mac80211: add some improvements to the software queueing code

Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 44872

4 files changed, 268 insertions, 106 deletions

diff --git a/package/kernel/mac80211/patches/300-mac80211-add-an-intermediate-software-queue-implemen.patch b/package/kernel/mac80211/patches/300-mac80211-add-an-intermediate-software-queue-implemen.patch
index 475d32943b..154d911457 100644
--- a/package/kernel/mac80211/patches/300-mac80211-add-an-intermediate-software-queue-implemen.patch
+++ b/package/kernel/mac80211/patches/300-mac80211-add-an-intermediate-software-queue-implemen.patch
@@ -19,7 +19,42 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
 
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -1257,6 +1257,8 @@ struct ieee80211_vif {
+@@ -84,6 +84,34 @@
+  *
+  */
+ 
++/**
++ * DOC: mac80211 software tx queueing
++ *
++ * mac80211 provides an optional intermediate queueing implementation designed
++ * to allow the driver to keep hardware queues short and provide some fairness
++ * between different stations/interfaces.
++ * In this model, the driver pulls data frames from the mac80211 queue instead
++ * of letting mac80211 push them via drv_tx().
++ * Other frames (e.g. control or management) are still pushed using drv_tx().
++ *
++ * Intermediate queues (struct ieee80211_txq) are kept per-sta per-tid, with a
++ * single per-vif queue for multicast data frames.
++ *
++ * The driver is expected to initialize its private per-queue data for stations
++ * and interfaces in the .add_interface and .sta_add ops.
++ *
++ * The driver can not access the queue directly. To dequeue a frame, it calls
++ * ieee80211_tx_dequeue(). Whenever mac80211 adds a new frame to a queue, it
++ * calls the .wake_tx_queue driver op.
++ *
++ * For AP powersave TIM handling, the driver only needs to indicate if it has
++ * buffered packets in the driver specific data structures by calling
++ * ieee80211_sta_set_buffered(). For frames buffered in the ieee80211_txq
++ * struct, mac80211 sets TIM and calls .release_buffered_frames().
++ * The driver is expected to release its own buffered frames and also call
++ * ieee80211_tx_dequeue() within that callback.
++ */
++
+ struct device;
+ 
+ /**
+@@ -1257,6 +1285,8 @@ struct ieee80211_vif {
  	u8 cab_queue;
  	u8 hw_queue[IEEE80211_NUM_ACS];
  
@@ -28,7 +63,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  	struct ieee80211_chanctx_conf __rcu *chanctx_conf;
  
  	u32 driver_flags;
-@@ -1519,6 +1521,8 @@ struct ieee80211_sta {
+@@ -1519,6 +1549,8 @@ struct ieee80211_sta {
  	bool tdls_initiator;
  	bool mfp;
  
@@ -37,7 +72,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  	/* must be last */
  	u8 drv_priv[0] __aligned(sizeof(void *));
  };
-@@ -1547,6 +1551,27 @@ struct ieee80211_tx_control {
+@@ -1547,6 +1579,27 @@ struct ieee80211_tx_control {
  };
  
  /**
@@ -45,7 +80,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
 + *
 + * @vif: &struct ieee80211_vif pointer from the add_interface callback.
 + * @sta: station table entry, may be NULL for per-vif queue
-+ * @tid: the TID for this queue (unset for per-vif queue)
++ * @tid: the TID for this queue (unused for per-vif queue)
 + * @ac: the AC for this queue
 + *
 + * The driver can obtain packets from this queue by calling
@@ -65,7 +100,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
   * enum ieee80211_hw_flags - hardware flags
   *
   * These flags are used to indicate hardware capabilities to
-@@ -1770,6 +1795,8 @@ enum ieee80211_hw_flags {
+@@ -1770,6 +1823,8 @@ enum ieee80211_hw_flags {
   *	within &struct ieee80211_sta.
   * @chanctx_data_size: size (in bytes) of the drv_priv data area
   *	within &struct ieee80211_chanctx_conf.
@@ -74,7 +109,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
   *
   * @max_rates: maximum number of alternate rate retry stages the hw
   *	can handle.
-@@ -1818,6 +1845,9 @@ enum ieee80211_hw_flags {
+@@ -1818,6 +1873,9 @@ enum ieee80211_hw_flags {
   * @n_cipher_schemes: a size of an array of cipher schemes definitions.
   * @cipher_schemes: a pointer to an array of cipher scheme definitions
   *	supported by HW.
@@ -84,7 +119,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
   */
  struct ieee80211_hw {
  	struct ieee80211_conf conf;
-@@ -1830,6 +1860,7 @@ struct ieee80211_hw {
+@@ -1830,6 +1888,7 @@ struct ieee80211_hw {
  	int vif_data_size;
  	int sta_data_size;
  	int chanctx_data_size;
@@ -92,7 +127,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  	u16 queues;
  	u16 max_listen_interval;
  	s8 max_signal;
-@@ -1846,6 +1877,7 @@ struct ieee80211_hw {
+@@ -1846,6 +1905,7 @@ struct ieee80211_hw {
  	u8 uapsd_max_sp_len;
  	u8 n_cipher_schemes;
  	const struct ieee80211_cipher_scheme *cipher_schemes;
@@ -100,7 +135,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  };
  
