39 files changed, 2518 insertions, 1350 deletions

diff --git a/net/mac80211/Kconfig b/net/mac80211/Kconfig
index 7d3b438755f0..96ddb72760b9 100644
--- a/net/mac80211/Kconfig
+++ b/net/mac80211/Kconfig
@@ -247,15 +247,3 @@ config MAC80211_DEBUG_COUNTERS
           and show them in debugfs.
 
           If unsure, say N.
-
-config MAC80211_DRIVER_API_TRACER
-        bool "Driver API tracer"
-        depends on MAC80211_DEBUG_MENU
-        depends on EVENT_TRACING
-        help
-          Say Y here to make mac80211 register with the ftrace
-          framework for the driver API -- you can then see which
-          driver methods it is calling and which API functions
-          drivers are calling by looking at the trace.
-
-          If unsure, say Y.
diff --git a/net/mac80211/Makefile b/net/mac80211/Makefile
index fdb54e61d637..d540c3b160f3 100644
--- a/net/mac80211/Makefile
+++ b/net/mac80211/Makefile
@@ -24,7 +24,8 @@ mac80211-y := \
         util.o \
         wme.o \
         event.o \
-        chan.o
+        chan.o \
+        driver-trace.o
 
 mac80211-$(CONFIG_MAC80211_LEDS) += led.o
 mac80211-$(CONFIG_MAC80211_DEBUGFS) += \
@@ -41,7 +42,6 @@ mac80211-$(CONFIG_MAC80211_MESH) += \
 
 mac80211-$(CONFIG_PM) += pm.o
 
-mac80211-$(CONFIG_MAC80211_DRIVER_API_TRACER) += driver-trace.o
 CFLAGS_driver-trace.o := -I$(src)
 
 # objects for PID algorithm
diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c
index 93b243422659..96debba2c407 100644
--- a/net/mac80211/agg-rx.c
+++ b/net/mac80211/agg-rx.c
@@ -73,8 +73,11 @@ void ___ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid,
         RCU_INIT_POINTER(sta->ampdu_mlme.tid_rx[tid], NULL);
 
 #ifdef CONFIG_MAC80211_HT_DEBUG
-        printk(KERN_DEBUG "Rx BA session stop requested for %pM tid %u\n",
-               sta->sta.addr, tid);
+        printk(KERN_DEBUG
+               "Rx BA session stop requested for %pM tid %u %s reason: %d\n",
+               sta->sta.addr, tid,
+               initiator == WLAN_BACK_RECIPIENT ? "recipient" : "inititator",
+               (int)reason);
 #endif /* CONFIG_MAC80211_HT_DEBUG */
 
         if (drv_ampdu_action(local, sta->sdata, IEEE80211_AMPDU_RX_STOP,
@@ -85,7 +88,7 @@ void ___ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid,
         /* check if this is a self generated aggregation halt */
         if (initiator == WLAN_BACK_RECIPIENT && tx)
                 ieee80211_send_delba(sta->sdata, sta->sta.addr,
-                                     tid, 0, reason);
+                                     tid, WLAN_BACK_RECIPIENT, reason);
 
         del_timer_sync(&tid_rx->session_timer);
         del_timer_sync(&tid_rx->reorder_timer);
@@ -109,7 +112,7 @@ void ieee80211_stop_rx_ba_session(struct ieee80211_vif *vif, u16 ba_rx_bitmap,
         int i;
 
         rcu_read_lock();
-        sta = sta_info_get(sdata, addr);
+        sta = sta_info_get_bss(sdata, addr);
         if (!sta) {
                 rcu_read_unlock();
                 return;
@@ -177,10 +180,13 @@ static void ieee80211_send_addba_resp(struct ieee80211_sub_if_data *sdata, u8 *d
         memcpy(mgmt->da, da, ETH_ALEN);
         memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
         if (sdata->vif.type == NL80211_IFTYPE_AP ||
-            sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
+            sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
+            sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
                 memcpy(mgmt->bssid, sdata->vif.addr, ETH_ALEN);
         else if (sdata->vif.type == NL80211_IFTYPE_STATION)
                 memcpy(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN);
+        else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
+                memcpy(mgmt->bssid, sdata->u.ibss.bssid, ETH_ALEN);
 
         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
                                           IEEE80211_STYPE_ACTION);
diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index 2e4b961648d4..76be61744198 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -55,6 +55,8 @@
  * @ampdu_action function will be called with the action
  * %IEEE80211_AMPDU_TX_STOP. In this case, the call must not fail,
  * and the driver must later call ieee80211_stop_tx_ba_cb_irqsafe().
+ * Note that the sta can get destroyed before the BA tear down is
+ * complete.
  */
 
 static void ieee80211_send_addba_request(struct ieee80211_sub_if_data *sdata,
@@ -78,10 +80,13 @@ static void ieee80211_send_addba_request(struct ieee80211_sub_if_data *sdata,
         memcpy(mgmt->da, da, ETH_ALEN);
         memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
         if (sdata->vif.type == NL80211_IFTYPE_AP ||
-            sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
+            sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
+            sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
                 memcpy(mgmt->bssid, sdata->vif.addr, ETH_ALEN);
         else if (sdata->vif.type == NL80211_IFTYPE_STATION)
                 memcpy(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN);
+        else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
+                memcpy(mgmt->bssid, sdata->u.ibss.bssid, ETH_ALEN);
 
         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
                                           IEEE80211_STYPE_ACTION);
@@ -102,7 +107,7 @@ static void ieee80211_send_addba_request(struct ieee80211_sub_if_data *sdata,
         mgmt->u.action.u.addba_req.start_seq_num =
                                         cpu_to_le16(start_seq_num << 4);
 
-        ieee80211_tx_skb(sdata, skb);
+        ieee80211_tx_skb_tid(sdata, skb, tid);
 }
 
 void ieee80211_send_bar(struct ieee80211_vif *vif, u8 *ra, u16 tid, u16 ssn)
@@ -131,7 +136,7 @@ void ieee80211_send_bar(struct ieee80211_vif *vif, u8 *ra, u16 tid, u16 ssn)
         bar->start_seq_num = cpu_to_le16(ssn);
 
         IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
-        ieee80211_tx_skb(sdata, skb);
+        ieee80211_tx_skb_tid(sdata, skb, tid);
 }
 EXPORT_SYMBOL(ieee80211_send_bar);
 
@@ -185,6 +190,7 @@ int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
 #endif /* CONFIG_MAC80211_HT_DEBUG */
 
         del_timer_sync(&tid_tx->addba_resp_timer);
+        del_timer_sync(&tid_tx->session_timer);
 
         /*
          * After this packets are no longer handed right through
@@ -386,6 +392,7 @@ void ieee80211_tx_ba_session_handle_start(struct sta_info *sta, int tid)
 #endif
 
         spin_lock_bh(&sta->lock);
+        sta->ampdu_mlme.last_addba_req_time[tid] = jiffies;
         sta->ampdu_mlme.addba_req_num[tid]++;
         spin_unlock_bh(&sta->lock);
 
@@ -396,6 +403,28 @@ void ieee80211_tx_ba_session_handle_start(struct sta_info *sta, int tid)
                                      tid_tx->timeout);
 }
 
+/*
+ * After accepting the AddBA Response we activated a timer,
+ * resetting it after each frame that we send.
+ */
+static void sta_tx_agg_session_timer_expired(unsigned long data)
+{
+        /* not an elegant detour, but there is no choice as the timer passes
+         * only one argument, and various sta_info are needed here, so init
+         * flow in sta_info_create gives the TID as data, while the timer_to_id
+         * array gives the sta through container_of */
+        u8 *ptid = (u8 *)data;
+        u8 *timer_to_id = ptid - *ptid;
+        struct sta_info *sta = container_of(timer_to_id, struct sta_info,
+                                         timer_to_tid[0]);
+
+#ifdef CONFIG_MAC80211_HT_DEBUG
+        printk(KERN_DEBUG "tx session timer expired on tid %d\n", (u16)*ptid);
+#endif
+
+        ieee80211_stop_tx_ba_session(&sta->sta, *ptid);
+}
+
 int ieee80211_start_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid,
                                   u16 timeout)
 {
@@ -420,15 +449,11 @@ int ieee80211_start_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid,
                pubsta->addr, tid);
 #endif /* CONFIG_MAC80211_HT_DEBUG */
 
-        /*
-         * The aggregation code is not prepared to handle
-         * anything but STA/AP due to the BSSID handling.
-         * IBSS could work in the code but isn't supported
-         * by drivers or the standard.
-         */
         if (sdata->vif.type != NL80211_IFTYPE_STATION &&
+            sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
             sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
-            sdata->vif.type != NL80211_IFTYPE_AP)
+            sdata->vif.type != NL80211_IFTYPE_AP &&
+            sdata->vif.type != NL80211_IFTYPE_ADHOC)
                 return -EINVAL;
 
         if (test_sta_flag(sta, WLAN_STA_BLOCK_BA)) {
@@ -439,6 +464,27 @@ int ieee80211_start_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid,
                 return -EINVAL;
         }
 
+        /*
+         * 802.11n-2009 11.5.1.1: If the initiating STA is an HT STA, is a
+         * member of an IBSS, and has no other existing Block Ack agreement
+         * with the recipient STA, then the initiating STA shall transmit a
+         * Probe Request frame to the recipient STA and shall not transmit an
+         * ADDBA Request frame unless it receives a Probe Response frame
+         * from the recipient within dot11ADDBAFailureTimeout.
+         *
+         * The probe request mechanism for ADDBA is currently not implemented,
+         * but we only build up Block Ack session with HT STAs. This information
+         * is set when we receive a bss info from a probe response or a beacon.
+         */
+        if (sta->sdata->vif.type == NL80211_IFTYPE_ADHOC &&
+            !sta->sta.ht_cap.ht_supported) {
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                printk(KERN_DEBUG "BA request denied - IBSS STA %pM"
+                       "does not advertise HT support\n", pubsta->addr);
+#endif /* CONFIG_MAC80211_HT_DEBUG */
+                return -EINVAL;
+        }
+
         spin_lock_bh(&sta->lock);
 
         /* we have tried too many times, receiver does not want A-MPDU */
@@ -447,6 +493,24 @@ int ieee80211_start_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid,
                 goto err_unlock_sta;
         }
 
+        /*
+         * if we have tried more than HT_AGG_BURST_RETRIES times we
+         * will spread our requests in time to avoid stalling connection
+         * for too long
+         */
+        if (sta->ampdu_mlme.addba_req_num[tid] > HT_AGG_BURST_RETRIES &&
+            time_before(jiffies, sta->ampdu_mlme.last_addba_req_time[tid] +
+                        HT_AGG_RETRIES_PERIOD)) {
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                printk(KERN_DEBUG "BA request denied - "
+                       "waiting a grace period after %d failed requests "
+                       "on tid %u\n",
+                       sta->ampdu_mlme.addba_req_num[tid], tid);
+#endif /* CONFIG_MAC80211_HT_DEBUG */
+                ret = -EBUSY;
+                goto err_unlock_sta;
+        }
+
         tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
         /* check if the TID is not in aggregation flow already */
         if (tid_tx || sta->ampdu_mlme.tid_start_tx[tid]) {
@@ -470,11 +534,16 @@ int ieee80211_start_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid,
 
         tid_tx->timeout = timeout;
 
-        /* Tx timer */
+        /* response timer */
         tid_tx->addba_resp_timer.function = sta_addba_resp_timer_expired;
         tid_tx->addba_resp_timer.data = (unsigned long)&sta->timer_to_tid[tid];
         init_timer(&tid_tx->addba_resp_timer);
 
+        /* tx timer */
+        tid_tx->session_timer.function = sta_tx_agg_session_timer_expired;
+        tid_tx->session_timer.data = (unsigned long)&sta->timer_to_tid[tid];
+        init_timer(&tid_tx->session_timer);
+
         /* assign a dialog token */
         sta->ampdu_mlme.dialog_token_allocator++;
         tid_tx->dialog_token = sta->ampdu_mlme.dialog_token_allocator;
@@ -547,7 +616,7 @@ void ieee80211_start_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u16 tid)
         }
 
         mutex_lock(&local->sta_mtx);
-        sta = sta_info_get(sdata, ra);
+        sta = sta_info_get_bss(sdata, ra);
         if (!sta) {
                 mutex_unlock(&local->sta_mtx);
 #ifdef CONFIG_MAC80211_HT_DEBUG
@@ -676,7 +745,7 @@ void ieee80211_stop_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u8 tid)
 
         mutex_lock(&local->sta_mtx);
 
-        sta = sta_info_get(sdata, ra);
+        sta = sta_info_get_bss(sdata, ra);
         if (!sta) {
 #ifdef CONFIG_MAC80211_HT_DEBUG
                 printk(KERN_DEBUG "Could not find station: %pM\n", ra);
@@ -814,6 +883,11 @@ void ieee80211_process_addba_resp(struct ieee80211_local *local,
                         ieee80211_agg_tx_operational(local, sta, tid);
 
                 sta->ampdu_mlme.addba_req_num[tid] = 0;
+
+                if (tid_tx->timeout)
+                        mod_timer(&tid_tx->session_timer,
+                                  TU_TO_EXP_TIME(tid_tx->timeout));
+
         } else {
                 ___ieee80211_stop_tx_ba_session(sta, tid, WLAN_BACK_INITIATOR,
                                                 true);
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index d06c65fa5526..850bb96bd680 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -102,6 +102,16 @@ static int ieee80211_change_iface(struct wiphy *wiphy,
         return 0;
 }
 
+static int ieee80211_set_noack_map(struct wiphy *wiphy,
+                                  struct net_device *dev,
+                                  u16 noack_map)
+{
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+
+        sdata->noack_map = noack_map;
+        return 0;
+}
+
 static int ieee80211_add_key(struct wiphy *wiphy, struct net_device *dev,
                              u8 key_idx, bool pairwise, const u8 *mac_addr,
                              struct key_params *params)
@@ -345,7 +355,8 @@ static void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
                         STATION_INFO_RX_DROP_MISC |
                         STATION_INFO_BSS_PARAM |
                         STATION_INFO_CONNECTED_TIME |
-                        STATION_INFO_STA_FLAGS;
+                        STATION_INFO_STA_FLAGS |
+                        STATION_INFO_BEACON_LOSS_COUNT;
 
         do_posix_clock_monotonic_gettime(&uptime);
         sinfo->connected_time = uptime.tv_sec - sta->last_connected;
@@ -358,6 +369,7 @@ static void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
         sinfo->tx_retries = sta->tx_retry_count;
         sinfo->tx_failed = sta->tx_retry_failed;
         sinfo->rx_dropped_misc = sta->rx_dropped;
+        sinfo->beacon_loss_count = sta->beacon_loss_count;
 
         if ((sta->local->hw.flags & IEEE80211_HW_SIGNAL_DBM) ||
             (sta->local->hw.flags & IEEE80211_HW_SIGNAL_UNSPEC)) {
@@ -411,7 +423,8 @@ static void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
                                 BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
                                 BIT(NL80211_STA_FLAG_WME) |
                                 BIT(NL80211_STA_FLAG_MFP) |
-                                BIT(NL80211_STA_FLAG_AUTHENTICATED);
+                                BIT(NL80211_STA_FLAG_AUTHENTICATED) |
+                                BIT(NL80211_STA_FLAG_TDLS_PEER);
         if (test_sta_flag(sta, WLAN_STA_AUTHORIZED))
                 sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_AUTHORIZED);
         if (test_sta_flag(sta, WLAN_STA_SHORT_PREAMBLE))
@@ -422,6 +435,8 @@ static void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
                 sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_MFP);
         if (test_sta_flag(sta, WLAN_STA_AUTH))
                 sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_AUTHENTICATED);
+        if (test_sta_flag(sta, WLAN_STA_TDLS_PEER))
+                sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_TDLS_PEER);
 }
 
 
@@ -488,6 +503,31 @@ static void ieee80211_config_ap_ssid(struct ieee80211_sub_if_data *sdata,
                 (params->hidden_ssid != NL80211_HIDDEN_SSID_NOT_IN_USE);
 }
 
+static int ieee80211_set_probe_resp(struct ieee80211_sub_if_data *sdata,
+                                    u8 *resp, size_t resp_len)
+{
+        struct sk_buff *new, *old;
+
+        if (!resp || !resp_len)
+                return -EINVAL;
+
+        old = rtnl_dereference(sdata->u.ap.probe_resp);
+
+        new = dev_alloc_skb(resp_len);
+        if (!new)
+                return -ENOMEM;
+
+        memcpy(skb_put(new, resp_len), resp, resp_len);
+
+        rcu_assign_pointer(sdata->u.ap.probe_resp, new);
+        synchronize_rcu();
+
+        if (old)
+                dev_kfree_skb(old);
+
+        return 0;
+}
+
 /*
  * This handles both adding a beacon and setting new beacon info
  */
@@ -498,6 +538,7 @@ static int ieee80211_config_beacon(struct ieee80211_sub_if_data *sdata,
         int new_head_len, new_tail_len;
         int size;
         int err = -EINVAL;
+        u32 changed = 0;
 
         old = rtnl_dereference(sdata->u.ap.beacon);
 
@@ -581,11 +622,17 @@ static int ieee80211_config_beacon(struct ieee80211_sub_if_data *sdata,
 
         kfree(old);
 
+        err = ieee80211_set_probe_resp(sdata, params->probe_resp,
+                                       params->probe_resp_len);
+        if (!err)
+                changed |= BSS_CHANGED_AP_PROBE_RESP;
+
         ieee80211_config_ap_ssid(sdata, params);
+        changed |= BSS_CHANGED_BEACON_ENABLED |
+                   BSS_CHANGED_BEACON |
+                   BSS_CHANGED_SSID;
 
-        ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON_ENABLED |
-                                                BSS_CHANGED_BEACON |
-                                                BSS_CHANGED_SSID);
+        ieee80211_bss_info_change_notify(sdata, changed);
         return 0;
 }
 
@@ -594,6 +641,8 @@ static int ieee80211_add_beacon(struct wiphy *wiphy, struct net_device *dev,
 {
         struct ieee80211_sub_if_data *sdata;
         struct beacon_data *old;
+        struct ieee80211_sub_if_data *vlan;
+        int ret;
 
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
@@ -601,7 +650,24 @@ static int ieee80211_add_beacon(struct wiphy *wiphy, struct net_device *dev,
         if (old)
                 return -EALREADY;
 
-        return ieee80211_config_beacon(sdata, params);
+        ret = ieee80211_config_beacon(sdata, params);
+        if (ret)
+                return ret;
+
+        /*
+         * Apply control port protocol, this allows us to
+         * not encrypt dynamic WEP control frames.
+         */
+        sdata->control_port_protocol = params->crypto.control_port_ethertype;
+        sdata->control_port_no_encrypt = params->crypto.control_port_no_encrypt;
+        list_for_each_entry(vlan, &sdata->u.ap.vlans, u.vlan.list) {
+                vlan->control_port_protocol =
+                        params->crypto.control_port_ethertype;
+                vlan->control_port_no_encrypt =
+                        params->crypto.control_port_no_encrypt;
+        }
+
+        return 0;
 }
 
 static int ieee80211_set_beacon(struct wiphy *wiphy, struct net_device *dev,
@@ -682,10 +748,11 @@ static void ieee80211_send_layer2_update(struct sta_info *sta)
         netif_rx_ni(skb);
 }
 
-static void sta_apply_parameters(struct ieee80211_local *local,
-                                 struct sta_info *sta,
-                                 struct station_parameters *params)
+static int sta_apply_parameters(struct ieee80211_local *local,
+                                struct sta_info *sta,
+                                struct station_parameters *params)
 {
+        int ret = 0;
         u32 rates;
         int i, j;
         struct ieee80211_supported_band *sband;
@@ -697,13 +764,59 @@ static void sta_apply_parameters(struct ieee80211_local *local,
         mask = params->sta_flags_mask;
         set = params->sta_flags_set;
 
+        /*
+         * In mesh mode, we can clear AUTHENTICATED flag but must
+         * also make ASSOCIATED follow appropriately for the driver
+         * API. See also below, after AUTHORIZED changes.
+         */
+        if (mask & BIT(NL80211_STA_FLAG_AUTHENTICATED)) {
+                /* cfg80211 should not allow this in non-mesh modes */
+                if (WARN_ON(!ieee80211_vif_is_mesh(&sdata->vif)))
+                        return -EINVAL;
+
+                if (set & BIT(NL80211_STA_FLAG_AUTHENTICATED) &&
+                    !test_sta_flag(sta, WLAN_STA_AUTH)) {
+                        ret = sta_info_move_state_checked(sta,
+                                        IEEE80211_STA_AUTH);
+                        if (ret)
+                                return ret;
+                        ret = sta_info_move_state_checked(sta,
+                                        IEEE80211_STA_ASSOC);
+                        if (ret)
+                                return ret;
+                }
+        }
+
         if (mask & BIT(NL80211_STA_FLAG_AUTHORIZED)) {
                 if (set & BIT(NL80211_STA_FLAG_AUTHORIZED))
-                        set_sta_flag(sta, WLAN_STA_AUTHORIZED);
+                        ret = sta_info_move_state_checked(sta,
+                                        IEEE80211_STA_AUTHORIZED);
                 else
-                        clear_sta_flag(sta, WLAN_STA_AUTHORIZED);
+                        ret = sta_info_move_state_checked(sta,
+                                        IEEE80211_STA_ASSOC);
+                if (ret)
+                        return ret;
+        }
+
+        if (mask & BIT(NL80211_STA_FLAG_AUTHENTICATED)) {
+                /* cfg80211 should not allow this in non-mesh modes */
+                if (WARN_ON(!ieee80211_vif_is_mesh(&sdata->vif)))
+                        return -EINVAL;
+
+                if (!(set & BIT(NL80211_STA_FLAG_AUTHENTICATED)) &&
+                    test_sta_flag(sta, WLAN_STA_AUTH)) {
+                        ret = sta_info_move_state_checked(sta,
+                                        IEEE80211_STA_AUTH);
+                        if (ret)
+                                return ret;
+                        ret = sta_info_move_state_checked(sta,
+                                        IEEE80211_STA_NONE);
+                        if (ret)
+                                return ret;
+                }
         }
 
+
         if (mask & BIT(NL80211_STA_FLAG_SHORT_PREAMBLE)) {
                 if (set & BIT(NL80211_STA_FLAG_SHORT_PREAMBLE))
                         set_sta_flag(sta, WLAN_STA_SHORT_PREAMBLE);
@@ -728,13 +841,6 @@ static void sta_apply_parameters(struct ieee80211_local *local,
                         clear_sta_flag(sta, WLAN_STA_MFP);
         }
 
-        if (mask & BIT(NL80211_STA_FLAG_AUTHENTICATED)) {
-                if (set & BIT(NL80211_STA_FLAG_AUTHENTICATED))
-                        set_sta_flag(sta, WLAN_STA_AUTH);
-                else
-                        clear_sta_flag(sta, WLAN_STA_AUTH);
-        }
-
         if (mask & BIT(NL80211_STA_FLAG_TDLS_PEER)) {
                 if (set & BIT(NL80211_STA_FLAG_TDLS_PEER))
                         set_sta_flag(sta, WLAN_STA_TDLS_PEER);
@@ -778,7 +884,7 @@ static void sta_apply_parameters(struct ieee80211_local *local,
         }
 
         if (params->ht_capa)
-                ieee80211_ht_cap_ie_to_sta_ht_cap(sband,
+                ieee80211_ht_cap_ie_to_sta_ht_cap(sdata, sband,
                                                   params->ht_capa,
                                                   &sta->sta.ht_cap);
 
@@ -806,6 +912,8 @@ static void sta_apply_parameters(struct ieee80211_local *local,
                         }
 #endif
         }
+
+        return 0;
 }
 
 static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev,
@@ -832,22 +940,25 @@ static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev,
         if (is_multicast_ether_addr(mac))
                 return -EINVAL;
 
-        /* Only TDLS-supporting stations can add TDLS peers */
-        if ((params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) &&
-            !((wiphy->flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
-              sdata->vif.type == NL80211_IFTYPE_STATION))
-                return -ENOTSUPP;
-
         sta = sta_info_alloc(sdata, mac, GFP_KERNEL);
         if (!sta)
                 return -ENOMEM;
 
-        set_sta_flag(sta, WLAN_STA_AUTH);
-        set_sta_flag(sta, WLAN_STA_ASSOC);
+        sta_info_move_state(sta, IEEE80211_STA_AUTH);
+        sta_info_move_state(sta, IEEE80211_STA_ASSOC);
 
-        sta_apply_parameters(local, sta, params);
+        err = sta_apply_parameters(local, sta, params);
+        if (err) {
+                sta_info_free(local, sta);
+                return err;
+        }
 
-        rate_control_rate_init(sta);
+        /*
+         * for TDLS, rate control should be initialized only when supported
+         * rates are known.
+         */
+        if (!test_sta_flag(sta, WLAN_STA_TDLS_PEER))
+                rate_control_rate_init(sta);
 
         layer2_update = sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
                 sdata->vif.type == NL80211_IFTYPE_AP;
@@ -891,19 +1002,19 @@ static int ieee80211_change_station(struct wiphy *wiphy,
         struct sta_info *sta;
         struct ieee80211_sub_if_data *vlansdata;
 
-        rcu_read_lock();
+        mutex_lock(&local->sta_mtx);
 
         sta = sta_info_get_bss(sdata, mac);
         if (!sta) {
-                rcu_read_unlock();
+                mutex_unlock(&local->sta_mtx);
                 return -ENOENT;
         }
 
-        /* The TDLS bit cannot be toggled after the STA was added */
-        if ((params->sta_flags_mask & BIT(NL80211_STA_FLAG_TDLS_PEER)) &&
-            !!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) !=
-            !!test_sta_flag(sta, WLAN_STA_TDLS_PEER)) {
-                rcu_read_unlock();
+        /* in station mode, supported rates are only valid with TDLS */
+        if (sdata->vif.type == NL80211_IFTYPE_STATION &&
+            params->supported_rates &&
+            !test_sta_flag(sta, WLAN_STA_TDLS_PEER)) {
+                mutex_unlock(&local->sta_mtx);
                 return -EINVAL;
         }
 
@@ -912,13 +1023,13 @@ static int ieee80211_change_station(struct wiphy *wiphy,
 
                 if (vlansdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
                     vlansdata->vif.type != NL80211_IFTYPE_AP) {
-                        rcu_read_unlock();
+                        mutex_unlock(&local->sta_mtx);
                         return -EINVAL;
                 }
 
                 if (params->vlan->ieee80211_ptr->use_4addr) {
                         if (vlansdata->u.vlan.sta) {
-                                rcu_read_unlock();
+                                mutex_unlock(&local->sta_mtx);
                                 return -EBUSY;
                         }
 
@@ -931,7 +1042,10 @@ static int ieee80211_change_station(struct wiphy *wiphy,
 
         sta_apply_parameters(local, sta, params);
 
-        rcu_read_unlock();
+        if (test_sta_flag(sta, WLAN_STA_TDLS_PEER) && params->supported_rates)
+                rate_control_rate_init(sta);
+
+        mutex_unlock(&local->sta_mtx);
 
         if (sdata->vif.type == NL80211_IFTYPE_STATION &&
             params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED))
@@ -1123,6 +1237,8 @@ static int copy_mesh_setup(struct ieee80211_if_mesh *ifmsh,
 {
         u8 *new_ie;
         const u8 *old_ie;
+        struct ieee80211_sub_if_data *sdata = container_of(ifmsh,
+                                        struct ieee80211_sub_if_data, u.mesh);
 
         /* allocate information elements */
         new_ie = NULL;
@@ -1149,6 +1265,10 @@ static int copy_mesh_setup(struct ieee80211_if_mesh *ifmsh,
         if (setup->is_secure)
                 ifmsh->security |= IEEE80211_MESH_SEC_SECURED;
 
+        /* mcast rate setting in Mesh Node */
+        memcpy(sdata->vif.bss_conf.mcast_rate, setup->mcast_rate,
+                                                sizeof(setup->mcast_rate));
+
         return 0;
 }
 
@@ -1194,6 +1314,9 @@ static int ieee80211_update_mesh_config(struct wiphy *wiphy,
         if (_chg_mesh_attr(NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL, mask))
                 conf->dot11MeshHWMPpreqMinInterval =
                         nconf->dot11MeshHWMPpreqMinInterval;
+        if (_chg_mesh_attr(NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL, mask))
+                conf->dot11MeshHWMPperrMinInterval =
+                        nconf->dot11MeshHWMPperrMinInterval;
         if (_chg_mesh_attr(NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
                            mask))
                 conf->dot11MeshHWMPnetDiameterTraversalTime =
@@ -1394,7 +1517,7 @@ static int ieee80211_set_channel(struct wiphy *wiphy,
             (old_oper_type != local->_oper_channel_type))
                 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);
 
-        if ((sdata && sdata->vif.type != NL80211_IFTYPE_MONITOR) &&
+        if (sdata && sdata->vif.type != NL80211_IFTYPE_MONITOR &&
             old_vif_oper_type != sdata->vif.bss_conf.channel_type)
                 ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_HT);
 
@@ -1917,7 +2040,7 @@ static int ieee80211_mgmt_tx(struct wiphy *wiphy, struct net_device *dev,
                              enum nl80211_channel_type channel_type,
                              bool channel_type_valid, unsigned int wait,
                              const u8 *buf, size_t len, bool no_cck,
-                             u64 *cookie)
+                             bool dont_wait_for_ack, u64 *cookie)
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         struct ieee80211_local *local = sdata->local;
@@ -1925,10 +2048,15 @@ static int ieee80211_mgmt_tx(struct wiphy *wiphy, struct net_device *dev,
         struct sta_info *sta;
         struct ieee80211_work *wk;
         const struct ieee80211_mgmt *mgmt = (void *)buf;
-        u32 flags = IEEE80211_TX_INTFL_NL80211_FRAME_TX |
-                    IEEE80211_TX_CTL_REQ_TX_STATUS;
+        u32 flags;
         bool is_offchan = false;
 
+        if (dont_wait_for_ack)
+                flags = IEEE80211_TX_CTL_NO_ACK;
+        else
+                flags = IEEE80211_TX_INTFL_NL80211_FRAME_TX |
+                        IEEE80211_TX_CTL_REQ_TX_STATUS;
+
         /* Check that we are on the requested channel for transmission */
         if (chan != local->tmp_channel &&
             chan != local->oper_channel)
@@ -2488,6 +2616,82 @@ static int ieee80211_tdls_oper(struct wiphy *wiphy, struct net_device *dev,
         return 0;
 }
 
+static int ieee80211_probe_client(struct wiphy *wiphy, struct net_device *dev,
+                                  const u8 *peer, u64 *cookie)
+{
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_qos_hdr *nullfunc;
+        struct sk_buff *skb;
+        int size = sizeof(*nullfunc);
+        __le16 fc;
+        bool qos;
+        struct ieee80211_tx_info *info;
+        struct sta_info *sta;
+
+        rcu_read_lock();
+        sta = sta_info_get(sdata, peer);
+        if (sta) {
+                qos = test_sta_flag(sta, WLAN_STA_WME);
+                rcu_read_unlock();
+        } else {
+                rcu_read_unlock();
+                return -ENOLINK;
+        }
+
+        if (qos) {
+                fc = cpu_to_le16(IEEE80211_FTYPE_DATA |
+                                 IEEE80211_STYPE_QOS_NULLFUNC |
+                                 IEEE80211_FCTL_FROMDS);
+        } else {
+                size -= 2;
+                fc = cpu_to_le16(IEEE80211_FTYPE_DATA |
+                                 IEEE80211_STYPE_NULLFUNC |
+                                 IEEE80211_FCTL_FROMDS);
+        }
+
+        skb = dev_alloc_skb(local->hw.extra_tx_headroom + size);
+        if (!skb)
+                return -ENOMEM;
+
+        skb->dev = dev;
+
+        skb_reserve(skb, local->hw.extra_tx_headroom);
+
+        nullfunc = (void *) skb_put(skb, size);
+        nullfunc->frame_control = fc;
+        nullfunc->duration_id = 0;
+        memcpy(nullfunc->addr1, sta->sta.addr, ETH_ALEN);
+        memcpy(nullfunc->addr2, sdata->vif.addr, ETH_ALEN);
+        memcpy(nullfunc->addr3, sdata->vif.addr, ETH_ALEN);
+        nullfunc->seq_ctrl = 0;
+
+        info = IEEE80211_SKB_CB(skb);
+
+        info->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS |
+                       IEEE80211_TX_INTFL_NL80211_FRAME_TX;
+
+        skb_set_queue_mapping(skb, IEEE80211_AC_VO);
+        skb->priority = 7;
+        if (qos)
+                nullfunc->qos_ctrl = cpu_to_le16(7);
+
+        local_bh_disable();
+        ieee80211_xmit(sdata, skb);
+        local_bh_enable();
+
+        *cookie = (unsigned long) skb;
+        return 0;
+}
+
+static struct ieee80211_channel *
+ieee80211_wiphy_get_channel(struct wiphy *wiphy)
+{
+        struct ieee80211_local *local = wiphy_priv(wiphy);
+
+        return local->oper_channel;
+}
+
 struct cfg80211_ops mac80211_config_ops = {
         .add_virtual_intf = ieee80211_add_iface,
         .del_virtual_intf = ieee80211_del_iface,
@@ -2553,4 +2757,7 @@ struct cfg80211_ops mac80211_config_ops = {
         .set_rekey_data = ieee80211_set_rekey_data,
         .tdls_oper = ieee80211_tdls_oper,
         .tdls_mgmt = ieee80211_tdls_mgmt,
+        .probe_client = ieee80211_probe_client,
+        .get_channel = ieee80211_wiphy_get_channel,
+        .set_noack_map = ieee80211_set_noack_map,
 };
diff --git a/net/mac80211/debugfs.c b/net/mac80211/debugfs.c
index 883996b2f99f..90baea53e7c5 100644
--- a/net/mac80211/debugfs.c
+++ b/net/mac80211/debugfs.c
@@ -97,40 +97,6 @@ static const struct file_operations reset_ops = {
         .llseek = noop_llseek,
 };
 
-static ssize_t noack_read(struct file *file, char __user *user_buf,
-                          size_t count, loff_t *ppos)
-{
-        struct ieee80211_local *local = file->private_data;
-
-        return mac80211_format_buffer(user_buf, count, ppos, "%d\n",
-                                      local->wifi_wme_noack_test);
-}
-
-static ssize_t noack_write(struct file *file,
-                           const char __user *user_buf,
-                           size_t count, loff_t *ppos)
-{
-        struct ieee80211_local *local = file->private_data;
-        char buf[10];
-        size_t len;
-
-        len = min(count, sizeof(buf) - 1);
-        if (copy_from_user(buf, user_buf, len))
-                return -EFAULT;
-        buf[len] = '\0';
-
-        local->wifi_wme_noack_test = !!simple_strtoul(buf, NULL, 0);
-
-        return count;
-}
-
-static const struct file_operations noack_ops = {
-        .read = noack_read,
-        .write = noack_write,
-        .open = mac80211_open_file_generic,
-        .llseek = default_llseek,
-};
-
 static ssize_t uapsd_queues_read(struct file *file, char __user *user_buf,
                                  size_t count, loff_t *ppos)
 {
@@ -190,7 +156,7 @@ static ssize_t uapsd_max_sp_len_write(struct file *file,
                 return -EFAULT;
         buf[len] = '\0';
 
-        ret = strict_strtoul(buf, 0, &val);
+        ret = kstrtoul(buf, 0, &val);
 
         if (ret)
                 return -EINVAL;
@@ -398,7 +364,6 @@ void debugfs_hw_add(struct ieee80211_local *local)
         DEBUGFS_ADD(wep_iv);
         DEBUGFS_ADD(queues);
         DEBUGFS_ADD_MODE(reset, 0200);
-        DEBUGFS_ADD(noack);
         DEBUGFS_ADD(uapsd_queues);
         DEBUGFS_ADD(uapsd_max_sp_len);
         DEBUGFS_ADD(channel_type);
diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c
index 9352819a986b..176c08ffb13c 100644
--- a/net/mac80211/debugfs_netdev.c
+++ b/net/mac80211/debugfs_netdev.c
@@ -321,6 +321,7 @@ static ssize_t ieee80211_if_parse_tkip_mic_test(
 __IEEE80211_IF_FILE_W(tkip_mic_test);
 
 /* AP attributes */
+IEEE80211_IF_FILE(num_sta_authorized, u.ap.num_sta_authorized, ATOMIC);
 IEEE80211_IF_FILE(num_sta_ps, u.ap.num_sta_ps, ATOMIC);
 IEEE80211_IF_FILE(dtim_count, u.ap.dtim_count, DEC);
 
