12 files changed, 306 insertions, 310 deletions

diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 6f8756d26a93..fe4efdd4253d 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -142,7 +142,6 @@ typedef unsigned __bitwise__ ieee80211_tx_result;
 #define IEEE80211_TX_FRAGMENTED         BIT(0)
 #define IEEE80211_TX_UNICAST            BIT(1)
 #define IEEE80211_TX_PS_BUFFERED        BIT(2)
-#define IEEE80211_TX_PROBE_LAST_FRAG    BIT(3)
 
 struct ieee80211_tx_data {
         struct sk_buff *skb;
@@ -153,11 +152,6 @@ struct ieee80211_tx_data {
         struct ieee80211_key *key;
 
         struct ieee80211_channel *channel;
-        s8 rate_idx;
-        /* use this rate (if set) for last fragment; rate can
-         * be set to lower rate for the first fragments, e.g.,
-         * when using CTS protection with IEEE 802.11g. */
-        s8 last_frag_rate_idx;
 
         /* Extra fragments (in addition to the first fragment
          * in skb) */
@@ -203,9 +197,7 @@ struct ieee80211_rx_data {
 struct ieee80211_tx_stored_packet {
         struct sk_buff *skb;
         struct sk_buff **extra_frag;
-        s8 last_frag_rate_idx;
         int num_extra_frag;
-        bool last_frag_rate_ctrl_probe;
 };
 
 struct beacon_data {
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index ffff54944f9d..88c1975a97a5 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -41,6 +41,8 @@
  */
 struct ieee80211_tx_status_rtap_hdr {
         struct ieee80211_radiotap_header hdr;
+        u8 rate;
+        u8 padding_for_rate;
         __le16 tx_flags;
         u8 data_retries;
 } __attribute__ ((packed));
@@ -465,13 +467,28 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
         struct ieee80211_sub_if_data *sdata;
         struct net_device *prev_dev = NULL;
         struct sta_info *sta;
+        int retry_count = -1, i;
+
+        for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
+                /* the HW cannot have attempted that rate */
+                if (i >= hw->max_rates) {
+                        info->status.rates[i].idx = -1;
+                        info->status.rates[i].count = 0;
+                }
+
+                retry_count += info->status.rates[i].count;
+        }
+        if (retry_count < 0)
+                retry_count = 0;
 
         rcu_read_lock();
 
+        sband = local->hw.wiphy->bands[info->band];
+
         sta = sta_info_get(local, hdr->addr1);
 
         if (sta) {
-                if (info->status.excessive_retries &&
+                if (!(info->flags & IEEE80211_TX_STAT_ACK) &&
                     test_sta_flags(sta, WLAN_STA_PS)) {
                         /*
                          * The STA is in power save mode, so assume
@@ -502,12 +519,11 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
                         rcu_read_unlock();
                         return;
                 } else {
-                        if (info->status.excessive_retries)
+                        if (!(info->flags & IEEE80211_TX_STAT_ACK))
                                 sta->tx_retry_failed++;
-                        sta->tx_retry_count += info->status.retry_count;
+                        sta->tx_retry_count += retry_count;
                 }
 
-                sband = local->hw.wiphy->bands[info->band];
                 rate_control_tx_status(local, sband, sta, skb);
         }
 
@@ -528,9 +544,9 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
                         local->dot11TransmittedFrameCount++;
                         if (is_multicast_ether_addr(hdr->addr1))
                                 local->dot11MulticastTransmittedFrameCount++;
-                        if (info->status.retry_count > 0)
+                        if (retry_count > 0)
                                 local->dot11RetryCount++;
-                        if (info->status.retry_count > 1)
+                        if (retry_count > 1)
                                 local->dot11MultipleRetryCount++;
                 }
 
@@ -574,19 +590,30 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
         rthdr->hdr.it_len = cpu_to_le16(sizeof(*rthdr));
         rthdr->hdr.it_present =
                 cpu_to_le32((1 << IEEE80211_RADIOTAP_TX_FLAGS) |
-                            (1 << IEEE80211_RADIOTAP_DATA_RETRIES));
+                            (1 << IEEE80211_RADIOTAP_DATA_RETRIES) |
+                            (1 << IEEE80211_RADIOTAP_RATE));
 
         if (!(info->flags & IEEE80211_TX_STAT_ACK) &&
             !is_multicast_ether_addr(hdr->addr1))
                 rthdr->tx_flags |= cpu_to_le16(IEEE80211_RADIOTAP_F_TX_FAIL);
 
-        if ((info->flags & IEEE80211_TX_CTL_USE_RTS_CTS) &&
-            (info->flags & IEEE80211_TX_CTL_USE_CTS_PROTECT))
+        /*
+         * XXX: Once radiotap gets the bitmap reset thing the vendor
+         *      extensions proposal contains, we can actually report
+         *      the whole set of tries we did.
+         */
+        if ((info->status.rates[0].flags & IEEE80211_TX_RC_USE_RTS_CTS) ||
+            (info->status.rates[0].flags & IEEE80211_TX_RC_USE_CTS_PROTECT))
                 rthdr->tx_flags |= cpu_to_le16(IEEE80211_RADIOTAP_F_TX_CTS);
-        else if (info->flags & IEEE80211_TX_CTL_USE_RTS_CTS)
+        else if (info->status.rates[0].flags & IEEE80211_TX_RC_USE_RTS_CTS)
                 rthdr->tx_flags |= cpu_to_le16(IEEE80211_RADIOTAP_F_TX_RTS);
+        if (info->status.rates[0].idx >= 0 &&
+            !(info->status.rates[0].flags & IEEE80211_TX_RC_MCS))
+                rthdr->rate = sband->bitrates[
+                                info->status.rates[0].idx].bitrate / 5;
 
-        rthdr->data_retries = info->status.retry_count;
+        /* for now report the total retry_count */
+        rthdr->data_retries = retry_count;
 
         /* XXX: is this sufficient for BPF? */
         skb_set_mac_header(skb, 0);
@@ -671,8 +698,9 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
         BUG_ON(!ops->configure_filter);
         local->ops = ops;
 