  /**
-@@ -3007,6 +3039,8 @@ enum ieee80211_reconfig_type {
+@@ -3007,6 +3067,8 @@ enum ieee80211_reconfig_type {
   *	response template is provided, together with the location of the
   *	switch-timing IE within the template. The skb can only be used within
   *	the function call.
@@ -109,7 +144,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
   */
  struct ieee80211_ops {
  	void (*tx)(struct ieee80211_hw *hw,
-@@ -3238,6 +3272,9 @@ struct ieee80211_ops {
+@@ -3238,6 +3300,9 @@ struct ieee80211_ops {
  	void (*tdls_recv_channel_switch)(struct ieee80211_hw *hw,
  					 struct ieee80211_vif *vif,
  					 struct ieee80211_tdls_ch_sw_params *params);
@@ -119,7 +154,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  };
  
  /**
-@@ -5249,4 +5286,17 @@ void ieee80211_unreserve_tid(struct ieee
+@@ -5249,4 +5314,17 @@ void ieee80211_unreserve_tid(struct ieee
   */
  size_t ieee80211_ie_split(const u8 *ies, size_t ielen,
  			  const u8 *ids, int n_ids, size_t offset);
@@ -130,7 +165,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
 + * @hw: pointer as obtained from ieee80211_alloc_hw()
 + * @txq: pointer obtained from .add_tx_queue() call
 + *
-+ * Returns the sjb if successful, ERR_PTR(-EAGAIN) if no frame was available.
++ * Returns the skb if successful, NULL if no frame was available.
 + */
 +struct sk_buff *ieee80211_tx_dequeue(struct ieee80211_hw *hw,
 +				     struct ieee80211_txq *txq);
@@ -139,7 +174,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  #endif /* MAC80211_H */
 --- a/net/mac80211/driver-ops.h
 +++ b/net/mac80211/driver-ops.h
-@@ -1367,4 +1367,21 @@ drv_tdls_recv_channel_switch(struct ieee
+@@ -1367,4 +1367,16 @@ drv_tdls_recv_channel_switch(struct ieee
  	trace_drv_return_void(local);
  }
  
@@ -151,24 +186,25 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
 +	if (!check_sdata_in_driver(sdata))
 +		return;
 +
-+	if (txq->txq.sta)
-+		trace_drv_wake_sta_tx_queue(local, sdata, txq->txq.sta,
-+					    txq->txq.tid);
-+	else
-+		trace_drv_wake_vif_tx_queue(local, sdata);
-+
++	trace_drv_wake_tx_queue(local, sdata, txq->txq.sta, txq->txq.tid);
 +	local->ops->wake_tx_queue(&local->hw, &txq->txq);
 +}
 +
  #endif /* __MAC80211_DRIVER_OPS */
 --- a/net/mac80211/ieee80211_i.h
 +++ b/net/mac80211/ieee80211_i.h
-@@ -809,6 +809,13 @@ struct mac80211_qos_map {
+@@ -809,6 +809,19 @@ struct mac80211_qos_map {
  	struct rcu_head rcu_head;
  };
  
++enum txq_info_flags {
++	IEEE80211_TXQ_STOP,
++	IEEE80211_TXQ_AMPDU,
++};
++
 +struct txq_info {
 +	struct sk_buff_head queue;
++	unsigned long flags;
 +
 +	/* keep last! */
 +	struct ieee80211_txq txq;
@@ -177,7 +213,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  struct ieee80211_sub_if_data {
  	struct list_head list;
  
