mac80211: add a few upstream ath9k / mac80211 fixes
[openwrt/svn-archive/archive.git] / package / kernel / mac80211 / patches / 300-pending_work.patch
index b5a9c1a65f8e72e45efee392d8de471cf4178034..63229520982831f801125f4877197c6ef7bc5618 100644 (file)
---- a/net/mac80211/agg-rx.c
-+++ b/net/mac80211/agg-rx.c
-@@ -204,6 +204,8 @@ static void ieee80211_send_addba_resp(st
-               memcpy(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN);
-       else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
-               memcpy(mgmt->bssid, sdata->u.ibss.bssid, ETH_ALEN);
-+      else if (sdata->vif.type == NL80211_IFTYPE_WDS)
-+              memcpy(mgmt->bssid, da, ETH_ALEN);
-       mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
-                                         IEEE80211_STYPE_ACTION);
---- a/net/mac80211/agg-tx.c
-+++ b/net/mac80211/agg-tx.c
-@@ -81,7 +81,8 @@ static void ieee80211_send_addba_request
-       memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
-       if (sdata->vif.type == NL80211_IFTYPE_AP ||
-           sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
--          sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
-+          sdata->vif.type == NL80211_IFTYPE_MESH_POINT ||
-+          sdata->vif.type == NL80211_IFTYPE_WDS)
-               memcpy(mgmt->bssid, sdata->vif.addr, ETH_ALEN);
-       else if (sdata->vif.type == NL80211_IFTYPE_STATION)
-               memcpy(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN);
-@@ -527,6 +528,7 @@ int ieee80211_start_tx_ba_session(struct
-           sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
-           sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
-           sdata->vif.type != NL80211_IFTYPE_AP &&
-+          sdata->vif.type != NL80211_IFTYPE_WDS &&
-           sdata->vif.type != NL80211_IFTYPE_ADHOC)
-               return -EINVAL;
---- a/net/mac80211/debugfs_sta.c
-+++ b/net/mac80211/debugfs_sta.c
-@@ -66,11 +66,11 @@ static ssize_t sta_flags_read(struct fil
-       test_sta_flag(sta, WLAN_STA_##flg) ? #flg "\n" : ""
-       int res = scnprintf(buf, sizeof(buf),
--                          "%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s",
-+                          "%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s",
-                           TEST(AUTH), TEST(ASSOC), TEST(PS_STA),
-                           TEST(PS_DRIVER), TEST(AUTHORIZED),
-                           TEST(SHORT_PREAMBLE),
--                          TEST(WME), TEST(WDS), TEST(CLEAR_PS_FILT),
-+                          TEST(WME), TEST(CLEAR_PS_FILT),
-                           TEST(MFP), TEST(BLOCK_BA), TEST(PSPOLL),
-                           TEST(UAPSD), TEST(SP), TEST(TDLS_PEER),
-                           TEST(TDLS_PEER_AUTH), TEST(4ADDR_EVENT),
---- a/net/mac80211/iface.c
-+++ b/net/mac80211/iface.c
-@@ -463,7 +463,6 @@ int ieee80211_do_open(struct wireless_de
-       struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);
-       struct net_device *dev = wdev->netdev;
-       struct ieee80211_local *local = sdata->local;
--      struct sta_info *sta;
-       u32 changed = 0;
-       int res;
-       u32 hw_reconf_flags = 0;
-@@ -629,30 +628,8 @@ int ieee80211_do_open(struct wireless_de
-       set_bit(SDATA_STATE_RUNNING, &sdata->state);
--      if (sdata->vif.type == NL80211_IFTYPE_WDS) {
--              /* Create STA entry for the WDS peer */
--              sta = sta_info_alloc(sdata, sdata->u.wds.remote_addr,
--                                   GFP_KERNEL);
--              if (!sta) {
--                      res = -ENOMEM;
--                      goto err_del_interface;
--              }
--
--              sta_info_pre_move_state(sta, IEEE80211_STA_AUTH);
--              sta_info_pre_move_state(sta, IEEE80211_STA_ASSOC);
--              sta_info_pre_move_state(sta, IEEE80211_STA_AUTHORIZED);
--
--              res = sta_info_insert(sta);
--              if (res) {
--                      /* STA has been freed */
--                      goto err_del_interface;
--              }
--
--              rate_control_rate_init(sta);
--              netif_carrier_on(dev);
--      } else if (sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE) {
-+      if (sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE)
-               rcu_assign_pointer(local->p2p_sdata, sdata);
--      }
+commit 6fb7eefaa4d8377e6b124435059656dd6f643e91
+Author: Karl Beldan <karl.beldan@rivierawaves.com>
+Date:   Tue Oct 7 15:53:38 2014 +0200
+
+    mac80211/trivial: fix typo in starting baserate for rts_cts_rate_idx
+    
+    Fixes: 5253ffb8 ("mac80211: always pick a basic rate to tx RTS/CTS for pre-HT rates")
+    Signed-off-by: Karl Beldan <karl.beldan@rivierawaves.com>
+
+commit b18111d911980af52bead74ee45250cc96ad5108
+Author: Sujith Manoharan <c_manoha@qca.qualcomm.com>
+Date:   Tue Oct 7 10:14:37 2014 +0530
+
+    ath9k: Fix crash in MCC mode
+    
+    When a channel context is removed, the hw_queue_base
+    is set to -1, this will result in a panic because
+    ath9k_chanctx_stop_queues() can be called on an interface
+    that is not assigned to any context yet - for example,
+    when trying to scan.
+    
+    Fix this issue by setting the hw_queue_base to zero
+    when a channel context is removed.
+    
+    Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
+    Signed-off-by: John W. Linville <linville@tuxdriver.com>
+
+commit e2cba8d7590e76661e86f1f0987ef9f8c13c9a6d
+Author: Sujith Manoharan <c_manoha@qca.qualcomm.com>
+Date:   Thu Oct 2 06:33:20 2014 +0530
+
+    ath9k: Fix flushing in MCC mode
+    
+    When we are attempting to switch to a new
+    channel context, the TX queues are flushed, but
+    the mac80211 queues are not stopped and traffic
+    can still come down to the driver.
+    
+    This patch fixes it by stopping the queues
+    assigned to the current context/vif before
+    trying to flush.
+    
+    Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
+    Signed-off-by: John W. Linville <linville@tuxdriver.com>
+
+commit 5ba8d9d2f018f2c4e23f9e68b90ca5b9d5470457
+Author: Sujith Manoharan <c_manoha@qca.qualcomm.com>
+Date:   Thu Oct 2 06:33:19 2014 +0530
+
+    ath9k: Fix queue handling for channel contexts
+    
+    When a full chip reset is done, all the queues
+    across all VIFs are stopped, but if MCC is enabled,
+    only the queues of the current context is awakened,
+    when we complete the reset.
+    
+    This results in unfairness for the inactive context.
+    Since frames are queued internally in the driver if
+    there is a context mismatch, we can awaken all the
+    queues when coming out of a reset.
+    
+    The VIF-specific queues are still used in flow control,
+    to ensure fairness when traffic is high.
+    
+    Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
+    Signed-off-by: John W. Linville <linville@tuxdriver.com>
+
+commit a064eaa10ca4ec58d5a405c9a7f87efc6d2fa423
+Author: Sujith Manoharan <c_manoha@qca.qualcomm.com>
+Date:   Thu Oct 2 06:33:18 2014 +0530
+
+    ath9k: Add ath9k_chanctx_stop_queues()
+    
+    This can be used when the queues of a context
+    needs to be stopped.
+    
+    Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
+    Signed-off-by: John W. Linville <linville@tuxdriver.com>
+
+commit b39031536aab9cb1324328cf46fa4ef940bd975f
+Author: Sujith Manoharan <c_manoha@qca.qualcomm.com>
+Date:   Thu Oct 2 06:33:17 2014 +0530
+
+    ath9k: Pass context to ath9k_chanctx_wake_queues()
+    
+    Change the ath9k_chanctx_wake_queues() API so
+    that we can pass the channel context that needs its
+    queues to be stopped.
+    
+    Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
+    Signed-off-by: John W. Linville <linville@tuxdriver.com>
+
+commit 4f82eecf73019c27537f65c160e90385e159afd8
+Author: Sujith Manoharan <c_manoha@qca.qualcomm.com>
+Date:   Thu Oct 2 06:33:16 2014 +0530
+
+    ath9k: Fix queue handling in flush()
+    
+    When draining of the TX queues fails, a
+    full HW reset is done. ath_reset() makes sure
+    that the queues in mac80211 are restarted,
+    so there is no need to wake them up again.
+    
+    Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
+    Signed-off-by: John W. Linville <linville@tuxdriver.com>
+
+commit 60913f4d2951f6410eed969aae4717c7ced37044
+Author: Sujith Manoharan <c_manoha@qca.qualcomm.com>
+Date:   Thu Oct 2 06:33:15 2014 +0530
+
+    ath9k: Remove duplicate code
+    
+    ath9k_has_tx_pending() can be used to
+    check if there are pending frames instead
+    of having duplicate code.
+    
+    Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
+    Signed-off-by: John W. Linville <linville@tuxdriver.com>
+
+commit fc1314c75e0558c03cb434e2af2c257caa201e76
+Author: Sujith Manoharan <c_manoha@qca.qualcomm.com>
+Date:   Thu Oct 2 06:33:14 2014 +0530
+
+    ath9k: Fix pending frame check
+    
+    Checking for the queue depth outside of
+    the TX queue lock is incorrect and in this
+    case, is not required since it is done inside
+    ath9k_has_pending_frames().
+    
+    Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
+    Signed-off-by: John W. Linville <linville@tuxdriver.com>
+
+commit b736728575af03488388e84fceac7bf0eac5dbb6
+Author: Sujith Manoharan <c_manoha@qca.qualcomm.com>
+Date:   Thu Oct 2 06:33:13 2014 +0530
+
+    ath9k: Check pending frames properly
+    
+    There is no need to check if the current
+    channel context has active ACs queued up
+    if the TX queue is not empty.
+    
+    Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
+    Signed-off-by: John W. Linville <linville@tuxdriver.com>
+
+commit 4b60af4ab4363bd79eeba94bb6bed396cf2aaf62
+Author: Sujith Manoharan <c_manoha@qca.qualcomm.com>
+Date:   Thu Oct 2 06:33:12 2014 +0530
+
+    ath9k: Print RoC expiration
+    
+    Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
+    Signed-off-by: John W. Linville <linville@tuxdriver.com>
+
+commit 4d9f634b02e4240f86719f30e4c9e62f6a4c4d36
+Author: Sujith Manoharan <c_manoha@qca.qualcomm.com>
+Date:   Tue Sep 30 14:15:23 2014 +0530
+
+    ath9k: Check early for HW reset
+    
+    chan_lock is not required for checking if
+    we are in the middle of a HW reset, so do it
+    early. This also removes the small window
+    where the lock is dropped and reacquired.
+    
+    Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
+    Signed-off-by: John W. Linville <linville@tuxdriver.com>
+
+commit c393d179924685d5c8c72446c5b6401f25fdb2a0
+Author: Marek Puzyniak <marek.puzyniak@tieto.com>
+Date:   Tue Oct 7 17:04:30 2014 +0200
+
+    ath9k_htc: avoid kernel panic in ath9k_hw_reset
+    
+    hw pointer of ath_hw is not assigned to proper value
+    in function ath9k_hw_reset what finally causes kernel panic.
+    This can be solved by proper initialization of ath_hw in
+    ath9k_init_priv.
+    
+    Signed-off-by: Marek Puzyniak <marek.puzyniak@tieto.com>
+    Acked-by: Oleksij Rempel <linux@rempel-privat.de>
+    Signed-off-by: John W. Linville <linville@tuxdriver.com>
+
+commit 065e0b64f71632f5ad7f00c102fde09c534cfbf0
+Author: Felix Fietkau <nbd@openwrt.org>
+Date:   Tue Sep 30 11:00:33 2014 +0200
+
+    ath9k: fix getting tx duration for dynack
+    
+    On AR9003, tx control and tx status are in separate descriptor rings.
+    Tx duration is extracted from the tx control descriptor data, which
+    ar9003_hw_proc_txdesc cannot access.
+    
+    Fix getting the duration by adding a separate callback for it.
+    
+    Acked-by: Lorenzo Bianconi <lorenzo.bianconi83@gmail.com>
+    Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+
+commit fdf9a4517b60d847b9bc0a30249efd96559fa450
+Author: Felix Fietkau <nbd@openwrt.org>
+Date:   Tue Sep 9 09:48:30 2014 +0200
+
+    ath9k_hw: fix PLL clock initialization for newer SoC
+    
+    On AR934x and newer SoC devices, the layout of the AR_RTC_PLL_CONTROL
+    register changed. This currently breaks at least 5/10 MHz operation.
+    AR933x uses the old layout.
+    
+    It might also have been causing other stability issues because of the
+    different location of the PLL_BYPASS bit which needs to be set during
+    PLL clock initialization.
+    
+    This patch also removes more instances of hardcoded register values in
+    favor of properly computed ones with the PLL_BYPASS bit added.
+    
+    Reported-by: Lorenzo Bianconi <lorenzo.bianconi83@gmail.com>
+    Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+
+commit b6d1f51cd8bdc9d952147a960fbf1f261d8e4188
+Author: Felix Fietkau <nbd@openwrt.org>
+Date:   Mon Sep 8 18:35:08 2014 +0200
+
+    ath9k_hw: reduce ANI spur immunity setting on HT40 extension channel
+    
+    The cycpwr_thr1 value needs to be lower on the extension channel than on
+    the control channel, similar to how the register settings are programmed
+    in the initvals.
+    
+    Also drop the unnecessary check for HT40 - this register can always be
+    written. This patch has been reported to improve HT40 stability and
+    throughput in some environments.
+    
+    Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+
+commit 5ad2dfbaa19aa45d29184d30c8c5dae0e110074a
+Author: Felix Fietkau <nbd@openwrt.org>
+Date:   Mon Sep 8 18:31:26 2014 +0200
+
+    Revert "ath9k_hw: reduce ANI firstep range for older chips"
+    
+    This reverts commit 09efc56345be4146ab9fc87a55c837ed5d6ea1ab
+    
+    I've received reports that this change is decreasing throughput in some
+    rare conditions on an AR9280 based device
+    
+    Cc: stable@vger.kernel.org
+    Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+
+commit 4c82fc569cf2f29e6c66d98ef4a1b0f3b6a98e9d
+Author: Felix Fietkau <nbd@openwrt.org>
+Date:   Sat Sep 27 22:39:27 2014 +0200
+
+    ath9k_hw: disable hardware ad-hoc flag on ar934x rev 3
+    
+    On AR934x rev 3, settin the ad-hoc flag completely messes up hardware
+    state - beacons get stuck, almost no packets make it out, hardware is
+    constantly reset.
+    
+    When leaving out that flag and setting up the hw like in AP mode, TSF
+    timers won't be automatically synced, but at least the rest works.
+    
+    AR934x rev 2 and older are not affected by this bug
+    
+    Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+
+commit ecfb4b3fff006372ac5c40871f9bb182fd00444f
+Author: Felix Fietkau <nbd@openwrt.org>
+Date:   Sat Sep 27 22:15:43 2014 +0200
+
+    ath9k: use ah->get_mac_revision for all SoC devices if available
+    
+    It is needed for AR934x as well
+    
+    Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+
+commit c11113bc25df22898fb995d3205bdc4f27c98073
+Author: Felix Fietkau <nbd@openwrt.org>
+Date:   Sat Sep 27 18:04:58 2014 +0200
+
+    ath5k: add missing include for debug code
+    
+    Needed for calling vmalloc()/vfree()
+    
+    Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+
+commit 83f76a9f9a42773c7eef90bb86b4b2c16b0b3755
+Author: Felix Fietkau <nbd@openwrt.org>
+Date:   Sat Sep 27 15:58:51 2014 +0200
+
+    ath5k: fix AHB kconfig dependency
+    
+    Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+
+commit ddd67f2a5cfd73fad4b78190025402d419b9f0a9
+Author: Felix Fietkau <nbd@openwrt.org>
+Date:   Sat Sep 27 15:57:09 2014 +0200
+
+    Revert "ath5k: Remove AHB bus support"
+    
+    This reverts commit 093ec3c5337434f40d77c1af06c139da3e5ba6dc.
+
+--- a/drivers/net/wireless/ath/ath5k/Kconfig
++++ b/drivers/net/wireless/ath/ath5k/Kconfig
+@@ -2,12 +2,14 @@ config ATH5K
+       tristate "Atheros 5xxx wireless cards support"
+       depends on m
+       depends on PCI && MAC80211
++      depends on (PCI || ATHEROS_AR231X) && MAC80211
+       select ATH_COMMON
+       select MAC80211_LEDS
+       select BACKPORT_LEDS_CLASS
+       select BACKPORT_NEW_LEDS
+       select BACKPORT_AVERAGE
+-      select ATH5K_PCI
++      select ATH5K_AHB if ATHEROS_AR231X
++      select ATH5K_PCI if !ATHEROS_AR231X
+       ---help---
+         This module adds support for wireless adapters based on
+         Atheros 5xxx chipset.
+@@ -52,9 +54,16 @@ config ATH5K_TRACER
  
-       /*
-        * set_multicast_list will be invoked by the networking core
-@@ -1116,6 +1093,74 @@ static void ieee80211_if_setup(struct ne
-       dev->destructor = free_netdev;
- }
+         If unsure, say N.
  