-        local->hw.queues = 1; /* default */
-
+        /* set up some defaults */
+        local->hw.queues = 1;
+        local->hw.max_rates = 1;
         local->rts_threshold = IEEE80211_MAX_RTS_THRESHOLD;
         local->fragmentation_threshold = IEEE80211_MAX_FRAG_THRESHOLD;
         local->hw.conf.long_frame_max_tx_count = 4;
diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
index 501c7831adb4..e8d573d592e7 100644
--- a/net/mac80211/mesh_hwmp.c
+++ b/net/mac80211/mesh_hwmp.c
@@ -218,12 +218,16 @@ static u32 airtime_link_metric_get(struct ieee80211_local *local,
 
         if (sta->fail_avg >= 100)
                 return MAX_METRIC;
+
+        if (sta->last_tx_rate.flags & IEEE80211_TX_RC_MCS)
+                return MAX_METRIC;
+
         err = (sta->fail_avg << ARITH_SHIFT) / 100;
 
         /* bitrate is in units of 100 Kbps, while we need rate in units of
          * 1Mbps. This will be corrected on tx_time computation.
          */
-        rate = sband->bitrates[sta->last_txrate_idx].bitrate;
+        rate = sband->bitrates[sta->last_tx_rate.idx].bitrate;
         tx_time = (device_constant + 10 * test_frame_len / rate);
         estimated_retx = ((1 << (2 * ARITH_SHIFT)) / (s_unit - err));
         result = (tx_time * estimated_retx) >> (2 * ARITH_SHIFT) ;
diff --git a/net/mac80211/rate.c b/net/mac80211/rate.c
index 5d786720d935..3fa7ab285066 100644
--- a/net/mac80211/rate.c
+++ b/net/mac80211/rate.c
@@ -199,48 +199,44 @@ static void rate_control_release(struct kref *kref)
 }
 
 void rate_control_get_rate(struct ieee80211_sub_if_data *sdata,
-                           struct ieee80211_supported_band *sband,
-                           struct sta_info *sta, struct sk_buff *skb,
-                           struct rate_selection *sel)
+                           struct sta_info *sta,
+                           struct ieee80211_tx_rate_control *txrc)
 {
         struct rate_control_ref *ref = sdata->local->rate_ctrl;
         void *priv_sta = NULL;
         struct ieee80211_sta *ista = NULL;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(txrc->skb);
         int i;
 
-        sel->rate_idx = -1;
-        sel->nonerp_idx = -1;
-        sel->probe_idx = -1;
-        sel->max_rate_idx = sdata->max_ratectrl_rateidx;
-
         if (sta) {
                 ista = &sta->sta;
                 priv_sta = sta->rate_ctrl_priv;
         }
 
+        for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
+                info->control.rates[i].idx = -1;
+                info->control.rates[i].flags = 0;
+                info->control.rates[i].count = 1;
+        }
+
         if (sta && sdata->force_unicast_rateidx > -1)
-                sel->rate_idx = sdata->force_unicast_rateidx;
+                info->control.rates[0].idx = sdata->force_unicast_rateidx;
         else
-                ref->ops->get_rate(ref->priv, sband, ista, priv_sta, skb, sel);
-
-        if (sdata->max_ratectrl_rateidx > -1 &&
-            sel->rate_idx > sdata->max_ratectrl_rateidx)
-                sel->rate_idx = sdata->max_ratectrl_rateidx;
-
-        BUG_ON(sel->rate_idx < 0);
-
-        /* Select a non-ERP backup rate. */
-        if (sel->nonerp_idx < 0) {
-                for (i = 0; i < sband->n_bitrates; i++) {
-                        struct ieee80211_rate *rate = &sband->bitrates[i];
-                        if (sband->bitrates[sel->rate_idx].bitrate < rate->bitrate)
-                                break;
-
-                        if (rate_supported(ista, sband->band, i) &&
-                            !(rate->flags & IEEE80211_RATE_ERP_G))
-                                sel->nonerp_idx = i;
-                }
+                ref->ops->get_rate(ref->priv, ista, priv_sta, txrc);
+
+        /*
+         * try to enforce the maximum rate the user wanted
+         */
+        if (sdata->max_ratectrl_rateidx > -1)
+                for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
+                        if (info->control.rates[i].flags & IEEE80211_TX_RC_MCS)
+                                continue;
+                        info->control.rates[i].idx =
+                                min_t(s8, info->control.rates[i].idx,
+                                      sdata->max_ratectrl_rateidx);
         }
+
+        BUG_ON(info->control.rates[0].idx < 0);
 }
 
 struct rate_control_ref *rate_control_get(struct rate_control_ref *ref)
diff --git a/net/mac80211/rate.h b/net/mac80211/rate.h
index d0092f847f82..7c25edf9ac55 100644
--- a/net/mac80211/rate.h
+++ b/net/mac80211/rate.h
@@ -31,9 +31,8 @@ struct rate_control_ref {
 struct rate_control_ref *rate_control_alloc(const char *name,
                                             struct ieee80211_local *local);
 void rate_control_get_rate(struct ieee80211_sub_if_data *sdata,
-                           struct ieee80211_supported_band *sband,
-                           struct sta_info *sta, struct sk_buff *skb,
-                           struct rate_selection *sel);
+                           struct sta_info *sta,
+                           struct ieee80211_tx_rate_control *txrc);
 struct rate_control_ref *rate_control_get(struct rate_control_ref *ref);
 void rate_control_put(struct rate_control_ref *ref);
 
diff --git a/net/mac80211/rc80211_minstrel.c b/net/mac80211/rc80211_minstrel.c
index f6d69dab07a3..759ddd8bf0f4 100644
--- a/net/mac80211/rc80211_minstrel.c
+++ b/net/mac80211/rc80211_minstrel.c
@@ -169,30 +169,20 @@ minstrel_tx_status(void *priv, struct ieee80211_supported_band *sband,
 {
         struct minstrel_sta_info *mi = priv_sta;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-        struct ieee80211_tx_altrate *ar = info->status.retries;
-        struct minstrel_priv *mp = priv;
-        int i, ndx, tries;
-        int success = 0;
+        struct ieee80211_tx_rate *ar = info->status.rates;
+        int i, ndx;
+        int success;
 