-@@ -853,6 +860,7 @@ struct ieee80211_sub_if_data {
+@@ -853,6 +866,7 @@ struct ieee80211_sub_if_data {
  	bool control_port_no_encrypt;
  	int encrypt_headroom;
  
@@ -185,7 +221,18 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  	struct ieee80211_tx_queue_params tx_conf[IEEE80211_NUM_ACS];
  	struct mac80211_qos_map __rcu *qos_map;
  
-@@ -1905,6 +1913,12 @@ static inline bool ieee80211_can_run_wor
+@@ -1453,6 +1467,10 @@ static inline struct ieee80211_local *hw
+ 	return container_of(hw, struct ieee80211_local, hw);
+ }
+ 
++static inline struct txq_info *to_txq_info(struct ieee80211_txq *txq)
++{
++	return container_of(txq, struct txq_info, txq);
++}
+ 
+ static inline int ieee80211_bssid_match(const u8 *raddr, const u8 *addr)
+ {
+@@ -1905,6 +1923,12 @@ static inline bool ieee80211_can_run_wor
  	return true;
  }
  
@@ -234,43 +281,22 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  			free_netdev(ndev);
  			return ret;
  		}
-@@ -1802,6 +1815,7 @@ int ieee80211_if_add(struct ieee80211_lo
- 
- void ieee80211_if_remove(struct ieee80211_sub_if_data *sdata)
- {
-+	struct txq_info *txqi;
- 	ASSERT_RTNL();
- 
- 	mutex_lock(&sdata->local->iflist_mtx);
-@@ -1810,6 +1824,11 @@ void ieee80211_if_remove(struct ieee8021
+@@ -1810,6 +1823,9 @@ void ieee80211_if_remove(struct ieee8021
  
  	synchronize_rcu();
  
-+	if (sdata->vif.txq) {
-+		txqi = container_of(sdata->vif.txq, struct txq_info, txq);
-+		kfree(txqi);
-+	}
++	if (sdata->vif.txq)
++		kfree(to_txq_info(sdata->vif.txq));
 +
  	if (sdata->dev) {
  		unregister_netdevice(sdata->dev);
  	} else {
-@@ -1833,6 +1852,7 @@ void ieee80211_sdata_stop(struct ieee802
- void ieee80211_remove_interfaces(struct ieee80211_local *local)
- {
- 	struct ieee80211_sub_if_data *sdata, *tmp;
-+	struct txq_info *txqi;
- 	LIST_HEAD(unreg_list);
- 	LIST_HEAD(wdev_list);
- 
-@@ -1851,6 +1871,12 @@ void ieee80211_remove_interfaces(struct 
+@@ -1851,6 +1867,9 @@ void ieee80211_remove_interfaces(struct 
  	list_for_each_entry_safe(sdata, tmp, &local->interfaces, list) {
  		list_del(&sdata->list);
  
-+		if (sdata->vif.txq) {
-+			txqi = container_of(sdata->vif.txq, struct txq_info,
-+					   txq);
-+			kfree(txqi);
-+		}
++		if (sdata->vif.txq)
++			kfree(to_txq_info(sdata->vif.txq));
 +
  		if (sdata->dev)
  			unregister_netdevice_queue(sdata->dev, &unreg_list);
@@ -293,23 +319,24 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  		atomic_dec(&ps->num_sta_ps);
  	}
  
-+	if (sta->txqi) {
-+		for (i = 0; i < IEEE80211_NUM_TIDS; i++)
++	if (sta->sta.txq[0]) {
++		for (i = 0; i < ARRAY_SIZE(sta->sta.txq); i++)
 +			ieee80211_flush_tx_queue(local, sta->sta.txq[i]);
 +	}
 +
  	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
  		local->total_ps_buffered -= skb_queue_len(&sta->ps_tx_buf[ac]);
  		ieee80211_purge_tx_queue(&local->hw, &sta->ps_tx_buf[ac]);
-@@ -234,6 +239,7 @@ void sta_info_free(struct ieee80211_loca
+@@ -234,6 +239,8 @@ void sta_info_free(struct ieee80211_loca
  
  	sta_dbg(sta->sdata, "Destroyed STA %pM\n", sta->sta.addr);
  
