diff options
| author | Felix Fietkau <nbd@openwrt.org> | 2014-05-20 09:35:17 +0000 |
|---|---|---|
| committer | Felix Fietkau <nbd@openwrt.org> | 2014-05-20 09:35:17 +0000 |
| commit | 8513629e3ed39ac7d6d3ca90f1ad745db5c449d6 (patch) | |
| tree | f38e2aa76f8ac55bf6eb361446250acce57956c5 /package/kernel/mac80211/patches/300-pending_work.patch | |
| parent | 8f526ff53067d029f42e0b887d770b28546fc0e9 (diff) | |
| download | upstream-8513629e3ed39ac7d6d3ca90f1ad745db5c449d6.tar.gz upstream-8513629e3ed39ac7d6d3ca90f1ad745db5c449d6.tar.bz2 upstream-8513629e3ed39ac7d6d3ca90f1ad745db5c449d6.zip | |
mac80211: update to wireless-testing 2014-05-19
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
SVN-Revision: 40800
Diffstat (limited to 'package/kernel/mac80211/patches/300-pending_work.patch')
| -rw-r--r-- | package/kernel/mac80211/patches/300-pending_work.patch | 4809 |
1 files changed, 4260 insertions, 549 deletions
diff --git a/package/kernel/mac80211/patches/300-pending_work.patch b/package/kernel/mac80211/patches/300-pending_work.patch index ef81721529..702b17b333 100644 --- a/package/kernel/mac80211/patches/300-pending_work.patch +++ b/package/kernel/mac80211/patches/300-pending_work.patch @@ -8,7 +8,7 @@ Date: Mon May 19 21:48:56 2014 +0200 Signed-off-by: Felix Fietkau <nbd@openwrt.org> -commit 27647baeaee1b12bc3c57ccf1c7eba53bcd7fe53 +commit ff9655bebd25d35ab13c2515a029723b69949720 Author: Felix Fietkau <nbd@openwrt.org> Date: Mon May 19 21:20:49 2014 +0200 @@ -21,675 +21,4316 @@ Date: Mon May 19 21:20:49 2014 +0200 Signed-off-by: Felix Fietkau <nbd@openwrt.org> -commit 92e9dd662542683856e62a5e7e43fcf5b9da5c4a -Author: Henning Rogge <hrogge@gmail.com> -Date: Thu May 1 10:03:46 2014 +0200 +commit 46c5d7d207a2a0725066c0928fd19b8c578b7d4f +Author: Oleksij Rempel <linux@rempel-privat.de> +Date: Tue May 20 00:02:03 2014 +0200 - mac80211: Fix mac80211 station info rx bitrate for IBSS mode + ath9k_htc: fix build with disabled debug - Filter out incoming multicast packages before applying their bitrate - to the rx bitrate station info field to prevent them from setting the - rx bitrate to the basic multicast rate. + CC [M] drivers/net/wireless/ath/ath9k/htc_drv_txrx.o + drivers/net/wireless/ath/ath9k/htc_drv_txrx.c: In function ‘ath9k_rx_prepare’: + drivers/net/wireless/ath/ath9k/htc_drv_txrx.c:1006:2: warning: passing argument 2 of ‘ath9k_htc_err_stat_rx’ from incompatible pointer type [enabled by default] + ath9k_htc_err_stat_rx(priv, &rx_stats); + ^ + In file included from drivers/net/wireless/ath/ath9k/htc_drv_txrx.c:17:0: + drivers/net/wireless/ath/ath9k/htc.h:380:20: note: expected ‘struct ath_htc_rx_status *’ but argument is of type ‘struct ath_rx_status *’ + static inline void ath9k_htc_err_stat_rx(struct ath9k_htc_priv *priv, - Signed-off-by: Henning Rogge <hrogge@gmail.com> + Signed-off-by: Oleksij Rempel <linux@rempel-privat.de> -commit 4c8a3486cb577d40c1ef75f0a8dc9a04773eef83 -Author: Nickolay Ledovskikh <nledovskikh@gmail.com> -Date: Fri Apr 25 22:53:34 2014 +0400 +commit 2d331334e9dc5659fdf9a89326c34c3db5a15279 +Author: Johannes Berg <johannes.berg@intel.com> +Date: Mon May 19 17:59:50 2014 +0200 - ath5k: Fix AR5K_PHY_TXPOWER_RATE_MAX register value setting. + cfg80211: constify wowlan/coalesce mask/pattern pointers - I was reading ath5k power setting code and - noticed typing error in ath5k_hw_txpower function. - Invalid value was written to AR5K_PHY_TXPOWER_RATE_MAX - register. + This requires changing the nl80211 parsing code a bit to use + intermediate pointers for the allocation, but clarifies the + API towards the drivers. - Signed-off-by: Nikolay Ledovskikh <nledovskikh@gmail.com> - Acked-by: Nick Kossifidis <mickflemm@gmail.com> - Signed-off-by: John W. Linville <linville@tuxdriver.com> + Signed-off-by: Johannes Berg <johannes.berg@intel.com> -commit 4d76248013dbb1948429555208900a585b0f351d -Author: Janusz Dziedzic <janusz.dziedzic@tieto.com> -Date: Tue Apr 8 13:38:43 2014 +0200 +commit 6788105c46babaa6938cbacb72fdf20bec4bb2e3 +Author: Johannes Berg <johannes.berg@intel.com> +Date: Mon May 19 17:53:16 2014 +0200 - ath9k: Enable DFS only when ATH9K_DFS_CERTIFIED + cfg80211: constify more pointers in the cfg80211 API - Add DFS interface combination only when - CONFIG_ATH9K_DFS_CERTIFIED is set. In other case - user can run CAC/beaconing without proper handling - of pulse events (without radar detection activated). + This also propagates through the drivers. - Reported-by: Cedric Voncken <cedric.voncken@acksys.fr> - Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com> - Signed-off-by: John W. Linville <linville@tuxdriver.com> + The orinoco driver uses the cfg80211 API structs for internal + bookkeeping, and so needs a (void *) cast that removes the + const - but that's OK because it allocates those pointers. + + Signed-off-by: Johannes Berg <johannes.berg@intel.com> -commit c83a4e5156a4b4dd22137d33a5625440982d6d37 -Author: Rajkumar Manoharan <rmanohar@qti.qualcomm.com> -Date: Mon Apr 28 21:17:08 2014 +0530 +commit c3d95010fd881da0fa0a4e88532412f5d0c092f6 +Author: Johannes Berg <johannes.berg@intel.com> +Date: Mon May 19 17:19:31 2014 +0200 - ath9k_hw: fix worse EVM for 11b rates + cfg80211: constify MAC addresses in cfg80211 ops - Adjust FIR filter co-efficients to improve EVM for 11b rates. + This propagates through all the drivers and mac80211. - Signed-off-by: Rajkumar Manoharan <rmanohar@qti.qualcomm.com> - Signed-off-by: John W. Linville <linville@tuxdriver.com> + Signed-off-by: Johannes Berg <johannes.berg@intel.com> -commit 8aab2c7a2f4a957e344db429dfb1190ae59ce8b5 -Author: Rajkumar Manoharan <rmanohar@qti.qualcomm.com> -Date: Mon Apr 28 21:17:07 2014 +0530 +commit ddf1e6f0f0354c601af7d42e5ace4b51f8b0bffc +Author: Luciano Coelho <luciano.coelho@intel.com> +Date: Thu May 15 20:32:08 2014 +0300 - ath9k_hw: update ar9300 initvals + mac80211: fix csa_counter_offs argument name in docbook + + The csa_counter_offs was erroneously described as csa_offs in + the docbook section. - * rfsat gainchange hysteresis of rf_gain stuck with large - interference present. + This fixes two warnings when making htmldocs (at least): - Signed-off-by: Rajkumar Manoharan <rmanohar@qti.qualcomm.com> - Signed-off-by: John W. Linville <linville@tuxdriver.com> + Warning(include/net/mac80211.h:3428): No description found for parameter 'csa_counter_offs[IEEE80211_MAX_CSA_COUNTERS_NUM]' + Warning(include/net/mac80211.h:3428): Excess struct/union/enum/typedef member 'csa_offs' description in 'ieee80211_mutable_offsets' + + Signed-off-by: Luciano Coelho <luciano.coelho@intel.com> + Signed-off-by: Johannes Berg <johannes.berg@intel.com> -commit 8c7ae357cc5b6bd037ad2d666e9f3789cf882925 -Author: Rajkumar Manoharan <rmanohar@qti.qualcomm.com> -Date: Wed Apr 23 15:07:57 2014 +0530 +commit 202322d1c04b8e498bd5bb78606fcf3941512b35 +Author: Luciano Coelho <luciano.coelho@intel.com> +Date: Thu May 15 20:18:09 2014 +0300 - ath9k: fix race in setting ATH_OP_INVALID + cfg80211: add documentation for max_num_csa_counters + + Move the comment in the structure to a description of the + max_num_csa_counters field in the docbook area. - The commit "ath9k: move sc_flags to ath_common" moved setting - ATH_OP_INVALID flag below ieee80211_register_hw. This is causing - the flag never being cleared randomly as the drv_start is called - prior to setting flag. Fix this by setting the flag prior to - register_hw. + This fixes a warning when building htmldocs (at least): - Signed-off-by: Rajkumar Manoharan <rmanohar@qti.qualcomm.com> - Signed-off-by: John W. Linville <linville@tuxdriver.com> + Warning(include/net/cfg80211.h:3064): No description found for parameter 'max_num_csa_counters' + + Signed-off-by: Luciano Coelho <luciano.coelho@intel.com> + Signed-off-by: Johannes Berg <johannes.berg@intel.com> -commit c82552c5b0cb1735dbcbad78b1ffc6d3c212dc56 -Author: Tim Harvey <tharvey@gateworks.com> -Date: Mon Apr 21 16:14:57 2014 -0700 +commit 457a33192f64b7637e8fd0ae0e9f32701c908603 +Author: Johannes Berg <johannes.berg@intel.com> +Date: Mon May 19 11:24:19 2014 +0200 - ath9k: add a recv budget + mac80211: minstrel-ht: small clarifications - Implement a recv budget so that in cases of high traffic we still allow other - taskets to get processed. + Antonio and I were looking over this code and some things + didn't immediately make sense, so we came up with two small + clarifications. - Without this, we can encounter a host of issues during high wireless traffic - reception depending on system load including rcu stall's detected (ARM), - soft lockups, failure to service critical tasks such as watchdog resets, - and triggering of the tx stuck tasklet. + Signed-off-by: Johannes Berg <johannes.berg@intel.com> + +commit 1e35dce952a64a957de97ae1f2bb19301756b936 +Author: Andrei Otcheretianski <andrei.otcheretianski@intel.com> +Date: Fri May 9 14:11:50 2014 +0300 + + mac80211: Handle the CSA counters correctly + + Make the beacon CSA counters part of ieee80211_mutable_offsets and don't + decrement CSA counters when generating a beacon template. This permits the + driver to offload the CSA counters handling. Since mac80211 updates the probe + responses with the correct counter, the driver should sync the counter's value + with mac80211 using ieee80211_csa_update_counter function. - The same thing was proposed previously by Ben: - http://www.spinics.net/lists/linux-wireless/msg112891.html + Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com> + Signed-off-by: Luciano Coelho <luciano.coelho@intel.com> + Signed-off-by: Johannes Berg <johannes.berg@intel.com> + +commit e7b5c449815d28a2105fde5b42e112f78cc711ac +Author: Andrei Otcheretianski <andrei.otcheretianski@intel.com> +Date: Fri May 9 14:11:49 2014 +0300 + + mac80211: Provide ieee80211_beacon_get_template API - The only difference here is that I make sure only processed packets are counted - in the budget by checking at the end of the rx loop. + Add a new API ieee80211_beacon_get_template, which doesn't + affect DTIM counter and should be used if the device generates beacon + frames, and new beacon template is needed. In addition set the offsets + to TIM IE for MESH interface. - Signed-off-by: Tim Harvey <tharvey@gateworks.com> - Acked-by: Felix Fietkau <nbd@openwrt.org> - Signed-off-by: John W. Linville <linville@tuxdriver.com> + Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com> + Signed-off-by: Luciano Coelho <luciano.coelho@intel.com> + Signed-off-by: Johannes Berg <johannes.berg@intel.com> -commit 3a758134e66ca74a9df792616b5288b2fa2cfd7f -Author: Tim Harvey <tharvey@gateworks.com> -Date: Mon Apr 21 16:14:56 2014 -0700 +commit e54eda80273ce8aded058c3c9365dca2342e2e75 +Author: Andrei Otcheretianski <andrei.otcheretianski@intel.com> +Date: Fri May 9 14:11:47 2014 +0300 - ath9k: fix possible hang on flush + mac80211: Support multiple CSA counters - If a flush is requested, make sure to clear the descriptor once we've - processed it. + Support up to IEEE80211_MAX_CSA_COUNTERS_NUM csa counters. + This is defined to be 2 now, to support both CSA and eCSA + counters. + + Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com> + Signed-off-by: Luciano Coelho <luciano.coelho@intel.com> + Signed-off-by: Johannes Berg <johannes.berg@intel.com> + +commit 678e87c3b929dd60d59470e8981eb551cee10319 +Author: Andrei Otcheretianski <andrei.otcheretianski@intel.com> +Date: Fri May 9 14:11:46 2014 +0300 + + cfg80211: Support multiple CSA counters - This resolves a hang that will occur if all RX descriptors are full when a - flush is requested. + Change the type of NL80211_ATTR_CSA_C_OFF_BEACON and + NL80211_ATTR_CSA_C_OFF_PRESP to be NLA_BINARY which allows + userspace to use beacons and probe responses with + multiple CSA counters. + This isn't breaking the API since userspace can + continue to use nla_put_u16 for this attributes, which + is equivalent to a single element u16 array. + In addition advertise max number of supported CSA counters. + This is needed when using CSA and eCSA IEs together. - Signed-off-by: Tim Harvey <tharvey@gateworks.com> - Acked-by: Felix Fietkau <nbd@openwrt.org> - Signed-off-by: John W. Linville <linville@tuxdriver.com> + Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com> + Signed-off-by: Luciano Coelho <luciano.coelho@intel.com> + Signed-off-by: Johannes Berg <johannes.berg@intel.com> -commit eefb1d6adc4c60d219182b8917e4567484ce07fc -Author: Felix Fietkau <nbd@openwrt.org> -Date: Mon Apr 28 18:27:41 2014 +0200 +commit 93f4867a966cc8645659031bbd44a9bb4b78485f +Author: Andrei Otcheretianski <andrei.otcheretianski@intel.com> +Date: Fri May 9 14:11:45 2014 +0300 - ath9k: remove tid->paused flag + mac80211: Update CSA counters in mgmt frames - There are some corner cases where the driver could get stuck with a full - tid queue that is paused, leading to a software tx queue hang. + Track current csa counter value and use it + to update mgmt frames at the provided offsets. - Since the tx queueing rework, pausing per-tid queues on aggregation - session setup is no longer necessary. The driver will assign sequence - numbers to buffered frames when a new session is established, in order - to get the correct starting sequence number. + Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com> + Signed-off-by: Luciano Coelho <luciano.coelho@intel.com> + Signed-off-by: Johannes Berg <johannes.berg@intel.com> + +commit 6c8461fcc03ff4d250027e47f53315b5e0ec43aa +Author: Andrei Otcheretianski <andrei.otcheretianski@intel.com> +Date: Fri May 9 14:11:44 2014 +0300 + + cfg80211: Add API to update CSA counters in mgmt frames - mac80211 prevents new frames from entering the queue during setup. + Add NL80211_ATTR_CSA_C_OFFSETS_TX which holds an array + of offsets to the CSA counters which should be updated + when sending a management frames with NL80211_CMD_FRAME. - Signed-off-by: Felix Fietkau <nbd@openwrt.org> + This API should be used by the drivers that wish to keep the + CSA counter updated in probe responses, but do not implement + probe response offloading and so, do not use + ieee80211_proberesp_get function. + + Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com> + Signed-off-by: Luciano Coelho <luciano.coelho@intel.com> + Signed-off-by: Johannes Berg <johannes.berg@intel.com> -commit 98a713933d8495f4078f561c1e651b738dd5b531 -Author: Felix Fietkau <nbd@openwrt.org> -Date: Sun Apr 27 14:49:03 2014 +0200 +commit 7d09fc9f1903b3d5e7d046bdf10467f37a97c4f9 +Author: Luciano Coelho <luciano.coelho@intel.com> +Date: Thu May 15 13:05:39 2014 +0300 - ath9k_hw: do not lower ANI setting below default on AR913x + cfg80211: pass the actual iftype when calling cfg80211_chandef_dfs_required() - When the amount of noise fluctuates strongly, low immunity settings - can sometimes disrupt signal detection on AR913x chips. When that - happens, no OFDM/CCK errors are reported anymore, and ANI tunes the - radio to the lowest immunity settings. - Usually rx/tx fails as well in that case. + There is no need to pass NL80211_IFTYPE_UNSPECIFIED when calling + cfg80211_chandef_dfs_required() since we always already have the + interface type. So, pass the actual interface type instead. - To fix this, keep noise immunity settings at or above ANI default level, - which will keep radio parameters at or above INI values. + Additionally, have cfg80211_chandef_dfs_required() WARN if the passed + interface type is NL80211_IFTYPE_UNSPECIFIED, so we can detect + problems more easily. - Signed-off-by: Felix Fietkau <nbd@openwrt.org> + Tested-by: Janusz Dziedzic <janusz.dziedzic@tieto.com> + Reported-by: Eliad Peller <eliad@wizery.com> + Signed-off-by: Luciano Coelho <luciano.coelho@intel.com> + Signed-off-by: Johannes Berg <johannes.berg@intel.com> -commit 7cbb4c021bfd1e656f5b9953a947ab3c64e4e3b0 -Author: Felix Fietkau <nbd@openwrt.org> -Date: Thu Apr 10 10:49:01 2014 +0200 +commit 2b7443b15f26ecb98281474666383cf2a882fbad +Author: Janusz Dziedzic <janusz.dziedzic@tieto.com> +Date: Wed May 14 13:25:04 2014 +0200 - mac80211: exclude AP_VLAN interfaces from tx power calculation + cfg80211: fix start_radar_detection issue - Their power value is initialized to zero. This patch fixes an issue - where the configured power drops to the minimum value when AP_VLAN - interfaces are created/removed. + After patch: + cfg80211/mac80211: refactor cfg80211_chandef_dfs_required() - Cc: stable@vger.kernel.org - Signed-off-by: Felix Fietkau <nbd@openwrt.org> + start_radar_detection always fail with -EINVAL. + + Acked-by: Luciano Coelho <luciano.coelho@intel.com> + Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com> + Signed-off-by: Johannes Berg <johannes.berg@intel.com> -commit 0ca13e26341733bf9577287fb04a3bef0d2f5cc9 +commit 4f46eb8b28f96aca212a364e0fa847eb5333df67 Author: Felix Fietkau <nbd@openwrt.org> -Date: Wed Apr 9 00:07:01 2014 +0200 +Date: Mon May 5 11:48:40 2014 +0200 - mac80211: suppress BSS info change notifications for AP_VLAN + cfg80211: allow restricting supported dfs regions - Fixes warnings on tx power changes + At the moment, the ath9k/ath10k DFS module only supports detecting ETSI + radar patterns. + Add a bitmap in the interface combinations, indicating which DFS regions + are supported by the detector. If unset, support for all regions is + assumed. Signed-off-by: Felix Fietkau <nbd@openwrt.org> + Signed-off-by: Johannes Berg <johannes.berg@intel.com> -commit ec998e5991781ecdaad0911dc64f1c8d3749c308 -Author: Felix Fietkau <nbd@openwrt.org> -Date: Tue Apr 8 23:42:17 2014 +0200 +commit 0277b034768d1800a00829a755fc56b925aa6b95 +Author: Johannes Berg <johannes.berg@intel.com> +Date: Wed Apr 30 14:19:04 2014 +0200 - ath9k: fix a scheduling while atomic bug in CSA handling + mac80211: handle failed restart/resume better - Commit "ath9k: prepare for multi-interface CSA support" added a call to - ieee80211_iterate_active_interfaces in atomic context (beacon tasklet), - which is crashing. - Use ieee80211_iterate_active_interfaces_atomic instead. + When the driver fails during HW restart or resume, the whole + stack goes into a very confused state with interfaces being + up while the hardware is down etc. - Signed-off-by: Felix Fietkau <nbd@openwrt.org> + Address this by shutting down everything; we'll run into a + lot of warnings in the process but that's better than having + the whole stack get messed up. + + Reviewed-by: Arik Nemtsov <arik@wizery.com> + Signed-off-by: Johannes Berg <johannes.berg@intel.com> -commit 93f310a38a1d81a4bc8fcd9bf29628bd721cf2ef -Author: Felix Fietkau <nbd@openwrt.org> -Date: Sun Apr 6 23:35:28 2014 +0200 +commit 43fd71bc4b83d24981e90ca178f505cf6a6b16dc +Author: Luciano Coelho <luciano.coelho@intel.com> +Date: Wed May 7 20:05:12 2014 +0300 - ath9k_hw: reduce ANI firstep range for older chips + mac80211: fix sparse warning caused by __ieee80211_channel_switch() - Use 0-8 instead of 0-16, which is closer to the old implementation. - Also drop the overwrite of the firstep_low parameter to improve - stability. + Commit 59af6928 (mac80211: fix CSA tx queue stopping) introduced a + sparse warning: - Signed-off-by: Felix Fietkau <nbd@openwrt.org> + net/mac80211/cfg.c:3274:5: warning: symbol '__ieee80211_channel_switch' was not declared. Should it be static? + + Fix it by declaring the function static. + + Signed-off-by: Luciano Coelho <luciano.coelho@intel.com> + Signed-off-by: Johannes Berg <johannes.berg@intel.com> + +commit dd4371e2957db19870bb22ab84e841e1ac6e8997 +Author: Luciano Coelho <luciano.coelho@intel.com> +Date: Wed May 7 19:07:05 2014 +0300 + + cfg80211: fix docbook warning + + When trying to generate documentation, at least xmldocs, we get the + following warning: + + Warning(include/net/cfg80211.h:461): No description found for parameter 'nl80211_iftype' + + Fix it by adding the iftype argument name to the + cfg80211_chandef_dfs_required() function declaration. + + Reported-and-tested-by: Masanari Iida <standby24x7@gmail.com> + Signed-off-by: Luciano Coelho <luciano.coelho@intel.com> + Signed-off-by: Johannes Berg <johannes.berg@intel.com> + +commit 56de850ae960f096c784ec07864ca5b71abd16e6 +Author: Michal Kazior <michal.kazior@tieto.com> +Date: Thu May 8 09:10:02 2014 +0200 + + mac80211: disconnect iface if CSA unexpectedly fails + + It doesn't make much sense to leave a crippled + interface running. + + As a side effect this will unblock tx queues with + CSA reason immediately after failure instead of + until after userspace requests interface to stop. + + This also gives userspace an opportunity to + indirectly see CSA failure. + + Signed-off-by: Michal Kazior <michal.kazior@tieto.com> + [small code cleanup] + Signed-off-by: Johannes Berg <johannes.berg@intel.com> + +commit f5894c4f19e55bb1ea6376031fe9d47d7528be9e +Author: Loic Poulain <loic.poulain@intel.com> +Date: Wed May 7 11:38:11 2014 +0200 + + rfkill-gpio: Use gpio cansleep