-        if (!info->status.excessive_retries)
-                success = 1;
+        success = !!(info->flags & IEEE80211_TX_STAT_ACK);
 
-        if (!mp->has_mrr || (ar[0].rate_idx < 0)) {
-                ndx = rix_to_ndx(mi, info->tx_rate_idx);
-                tries = info->status.retry_count + 1;
-                mi->r[ndx].success += success;
-                mi->r[ndx].attempts += tries;
-                return;
-        }
-
-        for (i = 0; i < 4; i++) {
-                if (ar[i].rate_idx < 0)
+        for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
+                if (ar[i].idx < 0)
                         break;
 
-                ndx = rix_to_ndx(mi, ar[i].rate_idx);
-                mi->r[ndx].attempts += ar[i].limit + 1;
+                ndx = rix_to_ndx(mi, ar[i].idx);
+                mi->r[ndx].attempts += ar[i].count;
 
-                if ((i != 3) && (ar[i + 1].rate_idx < 0))
+                if ((i != IEEE80211_TX_MAX_RATES - 1) && (ar[i + 1].idx < 0))
                         mi->r[ndx].success += success;
         }
 
@@ -210,9 +200,9 @@ minstrel_get_retry_count(struct minstrel_rate *mr,
 {
         unsigned int retry = mr->adjusted_retry_count;
 
-        if (info->flags & IEEE80211_TX_CTL_USE_RTS_CTS)
+        if (info->control.rates[0].flags & IEEE80211_TX_RC_USE_RTS_CTS)
                 retry = max(2U, min(mr->retry_count_rtscts, retry));
-        else if (info->flags & IEEE80211_TX_CTL_USE_CTS_PROTECT)
+        else if (info->control.rates[0].flags & IEEE80211_TX_RC_USE_CTS_PROTECT)
                 retry = max(2U, min(mr->retry_count_cts, retry));
         return retry;
 }
@@ -234,14 +224,15 @@ minstrel_get_next_sample(struct minstrel_sta_info *mi)
 }
 
 void
-minstrel_get_rate(void *priv, struct ieee80211_supported_band *sband,
-                  struct ieee80211_sta *sta, void *priv_sta,
-                  struct sk_buff *skb, struct rate_selection *sel)
+minstrel_get_rate(void *priv, struct ieee80211_sta *sta,
+                  void *priv_sta, struct ieee80211_tx_rate_control *txrc)
 {
+        struct sk_buff *skb = txrc->skb;
+        struct ieee80211_supported_band *sband = txrc->sband;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         struct minstrel_sta_info *mi = priv_sta;
         struct minstrel_priv *mp = priv;
-        struct ieee80211_tx_altrate *ar = info->control.retries;
+        struct ieee80211_tx_rate *ar = info->control.rates;
         unsigned int ndx, sample_ndx = 0;
         bool mrr;
         bool sample_slower = false;
@@ -251,16 +242,12 @@ minstrel_get_rate(void *priv, struct ieee80211_supported_band *sband,
         int sample_rate;
 
         if (!sta || !mi || use_low_rate(skb)) {
-                sel->rate_idx = rate_lowest_index(sband, sta);
+                ar[0].idx = rate_lowest_index(sband, sta);
+                ar[0].count = mp->max_retry;
                 return;
         }
 
-        mrr = mp->has_mrr;
-
-        /* mac80211 does not allow mrr for RTS/CTS */
-        if ((info->flags & IEEE80211_TX_CTL_USE_RTS_CTS) ||
-            (info->flags & IEEE80211_TX_CTL_USE_CTS_PROTECT))
-                mrr = false;
+        mrr = mp->has_mrr && !txrc->rts && !txrc->bss_conf->use_cts_prot;
 
         if (time_after(jiffies, mi->stats_update + (mp->update_interval *
                         HZ) / 1000))
@@ -315,13 +302,12 @@ minstrel_get_rate(void *priv, struct ieee80211_supported_band *sband,
                         mi->sample_deferred++;
                 }
         }
-        sel->rate_idx = mi->r[ndx].rix;
-        info->control.retry_limit = minstrel_get_retry_count(&mi->r[ndx], info);
+        ar[0].idx = mi->r[ndx].rix;
+        ar[0].count = minstrel_get_retry_count(&mi->r[ndx], info);
 
         if (!mrr) {
-                ar[0].rate_idx = mi->lowest_rix;
-                ar[0].limit = mp->max_retry;
-                ar[1].rate_idx = -1;
+                ar[1].idx = mi->lowest_rix;
+                ar[1].count = mp->max_retry;
                 return;
         }
 
@@ -336,9 +322,9 @@ minstrel_get_rate(void *priv, struct ieee80211_supported_band *sband,
         }
         mrr_ndx[1] = mi->max_prob_rate;
         mrr_ndx[2] = 0;
-        for (i = 0; i < 3; i++) {
-                ar[i].rate_idx = mi->r[mrr_ndx[i]].rix;
-                ar[i].limit = mi->r[mrr_ndx[i]].adjusted_retry_count;
+        for (i = 1; i < 4; i++) {
+                ar[i].idx = mi->r[mrr_ndx[i - 1]].rix;
+                ar[i].count = mi->r[mrr_ndx[i - 1]].adjusted_retry_count;
         }
 }
 
@@ -532,13 +518,13 @@ minstrel_alloc(struct ieee80211_hw *hw, struct dentry *debugfsdir)
         /* maximum time that the hw is allowed to stay in one MRR segment */
         mp->segment_size = 6000;
 
-        if (hw->max_altrate_tries > 0)
-                mp->max_retry = hw->max_altrate_tries;
+        if (hw->max_rate_tries > 0)
+                mp->max_retry = hw->max_rate_tries;
         else
                 /* safe default, does not necessarily have to match hw properties */
                 mp->max_retry = 7;
 
