---- a/net/mac80211/status.c
-+++ b/net/mac80211/status.c
-@@ -34,7 +34,7 @@ void ieee80211_tx_status_irqsafe(struct
- skb_queue_len(&local->skb_queue_unreliable);
- while (tmp > IEEE80211_IRQSAFE_QUEUE_LIMIT &&
- (skb = skb_dequeue(&local->skb_queue_unreliable))) {
-- dev_kfree_skb_irq(skb);
-+ ieee80211_free_txskb(hw, skb);
- tmp--;
- I802_DEBUG_INC(local->tx_status_drop);
- }
-@@ -159,7 +159,7 @@ static void ieee80211_handle_filtered_fr
- "dropped TX filtered frame, queue_len=%d PS=%d @%lu\n",
- skb_queue_len(&sta->tx_filtered[ac]),
- !!test_sta_flag(sta, WLAN_STA_PS_STA), jiffies);
-- dev_kfree_skb(skb);
-+ ieee80211_free_txskb(&local->hw, skb);
- }
-
- static void ieee80211_check_pending_bar(struct sta_info *sta, u8 *addr, u8 tid)
-@@ -324,6 +324,75 @@ static void ieee80211_add_tx_radiotap_he
-
- }
-
-+static void ieee80211_report_used_skb(struct ieee80211_local *local,
-+ struct sk_buff *skb, bool dropped)
-+{
-+ struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-+ struct ieee80211_hdr *hdr = (void *)skb->data;
-+ bool acked = info->flags & IEEE80211_TX_STAT_ACK;
-+
-+ if (dropped)
-+ acked = false;
-+
-+ if (info->flags & IEEE80211_TX_INTFL_NL80211_FRAME_TX) {
-+ struct ieee80211_sub_if_data *sdata = NULL;
-+ struct ieee80211_sub_if_data *iter_sdata;
-+ u64 cookie = (unsigned long)skb;
-+
-+ rcu_read_lock();
-+
-+ if (skb->dev) {
-+ list_for_each_entry_rcu(iter_sdata, &local->interfaces,
-+ list) {
-+ if (!iter_sdata->dev)
-+ continue;
-+
-+ if (skb->dev == iter_sdata->dev) {
-+ sdata = iter_sdata;
-+ break;
-+ }
-+ }
-+ } else {
-+ sdata = rcu_dereference(local->p2p_sdata);
-+ }
-+
-+ if (!sdata)
-+ skb->dev = NULL;
-+ else if (ieee80211_is_nullfunc(hdr->frame_control) ||
-+ ieee80211_is_qos_nullfunc(hdr->frame_control)) {
-+ cfg80211_probe_status(sdata->dev, hdr->addr1,
-+ cookie, acked, GFP_ATOMIC);
-+ } else {
-+ cfg80211_mgmt_tx_status(&sdata->wdev, cookie, skb->data,
-+ skb->len, acked, GFP_ATOMIC);
-+ }
-+
-+ rcu_read_unlock();
-+ }
-+
-+ if (unlikely(info->ack_frame_id)) {
-+ struct sk_buff *ack_skb;
-+ unsigned long flags;
-+
-+ spin_lock_irqsave(&local->ack_status_lock, flags);
-+ ack_skb = idr_find(&local->ack_status_frames,
-+ info->ack_frame_id);
-+ if (ack_skb)
-+ idr_remove(&local->ack_status_frames,
-+ info->ack_frame_id);
-+ spin_unlock_irqrestore(&local->ack_status_lock, flags);
-+
-+ if (ack_skb) {
-+ if (!dropped) {
-+ /* consumes ack_skb */
-+ skb_complete_wifi_ack(ack_skb, acked);
-+ } else {
-+ dev_kfree_skb_any(ack_skb);
-+ }
-+ }
-+ }
-+}
-+
- /*
- * Use a static threshold for now, best value to be determined
- * by testing ...