-+static void ieee80211_wds_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
-+                                       struct sk_buff *skb)
++config ATH5K_AHB
++      bool "Atheros 5xxx AHB bus support"
++      depends on ATHEROS_AR231X
++      ---help---
++        This adds support for WiSoC type chipsets of the 5xxx Atheros
++        family.
++
+ config ATH5K_PCI
+       bool "Atheros 5xxx PCI bus support"
+-      depends on PCI
++      depends on !ATHEROS_AR231X
+       ---help---
+         This adds support for PCI type chipsets of the 5xxx Atheros
+         family.
+--- /dev/null
++++ b/drivers/net/wireless/ath/ath5k/ahb.c
+@@ -0,0 +1,234 @@
++/*
++ * Copyright (c) 2008-2009 Atheros Communications Inc.
++ * Copyright (c) 2009 Gabor Juhos <juhosg@openwrt.org>
++ * Copyright (c) 2009 Imre Kaloz <kaloz@openwrt.org>
++ *
++ * Permission to use, copy, modify, and/or distribute this software for any
++ * purpose with or without fee is hereby granted, provided that the above
++ * copyright notice and this permission notice appear in all copies.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
++ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
++ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
++ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
++ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
++ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
++ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
++ */
++
++#include <linux/nl80211.h>
++#include <linux/platform_device.h>
++#include <linux/etherdevice.h>
++#include <linux/export.h>
++#include <ar231x_platform.h>
++#include "ath5k.h"
++#include "debug.h"
++#include "base.h"
++#include "reg.h"
++
++/* return bus cachesize in 4B word units */
++static void ath5k_ahb_read_cachesize(struct ath_common *common, int *csz)
 +{
-+      struct ieee80211_local *local = sdata->local;
-+      struct ieee80211_rx_status *rx_status;
-+      struct ieee802_11_elems elems;
-+      struct ieee80211_mgmt *mgmt;
-+      struct sta_info *sta;
-+      size_t baselen;
-+      u32 rates = 0;
-+      u16 stype;
-+      bool new = false;
-+      enum ieee80211_band band;
-+      struct ieee80211_supported_band *sband;
-+
-+      rx_status = IEEE80211_SKB_RXCB(skb);
-+      band = rx_status->band;
-+      sband = local->hw.wiphy->bands[band];
-+      mgmt = (struct ieee80211_mgmt *) skb->data;
-+      stype = le16_to_cpu(mgmt->frame_control) & IEEE80211_FCTL_STYPE;
-+
-+      if (stype != IEEE80211_STYPE_BEACON)
-+              return;
-+
-+      baselen = (u8 *) mgmt->u.probe_resp.variable - (u8 *) mgmt;
-+      if (baselen > skb->len)
-+              return;
-+
-+      ieee802_11_parse_elems(mgmt->u.probe_resp.variable,
-+                             skb->len - baselen, false, &elems);
-+
-+      rates = ieee80211_sta_get_rates(local, &elems, band, NULL);
-+
-+      rcu_read_lock();
-+
-+      sta = sta_info_get(sdata, sdata->u.wds.remote_addr);
-+
-+      if (!sta) {
-+              rcu_read_unlock();
-+              sta = sta_info_alloc(sdata, sdata->u.wds.remote_addr,
-+                                   GFP_KERNEL);
-+              if (!sta)
-+                      return;
-+
-+              new = true;
-+      }
++      *csz = L1_CACHE_BYTES >> 2;
++}
 +
-+      sta->last_rx = jiffies;
-+      sta->sta.supp_rates[band] = rates;
++static bool
++ath5k_ahb_eeprom_read(struct ath_common *common, u32 off, u16 *data)
++{
++      struct ath5k_hw *ah = common->priv;
++      struct platform_device *pdev = to_platform_device(ah->dev);
++      struct ar231x_board_config *bcfg = dev_get_platdata(&pdev->dev);
++      u16 *eeprom, *eeprom_end;
 +
-+      if (elems.ht_cap_elem)
-+              ieee80211_ht_cap_ie_to_sta_ht_cap(sdata, sband,
-+                              elems.ht_cap_elem, sta);
++      eeprom = (u16 *) bcfg->radio;
++      eeprom_end = ((void *) bcfg->config) + BOARD_CONFIG_BUFSZ;
 +
-+      if (elems.wmm_param)
-+              set_sta_flag(sta, WLAN_STA_WME);
++      eeprom += off;
++      if (eeprom > eeprom_end)
++              return false;
 +
-+      if (new) {
-+              sta_info_pre_move_state(sta, IEEE80211_STA_AUTH);
-+              sta_info_pre_move_state(sta, IEEE80211_STA_ASSOC);
-+              sta_info_pre_move_state(sta, IEEE80211_STA_AUTHORIZED);
-+              rate_control_rate_init(sta);
-+              sta_info_insert_rcu(sta);
-+      }
++      *data = *eeprom;
++      return true;
++}
 +
-+      rcu_read_unlock();
++int ath5k_hw_read_srev(struct ath5k_hw *ah)
++{
++      struct platform_device *pdev = to_platform_device(ah->dev);
++      struct ar231x_board_config *bcfg = dev_get_platdata(&pdev->dev);
++      ah->ah_mac_srev = bcfg->devid;
++      return 0;
 +}
 +
- static void ieee80211_iface_work(struct work_struct *work)
- {
-       struct ieee80211_sub_if_data *sdata =
-@@ -1220,6 +1265,9 @@ static void ieee80211_iface_work(struct 
-                               break;
-                       ieee80211_mesh_rx_queued_mgmt(sdata, skb);
-                       break;
-+              case NL80211_IFTYPE_WDS:
-+                      ieee80211_wds_rx_queued_mgmt(sdata, skb);
-+                      break;
-               default:
-                       WARN(1, "frame for unexpected interface type");
-                       break;
---- a/net/mac80211/rc80211_minstrel_ht.c
-+++ b/net/mac80211/rc80211_minstrel_ht.c
-@@ -804,10 +804,18 @@ minstrel_ht_get_rate(void *priv, struct 
-       sample_group = &minstrel_mcs_groups[sample_idx / MCS_GROUP_RATES];
-       info->flags |= IEEE80211_TX_CTL_RATE_CTRL_PROBE;
-+      rate->count = 1;
-+
-+      if (sample_idx / MCS_GROUP_RATES == MINSTREL_CCK_GROUP) {
-+              int idx = sample_idx % ARRAY_SIZE(mp->cck_rates);
-+              rate->idx = mp->cck_rates[idx];
-+              rate->flags = 0;
-+              return;
-+      }
++static int ath5k_ahb_eeprom_read_mac(struct ath5k_hw *ah, u8 *mac)
++{
++      struct platform_device *pdev = to_platform_device(ah->dev);
++      struct ar231x_board_config *bcfg = dev_get_platdata(&pdev->dev);
++      u8 *cfg_mac;
 +
-       rate->idx = sample_idx % MCS_GROUP_RATES +
-                   (sample_group->streams - 1) * MCS_GROUP_RATES;
-       rate->flags = IEEE80211_TX_RC_MCS | sample_group->flags;
--      rate->count = 1;
- }
- static void
---- a/net/mac80211/rx.c
-+++ b/net/mac80211/rx.c
-@@ -936,8 +936,14 @@ ieee80211_rx_h_check(struct ieee80211_rx
-       struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
-       struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
--      /* Drop duplicate 802.11 retransmissions (IEEE 802.11 Chap. 9.2.9) */
--      if (rx->sta && !is_multicast_ether_addr(hdr->addr1)) {
-+      /*
-+       * Drop duplicate 802.11 retransmissions
-+       * (IEEE 802.11-2012: 9.3.2.10 "Duplicate detection and recovery")
-+       */
-+      if (rx->skb->len >= 24 && rx->sta &&
-+          !ieee80211_is_ctl(hdr->frame_control) &&
-+          !ieee80211_is_qos_nullfunc(hdr->frame_control) &&
-+          !is_multicast_ether_addr(hdr->addr1)) {
-               if (unlikely(ieee80211_has_retry(hdr->frame_control) &&
-                            rx->sta->last_seq_ctrl[rx->seqno_idx] ==
-                            hdr->seq_ctrl)) {
-@@ -2369,6 +2375,7 @@ ieee80211_rx_h_action(struct ieee80211_r
-                   sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
-                   sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
-                   sdata->vif.type != NL80211_IFTYPE_AP &&
-+                  sdata->vif.type != NL80211_IFTYPE_WDS &&
-                   sdata->vif.type != NL80211_IFTYPE_ADHOC)
-                       break;
-@@ -2720,14 +2727,15 @@ ieee80211_rx_h_mgmt(struct ieee80211_rx_
-       if (!ieee80211_vif_is_mesh(&sdata->vif) &&
-           sdata->vif.type != NL80211_IFTYPE_ADHOC &&
--          sdata->vif.type != NL80211_IFTYPE_STATION)
-+          sdata->vif.type != NL80211_IFTYPE_STATION &&
-+          sdata->vif.type != NL80211_IFTYPE_WDS)
-               return RX_DROP_MONITOR;
-       switch (stype) {
-       case cpu_to_le16(IEEE80211_STYPE_AUTH):
-       case cpu_to_le16(IEEE80211_STYPE_BEACON):
-       case cpu_to_le16(IEEE80211_STYPE_PROBE_RESP):
--              /* process for all: mesh, mlme, ibss */
-+              /* process for all: mesh, mlme, ibss, wds */
-               break;
-       case cpu_to_le16(IEEE80211_STYPE_ASSOC_RESP):
-       case cpu_to_le16(IEEE80211_STYPE_REASSOC_RESP):
-@@ -3059,10 +3067,16 @@ static int prepare_for_handlers(struct i
-               }
-               break;
-       case NL80211_IFTYPE_WDS:
--              if (bssid || !ieee80211_is_data(hdr->frame_control))
--                      return 0;
-               if (!ether_addr_equal(sdata->u.wds.remote_addr, hdr->addr2))
-                       return 0;
-+
-+              if (ieee80211_is_data(hdr->frame_control) ||
-+                  ieee80211_is_action(hdr->frame_control)) {
-+                      if (compare_ether_addr(sdata->vif.addr, hdr->addr1))
-+                              return 0;
-+              } else if (!ieee80211_is_beacon(hdr->frame_control))
-+                      return 0;
++      if (to_platform_device(ah->dev)->id == 0)
++              cfg_mac = bcfg->config->wlan0_mac;
++      else
++              cfg_mac = bcfg->config->wlan1_mac;
 +
-               break;
-       case NL80211_IFTYPE_P2P_DEVICE:
-               if (!ieee80211_is_public_action(hdr, skb->len) &&
---- a/net/mac80211/sta_info.h
-+++ b/net/mac80211/sta_info.h
-@@ -32,7 +32,6 @@
-  * @WLAN_STA_SHORT_PREAMBLE: Station is capable of receiving short-preamble
-  *    frames.
-  * @WLAN_STA_WME: Station is a QoS-STA.
-- * @WLAN_STA_WDS: Station is one of our WDS peers.
-  * @WLAN_STA_CLEAR_PS_FILT: Clear PS filter in hardware (using the
-  *    IEEE80211_TX_CTL_CLEAR_PS_FILT control flag) when the next
-  *    frame to this station is transmitted.
-@@ -66,7 +65,6 @@ enum ieee80211_sta_info_flags {
-       WLAN_STA_AUTHORIZED,
-       WLAN_STA_SHORT_PREAMBLE,
-       WLAN_STA_WME,
--      WLAN_STA_WDS,
-       WLAN_STA_CLEAR_PS_FILT,
-       WLAN_STA_MFP,
-       WLAN_STA_BLOCK_BA,
---- a/drivers/net/wireless/ath/ath9k/xmit.c
-+++ b/drivers/net/wireless/ath/ath9k/xmit.c
-@@ -135,6 +135,9 @@ static struct ath_frame_info *get_frame_
- static void ath_send_bar(struct ath_atx_tid *tid, u16 seqno)
- {
-+      if (!tid->an->sta)
-+              return;
++      memcpy(mac, cfg_mac, ETH_ALEN);
++      return 0;
++}
 +
-       ieee80211_send_bar(tid->an->vif, tid->an->sta->addr, tid->tidno,
-                          seqno << IEEE80211_SEQ_SEQ_SHIFT);
- }
-@@ -146,6 +149,93 @@ static void ath_set_rates(struct ieee802
-                              ARRAY_SIZE(bf->rates));
- }
-+static void ath_txq_skb_done(struct ath_softc *sc, struct ath_txq *txq,
-+                           struct sk_buff *skb)
++static const struct ath_bus_ops ath_ahb_bus_ops = {
++      .ath_bus_type = ATH_AHB,
++      .read_cachesize = ath5k_ahb_read_cachesize,
++      .eeprom_read = ath5k_ahb_eeprom_read,
++      .eeprom_read_mac = ath5k_ahb_eeprom_read_mac,
++};
++
++/*Initialization*/
++static int ath_ahb_probe(struct platform_device *pdev)
 +{
-+      int q;
++      struct ar231x_board_config *bcfg = dev_get_platdata(&pdev->dev);
++      struct ath5k_hw *ah;
++      struct ieee80211_hw *hw;
++      struct resource *res;
++      void __iomem *mem;
++      int irq;
++      int ret = 0;
++      u32 reg;
++
++      if (!dev_get_platdata(&pdev->dev)) {
++              dev_err(&pdev->dev, "no platform data specified\n");
++              ret = -EINVAL;
++              goto err_out;
++      }
++
++      res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
++      if (res == NULL) {
++              dev_err(&pdev->dev, "no memory resource found\n");
++              ret = -ENXIO;
++              goto err_out;
++      }
 +
-+      q = skb_get_queue_mapping(skb);
-+      if (txq == sc->tx.uapsdq)
-+              txq = sc->tx.txq_map[q];
++      mem = ioremap_nocache(res->start, resource_size(res));
++      if (mem == NULL) {
++              dev_err(&pdev->dev, "ioremap failed\n");
++              ret = -ENOMEM;
++              goto err_out;
++      }
 +
-+      if (txq != sc->tx.txq_map[q])
-+              return;
++      res = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
++      if (res == NULL) {
++              dev_err(&pdev->dev, "no IRQ resource found\n");
++              ret = -ENXIO;
++              goto err_iounmap;
++      }
 +
-+      if (WARN_ON(--txq->pending_frames < 0))
-+              txq->pending_frames = 0;
++      irq = res->start;
 +
-+      if (txq->stopped &&
-+          txq->pending_frames < sc->tx.txq_max_pending[q]) {
-+              ieee80211_wake_queue(sc->hw, q);
-+              txq->stopped = false;
++      hw = ieee80211_alloc_hw(sizeof(struct ath5k_hw), &ath5k_hw_ops);
++      if (hw == NULL) {
++              dev_err(&pdev->dev, "no memory for ieee80211_hw\n");
++              ret = -ENOMEM;
++              goto err_iounmap;
 +      }
-+}
 +
-+static struct ath_atx_tid *
-+ath_get_skb_tid(struct ath_softc *sc, struct ath_node *an, struct sk_buff *skb)
-+{
-+      struct ieee80211_hdr *hdr;
-+      u8 tidno = 0;
++      ah = hw->priv;
++      ah->hw = hw;
++      ah->dev = &pdev->dev;
++      ah->iobase = mem;
++      ah->irq = irq;
++      ah->devid = bcfg->devid;
++
++      if (bcfg->devid >= AR5K_SREV_AR2315_R6) {
++              /* Enable WMAC AHB arbitration */
++              reg = ioread32((void __iomem *) AR5K_AR2315_AHB_ARB_CTL);
++              reg |= AR5K_AR2315_AHB_ARB_CTL_WLAN;
++              iowrite32(reg, (void __iomem *) AR5K_AR2315_AHB_ARB_CTL);
++
++              /* Enable global WMAC swapping */
++              reg = ioread32((void __iomem *) AR5K_AR2315_BYTESWAP);
++              reg |= AR5K_AR2315_BYTESWAP_WMAC;
++              iowrite32(reg, (void __iomem *) AR5K_AR2315_BYTESWAP);
++      } else {
++              /* Enable WMAC DMA access (assuming 5312 or 231x*/
++              /* TODO: check other platforms */
++              reg = ioread32((void __iomem *) AR5K_AR5312_ENABLE);
++              if (to_platform_device(ah->dev)->id == 0)
++                      reg |= AR5K_AR5312_ENABLE_WLAN0;
++              else
++                      reg |= AR5K_AR5312_ENABLE_WLAN1;
++              iowrite32(reg, (void __iomem *) AR5K_AR5312_ENABLE);
++
++              /*
++               * On a dual-band AR5312, the multiband radio is only
++               * used as pass-through. Disable 2 GHz support in the
++               * driver for it
++               */
++              if (to_platform_device(ah->dev)->id == 0 &&
++                  (bcfg->config->flags & (BD_WLAN0 | BD_WLAN1)) ==
++                   (BD_WLAN1 | BD_WLAN0))
++                      ah->ah_capabilities.cap_needs_2GHz_ovr = true;
++              else
++                      ah->ah_capabilities.cap_needs_2GHz_ovr = false;
++      }
++
++      ret = ath5k_init_ah(ah, &ath_ahb_bus_ops);
++      if (ret != 0) {
++              dev_err(&pdev->dev, "failed to attach device, err=%d\n", ret);
++              ret = -ENODEV;
++              goto err_free_hw;
++      }
 +
-+      hdr = (struct ieee80211_hdr *) skb->data;
-+      if (ieee80211_is_data_qos(hdr->frame_control))
-+              tidno = ieee80211_get_qos_ctl(hdr)[0];
++      platform_set_drvdata(pdev, hw);
 +
-+      tidno &= IEEE80211_QOS_CTL_TID_MASK;
-+      return ATH_AN_2_TID(an, tidno);
++      return 0;
++
++ err_free_hw:
++      ieee80211_free_hw(hw);
++ err_iounmap:
++        iounmap(mem);
++ err_out:
++      return ret;
 +}
 +
-+static bool ath_tid_has_buffered(struct ath_atx_tid *tid)
++static int ath_ahb_remove(struct platform_device *pdev)
 +{
-+      return !skb_queue_empty(&tid->buf_q) || !skb_queue_empty(&tid->retry_q);
++      struct ar231x_board_config *bcfg = dev_get_platdata(&pdev->dev);
++      struct ieee80211_hw *hw = platform_get_drvdata(pdev);
++      struct ath5k_hw *ah;
++      u32 reg;
++
++      if (!hw)
++              return 0;
++
++      ah = hw->priv;
++
++      if (bcfg->devid >= AR5K_SREV_AR2315_R6) {
++              /* Disable WMAC AHB arbitration */
++              reg = ioread32((void __iomem *) AR5K_AR2315_AHB_ARB_CTL);
++              reg &= ~AR5K_AR2315_AHB_ARB_CTL_WLAN;
++              iowrite32(reg, (void __iomem *) AR5K_AR2315_AHB_ARB_CTL);
++      } else {
++              /*Stop DMA access */
++              reg = ioread32((void __iomem *) AR5K_AR5312_ENABLE);
++              if (to_platform_device(ah->dev)->id == 0)
++                      reg &= ~AR5K_AR5312_ENABLE_WLAN0;
++              else
++                      reg &= ~AR5K_AR5312_ENABLE_WLAN1;
++              iowrite32(reg, (void __iomem *) AR5K_AR5312_ENABLE);
++      }
++
++      ath5k_deinit_ah(ah);
++      iounmap(ah->iobase);
++      ieee80211_free_hw(hw);
++
++      return 0;
 +}
 +
-+static struct sk_buff *ath_tid_dequeue(struct ath_atx_tid *tid)
-+{
-+      struct sk_buff *skb;
++static struct platform_driver ath_ahb_driver = {
++      .probe      = ath_ahb_probe,
++      .remove     = ath_ahb_remove,
++      .driver         = {
++              .name   = "ar231x-wmac",
++              .owner  = THIS_MODULE,
++      },
++};
++
++module_platform_driver(ath_ahb_driver);
+--- a/drivers/net/wireless/ath/ath5k/ath5k.h
++++ b/drivers/net/wireless/ath/ath5k/ath5k.h
+@@ -1647,6 +1647,32 @@ static inline struct ath_regulatory *ath
+       return &(ath5k_hw_common(ah)->regulatory);
+ }
++#ifdef CONFIG_ATHEROS_AR231X
++#define AR5K_AR2315_PCI_BASE  ((void __iomem *)0xb0100000)
 +
-+      skb = __skb_dequeue(&tid->retry_q);
-+      if (!skb)
-+              skb = __skb_dequeue(&tid->buf_q);
++static inline void __iomem *ath5k_ahb_reg(struct ath5k_hw *ah, u16 reg)
++{
++      /* On AR2315 and AR2317 the PCI clock domain registers
++       * are outside of the WMAC register space */
++      if (unlikely((reg >= 0x4000) && (reg < 0x5000) &&
++          (ah->ah_mac_srev >= AR5K_SREV_AR2315_R6)))
++              return AR5K_AR2315_PCI_BASE + reg;
 +
-+      return skb;
++      return ah->iobase + reg;
 +}
 +
-+/*
-+ * ath_tx_tid_change_state:
-+ * - clears a-mpdu flag of previous session
-+ * - force sequence number allocation to fix next BlockAck Window
-+ */
-+static void
-+ath_tx_tid_change_state(struct ath_softc *sc, struct ath_atx_tid *tid)
++static inline u32 ath5k_hw_reg_read(struct ath5k_hw *ah, u16 reg)
 +{
-+      struct ath_txq *txq = tid->ac->txq;
-+      struct ieee80211_tx_info *tx_info;
-+      struct sk_buff *skb, *tskb;
-+      struct ath_buf *bf;
-+      struct ath_frame_info *fi;
-+
-+      skb_queue_walk_safe(&tid->buf_q, skb, tskb) {
-+              fi = get_frame_info(skb);
-+              bf = fi->bf;
-+
-+              tx_info = IEEE80211_SKB_CB(skb);
-+              tx_info->flags &= ~IEEE80211_TX_CTL_AMPDU;
-+
-+              if (bf)
-+                      continue;
-+
-+              bf = ath_tx_setup_buffer(sc, txq, tid, skb);
-+              if (!bf) {
-+                      __skb_unlink(skb, &tid->buf_q);
-+                      ath_txq_skb_done(sc, txq, skb);
-+                      ieee80211_free_txskb(sc->hw, skb);
-+                      continue;
-+              }
-+      }
++      return ioread32(ath5k_ahb_reg(ah, reg));
++}
 +
++static inline void ath5k_hw_reg_write(struct ath5k_hw *ah, u32 val, u16 reg)
++{
++      iowrite32(val, ath5k_ahb_reg(ah, reg));
 +}
 +
- static void ath_tx_flush_tid(struct ath_softc *sc, struct ath_atx_tid *tid)
- {
-       struct ath_txq *txq = tid->ac->txq;
-@@ -160,27 +250,22 @@ static void ath_tx_flush_tid(struct ath_
-       memset(&ts, 0, sizeof(ts));
--      while ((skb = __skb_dequeue(&tid->buf_q))) {
-+      while ((skb = __skb_dequeue(&tid->retry_q))) {
-               fi = get_frame_info(skb);
-               bf = fi->bf;
--
-               if (!bf) {
--                      bf = ath_tx_setup_buffer(sc, txq, tid, skb);
--                      if (!bf) {
--                              ieee80211_free_txskb(sc->hw, skb);
--                              continue;
--                      }
-+                      ath_txq_skb_done(sc, txq, skb);
-+                      ieee80211_free_txskb(sc->hw, skb);
-+                      continue;
-               }
--              if (fi->retries) {
--                      list_add_tail(&bf->list, &bf_head);
-+              if (fi->baw_tracked) {
-                       ath_tx_update_baw(sc, tid, bf->bf_state.seqno);
--                      ath_tx_complete_buf(sc, bf, txq, &bf_head, &ts, 0);
-                       sendbar = true;
--              } else {
--                      ath_set_rates(tid->an->vif, tid->an->sta, bf);
--                      ath_tx_send_normal(sc, txq, NULL, skb);
-               }
++#else
 +
-+              list_add_tail(&bf->list, &bf_head);
-+              ath_tx_complete_buf(sc, bf, txq, &bf_head, &ts, 0);
-       }
-       if (sendbar) {
-@@ -209,13 +294,16 @@ static void ath_tx_update_baw(struct ath
- }
- static void ath_tx_addto_baw(struct ath_softc *sc, struct ath_atx_tid *tid,
--                           u16 seqno)
-+                           struct ath_buf *bf)
+ static inline u32 ath5k_hw_reg_read(struct ath5k_hw *ah, u16 reg)
  {
-+      struct ath_frame_info *fi = get_frame_info(bf->bf_mpdu);
-+      u16 seqno = bf->bf_state.seqno;
-       int index, cindex;
-       index  = ATH_BA_INDEX(tid->seq_start, seqno);
-       cindex = (tid->baw_head + index) & (ATH_TID_MAX_BUFS - 1);
-       __set_bit(cindex, tid->tx_buf);
-+      fi->baw_tracked = 1;
-       if (index >= ((tid->baw_tail - tid->baw_head) &
-               (ATH_TID_MAX_BUFS - 1))) {
-@@ -224,12 +312,6 @@ static void ath_tx_addto_baw(struct ath_
-       }
- }
--/*
-- * TODO: For frame(s) that are in the retry state, we will reuse the
-- * sequence number(s) without setting the retry bit. The
-- * alternative is to give up on these and BAR the receiver's window
-- * forward.
-- */
- static void ath_tid_drain(struct ath_softc *sc, struct ath_txq *txq,
-                         struct ath_atx_tid *tid)
-@@ -243,7 +325,7 @@ static void ath_tid_drain(struct ath_sof
-       memset(&ts, 0, sizeof(ts));
-       INIT_LIST_HEAD(&bf_head);
--      while ((skb = __skb_dequeue(&tid->buf_q))) {
-+      while ((skb = ath_tid_dequeue(tid))) {
-               fi = get_frame_info(skb);
-               bf = fi->bf;
-@@ -253,14 +335,8 @@ static void ath_tid_drain(struct ath_sof
-               }
-               list_add_tail(&bf->list, &bf_head);
--
--              ath_tx_update_baw(sc, tid, bf->bf_state.seqno);
-               ath_tx_complete_buf(sc, bf, txq, &bf_head, &ts, 0);
-       }
--
--      tid->seq_next = tid->seq_start;
--      tid->baw_tail = tid->baw_head;
--      tid->bar_index = -1;
- }
- static void ath_tx_set_retry(struct ath_softc *sc, struct ath_txq *txq,
-@@ -380,7 +456,6 @@ static void ath_tx_complete_aggr(struct 
-       struct ieee80211_tx_rate rates[4];
-       struct ath_frame_info *fi;
-       int nframes;
--      u8 tidno;
-       bool flush = !!(ts->ts_status & ATH9K_TX_FLUSH);
-       int i, retries;
-       int bar_index = -1;
-@@ -406,7 +481,7 @@ static void ath_tx_complete_aggr(struct 
-               while (bf) {
-                       bf_next = bf->bf_next;
--                      if (!bf->bf_stale || bf_next != NULL)
-+                      if (!bf->bf_state.stale || bf_next != NULL)
-                               list_move_tail(&bf->list, &bf_head);
-                       ath_tx_complete_buf(sc, bf, txq, &bf_head, ts, 0);
-@@ -417,8 +492,7 @@ static void ath_tx_complete_aggr(struct 
-       }
-       an = (struct ath_node *)sta->drv_priv;
--      tidno = ieee80211_get_qos_ctl(hdr)[0] & IEEE80211_QOS_CTL_TID_MASK;
--      tid = ATH_AN_2_TID(an, tidno);
-+      tid = ath_get_skb_tid(sc, an, skb);
-       seq_first = tid->seq_start;
-       isba = ts->ts_flags & ATH9K_TX_BA;
-@@ -430,7 +504,7 @@ static void ath_tx_complete_aggr(struct 
-        * Only BlockAcks have a TID and therefore normal Acks cannot be
-        * checked
-        */
--      if (isba && tidno != ts->tid)
-+      if (isba && tid->tidno != ts->tid)
-               txok = false;
-       isaggr = bf_isaggr(bf);
-@@ -466,7 +540,8 @@ static void ath_tx_complete_aggr(struct 
-               tx_info = IEEE80211_SKB_CB(skb);
-               fi = get_frame_info(skb);
--              if (!BAW_WITHIN(tid->seq_start, tid->baw_size, seqno)) {
-+              if (!BAW_WITHIN(tid->seq_start, tid->baw_size, seqno) ||
-+                  !tid->active) {
-                       /*
-                        * Outside of the current BlockAck window,
-                        * maybe part of a previous session
-@@ -499,7 +574,7 @@ static void ath_tx_complete_aggr(struct 
-                * not a holding desc.
-                */
-               INIT_LIST_HEAD(&bf_head);
--              if (bf_next != NULL || !bf_last->bf_stale)
-+              if (bf_next != NULL || !bf_last->bf_state.stale)
-                       list_move_tail(&bf->list, &bf_head);
-               if (!txpending) {
-@@ -523,7 +598,7 @@ static void ath_tx_complete_aggr(struct 
-                               ieee80211_sta_eosp(sta);
-                       }
-                       /* retry the un-acked ones */
--                      if (bf->bf_next == NULL && bf_last->bf_stale) {
-+                      if (bf->bf_next == NULL && bf_last->bf_state.stale) {
-                               struct ath_buf *tbf;
-                               tbf = ath_clone_txbuf(sc, bf_last);
-@@ -560,7 +635,7 @@ static void ath_tx_complete_aggr(struct 
-               if (an->sleeping)
-                       ieee80211_sta_set_buffered(sta, tid->tidno, true);
--              skb_queue_splice(&bf_pending, &tid->buf_q);
-+              skb_queue_splice_tail(&bf_pending, &tid->retry_q);
-               if (!an->sleeping) {
-                       ath_tx_queue_tid(txq, tid);
-@@ -618,7 +693,7 @@ static void ath_tx_process_buffer(struct
-       } else
-               ath_tx_complete_aggr(sc, txq, bf, bf_head, ts, txok);
--      if ((sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_HT) && !flush)
-+      if (!flush)
-               ath_txq_schedule(sc, txq);
+       return ioread32(ah->iobase + reg);
+@@ -1657,6 +1683,8 @@ static inline void ath5k_hw_reg_write(st
+       iowrite32(val, ah->iobase + reg);
  }
  
