Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next-2.6

14 files changed, 458 insertions, 151 deletions

diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 4bc8a9250cf..845c76d58d2 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -1215,6 +1215,9 @@ static int ieee80211_set_channel(struct wiphy *wiphy,
 {
         struct ieee80211_local *local = wiphy_priv(wiphy);
         struct ieee80211_sub_if_data *sdata = NULL;
+        struct ieee80211_channel *old_oper;
+        enum nl80211_channel_type old_oper_type;
+        enum nl80211_channel_type old_vif_oper_type= NL80211_CHAN_NO_HT;
 
         if (netdev)
                 sdata = IEEE80211_DEV_TO_SUB_IF(netdev);
@@ -1232,13 +1235,23 @@ static int ieee80211_set_channel(struct wiphy *wiphy,
                 break;
         }
 
-        local->oper_channel = chan;
+        if (sdata)
+                old_vif_oper_type = sdata->vif.bss_conf.channel_type;
+        old_oper_type = local->_oper_channel_type;
 
         if (!ieee80211_set_channel_type(local, sdata, channel_type))
                 return -EBUSY;
 
-        ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);
-        if (sdata && sdata->vif.type != NL80211_IFTYPE_MONITOR)
+        old_oper = local->oper_channel;
+        local->oper_channel = chan;
+
+        /* Update driver if changes were actually made. */
+        if ((old_oper != local->oper_channel) ||
+            (old_oper_type != local->_oper_channel_type))
+                ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);
+
+        if ((sdata && sdata->vif.type != NL80211_IFTYPE_MONITOR) &&
+            old_vif_oper_type != sdata->vif.bss_conf.channel_type)
                 ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_HT);
 
         return 0;
@@ -1274,8 +1287,11 @@ static int ieee80211_scan(struct wiphy *wiphy,
         case NL80211_IFTYPE_P2P_GO:
                 if (sdata->local->ops->hw_scan)
                         break;
-                /* FIXME: implement NoA while scanning in software */
-                return -EOPNOTSUPP;
+                /*
+                 * FIXME: implement NoA while scanning in software,
+                 * for now fall through to allow scanning only when
+                 * beaconing hasn't been configured yet
+                 */
         case NL80211_IFTYPE_AP:
                 if (sdata->u.ap.beacon)
                         return -EOPNOTSUPP;
diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c
index 872adb86200..dacace6b139 100644
--- a/net/mac80211/debugfs_netdev.c
+++ b/net/mac80211/debugfs_netdev.c
@@ -36,7 +36,7 @@ static ssize_t ieee80211_if_read(
                 ret = (*format)(sdata, buf, sizeof(buf));
         read_unlock(&dev_base_lock);
 
-        if (ret != -EINVAL)
+        if (ret >= 0)
                 ret = simple_read_from_buffer(userbuf, count, ppos, buf, ret);
 
         return ret;
@@ -149,6 +149,7 @@ IEEE80211_IF_FILE(rc_rateidx_mask_5ghz, rc_rateidx_mask[IEEE80211_BAND_5GHZ],
                   HEX);
 IEEE80211_IF_FILE(flags, flags, HEX);
 IEEE80211_IF_FILE(state, state, LHEX);
+IEEE80211_IF_FILE(channel_type, vif.bss_conf.channel_type, DEC);
 
 /* STA attributes */
 IEEE80211_IF_FILE(bssid, u.mgd.bssid, MAC);
@@ -220,6 +221,104 @@ static ssize_t ieee80211_if_parse_smps(struct ieee80211_sub_if_data *sdata,
 
