mac80211: update to wireless-testing 2013-06-13 + latest backport infrastructure

Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 36939

71 files changed, 745 insertions, 5821 deletions

diff --git a/package/mac80211/patches/000-disable_drivers.patch b/package/mac80211/patches/000-disable_drivers.patch
deleted file mode 100644
index 7c5944280c..0000000000
--- a/package/mac80211/patches/000-disable_drivers.patch
+++ /dev/null
@@ -1,37 +0,0 @@
---- a/config.mk
-+++ b/config.mk
-@@ -724,34 +724,3 @@ endif #CONFIG_LEDS_TRIGGERS
- # export CONFIG_RFKILL_BACKPORT_INPUT=y
- endif #CONFIG_COMPAT_KERNEL_2_6_31
- 
--# compilation has been tested down to 3.0 but run time
--# tests have only started on 3.2.
--ifndef CONFIG_COMPAT_KERNEL_3_2
--# Basic DRM support
--export CONFIG_COMPAT_VIDEO_MODULES=y
--export CONFIG_COMPAT_DRM=m
--export CONFIG_COMPAT_DRM_TTM=m
--export CONFIG_COMPAT_DRM_KMS_HELPER=m
--export CONFIG_COMPAT_DRM_LOAD_EDID_FIRMWARE=y
--# Intel i915
--export CONFIG_COMPAT_DRM_I915=m
--# ATI/AMD Radeon
--export CONFIG_COMPAT_DRM_RADEON=m
--export CONFIG_COMPAT_DRM_RADEON_KMS=y
--export CONFIG_COMPAT_DRM_NOUVEAU=m
--export CONFIG_COMPAT_DRM_NOUVEAU_BACKLIGHT=y
--export CONFIG_COMPAT_NOUVEAU_DEBUG=5
--export CONFIG_COMPAT_NOUVEAU_DEBUG_DEFAULT=3
--ifdef CONFIG_MEDIA_CONTROLLER
--export CONFIG_COMPAT_USB_VIDEO_CLASS=m
--endif #CONFIG_MEDIA_CONTROLLER
--export CONFIG_USB_VIDEO_CLASS=y
--endif #CONFIG_COMPAT_KERNEL_3_2
--
--ifndef CONFIG_COMPAT_KERNEL_3_2
--export CONFIG_COMPAT_MEDIA_MODULES=y
--export CONFIG_COMPAT_VIDEO_V4L2=m
--export CONFIG_COMPAT_VIDEOBUF2_CORE=m
--export CONFIG_COMPAT_VIDEOBUF2_VMALLOC=m
--export CONFIG_COMPAT_VIDEOBUF2_MEMOPS=m
--endif #CONFIG_COMPAT_KERNEL_3_2
diff --git a/package/mac80211/patches/000-fix_kconfig.patch b/package/mac80211/patches/000-fix_kconfig.patch
new file mode 100644
index 0000000000..88d0b04984
--- /dev/null
+++ b/package/mac80211/patches/000-fix_kconfig.patch
@@ -0,0 +1,16 @@
+--- a/kconf/Makefile
++++ b/kconf/Makefile
+@@ -1,10 +1,10 @@
+-CFLAGS=-Wall -Wmissing-prototypes -Wstrict-prototypes -O2 -fomit-frame-pointer
++CFLAGS=-Wall -Wmissing-prototypes -Wstrict-prototypes -O2 -fomit-frame-pointer -DKBUILD_NO_NLS
+ 
+ LXDIALOG := lxdialog/checklist.o lxdialog/inputbox.o lxdialog/menubox.o lxdialog/textbox.o lxdialog/util.o lxdialog/yesno.o
+ 
+ conf: conf.o zconf.tab.o
+-mconf: LDFLAGS = -Wl,--no-as-needed $(shell ./lxdialog/check-lxdialog.sh -ldflags $(CC))
+-mconf: CFLAGS += -DCURSES_LOC="<ncurses.h>" -DLOCALE
++mconf: LDFLAGS = $(shell ./lxdialog/check-lxdialog.sh -ldflags $(CC))
++mconf: CFLAGS += -DCURSES_LOC="<ncurses.h>"
+ mconf: mconf.o zconf.tab.o $(LXDIALOG)
+ 
+ .PHONY: clean
diff --git a/package/mac80211/patches/001-disable_rfkill.patch b/package/mac80211/patches/001-disable_rfkill.patch
deleted file mode 100644
index 7af485f5bf..0000000000
--- a/package/mac80211/patches/001-disable_rfkill.patch
+++ /dev/null
@@ -1,13 +0,0 @@
---- a/include/linux/rfkill.h
-+++ b/include/linux/rfkill.h
-@@ -3,6 +3,10 @@
- 
- #if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,31))
- 
-+#undef CONFIG_RFKILL
-+#undef CONFIG_RFKILL_LEDS
-+#undef CONFIG_RFKILL_MODULE
-+
- #include_next <linux/rfkill.h>
- 
- #else
diff --git a/package/mac80211/patches/001-fix_build.patch b/package/mac80211/patches/001-fix_build.patch
new file mode 100644
index 0000000000..c541985cf3
--- /dev/null
+++ b/package/mac80211/patches/001-fix_build.patch
@@ -0,0 +1,156 @@
+--- a/Makefile
++++ b/Makefile
+@@ -19,6 +19,7 @@ KLIB_BUILD ?= $(KLIB)/build/
+ KERNEL_CONFIG := $(KLIB_BUILD)/.config
+ KERNEL_MAKEFILE := $(KLIB_BUILD)/Makefile
+ CONFIG_MD5 := $(shell md5sum $(KERNEL_CONFIG) 2>/dev/null | sed 's/\s.*//')
++STAMP_KERNEL_CONFIG := .kernel_config_md5_$(CONFIG_MD5)
+ 
+ export KLIB KLIB_BUILD BACKPORT_PWD KMODDIR KMODPATH_ARG
+ 
+@@ -36,7 +37,8 @@ mrproper:
+ 	@rm -f .kernel_config_md5 Kconfig.versions Kconfig.kernel
+ 	@rm -f backport-include/backport/autoconf.h
+ 
+-.DEFAULT:
++.SILENT: $(STAMP_KERNEL_CONFIG)
++$(STAMP_KERNEL_CONFIG):
+ 	@set -e ; test -f .local-symbols || (						\
+ 	echo "/--------------"								;\
+ 	echo "| You shouldn't run make in the backports tree, but only in"		;\
+@@ -60,56 +62,60 @@ mrproper:
+ 	echo "| (that isn't currently running.)"					;\
+ 	echo "\\--"									;\
+ 	false)
+-	@set -e ; if [ "$$(cat .kernel_config_md5 2>/dev/null)" != "$(CONFIG_MD5)" ]	;\
+-	then 										\
+-		echo -n "Generating local configuration database from kernel ..."	;\
+-		grep -v -f .local-symbols $(KERNEL_CONFIG) | grep = | (			\
+-			while read l ; do						\
+-				if [ "$${l:0:7}" != "CONFIG_" ] ; then			\
+-					continue					;\
+-				fi							;\
+-				l=$${l:7}						;\
+-				n=$${l%%=*}						;\
+-				v=$${l#*=}						;\
+-				if [ "$$v" = "m" ] ; then				\
+-					echo config $$n					;\
+-					echo '    tristate' 				;\
+-				elif [ "$$v" = "y" ] ; then				\
+-					echo config $$n					;\
+-					echo '    bool'					;\
+-				else							\
+-					continue					;\
+-				fi							;\
+-				echo "    default $$v"					;\
+-				echo ""							;\
+-			done								\
+-		) > Kconfig.kernel							;\
+-		kver=$$($(MAKE) --no-print-directory -C $(KLIB_BUILD) kernelversion |	\
+-			sed 's/^\(\(3\|2\.6\)\.[0-9]\+\).*/\1/;t;d')			;\
+-		test "$$kver" != "" || echo "Kernel version parse failed!"		;\
+-		test "$$kver" != ""							;\
+-		kvers="$$(seq 14 39 | sed 's/^/2.6./')"					;\
+-		kvers="$$kvers $$(seq 0 99 | sed 's/^/3./')"				;\
+-		print=0									;\
+-		for v in $$kvers ; do							\
+-			if [ "$$print" = "1" ] ; then					\
+-				echo config BACKPORT_KERNEL_$$(echo $$v | tr . _)	;\
+-				echo "    def_bool y"					;\
+-			fi								;\
+-			if [ "$$v" = "$$kver" ] ; then print=1 ; fi			;\
+-		done > Kconfig.versions							;\
+-		# RHEL as well, sadly we need to grep for it				;\
+-		RHEL_MAJOR=$$(grep '^RHEL_MAJOR' $(KERNEL_MAKEFILE) | 			\
+-					sed 's/.*=\s*\([0-9]*\)/\1/;t;d')		;\
+-		RHEL_MINOR=$$(grep '^RHEL_MINOR' $(KERNEL_MAKEFILE) | 			\
+-					sed 's/.*=\s*\([0-9]*\)/\1/;t;d')		;\
+-		for v in $$(seq 0 $$RHEL_MINOR) ; do 					\
+-			echo config BACKPORT_RHEL_KERNEL_$${RHEL_MAJOR}_$$v		;\
+-			echo "    def_bool y"						;\
+-		done >> Kconfig.versions						;\
+-		echo " done."								;\
+-	fi										;\
+-	echo "$(CONFIG_MD5)" > .kernel_config_md5
++	@rm -f .kernel_config_md5_*
++	@touch $@
++
++Kconfig.kernel: $(STAMP_KERNEL_CONFIG) .local-symbols
++	@printf "Generating local configuration database from kernel ..."
++	@grep -v -f .local-symbols $(KERNEL_CONFIG) | grep = | (			\
++		while read l ; do						\
++			if [ "$${l:0:7}" != "CONFIG_" ] ; then			\
++				continue					;\
++			fi							;\
++			l=$${l:7}						;\
++			n=$${l%%=*}						;\
++			v=$${l#*=}						;\
++			if [ "$$v" = "m" ] ; then				\
++				echo config $$n					;\
++				echo '    tristate' 				;\
++			elif [ "$$v" = "y" ] ; then				\
++				echo config $$n					;\
++				echo '    bool'					;\
++			else							\
++				continue					;\
++			fi							;\
++			echo "    default $$v"					;\
++			echo ""							;\
++		done								\
++	) > $@
++	@echo " done."
++
++Kconfig.versions: Kconfig.kernel
++	@kver=$$($(MAKE) --no-print-directory -C $(KLIB_BUILD) kernelversion |	\
++		sed 's/^\(\(3\|2\.6\)\.[0-9]\+\).*/\1/;t;d')			;\
++	test "$$kver" != "" || echo "Kernel version parse failed!"		;\
++	test "$$kver" != ""							;\
++	kvers="$$(seq 14 39 | sed 's/^/2.6./')"					;\
++	kvers="$$kvers $$(seq 0 99 | sed 's/^/3./')"				;\
++	print=0									;\
++	for v in $$kvers ; do							\
++		if [ "$$print" = "1" ] ; then					\
++			echo config BACKPORT_KERNEL_$$(echo $$v | tr . _)	;\
++			echo "    def_bool y"					;\
++		fi								;\
++		if [ "$$v" = "$$kver" ] ; then print=1 ; fi			;\
++	done > $@
++	@RHEL_MAJOR=$$(grep '^RHEL_MAJOR' $(KERNEL_MAKEFILE) | 			\
++				sed 's/.*=\s*\([0-9]*\)/\1/;t;d')		;\
++	RHEL_MINOR=$$(grep '^RHEL_MINOR' $(KERNEL_MAKEFILE) | 			\
++				sed 's/.*=\s*\([0-9]*\)/\1/;t;d')		;\
++	for v in $$(seq 0 $$RHEL_MINOR) ; do 					\
++		echo config BACKPORT_RHEL_KERNEL_$${RHEL_MAJOR}_$$v		;\
++		echo "    def_bool y"						;\
++	done >> $@
++
++.DEFAULT:
++	@$(MAKE) Kconfig.versions
+ 	@$(MAKE) -f Makefile.real "$@"
+ 
+ else
+--- a/Makefile.real
++++ b/Makefile.real
+@@ -54,7 +54,7 @@ defconfig-%::
+ 
+ backport-include/backport/autoconf.h: .config Kconfig.versions Kconfig.kernel
+ 	@$(MAKE) oldconfig
+-	@echo -n "Building backport-include/backport/autoconf.h ..."
++	@printf "Building backport-include/backport/autoconf.h ..."
+ 	@grep -f .local-symbols .config | (				\
+ 		echo "#ifndef COMPAT_AUTOCONF_INCLUDED"			;\
+ 		echo "#define COMPAT_AUTOCONF_INCLUDED"			;\
+@@ -75,7 +75,12 @@ backport-include/backport/autoconf.h: .c
+ 			esac						;\
+ 		done							;\
+ 		echo "#endif /* COMPAT_AUTOCONF_INCLUDED */"		;\
+-	) > backport-include/backport/autoconf.h
++	) > $@.new
++	@if cmp -s $@ $@.new; then \
++		rm -f $@.new; \
++	else \
++		mv $@.new $@; \
++	fi
+ 	@echo " done."
+ 
+ .PHONY: modules
diff --git a/package/mac80211/patches/002-change_allconfig.patch b/package/mac80211/patches/002-change_allconfig.patch
new file mode 100644
index 0000000000..91ad20f06d
--- /dev/null
+++ b/package/mac80211/patches/002-change_allconfig.patch
@@ -0,0 +1,44 @@
+--- a/kconf/conf.c
++++ b/kconf/conf.c
+@@ -578,40 +578,12 @@ int main(int ac, char **av)
+ 	case oldconfig:
+ 	case listnewconfig:
+ 	case olddefconfig:
+-		conf_read(NULL);
+-		break;
+ 	case allnoconfig:
+ 	case allyesconfig:
+ 	case allmodconfig:
+ 	case alldefconfig:
+ 	case randconfig:
+-		name = getenv("KCONFIG_ALLCONFIG");
+-		if (!name)
+-			break;
+-		if ((strcmp(name, "") != 0) && (strcmp(name, "1") != 0)) {
+-			if (conf_read_simple(name, S_DEF_USER)) {
+-				fprintf(stderr,
+-					_("*** Can't read seed configuration \"%s\"!\n"),
+-					name);
+-				exit(1);
+-			}
+-			break;
+-		}
+-		switch (input_mode) {
+-		case allnoconfig:	name = "allno.config"; break;
+-		case allyesconfig:	name = "allyes.config"; break;
+-		case allmodconfig:	name = "allmod.config"; break;
+-		case alldefconfig:	name = "alldef.config"; break;
+-		case randconfig:	name = "allrandom.config"; break;
+-		default: break;
+-		}
+-		if (conf_read_simple(name, S_DEF_USER) &&
+-		    conf_read_simple("all.config", S_DEF_USER)) {
+-			fprintf(stderr,
+-				_("*** KCONFIG_ALLCONFIG set, but no \"%s\" or \"all.config\" file found\n"),
+-				name);
+-			exit(1);
+-		}
++		conf_read(NULL);
+ 		break;
+ 	default:
+ 		break;
diff --git a/package/mac80211/patches/002-disable_ssb_build.patch b/package/mac80211/patches/002-disable_ssb_build.patch
deleted file mode 100644
index d6a7099bfd..0000000000
--- a/package/mac80211/patches/002-disable_ssb_build.patch
+++ /dev/null
@@ -1,21 +0,0 @@
---- a/config.mk
-+++ b/config.mk
-@@ -371,7 +371,8 @@ export CONFIG_IPW2200_QOS=y
- # % echo 1 > /sys/bus/pci/drivers/ipw2200/*/rtap_iface
- endif #CONFIG_WIRELESS_EXT
- 
--ifdef CONFIG_SSB
-+# disabled
-+ifdef __CONFIG_SSB
- # Sonics Silicon Backplane
- export CONFIG_SSB_SPROM=y
- 
-@@ -384,7 +385,7 @@ endif #CONFIG_PCMCIA
- # export CONFIG_SSB_DEBUG=y
- export CONFIG_SSB_DRIVER_PCICORE=y
- export CONFIG_B43_SSB=y
--endif #CONFIG_SSB
-+endif #__CONFIG_SSB
- 
- # export CONFIG_BCMA=m
- # export CONFIG_BCMA_BLOCKIO=y
diff --git a/package/mac80211/patches/003-disable_codel.patch b/package/mac80211/patches/003-disable_codel.patch
deleted file mode 100644
index 0d6d749110..0000000000
--- a/package/mac80211/patches/003-disable_codel.patch
+++ /dev/null
@@ -1,19 +0,0 @@
---- a/compat/scripts/gen-compat-config.sh
-+++ b/compat/scripts/gen-compat-config.sh
-@@ -66,16 +66,3 @@ if [[ ${CONFIG_COMPAT_KERNEL_2_6_36} = "
- 		echo "export CONFIG_COMPAT_KFIFO=y"
- 	fi
- fi
--
--if [[ ${CONFIG_COMPAT_KERNEL_3_5} = "y" ]]; then
--	# We don't have 2.6.24 backport support yet for Codel / FQ CoDel
--	# For those who want to try this is what is required that I can tell
--	# so far:
--	#  * struct Qdisc_ops
--	#	- init and change callback ops use a different argument dataype
--	# 	- you need to parse data received from userspace differently
--	if [[ ${CONFIG_COMPAT_KERNEL_2_6_25} != "y" ]]; then
--		echo "export CONFIG_COMPAT_NET_SCH_CODEL=m"
--		echo "export CONFIG_COMPAT_NET_SCH_FQ_CODEL=m"
--	fi
--fi
diff --git a/package/mac80211/patches/004-use_env_for_bash.patch b/package/mac80211/patches/004-use_env_for_bash.patch
deleted file mode 100644
index 0ae382055a..0000000000
--- a/package/mac80211/patches/004-use_env_for_bash.patch
+++ /dev/null
@@ -1,8 +0,0 @@
---- a/compat/scripts/gen-compat-config.sh
-+++ b/compat/scripts/gen-compat-config.sh
-@@ -1,4 +1,4 @@
--#!/bin/bash
-+#!/usr/bin/env bash
- # Copyright 2012        Luis R. Rodriguez <mcgrof@frijolero.org>
- # Copyright 2012        Hauke Mehrtens <hauke@hauke-m.de>
- #
diff --git a/package/mac80211/patches/010-add_include_for_bcma.patch b/package/mac80211/patches/010-add_include_for_bcma.patch
deleted file mode 100644
index 6c9b4967d6..0000000000
--- a/package/mac80211/patches/010-add_include_for_bcma.patch
+++ /dev/null
@@ -1,11 +0,0 @@
---- a/include/linux/compat-3.0.h
-+++ b/include/linux/compat-3.0.h
-@@ -38,6 +38,8 @@ static inline struct page *shmem_read_ma
- #endif
- 
- 
-+#include <linux/mod_devicetable.h>
-+
- /*
-  * since commit 1c5cae815d19ffe02bdfda1260949ef2b1806171
-  * "net: call dev_alloc_name from register_netdevice" dev_alloc_name is
diff --git a/package/mac80211/patches/010-disable_rfkill.patch b/package/mac80211/patches/010-disable_rfkill.patch
new file mode 100644
index 0000000000..221ec6a87d
--- /dev/null
+++ b/package/mac80211/patches/010-disable_rfkill.patch
@@ -0,0 +1,13 @@
+--- a/backport-include/linux/rfkill.h
++++ b/backport-include/linux/rfkill.h
+@@ -43,6 +43,10 @@ struct rfkill_ops {
+ };
+ #endif
+ 
++#undef CONFIG_RFKILL
++#undef CONFIG_RFKILL_LEDS
++#undef CONFIG_RFKILL_MODULE
++
+ /* this changes infrequently, backport manually */
+ enum rfkill_type {
+ 	RFKILL_TYPE_ALL = 0,
diff --git a/package/mac80211/patches/020-disable_tty_set_termios.patch b/package/mac80211/patches/020-disable_tty_set_termios.patch
index fc5d4d63fb..89c6a60e13 100644
--- a/package/mac80211/patches/020-disable_tty_set_termios.patch
+++ b/package/mac80211/patches/020-disable_tty_set_termios.patch
@@ -1,14 +1,14 @@
 --- a/compat/compat-2.6.39.c
 +++ b/compat/compat-2.6.39.c
-@@ -12,6 +12,7 @@
- #include <linux/tty.h>
+@@ -13,6 +13,7 @@
  #include <linux/sched.h>
+ #include <linux/module.h>
  
