* any particular flags. There are some exceptions to this rule,
  * however, so you are advised to review these flags carefully.
  *
+ * @IEEE80211_HW_HAS_RATE_CONTROL:
+ *     The hardware or firmware includes rate control, and cannot be
+ *     controlled by the stack. As such, no rate control algorithm
+ *     should be instantiated, and the TX rate reported to userspace
+ *     will be taken from the TX status instead of the rate control
+ *     algorithm.
+ *     Note that this requires that the driver implement a number of
+ *     callbacks so it has the correct information, it needs to have
+ *     the @set_rts_threshold callback and must look at the BSS config
+ *     @use_cts_prot for G/N protection, @use_short_slot for slot
+ *     timing in 2.4 GHz and @use_short_preamble for preambles for
+ *     CCK frames.
+ *
  * @IEEE80211_HW_RX_INCLUDES_FCS:
  *     Indicates that received frames passed to the stack include
  *     the FCS at the end.
  *     avoid waking up cpu.
  */
 enum ieee80211_hw_flags {
+       IEEE80211_HW_HAS_RATE_CONTROL                   = 1<<0,
        IEEE80211_HW_RX_INCLUDES_FCS                    = 1<<1,
        IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING        = 1<<2,
        IEEE80211_HW_2GHZ_SHORT_SLOT_INCAPABLE          = 1<<3,
 
 DEBUGFS_READONLY_FILE(wep_iv, 20, "%#08x",
                      local->wep_iv & 0xffffff);
 DEBUGFS_READONLY_FILE(rate_ctrl_alg, 100, "%s",
-                     local->rate_ctrl ? local->rate_ctrl->ops->name : "<unset>");
+       local->rate_ctrl ? local->rate_ctrl->ops->name : "hw/driver");
 
 static ssize_t tsf_read(struct file *file, char __user *user_buf,
                             size_t count, loff_t *ppos)
 
        struct rate_control_ref *ref, *old;
 
        ASSERT_RTNL();
+
        if (local->open_count)
                return -EBUSY;
 
+       if (local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL) {
+               if (WARN_ON(!local->ops->set_rts_threshold))
+                       return -EINVAL;
+               return 0;
+       }
+
        ref = rate_control_alloc(name, local);
        if (!ref) {
                printk(KERN_WARNING "%s: Failed to select rate control "
               "algorithm '%s'\n", wiphy_name(local->hw.wiphy),
               ref->ops->name);
 
-
        return 0;
 }
 
        struct rate_control_ref *ref;
 
        ref = local->rate_ctrl;
+
+       if (!ref)
+               return;
+
        local->rate_ctrl = NULL;
        rate_control_put(ref);
 }
 
        void *priv_sta = sta->rate_ctrl_priv;
        struct ieee80211_supported_band *sband;
 
+       if (!ref)
+               return;
+
        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
 
        ref->ops->rate_init(ref->priv, sband, ista, priv_sta);
        struct ieee80211_sta *ista = &sta->sta;
        void *priv_sta = sta->rate_ctrl_priv;
 
-       if (ref->ops->rate_update)
+       if (ref && ref->ops->rate_update)
                ref->ops->rate_update(ref->priv, sband, ista,
                                      priv_sta, changed);
 }
 {
 #ifdef CONFIG_MAC80211_DEBUGFS
        struct rate_control_ref *ref = sta->rate_ctrl;
-       if (sta->debugfs.dir && ref->ops->add_sta_debugfs)
+       if (ref && sta->debugfs.dir && ref->ops->add_sta_debugfs)
                ref->ops->add_sta_debugfs(ref->priv, sta->rate_ctrl_priv,
                                          sta->debugfs.dir);
 #endif
 {
 #ifdef CONFIG_MAC80211_DEBUGFS
        struct rate_control_ref *ref = sta->rate_ctrl;
-       if (ref->ops->remove_sta_debugfs)
+       if (ref && ref->ops->remove_sta_debugfs)
                ref->ops->remove_sta_debugfs(ref->priv, sta->rate_ctrl_priv);
 #endif
 }
 
 static void __sta_info_free(struct ieee80211_local *local,
                            struct sta_info *sta)
 {
-       rate_control_free_sta(sta);
-       rate_control_put(sta->rate_ctrl);
+       if (sta->rate_ctrl) {
+               rate_control_free_sta(sta);
+               rate_control_put(sta->rate_ctrl);
+       }
 
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
        printk(KERN_DEBUG "%s: Destroyed STA %pM\n",
                ieee80211_sta_ps_deliver_poll_response(sta);
 }
 
+static int sta_prepare_rate_control(struct ieee80211_local *local,
+                                   struct sta_info *sta, gfp_t gfp)
+{
+       if (local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL)
+               return 0;
+
+       sta->rate_ctrl = rate_control_get(local->rate_ctrl);
+       sta->rate_ctrl_priv = rate_control_alloc_sta(sta->rate_ctrl,
+                                                    &sta->sta, gfp);
+       if (!sta->rate_ctrl_priv) {
+               rate_control_put(sta->rate_ctrl);
+               return -ENOMEM;
+       }
+
+       return 0;
+}
+
 struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
                                u8 *addr, gfp_t gfp)
 {
        sta->local = local;
        sta->sdata = sdata;
 
-       sta->rate_ctrl = rate_control_get(local->rate_ctrl);
-       sta->rate_ctrl_priv = rate_control_alloc_sta(sta->rate_ctrl,
-                                                    &sta->sta, gfp);
-       if (!sta->rate_ctrl_priv) {
-               rate_control_put(sta->rate_ctrl);
+       if (sta_prepare_rate_control(local, sta, gfp)) {
                kfree(sta);
                return NULL;
        }
 
        CALL_TXH(ieee80211_tx_h_ps_buf);
        CALL_TXH(ieee80211_tx_h_select_key);
        CALL_TXH(ieee80211_tx_h_michael_mic_add);
-       CALL_TXH(ieee80211_tx_h_rate_ctrl);
+       if (!(tx->local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL))
+               CALL_TXH(ieee80211_tx_h_rate_ctrl);
        CALL_TXH(ieee80211_tx_h_misc);
        CALL_TXH(ieee80211_tx_h_sequence);
        CALL_TXH(ieee80211_tx_h_fragment);