-@@ -792,15 +867,20 @@ static int ath_compute_num_delims(struct
- static struct ath_buf *
- ath_tx_get_tid_subframe(struct ath_softc *sc, struct ath_txq *txq,
--                      struct ath_atx_tid *tid)
-+                      struct ath_atx_tid *tid, struct sk_buff_head **q)
++#endif
++
+ static inline enum ath_bus_type ath5k_get_bus_type(struct ath5k_hw *ah)
  {
-+      struct ieee80211_tx_info *tx_info;
-       struct ath_frame_info *fi;
-       struct sk_buff *skb;
-       struct ath_buf *bf;
-       u16 seqno;
-       while (1) {
--              skb = skb_peek(&tid->buf_q);
-+              *q = &tid->retry_q;
-+              if (skb_queue_empty(*q))
-+                      *q = &tid->buf_q;
-+
-+              skb = skb_peek(*q);
-               if (!skb)
-                       break;
+       return ath5k_hw_common(ah)->bus_ops->ath_bus_type;
+--- a/drivers/net/wireless/ath/ath5k/base.c
++++ b/drivers/net/wireless/ath/ath5k/base.c
+@@ -99,6 +99,15 @@ static int ath5k_reset(struct ath5k_hw *
+ /* Known SREVs */
+ static const struct ath5k_srev_name srev_names[] = {
++#ifdef CONFIG_ATHEROS_AR231X
++      { "5312",       AR5K_VERSION_MAC,       AR5K_SREV_AR5312_R2 },
++      { "5312",       AR5K_VERSION_MAC,       AR5K_SREV_AR5312_R7 },
++      { "2313",       AR5K_VERSION_MAC,       AR5K_SREV_AR2313_R8 },
++      { "2315",       AR5K_VERSION_MAC,       AR5K_SREV_AR2315_R6 },
++      { "2315",       AR5K_VERSION_MAC,       AR5K_SREV_AR2315_R7 },
++      { "2317",       AR5K_VERSION_MAC,       AR5K_SREV_AR2317_R1 },
++      { "2317",       AR5K_VERSION_MAC,       AR5K_SREV_AR2317_R2 },
++#else
+       { "5210",       AR5K_VERSION_MAC,       AR5K_SREV_AR5210 },
+       { "5311",       AR5K_VERSION_MAC,       AR5K_SREV_AR5311 },
+       { "5311A",      AR5K_VERSION_MAC,       AR5K_SREV_AR5311A },
+@@ -117,6 +126,7 @@ static const struct ath5k_srev_name srev
+       { "5418",       AR5K_VERSION_MAC,       AR5K_SREV_AR5418 },
+       { "2425",       AR5K_VERSION_MAC,       AR5K_SREV_AR2425 },
+       { "2417",       AR5K_VERSION_MAC,       AR5K_SREV_AR2417 },
++#endif
+       { "xxxxx",      AR5K_VERSION_MAC,       AR5K_SREV_UNKNOWN },
+       { "5110",       AR5K_VERSION_RAD,       AR5K_SREV_RAD_5110 },
+       { "5111",       AR5K_VERSION_RAD,       AR5K_SREV_RAD_5111 },
+@@ -132,6 +142,10 @@ static const struct ath5k_srev_name srev
+       { "5413",       AR5K_VERSION_RAD,       AR5K_SREV_RAD_5413 },
+       { "5424",       AR5K_VERSION_RAD,       AR5K_SREV_RAD_5424 },
+       { "5133",       AR5K_VERSION_RAD,       AR5K_SREV_RAD_5133 },
++#ifdef CONFIG_ATHEROS_AR231X
++      { "2316",       AR5K_VERSION_RAD,       AR5K_SREV_RAD_2316 },
++      { "2317",       AR5K_VERSION_RAD,       AR5K_SREV_RAD_2317 },
++#endif
+       { "xxxxx",      AR5K_VERSION_RAD,       AR5K_SREV_UNKNOWN },
+ };
  
-@@ -808,13 +888,26 @@ ath_tx_get_tid_subframe(struct ath_softc
-               bf = fi->bf;
-               if (!fi->bf)
-                       bf = ath_tx_setup_buffer(sc, txq, tid, skb);
-+              else
-+                      bf->bf_state.stale = false;
+--- a/drivers/net/wireless/ath/ath5k/led.c
++++ b/drivers/net/wireless/ath/ath5k/led.c
+@@ -163,14 +163,20 @@ int ath5k_init_leds(struct ath5k_hw *ah)
+ {
+       int ret = 0;
+       struct ieee80211_hw *hw = ah->hw;
++#ifndef CONFIG_ATHEROS_AR231X
+       struct pci_dev *pdev = ah->pdev;
++#endif
+       char name[ATH5K_LED_MAX_NAME_LEN + 1];
+       const struct pci_device_id *match;
+       if (!ah->pdev)
+               return 0;
  
-               if (!bf) {
--                      __skb_unlink(skb, &tid->buf_q);
-+                      __skb_unlink(skb, *q);
-+                      ath_txq_skb_done(sc, txq, skb);
-                       ieee80211_free_txskb(sc->hw, skb);
-                       continue;
-               }
++#ifdef CONFIG_ATHEROS_AR231X
++      match = NULL;
++#else
+       match = pci_match_id(&ath5k_led_devices[0], pdev);
++#endif
+       if (match) {
+               __set_bit(ATH_STAT_LEDSOFT, ah->status);
+               ah->led_pin = ATH_PIN(match->driver_data);
+--- a/drivers/net/wireless/ath/ath5k/debug.c
++++ b/drivers/net/wireless/ath/ath5k/debug.c
+@@ -65,6 +65,7 @@
+ #include <linux/seq_file.h>
+ #include <linux/list.h>
++#include <linux/vmalloc.h>
+ #include "debug.h"
+ #include "ath5k.h"
+ #include "reg.h"
+--- a/drivers/net/wireless/ath/ath9k/hw.c
++++ b/drivers/net/wireless/ath/ath9k/hw.c
+@@ -222,31 +222,28 @@ static void ath9k_hw_read_revisions(stru
+ {
+       u32 val;
  
-+              bf->bf_next = NULL;
-+              bf->bf_lastbf = bf;
-+
-+              tx_info = IEEE80211_SKB_CB(skb);
-+              tx_info->flags &= ~IEEE80211_TX_CTL_CLEAR_PS_FILT;
-+              if (!(tx_info->flags & IEEE80211_TX_CTL_AMPDU)) {
-+                      bf->bf_state.bf_type = 0;
-+                      return bf;
-+              }
++      if (ah->get_mac_revision)
++              ah->hw_version.macRev = ah->get_mac_revision();
 +
-               bf->bf_state.bf_type = BUF_AMPDU | BUF_AGGR;
-               seqno = bf->bf_state.seqno;
-@@ -828,73 +921,52 @@ ath_tx_get_tid_subframe(struct ath_softc
-                       INIT_LIST_HEAD(&bf_head);
-                       list_add(&bf->list, &bf_head);
--                      __skb_unlink(skb, &tid->buf_q);
-+                      __skb_unlink(skb, *q);
-                       ath_tx_update_baw(sc, tid, seqno);
-                       ath_tx_complete_buf(sc, bf, txq, &bf_head, &ts, 0);
-                       continue;
+       switch (ah->hw_version.devid) {
+       case AR5416_AR9100_DEVID:
+               ah->hw_version.macVersion = AR_SREV_VERSION_9100;
+               break;
+       case AR9300_DEVID_AR9330:
+               ah->hw_version.macVersion = AR_SREV_VERSION_9330;
+-              if (ah->get_mac_revision) {
+-                      ah->hw_version.macRev = ah->get_mac_revision();
+-              } else {
++              if (!ah->get_mac_revision) {
+                       val = REG_READ(ah, AR_SREV);
+                       ah->hw_version.macRev = MS(val, AR_SREV_REVISION2);
                }
--              bf->bf_next = NULL;
--              bf->bf_lastbf = bf;
-               return bf;
+               return;
+       case AR9300_DEVID_AR9340:
+               ah->hw_version.macVersion = AR_SREV_VERSION_9340;
+-              val = REG_READ(ah, AR_SREV);
+-              ah->hw_version.macRev = MS(val, AR_SREV_REVISION2);
+               return;
+       case AR9300_DEVID_QCA955X:
+               ah->hw_version.macVersion = AR_SREV_VERSION_9550;
+               return;
+       case AR9300_DEVID_AR953X:
+               ah->hw_version.macVersion = AR_SREV_VERSION_9531;
+-              if (ah->get_mac_revision)
+-                      ah->hw_version.macRev = ah->get_mac_revision();
+               return;
        }
  
-       return NULL;
- }
--static enum ATH_AGGR_STATUS ath_tx_form_aggr(struct ath_softc *sc,
--                                           struct ath_txq *txq,
--                                           struct ath_atx_tid *tid,
--                                           struct list_head *bf_q,
--                                           int *aggr_len)
-+static bool
-+ath_tx_form_aggr(struct ath_softc *sc, struct ath_txq *txq,
-+               struct ath_atx_tid *tid, struct list_head *bf_q,
-+               struct ath_buf *bf_first, struct sk_buff_head *tid_q,
-+               int *aggr_len)
+@@ -704,6 +701,8 @@ static void ath9k_hw_init_pll(struct ath
  {
- #define PADBYTES(_len) ((4 - ((_len) % 4)) % 4)
--      struct ath_buf *bf, *bf_first = NULL, *bf_prev = NULL;
--      int rl = 0, nframes = 0, ndelim, prev_al = 0;
-+      struct ath_buf *bf = bf_first, *bf_prev = NULL;
-+      int nframes = 0, ndelim;
-       u16 aggr_limit = 0, al = 0, bpad = 0,
--              al_delta, h_baw = tid->baw_size / 2;
--      enum ATH_AGGR_STATUS status = ATH_AGGR_DONE;
-+          al_delta, h_baw = tid->baw_size / 2;
-       struct ieee80211_tx_info *tx_info;
-       struct ath_frame_info *fi;
-       struct sk_buff *skb;
-+      bool closed = false;
--      do {
--              bf = ath_tx_get_tid_subframe(sc, txq, tid);
--              if (!bf) {
--                      status = ATH_AGGR_BAW_CLOSED;
--                      break;
--              }
-+      bf = bf_first;
-+      aggr_limit = ath_lookup_rate(sc, bf, tid);
-+      do {
-               skb = bf->bf_mpdu;
-               fi = get_frame_info(skb);
--              if (!bf_first)
--                      bf_first = bf;
--
--              if (!rl) {
--                      ath_set_rates(tid->an->vif, tid->an->sta, bf);
--                      aggr_limit = ath_lookup_rate(sc, bf, tid);
--                      rl = 1;
--              }
--
-               /* do not exceed aggregation limit */
-               al_delta = ATH_AGGR_DELIM_SZ + fi->framelen;
-+              if (nframes) {
-+                      if (aggr_limit < al + bpad + al_delta ||
-+                          ath_lookup_legacy(bf) || nframes >= h_baw)
-+                              break;
--              if (nframes &&
--                  ((aggr_limit < (al + bpad + al_delta + prev_al)) ||
--                   ath_lookup_legacy(bf))) {
--                      status = ATH_AGGR_LIMITED;
--                      break;
--              }
--
--              tx_info = IEEE80211_SKB_CB(bf->bf_mpdu);
--              if (nframes && (tx_info->flags & IEEE80211_TX_CTL_RATE_CTRL_PROBE))
--                      break;
--
--              /* do not exceed subframe limit */
--              if (nframes >= min((int)h_baw, ATH_AMPDU_SUBFRAME_DEFAULT)) {
--                      status = ATH_AGGR_LIMITED;
--                      break;
-+                      tx_info = IEEE80211_SKB_CB(bf->bf_mpdu);
-+                      if ((tx_info->flags & IEEE80211_TX_CTL_RATE_CTRL_PROBE) ||
-+                          !(tx_info->flags & IEEE80211_TX_CTL_AMPDU))
-+                              break;
-               }
+       u32 pll;
++      pll = ath9k_hw_compute_pll_control(ah, chan);
++
+       if (AR_SREV_9485(ah) || AR_SREV_9565(ah)) {
+               /* program BB PLL ki and kd value, ki=0x4, kd=0x40 */
+               REG_RMW_FIELD(ah, AR_CH0_BB_DPLL2,
+@@ -754,7 +753,8 @@ static void ath9k_hw_init_pll(struct ath
+               REG_RMW_FIELD(ah, AR_CH0_DDR_DPLL3,
+                             AR_CH0_DPLL3_PHASE_SHIFT, 0x1);
+-              REG_WRITE(ah, AR_RTC_PLL_CONTROL, 0x1142c);
++              REG_WRITE(ah, AR_RTC_PLL_CONTROL,
++                        pll | AR_RTC_9300_PLL_BYPASS);
+               udelay(1000);
+               /* program refdiv, nint, frac to RTC register */
+@@ -770,7 +770,8 @@ static void ath9k_hw_init_pll(struct ath
+       } else if (AR_SREV_9340(ah) || AR_SREV_9550(ah) || AR_SREV_9531(ah)) {
+               u32 regval, pll2_divint, pll2_divfrac, refdiv;
+-              REG_WRITE(ah, AR_RTC_PLL_CONTROL, 0x1142c);
++              REG_WRITE(ah, AR_RTC_PLL_CONTROL,
++                        pll | AR_RTC_9300_SOC_PLL_BYPASS);
+               udelay(1000);
+               REG_SET_BIT(ah, AR_PHY_PLL_MODE, 0x1 << 16);
+@@ -843,7 +844,6 @@ static void ath9k_hw_init_pll(struct ath
+               udelay(1000);
+       }
  