 +#ifdef CONFIG_COMPAT_BLUETOOTH
  #if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,27))
  /*
   *		Termios Helper Methods
-@@ -111,4 +112,4 @@ int tty_set_termios(struct tty_struct *t
+@@ -112,4 +113,4 @@ int tty_set_termios(struct tty_struct *t
  }
  EXPORT_SYMBOL_GPL(tty_set_termios);
  #endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,27)) */
diff --git a/package/mac80211/patches/030-rt2x00_options.patch b/package/mac80211/patches/030-rt2x00_options.patch
new file mode 100644
index 0000000000..ed8e1b69ab
--- /dev/null
+++ b/package/mac80211/patches/030-rt2x00_options.patch
@@ -0,0 +1,33 @@
+--- a/drivers/net/wireless/rt2x00/Kconfig
++++ b/drivers/net/wireless/rt2x00/Kconfig
+@@ -202,25 +202,25 @@ config RT2800USB_UNKNOWN
+ endif
+ 
+ config RT2800_LIB
+-	tristate
++	tristate "RT2800 USB/PCI support"
+ 	depends on m
+ 
+ config RT2X00_LIB_MMIO
+-	tristate
++	tristate "RT2x00 MMIO support"
+ 	depends on m
+ 
+ config RT2X00_LIB_PCI
+-	tristate
++	tristate "RT2x00 PCI support"
+ 	depends on m
+ 	select RT2X00_LIB
+ 
+ config RT2X00_LIB_SOC
+-	tristate
++	tristate "RT2x00 SoC support"
+ 	depends on m
+ 	select RT2X00_LIB
+ 
+ config RT2X00_LIB_USB
+-	tristate
++	tristate "RT2x00 USB support"
+ 	depends on m
+ 	select RT2X00_LIB
+ 
diff --git a/package/mac80211/patches/030-wext.patch b/package/mac80211/patches/030-wext.patch
deleted file mode 100644
index dbd7a09202..0000000000
--- a/package/mac80211/patches/030-wext.patch
+++ /dev/null
@@ -1,18 +0,0 @@
---- a/net/wireless/core.c
-+++ b/net/wireless/core.c
-@@ -951,6 +951,15 @@ static int cfg80211_netdev_notifier_call
- 		wdev->sme_state = CFG80211_SME_IDLE;
- 		mutex_unlock(&rdev->devlist_mtx);
- #ifdef CONFIG_CFG80211_WEXT
-+#ifdef CONFIG_WIRELESS_EXT
-+		if (!dev->wireless_handlers)
-+			dev->wireless_handlers = &cfg80211_wext_handler;
-+#else
-+		printk_once(KERN_WARNING "cfg80211: wext will not work because "
-+			    "kernel was compiled with CONFIG_WIRELESS_EXT=n. "
-+			    "Tools using wext interface, like iwconfig will "
-+			    "not work.\n");
-+#endif
- 		wdev->wext.default_key = -1;
- 		wdev->wext.default_mgmt_key = -1;
- 		wdev->wext.connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
diff --git a/package/mac80211/patches/040-brcmutil_option.patch b/package/mac80211/patches/040-brcmutil_option.patch
new file mode 100644
index 0000000000..8a6cae6122
--- /dev/null
+++ b/package/mac80211/patches/040-brcmutil_option.patch
@@ -0,0 +1,9 @@
+--- a/drivers/net/wireless/brcm80211/Kconfig
++++ b/drivers/net/wireless/brcm80211/Kconfig
+@@ -1,5 +1,5 @@
+ config BRCMUTIL
+-	tristate
++	tristate "Broadcom 802.11 driver utility functions"
+ 	depends on m
+ 
+ config BRCMSMAC
diff --git a/package/mac80211/patches/050-drivers-net-rename-random32-to-prandom_u32.patch b/package/mac80211/patches/050-drivers-net-rename-random32-to-prandom_u32.patch
deleted file mode 100644
index a50896940b..0000000000
--- a/package/mac80211/patches/050-drivers-net-rename-random32-to-prandom_u32.patch
+++ /dev/null
@@ -1,66 +0,0 @@
-From e00adf39134028d65023c327b427074728c18f7e Mon Sep 17 00:00:00 2001
-From: Akinobu Mita <akinobu.mita@gmail.com>
-Date: Tue, 7 May 2013 16:18:15 -0700
-Subject: [PATCH] drivers/net: rename random32() to prandom_u32()
-
-Use preferable function name which implies using a pseudo-random number
-generator.
-
-[akpm@linux-foundation.org: convert team_mode_random.c]
-Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com>
-Acked-by: Thomas Sailer <t.sailer@alumni.ethz.ch>
-Acked-by: Bing Zhao <bzhao@marvell.com> [mwifiex]
-Cc: "David S. Miller" <davem@davemloft.net>
-Cc: Michael Chan <mchan@broadcom.com>
-Cc: Thomas Sailer <t.sailer@alumni.ethz.ch>
-Cc: Jean-Paul Roubelat <jpr@f6fbb.org>
-Cc: Bing Zhao <bzhao@marvell.com>
-Cc: Brett Rudley <brudley@broadcom.com>
-Cc: Arend van Spriel <arend@broadcom.com>
-Cc: "Franky (Zhenhui) Lin" <frankyl@broadcom.com>
-Cc: Hante Meuleman <meuleman@broadcom.com>
-Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
-Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
----
- drivers/net/wireless/brcm80211/brcmfmac/p2p.c |    2 +-
- drivers/net/wireless/mwifiex/cfg80211.c       |    4 ++--
- 2 files changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/drivers/net/wireless/brcm80211/brcmfmac/p2p.c b/drivers/net/wireless/brcm80211/brcmfmac/p2p.c
-index 2b90da0..e7a1a47 100644
---- a/drivers/net/wireless/brcm80211/brcmfmac/p2p.c
-+++ b/drivers/net/wireless/brcm80211/brcmfmac/p2p.c
-@@ -1117,7 +1117,7 @@ static void brcmf_p2p_afx_handler(struct work_struct *work)
- 	if (afx_hdl->is_listen && afx_hdl->my_listen_chan)
- 		/* 100ms ~ 300ms */
- 		err = brcmf_p2p_discover_listen(p2p, afx_hdl->my_listen_chan,
--						100 * (1 + (random32() % 3)));
-+						100 * (1 + prandom_u32() % 3));
- 	else
- 		err = brcmf_p2p_act_frm_search(p2p, afx_hdl->peer_listen_chan);
- 
-diff --git a/drivers/net/wireless/mwifiex/cfg80211.c b/drivers/net/wireless/mwifiex/cfg80211.c
-index a0cb077..d3c8ece 100644
---- a/drivers/net/wireless/mwifiex/cfg80211.c
-+++ b/drivers/net/wireless/mwifiex/cfg80211.c
-@@ -216,7 +216,7 @@ mwifiex_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
- 	mwifiex_form_mgmt_frame(skb, buf, len);
- 	mwifiex_queue_tx_pkt(priv, skb);
- 
--	*cookie = random32() | 1;
-+	*cookie = prandom_u32() | 1;
- 	cfg80211_mgmt_tx_status(wdev, *cookie, buf, len, true, GFP_ATOMIC);
- 
- 	wiphy_dbg(wiphy, "info: management frame transmitted\n");
-@@ -271,7 +271,7 @@ mwifiex_cfg80211_remain_on_channel(struct wiphy *wiphy,
- 					 duration);
- 
- 	if (!ret) {
--		*cookie = random32() | 1;
-+		*cookie = prandom_u32() | 1;
- 		priv->roc_cfg.cookie = *cookie;
- 		priv->roc_cfg.chan = *chan;
- 
--- 
-1.7.10.4
-
diff --git a/package/mac80211/patches/050-lib80211_option.patch b/package/mac80211/patches/050-lib80211_option.patch
new file mode 100644
index 0000000000..5372114310
--- /dev/null
+++ b/package/mac80211/patches/050-lib80211_option.patch
@@ -0,0 +1,30 @@
+--- a/net/wireless/Kconfig
++++ b/net/wireless/Kconfig
+@@ -123,7 +123,7 @@ config CFG80211_WEXT
+ 	  extensions with cfg80211-based drivers.
+ 
+ config LIB80211
+-	tristate
++	tristate "lib80211"
+ 	depends on m
+ 	default n
+ 	help
+@@ -133,15 +133,15 @@ config LIB80211
+ 	  Drivers should select this themselves if needed.
+ 
+ config LIB80211_CRYPT_WEP
+-	tristate
++	tristate "lib80211 WEP support"
+ 	depends on m
+ 
+ config LIB80211_CRYPT_CCMP
+-	tristate
++	tristate "lib80211 CCMP support"
+ 	depends on m
+ 
+ config LIB80211_CRYPT_TKIP
+-	tristate
++	tristate "lib80211 TKIP support"
+ 	depends on m
+ 
+ config LIB80211_DEBUG
diff --git a/package/mac80211/patches/060-no_local_ssb_bcma.patch b/package/mac80211/patches/060-no_local_ssb_bcma.patch
new file mode 100644
index 0000000000..81ae9e6e6b
--- /dev/null
+++ b/package/mac80211/patches/060-no_local_ssb_bcma.patch
@@ -0,0 +1,68 @@
+--- a/.local-symbols
++++ b/.local-symbols
+@@ -365,42 +365,6 @@ USB_CDC_PHONET=
+ USB_IPHETH=
+ USB_SIERRA_NET=
+ USB_VL600=
+-SSB_POSSIBLE=
+-SSB=
+-SSB_SPROM=
+-SSB_BLOCKIO=
+-SSB_PCIHOST_POSSIBLE=
+-SSB_PCIHOST=
+-SSB_B43_PCI_BRIDGE=
+-SSB_PCMCIAHOST_POSSIBLE=
+-SSB_PCMCIAHOST=
+-SSB_SDIOHOST_POSSIBLE=
+-SSB_SDIOHOST=
+-SSB_SILENT=
+-SSB_DEBUG=
+-SSB_SERIAL=
+-SSB_DRIVER_PCICORE_POSSIBLE=
+-SSB_DRIVER_PCICORE=
+-SSB_PCICORE_HOSTMODE=
+-SSB_DRIVER_MIPS=
+-SSB_SFLASH=
+-SSB_EMBEDDED=
+-SSB_DRIVER_EXTIF=
+-SSB_DRIVER_GIGE=
+-SSB_DRIVER_GPIO=
+-BCMA_POSSIBLE=
+-BCMA=
+-BCMA_BLOCKIO=
+-BCMA_HOST_PCI_POSSIBLE=
+-BCMA_HOST_PCI=
+-BCMA_DRIVER_PCI_HOSTMODE=
+-BCMA_HOST_SOC=
+-BCMA_DRIVER_MIPS=
+-BCMA_SFLASH=
+-BCMA_NFLASH=
+-BCMA_DRIVER_GMAC_CMN=
+-BCMA_DRIVER_GPIO=
+-BCMA_DEBUG=
+ DRM=
+ DRM_USB=
+ DRM_KMS_HELPER=
+--- a/Kconfig
++++ b/Kconfig
+@@ -31,9 +31,6 @@ source drivers/net/wireless/Kconfig
+ source drivers/net/ethernet/Kconfig
+ source drivers/net/usb/Kconfig
+ 
+-source drivers/ssb/Kconfig
+-source drivers/bcma/Kconfig
+-
+ source drivers/gpu/drm/Kconfig
+ 
+ source net/nfc/Kconfig
+--- a/Makefile.kernel
++++ b/Makefile.kernel
+@@ -26,8 +26,6 @@ obj-$(CPTCFG_MAC80211) += net/mac80211/
+ obj-$(CPTCFG_WLAN) += drivers/net/wireless/
+ obj-$(CPTCFG_BT) += net/bluetooth/
+ obj-$(CPTCFG_BT) += drivers/bluetooth/
+-obj-$(CPTCFG_SSB) += drivers/ssb/
+-obj-$(CPTCFG_BCMA) += drivers/bcma/
+ obj-$(CPTCFG_ETHERNET) += drivers/net/ethernet/
+ obj-$(CPTCFG_USB_NET_RNDIS_WLAN) += drivers/net/usb/
+ obj-$(CPTCFG_DRM) += drivers/gpu/drm/
diff --git a/package/mac80211/patches/100-compat-add-missing-include-in-else-for-compat-3.10.h.patch b/package/mac80211/patches/100-compat-add-missing-include-in-else-for-compat-3.10.h.patch
deleted file mode 100644
index 2e485ed28b..0000000000
--- a/package/mac80211/patches/100-compat-add-missing-include-in-else-for-compat-3.10.h.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-From 16f4984678b93c03fc3fe31ed7c2bda491574ea7 Mon Sep 17 00:00:00 2001
-From: Jonas Gorski <jogo@openwrt.org>
-Date: Sat, 18 May 2013 02:05:30 +0200
-Subject: [PATCH 1/2] compat: add missing include in #else for compat-3.10.h
-
-When compiling against 3.10-rc1, the build fails as follows:
-
-  CC [M]  compat/main.o
-In file included from include/linux/compat-2.6.h:75:0,
-                 from <command-line>:0:
-include/linux/compat-3.10.h:91:52: warning: 'struct fb_info' declared inside parameter list [enabled by default]
-include/linux/compat-3.10.h:91:52: warning: its scope is only this definition or declaration, which is probably not what you want [enabled by default]
-include/linux/compat-3.10.h: In function 'backport_fb_enable_skip_vt_switch':
-include/linux/compat-3.10.h:93:6: error: dereferencing pointer to incomplete type
-
-Fix this adding the missing include to the else branch to stay true to
-the original commit, instead of pulling it out of the #if #else #endif
-block.
-
-Signed-off-by: Jonas Gorski <jogo@openwrt.org>
----
- include/linux/compat-3.10.h |    2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/include/linux/compat-3.10.h b/include/linux/compat-3.10.h
-index f972203..9d6e55c 100644
---- a/include/linux/compat-3.10.h
-+++ b/include/linux/compat-3.10.h
-@@ -87,6 +87,8 @@ static inline void fb_enable_skip_vt_switch(struct fb_info *info)
-  * clash on the backport for 3.12 as the routine would
-  * already be defined *but* we'd need it for 3.11.
-  */
-+#include <linux/fb.h>
-+
- #define fb_enable_skip_vt_switch LINUX_BACKPORT(fb_enable_skip_vt_switch)
- static inline void fb_enable_skip_vt_switch(struct fb_info *info)
- {
--- 
-1.7.10.4
-
diff --git a/package/mac80211/patches/201-ath5k-WAR-for-AR71xx-PCI-bug.patch b/package/mac80211/patches/201-ath5k-WAR-for-AR71xx-PCI-bug.patch
index 9e08a08975..d9672d473f 100644
--- a/package/mac80211/patches/201-ath5k-WAR-for-AR71xx-PCI-bug.patch
+++ b/package/mac80211/patches/201-ath5k-WAR-for-AR71xx-PCI-bug.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath5k/initvals.c
 +++ b/drivers/net/wireless/ath/ath5k/initvals.c
-@@ -65,8 +65,14 @@ static const struct ath5k_ini ar5210_ini
+@@ -62,8 +62,14 @@ static const struct ath5k_ini ar5210_ini
  	{ AR5K_IMR,		0 },
  	{ AR5K_IER,		AR5K_IER_DISABLE },
  	{ AR5K_BSR,		0, AR5K_INI_READ },
@@ -17,7 +17,7 @@
  	{ AR5K_RXNOFRM,		8 },
 --- a/drivers/net/wireless/ath/ath5k/dma.c
 +++ b/drivers/net/wireless/ath/ath5k/dma.c
-@@ -863,10 +863,18 @@ ath5k_hw_dma_init(struct ath5k_hw *ah)
+@@ -860,10 +860,18 @@ ath5k_hw_dma_init(struct ath5k_hw *ah)
  	 * guess we can tweak it and see how it goes ;-)
  	 */
  	if (ah->ah_version != AR5K_AR5210) {
diff --git a/package/mac80211/patches/300-pending_work.patch b/package/mac80211/patches/300-pending_work.patch
index 9426b09eb1..1f6f95e12b 100644
--- a/package/mac80211/patches/300-pending_work.patch
+++ b/package/mac80211/patches/300-pending_work.patch
@@ -1,1058 +1,3 @@
---- a/drivers/net/wireless/ath/ath9k/ath9k.h
-+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
-@@ -234,6 +234,7 @@ struct ath_buf {
- 	dma_addr_t bf_daddr;		/* physical addr of desc */
- 	dma_addr_t bf_buf_addr;	/* physical addr of data buffer, for DMA */
- 	bool bf_stale;
-+	struct ieee80211_tx_rate rates[4];
- 	struct ath_buf_state bf_state;
- };
- 
-@@ -250,9 +251,9 @@ struct ath_atx_tid {
- 	int tidno;
- 	int baw_head;   /* first un-acked tx buffer */
- 	int baw_tail;   /* next unused tx buffer slot */
--	int sched;
--	int paused;
--	u8 state;
-+	bool sched;
-+	bool paused;
-+	bool active;
- };
- 
- struct ath_node {
-@@ -273,10 +274,6 @@ struct ath_node {
- #endif
- };
- 
--#define AGGR_CLEANUP         BIT(1)
--#define AGGR_ADDBA_COMPLETE  BIT(2)
--#define AGGR_ADDBA_PROGRESS  BIT(3)
--
- struct ath_tx_control {
- 	struct ath_txq *txq;
- 	struct ath_node *an;
-@@ -299,6 +296,7 @@ struct ath_tx {
- 	struct ath_txq txq[ATH9K_NUM_TX_QUEUES];
- 	struct ath_descdma txdma;
- 	struct ath_txq *txq_map[IEEE80211_NUM_ACS];
-+	struct ath_txq *uapsdq;
- 	u32 txq_max_pending[IEEE80211_NUM_ACS];
- 	u16 max_aggr_framelen[IEEE80211_NUM_ACS][4][32];
- };
-@@ -346,6 +344,8 @@ int ath_txq_update(struct ath_softc *sc,
- void ath_update_max_aggr_framelen(struct ath_softc *sc, int queue, int txop);
- int ath_tx_start(struct ieee80211_hw *hw, struct sk_buff *skb,
- 		 struct ath_tx_control *txctl);
-+void ath_tx_cabq(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
-+		 struct sk_buff *skb);
- void ath_tx_tasklet(struct ath_softc *sc);
- void ath_tx_edma_tasklet(struct ath_softc *sc);
- int ath_tx_aggr_start(struct ath_softc *sc, struct ieee80211_sta *sta,
-@@ -356,6 +356,11 @@ void ath_tx_aggr_resume(struct ath_softc
- void ath_tx_aggr_wakeup(struct ath_softc *sc, struct ath_node *an);
- void ath_tx_aggr_sleep(struct ieee80211_sta *sta, struct ath_softc *sc,
- 		       struct ath_node *an);
-+void ath9k_release_buffered_frames(struct ieee80211_hw *hw,
-+				   struct ieee80211_sta *sta,
-+				   u16 tids, int nframes,
-+				   enum ieee80211_frame_release_type reason,
-+				   bool more_data);
- 
- /********/
- /* VIFs */
-@@ -658,11 +663,10 @@ enum sc_op_flags {
- struct ath_rate_table;
- 
- struct ath9k_vif_iter_data {
--	const u8 *hw_macaddr; /* phy's hardware address, set
--			       * before starting iteration for
--			       * valid bssid mask.
--			       */
-+	u8 hw_macaddr[ETH_ALEN]; /* address of the first vif */
- 	u8 mask[ETH_ALEN]; /* bssid mask */
-+	bool has_hw_macaddr;
-+
- 	int naps;      /* number of AP vifs */
- 	int nmeshes;   /* number of mesh vifs */
- 	int nstations; /* number of station vifs */
---- a/drivers/net/wireless/ath/ath9k/hw.c
-+++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -1171,6 +1171,7 @@ u32 ath9k_regd_get_ctl(struct ath_regula
- static inline void ath9k_hw_set_dma(struct ath_hw *ah)
- {
- 	struct ath_common *common = ath9k_hw_common(ah);
-+	int txbuf_size;
- 
- 	ENABLE_REGWRITE_BUFFER(ah);
- 
-@@ -1224,13 +1225,17 @@ static inline void ath9k_hw_set_dma(stru
- 		 * So set the usable tx buf size also to half to
- 		 * avoid data/delimiter underruns
- 		 */
--		REG_WRITE(ah, AR_PCU_TXBUF_CTRL,
--			  AR_9285_PCU_TXBUF_CTRL_USABLE_SIZE);
--	} else if (!AR_SREV_9271(ah)) {
--		REG_WRITE(ah, AR_PCU_TXBUF_CTRL,
--			  AR_PCU_TXBUF_CTRL_USABLE_SIZE);
-+		txbuf_size = AR_9285_PCU_TXBUF_CTRL_USABLE_SIZE;
-+	} else if (AR_SREV_9340_13_OR_LATER(ah)) {
-+		/* Uses fewer entries for AR934x v1.3+ to prevent rx overruns */
-+		txbuf_size = AR_9340_PCU_TXBUF_CTRL_USABLE_SIZE;
-+	} else {
-+		txbuf_size = AR_PCU_TXBUF_CTRL_USABLE_SIZE;
- 	}
- 
-+	if (!AR_SREV_9271(ah))
-+		REG_WRITE(ah, AR_PCU_TXBUF_CTRL, txbuf_size);
-+
- 	REGWRITE_BUFFER_FLUSH(ah);
- 
- 	if (AR_SREV_9300_20_OR_LATER(ah))
-@@ -1305,9 +1310,13 @@ static bool ath9k_hw_set_reset(struct at
- 			AR_RTC_RC_COLD_RESET | AR_RTC_RC_WARM_RESET;
- 	} else {
- 		tmpReg = REG_READ(ah, AR_INTR_SYNC_CAUSE);
--		if (tmpReg &
--		    (AR_INTR_SYNC_LOCAL_TIMEOUT |
--		     AR_INTR_SYNC_RADM_CPL_TIMEOUT)) {
-+		if (AR_SREV_9340(ah))
-+			tmpReg &= AR9340_INTR_SYNC_LOCAL_TIMEOUT;
-+		else
-+			tmpReg &= AR_INTR_SYNC_LOCAL_TIMEOUT |
-+				  AR_INTR_SYNC_RADM_CPL_TIMEOUT;
-+
-+		if (tmpReg) {
- 			u32 val;
- 			REG_WRITE(ah, AR_INTR_SYNC_ENABLE, 0);
- 
-@@ -1366,7 +1375,10 @@ static bool ath9k_hw_set_reset(struct at
- 
- 	REGWRITE_BUFFER_FLUSH(ah);
- 
--	udelay(50);
-+	if (AR_SREV_9100(ah))
-+		mdelay(10);
-+	else
-+		udelay(50);
- 
- 	REG_WRITE(ah, AR_RTC_RC, 0);
- 	if (!ath9k_hw_wait(ah, AR_RTC_RC, AR_RTC_RC_M, 0, AH_WAIT_TIMEOUT)) {
-@@ -1377,8 +1389,12 @@ static bool ath9k_hw_set_reset(struct at
- 	if (!AR_SREV_9100(ah))
- 		REG_WRITE(ah, AR_RC, 0);
- 
--	if (AR_SREV_9100(ah))
-+	if (AR_SREV_9100(ah) && type != ATH9K_RESET_WARM) {
-+		if (ah->external_reset)
-+			ah->external_reset();
-+
- 		udelay(50);
-+	}
- 
- 	return true;
- }
-@@ -1464,7 +1480,8 @@ static bool ath9k_hw_chip_reset(struct a
- 			reset_type = ATH9K_RESET_POWER_ON;
- 		else
- 			reset_type = ATH9K_RESET_COLD;
--	} else if (ah->chip_fullsleep || REG_READ(ah, AR_Q_TXE) ||
-+	} else if (ah->chip_fullsleep ||
-+		   REG_READ(ah, AR_Q_TXE) ||
- 		   (REG_READ(ah, AR_CR) & AR_CR_RXE))
- 		reset_type = ATH9K_RESET_COLD;
- 
-@@ -1698,12 +1715,11 @@ static void ath9k_hw_reset_opmode(struct
- 
- 	ENABLE_REGWRITE_BUFFER(ah);
- 
--	REG_WRITE(ah, AR_STA_ID0, get_unaligned_le32(common->macaddr));
--	REG_WRITE(ah, AR_STA_ID1, get_unaligned_le16(common->macaddr + 4)
--		  | macStaId1
-+	REG_RMW(ah, AR_STA_ID1, macStaId1
- 		  | AR_STA_ID1_RTS_USE_DEF
- 		  | (ah->config.ack_6mb ? AR_STA_ID1_ACKCTS_6MB : 0)
--		  | ah->sta_id1_defaults);
-+		  | ah->sta_id1_defaults,
-+		  ~AR_STA_ID1_SADH_MASK);
- 	ath_hw_setbssidmask(common);
- 	REG_WRITE(ah, AR_DEF_ANTENNA, saveDefAntenna);
- 	ath9k_hw_write_associd(ah);
---- a/drivers/net/wireless/ath/ath9k/main.c
-+++ b/drivers/net/wireless/ath/ath9k/main.c
-@@ -839,10 +839,14 @@ static void ath9k_vif_iter(void *data, u
- 	struct ath9k_vif_iter_data *iter_data = data;
- 	int i;
- 
--	if (iter_data->hw_macaddr)
-+	if (iter_data->has_hw_macaddr) {
- 		for (i = 0; i < ETH_ALEN; i++)
- 			iter_data->mask[i] &=
- 				~(iter_data->hw_macaddr[i] ^ mac[i]);
-+	} else {
-+		memcpy(iter_data->hw_macaddr, mac, ETH_ALEN);
-+		iter_data->has_hw_macaddr = true;
-+	}
- 
- 	switch (vif->type) {
- 	case NL80211_IFTYPE_AP:
-@@ -891,7 +895,6 @@ void ath9k_calculate_iter_data(struct ie
- 	 * together with the BSSID mask when matching addresses.
- 	 */
- 	memset(iter_data, 0, sizeof(*iter_data));
--	iter_data->hw_macaddr = common->macaddr;
- 	memset(&iter_data->mask, 0xff, ETH_ALEN);
- 
- 	if (vif)
-@@ -901,6 +904,8 @@ void ath9k_calculate_iter_data(struct ie
- 	ieee80211_iterate_active_interfaces_atomic(
- 		sc->hw, IEEE80211_IFACE_ITER_RESUME_ALL,
- 		ath9k_vif_iter, iter_data);
-+
-+	memcpy(common->macaddr, iter_data->hw_macaddr, ETH_ALEN);
- }
- 
- /* Called with sc->mutex held. */
-@@ -1327,6 +1332,7 @@ static int ath9k_sta_add(struct ieee8021
- 	struct ath_common *common = ath9k_hw_common(sc->sc_ah);
- 	struct ath_node *an = (struct ath_node *) sta->drv_priv;
- 	struct ieee80211_key_conf ps_key = { };
-+	int key;
- 
- 	ath_node_attach(sc, sta, vif);
- 
-@@ -1334,7 +1340,9 @@ static int ath9k_sta_add(struct ieee8021
- 	    vif->type != NL80211_IFTYPE_AP_VLAN)
- 		return 0;
- 
--	an->ps_key = ath_key_config(common, vif, sta, &ps_key);
-+	key = ath_key_config(common, vif, sta, &ps_key);
-+	if (key > 0)
-+		an->ps_key = key;
- 
- 	return 0;
- }
-@@ -1351,6 +1359,7 @@ static void ath9k_del_ps_key(struct ath_
- 	    return;
- 
- 	ath_key_delete(common, &ps_key);
-+	an->ps_key = 0;
- }
- 
- static int ath9k_sta_remove(struct ieee80211_hw *hw,
-@@ -1678,6 +1687,7 @@ static int ath9k_ampdu_action(struct iee
- 			      u16 tid, u16 *ssn, u8 buf_size)
- {
- 	struct ath_softc *sc = hw->priv;
-+	bool flush = false;
- 	int ret = 0;
- 
- 	local_bh_disable();
-@@ -1694,12 +1704,14 @@ static int ath9k_ampdu_action(struct iee
- 			ieee80211_start_tx_ba_cb_irqsafe(vif, sta->addr, tid);
- 		ath9k_ps_restore(sc);
- 		break;
--	case IEEE80211_AMPDU_TX_STOP_CONT:
- 	case IEEE80211_AMPDU_TX_STOP_FLUSH:
- 	case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT:
-+		flush = true;
-+	case IEEE80211_AMPDU_TX_STOP_CONT:
- 		ath9k_ps_wakeup(sc);
- 		ath_tx_aggr_stop(sc, sta, tid);
--		ieee80211_stop_tx_ba_cb_irqsafe(vif, sta->addr, tid);
-+		if (!flush)
-+			ieee80211_stop_tx_ba_cb_irqsafe(vif, sta->addr, tid);
- 		ath9k_ps_restore(sc);
- 		break;
- 	case IEEE80211_AMPDU_TX_OPERATIONAL:
-@@ -2366,6 +2378,7 @@ struct ieee80211_ops ath9k_ops = {
- 	.flush		    = ath9k_flush,
- 	.tx_frames_pending  = ath9k_tx_frames_pending,
- 	.tx_last_beacon     = ath9k_tx_last_beacon,
-+	.release_buffered_frames = ath9k_release_buffered_frames,
- 	.get_stats	    = ath9k_get_stats,
- 	.set_antenna	    = ath9k_set_antenna,
- 	.get_antenna	    = ath9k_get_antenna,
---- a/drivers/net/wireless/ath/ath9k/reg.h
-+++ b/drivers/net/wireless/ath/ath9k/reg.h
-@@ -798,6 +798,10 @@
- #define AR_SREV_REVISION_9485_10	0
- #define AR_SREV_REVISION_9485_11        1
- #define AR_SREV_VERSION_9340		0x300
-+#define AR_SREV_REVISION_9340_10	0
-+#define AR_SREV_REVISION_9340_11	1
-+#define AR_SREV_REVISION_9340_12	2
-+#define AR_SREV_REVISION_9340_13	3
- #define AR_SREV_VERSION_9580		0x1C0
- #define AR_SREV_REVISION_9580_10	4 /* AR9580 1.0 */
- #define AR_SREV_VERSION_9462		0x280
-@@ -897,6 +901,10 @@
- #define AR_SREV_9340(_ah) \
- 	(((_ah)->hw_version.macVersion == AR_SREV_VERSION_9340))
- 
-+#define AR_SREV_9340_13_OR_LATER(_ah) \
-+	(AR_SREV_9340((_ah)) && \
-+	 ((_ah)->hw_version.macRev >= AR_SREV_REVISION_9340_13))
-+
- #define AR_SREV_9285E_20(_ah) \
-     (AR_SREV_9285_12_OR_LATER(_ah) && \
-      ((REG_READ(_ah, AR_AN_SYNTH9) & 0x7) == 0x1))
-@@ -1007,6 +1015,8 @@ enum {
- 				AR_INTR_SYNC_LOCAL_TIMEOUT |
- 				AR_INTR_SYNC_MAC_SLEEP_ACCESS),
- 
-+	AR9340_INTR_SYNC_LOCAL_TIMEOUT = 0x00000010,
-+
- 	AR_INTR_SYNC_SPURIOUS = 0xFFFFFFFF,
- 
- };
-@@ -1493,9 +1503,6 @@ enum {
- #define AR9271_RADIO_RF_RST			0x20
- #define AR9271_GATE_MAC_CTL			0x4000
- 
--#define AR_STA_ID0                 0x8000
--#define AR_STA_ID1                 0x8004
--#define AR_STA_ID1_SADH_MASK       0x0000FFFF
- #define AR_STA_ID1_STA_AP          0x00010000
- #define AR_STA_ID1_ADHOC           0x00020000
- #define AR_STA_ID1_PWR_SAV         0x00040000
-@@ -1884,6 +1891,7 @@ enum {
- #define AR_PCU_TXBUF_CTRL_SIZE_MASK     0x7FF
- #define AR_PCU_TXBUF_CTRL_USABLE_SIZE   0x700
- #define AR_9285_PCU_TXBUF_CTRL_USABLE_SIZE   0x380
-+#define AR_9340_PCU_TXBUF_CTRL_USABLE_SIZE   0x500
- 
- #define AR_PCU_MISC_MODE2               0x8344
- #define AR_PCU_MISC_MODE2_MGMT_CRYPTO_ENABLE           0x00000002
---- a/drivers/net/wireless/ath/hw.c
-+++ b/drivers/net/wireless/ath/hw.c
-@@ -118,6 +118,12 @@
- void ath_hw_setbssidmask(struct ath_common *common)
- {
- 	void *ah = common->ah;
-+	u32 id1;
-+
-+	REG_WRITE(ah, AR_STA_ID0, get_unaligned_le32(common->macaddr));
-+	id1 = REG_READ(ah, AR_STA_ID1) & ~AR_STA_ID1_SADH_MASK;
-+	id1 |= get_unaligned_le16(common->macaddr + 4);
-+	REG_WRITE(ah, AR_STA_ID1, id1);
- 
- 	REG_WRITE(ah, AR_BSSMSKL, get_unaligned_le32(common->bssidmask));
- 	REG_WRITE(ah, AR_BSSMSKU, get_unaligned_le16(common->bssidmask + 4));
---- a/drivers/net/wireless/ath/reg.h
-+++ b/drivers/net/wireless/ath/reg.h
-@@ -23,6 +23,10 @@
- #define AR_MIBC_CMC		0x00000004
- #define AR_MIBC_MCS		0x00000008
- 
-+#define AR_STA_ID0		0x8000
-+#define AR_STA_ID1		0x8004
-+#define AR_STA_ID1_SADH_MASK	0x0000ffff
-+
- /*
-  * BSSID mask registers. See ath_hw_set_bssid_mask()
-  * for detailed documentation about these registers.
---- a/drivers/net/wireless/iwlegacy/4965-mac.c
-+++ b/drivers/net/wireless/iwlegacy/4965-mac.c
-@@ -6059,7 +6059,7 @@ il4965_mac_channel_switch(struct ieee802
- 	struct il_priv *il = hw->priv;
- 	const struct il_channel_info *ch_info;
- 	struct ieee80211_conf *conf = &hw->conf;
--	struct ieee80211_channel *channel = ch_switch->channel;
-+	struct ieee80211_channel *channel = ch_switch->chandef.chan;
- 	struct il_ht_config *ht_conf = &il->current_ht_config;
- 	u16 ch;
- 
-@@ -6096,23 +6096,21 @@ il4965_mac_channel_switch(struct ieee802
- 	il->current_ht_config.smps = conf->smps_mode;
- 
- 	/* Configure HT40 channels */
--	il->ht.enabled = conf_is_ht(conf);
--	if (il->ht.enabled) {
--		if (conf_is_ht40_minus(conf)) {
--			il->ht.extension_chan_offset =
--			    IEEE80211_HT_PARAM_CHA_SEC_BELOW;
--			il->ht.is_40mhz = true;
--		} else if (conf_is_ht40_plus(conf)) {
--			il->ht.extension_chan_offset =
--			    IEEE80211_HT_PARAM_CHA_SEC_ABOVE;
--			il->ht.is_40mhz = true;
--		} else {
--			il->ht.extension_chan_offset =
--			    IEEE80211_HT_PARAM_CHA_SEC_NONE;
--			il->ht.is_40mhz = false;
--		}
--	} else
-+	switch (cfg80211_get_chandef_type(&ch_switch->chandef)) {
-+	case NL80211_CHAN_NO_HT:
-+	case NL80211_CHAN_HT20:
- 		il->ht.is_40mhz = false;
-+		il->ht.extension_chan_offset = IEEE80211_HT_PARAM_CHA_SEC_NONE;
-+		break;
-+	case NL80211_CHAN_HT40MINUS:
-+		il->ht.extension_chan_offset = IEEE80211_HT_PARAM_CHA_SEC_BELOW;
-+		il->ht.is_40mhz = true;
-+		break;
-+	case NL80211_CHAN_HT40PLUS:
-+		il->ht.extension_chan_offset = IEEE80211_HT_PARAM_CHA_SEC_ABOVE;
-+		il->ht.is_40mhz = true;
-+		break;
-+	}
- 
- 	if ((le16_to_cpu(il->staging.channel) != ch))
- 		il->staging.flags = 0;
---- a/drivers/net/wireless/iwlegacy/4965.c
-+++ b/drivers/net/wireless/iwlegacy/4965.c
-@@ -1493,7 +1493,7 @@ il4965_hw_channel_switch(struct il_priv 
- 
- 	cmd.band = band;
- 	cmd.expect_beacon = 0;
--	ch = ch_switch->channel->hw_value;
-+	ch = ch_switch->chandef.chan->hw_value;
- 	cmd.channel = cpu_to_le16(ch);
- 	cmd.rxon_flags = il->staging.flags;
- 	cmd.rxon_filter_flags = il->staging.filter_flags;
---- a/drivers/net/wireless/iwlwifi/dvm/devices.c
-+++ b/drivers/net/wireless/iwlwifi/dvm/devices.c
-@@ -379,7 +379,7 @@ static int iwl5000_hw_channel_switch(str
- 	};
- 
- 	cmd.band = priv->band == IEEE80211_BAND_2GHZ;
--	ch = ch_switch->channel->hw_value;
-+	ch = ch_switch->chandef.chan->hw_value;
- 	IWL_DEBUG_11H(priv, "channel switch from %d to %d\n",
- 		      ctx->active.channel, ch);
- 	cmd.channel = cpu_to_le16(ch);
-@@ -414,7 +414,8 @@ static int iwl5000_hw_channel_switch(str
- 	}
- 	IWL_DEBUG_11H(priv, "uCode time for the switch is 0x%x\n",
- 		      cmd.switch_time);
--	cmd.expect_beacon = ch_switch->channel->flags & IEEE80211_CHAN_RADAR;
-+	cmd.expect_beacon =
-+		ch_switch->chandef.chan->flags & IEEE80211_CHAN_RADAR;
- 
- 	return iwl_dvm_send_cmd(priv, &hcmd);
- }
-@@ -540,7 +541,7 @@ static int iwl6000_hw_channel_switch(str
- 	hcmd.data[0] = cmd;
- 
- 	cmd->band = priv->band == IEEE80211_BAND_2GHZ;
--	ch = ch_switch->channel->hw_value;
-+	ch = ch_switch->chandef.chan->hw_value;
- 	IWL_DEBUG_11H(priv, "channel switch from %u to %u\n",
- 		      ctx->active.channel, ch);
- 	cmd->channel = cpu_to_le16(ch);
-@@ -575,7 +576,8 @@ static int iwl6000_hw_channel_switch(str
- 	}
- 	IWL_DEBUG_11H(priv, "uCode time for the switch is 0x%x\n",
- 		      cmd->switch_time);
--	cmd->expect_beacon = ch_switch->channel->flags & IEEE80211_CHAN_RADAR;
-+	cmd->expect_beacon =
-+		ch_switch->chandef.chan->flags & IEEE80211_CHAN_RADAR;
- 
- 	err = iwl_dvm_send_cmd(priv, &hcmd);
- 	kfree(cmd);
---- a/drivers/net/wireless/iwlwifi/dvm/mac80211.c
-+++ b/drivers/net/wireless/iwlwifi/dvm/mac80211.c
-@@ -970,7 +970,7 @@ static void iwlagn_mac_channel_switch(st
- {
- 	struct iwl_priv *priv = IWL_MAC80211_GET_DVM(hw);
- 	struct ieee80211_conf *conf = &hw->conf;
--	struct ieee80211_channel *channel = ch_switch->channel;
-+	struct ieee80211_channel *channel = ch_switch->chandef.chan;
- 	struct iwl_ht_config *ht_conf = &priv->current_ht_config;
- 	/*
- 	 * MULTI-FIXME
-@@ -1008,11 +1008,21 @@ static void iwlagn_mac_channel_switch(st
- 	priv->current_ht_config.smps = conf->smps_mode;
- 
- 	/* Configure HT40 channels */
--	ctx->ht.enabled = conf_is_ht(conf);
--	if (ctx->ht.enabled)
--		iwlagn_config_ht40(conf, ctx);
--	else
-+	switch (cfg80211_get_chandef_type(&ch_switch->chandef)) {
-+	case NL80211_CHAN_NO_HT:
-+	case NL80211_CHAN_HT20:
- 		ctx->ht.is_40mhz = false;
-+		ctx->ht.extension_chan_offset = IEEE80211_HT_PARAM_CHA_SEC_NONE;
-+		break;
-+	case NL80211_CHAN_HT40MINUS:
-+		ctx->ht.extension_chan_offset = IEEE80211_HT_PARAM_CHA_SEC_BELOW;
-+		ctx->ht.is_40mhz = true;
-+		break;
-+	case NL80211_CHAN_HT40PLUS:
-+		ctx->ht.extension_chan_offset = IEEE80211_HT_PARAM_CHA_SEC_ABOVE;
-+		ctx->ht.is_40mhz = true;
-+		break;
-+	}
- 
- 	if ((le16_to_cpu(ctx->staging.channel) != ch))
- 		ctx->staging.flags = 0;
---- a/drivers/net/wireless/iwlwifi/dvm/rxon.c
-+++ b/drivers/net/wireless/iwlwifi/dvm/rxon.c
-@@ -1160,7 +1160,7 @@ int iwlagn_commit_rxon(struct iwl_priv *
- }
- 
- void iwlagn_config_ht40(struct ieee80211_conf *conf,
--	struct iwl_rxon_context *ctx)
-+			struct iwl_rxon_context *ctx)
- {
- 	if (conf_is_ht40_minus(conf)) {
- 		ctx->ht.extension_chan_offset =
---- a/drivers/net/wireless/mac80211_hwsim.c
-+++ b/drivers/net/wireless/mac80211_hwsim.c
-@@ -25,6 +25,7 @@
- #include <linux/if_arp.h>
- #include <linux/rtnetlink.h>
- #include <linux/etherdevice.h>
-+#include <linux/platform_device.h>
- #include <linux/debugfs.h>
- #include <linux/module.h>
- #include <linux/ktime.h>
-@@ -717,9 +718,17 @@ static bool mac80211_hwsim_tx_frame_no_n
- 	rx_status.flag |= RX_FLAG_MACTIME_START;
- 	rx_status.freq = chan->center_freq;
- 	rx_status.band = chan->band;
--	rx_status.rate_idx = info->control.rates[0].idx;
--	if (info->control.rates[0].flags & IEEE80211_TX_RC_MCS)
--		rx_status.flag |= RX_FLAG_HT;
-+	if (info->control.rates[0].flags & IEEE80211_TX_RC_VHT_MCS) {
-+		rx_status.rate_idx =
-+			ieee80211_rate_get_vht_mcs(&info->control.rates[0]);
-+		rx_status.vht_nss =
-+			ieee80211_rate_get_vht_nss(&info->control.rates[0]);
-+		rx_status.flag |= RX_FLAG_VHT;
-+	} else {
-+		rx_status.rate_idx = info->control.rates[0].idx;
-+		if (info->control.rates[0].flags & IEEE80211_TX_RC_MCS)
-+			rx_status.flag |= RX_FLAG_HT;
-+	}
- 	if (info->control.rates[0].flags & IEEE80211_TX_RC_40_MHZ_WIDTH)
- 		rx_status.flag |= RX_FLAG_40MHZ;
- 	if (info->control.rates[0].flags & IEEE80211_TX_RC_SHORT_GI)
-@@ -1687,6 +1696,7 @@ static void mac80211_hwsim_free(void)
- 		debugfs_remove(data->debugfs_ps);
- 		debugfs_remove(data->debugfs);
- 		ieee80211_unregister_hw(data->hw);
-+		device_release_driver(data->dev);
- 		device_unregister(data->dev);
- 		ieee80211_free_hw(data->hw);
- 	}
-@@ -1695,7 +1705,9 @@ static void mac80211_hwsim_free(void)
- 
- 
- static struct device_driver mac80211_hwsim_driver = {
--	.name = "mac80211_hwsim"
-+	.name = "mac80211_hwsim",
-+	.bus = &platform_bus_type,
-+	.owner = THIS_MODULE,
- };
- 
- static const struct net_device_ops hwsim_netdev_ops = {
-@@ -2187,9 +2199,15 @@ static int __init init_mac80211_hwsim(vo
- 	spin_lock_init(&hwsim_radio_lock);
- 	INIT_LIST_HEAD(&hwsim_radios);
- 
-+	err = driver_register(&mac80211_hwsim_driver);
-+	if (err)
-+		return err;
-+
- 	hwsim_class = class_create(THIS_MODULE, "mac80211_hwsim");
--	if (IS_ERR(hwsim_class))
--		return PTR_ERR(hwsim_class);
-+	if (IS_ERR(hwsim_class)) {
-+		err = PTR_ERR(hwsim_class);
-+		goto failed_unregister_driver;
-+	}
- 
- 	memset(addr, 0, ETH_ALEN);
- 	addr[0] = 0x02;
-@@ -2211,12 +2229,20 @@ static int __init init_mac80211_hwsim(vo
- 					  "hwsim%d", i);
- 		if (IS_ERR(data->dev)) {
- 			printk(KERN_DEBUG
--			       "mac80211_hwsim: device_create "
--			       "failed (%ld)\n", PTR_ERR(data->dev));
-+			       "mac80211_hwsim: device_create failed (%ld)\n",
-+			       PTR_ERR(data->dev));
- 			err = -ENOMEM;
- 			goto failed_drvdata;
- 		}
- 		data->dev->driver = &mac80211_hwsim_driver;
-+		err = device_bind_driver(data->dev);
-+		if (err != 0) {
-+			printk(KERN_DEBUG
-+			       "mac80211_hwsim: device_bind_driver failed (%d)\n",
-+			       err);
-+			goto failed_hw;
-+		}
-+
- 		skb_queue_head_init(&data->pending);
- 
- 		SET_IEEE80211_DEV(hw, data->dev);
-@@ -2515,6 +2541,8 @@ failed_drvdata:
- 	ieee80211_free_hw(hw);
- failed:
- 	mac80211_hwsim_free();
-+failed_unregister_driver:
-+	driver_unregister(&mac80211_hwsim_driver);
- 	return err;
- }
- module_init(init_mac80211_hwsim);
-@@ -2527,5 +2555,6 @@ static void __exit exit_mac80211_hwsim(v
- 
- 	mac80211_hwsim_free();
- 	unregister_netdev(hwsim_mon);
-+	driver_unregister(&mac80211_hwsim_driver);
- }
- module_exit(exit_mac80211_hwsim);
---- a/drivers/net/wireless/ti/wl12xx/cmd.c
-+++ b/drivers/net/wireless/ti/wl12xx/cmd.c
-@@ -301,7 +301,7 @@ int wl12xx_cmd_channel_switch(struct wl1
- 	}
- 
- 	cmd->role_id = wlvif->role_id;
--	cmd->channel = ch_switch->channel->hw_value;
-+	cmd->channel = ch_switch->chandef.chan->hw_value;
- 	cmd->switch_time = ch_switch->count;
- 	cmd->stop_tx = ch_switch->block_tx;
- 
---- a/drivers/net/wireless/ti/wl18xx/cmd.c
-+++ b/drivers/net/wireless/ti/wl18xx/cmd.c
-@@ -42,11 +42,11 @@ int wl18xx_cmd_channel_switch(struct wl1
- 	}
- 
- 	cmd->role_id = wlvif->role_id;
--	cmd->channel = ch_switch->channel->hw_value;
-+	cmd->channel = ch_switch->chandef.chan->hw_value;
- 	cmd->switch_time = ch_switch->count;
- 	cmd->stop_tx = ch_switch->block_tx;
- 
--	switch (ch_switch->channel->band) {
-+	switch (ch_switch->chandef.chan->band) {
- 	case IEEE80211_BAND_2GHZ:
- 		cmd->band = WLCORE_BAND_2_4GHZ;
- 		break;
-@@ -55,7 +55,7 @@ int wl18xx_cmd_channel_switch(struct wl1
- 		break;
- 	default:
- 		wl1271_error("invalid channel switch band: %d",
--			     ch_switch->channel->band);
-+			     ch_switch->chandef.chan->band);
- 		ret = -EINVAL;
- 		goto out_free;
- 	}
---- a/include/linux/ieee80211.h
-+++ b/include/linux/ieee80211.h
-@@ -673,6 +673,36 @@ struct ieee80211_channel_sw_ie {
- } __packed;
- 
- /**
-+ * struct ieee80211_ext_chansw_ie
-+ *
-+ * This structure represents the "Extended Channel Switch Announcement element"
-+ */
-+struct ieee80211_ext_chansw_ie {
-+	u8 mode;
-+	u8 new_operating_class;
-+	u8 new_ch_num;
-+	u8 count;
-+} __packed;
-+
-+/**
-+ * struct ieee80211_sec_chan_offs_ie - secondary channel offset IE
-+ * @sec_chan_offs: secondary channel offset, uses IEEE80211_HT_PARAM_CHA_SEC_*
-+ *	values here
-+ * This structure represents the "Secondary Channel Offset element"
-+ */
-+struct ieee80211_sec_chan_offs_ie {
-+	u8 sec_chan_offs;
-+} __packed;
-+
-+/**
-+ * struct ieee80211_wide_bw_chansw_ie - wide bandwidth channel switch IE
-+ */
-+struct ieee80211_wide_bw_chansw_ie {
-+	u8 new_channel_width;
-+	u8 new_center_freq_seg0, new_center_freq_seg1;
-+} __packed;
-+
-+/**
-  * struct ieee80211_tim
-  *
-  * This structure refers to "Traffic Indication Map information element"
-@@ -840,12 +870,15 @@ struct ieee80211_mgmt {
- 				} __packed wme_action;
- 				struct{
- 					u8 action_code;
--					u8 element_id;
--					u8 length;
--					struct ieee80211_channel_sw_ie sw_elem;
-+					u8 variable[0];
- 				} __packed chan_switch;
- 				struct{
- 					u8 action_code;
-+					struct ieee80211_ext_chansw_ie data;
-+					u8 variable[0];
-+				} __packed ext_chan_switch;
-+				struct{
-+					u8 action_code;
- 					u8 dialog_token;
- 					u8 element_id;
- 					u8 length;
-@@ -1638,6 +1671,7 @@ enum ieee80211_eid {
- 
- 	WLAN_EID_HT_CAPABILITY = 45,
- 	WLAN_EID_HT_OPERATION = 61,
-+	WLAN_EID_SECONDARY_CHANNEL_OFFSET = 62,
- 
- 	WLAN_EID_RSN = 48,
- 	WLAN_EID_MMIE = 76,
-@@ -1672,6 +1706,8 @@ enum ieee80211_eid {
- 	WLAN_EID_VHT_CAPABILITY = 191,
- 	WLAN_EID_VHT_OPERATION = 192,
- 	WLAN_EID_OPMODE_NOTIF = 199,
-+	WLAN_EID_WIDE_BW_CHANNEL_SWITCH = 194,
-+	WLAN_EID_CHANNEL_SWITCH_WRAPPER = 196,
- 
- 	/* 802.11ad */
- 	WLAN_EID_NON_TX_BSSID_CAP =  83,
-@@ -1795,6 +1831,7 @@ enum ieee80211_key_len {
- 
- /* Public action codes */
- enum ieee80211_pub_actioncode {
-+	WLAN_PUB_ACTION_EXT_CHANSW_ANN = 4,
- 	WLAN_PUB_ACTION_TDLS_DISCOVER_RES = 14,
- };
- 
---- a/include/net/cfg80211.h
-+++ b/include/net/cfg80211.h
-@@ -753,6 +753,8 @@ int cfg80211_check_station_change(struct
-  * @STATION_INFO_LOCAL_PM: @local_pm filled
-  * @STATION_INFO_PEER_PM: @peer_pm filled
-  * @STATION_INFO_NONPEER_PM: @nonpeer_pm filled
-+ * @STATION_INFO_CHAIN_SIGNAL: @chain_signal filled
-+ * @STATION_INFO_CHAIN_SIGNAL_AVG: @chain_signal_avg filled
-  */
- enum station_info_flags {
- 	STATION_INFO_INACTIVE_TIME	= 1<<0,
-@@ -781,6 +783,8 @@ enum station_info_flags {
- 	STATION_INFO_NONPEER_PM		= 1<<23,
- 	STATION_INFO_RX_BYTES64		= 1<<24,
- 	STATION_INFO_TX_BYTES64		= 1<<25,
-+	STATION_INFO_CHAIN_SIGNAL	= 1<<26,
-+	STATION_INFO_CHAIN_SIGNAL_AVG	= 1<<27,
- };
- 
- /**
-@@ -857,6 +861,8 @@ struct sta_bss_parameters {
- 	u16 beacon_interval;
- };
- 
-+#define IEEE80211_MAX_CHAINS	4
-+
- /**
-  * struct station_info - station information
-  *
-@@ -874,6 +880,9 @@ struct sta_bss_parameters {
-  *	For CFG80211_SIGNAL_TYPE_MBM, value is expressed in _dBm_.
-  * @signal_avg: Average signal strength, type depends on the wiphy's signal_type.
-  *	For CFG80211_SIGNAL_TYPE_MBM, value is expressed in _dBm_.
-+ * @chains: bitmask for filled values in @chain_signal, @chain_signal_avg
-+ * @chain_signal: per-chain signal strength of last received packet in dBm
-+ * @chain_signal_avg: per-chain signal strength average in dBm
-  * @txrate: current unicast bitrate from this station
-  * @rxrate: current unicast bitrate to this station
-  * @rx_packets: packets received from this station
-@@ -909,6 +918,11 @@ struct station_info {
- 	u8 plink_state;
- 	s8 signal;
- 	s8 signal_avg;
-+
-+	u8 chains;
-+	s8 chain_signal[IEEE80211_MAX_CHAINS];
-+	s8 chain_signal_avg[IEEE80211_MAX_CHAINS];
-+
- 	struct rate_info txrate;
- 	struct rate_info rxrate;
- 	u32 rx_packets;
-@@ -954,6 +968,7 @@ enum monitor_flags {
- 	MONITOR_FLAG_CONTROL		= 1<<NL80211_MNTR_FLAG_CONTROL,
- 	MONITOR_FLAG_OTHER_BSS		= 1<<NL80211_MNTR_FLAG_OTHER_BSS,
- 	MONITOR_FLAG_COOK_FRAMES	= 1<<NL80211_MNTR_FLAG_COOK_FRAMES,
-+	MONITOR_FLAG_ACTIVE		= 1<<NL80211_MNTR_FLAG_ACTIVE,
- };
- 
- /**
-@@ -4027,6 +4042,17 @@ bool cfg80211_reg_can_beacon(struct wiph
- void cfg80211_ch_switch_notify(struct net_device *dev,
- 			       struct cfg80211_chan_def *chandef);
- 
-+/**
-+ * ieee80211_operating_class_to_band - convert operating class to band
-+ *
-+ * @operating_class: the operating class to convert
-+ * @band: band pointer to fill
-+ *
-+ * Returns %true if the conversion was successful, %false otherwise.
-+ */
-+bool ieee80211_operating_class_to_band(u8 operating_class,
-+				       enum ieee80211_band *band);
-+
- /*
-  * cfg80211_tdls_oper_request - request userspace to perform TDLS operation
-  * @dev: the device on which the operation is requested
---- a/include/net/mac80211.h
-+++ b/include/net/mac80211.h
-@@ -210,7 +210,7 @@ struct ieee80211_chanctx_conf {
-  * @BSS_CHANGED_QOS: QoS for this association was enabled/disabled. Note
-  *	that it is only ever disabled for station mode.
-  * @BSS_CHANGED_IDLE: Idle changed for this BSS/interface.
-- * @BSS_CHANGED_SSID: SSID changed for this BSS (AP mode)
-+ * @BSS_CHANGED_SSID: SSID changed for this BSS (AP and IBSS mode)
-  * @BSS_CHANGED_AP_PROBE_RESP: Probe Response changed for this BSS (AP mode)
-  * @BSS_CHANGED_PS: PS changed for this BSS (STA mode)
-  * @BSS_CHANGED_TXPOWER: TX power setting changed for this interface
-@@ -327,7 +327,7 @@ enum ieee80211_rssi_event {
-  *	your driver/device needs to do.
-  * @ps: power-save mode (STA only). This flag is NOT affected by
-  *	offchannel/dynamic_ps operations.
-- * @ssid: The SSID of the current vif. Only valid in AP-mode.
-+ * @ssid: The SSID of the current vif. Valid in AP and IBSS mode.
-  * @ssid_len: Length of SSID given in @ssid.
-  * @hidden_ssid: The SSID of the current vif is hidden. Only valid in AP-mode.
-  * @txpower: TX power in dBm
-@@ -459,6 +459,8 @@ struct ieee80211_bss_conf {
-  * @IEEE80211_TX_CTL_DONTFRAG: Don't fragment this packet even if it
-  *	would be fragmented by size (this is optional, only used for
-  *	monitor injection).
-+ * @IEEE80211_TX_CTL_PS_RESPONSE: This frame is a response to a poll
-+ *	frame (PS-Poll or uAPSD).
-  *
-  * Note: If you have to add new flags to the enumeration, then don't
-  *	 forget to update %IEEE80211_TX_TEMPORARY_FLAGS when necessary.
-@@ -494,6 +496,7 @@ enum mac80211_tx_control_flags {
- 	IEEE80211_TX_STATUS_EOSP		= BIT(28),
- 	IEEE80211_TX_CTL_USE_MINRATE		= BIT(29),
- 	IEEE80211_TX_CTL_DONTFRAG		= BIT(30),
-+	IEEE80211_TX_CTL_PS_RESPONSE		= BIT(31),
- };
- 
- #define IEEE80211_TX_CTL_STBC_SHIFT		23
-@@ -562,6 +565,9 @@ enum mac80211_rate_control_flags {
- /* maximum number of rate stages */
- #define IEEE80211_TX_MAX_RATES	4
- 
-+/* maximum number of rate table entries */
-+#define IEEE80211_TX_RATE_TABLE_SIZE	4
-+
- /**
-  * struct ieee80211_tx_rate - rate selection/status
-  *
-@@ -602,8 +608,8 @@ static inline void ieee80211_rate_set_vh
- 					  u8 mcs, u8 nss)
- {
- 	WARN_ON(mcs & ~0xF);
--	WARN_ON(nss & ~0x7);
--	rate->idx = (nss << 4) | mcs;
-+	WARN_ON((nss - 1) & ~0x7);
-+	rate->idx = ((nss - 1) << 4) | mcs;
- }
- 
- static inline u8
-@@ -615,7 +621,7 @@ ieee80211_rate_get_vht_mcs(const struct 
- static inline u8
- ieee80211_rate_get_vht_nss(const struct ieee80211_tx_rate *rate)
- {
--	return rate->idx >> 4;
-+	return (rate->idx >> 4) + 1;
- }
- 
- /**
-@@ -656,7 +662,11 @@ struct ieee80211_tx_info {
- 					struct ieee80211_tx_rate rates[
- 						IEEE80211_TX_MAX_RATES];
- 					s8 rts_cts_rate_idx;
--					/* 3 bytes free */
-+					u8 use_rts:1;
-+					u8 use_cts_prot:1;
-+					u8 short_preamble:1;
-+					u8 skip_table:1;
-+					/* 2 bytes free */
- 				};
- 				/* only needed before rate control */
- 				unsigned long jiffies;
-@@ -677,6 +687,8 @@ struct ieee80211_tx_info {
- 		struct {
- 			struct ieee80211_tx_rate driver_rates[
- 				IEEE80211_TX_MAX_RATES];
-+			u8 pad[4];
-+
- 			void *rate_driver_data[
- 				IEEE80211_TX_INFO_RATE_DRIVER_DATA_SIZE / sizeof(void *)];
- 		};
-@@ -840,6 +852,9 @@ enum mac80211_rx_flags {
-  * @signal: signal strength when receiving this frame, either in dBm, in dB or
-  *	unspecified depending on the hardware capabilities flags
-  *	@IEEE80211_HW_SIGNAL_*
-+ * @chains: bitmask of receive chains for which separate signal strength
-+ *	values were filled.
-+ * @chain_signal: per-chain signal strength, same format as @signal
-  * @antenna: antenna used
-  * @rate_idx: index of data rate into band's supported rates or MCS index if
-  *	HT or VHT is used (%RX_FLAG_HT/%RX_FLAG_VHT)
-@@ -871,6 +886,8 @@ struct ieee80211_rx_status {
- 	u8 band;
- 	u8 antenna;
- 	s8 signal;
-+	u8 chains;
-+	s8 chain_signal[IEEE80211_MAX_CHAINS];
- 	u8 ampdu_delimiter_crc;
- 	u8 vendor_radiotap_align;
- 	u8 vendor_radiotap_oui[3];
-@@ -1018,13 +1035,13 @@ struct ieee80211_conf {
-  *	the driver passed into mac80211.
-  * @block_tx: Indicates whether transmission must be blocked before the
-  *	scheduled channel switch, as indicated by the AP.
-- * @channel: the new channel to switch to
-+ * @chandef: the new channel to switch to
-  * @count: the number of TBTT's until the channel switch event
-  */
- struct ieee80211_channel_switch {
- 	u64 timestamp;
- 	bool block_tx;
--	struct ieee80211_channel *channel;
-+	struct cfg80211_chan_def chandef;
- 	u8 count;
- };
- 
-@@ -1222,6 +1239,24 @@ enum ieee80211_sta_rx_bandwidth {
- };
- 
- /**
-+ * struct ieee80211_sta_rates - station rate selection table
-+ *
-+ * @rcu_head: RCU head used for freeing the table on update
-+ * @rates: transmit rates/flags to be used by default.
-+ *	Overriding entries per-packet is possible by using cb tx control.
-+ */
-+struct ieee80211_sta_rates {
-+	struct rcu_head rcu_head;
-+	struct {
-+		s8 idx;
-+		u8 count;
-+		u8 count_cts;
-+		u8 count_rts;
-+		u16 flags;
-+	} rate[IEEE80211_TX_RATE_TABLE_SIZE];
-+};
-+
-+/**
-  * struct ieee80211_sta - station table entry
-  *
-  * A station table entry represents a station we are possibly
-@@ -1248,6 +1283,7 @@ enum ieee80211_sta_rx_bandwidth {
-  *	notifications and capabilities. The value is only valid after
-  *	the station moves to associated state.
-  * @smps_mode: current SMPS mode (off, static or dynamic)
-+ * @tx_rates: rate control selection table
-  */
- struct ieee80211_sta {
- 	u32 supp_rates[IEEE80211_NUM_BANDS];
-@@ -1261,6 +1297,7 @@ struct ieee80211_sta {
- 	u8 rx_nss;
- 	enum ieee80211_sta_rx_bandwidth bandwidth;
- 	enum ieee80211_smps_mode smps_mode;
-+	struct ieee80211_sta_rates __rcu *rates;
- 
- 	/* must be last */
- 	u8 drv_priv[0] __aligned(sizeof(void *));
-@@ -1416,6 +1453,9 @@ struct ieee80211_tx_control {
-  *	for different virtual interfaces. See the doc section on HW queue
-  *	control for more details.
-  *
-+ * @IEEE80211_HW_SUPPORTS_RC_TABLE: The driver supports using a rate
-+ *	selection table provided by the rate control algorithm.
-+ *
-  * @IEEE80211_HW_P2P_DEV_ADDR_FOR_INTF: Use the P2P Device address for any
-  *	P2P Interface. This will be honoured even if more than one interface
-  *	is supported.
-@@ -1448,6 +1488,7 @@ enum ieee80211_hw_flags {
- 	IEEE80211_HW_SUPPORTS_PER_STA_GTK		= 1<<21,
- 	IEEE80211_HW_AP_LINK_PS				= 1<<22,
- 	IEEE80211_HW_TX_AMPDU_SETUP_IN_HW		= 1<<23,
-+	IEEE80211_HW_SUPPORTS_RC_TABLE			= 1<<24,
- 	IEEE80211_HW_P2P_DEV_ADDR_FOR_INTF		= 1<<25,
- 	IEEE80211_HW_TIMING_BEACON_ONLY			= 1<<26,
- };
-@@ -3144,6 +3185,25 @@ void ieee80211_sta_set_buffered(struct i
- 				u8 tid, bool buffered);
- 
- /**
-+ * ieee80211_get_tx_rates - get the selected transmit rates for a packet
-+ *
-+ * Call this function in a driver with per-packet rate selection support
-+ * to combine the rate info in the packet tx info with the most recent
-+ * rate selection table for the station entry.
-+ *
-+ * @vif: &struct ieee80211_vif pointer from the add_interface callback.
-+ * @sta: the receiver station to which this packet is sent.
-+ * @skb: the frame to be transmitted.
-+ * @dest: buffer for extracted rate/retry information
-+ * @max_rates: maximum number of rates to fetch
-+ */
-+void ieee80211_get_tx_rates(struct ieee80211_vif *vif,
-+			    struct ieee80211_sta *sta,
-+			    struct sk_buff *skb,
-+			    struct ieee80211_tx_rate *dest,
-+			    int max_rates);
-+
-+/**
-  * ieee80211_tx_status - transmit status callback
-  *
-  * Call this function for all transmitted frames after they have been
-@@ -4118,7 +4178,7 @@ void ieee80211_send_bar(struct ieee80211
-  *	(deprecated; this will be removed once drivers get updated to use
-  *	rate_idx_mask)
-  * @rate_idx_mask: user-requested (legacy) rate mask
-- * @rate_idx_mcs_mask: user-requested MCS rate mask
-+ * @rate_idx_mcs_mask: user-requested MCS rate mask (NULL if not in use)
-  * @bss: whether this frame is sent out in AP or IBSS mode
-  */
- struct ieee80211_tx_rate_control {
-@@ -4130,7 +4190,7 @@ struct ieee80211_tx_rate_control {
- 	bool rts, short_preamble;
- 	u8 max_rate_idx;
- 	u32 rate_idx_mask;
--	u8 rate_idx_mcs_mask[IEEE80211_HT_MCS_MASK_LEN];
-+	u8 *rate_idx_mcs_mask;
- 	bool bss;
- };
- 
-@@ -4219,6 +4279,22 @@ bool rate_usable_index_exists(struct iee
- 	return false;
- }
- 
-+/**
-+ * rate_control_set_rates - pass the sta rate selection to mac80211/driver
-+ *
-+ * When not doing a rate control probe to test rates, rate control should pass
-+ * its rate selection to mac80211. If the driver supports receiving a station
-+ * rate table, it will use it to ensure that frames are always sent based on
-+ * the most recent rate control module decision.
-+ *
-+ * @hw: pointer as obtained from ieee80211_alloc_hw()
-+ * @pubsta: &struct ieee80211_sta pointer to the target destination.
-+ * @rates: new tx rate set to be used for this station.
-+ */
-+int rate_control_set_rates(struct ieee80211_hw *hw,
-+			   struct ieee80211_sta *pubsta,
-+			   struct ieee80211_sta_rates *rates);
-+
- int ieee80211_rate_control_register(struct rate_control_ops *ops);
- void ieee80211_rate_control_unregister(struct rate_control_ops *ops);
- 
 --- a/net/mac80211/agg-rx.c
 +++ b/net/mac80211/agg-rx.c
 @@ -204,6 +204,8 @@ static void ieee80211_send_addba_resp(st
@@ -1084,180 +29,6 @@
  	    sdata->vif.type != NL80211_IFTYPE_ADHOC)
  		return -EINVAL;
  
---- a/net/mac80211/cfg.c
-+++ b/net/mac80211/cfg.c
-@@ -73,16 +73,19 @@ static int ieee80211_change_iface(struct
- 		struct ieee80211_local *local = sdata->local;
- 
- 		if (ieee80211_sdata_running(sdata)) {
-+			u32 mask = MONITOR_FLAG_COOK_FRAMES |
-+				   MONITOR_FLAG_ACTIVE;
-+
- 			/*
--			 * Prohibit MONITOR_FLAG_COOK_FRAMES to be
--			 * changed while the interface is up.
-+			 * Prohibit MONITOR_FLAG_COOK_FRAMES and
-+			 * MONITOR_FLAG_ACTIVE to be changed while the
-+			 * interface is up.
- 			 * Else we would need to add a lot of cruft
- 			 * to update everything:
- 			 *	cooked_mntrs, monitor and all fif_* counters
- 			 *	reconfigure hardware
- 			 */
--			if ((*flags & MONITOR_FLAG_COOK_FRAMES) !=
--			    (sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES))
-+			if ((*flags & mask) != (sdata->u.mntr_flags & mask))
- 				return -EBUSY;
- 
- 			ieee80211_adjust_monitor_flags(sdata, -1);
-@@ -444,7 +447,7 @@ static void sta_set_sinfo(struct sta_inf
- 	struct ieee80211_local *local = sdata->local;
- 	struct timespec uptime;
- 	u64 packets = 0;
--	int ac;
-+	int i, ac;
- 
- 	sinfo->generation = sdata->local->sta_generation;
- 
-@@ -488,6 +491,17 @@ static void sta_set_sinfo(struct sta_inf
- 			sinfo->signal = (s8)sta->last_signal;
- 		sinfo->signal_avg = (s8) -ewma_read(&sta->avg_signal);
- 	}
-+	if (sta->chains) {
-+		sinfo->filled |= STATION_INFO_CHAIN_SIGNAL |
-+				 STATION_INFO_CHAIN_SIGNAL_AVG;
-+
-+		sinfo->chains = sta->chains;
-+		for (i = 0; i < ARRAY_SIZE(sinfo->chain_signal); i++) {
-+			sinfo->chain_signal[i] = sta->chain_signal_last[i];
-+			sinfo->chain_signal_avg[i] =
-+				(s8) -ewma_read(&sta->chain_signal_avg[i]);
-+		}
-+	}
- 
- 	sta_set_rate_info_tx(sta, &sta->last_tx_rate, &sinfo->txrate);
- 	sta_set_rate_info_rx(sta, &sinfo->rxrate);
-@@ -1052,6 +1066,7 @@ static int ieee80211_stop_ap(struct wiph
- 	ieee80211_free_keys(sdata);
- 
- 	sdata->vif.bss_conf.enable_beacon = false;
-+	sdata->vif.bss_conf.ssid_len = 0;
- 	clear_bit(SDATA_STATE_OFFCHANNEL_BEACON_STOPPED, &sdata->state);
- 	ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON_ENABLED);
- 
-@@ -2416,9 +2431,22 @@ static int ieee80211_set_bitrate_mask(st
- 	}
- 
- 	for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
-+		struct ieee80211_supported_band *sband = wiphy->bands[i];
-+		int j;
-+
- 		sdata->rc_rateidx_mask[i] = mask->control[i].legacy;
- 		memcpy(sdata->rc_rateidx_mcs_mask[i], mask->control[i].mcs,
- 		       sizeof(mask->control[i].mcs));
-+
-+		sdata->rc_has_mcs_mask[i] = false;
-+		if (!sband)
-+			continue;
-+
-+		for (j = 0; j < IEEE80211_HT_MCS_MASK_LEN; j++)
-+			if (~sdata->rc_rateidx_mcs_mask[i][j]) {
-+				sdata->rc_has_mcs_mask[i] = true;
-+				break;
-+			}
- 	}
- 
- 	return 0;
---- a/net/mac80211/chan.c
-+++ b/net/mac80211/chan.c
-@@ -57,6 +57,22 @@ ieee80211_find_chanctx(struct ieee80211_
- 	return NULL;
- }
- 
-+static bool ieee80211_is_radar_required(struct ieee80211_local *local)
-+{
-+	struct ieee80211_sub_if_data *sdata;
-+
-+	rcu_read_lock();
-+	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
-+		if (sdata->radar_required) {
-+			rcu_read_unlock();
-+			return true;
-+		}
-+	}
-+	rcu_read_unlock();
-+
-+	return false;
-+}
-+
- static struct ieee80211_chanctx *
- ieee80211_new_chanctx(struct ieee80211_local *local,
- 		      const struct cfg80211_chan_def *chandef,
-@@ -76,6 +92,9 @@ ieee80211_new_chanctx(struct ieee80211_l
- 	ctx->conf.rx_chains_static = 1;
- 	ctx->conf.rx_chains_dynamic = 1;
- 	ctx->mode = mode;
-+	ctx->conf.radar_enabled = ieee80211_is_radar_required(local);
-+	if (!local->use_chanctx)
-+		local->hw.conf.radar_enabled = ctx->conf.radar_enabled;
- 
- 	/* acquire mutex to prevent idle from changing */
- 	mutex_lock(&local->mtx);
-@@ -110,6 +129,7 @@ ieee80211_new_chanctx(struct ieee80211_l
- static void ieee80211_free_chanctx(struct ieee80211_local *local,
- 				   struct ieee80211_chanctx *ctx)
- {
-+	bool check_single_channel = false;
- 	lockdep_assert_held(&local->chanctx_mtx);
- 
- 	WARN_ON_ONCE(ctx->refcount != 0);
-@@ -119,6 +139,14 @@ static void ieee80211_free_chanctx(struc
- 		chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
- 		chandef->center_freq1 = chandef->chan->center_freq;
- 		chandef->center_freq2 = 0;
-+
-+		/* NOTE: Disabling radar is only valid here for
-+		 * single channel context. To be sure, check it ...
-+		 */
-+		if (local->hw.conf.radar_enabled)
-+			check_single_channel = true;
-+		local->hw.conf.radar_enabled = false;
-+
- 		ieee80211_hw_config(local, 0);
- 	} else {
- 		drv_remove_chanctx(local, ctx);
-@@ -127,6 +155,9 @@ static void ieee80211_free_chanctx(struc
- 	list_del_rcu(&ctx->list);
- 	kfree_rcu(ctx, rcu_head);
- 
-+	/* throw a warning if this wasn't the only channel context. */
-+	WARN_ON(check_single_channel && !list_empty(&local->chanctx_list));
-+
- 	mutex_lock(&local->mtx);
- 	ieee80211_recalc_idle(local);
- 	mutex_unlock(&local->mtx);
-@@ -238,19 +269,11 @@ static void __ieee80211_vif_release_chan
- void ieee80211_recalc_radar_chanctx(struct ieee80211_local *local,
- 				    struct ieee80211_chanctx *chanctx)
- {
--	struct ieee80211_sub_if_data *sdata;
--	bool radar_enabled = false;
-+	bool radar_enabled;
- 
- 	lockdep_assert_held(&local->chanctx_mtx);
- 
--	rcu_read_lock();
--	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
--		if (sdata->radar_required) {
--			radar_enabled = true;
--			break;
--		}
--	}
--	rcu_read_unlock();
-+	radar_enabled = ieee80211_is_radar_required(local);
- 
- 	if (radar_enabled == chanctx->conf.radar_enabled)
- 		return;
 --- a/net/mac80211/debugfs_sta.c
 +++ b/net/mac80211/debugfs_sta.c
 @@ -66,11 +66,11 @@ static ssize_t sta_flags_read(struct fil
@@ -1274,159 +45,35 @@
  			    TEST(MFP), TEST(BLOCK_BA), TEST(PSPOLL),
  			    TEST(UAPSD), TEST(SP), TEST(TDLS_PEER),
  			    TEST(TDLS_PEER_AUTH), TEST(4ADDR_EVENT),
---- a/net/mac80211/ibss.c
-+++ b/net/mac80211/ibss.c
-@@ -209,6 +209,8 @@ static void __ieee80211_sta_join_ibss(st
- 	sdata->vif.bss_conf.enable_beacon = true;
- 	sdata->vif.bss_conf.beacon_int = beacon_int;
- 	sdata->vif.bss_conf.basic_rates = basic_rates;
-+	sdata->vif.bss_conf.ssid_len = ifibss->ssid_len;
-+	memcpy(sdata->vif.bss_conf.ssid, ifibss->ssid, ifibss->ssid_len);
- 	bss_change = BSS_CHANGED_BEACON_INT;
- 	bss_change |= ieee80211_reset_erp_info(sdata);
- 	bss_change |= BSS_CHANGED_BSSID;
-@@ -217,6 +219,7 @@ static void __ieee80211_sta_join_ibss(st
- 	bss_change |= BSS_CHANGED_BASIC_RATES;
- 	bss_change |= BSS_CHANGED_HT;
- 	bss_change |= BSS_CHANGED_IBSS;
-+	bss_change |= BSS_CHANGED_SSID;
- 
- 	/*
- 	 * In 5 GHz/802.11a, we can always use short slot time.
-@@ -911,7 +914,7 @@ void ieee80211_rx_mgmt_probe_beacon(stru
- 		return;
- 
- 	ieee802_11_parse_elems(mgmt->u.probe_resp.variable, len - baselen,
--				&elems);
-+			       false, &elems);
+--- a/net/mac80211/ht.c
++++ b/net/mac80211/ht.c
+@@ -281,13 +281,14 @@ void ieee80211_ba_session_work(struct wo
+ 				sta, tid, WLAN_BACK_RECIPIENT,
+ 				WLAN_REASON_UNSPECIFIED, true);
  