@@ -405,6 +406,8 @@ IEEE80211_IF_FILE(dot11MeshHWMPactivePathTimeout,
                 u.mesh.mshcfg.dot11MeshHWMPactivePathTimeout, DEC);
 IEEE80211_IF_FILE(dot11MeshHWMPpreqMinInterval,
                 u.mesh.mshcfg.dot11MeshHWMPpreqMinInterval, DEC);
+IEEE80211_IF_FILE(dot11MeshHWMPperrMinInterval,
+                u.mesh.mshcfg.dot11MeshHWMPperrMinInterval, DEC);
 IEEE80211_IF_FILE(dot11MeshHWMPnetDiameterTraversalTime,
                 u.mesh.mshcfg.dot11MeshHWMPnetDiameterTraversalTime, DEC);
 IEEE80211_IF_FILE(dot11MeshHWMPmaxPREQretries,
@@ -456,6 +459,7 @@ static void add_ap_files(struct ieee80211_sub_if_data *sdata)
         DEBUGFS_ADD(rc_rateidx_mask_2ghz);
         DEBUGFS_ADD(rc_rateidx_mask_5ghz);
 
+        DEBUGFS_ADD(num_sta_authorized);
         DEBUGFS_ADD(num_sta_ps);
         DEBUGFS_ADD(dtim_count);
         DEBUGFS_ADD(num_buffered_multicast);
@@ -534,6 +538,7 @@ static void add_mesh_config(struct ieee80211_sub_if_data *sdata)
         MESHPARAMS_ADD(dot11MeshMaxPeerLinks);
         MESHPARAMS_ADD(dot11MeshHWMPactivePathTimeout);
         MESHPARAMS_ADD(dot11MeshHWMPpreqMinInterval);
+        MESHPARAMS_ADD(dot11MeshHWMPperrMinInterval);
         MESHPARAMS_ADD(dot11MeshHWMPnetDiameterTraversalTime);
         MESHPARAMS_ADD(dot11MeshHWMPmaxPREQretries);
         MESHPARAMS_ADD(path_refresh_time);
diff --git a/net/mac80211/debugfs_sta.c b/net/mac80211/debugfs_sta.c
index 3110cbdc501b..2406b3e7393f 100644
--- a/net/mac80211/debugfs_sta.c
+++ b/net/mac80211/debugfs_sta.c
@@ -63,10 +63,10 @@ static ssize_t sta_flags_read(struct file *file, char __user *userbuf,
         test_sta_flag(sta, WLAN_STA_##flg) ? #flg "\n" : ""
 
         int res = scnprintf(buf, sizeof(buf),
-                            "%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s",
+                            "%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s",
                             TEST(AUTH), TEST(ASSOC), TEST(PS_STA),
                             TEST(PS_DRIVER), TEST(AUTHORIZED),
-                            TEST(SHORT_PREAMBLE), TEST(ASSOC_AP),
+                            TEST(SHORT_PREAMBLE),
                             TEST(WME), TEST(WDS), TEST(CLEAR_PS_FILT),
                             TEST(MFP), TEST(BLOCK_BA), TEST(PSPOLL),
                             TEST(UAPSD), TEST(SP), TEST(TDLS_PEER),
diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
index 5f165d7eb2db..e8960ae39861 100644
--- a/net/mac80211/driver-ops.h
+++ b/net/mac80211/driver-ops.h
@@ -5,11 +5,34 @@
 #include "ieee80211_i.h"
 #include "driver-trace.h"
 
+static inline void check_sdata_in_driver(struct ieee80211_sub_if_data *sdata)
+{
+        WARN_ON(!(sdata->flags & IEEE80211_SDATA_IN_DRIVER));
+}
+
+static inline struct ieee80211_sub_if_data *
+get_bss_sdata(struct ieee80211_sub_if_data *sdata)
+{
+        if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
+                sdata = container_of(sdata->bss, struct ieee80211_sub_if_data,
+                                     u.ap);
+
+        return sdata;
+}
+
 static inline void drv_tx(struct ieee80211_local *local, struct sk_buff *skb)
 {
         local->ops->tx(&local->hw, skb);
 }
 
+static inline void drv_tx_frags(struct ieee80211_local *local,
+                                struct ieee80211_vif *vif,
+                                struct ieee80211_sta *sta,
+                                struct sk_buff_head *skbs)
+{
+        local->ops->tx_frags(&local->hw, vif, sta, skbs);
+}
+
 static inline int drv_start(struct ieee80211_local *local)
 {
         int ret;
@@ -69,15 +92,23 @@ static inline int drv_resume(struct ieee80211_local *local)
 #endif
 
 static inline int drv_add_interface(struct ieee80211_local *local,
-                                    struct ieee80211_vif *vif)
+                                    struct ieee80211_sub_if_data *sdata)
 {
         int ret;
 
         might_sleep();
 
-        trace_drv_add_interface(local, vif_to_sdata(vif));
-        ret = local->ops->add_interface(&local->hw, vif);
+        if (WARN_ON(sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
+                    sdata->vif.type == NL80211_IFTYPE_MONITOR))
+                return -EINVAL;
+
+        trace_drv_add_interface(local, sdata);
+        ret = local->ops->add_interface(&local->hw, &sdata->vif);
         trace_drv_return_int(local, ret);
+
+        if (ret == 0)
+                sdata->flags |= IEEE80211_SDATA_IN_DRIVER;
+
         return ret;
 }
 
@@ -89,6 +120,8 @@ static inline int drv_change_interface(struct ieee80211_local *local,
 
         might_sleep();
 
+        check_sdata_in_driver(sdata);
+
         trace_drv_change_interface(local, sdata, type, p2p);
         ret = local->ops->change_interface(&local->hw, &sdata->vif, type, p2p);
         trace_drv_return_int(local, ret);
@@ -96,12 +129,15 @@ static inline int drv_change_interface(struct ieee80211_local *local,
 }
 
 static inline void drv_remove_interface(struct ieee80211_local *local,
-                                        struct ieee80211_vif *vif)
+                                        struct ieee80211_sub_if_data *sdata)
 {
         might_sleep();
 
-        trace_drv_remove_interface(local, vif_to_sdata(vif));
-        local->ops->remove_interface(&local->hw, vif);
+        check_sdata_in_driver(sdata);
+
+        trace_drv_remove_interface(local, sdata);
+        local->ops->remove_interface(&local->hw, &sdata->vif);
+        sdata->flags &= ~IEEE80211_SDATA_IN_DRIVER;
         trace_drv_return_void(local);
 }
 
@@ -124,6 +160,8 @@ static inline void drv_bss_info_changed(struct ieee80211_local *local,
 {
         might_sleep();
 
+        check_sdata_in_driver(sdata);
+
         trace_drv_bss_info_changed(local, sdata, info, changed);
         if (local->ops->bss_info_changed)
                 local->ops->bss_info_changed(&local->hw, &sdata->vif, info, changed);
@@ -139,6 +177,8 @@ static inline int drv_tx_sync(struct ieee80211_local *local,
 
         might_sleep();
 
+        check_sdata_in_driver(sdata);
+
         trace_drv_tx_sync(local, sdata, bssid, type);
         if (local->ops->tx_sync)
                 ret = local->ops->tx_sync(&local->hw, &sdata->vif,
@@ -154,6 +194,8 @@ static inline void drv_finish_tx_sync(struct ieee80211_local *local,
 {
         might_sleep();
 
+        check_sdata_in_driver(sdata);
+
         trace_drv_finish_tx_sync(local, sdata, bssid, type);
         if (local->ops->finish_tx_sync)
                 local->ops->finish_tx_sync(&local->hw, &sdata->vif,
@@ -211,6 +253,8 @@ static inline int drv_set_key(struct ieee80211_local *local,
 
         might_sleep();
 
+        check_sdata_in_driver(sdata);
+
         trace_drv_set_key(local, cmd, sdata, sta, key);
         ret = local->ops->set_key(&local->hw, cmd, &sdata->vif, sta, key);
         trace_drv_return_int(local, ret);
@@ -228,6 +272,8 @@ static inline void drv_update_tkip_key(struct ieee80211_local *local,
         if (sta)
                 ista = &sta->sta;
 
+        check_sdata_in_driver(sdata);
+
         trace_drv_update_tkip_key(local, sdata, conf, ista, iv32);
         if (local->ops->update_tkip_key)
                 local->ops->update_tkip_key(&local->hw, &sdata->vif, conf,
@@ -243,6 +289,8 @@ static inline int drv_hw_scan(struct ieee80211_local *local,
 
         might_sleep();
 
+        check_sdata_in_driver(sdata);
+
         trace_drv_hw_scan(local, sdata);
         ret = local->ops->hw_scan(&local->hw, &sdata->vif, req);
         trace_drv_return_int(local, ret);
@@ -254,6 +302,8 @@ static inline void drv_cancel_hw_scan(struct ieee80211_local *local,
 {
         might_sleep();
 
+        check_sdata_in_driver(sdata);
+
         trace_drv_cancel_hw_scan(local, sdata);
         local->ops->cancel_hw_scan(&local->hw, &sdata->vif);
         trace_drv_return_void(local);
@@ -269,6 +319,8 @@ drv_sched_scan_start(struct ieee80211_local *local,
 
         might_sleep();
 
+        check_sdata_in_driver(sdata);
+
         trace_drv_sched_scan_start(local, sdata);
         ret = local->ops->sched_scan_start(&local->hw, &sdata->vif,
                                               req, ies);
@@ -281,6 +333,8 @@ static inline void drv_sched_scan_stop(struct ieee80211_local *local,
 {
         might_sleep();
 
+        check_sdata_in_driver(sdata);
+
         trace_drv_sched_scan_stop(local, sdata);
         local->ops->sched_scan_stop(&local->hw, &sdata->vif);
         trace_drv_return_void(local);
@@ -377,6 +431,9 @@ static inline void drv_sta_notify(struct ieee80211_local *local,
                                   enum sta_notify_cmd cmd,
                                   struct ieee80211_sta *sta)
 {
+        sdata = get_bss_sdata(sdata);
+        check_sdata_in_driver(sdata);
+
         trace_drv_sta_notify(local, sdata, cmd, sta);
         if (local->ops->sta_notify)
                 local->ops->sta_notify(&local->hw, &sdata->vif, cmd, sta);
@@ -391,6 +448,9 @@ static inline int drv_sta_add(struct ieee80211_local *local,
 
         might_sleep();
 
+        sdata = get_bss_sdata(sdata);
+        check_sdata_in_driver(sdata);
+
         trace_drv_sta_add(local, sdata, sta);
         if (local->ops->sta_add)
                 ret = local->ops->sta_add(&local->hw, &sdata->vif, sta);
@@ -406,6 +466,9 @@ static inline void drv_sta_remove(struct ieee80211_local *local,
 {
         might_sleep();
 
+        sdata = get_bss_sdata(sdata);
+        check_sdata_in_driver(sdata);
+
         trace_drv_sta_remove(local, sdata, sta);
         if (local->ops->sta_remove)
                 local->ops->sta_remove(&local->hw, &sdata->vif, sta);
@@ -421,6 +484,8 @@ static inline int drv_conf_tx(struct ieee80211_local *local,
 
         might_sleep();
 
+        check_sdata_in_driver(sdata);
+
         trace_drv_conf_tx(local, sdata, queue, params);
         if (local->ops->conf_tx)
                 ret = local->ops->conf_tx(&local->hw, &sdata->vif,
@@ -436,6 +501,8 @@ static inline u64 drv_get_tsf(struct ieee80211_local *local,
 
         might_sleep();
 
+        check_sdata_in_driver(sdata);
+
         trace_drv_get_tsf(local, sdata);
         if (local->ops->get_tsf)
                 ret = local->ops->get_tsf(&local->hw, &sdata->vif);
@@ -449,6 +516,8 @@ static inline void drv_set_tsf(struct ieee80211_local *local,
 {
         might_sleep();
 
+        check_sdata_in_driver(sdata);
+
         trace_drv_set_tsf(local, sdata, tsf);
         if (local->ops->set_tsf)
                 local->ops->set_tsf(&local->hw, &sdata->vif, tsf);
@@ -460,6 +529,8 @@ static inline void drv_reset_tsf(struct ieee80211_local *local,
 {
         might_sleep();
 
+        check_sdata_in_driver(sdata);
+
         trace_drv_reset_tsf(local, sdata);
         if (local->ops->reset_tsf)
                 local->ops->reset_tsf(&local->hw, &sdata->vif);
@@ -489,6 +560,9 @@ static inline int drv_ampdu_action(struct ieee80211_local *local,
 
         might_sleep();
 
+        sdata = get_bss_sdata(sdata);
+        check_sdata_in_driver(sdata);
+
         trace_drv_ampdu_action(local, sdata, action, sta, tid, ssn, buf_size);
 
         if (local->ops->ampdu_action)
@@ -644,6 +718,8 @@ static inline int drv_set_bitrate_mask(struct ieee80211_local *local,
 
         might_sleep();
 
+        check_sdata_in_driver(sdata);
+
         trace_drv_set_bitrate_mask(local, sdata, mask);
         if (local->ops->set_bitrate_mask)
                 ret = local->ops->set_bitrate_mask(&local->hw,
@@ -657,6 +733,8 @@ static inline void drv_set_rekey_data(struct ieee80211_local *local,
                                       struct ieee80211_sub_if_data *sdata,
                                       struct cfg80211_gtk_rekey_data *data)
 {
+        check_sdata_in_driver(sdata);
+
         trace_drv_set_rekey_data(local, sdata, data);
         if (local->ops->set_rekey_data)
                 local->ops->set_rekey_data(&local->hw, &sdata->vif, data);
diff --git a/net/mac80211/driver-trace.h b/net/mac80211/driver-trace.h
index 2af4fca55337..6e9df8fd8fb8 100644
--- a/net/mac80211/driver-trace.h
+++ b/net/mac80211/driver-trace.h
@@ -5,17 +5,6 @@
 #include <net/mac80211.h>
 #include "ieee80211_i.h"
 
-#if !defined(CONFIG_MAC80211_DRIVER_API_TRACER) || defined(__CHECKER__)
-#undef TRACE_EVENT
-#define TRACE_EVENT(name, proto, ...) \
-static inline void trace_ ## name(proto) {}
-#undef DECLARE_EVENT_CLASS
-#define DECLARE_EVENT_CLASS(...)
-#undef DEFINE_EVENT
-#define DEFINE_EVENT(evt_class, name, proto, ...) \
-static inline void trace_ ## name(proto) {}
-#endif
-
 #undef TRACE_SYSTEM
 #define TRACE_SYSTEM mac80211
 
diff --git a/net/mac80211/ht.c b/net/mac80211/ht.c
index f0fb737efa86..f25fff7607d8 100644
--- a/net/mac80211/ht.c
+++ b/net/mac80211/ht.c
@@ -19,7 +19,84 @@
 #include "ieee80211_i.h"
 #include "rate.h"
 
-void ieee80211_ht_cap_ie_to_sta_ht_cap(struct ieee80211_supported_band *sband,
+bool ieee80111_cfg_override_disables_ht40(struct ieee80211_sub_if_data *sdata)
+{
+        const __le16 flg = cpu_to_le16(IEEE80211_HT_CAP_SUP_WIDTH_20_40);
+        if ((sdata->u.mgd.ht_capa_mask.cap_info & flg) &&
+            !(sdata->u.mgd.ht_capa.cap_info & flg))
+                return true;
+        return false;
+}
+
+static void __check_htcap_disable(struct ieee80211_sub_if_data *sdata,
+                                  struct ieee80211_sta_ht_cap *ht_cap,
+                                  u16 flag)
+{
+        __le16 le_flag = cpu_to_le16(flag);
+        if (sdata->u.mgd.ht_capa_mask.cap_info & le_flag) {
+                if (!(sdata->u.mgd.ht_capa.cap_info & le_flag))
+                        ht_cap->cap &= ~flag;
+        }
+}
+
+void ieee80211_apply_htcap_overrides(struct ieee80211_sub_if_data *sdata,
+                                     struct ieee80211_sta_ht_cap *ht_cap)
+{
+        u8 *scaps = (u8 *)(&sdata->u.mgd.ht_capa.mcs.rx_mask);
+        u8 *smask = (u8 *)(&sdata->u.mgd.ht_capa_mask.mcs.rx_mask);
+        int i;
+
+        if (sdata->vif.type != NL80211_IFTYPE_STATION) {
+                /* AP interfaces call this code when adding new stations,
+                 * so just silently ignore non station interfaces.
+                 */
+                return;
+        }
+
+        /* NOTE:  If you add more over-rides here, update register_hw
+         * ht_capa_mod_msk logic in main.c as well.
+         * And, if this method can ever change ht_cap.ht_supported, fix
+         * the check in ieee80211_add_ht_ie.
+         */
+
+        /* check for HT over-rides, MCS rates first. */
+        for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
+                u8 m = smask[i];
+                ht_cap->mcs.rx_mask[i] &= ~m; /* turn off all masked bits */
+                /* Add back rates that are supported */
+                ht_cap->mcs.rx_mask[i] |= (m & scaps[i]);
+        }
+
+        /* Force removal of HT-40 capabilities? */
+        __check_htcap_disable(sdata, ht_cap, IEEE80211_HT_CAP_SUP_WIDTH_20_40);
+        __check_htcap_disable(sdata, ht_cap, IEEE80211_HT_CAP_SGI_40);
+
+        /* Allow user to disable the max-AMSDU bit. */
+        __check_htcap_disable(sdata, ht_cap, IEEE80211_HT_CAP_MAX_AMSDU);
+
+        /* Allow user to decrease AMPDU factor */
+        if (sdata->u.mgd.ht_capa_mask.ampdu_params_info &
+            IEEE80211_HT_AMPDU_PARM_FACTOR) {
+                u8 n = sdata->u.mgd.ht_capa.ampdu_params_info
+                        & IEEE80211_HT_AMPDU_PARM_FACTOR;
+                if (n < ht_cap->ampdu_factor)
+                        ht_cap->ampdu_factor = n;
+        }
+
+        /* Allow the user to increase AMPDU density. */
+        if (sdata->u.mgd.ht_capa_mask.ampdu_params_info &
+            IEEE80211_HT_AMPDU_PARM_DENSITY) {
+                u8 n = (sdata->u.mgd.ht_capa.ampdu_params_info &
+                        IEEE80211_HT_AMPDU_PARM_DENSITY)
+                        >> IEEE80211_HT_AMPDU_PARM_DENSITY_SHIFT;
+                if (n > ht_cap->ampdu_density)
+                        ht_cap->ampdu_density = n;
+        }
+}
+
+
+void ieee80211_ht_cap_ie_to_sta_ht_cap(struct ieee80211_sub_if_data *sdata,
+                                       struct ieee80211_supported_band *sband,
                                        struct ieee80211_ht_cap *ht_cap_ie,
                                        struct ieee80211_sta_ht_cap *ht_cap)
 {
@@ -103,6 +180,12 @@ void ieee80211_ht_cap_ie_to_sta_ht_cap(struct ieee80211_supported_band *sband,
         /* handle MCS rate 32 too */
         if (sband->ht_cap.mcs.rx_mask[32/8] & ht_cap_ie->mcs.rx_mask[32/8] & 1)
                 ht_cap->mcs.rx_mask[32/8] |= 1;
+
+        /*
+         * If user has specified capability over-rides, take care
+         * of that here.
+         */
+        ieee80211_apply_htcap_overrides(sdata, ht_cap);
 }
 
 void ieee80211_sta_tear_down_BA_sessions(struct sta_info *sta, bool tx)
@@ -196,10 +279,13 @@ void ieee80211_send_delba(struct ieee80211_sub_if_data *sdata,
         memcpy(mgmt->da, da, ETH_ALEN);
         memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
         if (sdata->vif.type == NL80211_IFTYPE_AP ||
-            sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
+            sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
+            sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
                 memcpy(mgmt->bssid, sdata->vif.addr, ETH_ALEN);
         else if (sdata->vif.type == NL80211_IFTYPE_STATION)
                 memcpy(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN);
+        else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
+                memcpy(mgmt->bssid, sdata->u.ibss.bssid, ETH_ALEN);
 
         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
                                           IEEE80211_STYPE_ACTION);
@@ -214,7 +300,7 @@ void ieee80211_send_delba(struct ieee80211_sub_if_data *sdata,
         mgmt->u.action.u.delba.params = cpu_to_le16(params);
         mgmt->u.action.u.delba.reason_code = cpu_to_le16(reason_code);
 
-        ieee80211_tx_skb(sdata, skb);
+        ieee80211_tx_skb_tid(sdata, skb, tid);
 }
 
 void ieee80211_process_delba(struct ieee80211_sub_if_data *sdata,
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index ede9a8b341ac..f8a32bf98216 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -77,6 +77,7 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
         struct cfg80211_bss *bss;
         u32 bss_change;
         u8 supp_rates[IEEE80211_MAX_SUPP_RATES];
+        enum nl80211_channel_type channel_type;
 
         lockdep_assert_held(&ifibss->mtx);
 
@@ -97,6 +98,7 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
         /* if merging, indicate to driver that we leave the old IBSS */
         if (sdata->vif.bss_conf.ibss_joined) {
                 sdata->vif.bss_conf.ibss_joined = false;
+                netif_carrier_off(sdata->dev);
                 ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_IBSS);
         }
 
@@ -104,8 +106,16 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
 
         sdata->drop_unencrypted = capability & WLAN_CAPABILITY_PRIVACY ? 1 : 0;
 
-        local->oper_channel = chan;
-        WARN_ON(!ieee80211_set_channel_type(local, sdata, NL80211_CHAN_NO_HT));
+        channel_type = ifibss->channel_type;
+        if (channel_type > NL80211_CHAN_HT20 &&
+            !cfg80211_can_beacon_sec_chan(local->hw.wiphy, chan, channel_type))
+                channel_type = NL80211_CHAN_HT20;
+        if (!ieee80211_set_channel_type(local, sdata, channel_type)) {
+                /* can only fail due to HT40+/- mismatch */
+                channel_type = NL80211_CHAN_HT20;
+                WARN_ON(!ieee80211_set_channel_type(local, sdata,
+                                                    NL80211_CHAN_HT20));
+        }
         ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);
 
         sband = local->hw.wiphy->bands[chan->band];
@@ -171,6 +181,19 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
                 memcpy(skb_put(skb, ifibss->ie_len),
                        ifibss->ie, ifibss->ie_len);
 
+        /* add HT capability and information IEs */
+        if (channel_type && sband->ht_cap.ht_supported) {
+                pos = skb_put(skb, 4 +
+                                   sizeof(struct ieee80211_ht_cap) +
+                                   sizeof(struct ieee80211_ht_info));
+                pos = ieee80211_ie_build_ht_cap(pos, &sband->ht_cap,
+                                                sband->ht_cap.cap);
+                pos = ieee80211_ie_build_ht_info(pos,
+                                                 &sband->ht_cap,
+                                                 chan,
+                                                 channel_type);
+        }
+
         if (local->hw.queues >= 4) {
                 pos = skb_put(skb, 9);
                 *pos++ = WLAN_EID_VENDOR_SPECIFIC;
@@ -194,6 +217,7 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
         bss_change |= BSS_CHANGED_BEACON;
         bss_change |= BSS_CHANGED_BEACON_ENABLED;
         bss_change |= BSS_CHANGED_BASIC_RATES;
+        bss_change |= BSS_CHANGED_HT;
         bss_change |= BSS_CHANGED_IBSS;
         sdata->vif.bss_conf.ibss_joined = true;
         ieee80211_bss_info_change_notify(sdata, bss_change);
@@ -207,6 +231,7 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
         bss = cfg80211_inform_bss_frame(local->hw.wiphy, local->hw.conf.channel,
                                         mgmt, skb->len, 0, GFP_KERNEL);
         cfg80211_put_bss(bss);
+        netif_carrier_on(sdata->dev);
         cfg80211_ibss_joined(sdata->dev, ifibss->bssid, GFP_KERNEL);
 }
 
@@ -250,6 +275,80 @@ static void ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
                                   cbss->tsf);
 }
 
+static struct sta_info *ieee80211_ibss_finish_sta(struct sta_info *sta)
+        __acquires(RCU)
+{
+        struct ieee80211_sub_if_data *sdata = sta->sdata;
+        u8 addr[ETH_ALEN];
+
+        memcpy(addr, sta->sta.addr, ETH_ALEN);
+
+#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
+        wiphy_debug(sdata->local->hw.wiphy,
+                    "Adding new IBSS station %pM (dev=%s)\n",
+                    addr, sdata->name);
+#endif
+
+        sta_info_move_state(sta, IEEE80211_STA_AUTH);
+        sta_info_move_state(sta, IEEE80211_STA_ASSOC);
+        sta_info_move_state(sta, IEEE80211_STA_AUTHORIZED);
+
+        rate_control_rate_init(sta);
+
+        /* If it fails, maybe we raced another insertion? */
+        if (sta_info_insert_rcu(sta))
+                return sta_info_get(sdata, addr);
+        return sta;
+}
+
+static struct sta_info *
+ieee80211_ibss_add_sta(struct ieee80211_sub_if_data *sdata,
+                       const u8 *bssid, const u8 *addr,
+                       u32 supp_rates)
+        __acquires(RCU)
+{
+        struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
+        struct ieee80211_local *local = sdata->local;
+        struct sta_info *sta;
+        int band = local->hw.conf.channel->band;
+
+        /*
+         * XXX: Consider removing the least recently used entry and
+         *      allow new one to be added.
+         */
+        if (local->num_sta >= IEEE80211_IBSS_MAX_STA_ENTRIES) {
+                if (net_ratelimit())
+                        printk(KERN_DEBUG "%s: No room for a new IBSS STA entry %pM\n",
+                               sdata->name, addr);
+                rcu_read_lock();
+                return NULL;
+        }
+
+        if (ifibss->state == IEEE80211_IBSS_MLME_SEARCH) {
+                rcu_read_lock();
+                return NULL;
+        }
+
+        if (compare_ether_addr(bssid, sdata->u.ibss.bssid)) {
+                rcu_read_lock();
+                return NULL;
+        }
+
+        sta = sta_info_alloc(sdata, addr, GFP_KERNEL);
+        if (!sta) {
+                rcu_read_lock();
+                return NULL;
+        }
+
+        sta->last_rx = jiffies;
+
+        /* make sure mandatory rates are always added */
+        sta->sta.supp_rates[band] = supp_rates |
+                        ieee80211_mandatory_rates(local, band);
+
+        return ieee80211_ibss_finish_sta(sta);
+}
+
 static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
                                   struct ieee80211_mgmt *mgmt,
                                   size_t len,
@@ -266,6 +365,8 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
         u64 beacon_timestamp, rx_timestamp;
         u32 supp_rates = 0;
         enum ieee80211_band band = rx_status->band;
+        struct ieee80211_supported_band *sband = local->hw.wiphy->bands[band];
+        bool rates_updated = false;
 
         if (elems->ds_params && elems->ds_params_len == 1)
                 freq = ieee80211_channel_to_frequency(elems->ds_params[0],
@@ -305,17 +406,51 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
                                                 prev_rates,
                                                 sta->sta.supp_rates[band]);
 #endif
-                                        rate_control_rate_init(sta);
+                                        rates_updated = true;
                                 }
-                        } else
+                        } else {
+                                rcu_read_unlock();
                                 sta = ieee80211_ibss_add_sta(sdata, mgmt->bssid,
-                                                mgmt->sa, supp_rates,
-                                                GFP_ATOMIC);
+                                                mgmt->sa, supp_rates);
+                        }
                 }
 
                 if (sta && elems->wmm_info)
                         set_sta_flag(sta, WLAN_STA_WME);
 
+                if (sta && elems->ht_info_elem && elems->ht_cap_elem &&
+                    sdata->u.ibss.channel_type != NL80211_CHAN_NO_HT) {
+                        /* we both use HT */
+                        struct ieee80211_sta_ht_cap sta_ht_cap_new;
+                        enum nl80211_channel_type channel_type =
+                                ieee80211_ht_info_to_channel_type(
+                                                        elems->ht_info_elem);
+
+                        ieee80211_ht_cap_ie_to_sta_ht_cap(sdata, sband,
+                                                          elems->ht_cap_elem,
+                                                          &sta_ht_cap_new);
+
+                        /*
+                         * fall back to HT20 if we don't use or use
+                         * the other extension channel
+                         */
+                        if ((channel_type == NL80211_CHAN_HT40MINUS ||
+                             channel_type == NL80211_CHAN_HT40PLUS) &&
+                            channel_type != sdata->u.ibss.channel_type)
+                                sta_ht_cap_new.cap &=
+                                        ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
+
+                        if (memcmp(&sta->sta.ht_cap, &sta_ht_cap_new,
+                                   sizeof(sta_ht_cap_new))) {
+                                memcpy(&sta->sta.ht_cap, &sta_ht_cap_new,
+                                       sizeof(sta_ht_cap_new));
+                                rates_updated = true;
+                        }
+                }
+
+                if (sta && rates_updated)
+                        rate_control_rate_init(sta);
+
                 rcu_read_unlock();
         }
 
@@ -404,21 +539,17 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
                 ieee80211_sta_join_ibss(sdata, bss);
                 supp_rates = ieee80211_sta_get_rates(local, elems, band);
                 ieee80211_ibss_add_sta(sdata, mgmt->bssid, mgmt->sa,
-                                       supp_rates, GFP_KERNEL);
+                                       supp_rates);
+                rcu_read_unlock();
         }
 
  put_bss:
         ieee80211_rx_bss_put(local, bss);
 }
 
-/*
- * Add a new IBSS station, will also be called by the RX code when,
- * in IBSS mode, receiving a frame from a yet-unknown station, hence
- * must be callable in atomic context.
- */
-struct sta_info *ieee80211_ibss_add_sta(struct ieee80211_sub_if_data *sdata,
-                                        u8 *bssid, u8 *addr, u32 supp_rates,
-                                        gfp_t gfp)
+void ieee80211_ibss_rx_no_sta(struct ieee80211_sub_if_data *sdata,
+                              const u8 *bssid, const u8 *addr,
+                              u32 supp_rates)
 {
         struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
         struct ieee80211_local *local = sdata->local;
@@ -433,37 +564,29 @@ struct sta_info *ieee80211_ibss_add_sta(struct ieee80211_sub_if_data *sdata,
                 if (net_ratelimit())
                         printk(KERN_DEBUG "%s: No room for a new IBSS STA entry %pM\n",
                                sdata->name, addr);
-                return NULL;
+                return;
         }
 
         if (ifibss->state == IEEE80211_IBSS_MLME_SEARCH)
-                return NULL;
+                return;
 
         if (compare_ether_addr(bssid, sdata->u.ibss.bssid))
-                return NULL;
-
-#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
-        wiphy_debug(local->hw.wiphy, "Adding new IBSS station %pM (dev=%s)\n",
-                    addr, sdata->name);
-#endif
+                return;
 
-        sta = sta_info_alloc(sdata, addr, gfp);
+        sta = sta_info_alloc(sdata, addr, GFP_ATOMIC);
         if (!sta)
-                return NULL;
+                return;
 
         sta->last_rx = jiffies;
-        set_sta_flag(sta, WLAN_STA_AUTHORIZED);
 
         /* make sure mandatory rates are always added */
         sta->sta.supp_rates[band] = supp_rates |
                         ieee80211_mandatory_rates(local, band);
 
-        rate_control_rate_init(sta);
-
-        /* If it fails, maybe we raced another insertion? */
-        if (sta_info_insert(sta))
-                return sta_info_get(sdata, addr);
-        return sta;
+        spin_lock(&ifibss->incomplete_lock);
+        list_add(&sta->list, &ifibss->incomplete_stations);
+        spin_unlock(&ifibss->incomplete_lock);
+        ieee80211_queue_work(&local->hw, &sdata->work);
 }
 
 static int ieee80211_sta_active_ibss(struct ieee80211_sub_if_data *sdata)
@@ -802,6 +925,7 @@ void ieee80211_ibss_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
 void ieee80211_ibss_work(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
+        struct sta_info *sta;
 
         mutex_lock(&ifibss->mtx);
 
@@ -813,6 +937,19 @@ void ieee80211_ibss_work(struct ieee80211_sub_if_data *sdata)
         if (!ifibss->ssid_len)
                 goto out;
 
+        spin_lock_bh(&ifibss->incomplete_lock);
+        while (!list_empty(&ifibss->incomplete_stations)) {
+                sta = list_first_entry(&ifibss->incomplete_stations,
+                                       struct sta_info, list);
+                list_del(&sta->list);
+                spin_unlock_bh(&ifibss->incomplete_lock);
+
+                ieee80211_ibss_finish_sta(sta);
+                rcu_read_unlock();
+                spin_lock_bh(&ifibss->incomplete_lock);
+        }
+        spin_unlock_bh(&ifibss->incomplete_lock);
+
         switch (ifibss->state) {
         case IEEE80211_IBSS_MLME_SEARCH:
                 ieee80211_sta_find_ibss(sdata);
@@ -871,6 +1008,8 @@ void ieee80211_ibss_setup_sdata(struct ieee80211_sub_if_data *sdata)
         setup_timer(&ifibss->timer, ieee80211_ibss_timer,
                     (unsigned long) sdata);
         mutex_init(&ifibss->mtx);
+        INIT_LIST_HEAD(&ifibss->incomplete_stations);
+        spin_lock_init(&ifibss->incomplete_lock);
 }
 
 /* scan finished notification */
@@ -894,12 +1033,18 @@ int ieee80211_ibss_join(struct ieee80211_sub_if_data *sdata,
                         struct cfg80211_ibss_params *params)
 {
         struct sk_buff *skb;
+        u32 changed = 0;
 
         skb = dev_alloc_skb(sdata->local->hw.extra_tx_headroom +
-                            36 /* bitrates */ +
-                            34 /* SSID */ +
-                            3  /* DS params */ +
-                            4  /* IBSS params */ +
+                            sizeof(struct ieee80211_hdr_3addr) +
+                            12 /* struct ieee80211_mgmt.u.beacon */ +
+                            2 + IEEE80211_MAX_SSID_LEN /* max SSID */ +
+                            2 + 8 /* max Supported Rates */ +
+                            3 /* max DS params */ +
+                            4 /* IBSS params */ +
+                            2 + (IEEE80211_MAX_SUPP_RATES - 8) +
+                            2 + sizeof(struct ieee80211_ht_cap) +
+                            2 + sizeof(struct ieee80211_ht_info) +
                             params->ie_len);
         if (!skb)
                 return -ENOMEM;
@@ -920,13 +1065,18 @@ int ieee80211_ibss_join(struct ieee80211_sub_if_data *sdata,
         sdata->vif.bss_conf.beacon_int = params->beacon_interval;
 
         sdata->u.ibss.channel = params->channel;
+        sdata->u.ibss.channel_type = params->channel_type;
         sdata->u.ibss.fixed_channel = params->channel_fixed;
 
         /* fix ourselves to that channel now already */
         if (params->channel_fixed) {
                 sdata->local->oper_channel = params->channel;
-                WARN_ON(!ieee80211_set_channel_type(sdata->local, sdata,
-                                                    NL80211_CHAN_NO_HT));
+                if (!ieee80211_set_channel_type(sdata->local, sdata,
+                                               params->channel_type)) {
+                        mutex_unlock(&sdata->u.ibss.mtx);
+                        kfree_skb(skb);
+                        return -EINVAL;
+                }
         }
 
         if (params->ie) {
@@ -949,6 +1099,23 @@ int ieee80211_ibss_join(struct ieee80211_sub_if_data *sdata,
         ieee80211_recalc_idle(sdata->local);
         mutex_unlock(&sdata->local->mtx);
 
+        /*
+         * 802.11n-2009 9.13.3.1: In an IBSS, the HT Protection field is
+         * reserved, but an HT STA shall protect HT transmissions as though
+         * the HT Protection field were set to non-HT mixed mode.
+         *
+         * In an IBSS, the RIFS Mode field of the HT Operation element is
+         * also reserved, but an HT STA shall operate as though this field
+         * were set to 1.
+         */
+
+        sdata->vif.bss_conf.ht_operation_mode |=
+                  IEEE80211_HT_OP_MODE_PROTECTION_NONHT_MIXED
+                | IEEE80211_HT_PARAM_RIFS_MODE;
+
+        changed |= BSS_CHANGED_HT;
+        ieee80211_bss_info_change_notify(sdata, changed);
+
         ieee80211_queue_work(&sdata->local->hw, &sdata->work);
 
         return 0;
@@ -962,6 +1129,7 @@ int ieee80211_ibss_leave(struct ieee80211_sub_if_data *sdata)
         struct cfg80211_bss *cbss;
         u16 capability;
         int active_ibss;
+        struct sta_info *sta;
 
         mutex_lock(&sdata->u.ibss.mtx);
 
