12 files changed, 199 insertions, 81 deletions
diff --git a/net/mac80211/driver-trace.c b/net/mac80211/driver-trace.c
index 6da6f79932fc..8ed8711b1a6d 100644
--- a/net/mac80211/driver-trace.c
+++ b/net/mac80211/driver-trace.c
@@ -1,6 +1,9 @@
 /* bug in tracepoint.h, it should include this */
 #include <linux/module.h>
+/* sparse isn't too happy with all macros... */
+#ifndef __CHECKER__
 #include "driver-ops.h"
 #define CREATE_TRACE_POINTS
 #include "driver-trace.h"
+#endif
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index 6e3cca65c460..920ec8792f4b 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -781,7 +781,7 @@ static void ieee80211_ibss_timer(unsigned long data)
        }
        set_bit(IEEE80211_IBSS_REQ_RUN, &ifibss->request);
-        queue_work(local->hw.workqueue, &ifibss->work);
+        ieee80211_queue_work(&local->hw, &ifibss->work);
 }
 #ifdef CONFIG_PM
@@ -853,7 +853,7 @@ ieee80211_ibss_rx_mgmt(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb)
        case IEEE80211_STYPE_PROBE_REQ:
        case IEEE80211_STYPE_AUTH:
                skb_queue_tail(&sdata->u.ibss.skb_queue, skb);
-                queue_work(local->hw.workqueue, &sdata->u.ibss.work);
+                ieee80211_queue_work(&local->hw, &sdata->u.ibss.work);
                return RX_QUEUED;
        }
@@ -912,7 +912,7 @@ int ieee80211_ibss_join(struct ieee80211_sub_if_data *sdata,
        ieee80211_recalc_idle(sdata->local);
        set_bit(IEEE80211_IBSS_REQ_RUN, &sdata->u.ibss.request);
-        queue_work(sdata->local->hw.workqueue, &sdata->u.ibss.work);
+        ieee80211_queue_work(&sdata->local->hw, &sdata->u.ibss.work);
        return 0;
 }
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index aec6853cb435..630a438180fd 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -280,6 +280,7 @@ struct ieee80211_if_managed {
        struct work_struct beacon_loss_work;
        unsigned long probe_timeout;
+        int probe_send_count;
        struct mutex mtx;
        struct ieee80211_bss *associated;
@@ -614,6 +615,12 @@ struct ieee80211_local {
        const struct ieee80211_ops *ops;
+        /*
+         * private workqueue to mac80211. mac80211 makes this accessible
+         * via ieee80211_queue_work()
+         */
+        struct workqueue_struct *workqueue;
        unsigned long queue_stop_reasons[IEEE80211_MAX_QUEUES];
        /* also used to protect ampdu_ac_queue and amdpu_ac_stop_refcnt */
        spinlock_t queue_stop_reason_lock;
@@ -621,7 +628,7 @@ struct ieee80211_local {
        int open_count;
        int monitors, cooked_mntrs;
        /* number of interfaces with corresponding FIF_ flags */
-        int fif_fcsfail, fif_plcpfail, fif_control, fif_other_bss;
+        int fif_fcsfail, fif_plcpfail, fif_control, fif_other_bss, fif_pspoll;
        unsigned int filter_flags; /* FIF_* */
        struct iw_statistics wstats;
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 6c655b6547fb..e8fb03b91a44 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -220,8 +220,10 @@ static int ieee80211_open(struct net_device *dev)
                        local->fif_fcsfail++;
                if (sdata->u.mntr_flags & MONITOR_FLAG_PLCPFAIL)
                        local->fif_plcpfail++;
-                if (sdata->u.mntr_flags & MONITOR_FLAG_CONTROL)
+                if (sdata->u.mntr_flags & MONITOR_FLAG_CONTROL) {
                        local->fif_control++;
+                        local->fif_pspoll++;
+                }
                if (sdata->u.mntr_flags & MONITOR_FLAG_OTHER_BSS)
                        local->fif_other_bss++;
@@ -244,7 +246,14 @@ static int ieee80211_open(struct net_device *dev)
                        spin_unlock_bh(&local->filter_lock);
                        ieee80211_start_mesh(sdata);
+                } else if (sdata->vif.type == NL80211_IFTYPE_AP) {
+                        local->fif_pspoll++;
+                        spin_lock_bh(&local->filter_lock);
+                        ieee80211_configure_filter(local);
+                        spin_unlock_bh(&local->filter_lock);
                }
                changed |= ieee80211_reset_erp_info(sdata);
                ieee80211_bss_info_change_notify(sdata, changed);
                ieee80211_enable_keys(sdata);
@@ -312,7 +321,7 @@ static int ieee80211_open(struct net_device *dev)
         * to fix this.
