mac80211: fix a null pointer deref when querying station info when rate control is...
[oweals/openwrt.git] / package / kernel / mac80211 / patches / 300-pending_work.patch
1 commit 38695a6e5a940e6a524523b88a33916b016fb2a1
2 Author: Felix Fietkau <nbd@openwrt.org>
3 Date:   Fri Jul 11 12:06:18 2014 +0200
4
5     mac80211: fix crash on getting sta info with uninitialized rate control
6     
7     If the expected throughput is queried before rate control has been
8     initialized, the minstrel op for it will crash while trying to access
9     the rate table.
10     Check for WLAN_STA_RATE_CONTROL before attempting to use the rate
11     control op.
12     
13     Reported-by: Jean-Pierre Tosoni <jp.tosoni@acksys.fr>
14     Signed-off-by: Felix Fietkau <nbd@openwrt.org>
15
16 commit c0ee7fa4c0da824ccccc172bf175fb1f86540921
17 Author: Felix Fietkau <nbd@openwrt.org>
18 Date:   Wed Jul 16 18:00:31 2014 +0200
19
20     ath9k: fix pending tx frames accounting
21     
22     Packets originally buffered for the regular hardware tx queues can end
23     up being transmitted through the U-APSD queue (via PS-Poll or U-APSD).
24     When packets are dropped due to retransmit failures, the pending frames
25     counter is not always updated properly.
26     Fix this by keeping track of the queue that a frame was accounted for in
27     the ath_frame_info struct, and using that on completion to decide
28     whether the counter should be updated.
29     This fixes some spurious transmit queue hangs.
30     
31     Cc: stable@vger.kernel.org
32     Signed-off-by: Felix Fietkau <nbd@openwrt.org>
33
34 commit edcdf0989410a05a6a4b8438df4010447eaa7d9a
35 Author: Felix Fietkau <nbd@openwrt.org>
36 Date:   Sun Jun 22 13:36:20 2014 +0200
37
38     Revert "cfg80211: Use 5MHz bandwidth by default when checking usable channels"
39     
40     It enables channels that are not supposed to be enabled according to the
41     regulatory rules.
42     
43     This reverts commit 8eca1fb692cc9557f386eddce75c300a3855d11a.
44
45 commit 6e7341074823d2a45b81f2742cbf75f1da790031
46 Author: Rafał Miłecki <zajec5@gmail.com>
47 Date:   Sat May 31 19:40:45 2014 +0200
48
49     b43: disable 5 GHz on G-PHY
50     
51     This fixes regression introduced by adding some G-PHY devices to the
52     list of dual band devices. There is simply no support for 5 GHz on
53     G-PHY devices in b43. It results in:
54     WARNING: CPU: 0 PID: 79 at drivers/net/wireless/b43/phy_g.c:75 b43_gphy_channel_switch+0x125/0x130 [b43]()
55     b43-phy1 ERROR: PHY init: Channel switch to default failed
56     
57     Regression was introduced by the following commit:
58     
59     commit 773cfc508f4d64c14547ff8751b5cbd473124364
60     Author: Rafał Miłecki <zajec5@gmail.com>
61     Date:   Mon May 19 23:18:55 2014 +0200
62     
63         b43: add more devices to the bands database
64     
65     Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
66     Signed-off-by: John W. Linville <linville@tuxdriver.com>
67
68 commit 1186edbef91f15722e5bdf56326ce0abc2935ce7
69 Author: Stanislaw Gruszka <sgruszka@redhat.com>
70 Date:   Tue Jun 10 12:51:06 2014 +0200
71
72     rt2x00: disable TKIP on USB
73     
74     On USB we can not get atomically TKIP key. We have to disable support
75     for TKIP acceleration on USB hardware to avoid bug as showed bellow.
76     
77     [  860.827243] BUG: scheduling while atomic: hostapd/3397/0x00000002
78     <snip>
79     [  860.827280] Call Trace:
80     [  860.827282]  [<ffffffff81682ea6>] dump_stack+0x4d/0x66
81     [  860.827284]  [<ffffffff8167eb9b>] __schedule_bug+0x47/0x55
82     [  860.827285]  [<ffffffff81685bb3>] __schedule+0x733/0x7b0
83     [  860.827287]  [<ffffffff81685c59>] schedule+0x29/0x70
84     [  860.827289]  [<ffffffff81684f8a>] schedule_timeout+0x15a/0x2b0
85     [  860.827291]  [<ffffffff8105ac50>] ? ftrace_raw_event_tick_stop+0xc0/0xc0
86     [  860.827294]  [<ffffffff810c13c2>] ? __module_text_address+0x12/0x70
87     [  860.827296]  [<ffffffff81686823>] wait_for_completion_timeout+0xb3/0x140
88     [  860.827298]  [<ffffffff81080fc0>] ? wake_up_state+0x20/0x20
89     [  860.827301]  [<ffffffff814d5b3d>] usb_start_wait_urb+0x7d/0x150
90     [  860.827303]  [<ffffffff814d5cd5>] usb_control_msg+0xc5/0x110
91     [  860.827305]  [<ffffffffa02fb0c6>] rt2x00usb_vendor_request+0xc6/0x160  [rt2x00usb]
92     [  860.827307]  [<ffffffffa02fb215>] rt2x00usb_vendor_req_buff_lock+0x75/0x150 [rt2x00usb]
93     [  860.827309]  [<ffffffffa02fb393>] rt2x00usb_vendor_request_buff+0xa3/0xe0 [rt2x00usb]
94     [  860.827311]  [<ffffffffa023d1a3>] rt2x00usb_register_multiread+0x33/0x40 [rt2800usb]
95     [  860.827314]  [<ffffffffa05805f9>] rt2800_get_tkip_seq+0x39/0x50  [rt2800lib]
96     [  860.827321]  [<ffffffffa0480f88>] ieee80211_get_key+0x218/0x2a0  [mac80211]
97     [  860.827322]  [<ffffffff815cc68c>] ? __nlmsg_put+0x6c/0x80
98     [  860.827329]  [<ffffffffa051b02e>] nl80211_get_key+0x22e/0x360 [cfg80211]
99     
100     Cc: stable@vger.kernel.org
101     Reported-and-tested-by: Peter Wu <lekensteyn@gmail.com>
102     Reported-and-tested-by: Pontus Fuchs <pontus.fuchs@gmail.com>
103     Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
104     Signed-off-by: John W. Linville <linville@tuxdriver.com>
105
106 commit 5f313a15da92dda80ac4c9a137bc42d7d0b49adf
107 Author: Rafał Miłecki <zajec5@gmail.com>
108 Date:   Thu Jun 12 09:28:38 2014 +0200
109
110     b43: fix frequency reported on G-PHY with /new/ firmware
111
112 commit d3a58df87a2e4c2301ac843604202d290a48440b
113 Author: Avraham Stern <avraham.stern@intel.com>
114 Date:   Thu May 22 12:17:47 2014 +0300
115
116     mac80211: set new interfaces as idle upon init
117     
118     Mark new interfaces as idle to allow operations that require that
119     interfaces are idle to take place. Interface types that are always
120     not idle (like AP interfaces) will be set as not idle when they are
121     assigned a channel context.
122     
123     Signed-off-by: Avraham Stern <avraham.stern@intel.com>
124     Signed-off-by: Emmanuel Grumbach<emmanuel.grumbach@intel.com>
125     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
126
127 commit 923eaf367206e01f22c97aee22300e332d071916
128 Author: Arik Nemtsov <arik@wizery.com>
129 Date:   Mon May 26 14:40:51 2014 +0300
130
131     mac80211: don't check netdev state for debugfs read/write
132     
133     Doing so will lead to an oops for a p2p-dev interface, since it has
134     no netdev.
135     
136     Cc: stable@vger.kernel.org
137     Signed-off-by: Arik Nemtsov <arikx.nemtsov@intel.com>
138     Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
139     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
140
141 commit a9fb54169b197f31aff24c8d6270dd1e56cde395
142 Author: chaitanya.mgit@gmail.com <chaitanya.mgit@gmail.com>
143 Date:   Mon May 26 18:01:44 2014 +0530
144
145     regdb: Generalize the mW to dBm power conversion
146     
147     Generalize the power conversion from mW to dBm
148     using log. This should fix the below compilation
149     error for country NO which adds a new power value
150     2000mW which is not handled earlier.
151     
152      CC [M]  net/wireless/wext-sme.o
153      CC [M]  net/wireless/regdb.o
154     net/wireless/regdb.c:1130:1: error: Unknown undeclared here (not in
155     a function)
156     net/wireless/regdb.c:1130:9: error: expected } before power
157     make[2]: *** [net/wireless/regdb.o] Error 1
158     make[1]: *** [net/wireless] Error 2
159     make: *** [net] Error 2
160     
161     Reported-By:  John Walker <john@x109.net>
162     Signed-off-by: Chaitanya T K <chaitanya.mgit@gmail.com>
163     Acked-by: John W. Linville <linville@tuxdriver.com>
164     [remove unneeded parentheses, fix rounding by using %.0f]
165     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
166
167 commit c7d37a66e345df2fdf1aa7b2c9a6d3d53846ca5b
168 Author: Krzysztof Hałasa <khalasa@piap.pl>
169 Date:   Mon May 26 14:14:46 2014 +0200
170
171     mac80211: fix IBSS join by initializing last_scan_completed
172     
173     Without this fix, freshly rebooted Linux creates a new IBSS
174     instead of joining an existing one. Only when jiffies counter
175     overflows after 5 minutes the IBSS can be successfully joined.
176     
177     Signed-off-by: Krzysztof Hałasa <khalasa@piap.pl>
178     [edit commit message slightly]
179     Cc: stable@vger.kernel.org
180     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
181
182 commit 34171dc0d623be2c1032416bf7d3819f388ed70d
183 Author: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
184 Date:   Sun May 25 15:35:41 2014 +0300
185
186     mac80211: fix virtual monitor interface addition
187     
188     Since the commit below, cfg80211_chandef_dfs_required()
189     will warn if it gets a an NL80211_IFTYPE_UNSPECIFIED iftype
190     as explicitely written in the commit log.
191     When an virtual monitor interface is added, its type is set
192     in ieee80211_sub_if_data.vif.type, but not in
193     ieee80211_sub_if_data.wdev.iftype which is passed to
194     cfg80211_chandef_dfs_required() hence resulting in the
195     following warning:
196     
197     WARNING: CPU: 1 PID: 21265 at net/wireless/chan.c:376 cfg80211_chandef_dfs_required+0xbc/0x130 [cfg80211]()
198     Modules linked in: [...]
199     CPU: 1 PID: 21265 Comm: ifconfig Tainted: G        W  O 3.13.11+ #12
200     Hardware name: Dell Inc. Latitude E6410/0667CC, BIOS A01 03/05/2010
201      0000000000000009 ffff88008f5fdb08 ffffffff817d4219 ffff88008f5fdb50
202      ffff88008f5fdb40 ffffffff8106f57d 0000000000000000 0000000000000000
203      ffff880081062fb8 ffff8800810604e0 0000000000000001 ffff88008f5fdba0
204     Call Trace:
205      [<ffffffff817d4219>] dump_stack+0x4d/0x66
206      [<ffffffff8106f57d>] warn_slowpath_common+0x7d/0xa0
207      [<ffffffff8106f5ec>] warn_slowpath_fmt+0x4c/0x50
208      [<ffffffffa04ea4ec>] cfg80211_chandef_dfs_required+0xbc/0x130 [cfg80211]
209      [<ffffffffa06b1024>] ieee80211_vif_use_channel+0x94/0x500 [mac80211]
210      [<ffffffffa0684e6b>] ieee80211_add_virtual_monitor+0x1ab/0x5c0 [mac80211]
211      [<ffffffffa0686ae5>] ieee80211_do_open+0xe75/0x1580 [mac80211]
212      [<ffffffffa0687259>] ieee80211_open+0x69/0x70 [mac80211]
213     [snip]
214     
215     Fixes: 00ec75fc5a64 ("cfg80211: pass the actual iftype when calling cfg80211_chandef_dfs_required()")
216     Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
217     Acked-by: Luciano Coelho <luciano.coelho@intel.com>
218     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
219
220 commit d93cc72b37b4e2c314e1c499e80e8801907c2fea
221 Author: Michal Kazior <michal.kazior@tieto.com>
222 Date:   Thu Jun 5 14:21:37 2014 +0200
223
224     mac80211: use csa counter offsets instead of csa_active
225     
226     vif->csa_active is protected by mutexes only. This
227     means it is unreliable to depend on it on codeflow
228     in non-sleepable beacon and CSA code. There was no
229     guarantee to have vif->csa_active update be
230     visible before beacons are updated on SMP systems.
231     
232     Using csa counter offsets which are embedded in
233     beacon struct (and thus are protected with single
234     RCU assignment) is much safer.
235     
236     Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
237     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
238
239 commit d2746694fcdef24e0a7a1947d8c70082cde81a26
240 Author: Michal Kazior <michal.kazior@tieto.com>
241 Date:   Thu Jun 5 14:21:36 2014 +0200
242
243     mac80211: move csa counters from sdata to beacon/presp
244     
245     Having csa counters part of beacon and probe_resp
246     structures makes it easier to get rid of possible
247     races between setting a beacon and updating
248     counters on SMP systems by guaranteeing counters
249     are always consistent against given beacon struct.
250     
251     While at it relax WARN_ON into WARN_ON_ONCE to
252     prevent spamming logs and racing.
253     
254     Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
255     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
256
257 commit 5dcb54f3a1a8cd7e0331e773487574f9743615db
258 Author: Janusz Dziedzic <janusz.dziedzic@tieto.com>
259 Date:   Thu Jun 5 08:12:57 2014 +0200
260
261     mac80211: allow tx via monitor iface when DFS
262     
263     Allow send frames using monitor interface
264     when DFS chandef and we pass CAC (beaconing
265     allowed).
266     
267     This fix problem when old kernel and new backports used,
268     in such case hostapd create/use also monitor interface.
269     Before this patch all frames hostapd send using monitor
270     iface were dropped when AP was configured on DFS channel.
271     
272     Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
273     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
274
275 commit 6f09a1beb0d2007572248c986780562219bd206f
276 Author: Johannes Berg <johannes.berg@intel.com>
277 Date:   Wed Jun 4 17:31:56 2014 +0200
278
279     cfg80211: make ethtool the driver's responsibility
280     
281     Currently, cfg80211 tries to implement ethtool, but that doesn't
282     really scale well, with all the different operations. Make the
283     lower-level driver responsible for it, which currently only has
284     an effect on mac80211. It will similarly not scale well at that
285     level though, since mac80211 also has many drivers.
286     
287     To cleanly implement this in mac80211, introduce a new file and
288     move some code to appropriate places.
289     
290     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
291
292 commit 6b0c6f133de8f90caeb1c4a902e6140567c5bf96
293 Author: Johannes Berg <johannes.berg@intel.com>
294 Date:   Wed Jun 4 17:06:23 2014 +0200
295
296     mac80211: remove weak WEP IV accounting
297     
298     Since WEP is practically dead, there seems very little
299     point in keeping WEP weak IV accounting.
300     
301     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
302
303 commit aecdc89fb4664c76baa4bbd46008f220532309ff
304 Author: Luciano Coelho <luciano.coelho@intel.com>
305 Date:   Fri May 23 11:04:50 2014 +0300
306
307     ath9k/ath10k: remove unnecessary channel_switch_beacon callbacks
308     
309     The channel_switch_beacon callback is optional, so it doesn't have to
310     be defined if it's not going to do anything useful with it.  Both
311     ath9k and ath10k define the callback and just returns.  This commit
312     removes them.
313     
314     Cc: Michal Kazior <michal.kazior@tieto.com>
315     Signed-off-by: Luciano Coelho <luciano.coelho@intel.com>
316     Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
317
318 commit 60ccc107c9b9fb732fdee1f76bb2dad44f0e1798
319 Author: Rajkumar Manoharan <rmanohar@qti.qualcomm.com>
320 Date:   Tue May 27 16:58:02 2014 +0530
321
322     ath9k: Fix deadlock while updating p2p beacon timer
323     
324     pm_lock is taken twice while syncing HW TSF of p2p vif.
325     Fix this by taking the lock at caller side.
326     
327     Cc: Felix Fietkau <nbd@openwrt.org>
328     Signed-off-by: Rajkumar Manoharan <rmanohar@qti.qualcomm.com>
329     Signed-off-by: John W. Linville <linville@tuxdriver.com>
330
331 commit f3831a4e3903dbc1a57d5df56deb6a143fd001bc
332 Author: Stanislaw Gruszka <sgruszka@redhat.com>
333 Date:   Thu Jun 5 13:52:27 2014 +0200
334
335     rt2x00: do not initialize BCN_OFFSET registers
336     
337     We setup BCN_OFFSET{0,1} registers dynamically, don't have to
338     initialize them.
339     
340     Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
341
342 commit e5c58ca7a48d4c82f282749a978052c47fd95998
343 Author: Stanislaw Gruszka <sgruszka@redhat.com>
344 Date:   Thu Jun 5 13:52:26 2014 +0200
345
346     rt2x00: change order when stop beaconing
347     
348     When no beaconing is needed, first stop beacon queue (disable beaconing
349     globally) to avoid possible sending of not prepared beacon on short
350     period after clearing beacon and before stop of BCN queue.
351     
352     Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
353
354 commit 382c1b9e03f52d0cd741ef1d942cad0f649f0744
355 Author: Stanislaw Gruszka <sgruszka@redhat.com>
356 Date:   Thu Jun 5 13:52:25 2014 +0200
357
358     rt2x00: change default MAC_BSSID_DW1_BSS_BCN_NUM
359     
360     We setup MAC_BSSID_DW1_BSS_BCN_NUM dynamically when numbers of active
361     beacons increase. Change default to 0 to tell hardware that we want to
362     send only one beacon as default.
363     
364     Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
365
366 commit 3b400571dd033e46fa7e76c5bb92a3ce8198afa9
367 Author: Stanislaw Gruszka <sgruszka@redhat.com>
368 Date:   Thu Jun 5 13:52:24 2014 +0200
369
370     rt2x00: change beaconing setup on RT2800
371     
372     As reported by Matthias, on 5572 chip, even if we clear up TXWI
373     of corresponding beacon, hardware still try to send it or do other
374     action that increase power consumption peak up to 1A.
375     
376     To avoid the issue, setup beaconing dynamically by configuring offsets
377     of currently active beacons and MAC_BSSID_DW1_BSS_BCN_NUM variable,
378     which limit number of beacons that hardware will try to send.
379     
380     Reported-by: Matthias Fend <Matthias.Fend@wolfvision.net>
381     Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
382
383 commit 916e591b2cc41f7e572992175ca56d866d7bc958
384 Author: Stanislaw Gruszka <sgruszka@redhat.com>
385 Date:   Thu Jun 5 13:52:23 2014 +0200
386
387     rt2x00: change beaconing locking
388     
389     This patch is needed for further changes to keep global variables
390     consistent when changing beaconing on diffrent vif's.
