mac80211: update to wireless-testing 2013-04-16 + backports

Signed-off-by: Felix Fietkau <nbd@openwrt.org>

git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36448 3c298f89-4303-0410-b956-a3cf2f4a3e73

1 files changed, 3431 insertions, 1412 deletions

diff --git a/package/mac80211/patches/300-pending_work.patch b/package/mac80211/patches/300-pending_work.patch
index 37f127ede..d47c6261e 100644
--- a/package/mac80211/patches/300-pending_work.patch
+++ b/package/mac80211/patches/300-pending_work.patch
@@ -1,113 +1,796 @@
---- a/drivers/net/wireless/ath/ath9k/common.h
-+++ b/drivers/net/wireless/ath/ath9k/common.h
-@@ -27,7 +27,7 @@
- #define WME_MAX_BA              WME_BA_BMP_SIZE
- #define ATH_TID_MAX_BUFS        (2 * WME_MAX_BA)
- 
--#define ATH_RSSI_DUMMY_MARKER   0x127
-+#define ATH_RSSI_DUMMY_MARKER   127
- #define ATH_RSSI_LPF_LEN 		10
- #define RSSI_LPF_THRESHOLD		-20
- #define ATH_RSSI_EP_MULTIPLIER     (1<<7)
---- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
-+++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
-@@ -1067,15 +1067,19 @@ static bool ath9k_rx_prepare(struct ath9
- 
- 	last_rssi = priv->rx.last_rssi;
- 
--	if (likely(last_rssi != ATH_RSSI_DUMMY_MARKER))
--		rxbuf->rxstatus.rs_rssi = ATH_EP_RND(last_rssi,
--						     ATH_RSSI_EP_MULTIPLIER);
-+	if (ieee80211_is_beacon(hdr->frame_control) &&
-+	    !is_zero_ether_addr(common->curbssid) &&
-+	    ether_addr_equal(hdr->addr3, common->curbssid)) {
-+		s8 rssi = rxbuf->rxstatus.rs_rssi;
- 
--	if (rxbuf->rxstatus.rs_rssi < 0)
--		rxbuf->rxstatus.rs_rssi = 0;
-+		if (likely(last_rssi != ATH_RSSI_DUMMY_MARKER))
-+			rssi = ATH_EP_RND(last_rssi, ATH_RSSI_EP_MULTIPLIER);
- 
--	if (ieee80211_is_beacon(fc))
--		priv->ah->stats.avgbrssi = rxbuf->rxstatus.rs_rssi;
-+		if (rssi < 0)
-+			rssi = 0;
-+
-+		priv->ah->stats.avgbrssi = rssi;
+--- a/drivers/net/wireless/ath/ath9k/ath9k.h
++++ b/drivers/net/wireless/ath/ath9k/ath9k.h
+@@ -234,6 +234,7 @@ struct ath_buf {
+ 	dma_addr_t bf_daddr;		/* physical addr of desc */
+ 	dma_addr_t bf_buf_addr;	/* physical addr of data buffer, for DMA */
+ 	bool bf_stale;
++	struct ieee80211_tx_rate rates[4];
+ 	struct ath_buf_state bf_state;
+ };
+ 
+@@ -658,11 +659,10 @@ enum sc_op_flags {
+ struct ath_rate_table;
+ 
+ struct ath9k_vif_iter_data {
+-	const u8 *hw_macaddr; /* phy's hardware address, set
+-			       * before starting iteration for
+-			       * valid bssid mask.
+-			       */
++	u8 hw_macaddr[ETH_ALEN]; /* address of the first vif */
+ 	u8 mask[ETH_ALEN]; /* bssid mask */
++	bool has_hw_macaddr;
++
+ 	int naps;      /* number of AP vifs */
+ 	int nmeshes;   /* number of mesh vifs */
+ 	int nstations; /* number of station vifs */
+--- a/drivers/net/wireless/ath/ath9k/hw.c
++++ b/drivers/net/wireless/ath/ath9k/hw.c
+@@ -1698,12 +1698,11 @@ static void ath9k_hw_reset_opmode(struct
+ 
+ 	ENABLE_REGWRITE_BUFFER(ah);
+ 
+-	REG_WRITE(ah, AR_STA_ID0, get_unaligned_le32(common->macaddr));
+-	REG_WRITE(ah, AR_STA_ID1, get_unaligned_le16(common->macaddr + 4)
+-		  | macStaId1
++	REG_RMW(ah, AR_STA_ID1, macStaId1
+ 		  | AR_STA_ID1_RTS_USE_DEF
+ 		  | (ah->config.ack_6mb ? AR_STA_ID1_ACKCTS_6MB : 0)
+-		  | ah->sta_id1_defaults);
++		  | ah->sta_id1_defaults,
++		  ~AR_STA_ID1_SADH_MASK);
+ 	ath_hw_setbssidmask(common);
+ 	REG_WRITE(ah, AR_DEF_ANTENNA, saveDefAntenna);
+ 	ath9k_hw_write_associd(ah);
+--- a/drivers/net/wireless/ath/ath9k/main.c
++++ b/drivers/net/wireless/ath/ath9k/main.c
+@@ -839,10 +839,14 @@ static void ath9k_vif_iter(void *data, u
+ 	struct ath9k_vif_iter_data *iter_data = data;
+ 	int i;
+ 
+-	if (iter_data->hw_macaddr)
++	if (iter_data->has_hw_macaddr) {
+ 		for (i = 0; i < ETH_ALEN; i++)
+ 			iter_data->mask[i] &=
+ 				~(iter_data->hw_macaddr[i] ^ mac[i]);
++	} else {
++		memcpy(iter_data->hw_macaddr, mac, ETH_ALEN);
++		iter_data->has_hw_macaddr = true;
 +	}
  
- 	rx_status->mactime = be64_to_cpu(rxbuf->rxstatus.rs_tstamp);
- 	rx_status->band = hw->conf.channel->band;
+ 	switch (vif->type) {
+ 	case NL80211_IFTYPE_AP:
+@@ -891,7 +895,6 @@ void ath9k_calculate_iter_data(struct ie
+ 	 * together with the BSSID mask when matching addresses.
+ 	 */
+ 	memset(iter_data, 0, sizeof(*iter_data));
+-	iter_data->hw_macaddr = common->macaddr;
+ 	memset(&iter_data->mask, 0xff, ETH_ALEN);
+ 
+ 	if (vif)
+@@ -901,6 +904,8 @@ void ath9k_calculate_iter_data(struct ie
+ 	ieee80211_iterate_active_interfaces_atomic(
+ 		sc->hw, IEEE80211_IFACE_ITER_RESUME_ALL,
+ 		ath9k_vif_iter, iter_data);
++
++	memcpy(common->macaddr, iter_data->hw_macaddr, ETH_ALEN);
+ }
+ 
+ /* Called with sc->mutex held. */
+--- a/drivers/net/wireless/ath/ath9k/reg.h
++++ b/drivers/net/wireless/ath/ath9k/reg.h
+@@ -1493,9 +1493,6 @@ enum {
+ #define AR9271_RADIO_RF_RST			0x20
+ #define AR9271_GATE_MAC_CTL			0x4000
+ 
+-#define AR_STA_ID0                 0x8000
+-#define AR_STA_ID1                 0x8004
+-#define AR_STA_ID1_SADH_MASK       0x0000FFFF
+ #define AR_STA_ID1_STA_AP          0x00010000
+ #define AR_STA_ID1_ADHOC           0x00020000
+ #define AR_STA_ID1_PWR_SAV         0x00040000
+--- a/drivers/net/wireless/ath/hw.c
++++ b/drivers/net/wireless/ath/hw.c
+@@ -118,6 +118,12 @@
+ void ath_hw_setbssidmask(struct ath_common *common)
+ {
+ 	void *ah = common->ah;
++	u32 id1;
++
++	REG_WRITE(ah, AR_STA_ID0, get_unaligned_le32(common->macaddr));
++	id1 = REG_READ(ah, AR_STA_ID1) & ~AR_STA_ID1_SADH_MASK;
++	id1 |= get_unaligned_le16(common->macaddr + 4);
++	REG_WRITE(ah, AR_STA_ID1, id1);
+ 
+ 	REG_WRITE(ah, AR_BSSMSKL, get_unaligned_le32(common->bssidmask));
+ 	REG_WRITE(ah, AR_BSSMSKU, get_unaligned_le16(common->bssidmask + 4));
+--- a/drivers/net/wireless/ath/reg.h
++++ b/drivers/net/wireless/ath/reg.h
+@@ -23,6 +23,10 @@
+ #define AR_MIBC_CMC		0x00000004
+ #define AR_MIBC_MCS		0x00000008
+ 
++#define AR_STA_ID0		0x8000
++#define AR_STA_ID1		0x8004
++#define AR_STA_ID1_SADH_MASK	0x0000ffff
++
+ /*
+  * BSSID mask registers. See ath_hw_set_bssid_mask()
+  * for detailed documentation about these registers.
+--- a/drivers/net/wireless/iwlegacy/4965-mac.c
++++ b/drivers/net/wireless/iwlegacy/4965-mac.c
+@@ -6059,7 +6059,7 @@ il4965_mac_channel_switch(struct ieee802
+ 	struct il_priv *il = hw->priv;
+ 	const struct il_channel_info *ch_info;
+ 	struct ieee80211_conf *conf = &hw->conf;
+-	struct ieee80211_channel *channel = ch_switch->channel;
++	struct ieee80211_channel *channel = ch_switch->chandef.chan;
+ 	struct il_ht_config *ht_conf = &il->current_ht_config;
+ 	u16 ch;
+ 
+@@ -6096,23 +6096,21 @@ il4965_mac_channel_switch(struct ieee802
+ 	il->current_ht_config.smps = conf->smps_mode;
+ 
+ 	/* Configure HT40 channels */
+-	il->ht.enabled = conf_is_ht(conf);
+-	if (il->ht.enabled) {
+-		if (conf_is_ht40_minus(conf)) {
+-			il->ht.extension_chan_offset =
+-			    IEEE80211_HT_PARAM_CHA_SEC_BELOW;
+-			il->ht.is_40mhz = true;
+-		} else if (conf_is_ht40_plus(conf)) {
+-			il->ht.extension_chan_offset =
+-			    IEEE80211_HT_PARAM_CHA_SEC_ABOVE;
+-			il->ht.is_40mhz = true;
+-		} else {
+-			il->ht.extension_chan_offset =
+-			    IEEE80211_HT_PARAM_CHA_SEC_NONE;
+-			il->ht.is_40mhz = false;
+-		}
+-	} else
++	switch (cfg80211_get_chandef_type(&ch_switch->chandef)) {
++	case NL80211_CHAN_NO_HT:
++	case NL80211_CHAN_HT20:
+ 		il->ht.is_40mhz = false;
++		il->ht.extension_chan_offset = IEEE80211_HT_PARAM_CHA_SEC_NONE;
++		break;
++	case NL80211_CHAN_HT40MINUS:
++		il->ht.extension_chan_offset = IEEE80211_HT_PARAM_CHA_SEC_BELOW;
++		il->ht.is_40mhz = true;
++		break;
++	case NL80211_CHAN_HT40PLUS:
++		il->ht.extension_chan_offset = IEEE80211_HT_PARAM_CHA_SEC_ABOVE;
++		il->ht.is_40mhz = true;
++		break;
++	}
+ 
+ 	if ((le16_to_cpu(il->staging.channel) != ch))
+ 		il->staging.flags = 0;
+--- a/drivers/net/wireless/iwlegacy/4965.c
++++ b/drivers/net/wireless/iwlegacy/4965.c
+@@ -1493,7 +1493,7 @@ il4965_hw_channel_switch(struct il_priv 
+ 
+ 	cmd.band = band;
+ 	cmd.expect_beacon = 0;
+-	ch = ch_switch->channel->hw_value;
++	ch = ch_switch->chandef.chan->hw_value;
+ 	cmd.channel = cpu_to_le16(ch);
+ 	cmd.rxon_flags = il->staging.flags;
+ 	cmd.rxon_filter_flags = il->staging.filter_flags;
+--- a/drivers/net/wireless/iwlwifi/dvm/devices.c
++++ b/drivers/net/wireless/iwlwifi/dvm/devices.c
+@@ -379,7 +379,7 @@ static int iwl5000_hw_channel_switch(str
+ 	};
+ 
+ 	cmd.band = priv->band == IEEE80211_BAND_2GHZ;
+-	ch = ch_switch->channel->hw_value;
++	ch = ch_switch->chandef.chan->hw_value;
+ 	IWL_DEBUG_11H(priv, "channel switch from %d to %d\n",
+ 		      ctx->active.channel, ch);
+ 	cmd.channel = cpu_to_le16(ch);
+@@ -414,7 +414,8 @@ static int iwl5000_hw_channel_switch(str
+ 	}
+ 	IWL_DEBUG_11H(priv, "uCode time for the switch is 0x%x\n",
+ 		      cmd.switch_time);
+-	cmd.expect_beacon = ch_switch->channel->flags & IEEE80211_CHAN_RADAR;
++	cmd.expect_beacon =
++		ch_switch->chandef.chan->flags & IEEE80211_CHAN_RADAR;
+ 
+ 	return iwl_dvm_send_cmd(priv, &hcmd);
+ }
+@@ -540,7 +541,7 @@ static int iwl6000_hw_channel_switch(str
+ 	hcmd.data[0] = cmd;
+ 
+ 	cmd->band = priv->band == IEEE80211_BAND_2GHZ;
+-	ch = ch_switch->channel->hw_value;
++	ch = ch_switch->chandef.chan->hw_value;
+ 	IWL_DEBUG_11H(priv, "channel switch from %u to %u\n",
+ 		      ctx->active.channel, ch);
+ 	cmd->channel = cpu_to_le16(ch);
+@@ -575,7 +576,8 @@ static int iwl6000_hw_channel_switch(str
+ 	}
+ 	IWL_DEBUG_11H(priv, "uCode time for the switch is 0x%x\n",
+ 		      cmd->switch_time);
+-	cmd->expect_beacon = ch_switch->channel->flags & IEEE80211_CHAN_RADAR;
++	cmd->expect_beacon =
++		ch_switch->chandef.chan->flags & IEEE80211_CHAN_RADAR;
+ 
+ 	err = iwl_dvm_send_cmd(priv, &hcmd);
+ 	kfree(cmd);
+--- a/drivers/net/wireless/iwlwifi/dvm/mac80211.c
++++ b/drivers/net/wireless/iwlwifi/dvm/mac80211.c
+@@ -970,7 +970,7 @@ static void iwlagn_mac_channel_switch(st
+ {
+ 	struct iwl_priv *priv = IWL_MAC80211_GET_DVM(hw);
+ 	struct ieee80211_conf *conf = &hw->conf;
+-	struct ieee80211_channel *channel = ch_switch->channel;
++	struct ieee80211_channel *channel = ch_switch->chandef.chan;
+ 	struct iwl_ht_config *ht_conf = &priv->current_ht_config;
+ 	/*
+ 	 * MULTI-FIXME
+@@ -1008,11 +1008,21 @@ static void iwlagn_mac_channel_switch(st
+ 	priv->current_ht_config.smps = conf->smps_mode;
+ 
+ 	/* Configure HT40 channels */
+-	ctx->ht.enabled = conf_is_ht(conf);
+-	if (ctx->ht.enabled)
+-		iwlagn_config_ht40(conf, ctx);
+-	else
++	switch (cfg80211_get_chandef_type(&ch_switch->chandef)) {
++	case NL80211_CHAN_NO_HT:
++	case NL80211_CHAN_HT20:
+ 		ctx->ht.is_40mhz = false;
++		ctx->ht.extension_chan_offset = IEEE80211_HT_PARAM_CHA_SEC_NONE;
++		break;
++	case NL80211_CHAN_HT40MINUS:
++		ctx->ht.extension_chan_offset = IEEE80211_HT_PARAM_CHA_SEC_BELOW;
++		ctx->ht.is_40mhz = true;
++		break;
++	case NL80211_CHAN_HT40PLUS:
++		ctx->ht.extension_chan_offset = IEEE80211_HT_PARAM_CHA_SEC_ABOVE;
++		ctx->ht.is_40mhz = true;
++		break;
++	}
+ 
+ 	if ((le16_to_cpu(ctx->staging.channel) != ch))
+ 		ctx->staging.flags = 0;
+--- a/drivers/net/wireless/iwlwifi/dvm/rxon.c
++++ b/drivers/net/wireless/iwlwifi/dvm/rxon.c
+@@ -1160,7 +1160,7 @@ int iwlagn_commit_rxon(struct iwl_priv *
+ }
+ 
+ void iwlagn_config_ht40(struct ieee80211_conf *conf,
+-	struct iwl_rxon_context *ctx)
++			struct iwl_rxon_context *ctx)
+ {
+ 	if (conf_is_ht40_minus(conf)) {
+ 		ctx->ht.extension_chan_offset =
+--- a/drivers/net/wireless/mac80211_hwsim.c
++++ b/drivers/net/wireless/mac80211_hwsim.c
+@@ -25,6 +25,7 @@
+ #include <linux/if_arp.h>
+ #include <linux/rtnetlink.h>
+ #include <linux/etherdevice.h>
++#include <linux/platform_device.h>
+ #include <linux/debugfs.h>
+ #include <linux/module.h>
+ #include <linux/ktime.h>
+@@ -717,9 +718,17 @@ static bool mac80211_hwsim_tx_frame_no_n
+ 	rx_status.flag |= RX_FLAG_MACTIME_START;
+ 	rx_status.freq = chan->center_freq;
+ 	rx_status.band = chan->band;
+-	rx_status.rate_idx = info->control.rates[0].idx;
+-	if (info->control.rates[0].flags & IEEE80211_TX_RC_MCS)
+-		rx_status.flag |= RX_FLAG_HT;
++	if (info->control.rates[0].flags & IEEE80211_TX_RC_VHT_MCS) {
++		rx_status.rate_idx =
++			ieee80211_rate_get_vht_mcs(&info->control.rates[0]);
++		rx_status.vht_nss =
++			ieee80211_rate_get_vht_nss(&info->control.rates[0]);
++		rx_status.flag |= RX_FLAG_VHT;
++	} else {
++		rx_status.rate_idx = info->control.rates[0].idx;
++		if (info->control.rates[0].flags & IEEE80211_TX_RC_MCS)
++			rx_status.flag |= RX_FLAG_HT;
++	}
+ 	if (info->control.rates[0].flags & IEEE80211_TX_RC_40_MHZ_WIDTH)
+ 		rx_status.flag |= RX_FLAG_40MHZ;
+ 	if (info->control.rates[0].flags & IEEE80211_TX_RC_SHORT_GI)
+@@ -1687,6 +1696,7 @@ static void mac80211_hwsim_free(void)
+ 		debugfs_remove(data->debugfs_ps);
+ 		debugfs_remove(data->debugfs);
+ 		ieee80211_unregister_hw(data->hw);
++		device_release_driver(data->dev);
+ 		device_unregister(data->dev);
+ 		ieee80211_free_hw(data->hw);
+ 	}
+@@ -1695,7 +1705,9 @@ static void mac80211_hwsim_free(void)
+ 
+ 
+ static struct device_driver mac80211_hwsim_driver = {
+-	.name = "mac80211_hwsim"
++	.name = "mac80211_hwsim",
++	.bus = &platform_bus_type,
++	.owner = THIS_MODULE,
+ };
+ 
+ static const struct net_device_ops hwsim_netdev_ops = {
+@@ -2187,9 +2199,15 @@ static int __init init_mac80211_hwsim(vo
+ 	spin_lock_init(&hwsim_radio_lock);
+ 	INIT_LIST_HEAD(&hwsim_radios);
+ 
++	err = driver_register(&mac80211_hwsim_driver);
++	if (err)
++		return err;
++
+ 	hwsim_class = class_create(THIS_MODULE, "mac80211_hwsim");
+-	if (IS_ERR(hwsim_class))
+-		return PTR_ERR(hwsim_class);
++	if (IS_ERR(hwsim_class)) {
++		err = PTR_ERR(hwsim_class);
++		goto failed_unregister_driver;
++	}
+ 
+ 	memset(addr, 0, ETH_ALEN);
+ 	addr[0] = 0x02;
+@@ -2211,12 +2229,20 @@ static int __init init_mac80211_hwsim(vo
+ 					  "hwsim%d", i);
+ 		if (IS_ERR(data->dev)) {
+ 			printk(KERN_DEBUG
+-			       "mac80211_hwsim: device_create "
+-			       "failed (%ld)\n", PTR_ERR(data->dev));
++			       "mac80211_hwsim: device_create failed (%ld)\n",
++			       PTR_ERR(data->dev));
+ 			err = -ENOMEM;
+ 			goto failed_drvdata;
+ 		}
+ 		data->dev->driver = &mac80211_hwsim_driver;
++		err = device_bind_driver(data->dev);
++		if (err != 0) {
++			printk(KERN_DEBUG
++			       "mac80211_hwsim: device_bind_driver failed (%d)\n",
++			       err);
++			goto failed_hw;
++		}
++
+ 		skb_queue_head_init(&data->pending);
+ 
+ 		SET_IEEE80211_DEV(hw, data->dev);
+@@ -2515,6 +2541,8 @@ failed_drvdata:
+ 	ieee80211_free_hw(hw);
+ failed:
+ 	mac80211_hwsim_free();
++failed_unregister_driver:
++	driver_unregister(&mac80211_hwsim_driver);
+ 	return err;
+ }
+ module_init(init_mac80211_hwsim);
+@@ -2527,5 +2555,6 @@ static void __exit exit_mac80211_hwsim(v
+ 
+ 	mac80211_hwsim_free();
+ 	unregister_netdev(hwsim_mon);
++	driver_unregister(&mac80211_hwsim_driver);
+ }
+ module_exit(exit_mac80211_hwsim);
+--- a/drivers/net/wireless/ti/wl12xx/cmd.c
++++ b/drivers/net/wireless/ti/wl12xx/cmd.c
+@@ -301,7 +301,7 @@ int wl12xx_cmd_channel_switch(struct wl1
+ 	}
+ 
+ 	cmd->role_id = wlvif->role_id;
+-	cmd->channel = ch_switch->channel->hw_value;
++	cmd->channel = ch_switch->chandef.chan->hw_value;
+ 	cmd->switch_time = ch_switch->count;
+ 	cmd->stop_tx = ch_switch->block_tx;
+ 
+--- a/drivers/net/wireless/ti/wl18xx/cmd.c
++++ b/drivers/net/wireless/ti/wl18xx/cmd.c
+@@ -42,11 +42,11 @@ int wl18xx_cmd_channel_switch(struct wl1
+ 	}
+ 
+ 	cmd->role_id = wlvif->role_id;
+-	cmd->channel = ch_switch->channel->hw_value;
++	cmd->channel = ch_switch->chandef.chan->hw_value;
+ 	cmd->switch_time = ch_switch->count;
+ 	cmd->stop_tx = ch_switch->block_tx;
+ 
+-	switch (ch_switch->channel->band) {
++	switch (ch_switch->chandef.chan->band) {
+ 	case IEEE80211_BAND_2GHZ:
+ 		cmd->band = WLCORE_BAND_2_4GHZ;
+ 		break;
+@@ -55,7 +55,7 @@ int wl18xx_cmd_channel_switch(struct wl1
+ 		break;
+ 	default:
+ 		wl1271_error("invalid channel switch band: %d",
+-			     ch_switch->channel->band);
++			     ch_switch->chandef.chan->band);
+ 		ret = -EINVAL;
+ 		goto out_free;
+ 	}
 --- a/include/linux/ieee80211.h
 +++ b/include/linux/ieee80211.h
-@@ -185,7 +185,7 @@ struct ieee80211_hdr {
- 	u8 addr3[6];
- 	__le16 seq_ctrl;
- 	u8 addr4[6];
--} __packed;
-+} __packed __aligned(2);
- 
- struct ieee80211_hdr_3addr {
- 	__le16 frame_control;
-@@ -194,7 +194,7 @@ struct ieee80211_hdr_3addr {
- 	u8 addr2[6];
- 	u8 addr3[6];
- 	__le16 seq_ctrl;
--} __packed;
-+} __packed __aligned(2);
- 
- struct ieee80211_qos_hdr {
- 	__le16 frame_control;
-@@ -204,7 +204,7 @@ struct ieee80211_qos_hdr {
- 	u8 addr3[6];
- 	__le16 seq_ctrl;
- 	__le16 qos_ctrl;
--} __packed;
-+} __packed __aligned(2);
+@@ -673,6 +673,36 @@ struct ieee80211_channel_sw_ie {
+ } __packed;
+ 
+ /**
++ * struct ieee80211_ext_chansw_ie
++ *
++ * This structure represents the "Extended Channel Switch Announcement element"
++ */
++struct ieee80211_ext_chansw_ie {
++	u8 mode;
++	u8 new_operating_class;
++	u8 new_ch_num;
++	u8 count;
++} __packed;
++
++/**
++ * struct ieee80211_sec_chan_offs_ie - secondary channel offset IE
++ * @sec_chan_offs: secondary channel offset, uses IEEE80211_HT_PARAM_CHA_SEC_*
++ *	values here
++ * This structure represents the "Secondary Channel Offset element"
++ */
++struct ieee80211_sec_chan_offs_ie {
++	u8 sec_chan_offs;
++} __packed;
++
++/**
++ * struct ieee80211_wide_bw_chansw_ie - wide bandwidth channel switch IE
++ */
++struct ieee80211_wide_bw_chansw_ie {
++	u8 new_channel_width;
++	u8 new_center_freq_seg0, new_center_freq_seg1;
++} __packed;
++
++/**
+  * struct ieee80211_tim
+  *
+  * This structure refers to "Traffic Indication Map information element"
+@@ -840,12 +870,15 @@ struct ieee80211_mgmt {
+ 				} __packed wme_action;
+ 				struct{
+ 					u8 action_code;
+-					u8 element_id;
+-					u8 length;
+-					struct ieee80211_channel_sw_ie sw_elem;
++					u8 variable[0];
+ 				} __packed chan_switch;
+ 				struct{
+ 					u8 action_code;
++					struct ieee80211_ext_chansw_ie data;
++					u8 variable[0];
++				} __packed ext_chan_switch;
++				struct{
++					u8 action_code;
+ 					u8 dialog_token;
+ 					u8 element_id;
+ 					u8 length;
+@@ -1638,6 +1671,7 @@ enum ieee80211_eid {
+ 
+ 	WLAN_EID_HT_CAPABILITY = 45,
+ 	WLAN_EID_HT_OPERATION = 61,
++	WLAN_EID_SECONDARY_CHANNEL_OFFSET = 62,
+ 
+ 	WLAN_EID_RSN = 48,
+ 	WLAN_EID_MMIE = 76,
+@@ -1672,6 +1706,8 @@ enum ieee80211_eid {
+ 	WLAN_EID_VHT_CAPABILITY = 191,
+ 	WLAN_EID_VHT_OPERATION = 192,
+ 	WLAN_EID_OPMODE_NOTIF = 199,
++	WLAN_EID_WIDE_BW_CHANNEL_SWITCH = 194,
++	WLAN_EID_CHANNEL_SWITCH_WRAPPER = 196,
+ 
+ 	/* 802.11ad */
+ 	WLAN_EID_NON_TX_BSSID_CAP =  83,
+@@ -1795,6 +1831,7 @@ enum ieee80211_key_len {
+ 
+ /* Public action codes */
+ enum ieee80211_pub_actioncode {
++	WLAN_PUB_ACTION_EXT_CHANSW_ANN = 4,
+ 	WLAN_PUB_ACTION_TDLS_DISCOVER_RES = 14,
+ };
+ 
+--- a/include/net/cfg80211.h
++++ b/include/net/cfg80211.h
+@@ -753,6 +753,8 @@ int cfg80211_check_station_change(struct
+  * @STATION_INFO_LOCAL_PM: @local_pm filled
+  * @STATION_INFO_PEER_PM: @peer_pm filled
+  * @STATION_INFO_NONPEER_PM: @nonpeer_pm filled
++ * @STATION_INFO_CHAIN_SIGNAL: @chain_signal filled
++ * @STATION_INFO_CHAIN_SIGNAL_AVG: @chain_signal_avg filled
+  */
+ enum station_info_flags {
+ 	STATION_INFO_INACTIVE_TIME	= 1<<0,
+@@ -781,6 +783,8 @@ enum station_info_flags {
+ 	STATION_INFO_NONPEER_PM		= 1<<23,
+ 	STATION_INFO_RX_BYTES64		= 1<<24,
+ 	STATION_INFO_TX_BYTES64		= 1<<25,
++	STATION_INFO_CHAIN_SIGNAL	= 1<<26,
++	STATION_INFO_CHAIN_SIGNAL_AVG	= 1<<27,
+ };
+ 
+ /**
+@@ -857,6 +861,8 @@ struct sta_bss_parameters {
+ 	u16 beacon_interval;
+ };
  