         */
        if (sdata->vif.type == NL80211_IFTYPE_STATION)
-                queue_work(local->hw.workqueue, &sdata->u.mgd.work);
+                ieee80211_queue_work(&local->hw, &sdata->u.mgd.work);
        netif_tx_start_all_queues(dev);
@@ -388,6 +397,9 @@ static int ieee80211_stop(struct net_device *dev)
        if (sdata->flags & IEEE80211_SDATA_PROMISC)
                atomic_dec(&local->iff_promiscs);
+        if (sdata->vif.type == NL80211_IFTYPE_AP)
+                local->fif_pspoll--;
        netif_addr_lock_bh(dev);
        spin_lock_bh(&local->filter_lock);
        __dev_addr_unsync(&local->mc_list, &local->mc_count,
@@ -401,7 +413,7 @@ static int ieee80211_stop(struct net_device *dev)
        /* APs need special treatment */
        if (sdata->vif.type == NL80211_IFTYPE_AP) {
-                struct ieee80211_sub_if_data *vlan, *tmp;
+                struct ieee80211_sub_if_data *vlan, *tmpsdata;
                struct beacon_data *old_beacon = sdata->u.ap.beacon;
                /* remove beacon */
@@ -410,7 +422,7 @@ static int ieee80211_stop(struct net_device *dev)
                kfree(old_beacon);
                /* down all dependent devices, that is VLANs */
-                list_for_each_entry_safe(vlan, tmp, &sdata->u.ap.vlans,
+                list_for_each_entry_safe(vlan, tmpsdata, &sdata->u.ap.vlans,
                                         u.vlan.list)
                        dev_close(vlan->dev);
                WARN_ON(!list_empty(&sdata->u.ap.vlans));
@@ -439,8 +451,10 @@ static int ieee80211_stop(struct net_device *dev)
                        local->fif_fcsfail--;
                if (sdata->u.mntr_flags & MONITOR_FLAG_PLCPFAIL)
                        local->fif_plcpfail--;
-                if (sdata->u.mntr_flags & MONITOR_FLAG_CONTROL)
+                if (sdata->u.mntr_flags & MONITOR_FLAG_CONTROL) {
+                        local->fif_pspoll--;
                        local->fif_control--;
+                }
                if (sdata->u.mntr_flags & MONITOR_FLAG_OTHER_BSS)
                        local->fif_other_bss--;
@@ -522,6 +536,16 @@ static int ieee80211_stop(struct net_device *dev)
                                ieee80211_scan_completed(&local->hw, true);
                }
+                /*
+                 * Disable beaconing for AP and mesh, IBSS can't
+                 * still be joined to a network at this point.
+                 */
+                if (sdata->vif.type == NL80211_IFTYPE_AP ||
+                    sdata->vif.type == NL80211_IFTYPE_MESH_POINT) {
+                        ieee80211_bss_info_change_notify(sdata,
+                                BSS_CHANGED_BEACON_ENABLED);
+                }
                conf.vif = &sdata->vif;
                conf.type = sdata->vif.type;
                conf.mac_addr = dev->dev_addr;
@@ -541,7 +565,7 @@ static int ieee80211_stop(struct net_device *dev)
                ieee80211_led_radio(local, false);
-                flush_workqueue(local->hw.workqueue);
+                flush_workqueue(local->workqueue);
                tasklet_disable(&local->tx_pending_tasklet);
                tasklet_disable(&local->tasklet);
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index c1a799194fff..0c4f8e122ed6 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -77,6 +77,9 @@ void ieee80211_configure_filter(struct ieee80211_local *local)
        if (local->fif_other_bss)
                new_flags |= FIF_OTHER_BSS;
+        if (local->fif_pspoll)
+                new_flags |= FIF_PSPOLL;
        changed_flags = local->filter_flags ^ new_flags;
        /* be a bit nasty */
@@ -198,7 +201,8 @@ void ieee80211_bss_info_change_notify(struct ieee80211_sub_if_data *sdata,
        }
        if (changed & BSS_CHANGED_BEACON_ENABLED) {
-                if (test_bit(SCAN_SW_SCANNING, &local->scanning)) {
+                if (local->quiescing || !netif_running(sdata->dev) ||
+                    test_bit(SCAN_SW_SCANNING, &local->scanning)) {
                        sdata->vif.bss_conf.enable_beacon = false;
                } else {
                        /*
@@ -310,6 +314,31 @@ static void ieee80211_handle_filtered_frame(struct ieee80211_local *local,
 {
        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+        /*
+         * XXX: This is temporary!