391     
392     Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
393
394 commit 930b0dffd1731f3f418f9132faea720a23b7af61
395 Author: Johannes Berg <johannes.berg@intel.com>
396 Date:   Tue Jun 3 11:18:47 2014 +0200
397
398     mac80211: fix station/driver powersave race
399     
400     It is currently possible to have a race due to the station PS
401     unblock work like this:
402      * station goes to sleep with frames buffered in the driver
403      * driver blocks wakeup
404      * station wakes up again
405      * driver flushes/returns frames, and unblocks, which schedules
406        the unblock work
407      * unblock work starts to run, and checks that the station is
408        awake (i.e. that the WLAN_STA_PS_STA flag isn't set)
409      * we process a received frame with PM=1, setting the flag again
410      * ieee80211_sta_ps_deliver_wakeup() runs, delivering all frames
411        to the driver, and then clearing the WLAN_STA_PS_DRIVER and
412        WLAN_STA_PS_STA flags
413     
414     In this scenario, mac80211 will think that the station is awake,
415     while it really is asleep, and any TX'ed frames should be filtered
416     by the device (it will know that the station is sleeping) but then
417     passed to mac80211 again, which will not buffer it either as it
418     thinks the station is awake, and eventually the packets will be
419     dropped.
420     
421     Fix this by moving the clearing of the flags to exactly where we
422     learn about the situation. This creates a problem of reordering,
423     so introduce another flag indicating that delivery is being done,
424     this new flag also queues frames and is cleared only while the
425     spinlock is held (which the queuing code also holds) so that any
426     concurrent delivery/TX is handled correctly.
427     
428     Reported-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
429     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
430
431 commit 6df35206bc6c1c6aad1d8077df5786b4a7f77873
432 Author: Felix Fietkau <nbd@openwrt.org>
433 Date:   Fri May 23 19:58:14 2014 +0200
434
435     mac80211: reduce packet loss notifications under load
436     
437     During strong signal fluctuations under high throughput, few consecutive
438     failed A-MPDU transmissions can easily trigger packet loss notification,
439     and thus (in AP mode) client disconnection.
440     
441     Reduce the number of false positives by checking the A-MPDU status flag
442     and treating a failed A-MPDU as a single packet.
443     
444     Signed-off-by: Felix Fietkau <nbd@openwrt.org>
445
446 commit 7b7843a36fbcc568834404c7430ff895d8502131
447 Author: Felix Fietkau <nbd@openwrt.org>
448 Date:   Fri May 23 19:26:32 2014 +0200
449
450     mac80211: fix a memory leak on sta rate selection table
451     
452     Cc: stable@vger.kernel.org
453     Reported-by: Christophe Prévotaux <cprevotaux@nltinc.com>
454     Signed-off-by: Felix Fietkau <nbd@openwrt.org>
455
456 commit 96892d6aa0a153423070addf3070bc79578b3897
457 Author: Felix Fietkau <nbd@openwrt.org>
458 Date:   Mon May 19 21:20:49 2014 +0200
459
460     ath9k: avoid passing buffers to the hardware during flush
461     
462     The commit "ath9k: fix possible hang on flush" changed the receive code
463     to always link rx descriptors of processed frames, even when flushing.
464     In some cases, this leads to flushed rx buffers being passed to the
465     hardware while rx is already stopped.
466     
467     Signed-off-by: Felix Fietkau <nbd@openwrt.org>
468
469 --- a/drivers/net/wireless/ath/ath9k/recv.c
470 +++ b/drivers/net/wireless/ath/ath9k/recv.c
471 @@ -34,7 +34,8 @@ static inline bool ath9k_check_auto_slee
472   * buffer (or rx fifo). This can incorrectly acknowledge packets
473   * to a sender if last desc is self-linked.
474   */
475 -static void ath_rx_buf_link(struct ath_softc *sc, struct ath_rxbuf *bf)
476 +static void ath_rx_buf_link(struct ath_softc *sc, struct ath_rxbuf *bf,
477 +                           bool flush)
478  {
479         struct ath_hw *ah = sc->sc_ah;
480         struct ath_common *common = ath9k_hw_common(ah);
481 @@ -59,18 +60,19 @@ static void ath_rx_buf_link(struct ath_s
482                              common->rx_bufsize,
483                              0);
484  
485 -       if (sc->rx.rxlink == NULL)
486 -               ath9k_hw_putrxbuf(ah, bf->bf_daddr);
487 -       else
488 +       if (sc->rx.rxlink)
489                 *sc->rx.rxlink = bf->bf_daddr;
490 +       else if (!flush)
491 +               ath9k_hw_putrxbuf(ah, bf->bf_daddr);
492  
493         sc->rx.rxlink = &ds->ds_link;
494  }
495  
496 -static void ath_rx_buf_relink(struct ath_softc *sc, struct ath_rxbuf *bf)
497 +static void ath_rx_buf_relink(struct ath_softc *sc, struct ath_rxbuf *bf,
498 +                             bool flush)
499  {
500         if (sc->rx.buf_hold)
501 -               ath_rx_buf_link(sc, sc->rx.buf_hold);
502 +               ath_rx_buf_link(sc, sc->rx.buf_hold, flush);
503  
504         sc->rx.buf_hold = bf;
505  }
506 @@ -442,7 +444,7 @@ int ath_startrecv(struct ath_softc *sc)
507         sc->rx.buf_hold = NULL;
508         sc->rx.rxlink = NULL;
509         list_for_each_entry_safe(bf, tbf, &sc->rx.rxbuf, list) {
510 -               ath_rx_buf_link(sc, bf);
511 +               ath_rx_buf_link(sc, bf, false);
512         }
513  
514         /* We could have deleted elements so the list may be empty now */
515 @@ -1118,12 +1120,12 @@ requeue_drop_frag:
516  requeue:
517                 list_add_tail(&bf->list, &sc->rx.rxbuf);
518  
519 -               if (edma) {
520 -                       ath_rx_edma_buf_link(sc, qtype);
521 -               } else {
522 -                       ath_rx_buf_relink(sc, bf);
523 +               if (!edma) {
524 +                       ath_rx_buf_relink(sc, bf, flush);
525                         if (!flush)
526                                 ath9k_hw_rxena(ah);
527 +               } else if (!flush) {
528 +                       ath_rx_edma_buf_link(sc, qtype);
529                 }
530  
531                 if (!budget--)
532 --- a/net/mac80211/sta_info.c
533 +++ b/net/mac80211/sta_info.c
534 @@ -100,7 +100,8 @@ static void __cleanup_single_sta(struct 
535         struct ps_data *ps;
536  
537         if (test_sta_flag(sta, WLAN_STA_PS_STA) ||
538 -           test_sta_flag(sta, WLAN_STA_PS_DRIVER)) {
539 +           test_sta_flag(sta, WLAN_STA_PS_DRIVER) ||
540 +           test_sta_flag(sta, WLAN_STA_PS_DELIVER)) {
541                 if (sta->sdata->vif.type == NL80211_IFTYPE_AP ||
542                     sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
543                         ps = &sdata->bss->ps;
544 @@ -111,6 +112,7 @@ static void __cleanup_single_sta(struct 
545  
546                 clear_sta_flag(sta, WLAN_STA_PS_STA);
547                 clear_sta_flag(sta, WLAN_STA_PS_DRIVER);
548 +               clear_sta_flag(sta, WLAN_STA_PS_DELIVER);
549  
550                 atomic_dec(&ps->num_sta_ps);
551                 sta_info_recalc_tim(sta);
552 @@ -125,7 +127,7 @@ static void __cleanup_single_sta(struct 
553         if (ieee80211_vif_is_mesh(&sdata->vif))
554                 mesh_sta_cleanup(sta);
555  
556 -       cancel_work_sync(&sta->drv_unblock_wk);
557 +       cancel_work_sync(&sta->drv_deliver_wk);
558  
559         /*
560          * Destroy aggregation state here. It would be nice to wait for the
561 @@ -227,6 +229,7 @@ struct sta_info *sta_info_get_by_idx(str
562   */
563  void sta_info_free(struct ieee80211_local *local, struct sta_info *sta)
564  {
565 +       struct ieee80211_sta_rates *rates;
566         int i;
567  
568         if (sta->rate_ctrl)
569 @@ -238,6 +241,10 @@ void sta_info_free(struct ieee80211_loca
570                 kfree(sta->tx_lat);
571         }
572  
573 +       rates = rcu_dereference_protected(sta->sta.rates, true);
574 +       if (rates)
575 +               kfree(rates);
576 +
577         sta_dbg(sta->sdata, "Destroyed STA %pM\n", sta->sta.addr);
578  
579         kfree(sta);
580 @@ -252,33 +259,23 @@ static void sta_info_hash_add(struct iee
581         rcu_assign_pointer(local->sta_hash[STA_HASH(sta->sta.addr)], sta);
582  }
583  
584 -static void sta_unblock(struct work_struct *wk)
585 +static void sta_deliver_ps_frames(struct work_struct *wk)
586  {
587         struct sta_info *sta;
588  
589 -       sta = container_of(wk, struct sta_info, drv_unblock_wk);
590 +       sta = container_of(wk, struct sta_info, drv_deliver_wk);
591  
592         if (sta->dead)
593                 return;
594  
595 -       if (!test_sta_flag(sta, WLAN_STA_PS_STA)) {
596 -               local_bh_disable();
597 +       local_bh_disable();
598 +       if (!test_sta_flag(sta, WLAN_STA_PS_STA))
599                 ieee80211_sta_ps_deliver_wakeup(sta);
600 -               local_bh_enable();
601 -       } else if (test_and_clear_sta_flag(sta, WLAN_STA_PSPOLL)) {
602 -               clear_sta_flag(sta, WLAN_STA_PS_DRIVER);
603 -
604 -               local_bh_disable();
605 +       else if (test_and_clear_sta_flag(sta, WLAN_STA_PSPOLL))
606                 ieee80211_sta_ps_deliver_poll_response(sta);
607 -               local_bh_enable();
608 -       } else if (test_and_clear_sta_flag(sta, WLAN_STA_UAPSD)) {
609 -               clear_sta_flag(sta, WLAN_STA_PS_DRIVER);
610 -
611 -               local_bh_disable();
612 +       else if (test_and_clear_sta_flag(sta, WLAN_STA_UAPSD))
613                 ieee80211_sta_ps_deliver_uapsd(sta);
614 -               local_bh_enable();
615 -       } else
616 -               clear_sta_flag(sta, WLAN_STA_PS_DRIVER);
617 +       local_bh_enable();
618  }
619  
620  static int sta_prepare_rate_control(struct ieee80211_local *local,
621 @@ -340,7 +337,7 @@ struct sta_info *sta_info_alloc(struct i
622  
623         spin_lock_init(&sta->lock);
624         spin_lock_init(&sta->ps_lock);
625 -       INIT_WORK(&sta->drv_unblock_wk, sta_unblock);
626 +       INIT_WORK(&sta->drv_deliver_wk, sta_deliver_ps_frames);
627         INIT_WORK(&sta->ampdu_mlme.work, ieee80211_ba_session_work);
628         mutex_init(&sta->ampdu_mlme.mtx);
629  #ifdef CPTCFG_MAC80211_MESH
630 @@ -1140,8 +1137,15 @@ void ieee80211_sta_ps_deliver_wakeup(str
631         }
632  
633         ieee80211_add_pending_skbs(local, &pending);
634 -       clear_sta_flag(sta, WLAN_STA_PS_DRIVER);
635 -       clear_sta_flag(sta, WLAN_STA_PS_STA);
636 +
637 +       /* now we're no longer in the deliver code */
638 +       clear_sta_flag(sta, WLAN_STA_PS_DELIVER);
639 +
640 +       /* The station might have polled and then woken up before we responded,
641 +        * so clear these flags now to avoid them sticking around.
642 +        */
643 +       clear_sta_flag(sta, WLAN_STA_PSPOLL);
644 +       clear_sta_flag(sta, WLAN_STA_UAPSD);
645         spin_unlock(&sta->ps_lock);
646  
647         atomic_dec(&ps->num_sta_ps);
648 @@ -1542,10 +1546,26 @@ void ieee80211_sta_block_awake(struct ie
649  
650         trace_api_sta_block_awake(sta->local, pubsta, block);
651  
652 -       if (block)
653 +       if (block) {
654                 set_sta_flag(sta, WLAN_STA_PS_DRIVER);
655 -       else if (test_sta_flag(sta, WLAN_STA_PS_DRIVER))
656 -               ieee80211_queue_work(hw, &sta->drv_unblock_wk);
657 +               return;
658 +       }
659 +
660 +       if (!test_sta_flag(sta, WLAN_STA_PS_DRIVER))
661 +               return;
662 +
663 +       if (!test_sta_flag(sta, WLAN_STA_PS_STA)) {
664 +               set_sta_flag(sta, WLAN_STA_PS_DELIVER);
665 +               clear_sta_flag(sta, WLAN_STA_PS_DRIVER);
666 +               ieee80211_queue_work(hw, &sta->drv_deliver_wk);
667 +       } else if (test_sta_flag(sta, WLAN_STA_PSPOLL) ||
668 +                  test_sta_flag(sta, WLAN_STA_UAPSD)) {
669 +               /* must be asleep in this case */
670 +               clear_sta_flag(sta, WLAN_STA_PS_DRIVER);
671 +               ieee80211_queue_work(hw, &sta->drv_deliver_wk);
672 +       } else {
673 +               clear_sta_flag(sta, WLAN_STA_PS_DRIVER);
674 +       }
675  }
676  EXPORT_SYMBOL(ieee80211_sta_block_awake);
677  
678 @@ -1703,3 +1723,140 @@ u8 sta_info_tx_streams(struct sta_info *
679         return ((ht_cap->mcs.tx_params & IEEE80211_HT_MCS_TX_MAX_STREAMS_MASK)
680                         >> IEEE80211_HT_MCS_TX_MAX_STREAMS_SHIFT) + 1;
681  }
682 +
683 +void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
684 +{
685 +       struct ieee80211_sub_if_data *sdata = sta->sdata;
686 +       struct ieee80211_local *local = sdata->local;
687 +       struct rate_control_ref *ref = NULL;
688 +       struct timespec uptime;
689 +       u64 packets = 0;
690 +       u32 thr = 0;
691 +       int i, ac;
692 +
693 +       if (test_sta_flag(sta, WLAN_STA_RATE_CONTROL))
694 +               ref = local->rate_ctrl;
695 +
696 +       sinfo->generation = sdata->local->sta_generation;
697 +
698 +       sinfo->filled = STATION_INFO_INACTIVE_TIME |
699 +                       STATION_INFO_RX_BYTES64 |
700 +                       STATION_INFO_TX_BYTES64 |
701 +                       STATION_INFO_RX_PACKETS |
702 +                       STATION_INFO_TX_PACKETS |
703 +                       STATION_INFO_TX_RETRIES |
704 +                       STATION_INFO_TX_FAILED |
705 +                       STATION_INFO_TX_BITRATE |
706 +                       STATION_INFO_RX_BITRATE |
707 +                       STATION_INFO_RX_DROP_MISC |
708 +                       STATION_INFO_BSS_PARAM |
709 +                       STATION_INFO_CONNECTED_TIME |
710 +                       STATION_INFO_STA_FLAGS |
711 +                       STATION_INFO_BEACON_LOSS_COUNT;
712 +
713 +       do_posix_clock_monotonic_gettime(&uptime);
714 +       sinfo->connected_time = uptime.tv_sec - sta->last_connected;
715 +
716 +       sinfo->inactive_time = jiffies_to_msecs(jiffies - sta->last_rx);
717 +       sinfo->tx_bytes = 0;
718 +       for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
719 +               sinfo->tx_bytes += sta->tx_bytes[ac];
720 +               packets += sta->tx_packets[ac];
721 +       }
722 +       sinfo->tx_packets = packets;
723 +       sinfo->rx_bytes = sta->rx_bytes;
724 +       sinfo->rx_packets = sta->rx_packets;
725 +       sinfo->tx_retries = sta->tx_retry_count;
726 +       sinfo->tx_failed = sta->tx_retry_failed;
727 +       sinfo->rx_dropped_misc = sta->rx_dropped;
728 +       sinfo->beacon_loss_count = sta->beacon_loss_count;
729 +
730 +       if ((sta->local->hw.flags & IEEE80211_HW_SIGNAL_DBM) ||
731 +           (sta->local->hw.flags & IEEE80211_HW_SIGNAL_UNSPEC)) {
732 +               sinfo->filled |= STATION_INFO_SIGNAL | STATION_INFO_SIGNAL_AVG;
733 +               if (!local->ops->get_rssi ||
734 +                   drv_get_rssi(local, sdata, &sta->sta, &sinfo->signal))
735 +                       sinfo->signal = (s8)sta->last_signal;
736 +               sinfo->signal_avg = (s8) -ewma_read(&sta->avg_signal);
737 +       }
738 +       if (sta->chains) {
739 +               sinfo->filled |= STATION_INFO_CHAIN_SIGNAL |
740 +                                STATION_INFO_CHAIN_SIGNAL_AVG;
741 +
742 +               sinfo->chains = sta->chains;
743 +               for (i = 0; i < ARRAY_SIZE(sinfo->chain_signal); i++) {
744 +                       sinfo->chain_signal[i] = sta->chain_signal_last[i];
745 +                       sinfo->chain_signal_avg[i] =
746 +                               (s8) -ewma_read(&sta->chain_signal_avg[i]);
747 +               }
748 +       }
749 +
750 +       sta_set_rate_info_tx(sta, &sta->last_tx_rate, &sinfo->txrate);
751 +       sta_set_rate_info_rx(sta, &sinfo->rxrate);
752 +
753 +       if (ieee80211_vif_is_mesh(&sdata->vif)) {
754 +#ifdef CPTCFG_MAC80211_MESH
755 +               sinfo->filled |= STATION_INFO_LLID |
756 +                                STATION_INFO_PLID |
757 +                                STATION_INFO_PLINK_STATE |
758 +                                STATION_INFO_LOCAL_PM |
759 +                                STATION_INFO_PEER_PM |
760 +                                STATION_INFO_NONPEER_PM;
761 +
762 +               sinfo->llid = sta->llid;
763 +               sinfo->plid = sta->plid;
764 +               sinfo->plink_state = sta->plink_state;
765 +               if (test_sta_flag(sta, WLAN_STA_TOFFSET_KNOWN)) {
766 +                       sinfo->filled |= STATION_INFO_T_OFFSET;
767 +                       sinfo->t_offset = sta->t_offset;
768 +               }
769 +               sinfo->local_pm = sta->local_pm;
770 +               sinfo->peer_pm = sta->peer_pm;
771 +               sinfo->nonpeer_pm = sta->nonpeer_pm;
772 +#endif
773 +       }
774 +
775 +       sinfo->bss_param.flags = 0;
776 +       if (sdata->vif.bss_conf.use_cts_prot)
777 +               sinfo->bss_param.flags |= BSS_PARAM_FLAGS_CTS_PROT;
778 +       if (sdata->vif.bss_conf.use_short_preamble)
779 +               sinfo->bss_param.flags |= BSS_PARAM_FLAGS_SHORT_PREAMBLE;
780 +       if (sdata->vif.bss_conf.use_short_slot)
781 +               sinfo->bss_param.flags |= BSS_PARAM_FLAGS_SHORT_SLOT_TIME;
782 +       sinfo->bss_param.dtim_period = sdata->local->hw.conf.ps_dtim_period;
783 +       sinfo->bss_param.beacon_interval = sdata->vif.bss_conf.beacon_int;
784 +
785 +       sinfo->sta_flags.set = 0;
786 +       sinfo->sta_flags.mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
787 +                               BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
788 +                               BIT(NL80211_STA_FLAG_WME) |
789 +                               BIT(NL80211_STA_FLAG_MFP) |
790 +                               BIT(NL80211_STA_FLAG_AUTHENTICATED) |
791 +                               BIT(NL80211_STA_FLAG_ASSOCIATED) |
792 +                               BIT(NL80211_STA_FLAG_TDLS_PEER);
793 +       if (test_sta_flag(sta, WLAN_STA_AUTHORIZED))
794 +               sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_AUTHORIZED);
795 +       if (test_sta_flag(sta, WLAN_STA_SHORT_PREAMBLE))
796 +               sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_SHORT_PREAMBLE);
797 +       if (test_sta_flag(sta, WLAN_STA_WME))
798 +               sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_WME);
799 +       if (test_sta_flag(sta, WLAN_STA_MFP))
800 +               sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_MFP);
801 +       if (test_sta_flag(sta, WLAN_STA_AUTH))
802 +               sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_AUTHENTICATED);
803 +       if (test_sta_flag(sta, WLAN_STA_ASSOC))
804 +               sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_ASSOCIATED);
805 +       if (test_sta_flag(sta, WLAN_STA_TDLS_PEER))
806 +               sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_TDLS_PEER);
807 +
808 +       /* check if the driver has a SW RC implementation */
809 +       if (ref && ref->ops->get_expected_throughput)
810 +               thr = ref->ops->get_expected_throughput(sta->rate_ctrl_priv);