- 	ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems);
- }
-@@ -1159,6 +1162,7 @@ int ieee80211_ibss_leave(struct ieee8021
- 	sdata->vif.bss_conf.ibss_joined = false;
- 	sdata->vif.bss_conf.ibss_creator = false;
- 	sdata->vif.bss_conf.enable_beacon = false;
-+	sdata->vif.bss_conf.ssid_len = 0;
- 	clear_bit(SDATA_STATE_OFFCHANNEL_BEACON_STOPPED, &sdata->state);
- 	ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON_ENABLED |
- 						BSS_CHANGED_IBSS);
---- a/net/mac80211/ieee80211_i.h
-+++ b/net/mac80211/ieee80211_i.h
-@@ -156,6 +156,7 @@ struct ieee80211_tx_data {
- 	struct ieee80211_sub_if_data *sdata;
- 	struct sta_info *sta;
- 	struct ieee80211_key *key;
-+	struct ieee80211_tx_rate rate;
- 
- 	unsigned int flags;
- };
-@@ -740,6 +741,8 @@ struct ieee80211_sub_if_data {
- 
- 	/* bitmap of allowed (non-MCS) rate indexes for rate control */
- 	u32 rc_rateidx_mask[IEEE80211_NUM_BANDS];
++		spin_lock_bh(&sta->lock);
 +
-+	bool rc_has_mcs_mask[IEEE80211_NUM_BANDS];
- 	u8  rc_rateidx_mcs_mask[IEEE80211_NUM_BANDS][IEEE80211_HT_MCS_MASK_LEN];
- 
- 	union {
-@@ -1025,7 +1028,7 @@ struct ieee80211_local {
- 	enum mac80211_scan_state next_scan_state;
- 	struct delayed_work scan_work;
- 	struct ieee80211_sub_if_data __rcu *scan_sdata;
--	struct ieee80211_channel *csa_channel;
-+	struct cfg80211_chan_def csa_chandef;
- 	/* For backward compatibility only -- do not use */
- 	struct cfg80211_chan_def _oper_chandef;
- 
-@@ -1184,10 +1187,13 @@ struct ieee802_11_elems {
- 	const u8 *perr;
- 	const struct ieee80211_rann_ie *rann;
- 	const struct ieee80211_channel_sw_ie *ch_switch_ie;
-+	const struct ieee80211_ext_chansw_ie *ext_chansw_ie;
-+	const struct ieee80211_wide_bw_chansw_ie *wide_bw_chansw_ie;
- 	const u8 *country_elem;
- 	const u8 *pwr_constr_elem;
- 	const struct ieee80211_timeout_interval_ie *timeout_int;
- 	const u8 *opmode_notif;
-+	const struct ieee80211_sec_chan_offs_ie *sec_chan_offs;
- 
- 	/* length of them, respectively */
- 	u8 ssid_len;
-@@ -1258,10 +1264,6 @@ void ieee80211_recalc_ps_vif(struct ieee
- int ieee80211_max_network_latency(struct notifier_block *nb,
- 				  unsigned long data, void *dummy);
- int ieee80211_set_arp_filter(struct ieee80211_sub_if_data *sdata);
--void
--ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
--				 const struct ieee80211_channel_sw_ie *sw_elem,
--				 struct ieee80211_bss *bss, u64 timestamp);
- void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata);
- void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
- 				  struct sk_buff *skb);
-@@ -1499,13 +1501,13 @@ static inline void ieee80211_tx_skb(stru
- 	ieee80211_tx_skb_tid(sdata, skb, 7);
- }
+ 		tid_tx = sta->ampdu_mlme.tid_start_tx[tid];
+ 		if (tid_tx) {
+ 			/*
+ 			 * Assign it over to the normal tid_tx array
+ 			 * where it "goes live".
+ 			 */
+-			spin_lock_bh(&sta->lock);
  
--u32 ieee802_11_parse_elems_crc(u8 *start, size_t len,
-+u32 ieee802_11_parse_elems_crc(u8 *start, size_t len, bool action,
- 			       struct ieee802_11_elems *elems,
- 			       u64 filter, u32 crc);
--static inline void ieee802_11_parse_elems(u8 *start, size_t len,
-+static inline void ieee802_11_parse_elems(u8 *start, size_t len, bool action,
- 					  struct ieee802_11_elems *elems)
- {
--	ieee802_11_parse_elems_crc(start, len, elems, 0, 0);
-+	ieee802_11_parse_elems_crc(start, len, action, elems, 0, 0);
- }
+ 			sta->ampdu_mlme.tid_start_tx[tid] = NULL;
+ 			/* could there be a race? */
+@@ -300,6 +301,7 @@ void ieee80211_ba_session_work(struct wo
+ 			ieee80211_tx_ba_session_handle_start(sta, tid);
+ 			continue;
+ 		}
++		spin_unlock_bh(&sta->lock);
  
- u32 ieee80211_mandatory_rates(struct ieee80211_local *local,
+ 		tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
+ 		if (tid_tx && test_and_clear_bit(HT_AGG_STATE_WANT_STOP,
 --- a/net/mac80211/iface.c
 +++ b/net/mac80211/iface.c
-@@ -159,7 +159,8 @@ static int ieee80211_change_mtu(struct n
- 	return 0;
- }
- 
--static int ieee80211_verify_mac(struct ieee80211_local *local, u8 *addr)
-+static int ieee80211_verify_mac(struct ieee80211_local *local, u8 *addr,
-+				bool check_dup)
- {
- 	struct ieee80211_sub_if_data *sdata;
- 	u64 new, mask, tmp;
-@@ -179,10 +180,13 @@ static int ieee80211_verify_mac(struct i
- 		((u64)m[2] << 3*8) | ((u64)m[3] << 2*8) |
- 		((u64)m[4] << 1*8) | ((u64)m[5] << 0*8);
- 
-+	if (!check_dup)
-+		return ret;
- 
- 	mutex_lock(&local->iflist_mtx);
- 	list_for_each_entry(sdata, &local->interfaces, list) {
--		if (sdata->vif.type == NL80211_IFTYPE_MONITOR)
-+		if (sdata->vif.type == NL80211_IFTYPE_MONITOR &&
-+		    !(sdata->u.mntr_flags & MONITOR_FLAG_ACTIVE))
- 			continue;
- 
- 		m = sdata->vif.addr;
-@@ -204,12 +208,17 @@ static int ieee80211_change_mac(struct n
- {
- 	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
- 	struct sockaddr *sa = addr;
-+	bool check_dup = true;
- 	int ret;
- 
- 	if (ieee80211_sdata_running(sdata))
- 		return -EBUSY;
- 
--	ret = ieee80211_verify_mac(sdata->local, sa->sa_data);
-+	if (sdata->vif.type == NL80211_IFTYPE_MONITOR &&
-+	    !(sdata->u.mntr_flags & MONITOR_FLAG_ACTIVE))
-+		check_dup = false;
-+
-+	ret = ieee80211_verify_mac(sdata->local, sa->sa_data, check_dup);
- 	if (ret)
- 		return ret;
- 
-@@ -450,7 +459,6 @@ int ieee80211_do_open(struct wireless_de
+@@ -463,7 +463,6 @@ int ieee80211_do_open(struct wireless_de
  	struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);
  	struct net_device *dev = wdev->netdev;
  	struct ieee80211_local *local = sdata->local;
@@ -1434,30 +81,7 @@
  	u32 changed = 0;
  	int res;
  	u32 hw_reconf_flags = 0;
-@@ -474,6 +482,9 @@ int ieee80211_do_open(struct wireless_de
- 			master->control_port_protocol;
- 		sdata->control_port_no_encrypt =
- 			master->control_port_no_encrypt;
-+		sdata->vif.cab_queue = master->vif.cab_queue;
-+		memcpy(sdata->vif.hw_queue, master->vif.hw_queue,
-+		       sizeof(sdata->vif.hw_queue));
- 		break;
- 		}
- 	case NL80211_IFTYPE_AP:
-@@ -538,7 +549,11 @@ int ieee80211_do_open(struct wireless_de
- 			break;
- 		}
- 
--		if (local->monitors == 0 && local->open_count == 0) {
-+		if (sdata->u.mntr_flags & MONITOR_FLAG_ACTIVE) {
-+			res = drv_add_interface(local, sdata);
-+			if (res)
-+				goto err_stop;
-+		} else if (local->monitors == 0 && local->open_count == 0) {
- 			res = ieee80211_add_virtual_monitor(local);
- 			if (res)
- 				goto err_stop;
-@@ -609,30 +624,8 @@ int ieee80211_do_open(struct wireless_de
+@@ -629,30 +628,8 @@ int ieee80211_do_open(struct wireless_de
  
  	set_bit(SDATA_STATE_RUNNING, &sdata->state);
  
@@ -1489,42 +113,7 @@
  
  	/*
  	 * set_multicast_list will be invoked by the networking core
-@@ -653,7 +646,11 @@ int ieee80211_do_open(struct wireless_de
- 
- 	ieee80211_recalc_ps(local, -1);
- 
--	if (dev) {
-+	if (sdata->vif.type == NL80211_IFTYPE_MONITOR ||
-+	    sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
-+		/* XXX: for AP_VLAN, actually track AP queues */
-+		netif_tx_start_all_queues(dev);
-+	} else if (dev) {
- 		unsigned long flags;
- 		int n_acs = IEEE80211_NUM_ACS;
- 		int ac;
-@@ -916,7 +913,11 @@ static void ieee80211_do_stop(struct iee
- 		mutex_lock(&local->mtx);
- 		ieee80211_recalc_idle(local);
- 		mutex_unlock(&local->mtx);
--		break;
-+
-+		if (!(sdata->u.mntr_flags & MONITOR_FLAG_ACTIVE))
-+			break;
-+
-+		/* fall through */
- 	default:
- 		if (going_down)
- 			drv_remove_interface(local, sdata);
-@@ -1075,7 +1076,7 @@ static const struct net_device_ops ieee8
- 	.ndo_start_xmit		= ieee80211_monitor_start_xmit,
- 	.ndo_set_rx_mode	= ieee80211_set_multicast_list,
- 	.ndo_change_mtu 	= ieee80211_change_mtu,
--	.ndo_set_mac_address 	= eth_mac_addr,
-+	.ndo_set_mac_address 	= ieee80211_change_mac,
- 	.ndo_select_queue	= ieee80211_monitor_select_queue,
- };
- 
-@@ -1092,6 +1093,74 @@ static void ieee80211_if_setup(struct ne
+@@ -1116,6 +1093,74 @@ static void ieee80211_if_setup(struct ne
  	dev->destructor = free_netdev;
  }
  
@@ -1599,7 +188,7 @@
  static void ieee80211_iface_work(struct work_struct *work)
  {
  	struct ieee80211_sub_if_data *sdata =
-@@ -1196,6 +1265,9 @@ static void ieee80211_iface_work(struct 
+@@ -1220,6 +1265,9 @@ static void ieee80211_iface_work(struct 
  				break;
  			ieee80211_mesh_rx_queued_mgmt(sdata, skb);
  			break;
@@ -1609,1783 +198,9 @@
  		default:
  			WARN(1, "frame for unexpected interface type");
  			break;
-@@ -1718,6 +1790,15 @@ void ieee80211_remove_interfaces(struct 
- 
- 	ASSERT_RTNL();
- 
-+	/*
-+	 * Close all AP_VLAN interfaces first, as otherwise they
-+	 * might be closed while the AP interface they belong to
-+	 * is closed, causing unregister_netdevice_many() to crash.
-+	 */
-+	list_for_each_entry(sdata, &local->interfaces, list)
-+		if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
-+			dev_close(sdata->dev);
-+
- 	mutex_lock(&local->iflist_mtx);
- 	list_for_each_entry_safe(sdata, tmp, &local->interfaces, list) {
- 		list_del(&sdata->list);
---- a/net/mac80211/main.c
-+++ b/net/mac80211/main.c
-@@ -674,6 +674,7 @@ int ieee80211_register_hw(struct ieee802
- 	int channels, max_bitrates;
- 	bool supp_ht, supp_vht;
- 	netdev_features_t feature_whitelist;
-+	struct cfg80211_chan_def dflt_chandef = {};
- 	static const u32 cipher_suites[] = {
- 		/* keep WEP first, it may be removed below */
- 		WLAN_CIPHER_SUITE_WEP40,
-@@ -751,19 +752,19 @@ int ieee80211_register_hw(struct ieee802
- 		sband = local->hw.wiphy->bands[band];
- 		if (!sband)
- 			continue;
--		if (!local->use_chanctx && !local->_oper_chandef.chan) {
-+
-+		if (!dflt_chandef.chan) {
-+			cfg80211_chandef_create(&dflt_chandef,
-+						&sband->channels[0],
-+						NL80211_CHAN_NO_HT);
- 			/* init channel we're on */
--			struct cfg80211_chan_def chandef = {
--				.chan = &sband->channels[0],
--				.width = NL80211_CHAN_NO_HT,
--				.center_freq1 = sband->channels[0].center_freq,
--				.center_freq2 = 0
--			};
--			local->hw.conf.chandef = local->_oper_chandef = chandef;
-+			if (!local->use_chanctx && !local->_oper_chandef.chan) {
-+				local->hw.conf.chandef = dflt_chandef;
-+				local->_oper_chandef = dflt_chandef;
-+			}
-+			local->monitor_chandef = dflt_chandef;
- 		}
--		cfg80211_chandef_create(&local->monitor_chandef,
--					&sband->channels[0],
--					NL80211_CHAN_NO_HT);
-+
- 		channels += sband->n_channels;
- 
- 		if (max_bitrates < sband->n_bitrates)
---- a/net/mac80211/mesh.c
-+++ b/net/mac80211/mesh.c
-@@ -838,7 +838,7 @@ ieee80211_mesh_rx_probe_req(struct ieee8
- 	if (baselen > len)
- 		return;
- 
--	ieee802_11_parse_elems(pos, len - baselen, &elems);
-+	ieee802_11_parse_elems(pos, len - baselen, false, &elems);
- 
- 	/* 802.11-2012 10.1.4.3.2 */
- 	if ((!ether_addr_equal(mgmt->da, sdata->vif.addr) &&
-@@ -899,7 +899,7 @@ static void ieee80211_mesh_rx_bcn_presp(
- 		return;
- 
- 	ieee802_11_parse_elems(mgmt->u.probe_resp.variable, len - baselen,
--			       &elems);
-+			       false, &elems);
- 
- 	/* ignore non-mesh or secure / unsecure mismatch */
- 	if ((!elems.mesh_id || !elems.mesh_config) ||
---- a/net/mac80211/mesh_hwmp.c
-+++ b/net/mac80211/mesh_hwmp.c
-@@ -880,7 +880,7 @@ void mesh_rx_path_sel_frame(struct ieee8
- 
- 	baselen = (u8 *) mgmt->u.action.u.mesh_action.variable - (u8 *) mgmt;
- 	ieee802_11_parse_elems(mgmt->u.action.u.mesh_action.variable,
--			len - baselen, &elems);
-+			       len - baselen, false, &elems);
- 
- 	if (elems.preq) {
- 		if (elems.preq_len != 37)
---- a/net/mac80211/mesh_plink.c
-+++ b/net/mac80211/mesh_plink.c
-@@ -544,8 +544,8 @@ static void mesh_plink_timer(unsigned lo
- 		return;
- 	}
- 	mpl_dbg(sta->sdata,
--		"Mesh plink timer for %pM fired on state %d\n",
--		sta->sta.addr, sta->plink_state);
-+		"Mesh plink timer for %pM fired on state %s\n",
-+		sta->sta.addr, mplstates[sta->plink_state]);
- 	reason = 0;
- 	llid = sta->llid;
- 	plid = sta->plid;
-@@ -687,7 +687,7 @@ void mesh_rx_plink_frame(struct ieee8021
- 		baseaddr += 4;
- 		baselen += 4;
- 	}
--	ieee802_11_parse_elems(baseaddr, len - baselen, &elems);
-+	ieee802_11_parse_elems(baseaddr, len - baselen, true, &elems);
- 
- 	if (!elems.peering) {
- 		mpl_dbg(sdata,
---- a/net/mac80211/mlme.c
-+++ b/net/mac80211/mlme.c
-@@ -289,6 +289,8 @@ ieee80211_determine_chantype(struct ieee
- 	} else {
- 		/* 40 MHz (and 80 MHz) must be supported for VHT */
- 		ret = IEEE80211_STA_DISABLE_VHT;
-+		/* also mark 40 MHz disabled */
-+		ret |= IEEE80211_STA_DISABLE_40MHZ;
- 		goto out;
- 	}
- 
-@@ -303,12 +305,6 @@ ieee80211_determine_chantype(struct ieee
- 					       channel->band);
- 	vht_chandef.center_freq2 = 0;
- 
--	if (vht_oper->center_freq_seg2_idx)
--		vht_chandef.center_freq2 =
--			ieee80211_channel_to_frequency(
--				vht_oper->center_freq_seg2_idx,
--				channel->band);
--
- 	switch (vht_oper->chan_width) {
- 	case IEEE80211_VHT_CHANWIDTH_USE_HT:
- 		vht_chandef.width = chandef->width;
-@@ -321,6 +317,10 @@ ieee80211_determine_chantype(struct ieee
- 		break;
- 	case IEEE80211_VHT_CHANWIDTH_80P80MHZ:
- 		vht_chandef.width = NL80211_CHAN_WIDTH_80P80;
-+		vht_chandef.center_freq2 =
-+			ieee80211_channel_to_frequency(
-+				vht_oper->center_freq_seg2_idx,
-+				channel->band);
- 		break;
- 	default:
- 		if (verbose)
-@@ -604,7 +604,6 @@ static void ieee80211_add_vht_ie(struct 
- 	u8 *pos;
- 	u32 cap;
- 	struct ieee80211_sta_vht_cap vht_cap;
--	int i;
- 
- 	BUILD_BUG_ON(sizeof(vht_cap) != sizeof(sband->vht_cap));
- 
-@@ -632,37 +631,6 @@ static void ieee80211_add_vht_ie(struct 
- 			cpu_to_le32(IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE)))
- 		cap &= ~IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE;
- 
--	if (!(ap_vht_cap->vht_cap_info &
--			cpu_to_le32(IEEE80211_VHT_CAP_TXSTBC)))
--		cap &= ~(IEEE80211_VHT_CAP_RXSTBC_1 |
--			 IEEE80211_VHT_CAP_RXSTBC_3 |
--			 IEEE80211_VHT_CAP_RXSTBC_4);
--
--	for (i = 0; i < 8; i++) {
--		int shift = i * 2;
--		u16 mask = IEEE80211_VHT_MCS_NOT_SUPPORTED << shift;
--		u16 ap_mcs, our_mcs;
--
--		ap_mcs = (le16_to_cpu(ap_vht_cap->supp_mcs.tx_mcs_map) &
--								mask) >> shift;
--		our_mcs = (le16_to_cpu(vht_cap.vht_mcs.rx_mcs_map) &
--								mask) >> shift;
--
--		if (our_mcs == IEEE80211_VHT_MCS_NOT_SUPPORTED)
--			continue;
--
--		switch (ap_mcs) {
--		default:
--			if (our_mcs <= ap_mcs)
--				break;
--			/* fall through */
--		case IEEE80211_VHT_MCS_NOT_SUPPORTED:
--			vht_cap.vht_mcs.rx_mcs_map &= cpu_to_le16(~mask);
--			vht_cap.vht_mcs.rx_mcs_map |=
--				cpu_to_le16(ap_mcs << shift);
--		}
--	}
--
- 	/* reserve and fill IE */
- 	pos = skb_put(skb, sizeof(struct ieee80211_vht_cap) + 2);
- 	ieee80211_ie_build_vht_cap(pos, &vht_cap, cap);
-@@ -998,16 +966,7 @@ static void ieee80211_chswitch_work(stru
- 	if (!ifmgd->associated)
- 		goto out;
- 
--	/*
--	 * FIXME: Here we are downgrading to NL80211_CHAN_WIDTH_20_NOHT
--	 * and don't adjust our ht/vht settings
--	 * This is wrong - we should behave according to the CSA params
--	 */
--	local->_oper_chandef.chan = local->csa_channel;
--	local->_oper_chandef.width = NL80211_CHAN_WIDTH_20_NOHT;
--	local->_oper_chandef.center_freq1 =
--		local->_oper_chandef.chan->center_freq;
--	local->_oper_chandef.center_freq2 = 0;
-+	local->_oper_chandef = local->csa_chandef;
- 
- 	if (!local->ops->channel_switch) {
- 		/* call "hw_config" only if doing sw channel switch */
-@@ -1054,56 +1013,208 @@ static void ieee80211_chswitch_timer(uns
- 	ieee80211_queue_work(&sdata->local->hw, &sdata->u.mgd.chswitch_work);
- }
- 
--void
-+static void
- ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
--				 const struct ieee80211_channel_sw_ie *sw_elem,
--				 struct ieee80211_bss *bss, u64 timestamp)
-+				 u64 timestamp, struct ieee802_11_elems *elems,
-+				 bool beacon)
- {
--	struct cfg80211_bss *cbss =
--		container_of((void *)bss, struct cfg80211_bss, priv);
--	struct ieee80211_channel *new_ch;
-+	struct ieee80211_local *local = sdata->local;
- 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
--	int new_freq = ieee80211_channel_to_frequency(sw_elem->new_ch_num,
--						      cbss->channel->band);
-+	struct cfg80211_bss *cbss = ifmgd->associated;
-+	struct ieee80211_bss *bss;
- 	struct ieee80211_chanctx *chanctx;
-+	enum ieee80211_band new_band;
-+	int new_freq;
-+	u8 new_chan_no;
-+	u8 count;
-+	u8 mode;
-+	struct ieee80211_channel *new_chan;
-+	struct cfg80211_chan_def new_chandef = {};
-+	struct cfg80211_chan_def new_vht_chandef = {};
-+	const struct ieee80211_sec_chan_offs_ie *sec_chan_offs;
-+	const struct ieee80211_wide_bw_chansw_ie *wide_bw_chansw_ie;
-+	const struct ieee80211_ht_operation *ht_oper;
-+	int secondary_channel_offset = -1;
- 
- 	ASSERT_MGD_MTX(ifmgd);
- 
--	if (!ifmgd->associated)
-+	if (!cbss)
-+		return;
-+
-+	if (local->scanning)
- 		return;
- 
--	if (sdata->local->scanning)
-+	/* disregard subsequent announcements if we are already processing */
-+	if (ifmgd->flags & IEEE80211_STA_CSA_RECEIVED)
- 		return;
- 
--	/* Disregard subsequent beacons if we are already running a timer
--	   processing a CSA */
-+	sec_chan_offs = elems->sec_chan_offs;
-+	wide_bw_chansw_ie = elems->wide_bw_chansw_ie;
-+	ht_oper = elems->ht_operation;
-+
-+	if (ifmgd->flags & (IEEE80211_STA_DISABLE_HT |
-+			    IEEE80211_STA_DISABLE_40MHZ)) {
-+		sec_chan_offs = NULL;
-+		wide_bw_chansw_ie = NULL;
-+		/* only used for bandwidth here */
-+		ht_oper = NULL;
-+	}
- 
--	if (ifmgd->flags & IEEE80211_STA_CSA_RECEIVED)
-+	if (ifmgd->flags & IEEE80211_STA_DISABLE_VHT)
-+		wide_bw_chansw_ie = NULL;
-+
-+	if (elems->ext_chansw_ie) {
-+		if (!ieee80211_operating_class_to_band(
-+				elems->ext_chansw_ie->new_operating_class,
-+				&new_band)) {
-+			sdata_info(sdata,
-+				   "cannot understand ECSA IE operating class %d, disconnecting\n",
-+				   elems->ext_chansw_ie->new_operating_class);
-+			ieee80211_queue_work(&local->hw,
-+					     &ifmgd->csa_connection_drop_work);
-+		}
-+		new_chan_no = elems->ext_chansw_ie->new_ch_num;
-+		count = elems->ext_chansw_ie->count;
-+		mode = elems->ext_chansw_ie->mode;
-+	} else if (elems->ch_switch_ie) {
-+		new_band = cbss->channel->band;
-+		new_chan_no = elems->ch_switch_ie->new_ch_num;
-+		count = elems->ch_switch_ie->count;
-+		mode = elems->ch_switch_ie->mode;
-+	} else {
-+		/* nothing here we understand */
- 		return;
-+	}
-+
-+	bss = (void *)cbss->priv;
- 
--	new_ch = ieee80211_get_channel(sdata->local->hw.wiphy, new_freq);
--	if (!new_ch || new_ch->flags & IEEE80211_CHAN_DISABLED) {
-+	new_freq = ieee80211_channel_to_frequency(new_chan_no, new_band);
-+	new_chan = ieee80211_get_channel(sdata->local->hw.wiphy, new_freq);
-+	if (!new_chan || new_chan->flags & IEEE80211_CHAN_DISABLED) {
- 		sdata_info(sdata,
- 			   "AP %pM switches to unsupported channel (%d MHz), disconnecting\n",
- 			   ifmgd->associated->bssid, new_freq);
--		ieee80211_queue_work(&sdata->local->hw,
-+		ieee80211_queue_work(&local->hw,
-+				     &ifmgd->csa_connection_drop_work);
-+		return;
-+	}
-+
-+	if (!beacon && sec_chan_offs) {
-+		secondary_channel_offset = sec_chan_offs->sec_chan_offs;
-+	} else if (beacon && ht_oper) {
-+		secondary_channel_offset =
-+			ht_oper->ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET;
-+	} else if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT)) {
-+		/*
-+		 * If it's not a beacon, HT is enabled and the IE not present,
-+		 * it's 20 MHz, 802.11-2012 8.5.2.6:
-+		 *	This element [the Secondary Channel Offset Element] is
-+		 *	present when switching to a 40 MHz channel. It may be
-+		 *	present when switching to a 20 MHz channel (in which
-+		 *	case the secondary channel offset is set to SCN).
-+		 */
-+		secondary_channel_offset = IEEE80211_HT_PARAM_CHA_SEC_NONE;
-+	}
-+
-+	switch (secondary_channel_offset) {
-+	default:
-+		/* secondary_channel_offset was present but is invalid */
-+	case IEEE80211_HT_PARAM_CHA_SEC_NONE:
-+		cfg80211_chandef_create(&new_chandef, new_chan,
-+					NL80211_CHAN_HT20);
-+		break;
-+	case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
-+		cfg80211_chandef_create(&new_chandef, new_chan,
-+					NL80211_CHAN_HT40PLUS);
-+		break;
-+	case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
-+		cfg80211_chandef_create(&new_chandef, new_chan,
-+					NL80211_CHAN_HT40MINUS);
-+		break;
-+	case -1:
-+		cfg80211_chandef_create(&new_chandef, new_chan,
-+					NL80211_CHAN_NO_HT);
-+		break;
-+	}
-+
-+	if (wide_bw_chansw_ie) {
-+		new_vht_chandef.chan = new_chan;
-+		new_vht_chandef.center_freq1 =
-+			ieee80211_channel_to_frequency(
-+				wide_bw_chansw_ie->new_center_freq_seg0,
-+				new_band);
-+
-+		switch (wide_bw_chansw_ie->new_channel_width) {
-+		default:
-+			/* hmmm, ignore VHT and use HT if present */
-+		case IEEE80211_VHT_CHANWIDTH_USE_HT:
-+			new_vht_chandef.chan = NULL;
-+			break;
-+		case IEEE80211_VHT_CHANWIDTH_80MHZ:
-+			new_vht_chandef.width = NL80211_CHAN_WIDTH_80;
-+			break;
-+		case IEEE80211_VHT_CHANWIDTH_160MHZ:
-+			new_vht_chandef.width = NL80211_CHAN_WIDTH_160;
-+			break;
-+		case IEEE80211_VHT_CHANWIDTH_80P80MHZ:
-+			/* field is otherwise reserved */
-+			new_vht_chandef.center_freq2 =
-+				ieee80211_channel_to_frequency(
-+					wide_bw_chansw_ie->new_center_freq_seg1,
-+					new_band);
-+			new_vht_chandef.width = NL80211_CHAN_WIDTH_80P80;
-+			break;
-+		}
-+		if (ifmgd->flags & IEEE80211_STA_DISABLE_80P80MHZ &&
-+		    new_vht_chandef.width == NL80211_CHAN_WIDTH_80P80)
-+			chandef_downgrade(&new_vht_chandef);
-+		if (ifmgd->flags & IEEE80211_STA_DISABLE_160MHZ &&
-+		    new_vht_chandef.width == NL80211_CHAN_WIDTH_160)
-+			chandef_downgrade(&new_vht_chandef);
-+		if (ifmgd->flags & IEEE80211_STA_DISABLE_40MHZ &&
-+		    new_vht_chandef.width > NL80211_CHAN_WIDTH_20)
-+			chandef_downgrade(&new_vht_chandef);
-+	}
-+
-+	/* if VHT data is there validate & use it */
-+	if (new_vht_chandef.chan) {
-+		if (!cfg80211_chandef_compatible(&new_vht_chandef,
-+						 &new_chandef)) {
-+			sdata_info(sdata,
-+				   "AP %pM CSA has inconsistent channel data, disconnecting\n",
-+				   ifmgd->associated->bssid);
-+			ieee80211_queue_work(&local->hw,
-+					     &ifmgd->csa_connection_drop_work);
-+			return;
-+		}
-+		new_chandef = new_vht_chandef;
-+	}
-+
-+	if (!cfg80211_chandef_usable(local->hw.wiphy, &new_chandef,
-+				     IEEE80211_CHAN_DISABLED)) {
-+		sdata_info(sdata,
-+			   "AP %pM switches to unsupported channel (%d MHz, width:%d, CF1/2: %d/%d MHz), disconnecting\n",
-+			   ifmgd->associated->bssid, new_freq,
-+			   new_chandef.width, new_chandef.center_freq1,
-+			   new_chandef.center_freq2);
-+		ieee80211_queue_work(&local->hw,
- 				     &ifmgd->csa_connection_drop_work);
- 		return;
- 	}
- 
- 	ifmgd->flags |= IEEE80211_STA_CSA_RECEIVED;
- 
--	if (sdata->local->use_chanctx) {
-+	if (local->use_chanctx) {
- 		sdata_info(sdata,
- 			   "not handling channel switch with channel contexts\n");
--		ieee80211_queue_work(&sdata->local->hw,
-+		ieee80211_queue_work(&local->hw,
- 				     &ifmgd->csa_connection_drop_work);
- 		return;
- 	}
- 
--	mutex_lock(&sdata->local->chanctx_mtx);
-+	mutex_lock(&local->chanctx_mtx);
- 	if (WARN_ON(!rcu_access_pointer(sdata->vif.chanctx_conf))) {
--		mutex_unlock(&sdata->local->chanctx_mtx);
-+		mutex_unlock(&local->chanctx_mtx);
- 		return;
- 	}
- 	chanctx = container_of(rcu_access_pointer(sdata->vif.chanctx_conf),
-@@ -1111,40 +1222,39 @@ ieee80211_sta_process_chanswitch(struct 
- 	if (chanctx->refcount > 1) {
- 		sdata_info(sdata,
- 			   "channel switch with multiple interfaces on the same channel, disconnecting\n");
--		ieee80211_queue_work(&sdata->local->hw,
-+		ieee80211_queue_work(&local->hw,
- 				     &ifmgd->csa_connection_drop_work);
--		mutex_unlock(&sdata->local->chanctx_mtx);
-+		mutex_unlock(&local->chanctx_mtx);
- 		return;
- 	}
--	mutex_unlock(&sdata->local->chanctx_mtx);
-+	mutex_unlock(&local->chanctx_mtx);
- 
--	sdata->local->csa_channel = new_ch;
-+	local->csa_chandef = new_chandef;
- 
--	if (sw_elem->mode)
--		ieee80211_stop_queues_by_reason(&sdata->local->hw,
-+	if (mode)
-+		ieee80211_stop_queues_by_reason(&local->hw,
- 				IEEE80211_MAX_QUEUE_MAP,
- 				IEEE80211_QUEUE_STOP_REASON_CSA);
- 
--	if (sdata->local->ops->channel_switch) {
-+	if (local->ops->channel_switch) {
- 		/* use driver's channel switch callback */
- 		struct ieee80211_channel_switch ch_switch = {
- 			.timestamp = timestamp,
--			.block_tx = sw_elem->mode,
--			.channel = new_ch,
--			.count = sw_elem->count,
-+			.block_tx = mode,
-+			.chandef = new_chandef,
-+			.count = count,
- 		};
- 
--		drv_channel_switch(sdata->local, &ch_switch);
-+		drv_channel_switch(local, &ch_switch);
- 		return;
- 	}
- 
- 	/* channel switch handled in software */
--	if (sw_elem->count <= 1)
--		ieee80211_queue_work(&sdata->local->hw, &ifmgd->chswitch_work);
-+	if (count <= 1)
-+		ieee80211_queue_work(&local->hw, &ifmgd->chswitch_work);
- 	else
- 		mod_timer(&ifmgd->chswitch_timer,
--			  TU_TO_EXP_TIME(sw_elem->count *
--					 cbss->beacon_interval));
-+			  TU_TO_EXP_TIME(count * cbss->beacon_interval));
- }
- 
- static u32 ieee80211_handle_pwr_constr(struct ieee80211_sub_if_data *sdata,
-@@ -2120,7 +2230,6 @@ void ieee80211_beacon_loss(struct ieee80
- 
- 	trace_api_beacon_loss(sdata);
- 
--	WARN_ON(hw->flags & IEEE80211_HW_CONNECTION_MONITOR);
- 	sdata->u.mgd.connection_loss = false;
- 	ieee80211_queue_work(hw, &sdata->u.mgd.beacon_connection_loss_work);
- }
-@@ -2170,7 +2279,7 @@ static void ieee80211_auth_challenge(str
- 	u32 tx_flags = 0;
- 
- 	pos = mgmt->u.auth.variable;
--	ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems);
-+	ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), false, &elems);
- 	if (!elems.challenge)
- 		return;
- 	auth_data->expected_transaction = 4;
-@@ -2435,7 +2544,7 @@ static bool ieee80211_assoc_success(stru
- 	}
- 
- 	pos = mgmt->u.assoc_resp.variable;
--	ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems);
-+	ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), false, &elems);
- 
- 	if (!elems.supp_rates) {
- 		sdata_info(sdata, "no SuppRates element in AssocResp\n");
-@@ -2604,7 +2713,7 @@ ieee80211_rx_mgmt_assoc_resp(struct ieee
- 		   capab_info, status_code, (u16)(aid & ~(BIT(15) | BIT(14))));
- 
- 	pos = mgmt->u.assoc_resp.variable;
--	ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems);
-+	ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), false, &elems);
- 
- 	if (status_code == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY &&
- 	    elems.timeout_int &&
-@@ -2659,6 +2768,8 @@ static void ieee80211_rx_bss_info(struct
- 	struct ieee80211_channel *channel;
- 	bool need_ps = false;
- 
-+	lockdep_assert_held(&sdata->u.mgd.mtx);
-+
- 	if ((sdata->u.mgd.associated &&
- 	     ether_addr_equal(mgmt->bssid, sdata->u.mgd.associated->bssid)) ||
- 	    (sdata->u.mgd.assoc_data &&
-@@ -2689,7 +2800,8 @@ static void ieee80211_rx_bss_info(struct
- 	if (bss)
- 		ieee80211_rx_bss_put(local, bss);
- 
--	if (!sdata->u.mgd.associated)
-+	if (!sdata->u.mgd.associated ||
-+	    !ether_addr_equal(mgmt->bssid, sdata->u.mgd.associated->bssid))
- 		return;
- 
- 	if (need_ps) {
-@@ -2698,10 +2810,9 @@ static void ieee80211_rx_bss_info(struct
- 		mutex_unlock(&local->iflist_mtx);
- 	}
- 
--	if (elems->ch_switch_ie &&
--	    memcmp(mgmt->bssid, sdata->u.mgd.associated->bssid, ETH_ALEN) == 0)
--		ieee80211_sta_process_chanswitch(sdata, elems->ch_switch_ie,
--						 bss, rx_status->mactime);
-+	ieee80211_sta_process_chanswitch(sdata, rx_status->mactime,
-+					 elems, true);
-+
- }
- 
- 
-@@ -2726,7 +2837,7 @@ static void ieee80211_rx_mgmt_probe_resp
- 		return;
- 
- 	ieee802_11_parse_elems(mgmt->u.probe_resp.variable, len - baselen,
--				&elems);
-+			       false, &elems);
- 
- 	ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems);
- 
-@@ -2809,7 +2920,7 @@ ieee80211_rx_mgmt_beacon(struct ieee8021
- 	if (ifmgd->assoc_data && ifmgd->assoc_data->need_beacon &&
- 	    ether_addr_equal(mgmt->bssid, ifmgd->assoc_data->bss->bssid)) {
- 		ieee802_11_parse_elems(mgmt->u.beacon.variable,
--				       len - baselen, &elems);
-+				       len - baselen, false, &elems);
- 
- 		ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems);
- 		ifmgd->assoc_data->have_beacon = true;
-@@ -2919,7 +3030,7 @@ ieee80211_rx_mgmt_beacon(struct ieee8021
- 
- 	ncrc = crc32_be(0, (void *)&mgmt->u.beacon.beacon_int, 4);
- 	ncrc = ieee802_11_parse_elems_crc(mgmt->u.beacon.variable,
--					  len - baselen, &elems,
-+					  len - baselen, false, &elems,
- 					  care_about_ies, ncrc);
- 
- 	if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK) {
-@@ -3066,6 +3177,8 @@ void ieee80211_sta_rx_queued_mgmt(struct
- 	enum rx_mgmt_action rma = RX_MGMT_NONE;
- 	u8 deauth_buf[IEEE80211_DEAUTH_FRAME_LEN];
- 	u16 fc;
-+	struct ieee802_11_elems elems;
-+	int ies_len;
- 
- 	rx_status = (struct ieee80211_rx_status *) skb->cb;
- 	mgmt = (struct ieee80211_mgmt *) skb->data;
-@@ -3095,14 +3208,48 @@ void ieee80211_sta_rx_queued_mgmt(struct
- 		rma = ieee80211_rx_mgmt_assoc_resp(sdata, mgmt, skb->len, &bss);
- 		break;
- 	case IEEE80211_STYPE_ACTION:
--		switch (mgmt->u.action.category) {
--		case WLAN_CATEGORY_SPECTRUM_MGMT:
-+		if (mgmt->u.action.category == WLAN_CATEGORY_SPECTRUM_MGMT) {
-+			ies_len = skb->len -
-+				  offsetof(struct ieee80211_mgmt,
-+					   u.action.u.chan_switch.variable);
-+
-+			if (ies_len < 0)
-+				break;
-+
-+			ieee802_11_parse_elems(
-+				mgmt->u.action.u.chan_switch.variable,
-+				ies_len, true, &elems);
-+
-+			if (elems.parse_error)
-+				break;
-+
- 			ieee80211_sta_process_chanswitch(sdata,
--					&mgmt->u.action.u.chan_switch.sw_elem,
--					(void *)ifmgd->associated->priv,
--					rx_status->mactime);
--			break;
-+							 rx_status->mactime,
-+							 &elems, false);
-+		} else if (mgmt->u.action.category == WLAN_CATEGORY_PUBLIC) {
-+			ies_len = skb->len -
-+				  offsetof(struct ieee80211_mgmt,
-+					   u.action.u.ext_chan_switch.variable);
-+
-+			if (ies_len < 0)
-+				break;
-+
-+			ieee802_11_parse_elems(
-+				mgmt->u.action.u.ext_chan_switch.variable,
-+				ies_len, true, &elems);
-+
-+			if (elems.parse_error)
-+				break;
-+
-+			/* for the handling code pretend this was also an IE */
-+			elems.ext_chansw_ie =
-+				&mgmt->u.action.u.ext_chan_switch.data;
-+
-+			ieee80211_sta_process_chanswitch(sdata,
-+							 rx_status->mactime,
-+							 &elems, false);
- 		}
-+		break;
- 	}
- 	mutex_unlock(&ifmgd->mtx);
- 
-@@ -4197,7 +4344,7 @@ int ieee80211_mgd_deauth(struct ieee8021
- 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
- 	u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
- 	bool tx = !req->local_state_change;
--	bool sent_frame = false;
-+	bool report_frame = false;
- 
- 	mutex_lock(&ifmgd->mtx);
- 
-@@ -4214,7 +4361,7 @@ int ieee80211_mgd_deauth(struct ieee8021
- 		ieee80211_destroy_auth_data(sdata, false);
- 		mutex_unlock(&ifmgd->mtx);
- 
--		sent_frame = tx;
-+		report_frame = true;
- 		goto out;
- 	}
- 
-@@ -4222,12 +4369,12 @@ int ieee80211_mgd_deauth(struct ieee8021
- 	    ether_addr_equal(ifmgd->associated->bssid, req->bssid)) {
- 		ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
- 				       req->reason_code, tx, frame_buf);
--		sent_frame = tx;
-+		report_frame = true;
- 	}
- 	mutex_unlock(&ifmgd->mtx);
- 
-  out:
--	if (sent_frame)
-+	if (report_frame)
- 		__cfg80211_send_deauth(sdata->dev, frame_buf,
- 				       IEEE80211_DEAUTH_FRAME_LEN);
- 
---- a/net/mac80211/pm.c
-+++ b/net/mac80211/pm.c
-@@ -38,8 +38,8 @@ int __ieee80211_suspend(struct ieee80211
- 					IEEE80211_MAX_QUEUE_MAP,
- 					IEEE80211_QUEUE_STOP_REASON_SUSPEND);
- 
--	/* flush out all packets */
--	synchronize_net();
-+	/* flush out all packets and station cleanup call_rcu()s */
-+	rcu_barrier();
- 
- 	ieee80211_flush_queues(local, NULL);
- 
---- a/net/mac80211/rate.c
-+++ b/net/mac80211/rate.c
-@@ -252,6 +252,25 @@ rate_lowest_non_cck_index(struct ieee802
- 	return 0;
- }
- 
-+static void __rate_control_send_low(struct ieee80211_hw *hw,
-+				    struct ieee80211_supported_band *sband,
-+				    struct ieee80211_sta *sta,
-+				    struct ieee80211_tx_info *info)
-+{
-+	if ((sband->band != IEEE80211_BAND_2GHZ) ||
-+	    !(info->flags & IEEE80211_TX_CTL_NO_CCK_RATE))
-+		info->control.rates[0].idx = rate_lowest_index(sband, sta);
-+	else
-+		info->control.rates[0].idx =
-+			rate_lowest_non_cck_index(sband, sta);
-+
-+	info->control.rates[0].count =
-+		(info->flags & IEEE80211_TX_CTL_NO_ACK) ?
-+		1 : hw->max_rate_tries;
-+
-+	info->control.skip_table = 1;
-+}
-+
- 
- bool rate_control_send_low(struct ieee80211_sta *sta,
- 			   void *priv_sta,
-@@ -262,16 +281,8 @@ bool rate_control_send_low(struct ieee80
- 	int mcast_rate;
- 
- 	if (!sta || !priv_sta || rc_no_data_or_no_ack_use_min(txrc)) {
--		if ((sband->band != IEEE80211_BAND_2GHZ) ||
--		    !(info->flags & IEEE80211_TX_CTL_NO_CCK_RATE))
--			info->control.rates[0].idx =
--				rate_lowest_index(txrc->sband, sta);
--		else
--			info->control.rates[0].idx =
--				rate_lowest_non_cck_index(txrc->sband, sta);
--		info->control.rates[0].count =
--			(info->flags & IEEE80211_TX_CTL_NO_ACK) ?
--			1 : txrc->hw->max_rate_tries;
-+		__rate_control_send_low(txrc->hw, sband, sta, info);
-+
- 		if (!sta && txrc->bss) {
- 			mcast_rate = txrc->bss_conf->mcast_rate[sband->band];
- 			if (mcast_rate > 0) {
-@@ -355,7 +366,8 @@ static bool rate_idx_match_mcs_mask(stru
- 
- 
- static void rate_idx_match_mask(struct ieee80211_tx_rate *rate,
--				struct ieee80211_tx_rate_control *txrc,
-+				struct ieee80211_supported_band *sband,
-+				enum nl80211_chan_width chan_width,
- 				u32 mask,
- 				u8 mcs_mask[IEEE80211_HT_MCS_MASK_LEN])
- {
-@@ -375,27 +387,17 @@ static void rate_idx_match_mask(struct i
- 				  IEEE80211_TX_RC_USE_SHORT_PREAMBLE);
- 		alt_rate.count = rate->count;
- 		if (rate_idx_match_legacy_mask(&alt_rate,
--					       txrc->sband->n_bitrates,
--					       mask)) {
-+					       sband->n_bitrates, mask)) {
- 			*rate = alt_rate;
- 			return;
- 		}
- 	} else {
--		struct sk_buff *skb = txrc->skb;
--		struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
--		__le16 fc;
--
- 		/* handle legacy rates */
--		if (rate_idx_match_legacy_mask(rate, txrc->sband->n_bitrates,
--					       mask))
-+		if (rate_idx_match_legacy_mask(rate, sband->n_bitrates, mask))
- 			return;
- 
- 		/* if HT BSS, and we handle a data frame, also try HT rates */
--		if (txrc->bss_conf->chandef.width == NL80211_CHAN_WIDTH_20_NOHT)
--			return;
--
--		fc = hdr->frame_control;
--		if (!ieee80211_is_data(fc))
-+		if (chan_width == NL80211_CHAN_WIDTH_20_NOHT)
- 			return;
- 
- 		alt_rate.idx = 0;
-@@ -408,7 +410,7 @@ static void rate_idx_match_mask(struct i
- 
- 		alt_rate.flags |= IEEE80211_TX_RC_MCS;
- 
--		if (txrc->bss_conf->chandef.width == NL80211_CHAN_WIDTH_40)
-+		if (chan_width == NL80211_CHAN_WIDTH_40)
- 			alt_rate.flags |= IEEE80211_TX_RC_40_MHZ_WIDTH;
- 
- 		if (rate_idx_match_mcs_mask(&alt_rate, mcs_mask)) {
-@@ -426,6 +428,228 @@ static void rate_idx_match_mask(struct i
- 	 */
- }
- 
-+static void rate_fixup_ratelist(struct ieee80211_vif *vif,
-+				struct ieee80211_supported_band *sband,
-+				struct ieee80211_tx_info *info,
-+				struct ieee80211_tx_rate *rates,
-+				int max_rates)
-+{
-+	struct ieee80211_rate *rate;
-+	bool inval = false;
-+	int i;
-+
-+	/*
-+	 * Set up the RTS/CTS rate as the fastest basic rate
-+	 * that is not faster than the data rate unless there
-+	 * is no basic rate slower than the data rate, in which
-+	 * case we pick the slowest basic rate
-+	 *
-+	 * XXX: Should this check all retry rates?
-+	 */
-+	if (!(rates[0].flags & IEEE80211_TX_RC_MCS)) {
-+		u32 basic_rates = vif->bss_conf.basic_rates;
-+		s8 baserate = basic_rates ? ffs(basic_rates - 1) : 0;
-+
-+		rate = &sband->bitrates[rates[0].idx];
-+
-+		for (i = 0; i < sband->n_bitrates; i++) {
-+			/* must be a basic rate */
-+			if (!(basic_rates & BIT(i)))
-+				continue;
-+			/* must not be faster than the data rate */
-+			if (sband->bitrates[i].bitrate > rate->bitrate)
-+				continue;
-+			/* maximum */
-+			if (sband->bitrates[baserate].bitrate <
-+			     sband->bitrates[i].bitrate)
-+				baserate = i;
-+		}
-+
-+		info->control.rts_cts_rate_idx = baserate;
-+	}
-+
-+	for (i = 0; i < max_rates; i++) {
-+		/*
-+		 * make sure there's no valid rate following
-+		 * an invalid one, just in case drivers don't
-+		 * take the API seriously to stop at -1.
-+		 */
-+		if (inval) {
-+			rates[i].idx = -1;
-+			continue;
-+		}
-+		if (rates[i].idx < 0) {
-+			inval = true;
-+			continue;
-+		}
-+
-+		/*
-+		 * For now assume MCS is already set up correctly, this
-+		 * needs to be fixed.
-+		 */
-+		if (rates[i].flags & IEEE80211_TX_RC_MCS) {
-+			WARN_ON(rates[i].idx > 76);
-+
-+			if (!(rates[i].flags & IEEE80211_TX_RC_USE_RTS_CTS) &&
-+			    info->control.use_cts_prot)
-+				rates[i].flags |=
-+					IEEE80211_TX_RC_USE_CTS_PROTECT;
-+			continue;
-+		}
-+
-+		if (rates[i].flags & IEEE80211_TX_RC_VHT_MCS) {
-+			WARN_ON(ieee80211_rate_get_vht_mcs(&rates[i]) > 9);
-+			continue;
-+		}
-+
-+		/* set up RTS protection if desired */
-+		if (info->control.use_rts) {
-+			rates[i].flags |= IEEE80211_TX_RC_USE_RTS_CTS;
-+			info->control.use_cts_prot = false;
-+		}
-+
-+		/* RC is busted */
-+		if (WARN_ON_ONCE(rates[i].idx >= sband->n_bitrates)) {
-+			rates[i].idx = -1;
-+			continue;
-+		}
-+
-+		rate = &sband->bitrates[rates[i].idx];
-+
-+		/* set up short preamble */
-+		if (info->control.short_preamble &&
-+		    rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
-+			rates[i].flags |= IEEE80211_TX_RC_USE_SHORT_PREAMBLE;
-+
-+		/* set up G protection */
-+		if (!(rates[i].flags & IEEE80211_TX_RC_USE_RTS_CTS) &&
-+		    info->control.use_cts_prot &&
-+		    rate->flags & IEEE80211_RATE_ERP_G)
-+			rates[i].flags |= IEEE80211_TX_RC_USE_CTS_PROTECT;
-+	}
-+}
-+
-+
-+static void rate_control_fill_sta_table(struct ieee80211_sta *sta,
-+					struct ieee80211_tx_info *info,
-+					struct ieee80211_tx_rate *rates,
-+					int max_rates)
-+{
-+	struct ieee80211_sta_rates *ratetbl = NULL;
-+	int i;
-+
-+	if (sta && !info->control.skip_table)
-+		ratetbl = rcu_dereference(sta->rates);
-+
-+	/* Fill remaining rate slots with data from the sta rate table. */
-+	max_rates = min_t(int, max_rates, IEEE80211_TX_RATE_TABLE_SIZE);
-+	for (i = 0; i < max_rates; i++) {
-+		if (i < ARRAY_SIZE(info->control.rates) &&
-+		    info->control.rates[i].idx >= 0 &&
-+		    info->control.rates[i].count) {
-+			if (rates != info->control.rates)
-+				rates[i] = info->control.rates[i];
-+		} else if (ratetbl) {
-+			rates[i].idx = ratetbl->rate[i].idx;
-+			rates[i].flags = ratetbl->rate[i].flags;
-+			if (info->control.use_rts)
-+				rates[i].count = ratetbl->rate[i].count_rts;
-+			else if (info->control.use_cts_prot)
-+				rates[i].count = ratetbl->rate[i].count_cts;
-+			else
-+				rates[i].count = ratetbl->rate[i].count;
-+		} else {
-+			rates[i].idx = -1;
-+			rates[i].count = 0;
-+		}
-+
-+		if (rates[i].idx < 0 || !rates[i].count)
-+			break;
-+	}
-+}
-+
-+static void rate_control_apply_mask(struct ieee80211_sub_if_data *sdata,
-+				    struct ieee80211_sta *sta,
-+				    struct ieee80211_supported_band *sband,
-+				    struct ieee80211_tx_info *info,
-+				    struct ieee80211_tx_rate *rates,
-+				    int max_rates)
-+{
-+	enum nl80211_chan_width chan_width;
-+	u8 mcs_mask[IEEE80211_HT_MCS_MASK_LEN];
-+	bool has_mcs_mask;
-+	u32 mask;
-+	int i;
-+
-+	/*
-+	 * Try to enforce the rateidx mask the user wanted. skip this if the
-+	 * default mask (allow all rates) is used to save some processing for
-+	 * the common case.
-+	 */
-+	mask = sdata->rc_rateidx_mask[info->band];
-+	has_mcs_mask = sdata->rc_has_mcs_mask[info->band];
-+	if (mask == (1 << sband->n_bitrates) - 1 && !has_mcs_mask)
-+		return;
-+
-+	if (has_mcs_mask)
-+		memcpy(mcs_mask, sdata->rc_rateidx_mcs_mask[info->band],
-+		       sizeof(mcs_mask));
-+	else
-+		memset(mcs_mask, 0xff, sizeof(mcs_mask));
-+
-+	if (sta) {
-+		/* Filter out rates that the STA does not support */
-+		mask &= sta->supp_rates[info->band];
-+		for (i = 0; i < sizeof(mcs_mask); i++)
-+			mcs_mask[i] &= sta->ht_cap.mcs.rx_mask[i];
-+	}
-+
-+	/*
-+	 * Make sure the rate index selected for each TX rate is
-+	 * included in the configured mask and change the rate indexes
-+	 * if needed.
-+	 */
-+	chan_width = sdata->vif.bss_conf.chandef.width;
-+	for (i = 0; i < max_rates; i++) {
-+		/* Skip invalid rates */
-+		if (rates[i].idx < 0)
-+			break;
-+
-+		rate_idx_match_mask(&rates[i], sband, chan_width, mask,
-+				    mcs_mask);
-+	}
-+}
-+
-+void ieee80211_get_tx_rates(struct ieee80211_vif *vif,
-+			    struct ieee80211_sta *sta,
-+			    struct sk_buff *skb,
-+			    struct ieee80211_tx_rate *dest,
-+			    int max_rates)
-+{
-+	struct ieee80211_sub_if_data *sdata;
-+	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
-+	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-+	struct ieee80211_supported_band *sband;
-+
-+	rate_control_fill_sta_table(sta, info, dest, max_rates);
-+
-+	if (!vif)
-+		return;
-+
-+	sdata = vif_to_sdata(vif);
-+	sband = sdata->local->hw.wiphy->bands[info->band];
-+
-+	if (ieee80211_is_data(hdr->frame_control))
-+		rate_control_apply_mask(sdata, sta, sband, info, dest, max_rates);
-+
-+	if (dest[0].idx < 0)
-+		__rate_control_send_low(&sdata->local->hw, sband, sta, info);
-+
-+	if (sta)
-+		rate_fixup_ratelist(vif, sband, info, dest, max_rates);
-+}
-+EXPORT_SYMBOL(ieee80211_get_tx_rates);
-+
- void rate_control_get_rate(struct ieee80211_sub_if_data *sdata,
- 			   struct sta_info *sta,
- 			   struct ieee80211_tx_rate_control *txrc)
-@@ -435,8 +659,6 @@ void rate_control_get_rate(struct ieee80
- 	struct ieee80211_sta *ista = NULL;
- 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(txrc->skb);
- 	int i;
--	u32 mask;
--	u8 mcs_mask[IEEE80211_HT_MCS_MASK_LEN];
- 
- 	if (sta && test_sta_flag(sta, WLAN_STA_RATE_CONTROL)) {
- 		ista = &sta->sta;
-@@ -454,37 +676,27 @@ void rate_control_get_rate(struct ieee80
- 
- 	ref->ops->get_rate(ref->priv, ista, priv_sta, txrc);
- 
--	/*
--	 * Try to enforce the rateidx mask the user wanted. skip this if the
--	 * default mask (allow all rates) is used to save some processing for
--	 * the common case.
--	 */
--	mask = sdata->rc_rateidx_mask[info->band];
--	memcpy(mcs_mask, sdata->rc_rateidx_mcs_mask[info->band],
--	       sizeof(mcs_mask));
--	if (mask != (1 << txrc->sband->n_bitrates) - 1) {
--		if (sta) {
--			/* Filter out rates that the STA does not support */
--			mask &= sta->sta.supp_rates[info->band];
--			for (i = 0; i < sizeof(mcs_mask); i++)
--				mcs_mask[i] &= sta->sta.ht_cap.mcs.rx_mask[i];
--		}
--		/*
--		 * Make sure the rate index selected for each TX rate is
--		 * included in the configured mask and change the rate indexes
--		 * if needed.
--		 */
--		for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
--			/* Skip invalid rates */
--			if (info->control.rates[i].idx < 0)
--				break;
--			rate_idx_match_mask(&info->control.rates[i], txrc,
--					    mask, mcs_mask);
--		}
--	}
-+	if (sdata->local->hw.flags & IEEE80211_HW_SUPPORTS_RC_TABLE)
-+		return;
- 
--	BUG_ON(info->control.rates[0].idx < 0);
-+	ieee80211_get_tx_rates(&sdata->vif, ista, txrc->skb,
-+			       info->control.rates,
-+			       ARRAY_SIZE(info->control.rates));
-+}
-+
-+int rate_control_set_rates(struct ieee80211_hw *hw,
-+			   struct ieee80211_sta *pubsta,
-+			   struct ieee80211_sta_rates *rates)
-+{
-+	struct ieee80211_sta_rates *old = rcu_dereference(pubsta->rates);
-+
-+	rcu_assign_pointer(pubsta->rates, rates);
-+	if (old)
-+		kfree_rcu(old, rcu_head);
-+
-+	return 0;
- }
-+EXPORT_SYMBOL(rate_control_set_rates);
- 
- int ieee80211_init_rate_ctrl_alg(struct ieee80211_local *local,
- 				 const char *name)
---- a/net/mac80211/rc80211_minstrel.c
-+++ b/net/mac80211/rc80211_minstrel.c
-@@ -84,6 +84,50 @@ minstrel_sort_best_tp_rates(struct minst
- }
- 
- static void
-+minstrel_set_rate(struct minstrel_sta_info *mi, struct ieee80211_sta_rates *ratetbl,
-+		  int offset, int idx)
-+{
-+	struct minstrel_rate *r = &mi->r[idx];
-+
-+	ratetbl->rate[offset].idx = r->rix;
-+	ratetbl->rate[offset].count = r->adjusted_retry_count;
-+	ratetbl->rate[offset].count_cts = r->retry_count_cts;
-+	ratetbl->rate[offset].count_rts = r->retry_count_rtscts;
-+}
-+
-+static void
-+minstrel_update_rates(struct minstrel_priv *mp, struct minstrel_sta_info *mi)
-+{
-+	struct ieee80211_sta_rates *ratetbl;
-+	int i = 0;
-+
-+	ratetbl = kzalloc(sizeof(*ratetbl), GFP_ATOMIC);
-+	if (!ratetbl)
-+		return;
-+
-+	/* Start with max_tp_rate */
-+	minstrel_set_rate(mi, ratetbl, i++, mi->max_tp_rate[0]);
-+
-+	if (mp->hw->max_rates >= 3) {
-+		/* At least 3 tx rates supported, use max_tp_rate2 next */
-+		minstrel_set_rate(mi, ratetbl, i++, mi->max_tp_rate[1]);
-+	}
-+
-+	if (mp->hw->max_rates >= 2) {
-+		/* At least 2 tx rates supported, use max_prob_rate next */
-+		minstrel_set_rate(mi, ratetbl, i++, mi->max_prob_rate);
-+	}
-+
-+	/* Use lowest rate last */
-+	ratetbl->rate[i].idx = mi->lowest_rix;
-+	ratetbl->rate[i].count = mp->max_retry;
-+	ratetbl->rate[i].count_cts = mp->max_retry;
-+	ratetbl->rate[i].count_rts = mp->max_retry;
-+
-+	rate_control_set_rates(mp->hw, mi->sta, ratetbl);
-+}
-+
-+static void
- minstrel_update_stats(struct minstrel_priv *mp, struct minstrel_sta_info *mi)
- {
- 	u8 tmp_tp_rate[MAX_THR_RATES];
-@@ -161,6 +205,8 @@ minstrel_update_stats(struct minstrel_pr
- 
- 	/* Reset update timer */
- 	mi->stats_update = jiffies;
-+
-+	minstrel_update_rates(mp, mi);
- }
- 
- static void
-@@ -209,9 +255,9 @@ minstrel_get_retry_count(struct minstrel
- {
- 	unsigned int retry = mr->adjusted_retry_count;
- 
--	if (info->control.rates[0].flags & IEEE80211_TX_RC_USE_RTS_CTS)
-+	if (info->control.use_rts)
- 		retry = max(2U, min(mr->retry_count_rtscts, retry));
--	else if (info->control.rates[0].flags & IEEE80211_TX_RC_USE_CTS_PROTECT)
-+	else if (info->control.use_cts_prot)
- 		retry = max(2U, min(mr->retry_count_cts, retry));
- 	return retry;
- }
-@@ -240,13 +286,12 @@ minstrel_get_rate(void *priv, struct iee
- 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
- 	struct minstrel_sta_info *mi = priv_sta;
- 	struct minstrel_priv *mp = priv;
--	struct ieee80211_tx_rate *ar = info->control.rates;
--	unsigned int ndx, sample_ndx = 0;
-+	struct ieee80211_tx_rate *rate = &info->control.rates[0];
-+	struct minstrel_rate *msr, *mr;
-+	unsigned int ndx;
- 	bool mrr_capable;
--	bool indirect_rate_sampling = false;
--	bool rate_sampling = false;
--	int i, delta;
--	int mrr_ndx[3];
-+	bool prev_sample = mi->prev_sample;
-+	int delta;
- 	int sampling_ratio;
- 
- 	/* management/no-ack frames do not use rate control */
-@@ -262,107 +307,75 @@ minstrel_get_rate(void *priv, struct iee
- 	else
- 		sampling_ratio = mp->lookaround_rate;
- 
--	/* init rateindex [ndx] with max throughput rate */
--	ndx = mi->max_tp_rate[0];
--
- 	/* increase sum packet counter */
- 	mi->packet_count++;
- 
- 	delta = (mi->packet_count * sampling_ratio / 100) -
- 			(mi->sample_count + mi->sample_deferred / 2);
- 
--	/* delta > 0: sampling required */
--	if ((delta > 0) && (mrr_capable || !mi->prev_sample)) {
--		struct minstrel_rate *msr;
--		if (mi->packet_count >= 10000) {
--			mi->sample_deferred = 0;
--			mi->sample_count = 0;
--			mi->packet_count = 0;
--		} else if (delta > mi->n_rates * 2) {
--			/* With multi-rate retry, not every planned sample
--			 * attempt actually gets used, due to the way the retry
--			 * chain is set up - [max_tp,sample,prob,lowest] for
--			 * sample_rate < max_tp.
--			 *
--			 * If there's too much sampling backlog and the link
--			 * starts getting worse, minstrel would start bursting
--			 * out lots of sampling frames, which would result
--			 * in a large throughput loss. */
--			mi->sample_count += (delta - mi->n_rates * 2);
--		}
-+	/* delta < 0: no sampling required */
-+	mi->prev_sample = false;
-+	if (delta < 0 || (!mrr_capable && prev_sample))
-+		return;
- 
--		/* get next random rate sample */
--		sample_ndx = minstrel_get_next_sample(mi);
--		msr = &mi->r[sample_ndx];
--		rate_sampling = true;
--
--		/* Decide if direct ( 1st mrr stage) or indirect (2nd mrr stage)
--		 * rate sampling method should be used.
--		 * Respect such rates that are not sampled for 20 interations.
--		 */
--		if (mrr_capable &&
--		    msr->perfect_tx_time > mi->r[ndx].perfect_tx_time &&
--		    msr->sample_skipped < 20)
--				indirect_rate_sampling = true;
--
--		if (!indirect_rate_sampling) {
--			if (msr->sample_limit != 0) {
--				ndx = sample_ndx;
--				mi->sample_count++;
--				if (msr->sample_limit > 0)
--					msr->sample_limit--;
--			} else
--				rate_sampling = false;
--		} else {
--			/* Only use IEEE80211_TX_CTL_RATE_CTRL_PROBE to mark
--			 * packets that have the sampling rate deferred to the
--			 * second MRR stage. Increase the sample counter only
--			 * if the deferred sample rate was actually used.
--			 * Use the sample_deferred counter to make sure that
--			 * the sampling is not done in large bursts */
--			info->flags |= IEEE80211_TX_CTL_RATE_CTRL_PROBE;
--			mi->sample_deferred++;
--		}
-+	if (mi->packet_count >= 10000) {
-+		mi->sample_deferred = 0;
-+		mi->sample_count = 0;
-+		mi->packet_count = 0;
-+	} else if (delta > mi->n_rates * 2) {
-+		/* With multi-rate retry, not every planned sample
-+		 * attempt actually gets used, due to the way the retry
-+		 * chain is set up - [max_tp,sample,prob,lowest] for
-+		 * sample_rate < max_tp.
-+		 *
-+		 * If there's too much sampling backlog and the link
-+		 * starts getting worse, minstrel would start bursting
-+		 * out lots of sampling frames, which would result
-+		 * in a large throughput loss. */
-+		mi->sample_count += (delta - mi->n_rates * 2);
-+	}
-+
-+	/* get next random rate sample */
-+	ndx = minstrel_get_next_sample(mi);
-+	msr = &mi->r[ndx];
-+	mr = &mi->r[mi->max_tp_rate[0]];
-+
-+	/* Decide if direct ( 1st mrr stage) or indirect (2nd mrr stage)
-+	 * rate sampling method should be used.
-+	 * Respect such rates that are not sampled for 20 interations.
-+	 */
-+	if (mrr_capable &&
-+	    msr->perfect_tx_time > mr->perfect_tx_time &&
-+	    msr->sample_skipped < 20) {
-+		/* Only use IEEE80211_TX_CTL_RATE_CTRL_PROBE to mark
-+		 * packets that have the sampling rate deferred to the
-+		 * second MRR stage. Increase the sample counter only
-+		 * if the deferred sample rate was actually used.
-+		 * Use the sample_deferred counter to make sure that
-+		 * the sampling is not done in large bursts */
-+		info->flags |= IEEE80211_TX_CTL_RATE_CTRL_PROBE;
-+		rate++;
-+		mi->sample_deferred++;
-+	} else {
-+		if (!msr->sample_limit != 0)
-+			return;
-+
-+		mi->sample_count++;
-+		if (msr->sample_limit > 0)
-+			msr->sample_limit--;
- 	}
--	mi->prev_sample = rate_sampling;
- 
- 	/* If we're not using MRR and the sampling rate already
- 	 * has a probability of >95%, we shouldn't be attempting
- 	 * to use it, as this only wastes precious airtime */
--	if (!mrr_capable && rate_sampling &&
-+	if (!mrr_capable &&
- 	   (mi->r[ndx].probability > MINSTREL_FRAC(95, 100)))
--		ndx = mi->max_tp_rate[0];
--
--	/* mrr setup for 1st stage */
--	ar[0].idx = mi->r[ndx].rix;
--	ar[0].count = minstrel_get_retry_count(&mi->r[ndx], info);
--
--	/* non mrr setup for 2nd stage */
--	if (!mrr_capable) {
--		if (!rate_sampling)
--			ar[0].count = mp->max_retry;
--		ar[1].idx = mi->lowest_rix;
--		ar[1].count = mp->max_retry;
- 		return;
--	}
- 
--	/* mrr setup for 2nd stage */
--	if (rate_sampling) {
--		if (indirect_rate_sampling)
--			mrr_ndx[0] = sample_ndx;
--		else
--			mrr_ndx[0] = mi->max_tp_rate[0];
--	} else {
--		mrr_ndx[0] = mi->max_tp_rate[1];
--	}
-+	mi->prev_sample = true;
- 
--	/* mrr setup for 3rd & 4th stage */
--	mrr_ndx[1] = mi->max_prob_rate;
--	mrr_ndx[2] = 0;
--	for (i = 1; i < 4; i++) {
--		ar[i].idx = mi->r[mrr_ndx[i - 1]].rix;
--		ar[i].count = mi->r[mrr_ndx[i - 1]].adjusted_retry_count;
--	}
-+	rate->idx = mi->r[ndx].rix;
-+	rate->count = minstrel_get_retry_count(&mi->r[ndx], info);
- }
- 
- 
-@@ -412,12 +425,16 @@ minstrel_rate_init(void *priv, struct ie
- 	unsigned int i, n = 0;
- 	unsigned int t_slot = 9; /* FIXME: get real slot time */
- 
-+	mi->sta = sta;
- 	mi->lowest_rix = rate_lowest_index(sband, sta);
- 	ctl_rate = &sband->bitrates[mi->lowest_rix];
- 	mi->sp_ack_dur = ieee80211_frame_duration(sband->band, 10,
- 				ctl_rate->bitrate,
- 				!!(ctl_rate->flags & IEEE80211_RATE_ERP_G), 1);
- 
-+	memset(mi->max_tp_rate, 0, sizeof(mi->max_tp_rate));
-+	mi->max_prob_rate = 0;
-+
- 	for (i = 0; i < sband->n_bitrates; i++) {
- 		struct minstrel_rate *mr = &mi->r[n];
- 		unsigned int tx_time = 0, tx_time_cts = 0, tx_time_rtscts = 0;
-@@ -460,6 +477,8 @@ minstrel_rate_init(void *priv, struct ie
- 		} while ((tx_time < mp->segment_size) &&
- 				(++mr->retry_count < mp->max_retry));
- 		mr->adjusted_retry_count = mr->retry_count;
-+		if (!(sband->bitrates[i].flags & IEEE80211_RATE_ERP_G))
-+			mr->retry_count_cts = mr->retry_count;
- 	}
- 
- 	for (i = n; i < sband->n_bitrates; i++) {
-@@ -471,6 +490,7 @@ minstrel_rate_init(void *priv, struct ie
- 	mi->stats_update = jiffies;
- 
- 	init_sample_table(mi);
-+	minstrel_update_rates(mp, mi);
- }
- 
- static void *
---- a/net/mac80211/rc80211_minstrel.h
-+++ b/net/mac80211/rc80211_minstrel.h
-@@ -9,7 +9,8 @@
- #ifndef __RC_MINSTREL_H
- #define __RC_MINSTREL_H
- 
--#define EWMA_LEVEL	75	/* ewma weighting factor [%] */
-+#define EWMA_LEVEL	96	/* ewma weighting factor [/EWMA_DIV] */
-+#define EWMA_DIV	128
- #define SAMPLE_COLUMNS	10	/* number of columns in sample table */
- 
- 
-@@ -27,7 +28,7 @@
- static inline int
- minstrel_ewma(int old, int new, int weight)
- {
--	return (new * (100 - weight) + old * weight) / 100;
-+	return (new * (EWMA_DIV - weight) + old * weight) / EWMA_DIV;
- }
- 
- 
-@@ -62,6 +63,8 @@ struct minstrel_rate {
- };
- 
- struct minstrel_sta_info {
-+	struct ieee80211_sta *sta;
-+
- 	unsigned long stats_update;
- 	unsigned int sp_ack_dur;
- 	unsigned int rate_avg;
---- a/net/mac80211/rc80211_minstrel_debugfs.c
-+++ b/net/mac80211/rc80211_minstrel_debugfs.c
-@@ -68,7 +68,7 @@ minstrel_stats_open(struct inode *inode,
- 
- 	file->private_data = ms;
- 	p = ms->buf;
--	p += sprintf(p, "rate     throughput  ewma prob   this prob  "
-+	p += sprintf(p, "rate      throughput  ewma prob  this prob  "
- 			"this succ/attempt   success    attempts\n");
- 	for (i = 0; i < mi->n_rates; i++) {
- 		struct minstrel_rate *mr = &mi->r[i];
-@@ -86,7 +86,7 @@ minstrel_stats_open(struct inode *inode,
- 		eprob = MINSTREL_TRUNC(mr->probability * 1000);
- 
- 		p += sprintf(p, "  %6u.%1u   %6u.%1u   %6u.%1u        "
--				"%3u(%3u)   %8llu    %8llu\n",
-+				"   %3u(%3u)  %8llu    %8llu\n",
- 				tp / 10, tp % 10,
- 				eprob / 10, eprob % 10,
- 				prob / 10, prob % 10,
---- a/net/mac80211/rc80211_minstrel_ht.c
-+++ b/net/mac80211/rc80211_minstrel_ht.c
-@@ -126,6 +126,9 @@ const struct mcs_group minstrel_mcs_grou
- 
- static u8 sample_table[SAMPLE_COLUMNS][MCS_GROUP_RATES];
- 
-+static void
-+minstrel_ht_update_rates(struct minstrel_priv *mp, struct minstrel_ht_sta *mi);
-+
- /*
-  * Look up an MCS group index based on mac80211 rate information
-  */
-@@ -244,6 +247,7 @@ minstrel_ht_update_stats(struct minstrel
- 	struct minstrel_rate_stats *mr;
- 	int cur_prob, cur_prob_tp, cur_tp, cur_tp2;
- 	int group, i, index;
-+	bool mi_rates_valid = false;
- 
- 	if (mi->ampdu_packets > 0) {
- 		mi->avg_ampdu_len = minstrel_ewma(mi->avg_ampdu_len,
-@@ -254,11 +258,10 @@ minstrel_ht_update_stats(struct minstrel
- 
- 	mi->sample_slow = 0;
- 	mi->sample_count = 0;
--	mi->max_tp_rate = 0;
--	mi->max_tp_rate2 = 0;
--	mi->max_prob_rate = 0;
- 
- 	for (group = 0; group < ARRAY_SIZE(minstrel_mcs_groups); group++) {
-+		bool mg_rates_valid = false;
-+
- 		cur_prob = 0;
- 		cur_prob_tp = 0;
- 		cur_tp = 0;
-@@ -268,15 +271,24 @@ minstrel_ht_update_stats(struct minstrel
- 		if (!mg->supported)
- 			continue;
- 
--		mg->max_tp_rate = 0;
--		mg->max_tp_rate2 = 0;
--		mg->max_prob_rate = 0;
- 		mi->sample_count++;
- 
- 		for (i = 0; i < MCS_GROUP_RATES; i++) {
- 			if (!(mg->supported & BIT(i)))
- 				continue;
- 
-+			/* initialize rates selections starting indexes */
-+			if (!mg_rates_valid) {
-+				mg->max_tp_rate = mg->max_tp_rate2 =
-+					mg->max_prob_rate = i;
-+				if (!mi_rates_valid) {
-+					mi->max_tp_rate = mi->max_tp_rate2 =
-+						mi->max_prob_rate = i;
-+					mi_rates_valid = true;
-+				}
-+				mg_rates_valid = true;
-+			}
-+
- 			mr = &mg->rates[i];
- 			mr->retry_updated = false;
- 			index = MCS_GROUP_RATES * group + i;
-@@ -456,7 +468,7 @@ minstrel_ht_tx_status(void *priv, struct
- 	struct ieee80211_tx_rate *ar = info->status.rates;
- 	struct minstrel_rate_stats *rate, *rate2;
- 	struct minstrel_priv *mp = priv;
--	bool last;
-+	bool last, update = false;
- 	int i;
- 
- 	if (!msp->is_ht)
-@@ -505,21 +517,29 @@ minstrel_ht_tx_status(void *priv, struct
- 	rate = minstrel_get_ratestats(mi, mi->max_tp_rate);
- 	if (rate->attempts > 30 &&
- 	    MINSTREL_FRAC(rate->success, rate->attempts) <
--	    MINSTREL_FRAC(20, 100))
-+	    MINSTREL_FRAC(20, 100)) {
- 		minstrel_downgrade_rate(mi, &mi->max_tp_rate, true);
-+		update = true;
-+	}
- 
- 	rate2 = minstrel_get_ratestats(mi, mi->max_tp_rate2);
- 	if (rate2->attempts > 30 &&
- 	    MINSTREL_FRAC(rate2->success, rate2->attempts) <
--	    MINSTREL_FRAC(20, 100))
-+	    MINSTREL_FRAC(20, 100)) {
- 		minstrel_downgrade_rate(mi, &mi->max_tp_rate2, false);
-+		update = true;
-+	}
- 
- 	if (time_after(jiffies, mi->stats_update + (mp->update_interval / 2 * HZ) / 1000)) {
-+		update = true;
- 		minstrel_ht_update_stats(mp, mi);
- 		if (!(info->flags & IEEE80211_TX_CTL_AMPDU) &&
- 		    mi->max_prob_rate / MCS_GROUP_RATES != MINSTREL_CCK_GROUP)
- 			minstrel_aggr_check(sta, skb);
- 	}
-+
-+	if (update)
-+		minstrel_ht_update_rates(mp, mi);
- }
- 
- static void
-@@ -580,39 +600,73 @@ minstrel_calc_retransmit(struct minstrel
- 	         (++mr->retry_count < mp->max_retry));
- }
- 
--
- static void
- minstrel_ht_set_rate(struct minstrel_priv *mp, struct minstrel_ht_sta *mi,
--                     struct ieee80211_tx_rate *rate, int index,
--                     bool sample, bool rtscts)
-+                     struct ieee80211_sta_rates *ratetbl, int offset, int index)
- {
- 	const struct mcs_group *group = &minstrel_mcs_groups[index / MCS_GROUP_RATES];
- 	struct minstrel_rate_stats *mr;
-+	u8 idx;
-+	u16 flags;
- 
- 	mr = minstrel_get_ratestats(mi, index);
- 	if (!mr->retry_updated)
- 		minstrel_calc_retransmit(mp, mi, index);
- 
--	if (sample)
--		rate->count = 1;
--	else if (mr->probability < MINSTREL_FRAC(20, 100))
--		rate->count = 2;
--	else if (rtscts)
--		rate->count = mr->retry_count_rtscts;
--	else
--		rate->count = mr->retry_count;
--
--	rate->flags = 0;
--	if (rtscts)
--		rate->flags |= IEEE80211_TX_RC_USE_RTS_CTS;
-+	if (mr->probability < MINSTREL_FRAC(20, 100) || !mr->retry_count) {
-+		ratetbl->rate[offset].count = 2;
-+		ratetbl->rate[offset].count_rts = 2;
-+		ratetbl->rate[offset].count_cts = 2;
-+	} else {
-+		ratetbl->rate[offset].count = mr->retry_count;
-+		ratetbl->rate[offset].count_cts = mr->retry_count;
-+		ratetbl->rate[offset].count_rts = mr->retry_count_rtscts;
-+	}
- 
- 	if (index / MCS_GROUP_RATES == MINSTREL_CCK_GROUP) {
--		rate->idx = mp->cck_rates[index % ARRAY_SIZE(mp->cck_rates)];
-+		idx = mp->cck_rates[index % ARRAY_SIZE(mp->cck_rates)];
-+		flags = 0;
-+	} else {
-+		idx = index % MCS_GROUP_RATES +
-+		      (group->streams - 1) * MCS_GROUP_RATES;
-+		flags = IEEE80211_TX_RC_MCS | group->flags;
-+	}
-+
-+	if (offset > 0) {
-+		ratetbl->rate[offset].count = ratetbl->rate[offset].count_rts;
-+		flags |= IEEE80211_TX_RC_USE_RTS_CTS;
-+	}
-+
-+	ratetbl->rate[offset].idx = idx;
-+	ratetbl->rate[offset].flags = flags;
-+}
-+
-+static void
-+minstrel_ht_update_rates(struct minstrel_priv *mp, struct minstrel_ht_sta *mi)
-+{
-+	struct ieee80211_sta_rates *rates;
-+	int i = 0;
-+
-+	rates = kzalloc(sizeof(*rates), GFP_ATOMIC);
-+	if (!rates)
- 		return;
-+
-+	/* Start with max_tp_rate */
-+	minstrel_ht_set_rate(mp, mi, rates, i++, mi->max_tp_rate);
-+
-+	if (mp->hw->max_rates >= 3) {
-+		/* At least 3 tx rates supported, use max_tp_rate2 next */
-+		minstrel_ht_set_rate(mp, mi, rates, i++, mi->max_tp_rate2);
-+	}
-+
-+	if (mp->hw->max_rates >= 2) {
-+		/*
-+		 * At least 2 tx rates supported, use max_prob_rate next */
-+		minstrel_ht_set_rate(mp, mi, rates, i++, mi->max_prob_rate);
- 	}
- 
--	rate->flags |= IEEE80211_TX_RC_MCS | group->flags;
--	rate->idx = index % MCS_GROUP_RATES + (group->streams - 1) * MCS_GROUP_RATES;
-+	rates->rate[i].idx = -1;
-+	rate_control_set_rates(mp->hw, mi->sta, rates);
- }
- 
- static inline int
-@@ -702,13 +756,13 @@ static void
- minstrel_ht_get_rate(void *priv, struct ieee80211_sta *sta, void *priv_sta,
-                      struct ieee80211_tx_rate_control *txrc)
- {
-+	const struct mcs_group *sample_group;
- 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(txrc->skb);
--	struct ieee80211_tx_rate *ar = info->status.rates;
-+	struct ieee80211_tx_rate *rate = &info->status.rates[0];
- 	struct minstrel_ht_sta_priv *msp = priv_sta;
- 	struct minstrel_ht_sta *mi = &msp->ht;
- 	struct minstrel_priv *mp = priv;
- 	int sample_idx;
--	bool sample = false;
- 
- 	if (rate_control_send_low(sta, priv_sta, txrc))
- 		return;
-@@ -736,51 +790,6 @@ minstrel_ht_get_rate(void *priv, struct 
- 	}
- #endif
- 
--	if (sample_idx >= 0) {
--		sample = true;
--		minstrel_ht_set_rate(mp, mi, &ar[0], sample_idx,
--			true, false);
--		info->flags |= IEEE80211_TX_CTL_RATE_CTRL_PROBE;
--	} else {
--		minstrel_ht_set_rate(mp, mi, &ar[0], mi->max_tp_rate,
--			false, false);
--	}
--
--	if (mp->hw->max_rates >= 3) {
--		/*
--		 * At least 3 tx rates supported, use
--		 * sample_rate -> max_tp_rate -> max_prob_rate for sampling and
--		 * max_tp_rate -> max_tp_rate2 -> max_prob_rate by default.
--		 */
--		if (sample_idx >= 0)
--			minstrel_ht_set_rate(mp, mi, &ar[1], mi->max_tp_rate,
--				false, false);
--		else
--			minstrel_ht_set_rate(mp, mi, &ar[1], mi->max_tp_rate2,
--				false, true);
--
--		minstrel_ht_set_rate(mp, mi, &ar[2], mi->max_prob_rate,
--				     false, !sample);
--
--		ar[3].count = 0;
--		ar[3].idx = -1;
--	} else if (mp->hw->max_rates == 2) {
--		/*
--		 * Only 2 tx rates supported, use
--		 * sample_rate -> max_prob_rate for sampling and
--		 * max_tp_rate -> max_prob_rate by default.
--		 */
--		minstrel_ht_set_rate(mp, mi, &ar[1], mi->max_prob_rate,
--				     false, !sample);
--
--		ar[2].count = 0;
--		ar[2].idx = -1;
--	} else {
--		/* Not using MRR, only use the first rate */
--		ar[1].count = 0;
--		ar[1].idx = -1;
--	}
--
- 	mi->total_packets++;
- 
- 	/* wraparound */
-@@ -788,6 +797,16 @@ minstrel_ht_get_rate(void *priv, struct 
- 		mi->total_packets = 0;
- 		mi->sample_packets = 0;
- 	}
-+
-+	if (sample_idx < 0)
-+		return;
-+
-+	sample_group = &minstrel_mcs_groups[sample_idx / MCS_GROUP_RATES];
-+	info->flags |= IEEE80211_TX_CTL_RATE_CTRL_PROBE;
-+	rate->idx = sample_idx % MCS_GROUP_RATES +
-+		    (sample_group->streams - 1) * MCS_GROUP_RATES;
-+	rate->flags = IEEE80211_TX_RC_MCS | sample_group->flags;
-+	rate->count = 1;
- }
- 
- static void
-@@ -837,6 +856,8 @@ minstrel_ht_update_caps(void *priv, stru
- 
- 	msp->is_ht = true;
- 	memset(mi, 0, sizeof(*mi));
-+
-+	mi->sta = sta;
- 	mi->stats_update = jiffies;
- 
- 	ack_dur = ieee80211_frame_duration(sband->band, 10, 60, 1, 1);
-@@ -898,6 +919,9 @@ minstrel_ht_update_caps(void *priv, stru
- 	if (!n_supported)
- 		goto use_legacy;
- 
-+	minstrel_ht_update_stats(mp, mi);
-+	minstrel_ht_update_rates(mp, mi);
-+
- 	return;
- 
- use_legacy:
---- a/net/mac80211/rc80211_minstrel_ht.h
-+++ b/net/mac80211/rc80211_minstrel_ht.h
-@@ -65,6 +65,8 @@ struct minstrel_mcs_group_data {
- };
- 
- struct minstrel_ht_sta {
-+	struct ieee80211_sta *sta;
-+
- 	/* ampdu length (average, per sampling interval) */
- 	unsigned int ampdu_len;
- 	unsigned int ampdu_packets;
 --- a/net/mac80211/rx.c
 +++ b/net/mac80211/rx.c
-@@ -1372,6 +1372,7 @@ ieee80211_rx_h_sta_process(struct ieee80
- 	struct sk_buff *skb = rx->skb;
- 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
- 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
-+	int i;
- 
- 	if (!sta)
- 		return RX_CONTINUE;
-@@ -1422,6 +1423,19 @@ ieee80211_rx_h_sta_process(struct ieee80
- 		ewma_add(&sta->avg_signal, -status->signal);
- 	}
- 
-+	if (status->chains) {
-+		sta->chains = status->chains;
-+		for (i = 0; i < ARRAY_SIZE(status->chain_signal); i++) {
-+			int signal = status->chain_signal[i];
-+
-+			if (!(status->chains & BIT(i)))
-+				continue;
-+
-+			sta->chain_signal_last[i] = signal;
-+			ewma_add(&sta->chain_signal_avg[i], -signal);
-+		}
-+	}
-+
- 	/*
- 	 * Change STA power saving mode only at the end of a frame
- 	 * exchange sequence.
-@@ -2085,6 +2099,7 @@ ieee80211_rx_h_mesh_fwding(struct ieee80
- 	}
- 
- 	fwd_hdr =  (struct ieee80211_hdr *) fwd_skb->data;
-+	fwd_hdr->frame_control &= ~cpu_to_le16(IEEE80211_FCTL_RETRY);
- 	info = IEEE80211_SKB_CB(fwd_skb);
- 	memset(info, 0, sizeof(*info));
- 	info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
-@@ -2356,6 +2371,7 @@ ieee80211_rx_h_action(struct ieee80211_r
+@@ -2369,6 +2369,7 @@ ieee80211_rx_h_action(struct ieee80211_r
  		    sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
  		    sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
  		    sdata->vif.type != NL80211_IFTYPE_AP &&
@@ -3393,41 +208,7 @@
  		    sdata->vif.type != NL80211_IFTYPE_ADHOC)
  			break;
  