+         *
+         *      The problem here is that when we get here, the driver will
+         *      quite likely have pretty much overwritten info->control by
+         *      using info->driver_data or info->rate_driver_data. Thus,
+         *      when passing out the frame to the driver again, we would be
+         *      passing completely bogus data since the driver would then
+         *      expect a properly filled info->control. In mac80211 itself
+         *      the same problem occurs, since we need info->control.vif
+         *      internally.
+         *
+         *      To fix this, we should send the frame through TX processing
+         *      again. However, it's not that simple, since the frame will
+         *      have been software-encrypted (if applicable) already, and
+         *      encrypting it again doesn't do much good. So to properly do
+         *      that, we not only have to skip the actual 'raw' encryption
+         *      (key selection etc. still has to be done!) but also the
+         *      sequence number assignment since that impacts the crypto
+         *      encapsulation, of course.
+         *
+         *      Hence, for now, fix the bug by just dropping the frame.
+         */
+        goto drop;
        sta->tx_filtered_count++;
        /*
@@ -363,6 +392,7 @@ static void ieee80211_handle_filtered_frame(struct ieee80211_local *local,
                return;
        }
+ drop:
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
        if (net_ratelimit())
                printk(KERN_DEBUG "%s: dropped TX filtered frame, "
@@ -794,9 +824,9 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
        if (hw->queues > IEEE80211_MAX_QUEUES)
                hw->queues = IEEE80211_MAX_QUEUES;
-        local->hw.workqueue =
+        local->workqueue =
                create_singlethread_workqueue(wiphy_name(local->hw.wiphy));
-        if (!local->hw.workqueue) {
+        if (!local->workqueue) {
                result = -ENOMEM;
                goto fail_workqueue;
        }
@@ -886,7 +916,7 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
        sta_info_stop(local);
 fail_sta_info:
        debugfs_hw_del(local);
-        destroy_workqueue(local->hw.workqueue);
+        destroy_workqueue(local->workqueue);
 fail_workqueue:
        wiphy_unregister(local->hw.wiphy);
 fail_wiphy_register:
@@ -928,7 +958,7 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw)
        skb_queue_purge(&local->skb_queue);
        skb_queue_purge(&local->skb_queue_unreliable);
-        destroy_workqueue(local->hw.workqueue);
+        destroy_workqueue(local->workqueue);
        wiphy_unregister(local->hw.wiphy);
        ieee80211_wep_free(local);
        ieee80211_led_exit(local);
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index 9a3826978b1c..2f4f518ab45c 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -54,7 +54,7 @@ static void ieee80211_mesh_housekeeping_timer(unsigned long data)
                return;
        }
-        queue_work(local->hw.workqueue, &ifmsh->work);
+        ieee80211_queue_work(local->hw.workqueue, &ifmsh->work);
 }
 /**
@@ -357,7 +357,7 @@ static void ieee80211_mesh_path_timer(unsigned long data)
                return;
        }