 __IEEE80211_IF_FILE_W(smps);
 
+static ssize_t ieee80211_if_fmt_tkip_mic_test(
+        const struct ieee80211_sub_if_data *sdata, char *buf, int buflen)
+{
+        return -EOPNOTSUPP;
+}
+
+static int hwaddr_aton(const char *txt, u8 *addr)
+{
+        int i;
+
+        for (i = 0; i < ETH_ALEN; i++) {
+                int a, b;
+
+                a = hex_to_bin(*txt++);
+                if (a < 0)
+                        return -1;
+                b = hex_to_bin(*txt++);
+                if (b < 0)
+                        return -1;
+                *addr++ = (a << 4) | b;
+                if (i < 5 && *txt++ != ':')
+                        return -1;
+        }
+
+        return 0;
+}
+
+static ssize_t ieee80211_if_parse_tkip_mic_test(
+        struct ieee80211_sub_if_data *sdata, const char *buf, int buflen)
+{
+        struct ieee80211_local *local = sdata->local;
+        u8 addr[ETH_ALEN];
+        struct sk_buff *skb;
+        struct ieee80211_hdr *hdr;
+        __le16 fc;
+
+        /*
+         * Assume colon-delimited MAC address with possible white space
+         * following.
+         */
+        if (buflen < 3 * ETH_ALEN - 1)
+                return -EINVAL;
+        if (hwaddr_aton(buf, addr) < 0)
+                return -EINVAL;
+
+        if (!ieee80211_sdata_running(sdata))
+                return -ENOTCONN;
+
+        skb = dev_alloc_skb(local->hw.extra_tx_headroom + 24 + 100);
+        if (!skb)
+                return -ENOMEM;
+        skb_reserve(skb, local->hw.extra_tx_headroom);
+
+        hdr = (struct ieee80211_hdr *) skb_put(skb, 24);
+        memset(hdr, 0, 24);
+        fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_DATA);
+
+        switch (sdata->vif.type) {
+        case NL80211_IFTYPE_AP:
+                fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS);
+                /* DA BSSID SA */
+                memcpy(hdr->addr1, addr, ETH_ALEN);
+                memcpy(hdr->addr2, sdata->vif.addr, ETH_ALEN);
+                memcpy(hdr->addr3, sdata->vif.addr, ETH_ALEN);
+                break;
+        case NL80211_IFTYPE_STATION:
+                fc |= cpu_to_le16(IEEE80211_FCTL_TODS);
+                /* BSSID SA DA */
+                if (sdata->vif.bss_conf.bssid == NULL) {
+                        dev_kfree_skb(skb);
+                        return -ENOTCONN;
+                }
+                memcpy(hdr->addr1, sdata->vif.bss_conf.bssid, ETH_ALEN);
+                memcpy(hdr->addr2, sdata->vif.addr, ETH_ALEN);
+                memcpy(hdr->addr3, addr, ETH_ALEN);
+                break;
+        default:
+                dev_kfree_skb(skb);
+                return -EOPNOTSUPP;
+        }
+        hdr->frame_control = fc;
+
+        /*
+         * Add some length to the test frame to make it look bit more valid.
+         * The exact contents does not matter since the recipient is required
+         * to drop this because of the Michael MIC failure.
+         */
+        memset(skb_put(skb, 50), 0, 50);
+
+        IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_TKIP_MIC_FAILURE;
+
+        ieee80211_tx_skb(sdata, skb);
+
+        return buflen;
+}
+
+__IEEE80211_IF_FILE_W(tkip_mic_test);
+
 /* AP attributes */
 IEEE80211_IF_FILE(num_sta_ps, u.ap.num_sta_ps, ATOMIC);
 IEEE80211_IF_FILE(dtim_count, u.ap.dtim_count, DEC);
@@ -289,6 +388,7 @@ static void add_sta_files(struct ieee80211_sub_if_data *sdata)
         DEBUGFS_ADD(drop_unencrypted);
         DEBUGFS_ADD(flags);
         DEBUGFS_ADD(state);
+        DEBUGFS_ADD(channel_type);
         DEBUGFS_ADD(rc_rateidx_mask_2ghz);
         DEBUGFS_ADD(rc_rateidx_mask_5ghz);
 
@@ -297,6 +397,7 @@ static void add_sta_files(struct ieee80211_sub_if_data *sdata)
         DEBUGFS_ADD(last_beacon);
         DEBUGFS_ADD(ave_beacon);
         DEBUGFS_ADD_MODE(smps, 0600);
+        DEBUGFS_ADD_MODE(tkip_mic_test, 0200);
 }
 
 static void add_ap_files(struct ieee80211_sub_if_data *sdata)
@@ -304,12 +405,14 @@ static void add_ap_files(struct ieee80211_sub_if_data *sdata)
         DEBUGFS_ADD(drop_unencrypted);
         DEBUGFS_ADD(flags);
         DEBUGFS_ADD(state);
+        DEBUGFS_ADD(channel_type);
         DEBUGFS_ADD(rc_rateidx_mask_2ghz);
         DEBUGFS_ADD(rc_rateidx_mask_5ghz);
 
         DEBUGFS_ADD(num_sta_ps);
         DEBUGFS_ADD(dtim_count);
         DEBUGFS_ADD(num_buffered_multicast);
+        DEBUGFS_ADD_MODE(tkip_mic_test, 0200);
 }
 
 static void add_wds_files(struct ieee80211_sub_if_data *sdata)
@@ -317,6 +420,7 @@ static void add_wds_files(struct ieee80211_sub_if_data *sdata)
         DEBUGFS_ADD(drop_unencrypted);
         DEBUGFS_ADD(flags);
         DEBUGFS_ADD(state);
+        DEBUGFS_ADD(channel_type);
         DEBUGFS_ADD(rc_rateidx_mask_2ghz);
         DEBUGFS_ADD(rc_rateidx_mask_5ghz);
 
@@ -328,6 +432,7 @@ static void add_vlan_files(struct ieee80211_sub_if_data *sdata)
         DEBUGFS_ADD(drop_unencrypted);
         DEBUGFS_ADD(flags);
         DEBUGFS_ADD(state);
+        DEBUGFS_ADD(channel_type);
         DEBUGFS_ADD(rc_rateidx_mask_2ghz);
         DEBUGFS_ADD(rc_rateidx_mask_5ghz);
 }
@@ -336,6 +441,7 @@ static void add_monitor_files(struct ieee80211_sub_if_data *sdata)
 {
         DEBUGFS_ADD(flags);
         DEBUGFS_ADD(state);
+        DEBUGFS_ADD(channel_type);
 }
 