-@@ -2423,6 +2439,22 @@ ieee80211_rx_h_action(struct ieee80211_r
- 		}
- 
- 		break;
-+	case WLAN_CATEGORY_PUBLIC:
-+		if (len < IEEE80211_MIN_ACTION_SIZE + 1)
-+			goto invalid;
-+		if (sdata->vif.type != NL80211_IFTYPE_STATION)
-+			break;
-+		if (!rx->sta)
-+			break;
-+		if (!ether_addr_equal(mgmt->bssid, sdata->u.mgd.bssid))
-+			break;
-+		if (mgmt->u.action.u.ext_chan_switch.action_code !=
-+				WLAN_PUB_ACTION_EXT_CHANSW_ANN)
-+			break;
-+		if (len < offsetof(struct ieee80211_mgmt,
-+				   u.action.u.ext_chan_switch.variable))
-+			goto invalid;
-+		goto queue;
- 	case WLAN_CATEGORY_VHT:
- 		if (sdata->vif.type != NL80211_IFTYPE_STATION &&
- 		    sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
-@@ -2506,10 +2538,6 @@ ieee80211_rx_h_action(struct ieee80211_r
- 			ieee80211_process_measurement_req(sdata, mgmt, len);
- 			goto handled;
- 		case WLAN_ACTION_SPCT_CHL_SWITCH:
--			if (len < (IEEE80211_MIN_ACTION_SIZE +
--				   sizeof(mgmt->u.action.u.chan_switch)))
--				break;
--
- 			if (sdata->vif.type != NL80211_IFTYPE_STATION)
- 				break;
- 
-@@ -2695,14 +2723,15 @@ ieee80211_rx_h_mgmt(struct ieee80211_rx_
+@@ -2720,14 +2721,15 @@ ieee80211_rx_h_mgmt(struct ieee80211_rx_
  