++#define IEEE80211_MAX_CHAINS	4
++
  /**
-  * ieee80211_has_tods - check if IEEE80211_FCTL_TODS is set
-@@ -581,7 +581,7 @@ struct ieee80211s_hdr {
- 	__le32 seqnum;
- 	u8 eaddr1[6];
- 	u8 eaddr2[6];
--} __packed;
-+} __packed __aligned(2);
- 
- /* Mesh flags */
- #define MESH_FLAGS_AE_A4 	0x1
-@@ -875,7 +875,7 @@ struct ieee80211_mgmt {
- 			} u;
- 		} __packed action;
- 	} u;
--} __packed;
-+} __packed __aligned(2);
- 
- /* Supported Rates value encodings in 802.11n-2009 7.3.2.2 */
- #define BSS_MEMBERSHIP_SELECTOR_HT_PHY	127
-@@ -906,20 +906,20 @@ struct ieee80211_rts {
- 	__le16 duration;
- 	u8 ra[6];
- 	u8 ta[6];
--} __packed;
-+} __packed __aligned(2);
- 
- struct ieee80211_cts {
- 	__le16 frame_control;
- 	__le16 duration;
- 	u8 ra[6];
--} __packed;
-+} __packed __aligned(2);
- 
- struct ieee80211_pspoll {
- 	__le16 frame_control;
- 	__le16 aid;
- 	u8 bssid[6];
- 	u8 ta[6];
--} __packed;
-+} __packed __aligned(2);
- 
- /* TDLS */
+  * struct station_info - station information
+  *
+@@ -874,6 +880,9 @@ struct sta_bss_parameters {
+  *	For CFG80211_SIGNAL_TYPE_MBM, value is expressed in _dBm_.
+  * @signal_avg: Average signal strength, type depends on the wiphy's signal_type.
+  *	For CFG80211_SIGNAL_TYPE_MBM, value is expressed in _dBm_.
++ * @chains: bitmask for filled values in @chain_signal, @chain_signal_avg
++ * @chain_signal: per-chain signal strength of last received packet in dBm
++ * @chain_signal_avg: per-chain signal strength average in dBm
+  * @txrate: current unicast bitrate from this station
+  * @rxrate: current unicast bitrate to this station
+  * @rx_packets: packets received from this station
+@@ -909,6 +918,11 @@ struct station_info {
+ 	u8 plink_state;
+ 	s8 signal;
+ 	s8 signal_avg;
++
++	u8 chains;
++	s8 chain_signal[IEEE80211_MAX_CHAINS];
++	s8 chain_signal_avg[IEEE80211_MAX_CHAINS];
++
+ 	struct rate_info txrate;
+ 	struct rate_info rxrate;
+ 	u32 rx_packets;
+@@ -4027,6 +4041,17 @@ bool cfg80211_reg_can_beacon(struct wiph
+ void cfg80211_ch_switch_notify(struct net_device *dev,
+ 			       struct cfg80211_chan_def *chandef);
+ 
++/**
++ * ieee80211_operating_class_to_band - convert operating class to band
++ *
++ * @operating_class: the operating class to convert
++ * @band: band pointer to fill
++ *
++ * Returns %true if the conversion was successful, %false otherwise.
++ */
++bool ieee80211_operating_class_to_band(u8 operating_class,
++				       enum ieee80211_band *band);
++
+ /*
+  * cfg80211_tdls_oper_request - request userspace to perform TDLS operation
+  * @dev: the device on which the operation is requested
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -210,7 +210,7 @@ struct ieee80211_chanctx_conf {
+  * @BSS_CHANGED_QOS: QoS for this association was enabled/disabled. Note
+  *	that it is only ever disabled for station mode.
+  * @BSS_CHANGED_IDLE: Idle changed for this BSS/interface.
+- * @BSS_CHANGED_SSID: SSID changed for this BSS (AP mode)
++ * @BSS_CHANGED_SSID: SSID changed for this BSS (AP and IBSS mode)
+  * @BSS_CHANGED_AP_PROBE_RESP: Probe Response changed for this BSS (AP mode)
+  * @BSS_CHANGED_PS: PS changed for this BSS (STA mode)
+  * @BSS_CHANGED_TXPOWER: TX power setting changed for this interface
+@@ -327,7 +327,7 @@ enum ieee80211_rssi_event {
+  *	your driver/device needs to do.
+  * @ps: power-save mode (STA only). This flag is NOT affected by
+  *	offchannel/dynamic_ps operations.
+- * @ssid: The SSID of the current vif. Only valid in AP-mode.
++ * @ssid: The SSID of the current vif. Valid in AP and IBSS mode.
+  * @ssid_len: Length of SSID given in @ssid.
+  * @hidden_ssid: The SSID of the current vif is hidden. Only valid in AP-mode.
+  * @txpower: TX power in dBm
+@@ -562,6 +562,9 @@ enum mac80211_rate_control_flags {
+ /* maximum number of rate stages */
+ #define IEEE80211_TX_MAX_RATES	4
+ 
++/* maximum number of rate table entries */
++#define IEEE80211_TX_RATE_TABLE_SIZE	4
++
+ /**
+  * struct ieee80211_tx_rate - rate selection/status
+  *
+@@ -602,8 +605,8 @@ static inline void ieee80211_rate_set_vh
+ 					  u8 mcs, u8 nss)
+ {
+ 	WARN_ON(mcs & ~0xF);
+-	WARN_ON(nss & ~0x7);
+-	rate->idx = (nss << 4) | mcs;
++	WARN_ON((nss - 1) & ~0x7);
++	rate->idx = ((nss - 1) << 4) | mcs;
+ }
+ 
+ static inline u8
+@@ -615,7 +618,7 @@ ieee80211_rate_get_vht_mcs(const struct 
+ static inline u8
+ ieee80211_rate_get_vht_nss(const struct ieee80211_tx_rate *rate)
+ {
+-	return rate->idx >> 4;
++	return (rate->idx >> 4) + 1;
+ }
+ 
+ /**
+@@ -656,7 +659,11 @@ struct ieee80211_tx_info {
+ 					struct ieee80211_tx_rate rates[
+ 						IEEE80211_TX_MAX_RATES];
+ 					s8 rts_cts_rate_idx;
+-					/* 3 bytes free */
++					u8 use_rts:1;
++					u8 use_cts_prot:1;
++					u8 short_preamble:1;
++					u8 skip_table:1;
++					/* 2 bytes free */
+ 				};
+ 				/* only needed before rate control */
+ 				unsigned long jiffies;
+@@ -677,6 +684,8 @@ struct ieee80211_tx_info {
+ 		struct {
+ 			struct ieee80211_tx_rate driver_rates[
+ 				IEEE80211_TX_MAX_RATES];
++			u8 pad[4];
++
+ 			void *rate_driver_data[
+ 				IEEE80211_TX_INFO_RATE_DRIVER_DATA_SIZE / sizeof(void *)];
+ 		};
+@@ -840,6 +849,9 @@ enum mac80211_rx_flags {
+  * @signal: signal strength when receiving this frame, either in dBm, in dB or
+  *	unspecified depending on the hardware capabilities flags
+  *	@IEEE80211_HW_SIGNAL_*
++ * @chains: bitmask of receive chains for which separate signal strength
++ *	values were filled.
++ * @chain_signal: per-chain signal strength, same format as @signal
+  * @antenna: antenna used
+  * @rate_idx: index of data rate into band's supported rates or MCS index if
+  *	HT or VHT is used (%RX_FLAG_HT/%RX_FLAG_VHT)
+@@ -871,6 +883,8 @@ struct ieee80211_rx_status {
+ 	u8 band;
+ 	u8 antenna;
+ 	s8 signal;
++	u8 chains;
++	s8 chain_signal[IEEE80211_MAX_CHAINS];
+ 	u8 ampdu_delimiter_crc;
+ 	u8 vendor_radiotap_align;
+ 	u8 vendor_radiotap_oui[3];
+@@ -1018,13 +1032,13 @@ struct ieee80211_conf {
+  *	the driver passed into mac80211.
+  * @block_tx: Indicates whether transmission must be blocked before the
+  *	scheduled channel switch, as indicated by the AP.
+- * @channel: the new channel to switch to
++ * @chandef: the new channel to switch to
+  * @count: the number of TBTT's until the channel switch event
+  */
+ struct ieee80211_channel_switch {
+ 	u64 timestamp;
+ 	bool block_tx;
+-	struct ieee80211_channel *channel;
++	struct cfg80211_chan_def chandef;
+ 	u8 count;
+ };
+ 
+@@ -1222,6 +1236,24 @@ enum ieee80211_sta_rx_bandwidth {
+ };
+ 
+ /**
++ * struct ieee80211_sta_rates - station rate selection table
++ *
++ * @rcu_head: RCU head used for freeing the table on update
++ * @rates: transmit rates/flags to be used by default.
++ *	Overriding entries per-packet is possible by using cb tx control.
++ */
++struct ieee80211_sta_rates {
++	struct rcu_head rcu_head;
++	struct {
++		s8 idx;
++		u8 count;
++		u8 count_cts;
++		u8 count_rts;
++		u16 flags;
++	} rate[IEEE80211_TX_RATE_TABLE_SIZE];
++};
++
++/**
+  * struct ieee80211_sta - station table entry
+  *
+  * A station table entry represents a station we are possibly
+@@ -1248,6 +1280,7 @@ enum ieee80211_sta_rx_bandwidth {
+  *	notifications and capabilities. The value is only valid after
+  *	the station moves to associated state.
+  * @smps_mode: current SMPS mode (off, static or dynamic)
++ * @tx_rates: rate control selection table
+  */
+ struct ieee80211_sta {
+ 	u32 supp_rates[IEEE80211_NUM_BANDS];
+@@ -1261,6 +1294,7 @@ struct ieee80211_sta {
+ 	u8 rx_nss;
+ 	enum ieee80211_sta_rx_bandwidth bandwidth;
+ 	enum ieee80211_smps_mode smps_mode;
++	struct ieee80211_sta_rates __rcu *rates;
+ 
+ 	/* must be last */
+ 	u8 drv_priv[0] __aligned(sizeof(void *));
+@@ -1416,6 +1450,9 @@ struct ieee80211_tx_control {
+  *	for different virtual interfaces. See the doc section on HW queue
+  *	control for more details.
+  *
++ * @IEEE80211_HW_SUPPORTS_RC_TABLE: The driver supports using a rate
++ *	selection table provided by the rate control algorithm.
++ *
+  * @IEEE80211_HW_P2P_DEV_ADDR_FOR_INTF: Use the P2P Device address for any
+  *	P2P Interface. This will be honoured even if more than one interface
+  *	is supported.
+@@ -1448,6 +1485,7 @@ enum ieee80211_hw_flags {
+ 	IEEE80211_HW_SUPPORTS_PER_STA_GTK		= 1<<21,
+ 	IEEE80211_HW_AP_LINK_PS				= 1<<22,
+ 	IEEE80211_HW_TX_AMPDU_SETUP_IN_HW		= 1<<23,
++	IEEE80211_HW_SUPPORTS_RC_TABLE			= 1<<24,
+ 	IEEE80211_HW_P2P_DEV_ADDR_FOR_INTF		= 1<<25,
+ 	IEEE80211_HW_TIMING_BEACON_ONLY			= 1<<26,
+ };
+@@ -3144,6 +3182,25 @@ void ieee80211_sta_set_buffered(struct i
+ 				u8 tid, bool buffered);
+ 
+ /**
++ * ieee80211_get_tx_rates - get the selected transmit rates for a packet
++ *
++ * Call this function in a driver with per-packet rate selection support
++ * to combine the rate info in the packet tx info with the most recent
++ * rate selection table for the station entry.
++ *
++ * @vif: &struct ieee80211_vif pointer from the add_interface callback.
++ * @sta: the receiver station to which this packet is sent.
++ * @skb: the frame to be transmitted.
++ * @dest: buffer for extracted rate/retry information
++ * @max_rates: maximum number of rates to fetch
++ */
++void ieee80211_get_tx_rates(struct ieee80211_vif *vif,
++			    struct ieee80211_sta *sta,
++			    struct sk_buff *skb,
++			    struct ieee80211_tx_rate *dest,
++			    int max_rates);
++
++/**
+  * ieee80211_tx_status - transmit status callback
+  *
+  * Call this function for all transmitted frames after they have been
+@@ -4118,7 +4175,7 @@ void ieee80211_send_bar(struct ieee80211
+  *	(deprecated; this will be removed once drivers get updated to use
+  *	rate_idx_mask)
+  * @rate_idx_mask: user-requested (legacy) rate mask
+- * @rate_idx_mcs_mask: user-requested MCS rate mask
++ * @rate_idx_mcs_mask: user-requested MCS rate mask (NULL if not in use)
+  * @bss: whether this frame is sent out in AP or IBSS mode
+  */
+ struct ieee80211_tx_rate_control {
+@@ -4130,7 +4187,7 @@ struct ieee80211_tx_rate_control {
+ 	bool rts, short_preamble;
+ 	u8 max_rate_idx;
+ 	u32 rate_idx_mask;
+-	u8 rate_idx_mcs_mask[IEEE80211_HT_MCS_MASK_LEN];
++	u8 *rate_idx_mcs_mask;
+ 	bool bss;
+ };
+ 
+@@ -4219,6 +4276,22 @@ bool rate_usable_index_exists(struct iee
+ 	return false;
+ }
+ 
++/**
++ * rate_control_set_rates - pass the sta rate selection to mac80211/driver
++ *
++ * When not doing a rate control probe to test rates, rate control should pass
++ * its rate selection to mac80211. If the driver supports receiving a station
++ * rate table, it will use it to ensure that frames are always sent based on
++ * the most recent rate control module decision.
++ *
++ * @hw: pointer as obtained from ieee80211_alloc_hw()
++ * @pubsta: &struct ieee80211_sta pointer to the target destination.
++ * @rates: new tx rate set to be used for this station.
++ */
++int rate_control_set_rates(struct ieee80211_hw *hw,
++			   struct ieee80211_sta *pubsta,
++			   struct ieee80211_sta_rates *rates);
++
+ int ieee80211_rate_control_register(struct rate_control_ops *ops);
+ void ieee80211_rate_control_unregister(struct rate_control_ops *ops);
  
 --- a/net/mac80211/agg-rx.c
 +++ b/net/mac80211/agg-rx.c
@@ -140,9 +823,159 @@
  	    sdata->vif.type != NL80211_IFTYPE_ADHOC)
  		return -EINVAL;
  
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -444,7 +444,7 @@ static void sta_set_sinfo(struct sta_inf
+ 	struct ieee80211_local *local = sdata->local;
+ 	struct timespec uptime;
+ 	u64 packets = 0;
+-	int ac;
++	int i, ac;
+ 
+ 	sinfo->generation = sdata->local->sta_generation;
+ 
+@@ -488,6 +488,17 @@ static void sta_set_sinfo(struct sta_inf
+ 			sinfo->signal = (s8)sta->last_signal;
+ 		sinfo->signal_avg = (s8) -ewma_read(&sta->avg_signal);
+ 	}
++	if (sta->chains) {
++		sinfo->filled |= STATION_INFO_CHAIN_SIGNAL |
++				 STATION_INFO_CHAIN_SIGNAL_AVG;
++
++		sinfo->chains = sta->chains;
++		for (i = 0; i < ARRAY_SIZE(sinfo->chain_signal); i++) {
++			sinfo->chain_signal[i] = sta->chain_signal_last[i];
++			sinfo->chain_signal_avg[i] =
++				(s8) -ewma_read(&sta->chain_signal_avg[i]);
++		}
++	}
+ 
+ 	sta_set_rate_info_tx(sta, &sta->last_tx_rate, &sinfo->txrate);
+ 	sta_set_rate_info_rx(sta, &sinfo->rxrate);
+@@ -1052,6 +1063,7 @@ static int ieee80211_stop_ap(struct wiph
+ 	ieee80211_free_keys(sdata);
+ 
+ 	sdata->vif.bss_conf.enable_beacon = false;
++	sdata->vif.bss_conf.ssid_len = 0;
+ 	clear_bit(SDATA_STATE_OFFCHANNEL_BEACON_STOPPED, &sdata->state);
+ 	ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON_ENABLED);
+ 
+@@ -2416,9 +2428,22 @@ static int ieee80211_set_bitrate_mask(st
+ 	}
+ 
+ 	for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
++		struct ieee80211_supported_band *sband = wiphy->bands[i];
++		int j;
++
+ 		sdata->rc_rateidx_mask[i] = mask->control[i].legacy;
+ 		memcpy(sdata->rc_rateidx_mcs_mask[i], mask->control[i].mcs,
+ 		       sizeof(mask->control[i].mcs));
++
++		sdata->rc_has_mcs_mask[i] = false;
++		if (!sband)
++			continue;
++
++		for (j = 0; j < IEEE80211_HT_MCS_MASK_LEN; j++)
++			if (~sdata->rc_rateidx_mcs_mask[i][j]) {
++				sdata->rc_has_mcs_mask[i] = true;
++				break;
++			}
+ 	}
+ 
+ 	return 0;
+--- a/net/mac80211/chan.c
++++ b/net/mac80211/chan.c
+@@ -57,6 +57,22 @@ ieee80211_find_chanctx(struct ieee80211_
+ 	return NULL;
+ }
+ 
++static bool ieee80211_is_radar_required(struct ieee80211_local *local)
++{
++	struct ieee80211_sub_if_data *sdata;
++
++	rcu_read_lock();
++	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
++		if (sdata->radar_required) {
++			rcu_read_unlock();
++			return true;
++		}
++	}
++	rcu_read_unlock();
++
++	return false;
++}
++
+ static struct ieee80211_chanctx *
+ ieee80211_new_chanctx(struct ieee80211_local *local,
+ 		      const struct cfg80211_chan_def *chandef,
+@@ -76,6 +92,9 @@ ieee80211_new_chanctx(struct ieee80211_l
+ 	ctx->conf.rx_chains_static = 1;
+ 	ctx->conf.rx_chains_dynamic = 1;
+ 	ctx->mode = mode;
++	ctx->conf.radar_enabled = ieee80211_is_radar_required(local);
++	if (!local->use_chanctx)
++		local->hw.conf.radar_enabled = ctx->conf.radar_enabled;
+ 
+ 	/* acquire mutex to prevent idle from changing */
+ 	mutex_lock(&local->mtx);
+@@ -110,6 +129,7 @@ ieee80211_new_chanctx(struct ieee80211_l
+ static void ieee80211_free_chanctx(struct ieee80211_local *local,
+ 				   struct ieee80211_chanctx *ctx)
+ {
++	bool check_single_channel = false;
+ 	lockdep_assert_held(&local->chanctx_mtx);
+ 
+ 	WARN_ON_ONCE(ctx->refcount != 0);
+@@ -119,6 +139,14 @@ static void ieee80211_free_chanctx(struc
+ 		chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
+ 		chandef->center_freq1 = chandef->chan->center_freq;
+ 		chandef->center_freq2 = 0;
++
++		/* NOTE: Disabling radar is only valid here for
++		 * single channel context. To be sure, check it ...
++		 */
++		if (local->hw.conf.radar_enabled)
++			check_single_channel = true;
++		local->hw.conf.radar_enabled = false;
++
+ 		ieee80211_hw_config(local, 0);
+ 	} else {
+ 		drv_remove_chanctx(local, ctx);
+@@ -127,6 +155,9 @@ static void ieee80211_free_chanctx(struc
+ 	list_del_rcu(&ctx->list);
+ 	kfree_rcu(ctx, rcu_head);
+ 
++	/* throw a warning if this wasn't the only channel context. */
++	WARN_ON(check_single_channel && !list_empty(&local->chanctx_list));
++
+ 	mutex_lock(&local->mtx);
+ 	ieee80211_recalc_idle(local);
+ 	mutex_unlock(&local->mtx);
+@@ -238,19 +269,11 @@ static void __ieee80211_vif_release_chan
+ void ieee80211_recalc_radar_chanctx(struct ieee80211_local *local,
+ 				    struct ieee80211_chanctx *chanctx)
+ {
+-	struct ieee80211_sub_if_data *sdata;
+-	bool radar_enabled = false;
++	bool radar_enabled;
+ 
+ 	lockdep_assert_held(&local->chanctx_mtx);
+ 
+-	rcu_read_lock();
+-	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
+-		if (sdata->radar_required) {
+-			radar_enabled = true;
+-			break;
+-		}
+-	}
+-	rcu_read_unlock();
++	radar_enabled = ieee80211_is_radar_required(local);
+ 
+ 	if (radar_enabled == chanctx->conf.radar_enabled)
+ 		return;
 --- a/net/mac80211/debugfs_sta.c
 +++ b/net/mac80211/debugfs_sta.c
-@@ -65,11 +65,11 @@ static ssize_t sta_flags_read(struct fil
+@@ -66,11 +66,11 @@ static ssize_t sta_flags_read(struct fil
  	test_sta_flag(sta, WLAN_STA_##flg) ? #flg "\n" : ""
  
  	int res = scnprintf(buf, sizeof(buf),
@@ -156,27 +989,115 @@
  			    TEST(MFP), TEST(BLOCK_BA), TEST(PSPOLL),
  			    TEST(UAPSD), TEST(SP), TEST(TDLS_PEER),
  			    TEST(TDLS_PEER_AUTH), TEST(4ADDR_EVENT),
---- a/net/mac80211/iface.c
-+++ b/net/mac80211/iface.c
-@@ -78,7 +78,7 @@ void ieee80211_recalc_txpower(struct iee
- 		ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_TXPOWER);
+--- a/net/mac80211/ibss.c
++++ b/net/mac80211/ibss.c
+@@ -209,6 +209,8 @@ static void __ieee80211_sta_join_ibss(st
+ 	sdata->vif.bss_conf.enable_beacon = true;
+ 	sdata->vif.bss_conf.beacon_int = beacon_int;
+ 	sdata->vif.bss_conf.basic_rates = basic_rates;
++	sdata->vif.bss_conf.ssid_len = ifibss->ssid_len;
++	memcpy(sdata->vif.bss_conf.ssid, ifibss->ssid, ifibss->ssid_len);
+ 	bss_change = BSS_CHANGED_BEACON_INT;
+ 	bss_change |= ieee80211_reset_erp_info(sdata);
+ 	bss_change |= BSS_CHANGED_BSSID;
+@@ -217,6 +219,7 @@ static void __ieee80211_sta_join_ibss(st
+ 	bss_change |= BSS_CHANGED_BASIC_RATES;
+ 	bss_change |= BSS_CHANGED_HT;
+ 	bss_change |= BSS_CHANGED_IBSS;
++	bss_change |= BSS_CHANGED_SSID;
+ 
+ 	/*
+ 	 * In 5 GHz/802.11a, we can always use short slot time.
+@@ -911,7 +914,7 @@ void ieee80211_rx_mgmt_probe_beacon(stru
+ 		return;
+ 
+ 	ieee802_11_parse_elems(mgmt->u.probe_resp.variable, len - baselen,
+-				&elems);
++			       false, &elems);
+ 
+ 	ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems);
  }
+@@ -1159,6 +1162,7 @@ int ieee80211_ibss_leave(struct ieee8021
+ 	sdata->vif.bss_conf.ibss_joined = false;
+ 	sdata->vif.bss_conf.ibss_creator = false;
+ 	sdata->vif.bss_conf.enable_beacon = false;
++	sdata->vif.bss_conf.ssid_len = 0;
+ 	clear_bit(SDATA_STATE_OFFCHANNEL_BEACON_STOPPED, &sdata->state);
+ 	ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON_ENABLED |
+ 						BSS_CHANGED_IBSS);
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -156,6 +156,7 @@ struct ieee80211_tx_data {
+ 	struct ieee80211_sub_if_data *sdata;
+ 	struct sta_info *sta;
+ 	struct ieee80211_key *key;
++	struct ieee80211_tx_rate rate;
  
--static u32 ieee80211_idle_off(struct ieee80211_local *local)
-+u32 ieee80211_idle_off(struct ieee80211_local *local)
- {
- 	if (!(local->hw.conf.flags & IEEE80211_CONF_IDLE))
- 		return 0;
-@@ -107,7 +107,7 @@ void ieee80211_recalc_idle(struct ieee80
+ 	unsigned int flags;
+ };
+@@ -740,6 +741,8 @@ struct ieee80211_sub_if_data {
  
- 	lockdep_assert_held(&local->mtx);
+ 	/* bitmap of allowed (non-MCS) rate indexes for rate control */
+ 	u32 rc_rateidx_mask[IEEE80211_NUM_BANDS];
++
++	bool rc_has_mcs_mask[IEEE80211_NUM_BANDS];
+ 	u8  rc_rateidx_mcs_mask[IEEE80211_NUM_BANDS][IEEE80211_HT_MCS_MASK_LEN];
+ 
+ 	union {
+@@ -1025,7 +1028,7 @@ struct ieee80211_local {
+ 	enum mac80211_scan_state next_scan_state;
+ 	struct delayed_work scan_work;
+ 	struct ieee80211_sub_if_data __rcu *scan_sdata;
+-	struct ieee80211_channel *csa_channel;
++	struct cfg80211_chan_def csa_chandef;
+ 	/* For backward compatibility only -- do not use */
+ 	struct cfg80211_chan_def _oper_chandef;
+ 
+@@ -1184,10 +1187,13 @@ struct ieee802_11_elems {
+ 	const u8 *perr;
+ 	const struct ieee80211_rann_ie *rann;
+ 	const struct ieee80211_channel_sw_ie *ch_switch_ie;
++	const struct ieee80211_ext_chansw_ie *ext_chansw_ie;
++	const struct ieee80211_wide_bw_chansw_ie *wide_bw_chansw_ie;
+ 	const u8 *country_elem;
+ 	const u8 *pwr_constr_elem;
+ 	const struct ieee80211_timeout_interval_ie *timeout_int;
+ 	const u8 *opmode_notif;
++	const struct ieee80211_sec_chan_offs_ie *sec_chan_offs;
+ 
+ 	/* length of them, respectively */
+ 	u8 ssid_len;
+@@ -1258,10 +1264,6 @@ void ieee80211_recalc_ps_vif(struct ieee
+ int ieee80211_max_network_latency(struct notifier_block *nb,
+ 				  unsigned long data, void *dummy);
+ int ieee80211_set_arp_filter(struct ieee80211_sub_if_data *sdata);
+-void
+-ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
+-				 const struct ieee80211_channel_sw_ie *sw_elem,
+-				 struct ieee80211_bss *bss, u64 timestamp);
+ void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata);
+ void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
+ 				  struct sk_buff *skb);
+@@ -1499,13 +1501,13 @@ static inline void ieee80211_tx_skb(stru
+ 	ieee80211_tx_skb_tid(sdata, skb, 7);
+ }
  
--	active = !list_empty(&local->chanctx_list);
-+	active = !list_empty(&local->chanctx_list) || local->monitors;
+-u32 ieee802_11_parse_elems_crc(u8 *start, size_t len,
++u32 ieee802_11_parse_elems_crc(u8 *start, size_t len, bool action,
+ 			       struct ieee802_11_elems *elems,
+ 			       u64 filter, u32 crc);
+-static inline void ieee802_11_parse_elems(u8 *start, size_t len,
++static inline void ieee802_11_parse_elems(u8 *start, size_t len, bool action,
+ 					  struct ieee802_11_elems *elems)
+ {
+-	ieee802_11_parse_elems_crc(start, len, elems, 0, 0);
++	ieee802_11_parse_elems_crc(start, len, action, elems, 0, 0);
+ }
  
- 	if (!local->ops->remain_on_channel) {
- 		list_for_each_entry(roc, &local->roc_list, list) {
-@@ -436,7 +436,6 @@ int ieee80211_do_open(struct wireless_de
+ u32 ieee80211_mandatory_rates(struct ieee80211_local *local,
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -450,7 +450,6 @@ int ieee80211_do_open(struct wireless_de
  	struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);
  	struct net_device *dev = wdev->netdev;
  	struct ieee80211_local *local = sdata->local;
@@ -184,17 +1105,7 @@
  	u32 changed = 0;
  	int res;
  	u32 hw_reconf_flags = 0;
-@@ -541,6 +540,9 @@ int ieee80211_do_open(struct wireless_de
- 
- 		ieee80211_adjust_monitor_flags(sdata, 1);
- 		ieee80211_configure_filter(local);
-+		mutex_lock(&local->mtx);
-+		ieee80211_recalc_idle(local);
-+		mutex_unlock(&local->mtx);
- 
- 		netif_carrier_on(dev);
- 		break;
-@@ -595,30 +597,8 @@ int ieee80211_do_open(struct wireless_de
+@@ -609,30 +608,8 @@ int ieee80211_do_open(struct wireless_de
  
  	set_bit(SDATA_STATE_RUNNING, &sdata->state);
  