 #ifdef CONFIG_MAC80211_MESH
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index c47d7c0e48a..44eea1af155 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -225,6 +225,7 @@ struct ieee80211_if_ap {
         struct sk_buff_head ps_bc_buf;
         atomic_t num_sta_ps; /* number of stations in PS mode */
         int dtim_count;
+        bool dtim_bc_mc;
 };
 
 struct ieee80211_if_wds {
@@ -654,8 +655,6 @@ struct tpt_led_trigger {
  *      well be on the operating channel
  * @SCAN_HW_SCANNING: The hardware is scanning for us, we have no way to
  *      determine if we are on the operating channel or not
- * @SCAN_OFF_CHANNEL: We're off our operating channel for scanning,
- *      gets only set in conjunction with SCAN_SW_SCANNING
  * @SCAN_COMPLETED: Set for our scan work function when the driver reported
  *      that the scan completed.
  * @SCAN_ABORTED: Set for our scan work function when the driver reported
@@ -664,7 +663,6 @@ struct tpt_led_trigger {
 enum {
         SCAN_SW_SCANNING,
         SCAN_HW_SCANNING,
-        SCAN_OFF_CHANNEL,
         SCAN_COMPLETED,
         SCAN_ABORTED,
 };
@@ -1147,10 +1145,14 @@ void ieee80211_rx_bss_put(struct ieee80211_local *local,
                           struct ieee80211_bss *bss);
 
 /* off-channel helpers */
-void ieee80211_offchannel_stop_beaconing(struct ieee80211_local *local);
-void ieee80211_offchannel_stop_station(struct ieee80211_local *local);
+bool ieee80211_cfg_on_oper_channel(struct ieee80211_local *local);
+void ieee80211_offchannel_enable_all_ps(struct ieee80211_local *local,
+                                        bool tell_ap);
+void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local,
+                                    bool offchannel_ps_enable);
 void ieee80211_offchannel_return(struct ieee80211_local *local,
-                                 bool enable_beaconing);
+                                 bool enable_beaconing,
+                                 bool offchannel_ps_disable);
 void ieee80211_hw_roc_setup(struct ieee80211_local *local);
 
 /* interface handling */
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 8acba456744..5a4e19b8803 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -382,6 +382,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
         struct sk_buff *skb, *tmp;
         u32 hw_reconf_flags = 0;
         int i;
+        enum nl80211_channel_type orig_ct;
 
         if (local->scan_sdata == sdata)
                 ieee80211_scan_cancel(local);
@@ -542,8 +543,14 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
                 hw_reconf_flags = 0;
         }
 
+        /* Re-calculate channel-type, in case there are multiple vifs
+         * on different channel types.
+         */
+        orig_ct = local->_oper_channel_type;
+        ieee80211_set_channel_type(local, NULL, NL80211_CHAN_NO_HT);
+
         /* do after stop to avoid reconfiguring when we stop anyway */
-        if (hw_reconf_flags)
+        if (hw_reconf_flags || (orig_ct != local->_oper_channel_type))
                 ieee80211_hw_config(local, hw_reconf_flags);
 
         spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 09a27449f3f..c155c0b6942 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -98,6 +98,41 @@ static void ieee80211_reconfig_filter(struct work_struct *work)
         ieee80211_configure_filter(local);
 }
 
+/*
+ * Returns true if we are logically configured to be on
+ * the operating channel AND the hardware-conf is currently
+ * configured on the operating channel.  Compares channel-type
+ * as well.
+ */
+bool ieee80211_cfg_on_oper_channel(struct ieee80211_local *local)
+{
+        struct ieee80211_channel *chan, *scan_chan;
+        enum nl80211_channel_type channel_type;
+
+        /* This logic needs to match logic in ieee80211_hw_config */
+        if (local->scan_channel) {
+                chan = local->scan_channel;
+                channel_type = NL80211_CHAN_NO_HT;
+        } else if (local->tmp_channel) {
+                chan = scan_chan = local->tmp_channel;
+                channel_type = local->tmp_channel_type;
+        } else {
+                chan = local->oper_channel;
+                channel_type = local->_oper_channel_type;
+        }
+
+        if (chan != local->oper_channel ||
+            channel_type != local->_oper_channel_type)
+                return false;
+
+        /* Check current hardware-config against oper_channel. */
+        if ((local->oper_channel != local->hw.conf.channel) ||
+            (local->_oper_channel_type != local->hw.conf.channel_type))
+                return false;
+
+        return true;
+}
+
 int ieee80211_hw_config(struct ieee80211_local *local, u32 changed)
 {
         struct ieee80211_channel *chan, *scan_chan;
@@ -110,21 +145,27 @@ int ieee80211_hw_config(struct ieee80211_local *local, u32 changed)
 
         scan_chan = local->scan_channel;
 