  	if (!ieee80211_vif_is_mesh(&sdata->vif) &&
  	    sdata->vif.type != NL80211_IFTYPE_ADHOC &&
@@ -3445,17 +226,7 @@
  		break;
  	case cpu_to_le16(IEEE80211_STYPE_ASSOC_RESP):
  	case cpu_to_le16(IEEE80211_STYPE_REASSOC_RESP):
-@@ -3023,6 +3052,9 @@ static int prepare_for_handlers(struct i
- 			 * and location updates. Note that mac80211
- 			 * itself never looks at these frames.
- 			 */
-+			if (!multicast &&
-+			    !ether_addr_equal(sdata->vif.addr, hdr->addr1))
-+				return 0;
- 			if (ieee80211_is_public_action(hdr, skb->len))
- 				return 1;
- 			if (!ieee80211_is_beacon(hdr->frame_control))
-@@ -3031,10 +3063,16 @@ static int prepare_for_handlers(struct i
+@@ -3059,10 +3061,16 @@ static int prepare_for_handlers(struct i
  		}
  		break;
  	case NL80211_IFTYPE_WDS:
@@ -3474,17 +245,16 @@
  		break;
  	case NL80211_IFTYPE_P2P_DEVICE:
  		if (!ieee80211_is_public_action(hdr, skb->len) &&
---- a/net/mac80211/scan.c
-+++ b/net/mac80211/scan.c
-@@ -181,7 +181,7 @@ void ieee80211_scan_rx(struct ieee80211_
- 	if (baselen > skb->len)
- 		return;
- 
--	ieee802_11_parse_elems(elements, skb->len - baselen, &elems);
-+	ieee802_11_parse_elems(elements, skb->len - baselen, false, &elems);
- 
- 	channel = ieee80211_get_channel(local->hw.wiphy, rx_status->freq);
- 
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -149,6 +149,7 @@ static void cleanup_single_sta(struct st
+ 	 * directly by station destruction.
+ 	 */
+ 	for (i = 0; i < IEEE80211_NUM_TIDS; i++) {
++		kfree(sta->ampdu_mlme.tid_start_tx[i]);
+ 		tid_tx = rcu_dereference_raw(sta->ampdu_mlme.tid_tx[i]);
+ 		if (!tid_tx)
+ 			continue;
 --- a/net/mac80211/sta_info.h
 +++ b/net/mac80211/sta_info.h
 @@ -32,7 +32,6 @@
@@ -3503,1717 +273,11 @@
  	WLAN_STA_CLEAR_PS_FILT,
  	WLAN_STA_MFP,
  	WLAN_STA_BLOCK_BA,
-@@ -344,6 +342,11 @@ struct sta_info {
- 	int last_signal;
- 	struct ewma avg_signal;
- 	int last_ack_signal;
-+
-+	u8 chains;
-+	s8 chain_signal_last[IEEE80211_MAX_CHAINS];
-+	struct ewma chain_signal_avg[IEEE80211_MAX_CHAINS];
-+
- 	/* Plus 1 for non-QoS frames */
- 	__le16 last_seq_ctrl[IEEE80211_NUM_TIDS + 1];
- 
---- a/net/mac80211/trace.h
-+++ b/net/mac80211/trace.h
-@@ -990,23 +990,23 @@ TRACE_EVENT(drv_channel_switch,
- 
- 	TP_STRUCT__entry(
- 		LOCAL_ENTRY
-+		CHANDEF_ENTRY
- 		__field(u64, timestamp)
- 		__field(bool, block_tx)
--		__field(u16, freq)
- 		__field(u8, count)
- 	),
- 
- 	TP_fast_assign(
- 		LOCAL_ASSIGN;
-+		CHANDEF_ASSIGN(&ch_switch->chandef)
- 		__entry->timestamp = ch_switch->timestamp;
- 		__entry->block_tx = ch_switch->block_tx;
--		__entry->freq = ch_switch->channel->center_freq;
- 		__entry->count = ch_switch->count;
- 	),
- 
- 	TP_printk(
--		LOCAL_PR_FMT " new freq:%u count:%d",
--		LOCAL_PR_ARG, __entry->freq, __entry->count
-+		LOCAL_PR_FMT " new " CHANDEF_PR_FMT " count:%d",
-+		LOCAL_PR_ARG, CHANDEF_PR_ARG, __entry->count
- 	)
- );
- 
---- a/net/mac80211/tx.c
-+++ b/net/mac80211/tx.c
-@@ -48,15 +48,15 @@ static __le16 ieee80211_duration(struct 
- 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
- 
- 	/* assume HW handles this */
--	if (info->control.rates[0].flags & IEEE80211_TX_RC_MCS)
-+	if (tx->rate.flags & IEEE80211_TX_RC_MCS)
- 		return 0;
- 
- 	/* uh huh? */
--	if (WARN_ON_ONCE(info->control.rates[0].idx < 0))
-+	if (WARN_ON_ONCE(tx->rate.idx < 0))
- 		return 0;
- 
- 	sband = local->hw.wiphy->bands[info->band];
--	txrate = &sband->bitrates[info->control.rates[0].idx];
-+	txrate = &sband->bitrates[tx->rate.idx];
- 
- 	erp = txrate->flags & IEEE80211_RATE_ERP_G;
- 
-@@ -617,11 +617,9 @@ ieee80211_tx_h_rate_ctrl(struct ieee8021
- 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
- 	struct ieee80211_hdr *hdr = (void *)tx->skb->data;
- 	struct ieee80211_supported_band *sband;
--	struct ieee80211_rate *rate;
--	int i;
- 	u32 len;
--	bool inval = false, rts = false, short_preamble = false;
- 	struct ieee80211_tx_rate_control txrc;
-+	struct ieee80211_sta_rates *ratetbl = NULL;
- 	bool assoc = false;
- 
- 	memset(&txrc, 0, sizeof(txrc));
-@@ -642,18 +640,23 @@ ieee80211_tx_h_rate_ctrl(struct ieee8021
- 		txrc.max_rate_idx = -1;
- 	else
- 		txrc.max_rate_idx = fls(txrc.rate_idx_mask) - 1;
--	memcpy(txrc.rate_idx_mcs_mask,
--	       tx->sdata->rc_rateidx_mcs_mask[info->band],
--	       sizeof(txrc.rate_idx_mcs_mask));
-+
-+	if (tx->sdata->rc_has_mcs_mask[info->band])
-+		txrc.rate_idx_mcs_mask =
-+			tx->sdata->rc_rateidx_mcs_mask[info->band];
-+
- 	txrc.bss = (tx->sdata->vif.type == NL80211_IFTYPE_AP ||
- 		    tx->sdata->vif.type == NL80211_IFTYPE_MESH_POINT ||
- 		    tx->sdata->vif.type == NL80211_IFTYPE_ADHOC);
- 
- 	/* set up RTS protection if desired */
- 	if (len > tx->local->hw.wiphy->rts_threshold) {
--		txrc.rts = rts = true;
-+		txrc.rts = true;
- 	}
- 
-+	info->control.use_rts = txrc.rts;
-+	info->control.use_cts_prot = tx->sdata->vif.bss_conf.use_cts_prot;
-+
- 	/*
- 	 * Use short preamble if the BSS can handle it, but not for
- 	 * management frames unless we know the receiver can handle
-@@ -663,7 +666,9 @@ ieee80211_tx_h_rate_ctrl(struct ieee8021
- 	if (tx->sdata->vif.bss_conf.use_short_preamble &&
- 	    (ieee80211_is_data(hdr->frame_control) ||
- 	     (tx->sta && test_sta_flag(tx->sta, WLAN_STA_SHORT_PREAMBLE))))
--		txrc.short_preamble = short_preamble = true;
-+		txrc.short_preamble = true;
-+
-+	info->control.short_preamble = txrc.short_preamble;
- 
- 	if (tx->sta)
- 		assoc = test_sta_flag(tx->sta, WLAN_STA_ASSOC);
-@@ -687,16 +692,38 @@ ieee80211_tx_h_rate_ctrl(struct ieee8021
- 	 */
- 	rate_control_get_rate(tx->sdata, tx->sta, &txrc);
- 
--	if (unlikely(info->control.rates[0].idx < 0))
--		return TX_DROP;
-+	if (tx->sta && !info->control.skip_table)
-+		ratetbl = rcu_dereference(tx->sta->sta.rates);
-+
-+	if (unlikely(info->control.rates[0].idx < 0)) {
-+		if (ratetbl) {
-+			struct ieee80211_tx_rate rate = {
-+				.idx = ratetbl->rate[0].idx,
-+				.flags = ratetbl->rate[0].flags,
-+				.count = ratetbl->rate[0].count
-+			};
-+
-+			if (ratetbl->rate[0].idx < 0)
-+				return TX_DROP;
-+
-+			tx->rate = rate;
-+		} else {
-+			return TX_DROP;
-+		}
-+	} else {
-+		tx->rate = info->control.rates[0];
-+	}
- 
- 	if (txrc.reported_rate.idx < 0) {
--		txrc.reported_rate = info->control.rates[0];
-+		txrc.reported_rate = tx->rate;
- 		if (tx->sta && ieee80211_is_data(hdr->frame_control))
- 			tx->sta->last_tx_rate = txrc.reported_rate;
- 	} else if (tx->sta)
- 		tx->sta->last_tx_rate = txrc.reported_rate;
- 
-+	if (ratetbl)
-+		return TX_CONTINUE;
-+
- 	if (unlikely(!info->control.rates[0].count))
- 		info->control.rates[0].count = 1;
- 
-@@ -704,91 +731,6 @@ ieee80211_tx_h_rate_ctrl(struct ieee8021
- 			 (info->flags & IEEE80211_TX_CTL_NO_ACK)))
- 		info->control.rates[0].count = 1;
- 
--	if (is_multicast_ether_addr(hdr->addr1)) {
--		/*
--		 * XXX: verify the rate is in the basic rateset
--		 */
--		return TX_CONTINUE;
--	}
--
--	/*
--	 * set up the RTS/CTS rate as the fastest basic rate
--	 * that is not faster than the data rate
--	 *
--	 * XXX: Should this check all retry rates?
--	 */
--	if (!(info->control.rates[0].flags & IEEE80211_TX_RC_MCS)) {
--		s8 baserate = 0;
--
--		rate = &sband->bitrates[info->control.rates[0].idx];
--
--		for (i = 0; i < sband->n_bitrates; i++) {
--			/* must be a basic rate */
--			if (!(tx->sdata->vif.bss_conf.basic_rates & BIT(i)))
--				continue;
--			/* must not be faster than the data rate */
--			if (sband->bitrates[i].bitrate > rate->bitrate)
--				continue;
--			/* maximum */
--			if (sband->bitrates[baserate].bitrate <
--			     sband->bitrates[i].bitrate)
--				baserate = i;
--		}
--
--		info->control.rts_cts_rate_idx = baserate;
--	}
--
--	for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
--		/*
--		 * make sure there's no valid rate following
--		 * an invalid one, just in case drivers don't
--		 * take the API seriously to stop at -1.
--		 */
--		if (inval) {
--			info->control.rates[i].idx = -1;
--			continue;
--		}
--		if (info->control.rates[i].idx < 0) {
--			inval = true;
--			continue;
--		}
--
--		/*
--		 * For now assume MCS is already set up correctly, this
--		 * needs to be fixed.
--		 */
--		if (info->control.rates[i].flags & IEEE80211_TX_RC_MCS) {
--			WARN_ON(info->control.rates[i].idx > 76);
--			continue;
--		}
--
--		/* set up RTS protection if desired */
--		if (rts)
--			info->control.rates[i].flags |=
--				IEEE80211_TX_RC_USE_RTS_CTS;
--
--		/* RC is busted */
--		if (WARN_ON_ONCE(info->control.rates[i].idx >=
--				 sband->n_bitrates)) {
--			info->control.rates[i].idx = -1;
--			continue;
--		}
--
--		rate = &sband->bitrates[info->control.rates[i].idx];
--
--		/* set up short preamble */
--		if (short_preamble &&
--		    rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
--			info->control.rates[i].flags |=
--				IEEE80211_TX_RC_USE_SHORT_PREAMBLE;
--
--		/* set up G protection */
--		if (!rts && tx->sdata->vif.bss_conf.use_cts_prot &&
--		    rate->flags & IEEE80211_RATE_ERP_G)
--			info->control.rates[i].flags |=
--				IEEE80211_TX_RC_USE_CTS_PROTECT;
--	}
--
- 	return TX_CONTINUE;
- }
- 
-@@ -2508,8 +2450,6 @@ struct sk_buff *ieee80211_beacon_get_tim
- 		txrc.max_rate_idx = -1;
- 	else
- 		txrc.max_rate_idx = fls(txrc.rate_idx_mask) - 1;
--	memcpy(txrc.rate_idx_mcs_mask, sdata->rc_rateidx_mcs_mask[band],
--	       sizeof(txrc.rate_idx_mcs_mask));
- 	txrc.bss = true;
- 	rate_control_get_rate(sdata, NULL, &txrc);
- 
---- a/net/mac80211/util.c
-+++ b/net/mac80211/util.c
-@@ -485,7 +485,8 @@ int ieee80211_queue_stopped(struct ieee8
- 		return true;
- 
- 	spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
--	ret = !!local->queue_stop_reasons[queue];
-+	ret = test_bit(IEEE80211_QUEUE_STOP_REASON_DRIVER,
-+		       &local->queue_stop_reasons[queue]);
- 	spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
- 	return ret;
- }
-@@ -559,6 +560,9 @@ void ieee80211_iterate_active_interfaces
- 	list_for_each_entry(sdata, &local->interfaces, list) {
- 		switch (sdata->vif.type) {
- 		case NL80211_IFTYPE_MONITOR:
-+			if (!(sdata->u.mntr_flags & MONITOR_FLAG_ACTIVE))
-+				continue;
-+			break;
- 		case NL80211_IFTYPE_AP_VLAN:
- 			continue;
- 		default:
-@@ -597,6 +601,9 @@ void ieee80211_iterate_active_interfaces
- 	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
- 		switch (sdata->vif.type) {
- 		case NL80211_IFTYPE_MONITOR:
-+			if (!(sdata->u.mntr_flags & MONITOR_FLAG_ACTIVE))
-+				continue;
-+			break;
- 		case NL80211_IFTYPE_AP_VLAN:
- 			continue;
- 		default:
-@@ -660,7 +667,7 @@ void ieee80211_queue_delayed_work(struct
- }
- EXPORT_SYMBOL(ieee80211_queue_delayed_work);
- 
--u32 ieee802_11_parse_elems_crc(u8 *start, size_t len,
-+u32 ieee802_11_parse_elems_crc(u8 *start, size_t len, bool action,
- 			       struct ieee802_11_elems *elems,
- 			       u64 filter, u32 crc)
- {
-@@ -668,6 +675,7 @@ u32 ieee802_11_parse_elems_crc(u8 *start
- 	u8 *pos = start;
- 	bool calc_crc = filter != 0;
- 	DECLARE_BITMAP(seen_elems, 256);
-+	const u8 *ie;
- 
- 	bitmap_zero(seen_elems, 256);
- 	memset(elems, 0, sizeof(*elems));
-@@ -715,6 +723,12 @@ u32 ieee802_11_parse_elems_crc(u8 *start
- 		case WLAN_EID_COUNTRY:
- 		case WLAN_EID_PWR_CONSTRAINT:
- 		case WLAN_EID_TIMEOUT_INTERVAL:
-+		case WLAN_EID_SECONDARY_CHANNEL_OFFSET:
-+		case WLAN_EID_WIDE_BW_CHANNEL_SWITCH:
-+		/*
-+		 * not listing WLAN_EID_CHANNEL_SWITCH_WRAPPER -- it seems possible
-+		 * that if the content gets bigger it might be needed more than once
-+		 */
- 			if (test_bit(id, seen_elems)) {
- 				elems->parse_error = true;
- 				left -= elen;
-@@ -862,6 +876,48 @@ u32 ieee802_11_parse_elems_crc(u8 *start
- 			}
- 			elems->ch_switch_ie = (void *)pos;
- 			break;
-+		case WLAN_EID_EXT_CHANSWITCH_ANN:
-+			if (elen != sizeof(struct ieee80211_ext_chansw_ie)) {
-+				elem_parse_failed = true;
-+				break;
-+			}
-+			elems->ext_chansw_ie = (void *)pos;
-+			break;
-+		case WLAN_EID_SECONDARY_CHANNEL_OFFSET:
-+			if (elen != sizeof(struct ieee80211_sec_chan_offs_ie)) {
-+				elem_parse_failed = true;
-+				break;
-+			}
-+			elems->sec_chan_offs = (void *)pos;
-+			break;
-+		case WLAN_EID_WIDE_BW_CHANNEL_SWITCH:
-+			if (!action ||
-+			    elen != sizeof(*elems->wide_bw_chansw_ie)) {
-+				elem_parse_failed = true;
-+				break;
-+			}
-+			elems->wide_bw_chansw_ie = (void *)pos;
-+			break;
-+		case WLAN_EID_CHANNEL_SWITCH_WRAPPER:
-+			if (action) {
-+				elem_parse_failed = true;
-+				break;
-+			}
-+			/*
-+			 * This is a bit tricky, but as we only care about
-+			 * the wide bandwidth channel switch element, so
-+			 * just parse it out manually.
-+			 */
-+			ie = cfg80211_find_ie(WLAN_EID_WIDE_BW_CHANNEL_SWITCH,
-+					      pos, elen);
-+			if (ie) {
-+				if (ie[1] == sizeof(*elems->wide_bw_chansw_ie))
-+					elems->wide_bw_chansw_ie =
-+						(void *)(ie + 2);
-+				else
-+					elem_parse_failed = true;
-+			}
-+			break;
- 		case WLAN_EID_COUNTRY:
- 			elems->country_elem = pos;
- 			elems->country_elem_len = elen;
---- a/net/wireless/reg.c
-+++ b/net/wireless/reg.c
-@@ -857,7 +857,7 @@ static void handle_channel(struct wiphy 
- 			return;
- 
- 		REG_DBG_PRINT("Disabling freq %d MHz\n", chan->center_freq);
--		chan->flags = IEEE80211_CHAN_DISABLED;
-+		chan->flags |= IEEE80211_CHAN_DISABLED;
- 		return;
- 	}
- 
---- a/net/wireless/util.c
-+++ b/net/wireless/util.c
-@@ -1156,6 +1156,26 @@ int cfg80211_get_p2p_attr(const u8 *ies,
- }
- EXPORT_SYMBOL(cfg80211_get_p2p_attr);
- 
-+bool ieee80211_operating_class_to_band(u8 operating_class,
-+				       enum ieee80211_band *band)
-+{
-+	switch (operating_class) {
-+	case 112:
-+	case 115 ... 127:
-+		*band = IEEE80211_BAND_5GHZ;
-+		return true;
-+	case 81:
-+	case 82:
-+	case 83:
-+	case 84:
-+		*band = IEEE80211_BAND_2GHZ;
-+		return true;
-+	}
-+
-+	return false;
-+}
-+EXPORT_SYMBOL(ieee80211_operating_class_to_band);
-+
- int cfg80211_validate_beacon_int(struct cfg80211_registered_device *rdev,
- 				 u32 beacon_int)
- {
---- a/include/uapi/linux/nl80211.h
-+++ b/include/uapi/linux/nl80211.h
-@@ -1973,6 +1973,10 @@ enum nl80211_sta_bss_param {
-  * @NL80211_STA_INFO_PEER_PM: peer mesh STA link-specific power mode
-  * @NL80211_STA_INFO_NONPEER_PM: neighbor mesh STA power save mode towards
-  *	non-peer STA
-+ * @NL80211_STA_INFO_CHAIN_SIGNAL: per-chain signal strength of last PPDU
-+ *	Contains a nested array of signal strength attributes (u8, dBm)
-+ * @NL80211_STA_INFO_CHAIN_SIGNAL_AVG: per-chain signal strength average
-+ *	Same format as NL80211_STA_INFO_CHAIN_SIGNAL.
-  * @__NL80211_STA_INFO_AFTER_LAST: internal
-  * @NL80211_STA_INFO_MAX: highest possible station info attribute
+@@ -203,6 +201,7 @@ struct tid_ampdu_rx {
+  *	driver requested to close until the work for it runs
+  * @mtx: mutex to protect all TX data (except non-NULL assignments
+  *	to tid_tx[idx], which are protected by the sta spinlock)
++ *	tid_start_tx is also protected by sta->lock.
   */
-@@ -2002,6 +2006,8 @@ enum nl80211_sta_info {
- 	NL80211_STA_INFO_NONPEER_PM,
- 	NL80211_STA_INFO_RX_BYTES64,
- 	NL80211_STA_INFO_TX_BYTES64,
-+	NL80211_STA_INFO_CHAIN_SIGNAL,
-+	NL80211_STA_INFO_CHAIN_SIGNAL_AVG,
- 
- 	/* keep last */
- 	__NL80211_STA_INFO_AFTER_LAST,
-@@ -2395,6 +2401,8 @@ enum nl80211_survey_info {
-  * @NL80211_MNTR_FLAG_OTHER_BSS: disable BSSID filtering
-  * @NL80211_MNTR_FLAG_COOK_FRAMES: report frames after processing.
-  *	overrides all other flags.
-+ * @NL80211_MNTR_FLAG_ACTIVE: use the configured MAC address
-+ *	and ACK incoming unicast packets.
-  *
-  * @__NL80211_MNTR_FLAG_AFTER_LAST: internal use
-  * @NL80211_MNTR_FLAG_MAX: highest possible monitor flag
-@@ -2406,6 +2414,7 @@ enum nl80211_mntr_flags {
- 	NL80211_MNTR_FLAG_CONTROL,
- 	NL80211_MNTR_FLAG_OTHER_BSS,
- 	NL80211_MNTR_FLAG_COOK_FRAMES,
-+	NL80211_MNTR_FLAG_ACTIVE,
- 
- 	/* keep last */
- 	__NL80211_MNTR_FLAG_AFTER_LAST,
-@@ -3557,6 +3566,7 @@ enum nl80211_feature_flags {
- 	NL80211_FEATURE_ADVERTISE_CHAN_LIMITS		= 1 << 14,
- 	NL80211_FEATURE_FULL_AP_CLIENT_STATE		= 1 << 15,
- 	NL80211_FEATURE_USERSPACE_MPM			= 1 << 16,
-+	NL80211_FEATURE_ACTIVE_MONITOR			= 1 << 17,
- };
- 
- /**
---- a/net/mac80211/sta_info.c
-+++ b/net/mac80211/sta_info.c
-@@ -358,6 +358,8 @@ struct sta_info *sta_info_alloc(struct i
- 	do_posix_clock_monotonic_gettime(&uptime);
- 	sta->last_connected = uptime.tv_sec;
- 	ewma_init(&sta->avg_signal, 1024, 8);
-+	for (i = 0; i < ARRAY_SIZE(sta->chain_signal_avg); i++)
-+		ewma_init(&sta->chain_signal_avg[i], 1024, 8);
- 
- 	if (sta_prepare_rate_control(local, sta, gfp)) {
- 		kfree(sta);
-@@ -1130,6 +1132,7 @@ static void ieee80211_send_null_response
- 	 * ends the poll/service period.
- 	 */
- 	info->flags |= IEEE80211_TX_CTL_NO_PS_BUFFER |
-+		       IEEE80211_TX_CTL_PS_RESPONSE |
- 		       IEEE80211_TX_STATUS_EOSP |
- 		       IEEE80211_TX_CTL_REQ_TX_STATUS;
- 
-@@ -1267,7 +1270,8 @@ ieee80211_sta_ps_deliver_response(struct
- 			 * STA may still remain is PS mode after this frame
- 			 * exchange.
- 			 */
--			info->flags |= IEEE80211_TX_CTL_NO_PS_BUFFER;
-+			info->flags |= IEEE80211_TX_CTL_NO_PS_BUFFER |
-+				       IEEE80211_TX_CTL_PS_RESPONSE;
- 
- 			/*
- 			 * Use MoreData flag to indicate whether there are
---- a/net/wireless/nl80211.c
-+++ b/net/wireless/nl80211.c
-@@ -2270,6 +2270,7 @@ static const struct nla_policy mntr_flag
- 	[NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
- 	[NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
- 	[NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
-+	[NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
- };
- 
- static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
-@@ -2381,6 +2382,10 @@ static int nl80211_set_interface(struct 
- 		change = true;
- 	}
- 
-+	if (flags && (*flags & NL80211_MNTR_FLAG_ACTIVE) &&
-+	    !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
-+		return -EOPNOTSUPP;
-+
- 	if (change)
- 		err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
- 	else
-@@ -2438,6 +2443,11 @@ static int nl80211_new_interface(struct 
- 	err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
- 				  info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
- 				  &flags);
-+
-+	if (!err && (flags & NL80211_MNTR_FLAG_ACTIVE) &&
-+	    !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
-+		return -EOPNOTSUPP;
-+
- 	wdev = rdev_add_virtual_intf(rdev,
- 				nla_data(info->attrs[NL80211_ATTR_IFNAME]),
- 				type, err ? NULL : &flags, &params);
-@@ -3367,6 +3377,32 @@ static bool nl80211_put_sta_rate(struct 
- 	return true;
- }
- 
-+static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
-+			       int id)
-+{
-+	void *attr;
-+	int i = 0;
-+
-+	if (!mask)
-+		return true;
-+
-+	attr = nla_nest_start(msg, id);
-+	if (!attr)
-+		return false;
-+
-+	for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
-+		if (!(mask & BIT(i)))
-+			continue;
-+
-+		if (nla_put_u8(msg, i, signal[i]))
-+			return false;
-+	}
-+
-+	nla_nest_end(msg, attr);
-+
-+	return true;
-+}
-+
- static int nl80211_send_station(struct sk_buff *msg, u32 portid, u32 seq,
- 				int flags,
- 				struct cfg80211_registered_device *rdev,
-@@ -3402,7 +3438,7 @@ static int nl80211_send_station(struct s
- 			(u32)sinfo->rx_bytes))
- 		goto nla_put_failure;
- 	if ((sinfo->filled & (STATION_INFO_TX_BYTES |
--			      NL80211_STA_INFO_TX_BYTES64)) &&
-+			      STATION_INFO_TX_BYTES64)) &&
- 	    nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
- 			(u32)sinfo->tx_bytes))
- 		goto nla_put_failure;
-@@ -3438,6 +3474,18 @@ static int nl80211_send_station(struct s
- 	default:
- 		break;
- 	}
-+	if (sinfo->filled & STATION_INFO_CHAIN_SIGNAL) {
-+		if (!nl80211_put_signal(msg, sinfo->chains,
-+					sinfo->chain_signal,
-+					NL80211_STA_INFO_CHAIN_SIGNAL))
-+			goto nla_put_failure;
-+	}
-+	if (sinfo->filled & STATION_INFO_CHAIN_SIGNAL_AVG) {
-+		if (!nl80211_put_signal(msg, sinfo->chains,
-+					sinfo->chain_signal_avg,
-+					NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
-+			goto nla_put_failure;
-+	}
- 	if (sinfo->filled & STATION_INFO_TX_BITRATE) {
- 		if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
- 					  NL80211_STA_INFO_TX_BITRATE))
---- a/drivers/net/wireless/ath/ath9k/init.c
-+++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -433,6 +433,8 @@ static int ath9k_init_queues(struct ath_
- 	sc->config.cabqReadytime = ATH_CABQ_READY_TIME;
- 	ath_cabq_update(sc);
- 
-+	sc->tx.uapsdq = ath_txq_setup(sc, ATH9K_TX_QUEUE_UAPSD, 0);
-+
- 	for (i = 0; i < IEEE80211_NUM_ACS; i++) {
- 		sc->tx.txq_map[i] = ath_txq_setup(sc, ATH9K_TX_QUEUE_DATA, i);
- 		sc->tx.txq_map[i]->mac80211_qnum = i;
-@@ -768,7 +770,8 @@ void ath9k_set_hw_capab(struct ath_softc
- 		IEEE80211_HW_SUPPORTS_PS |
- 		IEEE80211_HW_PS_NULLFUNC_STACK |
- 		IEEE80211_HW_SPECTRUM_MGMT |
--		IEEE80211_HW_REPORTS_TX_ACK_STATUS;
-+		IEEE80211_HW_REPORTS_TX_ACK_STATUS |
-+		IEEE80211_HW_SUPPORTS_RC_TABLE;
- 
- 	if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_HT)
- 		 hw->flags |= IEEE80211_HW_AMPDU_AGGREGATION;
-@@ -776,6 +779,8 @@ void ath9k_set_hw_capab(struct ath_softc
- 	if (AR_SREV_9160_10_OR_LATER(sc->sc_ah) || ath9k_modparam_nohwcrypt)
- 		hw->flags |= IEEE80211_HW_MFP_CAPABLE;
- 
-+	hw->wiphy->features |= NL80211_FEATURE_ACTIVE_MONITOR;
-+
- 	hw->wiphy->interface_modes =
- 		BIT(NL80211_IFTYPE_P2P_GO) |
- 		BIT(NL80211_IFTYPE_P2P_CLIENT) |
---- a/drivers/net/wireless/ath/ath9k/xmit.c
-+++ b/drivers/net/wireless/ath/ath9k/xmit.c
-@@ -125,24 +125,6 @@ static void ath_tx_queue_tid(struct ath_
- 	list_add_tail(&ac->list, &txq->axq_acq);
- }
- 
--static void ath_tx_resume_tid(struct ath_softc *sc, struct ath_atx_tid *tid)
--{
--	struct ath_txq *txq = tid->ac->txq;
--
--	WARN_ON(!tid->paused);
--
--	ath_txq_lock(sc, txq);
--	tid->paused = false;
--
--	if (skb_queue_empty(&tid->buf_q))
--		goto unlock;
--
--	ath_tx_queue_tid(txq, tid);
--	ath_txq_schedule(sc, txq);
--unlock:
--	ath_txq_unlock_complete(sc, txq);
--}
--
- static struct ath_frame_info *get_frame_info(struct sk_buff *skb)
- {
- 	struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
-@@ -157,6 +139,13 @@ static void ath_send_bar(struct ath_atx_
- 			   seqno << IEEE80211_SEQ_SEQ_SHIFT);
- }
- 
-+static void ath_set_rates(struct ieee80211_vif *vif, struct ieee80211_sta *sta,
-+			  struct ath_buf *bf)
-+{
-+	ieee80211_get_tx_rates(vif, sta, bf->bf_mpdu, bf->rates,
-+			       ARRAY_SIZE(bf->rates));
-+}
-+
- static void ath_tx_flush_tid(struct ath_softc *sc, struct ath_atx_tid *tid)
- {
- 	struct ath_txq *txq = tid->ac->txq;
-@@ -189,15 +178,11 @@ static void ath_tx_flush_tid(struct ath_
- 			ath_tx_complete_buf(sc, bf, txq, &bf_head, &ts, 0);
- 			sendbar = true;
- 		} else {
-+			ath_set_rates(tid->an->vif, tid->an->sta, bf);
- 			ath_tx_send_normal(sc, txq, NULL, skb);
- 		}
- 	}
- 
--	if (tid->baw_head == tid->baw_tail) {
--		tid->state &= ~AGGR_ADDBA_COMPLETE;
--		tid->state &= ~AGGR_CLEANUP;
--	}
--
- 	if (sendbar) {
- 		ath_txq_unlock(sc, txq);
- 		ath_send_bar(tid, tid->seq_start);
-@@ -269,9 +254,7 @@ static void ath_tid_drain(struct ath_sof
- 
- 		list_add_tail(&bf->list, &bf_head);
- 
--		if (fi->retries)
--			ath_tx_update_baw(sc, tid, bf->bf_state.seqno);
--
-+		ath_tx_update_baw(sc, tid, bf->bf_state.seqno);
- 		ath_tx_complete_buf(sc, bf, txq, &bf_head, &ts, 0);
- 	}
- 
-@@ -407,7 +390,7 @@ static void ath_tx_complete_aggr(struct 
- 
- 	tx_info = IEEE80211_SKB_CB(skb);
- 
--	memcpy(rates, tx_info->control.rates, sizeof(rates));
-+	memcpy(rates, bf->rates, sizeof(rates));
- 
- 	retries = ts->ts_longretry + 1;
- 	for (i = 0; i < ts->ts_rateindex; i++)
-@@ -483,19 +466,19 @@ static void ath_tx_complete_aggr(struct 
- 		tx_info = IEEE80211_SKB_CB(skb);
- 		fi = get_frame_info(skb);
- 
--		if (ATH_BA_ISSET(ba, ATH_BA_INDEX(seq_st, seqno))) {
-+		if (!BAW_WITHIN(tid->seq_start, tid->baw_size, seqno)) {
-+			/*
-+			 * Outside of the current BlockAck window,
-+			 * maybe part of a previous session
-+			 */
-+			txfail = 1;
-+		} else if (ATH_BA_ISSET(ba, ATH_BA_INDEX(seq_st, seqno))) {
- 			/* transmit completion, subframe is
- 			 * acked by block ack */
- 			acked_cnt++;
- 		} else if (!isaggr && txok) {
- 			/* transmit completion */
- 			acked_cnt++;
--		} else if (tid->state & AGGR_CLEANUP) {
--			/*
--			 * cleanup in progress, just fail
--			 * the un-acked sub-frames
--			 */
--			txfail = 1;
- 		} else if (flush) {
- 			txpending = 1;
- 		} else if (fi->retries < ATH_MAX_SW_RETRIES) {
-@@ -519,7 +502,7 @@ static void ath_tx_complete_aggr(struct 
- 		if (bf_next != NULL || !bf_last->bf_stale)
- 			list_move_tail(&bf->list, &bf_head);
- 
--		if (!txpending || (tid->state & AGGR_CLEANUP)) {
-+		if (!txpending) {
- 			/*
- 			 * complete the acked-ones/xretried ones; update
- 			 * block-ack window
-@@ -535,6 +518,10 @@ static void ath_tx_complete_aggr(struct 
- 			ath_tx_complete_buf(sc, bf, txq, &bf_head, ts,
- 				!txfail);
- 		} else {
-+			if (tx_info->flags & IEEE80211_TX_STATUS_EOSP) {
-+				tx_info->flags &= ~IEEE80211_TX_STATUS_EOSP;
-+				ieee80211_sta_eosp(sta);
-+			}
- 			/* retry the un-acked ones */
- 			if (bf->bf_next == NULL && bf_last->bf_stale) {
- 				struct ath_buf *tbf;
-@@ -593,9 +580,6 @@ static void ath_tx_complete_aggr(struct 
- 		ath_txq_lock(sc, txq);
- 	}
- 
--	if (tid->state & AGGR_CLEANUP)
--		ath_tx_flush_tid(sc, tid);
--
- 	rcu_read_unlock();
- 
- 	if (needreset)
-@@ -612,6 +596,7 @@ static void ath_tx_process_buffer(struct
- 				  struct ath_tx_status *ts, struct ath_buf *bf,
- 				  struct list_head *bf_head)
- {
-+	struct ieee80211_tx_info *info;
- 	bool txok, flush;
- 
- 	txok = !(ts->ts_status & ATH9K_TXERR_MASK);
-@@ -623,8 +608,12 @@ static void ath_tx_process_buffer(struct
- 		txq->axq_ampdu_depth--;
- 
- 	if (!bf_isampdu(bf)) {
--		if (!flush)
-+		if (!flush) {
-+			info = IEEE80211_SKB_CB(bf->bf_mpdu);
-+			memcpy(info->control.rates, bf->rates,
-+			       sizeof(info->control.rates));
- 			ath_tx_rc_status(sc, bf, ts, 1, txok ? 0 : 1, txok);
-+		}
- 		ath_tx_complete_buf(sc, bf, txq, bf_head, ts, txok);
- 	} else
- 		ath_tx_complete_aggr(sc, txq, bf, bf_head, ts, txok);
-@@ -668,7 +657,7 @@ static u32 ath_lookup_rate(struct ath_so
- 
- 	skb = bf->bf_mpdu;
- 	tx_info = IEEE80211_SKB_CB(skb);
--	rates = tx_info->control.rates;
-+	rates = bf->rates;
- 
- 	/*
- 	 * Find the lowest frame length among the rate series that will have a
-@@ -736,8 +725,6 @@ static int ath_compute_num_delims(struct
- 				  bool first_subfrm)
- {
- #define FIRST_DESC_NDELIMS 60
--	struct sk_buff *skb = bf->bf_mpdu;
--	struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
- 	u32 nsymbits, nsymbols;
- 	u16 minlen;
- 	u8 flags, rix;
-@@ -778,8 +765,8 @@ static int ath_compute_num_delims(struct
- 	if (tid->an->mpdudensity == 0)
- 		return ndelim;
- 
--	rix = tx_info->control.rates[0].idx;
--	flags = tx_info->control.rates[0].flags;
-+	rix = bf->rates[0].idx;
-+	flags = bf->rates[0].flags;
- 	width = (flags & IEEE80211_TX_RC_40_MHZ_WIDTH) ? 1 : 0;
- 	half_gi = (flags & IEEE80211_TX_RC_SHORT_GI) ? 1 : 0;
- 
-@@ -803,25 +790,20 @@ static int ath_compute_num_delims(struct
- 	return ndelim;
- }
- 
--static enum ATH_AGGR_STATUS ath_tx_form_aggr(struct ath_softc *sc,
--					     struct ath_txq *txq,
--					     struct ath_atx_tid *tid,
--					     struct list_head *bf_q,
--					     int *aggr_len)
-+static struct ath_buf *
-+ath_tx_get_tid_subframe(struct ath_softc *sc, struct ath_txq *txq,
-+			struct ath_atx_tid *tid)
- {
--#define PADBYTES(_len) ((4 - ((_len) % 4)) % 4)
--	struct ath_buf *bf, *bf_first = NULL, *bf_prev = NULL;
--	int rl = 0, nframes = 0, ndelim, prev_al = 0;
--	u16 aggr_limit = 0, al = 0, bpad = 0,
--		al_delta, h_baw = tid->baw_size / 2;
--	enum ATH_AGGR_STATUS status = ATH_AGGR_DONE;
--	struct ieee80211_tx_info *tx_info;
- 	struct ath_frame_info *fi;
- 	struct sk_buff *skb;
-+	struct ath_buf *bf;
- 	u16 seqno;
- 
--	do {
-+	while (1) {
- 		skb = skb_peek(&tid->buf_q);
-+		if (!skb)
-+			break;
-+
- 		fi = get_frame_info(skb);
- 		bf = fi->bf;
- 		if (!fi->bf)
-@@ -837,10 +819,8 @@ static enum ATH_AGGR_STATUS ath_tx_form_
- 		seqno = bf->bf_state.seqno;
- 
- 		/* do not step over block-ack window */
--		if (!BAW_WITHIN(tid->seq_start, tid->baw_size, seqno)) {
--			status = ATH_AGGR_BAW_CLOSED;
-+		if (!BAW_WITHIN(tid->seq_start, tid->baw_size, seqno))
- 			break;
--		}
- 
- 		if (tid->bar_index > ATH_BA_INDEX(tid->seq_start, seqno)) {
- 			struct ath_tx_status ts = {};
-@@ -854,10 +834,45 @@ static enum ATH_AGGR_STATUS ath_tx_form_
- 			continue;
- 		}
- 
-+		bf->bf_next = NULL;
-+		bf->bf_lastbf = bf;
-+		return bf;
-+	}
-+
-+	return NULL;
-+}
-+
-+static enum ATH_AGGR_STATUS ath_tx_form_aggr(struct ath_softc *sc,
-+					     struct ath_txq *txq,
-+					     struct ath_atx_tid *tid,
-+					     struct list_head *bf_q,
-+					     int *aggr_len)
-+{
-+#define PADBYTES(_len) ((4 - ((_len) % 4)) % 4)
-+	struct ath_buf *bf, *bf_first = NULL, *bf_prev = NULL;
-+	int rl = 0, nframes = 0, ndelim, prev_al = 0;
-+	u16 aggr_limit = 0, al = 0, bpad = 0,
-+		al_delta, h_baw = tid->baw_size / 2;
-+	enum ATH_AGGR_STATUS status = ATH_AGGR_DONE;
-+	struct ieee80211_tx_info *tx_info;
-+	struct ath_frame_info *fi;
-+	struct sk_buff *skb;
-+
-+	do {
-+		bf = ath_tx_get_tid_subframe(sc, txq, tid);
-+		if (!bf) {
-+			status = ATH_AGGR_BAW_CLOSED;
-+			break;
-+		}
-+
-+		skb = bf->bf_mpdu;
-+		fi = get_frame_info(skb);
-+
- 		if (!bf_first)
- 			bf_first = bf;
- 
- 		if (!rl) {
-+			ath_set_rates(tid->an->vif, tid->an->sta, bf);
- 			aggr_limit = ath_lookup_rate(sc, bf, tid);
- 			rl = 1;
- 		}
-@@ -898,7 +913,7 @@ static enum ATH_AGGR_STATUS ath_tx_form_
- 
- 		/* link buffers of this frame to the aggregate */
- 		if (!fi->retries)
--			ath_tx_addto_baw(sc, tid, seqno);
-+			ath_tx_addto_baw(sc, tid, bf->bf_state.seqno);
- 		bf->bf_state.ndelim = ndelim;
- 
- 		__skb_unlink(skb, &tid->buf_q);
-@@ -998,14 +1013,14 @@ static void ath_buf_set_rate(struct ath_
- 
- 	skb = bf->bf_mpdu;
- 	tx_info = IEEE80211_SKB_CB(skb);
--	rates = tx_info->control.rates;
-+	rates = bf->rates;
- 	hdr = (struct ieee80211_hdr *)skb->data;
- 
- 	/* set dur_update_en for l-sig computation except for PS-Poll frames */
- 	info->dur_update = !ieee80211_is_pspoll(hdr->frame_control);
- 	info->rtscts_rate = fi->rtscts_rate;
- 
--	for (i = 0; i < 4; i++) {
-+	for (i = 0; i < ARRAY_SIZE(bf->rates); i++) {
- 		bool is_40, is_sgi, is_sp;
- 		int phy;
- 
-@@ -1106,10 +1121,8 @@ static void ath_tx_fill_desc(struct ath_
- 			     struct ath_txq *txq, int len)
- {
- 	struct ath_hw *ah = sc->sc_ah;
--	struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(bf->bf_mpdu);
--	struct ath_buf *bf_first = bf;
-+	struct ath_buf *bf_first = NULL;
- 	struct ath_tx_info info;
--	bool aggr = !!(bf->bf_state.bf_type & BUF_AGGR);
- 
- 	memset(&info, 0, sizeof(info));
- 	info.is_first = true;
-@@ -1117,24 +1130,11 @@ static void ath_tx_fill_desc(struct ath_
- 	info.txpower = MAX_RATE_POWER;
- 	info.qcu = txq->axq_qnum;
- 
--	info.flags = ATH9K_TXDESC_INTREQ;
--	if (tx_info->flags & IEEE80211_TX_CTL_NO_ACK)
--		info.flags |= ATH9K_TXDESC_NOACK;
--	if (tx_info->flags & IEEE80211_TX_CTL_LDPC)
--		info.flags |= ATH9K_TXDESC_LDPC;
--
--	ath_buf_set_rate(sc, bf, &info, len);
--
--	if (tx_info->flags & IEEE80211_TX_CTL_CLEAR_PS_FILT)
--		info.flags |= ATH9K_TXDESC_CLRDMASK;
--
--	if (bf->bf_state.bfs_paprd)
--		info.flags |= (u32) bf->bf_state.bfs_paprd << ATH9K_TXDESC_PAPRD_S;
--
--
- 	while (bf) {
- 		struct sk_buff *skb = bf->bf_mpdu;
-+		struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
- 		struct ath_frame_info *fi = get_frame_info(skb);
-+		bool aggr = !!(bf->bf_state.bf_type & BUF_AGGR);
- 
- 		info.type = get_hw_packet_type(skb);
- 		if (bf->bf_next)
-@@ -1142,6 +1142,26 @@ static void ath_tx_fill_desc(struct ath_
- 		else
- 			info.link = 0;
- 
-+		if (!bf_first) {
-+			bf_first = bf;
-+
-+			info.flags = ATH9K_TXDESC_INTREQ;
-+			if ((tx_info->flags & IEEE80211_TX_CTL_CLEAR_PS_FILT) ||
-+			    txq == sc->tx.uapsdq)
-+				info.flags |= ATH9K_TXDESC_CLRDMASK;
-+
-+			if (tx_info->flags & IEEE80211_TX_CTL_NO_ACK)
-+				info.flags |= ATH9K_TXDESC_NOACK;
-+			if (tx_info->flags & IEEE80211_TX_CTL_LDPC)
-+				info.flags |= ATH9K_TXDESC_LDPC;
-+
-+			if (bf->bf_state.bfs_paprd)
-+				info.flags |= (u32) bf->bf_state.bfs_paprd <<
-+					      ATH9K_TXDESC_PAPRD_S;
-+
-+			ath_buf_set_rate(sc, bf, &info, len);
-+		}
-+
- 		info.buf_addr[0] = bf->bf_buf_addr;
- 		info.buf_len[0] = skb->len;
- 		info.pkt_len = fi->framelen;
-@@ -1151,7 +1171,7 @@ static void ath_tx_fill_desc(struct ath_
- 		if (aggr) {
- 			if (bf == bf_first)
- 				info.aggr = AGGR_BUF_FIRST;
--			else if (!bf->bf_next)
-+			else if (bf == bf_first->bf_lastbf)
- 				info.aggr = AGGR_BUF_LAST;
- 			else
- 				info.aggr = AGGR_BUF_MIDDLE;
-@@ -1160,6 +1180,9 @@ static void ath_tx_fill_desc(struct ath_
- 			info.aggr_len = len;
- 		}
- 
-+		if (bf == bf_first->bf_lastbf)
-+			bf_first = NULL;
-+
- 		ath9k_hw_set_txdesc(ah, bf->bf_desc, &info);
- 		bf = bf->bf_next;
- 	}
-@@ -1224,9 +1247,6 @@ int ath_tx_aggr_start(struct ath_softc *
- 	an = (struct ath_node *)sta->drv_priv;
- 	txtid = ATH_AN_2_TID(an, tid);
- 
--	if (txtid->state & (AGGR_CLEANUP | AGGR_ADDBA_COMPLETE))
--		return -EAGAIN;
--
- 	/* update ampdu factor/density, they may have changed. This may happen
- 	 * in HT IBSS when a beacon with HT-info is received after the station
- 	 * has already been added.
-@@ -1238,7 +1258,7 @@ int ath_tx_aggr_start(struct ath_softc *
- 		an->mpdudensity = density;
- 	}
- 
--	txtid->state |= AGGR_ADDBA_PROGRESS;
-+	txtid->active = true;
- 	txtid->paused = true;
- 	*ssn = txtid->seq_start = txtid->seq_next;
- 	txtid->bar_index = -1;
-@@ -1255,28 +1275,9 @@ void ath_tx_aggr_stop(struct ath_softc *
- 	struct ath_atx_tid *txtid = ATH_AN_2_TID(an, tid);
- 	struct ath_txq *txq = txtid->ac->txq;
- 
--	if (txtid->state & AGGR_CLEANUP)
--		return;
--
--	if (!(txtid->state & AGGR_ADDBA_COMPLETE)) {
--		txtid->state &= ~AGGR_ADDBA_PROGRESS;
--		return;
--	}
--
- 	ath_txq_lock(sc, txq);
-+	txtid->active = false;
- 	txtid->paused = true;
--
--	/*
--	 * If frames are still being transmitted for this TID, they will be
--	 * cleaned up during tx completion. To prevent race conditions, this
--	 * TID can only be reused after all in-progress subframes have been
--	 * completed.
--	 */
--	if (txtid->baw_head != txtid->baw_tail)
--		txtid->state |= AGGR_CLEANUP;
--	else
--		txtid->state &= ~AGGR_ADDBA_COMPLETE;
--
- 	ath_tx_flush_tid(sc, txtid);
- 	ath_txq_unlock_complete(sc, txq);
- }
-@@ -1342,18 +1343,92 @@ void ath_tx_aggr_wakeup(struct ath_softc
- 	}
- }
- 
--void ath_tx_aggr_resume(struct ath_softc *sc, struct ieee80211_sta *sta, u16 tid)
-+void ath_tx_aggr_resume(struct ath_softc *sc, struct ieee80211_sta *sta,
-+			u16 tidno)
- {
--	struct ath_atx_tid *txtid;
-+	struct ath_atx_tid *tid;
- 	struct ath_node *an;
-+	struct ath_txq *txq;
- 
- 	an = (struct ath_node *)sta->drv_priv;
-+	tid = ATH_AN_2_TID(an, tidno);
-+	txq = tid->ac->txq;
- 
--	txtid = ATH_AN_2_TID(an, tid);
--	txtid->baw_size = IEEE80211_MIN_AMPDU_BUF << sta->ht_cap.ampdu_factor;
--	txtid->state |= AGGR_ADDBA_COMPLETE;
--	txtid->state &= ~AGGR_ADDBA_PROGRESS;
--	ath_tx_resume_tid(sc, txtid);
-+	ath_txq_lock(sc, txq);
-+
-+	tid->baw_size = IEEE80211_MIN_AMPDU_BUF << sta->ht_cap.ampdu_factor;
-+	tid->paused = false;
-+
-+	if (!skb_queue_empty(&tid->buf_q)) {
-+		ath_tx_queue_tid(txq, tid);
-+		ath_txq_schedule(sc, txq);
-+	}
-+
-+	ath_txq_unlock_complete(sc, txq);
-+}
-+
-+void ath9k_release_buffered_frames(struct ieee80211_hw *hw,
-+				   struct ieee80211_sta *sta,
-+				   u16 tids, int nframes,
-+				   enum ieee80211_frame_release_type reason,
-+				   bool more_data)
-+{
-+	struct ath_softc *sc = hw->priv;
-+	struct ath_node *an = (struct ath_node *)sta->drv_priv;
-+	struct ath_txq *txq = sc->tx.uapsdq;
-+	struct ieee80211_tx_info *info;
-+	struct list_head bf_q;
-+	struct ath_buf *bf_tail = NULL, *bf;
-+	int sent = 0;
-+	int i;
-+
-+	INIT_LIST_HEAD(&bf_q);
-+	for (i = 0; tids && nframes; i++, tids >>= 1) {
-+		struct ath_atx_tid *tid;
-+
-+		if (!(tids & 1))
-+			continue;
-+
-+		tid = ATH_AN_2_TID(an, i);
-+		if (tid->paused)
-+			continue;
-+
-+		ath_txq_lock(sc, tid->ac->txq);
-+		while (!skb_queue_empty(&tid->buf_q) && nframes > 0) {
-+			bf = ath_tx_get_tid_subframe(sc, sc->tx.uapsdq, tid);
-+			if (!bf)
-+				break;
-+
-+			__skb_unlink(bf->bf_mpdu, &tid->buf_q);
-+			list_add_tail(&bf->list, &bf_q);
-+			ath_set_rates(tid->an->vif, tid->an->sta, bf);
-+			ath_tx_addto_baw(sc, tid, bf->bf_state.seqno);
-+			bf->bf_state.bf_type &= ~BUF_AGGR;
-+			if (bf_tail)
-+				bf_tail->bf_next = bf;
-+
-+			bf_tail = bf;
-+			nframes--;
-+			sent++;
-+			TX_STAT_INC(txq->axq_qnum, a_queued_hw);
-+
-+			if (skb_queue_empty(&tid->buf_q))
-+				ieee80211_sta_set_buffered(an->sta, i, false);
-+		}
-+		ath_txq_unlock_complete(sc, tid->ac->txq);
-+	}
-+
-+	if (list_empty(&bf_q))
-+		return;
-+
-+	info = IEEE80211_SKB_CB(bf_tail->bf_mpdu);
-+	info->flags |= IEEE80211_TX_STATUS_EOSP;
-+
-+	bf = list_first_entry(&bf_q, struct ath_buf, list);
-+	ath_txq_lock(sc, txq);
-+	ath_tx_fill_desc(sc, bf, txq, 0);
-+	ath_tx_txqaddbuf(sc, txq, &bf_q, false);
-+	ath_txq_unlock(sc, txq);
- }
- 
- /********************/
-@@ -1709,8 +1784,9 @@ static void ath_tx_txqaddbuf(struct ath_
- 	}
- }
- 
--static void ath_tx_send_ampdu(struct ath_softc *sc, struct ath_atx_tid *tid,
--			      struct sk_buff *skb, struct ath_tx_control *txctl)
-+static void ath_tx_send_ampdu(struct ath_softc *sc, struct ath_txq *txq,
-+			      struct ath_atx_tid *tid, struct sk_buff *skb,
-+			      struct ath_tx_control *txctl)
- {
- 	struct ath_frame_info *fi = get_frame_info(skb);
- 	struct list_head bf_head;
-@@ -1723,26 +1799,28 @@ static void ath_tx_send_ampdu(struct ath
- 	 * - seqno is not within block-ack window
- 	 * - h/w queue depth exceeds low water mark
- 	 */
--	if (!skb_queue_empty(&tid->buf_q) || tid->paused ||
--	    !BAW_WITHIN(tid->seq_start, tid->baw_size, tid->seq_next) ||
--	    txctl->txq->axq_ampdu_depth >= ATH_AGGR_MIN_QDEPTH) {
-+	if ((!skb_queue_empty(&tid->buf_q) || tid->paused ||
-+	     !BAW_WITHIN(tid->seq_start, tid->baw_size, tid->seq_next) ||
-+	     txq->axq_ampdu_depth >= ATH_AGGR_MIN_QDEPTH) &&
-+	    txq != sc->tx.uapsdq) {
- 		/*
- 		 * Add this frame to software queue for scheduling later
- 		 * for aggregation.
- 		 */
--		TX_STAT_INC(txctl->txq->axq_qnum, a_queued_sw);
-+		TX_STAT_INC(txq->axq_qnum, a_queued_sw);
- 		__skb_queue_tail(&tid->buf_q, skb);
- 		if (!txctl->an || !txctl->an->sleeping)
--			ath_tx_queue_tid(txctl->txq, tid);
-+			ath_tx_queue_tid(txq, tid);
- 		return;
- 	}
- 
--	bf = ath_tx_setup_buffer(sc, txctl->txq, tid, skb);
-+	bf = ath_tx_setup_buffer(sc, txq, tid, skb);
- 	if (!bf) {
- 		ieee80211_free_txskb(sc->hw, skb);
- 		return;
- 	}
- 
-+	ath_set_rates(tid->an->vif, tid->an->sta, bf);
- 	bf->bf_state.bf_type = BUF_AMPDU;
- 	INIT_LIST_HEAD(&bf_head);
- 	list_add(&bf->list, &bf_head);
-@@ -1751,10 +1829,10 @@ static void ath_tx_send_ampdu(struct ath
- 	ath_tx_addto_baw(sc, tid, bf->bf_state.seqno);
- 
- 	/* Queue to h/w without aggregation */
--	TX_STAT_INC(txctl->txq->axq_qnum, a_queued_hw);
-+	TX_STAT_INC(txq->axq_qnum, a_queued_hw);
- 	bf->bf_lastbf = bf;
--	ath_tx_fill_desc(sc, bf, txctl->txq, fi->framelen);
--	ath_tx_txqaddbuf(sc, txctl->txq, &bf_head, false);
-+	ath_tx_fill_desc(sc, bf, txq, fi->framelen);
-+	ath_tx_txqaddbuf(sc, txq, &bf_head, false);
- }
- 
- static void ath_tx_send_normal(struct ath_softc *sc, struct ath_txq *txq,
-@@ -1892,62 +1970,16 @@ static struct ath_buf *ath_tx_setup_buff
- 	return bf;
- }
- 
--/* FIXME: tx power */
--static void ath_tx_start_dma(struct ath_softc *sc, struct sk_buff *skb,
--			     struct ath_tx_control *txctl)
--{
--	struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
--	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
--	struct ath_atx_tid *tid = NULL;
--	struct ath_buf *bf;
--	u8 tidno;
--
--	if (txctl->an && ieee80211_is_data_qos(hdr->frame_control)) {
--		tidno = ieee80211_get_qos_ctl(hdr)[0] &
--			IEEE80211_QOS_CTL_TID_MASK;
--		tid = ATH_AN_2_TID(txctl->an, tidno);
--
--		WARN_ON(tid->ac->txq != txctl->txq);
--	}
--
--	if ((tx_info->flags & IEEE80211_TX_CTL_AMPDU) && tid) {
--		/*
--		 * Try aggregation if it's a unicast data frame
--		 * and the destination is HT capable.
--		 */
--		ath_tx_send_ampdu(sc, tid, skb, txctl);
--	} else {
--		bf = ath_tx_setup_buffer(sc, txctl->txq, tid, skb);
--		if (!bf) {
--			if (txctl->paprd)
--				dev_kfree_skb_any(skb);
--			else
--				ieee80211_free_txskb(sc->hw, skb);
--			return;
--		}
--
--		bf->bf_state.bfs_paprd = txctl->paprd;
--
--		if (txctl->paprd)
--			bf->bf_state.bfs_paprd_timestamp = jiffies;
--
--		ath_tx_send_normal(sc, txctl->txq, tid, skb);
--	}
--}
--
--/* Upon failure caller should free skb */
--int ath_tx_start(struct ieee80211_hw *hw, struct sk_buff *skb,
--		 struct ath_tx_control *txctl)
-+static int ath_tx_prepare(struct ieee80211_hw *hw, struct sk_buff *skb,
-+			  struct ath_tx_control *txctl)
- {
- 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
- 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
- 	struct ieee80211_sta *sta = txctl->sta;
- 	struct ieee80211_vif *vif = info->control.vif;
- 	struct ath_softc *sc = hw->priv;
--	struct ath_txq *txq = txctl->txq;
--	int padpos, padsize;
- 	int frmlen = skb->len + FCS_LEN;
--	int q;
-+	int padpos, padsize;
- 
- 	/* NOTE:  sta can be NULL according to net/mac80211.h */
- 	if (sta)
-@@ -1968,6 +2000,11 @@ int ath_tx_start(struct ieee80211_hw *hw
- 		hdr->seq_ctrl |= cpu_to_le16(sc->tx.seq_no);
- 	}
- 
-+	if ((vif && vif->type != NL80211_IFTYPE_AP &&
-+	            vif->type != NL80211_IFTYPE_AP_VLAN) ||
-+	    !ieee80211_is_data(hdr->frame_control))
-+		info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT;
-+
- 	/* Add the padding after the header if this is not already done */
- 	padpos = ieee80211_hdrlen(hdr->frame_control);
- 	padsize = padpos & 3;
-@@ -1977,16 +2014,34 @@ int ath_tx_start(struct ieee80211_hw *hw
- 
- 		skb_push(skb, padsize);
- 		memmove(skb->data, skb->data + padsize, padpos);
--		hdr = (struct ieee80211_hdr *) skb->data;
- 	}
- 
--	if ((vif && vif->type != NL80211_IFTYPE_AP &&
--	            vif->type != NL80211_IFTYPE_AP_VLAN) ||
--	    !ieee80211_is_data(hdr->frame_control))
--		info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT;
--
- 	setup_frame_info(hw, sta, skb, frmlen);
-+	return 0;
-+}
- 
-+
-+/* Upon failure caller should free skb */
-+int ath_tx_start(struct ieee80211_hw *hw, struct sk_buff *skb,
-+		 struct ath_tx_control *txctl)
-+{
-+	struct ieee80211_hdr *hdr;
-+	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-+	struct ieee80211_sta *sta = txctl->sta;
-+	struct ieee80211_vif *vif = info->control.vif;
-+	struct ath_softc *sc = hw->priv;
-+	struct ath_txq *txq = txctl->txq;
-+	struct ath_atx_tid *tid = NULL;
-+	struct ath_buf *bf;
-+	u8 tidno;
-+	int q;
-+	int ret;
-+
-+	ret = ath_tx_prepare(hw, skb, txctl);
-+	if (ret)
-+	    return ret;
-+
-+	hdr = (struct ieee80211_hdr *) skb->data;
- 	/*
- 	 * At this point, the vif, hw_key and sta pointers in the tx control
- 	 * info are no longer valid (overwritten by the ath_frame_info data.
-@@ -2002,13 +2057,120 @@ int ath_tx_start(struct ieee80211_hw *hw
- 		txq->stopped = true;
- 	}
- 
--	ath_tx_start_dma(sc, skb, txctl);
-+	if (info->flags & IEEE80211_TX_CTL_PS_RESPONSE) {
-+		ath_txq_unlock(sc, txq);
-+		txq = sc->tx.uapsdq;
-+		ath_txq_lock(sc, txq);
-+	}
-+
-+	if (txctl->an && ieee80211_is_data_qos(hdr->frame_control)) {
-+		tidno = ieee80211_get_qos_ctl(hdr)[0] &
-+			IEEE80211_QOS_CTL_TID_MASK;
-+		tid = ATH_AN_2_TID(txctl->an, tidno);
-+
-+		WARN_ON(tid->ac->txq != txctl->txq);
-+	}
-+
-+	if ((info->flags & IEEE80211_TX_CTL_AMPDU) && tid) {
-+		/*
-+		 * Try aggregation if it's a unicast data frame
-+		 * and the destination is HT capable.
-+		 */
-+		ath_tx_send_ampdu(sc, txq, tid, skb, txctl);
-+		goto out;
-+	}
-+
-+	bf = ath_tx_setup_buffer(sc, txq, tid, skb);
-+	if (!bf) {
-+		if (txctl->paprd)
-+			dev_kfree_skb_any(skb);
-+		else
-+			ieee80211_free_txskb(sc->hw, skb);
-+		goto out;
-+	}
-+
-+	bf->bf_state.bfs_paprd = txctl->paprd;
- 
-+	if (txctl->paprd)
-+		bf->bf_state.bfs_paprd_timestamp = jiffies;
-+
-+	ath_set_rates(vif, sta, bf);
-+	ath_tx_send_normal(sc, txq, tid, skb);
-+
-+out:
- 	ath_txq_unlock(sc, txq);
- 
- 	return 0;
- }
- 
-+void ath_tx_cabq(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
-+		 struct sk_buff *skb)
-+{
-+	struct ath_softc *sc = hw->priv;
-+	struct ath_tx_control txctl = {
-+		.txq = sc->beacon.cabq
-+	};
-+	struct ath_tx_info info = {};
-+	struct ieee80211_hdr *hdr;
-+	struct ath_buf *bf_tail = NULL;
-+	struct ath_buf *bf;
-+	LIST_HEAD(bf_q);
-+	int duration = 0;
-+	int max_duration;
-+
-+	max_duration =
-+		sc->cur_beacon_conf.beacon_interval * 1000 *
-+		sc->cur_beacon_conf.dtim_period / ATH_BCBUF;
-+
-+	do {
-+		struct ath_frame_info *fi = get_frame_info(skb);
-+
-+		if (ath_tx_prepare(hw, skb, &txctl))
-+			break;
-+
-+		bf = ath_tx_setup_buffer(sc, txctl.txq, NULL, skb);
-+		if (!bf)
-+			break;
-+
-+		bf->bf_lastbf = bf;
-+		ath_set_rates(vif, NULL, bf);
-+		ath_buf_set_rate(sc, bf, &info, fi->framelen);
-+		duration += info.rates[0].PktDuration;
-+		if (bf_tail)
-+			bf_tail->bf_next = bf;
-+
-+		list_add_tail(&bf->list, &bf_q);
-+		bf_tail = bf;
-+		skb = NULL;
-+
-+		if (duration > max_duration)
-+			break;
-+
-+		skb = ieee80211_get_buffered_bc(hw, vif);
-+	} while(skb);
-+
-+	if (skb)
-+		ieee80211_free_txskb(hw, skb);
-+
-+	if (list_empty(&bf_q))
-+		return;
-+
-+	bf = list_first_entry(&bf_q, struct ath_buf, list);
-+	hdr = (struct ieee80211_hdr *) bf->bf_mpdu->data;
-+
-+	if (hdr->frame_control & IEEE80211_FCTL_MOREDATA) {
-+		hdr->frame_control &= ~IEEE80211_FCTL_MOREDATA;
-+		dma_sync_single_for_device(sc->dev, bf->bf_buf_addr,
-+			sizeof(*hdr), DMA_TO_DEVICE);
-+	}
-+
-+	ath_txq_lock(sc, txctl.txq);
-+	ath_tx_fill_desc(sc, bf, txctl.txq, 0);
-+	ath_tx_txqaddbuf(sc, txctl.txq, &bf_q, false);
-+	TX_STAT_INC(txctl.txq->axq_qnum, queued);
-+	ath_txq_unlock(sc, txctl.txq);
-+}
-+
- /*****************/
- /* TX Completion */
- /*****************/
-@@ -2054,7 +2216,12 @@ static void ath_tx_complete(struct ath_s
- 	}
- 	spin_unlock_irqrestore(&sc->sc_pm_lock, flags);
- 
-+	__skb_queue_tail(&txq->complete_q, skb);
-+
- 	q = skb_get_queue_mapping(skb);
-+	if (txq == sc->tx.uapsdq)
-+		txq = sc->tx.txq_map[q];
-+
- 	if (txq == sc->tx.txq_map[q]) {
- 		if (WARN_ON(--txq->pending_frames < 0))
- 			txq->pending_frames = 0;
-@@ -2065,8 +2232,6 @@ static void ath_tx_complete(struct ath_s
- 			txq->stopped = false;
- 		}
- 	}
--
--	__skb_queue_tail(&txq->complete_q, skb);
- }
- 
- static void ath_tx_complete_buf(struct ath_softc *sc, struct ath_buf *bf,
-@@ -2408,12 +2573,10 @@ void ath_tx_node_init(struct ath_softc *
- 		tid->baw_head  = tid->baw_tail = 0;
- 		tid->sched     = false;
- 		tid->paused    = false;
--		tid->state &= ~AGGR_CLEANUP;
-+		tid->active	   = false;
- 		__skb_queue_head_init(&tid->buf_q);
- 		acno = TID_TO_WME_AC(tidno);
- 		tid->ac = &an->ac[acno];
--		tid->state &= ~AGGR_ADDBA_COMPLETE;
--		tid->state &= ~AGGR_ADDBA_PROGRESS;
- 	}
- 
- 	for (acno = 0, ac = &an->ac[acno];
-@@ -2450,9 +2613,9 @@ void ath_tx_node_cleanup(struct ath_soft
- 		}
- 
- 		ath_tid_drain(sc, txq, tid);
--		tid->state &= ~AGGR_ADDBA_COMPLETE;
--		tid->state &= ~AGGR_CLEANUP;
-+		tid->active = false;
- 
- 		ath_txq_unlock(sc, txq);
- 	}
- }
-+
---- a/drivers/net/wireless/ath/ath9k/recv.c
-+++ b/drivers/net/wireless/ath/ath9k/recv.c
-@@ -124,7 +124,7 @@ static bool ath_rx_edma_buf_link(struct 
- 
- 	SKB_CB_ATHBUF(skb) = bf;
- 	ath9k_hw_addrxbuf_edma(ah, bf->bf_buf_addr, qtype);
--	skb_queue_tail(&rx_edma->rx_fifo, skb);
-+	__skb_queue_tail(&rx_edma->rx_fifo, skb);
- 
- 	return true;
- }
-@@ -155,7 +155,7 @@ static void ath_rx_remove_buffer(struct 
- 
- 	rx_edma = &sc->rx.rx_edma[qtype];
- 
--	while ((skb = skb_dequeue(&rx_edma->rx_fifo)) != NULL) {
-+	while ((skb = __skb_dequeue(&rx_edma->rx_fifo)) != NULL) {
- 		bf = SKB_CB_ATHBUF(skb);
- 		BUG_ON(!bf);
- 		list_add_tail(&bf->list, &sc->rx.rxbuf);
-@@ -1287,13 +1287,13 @@ int ath_rx_tasklet(struct ath_softc *sc,
- 			goto requeue_drop_frag;
- 		}
- 
--		bf->bf_mpdu = requeue_skb;
--		bf->bf_buf_addr = new_buf_addr;
--
- 		/* Unmap the frame */
- 		dma_unmap_single(sc->dev, bf->bf_buf_addr,
- 				 common->rx_bufsize, dma_type);
- 
-+		bf->bf_mpdu = requeue_skb;
-+		bf->bf_buf_addr = new_buf_addr;
-+
- 		skb_put(skb, rs.rs_datalen + ah->caps.rx_status_len);
- 		if (ah->caps.rx_status_len)
- 			skb_pull(skb, ah->caps.rx_status_len);
---- a/net/wireless/core.c
-+++ b/net/wireless/core.c
-@@ -885,7 +885,6 @@ void cfg80211_leave(struct cfg80211_regi
- #endif
- 		__cfg80211_disconnect(rdev, dev,
- 				      WLAN_REASON_DEAUTH_LEAVING, true);
--		cfg80211_mlme_down(rdev, dev);
- 		wdev_unlock(wdev);
- 		break;
- 	case NL80211_IFTYPE_MESH_POINT:
---- a/net/wireless/sme.c
-+++ b/net/wireless/sme.c
-@@ -961,7 +961,7 @@ int __cfg80211_disconnect(struct cfg8021
- 		/* was it connected by userspace SME? */
- 		if (!wdev->conn) {
- 			cfg80211_mlme_down(rdev, dev);
--			return 0;
-+			goto disconnect;
- 		}
- 
- 		if (wdev->sme_state == CFG80211_SME_CONNECTING &&
-@@ -987,6 +987,7 @@ int __cfg80211_disconnect(struct cfg8021
- 			return err;
- 	}
- 
-+ disconnect:
- 	if (wdev->sme_state == CFG80211_SME_CONNECTED)
- 		__cfg80211_disconnected(dev, NULL, 0, 0, false);
- 	else if (wdev->sme_state == CFG80211_SME_CONNECTING)
---- a/drivers/net/wireless/ath/ath9k/rc.c
-+++ b/drivers/net/wireless/ath/ath9k/rc.c
-@@ -1227,10 +1227,7 @@ static bool ath_tx_aggr_check(struct ath
- 		return false;
- 
- 	txtid = ATH_AN_2_TID(an, tidno);
--
--	if (!(txtid->state & (AGGR_ADDBA_COMPLETE | AGGR_ADDBA_PROGRESS)))
--			return true;
--	return false;
-+	return !txtid->active;
- }
- 
- 
---- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
-+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
-@@ -334,7 +334,8 @@ static void ar9003_hw_spur_ofdm(struct a
- 	REG_RMW_FIELD(ah, AR_PHY_SPUR_REG,
- 		      AR_PHY_SPUR_REG_EN_VIT_SPUR_RSSI, 1);
- 
--	if (REG_READ_FIELD(ah, AR_PHY_MODE,
-+	if (!AR_SREV_9340(ah) &&
-+	    REG_READ_FIELD(ah, AR_PHY_MODE,
- 			   AR_PHY_MODE_DYNAMIC) == 0x1)
- 		REG_RMW_FIELD(ah, AR_PHY_SPUR_REG,
- 			      AR_PHY_SPUR_REG_ENABLE_NF_RSSI_SPUR_MIT, 1);
---- a/drivers/net/wireless/ath/ath9k/mac.c
-+++ b/drivers/net/wireless/ath/ath9k/mac.c
-@@ -410,7 +410,7 @@ bool ath9k_hw_resettxqueue(struct ath_hw
- 
- 	REG_WRITE(ah, AR_QMISC(q), AR_Q_MISC_DCU_EARLY_TERM_REQ);
- 
--	if (AR_SREV_9340(ah))
-+	if (AR_SREV_9340(ah) && !AR_SREV_9340_13_OR_LATER(ah))
- 		REG_WRITE(ah, AR_DMISC(q),
- 			  AR_D_MISC_CW_BKOFF_EN | AR_D_MISC_FRAG_WAIT_EN | 0x1);
- 	else
---- a/net/mac80211/driver-ops.h
-+++ b/net/mac80211/driver-ops.h
-@@ -146,7 +146,8 @@ static inline int drv_add_interface(stru
- 
- 	if (WARN_ON(sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
- 		    (sdata->vif.type == NL80211_IFTYPE_MONITOR &&
--		     !(local->hw.flags & IEEE80211_HW_WANT_MONITOR_VIF))))
-+		     !(local->hw.flags & IEEE80211_HW_WANT_MONITOR_VIF) &&
-+		     !(sdata->u.mntr_flags & MONITOR_FLAG_ACTIVE))))
- 		return -EINVAL;
- 
- 	trace_drv_add_interface(local, sdata);
---- a/drivers/net/wireless/ath/ath9k/ar9003_paprd.c
-+++ b/drivers/net/wireless/ath/ath9k/ar9003_paprd.c
-@@ -454,6 +454,8 @@ static bool create_pa_curve(u32 *data_L,
- 		if (accum_cnt <= thresh_accum_cnt)
- 			continue;
- 
-+		max_index++;
-+
- 		/* sum(tx amplitude) */
- 		accum_tx = ((data_L[i] >> 16) & 0xffff) |
- 		    ((data_U[i] & 0x7ff) << 16);
-@@ -468,20 +470,21 @@ static bool create_pa_curve(u32 *data_L,
- 
- 		accum_tx <<= scale_factor;
- 		accum_rx <<= scale_factor;
--		x_est[i + 1] = (((accum_tx + accum_cnt) / accum_cnt) + 32) >>
--		    scale_factor;
-+		x_est[max_index] =
-+			(((accum_tx + accum_cnt) / accum_cnt) + 32) >>
-+			scale_factor;
- 
--		Y[i + 1] = ((((accum_rx + accum_cnt) / accum_cnt) + 32) >>
-+		Y[max_index] =
-+			((((accum_rx + accum_cnt) / accum_cnt) + 32) >>
- 			    scale_factor) +
--			    (1 << scale_factor) * max_index + 16;
-+			(1 << scale_factor) * i + 16;
- 
- 		if (accum_ang >= (1 << 26))
- 			accum_ang -= 1 << 27;
- 
--		theta[i + 1] = ((accum_ang * (1 << scale_factor)) + accum_cnt) /
--		    accum_cnt;
--
--		max_index++;
-+		theta[max_index] =
-+			((accum_ang * (1 << scale_factor)) + accum_cnt) /
-+			accum_cnt;
- 	}
- 
- 	/*
---- a/drivers/net/wireless/ath/ath9k/beacon.c
-+++ b/drivers/net/wireless/ath/ath9k/beacon.c
-@@ -107,23 +107,6 @@ static void ath9k_beacon_setup(struct at
- 	ath9k_hw_set_txdesc(ah, bf->bf_desc, &info);
- }
- 
--static void ath9k_tx_cabq(struct ieee80211_hw *hw, struct sk_buff *skb)
--{
--	struct ath_softc *sc = hw->priv;
--	struct ath_common *common = ath9k_hw_common(sc->sc_ah);
--	struct ath_tx_control txctl;
--
--	memset(&txctl, 0, sizeof(struct ath_tx_control));
--	txctl.txq = sc->beacon.cabq;
--
--	ath_dbg(common, XMIT, "transmitting CABQ packet, skb: %p\n", skb);
--
--	if (ath_tx_start(hw, skb, &txctl) != 0) {
--		ath_dbg(common, XMIT, "CABQ TX failed\n");
--		ieee80211_free_txskb(hw, skb);
--	}
--}
--
- static struct ath_buf *ath9k_beacon_generate(struct ieee80211_hw *hw,
- 					     struct ieee80211_vif *vif)
- {
-@@ -205,10 +188,8 @@ static struct ath_buf *ath9k_beacon_gene
- 
- 	ath9k_beacon_setup(sc, vif, bf, info->control.rates[0].idx);
- 
--	while (skb) {
--		ath9k_tx_cabq(hw, skb);
--		skb = ieee80211_get_buffered_bc(hw, vif);
--	}
-+	if (skb)
-+		ath_tx_cabq(hw, vif, skb);
- 
- 	return bf;
- }
---- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.h
-+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.h
-@@ -68,13 +68,16 @@
- #define AR9300_BASE_ADDR 0x3ff
- #define AR9300_BASE_ADDR_512 0x1ff
- 
--#define AR9300_OTP_BASE			(AR_SREV_9340(ah) ? 0x30000 : 0x14000)
--#define AR9300_OTP_STATUS		(AR_SREV_9340(ah) ? 0x30018 : 0x15f18)
-+#define AR9300_OTP_BASE \
-+		((AR_SREV_9340(ah) || AR_SREV_9550(ah)) ? 0x30000 : 0x14000)
-+#define AR9300_OTP_STATUS \
-+		((AR_SREV_9340(ah) || AR_SREV_9550(ah)) ? 0x30018 : 0x15f18)
- #define AR9300_OTP_STATUS_TYPE		0x7
- #define AR9300_OTP_STATUS_VALID		0x4
- #define AR9300_OTP_STATUS_ACCESS_BUSY	0x2
- #define AR9300_OTP_STATUS_SM_BUSY	0x1
--#define AR9300_OTP_READ_DATA		(AR_SREV_9340(ah) ? 0x3001c : 0x15f1c)
-+#define AR9300_OTP_READ_DATA \
-+		((AR_SREV_9340(ah) || AR_SREV_9550(ah)) ? 0x3001c : 0x15f1c)
- 
- enum targetPowerHTRates {
- 	HT_TARGET_RATE_0_8_16,
+ struct sta_ampdu_mlme {
+ 	struct mutex mtx;
diff --git a/package/mac80211/patches/310-ap_scan.patch b/package/mac80211/patches/310-ap_scan.patch
index 681bee24c7..d7479f2965 100644
--- a/package/mac80211/patches/310-ap_scan.patch
+++ b/package/mac80211/patches/310-ap_scan.patch
@@ -1,6 +1,6 @@
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -2081,7 +2081,7 @@ static int ieee80211_scan(struct wiphy *
+@@ -2092,7 +2092,7 @@ static int ieee80211_scan(struct wiphy *
  		 * the  frames sent while scanning on other channel will be
  		 * lost)
  		 */
diff --git a/package/mac80211/patches/400-ath_move_debug_code.patch b/package/mac80211/patches/400-ath_move_debug_code.patch
index c91128db61..a01db3ea9b 100644
--- a/package/mac80211/patches/400-ath_move_debug_code.patch
+++ b/package/mac80211/patches/400-ath_move_debug_code.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/Makefile
 +++ b/drivers/net/wireless/ath/Makefile
-@@ -10,7 +10,7 @@ obj-$(CONFIG_ATH_COMMON)	+= ath.o
+@@ -11,7 +11,7 @@ obj-$(CPTCFG_ATH_COMMON)	+= ath.o
  ath-objs :=	main.o \
  		regd.o \
  		hw.o \
@@ -8,15 +8,15 @@
 +		key.o \
 +		debug.o
  
