Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next-2.6 into for-davem

14 files changed, 266 insertions, 159 deletions

diff --git a/net/bluetooth/Kconfig b/net/bluetooth/Kconfig
index c6f9c2fb4891..6ae5ec508587 100644
--- a/net/bluetooth/Kconfig
+++ b/net/bluetooth/Kconfig
@@ -31,9 +31,10 @@ menuconfig BT
           to Bluetooth kernel modules are provided in the BlueZ packages.  For
           more information, see <http://www.bluez.org/>.
 
+if BT != n
+
 config BT_L2CAP
         bool "L2CAP protocol support"
-        depends on BT
         select CRC16
         help
           L2CAP (Logical Link Control and Adaptation Protocol) provides
@@ -42,11 +43,12 @@ config BT_L2CAP
 
 config BT_SCO
         bool "SCO links support"
-        depends on BT
         help
           SCO link provides voice transport over Bluetooth.  SCO support is
           required for voice applications like Headset and Audio.
 
+endif
+
 source "net/bluetooth/rfcomm/Kconfig"
 
 source "net/bluetooth/bnep/Kconfig"
diff --git a/net/mac80211/Kconfig b/net/mac80211/Kconfig
index dbf5e4006bc1..513f85cc2ae1 100644
--- a/net/mac80211/Kconfig
+++ b/net/mac80211/Kconfig
@@ -78,7 +78,7 @@ config MAC80211_RC_DEFAULT
 endif
 
 comment "Some wireless drivers require a rate control algorithm"
-        depends on MAC80211_HAS_RC=n
+        depends on MAC80211 && MAC80211_HAS_RC=n
 
 config MAC80211_MESH
         bool "Enable mac80211 mesh networking (pre-802.11s) support"
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 140503d4c97a..7b701dcddb50 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -316,6 +316,17 @@ static int ieee80211_config_default_mgmt_key(struct wiphy *wiphy,
         return 0;
 }
 
+static void rate_idx_to_bitrate(struct rate_info *rate, struct sta_info *sta, int idx)
+{
+        if (!(rate->flags & RATE_INFO_FLAGS_MCS)) {
+                struct ieee80211_supported_band *sband;
+                sband = sta->local->hw.wiphy->bands[
+                                sta->local->hw.conf.channel->band];
+                rate->legacy = sband->bitrates[idx].bitrate;
+        } else
+                rate->mcs = idx;
+}
+
 static void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
 {
         struct ieee80211_sub_if_data *sdata = sta->sdata;
@@ -330,6 +341,7 @@ static void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
                         STATION_INFO_TX_RETRIES |
                         STATION_INFO_TX_FAILED |
                         STATION_INFO_TX_BITRATE |
+                        STATION_INFO_RX_BITRATE |
                         STATION_INFO_RX_DROP_MISC;
 
         sinfo->inactive_time = jiffies_to_msecs(jiffies - sta->last_rx);
@@ -355,15 +367,16 @@ static void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
                 sinfo->txrate.flags |= RATE_INFO_FLAGS_40_MHZ_WIDTH;
         if (sta->last_tx_rate.flags & IEEE80211_TX_RC_SHORT_GI)
                 sinfo->txrate.flags |= RATE_INFO_FLAGS_SHORT_GI;
+        rate_idx_to_bitrate(&sinfo->txrate, sta, sta->last_tx_rate.idx);
 