-@@ -515,50 +584,7 @@ void ieee80211_tx_status(struct ieee8021
- msecs_to_jiffies(10));
- }
-
-- if (info->flags & IEEE80211_TX_INTFL_NL80211_FRAME_TX) {
-- u64 cookie = (unsigned long)skb;
-- acked = info->flags & IEEE80211_TX_STAT_ACK;
--
-- if (ieee80211_is_nullfunc(hdr->frame_control) ||
-- ieee80211_is_qos_nullfunc(hdr->frame_control)) {
-- cfg80211_probe_status(skb->dev, hdr->addr1,
-- cookie, acked, GFP_ATOMIC);
-- } else if (skb->dev) {
-- cfg80211_mgmt_tx_status(
-- skb->dev->ieee80211_ptr, cookie, skb->data,
-- skb->len, acked, GFP_ATOMIC);
-- } else {
-- struct ieee80211_sub_if_data *p2p_sdata;
--
-- rcu_read_lock();
--
-- p2p_sdata = rcu_dereference(local->p2p_sdata);
-- if (p2p_sdata) {
-- cfg80211_mgmt_tx_status(
-- &p2p_sdata->wdev, cookie, skb->data,
-- skb->len, acked, GFP_ATOMIC);
-- }
-- rcu_read_unlock();
-- }
-- }
--
-- if (unlikely(info->ack_frame_id)) {
-- struct sk_buff *ack_skb;
-- unsigned long flags;
--
-- spin_lock_irqsave(&local->ack_status_lock, flags);
-- ack_skb = idr_find(&local->ack_status_frames,
-- info->ack_frame_id);
-- if (ack_skb)
-- idr_remove(&local->ack_status_frames,
-- info->ack_frame_id);
-- spin_unlock_irqrestore(&local->ack_status_lock, flags);
--
-- /* consumes ack_skb */
-- if (ack_skb)
-- skb_complete_wifi_ack(ack_skb,
-- info->flags & IEEE80211_TX_STAT_ACK);
-- }
-+ ieee80211_report_used_skb(local, skb, false);
-
- /* this was a transmitted frame, but now we want to reuse it */
- skb_orphan(skb);
-@@ -634,25 +660,17 @@ EXPORT_SYMBOL(ieee80211_report_low_ack);
- void ieee80211_free_txskb(struct ieee80211_hw *hw, struct sk_buff *skb)
- {
- struct ieee80211_local *local = hw_to_local(hw);
-- struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
--
-- if (unlikely(info->ack_frame_id)) {
-- struct sk_buff *ack_skb;
-- unsigned long flags;
--
-- spin_lock_irqsave(&local->ack_status_lock, flags);
-- ack_skb = idr_find(&local->ack_status_frames,
-- info->ack_frame_id);
-- if (ack_skb)
-- idr_remove(&local->ack_status_frames,
-- info->ack_frame_id);
-- spin_unlock_irqrestore(&local->ack_status_lock, flags);
--
-- /* consumes ack_skb */
-- if (ack_skb)
-- dev_kfree_skb_any(ack_skb);
-- }
-
-+ ieee80211_report_used_skb(local, skb, true);
- dev_kfree_skb_any(skb);
- }
- EXPORT_SYMBOL(ieee80211_free_txskb);
-+
-+void ieee80211_purge_tx_queue(struct ieee80211_hw *hw,
-+ struct sk_buff_head *skbs)
-+{
-+ struct sk_buff *skb;
-+
-+ while ((skb = __skb_dequeue(skbs)))
-+ ieee80211_free_txskb(hw, skb);
-+}
---- a/drivers/net/wireless/p54/main.c
-+++ b/drivers/net/wireless/p54/main.c
-@@ -139,6 +139,7 @@ static int p54_beacon_format_ie_tim(stru
- static int p54_beacon_update(struct p54_common *priv,
- struct ieee80211_vif *vif)
- {
-+ struct ieee80211_tx_control control = { };
- struct sk_buff *beacon;
- int ret;
-
-@@ -158,7 +159,7 @@ static int p54_beacon_update(struct p54_
- * to cancel the old beacon template by hand, instead the firmware
- * will release the previous one through the feedback mechanism.