+        /* If this off-channel logic ever changes,  ieee80211_on_oper_channel
+         * may need to change as well.
+         */
         offchannel_flag = local->hw.conf.flags & IEEE80211_CONF_OFFCHANNEL;
         if (scan_chan) {
                 chan = scan_chan;
                 channel_type = NL80211_CHAN_NO_HT;
-                local->hw.conf.flags |= IEEE80211_CONF_OFFCHANNEL;
-        } else if (local->tmp_channel &&
-                   local->oper_channel != local->tmp_channel) {
+        } else if (local->tmp_channel) {
                 chan = scan_chan = local->tmp_channel;
                 channel_type = local->tmp_channel_type;
-                local->hw.conf.flags |= IEEE80211_CONF_OFFCHANNEL;
         } else {
                 chan = local->oper_channel;
                 channel_type = local->_oper_channel_type;
-                local->hw.conf.flags &= ~IEEE80211_CONF_OFFCHANNEL;
         }
+
+        if (chan != local->oper_channel ||
+            channel_type != local->_oper_channel_type)
+                local->hw.conf.flags |= IEEE80211_CONF_OFFCHANNEL;
+        else
+                local->hw.conf.flags &= ~IEEE80211_CONF_OFFCHANNEL;
+
         offchannel_flag ^= local->hw.conf.flags & IEEE80211_CONF_OFFCHANNEL;
 
         if (offchannel_flag || chan != local->hw.conf.channel ||
@@ -231,7 +272,7 @@ void ieee80211_bss_info_change_notify(struct ieee80211_sub_if_data *sdata,
 
         if (changed & BSS_CHANGED_BEACON_ENABLED) {
                 if (local->quiescing || !ieee80211_sdata_running(sdata) ||
-                    test_bit(SCAN_SW_SCANNING, &local->scanning)) {
+                    test_bit(SDATA_STATE_OFFCHANNEL, &sdata->state)) {
                         sdata->vif.bss_conf.enable_beacon = false;
                 } else {
                         /*
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index dfa752e5520..f77adf1a520 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -28,8 +28,15 @@
 #include "rate.h"
 #include "led.h"
 
-#define IEEE80211_MAX_NULLFUNC_TRIES 2
-#define IEEE80211_MAX_PROBE_TRIES 5
+static int max_nullfunc_tries = 2;
+module_param(max_nullfunc_tries, int, 0644);
+MODULE_PARM_DESC(max_nullfunc_tries,
+                 "Maximum nullfunc tx tries before disconnecting (reason 4).");
+
+static int max_probe_tries = 5;
+module_param(max_probe_tries, int, 0644);
+MODULE_PARM_DESC(max_probe_tries,
+                 "Maximum probe tries before disconnecting (reason 4).");
 
 /*
  * Beacon loss timeout is calculated as N frames times the
@@ -51,7 +58,11 @@
  * a probe request because of beacon loss or for
  * checking the connection still works.
  */
-#define IEEE80211_PROBE_WAIT            (HZ / 2)
+static int probe_wait_ms = 500;
+module_param(probe_wait_ms, int, 0644);
+MODULE_PARM_DESC(probe_wait_ms,
+                 "Maximum time(ms) to wait for probe response"
+                 " before disconnecting (reason 4).");
 
 /*
  * Weight given to the latest Beacon frame when calculating average signal
@@ -161,6 +172,7 @@ static u32 ieee80211_enable_ht(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_supported_band *sband;
         struct sta_info *sta;
         u32 changed = 0;
+        int hti_cfreq;
         u16 ht_opmode;
         bool enable_ht = true;
         enum nl80211_channel_type prev_chantype;
@@ -174,10 +186,27 @@ static u32 ieee80211_enable_ht(struct ieee80211_sub_if_data *sdata,
         if (!sband->ht_cap.ht_supported)
                 enable_ht = false;
 
-        /* check that channel matches the right operating channel */
-        if (local->hw.conf.channel->center_freq !=
-            ieee80211_channel_to_frequency(hti->control_chan, sband->band))
-                enable_ht = false;
+        if (enable_ht) {
+                hti_cfreq = ieee80211_channel_to_frequency(hti->control_chan,
+                                                           sband->band);
+                /* check that channel matches the right operating channel */
+                if (local->hw.conf.channel->center_freq != hti_cfreq) {
+                        /* Some APs mess this up, evidently.
+                         * Netgear WNDR3700 sometimes reports 4 higher than
+                         * the actual channel, for instance.
+                         */
+                        printk(KERN_DEBUG
+                               "%s: Wrong control channel in association"
+                               " response: configured center-freq: %d"
+                               " hti-cfreq: %d  hti->control_chan: %d"
+                               " band: %d.  Disabling HT.\n",
+                               sdata->name,
+                               local->hw.conf.channel->center_freq,
+                               hti_cfreq, hti->control_chan,
+                               sband->band);
+                        enable_ht = false;
+                }
+        }
 
         if (enable_ht) {
                 channel_type = NL80211_CHAN_HT20;
@@ -1098,7 +1127,7 @@ static void ieee80211_mgd_probe_ap_send(struct ieee80211_sub_if_data *sdata)
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         const u8 *ssid;
         u8 *dst = ifmgd->associated->bssid;
-        u8 unicast_limit = max(1, IEEE80211_MAX_PROBE_TRIES - 3);
+        u8 unicast_limit = max(1, max_probe_tries - 3);
 