@@ -226,17 +1137,7 @@
  
  	/*
  	 * set_multicast_list will be invoked by the networking core
-@@ -817,6 +797,9 @@ static void ieee80211_do_stop(struct iee
- 
- 		ieee80211_adjust_monitor_flags(sdata, -1);
- 		ieee80211_configure_filter(local);
-+		mutex_lock(&local->mtx);
-+		ieee80211_recalc_idle(local);
-+		mutex_unlock(&local->mtx);
- 		break;
- 	case NL80211_IFTYPE_P2P_DEVICE:
- 		/* relies on synchronize_rcu() below */
-@@ -1022,6 +1005,72 @@ static void ieee80211_if_setup(struct ne
+@@ -1092,6 +1069,74 @@ static void ieee80211_if_setup(struct ne
  	dev->destructor = free_netdev;
  }
  
@@ -252,10 +1153,12 @@
 +	u32 rates = 0;
 +	u16 stype;
 +	bool new = false;
-+	enum ieee80211_band band = local->hw.conf.channel->band;
-+	struct ieee80211_supported_band *sband = local->hw.wiphy->bands[band];
++	enum ieee80211_band band;
++	struct ieee80211_supported_band *sband;
 +
 +	rx_status = IEEE80211_SKB_RXCB(skb);
++	band = rx_status->band;
++	sband = local->hw.wiphy->bands[band];
 +	mgmt = (struct ieee80211_mgmt *) skb->data;
 +	stype = le16_to_cpu(mgmt->frame_control) & IEEE80211_FCTL_STYPE;
 +
@@ -267,7 +1170,7 @@
 +		return;
 +
 +	ieee802_11_parse_elems(mgmt->u.probe_resp.variable,
-+			       skb->len - baselen, &elems);
++			       skb->len - baselen, false, &elems);
 +
 +	rates = ieee80211_sta_get_rates(local, &elems, band, NULL);
 +
@@ -286,7 +1189,7 @@
 +	}
 +
 +	sta->last_rx = jiffies;
-+	sta->sta.supp_rates[local->hw.conf.channel->band] = rates;
++	sta->sta.supp_rates[band] = rates;
 +
 +	if (elems.ht_cap_elem)
 +		ieee80211_ht_cap_ie_to_sta_ht_cap(sdata, sband,
@@ -309,7 +1212,7 @@
  static void ieee80211_iface_work(struct work_struct *work)
  {
  	struct ieee80211_sub_if_data *sdata =
-@@ -1126,6 +1175,9 @@ static void ieee80211_iface_work(struct 
+@@ -1196,6 +1241,9 @@ static void ieee80211_iface_work(struct 
  				break;
  			ieee80211_mesh_rx_queued_mgmt(sdata, skb);
  			break;
@@ -319,1422 +1222,2538 @@
  		default:
  			WARN(1, "frame for unexpected interface type");
  			break;
---- a/net/mac80211/rx.c
-+++ b/net/mac80211/rx.c
-@@ -2365,6 +2365,7 @@ ieee80211_rx_h_action(struct ieee80211_r
- 		    sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
- 		    sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
- 		    sdata->vif.type != NL80211_IFTYPE_AP &&
-+		    sdata->vif.type != NL80211_IFTYPE_WDS &&
- 		    sdata->vif.type != NL80211_IFTYPE_ADHOC)
- 			break;
- 
-@@ -2692,14 +2693,15 @@ ieee80211_rx_h_mgmt(struct ieee80211_rx_
- 
- 	if (!ieee80211_vif_is_mesh(&sdata->vif) &&
- 	    sdata->vif.type != NL80211_IFTYPE_ADHOC &&
--	    sdata->vif.type != NL80211_IFTYPE_STATION)
-+	    sdata->vif.type != NL80211_IFTYPE_STATION &&
-+	    sdata->vif.type != NL80211_IFTYPE_WDS)
- 		return RX_DROP_MONITOR;
- 
- 	switch (stype) {
- 	case cpu_to_le16(IEEE80211_STYPE_AUTH):
- 	case cpu_to_le16(IEEE80211_STYPE_BEACON):
- 	case cpu_to_le16(IEEE80211_STYPE_PROBE_RESP):
--		/* process for all: mesh, mlme, ibss */
-+		/* process for all: mesh, mlme, ibss, wds */
- 		break;
- 	case cpu_to_le16(IEEE80211_STYPE_ASSOC_RESP):
- 	case cpu_to_le16(IEEE80211_STYPE_REASSOC_RESP):
-@@ -3028,10 +3030,16 @@ static int prepare_for_handlers(struct i
- 		}
- 		break;
- 	case NL80211_IFTYPE_WDS:
--		if (bssid || !ieee80211_is_data(hdr->frame_control))
--			return 0;
- 		if (!ether_addr_equal(sdata->u.wds.remote_addr, hdr->addr2))
- 			return 0;
-+
-+		if (ieee80211_is_data(hdr->frame_control) ||
-+		    ieee80211_is_action(hdr->frame_control)) {
-+			if (compare_ether_addr(sdata->vif.addr, hdr->addr1))
-+				return 0;
-+		} else if (!ieee80211_is_beacon(hdr->frame_control))
-+			return 0;
-+
- 		break;
- 	case NL80211_IFTYPE_P2P_DEVICE:
- 		if (!ieee80211_is_public_action(hdr, skb->len) &&
---- a/net/mac80211/sta_info.h
-+++ b/net/mac80211/sta_info.h
-@@ -32,7 +32,6 @@
-  * @WLAN_STA_SHORT_PREAMBLE: Station is capable of receiving short-preamble
-  *	frames.
-  * @WLAN_STA_WME: Station is a QoS-STA.
-- * @WLAN_STA_WDS: Station is one of our WDS peers.
-  * @WLAN_STA_CLEAR_PS_FILT: Clear PS filter in hardware (using the
-  *	IEEE80211_TX_CTL_CLEAR_PS_FILT control flag) when the next
-  *	frame to this station is transmitted.
-@@ -66,7 +65,6 @@ enum ieee80211_sta_info_flags {
- 	WLAN_STA_AUTHORIZED,
- 	WLAN_STA_SHORT_PREAMBLE,
- 	WLAN_STA_WME,
--	WLAN_STA_WDS,
- 	WLAN_STA_CLEAR_PS_FILT,
- 	WLAN_STA_MFP,
- 	WLAN_STA_BLOCK_BA,
---- a/net/mac80211/tx.c
-+++ b/net/mac80211/tx.c
-@@ -1231,34 +1231,40 @@ static bool ieee80211_tx_frags(struct ie
- 		if (local->queue_stop_reasons[q] ||
- 		    (!txpending && !skb_queue_empty(&local->pending[q]))) {
- 			if (unlikely(info->flags &
--					IEEE80211_TX_INTFL_OFFCHAN_TX_OK &&
--				     local->queue_stop_reasons[q] &
--					~BIT(IEEE80211_QUEUE_STOP_REASON_OFFCHANNEL))) {
-+				     IEEE80211_TX_INTFL_OFFCHAN_TX_OK)) {
-+				if (local->queue_stop_reasons[q] &
-+				    ~BIT(IEEE80211_QUEUE_STOP_REASON_OFFCHANNEL)) {
-+					/*
-+					 * Drop off-channel frames if queues
-+					 * are stopped for any reason other
-+					 * than off-channel operation. Never
-+					 * queue them.
-+					 */
-+					spin_unlock_irqrestore(
-+						&local->queue_stop_reason_lock,
-+						flags);
-+					ieee80211_purge_tx_queue(&local->hw,
-+								 skbs);
-+					return true;
-+				}
-+			} else {
-+
- 				/*
--				 * Drop off-channel frames if queues are stopped
--				 * for any reason other than off-channel
--				 * operation. Never queue them.
-+				 * Since queue is stopped, queue up frames for
-+				 * later transmission from the tx-pending
-+				 * tasklet when the queue is woken again.
- 				 */
--				spin_unlock_irqrestore(
--					&local->queue_stop_reason_lock, flags);
--				ieee80211_purge_tx_queue(&local->hw, skbs);
--				return true;
-+				if (txpending)
-+					skb_queue_splice_init(skbs,
-+							      &local->pending[q]);
-+				else
-+					skb_queue_splice_tail_init(skbs,
-+								   &local->pending[q]);
+--- a/net/mac80211/main.c
++++ b/net/mac80211/main.c
+@@ -674,6 +674,7 @@ int ieee80211_register_hw(struct ieee802
+ 	int channels, max_bitrates;
+ 	bool supp_ht, supp_vht;
+ 	netdev_features_t feature_whitelist;
++	struct cfg80211_chan_def dflt_chandef = {};
+ 	static const u32 cipher_suites[] = {
+ 		/* keep WEP first, it may be removed below */
+ 		WLAN_CIPHER_SUITE_WEP40,
+@@ -751,19 +752,19 @@ int ieee80211_register_hw(struct ieee802
+ 		sband = local->hw.wiphy->bands[band];
+ 		if (!sband)
+ 			continue;
+-		if (!local->use_chanctx && !local->_oper_chandef.chan) {
 +
-+				spin_unlock_irqrestore(&local->queue_stop_reason_lock,
-+						       flags);
-+				return false;
- 			}
--
--			/*
--			 * Since queue is stopped, queue up frames for later
--			 * transmission from the tx-pending tasklet when the
--			 * queue is woken again.
--			 */
--			if (txpending)
--				skb_queue_splice_init(skbs, &local->pending[q]);
--			else
--				skb_queue_splice_tail_init(skbs,
--							   &local->pending[q]);
--
--			spin_unlock_irqrestore(&local->queue_stop_reason_lock,
--					       flags);
--			return false;
++		if (!dflt_chandef.chan) {
++			cfg80211_chandef_create(&dflt_chandef,
++						&sband->channels[0],
++						NL80211_CHAN_NO_HT);
+ 			/* init channel we're on */
+-			struct cfg80211_chan_def chandef = {
+-				.chan = &sband->channels[0],
+-				.width = NL80211_CHAN_NO_HT,
+-				.center_freq1 = sband->channels[0].center_freq,
+-				.center_freq2 = 0
+-			};
+-			local->hw.conf.chandef = local->_oper_chandef = chandef;
++			if (!local->use_chanctx && !local->_oper_chandef.chan) {
++				local->hw.conf.chandef = dflt_chandef;
++				local->_oper_chandef = dflt_chandef;
++			}
++			local->monitor_chandef = dflt_chandef;
  		}
- 		spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
+-		cfg80211_chandef_create(&local->monitor_chandef,
+-					&sband->channels[0],
+-					NL80211_CHAN_NO_HT);
++
+ 		channels += sband->n_channels;
  
-@@ -1848,9 +1854,24 @@ netdev_tx_t ieee80211_subif_start_xmit(s
- 		}
+ 		if (max_bitrates < sband->n_bitrates)
+--- a/net/mac80211/mesh.c
++++ b/net/mac80211/mesh.c
+@@ -838,7 +838,7 @@ ieee80211_mesh_rx_probe_req(struct ieee8
+ 	if (baselen > len)
+ 		return;
  
- 		if (!is_multicast_ether_addr(skb->data)) {
-+			struct sta_info *next_hop;
-+			bool mpp_lookup = true;
-+
- 			mpath = mesh_path_lookup(sdata, skb->data);
--			if (!mpath)
-+			if (mpath) {
-+				mpp_lookup = false;
-+				next_hop = rcu_dereference(mpath->next_hop);
-+				if (!next_hop ||
-+				    !(mpath->flags & (MESH_PATH_ACTIVE |
-+						      MESH_PATH_RESOLVING)))
-+					mpp_lookup = true;
-+			}
-+
-+			if (mpp_lookup)
- 				mppath = mpp_path_lookup(sdata, skb->data);
-+
-+			if (mppath && mpath)
-+				mesh_path_del(mpath->sdata, mpath->dst);
- 		}
+-	ieee802_11_parse_elems(pos, len - baselen, &elems);
++	ieee802_11_parse_elems(pos, len - baselen, false, &elems);
  
- 		/*
---- a/net/wireless/nl80211.c
-+++ b/net/wireless/nl80211.c
-@@ -554,16 +554,9 @@ static int nl80211_msg_put_channel(struc
- 	if ((chan->flags & IEEE80211_CHAN_NO_IBSS) &&
- 	    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IBSS))
- 		goto nla_put_failure;
--	if (chan->flags & IEEE80211_CHAN_RADAR) {
--		u32 time = elapsed_jiffies_msecs(chan->dfs_state_entered);
--		if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
--			goto nla_put_failure;
--		if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
--				chan->dfs_state))
--			goto nla_put_failure;
--		if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME, time))
--			goto nla_put_failure;
--	}
-+	if ((chan->flags & IEEE80211_CHAN_RADAR) &&
-+	    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
-+		goto nla_put_failure;
- 	if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
- 	    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
- 		goto nla_put_failure;
-@@ -900,9 +893,6 @@ static int nl80211_put_iface_combination
- 		    nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
- 				c->max_interfaces))
- 			goto nla_put_failure;
--		if (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
--				c->radar_detect_widths))
--			goto nla_put_failure;
- 
- 		nla_nest_end(msg, nl_combi);
+ 	/* 802.11-2012 10.1.4.3.2 */
+ 	if ((!ether_addr_equal(mgmt->da, sdata->vif.addr) &&
+@@ -899,7 +899,7 @@ static void ieee80211_mesh_rx_bcn_presp(
+ 		return;
+ 
+ 	ieee802_11_parse_elems(mgmt->u.probe_resp.variable, len - baselen,
+-			       &elems);
++			       false, &elems);
+ 
+ 	/* ignore non-mesh or secure / unsecure mismatch */
+ 	if ((!elems.mesh_id || !elems.mesh_config) ||
+--- a/net/mac80211/mesh_hwmp.c
++++ b/net/mac80211/mesh_hwmp.c
+@@ -880,7 +880,7 @@ void mesh_rx_path_sel_frame(struct ieee8
+ 
+ 	baselen = (u8 *) mgmt->u.action.u.mesh_action.variable - (u8 *) mgmt;
+ 	ieee802_11_parse_elems(mgmt->u.action.u.mesh_action.variable,
+-			len - baselen, &elems);
++			       len - baselen, false, &elems);
+ 
+ 	if (elems.preq) {
+ 		if (elems.preq_len != 37)
+--- a/net/mac80211/mesh_plink.c
++++ b/net/mac80211/mesh_plink.c
+@@ -544,8 +544,8 @@ static void mesh_plink_timer(unsigned lo
+ 		return;
  	}
-@@ -914,48 +904,6 @@ nla_put_failure:
- 	return -ENOBUFS;
- }
+ 	mpl_dbg(sta->sdata,
+-		"Mesh plink timer for %pM fired on state %d\n",
+-		sta->sta.addr, sta->plink_state);
++		"Mesh plink timer for %pM fired on state %s\n",
++		sta->sta.addr, mplstates[sta->plink_state]);
+ 	reason = 0;
+ 	llid = sta->llid;
+ 	plid = sta->plid;
+@@ -687,7 +687,7 @@ void mesh_rx_plink_frame(struct ieee8021
+ 		baseaddr += 4;
+ 		baselen += 4;
+ 	}
+-	ieee802_11_parse_elems(baseaddr, len - baselen, &elems);
++	ieee802_11_parse_elems(baseaddr, len - baselen, true, &elems);
  
--#ifdef CONFIG_PM
--static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
--					struct sk_buff *msg)
--{
--	const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan.tcp;
--	struct nlattr *nl_tcp;
--
--	if (!tcp)
--		return 0;
--
--	nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
--	if (!nl_tcp)
--		return -ENOBUFS;
--
--	if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
--			tcp->data_payload_max))
--		return -ENOBUFS;
--
--	if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
--			tcp->data_payload_max))
--		return -ENOBUFS;
+ 	if (!elems.peering) {
+ 		mpl_dbg(sdata,
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -289,6 +289,8 @@ ieee80211_determine_chantype(struct ieee
+ 	} else {
+ 		/* 40 MHz (and 80 MHz) must be supported for VHT */
+ 		ret = IEEE80211_STA_DISABLE_VHT;
++		/* also mark 40 MHz disabled */
++		ret |= IEEE80211_STA_DISABLE_40MHZ;
+ 		goto out;
+ 	}
+ 
+@@ -303,12 +305,6 @@ ieee80211_determine_chantype(struct ieee
+ 					       channel->band);
+ 	vht_chandef.center_freq2 = 0;
+ 
+-	if (vht_oper->center_freq_seg2_idx)
+-		vht_chandef.center_freq2 =
+-			ieee80211_channel_to_frequency(
+-				vht_oper->center_freq_seg2_idx,
+-				channel->band);
 -
--	if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
--		return -ENOBUFS;
+ 	switch (vht_oper->chan_width) {
+ 	case IEEE80211_VHT_CHANWIDTH_USE_HT:
+ 		vht_chandef.width = chandef->width;
+@@ -321,6 +317,10 @@ ieee80211_determine_chantype(struct ieee
+ 		break;
+ 	case IEEE80211_VHT_CHANWIDTH_80P80MHZ:
+ 		vht_chandef.width = NL80211_CHAN_WIDTH_80P80;
++		vht_chandef.center_freq2 =
++			ieee80211_channel_to_frequency(
++				vht_oper->center_freq_seg2_idx,
++				channel->band);
+ 		break;
+ 	default:
+ 		if (verbose)
+@@ -604,7 +604,6 @@ static void ieee80211_add_vht_ie(struct 
+ 	u8 *pos;
+ 	u32 cap;
+ 	struct ieee80211_sta_vht_cap vht_cap;
+-	int i;
+ 
+ 	BUILD_BUG_ON(sizeof(vht_cap) != sizeof(sband->vht_cap));
+ 
+@@ -632,37 +631,6 @@ static void ieee80211_add_vht_ie(struct 
+ 			cpu_to_le32(IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE)))
+ 		cap &= ~IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE;
+ 
+-	if (!(ap_vht_cap->vht_cap_info &
+-			cpu_to_le32(IEEE80211_VHT_CAP_TXSTBC)))
+-		cap &= ~(IEEE80211_VHT_CAP_RXSTBC_1 |
+-			 IEEE80211_VHT_CAP_RXSTBC_3 |
+-			 IEEE80211_VHT_CAP_RXSTBC_4);
 -
--	if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
--				sizeof(*tcp->tok), tcp->tok))
--		return -ENOBUFS;
+-	for (i = 0; i < 8; i++) {
+-		int shift = i * 2;
+-		u16 mask = IEEE80211_VHT_MCS_NOT_SUPPORTED << shift;
+-		u16 ap_mcs, our_mcs;
 -
--	if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
--			tcp->data_interval_max))
--		return -ENOBUFS;
+-		ap_mcs = (le16_to_cpu(ap_vht_cap->supp_mcs.tx_mcs_map) &
+-								mask) >> shift;
+-		our_mcs = (le16_to_cpu(vht_cap.vht_mcs.rx_mcs_map) &
+-								mask) >> shift;
 -
--	if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
--			tcp->wake_payload_max))
--		return -ENOBUFS;
+-		if (our_mcs == IEEE80211_VHT_MCS_NOT_SUPPORTED)
+-			continue;
 -
--	nla_nest_end(msg, nl_tcp);
--	return 0;
--}
--#endif
+-		switch (ap_mcs) {
+-		default:
+-			if (our_mcs <= ap_mcs)
+-				break;
+-			/* fall through */
+-		case IEEE80211_VHT_MCS_NOT_SUPPORTED:
+-			vht_cap.vht_mcs.rx_mcs_map &= cpu_to_le16(~mask);
+-			vht_cap.vht_mcs.rx_mcs_map |=
+-				cpu_to_le16(ap_mcs << shift);
+-		}
+-	}
 -
- static int nl80211_send_wiphy(struct sk_buff *msg, u32 portid, u32 seq, int flags,
- 			      struct cfg80211_registered_device *dev)
+ 	/* reserve and fill IE */
+ 	pos = skb_put(skb, sizeof(struct ieee80211_vht_cap) + 2);
+ 	ieee80211_ie_build_vht_cap(pos, &vht_cap, cap);
+@@ -998,16 +966,7 @@ static void ieee80211_chswitch_work(stru
+ 	if (!ifmgd->associated)
+ 		goto out;
+ 
+-	/*
+-	 * FIXME: Here we are downgrading to NL80211_CHAN_WIDTH_20_NOHT
+-	 * and don't adjust our ht/vht settings
+-	 * This is wrong - we should behave according to the CSA params
+-	 */
+-	local->_oper_chandef.chan = local->csa_channel;
+-	local->_oper_chandef.width = NL80211_CHAN_WIDTH_20_NOHT;
+-	local->_oper_chandef.center_freq1 =
+-		local->_oper_chandef.chan->center_freq;
+-	local->_oper_chandef.center_freq2 = 0;
++	local->_oper_chandef = local->csa_chandef;
+ 
+ 	if (!local->ops->channel_switch) {
+ 		/* call "hw_config" only if doing sw channel switch */
+@@ -1054,56 +1013,193 @@ static void ieee80211_chswitch_timer(uns
+ 	ieee80211_queue_work(&sdata->local->hw, &sdata->u.mgd.chswitch_work);
+ }
+ 
+-void
++static void
+ ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
+-				 const struct ieee80211_channel_sw_ie *sw_elem,
+-				 struct ieee80211_bss *bss, u64 timestamp)
++				 u64 timestamp, struct ieee802_11_elems *elems)
  {
-@@ -1330,9 +1278,6 @@ static int nl80211_send_wiphy(struct sk_
- 				goto nla_put_failure;
- 		}
+-	struct cfg80211_bss *cbss =
+-		container_of((void *)bss, struct cfg80211_bss, priv);
+-	struct ieee80211_channel *new_ch;
++	struct ieee80211_local *local = sdata->local;
+ 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+-	int new_freq = ieee80211_channel_to_frequency(sw_elem->new_ch_num,
+-						      cbss->channel->band);
++	struct cfg80211_bss *cbss = ifmgd->associated;
++	struct ieee80211_bss *bss;
+ 	struct ieee80211_chanctx *chanctx;
++	enum ieee80211_band new_band;
++	int new_freq;
++	u8 new_chan_no;
++	u8 count;
++	u8 mode;
++	struct ieee80211_channel *new_chan;
++	struct cfg80211_chan_def new_chandef = {};
++	struct cfg80211_chan_def new_vht_chandef = {};
++	const struct ieee80211_sec_chan_offs_ie *sec_chan_offs;
++	const struct ieee80211_wide_bw_chansw_ie *wide_bw_chansw_ie;
++	int secondary_channel_offset = -1;
+ 
+ 	ASSERT_MGD_MTX(ifmgd);
+ 
+-	if (!ifmgd->associated)
++	if (!cbss)
+ 		return;
  
--		if (nl80211_send_wowlan_tcp_caps(dev, msg))
--			goto nla_put_failure;
+-	if (sdata->local->scanning)
++	if (local->scanning)
+ 		return;
+ 
+-	/* Disregard subsequent beacons if we are already running a timer
+-	   processing a CSA */
 -
- 		nla_nest_end(msg, nl_wowlan);
++	/* disregard subsequent announcements if we are already processing */
+ 	if (ifmgd->flags & IEEE80211_STA_CSA_RECEIVED)
+ 		return;
+ 
+-	new_ch = ieee80211_get_channel(sdata->local->hw.wiphy, new_freq);
+-	if (!new_ch || new_ch->flags & IEEE80211_CHAN_DISABLED) {
++	sec_chan_offs = elems->sec_chan_offs;
++	wide_bw_chansw_ie = elems->wide_bw_chansw_ie;
++
++	if (ifmgd->flags & (IEEE80211_STA_DISABLE_HT |
++			    IEEE80211_STA_DISABLE_40MHZ)) {
++		sec_chan_offs = NULL;
++		wide_bw_chansw_ie = NULL;
++	}
++
++	if (ifmgd->flags & IEEE80211_STA_DISABLE_VHT)
++		wide_bw_chansw_ie = NULL;
++
++	if (elems->ext_chansw_ie) {
++		if (!ieee80211_operating_class_to_band(
++				elems->ext_chansw_ie->new_operating_class,
++				&new_band)) {
++			sdata_info(sdata,
++				   "cannot understand ECSA IE operating class %d, disconnecting\n",
++				   elems->ext_chansw_ie->new_operating_class);
++			ieee80211_queue_work(&local->hw,
++					     &ifmgd->csa_connection_drop_work);
++		}
++		new_chan_no = elems->ext_chansw_ie->new_ch_num;
++		count = elems->ext_chansw_ie->count;
++		mode = elems->ext_chansw_ie->mode;
++	} else if (elems->ch_switch_ie) {
++		new_band = cbss->channel->band;
++		new_chan_no = elems->ch_switch_ie->new_ch_num;
++		count = elems->ch_switch_ie->count;
++		mode = elems->ch_switch_ie->mode;
++	} else {
++		/* nothing here we understand */
++		return;
++	}
++
++	bss = (void *)cbss->priv;
++
++	new_freq = ieee80211_channel_to_frequency(new_chan_no, new_band);
++	new_chan = ieee80211_get_channel(sdata->local->hw.wiphy, new_freq);
++	if (!new_chan || new_chan->flags & IEEE80211_CHAN_DISABLED) {
+ 		sdata_info(sdata,
+ 			   "AP %pM switches to unsupported channel (%d MHz), disconnecting\n",
+ 			   ifmgd->associated->bssid, new_freq);
+-		ieee80211_queue_work(&sdata->local->hw,
++		ieee80211_queue_work(&local->hw,
++				     &ifmgd->csa_connection_drop_work);
++		return;
++	}
++
++	if (sec_chan_offs) {
++		secondary_channel_offset = sec_chan_offs->sec_chan_offs;
++	} else if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT)) {
++		/* if HT is enabled and the IE not present, it's still HT */
++		secondary_channel_offset = IEEE80211_HT_PARAM_CHA_SEC_NONE;
++	}
++
++	switch (secondary_channel_offset) {
++	default:
++		/* secondary_channel_offset was present but is invalid */
++	case IEEE80211_HT_PARAM_CHA_SEC_NONE:
++		cfg80211_chandef_create(&new_chandef, new_chan,
++					NL80211_CHAN_HT20);
++		break;
++	case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
++		cfg80211_chandef_create(&new_chandef, new_chan,
++					NL80211_CHAN_HT40PLUS);
++		break;
++	case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
++		cfg80211_chandef_create(&new_chandef, new_chan,
++					NL80211_CHAN_HT40MINUS);
++		break;
++	case -1:
++		cfg80211_chandef_create(&new_chandef, new_chan,
++					NL80211_CHAN_NO_HT);
++		break;
++	}
++
++	if (wide_bw_chansw_ie) {
++		new_vht_chandef.chan = new_chan;
++		new_vht_chandef.center_freq1 =
++			ieee80211_channel_to_frequency(
++				wide_bw_chansw_ie->new_center_freq_seg0,
++				new_band);
++
++		switch (wide_bw_chansw_ie->new_channel_width) {
++		default:
++			/* hmmm, ignore VHT and use HT if present */
++		case IEEE80211_VHT_CHANWIDTH_USE_HT:
++			new_vht_chandef.chan = NULL;
++			break;
++		case IEEE80211_VHT_CHANWIDTH_80MHZ:
++			new_vht_chandef.width = NL80211_CHAN_WIDTH_80;
++			break;
++		case IEEE80211_VHT_CHANWIDTH_160MHZ:
++			new_vht_chandef.width = NL80211_CHAN_WIDTH_160;
++			break;
++		case IEEE80211_VHT_CHANWIDTH_80P80MHZ:
++			/* field is otherwise reserved */
++			new_vht_chandef.center_freq2 =
++				ieee80211_channel_to_frequency(
++					wide_bw_chansw_ie->new_center_freq_seg1,
++					new_band);
++			new_vht_chandef.width = NL80211_CHAN_WIDTH_80P80;
++			break;
++		}
++		if (ifmgd->flags & IEEE80211_STA_DISABLE_80P80MHZ &&
++		    new_vht_chandef.width == NL80211_CHAN_WIDTH_80P80)
++			chandef_downgrade(&new_vht_chandef);
++		if (ifmgd->flags & IEEE80211_STA_DISABLE_160MHZ &&
++		    new_vht_chandef.width == NL80211_CHAN_WIDTH_160)
++			chandef_downgrade(&new_vht_chandef);
++		if (ifmgd->flags & IEEE80211_STA_DISABLE_40MHZ &&
++		    new_vht_chandef.width > NL80211_CHAN_WIDTH_20)
++			chandef_downgrade(&new_vht_chandef);
++	}
++
++	/* if VHT data is there validate & use it */
++	if (new_vht_chandef.chan) {
++		if (!cfg80211_chandef_compatible(&new_vht_chandef,
++						 &new_chandef)) {
++			sdata_info(sdata,
++				   "AP %pM CSA has inconsistent channel data, disconnecting\n",
++				   ifmgd->associated->bssid);
++			ieee80211_queue_work(&local->hw,
++					     &ifmgd->csa_connection_drop_work);
++			return;
++		}
++		new_chandef = new_vht_chandef;
++	}
++
++	if (!cfg80211_chandef_usable(local->hw.wiphy, &new_chandef,
++				     IEEE80211_CHAN_DISABLED)) {
++		sdata_info(sdata,
++			   "AP %pM switches to unsupported channel (%d MHz, width:%d, CF1/2: %d/%d MHz), disconnecting\n",
++			   ifmgd->associated->bssid, new_freq,
++			   new_chandef.width, new_chandef.center_freq1,
++			   new_chandef.center_freq2);
++		ieee80211_queue_work(&local->hw,
+ 				     &ifmgd->csa_connection_drop_work);
+ 		return;
  	}
- #endif
---- a/net/mac80211/cfg.c
-+++ b/net/mac80211/cfg.c
-@@ -3285,13 +3285,19 @@ static int ieee80211_cfg_get_channel(str
- 				     struct cfg80211_chan_def *chandef)
- {
- 	struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);
-+	struct ieee80211_local *local = wiphy_priv(wiphy);
- 	struct ieee80211_chanctx_conf *chanctx_conf;
- 	int ret = -ENODATA;
- 
- 	rcu_read_lock();
--	chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
--	if (chanctx_conf) {
--		*chandef = chanctx_conf->def;
+ 
+ 	ifmgd->flags |= IEEE80211_STA_CSA_RECEIVED;
+ 
+-	if (sdata->local->use_chanctx) {
 +	if (local->use_chanctx) {
-+		chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
-+		if (chanctx_conf) {
-+			*chandef = chanctx_conf->def;
-+			ret = 0;
-+		}
-+	} else if (local->open_count == local->monitors) {
-+		*chandef = local->monitor_chandef;
- 		ret = 0;
+ 		sdata_info(sdata,
+ 			   "not handling channel switch with channel contexts\n");
+-		ieee80211_queue_work(&sdata->local->hw,
++		ieee80211_queue_work(&local->hw,
+ 				     &ifmgd->csa_connection_drop_work);
+ 		return;
  	}
- 	rcu_read_unlock();
---- a/drivers/net/wireless/ath/ath9k/hw.c
-+++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -1463,7 +1463,9 @@ static bool ath9k_hw_chip_reset(struct a
- 			reset_type = ATH9K_RESET_POWER_ON;
- 		else
- 			reset_type = ATH9K_RESET_COLD;
--	}
-+	} else if (ah->chip_fullsleep || REG_READ(ah, AR_Q_TXE) ||
-+		   (REG_READ(ah, AR_CR) & AR_CR_RXE))
-+		reset_type = ATH9K_RESET_COLD;
  