-+	kfree(sta->txqi);
++	if (sta->sta.txq[0])
++		kfree(to_txq_info(sta->sta.txq[0]));
  	kfree(rcu_dereference_raw(sta->sta.rates));
  	kfree(sta);
  }
-@@ -285,11 +291,12 @@ struct sta_info *sta_info_alloc(struct i
+@@ -285,11 +292,12 @@ struct sta_info *sta_info_alloc(struct i
  				const u8 *addr, gfp_t gfp)
  {
  	struct ieee80211_local *local = sdata->local;
@@ -323,7 +350,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  	if (!sta)
  		return NULL;
  
-@@ -321,11 +328,25 @@ struct sta_info *sta_info_alloc(struct i
+@@ -321,11 +329,24 @@ struct sta_info *sta_info_alloc(struct i
  	for (i = 0; i < ARRAY_SIZE(sta->chain_signal_avg); i++)
  		ewma_init(&sta->chain_signal_avg[i], 1024, 8);
  
@@ -335,12 +362,11 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
 +		int size = sizeof(struct txq_info) +
 +			   ALIGN(hw->txq_data_size, sizeof(void *));
 +
-+		txq_data = kcalloc(IEEE80211_NUM_TIDS, size, gfp);
++		txq_data = kcalloc(ARRAY_SIZE(sta->sta.txq), size, gfp);
 +		if (!txq_data)
 +			goto free;
 +
-+		sta->txqi = txq_data;
-+		for (i = 0; i < IEEE80211_NUM_TIDS; i++) {
++		for (i = 0; i < ARRAY_SIZE(sta->sta.txq); i++) {
 +			struct txq_info *txq = txq_data + i * size;
 +			ieee80211_init_tx_queue(sdata, sta, txq, i);
 +		}
@@ -361,20 +387,21 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  		u8 smps = (sband->ht_cap.cap & IEEE80211_HT_CAP_SM_PS) >>
  				IEEE80211_HT_CAP_SM_PS_SHIFT;
  		/*
-@@ -371,6 +392,12 @@ struct sta_info *sta_info_alloc(struct i
+@@ -371,6 +392,13 @@ struct sta_info *sta_info_alloc(struct i
  	sta_dbg(sdata, "Allocated STA %pM\n", sta->sta.addr);
  
  	return sta;
 +
 +free_txq:
-+	kfree(sta->txqi);
++	if (sta->sta.txq[0])
++		kfree(to_txq_info(sta->sta.txq[0]));
 +free:
 +	kfree(sta);
 +	return NULL;
  }
  
  static int sta_info_insert_check(struct sta_info *sta)
-@@ -640,6 +667,8 @@ static void __sta_info_recalc_tim(struct
+@@ -640,6 +668,8 @@ static void __sta_info_recalc_tim(struct
  
  		indicate_tim |=
  			sta->driver_buffered_tids & tids;
@@ -383,7 +410,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  	}
  
   done:
-@@ -1071,7 +1100,7 @@ void ieee80211_sta_ps_deliver_wakeup(str
+@@ -1071,7 +1101,7 @@ void ieee80211_sta_ps_deliver_wakeup(str
  	struct ieee80211_sub_if_data *sdata = sta->sdata;
  	struct ieee80211_local *local = sdata->local;
  	struct sk_buff_head pending;
@@ -392,7 +419,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  	unsigned long flags;
  	struct ps_data *ps;
  
-@@ -1090,10 +1119,25 @@ void ieee80211_sta_ps_deliver_wakeup(str
+@@ -1090,10 +1120,22 @@ void ieee80211_sta_ps_deliver_wakeup(str
  
  	BUILD_BUG_ON(BITS_TO_LONGS(IEEE80211_NUM_TIDS) > 1);
  	sta->driver_buffered_tids = 0;
@@ -401,12 +428,9 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  	if (!(local->hw.flags & IEEE80211_HW_AP_LINK_PS))
  		drv_sta_notify(local, sdata, STA_NOTIFY_AWAKE, &sta->sta);
  