         /*
          * Try sending broadcast probe requests for the last three
@@ -1124,7 +1153,7 @@ static void ieee80211_mgd_probe_ap_send(struct ieee80211_sub_if_data *sdata)
         }
 
         ifmgd->probe_send_count++;
-        ifmgd->probe_timeout = jiffies + IEEE80211_PROBE_WAIT;
+        ifmgd->probe_timeout = jiffies + msecs_to_jiffies(probe_wait_ms);
         run_again(ifmgd, ifmgd->probe_timeout);
 }
 
@@ -1225,7 +1254,8 @@ static void __ieee80211_connection_loss(struct ieee80211_sub_if_data *sdata)
 
         memcpy(bssid, ifmgd->associated->bssid, ETH_ALEN);
 
-        printk(KERN_DEBUG "Connection to AP %pM lost.\n", bssid);
+        printk(KERN_DEBUG "%s: Connection to AP %pM lost.\n",
+               sdata->name, bssid);
 
         ieee80211_set_disassoc(sdata, true, true);
         mutex_unlock(&ifmgd->mtx);
@@ -1970,9 +2000,9 @@ void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
                 memcpy(bssid, ifmgd->associated->bssid, ETH_ALEN);
 
                 if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
-                        max_tries = IEEE80211_MAX_NULLFUNC_TRIES;
+                        max_tries = max_nullfunc_tries;
                 else
-                        max_tries = IEEE80211_MAX_PROBE_TRIES;
+                        max_tries = max_probe_tries;
 
                 /* ACK received for nullfunc probing frame */
                 if (!ifmgd->probe_send_count)
@@ -2004,7 +2034,7 @@ void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
                                     "%s: Failed to send nullfunc to AP %pM"
                                     " after %dms, disconnecting.\n",
                                     sdata->name,
-                                    bssid, (1000 * IEEE80211_PROBE_WAIT)/HZ);
+                                    bssid, probe_wait_ms);
 #endif
                         ieee80211_sta_connection_lost(sdata, bssid);
                 } else if (ifmgd->probe_send_count < max_tries) {
@@ -2013,7 +2043,7 @@ void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
                                     "%s: No probe response from AP %pM"
                                     " after %dms, try %d/%i\n",
                                     sdata->name,
-                                    bssid, (1000 * IEEE80211_PROBE_WAIT)/HZ,
+                                    bssid, probe_wait_ms,
                                     ifmgd->probe_send_count, max_tries);
 #endif
                         ieee80211_mgd_probe_ap_send(sdata);
@@ -2026,7 +2056,7 @@ void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
                                     "%s: No probe response from AP %pM"
                                     " after %dms, disconnecting.\n",
                                     sdata->name,
-                                    bssid, (1000 * IEEE80211_PROBE_WAIT)/HZ);
+                                    bssid, probe_wait_ms);
 
                         ieee80211_sta_connection_lost(sdata, bssid);
                 }
diff --git a/net/mac80211/offchannel.c b/net/mac80211/offchannel.c
index b4e52676f3f..13427b194ce 100644
--- a/net/mac80211/offchannel.c
+++ b/net/mac80211/offchannel.c
@@ -17,10 +17,14 @@
 #include "driver-trace.h"
 
 /*
- * inform AP that we will go to sleep so that it will buffer the frames
- * while we scan
+ * Tell our hardware to disable PS.
+ * Optionally inform AP that we will go to sleep so that it will buffer
+ * the frames while we are doing off-channel work.  This is optional
+ * because we *may* be doing work on-operating channel, and want our
+ * hardware unconditionally awake, but still let the AP send us normal frames.
  */
-static void ieee80211_offchannel_ps_enable(struct ieee80211_sub_if_data *sdata)
+static void ieee80211_offchannel_ps_enable(struct ieee80211_sub_if_data *sdata,
+                                           bool tell_ap)
 {
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
@@ -41,8 +45,8 @@ static void ieee80211_offchannel_ps_enable(struct ieee80211_sub_if_data *sdata)
                 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
         }
 
