package/kernel/mac80211/patches/300-pending_work.patch

   1 commit c977493766310a825f406836636ffd66e1447783
   2 Author: Felix Fietkau <nbd@openwrt.org>
   3 Date:   Mon Mar 10 19:52:56 2014 +0100
   4
   5     ath9k_hw: remove ANI function restrictions for AP mode
   6
   7     The primary purpose of this piece of code was to selectively disable
   8     OFDM weak signal detection. The checks for this are elsewhere, and an
   9     earlier commit relaxed the restrictions for older chips, which are more
  10     sensitive to interference.
  11
  12     Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  13
  14 commit 8d804f1af11e4e058b1e8453327777d73a585cb8
  15 Author: Felix Fietkau <nbd@openwrt.org>
  16 Date:   Sun Mar 9 11:25:43 2014 +0100
  17
  18     ath9k: clean up and enhance ANI debugfs file
  19
  20     Unify scnprintf calls and include the current OFDM/CCK immunity level.
  21
  22     Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  23
  24 commit 22e298b5a3a8a49e33805d4e351965123dede35b
  25 Author: Felix Fietkau <nbd@openwrt.org>
  26 Date:   Sun Mar 9 10:58:47 2014 +0100
  27
  28     ath9k: fix ready time of the multicast buffer queue
  29
  30     qi->tqi_readyTime is written directly to registers that expect
  31     microseconds as unit instead of TU.
  32     When setting the CABQ ready time, cur_conf->beacon_interval is in TU, so
  33     convert it to microseconds before passing it to ath9k_hw.
  34
  35     This should hopefully fix some Tx DMA issues with buffered multicast
  36     frames in AP mode.
  37
  38     Cc: stable@vger.kernel.org
  39     Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  40
  41 commit fcb064fdd5a27bec8d24099bc0172468f34c97cb
  42 Author: Felix Fietkau <nbd@openwrt.org>
  43 Date:   Sun Mar 9 09:43:09 2014 +0100
  44
  45     ath9k_hw: fix unreachable code in baseband hang detection code
  46
  47     The commit "ath9k: reduce baseband hang detection false positive rate"
  48     added a delay in the loop checking the baseband state, however it was
  49     unreachable due to previous 'continue' statements.
  50
  51     Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
  52     Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  53
  54 commit 31959d8df39319e32c6d5ba9c135727be90cfad7
  55 Author: Michal Kazior <michal.kazior@tieto.com>
  56 Date:   Fri Mar 7 08:09:38 2014 +0100
  57
  58     mac80211: fix possible NULL dereference
  59
  60     If chanctx is missing on a given vif then the band
  61     is assumed to be 2GHz. However if hw doesn't
  62     support 2GHz band then mac80211 ended up with a
  63     NULL dereference.
  64
  65     This fixes a splat:
  66
  67     [ 4605.207223] BUG: unable to handle kernel NULL pointer dereference at 0000000000000018
  68     [ 4605.210789] IP: [<ffffffffa07b5635>] ieee80211_parse_bitrates+0x65/0x110 [mac80211]
  69
  70     The splat was preceeded by WARN_ON(!chanctx_conf)
  71     in ieee80211_get_sdata_band().
  72
  73     Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
  74
  75 commit 6c5a3ffa0a2d22c091a2717f427259bacf77ac5e
  76 Author: Michael Braun <michael-dev@fami-braun.de>
  77 Date:   Thu Mar 6 15:08:43 2014 +0100
  78
  79     mac80211: fix WPA with VLAN on AP side with ps-sta again
  80
  81     commit de74a1d9032f4d37ea453ad2a647e1aff4cd2591
  82       "mac80211: fix WPA with VLAN on AP side with ps-sta"
  83     fixed an issue where queued multicast packets would
  84     be sent out encrypted with the key of an other bss.
  85
  86     commit "7cbf9d017dbb5e3276de7d527925d42d4c11e732"
  87       "mac80211: fix oops on mesh PS broadcast forwarding"
  88     essentially reverted it, because vif.type cannot be AP_VLAN
  89     due to the check to vif.type in ieee80211_get_buffered_bc before.
  90
  91     As the later commit intended to fix the MESH case, fix it
  92     by checking for IFTYPE_AP instead of IFTYPE_AP_VLAN.
  93
  94     Fixes: 7cbf9d017dbb
  95     Cc: <stable@vger.kernel.org> # 3.10.x
  96     Cc: <stable@vger.kernel.org> # 3.11.x
  97     Cc: <stable@vger.kernel.org> # 3.12.x
  98     Cc: <stable@vger.kernel.org> # 3.13.x
  99     Cc: <linux-wireless@vger.kernel.org>
 100     Cc: <projekt-wlan@fem.tu-ilmenau.de>
 101     Signed-off-by: Michael Braun <michael-dev@fami-braun.de>
 102
 103 commit 9d6ab9bdb9b368a6cf9519f0f92509b5b2c297ec
 104 Author: Johannes Berg <johannes.berg@intel.com>
 105 Date:   Mon Mar 3 14:19:08 2014 +0100
 106
 107     cfg80211: remove racy beacon_interval assignment
 108
 109     In case of AP mode, the beacon interval is already reset to
 110     zero inside cfg80211_stop_ap(), and in the other modes it
 111     isn't relevant. Remove the assignment to remove a potential
 112     race since the assignment isn't properly locked.
 113
 114     Reported-by: Michal Kazior <michal.kazior@tieto.com>
 115     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 116
 117 commit 1abdeca3c6fb9cf1f84f85e78ed8d1c33bd69db0
 118 Author: Felix Fietkau <nbd@openwrt.org>
 119 Date:   Fri Feb 28 18:52:56 2014 +0100
 120
 121     ath9k_hw: tweak noise immunity thresholds for older chipsets
 122
 123     Older chipsets are more sensitive to high PHY error counts, and the
 124     current noise immunity thresholds were based on tests run at QCA with
 125     newer chipsets.
 126
 127     This patch brings back the values from the old ANI implementation for
 128     old chipsets, and it also disables weak signal detection on an earlier
 129     noise immunity level, to improve overall radio stability on affected
 130     devices.
 131
 132     Signed-off-by: Felix Fietkau <nbd@openwrt.org>
 133
 134 commit 431e506da5953adc3b65af25f4b90873d528c115
 135 Author: Felix Fietkau <nbd@openwrt.org>
 136 Date:   Fri Feb 28 18:44:13 2014 +0100
 137
 138     ath9k_hw: toggle weak signal detection in AP mode on older chipsets
 139
 140     The commit 80b4205b "ath9k: Fix OFDM weak signal detection for AP mode"
 141     prevented weak signal detection changes from taking effect in AP mode on
 142     all chipsets, claiming it is "not allowed".
 143
 144     The main reason for not disabling weak signal detection in AP mode is
 145     that typically beacon RSSI is used to track whether it is needed to
 146     boost range, and this is unavailable in AP mode for obvious reasons.
 147
 148     The problem with not disabling weak signal detection is that older
 149     chipsets are very sensitive to high PHY error counts. When faced with
 150     heavy noise, this can lead to an excessive amount of "Failed to stop
 151     TX DMA" errors in the field.
 152
 153     Signed-off-by: Felix Fietkau <nbd@openwrt.org>
 154
 155 commit 98d1a6c5b14688ed030e81b889f607be308e0df9
 156 Author: Felix Fietkau <nbd@openwrt.org>
 157 Date:   Mon Feb 24 22:20:32 2014 +0100
 158
 159     ath9k: fix invalid descriptor discarding
 160
 161     Only set sc->rx.discard_next to rx_stats->rs_more when actually
 162     discarding the current descriptor.
 163
 164     Also, fix a detection of broken descriptors:
 165     First the code checks if the current descriptor is not done.
 166     Then it checks if the next descriptor is done.
 167     Add a check that afterwards checks the first descriptor again, because
 168     it might have been completed in the mean time.
 169
 170     This fixes a regression introduced in
 171     commit 723e711356b5a8a95728a890e254e8b0d47b55cf
 172     "ath9k: fix handling of broken descriptors"
 173
 174     Cc: stable@vger.kernel.org
 175     Reported-by: Marco André Dinis <marcoandredinis@gmail.com>
 176     Signed-off-by: Felix Fietkau <nbd@openwrt.org>
 177
 178 commit 52a46300e782fe6994466523eb2b0b59091ea59f
 179 Author: Felix Fietkau <nbd@openwrt.org>
 180 Date:   Mon Feb 24 11:43:50 2014 +0100
 181
 182     ath9k: reduce baseband hang detection false positive rate
 183
 184     Check if the baseband state remains stable, and add a small delay
 185     between register reads.
 186
 187     Signed-off-by: Felix Fietkau <nbd@openwrt.org>
 188
 189 commit 118945bb12082e9d4edddc868d88143164e0f440
 190 Author: Felix Fietkau <nbd@openwrt.org>
 191 Date:   Sat Feb 22 14:55:23 2014 +0100
 192
 193     ath5k: set SURVEY_INFO_IN_USE on get_survey
 194
 195     Only one channel is returned - the one currently being used.
 196
 197     Signed-off-by: Felix Fietkau <nbd@openwrt.org>
 198
 199 commit ee41f72476e1ea44283dfe1cbf75b9543a1e15c8
 200 Author: Felix Fietkau <nbd@openwrt.org>
 201 Date:   Sat Feb 22 14:44:52 2014 +0100
 202
 203     ath9k: make some hardware reset log messages debug-only
 204
 205     On some chips, baseband watchdog hangs are more common than others, and
 206     the driver has support for handling them.
 207     Interrupts even after a watchdog hang are also quite common, so there's
 208     not much point in spamming the user's logfiles.
 209
 210     Signed-off-by: Felix Fietkau <nbd@openwrt.org>
 211
 212 commit b14fbb554fc65a2e0b5c41a319269b0350f187e7
 213 Author: Felix Fietkau <nbd@openwrt.org>
 214 Date:   Sat Feb 22 14:35:25 2014 +0100
 215
 216     ath9k: do not set half/quarter channel flags in AR_PHY_MODE
 217
 218     5/10 MHz channel bandwidth is configured via the PLL clock, instead of
 219     the AR_PHY_MODE register. Using that register is AR93xx specific, and
 220     makes the mode incompatible with earlier chipsets.
 221
 222     In some early versions, these flags were apparently applied at the wrong
 223     point in time and thus did not cause connectivity issues, however now
 224     they are causing problems, as pointed out in this OpenWrt ticket:
 225
 226     https://dev.openwrt.org/ticket/14916
 227
 228     Signed-off-by: Felix Fietkau <nbd@openwrt.org>
 229
 230 commit 0f1cb7be2551b30b02cd54c897e0e29e483cfda5
 231 Author: Felix Fietkau <nbd@openwrt.org>
 232 Date:   Sat Feb 22 13:43:29 2014 +0100
 233
 234     ath9k: fix ps-poll responses under a-mpdu sessions
 235
 236     When passing tx frames to the U-APSD queue for powersave poll responses,
 237     the ath_atx_tid pointer needs to be passed to ath_tx_setup_buffer for
 238     proper sequence number accounting.
 239
 240     This fixes high latency and connection stability issues with ath9k
 241     running as AP and a few kinds of mobile phones as client, when PS-Poll
 242     is heavily used
 243
 244     Cc: stable@vger.kernel.org
 245     Signed-off-by: Felix Fietkau <nbd@openwrt.org>
 246
 247 commit d5d87a37bbd6066b2c3c5d0bd0fe2a6e2ea45cc5
 248 Author: Felix Fietkau <nbd@openwrt.org>
 249 Date:   Fri Feb 21 11:39:59 2014 +0100
 250
 251     ath9k: list more reset causes in debugfs
 252
 253     Number of MAC hangs and stuck beacons were missing
 254
 255     Signed-off-by: Felix Fietkau <nbd@openwrt.org>
 256
 257 commit d84856012e0f10fe598a5ad3b7b869397a089e07
 258 Author: Johannes Berg <johannes.berg@intel.com>
 259 Date:   Thu Feb 20 11:19:58 2014 +0100
 260
 261     mac80211: fix station wakeup powersave race
 262
 263     Consider the following (relatively unlikely) scenario:
 264      1) station goes to sleep while frames are buffered in driver
 265      2) driver blocks wakeup (until no more frames are buffered)
 266      3) station wakes up again
 267      4) driver unblocks wakeup
 268
 269     In this case, the current mac80211 code will do the following:
 270      1) WLAN_STA_PS_STA set
 271      2) WLAN_STA_PS_DRIVER set
 272      3) - nothing -
 273      4) WLAN_STA_PS_DRIVER cleared
 274
 275     As a result, no frames will be delivered to the client, even
 276     though it is awake, until it sends another frame to us that
 277     triggers ieee80211_sta_ps_deliver_wakeup() in sta_ps_end().
 278
 279     Since we now take the PS spinlock, we can fix this while at
 280     the same time removing the complexity with the pending skb
 281     queue function. This was broken since my commit 50a9432daeec
 282     ("mac80211: fix powersaving clients races") due to removing
 283     the clearing of WLAN_STA_PS_STA in the RX path.
 284
 285     While at it, fix a cleanup path issue when a station is
 286     removed while the driver is still blocking its wakeup.
 287
 288     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 289
 290 commit 798f2786602cbe93e6b928299614aa36ebf50692
 291 Author: Johannes Berg <johannes.berg@intel.com>
 292 Date:   Mon Feb 17 20:49:03 2014 +0100
 293
 294     mac80211: insert stations before adding to driver
 295
 296     There's a race condition in mac80211 because we add stations
 297     to the internal lists after adding them to the driver, which
 298     means that (for example) the following can happen:
 299      1. a station connects and is added
 300      2. first, it is added to the driver
 301      3. then, it is added to the mac80211 lists
 302
 303     If the station goes to sleep between steps 2 and 3, and the
 304     firmware/hardware records it as being asleep, mac80211 will
 305     never instruct the driver to wake it up again as it never
 306     realized it went to sleep since the RX path discarded the
 307     frame as a "spurious class 3 frame", no station entry was
 308     present yet.
 309
 310     Fix this by adding the station in software first, and only
 311     then adding it to the driver. That way, any state that the
 312     driver changes will be reflected properly in mac80211's
 313     station state. The problematic part is the roll-back if the
 314     driver fails to add the station, in that case a bit more is
 315     needed. To not make that overly complex prevent starting BA
 316     sessions in the meantime.
 317
 318     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 319
 320 commit b9ba6a520cb07ab3aa7aaaf9ce4a0bc7a6bc06fe
 321 Author: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
 322 Date:   Thu Feb 20 09:22:11 2014 +0200
 323
 324     mac80211: fix AP powersave TX vs. wakeup race
 325
 326     There is a race between the TX path and the STA wakeup: while
 327     a station is sleeping, mac80211 buffers frames until it wakes
 328     up, then the frames are transmitted. However, the RX and TX
 329     path are concurrent, so the packet indicating wakeup can be
 330     processed while a packet is being transmitted.
 331
 332     This can lead to a situation where the buffered frames list
 333     is emptied on the one side, while a frame is being added on
 334     the other side, as the station is still seen as sleeping in
 335     the TX path.
 336
 337     As a result, the newly added frame will not be send anytime
 338     soon. It might be sent much later (and out of order) when the
 339     station goes to sleep and wakes up the next time.
 340
 341     Additionally, it can lead to the crash below.
 342
 343     Fix all this by synchronising both paths with a new lock.
 344     Both path are not fastpath since they handle PS situations.
 345
 346     In a later patch we'll remove the extra skb queue locks to
 347     reduce locking overhead.
 348
 349     BUG: unable to handle kernel
 350     NULL pointer dereference at 000000b0
 351     IP: [<ff6f1791>] ieee80211_report_used_skb+0x11/0x3e0 [mac80211]
 352     *pde = 00000000
 353     Oops: 0000 [#1] SMP DEBUG_PAGEALLOC
 354     EIP: 0060:[<ff6f1791>] EFLAGS: 00210282 CPU: 1
 355     EIP is at ieee80211_report_used_skb+0x11/0x3e0 [mac80211]
 356     EAX: e5900da0 EBX: 00000000 ECX: 00000001 EDX: 00000000
 357     ESI: e41d00c0 EDI: e5900da0 EBP: ebe458e4 ESP: ebe458b0
 358      DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
 359     CR0: 8005003b CR2: 000000b0 CR3: 25a78000 CR4: 000407d0
 360     DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
 361     DR6: ffff0ff0 DR7: 00000400
 362     Process iperf (pid: 3934, ti=ebe44000 task=e757c0b0 task.ti=ebe44000)
 363     iwlwifi 0000:02:00.0: I iwl_pcie_enqueue_hcmd Sending command LQ_CMD (#4e), seq: 0x0903, 92 bytes at 3[3]:9
 364     Stack:
 365      e403b32c ebe458c4 00200002 00200286 e403b338 ebe458cc c10960bb e5900da0
 366      ff76a6ec ebe458d8 00000000 e41d00c0 e5900da0 ebe458f0 ff6f1b75 e403b210
 367      ebe4598c ff723dc1 00000000 ff76a6ec e597c978 e403b758 00000002 00000002
 368     Call Trace:
 369      [<ff6f1b75>] ieee80211_free_txskb+0x15/0x20 [mac80211]
 370      [<ff723dc1>] invoke_tx_handlers+0x1661/0x1780 [mac80211]
 371      [<ff7248a5>] ieee80211_tx+0x75/0x100 [mac80211]
 372      [<ff7249bf>] ieee80211_xmit+0x8f/0xc0 [mac80211]
 373      [<ff72550e>] ieee80211_subif_start_xmit+0x4fe/0xe20 [mac80211]
 374      [<c149ef70>] dev_hard_start_xmit+0x450/0x950
 375      [<c14b9aa9>] sch_direct_xmit+0xa9/0x250
 376      [<c14b9c9b>] __qdisc_run+0x4b/0x150
 377      [<c149f732>] dev_queue_xmit+0x2c2/0xca0
 378
 379     Cc: stable@vger.kernel.org
 380     Reported-by: Yaara Rozenblum <yaara.rozenblum@intel.com>
 381     Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
 382     Reviewed-by: Stanislaw Gruszka <sgruszka@redhat.com>
 383     [reword commit log, use a separate lock]
 384     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 385
 386 commit 80e419de0dff38436b30d363311c625766193f86
 387 Author: Inbal Hacohen <Inbal.Hacohen@intel.com>
 388 Date:   Wed Feb 12 09:32:27 2014 +0200
 389
 390     cfg80211: bugfix in regulatory user hint process
 391
 392     After processing hint_user, we would want to schedule the
 393     timeout work only if we are actually waiting to CRDA. This happens
 394     when the status is not "IGNORE" nor "ALREADY_SET".
 395
 396     Signed-off-by: Inbal Hacohen <Inbal.Hacohen@intel.com>
 397     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 398
 399 commit 6514c93afede55284e2cb63359aadedb85884c80
 400 Author: Jouni Malinen <jouni@qca.qualcomm.com>
 401 Date:   Tue Feb 18 20:41:08 2014 +0200
 402
 403     ath9k: Enable U-APSD AP mode support
 404
 405     mac80211 handles the actual operations, so ath9k can just indicate
 406     support for this. Based on initial tests, this combination seems to
 407     work fine.
 408
 409     Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
 410
 411 commit a63caf0a357ad5c1f08d6b7827dc76c451445017
 412 Author: Stanislaw Gruszka <sgruszka@redhat.com>
 413 Date:   Wed Feb 19 13:15:17 2014 +0100
 414
 415     ath9k: protect tid->sched check
 416
 417     We check tid->sched without a lock taken on ath_tx_aggr_sleep(). That
 418     is race condition which can result of doing list_del(&tid->list) twice
 419     (second time with poisoned list node) and cause crash like shown below:
 420
 421     [424271.637220] BUG: unable to handle kernel paging request at 00100104
 422     [424271.637328] IP: [<f90fc072>] ath_tx_aggr_sleep+0x62/0xe0 [ath9k]
 423     ...
 424     [424271.639953] Call Trace:
 425     [424271.639998]  [<f90f6900>] ? ath9k_get_survey+0x110/0x110 [ath9k]
 426     [424271.640083]  [<f90f6942>] ath9k_sta_notify+0x42/0x50 [ath9k]
 427     [424271.640177]  [<f809cfef>] sta_ps_start+0x8f/0x1c0 [mac80211]
 428     [424271.640258]  [<c10f730e>] ? free_compound_page+0x2e/0x40
 429     [424271.640346]  [<f809e915>] ieee80211_rx_handlers+0x9d5/0x2340 [mac80211]
 430     [424271.640437]  [<c112f048>] ? kmem_cache_free+0x1d8/0x1f0
 431     [424271.640510]  [<c1345a84>] ? kfree_skbmem+0x34/0x90
 432     [424271.640578]  [<c10fc23c>] ? put_page+0x2c/0x40
 433     [424271.640640]  [<c1345a84>] ? kfree_skbmem+0x34/0x90
 434     [424271.640706]  [<c1345a84>] ? kfree_skbmem+0x34/0x90
 435     [424271.640787]  [<f809dde3>] ? ieee80211_rx_handlers_result+0x73/0x1d0 [mac80211]
 436     [424271.640897]  [<f80a07a0>] ieee80211_prepare_and_rx_handle+0x520/0xad0 [mac80211]
 437     [424271.641009]  [<f809e22d>] ? ieee80211_rx_handlers+0x2ed/0x2340 [mac80211]
 438     [424271.641104]  [<c13846ce>] ? ip_output+0x7e/0xd0
 439     [424271.641182]  [<f80a1057>] ieee80211_rx+0x307/0x7c0 [mac80211]
 440     [424271.641266]  [<f90fa6ee>] ath_rx_tasklet+0x88e/0xf70 [ath9k]
 441     [424271.641358]  [<f80a0f2c>] ? ieee80211_rx+0x1dc/0x7c0 [mac80211]
 442     [424271.641445]  [<f90f82db>] ath9k_tasklet+0xcb/0x130 [ath9k]
 443
 444     Bug report:
 445     https://bugzilla.kernel.org/show_bug.cgi?id=70551
 446
 447     Reported-and-tested-by: Max Sydorenko <maxim.stargazer@gmail.com>
 448     Cc: stable@vger.kernel.org
 449     Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
 450
 451 commit 82ed9e3ccc02797df2ffe4b78127c4cd5f799a41
 452 Author: Felix Fietkau <nbd@openwrt.org>
 453 Date:   Tue Feb 11 15:54:13 2014 +0100
 454
 455     mac80211: send control port protocol frames to the VO queue
 456
 457     Improves reliability of wifi connections with WPA, since authentication
 458     frames are prioritized over normal traffic and also typically exempt
 459     from aggregation.
 460
 461     Cc: stable@vger.kernel.org
 462     Signed-off-by: Felix Fietkau <nbd@openwrt.org>
 463
 464 commit d4426800f71e972feaa33e04c5801fc730627bdd
 465 Author: Stanislaw Gruszka <stf_xl@wp.pl>
 466 Date:   Mon Feb 10 22:38:28 2014 +0100
 467
 468     rtl8187: fix regression on MIPS without coherent DMA
 469
 470     This patch fixes regression caused by commit a16dad77634 "MIPS: Fix
 471     potencial corruption". That commit fixes one corruption scenario in
 472     cost of adding another one, which actually start to cause crashes
 473     on Yeeloong laptop when rtl8187 driver is used.
 474
 475     For correct DMA read operation on machines without DMA coherence, kernel
 476     have to invalidate cache, such it will refill later with new data that
 477     device wrote to memory, when that data is needed to process. We can only
 478     invalidate full cache line. Hence when cache line includes both dma
 479     buffer and some other data (written in cache, but not yet in main
 480     memory), the other data can not hit memory due to invalidation. That
 481     happen on rtl8187 where struct rtl8187_priv fields are located just
 482     before and after small buffers that are passed to USB layer and DMA
 483     is performed on them.
 484
 485     To fix the problem we align buffers and reserve space after them to make
 486     them match cache line.