-+	if (sta->txqi) {
++	if (sta->sta.txq[0]) {
 +		for (i = 0; i < ARRAY_SIZE(sta->sta.txq); i++) {
-+			struct txq_info *txqi;
-+
-+			txqi = container_of(sta->sta.txq[i], struct txq_info,
-+					    txq);
++			struct txq_info *txqi = to_txq_info(sta->sta.txq[i]);
 +
 +			if (!skb_queue_len(&txqi->queue))
 +				continue;
@@ -418,7 +442,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  	skb_queue_head_init(&pending);
  
  	/* sync with ieee80211_tx_h_unicast_ps_buf */
-@@ -1254,7 +1298,7 @@ ieee80211_sta_ps_deliver_response(struct
+@@ -1254,7 +1296,7 @@ ieee80211_sta_ps_deliver_response(struct
  	struct ieee80211_sub_if_data *sdata = sta->sdata;
  	struct ieee80211_local *local = sdata->local;
  	bool more_data = false;
@@ -427,7 +451,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  	unsigned long driver_release_tids = 0;
  	struct sk_buff_head frames;
  
-@@ -1275,8 +1319,10 @@ ieee80211_sta_ps_deliver_response(struct
+@@ -1275,8 +1317,10 @@ ieee80211_sta_ps_deliver_response(struct
  		/* if we already have frames from software, then we can't also
  		 * release from hardware queues
  		 */
@@ -439,7 +463,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  
  		if (driver_release_tids) {
  			/* If the driver has data on more than one TID then
-@@ -1447,6 +1493,8 @@ ieee80211_sta_ps_deliver_response(struct
+@@ -1447,6 +1491,8 @@ ieee80211_sta_ps_deliver_response(struct
  
  		sta_info_recalc_tim(sta);
  	} else {
@@ -448,7 +472,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  		/*
  		 * We need to release a frame that is buffered somewhere in the
  		 * driver ... it'll have to handle that.
-@@ -1466,8 +1514,25 @@ ieee80211_sta_ps_deliver_response(struct
+@@ -1466,8 +1512,22 @@ ieee80211_sta_ps_deliver_response(struct
  		 * that the TID(s) became empty before returning here from the
  		 * release function.
  		 * Either way, however, when the driver tells us that the TID(s)
@@ -457,14 +481,11 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
 +		 * TIM recalculation.
  		 */
 +
-+		if (!sta->txqi)
++		if (!sta->sta.txq[0])
 +			return;
 +
-+		for (tid = 0; tid < IEEE80211_NUM_TIDS; tid++) {
-+			struct txq_info *txqi;
-+
-+			txqi = container_of(sta->sta.txq[tid], struct txq_info,
-+					    txq);
++		for (tid = 0; tid < ARRAY_SIZE(sta->sta.txq); tid++) {
++			struct txq_info *txqi = to_txq_info(sta->sta.txq[tid]);
 +
 +			if (!(tids & BIT(tid)) || skb_queue_len(&txqi->queue))
 +				continue;
@@ -485,28 +506,21 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
   * @rx_packets: Number of MSDUs received from this STA
   * @rx_bytes: Number of bytes received from this STA
   * @last_rx: time (in jiffies) when last frame was received from this STA
-@@ -368,6 +369,8 @@ struct sta_info {
+@@ -368,6 +369,7 @@ struct sta_info {
  	struct sk_buff_head ps_tx_buf[IEEE80211_NUM_ACS];
  	struct sk_buff_head tx_filtered[IEEE80211_NUM_ACS];
  	unsigned long driver_buffered_tids;
 +	unsigned long txq_buffered_tids;
-+	struct txq_info *txqi;
  
  	/* Updated from RX path only, no locking requirements */
  	unsigned long rx_packets;
 --- a/net/mac80211/trace.h
 +++ b/net/mac80211/trace.h
-@@ -2312,6 +2312,40 @@ TRACE_EVENT(drv_tdls_recv_channel_switch
+@@ -2312,6 +2312,34 @@ TRACE_EVENT(drv_tdls_recv_channel_switch
  	)
  );
  