-        if (hw->max_altrates >= 3)
+        if (hw->max_rates >= 4)
                 mp->has_mrr = true;
 
         mp->hw = hw;
diff --git a/net/mac80211/rc80211_pid.h b/net/mac80211/rc80211_pid.h
index ce099ea1d5d3..1a873f00691a 100644
--- a/net/mac80211/rc80211_pid.h
+++ b/net/mac80211/rc80211_pid.h
@@ -61,6 +61,7 @@ enum rc_pid_event_type {
 union rc_pid_event_data {
         /* RC_PID_EVENT_TX_STATUS */
         struct {
+                u32 flags;
                 struct ieee80211_tx_info tx_status;
         };
         /* RC_PID_EVENT_TYPE_RATE_CHANGE */
diff --git a/net/mac80211/rc80211_pid_algo.c b/net/mac80211/rc80211_pid_algo.c
index 86eb374e3b87..92caecfcee78 100644
--- a/net/mac80211/rc80211_pid_algo.c
+++ b/net/mac80211/rc80211_pid_algo.c
@@ -241,7 +241,7 @@ static void rate_control_pid_tx_status(void *priv, struct ieee80211_supported_ba
 
         /* Ignore all frames that were sent with a different rate than the rate
          * we currently advise mac80211 to use. */
-        if (info->tx_rate_idx != spinfo->txrate_idx)
+        if (info->status.rates[0].idx != spinfo->txrate_idx)
                 return;
 
         spinfo->tx_num_xmit++;
@@ -253,10 +253,10 @@ static void rate_control_pid_tx_status(void *priv, struct ieee80211_supported_ba
         /* We count frames that totally failed to be transmitted as two bad
          * frames, those that made it out but had some retries as one good and
          * one bad frame. */
-        if (info->status.excessive_retries) {
+        if (!(info->flags & IEEE80211_TX_STAT_ACK)) {
                 spinfo->tx_num_failed += 2;
                 spinfo->tx_num_xmit++;
-        } else if (info->status.retry_count) {
+        } else if (info->status.rates[0].count) {
                 spinfo->tx_num_failed++;
                 spinfo->tx_num_xmit++;
         }
@@ -270,23 +270,32 @@ static void rate_control_pid_tx_status(void *priv, struct ieee80211_supported_ba
 }
 
 static void
-rate_control_pid_get_rate(void *priv, struct ieee80211_supported_band *sband,
-                          struct ieee80211_sta *sta, void *priv_sta,
-                          struct sk_buff *skb,
-                          struct rate_selection *sel)
+rate_control_pid_get_rate(void *priv, struct ieee80211_sta *sta,
+                          void *priv_sta,
+                          struct ieee80211_tx_rate_control *txrc)
 {
+        struct sk_buff *skb = txrc->skb;
+        struct ieee80211_supported_band *sband = txrc->sband;
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         struct rc_pid_sta_info *spinfo = priv_sta;
         int rateidx;
         u16 fc;
 
+        if (txrc->rts)
+                info->control.rates[0].count =
+                        txrc->hw->conf.long_frame_max_tx_count;
+        else
+                info->control.rates[0].count =
+                        txrc->hw->conf.short_frame_max_tx_count;
+
         /* Send management frames and broadcast/multicast data using lowest
          * rate. */
         fc = le16_to_cpu(hdr->frame_control);
         if (!sta || !spinfo ||
             (fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA ||
             is_multicast_ether_addr(hdr->addr1)) {
-                sel->rate_idx = rate_lowest_index(sband, sta);
+                info->control.rates[0].idx = rate_lowest_index(sband, sta);
                 return;
         }
 
@@ -295,7 +304,7 @@ rate_control_pid_get_rate(void *priv, struct ieee80211_supported_band *sband,
         if (rateidx >= sband->n_bitrates)
                 rateidx = sband->n_bitrates - 1;
 
-        sel->rate_idx = rateidx;
+        info->control.rates[0].idx = rateidx;
 
 #ifdef CONFIG_MAC80211_DEBUGFS
         rate_control_pid_event_tx_rate(&spinfo->events,
diff --git a/net/mac80211/rc80211_pid_debugfs.c b/net/mac80211/rc80211_pid_debugfs.c
index 8121d3bc6835..a08a9b530347 100644
--- a/net/mac80211/rc80211_pid_debugfs.c
+++ b/net/mac80211/rc80211_pid_debugfs.c
@@ -43,6 +43,7 @@ void rate_control_pid_event_tx_status(struct rc_pid_event_buffer *buf,
 {
         union rc_pid_event_data evd;
 
+        evd.flags = stat->flags;
         memcpy(&evd.tx_status, stat, sizeof(struct ieee80211_tx_info));
         rate_control_pid_event(buf, RC_PID_EVENT_TYPE_TX_STATUS, &evd);
 }
@@ -167,8 +168,8 @@ static ssize_t rate_control_pid_events_read(struct file *file, char __user *buf,
         switch (ev->type) {
         case RC_PID_EVENT_TYPE_TX_STATUS:
                 p += snprintf(pb + p, length - p, "tx_status %u %u",
-                              ev->data.tx_status.status.excessive_retries,
-                              ev->data.tx_status.status.retry_count);
+                              !(ev->data.flags & IEEE80211_TX_STAT_ACK),
+                              ev->data.tx_status.status.rates[0].idx);
                 break;
         case RC_PID_EVENT_TYPE_RATE_CHANGE:
                 p += snprintf(pb + p, length - p, "rate_change %d %d",
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index 168a39a298bd..4ac372aa75ce 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -196,7 +196,7 @@ struct sta_ampdu_mlme {
  * @tx_packets: number of RX/TX MSDUs
  * @tx_bytes: TBD
  * @tx_fragments: number of transmitted MPDUs
- * @last_txrate_idx: Index of the last used transmit rate
+ * @last_txrate: description of the last used transmit rate
  * @tid_seq: TBD
  * @ampdu_mlme: TBD
  * @timer_to_tid: identity mapping to ID timers
@@ -267,7 +267,7 @@ struct sta_info {
         unsigned long tx_packets;
         unsigned long tx_bytes;
         unsigned long tx_fragments;
-        unsigned int last_txrate_idx;
+        struct ieee80211_tx_rate last_tx_rate;
         u16 tid_seq[IEEE80211_QOS_CTL_TID_MASK + 1];
 