-               /* add padding for previous frame to aggregation length */
-@@ -912,22 +984,37 @@ static enum ATH_AGGR_STATUS ath_tx_form_
-               bf->bf_next = NULL;
-               /* link buffers of this frame to the aggregate */
--              if (!fi->retries)
--                      ath_tx_addto_baw(sc, tid, bf->bf_state.seqno);
-+              if (!fi->baw_tracked)
-+                      ath_tx_addto_baw(sc, tid, bf);
-               bf->bf_state.ndelim = ndelim;
--              __skb_unlink(skb, &tid->buf_q);
-+              __skb_unlink(skb, tid_q);
-               list_add_tail(&bf->list, bf_q);
-               if (bf_prev)
-                       bf_prev->bf_next = bf;
-               bf_prev = bf;
--      } while (!skb_queue_empty(&tid->buf_q));
-+              bf = ath_tx_get_tid_subframe(sc, txq, tid, &tid_q);
-+              if (!bf) {
-+                      closed = true;
+-      pll = ath9k_hw_compute_pll_control(ah, chan);
+       if (AR_SREV_9565(ah))
+               pll |= 0x40000;
+       REG_WRITE(ah, AR_RTC_PLL_CONTROL, pll);
+@@ -1192,9 +1192,12 @@ static void ath9k_hw_set_operating_mode(
+       switch (opmode) {
+       case NL80211_IFTYPE_ADHOC:
+-              set |= AR_STA_ID1_ADHOC;
+-              REG_SET_BIT(ah, AR_CFG, AR_CFG_AP_ADHOC_INDICATION);
+-              break;
++              if (!AR_SREV_9340_13(ah)) {
++                      set |= AR_STA_ID1_ADHOC;
++                      REG_SET_BIT(ah, AR_CFG, AR_CFG_AP_ADHOC_INDICATION);
 +                      break;
 +              }
-+      } while (ath_tid_has_buffered(tid));
-+
-+      bf = bf_first;
-+      bf->bf_lastbf = bf_prev;
-+
-+      if (bf == bf_prev) {
-+              al = get_frame_info(bf->bf_mpdu)->framelen;
-+              bf->bf_state.bf_type = BUF_AMPDU;
-+      } else {
-+              TX_STAT_INC(txq->axq_qnum, a_aggr);
-+      }
-       *aggr_len = al;
--      return status;
-+      return closed;
- #undef PADBYTES
- }
-@@ -1188,53 +1275,86 @@ static void ath_tx_fill_desc(struct ath_
-       }
++              /* fall through */
+       case NL80211_IFTYPE_MESH_POINT:
+       case NL80211_IFTYPE_AP:
+               set |= AR_STA_ID1_STA_AP;
+--- a/drivers/net/wireless/ath/ath9k/reg.h
++++ b/drivers/net/wireless/ath/ath9k/reg.h
+@@ -903,6 +903,10 @@
+ #define AR_SREV_9340(_ah) \
+       (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9340))
++#define AR_SREV_9340_13(_ah) \
++      (AR_SREV_9340((_ah)) && \
++       ((_ah)->hw_version.macRev == AR_SREV_REVISION_9340_13))
++
+ #define AR_SREV_9340_13_OR_LATER(_ah) \
+       (AR_SREV_9340((_ah)) && \
+        ((_ah)->hw_version.macRev >= AR_SREV_REVISION_9340_13))
+@@ -1240,12 +1244,23 @@ enum {
+ #define AR_CH0_DPLL3_PHASE_SHIFT_S   23
+ #define AR_PHY_CCA_NOM_VAL_2GHZ      -118
++#define AR_RTC_9300_SOC_PLL_DIV_INT          0x0000003f
++#define AR_RTC_9300_SOC_PLL_DIV_INT_S        0
++#define AR_RTC_9300_SOC_PLL_DIV_FRAC         0x000fffc0
++#define AR_RTC_9300_SOC_PLL_DIV_FRAC_S       6
++#define AR_RTC_9300_SOC_PLL_REFDIV           0x01f00000
++#define AR_RTC_9300_SOC_PLL_REFDIV_S         20
++#define AR_RTC_9300_SOC_PLL_CLKSEL           0x06000000
++#define AR_RTC_9300_SOC_PLL_CLKSEL_S         25
++#define AR_RTC_9300_SOC_PLL_BYPASS           0x08000000
++
+ #define AR_RTC_9300_PLL_DIV          0x000003ff
+ #define AR_RTC_9300_PLL_DIV_S        0
+ #define AR_RTC_9300_PLL_REFDIV       0x00003C00
+ #define AR_RTC_9300_PLL_REFDIV_S     10
+ #define AR_RTC_9300_PLL_CLKSEL       0x0000C000
+ #define AR_RTC_9300_PLL_CLKSEL_S     14
++#define AR_RTC_9300_PLL_BYPASS       0x00010000
+ #define AR_RTC_9160_PLL_DIV   0x000003ff
+ #define AR_RTC_9160_PLL_DIV_S   0
+--- a/drivers/net/wireless/ath/ath9k/ar5008_phy.c
++++ b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
+@@ -1004,9 +1004,11 @@ static bool ar5008_hw_ani_control_new(st
+       case ATH9K_ANI_FIRSTEP_LEVEL:{
+               u32 level = param;
+-              value = level;
++              value = level * 2;
+               REG_RMW_FIELD(ah, AR_PHY_FIND_SIG,
+                             AR_PHY_FIND_SIG_FIRSTEP, value);
++              REG_RMW_FIELD(ah, AR_PHY_FIND_SIG_LOW,
++                            AR_PHY_FIND_SIG_FIRSTEP_LOW, value);
+               if (level != aniState->firstepLevel) {
+                       ath_dbg(common, ANI,
+@@ -1040,9 +1042,8 @@ static bool ar5008_hw_ani_control_new(st
+               REG_RMW_FIELD(ah, AR_PHY_TIMING5,
+                             AR_PHY_TIMING5_CYCPWR_THR1, value);
+-              if (IS_CHAN_HT40(ah->curchan))
+-                      REG_RMW_FIELD(ah, AR_PHY_EXT_CCA,
+-                                    AR_PHY_EXT_TIMING5_CYCPWR_THR1, value);
++              REG_RMW_FIELD(ah, AR_PHY_EXT_CCA,
++                                AR_PHY_EXT_TIMING5_CYCPWR_THR1, value - 1);
+               if (level != aniState->spurImmunityLevel) {
+                       ath_dbg(common, ANI,
+--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
++++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
+@@ -517,6 +517,23 @@ static void ar9003_hw_spur_mitigate(stru
+       ar9003_hw_spur_mitigate_ofdm(ah, chan);
  }
  
--static void ath_tx_sched_aggr(struct ath_softc *sc, struct ath_txq *txq,
--                            struct ath_atx_tid *tid)
-+static void
-+ath_tx_form_burst(struct ath_softc *sc, struct ath_txq *txq,
-+                struct ath_atx_tid *tid, struct list_head *bf_q,
-+                struct ath_buf *bf_first, struct sk_buff_head *tid_q)
- {
--      struct ath_buf *bf;
--      enum ATH_AGGR_STATUS status;
--      struct ieee80211_tx_info *tx_info;
--      struct list_head bf_q;
--      int aggr_len;
-+      struct ath_buf *bf = bf_first, *bf_prev = NULL;
-+      struct sk_buff *skb;
-+      int nframes = 0;
-       do {
--              if (skb_queue_empty(&tid->buf_q))
--                      return;
-+              struct ieee80211_tx_info *tx_info;
-+              skb = bf->bf_mpdu;
--              INIT_LIST_HEAD(&bf_q);
-+              nframes++;
-+              __skb_unlink(skb, tid_q);
-+              list_add_tail(&bf->list, bf_q);
-+              if (bf_prev)
-+                      bf_prev->bf_next = bf;
-+              bf_prev = bf;
--              status = ath_tx_form_aggr(sc, txq, tid, &bf_q, &aggr_len);
-+              if (nframes >= 2)
-+                      break;
--              /*
--               * no frames picked up to be aggregated;
--               * block-ack window is not open.
--               */
--              if (list_empty(&bf_q))
-+              bf = ath_tx_get_tid_subframe(sc, txq, tid, &tid_q);
-+              if (!bf)
-                       break;
--              bf = list_first_entry(&bf_q, struct ath_buf, list);
--              bf->bf_lastbf = list_entry(bf_q.prev, struct ath_buf, list);
-               tx_info = IEEE80211_SKB_CB(bf->bf_mpdu);
-+              if (tx_info->flags & IEEE80211_TX_CTL_AMPDU)
-+                      break;
--              if (tid->ac->clear_ps_filter) {
--                      tid->ac->clear_ps_filter = false;
--                      tx_info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT;
--              } else {
--                      tx_info->flags &= ~IEEE80211_TX_CTL_CLEAR_PS_FILT;
--              }
-+              ath_set_rates(tid->an->vif, tid->an->sta, bf);
-+      } while (1);
-+}
--              /* if only one frame, send as non-aggregate */
--              if (bf == bf->bf_lastbf) {
--                      aggr_len = get_frame_info(bf->bf_mpdu)->framelen;
--                      bf->bf_state.bf_type = BUF_AMPDU;
--              } else {
--                      TX_STAT_INC(txq->axq_qnum, a_aggr);
--              }
-+static bool ath_tx_sched_aggr(struct ath_softc *sc, struct ath_txq *txq,
-+                            struct ath_atx_tid *tid, bool *stop)
++static u32 ar9003_hw_compute_pll_control_soc(struct ath_hw *ah,
++                                           struct ath9k_channel *chan)
 +{
-+      struct ath_buf *bf;
-+      struct ieee80211_tx_info *tx_info;
-+      struct sk_buff_head *tid_q;
-+      struct list_head bf_q;
-+      int aggr_len = 0;
-+      bool aggr, last = true;
-+
-+      if (!ath_tid_has_buffered(tid))
-+              return false;
-+
-+      INIT_LIST_HEAD(&bf_q);
++      u32 pll;
 +
-+      bf = ath_tx_get_tid_subframe(sc, txq, tid, &tid_q);
-+      if (!bf)
-+              return false;
++      pll = SM(0x5, AR_RTC_9300_SOC_PLL_REFDIV);
 +
-+      tx_info = IEEE80211_SKB_CB(bf->bf_mpdu);
-+      aggr = !!(tx_info->flags & IEEE80211_TX_CTL_AMPDU);
-+      if ((aggr && txq->axq_ampdu_depth >= ATH_AGGR_MIN_QDEPTH) ||
-+              (!aggr && txq->axq_depth >= ATH_NON_AGGR_MIN_QDEPTH)) {
-+              *stop = true;
-+              return false;
-+      }
++      if (chan && IS_CHAN_HALF_RATE(chan))
++              pll |= SM(0x1, AR_RTC_9300_SOC_PLL_CLKSEL);
++      else if (chan && IS_CHAN_QUARTER_RATE(chan))
++              pll |= SM(0x2, AR_RTC_9300_SOC_PLL_CLKSEL);
 +
-+      ath_set_rates(tid->an->vif, tid->an->sta, bf);
-+      if (aggr)
-+              last = ath_tx_form_aggr(sc, txq, tid, &bf_q, bf,
-+                                      tid_q, &aggr_len);
-+      else
-+              ath_tx_form_burst(sc, txq, tid, &bf_q, bf, tid_q);
--              ath_tx_fill_desc(sc, bf, txq, aggr_len);
--              ath_tx_txqaddbuf(sc, txq, &bf_q, false);
--      } while (txq->axq_ampdu_depth < ATH_AGGR_MIN_QDEPTH &&
--               status != ATH_AGGR_BAW_CLOSED);
-+      if (list_empty(&bf_q))
-+              return false;
++      pll |= SM(0x2c, AR_RTC_9300_SOC_PLL_DIV_INT);
 +
-+      if (tid->ac->clear_ps_filter || tid->an->no_ps_filter) {
-+              tid->ac->clear_ps_filter = false;
-+              tx_info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT;
-+      }
++      return pll;
++}
 +
-+      ath_tx_fill_desc(sc, bf, txq, aggr_len);
-+      ath_tx_txqaddbuf(sc, txq, &bf_q, false);
-+      return true;
- }
- int ath_tx_aggr_start(struct ath_softc *sc, struct ieee80211_sta *sta,
-@@ -1258,6 +1378,9 @@ int ath_tx_aggr_start(struct ath_softc *
-               an->mpdudensity = density;
-       }
-+      /* force sequence number allocation for pending frames */
-+      ath_tx_tid_change_state(sc, txtid);
-+
-       txtid->active = true;
-       txtid->paused = true;
-       *ssn = txtid->seq_start = txtid->seq_next;
-@@ -1277,8 +1400,9 @@ void ath_tx_aggr_stop(struct ath_softc *
-       ath_txq_lock(sc, txq);
-       txtid->active = false;
--      txtid->paused = true;
-+      txtid->paused = false;
-       ath_tx_flush_tid(sc, txtid);
-+      ath_tx_tid_change_state(sc, txtid);
-       ath_txq_unlock_complete(sc, txq);
- }
-@@ -1302,7 +1426,7 @@ void ath_tx_aggr_sleep(struct ieee80211_
-               ath_txq_lock(sc, txq);
--              buffered = !skb_queue_empty(&tid->buf_q);
-+              buffered = ath_tid_has_buffered(tid);
-               tid->sched = false;
-               list_del(&tid->list);
-@@ -1334,7 +1458,7 @@ void ath_tx_aggr_wakeup(struct ath_softc
-               ath_txq_lock(sc, txq);
-               ac->clear_ps_filter = true;
--              if (!skb_queue_empty(&tid->buf_q) && !tid->paused) {
-+              if (!tid->paused && ath_tid_has_buffered(tid)) {
-                       ath_tx_queue_tid(txq, tid);
-                       ath_txq_schedule(sc, txq);
-               }
-@@ -1359,7 +1483,7 @@ void ath_tx_aggr_resume(struct ath_softc
-       tid->baw_size = IEEE80211_MIN_AMPDU_BUF << sta->ht_cap.ampdu_factor;
-       tid->paused = false;
--      if (!skb_queue_empty(&tid->buf_q)) {
-+      if (ath_tid_has_buffered(tid)) {
-               ath_tx_queue_tid(txq, tid);
-               ath_txq_schedule(sc, txq);
-       }
-@@ -1379,6 +1503,7 @@ void ath9k_release_buffered_frames(struc
-       struct ieee80211_tx_info *info;
-       struct list_head bf_q;
-       struct ath_buf *bf_tail = NULL, *bf;
-+      struct sk_buff_head *tid_q;
-       int sent = 0;
-       int i;
-@@ -1394,15 +1519,15 @@ void ath9k_release_buffered_frames(struc
-                       continue;
-               ath_txq_lock(sc, tid->ac->txq);
--              while (!skb_queue_empty(&tid->buf_q) && nframes > 0) {
--                      bf = ath_tx_get_tid_subframe(sc, sc->tx.uapsdq, tid);
-+              while (nframes > 0) {
-+                      bf = ath_tx_get_tid_subframe(sc, sc->tx.uapsdq, tid, &tid_q);
-                       if (!bf)
-                               break;
--                      __skb_unlink(bf->bf_mpdu, &tid->buf_q);
-+                      __skb_unlink(bf->bf_mpdu, tid_q);
-                       list_add_tail(&bf->list, &bf_q);
-                       ath_set_rates(tid->an->vif, tid->an->sta, bf);
--                      ath_tx_addto_baw(sc, tid, bf->bf_state.seqno);
-+                      ath_tx_addto_baw(sc, tid, bf);
-                       bf->bf_state.bf_type &= ~BUF_AGGR;
-                       if (bf_tail)
-                               bf_tail->bf_next = bf;
-@@ -1412,7 +1537,7 @@ void ath9k_release_buffered_frames(struc
-                       sent++;
-                       TX_STAT_INC(txq->axq_qnum, a_queued_hw);
--                      if (skb_queue_empty(&tid->buf_q))
-+                      if (an->sta && !ath_tid_has_buffered(tid))
-                               ieee80211_sta_set_buffered(an->sta, i, false);
-               }
-               ath_txq_unlock_complete(sc, tid->ac->txq);
-@@ -1571,7 +1696,7 @@ static void ath_drain_txq_list(struct at
-       while (!list_empty(list)) {
-               bf = list_first_entry(list, struct ath_buf, list);
--              if (bf->bf_stale) {
-+              if (bf->bf_state.stale) {
-                       list_del(&bf->list);
-                       ath_tx_return_buffer(sc, bf);
-@@ -1665,25 +1790,27 @@ void ath_tx_cleanupq(struct ath_softc *s
-  */
- void ath_txq_schedule(struct ath_softc *sc, struct ath_txq *txq)
+ static u32 ar9003_hw_compute_pll_control(struct ath_hw *ah,
+                                        struct ath9k_channel *chan)
  {
--      struct ath_atx_ac *ac, *ac_tmp, *last_ac;
-+      struct ath_atx_ac *ac, *last_ac;
-       struct ath_atx_tid *tid, *last_tid;
-+      bool sent = false;
-       if (test_bit(SC_OP_HW_RESET, &sc->sc_flags) ||
--          list_empty(&txq->axq_acq) ||
--          txq->axq_ampdu_depth >= ATH_AGGR_MIN_QDEPTH)
-+          list_empty(&txq->axq_acq))
-               return;
-       rcu_read_lock();
--      ac = list_first_entry(&txq->axq_acq, struct ath_atx_ac, list);
-       last_ac = list_entry(txq->axq_acq.prev, struct ath_atx_ac, list);
-+      while (!list_empty(&txq->axq_acq)) {
-+              bool stop = false;
--      list_for_each_entry_safe(ac, ac_tmp, &txq->axq_acq, list) {
-+              ac = list_first_entry(&txq->axq_acq, struct ath_atx_ac, list);
-               last_tid = list_entry(ac->tid_q.prev, struct ath_atx_tid, list);
-               list_del(&ac->list);
-               ac->sched = false;
-               while (!list_empty(&ac->tid_q)) {
-+
-                       tid = list_first_entry(&ac->tid_q, struct ath_atx_tid,
-                                              list);
-                       list_del(&tid->list);
-@@ -1692,17 +1819,17 @@ void ath_txq_schedule(struct ath_softc *
-                       if (tid->paused)
-                               continue;
--                      ath_tx_sched_aggr(sc, txq, tid);
-+                      if (ath_tx_sched_aggr(sc, txq, tid, &stop))
-+                              sent = true;
-                       /*
-                        * add tid to round-robin queue if more frames
-                        * are pending for the tid
-                        */
--                      if (!skb_queue_empty(&tid->buf_q))
-+                      if (ath_tid_has_buffered(tid))
-                               ath_tx_queue_tid(txq, tid);
--                      if (tid == last_tid ||
--                          txq->axq_ampdu_depth >= ATH_AGGR_MIN_QDEPTH)
-+                      if (stop || tid == last_tid)
-                               break;
-               }
-@@ -1711,9 +1838,17 @@ void ath_txq_schedule(struct ath_softc *
-                       list_add_tail(&ac->list, &txq->axq_acq);
-               }
+@@ -1781,7 +1798,12 @@ void ar9003_hw_attach_phy_ops(struct ath
  
--              if (ac == last_ac ||
--                  txq->axq_ampdu_depth >= ATH_AGGR_MIN_QDEPTH)
-+              if (stop)
-                       break;
+       priv_ops->rf_set_freq = ar9003_hw_set_channel;
+       priv_ops->spur_mitigate_freq = ar9003_hw_spur_mitigate;
+-      priv_ops->compute_pll_control = ar9003_hw_compute_pll_control;
 +
-+              if (ac == last_ac) {
-+                      if (!sent)
-+                              break;
-+
-+                      sent = false;
-+                      last_ac = list_entry(txq->axq_acq.prev,
-+                                           struct ath_atx_ac, list);
-+              }
-       }
-       rcu_read_unlock();
-@@ -1792,57 +1927,6 @@ static void ath_tx_txqaddbuf(struct ath_
-       }
- }
--static void ath_tx_send_ampdu(struct ath_softc *sc, struct ath_txq *txq,
--                            struct ath_atx_tid *tid, struct sk_buff *skb,
--                            struct ath_tx_control *txctl)
--{
--      struct ath_frame_info *fi = get_frame_info(skb);
--      struct list_head bf_head;
--      struct ath_buf *bf;
--
--      /*
--       * Do not queue to h/w when any of the following conditions is true:
--       * - there are pending frames in software queue
--       * - the TID is currently paused for ADDBA/BAR request
--       * - seqno is not within block-ack window
--       * - h/w queue depth exceeds low water mark
--       */
--      if ((!skb_queue_empty(&tid->buf_q) || tid->paused ||
--           !BAW_WITHIN(tid->seq_start, tid->baw_size, tid->seq_next) ||
--           txq->axq_ampdu_depth >= ATH_AGGR_MIN_QDEPTH) &&
--          txq != sc->tx.uapsdq) {
--              /*
--               * Add this frame to software queue for scheduling later
--               * for aggregation.
--               */
--              TX_STAT_INC(txq->axq_qnum, a_queued_sw);
--              __skb_queue_tail(&tid->buf_q, skb);
--              if (!txctl->an || !txctl->an->sleeping)
--                      ath_tx_queue_tid(txq, tid);
--              return;
--      }
--
--      bf = ath_tx_setup_buffer(sc, txq, tid, skb);
--      if (!bf) {
--              ieee80211_free_txskb(sc->hw, skb);
--              return;
--      }
--
--      ath_set_rates(tid->an->vif, tid->an->sta, bf);
--      bf->bf_state.bf_type = BUF_AMPDU;
--      INIT_LIST_HEAD(&bf_head);
--      list_add(&bf->list, &bf_head);
--
--      /* Add sub-frame to BAW */
--      ath_tx_addto_baw(sc, tid, bf->bf_state.seqno);
--
--      /* Queue to h/w without aggregation */
--      TX_STAT_INC(txq->axq_qnum, a_queued_hw);
--      bf->bf_lastbf = bf;
--      ath_tx_fill_desc(sc, bf, txq, fi->framelen);
--      ath_tx_txqaddbuf(sc, txq, &bf_head, false);
--}
--
- static void ath_tx_send_normal(struct ath_softc *sc, struct ath_txq *txq,
-                              struct ath_atx_tid *tid, struct sk_buff *skb)
- {
-@@ -1985,6 +2069,7 @@ static int ath_tx_prepare(struct ieee802
-       struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-       struct ieee80211_sta *sta = txctl->sta;
-       struct ieee80211_vif *vif = info->control.vif;
-+      struct ath_vif *avp;
-       struct ath_softc *sc = hw->priv;
-       int frmlen = skb->len + FCS_LEN;
-       int padpos, padsize;
-@@ -1992,6 +2077,10 @@ static int ath_tx_prepare(struct ieee802
-       /* NOTE:  sta can be NULL according to net/mac80211.h */
-       if (sta)
-               txctl->an = (struct ath_node *)sta->drv_priv;
-+      else if (vif && ieee80211_is_data(hdr->frame_control)) {
-+              avp = (void *)vif->drv_priv;
-+              txctl->an = &avp->mcast_node;
-+      }
-       if (info->control.hw_key)
-               frmlen += info->control.hw_key->icv_len;
-@@ -2041,7 +2130,6 @@ int ath_tx_start(struct ieee80211_hw *hw
-       struct ath_txq *txq = txctl->txq;
-       struct ath_atx_tid *tid = NULL;
-       struct ath_buf *bf;
--      u8 tidno;
-       int q;
-       int ret;
-@@ -2069,27 +2157,31 @@ int ath_tx_start(struct ieee80211_hw *hw
-               ath_txq_unlock(sc, txq);
-               txq = sc->tx.uapsdq;
-               ath_txq_lock(sc, txq);
--      }
--
--      if (txctl->an && ieee80211_is_data_qos(hdr->frame_control)) {
--              tidno = ieee80211_get_qos_ctl(hdr)[0] &
--                      IEEE80211_QOS_CTL_TID_MASK;
--              tid = ATH_AN_2_TID(txctl->an, tidno);
-+      } else if (txctl->an &&
-+                 ieee80211_is_data_present(hdr->frame_control)) {
-+              tid = ath_get_skb_tid(sc, txctl->an, skb);
-               WARN_ON(tid->ac->txq != txctl->txq);
--      }
--      if ((info->flags & IEEE80211_TX_CTL_AMPDU) && tid) {
-+              if (info->flags & IEEE80211_TX_CTL_CLEAR_PS_FILT)
-+                      tid->ac->clear_ps_filter = true;
-+
-               /*
--               * Try aggregation if it's a unicast data frame
--               * and the destination is HT capable.
-+               * Add this frame to software queue for scheduling later
-+               * for aggregation.
-                */
--              ath_tx_send_ampdu(sc, txq, tid, skb, txctl);
-+              TX_STAT_INC(txq->axq_qnum, a_queued_sw);
-+              __skb_queue_tail(&tid->buf_q, skb);
-+              if (!txctl->an->sleeping)
-+                      ath_tx_queue_tid(txq, tid);
-+
-+              ath_txq_schedule(sc, txq);
-               goto out;
-       }
-       bf = ath_tx_setup_buffer(sc, txq, tid, skb);
-       if (!bf) {
-+              ath_txq_skb_done(sc, txq, skb);
-               if (txctl->paprd)
-                       dev_kfree_skb_any(skb);
-               else
-@@ -2189,7 +2281,7 @@ static void ath_tx_complete(struct ath_s
-       struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
-       struct ath_common *common = ath9k_hw_common(sc->sc_ah);
-       struct ieee80211_hdr * hdr = (struct ieee80211_hdr *)skb->data;
--      int q, padpos, padsize;
-+      int padpos, padsize;
-       unsigned long flags;
-       ath_dbg(common, XMIT, "TX complete: skb: %p\n", skb);
-@@ -2225,21 +2317,7 @@ static void ath_tx_complete(struct ath_s
-       spin_unlock_irqrestore(&sc->sc_pm_lock, flags);
-       __skb_queue_tail(&txq->complete_q, skb);
--
--      q = skb_get_queue_mapping(skb);
--      if (txq == sc->tx.uapsdq)
--              txq = sc->tx.txq_map[q];
--
--      if (txq == sc->tx.txq_map[q]) {
--              if (WARN_ON(--txq->pending_frames < 0))
--                      txq->pending_frames = 0;
++      if (AR_SREV_9340(ah) || AR_SREV_9550(ah) || AR_SREV_9531(ah))
++              priv_ops->compute_pll_control = ar9003_hw_compute_pll_control_soc;
++      else
++              priv_ops->compute_pll_control = ar9003_hw_compute_pll_control;
++
+       priv_ops->set_channel_regs = ar9003_hw_set_channel_regs;
+       priv_ops->init_bb = ar9003_hw_init_bb;
+       priv_ops->process_ini = ar9003_hw_process_ini;
+--- a/drivers/net/wireless/ath/ath9k/ar9002_mac.c
++++ b/drivers/net/wireless/ath/ath9k/ar9002_mac.c
+@@ -381,16 +381,27 @@ static int ar9002_hw_proc_txdesc(struct 
+       ts->evm1 = ads->AR_TxEVM1;
+       ts->evm2 = ads->AR_TxEVM2;
+-      status = ACCESS_ONCE(ads->ds_ctl4);
+-      ts->duration[0] = MS(status, AR_PacketDur0);
+-      ts->duration[1] = MS(status, AR_PacketDur1);
+-      status = ACCESS_ONCE(ads->ds_ctl5);
+-      ts->duration[2] = MS(status, AR_PacketDur2);
+-      ts->duration[3] = MS(status, AR_PacketDur3);
 -
--              if (txq->stopped &&
--                  txq->pending_frames < sc->tx.txq_max_pending[q]) {
--                      ieee80211_wake_queue(sc->hw, q);
--                      txq->stopped = false;
--              }
--      }
-+      ath_txq_skb_done(sc, txq, skb);
+       return 0;
  }
  