811 +       else
812 +               thr = drv_get_expected_throughput(local, &sta->sta);
813 +
814 +       if (thr != 0) {
815 +               sinfo->filled |= STATION_INFO_EXPECTED_THROUGHPUT;
816 +               sinfo->expected_throughput = thr;
817 +       }
818 +}
819 --- a/net/mac80211/status.c
820 +++ b/net/mac80211/status.c
821 @@ -541,6 +541,23 @@ static void ieee80211_tx_latency_end_msr
822   */
823  #define STA_LOST_PKT_THRESHOLD 50
824  
825 +static void ieee80211_lost_packet(struct sta_info *sta, struct sk_buff *skb)
826 +{
827 +       struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
828 +
829 +       /* This packet was aggregated but doesn't carry status info */
830 +       if ((info->flags & IEEE80211_TX_CTL_AMPDU) &&
831 +           !(info->flags & IEEE80211_TX_STAT_AMPDU))
832 +               return;
833 +
834 +       if (++sta->lost_packets < STA_LOST_PKT_THRESHOLD)
835 +               return;
836 +
837 +       cfg80211_cqm_pktloss_notify(sta->sdata->dev, sta->sta.addr,
838 +                                   sta->lost_packets, GFP_ATOMIC);
839 +       sta->lost_packets = 0;
840 +}
841 +
842  void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
843  {
844         struct sk_buff *skb2;
845 @@ -680,12 +697,8 @@ void ieee80211_tx_status(struct ieee8021
846                         if (info->flags & IEEE80211_TX_STAT_ACK) {
847                                 if (sta->lost_packets)
848                                         sta->lost_packets = 0;
849 -                       } else if (++sta->lost_packets >= STA_LOST_PKT_THRESHOLD) {
850 -                               cfg80211_cqm_pktloss_notify(sta->sdata->dev,
851 -                                                           sta->sta.addr,
852 -                                                           sta->lost_packets,
853 -                                                           GFP_ATOMIC);
854 -                               sta->lost_packets = 0;
855 +                       } else {
856 +                               ieee80211_lost_packet(sta, skb);
857                         }
858                 }
859  
860 --- a/net/mac80211/rx.c
861 +++ b/net/mac80211/rx.c
862 @@ -1107,6 +1107,8 @@ static void sta_ps_end(struct sta_info *
863                 return;
864         }
865  
866 +       set_sta_flag(sta, WLAN_STA_PS_DELIVER);
867 +       clear_sta_flag(sta, WLAN_STA_PS_STA);
868         ieee80211_sta_ps_deliver_wakeup(sta);
869  }
870  
871 --- a/net/mac80211/sta_info.h
872 +++ b/net/mac80211/sta_info.h
873 @@ -82,6 +82,7 @@ enum ieee80211_sta_info_flags {
874         WLAN_STA_TOFFSET_KNOWN,
875         WLAN_STA_MPSP_OWNER,
876         WLAN_STA_MPSP_RECIPIENT,
877 +       WLAN_STA_PS_DELIVER,
878  };
879  
880  #define ADDBA_RESP_INTERVAL HZ
881 @@ -265,7 +266,7 @@ struct ieee80211_tx_latency_stat {
882   * @last_rx_rate_vht_nss: rx status nss of last data packet
883   * @lock: used for locking all fields that require locking, see comments
884   *     in the header file.
885 - * @drv_unblock_wk: used for driver PS unblocking
886 + * @drv_deliver_wk: used for delivering frames after driver PS unblocking
887   * @listen_interval: listen interval of this station, when we're acting as AP
888   * @_flags: STA flags, see &enum ieee80211_sta_info_flags, do not use directly
889   * @ps_lock: used for powersave (when mac80211 is the AP) related locking
890 @@ -278,7 +279,6 @@ struct ieee80211_tx_latency_stat {
891   * @driver_buffered_tids: bitmap of TIDs the driver has data buffered on
892   * @rx_packets: Number of MSDUs received from this STA
893   * @rx_bytes: Number of bytes received from this STA
894 - * @wep_weak_iv_count: number of weak WEP IVs received from this station
895   * @last_rx: time (in jiffies) when last frame was received from this STA
896   * @last_connected: time (in seconds) when a station got connected
897   * @num_duplicates: number of duplicate frames received from this STA
898 @@ -345,7 +345,7 @@ struct sta_info {
899         void *rate_ctrl_priv;
900         spinlock_t lock;
901  
902 -       struct work_struct drv_unblock_wk;
903 +       struct work_struct drv_deliver_wk;
904  
905         u16 listen_interval;
906  
907 @@ -367,7 +367,6 @@ struct sta_info {
908         /* Updated from RX path only, no locking requirements */
909         unsigned long rx_packets;
910         u64 rx_bytes;
911 -       unsigned long wep_weak_iv_count;
912         unsigned long last_rx;
913         long last_connected;
914         unsigned long num_duplicates;
915 @@ -628,6 +627,8 @@ void sta_set_rate_info_tx(struct sta_inf
916                           struct rate_info *rinfo);
917  void sta_set_rate_info_rx(struct sta_info *sta,
918                           struct rate_info *rinfo);
919 +void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo);
920 +
921  void ieee80211_sta_expire(struct ieee80211_sub_if_data *sdata,
922                           unsigned long exp_time);
923  u8 sta_info_tx_streams(struct sta_info *sta);
924 --- a/net/mac80211/tx.c
925 +++ b/net/mac80211/tx.c
926 @@ -469,7 +469,8 @@ ieee80211_tx_h_unicast_ps_buf(struct iee
927                 return TX_CONTINUE;
928  
929         if (unlikely((test_sta_flag(sta, WLAN_STA_PS_STA) ||
930 -                     test_sta_flag(sta, WLAN_STA_PS_DRIVER)) &&
931 +                     test_sta_flag(sta, WLAN_STA_PS_DRIVER) ||
932 +                     test_sta_flag(sta, WLAN_STA_PS_DELIVER)) &&
933                      !(info->flags & IEEE80211_TX_CTL_NO_PS_BUFFER))) {
934                 int ac = skb_get_queue_mapping(tx->skb);
935  
936 @@ -486,7 +487,8 @@ ieee80211_tx_h_unicast_ps_buf(struct iee
937                  * ahead and Tx the packet.
938                  */
939                 if (!test_sta_flag(sta, WLAN_STA_PS_STA) &&
940 -                   !test_sta_flag(sta, WLAN_STA_PS_DRIVER)) {
941 +                   !test_sta_flag(sta, WLAN_STA_PS_DRIVER) &&
942 +                   !test_sta_flag(sta, WLAN_STA_PS_DELIVER)) {
943                         spin_unlock(&sta->ps_lock);
944                         return TX_CONTINUE;
945                 }
946 @@ -1618,12 +1620,12 @@ netdev_tx_t ieee80211_monitor_start_xmit
947  {
948         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
949         struct ieee80211_chanctx_conf *chanctx_conf;
950 -       struct ieee80211_channel *chan;
951         struct ieee80211_radiotap_header *prthdr =
952                 (struct ieee80211_radiotap_header *)skb->data;
953         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
954         struct ieee80211_hdr *hdr;
955         struct ieee80211_sub_if_data *tmp_sdata, *sdata;
956 +       struct cfg80211_chan_def *chandef;
957         u16 len_rthdr;
958         int hdrlen;
959  
960 @@ -1721,9 +1723,9 @@ netdev_tx_t ieee80211_monitor_start_xmit
961         }
962  
963         if (chanctx_conf)
964 -               chan = chanctx_conf->def.chan;
965 +               chandef = &chanctx_conf->def;
966         else if (!local->use_chanctx)
967 -               chan = local->_oper_chandef.chan;
968 +               chandef = &local->_oper_chandef;
969         else
970                 goto fail_rcu;
971  
972 @@ -1743,10 +1745,11 @@ netdev_tx_t ieee80211_monitor_start_xmit
973          * radar detection by itself. We can do that later by adding a
974          * monitor flag interfaces used for AP support.
975          */
976 -       if ((chan->flags & (IEEE80211_CHAN_NO_IR | IEEE80211_CHAN_RADAR)))
977 +       if (!cfg80211_reg_can_beacon(local->hw.wiphy, chandef,
978 +                                    sdata->vif.type))
979                 goto fail_rcu;
980  
981 -       ieee80211_xmit(sdata, skb, chan->band);
982 +       ieee80211_xmit(sdata, skb, chandef->chan->band);
983         rcu_read_unlock();
984  
985         return NETDEV_TX_OK;
986 @@ -2425,7 +2428,7 @@ static void ieee80211_set_csa(struct iee
987         u8 *beacon_data;
988         size_t beacon_data_len;
989         int i;
990 -       u8 count = sdata->csa_current_counter;
991 +       u8 count = beacon->csa_current_counter;
992  
993         switch (sdata->vif.type) {
994         case NL80211_IFTYPE_AP:
995 @@ -2444,46 +2447,54 @@ static void ieee80211_set_csa(struct iee
996                 return;
997         }
998  
999 +       rcu_read_lock();
1000         for (i = 0; i < IEEE80211_MAX_CSA_COUNTERS_NUM; ++i) {
1001 -               u16 counter_offset_beacon =
1002 -                       sdata->csa_counter_offset_beacon[i];
1003 -               u16 counter_offset_presp = sdata->csa_counter_offset_presp[i];
1004 -
1005 -               if (counter_offset_beacon) {
1006 -                       if (WARN_ON(counter_offset_beacon >= beacon_data_len))
1007 -                               return;
1008 -
1009 -                       beacon_data[counter_offset_beacon] = count;
1010 -               }
1011 -
1012 -               if (sdata->vif.type == NL80211_IFTYPE_AP &&
1013 -                   counter_offset_presp) {
1014 -                       rcu_read_lock();
1015 -                       resp = rcu_dereference(sdata->u.ap.probe_resp);
1016 +               resp = rcu_dereference(sdata->u.ap.probe_resp);
1017  
1018 -                       /* If nl80211 accepted the offset, this should
1019 -                        * not happen.
1020 -                        */
1021 -                       if (WARN_ON(!resp)) {
1022 +               if (beacon->csa_counter_offsets[i]) {
1023 +                       if (WARN_ON_ONCE(beacon->csa_counter_offsets[i] >=
1024 +                                        beacon_data_len)) {
1025                                 rcu_read_unlock();
1026                                 return;
1027                         }
1028 -                       resp->data[counter_offset_presp] = count;
1029 -                       rcu_read_unlock();
1030 +
1031 +                       beacon_data[beacon->csa_counter_offsets[i]] = count;
1032                 }
1033 +
1034 +               if (sdata->vif.type == NL80211_IFTYPE_AP && resp &&
1035 +                   resp->csa_counter_offsets)
1036 +                       resp->data[resp->csa_counter_offsets[i]] = count;
1037         }
1038 +       rcu_read_unlock();
1039  }
1040  
1041  u8 ieee80211_csa_update_counter(struct ieee80211_vif *vif)
1042  {
1043         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
1044 +       struct beacon_data *beacon = NULL;
1045 +       u8 count = 0;
1046 +
1047 +       rcu_read_lock();
1048 +
1049 +       if (sdata->vif.type == NL80211_IFTYPE_AP)
1050 +               beacon = rcu_dereference(sdata->u.ap.beacon);
1051 +       else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
1052 +               beacon = rcu_dereference(sdata->u.ibss.presp);
1053 +       else if (ieee80211_vif_is_mesh(&sdata->vif))
1054 +               beacon = rcu_dereference(sdata->u.mesh.beacon);
1055 +
1056 +       if (!beacon)
1057 +               goto unlock;
1058  
1059 -       sdata->csa_current_counter--;
1060 +       beacon->csa_current_counter--;
1061  
1062         /* the counter should never reach 0 */
1063 -       WARN_ON(!sdata->csa_current_counter);
1064 +       WARN_ON_ONCE(!beacon->csa_current_counter);
1065 +       count = beacon->csa_current_counter;
1066  
1067 -       return sdata->csa_current_counter;
1068 +unlock:
1069 +       rcu_read_unlock();
1070 +       return count;
1071  }
1072  EXPORT_SYMBOL(ieee80211_csa_update_counter);
1073  
1074 @@ -2493,7 +2504,6 @@ bool ieee80211_csa_is_complete(struct ie
1075         struct beacon_data *beacon = NULL;
1076         u8 *beacon_data;
1077         size_t beacon_data_len;
1078 -       int counter_beacon = sdata->csa_counter_offset_beacon[0];
1079         int ret = false;
1080  
1081         if (!ieee80211_sdata_running(sdata))
1082 @@ -2531,10 +2541,13 @@ bool ieee80211_csa_is_complete(struct ie
1083                 goto out;
1084         }
1085  
1086 -       if (WARN_ON(counter_beacon > beacon_data_len))
1087 +       if (!beacon->csa_counter_offsets[0])
1088 +               goto out;
1089 +
1090 +       if (WARN_ON_ONCE(beacon->csa_counter_offsets[0] > beacon_data_len))
1091                 goto out;
1092  
1093 -       if (beacon_data[counter_beacon] == 1)
1094 +       if (beacon_data[beacon->csa_counter_offsets[0]] == 1)
1095                 ret = true;
1096   out:
1097         rcu_read_unlock();
1098 @@ -2550,6 +2563,7 @@ __ieee80211_beacon_get(struct ieee80211_
1099                        bool is_template)
1100  {
1101         struct ieee80211_local *local = hw_to_local(hw);
1102 +       struct beacon_data *beacon = NULL;
1103         struct sk_buff *skb = NULL;
1104         struct ieee80211_tx_info *info;
1105         struct ieee80211_sub_if_data *sdata = NULL;
1106 @@ -2571,10 +2585,10 @@ __ieee80211_beacon_get(struct ieee80211_
1107  
1108         if (sdata->vif.type == NL80211_IFTYPE_AP) {
1109                 struct ieee80211_if_ap *ap = &sdata->u.ap;
1110 -               struct beacon_data *beacon = rcu_dereference(ap->beacon);
1111  
1112 +               beacon = rcu_dereference(ap->beacon);
1113                 if (beacon) {
1114 -                       if (sdata->vif.csa_active) {
1115 +                       if (beacon->csa_counter_offsets[0]) {
1116                                 if (!is_template)
1117                                         ieee80211_csa_update_counter(vif);
1118  
1119 @@ -2615,37 +2629,37 @@ __ieee80211_beacon_get(struct ieee80211_
1120         } else if (sdata->vif.type == NL80211_IFTYPE_ADHOC) {
1121                 struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
1122                 struct ieee80211_hdr *hdr;
1123 -               struct beacon_data *presp = rcu_dereference(ifibss->presp);
1124  
1125 -               if (!presp)
1126 +               beacon = rcu_dereference(ifibss->presp);
1127 +               if (!beacon)
1128                         goto out;
1129  
1130 -               if (sdata->vif.csa_active) {
1131 +               if (beacon->csa_counter_offsets[0]) {
1132                         if (!is_template)
1133                                 ieee80211_csa_update_counter(vif);
1134  
1135 -                       ieee80211_set_csa(sdata, presp);
1136 +                       ieee80211_set_csa(sdata, beacon);
1137                 }
1138  
1139 -               skb = dev_alloc_skb(local->tx_headroom + presp->head_len +
1140 +               skb = dev_alloc_skb(local->tx_headroom + beacon->head_len +
1141                                     local->hw.extra_beacon_tailroom);
1142                 if (!skb)
1143                         goto out;
1144                 skb_reserve(skb, local->tx_headroom);
1145 -               memcpy(skb_put(skb, presp->head_len), presp->head,
1146 -                      presp->head_len);
1147 +               memcpy(skb_put(skb, beacon->head_len), beacon->head,
1148 +                      beacon->head_len);
1149  
1150                 hdr = (struct ieee80211_hdr *) skb->data;
1151                 hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
1152                                                  IEEE80211_STYPE_BEACON);
1153         } else if (ieee80211_vif_is_mesh(&sdata->vif)) {
1154                 struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
1155 -               struct beacon_data *bcn = rcu_dereference(ifmsh->beacon);
1156  
1157 -               if (!bcn)
1158 +               beacon = rcu_dereference(ifmsh->beacon);
1159 +               if (!beacon)
1160                         goto out;
1161  
1162 -               if (sdata->vif.csa_active) {
1163 +               if (beacon->csa_counter_offsets[0]) {
1164                         if (!is_template)
1165                                 /* TODO: For mesh csa_counter is in TU, so
1166                                  * decrementing it by one isn't correct, but
1167 @@ -2654,40 +2668,42 @@ __ieee80211_beacon_get(struct ieee80211_
1168                                  */
1169                                 ieee80211_csa_update_counter(vif);
1170  
1171 -                       ieee80211_set_csa(sdata, bcn);
1172 +                       ieee80211_set_csa(sdata, beacon);
1173                 }
1174  
1175                 if (ifmsh->sync_ops)
1176 -                       ifmsh->sync_ops->adjust_tbtt(sdata, bcn);
1177 +                       ifmsh->sync_ops->adjust_tbtt(sdata, beacon);
1178  
1179                 skb = dev_alloc_skb(local->tx_headroom +
1180 -                                   bcn->head_len +
1181 +                                   beacon->head_len +
1182                                     256 + /* TIM IE */
1183 -                                   bcn->tail_len +
1184 +                                   beacon->tail_len +
1185                                     local->hw.extra_beacon_tailroom);
1186                 if (!skb)
1187                         goto out;
1188                 skb_reserve(skb, local->tx_headroom);
1189 -               memcpy(skb_put(skb, bcn->head_len), bcn->head, bcn->head_len);
1190 +               memcpy(skb_put(skb, beacon->head_len), beacon->head,
1191 +                      beacon->head_len);
1192                 ieee80211_beacon_add_tim(sdata, &ifmsh->ps, skb, is_template);
1193  
1194                 if (offs) {
1195 -                       offs->tim_offset = bcn->head_len;
1196 -                       offs->tim_length = skb->len - bcn->head_len;
1197 +                       offs->tim_offset = beacon->head_len;
1198 +                       offs->tim_length = skb->len - beacon->head_len;
1199                 }
1200  
1201 -               memcpy(skb_put(skb, bcn->tail_len), bcn->tail, bcn->tail_len);
1202 +               memcpy(skb_put(skb, beacon->tail_len), beacon->tail,
1203 +                      beacon->tail_len);
1204         } else {
1205                 WARN_ON(1);
1206                 goto out;
1207         }
1208  
1209         /* CSA offsets */
1210 -       if (offs) {
1211 +       if (offs && beacon) {
1212                 int i;
1213  
1214                 for (i = 0; i < IEEE80211_MAX_CSA_COUNTERS_NUM; i++) {
1215 -                       u16 csa_off = sdata->csa_counter_offset_beacon[i];
1216 +                       u16 csa_off = beacon->csa_counter_offsets[i];
1217  
1218                         if (!csa_off)
1219                                 continue;
1220 --- a/drivers/net/wireless/rt2x00/rt2800lib.c
1221 +++ b/drivers/net/wireless/rt2x00/rt2800lib.c
1222 @@ -947,6 +947,40 @@ static inline u8 rt2800_get_beacon_offse
1223         return BEACON_BASE_TO_OFFSET(rt2800_hw_beacon_base(rt2x00dev, index));
1224  }
1225  
1226 +static void rt2800_update_beacons_setup(struct rt2x00_dev *rt2x00dev)
1227 +{
1228 +       struct data_queue *queue = rt2x00dev->bcn;
1229 +       struct queue_entry *entry;
1230 +       int i, bcn_num = 0;
1231 +       u64 off, reg = 0;
1232 +       u32 bssid_dw1;
1233 +
1234 +       /*
1235 +        * Setup offsets of all active beacons in BCN_OFFSET{0,1} registers.