         /*
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 6f3e4be97631..21951bac1ef7 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -46,13 +46,20 @@ static __le16 ieee80211_duration(struct ieee80211_tx_data *tx, int group_addr,
         struct ieee80211_local *local = tx->local;
         struct ieee80211_supported_band *sband;
         struct ieee80211_hdr *hdr;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
+
+        /* assume HW handles this */
+        if (info->control.rates[0].flags & IEEE80211_TX_RC_MCS)
+                return 0;
+
+        /* uh huh? */
+        if (WARN_ON_ONCE(info->control.rates[0].idx < 0))
+                return 0;
 
         sband = local->hw.wiphy->bands[tx->channel->band];
-        txrate = &sband->bitrates[tx->rate_idx];
+        txrate = &sband->bitrates[info->control.rates[0].idx];
 
-        erp = 0;
-        if (tx->sdata->flags & IEEE80211_SDATA_OPERATING_GMODE)
-                erp = txrate->flags & IEEE80211_RATE_ERP_G;
+        erp = txrate->flags & IEEE80211_RATE_ERP_G;
 
         /*
          * data and mgmt (except PS Poll):
@@ -437,140 +444,154 @@ ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx)
 static ieee80211_tx_result debug_noinline
 ieee80211_tx_h_rate_ctrl(struct ieee80211_tx_data *tx)
 {
-        struct rate_selection rsel;
-        struct ieee80211_supported_band *sband;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
+        struct ieee80211_hdr *hdr = (void *)tx->skb->data;
+        struct ieee80211_supported_band *sband;
+        struct ieee80211_rate *rate;
+        int i, len;
+        bool inval = false, rts = false, short_preamble = false;
+        struct ieee80211_tx_rate_control txrc;
 
-        sband = tx->local->hw.wiphy->bands[tx->channel->band];
+        memset(&txrc, 0, sizeof(txrc));
 
-        if (likely(tx->rate_idx < 0)) {
-                rate_control_get_rate(tx->sdata, sband, tx->sta,
-                                      tx->skb, &rsel);
-                if (tx->sta)
-                        tx->sta->last_txrate_idx = rsel.rate_idx;
-                tx->rate_idx = rsel.rate_idx;
-                if (unlikely(rsel.probe_idx >= 0)) {
-                        info->flags |= IEEE80211_TX_CTL_RATE_CTRL_PROBE;
-                        tx->flags |= IEEE80211_TX_PROBE_LAST_FRAG;
-                        info->control.retries[0].rate_idx = tx->rate_idx;
-                        info->control.retries[0].limit = tx->local->hw.max_altrate_tries;
-                        tx->rate_idx = rsel.probe_idx;
-                } else if (info->control.retries[0].limit == 0)
-                        info->control.retries[0].rate_idx = -1;
-
-                if (unlikely(tx->rate_idx < 0))
-                        return TX_DROP;
-        } else
-                info->control.retries[0].rate_idx = -1;
+        sband = tx->local->hw.wiphy->bands[tx->channel->band];
 
-        if (tx->sdata->vif.bss_conf.use_cts_prot &&
-            (tx->flags & IEEE80211_TX_FRAGMENTED) && (rsel.nonerp_idx >= 0)) {
-                tx->last_frag_rate_idx = tx->rate_idx;
-                if (rsel.probe_idx >= 0)
-                        tx->flags &= ~IEEE80211_TX_PROBE_LAST_FRAG;
-                else
-                        tx->flags |= IEEE80211_TX_PROBE_LAST_FRAG;
-                tx->rate_idx = rsel.nonerp_idx;
-                info->tx_rate_idx = rsel.nonerp_idx;
-                info->flags &= ~IEEE80211_TX_CTL_RATE_CTRL_PROBE;
-        } else {
-                tx->last_frag_rate_idx = tx->rate_idx;
-                info->tx_rate_idx = tx->rate_idx;
+        len = min_t(int, tx->skb->len + FCS_LEN,
+                         tx->local->fragmentation_threshold);
+
+        /* set up the tx rate control struct we give the RC algo */
+        txrc.hw = local_to_hw(tx->local);
+        txrc.sband = sband;
+        txrc.bss_conf = &tx->sdata->vif.bss_conf;
+        txrc.skb = tx->skb;
+        txrc.reported_rate.idx = -1;
+        txrc.max_rate_idx = tx->sdata->max_ratectrl_rateidx;
+
+        /* set up RTS protection if desired */
+        if (tx->local->rts_threshold < IEEE80211_MAX_RTS_THRESHOLD &&
+            len > tx->local->rts_threshold) {
+                txrc.rts = rts = true;
         }
-        info->tx_rate_idx = tx->rate_idx;
 
-        return TX_CONTINUE;
-}
+        /*
+         * Use short preamble if the BSS can handle it, but not for
+         * management frames unless we know the receiver can handle
+         * that -- the management frame might be to a station that
+         * just wants a probe response.
+         */
+        if (tx->sdata->vif.bss_conf.use_short_preamble &&
+            (ieee80211_is_data(hdr->frame_control) ||
+             (tx->sta && test_sta_flags(tx->sta, WLAN_STA_SHORT_PREAMBLE))))
+                txrc.short_preamble = short_preamble = true;
 
-static ieee80211_tx_result debug_noinline
-ieee80211_tx_h_misc(struct ieee80211_tx_data *tx)
-{
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
-        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
-        struct ieee80211_supported_band *sband;
 
-        sband = tx->local->hw.wiphy->bands[tx->channel->band];
+        rate_control_get_rate(tx->sdata, tx->sta, &txrc);
+
+        if (unlikely(info->control.rates[0].idx < 0))
+                return TX_DROP;
+
+        if (txrc.reported_rate.idx < 0)
+                txrc.reported_rate = info->control.rates[0];
 
         if (tx->sta)
-                info->control.sta = &tx->sta->sta;
+                tx->sta->last_tx_rate = txrc.reported_rate;
 