- static void ath_tx_complete_buf(struct ath_softc *sc, struct ath_buf *bf,
-@@ -2360,8 +2438,7 @@ static void ath_tx_processq(struct ath_s
-               if (list_empty(&txq->axq_q)) {
-                       txq->axq_link = NULL;
--                      if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_HT)
--                              ath_txq_schedule(sc, txq);
-+                      ath_txq_schedule(sc, txq);
-                       break;
-               }
-               bf = list_first_entry(&txq->axq_q, struct ath_buf, list);
-@@ -2375,7 +2452,7 @@ static void ath_tx_processq(struct ath_s
-                * it with the STALE flag.
-                */
-               bf_held = NULL;
--              if (bf->bf_stale) {
-+              if (bf->bf_state.stale) {
-                       bf_held = bf;
-                       if (list_is_last(&bf_held->list, &txq->axq_q))
-                               break;
-@@ -2399,7 +2476,7 @@ static void ath_tx_processq(struct ath_s
-                * however leave the last descriptor back as the holding
-                * descriptor for hw.
-                */
--              lastbf->bf_stale = true;
-+              lastbf->bf_state.stale = true;
-               INIT_LIST_HEAD(&bf_head);
-               if (!list_is_singular(&lastbf->list))
-                       list_cut_position(&bf_head,
-@@ -2470,7 +2547,7 @@ void ath_tx_edma_tasklet(struct ath_soft
-               }
-               bf = list_first_entry(fifo_list, struct ath_buf, list);
--              if (bf->bf_stale) {
-+              if (bf->bf_state.stale) {
-                       list_del(&bf->list);
-                       ath_tx_return_buffer(sc, bf);
-                       bf = list_first_entry(fifo_list, struct ath_buf, list);
-@@ -2492,7 +2569,7 @@ void ath_tx_edma_tasklet(struct ath_soft
-                               ath_tx_txqaddbuf(sc, txq, &bf_q, true);
-                       }
-               } else {
--                      lastbf->bf_stale = true;
-+                      lastbf->bf_state.stale = true;
-                       if (bf != lastbf)
-                               list_cut_position(&bf_head, fifo_list,
-                                                 lastbf->list.prev);
-@@ -2583,6 +2660,7 @@ void ath_tx_node_init(struct ath_softc *
-               tid->paused    = false;
-               tid->active        = false;
-               __skb_queue_head_init(&tid->buf_q);
-+              __skb_queue_head_init(&tid->retry_q);
-               acno = TID_TO_WME_AC(tidno);
-               tid->ac = &an->ac[acno];
-       }
-@@ -2590,6 +2668,7 @@ void ath_tx_node_init(struct ath_softc *
-       for (acno = 0, ac = &an->ac[acno];
-            acno < IEEE80211_NUM_ACS; acno++, ac++) {
-               ac->sched    = false;
-+              ac->clear_ps_filter = true;
-               ac->txq = sc->tx.txq_map[acno];
-               INIT_LIST_HEAD(&ac->tid_q);
-       }
---- a/drivers/net/wireless/ath/ath9k/main.c
-+++ b/drivers/net/wireless/ath/ath9k/main.c
-@@ -966,6 +966,8 @@ static int ath9k_add_interface(struct ie
-       struct ath_softc *sc = hw->priv;
-       struct ath_hw *ah = sc->sc_ah;
-       struct ath_common *common = ath9k_hw_common(ah);
-+      struct ath_vif *avp = (void *)vif->drv_priv;
-+      struct ath_node *an = &avp->mcast_node;
-       mutex_lock(&sc->mutex);
-@@ -979,6 +981,12 @@ static int ath9k_add_interface(struct ie
-       if (ath9k_uses_beacons(vif->type))
-               ath9k_beacon_assign_slot(sc, vif);
-+      an->sc = sc;
-+      an->sta = NULL;
-+      an->vif = vif;
-+      an->no_ps_filter = true;
-+      ath_tx_node_init(sc, an);
++static int ar9002_hw_get_duration(struct ath_hw *ah, const void *ds, int index)
++{
++      struct ar5416_desc *ads = AR5416DESC(ds);
++
++      switch (index) {
++      case 0:
++              return MS(ACCESS_ONCE(ads->ds_ctl4), AR_PacketDur0);
++      case 1:
++              return MS(ACCESS_ONCE(ads->ds_ctl4), AR_PacketDur1);
++      case 2:
++              return MS(ACCESS_ONCE(ads->ds_ctl5), AR_PacketDur2);
++      case 3:
++              return MS(ACCESS_ONCE(ads->ds_ctl5), AR_PacketDur3);
++      default:
++              return -1;
++      }
++}
 +
-       mutex_unlock(&sc->mutex);
-       return 0;
+ void ath9k_hw_setuprxdesc(struct ath_hw *ah, struct ath_desc *ds,
+                         u32 size, u32 flags)
+ {
+@@ -413,4 +424,5 @@ void ar9002_hw_attach_mac_ops(struct ath
+       ops->get_isr = ar9002_hw_get_isr;
+       ops->set_txdesc = ar9002_set_txdesc;
+       ops->proc_txdesc = ar9002_hw_proc_txdesc;
++      ops->get_duration = ar9002_hw_get_duration;
  }
-@@ -1016,6 +1024,7 @@ static void ath9k_remove_interface(struc
+--- a/drivers/net/wireless/ath/ath9k/ar9003_mac.c
++++ b/drivers/net/wireless/ath/ath9k/ar9003_mac.c
+@@ -355,11 +355,9 @@ static int ar9003_hw_proc_txdesc(struct 
+                                struct ath_tx_status *ts)
  {
-       struct ath_softc *sc = hw->priv;
-       struct ath_common *common = ath9k_hw_common(sc->sc_ah);
-+      struct ath_vif *avp = (void *)vif->drv_priv;
-       ath_dbg(common, CONFIG, "Detach Interface\n");
+       struct ar9003_txs *ads;
+-      struct ar9003_txc *adc;
+       u32 status;
+       ads = &ah->ts_ring[ah->ts_tail];
+-      adc = (struct ar9003_txc *)ads;
+       status = ACCESS_ONCE(ads->status8);
+       if ((status & AR_TxDone) == 0)
+@@ -428,18 +426,29 @@ static int ar9003_hw_proc_txdesc(struct 
+       ts->ts_rssi_ext1 = MS(status, AR_TxRSSIAnt11);
+       ts->ts_rssi_ext2 = MS(status, AR_TxRSSIAnt12);
+-      status = ACCESS_ONCE(adc->ctl15);
+-      ts->duration[0] = MS(status, AR_PacketDur0);
+-      ts->duration[1] = MS(status, AR_PacketDur1);
+-      status = ACCESS_ONCE(adc->ctl16);
+-      ts->duration[2] = MS(status, AR_PacketDur2);
+-      ts->duration[3] = MS(status, AR_PacketDur3);
+-
+       memset(ads, 0, sizeof(*ads));
  
-@@ -1030,6 +1039,8 @@ static void ath9k_remove_interface(struc
-       ath9k_calculate_summary_state(hw, NULL);
-       ath9k_ps_restore(sc);
+       return 0;
+ }
  
-+      ath_tx_node_cleanup(sc, &avp->mcast_node);
++static int ar9003_hw_get_duration(struct ath_hw *ah, const void *ds, int index)
++{
++      const struct ar9003_txc *adc = ds;
++
++      switch (index) {
++      case 0:
++              return MS(ACCESS_ONCE(adc->ctl15), AR_PacketDur0);
++      case 1:
++              return MS(ACCESS_ONCE(adc->ctl15), AR_PacketDur1);
++      case 2:
++              return MS(ACCESS_ONCE(adc->ctl16), AR_PacketDur2);
++      case 3:
++              return MS(ACCESS_ONCE(adc->ctl16), AR_PacketDur3);
++      default:
++              return 0;
++      }
++}
 +
-       mutex_unlock(&sc->mutex);
+ void ar9003_hw_attach_mac_ops(struct ath_hw *hw)
+ {
+       struct ath_hw_ops *ops = ath9k_hw_ops(hw);
+@@ -449,6 +458,7 @@ void ar9003_hw_attach_mac_ops(struct ath
+       ops->get_isr = ar9003_hw_get_isr;
+       ops->set_txdesc = ar9003_set_txdesc;
+       ops->proc_txdesc = ar9003_hw_proc_txdesc;
++      ops->get_duration = ar9003_hw_get_duration;
  }
  
-@@ -1374,9 +1385,6 @@ static void ath9k_sta_notify(struct ieee
-       struct ath_softc *sc = hw->priv;
-       struct ath_node *an = (struct ath_node *) sta->drv_priv;
+ void ath9k_hw_set_rx_bufsize(struct ath_hw *ah, u16 buf_size)
+--- a/drivers/net/wireless/ath/ath9k/dynack.c
++++ b/drivers/net/wireless/ath/ath9k/dynack.c
+@@ -202,7 +202,7 @@ void ath_dynack_sample_tx_ts(struct ath_
+       ridx = ts->ts_rateindex;
+       da->st_rbf.ts[da->st_rbf.t_rb].tstamp = ts->ts_tstamp;
+-      da->st_rbf.ts[da->st_rbf.t_rb].dur = ts->duration[ts->ts_rateindex];
++      da->st_rbf.ts[da->st_rbf.t_rb].dur = ts->duration;
+       ether_addr_copy(da->st_rbf.addr[da->st_rbf.t_rb].h_dest, hdr->addr1);
+       ether_addr_copy(da->st_rbf.addr[da->st_rbf.t_rb].h_src, hdr->addr2);
+--- a/drivers/net/wireless/ath/ath9k/hw-ops.h
++++ b/drivers/net/wireless/ath/ath9k/hw-ops.h
+@@ -67,6 +67,12 @@ static inline int ath9k_hw_txprocdesc(st
+       return ath9k_hw_ops(ah)->proc_txdesc(ah, ds, ts);
+ }
  
--      if (!sta->ht_cap.ht_supported)
--              return;
--
-       switch (cmd) {
-       case STA_NOTIFY_SLEEP:
-               an->sleeping = true;
-@@ -2094,7 +2102,7 @@ static void ath9k_wow_add_pattern(struct
- {
-       struct ath_hw *ah = sc->sc_ah;
-       struct ath9k_wow_pattern *wow_pattern = NULL;
--      struct cfg80211_wowlan_trig_pkt_pattern *patterns = wowlan->patterns;
-+      struct cfg80211_pkt_pattern *patterns = wowlan->patterns;
-       int mask_len;
-       s8 i = 0;
---- a/drivers/net/wireless/mwifiex/cfg80211.c
-+++ b/drivers/net/wireless/mwifiex/cfg80211.c
-@@ -2298,8 +2298,7 @@ EXPORT_SYMBOL_GPL(mwifiex_del_virtual_in
- #ifdef CONFIG_PM
- static bool
--mwifiex_is_pattern_supported(struct cfg80211_wowlan_trig_pkt_pattern *pat,
--                           s8 *byte_seq)
-+mwifiex_is_pattern_supported(struct cfg80211_pkt_pattern *pat, s8 *byte_seq)
- {
-       int j, k, valid_byte_cnt = 0;
-       bool dont_care_byte = false;
---- a/drivers/net/wireless/ti/wlcore/main.c
-+++ b/drivers/net/wireless/ti/wlcore/main.c
-@@ -1315,7 +1315,7 @@ static struct sk_buff *wl12xx_alloc_dumm
- #ifdef CONFIG_PM
- static int
--wl1271_validate_wowlan_pattern(struct cfg80211_wowlan_trig_pkt_pattern *p)
-+wl1271_validate_wowlan_pattern(struct cfg80211_pkt_pattern *p)
- {
-       int num_fields = 0, in_field = 0, fields_size = 0;
-       int i, pattern_len = 0;
-@@ -1458,9 +1458,9 @@ void wl1271_rx_filter_flatten_fields(str
-  * Allocates an RX filter returned through f
-  * which needs to be freed using rx_filter_free()
-  */
--static int wl1271_convert_wowlan_pattern_to_rx_filter(
--      struct cfg80211_wowlan_trig_pkt_pattern *p,
--      struct wl12xx_rx_filter **f)
-+static int
-+wl1271_convert_wowlan_pattern_to_rx_filter(struct cfg80211_pkt_pattern *p,
-+                                         struct wl12xx_rx_filter **f)
++static inline int ath9k_hw_get_duration(struct ath_hw *ah, const void *ds,
++                                      int index)
++{
++      return ath9k_hw_ops(ah)->get_duration(ah, ds, index);
++}
++
+ static inline void ath9k_hw_antdiv_comb_conf_get(struct ath_hw *ah,
+               struct ath_hw_antcomb_conf *antconf)
  {
-       int i, j, ret = 0;
-       struct wl12xx_rx_filter *filter;
-@@ -1562,7 +1562,7 @@ static int wl1271_configure_wowlan(struc
-       /* Translate WoWLAN patterns into filters */
-       for (i = 0; i < wow->n_patterns; i++) {
--              struct cfg80211_wowlan_trig_pkt_pattern *p;
-+              struct cfg80211_pkt_pattern *p;
-               struct wl12xx_rx_filter *filter = NULL;
-               p = &wow->patterns[i];
---- a/include/net/cfg80211.h
-+++ b/include/net/cfg80211.h
-@@ -1698,7 +1698,7 @@ struct cfg80211_pmksa {
+--- a/drivers/net/wireless/ath/ath9k/hw.h
++++ b/drivers/net/wireless/ath/ath9k/hw.h
+@@ -691,6 +691,7 @@ struct ath_hw_ops {
+                          struct ath_tx_info *i);
+       int (*proc_txdesc)(struct ath_hw *ah, void *ds,
+                          struct ath_tx_status *ts);
++      int (*get_duration)(struct ath_hw *ah, const void *ds, int index);
+       void (*antdiv_comb_conf_get)(struct ath_hw *ah,
+                       struct ath_hw_antcomb_conf *antconf);
+       void (*antdiv_comb_conf_set)(struct ath_hw *ah,
+--- a/drivers/net/wireless/ath/ath9k/mac.h
++++ b/drivers/net/wireless/ath/ath9k/mac.h
+@@ -121,7 +121,7 @@ struct ath_tx_status {
+       u32 evm0;
+       u32 evm1;
+       u32 evm2;
+-      u32 duration[4];
++      u32 duration;
  };
  