1236 +        */
1237 +       for (i = 0; i < queue->limit; i++) {
1238 +               entry = &queue->entries[i];
1239 +               if (!test_bit(ENTRY_BCN_ENABLED, &entry->flags))
1240 +                       continue;
1241 +               off = rt2800_get_beacon_offset(rt2x00dev, entry->entry_idx);
1242 +               reg |= off << (8 * bcn_num);
1243 +               bcn_num++;
1244 +       }
1245 +
1246 +       WARN_ON_ONCE(bcn_num != rt2x00dev->intf_beaconing);
1247 +
1248 +       rt2800_register_write(rt2x00dev, BCN_OFFSET0, (u32) reg);
1249 +       rt2800_register_write(rt2x00dev, BCN_OFFSET1, (u32) (reg >> 32));
1250 +
1251 +       /*
1252 +        * H/W sends up to MAC_BSSID_DW1_BSS_BCN_NUM + 1 consecutive beacons.
1253 +        */
1254 +       rt2800_register_read(rt2x00dev, MAC_BSSID_DW1, &bssid_dw1);
1255 +       rt2x00_set_field32(&bssid_dw1, MAC_BSSID_DW1_BSS_BCN_NUM,
1256 +                          bcn_num > 0 ? bcn_num - 1 : 0);
1257 +       rt2800_register_write(rt2x00dev, MAC_BSSID_DW1, bssid_dw1);
1258 +}
1259 +
1260  void rt2800_write_beacon(struct queue_entry *entry, struct txentry_desc *txdesc)
1261  {
1262         struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
1263 @@ -1003,6 +1037,12 @@ void rt2800_write_beacon(struct queue_en
1264  
1265         rt2800_register_multiwrite(rt2x00dev, beacon_base, entry->skb->data,
1266                                    entry->skb->len + padding_len);
1267 +       __set_bit(ENTRY_BCN_ENABLED, &entry->flags);
1268 +
1269 +       /*
1270 +        * Change global beacons settings.
1271 +        */
1272 +       rt2800_update_beacons_setup(rt2x00dev);
1273  
1274         /*
1275          * Restore beaconing state.
1276 @@ -1053,8 +1093,13 @@ void rt2800_clear_beacon(struct queue_en
1277          * Clear beacon.
1278          */
1279         rt2800_clear_beacon_register(rt2x00dev, entry->entry_idx);
1280 +       __clear_bit(ENTRY_BCN_ENABLED, &entry->flags);
1281  
1282         /*
1283 +        * Change global beacons settings.
1284 +        */
1285 +       rt2800_update_beacons_setup(rt2x00dev);
1286 +       /*
1287          * Restore beaconing state.
1288          */
1289         rt2800_register_write(rt2x00dev, BCN_TIME_CFG, orig_reg);
1290 @@ -1556,7 +1601,7 @@ void rt2800_config_intf(struct rt2x00_de
1291                 if (!is_zero_ether_addr((const u8 *)conf->bssid)) {
1292                         reg = le32_to_cpu(conf->bssid[1]);
1293                         rt2x00_set_field32(&reg, MAC_BSSID_DW1_BSS_ID_MASK, 3);
1294 -                       rt2x00_set_field32(&reg, MAC_BSSID_DW1_BSS_BCN_NUM, 7);
1295 +                       rt2x00_set_field32(&reg, MAC_BSSID_DW1_BSS_BCN_NUM, 0);
1296                         conf->bssid[1] = cpu_to_le32(reg);
1297                 }
1298  
1299 @@ -4517,28 +4562,6 @@ static int rt2800_init_registers(struct 
1300         if (ret)
1301                 return ret;
1302  
1303 -       rt2800_register_read(rt2x00dev, BCN_OFFSET0, &reg);
1304 -       rt2x00_set_field32(&reg, BCN_OFFSET0_BCN0,
1305 -                          rt2800_get_beacon_offset(rt2x00dev, 0));
1306 -       rt2x00_set_field32(&reg, BCN_OFFSET0_BCN1,
1307 -                          rt2800_get_beacon_offset(rt2x00dev, 1));
1308 -       rt2x00_set_field32(&reg, BCN_OFFSET0_BCN2,
1309 -                          rt2800_get_beacon_offset(rt2x00dev, 2));
1310 -       rt2x00_set_field32(&reg, BCN_OFFSET0_BCN3,
1311 -                          rt2800_get_beacon_offset(rt2x00dev, 3));
1312 -       rt2800_register_write(rt2x00dev, BCN_OFFSET0, reg);
1313 -
1314 -       rt2800_register_read(rt2x00dev, BCN_OFFSET1, &reg);
1315 -       rt2x00_set_field32(&reg, BCN_OFFSET1_BCN4,
1316 -                          rt2800_get_beacon_offset(rt2x00dev, 4));
1317 -       rt2x00_set_field32(&reg, BCN_OFFSET1_BCN5,
1318 -                          rt2800_get_beacon_offset(rt2x00dev, 5));
1319 -       rt2x00_set_field32(&reg, BCN_OFFSET1_BCN6,
1320 -                          rt2800_get_beacon_offset(rt2x00dev, 6));
1321 -       rt2x00_set_field32(&reg, BCN_OFFSET1_BCN7,
1322 -                          rt2800_get_beacon_offset(rt2x00dev, 7));
1323 -       rt2800_register_write(rt2x00dev, BCN_OFFSET1, reg);
1324 -
1325         rt2800_register_write(rt2x00dev, LEGACY_BASIC_RATE, 0x0000013f);
1326         rt2800_register_write(rt2x00dev, HT_BASIC_RATE, 0x00008003);
1327  
1328 --- a/drivers/net/wireless/rt2x00/rt2x00dev.c
1329 +++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
1330 @@ -141,8 +141,11 @@ static void rt2x00lib_intf_scheduled_ite
1331         if (!test_bit(DEVICE_STATE_ENABLED_RADIO, &rt2x00dev->flags))
1332                 return;
1333  
1334 -       if (test_and_clear_bit(DELAYED_UPDATE_BEACON, &intf->delayed_flags))
1335 +       if (test_and_clear_bit(DELAYED_UPDATE_BEACON, &intf->delayed_flags)) {
1336 +               mutex_lock(&intf->beacon_skb_mutex);
1337                 rt2x00queue_update_beacon(rt2x00dev, vif);
1338 +               mutex_unlock(&intf->beacon_skb_mutex);
1339 +       }
1340  }
1341  
1342  static void rt2x00lib_intf_scheduled(struct work_struct *work)
1343 @@ -216,7 +219,7 @@ static void rt2x00lib_beaconupdate_iter(
1344          * never be called for USB devices.
1345          */
1346         WARN_ON(rt2x00_is_usb(rt2x00dev));
1347 -       rt2x00queue_update_beacon_locked(rt2x00dev, vif);
1348 +       rt2x00queue_update_beacon(rt2x00dev, vif);
1349  }
1350  
1351  void rt2x00lib_beacondone(struct rt2x00_dev *rt2x00dev)
1352 --- a/drivers/net/wireless/rt2x00/rt2x00mac.c
1353 +++ b/drivers/net/wireless/rt2x00/rt2x00mac.c
1354 @@ -487,6 +487,8 @@ int rt2x00mac_set_key(struct ieee80211_h
1355         crypto.cipher = rt2x00crypto_key_to_cipher(key);
1356         if (crypto.cipher == CIPHER_NONE)
1357                 return -EOPNOTSUPP;
1358 +       if (crypto.cipher == CIPHER_TKIP && rt2x00_is_usb(rt2x00dev))
1359 +               return -EOPNOTSUPP;
1360  
1361         crypto.cmd = cmd;
1362  
1363 @@ -624,25 +626,24 @@ void rt2x00mac_bss_info_changed(struct i
1364          * Start/stop beaconing.
1365          */
1366         if (changes & BSS_CHANGED_BEACON_ENABLED) {
1367 +               mutex_lock(&intf->beacon_skb_mutex);
1368                 if (!bss_conf->enable_beacon && intf->enable_beacon) {
1369                         rt2x00dev->intf_beaconing--;
1370                         intf->enable_beacon = false;
1371 -                       /*
1372 -                        * Clear beacon in the H/W for this vif. This is needed
1373 -                        * to disable beaconing on this particular interface
1374 -                        * and keep it running on other interfaces.
1375 -                        */
1376 -                       rt2x00queue_clear_beacon(rt2x00dev, vif);
1377  
1378                         if (rt2x00dev->intf_beaconing == 0) {
1379                                 /*
1380                                  * Last beaconing interface disabled
1381                                  * -> stop beacon queue.
1382                                  */
1383 -                               mutex_lock(&intf->beacon_skb_mutex);
1384                                 rt2x00queue_stop_queue(rt2x00dev->bcn);
1385 -                               mutex_unlock(&intf->beacon_skb_mutex);
1386                         }
1387 +                       /*
1388 +                        * Clear beacon in the H/W for this vif. This is needed
1389 +                        * to disable beaconing on this particular interface
1390 +                        * and keep it running on other interfaces.
1391 +                        */
1392 +                       rt2x00queue_clear_beacon(rt2x00dev, vif);
1393                 } else if (bss_conf->enable_beacon && !intf->enable_beacon) {
1394                         rt2x00dev->intf_beaconing++;
1395                         intf->enable_beacon = true;
1396 @@ -658,11 +659,10 @@ void rt2x00mac_bss_info_changed(struct i
1397                                  * First beaconing interface enabled
1398                                  * -> start beacon queue.
1399                                  */
1400 -                               mutex_lock(&intf->beacon_skb_mutex);
1401                                 rt2x00queue_start_queue(rt2x00dev->bcn);
1402 -                               mutex_unlock(&intf->beacon_skb_mutex);
1403                         }
1404                 }
1405 +               mutex_unlock(&intf->beacon_skb_mutex);
1406         }
1407  
1408         /*
1409 --- a/drivers/net/wireless/rt2x00/rt2x00queue.c
1410 +++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
1411 @@ -754,8 +754,6 @@ int rt2x00queue_clear_beacon(struct rt2x
1412         if (unlikely(!intf->beacon))
1413                 return -ENOBUFS;
1414  
1415 -       mutex_lock(&intf->beacon_skb_mutex);
1416 -
1417         /*
1418          * Clean up the beacon skb.