-        if (!(sta->last_tx_rate.flags & IEEE80211_TX_RC_MCS)) {
-                struct ieee80211_supported_band *sband;
-                sband = sta->local->hw.wiphy->bands[
-                                sta->local->hw.conf.channel->band];
-                sinfo->txrate.legacy =
-                        sband->bitrates[sta->last_tx_rate.idx].bitrate;
-        } else
-                sinfo->txrate.mcs = sta->last_tx_rate.idx;
+        sinfo->rxrate.flags = 0;
+        if (sta->last_rx_rate_flag & RX_FLAG_HT)
+                sinfo->rxrate.flags |= RATE_INFO_FLAGS_MCS;
+        if (sta->last_rx_rate_flag & RX_FLAG_40MHZ)
+                sinfo->rxrate.flags |= RATE_INFO_FLAGS_40_MHZ_WIDTH;
+        if (sta->last_rx_rate_flag & RX_FLAG_SHORT_GI)
+                sinfo->rxrate.flags |= RATE_INFO_FLAGS_SHORT_GI;
+        rate_idx_to_bitrate(&sinfo->rxrate, sta, sta->last_rx_rate_idx);
 
         if (ieee80211_vif_is_mesh(&sdata->vif)) {
 #ifdef CONFIG_MAC80211_MESH
@@ -1800,6 +1813,33 @@ static int ieee80211_mgmt_tx(struct wiphy *wiphy, struct net_device *dev,
 
         *cookie = (unsigned long) skb;
 
+        if (is_offchan && local->ops->offchannel_tx) {
+                int ret;
+
+                IEEE80211_SKB_CB(skb)->band = chan->band;
+
+                mutex_lock(&local->mtx);
+
+                if (local->hw_offchan_tx_cookie) {
+                        mutex_unlock(&local->mtx);
+                        return -EBUSY;
+                }
+
+                /* TODO: bitrate control, TX processing? */
+                ret = drv_offchannel_tx(local, skb, chan, channel_type, wait);
+
+                if (ret == 0)
+                        local->hw_offchan_tx_cookie = *cookie;
+                mutex_unlock(&local->mtx);
+
+                /*
+                 * Allow driver to return 1 to indicate it wants to have the
+                 * frame transmitted with a remain_on_channel + regular TX.
+                 */
+                if (ret != 1)
+                        return ret;
+        }
+
         if (is_offchan && local->ops->remain_on_channel) {
                 unsigned int duration;
                 int ret;
@@ -1886,6 +1926,18 @@ static int ieee80211_mgmt_tx_cancel_wait(struct wiphy *wiphy,
 
         mutex_lock(&local->mtx);
 
+        if (local->ops->offchannel_tx_cancel_wait &&
+            local->hw_offchan_tx_cookie == cookie) {
+                ret = drv_offchannel_tx_cancel_wait(local);
+
+                if (!ret)
+                        local->hw_offchan_tx_cookie = 0;
+
+                mutex_unlock(&local->mtx);
+
+                return ret;
+        }
+
         if (local->ops->cancel_remain_on_channel) {
                 cookie ^= 2;
                 ret = ieee80211_cancel_remain_on_channel_hw(local, cookie);
diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
index 78af32d4bc58..3729296f6f95 100644
--- a/net/mac80211/driver-ops.h
+++ b/net/mac80211/driver-ops.h
@@ -5,9 +5,9 @@
 #include "ieee80211_i.h"
 #include "driver-trace.h"
 
-static inline int drv_tx(struct ieee80211_local *local, struct sk_buff *skb)
+static inline void drv_tx(struct ieee80211_local *local, struct sk_buff *skb)
 {
-        return local->ops->tx(&local->hw, skb);
+        local->ops->tx(&local->hw, skb);
 }
 
 static inline int drv_start(struct ieee80211_local *local)
@@ -495,4 +495,35 @@ static inline int drv_cancel_remain_on_channel(struct ieee80211_local *local)
         return ret;
 }
 