- 	if (!ath9k_hw_set_reset_reg(ah, reset_type))
- 		return false;
-@@ -1876,13 +1878,12 @@ int ath9k_hw_reset(struct ath_hw *ah, st
+-	mutex_lock(&sdata->local->chanctx_mtx);
++	mutex_lock(&local->chanctx_mtx);
+ 	if (WARN_ON(!rcu_access_pointer(sdata->vif.chanctx_conf))) {
+-		mutex_unlock(&sdata->local->chanctx_mtx);
++		mutex_unlock(&local->chanctx_mtx);
+ 		return;
+ 	}
+ 	chanctx = container_of(rcu_access_pointer(sdata->vif.chanctx_conf),
+@@ -1111,40 +1207,39 @@ ieee80211_sta_process_chanswitch(struct 
+ 	if (chanctx->refcount > 1) {
+ 		sdata_info(sdata,
+ 			   "channel switch with multiple interfaces on the same channel, disconnecting\n");
+-		ieee80211_queue_work(&sdata->local->hw,
++		ieee80211_queue_work(&local->hw,
+ 				     &ifmgd->csa_connection_drop_work);
+-		mutex_unlock(&sdata->local->chanctx_mtx);
++		mutex_unlock(&local->chanctx_mtx);
+ 		return;
+ 	}
+-	mutex_unlock(&sdata->local->chanctx_mtx);
++	mutex_unlock(&local->chanctx_mtx);
+ 
+-	sdata->local->csa_channel = new_ch;
++	local->csa_chandef = new_chandef;
+ 
+-	if (sw_elem->mode)
+-		ieee80211_stop_queues_by_reason(&sdata->local->hw,
++	if (mode)
++		ieee80211_stop_queues_by_reason(&local->hw,
+ 				IEEE80211_MAX_QUEUE_MAP,
+ 				IEEE80211_QUEUE_STOP_REASON_CSA);
+ 
+-	if (sdata->local->ops->channel_switch) {
++	if (local->ops->channel_switch) {
+ 		/* use driver's channel switch callback */
+ 		struct ieee80211_channel_switch ch_switch = {
+ 			.timestamp = timestamp,
+-			.block_tx = sw_elem->mode,
+-			.channel = new_ch,
+-			.count = sw_elem->count,
++			.block_tx = mode,
++			.chandef = new_chandef,
++			.count = count,
+ 		};
+ 
+-		drv_channel_switch(sdata->local, &ch_switch);
++		drv_channel_switch(local, &ch_switch);
+ 		return;
+ 	}
  
- 	ENABLE_REGWRITE_BUFFER(ah);
+ 	/* channel switch handled in software */
+-	if (sw_elem->count <= 1)
+-		ieee80211_queue_work(&sdata->local->hw, &ifmgd->chswitch_work);
++	if (count <= 1)
++		ieee80211_queue_work(&local->hw, &ifmgd->chswitch_work);
+ 	else
+ 		mod_timer(&ifmgd->chswitch_timer,
+-			  TU_TO_EXP_TIME(sw_elem->count *
+-					 cbss->beacon_interval));
++			  TU_TO_EXP_TIME(count * cbss->beacon_interval));
+ }
  
--	REG_WRITE(ah, AR_STA_ID0, get_unaligned_le32(common->macaddr));
--	REG_WRITE(ah, AR_STA_ID1, get_unaligned_le16(common->macaddr + 4)
--		  | macStaId1
-+	REG_RMW(ah, AR_STA_ID1, macStaId1
- 		  | AR_STA_ID1_RTS_USE_DEF
- 		  | (ah->config.
- 		     ack_6mb ? AR_STA_ID1_ACKCTS_6MB : 0)
--		  | ah->sta_id1_defaults);
-+		  | ah->sta_id1_defaults,
-+		  ~AR_STA_ID1_SADH_MASK);
- 	ath_hw_setbssidmask(common);
- 	REG_WRITE(ah, AR_DEF_ANTENNA, saveDefAntenna);
- 	ath9k_hw_write_associd(ah);
---- a/drivers/net/wireless/rt2x00/rt2x00dev.c
-+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
-@@ -1236,8 +1236,10 @@ static inline void rt2x00lib_set_if_comb
- 	 */
- 	if_limit = &rt2x00dev->if_limits_ap;
- 	if_limit->max = rt2x00dev->ops->max_ap_intf;
--	if_limit->types = BIT(NL80211_IFTYPE_AP) |
--			BIT(NL80211_IFTYPE_MESH_POINT);
-+	if_limit->types = BIT(NL80211_IFTYPE_AP);
-+#ifdef CONFIG_MAC80211_MESH
-+	if_limit->types |= BIT(NL80211_IFTYPE_MESH_POINT);
-+#endif
+ static u32 ieee80211_handle_pwr_constr(struct ieee80211_sub_if_data *sdata,
+@@ -2120,7 +2215,6 @@ void ieee80211_beacon_loss(struct ieee80
  
- 	/*
- 	 * Build up AP interface combinations structure.
-@@ -1309,7 +1311,9 @@ int rt2x00lib_probe_dev(struct rt2x00_de
- 		rt2x00dev->hw->wiphy->interface_modes |=
- 		    BIT(NL80211_IFTYPE_ADHOC) |
- 		    BIT(NL80211_IFTYPE_AP) |
-+#ifdef CONFIG_MAC80211_MESH
- 		    BIT(NL80211_IFTYPE_MESH_POINT) |
-+#endif
- 		    BIT(NL80211_IFTYPE_WDS);
- 
- 	rt2x00dev->hw->wiphy->flags |= WIPHY_FLAG_IBSS_RSN;
---- a/net/mac80211/rc80211_minstrel_ht.c
-+++ b/net/mac80211/rc80211_minstrel_ht.c
-@@ -17,8 +17,6 @@
- #include "rc80211_minstrel_ht.h"
- 
- #define AVG_PKT_SIZE	1200
--#define SAMPLE_COLUMNS	10
--#define EWMA_LEVEL		75
- 
- /* Number of bits for an average sized packet */
- #define MCS_NBITS (AVG_PKT_SIZE << 3)
-@@ -26,11 +24,11 @@
- /* Number of symbols for a packet with (bps) bits per symbol */
- #define MCS_NSYMS(bps) ((MCS_NBITS + (bps) - 1) / (bps))
- 
--/* Transmission time for a packet containing (syms) symbols */
-+/* Transmission time (nanoseconds) for a packet containing (syms) symbols */
- #define MCS_SYMBOL_TIME(sgi, syms)					\
- 	(sgi ?								\
--	  ((syms) * 18 + 4) / 5 :	/* syms * 3.6 us */		\
--	  (syms) << 2			/* syms * 4 us */		\
-+	  ((syms) * 18000 + 4000) / 5 :	/* syms * 3.6 us */		\
-+	  ((syms) * 1000) << 2		/* syms * 4 us */		\
- 	)
+ 	trace_api_beacon_loss(sdata);
  
- /* Transmit duration for the raw data part of an average sized packet */
-@@ -64,9 +62,9 @@
+-	WARN_ON(hw->flags & IEEE80211_HW_CONNECTION_MONITOR);
+ 	sdata->u.mgd.connection_loss = false;
+ 	ieee80211_queue_work(hw, &sdata->u.mgd.beacon_connection_loss_work);
  }
+@@ -2170,7 +2264,7 @@ static void ieee80211_auth_challenge(str
+ 	u32 tx_flags = 0;
  
- #define CCK_DURATION(_bitrate, _short, _len)		\
--	(10 /* SIFS */ +				\
-+	(1000 * (10 /* SIFS */ +			\
- 	 (_short ? 72 + 24 : 144 + 48 ) +		\
--	 (8 * (_len + 4) * 10) / (_bitrate))
-+	 (8 * (_len + 4) * 10) / (_bitrate)))
+ 	pos = mgmt->u.auth.variable;
+-	ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems);
++	ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), false, &elems);
+ 	if (!elems.challenge)
+ 		return;
+ 	auth_data->expected_transaction = 4;
+@@ -2435,7 +2529,7 @@ static bool ieee80211_assoc_success(stru
+ 	}
  
- #define CCK_ACK_DURATION(_bitrate, _short)			\
- 	(CCK_DURATION((_bitrate > 10 ? 20 : 10), false, 60) +	\
-@@ -129,15 +127,6 @@ const struct mcs_group minstrel_mcs_grou
- static u8 sample_table[SAMPLE_COLUMNS][MCS_GROUP_RATES];
+ 	pos = mgmt->u.assoc_resp.variable;
+-	ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems);
++	ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), false, &elems);
  
- /*
-- * Perform EWMA (Exponentially Weighted Moving Average) calculation
-- */
--static int
--minstrel_ewma(int old, int new, int weight)
--{
--	return (new * (100 - weight) + old * weight) / 100;
--}
--
--/*
-  * Look up an MCS group index based on mac80211 rate information
-  */
- static int
-@@ -211,20 +200,32 @@ static void
- minstrel_ht_calc_tp(struct minstrel_ht_sta *mi, int group, int rate)
- {
- 	struct minstrel_rate_stats *mr;
--	unsigned int usecs = 0;
-+	unsigned int nsecs = 0;
-+	unsigned int tp;
-+	unsigned int prob;
+ 	if (!elems.supp_rates) {
+ 		sdata_info(sdata, "no SuppRates element in AssocResp\n");
+@@ -2604,7 +2698,7 @@ ieee80211_rx_mgmt_assoc_resp(struct ieee
+ 		   capab_info, status_code, (u16)(aid & ~(BIT(15) | BIT(14))));
  
- 	mr = &mi->groups[group].rates[rate];
-+	prob = mr->probability;
+ 	pos = mgmt->u.assoc_resp.variable;
+-	ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems);
++	ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), false, &elems);
  
--	if (mr->probability < MINSTREL_FRAC(1, 10)) {
-+	if (prob < MINSTREL_FRAC(1, 10)) {
- 		mr->cur_tp = 0;
+ 	if (status_code == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY &&
+ 	    elems.timeout_int &&
+@@ -2659,6 +2753,8 @@ static void ieee80211_rx_bss_info(struct
+ 	struct ieee80211_channel *channel;
+ 	bool need_ps = false;
+ 
++	lockdep_assert_held(&sdata->u.mgd.mtx);
++
+ 	if ((sdata->u.mgd.associated &&
+ 	     ether_addr_equal(mgmt->bssid, sdata->u.mgd.associated->bssid)) ||
+ 	    (sdata->u.mgd.assoc_data &&
+@@ -2689,7 +2785,8 @@ static void ieee80211_rx_bss_info(struct
+ 	if (bss)
+ 		ieee80211_rx_bss_put(local, bss);
+ 
+-	if (!sdata->u.mgd.associated)
++	if (!sdata->u.mgd.associated ||
++	    !ether_addr_equal(mgmt->bssid, sdata->u.mgd.associated->bssid))
  		return;
+ 
+ 	if (need_ps) {
+@@ -2698,10 +2795,8 @@ static void ieee80211_rx_bss_info(struct
+ 		mutex_unlock(&local->iflist_mtx);
  	}
  
-+	/*
-+	 * For the throughput calculation, limit the probability value to 90% to
-+	 * account for collision related packet error rate fluctuation
-+	 */
-+	if (prob > MINSTREL_FRAC(9, 10))
-+		prob = MINSTREL_FRAC(9, 10);
-+
- 	if (group != MINSTREL_CCK_GROUP)
--		usecs = mi->overhead / MINSTREL_TRUNC(mi->avg_ampdu_len);
-+		nsecs = 1000 * mi->overhead / MINSTREL_TRUNC(mi->avg_ampdu_len);
+-	if (elems->ch_switch_ie &&
+-	    memcmp(mgmt->bssid, sdata->u.mgd.associated->bssid, ETH_ALEN) == 0)
+-		ieee80211_sta_process_chanswitch(sdata, elems->ch_switch_ie,
+-						 bss, rx_status->mactime);
++	ieee80211_sta_process_chanswitch(sdata, rx_status->mactime, elems);
 +
-+	nsecs += minstrel_mcs_groups[group].duration[rate];
-+	tp = 1000000 * ((mr->probability * 1000) / nsecs);
- 
--	usecs += minstrel_mcs_groups[group].duration[rate];
--	mr->cur_tp = MINSTREL_TRUNC((1000000 / usecs) * mr->probability);
-+	mr->cur_tp = MINSTREL_TRUNC(tp);
  }
  
- /*
-@@ -308,8 +309,8 @@ minstrel_ht_update_stats(struct minstrel
+ 
+@@ -2726,7 +2821,7 @@ static void ieee80211_rx_mgmt_probe_resp
+ 		return;
+ 
+ 	ieee802_11_parse_elems(mgmt->u.probe_resp.variable, len - baselen,
+-				&elems);
++			       false, &elems);
+ 
+ 	ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems);
+ 
+@@ -2809,7 +2904,7 @@ ieee80211_rx_mgmt_beacon(struct ieee8021
+ 	if (ifmgd->assoc_data && ifmgd->assoc_data->need_beacon &&
+ 	    ether_addr_equal(mgmt->bssid, ifmgd->assoc_data->bss->bssid)) {
+ 		ieee802_11_parse_elems(mgmt->u.beacon.variable,
+-				       len - baselen, &elems);
++				       len - baselen, false, &elems);
+ 
+ 		ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems);
+ 		ifmgd->assoc_data->have_beacon = true;
+@@ -2919,7 +3014,7 @@ ieee80211_rx_mgmt_beacon(struct ieee8021
+ 
+ 	ncrc = crc32_be(0, (void *)&mgmt->u.beacon.beacon_int, 4);
+ 	ncrc = ieee802_11_parse_elems_crc(mgmt->u.beacon.variable,
+-					  len - baselen, &elems,
++					  len - baselen, false, &elems,
+ 					  care_about_ies, ncrc);
+ 
+ 	if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK) {
+@@ -3066,6 +3161,8 @@ void ieee80211_sta_rx_queued_mgmt(struct
+ 	enum rx_mgmt_action rma = RX_MGMT_NONE;
+ 	u8 deauth_buf[IEEE80211_DEAUTH_FRAME_LEN];
+ 	u16 fc;
++	struct ieee802_11_elems elems;
++	int ies_len;
+ 
+ 	rx_status = (struct ieee80211_rx_status *) skb->cb;
+ 	mgmt = (struct ieee80211_mgmt *) skb->data;
+@@ -3095,14 +3192,48 @@ void ieee80211_sta_rx_queued_mgmt(struct
+ 		rma = ieee80211_rx_mgmt_assoc_resp(sdata, mgmt, skb->len, &bss);
+ 		break;
+ 	case IEEE80211_STYPE_ACTION:
+-		switch (mgmt->u.action.category) {
+-		case WLAN_CATEGORY_SPECTRUM_MGMT:
++		if (mgmt->u.action.category == WLAN_CATEGORY_SPECTRUM_MGMT) {
++			ies_len = skb->len -
++				  offsetof(struct ieee80211_mgmt,
++					   u.action.u.chan_switch.variable);
++
++			if (ies_len < 0)
++				break;
++
++			ieee802_11_parse_elems(
++				mgmt->u.action.u.chan_switch.variable,
++				ies_len, true, &elems);
++
++			if (elems.parse_error)
++				break;
++
+ 			ieee80211_sta_process_chanswitch(sdata,
+-					&mgmt->u.action.u.chan_switch.sw_elem,
+-					(void *)ifmgd->associated->priv,
+-					rx_status->mactime);
+-			break;
++							 rx_status->mactime,
++							 &elems);
++		} else if (mgmt->u.action.category == WLAN_CATEGORY_PUBLIC) {
++			ies_len = skb->len -
++				  offsetof(struct ieee80211_mgmt,
++					   u.action.u.ext_chan_switch.variable);
++
++			if (ies_len < 0)
++				break;
++
++			ieee802_11_parse_elems(
++				mgmt->u.action.u.ext_chan_switch.variable,
++				ies_len, true, &elems);
++
++			if (elems.parse_error)
++				break;
++
++			/* for the handling code pretend this was also an IE */
++			elems.ext_chansw_ie =
++				&mgmt->u.action.u.ext_chan_switch.data;
++
++			ieee80211_sta_process_chanswitch(sdata,
++							 rx_status->mactime,
++							 &elems);
  		}
++		break;
  	}
+ 	mutex_unlock(&ifmgd->mtx);
  
--	/* try to sample up to half of the available rates during each interval */
--	mi->sample_count *= 4;
-+	/* try to sample all available rates during each interval */
-+	mi->sample_count *= 8;
+--- a/net/mac80211/pm.c
++++ b/net/mac80211/pm.c
+@@ -38,8 +38,8 @@ int __ieee80211_suspend(struct ieee80211
+ 					IEEE80211_MAX_QUEUE_MAP,
+ 					IEEE80211_QUEUE_STOP_REASON_SUSPEND);
  
- 	cur_prob = 0;
- 	cur_prob_tp = 0;
-@@ -320,20 +321,13 @@ minstrel_ht_update_stats(struct minstrel
- 		if (!mg->supported)
- 			continue;
+-	/* flush out all packets */
+-	synchronize_net();
++	/* flush out all packets and station cleanup call_rcu()s */
++	rcu_barrier();
  
--		mr = minstrel_get_ratestats(mi, mg->max_prob_rate);
--		if (cur_prob_tp < mr->cur_tp &&
--		    minstrel_mcs_groups[group].streams == 1) {
--			mi->max_prob_rate = mg->max_prob_rate;
--			cur_prob = mr->cur_prob;
--			cur_prob_tp = mr->cur_tp;
--		}
--
- 		mr = minstrel_get_ratestats(mi, mg->max_tp_rate);
- 		if (cur_tp < mr->cur_tp) {
- 			mi->max_tp_rate2 = mi->max_tp_rate;
- 			cur_tp2 = cur_tp;
- 			mi->max_tp_rate = mg->max_tp_rate;
- 			cur_tp = mr->cur_tp;
-+			mi->max_prob_streams = minstrel_mcs_groups[group].streams - 1;
- 		}
+ 	ieee80211_flush_queues(local, NULL);
+ 
+--- a/net/mac80211/rate.c
++++ b/net/mac80211/rate.c
+@@ -252,6 +252,25 @@ rate_lowest_non_cck_index(struct ieee802
+ 	return 0;
+ }
  
- 		mr = minstrel_get_ratestats(mi, mg->max_tp_rate2);
-@@ -343,6 +337,23 @@ minstrel_ht_update_stats(struct minstrel
++static void __rate_control_send_low(struct ieee80211_hw *hw,
++				    struct ieee80211_supported_band *sband,
++				    struct ieee80211_sta *sta,
++				    struct ieee80211_tx_info *info)
++{
++	if ((sband->band != IEEE80211_BAND_2GHZ) ||
++	    !(info->flags & IEEE80211_TX_CTL_NO_CCK_RATE))
++		info->control.rates[0].idx = rate_lowest_index(sband, sta);
++	else
++		info->control.rates[0].idx =
++			rate_lowest_non_cck_index(sband, sta);
++
++	info->control.rates[0].count =
++		(info->flags & IEEE80211_TX_CTL_NO_ACK) ?
++		1 : hw->max_rate_tries;
++
++	info->control.skip_table = 1;
++}
++
+ 
+ bool rate_control_send_low(struct ieee80211_sta *sta,
+ 			   void *priv_sta,
+@@ -262,16 +281,8 @@ bool rate_control_send_low(struct ieee80
+ 	int mcast_rate;
+ 
+ 	if (!sta || !priv_sta || rc_no_data_or_no_ack_use_min(txrc)) {
+-		if ((sband->band != IEEE80211_BAND_2GHZ) ||
+-		    !(info->flags & IEEE80211_TX_CTL_NO_CCK_RATE))
+-			info->control.rates[0].idx =
+-				rate_lowest_index(txrc->sband, sta);
+-		else
+-			info->control.rates[0].idx =
+-				rate_lowest_non_cck_index(txrc->sband, sta);
+-		info->control.rates[0].count =
+-			(info->flags & IEEE80211_TX_CTL_NO_ACK) ?
+-			1 : txrc->hw->max_rate_tries;
++		__rate_control_send_low(txrc->hw, sband, sta, info);
++
+ 		if (!sta && txrc->bss) {
+ 			mcast_rate = txrc->bss_conf->mcast_rate[sband->band];
+ 			if (mcast_rate > 0) {
+@@ -355,7 +366,8 @@ static bool rate_idx_match_mcs_mask(stru
+ 
+ 
+ static void rate_idx_match_mask(struct ieee80211_tx_rate *rate,
+-				struct ieee80211_tx_rate_control *txrc,
++				struct ieee80211_supported_band *sband,
++				enum nl80211_chan_width chan_width,
+ 				u32 mask,
+ 				u8 mcs_mask[IEEE80211_HT_MCS_MASK_LEN])
+ {
+@@ -375,27 +387,17 @@ static void rate_idx_match_mask(struct i
+ 				  IEEE80211_TX_RC_USE_SHORT_PREAMBLE);
+ 		alt_rate.count = rate->count;
+ 		if (rate_idx_match_legacy_mask(&alt_rate,
+-					       txrc->sband->n_bitrates,
+-					       mask)) {
++					       sband->n_bitrates, mask)) {
+ 			*rate = alt_rate;
+ 			return;
  		}
- 	}
+ 	} else {
+-		struct sk_buff *skb = txrc->skb;
+-		struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
+-		__le16 fc;
+-
+ 		/* handle legacy rates */
+-		if (rate_idx_match_legacy_mask(rate, txrc->sband->n_bitrates,
+-					       mask))
++		if (rate_idx_match_legacy_mask(rate, sband->n_bitrates, mask))
+ 			return;
+ 
+ 		/* if HT BSS, and we handle a data frame, also try HT rates */
+-		if (txrc->bss_conf->chandef.width == NL80211_CHAN_WIDTH_20_NOHT)
+-			return;
+-
+-		fc = hdr->frame_control;
+-		if (!ieee80211_is_data(fc))
++		if (chan_width == NL80211_CHAN_WIDTH_20_NOHT)
+ 			return;
+ 
+ 		alt_rate.idx = 0;
+@@ -408,7 +410,7 @@ static void rate_idx_match_mask(struct i
+ 
+ 		alt_rate.flags |= IEEE80211_TX_RC_MCS;
+ 
+-		if (txrc->bss_conf->chandef.width == NL80211_CHAN_WIDTH_40)
++		if (chan_width == NL80211_CHAN_WIDTH_40)
+ 			alt_rate.flags |= IEEE80211_TX_RC_40_MHZ_WIDTH;
  