version + + If gpio controller requires waiting for read and write + GPIO values, then we have to use the gpio cansleep api. + Fix the rfkill_gpio_set_power which calls only the + nonsleep version (causing kernel warning). + There is no problem to use the cansleep version here + because we are not in IRQ handler or similar context + (cf rfkill_set_block). + + Signed-off-by: Loic Poulain <loic.poulain@intel.com> + Signed-off-by: Johannes Berg <johannes.berg@intel.com> + +commit 47fdf5d4f3704d2db9d1c0f647f788edef104fc8 +Author: Michal Kazior <michal.kazior@tieto.com> +Date: Wed Apr 9 15:45:36 2014 +0200 + + mac80211: ignore cqm during csa + + It is not guaranteed that multi-vif channel + switching is tightly synchronized. It makes sense + to ignore cqm (missing beacons, et al) while csa + is progressing and re-check it after it completes. + + Signed-off-by: Michal Kazior <michal.kazior@tieto.com> + Signed-off-by: Johannes Berg <johannes.berg@intel.com> + +commit 1a8ed386e1684b266a15dacf675102ae53361ee5 +Author: Michal Kazior <michal.kazior@tieto.com> +Date: Wed Apr 9 15:11:01 2014 +0200 + + cfg80211: export interface stopping function + + This exports a new cfg80211_stop_iface() function. + + This is intended for driver internal interface + combination management and channel switching. + + Due to locking issues (it re-enters driver) the + call is asynchronous and uses cfg80211 event + list/worker. + + Signed-off-by: Michal Kazior <michal.kazior@tieto.com> + Signed-off-by: Johannes Berg <johannes.berg@intel.com> + +commit 573f31d6d0e572ff8186c45a1ecd9273242233e6 +Author: Michal Kazior <michal.kazior@tieto.com> +Date: Wed Apr 9 15:11:00 2014 +0200 + + mac80211: split CSA finalize function + + Improves readability and modularity. + + Signed-off-by: Michal Kazior <michal.kazior@tieto.com> + Signed-off-by: Johannes Berg <johannes.berg@intel.com> + +commit 2d104d52e7c7640d68f29f2136dbe3938b7bc9ba +Author: Michal Kazior <michal.kazior@tieto.com> +Date: Wed Apr 9 15:10:59 2014 +0200 + + mac80211: fix CSA tx queue stopping + + It was possible for tx queues to be stuck stopped + if AP CSA finalization failed. In that case + neither stop_ap nor do_stop woke the queues up. + This means it was impossible to perform tx at all + until driver was reloaded or a successful CSA was + performed later. + + It was possible to solve this in a simpler manner + however this is more robust and future proof + (having multi-vif CSA in mind). + + New sdata->csa_block_tx is introduced to keep + track of which interfaces requested tx to be + blocked for CSA. This is required because mac80211 + stops all tx queues for that purpose. This means + queues must be awoken only when last tx-blocking + CSA interface is finished. + + It is still possible to have tx queues stopped + after CSA failure but as soon as offending + interfaces are stopped from userspace (stop_ap or + ifdown) tx queues are woken up properly. + + Signed-off-by: Michal Kazior <michal.kazior@tieto.com> + Signed-off-by: Johannes Berg <johannes.berg@intel.com> + +commit 6be615d6d42aa7fdab6c4278031d8fa0953e594f +Author: Johannes Berg <johannes.berg@intel.com> +Date: Wed Apr 9 21:31:13 2014 +0200 + + mac80211: mark local variable __maybe_unused + + The 'local' variable in __ieee80211_vif_copy_chanctx_to_vlans() + is only used/needed when lockdep is compiled in, mark it as such + to avoid compile warnings in the other case. + + While at it, fix some indentation where it's used. + + Reviewed-by: Luciano Coelho <luciano.coelho@intel.com> + Reviewed-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> + Signed-off-by: Johannes Berg <johannes.berg@intel.com> + +commit 43279e584aeb78aa0c853728db047b58156c0753 +Author: Arik Nemtsov <arik@wizery.com> +Date: Thu May 1 10:17:28 2014 +0300 + + mac80211: move TDLS code to another file + + With new additions planned, this code is getting too big for cfg.c. + + Signed-off-by: Arik Nemtsov <arikx.nemtsov@intel.com> + Signed-off-by: Johannes Berg <johannes.berg@intel.com> + +commit bf9c234b83c77f1ebbcbab73de2a9e4a5d4aafc6 +Author: Arik Nemtsov <arik@wizery.com> +Date: Thu May 1 10:17:27 2014 +0300 + + mac80211: set an external flag for TDLS stations + + Expose a new tdls flag for the public ieee80211_sta struct. + This can be used in some rate control decisions. + + Signed-off-by: Arik Nemtsov <arikx.nemtsov@intel.com> + Signed-off-by: Johannes Berg <johannes.berg@intel.com> + +commit 910e65141a17f645ab85dae1a497e64ebe63df70 +Author: Johannes Berg <johannes.berg@intel.com> +Date: Tue Apr 29 17:55:26 2014 +0200 + + mac80211: remove BUG_ON usage + + These BUG_ON statements should never trigger, but in the unlikely + event that somebody does manage don't stop everything but simply + exit the code path with an error. + + Leave the one BUG_ON where changing it would result in a NULL + pointer dereference. + + Signed-off-by: Johannes Berg <johannes.berg@intel.com> +commit ff36b582a10285530351aab036087b57ddb4ae2b +Author: Johannes Berg <johannes.berg@intel.com> +Date: Tue Apr 29 17:52:36 2014 +0200 ---- a/drivers/net/wireless/ath/ath9k/ar5008_phy.c -+++ b/drivers/net/wireless/ath/ath9k/ar5008_phy.c -@@ -1004,11 +1004,9 @@ static bool ar5008_hw_ani_control_new(st - case ATH9K_ANI_FIRSTEP_LEVEL:{ - u32 level = param; + cfg80211: remove BUG_ON usage + + These really can't trigger unless somebody messes up the code, + but don't make debugging it needlessly complicated, WARN and + return instead of BUG_ON(). + + Signed-off-by: Johannes Berg <johannes.berg@intel.com> + +--- a/drivers/net/wireless/ath/ath6kl/cfg80211.c ++++ b/drivers/net/wireless/ath/ath6kl/cfg80211.c +@@ -1759,7 +1759,7 @@ static bool is_rate_ht40(s32 rate, u8 *m + } -- value = level * 2; -+ value = level; - REG_RMW_FIELD(ah, AR_PHY_FIND_SIG, - AR_PHY_FIND_SIG_FIRSTEP, value); -- REG_RMW_FIELD(ah, AR_PHY_FIND_SIG_LOW, -- AR_PHY_FIND_SIG_FIRSTEP_LOW, value); + static int ath6kl_get_station(struct wiphy *wiphy, struct net_device *dev, +- u8 *mac, struct station_info *sinfo) ++ const u8 *mac, struct station_info *sinfo) + { + struct ath6kl *ar = ath6kl_priv(dev); + struct ath6kl_vif *vif = netdev_priv(dev); +@@ -2974,7 +2974,7 @@ static int ath6kl_stop_ap(struct wiphy * + static const u8 bcast_addr[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff }; - if (level != aniState->firstepLevel) { - ath_dbg(common, ANI, ---- a/drivers/net/wireless/ath/ath9k/beacon.c -+++ b/drivers/net/wireless/ath/ath9k/beacon.c -@@ -312,10 +312,9 @@ static void ath9k_csa_update_vif(void *d + static int ath6kl_del_station(struct wiphy *wiphy, struct net_device *dev, +- u8 *mac) ++ const u8 *mac) + { + struct ath6kl *ar = ath6kl_priv(dev); + struct ath6kl_vif *vif = netdev_priv(dev); +@@ -2985,7 +2985,8 @@ static int ath6kl_del_station(struct wip + } - void ath9k_csa_update(struct ath_softc *sc) + static int ath6kl_change_station(struct wiphy *wiphy, struct net_device *dev, +- u8 *mac, struct station_parameters *params) ++ const u8 *mac, ++ struct station_parameters *params) { -- ieee80211_iterate_active_interfaces(sc->hw, -- IEEE80211_IFACE_ITER_NORMAL, -- ath9k_csa_update_vif, -- sc); -+ ieee80211_iterate_active_interfaces_atomic(sc->hw, -+ IEEE80211_IFACE_ITER_NORMAL, -+ ath9k_csa_update_vif, sc); + struct ath6kl *ar = ath6kl_priv(dev); + struct ath6kl_vif *vif = netdev_priv(dev); +--- a/drivers/net/wireless/ath/ath6kl/wmi.c ++++ b/drivers/net/wireless/ath/ath6kl/wmi.c +@@ -2320,7 +2320,7 @@ int ath6kl_wmi_addkey_cmd(struct wmi *wm + return ret; } - void ath9k_beacon_tasklet(unsigned long data) ---- a/net/mac80211/main.c -+++ b/net/mac80211/main.c -@@ -152,6 +152,8 @@ static u32 ieee80211_hw_conf_chan(struct - list_for_each_entry_rcu(sdata, &local->interfaces, list) { - if (!rcu_access_pointer(sdata->vif.chanctx_conf)) - continue; -+ if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN) +-int ath6kl_wmi_add_krk_cmd(struct wmi *wmi, u8 if_idx, u8 *krk) ++int ath6kl_wmi_add_krk_cmd(struct wmi *wmi, u8 if_idx, const u8 *krk) + { + struct sk_buff *skb; + struct wmi_add_krk_cmd *cmd; +--- a/drivers/net/wireless/ath/ath6kl/wmi.h ++++ b/drivers/net/wireless/ath/ath6kl/wmi.h +@@ -2616,7 +2616,7 @@ int ath6kl_wmi_addkey_cmd(struct wmi *wm + u8 *key_material, + u8 key_op_ctrl, u8 *mac_addr, + enum wmi_sync_flag sync_flag); +-int ath6kl_wmi_add_krk_cmd(struct wmi *wmi, u8 if_idx, u8 *krk); ++int ath6kl_wmi_add_krk_cmd(struct wmi *wmi, u8 if_idx, const u8 *krk); + int ath6kl_wmi_deletekey_cmd(struct wmi *wmi, u8 if_idx, u8 key_index); + int ath6kl_wmi_setpmkid_cmd(struct wmi *wmi, u8 if_idx, const u8 *bssid, + const u8 *pmkid, bool set); +--- a/drivers/net/wireless/ath/ath9k/htc.h ++++ b/drivers/net/wireless/ath/ath9k/htc.h +@@ -378,7 +378,7 @@ void ath9k_htc_get_et_stats(struct ieee8 + #define TX_QSTAT_INC(c) do { } while (0) + + static inline void ath9k_htc_err_stat_rx(struct ath9k_htc_priv *priv, +- struct ath_htc_rx_status *rxs) ++ struct ath_rx_status *rs); + { + } + +--- a/drivers/net/wireless/ath/wil6210/cfg80211.c ++++ b/drivers/net/wireless/ath/wil6210/cfg80211.c +@@ -172,7 +172,7 @@ static int wil_cid_fill_sinfo(struct wil + + static int wil_cfg80211_get_station(struct wiphy *wiphy, + struct net_device *ndev, +- u8 *mac, struct station_info *sinfo) ++ const u8 *mac, struct station_info *sinfo) + { + struct wil6210_priv *wil = wiphy_to_wil(wiphy); + int rc; +@@ -671,7 +671,7 @@ static int wil_cfg80211_stop_ap(struct w + } + + static int wil_cfg80211_del_station(struct wiphy *wiphy, +- struct net_device *dev, u8 *mac) ++ struct net_device *dev, const u8 *mac) + { + struct wil6210_priv *wil = wiphy_to_wil(wiphy); + +--- a/drivers/net/wireless/ath/wil6210/main.c ++++ b/drivers/net/wireless/ath/wil6210/main.c +@@ -81,7 +81,7 @@ static void wil_disconnect_cid(struct wi + memset(&sta->stats, 0, sizeof(sta->stats)); + } + +-static void _wil6210_disconnect(struct wil6210_priv *wil, void *bssid) ++static void _wil6210_disconnect(struct wil6210_priv *wil, const u8 *bssid) + { + int cid = -ENOENT; + struct net_device *ndev = wil_to_ndev(wil); +@@ -252,7 +252,7 @@ int wil_priv_init(struct wil6210_priv *w + return 0; + } + +-void wil6210_disconnect(struct wil6210_priv *wil, void *bssid) ++void wil6210_disconnect(struct wil6210_priv *wil, const u8 *bssid) + { + del_timer_sync(&wil->connect_timer); + _wil6210_disconnect(wil, bssid); +--- a/drivers/net/wireless/ath/wil6210/wil6210.h ++++ b/drivers/net/wireless/ath/wil6210/wil6210.h +@@ -508,7 +508,7 @@ void wil_wdev_free(struct wil6210_priv * + int wmi_set_mac_address(struct wil6210_priv *wil, void *addr); + int wmi_pcp_start(struct wil6210_priv *wil, int bi, u8 wmi_nettype, u8 chan); + int wmi_pcp_stop(struct wil6210_priv *wil); +-void wil6210_disconnect(struct wil6210_priv *wil, void *bssid); ++void wil6210_disconnect(struct wil6210_priv *wil, const u8 *bssid); + + int wil_rx_init(struct wil6210_priv *wil); + void wil_rx_fini(struct wil6210_priv *wil); +--- a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c ++++ b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c +@@ -2236,7 +2236,7 @@ brcmf_cfg80211_config_default_mgmt_key(s + + static s32 + brcmf_cfg80211_get_station(struct wiphy *wiphy, struct net_device *ndev, +- u8 *mac, struct station_info *sinfo) ++ const u8 *mac, struct station_info *sinfo) + { + struct brcmf_if *ifp = netdev_priv(ndev); + struct brcmf_cfg80211_profile *profile = &ifp->vif->profile; +@@ -4014,7 +4014,7 @@ brcmf_cfg80211_change_beacon(struct wiph + + static int + brcmf_cfg80211_del_station(struct wiphy *wiphy, struct net_device *ndev, +- u8 *mac) ++ const u8 *mac) + { + struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy); + struct brcmf_scb_val_le scbval; +@@ -4242,7 +4242,7 @@ static int brcmf_convert_nl80211_tdls_op + } + + static int brcmf_cfg80211_tdls_oper(struct wiphy *wiphy, +- struct net_device *ndev, u8 *peer, ++ struct net_device *ndev, const u8 *peer, + enum nl80211_tdls_operation oper) + { + struct brcmf_if *ifp; +--- a/drivers/net/wireless/libertas/cfg.c ++++ b/drivers/net/wireless/libertas/cfg.c +@@ -1006,9 +1006,8 @@ struct cmd_key_material { + } __packed; + + static int lbs_set_key_material(struct lbs_private *priv, +- int key_type, +- int key_info, +- u8 *key, u16 key_len) ++ int key_type, int key_info, ++ const u8 *key, u16 key_len) + { + struct cmd_key_material cmd; + int ret; +@@ -1610,7 +1609,7 @@ static int lbs_cfg_del_key(struct wiphy + */ + + static int lbs_cfg_get_station(struct wiphy *wiphy, struct net_device *dev, +- u8 *mac, struct station_info *sinfo) ++ const u8 *mac, struct station_info *sinfo) + { + struct lbs_private *priv = wiphy_priv(wiphy); + s8 signal, noise; +--- a/drivers/net/wireless/libertas/defs.h ++++ b/drivers/net/wireless/libertas/defs.h +@@ -90,7 +90,8 @@ do { if ((lbs_debug & (grp)) == (grp)) \ + #define lbs_deb_cfg80211(fmt, args...) LBS_DEB_LL(LBS_DEB_CFG80211, " cfg80211", fmt, ##args) + + #ifdef DEBUG +-static inline void lbs_deb_hex(unsigned int grp, const char *prompt, u8 *buf, int len) ++static inline void lbs_deb_hex(unsigned int grp, const char *prompt, ++ const u8 *buf, int len) + { + int i = 0; + +--- a/drivers/net/wireless/mwifiex/11n.h ++++ b/drivers/net/wireless/mwifiex/11n.h +@@ -200,7 +200,7 @@ static inline int mwifiex_is_sta_11n_ena + } + + static inline u8 +-mwifiex_tdls_peer_11n_enabled(struct mwifiex_private *priv, u8 *ra) ++mwifiex_tdls_peer_11n_enabled(struct mwifiex_private *priv, const u8 *ra) + { + struct mwifiex_sta_node *node = mwifiex_get_sta_entry(priv, ra); + if (node) +--- a/drivers/net/wireless/mwifiex/cfg80211.c ++++ b/drivers/net/wireless/mwifiex/cfg80211.c +@@ -994,7 +994,7 @@ mwifiex_dump_station_info(struct mwifiex + */ + static int + mwifiex_cfg80211_get_station(struct wiphy *wiphy, struct net_device *dev, +- u8 *mac, struct station_info *sinfo) ++ const u8 *mac, struct station_info *sinfo) + { + struct mwifiex_private *priv = mwifiex_netdev_get_priv(dev); + +@@ -1270,7 +1270,7 @@ static int mwifiex_cfg80211_change_beaco + */ + static int + mwifiex_cfg80211_del_station(struct wiphy *wiphy, struct net_device *dev, +- u8 *mac) ++ const u8 *mac) + { + struct mwifiex_private *priv = mwifiex_netdev_get_priv(dev); + struct mwifiex_sta_node *sta_node; +@@ -2629,7 +2629,7 @@ static int mwifiex_cfg80211_set_coalesce + */ + static int + mwifiex_cfg80211_tdls_mgmt(struct wiphy *wiphy, struct net_device *dev, +- u8 *peer, u8 action_code, u8 dialog_token, ++ const u8 *peer, u8 action_code, u8 dialog_token, + u16 status_code, u32 peer_capability, + const u8 *extra_ies, size_t extra_ies_len) + { +@@ -2701,7 +2701,7 @@ mwifiex_cfg80211_tdls_mgmt(struct wiphy + + static int + mwifiex_cfg80211_tdls_oper(struct wiphy *wiphy, struct net_device *dev, +- u8 *peer, enum nl80211_tdls_operation action) ++ const u8 *peer, enum nl80211_tdls_operation action) + { + struct mwifiex_private *priv = mwifiex_netdev_get_priv(dev); + +@@ -2748,9 +2748,8 @@ mwifiex_cfg80211_tdls_oper(struct wiphy + } + + static int +-mwifiex_cfg80211_add_station(struct wiphy *wiphy, +- struct net_device *dev, +- u8 *mac, struct station_parameters *params) ++mwifiex_cfg80211_add_station(struct wiphy *wiphy, struct net_device *dev, ++ const u8 *mac, struct station_parameters *params) + { + struct mwifiex_private *priv = mwifiex_netdev_get_priv(dev); + +@@ -2765,9 +2764,9 @@ mwifiex_cfg80211_add_station(struct wiph + } + + static int +-mwifiex_cfg80211_change_station(struct wiphy *wiphy, +- struct net_device *dev, +- u8 *mac, struct station_parameters *params) ++mwifiex_cfg80211_change_station(struct wiphy *wiphy, struct net_device *dev, ++ const u8 *mac, ++ struct station_parameters *params) + { + int ret; + struct mwifiex_private *priv = mwifiex_netdev_get_priv(dev); +--- a/drivers/net/wireless/mwifiex/main.h ++++ b/drivers/net/wireless/mwifiex/main.h +@@ -910,8 +910,6 @@ int mwifiex_handle_uap_rx_forward(struct + struct sk_buff *skb); + int mwifiex_process_sta_event(struct mwifiex_private *); + int mwifiex_process_uap_event(struct mwifiex_private *); +-struct mwifiex_sta_node * +-mwifiex_get_sta_entry(struct mwifiex_private *priv, u8 *mac); + void mwifiex_delete_all_station_list(struct mwifiex_private *priv); + void *mwifiex_process_sta_txpd(struct mwifiex_private *, struct sk_buff *skb); + void *mwifiex_process_uap_txpd(struct mwifiex_private *, struct sk_buff *skb); +@@ -1220,26 +1218,26 @@ void mwifiex_dnld_txpwr_table(struct mwi + extern const struct ethtool_ops mwifiex_ethtool_ops; + + void mwifiex_del_all_sta_list(struct mwifiex_private *priv); +-void mwifiex_del_sta_entry(struct mwifiex_private *priv, u8 *mac); ++void mwifiex_del_sta_entry(struct mwifiex_private *priv, const u8 *mac); + void + mwifiex_set_sta_ht_cap(struct mwifiex_private *priv, const u8 *ies, + int ies_len, struct mwifiex_sta_node *node); + struct mwifiex_sta_node * +-mwifiex_add_sta_entry(struct mwifiex_private *priv, u8 *mac); ++mwifiex_add_sta_entry(struct mwifiex_private *priv, const u8 *mac); + struct mwifiex_sta_node * +-mwifiex_get_sta_entry(struct mwifiex_private *priv, u8 *mac); +-int mwifiex_send_tdls_data_frame(struct mwifiex_private *priv, u8 *peer, ++mwifiex_get_sta_entry(struct mwifiex_private *priv, const u8 *mac); ++int mwifiex_send_tdls_data_frame(struct mwifiex_private *priv, const u8 *peer, + u8 action_code, u8 dialog_token, + u16 status_code, const u8 *extra_ies, + size_t extra_ies_len); +-int mwifiex_send_tdls_action_frame(struct mwifiex_private *priv, +- u8 *peer, u8 action_code, u8 dialog_token, +- u16 status_code, const u8 *extra_ies, +- size_t extra_ies_len); ++int mwifiex_send_tdls_action_frame(struct mwifiex_private *priv, const u8 *peer, ++ u8 action_code, u8 dialog_token, ++ u16 status_code, const u8 *extra_ies, ++ size_t extra_ies_len); + void mwifiex_process_tdls_action_frame(struct mwifiex_private *priv, + u8 *buf, int len); +-int mwifiex_tdls_oper(struct mwifiex_private *priv, u8 *peer, u8 action); +-int mwifiex_get_tdls_link_status(struct mwifiex_private *priv, u8 *mac); ++int mwifiex_tdls_oper(struct mwifiex_private *priv, const u8 *peer, u8 action); ++int mwifiex_get_tdls_link_status(struct mwifiex_private *priv, const u8 *mac); + void mwifiex_disable_all_tdls_links(struct mwifiex_private *priv); + bool mwifiex_is_bss_in_11ac_mode(struct mwifiex_private *priv); + u8 mwifiex_get_center_freq_index(struct mwifiex_private *priv, u8 band, +--- a/drivers/net/wireless/mwifiex/tdls.c ++++ b/drivers/net/wireless/mwifiex/tdls.c +@@ -25,8 +25,8 @@ + #define TDLS_RESP_FIX_LEN 8 + #define TDLS_CONFIRM_FIX_LEN 6 + +-static void +-mwifiex_restore_tdls_packets(struct mwifiex_private *priv, u8 *mac, u8 status) ++static void mwifiex_restore_tdls_packets(struct mwifiex_private *priv, ++ const u8 *mac, u8 status) + { + struct mwifiex_ra_list_tbl *ra_list; + struct list_head *tid_list; +@@ -84,7 +84,8 @@ mwifiex_restore_tdls_packets(struct mwif + return; + } + +-static void mwifiex_hold_tdls_packets(struct mwifiex_private *priv, u8 *mac) ++static void mwifiex_hold_tdls_packets(struct mwifiex_private *priv, ++ const u8 *mac) + { + struct mwifiex_ra_list_tbl *ra_list; + struct list_head *ra_list_head; +@@ -228,7 +229,7 @@ mwifiex_tdls_add_ht_oper(struct mwifiex_ + } + + static int mwifiex_tdls_add_vht_oper(struct mwifiex_private *priv, +- u8 *mac, struct sk_buff *skb) ++ const u8 *mac, struct sk_buff *skb) + { + struct mwifiex_bssdescriptor *bss_desc; + struct ieee80211_vht_operation *vht_oper; +@@ -367,8 +368,9 @@ static void mwifiex_tdls_add_qos_capab(s + } + + static int mwifiex_prep_tdls_encap_data(struct mwifiex_private *priv, +- u8 *peer, u8 action_code, u8 dialog_token, +- u16 status_code, struct sk_buff *skb) ++ const u8 *peer, u8 action_code, ++ u8 dialog_token, ++ u16 status_code, struct sk_buff *skb) + { + struct ieee80211_tdls_data *tf; + int ret; +@@ -506,7 +508,8 @@ static int mwifiex_prep_tdls_encap_data( + } + + static void +-mwifiex_tdls_add_link_ie(struct sk_buff *skb, u8 *src_addr, u8 *peer, u8 *bssid) ++mwifiex_tdls_add_link_ie(struct sk_buff *skb, const u8 *src_addr, ++ const u8 *peer, const u8 *bssid) + { + struct ieee80211_tdls_lnkie *lnkid; + +@@ -520,8 +523,8 @@ mwifiex_tdls_add_link_ie(struct sk_buff + memcpy(lnkid->resp_sta, peer, ETH_ALEN); + } + +-int mwifiex_send_tdls_data_frame(struct mwifiex_private *priv, +- u8 *peer, u8 action_code, u8 dialog_token, ++int mwifiex_send_tdls_data_frame(struct mwifiex_private *priv, const u8 *peer, ++ u8 action_code, u8 dialog_token, + u16 status_code, const u8 *extra_ies, + size_t extra_ies_len) + { +@@ -613,7 +616,8 @@ int mwifiex_send_tdls_data_frame(struct + } + + static int +-mwifiex_construct_tdls_action_frame(struct mwifiex_private *priv, u8 *peer, ++mwifiex_construct_tdls_action_frame(struct mwifiex_private *priv, ++ const u8 *peer, + u8 action_code, u8 dialog_token, + u16 status_code, struct sk_buff *skb) + { +@@ -691,10 +695,10 @@ mwifiex_construct_tdls_action_frame(stru + return 