+static inline int drv_offchannel_tx(struct ieee80211_local *local,
+                                    struct sk_buff *skb,
+                                    struct ieee80211_channel *chan,
+                                    enum nl80211_channel_type channel_type,
+                                    unsigned int wait)
+{
+        int ret;
+
+        might_sleep();
+
+        trace_drv_offchannel_tx(local, skb, chan, channel_type, wait);
+        ret = local->ops->offchannel_tx(&local->hw, skb, chan,
+                                        channel_type, wait);
+        trace_drv_return_int(local, ret);
+
+        return ret;
+}
+
+static inline int drv_offchannel_tx_cancel_wait(struct ieee80211_local *local)
+{
+        int ret;
+
+        might_sleep();
+
+        trace_drv_offchannel_tx_cancel_wait(local);
+        ret = local->ops->offchannel_tx_cancel_wait(&local->hw);
+        trace_drv_return_int(local, ret);
+
+        return ret;
+}
+
 #endif /* __MAC80211_DRIVER_OPS */
diff --git a/net/mac80211/driver-trace.h b/net/mac80211/driver-trace.h
index e5cce19a7d65..520fe2444893 100644
--- a/net/mac80211/driver-trace.h
+++ b/net/mac80211/driver-trace.h
@@ -884,6 +884,39 @@ DEFINE_EVENT(local_only_evt, drv_cancel_remain_on_channel,
         TP_ARGS(local)
 );
 
+TRACE_EVENT(drv_offchannel_tx,
+        TP_PROTO(struct ieee80211_local *local, struct sk_buff *skb,
+                 struct ieee80211_channel *chan,
+                 enum nl80211_channel_type channel_type,
+                 unsigned int wait),
+
+        TP_ARGS(local, skb, chan, channel_type, wait),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                __field(int, center_freq)
+                __field(int, channel_type)
+                __field(unsigned int, wait)
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                __entry->center_freq = chan->center_freq;
+                __entry->channel_type = channel_type;
+                __entry->wait = wait;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT " freq:%dMHz, wait:%dms",
+                LOCAL_PR_ARG, __entry->center_freq, __entry->wait
+        )
+);
+
+DEFINE_EVENT(local_only_evt, drv_offchannel_tx_cancel_wait,
+        TP_PROTO(struct ieee80211_local *local),
+        TP_ARGS(local)
+);
+
 /*
  * Tracing for API calls that drivers call.
  */
diff --git a/net/mac80211/ht.c b/net/mac80211/ht.c
index 75d679d75e63..b9e4b9bd2179 100644
--- a/net/mac80211/ht.c
+++ b/net/mac80211/ht.c
@@ -66,6 +66,9 @@ void ieee80211_ht_cap_ie_to_sta_ht_cap(struct ieee80211_supported_band *sband,
         /* own MCS TX capabilities */
         tx_mcs_set_cap = sband->ht_cap.mcs.tx_params;
 
+        /* Copy peer MCS TX capabilities, the driver might need them. */
+        ht_cap->mcs.tx_params = ht_cap_ie->mcs.tx_params;
+
         /* can we TX with MCS rates? */
         if (!(tx_mcs_set_cap & IEEE80211_HT_MCS_TX_DEFINED))
                 return;
@@ -79,7 +82,7 @@ void ieee80211_ht_cap_ie_to_sta_ht_cap(struct ieee80211_supported_band *sband,
                 max_tx_streams = IEEE80211_HT_MCS_TX_MAX_STREAMS;
 
         /*
-         * 802.11n D5.0 20.3.5 / 20.6 says:
+         * 802.11n-2009 20.3.5 / 20.6 says:
          * - indices 0 to 7 and 32 are single spatial stream
          * - 8 to 31 are multiple spatial streams using equal modulation
          *   [8..15 for two streams, 16..23 for three and 24..31 for four]
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index a42aa61269ea..3e81af1fce58 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -31,7 +31,6 @@
 #define IEEE80211_IBSS_JOIN_TIMEOUT (7 * HZ)
 
 #define IEEE80211_IBSS_MERGE_INTERVAL (30 * HZ)
-#define IEEE80211_IBSS_MERGE_DELAY 0x400000
 #define IEEE80211_IBSS_INACTIVITY_LIMIT (60 * HZ)
 
 #define IEEE80211_IBSS_MAX_STA_ENTRIES 128
@@ -355,7 +354,7 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
         if (memcmp(cbss->bssid, sdata->u.ibss.bssid, ETH_ALEN) == 0)
                 goto put_bss;
 