--ath-$(CONFIG_ATH_DEBUG) += debug.o
+-ath-$(CPTCFG_ATH_DEBUG) += debug.o
  ccflags-y += -D__CHECK_ENDIAN__
 --- a/drivers/net/wireless/ath/ath.h
 +++ b/drivers/net/wireless/ath/ath.h
 @@ -281,13 +281,6 @@ void _ath_dbg(struct ath_common *common,
- #endif /* CONFIG_ATH_DEBUG */
+ #endif /* CPTCFG_ATH_DEBUG */
  
  /** Returns string describing opmode, or NULL if unknown mode. */
--#ifdef CONFIG_ATH_DEBUG
+-#ifdef CPTCFG_ATH_DEBUG
  const char *ath_opmode_to_string(enum nl80211_iftype opmode);
 -#else
 -static inline const char *ath_opmode_to_string(enum nl80211_iftype opmode)
diff --git a/package/mac80211/patches/401-ath9k_blink_default.patch b/package/mac80211/patches/401-ath9k_blink_default.patch
index 421e78571d..b0cef87762 100644
--- a/package/mac80211/patches/401-ath9k_blink_default.patch
+++ b/package/mac80211/patches/401-ath9k_blink_default.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/init.c
 +++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -46,7 +46,7 @@ int ath9k_modparam_nohwcrypt;
+@@ -45,7 +45,7 @@ int ath9k_modparam_nohwcrypt;
  module_param_named(nohwcrypt, ath9k_modparam_nohwcrypt, int, 0444);
  MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption");
  
diff --git a/package/mac80211/patches/402-ath9k-fix-invalid-mac-address-handling.patch b/package/mac80211/patches/402-ath9k-fix-invalid-mac-address-handling.patch
index 40c4cb755c..b2a7073307 100644
--- a/package/mac80211/patches/402-ath9k-fix-invalid-mac-address-handling.patch
+++ b/package/mac80211/patches/402-ath9k-fix-invalid-mac-address-handling.patch
@@ -8,7 +8,7 @@
  #include <asm/unaligned.h>
  
  #include "hw.h"
-@@ -519,8 +520,16 @@ static int ath9k_hw_init_macaddr(struct 
+@@ -518,8 +519,16 @@ static int ath9k_hw_init_macaddr(struct 
  		common->macaddr[2 * i] = eeval >> 8;
  		common->macaddr[2 * i + 1] = eeval & 0xff;
  	}
diff --git a/package/mac80211/patches/403-ath_regd_optional.patch b/package/mac80211/patches/403-ath_regd_optional.patch
index 683417b776..a9d5b6d44e 100644
--- a/package/mac80211/patches/403-ath_regd_optional.patch
+++ b/package/mac80211/patches/403-ath_regd_optional.patch
@@ -1,46 +1,58 @@
 --- a/drivers/net/wireless/ath/regd.c
 +++ b/drivers/net/wireless/ath/regd.c
-@@ -198,6 +198,10 @@ ath_reg_apply_beaconing_flags(struct wip
+@@ -196,6 +196,10 @@ ath_reg_apply_beaconing_flags(struct wip
  	struct ieee80211_channel *ch;
  	unsigned int i;
  
-+#ifdef ATH_USER_REGD
++#ifdef CPTCFG_ATH_USER_REGD
 +	return;
 +#endif
 +
  	for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
  
  		if (!wiphy->bands[band])
-@@ -252,6 +256,10 @@ ath_reg_apply_active_scan_flags(struct w
+@@ -250,6 +254,10 @@ ath_reg_apply_active_scan_flags(struct w
  	struct ieee80211_channel *ch;
  	const struct ieee80211_reg_rule *reg_rule;
  
-+#ifdef ATH_USER_REGD
++#ifdef CPTCFG_ATH_USER_REGD
 +	return;
 +#endif
 +
  	sband = wiphy->bands[IEEE80211_BAND_2GHZ];
  	if (!sband)
  		return;
-@@ -301,6 +309,10 @@ static void ath_reg_apply_radar_flags(st
+@@ -299,6 +307,10 @@ static void ath_reg_apply_radar_flags(st
  	struct ieee80211_channel *ch;
  	unsigned int i;
  
-+#ifdef ATH_USER_REGD
++#ifdef CPTCFG_ATH_USER_REGD
 +	return;
 +#endif
 +
  	if (!wiphy->bands[IEEE80211_BAND_5GHZ])
  		return;
  
-@@ -505,6 +517,10 @@ ath_regd_init_wiphy(struct ath_regulator
+@@ -503,6 +515,10 @@ ath_regd_init_wiphy(struct ath_regulator
  {
  	const struct ieee80211_regdomain *regd;
  
-+#ifdef ATH_USER_REGD
++#ifdef CPTCFG_ATH_USER_REGD
 +	return 0;
 +#endif
 +
  	wiphy->reg_notifier = reg_notifier;
  	wiphy->flags |= WIPHY_FLAG_STRICT_REGULATORY;
  
+--- a/drivers/net/wireless/ath/Kconfig
++++ b/drivers/net/wireless/ath/Kconfig
+@@ -21,6 +21,9 @@ menuconfig ATH_CARDS
+ 
+ if ATH_CARDS
+ 
++config ATH_USER_REGD
++	bool "Do not enforce EEPROM regulatory restrictions"
++
+ config ATH_DEBUG
+ 	bool "Atheros wireless debugging"
+ 	---help---
diff --git a/package/mac80211/patches/404-world_regd_fixup.patch b/package/mac80211/patches/404-world_regd_fixup.patch
index d609b55e0a..7a5840eb18 100644
--- a/package/mac80211/patches/404-world_regd_fixup.patch
+++ b/package/mac80211/patches/404-world_regd_fixup.patch
@@ -1,16 +1,16 @@
 --- a/drivers/net/wireless/ath/regd.c
 +++ b/drivers/net/wireless/ath/regd.c
-@@ -44,7 +44,8 @@ static int __ath_regd_init(struct ath_re
+@@ -42,7 +42,8 @@ static int __ath_regd_init(struct ath_re
  				NL80211_RRF_PASSIVE_SCAN | NL80211_RRF_NO_OFDM)
  
  /* We allow IBSS on these on a case by case basis by regulatory domain */
--#define ATH9K_5GHZ_5150_5350	REG_RULE(5150-10, 5350+10, 40, 0, 30,\
-+#define ATH9K_5GHZ_5150_5350	REG_RULE(5150-10, 5250, 40, 0, 30, 0), \
-+				REG_RULE(5250, 5350+10, 40, 0, 30,\
+-#define ATH9K_5GHZ_5150_5350	REG_RULE(5150-10, 5350+10, 80, 0, 30,\
++#define ATH9K_5GHZ_5150_5350	REG_RULE(5150-10, 5250, 80, 0, 30, 0), \
++				REG_RULE(5250, 5350+10, 80, 0, 30,\
  				NL80211_RRF_PASSIVE_SCAN | NL80211_RRF_NO_IBSS)
- #define ATH9K_5GHZ_5470_5850	REG_RULE(5470-10, 5850+10, 40, 0, 30,\
+ #define ATH9K_5GHZ_5470_5850	REG_RULE(5470-10, 5850+10, 80, 0, 30,\
  				NL80211_RRF_PASSIVE_SCAN | NL80211_RRF_NO_IBSS)
-@@ -62,57 +63,56 @@ static int __ath_regd_init(struct ath_re
+@@ -60,57 +61,56 @@ static int __ath_regd_init(struct ath_re
  #define ATH9K_5GHZ_NO_MIDBAND	ATH9K_5GHZ_5150_5350, \
  				ATH9K_5GHZ_5725_5850
  
diff --git a/package/mac80211/patches/405-regd_no_assoc_hints.patch b/package/mac80211/patches/405-regd_no_assoc_hints.patch
index 938ac42165..5380853df6 100644
--- a/package/mac80211/patches/405-regd_no_assoc_hints.patch
+++ b/package/mac80211/patches/405-regd_no_assoc_hints.patch
@@ -1,15 +1,15 @@
 --- a/net/wireless/reg.c
 +++ b/net/wireless/reg.c
-@@ -1730,6 +1730,8 @@ void regulatory_hint_11d(struct wiphy *w
+@@ -1696,6 +1696,8 @@ void regulatory_hint_11d(struct wiphy *w
  	enum environment_cap env = ENVIRON_ANY;
- 	struct regulatory_request *request, *lr;
+ 	struct regulatory_request *request = NULL, *lr;
  
 +	return;
 +
- 	mutex_lock(&reg_mutex);
- 	lr = get_last_request();
- 
-@@ -1926,6 +1928,7 @@ static void restore_regulatory_settings(
+ 	/* IE len must be evenly divisible by 2 */
+ 	if (country_ie_len & 0x01)
+ 		return;
+@@ -1890,6 +1892,7 @@ static void restore_regulatory_settings(
  
  void regulatory_hint_disconnect(void)
  {
diff --git a/package/mac80211/patches/410-ath9k_allow_adhoc_and_ap.patch b/package/mac80211/patches/410-ath9k_allow_adhoc_and_ap.patch
index 8294ee2e52..2eae3916dd 100644
--- a/package/mac80211/patches/410-ath9k_allow_adhoc_and_ap.patch
+++ b/package/mac80211/patches/410-ath9k_allow_adhoc_and_ap.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/init.c
 +++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -733,6 +733,7 @@ static const struct ieee80211_iface_limi
+@@ -729,6 +729,7 @@ static const struct ieee80211_iface_limi
  #endif
  				 BIT(NL80211_IFTYPE_AP) |
  				 BIT(NL80211_IFTYPE_P2P_GO) },
diff --git a/package/mac80211/patches/411-ath5k_allow_adhoc_and_ap.patch b/package/mac80211/patches/411-ath5k_allow_adhoc_and_ap.patch
index 22d911370f..12e03e1bb1 100644
--- a/package/mac80211/patches/411-ath5k_allow_adhoc_and_ap.patch
+++ b/package/mac80211/patches/411-ath5k_allow_adhoc_and_ap.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath5k/mac80211-ops.c
 +++ b/drivers/net/wireless/ath/ath5k/mac80211-ops.c
-@@ -89,13 +89,8 @@ ath5k_add_interface(struct ieee80211_hw 
+@@ -86,13 +86,8 @@ ath5k_add_interface(struct ieee80211_hw 
  		goto end;
  	}
  
@@ -18,7 +18,7 @@
  		goto end;
 --- a/drivers/net/wireless/ath/ath5k/base.c
 +++ b/drivers/net/wireless/ath/ath5k/base.c
-@@ -1868,7 +1868,7 @@ ath5k_beacon_send(struct ath5k_hw *ah)
+@@ -1916,7 +1916,7 @@ ath5k_beacon_send(struct ath5k_hw *ah)
  	}
  
  	if ((ah->opmode == NL80211_IFTYPE_AP && ah->num_ap_vifs +
@@ -27,7 +27,7 @@
  			ah->opmode == NL80211_IFTYPE_MESH_POINT) {
  		u64 tsf = ath5k_hw_get_tsf64(ah);
  		u32 tsftu = TSF_TO_TU(tsf);
-@@ -1954,7 +1954,7 @@ ath5k_beacon_update_timers(struct ath5k_
+@@ -2002,7 +2002,7 @@ ath5k_beacon_update_timers(struct ath5k_
  
  	intval = ah->bintval & AR5K_BEACON_PERIOD;
  	if (ah->opmode == NL80211_IFTYPE_AP && ah->num_ap_vifs
@@ -36,7 +36,7 @@
  		intval /= ATH_BCBUF;	/* staggered multi-bss beacons */
  		if (intval < 15)
  			ATH5K_WARN(ah, "intval %u is too low, min 15\n",
-@@ -2418,6 +2418,7 @@ static const struct ieee80211_iface_limi
+@@ -2469,6 +2469,7 @@ static const struct ieee80211_iface_limi
  				 BIT(NL80211_IFTYPE_MESH_POINT) |
  #endif
  				 BIT(NL80211_IFTYPE_AP) },
diff --git a/package/mac80211/patches/420-ath5k_disable_fast_cc.patch b/package/mac80211/patches/420-ath5k_disable_fast_cc.patch
index bd661c6fbf..414f49508f 100644
--- a/package/mac80211/patches/420-ath5k_disable_fast_cc.patch
+++ b/package/mac80211/patches/420-ath5k_disable_fast_cc.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath5k/reset.c
 +++ b/drivers/net/wireless/ath/ath5k/reset.c
-@@ -1156,6 +1156,7 @@ ath5k_hw_reset(struct ath5k_hw *ah, enum
+@@ -1154,6 +1154,7 @@ ath5k_hw_reset(struct ath5k_hw *ah, enum
  	tsf_lo = 0;
  	mode = 0;
  
@@ -8,7 +8,7 @@
  	/*
  	 * Sanity check for fast flag
  	 * Fast channel change only available
-@@ -1163,6 +1164,7 @@ ath5k_hw_reset(struct ath5k_hw *ah, enum
+@@ -1161,6 +1162,7 @@ ath5k_hw_reset(struct ath5k_hw *ah, enum
  	 */
  	if (fast && (ah->ah_radio != AR5K_RF2413) &&
  	(ah->ah_radio != AR5K_RF5413))
diff --git a/package/mac80211/patches/431-add_platform_eeprom_support_to_ath5k.patch b/package/mac80211/patches/431-add_platform_eeprom_support_to_ath5k.patch
index 6cafa236a7..a223b38348 100644
--- a/package/mac80211/patches/431-add_platform_eeprom_support_to_ath5k.patch
+++ b/package/mac80211/patches/431-add_platform_eeprom_support_to_ath5k.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath5k/pci.c
 +++ b/drivers/net/wireless/ath/ath5k/pci.c
-@@ -23,6 +23,7 @@
+@@ -21,6 +21,7 @@
  #include <linux/pci-aspm.h>
  #include <linux/etherdevice.h>
  #include <linux/module.h>
@@ -8,7 +8,7 @@
  #include "../ath.h"
  #include "ath5k.h"
  #include "debug.h"
-@@ -74,7 +75,7 @@ static void ath5k_pci_read_cachesize(str
+@@ -72,7 +73,7 @@ static void ath5k_pci_read_cachesize(str
  }
  
  /*
@@ -17,7 +17,7 @@
   */
  static bool
  ath5k_pci_eeprom_read(struct ath_common *common, u32 offset, u16 *data)
-@@ -82,6 +83,19 @@ ath5k_pci_eeprom_read(struct ath_common 
+@@ -80,6 +81,19 @@ ath5k_pci_eeprom_read(struct ath_common 
  	struct ath5k_hw *ah = (struct ath5k_hw *) common->ah;
  	u32 status, timeout;
  
@@ -37,7 +37,7 @@
  	/*
  	 * Initialize EEPROM access
  	 */
-@@ -125,6 +139,16 @@ static int ath5k_pci_eeprom_read_mac(str
+@@ -123,6 +137,16 @@ static int ath5k_pci_eeprom_read_mac(str
  	u16 data;
  	int octet;
  
diff --git a/package/mac80211/patches/432-ath5k_add_pciids.patch b/package/mac80211/patches/432-ath5k_add_pciids.patch
index 8db5e1b3fa..e5c85cee61 100644
--- a/package/mac80211/patches/432-ath5k_add_pciids.patch
+++ b/package/mac80211/patches/432-ath5k_add_pciids.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath5k/pci.c
 +++ b/drivers/net/wireless/ath/ath5k/pci.c
-@@ -50,6 +50,8 @@ static DEFINE_PCI_DEVICE_TABLE(ath5k_pci
+@@ -48,6 +48,8 @@ static DEFINE_PCI_DEVICE_TABLE(ath5k_pci
  	{ PCI_VDEVICE(ATHEROS, 0x001b) }, /* 5413 Eagle */
  	{ PCI_VDEVICE(ATHEROS, 0x001c) }, /* PCI-E cards */
  	{ PCI_VDEVICE(ATHEROS, 0x001d) }, /* 2417 Nala */
diff --git a/package/mac80211/patches/440-ath5k_channel_bw_debugfs.patch b/package/mac80211/patches/440-ath5k_channel_bw_debugfs.patch
index a2141ab24e..01c28bcca2 100644
--- a/package/mac80211/patches/440-ath5k_channel_bw_debugfs.patch
+++ b/package/mac80211/patches/440-ath5k_channel_bw_debugfs.patch
@@ -11,7 +11,7 @@ drivers/net/wireless/ath/ath5k/debug.c |   86 ++++++++++++++++++++++++++++++++
 
 --- a/drivers/net/wireless/ath/ath5k/debug.c
 +++ b/drivers/net/wireless/ath/ath5k/debug.c
-@@ -813,6 +813,89 @@ static const struct file_operations fops
+@@ -811,6 +811,89 @@ static const struct file_operations fops
  	.llseek = default_llseek,
  };
  
@@ -101,7 +101,7 @@ drivers/net/wireless/ath/ath5k/debug.c |   86 ++++++++++++++++++++++++++++++++
  
  /* debugfs: queues etc */
  
-@@ -904,6 +987,9 @@ ath5k_debug_init_device(struct ath5k_hw 
+@@ -902,6 +985,9 @@ ath5k_debug_init_device(struct ath5k_hw 
  	debugfs_create_file("beacon", S_IWUSR | S_IRUSR, phydir, ah,
  			    &fops_beacon);
  
diff --git a/package/mac80211/patches/500-ath9k_eeprom_debugfs.patch b/package/mac80211/patches/500-ath9k_eeprom_debugfs.patch
index 25c0c2004f..7f4e68d5ea 100644
--- a/package/mac80211/patches/500-ath9k_eeprom_debugfs.patch
+++ b/package/mac80211/patches/500-ath9k_eeprom_debugfs.patch
@@ -1,7 +1,7 @@
 --- a/drivers/net/wireless/ath/ath9k/debug.c
 +++ b/drivers/net/wireless/ath/ath9k/debug.c
-@@ -2012,6 +2012,53 @@ void ath9k_get_et_stats(struct ieee80211
- 	WARN_ON(i != ATH9K_SSTATS_LEN);
+@@ -1735,6 +1735,53 @@ void ath9k_deinit_debug(struct ath_softc
+ 	}
  }
  
 +static ssize_t read_file_eeprom(struct file *file, char __user *user_buf,
@@ -54,7 +54,7 @@
  int ath9k_init_debug(struct ath_hw *ah)
  {
  	struct ath_common *common = ath9k_hw_common(ah);
-@@ -2029,6 +2076,8 @@ int ath9k_init_debug(struct ath_hw *ah)
+@@ -1752,6 +1799,8 @@ int ath9k_init_debug(struct ath_hw *ah)
  
  	ath9k_dfs_init_debug(sc);
  
diff --git a/package/mac80211/patches/501-ath9k-eeprom_endianess.patch b/package/mac80211/patches/501-ath9k-eeprom_endianess.patch
index 5888c208ce..3d904e939d 100644
--- a/package/mac80211/patches/501-ath9k-eeprom_endianess.patch
+++ b/package/mac80211/patches/501-ath9k-eeprom_endianess.patch
@@ -71,7 +71,7 @@
  
 --- a/drivers/net/wireless/ath/ath9k/hw.h
 +++ b/drivers/net/wireless/ath/ath9k/hw.h
-@@ -739,6 +739,7 @@ enum ath_cal_list {
+@@ -735,6 +735,7 @@ enum ath_cal_list {
  #define AH_USE_EEPROM   0x1
  #define AH_UNPLUGGED    0x2 /* The card has been physically removed. */
  #define AH_FASTCC       0x4
@@ -81,7 +81,7 @@
  	struct ath_ops reg_ops;
 --- a/drivers/net/wireless/ath/ath9k/init.c
 +++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -593,6 +593,8 @@ static int ath9k_init_softc(u16 devid, s
+@@ -592,6 +592,8 @@ static int ath9k_init_softc(u16 devid, s
  		ah->is_clk_25mhz = pdata->is_clk_25mhz;
  		ah->get_mac_revision = pdata->get_mac_revision;
  		ah->external_reset = pdata->external_reset;
diff --git a/package/mac80211/patches/502-ath9k_ahb_init.patch b/package/mac80211/patches/502-ath9k_ahb_init.patch
index 82dfa3f734..9e715526a6 100644
--- a/package/mac80211/patches/502-ath9k_ahb_init.patch
+++ b/package/mac80211/patches/502-ath9k_ahb_init.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/init.c
 +++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -990,23 +990,23 @@ static int __init ath9k_init(void)
+@@ -984,23 +984,23 @@ static int __init ath9k_init(void)
  		goto err_out;
  	}
  
diff --git a/package/mac80211/patches/510-ath9k_intr_mitigation_tweak.patch b/package/mac80211/patches/510-ath9k_intr_mitigation_tweak.patch
index 3b5d28a933..647bde2ca0 100644
--- a/package/mac80211/patches/510-ath9k_intr_mitigation_tweak.patch
+++ b/package/mac80211/patches/510-ath9k_intr_mitigation_tweak.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/hw.c
 +++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -2018,8 +2018,8 @@ int ath9k_hw_reset(struct ath_hw *ah, st
+@@ -2010,8 +2010,8 @@ int ath9k_hw_reset(struct ath_hw *ah, st
  		REG_WRITE(ah, AR_OBS, 8);
  
  	if (ah->config.rx_intr_mitigation) {
diff --git a/package/mac80211/patches/512-ath9k_channelbw_debugfs.patch b/package/mac80211/patches/512-ath9k_channelbw_debugfs.patch
index 541d568a6c..ef87a35922 100644
--- a/package/mac80211/patches/512-ath9k_channelbw_debugfs.patch
+++ b/package/mac80211/patches/512-ath9k_channelbw_debugfs.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/ath9k.h
 +++ b/drivers/net/wireless/ath/ath9k/ath9k.h
-@@ -695,6 +695,7 @@ struct ath_softc {
+@@ -696,6 +696,7 @@ struct ath_softc {
  	struct ieee80211_hw *hw;
  	struct device *dev;
  
@@ -18,7 +18,7 @@
  
 --- a/drivers/net/wireless/ath/ath9k/debug.c
 +++ b/drivers/net/wireless/ath/ath9k/debug.c
-@@ -2059,6 +2059,50 @@ static const struct file_operations fops
+@@ -1782,6 +1782,50 @@ static const struct file_operations fops
  	.owner = THIS_MODULE
  };
  
@@ -69,7 +69,7 @@
  int ath9k_init_debug(struct ath_hw *ah)
  {
  	struct ath_common *common = ath9k_hw_common(ah);
-@@ -2078,6 +2122,8 @@ int ath9k_init_debug(struct ath_hw *ah)
+@@ -1801,6 +1845,8 @@ int ath9k_init_debug(struct ath_hw *ah)
  
  	debugfs_create_file("eeprom", S_IRUSR, sc->debug.debugfs_phy, sc,
  			    &fops_eeprom);
@@ -80,7 +80,7 @@
  	debugfs_create_file("interrupt", S_IRUSR, sc->debug.debugfs_phy, sc,
 --- a/drivers/net/wireless/ath/ath9k/main.c
 +++ b/drivers/net/wireless/ath/ath9k/main.c
-@@ -1140,7 +1140,7 @@ int ath9k_spectral_scan_config(struct ie
+@@ -1139,7 +1139,7 @@ int ath9k_spectral_scan_config(struct ie
  	return 0;
  }
  
@@ -89,7 +89,7 @@
  {
  	struct ath_softc *sc = hw->priv;
  	struct ath_hw *ah = sc->sc_ah;
-@@ -1196,9 +1196,11 @@ static int ath9k_config(struct ieee80211
+@@ -1195,9 +1195,11 @@ static int ath9k_config(struct ieee80211
  		struct ieee80211_channel *curchan = hw->conf.chandef.chan;
  		enum nl80211_channel_type channel_type =
  			cfg80211_get_chandef_type(&conf->chandef);
@@ -101,7 +101,7 @@
  
  		if (ah->curchan)
  			old_pos = ah->curchan - &ah->channels[0];
-@@ -1241,7 +1243,23 @@ static int ath9k_config(struct ieee80211
+@@ -1233,7 +1235,23 @@ static int ath9k_config(struct ieee80211
  			memset(&sc->survey[pos], 0, sizeof(struct survey_info));
  		}
  
diff --git a/package/mac80211/patches/520-mac80211_cur_txpower.patch b/package/mac80211/patches/520-mac80211_cur_txpower.patch
index e2759edf92..8583cdc25b 100644
--- a/package/mac80211/patches/520-mac80211_cur_txpower.patch
+++ b/package/mac80211/patches/520-mac80211_cur_txpower.patch
@@ -1,6 +1,6 @@
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -1608,6 +1608,7 @@ struct ieee80211_hw {
+@@ -1614,6 +1614,7 @@ struct ieee80211_hw {
  	u8 max_tx_aggregation_subframes;
  	u8 offchannel_tx_hw_queue;
  	u8 radiotap_mcs_details;
@@ -10,7 +10,7 @@
  	u8 uapsd_queues;
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -2262,7 +2262,9 @@ static int ieee80211_get_tx_power(struct
+@@ -2273,7 +2273,9 @@ static int ieee80211_get_tx_power(struct
  	struct ieee80211_local *local = wiphy_priv(wiphy);
  	struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);
  
diff --git a/package/mac80211/patches/521-ath9k_cur_txpower.patch b/package/mac80211/patches/521-ath9k_cur_txpower.patch
index 134031219b..87a316c4f0 100644
--- a/package/mac80211/patches/521-ath9k_cur_txpower.patch
+++ b/package/mac80211/patches/521-ath9k_cur_txpower.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/main.c
 +++ b/drivers/net/wireless/ath/ath9k/main.c
-@@ -1266,6 +1266,8 @@ int ath9k_config(struct ieee80211_hw *hw
+@@ -1258,6 +1258,8 @@ int ath9k_config(struct ieee80211_hw *hw
  			return -EINVAL;
  		}
  
@@ -9,7 +9,7 @@
  		/*
  		 * The most recent snapshot of channel->noisefloor for the old
  		 * channel is only available after the hardware reset. Copy it to
-@@ -1302,6 +1304,7 @@ int ath9k_config(struct ieee80211_hw *hw
+@@ -1294,6 +1296,7 @@ int ath9k_config(struct ieee80211_hw *hw
  		sc->config.txpowlimit = 2 * conf->power_level;
  		ath9k_cmn_update_txpow(ah, sc->curtxpow,
  				       sc->config.txpowlimit, &sc->curtxpow);
diff --git a/package/mac80211/patches/522-ath9k_per_chain_signal_strength.patch b/package/mac80211/patches/522-ath9k_per_chain_signal_strength.patch
index 6aac4389f7..50dbcd9902 100644
--- a/package/mac80211/patches/522-ath9k_per_chain_signal_strength.patch
+++ b/package/mac80211/patches/522-ath9k_per_chain_signal_strength.patch
@@ -17,7 +17,7 @@
  	u8 rs_num_delims;
 --- a/drivers/net/wireless/ath/ath9k/recv.c
 +++ b/drivers/net/wireless/ath/ath9k/recv.c
-@@ -950,6 +950,7 @@ static int ath9k_rx_skb_preprocess(struc
+@@ -939,6 +939,7 @@ static int ath9k_rx_skb_preprocess(struc
  	struct ath_hw *ah = sc->sc_ah;
  	struct ath_common *common = ath9k_hw_common(ah);
  	bool discard_current = sc->rx.discard_next;
@@ -25,7 +25,7 @@
  
  	sc->rx.discard_next = rx_stats->rs_more;
  	if (discard_current)
-@@ -979,6 +980,21 @@ static int ath9k_rx_skb_preprocess(struc
+@@ -968,6 +969,21 @@ static int ath9k_rx_skb_preprocess(struc
  	if (rx_stats->rs_moreaggr)
  		rx_status->flag |= RX_FLAG_NO_SIGNAL_VAL;
  
@@ -47,7 +47,7 @@
  	sc->rx.discard_next = false;
  	return 0;
  }
-@@ -1088,7 +1104,7 @@ static int ath_process_fft(struct ath_so
+@@ -1077,7 +1093,7 @@ static int ath_process_fft(struct ath_so
  	fft_sample.tlv.length = __cpu_to_be16(length);
  
  	fft_sample.freq = __cpu_to_be16(ah->curchan->chan->center_freq);
@@ -58,7 +58,7 @@
  	switch (len - SPECTRAL_HT20_TOTAL_DATA_LEN) {
 --- a/drivers/net/wireless/ath/ath9k/ar9003_mac.c
 +++ b/drivers/net/wireless/ath/ath9k/ar9003_mac.c
-@@ -475,12 +475,12 @@ int ath9k_hw_process_rxdesc_edma(struct 
+@@ -476,12 +476,12 @@ int ath9k_hw_process_rxdesc_edma(struct 
  