-        queue_work(local->hw.workqueue, &ifmsh->work);
+        ieee80211_queue_work(local->hw.workqueue, &ifmsh->work);
 }
 struct mesh_table *mesh_table_grow(struct mesh_table *tbl)
@@ -471,7 +471,7 @@ void ieee80211_start_mesh(struct ieee80211_sub_if_data *sdata)
        struct ieee80211_local *local = sdata->local;
        ifmsh->housekeeping = true;
-        queue_work(local->hw.workqueue, &ifmsh->work);
+        ieee80211_queue_work(local->hw.workqueue, &ifmsh->work);
        ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON |
                                                BSS_CHANGED_BEACON_ENABLED);
 }
@@ -619,7 +619,7 @@ void ieee80211_mesh_notify_scan_completed(struct ieee80211_local *local)
        rcu_read_lock();
        list_for_each_entry_rcu(sdata, &local->interfaces, list)
                if (ieee80211_vif_is_mesh(&sdata->vif))
-                        queue_work(local->hw.workqueue, &sdata->u.mesh.work);
+                        ieee80211_queue_work(local->hw.workqueue, &sdata->u.mesh.work);
        rcu_read_unlock();
 }
@@ -692,7 +692,7 @@ ieee80211_mesh_rx_mgmt(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb)
        case IEEE80211_STYPE_PROBE_RESP:
        case IEEE80211_STYPE_BEACON:
                skb_queue_tail(&ifmsh->skb_queue, skb);
-                queue_work(local->hw.workqueue, &ifmsh->work);
+                ieee80211_queue_work(local->hw.workqueue, &ifmsh->work);
                return RX_QUEUED;
        }
diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
index e93c37ef6a48..11ab71a68ff9 100644
--- a/net/mac80211/mesh_hwmp.c
+++ b/net/mac80211/mesh_hwmp.c
@@ -660,14 +660,14 @@ static void mesh_queue_preq(struct mesh_path *mpath, u8 flags)
        spin_unlock(&ifmsh->mesh_preq_queue_lock);
        if (time_after(jiffies, ifmsh->last_preq + min_preq_int_jiff(sdata)))
-                queue_work(sdata->local->hw.workqueue, &ifmsh->work);
+                ieee80211_queue_work(sdata->local->hw.workqueue, &ifmsh->work);
        else if (time_before(jiffies, ifmsh->last_preq)) {
                /* avoid long wait if did not send preqs for a long time
                 * and jiffies wrapped around
                 */
                ifmsh->last_preq = jiffies - min_preq_int_jiff(sdata) - 1;
-                queue_work(sdata->local->hw.workqueue, &ifmsh->work);
+                ieee80211_queue_work(sdata->local->hw.workqueue, &ifmsh->work);
        } else
                mod_timer(&ifmsh->mesh_path_timer, ifmsh->last_preq +
                                                min_preq_int_jiff(sdata));
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index ee83125ed179..6d5a1ee0445f 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -31,6 +31,7 @@
 #define IEEE80211_AUTH_MAX_TRIES 3
 #define IEEE80211_ASSOC_TIMEOUT (HZ / 5)
 #define IEEE80211_ASSOC_MAX_TRIES 3
+#define IEEE80211_MAX_PROBE_TRIES 5
 /*
 * beacon loss detection timeout
@@ -41,13 +42,13 @@
 * Time the connection can be idle before we probe
 * it to see if we can still talk to the AP.
 */
-#define IEEE80211_CONNECTION_IDLE_TIME  (2 * HZ)
+#define IEEE80211_CONNECTION_IDLE_TIME  (30 * HZ)
 /*
 * Time we wait for a probe response after sending
 * a probe request because of beacon loss or for
 * checking the connection still works.