 487
 488     This patch does not resolve all possible MIPS problems entirely, for
 489     that we have to assure that we always map cache aligned buffers for DMA,
 490     what can be complex or even not possible. But patch fixes visible and
 491     reproducible regression and seems other possible corruptions do not
 492     happen in practice, since Yeeloong laptop works stable without rtl8187
 493     driver.
 494
 495     Bug report:
 496     https://bugzilla.kernel.org/show_bug.cgi?id=54391
 497
 498     Reported-by: Petr Pisar <petr.pisar@atlas.cz>
 499     Bisected-by: Tom Li <biergaizi2009@gmail.com>
 500     Reported-and-tested-by: Tom Li <biergaizi2009@gmail.com>
 501     Cc: stable@vger.kernel.org
 502     Signed-off-by: Stanislaw Gruszka <stf_xl@wp.pl>
 503
 504 commit e2f141d67ad1e7fe10aaab61811e8a409dfb2442
 505 Author: Sujith Manoharan <c_manoha@qca.qualcomm.com>
 506 Date:   Fri Feb 7 10:29:55 2014 +0530
 507
 508     ath9k: Calculate IQ-CAL median
 509
 510     This patch adds a routine to calculate the median IQ correction
 511     values for AR955x, which is used for outlier detection.
 512     The normal method which is used for all other chips is
 513     bypassed for AR955x.
 514
 515     Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
 516
 517 commit c52a6fce0820c8d0687443ab86058ae03b478c8f
 518 Author: Sujith Manoharan <c_manoha@qca.qualcomm.com>
 519 Date:   Fri Feb 7 10:29:54 2014 +0530
 520
 521     ath9k: Expand the IQ coefficient array
 522
 523     This will be used for storing data for mutiple
 524     IQ calibration runs, for AR955x.
 525
 526     Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
 527
 528 commit 034969ff5c2b6431d10e07c1938f0b916da85cc3
 529 Author: Sujith Manoharan <c_manoha@qca.qualcomm.com>
 530 Date:   Fri Feb 7 10:29:53 2014 +0530
 531
 532     ath9k: Modify IQ calibration for AR955x
 533
 534     IQ calibration post-processing for AR955x is different
 535     from other chips - instead of just doing it as part
 536     of AGC calibration once, it is triggered 3 times and
 537     a median is determined. This patch adds initial support
 538     for changing the calibration behavior for AR955x.
 539
 540     Also, to simplify things, a helper routine to issue/poll
 541     AGC calibration is used.
 542
 543     For non-AR955x chips, the iqcal_idx (which will be used
 544     in subsequent patches) is set to zero.
 545
 546     Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
 547
 548 commit 9b1ed6454e6f3511f24266be99b4e403f243f6a8
 549 Author: Sujith Manoharan <c_manoha@qca.qualcomm.com>
 550 Date:   Fri Feb 7 10:29:52 2014 +0530
 551
 552     ath9k: Fix magnitude/phase calculation
 553
 554     Incorrect values are programmed in the registers
 555     containing the IQ correction coefficients by the IQ-CAL
 556     post-processing code. Fix this.
 557
 558     Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
 559
 560 commit 36f93484f96f79171dcecb67c5ef0c3de22531a6
 561 Author: Sujith Manoharan <c_manoha@qca.qualcomm.com>
 562 Date:   Fri Feb 7 10:29:51 2014 +0530
 563
 564     ath9k: Rename ar9003_hw_tx_iqcal_load_avg_2_passes
 565
 566     Use ar9003_hw_tx_iq_cal_outlier_detection instead.
 567
 568     Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
 569
 570 commit 3af09a7f5d21dd5fd15b973ce6a91a575da30417
 571 Author: Sujith Manoharan <c_manoha@qca.qualcomm.com>
 572 Date:   Fri Feb 7 10:29:50 2014 +0530
 573
 574     ath9k: Check explicitly for IQ calibration
 575
 576     In chips like AR955x, the initvals contain the information
 577     whether IQ calibration is to be done in the HW when an
 578     AGC calibration is triggered. Check if IQ-CAL is enabled
 579     in the initvals before flagging 'txiqcal_done' as true.
 580
 581     Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
 582
 583 commit cb4969634b93c4643a32cc3fbd27d2b288b25771
 584 Author: Sujith Manoharan <c_manoha@qca.qualcomm.com>
 585 Date:   Fri Feb 7 10:29:49 2014 +0530
 586
 587     ath9k: Fix IQ cal post processing for SoC
 588
 589     Calibration data is not reused for SoC chips, so
 590     call ar9003_hw_tx_iq_cal_post_proc() with the correct
 591     argument. The 'is_reusable' flag is currently used
 592     only for PC-OEM chips, but it makes things clearer to
 593     specify it explicity.
 594
 595     Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
 596
 597 commit e138e0ef9560c46ce93dbb22a728a57888e94d1c
 598 Author: Sujith Manoharan <c_manoha@qca.qualcomm.com>
 599 Date:   Mon Feb 3 13:31:37 2014 +0530
 600
 601     ath9k: Fix TX power calculation
 602
 603     The commit, "ath9k_hw: Fix incorrect Tx control power in AR9003 template"
 604     fixed the incorrect values in the eeprom templates, but if
 605     boards have already been calibrated with incorrect values,
 606     they would still be using the wrong TX power. Fix this by assigning
 607     a default value in such cases.
 608
 609     Cc: Rajkumar Manoharan <rmanohar@qti.qualcomm.com>
 610     Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
 611
 612 commit b9f268b5b01331c3c82179abca551429450e9417
 613 Author: Michal Kazior <michal.kazior@tieto.com>
 614 Date:   Wed Jan 29 14:22:27 2014 +0100
 615
 616     cfg80211: consider existing DFS interfaces
 617
 618     It was possible to break interface combinations in
 619     the following way:
 620
 621      combo 1: iftype = AP, num_ifaces = 2, num_chans = 2,
 622      combo 2: iftype = AP, num_ifaces = 1, num_chans = 1, radar = HT20
 623
 624     With the above interface combinations it was
 625     possible to:
 626
 627      step 1. start AP on DFS channel by matching combo 2
 628      step 2. start AP on non-DFS channel by matching combo 1
 629
 630     This was possible beacuse (step 2) did not consider
 631     if other interfaces require radar detection.
 632
 633     The patch changes how cfg80211 tracks channels -
 634     instead of channel itself now a complete chandef
 635     is stored.
 636
 637     Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
 638     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 639
 640 commit bc9c62f5f511cc395c62dbf4cdd437f23db53b28
 641 Author: Antonio Quartulli <antonio@open-mesh.com>
 642 Date:   Wed Jan 29 17:53:43 2014 +0100
 643
 644     cfg80211: fix channel configuration in IBSS join
 645
 646     When receiving an IBSS_JOINED event select the BSS object
 647     based on the {bssid, channel} couple rather than the bssid
 648     only.
 649     With the current approach if another cell having the same
 650     BSSID (but using a different channel) exists then cfg80211
 651     picks up the wrong BSS object.
 652     The result is a mismatching channel configuration between
 653     cfg80211 and the driver, that can lead to any sort of
 654     problem.
 655
 656     The issue can be triggered by having an IBSS sitting on
 657     given channel and then asking the driver to create a new
 658     cell using the same BSSID but with a different frequency.
 659     By passing the channel to cfg80211_get_bss() we can solve
 660     this ambiguity and retrieve/create the correct BSS object.
 661     All the users of cfg80211_ibss_joined() have been changed
 662     accordingly.
 663
 664     Moreover WARN when cfg80211_ibss_joined() gets a NULL
 665     channel as argument and remove a bogus call of the same
 666     function in ath6kl (it does not make sense to call
 667     cfg80211_ibss_joined() with a zero BSSID on ibss-leave).
 668
 669     Cc: Kalle Valo <kvalo@qca.qualcomm.com>
 670     Cc: Arend van Spriel <arend@broadcom.com>
 671     Cc: Bing Zhao <bzhao@marvell.com>
 672     Cc: Jussi Kivilinna <jussi.kivilinna@iki.fi>
 673     Cc: libertas-dev@lists.infradead.org
 674     Acked-by: Kalle Valo <kvalo@qca.qualcomm.com>
 675     Signed-off-by: Antonio Quartulli <antonio@open-mesh.com>
 676     [minor code cleanup in ath6kl]
 677     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 678
 679 commit 7e0c41cb41f215aba2c39b1c237bb4d42ec49a85
 680 Author: Johannes Berg <johannes.berg@intel.com>
 681 Date:   Fri Jan 24 14:41:44 2014 +0100
 682
 683     mac80211: fix bufferable MMPDU RX handling
 684
 685     Action, disassoc and deauth frames are bufferable, and as such don't
 686     have the PM bit in the frame control field reserved which means we
 687     need to react to the bit when receiving in such a frame.
 688
 689     Fix this by introducing a new helper ieee80211_is_bufferable_mmpdu()
 690     and using it for the RX path that currently ignores the PM bit in
 691     any non-data frames for doze->wake transitions, but listens to it in
 692     all frames for wake->doze transitions, both of which are wrong.
 693
 694     Also use the new helper in the TX path to clean up the code.
 695
 696     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 697
 698 commit fc0df6d2343636e3f48a069330d5b972e3d8659d
 699 Author: Janusz Dziedzic <janusz.dziedzic@tieto.com>
 700 Date:   Fri Jan 24 14:29:21 2014 +0100
 701
 702     cfg80211: set preset_chandef after channel switch
 703
 704     Set preset_chandef in channel switch notification.
 705     In other case we will have old preset_chandef.
 706
 707     Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
 708     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 709
 710 commit cdec895e2344987ff171cece96e25d7407a3ebf6
 711 Author: Simon Wunderlich <simon@open-mesh.com>
 712 Date:   Fri Jan 24 23:48:29 2014 +0100
 713
 714     mac80211: send ibss probe responses with noack flag
 715
 716     Responding to probe requests for scanning clients will often create
 717     excessive retries, as it happens quite often that the scanning client
 718     already left the channel. Therefore do it like hostapd and send probe
 719     responses for wildcard SSID only once by using the noack flag.
 720
 721     Signed-off-by: Simon Wunderlich <simon@open-mesh.com>
 722     [fix typo & 'wildcard SSID' in commit log]
 723     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 724
 725 commit 0b865d1e6b9c05052adae9315df7cb195dc60c3b
 726 Author: Luciano Coelho <luciano.coelho@intel.com>
 727 Date:   Tue Jan 28 17:09:08 2014 +0200
 728
 729     mac80211: ibss: remove unnecessary call to release channel
 730
 731     The ieee80211_vif_use_channel() function calls
 732     ieee80211_vif_release_channel(), so there's no need to call it
 733     explicitly in __ieee80211_sta_join_ibss().
 734
 735     Signed-off-by: Luciano Coelho <luciano.coelho@intel.com>
 736     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 737
 738 commit e1b6c17e971f0a51ff86c2dac2584c63cd999cd7
 739 Author: Michal Kazior <michal.kazior@tieto.com>
 740 Date:   Wed Jan 29 07:56:21 2014 +0100
 741
 742     mac80211: add missing CSA locking
 743
 744     The patch adds a missing sdata lock and adds a few
 745     lockdeps for easier maintenance.
 746
 747     Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
 748     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 749
 750 commit ad17ba7d14d225b109b73c177cd446afb8050598
 751 Author: Michal Kazior <michal.kazior@tieto.com>
 752 Date:   Wed Jan 29 07:56:20 2014 +0100
 753
 754     mac80211: fix sdata->radar_required locking
 755
 756     radar_required setting wasn't protected by
 757     local->mtx in some places. This should prevent
 758     from scanning/radar detection/roc colliding.
 759
 760     Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
 761     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 762
 763 commit 5fcd5f1808813a3d9e502fd756e01bee8a79c85d
 764 Author: Michal Kazior <michal.kazior@tieto.com>
 765 Date:   Wed Jan 29 07:56:19 2014 +0100
 766
 767     mac80211: move csa_active setting in STA CSA
 768
 769     The sdata->vif.csa_active could be left set after,
 770     e.g. channel context constraints check fail in STA
 771     mode leaving the interface in a strange state for
 772     a brief period of time until it is disconnected.
 773     This was harmless but ugly.
 774
 775     Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
 776     Reviewed-by: Luciano Coelho <luciano.coelho@intel.com>
 777     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 778
 779 commit e486da4b7eed71821c6b4c1bb9ac62ffd3ab13e9
 780 Author: Michal Kazior <michal.kazior@tieto.com>
 781 Date:   Wed Jan 29 07:56:18 2014 +0100
 782
 783     mac80211: fix possible memory leak on AP CSA failure
 784
 785     If CSA for AP interface failed and the interface
 786     was not stopped afterwards another CSA request
 787     would leak sdata->u.ap.next_beacon.
 788
 789     Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
 790     Reviewed-by: Luciano Coelho <luciano.coelho@intel.com>
 791     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 792
 793 commit 3a77ba08940682bf3d52cf14f980337324af9d4a
 794 Author: Johannes Berg <johannes.berg@intel.com>
 795 Date:   Sat Feb 1 00:33:29 2014 +0100
 796
 797     mac80211: fix fragmentation code, particularly for encryption
 798
 799     The "new" fragmentation code (since my rewrite almost 5 years ago)
 800     erroneously sets skb->len rather than using skb_trim() to adjust
 801     the length of the first fragment after copying out all the others.
 802     This leaves the skb tail pointer pointing to after where the data
 803     originally ended, and thus causes the encryption MIC to be written
 804     at that point, rather than where it belongs: immediately after the
 805     data.
 806
 807     The impact of this is that if software encryption is done, then
 808      a) encryption doesn't work for the first fragment, the connection
 809         becomes unusable as the first fragment will never be properly
 810         verified at the receiver, the MIC is practically guaranteed to
 811         be wrong
 812      b) we leak up to 8 bytes of plaintext (!) of the packet out into
 813         the air
 814
 815     This is only mitigated by the fact that many devices are capable
 816     of doing encryption in hardware, in which case this can't happen
 817     as the tail pointer is irrelevant in that case. Additionally,
 818     fragmentation is not used very frequently and would normally have
 819     to be configured manually.
 820
 821     Fix this by using skb_trim() properly.
 822
 823     Cc: stable@vger.kernel.org
 824     Fixes: 2de8e0d999b8 ("mac80211: rewrite fragmentation")
 825     Reported-by: Jouni Malinen <j@w1.fi>
 826     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 827
 828 commit de5f242e0c10e841017e37eb8c38974a642dbca8
 829 Author: Sujith Manoharan <c_manoha@qca.qualcomm.com>
 830 Date:   Tue Jan 28 06:21:59 2014 +0530
 831
 832     ath9k: Fix build error on ARM
 833
 834     Use mdelay instead of udelay to fix this error:
 835
 836     ERROR: "__bad_udelay" [drivers/net/wireless/ath/ath9k/ath9k_hw.ko] undefined!
 837     make[1]: *** [__modpost] Error 1
 838     make: *** [modules] Error 2
 839
 840     Reported-by: Josh Boyer <jwboyer@fedoraproject.org>
 841     Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
 842
 843 commit 8e3ea7a51dfc61810fcefd947f6edcf61125252a
 844 Author: Geert Uytterhoeven <geert@linux-m68k.org>
 845 Date:   Sun Jan 26 11:53:21 2014 +0100
 846
 847     ath9k: Fix uninitialized variable in ath9k_has_tx_pending()
 848
 849     drivers/net/wireless/ath/ath9k/main.c: In function ‘ath9k_has_tx_pending’:
 850     drivers/net/wireless/ath/ath9k/main.c:1869: warning: ‘npend’ may be used uninitialized in this function
 851
 852     Introduced by commit 10e2318103f5941aa70c318afe34bc41f1b98529 ("ath9k:
 853     optimize ath9k_flush").
 854
 855     Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
 856
 857 commit a4a634a6937ebdd827fa58e8fcdb8ca49a3769f6
 858 Author: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
 859 Date:   Mon Jan 27 11:07:42 2014 +0200
 860
 861     mac80211: release the channel in error path in start_ap
 862
 863     When the driver cannot start the AP or when the assignement
 864     of the beacon goes wrong, we need to unassign the vif.
 865
 866     Cc: stable@vger.kernel.org
 867     Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
 868     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 869
 870 commit dfb6889a75c601aedb7450b7e606668e77da6679
 871 Author: Johannes Berg <johannes.berg@intel.com>
 872 Date:   Wed Jan 22 11:14:19 2014 +0200
 873
 874     cfg80211: send scan results from work queue
 875
 876     Due to the previous commit, when a scan finishes, it is in theory
 877     possible to hit the following sequence:
 878      1. interface starts being removed
 879      2. scan is cancelled by driver and cfg80211 is notified
 880      3. scan done work is scheduled
 881      4. interface is removed completely, rdev->scan_req is freed,
 882         event sent to userspace but scan done work remains pending
 883      5. new scan is requested on another virtual interface
 884      6. scan done work runs, freeing the still-running scan
 885
 886     To fix this situation, hang on to the scan done message and block
 887     new scans while that is the case, and only send the message from
 888     the work function, regardless of whether the scan_req is already
 889     freed from interface removal. This makes step 5 above impossible
 890     and changes step 6 to be
 891      5. scan done work runs, sending the scan done message
 892
 893     As this can't work for wext, so we send the message immediately,
 894     but this shouldn't be an issue since we still return -EBUSY.
 895
 896     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 897
 898 commit 45b7ab41fc08627d9a8428cb413d5d84662a9707
 899 Author: Johannes Berg <johannes.berg@intel.com>
 900 Date:   Wed Jan 22 11:14:18 2014 +0200
 901
 902     cfg80211: fix scan done race
 903
 904     When an interface/wdev is removed, any ongoing scan should be
 905     cancelled by the driver. This will make it call cfg80211, which
 906     only queues a work struct. If interface/wdev removal is quick
 907     enough, this can leave the scan request pending and processed
 908     only after the interface is gone, causing a use-after-free.
 909
 910     Fix this by making sure the scan request is not pending after
 911     the interface is destroyed. We can't flush or cancel the work
 912     item due to locking concerns, but when it'll run it shouldn't
 913     find anything to do. This leaves a potential issue, if a new
 914     scan gets requested before the work runs, it prematurely stops
 915     the running scan, potentially causing another crash. I'll fix
 916     that in the next patch.
 917
 918     This was particularly observed with P2P_DEVICE wdevs, likely
 919     because freeing them is quicker than freeing netdevs.
 920
 921     Reported-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
 922     Fixes: 4a58e7c38443 ("cfg80211: don't "leak" uncompleted scans")
 923     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 924
 925 commit ae04fa489ab31b5a10d3cc8399f52761175d4321
 926 Author: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
 927 Date:   Thu Jan 23 14:28:16 2014 +0200
 928
 929     mac80211: avoid deadlock revealed by lockdep
 930
 931     sdata->u.ap.request_smps_work can’t be flushed synchronously
 932     under wdev_lock(wdev) since ieee80211_request_smps_ap_work
 933     itself locks the same lock.
 934     While at it, reset the driver_smps_mode when the ap is
 935     stopped to its default: OFF.
 936
 937     This solves:
 938
 939     ======================================================
 940     [ INFO: possible circular locking dependency detected ]
 941     3.12.0-ipeer+ #2 Tainted: G           O
 942     -------------------------------------------------------
 943     rmmod/2867 is trying to acquire lock:
 944       ((&sdata->u.ap.request_smps_work)){+.+...}, at: [<c105b8d0>] flush_work+0x0/0x90
 945
 946     but task is already holding lock:
 947       (&wdev->mtx){+.+.+.}, at: [<f9b32626>] cfg80211_stop_ap+0x26/0x230 [cfg80211]
 948
 949     which lock already depends on the new lock.
 950
 951     the existing dependency chain (in reverse order) is:
 952
 953     -> #1 (&wdev->mtx){+.+.+.}:
 954             [<c10aefa9>] lock_acquire+0x79/0xe0
 955             [<c1607a1a>] mutex_lock_nested+0x4a/0x360
 956             [<fb06288b>] ieee80211_request_smps_ap_work+0x2b/0x50 [mac80211]
 957             [<c105cdd8>] process_one_work+0x198/0x450
 958             [<c105d469>] worker_thread+0xf9/0x320
 959             [<c10669ff>] kthread+0x9f/0xb0
 960             [<c1613397>] ret_from_kernel_thread+0x1b/0x28
 961
 962     -> #0 ((&sdata->u.ap.request_smps_work)){+.+...}:
 963             [<c10ae9df>] __lock_acquire+0x183f/0x1910
 964             [<c10aefa9>] lock_acquire+0x79/0xe0
 965             [<c105b917>] flush_work+0x47/0x90
 966             [<c105d867>] __cancel_work_timer+0x67/0xe0
 967             [<c105d90f>] cancel_work_sync+0xf/0x20
 968             [<fb0765cc>] ieee80211_stop_ap+0x8c/0x340 [mac80211]
 969             [<f9b3268c>] cfg80211_stop_ap+0x8c/0x230 [cfg80211]
 970             [<f9b0d8f9>] cfg80211_leave+0x79/0x100 [cfg80211]
 971             [<f9b0da72>] cfg80211_netdev_notifier_call+0xf2/0x4f0 [cfg80211]
 972             [<c160f2c9>] notifier_call_chain+0x59/0x130
 973             [<c106c6de>] __raw_notifier_call_chain+0x1e/0x30
 974             [<c106c70f>] raw_notifier_call_chain+0x1f/0x30
 975             [<c14f8213>] call_netdevice_notifiers_info+0x33/0x70
 976             [<c14f8263>] call_netdevice_notifiers+0x13/0x20
 977             [<c14f82a4>] __dev_close_many+0x34/0xb0
 978             [<c14f83fe>] dev_close_many+0x6e/0xc0
 979             [<c14f9c77>] rollback_registered_many+0xa7/0x1f0
 980             [<c14f9dd4>] unregister_netdevice_many+0x14/0x60
 981             [<fb06f4d9>] ieee80211_remove_interfaces+0xe9/0x170 [mac80211]
 982             [<fb055116>] ieee80211_unregister_hw+0x56/0x110 [mac80211]
 983             [<fa3e9396>] iwl_op_mode_mvm_stop+0x26/0xe0 [iwlmvm]
 984             [<f9b9d8ca>] _iwl_op_mode_stop+0x3a/0x70 [iwlwifi]
 985             [<f9b9d96f>] iwl_opmode_deregister+0x6f/0x90 [iwlwifi]
 986             [<fa405179>] __exit_compat+0xd/0x19 [iwlmvm]
 987             [<c10b8bf9>] SyS_delete_module+0x179/0x2b0
 988             [<c1613421>] sysenter_do_call+0x12/0x32
 989
 990     Fixes: 687da132234f ("mac80211: implement SMPS for AP")
 991     Cc: <stable@vger.kernel.org> [3.13]
 992     Reported-by: Ilan Peer <ilan.peer@intel.com>
 993     Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
 994     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 995
 996 commit 178b205e96217164fd7c30113464250d0b6f5eca
 997 Author: Johannes Berg <johannes.berg@intel.com>
 998 Date:   Thu Jan 23 16:32:29 2014 +0100
 999
1000     cfg80211: re-enable 5/10 MHz support
1001
1002     Unfortunately I forgot this during the merge window, but the
1003     patch seems small enough to go in as a fix. The userspace API
1004     bug that was the reason for disabling it has long been fixed.
1005
1006     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
1007
1008 commit 110a1c79acda14edc83b7c8dc5af9c7ddd23eb61
1009 Author: Pontus Fuchs <pontus.fuchs@gmail.com>
1010 Date:   Thu Jan 16 15:00:40 2014 +0100
1011
1012     nl80211: Reset split_start when netlink skb is exhausted
1013
1014     When the netlink skb is exhausted split_start is left set. In the
1015     subsequent retry, with a larger buffer, the dump is continued from the
1016     failing point instead of from the beginning.