0; + } + +-int mwifiex_send_tdls_action_frame(struct mwifiex_private *priv, +- u8 *peer, u8 action_code, u8 dialog_token, +- u16 status_code, const u8 *extra_ies, +- size_t extra_ies_len) ++int mwifiex_send_tdls_action_frame(struct mwifiex_private *priv, const u8 *peer, ++ u8 action_code, u8 dialog_token, ++ u16 status_code, const u8 *extra_ies, ++ size_t extra_ies_len) + { + struct sk_buff *skb; + struct mwifiex_txinfo *tx_info; +@@ -901,7 +905,7 @@ void mwifiex_process_tdls_action_frame(s + } + + static int +-mwifiex_tdls_process_config_link(struct mwifiex_private *priv, u8 *peer) ++mwifiex_tdls_process_config_link(struct mwifiex_private *priv, const u8 *peer) + { + struct mwifiex_sta_node *sta_ptr; + struct mwifiex_ds_tdls_oper tdls_oper; +@@ -922,7 +926,7 @@ mwifiex_tdls_process_config_link(struct + } + + static int +-mwifiex_tdls_process_create_link(struct mwifiex_private *priv, u8 *peer) ++mwifiex_tdls_process_create_link(struct mwifiex_private *priv, const u8 *peer) + { + struct mwifiex_sta_node *sta_ptr; + struct mwifiex_ds_tdls_oper tdls_oper; +@@ -949,7 +953,7 @@ mwifiex_tdls_process_create_link(struct + } + + static int +-mwifiex_tdls_process_disable_link(struct mwifiex_private *priv, u8 *peer) ++mwifiex_tdls_process_disable_link(struct mwifiex_private *priv, const u8 *peer) + { + struct mwifiex_sta_node *sta_ptr; + struct mwifiex_ds_tdls_oper tdls_oper; +@@ -978,7 +982,7 @@ mwifiex_tdls_process_disable_link(struct + } + + static int +-mwifiex_tdls_process_enable_link(struct mwifiex_private *priv, u8 *peer) ++mwifiex_tdls_process_enable_link(struct mwifiex_private *priv, const u8 *peer) + { + struct mwifiex_sta_node *sta_ptr; + struct ieee80211_mcs_info mcs; +@@ -1035,7 +1039,7 @@ mwifiex_tdls_process_enable_link(struct + return 0; + } + +-int mwifiex_tdls_oper(struct mwifiex_private *priv, u8 *peer, u8 action) ++int mwifiex_tdls_oper(struct mwifiex_private *priv, const u8 *peer, u8 action) + { + switch (action) { + case MWIFIEX_TDLS_ENABLE_LINK: +@@ -1050,7 +1054,7 @@ int mwifiex_tdls_oper(struct mwifiex_pri + return 0; + } + +-int mwifiex_get_tdls_link_status(struct mwifiex_private *priv, u8 *mac) ++int mwifiex_get_tdls_link_status(struct mwifiex_private *priv, const u8 *mac) + { + struct mwifiex_sta_node *sta_ptr; + +--- a/drivers/net/wireless/mwifiex/util.c ++++ b/drivers/net/wireless/mwifiex/util.c +@@ -259,7 +259,7 @@ int mwifiex_complete_cmd(struct mwifiex_ + * NULL is returned if station entry is not found in associated STA list. + */ + struct mwifiex_sta_node * +-mwifiex_get_sta_entry(struct mwifiex_private *priv, u8 *mac) ++mwifiex_get_sta_entry(struct mwifiex_private *priv, const u8 *mac) + { + struct mwifiex_sta_node *node; + +@@ -280,7 +280,7 @@ mwifiex_get_sta_entry(struct mwifiex_pri + * If received mac address is NULL, NULL is returned. + */ + struct mwifiex_sta_node * +-mwifiex_add_sta_entry(struct mwifiex_private *priv, u8 *mac) ++mwifiex_add_sta_entry(struct mwifiex_private *priv, const u8 *mac) + { + struct mwifiex_sta_node *node; + unsigned long flags; +@@ -332,7 +332,7 @@ mwifiex_set_sta_ht_cap(struct mwifiex_pr + } + + /* This function will delete a station entry from station list */ +-void mwifiex_del_sta_entry(struct mwifiex_private *priv, u8 *mac) ++void mwifiex_del_sta_entry(struct mwifiex_private *priv, const u8 *mac) + { + struct mwifiex_sta_node *node; + unsigned long flags; +--- a/drivers/net/wireless/mwifiex/wmm.c ++++ b/drivers/net/wireless/mwifiex/wmm.c +@@ -92,7 +92,7 @@ mwifiex_wmm_ac_debug_print(const struct + * The function also initializes the list with the provided RA. + */ + static struct mwifiex_ra_list_tbl * +-mwifiex_wmm_allocate_ralist_node(struct mwifiex_adapter *adapter, u8 *ra) ++mwifiex_wmm_allocate_ralist_node(struct mwifiex_adapter *adapter, const u8 *ra) + { + struct mwifiex_ra_list_tbl *ra_list; + +@@ -139,8 +139,7 @@ static u8 mwifiex_get_random_ba_threshol + * This function allocates and adds a RA list for all TIDs + * with the given RA. + */ +-void +-mwifiex_ralist_add(struct mwifiex_private *priv, u8 *ra) ++void mwifiex_ralist_add(struct mwifiex_private *priv, const u8 *ra) + { + int i; + struct mwifiex_ra_list_tbl *ra_list; +@@ -566,7 +565,7 @@ mwifiex_clean_txrx(struct mwifiex_privat + */ + static struct mwifiex_ra_list_tbl * + mwifiex_wmm_get_ralist_node(struct mwifiex_private *priv, u8 tid, +- u8 *ra_addr) ++ const u8 *ra_addr) + { + struct mwifiex_ra_list_tbl *ra_list; + +@@ -587,7 +586,8 @@ mwifiex_wmm_get_ralist_node(struct mwifi + * retrieved. + */ + struct mwifiex_ra_list_tbl * +-mwifiex_wmm_get_queue_raptr(struct mwifiex_private *priv, u8 tid, u8 *ra_addr) ++mwifiex_wmm_get_queue_raptr(struct mwifiex_private *priv, u8 tid, ++ const u8 *ra_addr) + { + struct mwifiex_ra_list_tbl *ra_list; + +--- a/drivers/net/wireless/mwifiex/wmm.h ++++ b/drivers/net/wireless/mwifiex/wmm.h +@@ -99,7 +99,7 @@ mwifiex_wmm_is_ra_list_empty(struct list + + void mwifiex_wmm_add_buf_txqueue(struct mwifiex_private *priv, + struct sk_buff *skb); +-void mwifiex_ralist_add(struct mwifiex_private *priv, u8 *ra); ++void mwifiex_ralist_add(struct mwifiex_private *priv, const u8 *ra); + void mwifiex_rotate_priolists(struct mwifiex_private *priv, + struct mwifiex_ra_list_tbl *ra, int tid); + +@@ -123,7 +123,8 @@ void mwifiex_wmm_setup_ac_downgrade(stru + int mwifiex_ret_wmm_get_status(struct mwifiex_private *priv, + const struct host_cmd_ds_command *resp); + struct mwifiex_ra_list_tbl * +-mwifiex_wmm_get_queue_raptr(struct mwifiex_private *priv, u8 tid, u8 *ra_addr); ++mwifiex_wmm_get_queue_raptr(struct mwifiex_private *priv, u8 tid, ++ const u8 *ra_addr); + u8 mwifiex_wmm_downgrade_tid(struct mwifiex_private *priv, u32 tid); + + #endif /* !_MWIFIEX_WMM_H_ */ +--- a/drivers/net/wireless/orinoco/hw.c ++++ b/drivers/net/wireless/orinoco/hw.c +@@ -988,8 +988,8 @@ int __orinoco_hw_setup_enc(struct orinoc + * tsc must be NULL or up to 8 bytes + */ + int __orinoco_hw_set_tkip_key(struct orinoco_private *priv, int key_idx, +- int set_tx, u8 *key, u8 *rsc, size_t rsc_len, +- u8 *tsc, size_t tsc_len) ++ int set_tx, const u8 *key, const u8 *rsc, ++ size_t rsc_len, const u8 *tsc, size_t tsc_len) + { + struct { + __le16 idx; +--- a/drivers/net/wireless/orinoco/hw.h ++++ b/drivers/net/wireless/orinoco/hw.h +@@ -38,8 +38,8 @@ int __orinoco_hw_set_wap(struct orinoco_ + int __orinoco_hw_setup_wepkeys(struct orinoco_private *priv); + int __orinoco_hw_setup_enc(struct orinoco_private *priv); + int __orinoco_hw_set_tkip_key(struct orinoco_private *priv, int key_idx, +- int set_tx, u8 *key, u8 *rsc, size_t rsc_len, +- u8 *tsc, size_t tsc_len); ++ int set_tx, const u8 *key, const u8 *rsc, ++ size_t rsc_len, const u8 *tsc, size_t tsc_len); + int orinoco_clear_tkip_key(struct orinoco_private *priv, int key_idx); + int __orinoco_hw_set_multicast_list(struct orinoco_private *priv, + struct net_device *dev, +--- a/drivers/net/wireless/orinoco/wext.c ++++ b/drivers/net/wireless/orinoco/wext.c +@@ -52,9 +52,9 @@ static int orinoco_set_key(struct orinoc + priv->keys[index].seq_len = seq_len; + + if (key_len) +- memcpy(priv->keys[index].key, key, key_len); ++ memcpy((void *)priv->keys[index].key, key, key_len); + if (seq_len) +- memcpy(priv->keys[index].seq, seq, seq_len); ++ memcpy((void *)priv->keys[index].seq, seq, seq_len); + + switch (alg) { + case ORINOCO_ALG_TKIP: +--- a/drivers/net/wireless/rndis_wlan.c ++++ b/drivers/net/wireless/rndis_wlan.c +@@ -517,7 +517,7 @@ static int rndis_set_default_key(struct + u8 key_index, bool unicast, bool multicast); + + static int rndis_get_station(struct wiphy *wiphy, struct net_device *dev, +- u8 *mac, struct station_info *sinfo); ++ const u8 *mac, struct station_info *sinfo); + + static int rndis_dump_station(struct wiphy *wiphy, struct net_device *dev, + int idx, u8 *mac, struct station_info *sinfo); +@@ -2490,7 +2490,7 @@ static void rndis_fill_station_info(stru + } + + static int rndis_get_station(struct wiphy *wiphy, struct net_device *dev, +- u8 *mac, struct station_info *sinfo) ++ const u8 *mac, struct station_info *sinfo) + { + struct rndis_wlan_private *priv = wiphy_priv(wiphy); + struct usbnet *usbdev = priv->usbdev; +--- a/drivers/net/wireless/ti/wlcore/main.c ++++ b/drivers/net/wireless/ti/wlcore/main.c +@@ -1416,7 +1416,7 @@ void wl1271_rx_filter_free(struct wl12xx + + int wl1271_rx_filter_alloc_field(struct wl12xx_rx_filter *filter, + u16 offset, u8 flags, +- u8 *pattern, u8 len) ++ const u8 *pattern, u8 len) + { + struct wl12xx_rx_filter_field *field; + +--- a/drivers/net/wireless/ti/wlcore/wlcore_i.h ++++ b/drivers/net/wireless/ti/wlcore/wlcore_i.h +@@ -512,8 +512,8 @@ int wl1271_recalc_rx_streaming(struct wl + void wl12xx_queue_recovery_work(struct wl1271 *wl); + size_t wl12xx_copy_fwlog(struct wl1271 *wl, u8 *memblock, size_t maxlen); + int wl1271_rx_filter_alloc_field(struct wl12xx_rx_filter *filter, +- u16 offset, u8 flags, +- u8 *pattern, u8 len); ++ u16 offset, u8 flags, ++ const u8 *pattern, u8 len); + void wl1271_rx_filter_free(struct wl12xx_rx_filter *filter); + struct wl12xx_rx_filter *wl1271_rx_filter_alloc(void); + int wl1271_rx_filter_get_fields_size(struct wl12xx_rx_filter *filter); +--- a/include/net/cfg80211.h ++++ b/include/net/cfg80211.h +@@ -341,8 +341,8 @@ struct vif_params { + * @seq_len: length of @seq. + */ + struct key_params { +- u8 *key; +- u8 *seq; ++ const u8 *key; ++ const u8 *seq; + int key_len; + int seq_len; + u32 cipher; +@@ -458,7 +458,7 @@ bool cfg80211_chandef_usable(struct wiph + */ + int cfg80211_chandef_dfs_required(struct wiphy *wiphy, + const struct cfg80211_chan_def *chandef, +- enum nl80211_iftype); ++ enum nl80211_iftype iftype); + + /** + * ieee80211_chandef_rate_flags - returns rate flags for a channel +@@ -694,8 +694,10 @@ struct cfg80211_ap_settings { + * + * @chandef: defines the channel to use after the switch + * @beacon_csa: beacon data while performing the switch +- * @counter_offset_beacon: offset for the counter within the beacon (tail) +- * @counter_offset_presp: offset for the counter within the probe response ++ * @counter_offsets_beacon: offsets of the counters within the beacon (tail) ++ * @counter_offsets_presp: offsets of the counters within the probe response ++ * @n_counter_offsets_beacon: number of csa counters the beacon (tail) ++ * @n_counter_offsets_presp: number of csa counters in the probe response + * @beacon_after: beacon data to be used on the new channel + * @radar_required: whether radar detection is required on the new channel + * @block_tx: whether transmissions should be blocked while changing +@@ -704,7 +706,10 @@ struct cfg80211_ap_settings { + struct cfg80211_csa_settings { + struct cfg80211_chan_def chandef; + struct cfg80211_beacon_data beacon_csa; +- u16 counter_offset_beacon, counter_offset_presp; ++ const u16 *counter_offsets_beacon; ++ const u16 *counter_offsets_presp; ++ unsigned int n_counter_offsets_beacon; ++ unsigned int n_counter_offsets_presp; + struct cfg80211_beacon_data beacon_after; + bool radar_required; + bool block_tx; +@@ -1164,7 +1169,7 @@ struct bss_parameters { + int use_cts_prot; + int use_short_preamble; + int use_short_slot_time; +- u8 *basic_rates; ++ const u8 *basic_rates; + u8 basic_rates_len; + int ap_isolate; + int ht_opmode; +@@ -1694,10 +1699,10 @@ struct cfg80211_disassoc_request { + * @ht_capa_mask: The bits of ht_capa which are to be used. + */ + struct cfg80211_ibss_params { +- u8 *ssid; +- u8 *bssid; ++ const u8 *ssid; ++ const u8 *bssid; + struct cfg80211_chan_def chandef; +- u8 *ie; ++ const u8 *ie; + u8 ssid_len, ie_len; + u16 beacon_interval; + u32 basic_rates; +@@ -1806,8 +1811,8 @@ struct cfg80211_bitrate_mask { + * @pmkid: The PMK material itself. + */ + struct cfg80211_pmksa { +- u8 *bssid; +- u8 *pmkid; ++ const u8 *bssid; ++ const u8 *pmkid; + }; + + /** +@@ -1822,7 +1827,7 @@ struct cfg80211_pmksa { + * memory, free @mask only! + */ + struct cfg80211_pkt_pattern { +- u8 *mask, *pattern; ++ const u8 *mask, *pattern; + int pattern_len; + int pkt_offset; + }; +@@ -1986,6 +1991,8 @@ struct cfg80211_update_ft_ies_params { + * @len: buffer length + * @no_cck: don't use cck rates for this frame + * @dont_wait_for_ack: tells the low level not to wait for an ack ++ * @n_csa_offsets: length of csa_offsets array ++ * @csa_offsets: array of all the csa offsets in the frame + */ + struct cfg80211_mgmt_tx_params { + struct ieee80211_channel *chan; +@@ -1995,6 +2002,8 @@ struct cfg80211_mgmt_tx_params { + size_t len; + bool no_cck; + bool dont_wait_for_ack; ++ int n_csa_offsets; ++ const u16 *csa_offsets; + }; + + /** +@@ -2336,28 +2345,29 @@ struct cfg80211_ops { + + + int (*add_station)(struct wiphy *wiphy, struct net_device *dev, +- u8 *mac, struct station_parameters *params); ++ const u8 *mac, ++ struct station_parameters *params); + int (*del_station)(struct wiphy *wiphy, struct net_device *dev, +- u8 *mac); ++ const u8 *mac); + int (*change_station)(struct wiphy *wiphy, struct net_device *dev, +- u8 *mac, struct station_parameters *params); ++ const u8 *mac, ++ struct station_parameters *params); + int (*get_station)(struct wiphy *wiphy, struct net_device *dev, +- u8 *mac, struct station_info *sinfo); ++ const u8 *mac, struct station_info *sinfo); + int (*dump_station)(struct wiphy *wiphy, struct net_device *dev, +- int idx, u8 *mac, struct station_info *sinfo); ++ int idx, u8 *mac, struct station_info *sinfo); + + int (*add_mpath)(struct wiphy *wiphy, struct net_device *dev, +- u8 *dst, u8 *next_hop); ++ const u8 *dst, const u8 *next_hop); + int (*del_mpath)(struct wiphy *wiphy, struct net_device *dev, +- u8 *dst); ++ const u8 *dst); + int (*change_mpath)(struct wiphy *wiphy, struct net_device *dev, +- u8 *dst, u8 *next_hop); ++ const u8 *dst, const u8 *next_hop); + int (*get_mpath)(struct wiphy *wiphy, struct net_device *dev, +- u8 *dst, u8 *next_hop, +- struct mpath_info *pinfo); ++ u8 *dst, u8 *next_hop, struct mpath_info *pinfo); + int (*dump_mpath)(struct wiphy *wiphy, struct net_device *dev, +- int idx, u8 *dst, u8 *next_hop, +- struct mpath_info *pinfo); ++ int idx, u8 *dst, u8 *next_hop, ++ struct mpath_info *pinfo); + int (*get_mesh_config)(struct wiphy *wiphy, + struct net_device *dev, + struct mesh_config *conf); +@@ -2487,11 +2497,11 @@ struct cfg80211_ops { + struct cfg80211_gtk_rekey_data *data); + + int (*tdls_mgmt)(struct wiphy *wiphy, struct net_device *dev, +- u8 *peer, u8 action_code, u8 dialog_token, ++ const u8 *peer, u8 action_code, u8 dialog_token, + u16 status_code, u32 peer_capability, + const u8 *buf, size_t len); + int (*tdls_oper)(struct wiphy *wiphy, struct net_device *dev, +- u8 *peer, enum nl80211_tdls_operation oper); ++ const u8 *peer, enum nl80211_tdls_operation oper); + + int (*probe_client)(struct wiphy *wiphy, struct net_device *dev, + const u8 *peer, u64 *cookie); +@@ -2638,6 +2648,7 @@ struct ieee80211_iface_limit { + * between infrastructure and AP types must match. This is required + * only in special cases. + * @radar_detect_widths: bitmap of channel widths supported for radar detection ++ * @radar_detect_regions: bitmap of regions supported for radar detection + * + * With this structure the driver can describe which interface + * combinations it supports concurrently. +@@ -2695,6 +2706,7 @@ struct ieee80211_iface_combination { + u8 n_limits; + bool beacon_int_infra_match; + u8 radar_detect_widths; ++ u8 radar_detect_regions; + }; + + struct ieee80211_txrx_stypes { +@@ -2925,6 +2937,11 @@ struct wiphy_vendor_command { + * (including P2P GO) or 0 to indicate no such limit is advertised. The + * driver is allowed to advertise a theoretical limit that it can reach in + * some cases, but may not always reach. ++ * ++ * @max_num_csa_counters: Number of supported csa_counters in beacons ++ * and probe responses. This value should be set if the driver ++ * wishes to limit the number of csa counters. Default (0) means ++ * infinite. + */ + struct wiphy { + /* assign these fields before you register the wiphy */ +@@ -3045,6 +3062,8 @@ struct wiphy { + + u16 max_ap_assoc_sta; + ++ u8 max_num_csa_counters; ++ + char priv[0] __aligned(NETDEV_ALIGN); + }; + +@@ -3273,7 +3292,7 @@ struct wireless_dev { + struct cfg80211_ibss_params ibss; + struct cfg80211_connect_params connect; + struct cfg80211_cached_keys *keys; +- u8 *ie; ++ const u8 *ie; + size_t ie_len; + u8 bssid[ETH_ALEN], prev_bssid[ETH_ALEN]; + u8 ssid[IEEE80211_MAX_SSID_LEN]; +@@ -3514,7 +3533,8 @@ int ieee80211_data_to_8023(struct sk_buf + * Return: 0 on success, or a negative error code. + */ + int ieee80211_data_from_8023(struct sk_buff *skb, const u8 *addr, +- enum nl80211_iftype iftype, u8 *bssid, bool qos); ++ enum nl80211_iftype iftype, const u8 *bssid, ++ bool qos); + + /** + * ieee80211_amsdu_to_8023s - decode an IEEE 802.11n A-MSDU frame +@@ -4315,7 +4335,7 @@ void cfg80211_roamed_bss(struct net_devi + * and not try to connect to any AP any more. + */ + void cfg80211_disconnected(struct net_device *dev, u16 reason, +- u8 *ie, size_t ie_len, gfp_t gfp); ++ const u8 *ie, size_t ie_len, gfp_t gfp); + + /** + * cfg80211_ready_on_channel - notification of remain_on_channel start +@@ -4771,6 +4791,35 @@ int cfg80211_iter_combinations(struct wi + void *data), + void *data); + ++/* ++ * cfg80211_stop_iface - trigger interface disconnection ++ * ++ * @wiphy: the wiphy ++ * @wdev: wireless device ++ * @gfp: context flags ++ * ++ * Trigger interface to be stopped as if AP was stopped, IBSS/mesh left, STA ++ * disconnected. ++ * ++ * Note: This doesn't need any locks and is asynchronous. ++ */ ++void cfg80211_stop_iface(struct wiphy *wiphy, struct wireless_dev *wdev, ++ gfp_t gfp); ++ ++/** ++ * cfg80211_shutdown_all_interfaces - shut down all interfaces for a wiphy ++ * @wiphy: the wiphy to shut down ++ * ++ * This function shuts down all interfaces belonging to this wiphy by ++ * calling dev_close() (and treating non-netdev interfaces as needed). ++ * It shouldn't really be used unless there are some fatal device errors ++ * that really can't be recovered in any other way. ++ * ++ * Callers must hold the RTNL and be able to deal with callbacks into ++ * the driver while the function is running. ++ */ ++void cfg80211_shutdown_all_interfaces(struct wiphy *wiphy); ++ + /* Logging, debugging and troubleshooting/diagnostic helpers. */ + + /* wiphy_printk helpers, similar to dev_printk */ +--- a/include/net/mac80211.h ++++ b/include/net/mac80211.h +@@ -1113,7 +1113,9 @@ enum ieee80211_vif_flags { + * @addr: address of this interface + * @p2p: indicates whether this AP or STA interface is a p2p + * interface, i.e. a GO or p2p-sta respectively +- * @csa_active: marks whether a channel switch is going on ++ * @csa_active: marks whether a channel switch is going on. Internally it is ++ * write-protected by sdata_lock and local->mtx so holding either is fine ++ * for read access. + * @driver_flags: flags/capabilities the driver has for this interface, + * these need to be set (or cleared) when the interface is added + * or, if supported by the driver, the interface type is changed +@@ -1374,6 +1376,7 @@ struct ieee80211_sta_rates { + * the station moves to associated state. + * @smps_mode: current SMPS mode (off, static or dynamic) + * @rates: rate control selection table ++ * @tdls: indicates whether the STA is a TDLS peer + */ + struct ieee80211_sta { + u32 supp_rates[IEEE80211_NUM_BANDS]; +@@ -1388,6 +1391,7 @@ struct ieee80211_sta { + enum ieee80211_sta_rx_bandwidth bandwidth; + enum ieee80211_smps_mode smps_mode; + struct ieee80211_sta_rates __rcu *rates; ++ bool tdls; + + /* must be last */ + u8 drv_priv[0] __aligned(sizeof(void *)); +@@ -3407,6 +3411,47 @@ void ieee80211_tx_status_irqsafe(struct + */ + void ieee80211_report_low_ack(struct ieee80211_sta *sta, u32 num_packets); + ++#define IEEE80211_MAX_CSA_COUNTERS_NUM 2 ++ ++/** ++ * struct ieee80211_mutable_offsets - mutable beacon offsets ++ * @tim_offset: position of TIM element ++ * @tim_length: size of TIM element ++ * @csa_counter_offs: array of IEEE80211_MAX_CSA_COUNTERS_NUM offsets ++ * to CSA counters. This array can contain zero values which ++ * should be ignored. ++ */ ++struct ieee80211_mutable_offsets { ++ u16 tim_offset; ++ u16 tim_length; ++ ++ u16 csa_counter_offs[IEEE80211_MAX_CSA_COUNTERS_NUM]; ++}; ++ ++/** ++ * ieee80211_beacon_get_template - beacon template generation function ++ * @hw: pointer obtained from ieee80211_alloc_hw(). ++ * @vif: &struct ieee80211_vif pointer from the add_interface callback. ++ * @offs: &struct ieee80211_mutable_offsets pointer to struct that will ++ * receive the offsets that may be updated by the driver. ++ * ++ * If the driver implements beaconing modes, it must use this function to ++ * obtain the beacon template. ++ * ++ * This function should be used if the beacon frames are generated by the ++ * device, and then the driver must use the returned beacon as the template ++ * The driver or the device are responsible to update the DTIM and, when ++ * applicable, the CSA count. ++ * ++ * The driver is responsible for freeing the returned skb. ++ * ++ * Return: The beacon template. %NULL on error. ++ */ ++struct sk_buff * ++ieee80211_beacon_get_template(struct ieee80211_hw *hw, ++ struct ieee80211_vif *vif, ++ struct ieee80211_mutable_offsets *offs); ++ + /** + * ieee80211_beacon_get_tim - beacon generation function + * @hw: pointer obtained from ieee80211_alloc_hw(). +@@ -3418,16 +3463,12 @@ void ieee80211_report_low_ack(struct iee + * Set to 0 if invalid (in non-AP modes). + * + * If the driver implements beaconing modes, it must use this function to +- * obtain the beacon frame/template. ++ * obtain the beacon frame. + * + * If the beacon frames are generated by the host system (i.e., not in + * hardware/firmware), the driver uses this function to get each beacon +- * frame from mac80211 -- it is responsible for calling this function +- * before the beacon is needed (e.g. based on hardware interrupt). +- * +- * If the beacon frames are generated by the device, then the driver +- * must use the returned beacon as the template and change the TIM IE +- * according to the current DTIM parameters/TIM bitmap. ++ * frame from mac80211 -- it is responsible for calling this function exactly ++ * once before the beacon is needed (e.g. based on hardware interrupt). + * + * The driver is responsible for freeing the returned skb. + * +@@ -3453,6 +3494,20 @@ static inline struct sk_buff *ieee80211_ + } + + /** ++ * ieee80211_csa_update_counter - request mac80211 to decrement the csa counter ++ * @vif: &struct ieee80211_vif pointer from the add_interface callback. ++ * ++ * The csa counter should be updated after each beacon transmission. ++ * This function is called implicitly when ++ * ieee80211_beacon_get/ieee80211_beacon_get_tim are called, however if the ++ * beacon frames are generated by the device, the driver should call this ++ * function after each beacon transmission to sync mac80211's csa counters. ++ * ++ * Return: new csa counter value ++ */ ++u8 ieee80211_csa_update_counter(struct ieee80211_vif *vif); ++ ++/** + * ieee80211_csa_finish - notify mac80211 about channel switch + * @vif: &struct ieee80211_vif pointer from the add_interface callback. + * +--- a/include/uapi/linux/nl80211.h ++++ b/include/uapi/linux/nl80211.h +@@ -503,6 +503,9 @@ + * TX status event pertaining to the TX request. + * %NL80211_ATTR_TX_NO_CCK_RATE is used to decide whether to send the + * management frames at CCK rate or not in 2GHz band. ++ * %NL80211_ATTR_CSA_C_OFFSETS_TX is an array of offsets to CSA ++ * counters which will be updated to the current value. This attribute ++ * is used during CSA period. + * @NL80211_CMD_FRAME_WAIT_CANCEL: When an off-channel TX was requested, this + * command may be used with the corresponding cookie to cancel the wait + * time if it is known that it is no longer necessary. +@@ -1525,10 +1528,10 @@ enum nl80211_commands { + * operation). + * @NL80211_ATTR_CSA_IES: Nested set of attributes containing the IE information + * for the time while performing a channel switch. +- * @NL80211_ATTR_CSA_C_OFF_BEACON: Offset of the channel switch counter +- * field in the beacons tail (%NL80211_ATTR_BEACON_TAIL). +- * @NL80211_ATTR_CSA_C_OFF_PRESP: Offset of the channel switch counter +- * field in the probe response (%NL80211_ATTR_PROBE_RESP). ++ * @NL80211_ATTR_CSA_C_OFF_BEACON: An array of offsets (u16) to the channel ++ * switch counters in the beacons tail (%NL80211_ATTR_BEACON_TAIL). ++ * @NL80211_ATTR_CSA_C_OFF_PRESP: An array of offsets (u16) to the channel ++ * switch counters in the probe response (%NL80211_ATTR_PROBE_RESP). + * + * @NL80211_ATTR_RXMGMT_FLAGS: flags for nl80211_send_mgmt(), u32. + * As specified in the &enum nl80211_rxmgmt_flags. +@@ -1576,6 +1579,11 @@ enum nl80211_commands { + * advertise values that cannot always be met. In such cases, an attempt + * to add a new station entry with @NL80211_CMD_NEW_STATION may fail. + * ++ * @NL80211_ATTR_CSA_C_OFFSETS_TX: An array of csa counter offsets (u16) which ++ * should be updated when the frame is transmitted. ++ * @NL80211_ATTR_MAX_CSA_COUNTERS: U8 attribute used to advertise the maximum ++ * supported number of csa counters. ++ * + * @NL80211_ATTR_TDLS_PEER_CAPABILITY: flags for TDLS peer capabilities, u32. + * As specified in the &enum nl80211_tdls_peer_capability. + * +@@ -1920,6 +1928,9 @@ enum nl80211_attrs { + + NL80211_ATTR_IFACE_SOCKET_OWNER, + ++ NL80211_ATTR_CSA_C_OFFSETS_TX, ++ NL80211_ATTR_MAX_CSA_COUNTERS, ++ + /* add attributes here, update the policy in nl80211.c */ + + __NL80211_ATTR_AFTER_LAST, +@@ -3688,6 +3699,8 @@ enum nl80211_iface_limit_attrs { + * different channels may be used within this group. + * @NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS: u32 attribute containing the bitmap + * of supported channel widths for radar detection. ++ * @NL80211_IFACE_COMB_RADAR_DETECT_REGIONS: u32 attribute containing the bitmap ++ * of supported regulatory regions for radar detection. + * @NUM_NL80211_IFACE_COMB: number of attributes + * @MAX_NL80211_IFACE_COMB: highest attribute number + * +@@ -3721,6 +3734,7 @@ enum nl80211_if_combination_attrs { + NL80211_IFACE_COMB_STA_AP_BI_MATCH, + NL80211_IFACE_COMB_NUM_CHANNELS, + NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS, ++ NL80211_IFACE_COMB_RADAR_DETECT_REGIONS, + + /* keep last */ + NUM_NL80211_IFACE_COMB, +--- a/net/mac80211/Makefile ++++ b/net/mac80211/Makefile +@@ -25,7 +25,8 @@ mac80211-y := \ + wme.o \ + event.o \ + chan.o \ +- trace.o mlme.o ++ trace.o mlme.o \ ++ tdls.o + + mac80211-$(CPTCFG_MAC80211_LEDS) += led.o + mac80211-$(CPTCFG_MAC80211_DEBUGFS) += \ +--- a/net/mac80211/cfg.c ++++ b/net/mac80211/cfg.c +@@ -777,7 +777,7 @@ static void ieee80211_get_et_strings(str + } + + static int ieee80211_dump_station(struct wiphy *wiphy, struct net_device *dev, +- int idx, u8 *mac, struct station_info *sinfo) ++ int idx, u8 *mac, struct station_info *sinfo) + { + struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev); + struct ieee80211_local *local = sdata->local; +@@ -807,7 +807,7 @@ static int ieee80211_dump_survey(struct + } + + static int ieee80211_get_station(struct wiphy *wiphy, struct net_device *dev, +- u8 *mac, struct station_info *sinfo) ++ const u8 *mac, struct station_info *sinfo) + { + struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev); + struct ieee80211_local *local = sdata->local; +@@ -1084,6 +1084,31 @@ static int ieee80211_change_beacon(struc + return 0; + } + ++bool ieee80211_csa_needs_block_tx(struct ieee80211_local *local) ++{ ++ struct ieee80211_sub_if_data *sdata; ++ ++ lockdep_assert_held(&local->mtx); ++ ++ rcu_read_lock(); ++ list_for_each_entry_rcu(sdata, &local->interfaces, list) { ++ if (!ieee80211_sdata_running(sdata)) ++ continue; ++ ++ if (!sdata->vif.csa_active) ++ continue; ++ ++ if (!sdata->csa_block_tx) + continue; - power = min(power, sdata->vif.bss_conf.txpower); ++ ++ rcu_read_unlock(); ++ return true; ++ } ++ rcu_read_unlock(); ++ ++ return false; ++} ++ + static int ieee80211_stop_ap(struct wiphy *wiphy, struct net_device *dev) + { + struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev); +@@ -1101,7 +1126,14 @@ static int ieee80211_stop_ap(struct wiph + old_probe_resp = sdata_dereference(sdata->u.ap.probe_resp, sdata); + + /* abort any running channel switch */ ++ mutex_lock(&local->mtx); + sdata->vif.csa_active = false; ++ if (!ieee80211_csa_needs_block_tx(local)) ++ ieee80211_wake_queues_by_reason(&local->hw, ++ IEEE80211_MAX_QUEUE_MAP, ++ IEEE80211_QUEUE_STOP_REASON_CSA); ++ mutex_unlock(&local->mtx); ++ + kfree(sdata->u.ap.next_beacon); + sdata->u.ap.next_beacon = NULL; + +@@ -1425,7 +1457,8 @@ static int sta_apply_parameters(struct i + } + + static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev, +- u8 *mac, struct station_parameters *params) ++ const u8 *mac, ++ struct station_parameters *params) + { + struct ieee80211_local *local = wiphy_priv(wiphy); + struct sta_info *sta; +@@ -1459,6 +1492,8 @@ static int ieee80211_add_station(struct + if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))) { + sta_info_pre_move_state(sta, IEEE80211_STA_AUTH); + sta_info_pre_move_state(sta, IEEE80211_STA_ASSOC); ++ } else { ++ sta->sta.tdls = true; } - rcu_read_unlock(); -@@ -203,7 +205,7 @@ void ieee80211_bss_info_change_notify(st + + err = sta_apply_parameters(local, sta, params); +@@ -1492,7 +1527,7 @@ static int ieee80211_add_station(struct + } + + static int ieee80211_del_station(struct wiphy *wiphy, struct net_device *dev, +- u8 *mac) ++ const u8 *mac) + { + struct ieee80211_sub_if_data *sdata; + +@@ -1506,7 +1541,7 @@ static int ieee80211_del_station(struct + } + + static int ieee80211_change_station(struct wiphy *wiphy, +- struct net_device *dev, u8 *mac, ++ struct net_device *dev, const u8 *mac, + struct station_parameters *params) + { + struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev); +@@ -1631,7 +1666,7 @@ out_err: + + #ifdef CPTCFG_MAC80211_MESH + static int ieee80211_add_mpath(struct wiphy *wiphy, struct net_device *dev, +- u8 *dst, u8 *next_hop) ++ const u8 *dst, const u8 *next_hop) + { + struct ieee80211_sub_if_data *sdata; + struct mesh_path *mpath; +@@ -1659,7 +1694,7 @@ static int ieee80211_add_mpath(struct wi + } + + static int ieee80211_del_mpath(struct wiphy *wiphy, struct net_device *dev, +- u8 *dst) ++ const u8 *dst) + { + struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev); + +@@ -1670,9 +1705,8 @@ static int ieee80211_del_mpath(struct wi + return 0; + } + +-static int ieee80211_change_mpath(struct wiphy *wiphy, +- struct net_device *dev, +- u8 *dst, u8 *next_hop) ++static int ieee80211_change_mpath(struct wiphy *wiphy, struct net_device *dev, ++ const u8 *dst, const u8 *next_hop) + { + struct ieee80211_sub_if_data *sdata; + struct mesh_path *mpath; +@@ -1764,8 +1798,8 @@ static int ieee80211_get_mpath(struct wi + } + + static int ieee80211_dump_mpath(struct wiphy *wiphy, struct net_device *dev, +- int idx, u8 *dst, u8 *next_hop, +- struct mpath_info *pinfo) ++ int idx, u8 *dst, u8 *next_hop, ++ struct mpath_info *pinfo) + { + struct ieee80211_sub_if_data *sdata; + struct mesh_path *mpath; +@@ -3019,26 +3053,11 @@ void ieee80211_csa_finish(struct ieee802 + } + EXPORT_SYMBOL(ieee80211_csa_finish); + +-static void ieee80211_csa_finalize(struct ieee80211_sub_if_data *sdata) ++static int ieee80211_set_after_csa_beacon(struct ieee80211_sub_if_data *sdata, ++ u32 *changed) + { +- struct ieee80211_local *local = sdata->local; +- int err, changed = 0; +- +- sdata_assert_lock(sdata); +- +- mutex_lock(&local->mtx); +- sdata->radar_required = sdata->csa_radar_required; +- err = ieee80211_vif_change_channel(sdata, &changed); +- mutex_unlock(&local->mtx); +- if (WARN_ON(err < 0)) +- return; +- +- if (!local->use_chanctx) { +- local->_oper_chandef = sdata->csa_chandef; +- ieee80211_hw_config(local, 0); +- } ++ int err; + +- sdata->vif.csa_active = false; + switch (sdata->vif.type) { + case NL80211_IFTYPE_AP: + err = ieee80211_assign_beacon(sdata, sdata->u.ap.next_beacon); +@@ -3046,35 +3065,75 @@ static void ieee80211_csa_finalize(struc + sdata->u.ap.next_beacon = NULL; + + if (err < 0) +- return; +- changed |= err; ++ return err; ++ *changed |= err; + break; + case NL80211_IFTYPE_ADHOC: + err = ieee80211_ibss_finish_csa(sdata); + if (err < 0) +- return; +- changed |= err; ++ return err; ++ *changed |= err; + break; + #ifdef CPTCFG_MAC80211_MESH + case NL80211_IFTYPE_MESH_POINT: + err = ieee80211_mesh_finish_csa(sdata); + if (err < 0) +- return; +- changed |= err; ++ return err; ++ *changed |= err; + break; + #endif + default: + WARN_ON(1); +- return; ++ return -EINVAL; + } + ++ ++ return 0; ++} ++ ++static int __ieee80211_csa_finalize(struct ieee80211_sub_if_data *sdata) ++{ ++ struct ieee80211_local *local = sdata->local; ++ u32 changed = 0; ++ int err; ++ ++ sdata_assert_lock(sdata); ++ lockdep_assert_held(&local->mtx); ++ ++ sdata->radar_required = sdata->csa_radar_required; ++ err = ieee80211_vif_change_channel(sdata, &changed); ++ if (err < 0) ++ return err; ++ ++ if (!local->use_chanctx) { ++ local->_oper_chandef = sdata->csa_chandef; ++ ieee80211_hw_config(local, 0); ++ } ++ ++ sdata->vif.csa_active = false; ++ ++ err = ieee80211_set_after_csa_beacon(sdata, &changed); ++ if (err) ++ return err; ++ + ieee80211_bss_info_change_notify(sdata, changed); ++ cfg80211_ch_switch_notify(sdata->dev, &sdata->csa_chandef); + +- ieee80211_wake_queues_by_reason(&sdata->local->hw, ++ if (!ieee80211_csa_needs_block_tx(local)) ++ ieee80211_wake_queues_by_reason(&local->hw, + IEEE80211_MAX_QUEUE_MAP, + IEEE80211_QUEUE_STOP_REASON_CSA); + +- cfg80211_ch_switch_notify(sdata->dev, &sdata->csa_chandef); ++ return 0; ++} ++ ++static void ieee80211_csa_finalize(struct ieee80211_sub_if_data *sdata) ++{ ++ if (__ieee80211_csa_finalize(sdata)) { ++ sdata_info(sdata, "failed to finalize CSA, disconnecting\n"); ++ cfg80211_stop_iface(sdata->local->hw.wiphy, &sdata->wdev, ++ GFP_KERNEL); ++ } + } + + void ieee80211_csa_finalize_work(struct work_struct *work) +@@ -3082,8 +3141,11 @@ void ieee80211_csa_finalize_work(struct + struct ieee80211_sub_if_data *sdata = + container_of(work, struct ieee80211_sub_if_data, + csa_finalize_work); ++ struct ieee80211_local *local = sdata->local; + + sdata_lock(sdata); ++ mutex_lock(&local->mtx); ++ + /* AP might have been stopped while waiting for the lock. */ + if (!sdata->vif.csa_active) + goto unlock; +@@ -3094,6 +3156,7 @@ void ieee80211_csa_finalize_work(struct + ieee80211_csa_finalize(sdata); + + unlock: ++ mutex_unlock(&local->mtx); + sdata_unlock(sdata); + } + +@@ -3129,9 +3192,25 @@ static int ieee80211_set_csa_beacon(stru + if (params->count <= 1) + break; + +- sdata->csa_counter_offset_beacon = +- params->counter_offset_beacon; +- sdata->csa_counter_offset_presp = params->counter_offset_presp; ++ if ((params->n_counter_offsets_beacon > ++ IEEE80211_MAX_CSA_COUNTERS_NUM) || ++ (params->n_counter_offsets_presp > ++ IEEE80211_MAX_CSA_COUNTERS_NUM)) ++ return -EINVAL; ++ ++ /* make sure we don't have garbage in other counters */ ++ memset(sdata->csa_counter_offset_beacon, 0, ++ sizeof(sdata->csa_counter_offset_beacon)); ++ memset(sdata->csa_counter_offset_presp, 0, ++ sizeof(sdata->csa_counter_offset_presp)); ++ ++ memcpy(sdata->csa_counter_offset_beacon, ++ params->counter_offsets_beacon, ++ params->n_counter_offsets_beacon * sizeof(u16)); ++ memcpy(sdata->csa_counter_offset_presp, ++ params->counter_offsets_presp, ++ params->n_counter_offsets_presp * sizeof(u16)); ++ + err = ieee80211_assign_beacon(sdata, ¶ms->beacon_csa); + if (err < 0) { + kfree(sdata->u.ap.next_beacon); +@@ -3220,8 +3299,9 @@ static int ieee80211_set_csa_beacon(stru + return 0; + } + +-int ieee80211_channel_switch(struct wiphy *wiphy, struct net_device *dev, +- struct cfg80211_csa_settings *params) ++static int ++__ieee80211_channel_switch(struct wiphy *wiphy, struct net_device *dev, ++ struct cfg80211_csa_settings *params) { + struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev); struct ieee80211_local *local = sdata->local; +@@ -3230,6 +3310,7 @@ int ieee80211_channel_switch(struct wiph + int err, num_chanctx, changed = 0; + + sdata_assert_lock(sdata); ++ lockdep_assert_held(&local->mtx); -- if (!changed) -+ if (!changed || sdata->vif.type == NL80211_IFTYPE_AP_VLAN) + if (!list_empty(&local->roc_list) || local->scanning) + return -EBUSY; +@@ -3272,15 +3353,16 @@ int ieee80211_channel_switch(struct wiph + return err; + + sdata->csa_radar_required = params->radar_required; +- +- if (params->block_tx) +- ieee80211_stop_queues_by_reason(&local->hw, +- IEEE80211_MAX_QUEUE_MAP, +- IEEE80211_QUEUE_STOP_REASON_CSA); +- + sdata->csa_chandef = params->chandef; ++ sdata->csa_block_tx = params->block_tx; ++ sdata->csa_current_counter = params->count; + sdata->vif.csa_active = true; + ++ if (sdata->csa_block_tx) ++ ieee80211_stop_queues_by_reason(&local->hw, ++ IEEE80211_MAX_QUEUE_MAP, ++ IEEE80211_QUEUE_STOP_REASON_CSA); ++ + if (changed) { + ieee80211_bss_info_change_notify(sdata, changed); + drv_channel_switch_beacon(sdata, ¶ms->chandef); +@@ -3292,6 +3374,20 @@ int ieee80211_channel_switch(struct wiph + return 0; + } + ++int ieee80211_channel_switch(struct wiphy *wiphy, struct net_device *dev, ++ struct cfg80211_csa_settings *params) ++{ ++ struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev); ++ struct ieee80211_local *local = sdata->local; ++ int err; ++ ++ mutex_lock(&local->mtx); ++ err = __ieee80211_channel_switch(wiphy, dev, params); ++ mutex_unlock(&local->mtx); ++ ++ return err; ++} ++ + static int ieee80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev, + struct cfg80211_mgmt_tx_params *params, + u64 *cookie) +@@ -3304,6 +3400,7 @@ static int ieee80211_mgmt_tx(struct wiph + bool need_offchan = false; + u32 flags; + int ret; ++ u8 *data; + + if (params->dont_wait_for_ack) + flags = IEEE80211_TX_CTL_NO_ACK; +@@ -3397,7 +3494,20 @@ static int ieee80211_mgmt_tx(struct wiph + } + skb_reserve(skb, local->hw.extra_tx_headroom); + +- memcpy(skb_put(skb, params->len), params->buf, params->len); ++ data = skb_put(skb, params->len); ++ memcpy(data, params->buf, params->len); ++ ++ /* Update CSA counters */ ++ if (sdata->vif.csa_active && ++ (sdata->vif.type == NL80211_IFTYPE_AP || ++ sdata->vif.type == NL80211_IFTYPE_ADHOC) && ++ params->n_csa_offsets) { ++ int i; ++ u8 c = sdata->csa_current_counter; ++ ++ for (i = 0; i < params->n_csa_offsets; i++) ++ data[params->csa_offsets[i]] = c; ++ } + + IEEE80211_SKB_CB(skb)->flags = flags; + +@@ -3506,320 +3616,6 @@ static int ieee80211_set_rekey_data(stru + return 0; + } + +-static void ieee80211_tdls_add_ext_capab(struct sk_buff *skb) +-{ +- u8 *pos = (void *)skb_put(skb, 7); +- +- *pos++ = WLAN_EID_EXT_CAPABILITY; +- *pos++ = 5; /* len */ +- *pos++ = 0x0; +- *pos++ = 0x0; +- *pos++ = 0x0; +- *pos++ = 0x0; +- *pos++ = WLAN_EXT_CAPA5_TDLS_ENABLED; +-} +- +-static u16 ieee80211_get_tdls_sta_capab(struct ieee80211_sub_if_data *sdata) +-{ +- struct ieee80211_local *local = sdata->local; +- u16 capab; +- +- capab = 0; +- if (ieee80211_get_sdata_band(sdata) != IEEE80211_BAND_2GHZ) +- return capab; +- +- if (!(local->hw.flags & IEEE80211_HW_2GHZ_SHORT_SLOT_INCAPABLE)) +- capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME; +- if (!(local->hw.flags & IEEE80211_HW_2GHZ_SHORT_PREAMBLE_INCAPABLE)) +- capab |= WLAN_CAPABILITY_SHORT_PREAMBLE; +- +- return capab; +-} +- +-static void ieee80211_tdls_add_link_ie(struct sk_buff *skb, u8 *src_addr, +- u8 *peer, u8 *bssid) +-{ +- struct ieee80211_tdls_lnkie *lnkid; +- +- lnkid = (void *)skb_put(skb, sizeof(struct ieee80211_tdls_lnkie)); +- +- lnkid->ie_type = WLAN_EID_LINK_ID; +- lnkid->ie_len = sizeof(struct ieee80211_tdls_lnkie) - 2; +- +- memcpy(lnkid->bssid, bssid, ETH_ALEN); +- memcpy(lnkid->init_sta, src_addr, ETH_ALEN); +- memcpy(lnkid->resp_sta, peer, ETH_ALEN); +-} +- +-static int +-ieee80211_prep_tdls_encap_data(struct wiphy *wiphy, struct net_device *dev, +- u8 *peer, u8 action_code, u8 dialog_token, +- u16 status_code, struct sk_buff *skb) +-{ +- struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev); +- enum ieee80211_band band = ieee80211_get_sdata_band(sdata); +- struct ieee80211_tdls_data *tf; +- +- tf = (void *)skb_put(skb, offsetof(struct ieee80211_tdls_data, u)); +- +- memcpy(tf->da, peer, ETH_ALEN); +- memcpy(tf->sa, sdata->vif.addr, ETH_ALEN); +- tf->ether_type = cpu_to_be16(ETH_P_TDLS); +- tf->payload_type = WLAN_TDLS_SNAP_RFTYPE; +- +- switch (action_code) { +- case WLAN_TDLS_SETUP_REQUEST: +- tf->category = WLAN_CATEGORY_TDLS; +- tf->action_code = WLAN_TDLS_SETUP_REQUEST; +- +- skb_put(skb, sizeof(tf->u.setup_req)); +- tf->u.setup_req.dialog_token = dialog_token; +- tf->u.setup_req.capability = +- cpu_to_le16(ieee80211_get_tdls_sta_capab(sdata)); +- +- ieee80211_add_srates_ie(sdata, skb, false, band); +- ieee80211_add_ext_srates_ie(sdata, skb, false, band); +- ieee80211_tdls_add_ext_capab(skb); +- break; +- case WLAN_TDLS_SETUP_RESPONSE: +- tf->category = WLAN_CATEGORY_TDLS; +- tf->action_code = WLAN_TDLS_SETUP_RESPONSE; +- +- skb_put(skb, sizeof(tf->u.setup_resp)); +- tf->u.setup_resp.status_code = cpu_to_le16(status_code); +- tf->u.setup_resp.dialog_token = dialog_token; +- tf->u.setup_resp.capability = +- cpu_to_le16(ieee80211_get_tdls_sta_capab(sdata)); +- +- ieee80211_add_srates_ie(sdata, skb, false, band); +- ieee80211_add_ext_srates_ie(sdata, skb, false, band); +- ieee80211_tdls_add_ext_capab(skb); +- break; +- case WLAN_TDLS_SETUP_CONFIRM: +- tf->category = WLAN_CATEGORY_TDLS; +- tf->action_code = WLAN_TDLS_SETUP_CONFIRM; +- +- skb_put(skb, sizeof(tf->u.setup_cfm)); +- tf->u.setup_cfm.status_code = cpu_to_le16(status_code); +- tf->u.setup_cfm.dialog_token = dialog_token; +- break; +- case WLAN_TDLS_TEARDOWN: +- tf->category = WLAN_CATEGORY_TDLS; +- tf->action_code = WLAN_TDLS_TEARDOWN; +- +- skb_put(skb, sizeof(tf->u.teardown)); +- tf->u.teardown.reason_code = cpu_to_le16(status_code); +- break; +- case WLAN_TDLS_DISCOVERY_REQUEST: +- tf->category = WLAN_CATEGORY_TDLS; +- tf->action_code = WLAN_TDLS_DISCOVERY_REQUEST; +- +- skb_put(skb, sizeof(tf->u.discover_req)); +- tf->u.discover_req.dialog_token = dialog_token; +- break; +- default: +- return -EINVAL; +- } +- +- return 0; +-} +- +-static int +-ieee80211_prep_tdls_direct(struct wiphy *wiphy, struct net_device *dev, +- u8 *peer, u8 action_code, u8 dialog_token, +- u16 status_code, struct sk_buff *skb) +-{ +- struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev); +- enum ieee80211_band band = ieee80211_get_sdata_band(sdata); +- struct ieee80211_mgmt *mgmt; +- +- mgmt = (void *)skb_put(skb, 24); +- memset(mgmt, 0, 24); +- memcpy(mgmt->da, peer, ETH_ALEN); +- memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN); +- memcpy(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN); +- +- mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT | +- IEEE80211_STYPE_ACTION); +- +- switch (action_code) { +- case WLAN_PUB_ACTION_TDLS_DISCOVER_RES: +- skb_put(skb, 1 + sizeof(mgmt->u.action.u.tdls_discover_resp)); +- mgmt->u.action.category = WLAN_CATEGORY_PUBLIC; +- mgmt->u.action.u.tdls_discover_resp.action_code = +- WLAN_PUB_ACTION_TDLS_DISCOVER_RES; +- mgmt->u.action.u.tdls_discover_resp.dialog_token = +- dialog_token; +- mgmt->u.action.u.tdls_discover_resp.capability = +- cpu_to_le16(ieee80211_get_tdls_sta_capab(sdata)); +- +- ieee80211_add_srates_ie(sdata, skb, false, band); +- ieee80211_add_ext_srates_ie(sdata, skb, false, band); +- ieee80211_tdls_add_ext_capab(skb); +- break; +- default: +- return -EINVAL; +- } +- +- return 0; +-} +- +-static int ieee80211_tdls_mgmt(struct wiphy *wiphy, struct net_device *dev, +- u8 *peer, u8 action_code, u8 dialog_token, +- u16 status_code, u32 peer_capability, +- const u8 *extra_ies, size_t extra_ies_len) +-{ +- struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev); +- struct ieee80211_local *local = sdata->local; +- struct sk_buff *skb = NULL; +- bool send_direct; +- int ret; +- +- if (!