 */
-#define IEEE80211_PROBE_WAIT            (HZ / 5)
+#define IEEE80211_PROBE_WAIT            (HZ / 2)
 #define TMR_RUNNING_TIMER       0
 #define TMR_RUNNING_CHANSW      1
@@ -565,7 +566,7 @@ static void ieee80211_chswitch_timer(unsigned long data)
                return;
        }
-        queue_work(sdata->local->hw.workqueue, &ifmgd->chswitch_work);
+        ieee80211_queue_work(&sdata->local->hw, &ifmgd->chswitch_work);
 }
 void ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
@@ -597,7 +598,7 @@ void ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
        sdata->local->csa_channel = new_ch;
        if (sw_elem->count <= 1) {
-                queue_work(sdata->local->hw.workqueue, &ifmgd->chswitch_work);
+                ieee80211_queue_work(&sdata->local->hw, &ifmgd->chswitch_work);
        } else {
                ieee80211_stop_queues_by_reason(&sdata->local->hw,
                                        IEEE80211_QUEUE_STOP_REASON_CSA);
@@ -763,7 +764,7 @@ void ieee80211_dynamic_ps_timer(unsigned long data)
        if (local->quiescing || local->suspended)
                return;
-        queue_work(local->hw.workqueue, &local->dynamic_ps_enable_work);
+        ieee80211_queue_work(&local->hw, &local->dynamic_ps_enable_work);
 }
 /* MLME */
@@ -916,12 +917,9 @@ static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
        ieee80211_bss_info_change_notify(sdata, bss_info_changed);
-        /* will be same as sdata */
+        mutex_lock(&local->iflist_mtx);
-        if (local->ps_sdata) {
+        ieee80211_recalc_ps(local, -1);
-                mutex_lock(&local->iflist_mtx);
+        mutex_unlock(&local->iflist_mtx);
-                ieee80211_recalc_ps(local, -1);
-                mutex_unlock(&local->iflist_mtx);
-        }
        netif_tx_start_all_queues(sdata->dev);
        netif_carrier_on(sdata->dev);
@@ -950,7 +948,7 @@ ieee80211_direct_probe(struct ieee80211_sub_if_data *sdata,
                 * due to work needing to be done. Hence, queue the STAs work
                 * again for that.
                 */
-                queue_work(local->hw.workqueue, &ifmgd->work);
+                ieee80211_queue_work(&local->hw, &ifmgd->work);
                return RX_MGMT_CFG80211_AUTH_TO;
        }
@@ -995,7 +993,7 @@ ieee80211_authenticate(struct ieee80211_sub_if_data *sdata,
                 * due to work needing to be done. Hence, queue the STAs work
                 * again for that.
                 */
-                queue_work(local->hw.workqueue, &ifmgd->work);
+                ieee80211_queue_work(&local->hw, &ifmgd->work);
                return RX_MGMT_CFG80211_AUTH_TO;
        }
@@ -1124,7 +1122,7 @@ ieee80211_associate(struct ieee80211_sub_if_data *sdata,
                 * due to work needing to be done. Hence, queue the STAs work
                 * again for that.
                 */
-                queue_work(local->hw.workqueue, &ifmgd->work);
+                ieee80211_queue_work(&local->hw, &ifmgd->work);
                return RX_MGMT_CFG80211_ASSOC_TO;
        }
@@ -1156,11 +1154,24 @@ void ieee80211_sta_rx_notify(struct ieee80211_sub_if_data *sdata,
                  round_jiffies_up(jiffies + IEEE80211_CONNECTION_IDLE_TIME));
 }
+static void ieee80211_mgd_probe_ap_send(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+        const u8 *ssid;
+        ssid = ieee80211_bss_get_ie(&ifmgd->associated->cbss, WLAN_EID_SSID);
+        ieee80211_send_probe_req(sdata, ifmgd->associated->cbss.bssid,
+                                 ssid + 2, ssid[1], NULL, 0);
+        ifmgd->probe_send_count++;
+        ifmgd->probe_timeout = jiffies + IEEE80211_PROBE_WAIT;
+        run_again(ifmgd, ifmgd->probe_timeout);
+}
 static void ieee80211_mgd_probe_ap(struct ieee80211_sub_if_data *sdata,
                                   bool beacon)
 {
        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
-        const u8 *ssid;
        bool already = false;
        if (!netif_running(sdata->dev))
@@ -1203,18 +1214,12 @@ static void ieee80211_mgd_probe_ap(struct ieee80211_sub_if_data *sdata,
        if (already)
                goto out;
-        ifmgd->probe_timeout = jiffies + IEEE80211_PROBE_WAIT;
        mutex_lock(&sdata->local->iflist_mtx);
        ieee80211_recalc_ps(sdata->local, -1);
        mutex_unlock(&sdata->local->iflist_mtx);
-        ssid = ieee80211_bss_get_ie(&ifmgd->associated->cbss, WLAN_EID_SSID);
+        ifmgd->probe_send_count = 0;
-        ieee80211_send_probe_req(sdata, ifmgd->associated->cbss.bssid,