1017
1018     This was causing my rt28xx based USB dongle to now show up when
1019     running "iw list" with an old iw version without split dump support.
1020
1021     Cc: stable@vger.kernel.org
1022     Fixes: 3713b4e364ef ("nl80211: allow splitting wiphy information in dumps")
1023     Signed-off-by: Pontus Fuchs <pontus.fuchs@gmail.com>
1024     [avoid the entire workaround when state->split is set]
1025     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
1026
1027 commit b4c31b45ffc7ef110fa9ecc34d7878fe7c5b9da4
1028 Author: Eliad Peller <eliad@wizery.com>
1029 Date:   Sun Jan 12 11:06:37 2014 +0200
1030
1031     mac80211: move roc cookie assignment earlier
1032
1033     ieee80211_start_roc_work() might add a new roc
1034     to existing roc, and tell cfg80211 it has already
1035     started.
1036
1037     However, this might happen before the roc cookie
1038     was set, resulting in REMAIN_ON_CHANNEL (started)
1039     event with null cookie. Consequently, it can make
1040     wpa_supplicant go out of sync.
1041
1042     Fix it by setting the roc cookie earlier.
1043
1044     Cc: stable@vger.kernel.org
1045     Signed-off-by: Eliad Peller <eliad@wizery.com>
1046     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
1047
1048 commit cfdc9157bfd7bcf88ab4dae08873a9907eba984c
1049 Author: Johannes Berg <johannes.berg@intel.com>
1050 Date:   Fri Jan 24 14:06:29 2014 +0100
1051
1052     nl80211: send event when AP operation is stopped
1053
1054     There are a few cases, e.g. suspend, where an AP interface is
1055     stopped by the kernel rather than by userspace request, most
1056     commonly when suspending. To let userspace know about this,
1057     send the NL80211_CMD_STOP_AP command as an event every time
1058     an AP interface is stopped. This also happens when userspace
1059     did in fact request the AP stop, but that's not a problem.
1060
1061     For full-MAC drivers this may need to be extended to also
1062     cover cases where the device stopped the AP operation for
1063     some reason, this a bit more complicated because then all
1064     cfg80211 state also needs to be reset; such API is not part
1065     of this patch.
1066
1067     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
1068
1069 commit d5d567eda7704f190379ca852a8f9a4112e3eee3
1070 Author: Johannes Berg <johannes.berg@intel.com>
1071 Date:   Thu Jan 23 16:20:29 2014 +0100
1072
1073     mac80211: add length check in ieee80211_is_robust_mgmt_frame()
1074
1075     A few places weren't checking that the frame passed to the
1076     function actually has enough data even though the function
1077     clearly documents it must have a payload byte. Make this
1078     safer by changing the function to take an skb and checking
1079     the length inside. The old version is preserved for now as
1080     the rtl* drivers use it and don't have a correct skb.
1081
1082     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
1083
1084 commit f8f6d212a047fc65c7d3442dfc038f65517236fc
1085 Author: Johannes Berg <johannes.berg@intel.com>
1086 Date:   Fri Jan 24 10:53:53 2014 +0100
1087
1088     nl80211: fix scheduled scan RSSI matchset attribute confusion
1089
1090     The scheduled scan matchsets were intended to be a list of filters,
1091     with the found BSS having to pass at least one of them to be passed
1092     to the host. When the RSSI attribute was added, however, this was
1093     broken and currently wpa_supplicant adds that attribute in its own
1094     matchset; however, it doesn't intend that to mean that anything
1095     that passes the RSSI filter should be passed to the host, instead
1096     it wants it to mean that everything needs to also have higher RSSI.
1097
1098     This is semantically problematic because we have a list of filters
1099     like [ SSID1, SSID2, SSID3, RSSI ] with no real indication which
1100     one should be OR'ed and which one AND'ed.
1101
1102     To fix this, move the RSSI filter attribute into each matchset. As
1103     we need to stay backward compatible, treat a matchset with only the
1104     RSSI attribute as a "default RSSI filter" for all other matchsets,
1105     but only if there are other matchsets (an RSSI-only matchset by
1106     itself is still desirable.)
1107
1108     To make driver implementation easier, keep a global min_rssi_thold
1109     for the entire request as well. The only affected driver is ath6kl.
1110
1111     I found this when I looked into the code after Raja Mani submitted
1112     a patch fixing the n_match_sets calculation to disregard the RSSI,
1113     but that patch didn't address the semantic issue.
1114
1115     Reported-by: Raja Mani <rmani@qti.qualcomm.com>
1116     Acked-by: Luciano Coelho <luciano.coelho@intel.com>
1117     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
1118
1119 commit de553e8545e65a6dc4e45f43df7e1443d4291922
1120 Author: Johannes Berg <johannes.berg@intel.com>
1121 Date:   Fri Jan 24 10:17:47 2014 +0100
1122
1123     nl80211: check nla_parse() return values
1124
1125     If there's a policy, then nla_parse() return values must be
1126     checked, otherwise the policy is useless and there's nothing
1127     that ensures the attributes are actually what we expect them
1128     to be.
1129
1130     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
1131
1132 commit 652204a0733e9e1c54661d6f9d36e2e1e3b22bb1
1133 Author: Karl Beldan <karl.beldan@rivierawaves.com>
1134 Date:   Thu Jan 23 20:06:34 2014 +0100
1135
1136     mac80211: send {ADD,DEL}BA on AC_VO like other mgmt frames, as per spec
1137
1138     ATM, {ADD,DEL}BA and BAR frames are sent on the AC matching the TID of
1139     the BA parameters. In the discussion [1] about this patch, Johannes
1140     recalled that it fixed some races with the DELBA and indeed this
1141     behavior was introduced in [2].
1142     While [2] is right for the BARs, the part queueing the {ADD,DEL}BAs on
1143     their BA params TID AC violates the spec and is more a workaround for
1144     some drivers. Helmut expressed some concerns wrt such drivers, in
1145     particular DELBAs in rt2x00.
1146
1147     ATM, DELBAs are sent after a driver has called (hence "purposely")
1148     ieee80211_start_tx_ba_cb_irqsafe and Johannes and Emmanuel gave some
1149     details wrt intentions behind the split of the IEEE80211_AMPDU_TX_STOP_*
1150     given to the driver ampdu_action supposed to call this function, which
1151     could prove handy to people trying to do the right thing in faulty
1152     drivers (if their fw/hw don't get in their way).
1153
1154     [1] http://mid.gmane.org/1390391564-18481-1-git-send-email-karl.beldan@gmail.com
1155     [2] Commit: cf6bb79ad828 ("mac80211: Use appropriate TID for sending BAR, ADDBA and DELBA frames")
1156
1157     Signed-off-by: Karl Beldan <karl.beldan@rivierawaves.com>
1158     Cc: Helmut Schaa <helmut.schaa@googlemail.com>
1159     Cc: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
1160     Signed-off-by: Johannes Berg <johannes.berg@intel.com>
1161 --- a/drivers/net/wireless/ath/ath6kl/cfg80211.c
1162 +++ b/drivers/net/wireless/ath/ath6kl/cfg80211.c
1163 @@ -790,7 +790,7 @@ void ath6kl_cfg80211_connect_event(struc
1164         if (nw_type & ADHOC_NETWORK) {
1165                 ath6kl_dbg(ATH6KL_DBG_WLAN_CFG, "ad-hoc %s selected\n",
1166                            nw_type & ADHOC_CREATOR ? "creator" : "joiner");
1167 -               cfg80211_ibss_joined(vif->ndev, bssid, GFP_KERNEL);
1168 +               cfg80211_ibss_joined(vif->ndev, bssid, chan, GFP_KERNEL);
1169                 cfg80211_put_bss(ar->wiphy, bss);
1170                 return;
1171         }
1172 @@ -861,13 +861,9 @@ void ath6kl_cfg80211_disconnect_event(st
1173         }
1174
1175         if (vif->nw_type & ADHOC_NETWORK) {
1176 -               if (vif->wdev.iftype != NL80211_IFTYPE_ADHOC) {
1177 +               if (vif->wdev.iftype != NL80211_IFTYPE_ADHOC)
1178                         ath6kl_dbg(ATH6KL_DBG_WLAN_CFG,
1179                                    "%s: ath6k not in ibss mode\n", __func__);
1180 -                       return;
1181 -               }
1182 -               memset(bssid, 0, ETH_ALEN);
1183 -               cfg80211_ibss_joined(vif->ndev, bssid, GFP_KERNEL);
1184                 return;
1185         }
1186
1187 @@ -3256,6 +3252,15 @@ static int ath6kl_cfg80211_sscan_start(s
1188         struct ath6kl_vif *vif = netdev_priv(dev);
1189         u16 interval;
1190         int ret, rssi_thold;
1191 +       int n_match_sets = request->n_match_sets;
1192 +
1193 +       /*
1194 +        * If there's a matchset w/o an SSID, then assume it's just for
1195 +        * the RSSI (nothing else is currently supported) and ignore it.
1196 +        * The device only supports a global RSSI filter that we set below.
1197 +        */
1198 +       if (n_match_sets == 1 && !request->match_sets[0].ssid.ssid_len)
1199 +               n_match_sets = 0;
1200
1201         if (ar->state != ATH6KL_STATE_ON)
1202                 return -EIO;
1203 @@ -3268,11 +3273,11 @@ static int ath6kl_cfg80211_sscan_start(s
1204         ret = ath6kl_set_probed_ssids(ar, vif, request->ssids,
1205                                       request->n_ssids,
1206                                       request->match_sets,
1207 -                                     request->n_match_sets);
1208 +                                     n_match_sets);
1209         if (ret < 0)
1210                 return ret;
1211
1212 -       if (!request->n_match_sets) {
1213 +       if (!n_match_sets) {
1214                 ret = ath6kl_wmi_bssfilter_cmd(ar->wmi, vif->fw_vif_idx,
1215                                                ALL_BSS_FILTER, 0);
1216                 if (ret < 0)
1217 @@ -3286,12 +3291,12 @@ static int ath6kl_cfg80211_sscan_start(s
1218
1219         if (test_bit(ATH6KL_FW_CAPABILITY_RSSI_SCAN_THOLD,
1220                      ar->fw_capabilities)) {
1221 -               if (request->rssi_thold <= NL80211_SCAN_RSSI_THOLD_OFF)
1222 +               if (request->min_rssi_thold <= NL80211_SCAN_RSSI_THOLD_OFF)
1223                         rssi_thold = 0;
1224 -               else if (request->rssi_thold < -127)
1225 +               else if (request->min_rssi_thold < -127)
1226                         rssi_thold = -127;
1227                 else
1228 -                       rssi_thold = request->rssi_thold;
1229 +                       rssi_thold = request->min_rssi_thold;
1230
1231                 ret = ath6kl_wmi_set_rssi_filter_cmd(ar->wmi, vif->fw_vif_idx,
1232                                                      rssi_thold);
1233 --- a/drivers/net/wireless/ath/ath9k/hw.c
1234 +++ b/drivers/net/wireless/ath/ath9k/hw.c
1235 @@ -1316,7 +1316,7 @@ static bool ath9k_hw_set_reset(struct at
1236         if (AR_SREV_9300_20_OR_LATER(ah))
1237                 udelay(50);
1238         else if (AR_SREV_9100(ah))
1239 -               udelay(10000);
1240 +               mdelay(10);
1241         else
1242                 udelay(100);
1243
1244 @@ -1534,7 +1534,7 @@ EXPORT_SYMBOL(ath9k_hw_check_nav);
1245  bool ath9k_hw_check_alive(struct ath_hw *ah)
1246  {
1247         int count = 50;
1248 -       u32 reg;
1249 +       u32 reg, last_val;
1250
1251         if (AR_SREV_9300(ah))
1252                 return !ath9k_hw_detect_mac_hang(ah);
1253 @@ -1542,9 +1542,14 @@ bool ath9k_hw_check_alive(struct ath_hw
1254         if (AR_SREV_9285_12_OR_LATER(ah))
1255                 return true;
1256
1257 +       last_val = REG_READ(ah, AR_OBS_BUS_1);
1258         do {
1259                 reg = REG_READ(ah, AR_OBS_BUS_1);
1260 +               if (reg != last_val)
1261 +                       return true;
1262
1263 +               udelay(1);
1264 +               last_val = reg;
1265                 if ((reg & 0x7E7FFFEF) == 0x00702400)
1266                         continue;
1267
1268 @@ -2051,9 +2056,8 @@ static bool ath9k_hw_set_power_awake(str
1269
1270         REG_SET_BIT(ah, AR_RTC_FORCE_WAKE,
1271                     AR_RTC_FORCE_WAKE_EN);
1272 -
1273         if (AR_SREV_9100(ah))
1274 -               udelay(10000);
1275 +               mdelay(10);
1276         else
1277                 udelay(50);
1278
1279 --- a/drivers/net/wireless/ath/ath9k/main.c
1280 +++ b/drivers/net/wireless/ath/ath9k/main.c
1281 @@ -451,7 +451,7 @@ void ath9k_tasklet(unsigned long data)
1282                  * interrupts are enabled in the reset routine.
1283                  */
1284                 atomic_inc(&ah->intr_ref_cnt);
1285 -               ath_dbg(common, ANY, "FATAL: Skipping interrupts\n");
1286 +               ath_dbg(common, RESET, "FATAL: Skipping interrupts\n");
1287                 goto out;
1288         }
1289
1290 @@ -471,7 +471,7 @@ void ath9k_tasklet(unsigned long data)
1291                          * interrupts are enabled in the reset routine.
1292                          */
1293                         atomic_inc(&ah->intr_ref_cnt);
1294 -                       ath_dbg(common, ANY,
1295 +                       ath_dbg(common, RESET,
1296                                 "BB_WATCHDOG: Skipping interrupts\n");
1297                         goto out;
1298                 }
1299 @@ -484,7 +484,7 @@ void ath9k_tasklet(unsigned long data)
1300                         type = RESET_TYPE_TX_GTT;
1301                         ath9k_queue_reset(sc, type);
1302                         atomic_inc(&ah->intr_ref_cnt);
1303 -                       ath_dbg(common, ANY,
1304 +                       ath_dbg(common, RESET,
1305                                 "GTT: Skipping interrupts\n");
1306                         goto out;
1307                 }
1308 @@ -1866,7 +1866,7 @@ static void ath9k_set_coverage_class(str
1309
1310  static bool ath9k_has_tx_pending(struct ath_softc *sc)
1311  {
1312 -       int i, npend;
1313 +       int i, npend = 0;
1314
1315         for (i = 0; i < ATH9K_NUM_TX_QUEUES; i++) {
1316                 if (!ATH_TXQ_SETUP(sc, i))
1317 --- a/drivers/net/wireless/iwlwifi/mvm/scan.c
1318 +++ b/drivers/net/wireless/iwlwifi/mvm/scan.c
1319 @@ -595,6 +595,9 @@ static void iwl_scan_offload_build_ssid(
1320          * config match list.
1321          */
1322         for (i = 0; i < req->n_match_sets && i < PROBE_OPTION_MAX; i++) {
1323 +               /* skip empty SSID matchsets */
1324 +               if (!req->match_sets[i].ssid.ssid_len)
1325 +                       continue;
1326                 scan->direct_scan[i].id = WLAN_EID_SSID;
1327                 scan->direct_scan[i].len = req->match_sets[i].ssid.ssid_len;
1328                 memcpy(scan->direct_scan[i].ssid, req->match_sets[i].ssid.ssid,
1329 --- a/drivers/net/wireless/rtlwifi/rtl8188ee/trx.c
1330 +++ b/drivers/net/wireless/rtlwifi/rtl8188ee/trx.c
1331 @@ -452,7 +452,7 @@ bool rtl88ee_rx_query_desc(struct ieee80
1332                         /* During testing, hdr was NULL */
1333                         return false;
1334                 }
1335 -               if ((ieee80211_is_robust_mgmt_frame(hdr)) &&
1336 +               if ((_ieee80211_is_robust_mgmt_frame(hdr)) &&
1337                     (ieee80211_has_protected(hdr->frame_control)))
1338                         rx_status->flag &= ~RX_FLAG_DECRYPTED;
1339                 else
1340 --- a/drivers/net/wireless/rtlwifi/rtl8192ce/trx.c
1341 +++ b/drivers/net/wireless/rtlwifi/rtl8192ce/trx.c
1342 @@ -393,7 +393,7 @@ bool rtl92ce_rx_query_desc(struct ieee80
1343                         /* In testing, hdr was NULL here */
1344                         return false;
1345                 }
1346 -               if ((ieee80211_is_robust_mgmt_frame(hdr)) &&
1347 +               if ((_ieee80211_is_robust_mgmt_frame(hdr)) &&
1348                     (ieee80211_has_protected(hdr->frame_control)))
1349                         rx_status->flag &= ~RX_FLAG_DECRYPTED;
1350                 else
1351 --- a/drivers/net/wireless/rtlwifi/rtl8192se/trx.c
1352 +++ b/drivers/net/wireless/rtlwifi/rtl8192se/trx.c
1353 @@ -310,7 +310,7 @@ bool rtl92se_rx_query_desc(struct ieee80
1354                         /* during testing, hdr was NULL here */
1355                         return false;
1356                 }
1357 -               if ((ieee80211_is_robust_mgmt_frame(hdr)) &&
1358 +               if ((_ieee80211_is_robust_mgmt_frame(hdr)) &&
1359                         (ieee80211_has_protected(hdr->frame_control)))
1360                         rx_status->flag &= ~RX_FLAG_DECRYPTED;
1361                 else
1362 --- a/drivers/net/wireless/rtlwifi/rtl8723ae/trx.c
1363 +++ b/drivers/net/wireless/rtlwifi/rtl8723ae/trx.c
1364 @@ -334,7 +334,7 @@ bool rtl8723ae_rx_query_desc(struct ieee
1365                         /* during testing, hdr could be NULL here */
1366                         return false;
1367                 }
1368 -               if ((ieee80211_is_robust_mgmt_frame(hdr)) &&
1369 +               if ((_ieee80211_is_robust_mgmt_frame(hdr)) &&
1370                         (ieee80211_has_protected(hdr->frame_control)))
1371                         rx_status->flag &= ~RX_FLAG_DECRYPTED;
1372                 else
1373 --- a/include/linux/ieee80211.h
1374 +++ b/include/linux/ieee80211.h
1375 @@ -597,6 +597,20 @@ static inline int ieee80211_is_qos_nullf
1376  }
1377
1378  /**
1379 + * ieee80211_is_bufferable_mmpdu - check if frame is bufferable MMPDU
1380 + * @fc: frame control field in little-endian byteorder
1381 + */
1382 +static inline bool ieee80211_is_bufferable_mmpdu(__le16 fc)
1383 +{
1384 +       /* IEEE 802.11-2012, definition of "bufferable management frame";
1385 +        * note that this ignores the IBSS special case. */
1386 +       return ieee80211_is_mgmt(fc) &&
1387 +              (ieee80211_is_action(fc) ||
1388 +               ieee80211_is_disassoc(fc) ||
1389 +               ieee80211_is_deauth(fc));
1390 +}
1391 +
1392 +/**
1393   * ieee80211_is_first_frag - check if IEEE80211_SCTL_FRAG is not set
1394   * @seq_ctrl: frame sequence control bytes in little-endian byteorder
1395   */
1396 @@ -2192,10 +2206,10 @@ static inline u8 *ieee80211_get_DA(struc
1397  }
1398
1399  /**
1400 - * ieee80211_is_robust_mgmt_frame - check if frame is a robust management frame
1401 + * _ieee80211_is_robust_mgmt_frame - check if frame is a robust management frame
1402   * @hdr: the frame (buffer must include at least the first octet of payload)
1403   */
1404 -static inline bool ieee80211_is_robust_mgmt_frame(struct ieee80211_hdr *hdr)
1405 +static inline bool _ieee80211_is_robust_mgmt_frame(struct ieee80211_hdr *hdr)
1406  {
1407         if (ieee80211_is_disassoc(hdr->frame_control) ||
1408             ieee80211_is_deauth(hdr->frame_control))
1409 @@ -2224,6 +2238,17 @@ static inline bool ieee80211_is_robust_m
1410  }
1411
1412  /**
1413 + * ieee80211_is_robust_mgmt_frame - check if skb contains a robust mgmt frame
1414 + * @skb: the skb containing the frame, length will be checked
1415 + */
1416 +static inline bool ieee80211_is_robust_mgmt_frame(struct sk_buff *skb)
1417 +{
1418 +       if (skb->len < 25)
1419 +               return false;
1420 +       return _ieee80211_is_robust_mgmt_frame((void *)skb->data);
1421 +}
1422 +
1423 +/**
1424   * ieee80211_is_public_action - check if frame is a public action frame
1425   * @hdr: the frame
1426   * @len: length of the frame
1427 --- a/include/net/cfg80211.h
1428 +++ b/include/net/cfg80211.h
1429 @@ -1395,9 +1395,11 @@ struct cfg80211_scan_request {
1430   * struct cfg80211_match_set - sets of attributes to match
1431   *
1432   * @ssid: SSID to be matched
1433 + * @rssi_thold: don't report scan results below this threshold (in s32 dBm)
1434   */
1435  struct cfg80211_match_set {
1436         struct cfg80211_ssid ssid;
1437 +       s32 rssi_thold;
1438  };
1439
1440  /**
1441 @@ -1420,7 +1422,8 @@ struct cfg80211_match_set {
1442   * @dev: the interface
1443   * @scan_start: start time of the scheduled scan
1444   * @channels: channels to scan
1445 - * @rssi_thold: don't report scan results below this threshold (in s32 dBm)
1446 + * @min_rssi_thold: for drivers only supporting a single threshold, this
1447 + *     contains the minimum over all matchsets
1448   */
1449  struct cfg80211_sched_scan_request {
1450         struct cfg80211_ssid *ssids;
1451 @@ -1433,7 +1436,7 @@ struct cfg80211_sched_scan_request {
1452         u32 flags;
1453         struct cfg80211_match_set *match_sets;
1454         int n_match_sets;
1455 -       s32 rssi_thold;
1456 +       s32 min_rssi_thold;
1457
1458         /* internal */
1459         struct wiphy *wiphy;
1460 @@ -3130,8 +3133,8 @@ struct cfg80211_cached_keys;
1461   * @identifier: (private) Identifier used in nl80211 to identify this
1462   *     wireless device if it has no netdev
1463   * @current_bss: (private) Used by the internal configuration code
1464 - * @channel: (private) Used by the internal configuration code to track
1465 - *     the user-set AP, monitor and WDS channel
1466 + * @chandef: (private) Used by the internal configuration code to track
1467 + *     the user-set channel definition.
1468   * @preset_chandef: (private) Used by the internal configuration code to
1469   *     track the channel to be used for AP later
1470   * @bssid: (private) Used by the internal configuration code
1471 @@ -3195,9 +3198,7 @@ struct wireless_dev {
1472
1473         struct cfg80211_internal_bss *current_bss; /* associated / joined */
1474         struct cfg80211_chan_def preset_chandef;
1475 -
1476 -       /* for AP and mesh channel tracking */
1477 -       struct ieee80211_channel *channel;
1478 +       struct cfg80211_chan_def chandef;
1479
1480         bool ibss_fixed;
1481         bool ibss_dfs_possible;
1482 @@ -3879,6 +3880,7 @@ void cfg80211_michael_mic_failure(struct
1483   *
1484   * @dev: network device
1485   * @bssid: the BSSID of the IBSS joined
1486 + * @channel: the channel of the IBSS joined
1487   * @gfp: allocation flags
1488   *
1489   * This function notifies cfg80211 that the device joined an IBSS or
1490 @@ -3888,7 +3890,8 @@ void cfg80211_michael_mic_failure(struct
1491   * with the locally generated beacon -- this guarantees that there is
1492   * always a scan result for this IBSS. cfg80211 will handle the rest.