- /**
-- * struct cfg80211_wowlan_trig_pkt_pattern - packet pattern
-+ * struct cfg80211_pkt_pattern - packet pattern
-  * @mask: bitmask where to match pattern and where to ignore bytes,
-  *    one bit per byte, in same format as nl80211
-  * @pattern: bytes to match where bitmask is 1
-@@ -1708,7 +1708,7 @@ struct cfg80211_pmksa {
-  * Internal note: @mask and @pattern are allocated in one chunk of
-  * memory, free @mask only!
-  */
--struct cfg80211_wowlan_trig_pkt_pattern {
-+struct cfg80211_pkt_pattern {
-       u8 *mask, *pattern;
-       int pattern_len;
-       int pkt_offset;
-@@ -1770,7 +1770,7 @@ struct cfg80211_wowlan {
-       bool any, disconnect, magic_pkt, gtk_rekey_failure,
-            eap_identity_req, four_way_handshake,
-            rfkill_release;
--      struct cfg80211_wowlan_trig_pkt_pattern *patterns;
-+      struct cfg80211_pkt_pattern *patterns;
-       struct cfg80211_wowlan_tcp *tcp;
-       int n_patterns;
- };
---- a/include/uapi/linux/nl80211.h
-+++ b/include/uapi/linux/nl80211.h
-@@ -3060,11 +3060,11 @@ enum nl80211_tx_power_setting {
- };
- /**
-- * enum nl80211_wowlan_packet_pattern_attr - WoWLAN packet pattern attribute
-- * @__NL80211_WOWLAN_PKTPAT_INVALID: invalid number for nested attribute
-- * @NL80211_WOWLAN_PKTPAT_PATTERN: the pattern, values where the mask has
-+ * enum nl80211_packet_pattern_attr - packet pattern attribute
-+ * @__NL80211_PKTPAT_INVALID: invalid number for nested attribute
-+ * @NL80211_PKTPAT_PATTERN: the pattern, values where the mask has
-  *    a zero bit are ignored
-- * @NL80211_WOWLAN_PKTPAT_MASK: pattern mask, must be long enough to have
-+ * @NL80211_PKTPAT_MASK: pattern mask, must be long enough to have
-  *    a bit for each byte in the pattern. The lowest-order bit corresponds
-  *    to the first byte of the pattern, but the bytes of the pattern are
-  *    in a little-endian-like format, i.e. the 9th byte of the pattern
-@@ -3075,23 +3075,23 @@ enum nl80211_tx_power_setting {
-  *    Note that the pattern matching is done as though frames were not
-  *    802.11 frames but 802.3 frames, i.e. the frame is fully unpacked
-  *    first (including SNAP header unpacking) and then matched.
-- * @NL80211_WOWLAN_PKTPAT_OFFSET: packet offset, pattern is matched after
-+ * @NL80211_PKTPAT_OFFSET: packet offset, pattern is matched after
-  *    these fixed number of bytes of received packet
-- * @NUM_NL80211_WOWLAN_PKTPAT: number of attributes
-- * @MAX_NL80211_WOWLAN_PKTPAT: max attribute number
-+ * @NUM_NL80211_PKTPAT: number of attributes
-+ * @MAX_NL80211_PKTPAT: max attribute number
-  */
--enum nl80211_wowlan_packet_pattern_attr {
--      __NL80211_WOWLAN_PKTPAT_INVALID,
--      NL80211_WOWLAN_PKTPAT_MASK,
--      NL80211_WOWLAN_PKTPAT_PATTERN,
--      NL80211_WOWLAN_PKTPAT_OFFSET,
-+enum nl80211_packet_pattern_attr {
-+      __NL80211_PKTPAT_INVALID,
-+      NL80211_PKTPAT_MASK,
-+      NL80211_PKTPAT_PATTERN,
-+      NL80211_PKTPAT_OFFSET,
--      NUM_NL80211_WOWLAN_PKTPAT,
--      MAX_NL80211_WOWLAN_PKTPAT = NUM_NL80211_WOWLAN_PKTPAT - 1,
-+      NUM_NL80211_PKTPAT,
-+      MAX_NL80211_PKTPAT = NUM_NL80211_PKTPAT - 1,
- };
- /**
-- * struct nl80211_wowlan_pattern_support - pattern support information
-+ * struct nl80211_pattern_support - packet pattern support information
-  * @max_patterns: maximum number of patterns supported
-  * @min_pattern_len: minimum length of each pattern
-  * @max_pattern_len: maximum length of each pattern
-@@ -3101,13 +3101,22 @@ enum nl80211_wowlan_packet_pattern_attr 
-  * that is part of %NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED in the
-  * capability information given by the kernel to userspace.
-  */
--struct nl80211_wowlan_pattern_support {
-+struct nl80211_pattern_support {
-       __u32 max_patterns;
-       __u32 min_pattern_len;
-       __u32 max_pattern_len;
-       __u32 max_pkt_offset;
- } __attribute__((packed));
-+/* only for backward compatibility */
-+#define __NL80211_WOWLAN_PKTPAT_INVALID __NL80211_PKTPAT_INVALID
-+#define NL80211_WOWLAN_PKTPAT_MASK NL80211_PKTPAT_MASK
-+#define NL80211_WOWLAN_PKTPAT_PATTERN NL80211_PKTPAT_PATTERN
-+#define NL80211_WOWLAN_PKTPAT_OFFSET NL80211_PKTPAT_OFFSET
-+#define NUM_NL80211_WOWLAN_PKTPAT NUM_NL80211_PKTPAT
-+#define MAX_NL80211_WOWLAN_PKTPAT MAX_NL80211_PKTPAT
-+#define nl80211_wowlan_pattern_support nl80211_pattern_support
-+
- /**
-  * enum nl80211_wowlan_triggers - WoWLAN trigger definitions
-  * @__NL80211_WOWLAN_TRIG_INVALID: invalid number for nested attributes
-@@ -3127,7 +3136,7 @@ struct nl80211_wowlan_pattern_support {
-  *    pattern matching is done after the packet is converted to the MSDU.
-  *
-  *    In %NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED, it is a binary attribute
-- *    carrying a &struct nl80211_wowlan_pattern_support.
-+ *    carrying a &struct nl80211_pattern_support.
-  *
-  *    When reporting wakeup. it is a u32 attribute containing the 0-based
-  *    index of the pattern that caused the wakeup, in the patterns passed
-@@ -3284,7 +3293,7 @@ struct nl80211_wowlan_tcp_data_token_fea
-  * @NL80211_WOWLAN_TCP_WAKE_PAYLOAD: wake packet payload, for advertising a
-  *    u32 attribute holding the maximum length
-  * @NL80211_WOWLAN_TCP_WAKE_MASK: Wake packet payload mask, not used for
-- *    feature advertising. The mask works like @NL80211_WOWLAN_PKTPAT_MASK
-+ *    feature advertising. The mask works like @NL80211_PKTPAT_MASK
-  *    but on the TCP payload only.
-  * @NUM_NL80211_WOWLAN_TCP: number of TCP attributes
-  * @MAX_NL80211_WOWLAN_TCP: highest attribute number
---- a/net/mac80211/mesh_ps.c
-+++ b/net/mac80211/mesh_ps.c
-@@ -229,6 +229,10 @@ void ieee80211_mps_sta_status_update(str
-       enum nl80211_mesh_power_mode pm;
-       bool do_buffer;
-+      /* For non-assoc STA, prevent buffering or frame transmission */
-+      if (sta->sta_state < IEEE80211_STA_ASSOC)
-+              return;
-+
-       /*
-        * use peer-specific power mode if peering is established and the
-        * peer's power mode is known
---- a/net/wireless/nl80211.c
-+++ b/net/wireless/nl80211.c
-@@ -441,10 +441,12 @@ static int nl80211_prepare_wdev_dump(str
-                       goto out_unlock;
-               }
-               *rdev = wiphy_to_dev((*wdev)->wiphy);
--              cb->args[0] = (*rdev)->wiphy_idx;
-+              /* 0 is the first index - add 1 to parse only once */
-+              cb->args[0] = (*rdev)->wiphy_idx + 1;
-               cb->args[1] = (*wdev)->identifier;
-       } else {
--              struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0]);
-+              /* subtract the 1 again here */
-+              struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
-               struct wireless_dev *tmp;
-               if (!wiphy) {
-@@ -974,7 +976,7 @@ static int nl80211_send_wowlan(struct sk
-               return -ENOBUFS;
-       if (dev->wiphy.wowlan->n_patterns) {
--              struct nl80211_wowlan_pattern_support pat = {
-+              struct nl80211_pattern_support pat = {
-                       .max_patterns = dev->wiphy.wowlan->n_patterns,
-                       .min_pattern_len = dev->wiphy.wowlan->pattern_min_len,
-                       .max_pattern_len = dev->wiphy.wowlan->pattern_max_len,
-@@ -1568,8 +1570,10 @@ static int nl80211_dump_wiphy(struct sk_
-       rtnl_lock();
-       if (!state) {
-               state = kzalloc(sizeof(*state), GFP_KERNEL);
--              if (!state)
-+              if (!state) {
-+                      rtnl_unlock();
-                       return -ENOMEM;
-+              }
-               state->filter_wiphy = -1;
-               ret = nl80211_dump_wiphy_parse(skb, cb, state);
-               if (ret) {
-@@ -4770,9 +4774,9 @@ do {                                                                         \
-       FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, 0, 1,
-                                 mask, NL80211_MESHCONF_FORWARDING,
-                                 nla_get_u8);
--      FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, 1, 255,
-+      FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, -255, 0,
-                                 mask, NL80211_MESHCONF_RSSI_THRESHOLD,
--                                nla_get_u32);
-+                                nla_get_s32);
-       FILL_IN_MESH_PARAM_IF_SET(tb, cfg, ht_opmode, 0, 16,
-                                 mask, NL80211_MESHCONF_HT_OPMODE,
-                                 nla_get_u16);
-@@ -6615,12 +6619,14 @@ EXPORT_SYMBOL(cfg80211_testmode_alloc_ev
- void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
+ struct ath_rx_status {
+--- a/drivers/net/wireless/ath/ath9k/xmit.c
++++ b/drivers/net/wireless/ath/ath9k/xmit.c
+@@ -683,6 +683,8 @@ static void ath_tx_process_buffer(struct
+       if (bf_is_ampdu_not_probing(bf))
+               txq->axq_ampdu_depth--;
++      ts->duration = ath9k_hw_get_duration(sc->sc_ah, bf->bf_desc,
++                                           ts->ts_rateindex);
+       if (!bf_isampdu(bf)) {
+               if (!flush) {
+                       info = IEEE80211_SKB_CB(bf->bf_mpdu);
+--- a/drivers/net/wireless/ath/ath9k/ath9k.h
++++ b/drivers/net/wireless/ath/ath9k/ath9k.h
+@@ -455,7 +455,8 @@ void ath9k_p2p_bss_info_changed(struct a
+ void ath9k_beacon_add_noa(struct ath_softc *sc, struct ath_vif *avp,
+                         struct sk_buff *skb);
+ void ath9k_p2p_ps_timer(void *priv);
+-void ath9k_chanctx_wake_queues(struct ath_softc *sc);
++void ath9k_chanctx_wake_queues(struct ath_softc *sc, struct ath_chanctx *ctx);
++void ath9k_chanctx_stop_queues(struct ath_softc *sc, struct ath_chanctx *ctx);
+ void ath_chanctx_check_active(struct ath_softc *sc, struct ath_chanctx *ctx);
+ void ath_chanctx_beacon_recv_ev(struct ath_softc *sc,
+@@ -525,7 +526,12 @@ static inline void ath9k_beacon_add_noa(
+ static inline void ath9k_p2p_ps_timer(struct ath_softc *sc)
  {
-+      struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
-       void *hdr = ((void **)skb->cb)[1];
-       struct nlattr *data = ((void **)skb->cb)[2];
-       nla_nest_end(skb, data);
-       genlmsg_end(skb, hdr);
--      genlmsg_multicast(skb, 0, nl80211_testmode_mcgrp.id, gfp);
-+      genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), skb, 0,
-+                              nl80211_testmode_mcgrp.id, gfp);
  }
- EXPORT_SYMBOL(cfg80211_testmode_event);
- #endif
-@@ -7593,12 +7599,11 @@ static int nl80211_send_wowlan_patterns(
-               if (!nl_pat)
-                       return -ENOBUFS;
-               pat_len = wowlan->patterns[i].pattern_len;
--              if (nla_put(msg, NL80211_WOWLAN_PKTPAT_MASK,
--                          DIV_ROUND_UP(pat_len, 8),
-+              if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8),
-                           wowlan->patterns[i].mask) ||
--                  nla_put(msg, NL80211_WOWLAN_PKTPAT_PATTERN,
--                          pat_len, wowlan->patterns[i].pattern) ||
--                  nla_put_u32(msg, NL80211_WOWLAN_PKTPAT_OFFSET,
-+                  nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
-+                          wowlan->patterns[i].pattern) ||
-+                  nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
-                               wowlan->patterns[i].pkt_offset))
-                       return -ENOBUFS;
-               nla_nest_end(msg, nl_pat);
-@@ -7939,7 +7944,7 @@ static int nl80211_set_wowlan(struct sk_
-               struct nlattr *pat;
-               int n_patterns = 0;
-               int rem, pat_len, mask_len, pkt_offset;
--              struct nlattr *pat_tb[NUM_NL80211_WOWLAN_PKTPAT];
-+              struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
-               nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
-                                   rem)
-@@ -7958,26 +7963,25 @@ static int nl80211_set_wowlan(struct sk_
-               nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
-                                   rem) {
--                      nla_parse(pat_tb, MAX_NL80211_WOWLAN_PKTPAT,
--                                nla_data(pat), nla_len(pat), NULL);
-+                      nla_parse(pat_tb, MAX_NL80211_PKTPAT, nla_data(pat),
-+                                nla_len(pat), NULL);
-                       err = -EINVAL;
--                      if (!pat_tb[NL80211_WOWLAN_PKTPAT_MASK] ||
--                          !pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN])
-+                      if (!pat_tb[NL80211_PKTPAT_MASK] ||
-+                          !pat_tb[NL80211_PKTPAT_PATTERN])
-                               goto error;
--                      pat_len = nla_len(pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN]);
-+                      pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
-                       mask_len = DIV_ROUND_UP(pat_len, 8);
--                      if (nla_len(pat_tb[NL80211_WOWLAN_PKTPAT_MASK]) !=
--                          mask_len)
-+                      if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
-                               goto error;
-                       if (pat_len > wowlan->pattern_max_len ||
-                           pat_len < wowlan->pattern_min_len)
-                               goto error;
--                      if (!pat_tb[NL80211_WOWLAN_PKTPAT_OFFSET])
-+                      if (!pat_tb[NL80211_PKTPAT_OFFSET])
-                               pkt_offset = 0;
-                       else
-                               pkt_offset = nla_get_u32(
--                                      pat_tb[NL80211_WOWLAN_PKTPAT_OFFSET]);
-+                                      pat_tb[NL80211_PKTPAT_OFFSET]);
-                       if (pkt_offset > wowlan->max_pkt_offset)
-                               goto error;
-                       new_triggers.patterns[i].pkt_offset = pkt_offset;
-@@ -7991,11 +7995,11 @@ static int nl80211_set_wowlan(struct sk_
-                       new_triggers.patterns[i].pattern =
-                               new_triggers.patterns[i].mask + mask_len;
-                       memcpy(new_triggers.patterns[i].mask,
--                             nla_data(pat_tb[NL80211_WOWLAN_PKTPAT_MASK]),
-+                             nla_data(pat_tb[NL80211_PKTPAT_MASK]),
-                              mask_len);
-                       new_triggers.patterns[i].pattern_len = pat_len;
-                       memcpy(new_triggers.patterns[i].pattern,
--                             nla_data(pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN]),
-+                             nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
-                              pat_len);
-                       i++;
-               }
-@@ -10066,7 +10070,8 @@ void cfg80211_mgmt_tx_status(struct wire
-       genlmsg_end(msg, hdr);
--      genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
-+      genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
-+                              nl80211_mlme_mcgrp.id, gfp);
-       return;
-  nla_put_failure:
---- a/net/wireless/reg.c
-+++ b/net/wireless/reg.c
-@@ -2247,10 +2247,13 @@ int reg_device_uevent(struct device *dev
- void wiphy_regulatory_register(struct wiphy *wiphy)
+-static inline void ath9k_chanctx_wake_queues(struct ath_softc *sc)
++static inline void ath9k_chanctx_wake_queues(struct ath_softc *sc,
++                                           struct ath_chanctx *ctx)
++{
++}
++static inline void ath9k_chanctx_stop_queues(struct ath_softc *sc,
++                                           struct ath_chanctx *ctx)
  {
-+      struct regulatory_request *lr;
-+
-       if (!reg_dev_ignore_cell_hint(wiphy))
-               reg_num_devs_support_basehint++;
--      wiphy_update_regulatory(wiphy, NL80211_REGDOM_SET_BY_CORE);
-+      lr = get_last_request();
-+      wiphy_update_regulatory(wiphy, lr->initiator);
  }
+ static inline void ath_chanctx_check_active(struct ath_softc *sc,
+--- a/drivers/net/wireless/ath/ath9k/channel.c
++++ b/drivers/net/wireless/ath/ath9k/channel.c
+@@ -761,6 +761,13 @@ void ath_offchannel_next(struct ath_soft
  
- void wiphy_regulatory_deregister(struct wiphy *wiphy)
-@@ -2279,7 +2282,9 @@ void wiphy_regulatory_deregister(struct 
- static void reg_timeout_work(struct work_struct *work)
+ void ath_roc_complete(struct ath_softc *sc, bool abort)
  {
-       REG_DBG_PRINT("Timeout while waiting for CRDA to reply, restoring regulatory settings\n");
-+      rtnl_lock();
-       restore_regulatory_settings(true);
-+      rtnl_unlock();
- }
- int __init regulatory_init(void)
---- a/net/wireless/sme.c
-+++ b/net/wireless/sme.c
-@@ -34,8 +34,10 @@ struct cfg80211_conn {
-               CFG80211_CONN_SCAN_AGAIN,
-               CFG80211_CONN_AUTHENTICATE_NEXT,
-               CFG80211_CONN_AUTHENTICATING,
-+              CFG80211_CONN_AUTH_FAILED,
-               CFG80211_CONN_ASSOCIATE_NEXT,
-               CFG80211_CONN_ASSOCIATING,
-+              CFG80211_CONN_ASSOC_FAILED,
-               CFG80211_CONN_DEAUTH,
-               CFG80211_CONN_CONNECTED,
-       } state;
-@@ -164,6 +166,8 @@ static int cfg80211_conn_do_work(struct 
-                                         NULL, 0,
-                                         params->key, params->key_len,
-                                         params->key_idx, NULL, 0);
-+      case CFG80211_CONN_AUTH_FAILED:
-+              return -ENOTCONN;
-       case CFG80211_CONN_ASSOCIATE_NEXT:
-               BUG_ON(!rdev->ops->assoc);
-               wdev->conn->state = CFG80211_CONN_ASSOCIATING;
-@@ -188,10 +192,17 @@ static int cfg80211_conn_do_work(struct 
-                                            WLAN_REASON_DEAUTH_LEAVING,
-                                            false);
-               return err;
-+      case CFG80211_CONN_ASSOC_FAILED:
-+              cfg80211_mlme_deauth(rdev, wdev->netdev, params->bssid,
-+                                   NULL, 0,
-+                                   WLAN_REASON_DEAUTH_LEAVING, false);
-+              return -ENOTCONN;
-       case CFG80211_CONN_DEAUTH:
-               cfg80211_mlme_deauth(rdev, wdev->netdev, params->bssid,
-                                    NULL, 0,
-                                    WLAN_REASON_DEAUTH_LEAVING, false);
-+              /* free directly, disconnected event already sent */
-+              cfg80211_sme_free(wdev);
-               return 0;
-       default:
-               return 0;
-@@ -371,7 +382,7 @@ bool cfg80211_sme_rx_assoc_resp(struct w
-               return true;
-       }
--      wdev->conn->state = CFG80211_CONN_DEAUTH;
-+      wdev->conn->state = CFG80211_CONN_ASSOC_FAILED;
-       schedule_work(&rdev->conn_work);
-       return false;
- }
-@@ -383,7 +394,13 @@ void cfg80211_sme_deauth(struct wireless
- void cfg80211_sme_auth_timeout(struct wireless_dev *wdev)
- {
--      cfg80211_sme_free(wdev);
-+      struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
++      struct ath_common *common = ath9k_hw_common(sc->sc_ah);
 +
-+      if (!wdev->conn)
-+              return;
++      if (abort)
++              ath_dbg(common, CHAN_CTX, "RoC aborted\n");
++      else
++              ath_dbg(common, CHAN_CTX, "RoC expired\n");
 +
-+      wdev->conn->state = CFG80211_CONN_AUTH_FAILED;
-+      schedule_work(&rdev->conn_work);
- }
- void cfg80211_sme_disassoc(struct wireless_dev *wdev)
-@@ -399,7 +416,13 @@ void cfg80211_sme_disassoc(struct wirele
- void cfg80211_sme_assoc_timeout(struct wireless_dev *wdev)
+       sc->offchannel.roc_vif = NULL;
+       sc->offchannel.roc_chan = NULL;
+       if (!abort)
+@@ -1037,9 +1044,11 @@ static void ath_offchannel_channel_chang
+ void ath_chanctx_set_next(struct ath_softc *sc, bool force)
  {
--      cfg80211_sme_disassoc(wdev);
-+      struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
-+
-+      if (!wdev->conn)
-+              return;
+       struct ath_common *common = ath9k_hw_common(sc->sc_ah);
++      struct ath_chanctx *old_ctx;
+       struct timespec ts;
+       bool measure_time = false;
+       bool send_ps = false;
++      bool queues_stopped = false;
+       spin_lock_bh(&sc->chan_lock);
+       if (!sc->next_chan) {
+@@ -1069,6 +1078,10 @@ void ath_chanctx_set_next(struct ath_sof
+                       getrawmonotonic(&ts);
+                       measure_time = true;
+               }
 +
-+      wdev->conn->state = CFG80211_CONN_ASSOC_FAILED;
-+      schedule_work(&rdev->conn_work);
- }
- static int cfg80211_sme_connect(struct wireless_dev *wdev,
---- a/net/mac80211/rc80211_minstrel.c
-+++ b/net/mac80211/rc80211_minstrel.c
-@@ -290,7 +290,7 @@ minstrel_get_rate(void *priv, struct iee
-       struct minstrel_rate *msr, *mr;
-       unsigned int ndx;
-       bool mrr_capable;
--      bool prev_sample = mi->prev_sample;
-+      bool prev_sample;
-       int delta;
-       int sampling_ratio;
-@@ -314,6 +314,7 @@ minstrel_get_rate(void *priv, struct iee
-                       (mi->sample_count + mi->sample_deferred / 2);
-       /* delta < 0: no sampling required */
-+      prev_sample = mi->prev_sample;
-       mi->prev_sample = false;
-       if (delta < 0 || (!mrr_capable && prev_sample))
-               return;
---- a/drivers/net/wireless/rt2x00/rt2x00queue.c
-+++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
-@@ -936,13 +936,8 @@ void rt2x00queue_index_inc(struct queue_
-       spin_unlock_irqrestore(&queue->index_lock, irqflags);
- }
--void rt2x00queue_pause_queue(struct data_queue *queue)
-+void rt2x00queue_pause_queue_nocheck(struct data_queue *queue)
- {
--      if (!test_bit(DEVICE_STATE_PRESENT, &queue->rt2x00dev->flags) ||
--          !test_bit(QUEUE_STARTED, &queue->flags) ||
--          test_and_set_bit(QUEUE_PAUSED, &queue->flags))
--              return;
--
-       switch (queue->qid) {
-       case QID_AC_VO:
-       case QID_AC_VI:
-@@ -958,6 +953,15 @@ void rt2x00queue_pause_queue(struct data
-               break;
-       }
- }
-+void rt2x00queue_pause_queue(struct data_queue *queue)
-+{
-+      if (!test_bit(DEVICE_STATE_PRESENT, &queue->rt2x00dev->flags) ||
-+          !test_bit(QUEUE_STARTED, &queue->flags) ||
-+          test_and_set_bit(QUEUE_PAUSED, &queue->flags))
-+              return;
++              ath9k_chanctx_stop_queues(sc, sc->cur_chan);
++              queues_stopped = true;
 +
-+      rt2x00queue_pause_queue_nocheck(queue);
-+}
- EXPORT_SYMBOL_GPL(rt2x00queue_pause_queue);
- void rt2x00queue_unpause_queue(struct data_queue *queue)
-@@ -1019,7 +1023,7 @@ void rt2x00queue_stop_queue(struct data_
-               return;
-       }
--      rt2x00queue_pause_queue(queue);
-+      rt2x00queue_pause_queue_nocheck(queue);
-       queue->rt2x00dev->ops->lib->stop_queue(queue);
---- a/net/mac80211/mlme.c
-+++ b/net/mac80211/mlme.c
-@@ -31,10 +31,12 @@
- #include "led.h"
- #define IEEE80211_AUTH_TIMEOUT                (HZ / 5)
-+#define IEEE80211_AUTH_TIMEOUT_LONG   (HZ / 2)
- #define IEEE80211_AUTH_TIMEOUT_SHORT  (HZ / 10)
- #define IEEE80211_AUTH_MAX_TRIES      3
- #define IEEE80211_AUTH_WAIT_ASSOC     (HZ * 5)
- #define IEEE80211_ASSOC_TIMEOUT               (HZ / 5)
-+#define IEEE80211_ASSOC_TIMEOUT_LONG  (HZ / 2)
- #define IEEE80211_ASSOC_TIMEOUT_SHORT (HZ / 10)
- #define IEEE80211_ASSOC_MAX_TRIES     3
-@@ -209,8 +211,9 @@ ieee80211_determine_chantype(struct ieee
-                            struct ieee80211_channel *channel,
-                            const struct ieee80211_ht_operation *ht_oper,
-                            const struct ieee80211_vht_operation *vht_oper,
--                           struct cfg80211_chan_def *chandef, bool verbose)
-+                           struct cfg80211_chan_def *chandef, bool tracking)
- {
-+      struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
-       struct cfg80211_chan_def vht_chandef;
-       u32 ht_cfreq, ret;
-@@ -229,7 +232,7 @@ ieee80211_determine_chantype(struct ieee
-       ht_cfreq = ieee80211_channel_to_frequency(ht_oper->primary_chan,
-                                                 channel->band);
-       /* check that channel matches the right operating channel */
--      if (channel->center_freq != ht_cfreq) {
-+      if (!tracking && channel->center_freq != ht_cfreq) {
-               /*
-                * It's possible that some APs are confused here;
-                * Netgear WNDR3700 sometimes reports 4 higher than
-@@ -237,11 +240,10 @@ ieee80211_determine_chantype(struct ieee
-                * since we look at probe response/beacon data here
-                * it should be OK.
-                */
--              if (verbose)
--                      sdata_info(sdata,
--                                 "Wrong control channel: center-freq: %d ht-cfreq: %d ht->primary_chan: %d band: %d - Disabling HT\n",
--                                 channel->center_freq, ht_cfreq,
--                                 ht_oper->primary_chan, channel->band);
-+              sdata_info(sdata,
-+                         "Wrong control channel: center-freq: %d ht-cfreq: %d ht->primary_chan: %d band: %d - Disabling HT\n",
-+                         channel->center_freq, ht_cfreq,
-+                         ht_oper->primary_chan, channel->band);
-               ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
-               goto out;
-       }
-@@ -295,7 +297,7 @@ ieee80211_determine_chantype(struct ieee
-                               channel->band);
-               break;
-       default:
--              if (verbose)
-+              if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
-                       sdata_info(sdata,
-                                  "AP VHT operation IE has invalid channel width (%d), disable VHT\n",
-                                  vht_oper->chan_width);
-@@ -304,7 +306,7 @@ ieee80211_determine_chantype(struct ieee
-       }
-       if (!cfg80211_chandef_valid(&vht_chandef)) {
--              if (verbose)
-+              if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
-                       sdata_info(sdata,
-                                  "AP VHT information is invalid, disable VHT\n");
-               ret = IEEE80211_STA_DISABLE_VHT;
-@@ -317,7 +319,7 @@ ieee80211_determine_chantype(struct ieee
-       }
+               __ath9k_flush(sc->hw, ~0, true);
  