-        if (!(local->offchannel_ps_enabled) ||
-            !(local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK))
+        if (tell_ap && (!local->offchannel_ps_enabled ||
+                        !(local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK)))
                 /*
                  * If power save was enabled, no need to send a nullfunc
                  * frame because AP knows that we are sleeping. But if the
@@ -77,6 +81,9 @@ static void ieee80211_offchannel_ps_disable(struct ieee80211_sub_if_data *sdata)
                  * we are sleeping, let's just enable power save mode in
                  * hardware.
                  */
+                /* TODO:  Only set hardware if CONF_PS changed?
+                 * TODO:  Should we set offchannel_ps_enabled to false?
+                 */
                 local->hw.conf.flags |= IEEE80211_CONF_PS;
                 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
         } else if (local->hw.conf.dynamic_ps_timeout > 0) {
@@ -95,63 +102,61 @@ static void ieee80211_offchannel_ps_disable(struct ieee80211_sub_if_data *sdata)
         ieee80211_sta_reset_conn_monitor(sdata);
 }
 
-void ieee80211_offchannel_stop_beaconing(struct ieee80211_local *local)
+void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local,
+                                    bool offchannel_ps_enable)
 {
         struct ieee80211_sub_if_data *sdata;
 
+        /*
+         * notify the AP about us leaving the channel and stop all
+         * STA interfaces.
+         */
         mutex_lock(&local->iflist_mtx);
         list_for_each_entry(sdata, &local->interfaces, list) {
                 if (!ieee80211_sdata_running(sdata))
                         continue;
 
-                /* disable beaconing */
+                if (sdata->vif.type != NL80211_IFTYPE_MONITOR)
+                        set_bit(SDATA_STATE_OFFCHANNEL, &sdata->state);
+
+                /* Check to see if we should disable beaconing. */
                 if (sdata->vif.type == NL80211_IFTYPE_AP ||
                     sdata->vif.type == NL80211_IFTYPE_ADHOC ||
                     sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
                         ieee80211_bss_info_change_notify(
                                 sdata, BSS_CHANGED_BEACON_ENABLED);
 
-                /*
-                 * only handle non-STA interfaces here, STA interfaces
-                 * are handled in ieee80211_offchannel_stop_station(),
-                 * e.g., from the background scan state machine.
-                 *
-                 * In addition, do not stop monitor interface to allow it to be
-                 * used from user space controlled off-channel operations.
-                 */
-                if (sdata->vif.type != NL80211_IFTYPE_STATION &&
-                    sdata->vif.type != NL80211_IFTYPE_MONITOR) {
-                        set_bit(SDATA_STATE_OFFCHANNEL, &sdata->state);
+                if (sdata->vif.type != NL80211_IFTYPE_MONITOR) {
                         netif_tx_stop_all_queues(sdata->dev);
+                        if (offchannel_ps_enable &&
+                            (sdata->vif.type == NL80211_IFTYPE_STATION) &&
+                            sdata->u.mgd.associated)
+                                ieee80211_offchannel_ps_enable(sdata, true);
                 }
         }
         mutex_unlock(&local->iflist_mtx);
 }
 
-void ieee80211_offchannel_stop_station(struct ieee80211_local *local)
+void ieee80211_offchannel_enable_all_ps(struct ieee80211_local *local,
+                                        bool tell_ap)
 {
         struct ieee80211_sub_if_data *sdata;
 
-        /*
-         * notify the AP about us leaving the channel and stop all STA interfaces
-         */
         mutex_lock(&local->iflist_mtx);
         list_for_each_entry(sdata, &local->interfaces, list) {
                 if (!ieee80211_sdata_running(sdata))
                         continue;
 
-                if (sdata->vif.type == NL80211_IFTYPE_STATION) {
-                        set_bit(SDATA_STATE_OFFCHANNEL, &sdata->state);
-                        netif_tx_stop_all_queues(sdata->dev);
-                        if (sdata->u.mgd.associated)
-                                ieee80211_offchannel_ps_enable(sdata);
-                }
+                if (sdata->vif.type == NL80211_IFTYPE_STATION &&
+                    sdata->u.mgd.associated)
+                        ieee80211_offchannel_ps_enable(sdata, tell_ap);
         }
         mutex_unlock(&local->iflist_mtx);
 }
 
 void ieee80211_offchannel_return(struct ieee80211_local *local,
-                                 bool enable_beaconing)
+                                 bool enable_beaconing,
+                                 bool offchannel_ps_disable)
 {
         struct ieee80211_sub_if_data *sdata;
 
@@ -161,7 +166,8 @@ void ieee80211_offchannel_return(struct ieee80211_local *local,
                         continue;
 
                 /* Tell AP we're back */
-                if (sdata->vif.type == NL80211_IFTYPE_STATION) {
+                if (offchannel_ps_disable &&
+                    sdata->vif.type == NL80211_IFTYPE_STATION) {
                         if (sdata->u.mgd.associated)
                                 ieee80211_offchannel_ps_disable(sdata);
                 }
@@ -181,7 +187,7 @@ void ieee80211_offchannel_return(struct ieee80211_local *local,
                         netif_tx_wake_all_queues(sdata->dev);
                 }
 