-+DEFINE_EVENT(local_sdata_evt, drv_wake_vif_tx_queue,
-+	TP_PROTO(struct ieee80211_local *local,
-+		 struct ieee80211_sub_if_data *sdata),
-+	TP_ARGS(local, sdata)
-+);
-+
-+TRACE_EVENT(drv_wake_sta_tx_queue,
++TRACE_EVENT(drv_wake_tx_queue,
 +	TP_PROTO(struct ieee80211_local *local,
 +		 struct ieee80211_sub_if_data *sdata,
 +		 struct ieee80211_sta *sta,
@@ -539,7 +553,57 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  #define TRACE_SYSTEM mac80211_msg
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -1201,13 +1201,80 @@ ieee80211_tx_prepare(struct ieee80211_su
+@@ -776,12 +776,23 @@ ieee80211_tx_h_rate_ctrl(struct ieee8021
+ 	return TX_CONTINUE;
+ }
+ 
++static u16
++ieee80211_tx_next_seq(struct sta_info *sta, int tid)
++{
++	u16 *seq = &sta->tid_seq[tid];
++	u16 ret = cpu_to_le16(*seq);
++
++	/* Increase the sequence number. */
++	*seq = (*seq + 0x10) & IEEE80211_SCTL_SEQ;
++
++	return ret;
++}
++
+ static ieee80211_tx_result debug_noinline
+ ieee80211_tx_h_sequence(struct ieee80211_tx_data *tx)
+ {
+ 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
+ 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
+-	u16 *seq;
+ 	u8 *qc;
+ 	int tid;
+ 
+@@ -832,13 +843,10 @@ ieee80211_tx_h_sequence(struct ieee80211
+ 
+ 	qc = ieee80211_get_qos_ctl(hdr);
+ 	tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
+-	seq = &tx->sta->tid_seq[tid];
+ 	tx->sta->tx_msdu[tid]++;
+ 
+-	hdr->seq_ctrl = cpu_to_le16(*seq);
+-
+-	/* Increase the sequence number. */
+-	*seq = (*seq + 0x10) & IEEE80211_SCTL_SEQ;
++	if (!tx->sta->sta.txq[0])
++		hdr->seq_ctrl = ieee80211_tx_next_seq(tx->sta, tid);
+ 
+ 	return TX_CONTINUE;
+ }
+@@ -1067,7 +1075,7 @@ static bool ieee80211_tx_prep_agg(struct
+ 		 * nothing -- this aggregation session is being started
+ 		 * but that might still fail with the driver
+ 		 */
+-	} else {
++	} else if (!tx->sta->sta.txq[tid]) {
+ 		spin_lock(&tx->sta->lock);
+ 		/*
+ 		 * Need to re-check now, because we may get here
+@@ -1201,13 +1209,101 @@ ieee80211_tx_prepare(struct ieee80211_su
  	return TX_CONTINUE;
  }
  
@@ -561,8 +625,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
 +	if (info->control.flags & IEEE80211_TX_CTRL_PS_RESPONSE)
 +		goto tx_normal;
 +
-+	if (ieee80211_is_mgmt(hdr->frame_control) ||
-+	    ieee80211_is_ctl(hdr->frame_control))
++	if (!ieee80211_is_data(hdr->frame_control))
 +		goto tx_normal;
 +
 +	if (pubsta) {
@@ -596,17 +659,39 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
 +	struct ieee80211_local *local = hw_to_local(hw);
 +	struct ieee80211_sub_if_data *sdata = vif_to_sdata(txq->vif);
 +	struct txq_info *txqi = container_of(txq, struct txq_info, txq);
-+	struct sk_buff *skb;
++	struct ieee80211_hdr *hdr;
++	struct sk_buff *skb = NULL;
 +	u8 ac = txq->ac;
 +
-+	skb = skb_dequeue(&txqi->queue);
++	spin_lock_bh(&txqi->queue.lock);
++
++	if (test_bit(IEEE80211_TXQ_STOP, &txqi->flags))
++		goto out;
++
++	skb = __skb_dequeue(&txqi->queue);
 +	if (!skb)
-+		return ERR_PTR(-EAGAIN);
++		goto out;
 +
 +	atomic_dec(&sdata->txqs_len[ac]);
 +	if (__netif_subqueue_stopped(sdata->dev, ac))
 +		ieee80211_propagate_queue_wake(local, sdata->vif.hw_queue[ac]);
 +
++	hdr = (struct ieee80211_hdr *)skb->data;
++	if (txq->sta && ieee80211_is_data_qos(hdr->frame_control)) {
++		struct sta_info *sta = container_of(txq->sta, struct sta_info,
++						    sta);
++		struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
++
++		hdr->seq_ctrl = ieee80211_tx_next_seq(sta, txq->tid);
++		if (test_bit(IEEE80211_TXQ_AMPDU, &txqi->flags))
++			info->flags |= IEEE80211_TX_CTL_AMPDU;
++		else
++			info->flags &= ~IEEE80211_TX_CTL_AMPDU;
++	}
++
++out:
++	spin_unlock_bh(&txqi->queue.lock);
++
 +	return skb;
 +}
 +EXPORT_SYMBOL(ieee80211_tx_dequeue);
@@ -621,7 +706,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  	struct sk_buff *skb, *tmp;
  	unsigned long flags;
  