-        if (!info->control.retry_limit) {
-                if (!is_multicast_ether_addr(hdr->addr1)) {
-                        int len = min_t(int, tx->skb->len + FCS_LEN,
-                                        tx->local->fragmentation_threshold);
-                        if (len > tx->local->rts_threshold
-                            && tx->local->rts_threshold <
-                                                IEEE80211_MAX_RTS_THRESHOLD) {
-                                info->flags |= IEEE80211_TX_CTL_USE_RTS_CTS;
-                                info->flags |=
-                                        IEEE80211_TX_CTL_LONG_RETRY_LIMIT;
-                                info->control.retry_limit =
-                                        tx->local->hw.conf.long_frame_max_tx_count - 1;
-                        } else {
-                                info->control.retry_limit =
-                                        tx->local->hw.conf.short_frame_max_tx_count - 1;
-                        }
-                } else {
-                        info->control.retry_limit = 1;
-                }
-        }
+        if (unlikely(!info->control.rates[0].count))
+                info->control.rates[0].count = 1;
 
-        if (tx->flags & IEEE80211_TX_FRAGMENTED) {
-                /* Do not use multiple retry rates when sending fragmented
-                 * frames.
-                 * TODO: The last fragment could still use multiple retry
-                 * rates. */
-                info->control.retries[0].rate_idx = -1;
+        if (is_multicast_ether_addr(hdr->addr1)) {
+                /*
+                 * XXX: verify the rate is in the basic rateset
+                 */
+                return TX_CONTINUE;
         }
 
-        /* Use CTS protection for unicast frames sent using extended rates if
-         * there are associated non-ERP stations and RTS/CTS is not configured
-         * for the frame. */
-        if ((tx->sdata->flags & IEEE80211_SDATA_OPERATING_GMODE) &&
-            (sband->bitrates[tx->rate_idx].flags & IEEE80211_RATE_ERP_G) &&
-            (tx->flags & IEEE80211_TX_UNICAST) &&
-            tx->sdata->vif.bss_conf.use_cts_prot &&
-            !(info->flags & IEEE80211_TX_CTL_USE_RTS_CTS))
-                info->flags |= IEEE80211_TX_CTL_USE_CTS_PROTECT;
-
-        /* Transmit data frames using short preambles if the driver supports
-         * short preambles at the selected rate and short preambles are
-         * available on the network at the current point in time. */
-        if (ieee80211_is_data(hdr->frame_control) &&
-            (sband->bitrates[tx->rate_idx].flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
-            tx->sdata->vif.bss_conf.use_short_preamble &&
-            (!tx->sta || test_sta_flags(tx->sta, WLAN_STA_SHORT_PREAMBLE))) {
-                info->flags |= IEEE80211_TX_CTL_SHORT_PREAMBLE;
+        /*
+         * set up the RTS/CTS rate as the fastest basic rate
+         * that is not faster than the data rate
+         *
+         * XXX: Should this check all retry rates?
+         */
+        if (!(info->control.rates[0].flags & IEEE80211_TX_RC_MCS)) {
+                s8 baserate = 0;
+
+                rate = &sband->bitrates[info->control.rates[0].idx];
+
+                for (i = 0; i < sband->n_bitrates; i++) {
+                        /* must be a basic rate */
+                        if (!(tx->sdata->vif.bss_conf.basic_rates & BIT(i)))
+                                continue;
+                        /* must not be faster than the data rate */
+                        if (sband->bitrates[i].bitrate > rate->bitrate)
+                                continue;
+                        /* maximum */
+                        if (sband->bitrates[baserate].bitrate <
+                             sband->bitrates[i].bitrate)
+                                baserate = i;
+                }
+
+                info->control.rts_cts_rate_idx = baserate;
         }
 
-        if ((info->flags & IEEE80211_TX_CTL_USE_RTS_CTS) ||
-            (info->flags & IEEE80211_TX_CTL_USE_CTS_PROTECT)) {
-                struct ieee80211_rate *rate;
-                s8 baserate = -1;
-                int idx;
+        for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
+                /*
+                 * make sure there's no valid rate following
+                 * an invalid one, just in case drivers don't
+                 * take the API seriously to stop at -1.
+                 */
+                if (inval) {
+                        info->control.rates[i].idx = -1;
+                        continue;
+                }
+                if (info->control.rates[i].idx < 0) {
+                        inval = true;
+                        continue;
+                }
 
-                /* Do not use multiple retry rates when using RTS/CTS */
-                info->control.retries[0].rate_idx = -1;
+                /*
+                 * For now assume MCS is already set up correctly, this
+                 * needs to be fixed.
+                 */
+                if (info->control.rates[i].flags & IEEE80211_TX_RC_MCS) {
+                        WARN_ON(info->control.rates[i].idx > 76);
+                        continue;
+                }
 
-                /* Use min(data rate, max base rate) as CTS/RTS rate */
-                rate = &sband->bitrates[tx->rate_idx];
+                /* set up RTS protection if desired */
+                if (rts)
+                        info->control.rates[i].flags |=
+                                IEEE80211_TX_RC_USE_RTS_CTS;
 
-                for (idx = 0; idx < sband->n_bitrates; idx++) {
-                        if (sband->bitrates[idx].bitrate > rate->bitrate)
-                                continue;
-                        if (tx->sdata->vif.bss_conf.basic_rates & BIT(idx) &&
-                            (baserate < 0 ||
-                             (sband->bitrates[baserate].bitrate
-                              < sband->bitrates[idx].bitrate)))
-                                baserate = idx;
+                /* RC is busted */
+                if (WARN_ON(info->control.rates[i].idx >=
+                            sband->n_bitrates)) {
+                        info->control.rates[i].idx = -1;
+                        continue;
                 }
 
-                if (baserate >= 0)
-                        info->control.rts_cts_rate_idx = baserate;
-                else
-                        info->control.rts_cts_rate_idx = 0;
+                rate = &sband->bitrates[info->control.rates[i].idx];
+
+                /* set up short preamble */
+                if (short_preamble &&
+                    rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
+                        info->control.rates[i].flags |=
+                                IEEE80211_TX_RC_USE_SHORT_PREAMBLE;
+
+                /* set up G protection */
+                if (!rts && tx->sdata->vif.bss_conf.use_cts_prot &&
+                    rate->flags & IEEE80211_RATE_ERP_G)
+                        info->control.rates[i].flags |=
+                                IEEE80211_TX_RC_USE_CTS_PROTECT;
         }
 