(wiphy->flags & WIPHY_FLAG_SUPPORTS_TDLS)) +- return -ENOTSUPP; +- +- /* make sure we are in managed mode, and associated */ +- if (sdata->vif.type != NL80211_IFTYPE_STATION || +- !sdata->u.mgd.associated) +- return -EINVAL; +- +- tdls_dbg(sdata, "TDLS mgmt action %d peer %pM\n", +- action_code, peer); +- +- skb = dev_alloc_skb(local->hw.extra_tx_headroom + +- max(sizeof(struct ieee80211_mgmt), +- sizeof(struct ieee80211_tdls_data)) + +- 50 + /* supported rates */ +- 7 + /* ext capab */ +- extra_ies_len + +- sizeof(struct ieee80211_tdls_lnkie)); +- if (!skb) +- return -ENOMEM; +- +- skb_reserve(skb, local->hw.extra_tx_headroom); +- +- switch (action_code) { +- case WLAN_TDLS_SETUP_REQUEST: +- case WLAN_TDLS_SETUP_RESPONSE: +- case WLAN_TDLS_SETUP_CONFIRM: +- case WLAN_TDLS_TEARDOWN: +- case WLAN_TDLS_DISCOVERY_REQUEST: +- ret = ieee80211_prep_tdls_encap_data(wiphy, dev, peer, +- action_code, dialog_token, +- status_code, skb); +- send_direct = false; +- break; +- case WLAN_PUB_ACTION_TDLS_DISCOVER_RES: +- ret = ieee80211_prep_tdls_direct(wiphy, dev, peer, action_code, +- dialog_token, status_code, +- skb); +- send_direct = true; +- break; +- default: +- ret = -ENOTSUPP; +- break; +- } +- +- if (ret < 0) +- goto fail; +- +- if (extra_ies_len) +- memcpy(skb_put(skb, extra_ies_len), extra_ies, extra_ies_len); +- +- /* the TDLS link IE is always added last */ +- switch (action_code) { +- case WLAN_TDLS_SETUP_REQUEST: +- case WLAN_TDLS_SETUP_CONFIRM: +- case WLAN_TDLS_TEARDOWN: +- case WLAN_TDLS_DISCOVERY_REQUEST: +- /* we are the initiator */ +- ieee80211_tdls_add_link_ie(skb, sdata->vif.addr, peer, +- sdata->u.mgd.bssid); +- break; +- case WLAN_TDLS_SETUP_RESPONSE: +- case WLAN_PUB_ACTION_TDLS_DISCOVER_RES: +- /* we are the responder */ +- ieee80211_tdls_add_link_ie(skb, peer, sdata->vif.addr, +- sdata->u.mgd.bssid); +- break; +- default: +- ret = -ENOTSUPP; +- goto fail; +- } +- +- if (send_direct) { +- ieee80211_tx_skb(sdata, skb); +- return 0; +- } +- +- /* +- * According to 802.11z: Setup req/resp are sent in AC_BK, otherwise +- * we should default to AC_VI. +- */ +- switch (action_code) { +- case WLAN_TDLS_SETUP_REQUEST: +- case WLAN_TDLS_SETUP_RESPONSE: +- skb_set_queue_mapping(skb, IEEE80211_AC_BK); +- skb->priority = 2; +- break; +- default: +- skb_set_queue_mapping(skb, IEEE80211_AC_VI); +- skb->priority = 5; +- break; +- } +- +- /* disable bottom halves when entering the Tx path */ +- local_bh_disable(); +- ret = ieee80211_subif_start_xmit(skb, dev); +- local_bh_enable(); +- +- return ret; +- +-fail: +- dev_kfree_skb(skb); +- return ret; +-} +- +-static int ieee80211_tdls_oper(struct wiphy *wiphy, struct net_device *dev, +- u8 *peer, enum nl80211_tdls_operation oper) +-{ +- struct sta_info *sta; +- struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev); +- +- if (!(wiphy->flags & WIPHY_FLAG_SUPPORTS_TDLS)) +- return -ENOTSUPP; +- +- if (sdata->vif.type != NL80211_IFTYPE_STATION) +- return -EINVAL; +- +- tdls_dbg(sdata, "TDLS oper %d peer %pM\n", oper, peer); +- +- switch (oper) { +- case NL80211_TDLS_ENABLE_LINK: +- rcu_read_lock(); +- sta = sta_info_get(sdata, peer); +- if (!sta) { +- rcu_read_unlock(); +- return -ENOLINK; +- } +- +- set_sta_flag(sta, WLAN_STA_TDLS_PEER_AUTH); +- rcu_read_unlock(); +- break; +- case NL80211_TDLS_DISABLE_LINK: +- return sta_info_destroy_addr(sdata, peer); +- case NL80211_TDLS_TEARDOWN: +- case NL80211_TDLS_SETUP: +- case NL80211_TDLS_DISCOVERY_REQ: +- /* We don't support in-driver setup/teardown/discovery */ +- return -ENOTSUPP; +- default: +- return -ENOTSUPP; +- } +- +- return 0; +-} +- + static int ieee80211_probe_client(struct wiphy *wiphy, struct net_device *dev, + const u8 *peer, u64 *cookie) + { +--- a/net/mac80211/chan.c ++++ b/net/mac80211/chan.c +@@ -855,7 +855,7 @@ static void + __ieee80211_vif_copy_chanctx_to_vlans(struct ieee80211_sub_if_data *sdata, + bool clear) + { +- struct ieee80211_local *local = sdata->local; ++ struct ieee80211_local *local __maybe_unused = sdata->local; + struct ieee80211_sub_if_data *vlan; + struct ieee80211_chanctx_conf *conf; + +@@ -871,7 +871,7 @@ __ieee80211_vif_copy_chanctx_to_vlans(st + * to a channel context that has already been freed. + */ + conf = rcu_dereference_protected(sdata->vif.chanctx_conf, +- lockdep_is_held(&local->chanctx_mtx)); ++ lockdep_is_held(&local->chanctx_mtx)); + WARN_ON(!conf); + + if (clear) +--- a/net/mac80211/driver-ops.h ++++ b/net/mac80211/driver-ops.h +@@ -5,11 +5,11 @@ + #include "ieee80211_i.h" + #include "trace.h" + +-static inline void check_sdata_in_driver(struct ieee80211_sub_if_data *sdata) ++static inline bool check_sdata_in_driver(struct ieee80211_sub_if_data *sdata) + { +- WARN(!(sdata->flags & IEEE80211_SDATA_IN_DRIVER), +- "%s: Failed check-sdata-in-driver check, flags: 0x%x\n", +- sdata->dev ? sdata->dev->name : sdata->name, sdata->flags); ++ return !WARN(!(sdata->flags & IEEE80211_SDATA_IN_DRIVER), ++ "%s: Failed check-sdata-in-driver check, flags: 0x%x\n", ++ sdata->dev ? sdata->dev->name : sdata->name, sdata->flags); + } + + static inline struct ieee80211_sub_if_data * +@@ -168,7 +168,8 @@ static inline int drv_change_interface(s + + might_sleep(); + +- check_sdata_in_driver(sdata); ++ if (!check_sdata_in_driver(sdata)) ++ return -EIO; + + trace_drv_change_interface(local, sdata, type, p2p); + ret = local->ops->change_interface(&local->hw, &sdata->vif, type, p2p); +@@ -181,7 +182,8 @@ static inline void drv_remove_interface( + { + might_sleep(); + +- check_sdata_in_driver(sdata); ++ if (!check_sdata_in_driver(sdata)) ++ return; + + trace_drv_remove_interface(local, sdata); + local->ops->remove_interface(&local->hw, &sdata->vif); +@@ -219,7 +221,8 @@ static inline void drv_bss_info_changed( + sdata->vif.type == NL80211_IFTYPE_MONITOR)) return; - drv_bss_info_changed(local, sdata, &sdata->vif.bss_conf, changed); ---- a/drivers/net/wireless/ath/ath9k/ani.c -+++ b/drivers/net/wireless/ath/ath9k/ani.c -@@ -155,6 +155,9 @@ static void ath9k_hw_set_ofdm_nil(struct - ATH9K_ANI_RSSI_THR_LOW, - ATH9K_ANI_RSSI_THR_HIGH); - -+ if (AR_SREV_9100(ah) && immunityLevel < ATH9K_ANI_OFDM_DEF_LEVEL) -+ immunityLevel = ATH9K_ANI_OFDM_DEF_LEVEL; -+ - if (!scan) - aniState->ofdmNoiseImmunityLevel = immunityLevel; - -@@ -235,6 +238,9 @@ static void ath9k_hw_set_cck_nil(struct - BEACON_RSSI(ah), ATH9K_ANI_RSSI_THR_LOW, - ATH9K_ANI_RSSI_THR_HIGH); - -+ if (AR_SREV_9100(ah) && immunityLevel < ATH9K_ANI_CCK_DEF_LEVEL) -+ immunityLevel = ATH9K_ANI_CCK_DEF_LEVEL; -+ - if (ah->opmode == NL80211_IFTYPE_STATION && - BEACON_RSSI(ah) <= ATH9K_ANI_RSSI_THR_LOW && - immunityLevel > ATH9K_ANI_CCK_MAX_LEVEL_LOW_RSSI) ---- a/drivers/net/wireless/ath/ath9k/ath9k.h -+++ b/drivers/net/wireless/ath/ath9k/ath9k.h -@@ -251,7 +251,6 @@ struct ath_atx_tid { - - s8 bar_index; - bool sched; -- bool paused; - bool active; - }; +- check_sdata_in_driver(sdata); ++ if (!check_sdata_in_driver(sdata)) ++ return; + + trace_drv_bss_info_changed(local, sdata, info, changed); + if (local->ops->bss_info_changed) +@@ -278,7 +281,8 @@ static inline int drv_set_key(struct iee + might_sleep(); + + sdata = get_bss_sdata(sdata); +- check_sdata_in_driver(sdata); ++ if (!check_sdata_in_driver(sdata)) ++ return -EIO; + + trace_drv_set_key(local, cmd, sdata, sta, key); + ret = local->ops->set_key(&local->hw, cmd, &sdata->vif, sta, key); +@@ -298,7 +302,8 @@ static inline void drv_update_tkip_key(s + ista = &sta->sta; + + sdata = get_bss_sdata(sdata); +- check_sdata_in_driver(sdata); ++ if (!check_sdata_in_driver(sdata)) ++ return; + + trace_drv_update_tkip_key(local, sdata, conf, ista, iv32); + if (local->ops->update_tkip_key) +@@ -315,7 +320,8 @@ static inline int drv_hw_scan(struct iee + + might_sleep(); + +- check_sdata_in_driver(sdata); ++ if (!check_sdata_in_driver(sdata)) ++ return -EIO; ---- a/drivers/net/wireless/ath/ath9k/xmit.c -+++ b/drivers/net/wireless/ath/ath9k/xmit.c -@@ -107,9 +107,6 @@ static void ath_tx_queue_tid(struct ath_ + trace_drv_hw_scan(local, sdata); + ret = local->ops->hw_scan(&local->hw, &sdata->vif, req); +@@ -328,7 +334,8 @@ static inline void drv_cancel_hw_scan(st { - struct ath_atx_ac *ac = tid->ac; + might_sleep(); -- if (tid->paused) -- return; +- check_sdata_in_driver(sdata); ++ if (!check_sdata_in_driver(sdata)) ++ return; + + trace_drv_cancel_hw_scan(local, sdata); + local->ops->cancel_hw_scan(&local->hw, &sdata->vif); +@@ -345,7 +352,8 @@ drv_sched_scan_start(struct ieee80211_lo + + might_sleep(); + +- check_sdata_in_driver(sdata); ++ if (!check_sdata_in_driver(sdata)) ++ return -EIO; + + trace_drv_sched_scan_start(local, sdata); + ret = local->ops->sched_scan_start(&local->hw, &sdata->vif, +@@ -361,7 +369,8 @@ static inline int drv_sched_scan_stop(st + + might_sleep(); + +- check_sdata_in_driver(sdata); ++ if (!check_sdata_in_driver(sdata)) ++ return -EIO; + + trace_drv_sched_scan_stop(local, sdata); + ret = local->ops->sched_scan_stop(&local->hw, &sdata->vif); +@@ -462,7 +471,8 @@ static inline void drv_sta_notify(struct + struct ieee80211_sta *sta) + { + sdata = get_bss_sdata(sdata); +- check_sdata_in_driver(sdata); ++ if (!check_sdata_in_driver(sdata)) ++ return; + + trace_drv_sta_notify(local, sdata, cmd, sta); + if (local->ops->sta_notify) +@@ -479,7 +489,8 @@ static inline int drv_sta_add(struct iee + might_sleep(); + + sdata = get_bss_sdata(sdata); +- check_sdata_in_driver(sdata); ++ if (!check_sdata_in_driver(sdata)) ++ return -EIO; + + trace_drv_sta_add(local, sdata, sta); + if (local->ops->sta_add) +@@ -497,7 +508,8 @@ static inline void drv_sta_remove(struct + might_sleep(); + + sdata = get_bss_sdata(sdata); +- check_sdata_in_driver(sdata); ++ if (!check_sdata_in_driver(sdata)) ++ return; + + trace_drv_sta_remove(local, sdata, sta); + if (local->ops->sta_remove) +@@ -515,7 +527,8 @@ static inline void drv_sta_add_debugfs(s + might_sleep(); + + sdata = get_bss_sdata(sdata); +- check_sdata_in_driver(sdata); ++ if (!check_sdata_in_driver(sdata)) ++ return; + + if (local->ops->sta_add_debugfs) + local->ops->sta_add_debugfs(&local->hw, &sdata->vif, +@@ -545,7 +558,8 @@ static inline void drv_sta_pre_rcu_remov + might_sleep(); + + sdata = get_bss_sdata(sdata); +- check_sdata_in_driver(sdata); ++ if (!check_sdata_in_driver(sdata)) ++ return; + + trace_drv_sta_pre_rcu_remove(local, sdata, &sta->sta); + if (local->ops->sta_pre_rcu_remove) +@@ -566,7 +580,8 @@ int drv_sta_state(struct ieee80211_local + might_sleep(); + + sdata = get_bss_sdata(sdata); +- check_sdata_in_driver(sdata); ++ if (!check_sdata_in_driver(sdata)) ++ return -EIO; + + trace_drv_sta_state(local, sdata, &sta->sta, old_state, new_state); + if (local->ops->sta_state) { +@@ -590,7 +605,8 @@ static inline void drv_sta_rc_update(str + struct ieee80211_sta *sta, u32 changed) + { + sdata = get_bss_sdata(sdata); +- check_sdata_in_driver(sdata); ++ if (!check_sdata_in_driver(sdata)) ++ return; + + WARN_ON(changed & IEEE80211_RC_SUPP_RATES_CHANGED && + (sdata->vif.type != NL80211_IFTYPE_ADHOC && +@@ -612,7 +628,8 @@ static inline int drv_conf_tx(struct iee + + might_sleep(); + +- check_sdata_in_driver(sdata); ++ if (!check_sdata_in_driver(sdata)) ++ return -EIO; + + trace_drv_conf_tx(local, sdata, ac, params); + if (local->ops->conf_tx) +@@ -629,7 +646,8 @@ static inline u64 drv_get_tsf(struct iee + + might_sleep(); + +- check_sdata_in_driver(sdata); ++ if (!check_sdata_in_driver(sdata)) ++ return ret; + + trace_drv_get_tsf(local, sdata); + if (local->ops->get_tsf) +@@ -644,7 +662,8 @@ static inline void drv_set_tsf(struct ie + { + might_sleep(); + +- check_sdata_in_driver(sdata); ++ if (!check_sdata_in_driver(sdata)) ++ return; + + trace_drv_set_tsf(local, sdata, tsf); + if (local->ops->set_tsf) +@@ -657,7 +676,8 @@ static inline void drv_reset_tsf(struct + { + might_sleep(); + +- check_sdata_in_driver(sdata); ++ if (!check_sdata_in_driver(sdata)) ++ return; + + trace_drv_reset_tsf(local, sdata); + if (local->ops->reset_tsf) +@@ -689,7 +709,8 @@ static inline int drv_ampdu_action(struc + might_sleep(); + + sdata = get_bss_sdata(sdata); +- check_sdata_in_driver(sdata); ++ if (!check_sdata_in_driver(sdata)) ++ return -EIO; + + trace_drv_ampdu_action(local, sdata, action, sta, tid, ssn, buf_size); + +@@ -733,8 +754,8 @@ static inline void drv_flush(struct ieee + + might_sleep(); + +- if (sdata) +- check_sdata_in_driver(sdata); ++ if (sdata && !check_sdata_in_driver(sdata)) ++ return; + + trace_drv_flush(local, queues, drop); + if (local->ops->flush) +@@ -854,7 +875,8 @@ static inline int drv_set_bitrate_mask(s + + might_sleep(); + +- check_sdata_in_driver(sdata); ++ if (!check_sdata_in_driver(sdata)) ++ return -EIO; + + trace_drv_set_bitrate_mask(local, sdata, mask); + if (local->ops->set_bitrate_mask) +@@ -869,7 +891,8 @@ static inline void drv_set_rekey_data(st + struct ieee80211_sub_if_data *sdata, + struct cfg80211_gtk_rekey_data *data) + { +- check_sdata_in_driver(sdata); ++ if (!check_sdata_in_driver(sdata)) ++ return; + + trace_drv_set_rekey_data(local, sdata, data); + if (local->ops->set_rekey_data) +@@ -937,7 +960,8 @@ static inline void drv_mgd_prepare_tx(st + { + might_sleep(); + +- check_sdata_in_driver(sdata); ++ if (!check_sdata_in_driver(sdata)) ++ return; + WARN_ON_ONCE(sdata->vif.type != NL80211_IFTYPE_STATION); + + trace_drv_mgd_prepare_tx(local, sdata); +@@ -964,6 +988,9 @@ static inline int drv_add_chanctx(struct + static inline void drv_remove_chanctx(struct ieee80211_local *local, + struct ieee80211_chanctx *ctx) + { ++ if (WARN_ON(!ctx->driver_present)) ++ return; ++ + trace_drv_remove_chanctx(local, ctx); + if (local->ops->remove_chanctx) + local->ops->remove_chanctx(&local->hw, &ctx->conf); +@@ -989,7 +1016,8 @@ static inline int drv_assign_vif_chanctx + { + int ret = 0; + +- check_sdata_in_driver(sdata); ++ if (!check_sdata_in_driver(sdata)) ++ return -EIO; + + trace_drv_assign_vif_chanctx(local, sdata, ctx); + if (local->ops->assign_vif_chanctx) { +@@ -1007,7 +1035,8 @@ static inline void drv_unassign_vif_chan + struct ieee80211_sub_if_data *sdata, + struct ieee80211_chanctx *ctx) + { +- check_sdata_in_driver(sdata); ++ if (!check_sdata_in_driver(sdata)) ++ return; + + trace_drv_unassign_vif_chanctx(local, sdata, ctx); + if (local->ops->unassign_vif_chanctx) { +@@ -1024,7 +1053,8 @@ static inline int drv_start_ap(struct ie + { + int ret = 0; + +- check_sdata_in_driver(sdata); ++ if (!check_sdata_in_driver(sdata)) ++ return -EIO; + + trace_drv_start_ap(local, sdata, &sdata->vif.bss_conf); + if (local->ops->start_ap) +@@ -1036,7 +1066,8 @@ static inline int drv_start_ap(struct ie + static inline void drv_stop_ap(struct ieee80211_local *local, + struct ieee80211_sub_if_data *sdata) + { +- check_sdata_in_driver(sdata); ++ if (!check_sdata_in_driver(sdata)) ++ return; + + trace_drv_stop_ap(local, sdata); + if (local->ops->stop_ap) +@@ -1059,7 +1090,8 @@ drv_set_default_unicast_key(struct ieee8 + struct ieee80211_sub_if_data *sdata, + int key_idx) + { +- check_sdata_in_driver(sdata); ++ if (!check_sdata_in_driver(sdata)) ++ return; + + WARN_ON_ONCE(key_idx < -1 || key_idx > 3); + +@@ -1101,7 +1133,8 @@ static inline int drv_join_ibss(struct i + int ret = 0; + + might_sleep(); +- check_sdata_in_driver(sdata); ++ if (!check_sdata_in_driver(sdata)) ++ return -EIO; + + trace_drv_join_ibss(local, sdata, &sdata->vif.bss_conf); + if (local->ops->join_ibss) +@@ -1114,7 +1147,8 @@ static inline void drv_leave_ibss(struct + struct ieee80211_sub_if_data *sdata) + { + might_sleep(); +- check_sdata_in_driver(sdata); ++ if (!check_sdata_in_driver(sdata)) ++ return; + + trace_drv_leave_ibss(local, sdata); + if (local->ops->leave_ibss) +--- a/net/mac80211/ibss.c ++++ b/net/mac80211/ibss.c +@@ -143,7 +143,7 @@ ieee80211_ibss_build_presp(struct ieee80 + *pos++ = csa_settings->block_tx ? 