-        if (rx_status->flag & RX_FLAG_TSFT) {
+        if (rx_status->flag & RX_FLAG_MACTIME_MPDU) {
                 /*
                  * For correct IBSS merging we need mactime; since mactime is
                  * defined as the time the first data symbol of the frame hits
@@ -397,10 +396,6 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
                jiffies);
 #endif
 
-        /* give slow hardware some time to do the TSF sync */
-        if (rx_timestamp < IEEE80211_IBSS_MERGE_DELAY)
-                goto put_bss;
-
         if (beacon_timestamp > rx_timestamp) {
 #ifdef CONFIG_MAC80211_IBSS_DEBUG
                 printk(KERN_DEBUG "%s: beacon TSF higher than "
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 0a570a111a84..a40401701424 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -957,6 +957,7 @@ struct ieee80211_local {
         unsigned int hw_roc_duration;
         u32 hw_roc_cookie;
         bool hw_roc_for_tx;
+        unsigned long hw_offchan_tx_cookie;
 
         /* dummy netdev for use w/ NAPI */
         struct net_device napi_dev;
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 7b3f9df725bd..cc984bd861cf 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -145,6 +145,9 @@ void ieee80211_sta_reset_conn_monitor(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 
+        if (unlikely(!sdata->u.mgd.associated))
+                return;
+
         if (sdata->local->hw.flags & IEEE80211_HW_CONNECTION_MONITOR)
                 return;
 
@@ -738,9 +741,19 @@ void ieee80211_dynamic_ps_enable_work(struct work_struct *work)
                 return;
 
         if ((local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK) &&
-            (!(ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED)))
+            (!(ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED))) {
+                netif_tx_stop_all_queues(sdata->dev);
+                /*
+                 * Flush all the frames queued in the driver before
+                 * going to power save
+                 */
+                drv_flush(local, false);
                 ieee80211_send_nullfunc(local, sdata, 1);
 
+                /* Flush once again to get the tx status of nullfunc frame */
+                drv_flush(local, false);
+        }
+
         if (!((local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS) &&
               (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK)) ||
             (ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED)) {
@@ -748,6 +761,8 @@ void ieee80211_dynamic_ps_enable_work(struct work_struct *work)
                 local->hw.conf.flags |= IEEE80211_CONF_PS;
                 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
         }
+
+        netif_tx_start_all_queues(sdata->dev);
 }
 
 void ieee80211_dynamic_ps_timer(unsigned long data)
@@ -1071,12 +1086,6 @@ void ieee80211_sta_rx_notify(struct ieee80211_sub_if_data *sdata,
         if (is_multicast_ether_addr(hdr->addr1))
                 return;
 
-        /*
-         * In case we receive frames after disassociation.
-         */
-        if (!sdata->u.mgd.associated)
-                return;
-
         ieee80211_sta_reset_conn_monitor(sdata);
 }
 
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index f502634d43af..5c1930ba8ebe 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -77,7 +77,7 @@ ieee80211_rx_radiotap_len(struct ieee80211_local *local,
         /* always present fields */
         len = sizeof(struct ieee80211_radiotap_header) + 9;
 
-        if (status->flag & RX_FLAG_TSFT)
+        if (status->flag & RX_FLAG_MACTIME_MPDU)
                 len += 8;
         if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
                 len += 1;
@@ -123,7 +123,7 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
         /* the order of the following fields is important */
 