1419          */
1420 @@ -768,13 +766,11 @@ int rt2x00queue_clear_beacon(struct rt2x
1421         if (rt2x00dev->ops->lib->clear_beacon)
1422                 rt2x00dev->ops->lib->clear_beacon(intf->beacon);
1423  
1424 -       mutex_unlock(&intf->beacon_skb_mutex);
1425 -
1426         return 0;
1427  }
1428  
1429 -int rt2x00queue_update_beacon_locked(struct rt2x00_dev *rt2x00dev,
1430 -                                    struct ieee80211_vif *vif)
1431 +int rt2x00queue_update_beacon(struct rt2x00_dev *rt2x00dev,
1432 +                             struct ieee80211_vif *vif)
1433  {
1434         struct rt2x00_intf *intf = vif_to_intf(vif);
1435         struct skb_frame_desc *skbdesc;
1436 @@ -815,19 +811,6 @@ int rt2x00queue_update_beacon_locked(str
1437  
1438  }
1439  
1440 -int rt2x00queue_update_beacon(struct rt2x00_dev *rt2x00dev,
1441 -                             struct ieee80211_vif *vif)
1442 -{
1443 -       struct rt2x00_intf *intf = vif_to_intf(vif);
1444 -       int ret;
1445 -
1446 -       mutex_lock(&intf->beacon_skb_mutex);
1447 -       ret = rt2x00queue_update_beacon_locked(rt2x00dev, vif);
1448 -       mutex_unlock(&intf->beacon_skb_mutex);
1449 -
1450 -       return ret;
1451 -}
1452 -
1453  bool rt2x00queue_for_each_entry(struct data_queue *queue,
1454                                 enum queue_index start,
1455                                 enum queue_index end,
1456 --- a/drivers/net/wireless/rt2x00/rt2x00queue.h
1457 +++ b/drivers/net/wireless/rt2x00/rt2x00queue.h
1458 @@ -353,6 +353,7 @@ struct txentry_desc {
1459   */
1460  enum queue_entry_flags {
1461         ENTRY_BCN_ASSIGNED,
1462 +       ENTRY_BCN_ENABLED,
1463         ENTRY_OWNER_DEVICE_DATA,
1464         ENTRY_DATA_PENDING,
1465         ENTRY_DATA_IO_FAILED,
1466 --- a/drivers/net/wireless/ath/ath9k/main.c
1467 +++ b/drivers/net/wireless/ath/ath9k/main.c
1468 @@ -1757,7 +1757,6 @@ out:
1469  void ath9k_update_p2p_ps(struct ath_softc *sc, struct ieee80211_vif *vif)
1470  {
1471         struct ath_vif *avp = (void *)vif->drv_priv;
1472 -       unsigned long flags;
1473         u32 tsf;
1474  
1475         if (!sc->p2p_ps_timer)
1476 @@ -1767,14 +1766,9 @@ void ath9k_update_p2p_ps(struct ath_soft
1477                 return;
1478  
1479         sc->p2p_ps_vif = avp;
1480 -
1481 -       spin_lock_irqsave(&sc->sc_pm_lock, flags);
1482 -       if (!(sc->ps_flags & PS_BEACON_SYNC)) {
1483 -               tsf = ath9k_hw_gettsf32(sc->sc_ah);
1484 -               ieee80211_parse_p2p_noa(&vif->bss_conf.p2p_noa_attr, &avp->noa, tsf);
1485 -               ath9k_update_p2p_ps_timer(sc, avp);
1486 -       }
1487 -       spin_unlock_irqrestore(&sc->sc_pm_lock, flags);
1488 +       tsf = ath9k_hw_gettsf32(sc->sc_ah);
1489 +       ieee80211_parse_p2p_noa(&vif->bss_conf.p2p_noa_attr, &avp->noa, tsf);
1490 +       ath9k_update_p2p_ps_timer(sc, avp);
1491  }
1492  
1493  static void ath9k_bss_info_changed(struct ieee80211_hw *hw,
1494 @@ -1791,6 +1785,7 @@ static void ath9k_bss_info_changed(struc
1495         struct ath_hw *ah = sc->sc_ah;
1496         struct ath_common *common = ath9k_hw_common(ah);
1497         struct ath_vif *avp = (void *)vif->drv_priv;
1498 +       unsigned long flags;
1499         int slottime;
1500  
1501         ath9k_ps_wakeup(sc);
1502 @@ -1853,7 +1848,10 @@ static void ath9k_bss_info_changed(struc
1503  
1504         if (changed & BSS_CHANGED_P2P_PS) {
1505                 spin_lock_bh(&sc->sc_pcu_lock);
1506 -               ath9k_update_p2p_ps(sc, vif);
1507 +               spin_lock_irqsave(&sc->sc_pm_lock, flags);
1508 +               if (!(sc->ps_flags & PS_BEACON_SYNC))
1509 +                       ath9k_update_p2p_ps(sc, vif);
1510 +               spin_unlock_irqrestore(&sc->sc_pm_lock, flags);
1511                 spin_unlock_bh(&sc->sc_pcu_lock);
1512         }
1513  
1514 @@ -2232,14 +2230,6 @@ static void ath9k_sw_scan_complete(struc
1515         clear_bit(ATH_OP_SCANNING, &common->op_flags);
1516  }
1517  
1518 -static void ath9k_channel_switch_beacon(struct ieee80211_hw *hw,
1519 -                                       struct ieee80211_vif *vif,
1520 -                                       struct cfg80211_chan_def *chandef)
1521 -{
1522 -       /* depend on vif->csa_active only */
1523 -       return;
1524 -}
1525 -
1526  struct ieee80211_ops ath9k_ops = {
1527         .tx                 = ath9k_tx,
1528         .start              = ath9k_start,
1529 @@ -2287,5 +2277,4 @@ struct ieee80211_ops ath9k_ops = {
1530  #endif
1531         .sw_scan_start      = ath9k_sw_scan_start,
1532         .sw_scan_complete   = ath9k_sw_scan_complete,
1533 -       .channel_switch_beacon     = ath9k_channel_switch_beacon,
1534  };
1535 --- a/drivers/net/wireless/ath/ath10k/mac.c
1536 +++ b/drivers/net/wireless/ath/ath10k/mac.c
1537 @@ -4142,14 +4142,6 @@ static int ath10k_set_bitrate_mask(struc
1538                                            fixed_nss, force_sgi);
1539  }
1540  
1541 -static void ath10k_channel_switch_beacon(struct ieee80211_hw *hw,
1542 -                                        struct ieee80211_vif *vif,
1543 -                                        struct cfg80211_chan_def *chandef)
1544 -{
1545 -       /* there's no need to do anything here. vif->csa_active is enough */
1546 -       return;
1547 -}
1548 -
1549  static void ath10k_sta_rc_update(struct ieee80211_hw *hw,
1550                                  struct ieee80211_vif *vif,
1551                                  struct ieee80211_sta *sta,
1552 @@ -4256,7 +4248,6 @@ static const struct ieee80211_ops ath10k
1553         .restart_complete               = ath10k_restart_complete,
1554         .get_survey                     = ath10k_get_survey,
1555         .set_bitrate_mask               = ath10k_set_bitrate_mask,
1556 -       .channel_switch_beacon          = ath10k_channel_switch_beacon,
1557         .sta_rc_update                  = ath10k_sta_rc_update,
1558         .get_tsf                        = ath10k_get_tsf,
1559  #ifdef CONFIG_PM
1560 --- a/net/mac80211/cfg.c
1561 +++ b/net/mac80211/cfg.c
1562 @@ -468,327 +468,6 @@ void sta_set_rate_info_rx(struct sta_inf
1563                 rinfo->flags |= RATE_INFO_FLAGS_160_MHZ_WIDTH;
1564  }
1565  
1566 -static void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
1567 -{
1568 -       struct ieee80211_sub_if_data *sdata = sta->sdata;
1569 -       struct ieee80211_local *local = sdata->local;
1570 -       struct rate_control_ref *ref = local->rate_ctrl;
1571 -       struct timespec uptime;
1572 -       u64 packets = 0;
1573 -       u32 thr = 0;
1574 -       int i, ac;
1575 -
1576 -       sinfo->generation = sdata->local->sta_generation;
1577 -
1578 -       sinfo->filled = STATION_INFO_INACTIVE_TIME |
1579 -                       STATION_INFO_RX_BYTES64 |
1580 -                       STATION_INFO_TX_BYTES64 |
1581 -                       STATION_INFO_RX_PACKETS |
1582 -                       STATION_INFO_TX_PACKETS |
1583 -                       STATION_INFO_TX_RETRIES |
1584 -                       STATION_INFO_TX_FAILED |
1585 -                       STATION_INFO_TX_BITRATE |
1586 -                       STATION_INFO_RX_BITRATE |
1587 -                       STATION_INFO_RX_DROP_MISC |
1588 -                       STATION_INFO_BSS_PARAM |
1589 -                       STATION_INFO_CONNECTED_TIME |
1590 -                       STATION_INFO_STA_FLAGS |
1591 -                       STATION_INFO_BEACON_LOSS_COUNT;
1592 -
1593 -       do_posix_clock_monotonic_gettime(&uptime);
1594 -       sinfo->connected_time = uptime.tv_sec - sta->last_connected;
1595 -
1596 -       sinfo->inactive_time = jiffies_to_msecs(jiffies - sta->last_rx);
1597 -       sinfo->tx_bytes = 0;
1598 -       for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
1599 -               sinfo->tx_bytes += sta->tx_bytes[ac];
1600 -               packets += sta->tx_packets[ac];
1601 -       }
1602 -       sinfo->tx_packets = packets;
1603 -       sinfo->rx_bytes = sta->rx_bytes;
1604 -       sinfo->rx_packets = sta->rx_packets;
1605 -       sinfo->tx_retries = sta->tx_retry_count;
1606 -       sinfo->tx_failed = sta->tx_retry_failed;
1607 -       sinfo->rx_dropped_misc = sta->rx_dropped;
1608 -       sinfo->beacon_loss_count = sta->beacon_loss_count;
1609 -
1610 -       if ((sta->local->hw.flags & IEEE80211_HW_SIGNAL_DBM) ||
1611 -           (sta->local->hw.flags & IEEE80211_HW_SIGNAL_UNSPEC)) {
1612 -               sinfo->filled |= STATION_INFO_SIGNAL | STATION_INFO_SIGNAL_AVG;
1613 -               if (!local->ops->get_rssi ||
1614 -                   drv_get_rssi(local, sdata, &sta->sta, &sinfo->signal))
1615 -                       sinfo->signal = (s8)sta->last_signal;
1616 -               sinfo->signal_avg = (s8) -ewma_read(&sta->avg_signal);
1617 -       }
1618 -       if (sta->chains) {
1619 -               sinfo->filled |= STATION_INFO_CHAIN_SIGNAL |
1620 -                                STATION_INFO_CHAIN_SIGNAL_AVG;
1621 -
1622 -               sinfo->chains = sta->chains;
1623 -               for (i = 0; i < ARRAY_SIZE(sinfo->chain_signal); i++) {
1624 -                       sinfo->chain_signal[i] = sta->chain_signal_last[i];
1625 -                       sinfo->chain_signal_avg[i] =
1626 -                               (s8) -ewma_read(&sta->chain_signal_avg[i]);
1627 -               }
1628 -       }
1629 -
1630 -       sta_set_rate_info_tx(sta, &sta->last_tx_rate, &sinfo->txrate);
1631 -       sta_set_rate_info_rx(sta, &sinfo->rxrate);
1632 -
1633 -       if (ieee80211_vif_is_mesh(&sdata->vif)) {
1634 -#ifdef CPTCFG_MAC80211_MESH
1635 -               sinfo->filled |= STATION_INFO_LLID |
1636 -                                STATION_INFO_PLID |
1637 -                                STATION_INFO_PLINK_STATE |
1638 -                                STATION_INFO_LOCAL_PM |
1639 -                                STATION_INFO_PEER_PM |
1640 -                                STATION_INFO_NONPEER_PM;
1641 -
1642 -               sinfo->llid = sta->llid;
1643 -               sinfo->plid = sta->plid;
1644 -               sinfo->plink_state = sta->plink_state;
1645 -               if (test_sta_flag(sta, WLAN_STA_TOFFSET_KNOWN)) {
1646 -                       sinfo->filled |= STATION_INFO_T_OFFSET;
1647 -                       sinfo->t_offset = sta->t_offset;
1648 -               }
1649 -               sinfo->local_pm = sta->local_pm;
1650 -               sinfo->peer_pm = sta->peer_pm;
1651 -               sinfo->nonpeer_pm = sta->nonpeer_pm;
1652 -#endif
1653 -       }
1654 -
1655 -       sinfo->bss_param.flags = 0;
1656 -       if (sdata->vif.bss_conf.use_cts_prot)
1657 -               sinfo->bss_param.flags |= BSS_PARAM_FLAGS_CTS_PROT;
1658 -       if (sdata->vif.bss_conf.use_short_preamble)
1659 -               sinfo->bss_param.flags |= BSS_PARAM_FLAGS_SHORT_PREAMBLE;
1660 -       if (sdata->vif.bss_conf.use_short_slot)
1661 -               sinfo->bss_param.flags |= BSS_PARAM_FLAGS_SHORT_SLOT_TIME;
1662 -       sinfo->bss_param.dtim_period = sdata->local->hw.conf.ps_dtim_period;
1663 -       sinfo->bss_param.beacon_interval = sdata->vif.bss_conf.beacon_int;
1664 -
1665 -       sinfo->sta_flags.set = 0;
1666 -       sinfo->sta_flags.mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
1667 -                               BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
1668 -                               BIT(NL80211_STA_FLAG_WME) |
1669 -                               BIT(NL80211_STA_FLAG_MFP) |
1670 -                               BIT(NL80211_STA_FLAG_AUTHENTICATED) |
1671 -                               BIT(NL80211_STA_FLAG_ASSOCIATED) |
1672 -                               BIT(NL80211_STA_FLAG_TDLS_PEER);
1673 -       if (test_sta_flag(sta, WLAN_STA_AUTHORIZED))
1674 -               sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_AUTHORIZED);
1675 -       if (test_sta_flag(sta, WLAN_STA_SHORT_PREAMBLE))
1676 -               sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_SHORT_PREAMBLE);
1677 -       if (test_sta_flag(sta, WLAN_STA_WME))
1678 -               sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_WME);
1679 -       if (test_sta_flag(sta, WLAN_STA_MFP))
1680 -               sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_MFP);
1681 -       if (test_sta_flag(sta, WLAN_STA_AUTH))
1682 -               sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_AUTHENTICATED);
1683 -       if (test_sta_flag(sta, WLAN_STA_ASSOC))
1684 -               sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_ASSOCIATED);
1685 -       if (test_sta_flag(sta, WLAN_STA_TDLS_PEER))
1686 -               sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_TDLS_PEER);
1687 -
1688 -       /* check if the driver has a SW RC implementation */
1689 -       if (ref && ref->ops->get_expected_throughput)
1690 -               thr = ref->ops->get_expected_throughput(sta->rate_ctrl_priv);
1691 -       else
1692 -               thr = drv_get_expected_throughput(local, &sta->sta);
1693 -
1694 -       if (thr != 0) {
1695 -               sinfo->filled |= STATION_INFO_EXPECTED_THROUGHPUT;
1696 -               sinfo->expected_throughput = thr;
1697 -       }
1698 -}
1699 -
1700 -static const char ieee80211_gstrings_sta_stats[][ETH_GSTRING_LEN] = {
1701 -       "rx_packets", "rx_bytes", "wep_weak_iv_count",
1702 -       "rx_duplicates", "rx_fragments", "rx_dropped",
1703 -       "tx_packets", "tx_bytes", "tx_fragments",
1704 -       "tx_filtered", "tx_retry_failed", "tx_retries",
1705 -       "beacon_loss", "sta_state", "txrate", "rxrate", "signal",
1706 -       "channel", "noise", "ch_time", "ch_time_busy",
1707 -       "ch_time_ext_busy", "ch_time_rx", "ch_time_tx"
1708 -};
1709 -#define STA_STATS_LEN  ARRAY_SIZE(ieee80211_gstrings_sta_stats)
1710 -
1711 -static int ieee80211_get_et_sset_count(struct wiphy *wiphy,
1712 -                                      struct net_device *dev,
1713 -                                      int sset)
1714 -{
1715 -       struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1716 -       int rv = 0;
1717 -
1718 -       if (sset == ETH_SS_STATS)
1719 -               rv += STA_STATS_LEN;
1720 -
1721 -       rv += drv_get_et_sset_count(sdata, sset);
1722 -
1723 -       if (rv == 0)
1724 -               return -EOPNOTSUPP;
1725 -       return rv;
1726 -}
1727 -
1728 -static void ieee80211_get_et_stats(struct wiphy *wiphy,
1729 -                                  struct net_device *dev,
1730 -                                  struct ethtool_stats *stats,
1731 -                                  u64 *data)
1732 -{
1733 -       struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1734 -       struct ieee80211_chanctx_conf *chanctx_conf;
1735 -       struct ieee80211_channel *channel;
1736 -       struct sta_info *sta;
1737 -       struct ieee80211_local *local = sdata->local;
1738 -       struct station_info sinfo;
1739 -       struct survey_info survey;
1740 -       int i, q;
1741 -#define STA_STATS_SURVEY_LEN 7
1742 -
1743 -       memset(data, 0, sizeof(u64) * STA_STATS_LEN);
1744 -
1745 -#define ADD_STA_STATS(sta)                             \
1746 -       do {                                            \
1747 -               data[i++] += sta->rx_packets;           \
1748 -               data[i++] += sta->rx_bytes;             \
1749 -               data[i++] += sta->wep_weak_iv_count;    \
1750 -               data[i++] += sta->num_duplicates;       \
1751 -               data[i++] += sta->rx_fragments;         \
1752 -               data[i++] += sta->rx_dropped;           \
1753 -                                                       \
1754 -               data[i++] += sinfo.tx_packets;          \
1755 -               data[i++] += sinfo.tx_bytes;            \
1756 -               data[i++] += sta->tx_fragments;         \
1757 -               data[i++] += sta->tx_filtered_count;    \
1758 -               data[i++] += sta->tx_retry_failed;      \
1759 -               data[i++] += sta->tx_retry_count;       \
1760 -               data[i++] += sta->beacon_loss_count;    \
1761 -       } while (0)
1762 -
1763 -       /* For Managed stations, find the single station based on BSSID
1764 -        * and use that.  For interface types, iterate through all available
1765 -        * stations and add stats for any station that is assigned to this
1766 -        * network device.