-                /* re-enable beaconing */
+                /* Check to see if we should re-enable beaconing */
                 if (enable_beaconing &&
                     (sdata->vif.type == NL80211_IFTYPE_AP ||
                      sdata->vif.type == NL80211_IFTYPE_ADHOC ||
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 7185c9316be..045b2fe4a41 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -142,11 +142,8 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
         /* IEEE80211_RADIOTAP_RATE */
         if (status->flag & RX_FLAG_HT) {
                 /*
-                 * TODO: add following information into radiotap header once
-                 * suitable fields are defined for it:
-                 * - MCS index (status->rate_idx)
-                 * - HT40 (status->flag & RX_FLAG_40MHZ)
-                 * - short-GI (status->flag & RX_FLAG_SHORT_GI)
+                 * MCS information is a separate field in radiotap,
+                 * added below.
                  */
                 *pos = 0;
         } else {
@@ -409,16 +406,10 @@ ieee80211_rx_h_passive_scan(struct ieee80211_rx_data *rx)
         if (likely(!(status->rx_flags & IEEE80211_RX_IN_SCAN)))
                 return RX_CONTINUE;
 
-        if (test_bit(SCAN_HW_SCANNING, &local->scanning))
+        if (test_bit(SCAN_HW_SCANNING, &local->scanning) ||
+            test_bit(SCAN_SW_SCANNING, &local->scanning))
                 return ieee80211_scan_rx(rx->sdata, skb);
 
-        if (test_bit(SCAN_SW_SCANNING, &local->scanning)) {
-                /* drop all the other packets during a software scan anyway */
-                if (ieee80211_scan_rx(rx->sdata, skb) != RX_QUEUED)
-                        dev_kfree_skb(skb);
-                return RX_QUEUED;
-        }
-
         /* scanning finished during invoking of handlers */
         I802_DEBUG_INC(local->rx_handlers_drop_passive_scan);
         return RX_DROP_UNUSABLE;
@@ -815,7 +806,7 @@ ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
                                 rx->local->dot11FrameDuplicateCount++;
                                 rx->sta->num_duplicates++;
                         }
-                        return RX_DROP_MONITOR;
+                        return RX_DROP_UNUSABLE;
                 } else
                         rx->sta->last_seq_ctrl[rx->queue] = hdr->seq_ctrl;
         }
@@ -1105,7 +1096,8 @@ static void ap_sta_ps_start(struct sta_info *sta)
 
         atomic_inc(&sdata->bss->num_sta_ps);
         set_sta_flags(sta, WLAN_STA_PS_STA);
-        drv_sta_notify(local, sdata, STA_NOTIFY_SLEEP, &sta->sta);
+        if (!(local->hw.flags & IEEE80211_HW_AP_LINK_PS))
+                drv_sta_notify(local, sdata, STA_NOTIFY_SLEEP, &sta->sta);
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
         printk(KERN_DEBUG "%s: STA %pM aid %d enters power save mode\n",
                sdata->name, sta->sta.addr, sta->sta.aid);
@@ -1134,6 +1126,27 @@ static void ap_sta_ps_end(struct sta_info *sta)
         ieee80211_sta_ps_deliver_wakeup(sta);
 }
 
+int ieee80211_sta_ps_transition(struct ieee80211_sta *sta, bool start)
+{
+        struct sta_info *sta_inf = container_of(sta, struct sta_info, sta);
+        bool in_ps;
+
+        WARN_ON(!(sta_inf->local->hw.flags & IEEE80211_HW_AP_LINK_PS));
+
+        /* Don't let the same PS state be set twice */
+        in_ps = test_sta_flags(sta_inf, WLAN_STA_PS_STA);
+        if ((start && in_ps) || (!start && !in_ps))
+                return -EINVAL;
+
+        if (start)
+                ap_sta_ps_start(sta_inf);
+        else
+                ap_sta_ps_end(sta_inf);
+
+        return 0;
+}
+EXPORT_SYMBOL(ieee80211_sta_ps_transition);
+
 static ieee80211_rx_result debug_noinline
 ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
 {
@@ -1178,7 +1191,8 @@ ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
          * Change STA power saving mode only at the end of a frame
          * exchange sequence.
          */
-        if (!ieee80211_has_morefrags(hdr->frame_control) &&
+        if (!(sta->local->hw.flags & IEEE80211_HW_AP_LINK_PS) &&
+            !ieee80211_has_morefrags(hdr->frame_control) &&
             !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&
             (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
              rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)) {
@@ -1929,7 +1943,10 @@ ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
         dev->stats.rx_bytes += rx->skb->len;
 