-+	if (mi->max_prob_streams < 1)
-+		mi->max_prob_streams = 1;
+ 		if (rate_idx_match_mcs_mask(&alt_rate, mcs_mask)) {
+@@ -426,6 +428,228 @@ static void rate_idx_match_mask(struct i
+ 	 */
+ }
+ 
++static void rate_fixup_ratelist(struct ieee80211_vif *vif,
++				struct ieee80211_supported_band *sband,
++				struct ieee80211_tx_info *info,
++				struct ieee80211_tx_rate *rates,
++				int max_rates)
++{
++	struct ieee80211_rate *rate;
++	bool inval = false;
++	int i;
 +
-+	for (group = 0; group < ARRAY_SIZE(minstrel_mcs_groups); group++) {
-+		mg = &mi->groups[group];
-+		if (!mg->supported)
++	/*
++	 * Set up the RTS/CTS rate as the fastest basic rate
++	 * that is not faster than the data rate unless there
++	 * is no basic rate slower than the data rate, in which
++	 * case we pick the slowest basic rate
++	 *
++	 * XXX: Should this check all retry rates?
++	 */
++	if (!(rates[0].flags & IEEE80211_TX_RC_MCS)) {
++		u32 basic_rates = vif->bss_conf.basic_rates;
++		s8 baserate = basic_rates ? ffs(basic_rates - 1) : 0;
++
++		rate = &sband->bitrates[rates[0].idx];
++
++		for (i = 0; i < sband->n_bitrates; i++) {
++			/* must be a basic rate */
++			if (!(basic_rates & BIT(i)))
++				continue;
++			/* must not be faster than the data rate */
++			if (sband->bitrates[i].bitrate > rate->bitrate)
++				continue;
++			/* maximum */
++			if (sband->bitrates[baserate].bitrate <
++			     sband->bitrates[i].bitrate)
++				baserate = i;
++		}
++
++		info->control.rts_cts_rate_idx = baserate;
++	}
++
++	for (i = 0; i < max_rates; i++) {
++		/*
++		 * make sure there's no valid rate following
++		 * an invalid one, just in case drivers don't
++		 * take the API seriously to stop at -1.
++		 */
++		if (inval) {
++			rates[i].idx = -1;
 +			continue;
-+		mr = minstrel_get_ratestats(mi, mg->max_prob_rate);
-+		if (cur_prob_tp < mr->cur_tp &&
-+		    minstrel_mcs_groups[group].streams <= mi->max_prob_streams) {
-+			mi->max_prob_rate = mg->max_prob_rate;
-+			cur_prob = mr->cur_prob;
-+			cur_prob_tp = mr->cur_tp;
 +		}
++		if (rates[i].idx < 0) {
++			inval = true;
++			continue;
++		}
++
++		/*
++		 * For now assume MCS is already set up correctly, this
++		 * needs to be fixed.
++		 */
++		if (rates[i].flags & IEEE80211_TX_RC_MCS) {
++			WARN_ON(rates[i].idx > 76);
++
++			if (!(rates[i].flags & IEEE80211_TX_RC_USE_RTS_CTS) &&
++			    info->control.use_cts_prot)
++				rates[i].flags |=
++					IEEE80211_TX_RC_USE_CTS_PROTECT;
++			continue;
++		}
++
++		if (rates[i].flags & IEEE80211_TX_RC_VHT_MCS) {
++			WARN_ON(ieee80211_rate_get_vht_mcs(&rates[i]) > 9);
++			continue;
++		}
++
++		/* set up RTS protection if desired */
++		if (info->control.use_rts) {
++			rates[i].flags |= IEEE80211_TX_RC_USE_RTS_CTS;
++			info->control.use_cts_prot = false;
++		}
++
++		/* RC is busted */
++		if (WARN_ON_ONCE(rates[i].idx >= sband->n_bitrates)) {
++			rates[i].idx = -1;
++			continue;
++		}
++
++		rate = &sband->bitrates[rates[i].idx];
++
++		/* set up short preamble */
++		if (info->control.short_preamble &&
++		    rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
++			rates[i].flags |= IEEE80211_TX_RC_USE_SHORT_PREAMBLE;
++
++		/* set up G protection */
++		if (!(rates[i].flags & IEEE80211_TX_RC_USE_RTS_CTS) &&
++		    info->control.use_cts_prot &&
++		    rate->flags & IEEE80211_RATE_ERP_G)
++			rates[i].flags |= IEEE80211_TX_RC_USE_CTS_PROTECT;
++	}
++}
++
++
++static void rate_control_fill_sta_table(struct ieee80211_sta *sta,
++					struct ieee80211_tx_info *info,
++					struct ieee80211_tx_rate *rates,
++					int max_rates)
++{
++	struct ieee80211_sta_rates *ratetbl = NULL;
++	int i;
++
++	if (sta && !info->control.skip_table)
++		ratetbl = rcu_dereference(sta->rates);
++
++	/* Fill remaining rate slots with data from the sta rate table. */
++	max_rates = min_t(int, max_rates, IEEE80211_TX_RATE_TABLE_SIZE);
++	for (i = 0; i < max_rates; i++) {
++		if (i < ARRAY_SIZE(info->control.rates) &&
++		    info->control.rates[i].idx >= 0 &&
++		    info->control.rates[i].count) {
++			if (rates != info->control.rates)
++				rates[i] = info->control.rates[i];
++		} else if (ratetbl) {
++			rates[i].idx = ratetbl->rate[i].idx;
++			rates[i].flags = ratetbl->rate[i].flags;
++			if (info->control.use_rts)
++				rates[i].count = ratetbl->rate[i].count_rts;
++			else if (info->control.use_cts_prot)
++				rates[i].count = ratetbl->rate[i].count_cts;
++			else
++				rates[i].count = ratetbl->rate[i].count;
++		} else {
++			rates[i].idx = -1;
++			rates[i].count = 0;
++		}
++
++		if (rates[i].idx < 0 || !rates[i].count)
++			break;
++	}
++}
++
++static void rate_control_apply_mask(struct ieee80211_sub_if_data *sdata,
++				    struct ieee80211_sta *sta,
++				    struct ieee80211_supported_band *sband,
++				    struct ieee80211_tx_info *info,
++				    struct ieee80211_tx_rate *rates,
++				    int max_rates)
++{
++	enum nl80211_chan_width chan_width;
++	u8 mcs_mask[IEEE80211_HT_MCS_MASK_LEN];
++	bool has_mcs_mask;
++	u32 mask;
++	int i;
++
++	/*
++	 * Try to enforce the rateidx mask the user wanted. skip this if the
++	 * default mask (allow all rates) is used to save some processing for
++	 * the common case.
++	 */
++	mask = sdata->rc_rateidx_mask[info->band];
++	has_mcs_mask = sdata->rc_has_mcs_mask[info->band];
++	if (mask == (1 << sband->n_bitrates) - 1 && !has_mcs_mask)
++		return;
++
++	if (has_mcs_mask)
++		memcpy(mcs_mask, sdata->rc_rateidx_mcs_mask[info->band],
++		       sizeof(mcs_mask));
++	else
++		memset(mcs_mask, 0xff, sizeof(mcs_mask));
++
++	if (sta) {
++		/* Filter out rates that the STA does not support */
++		mask &= sta->supp_rates[info->band];
++		for (i = 0; i < sizeof(mcs_mask); i++)
++			mcs_mask[i] &= sta->ht_cap.mcs.rx_mask[i];
++	}
++
++	/*
++	 * Make sure the rate index selected for each TX rate is
++	 * included in the configured mask and change the rate indexes
++	 * if needed.
++	 */
++	chan_width = sdata->vif.bss_conf.chandef.width;
++	for (i = 0; i < max_rates; i++) {
++		/* Skip invalid rates */
++		if (rates[i].idx < 0)
++			break;
++
++		rate_idx_match_mask(&rates[i], sband, mask, chan_width,
++				    mcs_mask);
++	}
++}
++
++void ieee80211_get_tx_rates(struct ieee80211_vif *vif,
++			    struct ieee80211_sta *sta,
++			    struct sk_buff *skb,
++			    struct ieee80211_tx_rate *dest,
++			    int max_rates)
++{
++	struct ieee80211_sub_if_data *sdata;
++	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
++	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
++	struct ieee80211_supported_band *sband;
++
++	rate_control_fill_sta_table(sta, info, dest, max_rates);
++
++	if (!vif)
++		return;
++
++	sdata = vif_to_sdata(vif);
++	sband = sdata->local->hw.wiphy->bands[info->band];
++
++	if (ieee80211_is_data(hdr->frame_control))
++		rate_control_apply_mask(sdata, sta, sband, info, dest, max_rates);
++
++	if (dest[0].idx < 0)
++		__rate_control_send_low(&sdata->local->hw, sband, sta, info);
++
++	if (sta)
++		rate_fixup_ratelist(vif, sband, info, dest, max_rates);
++}
++EXPORT_SYMBOL(ieee80211_get_tx_rates);
++
+ void rate_control_get_rate(struct ieee80211_sub_if_data *sdata,
+ 			   struct sta_info *sta,
+ 			   struct ieee80211_tx_rate_control *txrc)
+@@ -435,8 +659,6 @@ void rate_control_get_rate(struct ieee80
+ 	struct ieee80211_sta *ista = NULL;
+ 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(txrc->skb);
+ 	int i;
+-	u32 mask;
+-	u8 mcs_mask[IEEE80211_HT_MCS_MASK_LEN];
+ 
+ 	if (sta && test_sta_flag(sta, WLAN_STA_RATE_CONTROL)) {
+ 		ista = &sta->sta;
+@@ -454,37 +676,27 @@ void rate_control_get_rate(struct ieee80
+ 
+ 	ref->ops->get_rate(ref->priv, ista, priv_sta, txrc);
+ 
+-	/*
+-	 * Try to enforce the rateidx mask the user wanted. skip this if the
+-	 * default mask (allow all rates) is used to save some processing for
+-	 * the common case.
+-	 */
+-	mask = sdata->rc_rateidx_mask[info->band];
+-	memcpy(mcs_mask, sdata->rc_rateidx_mcs_mask[info->band],
+-	       sizeof(mcs_mask));
+-	if (mask != (1 << txrc->sband->n_bitrates) - 1) {
+-		if (sta) {
+-			/* Filter out rates that the STA does not support */
+-			mask &= sta->sta.supp_rates[info->band];
+-			for (i = 0; i < sizeof(mcs_mask); i++)
+-				mcs_mask[i] &= sta->sta.ht_cap.mcs.rx_mask[i];
+-		}
+-		/*
+-		 * Make sure the rate index selected for each TX rate is
+-		 * included in the configured mask and change the rate indexes
+-		 * if needed.
+-		 */
+-		for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
+-			/* Skip invalid rates */
+-			if (info->control.rates[i].idx < 0)
+-				break;
+-			rate_idx_match_mask(&info->control.rates[i], txrc,
+-					    mask, mcs_mask);
+-		}
+-	}
++	if (sdata->local->hw.flags & IEEE80211_HW_SUPPORTS_RC_TABLE)
++		return;
+ 
+-	BUG_ON(info->control.rates[0].idx < 0);
++	ieee80211_get_tx_rates(&sdata->vif, ista, txrc->skb,
++			       info->control.rates,
++			       ARRAY_SIZE(info->control.rates));
++}
++
++int rate_control_set_rates(struct ieee80211_hw *hw,
++			   struct ieee80211_sta *pubsta,
++			   struct ieee80211_sta_rates *rates)
++{
++	struct ieee80211_sta_rates *old = rcu_dereference(pubsta->rates);
++
++	rcu_assign_pointer(pubsta->rates, rates);
++	if (old)
++		kfree_rcu(old, rcu_head);
++
++	return 0;
+ }
++EXPORT_SYMBOL(rate_control_set_rates);
+ 
+ int ieee80211_init_rate_ctrl_alg(struct ieee80211_local *local,
+ 				 const char *name)
+--- a/net/mac80211/rc80211_minstrel.c
++++ b/net/mac80211/rc80211_minstrel.c
+@@ -84,6 +84,50 @@ minstrel_sort_best_tp_rates(struct minst
+ }
+ 
+ static void
++minstrel_set_rate(struct minstrel_sta_info *mi, struct ieee80211_sta_rates *ratetbl,
++		  int offset, int idx)
++{
++	struct minstrel_rate *r = &mi->r[idx];
++
++	ratetbl->rate[offset].idx = r->rix;
++	ratetbl->rate[offset].count = r->adjusted_retry_count;
++	ratetbl->rate[offset].count_cts = r->retry_count_cts;
++	ratetbl->rate[offset].count_rts = r->retry_count_rtscts;
++}
++
++static void
++minstrel_update_rates(struct minstrel_priv *mp, struct minstrel_sta_info *mi)
++{
++	struct ieee80211_sta_rates *ratetbl;
++	int i = 0;
++
++	ratetbl = kzalloc(sizeof(*ratetbl), GFP_ATOMIC);
++	if (!ratetbl)
++		return;
++
++	/* Start with max_tp_rate */
++	minstrel_set_rate(mi, ratetbl, i++, mi->max_tp_rate[0]);
++
++	if (mp->hw->max_rates >= 3) {
++		/* At least 3 tx rates supported, use max_tp_rate2 next */
++		minstrel_set_rate(mi, ratetbl, i++, mi->max_tp_rate[1]);
++	}
++
++	if (mp->hw->max_rates >= 2) {
++		/* At least 2 tx rates supported, use max_prob_rate next */
++		minstrel_set_rate(mi, ratetbl, i++, mi->max_prob_rate);
 +	}
 +
++	/* Use lowest rate last */
++	ratetbl->rate[i].idx = mi->lowest_rix;
++	ratetbl->rate[i].count = mp->max_retry;
++	ratetbl->rate[i].count_cts = mp->max_retry;
++	ratetbl->rate[i].count_rts = mp->max_retry;
++
++	rate_control_set_rates(mp->hw, mi->sta, ratetbl);
++}
 +
++static void
+ minstrel_update_stats(struct minstrel_priv *mp, struct minstrel_sta_info *mi)
+ {
+ 	u8 tmp_tp_rate[MAX_THR_RATES];
+@@ -161,6 +205,8 @@ minstrel_update_stats(struct minstrel_pr
+ 
+ 	/* Reset update timer */
  	mi->stats_update = jiffies;
++
++	minstrel_update_rates(mp, mi);
  }
  
-@@ -467,7 +478,7 @@ minstrel_ht_tx_status(void *priv, struct
+ static void
+@@ -209,9 +255,9 @@ minstrel_get_retry_count(struct minstrel
+ {
+ 	unsigned int retry = mr->adjusted_retry_count;
+ 
+-	if (info->control.rates[0].flags & IEEE80211_TX_RC_USE_RTS_CTS)
++	if (info->control.use_rts)
+ 		retry = max(2U, min(mr->retry_count_rtscts, retry));
+-	else if (info->control.rates[0].flags & IEEE80211_TX_RC_USE_CTS_PROTECT)
++	else if (info->control.use_cts_prot)
+ 		retry = max(2U, min(mr->retry_count_cts, retry));
+ 	return retry;
+ }
+@@ -240,13 +286,12 @@ minstrel_get_rate(void *priv, struct iee
+ 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+ 	struct minstrel_sta_info *mi = priv_sta;
+ 	struct minstrel_priv *mp = priv;
+-	struct ieee80211_tx_rate *ar = info->control.rates;
+-	unsigned int ndx, sample_ndx = 0;
++	struct ieee80211_tx_rate *rate = &info->control.rates[0];
++	struct minstrel_rate *msr, *mr;
++	unsigned int ndx;
+ 	bool mrr_capable;
+-	bool indirect_rate_sampling = false;
+-	bool rate_sampling = false;
+-	int i, delta;
+-	int mrr_ndx[3];
++	bool prev_sample = mi->prev_sample;
++	int delta;
+ 	int sampling_ratio;
+ 
+ 	/* management/no-ack frames do not use rate control */
+@@ -262,107 +307,75 @@ minstrel_get_rate(void *priv, struct iee
+ 	else
+ 		sampling_ratio = mp->lookaround_rate;
  
- 	if (!mi->sample_wait && !mi->sample_tries && mi->sample_count > 0) {
- 		mi->sample_wait = 16 + 2 * MINSTREL_TRUNC(mi->avg_ampdu_len);
--		mi->sample_tries = 2;
-+		mi->sample_tries = 1;
- 		mi->sample_count--;
+-	/* init rateindex [ndx] with max throughput rate */
+-	ndx = mi->max_tp_rate[0];
+-
+ 	/* increase sum packet counter */
+ 	mi->packet_count++;
+ 
+ 	delta = (mi->packet_count * sampling_ratio / 100) -
+ 			(mi->sample_count + mi->sample_deferred / 2);
+ 
+-	/* delta > 0: sampling required */
+-	if ((delta > 0) && (mrr_capable || !mi->prev_sample)) {
+-		struct minstrel_rate *msr;
+-		if (mi->packet_count >= 10000) {
+-			mi->sample_deferred = 0;
+-			mi->sample_count = 0;
+-			mi->packet_count = 0;
+-		} else if (delta > mi->n_rates * 2) {
+-			/* With multi-rate retry, not every planned sample
+-			 * attempt actually gets used, due to the way the retry
+-			 * chain is set up - [max_tp,sample,prob,lowest] for
+-			 * sample_rate < max_tp.
+-			 *
+-			 * If there's too much sampling backlog and the link
+-			 * starts getting worse, minstrel would start bursting
+-			 * out lots of sampling frames, which would result
+-			 * in a large throughput loss. */
+-			mi->sample_count += (delta - mi->n_rates * 2);
+-		}
++	/* delta < 0: no sampling required */
++	mi->prev_sample = false;
++	if (delta < 0 || (!mrr_capable && prev_sample))
++		return;
+ 
+-		/* get next random rate sample */
+-		sample_ndx = minstrel_get_next_sample(mi);
+-		msr = &mi->r[sample_ndx];
+-		rate_sampling = true;
+-
+-		/* Decide if direct ( 1st mrr stage) or indirect (2nd mrr stage)
+-		 * rate sampling method should be used.
+-		 * Respect such rates that are not sampled for 20 interations.
+-		 */
+-		if (mrr_capable &&
+-		    msr->perfect_tx_time > mi->r[ndx].perfect_tx_time &&
+-		    msr->sample_skipped < 20)
+-				indirect_rate_sampling = true;
+-
+-		if (!indirect_rate_sampling) {
+-			if (msr->sample_limit != 0) {
+-				ndx = sample_ndx;
+-				mi->sample_count++;
+-				if (msr->sample_limit > 0)
+-					msr->sample_limit--;
+-			} else
+-				rate_sampling = false;
+-		} else {
+-			/* Only use IEEE80211_TX_CTL_RATE_CTRL_PROBE to mark
+-			 * packets that have the sampling rate deferred to the
+-			 * second MRR stage. Increase the sample counter only
+-			 * if the deferred sample rate was actually used.
+-			 * Use the sample_deferred counter to make sure that
+-			 * the sampling is not done in large bursts */
+-			info->flags |= IEEE80211_TX_CTL_RATE_CTRL_PROBE;
+-			mi->sample_deferred++;
+-		}
++	if (mi->packet_count >= 10000) {
++		mi->sample_deferred = 0;
++		mi->sample_count = 0;
++		mi->packet_count = 0;
++	} else if (delta > mi->n_rates * 2) {
++		/* With multi-rate retry, not every planned sample
++		 * attempt actually gets used, due to the way the retry
++		 * chain is set up - [max_tp,sample,prob,lowest] for
++		 * sample_rate < max_tp.
++		 *
++		 * If there's too much sampling backlog and the link
++		 * starts getting worse, minstrel would start bursting
++		 * out lots of sampling frames, which would result
++		 * in a large throughput loss. */
++		mi->sample_count += (delta - mi->n_rates * 2);
++	}
++
++	/* get next random rate sample */
++	ndx = minstrel_get_next_sample(mi);
++	msr = &mi->r[ndx];
++	mr = &mi->r[mi->max_tp_rate[0]];
++
++	/* Decide if direct ( 1st mrr stage) or indirect (2nd mrr stage)
++	 * rate sampling method should be used.
++	 * Respect such rates that are not sampled for 20 interations.
++	 */
++	if (mrr_capable &&
++	    msr->perfect_tx_time > mr->perfect_tx_time &&
++	    msr->sample_skipped < 20) {
++		/* Only use IEEE80211_TX_CTL_RATE_CTRL_PROBE to mark
++		 * packets that have the sampling rate deferred to the
++		 * second MRR stage. Increase the sample counter only
++		 * if the deferred sample rate was actually used.
++		 * Use the sample_deferred counter to make sure that
++		 * the sampling is not done in large bursts */
++		info->flags |= IEEE80211_TX_CTL_RATE_CTRL_PROBE;
++		rate++;
++		mi->sample_deferred++;
++	} else {
++		if (!msr->sample_limit != 0)
++			return;
++
++		mi->sample_count++;
++		if (msr->sample_limit > 0)
++			msr->sample_limit--;
  	}
+-	mi->prev_sample = rate_sampling;
  
-@@ -536,7 +547,7 @@ minstrel_calc_retransmit(struct minstrel
- 	mr->retry_updated = true;
+ 	/* If we're not using MRR and the sampling rate already
+ 	 * has a probability of >95%, we shouldn't be attempting
+ 	 * to use it, as this only wastes precious airtime */
+-	if (!mrr_capable && rate_sampling &&
++	if (!mrr_capable &&
+ 	   (mi->r[ndx].probability > MINSTREL_FRAC(95, 100)))
+-		ndx = mi->max_tp_rate[0];
+-
+-	/* mrr setup for 1st stage */
+-	ar[0].idx = mi->r[ndx].rix;
+-	ar[0].count = minstrel_get_retry_count(&mi->r[ndx], info);
+-
+-	/* non mrr setup for 2nd stage */
+-	if (!mrr_capable) {
+-		if (!rate_sampling)
+-			ar[0].count = mp->max_retry;
+-		ar[1].idx = mi->lowest_rix;
+-		ar[1].count = mp->max_retry;
+ 		return;
+-	}
  
- 	group = &minstrel_mcs_groups[index / MCS_GROUP_RATES];
--	tx_time_data = group->duration[index % MCS_GROUP_RATES] * ampdu_len;
-+	tx_time_data = group->duration[index % MCS_GROUP_RATES] * ampdu_len / 1000;
+-	/* mrr setup for 2nd stage */
+-	if (rate_sampling) {
+-		if (indirect_rate_sampling)
+-			mrr_ndx[0] = sample_ndx;
+-		else
+-			mrr_ndx[0] = mi->max_tp_rate[0];
+-	} else {
+-		mrr_ndx[0] = mi->max_tp_rate[1];
+-	}
++	mi->prev_sample = true;
+ 
+-	/* mrr setup for 3rd & 4th stage */
+-	mrr_ndx[1] = mi->max_prob_rate;
+-	mrr_ndx[2] = 0;
+-	for (i = 1; i < 4; i++) {
+-		ar[i].idx = mi->r[mrr_ndx[i - 1]].rix;
+-		ar[i].count = mi->r[mrr_ndx[i - 1]].adjusted_retry_count;
+-	}
++	rate->idx = mi->r[ndx].rix;
++	rate->count = minstrel_get_retry_count(&mi->r[ndx], info);
+ }
  
- 	/* Contention time for first 2 tries */
- 	ctime = (t_slot * cw) >> 1;
-@@ -616,6 +627,7 @@ minstrel_get_sample_rate(struct minstrel
- {
- 	struct minstrel_rate_stats *mr;
- 	struct minstrel_mcs_group_data *mg;
-+	unsigned int sample_dur, sample_group;
- 	int sample_idx = 0;
- 
- 	if (mi->sample_wait > 0) {
-@@ -626,39 +638,46 @@ minstrel_get_sample_rate(struct minstrel
- 	if (!mi->sample_tries)
- 		return -1;
- 
--	mi->sample_tries--;
- 	mg = &mi->groups[mi->sample_group];
- 	sample_idx = sample_table[mg->column][mg->index];
- 	mr = &mg->rates[sample_idx];
--	sample_idx += mi->sample_group * MCS_GROUP_RATES;
-+	sample_group = mi->sample_group;
-+	sample_idx += sample_group * MCS_GROUP_RATES;
- 	minstrel_next_sample_idx(mi);
  
- 	/*
- 	 * Sampling might add some overhead (RTS, no aggregation)
- 	 * to the frame. Hence, don't use sampling for the currently
--	 * used max TP rate.
-+	 * used rates.
- 	 */
--	if (sample_idx == mi->max_tp_rate)
-+	if (sample_idx == mi->max_tp_rate ||
-+	    sample_idx == mi->max_tp_rate2 ||
-+	    sample_idx == mi->max_prob_rate)
- 		return -1;
-+
- 	/*
--	 * When not using MRR, do not sample if the probability is already
--	 * higher than 95% to avoid wasting airtime
-+	 * Do not sample if the probability is already higher than 95%
-+	 * to avoid wasting airtime.
- 	 */
--	if (!mp->has_mrr && (mr->probability > MINSTREL_FRAC(95, 100)))
-+	if (mr->probability > MINSTREL_FRAC(95, 100))
- 		return -1;
+@@ -412,12 +425,16 @@ minstrel_rate_init(void *priv, struct ie
+ 	unsigned int i, n = 0;
+ 	unsigned int t_slot = 9; /* FIXME: get real slot time */
  
- 	/*
- 	 * Make sure that lower rates get sampled only occasionally,
- 	 * if the link is working perfectly.
- 	 */
--	if (minstrel_get_duration(sample_idx) >
--	    minstrel_get_duration(mi->max_tp_rate)) {
-+	sample_dur = minstrel_get_duration(sample_idx);
-+	if (sample_dur >= minstrel_get_duration(mi->max_tp_rate2) &&
-+	    (mi->max_prob_streams <
-+	     minstrel_mcs_groups[sample_group].streams ||
-+	     sample_dur >= minstrel_get_duration(mi->max_prob_rate))) {
- 		if (mr->sample_skipped < 20)
- 			return -1;
- 
- 		if (mi->sample_slow++ > 2)
- 			return -1;
++	mi->sta = sta;
+ 	mi->lowest_rix = rate_lowest_index(sband, sta);
+ 	ctl_rate = &sband->bitrates[mi->lowest_rix];
+ 	mi->sp_ack_dur = ieee80211_frame_duration(sband->band, 10,
+ 				ctl_rate->bitrate,
+ 				!!(ctl_rate->flags & IEEE80211_RATE_ERP_G), 1);
+ 
++	memset(mi->max_tp_rate, 0, sizeof(mi->max_tp_rate));
++	mi->max_prob_rate = 0;
++
+ 	for (i = 0; i < sband->n_bitrates; i++) {
+ 		struct minstrel_rate *mr = &mi->r[n];
+ 		unsigned int tx_time = 0, tx_time_cts = 0, tx_time_rtscts = 0;
+@@ -460,6 +477,8 @@ minstrel_rate_init(void *priv, struct ie
+ 		} while ((tx_time < mp->segment_size) &&
+ 				(++mr->retry_count < mp->max_retry));
+ 		mr->adjusted_retry_count = mr->retry_count;
++		if (!(sband->bitrates[i].flags & IEEE80211_RATE_ERP_G))
++			mr->retry_count_cts = mr->retry_count;
  	}
-+	mi->sample_tries--;
  
- 	return sample_idx;
+ 	for (i = n; i < sband->n_bitrates; i++) {
+@@ -471,6 +490,7 @@ minstrel_rate_init(void *priv, struct ie
+ 	mi->stats_update = jiffies;
+ 
+ 	init_sample_table(mi);
++	minstrel_update_rates(mp, mi);
  }
---- a/net/mac80211/rc80211_minstrel_ht.h
-+++ b/net/mac80211/rc80211_minstrel_ht.h
-@@ -16,11 +16,6 @@
- #define MINSTREL_MAX_STREAMS	3
- #define MINSTREL_STREAM_GROUPS	4
- 
--/* scaled fraction values */
--#define MINSTREL_SCALE	16
--#define MINSTREL_FRAC(val, div) (((val) << MINSTREL_SCALE) / div)
--#define MINSTREL_TRUNC(val) ((val) >> MINSTREL_SCALE)
--
- #define MCS_GROUP_RATES	8
  
- struct mcs_group {
-@@ -85,6 +80,7 @@ struct minstrel_ht_sta {
+ static void *
+--- a/net/mac80211/rc80211_minstrel.h
++++ b/net/mac80211/rc80211_minstrel.h
+@@ -9,7 +9,8 @@
+ #ifndef __RC_MINSTREL_H
+ #define __RC_MINSTREL_H
  
- 	/* best probability rate */
- 	unsigned int max_prob_rate;
-+	unsigned int max_prob_streams;
+-#define EWMA_LEVEL	75	/* ewma weighting factor [%] */
++#define EWMA_LEVEL	96	/* ewma weighting factor [/EWMA_DIV] */
++#define EWMA_DIV	128
+ #define SAMPLE_COLUMNS	10	/* number of columns in sample table */
  
- 	/* time of last status update */
- 	unsigned long stats_update;
---- a/drivers/net/wireless/ath/ath9k/ar9003_calib.c
-+++ b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
-@@ -1023,6 +1023,7 @@ static bool ar9003_hw_init_cal(struct at
- 					  AR_PHY_AGC_CONTROL_FLTR_CAL   |
- 					  AR_PHY_AGC_CONTROL_PKDET_CAL;
- 
-+	/* Use chip chainmask only for calibration */
- 	ar9003_hw_set_chain_masks(ah, ah->caps.rx_chainmask, ah->caps.tx_chainmask);
- 
- 	if (rtt) {
-@@ -1150,6 +1151,9 @@ skip_tx_iqcal:
- 		ar9003_hw_rtt_disable(ah);
- 	}
  
-+	/* Revert chainmask to runtime parameters */
-+	ar9003_hw_set_chain_masks(ah, ah->rxchainmask, ah->txchainmask);
+@@ -27,7 +28,7 @@
+ static inline int
+ minstrel_ewma(int old, int new, int weight)
+ {
+-	return (new * (100 - weight) + old * weight) / 100;
++	return (new * (EWMA_DIV - weight) + old * weight) / EWMA_DIV;
+ }
+ 
+ 
+@@ -62,6 +63,8 @@ struct minstrel_rate {
+ };
+ 
+ struct minstrel_sta_info {
++	struct ieee80211_sta *sta;
 +
- 	/* Initialize list pointers */
- 	ah->cal_list = ah->cal_list_last = ah->cal_list_curr = NULL;
+ 	unsigned long stats_update;
+ 	unsigned int sp_ack_dur;
+ 	unsigned int rate_avg;
+--- a/net/mac80211/rc80211_minstrel_debugfs.c
++++ b/net/mac80211/rc80211_minstrel_debugfs.c
+@@ -68,7 +68,7 @@ minstrel_stats_open(struct inode *inode,
  
---- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
-+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
-@@ -3606,6 +3606,12 @@ static void ar9003_hw_ant_ctrl_apply(str
- 	value = ar9003_hw_ant_ctrl_common_2_get(ah, is2ghz);
- 	REG_RMW_FIELD(ah, AR_PHY_SWITCH_COM_2, AR_SWITCH_TABLE_COM2_ALL, value);
+ 	file->private_data = ms;
+ 	p = ms->buf;
+-	p += sprintf(p, "rate     throughput  ewma prob   this prob  "
++	p += sprintf(p, "rate      throughput  ewma prob  this prob  "
+ 			"this succ/attempt   success    attempts\n");
+ 	for (i = 0; i < mi->n_rates; i++) {
+ 		struct minstrel_rate *mr = &mi->r[i];
+@@ -86,7 +86,7 @@ minstrel_stats_open(struct inode *inode,
+ 		eprob = MINSTREL_TRUNC(mr->probability * 1000);
  