1767 -        */
1768 -
1769 -       mutex_lock(&local->sta_mtx);
1770 -
1771 -       if (sdata->vif.type == NL80211_IFTYPE_STATION) {
1772 -               sta = sta_info_get_bss(sdata, sdata->u.mgd.bssid);
1773 -
1774 -               if (!(sta && !WARN_ON(sta->sdata->dev != dev)))
1775 -                       goto do_survey;
1776 -
1777 -               sinfo.filled = 0;
1778 -               sta_set_sinfo(sta, &sinfo);
1779 -
1780 -               i = 0;
1781 -               ADD_STA_STATS(sta);
1782 -
1783 -               data[i++] = sta->sta_state;
1784 -
1785 -
1786 -               if (sinfo.filled & STATION_INFO_TX_BITRATE)
1787 -                       data[i] = 100000 *
1788 -                               cfg80211_calculate_bitrate(&sinfo.txrate);
1789 -               i++;
1790 -               if (sinfo.filled & STATION_INFO_RX_BITRATE)
1791 -                       data[i] = 100000 *
1792 -                               cfg80211_calculate_bitrate(&sinfo.rxrate);
1793 -               i++;
1794 -
1795 -               if (sinfo.filled & STATION_INFO_SIGNAL_AVG)
1796 -                       data[i] = (u8)sinfo.signal_avg;
1797 -               i++;
1798 -       } else {
1799 -               list_for_each_entry(sta, &local->sta_list, list) {
1800 -                       /* Make sure this station belongs to the proper dev */
1801 -                       if (sta->sdata->dev != dev)
1802 -                               continue;
1803 -
1804 -                       sinfo.filled = 0;
1805 -                       sta_set_sinfo(sta, &sinfo);
1806 -                       i = 0;
1807 -                       ADD_STA_STATS(sta);
1808 -               }
1809 -       }
1810 -
1811 -do_survey:
1812 -       i = STA_STATS_LEN - STA_STATS_SURVEY_LEN;
1813 -       /* Get survey stats for current channel */
1814 -       survey.filled = 0;
1815 -
1816 -       rcu_read_lock();
1817 -       chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
1818 -       if (chanctx_conf)
1819 -               channel = chanctx_conf->def.chan;
1820 -       else
1821 -               channel = NULL;
1822 -       rcu_read_unlock();
1823 -
1824 -       if (channel) {
1825 -               q = 0;
1826 -               do {
1827 -                       survey.filled = 0;
1828 -                       if (drv_get_survey(local, q, &survey) != 0) {
1829 -                               survey.filled = 0;
1830 -                               break;
1831 -                       }
1832 -                       q++;
1833 -               } while (channel != survey.channel);
1834 -       }
1835 -
1836 -       if (survey.filled)
1837 -               data[i++] = survey.channel->center_freq;
1838 -       else
1839 -               data[i++] = 0;
1840 -       if (survey.filled & SURVEY_INFO_NOISE_DBM)
1841 -               data[i++] = (u8)survey.noise;
1842 -       else
1843 -               data[i++] = -1LL;
1844 -       if (survey.filled & SURVEY_INFO_CHANNEL_TIME)
1845 -               data[i++] = survey.channel_time;
1846 -       else
1847 -               data[i++] = -1LL;
1848 -       if (survey.filled & SURVEY_INFO_CHANNEL_TIME_BUSY)
1849 -               data[i++] = survey.channel_time_busy;
1850 -       else
1851 -               data[i++] = -1LL;
1852 -       if (survey.filled & SURVEY_INFO_CHANNEL_TIME_EXT_BUSY)
1853 -               data[i++] = survey.channel_time_ext_busy;
1854 -       else
1855 -               data[i++] = -1LL;
1856 -       if (survey.filled & SURVEY_INFO_CHANNEL_TIME_RX)
1857 -               data[i++] = survey.channel_time_rx;
1858 -       else
1859 -               data[i++] = -1LL;
1860 -       if (survey.filled & SURVEY_INFO_CHANNEL_TIME_TX)
1861 -               data[i++] = survey.channel_time_tx;
1862 -       else
1863 -               data[i++] = -1LL;
1864 -
1865 -       mutex_unlock(&local->sta_mtx);
1866 -
1867 -       if (WARN_ON(i != STA_STATS_LEN))
1868 -               return;
1869 -
1870 -       drv_get_et_stats(sdata, stats, &(data[STA_STATS_LEN]));
1871 -}
1872 -
1873 -static void ieee80211_get_et_strings(struct wiphy *wiphy,
1874 -                                    struct net_device *dev,
1875 -                                    u32 sset, u8 *data)
1876 -{
1877 -       struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1878 -       int sz_sta_stats = 0;
1879 -
1880 -       if (sset == ETH_SS_STATS) {
1881 -               sz_sta_stats = sizeof(ieee80211_gstrings_sta_stats);
1882 -               memcpy(data, ieee80211_gstrings_sta_stats, sz_sta_stats);
1883 -       }
1884 -       drv_get_et_strings(sdata, sset, &(data[sz_sta_stats]));
1885 -}
1886 -
1887  static int ieee80211_dump_station(struct wiphy *wiphy, struct net_device *dev,
1888                                   int idx, u8 *mac, struct station_info *sinfo)
1889  {
1890 @@ -875,7 +554,8 @@ static int ieee80211_set_monitor_channel
1891  }
1892  
1893  static int ieee80211_set_probe_resp(struct ieee80211_sub_if_data *sdata,
1894 -                                   const u8 *resp, size_t resp_len)
1895 +                                   const u8 *resp, size_t resp_len,
1896 +                                   const struct ieee80211_csa_settings *csa)
1897  {
1898         struct probe_resp *new, *old;
1899  
1900 @@ -891,6 +571,11 @@ static int ieee80211_set_probe_resp(stru
1901         new->len = resp_len;
1902         memcpy(new->data, resp, resp_len);
1903  
1904 +       if (csa)
1905 +               memcpy(new->csa_counter_offsets, csa->counter_offsets_presp,
1906 +                      csa->n_counter_offsets_presp *
1907 +                      sizeof(new->csa_counter_offsets[0]));
1908 +
1909         rcu_assign_pointer(sdata->u.ap.probe_resp, new);
1910         if (old)
1911                 kfree_rcu(old, rcu_head);
1912 @@ -899,7 +584,8 @@ static int ieee80211_set_probe_resp(stru
1913  }
1914  
1915  static int ieee80211_assign_beacon(struct ieee80211_sub_if_data *sdata,
1916 -                                  struct cfg80211_beacon_data *params)
1917 +                                  struct cfg80211_beacon_data *params,
1918 +                                  const struct ieee80211_csa_settings *csa)
1919  {
1920         struct beacon_data *new, *old;
1921         int new_head_len, new_tail_len;
1922 @@ -943,6 +629,13 @@ static int ieee80211_assign_beacon(struc
1923         new->head_len = new_head_len;
1924         new->tail_len = new_tail_len;
1925  
1926 +       if (csa) {
1927 +               new->csa_current_counter = csa->count;
1928 +               memcpy(new->csa_counter_offsets, csa->counter_offsets_beacon,
1929 +                      csa->n_counter_offsets_beacon *
1930 +                      sizeof(new->csa_counter_offsets[0]));
1931 +       }
1932 +
1933         /* copy in head */
1934         if (params->head)
1935                 memcpy(new->head, params->head, new_head_len);
1936 @@ -957,7 +650,7 @@ static int ieee80211_assign_beacon(struc
1937                         memcpy(new->tail, old->tail, new_tail_len);
1938  
1939         err = ieee80211_set_probe_resp(sdata, params->probe_resp,
1940 -                                      params->probe_resp_len);
1941 +                                      params->probe_resp_len, csa);
1942         if (err < 0)
1943                 return err;
1944         if (err == 0)
1945 @@ -1042,7 +735,7 @@ static int ieee80211_start_ap(struct wip
1946                 sdata->vif.bss_conf.p2p_noa_attr.oppps_ctwindow |=
1947                                         IEEE80211_P2P_OPPPS_ENABLE_BIT;
1948  
1949 -       err = ieee80211_assign_beacon(sdata, &params->beacon);
1950 +       err = ieee80211_assign_beacon(sdata, &params->beacon, NULL);
1951         if (err < 0) {
1952                 ieee80211_vif_release_channel(sdata);
1953                 return err;
1954 @@ -1090,7 +783,7 @@ static int ieee80211_change_beacon(struc
1955         if (!old)
1956                 return -ENOENT;
1957  
1958 -       err = ieee80211_assign_beacon(sdata, params);
1959 +       err = ieee80211_assign_beacon(sdata, params, NULL);
1960         if (err < 0)
1961                 return err;
1962         ieee80211_bss_info_change_notify(sdata, err);
1963 @@ -3073,7 +2766,8 @@ static int ieee80211_set_after_csa_beaco
1964  
1965         switch (sdata->vif.type) {
1966         case NL80211_IFTYPE_AP:
1967 -               err = ieee80211_assign_beacon(sdata, sdata->u.ap.next_beacon);
1968 +               err = ieee80211_assign_beacon(sdata, sdata->u.ap.next_beacon,
1969 +                                             NULL);
1970                 kfree(sdata->u.ap.next_beacon);
1971                 sdata->u.ap.next_beacon = NULL;
1972  
1973 @@ -3176,6 +2870,7 @@ static int ieee80211_set_csa_beacon(stru
1974                                     struct cfg80211_csa_settings *params,
1975                                     u32 *changed)
1976  {
1977 +       struct ieee80211_csa_settings csa = {};
1978         int err;
1979  
1980         switch (sdata->vif.type) {
1981 @@ -3210,20 +2905,13 @@ static int ieee80211_set_csa_beacon(stru
1982                      IEEE80211_MAX_CSA_COUNTERS_NUM))
1983                         return -EINVAL;
1984  
1985 -               /* make sure we don't have garbage in other counters */
1986 -               memset(sdata->csa_counter_offset_beacon, 0,
1987 -                      sizeof(sdata->csa_counter_offset_beacon));
1988 -               memset(sdata->csa_counter_offset_presp, 0,
1989 -                      sizeof(sdata->csa_counter_offset_presp));
1990 -
1991 -               memcpy(sdata->csa_counter_offset_beacon,
1992 -                      params->counter_offsets_beacon,
1993 -                      params->n_counter_offsets_beacon * sizeof(u16));
1994 -               memcpy(sdata->csa_counter_offset_presp,
1995 -                      params->counter_offsets_presp,
1996 -                      params->n_counter_offsets_presp * sizeof(u16));
1997 +               csa.counter_offsets_beacon = params->counter_offsets_beacon;
1998 +               csa.counter_offsets_presp = params->counter_offsets_presp;
1999 +               csa.n_counter_offsets_beacon = params->n_counter_offsets_beacon;
2000 +               csa.n_counter_offsets_presp = params->n_counter_offsets_presp;
2001 +               csa.count = params->count;
2002  
2003 -               err = ieee80211_assign_beacon(sdata, &params->beacon_csa);
2004 +               err = ieee80211_assign_beacon(sdata, &params->beacon_csa, &csa);
2005                 if (err < 0) {
2006                         kfree(sdata->u.ap.next_beacon);
2007                         return err;
2008 @@ -3367,7 +3055,6 @@ __ieee80211_channel_switch(struct wiphy 
2009         sdata->csa_radar_required = params->radar_required;
2010         sdata->csa_chandef = params->chandef;
2011         sdata->csa_block_tx = params->block_tx;
2012 -       sdata->csa_current_counter = params->count;
2013         sdata->vif.csa_active = true;
2014  
2015         if (sdata->csa_block_tx)
2016 @@ -3515,10 +3202,23 @@ static int ieee80211_mgmt_tx(struct wiph
2017              sdata->vif.type == NL80211_IFTYPE_ADHOC) &&
2018             params->n_csa_offsets) {
2019                 int i;
2020 -               u8 c = sdata->csa_current_counter;
2021 +               struct beacon_data *beacon = NULL;
2022 +
2023 +               rcu_read_lock();
2024  
2025 -               for (i = 0; i < params->n_csa_offsets; i++)
2026 -                       data[params->csa_offsets[i]] = c;
2027 +               if (sdata->vif.type == NL80211_IFTYPE_AP)
2028 +                       beacon = rcu_dereference(sdata->u.ap.beacon);
2029 +               else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
2030 +                       beacon = rcu_dereference(sdata->u.ibss.presp);
2031 +               else if (ieee80211_vif_is_mesh(&sdata->vif))
2032 +                       beacon = rcu_dereference(sdata->u.mesh.beacon);
2033 +
2034 +               if (beacon)
2035 +                       for (i = 0; i < params->n_csa_offsets; i++)
2036 +                               data[params->csa_offsets[i]] =
2037 +                                       beacon->csa_current_counter;
2038 +
2039 +               rcu_read_unlock();
2040         }
2041  
2042         IEEE80211_SKB_CB(skb)->flags = flags;
2043 @@ -3598,21 +3298,6 @@ static int ieee80211_get_antenna(struct 
2044         return drv_get_antenna(local, tx_ant, rx_ant);
2045  }
2046  
2047 -static int ieee80211_set_ringparam(struct wiphy *wiphy, u32 tx, u32 rx)
2048 -{
2049 -       struct ieee80211_local *local = wiphy_priv(wiphy);
2050 -
2051 -       return drv_set_ringparam(local, tx, rx);
2052 -}
2053 -
2054 -static void ieee80211_get_ringparam(struct wiphy *wiphy,
2055 -                                   u32 *tx, u32 *tx_max, u32 *rx, u32 *rx_max)
2056 -{
2057 -       struct ieee80211_local *local = wiphy_priv(wiphy);
2058 -
2059 -       drv_get_ringparam(local, tx, tx_max, rx, rx_max);
2060 -}
2061 -
2062  static int ieee80211_set_rekey_data(struct wiphy *wiphy,
2063                                     struct net_device *dev,
2064                                     struct cfg80211_gtk_rekey_data *data)
2065 @@ -3844,8 +3529,6 @@ const struct cfg80211_ops mac80211_confi
2066         .mgmt_frame_register = ieee80211_mgmt_frame_register,
2067         .set_antenna = ieee80211_set_antenna,
2068         .get_antenna = ieee80211_get_antenna,
2069 -       .set_ringparam = ieee80211_set_ringparam,
2070 -       .get_ringparam = ieee80211_get_ringparam,
2071         .set_rekey_data = ieee80211_set_rekey_data,
2072         .tdls_oper = ieee80211_tdls_oper,
2073         .tdls_mgmt = ieee80211_tdls_mgmt,
2074 @@ -3854,9 +3537,6 @@ const struct cfg80211_ops mac80211_confi
2075  #ifdef CONFIG_PM
2076         .set_wakeup = ieee80211_set_wakeup,
2077  #endif
2078 -       .get_et_sset_count = ieee80211_get_et_sset_count,
2079 -       .get_et_stats = ieee80211_get_et_stats,
2080 -       .get_et_strings = ieee80211_get_et_strings,
2081         .get_channel = ieee80211_cfg_get_channel,
2082         .start_radar_detection = ieee80211_start_radar_detection,
2083         .channel_switch = ieee80211_channel_switch,
2084 --- a/net/mac80211/debugfs_sta.c
2085 +++ b/net/mac80211/debugfs_sta.c
2086 @@ -587,7 +587,6 @@ void ieee80211_sta_debugfs_add(struct st
2087         DEBUGFS_ADD_COUNTER(tx_filtered, tx_filtered_count);
2088         DEBUGFS_ADD_COUNTER(tx_retry_failed, tx_retry_failed);
2089         DEBUGFS_ADD_COUNTER(tx_retry_count, tx_retry_count);
2090 -       DEBUGFS_ADD_COUNTER(wep_weak_iv_count, wep_weak_iv_count);
2091  
2092         if (sizeof(sta->driver_buffered_tids) == sizeof(u32))
2093                 debugfs_create_x32("driver_buffered_tids", 0400,
2094 --- a/net/mac80211/wep.c
2095 +++ b/net/mac80211/wep.c
2096 @@ -271,22 +271,6 @@ static int ieee80211_wep_decrypt(struct 
2097         return ret;
2098  }
2099  
2100 -
2101 -static bool ieee80211_wep_is_weak_iv(struct sk_buff *skb,
2102 -                                    struct ieee80211_key *key)
2103 -{
2104 -       struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
2105 -       unsigned int hdrlen;
2106 -       u8 *ivpos;
2107 -       u32 iv;
2108 -
2109 -       hdrlen = ieee80211_hdrlen(hdr->frame_control);
2110 -       ivpos = skb->data + hdrlen;
2111 -       iv = (ivpos[0] << 16) | (ivpos[1] << 8) | ivpos[2];
2112 -
2113 -       return ieee80211_wep_weak_iv(iv, key->conf.keylen);
2114 -}
2115 -
2116  ieee80211_rx_result
2117  ieee80211_crypto_wep_decrypt(struct ieee80211_rx_data *rx)
2118  {
2119 @@ -301,16 +285,12 @@ ieee80211_crypto_wep_decrypt(struct ieee
2120         if (!(status->flag & RX_FLAG_DECRYPTED)) {
2121                 if (skb_linearize(rx->skb))
2122                         return RX_DROP_UNUSABLE;
2123 -               if (rx->sta && ieee80211_wep_is_weak_iv(rx->skb, rx->key))
2124 -                       rx->sta->wep_weak_iv_count++;
2125                 if (ieee80211_wep_decrypt(rx->local, rx->skb, rx->key))
2126                         return RX_DROP_UNUSABLE;
2127         } else if (!(status->flag & RX_FLAG_IV_STRIPPED)) {
2128                 if (!pskb_may_pull(rx->skb, ieee80211_hdrlen(fc) +
2129                                             IEEE80211_WEP_IV_LEN))
2130                         return RX_DROP_UNUSABLE;
2131 -               if (rx->sta && ieee80211_wep_is_weak_iv(rx->skb, rx->key))
2132 -                       rx->sta->wep_weak_iv_count++;
2133                 ieee80211_wep_remove_iv(rx->local, rx->skb, rx->key);
2134                 /* remove ICV */
2135                 if (pskb_trim(rx->skb, rx->skb->len - IEEE80211_WEP_ICV_LEN))
2136 --- a/include/net/cfg80211.h
2137 +++ b/include/net/cfg80211.h
2138 @@ -2278,16 +2278,6 @@ struct cfg80211_qos_map {
2139   *
2140   * @set_noack_map: Set the NoAck Map for the TIDs.
2141   *
2142 - * @get_et_sset_count:  Ethtool API to get string-set count.
2143 - *     See @ethtool_ops.get_sset_count
2144 - *
2145 - * @get_et_stats:  Ethtool API to get a set of u64 stats.
2146 - *     See @ethtool_ops.get_ethtool_stats
2147 - *
2148 - * @get_et_strings:  Ethtool API to get a set of strings to describe stats
2149 - *     and perhaps other supported types of ethtool data-sets.
2150 - *     See @ethtool_ops.get_strings
2151 - *
2152   * @get_channel: Get the current operating channel for the virtual interface.
2153   *     For monitor interfaces, it should return %NULL unless there's a single
2154   *     current monitoring channel.