- */
-- p54_tx_80211(priv->hw, NULL, beacon);
-+ p54_tx_80211(priv->hw, &control, beacon);
- priv->tsf_high32 = 0;
- priv->tsf_low32 = 0;
-
---- a/net/wireless/reg.c
-+++ b/net/wireless/reg.c
-@@ -352,6 +352,9 @@ static void reg_regdb_search(struct work
- struct reg_regdb_search_request *request;
- const struct ieee80211_regdomain *curdom, *regdom;
- int i, r;
-+ bool set_reg = false;
-+
-+ mutex_lock(&cfg80211_mutex);
-
- mutex_lock(®_regdb_search_mutex);
- while (!list_empty(®_regdb_search_list)) {
-@@ -367,9 +370,7 @@ static void reg_regdb_search(struct work
- r = reg_copy_regd(®dom, curdom);
- if (r)
- break;
-- mutex_lock(&cfg80211_mutex);
-- set_regdom(regdom);
-- mutex_unlock(&cfg80211_mutex);
-+ set_reg = true;
- break;
- }
- }
-@@ -377,6 +378,11 @@ static void reg_regdb_search(struct work
- kfree(request);
- }
- mutex_unlock(®_regdb_search_mutex);
-+
-+ if (set_reg)
-+ set_regdom(regdom);
-+
-+ mutex_unlock(&cfg80211_mutex);
- }
-
- static DECLARE_WORK(reg_regdb_work, reg_regdb_search);
---- a/drivers/net/wireless/ath/ath9k/recv.c
-+++ b/drivers/net/wireless/ath/ath9k/recv.c
-@@ -424,8 +424,8 @@ u32 ath_calcrxfilter(struct ath_softc *s
- rfilt |= ATH9K_RX_FILTER_COMP_BAR;
-
- if (sc->nvifs > 1 || (sc->rx.rxfilter & FIF_OTHER_BSS)) {
-- /* The following may also be needed for other older chips */
-- if (sc->sc_ah->hw_version.macVersion == AR_SREV_VERSION_9160)
-+ /* This is needed for older chips */
-+ if (sc->sc_ah->hw_version.macVersion <= AR_SREV_VERSION_9160)
- rfilt |= ATH9K_RX_FILTER_PROM;
- rfilt |= ATH9K_RX_FILTER_MCAST_BCAST_ALL;
- }
---- a/net/mac80211/mlme.c
-+++ b/net/mac80211/mlme.c
-@@ -818,23 +818,71 @@ void ieee80211_sta_process_chanswitch(st
- }
-
- static void ieee80211_handle_pwr_constr(struct ieee80211_sub_if_data *sdata,
-- u16 capab_info, u8 *pwr_constr_elem,
-- u8 pwr_constr_elem_len)
-+ struct ieee80211_channel *channel,
-+ const u8 *country_ie, u8 country_ie_len,
-+ const u8 *pwr_constr_elem)
- {
-- struct ieee80211_conf *conf = &sdata->local->hw.conf;
-+ struct ieee80211_country_ie_triplet *triplet;
-+ int chan = ieee80211_frequency_to_channel(channel->center_freq);
-+ int i, chan_pwr, chan_increment, new_ap_level;
-+ bool have_chan_pwr = false;
-
-- if (!(capab_info & WLAN_CAPABILITY_SPECTRUM_MGMT))
-+ /* Invalid IE */
-+ if (country_ie_len % 2 || country_ie_len < IEEE80211_COUNTRY_IE_MIN_LEN)
- return;
-
-- /* Power constraint IE length should be 1 octet */
-- if (pwr_constr_elem_len != 1)
-- return;
-+ triplet = (void *)(country_ie + 3);
-+ country_ie_len -= 3;
-
-- if ((*pwr_constr_elem <= conf->channel->max_reg_power) &&
-- (*pwr_constr_elem != sdata->local->power_constr_level)) {
-- sdata->local->power_constr_level = *pwr_constr_elem;
-- ieee80211_hw_config(sdata->local, 0);
-+ switch (channel->band) {
-+ default:
-+ WARN_ON_ONCE(1);
-+ /* fall through */
-+ case IEEE80211_BAND_2GHZ:
-+ case IEEE80211_BAND_60GHZ:
-+ chan_increment = 1;
-+ break;
-+ case IEEE80211_BAND_5GHZ:
-+ chan_increment = 4;
-+ break;
- }
-+
-+ /* find channel */
-+ while (country_ie_len >= 3) {
-+ u8 first_channel = triplet->chans.first_channel;
-+
-+ if (first_channel >= IEEE80211_COUNTRY_EXTENSION_ID)
-+ goto next;
-+
-+ for (i = 0; i < triplet->chans.num_channels; i++) {
-+ if (first_channel + i * chan_increment == chan) {
-+ have_chan_pwr = true;
-+ chan_pwr = triplet->chans.max_power;
-+ break;
-+ }
-+ }
-+ if (have_chan_pwr)
-+ break;
-+
-+ next:
-+ triplet++;
-+ country_ie_len -= 3;
-+ }
-+
-+ if (!have_chan_pwr)
-+ return;
-+
-+ new_ap_level = max_t(int, 0, chan_pwr - *pwr_constr_elem);
-+
-+ if (sdata->local->ap_power_level == new_ap_level)
-+ return;
-+
-+ sdata_info(sdata,
-+ "Limiting TX power to %d (%d - %d) dBm as advertised by %pM\n",
-+ new_ap_level, chan_pwr, *pwr_constr_elem,
-+ sdata->u.mgd.bssid);
-+ sdata->local->ap_power_level = new_ap_level;
-+ ieee80211_hw_config(sdata->local, 0);
- }
-
- void ieee80211_enable_dyn_ps(struct ieee80211_vif *vif)
-@@ -1390,7 +1438,7 @@ static void ieee80211_set_disassoc(struc
- sta = sta_info_get(sdata, ifmgd->bssid);
- if (sta) {
- set_sta_flag(sta, WLAN_STA_BLOCK_BA);
-- ieee80211_sta_tear_down_BA_sessions(sta, tx);
-+ ieee80211_sta_tear_down_BA_sessions(sta, false);
- }
- mutex_unlock(&local->sta_mtx);
-
-@@ -1438,7 +1486,7 @@ static void ieee80211_set_disassoc(struc
- memset(&ifmgd->ht_capa, 0, sizeof(ifmgd->ht_capa));
- memset(&ifmgd->ht_capa_mask, 0, sizeof(ifmgd->ht_capa_mask));
-
-- local->power_constr_level = 0;
-+ local->ap_power_level = 0;
-
- del_timer_sync(&local->dynamic_ps_timer);
- cancel_work_sync(&local->dynamic_ps_enable_work);
-@@ -2530,15 +2578,13 @@ static void ieee80211_rx_mgmt_beacon(str
- bssid, true);
- }
-
-- /* Note: country IE parsing is done for us by cfg80211 */
-- if (elems.country_elem) {
-- /* TODO: IBSS also needs this */
-- if (elems.pwr_constr_elem)
-- ieee80211_handle_pwr_constr(sdata,
-- le16_to_cpu(mgmt->u.probe_resp.capab_info),
-- elems.pwr_constr_elem,
-- elems.pwr_constr_elem_len);
-- }
-+ if (elems.country_elem && elems.pwr_constr_elem &&
-+ mgmt->u.probe_resp.capab_info &
-+ cpu_to_le16(WLAN_CAPABILITY_SPECTRUM_MGMT))
-+ ieee80211_handle_pwr_constr(sdata, local->oper_channel,
-+ elems.country_elem,
-+ elems.country_elem_len,
-+ elems.pwr_constr_elem);
-
- ieee80211_bss_info_change_notify(sdata, changed);
- }
-@@ -3526,6 +3572,7 @@ int ieee80211_mgd_deauth(struct ieee8021
- {
- struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
- u8 frame_buf[DEAUTH_DISASSOC_LEN];
-+ bool tx = !req->local_state_change;
-
- mutex_lock(&ifmgd->mtx);
-
-@@ -3542,12 +3589,12 @@ int ieee80211_mgd_deauth(struct ieee8021
- if (ifmgd->associated &&
- ether_addr_equal(ifmgd->associated->bssid, req->bssid)) {
- ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
-- req->reason_code, true, frame_buf);
-+ req->reason_code, tx, frame_buf);
- } else {
- drv_mgd_prepare_tx(sdata->local, sdata);
- ieee80211_send_deauth_disassoc(sdata, req->bssid,
- IEEE80211_STYPE_DEAUTH,
-- req->reason_code, true,
-+ req->reason_code, tx,
- frame_buf);
- }
-
---- a/net/mac80211/sta_info.c
-+++ b/net/mac80211/sta_info.c
-@@ -585,7 +585,7 @@ static bool sta_info_cleanup_expire_buff
- */
- if (!skb)
- break;
-- dev_kfree_skb(skb);
-+ ieee80211_free_txskb(&local->hw, skb);
- }
-
- /*
-@@ -614,7 +614,7 @@ static bool sta_info_cleanup_expire_buff
- local->total_ps_buffered--;
- ps_dbg(sta->sdata, "Buffered frame expired (STA %pM)\n",
- sta->sta.addr);
-- dev_kfree_skb(skb);
-+ ieee80211_free_txskb(&local->hw, skb);
- }
-
- /*
-@@ -674,7 +674,7 @@ int __must_check __sta_info_destroy(stru
- * will be sufficient.
- */
- set_sta_flag(sta, WLAN_STA_BLOCK_BA);
-- ieee80211_sta_tear_down_BA_sessions(sta, true);
-+ ieee80211_sta_tear_down_BA_sessions(sta, false);
-
- ret = sta_info_hash_del(local, sta);
- if (ret)
-@@ -730,8 +730,8 @@ int __must_check __sta_info_destroy(stru
-
- for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
- local->total_ps_buffered -= skb_queue_len(&sta->ps_tx_buf[ac]);
-- __skb_queue_purge(&sta->ps_tx_buf[ac]);
-- __skb_queue_purge(&sta->tx_filtered[ac]);
-+ ieee80211_purge_tx_queue(&local->hw, &sta->ps_tx_buf[ac]);
-+ ieee80211_purge_tx_queue(&local->hw, &sta->tx_filtered[ac]);
- }
-
- #ifdef CONFIG_MAC80211_MESH
-@@ -765,7 +765,7 @@ int __must_check __sta_info_destroy(stru
- tid_tx = rcu_dereference_raw(sta->ampdu_mlme.tid_tx[i]);
- if (!tid_tx)
- continue;
-- __skb_queue_purge(&tid_tx->pending);
-+ ieee80211_purge_tx_queue(&local->hw, &tid_tx->pending);
- kfree(tid_tx);
- }
-
---- a/drivers/net/wireless/ath/ath5k/phy.c
-+++ b/drivers/net/wireless/ath/ath5k/phy.c
-@@ -1977,11 +1977,13 @@ ath5k_hw_set_spur_mitigation_filter(stru
- spur_delta_phase = (spur_offset << 18) / 25;
- spur_freq_sigma_delta = (spur_delta_phase >> 10);
- symbol_width = AR5K_SPUR_SYMBOL_WIDTH_BASE_100Hz / 2;
-+ break;
- case AR5K_BWMODE_5MHZ:
- /* Both sample_freq and chip_freq are 10MHz (?) */
- spur_delta_phase = (spur_offset << 19) / 25;
- spur_freq_sigma_delta = (spur_delta_phase >> 10);
- symbol_width = AR5K_SPUR_SYMBOL_WIDTH_BASE_100Hz / 4;
-+ break;
- default:
- if (channel->band == IEEE80211_BAND_5GHZ) {
- /* Both sample_freq and chip_freq are 40MHz */
---- a/net/mac80211/ieee80211_i.h
-+++ b/net/mac80211/ieee80211_i.h
-@@ -1062,7 +1062,7 @@ struct ieee80211_local {
- bool disable_dynamic_ps;
-
- int user_power_level; /* in dBm */
-- int power_constr_level; /* in dBm */
-+ int ap_power_level; /* in dBm */
-
- enum ieee80211_smps_mode smps_mode;
-
-@@ -1170,7 +1170,6 @@ struct ieee802_11_elems {
- u8 prep_len;
- u8 perr_len;
- u8 country_elem_len;
-- u8 pwr_constr_elem_len;