-@@ -1265,10 +1332,9 @@ static bool ieee80211_tx_frags(struct ie
+@@ -1265,10 +1361,9 @@ static bool ieee80211_tx_frags(struct ie
  		spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
  
  		info->control.vif = vif;
@@ -694,18 +779,16 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  
  	if (sta->sdata->vif.type == NL80211_IFTYPE_AP ||
  	    sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
-@@ -1189,6 +1190,20 @@ static void sta_ps_start(struct sta_info
+@@ -1189,6 +1190,18 @@ static void sta_ps_start(struct sta_info
  		drv_sta_notify(local, sdata, STA_NOTIFY_SLEEP, &sta->sta);
  	ps_dbg(sdata, "STA %pM aid %d enters power save mode\n",
  	       sta->sta.addr, sta->sta.aid);
 +
-+	if (!sta->txqi)
++	if (!sta->sta.txq[0])
 +		return;
 +
-+	for (tid = 0; tid < IEEE80211_NUM_TIDS; tid++) {
-+		struct txq_info *txqi;
-+
-+		txqi = container_of(sta->sta.txq[tid], struct txq_info, txq);
++	for (tid = 0; tid < ARRAY_SIZE(sta->sta.txq); tid++) {
++		struct txq_info *txqi = to_txq_info(sta->sta.txq[tid]);
 +
 +		if (!skb_queue_len(&txqi->queue))
 +			set_bit(tid, &sta->txq_buffered_tids);
@@ -715,3 +798,82 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  }
  
  static void sta_ps_end(struct sta_info *sta)
+--- a/net/mac80211/agg-tx.c
++++ b/net/mac80211/agg-tx.c
+@@ -188,6 +188,41 @@ ieee80211_wake_queue_agg(struct ieee8021
+ 	__release(agg_queue);
+ }
+ 
++static void
++ieee80211_agg_stop_txq(struct sta_info *sta, int tid)
++{
++	struct ieee80211_txq *txq = sta->sta.txq[tid];
++	struct txq_info *txqi;
++
++	if (!txq)
++		return;
++
++	txqi = to_txq_info(txq);
++	spin_lock_bh(&txqi->queue.lock);
++	set_bit(IEEE80211_TXQ_STOP, &txqi->flags);
++	spin_unlock_bh(&txqi->queue.lock);
++}
++
++static void
++ieee80211_agg_start_txq(struct sta_info *sta, int tid, bool enable)
++{
++	struct ieee80211_txq *txq = sta->sta.txq[tid];
++	struct txq_info *txqi;
++
++	if (!txq)
++		return;
++
++	txqi = to_txq_info(txq);
++
++	if (enable)
++		set_bit(IEEE80211_TXQ_AMPDU, &txqi->flags);
++	else
++		clear_bit(IEEE80211_TXQ_AMPDU, &txqi->flags);
++
++	clear_bit(IEEE80211_TXQ_STOP, &txqi->flags);
++	drv_wake_tx_queue(sta->sdata->local, txqi);
++}
++
+ /*
+  * splice packets from the STA's pending to the local pending,
+  * requires a call to ieee80211_agg_splice_finish later
+@@ -247,6 +282,7 @@ static void ieee80211_remove_tid_tx(stru
+ 	ieee80211_assign_tid_tx(sta, tid, NULL);
+ 
+ 	ieee80211_agg_splice_finish(sta->sdata, tid);
++	ieee80211_agg_start_txq(sta, tid, false);
+ 
+ 	kfree_rcu(tid_tx, rcu_head);
+ }
+@@ -418,6 +454,8 @@ void ieee80211_tx_ba_session_handle_star
+ 	 */
+ 	clear_bit(HT_AGG_STATE_WANT_START, &tid_tx->state);
+ 
++	ieee80211_agg_stop_txq(sta, tid);
++
+ 	/*
+ 	 * Make sure no packets are being processed. This ensures that
+ 	 * we have a valid starting sequence number and that in-flight
+@@ -440,6 +478,8 @@ void ieee80211_tx_ba_session_handle_star
+ 		ieee80211_agg_splice_finish(sdata, tid);
+ 		spin_unlock_bh(&sta->lock);
+ 
++		ieee80211_agg_start_txq(sta, tid, false);
++
+ 		kfree_rcu(tid_tx, rcu_head);
+ 		return;
+ 	}
+@@ -666,6 +706,8 @@ static void ieee80211_agg_tx_operational
+ 	ieee80211_agg_splice_finish(sta->sdata, tid);
+ 
+ 	spin_unlock_bh(&sta->lock);
++
++	ieee80211_agg_start_txq(sta, tid, true);
+ }
+ 
+ void ieee80211_start_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u16 tid)
diff --git a/package/kernel/mac80211/patches/301-mac80211-lock-rate-control.patch b/package/kernel/mac80211/patches/301-mac80211-lock-rate-control.patch
index 3acc529bb9..53d981b9e9 100644
--- a/package/kernel/mac80211/patches/301-mac80211-lock-rate-control.patch
+++ b/package/kernel/mac80211/patches/301-mac80211-lock-rate-control.patch
@@ -104,7 +104,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  static inline void rate_control_free_sta(struct sta_info *sta)
 --- a/net/mac80211/sta_info.c
 +++ b/net/mac80211/sta_info.c
-@@ -280,7 +280,7 @@ static int sta_prepare_rate_control(stru
+@@ -281,7 +281,7 @@ static int sta_prepare_rate_control(stru
  