2155 @@ -2529,13 +2519,6 @@ struct cfg80211_ops {
2156                                   struct net_device *dev,
2157                                   u16 noack_map);
2158  
2159 -       int     (*get_et_sset_count)(struct wiphy *wiphy,
2160 -                                    struct net_device *dev, int sset);
2161 -       void    (*get_et_stats)(struct wiphy *wiphy, struct net_device *dev,
2162 -                               struct ethtool_stats *stats, u64 *data);
2163 -       void    (*get_et_strings)(struct wiphy *wiphy, struct net_device *dev,
2164 -                                 u32 sset, u8 *data);
2165 -
2166         int     (*get_channel)(struct wiphy *wiphy,
2167                                struct wireless_dev *wdev,
2168                                struct cfg80211_chan_def *chandef);
2169 @@ -4846,6 +4829,10 @@ void cfg80211_stop_iface(struct wiphy *w
2170   */
2171  void cfg80211_shutdown_all_interfaces(struct wiphy *wiphy);
2172  
2173 +
2174 +/* ethtool helper */
2175 +void cfg80211_get_drvinfo(struct net_device *dev, struct ethtool_drvinfo *info);
2176 +
2177  /* Logging, debugging and troubleshooting/diagnostic helpers. */
2178  
2179  /* wiphy_printk helpers, similar to dev_printk */
2180 --- a/net/mac80211/Makefile
2181 +++ b/net/mac80211/Makefile
2182 @@ -17,6 +17,7 @@ mac80211-y := \
2183         aes_ccm.o \
2184         aes_cmac.o \
2185         cfg.o \
2186 +       ethtool.o \
2187         rx.o \
2188         spectmgmt.o \
2189         tx.o \
2190 --- a/net/mac80211/ieee80211_i.h
2191 +++ b/net/mac80211/ieee80211_i.h
2192 @@ -229,16 +229,29 @@ struct ieee80211_rx_data {
2193         u16 tkip_iv16;
2194  };
2195  
2196 +struct ieee80211_csa_settings {
2197 +       const u16 *counter_offsets_beacon;
2198 +       const u16 *counter_offsets_presp;
2199 +
2200 +       int n_counter_offsets_beacon;
2201 +       int n_counter_offsets_presp;
2202 +
2203 +       u8 count;
2204 +};
2205 +
2206  struct beacon_data {
2207         u8 *head, *tail;
2208         int head_len, tail_len;
2209         struct ieee80211_meshconf_ie *meshconf;
2210 +       u16 csa_counter_offsets[IEEE80211_MAX_CSA_COUNTERS_NUM];
2211 +       u8 csa_current_counter;
2212         struct rcu_head rcu_head;
2213  };
2214  
2215  struct probe_resp {
2216         struct rcu_head rcu_head;
2217         int len;
2218 +       u16 csa_counter_offsets[IEEE80211_MAX_CSA_COUNTERS_NUM];
2219         u8 data[0];
2220  };
2221  
2222 @@ -754,8 +767,6 @@ struct ieee80211_sub_if_data {
2223         struct mac80211_qos_map __rcu *qos_map;
2224  
2225         struct work_struct csa_finalize_work;
2226 -       u16 csa_counter_offset_beacon[IEEE80211_MAX_CSA_COUNTERS_NUM];
2227 -       u16 csa_counter_offset_presp[IEEE80211_MAX_CSA_COUNTERS_NUM];
2228         bool csa_radar_required;
2229         bool csa_block_tx; /* write-protected by sdata_lock and local->mtx */
2230         struct cfg80211_chan_def csa_chandef;
2231 @@ -767,7 +778,6 @@ struct ieee80211_sub_if_data {
2232         struct ieee80211_chanctx *reserved_chanctx;
2233         struct cfg80211_chan_def reserved_chandef;
2234         bool reserved_radar_required;
2235 -       u8 csa_current_counter;
2236  
2237         /* used to reconfigure hardware SM PS */
2238         struct work_struct recalc_smps;
2239 @@ -1850,6 +1860,8 @@ int ieee80211_tdls_oper(struct wiphy *wi
2240                         const u8 *peer, enum nl80211_tdls_operation oper);
2241  
2242  
2243 +extern const struct ethtool_ops ieee80211_ethtool_ops;
2244 +
2245  #ifdef CPTCFG_MAC80211_NOINLINE
2246  #define debug_noinline noinline
2247  #else
2248 --- a/net/mac80211/iface.c
2249 +++ b/net/mac80211/iface.c
2250 @@ -399,6 +399,7 @@ int ieee80211_add_virtual_monitor(struct
2251         sdata->vif.type = NL80211_IFTYPE_MONITOR;
2252         snprintf(sdata->name, IFNAMSIZ, "%s-monitor",
2253                  wiphy_name(local->hw.wiphy));
2254 +       sdata->wdev.iftype = NL80211_IFTYPE_MONITOR;
2255  
2256         sdata->encrypt_headroom = IEEE80211_ENCRYPT_HEADROOM;
2257  
2258 @@ -1303,6 +1304,7 @@ static void ieee80211_setup_sdata(struct
2259         sdata->control_port_protocol = cpu_to_be16(ETH_P_PAE);
2260         sdata->control_port_no_encrypt = false;
2261         sdata->encrypt_headroom = IEEE80211_ENCRYPT_HEADROOM;
2262 +       sdata->vif.bss_conf.idle = true;
2263  
2264         sdata->noack_map = 0;
2265  
2266 @@ -1721,6 +1723,8 @@ int ieee80211_if_add(struct ieee80211_lo
2267  
2268                 ndev->features |= local->hw.netdev_features;
2269  
2270 +               netdev_set_default_ethtool_ops(ndev, &ieee80211_ethtool_ops);
2271 +
2272                 ret = register_netdevice(ndev);
2273                 if (ret) {
2274                         free_netdev(ndev);
2275 --- a/net/wireless/core.c
2276 +++ b/net/wireless/core.c
2277 @@ -25,7 +25,6 @@
2278  #include "sysfs.h"
2279  #include "debugfs.h"
2280  #include "wext-compat.h"
2281 -#include "ethtool.h"
2282  #include "rdev-ops.h"
2283  
2284  /* name for sysfs, %d is appended */
2285 @@ -940,8 +939,6 @@ static int cfg80211_netdev_notifier_call
2286                 /* allow mac80211 to determine the timeout */
2287                 wdev->ps_timeout = -1;
2288  
2289 -               netdev_set_default_ethtool_ops(dev, &cfg80211_ethtool_ops);
2290 -
2291                 if ((wdev->iftype == NL80211_IFTYPE_STATION ||
2292                      wdev->iftype == NL80211_IFTYPE_P2P_CLIENT ||
2293                      wdev->iftype == NL80211_IFTYPE_ADHOC) && !wdev->use_4addr)
2294 --- a/net/wireless/ethtool.c
2295 +++ b/net/wireless/ethtool.c
2296 @@ -1,11 +1,9 @@
2297  #include <linux/utsname.h>
2298  #include <net/cfg80211.h>
2299  #include "core.h"
2300 -#include "ethtool.h"
2301  #include "rdev-ops.h"
2302  
2303 -static void cfg80211_get_drvinfo(struct net_device *dev,
2304 -                                       struct ethtool_drvinfo *info)
2305 +void cfg80211_get_drvinfo(struct net_device *dev, struct ethtool_drvinfo *info)
2306  {
2307         struct wireless_dev *wdev = dev->ieee80211_ptr;
2308  
2309 @@ -23,84 +21,4 @@ static void cfg80211_get_drvinfo(struct 
2310         strlcpy(info->bus_info, dev_name(wiphy_dev(wdev->wiphy)),
2311                 sizeof(info->bus_info));
2312  }
2313 -
2314 -static int cfg80211_get_regs_len(struct net_device *dev)
2315 -{
2316 -       /* For now, return 0... */
2317 -       return 0;
2318 -}
2319 -
2320 -static void cfg80211_get_regs(struct net_device *dev, struct ethtool_regs *regs,
2321 -                       void *data)
2322 -{
2323 -       struct wireless_dev *wdev = dev->ieee80211_ptr;
2324 -
2325 -       regs->version = wdev->wiphy->hw_version;
2326 -       regs->len = 0;
2327 -}
2328 -
2329 -static void cfg80211_get_ringparam(struct net_device *dev,
2330 -                                  struct ethtool_ringparam *rp)
2331 -{
2332 -       struct wireless_dev *wdev = dev->ieee80211_ptr;
2333 -       struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
2334 -
2335 -       memset(rp, 0, sizeof(*rp));
2336 -
2337 -       if (rdev->ops->get_ringparam)
2338 -               rdev_get_ringparam(rdev, &rp->tx_pending, &rp->tx_max_pending,
2339 -                                  &rp->rx_pending, &rp->rx_max_pending);
2340 -}
2341 -
2342 -static int cfg80211_set_ringparam(struct net_device *dev,
2343 -                                 struct ethtool_ringparam *rp)
2344 -{
2345 -       struct wireless_dev *wdev = dev->ieee80211_ptr;
2346 -       struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
2347 -
2348 -       if (rp->rx_mini_pending != 0 || rp->rx_jumbo_pending != 0)
2349 -               return -EINVAL;
2350 -
2351 -       if (rdev->ops->set_ringparam)
2352 -               return rdev_set_ringparam(rdev, rp->tx_pending, rp->rx_pending);
2353 -
2354 -       return -ENOTSUPP;
2355 -}
2356 -
2357 -static int cfg80211_get_sset_count(struct net_device *dev, int sset)
2358 -{
2359 -       struct wireless_dev *wdev = dev->ieee80211_ptr;
2360 -       struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
2361 -       if (rdev->ops->get_et_sset_count)
2362 -               return rdev_get_et_sset_count(rdev, dev, sset);
2363 -       return -EOPNOTSUPP;
2364 -}
2365 -
2366 -static void cfg80211_get_stats(struct net_device *dev,
2367 -                              struct ethtool_stats *stats, u64 *data)
2368 -{
2369 -       struct wireless_dev *wdev = dev->ieee80211_ptr;
2370 -       struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
2371 -       if (rdev->ops->get_et_stats)
2372 -               rdev_get_et_stats(rdev, dev, stats, data);
2373 -}
2374 -
2375 -static void cfg80211_get_strings(struct net_device *dev, u32 sset, u8 *data)
2376 -{
2377 -       struct wireless_dev *wdev = dev->ieee80211_ptr;
2378 -       struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
2379 -       if (rdev->ops->get_et_strings)
2380 -               rdev_get_et_strings(rdev, dev, sset, data);
2381 -}
2382 -
2383 -const struct ethtool_ops cfg80211_ethtool_ops = {
2384 -       .get_drvinfo = cfg80211_get_drvinfo,
2385 -       .get_regs_len = cfg80211_get_regs_len,
2386 -       .get_regs = cfg80211_get_regs,
2387 -       .get_link = ethtool_op_get_link,
2388 -       .get_ringparam = cfg80211_get_ringparam,
2389 -       .set_ringparam = cfg80211_set_ringparam,
2390 -       .get_strings = cfg80211_get_strings,
2391 -       .get_ethtool_stats = cfg80211_get_stats,
2392 -       .get_sset_count = cfg80211_get_sset_count,
2393 -};
2394 +EXPORT_SYMBOL(cfg80211_get_drvinfo);
2395 --- a/net/wireless/ethtool.h
2396 +++ /dev/null
2397 @@ -1,6 +0,0 @@
2398 -#ifndef __CFG80211_ETHTOOL__
2399 -#define __CFG80211_ETHTOOL__
2400 -
2401 -extern const struct ethtool_ops cfg80211_ethtool_ops;
2402 -
2403 -#endif /* __CFG80211_ETHTOOL__ */
2404 --- a/net/wireless/rdev-ops.h
2405 +++ b/net/wireless/rdev-ops.h
2406 @@ -714,25 +714,6 @@ static inline int rdev_get_antenna(struc
2407         return ret;
2408  }
2409  
2410 -static inline int rdev_set_ringparam(struct cfg80211_registered_device *rdev,
2411 -                                    u32 tx, u32 rx)
2412 -{
2413 -       int ret;
2414 -       trace_rdev_set_ringparam(&rdev->wiphy, tx, rx);
2415 -       ret = rdev->ops->set_ringparam(&rdev->wiphy, tx, rx);
2416 -       trace_rdev_return_int(&rdev->wiphy, ret);
2417 -       return ret;
2418 -}
2419 -
2420 -static inline void rdev_get_ringparam(struct cfg80211_registered_device *rdev,
2421 -                                     u32 *tx, u32 *tx_max, u32 *rx,
2422 -                                     u32 *rx_max)
2423 -{
2424 -       trace_rdev_get_ringparam(&rdev->wiphy);
2425 -       rdev->ops->get_ringparam(&rdev->wiphy, tx, tx_max, rx, rx_max);
2426 -       trace_rdev_return_void_tx_rx(&rdev->wiphy, *tx, *tx_max, *rx, *rx_max);
2427 -}
2428 -
2429  static inline int
2430  rdev_sched_scan_start(struct cfg80211_registered_device *rdev,
2431                       struct net_device *dev,
2432 @@ -816,35 +797,6 @@ static inline int rdev_set_noack_map(str
2433  }
2434  
2435  static inline int
2436 -rdev_get_et_sset_count(struct cfg80211_registered_device *rdev,
2437 -                      struct net_device *dev, int sset)
2438 -{
2439 -       int ret;
2440 -       trace_rdev_get_et_sset_count(&rdev->wiphy, dev, sset);
2441 -       ret = rdev->ops->get_et_sset_count(&rdev->wiphy, dev, sset);
2442 -       trace_rdev_return_int(&rdev->wiphy, ret);
2443 -       return ret;
2444 -}
2445 -
2446 -static inline void rdev_get_et_stats(struct cfg80211_registered_device *rdev,
2447 -                                    struct net_device *dev,
2448 -                                    struct ethtool_stats *stats, u64 *data)
2449 -{
2450 -       trace_rdev_get_et_stats(&rdev->wiphy, dev);
2451 -       rdev->ops->get_et_stats(&rdev->wiphy, dev, stats, data);
2452 -       trace_rdev_return_void(&rdev->wiphy);
2453 -}
2454 -
2455 -static inline void rdev_get_et_strings(struct cfg80211_registered_device *rdev,
2456 -                                      struct net_device *dev, u32 sset,
2457 -                                      u8 *data)
2458 -{
2459 -       trace_rdev_get_et_strings(&rdev->wiphy, dev, sset);
2460 -       rdev->ops->get_et_strings(&rdev->wiphy, dev, sset, data);
2461 -       trace_rdev_return_void(&rdev->wiphy);
2462 -}
2463 -
2464 -static inline int
2465  rdev_get_channel(struct cfg80211_registered_device *rdev,
2466                  struct wireless_dev *wdev,
2467                  struct cfg80211_chan_def *chandef)
2468 --- a/net/wireless/trace.h
2469 +++ b/net/wireless/trace.h
2470 @@ -298,11 +298,6 @@ DEFINE_EVENT(wiphy_only_evt, rdev_return
2471         TP_ARGS(wiphy)
2472  );
2473  
2474 -DEFINE_EVENT(wiphy_only_evt, rdev_get_ringparam,
2475 -       TP_PROTO(struct wiphy *wiphy),
2476 -       TP_ARGS(wiphy)
2477 -);
2478 -
2479  DEFINE_EVENT(wiphy_only_evt, rdev_get_antenna,
2480         TP_PROTO(struct wiphy *wiphy),
2481         TP_ARGS(wiphy)
2482 @@ -580,11 +575,6 @@ DEFINE_EVENT(wiphy_netdev_evt, rdev_stop
2483         TP_ARGS(wiphy, netdev)
2484  );
2485  
2486 -DEFINE_EVENT(wiphy_netdev_evt, rdev_get_et_stats,
2487 -       TP_PROTO(struct wiphy *wiphy, struct net_device *netdev),
2488 -       TP_ARGS(wiphy, netdev)
2489 -);
2490 -
2491  DEFINE_EVENT(wiphy_netdev_evt, rdev_sched_scan_stop,
2492         TP_PROTO(struct wiphy *wiphy, struct net_device *netdev),
2493         TP_ARGS(wiphy, netdev)
2494 @@ -1439,11 +1429,6 @@ DECLARE_EVENT_CLASS(tx_rx_evt,
2495                   WIPHY_PR_ARG, __entry->tx, __entry->rx)
2496  );
2497  
2498 -DEFINE_EVENT(tx_rx_evt, rdev_set_ringparam,
2499 -       TP_PROTO(struct wiphy *wiphy, u32 tx, u32 rx),
2500 -       TP_ARGS(wiphy, rx, tx)
2501 -);
2502 -
2503  DEFINE_EVENT(tx_rx_evt, rdev_set_antenna,
2504         TP_PROTO(struct wiphy *wiphy, u32 tx, u32 rx),
2505         TP_ARGS(wiphy, rx, tx)
2506 @@ -1725,40 +1710,6 @@ TRACE_EVENT(rdev_set_noack_map,
2507                   WIPHY_PR_ARG, NETDEV_PR_ARG, __entry->noack_map)
2508  );
2509  
2510 -TRACE_EVENT(rdev_get_et_sset_count,
2511 -       TP_PROTO(struct wiphy *wiphy, struct net_device *netdev, int sset),
2512 -       TP_ARGS(wiphy, netdev, sset),
2513 -       TP_STRUCT__entry(
2514 -               WIPHY_ENTRY
2515 -               NETDEV_ENTRY
2516 -               __field(int, sset)
2517 -       ),
2518 -       TP_fast_assign(
2519 -               WIPHY_ASSIGN;
2520 -               NETDEV_ASSIGN;
2521 -               __entry->sset = sset;
2522 -       ),
2523 -       TP_printk(WIPHY_PR_FMT ", " NETDEV_PR_FMT ", sset: %d",
2524 -                 WIPHY_PR_ARG, NETDEV_PR_ARG, __entry->sset)
2525 -);
2526 -
2527 -TRACE_EVENT(rdev_get_et_strings,
2528 -       TP_PROTO(struct wiphy *wiphy, struct net_device *netdev, u32 sset),
2529 -       TP_ARGS(wiphy, netdev, sset),
2530 -       TP_STRUCT__entry(
2531 -               WIPHY_ENTRY
2532 -               NETDEV_ENTRY
2533 -               __field(u32, sset)
2534 -       ),
2535 -       TP_fast_assign(
2536 -               WIPHY_ASSIGN;
2537 -               NETDEV_ASSIGN;
2538 -               __entry->sset = sset;
2539 -       ),
2540 -       TP_printk(WIPHY_PR_FMT ", " NETDEV_PR_FMT ", sset: %u",
2541 -                 WIPHY_PR_ARG, NETDEV_PR_ARG, __entry->sset)
2542 -);
2543 -
2544  DEFINE_EVENT(wiphy_wdev_evt, rdev_get_channel,
2545         TP_PROTO(struct wiphy *wiphy, struct wireless_dev *wdev),
2546         TP_ARGS(wiphy, wdev)
2547 --- /dev/null
2548 +++ b/net/mac80211/ethtool.c
2549 @@ -0,0 +1,244 @@
2550 +/*
2551 + * mac80211 ethtool hooks for cfg80211
2552 + *
2553 + * Copied from cfg.c - originally
2554 + * Copyright 2006-2010 Johannes Berg <johannes@sipsolutions.net>
2555 + * Copyright 2014      Intel Corporation (Author: Johannes Berg)
2556 + *
2557 + * This file is GPLv2 as found in COPYING.
2558 + */
2559 +#include <linux/types.h>
2560 +#include <net/cfg80211.h>
2561 +#include "ieee80211_i.h"
2562 +#include "sta_info.h"
2563 +#include "driver-ops.h"
2564 +
2565 +static int ieee80211_set_ringparam(struct net_device *dev,
2566 +                                  struct ethtool_ringparam *rp)
2567 +{
2568 +       struct ieee80211_local *local = wiphy_priv(dev->ieee80211_ptr->wiphy);
2569 +
2570 +       if (rp->rx_mini_pending != 0 || rp->rx_jumbo_pending != 0)
2571 +               return -EINVAL;
2572 +
2573 +       return drv_set_ringparam(local, rp->tx_pending, rp->rx_pending);
2574 +}
2575 +
2576 +static void ieee80211_get_ringparam(struct net_device *dev,
2577 +                                   struct ethtool_ringparam *rp)
2578 +{
2579 +       struct ieee80211_local *local = wiphy_priv(dev->ieee80211_ptr->wiphy);
2580 +
2581 +       memset(rp, 0, sizeof(*rp));
2582 +
2583 +       drv_get_ringparam(local, &rp->tx_pending, &rp->tx_max_pending,
2584 +                         &rp->rx_pending, &rp->rx_max_pending);
2585 +}
2586 +
2587 +static const char ieee80211_gstrings_sta_stats[][ETH_GSTRING_LEN] = {
2588 +       "rx_packets", "rx_bytes",
2589 +       "rx_duplicates", "rx_fragments", "rx_dropped",
2590 +       "tx_packets", "tx_bytes", "tx_fragments",
2591 +       "tx_filtered", "tx_retry_failed", "tx_retries",
2592 +       "beacon_loss", "sta_state", "txrate", "rxrate", "signal",
2593 +       "channel", "noise", "ch_time", "ch_time_busy",
2594 +       "ch_time_ext_busy", "ch_time_rx", "ch_time_tx"
2595 +};
2596 +#define STA_STATS_LEN  ARRAY_SIZE(ieee80211_gstrings_sta_stats)
2597 +
2598 +static int ieee80211_get_sset_count(struct net_device *dev, int sset)
2599 +{
2600 +       struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2601 +       int rv = 0;
2602 +
2603 +       if (sset == ETH_SS_STATS)
2604 +               rv += STA_STATS_LEN;
2605 +
2606 +       rv += drv_get_et_sset_count(sdata, sset);
2607 +
2608 +       if (rv == 0)
2609 +               return -EOPNOTSUPP;
2610 +       return rv;
2611 +}
2612 +
2613 +static void ieee80211_get_stats(struct net_device *dev,
2614 +                               struct ethtool_stats *stats,
2615 +                               u64 *data)
2616 +{
2617 +       struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2618 +       struct ieee80211_chanctx_conf *chanctx_conf;
2619 +       struct ieee80211_channel *channel;
2620 +       struct sta_info *sta;
2621 +       struct ieee80211_local *local = sdata->local;
2622 +       struct station_info sinfo;
2623 +       struct survey_info survey;
2624 +       int i, q;
2625 +#define STA_STATS_SURVEY_LEN 7
2626 +
2627 +       memset(data, 0, sizeof(u64) * STA_STATS_LEN);
2628 +
2629 +#define ADD_STA_STATS(sta)                             \
2630 +       do {                                            \
2631 +               data[i++] += sta->rx_packets;           \
2632 +               data[i++] += sta->rx_bytes;             \
2633 +               data[i++] += sta->num_duplicates;       \
2634 +               data[i++] += sta->rx_fragments;         \
2635 +               data[i++] += sta->rx_dropped;           \
2636 +                                                       \
2637 +               data[i++] += sinfo.tx_packets;          \
2638 +               data[i++] += sinfo.tx_bytes;            \
2639 +               data[i++] += sta->tx_fragments;         \
2640 +               data[i++] += sta->tx_filtered_count;    \
2641 +               data[i++] += sta->tx_retry_failed;      \
2642 +               data[i++] += sta->tx_retry_count;       \
2643 +               data[i++] += sta->beacon_loss_count;    \
2644 +       } while (0)
2645 +
2646 +       /* For Managed stations, find the single station based on BSSID
2647 +        * and use that.  For interface types, iterate through all available
2648 +        * stations and add stats for any station that is assigned to this
2649 +        * network device.