@@ -991,6 +1159,20 @@ int ieee80211_ibss_leave(struct ieee80211_sub_if_data *sdata)
 
         sta_info_flush(sdata->local, sdata);
 
+        spin_lock_bh(&ifibss->incomplete_lock);
+        while (!list_empty(&ifibss->incomplete_stations)) {
+                sta = list_first_entry(&ifibss->incomplete_stations,
+                                       struct sta_info, list);
+                list_del(&sta->list);
+                spin_unlock_bh(&ifibss->incomplete_lock);
+
+                sta_info_free(local, sta);
+                spin_lock_bh(&ifibss->incomplete_lock);
+        }
+        spin_unlock_bh(&ifibss->incomplete_lock);
+
+        netif_carrier_off(sdata->dev);
+
         /* remove beacon */
         kfree(sdata->u.ibss.ie);
         skb = rcu_dereference_protected(sdata->u.ibss.presp,
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index ea10a51babda..2f0642d9e154 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -24,6 +24,7 @@
 #include <linux/spinlock.h>
 #include <linux/etherdevice.h>
 #include <linux/leds.h>
+#include <linux/idr.h>
 #include <net/ieee80211_radiotap.h>
 #include <net/cfg80211.h>
 #include <net/mac80211.h>
@@ -141,6 +142,7 @@ typedef unsigned __bitwise__ ieee80211_tx_result;
 
 struct ieee80211_tx_data {
         struct sk_buff *skb;
+        struct sk_buff_head skbs;
         struct ieee80211_local *local;
         struct ieee80211_sub_if_data *sdata;
         struct sta_info *sta;
@@ -184,12 +186,15 @@ enum ieee80211_packet_rx_flags {
  * enum ieee80211_rx_flags - RX data flags
  *
  * @IEEE80211_RX_CMNTR: received on cooked monitor already
+ * @IEEE80211_RX_BEACON_REPORTED: This frame was already reported
+ *      to cfg80211_report_obss_beacon().
  *
  * These flags are used across handling multiple interfaces
  * for a single frame.
  */
 enum ieee80211_rx_flags {
         IEEE80211_RX_CMNTR              = BIT(0),
+        IEEE80211_RX_BEACON_REPORTED    = BIT(1),
 };
 
 struct ieee80211_rx_data {
@@ -228,6 +233,7 @@ struct beacon_data {
 
 struct ieee80211_if_ap {
         struct beacon_data __rcu *beacon;
+        struct sk_buff __rcu *probe_resp;
 
         struct list_head vlans;
 
@@ -237,6 +243,7 @@ struct ieee80211_if_ap {
         u8 tim[sizeof(unsigned long) * BITS_TO_LONGS(IEEE80211_MAX_AID + 1)];
         struct sk_buff_head ps_bc_buf;
         atomic_t num_sta_ps; /* number of stations in PS mode */
+        atomic_t num_sta_authorized; /* number of authorized stations */
         int dtim_count;
         bool dtim_bc_mc;
 };
@@ -443,6 +450,9 @@ struct ieee80211_if_managed {
          */
         int rssi_min_thold, rssi_max_thold;
         int last_ave_beacon_signal;
+
+        struct ieee80211_ht_cap ht_capa; /* configured ht-cap over-rides */
+        struct ieee80211_ht_cap ht_capa_mask; /* Valid parts of ht_capa */
 };
 
 struct ieee80211_if_ibss {
@@ -465,12 +475,16 @@ struct ieee80211_if_ibss {
         u8 ssid_len, ie_len;
         u8 *ie;
         struct ieee80211_channel *channel;
+        enum nl80211_channel_type channel_type;
 
         unsigned long ibss_join_req;
         /* probe response/beacon for IBSS */
         struct sk_buff __rcu *presp;
         struct sk_buff *skb;
 
+        spinlock_t incomplete_lock;
+        struct list_head incomplete_stations;
+
         enum {
                 IEEE80211_IBSS_MLME_SEARCH,
                 IEEE80211_IBSS_MLME_JOINED,
@@ -505,7 +519,9 @@ struct ieee80211_if_mesh {
         atomic_t mpaths;
         /* Timestamp of last SN update */
         unsigned long last_sn_update;
-        /* Timestamp of last SN sent */
+        /* Time when it's ok to send next PERR */
+        unsigned long next_perr;
+        /* Timestamp of last PREQ sent */
         unsigned long last_preq;
         struct mesh_rmc *rmc;
         spinlock_t mesh_preq_queue_lock;
@@ -543,6 +559,7 @@ struct ieee80211_if_mesh {
  *      associated stations and deliver multicast frames both
  *      back to wireless media and to the local net stack.
  * @IEEE80211_SDATA_DISCONNECT_RESUME: Disconnect after resume.
+ * @IEEE80211_SDATA_IN_DRIVER: indicates interface was added to driver
  */
 enum ieee80211_sub_if_data_flags {
         IEEE80211_SDATA_ALLMULTI                = BIT(0),
@@ -550,6 +567,7 @@ enum ieee80211_sub_if_data_flags {
         IEEE80211_SDATA_OPERATING_GMODE         = BIT(2),
         IEEE80211_SDATA_DONT_BRIDGE_PACKETS     = BIT(3),
         IEEE80211_SDATA_DISCONNECT_RESUME       = BIT(4),
+        IEEE80211_SDATA_IN_DRIVER               = BIT(5),
 };
 
 /**
@@ -600,6 +618,9 @@ struct ieee80211_sub_if_data {
         struct ieee80211_fragment_entry fragments[IEEE80211_FRAGMENT_MAX];
         unsigned int fragment_next;
 
+        /* TID bitmap for NoAck policy */
+        u16 noack_map;
+
         struct ieee80211_key __rcu *keys[NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS];
         struct ieee80211_key __rcu *default_unicast_key;
         struct ieee80211_key __rcu *default_multicast_key;
@@ -722,17 +743,16 @@ enum {
  *      operating channel
  * @SCAN_SET_CHANNEL: Set the next channel to be scanned
  * @SCAN_SEND_PROBE: Send probe requests and wait for probe responses
- * @SCAN_LEAVE_OPER_CHANNEL: Leave the operating channel, notify the AP
- *      about us leaving the channel and stop all associated STA interfaces
- * @SCAN_ENTER_OPER_CHANNEL: Enter the operating channel again, notify the
- *      AP about us being back and restart all associated STA interfaces
+ * @SCAN_SUSPEND: Suspend the scan and go back to operating channel to
+ *      send out data
+ * @SCAN_RESUME: Resume the scan and scan the next channel
  */
 enum mac80211_scan_state {
         SCAN_DECISION,
         SCAN_SET_CHANNEL,
         SCAN_SEND_PROBE,
-        SCAN_LEAVE_OPER_CHANNEL,
-        SCAN_ENTER_OPER_CHANNEL,
+        SCAN_SUSPEND,
+        SCAN_RESUME,
 };
 
 struct ieee80211_local {
@@ -835,18 +855,15 @@ struct ieee80211_local {
 
         /* Station data */
         /*
-         * The mutex only protects the list and counter,
-         * reads are done in RCU.
-         * Additionally, the lock protects the hash table,
-         * the pending list and each BSS's TIM bitmap.
+         * The mutex only protects the list, hash table and
+         * counter, reads are done with RCU.
          */
         struct mutex sta_mtx;
-        spinlock_t sta_lock;
+        spinlock_t tim_lock;
         unsigned long num_sta;
-        struct list_head sta_list, sta_pending_list;
+        struct list_head sta_list;
         struct sta_info __rcu *sta_hash[STA_HASH_SIZE];
         struct timer_list sta_cleanup;
-        struct work_struct sta_finish_work;
         int sta_generation;
 
         struct sk_buff_head pending[IEEE80211_MAX_QUEUES];
@@ -951,7 +968,6 @@ struct ieee80211_local {
         int total_ps_buffered; /* total number of all buffered unicast and
                                 * multicast packets for power saving stations
                                 */
-        int wifi_wme_noack_test;
         unsigned int wmm_acm; /* bit field of ACM bits (BIT(802.1D tag)) */
 
         /*
@@ -1012,6 +1028,9 @@ struct ieee80211_local {
         u32 hw_roc_cookie;
         bool hw_roc_for_tx;
 
+        struct idr ack_status_frames;
+        spinlock_t ack_status_lock;
+
         /* dummy netdev for use w/ NAPI */
         struct net_device napi_dev;
 
@@ -1030,6 +1049,69 @@ struct ieee80211_ra_tid {
         u16 tid;
 };
 
+/* Parsed Information Elements */
+struct ieee802_11_elems {
+        u8 *ie_start;
+        size_t total_len;
+
+        /* pointers to IEs */
+        u8 *ssid;
+        u8 *supp_rates;
+        u8 *fh_params;
+        u8 *ds_params;
+        u8 *cf_params;
+        struct ieee80211_tim_ie *tim;
+        u8 *ibss_params;
+        u8 *challenge;
+        u8 *wpa;
+        u8 *rsn;
+        u8 *erp_info;
+        u8 *ext_supp_rates;
+        u8 *wmm_info;
+        u8 *wmm_param;
+        struct ieee80211_ht_cap *ht_cap_elem;
+        struct ieee80211_ht_info *ht_info_elem;
+        struct ieee80211_meshconf_ie *mesh_config;
+        u8 *mesh_id;
+        u8 *peering;
+        u8 *preq;
+        u8 *prep;
+        u8 *perr;
+        struct ieee80211_rann_ie *rann;
+        u8 *ch_switch_elem;
+        u8 *country_elem;
+        u8 *pwr_constr_elem;
+        u8 *quiet_elem; /* first quite element */
+        u8 *timeout_int;
+
+        /* length of them, respectively */
+        u8 ssid_len;
+        u8 supp_rates_len;
+        u8 fh_params_len;
+        u8 ds_params_len;
+        u8 cf_params_len;
+        u8 tim_len;
+        u8 ibss_params_len;
+        u8 challenge_len;
+        u8 wpa_len;
+        u8 rsn_len;
+        u8 erp_info_len;
+        u8 ext_supp_rates_len;
+        u8 wmm_info_len;
+        u8 wmm_param_len;
+        u8 mesh_id_len;
+        u8 peering_len;
+        u8 preq_len;
+        u8 prep_len;
+        u8 perr_len;
+        u8 ch_switch_elem_len;
+        u8 country_elem_len;
+        u8 pwr_constr_elem_len;
+        u8 quiet_elem_len;
+        u8 num_of_quiet_elem;   /* can be more the one */
+        u8 timeout_int_len;
+};
+
 static inline struct ieee80211_local *hw_to_local(
         struct ieee80211_hw *hw)
 {
@@ -1090,9 +1172,8 @@ void ieee80211_sta_reset_conn_monitor(struct ieee80211_sub_if_data *sdata);
 /* IBSS code */
 void ieee80211_ibss_notify_scan_completed(struct ieee80211_local *local);
 void ieee80211_ibss_setup_sdata(struct ieee80211_sub_if_data *sdata);
-struct sta_info *ieee80211_ibss_add_sta(struct ieee80211_sub_if_data *sdata,
-                                        u8 *bssid, u8 *addr, u32 supp_rates,
-                                        gfp_t gfp);
+void ieee80211_ibss_rx_no_sta(struct ieee80211_sub_if_data *sdata,
+                              const u8 *bssid, const u8 *addr, u32 supp_rates);
 int ieee80211_ibss_join(struct ieee80211_sub_if_data *sdata,
                         struct cfg80211_ibss_params *params);
 int ieee80211_ibss_leave(struct ieee80211_sub_if_data *sdata);
@@ -1140,13 +1221,9 @@ int ieee80211_request_sched_scan_stop(struct ieee80211_sub_if_data *sdata);
 void ieee80211_sched_scan_stopped_work(struct work_struct *work);
 
 /* off-channel helpers */
-bool ieee80211_cfg_on_oper_channel(struct ieee80211_local *local);
-void ieee80211_offchannel_enable_all_ps(struct ieee80211_local *local,
-                                        bool tell_ap);
 void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local,
                                     bool offchannel_ps_enable);
 void ieee80211_offchannel_return(struct ieee80211_local *local,
-                                 bool enable_beaconing,
                                  bool offchannel_ps_disable);
 void ieee80211_hw_roc_setup(struct ieee80211_local *local);
 
@@ -1179,7 +1256,11 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
                                        struct net_device *dev);
 
 /* HT */
-void ieee80211_ht_cap_ie_to_sta_ht_cap(struct ieee80211_supported_band *sband,
+bool ieee80111_cfg_override_disables_ht40(struct ieee80211_sub_if_data *sdata);
+void ieee80211_apply_htcap_overrides(struct ieee80211_sub_if_data *sdata,
+                                     struct ieee80211_sta_ht_cap *ht_cap);
+void ieee80211_ht_cap_ie_to_sta_ht_cap(struct ieee80211_sub_if_data *sdata,
+                                       struct ieee80211_supported_band *sband,
                                        struct ieee80211_ht_cap *ht_cap_ie,
                                        struct ieee80211_sta_ht_cap *ht_cap);
 void ieee80211_send_delba(struct ieee80211_sub_if_data *sdata,
@@ -1266,7 +1347,16 @@ void mac80211_ev_michael_mic_failure(struct ieee80211_sub_if_data *sdata, int ke
                                      gfp_t gfp);
 void ieee80211_set_wmm_default(struct ieee80211_sub_if_data *sdata);
 void ieee80211_xmit(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb);
-void ieee80211_tx_skb(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb);
+
+void ieee80211_tx_skb_tid(struct ieee80211_sub_if_data *sdata,
+                          struct sk_buff *skb, int tid);
+static void inline ieee80211_tx_skb(struct ieee80211_sub_if_data *sdata,
+                                    struct sk_buff *skb)
+{
+        /* Send all internal mgmt frames on VO. Accordingly set TID to 7. */
+        ieee80211_tx_skb_tid(sdata, skb, 7);
+}
+
 void ieee802_11_parse_elems(u8 *start, size_t len,
                             struct ieee802_11_elems *elems);
 u32 ieee802_11_parse_elems_crc(u8 *start, size_t len,
@@ -1334,6 +1424,12 @@ void ieee80211_recalc_smps(struct ieee80211_local *local);
 size_t ieee80211_ie_split(const u8 *ies, size_t ielen,
                           const u8 *ids, int n_ids, size_t offset);
 size_t ieee80211_ie_split_vendor(const u8 *ies, size_t ielen, size_t offset);
+u8 *ieee80211_ie_build_ht_cap(u8 *pos, struct ieee80211_sta_ht_cap *ht_cap,
+                              u16 cap);
+u8 *ieee80211_ie_build_ht_info(u8 *pos,
+                                struct ieee80211_sta_ht_cap *ht_cap,
+                                struct ieee80211_channel *channel,
+                                enum nl80211_channel_type channel_type);
 
 /* internal work items */
 void ieee80211_work_init(struct ieee80211_local *local);
@@ -1362,6 +1458,8 @@ ieee80211_get_channel_mode(struct ieee80211_local *local,
 bool ieee80211_set_channel_type(struct ieee80211_local *local,
                                 struct ieee80211_sub_if_data *sdata,
                                 enum nl80211_channel_type chantype);
+enum nl80211_channel_type
+ieee80211_ht_info_to_channel_type(struct ieee80211_ht_info *ht_info);
 
 #ifdef CONFIG_MAC80211_NOINLINE
 #define debug_noinline noinline
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 30d73552e9ab..e47768cb8cb3 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -188,11 +188,22 @@ static int ieee80211_do_open(struct net_device *dev, bool coming_up)
                 if (!is_valid_ether_addr(sdata->u.wds.remote_addr))
                         return -ENOLINK;
                 break;
-        case NL80211_IFTYPE_AP_VLAN:
+        case NL80211_IFTYPE_AP_VLAN: {
+                struct ieee80211_sub_if_data *master;
+
                 if (!sdata->bss)
                         return -ENOLINK;
+
                 list_add(&sdata->u.vlan.list, &sdata->bss->vlans);
+
+                master = container_of(sdata->bss,
+                                      struct ieee80211_sub_if_data, u.ap);
+                sdata->control_port_protocol =
+                        master->control_port_protocol;
+                sdata->control_port_no_encrypt =
+                        master->control_port_no_encrypt;
                 break;
+                }
         case NL80211_IFTYPE_AP:
                 sdata->bss = &sdata->u.ap;
                 break;
@@ -265,7 +276,7 @@ static int ieee80211_do_open(struct net_device *dev, bool coming_up)
                 break;
         default:
                 if (coming_up) {
-                        res = drv_add_interface(local, &sdata->vif);
+                        res = drv_add_interface(local, sdata);
                         if (res)
                                 goto err_stop;
                 }
@@ -282,10 +293,18 @@ static int ieee80211_do_open(struct net_device *dev, bool coming_up)
                 changed |= ieee80211_reset_erp_info(sdata);
                 ieee80211_bss_info_change_notify(sdata, changed);
 
-                if (sdata->vif.type == NL80211_IFTYPE_STATION)
+                if (sdata->vif.type == NL80211_IFTYPE_STATION ||
+                    sdata->vif.type == NL80211_IFTYPE_ADHOC)
                         netif_carrier_off(dev);
                 else
                         netif_carrier_on(dev);
+
+                /*
+                 * set default queue parameters so drivers don't
+                 * need to initialise the hardware if the hardware
+                 * doesn't start up with sane defaults
+                 */
+                ieee80211_set_wmm_default(sdata);
         }
 
         set_bit(SDATA_STATE_RUNNING, &sdata->state);
@@ -299,8 +318,9 @@ static int ieee80211_do_open(struct net_device *dev, bool coming_up)
                         goto err_del_interface;
                 }
 
-                /* no atomic bitop required since STA is not live yet */
-                set_sta_flag(sta, WLAN_STA_AUTHORIZED);
+                sta_info_move_state(sta, IEEE80211_STA_AUTH);
+                sta_info_move_state(sta, IEEE80211_STA_ASSOC);
+                sta_info_move_state(sta, IEEE80211_STA_AUTHORIZED);
 
                 res = sta_info_insert(sta);
                 if (res) {
@@ -329,15 +349,8 @@ static int ieee80211_do_open(struct net_device *dev, bool coming_up)
         if (coming_up)
                 local->open_count++;
 
-        if (hw_reconf_flags) {
+        if (hw_reconf_flags)
                 ieee80211_hw_config(local, hw_reconf_flags);
-                /*
-                 * set default queue parameters so drivers don't
-                 * need to initialise the hardware if the hardware
-                 * doesn't start up with sane defaults
-                 */
-                ieee80211_set_wmm_default(sdata);
-        }
 
         ieee80211_recalc_ps(local, -1);
 
@@ -345,7 +358,7 @@ static int ieee80211_do_open(struct net_device *dev, bool coming_up)
 
         return 0;
  err_del_interface:
-        drv_remove_interface(local, &sdata->vif);
+        drv_remove_interface(local, sdata);
  err_stop:
         if (!local->open_count)
                 drv_stop(local);
@@ -450,15 +463,19 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
                 struct ieee80211_sub_if_data *vlan, *tmpsdata;
                 struct beacon_data *old_beacon =
                         rtnl_dereference(sdata->u.ap.beacon);
+                struct sk_buff *old_probe_resp =
+                        rtnl_dereference(sdata->u.ap.probe_resp);
 
                 /* sdata_running will return false, so this will disable */
                 ieee80211_bss_info_change_notify(sdata,
                                                  BSS_CHANGED_BEACON_ENABLED);
 
-                /* remove beacon */
+                /* remove beacon and probe response */
                 RCU_INIT_POINTER(sdata->u.ap.beacon, NULL);
+                RCU_INIT_POINTER(sdata->u.ap.probe_resp, NULL);
                 synchronize_rcu();
                 kfree(old_beacon);
+                kfree_skb(old_probe_resp);
 
                 /* down all dependent devices, that is VLANs */
                 list_for_each_entry_safe(vlan, tmpsdata, &sdata->u.ap.vlans,
@@ -520,7 +537,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
                 ieee80211_free_keys(sdata);
 
                 if (going_down)
-                        drv_remove_interface(local, &sdata->vif);
+                        drv_remove_interface(local, sdata);
         }
 
         sdata->bss = NULL;
@@ -656,7 +673,6 @@ static u16 ieee80211_monitor_select_queue(struct net_device *dev,
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_hdr *hdr;
         struct ieee80211_radiotap_header *rtap = (void *)skb->data;
-        u8 *p;
 
         if (local->hw.queues < 4)
                 return 0;
@@ -667,19 +683,7 @@ static u16 ieee80211_monitor_select_queue(struct net_device *dev,
 
         hdr = (void *)((u8 *)skb->data + le16_to_cpu(rtap->it_len));
 
-        if (!ieee80211_is_data(hdr->frame_control)) {
-                skb->priority = 7;
-                return ieee802_1d_to_ac[skb->priority];
-        }
-        if (!ieee80211_is_data_qos(hdr->frame_control)) {
-                skb->priority = 0;
-                return ieee802_1d_to_ac[skb->priority];
-        }
-
-        p = ieee80211_get_qos_ctl(hdr);
-        skb->priority = *p & IEEE80211_QOS_CTL_TAG1D_MASK;
-
-        return ieee80211_downgrade_queue(local, skb);
+        return ieee80211_select_queue_80211(local, skb, hdr);
 }
 
 static const struct net_device_ops ieee80211_monitorif_ops = {
@@ -850,6 +854,8 @@ static void ieee80211_setup_sdata(struct ieee80211_sub_if_data *sdata,
         sdata->control_port_protocol = cpu_to_be16(ETH_P_PAE);
         sdata->control_port_no_encrypt = false;
 
+        sdata->noack_map = 0;
+
         /* only monitor differs */
         sdata->dev->type = ARPHRD_ETHER;
 
diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index fb02ea52d2c2..87a89741432d 100644
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -134,9 +134,13 @@ static int ieee80211_key_enable_hw_accel(struct ieee80211_key *key)
                 key->flags |= KEY_FLAG_UPLOADED_TO_HARDWARE;
 
                 if (!((key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC) ||
-                      (key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV)))
+                      (key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV) ||
+                      (key->conf.flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE)))
                         sdata->crypto_tx_tailroom_needed_cnt--;
 
+                WARN_ON((key->conf.flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE) &&
+                        (key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV));
+
                 return 0;
         }
 
@@ -179,7 +183,8 @@ static void ieee80211_key_disable_hw_accel(struct ieee80211_key *key)
         sdata = key->sdata;
 
         if (!((key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC) ||
-              (key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV)))
+              (key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV) ||
+              (key->conf.flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE)))
                 increment_tailroom_need_count(sdata);
 
         if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index cae443563ec9..0a0d94ad9b08 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -47,7 +47,7 @@ void ieee80211_configure_filter(struct ieee80211_local *local)
         if (atomic_read(&local->iff_allmultis))
                 new_flags |= FIF_ALLMULTI;
 
-        if (local->monitors || local->scanning)
+        if (local->monitors || test_bit(SCAN_SW_SCANNING, &local->scanning))
                 new_flags |= FIF_BCN_PRBRESP_PROMISC;
 
         if (local->fif_probe_req || local->probe_req_reg)
@@ -92,50 +92,9 @@ static void ieee80211_reconfig_filter(struct work_struct *work)
         ieee80211_configure_filter(local);
 }
 
-/*
- * Returns true if we are logically configured to be on
- * the operating channel AND the hardware-conf is currently
- * configured on the operating channel.  Compares channel-type
- * as well.
- */
-bool ieee80211_cfg_on_oper_channel(struct ieee80211_local *local)
-{
-        struct ieee80211_channel *chan, *scan_chan;
-        enum nl80211_channel_type channel_type;
-
-        /* This logic needs to match logic in ieee80211_hw_config */
-        if (local->scan_channel) {
-                chan = local->scan_channel;
-                /* If scanning on oper channel, use whatever channel-type
-                 * is currently in use.
-                 */
-                if (chan == local->oper_channel)
-                        channel_type = local->_oper_channel_type;
-                else
-                        channel_type = NL80211_CHAN_NO_HT;
-        } else if (local->tmp_channel) {
-                chan = scan_chan = local->tmp_channel;
-                channel_type = local->tmp_channel_type;
-        } else {
-                chan = local->oper_channel;
-                channel_type = local->_oper_channel_type;
-        }
-
-        if (chan != local->oper_channel ||
-            channel_type != local->_oper_channel_type)
-                return false;
-
-        /* Check current hardware-config against oper_channel. */
-        if ((local->oper_channel != local->hw.conf.channel) ||
-            (local->_oper_channel_type != local->hw.conf.channel_type))
-                return false;
-
-        return true;
-}
-
 int ieee80211_hw_config(struct ieee80211_local *local, u32 changed)
 {
-        struct ieee80211_channel *chan, *scan_chan;
+        struct ieee80211_channel *chan;
         int ret = 0;
         int power;
         enum nl80211_channel_type channel_type;
@@ -143,14 +102,12 @@ int ieee80211_hw_config(struct ieee80211_local *local, u32 changed)
 
         might_sleep();
 
-        scan_chan = local->scan_channel;
-
         /* If this off-channel logic ever changes,  ieee80211_on_oper_channel
          * may need to change as well.
          */
         offchannel_flag = local->hw.conf.flags & IEEE80211_CONF_OFFCHANNEL;
-        if (scan_chan) {
-                chan = scan_chan;
+        if (local->scan_channel) {
+                chan = local->scan_channel;
                 /* If scanning on oper channel, use whatever channel-type
                  * is currently in use.
                  */
@@ -159,7 +116,7 @@ int ieee80211_hw_config(struct ieee80211_local *local, u32 changed)
                 else
                         channel_type = NL80211_CHAN_NO_HT;
         } else if (local->tmp_channel) {
-                chan = scan_chan = local->tmp_channel;
+                chan = local->tmp_channel;
                 channel_type = local->tmp_channel_type;
         } else {
                 chan = local->oper_channel;
@@ -193,8 +150,8 @@ int ieee80211_hw_config(struct ieee80211_local *local, u32 changed)
                 changed |= IEEE80211_CONF_CHANGE_SMPS;
         }
 
-        if ((local->scanning & SCAN_SW_SCANNING) ||
-            (local->scanning & SCAN_HW_SCANNING))
+        if (test_bit(SCAN_SW_SCANNING, &local->scanning) ||
+            test_bit(SCAN_HW_SCANNING, &local->scanning))
                 power = chan->max_power;
         else
                 power = local->power_constr_level ?
@@ -436,9 +393,6 @@ static int ieee80211_ifa_changed(struct notifier_block *nb,
         sdata = IEEE80211_DEV_TO_SUB_IF(ndev);
         bss_conf = &sdata->vif.bss_conf;
 
-        if (!ieee80211_sdata_running(sdata))
-                return NOTIFY_DONE;
-
         /* ARP filtering is only supported in managed mode */
         if (sdata->vif.type != NL80211_IFTYPE_STATION)
                 return NOTIFY_DONE;
@@ -467,7 +421,7 @@ static int ieee80211_ifa_changed(struct notifier_block *nb,
         }
         bss_conf->arp_addr_cnt = c;
 
-        /* Configure driver only if associated */
+        /* Configure driver only if associated (which also implies it is up) */
         if (ifmgd->associated) {
                 bss_conf->arp_filter_enabled = sdata->arp_filter_state;
                 ieee80211_bss_info_change_notify(sdata,
@@ -560,6 +514,19 @@ ieee80211_default_mgmt_stypes[NUM_NL80211_IFTYPES] = {
         },
 };
 
+static const struct ieee80211_ht_cap mac80211_ht_capa_mod_mask = {
+        .ampdu_params_info = IEEE80211_HT_AMPDU_PARM_FACTOR |
+                             IEEE80211_HT_AMPDU_PARM_DENSITY,
+
+        .cap_info = cpu_to_le16(IEEE80211_HT_CAP_SUP_WIDTH_20_40 |
+                                IEEE80211_HT_CAP_MAX_AMSDU |
+                                IEEE80211_HT_CAP_SGI_40),
+        .mcs = {
+                .rx_mask = { 0xff, 0xff, 0xff, 0xff, 0xff,
+                             0xff, 0xff, 0xff, 0xff, 0xff, },
+        },
+};
+
 struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
                                         const struct ieee80211_ops *ops)
 {
@@ -595,7 +562,13 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
 
         wiphy->flags |= WIPHY_FLAG_NETNS_OK |
                         WIPHY_FLAG_4ADDR_AP |
-                        WIPHY_FLAG_4ADDR_STATION;
+                        WIPHY_FLAG_4ADDR_STATION |
+                        WIPHY_FLAG_REPORTS_OBSS |
+                        WIPHY_FLAG_OFFCHAN_TX |
+                        WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL;
+
+        wiphy->features = NL80211_FEATURE_SK_TX_STATUS |
+                          NL80211_FEATURE_HT_IBSS;
 
         if (!ops->set_key)
                 wiphy->flags |= WIPHY_FLAG_IBSS_RSN;
@@ -608,7 +581,7 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
 
         local->hw.priv = (char *)local + ALIGN(sizeof(*local), NETDEV_ALIGN);
 
-        BUG_ON(!ops->tx);
+        BUG_ON(!ops->tx && !ops->tx_frags);
         BUG_ON(!ops->start);
         BUG_ON(!ops->stop);
         BUG_ON(!ops->config);
@@ -628,6 +601,7 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
         local->user_power_level = -1;
         local->uapsd_queues = IEEE80211_DEFAULT_UAPSD_QUEUES;
         local->uapsd_max_sp_len = IEEE80211_DEFAULT_MAX_SP_LEN;
+        wiphy->ht_capa_mod_mask = &mac80211_ht_capa_mod_mask;
 
         INIT_LIST_HEAD(&local->interfaces);
 
@@ -670,6 +644,11 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
         INIT_WORK(&local->sched_scan_stopped_work,
                   ieee80211_sched_scan_stopped_work);
 
+        spin_lock_init(&local->ack_status_lock);
+        idr_init(&local->ack_status_frames);
+        /* preallocate at least one entry */
+        idr_pre_get(&local->ack_status_frames, GFP_KERNEL);
+
         sta_info_init(local);
 
         for (i = 0; i < IEEE80211_MAX_QUEUES; i++) {
@@ -1051,6 +1030,13 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw)
 }
 EXPORT_SYMBOL(ieee80211_unregister_hw);
 
+static int ieee80211_free_ack_frame(int id, void *p, void *data)
+{
+        WARN_ONCE(1, "Have pending ack frames!\n");
+        kfree_skb(p);
+        return 0;
+}
+
 void ieee80211_free_hw(struct ieee80211_hw *hw)
 {
         struct ieee80211_local *local = hw_to_local(hw);
@@ -1061,6 +1047,10 @@ void ieee80211_free_hw(struct ieee80211_hw *hw)
         if (local->wiphy_ciphers_allocated)
                 kfree(local->hw.wiphy->cipher_suites);
 
+        idr_for_each(&local->ack_status_frames,
+                     ieee80211_free_ack_frame, NULL);
+        idr_destroy(&local->ack_status_frames);
+
         wiphy_free(local->hw.wiphy);
 }
 EXPORT_SYMBOL(ieee80211_free_hw);
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index a7078fdba8ca..c707c8bf6d2c 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -76,6 +76,7 @@ static void ieee80211_mesh_housekeeping_timer(unsigned long data)
 bool mesh_matches_local(struct ieee802_11_elems *ie, struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
+        struct ieee80211_local *local = sdata->local;
 
         /*
          * As support for each feature is added, check for matching
@@ -87,15 +88,23 @@ bool mesh_matches_local(struct ieee802_11_elems *ie, struct ieee80211_sub_if_dat
          *   - MDA enabled
          * - Power management control on fc
          */
-        if (ifmsh->mesh_id_len == ie->mesh_id_len &&
-                memcmp(ifmsh->mesh_id, ie->mesh_id, ie->mesh_id_len) == 0 &&
-                (ifmsh->mesh_pp_id == ie->mesh_config->meshconf_psel) &&
-                (ifmsh->mesh_pm_id == ie->mesh_config->meshconf_pmetric) &&
-                (ifmsh->mesh_cc_id == ie->mesh_config->meshconf_congest) &&
-                (ifmsh->mesh_sp_id == ie->mesh_config->meshconf_synch) &&
-                (ifmsh->mesh_auth_id == ie->mesh_config->meshconf_auth))
-                return true;
-
+        if (!(ifmsh->mesh_id_len == ie->mesh_id_len &&
+             memcmp(ifmsh->mesh_id, ie->mesh_id, ie->mesh_id_len) == 0 &&
+             (ifmsh->mesh_pp_id == ie->mesh_config->meshconf_psel) &&
+             (ifmsh->mesh_pm_id == ie->mesh_config->meshconf_pmetric) &&
+             (ifmsh->mesh_cc_id == ie->mesh_config->meshconf_congest) &&
+             (ifmsh->mesh_sp_id == ie->mesh_config->meshconf_synch) &&
+             (ifmsh->mesh_auth_id == ie->mesh_config->meshconf_auth)))
+                goto mismatch;
+
+        /* disallow peering with mismatched channel types for now */
+        if (ie->ht_info_elem &&
+            (local->_oper_channel_type !=
+             ieee80211_ht_info_to_channel_type(ie->ht_info_elem)))
+                goto mismatch;
+
+        return true;
+mismatch:
         return false;
 }
 
@@ -341,6 +350,49 @@ int mesh_add_ds_params_ie(struct sk_buff *skb,
         return 0;
 }
 
+int mesh_add_ht_cap_ie(struct sk_buff *skb,
+                       struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_supported_band *sband;
+        u8 *pos;
+
+        sband = local->hw.wiphy->bands[local->oper_channel->band];
+        if (!sband->ht_cap.ht_supported ||
+            local->_oper_channel_type == NL80211_CHAN_NO_HT)
+                return 0;
+
+        if (skb_tailroom(skb) < 2 + sizeof(struct ieee80211_ht_cap))
+                return -ENOMEM;
+
+        pos = skb_put(skb, 2 + sizeof(struct ieee80211_ht_cap));
+        ieee80211_ie_build_ht_cap(pos, &sband->ht_cap, sband->ht_cap.cap);
+
+        return 0;
+}
+
+int mesh_add_ht_info_ie(struct sk_buff *skb,
+                        struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_channel *channel = local->oper_channel;
+        enum nl80211_channel_type channel_type = local->_oper_channel_type;
+        struct ieee80211_supported_band *sband =
+                                local->hw.wiphy->bands[channel->band];
+        struct ieee80211_sta_ht_cap *ht_cap = &sband->ht_cap;
+        u8 *pos;
+
+        if (!ht_cap->ht_supported || channel_type == NL80211_CHAN_NO_HT)
+                return 0;
+
+        if (skb_tailroom(skb) < 2 + sizeof(struct ieee80211_ht_info))
+                return -ENOMEM;
+
+        pos = skb_put(skb, 2 + sizeof(struct ieee80211_ht_info));
+        ieee80211_ie_build_ht_info(pos, ht_cap, channel, channel_type);
+
+        return 0;
+}
 static void ieee80211_mesh_path_timer(unsigned long data)
 {
         struct ieee80211_sub_if_data *sdata =
@@ -697,6 +749,7 @@ void ieee80211_mesh_init_sdata(struct ieee80211_sub_if_data *sdata)
         atomic_set(&ifmsh->mpaths, 0);
         mesh_rmc_init(sdata);
         ifmsh->last_preq = jiffies;
+        ifmsh->next_perr = jiffies;
         /* Allocate all mesh structures when creating the first mesh interface. */
         if (!mesh_allocated)
                 ieee80211s_init();
diff --git a/net/mac80211/mesh.h b/net/mac80211/mesh.h
index 8c00e2d1d636..bd14bd26a2b6 100644
--- a/net/mac80211/mesh.h
+++ b/net/mac80211/mesh.h
@@ -31,6 +31,8 @@
  * @MESH_PATH_FIXED: the mesh path has been manually set and should not be
  *      modified
  * @MESH_PATH_RESOLVED: the mesh path can has been resolved
+ * @MESH_PATH_REQ_QUEUED: there is an unsent path request for this destination
+ * already queued up, waiting for the discovery process to start.
  *
  * MESH_PATH_RESOLVED is used by the mesh path timer to
  * decide when to stop or cancel the mesh path discovery.
@@ -41,6 +43,7 @@ enum mesh_path_flags {
         MESH_PATH_SN_VALID =    BIT(2),
         MESH_PATH_FIXED =       BIT(3),
         MESH_PATH_RESOLVED =    BIT(4),
+        MESH_PATH_REQ_QUEUED =  BIT(5),
 };
 