1493   */
1494 -void cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid, gfp_t gfp);
1495 +void cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid,
1496 +                         struct ieee80211_channel *channel, gfp_t gfp);
1497
1498  /**
1499   * cfg80211_notify_new_candidate - notify cfg80211 of a new mesh peer candidate
1500 --- a/include/uapi/linux/nl80211.h
1501 +++ b/include/uapi/linux/nl80211.h
1502 @@ -2442,9 +2442,15 @@ enum nl80211_reg_rule_attr {
1503   * enum nl80211_sched_scan_match_attr - scheduled scan match attributes
1504   * @__NL80211_SCHED_SCAN_MATCH_ATTR_INVALID: attribute number 0 is reserved
1505   * @NL80211_SCHED_SCAN_MATCH_ATTR_SSID: SSID to be used for matching,
1506 - * only report BSS with matching SSID.
1507 + *     only report BSS with matching SSID.
1508   * @NL80211_SCHED_SCAN_MATCH_ATTR_RSSI: RSSI threshold (in dBm) for reporting a
1509 - *     BSS in scan results. Filtering is turned off if not specified.
1510 + *     BSS in scan results. Filtering is turned off if not specified. Note that
1511 + *     if this attribute is in a match set of its own, then it is treated as
1512 + *     the default value for all matchsets with an SSID, rather than being a
1513 + *     matchset of its own without an RSSI filter. This is due to problems with
1514 + *     how this API was implemented in the past. Also, due to the same problem,
1515 + *     the only way to create a matchset with only an RSSI filter (with this
1516 + *     attribute) is if there's only a single matchset with the RSSI attribute.
1517   * @NL80211_SCHED_SCAN_MATCH_ATTR_MAX: highest scheduled scan filter
1518   *     attribute number currently defined
1519   * @__NL80211_SCHED_SCAN_MATCH_ATTR_AFTER_LAST: internal use
1520 --- a/net/mac80211/agg-tx.c
1521 +++ b/net/mac80211/agg-tx.c
1522 @@ -107,7 +107,7 @@ static void ieee80211_send_addba_request
1523         mgmt->u.action.u.addba_req.start_seq_num =
1524                                         cpu_to_le16(start_seq_num << 4);
1525
1526 -       ieee80211_tx_skb_tid(sdata, skb, tid);
1527 +       ieee80211_tx_skb(sdata, skb);
1528  }
1529
1530  void ieee80211_send_bar(struct ieee80211_vif *vif, u8 *ra, u16 tid, u16 ssn)
1531 --- a/net/mac80211/cfg.c
1532 +++ b/net/mac80211/cfg.c
1533 @@ -970,9 +970,9 @@ static int ieee80211_start_ap(struct wip
1534         /* TODO: make hostapd tell us what it wants */
1535         sdata->smps_mode = IEEE80211_SMPS_OFF;
1536         sdata->needed_rx_chains = sdata->local->rx_chains;
1537 -       sdata->radar_required = params->radar_required;
1538
1539         mutex_lock(&local->mtx);
1540 +       sdata->radar_required = params->radar_required;
1541         err = ieee80211_vif_use_channel(sdata, &params->chandef,
1542                                         IEEE80211_CHANCTX_SHARED);
1543         mutex_unlock(&local->mtx);
1544 @@ -1021,8 +1021,10 @@ static int ieee80211_start_ap(struct wip
1545                                         IEEE80211_P2P_OPPPS_ENABLE_BIT;
1546
1547         err = ieee80211_assign_beacon(sdata, &params->beacon);
1548 -       if (err < 0)
1549 +       if (err < 0) {
1550 +               ieee80211_vif_release_channel(sdata);
1551                 return err;
1552 +       }
1553         changed |= err;
1554
1555         err = drv_start_ap(sdata->local, sdata);
1556 @@ -1032,6 +1034,7 @@ static int ieee80211_start_ap(struct wip
1557                 if (old)
1558                         kfree_rcu(old, rcu_head);
1559                 RCU_INIT_POINTER(sdata->u.ap.beacon, NULL);
1560 +               ieee80211_vif_release_channel(sdata);
1561                 return err;
1562         }
1563
1564 @@ -1053,6 +1056,7 @@ static int ieee80211_change_beacon(struc
1565         int err;
1566
1567         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1568 +       sdata_assert_lock(sdata);
1569
1570         /* don't allow changing the beacon while CSA is in place - offset
1571          * of channel switch counter may change
1572 @@ -1080,6 +1084,8 @@ static int ieee80211_stop_ap(struct wiph
1573         struct probe_resp *old_probe_resp;
1574         struct cfg80211_chan_def chandef;
1575
1576 +       sdata_assert_lock(sdata);
1577 +
1578         old_beacon = sdata_dereference(sdata->u.ap.beacon, sdata);
1579         if (!old_beacon)
1580                 return -ENOENT;
1581 @@ -1090,8 +1096,6 @@ static int ieee80211_stop_ap(struct wiph
1582         kfree(sdata->u.ap.next_beacon);
1583         sdata->u.ap.next_beacon = NULL;
1584
1585 -       cancel_work_sync(&sdata->u.ap.request_smps_work);
1586 -
1587         /* turn off carrier for this interface and dependent VLANs */
1588         list_for_each_entry(vlan, &sdata->u.ap.vlans, u.vlan.list)
1589                 netif_carrier_off(vlan->dev);
1590 @@ -1103,6 +1107,7 @@ static int ieee80211_stop_ap(struct wiph
1591         kfree_rcu(old_beacon, rcu_head);
1592         if (old_probe_resp)
1593                 kfree_rcu(old_probe_resp, rcu_head);
1594 +       sdata->u.ap.driver_smps_mode = IEEE80211_SMPS_OFF;
1595
1596         __sta_info_flush(sdata, true);
1597         ieee80211_free_keys(sdata, true);
1598 @@ -1988,6 +1993,9 @@ static int ieee80211_change_bss(struct w
1599
1600         band = ieee80211_get_sdata_band(sdata);
1601
1602 +       if (WARN_ON(!wiphy->bands[band]))
1603 +               return -EINVAL;
1604 +
1605         if (params->use_cts_prot >= 0) {
1606                 sdata->vif.bss_conf.use_cts_prot = params->use_cts_prot;
1607                 changed |= BSS_CHANGED_ERP_CTS_PROT;
1608 @@ -2638,6 +2646,24 @@ static int ieee80211_start_roc_work(stru
1609         INIT_DELAYED_WORK(&roc->work, ieee80211_sw_roc_work);
1610         INIT_LIST_HEAD(&roc->dependents);
1611
1612 +       /*
1613 +        * cookie is either the roc cookie (for normal roc)
1614 +        * or the SKB (for mgmt TX)
1615 +        */
1616 +       if (!txskb) {
1617 +               /* local->mtx protects this */
1618 +               local->roc_cookie_counter++;
1619 +               roc->cookie = local->roc_cookie_counter;
1620 +               /* wow, you wrapped 64 bits ... more likely a bug */
1621 +               if (WARN_ON(roc->cookie == 0)) {
1622 +                       roc->cookie = 1;
1623 +                       local->roc_cookie_counter++;
1624 +               }
1625 +               *cookie = roc->cookie;
1626 +       } else {
1627 +               *cookie = (unsigned long)txskb;
1628 +       }
1629 +
1630         /* if there's one pending or we're scanning, queue this one */
1631         if (!list_empty(&local->roc_list) ||
1632             local->scanning || local->radar_detect_enabled)
1633 @@ -2772,24 +2798,6 @@ static int ieee80211_start_roc_work(stru
1634         if (!queued)
1635                 list_add_tail(&roc->list, &local->roc_list);
1636
1637 -       /*
1638 -        * cookie is either the roc cookie (for normal roc)
1639 -        * or the SKB (for mgmt TX)
1640 -        */
1641 -       if (!txskb) {
1642 -               /* local->mtx protects this */
1643 -               local->roc_cookie_counter++;
1644 -               roc->cookie = local->roc_cookie_counter;
1645 -               /* wow, you wrapped 64 bits ... more likely a bug */
1646 -               if (WARN_ON(roc->cookie == 0)) {
1647 -                       roc->cookie = 1;
1648 -                       local->roc_cookie_counter++;
1649 -               }
1650 -               *cookie = roc->cookie;
1651 -       } else {
1652 -               *cookie = (unsigned long)txskb;
1653 -       }
1654 -
1655         return 0;
1656  }
1657
1658 @@ -3004,8 +3012,10 @@ void ieee80211_csa_finalize_work(struct
1659         if (!ieee80211_sdata_running(sdata))
1660                 goto unlock;
1661
1662 -       sdata->radar_required = sdata->csa_radar_required;
1663 +       sdata_assert_lock(sdata);
1664 +
1665         mutex_lock(&local->mtx);
1666 +       sdata->radar_required = sdata->csa_radar_required;
1667         err = ieee80211_vif_change_channel(sdata, &changed);
1668         mutex_unlock(&local->mtx);
1669         if (WARN_ON(err < 0))
1670 @@ -3022,13 +3032,13 @@ void ieee80211_csa_finalize_work(struct
1671         switch (sdata->vif.type) {
1672         case NL80211_IFTYPE_AP:
1673                 err = ieee80211_assign_beacon(sdata, sdata->u.ap.next_beacon);
1674 +               kfree(sdata->u.ap.next_beacon);
1675 +               sdata->u.ap.next_beacon = NULL;
1676 +
1677                 if (err < 0)
1678                         goto unlock;
1679
1680                 changed |= err;
1681 -               kfree(sdata->u.ap.next_beacon);
1682 -               sdata->u.ap.next_beacon = NULL;
1683 -
1684                 ieee80211_bss_info_change_notify(sdata, err);
1685                 break;
1686         case NL80211_IFTYPE_ADHOC:
1687 @@ -3066,7 +3076,7 @@ int ieee80211_channel_switch(struct wiph
1688         struct ieee80211_if_mesh __maybe_unused *ifmsh;
1689         int err, num_chanctx;
1690
1691 -       lockdep_assert_held(&sdata->wdev.mtx);
1692 +       sdata_assert_lock(sdata);
1693
1694         if (!list_empty(&local->roc_list) || local->scanning)
1695                 return -EBUSY;
1696 --- a/net/mac80211/ht.c
1697 +++ b/net/mac80211/ht.c
1698 @@ -375,7 +375,7 @@ void ieee80211_send_delba(struct ieee802
1699         mgmt->u.action.u.delba.params = cpu_to_le16(params);
1700         mgmt->u.action.u.delba.reason_code = cpu_to_le16(reason_code);
1701
1702 -       ieee80211_tx_skb_tid(sdata, skb, tid);
1703 +       ieee80211_tx_skb(sdata, skb);
1704  }
1705
1706  void ieee80211_process_delba(struct ieee80211_sub_if_data *sdata,
1707 @@ -466,7 +466,9 @@ void ieee80211_request_smps_ap_work(stru
1708                              u.ap.request_smps_work);
1709
1710         sdata_lock(sdata);
1711 -       __ieee80211_request_smps_ap(sdata, sdata->u.ap.driver_smps_mode);
1712 +       if (sdata_dereference(sdata->u.ap.beacon, sdata))
1713 +               __ieee80211_request_smps_ap(sdata,
1714 +                                           sdata->u.ap.driver_smps_mode);
1715         sdata_unlock(sdata);
1716  }
1717
1718 --- a/net/mac80211/iface.c
1719 +++ b/net/mac80211/iface.c
1720 @@ -770,12 +770,19 @@ static void ieee80211_do_stop(struct iee
1721
1722         ieee80211_roc_purge(local, sdata);
1723
1724 -       if (sdata->vif.type == NL80211_IFTYPE_STATION)
1725 +       switch (sdata->vif.type) {
1726 +       case NL80211_IFTYPE_STATION:
1727                 ieee80211_mgd_stop(sdata);
1728 -
1729 -       if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
1730 +               break;
1731 +       case NL80211_IFTYPE_ADHOC:
1732                 ieee80211_ibss_stop(sdata);
1733 -
1734 +               break;
1735 +       case NL80211_IFTYPE_AP:
1736 +               cancel_work_sync(&sdata->u.ap.request_smps_work);
1737 +               break;
1738 +       default:
1739 +               break;
1740 +       }
1741
1742         /*
1743          * Remove all stations associated with this interface.
1744 @@ -827,7 +834,9 @@ static void ieee80211_do_stop(struct iee
1745         cancel_work_sync(&local->dynamic_ps_enable_work);
1746
1747         cancel_work_sync(&sdata->recalc_smps);
1748 +       sdata_lock(sdata);
1749         sdata->vif.csa_active = false;
1750 +       sdata_unlock(sdata);
1751         cancel_work_sync(&sdata->csa_finalize_work);
1752
1753         cancel_delayed_work_sync(&sdata->dfs_cac_timer_work);
1754 --- a/net/mac80211/rx.c
1755 +++ b/net/mac80211/rx.c
1756 @@ -599,10 +599,10 @@ static int ieee80211_is_unicast_robust_m
1757  {
1758         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
1759
1760 -       if (skb->len < 24 || is_multicast_ether_addr(hdr->addr1))
1761 +       if (is_multicast_ether_addr(hdr->addr1))
1762                 return 0;
1763
1764 -       return ieee80211_is_robust_mgmt_frame(hdr);
1765 +       return ieee80211_is_robust_mgmt_frame(skb);
1766  }
1767
1768
1769 @@ -610,10 +610,10 @@ static int ieee80211_is_multicast_robust
1770  {
1771         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
1772
1773 -       if (skb->len < 24 || !is_multicast_ether_addr(hdr->addr1))
1774 +       if (!is_multicast_ether_addr(hdr->addr1))
1775                 return 0;
1776
1777 -       return ieee80211_is_robust_mgmt_frame(hdr);
1778 +       return ieee80211_is_robust_mgmt_frame(skb);
1779  }
1780
1781
1782 @@ -626,7 +626,7 @@ static int ieee80211_get_mmie_keyidx(str
1783         if (skb->len < 24 + sizeof(*mmie) || !is_multicast_ether_addr(hdr->da))
1784                 return -1;
1785
1786 -       if (!ieee80211_is_robust_mgmt_frame((struct ieee80211_hdr *) hdr))
1787 +       if (!ieee80211_is_robust_mgmt_frame(skb))
1788                 return -1; /* not a robust management frame */
1789
1790         mmie = (struct ieee80211_mmie *)
1791 @@ -1128,6 +1128,13 @@ static void sta_ps_end(struct sta_info *
1792                sta->sta.addr, sta->sta.aid);
1793
1794         if (test_sta_flag(sta, WLAN_STA_PS_DRIVER)) {
1795 +               /*
1796 +                * Clear the flag only if the other one is still set
1797 +                * so that the TX path won't start TX'ing new frames
1798 +                * directly ... In the case that the driver flag isn't
1799 +                * set ieee80211_sta_ps_deliver_wakeup() will clear it.
1800 +                */
1801 +               clear_sta_flag(sta, WLAN_STA_PS_STA);
1802                 ps_dbg(sta->sdata, "STA %pM aid %d driver-ps-blocked\n",
1803                        sta->sta.addr, sta->sta.aid);
1804                 return;
1805 @@ -1311,18 +1318,15 @@ ieee80211_rx_h_sta_process(struct ieee80
1806             !ieee80211_has_morefrags(hdr->frame_control) &&
1807             !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&
1808             (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
1809 -            rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)) {
1810 +            rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN) &&
1811 +           /* PM bit is only checked in frames where it isn't reserved,
1812 +            * in AP mode it's reserved in non-bufferable management frames
1813 +            * (cf. IEEE 802.11-2012 8.2.4.1.7 Power Management field)
1814 +            */
1815 +           (!ieee80211_is_mgmt(hdr->frame_control) ||
1816 +            ieee80211_is_bufferable_mmpdu(hdr->frame_control))) {
1817                 if (test_sta_flag(sta, WLAN_STA_PS_STA)) {
1818 -                       /*
1819 -                        * Ignore doze->wake transitions that are
1820 -                        * indicated by non-data frames, the standard
1821 -                        * is unclear here, but for example going to
1822 -                        * PS mode and then scanning would cause a
1823 -                        * doze->wake transition for the probe request,
1824 -                        * and that is clearly undesirable.
1825 -                        */
1826 -                       if (ieee80211_is_data(hdr->frame_control) &&
1827 -                           !ieee80211_has_pm(hdr->frame_control))
1828 +                       if (!ieee80211_has_pm(hdr->frame_control))
1829                                 sta_ps_end(sta);
1830                 } else {
1831                         if (ieee80211_has_pm(hdr->frame_control))
1832 @@ -1845,8 +1849,7 @@ static int ieee80211_drop_unencrypted_mg
1833                  * having configured keys.
1834                  */
1835                 if (unlikely(ieee80211_is_action(fc) && !rx->key &&
1836 -                            ieee80211_is_robust_mgmt_frame(
1837 -                                    (struct ieee80211_hdr *) rx->skb->data)))
1838 +                            ieee80211_is_robust_mgmt_frame(rx->skb)))
1839                         return -EACCES;
1840         }
1841
1842 --- a/net/mac80211/tx.c
1843 +++ b/net/mac80211/tx.c
1844 @@ -452,8 +452,7 @@ static int ieee80211_use_mfp(__le16 fc,
1845         if (sta == NULL || !test_sta_flag(sta, WLAN_STA_MFP))
1846                 return 0;
1847
1848 -       if (!ieee80211_is_robust_mgmt_frame((struct ieee80211_hdr *)
1849 -                                           skb->data))
1850 +       if (!ieee80211_is_robust_mgmt_frame(skb))
1851                 return 0;
1852
1853         return 1;
1854 @@ -478,6 +477,20 @@ ieee80211_tx_h_unicast_ps_buf(struct iee
1855                        sta->sta.addr, sta->sta.aid, ac);
1856                 if (tx->local->total_ps_buffered >= TOTAL_MAX_TX_BUFFER)
1857                         purge_old_ps_buffers(tx->local);
1858 +
1859 +               /* sync with ieee80211_sta_ps_deliver_wakeup */
1860 +               spin_lock(&sta->ps_lock);
1861 +               /*
1862 +                * STA woke up the meantime and all the frames on ps_tx_buf have
1863 +                * been queued to pending queue. No reordering can happen, go
1864 +                * ahead and Tx the packet.
1865 +                */
1866 +               if (!test_sta_flag(sta, WLAN_STA_PS_STA) &&
1867 +                   !test_sta_flag(sta, WLAN_STA_PS_DRIVER)) {
1868 +                       spin_unlock(&sta->ps_lock);
1869 +                       return TX_CONTINUE;
1870 +               }
1871 +
1872                 if (skb_queue_len(&sta->ps_tx_buf[ac]) >= STA_MAX_TX_BUFFER) {
1873                         struct sk_buff *old = skb_dequeue(&sta->ps_tx_buf[ac]);
1874                         ps_dbg(tx->sdata,
1875 @@ -492,6 +505,7 @@ ieee80211_tx_h_unicast_ps_buf(struct iee
1876                 info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
1877                 info->flags &= ~IEEE80211_TX_TEMPORARY_FLAGS;
1878                 skb_queue_tail(&sta->ps_tx_buf[ac], tx->skb);
1879 +               spin_unlock(&sta->ps_lock);
1880
1881                 if (!timer_pending(&local->sta_cleanup))
1882                         mod_timer(&local->sta_cleanup,
1883 @@ -525,9 +539,7 @@ ieee80211_tx_h_ps_buf(struct ieee80211_t
1884
1885         /* only deauth, disassoc and action are bufferable MMPDUs */
1886         if (ieee80211_is_mgmt(hdr->frame_control) &&
1887 -           !ieee80211_is_deauth(hdr->frame_control) &&
1888 -           !ieee80211_is_disassoc(hdr->frame_control) &&
1889 -           !ieee80211_is_action(hdr->frame_control)) {
1890 +           !ieee80211_is_bufferable_mmpdu(hdr->frame_control)) {
1891                 if (tx->flags & IEEE80211_TX_UNICAST)
1892                         info->flags |= IEEE80211_TX_CTL_NO_PS_BUFFER;
1893                 return TX_CONTINUE;
1894 @@ -567,7 +579,7 @@ ieee80211_tx_h_select_key(struct ieee802
1895                 tx->key = key;
1896         else if (ieee80211_is_mgmt(hdr->frame_control) &&
1897                  is_multicast_ether_addr(hdr->addr1) &&
1898 -                ieee80211_is_robust_mgmt_frame(hdr) &&
1899 +                ieee80211_is_robust_mgmt_frame(tx->skb) &&
1900                  (key = rcu_dereference(tx->sdata->default_mgmt_key)))
1901                 tx->key = key;
1902         else if (is_multicast_ether_addr(hdr->addr1) &&
1903 @@ -582,12 +594,12 @@ ieee80211_tx_h_select_key(struct ieee802
1904                 tx->key = NULL;
1905         else if (tx->skb->protocol == tx->sdata->control_port_protocol)
1906                 tx->key = NULL;
1907 -       else if (ieee80211_is_robust_mgmt_frame(hdr) &&
1908 +       else if (ieee80211_is_robust_mgmt_frame(tx->skb) &&
1909                  !(ieee80211_is_action(hdr->frame_control) &&
1910                    tx->sta && test_sta_flag(tx->sta, WLAN_STA_MFP)))
1911                 tx->key = NULL;
1912         else if (ieee80211_is_mgmt(hdr->frame_control) &&
1913 -                !ieee80211_is_robust_mgmt_frame(hdr))
1914 +                !ieee80211_is_robust_mgmt_frame(tx->skb))
1915                 tx->key = NULL;
1916         else {
1917                 I802_DEBUG_INC(tx->local->tx_handlers_drop_unencrypted);
1918 @@ -878,7 +890,7 @@ static int ieee80211_fragment(struct iee
1919         }
1920
1921         /* adjust first fragment's length */
1922 -       skb->len = hdrlen + per_fragm;
1923 +       skb_trim(skb, hdrlen + per_fragm);
1924         return 0;
1925  }
1926
1927 @@ -2900,7 +2912,7 @@ ieee80211_get_buffered_bc(struct ieee802
1928                                 cpu_to_le16(IEEE80211_FCTL_MOREDATA);
1929                 }
1930
1931 -               if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
1932 +               if (sdata->vif.type == NL80211_IFTYPE_AP)
1933                         sdata = IEEE80211_DEV_TO_SUB_IF(skb->dev);
1934                 if (!ieee80211_tx_prepare(sdata, &tx, skb))
1935                         break;
1936 --- a/net/mac80211/wpa.c
1937 +++ b/net/mac80211/wpa.c
1938 @@ -499,7 +499,7 @@ ieee80211_crypto_ccmp_decrypt(struct iee
1939         hdrlen = ieee80211_hdrlen(hdr->frame_control);
1940
1941         if (!ieee80211_is_data(hdr->frame_control) &&
1942 -           !ieee80211_is_robust_mgmt_frame(hdr))
1943 +           !ieee80211_is_robust_mgmt_frame(skb))
1944                 return RX_CONTINUE;
1945
1946         data_len = skb->len - hdrlen - IEEE80211_CCMP_HDR_LEN -
1947 --- a/net/wireless/ap.c
1948 +++ b/net/wireless/ap.c
1949 @@ -27,9 +27,10 @@ static int __cfg80211_stop_ap(struct cfg
1950         err = rdev_stop_ap(rdev, dev);
1951         if (!err) {
1952                 wdev->beacon_interval = 0;
1953 -               wdev->channel = NULL;
1954 +               memset(&wdev->chandef, 0, sizeof(wdev->chandef));
1955                 wdev->ssid_len = 0;
1956                 rdev_set_qos_map(rdev, dev, NULL);
1957 +               nl80211_send_ap_stopped(wdev);
1958         }
1959
1960         return err;
1961 --- a/net/wireless/core.c
1962 +++ b/net/wireless/core.c
1963 @@ -203,8 +203,11 @@ void cfg80211_stop_p2p_device(struct cfg
1964
1965         rdev->opencount--;
1966
1967 -       WARN_ON(rdev->scan_req && rdev->scan_req->wdev == wdev &&
1968 -               !rdev->scan_req->notified);
1969 +       if (rdev->scan_req && rdev->scan_req->wdev == wdev) {
1970 +               if (WARN_ON(!rdev->scan_req->notified))
1971 +                       rdev->scan_req->aborted = true;
1972 +               ___cfg80211_scan_done(rdev, false);
1973 +       }
1974  }
1975
1976  static int cfg80211_rfkill_set_block(void *data, bool blocked)
1977 @@ -447,9 +450,6 @@ int wiphy_register(struct wiphy *wiphy)
1978         int i;
1979         u16 ifmodes = wiphy->interface_modes;
1980
1981 -       /* support for 5/10 MHz is broken due to nl80211 API mess - disable */
1982 -       wiphy->flags &= ~WIPHY_FLAG_SUPPORTS_5_10_MHZ;
1983 -
1984         /*
1985          * There are major locking problems in nl80211/mac80211 for CSA,
1986          * disable for all drivers until this has been reworked.