-+	if ((AR_SREV_9462(ah)) && (ah->rxchainmask == 0x2)) {
-+		value = ar9003_hw_ant_ctrl_chain_get(ah, 1, is2ghz);
-+		REG_RMW_FIELD(ah, switch_chain_reg[0],
-+			      AR_SWITCH_TABLE_ALL, value);
-+	}
+ 		p += sprintf(p, "  %6u.%1u   %6u.%1u   %6u.%1u        "
+-				"%3u(%3u)   %8llu    %8llu\n",
++				"   %3u(%3u)  %8llu    %8llu\n",
+ 				tp / 10, tp % 10,
+ 				eprob / 10, eprob % 10,
+ 				prob / 10, prob % 10,
+--- a/net/mac80211/rc80211_minstrel_ht.c
++++ b/net/mac80211/rc80211_minstrel_ht.c
+@@ -126,6 +126,9 @@ const struct mcs_group minstrel_mcs_grou
+ 
+ static u8 sample_table[SAMPLE_COLUMNS][MCS_GROUP_RATES];
+ 
++static void
++minstrel_ht_update_rates(struct minstrel_priv *mp, struct minstrel_ht_sta *mi);
 +
- 	for (chain = 0; chain < AR9300_MAX_CHAINS; chain++) {
- 		if ((ah->rxchainmask & BIT(chain)) ||
- 		    (ah->txchainmask & BIT(chain))) {
-@@ -3772,6 +3778,17 @@ static void ar9003_hw_atten_apply(struct
- 					  AR_PHY_EXT_ATTEN_CTL_2,
- 					 };
- 
-+	if ((AR_SREV_9462(ah)) && (ah->rxchainmask == 0x2)) {
-+		value = ar9003_hw_atten_chain_get(ah, 1, chan);
-+		REG_RMW_FIELD(ah, ext_atten_reg[0],
-+			      AR_PHY_EXT_ATTEN_CTL_XATTEN1_DB, value);
-+
-+		value = ar9003_hw_atten_chain_get_margin(ah, 1, chan);
-+		REG_RMW_FIELD(ah, ext_atten_reg[0],
-+			      AR_PHY_EXT_ATTEN_CTL_XATTEN1_MARGIN,
-+			      value);
-+	}
+ /*
+  * Look up an MCS group index based on mac80211 rate information
+  */
+@@ -244,6 +247,7 @@ minstrel_ht_update_stats(struct minstrel
+ 	struct minstrel_rate_stats *mr;
+ 	int cur_prob, cur_prob_tp, cur_tp, cur_tp2;
+ 	int group, i, index;
++	bool mi_rates_valid = false;
+ 
+ 	if (mi->ampdu_packets > 0) {
+ 		mi->avg_ampdu_len = minstrel_ewma(mi->avg_ampdu_len,
+@@ -254,11 +258,10 @@ minstrel_ht_update_stats(struct minstrel
+ 
+ 	mi->sample_slow = 0;
+ 	mi->sample_count = 0;
+-	mi->max_tp_rate = 0;
+-	mi->max_tp_rate2 = 0;
+-	mi->max_prob_rate = 0;
+ 
+ 	for (group = 0; group < ARRAY_SIZE(minstrel_mcs_groups); group++) {
++		bool mg_rates_valid = false;
 +
- 	/* Test value. if 0 then attenuation is unused. Don't load anything. */
- 	for (i = 0; i < 3; i++) {
- 		if (ah->txchainmask & BIT(i)) {
---- a/drivers/net/wireless/ath/ath9k/link.c
-+++ b/drivers/net/wireless/ath/ath9k/link.c
-@@ -28,21 +28,21 @@ void ath_tx_complete_poll_work(struct wo
+ 		cur_prob = 0;
+ 		cur_prob_tp = 0;
+ 		cur_tp = 0;
+@@ -268,15 +271,24 @@ minstrel_ht_update_stats(struct minstrel
+ 		if (!mg->supported)
+ 			continue;
+ 
+-		mg->max_tp_rate = 0;
+-		mg->max_tp_rate2 = 0;
+-		mg->max_prob_rate = 0;
+ 		mi->sample_count++;
+ 
+ 		for (i = 0; i < MCS_GROUP_RATES; i++) {
+ 			if (!(mg->supported & BIT(i)))
+ 				continue;
+ 
++			/* initialize rates selections starting indexes */
++			if (!mg_rates_valid) {
++				mg->max_tp_rate = mg->max_tp_rate2 =
++					mg->max_prob_rate = i;
++				if (!mi_rates_valid) {
++					mi->max_tp_rate = mi->max_tp_rate2 =
++						mi->max_prob_rate = i;
++					mi_rates_valid = true;
++				}
++				mg_rates_valid = true;
++			}
++
+ 			mr = &mg->rates[i];
+ 			mr->retry_updated = false;
+ 			index = MCS_GROUP_RATES * group + i;
+@@ -456,7 +468,7 @@ minstrel_ht_tx_status(void *priv, struct
+ 	struct ieee80211_tx_rate *ar = info->status.rates;
+ 	struct minstrel_rate_stats *rate, *rate2;
+ 	struct minstrel_priv *mp = priv;
+-	bool last;
++	bool last, update = false;
  	int i;
- 	bool needreset = false;
- 
--	for (i = 0; i < ATH9K_NUM_TX_QUEUES; i++)
--		if (ATH_TXQ_SETUP(sc, i)) {
--			txq = &sc->tx.txq[i];
--			ath_txq_lock(sc, txq);
--			if (txq->axq_depth) {
--				if (txq->axq_tx_inprogress) {
--					needreset = true;
--					ath_txq_unlock(sc, txq);
--					break;
--				} else {
--					txq->axq_tx_inprogress = true;
--				}
-+	for (i = 0; i < IEEE80211_NUM_ACS; i++) {
-+		txq = sc->tx.txq_map[i];
-+
-+		ath_txq_lock(sc, txq);
-+		if (txq->axq_depth) {
-+			if (txq->axq_tx_inprogress) {
-+				needreset = true;
-+				ath_txq_unlock(sc, txq);
-+				break;
-+			} else {
-+				txq->axq_tx_inprogress = true;
- 			}
--			ath_txq_unlock_complete(sc, txq);
- 		}
-+		ath_txq_unlock_complete(sc, txq);
+ 
+ 	if (!msp->is_ht)
+@@ -505,21 +517,29 @@ minstrel_ht_tx_status(void *priv, struct
+ 	rate = minstrel_get_ratestats(mi, mi->max_tp_rate);
+ 	if (rate->attempts > 30 &&
+ 	    MINSTREL_FRAC(rate->success, rate->attempts) <
+-	    MINSTREL_FRAC(20, 100))
++	    MINSTREL_FRAC(20, 100)) {
+ 		minstrel_downgrade_rate(mi, &mi->max_tp_rate, true);
++		update = true;
 +	}
  
- 	if (needreset) {
- 		ath_dbg(ath9k_hw_common(sc->sc_ah), RESET,
---- a/net/mac80211/sta_info.c
-+++ b/net/mac80211/sta_info.c
-@@ -766,6 +766,7 @@ int __must_check __sta_info_destroy(stru
- 	struct ieee80211_local *local;
- 	struct ieee80211_sub_if_data *sdata;
- 	int ret, i;
-+	bool have_key = false;
+ 	rate2 = minstrel_get_ratestats(mi, mi->max_tp_rate2);
+ 	if (rate2->attempts > 30 &&
+ 	    MINSTREL_FRAC(rate2->success, rate2->attempts) <
+-	    MINSTREL_FRAC(20, 100))
++	    MINSTREL_FRAC(20, 100)) {
+ 		minstrel_downgrade_rate(mi, &mi->max_tp_rate2, false);
++		update = true;
++	}
  
- 	might_sleep();
+ 	if (time_after(jiffies, mi->stats_update + (mp->update_interval / 2 * HZ) / 1000)) {
++		update = true;
+ 		minstrel_ht_update_stats(mp, mi);
+ 		if (!(info->flags & IEEE80211_TX_CTL_AMPDU) &&
+ 		    mi->max_prob_rate / MCS_GROUP_RATES != MINSTREL_CCK_GROUP)
+ 			minstrel_aggr_check(sta, skb);
+ 	}
++
++	if (update)
++		minstrel_ht_update_rates(mp, mi);
+ }
  
-@@ -793,12 +794,19 @@ int __must_check __sta_info_destroy(stru
- 	list_del_rcu(&sta->list);
+ static void
+@@ -580,39 +600,73 @@ minstrel_calc_retransmit(struct minstrel
+ 	         (++mr->retry_count < mp->max_retry));
+ }
  
- 	mutex_lock(&local->key_mtx);
--	for (i = 0; i < NUM_DEFAULT_KEYS; i++)
-+	for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
- 		__ieee80211_key_free(key_mtx_dereference(local, sta->gtk[i]));
--	if (sta->ptk)
-+		have_key = true;
-+	}
-+	if (sta->ptk) {
- 		__ieee80211_key_free(key_mtx_dereference(local, sta->ptk));
-+		have_key = true;
+-
+ static void
+ minstrel_ht_set_rate(struct minstrel_priv *mp, struct minstrel_ht_sta *mi,
+-                     struct ieee80211_tx_rate *rate, int index,
+-                     bool sample, bool rtscts)
++                     struct ieee80211_sta_rates *ratetbl, int offset, int index)
+ {
+ 	const struct mcs_group *group = &minstrel_mcs_groups[index / MCS_GROUP_RATES];
+ 	struct minstrel_rate_stats *mr;
++	u8 idx;
++	u16 flags;
+ 
+ 	mr = minstrel_get_ratestats(mi, index);
+ 	if (!mr->retry_updated)
+ 		minstrel_calc_retransmit(mp, mi, index);
+ 
+-	if (sample)
+-		rate->count = 1;
+-	else if (mr->probability < MINSTREL_FRAC(20, 100))
+-		rate->count = 2;
+-	else if (rtscts)
+-		rate->count = mr->retry_count_rtscts;
+-	else
+-		rate->count = mr->retry_count;
+-
+-	rate->flags = 0;
+-	if (rtscts)
+-		rate->flags |= IEEE80211_TX_RC_USE_RTS_CTS;
++	if (mr->probability < MINSTREL_FRAC(20, 100) || !mr->retry_count) {
++		ratetbl->rate[offset].count = 2;
++		ratetbl->rate[offset].count_rts = 2;
++		ratetbl->rate[offset].count_cts = 2;
++	} else {
++		ratetbl->rate[offset].count = mr->retry_count;
++		ratetbl->rate[offset].count_cts = mr->retry_count;
++		ratetbl->rate[offset].count_rts = mr->retry_count_rtscts;
 +	}
- 	mutex_unlock(&local->key_mtx);
  
-+	if (!have_key)
-+		synchronize_net();
+ 	if (index / MCS_GROUP_RATES == MINSTREL_CCK_GROUP) {
+-		rate->idx = mp->cck_rates[index % ARRAY_SIZE(mp->cck_rates)];
++		idx = mp->cck_rates[index % ARRAY_SIZE(mp->cck_rates)];
++		flags = 0;
++	} else {
++		idx = index % MCS_GROUP_RATES +
++		      (group->streams - 1) * MCS_GROUP_RATES;
++		flags = IEEE80211_TX_RC_MCS | group->flags;
++	}
++
++	if (offset > 0) {
++		ratetbl->rate[offset].count = ratetbl->rate[offset].count_rts;
++		flags |= IEEE80211_TX_RC_USE_RTS_CTS;
++	}
++
++	ratetbl->rate[offset].idx = idx;
++	ratetbl->rate[offset].flags = flags;
++}
++
++static void
++minstrel_ht_update_rates(struct minstrel_priv *mp, struct minstrel_ht_sta *mi)
++{
++	struct ieee80211_sta_rates *rates;
++	int i = 0;
++
++	rates = kzalloc(sizeof(*rates), GFP_ATOMIC);
++	if (!rates)
+ 		return;
 +
- 	sta->dead = true;
++	/* Start with max_tp_rate */
++	minstrel_ht_set_rate(mp, mi, rates, i++, mi->max_tp_rate);
++
++	if (mp->hw->max_rates >= 3) {
++		/* At least 3 tx rates supported, use max_tp_rate2 next */
++		minstrel_ht_set_rate(mp, mi, rates, i++, mi->max_tp_rate2);
++	}
++
++	if (mp->hw->max_rates >= 2) {
++		/*
++		 * At least 2 tx rates supported, use max_prob_rate next */
++		minstrel_ht_set_rate(mp, mi, rates, i++, mi->max_prob_rate);
+ 	}
  
- 	local->num_sta--;
---- a/net/mac80211/chan.c
-+++ b/net/mac80211/chan.c
-@@ -63,6 +63,7 @@ ieee80211_new_chanctx(struct ieee80211_l
- 		      enum ieee80211_chanctx_mode mode)
+-	rate->flags |= IEEE80211_TX_RC_MCS | group->flags;
+-	rate->idx = index % MCS_GROUP_RATES + (group->streams - 1) * MCS_GROUP_RATES;
++	rates->rate[i].idx = -1;
++	rate_control_set_rates(mp->hw, mi->sta, rates);
+ }
+ 
+ static inline int
+@@ -702,13 +756,13 @@ static void
+ minstrel_ht_get_rate(void *priv, struct ieee80211_sta *sta, void *priv_sta,
+                      struct ieee80211_tx_rate_control *txrc)
  {
- 	struct ieee80211_chanctx *ctx;
-+	u32 changed;
- 	int err;
++	const struct mcs_group *sample_group;
+ 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(txrc->skb);
+-	struct ieee80211_tx_rate *ar = info->status.rates;
++	struct ieee80211_tx_rate *rate = &info->status.rates[0];
+ 	struct minstrel_ht_sta_priv *msp = priv_sta;
+ 	struct minstrel_ht_sta *mi = &msp->ht;
+ 	struct minstrel_priv *mp = priv;
+ 	int sample_idx;
+-	bool sample = false;
  
- 	lockdep_assert_held(&local->chanctx_mtx);
-@@ -76,6 +77,13 @@ ieee80211_new_chanctx(struct ieee80211_l
- 	ctx->conf.rx_chains_dynamic = 1;
- 	ctx->mode = mode;
+ 	if (rate_control_send_low(sta, priv_sta, txrc))
+ 		return;
+@@ -736,51 +790,6 @@ minstrel_ht_get_rate(void *priv, struct 
+ 	}
+ #endif
  
-+	/* acquire mutex to prevent idle from changing */
-+	mutex_lock(&local->mtx);
-+	/* turn idle off *before* setting channel -- some drivers need that */
-+	changed = ieee80211_idle_off(local);
-+	if (changed)
-+		ieee80211_hw_config(local, changed);
-+
- 	if (!local->use_chanctx) {
- 		local->_oper_channel_type =
- 			cfg80211_get_chandef_type(chandef);
-@@ -85,14 +93,17 @@ ieee80211_new_chanctx(struct ieee80211_l
- 		err = drv_add_chanctx(local, ctx);
- 		if (err) {
- 			kfree(ctx);
--			return ERR_PTR(err);
-+			ctx = ERR_PTR(err);
-+
-+			ieee80211_recalc_idle(local);
-+			goto out;
- 		}
+-	if (sample_idx >= 0) {
+-		sample = true;
+-		minstrel_ht_set_rate(mp, mi, &ar[0], sample_idx,
+-			true, false);
+-		info->flags |= IEEE80211_TX_CTL_RATE_CTRL_PROBE;
+-	} else {
+-		minstrel_ht_set_rate(mp, mi, &ar[0], mi->max_tp_rate,
+-			false, false);
+-	}
+-
+-	if (mp->hw->max_rates >= 3) {
+-		/*
+-		 * At least 3 tx rates supported, use
+-		 * sample_rate -> max_tp_rate -> max_prob_rate for sampling and
+-		 * max_tp_rate -> max_tp_rate2 -> max_prob_rate by default.
+-		 */
+-		if (sample_idx >= 0)
+-			minstrel_ht_set_rate(mp, mi, &ar[1], mi->max_tp_rate,
+-				false, false);
+-		else
+-			minstrel_ht_set_rate(mp, mi, &ar[1], mi->max_tp_rate2,
+-				false, true);
+-
+-		minstrel_ht_set_rate(mp, mi, &ar[2], mi->max_prob_rate,
+-				     false, !sample);
+-
+-		ar[3].count = 0;
+-		ar[3].idx = -1;
+-	} else if (mp->hw->max_rates == 2) {
+-		/*
+-		 * Only 2 tx rates supported, use
+-		 * sample_rate -> max_prob_rate for sampling and
+-		 * max_tp_rate -> max_prob_rate by default.
+-		 */
+-		minstrel_ht_set_rate(mp, mi, &ar[1], mi->max_prob_rate,
+-				     false, !sample);
+-
+-		ar[2].count = 0;
+-		ar[2].idx = -1;
+-	} else {
+-		/* Not using MRR, only use the first rate */
+-		ar[1].count = 0;
+-		ar[1].idx = -1;
+-	}
+-
+ 	mi->total_packets++;
+ 
+ 	/* wraparound */
+@@ -788,6 +797,16 @@ minstrel_ht_get_rate(void *priv, struct 
+ 		mi->total_packets = 0;
+ 		mi->sample_packets = 0;
  	}
++
++	if (sample_idx < 0)
++		return;
++
++	sample_group = &minstrel_mcs_groups[sample_idx / MCS_GROUP_RATES];
++	info->flags |= IEEE80211_TX_CTL_RATE_CTRL_PROBE;
++	rate->idx = sample_idx % MCS_GROUP_RATES +
++		    (sample_group->streams - 1) * MCS_GROUP_RATES;
++	rate->flags = IEEE80211_TX_RC_MCS | sample_group->flags;
++	rate->count = 1;
+ }
  
-+	/* and keep the mutex held until the new chanctx is on the list */
- 	list_add_rcu(&ctx->list, &local->chanctx_list);
+ static void
+@@ -837,6 +856,8 @@ minstrel_ht_update_caps(void *priv, stru
  
--	mutex_lock(&local->mtx);
--	ieee80211_recalc_idle(local);
-+ out:
- 	mutex_unlock(&local->mtx);
+ 	msp->is_ht = true;
+ 	memset(mi, 0, sizeof(*mi));
++
++	mi->sta = sta;
+ 	mi->stats_update = jiffies;
  
- 	return ctx;
---- a/net/mac80211/ieee80211_i.h
-+++ b/net/mac80211/ieee80211_i.h
-@@ -1366,6 +1366,7 @@ int ieee80211_if_change_type(struct ieee
- 			     enum nl80211_iftype type);
- void ieee80211_if_remove(struct ieee80211_sub_if_data *sdata);
- void ieee80211_remove_interfaces(struct ieee80211_local *local);
-+u32 ieee80211_idle_off(struct ieee80211_local *local);
- void ieee80211_recalc_idle(struct ieee80211_local *local);
- void ieee80211_adjust_monitor_flags(struct ieee80211_sub_if_data *sdata,
- 				    const int offset);
---- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c
-+++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
-@@ -799,7 +799,7 @@ static int ath9k_init_firmware_version(s
- 	 * required version.
- 	 */
- 	if (priv->fw_version_major != MAJOR_VERSION_REQ ||
--	    priv->fw_version_minor != MINOR_VERSION_REQ) {
-+	    priv->fw_version_minor < MINOR_VERSION_REQ) {
- 		dev_err(priv->dev, "ath9k_htc: Please upgrade to FW version %d.%d\n",
- 			MAJOR_VERSION_REQ, MINOR_VERSION_REQ);
- 		return -EINVAL;
---- a/drivers/net/wireless/ath/ath9k/xmit.c
-+++ b/drivers/net/wireless/ath/ath9k/xmit.c
-@@ -516,8 +516,7 @@ static void ath_tx_complete_aggr(struct 
- 		 * not a holding desc.
- 		 */
- 		INIT_LIST_HEAD(&bf_head);
--		if ((sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA) ||
--		    bf_next != NULL || !bf_last->bf_stale)
-+		if (bf_next != NULL || !bf_last->bf_stale)
- 			list_move_tail(&bf->list, &bf_head);
- 
- 		if (!txpending || (tid->state & AGGR_CLEANUP)) {
-@@ -537,8 +536,7 @@ static void ath_tx_complete_aggr(struct 
- 				!txfail);
- 		} else {
- 			/* retry the un-acked ones */
--			if (!(sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA) &&
--			    bf->bf_next == NULL && bf_last->bf_stale) {
-+			if (bf->bf_next == NULL && bf_last->bf_stale) {
- 				struct ath_buf *tbf;
- 
- 				tbf = ath_clone_txbuf(sc, bf_last);
-@@ -2264,6 +2262,7 @@ void ath_tx_edma_tasklet(struct ath_soft
- 	struct ath_txq *txq;
- 	struct ath_buf *bf, *lastbf;
- 	struct list_head bf_head;
-+	struct list_head *fifo_list;
- 	int status;
- 
- 	for (;;) {
-@@ -2291,20 +2290,24 @@ void ath_tx_edma_tasklet(struct ath_soft
- 
- 		TX_STAT_INC(txq->axq_qnum, txprocdesc);
- 
--		if (list_empty(&txq->txq_fifo[txq->txq_tailidx])) {
-+		fifo_list = &txq->txq_fifo[txq->txq_tailidx];
-+		if (list_empty(fifo_list)) {
- 			ath_txq_unlock(sc, txq);
- 			return;
- 		}
+ 	ack_dur = ieee80211_frame_duration(sband->band, 10, 60, 1, 1);
+@@ -898,6 +919,9 @@ minstrel_ht_update_caps(void *priv, stru
+ 	if (!n_supported)
+ 		goto use_legacy;
  
--		bf = list_first_entry(&txq->txq_fifo[txq->txq_tailidx],
--				      struct ath_buf, list);
-+		bf = list_first_entry(fifo_list, struct ath_buf, list);
-+		if (bf->bf_stale) {
-+			list_del(&bf->list);
-+			ath_tx_return_buffer(sc, bf);
-+			bf = list_first_entry(fifo_list, struct ath_buf, list);
-+		}
++	minstrel_ht_update_stats(mp, mi);
++	minstrel_ht_update_rates(mp, mi);
 +
- 		lastbf = bf->bf_lastbf;
+ 	return;
  
- 		INIT_LIST_HEAD(&bf_head);
--		list_cut_position(&bf_head, &txq->txq_fifo[txq->txq_tailidx],
--				  &lastbf->list);
--
--		if (list_empty(&txq->txq_fifo[txq->txq_tailidx])) {
-+		if (list_is_last(&lastbf->list, fifo_list)) {
-+			list_splice_tail_init(fifo_list, &bf_head);
- 			INCR(txq->txq_tailidx, ATH_TXFIFO_DEPTH);
- 
- 			if (!list_empty(&txq->axq_q)) {
-@@ -2315,6 +2318,11 @@ void ath_tx_edma_tasklet(struct ath_soft
- 				list_splice_tail_init(&txq->axq_q, &bf_q);
- 				ath_tx_txqaddbuf(sc, txq, &bf_q, true);
- 			}
-+		} else {
-+			lastbf->bf_stale = true;
-+			if (bf != lastbf)
-+				list_cut_position(&bf_head, fifo_list,
-+						  lastbf->list.prev);
- 		}
+ use_legacy:
+--- a/net/mac80211/rc80211_minstrel_ht.h
++++ b/net/mac80211/rc80211_minstrel_ht.h
+@@ -65,6 +65,8 @@ struct minstrel_mcs_group_data {
+ };
  
- 		ath_tx_process_buffer(sc, txq, &ts, bf, &bf_head);
---- a/drivers/net/wireless/ath/ath9k/ar9580_1p0_initvals.h
-+++ b/drivers/net/wireless/ath/ath9k/ar9580_1p0_initvals.h
-@@ -519,7 +519,7 @@ static const u32 ar9580_1p0_mac_core[][2
- 	{0x00008258, 0x00000000},
- 	{0x0000825c, 0x40000000},
- 	{0x00008260, 0x00080922},
--	{0x00008264, 0x9bc00010},
-+	{0x00008264, 0x9d400010},
- 	{0x00008268, 0xffffffff},
- 	{0x0000826c, 0x0000ffff},
- 	{0x00008270, 0x00000000},
---- a/net/mac80211/mlme.c
-+++ b/net/mac80211/mlme.c
-@@ -3955,8 +3955,16 @@ int ieee80211_mgd_auth(struct ieee80211_
- 	/* prep auth_data so we don't go into idle on disassoc */
- 	ifmgd->auth_data = auth_data;
+ struct minstrel_ht_sta {
++	struct ieee80211_sta *sta;
++
+ 	/* ampdu length (average, per sampling interval) */
+ 	unsigned int ampdu_len;
+ 	unsigned int ampdu_packets;
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -1372,6 +1372,7 @@ ieee80211_rx_h_sta_process(struct ieee80
+ 	struct sk_buff *skb = rx->skb;
+ 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
+ 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
++	int i;
+ 
+ 	if (!sta)
+ 		return RX_CONTINUE;
+@@ -1422,6 +1423,19 @@ ieee80211_rx_h_sta_process(struct ieee80
+ 		ewma_add(&sta->avg_signal, -status->signal);
+ 	}
  
--	if (ifmgd->associated)
--		ieee80211_set_disassoc(sdata, 0, 0, false, NULL);
-+	if (ifmgd->associated) {
-+		u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
++	if (status->chains) {
++		sta->chains = status->chains;
++		for (i = 0; i < ARRAY_SIZE(status->chain_signal); i++) {
++			int signal = status->chain_signal[i];
 +
-+		ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
-+				       WLAN_REASON_UNSPECIFIED,
-+				       false, frame_buf);
++			if (!(status->chains & BIT(i)))
++				continue;
 +
-+		__cfg80211_send_deauth(sdata->dev, frame_buf,
-+				       sizeof(frame_buf));
++			sta->chain_signal_last[i] = signal;
++			ewma_add(&sta->chain_signal_avg[i], -signal);
++		}
 +	}
++
+ 	/*
+ 	 * Change STA power saving mode only at the end of a frame
+ 	 * exchange sequence.
+@@ -2085,6 +2099,7 @@ ieee80211_rx_h_mesh_fwding(struct ieee80
+ 	}
  
- 	sdata_info(sdata, "authenticate with %pM\n", req->bss->bssid);
+ 	fwd_hdr =  (struct ieee80211_hdr *) fwd_skb->data;
++	fwd_hdr->frame_control &= ~cpu_to_le16(IEEE80211_FCTL_RETRY);
+ 	info = IEEE80211_SKB_CB(fwd_skb);
+ 	memset(info, 0, sizeof(*info));
+ 	info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
+@@ -2356,6 +2371,7 @@ ieee80211_rx_h_action(struct ieee80211_r
+ 		    sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
+ 		    sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
+ 		    sdata->vif.type != NL80211_IFTYPE_AP &&
++		    sdata->vif.type != NL80211_IFTYPE_WDS &&
+ 		    sdata->vif.type != NL80211_IFTYPE_ADHOC)
+ 			break;
  
-@@ -4016,8 +4024,16 @@ int ieee80211_mgd_assoc(struct ieee80211
+@@ -2423,6 +2439,22 @@ ieee80211_rx_h_action(struct ieee80211_r
+ 		}
  
- 	mutex_lock(&ifmgd->mtx);
+ 		break;
++	case WLAN_CATEGORY_PUBLIC:
++		if (len < IEEE80211_MIN_ACTION_SIZE + 1)
++			goto invalid;
++		if (sdata->vif.type != NL80211_IFTYPE_STATION)
++			break;
++		if (!rx->sta)
++			break;
++		if (!ether_addr_equal(mgmt->bssid, sdata->u.mgd.bssid))
++			break;
++		if (mgmt->u.action.u.ext_chan_switch.action_code !=
++				WLAN_PUB_ACTION_EXT_CHANSW_ANN)
++			break;
++		if (len < offsetof(struct ieee80211_mgmt,
++				   u.action.u.ext_chan_switch.variable))
++			goto invalid;
++		goto queue;
+ 	case WLAN_CATEGORY_VHT:
+ 		if (sdata->vif.type != NL80211_IFTYPE_STATION &&
+ 		    sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
+@@ -2506,10 +2538,6 @@ ieee80211_rx_h_action(struct ieee80211_r
+ 			ieee80211_process_measurement_req(sdata, mgmt, len);
+ 			goto handled;
+ 		case WLAN_ACTION_SPCT_CHL_SWITCH:
+-			if (len < (IEEE80211_MIN_ACTION_SIZE +
+-				   sizeof(mgmt->u.action.u.chan_switch)))
+-				break;
+-
+ 			if (sdata->vif.type != NL80211_IFTYPE_STATION)
+ 				break;
  