 /**
@@ -212,6 +215,10 @@ int mesh_add_vendor_ies(struct sk_buff *skb,
                         struct ieee80211_sub_if_data *sdata);
 int mesh_add_ds_params_ie(struct sk_buff *skb,
                           struct ieee80211_sub_if_data *sdata);
+int mesh_add_ht_cap_ie(struct sk_buff *skb,
+                       struct ieee80211_sub_if_data *sdata);
+int mesh_add_ht_info_ie(struct sk_buff *skb,
+                        struct ieee80211_sub_if_data *sdata);
 void mesh_rmc_free(struct ieee80211_sub_if_data *sdata);
 int mesh_rmc_init(struct ieee80211_sub_if_data *sdata);
 void ieee80211s_init(void);
@@ -226,6 +233,8 @@ void ieee80211_mesh_root_setup(struct ieee80211_if_mesh *ifmsh);
 /* Mesh paths */
 int mesh_nexthop_lookup(struct sk_buff *skb,
                 struct ieee80211_sub_if_data *sdata);
+int mesh_nexthop_resolve(struct sk_buff *skb,
+                         struct ieee80211_sub_if_data *sdata);
 void mesh_path_start_discovery(struct ieee80211_sub_if_data *sdata);
 struct mesh_path *mesh_path_lookup(u8 *dst,
                 struct ieee80211_sub_if_data *sdata);
diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
index 174040a42887..73abb7524b2c 100644
--- a/net/mac80211/mesh_hwmp.c
+++ b/net/mac80211/mesh_hwmp.c
@@ -113,20 +113,20 @@ static int mesh_path_sel_frame_tx(enum mpath_frame_type action, u8 flags,
                 struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_local *local = sdata->local;
-        struct sk_buff *skb = dev_alloc_skb(local->hw.extra_tx_headroom + 400);
+        struct sk_buff *skb;
         struct ieee80211_mgmt *mgmt;
-        u8 *pos;
-        int ie_len;
+        u8 *pos, ie_len;
+        int hdr_len = offsetof(struct ieee80211_mgmt, u.action.u.mesh_action) +
+                      sizeof(mgmt->u.action.u.mesh_action);
 
+        skb = dev_alloc_skb(local->hw.extra_tx_headroom +
+                            hdr_len +
+                            2 + 37); /* max HWMP IE */
         if (!skb)
                 return -1;
         skb_reserve(skb, local->hw.extra_tx_headroom);
-        /* 25 is the size of the common mgmt part (24) plus the size of the
-         * common action part (1)
-         */
-        mgmt = (struct ieee80211_mgmt *)
-                skb_put(skb, 25 + sizeof(mgmt->u.action.u.mesh_action));
-        memset(mgmt, 0, 25 + sizeof(mgmt->u.action.u.mesh_action));
+        mgmt = (struct ieee80211_mgmt *) skb_put(skb, hdr_len);
+        memset(mgmt, 0, hdr_len);
         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
                                           IEEE80211_STYPE_ACTION);
 
@@ -240,20 +240,24 @@ int mesh_path_error_tx(u8 ttl, u8 *target, __le32 target_sn,
                        struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_local *local = sdata->local;
-        struct sk_buff *skb = dev_alloc_skb(local->hw.extra_tx_headroom + 400);
+        struct sk_buff *skb;
+        struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
         struct ieee80211_mgmt *mgmt;
-        u8 *pos;
-        int ie_len;
+        u8 *pos, ie_len;
+        int hdr_len = offsetof(struct ieee80211_mgmt, u.action.u.mesh_action) +
+                      sizeof(mgmt->u.action.u.mesh_action);
 
+        if (time_before(jiffies, ifmsh->next_perr))
+                return -EAGAIN;
+
+        skb = dev_alloc_skb(local->hw.extra_tx_headroom +
+                            hdr_len +
+                            2 + 15 /* PERR IE */);
         if (!skb)
                 return -1;
         skb_reserve(skb, local->tx_headroom + local->hw.extra_tx_headroom);
-        /* 25 is the size of the common mgmt part (24) plus the size of the
-         * common action part (1)
-         */
-        mgmt = (struct ieee80211_mgmt *)
-                skb_put(skb, 25 + sizeof(mgmt->u.action.u.mesh_action));
-        memset(mgmt, 0, 25 + sizeof(mgmt->u.action.u.mesh_action));
+        mgmt = (struct ieee80211_mgmt *) skb_put(skb, hdr_len);
+        memset(mgmt, 0, hdr_len);
         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
                                           IEEE80211_STYPE_ACTION);
 
@@ -290,6 +294,8 @@ int mesh_path_error_tx(u8 ttl, u8 *target, __le32 target_sn,
 
         /* see note in function header */
         prepare_frame_for_deferred_tx(sdata, skb);
+        ifmsh->next_perr = TU_TO_EXP_TIME(
+                                   ifmsh->mshcfg.dot11MeshHWMPperrMinInterval);
         ieee80211_add_pending_skb(local, skb);
         return 0;
 }
@@ -393,15 +399,13 @@ static u32 hwmp_route_info_get(struct ieee80211_sub_if_data *sdata,
                 orig_metric = PREQ_IE_METRIC(hwmp_ie);
                 break;
         case MPATH_PREP:
-                /* Originator here refers to the MP that was the destination in
-                 * the Path Request. The draft refers to that MP as the
-                 * destination address, even though usually it is the origin of
-                 * the PREP frame. We divert from the nomenclature in the draft
+                /* Originator here refers to the MP that was the target in the
+                 * Path Request. We divert from the nomenclature in the draft
                  * so that we can easily use a single function to gather path
                  * information from both PREQ and PREP frames.
                  */
-                orig_addr = PREP_IE_ORIG_ADDR(hwmp_ie);
-                orig_sn = PREP_IE_ORIG_SN(hwmp_ie);
+                orig_addr = PREP_IE_TARGET_ADDR(hwmp_ie);
+                orig_sn = PREP_IE_TARGET_SN(hwmp_ie);
                 orig_lifetime = PREP_IE_LIFETIME(hwmp_ie);
                 orig_metric = PREP_IE_METRIC(hwmp_ie);
                 break;
@@ -562,9 +566,9 @@ static void hwmp_preq_frame_process(struct ieee80211_sub_if_data *sdata,
                 ttl = ifmsh->mshcfg.element_ttl;
                 if (ttl != 0) {
                         mhwmp_dbg("replying to the PREQ");
-                        mesh_path_sel_frame_tx(MPATH_PREP, 0, target_addr,
-                                cpu_to_le32(target_sn), 0, orig_addr,
-                                cpu_to_le32(orig_sn), mgmt->sa, 0, ttl,
+                        mesh_path_sel_frame_tx(MPATH_PREP, 0, orig_addr,
+                                cpu_to_le32(orig_sn), 0, target_addr,
+                                cpu_to_le32(target_sn), mgmt->sa, 0, ttl,
                                 cpu_to_le32(lifetime), cpu_to_le32(metric),
                                 0, sdata);
                 } else
@@ -618,14 +622,8 @@ static void hwmp_prep_frame_process(struct ieee80211_sub_if_data *sdata,
 
         mhwmp_dbg("received PREP from %pM", PREP_IE_ORIG_ADDR(prep_elem));
 
-        /* Note that we divert from the draft nomenclature and denominate
-         * destination to what the draft refers to as origininator. So in this
-         * function destnation refers to the final destination of the PREP,
-         * which corresponds with the originator of the PREQ which this PREP
-         * replies
-         */
-        target_addr = PREP_IE_TARGET_ADDR(prep_elem);
-        if (memcmp(target_addr, sdata->vif.addr, ETH_ALEN) == 0)
+        orig_addr = PREP_IE_ORIG_ADDR(prep_elem);
+        if (memcmp(orig_addr, sdata->vif.addr, ETH_ALEN) == 0)
                 /* destination, no forwarding required */
                 return;
 
@@ -636,7 +634,7 @@ static void hwmp_prep_frame_process(struct ieee80211_sub_if_data *sdata,
         }
 
         rcu_read_lock();
-        mpath = mesh_path_lookup(target_addr, sdata);
+        mpath = mesh_path_lookup(orig_addr, sdata);
         if (mpath)
                 spin_lock_bh(&mpath->state_lock);
         else
@@ -651,7 +649,7 @@ static void hwmp_prep_frame_process(struct ieee80211_sub_if_data *sdata,
         flags = PREP_IE_FLAGS(prep_elem);
         lifetime = PREP_IE_LIFETIME(prep_elem);
         hopcount = PREP_IE_HOPCOUNT(prep_elem) + 1;
-        orig_addr = PREP_IE_ORIG_ADDR(prep_elem);
+        target_addr = PREP_IE_TARGET_ADDR(prep_elem);
         target_sn = PREP_IE_TARGET_SN(prep_elem);
         orig_sn = PREP_IE_ORIG_SN(prep_elem);
 
@@ -867,9 +865,20 @@ static void mesh_queue_preq(struct mesh_path *mpath, u8 flags)
                 return;
         }
 
+        spin_lock(&mpath->state_lock);
+        if (mpath->flags & MESH_PATH_REQ_QUEUED) {
+                spin_unlock(&mpath->state_lock);
+                spin_unlock_bh(&ifmsh->mesh_preq_queue_lock);
+                kfree(preq_node);
+                return;
+        }
+
         memcpy(preq_node->dst, mpath->dst, ETH_ALEN);
         preq_node->flags = flags;
 
+        mpath->flags |= MESH_PATH_REQ_QUEUED;
+        spin_unlock(&mpath->state_lock);
+
         list_add_tail(&preq_node->list, &ifmsh->preq_queue.list);
         ++ifmsh->preq_queue_len;
         spin_unlock_bh(&ifmsh->mesh_preq_queue_lock);
@@ -921,6 +930,7 @@ void mesh_path_start_discovery(struct ieee80211_sub_if_data *sdata)
                 goto enddiscovery;
 
         spin_lock_bh(&mpath->state_lock);
+        mpath->flags &= ~MESH_PATH_REQ_QUEUED;
         if (preq_node->flags & PREQ_Q_F_START) {
                 if (mpath->flags & MESH_PATH_RESOLVING) {
                         spin_unlock_bh(&mpath->state_lock);
@@ -972,71 +982,97 @@ enddiscovery:
         kfree(preq_node);
 }
 
-/**
- * mesh_nexthop_lookup - put the appropriate next hop on a mesh frame
+/* mesh_nexthop_resolve - lookup next hop for given skb and start path
+ * discovery if no forwarding information is found.
  *
  * @skb: 802.11 frame to be sent
  * @sdata: network subif the frame will be sent through
  *
- * Returns: 0 if the next hop was found. Nonzero otherwise. If no next hop is
- * found, the function will start a path discovery and queue the frame so it is
- * sent when the path is resolved. This means the caller must not free the skb
- * in this case.
+ * Returns: 0 if the next hop was found and -ENOENT if the frame was queued.
+ * skb is freeed here if no mpath could be allocated.
  */
-int mesh_nexthop_lookup(struct sk_buff *skb,
-                        struct ieee80211_sub_if_data *sdata)
+int mesh_nexthop_resolve(struct sk_buff *skb,
+                         struct ieee80211_sub_if_data *sdata)
 {
-        struct sk_buff *skb_to_free = NULL;
-        struct mesh_path *mpath;
-        struct sta_info *next_hop;
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+        struct mesh_path *mpath;
+        struct sk_buff *skb_to_free = NULL;
         u8 *target_addr = hdr->addr3;
         int err = 0;
 
         rcu_read_lock();
-        mpath = mesh_path_lookup(target_addr, sdata);
+        err = mesh_nexthop_lookup(skb, sdata);
+        if (!err)
+                goto endlookup;
 
+        /* no nexthop found, start resolving */
+        mpath = mesh_path_lookup(target_addr, sdata);
         if (!mpath) {
                 mesh_path_add(target_addr, sdata);
                 mpath = mesh_path_lookup(target_addr, sdata);
                 if (!mpath) {
-                        sdata->u.mesh.mshstats.dropped_frames_no_route++;
+                        mesh_path_discard_frame(skb, sdata);
                         err = -ENOSPC;
                         goto endlookup;
                 }
         }
 
-        if (mpath->flags & MESH_PATH_ACTIVE) {
-                if (time_after(jiffies,
-                               mpath->exp_time -
-                               msecs_to_jiffies(sdata->u.mesh.mshcfg.path_refresh_time)) &&
-                    !memcmp(sdata->vif.addr, hdr->addr4, ETH_ALEN) &&
-                    !(mpath->flags & MESH_PATH_RESOLVING) &&
-                    !(mpath->flags & MESH_PATH_FIXED)) {
-                        mesh_queue_preq(mpath,
-                                        PREQ_Q_F_START | PREQ_Q_F_REFRESH);
-                }
-                next_hop = rcu_dereference(mpath->next_hop);
-                if (next_hop)
-                        memcpy(hdr->addr1, next_hop->sta.addr, ETH_ALEN);
-                else
-                        err = -ENOENT;
-        } else {
-                struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-                if (!(mpath->flags & MESH_PATH_RESOLVING)) {
-                        /* Start discovery only if it is not running yet */
-                        mesh_queue_preq(mpath, PREQ_Q_F_START);
-                }
+        if (!(mpath->flags & MESH_PATH_RESOLVING))
+                mesh_queue_preq(mpath, PREQ_Q_F_START);
+
+        if (skb_queue_len(&mpath->frame_queue) >= MESH_FRAME_QUEUE_LEN)
+                skb_to_free = skb_dequeue(&mpath->frame_queue);
 
-                if (skb_queue_len(&mpath->frame_queue) >=
-                                MESH_FRAME_QUEUE_LEN)
-                        skb_to_free = skb_dequeue(&mpath->frame_queue);
+        info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
+        ieee80211_set_qos_hdr(sdata, skb);
+        skb_queue_tail(&mpath->frame_queue, skb);
+        err = -ENOENT;
+        if (skb_to_free)
+                mesh_path_discard_frame(skb_to_free, sdata);
+
+endlookup:
+        rcu_read_unlock();
+        return err;
+}
+/**
+ * mesh_nexthop_lookup - put the appropriate next hop on a mesh frame. Calling
+ * this function is considered "using" the associated mpath, so preempt a path
+ * refresh if this mpath expires soon.
+ *
+ * @skb: 802.11 frame to be sent
+ * @sdata: network subif the frame will be sent through
+ *
+ * Returns: 0 if the next hop was found. Nonzero otherwise.
+ */
+int mesh_nexthop_lookup(struct sk_buff *skb,
+                        struct ieee80211_sub_if_data *sdata)
+{
+        struct mesh_path *mpath;
+        struct sta_info *next_hop;
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
+        u8 *target_addr = hdr->addr3;
+        int err = -ENOENT;
+
+        rcu_read_lock();
+        mpath = mesh_path_lookup(target_addr, sdata);
+
+        if (!mpath || !(mpath->flags & MESH_PATH_ACTIVE))
+                goto endlookup;
+
+        if (time_after(jiffies,
+                       mpath->exp_time -
+                       msecs_to_jiffies(sdata->u.mesh.mshcfg.path_refresh_time)) &&
+            !memcmp(sdata->vif.addr, hdr->addr4, ETH_ALEN) &&
+            !(mpath->flags & MESH_PATH_RESOLVING) &&
+            !(mpath->flags & MESH_PATH_FIXED))
+                mesh_queue_preq(mpath, PREQ_Q_F_START | PREQ_Q_F_REFRESH);
 
-                info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
-                skb_queue_tail(&mpath->frame_queue, skb);
-                if (skb_to_free)
-                        mesh_path_discard_frame(skb_to_free, sdata);
-                err = -ENOENT;
+        next_hop = rcu_dereference(mpath->next_hop);
+        if (next_hop) {
+                memcpy(hdr->addr1, next_hop->sta.addr, ETH_ALEN);
+                memcpy(hdr->addr2, sdata->vif.addr, ETH_ALEN);
+                err = 0;
         }
 
 endlookup:
@@ -1061,6 +1097,7 @@ void mesh_path_timer(unsigned long data)
         } else if (mpath->discovery_retries < max_preq_retries(sdata)) {
                 ++mpath->discovery_retries;
                 mpath->discovery_timeout *= 2;
+                mpath->flags &= ~MESH_PATH_REQ_QUEUED;
                 spin_unlock_bh(&mpath->state_lock);
                 mesh_queue_preq(mpath, 0);
         } else {
diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c
index 7f54c5042235..edf167e3b8f3 100644
--- a/net/mac80211/mesh_pathtbl.c
+++ b/net/mac80211/mesh_pathtbl.c
@@ -69,8 +69,6 @@ static inline struct mesh_table *resize_dereference_mpp_paths(void)
                 lockdep_is_held(&pathtbl_resize_lock));
 }
 
-static int mesh_gate_add(struct mesh_table *tbl, struct mesh_path *mpath);
-
 /*
  * CAREFUL -- "tbl" must not be an expression,
  * in particular not an rcu_dereference(), since
@@ -213,7 +211,6 @@ void mesh_path_assign_nexthop(struct mesh_path *mpath, struct sta_info *sta)
         struct ieee80211_hdr *hdr;
         struct sk_buff_head tmpq;
         unsigned long flags;
-        struct ieee80211_sub_if_data *sdata = mpath->sdata;
 
         rcu_assign_pointer(mpath->next_hop, sta);
 
@@ -224,8 +221,7 @@ void mesh_path_assign_nexthop(struct mesh_path *mpath, struct sta_info *sta)
         while ((skb = __skb_dequeue(&mpath->frame_queue)) != NULL) {
                 hdr = (struct ieee80211_hdr *) skb->data;
                 memcpy(hdr->addr1, sta->sta.addr, ETH_ALEN);
-                skb_set_queue_mapping(skb, ieee80211_select_queue(sdata, skb));
-                ieee80211_set_qos_hdr(sdata, skb);
+                memcpy(hdr->addr2, mpath->sdata->vif.addr, ETH_ALEN);
                 __skb_queue_tail(&tmpq, skb);
         }
 
@@ -269,6 +265,7 @@ static void prepare_for_gate(struct sk_buff *skb, char *dst_addr,
         next_hop = rcu_dereference(gate_mpath->next_hop)->sta.addr;
         memcpy(hdr->addr1, next_hop, ETH_ALEN);
         rcu_read_unlock();
+        memcpy(hdr->addr2, gate_mpath->sdata->vif.addr, ETH_ALEN);
         memcpy(hdr->addr3, dst_addr, ETH_ALEN);
 }
 
@@ -423,21 +420,18 @@ static void mesh_gate_node_reclaim(struct rcu_head *rp)
 }
 
 /**
- * mesh_gate_add - mark mpath as path to a mesh gate and add to known_gates
- * @mesh_tbl: table which contains known_gates list
- * @mpath: mpath to known mesh gate
- *
- * Returns: 0 on success
- *
+ * mesh_path_add_gate - add the given mpath to a mesh gate to our path table
+ * @mpath: gate path to add to table
  */
-static int mesh_gate_add(struct mesh_table *tbl, struct mesh_path *mpath)
+int mesh_path_add_gate(struct mesh_path *mpath)
 {
+        struct mesh_table *tbl;
         struct mpath_node *gate, *new_gate;
         struct hlist_node *n;
         int err;
 
         rcu_read_lock();
-        tbl = rcu_dereference(tbl);
+        tbl = rcu_dereference(mesh_paths);
 
         hlist_for_each_entry_rcu(gate, n, tbl->known_gates, list)
                 if (gate->mpath == mpath) {
@@ -481,8 +475,6 @@ static int mesh_gate_del(struct mesh_table *tbl, struct mesh_path *mpath)
         struct mpath_node *gate;
         struct hlist_node *p, *q;
 
-        tbl = rcu_dereference(tbl);
-
         hlist_for_each_entry_safe(gate, p, q, tbl->known_gates, list)
                 if (gate->mpath == mpath) {
                         spin_lock_bh(&tbl->gates_lock);
@@ -501,16 +493,6 @@ static int mesh_gate_del(struct mesh_table *tbl, struct mesh_path *mpath)
 }
 
 /**
- *
- * mesh_path_add_gate - add the given mpath to a mesh gate to our path table
- * @mpath: gate path to add to table
- */
-int mesh_path_add_gate(struct mesh_path *mpath)
-{
-        return mesh_gate_add(mesh_paths, mpath);
-}
-
-/**
  * mesh_gate_num - number of gates known to this interface
  * @sdata: subif data
  */
@@ -991,38 +973,11 @@ int mesh_path_send_to_gates(struct mesh_path *mpath)
  * @skb: frame to discard
  * @sdata: network subif the frame was to be sent through
  *
- * If the frame was being forwarded from another MP, a PERR frame will be sent
- * to the precursor.  The precursor's address (i.e. the previous hop) was saved
- * in addr1 of the frame-to-be-forwarded, and would only be overwritten once
- * the destination is successfully resolved.
- *
  * Locking: the function must me called within a rcu_read_lock region
  */
 void mesh_path_discard_frame(struct sk_buff *skb,
                              struct ieee80211_sub_if_data *sdata)
 {
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
-        struct mesh_path *mpath;
-        u32 sn = 0;
-        __le16 reason = cpu_to_le16(WLAN_REASON_MESH_PATH_NOFORWARD);
-
-        if (memcmp(hdr->addr4, sdata->vif.addr, ETH_ALEN) != 0) {
-                u8 *ra, *da;
-
-                da = hdr->addr3;
-                ra = hdr->addr1;
-                rcu_read_lock();
-                mpath = mesh_path_lookup(da, sdata);
-                if (mpath) {
-                        spin_lock_bh(&mpath->state_lock);
-                        sn = ++mpath->sn;
-                        spin_unlock_bh(&mpath->state_lock);
-                }
-                rcu_read_unlock();
-                mesh_path_error_tx(sdata->u.mesh.mshcfg.element_ttl, skb->data,
-                                   cpu_to_le32(sn), reason, ra, sdata);
-        }
-
         kfree_skb(skb);
         sdata->u.mesh.mshstats.dropped_frames_no_route++;
 }
diff --git a/net/mac80211/mesh_plink.c b/net/mac80211/mesh_plink.c
index 7e57f5d07f66..41ef1b476442 100644
--- a/net/mac80211/mesh_plink.c
+++ b/net/mac80211/mesh_plink.c
@@ -80,11 +80,15 @@ static inline void mesh_plink_fsm_restart(struct sta_info *sta)
  *       on it in the lifecycle management section!
  */
 static struct sta_info *mesh_plink_alloc(struct ieee80211_sub_if_data *sdata,
-                                         u8 *hw_addr, u32 rates)
+                                         u8 *hw_addr, u32 rates,
+                                         struct ieee802_11_elems *elems)
 {
         struct ieee80211_local *local = sdata->local;
+        struct ieee80211_supported_band *sband;
         struct sta_info *sta;
 
+        sband = local->hw.wiphy->bands[local->oper_channel->band];
+
         if (local->num_sta >= MESH_MAX_PLINKS)
                 return NULL;
 
@@ -92,10 +96,17 @@ static struct sta_info *mesh_plink_alloc(struct ieee80211_sub_if_data *sdata,
         if (!sta)
                 return NULL;
 
-        set_sta_flag(sta, WLAN_STA_AUTH);
-        set_sta_flag(sta, WLAN_STA_AUTHORIZED);
+        sta_info_move_state(sta, IEEE80211_STA_AUTH);
+        sta_info_move_state(sta, IEEE80211_STA_ASSOC);
+        sta_info_move_state(sta, IEEE80211_STA_AUTHORIZED);
+
         set_sta_flag(sta, WLAN_STA_WME);
+
         sta->sta.supp_rates[local->hw.conf.channel->band] = rates;
+        if (elems->ht_cap_elem)
+                ieee80211_ht_cap_ie_to_sta_ht_cap(sdata, sband,
+                                                  elems->ht_cap_elem,
+                                                  &sta->sta.ht_cap);
         rate_control_rate_init(sta);
 
         return sta;
@@ -153,23 +164,31 @@ static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata,
                 enum ieee80211_self_protected_actioncode action,
                 u8 *da, __le16 llid, __le16 plid, __le16 reason) {
         struct ieee80211_local *local = sdata->local;
-        struct sk_buff *skb = dev_alloc_skb(local->hw.extra_tx_headroom + 400 +
-                        sdata->u.mesh.ie_len);
+        struct sk_buff *skb;
         struct ieee80211_mgmt *mgmt;
         bool include_plid = false;
-        int ie_len = 4;
         u16 peering_proto = 0;
-        u8 *pos;
-
+        u8 *pos, ie_len = 4;
+        int hdr_len = offsetof(struct ieee80211_mgmt, u.action.u.self_prot) +
+                      sizeof(mgmt->u.action.u.self_prot);
+
+        skb = dev_alloc_skb(local->hw.extra_tx_headroom +
+                            hdr_len +
+                            2 + /* capability info */
+                            2 + /* AID */
+                            2 + 8 + /* supported rates */
+                            2 + (IEEE80211_MAX_SUPP_RATES - 8) +
+                            2 + sdata->u.mesh.mesh_id_len +
+                            2 + sizeof(struct ieee80211_meshconf_ie) +
+                            2 + sizeof(struct ieee80211_ht_cap) +
+                            2 + sizeof(struct ieee80211_ht_info) +
+                            2 + 8 + /* peering IE */
+                            sdata->u.mesh.ie_len);
         if (!skb)
                 return -1;
         skb_reserve(skb, local->hw.extra_tx_headroom);
-        /* 25 is the size of the common mgmt part (24) plus the size of the
-         * common action part (1)
-         */
-        mgmt = (struct ieee80211_mgmt *)
-                skb_put(skb, 25 + sizeof(mgmt->u.action.u.self_prot));
-        memset(mgmt, 0, 25 + sizeof(mgmt->u.action.u.self_prot));
+        mgmt = (struct ieee80211_mgmt *) skb_put(skb, hdr_len);
+        memset(mgmt, 0, hdr_len);
         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
                                           IEEE80211_STYPE_ACTION);
         memcpy(mgmt->da, da, ETH_ALEN);
@@ -235,6 +254,13 @@ static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata,
                 memcpy(pos, &reason, 2);
                 pos += 2;
         }
+
+        if (action != WLAN_SP_MESH_PEERING_CLOSE) {
+                if (mesh_add_ht_cap_ie(skb, sdata) ||
+                    mesh_add_ht_info_ie(skb, sdata))
+                        return -1;
+        }
+
         if (mesh_add_vendor_ies(skb, sdata))
                 return -1;
 
@@ -261,7 +287,7 @@ void mesh_neighbour_update(u8 *hw_addr, u32 rates,
                                         elems->ie_start, elems->total_len,
                                         GFP_KERNEL);
                 else
-                        sta = mesh_plink_alloc(sdata, hw_addr, rates);
+                        sta = mesh_plink_alloc(sdata, hw_addr, rates, elems);
                 if (!sta)
                         return;
                 if (sta_info_insert_rcu(sta)) {
@@ -552,7 +578,7 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                 }
 
                 rates = ieee80211_sta_get_rates(local, &elems, rx_status->band);
-                sta = mesh_plink_alloc(sdata, mgmt->sa, rates);
+                sta = mesh_plink_alloc(sdata, mgmt->sa, rates, &elems);
                 if (!sta) {
                         mpl_dbg("Mesh plink error: plink table full\n");
                         return;
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index b1b1bb368f70..ecb4c84c1bb3 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -209,6 +209,7 @@ static u32 ieee80211_enable_ht(struct ieee80211_sub_if_data *sdata,
                 channel_type = NL80211_CHAN_HT20;
 
                 if (!(ap_ht_cap_flags & IEEE80211_HT_CAP_40MHZ_INTOLERANT) &&
+                    !ieee80111_cfg_override_disables_ht40(sdata) &&
                     (sband->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) &&
                     (hti->ht_param & IEEE80211_HT_PARAM_CHAN_WIDTH_ANY)) {
                         switch(hti->ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
@@ -818,7 +819,7 @@ void ieee80211_dynamic_ps_enable_work(struct work_struct *work)
         }
 
         if ((local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK) &&
-            (!(ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED))) {
+            !(ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED)) {
                 netif_tx_stop_all_queues(sdata->dev);
 
                 if (drv_tx_frames_pending(local))
@@ -1120,6 +1121,8 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
 
         /* on the next assoc, re-program HT parameters */
         sdata->ht_opmode_valid = false;
+        memset(&ifmgd->ht_capa, 0, sizeof(ifmgd->ht_capa));
+        memset(&ifmgd->ht_capa_mask, 0, sizeof(ifmgd->ht_capa_mask));
 
         local->power_constr_level = 0;
 
@@ -1359,9 +1362,6 @@ static void __ieee80211_connection_loss(struct ieee80211_sub_if_data *sdata)
         ieee80211_set_disassoc(sdata, true, true);
         mutex_unlock(&ifmgd->mtx);
 
-        mutex_lock(&local->mtx);
-        ieee80211_recalc_idle(local);
-        mutex_unlock(&local->mtx);
         /*
          * must be outside lock due to cfg80211,
          * but that's not a problem.
@@ -1370,6 +1370,10 @@ static void __ieee80211_connection_loss(struct ieee80211_sub_if_data *sdata)
                                        IEEE80211_STYPE_DEAUTH,
                                        WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
                                        NULL, true);
+
+        mutex_lock(&local->mtx);
+        ieee80211_recalc_idle(local);
+        mutex_unlock(&local->mtx);
 }
 
 void ieee80211_beacon_connection_loss_work(struct work_struct *work)
@@ -1377,6 +1381,16 @@ void ieee80211_beacon_connection_loss_work(struct work_struct *work)
         struct ieee80211_sub_if_data *sdata =
                 container_of(work, struct ieee80211_sub_if_data,
                              u.mgd.beacon_connection_loss_work);
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+        struct sta_info *sta;
+
+        if (ifmgd->associated) {
+                rcu_read_lock();
+                sta = sta_info_get(sdata, ifmgd->bssid);
+                if (sta)
+                        sta->beacon_loss_count++;
+                rcu_read_unlock();
+        }
 
         if (sdata->local->hw.flags & IEEE80211_HW_CONNECTION_MONITOR)
                 __ieee80211_connection_loss(sdata);
@@ -1468,6 +1482,47 @@ ieee80211_rx_mgmt_disassoc(struct ieee80211_sub_if_data *sdata,
         return RX_MGMT_CFG80211_DISASSOC;
 }
 
+static void ieee80211_get_rates(struct ieee80211_supported_band *sband,
+                                u8 *supp_rates, unsigned int supp_rates_len,
+                                u32 *rates, u32 *basic_rates,
+                                bool *have_higher_than_11mbit,
+                                int *min_rate, int *min_rate_index)
+{
+        int i, j;
+
+        for (i = 0; i < supp_rates_len; i++) {
+                int rate = (supp_rates[i] & 0x7f) * 5;
+                bool is_basic = !!(supp_rates[i] & 0x80);
+
+                if (rate > 110)
+                        *have_higher_than_11mbit = true;
+
+                /*
+                 * BSS_MEMBERSHIP_SELECTOR_HT_PHY is defined in 802.11n-2009
+                 * 7.3.2.2 as a magic value instead of a rate. Hence, skip it.
+                 *
+                 * Note: Even through the membership selector and the basic
+                 *       rate flag share the same bit, they are not exactly
+                 *       the same.
+                 */
+                if (!!(supp_rates[i] & 0x80) &&
+                    (supp_rates[i] & 0x7f) == BSS_MEMBERSHIP_SELECTOR_HT_PHY)
+                        continue;
+
+                for (j = 0; j < sband->n_bitrates; j++) {
+                        if (sband->bitrates[j].bitrate == rate) {
+                                *rates |= BIT(j);
+                                if (is_basic)
+                                        *basic_rates |= BIT(j);
+                                if (rate < *min_rate) {
+                                        *min_rate = rate;
+                                        *min_rate_index = j;
+                                }
+                                break;
+                        }
+                }
+        }
+}
 
 static bool ieee80211_assoc_success(struct ieee80211_work *wk,
                                     struct ieee80211_mgmt *mgmt, size_t len)
@@ -1484,7 +1539,7 @@ static bool ieee80211_assoc_success(struct ieee80211_work *wk,
         struct ieee802_11_elems elems;
         struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
         u32 changed = 0;
-        int i, j, err;
+        int err;
         bool have_higher_than_11mbit = false;
         u16 ap_ht_cap_flags;
         int min_rate = INT_MAX, min_rate_index = -1;
@@ -1532,57 +1587,23 @@ static bool ieee80211_assoc_success(struct ieee80211_work *wk,
                 return false;
         }
 
-        set_sta_flag(sta, WLAN_STA_AUTH);
-        set_sta_flag(sta, WLAN_STA_ASSOC);
-        set_sta_flag(sta, WLAN_STA_ASSOC_AP);
+        sta_info_move_state(sta, IEEE80211_STA_AUTH);
+        sta_info_move_state(sta, IEEE80211_STA_ASSOC);
         if (!(ifmgd->flags & IEEE80211_STA_CONTROL_PORT))
-                set_sta_flag(sta, WLAN_STA_AUTHORIZED);
+                sta_info_move_state(sta, IEEE80211_STA_AUTHORIZED);
 
         rates = 0;
         basic_rates = 0;
         sband = local->hw.wiphy->bands[wk->chan->band];
 
-        for (i = 0; i < elems.supp_rates_len; i++) {
-                int rate = (elems.supp_rates[i] & 0x7f) * 5;
-                bool is_basic = !!(elems.supp_rates[i] & 0x80);
+        ieee80211_get_rates(sband, elems.supp_rates, elems.supp_rates_len,
+                            &rates, &basic_rates, &have_higher_than_11mbit,
+                            &min_rate, &min_rate_index);
 
-                if (rate > 110)
-                        have_higher_than_11mbit = true;
-
-                for (j = 0; j < sband->n_bitrates; j++) {
-                        if (sband->bitrates[j].bitrate == rate) {
-                                rates |= BIT(j);
-                                if (is_basic)
-                                        basic_rates |= BIT(j);
-                                if (rate < min_rate) {
-                                        min_rate = rate;
-                                        min_rate_index = j;
-                                }
-                                break;
-                        }
-                }
-        }
-
-        for (i = 0; i < elems.ext_supp_rates_len; i++) {
-                int rate = (elems.ext_supp_rates[i] & 0x7f) * 5;
-                bool is_basic = !!(elems.ext_supp_rates[i] & 0x80);
-
-                if (rate > 110)
-                        have_higher_than_11mbit = true;
-
-                for (j = 0; j < sband->n_bitrates; j++) {
-                        if (sband->bitrates[j].bitrate == rate) {
-                                rates |= BIT(j);
-                                if (is_basic)
-                                        basic_rates |= BIT(j);
-                                if (rate < min_rate) {
-                                        min_rate = rate;
-                                        min_rate_index = j;
-                                }
-                                break;
-                        }
-                }
-        }
+        ieee80211_get_rates(sband, elems.ext_supp_rates,
+                            elems.ext_supp_rates_len, &rates, &basic_rates,
+                            &have_higher_than_11mbit,
+                            &min_rate, &min_rate_index);
 
         /*
          * some buggy APs don't advertise basic_rates. use the lowest
@@ -1605,7 +1626,7 @@ static bool ieee80211_assoc_success(struct ieee80211_work *wk,
                 sdata->flags &= ~IEEE80211_SDATA_OPERATING_GMODE;
 
         if (elems.ht_cap_elem && !(ifmgd->flags & IEEE80211_STA_DISABLE_11N))
-                ieee80211_ht_cap_ie_to_sta_ht_cap(sband,
+                ieee80211_ht_cap_ie_to_sta_ht_cap(sdata, sband,
                                 elems.ht_cap_elem, &sta->sta.ht_cap);
 
         ap_ht_cap_flags = sta->sta.ht_cap.cap;
@@ -1974,7 +1995,7 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
 
                 sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
 
-                ieee80211_ht_cap_ie_to_sta_ht_cap(sband,
+                ieee80211_ht_cap_ie_to_sta_ht_cap(sdata, sband,
                                 elems.ht_cap_elem, &sta->sta.ht_cap);
 
                 ap_ht_cap_flags = sta->sta.ht_cap.cap;
@@ -2128,9 +2149,6 @@ static void ieee80211_sta_connection_lost(struct ieee80211_sub_if_data *sdata,
 
         ieee80211_set_disassoc(sdata, true, true);
         mutex_unlock(&ifmgd->mtx);
-        mutex_lock(&local->mtx);
-        ieee80211_recalc_idle(local);
-        mutex_unlock(&local->mtx);
         /*
          * must be outside lock due to cfg80211,
          * but that's not a problem.
@@ -2138,6 +2156,11 @@ static void ieee80211_sta_connection_lost(struct ieee80211_sub_if_data *sdata,
         ieee80211_send_deauth_disassoc(sdata, bssid,
                         IEEE80211_STYPE_DEAUTH, reason,
                         NULL, true);
+
+        mutex_lock(&local->mtx);
+        ieee80211_recalc_idle(local);
+        mutex_unlock(&local->mtx);
+
         mutex_lock(&ifmgd->mtx);
 }
 