1987 @@ -795,8 +795,6 @@ void cfg80211_leave(struct cfg80211_regi
1988         default:
1989                 break;
1990         }
1991 -
1992 -       wdev->beacon_interval = 0;
1993  }
1994
1995  static int cfg80211_netdev_notifier_call(struct notifier_block *nb,
1996 @@ -875,8 +873,11 @@ static int cfg80211_netdev_notifier_call
1997                 break;
1998         case NETDEV_DOWN:
1999                 cfg80211_update_iface_num(rdev, wdev->iftype, -1);
2000 -               WARN_ON(rdev->scan_req && rdev->scan_req->wdev == wdev &&
2001 -                       !rdev->scan_req->notified);
2002 +               if (rdev->scan_req && rdev->scan_req->wdev == wdev) {
2003 +                       if (WARN_ON(!rdev->scan_req->notified))
2004 +                               rdev->scan_req->aborted = true;
2005 +                       ___cfg80211_scan_done(rdev, false);
2006 +               }
2007
2008                 if (WARN_ON(rdev->sched_scan_req &&
2009                             rdev->sched_scan_req->dev == wdev->netdev)) {
2010 --- a/net/wireless/core.h
2011 +++ b/net/wireless/core.h
2012 @@ -62,6 +62,7 @@ struct cfg80211_registered_device {
2013         struct rb_root bss_tree;
2014         u32 bss_generation;
2015         struct cfg80211_scan_request *scan_req; /* protected by RTNL */
2016 +       struct sk_buff *scan_msg;
2017         struct cfg80211_sched_scan_request *sched_scan_req;
2018         unsigned long suspend_at;
2019         struct work_struct scan_done_wk;
2020 @@ -210,6 +211,7 @@ struct cfg80211_event {
2021                 } dc;
2022                 struct {
2023                         u8 bssid[ETH_ALEN];
2024 +                       struct ieee80211_channel *channel;
2025                 } ij;
2026         };
2027  };
2028 @@ -257,7 +259,8 @@ int __cfg80211_leave_ibss(struct cfg8021
2029                           struct net_device *dev, bool nowext);
2030  int cfg80211_leave_ibss(struct cfg80211_registered_device *rdev,
2031                         struct net_device *dev, bool nowext);
2032 -void __cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid);
2033 +void __cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid,
2034 +                           struct ieee80211_channel *channel);
2035  int cfg80211_ibss_wext_join(struct cfg80211_registered_device *rdev,
2036                             struct wireless_dev *wdev);
2037
2038 @@ -361,7 +364,8 @@ int cfg80211_validate_key_settings(struc
2039                                    struct key_params *params, int key_idx,
2040                                    bool pairwise, const u8 *mac_addr);
2041  void __cfg80211_scan_done(struct work_struct *wk);
2042 -void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev);
2043 +void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev,
2044 +                          bool send_message);
2045  void __cfg80211_sched_scan_results(struct work_struct *wk);
2046  int __cfg80211_stop_sched_scan(struct cfg80211_registered_device *rdev,
2047                                bool driver_initiated);
2048 @@ -441,7 +445,8 @@ static inline unsigned int elapsed_jiffi
2049  void
2050  cfg80211_get_chan_state(struct wireless_dev *wdev,
2051                         struct ieee80211_channel **chan,
2052 -                       enum cfg80211_chan_mode *chanmode);
2053 +                       enum cfg80211_chan_mode *chanmode,
2054 +                       u8 *radar_detect);
2055
2056  int cfg80211_set_monitor_channel(struct cfg80211_registered_device *rdev,
2057                                  struct cfg80211_chan_def *chandef);
2058 --- a/net/wireless/nl80211.c
2059 +++ b/net/wireless/nl80211.c
2060 @@ -1723,9 +1723,10 @@ static int nl80211_dump_wiphy(struct sk_
2061                                  * We can then retry with the larger buffer.
2062                                  */
2063                                 if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
2064 -                                   !skb->len &&
2065 +                                   !skb->len && !state->split &&
2066                                     cb->min_dump_alloc < 4096) {
2067                                         cb->min_dump_alloc = 4096;
2068 +                                       state->split_start = 0;
2069                                         rtnl_unlock();
2070                                         return 1;
2071                                 }
2072 @@ -2047,10 +2048,12 @@ static int nl80211_set_wiphy(struct sk_b
2073                 nla_for_each_nested(nl_txq_params,
2074                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
2075                                     rem_txq_params) {
2076 -                       nla_parse(tb, NL80211_TXQ_ATTR_MAX,
2077 -                                 nla_data(nl_txq_params),
2078 -                                 nla_len(nl_txq_params),
2079 -                                 txq_params_policy);
2080 +                       result = nla_parse(tb, NL80211_TXQ_ATTR_MAX,
2081 +                                          nla_data(nl_txq_params),
2082 +                                          nla_len(nl_txq_params),
2083 +                                          txq_params_policy);
2084 +                       if (result)
2085 +                               goto bad_res;
2086                         result = parse_txq_params(tb, &txq_params);
2087                         if (result)
2088                                 goto bad_res;
2089 @@ -3289,7 +3292,7 @@ static int nl80211_start_ap(struct sk_bu
2090         if (!err) {
2091                 wdev->preset_chandef = params.chandef;
2092                 wdev->beacon_interval = params.beacon_interval;
2093 -               wdev->channel = params.chandef.chan;
2094 +               wdev->chandef = params.chandef;
2095                 wdev->ssid_len = params.ssid_len;
2096                 memcpy(wdev->ssid, params.ssid, wdev->ssid_len);
2097         }
2098 @@ -5210,9 +5213,11 @@ static int nl80211_set_reg(struct sk_buf
2099
2100         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
2101                             rem_reg_rules) {
2102 -               nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
2103 -                         nla_data(nl_reg_rule), nla_len(nl_reg_rule),
2104 -                         reg_rule_policy);
2105 +               r = nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
2106 +                             nla_data(nl_reg_rule), nla_len(nl_reg_rule),
2107 +                             reg_rule_policy);
2108 +               if (r)
2109 +                       goto bad_reg;
2110                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
2111                 if (r)
2112                         goto bad_reg;
2113 @@ -5277,7 +5282,7 @@ static int nl80211_trigger_scan(struct s
2114         if (!rdev->ops->scan)
2115                 return -EOPNOTSUPP;
2116
2117 -       if (rdev->scan_req) {
2118 +       if (rdev->scan_req || rdev->scan_msg) {
2119                 err = -EBUSY;
2120                 goto unlock;
2121         }
2122 @@ -5475,6 +5480,7 @@ static int nl80211_start_sched_scan(stru
2123         enum ieee80211_band band;
2124         size_t ie_len;
2125         struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
2126 +       s32 default_match_rssi = NL80211_SCAN_RSSI_THOLD_OFF;
2127
2128         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
2129             !rdev->ops->sched_scan_start)
2130 @@ -5509,11 +5515,40 @@ static int nl80211_start_sched_scan(stru
2131         if (n_ssids > wiphy->max_sched_scan_ssids)
2132                 return -EINVAL;
2133
2134 -       if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH])
2135 +       /*
2136 +        * First, count the number of 'real' matchsets. Due to an issue with
2137 +        * the old implementation, matchsets containing only the RSSI attribute
2138 +        * (NL80211_SCHED_SCAN_MATCH_ATTR_RSSI) are considered as the 'default'
2139 +        * RSSI for all matchsets, rather than their own matchset for reporting
2140 +        * all APs with a strong RSSI. This is needed to be compatible with
2141 +        * older userspace that treated a matchset with only the RSSI as the
2142 +        * global RSSI for all other matchsets - if there are other matchsets.
2143 +        */
2144 +       if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
2145                 nla_for_each_nested(attr,
2146                                     info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
2147 -                                   tmp)
2148 -                       n_match_sets++;
2149 +                                   tmp) {
2150 +                       struct nlattr *rssi;
2151 +
2152 +                       err = nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
2153 +                                       nla_data(attr), nla_len(attr),
2154 +                                       nl80211_match_policy);
2155 +                       if (err)
2156 +                               return err;
2157 +                       /* add other standalone attributes here */
2158 +                       if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID]) {
2159 +                               n_match_sets++;
2160 +                               continue;
2161 +                       }
2162 +                       rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
2163 +                       if (rssi)
2164 +                               default_match_rssi = nla_get_s32(rssi);
2165 +               }
2166 +       }
2167 +
2168 +       /* However, if there's no other matchset, add the RSSI one */
2169 +       if (!n_match_sets && default_match_rssi != NL80211_SCAN_RSSI_THOLD_OFF)
2170 +               n_match_sets = 1;
2171
2172         if (n_match_sets > wiphy->max_match_sets)
2173                 return -EINVAL;
2174 @@ -5634,11 +5669,22 @@ static int nl80211_start_sched_scan(stru
2175                                     tmp) {
2176                         struct nlattr *ssid, *rssi;
2177
2178 -                       nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
2179 -                                 nla_data(attr), nla_len(attr),
2180 -                                 nl80211_match_policy);
2181 +                       err = nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
2182 +                                       nla_data(attr), nla_len(attr),
2183 +                                       nl80211_match_policy);
2184 +                       if (err)
2185 +                               goto out_free;
2186                         ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
2187                         if (ssid) {
2188 +                               if (WARN_ON(i >= n_match_sets)) {
2189 +                                       /* this indicates a programming error,
2190 +                                        * the loop above should have verified
2191 +                                        * things properly
2192 +                                        */
2193 +                                       err = -EINVAL;
2194 +                                       goto out_free;
2195 +                               }
2196 +
2197                                 if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) {
2198                                         err = -EINVAL;
2199                                         goto out_free;
2200 @@ -5647,15 +5693,28 @@ static int nl80211_start_sched_scan(stru
2201                                        nla_data(ssid), nla_len(ssid));
2202                                 request->match_sets[i].ssid.ssid_len =
2203                                         nla_len(ssid);
2204 +                               /* special attribute - old implemenation w/a */
2205 +                               request->match_sets[i].rssi_thold =
2206 +                                       default_match_rssi;
2207 +                               rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
2208 +                               if (rssi)
2209 +                                       request->match_sets[i].rssi_thold =
2210 +                                               nla_get_s32(rssi);
2211                         }
2212 -                       rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
2213 -                       if (rssi)
2214 -                               request->rssi_thold = nla_get_u32(rssi);
2215 -                       else
2216 -                               request->rssi_thold =
2217 -                                                  NL80211_SCAN_RSSI_THOLD_OFF;
2218                         i++;
2219                 }
2220 +
2221 +               /* there was no other matchset, so the RSSI one is alone */
2222 +               if (i == 0)
2223 +                       request->match_sets[0].rssi_thold = default_match_rssi;
2224 +
2225 +               request->min_rssi_thold = INT_MAX;
2226 +               for (i = 0; i < n_match_sets; i++)
2227 +                       request->min_rssi_thold =
2228 +                               min(request->match_sets[i].rssi_thold,
2229 +                                   request->min_rssi_thold);
2230 +       } else {
2231 +               request->min_rssi_thold = NL80211_SCAN_RSSI_THOLD_OFF;
2232         }
2233
2234         if (info->attrs[NL80211_ATTR_IE]) {
2235 @@ -5751,7 +5810,7 @@ static int nl80211_start_radar_detection
2236
2237         err = rdev->ops->start_radar_detection(&rdev->wiphy, dev, &chandef);
2238         if (!err) {
2239 -               wdev->channel = chandef.chan;
2240 +               wdev->chandef = chandef;
2241                 wdev->cac_started = true;
2242                 wdev->cac_start_time = jiffies;
2243         }
2244 @@ -7502,16 +7561,19 @@ static int nl80211_set_tx_bitrate_mask(s
2245          * directly to the enum ieee80211_band values used in cfg80211.
2246          */
2247         BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
2248 -       nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem)
2249 -       {
2250 +       nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem) {
2251                 enum ieee80211_band band = nla_type(tx_rates);
2252 +               int err;
2253 +
2254                 if (band < 0 || band >= IEEE80211_NUM_BANDS)
2255                         return -EINVAL;
2256                 sband = rdev->wiphy.bands[band];
2257                 if (sband == NULL)
2258                         return -EINVAL;
2259 -               nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
2260 -                         nla_len(tx_rates), nl80211_txattr_policy);
2261 +               err = nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
2262 +                               nla_len(tx_rates), nl80211_txattr_policy);
2263 +               if (err)
2264 +                       return err;
2265                 if (tb[NL80211_TXRATE_LEGACY]) {
2266                         mask.control[band].legacy = rateset_to_mask(
2267                                 sband,
2268 @@ -10054,40 +10116,31 @@ void nl80211_send_scan_start(struct cfg8
2269                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
2270  }
2271
2272 -void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
2273 -                           struct wireless_dev *wdev)
2274 +struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev,
2275 +                                      struct wireless_dev *wdev, bool aborted)
2276  {
2277         struct sk_buff *msg;
2278
2279         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2280         if (!msg)
2281 -               return;
2282 +               return NULL;
2283
2284         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
2285 -                                 NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
2286 +                                 aborted ? NL80211_CMD_SCAN_ABORTED :
2287 +                                           NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
2288                 nlmsg_free(msg);
2289 -               return;
2290 +               return NULL;
2291         }
2292
2293 -       genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
2294 -                               NL80211_MCGRP_SCAN, GFP_KERNEL);
2295 +       return msg;
2296  }
2297
2298 -void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
2299 -                              struct wireless_dev *wdev)
2300 +void nl80211_send_scan_result(struct cfg80211_registered_device *rdev,
2301 +                             struct sk_buff *msg)
2302  {
2303 -       struct sk_buff *msg;
2304 -
2305 -       msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2306         if (!msg)
2307                 return;
2308
2309 -       if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
2310 -                                 NL80211_CMD_SCAN_ABORTED) < 0) {
2311 -               nlmsg_free(msg);
2312 -               return;
2313 -       }
2314 -
2315         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
2316                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
2317  }
2318 @@ -11158,7 +11211,8 @@ void cfg80211_ch_switch_notify(struct ne
2319                     wdev->iftype != NL80211_IFTYPE_MESH_POINT))
2320                 return;
2321
2322 -       wdev->channel = chandef->chan;
2323 +       wdev->chandef = *chandef;
2324 +       wdev->preset_chandef = *chandef;
2325         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL);
2326  }
2327  EXPORT_SYMBOL(cfg80211_ch_switch_notify);
2328 @@ -11673,6 +11727,35 @@ void cfg80211_crit_proto_stopped(struct
2329  }
2330  EXPORT_SYMBOL(cfg80211_crit_proto_stopped);
2331
2332 +void nl80211_send_ap_stopped(struct wireless_dev *wdev)
2333 +{
2334 +       struct wiphy *wiphy = wdev->wiphy;
2335 +       struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
2336 +       struct sk_buff *msg;
2337 +       void *hdr;
2338 +
2339 +       msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2340 +       if (!msg)
2341 +               return;
2342 +
2343 +       hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STOP_AP);
2344 +       if (!hdr)
2345 +               goto out;
2346 +
2347 +       if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
2348 +           nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) ||
2349 +           nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
2350 +               goto out;
2351 +
2352 +       genlmsg_end(msg, hdr);
2353 +
2354 +       genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0,
2355 +                               NL80211_MCGRP_MLME, GFP_KERNEL);
2356 +       return;
2357 + out:
2358 +       nlmsg_free(msg);
2359 +}
2360 +
2361  /* initialisation/exit functions */
2362
2363  int nl80211_init(void)
2364 --- a/net/wireless/nl80211.h
2365 +++ b/net/wireless/nl80211.h
2366 @@ -8,10 +8,10 @@ void nl80211_exit(void);
2367  void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev);
2368  void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
2369                              struct wireless_dev *wdev);
2370 -void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
2371 -                           struct wireless_dev *wdev);
2372 -void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
2373 -                              struct wireless_dev *wdev);
2374 +struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev,
2375 +                                      struct wireless_dev *wdev, bool aborted);
2376 +void nl80211_send_scan_result(struct cfg80211_registered_device *rdev,
2377 +                             struct sk_buff *msg);
2378  void nl80211_send_sched_scan(struct cfg80211_registered_device *rdev,
2379                              struct net_device *netdev, u32 cmd);
2380  void nl80211_send_sched_scan_results(struct cfg80211_registered_device *rdev,
2381 @@ -74,6 +74,8 @@ nl80211_radar_notify(struct cfg80211_reg
2382                      enum nl80211_radar_event event,
2383                      struct net_device *netdev, gfp_t gfp);
2384
2385 +void nl80211_send_ap_stopped(struct wireless_dev *wdev);
2386 +
2387  void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev);
2388
2389  #endif /* __NET_WIRELESS_NL80211_H */
2390 --- a/net/wireless/scan.c
2391 +++ b/net/wireless/scan.c
2392 @@ -161,18 +161,25 @@ static void __cfg80211_bss_expire(struct
2393                 dev->bss_generation++;
2394  }
2395
2396 -void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev)
2397 +void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev,
2398 +                          bool send_message)
2399  {
2400         struct cfg80211_scan_request *request;
2401         struct wireless_dev *wdev;
2402 +       struct sk_buff *msg;
2403  #ifdef CPTCFG_CFG80211_WEXT
2404         union iwreq_data wrqu;
2405  #endif
2406
2407         ASSERT_RTNL();
2408
2409 -       request = rdev->scan_req;
2410 +       if (rdev->scan_msg) {
2411 +               nl80211_send_scan_result(rdev, rdev->scan_msg);
2412 +               rdev->scan_msg = NULL;
2413 +               return;
2414 +       }
2415
2416 +       request = rdev->scan_req;
2417         if (!request)
2418                 return;
2419
2420 @@ -186,18 +193,16 @@ void ___cfg80211_scan_done(struct cfg802
2421         if (wdev->netdev)
2422                 cfg80211_sme_scan_done(wdev->netdev);
2423
2424 -       if (request->aborted) {
2425 -               nl80211_send_scan_aborted(rdev, wdev);
2426 -       } else {
2427 -               if (request->flags & NL80211_SCAN_FLAG_FLUSH) {
2428 -                       /* flush entries from previous scans */
2429 -                       spin_lock_bh(&rdev->bss_lock);
2430 -                       __cfg80211_bss_expire(rdev, request->scan_start);
2431 -                       spin_unlock_bh(&rdev->bss_lock);
2432 -               }
2433 -               nl80211_send_scan_done(rdev, wdev);
2434 +       if (!request->aborted &&
2435 +           request->flags & NL80211_SCAN_FLAG_FLUSH) {
2436 +               /* flush entries from previous scans */
2437 +               spin_lock_bh(&rdev->bss_lock);
2438 +               __cfg80211_bss_expire(rdev, request->scan_start);
2439 +               spin_unlock_bh(&rdev->bss_lock);
2440         }
2441
2442 +       msg = nl80211_build_scan_msg(rdev, wdev, request->aborted);
2443 +
2444  #ifdef CPTCFG_CFG80211_WEXT
2445         if (wdev->netdev && !request->aborted) {
2446                 memset(&wrqu, 0, sizeof(wrqu));
2447 @@ -211,6 +216,11 @@ void ___cfg80211_scan_done(struct cfg802
2448
2449         rdev->scan_req = NULL;
2450         kfree(request);
2451 +
2452 +       if (!send_message)
2453 +               rdev->scan_msg = msg;
2454 +       else
2455 +               nl80211_send_scan_result(rdev, msg);
2456  }
2457
2458  void __cfg80211_scan_done(struct work_struct *wk)
2459 @@ -221,7 +231,7 @@ void __cfg80211_scan_done(struct work_st
2460                             scan_done_wk);
2461
2462         rtnl_lock();
2463 -       ___cfg80211_scan_done(rdev);
2464 +       ___cfg80211_scan_done(rdev, true);
2465         rtnl_unlock();
2466  }
2467
2468 @@ -1079,7 +1089,7 @@ int cfg80211_wext_siwscan(struct net_dev
2469         if (IS_ERR(rdev))
2470                 return PTR_ERR(rdev);
2471
2472 -       if (rdev->scan_req) {
2473 +       if (rdev->scan_req || rdev->scan_msg) {
2474                 err = -EBUSY;
2475                 goto out;
2476         }
2477 @@ -1481,7 +1491,7 @@ int cfg80211_wext_giwscan(struct net_dev
2478         if (IS_ERR(rdev))
2479                 return PTR_ERR(rdev);
2480
2481 -       if (rdev->scan_req)
2482 +       if (rdev->scan_req || rdev->scan_msg)
2483                 return -EAGAIN;
2484
2485         res = ieee80211_scan_results(rdev, info, extra, data->length);
2486 --- a/net/wireless/sme.c
2487 +++ b/net/wireless/sme.c
2488 @@ -67,7 +67,7 @@ static int cfg80211_conn_scan(struct wir
2489         ASSERT_RDEV_LOCK(rdev);
2490         ASSERT_WDEV_LOCK(wdev);
2491
2492 -       if (rdev->scan_req)
2493 +       if (rdev->scan_req || rdev->scan_msg)
2494                 return -EBUSY;
2495
2496         if (wdev->conn->params.channel)
2497 --- a/net/mac80211/mlme.c
2498 +++ b/net/mac80211/mlme.c
2499 @@ -1001,7 +1001,6 @@ ieee80211_sta_process_chanswitch(struct
2500         }
2501
2502         ifmgd->flags |= IEEE80211_STA_CSA_RECEIVED;
2503 -       sdata->vif.csa_active = true;
2504
2505         mutex_lock(&local->chanctx_mtx);
2506         if (local->use_chanctx) {
2507 @@ -1039,6 +1038,7 @@ ieee80211_sta_process_chanswitch(struct
2508         mutex_unlock(&local->chanctx_mtx);
2509
2510         sdata->csa_chandef = csa_ie.chandef;
2511 +       sdata->vif.csa_active = true;
2512
2513         if (csa_ie.mode)
2514                 ieee80211_stop_queues_by_reason(&local->hw,
2515 --- a/net/mac80211/chan.c
2516 +++ b/net/mac80211/chan.c
2517 @@ -196,6 +196,8 @@ static bool ieee80211_is_radar_required(
2518  {
2519         struct ieee80211_sub_if_data *sdata;
2520
2521 +       lockdep_assert_held(&local->mtx);
2522 +
2523         rcu_read_lock();
2524         list_for_each_entry_rcu(sdata, &local->interfaces, list) {
2525                 if (sdata->radar_required) {
2526 --- a/net/mac80211/ibss.c
2527 +++ b/net/mac80211/ibss.c
2528 @@ -294,7 +294,6 @@ static void __ieee80211_sta_join_ibss(st
2529         }
2530
2531         mutex_lock(&local->mtx);
2532 -       ieee80211_vif_release_channel(sdata);
2533         if (ieee80211_vif_use_channel(sdata, &chandef,
2534                                       ifibss->fixed_channel ?