  	/* XXX: Keycache */
  	rxs->rs_rssi = MS(rxsp->status5, AR_RxRSSICombined);
@@ -79,7 +79,7 @@
  		rxs->rs_keyix = MS(rxsp->status11, AR_KeyIdx);
 --- a/drivers/net/wireless/ath/ath9k/mac.c
 +++ b/drivers/net/wireless/ath/ath9k/mac.c
-@@ -553,25 +553,25 @@ int ath9k_hw_rxprocdesc(struct ath_hw *a
+@@ -554,25 +554,25 @@ int ath9k_hw_rxprocdesc(struct ath_hw *a
  
  	if (ads.ds_rxstatus8 & AR_PostDelimCRCErr) {
  		rs->rs_rssi = ATH9K_RSSI_BAD;
@@ -117,30 +117,9 @@
  						AR_RxRSSIAnt12);
  	}
  	if (ads.ds_rxstatus8 & AR_RxKeyIdxValid)
---- a/drivers/net/wireless/ath/ath9k/debug.c
-+++ b/drivers/net/wireless/ath/ath9k/debug.c
-@@ -943,12 +943,12 @@ void ath_debug_stat_rx(struct ath_softc 
- #ifdef CONFIG_ATH9K_MAC_DEBUG
- 	spin_lock(&sc->debug.samp_lock);
- 	RX_SAMP_DBG(jiffies) = jiffies;
--	RX_SAMP_DBG(rssi_ctl0) = rs->rs_rssi_ctl0;
--	RX_SAMP_DBG(rssi_ctl1) = rs->rs_rssi_ctl1;
--	RX_SAMP_DBG(rssi_ctl2) = rs->rs_rssi_ctl2;
--	RX_SAMP_DBG(rssi_ext0) = rs->rs_rssi_ext0;
--	RX_SAMP_DBG(rssi_ext1) = rs->rs_rssi_ext1;
--	RX_SAMP_DBG(rssi_ext2) = rs->rs_rssi_ext2;
-+	RX_SAMP_DBG(rssi_ctl0) = rs->rs_rssi_ctl[0];
-+	RX_SAMP_DBG(rssi_ctl1) = rs->rs_rssi_ctl[1];
-+	RX_SAMP_DBG(rssi_ctl2) = rs->rs_rssi_ctl[2];
-+	RX_SAMP_DBG(rssi_ext0) = rs->rs_rssi_ext[0];
-+	RX_SAMP_DBG(rssi_ext1) = rs->rs_rssi_ext[1];
-+	RX_SAMP_DBG(rssi_ext2) = rs->rs_rssi_ext[2];
- 	RX_SAMP_DBG(antenna) = rs->rs_antenna;
- 	RX_SAMP_DBG(rssi) = rs->rs_rssi;
- 	RX_SAMP_DBG(rate) = rs->rs_rate;
 --- a/drivers/net/wireless/ath/ath9k/dfs.c
 +++ b/drivers/net/wireless/ath/ath9k/dfs.c
-@@ -164,8 +164,8 @@ void ath9k_dfs_process_phyerr(struct ath
+@@ -158,8 +158,8 @@ void ath9k_dfs_process_phyerr(struct ath
  		return;
  	}
  
diff --git a/package/mac80211/patches/523-mac80211_configure_antenna_gain.patch b/package/mac80211/patches/523-mac80211_configure_antenna_gain.patch
index d5c8ccf04c..759812bfd7 100644
--- a/package/mac80211/patches/523-mac80211_configure_antenna_gain.patch
+++ b/package/mac80211/patches/523-mac80211_configure_antenna_gain.patch
@@ -1,6 +1,6 @@
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -991,6 +991,7 @@ enum ieee80211_smps_mode {
+@@ -997,6 +997,7 @@ enum ieee80211_smps_mode {
   *
   * @power_level: requested transmit power (in dBm), backward compatibility
   *	value only that is set to the minimum of all interfaces
@@ -8,7 +8,7 @@
   *
   * @chandef: the channel definition to tune to
   * @radar_enabled: whether radar detection is enabled
-@@ -1012,6 +1013,7 @@ struct ieee80211_conf {
+@@ -1018,6 +1019,7 @@ struct ieee80211_conf {
  	u32 flags;
  	int power_level, dynamic_ps_timeout;
  	int max_sleep_period;
@@ -18,7 +18,7 @@
  	u8 ps_dtim_period;
 --- a/net/mac80211/ieee80211_i.h
 +++ b/net/mac80211/ieee80211_i.h
-@@ -1110,6 +1110,7 @@ struct ieee80211_local {
+@@ -1126,6 +1126,7 @@ struct ieee80211_local {
  	int dynamic_ps_forced_timeout;
  
  	int user_power_level; /* in dBm, for all interfaces */
@@ -28,9 +28,9 @@
  
 --- a/include/uapi/linux/nl80211.h
 +++ b/include/uapi/linux/nl80211.h
-@@ -1709,6 +1709,8 @@ enum nl80211_attrs {
- 	NL80211_ATTR_MDID,
- 	NL80211_ATTR_IE_RIC,
+@@ -1736,6 +1736,8 @@ enum nl80211_attrs {
+ 
+ 	NL80211_ATTR_PEER_AID,
  
 +	NL80211_ATTR_WIPHY_ANTENNA_GAIN,
 +
@@ -39,15 +39,15 @@
  	__NL80211_ATTR_AFTER_LAST,
 --- a/net/wireless/nl80211.c
 +++ b/net/wireless/nl80211.c
-@@ -378,6 +378,7 @@ static const struct nla_policy nl80211_p
- 	[NL80211_ATTR_MDID] = { .type = NLA_U16 },
+@@ -349,6 +349,7 @@ static const struct nla_policy nl80211_p
  	[NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
  				  .len = IEEE80211_MAX_DATA_LEN },
+ 	[NL80211_ATTR_PEER_AID] = { .type = NLA_U16 },
 +	[NL80211_ATTR_WIPHY_ANTENNA_GAIN] = { .type = NLA_U32 },
  };
  
  /* policy for the key attributes */
-@@ -1990,6 +1991,22 @@ static int nl80211_set_wiphy(struct sk_b
+@@ -1953,6 +1954,22 @@ static int nl80211_set_wiphy(struct sk_b
  			goto bad_res;
  	}
  
@@ -72,7 +72,7 @@
  		u32 tx_ant, rx_ant;
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -2272,6 +2272,19 @@ static int ieee80211_get_tx_power(struct
+@@ -2283,6 +2283,19 @@ static int ieee80211_get_tx_power(struct
  	return 0;
  }
  
@@ -92,7 +92,7 @@
  static int ieee80211_set_wds_peer(struct wiphy *wiphy, struct net_device *dev,
  				  const u8 *addr)
  {
-@@ -3462,6 +3475,7 @@ struct cfg80211_ops mac80211_config_ops 
+@@ -3484,6 +3497,7 @@ struct cfg80211_ops mac80211_config_ops 
  	.set_wiphy_params = ieee80211_set_wiphy_params,
  	.set_tx_power = ieee80211_set_tx_power,
  	.get_tx_power = ieee80211_get_tx_power,
@@ -102,7 +102,7 @@
  	CFG80211_TESTMODE_CMD(ieee80211_testmode_cmd)
 --- a/include/net/cfg80211.h
 +++ b/include/net/cfg80211.h
-@@ -1922,6 +1922,7 @@ struct cfg80211_update_ft_ies_params {
+@@ -1942,6 +1942,7 @@ struct cfg80211_update_ft_ies_params {
   *	(as advertised by the nl80211 feature flag.)
   * @get_tx_power: store the current TX power into the dbm variable;
   *	return 0 if successful
@@ -110,7 +110,7 @@
   *
   * @set_wds_peer: set the WDS peer for a WDS interface
   *
-@@ -2135,6 +2136,7 @@ struct cfg80211_ops {
+@@ -2161,6 +2162,7 @@ struct cfg80211_ops {
  				enum nl80211_tx_power_setting type, int mbm);
  	int	(*get_tx_power)(struct wiphy *wiphy, struct wireless_dev *wdev,
  				int *dbm);
diff --git a/package/mac80211/patches/524-ath9k_use_configured_antenna_gain.patch b/package/mac80211/patches/524-ath9k_use_configured_antenna_gain.patch
index 8d12538c34..8f48eea3ad 100644
--- a/package/mac80211/patches/524-ath9k_use_configured_antenna_gain.patch
+++ b/package/mac80211/patches/524-ath9k_use_configured_antenna_gain.patch
@@ -10,7 +10,7 @@
  
 --- a/drivers/net/wireless/ath/ath9k/hw.c
 +++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -2860,7 +2860,7 @@ void ath9k_hw_apply_txpower(struct ath_h
+@@ -2847,7 +2847,7 @@ void ath9k_hw_apply_txpower(struct ath_h
  	channel = chan->chan;
  	chan_pwr = min_t(int, channel->max_power * 2, MAX_RATE_POWER);
  	new_pwr = min_t(int, chan_pwr, reg->power_limit);
@@ -21,7 +21,7 @@
  	if (ant_gain > max_gain)
 --- a/drivers/net/wireless/ath/ath9k/main.c
 +++ b/drivers/net/wireless/ath/ath9k/main.c
-@@ -1300,7 +1300,10 @@ int ath9k_config(struct ieee80211_hw *hw
+@@ -1292,7 +1292,10 @@ int ath9k_config(struct ieee80211_hw *hw
  	}
  
  	if (changed & IEEE80211_CONF_CHANGE_POWER) {
diff --git a/package/mac80211/patches/530-ath9k_extra_leds.patch b/package/mac80211/patches/530-ath9k_extra_leds.patch
index ce6a0c68f3..134b0978b2 100644
--- a/package/mac80211/patches/530-ath9k_extra_leds.patch
+++ b/package/mac80211/patches/530-ath9k_extra_leds.patch
@@ -10,7 +10,7 @@
  #else
  static inline void ath_init_leds(struct ath_softc *sc)
  {
-@@ -691,6 +694,13 @@ enum spectral_mode {
+@@ -692,6 +695,13 @@ enum spectral_mode {
  	SPECTRAL_CHANSCAN,
  };
  
@@ -24,10 +24,10 @@
  struct ath_softc {
  	struct ieee80211_hw *hw;
  	struct device *dev;
-@@ -732,9 +742,8 @@ struct ath_softc {
+@@ -733,9 +743,8 @@ struct ath_softc {
  	struct ieee80211_supported_band sbands[IEEE80211_NUM_BANDS];
  
- #ifdef CONFIG_MAC80211_LEDS
+ #ifdef CPTCFG_MAC80211_LEDS
 -	bool led_registered;
 -	char led_name[32];
 -	struct led_classdev led_cdev;
@@ -162,9 +162,9 @@
  void ath_fill_led_pin(struct ath_softc *sc)
 --- a/drivers/net/wireless/ath/ath9k/init.c
 +++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -895,7 +895,7 @@ int ath9k_init_device(u16 devid, struct 
+@@ -891,7 +891,7 @@ int ath9k_init_device(u16 devid, struct 
  
- #ifdef CONFIG_MAC80211_LEDS
+ #ifdef CPTCFG_MAC80211_LEDS
  	/* must be initialized before ieee80211_register_hw */
 -	sc->led_cdev.default_trigger = ieee80211_create_tpt_led_trigger(sc->hw,
 +	sc->led_default_trigger = ieee80211_create_tpt_led_trigger(sc->hw,
@@ -173,7 +173,7 @@
  #endif
 --- a/drivers/net/wireless/ath/ath9k/debug.c
 +++ b/drivers/net/wireless/ath/ath9k/debug.c
-@@ -1489,6 +1489,61 @@ static const struct file_operations fops
+@@ -1825,6 +1825,61 @@ static const struct file_operations fops
  	.llseek = default_llseek,
  };
  
@@ -232,10 +232,10 @@
 +
 +#endif
 +
- #ifdef CONFIG_ATH9K_MAC_DEBUG
  
- void ath9k_debug_samp_bb_mac(struct ath_softc *sc)
-@@ -2124,6 +2179,10 @@ int ath9k_init_debug(struct ath_hw *ah)
+ int ath9k_init_debug(struct ath_hw *ah)
+ {
+@@ -1847,6 +1902,10 @@ int ath9k_init_debug(struct ath_hw *ah)
  			    &fops_eeprom);
  	debugfs_create_file("chanbw", S_IRUSR | S_IWUSR, sc->debug.debugfs_phy,
  			    sc, &fops_chanbw);
diff --git a/package/mac80211/patches/531-ath9k_extra_platform_leds.patch b/package/mac80211/patches/531-ath9k_extra_platform_leds.patch
index d07fc4eaa6..764242cd1c 100644
--- a/package/mac80211/patches/531-ath9k_extra_platform_leds.patch
+++ b/package/mac80211/patches/531-ath9k_extra_platform_leds.patch
@@ -12,14 +12,14 @@
  #endif /* _LINUX_ATH9K_PLATFORM_H */
 --- a/drivers/net/wireless/ath/ath9k/gpio.c
 +++ b/drivers/net/wireless/ath/ath9k/gpio.c
-@@ -14,6 +14,7 @@
-  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+@@ -15,6 +15,7 @@
   */
  
-+#include <linux/ath9k_platform.h>
  #include "ath9k.h"
++#include <linux/ath9k_platform.h>
  
  /********************************/
+ /*	 LED functions		*/
 @@ -88,6 +89,24 @@ int ath_create_gpio_led(struct ath_softc
  	return ret;
  }
diff --git a/package/mac80211/patches/550-ath9k_reduce_ani_interval.patch b/package/mac80211/patches/550-ath9k_reduce_ani_interval.patch
index f8f54ed271..2b7cf21881 100644
--- a/package/mac80211/patches/550-ath9k_reduce_ani_interval.patch
+++ b/package/mac80211/patches/550-ath9k_reduce_ani_interval.patch
@@ -1,11 +1,11 @@
 --- a/drivers/net/wireless/ath/ath9k/ani.h
 +++ b/drivers/net/wireless/ath/ath9k/ani.h
-@@ -51,7 +51,7 @@
+@@ -34,7 +34,7 @@
  #define ATH9K_ANI_PERIOD                  300
  
  /* in ms */
 -#define ATH9K_ANI_POLLINTERVAL            1000
 +#define ATH9K_ANI_POLLINTERVAL            300
  
- #define HAL_NOISE_IMMUNE_MAX              4
- #define HAL_SPUR_IMMUNE_MAX               7
+ #define ATH9K_SIG_FIRSTEP_SETTING_MIN     0
+ #define ATH9K_SIG_FIRSTEP_SETTING_MAX     20
diff --git a/package/mac80211/patches/551-ath9k_revert_initval_change.patch b/package/mac80211/patches/551-ath9k_revert_initval_change.patch
deleted file mode 100644
index ffb08bfbbd..0000000000
--- a/package/mac80211/patches/551-ath9k_revert_initval_change.patch
+++ /dev/null
@@ -1,19 +0,0 @@
---- a/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h
-+++ b/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h
-@@ -958,11 +958,11 @@ static const u32 ar9300Common_rx_gain_ta
- 	{0x0000a074, 0x00000000},
- 	{0x0000a078, 0x00000000},
- 	{0x0000a07c, 0x00000000},
--	{0x0000a080, 0x1a1a1a1a},
--	{0x0000a084, 0x1a1a1a1a},
--	{0x0000a088, 0x1a1a1a1a},
--	{0x0000a08c, 0x1a1a1a1a},
--	{0x0000a090, 0x171a1a1a},
-+	{0x0000a080, 0x22222229},
-+	{0x0000a084, 0x1d1d1d1d},
-+	{0x0000a088, 0x1d1d1d1d},
-+	{0x0000a08c, 0x1d1d1d1d},
-+	{0x0000a090, 0x171d1d1d},
- 	{0x0000a094, 0x11111717},
- 	{0x0000a098, 0x00030311},
- 	{0x0000a09c, 0x00000000},
diff --git a/package/mac80211/patches/552-ath9k_rx_dma_stop_check.patch b/package/mac80211/patches/552-ath9k_rx_dma_stop_check.patch
index 4920ccbd71..5d063c7d65 100644
--- a/package/mac80211/patches/552-ath9k_rx_dma_stop_check.patch
+++ b/package/mac80211/patches/552-ath9k_rx_dma_stop_check.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/mac.c
 +++ b/drivers/net/wireless/ath/ath9k/mac.c
-@@ -697,7 +697,7 @@ bool ath9k_hw_stopdmarecv(struct ath_hw 
+@@ -705,7 +705,7 @@ bool ath9k_hw_stopdmarecv(struct ath_hw 
  {
  #define AH_RX_STOP_DMA_TIMEOUT 10000   /* usec */
  	struct ath_common *common = ath9k_hw_common(ah);
@@ -9,7 +9,7 @@
  	int i;
  
  	/* Enable access to the DMA observation bus */
-@@ -727,6 +727,16 @@ bool ath9k_hw_stopdmarecv(struct ath_hw 
+@@ -735,6 +735,16 @@ bool ath9k_hw_stopdmarecv(struct ath_hw 
  	}
  
  	if (i == 0) {
diff --git a/package/mac80211/patches/553-ath9k_debugfs_diag.patch b/package/mac80211/patches/553-ath9k_debugfs_diag.patch
index d18f7116d8..0e1572af9a 100644
--- a/package/mac80211/patches/553-ath9k_debugfs_diag.patch
+++ b/package/mac80211/patches/553-ath9k_debugfs_diag.patch
@@ -1,7 +1,7 @@
 --- a/drivers/net/wireless/ath/ath9k/debug.c
 +++ b/drivers/net/wireless/ath/ath9k/debug.c
-@@ -2158,6 +2158,50 @@ static const struct file_operations fops
- };
+@@ -1881,6 +1881,50 @@ static const struct file_operations fops
+ #endif
  
  
 +static ssize_t read_file_diag(struct file *file, char __user *user_buf,
@@ -51,7 +51,7 @@
  int ath9k_init_debug(struct ath_hw *ah)
  {
  	struct ath_common *common = ath9k_hw_common(ah);
-@@ -2183,6 +2227,8 @@ int ath9k_init_debug(struct ath_hw *ah)
+@@ -1906,6 +1950,8 @@ int ath9k_init_debug(struct ath_hw *ah)
  	debugfs_create_file("gpio_led", S_IWUSR,
  			   sc->debug.debugfs_phy, sc, &fops_gpio_led);
  #endif
@@ -62,7 +62,7 @@
  	debugfs_create_file("interrupt", S_IRUSR, sc->debug.debugfs_phy, sc,
 --- a/drivers/net/wireless/ath/ath9k/hw.h
 +++ b/drivers/net/wireless/ath/ath9k/hw.h
-@@ -499,6 +499,12 @@ enum {
+@@ -495,6 +495,12 @@ enum {
  	ATH9K_RESET_COLD,
  };
  
@@ -75,7 +75,7 @@
  struct ath9k_hw_version {
  	u32 magic;
  	u16 devid;
-@@ -777,6 +783,8 @@ struct ath_hw {
+@@ -773,6 +779,8 @@ struct ath_hw {
  	u32 rfkill_polarity;
  	u32 ah_flags;
  
@@ -84,17 +84,17 @@
  	bool reset_power_on;
  	bool htc_reset_init;
  
-@@ -1027,6 +1035,7 @@ void ath9k_hw_set_sta_beacon_timers(stru
+@@ -1020,6 +1028,7 @@ void ath9k_hw_set_sta_beacon_timers(stru
  bool ath9k_hw_check_alive(struct ath_hw *ah);
  
  bool ath9k_hw_setpower(struct ath_hw *ah, enum ath9k_power_mode mode);
 +void ath9k_hw_update_diag(struct ath_hw *ah);
  
- #ifdef CONFIG_ATH9K_DEBUGFS
+ #ifdef CPTCFG_ATH9K_DEBUGFS
  void ath9k_debug_sync_cause(struct ath_common *common, u32 sync_cause);
 --- a/drivers/net/wireless/ath/ath9k/hw.c
 +++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -1862,6 +1862,20 @@ fail:
+@@ -1853,6 +1853,20 @@ fail:
  	return -EINVAL;
  }
  
@@ -115,7 +115,7 @@
  int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
  		   struct ath9k_hw_cal_data *caldata, bool fastcc)
  {
-@@ -2063,6 +2077,7 @@ int ath9k_hw_reset(struct ath_hw *ah, st
+@@ -2055,6 +2069,7 @@ int ath9k_hw_reset(struct ath_hw *ah, st
  	}
  
  	ath9k_hw_apply_gpio_override(ah);
@@ -125,7 +125,7 @@
  		REG_SET_BIT(ah, AR_BTCOEX_WL_LNADIV, AR_BTCOEX_WL_LNADIV_FORCE_ON);
 --- a/drivers/net/wireless/ath/ath9k/main.c
 +++ b/drivers/net/wireless/ath/ath9k/main.c
-@@ -463,6 +463,11 @@ irqreturn_t ath_isr(int irq, void *dev)
+@@ -462,6 +462,11 @@ irqreturn_t ath_isr(int irq, void *dev)
  	ath9k_hw_getisr(ah, &status);	/* NB: clears ISR too */
  	status &= ah->imask;	/* discard unasked-for bits */
  
diff --git a/package/mac80211/patches/554-ath9k_ani_mrc_fix.patch b/package/mac80211/patches/554-ath9k_ani_mrc_fix.patch
index 8a4ce06be4..3bee413970 100644
--- a/package/mac80211/patches/554-ath9k_ani_mrc_fix.patch
+++ b/package/mac80211/patches/554-ath9k_ani_mrc_fix.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
 +++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
-@@ -1076,6 +1076,10 @@ static bool ar9003_hw_ani_control(struct
+@@ -1136,6 +1136,10 @@ skip_ws_det:
  		 * is_on == 0 means MRC CCK is OFF (more noise imm)
  		 */
  		bool is_on = param ? 1 : 0;
diff --git a/package/mac80211/patches/555-ath9k-allow-to-disable-bands-via-platform-data.patch b/package/mac80211/patches/555-ath9k-allow-to-disable-bands-via-platform-data.patch
index 2c40318bdc..fc0243162f 100644
--- a/package/mac80211/patches/555-ath9k-allow-to-disable-bands-via-platform-data.patch
+++ b/package/mac80211/patches/555-ath9k-allow-to-disable-bands-via-platform-data.patch
@@ -12,7 +12,7 @@
  
 --- a/drivers/net/wireless/ath/ath9k/hw.c
 +++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -2456,17 +2456,25 @@ int ath9k_hw_fill_cap_info(struct ath_hw
+@@ -2448,17 +2448,25 @@ int ath9k_hw_fill_cap_info(struct ath_hw
  	}
  
  	eeval = ah->eep_ops->get_eeprom(ah, EEP_OP_MODE);
@@ -48,7 +48,7 @@
  	    AR_SREV_9285(ah) ||
 --- a/drivers/net/wireless/ath/ath9k/hw.h
 +++ b/drivers/net/wireless/ath/ath9k/hw.h
-@@ -947,6 +947,8 @@ struct ath_hw {
+@@ -940,6 +940,8 @@ struct ath_hw {
  	bool is_clk_25mhz;
  	int (*get_mac_revision)(void);
  	int (*external_reset)(void);
@@ -59,7 +59,7 @@
  };
 --- a/drivers/net/wireless/ath/ath9k/init.c
 +++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -593,6 +593,8 @@ static int ath9k_init_softc(u16 devid, s
+@@ -592,6 +592,8 @@ static int ath9k_init_softc(u16 devid, s
  		ah->is_clk_25mhz = pdata->is_clk_25mhz;
  		ah->get_mac_revision = pdata->get_mac_revision;
  		ah->external_reset = pdata->external_reset;
diff --git a/package/mac80211/patches/601-rt2x00-set_pci_mwi.patch b/package/mac80211/patches/601-rt2x00-set_pci_mwi.patch
index 225b6207eb..d9a20bc107 100644
--- a/package/mac80211/patches/601-rt2x00-set_pci_mwi.patch
+++ b/package/mac80211/patches/601-rt2x00-set_pci_mwi.patch
@@ -6,8 +6,8 @@
  
 +#ifdef CONFIG_PCI_SET_MWI
  	if (pci_set_mwi(pci_dev))
- 		ERROR_PROBE("MWI not available.\n");
+ 		rt2x00_probe_err("MWI not available\n");
 +#endif
  
  	if (dma_set_mask(&pci_dev->dev, DMA_BIT_MASK(32))) {
- 		ERROR_PROBE("PCI DMA not supported.\n");
+ 		rt2x00_probe_err("PCI DMA not supported\n");
diff --git a/package/mac80211/patches/603-rt2x00-introduce-rt2x00eeprom.patch b/package/mac80211/patches/603-rt2x00-introduce-rt2x00eeprom.patch
index 0c9cf81ccf..40a2576d7a 100644
--- a/package/mac80211/patches/603-rt2x00-introduce-rt2x00eeprom.patch
+++ b/package/mac80211/patches/603-rt2x00-introduce-rt2x00eeprom.patch
@@ -41,30 +41,30 @@
 +
 +	ee_name = rt2x00dev->ops->lib->get_eeprom_file_name(rt2x00dev);
 +	if (!ee_name) {
-+		ERROR(rt2x00dev,
-+		      "Invalid EEPROM filename.\n"
-+		      "Please file bug report to %s.\n", DRV_PROJECT);
++		rt2x00_err(rt2x00dev,
++			   "Invalid EEPROM filename.\n"
++			   "Please file bug report to %s.\n", DRV_PROJECT);
 +		return -EINVAL;
 +	}
 +
-+	INFO(rt2x00dev, "Loading EEPROM data from '%s'.\n", ee_name);
++	rt2x00_info(rt2x00dev, "Loading EEPROM data from '%s'.\n", ee_name);
 +
 +	retval = request_firmware(&ee, ee_name, rt2x00dev->dev);
 +	if (retval) {
-+		ERROR(rt2x00dev, "Failed to request EEPROM.\n");
++		rt2x00_err(rt2x00dev, "Failed to request EEPROM.\n");
 +		return retval;
 +	}
 +
 +	if (!ee || !ee->size || !ee->data) {
-+		ERROR(rt2x00dev, "Failed to read EEPROM file.\n");
++		rt2x00_err(rt2x00dev, "Failed to read EEPROM file.\n");
 +		retval = -ENOENT;
 +		goto err_exit;
 +	}
 +
 +	if (ee->size != rt2x00dev->ops->eeprom_size) {
-+		ERROR(rt2x00dev,
-+		      "EEPROM file size is invalid, it should be %d bytes\n",
-+		      rt2x00dev->ops->eeprom_size);
++		rt2x00_err(rt2x00dev,
++			   "EEPROM file size is invalid, it should be %d bytes\n",
++			   rt2x00dev->ops->eeprom_size);
 +		retval = -EINVAL;
 +		goto err_release_ee;
 +	}
@@ -101,7 +101,7 @@
 +}
 --- a/drivers/net/wireless/rt2x00/rt2x00.h
 +++ b/drivers/net/wireless/rt2x00/rt2x00.h
-@@ -560,6 +560,7 @@ struct rt2x00lib_ops {
+@@ -549,6 +549,7 @@ struct rt2x00lib_ops {
  			       const u8 *data, const size_t len);
  	int (*load_firmware) (struct rt2x00_dev *rt2x00dev,
  			      const u8 *data, const size_t len);
@@ -109,7 +109,7 @@
  
  	/*
  	 * Device initialization/deinitialization handlers.
-@@ -720,6 +721,7 @@ enum rt2x00_capability_flags {
+@@ -705,6 +706,7 @@ enum rt2x00_capability_flags {
  	REQUIRE_SW_SEQNO,
  	REQUIRE_HT_TX_DESC,
  	REQUIRE_PS_AUTOWAKE,
@@ -117,7 +117,7 @@
  
  	/*
  	 * Capabilities
-@@ -989,6 +991,11 @@ struct rt2x00_dev {
+@@ -974,6 +976,11 @@ struct rt2x00_dev {
  	const struct firmware *fw;
  
  	/*
@@ -132,12 +132,12 @@
 --- a/drivers/net/wireless/rt2x00/rt2x00lib.h
 +++ b/drivers/net/wireless/rt2x00/rt2x00lib.h
 @@ -322,6 +322,22 @@ static inline void rt2x00lib_free_firmwa
- #endif /* CONFIG_RT2X00_LIB_FIRMWARE */
+ #endif /* CPTCFG_RT2X00_LIB_FIRMWARE */
  
  /*
 + * EEPROM file handlers.
 + */
-+#ifdef CONFIG_RT2X00_LIB_EEPROM
++#ifdef CPTCFG_RT2X00_LIB_EEPROM
 +int rt2x00lib_load_eeprom_file(struct rt2x00_dev *rt2x00dev);
 +void rt2x00lib_free_eeprom_file(struct rt2x00_dev *rt2x00dev);
 +#else
@@ -148,23 +148,23 @@
 +static inline void rt2x00lib_free_eeprom_file(struct rt2x00_dev *rt2x00dev)
 +{
 +}
-+#endif /* CONFIG_RT2X00_LIB_EEPROM_FILE */
++#endif /* CPTCFG_RT2X00_LIB_EEPROM */
 +
 +/*
   * Debugfs handlers.
   */
- #ifdef CONFIG_RT2X00_LIB_DEBUGFS
+ #ifdef CPTCFG_RT2X00_LIB_DEBUGFS
 --- a/drivers/net/wireless/rt2x00/Kconfig
 +++ b/drivers/net/wireless/rt2x00/Kconfig
-@@ -64,6 +64,7 @@ config RT2800PCI
+@@ -69,6 +69,7 @@ config RT2800PCI
  	select RT2X00_LIB_PCI if PCI
  	select RT2X00_LIB_SOC if SOC_RT288X || SOC_RT305X
  	select RT2X00_LIB_FIRMWARE
 +	select RT2X00_LIB_EEPROM
  	select RT2X00_LIB_CRYPTO
- 	select CRC_CCITT
- 	select EEPROM_93CX6
-@@ -221,6 +222,9 @@ config RT2X00_LIB_FIRMWARE
+ 	depends on CRC_CCITT
+ 	depends on EEPROM_93CX6
+@@ -235,6 +236,9 @@ config RT2X00_LIB_FIRMWARE
  config RT2X00_LIB_CRYPTO
  	boolean
  
@@ -172,18 +172,18 @@
 +	boolean
 +
  config RT2X00_LIB_LEDS
+ 	depends on !BACKPORT_KERNEL_2_6_25
  	boolean
- 	default y if (RT2X00_LIB=y && LEDS_CLASS=y) || (RT2X00_LIB=m && LEDS_CLASS!=n)
 --- a/drivers/net/wireless/rt2x00/Makefile
 +++ b/drivers/net/wireless/rt2x00/Makefile
-@@ -7,6 +7,7 @@ rt2x00lib-$(CONFIG_RT2X00_LIB_DEBUGFS)	+
- rt2x00lib-$(CONFIG_RT2X00_LIB_CRYPTO)	+= rt2x00crypto.o
- rt2x00lib-$(CONFIG_RT2X00_LIB_FIRMWARE)	+= rt2x00firmware.o
- rt2x00lib-$(CONFIG_RT2X00_LIB_LEDS)	+= rt2x00leds.o
-+rt2x00lib-$(CONFIG_RT2X00_LIB_EEPROM)	+= rt2x00eeprom.o
+@@ -7,6 +7,7 @@ rt2x00lib-$(CPTCFG_RT2X00_LIB_DEBUGFS)	+
+ rt2x00lib-$(CPTCFG_RT2X00_LIB_CRYPTO)	+= rt2x00crypto.o
+ rt2x00lib-$(CPTCFG_RT2X00_LIB_FIRMWARE)	+= rt2x00firmware.o
+ rt2x00lib-$(CPTCFG_RT2X00_LIB_LEDS)	+= rt2x00leds.o
++rt2x00lib-$(CPTCFG_RT2X00_LIB_EEPROM)	+= rt2x00eeprom.o
  
- obj-$(CONFIG_RT2X00_LIB)		+= rt2x00lib.o
- obj-$(CONFIG_RT2X00_LIB_MMIO)		+= rt2x00mmio.o
+ obj-$(CPTCFG_RT2X00_LIB)		+= rt2x00lib.o
+ obj-$(CPTCFG_RT2X00_LIB_MMIO)		+= rt2x00mmio.o
 --- a/drivers/net/wireless/rt2x00/rt2800pci.c
 +++ b/drivers/net/wireless/rt2x00/rt2800pci.c
 @@ -90,25 +90,11 @@ static void rt2800pci_mcu_status(struct 
@@ -234,7 +234,7 @@
   * Initialization functions.
   */
  static bool rt2800pci_get_entry_state(struct queue_entry *entry)
-@@ -1162,6 +1162,7 @@ static const struct rt2x00lib_ops rt2800
+@@ -1155,6 +1155,7 @@ static const struct rt2x00lib_ops rt2800
  	.get_firmware_name	= rt2800pci_get_firmware_name,
  	.check_firmware		= rt2800_check_firmware,
  	.load_firmware		= rt2800_load_firmware,
@@ -244,18 +244,18 @@
  	.get_entry_state	= rt2800pci_get_entry_state,
 --- a/drivers/net/wireless/rt2x00/rt2x00dev.c
 +++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
-@@ -1318,6 +1318,10 @@ int rt2x00lib_probe_dev(struct rt2x00_de
- 
- 	rt2x00dev->hw->wiphy->flags |= WIPHY_FLAG_IBSS_RSN;
+@@ -1325,6 +1325,10 @@ int rt2x00lib_probe_dev(struct rt2x00_de
+ 	INIT_DELAYED_WORK(&rt2x00dev->autowakeup_work, rt2x00lib_autowakeup);
+ 	INIT_WORK(&rt2x00dev->sleep_work, rt2x00lib_sleep);
  
 +	retval = rt2x00lib_load_eeprom_file(rt2x00dev);
 +	if (retval)
 +		goto exit;
 +
  	/*
- 	 * Initialize work.
+ 	 * Let the driver probe the device to detect the capabilities.
  	 */
-@@ -1442,6 +1446,11 @@ void rt2x00lib_remove_dev(struct rt2x00_
+@@ -1455,6 +1459,11 @@ void rt2x00lib_remove_dev(struct rt2x00_
  	 */
  	if (rt2x00dev->drv_data)
  		kfree(rt2x00dev->drv_data);
@@ -277,3 +277,13 @@
  
  	rt2x00_set_chip_intf(rt2x00dev, RT2X00_CHIP_INTF_SOC);
  
+--- a/.local-symbols
++++ b/.local-symbols
+@@ -272,6 +272,7 @@ RT2X00_LIB_FIRMWARE=
+ RT2X00_LIB_CRYPTO=
+ RT2X00_LIB_LEDS=
+ RT2X00_LIB_DEBUGFS=
++RT2X00_LIB_EEPROM=
+ RT2X00_DEBUG=
+ RTLWIFI=
+ RTLWIFI_DEBUG=
diff --git a/package/mac80211/patches/604-rt2x00-add-CONFIG_RT2X00_LIB_EEPROM-option.patch b/package/mac80211/patches/604-rt2x00-add-CONFIG_RT2X00_LIB_EEPROM-option.patch
deleted file mode 100644
index 31b58d93d2..0000000000
--- a/package/mac80211/patches/604-rt2x00-add-CONFIG_RT2X00_LIB_EEPROM-option.patch
+++ /dev/null
@@ -1,10 +0,0 @@
---- a/config.mk
-+++ b/config.mk
-@@ -647,6 +647,7 @@ export CONFIG_RT2X00=y
- export CONFIG_RT2X00_LIB=m
- export CONFIG_RT2800_LIB=m
- export CONFIG_RT2X00_LIB_FIRMWARE=y
-+export CONFIG_RT2X00_LIB_EEPROM=y
- export CONFIG_RT2X00_LIB_CRYPTO=y
- # export CONFIG_RT2X00_LIB_SOC=y
- ifdef CONFIG_COMPAT_KERNEL_2_6_25
diff --git a/package/mac80211/patches/605-rt2x00-pci-eeprom.patch b/package/mac80211/patches/605-rt2x00-pci-eeprom.patch
index 4defba681f..d37f3acc28 100644
--- a/package/mac80211/patches/605-rt2x00-pci-eeprom.patch
+++ b/package/mac80211/patches/605-rt2x00-pci-eeprom.patch
@@ -9,7 +9,7 @@
  {
  	memcpy(rt2x00dev->eeprom, rt2x00dev->eeprom_file->data, EEPROM_SIZE);
  	return 0;
-@@ -1099,8 +1099,9 @@ static int rt2800pci_read_eeprom(struct 
+@@ -1092,8 +1092,9 @@ static int rt2800pci_read_eeprom(struct 
  {
  	int retval;
  
@@ -31,7 +31,7 @@
  	struct rt2x00_dev *rt2x00dev;
  	int retval;
  	u16 chip;
-@@ -123,6 +124,12 @@ int rt2x00pci_probe(struct pci_dev *pci_
+@@ -125,6 +126,12 @@ int rt2x00pci_probe(struct pci_dev *pci_
  	rt2x00dev->irq = pci_dev->irq;
  	rt2x00dev->name = pci_name(pci_dev);
  
diff --git a/package/mac80211/patches/606-rt2x00_no_realign.patch b/package/mac80211/patches/606-rt2x00_no_realign.patch
index 202570157e..9608df2e20 100644
--- a/package/mac80211/patches/606-rt2x00_no_realign.patch
+++ b/package/mac80211/patches/606-rt2x00_no_realign.patch
@@ -24,7 +24,7 @@ Helmut
 
 --- a/drivers/net/wireless/rt2x00/rt2x00queue.c
 +++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
-@@ -162,36 +162,14 @@ void rt2x00queue_align_frame(struct sk_b
+@@ -163,36 +163,14 @@ void rt2x00queue_align_frame(struct sk_b
  void rt2x00queue_insert_l2pad(struct sk_buff *skb, unsigned int header_length)
  {
  	unsigned int payload_length = skb->len - header_length;
diff --git a/package/mac80211/patches/607-rt2x00-allow_disabling_bands_through_platform_data.patch b/package/mac80211/patches/607-rt2x00-allow_disabling_bands_through_platform_data.patch
index 937f1c9cb2..5e6e27de98 100644
--- a/package/mac80211/patches/607-rt2x00-allow_disabling_bands_through_platform_data.patch
+++ b/package/mac80211/patches/607-rt2x00-allow_disabling_bands_through_platform_data.patch
@@ -12,7 +12,7 @@
  #endif /* _RT2X00_PLATFORM_H */
 --- a/drivers/net/wireless/rt2x00/rt2x00dev.c
 +++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
-@@ -939,6 +939,22 @@ static int rt2x00lib_probe_hw_modes(stru
+@@ -938,6 +938,22 @@ static int rt2x00lib_probe_hw_modes(stru
  	unsigned int num_rates;
  	unsigned int i;
  
@@ -27,7 +27,7 @@
 +	}
 +
 +	if ((spec->supported_bands & SUPPORT_BAND_BOTH) == 0) {
-+		ERROR(rt2x00dev, "No supported bands\n");
++		rt2x00_err(rt2x00dev, "No supported bands\n");
 +		return -EINVAL;
 +	}
 +
@@ -37,7 +37,7 @@
  		num_rates += 4;
 --- a/drivers/net/wireless/rt2x00/rt2x00.h
 +++ b/drivers/net/wireless/rt2x00/rt2x00.h
-@@ -425,6 +425,7 @@ struct hw_mode_spec {
+@@ -414,6 +414,7 @@ struct hw_mode_spec {
  	unsigned int supported_bands;
  #define SUPPORT_BAND_2GHZ	0x00000001
  #define SUPPORT_BAND_5GHZ	0x00000002
diff --git a/package/mac80211/patches/608-add_platform_data_mac_addr.patch b/package/mac80211/patches/608-add_platform_data_mac_addr.patch
index 97307f01a9..0695b893b5 100644
--- a/package/mac80211/patches/608-add_platform_data_mac_addr.patch
+++ b/package/mac80211/patches/608-add_platform_data_mac_addr.patch
@@ -10,7 +10,7 @@
  	int disable_5ghz;
 --- a/drivers/net/wireless/rt2x00/rt2x00dev.c
 +++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
-@@ -930,6 +930,18 @@ static void rt2x00lib_rate(struct ieee80
+@@ -929,6 +929,18 @@ static void rt2x00lib_rate(struct ieee80
  		entry->flags |= IEEE80211_RATE_SHORT_PREAMBLE;
  }
  
@@ -31,7 +31,7 @@
  {
 --- a/drivers/net/wireless/rt2x00/rt2x00.h
 +++ b/drivers/net/wireless/rt2x00/rt2x00.h
-@@ -1337,6 +1337,7 @@ static inline void rt2x00debug_dump_fram
+@@ -1326,6 +1326,7 @@ static inline void rt2x00debug_dump_fram
   */
  u32 rt2x00lib_get_bssidx(struct rt2x00_dev *rt2x00dev,
  			 struct ieee80211_vif *vif);
@@ -41,7 +41,7 @@
   * Interrupt context handlers.
 --- a/drivers/net/wireless/rt2x00/rt61pci.c
 +++ b/drivers/net/wireless/rt2x00/rt61pci.c
-@@ -2396,6 +2396,7 @@ static int rt61pci_validate_eeprom(struc
+@@ -2395,6 +2395,7 @@ static int rt61pci_validate_eeprom(struc
  	u32 reg;
  	u16 word;
  	u8 *mac;
@@ -49,7 +49,7 @@
  	s8 value;
  
  	rt2x00mmio_register_read(rt2x00dev, E2PROM_CSR, &reg);
-@@ -2416,7 +2417,11 @@ static int rt61pci_validate_eeprom(struc
+@@ -2415,7 +2416,11 @@ static int rt61pci_validate_eeprom(struc
  	/*
  	 * Start validation of the data that has been read.
  	 */
@@ -60,4 +60,4 @@
 +
  	if (!is_valid_ether_addr(mac)) {
  		eth_random_addr(mac);
- 		EEPROM(rt2x00dev, "MAC: %pM\n", mac);
+ 		rt2x00_eeprom_dbg(rt2x00dev, "MAC: %pM\n", mac);
diff --git a/package/mac80211/patches/610-rt2x00-fix-rt3352-ext-pa.patch b/package/mac80211/patches/610-rt2x00-fix-rt3352-ext-pa.patch
index 7c76b5a9fd..f5709d9846 100644
--- a/package/mac80211/patches/610-rt2x00-fix-rt3352-ext-pa.patch
+++ b/package/mac80211/patches/610-rt2x00-fix-rt3352-ext-pa.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/rt2x00/rt2800lib.c
 +++ b/drivers/net/wireless/rt2x00/rt2800lib.c
-@@ -2622,15 +2622,18 @@ static void rt2800_config_channel(struct
+@@ -2631,15 +2631,18 @@ static void rt2800_config_channel(struct
  	/*
  	 * Change BBP settings
  	 */
@@ -22,15 +22,7 @@
  		rt2800_bbp_write(rt2x00dev, 86, 0);
  	}
  
-@@ -4203,6 +4206,7 @@ static int rt2800_init_bbp(struct rt2x00
- 		rt2800_bbp_write(rt2x00dev, 120, 0x50);
- 
- 	if (rt2x00_rt(rt2x00dev, RT3290) ||
-+	    rt2x00_rt(rt2x00dev, RT3352) ||
- 	    rt2x00_rt(rt2x00dev, RT5390) ||
- 	    rt2x00_rt(rt2x00dev, RT5392))
- 		rt2800_bbp_write(rt2x00dev, 128, 0x12);
-@@ -4507,6 +4511,12 @@ static void rt2800_init_rfcsr_3290(struc
+@@ -4948,6 +4951,12 @@ static void rt2800_init_rfcsr_3290(struc
  
  static void rt2800_init_rfcsr_3352(struct rt2x00_dev *rt2x00dev)
  {
@@ -40,10 +32,10 @@
 +				  &rt2x00dev->cap_flags);
 +	u8 rfcsr;
 +
+ 	rt2800_rf_init_calibration(rt2x00dev, 30);
+ 
  	rt2800_rfcsr_write(rt2x00dev, 0, 0xf0);
- 	rt2800_rfcsr_write(rt2x00dev, 1, 0x23);
- 	rt2800_rfcsr_write(rt2x00dev, 2, 0x50);
-@@ -4540,15 +4550,30 @@ static void rt2800_init_rfcsr_3352(struc
+@@ -4983,15 +4992,30 @@ static void rt2800_init_rfcsr_3352(struc
  	rt2800_rfcsr_write(rt2x00dev, 31, 0x80);
  	rt2800_rfcsr_write(rt2x00dev, 32, 0x80);
  	rt2800_rfcsr_write(rt2x00dev, 33, 0x00);
@@ -53,7 +45,7 @@
 +		rt2x00_set_field8(&rfcsr, RFCSR34_TX0_EXT_PA, 1);
 +	if (!tx1_int_pa)
 +		rt2x00_set_field8(&rfcsr, RFCSR34_TX1_EXT_PA, 1);
-+	rt2800_rfcsr_write(rt2x00dev, 34, rfcsr );
++	rt2800_rfcsr_write(rt2x00dev, 34, rfcsr);
  	rt2800_rfcsr_write(rt2x00dev, 35, 0x03);
  	rt2800_rfcsr_write(rt2x00dev, 36, 0xbd);
  	rt2800_rfcsr_write(rt2x00dev, 37, 0x3c);
@@ -77,7 +69,7 @@
  	rt2800_rfcsr_write(rt2x00dev, 43, 0xdb);
  	rt2800_rfcsr_write(rt2x00dev, 44, 0xdb);
  	rt2800_rfcsr_write(rt2x00dev, 45, 0xdb);
-@@ -4556,15 +4581,20 @@ static void rt2800_init_rfcsr_3352(struc
+@@ -4999,15 +5023,20 @@ static void rt2800_init_rfcsr_3352(struc
  	rt2800_rfcsr_write(rt2x00dev, 47, 0x0d);
  	rt2800_rfcsr_write(rt2x00dev, 48, 0x14);
  	rt2800_rfcsr_write(rt2x00dev, 49, 0x00);
@@ -107,7 +99,15 @@
  	rt2800_rfcsr_write(rt2x00dev, 59, 0x00);
  	rt2800_rfcsr_write(rt2x00dev, 60, 0x00);
  	rt2800_rfcsr_write(rt2x00dev, 61, 0x00);
-@@ -5534,7 +5564,8 @@ static int rt2800_init_eeprom(struct rt2
+@@ -5692,6 +5721,7 @@ static int rt2800_init_eeprom(struct rt2
+ 	 * RT53xx: defined in "EEPROM_CHIP_ID" field
+ 	 */
+ 	if (rt2x00_rt(rt2x00dev, RT3290) ||
++	    rt2x00_rt(rt2x00dev, RT3352) ||
+ 	    rt2x00_rt(rt2x00dev, RT5390) ||
+ 	    rt2x00_rt(rt2x00dev, RT5392))
+ 		rt2x00_eeprom_read(rt2x00dev, EEPROM_CHIP_ID, &rf);
+@@ -5781,7 +5811,8 @@ static int rt2800_init_eeprom(struct rt2
  	/*
  	 * Detect if this device has Bluetooth co-existence.
  	 */
@@ -117,7 +117,7 @@
  		__set_bit(CAPABILITY_BT_COEXIST, &rt2x00dev->cap_flags);
  
  	/*
-@@ -5563,6 +5594,22 @@ static int rt2800_init_eeprom(struct rt2
+@@ -5810,6 +5841,22 @@ static int rt2800_init_eeprom(struct rt2
  					EIRP_MAX_TX_POWER_LIMIT)
  		__set_bit(CAPABILITY_POWER_LIMIT, &rt2x00dev->cap_flags);
  
@@ -203,7 +203,7 @@
   * EEPROM frequency
 --- a/drivers/net/wireless/rt2x00/rt2x00.h
 +++ b/drivers/net/wireless/rt2x00/rt2x00.h
-@@ -741,6 +741,8 @@ enum rt2x00_capability_flags {
+@@ -726,6 +726,8 @@ enum rt2x00_capability_flags {
  	CAPABILITY_DOUBLE_ANTENNA,
  	CAPABILITY_BT_COEXIST,
  	CAPABILITY_VCO_RECALIBRATION,
diff --git a/package/mac80211/patches/611-rt2x00-rf_vals-rt3352-xtal20.patch b/package/mac80211/patches/611-rt2x00-rf_vals-rt3352-xtal20.patch
index 4c81b5e220..81df685043 100644
--- a/package/mac80211/patches/611-rt2x00-rf_vals-rt3352-xtal20.patch
+++ b/package/mac80211/patches/611-rt2x00-rf_vals-rt3352-xtal20.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/rt2x00/rt2800lib.c
 +++ b/drivers/net/wireless/rt2x00/rt2800lib.c
-@@ -5886,6 +5886,27 @@ static const struct rf_channel rf_vals_5
+@@ -6133,6 +6133,27 @@ static const struct rf_channel rf_vals_5
  	{196, 83, 0, 12, 1},
  };
  