         /* IEEE80211_RADIOTAP_TSFT */
-        if (status->flag & RX_FLAG_TSFT) {
+        if (status->flag & RX_FLAG_MACTIME_MPDU) {
                 put_unaligned_le64(status->mactime, pos);
                 rthdr->it_present |=
                         cpu_to_le32(1 << IEEE80211_RADIOTAP_TSFT);
@@ -1156,14 +1156,23 @@ ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
         if (rx->sdata->vif.type == NL80211_IFTYPE_ADHOC) {
                 u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len,
                                                 NL80211_IFTYPE_ADHOC);
-                if (compare_ether_addr(bssid, rx->sdata->u.ibss.bssid) == 0)
+                if (compare_ether_addr(bssid, rx->sdata->u.ibss.bssid) == 0) {
                         sta->last_rx = jiffies;
+                        if (ieee80211_is_data(hdr->frame_control)) {
+                                sta->last_rx_rate_idx = status->rate_idx;
+                                sta->last_rx_rate_flag = status->flag;
+                        }
+                }
         } else if (!is_multicast_ether_addr(hdr->addr1)) {
                 /*
                  * Mesh beacons will update last_rx when if they are found to
                  * match the current local configuration when processed.
                  */
                 sta->last_rx = jiffies;
+                if (ieee80211_is_data(hdr->frame_control)) {
+                        sta->last_rx_rate_idx = status->rate_idx;
+                        sta->last_rx_rate_flag = status->flag;
+                }
         }
 
         if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index ca0b69060ef7..57681149e37f 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -209,6 +209,8 @@ enum plink_state {
  * @rate_ctrl_priv: rate control private per-STA pointer
  * @last_tx_rate: rate used for last transmit, to report to userspace as
  *      "the" transmit rate
+ * @last_rx_rate_idx: rx status rate index of the last data packet
+ * @last_rx_rate_flag: rx status flag of the last data packet
  * @lock: used for locking all fields that require locking, see comments
  *      in the header file.
  * @flaglock: spinlock for flags accesses
@@ -311,6 +313,8 @@ struct sta_info {
         unsigned long tx_bytes;
         unsigned long tx_fragments;
         struct ieee80211_tx_rate last_tx_rate;
+        int last_rx_rate_idx;
+        int last_rx_rate_flag;
         u16 tid_seq[IEEE80211_QOS_CTL_TID_MASK + 1];
 
         /*
diff --git a/net/mac80211/status.c b/net/mac80211/status.c
index 010a559bd872..b936dd29e92b 100644
--- a/net/mac80211/status.c
+++ b/net/mac80211/status.c
@@ -318,8 +318,6 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
                 if (info->flags & IEEE80211_TX_STAT_ACK) {
                         local->ps_sdata->u.mgd.flags |=
                                         IEEE80211_STA_NULLFUNC_ACKED;
-                        ieee80211_queue_work(&local->hw,
-                                        &local->dynamic_ps_enable_work);
                 } else
                         mod_timer(&local->dynamic_ps_timer, jiffies +
                                         msecs_to_jiffies(10));
@@ -343,6 +341,10 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
                         cookie = local->hw_roc_cookie ^ 2;
                         local->hw_roc_skb_for_status = NULL;
                 }
+
+                if (cookie == local->hw_offchan_tx_cookie)
+                        local->hw_offchan_tx_cookie = 0;
+
                 cfg80211_mgmt_tx_status(
                         skb->dev, cookie, skb->data, skb->len,
                         !!(info->flags & IEEE80211_TX_STAT_ACK), GFP_ATOMIC);
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 34edf7f22b0e..081dcaf6577b 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -33,10 +33,6 @@
 #include "wme.h"
 #include "rate.h"
 
-#define IEEE80211_TX_OK         0
-#define IEEE80211_TX_AGAIN      1
-#define IEEE80211_TX_PENDING    2
-
 /* misc utils */
 
 static __le16 ieee80211_duration(struct ieee80211_tx_data *tx, int group_addr,
@@ -1285,16 +1281,17 @@ ieee80211_tx_prepare(struct ieee80211_sub_if_data *sdata,
         return TX_CONTINUE;
 }
 