2535                                         IEEE80211_CHANCTX_SHARED :
2536 @@ -303,6 +302,7 @@ static void __ieee80211_sta_join_ibss(st
2537                 mutex_unlock(&local->mtx);
2538                 return;
2539         }
2540 +       sdata->radar_required = radar_required;
2541         mutex_unlock(&local->mtx);
2542
2543         memcpy(ifibss->bssid, bssid, ETH_ALEN);
2544 @@ -318,7 +318,6 @@ static void __ieee80211_sta_join_ibss(st
2545         rcu_assign_pointer(ifibss->presp, presp);
2546         mgmt = (void *)presp->head;
2547
2548 -       sdata->radar_required = radar_required;
2549         sdata->vif.bss_conf.enable_beacon = true;
2550         sdata->vif.bss_conf.beacon_int = beacon_int;
2551         sdata->vif.bss_conf.basic_rates = basic_rates;
2552 @@ -386,7 +385,7 @@ static void __ieee80211_sta_join_ibss(st
2553                                               presp->head_len, 0, GFP_KERNEL);
2554         cfg80211_put_bss(local->hw.wiphy, bss);
2555         netif_carrier_on(sdata->dev);
2556 -       cfg80211_ibss_joined(sdata->dev, ifibss->bssid, GFP_KERNEL);
2557 +       cfg80211_ibss_joined(sdata->dev, ifibss->bssid, chan, GFP_KERNEL);
2558  }
2559
2560  static void ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
2561 @@ -802,6 +801,8 @@ ieee80211_ibss_process_chanswitch(struct
2562         int err;
2563         u32 sta_flags;
2564
2565 +       sdata_assert_lock(sdata);
2566 +
2567         sta_flags = IEEE80211_STA_DISABLE_VHT;
2568         switch (ifibss->chandef.width) {
2569         case NL80211_CHAN_WIDTH_5:
2570 @@ -1471,6 +1472,11 @@ static void ieee80211_rx_mgmt_probe_req(
2571         memcpy(((struct ieee80211_mgmt *) skb->data)->da, mgmt->sa, ETH_ALEN);
2572         ibss_dbg(sdata, "Sending ProbeResp to %pM\n", mgmt->sa);
2573         IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
2574 +
2575 +       /* avoid excessive retries for probe request to wildcard SSIDs */
2576 +       if (pos[1] == 0)
2577 +               IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_NO_ACK;
2578 +
2579         ieee80211_tx_skb(sdata, skb);
2580  }
2581
2582 --- a/net/mac80211/mesh.c
2583 +++ b/net/mac80211/mesh.c
2584 @@ -872,6 +872,8 @@ ieee80211_mesh_process_chnswitch(struct
2585         if (!ifmsh->mesh_id)
2586                 return false;
2587
2588 +       sdata_assert_lock(sdata);
2589 +
2590         sta_flags = IEEE80211_STA_DISABLE_VHT;
2591         switch (sdata->vif.bss_conf.chandef.width) {
2592         case NL80211_CHAN_WIDTH_20_NOHT:
2593 --- a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
2594 +++ b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
2595 @@ -4658,6 +4658,7 @@ brcmf_notify_connect_status(struct brcmf
2596         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
2597         struct net_device *ndev = ifp->ndev;
2598         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
2599 +       struct ieee80211_channel *chan;
2600         s32 err = 0;
2601
2602         if (ifp->vif->mode == WL_MODE_AP) {
2603 @@ -4665,9 +4666,10 @@ brcmf_notify_connect_status(struct brcmf
2604         } else if (brcmf_is_linkup(e)) {
2605                 brcmf_dbg(CONN, "Linkup\n");
2606                 if (brcmf_is_ibssmode(ifp->vif)) {
2607 +                       chan = ieee80211_get_channel(cfg->wiphy, cfg->channel);
2608                         memcpy(profile->bssid, e->addr, ETH_ALEN);
2609                         wl_inform_ibss(cfg, ndev, e->addr);
2610 -                       cfg80211_ibss_joined(ndev, e->addr, GFP_KERNEL);
2611 +                       cfg80211_ibss_joined(ndev, e->addr, chan, GFP_KERNEL);
2612                         clear_bit(BRCMF_VIF_STATUS_CONNECTING,
2613                                   &ifp->vif->sme_state);
2614                         set_bit(BRCMF_VIF_STATUS_CONNECTED,
2615 --- a/drivers/net/wireless/libertas/cfg.c
2616 +++ b/drivers/net/wireless/libertas/cfg.c
2617 @@ -1766,7 +1766,8 @@ static void lbs_join_post(struct lbs_pri
2618         memcpy(priv->wdev->ssid, params->ssid, params->ssid_len);
2619         priv->wdev->ssid_len = params->ssid_len;
2620
2621 -       cfg80211_ibss_joined(priv->dev, bssid, GFP_KERNEL);
2622 +       cfg80211_ibss_joined(priv->dev, bssid, params->chandef.chan,
2623 +                            GFP_KERNEL);
2624
2625         /* TODO: consider doing this at MACREG_INT_CODE_LINK_SENSED time */
2626         priv->connect_status = LBS_CONNECTED;
2627 --- a/drivers/net/wireless/mwifiex/cfg80211.c
2628 +++ b/drivers/net/wireless/mwifiex/cfg80211.c
2629 @@ -1881,7 +1881,8 @@ mwifiex_cfg80211_join_ibss(struct wiphy
2630                                      params->privacy);
2631  done:
2632         if (!ret) {
2633 -               cfg80211_ibss_joined(priv->netdev, priv->cfg_bssid, GFP_KERNEL);
2634 +               cfg80211_ibss_joined(priv->netdev, priv->cfg_bssid,
2635 +                                    params->chandef.chan, GFP_KERNEL);
2636                 dev_dbg(priv->adapter->dev,
2637                         "info: joined/created adhoc network with bssid"
2638                         " %pM successfully\n", priv->cfg_bssid);
2639 --- a/drivers/net/wireless/rndis_wlan.c
2640 +++ b/drivers/net/wireless/rndis_wlan.c
2641 @@ -2835,7 +2835,9 @@ static void rndis_wlan_do_link_up_work(s
2642                                         bssid, req_ie, req_ie_len,
2643                                         resp_ie, resp_ie_len, GFP_KERNEL);
2644         } else if (priv->infra_mode == NDIS_80211_INFRA_ADHOC)
2645 -               cfg80211_ibss_joined(usbdev->net, bssid, GFP_KERNEL);
2646 +               cfg80211_ibss_joined(usbdev->net, bssid,
2647 +                                    get_current_channel(usbdev, NULL),
2648 +                                    GFP_KERNEL);
2649
2650         kfree(info);
2651
2652 --- a/net/wireless/ibss.c
2653 +++ b/net/wireless/ibss.c
2654 @@ -14,7 +14,8 @@
2655  #include "rdev-ops.h"
2656
2657
2658 -void __cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid)
2659 +void __cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid,
2660 +                           struct ieee80211_channel *channel)
2661  {
2662         struct wireless_dev *wdev = dev->ieee80211_ptr;
2663         struct cfg80211_bss *bss;
2664 @@ -28,8 +29,7 @@ void __cfg80211_ibss_joined(struct net_d
2665         if (!wdev->ssid_len)
2666                 return;
2667
2668 -       bss = cfg80211_get_bss(wdev->wiphy, NULL, bssid,
2669 -                              wdev->ssid, wdev->ssid_len,
2670 +       bss = cfg80211_get_bss(wdev->wiphy, channel, bssid, NULL, 0,
2671                                WLAN_CAPABILITY_IBSS, WLAN_CAPABILITY_IBSS);
2672
2673         if (WARN_ON(!bss))
2674 @@ -54,21 +54,26 @@ void __cfg80211_ibss_joined(struct net_d
2675  #endif
2676  }
2677
2678 -void cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid, gfp_t gfp)
2679 +void cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid,
2680 +                         struct ieee80211_channel *channel, gfp_t gfp)
2681  {
2682         struct wireless_dev *wdev = dev->ieee80211_ptr;
2683         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
2684         struct cfg80211_event *ev;
2685         unsigned long flags;
2686
2687 -       trace_cfg80211_ibss_joined(dev, bssid);
2688 +       trace_cfg80211_ibss_joined(dev, bssid, channel);
2689 +
2690 +       if (WARN_ON(!channel))
2691 +               return;
2692
2693         ev = kzalloc(sizeof(*ev), gfp);
2694         if (!ev)
2695                 return;
2696
2697         ev->type = EVENT_IBSS_JOINED;
2698 -       memcpy(ev->cr.bssid, bssid, ETH_ALEN);
2699 +       memcpy(ev->ij.bssid, bssid, ETH_ALEN);
2700 +       ev->ij.channel = channel;
2701
2702         spin_lock_irqsave(&wdev->event_lock, flags);
2703         list_add_tail(&ev->list, &wdev->event_list);
2704 @@ -117,6 +122,7 @@ int __cfg80211_join_ibss(struct cfg80211
2705
2706         wdev->ibss_fixed = params->channel_fixed;
2707         wdev->ibss_dfs_possible = params->userspace_handles_dfs;
2708 +       wdev->chandef = params->chandef;
2709  #ifdef CPTCFG_CFG80211_WEXT
2710         wdev->wext.ibss.chandef = params->chandef;
2711  #endif
2712 @@ -200,6 +206,7 @@ static void __cfg80211_clear_ibss(struct
2713
2714         wdev->current_bss = NULL;
2715         wdev->ssid_len = 0;
2716 +       memset(&wdev->chandef, 0, sizeof(wdev->chandef));
2717  #ifdef CPTCFG_CFG80211_WEXT
2718         if (!nowext)
2719                 wdev->wext.ibss.ssid_len = 0;
2720 --- a/net/wireless/trace.h
2721 +++ b/net/wireless/trace.h
2722 @@ -2278,11 +2278,6 @@ DECLARE_EVENT_CLASS(cfg80211_rx_evt,
2723         TP_printk(NETDEV_PR_FMT ", " MAC_PR_FMT, NETDEV_PR_ARG, MAC_PR_ARG(addr))
2724  );
2725
2726 -DEFINE_EVENT(cfg80211_rx_evt, cfg80211_ibss_joined,
2727 -       TP_PROTO(struct net_device *netdev, const u8 *addr),
2728 -       TP_ARGS(netdev, addr)
2729 -);
2730 -
2731  DEFINE_EVENT(cfg80211_rx_evt, cfg80211_rx_spurious_frame,
2732         TP_PROTO(struct net_device *netdev, const u8 *addr),
2733         TP_ARGS(netdev, addr)
2734 @@ -2293,6 +2288,24 @@ DEFINE_EVENT(cfg80211_rx_evt, cfg80211_r
2735         TP_ARGS(netdev, addr)
2736  );
2737
2738 +TRACE_EVENT(cfg80211_ibss_joined,
2739 +       TP_PROTO(struct net_device *netdev, const u8 *bssid,
2740 +                struct ieee80211_channel *channel),
2741 +       TP_ARGS(netdev, bssid, channel),
2742 +       TP_STRUCT__entry(
2743 +               NETDEV_ENTRY
2744 +               MAC_ENTRY(bssid)
2745 +               CHAN_ENTRY
2746 +       ),
2747 +       TP_fast_assign(
2748 +               NETDEV_ASSIGN;
2749 +               MAC_ASSIGN(bssid, bssid);
2750 +               CHAN_ASSIGN(channel);
2751 +       ),
2752 +       TP_printk(NETDEV_PR_FMT ", bssid: " MAC_PR_FMT ", " CHAN_PR_FMT,
2753 +                 NETDEV_PR_ARG, MAC_PR_ARG(bssid), CHAN_PR_ARG)
2754 +);
2755 +
2756  TRACE_EVENT(cfg80211_probe_status,
2757         TP_PROTO(struct net_device *netdev, const u8 *addr, u64 cookie,
2758                  bool acked),
2759 --- a/net/wireless/util.c
2760 +++ b/net/wireless/util.c
2761 @@ -820,7 +820,8 @@ void cfg80211_process_wdev_events(struct
2762                                                 ev->dc.reason, true);
2763                         break;
2764                 case EVENT_IBSS_JOINED:
2765 -                       __cfg80211_ibss_joined(wdev->netdev, ev->ij.bssid);
2766 +                       __cfg80211_ibss_joined(wdev->netdev, ev->ij.bssid,
2767 +                                              ev->ij.channel);
2768                         break;
2769                 }
2770                 wdev_unlock(wdev);
2771 @@ -1356,7 +1357,7 @@ int cfg80211_can_use_iftype_chan(struct
2772                  */
2773                 mutex_lock_nested(&wdev_iter->mtx, 1);
2774                 __acquire(wdev_iter->mtx);
2775 -               cfg80211_get_chan_state(wdev_iter, &ch, &chmode);
2776 +               cfg80211_get_chan_state(wdev_iter, &ch, &chmode, &radar_detect);
2777                 wdev_unlock(wdev_iter);
2778
2779                 switch (chmode) {
2780 --- a/net/wireless/chan.c
2781 +++ b/net/wireless/chan.c
2782 @@ -642,7 +642,8 @@ int cfg80211_set_monitor_channel(struct
2783  void
2784  cfg80211_get_chan_state(struct wireless_dev *wdev,
2785                         struct ieee80211_channel **chan,
2786 -                       enum cfg80211_chan_mode *chanmode)
2787 +                       enum cfg80211_chan_mode *chanmode,
2788 +                       u8 *radar_detect)
2789  {
2790         *chan = NULL;
2791         *chanmode = CHAN_MODE_UNDEFINED;
2792 @@ -660,6 +661,11 @@ cfg80211_get_chan_state(struct wireless_
2793                                      !wdev->ibss_dfs_possible)
2794                                   ? CHAN_MODE_SHARED
2795                                   : CHAN_MODE_EXCLUSIVE;
2796 +
2797 +                       /* consider worst-case - IBSS can try to return to the
2798 +                        * original user-specified channel as creator */
2799 +                       if (wdev->ibss_dfs_possible)
2800 +                               *radar_detect |= BIT(wdev->chandef.width);
2801                         return;
2802                 }
2803                 break;
2804 @@ -674,17 +680,26 @@ cfg80211_get_chan_state(struct wireless_
2805         case NL80211_IFTYPE_AP:
2806         case NL80211_IFTYPE_P2P_GO:
2807                 if (wdev->cac_started) {
2808 -                       *chan = wdev->channel;
2809 +                       *chan = wdev->chandef.chan;
2810                         *chanmode = CHAN_MODE_SHARED;
2811 +                       *radar_detect |= BIT(wdev->chandef.width);
2812                 } else if (wdev->beacon_interval) {
2813 -                       *chan = wdev->channel;
2814 +                       *chan = wdev->chandef.chan;
2815                         *chanmode = CHAN_MODE_SHARED;
2816 +
2817 +                       if (cfg80211_chandef_dfs_required(wdev->wiphy,
2818 +                                                         &wdev->chandef))
2819 +                               *radar_detect |= BIT(wdev->chandef.width);
2820                 }
2821                 return;
2822         case NL80211_IFTYPE_MESH_POINT:
2823                 if (wdev->mesh_id_len) {
2824 -                       *chan = wdev->channel;
2825 +                       *chan = wdev->chandef.chan;
2826                         *chanmode = CHAN_MODE_SHARED;
2827 +
2828 +                       if (cfg80211_chandef_dfs_required(wdev->wiphy,
2829 +                                                         &wdev->chandef))
2830 +                               *radar_detect |= BIT(wdev->chandef.width);
2831                 }
2832                 return;
2833         case NL80211_IFTYPE_MONITOR:
2834 --- a/net/wireless/mesh.c
2835 +++ b/net/wireless/mesh.c
2836 @@ -195,7 +195,7 @@ int __cfg80211_join_mesh(struct cfg80211
2837         if (!err) {
2838                 memcpy(wdev->ssid, setup->mesh_id, setup->mesh_id_len);
2839                 wdev->mesh_id_len = setup->mesh_id_len;
2840 -               wdev->channel = setup->chandef.chan;
2841 +               wdev->chandef = setup->chandef;
2842         }
2843
2844         return err;
2845 @@ -244,7 +244,7 @@ int cfg80211_set_mesh_channel(struct cfg
2846                 err = rdev_libertas_set_mesh_channel(rdev, wdev->netdev,
2847                                                      chandef->chan);
2848                 if (!err)
2849 -                       wdev->channel = chandef->chan;
2850 +                       wdev->chandef = *chandef;
2851
2852                 return err;
2853         }
2854 @@ -276,7 +276,7 @@ static int __cfg80211_leave_mesh(struct
2855         err = rdev_leave_mesh(rdev, dev);
2856         if (!err) {
2857                 wdev->mesh_id_len = 0;
2858 -               wdev->channel = NULL;
2859 +               memset(&wdev->chandef, 0, sizeof(wdev->chandef));
2860                 rdev_set_qos_map(rdev, dev, NULL);
2861         }
2862
2863 --- a/net/wireless/mlme.c
2864 +++ b/net/wireless/mlme.c
2865 @@ -772,7 +772,7 @@ void cfg80211_cac_event(struct net_devic
2866         if (WARN_ON(!wdev->cac_started))
2867                 return;
2868
2869 -       if (WARN_ON(!wdev->channel))
2870 +       if (WARN_ON(!wdev->chandef.chan))
2871                 return;
2872
2873         switch (event) {
2874 --- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
2875 +++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
2876 @@ -5065,6 +5065,10 @@ static u16 ar9003_hw_get_max_edge_power(
2877                         break;
2878                 }
2879         }
2880 +
2881 +       if (is2GHz && !twiceMaxEdgePower)
2882 +               twiceMaxEdgePower = 60;
2883 +
2884         return twiceMaxEdgePower;
2885  }
2886
2887 --- a/drivers/net/wireless/ath/ath9k/ar9003_calib.c
2888 +++ b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
2889 @@ -23,10 +23,11 @@
2890  #define MAX_MEASUREMENT        MAX_IQCAL_MEASUREMENT
2891  #define MAX_MAG_DELTA  11
2892  #define MAX_PHS_DELTA  10
2893 +#define MAXIQCAL        3
2894
2895  struct coeff {
2896 -       int mag_coeff[AR9300_MAX_CHAINS][MAX_MEASUREMENT];
2897 -       int phs_coeff[AR9300_MAX_CHAINS][MAX_MEASUREMENT];
2898 +       int mag_coeff[AR9300_MAX_CHAINS][MAX_MEASUREMENT][MAXIQCAL];
2899 +       int phs_coeff[AR9300_MAX_CHAINS][MAX_MEASUREMENT][MAXIQCAL];
2900         int iqc_coeff[2];
2901  };
2902
2903 @@ -800,7 +801,7 @@ static bool ar9003_hw_calc_iq_corr(struc
2904         if (q_q_coff > 63)
2905                 q_q_coff = 63;
2906
2907 -       iqc_coeff[0] = (q_q_coff * 128) + q_i_coff;
2908 +       iqc_coeff[0] = (q_q_coff * 128) + (0x7f & q_i_coff);
2909
2910         ath_dbg(common, CALIBRATE, "tx chain %d: iq corr coeff=%x\n",
2911                 chain_idx, iqc_coeff[0]);
2912 @@ -831,7 +832,7 @@ static bool ar9003_hw_calc_iq_corr(struc
2913         if (q_q_coff > 63)
2914                 q_q_coff = 63;
2915
2916 -       iqc_coeff[1] = (q_q_coff * 128) + q_i_coff;
2917 +       iqc_coeff[1] = (q_q_coff * 128) + (0x7f & q_i_coff);
2918
2919         ath_dbg(common, CALIBRATE, "rx chain %d: iq corr coeff=%x\n",
2920                 chain_idx, iqc_coeff[1]);
2921 @@ -839,7 +840,8 @@ static bool ar9003_hw_calc_iq_corr(struc
2922         return true;
2923  }
2924
2925 -static void ar9003_hw_detect_outlier(int *mp_coeff, int nmeasurement,
2926 +static void ar9003_hw_detect_outlier(int mp_coeff[][MAXIQCAL],
2927 +                                    int nmeasurement,
2928                                      int max_delta)
2929  {
2930         int mp_max = -64, max_idx = 0;
2931 @@ -848,20 +850,20 @@ static void ar9003_hw_detect_outlier(int
2932
2933         /* find min/max mismatch across all calibrated gains */
2934         for (i = 0; i < nmeasurement; i++) {
2935 -               if (mp_coeff[i] > mp_max) {
2936 -                       mp_max = mp_coeff[i];
2937 +               if (mp_coeff[i][0] > mp_max) {
2938 +                       mp_max = mp_coeff[i][0];
2939                         max_idx = i;
2940 -               } else if (mp_coeff[i] < mp_min) {
2941 -                       mp_min = mp_coeff[i];
2942 +               } else if (mp_coeff[i][0] < mp_min) {
2943 +                       mp_min = mp_coeff[i][0];
2944                         min_idx = i;
2945                 }
2946         }
2947
2948         /* find average (exclude max abs value) */
2949         for (i = 0; i < nmeasurement; i++) {
2950 -               if ((abs(mp_coeff[i]) < abs(mp_max)) ||
2951 -                   (abs(mp_coeff[i]) < abs(mp_min))) {
2952 -                       mp_avg += mp_coeff[i];
2953 +               if ((abs(mp_coeff[i][0]) < abs(mp_max)) ||
2954 +                   (abs(mp_coeff[i][0]) < abs(mp_min))) {
2955 +                       mp_avg += mp_coeff[i][0];
2956                         mp_count++;
2957                 }
2958         }
2959 @@ -873,7 +875,7 @@ static void ar9003_hw_detect_outlier(int
2960         if (mp_count)
2961                 mp_avg /= mp_count;
2962         else
2963 -               mp_avg = mp_coeff[nmeasurement - 1];
2964 +               mp_avg = mp_coeff[nmeasurement - 1][0];
2965
2966         /* detect outlier */
2967         if (abs(mp_max - mp_min) > max_delta) {
2968 @@ -882,15 +884,16 @@ static void ar9003_hw_detect_outlier(int
2969                 else
2970                         outlier_idx = min_idx;
2971
2972 -               mp_coeff[outlier_idx] = mp_avg;
2973 +               mp_coeff[outlier_idx][0] = mp_avg;
2974         }
2975  }
2976
2977 -static void ar9003_hw_tx_iqcal_load_avg_2_passes(struct ath_hw *ah,
2978 -                                                struct coeff *coeff,
2979 -                                                bool is_reusable)
2980 +static void ar9003_hw_tx_iq_cal_outlier_detection(struct ath_hw *ah,
2981 +                                                 struct coeff *coeff,
2982 +                                                 bool is_reusable)
2983  {
2984         int i, im, nmeasurement;
2985 +       int magnitude, phase;
2986         u32 tx_corr_coeff[MAX_MEASUREMENT][AR9300_MAX_CHAINS];
2987         struct ath9k_hw_cal_data *caldata = ah->caldata;
2988
2989 @@ -920,21 +923,30 @@ static void ar9003_hw_tx_iqcal_load_avg_
2990                 if (nmeasurement > MAX_MEASUREMENT)
2991                         nmeasurement = MAX_MEASUREMENT;
2992
2993 -               /* detect outlier only if nmeasurement > 1 */
2994 -               if (nmeasurement > 1) {
2995 -                       /* Detect magnitude outlier */
2996 -                       ar9003_hw_detect_outlier(coeff->mag_coeff[i],
2997 -                                       nmeasurement, MAX_MAG_DELTA);
2998 -
2999 -                       /* Detect phase outlier */
3000 -                       ar9003_hw_detect_outlier(coeff->phs_coeff[i],
3001 -                                       nmeasurement, MAX_PHS_DELTA);
3002 +               /*
3003 +                * Skip normal outlier detection for AR9550.