@@ -2358,6 +2381,7 @@ void ieee80211_sta_setup_sdata(struct ieee80211_sub_if_data *sdata)
                     (unsigned long) sdata);
 
         ifmgd->flags = 0;
+        ifmgd->powersave = sdata->wdev.ps;
 
         mutex_init(&ifmgd->mtx);
 
@@ -2632,6 +2656,13 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
                         ifmgd->flags |= IEEE80211_STA_DISABLE_11N;
 
 
+        if (req->flags & ASSOC_REQ_DISABLE_HT)
+                ifmgd->flags |= IEEE80211_STA_DISABLE_11N;
+
+        memcpy(&ifmgd->ht_capa, &req->ht_capa, sizeof(ifmgd->ht_capa));
+        memcpy(&ifmgd->ht_capa_mask, &req->ht_capa_mask,
+               sizeof(ifmgd->ht_capa_mask));
+
         if (req->ie && req->ie_len) {
                 memcpy(wk->ie, req->ie, req->ie_len);
                 wk->ie_len = req->ie_len;
diff --git a/net/mac80211/offchannel.c b/net/mac80211/offchannel.c
index 3d414411a96e..f054e94901a2 100644
--- a/net/mac80211/offchannel.c
+++ b/net/mac80211/offchannel.c
@@ -138,31 +138,16 @@ void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local,
         mutex_unlock(&local->iflist_mtx);
 }
 
-void ieee80211_offchannel_enable_all_ps(struct ieee80211_local *local,
-                                        bool tell_ap)
-{
-        struct ieee80211_sub_if_data *sdata;
-
-        mutex_lock(&local->iflist_mtx);
-        list_for_each_entry(sdata, &local->interfaces, list) {
-                if (!ieee80211_sdata_running(sdata))
-                        continue;
-
-                if (sdata->vif.type == NL80211_IFTYPE_STATION &&
-                    sdata->u.mgd.associated)
-                        ieee80211_offchannel_ps_enable(sdata, tell_ap);
-        }
-        mutex_unlock(&local->iflist_mtx);
-}
-
 void ieee80211_offchannel_return(struct ieee80211_local *local,
-                                 bool enable_beaconing,
                                  bool offchannel_ps_disable)
 {
         struct ieee80211_sub_if_data *sdata;
 
         mutex_lock(&local->iflist_mtx);
         list_for_each_entry(sdata, &local->interfaces, list) {
+                if (sdata->vif.type != NL80211_IFTYPE_MONITOR)
+                        clear_bit(SDATA_STATE_OFFCHANNEL, &sdata->state);
+
                 if (!ieee80211_sdata_running(sdata))
                         continue;
 
@@ -174,7 +159,6 @@ void ieee80211_offchannel_return(struct ieee80211_local *local,
                 }
 
                 if (sdata->vif.type != NL80211_IFTYPE_MONITOR) {
-                        clear_bit(SDATA_STATE_OFFCHANNEL, &sdata->state);
                         /*
                          * This may wake up queues even though the driver
                          * currently has them stopped. This is not very
@@ -188,11 +172,9 @@ void ieee80211_offchannel_return(struct ieee80211_local *local,
                         netif_tx_wake_all_queues(sdata->dev);
                 }
 
-                /* Check to see if we should re-enable beaconing */
-                if (enable_beaconing &&
-                    (sdata->vif.type == NL80211_IFTYPE_AP ||
-                     sdata->vif.type == NL80211_IFTYPE_ADHOC ||
-                     sdata->vif.type == NL80211_IFTYPE_MESH_POINT))
+                if (sdata->vif.type == NL80211_IFTYPE_AP ||
+                    sdata->vif.type == NL80211_IFTYPE_ADHOC ||
+                    sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
                         ieee80211_bss_info_change_notify(
                                 sdata, BSS_CHANGED_BEACON_ENABLED);
         }
@@ -212,8 +194,6 @@ static void ieee80211_hw_roc_start(struct work_struct *work)
                 return;
         }
 
-        ieee80211_recalc_idle(local);
-
         if (local->hw_roc_skb) {
                 sdata = IEEE80211_DEV_TO_SUB_IF(local->hw_roc_dev);
                 ieee80211_tx_skb(sdata, local->hw_roc_skb);
@@ -227,6 +207,8 @@ static void ieee80211_hw_roc_start(struct work_struct *work)
                                           GFP_KERNEL);
         }
 
+        ieee80211_recalc_idle(local);
+
         mutex_unlock(&local->mtx);
 }
 
diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c
index 9ee7164b207c..596efaf50e09 100644
--- a/net/mac80211/pm.c
+++ b/net/mac80211/pm.c
@@ -125,7 +125,7 @@ int __ieee80211_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
                 ieee80211_bss_info_change_notify(sdata,
                         BSS_CHANGED_BEACON_ENABLED);
 
-                drv_remove_interface(local, &sdata->vif);
+                drv_remove_interface(local, sdata);
         }
 
         /* stop hardware - this must stop RX */
diff --git a/net/mac80211/rc80211_minstrel.c b/net/mac80211/rc80211_minstrel.c
index 58a89554b788..b39dda523f39 100644
--- a/net/mac80211/rc80211_minstrel.c
+++ b/net/mac80211/rc80211_minstrel.c
@@ -334,8 +334,8 @@ minstrel_get_rate(void *priv, struct ieee80211_sta *sta,
 
 
 static void
-calc_rate_durations(struct minstrel_sta_info *mi, struct ieee80211_local *local,
-                    struct minstrel_rate *d, struct ieee80211_rate *rate)
+calc_rate_durations(struct ieee80211_local *local, struct minstrel_rate *d,
+                    struct ieee80211_rate *rate)
 {
         int erp = !!(rate->flags & IEEE80211_RATE_ERP_G);
 
@@ -402,8 +402,7 @@ minstrel_rate_init(void *priv, struct ieee80211_supported_band *sband,
 
                 mr->rix = i;
                 mr->bitrate = sband->bitrates[i].bitrate / 5;
-                calc_rate_durations(mi, local, mr,
-                                &sband->bitrates[i]);
+                calc_rate_durations(local, mr, &sband->bitrates[i]);
 
                 /* calculate maximum number of retransmissions before
                  * fallback (based on maximum segment size) */
diff --git a/net/mac80211/rc80211_minstrel_ht.c b/net/mac80211/rc80211_minstrel_ht.c
index cdb28535716b..ff5f7b84e825 100644
--- a/net/mac80211/rc80211_minstrel_ht.c
+++ b/net/mac80211/rc80211_minstrel_ht.c
@@ -36,8 +36,17 @@
 /* Transmit duration for the raw data part of an average sized packet */
 #define MCS_DURATION(streams, sgi, bps) MCS_SYMBOL_TIME(sgi, MCS_NSYMS((streams) * (bps)))
 
+/*
+ * Define group sort order: HT40 -> SGI -> #streams
+ */
+#define GROUP_IDX(_streams, _sgi, _ht40)        \
+        MINSTREL_MAX_STREAMS * 2 * _ht40 +      \
+        MINSTREL_MAX_STREAMS * _sgi +           \
+        _streams - 1
+
 /* MCS rate information for an MCS group */
-#define MCS_GROUP(_streams, _sgi, _ht40) {                              \
+#define MCS_GROUP(_streams, _sgi, _ht40)                                \
+        [GROUP_IDX(_streams, _sgi, _ht40)] = {                          \
         .streams = _streams,                                            \
         .flags =                                                        \
                 (_sgi ? IEEE80211_TX_RC_SHORT_GI : 0) |                 \
@@ -58,6 +67,9 @@
  * To enable sufficiently targeted rate sampling, MCS rates are divided into
  * groups, based on the number of streams and flags (HT40, SGI) that they
  * use.
+ *
+ * Sortorder has to be fixed for GROUP_IDX macro to be applicable:
+ * HT40 -> SGI -> #streams
  */
 const struct mcs_group minstrel_mcs_groups[] = {
         MCS_GROUP(1, 0, 0),
@@ -102,21 +114,9 @@ minstrel_ewma(int old, int new, int weight)
 static int
 minstrel_ht_get_group_idx(struct ieee80211_tx_rate *rate)
 {
-        int streams = (rate->idx / MCS_GROUP_RATES) + 1;
-        u32 flags = IEEE80211_TX_RC_SHORT_GI | IEEE80211_TX_RC_40_MHZ_WIDTH;
-        int i;
-
-        for (i = 0; i < ARRAY_SIZE(minstrel_mcs_groups); i++) {
-                if (minstrel_mcs_groups[i].streams != streams)
-                        continue;
-                if (minstrel_mcs_groups[i].flags != (rate->flags & flags))
-                        continue;
-
-                return i;
-        }
-
-        WARN_ON(1);
-        return 0;
+        return GROUP_IDX((rate->idx / MCS_GROUP_RATES) + 1,
+                         !!(rate->flags & IEEE80211_TX_RC_SHORT_GI),
+                         !!(rate->flags & IEEE80211_TX_RC_40_MHZ_WIDTH));
 }
 
 static inline struct minstrel_rate_stats *
@@ -130,7 +130,7 @@ minstrel_get_ratestats(struct minstrel_ht_sta *mi, int index)
  * Recalculate success probabilities and counters for a rate using EWMA
  */
 static void
-minstrel_calc_rate_ewma(struct minstrel_priv *mp, struct minstrel_rate_stats *mr)
+minstrel_calc_rate_ewma(struct minstrel_rate_stats *mr)
 {
         if (unlikely(mr->attempts > 0)) {
                 mr->sample_skipped = 0;
@@ -156,8 +156,7 @@ minstrel_calc_rate_ewma(struct minstrel_priv *mp, struct minstrel_rate_stats *mr
  * the expected number of retransmissions and their expected length
  */
 static void
-minstrel_ht_calc_tp(struct minstrel_priv *mp, struct minstrel_ht_sta *mi,
-                    int group, int rate)
+minstrel_ht_calc_tp(struct minstrel_ht_sta *mi, int group, int rate)
 {
         struct minstrel_rate_stats *mr;
         unsigned int usecs;
@@ -226,8 +225,8 @@ minstrel_ht_update_stats(struct minstrel_priv *mp, struct minstrel_ht_sta *mi)
                         mr = &mg->rates[i];
                         mr->retry_updated = false;
                         index = MCS_GROUP_RATES * group + i;
-                        minstrel_calc_rate_ewma(mp, mr);
-                        minstrel_ht_calc_tp(mp, mi, group, i);
+                        minstrel_calc_rate_ewma(mr);
+                        minstrel_ht_calc_tp(mi, group, i);
 
                         if (!mr->cur_tp)
                                 continue;
@@ -300,10 +299,10 @@ minstrel_ht_update_stats(struct minstrel_priv *mp, struct minstrel_ht_sta *mi)
 static bool
 minstrel_ht_txstat_valid(struct ieee80211_tx_rate *rate)
 {
-        if (!rate->count)
+        if (rate->idx < 0)
                 return false;
 
-        if (rate->idx < 0)
+        if (!rate->count)
                 return false;
 
         return !!(rate->flags & IEEE80211_TX_RC_MCS);
@@ -357,7 +356,7 @@ minstrel_downgrade_rate(struct minstrel_ht_sta *mi, unsigned int *idx,
 }
 
 static void
-minstrel_aggr_check(struct minstrel_priv *mp, struct ieee80211_sta *pubsta, struct sk_buff *skb)
+minstrel_aggr_check(struct ieee80211_sta *pubsta, struct sk_buff *skb)
 {
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
         struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
@@ -455,7 +454,7 @@ minstrel_ht_tx_status(void *priv, struct ieee80211_supported_band *sband,
         if (time_after(jiffies, mi->stats_update + (mp->update_interval / 2 * HZ) / 1000)) {
                 minstrel_ht_update_stats(mp, mi);
                 if (!(info->flags & IEEE80211_TX_CTL_AMPDU))
-                        minstrel_aggr_check(mp, sta, skb);
+                        minstrel_aggr_check(sta, skb);
         }
 }
 
@@ -515,7 +514,6 @@ minstrel_calc_retransmit(struct minstrel_priv *mp, struct minstrel_ht_sta *mi,
 static void
 minstrel_ht_set_rate(struct minstrel_priv *mp, struct minstrel_ht_sta *mi,
                      struct ieee80211_tx_rate *rate, int index,
-                     struct ieee80211_tx_rate_control *txrc,
                      bool sample, bool rtscts)
 {
         const struct mcs_group *group = &minstrel_mcs_groups[index / MCS_GROUP_RATES];
@@ -628,11 +626,11 @@ minstrel_ht_get_rate(void *priv, struct ieee80211_sta *sta, void *priv_sta,
         if (sample_idx >= 0) {
                 sample = true;
                 minstrel_ht_set_rate(mp, mi, &ar[0], sample_idx,
-                        txrc, true, false);
+                        true, false);
                 info->flags |= IEEE80211_TX_CTL_RATE_CTRL_PROBE;
         } else {
                 minstrel_ht_set_rate(mp, mi, &ar[0], mi->max_tp_rate,
-                        txrc, false, false);
+                        false, false);
         }
 
         if (mp->hw->max_rates >= 3) {
@@ -643,13 +641,13 @@ minstrel_ht_get_rate(void *priv, struct ieee80211_sta *sta, void *priv_sta,
                  */
                 if (sample_idx >= 0)
                         minstrel_ht_set_rate(mp, mi, &ar[1], mi->max_tp_rate,
-                                txrc, false, false);
+                                false, false);
                 else
                         minstrel_ht_set_rate(mp, mi, &ar[1], mi->max_tp_rate2,
-                                txrc, false, true);
+                                false, true);
 
                 minstrel_ht_set_rate(mp, mi, &ar[2], mi->max_prob_rate,
-                                     txrc, false, !sample);
+                                     false, !sample);
 
                 ar[3].count = 0;
                 ar[3].idx = -1;
@@ -660,7 +658,7 @@ minstrel_ht_get_rate(void *priv, struct ieee80211_sta *sta, void *priv_sta,
                  * max_tp_rate -> max_prob_rate by default.
                  */
                 minstrel_ht_set_rate(mp, mi, &ar[1], mi->max_prob_rate,
-                                     txrc, false, !sample);
+                                     false, !sample);
 
                 ar[2].count = 0;
                 ar[2].idx = -1;
diff --git a/net/mac80211/rc80211_pid_algo.c b/net/mac80211/rc80211_pid_algo.c
index aeda65466f3e..502d3ecc4a79 100644
--- a/net/mac80211/rc80211_pid_algo.c
+++ b/net/mac80211/rc80211_pid_algo.c
@@ -318,7 +318,7 @@ rate_control_pid_rate_init(void *priv, struct ieee80211_supported_band *sband,
                         rinfo[i].diff = i * pinfo->norm_offset;
         }
         for (i = 1; i < sband->n_bitrates; i++) {
-                s = 0;
+                s = false;
                 for (j = 0; j < sband->n_bitrates - i; j++)
                         if (unlikely(sband->bitrates[rinfo[j].index].bitrate >
                                      sband->bitrates[rinfo[j + 1].index].bitrate)) {
@@ -327,7 +327,7 @@ rate_control_pid_rate_init(void *priv, struct ieee80211_supported_band *sband,
                                 rinfo[j + 1].index = tmp;
                                 rinfo[rinfo[j].index].rev_index = j;
                                 rinfo[rinfo[j + 1].index].rev_index = j + 1;
-                                s = 1;
+                                s = true;
                         }
                 if (!s)
                         break;
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index fb123e2e081a..f407427c642f 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -28,6 +28,7 @@
 #include "wpa.h"
 #include "tkip.h"
 #include "wme.h"
+#include "rate.h"
 
 /*
  * monitor mode reception
@@ -748,10 +749,11 @@ static void ieee80211_rx_reorder_ampdu(struct ieee80211_rx_data *rx)
         struct ieee80211_local *local = rx->local;
         struct ieee80211_hw *hw = &local->hw;
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
+        struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
         struct sta_info *sta = rx->sta;
         struct tid_ampdu_rx *tid_agg_rx;
         u16 sc;
-        int tid;
+        u8 tid, ack_policy;
 
         if (!ieee80211_is_data_qos(hdr->frame_control))
                 goto dont_reorder;
@@ -764,6 +766,8 @@ static void ieee80211_rx_reorder_ampdu(struct ieee80211_rx_data *rx)
         if (!sta)
                 goto dont_reorder;
 
+        ack_policy = *ieee80211_get_qos_ctl(hdr) &
+                     IEEE80211_QOS_CTL_ACK_POLICY_MASK;
         tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK;
 
         tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
@@ -774,6 +778,15 @@ static void ieee80211_rx_reorder_ampdu(struct ieee80211_rx_data *rx)
         if (unlikely(hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_NULLFUNC)))
                 goto dont_reorder;
 
+        /* not part of a BA session */
+        if (ack_policy != IEEE80211_QOS_CTL_ACK_POLICY_BLOCKACK &&
+            ack_policy != IEEE80211_QOS_CTL_ACK_POLICY_NORMAL)
+                goto dont_reorder;
+
+        /* not actually part of this BA session */
+        if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
+                goto dont_reorder;
+
         /* new, potentially un-ordered, ampdu frame - process it */
 
         /* reset session timer */
@@ -858,6 +871,13 @@ ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
                             rx->sdata->control_port_protocol)
                                 return RX_CONTINUE;
                 }
+
+                if (rx->sdata->vif.type == NL80211_IFTYPE_AP &&
+                    cfg80211_rx_spurious_frame(rx->sdata->dev,
+                                               hdr->addr2,
+                                               GFP_ATOMIC))
+                        return RX_DROP_UNUSABLE;
+
                 return RX_DROP_MONITOR;
         }
 
@@ -1327,15 +1347,20 @@ ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
 
                 /*
                  * If we receive a 4-addr nullfunc frame from a STA
-                 * that was not moved to a 4-addr STA vlan yet, drop
-                 * the frame to the monitor interface, to make sure
-                 * that hostapd sees it
+                 * that was not moved to a 4-addr STA vlan yet send
+                 * the event to userspace and for older hostapd drop
+                 * the frame to the monitor interface.
                  */
                 if (ieee80211_has_a4(hdr->frame_control) &&
                     (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
                      (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
-                      !rx->sdata->u.vlan.sta)))
+                      !rx->sdata->u.vlan.sta))) {
+                        if (!test_and_set_sta_flag(sta, WLAN_STA_4ADDR_EVENT))
+                                cfg80211_rx_unexpected_4addr_frame(
+                                        rx->sdata->dev, sta->sta.addr,
+                                        GFP_ATOMIC);
                         return RX_DROP_MONITOR;
+                }
                 /*
                  * Update counter and free packet here to avoid
                  * counting this as a dropped packed.
@@ -1551,25 +1576,6 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
         return RX_CONTINUE;
 }
 
-static ieee80211_rx_result debug_noinline
-ieee80211_rx_h_remove_qos_control(struct ieee80211_rx_data *rx)
-{
-        u8 *data = rx->skb->data;
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)data;
-
-        if (!ieee80211_is_data_qos(hdr->frame_control))
-                return RX_CONTINUE;
-
-        /* remove the qos control field, update frame type and meta-data */
-        memmove(data + IEEE80211_QOS_CTL_LEN, data,
-                ieee80211_hdrlen(hdr->frame_control) - IEEE80211_QOS_CTL_LEN);
-        hdr = (struct ieee80211_hdr *)skb_pull(rx->skb, IEEE80211_QOS_CTL_LEN);
-        /* change frame type to non QOS */
-        hdr->frame_control &= ~cpu_to_le16(IEEE80211_STYPE_QOS_DATA);
-
-        return RX_CONTINUE;
-}
-
 static int
 ieee80211_802_1x_port_control(struct ieee80211_rx_data *rx)
 {
@@ -1802,7 +1808,12 @@ ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
         }
 
         if (xmit_skb) {
-                /* send to wireless media */
+                /*
+                 * Send to wireless media and increase priority by 256 to
+                 * keep the received priority instead of reclassifying
+                 * the frame (see cfg80211_classify8021d).
+                 */
+                xmit_skb->priority += 256;
                 xmit_skb->protocol = htons(ETH_P_802_3);
                 skb_reset_network_header(xmit_skb);
                 skb_reset_mac_header(xmit_skb);
@@ -1871,13 +1882,16 @@ ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
 static ieee80211_rx_result
 ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
 {
-        struct ieee80211_hdr *hdr;
+        struct ieee80211_hdr *fwd_hdr, *hdr;
+        struct ieee80211_tx_info *info;
         struct ieee80211s_hdr *mesh_hdr;
-        unsigned int hdrlen;
         struct sk_buff *skb = rx->skb, *fwd_skb;
         struct ieee80211_local *local = rx->local;
         struct ieee80211_sub_if_data *sdata = rx->sdata;
         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
+        struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
+        __le16 reason = cpu_to_le16(WLAN_REASON_MESH_PATH_NOFORWARD);
+        u16 q, hdrlen;
 
         hdr = (struct ieee80211_hdr *) skb->data;
         hdrlen = ieee80211_hdrlen(hdr->frame_control);
@@ -1893,14 +1907,7 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
                 return RX_CONTINUE;
 
         if (!mesh_hdr->ttl)
-                /* illegal frame */
-                return RX_DROP_MONITOR;
-
-        if (ieee80211_queue_stopped(&local->hw, skb_get_queue_mapping(skb))) {
-                IEEE80211_IFSTA_MESH_CTR_INC(&sdata->u.mesh,
-                                                dropped_frames_congestion);
                 return RX_DROP_MONITOR;
-        }
 
         if (mesh_hdr->flags & MESH_FLAGS_AE) {
                 struct mesh_path *mppath;
@@ -1933,60 +1940,50 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
             compare_ether_addr(sdata->vif.addr, hdr->addr3) == 0)
                 return RX_CONTINUE;
 
-        mesh_hdr->ttl--;
+        q = ieee80211_select_queue_80211(local, skb, hdr);
+        if (ieee80211_queue_stopped(&local->hw, q)) {
+                IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_congestion);
+                return RX_DROP_MONITOR;
+        }
+        skb_set_queue_mapping(skb, q);
 
-        if (status->rx_flags & IEEE80211_RX_RA_MATCH) {
-                if (!mesh_hdr->ttl)
-                        IEEE80211_IFSTA_MESH_CTR_INC(&rx->sdata->u.mesh,
-                                                     dropped_frames_ttl);
-                else {
-                        struct ieee80211_hdr *fwd_hdr;
-                        struct ieee80211_tx_info *info;
-
-                        fwd_skb = skb_copy(skb, GFP_ATOMIC);
-
-                        if (!fwd_skb && net_ratelimit())
-                                printk(KERN_DEBUG "%s: failed to clone mesh frame\n",
-                                                   sdata->name);
-                        if (!fwd_skb)
-                                goto out;
-
-                        fwd_hdr =  (struct ieee80211_hdr *) fwd_skb->data;
-                        memcpy(fwd_hdr->addr2, sdata->vif.addr, ETH_ALEN);
-                        info = IEEE80211_SKB_CB(fwd_skb);
-                        memset(info, 0, sizeof(*info));
-                        info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
-                        info->control.vif = &rx->sdata->vif;
-                        if (is_multicast_ether_addr(fwd_hdr->addr1)) {
-                                IEEE80211_IFSTA_MESH_CTR_INC(&sdata->u.mesh,
-                                                                fwded_mcast);
-                                skb_set_queue_mapping(fwd_skb,
-                                        ieee80211_select_queue(sdata, fwd_skb));
-                                ieee80211_set_qos_hdr(sdata, fwd_skb);
-                        } else {
-                                int err;
-                                /*
-                                 * Save TA to addr1 to send TA a path error if a
-                                 * suitable next hop is not found
-                                 */
-                                memcpy(fwd_hdr->addr1, fwd_hdr->addr2,
-                                                ETH_ALEN);
-                                err = mesh_nexthop_lookup(fwd_skb, sdata);
-                                /* Failed to immediately resolve next hop:
-                                 * fwded frame was dropped or will be added
-                                 * later to the pending skb queue.  */
-                                if (err)
-                                        return RX_DROP_MONITOR;
-
-                                IEEE80211_IFSTA_MESH_CTR_INC(&sdata->u.mesh,
-                                                                fwded_unicast);
-                        }
-                        IEEE80211_IFSTA_MESH_CTR_INC(&sdata->u.mesh,
-                                                     fwded_frames);
-                        ieee80211_add_pending_skb(local, fwd_skb);
-                }
+        if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
+                goto out;
+
+        if (!--mesh_hdr->ttl) {
+                IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_ttl);
+                return RX_DROP_MONITOR;
+        }
+
+        fwd_skb = skb_copy(skb, GFP_ATOMIC);
+        if (!fwd_skb) {
+                if (net_ratelimit())
+                        printk(KERN_DEBUG "%s: failed to clone mesh frame\n",
+                                        sdata->name);
+                goto out;
         }
 
+        fwd_hdr =  (struct ieee80211_hdr *) fwd_skb->data;
+        info = IEEE80211_SKB_CB(fwd_skb);
+        memset(info, 0, sizeof(*info));
+        info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
+        info->control.vif = &rx->sdata->vif;
+        info->control.jiffies = jiffies;
+        if (is_multicast_ether_addr(fwd_hdr->addr1)) {
+                IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_mcast);
+                memcpy(fwd_hdr->addr2, sdata->vif.addr, ETH_ALEN);
+        } else if (!mesh_nexthop_lookup(fwd_skb, sdata)) {
+                IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_unicast);
+        } else {
+                /* unable to resolve next hop */
+                mesh_path_error_tx(ifmsh->mshcfg.element_ttl, fwd_hdr->addr3,
+                                    0, reason, fwd_hdr->addr2, sdata);
+                IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_no_route);
+                return RX_DROP_MONITOR;
+        }
+
+        IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_frames);
+        ieee80211_add_pending_skb(local, fwd_skb);
  out:
         if (is_multicast_ether_addr(hdr->addr1) ||
             sdata->dev->flags & IFF_PROMISC)
@@ -2014,12 +2011,17 @@ ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
                 return RX_DROP_MONITOR;
 
         /*
-         * Allow the cooked monitor interface of an AP to see 4-addr frames so
-         * that a 4-addr station can be detected and moved into a separate VLAN
+         * Send unexpected-4addr-frame event to hostapd. For older versions,
+         * also drop the frame to cooked monitor interfaces.
          */
         if (ieee80211_has_a4(hdr->frame_control) &&
-            sdata->vif.type == NL80211_IFTYPE_AP)
+            sdata->vif.type == NL80211_IFTYPE_AP) {
+                if (rx->sta &&
+                    !test_and_set_sta_flag(rx->sta, WLAN_STA_4ADDR_EVENT))
+                        cfg80211_rx_unexpected_4addr_frame(
+                                rx->sdata->dev, rx->sta->sta.addr, GFP_ATOMIC);
                 return RX_DROP_MONITOR;
+        }
 
         err = __ieee80211_data_to_8023(rx, &port_control);
         if (unlikely(err))
@@ -2174,6 +2176,18 @@ ieee80211_rx_h_mgmt_check(struct ieee80211_rx_data *rx)
         if (!ieee80211_is_mgmt(mgmt->frame_control))
                 return RX_DROP_MONITOR;
 
+        if (rx->sdata->vif.type == NL80211_IFTYPE_AP &&
+            ieee80211_is_beacon(mgmt->frame_control) &&
+            !(rx->flags & IEEE80211_RX_BEACON_REPORTED)) {
+                struct ieee80211_rx_status *status;
+
+                status = IEEE80211_SKB_RXCB(rx->skb);
+                cfg80211_report_obss_beacon(rx->local->hw.wiphy,
+                                            rx->skb->data, rx->skb->len,
+                                            status->freq, GFP_ATOMIC);
+                rx->flags |= IEEE80211_RX_BEACON_REPORTED;
+        }
+
         if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
                 return RX_DROP_MONITOR;
 
@@ -2206,16 +2220,69 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
                 return RX_DROP_UNUSABLE;
 
         switch (mgmt->u.action.category) {
+        case WLAN_CATEGORY_HT:
+                /* reject HT action frames from stations not supporting HT */
+                if (!rx->sta->sta.ht_cap.ht_supported)
+                        goto invalid;
+
+                if (sdata->vif.type != NL80211_IFTYPE_STATION &&
+                    sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
+                    sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
+                    sdata->vif.type != NL80211_IFTYPE_AP &&
+                    sdata->vif.type != NL80211_IFTYPE_ADHOC)
+                        break;
+
+                /* verify action & smps_control are present */
+                if (len < IEEE80211_MIN_ACTION_SIZE + 2)
+                        goto invalid;
+
+                switch (mgmt->u.action.u.ht_smps.action) {
+                case WLAN_HT_ACTION_SMPS: {
+                        struct ieee80211_supported_band *sband;
+                        u8 smps;
+
+                        /* convert to HT capability */
+                        switch (mgmt->u.action.u.ht_smps.smps_control) {
+                        case WLAN_HT_SMPS_CONTROL_DISABLED:
+                                smps = WLAN_HT_CAP_SM_PS_DISABLED;
+                                break;
+                        case WLAN_HT_SMPS_CONTROL_STATIC:
+                                smps = WLAN_HT_CAP_SM_PS_STATIC;
+                                break;
+                        case WLAN_HT_SMPS_CONTROL_DYNAMIC:
+                                smps = WLAN_HT_CAP_SM_PS_DYNAMIC;
+                                break;
+                        default:
+                                goto invalid;
+                        }
+                        smps <<= IEEE80211_HT_CAP_SM_PS_SHIFT;
+
+                        /* if no change do nothing */
+                        if ((rx->sta->sta.ht_cap.cap &
+                                        IEEE80211_HT_CAP_SM_PS) == smps)
+                                goto handled;
+
+                        rx->sta->sta.ht_cap.cap &= ~IEEE80211_HT_CAP_SM_PS;
+                        rx->sta->sta.ht_cap.cap |= smps;
+
+                        sband = rx->local->hw.wiphy->bands[status->band];
+
+                        rate_control_rate_update(local, sband, rx->sta,
+                                                 IEEE80211_RC_SMPS_CHANGED,
+                                                 local->_oper_channel_type);
+                        goto handled;
+                }
+                default:
+                        goto invalid;
+                }
+
+                break;
         case WLAN_CATEGORY_BACK:
-                /*
-                 * The aggregation code is not prepared to handle
-                 * anything but STA/AP due to the BSSID handling;
-                 * IBSS could work in the code but isn't supported
-                 * by drivers or the standard.
-                 */
                 if (sdata->vif.type != NL80211_IFTYPE_STATION &&
+                    sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
                     sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
-                    sdata->vif.type != NL80211_IFTYPE_AP)
+                    sdata->vif.type != NL80211_IFTYPE_AP &&
+                    sdata->vif.type != NL80211_IFTYPE_ADHOC)
                         break;
 
                 /* verify action_code is present */
@@ -2493,6 +2560,10 @@ static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx,
                 goto out_free_skb;
         rx->flags |= IEEE80211_RX_CMNTR;
 
+        /* If there are no cooked monitor interfaces, just free the SKB */
+        if (!local->cooked_mntrs)
+                goto out_free_skb;
+
         if (skb_headroom(skb) < sizeof(*rthdr) &&
             pskb_expand_head(skb, sizeof(*rthdr), 0, GFP_ATOMIC))
                 goto out_free_skb;
@@ -2628,7 +2699,6 @@ static void ieee80211_rx_handlers(struct ieee80211_rx_data *rx)
                 if (ieee80211_vif_is_mesh(&rx->sdata->vif))
                         CALL_RXH(ieee80211_rx_h_mesh_fwding);
 #endif
-                CALL_RXH(ieee80211_rx_h_remove_qos_control)
                 CALL_RXH(ieee80211_rx_h_amsdu)
                 CALL_RXH(ieee80211_rx_h_data)
                 CALL_RXH(ieee80211_rx_h_ctrl);
@@ -2748,8 +2818,8 @@ static int prepare_for_handlers(struct ieee80211_rx_data *rx,
                                 rate_idx = 0; /* TODO: HT rates */
                         else
                                 rate_idx = status->rate_idx;
-                        rx->sta = ieee80211_ibss_add_sta(sdata, bssid,
-                                        hdr->addr2, BIT(rate_idx), GFP_ATOMIC);
+                        ieee80211_ibss_rx_no_sta(sdata, bssid, hdr->addr2,
+                                                 BIT(rate_idx));
                 }
                 break;
         case NL80211_IFTYPE_MESH_POINT:
@@ -2770,10 +2840,17 @@ static int prepare_for_handlers(struct ieee80211_rx_data *rx,
                                 return 0;
                 } else if (!ieee80211_bssid_match(bssid,
                                         sdata->vif.addr)) {
+                        /*
+                         * Accept public action frames even when the
+                         * BSSID doesn't match, this is used for P2P
+                         * and location updates. Note that mac80211
+                         * itself never looks at these frames.
+                         */
+                        if (!(status->rx_flags & IEEE80211_RX_IN_SCAN) &&
+                            ieee80211_is_public_action(hdr, skb->len))
+                                return 1;
                         if (!(status->rx_flags & IEEE80211_RX_IN_SCAN) &&
-                            !ieee80211_is_beacon(hdr->frame_control) &&
-                            !(ieee80211_is_action(hdr->frame_control) &&
-                              sdata->vif.p2p))
+                            !ieee80211_is_beacon(hdr->frame_control))
                                 return 0;
                         status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
                 }
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index 105436dbb90d..9270771702fe 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -106,7 +106,7 @@ ieee80211_bss_info_update(struct ieee80211_local *local,
         /* save the ERP value so that it is available at association time */
         if (elems->erp_info && elems->erp_info_len >= 1) {
                 bss->erp_value = elems->erp_info[0];
-                bss->has_erp_value = 1;
+                bss->has_erp_value = true;
         }
 
         if (elems->tim) {
@@ -213,12 +213,7 @@ ieee80211_scan_rx(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb)
         if (bss)
                 ieee80211_rx_bss_put(sdata->local, bss);
 
-        /* If we are on-operating-channel, and this packet is for the
-         * current channel, pass the pkt on up the stack so that
-         * the rest of the stack can make use of it.
-         */
-        if (ieee80211_cfg_on_oper_channel(sdata->local)
-            && (channel == sdata->local->oper_channel))
+        if (channel == sdata->local->oper_channel)
                 return RX_CONTINUE;
 
         dev_kfree_skb(skb);
@@ -264,8 +259,6 @@ static void __ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted,
                                        bool was_hw_scan)
 {
         struct ieee80211_local *local = hw_to_local(hw);
-        bool on_oper_chan;
-        bool enable_beacons = false;
 
         lockdep_assert_held(&local->mtx);
 
@@ -298,25 +291,13 @@ static void __ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted,
         local->scanning = 0;
         local->scan_channel = NULL;
 
-        on_oper_chan = ieee80211_cfg_on_oper_channel(local);
-
-        if (was_hw_scan || !on_oper_chan)
-                ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);
-        else
-                /* Set power back to normal operating levels. */
-                ieee80211_hw_config(local, 0);
+        /* Set power back to normal operating levels. */
+        ieee80211_hw_config(local, 0);
 
         if (!was_hw_scan) {
-                bool on_oper_chan2;
                 ieee80211_configure_filter(local);
                 drv_sw_scan_complete(local);
-                on_oper_chan2 = ieee80211_cfg_on_oper_channel(local);
-                /* We should always be on-channel at this point. */
-                WARN_ON(!on_oper_chan2);
-                if (on_oper_chan2 && (on_oper_chan != on_oper_chan2))
-                        enable_beacons = true;
-
-                ieee80211_offchannel_return(local, enable_beacons, true);
+                ieee80211_offchannel_return(local, true);
         }
 
         ieee80211_recalc_idle(local);
@@ -361,11 +342,7 @@ static int ieee80211_start_sw_scan(struct ieee80211_local *local)
         local->next_scan_state = SCAN_DECISION;
         local->scan_channel_idx = 0;
 
-        /* We always want to use off-channel PS, even if we
-         * are not really leaving oper-channel.  Don't
-         * tell the AP though, as long as we are on-channel.
-         */
-        ieee80211_offchannel_enable_all_ps(local, false);
+        ieee80211_offchannel_stop_vifs(local, true);
 
         ieee80211_configure_filter(local);
 