+        return TX_CONTINUE;
+}
+
+static ieee80211_tx_result debug_noinline
+ieee80211_tx_h_misc(struct ieee80211_tx_data *tx)
+{
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
+
         if (tx->sta)
                 info->control.sta = &tx->sta->sta;
 
@@ -678,6 +699,7 @@ ieee80211_tx_h_fragment(struct ieee80211_tx_data *tx)
         left = payload_len - per_fragm;
         for (i = 0; i < num_fragm - 1; i++) {
                 struct ieee80211_hdr *fhdr;
+                struct ieee80211_tx_info *info;
                 size_t copylen;
 
                 if (left <= 0)
@@ -692,20 +714,45 @@ ieee80211_tx_h_fragment(struct ieee80211_tx_data *tx)
                                       IEEE80211_ENCRYPT_TAILROOM);
                 if (!frag)
                         goto fail;
+
                 /* Make sure that all fragments use the same priority so
                  * that they end up using the same TX queue */
                 frag->priority = first->priority;
+
                 skb_reserve(frag, tx->local->tx_headroom +
                                   IEEE80211_ENCRYPT_HEADROOM);
+
+                /* copy TX information */
+                info = IEEE80211_SKB_CB(frag);
+                memcpy(info, first->cb, sizeof(frag->cb));
+
+                /* copy/fill in 802.11 header */
                 fhdr = (struct ieee80211_hdr *) skb_put(frag, hdrlen);
                 memcpy(fhdr, first->data, hdrlen);
-                if (i == num_fragm - 2)
-                        fhdr->frame_control &= cpu_to_le16(~IEEE80211_FCTL_MOREFRAGS);
                 fhdr->seq_ctrl = cpu_to_le16(seq | ((i + 1) & IEEE80211_SCTL_FRAG));
+
+                if (i == num_fragm - 2) {
+                        /* clear MOREFRAGS bit for the last fragment */
+                        fhdr->frame_control &= cpu_to_le16(~IEEE80211_FCTL_MOREFRAGS);
+                } else {
+                        /*
+                         * No multi-rate retries for fragmented frames, that
+                         * would completely throw off the NAV at other STAs.
+                         */
+                        info->control.rates[1].idx = -1;
+                        info->control.rates[2].idx = -1;
+                        info->control.rates[3].idx = -1;
+                        info->control.rates[4].idx = -1;
+                        BUILD_BUG_ON(IEEE80211_TX_MAX_RATES != 5);
+                        info->flags &= ~IEEE80211_TX_CTL_RATE_CTRL_PROBE;
+                }
+
+                /* copy data */
                 copylen = left > per_fragm ? per_fragm : left;
                 memcpy(skb_put(frag, copylen), pos, copylen);
-                memcpy(frag->cb, first->cb, sizeof(frag->cb));
+
                 skb_copy_queue_mapping(frag, first);
+
                 frag->do_not_encrypt = first->do_not_encrypt;
 
                 pos += copylen;
@@ -765,12 +812,10 @@ ieee80211_tx_h_calculate_duration(struct ieee80211_tx_data *tx)
                                               tx->extra_frag[0]->len);
 
         for (i = 0; i < tx->num_extra_frag; i++) {
-                if (i + 1 < tx->num_extra_frag) {
+                if (i + 1 < tx->num_extra_frag)
                         next_len = tx->extra_frag[i + 1]->len;
-                } else {
+                else
                         next_len = 0;
-                        tx->rate_idx = tx->last_frag_rate_idx;
-                }
 
                 hdr = (struct ieee80211_hdr *)tx->extra_frag[i]->data;
                 hdr->duration_id = ieee80211_duration(tx, 0, next_len);
@@ -823,7 +868,6 @@ __ieee80211_parse_tx_radiotap(struct ieee80211_tx_data *tx,
                 (struct ieee80211_radiotap_header *) skb->data;
         struct ieee80211_supported_band *sband;
         int ret = ieee80211_radiotap_iterator_init(&iterator, rthdr, skb->len);
-        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 
         sband = tx->local->hw.wiphy->bands[tx->channel->band];
 
@@ -837,8 +881,6 @@ __ieee80211_parse_tx_radiotap(struct ieee80211_tx_data *tx,
          */
 
         while (!ret) {
-                int i, target_rate;
-
                 ret = ieee80211_radiotap_iterator_next(&iterator);
 