--	if (ifmgd->associated)
--		ieee80211_set_disassoc(sdata, 0, 0, false, NULL);
-+	if (ifmgd->associated) {
-+		u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
+@@ -2695,14 +2723,15 @@ ieee80211_rx_h_mgmt(struct ieee80211_rx_
+ 
+ 	if (!ieee80211_vif_is_mesh(&sdata->vif) &&
+ 	    sdata->vif.type != NL80211_IFTYPE_ADHOC &&
+-	    sdata->vif.type != NL80211_IFTYPE_STATION)
++	    sdata->vif.type != NL80211_IFTYPE_STATION &&
++	    sdata->vif.type != NL80211_IFTYPE_WDS)
+ 		return RX_DROP_MONITOR;
+ 
+ 	switch (stype) {
+ 	case cpu_to_le16(IEEE80211_STYPE_AUTH):
+ 	case cpu_to_le16(IEEE80211_STYPE_BEACON):
+ 	case cpu_to_le16(IEEE80211_STYPE_PROBE_RESP):
+-		/* process for all: mesh, mlme, ibss */
++		/* process for all: mesh, mlme, ibss, wds */
+ 		break;
+ 	case cpu_to_le16(IEEE80211_STYPE_ASSOC_RESP):
+ 	case cpu_to_le16(IEEE80211_STYPE_REASSOC_RESP):
+@@ -3031,10 +3060,16 @@ static int prepare_for_handlers(struct i
+ 		}
+ 		break;
+ 	case NL80211_IFTYPE_WDS:
+-		if (bssid || !ieee80211_is_data(hdr->frame_control))
+-			return 0;
+ 		if (!ether_addr_equal(sdata->u.wds.remote_addr, hdr->addr2))
+ 			return 0;
 +
-+		ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
-+				       WLAN_REASON_UNSPECIFIED,
-+				       false, frame_buf);
++		if (ieee80211_is_data(hdr->frame_control) ||
++		    ieee80211_is_action(hdr->frame_control)) {
++			if (compare_ether_addr(sdata->vif.addr, hdr->addr1))
++				return 0;
++		} else if (!ieee80211_is_beacon(hdr->frame_control))
++			return 0;
 +
-+		__cfg80211_send_deauth(sdata->dev, frame_buf,
-+				       sizeof(frame_buf));
-+	}
+ 		break;
+ 	case NL80211_IFTYPE_P2P_DEVICE:
+ 		if (!ieee80211_is_public_action(hdr, skb->len) &&
+--- a/net/mac80211/scan.c
++++ b/net/mac80211/scan.c
+@@ -181,7 +181,7 @@ void ieee80211_scan_rx(struct ieee80211_
+ 	if (baselen > skb->len)
+ 		return;
  
- 	if (ifmgd->auth_data && !ifmgd->auth_data->done) {
- 		err = -EBUSY;
---- a/net/mac80211/rc80211_minstrel.c
-+++ b/net/mac80211/rc80211_minstrel.c
-@@ -55,7 +55,6 @@
- #include "rate.h"
- #include "rc80211_minstrel.h"
+-	ieee802_11_parse_elems(elements, skb->len - baselen, &elems);
++	ieee802_11_parse_elems(elements, skb->len - baselen, false, &elems);
  
--#define SAMPLE_COLUMNS	10
- #define SAMPLE_TBL(_mi, _idx, _col) \
- 		_mi->sample_table[(_idx * SAMPLE_COLUMNS) + _col]
+ 	channel = ieee80211_get_channel(local->hw.wiphy, rx_status->freq);
  
-@@ -70,16 +69,31 @@ rix_to_ndx(struct minstrel_sta_info *mi,
- 	return i;
- }
+--- a/net/mac80211/sta_info.h
++++ b/net/mac80211/sta_info.h
+@@ -32,7 +32,6 @@
+  * @WLAN_STA_SHORT_PREAMBLE: Station is capable of receiving short-preamble
+  *	frames.
+  * @WLAN_STA_WME: Station is a QoS-STA.
+- * @WLAN_STA_WDS: Station is one of our WDS peers.
+  * @WLAN_STA_CLEAR_PS_FILT: Clear PS filter in hardware (using the
+  *	IEEE80211_TX_CTL_CLEAR_PS_FILT control flag) when the next
+  *	frame to this station is transmitted.
+@@ -66,7 +65,6 @@ enum ieee80211_sta_info_flags {
+ 	WLAN_STA_AUTHORIZED,
+ 	WLAN_STA_SHORT_PREAMBLE,
+ 	WLAN_STA_WME,
+-	WLAN_STA_WDS,
+ 	WLAN_STA_CLEAR_PS_FILT,
+ 	WLAN_STA_MFP,
+ 	WLAN_STA_BLOCK_BA,
+@@ -344,6 +342,11 @@ struct sta_info {
+ 	int last_signal;
+ 	struct ewma avg_signal;
+ 	int last_ack_signal;
++
++	u8 chains;
++	s8 chain_signal_last[IEEE80211_MAX_CHAINS];
++	struct ewma chain_signal_avg[IEEE80211_MAX_CHAINS];
++
+ 	/* Plus 1 for non-QoS frames */
+ 	__le16 last_seq_ctrl[IEEE80211_NUM_TIDS + 1];
+ 
+--- a/net/mac80211/trace.h
++++ b/net/mac80211/trace.h
+@@ -990,23 +990,23 @@ TRACE_EVENT(drv_channel_switch,
+ 
+ 	TP_STRUCT__entry(
+ 		LOCAL_ENTRY
++		CHANDEF_ENTRY
+ 		__field(u64, timestamp)
+ 		__field(bool, block_tx)
+-		__field(u16, freq)
+ 		__field(u8, count)
+ 	),
+ 
+ 	TP_fast_assign(
+ 		LOCAL_ASSIGN;
++		CHANDEF_ASSIGN(&ch_switch->chandef)
+ 		__entry->timestamp = ch_switch->timestamp;
+ 		__entry->block_tx = ch_switch->block_tx;
+-		__entry->freq = ch_switch->channel->center_freq;
+ 		__entry->count = ch_switch->count;
+ 	),
+ 
+ 	TP_printk(
+-		LOCAL_PR_FMT " new freq:%u count:%d",
+-		LOCAL_PR_ARG, __entry->freq, __entry->count
++		LOCAL_PR_FMT " new " CHANDEF_PR_FMT " count:%d",
++		LOCAL_PR_ARG, CHANDEF_PR_ARG, __entry->count
+ 	)
+ );
  
-+/* find & sort topmost throughput rates */
-+static inline void
-+minstrel_sort_best_tp_rates(struct minstrel_sta_info *mi, int i, u8 *tp_list)
-+{
-+	int j = MAX_THR_RATES;
-+
-+	while (j > 0 && mi->r[i].cur_tp > mi->r[tp_list[j - 1]].cur_tp)
-+		j--;
-+	if (j < MAX_THR_RATES - 1)
-+		memmove(&tp_list[j + 1], &tp_list[j], MAX_THR_RATES - (j + 1));
-+	if (j < MAX_THR_RATES)
-+		tp_list[j] = i;
-+}
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -48,15 +48,15 @@ static __le16 ieee80211_duration(struct 
+ 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+ 
+ 	/* assume HW handles this */
+-	if (info->control.rates[0].flags & IEEE80211_TX_RC_MCS)
++	if (tx->rate.flags & IEEE80211_TX_RC_MCS)
+ 		return 0;
+ 
+ 	/* uh huh? */
+-	if (WARN_ON_ONCE(info->control.rates[0].idx < 0))
++	if (WARN_ON_ONCE(tx->rate.idx < 0))
+ 		return 0;
+ 
+ 	sband = local->hw.wiphy->bands[info->band];
+-	txrate = &sband->bitrates[info->control.rates[0].idx];
++	txrate = &sband->bitrates[tx->rate.idx];
+ 
+ 	erp = txrate->flags & IEEE80211_RATE_ERP_G;
+ 
+@@ -617,11 +617,9 @@ ieee80211_tx_h_rate_ctrl(struct ieee8021
+ 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
+ 	struct ieee80211_hdr *hdr = (void *)tx->skb->data;
+ 	struct ieee80211_supported_band *sband;
+-	struct ieee80211_rate *rate;
+-	int i;
+ 	u32 len;
+-	bool inval = false, rts = false, short_preamble = false;
+ 	struct ieee80211_tx_rate_control txrc;
++	struct ieee80211_sta_rates *ratetbl = NULL;
+ 	bool assoc = false;
+ 
+ 	memset(&txrc, 0, sizeof(txrc));
+@@ -642,18 +640,23 @@ ieee80211_tx_h_rate_ctrl(struct ieee8021
+ 		txrc.max_rate_idx = -1;
+ 	else
+ 		txrc.max_rate_idx = fls(txrc.rate_idx_mask) - 1;
+-	memcpy(txrc.rate_idx_mcs_mask,
+-	       tx->sdata->rc_rateidx_mcs_mask[info->band],
+-	       sizeof(txrc.rate_idx_mcs_mask));
 +
- static void
- minstrel_update_stats(struct minstrel_priv *mp, struct minstrel_sta_info *mi)
- {
--	u32 max_tp = 0, index_max_tp = 0, index_max_tp2 = 0;
--	u32 max_prob = 0, index_max_prob = 0;
-+	u8 tmp_tp_rate[MAX_THR_RATES];
-+	u8 tmp_prob_rate = 0;
- 	u32 usecs;
--	u32 p;
- 	int i;
++	if (tx->sdata->rc_has_mcs_mask[info->band])
++		txrc.rate_idx_mcs_mask =
++			tx->sdata->rc_rateidx_mcs_mask[info->band];
++
+ 	txrc.bss = (tx->sdata->vif.type == NL80211_IFTYPE_AP ||
+ 		    tx->sdata->vif.type == NL80211_IFTYPE_MESH_POINT ||
+ 		    tx->sdata->vif.type == NL80211_IFTYPE_ADHOC);
+ 
+ 	/* set up RTS protection if desired */
+ 	if (len > tx->local->hw.wiphy->rts_threshold) {
+-		txrc.rts = rts = true;
++		txrc.rts = true;
+ 	}
  
--	mi->stats_update = jiffies;
-+	for (i=0; i < MAX_THR_RATES; i++)
-+	    tmp_tp_rate[i] = 0;
++	info->control.use_rts = txrc.rts;
++	info->control.use_cts_prot = tx->sdata->vif.bss_conf.use_cts_prot;
 +
- 	for (i = 0; i < mi->n_rates; i++) {
- 		struct minstrel_rate *mr = &mi->r[i];
+ 	/*
+ 	 * Use short preamble if the BSS can handle it, but not for
+ 	 * management frames unless we know the receiver can handle
+@@ -663,7 +666,9 @@ ieee80211_tx_h_rate_ctrl(struct ieee8021
+ 	if (tx->sdata->vif.bss_conf.use_short_preamble &&
+ 	    (ieee80211_is_data(hdr->frame_control) ||
+ 	     (tx->sta && test_sta_flag(tx->sta, WLAN_STA_SHORT_PREAMBLE))))
+-		txrc.short_preamble = short_preamble = true;
++		txrc.short_preamble = true;
++
++	info->control.short_preamble = txrc.short_preamble;
  
-@@ -87,27 +101,32 @@ minstrel_update_stats(struct minstrel_pr
- 		if (!usecs)
- 			usecs = 1000000;
- 
--		/* To avoid rounding issues, probabilities scale from 0 (0%)
--		 * to 18000 (100%) */
--		if (mr->attempts) {
--			p = (mr->success * 18000) / mr->attempts;
-+		if (unlikely(mr->attempts > 0)) {
-+			mr->sample_skipped = 0;
-+			mr->cur_prob = MINSTREL_FRAC(mr->success, mr->attempts);
- 			mr->succ_hist += mr->success;
- 			mr->att_hist += mr->attempts;
--			mr->cur_prob = p;
--			p = ((p * (100 - mp->ewma_level)) + (mr->probability *
--				mp->ewma_level)) / 100;
--			mr->probability = p;
--			mr->cur_tp = p * (1000000 / usecs);
--		}
-+			mr->probability = minstrel_ewma(mr->probability,
-+							mr->cur_prob,
-+							EWMA_LEVEL);
-+		} else
-+			mr->sample_skipped++;
- 
- 		mr->last_success = mr->success;
- 		mr->last_attempts = mr->attempts;
- 		mr->success = 0;
- 		mr->attempts = 0;
- 
-+		/* Update throughput per rate, reset thr. below 10% success */
-+		if (mr->probability < MINSTREL_FRAC(10, 100))
-+			mr->cur_tp = 0;
-+		else
-+			mr->cur_tp = mr->probability * (1000000 / usecs);
-+
- 		/* Sample less often below the 10% chance of success.
- 		 * Sample less often above the 95% chance of success. */
--		if ((mr->probability > 17100) || (mr->probability < 1800)) {
-+		if (mr->probability > MINSTREL_FRAC(95, 100) ||
-+		    mr->probability < MINSTREL_FRAC(10, 100)) {
- 			mr->adjusted_retry_count = mr->retry_count >> 1;
- 			if (mr->adjusted_retry_count > 2)
- 				mr->adjusted_retry_count = 2;
-@@ -118,35 +137,30 @@ minstrel_update_stats(struct minstrel_pr
- 		}
- 		if (!mr->adjusted_retry_count)
- 			mr->adjusted_retry_count = 2;
--	}
+ 	if (tx->sta)
+ 		assoc = test_sta_flag(tx->sta, WLAN_STA_ASSOC);
+@@ -687,16 +692,38 @@ ieee80211_tx_h_rate_ctrl(struct ieee8021
+ 	 */
+ 	rate_control_get_rate(tx->sdata, tx->sta, &txrc);
  
--	for (i = 0; i < mi->n_rates; i++) {
--		struct minstrel_rate *mr = &mi->r[i];
--		if (max_tp < mr->cur_tp) {
--			index_max_tp = i;
--			max_tp = mr->cur_tp;
--		}
--		if (max_prob < mr->probability) {
--			index_max_prob = i;
--			max_prob = mr->probability;
-+		minstrel_sort_best_tp_rates(mi, i, tmp_tp_rate);
-+
-+		/* To determine the most robust rate (max_prob_rate) used at
-+		 * 3rd mmr stage we distinct between two cases:
-+		 * (1) if any success probabilitiy >= 95%, out of those rates
-+		 * choose the maximum throughput rate as max_prob_rate
-+		 * (2) if all success probabilities < 95%, the rate with
-+		 * highest success probability is choosen as max_prob_rate */
-+		if (mr->probability >= MINSTREL_FRAC(95,100)) {
-+			if (mr->cur_tp >= mi->r[tmp_prob_rate].cur_tp)
-+				tmp_prob_rate = i;
+-	if (unlikely(info->control.rates[0].idx < 0))
+-		return TX_DROP;
++	if (tx->sta && !info->control.skip_table)
++		ratetbl = rcu_dereference(tx->sta->sta.rates);
++
++	if (unlikely(info->control.rates[0].idx < 0)) {
++		if (ratetbl) {
++			struct ieee80211_tx_rate rate = {
++				.idx = ratetbl->rate[0].idx,
++				.flags = ratetbl->rate[0].flags,
++				.count = ratetbl->rate[0].count
++			};
++
++			if (ratetbl->rate[0].idx < 0)
++				return TX_DROP;
++
++			tx->rate = rate;
 +		} else {
-+			if (mr->probability >= mi->r[tmp_prob_rate].probability)
-+				tmp_prob_rate = i;
- 		}
- 	}
++			return TX_DROP;
++		}
++	} else {
++		tx->rate = info->control.rates[0];
++	}
+ 
+ 	if (txrc.reported_rate.idx < 0) {
+-		txrc.reported_rate = info->control.rates[0];
++		txrc.reported_rate = tx->rate;
+ 		if (tx->sta && ieee80211_is_data(hdr->frame_control))
+ 			tx->sta->last_tx_rate = txrc.reported_rate;
+ 	} else if (tx->sta)
+ 		tx->sta->last_tx_rate = txrc.reported_rate;
  
--	max_tp = 0;
--	for (i = 0; i < mi->n_rates; i++) {
--		struct minstrel_rate *mr = &mi->r[i];
++	if (ratetbl)
++		return TX_CONTINUE;
++
+ 	if (unlikely(!info->control.rates[0].count))
+ 		info->control.rates[0].count = 1;
+ 
+@@ -704,91 +731,6 @@ ieee80211_tx_h_rate_ctrl(struct ieee8021
+ 			 (info->flags & IEEE80211_TX_CTL_NO_ACK)))
+ 		info->control.rates[0].count = 1;
+ 
+-	if (is_multicast_ether_addr(hdr->addr1)) {
+-		/*
+-		 * XXX: verify the rate is in the basic rateset
+-		 */
+-		return TX_CONTINUE;
+-	}
+-
+-	/*
+-	 * set up the RTS/CTS rate as the fastest basic rate
+-	 * that is not faster than the data rate
+-	 *
+-	 * XXX: Should this check all retry rates?
+-	 */
+-	if (!(info->control.rates[0].flags & IEEE80211_TX_RC_MCS)) {
+-		s8 baserate = 0;
+-
+-		rate = &sband->bitrates[info->control.rates[0].idx];
 -
--		if (i == index_max_tp)
+-		for (i = 0; i < sband->n_bitrates; i++) {
+-			/* must be a basic rate */
+-			if (!(tx->sdata->vif.bss_conf.basic_rates & BIT(i)))
+-				continue;
+-			/* must not be faster than the data rate */
+-			if (sband->bitrates[i].bitrate > rate->bitrate)
+-				continue;
+-			/* maximum */
+-			if (sband->bitrates[baserate].bitrate <
+-			     sband->bitrates[i].bitrate)
+-				baserate = i;
+-		}
+-
+-		info->control.rts_cts_rate_idx = baserate;
+-	}
+-
+-	for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
+-		/*
+-		 * make sure there's no valid rate following
+-		 * an invalid one, just in case drivers don't
+-		 * take the API seriously to stop at -1.
+-		 */
+-		if (inval) {
+-			info->control.rates[i].idx = -1;
+-			continue;
+-		}
+-		if (info->control.rates[i].idx < 0) {
+-			inval = true;
 -			continue;
-+	/* Assign the new rate set */
-+	memcpy(mi->max_tp_rate, tmp_tp_rate, sizeof(mi->max_tp_rate));
-+	mi->max_prob_rate = tmp_prob_rate;
- 
--		if (max_tp < mr->cur_tp) {
--			index_max_tp2 = i;
--			max_tp = mr->cur_tp;
 -		}
+-
+-		/*
+-		 * For now assume MCS is already set up correctly, this
+-		 * needs to be fixed.
+-		 */
+-		if (info->control.rates[i].flags & IEEE80211_TX_RC_MCS) {
+-			WARN_ON(info->control.rates[i].idx > 76);
+-			continue;
+-		}
+-
+-		/* set up RTS protection if desired */
+-		if (rts)
+-			info->control.rates[i].flags |=
+-				IEEE80211_TX_RC_USE_RTS_CTS;
+-
+-		/* RC is busted */
+-		if (WARN_ON_ONCE(info->control.rates[i].idx >=
+-				 sband->n_bitrates)) {
+-			info->control.rates[i].idx = -1;
+-			continue;
+-		}
+-
+-		rate = &sband->bitrates[info->control.rates[i].idx];
+-
+-		/* set up short preamble */
+-		if (short_preamble &&
+-		    rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
+-			info->control.rates[i].flags |=
+-				IEEE80211_TX_RC_USE_SHORT_PREAMBLE;
+-
+-		/* set up G protection */
+-		if (!rts && tx->sdata->vif.bss_conf.use_cts_prot &&
+-		    rate->flags & IEEE80211_RATE_ERP_G)
+-			info->control.rates[i].flags |=
+-				IEEE80211_TX_RC_USE_CTS_PROTECT;
 -	}
--	mi->max_tp_rate = index_max_tp;
--	mi->max_tp_rate2 = index_max_tp2;
--	mi->max_prob_rate = index_max_prob;
-+	/* Reset update timer */
-+	mi->stats_update = jiffies;
+-
+ 	return TX_CONTINUE;
  }
  
- static void
-@@ -207,10 +221,10 @@ static int
- minstrel_get_next_sample(struct minstrel_sta_info *mi)
+@@ -2508,8 +2450,6 @@ struct sk_buff *ieee80211_beacon_get_tim
+ 		txrc.max_rate_idx = -1;
+ 	else
+ 		txrc.max_rate_idx = fls(txrc.rate_idx_mask) - 1;
+-	memcpy(txrc.rate_idx_mcs_mask, sdata->rc_rateidx_mcs_mask[band],
+-	       sizeof(txrc.rate_idx_mcs_mask));
+ 	txrc.bss = true;
+ 	rate_control_get_rate(sdata, NULL, &txrc);
+ 
+--- a/net/mac80211/util.c
++++ b/net/mac80211/util.c
+@@ -485,7 +485,8 @@ int ieee80211_queue_stopped(struct ieee8
+ 		return true;
+ 
+ 	spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
+-	ret = !!local->queue_stop_reasons[queue];
++	ret = test_bit(IEEE80211_QUEUE_STOP_REASON_DRIVER,
++		       &local->queue_stop_reasons[queue]);
+ 	spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
+ 	return ret;
+ }
+@@ -660,7 +661,7 @@ void ieee80211_queue_delayed_work(struct
+ }
+ EXPORT_SYMBOL(ieee80211_queue_delayed_work);
+ 
+-u32 ieee802_11_parse_elems_crc(u8 *start, size_t len,
++u32 ieee802_11_parse_elems_crc(u8 *start, size_t len, bool action,
+ 			       struct ieee802_11_elems *elems,
+ 			       u64 filter, u32 crc)
  {
- 	unsigned int sample_ndx;
--	sample_ndx = SAMPLE_TBL(mi, mi->sample_idx, mi->sample_column);
--	mi->sample_idx++;
--	if ((int) mi->sample_idx > (mi->n_rates - 2)) {
--		mi->sample_idx = 0;
-+	sample_ndx = SAMPLE_TBL(mi, mi->sample_row, mi->sample_column);
-+	mi->sample_row++;
-+	if ((int) mi->sample_row >= mi->n_rates) {
-+		mi->sample_row = 0;
- 		mi->sample_column++;
- 		if (mi->sample_column >= SAMPLE_COLUMNS)
- 			mi->sample_column = 0;
-@@ -228,31 +242,37 @@ minstrel_get_rate(void *priv, struct iee
- 	struct minstrel_priv *mp = priv;
- 	struct ieee80211_tx_rate *ar = info->control.rates;
- 	unsigned int ndx, sample_ndx = 0;
--	bool mrr;
--	bool sample_slower = false;
--	bool sample = false;
-+	bool mrr_capable;
-+	bool indirect_rate_sampling = false;
-+	bool rate_sampling = false;
- 	int i, delta;
- 	int mrr_ndx[3];
--	int sample_rate;
-+	int sampling_ratio;
- 
-+	/* management/no-ack frames do not use rate control */
- 	if (rate_control_send_low(sta, priv_sta, txrc))
+@@ -668,6 +669,7 @@ u32 ieee802_11_parse_elems_crc(u8 *start
+ 	u8 *pos = start;
+ 	bool calc_crc = filter != 0;
+ 	DECLARE_BITMAP(seen_elems, 256);
++	const u8 *ie;
+ 
+ 	bitmap_zero(seen_elems, 256);
+ 	memset(elems, 0, sizeof(*elems));
+@@ -715,6 +717,12 @@ u32 ieee802_11_parse_elems_crc(u8 *start
+ 		case WLAN_EID_COUNTRY:
+ 		case WLAN_EID_PWR_CONSTRAINT:
+ 		case WLAN_EID_TIMEOUT_INTERVAL:
++		case WLAN_EID_SECONDARY_CHANNEL_OFFSET:
++		case WLAN_EID_WIDE_BW_CHANNEL_SWITCH:
++		/*
++		 * not listing WLAN_EID_CHANNEL_SWITCH_WRAPPER -- it seems possible
++		 * that if the content gets bigger it might be needed more than once
++		 */
+ 			if (test_bit(id, seen_elems)) {
+ 				elems->parse_error = true;
+ 				left -= elen;
+@@ -862,6 +870,48 @@ u32 ieee802_11_parse_elems_crc(u8 *start
+ 			}
+ 			elems->ch_switch_ie = (void *)pos;
+ 			break;
++		case WLAN_EID_EXT_CHANSWITCH_ANN:
++			if (elen != sizeof(struct ieee80211_ext_chansw_ie)) {
++				elem_parse_failed = true;
++				break;
++			}
++			elems->ext_chansw_ie = (void *)pos;
++			break;
++		case WLAN_EID_SECONDARY_CHANNEL_OFFSET:
++			if (elen != sizeof(struct ieee80211_sec_chan_offs_ie)) {
++				elem_parse_failed = true;
++				break;
++			}
++			elems->sec_chan_offs = (void *)pos;
++			break;
++		case WLAN_EID_WIDE_BW_CHANNEL_SWITCH:
++			if (!action ||
++			    elen != sizeof(*elems->wide_bw_chansw_ie)) {
++				elem_parse_failed = true;
++				break;
++			}
++			elems->wide_bw_chansw_ie = (void *)pos;
++			break;
++		case WLAN_EID_CHANNEL_SWITCH_WRAPPER:
++			if (action) {
++				elem_parse_failed = true;
++				break;
++			}
++			/*
++			 * This is a bit tricky, but as we only care about
++			 * the wide bandwidth channel switch element, so
++			 * just parse it out manually.
++			 */
++			ie = cfg80211_find_ie(WLAN_EID_WIDE_BW_CHANNEL_SWITCH,
++					      pos, elen);
++			if (ie) {
++				if (ie[1] == sizeof(*elems->wide_bw_chansw_ie))
++					elems->wide_bw_chansw_ie =
++						(void *)(ie + 2);
++				else
++					elem_parse_failed = true;
++			}
++			break;
+ 		case WLAN_EID_COUNTRY:
+ 			elems->country_elem = pos;
+ 			elems->country_elem_len = elen;
+--- a/net/wireless/reg.c
++++ b/net/wireless/reg.c
+@@ -857,7 +857,7 @@ static void handle_channel(struct wiphy 
+ 			return;
+ 
+ 		REG_DBG_PRINT("Disabling freq %d MHz\n", chan->center_freq);
+-		chan->flags = IEEE80211_CHAN_DISABLED;
++		chan->flags |= IEEE80211_CHAN_DISABLED;
  		return;
+ 	}
  
--	mrr = mp->has_mrr && !txrc->rts && !txrc->bss_conf->use_cts_prot;
--
--	ndx = mi->max_tp_rate;
--
--	if (mrr)
--		sample_rate = mp->lookaround_rate_mrr;
-+	/* check multi-rate-retry capabilities & adjust lookaround_rate */
-+	mrr_capable = mp->has_mrr &&
-+		      !txrc->rts &&
-+		      !txrc->bss_conf->use_cts_prot;
-+	if (mrr_capable)
-+		sampling_ratio = mp->lookaround_rate_mrr;
- 	else
--		sample_rate = mp->lookaround_rate;
-+		sampling_ratio = mp->lookaround_rate;
-+
-+	/* init rateindex [ndx] with max throughput rate */
-+	ndx = mi->max_tp_rate[0];
+--- a/net/wireless/util.c
++++ b/net/wireless/util.c
+@@ -1156,6 +1156,26 @@ int cfg80211_get_p2p_attr(const u8 *ies,
+ }
+ EXPORT_SYMBOL(cfg80211_get_p2p_attr);
  