3004 +                */
3005 +               if (!AR_SREV_9550(ah)) {
3006 +                       /* detect outlier only if nmeasurement > 1 */
3007 +                       if (nmeasurement > 1) {
3008 +                               /* Detect magnitude outlier */
3009 +                               ar9003_hw_detect_outlier(coeff->mag_coeff[i],
3010 +                                                        nmeasurement,
3011 +                                                        MAX_MAG_DELTA);
3012 +
3013 +                               /* Detect phase outlier */
3014 +                               ar9003_hw_detect_outlier(coeff->phs_coeff[i],
3015 +                                                        nmeasurement,
3016 +                                                        MAX_PHS_DELTA);
3017 +                       }
3018                 }
3019
3020                 for (im = 0; im < nmeasurement; im++) {
3021 +                       magnitude = coeff->mag_coeff[i][im][0];
3022 +                       phase = coeff->phs_coeff[i][im][0];
3023
3024 -                       coeff->iqc_coeff[0] = (coeff->mag_coeff[i][im] & 0x7f) |
3025 -                               ((coeff->phs_coeff[i][im] & 0x7f) << 7);
3026 +                       coeff->iqc_coeff[0] =
3027 +                               (phase & 0x7f) | ((magnitude & 0x7f) << 7);
3028
3029                         if ((im % 2) == 0)
3030                                 REG_RMW_FIELD(ah, tx_corr_coeff[im][i],
3031 @@ -991,7 +1003,63 @@ static bool ar9003_hw_tx_iq_cal_run(stru
3032         return true;
3033  }
3034
3035 -static void ar9003_hw_tx_iq_cal_post_proc(struct ath_hw *ah, bool is_reusable)
3036 +static void __ar955x_tx_iq_cal_sort(struct ath_hw *ah,
3037 +                                   struct coeff *coeff,
3038 +                                   int i, int nmeasurement)
3039 +{
3040 +       struct ath_common *common = ath9k_hw_common(ah);
3041 +       int im, ix, iy, temp;
3042 +
3043 +       for (im = 0; im < nmeasurement; im++) {
3044 +               for (ix = 0; ix < MAXIQCAL - 1; ix++) {
3045 +                       for (iy = ix + 1; iy <= MAXIQCAL - 1; iy++) {
3046 +                               if (coeff->mag_coeff[i][im][iy] <
3047 +                                   coeff->mag_coeff[i][im][ix]) {
3048 +                                       temp = coeff->mag_coeff[i][im][ix];
3049 +                                       coeff->mag_coeff[i][im][ix] =
3050 +                                               coeff->mag_coeff[i][im][iy];
3051 +                                       coeff->mag_coeff[i][im][iy] = temp;
3052 +                               }
3053 +                               if (coeff->phs_coeff[i][im][iy] <
3054 +                                   coeff->phs_coeff[i][im][ix]) {
3055 +                                       temp = coeff->phs_coeff[i][im][ix];
3056 +                                       coeff->phs_coeff[i][im][ix] =
3057 +                                               coeff->phs_coeff[i][im][iy];
3058 +                                       coeff->phs_coeff[i][im][iy] = temp;
3059 +                               }
3060 +                       }
3061 +               }
3062 +               coeff->mag_coeff[i][im][0] = coeff->mag_coeff[i][im][MAXIQCAL / 2];
3063 +               coeff->phs_coeff[i][im][0] = coeff->phs_coeff[i][im][MAXIQCAL / 2];
3064 +
3065 +               ath_dbg(common, CALIBRATE,
3066 +                       "IQCAL: Median [ch%d][gain%d]: mag = %d phase = %d\n",
3067 +                       i, im,
3068 +                       coeff->mag_coeff[i][im][0],
3069 +                       coeff->phs_coeff[i][im][0]);
3070 +       }
3071 +}
3072 +
3073 +static bool ar955x_tx_iq_cal_median(struct ath_hw *ah,
3074 +                                   struct coeff *coeff,
3075 +                                   int iqcal_idx,
3076 +                                   int nmeasurement)
3077 +{
3078 +       int i;
3079 +
3080 +       if ((iqcal_idx + 1) != MAXIQCAL)
3081 +               return false;
3082 +
3083 +       for (i = 0; i < AR9300_MAX_CHAINS; i++) {
3084 +               __ar955x_tx_iq_cal_sort(ah, coeff, i, nmeasurement);
3085 +       }
3086 +
3087 +       return true;
3088 +}
3089 +
3090 +static void ar9003_hw_tx_iq_cal_post_proc(struct ath_hw *ah,
3091 +                                         int iqcal_idx,
3092 +                                         bool is_reusable)
3093  {
3094         struct ath_common *common = ath9k_hw_common(ah);
3095         const u32 txiqcal_status[AR9300_MAX_CHAINS] = {
3096 @@ -1004,10 +1072,11 @@ static void ar9003_hw_tx_iq_cal_post_pro
3097                 AR_PHY_CHAN_INFO_TAB_1,
3098                 AR_PHY_CHAN_INFO_TAB_2,
3099         };
3100 -       struct coeff coeff;
3101 +       static struct coeff coeff;
3102         s32 iq_res[6];
3103         int i, im, j;
3104 -       int nmeasurement;
3105 +       int nmeasurement = 0;
3106 +       bool outlier_detect = true;
3107
3108         for (i = 0; i < AR9300_MAX_CHAINS; i++) {
3109                 if (!(ah->txchainmask & (1 << i)))
3110 @@ -1065,17 +1134,23 @@ static void ar9003_hw_tx_iq_cal_post_pro
3111                                 goto tx_iqcal_fail;
3112                         }
3113
3114 -                       coeff.mag_coeff[i][im] = coeff.iqc_coeff[0] & 0x7f;
3115 -                       coeff.phs_coeff[i][im] =
3116 +                       coeff.phs_coeff[i][im][iqcal_idx] =
3117 +                               coeff.iqc_coeff[0] & 0x7f;
3118 +                       coeff.mag_coeff[i][im][iqcal_idx] =
3119                                 (coeff.iqc_coeff[0] >> 7) & 0x7f;
3120
3121 -                       if (coeff.mag_coeff[i][im] > 63)
3122 -                               coeff.mag_coeff[i][im] -= 128;
3123 -                       if (coeff.phs_coeff[i][im] > 63)
3124 -                               coeff.phs_coeff[i][im] -= 128;
3125 +                       if (coeff.mag_coeff[i][im][iqcal_idx] > 63)
3126 +                               coeff.mag_coeff[i][im][iqcal_idx] -= 128;
3127 +                       if (coeff.phs_coeff[i][im][iqcal_idx] > 63)
3128 +                               coeff.phs_coeff[i][im][iqcal_idx] -= 128;
3129                 }
3130         }
3131 -       ar9003_hw_tx_iqcal_load_avg_2_passes(ah, &coeff, is_reusable);
3132 +
3133 +       if (AR_SREV_9550(ah))
3134 +               outlier_detect = ar955x_tx_iq_cal_median(ah, &coeff,
3135 +                                                        iqcal_idx, nmeasurement);
3136 +       if (outlier_detect)
3137 +               ar9003_hw_tx_iq_cal_outlier_detection(ah, &coeff, is_reusable);
3138
3139         return;
3140
3141 @@ -1409,7 +1484,7 @@ skip_tx_iqcal:
3142         }
3143
3144         if (txiqcal_done)
3145 -               ar9003_hw_tx_iq_cal_post_proc(ah, is_reusable);
3146 +               ar9003_hw_tx_iq_cal_post_proc(ah, 0, is_reusable);
3147         else if (caldata && test_bit(TXIQCAL_DONE, &caldata->cal_flags))
3148                 ar9003_hw_tx_iq_cal_reload(ah);
3149
3150 @@ -1455,14 +1530,38 @@ skip_tx_iqcal:
3151         return true;
3152  }
3153
3154 +static bool do_ar9003_agc_cal(struct ath_hw *ah)
3155 +{
3156 +       struct ath_common *common = ath9k_hw_common(ah);
3157 +       bool status;
3158 +
3159 +       REG_WRITE(ah, AR_PHY_AGC_CONTROL,
3160 +                 REG_READ(ah, AR_PHY_AGC_CONTROL) |
3161 +                 AR_PHY_AGC_CONTROL_CAL);
3162 +
3163 +       status = ath9k_hw_wait(ah, AR_PHY_AGC_CONTROL,
3164 +                              AR_PHY_AGC_CONTROL_CAL,
3165 +                              0, AH_WAIT_TIMEOUT);
3166 +       if (!status) {
3167 +               ath_dbg(common, CALIBRATE,
3168 +                       "offset calibration failed to complete in %d ms,"
3169 +                       "noisy environment?\n",
3170 +                       AH_WAIT_TIMEOUT / 1000);
3171 +               return false;
3172 +       }
3173 +
3174 +       return true;
3175 +}
3176 +
3177  static bool ar9003_hw_init_cal_soc(struct ath_hw *ah,
3178                                    struct ath9k_channel *chan)
3179  {
3180         struct ath_common *common = ath9k_hw_common(ah);
3181         struct ath9k_hw_cal_data *caldata = ah->caldata;
3182         bool txiqcal_done = false;
3183 -       bool is_reusable = true, status = true;
3184 +       bool status = true;
3185         bool run_agc_cal = false, sep_iq_cal = false;
3186 +       int i = 0;
3187
3188         /* Use chip chainmask only for calibration */
3189         ar9003_hw_set_chain_masks(ah, ah->caps.rx_chainmask, ah->caps.tx_chainmask);
3190 @@ -1485,7 +1584,12 @@ static bool ar9003_hw_init_cal_soc(struc
3191          * AGC calibration. Specifically, AR9550 in SoC chips.
3192          */
3193         if (ah->enabled_cals & TX_IQ_ON_AGC_CAL) {
3194 -               txiqcal_done = true;
3195 +               if (REG_READ_FIELD(ah, AR_PHY_TX_IQCAL_CONTROL_0,
3196 +                                  AR_PHY_TX_IQCAL_CONTROL_0_ENABLE_TXIQ_CAL)) {
3197 +                               txiqcal_done = true;
3198 +               } else {
3199 +                       txiqcal_done = false;
3200 +               }
3201                 run_agc_cal = true;
3202         } else {
3203                 sep_iq_cal = true;
3204 @@ -1512,27 +1616,37 @@ skip_tx_iqcal:
3205                 if (AR_SREV_9330_11(ah))
3206                         ar9003_hw_manual_peak_cal(ah, 0, IS_CHAN_2GHZ(chan));
3207
3208 -               /* Calibrate the AGC */
3209 -               REG_WRITE(ah, AR_PHY_AGC_CONTROL,
3210 -                         REG_READ(ah, AR_PHY_AGC_CONTROL) |
3211 -                         AR_PHY_AGC_CONTROL_CAL);
3212 -
3213 -               /* Poll for offset calibration complete */
3214 -               status = ath9k_hw_wait(ah, AR_PHY_AGC_CONTROL,
3215 -                                      AR_PHY_AGC_CONTROL_CAL,
3216 -                                      0, AH_WAIT_TIMEOUT);
3217 -       }
3218 +               /*
3219 +                * For non-AR9550 chips, we just trigger AGC calibration
3220 +                * in the HW, poll for completion and then process
3221 +                * the results.
3222 +                *
3223 +                * For AR955x, we run it multiple times and use
3224 +                * median IQ correction.
3225 +                */
3226 +               if (!AR_SREV_9550(ah)) {
3227 +                       status = do_ar9003_agc_cal(ah);
3228 +                       if (!status)
3229 +                               return false;
3230
3231 -       if (!status) {
3232 -               ath_dbg(common, CALIBRATE,
3233 -                       "offset calibration failed to complete in %d ms; noisy environment?\n",
3234 -                       AH_WAIT_TIMEOUT / 1000);
3235 -               return false;
3236 +                       if (txiqcal_done)
3237 +                               ar9003_hw_tx_iq_cal_post_proc(ah, 0, false);
3238 +               } else {
3239 +                       if (!txiqcal_done) {
3240 +                               status = do_ar9003_agc_cal(ah);
3241 +                               if (!status)
3242 +                                       return false;
3243 +                       } else {
3244 +                               for (i = 0; i < MAXIQCAL; i++) {
3245 +                                       status = do_ar9003_agc_cal(ah);
3246 +                                       if (!status)
3247 +                                               return false;
3248 +                                       ar9003_hw_tx_iq_cal_post_proc(ah, i, false);
3249 +                               }
3250 +                       }
3251 +               }
3252         }
3253
3254 -       if (txiqcal_done)
3255 -               ar9003_hw_tx_iq_cal_post_proc(ah, is_reusable);
3256 -
3257         /* Revert chainmask to runtime parameters */
3258         ar9003_hw_set_chain_masks(ah, ah->rxchainmask, ah->txchainmask);
3259
3260 --- a/drivers/net/wireless/rtl818x/rtl8187/rtl8187.h
3261 +++ b/drivers/net/wireless/rtl818x/rtl8187/rtl8187.h
3262 @@ -15,6 +15,8 @@
3263  #ifndef RTL8187_H
3264  #define RTL8187_H
3265
3266 +#include <linux/cache.h>
3267 +
3268  #include "rtl818x.h"
3269  #include "leds.h"
3270
3271 @@ -139,7 +141,10 @@ struct rtl8187_priv {
3272         u8 aifsn[4];
3273         u8 rfkill_mask;
3274         struct {
3275 -               __le64 buf;
3276 +               union {
3277 +                       __le64 buf;
3278 +                       u8 dummy1[L1_CACHE_BYTES];
3279 +               } ____cacheline_aligned;
3280                 struct sk_buff_head queue;
3281         } b_tx_status; /* This queue is used by both -b and non-b devices */
3282         struct mutex io_mutex;
3283 @@ -147,7 +152,8 @@ struct rtl8187_priv {
3284                 u8 bits8;
3285                 __le16 bits16;
3286                 __le32 bits32;
3287 -       } *io_dmabuf;
3288 +               u8 dummy2[L1_CACHE_BYTES];
3289 +       } *io_dmabuf ____cacheline_aligned;
3290         bool rfkill_off;
3291         u16 seqno;
3292  };
3293 --- a/net/mac80211/wme.c
3294 +++ b/net/mac80211/wme.c
3295 @@ -154,6 +154,11 @@ u16 ieee80211_select_queue(struct ieee80
3296                 return IEEE80211_AC_BE;
3297         }
3298
3299 +       if (skb->protocol == sdata->control_port_protocol) {
3300 +               skb->priority = 7;
3301 +               return ieee80211_downgrade_queue(sdata, skb);
3302 +       }
3303 +
3304         /* use the data classifier to determine what 802.1d tag the
3305          * data frame has */
3306         rcu_read_lock();
3307 --- a/drivers/net/wireless/ath/ath9k/xmit.c
3308 +++ b/drivers/net/wireless/ath/ath9k/xmit.c
3309 @@ -1444,14 +1444,16 @@ void ath_tx_aggr_sleep(struct ieee80211_
3310         for (tidno = 0, tid = &an->tid[tidno];
3311              tidno < IEEE80211_NUM_TIDS; tidno++, tid++) {
3312
3313 -               if (!tid->sched)
3314 -                       continue;
3315 -
3316                 ac = tid->ac;
3317                 txq = ac->txq;
3318
3319                 ath_txq_lock(sc, txq);
3320
3321 +               if (!tid->sched) {
3322 +                       ath_txq_unlock(sc, txq);
3323 +                       continue;
3324 +               }
3325 +
3326                 buffered = ath_tid_has_buffered(tid);
3327
3328                 tid->sched = false;
3329 @@ -1696,7 +1698,7 @@ int ath_cabq_update(struct ath_softc *sc
3330
3331         ath9k_hw_get_txq_props(sc->sc_ah, qnum, &qi);
3332
3333 -       qi.tqi_readyTime = (cur_conf->beacon_interval *
3334 +       qi.tqi_readyTime = (TU_TO_USEC(cur_conf->beacon_interval) *
3335                             ATH_CABQ_READY_TIME) / 100;
3336         ath_txq_update(sc, qnum, &qi);
3337
3338 @@ -2184,14 +2186,15 @@ int ath_tx_start(struct ieee80211_hw *hw
3339                 txq->stopped = true;
3340         }
3341
3342 +       if (txctl->an)
3343 +               tid = ath_get_skb_tid(sc, txctl->an, skb);
3344 +
3345         if (info->flags & IEEE80211_TX_CTL_PS_RESPONSE) {
3346                 ath_txq_unlock(sc, txq);
3347                 txq = sc->tx.uapsdq;
3348                 ath_txq_lock(sc, txq);
3349         } else if (txctl->an &&
3350                    ieee80211_is_data_present(hdr->frame_control)) {
3351 -               tid = ath_get_skb_tid(sc, txctl->an, skb);
3352 -
3353                 WARN_ON(tid->ac->txq != txctl->txq);
3354
3355                 if (info->flags & IEEE80211_TX_CTL_CLEAR_PS_FILT)
3356 --- a/drivers/net/wireless/ath/ath9k/init.c
3357 +++ b/drivers/net/wireless/ath/ath9k/init.c
3358 @@ -943,6 +943,7 @@ static void ath9k_set_hw_capab(struct at
3359         hw->wiphy->flags |= WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL;
3360         hw->wiphy->flags |= WIPHY_FLAG_SUPPORTS_5_10_MHZ;
3361         hw->wiphy->flags |= WIPHY_FLAG_HAS_CHANNEL_SWITCH;
3362 +       hw->wiphy->flags |= WIPHY_FLAG_AP_UAPSD;
3363
3364         hw->queues = 4;
3365         hw->max_rates = 4;
3366 --- a/net/mac80211/ieee80211_i.h
3367 +++ b/net/mac80211/ieee80211_i.h
3368 @@ -1700,14 +1700,8 @@ void ieee80211_stop_queue_by_reason(stru
3369  void ieee80211_propagate_queue_wake(struct ieee80211_local *local, int queue);
3370  void ieee80211_add_pending_skb(struct ieee80211_local *local,
3371                                struct sk_buff *skb);
3372 -void ieee80211_add_pending_skbs_fn(struct ieee80211_local *local,
3373 -                                  struct sk_buff_head *skbs,
3374 -                                  void (*fn)(void *data), void *data);
3375 -static inline void ieee80211_add_pending_skbs(struct ieee80211_local *local,
3376 -                                             struct sk_buff_head *skbs)
3377 -{
3378 -       ieee80211_add_pending_skbs_fn(local, skbs, NULL, NULL);
3379 -}
3380 +void ieee80211_add_pending_skbs(struct ieee80211_local *local,
3381 +                               struct sk_buff_head *skbs);
3382  void ieee80211_flush_queues(struct ieee80211_local *local,
3383                             struct ieee80211_sub_if_data *sdata);
3384
3385 --- a/net/mac80211/sta_info.c
3386 +++ b/net/mac80211/sta_info.c
3387 @@ -91,7 +91,7 @@ static int sta_info_hash_del(struct ieee
3388         return -ENOENT;
3389  }
3390
3391 -static void cleanup_single_sta(struct sta_info *sta)
3392 +static void __cleanup_single_sta(struct sta_info *sta)
3393  {
3394         int ac, i;
3395         struct tid_ampdu_tx *tid_tx;
3396 @@ -99,7 +99,8 @@ static void cleanup_single_sta(struct st
3397         struct ieee80211_local *local = sdata->local;
3398         struct ps_data *ps;
3399
3400 -       if (test_sta_flag(sta, WLAN_STA_PS_STA)) {
3401 +       if (test_sta_flag(sta, WLAN_STA_PS_STA) ||
3402 +           test_sta_flag(sta, WLAN_STA_PS_DRIVER)) {
3403                 if (sta->sdata->vif.type == NL80211_IFTYPE_AP ||
3404                     sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
3405                         ps = &sdata->bss->ps;
3406 @@ -109,6 +110,7 @@ static void cleanup_single_sta(struct st
3407                         return;
3408
3409                 clear_sta_flag(sta, WLAN_STA_PS_STA);
3410 +               clear_sta_flag(sta, WLAN_STA_PS_DRIVER);
3411
3412                 atomic_dec(&ps->num_sta_ps);
3413                 sta_info_recalc_tim(sta);
3414 @@ -139,7 +141,14 @@ static void cleanup_single_sta(struct st
3415                 ieee80211_purge_tx_queue(&local->hw, &tid_tx->pending);
3416                 kfree(tid_tx);
3417         }
3418 +}
3419
3420 +static void cleanup_single_sta(struct sta_info *sta)
3421 +{
3422 +       struct ieee80211_sub_if_data *sdata = sta->sdata;
3423 +       struct ieee80211_local *local = sdata->local;
3424 +
3425 +       __cleanup_single_sta(sta);
3426         sta_info_free(local, sta);
3427  }
3428
3429 @@ -330,6 +339,7 @@ struct sta_info *sta_info_alloc(struct i
3430         rcu_read_unlock();
3431
3432         spin_lock_init(&sta->lock);
3433 +       spin_lock_init(&sta->ps_lock);
3434         INIT_WORK(&sta->drv_unblock_wk, sta_unblock);
3435         INIT_WORK(&sta->ampdu_mlme.work, ieee80211_ba_session_work);
3436         mutex_init(&sta->ampdu_mlme.mtx);
3437 @@ -487,21 +497,26 @@ static int sta_info_insert_finish(struct
3438                 goto out_err;
3439         }
3440
3441 -       /* notify driver */
3442 -       err = sta_info_insert_drv_state(local, sdata, sta);
3443 -       if (err)
3444 -               goto out_err;
3445 -
3446         local->num_sta++;
3447         local->sta_generation++;
3448         smp_mb();
3449
3450 +       /* simplify things and don't accept BA sessions yet */
3451 +       set_sta_flag(sta, WLAN_STA_BLOCK_BA);
3452 +
3453         /* make the station visible */
3454         sta_info_hash_add(local, sta);
3455
3456         list_add_rcu(&sta->list, &local->sta_list);
3457
3458 +       /* notify driver */
3459 +       err = sta_info_insert_drv_state(local, sdata, sta);
3460 +       if (err)
3461 +               goto out_remove;
3462 +
3463         set_sta_flag(sta, WLAN_STA_INSERTED);
3464 +       /* accept BA sessions now */
3465 +       clear_sta_flag(sta, WLAN_STA_BLOCK_BA);
3466
3467         ieee80211_recalc_min_chandef(sdata);
3468         ieee80211_sta_debugfs_add(sta);
3469 @@ -522,6 +537,12 @@ static int sta_info_insert_finish(struct
3470                 mesh_accept_plinks_update(sdata);
3471
3472         return 0;
3473 + out_remove:
3474 +       sta_info_hash_del(local, sta);
3475 +       list_del_rcu(&sta->list);
3476 +       local->num_sta--;
3477 +       synchronize_net();
3478 +       __cleanup_single_sta(sta);
3479   out_err:
3480         mutex_unlock(&local->sta_mtx);
3481         rcu_read_lock();
3482 @@ -1071,10 +1092,14 @@ struct ieee80211_sta *ieee80211_find_sta
3483  }
3484  EXPORT_SYMBOL(ieee80211_find_sta);
3485
3486 -static void clear_sta_ps_flags(void *_sta)
3487 +/* powersave support code */
3488 +void ieee80211_sta_ps_deliver_wakeup(struct sta_info *sta)
3489  {
3490 -       struct sta_info *sta = _sta;
3491         struct ieee80211_sub_if_data *sdata = sta->sdata;
3492 +       struct ieee80211_local *local = sdata->local;
3493 +       struct sk_buff_head pending;
3494 +       int filtered = 0, buffered = 0, ac;
3495 +       unsigned long flags;
3496         struct ps_data *ps;
3497
3498         if (sdata->vif.type == NL80211_IFTYPE_AP ||
3499 @@ -1085,20 +1110,6 @@ static void clear_sta_ps_flags(void *_st
3500         else
3501                 return;
3502
3503 -       clear_sta_flag(sta, WLAN_STA_PS_DRIVER);
3504 -       if (test_and_clear_sta_flag(sta, WLAN_STA_PS_STA))
3505 -               atomic_dec(&ps->num_sta_ps);
3506 -}
3507 -
3508 -/* powersave support code */
3509 -void ieee80211_sta_ps_deliver_wakeup(struct sta_info *sta)
3510 -{
3511 -       struct ieee80211_sub_if_data *sdata = sta->sdata;
3512 -       struct ieee80211_local *local = sdata->local;
3513 -       struct sk_buff_head pending;
3514 -       int filtered = 0, buffered = 0, ac;
3515 -       unsigned long flags;
3516 -
3517         clear_sta_flag(sta, WLAN_STA_SP);
3518
3519         BUILD_BUG_ON(BITS_TO_LONGS(IEEE80211_NUM_TIDS) > 1);
3520 @@ -1109,6 +1120,8 @@ void ieee80211_sta_ps_deliver_wakeup(str
3521
3522         skb_queue_head_init(&pending);
3523
3524 +       /* sync with ieee80211_tx_h_unicast_ps_buf */
3525 +       spin_lock(&sta->ps_lock);
3526         /* Send all buffered frames to the station */
3527         for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
3528                 int count = skb_queue_len(&pending), tmp;
3529 @@ -1127,7 +1140,12 @@ void ieee80211_sta_ps_deliver_wakeup(str
3530                 buffered += tmp - count;
3531         }
3532
3533 -       ieee80211_add_pending_skbs_fn(local, &pending, clear_sta_ps_flags, sta);
3534 +       ieee80211_add_pending_skbs(local, &pending);
3535 +       clear_sta_flag(sta, WLAN_STA_PS_DRIVER);
3536 +       clear_sta_flag(sta, WLAN_STA_PS_STA);
3537 +       spin_unlock(&sta->ps_lock);
3538 +
3539 +       atomic_dec(&ps->num_sta_ps);
3540
3541         /* This station just woke up and isn't aware of our SMPS state */
3542         if (!ieee80211_smps_is_restrictive(sta->known_smps_mode,
3543 --- a/net/mac80211/sta_info.h
3544 +++ b/net/mac80211/sta_info.h
3545 @@ -267,6 +267,7 @@ struct ieee80211_tx_latency_stat {
3546   * @drv_unblock_wk: used for driver PS unblocking
3547   * @listen_interval: listen interval of this station, when we're acting as AP
3548   * @_flags: STA flags, see &enum ieee80211_sta_info_flags, do not use directly
3549 + * @ps_lock: used for powersave (when mac80211 is the AP) related locking
3550   * @ps_tx_buf: buffers (per AC) of frames to transmit to this station
3551   *     when it leaves power saving state or polls
3552   * @tx_filtered: buffers (per AC) of frames we already tried to
3553 @@ -356,10 +357,8 @@ struct sta_info {
3554         /* use the accessors defined below */
3555         unsigned long _flags;
3556
3557 -       /*
3558 -        * STA powersave frame queues, no more than the internal
3559 -        * locking required.