- u8 quiet_elem_len;
- u8 num_of_quiet_elem; /* can be more the one */
- u8 timeout_int_len;
-@@ -1318,6 +1317,8 @@ netdev_tx_t ieee80211_monitor_start_xmit
- struct net_device *dev);
- netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
- struct net_device *dev);
-+void ieee80211_purge_tx_queue(struct ieee80211_hw *hw,
-+ struct sk_buff_head *skbs);
-
- /* HT */
- void ieee80211_apply_htcap_overrides(struct ieee80211_sub_if_data *sdata,
---- a/net/mac80211/util.c
-+++ b/net/mac80211/util.c
-@@ -406,7 +406,7 @@ void ieee80211_add_pending_skb(struct ie
- int queue = info->hw_queue;
-
- if (WARN_ON(!info->control.vif)) {
-- kfree_skb(skb);
-+ ieee80211_free_txskb(&local->hw, skb);
- return;
- }
-
-@@ -431,7 +431,7 @@ void ieee80211_add_pending_skbs_fn(struc
- struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-
- if (WARN_ON(!info->control.vif)) {
-- kfree_skb(skb);
-+ ieee80211_free_txskb(&local->hw, skb);
- continue;
- }
-
-@@ -792,8 +792,11 @@ u32 ieee802_11_parse_elems_crc(u8 *start
- elems->country_elem_len = elen;
- break;
- case WLAN_EID_PWR_CONSTRAINT:
-+ if (elen != 1) {
-+ elem_parse_failed = true;
-+ break;
-+ }
- elems->pwr_constr_elem = pos;
-- elems->pwr_constr_elem_len = elen;
- break;
- case WLAN_EID_TIMEOUT_INTERVAL:
- elems->timeout_int = pos;
---- a/net/mac80211/main.c
-+++ b/net/mac80211/main.c
-@@ -154,13 +154,11 @@ int ieee80211_hw_config(struct ieee80211
-
- if (test_bit(SCAN_SW_SCANNING, &local->scanning) ||
- test_bit(SCAN_ONCHANNEL_SCANNING, &local->scanning) ||
-- test_bit(SCAN_HW_SCANNING, &local->scanning))
-+ test_bit(SCAN_HW_SCANNING, &local->scanning) ||
-+ !local->ap_power_level)
- power = chan->max_power;
- else
-- power = local->power_constr_level ?
-- min(chan->max_power,
-- (chan->max_reg_power - local->power_constr_level)) :
-- chan->max_power;
-+ power = min(chan->max_power, local->ap_power_level);
-
- if (local->user_power_level >= 0)
- power = min(power, local->user_power_level);
---- a/include/net/cfg80211.h
-+++ b/include/net/cfg80211.h
-@@ -1218,6 +1218,7 @@ struct cfg80211_deauth_request {
- const u8 *ie;
- size_t ie_len;
- u16 reason_code;
-+ bool local_state_change;
- };
-
- /**
---- a/net/wireless/mlme.c
-+++ b/net/wireless/mlme.c
-@@ -457,20 +457,14 @@ int __cfg80211_mlme_deauth(struct cfg802
- .reason_code = reason,
- .ie = ie,
- .ie_len = ie_len,
-+ .local_state_change = local_state_change,
- };
-
- ASSERT_WDEV_LOCK(wdev);
-
-- if (local_state_change) {
-- if (wdev->current_bss &&
-- ether_addr_equal(wdev->current_bss->pub.bssid, bssid)) {
-- cfg80211_unhold_bss(wdev->current_bss);
-- cfg80211_put_bss(&wdev->current_bss->pub);
-- wdev->current_bss = NULL;
-- }
--
-+ if (local_state_change && (!wdev->current_bss ||
-+ !ether_addr_equal(wdev->current_bss->pub.bssid, bssid)))
- return 0;
-- }
-
- return rdev->ops->deauth(&rdev->wiphy, dev, &req);
- }