-+	/* increase sum packet counter */
- 	mi->packet_count++;
--	delta = (mi->packet_count * sample_rate / 100) -
++bool ieee80211_operating_class_to_band(u8 operating_class,
++				       enum ieee80211_band *band)
++{
++	switch (operating_class) {
++	case 112:
++	case 115 ... 127:
++		*band = IEEE80211_BAND_5GHZ;
++		return true;
++	case 81:
++	case 82:
++	case 83:
++	case 84:
++		*band = IEEE80211_BAND_2GHZ;
++		return true;
++	}
 +
-+	delta = (mi->packet_count * sampling_ratio / 100) -
- 			(mi->sample_count + mi->sample_deferred / 2);
++	return false;
++}
++EXPORT_SYMBOL(ieee80211_operating_class_to_band);
++
+ int cfg80211_validate_beacon_int(struct cfg80211_registered_device *rdev,
+ 				 u32 beacon_int)
+ {
+--- a/include/uapi/linux/nl80211.h
++++ b/include/uapi/linux/nl80211.h
+@@ -1973,6 +1973,10 @@ enum nl80211_sta_bss_param {
+  * @NL80211_STA_INFO_PEER_PM: peer mesh STA link-specific power mode
+  * @NL80211_STA_INFO_NONPEER_PM: neighbor mesh STA power save mode towards
+  *	non-peer STA
++ * @NL80211_STA_INFO_CHAIN_SIGNAL: per-chain signal strength of last PPDU
++ *	Contains a nested array of signal strength attributes (u8, dBm)
++ * @NL80211_STA_INFO_CHAIN_SIGNAL_AVG: per-chain signal strength average
++ *	Same format as NL80211_STA_INFO_CHAIN_SIGNAL.
+  * @__NL80211_STA_INFO_AFTER_LAST: internal
+  * @NL80211_STA_INFO_MAX: highest possible station info attribute
+  */
+@@ -2002,6 +2006,8 @@ enum nl80211_sta_info {
+ 	NL80211_STA_INFO_NONPEER_PM,
+ 	NL80211_STA_INFO_RX_BYTES64,
+ 	NL80211_STA_INFO_TX_BYTES64,
++	NL80211_STA_INFO_CHAIN_SIGNAL,
++	NL80211_STA_INFO_CHAIN_SIGNAL_AVG,
+ 
+ 	/* keep last */
+ 	__NL80211_STA_INFO_AFTER_LAST,
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -358,6 +358,8 @@ struct sta_info *sta_info_alloc(struct i
+ 	do_posix_clock_monotonic_gettime(&uptime);
+ 	sta->last_connected = uptime.tv_sec;
+ 	ewma_init(&sta->avg_signal, 1024, 8);
++	for (i = 0; i < ARRAY_SIZE(sta->chain_signal_avg); i++)
++		ewma_init(&sta->chain_signal_avg[i], 1024, 8);
+ 
+ 	if (sta_prepare_rate_control(local, sta, gfp)) {
+ 		kfree(sta);
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -3367,6 +3367,32 @@ static bool nl80211_put_sta_rate(struct 
+ 	return true;
+ }
  
- 	/* delta > 0: sampling required */
--	if ((delta > 0) && (mrr || !mi->prev_sample)) {
-+	if ((delta > 0) && (mrr_capable || !mi->prev_sample)) {
- 		struct minstrel_rate *msr;
- 		if (mi->packet_count >= 10000) {
- 			mi->sample_deferred = 0;
-@@ -271,21 +291,28 @@ minstrel_get_rate(void *priv, struct iee
- 			mi->sample_count += (delta - mi->n_rates * 2);
- 		}
++static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
++			       int id)
++{
++	void *attr;
++	int i = 0;
++
++	if (!mask)
++		return true;
++
++	attr = nla_nest_start(msg, id);
++	if (!attr)
++		return false;
++
++	for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
++		if (!(mask & BIT(i)))
++			continue;
++
++		if (nla_put_u8(msg, i, signal[i]))
++			return false;
++	}
++
++	nla_nest_end(msg, attr);
++
++	return true;
++}
++
+ static int nl80211_send_station(struct sk_buff *msg, u32 portid, u32 seq,
+ 				int flags,
+ 				struct cfg80211_registered_device *rdev,
+@@ -3438,6 +3464,18 @@ static int nl80211_send_station(struct s
+ 	default:
+ 		break;
+ 	}
++	if (sinfo->filled & STATION_INFO_CHAIN_SIGNAL) {
++		if (!nl80211_put_signal(msg, sinfo->chains,
++					sinfo->chain_signal,
++					NL80211_STA_INFO_CHAIN_SIGNAL))
++			goto nla_put_failure;
++	}
++	if (sinfo->filled & STATION_INFO_CHAIN_SIGNAL_AVG) {
++		if (!nl80211_put_signal(msg, sinfo->chains,
++					sinfo->chain_signal_avg,
++					NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
++			goto nla_put_failure;
++	}
+ 	if (sinfo->filled & STATION_INFO_TX_BITRATE) {
+ 		if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
+ 					  NL80211_STA_INFO_TX_BITRATE))
+--- a/drivers/net/wireless/ath/ath9k/init.c
++++ b/drivers/net/wireless/ath/ath9k/init.c
+@@ -768,7 +768,8 @@ void ath9k_set_hw_capab(struct ath_softc
+ 		IEEE80211_HW_SUPPORTS_PS |
+ 		IEEE80211_HW_PS_NULLFUNC_STACK |
+ 		IEEE80211_HW_SPECTRUM_MGMT |
+-		IEEE80211_HW_REPORTS_TX_ACK_STATUS;
++		IEEE80211_HW_REPORTS_TX_ACK_STATUS |
++		IEEE80211_HW_SUPPORTS_RC_TABLE;
+ 
+ 	if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_HT)
+ 		 hw->flags |= IEEE80211_HW_AMPDU_AGGREGATION;
+--- a/drivers/net/wireless/ath/ath9k/xmit.c
++++ b/drivers/net/wireless/ath/ath9k/xmit.c
+@@ -157,6 +157,13 @@ static void ath_send_bar(struct ath_atx_
+ 			   seqno << IEEE80211_SEQ_SEQ_SHIFT);
+ }
  
-+		/* get next random rate sample */
- 		sample_ndx = minstrel_get_next_sample(mi);
- 		msr = &mi->r[sample_ndx];
--		sample = true;
--		sample_slower = mrr && (msr->perfect_tx_time >
--			mi->r[ndx].perfect_tx_time);
-+		rate_sampling = true;
- 
--		if (!sample_slower) {
-+		/* Decide if direct ( 1st mrr stage) or indirect (2nd mrr stage)
-+		 * rate sampling method should be used.
-+		 * Respect such rates that are not sampled for 20 interations.
-+		 */
-+		if (mrr_capable &&
-+		    msr->perfect_tx_time > mi->r[ndx].perfect_tx_time &&
-+		    msr->sample_skipped < 20)
-+				indirect_rate_sampling = true;
-+
-+		if (!indirect_rate_sampling) {
- 			if (msr->sample_limit != 0) {
- 				ndx = sample_ndx;
- 				mi->sample_count++;
- 				if (msr->sample_limit > 0)
- 					msr->sample_limit--;
--			} else {
--				sample = false;
--			}
-+			} else
-+				rate_sampling = false;
++static void ath_set_rates(struct ieee80211_vif *vif, struct ieee80211_sta *sta,
++			  struct ath_buf *bf)
++{
++	ieee80211_get_tx_rates(vif, sta, bf->bf_mpdu, bf->rates,
++			       ARRAY_SIZE(bf->rates));
++}
++
+ static void ath_tx_flush_tid(struct ath_softc *sc, struct ath_atx_tid *tid)
+ {
+ 	struct ath_txq *txq = tid->ac->txq;
+@@ -189,6 +196,7 @@ static void ath_tx_flush_tid(struct ath_
+ 			ath_tx_complete_buf(sc, bf, txq, &bf_head, &ts, 0);
+ 			sendbar = true;
  		} else {
- 			/* Only use IEEE80211_TX_CTL_RATE_CTRL_PROBE to mark
- 			 * packets that have the sampling rate deferred to the
-@@ -297,34 +324,39 @@ minstrel_get_rate(void *priv, struct iee
- 			mi->sample_deferred++;
++			ath_set_rates(tid->an->vif, tid->an->sta, bf);
+ 			ath_tx_send_normal(sc, txq, NULL, skb);
  		}
  	}
--	mi->prev_sample = sample;
-+	mi->prev_sample = rate_sampling;
+@@ -407,7 +415,7 @@ static void ath_tx_complete_aggr(struct 
  
- 	/* If we're not using MRR and the sampling rate already
- 	 * has a probability of >95%, we shouldn't be attempting
- 	 * to use it, as this only wastes precious airtime */
--	if (!mrr && sample && (mi->r[ndx].probability > 17100))
--		ndx = mi->max_tp_rate;
-+	if (!mrr_capable && rate_sampling &&
-+	   (mi->r[ndx].probability > MINSTREL_FRAC(95, 100)))
-+		ndx = mi->max_tp_rate[0];
- 
-+	/* mrr setup for 1st stage */
- 	ar[0].idx = mi->r[ndx].rix;
- 	ar[0].count = minstrel_get_retry_count(&mi->r[ndx], info);
- 
--	if (!mrr) {
--		if (!sample)
-+	/* non mrr setup for 2nd stage */
-+	if (!mrr_capable) {
-+		if (!rate_sampling)
- 			ar[0].count = mp->max_retry;
- 		ar[1].idx = mi->lowest_rix;
- 		ar[1].count = mp->max_retry;
- 		return;
- 	}
+ 	tx_info = IEEE80211_SKB_CB(skb);
  
--	/* MRR setup */
--	if (sample) {
--		if (sample_slower)
-+	/* mrr setup for 2nd stage */
-+	if (rate_sampling) {
-+		if (indirect_rate_sampling)
- 			mrr_ndx[0] = sample_ndx;
- 		else
--			mrr_ndx[0] = mi->max_tp_rate;
-+			mrr_ndx[0] = mi->max_tp_rate[0];
- 	} else {
--		mrr_ndx[0] = mi->max_tp_rate2;
-+		mrr_ndx[0] = mi->max_tp_rate[1];
- 	}
-+
-+	/* mrr setup for 3rd & 4th stage */
- 	mrr_ndx[1] = mi->max_prob_rate;
- 	mrr_ndx[2] = 0;
- 	for (i = 1; i < 4; i++) {
-@@ -351,26 +383,21 @@ static void
- init_sample_table(struct minstrel_sta_info *mi)
+-	memcpy(rates, tx_info->control.rates, sizeof(rates));
++	memcpy(rates, bf->rates, sizeof(rates));
+ 
+ 	retries = ts->ts_longretry + 1;
+ 	for (i = 0; i < ts->ts_rateindex; i++)
+@@ -736,8 +744,6 @@ static int ath_compute_num_delims(struct
+ 				  bool first_subfrm)
  {
- 	unsigned int i, col, new_idx;
--	unsigned int n_srates = mi->n_rates - 1;
- 	u8 rnd[8];
- 
- 	mi->sample_column = 0;
--	mi->sample_idx = 0;
--	memset(mi->sample_table, 0, SAMPLE_COLUMNS * mi->n_rates);
-+	mi->sample_row = 0;
-+	memset(mi->sample_table, 0xff, SAMPLE_COLUMNS * mi->n_rates);
- 
- 	for (col = 0; col < SAMPLE_COLUMNS; col++) {
--		for (i = 0; i < n_srates; i++) {
-+		for (i = 0; i < mi->n_rates; i++) {
- 			get_random_bytes(rnd, sizeof(rnd));
--			new_idx = (i + rnd[i & 7]) % n_srates;
-+			new_idx = (i + rnd[i & 7]) % mi->n_rates;
- 
--			while (SAMPLE_TBL(mi, new_idx, col) != 0)
--				new_idx = (new_idx + 1) % n_srates;
-+			while (SAMPLE_TBL(mi, new_idx, col) != 0xff)
-+				new_idx = (new_idx + 1) % mi->n_rates;
- 
--			/* Don't sample the slowest rate (i.e. slowest base
--			 * rate). We must presume that the slowest rate works
--			 * fine, or else other management frames will also be
--			 * failing and the link will break */
--			SAMPLE_TBL(mi, new_idx, col) = i + 1;
-+			SAMPLE_TBL(mi, new_idx, col) = i;
+ #define FIRST_DESC_NDELIMS 60
+-	struct sk_buff *skb = bf->bf_mpdu;
+-	struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
+ 	u32 nsymbits, nsymbols;
+ 	u16 minlen;
+ 	u8 flags, rix;
+@@ -778,8 +784,8 @@ static int ath_compute_num_delims(struct
+ 	if (tid->an->mpdudensity == 0)
+ 		return ndelim;
+ 
+-	rix = tx_info->control.rates[0].idx;
+-	flags = tx_info->control.rates[0].flags;
++	rix = bf->rates[0].idx;
++	flags = bf->rates[0].flags;
+ 	width = (flags & IEEE80211_TX_RC_40_MHZ_WIDTH) ? 1 : 0;
+ 	half_gi = (flags & IEEE80211_TX_RC_SHORT_GI) ? 1 : 0;
+ 
+@@ -858,6 +864,7 @@ static enum ATH_AGGR_STATUS ath_tx_form_
+ 			bf_first = bf;
+ 
+ 		if (!rl) {
++			ath_set_rates(tid->an->vif, tid->an->sta, bf);
+ 			aggr_limit = ath_lookup_rate(sc, bf, tid);
+ 			rl = 1;
  		}
+@@ -998,14 +1005,14 @@ static void ath_buf_set_rate(struct ath_
+ 
+ 	skb = bf->bf_mpdu;
+ 	tx_info = IEEE80211_SKB_CB(skb);
+-	rates = tx_info->control.rates;
++	rates = bf->rates;
+ 	hdr = (struct ieee80211_hdr *)skb->data;
+ 
+ 	/* set dur_update_en for l-sig computation except for PS-Poll frames */
+ 	info->dur_update = !ieee80211_is_pspoll(hdr->frame_control);
+ 	info->rtscts_rate = fi->rtscts_rate;
+ 
+-	for (i = 0; i < 4; i++) {
++	for (i = 0; i < ARRAY_SIZE(bf->rates); i++) {
+ 		bool is_40, is_sgi, is_sp;
+ 		int phy;
+ 
+@@ -1743,6 +1750,7 @@ static void ath_tx_send_ampdu(struct ath
+ 		return;
  	}
+ 
++	ath_set_rates(tid->an->vif, tid->an->sta, bf);
+ 	bf->bf_state.bf_type = BUF_AMPDU;
+ 	INIT_LIST_HEAD(&bf_head);
+ 	list_add(&bf->list, &bf_head);
+@@ -1892,49 +1900,6 @@ static struct ath_buf *ath_tx_setup_buff
+ 	return bf;
  }
-@@ -542,9 +569,6 @@ minstrel_alloc(struct ieee80211_hw *hw, 
- 	mp->lookaround_rate = 5;
- 	mp->lookaround_rate_mrr = 10;
  
--	/* moving average weight for EWMA */
--	mp->ewma_level = 75;
+-/* FIXME: tx power */
+-static void ath_tx_start_dma(struct ath_softc *sc, struct sk_buff *skb,
+-			     struct ath_tx_control *txctl)
+-{
+-	struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
+-	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+-	struct ath_atx_tid *tid = NULL;
+-	struct ath_buf *bf;
+-	u8 tidno;
 -
- 	/* maximum time that the hw is allowed to stay in one MRR segment */
- 	mp->segment_size = 6000;
- 
---- a/net/mac80211/rc80211_minstrel.h
-+++ b/net/mac80211/rc80211_minstrel.h
-@@ -9,6 +9,28 @@
- #ifndef __RC_MINSTREL_H
- #define __RC_MINSTREL_H
+-	if (txctl->an && ieee80211_is_data_qos(hdr->frame_control)) {
+-		tidno = ieee80211_get_qos_ctl(hdr)[0] &
+-			IEEE80211_QOS_CTL_TID_MASK;
+-		tid = ATH_AN_2_TID(txctl->an, tidno);
+-
+-		WARN_ON(tid->ac->txq != txctl->txq);
+-	}
+-
+-	if ((tx_info->flags & IEEE80211_TX_CTL_AMPDU) && tid) {
+-		/*
+-		 * Try aggregation if it's a unicast data frame
+-		 * and the destination is HT capable.
+-		 */
+-		ath_tx_send_ampdu(sc, tid, skb, txctl);
+-	} else {
+-		bf = ath_tx_setup_buffer(sc, txctl->txq, tid, skb);
+-		if (!bf) {
+-			if (txctl->paprd)
+-				dev_kfree_skb_any(skb);
+-			else
+-				ieee80211_free_txskb(sc->hw, skb);
+-			return;
+-		}
+-
+-		bf->bf_state.bfs_paprd = txctl->paprd;
+-
+-		if (txctl->paprd)
+-			bf->bf_state.bfs_paprd_timestamp = jiffies;
+-
+-		ath_tx_send_normal(sc, txctl->txq, tid, skb);
+-	}
+-}
+-
+ /* Upon failure caller should free skb */
+ int ath_tx_start(struct ieee80211_hw *hw, struct sk_buff *skb,
+ 		 struct ath_tx_control *txctl)
+@@ -1945,8 +1910,11 @@ int ath_tx_start(struct ieee80211_hw *hw
+ 	struct ieee80211_vif *vif = info->control.vif;
+ 	struct ath_softc *sc = hw->priv;
+ 	struct ath_txq *txq = txctl->txq;
++	struct ath_atx_tid *tid = NULL;
++	struct ath_buf *bf;
+ 	int padpos, padsize;
+ 	int frmlen = skb->len + FCS_LEN;
++	u8 tidno;
+ 	int q;
+ 
+ 	/* NOTE:  sta can be NULL according to net/mac80211.h */
+@@ -2002,8 +1970,41 @@ int ath_tx_start(struct ieee80211_hw *hw
+ 		txq->stopped = true;
+ 	}
  
-+#define EWMA_LEVEL	75	/* ewma weighting factor [%] */
-+#define SAMPLE_COLUMNS	10	/* number of columns in sample table */
+-	ath_tx_start_dma(sc, skb, txctl);
++	if (txctl->an && ieee80211_is_data_qos(hdr->frame_control)) {
++		tidno = ieee80211_get_qos_ctl(hdr)[0] &
++			IEEE80211_QOS_CTL_TID_MASK;
++		tid = ATH_AN_2_TID(txctl->an, tidno);
 +
++		WARN_ON(tid->ac->txq != txctl->txq);
++	}
 +
-+/* scaled fraction values */
-+#define MINSTREL_SCALE  16
-+#define MINSTREL_FRAC(val, div) (((val) << MINSTREL_SCALE) / div)
-+#define MINSTREL_TRUNC(val) ((val) >> MINSTREL_SCALE)
++	if ((info->flags & IEEE80211_TX_CTL_AMPDU) && tid) {
++		/*
++		 * Try aggregation if it's a unicast data frame
++		 * and the destination is HT capable.
++		 */
++		ath_tx_send_ampdu(sc, tid, skb, txctl);
++		goto out;
++	}
 +
-+/* number of highest throughput rates to consider*/
-+#define MAX_THR_RATES 4
++	bf = ath_tx_setup_buffer(sc, txctl->txq, tid, skb);
++	if (!bf) {
++		if (txctl->paprd)
++			dev_kfree_skb_any(skb);
++		else
++			ieee80211_free_txskb(sc->hw, skb);
++		goto out;
++	}
 +
-+/*
-+ * Perform EWMA (Exponentially Weighted Moving Average) calculation
-+  */
-+static inline int
-+minstrel_ewma(int old, int new, int weight)
-+{
-+	return (new * (100 - weight) + old * weight) / 100;
-+}
++	bf->bf_state.bfs_paprd = txctl->paprd;
 +
++	if (txctl->paprd)
++		bf->bf_state.bfs_paprd_timestamp = jiffies;
 +
- struct minstrel_rate {
- 	int bitrate;
- 	int rix;
-@@ -26,6 +48,7 @@ struct minstrel_rate {
- 	u32 attempts;
- 	u32 last_attempts;
- 	u32 last_success;
-+	u8 sample_skipped;
- 
- 	/* parts per thousand */
- 	u32 cur_prob;
-@@ -45,14 +68,13 @@ struct minstrel_sta_info {
- 
- 	unsigned int lowest_rix;
- 
--	unsigned int max_tp_rate;
--	unsigned int max_tp_rate2;
--	unsigned int max_prob_rate;
-+	u8 max_tp_rate[MAX_THR_RATES];
-+	u8 max_prob_rate;
- 	unsigned int packet_count;
- 	unsigned int sample_count;
- 	int sample_deferred;
- 
--	unsigned int sample_idx;
-+	unsigned int sample_row;
- 	unsigned int sample_column;
- 
- 	int n_rates;
-@@ -73,7 +95,6 @@ struct minstrel_priv {
- 	unsigned int cw_min;
- 	unsigned int cw_max;
- 	unsigned int max_retry;
--	unsigned int ewma_level;
- 	unsigned int segment_size;
- 	unsigned int update_interval;
- 	unsigned int lookaround_rate;
---- a/net/mac80211/rc80211_minstrel_debugfs.c
-+++ b/net/mac80211/rc80211_minstrel_debugfs.c
-@@ -73,15 +73,17 @@ minstrel_stats_open(struct inode *inode,
- 	for (i = 0; i < mi->n_rates; i++) {
- 		struct minstrel_rate *mr = &mi->r[i];
++	ath_set_rates(vif, sta, bf);
++	ath_tx_send_normal(sc, txctl->txq, tid, skb);
  
--		*(p++) = (i == mi->max_tp_rate) ? 'T' : ' ';
--		*(p++) = (i == mi->max_tp_rate2) ? 't' : ' ';
-+		*(p++) = (i == mi->max_tp_rate[0]) ? 'A' : ' ';
-+		*(p++) = (i == mi->max_tp_rate[1]) ? 'B' : ' ';
-+		*(p++) = (i == mi->max_tp_rate[2]) ? 'C' : ' ';
-+		*(p++) = (i == mi->max_tp_rate[3]) ? 'D' : ' ';
- 		*(p++) = (i == mi->max_prob_rate) ? 'P' : ' ';
- 		p += sprintf(p, "%3u%s", mr->bitrate / 2,
- 				(mr->bitrate & 1 ? ".5" : "  "));
- 
--		tp = mr->cur_tp / ((18000 << 10) / 96);
--		prob = mr->cur_prob / 18;
--		eprob = mr->probability / 18;
-+		tp = MINSTREL_TRUNC(mr->cur_tp / 10);
-+		prob = MINSTREL_TRUNC(mr->cur_prob * 1000);
-+		eprob = MINSTREL_TRUNC(mr->probability * 1000);
++out:
+ 	ath_txq_unlock(sc, txq);
  
- 		p += sprintf(p, "  %6u.%1u   %6u.%1u   %6u.%1u        "
- 				"%3u(%3u)   %8llu    %8llu\n",
---- a/drivers/net/wireless/ath/ath9k/ath9k.h
-+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
-@@ -657,11 +657,10 @@ enum sc_op_flags {
- struct ath_rate_table;
+ 	return 0;
+--- a/drivers/net/wireless/ath/ath9k/recv.c
++++ b/drivers/net/wireless/ath/ath9k/recv.c
+@@ -124,7 +124,7 @@ static bool ath_rx_edma_buf_link(struct 
  
- struct ath9k_vif_iter_data {
--	const u8 *hw_macaddr; /* phy's hardware address, set
--			       * before starting iteration for
--			       * valid bssid mask.
--			       */
-+	u8 hw_macaddr[ETH_ALEN]; /* address of the first vif */
- 	u8 mask[ETH_ALEN]; /* bssid mask */
-+	bool has_hw_macaddr;
-+
- 	int naps;      /* number of AP vifs */
- 	int nmeshes;   /* number of mesh vifs */
- 	int nstations; /* number of station vifs */
---- a/drivers/net/wireless/ath/ath9k/main.c
-+++ b/drivers/net/wireless/ath/ath9k/main.c
-@@ -835,10 +835,14 @@ static void ath9k_vif_iter(void *data, u
- 	struct ath9k_vif_iter_data *iter_data = data;
- 	int i;
- 
--	if (iter_data->hw_macaddr)
-+	if (iter_data->has_hw_macaddr) {
- 		for (i = 0; i < ETH_ALEN; i++)
- 			iter_data->mask[i] &=
- 				~(iter_data->hw_macaddr[i] ^ mac[i]);
-+	} else {
-+		memcpy(iter_data->hw_macaddr, mac, ETH_ALEN);
-+		iter_data->has_hw_macaddr = true;
-+	}
+ 	SKB_CB_ATHBUF(skb) = bf;
+ 	ath9k_hw_addrxbuf_edma(ah, bf->bf_buf_addr, qtype);
+-	skb_queue_tail(&rx_edma->rx_fifo, skb);
++	__skb_queue_tail(&rx_edma->rx_fifo, skb);
  
- 	switch (vif->type) {
- 	case NL80211_IFTYPE_AP:
-@@ -887,7 +891,6 @@ void ath9k_calculate_iter_data(struct ie
- 	 * together with the BSSID mask when matching addresses.
- 	 */
- 	memset(iter_data, 0, sizeof(*iter_data));
--	iter_data->hw_macaddr = common->macaddr;
- 	memset(&iter_data->mask, 0xff, ETH_ALEN);
- 
- 	if (vif)
-@@ -897,6 +900,8 @@ void ath9k_calculate_iter_data(struct ie
- 	ieee80211_iterate_active_interfaces_atomic(
- 		sc->hw, IEEE80211_IFACE_ITER_RESUME_ALL,
- 		ath9k_vif_iter, iter_data);
-+
-+	memcpy(common->macaddr, iter_data->hw_macaddr, ETH_ALEN);
+ 	return true;
  }
+@@ -155,7 +155,7 @@ static void ath_rx_remove_buffer(struct 
  
- /* Called with sc->mutex held. */
---- a/drivers/net/wireless/ath/ath9k/reg.h
-+++ b/drivers/net/wireless/ath/ath9k/reg.h
-@@ -1493,9 +1493,6 @@ enum {
- #define AR9271_RADIO_RF_RST			0x20
- #define AR9271_GATE_MAC_CTL			0x4000
+ 	rx_edma = &sc->rx.rx_edma[qtype];
  
--#define AR_STA_ID0                 0x8000
--#define AR_STA_ID1                 0x8004
--#define AR_STA_ID1_SADH_MASK       0x0000FFFF
- #define AR_STA_ID1_STA_AP          0x00010000
- #define AR_STA_ID1_ADHOC           0x00020000
- #define AR_STA_ID1_PWR_SAV         0x00040000
---- a/drivers/net/wireless/ath/hw.c
-+++ b/drivers/net/wireless/ath/hw.c
-@@ -118,6 +118,12 @@
- void ath_hw_setbssidmask(struct ath_common *common)
- {
- 	void *ah = common->ah;
-+	u32 id1;
-+
-+	REG_WRITE(ah, AR_STA_ID0, get_unaligned_le32(common->macaddr));
-+	id1 = REG_READ(ah, AR_STA_ID1) & ~AR_STA_ID1_SADH_MASK;
-+	id1 |= get_unaligned_le16(common->macaddr + 4);
-+	REG_WRITE(ah, AR_STA_ID1, id1);
+-	while ((skb = skb_dequeue(&rx_edma->rx_fifo)) != NULL) {
++	while ((skb = __skb_dequeue(&rx_edma->rx_fifo)) != NULL) {
+ 		bf = SKB_CB_ATHBUF(skb);
+ 		BUG_ON(!bf);
+ 		list_add_tail(&bf->list, &sc->rx.rxbuf);
+@@ -1287,13 +1287,13 @@ int ath_rx_tasklet(struct ath_softc *sc,
+ 			goto requeue_drop_frag;
+ 		}
  
- 	REG_WRITE(ah, AR_BSSMSKL, get_unaligned_le32(common->bssidmask));
- 	REG_WRITE(ah, AR_BSSMSKU, get_unaligned_le16(common->bssidmask + 4));
---- a/drivers/net/wireless/ath/reg.h
-+++ b/drivers/net/wireless/ath/reg.h
-@@ -23,6 +23,10 @@
- #define AR_MIBC_CMC		0x00000004
- #define AR_MIBC_MCS		0x00000008
+-		bf->bf_mpdu = requeue_skb;
+-		bf->bf_buf_addr = new_buf_addr;
+-
+ 		/* Unmap the frame */
+ 		dma_unmap_single(sc->dev, bf->bf_buf_addr,
+ 				 common->rx_bufsize, dma_type);
  
-+#define AR_STA_ID0		0x8000
-+#define AR_STA_ID1		0x8004
-+#define AR_STA_ID1_SADH_MASK	0x0000ffff
++		bf->bf_mpdu = requeue_skb;
++		bf->bf_buf_addr = new_buf_addr;
 +
- /*
-  * BSSID mask registers. See ath_hw_set_bssid_mask()
-  * for detailed documentation about these registers.
+ 		skb_put(skb, rs.rs_datalen + ah->caps.rx_status_len);
+ 		if (ah->caps.rx_status_len)
+ 			skb_pull(skb, ah->caps.rx_status_len);