@@ -373,8 +350,7 @@ static int ieee80211_start_sw_scan(struct ieee80211_local *local)
         ieee80211_hw_config(local, 0);
 
         ieee80211_queue_delayed_work(&local->hw,
-                                     &local->scan_work,
-                                     IEEE80211_CHANNEL_TIME);
+                                     &local->scan_work, 0);
 
         return 0;
 }
@@ -510,96 +486,39 @@ static void ieee80211_scan_state_decision(struct ieee80211_local *local,
 
         next_chan = local->scan_req->channels[local->scan_channel_idx];
 
-        if (ieee80211_cfg_on_oper_channel(local)) {
-                /* We're currently on operating channel. */
-                if (next_chan == local->oper_channel)
-                        /* We don't need to move off of operating channel. */
-                        local->next_scan_state = SCAN_SET_CHANNEL;
-                else
-                        /*
-                         * We do need to leave operating channel, as next
-                         * scan is somewhere else.
-                         */
-                        local->next_scan_state = SCAN_LEAVE_OPER_CHANNEL;
-        } else {
-                /*
-                 * we're currently scanning a different channel, let's
-                 * see if we can scan another channel without interfering
-                 * with the current traffic situation.
-                 *
-                 * Since we don't know if the AP has pending frames for us
-                 * we can only check for our tx queues and use the current
-                 * pm_qos requirements for rx. Hence, if no tx traffic occurs
-                 * at all we will scan as many channels in a row as the pm_qos
-                 * latency allows us to. Additionally we also check for the
-                 * currently negotiated listen interval to prevent losing
-                 * frames unnecessarily.
-                 *
-                 * Otherwise switch back to the operating channel.
-                 */
-
-                bad_latency = time_after(jiffies +
-                                ieee80211_scan_get_channel_time(next_chan),
-                                local->leave_oper_channel_time +
-                                usecs_to_jiffies(pm_qos_request(PM_QOS_NETWORK_LATENCY)));
-
-                listen_int_exceeded = time_after(jiffies +
-                                ieee80211_scan_get_channel_time(next_chan),
-                                local->leave_oper_channel_time +
-                                usecs_to_jiffies(min_beacon_int * 1024) *
-                                local->hw.conf.listen_interval);
-
-                if (associated && ( !tx_empty || bad_latency ||
-                    listen_int_exceeded))
-                        local->next_scan_state = SCAN_ENTER_OPER_CHANNEL;
-                else
-                        local->next_scan_state = SCAN_SET_CHANNEL;
-        }
-
-        *next_delay = 0;
-}
-
-static void ieee80211_scan_state_leave_oper_channel(struct ieee80211_local *local,
-                                                    unsigned long *next_delay)
-{
-        /* PS will already be in off-channel mode,
-         * we do that once at the beginning of scanning.
-         */
-        ieee80211_offchannel_stop_vifs(local, false);
-
         /*
-         * What if the nullfunc frames didn't arrive?
+         * we're currently scanning a different channel, let's
+         * see if we can scan another channel without interfering
+         * with the current traffic situation.
+         *
+         * Since we don't know if the AP has pending frames for us
+         * we can only check for our tx queues and use the current
+         * pm_qos requirements for rx. Hence, if no tx traffic occurs
+         * at all we will scan as many channels in a row as the pm_qos
+         * latency allows us to. Additionally we also check for the
+         * currently negotiated listen interval to prevent losing
+         * frames unnecessarily.
+         *
+         * Otherwise switch back to the operating channel.
          */
-        drv_flush(local, false);
-        if (local->ops->flush)
-                *next_delay = 0;
-        else
-                *next_delay = HZ / 10;
 
-        /* remember when we left the operating channel */
-        local->leave_oper_channel_time = jiffies;
+        bad_latency = time_after(jiffies +
+                        ieee80211_scan_get_channel_time(next_chan),
+                        local->leave_oper_channel_time +
+                        usecs_to_jiffies(pm_qos_request(PM_QOS_NETWORK_LATENCY)));
 
-        /* advance to the next channel to be scanned */
-        local->next_scan_state = SCAN_SET_CHANNEL;
-}
-
-static void ieee80211_scan_state_enter_oper_channel(struct ieee80211_local *local,
-                                                    unsigned long *next_delay)
-{
-        /* switch back to the operating channel */
-        local->scan_channel = NULL;
-        if (!ieee80211_cfg_on_oper_channel(local))
-                ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);
+        listen_int_exceeded = time_after(jiffies +
+                        ieee80211_scan_get_channel_time(next_chan),
+                        local->leave_oper_channel_time +
+                        usecs_to_jiffies(min_beacon_int * 1024) *
+                        local->hw.conf.listen_interval);
 
-        /*
-         * Re-enable vifs and beaconing.  Leave PS
-         * in off-channel state..will put that back
-         * on-channel at the end of scanning.
-         */
-        ieee80211_offchannel_return(local, true, false);
+        if (associated && (!tx_empty || bad_latency || listen_int_exceeded))
+                local->next_scan_state = SCAN_SUSPEND;
+        else
+                local->next_scan_state = SCAN_SET_CHANNEL;
 
-        *next_delay = HZ / 5;
-        local->next_scan_state = SCAN_DECISION;
+        *next_delay = 0;
 }
 
 static void ieee80211_scan_state_set_channel(struct ieee80211_local *local,
@@ -613,10 +532,8 @@ static void ieee80211_scan_state_set_channel(struct ieee80211_local *local,
 
         local->scan_channel = chan;
 
-        /* Only call hw-config if we really need to change channels. */
-        if (chan != local->hw.conf.channel)
-                if (ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL))
-                        skip = 1;
+        if (ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL))
+                skip = 1;
 
         /* advance state machine to next channel/band */
         local->scan_channel_idx++;
@@ -673,6 +590,44 @@ static void ieee80211_scan_state_send_probe(struct ieee80211_local *local,
         local->next_scan_state = SCAN_DECISION;
 }
 
+static void ieee80211_scan_state_suspend(struct ieee80211_local *local,
+                                         unsigned long *next_delay)
+{
+        /* switch back to the operating channel */
+        local->scan_channel = NULL;
+        ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);
+
+        /*
+         * Re-enable vifs and beaconing.  Leave PS
+         * in off-channel state..will put that back
+         * on-channel at the end of scanning.
+         */
+        ieee80211_offchannel_return(local, false);
+
+        *next_delay = HZ / 5;
+        /* afterwards, resume scan & go to next channel */
+        local->next_scan_state = SCAN_RESUME;
+}
+
+static void ieee80211_scan_state_resume(struct ieee80211_local *local,
+                                        unsigned long *next_delay)
+{
+        /* PS already is in off-channel mode */
+        ieee80211_offchannel_stop_vifs(local, false);
+
+        if (local->ops->flush) {
+                drv_flush(local, false);
+                *next_delay = 0;
+        } else
+                *next_delay = HZ / 10;
+
+        /* remember when we left the operating channel */
+        local->leave_oper_channel_time = jiffies;
+
+        /* advance to the next channel to be scanned */
+        local->next_scan_state = SCAN_SET_CHANNEL;
+}
+
 void ieee80211_scan_work(struct work_struct *work)
 {
         struct ieee80211_local *local =
@@ -743,11 +698,11 @@ void ieee80211_scan_work(struct work_struct *work)
                 case SCAN_SEND_PROBE:
                         ieee80211_scan_state_send_probe(local, &next_delay);
                         break;
-                case SCAN_LEAVE_OPER_CHANNEL:
-                        ieee80211_scan_state_leave_oper_channel(local, &next_delay);
+                case SCAN_SUSPEND:
+                        ieee80211_scan_state_suspend(local, &next_delay);
                         break;
-                case SCAN_ENTER_OPER_CHANNEL:
-                        ieee80211_scan_state_enter_oper_channel(local, &next_delay);
+                case SCAN_RESUME:
+                        ieee80211_scan_state_resume(local, &next_delay);
                         break;
                 }
         } while (next_delay == 0);
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index 8eaa746ec7a2..b197136aea2c 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -62,14 +62,14 @@
  * freed before they are done using it.
  */
 
-/* Caller must hold local->sta_lock */
+/* Caller must hold local->sta_mtx */
 static int sta_info_hash_del(struct ieee80211_local *local,
                              struct sta_info *sta)
 {
         struct sta_info *s;
 
         s = rcu_dereference_protected(local->sta_hash[STA_HASH(sta->sta.addr)],
-                                      lockdep_is_held(&local->sta_lock));
+                                      lockdep_is_held(&local->sta_mtx));
         if (!s)
                 return -ENOENT;
         if (s == sta) {
@@ -81,7 +81,7 @@ static int sta_info_hash_del(struct ieee80211_local *local,
         while (rcu_access_pointer(s->hnext) &&
                rcu_access_pointer(s->hnext) != sta)
                 s = rcu_dereference_protected(s->hnext,
-                                        lockdep_is_held(&local->sta_lock));
+                                        lockdep_is_held(&local->sta_mtx));
         if (rcu_access_pointer(s->hnext)) {
                 RCU_INIT_POINTER(s->hnext, sta->hnext);
                 return 0;
@@ -98,14 +98,12 @@ struct sta_info *sta_info_get(struct ieee80211_sub_if_data *sdata,
         struct sta_info *sta;
 
         sta = rcu_dereference_check(local->sta_hash[STA_HASH(addr)],
-                                    lockdep_is_held(&local->sta_lock) ||
                                     lockdep_is_held(&local->sta_mtx));
         while (sta) {
                 if (sta->sdata == sdata && !sta->dummy &&
                     memcmp(sta->sta.addr, addr, ETH_ALEN) == 0)
                         break;
                 sta = rcu_dereference_check(sta->hnext,
-                                            lockdep_is_held(&local->sta_lock) ||
                                             lockdep_is_held(&local->sta_mtx));
         }
         return sta;
@@ -119,14 +117,12 @@ struct sta_info *sta_info_get_rx(struct ieee80211_sub_if_data *sdata,
         struct sta_info *sta;
 
         sta = rcu_dereference_check(local->sta_hash[STA_HASH(addr)],
-                                    lockdep_is_held(&local->sta_lock) ||
                                     lockdep_is_held(&local->sta_mtx));
         while (sta) {
                 if (sta->sdata == sdata &&
                     memcmp(sta->sta.addr, addr, ETH_ALEN) == 0)
                         break;
                 sta = rcu_dereference_check(sta->hnext,
-                                            lockdep_is_held(&local->sta_lock) ||
                                             lockdep_is_held(&local->sta_mtx));
         }
         return sta;
@@ -143,7 +139,6 @@ struct sta_info *sta_info_get_bss(struct ieee80211_sub_if_data *sdata,
         struct sta_info *sta;
 
         sta = rcu_dereference_check(local->sta_hash[STA_HASH(addr)],
-                                    lockdep_is_held(&local->sta_lock) ||
                                     lockdep_is_held(&local->sta_mtx));
         while (sta) {
                 if ((sta->sdata == sdata ||
@@ -152,7 +147,6 @@ struct sta_info *sta_info_get_bss(struct ieee80211_sub_if_data *sdata,
                     memcmp(sta->sta.addr, addr, ETH_ALEN) == 0)
                         break;
                 sta = rcu_dereference_check(sta->hnext,
-                                            lockdep_is_held(&local->sta_lock) ||
                                             lockdep_is_held(&local->sta_mtx));
         }
         return sta;
@@ -169,7 +163,6 @@ struct sta_info *sta_info_get_bss_rx(struct ieee80211_sub_if_data *sdata,
         struct sta_info *sta;
 
         sta = rcu_dereference_check(local->sta_hash[STA_HASH(addr)],
-                                    lockdep_is_held(&local->sta_lock) ||
                                     lockdep_is_held(&local->sta_mtx));
         while (sta) {
                 if ((sta->sdata == sdata ||
@@ -177,7 +170,6 @@ struct sta_info *sta_info_get_bss_rx(struct ieee80211_sub_if_data *sdata,
                     memcmp(sta->sta.addr, addr, ETH_ALEN) == 0)
                         break;
                 sta = rcu_dereference_check(sta->hnext,
-                                            lockdep_is_held(&local->sta_lock) ||
                                             lockdep_is_held(&local->sta_mtx));
         }
         return sta;
@@ -204,16 +196,17 @@ struct sta_info *sta_info_get_by_idx(struct ieee80211_sub_if_data *sdata,
 }
 
 /**
- * __sta_info_free - internal STA free helper
+ * sta_info_free - free STA
  *
  * @local: pointer to the global information
  * @sta: STA info to free
  *
  * This function must undo everything done by sta_info_alloc()
- * that may happen before sta_info_insert().
+ * that may happen before sta_info_insert(). It may only be
+ * called when sta_info_insert() has not been attempted (and
+ * if that fails, the station is freed anyway.)
  */
-static void __sta_info_free(struct ieee80211_local *local,
-                            struct sta_info *sta)
+void sta_info_free(struct ieee80211_local *local, struct sta_info *sta)
 {
         if (sta->rate_ctrl) {
                 rate_control_free_sta(sta);
@@ -227,10 +220,11 @@ static void __sta_info_free(struct ieee80211_local *local,
         kfree(sta);
 }
 
-/* Caller must hold local->sta_lock */
+/* Caller must hold local->sta_mtx */
 static void sta_info_hash_add(struct ieee80211_local *local,
                               struct sta_info *sta)
 {
+        lockdep_assert_held(&local->sta_mtx);
         sta->hnext = local->sta_hash[STA_HASH(sta->sta.addr)];
         RCU_INIT_POINTER(local->sta_hash[STA_HASH(sta->sta.addr)], sta);
 }
@@ -280,7 +274,7 @@ static int sta_prepare_rate_control(struct ieee80211_local *local,
 }
 
 struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
-                                u8 *addr, gfp_t gfp)
+                                const u8 *addr, gfp_t gfp)
 {
         struct ieee80211_local *local = sdata->local;
         struct sta_info *sta;
@@ -338,102 +332,6 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
         return sta;
 }
 
-static int sta_info_finish_insert(struct sta_info *sta,
-                                bool async, bool dummy_reinsert)
-{
-        struct ieee80211_local *local = sta->local;
-        struct ieee80211_sub_if_data *sdata = sta->sdata;
-        struct station_info sinfo;
-        unsigned long flags;
-        int err = 0;
-
-        lockdep_assert_held(&local->sta_mtx);
-
-        if (!sta->dummy || dummy_reinsert) {
-                /* notify driver */
-                if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
-                        sdata = container_of(sdata->bss,
-                                             struct ieee80211_sub_if_data,
-                                             u.ap);
-                err = drv_sta_add(local, sdata, &sta->sta);
-                if (err) {
-                        if (!async)
-                                return err;
-                        printk(KERN_DEBUG "%s: failed to add IBSS STA %pM to "
-                                          "driver (%d) - keeping it anyway.\n",
-                               sdata->name, sta->sta.addr, err);
-                } else {
-                        sta->uploaded = true;
-#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
-                        if (async)
-                                wiphy_debug(local->hw.wiphy,
-                                            "Finished adding IBSS STA %pM\n",
-                                            sta->sta.addr);
-#endif
-                }
-
-                sdata = sta->sdata;
-        }
-
-        if (!dummy_reinsert) {
-                if (!async) {
-                        local->num_sta++;
-                        local->sta_generation++;
-                        smp_mb();
-
-                        /* make the station visible */
-                        spin_lock_irqsave(&local->sta_lock, flags);
-                        sta_info_hash_add(local, sta);
-                        spin_unlock_irqrestore(&local->sta_lock, flags);
-                }
-
-                list_add(&sta->list, &local->sta_list);
-        } else {
-                sta->dummy = false;
-        }
-
-        if (!sta->dummy) {
-                ieee80211_sta_debugfs_add(sta);
-                rate_control_add_sta_debugfs(sta);
-
-                memset(&sinfo, 0, sizeof(sinfo));
-                sinfo.filled = 0;
-                sinfo.generation = local->sta_generation;
-                cfg80211_new_sta(sdata->dev, sta->sta.addr, &sinfo, GFP_KERNEL);
-        }
-
-        return 0;
-}
-
-static void sta_info_finish_pending(struct ieee80211_local *local)
-{
-        struct sta_info *sta;
-        unsigned long flags;
-
-        spin_lock_irqsave(&local->sta_lock, flags);
-        while (!list_empty(&local->sta_pending_list)) {
-                sta = list_first_entry(&local->sta_pending_list,
-                                       struct sta_info, list);
-                list_del(&sta->list);
-                spin_unlock_irqrestore(&local->sta_lock, flags);
-
-                sta_info_finish_insert(sta, true, false);
-
-                spin_lock_irqsave(&local->sta_lock, flags);
-        }
-        spin_unlock_irqrestore(&local->sta_lock, flags);
-}
-
-static void sta_info_finish_work(struct work_struct *work)
-{
-        struct ieee80211_local *local =
-                container_of(work, struct ieee80211_local, sta_finish_work);
-
-        mutex_lock(&local->sta_mtx);
-        sta_info_finish_pending(local);
-        mutex_unlock(&local->sta_mtx);
-}
-
 static int sta_info_insert_check(struct sta_info *sta)
 {
         struct ieee80211_sub_if_data *sdata = sta->sdata;
@@ -453,50 +351,15 @@ static int sta_info_insert_check(struct sta_info *sta)
         return 0;
 }
 
-static int sta_info_insert_ibss(struct sta_info *sta) __acquires(RCU)
-{
-        struct ieee80211_local *local = sta->local;
-        struct ieee80211_sub_if_data *sdata = sta->sdata;
-        unsigned long flags;
-
-        spin_lock_irqsave(&local->sta_lock, flags);
-        /* check if STA exists already */
-        if (sta_info_get_bss_rx(sdata, sta->sta.addr)) {
-                spin_unlock_irqrestore(&local->sta_lock, flags);
-                rcu_read_lock();
-                return -EEXIST;
-        }
-
-        local->num_sta++;
-        local->sta_generation++;
-        smp_mb();
-        sta_info_hash_add(local, sta);
-
-        list_add_tail(&sta->list, &local->sta_pending_list);
-
-        rcu_read_lock();
-        spin_unlock_irqrestore(&local->sta_lock, flags);
-
-#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
-        wiphy_debug(local->hw.wiphy, "Added IBSS STA %pM\n",
-                        sta->sta.addr);
-#endif /* CONFIG_MAC80211_VERBOSE_DEBUG */
-
-        ieee80211_queue_work(&local->hw, &local->sta_finish_work);
-
-        return 0;
-}
-
 /*
  * should be called with sta_mtx locked
  * this function replaces the mutex lock
  * with a RCU lock
  */
-static int sta_info_insert_non_ibss(struct sta_info *sta) __acquires(RCU)
+static int sta_info_insert_finish(struct sta_info *sta) __acquires(RCU)
 {
         struct ieee80211_local *local = sta->local;
         struct ieee80211_sub_if_data *sdata = sta->sdata;
-        unsigned long flags;
         struct sta_info *exist_sta;
         bool dummy_reinsert = false;
         int err = 0;
@@ -504,19 +367,8 @@ static int sta_info_insert_non_ibss(struct sta_info *sta) __acquires(RCU)
         lockdep_assert_held(&local->sta_mtx);
 
         /*
-         * On first glance, this will look racy, because the code
-         * in this function, which inserts a station with sleeping,
-         * unlocks the sta_lock between checking existence in the
-         * hash table and inserting into it.
-         *
-         * However, it is not racy against itself because it keeps
-         * the mutex locked.
-         */
-
-        spin_lock_irqsave(&local->sta_lock, flags);
-        /*
          * check if STA exists already.
-         * only accept a scenario of a second call to sta_info_insert_non_ibss
+         * only accept a scenario of a second call to sta_info_insert_finish
          * with a dummy station entry that was inserted earlier
          * in that case - assume that the dummy station flag should
          * be removed.
@@ -526,20 +378,47 @@ static int sta_info_insert_non_ibss(struct sta_info *sta) __acquires(RCU)
                 if (exist_sta == sta && sta->dummy) {
                         dummy_reinsert = true;
                 } else {
-                        spin_unlock_irqrestore(&local->sta_lock, flags);
-                        mutex_unlock(&local->sta_mtx);
-                        rcu_read_lock();
-                        return -EEXIST;
+                        err = -EEXIST;
+                        goto out_err;
                 }
         }
 
-        spin_unlock_irqrestore(&local->sta_lock, flags);
+        if (!sta->dummy || dummy_reinsert) {
+                /* notify driver */
+                err = drv_sta_add(local, sdata, &sta->sta);
+                if (err) {
+                        if (sdata->vif.type != NL80211_IFTYPE_ADHOC)
+                                goto out_err;
+                        printk(KERN_DEBUG "%s: failed to add IBSS STA %pM to "
+                                          "driver (%d) - keeping it anyway.\n",
+                               sdata->name, sta->sta.addr, err);
+                } else
+                        sta->uploaded = true;
+        }
 
-        err = sta_info_finish_insert(sta, false, dummy_reinsert);
-        if (err) {
-                mutex_unlock(&local->sta_mtx);
-                rcu_read_lock();
-                return err;
+        if (!dummy_reinsert) {
+                local->num_sta++;
+                local->sta_generation++;
+                smp_mb();
+
+                /* make the station visible */
+                sta_info_hash_add(local, sta);
+
+                list_add(&sta->list, &local->sta_list);
+        } else {
+                sta->dummy = false;
+        }
+
+        if (!sta->dummy) {
+                struct station_info sinfo;
+
+                ieee80211_sta_debugfs_add(sta);
+                rate_control_add_sta_debugfs(sta);
+
+                memset(&sinfo, 0, sizeof(sinfo));
+                sinfo.filled = 0;
+                sinfo.generation = local->sta_generation;
+                cfg80211_new_sta(sdata->dev, sta->sta.addr, &sinfo, GFP_KERNEL);
         }
 
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
@@ -555,54 +434,35 @@ static int sta_info_insert_non_ibss(struct sta_info *sta) __acquires(RCU)
                 mesh_accept_plinks_update(sdata);
 
         return 0;
+ out_err:
+        mutex_unlock(&local->sta_mtx);
+        rcu_read_lock();
+        return err;
 }
 
 int sta_info_insert_rcu(struct sta_info *sta) __acquires(RCU)
 {
         struct ieee80211_local *local = sta->local;
-        struct ieee80211_sub_if_data *sdata = sta->sdata;
         int err = 0;
 
+        might_sleep();
+
         err = sta_info_insert_check(sta);
         if (err) {
                 rcu_read_lock();
                 goto out_free;
         }
 
-        /*
-         * In ad-hoc mode, we sometimes need to insert stations
-         * from tasklet context from the RX path. To avoid races,
-         * always do so in that case -- see the comment below.
-         */
-        if (sdata->vif.type == NL80211_IFTYPE_ADHOC) {
-                err = sta_info_insert_ibss(sta);
-                if (err)
-                        goto out_free;
-
-                return 0;
-        }
-
-        /*
-         * It might seem that the function called below is in race against
-         * the function call above that atomically inserts the station... That,
-         * however, is not true because the above code can only
-         * be invoked for IBSS interfaces, and the below code will
-         * not be -- and the two do not race against each other as
-         * the hash table also keys off the interface.
-         */
-
-        might_sleep();
-
         mutex_lock(&local->sta_mtx);
 
-        err = sta_info_insert_non_ibss(sta);
+        err = sta_info_insert_finish(sta);
         if (err)
                 goto out_free;
 
         return 0;
  out_free:
         BUG_ON(!err);
-        __sta_info_free(local, sta);
+        sta_info_free(local, sta);
         return err;
 }
 
@@ -629,7 +489,7 @@ int sta_info_reinsert(struct sta_info *sta)
 
         might_sleep();
 
-        err = sta_info_insert_non_ibss(sta);
+        err = sta_info_insert_finish(sta);
         rcu_read_unlock();
         return err;
 }
@@ -716,7 +576,7 @@ void sta_info_recalc_tim(struct sta_info *sta)
         }
 
  done:
-        spin_lock_irqsave(&local->sta_lock, flags);
+        spin_lock_irqsave(&local->tim_lock, flags);
 
         if (indicate_tim)
                 __bss_tim_set(bss, sta->sta.aid);
@@ -729,7 +589,7 @@ void sta_info_recalc_tim(struct sta_info *sta)
                 local->tim_in_locked_section = false;
         }
 
-        spin_unlock_irqrestore(&local->sta_lock, flags);
+        spin_unlock_irqrestore(&local->tim_lock, flags);
 }
 
 static bool sta_info_buffer_expired(struct sta_info *sta, struct sk_buff *skb)
@@ -853,8 +713,8 @@ static int __must_check __sta_info_destroy(struct sta_info *sta)
 {
         struct ieee80211_local *local;
         struct ieee80211_sub_if_data *sdata;
-        unsigned long flags;
         int ret, i, ac;
+        struct tid_ampdu_tx *tid_tx;
 
         might_sleep();
 
@@ -873,15 +733,12 @@ static int __must_check __sta_info_destroy(struct sta_info *sta)
         set_sta_flag(sta, WLAN_STA_BLOCK_BA);
         ieee80211_sta_tear_down_BA_sessions(sta, true);
 
-        spin_lock_irqsave(&local->sta_lock, flags);
         ret = sta_info_hash_del(local, sta);
-        /* this might still be the pending list ... which is fine */
-        if (!ret)
-                list_del(&sta->list);
-        spin_unlock_irqrestore(&local->sta_lock, flags);
         if (ret)
                 return ret;
 
+        list_del(&sta->list);
+
         mutex_lock(&local->key_mtx);
         for (i = 0; i < NUM_DEFAULT_KEYS; i++)
                 __ieee80211_key_free(key_mtx_dereference(local, sta->gtk[i]));
@@ -908,6 +765,9 @@ static int __must_check __sta_info_destroy(struct sta_info *sta)
         if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
                 RCU_INIT_POINTER(sdata->u.vlan.sta, NULL);
 
+        while (sta->sta_state > IEEE80211_STA_NONE)
+                sta_info_move_state(sta, sta->sta_state - 1);
+
         if (sta->uploaded) {
                 if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
                         sdata = container_of(sdata->bss,
@@ -953,7 +813,36 @@ static int __must_check __sta_info_destroy(struct sta_info *sta)
         }
 #endif
 
-        __sta_info_free(local, sta);
+        /* There could be some memory leaks because of ampdu tx pending queue
+         * not being freed before destroying the station info.
+         *
+         * Make sure that such queues are purged before freeing the station
+         * info.
+         * TODO: We have to somehow postpone the full destruction
+         * until the aggregation stop completes. Refer
+         * http://thread.gmane.org/gmane.linux.kernel.wireless.general/81936
+         */
+
+        mutex_lock(&sta->ampdu_mlme.mtx);
+
+        for (i = 0; i < STA_TID_NUM; i++) {
+                tid_tx = rcu_dereference_protected_tid_tx(sta, i);
+                if (!tid_tx)
+                        continue;
+                if (skb_queue_len(&tid_tx->pending)) {
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                        wiphy_debug(local->hw.wiphy, "TX A-MPDU  purging %d "
+                                "packets for tid=%d\n",
+                                skb_queue_len(&tid_tx->pending), i);
+#endif /* CONFIG_MAC80211_HT_DEBUG */
+                        __skb_queue_purge(&tid_tx->pending);
+                }
+                kfree_rcu(tid_tx, rcu_head);
+        }
+
+        mutex_unlock(&sta->ampdu_mlme.mtx);
+
+        sta_info_free(local, sta);
 
         return 0;
 }
@@ -1009,11 +898,9 @@ static void sta_info_cleanup(unsigned long data)
 
 void sta_info_init(struct ieee80211_local *local)
 {
-        spin_lock_init(&local->sta_lock);
+        spin_lock_init(&local->tim_lock);
         mutex_init(&local->sta_mtx);
         INIT_LIST_HEAD(&local->sta_list);
-        INIT_LIST_HEAD(&local->sta_pending_list);
-        INIT_WORK(&local->sta_finish_work, sta_info_finish_work);
 
         setup_timer(&local->sta_cleanup, sta_info_cleanup,
                     (unsigned long)local);
@@ -1042,9 +929,6 @@ int sta_info_flush(struct ieee80211_local *local,
         might_sleep();
 
         mutex_lock(&local->sta_mtx);
-
-        sta_info_finish_pending(local);
-
         list_for_each_entry_safe(sta, tmp, &local->sta_list, list) {
                 if (!sdata || sdata == sta->sdata)
                         WARN_ON(__sta_info_destroy(sta));
@@ -1061,7 +945,11 @@ void ieee80211_sta_expire(struct ieee80211_sub_if_data *sdata,
         struct sta_info *sta, *tmp;
 
         mutex_lock(&local->sta_mtx);
-        list_for_each_entry_safe(sta, tmp, &local->sta_list, list)
+
+        list_for_each_entry_safe(sta, tmp, &local->sta_list, list) {
+                if (sdata != sta->sdata)
+                        continue;
+
                 if (time_after(jiffies, sta->last_rx + exp_time)) {
 #ifdef CONFIG_MAC80211_IBSS_DEBUG
                         printk(KERN_DEBUG "%s: expiring inactive STA %pM\n",
@@ -1069,6 +957,8 @@ void ieee80211_sta_expire(struct ieee80211_sub_if_data *sdata,
 #endif
                         WARN_ON(__sta_info_destroy(sta));
                 }
+        }
+
         mutex_unlock(&local->sta_mtx);
 }
 
@@ -1517,3 +1407,56 @@ void ieee80211_sta_set_buffered(struct ieee80211_sta *pubsta,
         sta_info_recalc_tim(sta);
 }
 EXPORT_SYMBOL(ieee80211_sta_set_buffered);
+
+int sta_info_move_state_checked(struct sta_info *sta,
+                                enum ieee80211_sta_state new_state)
+{
+        might_sleep();
+
+        if (sta->sta_state == new_state)
+                return 0;
+
+        switch (new_state) {
+        case IEEE80211_STA_NONE:
+                if (sta->sta_state == IEEE80211_STA_AUTH)
+                        clear_bit(WLAN_STA_AUTH, &sta->_flags);
+                else
+                        return -EINVAL;
+                break;
+        case IEEE80211_STA_AUTH:
+                if (sta->sta_state == IEEE80211_STA_NONE)
+                        set_bit(WLAN_STA_AUTH, &sta->_flags);
+                else if (sta->sta_state == IEEE80211_STA_ASSOC)
+                        clear_bit(WLAN_STA_ASSOC, &sta->_flags);
+                else
+                        return -EINVAL;
+                break;
+        case IEEE80211_STA_ASSOC:
+                if (sta->sta_state == IEEE80211_STA_AUTH) {
+                        set_bit(WLAN_STA_ASSOC, &sta->_flags);
+                } else if (sta->sta_state == IEEE80211_STA_AUTHORIZED) {
+                        if (sta->sdata->vif.type == NL80211_IFTYPE_AP)
+                                atomic_dec(&sta->sdata->u.ap.num_sta_authorized);
+                        clear_bit(WLAN_STA_AUTHORIZED, &sta->_flags);
+                } else
+                        return -EINVAL;
+                break;
+        case IEEE80211_STA_AUTHORIZED:
+                if (sta->sta_state == IEEE80211_STA_ASSOC) {
+                        if (sta->sdata->vif.type == NL80211_IFTYPE_AP)
+                                atomic_inc(&sta->sdata->u.ap.num_sta_authorized);
+                        set_bit(WLAN_STA_AUTHORIZED, &sta->_flags);
+                } else
+                        return -EINVAL;
+                break;
+        default:
+                WARN(1, "invalid state %d", new_state);
+                return -EINVAL;
+        }
+
+        printk(KERN_DEBUG "%s: moving STA %pM to state %d\n",
+                sta->sdata->name, sta->sta.addr, new_state);
+        sta->sta_state = new_state;
+
+        return 0;
+}
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index 8c8ce05ad26f..6f77f12dc3fc 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -30,7 +30,6 @@
  *      when virtual port control is not in use.
  * @WLAN_STA_SHORT_PREAMBLE: Station is capable of receiving short-preamble
  *      frames.
- * @WLAN_STA_ASSOC_AP: We're associated to that station, it is an AP.
  * @WLAN_STA_WME: Station is a QoS-STA.
  * @WLAN_STA_WDS: Station is one of our WDS peers.
  * @WLAN_STA_CLEAR_PS_FILT: Clear PS filter in hardware (using the
@@ -52,6 +51,7 @@
  *      unblocks the station.
  * @WLAN_STA_SP: Station is in a service period, so don't try to
  *      reply to other uAPSD trigger frames or PS-Poll.
+ * @WLAN_STA_4ADDR_EVENT: 4-addr event was already sent for this frame.
  */
 enum ieee80211_sta_info_flags {
         WLAN_STA_AUTH,
@@ -59,7 +59,6 @@ enum ieee80211_sta_info_flags {
         WLAN_STA_PS_STA,
         WLAN_STA_AUTHORIZED,
         WLAN_STA_SHORT_PREAMBLE,
-        WLAN_STA_ASSOC_AP,
         WLAN_STA_WME,
         WLAN_STA_WDS,
         WLAN_STA_CLEAR_PS_FILT,
@@ -71,11 +70,22 @@ enum ieee80211_sta_info_flags {
         WLAN_STA_TDLS_PEER_AUTH,
         WLAN_STA_UAPSD,
         WLAN_STA_SP,
+        WLAN_STA_4ADDR_EVENT,
+};
+
+enum ieee80211_sta_state {
+        /* NOTE: These need to be ordered correctly! */
+        IEEE80211_STA_NONE,
+        IEEE80211_STA_AUTH,
+        IEEE80211_STA_ASSOC,
+        IEEE80211_STA_AUTHORIZED,
 };
 
 #define STA_TID_NUM 16
 #define ADDBA_RESP_INTERVAL HZ
-#define HT_AGG_MAX_RETRIES              0x3
+#define HT_AGG_MAX_RETRIES              15
+#define HT_AGG_BURST_RETRIES            3
+#define HT_AGG_RETRIES_PERIOD           (15 * HZ)
 
 #define HT_AGG_STATE_DRV_READY          0
 #define HT_AGG_STATE_RESPONSE_RECEIVED  1
@@ -88,6 +98,7 @@ enum ieee80211_sta_info_flags {
  * struct tid_ampdu_tx - TID aggregation information (Tx).
  *
  * @rcu_head: rcu head for freeing structure
+ * @session_timer: check if we keep Tx-ing on the TID (by timeout value)
  * @addba_resp_timer: timer for peer's response to addba request
  * @pending: pending frames queue -- use sta's spinlock to protect
  * @dialog_token: dialog token for aggregation session
@@ -110,6 +121,7 @@ enum ieee80211_sta_info_flags {
  */
 struct tid_ampdu_tx {
         struct rcu_head rcu_head;
+        struct timer_list session_timer;
         struct timer_list addba_resp_timer;
         struct sk_buff_head pending;
         unsigned long state;
@@ -169,6 +181,7 @@ struct tid_ampdu_rx {
  * @tid_tx: aggregation info for Tx per TID
  * @tid_start_tx: sessions where start was requested
  * @addba_req_num: number of times addBA request has been sent.
+ * @last_addba_req_time: timestamp of the last addBA request.
  * @dialog_token_allocator: dialog token enumerator for each new session;
  * @work: work struct for starting/stopping aggregation
  * @tid_rx_timer_expired: bitmap indicating on which TIDs the
@@ -188,6 +201,7 @@ struct sta_ampdu_mlme {
         struct work_struct work;
         struct tid_ampdu_tx __rcu *tid_tx[STA_TID_NUM];
         struct tid_ampdu_tx *tid_start_tx[STA_TID_NUM];
+        unsigned long last_addba_req_time[STA_TID_NUM];
         u8 addba_req_num[STA_TID_NUM];
         u8 dialog_token_allocator;
 };
@@ -260,6 +274,8 @@ struct sta_ampdu_mlme {
  * @dummy: indicate a dummy station created for receiving
  *      EAP frames before association
  * @sta: station information we share with the driver
+ * @sta_state: duplicates information about station state (for debug)
+ * @beacon_loss_count: number of times beacon loss has triggered
  */
 struct sta_info {
         /* General information, mostly static */
@@ -281,6 +297,8 @@ struct sta_info {
 
         bool uploaded;
 
+        enum ieee80211_sta_state sta_state;
+
         /* use the accessors defined below */
         unsigned long _flags;
 
@@ -350,6 +368,7 @@ struct sta_info {
 #endif
 
         unsigned int lost_packets;
+        unsigned int beacon_loss_count;
 
         /* should be right in front of sta to be in the same cache line */
         bool dummy;
@@ -369,12 +388,18 @@ static inline enum nl80211_plink_state sta_plink_state(struct sta_info *sta)
 static inline void set_sta_flag(struct sta_info *sta,
                                 enum ieee80211_sta_info_flags flag)
 {
+        WARN_ON(flag == WLAN_STA_AUTH ||
+                flag == WLAN_STA_ASSOC ||
+                flag == WLAN_STA_AUTHORIZED);
         set_bit(flag, &sta->_flags);
 }
 
 static inline void clear_sta_flag(struct sta_info *sta,
                                   enum ieee80211_sta_info_flags flag)
 {
+        WARN_ON(flag == WLAN_STA_AUTH ||
+                flag == WLAN_STA_ASSOC ||
+                flag == WLAN_STA_AUTHORIZED);
         clear_bit(flag, &sta->_flags);
 }
 