2650 +        */
2651 +
2652 +       mutex_lock(&local->sta_mtx);
2653 +
2654 +       if (sdata->vif.type == NL80211_IFTYPE_STATION) {
2655 +               sta = sta_info_get_bss(sdata, sdata->u.mgd.bssid);
2656 +
2657 +               if (!(sta && !WARN_ON(sta->sdata->dev != dev)))
2658 +                       goto do_survey;
2659 +
2660 +               sinfo.filled = 0;
2661 +               sta_set_sinfo(sta, &sinfo);
2662 +
2663 +               i = 0;
2664 +               ADD_STA_STATS(sta);
2665 +
2666 +               data[i++] = sta->sta_state;
2667 +
2668 +
2669 +               if (sinfo.filled & STATION_INFO_TX_BITRATE)
2670 +                       data[i] = 100000 *
2671 +                               cfg80211_calculate_bitrate(&sinfo.txrate);
2672 +               i++;
2673 +               if (sinfo.filled & STATION_INFO_RX_BITRATE)
2674 +                       data[i] = 100000 *
2675 +                               cfg80211_calculate_bitrate(&sinfo.rxrate);
2676 +               i++;
2677 +
2678 +               if (sinfo.filled & STATION_INFO_SIGNAL_AVG)
2679 +                       data[i] = (u8)sinfo.signal_avg;
2680 +               i++;
2681 +       } else {
2682 +               list_for_each_entry(sta, &local->sta_list, list) {
2683 +                       /* Make sure this station belongs to the proper dev */
2684 +                       if (sta->sdata->dev != dev)
2685 +                               continue;
2686 +
2687 +                       sinfo.filled = 0;
2688 +                       sta_set_sinfo(sta, &sinfo);
2689 +                       i = 0;
2690 +                       ADD_STA_STATS(sta);
2691 +               }
2692 +       }
2693 +
2694 +do_survey:
2695 +       i = STA_STATS_LEN - STA_STATS_SURVEY_LEN;
2696 +       /* Get survey stats for current channel */
2697 +       survey.filled = 0;
2698 +
2699 +       rcu_read_lock();
2700 +       chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
2701 +       if (chanctx_conf)
2702 +               channel = chanctx_conf->def.chan;
2703 +       else
2704 +               channel = NULL;
2705 +       rcu_read_unlock();
2706 +
2707 +       if (channel) {
2708 +               q = 0;
2709 +               do {
2710 +                       survey.filled = 0;
2711 +                       if (drv_get_survey(local, q, &survey) != 0) {
2712 +                               survey.filled = 0;
2713 +                               break;
2714 +                       }
2715 +                       q++;
2716 +               } while (channel != survey.channel);
2717 +       }
2718 +
2719 +       if (survey.filled)
2720 +               data[i++] = survey.channel->center_freq;
2721 +       else
2722 +               data[i++] = 0;
2723 +       if (survey.filled & SURVEY_INFO_NOISE_DBM)
2724 +               data[i++] = (u8)survey.noise;
2725 +       else
2726 +               data[i++] = -1LL;
2727 +       if (survey.filled & SURVEY_INFO_CHANNEL_TIME)
2728 +               data[i++] = survey.channel_time;
2729 +       else
2730 +               data[i++] = -1LL;
2731 +       if (survey.filled & SURVEY_INFO_CHANNEL_TIME_BUSY)
2732 +               data[i++] = survey.channel_time_busy;
2733 +       else
2734 +               data[i++] = -1LL;
2735 +       if (survey.filled & SURVEY_INFO_CHANNEL_TIME_EXT_BUSY)
2736 +               data[i++] = survey.channel_time_ext_busy;
2737 +       else
2738 +               data[i++] = -1LL;
2739 +       if (survey.filled & SURVEY_INFO_CHANNEL_TIME_RX)
2740 +               data[i++] = survey.channel_time_rx;
2741 +       else
2742 +               data[i++] = -1LL;
2743 +       if (survey.filled & SURVEY_INFO_CHANNEL_TIME_TX)
2744 +               data[i++] = survey.channel_time_tx;
2745 +       else
2746 +               data[i++] = -1LL;
2747 +
2748 +       mutex_unlock(&local->sta_mtx);
2749 +
2750 +       if (WARN_ON(i != STA_STATS_LEN))
2751 +               return;
2752 +
2753 +       drv_get_et_stats(sdata, stats, &(data[STA_STATS_LEN]));
2754 +}
2755 +
2756 +static void ieee80211_get_strings(struct net_device *dev, u32 sset, u8 *data)
2757 +{
2758 +       struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2759 +       int sz_sta_stats = 0;
2760 +
2761 +       if (sset == ETH_SS_STATS) {
2762 +               sz_sta_stats = sizeof(ieee80211_gstrings_sta_stats);
2763 +               memcpy(data, ieee80211_gstrings_sta_stats, sz_sta_stats);
2764 +       }
2765 +       drv_get_et_strings(sdata, sset, &(data[sz_sta_stats]));
2766 +}
2767 +
2768 +static int ieee80211_get_regs_len(struct net_device *dev)
2769 +{
2770 +       return 0;
2771 +}
2772 +
2773 +static void ieee80211_get_regs(struct net_device *dev,
2774 +                              struct ethtool_regs *regs,
2775 +                              void *data)
2776 +{
2777 +       struct wireless_dev *wdev = dev->ieee80211_ptr;
2778 +
2779 +       regs->version = wdev->wiphy->hw_version;
2780 +       regs->len = 0;
2781 +}
2782 +
2783 +const struct ethtool_ops ieee80211_ethtool_ops = {
2784 +       .get_drvinfo = cfg80211_get_drvinfo,
2785 +       .get_regs_len = ieee80211_get_regs_len,
2786 +       .get_regs = ieee80211_get_regs,
2787 +       .get_link = ethtool_op_get_link,
2788 +       .get_ringparam = ieee80211_get_ringparam,
2789 +       .set_ringparam = ieee80211_set_ringparam,
2790 +       .get_strings = ieee80211_get_strings,
2791 +       .get_ethtool_stats = ieee80211_get_stats,
2792 +       .get_sset_count = ieee80211_get_sset_count,
2793 +};
2794 --- a/net/mac80211/ibss.c
2795 +++ b/net/mac80211/ibss.c
2796 @@ -143,7 +143,7 @@ ieee80211_ibss_build_presp(struct ieee80
2797                 *pos++ = csa_settings->block_tx ? 1 : 0;
2798                 *pos++ = ieee80211_frequency_to_channel(
2799                                 csa_settings->chandef.chan->center_freq);
2800 -               sdata->csa_counter_offset_beacon[0] = (pos - presp->head);
2801 +               presp->csa_counter_offsets[0] = (pos - presp->head);
2802                 *pos++ = csa_settings->count;
2803         }
2804  
2805 @@ -1677,6 +1677,7 @@ int ieee80211_ibss_join(struct ieee80211
2806         sdata->u.ibss.control_port = params->control_port;
2807         sdata->u.ibss.userspace_handles_dfs = params->userspace_handles_dfs;
2808         sdata->u.ibss.basic_rates = params->basic_rates;
2809 +       sdata->u.ibss.last_scan_completed = jiffies;
2810  
2811         /* fix basic_rates if channel does not support these rates */
2812         rate_flags = ieee80211_chandef_rate_flags(&params->chandef);
2813 --- a/net/mac80211/mesh.c
2814 +++ b/net/mac80211/mesh.c
2815 @@ -679,7 +679,7 @@ ieee80211_mesh_build_beacon(struct ieee8
2816                 *pos++ = 0x0;
2817                 *pos++ = ieee80211_frequency_to_channel(
2818                                 csa->settings.chandef.chan->center_freq);
2819 -               sdata->csa_counter_offset_beacon[0] = hdr_len + 6;
2820 +               bcn->csa_counter_offsets[0] = hdr_len + 6;
2821                 *pos++ = csa->settings.count;
2822                 *pos++ = WLAN_EID_CHAN_SWITCH_PARAM;
2823                 *pos++ = 6;
2824 --- a/net/wireless/genregdb.awk
2825 +++ b/net/wireless/genregdb.awk
2826 @@ -65,17 +65,7 @@ function parse_reg_rule()
2827         sub(/,/, "", units)
2828         dfs_cac = $9
2829         if (units == "mW") {
2830 -               if (power == 100) {
2831 -                       power = 20
2832 -               } else if (power == 200) {
2833 -                       power = 23
2834 -               } else if (power == 500) {
2835 -                       power = 27
2836 -               } else if (power == 1000) {
2837 -                       power = 30
2838 -               } else {
2839 -                       print "Unknown power value in database!"
2840 -               }
2841 +               power = 10 * log(power)/log(10)
2842         } else {
2843                 dfs_cac = $8
2844         }
2845 @@ -114,7 +104,7 @@ function parse_reg_rule()
2846  
2847         }
2848         flags = flags "0"
2849 -       printf "\t\tREG_RULE_EXT(%d, %d, %d, %d, %d, %d, %s),\n", start, end, bw, gain, power, dfs_cac, flags
2850 +       printf "\t\tREG_RULE_EXT(%d, %d, %d, %d, %.0f, %d, %s),\n", start, end, bw, gain, power, dfs_cac, flags
2851         rules++
2852  }
2853  
2854 --- a/net/mac80211/debugfs_netdev.c
2855 +++ b/net/mac80211/debugfs_netdev.c
2856 @@ -34,8 +34,7 @@ static ssize_t ieee80211_if_read(
2857         ssize_t ret = -EINVAL;
2858  
2859         read_lock(&dev_base_lock);
2860 -       if (sdata->dev->reg_state == NETREG_REGISTERED)
2861 -               ret = (*format)(sdata, buf, sizeof(buf));
2862 +       ret = (*format)(sdata, buf, sizeof(buf));
2863         read_unlock(&dev_base_lock);
2864  
2865         if (ret >= 0)
2866 @@ -62,8 +61,7 @@ static ssize_t ieee80211_if_write(
2867  
2868         ret = -ENODEV;
2869         rtnl_lock();
2870 -       if (sdata->dev->reg_state == NETREG_REGISTERED)
2871 -               ret = (*write)(sdata, buf, count);
2872 +       ret = (*write)(sdata, buf, count);
2873         rtnl_unlock();
2874  
2875         return ret;
2876 --- a/drivers/net/wireless/b43/xmit.c
2877 +++ b/drivers/net/wireless/b43/xmit.c
2878 @@ -811,9 +811,13 @@ void b43_rx(struct b43_wldev *dev, struc
2879                 break;
2880         case B43_PHYTYPE_G:
2881                 status.band = IEEE80211_BAND_2GHZ;
2882 -               /* chanid is the radio channel cookie value as used
2883 -                * to tune the radio. */
2884 -               status.freq = chanid + 2400;
2885 +               /* Somewhere between 478.104 and 508.1084 firmware for G-PHY
2886 +                * has been modified to be compatible with N-PHY and others.
2887 +                */
2888 +               if (dev->fw.rev >= 508)
2889 +                       status.freq = ieee80211_channel_to_frequency(chanid, status.band);
2890 +               else
2891 +                       status.freq = chanid + 2400;
2892                 break;
2893         case B43_PHYTYPE_N:
2894         case B43_PHYTYPE_LP:
2895 --- a/drivers/net/wireless/b43/main.c
2896 +++ b/drivers/net/wireless/b43/main.c
2897 @@ -5216,6 +5216,7 @@ static int b43_wireless_core_attach(stru
2898         /* We don't support 5 GHz on some PHYs yet */
2899         switch (dev->phy.type) {
2900         case B43_PHYTYPE_A:
2901 +       case B43_PHYTYPE_G:
2902         case B43_PHYTYPE_N:
2903         case B43_PHYTYPE_LP:
2904         case B43_PHYTYPE_HT:
2905 --- a/net/wireless/reg.c
2906 +++ b/net/wireless/reg.c
2907 @@ -935,7 +935,7 @@ freq_reg_info_regd(struct wiphy *wiphy, 
2908                 if (!band_rule_found)
2909                         band_rule_found = freq_in_rule_band(fr, center_freq);
2910  
2911 -               bw_fits = reg_does_bw_fit(fr, center_freq, MHZ_TO_KHZ(5));
2912 +               bw_fits = reg_does_bw_fit(fr, center_freq, MHZ_TO_KHZ(20));
2913  
2914                 if (band_rule_found && bw_fits)
2915                         return rr;
2916 @@ -1019,10 +1019,10 @@ static void chan_reg_rule_print_dbg(cons
2917  }
2918  #endif
2919  
2920 -/* Find an ieee80211_reg_rule such that a 5MHz channel with frequency
2921 - * chan->center_freq fits there.
2922 - * If there is no such reg_rule, disable the channel, otherwise set the
2923 - * flags corresponding to the bandwidths allowed in the particular reg_rule
2924 +/*
2925 + * Note that right now we assume the desired channel bandwidth
2926 + * is always 20 MHz for each individual channel (HT40 uses 20 MHz
2927 + * per channel, the primary and the extension channel).
2928   */
2929  static void handle_channel(struct wiphy *wiphy,
2930                            enum nl80211_reg_initiator initiator,
2931 @@ -1083,12 +1083,8 @@ static void handle_channel(struct wiphy 
2932         if (reg_rule->flags & NL80211_RRF_AUTO_BW)
2933                 max_bandwidth_khz = reg_get_max_bandwidth(regd, reg_rule);
2934  
2935 -       if (max_bandwidth_khz < MHZ_TO_KHZ(10))
2936 -               bw_flags = IEEE80211_CHAN_NO_10MHZ;
2937 -       if (max_bandwidth_khz < MHZ_TO_KHZ(20))
2938 -               bw_flags |= IEEE80211_CHAN_NO_20MHZ;
2939         if (max_bandwidth_khz < MHZ_TO_KHZ(40))
2940 -               bw_flags |= IEEE80211_CHAN_NO_HT40;
2941 +               bw_flags = IEEE80211_CHAN_NO_HT40;
2942         if (max_bandwidth_khz < MHZ_TO_KHZ(80))
2943                 bw_flags |= IEEE80211_CHAN_NO_80MHZ;
2944         if (max_bandwidth_khz < MHZ_TO_KHZ(160))
2945 @@ -1522,12 +1518,8 @@ static void handle_channel_custom(struct
2946         if (reg_rule->flags & NL80211_RRF_AUTO_BW)
2947                 max_bandwidth_khz = reg_get_max_bandwidth(regd, reg_rule);
2948  
2949 -       if (max_bandwidth_khz < MHZ_TO_KHZ(10))
2950 -               bw_flags = IEEE80211_CHAN_NO_10MHZ;
2951 -       if (max_bandwidth_khz < MHZ_TO_KHZ(20))
2952 -               bw_flags |= IEEE80211_CHAN_NO_20MHZ;
2953         if (max_bandwidth_khz < MHZ_TO_KHZ(40))
2954 -               bw_flags |= IEEE80211_CHAN_NO_HT40;
2955 +               bw_flags = IEEE80211_CHAN_NO_HT40;
2956         if (max_bandwidth_khz < MHZ_TO_KHZ(80))
2957                 bw_flags |= IEEE80211_CHAN_NO_80MHZ;
2958         if (max_bandwidth_khz < MHZ_TO_KHZ(160))
2959 --- a/drivers/net/wireless/ath/ath9k/ath9k.h
2960 +++ b/drivers/net/wireless/ath/ath9k/ath9k.h
2961 @@ -185,7 +185,8 @@ struct ath_atx_ac {
2962  
2963  struct ath_frame_info {
2964         struct ath_buf *bf;
2965 -       int framelen;
2966 +       u16 framelen;
2967 +       s8 txq;
2968         enum ath9k_key_type keytype;
2969         u8 keyix;
2970         u8 rtscts_rate;
2971 --- a/drivers/net/wireless/ath/ath9k/xmit.c
2972 +++ b/drivers/net/wireless/ath/ath9k/xmit.c
2973 @@ -147,15 +147,13 @@ static void ath_set_rates(struct ieee802
2974  static void ath_txq_skb_done(struct ath_softc *sc, struct ath_txq *txq,
2975                              struct sk_buff *skb)
2976  {
2977 -       int q;
2978 -
2979 -       q = skb_get_queue_mapping(skb);
2980 -       if (txq == sc->tx.uapsdq)
2981 -               txq = sc->tx.txq_map[q];
2982 +       struct ath_frame_info *fi = get_frame_info(skb);
2983 +       int q = fi->txq;
2984  
2985 -       if (txq != sc->tx.txq_map[q])
2986 +       if (q < 0)
2987                 return;
2988  
2989 +       txq = sc->tx.txq_map[q];
2990         if (WARN_ON(--txq->pending_frames < 0))
2991                 txq->pending_frames = 0;
2992  
2993 @@ -1999,6 +1997,7 @@ static void setup_frame_info(struct ieee
2994                 an = (struct ath_node *) sta->drv_priv;
2995  
2996         memset(fi, 0, sizeof(*fi));
2997 +       fi->txq = -1;
2998         if (hw_key)
2999                 fi->keyix = hw_key->hw_key_idx;
3000         else if (an && ieee80211_is_data(hdr->frame_control) && an->ps_key > 0)
3001 @@ -2150,6 +2149,7 @@ int ath_tx_start(struct ieee80211_hw *hw
3002         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
3003         struct ieee80211_sta *sta = txctl->sta;
3004         struct ieee80211_vif *vif = info->control.vif;
3005 +       struct ath_frame_info *fi = get_frame_info(skb);
3006         struct ath_softc *sc = hw->priv;
3007         struct ath_txq *txq = txctl->txq;
3008         struct ath_atx_tid *tid = NULL;
3009 @@ -2170,11 +2170,13 @@ int ath_tx_start(struct ieee80211_hw *hw
3010         q = skb_get_queue_mapping(skb);
3011  
3012         ath_txq_lock(sc, txq);
3013 -       if (txq == sc->tx.txq_map[q] &&
3014 -           ++txq->pending_frames > sc->tx.txq_max_pending[q] &&
3015 -           !txq->stopped) {
3016 -               ieee80211_stop_queue(sc->hw, q);
3017 -               txq->stopped = true;
3018 +       if (txq == sc->tx.txq_map[q]) {
3019 +               fi->txq = q;
3020 +               if (++txq->pending_frames > sc->tx.txq_max_pending[q] &&
3021 +                   !txq->stopped) {
3022 +                       ieee80211_stop_queue(sc->hw, q);
3023 +                       txq->stopped = true;
3024 +               }
3025         }
3026  
3027         if (txctl->an && ieee80211_is_data_present(hdr->frame_control))