-       if (!cfg80211_chandef_compatible(chandef, &vht_chandef)) {
--              if (verbose)
-+              if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
-                       sdata_info(sdata,
-                                  "AP VHT information doesn't match HT, disable VHT\n");
-               ret = IEEE80211_STA_DISABLE_VHT;
-@@ -333,18 +335,27 @@ out:
-       if (ret & IEEE80211_STA_DISABLE_VHT)
-               vht_chandef = *chandef;
-+      /*
-+       * Ignore the DISABLED flag when we're already connected and only
-+       * tracking the APs beacon for bandwidth changes - otherwise we
-+       * might get disconnected here if we connect to an AP, update our
-+       * regulatory information based on the AP's country IE and the
-+       * information we have is wrong/outdated and disables the channel
-+       * that we're actually using for the connection to the AP.
-+       */
-       while (!cfg80211_chandef_usable(sdata->local->hw.wiphy, chandef,
--                                      IEEE80211_CHAN_DISABLED)) {
-+                                      tracking ? 0 :
-+                                                 IEEE80211_CHAN_DISABLED)) {
-               if (WARN_ON(chandef->width == NL80211_CHAN_WIDTH_20_NOHT)) {
-                       ret = IEEE80211_STA_DISABLE_HT |
-                             IEEE80211_STA_DISABLE_VHT;
--                      goto out;
-+                      break;
+               if (ath_chanctx_send_ps_frame(sc, true))
+@@ -1082,6 +1095,7 @@ void ath_chanctx_set_next(struct ath_sof
+                       sc->cur_chan->tsf_val = ath9k_hw_gettsf64(sc->sc_ah);
                }
-               ret |= chandef_downgrade(chandef);
        }
--      if (chandef->width != vht_chandef.width && verbose)
-+      if (chandef->width != vht_chandef.width && !tracking)
-               sdata_info(sdata,
-                          "capabilities/regulatory prevented using AP HT/VHT configuration, downgraded\n");
-@@ -384,7 +395,7 @@ static int ieee80211_config_bw(struct ie
-       /* calculate new channel (type) based on HT/VHT operation IEs */
-       flags = ieee80211_determine_chantype(sdata, sband, chan, ht_oper,
--                                           vht_oper, &chandef, false);
-+                                           vht_oper, &chandef, true);
-       /*
-        * Downgrade the new channel if we associated with restricted
-@@ -3394,10 +3405,13 @@ static int ieee80211_probe_auth(struct i
-       if (tx_flags == 0) {
-               auth_data->timeout = jiffies + IEEE80211_AUTH_TIMEOUT;
--              ifmgd->auth_data->timeout_started = true;
-+              auth_data->timeout_started = true;
-               run_again(sdata, auth_data->timeout);
-       } else {
--              auth_data->timeout_started = false;
-+              auth_data->timeout =
-+                      round_jiffies_up(jiffies + IEEE80211_AUTH_TIMEOUT_LONG);
-+              auth_data->timeout_started = true;
-+              run_again(sdata, auth_data->timeout);
-       }
-       return 0;
-@@ -3434,7 +3448,11 @@ static int ieee80211_do_assoc(struct iee
-               assoc_data->timeout_started = true;
-               run_again(sdata, assoc_data->timeout);
-       } else {
--              assoc_data->timeout_started = false;
-+              assoc_data->timeout =
-+                      round_jiffies_up(jiffies +
-+                                       IEEE80211_ASSOC_TIMEOUT_LONG);
-+              assoc_data->timeout_started = true;
-+              run_again(sdata, assoc_data->timeout);
++      old_ctx = sc->cur_chan;
+       sc->cur_chan = sc->next_chan;
+       sc->cur_chan->stopped = false;
+       sc->next_chan = NULL;
+@@ -1104,7 +1118,16 @@ void ath_chanctx_set_next(struct ath_sof
+               if (measure_time)
+                       sc->sched.channel_switch_time =
+                               ath9k_hw_get_tsf_offset(&ts, NULL);
++              /*
++               * A reset will ensure that all queues are woken up,
++               * so there is no need to awaken them again.
++               */
++              goto out;
        }
-       return 0;
-@@ -3829,7 +3847,7 @@ static int ieee80211_prep_channel(struct
-       ifmgd->flags |= ieee80211_determine_chantype(sdata, sband,
-                                                    cbss->channel,
-                                                    ht_oper, vht_oper,
--                                                   &chandef, true);
-+                                                   &chandef, false);
-       sdata->needed_rx_chains = min(ieee80211_ht_vht_rx_chains(sdata, cbss),
-                                     local->rx_chains);
---- a/net/wireless/core.c
-+++ b/net/wireless/core.c
-@@ -772,6 +772,7 @@ void cfg80211_leave(struct cfg80211_regi
-               cfg80211_leave_mesh(rdev, dev);
-               break;
-       case NL80211_IFTYPE_AP:
-+      case NL80211_IFTYPE_P2P_GO:
-               cfg80211_stop_ap(rdev, dev);
-               break;
-       default:
---- a/drivers/net/wireless/rtlwifi/Kconfig
-+++ b/drivers/net/wireless/rtlwifi/Kconfig
-@@ -1,29 +1,22 @@
--config RTLWIFI
--      tristate "Realtek wireless card support"
-+menuconfig RTL_CARDS
-+      tristate "Realtek rtlwifi family of devices"
-       depends on m
--      depends on MAC80211
--      select BACKPORT_FW_LOADER
--      ---help---
--        This is common code for RTL8192CE/RTL8192CU/RTL8192SE/RTL8723AE
--        drivers.  This module does nothing by itself - the various front-end
--        drivers need to be enabled to support any desired devices.
--
--        If you choose to build as a module, it'll be called rtlwifi.
--
--config RTLWIFI_DEBUG
--      bool "Debugging output for rtlwifi driver family"
--      depends on RTLWIFI
-+      depends on MAC80211 && (PCI || USB)
-       default y
-       ---help---
--      To use the module option that sets the dynamic-debugging level for,
--      the front-end driver, this parameter must be "Y". For memory-limited
--      systems, choose "N". If in doubt, choose "Y".
-+        This option will enable support for the Realtek mac80211-based
-+        wireless drivers. Drivers rtl8192ce, rtl8192cu, rtl8192se, rtl8192de,
-+        rtl8723eu, and rtl8188eu share some common code.
 +
-+if RTL_CARDS
++      if (queues_stopped)
++              ath9k_chanctx_wake_queues(sc, old_ctx);
++out:
+       if (send_ps)
+               ath_chanctx_send_ps_frame(sc, false);
  
- config RTL8192CE
-       tristate "Realtek RTL8192CE/RTL8188CE Wireless Network Adapter"
-       depends on m
--      depends on RTLWIFI && PCI
-+      depends on PCI
-       select RTL8192C_COMMON
-+      select RTLWIFI
-+      select RTLWIFI_PCI
-       ---help---
-       This is the driver for Realtek RTL8192CE/RTL8188CE 802.11n PCIe
-       wireless network adapters.
-@@ -33,7 +26,9 @@ config RTL8192CE
- config RTL8192SE
-       tristate "Realtek RTL8192SE/RTL8191SE PCIe Wireless Network Adapter"
-       depends on m
--      depends on RTLWIFI && PCI
-+      depends on PCI
-+      select RTLWIFI
-+      select RTLWIFI_PCI
-       ---help---
-       This is the driver for Realtek RTL8192SE/RTL8191SE 802.11n PCIe
-       wireless network adapters.
-@@ -43,7 +38,9 @@ config RTL8192SE
- config RTL8192DE
-       tristate "Realtek RTL8192DE/RTL8188DE PCIe Wireless Network Adapter"
-       depends on m
--      depends on RTLWIFI && PCI
-+      depends on PCI
-+      select RTLWIFI
-+      select RTLWIFI_PCI
-       ---help---
-       This is the driver for Realtek RTL8192DE/RTL8188DE 802.11n PCIe
-       wireless network adapters.
-@@ -53,7 +50,9 @@ config RTL8192DE
- config RTL8723AE
-       tristate "Realtek RTL8723AE PCIe Wireless Network Adapter"
-       depends on m
--      depends on RTLWIFI && PCI
-+      depends on PCI
-+      select RTLWIFI
-+      select RTLWIFI_PCI
-       ---help---
-       This is the driver for Realtek RTL8723AE 802.11n PCIe
-       wireless network adapters.
-@@ -63,7 +62,9 @@ config RTL8723AE
- config RTL8188EE
-       tristate "Realtek RTL8188EE Wireless Network Adapter"
-       depends on m
--      depends on RTLWIFI && PCI
-+      depends on PCI
-+      select RTLWIFI
-+      select RTLWIFI_PCI
-       ---help---
-       This is the driver for Realtek RTL8188EE 802.11n PCIe
-       wireless network adapters.
-@@ -73,7 +74,9 @@ config RTL8188EE
- config RTL8192CU
-       tristate "Realtek RTL8192CU/RTL8188CU USB Wireless Network Adapter"
-       depends on m
--      depends on RTLWIFI && USB
-+      depends on USB
-+      select RTLWIFI
-+      select RTLWIFI_USB
-       select RTL8192C_COMMON
-       ---help---
-       This is the driver for Realtek RTL8192CU/RTL8188CU 802.11n USB
-@@ -81,8 +84,32 @@ config RTL8192CU
+@@ -1170,18 +1193,37 @@ bool ath9k_is_chanctx_enabled(void)
+ /* Queue management */
+ /********************/
  
-       If you choose to build it as a module, it will be called rtl8192cu
-+config RTLWIFI
-+      tristate "Realtek common driver part"
-+      depends on m
-+      select BACKPORT_FW_LOADER
+-void ath9k_chanctx_wake_queues(struct ath_softc *sc)
++void ath9k_chanctx_stop_queues(struct ath_softc *sc, struct ath_chanctx *ctx)
++{
++      struct ath_hw *ah = sc->sc_ah;
++      int i;
 +
-+config RTLWIFI_PCI
-+      depends on m
-+      tristate
++      if (ctx == &sc->offchannel.chan) {
++              ieee80211_stop_queue(sc->hw,
++                                   sc->hw->offchannel_tx_hw_queue);
++      } else {
++              for (i = 0; i < IEEE80211_NUM_ACS; i++)
++                      ieee80211_stop_queue(sc->hw,
++                                           ctx->hw_queue_base + i);
++      }
 +
-+config RTLWIFI_USB
-+      depends on m
-+      tristate
++      if (ah->opmode == NL80211_IFTYPE_AP)
++              ieee80211_stop_queue(sc->hw, sc->hw->queues - 2);
++}
 +
-+config RTLWIFI_DEBUG
-+      bool "Debugging output for rtlwifi driver family"
-+      depends on RTLWIFI
-+      default y
-+      ---help---
-+      To use the module option that sets the dynamic-debugging level for,
-+      the front-end driver, this parameter must be "Y". For memory-limited
-+      systems, choose "N". If in doubt, choose "Y".
 +
- config RTL8192C_COMMON
-       tristate
-       depends on m
-       depends on RTL8192CE || RTL8192CU
-       default m
-+
-+endif
---- a/drivers/net/wireless/rtlwifi/Makefile
-+++ b/drivers/net/wireless/rtlwifi/Makefile
-@@ -12,13 +12,11 @@ rtlwifi-objs       :=              \
- rtl8192c_common-objs +=               \
--ifneq ($(CONFIG_PCI),)
--rtlwifi-objs  += pci.o
--endif
-+obj-$(CPTCFG_RTLWIFI_PCI)     += rtl_pci.o
-+rtl_pci-objs  :=              pci.o
--ifneq ($(CONFIG_USB),)
--rtlwifi-objs  += usb.o
--endif
-+obj-$(CPTCFG_RTLWIFI_USB)     += rtl_usb.o
-+rtl_usb-objs  :=              usb.o
- obj-$(CPTCFG_RTL8192C_COMMON) += rtl8192c/
- obj-$(CPTCFG_RTL8192CE)               += rtl8192ce/
---- a/drivers/net/wireless/rtlwifi/base.c
-+++ b/drivers/net/wireless/rtlwifi/base.c
-@@ -173,6 +173,7 @@ u8 rtl_tid_to_ac(u8 tid)
- {
-       return tid_to_ac[tid];
- }
-+EXPORT_SYMBOL_GPL(rtl_tid_to_ac);
- static void _rtl_init_hw_ht_capab(struct ieee80211_hw *hw,
-                                 struct ieee80211_sta_ht_cap *ht_cap)
-@@ -407,6 +408,7 @@ void rtl_deinit_deferred_work(struct iee
-       cancel_delayed_work(&rtlpriv->works.ps_rfon_wq);
-       cancel_delayed_work(&rtlpriv->works.fwevt_wq);
- }
-+EXPORT_SYMBOL_GPL(rtl_deinit_deferred_work);
- void rtl_init_rfkill(struct ieee80211_hw *hw)
- {
-@@ -440,6 +442,7 @@ void rtl_deinit_rfkill(struct ieee80211_
++void ath9k_chanctx_wake_queues(struct ath_softc *sc, struct ath_chanctx *ctx)
  {
-       wiphy_rfkill_stop_polling(hw->wiphy);
- }
-+EXPORT_SYMBOL_GPL(rtl_deinit_rfkill);
- int rtl_init_core(struct ieee80211_hw *hw)
- {
-@@ -490,10 +493,12 @@ int rtl_init_core(struct ieee80211_hw *h
-       return 0;
- }
-+EXPORT_SYMBOL_GPL(rtl_init_core);
+       struct ath_hw *ah = sc->sc_ah;
+       int i;
  
- void rtl_deinit_core(struct ieee80211_hw *hw)
- {
- }
-+EXPORT_SYMBOL_GPL(rtl_deinit_core);
+-      if (sc->cur_chan == &sc->offchannel.chan) {
++      if (ctx == &sc->offchannel.chan) {
+               ieee80211_wake_queue(sc->hw,
+                                    sc->hw->offchannel_tx_hw_queue);
+       } else {
+               for (i = 0; i < IEEE80211_NUM_ACS; i++)
+                       ieee80211_wake_queue(sc->hw,
+-                                           sc->cur_chan->hw_queue_base + i);
++                                           ctx->hw_queue_base + i);
+       }
  
- void rtl_init_rx_config(struct ieee80211_hw *hw)
- {
-@@ -502,6 +507,7 @@ void rtl_init_rx_config(struct ieee80211
+       if (ah->opmode == NL80211_IFTYPE_AP)
+--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c
++++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+@@ -464,6 +464,7 @@ static int ath9k_init_priv(struct ath9k_
+               return -ENOMEM;
+       ah->dev = priv->dev;
++      ah->hw = priv->hw;
+       ah->hw_version.devid = devid;
+       ah->hw_version.usbdev = drv_info;
+       ah->ah_flags |= AH_USE_EEPROM;
+--- a/drivers/net/wireless/ath/ath9k/main.c
++++ b/drivers/net/wireless/ath/ath9k/main.c
+@@ -60,8 +60,10 @@ static bool ath9k_has_pending_frames(str
  
-       rtlpriv->cfg->ops->get_hw_reg(hw, HW_VAR_RCR, (u8 *) (&mac->rx_conf));
- }
-+EXPORT_SYMBOL_GPL(rtl_init_rx_config);
+       spin_lock_bh(&txq->axq_lock);
  
- /*********************************************************
-  *
-@@ -880,6 +886,7 @@ bool rtl_tx_mgmt_proc(struct ieee80211_h
+-      if (txq->axq_depth)
++      if (txq->axq_depth) {
+               pending = true;
++              goto out;
++      }
  
-       return true;
+       if (txq->mac80211_qnum >= 0) {
+               struct list_head *list;
+@@ -70,6 +72,7 @@ static bool ath9k_has_pending_frames(str
+               if (!list_empty(list))
+                       pending = true;
+       }
++out:
+       spin_unlock_bh(&txq->axq_lock);
+       return pending;
  }
-+EXPORT_SYMBOL_GPL(rtl_tx_mgmt_proc);
+@@ -261,12 +264,7 @@ static bool ath_complete_reset(struct at
  