+        ieee80211_mgd_probe_ap_send(sdata);
-                                 ssid + 2, ssid[1], NULL, 0);
-        run_again(ifmgd, ifmgd->probe_timeout);
 out:
        mutex_unlock(&ifmgd->mtx);
 }
@@ -1232,8 +1237,7 @@ void ieee80211_beacon_loss(struct ieee80211_vif *vif)
 {
        struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
-        queue_work(sdata->local->hw.workqueue,
+        ieee80211_queue_work(&sdata->local->hw, &sdata->u.mgd.beacon_loss_work);
-                   &sdata->u.mgd.beacon_loss_work);
 }
 EXPORT_SYMBOL(ieee80211_beacon_loss);
@@ -1570,6 +1574,9 @@ ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
                                               wk->bss->cbss.bssid,
                                               ap_ht_cap_flags);
+        /* delete work item -- must be before set_associated for PS */
+        list_del(&wk->list);
        /* set AID and assoc capability,
         * ieee80211_set_associated() will tell the driver */
        bss_conf->aid = aid;
@@ -1583,7 +1590,6 @@ ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
        ieee80211_sta_rx_notify(sdata, (struct ieee80211_hdr *)mgmt);
        mod_beacon_timer(sdata);
-        list_del(&wk->list);
        kfree(wk);
        return RX_MGMT_CFG80211_ASSOC;
 }
@@ -1847,12 +1853,8 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
                                               bssid, ap_ht_cap_flags);
        }
+        /* Note: country IE parsing is done for us by cfg80211 */
        if (elems.country_elem) {
-                /* Note we are only reviewing this on beacons
-                 * for the BSSID we are associated to */
-                regulatory_hint_11d(local->hw.wiphy,
-                        elems.country_elem, elems.country_elem_len);
                /* TODO: IBSS also needs this */
                if (elems.pwr_constr_elem)
                        ieee80211_handle_pwr_constr(sdata,
@@ -1888,7 +1890,7 @@ ieee80211_rx_result ieee80211_sta_rx_mgmt(struct ieee80211_sub_if_data *sdata,
        case IEEE80211_STYPE_DISASSOC:
        case IEEE80211_STYPE_ACTION:
                skb_queue_tail(&sdata->u.mgd.skb_queue, skb);
-                queue_work(local->hw.workqueue, &sdata->u.mgd.work);
+                ieee80211_queue_work(&local->hw, &sdata->u.mgd.work);
                return RX_QUEUED;
        }
@@ -2026,7 +2028,7 @@ static void ieee80211_sta_timer(unsigned long data)
                return;
        }
-        queue_work(local->hw.workqueue, &ifmgd->work);
+        ieee80211_queue_work(&local->hw, &ifmgd->work);
 }
 static void ieee80211_sta_work(struct work_struct *work)
@@ -2051,13 +2053,11 @@ static void ieee80211_sta_work(struct work_struct *work)
                return;
        /*
-         * Nothing should have been stuffed into the workqueue during
+         * ieee80211_queue_work() should have picked up most cases,
-         * the suspend->resume cycle. If this WARN is seen then there
+         * here we'll pick the the rest.
-         * is a bug with either the driver suspend or something in
-         * mac80211 stuffing into the workqueue which we haven't yet
-         * cleared during mac80211's suspend cycle.
         */
-        if (WARN_ON(local->suspended))
+        if (WARN(local->suspended, "STA MLME work scheduled while "
+                 "going to suspend\n"))
                return;
        ifmgd = &sdata->u.mgd;
@@ -2072,17 +2072,27 @@ static void ieee80211_sta_work(struct work_struct *work)
        if (ifmgd->flags & (IEEE80211_STA_BEACON_POLL |
                            IEEE80211_STA_CONNECTION_POLL) &&
            ifmgd->associated) {
+                u8 bssid[ETH_ALEN];
+                memcpy(bssid, ifmgd->associated->cbss.bssid, ETH_ALEN);
                if (time_is_after_jiffies(ifmgd->probe_timeout))
                        run_again(ifmgd, ifmgd->probe_timeout);
-                else {
-                        u8 bssid[ETH_ALEN];
+                else if (ifmgd->probe_send_count < IEEE80211_MAX_PROBE_TRIES) {
+#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
+                        printk(KERN_DEBUG "No probe response from AP %pM"
+                                " after %dms, try %d\n", bssid,
+                                (1000 * IEEE80211_PROBE_WAIT)/HZ,
+                                ifmgd->probe_send_count);
+#endif
+                        ieee80211_mgd_probe_ap_send(sdata);
+                } else {
                        /*
                         * We actually lost the connection ... or did we?