1 : 0; + *pos++ = ieee80211_frequency_to_channel( + csa_settings->chandef.chan->center_freq); +- sdata->csa_counter_offset_beacon = (pos - presp->head); ++ sdata->csa_counter_offset_beacon[0] = (pos - presp->head); + *pos++ = csa_settings->count; + } + +--- a/net/mac80211/ieee80211_i.h ++++ b/net/mac80211/ieee80211_i.h +@@ -754,9 +754,10 @@ struct ieee80211_sub_if_data { + struct mac80211_qos_map __rcu *qos_map; + + struct work_struct csa_finalize_work; +- int csa_counter_offset_beacon; +- int csa_counter_offset_presp; ++ u16 csa_counter_offset_beacon[IEEE80211_MAX_CSA_COUNTERS_NUM]; ++ u16 csa_counter_offset_presp[IEEE80211_MAX_CSA_COUNTERS_NUM]; + bool csa_radar_required; ++ bool csa_block_tx; /* write-protected by sdata_lock and local->mtx */ + struct cfg80211_chan_def csa_chandef; + + struct list_head assigned_chanctx_list; /* protected by chanctx_mtx */ +@@ -766,6 +767,7 @@ struct ieee80211_sub_if_data { + struct ieee80211_chanctx *reserved_chanctx; + struct cfg80211_chan_def reserved_chandef; + bool reserved_radar_required; ++ u8 csa_current_counter; + + /* used to reconfigure hardware SM PS */ + struct work_struct recalc_smps; +@@ -1462,6 +1464,7 @@ __ieee80211_request_sched_scan_start(str + int ieee80211_request_sched_scan_start(struct ieee80211_sub_if_data *sdata, + struct cfg80211_sched_scan_request *req); + int ieee80211_request_sched_scan_stop(struct ieee80211_sub_if_data *sdata); ++void ieee80211_sched_scan_end(struct ieee80211_local *local); + void ieee80211_sched_scan_stopped_work(struct work_struct *work); + + /* off-channel helpers */ +@@ -1476,6 +1479,7 @@ void ieee80211_sw_roc_work(struct work_s + void ieee80211_handle_roc_started(struct ieee80211_roc_work *roc); + + /* channel switch handling */ ++bool ieee80211_csa_needs_block_tx(struct ieee80211_local *local); + void ieee80211_csa_finalize_work(struct work_struct *work); + int ieee80211_channel_switch(struct wiphy *wiphy, struct net_device *dev, + struct cfg80211_csa_settings *params); +@@ -1837,6 +1841,15 @@ int ieee80211_check_combinations(struct + u8 radar_detect); + int ieee80211_max_num_channels(struct ieee80211_local *local); + ++/* TDLS */ ++int ieee80211_tdls_mgmt(struct wiphy *wiphy, struct net_device *dev, ++ const u8 *peer, u8 action_code, u8 dialog_token, ++ u16 status_code, u32 peer_capability, ++ const u8 *extra_ies, size_t extra_ies_len); ++int ieee80211_tdls_oper(struct wiphy *wiphy, struct net_device *dev, ++ const u8 *peer, enum nl80211_tdls_operation oper); ++ ++ + #ifdef CPTCFG_MAC80211_NOINLINE + #define debug_noinline noinline + #else +--- a/net/mac80211/iface.c ++++ b/net/mac80211/iface.c +@@ -838,8 +838,15 @@ static void ieee80211_do_stop(struct iee + + cancel_work_sync(&sdata->recalc_smps); + sdata_lock(sdata); ++ mutex_lock(&local->mtx); + sdata->vif.csa_active = false; ++ if (!ieee80211_csa_needs_block_tx(local)) ++ ieee80211_wake_queues_by_reason(&local->hw, ++ IEEE80211_MAX_QUEUE_MAP, ++ IEEE80211_QUEUE_STOP_REASON_CSA); ++ mutex_unlock(&local->mtx); + sdata_unlock(sdata); ++ + cancel_work_sync(&sdata->csa_finalize_work); + + cancel_delayed_work_sync(&sdata->dfs_cac_timer_work); +--- a/net/mac80211/key.c ++++ b/net/mac80211/key.c +@@ -325,7 +325,8 @@ ieee80211_key_alloc(u32 cipher, int idx, + struct ieee80211_key *key; + int i, j, err; + +- BUG_ON(idx < 0 || idx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS); ++ if (WARN_ON(idx < 0 || idx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS)) ++ return ERR_PTR(-EINVAL); + + key = kzalloc(sizeof(struct ieee80211_key) + key_len, GFP_KERNEL); + if (!key) +@@ -481,8 +482,8 @@ int ieee80211_key_link(struct ieee80211_ + int idx, ret; + bool pairwise; + +- BUG_ON(!sdata); +- BUG_ON(!key); ++ if (WARN_ON(!sdata || !key)) ++ return -EINVAL; + + pairwise = key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE; + idx = key->conf.keyidx; +--- a/net/mac80211/main.c ++++ b/net/mac80211/main.c +@@ -956,6 +956,8 @@ int ieee80211_register_hw(struct ieee802 + if (local->hw.wiphy->flags & WIPHY_FLAG_SUPPORTS_TDLS) + local->hw.wiphy->flags |= WIPHY_FLAG_TDLS_EXTERNAL_SETUP; + ++ local->hw.wiphy->max_num_csa_counters = IEEE80211_MAX_CSA_COUNTERS_NUM; ++ + result = wiphy_register(local->hw.wiphy); + if (result < 0) + goto fail_wiphy_register; +--- a/net/mac80211/mesh.c ++++ b/net/mac80211/mesh.c +@@ -679,7 +679,7 @@ ieee80211_mesh_build_beacon(struct ieee8 + *pos++ = 0x0; + *pos++ = ieee80211_frequency_to_channel( + csa->settings.chandef.chan->center_freq); +- sdata->csa_counter_offset_beacon = hdr_len + 6; ++ sdata->csa_counter_offset_beacon[0] = hdr_len + 6; + *pos++ = csa->settings.count; + *pos++ = WLAN_EID_CHAN_SWITCH_PARAM; + *pos++ = 6; +--- a/net/mac80211/mesh_pathtbl.c ++++ b/net/mac80211/mesh_pathtbl.c +@@ -287,8 +287,10 @@ static void mesh_path_move_to_queue(stru + struct sk_buff_head failq; + unsigned long flags; + +- BUG_ON(gate_mpath == from_mpath); +- BUG_ON(!gate_mpath->next_hop); ++ if (WARN_ON(gate_mpath == from_mpath)) ++ return; ++ if (WARN_ON(!gate_mpath->next_hop)) ++ return; + + __skb_queue_head_init(&failq); + +--- a/net/mac80211/mesh_sync.c ++++ b/net/mac80211/mesh_sync.c +@@ -171,7 +171,7 @@ static void mesh_sync_offset_adjust_tbtt + u8 cap; + + WARN_ON(ifmsh->mesh_sp_id != IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET); +- BUG_ON(!rcu_read_lock_held()); ++ WARN_ON(!rcu_read_lock_held()); + cap = beacon->meshconf->meshconf_cap; + + spin_lock_bh(&ifmsh->sync_offset_lock); +--- a/net/mac80211/mlme.c ++++ b/net/mac80211/mlme.c +@@ -975,16 +975,23 @@ static void ieee80211_chswitch_work(stru + /* XXX: shouldn't really modify cfg80211-owned data! */ + ifmgd->associated->channel = sdata->csa_chandef.chan; + ++ ieee80211_bss_info_change_notify(sdata, changed); ++ ++ mutex_lock(&local->mtx); ++ sdata->vif.csa_active = false; + /* XXX: wait for a beacon first? */ +- ieee80211_wake_queues_by_reason(&local->hw, ++ if (!ieee80211_csa_needs_block_tx(local)) ++ ieee80211_wake_queues_by_reason(&local->hw, + IEEE80211_MAX_QUEUE_MAP, + IEEE80211_QUEUE_STOP_REASON_CSA); ++ mutex_unlock(&local->mtx); + +- ieee80211_bss_info_change_notify(sdata, changed); - - if (tid->sched) +- out: +- sdata->vif.csa_active = false; + ifmgd->flags &= ~IEEE80211_STA_CSA_RECEIVED; ++ ++ ieee80211_sta_reset_beacon_monitor(sdata); ++ ieee80211_sta_reset_conn_monitor(sdata); ++ ++out: + sdata_unlock(sdata); + } + +@@ -1100,12 +1107,16 @@ ieee80211_sta_process_chanswitch(struct + mutex_unlock(&local->chanctx_mtx); + + sdata->csa_chandef = csa_ie.chandef; ++ ++ mutex_lock(&local->mtx); + sdata->vif.csa_active = true; ++ sdata->csa_block_tx = csa_ie.mode; + +- if (csa_ie.mode) ++ if (sdata->csa_block_tx) + ieee80211_stop_queues_by_reason(&local->hw, +- IEEE80211_MAX_QUEUE_MAP, +- IEEE80211_QUEUE_STOP_REASON_CSA); ++ IEEE80211_MAX_QUEUE_MAP, ++ IEEE80211_QUEUE_STOP_REASON_CSA); ++ mutex_unlock(&local->mtx); + + if (local->ops->channel_switch) { + /* use driver's channel switch callback */ +@@ -1817,6 +1828,12 @@ static void ieee80211_set_disassoc(struc + ifmgd->flags = 0; + mutex_lock(&local->mtx); + ieee80211_vif_release_channel(sdata); ++ ++ sdata->vif.csa_active = false; ++ if (!ieee80211_csa_needs_block_tx(local)) ++ ieee80211_wake_queues_by_reason(&local->hw, ++ IEEE80211_MAX_QUEUE_MAP, ++ IEEE80211_QUEUE_STOP_REASON_CSA); + mutex_unlock(&local->mtx); + + sdata->encrypt_headroom = IEEE80211_ENCRYPT_HEADROOM; +@@ -2045,6 +2062,7 @@ EXPORT_SYMBOL(ieee80211_ap_probereq_get) + + static void __ieee80211_disconnect(struct ieee80211_sub_if_data *sdata) + { ++ struct ieee80211_local *local = sdata->local; + struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; + u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN]; + +@@ -2058,10 +2076,14 @@ static void __ieee80211_disconnect(struc + WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY, + true, frame_buf); + ifmgd->flags &= ~IEEE80211_STA_CSA_RECEIVED; ++ ++ mutex_lock(&local->mtx); + sdata->vif.csa_active = false; +- ieee80211_wake_queues_by_reason(&sdata->local->hw, ++ if (!ieee80211_csa_needs_block_tx(local)) ++ ieee80211_wake_queues_by_reason(&local->hw, + IEEE80211_MAX_QUEUE_MAP, + IEEE80211_QUEUE_STOP_REASON_CSA); ++ mutex_unlock(&local->mtx); + + cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf, + IEEE80211_DEAUTH_FRAME_LEN); +@@ -3546,6 +3568,9 @@ static void ieee80211_sta_bcn_mon_timer( + if (local->quiescing) return; -@@ -1407,7 +1404,6 @@ int ath_tx_aggr_start(struct ath_softc * - ath_tx_tid_change_state(sc, txtid); - - txtid->active = true; -- txtid->paused = true; - *ssn = txtid->seq_start = txtid->seq_next; - txtid->bar_index = -1; - -@@ -1427,7 +1423,6 @@ void ath_tx_aggr_stop(struct ath_softc * - - ath_txq_lock(sc, txq); - txtid->active = false; -- txtid->paused = false; - ath_tx_flush_tid(sc, txtid); - ath_tx_tid_change_state(sc, txtid); - ath_txq_unlock_complete(sc, txq); -@@ -1487,7 +1482,7 @@ void ath_tx_aggr_wakeup(struct ath_softc - ath_txq_lock(sc, txq); - ac->clear_ps_filter = true; - -- if (!tid->paused && ath_tid_has_buffered(tid)) { -+ if (ath_tid_has_buffered(tid)) { - ath_tx_queue_tid(txq, tid); - ath_txq_schedule(sc, txq); - } -@@ -1510,7 +1505,6 @@ void ath_tx_aggr_resume(struct ath_softc - ath_txq_lock(sc, txq); - - tid->baw_size = IEEE80211_MIN_AMPDU_BUF << sta->ht_cap.ampdu_factor; -- tid->paused = false; - - if (ath_tid_has_buffered(tid)) { - ath_tx_queue_tid(txq, tid); -@@ -1544,8 +1538,6 @@ void ath9k_release_buffered_frames(struc - continue; - - tid = ATH_AN_2_TID(an, i); -- if (tid->paused) -- continue; - - ath_txq_lock(sc, tid->ac->txq); - while (nframes > 0) { -@@ -1844,9 +1836,6 @@ void ath_txq_schedule(struct ath_softc * - list_del(&tid->list); - tid->sched = false; - -- if (tid->paused) -- continue; -- - if (ath_tx_sched_aggr(sc, txq, tid, &stop)) - sent = true; - -@@ -2698,7 +2687,6 @@ void ath_tx_node_init(struct ath_softc * - tid->baw_size = WME_MAX_BA; - tid->baw_head = tid->baw_tail = 0; - tid->sched = false; -- tid->paused = false; - tid->active = false; - __skb_queue_head_init(&tid->buf_q); - __skb_queue_head_init(&tid->retry_q); ---- a/drivers/net/wireless/ath/ath9k/recv.c -+++ b/drivers/net/wireless/ath/ath9k/recv.c -@@ -34,7 +34,8 @@ static inline bool ath9k_check_auto_slee - * buffer (or rx fifo). This can incorrectly acknowledge packets - * to a sender if last desc is self-linked. - */ --static void ath_rx_buf_link(struct ath_softc *sc, struct ath_rxbuf *bf) -+static void ath_rx_buf_link(struct ath_softc *sc, struct ath_rxbuf *bf, -+ bool flush) ++ if (sdata->vif.csa_active) ++ return; ++ + sdata->u.mgd.connection_loss = false; + ieee80211_queue_work(&sdata->local->hw, + &sdata->u.mgd.beacon_connection_loss_work); +@@ -3561,6 +3586,9 @@ static void ieee80211_sta_conn_mon_timer + if (local->quiescing) + return; + ++ if (sdata->vif.csa_active) ++ return; ++ + ieee80211_queue_work(&local->hw, &ifmgd->monitor_work); + } + +--- a/net/mac80211/rc80211_minstrel_ht.c ++++ b/net/mac80211/rc80211_minstrel_ht.c +@@ -22,7 +22,7 @@ + #define MCS_NBITS (AVG_PKT_SIZE << 3) + + /* Number of symbols for a packet with (bps) bits per symbol */ +-#define MCS_NSYMS(bps) ((MCS_NBITS + (bps) - 1) / (bps)) ++#define MCS_NSYMS(bps) DIV_ROUND_UP(MCS_NBITS, (bps)) + + /* Transmission time (nanoseconds) for a packet containing (syms) symbols */ + #define MCS_SYMBOL_TIME(sgi, syms) \ +@@ -226,8 +226,9 @@ minstrel_ht_calc_tp(struct minstrel_ht_s + nsecs = 1000 * mi->overhead / MINSTREL_TRUNC(mi->avg_ampdu_len); + + nsecs += minstrel_mcs_groups[group].duration[rate]; +- tp = 1000000 * ((prob * 1000) / nsecs); + ++ /* prob is scaled - see MINSTREL_FRAC above */ ++ tp = 1000000 * ((prob * 1000) / nsecs); + mr->cur_tp = MINSTREL_TRUNC(tp); + } + +--- a/net/mac80211/scan.c ++++ b/net/mac80211/scan.c +@@ -1076,12 +1076,8 @@ void ieee80211_sched_scan_results(struct + } + EXPORT_SYMBOL(ieee80211_sched_scan_results); + +-void ieee80211_sched_scan_stopped_work(struct work_struct *work) ++void ieee80211_sched_scan_end(struct ieee80211_local *local) { - struct ath_hw *ah = sc->sc_ah; - struct ath_common *common = ath9k_hw_common(ah); -@@ -59,18 +60,19 @@ static void ath_rx_buf_link(struct ath_s - common->rx_bufsize, - 0); +- struct ieee80211_local *local = +- container_of(work, struct ieee80211_local, +- sched_scan_stopped_work); +- + mutex_lock(&local->mtx); -- if (sc->rx.rxlink == NULL) -- ath9k_hw_putrxbuf(ah, bf->bf_daddr); + if (!rcu_access_pointer(local->sched_scan_sdata)) { +@@ -1099,6 +1095,15 @@ void ieee80211_sched_scan_stopped_work(s + cfg80211_sched_scan_stopped(local->hw.wiphy); + } + ++void ieee80211_sched_scan_stopped_work(struct work_struct *work) ++{ ++ struct ieee80211_local *local = ++ container_of(work, struct ieee80211_local, ++ sched_scan_stopped_work); ++ ++ ieee80211_sched_scan_end(local); ++} ++ + void ieee80211_sched_scan_stopped(struct ieee80211_hw *hw) + { + struct ieee80211_local *local = hw_to_local(hw); +--- /dev/null ++++ b/net/mac80211/tdls.c +@@ -0,0 +1,325 @@ ++/* ++ * mac80211 TDLS handling code ++ * ++ * Copyright 2006-2010 Johannes Berg <johannes@sipsolutions.net> ++ * Copyright 2014, Intel Corporation ++ * ++ * This file is GPLv2 as found in COPYING. ++ */ ++ ++#include <linux/ieee80211.h> ++#include "ieee80211_i.h" ++ ++static void ieee80211_tdls_add_ext_capab(struct sk_buff *skb) ++{ ++ u8 *pos = (void *)skb_put(skb, 7); ++ ++ *pos++ = WLAN_EID_EXT_CAPABILITY; ++ *pos++ = 5; /* len */ ++ *pos++ = 0x0; ++ *pos++ = 0x0; ++ *pos++ = 0x0; ++ *pos++ = 0x0; ++ *pos++ = WLAN_EXT_CAPA5_TDLS_ENABLED; ++} ++ ++static u16 ieee80211_get_tdls_sta_capab(struct ieee80211_sub_if_data *sdata) ++{ ++ struct ieee80211_local *local = sdata->local; ++ u16 capab; ++ ++ capab = 0; ++ if (ieee80211_get_sdata_band(sdata) != IEEE80211_BAND_2GHZ) ++ return capab; ++ ++ if (!(local->hw.flags & IEEE80211_HW_2GHZ_SHORT_SLOT_INCAPABLE)) ++ capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME; ++ if (!(local->hw.flags & IEEE80211_HW_2GHZ_SHORT_PREAMBLE_INCAPABLE)) ++ capab |= WLAN_CAPABILITY_SHORT_PREAMBLE; ++ ++ return capab; ++} ++ ++static void ieee80211_tdls_add_link_ie(struct sk_buff *skb, const u8 *src_addr, ++ const u8 *peer, const u8 *bssid) ++{ ++ struct ieee80211_tdls_lnkie *lnkid; ++ ++ lnkid = (void *)skb_put(skb, sizeof(struct ieee80211_tdls_lnkie)); ++ ++ lnkid->ie_type = WLAN_EID_LINK_ID; ++ lnkid->ie_len = sizeof(struct ieee80211_tdls_lnkie) - 2; ++ ++ memcpy(lnkid->bssid, bssid, ETH_ALEN); ++ memcpy(lnkid->init_sta, src_addr, ETH_ALEN); ++ memcpy(lnkid->resp_sta, peer, ETH_ALEN); ++} ++ ++static int ++ieee80211_prep_tdls_encap_data(struct wiphy *wiphy, struct net_device *dev, ++ const u8 *peer, u8 action_code, u8 dialog_token, ++ u16 status_code, struct sk_buff *skb) ++{ ++ struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev); ++ enum ieee80211_band band = ieee80211_get_sdata_band(sdata); ++ struct ieee80211_tdls_data *tf; ++ ++ tf = (void *)skb_put(skb, offsetof(struct ieee80211_tdls_data, u)); ++ ++ memcpy(tf->da, peer, ETH_ALEN); ++ memcpy(tf->sa, sdata->vif.addr, ETH_ALEN); ++ tf->ether_type = cpu_to_be16(ETH_P_TDLS); ++ tf->payload_type = WLAN_TDLS_SNAP_RFTYPE; ++ ++ switch (action_code) { ++ case WLAN_TDLS_SETUP_REQUEST: ++ tf->category = WLAN_CATEGORY_TDLS; ++ tf->action_code = WLAN_TDLS_SETUP_REQUEST; ++ ++ skb_put(skb, sizeof(tf->u.setup_req)); ++ tf->u.setup_req.dialog_token = dialog_token; ++ tf->u.setup_req.capability = ++ cpu_to_le16(ieee80211_get_tdls_sta_capab(sdata)); ++ ++ ieee80211_add_srates_ie(sdata, skb, false, band); ++ ieee80211_add_ext_srates_ie(sdata, skb, false, band); ++ ieee80211_tdls_add_ext_capab(skb); ++ break; ++ case WLAN_TDLS_SETUP_RESPONSE: ++ tf->category = WLAN_CATEGORY_TDLS; ++ tf->action_code = WLAN_TDLS_SETUP_RESPONSE; ++ ++ skb_put(skb, sizeof(tf->u.setup_resp)); ++ tf->u.setup_resp.status_code = cpu_to_le16(status_code); ++ tf->u.setup_resp.dialog_token = dialog_token; ++ tf->u.setup_resp.capability = ++ cpu_to_le16(ieee80211_get_tdls_sta_capab(sdata)); ++ ++ ieee80211_add_srates_ie(sdata, skb, false, band); ++ ieee80211_add_ext_srates_ie(sdata, skb, false, band); ++ ieee80211_tdls_add_ext_capab(skb); ++ break; ++ case WLAN_TDLS_SETUP_CONFIRM: ++ tf->category = WLAN_CATEGORY_TDLS; ++ tf->action_code = WLAN_TDLS_SETUP_CONFIRM; ++ ++ skb_put(skb, sizeof(tf->u.setup_cfm)); ++ tf->u.setup_cfm.status_code = cpu_to_le16(status_code); ++ tf->u.setup_cfm.dialog_token = dialog_token; ++ break; ++ case WLAN_TDLS_TEARDOWN: ++ tf->category = WLAN_CATEGORY_TDLS; ++ tf->action_code = WLAN_TDLS_TEARDOWN; ++ ++ skb_put(skb, sizeof(tf->u.teardown)); ++ tf->u.teardown.reason_code = cpu_to_le16(status_code); ++ break; ++ case WLAN_TDLS_DISCOVERY_REQUEST: ++ tf->category = WLAN_CATEGORY_TDLS; ++ tf->action_code = WLAN_TDLS_DISCOVERY_REQUEST; ++ ++ skb_put(skb, sizeof(tf->u.discover_req)); ++ tf->u.discover_req.dialog_token = dialog_token; ++ break; ++ default: ++ return -EINVAL; ++ } ++ ++ return 0; ++} ++ ++static int ++ieee80211_prep_tdls_direct(struct wiphy *wiphy, struct net_device *dev, ++ const u8 *peer, u8 action_code, u8 dialog_token, ++ u16 status_code, struct sk_buff *skb) ++{ ++ struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev); ++ enum ieee80211_band band = ieee80211_get_sdata_band(sdata); ++ struct ieee80211_mgmt *mgmt; ++ ++ mgmt = (void *)skb_put(skb, 24); ++ memset(mgmt, 0, 24); ++ memcpy(mgmt->da, peer, ETH_ALEN); ++ memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN); ++ memcpy(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN); ++ ++ mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT | ++ IEEE80211_STYPE_ACTION); ++ ++ switch (action_code) { ++ case WLAN_PUB_ACTION_TDLS_DISCOVER_RES: ++ skb_put(skb, 1 + sizeof(mgmt->u.action.u.tdls_discover_resp)); ++ mgmt->u.action.category = WLAN_CATEGORY_PUBLIC; ++ mgmt->u.action.u.tdls_discover_resp.action_code = ++ WLAN_PUB_ACTION_TDLS_DISCOVER_RES; ++ mgmt->u.action.u.tdls_discover_resp.dialog_token = ++ dialog_token; ++ mgmt->u.action.u.tdls_discover_resp.capability = ++ cpu_to_le16(ieee80211_get_tdls_sta_capab(sdata)); ++ ++ ieee80211_add_srates_ie(sdata, skb, false, band); ++ ieee80211_add_ext_srates_ie(sdata, skb, false, band); ++ ieee80211_tdls_add_ext_capab(skb); ++ break; ++ default: ++ return -EINVAL; ++ } ++ ++ return 0; ++} ++ ++int ieee80211_tdls_mgmt(struct wiphy *wiphy, struct net_device *dev, ++ const u8 *peer, u8 action_code, u8 dialog_token, ++ u16 status_code, u32 peer_capability, ++ const u8 *extra_ies, size_t extra_ies_len) ++{ ++ struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev); ++ struct ieee80211_local *local = sdata->local; ++ struct sk_buff *skb = NULL; ++ bool send_direct; ++ int ret; ++ ++ if (!(wiphy->flags & WIPHY_FLAG_SUPPORTS_TDLS)) ++ return -ENOTSUPP; ++ ++ /* make sure we are in managed mode, and associated */ ++ if (sdata->vif.type != NL80211_IFTYPE_STATION || ++ !sdata->u.mgd.associated) ++ return -EINVAL; ++ ++ tdls_dbg(sdata, "TDLS mgmt action %d peer %pM\n", ++ action_code, peer); ++ ++ skb = dev_alloc_skb(local->hw.extra_tx_headroom + ++ max(sizeof(struct ieee80211_mgmt), ++ sizeof(struct ieee80211_tdls_data)) + ++ 50 + /* supported rates */ ++ 7 + /* ext capab */ ++ extra_ies_len + ++ sizeof(struct ieee80211_tdls_lnkie)); ++ if (!skb) ++ return -ENOMEM; ++ ++ skb_reserve(skb, local->hw.extra_tx_headroom); ++ ++ switch (action_code) { ++ case WLAN_TDLS_SETUP_REQUEST: ++ case WLAN_TDLS_SETUP_RESPONSE: ++ case WLAN_TDLS_SETUP_CONFIRM: ++ case WLAN_TDLS_TEARDOWN: ++ case WLAN_TDLS_DISCOVERY_REQUEST: ++ ret = ieee80211_prep_tdls_encap_data(wiphy, dev, peer, ++ action_code, dialog_token, ++ status_code, skb); ++ send_direct = false; ++ break; ++ case WLAN_PUB_ACTION_TDLS_DISCOVER_RES: ++ ret = ieee80211_prep_tdls_direct(wiphy, dev, peer, action_code, ++ dialog_token, status_code, ++ skb); ++ send_direct = true; ++ break; ++ default: ++ ret = -ENOTSUPP; ++ break; ++ } ++ ++ if (ret < 0) ++ goto fail; ++ ++ if (extra_ies_len) ++ memcpy(skb_put(skb, extra_ies_len), extra_ies, extra_ies_len); ++ ++ /* the TDLS link IE is always added last */ ++ switch (action_code) { ++ case WLAN_TDLS_SETUP_REQUEST: ++ case WLAN_TDLS_SETUP_CONFIRM: ++ case WLAN_TDLS_TEARDOWN: ++ case WLAN_TDLS_DISCOVERY_REQUEST: ++ /* we are the initiator */ ++ ieee80211_tdls_add_link_ie(skb, sdata->vif.addr, peer, ++ sdata->u.mgd.bssid); ++ break; ++ case WLAN_TDLS_SETUP_RESPONSE: ++ case WLAN_PUB_ACTION_TDLS_DISCOVER_RES: ++ /* we are the responder */ ++ ieee80211_tdls_add_link_ie(skb, peer, sdata->vif.addr, ++ sdata->u.mgd.bssid); ++ break; ++ default: ++ ret = -ENOTSUPP; ++ goto fail; ++ } ++ ++ if (send_direct) { ++ ieee80211_tx_skb(sdata, skb); ++ return 0; ++ } ++ ++ /* ++ * According to 802.11z: Setup req/resp are sent in AC_BK, otherwise ++ * we should default to AC_VI. ++ */ ++ switch (action_code) { ++ case WLAN_TDLS_SETUP_REQUEST: ++ case WLAN_TDLS_SETUP_RESPONSE: ++ skb_set_queue_mapping(skb, IEEE80211_AC_BK); ++ skb->priority = 2; ++ break; ++ default: ++ skb_set_queue_mapping(skb, IEEE80211_AC_VI); ++ skb->priority = 5; ++ break; ++ } ++ ++ /* disable bottom halves when entering the Tx path */ ++ local_bh_disable(); ++ ret = ieee80211_subif_start_xmit(skb, dev); ++ local_bh_enable(); ++ ++ return ret; ++ ++fail: ++ dev_kfree_skb(skb); ++ return ret; ++} ++ ++int ieee80211_tdls_oper(struct wiphy *wiphy, struct net_device *dev, ++ const u8 *peer, enum nl80211_tdls_operation oper) ++{ ++ struct sta_info *sta; ++ struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev); ++ ++ if (!