3560 -        */
3561 +       /* STA powersave lock and frame queues */
3562 +       spinlock_t ps_lock;
3563         struct sk_buff_head ps_tx_buf[IEEE80211_NUM_ACS];
3564         struct sk_buff_head tx_filtered[IEEE80211_NUM_ACS];
3565         unsigned long driver_buffered_tids;
3566 --- a/net/mac80211/util.c
3567 +++ b/net/mac80211/util.c
3568 @@ -435,9 +435,8 @@ void ieee80211_add_pending_skb(struct ie
3569         spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
3570  }
3571
3572 -void ieee80211_add_pending_skbs_fn(struct ieee80211_local *local,
3573 -                                  struct sk_buff_head *skbs,
3574 -                                  void (*fn)(void *data), void *data)
3575 +void ieee80211_add_pending_skbs(struct ieee80211_local *local,
3576 +                               struct sk_buff_head *skbs)
3577  {
3578         struct ieee80211_hw *hw = &local->hw;
3579         struct sk_buff *skb;
3580 @@ -461,9 +460,6 @@ void ieee80211_add_pending_skbs_fn(struc
3581                 __skb_queue_tail(&local->pending[queue], skb);
3582         }
3583
3584 -       if (fn)
3585 -               fn(data);
3586 -
3587         for (i = 0; i < hw->queues; i++)
3588                 __ieee80211_wake_queue(hw, i,
3589                         IEEE80211_QUEUE_STOP_REASON_SKB_ADD);
3590 --- a/net/wireless/reg.c
3591 +++ b/net/wireless/reg.c
3592 @@ -1700,7 +1700,7 @@ static void reg_process_hint(struct regu
3593                 return;
3594         case NL80211_REGDOM_SET_BY_USER:
3595                 treatment = reg_process_hint_user(reg_request);
3596 -               if (treatment == REG_REQ_OK ||
3597 +               if (treatment == REG_REQ_IGNORE ||
3598                     treatment == REG_REQ_ALREADY_SET)
3599                         return;
3600                 schedule_delayed_work(&reg_timeout, msecs_to_jiffies(3142));
3601 --- a/drivers/net/wireless/ath/ath9k/debug.c
3602 +++ b/drivers/net/wireless/ath/ath9k/debug.c
3603 @@ -138,43 +138,41 @@ static ssize_t read_file_ani(struct file
3604         unsigned int len = 0, size = 1024;
3605         ssize_t retval = 0;
3606         char *buf;
3607 +       int i;
3608 +       struct {
3609 +               const char *name;
3610 +               unsigned int val;
3611 +       } ani_info[] = {
3612 +               { "ANI RESET", ah->stats.ast_ani_reset },
3613 +               { "OFDM LEVEL", ah->ani.ofdmNoiseImmunityLevel },
3614 +               { "CCK LEVEL", ah->ani.cckNoiseImmunityLevel },
3615 +               { "SPUR UP", ah->stats.ast_ani_spurup },
3616 +               { "SPUR DOWN", ah->stats.ast_ani_spurup },
3617 +               { "OFDM WS-DET ON", ah->stats.ast_ani_ofdmon },
3618 +               { "OFDM WS-DET OFF", ah->stats.ast_ani_ofdmoff },
3619 +               { "MRC-CCK ON", ah->stats.ast_ani_ccklow },
3620 +               { "MRC-CCK OFF", ah->stats.ast_ani_cckhigh },
3621 +               { "FIR-STEP UP", ah->stats.ast_ani_stepup },
3622 +               { "FIR-STEP DOWN", ah->stats.ast_ani_stepdown },
3623 +               { "INV LISTENTIME", ah->stats.ast_ani_lneg_or_lzero },
3624 +               { "OFDM ERRORS", ah->stats.ast_ani_ofdmerrs },
3625 +               { "CCK ERRORS", ah->stats.ast_ani_cckerrs },
3626 +       };
3627
3628         buf = kzalloc(size, GFP_KERNEL);
3629         if (buf == NULL)
3630                 return -ENOMEM;
3631
3632 -       if (common->disable_ani) {
3633 -               len += scnprintf(buf + len, size - len, "%s: %s\n",
3634 -                                "ANI", "DISABLED");
3635 +       len += scnprintf(buf + len, size - len, "%15s: %s\n", "ANI",
3636 +                        common->disable_ani ? "DISABLED" : "ENABLED");
3637 +
3638 +       if (common->disable_ani)
3639                 goto exit;
3640 -       }
3641
3642 -       len += scnprintf(buf + len, size - len, "%15s: %s\n",
3643 -                        "ANI", "ENABLED");
3644 -       len += scnprintf(buf + len, size - len, "%15s: %u\n",
3645 -                        "ANI RESET", ah->stats.ast_ani_reset);
3646 -       len += scnprintf(buf + len, size - len, "%15s: %u\n",
3647 -                        "SPUR UP", ah->stats.ast_ani_spurup);
3648 -       len += scnprintf(buf + len, size - len, "%15s: %u\n",
3649 -                        "SPUR DOWN", ah->stats.ast_ani_spurup);
3650 -       len += scnprintf(buf + len, size - len, "%15s: %u\n",
3651 -                        "OFDM WS-DET ON", ah->stats.ast_ani_ofdmon);
3652 -       len += scnprintf(buf + len, size - len, "%15s: %u\n",
3653 -                        "OFDM WS-DET OFF", ah->stats.ast_ani_ofdmoff);
3654 -       len += scnprintf(buf + len, size - len, "%15s: %u\n",
3655 -                        "MRC-CCK ON", ah->stats.ast_ani_ccklow);
3656 -       len += scnprintf(buf + len, size - len, "%15s: %u\n",
3657 -                        "MRC-CCK OFF", ah->stats.ast_ani_cckhigh);
3658 -       len += scnprintf(buf + len, size - len, "%15s: %u\n",
3659 -                        "FIR-STEP UP", ah->stats.ast_ani_stepup);
3660 -       len += scnprintf(buf + len, size - len, "%15s: %u\n",
3661 -                        "FIR-STEP DOWN", ah->stats.ast_ani_stepdown);
3662 -       len += scnprintf(buf + len, size - len, "%15s: %u\n",
3663 -                        "INV LISTENTIME", ah->stats.ast_ani_lneg_or_lzero);
3664 -       len += scnprintf(buf + len, size - len, "%15s: %u\n",
3665 -                        "OFDM ERRORS", ah->stats.ast_ani_ofdmerrs);
3666 -       len += scnprintf(buf + len, size - len, "%15s: %u\n",
3667 -                        "CCK ERRORS", ah->stats.ast_ani_cckerrs);
3668 +       for (i = 0; i < ARRAY_SIZE(ani_info); i++)
3669 +               len += scnprintf(buf + len, size - len, "%15s: %u\n",
3670 +                                ani_info[i].name, ani_info[i].val);
3671 +
3672  exit:
3673         if (len > size)
3674                 len = size;
3675 @@ -866,6 +864,12 @@ static ssize_t read_file_reset(struct fi
3676                          "%17s: %2d\n", "PLL RX Hang",
3677                          sc->debug.stats.reset[RESET_TYPE_PLL_HANG]);
3678         len += scnprintf(buf + len, sizeof(buf) - len,
3679 +                        "%17s: %2d\n", "MAC Hang",
3680 +                        sc->debug.stats.reset[RESET_TYPE_MAC_HANG]);
3681 +       len += scnprintf(buf + len, sizeof(buf) - len,
3682 +                        "%17s: %2d\n", "Stuck Beacon",
3683 +                        sc->debug.stats.reset[RESET_TYPE_BEACON_STUCK]);
3684 +       len += scnprintf(buf + len, sizeof(buf) - len,
3685                          "%17s: %2d\n", "MCI Reset",
3686                          sc->debug.stats.reset[RESET_TYPE_MCI]);
3687
3688 --- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
3689 +++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
3690 @@ -868,10 +868,6 @@ static void ar9003_hw_set_rfmode(struct
3691
3692         if (IS_CHAN_A_FAST_CLOCK(ah, chan))
3693                 rfMode |= (AR_PHY_MODE_DYNAMIC | AR_PHY_MODE_DYN_CCK_DISABLE);
3694 -       if (IS_CHAN_QUARTER_RATE(chan))
3695 -               rfMode |= AR_PHY_MODE_QUARTER;
3696 -       if (IS_CHAN_HALF_RATE(chan))
3697 -               rfMode |= AR_PHY_MODE_HALF;
3698
3699         if (rfMode & (AR_PHY_MODE_QUARTER | AR_PHY_MODE_HALF))
3700                 REG_RMW_FIELD(ah, AR_PHY_FRAME_CTL,
3701 --- a/drivers/net/wireless/ath/ath5k/mac80211-ops.c
3702 +++ b/drivers/net/wireless/ath/ath5k/mac80211-ops.c
3703 @@ -706,6 +706,7 @@ ath5k_get_survey(struct ieee80211_hw *hw
3704         survey->channel = conf->chandef.chan;
3705         survey->noise = ah->ah_noise_floor;
3706         survey->filled = SURVEY_INFO_NOISE_DBM |
3707 +                       SURVEY_INFO_IN_USE |
3708                         SURVEY_INFO_CHANNEL_TIME |
3709                         SURVEY_INFO_CHANNEL_TIME_BUSY |
3710                         SURVEY_INFO_CHANNEL_TIME_RX |
3711 --- a/drivers/net/wireless/ath/ath9k/recv.c
3712 +++ b/drivers/net/wireless/ath/ath9k/recv.c
3713 @@ -732,11 +732,18 @@ static struct ath_rxbuf *ath_get_next_rx
3714                         return NULL;
3715
3716                 /*
3717 -                * mark descriptor as zero-length and set the 'more'
3718 -                * flag to ensure that both buffers get discarded
3719 +                * Re-check previous descriptor, in case it has been filled
3720 +                * in the mean time.
3721                  */
3722 -               rs->rs_datalen = 0;
3723 -               rs->rs_more = true;
3724 +               ret = ath9k_hw_rxprocdesc(ah, ds, rs);
3725 +               if (ret == -EINPROGRESS) {
3726 +                       /*
3727 +                        * mark descriptor as zero-length and set the 'more'
3728 +                        * flag to ensure that both buffers get discarded
3729 +                        */
3730 +                       rs->rs_datalen = 0;
3731 +                       rs->rs_more = true;
3732 +               }
3733         }
3734
3735         list_del(&bf->list);
3736 @@ -985,32 +992,32 @@ static int ath9k_rx_skb_preprocess(struc
3737         struct ath_common *common = ath9k_hw_common(ah);
3738         struct ieee80211_hdr *hdr;
3739         bool discard_current = sc->rx.discard_next;
3740 -       int ret = 0;
3741
3742         /*
3743          * Discard corrupt descriptors which are marked in
3744          * ath_get_next_rx_buf().
3745          */
3746 -       sc->rx.discard_next = rx_stats->rs_more;
3747         if (discard_current)
3748 -               return -EINVAL;
3749 +               goto corrupt;
3750 +
3751 +       sc->rx.discard_next = false;
3752
3753         /*
3754          * Discard zero-length packets.
3755          */
3756         if (!rx_stats->rs_datalen) {
3757                 RX_STAT_INC(rx_len_err);
3758 -               return -EINVAL;
3759 +               goto corrupt;
3760         }
3761
3762 -        /*
3763 -         * rs_status follows rs_datalen so if rs_datalen is too large
3764 -         * we can take a hint that hardware corrupted it, so ignore
3765 -         * those frames.
3766 -         */
3767 +       /*
3768 +        * rs_status follows rs_datalen so if rs_datalen is too large
3769 +        * we can take a hint that hardware corrupted it, so ignore
3770 +        * those frames.
3771 +        */
3772         if (rx_stats->rs_datalen > (common->rx_bufsize - ah->caps.rx_status_len)) {
3773                 RX_STAT_INC(rx_len_err);
3774 -               return -EINVAL;
3775 +               goto corrupt;
3776         }
3777
3778         /* Only use status info from the last fragment */
3779 @@ -1024,10 +1031,8 @@ static int ath9k_rx_skb_preprocess(struc
3780          * This is different from the other corrupt descriptor
3781          * condition handled above.
3782          */
3783 -       if (rx_stats->rs_status & ATH9K_RXERR_CORRUPT_DESC) {
3784 -               ret = -EINVAL;
3785 -               goto exit;
3786 -       }
3787 +       if (rx_stats->rs_status & ATH9K_RXERR_CORRUPT_DESC)
3788 +               goto corrupt;
3789
3790         hdr = (struct ieee80211_hdr *) (skb->data + ah->caps.rx_status_len);
3791
3792 @@ -1043,18 +1048,15 @@ static int ath9k_rx_skb_preprocess(struc
3793                 if (ath_process_fft(sc, hdr, rx_stats, rx_status->mactime))
3794                         RX_STAT_INC(rx_spectral);
3795
3796 -               ret = -EINVAL;
3797 -               goto exit;
3798 +               return -EINVAL;
3799         }
3800
3801         /*
3802          * everything but the rate is checked here, the rate check is done
3803          * separately to avoid doing two lookups for a rate for each frame.
3804          */
3805 -       if (!ath9k_rx_accept(common, hdr, rx_status, rx_stats, decrypt_error)) {
3806 -               ret = -EINVAL;
3807 -               goto exit;
3808 -       }
3809 +       if (!ath9k_rx_accept(common, hdr, rx_status, rx_stats, decrypt_error))
3810 +               return -EINVAL;
3811
3812         if (ath_is_mybeacon(common, hdr)) {
3813                 RX_STAT_INC(rx_beacons);
3814 @@ -1064,15 +1066,11 @@ static int ath9k_rx_skb_preprocess(struc
3815         /*
3816          * This shouldn't happen, but have a safety check anyway.
3817          */
3818 -       if (WARN_ON(!ah->curchan)) {
3819 -               ret = -EINVAL;
3820 -               goto exit;
3821 -       }
3822 +       if (WARN_ON(!ah->curchan))
3823 +               return -EINVAL;
3824
3825 -       if (ath9k_process_rate(common, hw, rx_stats, rx_status)) {
3826 -               ret =-EINVAL;
3827 -               goto exit;
3828 -       }
3829 +       if (ath9k_process_rate(common, hw, rx_stats, rx_status))
3830 +               return -EINVAL;
3831
3832         ath9k_process_rssi(common, hw, rx_stats, rx_status);
3833
3834 @@ -1087,9 +1085,11 @@ static int ath9k_rx_skb_preprocess(struc
3835                 sc->rx.num_pkts++;
3836  #endif
3837
3838 -exit:
3839 -       sc->rx.discard_next = false;
3840 -       return ret;
3841 +       return 0;
3842 +
3843 +corrupt:
3844 +       sc->rx.discard_next = rx_stats->rs_more;
3845 +       return -EINVAL;
3846  }
3847
3848  static void ath9k_rx_skb_postprocess(struct ath_common *common,
3849 --- a/drivers/net/wireless/ath/ath9k/ani.c
3850 +++ b/drivers/net/wireless/ath/ath9k/ani.c
3851 @@ -176,16 +176,26 @@ static void ath9k_hw_set_ofdm_nil(struct
3852         if (ah->opmode == NL80211_IFTYPE_STATION &&
3853             BEACON_RSSI(ah) <= ATH9K_ANI_RSSI_THR_HIGH)
3854                 weak_sig = true;
3855 -
3856         /*
3857 -        * OFDM Weak signal detection is always enabled for AP mode.
3858 +        * Newer chipsets are better at dealing with high PHY error counts -
3859 +        * keep weak signal detection enabled when no RSSI threshold is
3860 +        * available to determine if it is needed (mode != STA)
3861          */
3862 -       if (ah->opmode != NL80211_IFTYPE_AP &&
3863 -           aniState->ofdmWeakSigDetect != weak_sig) {
3864 -               ath9k_hw_ani_control(ah,
3865 -                                    ATH9K_ANI_OFDM_WEAK_SIGNAL_DETECTION,
3866 -                                    entry_ofdm->ofdm_weak_signal_on);
3867 -       }
3868 +       else if (AR_SREV_9300_20_OR_LATER(ah) &&
3869 +                ah->opmode != NL80211_IFTYPE_STATION)
3870 +               weak_sig = true;
3871 +
3872 +       /* Older chipsets are more sensitive to high PHY error counts */
3873 +       else if (!AR_SREV_9300_20_OR_LATER(ah) &&
3874 +                aniState->ofdmNoiseImmunityLevel >= 8)
3875 +               weak_sig = false;
3876 +
3877 +       if (aniState->ofdmWeakSigDetect != weak_sig)
3878 +               ath9k_hw_ani_control(ah, ATH9K_ANI_OFDM_WEAK_SIGNAL_DETECTION,
3879 +                                    weak_sig);
3880 +
3881 +       if (!AR_SREV_9300_20_OR_LATER(ah))
3882 +               return;
3883
3884         if (aniState->ofdmNoiseImmunityLevel >= ATH9K_ANI_OFDM_DEF_LEVEL) {
3885                 ah->config.ofdm_trig_high = ATH9K_ANI_OFDM_TRIG_HIGH;
3886 @@ -308,17 +318,6 @@ void ath9k_ani_reset(struct ath_hw *ah,
3887         BUG_ON(aniState == NULL);
3888         ah->stats.ast_ani_reset++;
3889
3890 -       /* only allow a subset of functions in AP mode */
3891 -       if (ah->opmode == NL80211_IFTYPE_AP) {
3892 -               if (IS_CHAN_2GHZ(chan)) {
3893 -                       ah->ani_function = (ATH9K_ANI_SPUR_IMMUNITY_LEVEL |
3894 -                                           ATH9K_ANI_FIRSTEP_LEVEL);
3895 -                       if (AR_SREV_9300_20_OR_LATER(ah))
3896 -                               ah->ani_function |= ATH9K_ANI_MRC_CCK;
3897 -               } else
3898 -                       ah->ani_function = 0;
3899 -       }
3900 -
3901         ofdm_nil = max_t(int, ATH9K_ANI_OFDM_DEF_LEVEL,
3902                          aniState->ofdmNoiseImmunityLevel);
3903         cck_nil = max_t(int, ATH9K_ANI_CCK_DEF_LEVEL,
3904 @@ -483,10 +482,17 @@ void ath9k_hw_ani_init(struct ath_hw *ah
3905
3906         ath_dbg(common, ANI, "Initialize ANI\n");
3907
3908 -       ah->config.ofdm_trig_high = ATH9K_ANI_OFDM_TRIG_HIGH;
3909 -       ah->config.ofdm_trig_low = ATH9K_ANI_OFDM_TRIG_LOW;
3910 -       ah->config.cck_trig_high = ATH9K_ANI_CCK_TRIG_HIGH;
3911 -       ah->config.cck_trig_low = ATH9K_ANI_CCK_TRIG_LOW;
3912 +       if (AR_SREV_9300_20_OR_LATER(ah)) {
3913 +               ah->config.ofdm_trig_high = ATH9K_ANI_OFDM_TRIG_HIGH;
3914 +               ah->config.ofdm_trig_low = ATH9K_ANI_OFDM_TRIG_LOW;
3915 +               ah->config.cck_trig_high = ATH9K_ANI_CCK_TRIG_HIGH;
3916 +               ah->config.cck_trig_low = ATH9K_ANI_CCK_TRIG_LOW;
3917 +       } else {
3918 +               ah->config.ofdm_trig_high = ATH9K_ANI_OFDM_TRIG_HIGH_OLD;
3919 +               ah->config.ofdm_trig_low = ATH9K_ANI_OFDM_TRIG_LOW_OLD;
3920 +               ah->config.cck_trig_high = ATH9K_ANI_CCK_TRIG_HIGH_OLD;
3921 +               ah->config.cck_trig_low = ATH9K_ANI_CCK_TRIG_LOW_OLD;
3922 +       }
3923
3924         ani->spurImmunityLevel = ATH9K_ANI_SPUR_IMMUNE_LVL;
3925         ani->firstepLevel = ATH9K_ANI_FIRSTEP_LVL;
3926 --- a/drivers/net/wireless/ath/ath9k/ani.h
3927 +++ b/drivers/net/wireless/ath/ath9k/ani.h
3928 @@ -22,12 +22,16 @@
3929  /* units are errors per second */
3930  #define ATH9K_ANI_OFDM_TRIG_HIGH           3500
3931  #define ATH9K_ANI_OFDM_TRIG_HIGH_BELOW_INI 1000
3932 +#define ATH9K_ANI_OFDM_TRIG_HIGH_OLD       500
3933
3934  #define ATH9K_ANI_OFDM_TRIG_LOW           400
3935  #define ATH9K_ANI_OFDM_TRIG_LOW_ABOVE_INI 900
3936 +#define ATH9K_ANI_OFDM_TRIG_LOW_OLD       200
3937
3938  #define ATH9K_ANI_CCK_TRIG_HIGH           600
3939 +#define ATH9K_ANI_CCK_TRIG_HIGH_OLD       200
3940  #define ATH9K_ANI_CCK_TRIG_LOW            300
3941 +#define ATH9K_ANI_CCK_TRIG_LOW_OLD        100
3942
3943  #define ATH9K_ANI_SPUR_IMMUNE_LVL         3
3944  #define ATH9K_ANI_FIRSTEP_LVL             2