                         * Let's make sure!
                         */
                        ifmgd->flags &= ~(IEEE80211_STA_CONNECTION_POLL |
                                          IEEE80211_STA_BEACON_POLL);
-                        memcpy(bssid, ifmgd->associated->cbss.bssid, ETH_ALEN);
                        printk(KERN_DEBUG "No probe response from AP %pM"
                                " after %dms, disconnecting.\n",
                                bssid, (1000 * IEEE80211_PROBE_WAIT)/HZ);
@@ -2113,9 +2123,9 @@ static void ieee80211_sta_work(struct work_struct *work)
                mutex_unlock(&ifmgd->mtx);
                if (test_and_clear_bit(IEEE80211_STA_REQ_SCAN, &ifmgd->request))
-                        queue_delayed_work(local->hw.workqueue,
+                        ieee80211_queue_delayed_work(&local->hw,
-                                           &local->scan_work,
+                                                     &local->scan_work,
-                                           round_jiffies_relative(0));
+                                                     round_jiffies_relative(0));
                return;
        }
@@ -2196,8 +2206,7 @@ static void ieee80211_sta_bcn_mon_timer(unsigned long data)
        if (local->quiescing)
                return;
-        queue_work(sdata->local->hw.workqueue,
+        ieee80211_queue_work(&sdata->local->hw, &sdata->u.mgd.beacon_loss_work);
-                   &sdata->u.mgd.beacon_loss_work);
 }
 static void ieee80211_sta_conn_mon_timer(unsigned long data)
@@ -2210,7 +2219,7 @@ static void ieee80211_sta_conn_mon_timer(unsigned long data)
        if (local->quiescing)
                return;
-        queue_work(local->hw.workqueue, &ifmgd->monitor_work);
+        ieee80211_queue_work(&local->hw, &ifmgd->monitor_work);
 }
 static void ieee80211_sta_monitor_work(struct work_struct *work)
@@ -2229,10 +2238,10 @@ static void ieee80211_restart_sta_timer(struct ieee80211_sub_if_data *sdata)
                                        IEEE80211_STA_CONNECTION_POLL);
                /* let's probe the connection once */
-                queue_work(sdata->local->hw.workqueue,
+                ieee80211_queue_work(&sdata->local->hw,
                           &sdata->u.mgd.monitor_work);
                /* and do all the other regular work too */
-                queue_work(sdata->local->hw.workqueue,
+                ieee80211_queue_work(&sdata->local->hw,
                           &sdata->u.mgd.work);
        }
 }
@@ -2393,7 +2402,7 @@ int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata,
        list_add(&wk->list, &sdata->u.mgd.work_list);
        mutex_unlock(&ifmgd->mtx);
-        queue_work(sdata->local->hw.workqueue, &sdata->u.mgd.work);
+        ieee80211_queue_work(&sdata->local->hw, &sdata->u.mgd.work);
        return 0;
 }
@@ -2467,7 +2476,7 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
        else
                ifmgd->flags &= ~IEEE80211_STA_CONTROL_PORT;
-        queue_work(sdata->local->hw.workqueue, &sdata->u.mgd.work);
+        ieee80211_queue_work(&sdata->local->hw, &sdata->u.mgd.work);
        err = 0;
diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c
index 5e3d476972f9..a5d2f1fb4417 100644
--- a/net/mac80211/pm.c
+++ b/net/mac80211/pm.c
@@ -26,7 +26,7 @@ int __ieee80211_suspend(struct ieee80211_hw *hw)
        /* make quiescing visible to timers everywhere */
        mb();
-        flush_workqueue(local->hw.workqueue);
+        flush_workqueue(local->workqueue);
        /* Don't try to run timers while suspended. */
        del_timer_sync(&local->sta_cleanup);
@@ -96,6 +96,10 @@ int __ieee80211_suspend(struct ieee80211_hw *hw)
                if (!netif_running(sdata->dev))
                        continue;
+                /* disable beaconing */
+                ieee80211_bss_info_change_notify(sdata,
+                        BSS_CHANGED_BEACON_ENABLED);
                conf.vif = &sdata->vif;
                conf.type = sdata->vif.type;
                conf.mac_addr = sdata->dev->dev_addr;
@@ -113,7 +117,7 @@ int __ieee80211_suspend(struct ieee80211_hw *hw)
         * shouldn't be doing (or cancel everything in the
         * stop callback) that but better safe than sorry.