@@ -387,9 +412,32 @@ static inline int test_sta_flag(struct sta_info *sta,
 static inline int test_and_clear_sta_flag(struct sta_info *sta,
                                           enum ieee80211_sta_info_flags flag)
 {
+        WARN_ON(flag == WLAN_STA_AUTH ||
+                flag == WLAN_STA_ASSOC ||
+                flag == WLAN_STA_AUTHORIZED);
         return test_and_clear_bit(flag, &sta->_flags);
 }
 
+static inline int test_and_set_sta_flag(struct sta_info *sta,
+                                        enum ieee80211_sta_info_flags flag)
+{
+        WARN_ON(flag == WLAN_STA_AUTH ||
+                flag == WLAN_STA_ASSOC ||
+                flag == WLAN_STA_AUTHORIZED);
+        return test_and_set_bit(flag, &sta->_flags);
+}
+
+int sta_info_move_state_checked(struct sta_info *sta,
+                                enum ieee80211_sta_state new_state);
+
+static inline void sta_info_move_state(struct sta_info *sta,
+                                       enum ieee80211_sta_state new_state)
+{
+        int ret = sta_info_move_state_checked(sta, new_state);
+        WARN_ON_ONCE(ret);
+}
+
+
 void ieee80211_assign_tid_tx(struct sta_info *sta, int tid,
                              struct tid_ampdu_tx *tid_tx);
 
@@ -480,7 +528,10 @@ struct sta_info *sta_info_get_by_idx(struct ieee80211_sub_if_data *sdata,
  * until sta_info_insert().
  */
 struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
-                                u8 *addr, gfp_t gfp);
+                                const u8 *addr, gfp_t gfp);
+
+void sta_info_free(struct ieee80211_local *local, struct sta_info *sta);
+
 /*
  * Insert STA info into hash table/list, returns zero or a
  * -EEXIST if (if the same MAC address is already present).
@@ -491,7 +542,6 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
  */
 int sta_info_insert(struct sta_info *sta);
 int sta_info_insert_rcu(struct sta_info *sta) __acquires(RCU);
-int sta_info_insert_atomic(struct sta_info *sta);
 int sta_info_reinsert(struct sta_info *sta);
 
 int sta_info_destroy_addr(struct ieee80211_sub_if_data *sdata,
diff --git a/net/mac80211/status.c b/net/mac80211/status.c
index 16518f386117..30c265c98f73 100644
--- a/net/mac80211/status.c
+++ b/net/mac80211/status.c
@@ -340,7 +340,6 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
         struct ieee80211_local *local = hw_to_local(hw);
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-        u16 frag, type;
         __le16 fc;
         struct ieee80211_supported_band *sband;
         struct ieee80211_sub_if_data *sdata;
@@ -476,12 +475,8 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
          * Fragments are passed to low-level drivers as separate skbs, so these
          * are actually fragments, not frames. Update frame counters only for
          * the first fragment of the frame. */
-
-        frag = le16_to_cpu(hdr->seq_ctrl) & IEEE80211_SCTL_FRAG;
-        type = le16_to_cpu(hdr->frame_control) & IEEE80211_FCTL_FTYPE;
-
         if (info->flags & IEEE80211_TX_STAT_ACK) {
-                if (frag == 0) {
+                if (ieee80211_is_first_frag(hdr->seq_ctrl)) {
                         local->dot11TransmittedFrameCount++;
                         if (is_multicast_ether_addr(hdr->addr1))
                                 local->dot11MulticastTransmittedFrameCount++;
@@ -496,11 +491,11 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
                  * with a multicast address in the address 1 field of type Data
                  * or Management. */
                 if (!is_multicast_ether_addr(hdr->addr1) ||
-                    type == IEEE80211_FTYPE_DATA ||
-                    type == IEEE80211_FTYPE_MGMT)
+                    ieee80211_is_data(fc) ||
+                    ieee80211_is_mgmt(fc))
                         local->dot11TransmittedFragmentCount++;
         } else {
-                if (frag == 0)
+                if (ieee80211_is_first_frag(hdr->seq_ctrl))
                         local->dot11FailedCount++;
         }
 
@@ -517,27 +512,54 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
         }
 
         if (info->flags & IEEE80211_TX_INTFL_NL80211_FRAME_TX) {
-                struct ieee80211_work *wk;
                 u64 cookie = (unsigned long)skb;
 
-                rcu_read_lock();
-                list_for_each_entry_rcu(wk, &local->work_list, list) {
-                        if (wk->type != IEEE80211_WORK_OFFCHANNEL_TX)
-                                continue;
-                        if (wk->offchan_tx.frame != skb)
-                                continue;
-                        wk->offchan_tx.status = true;
-                        break;
-                }
-                rcu_read_unlock();
-                if (local->hw_roc_skb_for_status == skb) {
-                        cookie = local->hw_roc_cookie ^ 2;
-                        local->hw_roc_skb_for_status = NULL;
+                if (ieee80211_is_nullfunc(hdr->frame_control) ||
+                    ieee80211_is_qos_nullfunc(hdr->frame_control)) {
+                        bool acked = info->flags & IEEE80211_TX_STAT_ACK;
+                        cfg80211_probe_status(skb->dev, hdr->addr1,
+                                              cookie, acked, GFP_ATOMIC);
+                } else {
+                        struct ieee80211_work *wk;
+
+                        rcu_read_lock();
+                        list_for_each_entry_rcu(wk, &local->work_list, list) {
+                                if (wk->type != IEEE80211_WORK_OFFCHANNEL_TX)
+                                        continue;
+                                if (wk->offchan_tx.frame != skb)
+                                        continue;
+                                wk->offchan_tx.status = true;
+                                break;
+                        }
+                        rcu_read_unlock();
+                        if (local->hw_roc_skb_for_status == skb) {
+                                cookie = local->hw_roc_cookie ^ 2;
+                                local->hw_roc_skb_for_status = NULL;
+                        }
+
+                        cfg80211_mgmt_tx_status(
+                                skb->dev, cookie, skb->data, skb->len,
+                                !!(info->flags & IEEE80211_TX_STAT_ACK),
+                                GFP_ATOMIC);
                 }
+        }
 
-                cfg80211_mgmt_tx_status(
-                        skb->dev, cookie, skb->data, skb->len,
-                        !!(info->flags & IEEE80211_TX_STAT_ACK), GFP_ATOMIC);
+        if (unlikely(info->ack_frame_id)) {
+                struct sk_buff *ack_skb;
+                unsigned long flags;
+
+                spin_lock_irqsave(&local->ack_status_lock, flags);
+                ack_skb = idr_find(&local->ack_status_frames,
+                                   info->ack_frame_id);
+                if (ack_skb)
+                        idr_remove(&local->ack_status_frames,
+                                   info->ack_frame_id);
+                spin_unlock_irqrestore(&local->ack_status_lock, flags);
+
+                /* consumes ack_skb */
+                if (ack_skb)
+                        skb_complete_wifi_ack(ack_skb,
+                                info->flags & IEEE80211_TX_STAT_ACK);
         }
 
         /* this was a transmitted frame, but now we want to reuse it */
@@ -545,7 +567,7 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
 
         /* Need to make a copy before skb->cb gets cleared */
         send_to_cooked = !!(info->flags & IEEE80211_TX_CTL_INJECTED) ||
-                        (type != IEEE80211_FTYPE_DATA);
+                         !(ieee80211_is_data(fc));
 
         /*
          * This is a bit racy but we can avoid a lot of work
@@ -610,3 +632,29 @@ void ieee80211_report_low_ack(struct ieee80211_sta *pubsta, u32 num_packets)
                                     num_packets, GFP_ATOMIC);
 }
 EXPORT_SYMBOL(ieee80211_report_low_ack);
+
+void ieee80211_free_txskb(struct ieee80211_hw *hw, struct sk_buff *skb)
+{
+        struct ieee80211_local *local = hw_to_local(hw);
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+
+        if (unlikely(info->ack_frame_id)) {
+                struct sk_buff *ack_skb;
+                unsigned long flags;
+
+                spin_lock_irqsave(&local->ack_status_lock, flags);
+                ack_skb = idr_find(&local->ack_status_frames,
+                                   info->ack_frame_id);
+                if (ack_skb)
+                        idr_remove(&local->ack_status_frames,
+                                   info->ack_frame_id);
+                spin_unlock_irqrestore(&local->ack_status_lock, flags);
+
+                /* consumes ack_skb */
+                if (ack_skb)
+                        dev_kfree_skb_any(ack_skb);
+        }
+
+        dev_kfree_skb_any(skb);
+}
+EXPORT_SYMBOL(ieee80211_free_txskb);
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 1f8b120146d1..edcd1c7ab83f 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -36,7 +36,8 @@
 
 /* misc utils */
 
-static __le16 ieee80211_duration(struct ieee80211_tx_data *tx, int group_addr,
+static __le16 ieee80211_duration(struct ieee80211_tx_data *tx,
+                                 struct sk_buff *skb, int group_addr,
                                  int next_frag_len)
 {
         int rate, mrate, erp, dur, i;
@@ -44,7 +45,7 @@ static __le16 ieee80211_duration(struct ieee80211_tx_data *tx, int group_addr,
         struct ieee80211_local *local = tx->local;
         struct ieee80211_supported_band *sband;
         struct ieee80211_hdr *hdr;
-        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 
         /* assume HW handles this */
         if (info->control.rates[0].flags & IEEE80211_TX_RC_MCS)
@@ -76,7 +77,7 @@ static __le16 ieee80211_duration(struct ieee80211_tx_data *tx, int group_addr,
          *   at the highest possible rate belonging to the PHY rates in the
          *   BSSBasicRateSet
          */
-        hdr = (struct ieee80211_hdr *)tx->skb->data;
+        hdr = (struct ieee80211_hdr *)skb->data;
         if (ieee80211_is_ctl(hdr->frame_control)) {
                 /* TODO: These control frames are not currently sent by
                  * mac80211, but should they be implemented, this function
@@ -150,11 +151,15 @@ static __le16 ieee80211_duration(struct ieee80211_tx_data *tx, int group_addr,
                 rate = mrate;
         }
 
-        /* Time needed to transmit ACK
-         * (10 bytes + 4-byte FCS = 112 bits) plus SIFS; rounded up
-         * to closest integer */
-
-        dur = ieee80211_frame_duration(local, 10, rate, erp,
+        /* Don't calculate ACKs for QoS Frames with NoAck Policy set */
+        if (ieee80211_is_data_qos(hdr->frame_control) &&
+            *(ieee80211_get_qos_ctl(hdr)) | IEEE80211_QOS_CTL_ACK_POLICY_NOACK)
+                dur = 0;
+        else
+                /* Time needed to transmit ACK
+                 * (10 bytes + 4-byte FCS = 112 bits) plus SIFS; rounded up
+                 * to closest integer */
+                dur = ieee80211_frame_duration(local, 10, rate, erp,
                                 tx->sdata->vif.bss_conf.use_short_preamble);
 
         if (next_frag_len) {
@@ -290,7 +295,6 @@ ieee80211_tx_h_check_assoc(struct ieee80211_tx_data *tx)
 
         if (likely(tx->flags & IEEE80211_TX_UNICAST)) {
                 if (unlikely(!assoc &&
-                             tx->sdata->vif.type != NL80211_IFTYPE_ADHOC &&
                              ieee80211_is_data(hdr->frame_control))) {
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
                         printk(KERN_DEBUG "%s: dropped data frame to not "
@@ -300,17 +304,14 @@ ieee80211_tx_h_check_assoc(struct ieee80211_tx_data *tx)
                         I802_DEBUG_INC(tx->local->tx_handlers_drop_not_assoc);
                         return TX_DROP;
                 }
-        } else {
-                if (unlikely(ieee80211_is_data(hdr->frame_control) &&
-                             tx->local->num_sta == 0 &&
-                             tx->sdata->vif.type != NL80211_IFTYPE_ADHOC)) {
-                        /*
-                         * No associated STAs - no need to send multicast
-                         * frames.
-                         */
-                        return TX_DROP;
-                }
-                return TX_CONTINUE;
+        } else if (unlikely(tx->sdata->vif.type == NL80211_IFTYPE_AP &&
+                            ieee80211_is_data(hdr->frame_control) &&
+                            !atomic_read(&tx->sdata->u.ap.num_sta_authorized))) {
+                /*
+                 * No associated STAs - no need to send multicast
+                 * frames.
+                 */
+                return TX_DROP;
         }
 
         return TX_CONTINUE;
@@ -572,8 +573,6 @@ ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx)
                 switch (tx->key->conf.cipher) {
                 case WLAN_CIPHER_SUITE_WEP40:
                 case WLAN_CIPHER_SUITE_WEP104:
-                        if (ieee80211_is_auth(hdr->frame_control))
-                                break;
                 case WLAN_CIPHER_SUITE_TKIP:
                         if (!ieee80211_is_data_present(hdr->frame_control))
                                 tx->key = NULL;
@@ -637,6 +636,7 @@ ieee80211_tx_h_rate_ctrl(struct ieee80211_tx_data *tx)
         else
                 txrc.max_rate_idx = fls(txrc.rate_idx_mask) - 1;
         txrc.bss = (tx->sdata->vif.type == NL80211_IFTYPE_AP ||
+                    tx->sdata->vif.type == NL80211_IFTYPE_MESH_POINT ||
                     tx->sdata->vif.type == NL80211_IFTYPE_ADHOC);
 
         /* set up RTS protection if desired */
@@ -844,11 +844,13 @@ ieee80211_tx_h_sequence(struct ieee80211_tx_data *tx)
         return TX_CONTINUE;
 }
 
-static int ieee80211_fragment(struct ieee80211_local *local,
+static int ieee80211_fragment(struct ieee80211_tx_data *tx,
                               struct sk_buff *skb, int hdrlen,
                               int frag_threshold)
 {
-        struct sk_buff *tail = skb, *tmp;
+        struct ieee80211_local *local = tx->local;
+        struct ieee80211_tx_info *info;
+        struct sk_buff *tmp;
         int per_fragm = frag_threshold - hdrlen - FCS_LEN;
         int pos = hdrlen + per_fragm;
         int rem = skb->len - hdrlen - per_fragm;
@@ -856,6 +858,8 @@ static int ieee80211_fragment(struct ieee80211_local *local,
         if (WARN_ON(rem < 0))
                 return -EINVAL;
 
+        /* first fragment was already added to queue by caller */
+
         while (rem) {
                 int fraglen = per_fragm;
 
@@ -868,12 +872,21 @@ static int ieee80211_fragment(struct ieee80211_local *local,
                                     IEEE80211_ENCRYPT_TAILROOM);
                 if (!tmp)
                         return -ENOMEM;
-                tail->next = tmp;
-                tail = tmp;
+
+                __skb_queue_tail(&tx->skbs, tmp);
+
                 skb_reserve(tmp, local->tx_headroom +
                                  IEEE80211_ENCRYPT_HEADROOM);
                 /* copy control information */
                 memcpy(tmp->cb, skb->cb, sizeof(tmp->cb));
+
+                info = IEEE80211_SKB_CB(tmp);
+                info->flags &= ~(IEEE80211_TX_CTL_CLEAR_PS_FILT |
+                                 IEEE80211_TX_CTL_FIRST_FRAGMENT);
+
+                if (rem)
+                        info->flags |= IEEE80211_TX_CTL_MORE_FRAMES;
+
                 skb_copy_queue_mapping(tmp, skb);
                 tmp->priority = skb->priority;
                 tmp->dev = skb->dev;
@@ -885,6 +898,7 @@ static int ieee80211_fragment(struct ieee80211_local *local,
                 pos += fraglen;
         }
 
+        /* adjust first fragment's length */
         skb->len = hdrlen + per_fragm;
         return 0;
 }
@@ -899,6 +913,10 @@ ieee80211_tx_h_fragment(struct ieee80211_tx_data *tx)
         int hdrlen;
         int fragnum;
 
+        /* no matter what happens, tx->skb moves to tx->skbs */
+        __skb_queue_tail(&tx->skbs, skb);
+        tx->skb = NULL;
+
         if (info->flags & IEEE80211_TX_CTL_DONTFRAG)
                 return TX_CONTINUE;
 
@@ -927,21 +945,21 @@ ieee80211_tx_h_fragment(struct ieee80211_tx_data *tx)
          * of the fragments then we will simply pretend to accept the skb
          * but store it away as pending.
          */
-        if (ieee80211_fragment(tx->local, skb, hdrlen, frag_threshold))
+        if (ieee80211_fragment(tx, skb, hdrlen, frag_threshold))
                 return TX_DROP;
 
         /* update duration/seq/flags of fragments */
         fragnum = 0;
-        do {
+
+        skb_queue_walk(&tx->skbs, skb) {
                 int next_len;
                 const __le16 morefrags = cpu_to_le16(IEEE80211_FCTL_MOREFRAGS);
 
                 hdr = (void *)skb->data;
                 info = IEEE80211_SKB_CB(skb);
 
-                if (skb->next) {
+                if (!skb_queue_is_last(&tx->skbs, skb)) {
                         hdr->frame_control |= morefrags;
-                        next_len = skb->next->len;
                         /*
                          * No multi-rate retries for fragmented frames, that
                          * would completely throw off the NAV at other STAs.
@@ -956,10 +974,9 @@ ieee80211_tx_h_fragment(struct ieee80211_tx_data *tx)
                         hdr->frame_control &= ~morefrags;
                         next_len = 0;
                 }
-                hdr->duration_id = ieee80211_duration(tx, 0, next_len);
                 hdr->seq_ctrl |= cpu_to_le16(fragnum & IEEE80211_SCTL_FRAG);
                 fragnum++;
-        } while ((skb = skb->next));
+        }
 
         return TX_CONTINUE;
 }
@@ -967,16 +984,16 @@ ieee80211_tx_h_fragment(struct ieee80211_tx_data *tx)
 static ieee80211_tx_result debug_noinline
 ieee80211_tx_h_stats(struct ieee80211_tx_data *tx)
 {
-        struct sk_buff *skb = tx->skb;
+        struct sk_buff *skb;
 
         if (!tx->sta)
                 return TX_CONTINUE;
 
         tx->sta->tx_packets++;
-        do {
+        skb_queue_walk(&tx->skbs, skb) {
                 tx->sta->tx_fragments++;
                 tx->sta->tx_bytes += skb->len;
-        } while ((skb = skb->next));
+        }
 
         return TX_CONTINUE;
 }
@@ -1015,21 +1032,25 @@ ieee80211_tx_h_encrypt(struct ieee80211_tx_data *tx)
 static ieee80211_tx_result debug_noinline
 ieee80211_tx_h_calculate_duration(struct ieee80211_tx_data *tx)
 {
-        struct sk_buff *skb = tx->skb;
+        struct sk_buff *skb;
         struct ieee80211_hdr *hdr;
         int next_len;
         bool group_addr;
 
-        do {
+        skb_queue_walk(&tx->skbs, skb) {
                 hdr = (void *) skb->data;
                 if (unlikely(ieee80211_is_pspoll(hdr->frame_control)))
                         break; /* must not overwrite AID */
-                next_len = skb->next ? skb->next->len : 0;
+                if (!skb_queue_is_last(&tx->skbs, skb)) {
+                        struct sk_buff *next = skb_queue_next(&tx->skbs, skb);
+                        next_len = next->len;
+                } else
+                        next_len = 0;
                 group_addr = is_multicast_ether_addr(hdr->addr1);
 
                 hdr->duration_id =
-                        ieee80211_duration(tx, group_addr, next_len);
-        } while ((skb = skb->next));
+                        ieee80211_duration(tx, skb, group_addr, next_len);
+        }
 
         return TX_CONTINUE;
 }
@@ -1043,9 +1064,11 @@ static bool ieee80211_tx_prep_agg(struct ieee80211_tx_data *tx,
                                   int tid)
 {
         bool queued = false;
+        bool reset_agg_timer = false;
 
         if (test_bit(HT_AGG_STATE_OPERATIONAL, &tid_tx->state)) {
                 info->flags |= IEEE80211_TX_CTL_AMPDU;
+                reset_agg_timer = true;
         } else if (test_bit(HT_AGG_STATE_WANT_START, &tid_tx->state)) {
                 /*
                  * nothing -- this aggregation session is being started
@@ -1077,6 +1100,7 @@ static bool ieee80211_tx_prep_agg(struct ieee80211_tx_data *tx,
                         /* do nothing, let packet pass through */
                 } else if (test_bit(HT_AGG_STATE_OPERATIONAL, &tid_tx->state)) {
                         info->flags |= IEEE80211_TX_CTL_AMPDU;
+                        reset_agg_timer = true;
                 } else {
                         queued = true;
                         info->control.vif = &tx->sdata->vif;
@@ -1086,6 +1110,11 @@ static bool ieee80211_tx_prep_agg(struct ieee80211_tx_data *tx,
                 spin_unlock(&tx->sta->lock);
         }
 
+        /* reset session timer */
+        if (reset_agg_timer && tid_tx->timeout)
+                mod_timer(&tid_tx->session_timer,
+                          TU_TO_EXP_TIME(tid_tx->timeout));
+
         return queued;
 }
 
@@ -1108,6 +1137,7 @@ ieee80211_tx_prepare(struct ieee80211_sub_if_data *sdata,
         tx->local = local;
         tx->sdata = sdata;
         tx->channel = local->hw.conf.channel;
+        __skb_queue_head_init(&tx->skbs);
 
         /*
          * If this flag is set to true anywhere, and we get here,
@@ -1152,16 +1182,8 @@ ieee80211_tx_prepare(struct ieee80211_sub_if_data *sdata,
         if (is_multicast_ether_addr(hdr->addr1)) {
                 tx->flags &= ~IEEE80211_TX_UNICAST;
                 info->flags |= IEEE80211_TX_CTL_NO_ACK;
-        } else {
+        } else
                 tx->flags |= IEEE80211_TX_UNICAST;
-                if (unlikely(local->wifi_wme_noack_test))
-                        info->flags |= IEEE80211_TX_CTL_NO_ACK;
-                /*
-                 * Flags are initialized to 0. Hence, no need to
-                 * explicitly unset IEEE80211_TX_CTL_NO_ACK since
-                 * it might already be set for injected frames.
-                 */
-        }
 
         if (!(info->flags & IEEE80211_TX_CTL_DONTFRAG)) {
                 if (!(tx->flags & IEEE80211_TX_UNICAST) ||
@@ -1180,22 +1202,18 @@ ieee80211_tx_prepare(struct ieee80211_sub_if_data *sdata,
         return TX_CONTINUE;
 }
 
-/*
- * Returns false if the frame couldn't be transmitted but was queued instead.
- */
-static bool __ieee80211_tx(struct ieee80211_local *local, struct sk_buff **skbp,
-                           struct sta_info *sta, bool txpending)
+static bool ieee80211_tx_frags(struct ieee80211_local *local,
+                               struct ieee80211_vif *vif,
+                               struct ieee80211_sta *sta,
+                               struct sk_buff_head *skbs,
+                               bool txpending)
 {
-        struct sk_buff *skb = *skbp, *next;
+        struct sk_buff *skb, *tmp;
         struct ieee80211_tx_info *info;
-        struct ieee80211_sub_if_data *sdata;
         unsigned long flags;
-        int len;
-        bool fragm = false;
 
-        while (skb) {
+        skb_queue_walk_safe(skbs, skb, tmp) {
                 int q = skb_get_queue_mapping(skb);
-                __le16 fc;
 
                 spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
                 if (local->queue_stop_reasons[q] ||
@@ -1205,24 +1223,11 @@ static bool __ieee80211_tx(struct ieee80211_local *local, struct sk_buff **skbp,
                          * transmission from the tx-pending tasklet when the
                          * queue is woken again.
                          */
-
-                        do {
-                                next = skb->next;
-                                skb->next = NULL;
-                                /*
-                                 * NB: If txpending is true, next must already
-                                 * be NULL since we must've gone through this
-                                 * loop before already; therefore we can just
-                                 * queue the frame to the head without worrying
-                                 * about reordering of fragments.
-                                 */
-                                if (unlikely(txpending))
-                                        __skb_queue_head(&local->pending[q],
-                                                         skb);
-                                else
-                                        __skb_queue_tail(&local->pending[q],
-                                                         skb);
-                        } while ((skb = next));
+                        if (txpending)
+                                skb_queue_splice_init(skbs, &local->pending[q]);
+                        else
+                                skb_queue_splice_tail_init(skbs,
+                                                           &local->pending[q]);
 
                         spin_unlock_irqrestore(&local->queue_stop_reason_lock,
                                                flags);
@@ -1231,47 +1236,72 @@ static bool __ieee80211_tx(struct ieee80211_local *local, struct sk_buff **skbp,
                 spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
 
                 info = IEEE80211_SKB_CB(skb);
+                info->control.vif = vif;
+                info->control.sta = sta;
 
-                if (fragm)
-                        info->flags &= ~(IEEE80211_TX_CTL_CLEAR_PS_FILT |
-                                         IEEE80211_TX_CTL_FIRST_FRAGMENT);
-
-                next = skb->next;
-                len = skb->len;
+                __skb_unlink(skb, skbs);
+                drv_tx(local, skb);
+        }
 
-                if (next)
-                        info->flags |= IEEE80211_TX_CTL_MORE_FRAMES;
+        return true;
+}
 
-                sdata = vif_to_sdata(info->control.vif);
+/*
+ * Returns false if the frame couldn't be transmitted but was queued instead.
+ */
+static bool __ieee80211_tx(struct ieee80211_local *local,
+                           struct sk_buff_head *skbs, int led_len,
+                           struct sta_info *sta, bool txpending)
+{
+        struct ieee80211_tx_info *info;
+        struct ieee80211_sub_if_data *sdata;
+        struct ieee80211_vif *vif;
+        struct ieee80211_sta *pubsta;
+        struct sk_buff *skb;
+        bool result = true;
+        __le16 fc;
 
-                switch (sdata->vif.type) {
-                case NL80211_IFTYPE_MONITOR:
-                        info->control.vif = NULL;
-                        break;
-                case NL80211_IFTYPE_AP_VLAN:
-                        info->control.vif = &container_of(sdata->bss,
-                                struct ieee80211_sub_if_data, u.ap)->vif;
-                        break;
-                default:
-                        /* keep */
-                        break;
-                }
+        if (WARN_ON(skb_queue_empty(skbs)))
+                return true;
 
-                if (sta && sta->uploaded)
-                        info->control.sta = &sta->sta;
-                else
-                        info->control.sta = NULL;
+        skb = skb_peek(skbs);
+        fc = ((struct ieee80211_hdr *)skb->data)->frame_control;
+        info = IEEE80211_SKB_CB(skb);
+        sdata = vif_to_sdata(info->control.vif);
+        if (sta && !sta->uploaded)
+                sta = NULL;
 
-                fc = ((struct ieee80211_hdr *)skb->data)->frame_control;
-                drv_tx(local, skb);
+        if (sta)
+                pubsta = &sta->sta;
+        else
+                pubsta = NULL;
 
-                ieee80211_tpt_led_trig_tx(local, fc, len);
-                *skbp = skb = next;
-                ieee80211_led_tx(local, 1);
-                fragm = true;
+        switch (sdata->vif.type) {
+        case NL80211_IFTYPE_MONITOR:
+                sdata = NULL;
+                vif = NULL;
+                break;
+        case NL80211_IFTYPE_AP_VLAN:
+                sdata = container_of(sdata->bss,
+                                     struct ieee80211_sub_if_data, u.ap);
+                /* fall through */
+        default:
+                vif = &sdata->vif;
+                break;
         }
 
-        return true;
+        if (local->ops->tx_frags)
+                drv_tx_frags(local, vif, pubsta, skbs);
+        else
+                result = ieee80211_tx_frags(local, vif, pubsta, skbs,
+                                            txpending);
+
+        ieee80211_tpt_led_trig_tx(local, fc, led_len);
+        ieee80211_led_tx(local, 1);
+
+        WARN_ON_ONCE(!skb_queue_empty(skbs));
+
+        return result;
 }
 
 /*
@@ -1280,8 +1310,7 @@ static bool __ieee80211_tx(struct ieee80211_local *local, struct sk_buff **skbp,
  */
 static int invoke_tx_handlers(struct ieee80211_tx_data *tx)
 {
-        struct sk_buff *skb = tx->skb;
-        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
         ieee80211_tx_result res = TX_DROP;
 
 #define CALL_TXH(txh) \
@@ -1299,8 +1328,11 @@ static int invoke_tx_handlers(struct ieee80211_tx_data *tx)
         if (!(tx->local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL))
                 CALL_TXH(ieee80211_tx_h_rate_ctrl);
 
-        if (unlikely(info->flags & IEEE80211_TX_INTFL_RETRANSMISSION))
+        if (unlikely(info->flags & IEEE80211_TX_INTFL_RETRANSMISSION)) {
+                __skb_queue_tail(&tx->skbs, tx->skb);
+                tx->skb = NULL;
                 goto txh_done;
+        }
 
         CALL_TXH(ieee80211_tx_h_michael_mic_add);
         CALL_TXH(ieee80211_tx_h_sequence);
@@ -1315,13 +1347,10 @@ static int invoke_tx_handlers(struct ieee80211_tx_data *tx)
  txh_done:
         if (unlikely(res == TX_DROP)) {
                 I802_DEBUG_INC(tx->local->tx_handlers_drop);
-                while (skb) {
-                        struct sk_buff *next;
-
-                        next = skb->next;
-                        dev_kfree_skb(skb);
-                        skb = next;
-                }
+                if (tx->skb)
+                        dev_kfree_skb(tx->skb);
+                else
+                        __skb_queue_purge(&tx->skbs);
                 return -1;
         } else if (unlikely(res == TX_QUEUED)) {
                 I802_DEBUG_INC(tx->local->tx_handlers_queued);
@@ -1342,6 +1371,7 @@ static bool ieee80211_tx(struct ieee80211_sub_if_data *sdata,
         ieee80211_tx_result res_prepare;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         bool result = true;
+        int led_len;
 
         if (unlikely(skb->len < 10)) {
                 dev_kfree_skb(skb);
@@ -1351,6 +1381,7 @@ static bool ieee80211_tx(struct ieee80211_sub_if_data *sdata,
         rcu_read_lock();
 
         /* initialises tx */
+        led_len = skb->len;
         res_prepare = ieee80211_tx_prepare(sdata, &tx, skb);
 
         if (unlikely(res_prepare == TX_DROP)) {
@@ -1364,7 +1395,8 @@ static bool ieee80211_tx(struct ieee80211_sub_if_data *sdata,
         info->band = tx.channel->band;
 
         if (!invoke_tx_handlers(&tx))
-                result = __ieee80211_tx(local, &tx.skb, tx.sta, txpending);
+                result = __ieee80211_tx(local, &tx.skbs, led_len,
+                                        tx.sta, txpending);
  out:
         rcu_read_unlock();
         return result;
@@ -1431,7 +1463,7 @@ void ieee80211_xmit(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb)
         if (ieee80211_vif_is_mesh(&sdata->vif) &&
             ieee80211_is_data(hdr->frame_control) &&
                 !is_multicast_ether_addr(hdr->addr1))
-                        if (mesh_nexthop_lookup(skb, sdata)) {
+                        if (mesh_nexthop_resolve(skb, sdata)) {
                                 /* skb queued: don't free */
                                 rcu_read_unlock();
                                 return;
@@ -1685,8 +1717,10 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
         int nh_pos, h_pos;
         struct sta_info *sta = NULL;
         bool wme_sta = false, authorized = false, tdls_auth = false;
-        struct sk_buff *tmp_skb;
         bool tdls_direct = false;
+        bool multicast;
+        u32 info_flags = 0;
+        u16 info_id = 0;
 
         if (unlikely(skb->len < ETH_HLEN)) {
                 ret = NETDEV_TX_OK;
@@ -1873,7 +1907,8 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
          * if it is a multicast address (which can only happen
          * in AP mode)
          */
-        if (!is_multicast_ether_addr(hdr.addr1)) {
+        multicast = is_multicast_ether_addr(hdr.addr1);
+        if (!multicast) {
                 rcu_read_lock();
                 sta = sta_info_get(sdata, hdr.addr1);
                 if (sta) {
@@ -1914,11 +1949,54 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
                 goto fail;
         }
 
+        if (unlikely(!multicast && skb->sk &&
+                     skb_shinfo(skb)->tx_flags & SKBTX_WIFI_STATUS)) {
+                struct sk_buff *orig_skb = skb;
+
+                skb = skb_clone(skb, GFP_ATOMIC);
+                if (skb) {
+                        unsigned long flags;
+                        int id, r;
+
+                        spin_lock_irqsave(&local->ack_status_lock, flags);
+                        r = idr_get_new_above(&local->ack_status_frames,
+                                              orig_skb, 1, &id);
+                        if (r == -EAGAIN) {
+                                idr_pre_get(&local->ack_status_frames,
+                                            GFP_ATOMIC);
+                                r = idr_get_new_above(&local->ack_status_frames,
+                                                      orig_skb, 1, &id);
+                        }
+                        if (WARN_ON(!id) || id > 0xffff) {
+                                idr_remove(&local->ack_status_frames, id);
+                                r = -ERANGE;
+                        }
+                        spin_unlock_irqrestore(&local->ack_status_lock, flags);
+
+                        if (!r) {
+                                info_id = id;
+                                info_flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
+                        } else if (skb_shared(skb)) {
+                                kfree_skb(orig_skb);
+                        } else {
+                                kfree_skb(skb);
+                                skb = orig_skb;
+                        }
+                } else {
+                        /* couldn't clone -- lose tx status ... */
+                        skb = orig_skb;
+                }
+        }
+
         /*
          * If the skb is shared we need to obtain our own copy.
          */
         if (skb_shared(skb)) {
-                tmp_skb = skb;
+                struct sk_buff *tmp_skb = skb;
+
+                /* can't happen -- skb is a clone if info_id != 0 */
+                WARN_ON(info_id);
+
                 skb = skb_clone(skb, GFP_ATOMIC);
                 kfree_skb(tmp_skb);
 
@@ -2019,6 +2097,10 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
         memset(info, 0, sizeof(*info));
 
         dev->trans_start = jiffies;
+
+        info->flags = info_flags;
+        info->ack_frame_id = info_id;
+
         ieee80211_xmit(sdata, skb);
 
         return NETDEV_TX_OK;
@@ -2062,10 +2144,15 @@ static bool ieee80211_tx_pending_skb(struct ieee80211_local *local,
         if (info->flags & IEEE80211_TX_INTFL_NEED_TXPROCESSING) {
                 result = ieee80211_tx(sdata, skb, true);
         } else {
+                struct sk_buff_head skbs;
+
+                __skb_queue_head_init(&skbs);
+                __skb_queue_tail(&skbs, skb);
+
                 hdr = (struct ieee80211_hdr *)skb->data;
                 sta = sta_info_get(sdata, hdr->addr1);
 
-                result = __ieee80211_tx(local, &skb, sta, true);
+                result = __ieee80211_tx(local, &skbs, skb->len, sta, true);
         }
 
         return result;
@@ -2178,10 +2265,10 @@ static void ieee80211_beacon_add_tim(struct ieee80211_if_ap *bss,
                 /* Bitmap control */
                 *pos++ = n1 | aid0;
                 /* Part Virt Bitmap */
+                skb_put(skb, n2 - n1);
                 memcpy(pos, bss->tim + n1, n2 - n1 + 1);
 
                 tim[1] = n2 - n1 + 4;
-                skb_put(skb, n2 - n1);
         } else {
                 *pos++ = aid0; /* Bitmap control */
                 *pos++ = 0; /* Part Virt Bitmap */
@@ -2246,9 +2333,9 @@ struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
                         } else {
                                 unsigned long flags;
 
-                                spin_lock_irqsave(&local->sta_lock, flags);
+                                spin_lock_irqsave(&local->tim_lock, flags);
                                 ieee80211_beacon_add_tim(ap, skb, beacon);
-                                spin_unlock_irqrestore(&local->sta_lock, flags);
+                                spin_unlock_irqrestore(&local->tim_lock, flags);
                         }
 
                         if (tim_offset)
@@ -2279,22 +2366,31 @@ struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
         } else if (ieee80211_vif_is_mesh(&sdata->vif)) {
                 struct ieee80211_mgmt *mgmt;
                 u8 *pos;
+                int hdr_len = offsetof(struct ieee80211_mgmt, u.beacon) +
+                              sizeof(mgmt->u.beacon);
 