-static int __ieee80211_tx(struct ieee80211_local *local,
-                          struct sk_buff **skbp,
-                          struct sta_info *sta,
-                          bool txpending)
+/*
+ * Returns false if the frame couldn't be transmitted but was queued instead.
+ */
+static bool __ieee80211_tx(struct ieee80211_local *local, struct sk_buff **skbp,
+                           struct sta_info *sta, bool txpending)
 {
         struct sk_buff *skb = *skbp, *next;
         struct ieee80211_tx_info *info;
         struct ieee80211_sub_if_data *sdata;
         unsigned long flags;
-        int ret, len;
+        int len;
         bool fragm = false;
 
         while (skb) {
@@ -1302,13 +1299,37 @@ static int __ieee80211_tx(struct ieee80211_local *local,
                 __le16 fc;
 
                 spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
-                ret = IEEE80211_TX_OK;
                 if (local->queue_stop_reasons[q] ||
-                    (!txpending && !skb_queue_empty(&local->pending[q])))
-                        ret = IEEE80211_TX_PENDING;
+                    (!txpending && !skb_queue_empty(&local->pending[q]))) {
+                        /*
+                         * Since queue is stopped, queue up frames for later
+                         * transmission from the tx-pending tasklet when the
+                         * queue is woken again.
+                         */
+
+                        do {
+                                next = skb->next;
+                                skb->next = NULL;
+                                /*
+                                 * NB: If txpending is true, next must already
+                                 * be NULL since we must've gone through this
+                                 * loop before already; therefore we can just
+                                 * queue the frame to the head without worrying
+                                 * about reordering of fragments.
+                                 */
+                                if (unlikely(txpending))
+                                        __skb_queue_head(&local->pending[q],
+                                                         skb);
+                                else
+                                        __skb_queue_tail(&local->pending[q],
+                                                         skb);
+                        } while ((skb = next));
+
+                        spin_unlock_irqrestore(&local->queue_stop_reason_lock,
+                                               flags);
+                        return false;
+                }
                 spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
-                if (ret != IEEE80211_TX_OK)
-                        return ret;
 
                 info = IEEE80211_SKB_CB(skb);
 
@@ -1343,15 +1364,7 @@ static int __ieee80211_tx(struct ieee80211_local *local,
                         info->control.sta = NULL;
 
                 fc = ((struct ieee80211_hdr *)skb->data)->frame_control;
-                ret = drv_tx(local, skb);
-                if (WARN_ON(ret != NETDEV_TX_OK && skb->len != len)) {
-                        dev_kfree_skb(skb);
-                        ret = NETDEV_TX_OK;
-                }
-                if (ret != NETDEV_TX_OK) {
-                        info->control.vif = &sdata->vif;
-                        return IEEE80211_TX_AGAIN;
-                }
+                drv_tx(local, skb);
 
                 ieee80211_tpt_led_trig_tx(local, fc, len);
                 *skbp = skb = next;
@@ -1359,7 +1372,7 @@ static int __ieee80211_tx(struct ieee80211_local *local,
                 fragm = true;
         }
 
-        return IEEE80211_TX_OK;
+        return true;
 }
 
 /*
@@ -1419,23 +1432,24 @@ static int invoke_tx_handlers(struct ieee80211_tx_data *tx)
         return 0;
 }
 
-static void ieee80211_tx(struct ieee80211_sub_if_data *sdata,
+/*
+ * Returns false if the frame couldn't be transmitted but was queued instead.
+ */
+static bool ieee80211_tx(struct ieee80211_sub_if_data *sdata,
                          struct sk_buff *skb, bool txpending)
 {
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_tx_data tx;
         ieee80211_tx_result res_prepare;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-        struct sk_buff *next;
-        unsigned long flags;
-        int ret, retries;
         u16 queue;
+        bool result = true;
 
         queue = skb_get_queue_mapping(skb);
 
         if (unlikely(skb->len < 10)) {
                 dev_kfree_skb(skb);
-                return;
+                return true;
         }
 
         rcu_read_lock();
@@ -1445,85 +1459,19 @@ static void ieee80211_tx(struct ieee80211_sub_if_data *sdata,
 
         if (unlikely(res_prepare == TX_DROP)) {
                 dev_kfree_skb(skb);
-                rcu_read_unlock();
-                return;
+                goto out;
         } else if (unlikely(res_prepare == TX_QUEUED)) {
-                rcu_read_unlock();
-                return;
+                goto out;
         }
 
         tx.channel = local->hw.conf.channel;
         info->band = tx.channel->band;
 