@@ -28,7 +28,7 @@
  static int rt2800_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
  {
  	struct hw_mode_spec *spec = &rt2x00dev->spec;
-@@ -5964,7 +5985,6 @@ static int rt2800_probe_hw_mode(struct r
+@@ -6211,7 +6232,6 @@ static int rt2800_probe_hw_mode(struct r
  		   rt2x00_rf(rt2x00dev, RF3022) ||
  		   rt2x00_rf(rt2x00dev, RF3290) ||
  		   rt2x00_rf(rt2x00dev, RF3320) ||
@@ -36,7 +36,7 @@
  		   rt2x00_rf(rt2x00dev, RF5360) ||
  		   rt2x00_rf(rt2x00dev, RF5370) ||
  		   rt2x00_rf(rt2x00dev, RF5372) ||
-@@ -5972,6 +5992,12 @@ static int rt2800_probe_hw_mode(struct r
+@@ -6219,6 +6239,12 @@ static int rt2800_probe_hw_mode(struct r
  		   rt2x00_rf(rt2x00dev, RF5392)) {
  		spec->num_channels = 14;
  		spec->channels = rf_vals_3x;
@@ -49,7 +49,7 @@
  	} else if (rt2x00_rf(rt2x00dev, RF3052)) {
  		spec->supported_bands |= SUPPORT_BAND_5GHZ;
  		spec->num_channels = ARRAY_SIZE(rf_vals_3x);
-@@ -6120,6 +6146,19 @@ static int rt2800_probe_rt(struct rt2x00
+@@ -6366,6 +6392,19 @@ static int rt2800_probe_rt(struct rt2x00
  	return 0;
  }
  
@@ -69,7 +69,7 @@
  int rt2800_probe_hw(struct rt2x00_dev *rt2x00dev)
  {
  	int retval;
-@@ -6149,6 +6188,15 @@ int rt2800_probe_hw(struct rt2x00_dev *r
+@@ -6395,6 +6434,15 @@ int rt2800_probe_hw(struct rt2x00_dev *r
  	rt2800_register_write(rt2x00dev, GPIO_CTRL, reg);
  
  	/*
@@ -87,7 +87,7 @@
  	retval = rt2800_probe_hw_mode(rt2x00dev);
 --- a/drivers/net/wireless/rt2x00/rt2x00.h
 +++ b/drivers/net/wireless/rt2x00/rt2x00.h
-@@ -420,6 +420,7 @@ static inline struct rt2x00_intf* vif_to
+@@ -409,6 +409,7 @@ static inline struct rt2x00_intf* vif_to
   * @channels: Device/chipset specific channel values (See &struct rf_channel).
   * @channels_info: Additional information for channels (See &struct channel_info).
   * @ht: Driver HT Capabilities (See &ieee80211_sta_ht_cap).
@@ -95,7 +95,7 @@
   */
  struct hw_mode_spec {
  	unsigned int supported_bands;
-@@ -436,6 +437,7 @@ struct hw_mode_spec {
+@@ -425,6 +426,7 @@ struct hw_mode_spec {
  	const struct channel_info *channels_info;
  
  	struct ieee80211_sta_ht_cap ht;
diff --git a/package/mac80211/patches/612-rt2x00-make-wmac-loadable-via-OF-on-rt288x-305x-SoC.patch b/package/mac80211/patches/612-rt2x00-make-wmac-loadable-via-OF-on-rt288x-305x-SoC.patch
index 0ed680cf77..6b783bc6e8 100644
--- a/package/mac80211/patches/612-rt2x00-make-wmac-loadable-via-OF-on-rt288x-305x-SoC.patch
+++ b/package/mac80211/patches/612-rt2x00-make-wmac-loadable-via-OF-on-rt288x-305x-SoC.patch
@@ -13,7 +13,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
 
 --- a/drivers/net/wireless/rt2x00/rt2800pci.c
 +++ b/drivers/net/wireless/rt2x00/rt2800pci.c
-@@ -1301,11 +1301,18 @@ static int rt2800soc_probe(struct platfo
+@@ -1308,11 +1308,18 @@ static int rt2800soc_probe(struct platfo
  	return rt2x00soc_probe(pdev, &rt2800pci_ops);
  }
  
diff --git a/package/mac80211/patches/614-rt2x00-of_load_eeprom_filename.patch b/package/mac80211/patches/614-rt2x00-of_load_eeprom_filename.patch
index 55e40a2d86..293b71a183 100644
--- a/package/mac80211/patches/614-rt2x00-of_load_eeprom_filename.patch
+++ b/package/mac80211/patches/614-rt2x00-of_load_eeprom_filename.patch
@@ -1,6 +1,14 @@
 --- a/drivers/net/wireless/rt2x00/rt2800pci.c
 +++ b/drivers/net/wireless/rt2x00/rt2800pci.c
-@@ -323,11 +323,17 @@ static int rt2800pci_write_firmware(stru
+@@ -39,6 +39,7 @@
+ #include <linux/pci.h>
+ #include <linux/platform_device.h>
+ #include <linux/eeprom_93cx6.h>
++#include <linux/of.h>
+ 
+ #include "rt2x00.h"
+ #include "rt2x00mmio.h"
+@@ -323,11 +324,17 @@ static int rt2800pci_write_firmware(stru
  static char *rt2800pci_get_eeprom_file_name(struct rt2x00_dev *rt2x00dev)
  {
  	struct rt2x00_platform_data *pdata;
diff --git a/package/mac80211/patches/615-rt2x00-fix_20mhz_clk.patch b/package/mac80211/patches/615-rt2x00-fix_20mhz_clk.patch
index 59424e9e56..a0dc81c28d 100644
--- a/package/mac80211/patches/615-rt2x00-fix_20mhz_clk.patch
+++ b/package/mac80211/patches/615-rt2x00-fix_20mhz_clk.patch
@@ -8,7 +8,7 @@
  
  #include "rt2x00.h"
  #include "rt2800lib.h"
-@@ -6148,13 +6149,14 @@ static int rt2800_probe_rt(struct rt2x00
+@@ -6394,13 +6395,14 @@ static int rt2800_probe_rt(struct rt2x00
  
  int rt2800_probe_clk(struct rt2x00_dev *rt2x00dev)
  {
diff --git a/package/mac80211/patches/616-rt2x00-support-rt5350.patch b/package/mac80211/patches/616-rt2x00-support-rt5350.patch
index 93c1d615a2..79e864ba89 100644
--- a/package/mac80211/patches/616-rt2x00-support-rt5350.patch
+++ b/package/mac80211/patches/616-rt2x00-support-rt5350.patch
@@ -10,7 +10,7 @@
  #define RF5372				0x5372
 --- a/drivers/net/wireless/rt2x00/rt2800lib.c
 +++ b/drivers/net/wireless/rt2x00/rt2800lib.c
-@@ -2132,6 +2132,15 @@ static void rt2800_config_channel_rf53xx
+@@ -2141,6 +2141,15 @@ static void rt2800_config_channel_rf53xx
  	if (rf->channel <= 14) {
  		int idx = rf->channel-1;
  
@@ -26,7 +26,7 @@
  		if (test_bit(CAPABILITY_BT_COEXIST, &rt2x00dev->cap_flags)) {
  			if (rt2x00_rt_rev_gte(rt2x00dev, RT5390, REV_RT5390F)) {
  				/* r55/r59 value array of channel 1~14 */
-@@ -2589,6 +2598,7 @@ static void rt2800_config_channel(struct
+@@ -2598,6 +2607,7 @@ static void rt2800_config_channel(struct
  	case RF3322:
  		rt2800_config_channel_rf3322(rt2x00dev, conf, rf, info);
  		break;
@@ -34,7 +34,7 @@
  	case RF5360:
  	case RF5370:
  	case RF5372:
-@@ -2605,6 +2615,7 @@ static void rt2800_config_channel(struct
+@@ -2614,6 +2624,7 @@ static void rt2800_config_channel(struct
  
  	if (rt2x00_rf(rt2x00dev, RF3290) ||
  	    rt2x00_rf(rt2x00dev, RF3322) ||
@@ -42,7 +42,7 @@
  	    rt2x00_rf(rt2x00dev, RF5360) ||
  	    rt2x00_rf(rt2x00dev, RF5370) ||
  	    rt2x00_rf(rt2x00dev, RF5372) ||
-@@ -2746,7 +2757,8 @@ static void rt2800_config_channel(struct
+@@ -2755,7 +2766,8 @@ static void rt2800_config_channel(struct
  	/*
  	 * Clear update flag
  	 */
@@ -52,7 +52,7 @@
  		rt2800_bbp_read(rt2x00dev, 49, &bbp);
  		rt2x00_set_field8(&bbp, BBP49_UPDATE_FLAG, 0);
  		rt2800_bbp_write(rt2x00dev, 49, bbp);
-@@ -3185,6 +3197,7 @@ void rt2800_vco_calibration(struct rt2x0
+@@ -3201,6 +3213,7 @@ void rt2800_vco_calibration(struct rt2x0
  		rt2800_rfcsr_write(rt2x00dev, 7, rfcsr);
  		break;
  	case RF3290:
@@ -60,7 +60,7 @@
  	case RF5360:
  	case RF5370:
  	case RF5372:
-@@ -3524,7 +3537,8 @@ static int rt2800_init_registers(struct 
+@@ -3540,7 +3553,8 @@ static int rt2800_init_registers(struct 
  	} else if (rt2x00_rt(rt2x00dev, RT3572)) {
  		rt2800_register_write(rt2x00dev, TX_SW_CFG0, 0x00000400);
  		rt2800_register_write(rt2x00dev, TX_SW_CFG1, 0x00080606);
@@ -70,182 +70,64 @@
  		   rt2x00_rt(rt2x00dev, RT5392) ||
  		   rt2x00_rt(rt2x00dev, RT5592)) {
  		rt2800_register_write(rt2x00dev, TX_SW_CFG0, 0x00000404);
-@@ -4043,6 +4057,10 @@ static int rt2800_init_bbp(struct rt2x00
- 		rt2800_bbp_write(rt2x00dev, 4, 0x50);
- 	}
- 
-+	if (rt2x00_rt(rt2x00dev, RT5350)) {
-+		rt2800_bbp_write(rt2x00dev, 4, 0x50);
-+	}
-+
- 	if (rt2x00_rt(rt2x00dev, RT3290) ||
- 	    rt2x00_rt(rt2x00dev, RT5390) ||
- 	    rt2x00_rt(rt2x00dev, RT5392))
-@@ -4052,11 +4070,13 @@ static int rt2800_init_bbp(struct rt2x00
- 	    rt2x00_rt(rt2x00dev, RT3290) ||
- 	    rt2x00_rt(rt2x00dev, RT3352) ||
- 	    rt2x00_rt(rt2x00dev, RT3572) ||
-+	    rt2x00_rt(rt2x00dev, RT5350) ||
- 	    rt2x00_rt(rt2x00dev, RT5390) ||
- 	    rt2x00_rt(rt2x00dev, RT5392))
- 		rt2800_bbp_write(rt2x00dev, 31, 0x08);
- 
--	if (rt2x00_rt(rt2x00dev, RT3352))
-+	if (rt2x00_rt(rt2x00dev, RT3352) ||
-+	    rt2x00_rt(rt2x00dev, RT5350))
- 		rt2800_bbp_write(rt2x00dev, 47, 0x48);
- 
- 	rt2800_bbp_write(rt2x00dev, 65, 0x2c);
-@@ -4064,6 +4084,7 @@ static int rt2800_init_bbp(struct rt2x00
- 
- 	if (rt2x00_rt(rt2x00dev, RT3290) ||
- 	    rt2x00_rt(rt2x00dev, RT3352) ||
-+	    rt2x00_rt(rt2x00dev, RT5350) ||
- 	    rt2x00_rt(rt2x00dev, RT5390) ||
- 	    rt2x00_rt(rt2x00dev, RT5392))
- 		rt2800_bbp_write(rt2x00dev, 68, 0x0b);
-@@ -4073,6 +4094,7 @@ static int rt2800_init_bbp(struct rt2x00
- 		rt2800_bbp_write(rt2x00dev, 73, 0x12);
- 	} else if (rt2x00_rt(rt2x00dev, RT3290) ||
- 		   rt2x00_rt(rt2x00dev, RT3352) ||
-+		   rt2x00_rt(rt2x00dev, RT5350) ||
- 		   rt2x00_rt(rt2x00dev, RT5390) ||
- 		   rt2x00_rt(rt2x00dev, RT5392)) {
- 		rt2800_bbp_write(rt2x00dev, 69, 0x12);
-@@ -4109,7 +4131,8 @@ static int rt2800_init_bbp(struct rt2x00
- 		rt2800_bbp_write(rt2x00dev, 79, 0x18);
- 		rt2800_bbp_write(rt2x00dev, 80, 0x09);
- 		rt2800_bbp_write(rt2x00dev, 81, 0x33);
--	} else if (rt2x00_rt(rt2x00dev, RT3352)) {
-+	} else if (rt2x00_rt(rt2x00dev, RT3352) ||
-+		rt2x00_rt(rt2x00dev, RT5350)) {
- 		rt2800_bbp_write(rt2x00dev, 78, 0x0e);
- 		rt2800_bbp_write(rt2x00dev, 80, 0x08);
- 		rt2800_bbp_write(rt2x00dev, 81, 0x37);
-@@ -4119,6 +4142,7 @@ static int rt2800_init_bbp(struct rt2x00
+@@ -4193,9 +4207,13 @@ static void rt2800_init_bbp_3352(struct 
  
  	rt2800_bbp_write(rt2x00dev, 82, 0x62);
- 	if (rt2x00_rt(rt2x00dev, RT3290) ||
-+	    rt2x00_rt(rt2x00dev, RT5350) ||
- 	    rt2x00_rt(rt2x00dev, RT5390) ||
- 	    rt2x00_rt(rt2x00dev, RT5392))
- 		rt2800_bbp_write(rt2x00dev, 83, 0x7a);
-@@ -4128,6 +4152,7 @@ static int rt2800_init_bbp(struct rt2x00
- 	if (rt2x00_rt_rev(rt2x00dev, RT2860, REV_RT2860D))
- 		rt2800_bbp_write(rt2x00dev, 84, 0x19);
- 	else if (rt2x00_rt(rt2x00dev, RT3290) ||
-+		 rt2x00_rt(rt2x00dev, RT5350) ||
- 		 rt2x00_rt(rt2x00dev, RT5390) ||
- 		 rt2x00_rt(rt2x00dev, RT5392))
- 		rt2800_bbp_write(rt2x00dev, 84, 0x9a);
-@@ -4136,6 +4161,7 @@ static int rt2800_init_bbp(struct rt2x00
- 
- 	if (rt2x00_rt(rt2x00dev, RT3290) ||
- 	    rt2x00_rt(rt2x00dev, RT3352) ||
-+	    rt2x00_rt(rt2x00dev, RT5350) ||
- 	    rt2x00_rt(rt2x00dev, RT5390) ||
- 	    rt2x00_rt(rt2x00dev, RT5392))
- 		rt2800_bbp_write(rt2x00dev, 86, 0x38);
-@@ -4150,6 +4176,7 @@ static int rt2800_init_bbp(struct rt2x00
- 
- 	if (rt2x00_rt(rt2x00dev, RT3290) ||
- 	    rt2x00_rt(rt2x00dev, RT3352) ||
-+	    rt2x00_rt(rt2x00dev, RT5350) ||
- 	    rt2x00_rt(rt2x00dev, RT5390) ||
- 	    rt2x00_rt(rt2x00dev, RT5392))
- 		rt2800_bbp_write(rt2x00dev, 92, 0x02);
-@@ -4168,6 +4195,7 @@ static int rt2800_init_bbp(struct rt2x00
- 	    rt2x00_rt(rt2x00dev, RT3290) ||
- 	    rt2x00_rt(rt2x00dev, RT3352) ||
- 	    rt2x00_rt(rt2x00dev, RT3572) ||
-+	    rt2x00_rt(rt2x00dev, RT5350) ||
- 	    rt2x00_rt(rt2x00dev, RT5390) ||
- 	    rt2x00_rt(rt2x00dev, RT5392) ||
- 	    rt2800_is_305x_soc(rt2x00dev))
-@@ -4177,6 +4205,7 @@ static int rt2800_init_bbp(struct rt2x00
  
- 	if (rt2x00_rt(rt2x00dev, RT3290) ||
- 	    rt2x00_rt(rt2x00dev, RT3352) ||
-+	    rt2x00_rt(rt2x00dev, RT5350) ||
- 	    rt2x00_rt(rt2x00dev, RT5390) ||
- 	    rt2x00_rt(rt2x00dev, RT5392))
- 		rt2800_bbp_write(rt2x00dev, 104, 0x92);
-@@ -4187,13 +4216,15 @@ static int rt2800_init_bbp(struct rt2x00
- 		rt2800_bbp_write(rt2x00dev, 105, 0x1c);
- 	else if (rt2x00_rt(rt2x00dev, RT3352))
- 		rt2800_bbp_write(rt2x00dev, 105, 0x34);
--	else if (rt2x00_rt(rt2x00dev, RT5390) ||
-+	else if (rt2x00_rt(rt2x00dev, RT5350) ||
-+		 rt2x00_rt(rt2x00dev, RT5390) ||
- 		 rt2x00_rt(rt2x00dev, RT5392))
- 		rt2800_bbp_write(rt2x00dev, 105, 0x3c);
- 	else
- 		rt2800_bbp_write(rt2x00dev, 105, 0x05);
+-	rt2800_bbp_write(rt2x00dev, 83, 0x6a);
+-
+-	rt2800_bbp_write(rt2x00dev, 84, 0x99);
++	if (rt2x00_rt(rt2x00dev, RT5350)) {
++		rt2800_bbp_write(rt2x00dev, 83, 0x7a);
++		rt2800_bbp_write(rt2x00dev, 84, 0x9a);
++	} else {
++		rt2800_bbp_write(rt2x00dev, 83, 0x6a);
++		rt2800_bbp_write(rt2x00dev, 84, 0x99);
++	}
  
- 	if (rt2x00_rt(rt2x00dev, RT3290) ||
-+		rt2x00_rt(rt2x00dev, RT5350) ||
- 	    rt2x00_rt(rt2x00dev, RT5390))
- 		rt2800_bbp_write(rt2x00dev, 106, 0x03);
- 	else if (rt2x00_rt(rt2x00dev, RT3352))
-@@ -4203,11 +4234,13 @@ static int rt2800_init_bbp(struct rt2x00
- 	else
- 		rt2800_bbp_write(rt2x00dev, 106, 0x35);
+ 	rt2800_bbp_write(rt2x00dev, 86, 0x38);
  
--	if (rt2x00_rt(rt2x00dev, RT3352))
-+	if (rt2x00_rt(rt2x00dev, RT3352) ||
-+	    rt2x00_rt(rt2x00dev, RT5350))
- 		rt2800_bbp_write(rt2x00dev, 120, 0x50);
+@@ -4209,9 +4227,13 @@ static void rt2800_init_bbp_3352(struct 
  
- 	if (rt2x00_rt(rt2x00dev, RT3290) ||
- 	    rt2x00_rt(rt2x00dev, RT3352) ||
-+	    rt2x00_rt(rt2x00dev, RT5350) ||
- 	    rt2x00_rt(rt2x00dev, RT5390) ||
- 	    rt2x00_rt(rt2x00dev, RT5392))
- 		rt2800_bbp_write(rt2x00dev, 128, 0x12);
-@@ -4217,13 +4250,15 @@ static int rt2800_init_bbp(struct rt2x00
- 		rt2800_bbp_write(rt2x00dev, 135, 0xf6);
- 	}
+ 	rt2800_bbp_write(rt2x00dev, 104, 0x92);
  
--	if (rt2x00_rt(rt2x00dev, RT3352))
-+	if (rt2x00_rt(rt2x00dev, RT3352) ||
-+	    rt2x00_rt(rt2x00dev, RT5350))
- 		rt2800_bbp_write(rt2x00dev, 137, 0x0f);
+-	rt2800_bbp_write(rt2x00dev, 105, 0x34);
+-
+-	rt2800_bbp_write(rt2x00dev, 106, 0x05);
++	if (rt2x00_rt(rt2x00dev, RT5350)) {
++		rt2800_bbp_write(rt2x00dev, 105, 0x3c);
++		rt2800_bbp_write(rt2x00dev, 106, 0x03);
++	} else {
++		rt2800_bbp_write(rt2x00dev, 105, 0x34);
++		rt2800_bbp_write(rt2x00dev, 106, 0x05);
++	}
  
- 	if (rt2x00_rt(rt2x00dev, RT3071) ||
- 	    rt2x00_rt(rt2x00dev, RT3090) ||
- 	    rt2x00_rt(rt2x00dev, RT3390) ||
- 	    rt2x00_rt(rt2x00dev, RT3572) ||
-+	    rt2x00_rt(rt2x00dev, RT5350) ||
- 	    rt2x00_rt(rt2x00dev, RT5390) ||
- 	    rt2x00_rt(rt2x00dev, RT5392)) {
- 		rt2800_bbp_read(rt2x00dev, 138, &value);
-@@ -4260,7 +4295,8 @@ static int rt2800_init_bbp(struct rt2x00
- 		rt2800_bbp_write(rt2x00dev, 3, value);
- 	}
+ 	rt2800_bbp_write(rt2x00dev, 120, 0x50);
  
--	if (rt2x00_rt(rt2x00dev, RT3352)) {
-+	if (rt2x00_rt(rt2x00dev, RT3352) ||
-+	    rt2x00_rt(rt2x00dev, RT5350)) {
- 		rt2800_bbp_write(rt2x00dev, 163, 0xbd);
- 		/* Set ITxBF timeout to 0x9c40=1000msec */
- 		rt2800_bbp_write(rt2x00dev, 179, 0x02);
-@@ -4282,6 +4318,14 @@ static int rt2800_init_bbp(struct rt2x00
- 		rt2800_bbp_write(rt2x00dev, 148, 0xc8);
- 	}
+@@ -4236,6 +4258,13 @@ static void rt2800_init_bbp_3352(struct 
+ 	rt2800_bbp_write(rt2x00dev, 143, 0xa2);
  
+ 	rt2800_bbp_write(rt2x00dev, 148, 0xc8);
++
 +	if (rt2x00_rt(rt2x00dev, RT5350)) {
 +		rt2800_bbp_write(rt2x00dev, 150, 0x40); /* Antenna Software OFDM */
 +		rt2800_bbp_write(rt2x00dev, 151, 0x30); /* Antenna Software CCK */
 +		rt2800_bbp_write(rt2x00dev, 152, 0xa3);
 +		rt2800_bbp_write(rt2x00dev, 154, 0); /* Clear previously selected antenna */
 +	}
-+
-+
- 	if (rt2x00_rt(rt2x00dev, RT5390) ||
- 	    rt2x00_rt(rt2x00dev, RT5392)) {
- 		int ant, div_mode;
-@@ -4674,6 +4718,76 @@ static void rt2800_init_rfcsr_3572(struc
- 	rt2800_rfcsr_write(rt2x00dev, 31, 0x10);
+ }
+ 
+ static void rt2800_init_bbp_3390(struct rt2x00_dev *rt2x00dev)
+@@ -4520,6 +4549,7 @@ static void rt2800_init_bbp(struct rt2x0
+ 		rt2800_init_bbp_3290(rt2x00dev);
+ 		break;
+ 	case RT3352:
++	case RT5350:
+ 		rt2800_init_bbp_3352(rt2x00dev);
+ 		break;
+ 	case RT3390:
+@@ -5159,6 +5189,76 @@ static void rt2800_init_rfcsr_3572(struc
+ 	rt2800_normal_mode_setup_3xxx(rt2x00dev);
  }
  
 +static void rt2800_init_rfcsr_5350(struct rt2x00_dev *rt2x00dev)
@@ -320,16 +202,8 @@
 +
  static void rt2800_init_rfcsr_5390(struct rt2x00_dev *rt2x00dev)
  {
- 	rt2800_rfcsr_write(rt2x00dev, 1, 0x0f);
-@@ -4899,6 +5013,7 @@ static int rt2800_init_rfcsr(struct rt2x
- 	    !rt2x00_rt(rt2x00dev, RT3352) &&
- 	    !rt2x00_rt(rt2x00dev, RT3390) &&
- 	    !rt2x00_rt(rt2x00dev, RT3572) &&
-+	    !rt2x00_rt(rt2x00dev, RT5350) &&
- 	    !rt2x00_rt(rt2x00dev, RT5390) &&
- 	    !rt2x00_rt(rt2x00dev, RT5392) &&
- 	    !rt2x00_rt(rt2x00dev, RT5392) &&
-@@ -4951,6 +5066,9 @@ static int rt2800_init_rfcsr(struct rt2x
+ 	rt2800_rf_init_calibration(rt2x00dev, 2);
+@@ -5387,6 +5487,9 @@ static void rt2800_init_rfcsr(struct rt2
  	case RT3572:
  		rt2800_init_rfcsr_3572(rt2x00dev);
  		break;
@@ -339,20 +213,24 @@
  	case RT5390:
  		rt2800_init_rfcsr_5390(rt2x00dev);
  		break;
-@@ -5361,6 +5479,12 @@ static int rt2800_validate_eeprom(struct
- 		if (rt2x00_get_field16(word, EEPROM_NIC_CONF0_RXPATH) > 2)
- 			rt2x00_set_field16(&word, EEPROM_NIC_CONF0_RXPATH, 2);
+@@ -5598,6 +5701,12 @@ static int rt2800_validate_eeprom(struct
+ 		rt2x00_set_field16(&word, EEPROM_NIC_CONF0_RF_TYPE, RF2820);
  		rt2x00_eeprom_write(rt2x00dev, EEPROM_NIC_CONF0, word);
-+	} else if(rt2x00_rt(rt2x00dev, RT5350)) {
+ 		rt2x00_eeprom_dbg(rt2x00dev, "Antenna: 0x%04x\n", word);
++	} else if (rt2x00_rt(rt2x00dev, RT5350)) {
 +		rt2x00_set_field16(&word, EEPROM_NIC_CONF0_RXPATH, 1);
 +		rt2x00_set_field16(&word, EEPROM_NIC_CONF0_TXPATH, 1);
 +		rt2x00_set_field16(&word, EEPROM_NIC_CONF0_RF_TYPE, RF3320);
 +		rt2x00_eeprom_write(rt2x00dev, EEPROM_NIC_CONF0, word);
-+		EEPROM(rt2x00dev, "rt5350: Ant: 0x%04x\n", word);
- 	}
- 
- 	rt2x00_eeprom_read(rt2x00dev, EEPROM_NIC_CONF1, &word);
-@@ -5480,6 +5604,8 @@ static int rt2800_init_eeprom(struct rt2
++		rt2x00_eeprom_dbg(rt2x00dev, "Antenna: 0x%04x\n", word);
+ 	} else if (rt2x00_rt(rt2x00dev, RT2860) ||
+ 		   rt2x00_rt(rt2x00dev, RT2872)) {
+ 		/*
+@@ -5723,9 +5832,12 @@ static int rt2800_init_eeprom(struct rt2
+ 	 */
+ 	if (rt2x00_rt(rt2x00dev, RT3290) ||
+ 	    rt2x00_rt(rt2x00dev, RT3352) ||
++	    rt2x00_rt(rt2x00dev, RT5350) ||
  	    rt2x00_rt(rt2x00dev, RT5390) ||
  	    rt2x00_rt(rt2x00dev, RT5392))
  		rt2x00_eeprom_read(rt2x00dev, EEPROM_CHIP_ID, &rf);
@@ -361,7 +239,7 @@
  	else
  		rf = rt2x00_get_field16(eeprom, EEPROM_NIC_CONF0_RF_TYPE);
  
-@@ -5496,6 +5622,7 @@ static int rt2800_init_eeprom(struct rt2
+@@ -5742,6 +5854,7 @@ static int rt2800_init_eeprom(struct rt2
  	case RF3290:
  	case RF3320:
  	case RF3322:
@@ -369,7 +247,7 @@
  	case RF5360:
  	case RF5370:
  	case RF5372:
-@@ -5993,7 +6120,8 @@ static int rt2800_probe_hw_mode(struct r
+@@ -6240,7 +6353,8 @@ static int rt2800_probe_hw_mode(struct r
  		   rt2x00_rf(rt2x00dev, RF5392)) {
  		spec->num_channels = 14;
  		spec->channels = rf_vals_3x;
@@ -379,7 +257,7 @@
  		spec->num_channels = 14;
  		if (spec->clk_is_20mhz)
  			spec->channels = rf_vals_xtal20mhz_3x;
-@@ -6094,6 +6222,7 @@ static int rt2800_probe_hw_mode(struct r
+@@ -6341,6 +6455,7 @@ static int rt2800_probe_hw_mode(struct r
  	case RF3320:
  	case RF3052:
  	case RF3290:
@@ -387,7 +265,7 @@
  	case RF5360:
  	case RF5370:
  	case RF5372:
-@@ -6131,6 +6260,7 @@ static int rt2800_probe_rt(struct rt2x00
+@@ -6378,6 +6493,7 @@ static int rt2800_probe_rt(struct rt2x00
  	case RT3352:
  	case RT3390:
  	case RT3572:
@@ -397,7 +275,7 @@
  	case RT5592:
 --- a/drivers/net/wireless/rt2x00/rt2x00.h
 +++ b/drivers/net/wireless/rt2x00/rt2x00.h
-@@ -192,6 +192,7 @@ struct rt2x00_chip {
+@@ -181,6 +181,7 @@ struct rt2x00_chip {
  #define RT3572		0x3572
  #define RT3593		0x3593
  #define RT3883		0x3883	/* WSOC */
diff --git a/package/mac80211/patches/617-rt2x00-load-eeprom-on-SoC-from-a-mtd-device-defines-.patch b/package/mac80211/patches/617-rt2x00-load-eeprom-on-SoC-from-a-mtd-device-defines-.patch
index dbfd80faba..d5af4c9ae2 100644
--- a/package/mac80211/patches/617-rt2x00-load-eeprom-on-SoC-from-a-mtd-device-defines-.patch
+++ b/package/mac80211/patches/617-rt2x00-load-eeprom-on-SoC-from-a-mtd-device-defines-.patch
@@ -12,14 +12,14 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
 
 --- a/drivers/net/wireless/rt2x00/Kconfig
 +++ b/drivers/net/wireless/rt2x00/Kconfig
-@@ -68,6 +68,7 @@ config RT2800PCI
+@@ -71,6 +71,7 @@ config RT2800PCI
+ 	select RT2X00_LIB_FIRMWARE
+ 	select RT2X00_LIB_EEPROM
  	select RT2X00_LIB_CRYPTO
- 	select CRC_CCITT
- 	select EEPROM_93CX6
 +	select MTD if SOC_RT288X || SOC_RT305X
+ 	depends on CRC_CCITT
+ 	depends on EEPROM_93CX6
  	---help---
- 	  This adds support for rt27xx/rt28xx/rt30xx wireless chipset family.
- 	  Supported chips: RT2760, RT2790, RT2860, RT2880, RT2890, RT3052,
 --- a/drivers/net/wireless/rt2x00/rt2x00eeprom.c
 +++ b/drivers/net/wireless/rt2x00/rt2x00eeprom.c
 @@ -30,12 +30,77 @@
@@ -99,4 +99,4 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
 +
  	ee_name = rt2x00dev->ops->lib->get_eeprom_file_name(rt2x00dev);
  	if (!ee_name) {
- 		ERROR(rt2x00dev,
+ 		rt2x00_err(rt2x00dev,
diff --git a/package/mac80211/patches/700-mwl8k-missing-pci-id-for-WNR854T.patch b/package/mac80211/patches/700-mwl8k-missing-pci-id-for-WNR854T.patch
index 74122bceab..3381ba56ad 100644
--- a/package/mac80211/patches/700-mwl8k-missing-pci-id-for-WNR854T.patch
+++ b/package/mac80211/patches/700-mwl8k-missing-pci-id-for-WNR854T.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/mwl8k.c
 +++ b/drivers/net/wireless/mwl8k.c
-@@ -5525,6 +5525,7 @@ MODULE_FIRMWARE("mwl8k/fmimage_8366.fw")
+@@ -5530,6 +5530,7 @@ MODULE_FIRMWARE("mwl8k/fmimage_8366.fw")
  MODULE_FIRMWARE(MWL8K_8366_AP_FW(MWL8K_8366_AP_FW_API));
  
  static DEFINE_PCI_DEVICE_TABLE(mwl8k_pci_id_table) = {
diff --git a/package/mac80211/patches/800-b43-gpio-mask-module-option.patch b/package/mac80211/patches/800-b43-gpio-mask-module-option.patch
index fc874ad049..d2ccf30d7d 100644
--- a/package/mac80211/patches/800-b43-gpio-mask-module-option.patch
+++ b/package/mac80211/patches/800-b43-gpio-mask-module-option.patch
@@ -22,7 +22,7 @@
  static int modparam_bad_frames_preempt;
  module_param_named(bad_frames_preempt, modparam_bad_frames_preempt, int, 0444);
  MODULE_PARM_DESC(bad_frames_preempt,
-@@ -2747,10 +2752,10 @@ static int b43_gpio_init(struct b43_wlde
+@@ -2740,10 +2745,10 @@ static int b43_gpio_init(struct b43_wlde
  	u32 mask, set;
  
  	b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_GPOUTSMSK, 0);
diff --git a/package/mac80211/patches/810-b43_no_pio.patch b/package/mac80211/patches/810-b43_no_pio.patch
index 66c50ae3ea..0821dc7856 100644
--- a/package/mac80211/patches/810-b43_no_pio.patch
+++ b/package/mac80211/patches/810-b43_no_pio.patch
@@ -7,23 +7,23 @@
 -b43-y				+= pio.o
 +b43-$(CONFIG_B43_PIO)		+= pio.o
  b43-y				+= rfkill.o
- b43-$(CONFIG_B43_LEDS)		+= leds.o
- b43-$(CONFIG_B43_PCMCIA)	+= pcmcia.o
+ b43-$(CPTCFG_B43_LEDS)		+= leds.o
+ b43-$(CPTCFG_B43_PCMCIA)	+= pcmcia.o
 --- a/drivers/net/wireless/b43/main.c
 +++ b/drivers/net/wireless/b43/main.c
-@@ -1916,10 +1916,12 @@ static void b43_do_interrupt_thread(stru
- 			       dma_reason[0], dma_reason[1],
- 			       dma_reason[2], dma_reason[3],
- 			       dma_reason[4], dma_reason[5]);
+@@ -1913,10 +1913,12 @@ static void b43_do_interrupt_thread(stru
+ 			dma_reason[0], dma_reason[1],
+ 			dma_reason[2], dma_reason[3],
+ 			dma_reason[4], dma_reason[5]);
 +#ifdef CONFIG_B43_PIO
- 			b43err(dev->wl, "This device does not support DMA "
+ 		b43err(dev->wl, "This device does not support DMA "
  			       "on your system. It will now be switched to PIO.\n");
- 			/* Fall back to PIO transfers if we get fatal DMA errors! */
- 			dev->use_pio = true;
+ 		/* Fall back to PIO transfers if we get fatal DMA errors! */
+ 		dev->use_pio = true;
 +#endif
- 			b43_controller_restart(dev, "DMA error");
- 			return;
- 		}
+ 		b43_controller_restart(dev, "DMA error");
+ 		return;
+ 	}
 --- a/drivers/net/wireless/b43/pio.h
 +++ b/drivers/net/wireless/b43/pio.h
 @@ -150,7 +150,7 @@ static inline void b43_piorx_write32(str
@@ -73,3 +73,14 @@
 +#endif /* CONFIG_B43_PIO */
  
  #endif /* B43_PIO_H_ */
+--- a/drivers/net/wireless/b43/Kconfig
++++ b/drivers/net/wireless/b43/Kconfig
+@@ -104,7 +104,7 @@ config B43_BCMA_PIO
+ 	default y
+ 
+ config B43_PIO
+-	bool
++	bool "Broadcom 43xx PIO support"
+ 	depends on B43
+ 	select SSB_BLOCKIO
+ 	default y
diff --git a/package/mac80211/patches/820-b43-add-antenna-control.patch b/package/mac80211/patches/820-b43-add-antenna-control.patch
index 272eee4757..c17c1ca0a9 100644
--- a/package/mac80211/patches/820-b43-add-antenna-control.patch
+++ b/package/mac80211/patches/820-b43-add-antenna-control.patch
@@ -9,7 +9,7 @@
  	antenna = b43_antenna_to_phyctl(antenna);
  	ctl = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL);
  	/* We can't send beacons with short preamble. Would get PHY errors. */
-@@ -3105,8 +3105,8 @@ static int b43_chip_init(struct b43_wlde
+@@ -3098,8 +3098,8 @@ static int b43_chip_init(struct b43_wlde
  
  	/* Select the antennae */
  	if (phy->ops->set_rx_antenna)
@@ -20,7 +20,7 @@
  
  	if (phy->type == B43_PHYTYPE_B) {
  		value16 = b43_read16(dev, 0x005E);
-@@ -3850,7 +3850,6 @@ static int b43_op_config(struct ieee8021
+@@ -3843,7 +3843,6 @@ static int b43_op_config(struct ieee8021
  	struct b43_wldev *dev;
  	struct b43_phy *phy;
  	struct ieee80211_conf *conf = &hw->conf;
@@ -28,7 +28,7 @@
  	int err = 0;
  	bool reload_bss = false;
  
-@@ -3904,11 +3903,9 @@ static int b43_op_config(struct ieee8021
+@@ -3897,11 +3896,9 @@ static int b43_op_config(struct ieee8021
  	}
  
  	/* Antennas for RX and management frame TX. */
@@ -42,7 +42,7 @@
  
  	if (wl->radio_enabled != phy->radio_on) {
  		if (wl->radio_enabled) {
-@@ -5033,6 +5030,47 @@ static int b43_op_get_survey(struct ieee
+@@ -5026,6 +5023,47 @@ static int b43_op_get_survey(struct ieee
  	return 0;
  }
  
@@ -90,7 +90,7 @@
  static const struct ieee80211_ops b43_hw_ops = {
  	.tx			= b43_op_tx,
  	.conf_tx		= b43_op_conf_tx,
-@@ -5054,6 +5092,8 @@ static const struct ieee80211_ops b43_hw
+@@ -5047,6 +5085,8 @@ static const struct ieee80211_ops b43_hw
  	.sw_scan_complete	= b43_op_sw_scan_complete_notifier,
  	.get_survey		= b43_op_get_survey,
  	.rfkill_poll		= b43_rfkill_poll,
@@ -99,7 +99,7 @@
  };
  
  /* Hard-reset the chip. Do not call this directly.
-@@ -5300,6 +5340,8 @@ static int b43_one_core_attach(struct b4
+@@ -5293,6 +5333,8 @@ static int b43_one_core_attach(struct b4
  	if (!wldev)
  		goto out;
  
@@ -108,7 +108,7 @@
  	wldev->use_pio = b43_modparam_pio;
  	wldev->dev = dev;
  	wldev->wl = wl;
-@@ -5390,6 +5432,9 @@ static struct b43_wl *b43_wireless_init(
+@@ -5383,6 +5425,9 @@ static struct b43_wl *b43_wireless_init(
  
  	hw->wiphy->flags |= WIPHY_FLAG_IBSS_RSN;
  
diff --git a/package/mac80211/patches/830-b43-workaround-pcie-bcm4716.patch b/package/mac80211/patches/830-b43-workaround-pcie-bcm4716.patch
index 66631218f5..e55d4fe4aa 100644
--- a/package/mac80211/patches/830-b43-workaround-pcie-bcm4716.patch
+++ b/package/mac80211/patches/830-b43-workaround-pcie-bcm4716.patch
@@ -88,7 +88,7 @@ Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
  		dev->phy.writes_counter = 0;
 --- a/drivers/net/wireless/b43/phy_n.c
 +++ b/drivers/net/wireless/b43/phy_n.c
-@@ -5368,14 +5368,14 @@ static inline void check_phyreg(struct b
+@@ -5417,14 +5417,14 @@ static inline void check_phyreg(struct b
  static u16 b43_nphy_op_read(struct b43_wldev *dev, u16 reg)
  {
  	check_phyreg(dev, reg);
@@ -105,7 +105,7 @@ Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
  	b43_write16(dev, B43_MMIO_PHY_DATA, value);
  }
  
-@@ -5383,7 +5383,7 @@ static void b43_nphy_op_maskset(struct b
+@@ -5432,7 +5432,7 @@ static void b43_nphy_op_maskset(struct b
  				 u16 set)
  {
  	check_phyreg(dev, reg);
@@ -114,7 +114,7 @@ Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
  	b43_maskset16(dev, B43_MMIO_PHY_DATA, mask, set);
  }
  
-@@ -5394,7 +5394,7 @@ static u16 b43_nphy_op_radio_read(struct
+@@ -5443,7 +5443,7 @@ static u16 b43_nphy_op_radio_read(struct
  	/* N-PHY needs 0x100 for read access */
  	reg |= 0x100;
  
@@ -123,7 +123,7 @@ Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
  	return b43_read16(dev, B43_MMIO_RADIO_DATA_LOW);
  }
  
-@@ -5403,7 +5403,7 @@ static void b43_nphy_op_radio_write(stru
+@@ -5452,7 +5452,7 @@ static void b43_nphy_op_radio_write(stru
  	/* Register 1 is a 32-bit register. */
  	B43_WARN_ON(reg == 1);
  
diff --git a/package/mac80211/patches/840-b43-Handle-DMA-RX-descriptor-underrun.patch b/package/mac80211/patches/840-b43-Handle-DMA-RX-descriptor-underrun.patch
deleted file mode 100644
index 461e4ddb0a..0000000000
--- a/package/mac80211/patches/840-b43-Handle-DMA-RX-descriptor-underrun.patch
+++ /dev/null
@@ -1,145 +0,0 @@
-From 5921f167baf30255ebc079c6e751a7ed31cd986d Mon Sep 17 00:00:00 2001
-From: Thommy Jakobsson <thommyj@gmail.com>
-Date: Tue, 23 Apr 2013 21:45:11 +0200
-Subject: [PATCH 2/3] B43: Handle DMA RX descriptor underrun
-
-Add handling of rx descriptor underflow. This fixes a fault that could
-happen on slow machines, where data is received faster than the CPU can
-handle. In such a case the device will use up all rx descriptors and
-refuse to send any more data before confirming that it is ok. This
-patch enables necessary interrupt to discover such a situation and will
-handle them by dropping everything in the ring buffer.
-
-Reviewed-by: Michael Buesch <m@bues.ch>
-Signed-off-by: Thommy Jakobsson <thommyj@gmail.com>
-Cc: stable <stable@vger.kernel.org>
----
- drivers/net/wireless/b43/dma.c  |   19 +++++++++++++++++
- drivers/net/wireless/b43/dma.h  |    4 +++-
- drivers/net/wireless/b43/main.c |   43 ++++++++++++++++-----------------------
- 3 files changed, 40 insertions(+), 26 deletions(-)
-
---- a/drivers/net/wireless/b43/dma.c
-+++ b/drivers/net/wireless/b43/dma.c
-@@ -1733,6 +1733,25 @@ drop_recycle_buffer:
- 	sync_descbuffer_for_device(ring, dmaaddr, ring->rx_buffersize);
- }
- 
-+void b43_dma_handle_rx_overflow(struct b43_dmaring *ring)
-+{
-+	int current_slot, previous_slot;
-+
-+	B43_WARN_ON(ring->tx);
-+
-+	/* Device has filled all buffers, drop all packets and let TCP
-+	 * decrease speed.
-+	 * Decrement RX index by one will let the device to see all slots
-+	 * as free again
-+	 */
-+	/*
-+	*TODO: How to increase rx_drop in mac80211?
-+	*/
-+	current_slot = ring->ops->get_current_rxslot(ring);
-+	previous_slot = prev_slot(ring, current_slot);
-+	ring->ops->set_current_rxslot(ring, previous_slot);
-+}
-+
- void b43_dma_rx(struct b43_dmaring *ring)
- {
- 	const struct b43_dma_ops *ops = ring->ops;
---- a/drivers/net/wireless/b43/dma.h
-+++ b/drivers/net/wireless/b43/dma.h
-@@ -9,7 +9,7 @@
- /* DMA-Interrupt reasons. */
- #define B43_DMAIRQ_FATALMASK	((1 << 10) | (1 << 11) | (1 << 12) \
- 					 | (1 << 14) | (1 << 15))
--#define B43_DMAIRQ_NONFATALMASK	(1 << 13)
-+#define B43_DMAIRQ_RDESC_UFLOW		(1 << 13)
- #define B43_DMAIRQ_RX_DONE		(1 << 16)
- 
- /*** 32-bit DMA Engine. ***/
-@@ -295,6 +295,8 @@ int b43_dma_tx(struct b43_wldev *dev,
- void b43_dma_handle_txstatus(struct b43_wldev *dev,
- 			     const struct b43_txstatus *status);
- 
-+void b43_dma_handle_rx_overflow(struct b43_dmaring *ring);
-+
- void b43_dma_rx(struct b43_dmaring *ring);
- 
- void b43_dma_direct_fifo_rx(struct b43_wldev *dev,
---- a/drivers/net/wireless/b43/main.c
-+++ b/drivers/net/wireless/b43/main.c
-@@ -1907,32 +1907,20 @@ static void b43_do_interrupt_thread(stru
- 		}
- 	}
- 
--	if (unlikely(merged_dma_reason & (B43_DMAIRQ_FATALMASK |
--					  B43_DMAIRQ_NONFATALMASK))) {
--		if (merged_dma_reason & B43_DMAIRQ_FATALMASK) {
--			b43err(dev->wl, "Fatal DMA error: "
--			       "0x%08X, 0x%08X, 0x%08X, "
--			       "0x%08X, 0x%08X, 0x%08X\n",
--			       dma_reason[0], dma_reason[1],
--			       dma_reason[2], dma_reason[3],
--			       dma_reason[4], dma_reason[5]);
-+	if (unlikely(merged_dma_reason & (B43_DMAIRQ_FATALMASK))) {
-+		b43err(dev->wl,
-+			"Fatal DMA error: 0x%08X, 0x%08X, 0x%08X, 0x%08X, 0x%08X, 0x%08X\n",
-+			dma_reason[0], dma_reason[1],
-+			dma_reason[2], dma_reason[3],
-+			dma_reason[4], dma_reason[5]);
- #ifdef CONFIG_B43_PIO
--			b43err(dev->wl, "This device does not support DMA "
-+		b43err(dev->wl, "This device does not support DMA "
- 			       "on your system. It will now be switched to PIO.\n");
--			/* Fall back to PIO transfers if we get fatal DMA errors! */
--			dev->use_pio = true;
-+		/* Fall back to PIO transfers if we get fatal DMA errors! */
-+		dev->use_pio = true;
- #endif
--			b43_controller_restart(dev, "DMA error");
--			return;
--		}
--		if (merged_dma_reason & B43_DMAIRQ_NONFATALMASK) {
--			b43err(dev->wl, "DMA error: "
--			       "0x%08X, 0x%08X, 0x%08X, "
--			       "0x%08X, 0x%08X, 0x%08X\n",
--			       dma_reason[0], dma_reason[1],
--			       dma_reason[2], dma_reason[3],
--			       dma_reason[4], dma_reason[5]);
--		}
-+		b43_controller_restart(dev, "DMA error");
-+		return;
- 	}
- 
- 	if (unlikely(reason & B43_IRQ_UCODE_DEBUG))
-@@ -1951,6 +1939,11 @@ static void b43_do_interrupt_thread(stru
- 		handle_irq_noise(dev);
- 
- 	/* Check the DMA reason registers for received data. */
-+	if (dma_reason[0] & B43_DMAIRQ_RDESC_UFLOW) {
-+		if (B43_DEBUG)
-+			b43warn(dev->wl, "RX descriptor underrun\n");
-+		b43_dma_handle_rx_overflow(dev->dma.rx_ring);
-+	}
- 	if (dma_reason[0] & B43_DMAIRQ_RX_DONE) {
- 		if (b43_using_pio_transfers(dev))
- 			b43_pio_rx(dev->pio.rx_queue);
-@@ -2008,7 +2001,7 @@ static irqreturn_t b43_do_interrupt(stru
- 		return IRQ_NONE;
- 
- 	dev->dma_reason[0] = b43_read32(dev, B43_MMIO_DMA0_REASON)
--	    & 0x0001DC00;
-+	    & 0x0001FC00;
- 	dev->dma_reason[1] = b43_read32(dev, B43_MMIO_DMA1_REASON)
- 	    & 0x0000DC00;
- 	dev->dma_reason[2] = b43_read32(dev, B43_MMIO_DMA2_REASON)
-@@ -3137,7 +3130,7 @@ static int b43_chip_init(struct b43_wlde
- 		b43_write32(dev, 0x018C, 0x02000000);
- 	}
- 	b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, 0x00004000);
--	b43_write32(dev, B43_MMIO_DMA0_IRQ_MASK, 0x0001DC00);
-+	b43_write32(dev, B43_MMIO_DMA0_IRQ_MASK, 0x0001FC00);
- 	b43_write32(dev, B43_MMIO_DMA1_IRQ_MASK, 0x0000DC00);
- 	b43_write32(dev, B43_MMIO_DMA2_IRQ_MASK, 0x0000DC00);
- 	b43_write32(dev, B43_MMIO_DMA3_IRQ_MASK, 0x0001DC00);