  	sta->rate_ctrl = local->rate_ctrl;
  	sta->rate_ctrl_priv = rate_control_alloc_sta(sta->rate_ctrl,
diff --git a/package/kernel/mac80211/patches/402-ath_regd_optional.patch b/package/kernel/mac80211/patches/402-ath_regd_optional.patch
index 1c32a06361..2dac5057c9 100644
--- a/package/kernel/mac80211/patches/402-ath_regd_optional.patch
+++ b/package/kernel/mac80211/patches/402-ath_regd_optional.patch
@@ -47,7 +47,7 @@
  
 --- a/drivers/net/wireless/ath/Kconfig
 +++ b/drivers/net/wireless/ath/Kconfig
-@@ -21,6 +21,9 @@ menuconfig ATH_CARDS
+@@ -22,6 +22,9 @@ menuconfig ATH_CARDS
  
  if ATH_CARDS
  
diff --git a/package/kernel/mac80211/patches/522-mac80211_configure_antenna_gain.patch b/package/kernel/mac80211/patches/522-mac80211_configure_antenna_gain.patch
index 9712d6e153..486b0719c8 100644
--- a/package/kernel/mac80211/patches/522-mac80211_configure_antenna_gain.patch
+++ b/package/kernel/mac80211/patches/522-mac80211_configure_antenna_gain.patch
@@ -18,7 +18,7 @@
  				const u8 *addr);
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -1138,6 +1138,7 @@ enum ieee80211_smps_mode {
+@@ -1166,6 +1166,7 @@ enum ieee80211_smps_mode {
   *
   * @power_level: requested transmit power (in dBm), backward compatibility
   *	value only that is set to the minimum of all interfaces
@@ -26,7 +26,7 @@
   *
   * @chandef: the channel definition to tune to
   * @radar_enabled: whether radar detection is enabled
-@@ -1159,6 +1160,7 @@ struct ieee80211_conf {
+@@ -1187,6 +1188,7 @@ struct ieee80211_conf {
  	u32 flags;
  	int power_level, dynamic_ps_timeout;
  	int max_sleep_period;
@@ -87,7 +87,7 @@
  	CFG80211_TESTMODE_CMD(ieee80211_testmode_cmd)
 --- a/net/mac80211/ieee80211_i.h
 +++ b/net/mac80211/ieee80211_i.h
-@@ -1330,6 +1330,7 @@ struct ieee80211_local {
+@@ -1336,6 +1336,7 @@ struct ieee80211_local {
  	int dynamic_ps_forced_timeout;
  
  	int user_power_level; /* in dBm, for all interfaces */