- void rtl_get_tcb_desc(struct ieee80211_hw *hw,
-                     struct ieee80211_tx_info *info,
-@@ -1053,6 +1060,7 @@ bool rtl_action_proc(struct ieee80211_hw
+       ath9k_hw_set_interrupts(ah);
+       ath9k_hw_enable_interrupts(ah);
+-
+-      if (!ath9k_is_chanctx_enabled())
+-              ieee80211_wake_queues(sc->hw);
+-      else
+-              ath9k_chanctx_wake_queues(sc);
+-
++      ieee80211_wake_queues(sc->hw);
+       ath9k_p2p_ps_timer(sc);
  
        return true;
- }
-+EXPORT_SYMBOL_GPL(rtl_action_proc);
- /*should call before software enc*/
- u8 rtl_is_special_data(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx)
-@@ -1126,6 +1134,7 @@ u8 rtl_is_special_data(struct ieee80211_
-       return false;
- }
-+EXPORT_SYMBOL_GPL(rtl_is_special_data);
- /*********************************************************
-  *
-@@ -1301,6 +1310,7 @@ void rtl_beacon_statistic(struct ieee802
-       rtlpriv->link_info.bcn_rx_inperiod++;
- }
-+EXPORT_SYMBOL_GPL(rtl_beacon_statistic);
- void rtl_watchdog_wq_callback(void *data)
- {
-@@ -1794,6 +1804,7 @@ void rtl_recognize_peer(struct ieee80211
-       mac->vendor = vendor;
- }
-+EXPORT_SYMBOL_GPL(rtl_recognize_peer);
- /*********************************************************
-  *
-@@ -1850,6 +1861,7 @@ struct attribute_group rtl_attribute_gro
-       .name = "rtlsysfs",
-       .attrs = rtl_sysfs_entries,
- };
-+EXPORT_SYMBOL_GPL(rtl_attribute_group);
- MODULE_AUTHOR("lizhaoming     <chaoming_li@realsil.com.cn>");
- MODULE_AUTHOR("Realtek WlanFAE        <wlanfae@realtek.com>");
-@@ -1857,7 +1869,8 @@ MODULE_AUTHOR("Larry Finger      <Larry.FInge
- MODULE_LICENSE("GPL");
- MODULE_DESCRIPTION("Realtek 802.11n PCI wireless core");
--struct rtl_global_var global_var = {};
-+struct rtl_global_var rtl_global_var = {};
-+EXPORT_SYMBOL_GPL(rtl_global_var);
- static int __init rtl_core_module_init(void)
- {
-@@ -1865,8 +1878,8 @@ static int __init rtl_core_module_init(v
-               pr_err("Unable to register rtl_rc, use default RC !!\n");
-       /* init some global vars */
--      INIT_LIST_HEAD(&global_var.glb_priv_list);
--      spin_lock_init(&global_var.glb_list_lock);
-+      INIT_LIST_HEAD(&rtl_global_var.glb_priv_list);
-+      spin_lock_init(&rtl_global_var.glb_list_lock);
-       return 0;
- }
---- a/drivers/net/wireless/rtlwifi/base.h
-+++ b/drivers/net/wireless/rtlwifi/base.h
-@@ -147,7 +147,7 @@ void rtl_recognize_peer(struct ieee80211
- u8 rtl_tid_to_ac(u8 tid);
- extern struct attribute_group rtl_attribute_group;
- void rtl_easy_concurrent_retrytimer_callback(unsigned long data);
--extern struct rtl_global_var global_var;
-+extern struct rtl_global_var rtl_global_var;
- int rtlwifi_rate_mapping(struct ieee80211_hw *hw,
-                        bool isht, u8 desc_rate, bool first_ampdu);
- bool rtl_tx_mgmt_proc(struct ieee80211_hw *hw, struct sk_buff *skb);
---- a/drivers/net/wireless/rtlwifi/core.c
-+++ b/drivers/net/wireless/rtlwifi/core.c
-@@ -1330,3 +1330,4 @@ const struct ieee80211_ops rtl_ops = {
-       .rfkill_poll = rtl_op_rfkill_poll,
-       .flush = rtl_op_flush,
- };
-+EXPORT_SYMBOL_GPL(rtl_ops);
---- a/drivers/net/wireless/rtlwifi/debug.c
-+++ b/drivers/net/wireless/rtlwifi/debug.c
-@@ -51,3 +51,4 @@ void rtl_dbgp_flag_init(struct ieee80211
-       /*Init Debug flag enable condition */
- }
-+EXPORT_SYMBOL_GPL(rtl_dbgp_flag_init);
---- a/drivers/net/wireless/rtlwifi/efuse.c
-+++ b/drivers/net/wireless/rtlwifi/efuse.c
-@@ -229,6 +229,7 @@ void read_efuse_byte(struct ieee80211_hw
+@@ -1971,9 +1969,6 @@ static bool ath9k_has_tx_pending(struct 
+               if (!ATH_TXQ_SETUP(sc, i))
+                       continue;
  
-       *pbuf = (u8) (value32 & 0xff);
- }
-+EXPORT_SYMBOL_GPL(read_efuse_byte);
+-              if (!sc->tx.txq[i].axq_depth)
+-                      continue;
+-
+               npend = ath9k_has_pending_frames(sc, &sc->tx.txq[i]);
+               if (npend)
+                       break;
+@@ -1999,7 +1994,6 @@ void __ath9k_flush(struct ieee80211_hw *
+       struct ath_common *common = ath9k_hw_common(ah);
+       int timeout = HZ / 5; /* 200 ms */
+       bool drain_txq;
+-      int i;
  
- void read_efuse(struct ieee80211_hw *hw, u16 _offset, u16 _size_byte, u8 *pbuf)
- {
---- a/drivers/net/wireless/rtlwifi/pci.c
-+++ b/drivers/net/wireless/rtlwifi/pci.c
-@@ -35,6 +35,13 @@
- #include "efuse.h"
- #include <linux/export.h>
- #include <linux/kmemleak.h>
-+#include <linux/module.h>
-+
-+MODULE_AUTHOR("lizhaoming     <chaoming_li@realsil.com.cn>");
-+MODULE_AUTHOR("Realtek WlanFAE        <wlanfae@realtek.com>");
-+MODULE_AUTHOR("Larry Finger   <Larry.FInger@lwfinger.net>");
-+MODULE_LICENSE("GPL");
-+MODULE_DESCRIPTION("PCI basic driver for rtlwifi");
- static const u16 pcibridge_vendors[PCI_BRIDGE_VENDOR_MAX] = {
-       PCI_VENDOR_ID_INTEL,
-@@ -1899,7 +1906,7 @@ int rtl_pci_probe(struct pci_dev *pdev,
-       rtlpriv->rtlhal.interface = INTF_PCI;
-       rtlpriv->cfg = (struct rtl_hal_cfg *)(id->driver_data);
-       rtlpriv->intf_ops = &rtl_pci_ops;
--      rtlpriv->glb_var = &global_var;
-+      rtlpriv->glb_var = &rtl_global_var;
-       /*
-        *init dbgp flags before all
---- a/drivers/net/wireless/rtlwifi/ps.c
-+++ b/drivers/net/wireless/rtlwifi/ps.c
-@@ -269,6 +269,7 @@ void rtl_ips_nic_on(struct ieee80211_hw 
-       spin_unlock_irqrestore(&rtlpriv->locks.ips_lock, flags);
- }
-+EXPORT_SYMBOL_GPL(rtl_ips_nic_on);
+       cancel_delayed_work_sync(&sc->tx_complete_work);
  
- /*for FW LPS*/
+@@ -2027,10 +2021,6 @@ void __ath9k_flush(struct ieee80211_hw *
+                       ath_reset(sc);
  
-@@ -518,6 +519,7 @@ void rtl_swlps_beacon(struct ieee80211_h
-                        "u_bufferd: %x, m_buffered: %x\n", u_buffed, m_buffed);
+               ath9k_ps_restore(sc);
+-              for (i = 0; i < IEEE80211_NUM_ACS; i++) {
+-                      ieee80211_wake_queue(sc->hw,
+-                                           sc->cur_chan->hw_queue_base + i);
+-              }
        }
- }
-+EXPORT_SYMBOL_GPL(rtl_swlps_beacon);
  
- void rtl_swlps_rf_awake(struct ieee80211_hw *hw)
+       ieee80211_queue_delayed_work(hw, &sc->tx_complete_work, 0);
+@@ -2039,16 +2029,8 @@ void __ath9k_flush(struct ieee80211_hw *
+ static bool ath9k_tx_frames_pending(struct ieee80211_hw *hw)
  {
-@@ -922,3 +924,4 @@ void rtl_p2p_info(struct ieee80211_hw *h
-       else
-               rtl_p2p_noa_ie(hw, data, len - FCS_LEN);
- }
-+EXPORT_SYMBOL_GPL(rtl_p2p_info);
---- a/drivers/net/wireless/rtlwifi/usb.c
-+++ b/drivers/net/wireless/rtlwifi/usb.c
-@@ -32,6 +32,13 @@
- #include "ps.h"
- #include "rtl8192c/fw_common.h"
- #include <linux/export.h>
-+#include <linux/module.h>
-+
-+MODULE_AUTHOR("lizhaoming     <chaoming_li@realsil.com.cn>");
-+MODULE_AUTHOR("Realtek WlanFAE        <wlanfae@realtek.com>");
-+MODULE_AUTHOR("Larry Finger   <Larry.FInger@lwfinger.net>");
-+MODULE_LICENSE("GPL");
-+MODULE_DESCRIPTION("USB basic driver for rtlwifi");
- #define       REALTEK_USB_VENQT_READ                  0xC0
- #define       REALTEK_USB_VENQT_WRITE                 0x40
---- a/drivers/net/wireless/ath/ath9k/ath9k.h
-+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
-@@ -72,17 +72,12 @@ struct ath_config {
- /*************************/
- #define ATH_TXBUF_RESET(_bf) do {                             \
--              (_bf)->bf_stale = false;                        \
-               (_bf)->bf_lastbf = NULL;                        \
-               (_bf)->bf_next = NULL;                          \
-               memset(&((_bf)->bf_state), 0,                   \
-                      sizeof(struct ath_buf_state));           \
-       } while (0)
--#define ATH_RXBUF_RESET(_bf) do {             \
--              (_bf)->bf_stale = false;        \
--      } while (0)
--
- /**
-  * enum buffer_type - Buffer type flags
-  *
-@@ -137,7 +132,8 @@ int ath_descdma_setup(struct ath_softc *
- #define ATH_AGGR_ENCRYPTDELIM      10
- /* minimum h/w qdepth to be sustained to maximize aggregation */
- #define ATH_AGGR_MIN_QDEPTH        2
--#define ATH_AMPDU_SUBFRAME_DEFAULT 32
-+/* minimum h/w qdepth for non-aggregated traffic */
-+#define ATH_NON_AGGR_MIN_QDEPTH    8
- #define IEEE80211_SEQ_SEQ_SHIFT    4
- #define IEEE80211_SEQ_MAX          4096
-@@ -174,12 +170,6 @@ int ath_descdma_setup(struct ath_softc *
- #define ATH_TX_COMPLETE_POLL_INT      1000
--enum ATH_AGGR_STATUS {
--      ATH_AGGR_DONE,
--      ATH_AGGR_BAW_CLOSED,
--      ATH_AGGR_LIMITED,
--};
+       struct ath_softc *sc = hw->priv;
+-      int i;
 -
- #define ATH_TXFIFO_DEPTH 8
- struct ath_txq {
-       int mac80211_qnum; /* mac80211 queue number, -1 means not mac80211 Q */
-@@ -201,10 +191,10 @@ struct ath_txq {
- struct ath_atx_ac {
-       struct ath_txq *txq;
--      int sched;
-       struct list_head list;
-       struct list_head tid_q;
-       bool clear_ps_filter;
-+      bool sched;
- };
+-      for (i = 0; i < ATH9K_NUM_TX_QUEUES; i++) {
+-              if (!ATH_TXQ_SETUP(sc, i))
+-                      continue;
  
- struct ath_frame_info {
-@@ -212,14 +202,16 @@ struct ath_frame_info {
-       int framelen;
-       enum ath9k_key_type keytype;
-       u8 keyix;
--      u8 retries;
-       u8 rtscts_rate;
-+      u8 retries : 7;
-+      u8 baw_tracked : 1;
- };
- struct ath_buf_state {
-       u8 bf_type;
-       u8 bfs_paprd;
-       u8 ndelim;
-+      bool stale;
-       u16 seqno;
-       unsigned long bfs_paprd_timestamp;
- };
-@@ -233,7 +225,6 @@ struct ath_buf {
-       void *bf_desc;                  /* virtual addr of desc */
-       dma_addr_t bf_daddr;            /* physical addr of desc */
-       dma_addr_t bf_buf_addr; /* physical addr of data buffer, for DMA */
--      bool bf_stale;
-       struct ieee80211_tx_rate rates[4];
-       struct ath_buf_state bf_state;
- };
-@@ -241,16 +232,18 @@ struct ath_buf {
- struct ath_atx_tid {
-       struct list_head list;
-       struct sk_buff_head buf_q;
-+      struct sk_buff_head retry_q;
-       struct ath_node *an;
-       struct ath_atx_ac *ac;
-       unsigned long tx_buf[BITS_TO_LONGS(ATH_TID_MAX_BUFS)];
--      int bar_index;
-       u16 seq_start;
-       u16 seq_next;
-       u16 baw_size;
--      int tidno;
-+      u8 tidno;
-       int baw_head;   /* first un-acked tx buffer */
-       int baw_tail;   /* next unused tx buffer slot */
-+
-+      s8 bar_index;
-       bool sched;
-       bool paused;
-       bool active;
-@@ -262,12 +255,13 @@ struct ath_node {
-       struct ieee80211_vif *vif; /* interface with which we're associated */
-       struct ath_atx_tid tid[IEEE80211_NUM_TIDS];
-       struct ath_atx_ac ac[IEEE80211_NUM_ACS];
--      int ps_key;
-       u16 maxampdu;
-       u8 mpdudensity;
-+      s8 ps_key;
-       bool sleeping;
-+      bool no_ps_filter;
- #if defined(CPTCFG_MAC80211_DEBUGFS) && defined(CPTCFG_ATH9K_DEBUGFS)
-       struct dentry *node_stat;
-@@ -317,6 +311,7 @@ struct ath_rx {
-       struct ath_descdma rxdma;
-       struct ath_rx_edma rx_edma[ATH9K_RX_QUEUE_MAX];
-+      struct ath_buf *buf_hold;
-       struct sk_buff *frag;
-       u32 ampdu_ref;
-@@ -367,6 +362,7 @@ void ath9k_release_buffered_frames(struc
- /********/
- struct ath_vif {
-+      struct ath_node mcast_node;
-       int av_bslot;
-       bool primary_sta_vif;
-       __le64 tsf_adjust; /* TSF adjustment for staggered beacons */
---- a/drivers/net/wireless/ath/ath9k/debug.c
-+++ b/drivers/net/wireless/ath/ath9k/debug.c
-@@ -607,6 +607,28 @@ static ssize_t read_file_xmit(struct fil
-       return retval;
+-              if (ath9k_has_pending_frames(sc, &sc->tx.txq[i]))
+-                      return true;
+-      }
+-      return false;
++      return ath9k_has_tx_pending(sc);
  }
  
-+static ssize_t print_queue(struct ath_softc *sc, struct ath_txq *txq,
-+                         char *buf, ssize_t size)
-+{
-+      ssize_t len = 0;
-+
-+      ath_txq_lock(sc, txq);
-+
-+      len += snprintf(buf + len, size - len, "%s: %d ",
-+                      "qnum", txq->axq_qnum);
-+      len += snprintf(buf + len, size - len, "%s: %2d ",
-+                      "qdepth", txq->axq_depth);
-+      len += snprintf(buf + len, size - len, "%s: %2d ",
-+                      "ampdu-depth", txq->axq_ampdu_depth);
-+      len += snprintf(buf + len, size - len, "%s: %3d ",
-+                      "pending", txq->pending_frames);
-+      len += snprintf(buf + len, size - len, "%s: %d\n",
-+                      "stopped", txq->stopped);
-+
-+      ath_txq_unlock(sc, txq);
-+      return len;
-+}
-+
- static ssize_t read_file_queues(struct file *file, char __user *user_buf,
-                               size_t count, loff_t *ppos)
- {
-@@ -624,24 +646,13 @@ static ssize_t read_file_queues(struct f
-       for (i = 0; i < IEEE80211_NUM_ACS; i++) {
-               txq = sc->tx.txq_map[i];
--              len += snprintf(buf + len, size - len, "(%s): ", qname[i]);
--
--              ath_txq_lock(sc, txq);
--
--              len += snprintf(buf + len, size - len, "%s: %d ",
--                              "qnum", txq->axq_qnum);
--              len += snprintf(buf + len, size - len, "%s: %2d ",
--                              "qdepth", txq->axq_depth);
--              len += snprintf(buf + len, size - len, "%s: %2d ",
--                              "ampdu-depth", txq->axq_ampdu_depth);
--              len += snprintf(buf + len, size - len, "%s: %3d ",
--                              "pending", txq->pending_frames);
--              len += snprintf(buf + len, size - len, "%s: %d\n",
--                              "stopped", txq->stopped);
--
--              ath_txq_unlock(sc, txq);
-+              len += snprintf(buf + len, size - len, "(%s):  ", qname[i]);
-+              len += print_queue(sc, txq, buf + len, size - len);
-       }
-+      len += snprintf(buf + len, size - len, "(CAB): ");
-+      len += print_queue(sc, sc->beacon.cabq, buf + len, size - len);
-+
-       if (len > size)
-               len = size;
---- a/net/mac80211/ibss.c
-+++ b/net/mac80211/ibss.c
-@@ -792,6 +792,17 @@ static void ieee80211_sta_find_ibss(stru
-               return;
-       }
-+      /* if a fixed bssid and a fixed freq have been provided create the IBSS
-+       * directly and do not waste time scanning
-+       */
-+      if (ifibss->fixed_bssid && ifibss->fixed_channel) {
-+              sdata_info(sdata, "Created IBSS using preconfigured BSSID %pM\n",
-+                         bssid);
-+              ieee80211_sta_create_ibss(sdata);
-+              return;
-+      }
-+
-+
-       ibss_dbg(sdata, "sta_find_ibss: did not try to join ibss\n");
-       /* Selected IBSS not found in current scan results - try to scan */
---- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
-+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
-@@ -1173,6 +1173,10 @@ skip_ws_det:
-                * is_on == 0 means MRC CCK is OFF (more noise imm)
-                */
-               bool is_on = param ? 1 : 0;
-+
-+              if (ah->caps.rx_chainmask == 1)
-+                      break;
-+
-               REG_RMW_FIELD(ah, AR_PHY_MRC_CCK_CTRL,
-                             AR_PHY_MRC_CCK_ENABLE, is_on);
-               REG_RMW_FIELD(ah, AR_PHY_MRC_CCK_CTRL,
---- a/drivers/net/wireless/ath/ath9k/recv.c
-+++ b/drivers/net/wireless/ath/ath9k/recv.c
-@@ -42,8 +42,6 @@ static void ath_rx_buf_link(struct ath_s
-       struct ath_desc *ds;
-       struct sk_buff *skb;
+ static int ath9k_tx_last_beacon(struct ieee80211_hw *hw)
+@@ -2350,7 +2332,7 @@ static void ath9k_remove_chanctx(struct 
+               conf->def.chan->center_freq);
  
--      ATH_RXBUF_RESET(bf);
--
-       ds = bf->bf_desc;
-       ds->ds_link = 0; /* link to null */
-       ds->ds_data = bf->bf_buf_addr;
-@@ -70,6 +68,14 @@ static void ath_rx_buf_link(struct ath_s
-       sc->rx.rxlink = &ds->ds_link;
- }
+       ctx->assigned = false;
+-      ctx->hw_queue_base = -1;
++      ctx->hw_queue_base = 0;
+       ath_chanctx_event(sc, NULL, ATH_CHANCTX_EVENT_UNASSIGN);
  
-+static void ath_rx_buf_relink(struct ath_softc *sc, struct ath_buf *bf)
-+{
-+      if (sc->rx.buf_hold)
-+              ath_rx_buf_link(sc, sc->rx.buf_hold);
-+
-+      sc->rx.buf_hold = bf;
-+}
-+
- static void ath_setdefantenna(struct ath_softc *sc, u32 antenna)
- {
-       /* XXX block beacon interrupts */
-@@ -117,7 +123,6 @@ static bool ath_rx_edma_buf_link(struct 
-       skb = bf->bf_mpdu;
--      ATH_RXBUF_RESET(bf);
-       memset(skb->data, 0, ah->caps.rx_status_len);
-       dma_sync_single_for_device(sc->dev, bf->bf_buf_addr,
-                               ah->caps.rx_status_len, DMA_TO_DEVICE);
-@@ -432,6 +437,7 @@ int ath_startrecv(struct ath_softc *sc)
-       if (list_empty(&sc->rx.rxbuf))
-               goto start_recv;
-+      sc->rx.buf_hold = NULL;
-       sc->rx.rxlink = NULL;
-       list_for_each_entry_safe(bf, tbf, &sc->rx.rxbuf, list) {
-               ath_rx_buf_link(sc, bf);
-@@ -677,6 +683,9 @@ static struct ath_buf *ath_get_next_rx_b
-       }
+       mutex_unlock(&sc->mutex);
+--- a/net/mac80211/rate.c
++++ b/net/mac80211/rate.c
+@@ -448,7 +448,7 @@ static void rate_fixup_ratelist(struct i
+        */
+       if (!(rates[0].flags & IEEE80211_TX_RC_MCS)) {
+               u32 basic_rates = vif->bss_conf.basic_rates;
+-              s8 baserate = basic_rates ? ffs(basic_rates - 1) : 0;
++              s8 baserate = basic_rates ? ffs(basic_rates) - 1 : 0;
  
-       bf = list_first_entry(&sc->rx.rxbuf, struct ath_buf, list);
-+      if (bf == sc->rx.buf_hold)
-+              return NULL;
-+
-       ds = bf->bf_desc;
+               rate = &sband->bitrates[rates[0].idx];
  
-       /*
-@@ -1375,7 +1384,7 @@ requeue:
-               if (edma) {
-                       ath_rx_edma_buf_link(sc, qtype);
-               } else {
--                      ath_rx_buf_link(sc, bf);
-+                      ath_rx_buf_relink(sc, bf);
-                       ath9k_hw_rxena(ah);
-               }
-       } while (1);