-        if (invoke_tx_handlers(&tx))
-                goto out;
-
-        retries = 0;
- retry:
-        ret = __ieee80211_tx(local, &tx.skb, tx.sta, txpending);
-        switch (ret) {
-        case IEEE80211_TX_OK:
-                break;
-        case IEEE80211_TX_AGAIN:
-                /*
-                 * Since there are no fragmented frames on A-MPDU
-                 * queues, there's no reason for a driver to reject
-                 * a frame there, warn and drop it.
-                 */
-                if (WARN_ON(info->flags & IEEE80211_TX_CTL_AMPDU))
-                        goto drop;
-                /* fall through */
-        case IEEE80211_TX_PENDING:
-                skb = tx.skb;
-
-                spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
-
-                if (local->queue_stop_reasons[queue] ||
-                    !skb_queue_empty(&local->pending[queue])) {
-                        /*
-                         * if queue is stopped, queue up frames for later
-                         * transmission from the tasklet
-                         */
-                        do {
-                                next = skb->next;
-                                skb->next = NULL;
-                                if (unlikely(txpending))
-                                        __skb_queue_head(&local->pending[queue],
-                                                         skb);
-                                else
-                                        __skb_queue_tail(&local->pending[queue],
-                                                         skb);
-                        } while ((skb = next));
-
-                        spin_unlock_irqrestore(&local->queue_stop_reason_lock,
-                                               flags);
-                } else {
-                        /*
-                         * otherwise retry, but this is a race condition or
-                         * a driver bug (which we warn about if it persists)
-                         */
-                        spin_unlock_irqrestore(&local->queue_stop_reason_lock,
-                                               flags);
-
-                        retries++;
-                        if (WARN(retries > 10, "tx refused but queue active\n"))
-                                goto drop;
-                        goto retry;
-                }
-        }
+        if (!invoke_tx_handlers(&tx))
+                result = __ieee80211_tx(local, &tx.skb, tx.sta, txpending);
  out:
         rcu_read_unlock();
-        return;
-
- drop:
-        rcu_read_unlock();
-
-        skb = tx.skb;
-        while (skb) {
-                next = skb->next;
-                dev_kfree_skb(skb);
-                skb = next;
-        }
+        return result;
 }
 
 /* device xmit handlers */
@@ -2070,6 +2018,11 @@ void ieee80211_clear_tx_pending(struct ieee80211_local *local)
                 skb_queue_purge(&local->pending[i]);
 }
 
+/*
+ * Returns false if the frame couldn't be transmitted but was queued instead,
+ * which in this case means re-queued -- take as an indication to stop sending
+ * more pending frames.
+ */
 static bool ieee80211_tx_pending_skb(struct ieee80211_local *local,
                                      struct sk_buff *skb)
 {
@@ -2077,20 +2030,17 @@ static bool ieee80211_tx_pending_skb(struct ieee80211_local *local,
         struct ieee80211_sub_if_data *sdata;
         struct sta_info *sta;
         struct ieee80211_hdr *hdr;
-        int ret;
-        bool result = true;
+        bool result;
 
         sdata = vif_to_sdata(info->control.vif);
 
         if (info->flags & IEEE80211_TX_INTFL_NEED_TXPROCESSING) {
-                ieee80211_tx(sdata, skb, true);
+                result = ieee80211_tx(sdata, skb, true);
         } else {
                 hdr = (struct ieee80211_hdr *)skb->data;
                 sta = sta_info_get(sdata, hdr->addr1);
 