(wiphy->flags & WIPHY_FLAG_SUPPORTS_TDLS)) ++ return -ENOTSUPP; ++ ++ if (sdata->vif.type != NL80211_IFTYPE_STATION) ++ return -EINVAL; ++ ++ tdls_dbg(sdata, "TDLS oper %d peer %pM\n", oper, peer); ++ ++ switch (oper) { ++ case NL80211_TDLS_ENABLE_LINK: ++ rcu_read_lock(); ++ sta = sta_info_get(sdata, peer); ++ if (!sta) { ++ rcu_read_unlock(); ++ return -ENOLINK; ++ } ++ ++ set_sta_flag(sta, WLAN_STA_TDLS_PEER_AUTH); ++ rcu_read_unlock(); ++ break; ++ case NL80211_TDLS_DISABLE_LINK: ++ return sta_info_destroy_addr(sdata, peer); ++ case NL80211_TDLS_TEARDOWN: ++ case NL80211_TDLS_SETUP: ++ case NL80211_TDLS_DISCOVERY_REQ: ++ /* We don't support in-driver setup/teardown/discovery */ ++ return -ENOTSUPP; ++ default: ++ return -ENOTSUPP; ++ } ++ ++ return 0; ++} +--- a/net/mac80211/tx.c ++++ b/net/mac80211/tx.c +@@ -2330,7 +2330,8 @@ void ieee80211_tx_pending(unsigned long + /* functions for drivers to get certain frames */ + + static void __ieee80211_beacon_add_tim(struct ieee80211_sub_if_data *sdata, +- struct ps_data *ps, struct sk_buff *skb) ++ struct ps_data *ps, struct sk_buff *skb, ++ bool is_template) + { + u8 *pos, *tim; + int aid0 = 0; +@@ -2343,11 +2344,12 @@ static void __ieee80211_beacon_add_tim(s + * checking byte-for-byte */ + have_bits = !bitmap_empty((unsigned long *)ps->tim, + IEEE80211_MAX_AID+1); +- +- if (ps->dtim_count == 0) +- ps->dtim_count = sdata->vif.bss_conf.dtim_period - 1; - else -+ if (sc->rx.rxlink) - *sc->rx.rxlink = bf->bf_daddr; -+ else if (!flush) -+ ath9k_hw_putrxbuf(ah, bf->bf_daddr); +- ps->dtim_count--; ++ if (!is_template) { ++ if (ps->dtim_count == 0) ++ ps->dtim_count = sdata->vif.bss_conf.dtim_period - 1; ++ else ++ ps->dtim_count--; ++ } - sc->rx.rxlink = &ds->ds_link; + tim = pos = (u8 *) skb_put(skb, 6); + *pos++ = WLAN_EID_TIM; +@@ -2393,7 +2395,8 @@ static void __ieee80211_beacon_add_tim(s } --static void ath_rx_buf_relink(struct ath_softc *sc, struct ath_rxbuf *bf) -+static void ath_rx_buf_relink(struct ath_softc *sc, struct ath_rxbuf *bf, -+ bool flush) + static int ieee80211_beacon_add_tim(struct ieee80211_sub_if_data *sdata, +- struct ps_data *ps, struct sk_buff *skb) ++ struct ps_data *ps, struct sk_buff *skb, ++ bool is_template) { - if (sc->rx.buf_hold) -- ath_rx_buf_link(sc, sc->rx.buf_hold); -+ ath_rx_buf_link(sc, sc->rx.buf_hold, flush); + struct ieee80211_local *local = sdata->local; - sc->rx.buf_hold = bf; +@@ -2405,24 +2408,24 @@ static int ieee80211_beacon_add_tim(stru + * of the tim bitmap in mac80211 and the driver. + */ + if (local->tim_in_locked_section) { +- __ieee80211_beacon_add_tim(sdata, ps, skb); ++ __ieee80211_beacon_add_tim(sdata, ps, skb, is_template); + } else { + spin_lock_bh(&local->tim_lock); +- __ieee80211_beacon_add_tim(sdata, ps, skb); ++ __ieee80211_beacon_add_tim(sdata, ps, skb, is_template); + spin_unlock_bh(&local->tim_lock); + } + + return 0; } -@@ -106,7 +108,7 @@ static void ath_opmode_init(struct ath_s + +-static void ieee80211_update_csa(struct ieee80211_sub_if_data *sdata, +- struct beacon_data *beacon) ++static void ieee80211_set_csa(struct ieee80211_sub_if_data *sdata, ++ struct beacon_data *beacon) + { + struct probe_resp *resp; +- int counter_offset_beacon = sdata->csa_counter_offset_beacon; +- int counter_offset_presp = sdata->csa_counter_offset_presp; + u8 *beacon_data; + size_t beacon_data_len; ++ int i; ++ u8 count = sdata->csa_current_counter; + + switch (sdata->vif.type) { + case NL80211_IFTYPE_AP: +@@ -2440,40 +2443,57 @@ static void ieee80211_update_csa(struct + default: + return; + } +- if (WARN_ON(counter_offset_beacon >= beacon_data_len)) +- return; + +- /* Warn if the driver did not check for/react to csa +- * completeness. A beacon with CSA counter set to 0 should +- * never occur, because a counter of 1 means switch just +- * before the next beacon. +- */ +- if (WARN_ON(beacon_data[counter_offset_beacon] == 1)) +- return; ++ for (i = 0; i < IEEE80211_MAX_CSA_COUNTERS_NUM; ++i) { ++ u16 counter_offset_beacon = ++ sdata->csa_counter_offset_beacon[i]; ++ u16 counter_offset_presp = sdata->csa_counter_offset_presp[i]; ++ ++ if (counter_offset_beacon) { ++ if (WARN_ON(counter_offset_beacon >= beacon_data_len)) ++ return; + +- beacon_data[counter_offset_beacon]--; ++ beacon_data[counter_offset_beacon] = count; ++ } + +- if (sdata->vif.type == NL80211_IFTYPE_AP && counter_offset_presp) { +- rcu_read_lock(); +- resp = rcu_dereference(sdata->u.ap.probe_resp); ++ if (sdata->vif.type == NL80211_IFTYPE_AP && ++ counter_offset_presp) { ++ rcu_read_lock(); ++ resp = rcu_dereference(sdata->u.ap.probe_resp); + +- /* if nl80211 accepted the offset, this should not happen. */ +- if (WARN_ON(!resp)) { ++ /* If nl80211 accepted the offset, this should ++ * not happen. ++ */ ++ if (WARN_ON(!resp)) { ++ rcu_read_unlock(); ++ return; ++ } ++ resp->data[counter_offset_presp] = count; + rcu_read_unlock(); +- return; + } +- resp->data[counter_offset_presp]--; +- rcu_read_unlock(); + } } - static bool ath_rx_edma_buf_link(struct ath_softc *sc, -- enum ath9k_rx_qtype qtype) -+ enum ath9k_rx_qtype qtype, bool flush) ++u8 ieee80211_csa_update_counter(struct ieee80211_vif *vif) ++{ ++ struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif); ++ ++ sdata->csa_current_counter--; ++ ++ /* the counter should never reach 0 */ ++ WARN_ON(!sdata->csa_current_counter); ++ ++ return sdata->csa_current_counter; ++} ++EXPORT_SYMBOL(ieee80211_csa_update_counter); ++ + bool ieee80211_csa_is_complete(struct ieee80211_vif *vif) { - struct ath_hw *ah = sc->sc_ah; - struct ath_rx_edma *rx_edma; -@@ -127,7 +129,8 @@ static bool ath_rx_edma_buf_link(struct - ah->caps.rx_status_len, DMA_TO_DEVICE); - - SKB_CB_ATHBUF(skb) = bf; -- ath9k_hw_addrxbuf_edma(ah, bf->bf_buf_addr, qtype); -+ if (!flush) -+ ath9k_hw_addrxbuf_edma(ah, bf->bf_buf_addr, qtype); - __skb_queue_tail(&rx_edma->rx_fifo, skb); - - return true; -@@ -145,7 +148,7 @@ static void ath_rx_addbuffer_edma(struct + struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif); + struct beacon_data *beacon = NULL; + u8 *beacon_data; + size_t beacon_data_len; +- int counter_beacon = sdata->csa_counter_offset_beacon; ++ int counter_beacon = sdata->csa_counter_offset_beacon[0]; + int ret = false; + + if (!ieee80211_sdata_running(sdata)) +@@ -2523,9 +2543,11 @@ bool ieee80211_csa_is_complete(struct ie + } + EXPORT_SYMBOL(ieee80211_csa_is_complete); + +-struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw, +- struct ieee80211_vif *vif, +- u16 *tim_offset, u16 *tim_length) ++static struct sk_buff * ++__ieee80211_beacon_get(struct ieee80211_hw *hw, ++ struct ieee80211_vif *vif, ++ struct ieee80211_mutable_offsets *offs, ++ bool is_template) + { + struct ieee80211_local *local = hw_to_local(hw); + struct sk_buff *skb = NULL; +@@ -2534,6 +2556,7 @@ struct sk_buff *ieee80211_beacon_get_tim + enum ieee80211_band band; + struct ieee80211_tx_rate_control txrc; + struct ieee80211_chanctx_conf *chanctx_conf; ++ int csa_off_base = 0; + + rcu_read_lock(); + +@@ -2543,18 +2566,20 @@ struct sk_buff *ieee80211_beacon_get_tim + if (!ieee80211_sdata_running(sdata) || !chanctx_conf) + goto out; + +- if (tim_offset) +- *tim_offset = 0; +- if (tim_length) +- *tim_length = 0; ++ if (offs) ++ memset(offs, 0, sizeof(*offs)); + + if (sdata->vif.type == NL80211_IFTYPE_AP) { + struct ieee80211_if_ap *ap = &sdata->u.ap; + struct beacon_data *beacon = rcu_dereference(ap->beacon); + + if (beacon) { +- if (sdata->vif.csa_active) +- ieee80211_update_csa(sdata, beacon); ++ if (sdata->vif.csa_active) { ++ if (!is_template) ++ ieee80211_csa_update_counter(vif); ++ ++ ieee80211_set_csa(sdata, beacon); ++ } + + /* + * headroom, head length, +@@ -2571,12 +2596,16 @@ struct sk_buff *ieee80211_beacon_get_tim + memcpy(skb_put(skb, beacon->head_len), beacon->head, + beacon->head_len); + +- ieee80211_beacon_add_tim(sdata, &ap->ps, skb); ++ ieee80211_beacon_add_tim(sdata, &ap->ps, skb, ++ is_template); ++ ++ if (offs) { ++ offs->tim_offset = beacon->head_len; ++ offs->tim_length = skb->len - beacon->head_len; + +- if (tim_offset) +- *tim_offset = beacon->head_len; +- if (tim_length) +- *tim_length = skb->len - beacon->head_len; ++ /* for AP the csa offsets are from tail */ ++ csa_off_base = skb->len; ++ } + + if (beacon->tail) + memcpy(skb_put(skb, beacon->tail_len), +@@ -2591,9 +2620,12 @@ struct sk_buff *ieee80211_beacon_get_tim + if (!presp) + goto out; + +- if (sdata->vif.csa_active) +- ieee80211_update_csa(sdata, presp); ++ if (sdata->vif.csa_active) { ++ if (!is_template) ++ ieee80211_csa_update_counter(vif); + ++ ieee80211_set_csa(sdata, presp); ++ } + + skb = dev_alloc_skb(local->tx_headroom + presp->head_len + + local->hw.extra_beacon_tailroom); +@@ -2613,8 +2645,17 @@ struct sk_buff *ieee80211_beacon_get_tim + if (!bcn) + goto out; + +- if (sdata->vif.csa_active) +- ieee80211_update_csa(sdata, bcn); ++ if (sdata->vif.csa_active) { ++ if (!is_template) ++ /* TODO: For mesh csa_counter is in TU, so ++ * decrementing it by one isn't correct, but ++ * for now we leave it consistent with overall ++ * mac80211's behavior. ++ */ ++ ieee80211_csa_update_counter(vif); ++ ++ ieee80211_set_csa(sdata, bcn); ++ } + + if (ifmsh->sync_ops) + ifmsh->sync_ops->adjust_tbtt(sdata, bcn); +@@ -2628,13 +2669,33 @@ struct sk_buff *ieee80211_beacon_get_tim + goto out; + skb_reserve(skb, local->tx_headroom); + memcpy(skb_put(skb, bcn->head_len), bcn->head, bcn->head_len); +- ieee80211_beacon_add_tim(sdata, &ifmsh->ps, skb); ++ ieee80211_beacon_add_tim(sdata, &ifmsh->ps, skb, is_template); ++ ++ if (offs) { ++ offs->tim_offset = bcn->head_len; ++ offs->tim_length = skb->len - bcn->head_len; ++ } ++ + memcpy(skb_put(skb, bcn->tail_len), bcn->tail, bcn->tail_len); + } else { + WARN_ON(1); + goto out; } - list_for_each_entry_safe(bf, tbf, &sc->rx.rxbuf, list) -- if (!ath_rx_edma_buf_link(sc, qtype)) -+ if (!ath_rx_edma_buf_link(sc, qtype, false)) - break; ++ /* CSA offsets */ ++ if (offs) { ++ int i; ++ ++ for (i = 0; i < IEEE80211_MAX_CSA_COUNTERS_NUM; i++) { ++ u16 csa_off = sdata->csa_counter_offset_beacon[i]; ++ ++ if (!csa_off) ++ continue; ++ ++ offs->csa_counter_offs[i] = csa_off_base + csa_off; ++ } ++ } ++ + band = chanctx_conf->def.chan->band; + info = IEEE80211_SKB_CB(skb); +@@ -2665,6 +2726,32 @@ struct sk_buff *ieee80211_beacon_get_tim + out: + rcu_read_unlock(); + return skb; ++ ++} ++ ++struct sk_buff * ++ieee80211_beacon_get_template(struct ieee80211_hw *hw, ++ struct ieee80211_vif *vif, ++ struct ieee80211_mutable_offsets *offs) ++{ ++ return __ieee80211_beacon_get(hw, vif, offs, true); ++} ++EXPORT_SYMBOL(ieee80211_beacon_get_template); ++ ++struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw, ++ struct ieee80211_vif *vif, ++ u16 *tim_offset, u16 *tim_length) ++{ ++ struct ieee80211_mutable_offsets offs = {}; ++ struct sk_buff *bcn = __ieee80211_beacon_get(hw, vif, &offs, false); ++ ++ if (tim_offset) ++ *tim_offset = offs.tim_offset; ++ ++ if (tim_length) ++ *tim_length = offs.tim_length; ++ ++ return bcn; } -@@ -442,7 +445,7 @@ int ath_startrecv(struct ath_softc *sc) - sc->rx.buf_hold = NULL; - sc->rx.rxlink = NULL; - list_for_each_entry_safe(bf, tbf, &sc->rx.rxbuf, list) { -- ath_rx_buf_link(sc, bf); -+ ath_rx_buf_link(sc, bf, false); + EXPORT_SYMBOL(ieee80211_beacon_get_tim); + +--- a/net/mac80211/util.c ++++ b/net/mac80211/util.c +@@ -1457,6 +1457,44 @@ void ieee80211_stop_device(struct ieee80 + drv_stop(local); + } + ++static void ieee80211_handle_reconfig_failure(struct ieee80211_local *local) ++{ ++ struct ieee80211_sub_if_data *sdata; ++ struct ieee80211_chanctx *ctx; ++ ++ /* ++ * We get here if during resume the device can't be restarted properly. ++ * We might also get here if this happens during HW reset, which is a ++ * slightly different situation and we need to drop all connections in ++ * the latter case. ++ * ++ * Ask cfg80211 to turn off all interfaces, this will result in more ++ * warnings but at least we'll then get into a clean stopped state. ++ */ ++ ++ local->resuming = false; ++ local->suspended = false; ++ local->started = false; ++ ++ /* scheduled scan clearly can't be running any more, but tell ++ * cfg80211 and clear local state ++ */ ++ ieee80211_sched_scan_end(local); ++ ++ list_for_each_entry(sdata, &local->interfaces, list) ++ sdata->flags &= ~IEEE80211_SDATA_IN_DRIVER; ++ ++ /* Mark channel contexts as not being in the driver any more to avoid ++ * removing them from the driver during the shutdown process... ++ */ ++ mutex_lock(&local->chanctx_mtx); ++ list_for_each_entry(ctx, &local->chanctx_list, list) ++ ctx->driver_present = false; ++ mutex_unlock(&local->chanctx_mtx); ++ ++ cfg80211_shutdown_all_interfaces(local->hw.wiphy); ++} ++ + static void ieee80211_assign_chanctx(struct ieee80211_local *local, + struct ieee80211_sub_if_data *sdata) + { +@@ -1520,9 +1558,11 @@ int ieee80211_reconfig(struct ieee80211_ + */ + res = drv_start(local); + if (res) { +- WARN(local->suspended, "Hardware became unavailable " +- "upon resume. This could be a software issue " +- "prior to suspend or a hardware issue.\n"); ++ if (local->suspended) ++ WARN(1, "Hardware became unavailable upon resume. This could be a software issue prior to suspend or a hardware issue.\n"); ++ else ++ WARN(1, "Hardware became unavailable during restart.\n"); ++ ieee80211_handle_reconfig_failure(local); + return res; } - /* We could have deleted elements so the list may be empty now */ -@@ -636,7 +639,7 @@ static bool ath_edma_get_buffers(struct - if (ret == -EINVAL) { - /* corrupt descriptor, skip this one and the following one */ - list_add_tail(&bf->list, &sc->rx.rxbuf); -- ath_rx_edma_buf_link(sc, qtype); -+ ath_rx_edma_buf_link(sc, qtype, false); +--- a/net/wireless/ap.c ++++ b/net/wireless/ap.c +@@ -6,8 +6,8 @@ + #include "rdev-ops.h" - skb = skb_peek(&rx_edma->rx_fifo); - if (skb) { -@@ -645,7 +648,7 @@ static bool ath_edma_get_buffers(struct - __skb_unlink(skb, &rx_edma->rx_fifo); - list_add_tail(&bf->list, &sc->rx.rxbuf); -- ath_rx_edma_buf_link(sc, qtype); -+ ath_rx_edma_buf_link(sc, qtype, false); - } +-static int __cfg80211_stop_ap(struct cfg80211_registered_device *rdev, +- struct net_device *dev, bool notify) ++int __cfg80211_stop_ap(struct cfg80211_registered_device *rdev, ++ struct net_device *dev, bool notify) + { + struct wireless_dev *wdev = dev->ieee80211_ptr; + int err; +--- a/net/wireless/chan.c ++++ b/net/wireless/chan.c +@@ -370,8 +370,8 @@ int cfg80211_chandef_dfs_required(struct + case NL80211_IFTYPE_AP_VLAN: + case NL80211_IFTYPE_WDS: + case NL80211_IFTYPE_P2P_DEVICE: +- case NL80211_IFTYPE_UNSPECIFIED: + break; ++ case NL80211_IFTYPE_UNSPECIFIED: + case NUM_NL80211_IFTYPES: + WARN_ON(1); + } +@@ -796,8 +796,7 @@ bool cfg80211_reg_can_beacon(struct wiph + !cfg80211_go_permissive_chan(rdev, chandef->chan)) + prohibited_flags |= IEEE80211_CHAN_NO_IR; - bf = NULL; -@@ -975,6 +978,7 @@ int ath_rx_tasklet(struct ath_softc *sc, - u64 tsf = 0; - unsigned long flags; - dma_addr_t new_buf_addr; -+ unsigned int budget = 512; +- if (cfg80211_chandef_dfs_required(wiphy, chandef, +- NL80211_IFTYPE_UNSPECIFIED) > 0 && ++ if (cfg80211_chandef_dfs_required(wiphy, chandef, iftype) > 0 && + cfg80211_chandef_dfs_available(wiphy, chandef)) { + /* We can skip IEEE80211_CHAN_NO_IR if chandef dfs available */ + prohibited_flags = IEEE80211_CHAN_DISABLED; +--- a/net/wireless/core.c ++++ b/net/wireless/core.c +@@ -210,15 +210,12 @@ void cfg80211_stop_p2p_device(struct cfg + } + } - if (edma) - dma_type = DMA_BIDIRECTIONAL; -@@ -1113,15 +1117,17 @@ requeue_drop_frag: - } - requeue: - list_add_tail(&bf->list, &sc->rx.rxbuf); -- if (flush) -- continue; +-static int cfg80211_rfkill_set_block(void *data, bool blocked) ++void cfg80211_shutdown_all_interfaces(struct wiphy *wiphy) + { +- struct cfg80211_registered_device *rdev = data; ++ struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); + struct wireless_dev *wdev; - if (edma) { -- ath_rx_edma_buf_link(sc, qtype); -+ ath_rx_edma_buf_link(sc, qtype, flush); - } else { -- ath_rx_buf_relink(sc, bf); -- ath9k_hw_rxena(ah); -+ ath_rx_buf_relink(sc, bf, flush); -+ if (!flush) -+ ath9k_hw_rxena(ah); +- if (!blocked) +- return 0; +- +- rtnl_lock(); ++ ASSERT_RTNL(); + + list_for_each_entry(wdev, &rdev->wdev_list, list) { + if (wdev->netdev) { +@@ -234,7 +231,18 @@ static int cfg80211_rfkill_set_block(voi + break; } + } ++} ++EXPORT_SYMBOL_GPL(cfg80211_shutdown_all_interfaces); + ++static int cfg80211_rfkill_set_block(void *data, bool blocked) ++{ ++ struct cfg80211_registered_device *rdev = data; + -+ if (!budget--) -+ break; - } while (1); ++ if (!blocked) ++ return 0; ++ ++ rtnl_lock(); ++ cfg80211_shutdown_all_interfaces(&rdev->wiphy); + rtnl_unlock(); - if (!(ah->imask & ATH9K_INT_RXEOL)) { -@@ -1129,5 +1135,5 @@ requeue: - ath9k_hw_set_interrupts(ah); - } + return 0; +@@ -401,6 +409,8 @@ struct wiphy *wiphy_new(const struct cfg + rdev->wiphy.rts_threshold = (u32) -1; + rdev->wiphy.coverage_class = 0; -- return 0; -+ return !budget; ++ rdev->wiphy.max_num_csa_counters = 1; ++ + return &rdev->wiphy; } ---- a/drivers/net/wireless/ath/ath9k/ahb.c -+++ b/drivers/net/wireless/ath/ath9k/ahb.c -@@ -86,7 +86,6 @@ static int ath_ahb_probe(struct platform - int irq; - int ret = 0; - struct ath_hw *ah; -- struct ath_common *common; - char hw_name[64]; - - if (!dev_get_platdata(&pdev->dev)) { -@@ -146,9 +145,6 @@ static int ath_ahb_probe(struct platform - wiphy_info(hw->wiphy, "%s mem=0x%lx, irq=%d\n", - hw_name, (unsigned long)mem, irq); - -- common = ath9k_hw_common(sc->sc_ah); -- /* Will be cleared in ath9k_start() */ -- set_bit(ATH_OP_INVALID, &common->op_flags); - return 0; + EXPORT_SYMBOL(wiphy_new); +@@ -697,7 +707,7 @@ void wiphy_unregister(struct wiphy *wiph + rtnl_lock(); + rdev->wiphy.registered = false; + +- BUG_ON(!list_empty(&rdev->wdev_list)); ++ WARN_ON(!list_empty(&rdev->wdev_list)); + + /* + * First remove the hardware from everywhere, this makes +@@ -799,23 +809,23 @@ void cfg80211_update_iface_num(struct cf + rdev->num_running_monitor_ifaces += num; + } + +-void cfg80211_leave(struct cfg80211_registered_device *rdev, +- struct wireless_dev *wdev) ++void __cfg80211_leave(struct cfg80211_registered_device *rdev, ++ struct wireless_dev *wdev) + { + struct net_device *dev = wdev->netdev; + + ASSERT_RTNL(); ++ ASSERT_WDEV_LOCK(wdev); - err_irq: ---- a/drivers/net/wireless/ath/ath9k/init.c -+++ b/drivers/net/wireless/ath/ath9k/init.c -@@ -670,6 +670,7 @@ static const struct ieee80211_iface_comb - .num_different_channels = 1, - .beacon_int_infra_match = true, - }, -+#ifdef CONFIG_ATH9K_DFS_CERTIFIED - { - .limits = if_dfs_limits, - .n_limits = ARRAY_SIZE(if_dfs_limits), -@@ -679,6 +680,7 @@ static const struct ieee80211_iface_comb - .radar_detect_widths = BIT(NL80211_CHAN_WIDTH_20_NOHT) | - BIT(NL80211_CHAN_WIDTH_20), + switch (wdev->iftype) { + case NL80211_IFTYPE_ADHOC: +- cfg80211_leave_ibss(rdev, dev, true); ++ __cfg80211_leave_ibss(rdev, dev, true); + break; + case NL80211_IFTYPE_P2P_CLIENT: + case NL80211_IFTYPE_STATION: + if (rdev->sched_scan_req && dev == rdev->sched_scan_req->dev) + __cfg80211_stop_sched_scan(rdev, false); + +- wdev_lock(wdev); + #ifdef CPTCFG_CFG80211_WEXT + kfree(wdev->wext.ie); + wdev->wext.ie = NULL; +@@ -824,20 +834,49 @@ void cfg80211_leave(struct cfg80211_regi + #endif + cfg80211_disconnect(rdev, dev, + WLAN_REASON_DEAUTH_LEAVING, true); +- wdev_unlock(wdev); + break; + case NL80211_IFTYPE_MESH_POINT: +- cfg80211_leave_mesh(rdev, dev); ++ __cfg80211_leave_mesh(rdev, dev); + break; + case NL80211_IFTYPE_AP: + case NL80211_IFTYPE_P2P_GO: +- cfg80211_stop_ap(rdev, dev, true); ++ __cfg80211_stop_ap(rdev, dev, true); + break; + default: + break; } -+#endif + } + ++void cfg80211_leave(struct cfg80211_registered_device *rdev, ++ struct wireless_dev *wdev) ++{ ++ wdev_lock(wdev); ++ __cfg80211_leave(rdev, wdev); ++ wdev_unlock(wdev); ++} ++ ++void cfg80211_stop_iface(struct wiphy *wiphy, struct wireless_dev *wdev, ++ gfp_t gfp) ++{ ++ struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); ++ struct cfg80211_event *ev; ++ unsigned long flags; ++ ++ trace_cfg80211_stop_iface(wiphy, wdev); ++ ++ ev = kzalloc(sizeof(*ev), gfp); ++ if (!ev) ++ return; ++ ++ ev->type = EVENT_STOPPED; ++ ++ spin_lock_irqsave(&wdev->event_lock, flags); ++ list_add_tail(&ev->list, &wdev->event_list); ++ spin_unlock_irqrestore(&wdev->event_lock, flags); ++ queue_work(cfg80211_wq, &rdev->event_work); ++} ++EXPORT_SYMBOL(cfg80211_stop_iface); ++ + static int cfg80211_netdev_notifier_call(struct notifier_block *nb, + unsigned long state, void *ptr) + { +--- a/net/wireless/core.h ++++ b/net/wireless/core.h +@@ -185,6 +185,7 @@ enum cfg80211_event_type { + EVENT_ROAMED, + EVENT_DISCONNECTED, + EVENT_IBSS_JOINED, ++ EVENT_STOPPED, }; - static void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw) -@@ -781,6 +783,9 @@ int ath9k_init_device(u16 devid, struct - common = ath9k_hw_common(ah); - ath9k_set_hw_capab(sc, hw); - -+ /* Will be cleared in ath9k_start() */ -+ set_bit(ATH_OP_INVALID, &common->op_flags); -+ - /* Initialize regulatory */ - error = ath_regd_init(&common->regulatory, sc->hw->wiphy, - ath9k_reg_notifier); ---- a/drivers/net/wireless/ath/ath9k/pci.c -+++ b/drivers/net/wireless/ath/ath9k/pci.c -@@ -784,7 +784,6 @@ static int ath_pci_probe(struct pci_dev - { - struct ath_softc *sc; - struct ieee80211_hw *hw; -- struct ath_common *common; - u8 csz; - u32 val; - int ret = 0; -@@ -877,10 +876,6 @@ static int ath_pci_probe(struct pci_dev - wiphy_info(hw->wiphy, "%s mem=0x%lx, irq=%d\n", - hw_name, (unsigned long)sc->mem, pdev->irq); + struct cfg80211_event { +@@ -281,6 +282,8 @@ int cfg80211_join_mesh(struct cfg80211_r + struct net_device *dev, + struct mesh_setup *setup, + const struct mesh_config *conf); ++int __cfg80211_leave_mesh(struct cfg80211_registered_device *rdev, ++ struct net_device *dev); + int cfg80211_leave_mesh(struct cfg80211_registered_device *rdev, + struct net_device *dev); + int cfg80211_set_mesh_channel(struct cfg80211_registered_device *rdev, +@@ -288,6 +291,8 @@ int cfg80211_set_mesh_channel(struct cfg + struct cfg80211_chan_def *chandef); -- /* Will be cleared in ath9k_start() */ -- common = ath9k_hw_common(sc->sc_ah); -- set_bit(ATH_OP_INVALID, &common->op_flags); -- + /* AP */ ++int __cfg80211_stop_ap(struct cfg80211_registered_device *rdev, ++ struct net_device *dev, bool notify); + int cfg80211_stop_ap(struct cfg80211_registered_device *rdev, + struct net_device *dev, bool notify); + +@@ -441,6 +446,8 @@ int cfg80211_validate_beacon_int(struct + void cfg80211_update_iface_num(struct cfg80211_registered_device *rdev, + enum nl80211_iftype iftype, int num); + ++void __cfg80211_leave(struct cfg80211_registered_device *rdev, ++ struct wireless_dev *wdev); + void cfg80211_leave(struct cfg80211_registered_device *rdev, + struct wireless_dev *wdev); + +--- a/net/wireless/ibss.c ++++ b/net/wireless/ibss.c +@@ -420,8 +420,8 @@ int cfg80211_ibss_wext_siwessid(struct n + if (len > 0 && ssid[len - 1] == '\0') + len--; + ++ memcpy(wdev->ssid, ssid, len); + wdev->wext.ibss.ssid = wdev->ssid; +- memcpy(wdev->wext.ibss.ssid, ssid, len); + wdev->wext.ibss.ssid_len = len; + + wdev_lock(wdev); +--- a/net/wireless/mesh.c ++++ b/net/wireless/mesh.c +@@ -238,8 +238,8 @@ int cfg80211_set_mesh_channel(struct cfg return 0; + } - err_init: ---- a/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h -+++ b/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h -@@ -410,7 +410,7 @@ static const u32 ar9300_2p2_baseband_cor - {0x00009e30, 0x06336f77}, - {0x00009e34, 0x6af6532f}, - {0x00009e38, 0x0cc80c00}, -- {0x00009e40, 0x0d261820}, -+ {0x00009e40, 0x0d261800}, - {0x00009e4c, 0x00001004}, - {0x00009e50, 0x00ff03f1}, - {0x00009e54, 0x00000000}, ---- a/drivers/net/wireless/ath/ath9k/ar9330_1p1_initvals.h -+++ b/drivers/net/wireless/ath/ath9k/ar9330_1p1_initvals.h -@@ -592,7 +592,7 @@ static const u32 ar9331_1p1_baseband_cor - {0x00009e30, 0x06336f77}, - {0x00009e34, 0x6af6532f}, - {0x00009e38, 0x0cc80c00}, -- {0x00009e40, 0x0d261820}, -+ {0x00009e40, 0x0d261800}, - {0x00009e4c, 0x00001004}, - {0x00009e50, 0x00ff03f1}, - {0x00009fc0, 0x803e4788}, ---- a/drivers/net/wireless/ath/ath9k/ar9330_1p2_initvals.h -+++ b/drivers/net/wireless/ath/ath9k/ar9330_1p2_initvals.h -@@ -231,7 +231,7 @@ static const u32 ar9331_1p2_baseband_cor - {0x00009e30, 0x06336f77}, - {0x00009e34, 0x6af6532f}, - {0x00009e38, 0x0cc80c00}, -- {0x00009e40, 0x0d261820}, -+ {0x00009e40, 0x0d261800}, - {0x00009e4c, 0x00001004}, - {0x00009e50, 0x00ff03f1}, - {0x00009fc0, 0x803e4788}, ---- a/drivers/net/wireless/ath/ath9k/ar9340_initvals.h -+++ b/drivers/net/wireless/ath/ath9k/ar9340_initvals.h -@@ -318,7 +318,7 @@ static const u32 ar9340_1p0_baseband_cor - {0x00009e30, 0x06336f77}, - {0x00009e34, 0x6af6532f}, - {0x00009e38, 0x0cc80c00}, -- {0x00009e40, 0x0d261820}, -+ {0x00009e40, 0x0d261800}, - {0x00009e4c, 0x00001004}, - {0x00009e50, 0x00ff03f1}, - {0x00009e54, 0x00000000}, -@@ -348,9 +348,9 @@ static const u32 ar9340_1p0_baseband_cor - {0x0000a370, 0x00000000}, - {0x0000a390, 0x00000001}, - {0x0000a394, 0x00000444}, -- {0x0000a398, 0x00000000}, -- {0x0000a39c, 0x210d0401}, -- {0x0000a3a0, 0xab9a7144}, -+ {0x0000a398, 0x001f0e0f}, -+ {0x0000a39c, 0x0075393f}, -+ {0x0000a3a0, 0xb79f6427}, - {0x0000a3a4, 0x00000000}, - {0x0000a3a8, 0xaaaaaaaa}, - {0x0000a3ac, 0x3c466478}, ---- a/drivers/net/wireless/ath/ath9k/ar9580_1p0_initvals.h -+++ b/drivers/net/wireless/ath/ath9k/ar9580_1p0_initvals.h -@@ -90,7 +90,7 @@ static const u32 ar9580_1p0_baseband_cor - {0x00009e30, 0x06336f77}, - {0x00009e34, 0x6af6532f}, - {0x00009e38, 0x0cc80c00}, -- {0x00009e40, 0x0d261820}, -+ {0x00009e40, 0x0d261800}, - {0x00009e4c, 0x00001004}, - {0x00009e50, 0x00ff03f1}, - {0x00009e54, 0x00000000}, ---- a/drivers/net/wireless/ath/ath9k/ar953x_initvals.h -+++ b/drivers/net/wireless/ath/ath9k/ar953x_initvals.h -@@ -257,9 +257,9 @@ static const u32 qca953x_1p0_baseband_co - {0x0000a370, 0x00000000}, - {0x0000a390, 0x00000001}, - {0x0000a394, 0x00000444}, -- {0x0000a398, 0x1f020503}, -- {0x0000a39c, 0x29180c03}, -- {0x0000a3a0, 0x9a8b6844}, -+ {0x0000a398, 0x001f0e0f}, -+ {0x0000a39c, 0x0075393f}, -+ {0x0000a3a0, 0xb79f6427}, - {0x0000a3a4, 0x000000ff}, - {0x0000a3a8, 0x6a6a6a6a}, - {0x0000a3ac, 0x6a6a6a6a}, ---- a/drivers/net/wireless/ath/ath5k/phy.c -+++ b/drivers/net/wireless/ath/ath5k/phy.c -@@ -3709,8 +3709,8 @@ ath5k_hw_txpower(struct ath5k_hw *ah, st - AR5K_REG_MS(AR5K_TUNE_MAX_TXPOWER, AR5K_TPC_CHIRP), - AR5K_TPC); - } else { -- ath5k_hw_reg_write(ah, AR5K_PHY_TXPOWER_RATE_MAX | -- AR5K_TUNE_MAX_TXPOWER, AR5K_PHY_TXPOWER_RATE_MAX); -+ ath5k_hw_reg_write(ah, AR5K_TUNE_MAX_TXPOWER, -+ AR5K_PHY_TXPOWER_RATE_MAX); +-static int __cfg80211_leave_mesh(struct cfg80211_registered_device *rdev, +- struct net_device *dev) ++int __cfg80211_leave_mesh(struct cfg80211_registered_device *rdev, ++ struct net_device *dev) + { + struct wireless_dev *wdev = dev->ieee80211_ptr; + int err; +--- a/net/wireless/nl80211.c ++++ b/net/wireless/nl80211.c +@@ -371,8 +371,8 @@ static const struct nla_policy nl80211_p + [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 }, + [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG }, + [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED }, +- [NL80211_ATTR_CSA_C_OFF_BEACON] = { .type = NLA_U16 }, +- [NL80211_ATTR_CSA_C_OFF_PRESP] = { .type = NLA_U16 }, ++ [NL80211_ATTR_CSA_C_OFF_BEACON] = { .type = NLA_BINARY }, ++ [NL80211_ATTR_CSA_C_OFF_PRESP] = { .type = NLA_BINARY }, + [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = { .type = NLA_BINARY }, + [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] = { .type = NLA_BINARY }, + [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG }, +@@ -386,6 +386,7 @@ static const struct nla_policy nl80211_p + [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 }, + [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 }, + [NL80211_ATTR_IFACE_SOCKET_OWNER] = { .type = NLA_FLAG }, ++ [NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY }, + }; + + /* policy for the key attributes */ +@@ -970,8 +971,10 @@ static int nl80211_put_iface_combination + c->max_interfaces)) + goto nla_put_failure; + if (large && +- nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS, +- c->radar_detect_widths)) ++ (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS, ++ c->radar_detect_widths) || ++ nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS, ++ c->radar_detect_regions))) + goto nla_put_failure; + + nla_nest_end(msg, nl_combi); +@@ -1667,6 +1670,13 @@ static int nl80211_send_wiphy(struct cfg + } + nla_nest_end(msg, nested); + } ++ state->split_start++; ++ break; ++ case 12: ++ if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH && ++ nla_put_u8(msg, NL80211_ATTR_MAX_CSA_COUNTERS, ++ rdev->wiphy.max_num_csa_counters)) ++ goto nla_put_failure; + + /* done */ + state->split_start = 0; +@@ -5825,7 +5835,7 @@ static int nl80211_start_radar_detection + return -EBUSY; + + err = cfg80211_chandef_dfs_required(wdev->wiphy, &chandef, +- NL80211_IFTYPE_UNSPECIFIED); ++ wdev->iftype); + if (err < 0) + return err; + +@@ -5866,6 +5876,7 @@ static int nl80211_channel_switch(struct + u8 radar_detect_width = 0; + int err; + bool need_new_beacon = false; ++ int len, i; + + if (!rdev->ops->channel_switch || + !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)) +@@ -5924,26 +5935,55 @@ static int nl80211_channel_switch(struct + if (!csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]) + return -EINVAL; + +- params.counter_offset_beacon = +- nla_get_u16(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]); +- if (params.counter_offset_beacon >= params.beacon_csa.tail_len) ++ len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]); ++ if (!len || (len % sizeof(u16))) + return -EINVAL; + +- /* sanity check - counters should be the same */ +- if (params.beacon_csa.tail[params.counter_offset_beacon] != +- params.count) ++ params.n_counter_offsets_beacon = len / sizeof(u16); ++ if (rdev->wiphy.max_num_csa_counters && ++ (params.n_counter_offsets_beacon > ++ rdev->wiphy.max_num_csa_counters)) + return -EINVAL; + ++ params.counter_offsets_beacon = ++ nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]); ++ ++ /* sanity checks - counters should fit and be the same */ ++ for (i = 0; i < params.n_counter_offsets_beacon; i++) { ++ u16 offset = params.counter_offsets_beacon[i]; ++ ++ if (offset >= params.beacon_csa.tail_len) ++ return -EINVAL; ++ ++ if (params.beacon_csa.tail[offset] != params.count) ++ return -EINVAL; ++ } ++ + if (csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]) { +- params.counter_offset_presp = +- nla_get_u16(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]); +- if (params.counter_offset_presp >= +- params.beacon_csa.probe_resp_len) ++ len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]); ++ if (!len || (len % sizeof(u16))) + return -EINVAL; + +- if (params.beacon_csa.probe_resp[params.counter_offset_presp] != +- params.count) ++ params.n_counter_offsets_presp = len / sizeof(u16); ++ if (rdev->wiphy.max_num_csa_counters && ++ (params.n_counter_offsets_beacon > ++ rdev->wiphy.max_num_csa_counters)) + return -EINVAL; ++ ++ params.counter_offsets_presp = ++ nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]); ++ ++ /* sanity checks - counters should fit and be the same */ ++ for (i = 0; i < params.n_counter_offsets_presp; i++) { ++ u16 offset = params.counter_offsets_presp[i]; ++ ++ if (offset >= params.beacon_csa.probe_resp_len) ++ return -EINVAL; ++ ++ if (params.beacon_csa.probe_resp[offset] != ++ params.count) ++ return -EINVAL; ++ } } - return 0; ---- a/net/mac80211/rx.c -+++ b/net/mac80211/rx.c -@@ -1231,7 +1231,8 @@ ieee80211_rx_h_sta_process(struct ieee80 - if (ether_addr_equal(bssid, rx->sdata->u.ibss.bssid) && - test_sta_flag(sta, WLAN_STA_AUTHORIZED)) { - sta->last_rx = jiffies; -- if (ieee80211_is_data(hdr->frame_control)) { -+ if (ieee80211_is_data(hdr->frame_control) && -+ !is_multicast_ether_addr(hdr->addr1)) { - sta->last_rx_rate_idx = status->rate_idx; - sta->last_rx_rate_flag = status->flag; - sta->last_rx_rate_vht_flag = status->vht_flag; + skip_beacons: +@@ -7793,6 +7833,27 @@ static int nl80211_tx_mgmt(struct sk_buf + if (!chandef.chan && params.offchan) + return -EINVAL; + ++ params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]); ++ params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]); ++ ++ if (info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]) { ++ int len = nla_len(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]); ++ int i; ++ ++ if (len % sizeof(u16)) ++ return -EINVAL; ++ ++ params.n_csa_offsets = len / sizeof(u16); ++ params.csa_offsets = ++ nla_data(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]); ++ ++ /* check that all the offsets fit the frame */ ++ for (i = 0; i < params.n_csa_offsets; i++) { ++ if (params.csa_offsets[i] >= params.len) ++ return -EINVAL; ++ } ++ } ++ + if (!params.dont_wait_for_ack) { + msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); + if (!msg) +@@ -7807,8 +7868,6 @@ static int nl80211_tx_mgmt(struct sk_buf + } + } + +- params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]); +- params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]); + params.chan = chandef.chan; + err = cfg80211_mlme_mgmt_tx(rdev, wdev, ¶ms, &cookie); + if (err) +@@ -8507,6 +8566,8 @@ static int nl80211_set_wowlan(struct sk_ + + nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN], + rem) { ++ u8 *mask_pat; ++ + nla_parse(pat_tb, MAX_NL80211_PKTPAT, nla_data(pat), + nla_len(pat), NULL); + err = -EINVAL; +@@ -8530,19 +8591,18 @@ static int nl80211_set_wowlan(struct sk_ + goto error; + new_triggers.patterns[i].pkt_offset = pkt_offset; + +- new_triggers.patterns[i].mask = +- kmalloc(mask_len + pat_len, GFP_KERNEL); +- if (!new_triggers.patterns[i].mask) { ++ mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL); ++ if (!mask_pat) { + err = -ENOMEM; + goto error; + } +- new_triggers.patterns[i].pattern = +- new_triggers.patterns[i].mask + mask_len; +- memcpy(new_triggers.patterns[i].mask, +- nla_data(pat_tb[NL80211_PKTPAT_MASK]), ++ new_triggers.patterns[i].mask = mask_pat; ++ memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]), + mask_len); ++ mask_pat += mask_len; ++ new_triggers.patterns[i].pattern = mask_pat; + new_triggers.patterns[i].pattern_len = pat_len; +- memcpy(new_triggers.patterns[i].pattern, ++ memcpy(mask_pat, + nla_data(pat_tb[NL80211_PKTPAT_PATTERN]), + pat_len); + i++; +@@ -8735,6 +8795,8 @@ static int nl80211_parse_coalesce_rule(s + + nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN], + rem) { ++ u8 *mask_pat; ++ + nla_parse(pat_tb, MAX_NL80211_PKTPAT, nla_data(pat), + nla_len(pat), NULL); + if (!pat_tb[NL80211_PKTPAT_MASK] || +@@ -8756,17 +8818,19 @@ static int nl80211_parse_coalesce_rule(s + return -EINVAL; + new_rule->patterns[i].pkt_offset = pkt_offset; + +- new_rule->patterns[i].mask = +- kmalloc(mask_len + pat_len, GFP_KERNEL); +- if (!new_rule->patterns[i].mask) ++ mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL); ++ if (!mask_pat) + return -ENOMEM; +- new_rule->patterns[i].pattern = +- new_rule->patterns[i].mask + mask_len; +- memcpy(new_rule->patterns[i].mask, +- nla_data(pat_tb[NL80211_PKTPAT_MASK]), mask_len); ++ ++ new_rule->patterns[i].mask = mask_pat; ++ memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]), ++ mask_len); ++ ++ mask_pat += mask_len; ++ new_rule->patterns[i].pattern = mask_pat; + new_rule->patterns[i].pattern_len = pat_len; +- memcpy(new_rule->patterns[i].pattern, +- nla_data(pat_tb[NL80211_PKTPAT_PATTERN]), pat_len); ++ memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_PATTERN]), ++ pat_len); + i++; + } + +--- a/net/wireless/sme.c ++++ b/net/wireless/sme.c +@@ -149,7 +149,8 @@ static int cfg80211_conn_do_work(struct + case CFG80211_CONN_SCAN_AGAIN: + return cfg80211_conn_scan(wdev); + case CFG80211_CONN_AUTHENTICATE_NEXT: +- BUG_ON(!rdev->ops->auth); ++ if (WARN_ON(!rdev->ops->auth)) ++ return -EOPNOTSUPP; + wdev->conn->state = CFG80211_CONN_AUTHENTICATING; + return cfg80211_mlme_auth(rdev, wdev->netdev, + params->channel, params->auth_type, +@@ -161,7 +162,8 @@ static int cfg80211_conn_do_work(struct + case CFG80211_CONN_AUTH_FAILED: + return -ENOTCONN; + case CFG80211_CONN_ASSOCIATE_NEXT: +- BUG_ON(!rdev->ops->assoc); ++ if (WARN_ON(!rdev->ops->assoc)) ++ return -EOPNOTSUPP; + wdev->conn->state = CFG80211_CONN_ASSOCIATING; + if (wdev->conn->prev_bssid_valid) + req.prev_bssid = wdev->conn->prev_bssid; +@@ -877,7 +879,7 @@ void __cfg80211_disconnected(struct net_ + } + + void cfg80211_disconnected(struct net_device *dev, u16 reason, +- u8 *ie, size_t ie_len, gfp_t gfp) ++ const u8 *ie, size_t ie_len, gfp_t gfp) + { + struct wireless_dev *wdev = dev->ieee80211_ptr; + struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); +--- a/net/wireless/trace.h ++++ b/net/wireless/trace.h +@@ -1876,29 +1876,33 @@ TRACE_EVENT(rdev_channel_switch, + WIPHY_ENTRY + NETDEV_ENTRY + CHAN_DEF_ENTRY +- __field(u16, counter_offset_beacon) +- __field(u16, counter_offset_presp) + __field(bool, radar_required) + __field(bool, block_tx) + __field(u8, count) ++ __dynamic_array(u16, bcn_ofs, params->n_counter_offsets_beacon) ++ __dynamic_array(u16, pres_ofs, params->n_counter_offsets_presp) + ), + TP_fast_assign( + WIPHY_ASSIGN; + NETDEV_ASSIGN; + CHAN_DEF_ASSIGN(¶ms->chandef); +- __entry->counter_offset_beacon = params->counter_offset_beacon; +- __entry->counter_offset_presp = params->counter_offset_presp; + __entry->radar_required = params->radar_required; + __entry->block_tx = params->block_tx; + __entry->count = params->count; ++ memcpy(__get_dynamic_array(bcn_ofs), ++ params->counter_offsets_beacon, ++ params->n_counter_offsets_beacon * sizeof(u16)); ++ ++ /* probe response offsets are optional */ ++ if (params->n_counter_offsets_presp) ++ memcpy(__get_dynamic_array(pres_ofs), ++ params->counter_offsets_presp, ++ params->n_counter_offsets_presp * sizeof(u16)); + ), + TP_printk(WIPHY_PR_FMT ", " NETDEV_PR_FMT ", " CHAN_DEF_PR_FMT +- ", block_tx: %d, count: %u, radar_required: %d" +- ", counter offsets (beacon/presp): %u/%u", ++ ", block_tx: %d, count: %u, radar_required: %d", + WIPHY_PR_ARG, NETDEV_PR_ARG, CHAN_DEF_PR_ARG, +- __entry->block_tx, __entry->count, __entry->radar_required, +- __entry->counter_offset_beacon, +- __entry->counter_offset_presp) ++ __entry->block_tx, __entry->count, __entry->radar_required) + ); + + TRACE_EVENT(rdev_set_qos_map, +@@ -2636,6 +2640,21 @@ TRACE_EVENT(cfg80211_ft_event, + WIPHY_PR_ARG, NETDEV_PR_ARG, MAC_PR_ARG(target_ap)) + ); + ++TRACE_EVENT(cfg80211_stop_iface, ++ TP_PROTO(struct wiphy *wiphy, struct wireless_dev *wdev), ++ TP_ARGS(wiphy, wdev), ++ TP_STRUCT__entry( ++ WIPHY_ENTRY ++ WDEV_ENTRY ++ ), ++ TP_fast_assign( ++ WIPHY_ASSIGN; ++ WDEV_ASSIGN; ++ ), ++ TP_printk(WIPHY_PR_FMT ", " WDEV_PR_FMT, ++ WIPHY_PR_ARG, WDEV_PR_ARG) ++); ++ + #endif /* !__RDEV_OPS_TRACE || TRACE_HEADER_MULTI_READ */ + + #undef TRACE_INCLUDE_PATH +--- a/net/wireless/util.c ++++ b/net/wireless/util.c +@@ -476,7 +476,8 @@ int ieee80211_data_to_8023(struct sk_buf + EXPORT_SYMBOL(ieee80211_data_to_8023); + + int ieee80211_data_from_8023(struct sk_buff *skb, const u8 *addr, +- enum nl80211_iftype iftype, u8 *bssid, bool qos) ++ enum nl80211_iftype iftype, ++ const u8 *bssid, bool qos) + { + struct ieee80211_hdr hdr; + u16 hdrlen, ethertype; +@@ -839,6 +840,9 @@ void cfg80211_process_wdev_events(struct + __cfg80211_ibss_joined(wdev->netdev, ev->ij.bssid, + ev->ij.channel); + break; ++ case EVENT_STOPPED: ++ __cfg80211_leave(wiphy_to_rdev(wdev->wiphy), wdev); ++ break; + } + wdev_unlock(wdev); + +@@ -1271,10 +1275,20 @@ int cfg80211_iter_combinations(struct wi + void *data), + void *data) + { ++ const struct ieee80211_regdomain *regdom; ++ enum nl80211_dfs_regions region = 0; + int i, j, iftype; + int num_interfaces = 0; + u32 used_iftypes = 0; + ++ if (radar_detect) { ++ rcu_read_lock(); ++ regdom = rcu_dereference(cfg80211_regdomain); ++ if (regdom) ++ region = regdom->dfs_region; ++ rcu_read_unlock(); ++ } ++ + for (iftype = 0; iftype < NUM_NL80211_IFTYPES; iftype++) { + num_interfaces += iftype_num[iftype]; + if (iftype_num[iftype] > 0 && +@@ -1315,6 +1329,10 @@ int cfg80211_iter_combinations(struct wi + if (radar_detect != (c->radar_detect_widths & radar_detect)) + goto cont; + ++ if (radar_detect && c->radar_detect_regions && ++ !(c->radar_detect_regions & BIT(region))) ++ goto cont; ++ + /* Finally check that all iftypes that we're currently + * using are actually part of this combination. If they + * aren't then we can't use this combination and have --- a/drivers/net/wireless/ath/ath9k/main.c +++ b/drivers/net/wireless/ath/ath9k/main.c -@@ -442,6 +442,8 @@ void ath9k_tasklet(unsigned long data) +@@ -444,6 +444,8 @@ void ath9k_tasklet(unsigned long data) ath9k_ps_wakeup(sc); spin_lock(&sc->sc_pcu_lock); @@ -698,7 +4339,7 @@ Date: Sun Apr 6 23:35:28 2014 +0200 if (status & ATH9K_INT_FATAL) { type = RESET_TYPE_FATAL_INT; ath9k_queue_reset(sc, type); -@@ -510,10 +512,12 @@ void ath9k_tasklet(unsigned long data) +@@ -512,10 +514,12 @@ void ath9k_tasklet(unsigned long data) if (status & rxmask) { /* Check for high priority Rx first */ if ((ah->caps.hw_caps & ATH9K_HW_CAP_EDMA) && @@ -714,7 +4355,7 @@ Date: Sun Apr 6 23:35:28 2014 +0200 } if (status & ATH9K_INT_TX) { -@@ -541,6 +545,9 @@ void ath9k_tasklet(unsigned long data) +@@ -543,6 +547,9 @@ void ath9k_tasklet(unsigned long data) /* re-enable hardware interrupt */ ath9k_hw_enable_interrupts(ah); @@ -724,7 +4365,7 @@ Date: Sun Apr 6 23:35:28 2014 +0200 out: spin_unlock(&sc->sc_pcu_lock); ath9k_ps_restore(sc); -@@ -607,7 +614,7 @@ irqreturn_t ath_isr(int irq, void *dev) +@@ -609,7 +616,7 @@ irqreturn_t ath_isr(int irq, void *dev) return IRQ_NONE; /* Cache the status */ @@ -733,3 +4374,73 @@ Date: Sun Apr 6 23:35:28 2014 +0200 if (status & SCHED_INTR) sched = true; +--- a/drivers/net/wireless/ath/ath9k/recv.c ++++ b/drivers/net/wireless/ath/ath9k/recv.c +@@ -34,7 +34,8 @@ static inline bool ath9k_check_auto_slee + * buffer (or rx fifo). This can incorrectly acknowledge packets + * to a sender if last desc is self-linked. + */ +-static void ath_rx_buf_link(struct ath_softc *sc, struct ath_rxbuf *bf) ++static void ath_rx_buf_link(struct ath_softc *sc, struct ath_rxbuf *bf, ++ bool flush) + { + struct ath_hw *ah = sc->sc_ah; + struct ath_common *common = ath9k_hw_common(ah); +@@ -59,18 +60,19 @@ static void ath_rx_buf_link(struct ath_s + common->rx_bufsize, + 0); + +- if (sc->rx.rxlink == NULL) +- ath9k_hw_putrxbuf(ah, bf->bf_daddr); +- else ++ if (sc->rx.rxlink) + *sc->rx.rxlink = bf->bf_daddr; ++ else if (!flush) ++ ath9k_hw_putrxbuf(ah, bf->bf_daddr); + + sc->rx.rxlink = &ds->ds_link; + } + +-static void ath_rx_buf_relink(struct ath_softc *sc, struct ath_rxbuf *bf) ++static void ath_rx_buf_relink(struct ath_softc *sc, struct ath_rxbuf *bf, ++ bool flush) + { + if (sc->rx.buf_hold) +- ath_rx_buf_link(sc, sc->rx.buf_hold); ++ ath_rx_buf_link(sc, sc->rx.buf_hold, flush); + + sc->rx.buf_hold = bf; + } +@@ -442,7 +444,7 @@ int ath_startrecv(struct ath_softc *sc) + sc->rx.buf_hold = NULL; + sc->rx.rxlink = NULL; + list_for_each_entry_safe(bf, tbf, &sc->rx.rxbuf, list) { +- ath_rx_buf_link(sc, bf); ++ ath_rx_buf_link(sc, bf, false); + } + + /* We could have deleted elements so the list may be empty now */ +@@ -1118,12 +1120,12 @@ requeue_drop_frag: + requeue: + list_add_tail(&bf->list, &sc->rx.rxbuf); + +- if (edma) { +- ath_rx_edma_buf_link(sc, qtype); +- } else { +- ath_rx_buf_relink(sc, bf); ++ if (!edma) { ++ ath_rx_buf_relink(sc, bf, flush); + if (!flush) + ath9k_hw_rxena(ah); ++ } else if (!flush) { ++ ath_rx_edma_buf_link(sc, qtype); + } + + if (!budget--) +@@ -1135,5 +1137,5 @@ requeue: + ath9k_hw_set_interrupts(ah); + } + +- return 0; ++ return !budget; + } |