                 if (ret)
@@ -852,38 +894,6 @@ __ieee80211_parse_tx_radiotap(struct ieee80211_tx_data *tx,
                  * get_unaligned((type *)iterator.this_arg) to dereference
                  * iterator.this_arg for type "type" safely on all arches.
                 */
-                case IEEE80211_RADIOTAP_RATE:
-                        /*
-                         * radiotap rate u8 is in 500kbps units eg, 0x02=1Mbps
-                         * ieee80211 rate int is in 100kbps units eg, 0x0a=1Mbps
-                         */
-                        target_rate = (*iterator.this_arg) * 5;
-                        for (i = 0; i < sband->n_bitrates; i++) {
-                                struct ieee80211_rate *r;
-
-                                r = &sband->bitrates[i];
-
-                                if (r->bitrate == target_rate) {
-                                        tx->rate_idx = i;
-                                        break;
-                                }
-                        }
-                        break;
-
-                case IEEE80211_RADIOTAP_ANTENNA:
-                        /*
-                         * radiotap uses 0 for 1st ant, mac80211 is 1 for
-                         * 1st ant
-                         */
-                        info->antenna_sel_tx = (*iterator.this_arg) + 1;
-                        break;
-
-#if 0
-                case IEEE80211_RADIOTAP_DBM_TX_POWER:
-                        control->power_level = *iterator.this_arg;
-                        break;
-#endif
-
                 case IEEE80211_RADIOTAP_FLAGS:
                         if (*iterator.this_arg & IEEE80211_RADIOTAP_F_FCS) {
                                 /*
@@ -949,8 +959,6 @@ __ieee80211_tx_prepare(struct ieee80211_tx_data *tx,
         tx->local = local;
         tx->sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         tx->channel = local->hw.conf.channel;
-        tx->rate_idx = -1;
-        tx->last_frag_rate_idx = -1;
         /*
          * Set this flag (used below to indicate "automatic fragmentation"),
          * it will be cleared/left by radiotap as desired.
@@ -1051,23 +1059,11 @@ static int __ieee80211_tx(struct ieee80211_local *local, struct sk_buff *skb,
                         if (!tx->extra_frag[i])
                                 continue;
                         info = IEEE80211_SKB_CB(tx->extra_frag[i]);
-                        info->flags &= ~(IEEE80211_TX_CTL_USE_RTS_CTS |
-                                         IEEE80211_TX_CTL_USE_CTS_PROTECT |
-                                         IEEE80211_TX_CTL_CLEAR_PS_FILT |
+                        info->flags &= ~(IEEE80211_TX_CTL_CLEAR_PS_FILT |
                                          IEEE80211_TX_CTL_FIRST_FRAGMENT);
                         if (netif_subqueue_stopped(local->mdev,
                                                    tx->extra_frag[i]))
                                 return IEEE80211_TX_FRAG_AGAIN;
-                        if (i == tx->num_extra_frag) {
-                                info->tx_rate_idx = tx->last_frag_rate_idx;
-
-                                if (tx->flags & IEEE80211_TX_PROBE_LAST_FRAG)
-                                        info->flags |=
-                                                IEEE80211_TX_CTL_RATE_CTRL_PROBE;
-                                else
-                                        info->flags &=
-                                                ~IEEE80211_TX_CTL_RATE_CTRL_PROBE;
-                        }
 
                         ret = local->ops->tx(local_to_hw(local),
                                             tx->extra_frag[i]);
@@ -1204,9 +1200,6 @@ retry:
                 store->skb = skb;
                 store->extra_frag = tx.extra_frag;
                 store->num_extra_frag = tx.num_extra_frag;
-                store->last_frag_rate_idx = tx.last_frag_rate_idx;
-                store->last_frag_rate_ctrl_probe =
-                        !!(tx.flags & IEEE80211_TX_PROBE_LAST_FRAG);
         }
  out:
         rcu_read_unlock();
@@ -1763,10 +1756,7 @@ void ieee80211_tx_pending(unsigned long data)
                 store = &local->pending_packet[i];
                 tx.extra_frag = store->extra_frag;
                 tx.num_extra_frag = store->num_extra_frag;
-                tx.last_frag_rate_idx = store->last_frag_rate_idx;
                 tx.flags = 0;
-                if (store->last_frag_rate_ctrl_probe)
-                        tx.flags |= IEEE80211_TX_PROBE_LAST_FRAG;
                 ret = __ieee80211_tx(local, store->skb, &tx);
                 if (ret) {
                         if (ret == IEEE80211_TX_FRAG_AGAIN)
@@ -1854,7 +1844,6 @@ struct sk_buff *ieee80211_beacon_get(struct ieee80211_hw *hw,
         struct ieee80211_sub_if_data *sdata = NULL;
         struct ieee80211_if_ap *ap = NULL;
         struct ieee80211_if_sta *ifsta = NULL;
-        struct rate_selection rsel;
         struct beacon_data *beacon;
         struct ieee80211_supported_band *sband;
         enum ieee80211_band band = local->hw.conf.channel->band;
@@ -1958,32 +1947,23 @@ struct sk_buff *ieee80211_beacon_get(struct ieee80211_hw *hw,
         skb->do_not_encrypt = 1;
 
         info->band = band;
-        rate_control_get_rate(sdata, sband, NULL, skb, &rsel);
-
-        if (unlikely(rsel.rate_idx < 0)) {
-                if (net_ratelimit()) {
-                        printk(KERN_DEBUG "%s: ieee80211_beacon_get: "
-                               "no rate found\n",
-                               wiphy_name(local->hw.wiphy));
-                }
-                dev_kfree_skb_any(skb);
-                skb = NULL;
-                goto out;
-        }
+        /*
+         * XXX: For now, always use the lowest rate
+         */
+        info->control.rates[0].idx = 0;
+        info->control.rates[0].count = 1;
+        info->control.rates[1].idx = -1;
+        info->control.rates[2].idx = -1;
+        info->control.rates[3].idx = -1;
+        info->control.rates[4].idx = -1;
+        BUILD_BUG_ON(IEEE80211_TX_MAX_RATES != 5);
 
         info->control.vif = vif;
-        info->tx_rate_idx = rsel.rate_idx;
 
         info->flags |= IEEE80211_TX_CTL_NO_ACK;
         info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT;
         info->flags |= IEEE80211_TX_CTL_ASSIGN_SEQ;
-        if (sdata->vif.bss_conf.use_short_preamble &&
-            sband->bitrates[rsel.rate_idx].flags & IEEE80211_RATE_SHORT_PREAMBLE)
-                info->flags |= IEEE80211_TX_CTL_SHORT_PREAMBLE;
-
-        info->control.retry_limit = 1;
-
-out:
+ out:
         rcu_read_unlock();
         return skb;
 }
diff --git a/net/mac80211/wext.c b/net/mac80211/wext.c
index f7e442f80a17..31d2e74a1bc0 100644
--- a/net/mac80211/wext.c
+++ b/net/mac80211/wext.c
@@ -636,8 +636,8 @@ static int ieee80211_ioctl_giwrate(struct net_device *dev,
 
         sta = sta_info_get(local, sdata->u.sta.bssid);
 
-        if (sta && sta->last_txrate_idx < sband->n_bitrates)
-                rate->value = sband->bitrates[sta->last_txrate_idx].bitrate;
+        if (sta && !(sta->last_tx_rate.flags & IEEE80211_TX_RC_MCS))
+                rate->value = sband->bitrates[sta->last_tx_rate.idx].bitrate;
         else
                 rate->value = 0;