-                ret = __ieee80211_tx(local, &skb, sta, true);
-                if (ret != IEEE80211_TX_OK)
-                        result = false;
+                result = __ieee80211_tx(local, &skb, sta, true);
         }
 
         return result;
@@ -2132,8 +2082,6 @@ void ieee80211_tx_pending(unsigned long data)
                                                 flags);
 
                         txok = ieee80211_tx_pending_skb(local, skb);
-                        if (!txok)
-                                __skb_queue_head(&local->pending[i], skb);
                         spin_lock_irqsave(&local->queue_stop_reason_lock,
                                           flags);
                         if (!txok)
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 864ddfbeff2f..4ebce4284e9d 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -1968,13 +1968,41 @@ static int parse_station_flags(struct genl_info *info,
         return 0;
 }
 
+static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
+                                 int attr)
+{
+        struct nlattr *rate;
+        u16 bitrate;
+
+        rate = nla_nest_start(msg, attr);
+        if (!rate)
+                goto nla_put_failure;
+
+        /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
+        bitrate = cfg80211_calculate_bitrate(info);
+        if (bitrate > 0)
+                NLA_PUT_U16(msg, NL80211_RATE_INFO_BITRATE, bitrate);
+
+        if (info->flags & RATE_INFO_FLAGS_MCS)
+                NLA_PUT_U8(msg, NL80211_RATE_INFO_MCS, info->mcs);
+        if (info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH)
+                NLA_PUT_FLAG(msg, NL80211_RATE_INFO_40_MHZ_WIDTH);
+        if (info->flags & RATE_INFO_FLAGS_SHORT_GI)
+                NLA_PUT_FLAG(msg, NL80211_RATE_INFO_SHORT_GI);
+
+        nla_nest_end(msg, rate);
+        return true;
+
+nla_put_failure:
+        return false;
+}
+
 static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
                                 int flags, struct net_device *dev,
                                 const u8 *mac_addr, struct station_info *sinfo)
 {
         void *hdr;
-        struct nlattr *sinfoattr, *txrate;
-        u16 bitrate;
+        struct nlattr *sinfoattr;
 
         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
         if (!hdr)
@@ -2013,24 +2041,14 @@ static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
                 NLA_PUT_U8(msg, NL80211_STA_INFO_SIGNAL_AVG,
                            sinfo->signal_avg);
         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
-                txrate = nla_nest_start(msg, NL80211_STA_INFO_TX_BITRATE);
-                if (!txrate)
+                if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
+                                          NL80211_STA_INFO_TX_BITRATE))
+                        goto nla_put_failure;
+        }
+        if (sinfo->filled & STATION_INFO_RX_BITRATE) {
+                if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
+                                          NL80211_STA_INFO_RX_BITRATE))
                         goto nla_put_failure;
-
-                /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
-                bitrate = cfg80211_calculate_bitrate(&sinfo->txrate);
-                if (bitrate > 0)
-                        NLA_PUT_U16(msg, NL80211_RATE_INFO_BITRATE, bitrate);
-
-                if (sinfo->txrate.flags & RATE_INFO_FLAGS_MCS)
-                        NLA_PUT_U8(msg, NL80211_RATE_INFO_MCS,
-                                    sinfo->txrate.mcs);
-                if (sinfo->txrate.flags & RATE_INFO_FLAGS_40_MHZ_WIDTH)
-                        NLA_PUT_FLAG(msg, NL80211_RATE_INFO_40_MHZ_WIDTH);
-                if (sinfo->txrate.flags & RATE_INFO_FLAGS_SHORT_GI)
-                        NLA_PUT_FLAG(msg, NL80211_RATE_INFO_SHORT_GI);
-
-                nla_nest_end(msg, txrate);
         }
         if (sinfo->filled & STATION_INFO_RX_PACKETS)
                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_PACKETS,