         */
-        flush_workqueue(local->hw.workqueue);
+        flush_workqueue(local->workqueue);
        local->suspended = true;
        /* need suspended to be visible before quiescing is false */
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index 45731000eb8d..244f53f3c8b4 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -385,8 +385,9 @@ static int ieee80211_start_sw_scan(struct ieee80211_local *local)
        spin_unlock_bh(&local->filter_lock);
        /* TODO: start scan as soon as all nullfunc frames are ACKed */
-        queue_delayed_work(local->hw.workqueue, &local->scan_work,
+        ieee80211_queue_delayed_work(&local->hw,
-                           IEEE80211_CHANNEL_TIME);
+                                     &local->scan_work,
+                                     IEEE80211_CHANNEL_TIME);
        return 0;
 }
@@ -715,8 +716,7 @@ void ieee80211_scan_work(struct work_struct *work)
                }
        } while (next_delay == 0);
-        queue_delayed_work(local->hw.workqueue, &local->scan_work,
+        ieee80211_queue_delayed_work(&local->hw, &local->scan_work, next_delay);
-                           next_delay);
 }
 int ieee80211_request_scan(struct ieee80211_sub_if_data *sdata,
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 4e1b2ba122cd..7cffaa046b33 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1400,7 +1400,7 @@ static void ieee80211_xmit(struct ieee80211_sub_if_data *sdata,
                if (local->hw.conf.flags & IEEE80211_CONF_PS) {
                        ieee80211_stop_queues_by_reason(&local->hw,
                                        IEEE80211_QUEUE_STOP_REASON_PS);
-                        queue_work(local->hw.workqueue,
+                        ieee80211_queue_work(&local->hw,
                                        &local->dynamic_ps_disable_work);
                }
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 8502936e5314..e55d57f559ec 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -511,6 +511,46 @@ void ieee80211_iterate_active_interfaces_atomic(
 }
 EXPORT_SYMBOL_GPL(ieee80211_iterate_active_interfaces_atomic);
+/*
+ * Nothing should have been stuffed into the workqueue during
+ * the suspend->resume cycle. If this WARN is seen then there
+ * is a bug with either the driver suspend or something in
+ * mac80211 stuffing into the workqueue which we haven't yet
+ * cleared during mac80211's suspend cycle.
+ */
+static bool ieee80211_can_queue_work(struct ieee80211_local *local)
+{
+        if (WARN(local->suspended, "queueing ieee80211 work while "
+                 "going to suspend\n"))
+                return false;
+        return true;
+}
+void ieee80211_queue_work(struct ieee80211_hw *hw, struct work_struct *work)
+{
+        struct ieee80211_local *local = hw_to_local(hw);
+        if (!ieee80211_can_queue_work(local))
+                return;
+        queue_work(local->workqueue, work);
+}
+EXPORT_SYMBOL(ieee80211_queue_work);
+void ieee80211_queue_delayed_work(struct ieee80211_hw *hw,
+                                  struct delayed_work *dwork,
+                                  unsigned long delay)
+{
+        struct ieee80211_local *local = hw_to_local(hw);
+        if (!ieee80211_can_queue_work(local))
+                return;
+        queue_delayed_work(local->workqueue, dwork, delay);
+}
+EXPORT_SYMBOL(ieee80211_queue_delayed_work);
 void ieee802_11_parse_elems(u8 *start, size_t len,
                            struct ieee802_11_elems *elems)
 {
@@ -1114,3 +1154,4 @@ int ieee80211_reconfig(struct ieee80211_local *local)
 #endif
        return 0;
 }