 #ifdef CONFIG_MAC80211_MESH
                 if (!sdata->u.mesh.mesh_id_len)
                         goto out;
 #endif
 
-                /* headroom, head length, tail length and maximum TIM length */
-                skb = dev_alloc_skb(local->tx_headroom + 400 +
-                                sdata->u.mesh.ie_len);
+                skb = dev_alloc_skb(local->tx_headroom +
+                                    hdr_len +
+                                    2 + /* NULL SSID */
+                                    2 + 8 + /* supported rates */
+                                    2 + 3 + /* DS params */
+                                    2 + (IEEE80211_MAX_SUPP_RATES - 8) +
+                                    2 + sizeof(struct ieee80211_ht_cap) +
+                                    2 + sizeof(struct ieee80211_ht_info) +
+                                    2 + sdata->u.mesh.mesh_id_len +
+                                    2 + sizeof(struct ieee80211_meshconf_ie) +
+                                    sdata->u.mesh.ie_len);
                 if (!skb)
                         goto out;
 
                 skb_reserve(skb, local->hw.extra_tx_headroom);
-                mgmt = (struct ieee80211_mgmt *)
-                        skb_put(skb, 24 + sizeof(mgmt->u.beacon));
-                memset(mgmt, 0, 24 + sizeof(mgmt->u.beacon));
+                mgmt = (struct ieee80211_mgmt *) skb_put(skb, hdr_len);
+                memset(mgmt, 0, hdr_len);
                 mgmt->frame_control =
                     cpu_to_le16(IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_BEACON);
                 memset(mgmt->da, 0xff, ETH_ALEN);
@@ -2313,6 +2409,8 @@ struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
                     mesh_add_ds_params_ie(skb, sdata) ||
                     ieee80211_add_ext_srates_ie(&sdata->vif, skb) ||
                     mesh_add_rsn_ie(skb, sdata) ||
+                    mesh_add_ht_cap_ie(skb, sdata) ||
+                    mesh_add_ht_info_ie(skb, sdata) ||
                     mesh_add_meshid_ie(skb, sdata) ||
                     mesh_add_meshconf_ie(skb, sdata) ||
                     mesh_add_vendor_ies(skb, sdata)) {
@@ -2355,6 +2453,37 @@ struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
 }
 EXPORT_SYMBOL(ieee80211_beacon_get_tim);
 
+struct sk_buff *ieee80211_proberesp_get(struct ieee80211_hw *hw,
+                                        struct ieee80211_vif *vif)
+{
+        struct ieee80211_if_ap *ap = NULL;
+        struct sk_buff *presp = NULL, *skb = NULL;
+        struct ieee80211_hdr *hdr;
+        struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
+
+        if (sdata->vif.type != NL80211_IFTYPE_AP)
+                return NULL;
+
+        rcu_read_lock();
+
+        ap = &sdata->u.ap;
+        presp = rcu_dereference(ap->probe_resp);
+        if (!presp)
+                goto out;
+
+        skb = skb_copy(presp, GFP_ATOMIC);
+        if (!skb)
+                goto out;
+
+        hdr = (struct ieee80211_hdr *) skb->data;
+        memset(hdr->addr1, 0, sizeof(hdr->addr1));
+
+out:
+        rcu_read_unlock();
+        return skb;
+}
+EXPORT_SYMBOL(ieee80211_proberesp_get);
+
 struct sk_buff *ieee80211_pspoll_get(struct ieee80211_hw *hw,
                                      struct ieee80211_vif *vif)
 {
@@ -2567,15 +2696,15 @@ ieee80211_get_buffered_bc(struct ieee80211_hw *hw,
 }
 EXPORT_SYMBOL(ieee80211_get_buffered_bc);
 
-void ieee80211_tx_skb(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb)
+void ieee80211_tx_skb_tid(struct ieee80211_sub_if_data *sdata,
+                          struct sk_buff *skb, int tid)
 {
         skb_set_mac_header(skb, 0);
         skb_set_network_header(skb, 0);
         skb_set_transport_header(skb, 0);
 
-        /* Send all internal mgmt frames on VO. Accordingly set TID to 7. */
-        skb_set_queue_mapping(skb, IEEE80211_AC_VO);
-        skb->priority = 7;
+        skb_set_queue_mapping(skb, ieee802_1d_to_ac[tid]);
+        skb->priority = tid;
 
         /*
          * The other path calling ieee80211_xmit is from the tasklet,
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index d5230ecc784d..9919892575f4 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -20,6 +20,7 @@
 #include <linux/etherdevice.h>
 #include <linux/if_arp.h>
 #include <linux/bitmap.h>
+#include <linux/crc32.h>
 #include <net/net_namespace.h>
 #include <net/cfg80211.h>
 #include <net/rtnetlink.h>
@@ -96,13 +97,13 @@ u8 *ieee80211_get_bssid(struct ieee80211_hdr *hdr, size_t len,
 
 void ieee80211_tx_set_protected(struct ieee80211_tx_data *tx)
 {
-        struct sk_buff *skb = tx->skb;
+        struct sk_buff *skb;
         struct ieee80211_hdr *hdr;
 
-        do {
+        skb_queue_walk(&tx->skbs, skb) {
                 hdr = (struct ieee80211_hdr *) skb->data;
                 hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
-        } while ((skb = skb->next));
+        }
 }
 
 int ieee80211_frame_duration(struct ieee80211_local *local, size_t len,
@@ -564,6 +565,172 @@ void ieee80211_queue_delayed_work(struct ieee80211_hw *hw,
 }
 EXPORT_SYMBOL(ieee80211_queue_delayed_work);
 
+u32 ieee802_11_parse_elems_crc(u8 *start, size_t len,
+                               struct ieee802_11_elems *elems,
+                               u64 filter, u32 crc)
+{
+        size_t left = len;
+        u8 *pos = start;
+        bool calc_crc = filter != 0;
+
+        memset(elems, 0, sizeof(*elems));
+        elems->ie_start = start;
+        elems->total_len = len;
+
+        while (left >= 2) {
+                u8 id, elen;
+
+                id = *pos++;
+                elen = *pos++;
+                left -= 2;
+
+                if (elen > left)
+                        break;
+
+                if (calc_crc && id < 64 && (filter & (1ULL << id)))
+                        crc = crc32_be(crc, pos - 2, elen + 2);
+
+                switch (id) {
+                case WLAN_EID_SSID:
+                        elems->ssid = pos;
+                        elems->ssid_len = elen;
+                        break;
+                case WLAN_EID_SUPP_RATES:
+                        elems->supp_rates = pos;
+                        elems->supp_rates_len = elen;
+                        break;
+                case WLAN_EID_FH_PARAMS:
+                        elems->fh_params = pos;
+                        elems->fh_params_len = elen;
+                        break;
+                case WLAN_EID_DS_PARAMS:
+                        elems->ds_params = pos;
+                        elems->ds_params_len = elen;
+                        break;
+                case WLAN_EID_CF_PARAMS:
+                        elems->cf_params = pos;
+                        elems->cf_params_len = elen;
+                        break;
+                case WLAN_EID_TIM:
+                        if (elen >= sizeof(struct ieee80211_tim_ie)) {
+                                elems->tim = (void *)pos;
+                                elems->tim_len = elen;
+                        }
+                        break;
+                case WLAN_EID_IBSS_PARAMS:
+                        elems->ibss_params = pos;
+                        elems->ibss_params_len = elen;
+                        break;
+                case WLAN_EID_CHALLENGE:
+                        elems->challenge = pos;
+                        elems->challenge_len = elen;
+                        break;
+                case WLAN_EID_VENDOR_SPECIFIC:
+                        if (elen >= 4 && pos[0] == 0x00 && pos[1] == 0x50 &&
+                            pos[2] == 0xf2) {
+                                /* Microsoft OUI (00:50:F2) */
+
+                                if (calc_crc)
+                                        crc = crc32_be(crc, pos - 2, elen + 2);
+
+                                if (pos[3] == 1) {
+                                        /* OUI Type 1 - WPA IE */
+                                        elems->wpa = pos;
+                                        elems->wpa_len = elen;
+                                } else if (elen >= 5 && pos[3] == 2) {
+                                        /* OUI Type 2 - WMM IE */
+                                        if (pos[4] == 0) {
+                                                elems->wmm_info = pos;
+                                                elems->wmm_info_len = elen;
+                                        } else if (pos[4] == 1) {
+                                                elems->wmm_param = pos;
+                                                elems->wmm_param_len = elen;
+                                        }
+                                }
+                        }
+                        break;
+                case WLAN_EID_RSN:
+                        elems->rsn = pos;
+                        elems->rsn_len = elen;
+                        break;
+                case WLAN_EID_ERP_INFO:
+                        elems->erp_info = pos;
+                        elems->erp_info_len = elen;
+                        break;
+                case WLAN_EID_EXT_SUPP_RATES:
+                        elems->ext_supp_rates = pos;
+                        elems->ext_supp_rates_len = elen;
+                        break;
+                case WLAN_EID_HT_CAPABILITY:
+                        if (elen >= sizeof(struct ieee80211_ht_cap))
+                                elems->ht_cap_elem = (void *)pos;
+                        break;
+                case WLAN_EID_HT_INFORMATION:
+                        if (elen >= sizeof(struct ieee80211_ht_info))
+                                elems->ht_info_elem = (void *)pos;
+                        break;
+                case WLAN_EID_MESH_ID:
+                        elems->mesh_id = pos;
+                        elems->mesh_id_len = elen;
+                        break;
+                case WLAN_EID_MESH_CONFIG:
+                        if (elen >= sizeof(struct ieee80211_meshconf_ie))
+                                elems->mesh_config = (void *)pos;
+                        break;
+                case WLAN_EID_PEER_MGMT:
+                        elems->peering = pos;
+                        elems->peering_len = elen;
+                        break;
+                case WLAN_EID_PREQ:
+                        elems->preq = pos;
+                        elems->preq_len = elen;
+                        break;
+                case WLAN_EID_PREP:
+                        elems->prep = pos;
+                        elems->prep_len = elen;
+                        break;
+                case WLAN_EID_PERR:
+                        elems->perr = pos;
+                        elems->perr_len = elen;
+                        break;
+                case WLAN_EID_RANN:
+                        if (elen >= sizeof(struct ieee80211_rann_ie))
+                                elems->rann = (void *)pos;
+                        break;
+                case WLAN_EID_CHANNEL_SWITCH:
+                        elems->ch_switch_elem = pos;
+                        elems->ch_switch_elem_len = elen;
+                        break;
+                case WLAN_EID_QUIET:
+                        if (!elems->quiet_elem) {
+                                elems->quiet_elem = pos;
+                                elems->quiet_elem_len = elen;
+                        }
+                        elems->num_of_quiet_elem++;
+                        break;
+                case WLAN_EID_COUNTRY:
+                        elems->country_elem = pos;
+                        elems->country_elem_len = elen;
+                        break;
+                case WLAN_EID_PWR_CONSTRAINT:
+                        elems->pwr_constr_elem = pos;
+                        elems->pwr_constr_elem_len = elen;
+                        break;
+                case WLAN_EID_TIMEOUT_INTERVAL:
+                        elems->timeout_int = pos;
+                        elems->timeout_int_len = elen;
+                        break;
+                default:
+                        break;
+                }
+
+                left -= elen;
+                pos += elen;
+        }
+
+        return crc;
+}
+
 void ieee802_11_parse_elems(u8 *start, size_t len,
                             struct ieee802_11_elems *elems)
 {
@@ -812,23 +979,9 @@ int ieee80211_build_preq_ies(struct ieee80211_local *local, u8 *buffer,
                 offset = noffset;
         }
 
-        if (sband->ht_cap.ht_supported) {
-                u16 cap = sband->ht_cap.cap;
-                __le16 tmp;
-
-                *pos++ = WLAN_EID_HT_CAPABILITY;
-                *pos++ = sizeof(struct ieee80211_ht_cap);
-                memset(pos, 0, sizeof(struct ieee80211_ht_cap));
-                tmp = cpu_to_le16(cap);
-                memcpy(pos, &tmp, sizeof(u16));
-                pos += sizeof(u16);
-                *pos++ = sband->ht_cap.ampdu_factor |
-                         (sband->ht_cap.ampdu_density <<
-                                IEEE80211_HT_AMPDU_PARM_DENSITY_SHIFT);
-                memcpy(pos, &sband->ht_cap.mcs, sizeof(sband->ht_cap.mcs));
-                pos += sizeof(sband->ht_cap.mcs);
-                pos += 2 + 4 + 1; /* ext info, BF cap, antsel */
-        }
+        if (sband->ht_cap.ht_supported)
+                pos = ieee80211_ie_build_ht_cap(pos, &sband->ht_cap,
+                                                sband->ht_cap.cap);
 
         /*
          * If adding more here, adjust code in main.c
@@ -989,16 +1142,6 @@ int ieee80211_reconfig(struct ieee80211_local *local)
                  */
         }
 #endif
-
-        /* setup fragmentation threshold */
-        drv_set_frag_threshold(local, hw->wiphy->frag_threshold);
-
-        /* setup RTS threshold */
-        drv_set_rts_threshold(local, hw->wiphy->rts_threshold);
-
-        /* reset coverage class */
-        drv_set_coverage_class(local, hw->wiphy->coverage_class);
-
         /* everything else happens only if HW was up & running */
         if (!local->open_count)
                 goto wake_up;
@@ -1017,6 +1160,15 @@ int ieee80211_reconfig(struct ieee80211_local *local)
                 return res;
         }
 
+        /* setup fragmentation threshold */
+        drv_set_frag_threshold(local, hw->wiphy->frag_threshold);
+
+        /* setup RTS threshold */
+        drv_set_rts_threshold(local, hw->wiphy->rts_threshold);
+
+        /* reset coverage class */
+        drv_set_coverage_class(local, hw->wiphy->coverage_class);
+
         ieee80211_led_radio(local, true);
         ieee80211_mod_tpt_led_trig(local,
                                    IEEE80211_TPT_LEDTRIG_FL_RADIO, 0);
@@ -1026,7 +1178,7 @@ int ieee80211_reconfig(struct ieee80211_local *local)
                 if (sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
                     sdata->vif.type != NL80211_IFTYPE_MONITOR &&
                     ieee80211_sdata_running(sdata))
-                        res = drv_add_interface(local, &sdata->vif);
+                        res = drv_add_interface(local, sdata);
         }
 
         /* add STAs back */
@@ -1076,11 +1228,13 @@ int ieee80211_reconfig(struct ieee80211_local *local)
                           BSS_CHANGED_BEACON_INT |
                           BSS_CHANGED_BSSID |
                           BSS_CHANGED_CQM |
-                          BSS_CHANGED_QOS;
+                          BSS_CHANGED_QOS |
+                          BSS_CHANGED_IDLE;
 
                 switch (sdata->vif.type) {
                 case NL80211_IFTYPE_STATION:
-                        changed |= BSS_CHANGED_ASSOC;
+                        changed |= BSS_CHANGED_ASSOC |
+                                   BSS_CHANGED_ARP_FILTER;
                         mutex_lock(&sdata->u.mgd.mtx);
                         ieee80211_bss_info_change_notify(sdata, changed);
                         mutex_unlock(&sdata->u.mgd.mtx);
@@ -1090,6 +1244,10 @@ int ieee80211_reconfig(struct ieee80211_local *local)
                         /* fall through */
                 case NL80211_IFTYPE_AP:
                         changed |= BSS_CHANGED_SSID;
+
+                        if (sdata->vif.type == NL80211_IFTYPE_AP)
+                                changed |= BSS_CHANGED_AP_PROBE_RESP;
+
                         /* fall through */
                 case NL80211_IFTYPE_MESH_POINT:
                         changed |= BSS_CHANGED_BEACON |
@@ -1111,6 +1269,8 @@ int ieee80211_reconfig(struct ieee80211_local *local)
                 }
         }
 
+        ieee80211_recalc_ps(local, -1);
+
         /*
          * Clear the WLAN_STA_BLOCK_BA flag so new aggregation
          * sessions can be established after a resume.
@@ -1366,6 +1526,108 @@ void ieee80211_disable_rssi_reports(struct ieee80211_vif *vif)
 }
 EXPORT_SYMBOL(ieee80211_disable_rssi_reports);
 
+u8 *ieee80211_ie_build_ht_cap(u8 *pos, struct ieee80211_sta_ht_cap *ht_cap,
+                              u16 cap)
+{
+        __le16 tmp;
+
+        *pos++ = WLAN_EID_HT_CAPABILITY;
+        *pos++ = sizeof(struct ieee80211_ht_cap);
+        memset(pos, 0, sizeof(struct ieee80211_ht_cap));
+
+        /* capability flags */
+        tmp = cpu_to_le16(cap);
+        memcpy(pos, &tmp, sizeof(u16));
+        pos += sizeof(u16);
+
+        /* AMPDU parameters */
+        *pos++ = ht_cap->ampdu_factor |
+                 (ht_cap->ampdu_density <<
+                        IEEE80211_HT_AMPDU_PARM_DENSITY_SHIFT);
+
+        /* MCS set */
+        memcpy(pos, &ht_cap->mcs, sizeof(ht_cap->mcs));
+        pos += sizeof(ht_cap->mcs);
+
+        /* extended capabilities */
+        pos += sizeof(__le16);
+
+        /* BF capabilities */
+        pos += sizeof(__le32);
+
+        /* antenna selection */
+        pos += sizeof(u8);
+
+        return pos;
+}
+
+u8 *ieee80211_ie_build_ht_info(u8 *pos,
+                               struct ieee80211_sta_ht_cap *ht_cap,
+                               struct ieee80211_channel *channel,
+                               enum nl80211_channel_type channel_type)
+{
+        struct ieee80211_ht_info *ht_info;
+        /* Build HT Information */
+        *pos++ = WLAN_EID_HT_INFORMATION;
+        *pos++ = sizeof(struct ieee80211_ht_info);
+        ht_info = (struct ieee80211_ht_info *)pos;
+        ht_info->control_chan =
+                        ieee80211_frequency_to_channel(channel->center_freq);
+        switch (channel_type) {
+        case NL80211_CHAN_HT40MINUS:
+                ht_info->ht_param = IEEE80211_HT_PARAM_CHA_SEC_BELOW;
+                break;
+        case NL80211_CHAN_HT40PLUS:
+                ht_info->ht_param = IEEE80211_HT_PARAM_CHA_SEC_ABOVE;
+                break;
+        case NL80211_CHAN_HT20:
+        default:
+                ht_info->ht_param = IEEE80211_HT_PARAM_CHA_SEC_NONE;
+                break;
+        }
+        if (ht_cap->cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40)
+                ht_info->ht_param |= IEEE80211_HT_PARAM_CHAN_WIDTH_ANY;
+
+        /*
+         * Note: According to 802.11n-2009 9.13.3.1, HT Protection field and
+         * RIFS Mode are reserved in IBSS mode, therefore keep them at 0
+         */
+        ht_info->operation_mode = 0x0000;
+        ht_info->stbc_param = 0x0000;
+
+        /* It seems that Basic MCS set and Supported MCS set
+           are identical for the first 10 bytes */
+        memset(&ht_info->basic_set, 0, 16);
+        memcpy(&ht_info->basic_set, &ht_cap->mcs, 10);
+
+        return pos + sizeof(struct ieee80211_ht_info);
+}
+
+enum nl80211_channel_type
+ieee80211_ht_info_to_channel_type(struct ieee80211_ht_info *ht_info)
+{
+        enum nl80211_channel_type channel_type;
+
+        if (!ht_info)
+                return NL80211_CHAN_NO_HT;
+
+        switch (ht_info->ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
+        case IEEE80211_HT_PARAM_CHA_SEC_NONE:
+                channel_type = NL80211_CHAN_HT20;
+                break;
+        case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
+                channel_type = NL80211_CHAN_HT40PLUS;
+                break;
+        case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
+                channel_type = NL80211_CHAN_HT40MINUS;
+                break;
+        default:
+                channel_type = NL80211_CHAN_NO_HT;
+        }
+
+        return channel_type;
+}
+
 int ieee80211_add_srates_ie(struct ieee80211_vif *vif, struct sk_buff *skb)
 {
         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
diff --git a/net/mac80211/wep.c b/net/mac80211/wep.c
index a1c6bfd55f0f..68ad351479df 100644
--- a/net/mac80211/wep.c
+++ b/net/mac80211/wep.c
@@ -330,13 +330,12 @@ ieee80211_crypto_wep_encrypt(struct ieee80211_tx_data *tx)
 
         ieee80211_tx_set_protected(tx);
 
-        skb = tx->skb;
-        do {
+        skb_queue_walk(&tx->skbs, skb) {
                 if (wep_encrypt_skb(tx, skb) < 0) {
                         I802_DEBUG_INC(tx->local->tx_handlers_drop_wep);
                         return TX_DROP;
                 }
-        } while ((skb = skb->next));
+        }
 
         return TX_CONTINUE;
 }
diff --git a/net/mac80211/wme.c b/net/mac80211/wme.c
index fd52e695c071..89511be3111e 100644
--- a/net/mac80211/wme.c
+++ b/net/mac80211/wme.c
@@ -52,6 +52,30 @@ static int wme_downgrade_ac(struct sk_buff *skb)
         }
 }
 
+/* Indicate which queue to use for this fully formed 802.11 frame */
+u16 ieee80211_select_queue_80211(struct ieee80211_local *local,
+                                 struct sk_buff *skb,
+                                 struct ieee80211_hdr *hdr)
+{
+        u8 *p;
+
+        if (local->hw.queues < 4)
+                return 0;
+
+        if (!ieee80211_is_data(hdr->frame_control)) {
+                skb->priority = 7;
+                return ieee802_1d_to_ac[skb->priority];
+        }
+        if (!ieee80211_is_data_qos(hdr->frame_control)) {
+                skb->priority = 0;
+                return ieee802_1d_to_ac[skb->priority];
+        }
+
+        p = ieee80211_get_qos_ctl(hdr);
+        skb->priority = *p & IEEE80211_QOS_CTL_TAG1D_MASK;
+
+        return ieee80211_downgrade_queue(local, skb);
+}
 
 /* Indicate which queue to use. */
 u16 ieee80211_select_queue(struct ieee80211_sub_if_data *sdata,
@@ -83,7 +107,7 @@ u16 ieee80211_select_queue(struct ieee80211_sub_if_data *sdata,
                 break;
 #ifdef CONFIG_MAC80211_MESH
         case NL80211_IFTYPE_MESH_POINT:
-                ra = skb->data;
+                qos = true;
                 break;
 #endif
         case NL80211_IFTYPE_STATION:
@@ -139,16 +163,24 @@ void ieee80211_set_qos_hdr(struct ieee80211_sub_if_data *sdata,
                            struct sk_buff *skb)
 {
         struct ieee80211_hdr *hdr = (void *)skb->data;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 
         /* Fill in the QoS header if there is one. */
         if (ieee80211_is_data_qos(hdr->frame_control)) {
                 u8 *p = ieee80211_get_qos_ctl(hdr);
-                u8 ack_policy = 0, tid;
+                u8 ack_policy, tid;
 
                 tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
 
-                if (unlikely(sdata->local->wifi_wme_noack_test))
+                /* preserve EOSP bit */
+                ack_policy = *p & IEEE80211_QOS_CTL_EOSP;
+
+                if (is_multicast_ether_addr(hdr->addr1) ||
+                    sdata->noack_map & BIT(tid)) {
                         ack_policy |= IEEE80211_QOS_CTL_ACK_POLICY_NOACK;
+                        info->flags |= IEEE80211_TX_CTL_NO_ACK;
+                }
+
                 /* qos header is 2 bytes */
                 *p++ = ack_policy | tid;
                 *p = ieee80211_vif_is_mesh(&sdata->vif) ?
diff --git a/net/mac80211/wme.h b/net/mac80211/wme.h
index 34e166fbf4d4..94edceb617ff 100644
--- a/net/mac80211/wme.h
+++ b/net/mac80211/wme.h
@@ -15,6 +15,9 @@
 
 extern const int ieee802_1d_to_ac[8];
 
+u16 ieee80211_select_queue_80211(struct ieee80211_local *local,
+                                 struct sk_buff *skb,
+                                 struct ieee80211_hdr *hdr);
 u16 ieee80211_select_queue(struct ieee80211_sub_if_data *sdata,
                            struct sk_buff *skb);
 void ieee80211_set_qos_hdr(struct ieee80211_sub_if_data *sdata,
diff --git a/net/mac80211/work.c b/net/mac80211/work.c
index 6c53b6d1002b..c6dd01a05291 100644
--- a/net/mac80211/work.c
+++ b/net/mac80211/work.c
@@ -94,7 +94,8 @@ static int ieee80211_compatible_rates(const u8 *supp_rates, int supp_rates_len,
 
 /* frame sending functions */
 
-static void ieee80211_add_ht_ie(struct sk_buff *skb, const u8 *ht_info_ie,
+static void ieee80211_add_ht_ie(struct ieee80211_sub_if_data *sdata,
+                                struct sk_buff *skb, const u8 *ht_info_ie,
                                 struct ieee80211_supported_band *sband,
                                 struct ieee80211_channel *channel,
                                 enum ieee80211_smps_mode smps)
@@ -102,8 +103,10 @@ static void ieee80211_add_ht_ie(struct sk_buff *skb, const u8 *ht_info_ie,
         struct ieee80211_ht_info *ht_info;
         u8 *pos;
         u32 flags = channel->flags;
-        u16 cap = sband->ht_cap.cap;
-        __le16 tmp;
+        u16 cap;
+        struct ieee80211_sta_ht_cap ht_cap;
+
+        BUILD_BUG_ON(sizeof(ht_cap) != sizeof(sband->ht_cap));
 
         if (!sband->ht_cap.ht_supported)
                 return;
@@ -114,9 +117,13 @@ static void ieee80211_add_ht_ie(struct sk_buff *skb, const u8 *ht_info_ie,
         if (ht_info_ie[1] < sizeof(struct ieee80211_ht_info))
                 return;
 
+        memcpy(&ht_cap, &sband->ht_cap, sizeof(ht_cap));
+        ieee80211_apply_htcap_overrides(sdata, &ht_cap);
+
         ht_info = (struct ieee80211_ht_info *)(ht_info_ie + 2);
 
         /* determine capability flags */
+        cap = ht_cap.cap;
 
         switch (ht_info->ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
         case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
@@ -154,34 +161,8 @@ static void ieee80211_add_ht_ie(struct sk_buff *skb, const u8 *ht_info_ie,
         }
 
         /* reserve and fill IE */
-
         pos = skb_put(skb, sizeof(struct ieee80211_ht_cap) + 2);
-        *pos++ = WLAN_EID_HT_CAPABILITY;
-        *pos++ = sizeof(struct ieee80211_ht_cap);
-        memset(pos, 0, sizeof(struct ieee80211_ht_cap));
-
-        /* capability flags */
-        tmp = cpu_to_le16(cap);
-        memcpy(pos, &tmp, sizeof(u16));
-        pos += sizeof(u16);
-
-        /* AMPDU parameters */
-        *pos++ = sband->ht_cap.ampdu_factor |
-                 (sband->ht_cap.ampdu_density <<
-                        IEEE80211_HT_AMPDU_PARM_DENSITY_SHIFT);
-
-        /* MCS set */
-        memcpy(pos, &sband->ht_cap.mcs, sizeof(sband->ht_cap.mcs));
-        pos += sizeof(sband->ht_cap.mcs);
-
-        /* extended capabilities */
-        pos += sizeof(__le16);
-
-        /* BF capabilities */
-        pos += sizeof(__le32);
-
-        /* antenna selection */
-        pos += sizeof(u8);
+        ieee80211_ie_build_ht_cap(pos, &ht_cap, cap);
 }
 
 static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata,
@@ -356,7 +337,7 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata,
 
         if (wk->assoc.use_11n && wk->assoc.wmm_used &&
             local->hw.queues >= 4)
-                ieee80211_add_ht_ie(skb, wk->assoc.ht_information_ie,
+                ieee80211_add_ht_ie(sdata, skb, wk->assoc.ht_information_ie,
                                     sband, wk->chan, wk->assoc.smps);
 
         /* if present, add any custom non-vendor IEs that go after HT */
@@ -881,44 +862,6 @@ static void ieee80211_work_rx_queued_mgmt(struct ieee80211_local *local,
         kfree_skb(skb);
 }
 
-static bool ieee80211_work_ct_coexists(enum nl80211_channel_type wk_ct,
-                                       enum nl80211_channel_type oper_ct)
-{
-        switch (wk_ct) {
-        case NL80211_CHAN_NO_HT:
-                return true;
-        case NL80211_CHAN_HT20:
-                if (oper_ct != NL80211_CHAN_NO_HT)
-                        return true;
-                return false;
-        case NL80211_CHAN_HT40MINUS:
-        case NL80211_CHAN_HT40PLUS:
-                return (wk_ct == oper_ct);
-        }
-        WARN_ON(1); /* shouldn't get here */
-        return false;
-}
-
-static enum nl80211_channel_type
-ieee80211_calc_ct(enum nl80211_channel_type wk_ct,
-                  enum nl80211_channel_type oper_ct)
-{
-        switch (wk_ct) {
-        case NL80211_CHAN_NO_HT:
-                return oper_ct;
-        case NL80211_CHAN_HT20:
-                if (oper_ct != NL80211_CHAN_NO_HT)
-                        return oper_ct;
-                return wk_ct;
-        case NL80211_CHAN_HT40MINUS:
-        case NL80211_CHAN_HT40PLUS:
-                return wk_ct;
-        }
-        WARN_ON(1); /* shouldn't get here */
-        return wk_ct;
-}
-
-
 static void ieee80211_work_timer(unsigned long data)
 {
         struct ieee80211_local *local = (void *) data;
@@ -969,51 +912,12 @@ static void ieee80211_work_work(struct work_struct *work)
                 }
 
                 if (!started && !local->tmp_channel) {
-                        bool on_oper_chan;
-                        bool tmp_chan_changed = false;
-                        bool on_oper_chan2;
-                        enum nl80211_channel_type wk_ct;
-                        on_oper_chan = ieee80211_cfg_on_oper_channel(local);
-
-                        /* Work with existing channel type if possible. */
-                        wk_ct = wk->chan_type;
-                        if (wk->chan == local->hw.conf.channel)
-                                wk_ct = ieee80211_calc_ct(wk->chan_type,
-                                                local->hw.conf.channel_type);
-
-                        if (local->tmp_channel)
-                                if ((local->tmp_channel != wk->chan) ||
-                                    (local->tmp_channel_type != wk_ct))
-                                        tmp_chan_changed = true;
+                        ieee80211_offchannel_stop_vifs(local, true);
 
                         local->tmp_channel = wk->chan;
-                        local->tmp_channel_type = wk_ct;
-                        /*
-                         * Leave the station vifs in awake mode if they
-                         * happen to be on the same channel as
-                         * the requested channel.
-                         */
-                        on_oper_chan2 = ieee80211_cfg_on_oper_channel(local);
-                        if (on_oper_chan != on_oper_chan2) {
-                                if (on_oper_chan2) {
-                                        /* going off oper channel, PS too */
-                                        ieee80211_offchannel_stop_vifs(local,
-                                                                       true);
-                                        ieee80211_hw_config(local, 0);
-                                } else {
-                                        /* going on channel, but leave PS
-                                         * off-channel. */
-                                        ieee80211_hw_config(local, 0);
-                                        ieee80211_offchannel_return(local,
-                                                                    true,
-                                                                    false);
-                                }
-                        } else if (tmp_chan_changed)
-                                /* Still off-channel, but on some other
-                                 * channel, so update hardware.
-                                 * PS should already be off-channel.
-                                 */
-                                ieee80211_hw_config(local, 0);
+                        local->tmp_channel_type = wk->chan_type;
+
+                        ieee80211_hw_config(local, 0);
 
                         started = true;
                         wk->timeout = jiffies;
@@ -1082,34 +986,17 @@ static void ieee80211_work_work(struct work_struct *work)
         list_for_each_entry(wk, &local->work_list, list) {
                 if (!wk->started)
                         continue;
-                if (wk->chan != local->tmp_channel)
-                        continue;
-                if (!ieee80211_work_ct_coexists(wk->chan_type,
-                                                local->tmp_channel_type))
+                if (wk->chan != local->tmp_channel ||
+                    wk->chan_type != local->tmp_channel_type)
                         continue;
                 remain_off_channel = true;
         }
 
         if (!remain_off_channel && local->tmp_channel) {
                 local->tmp_channel = NULL;
-                /* If tmp_channel wasn't operating channel, then
-                 * we need to go back on-channel.
-                 * NOTE:  If we can ever be here while scannning,
-                 * or if the hw_config() channel config logic changes,
-                 * then we may need to do a more thorough check to see if
-                 * we still need to do a hardware config.  Currently,
-                 * we cannot be here while scanning, however.
-                 */
-                if (!ieee80211_cfg_on_oper_channel(local))
-                        ieee80211_hw_config(local, 0);
+                ieee80211_hw_config(local, 0);
 
-                /* At the least, we need to disable offchannel_ps,
-                 * so just go ahead and run the entire offchannel
-                 * return logic here.  We *could* skip enabling
-                 * beaconing if we were already on-oper-channel
-                 * as a future optimization.
-                 */
-                ieee80211_offchannel_return(local, true, true);
+                ieee80211_offchannel_return(local, true);
 
                 /* give connection some time to breathe */
                 run_again(local, jiffies + HZ/2);
diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c
index f614ce7bb6e3..93aab0715e8a 100644
--- a/net/mac80211/wpa.c
+++ b/net/mac80211/wpa.c
@@ -223,14 +223,14 @@ static int tkip_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
 ieee80211_tx_result
 ieee80211_crypto_tkip_encrypt(struct ieee80211_tx_data *tx)
 {
-        struct sk_buff *skb = tx->skb;
+        struct sk_buff *skb;
 
         ieee80211_tx_set_protected(tx);
 
-        do {
+        skb_queue_walk(&tx->skbs, skb) {
                 if (tkip_encrypt_skb(tx, skb) < 0)
                         return TX_DROP;
-        } while ((skb = skb->next));
+        }
 
         return TX_CONTINUE;
 }
@@ -390,7 +390,8 @@ static int ccmp_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
         u8 scratch[6 * AES_BLOCK_SIZE];
 
         if (info->control.hw_key &&
-            !(info->control.hw_key->flags & IEEE80211_KEY_FLAG_GENERATE_IV)) {
+            !(info->control.hw_key->flags & IEEE80211_KEY_FLAG_GENERATE_IV) &&
+            !(info->control.hw_key->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE)) {
                 /*
                  * hwaccel has no need for preallocated room for CCMP
                  * header or MIC fields
@@ -412,6 +413,12 @@ static int ccmp_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
 
         pos = skb_push(skb, CCMP_HDR_LEN);
         memmove(pos, pos + CCMP_HDR_LEN, hdrlen);
+
+        /* the HW only needs room for the IV, but not the actual IV */
+        if (info->control.hw_key &&
+            (info->control.hw_key->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE))
+                return 0;
+
         hdr = (struct ieee80211_hdr *) pos;
         pos += hdrlen;
 
@@ -442,14 +449,14 @@ static int ccmp_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
 ieee80211_tx_result
 ieee80211_crypto_ccmp_encrypt(struct ieee80211_tx_data *tx)
 {
-        struct sk_buff *skb = tx->skb;
+        struct sk_buff *skb;
 
         ieee80211_tx_set_protected(tx);
 
-        do {
+        skb_queue_walk(&tx->skbs, skb) {
                 if (ccmp_encrypt_skb(tx, skb) < 0)
                         return TX_DROP;
-        } while ((skb = skb->next));
+        }
 
         return TX_CONTINUE;
 }
@@ -547,15 +554,22 @@ static inline void bip_ipn_swap(u8 *d, const u8 *s)
 ieee80211_tx_result
 ieee80211_crypto_aes_cmac_encrypt(struct ieee80211_tx_data *tx)
 {
-        struct sk_buff *skb = tx->skb;
-        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+        struct sk_buff *skb;
+        struct ieee80211_tx_info *info;
         struct ieee80211_key *key = tx->key;
         struct ieee80211_mmie *mmie;
         u8 aad[20];
         u64 pn64;
 
+        if (WARN_ON(skb_queue_len(&tx->skbs) != 1))
+                return TX_DROP;
+
+        skb = skb_peek(&tx->skbs);
+
+        info = IEEE80211_SKB_CB(skb);
+
         if (info->control.hw_key)
-                return 0;
+                return TX_CONTINUE;
 
         if (WARN_ON(skb_tailroom(skb) < sizeof(*mmie)))
                 return TX_DROP;