         if (local->ps_sdata && local->hw.conf.dynamic_ps_timeout > 0 &&
-            !is_multicast_ether_addr(((struct ethhdr *)rx->skb->data)->h_dest)) {
+            !is_multicast_ether_addr(
+                    ((struct ethhdr *)rx->skb->data)->h_dest) &&
+            (!local->scanning &&
+             !test_bit(SDATA_STATE_OFFCHANNEL, &sdata->state))) {
                         mod_timer(&local->dynamic_ps_timer, jiffies +
                          msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout));
         }
@@ -2626,7 +2643,8 @@ static int prepare_for_handlers(struct ieee80211_rx_data *rx,
                         return 0;
                 if (!multicast &&
                     compare_ether_addr(sdata->vif.addr, hdr->addr1) != 0) {
-                        if (!(sdata->dev->flags & IFF_PROMISC))
+                        if (!(sdata->dev->flags & IFF_PROMISC) ||
+                            sdata->u.mgd.use_4addr)
                                 return 0;
                         status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
                 }
@@ -2675,7 +2693,8 @@ static int prepare_for_handlers(struct ieee80211_rx_data *rx,
                                 return 0;
                 } else if (!ieee80211_bssid_match(bssid,
                                         sdata->vif.addr)) {
-                        if (!(status->rx_flags & IEEE80211_RX_IN_SCAN))
+                        if (!(status->rx_flags & IEEE80211_RX_IN_SCAN) &&
+                            !ieee80211_is_beacon(hdr->frame_control))
                                 return 0;
                         status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
                 }
@@ -2766,7 +2785,7 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
                 local->dot11ReceivedFragmentCount++;
 
         if (unlikely(test_bit(SCAN_HW_SCANNING, &local->scanning) ||
-                     test_bit(SCAN_OFF_CHANNEL, &local->scanning)))
+                     test_bit(SCAN_SW_SCANNING, &local->scanning)))
                 status->rx_flags |= IEEE80211_RX_IN_SCAN;
 
         if (ieee80211_is_mgmt(fc))
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index 1ef73be76b2..0ea6adae3e0 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -212,6 +212,14 @@ ieee80211_scan_rx(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb)
         if (bss)
                 ieee80211_rx_bss_put(sdata->local, bss);
 
+        /* If we are on-operating-channel, and this packet is for the
+         * current channel, pass the pkt on up the stack so that
+         * the rest of the stack can make use of it.
+         */
+        if (ieee80211_cfg_on_oper_channel(sdata->local)
+            && (channel == sdata->local->oper_channel))
+                return RX_CONTINUE;
+
         dev_kfree_skb(skb);
         return RX_QUEUED;
 }
@@ -293,15 +301,31 @@ static void __ieee80211_scan_completed_finish(struct ieee80211_hw *hw,
                                               bool was_hw_scan)
 {
         struct ieee80211_local *local = hw_to_local(hw);
+        bool on_oper_chan;
+        bool enable_beacons = false;
+
+        mutex_lock(&local->mtx);
+        on_oper_chan = ieee80211_cfg_on_oper_channel(local);
+
+        if (was_hw_scan || !on_oper_chan) {
+                if (WARN_ON(local->scan_channel))
+                        local->scan_channel = NULL;
+                ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);
+        }
 
-        ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);
         if (!was_hw_scan) {
+                bool on_oper_chan2;
                 ieee80211_configure_filter(local);
                 drv_sw_scan_complete(local);
-                ieee80211_offchannel_return(local, true);
+                on_oper_chan2 = ieee80211_cfg_on_oper_channel(local);
+                /* We should always be on-channel at this point. */
+                WARN_ON(!on_oper_chan2);
+                if (on_oper_chan2 && (on_oper_chan != on_oper_chan2))
+                        enable_beacons = true;
+
+                ieee80211_offchannel_return(local, enable_beacons, true);
         }
 
-        mutex_lock(&local->mtx);
         ieee80211_recalc_idle(local);
         mutex_unlock(&local->mtx);
 
@@ -341,13 +365,15 @@ static int ieee80211_start_sw_scan(struct ieee80211_local *local)
          */
         drv_sw_scan_start(local);
 
-        ieee80211_offchannel_stop_beaconing(local);
-
         local->leave_oper_channel_time = 0;
         local->next_scan_state = SCAN_DECISION;
         local->scan_channel_idx = 0;
 
-        drv_flush(local, false);
+        /* We always want to use off-channel PS, even if we
+         * are not really leaving oper-channel.  Don't
+         * tell the AP though, as long as we are on-channel.
+         */
+        ieee80211_offchannel_enable_all_ps(local, false);
 
         ieee80211_configure_filter(local);
 
@@ -487,7 +513,21 @@ static void ieee80211_scan_state_decision(struct ieee80211_local *local,
         }
         mutex_unlock(&local->iflist_mtx);
 
-        if (local->scan_channel) {
+        next_chan = local->scan_req->channels[local->scan_channel_idx];
+
+        if (ieee80211_cfg_on_oper_channel(local)) {
+                /* We're currently on operating channel. */
+                if ((next_chan == local->oper_channel) &&
+                    (local->_oper_channel_type == NL80211_CHAN_NO_HT))
+                        /* We don't need to move off of operating channel. */
+                        local->next_scan_state = SCAN_SET_CHANNEL;
+                else
+                        /*
+                         * We do need to leave operating channel, as next
+                         * scan is somewhere else.
+                         */
+                        local->next_scan_state = SCAN_LEAVE_OPER_CHANNEL;
+        } else {
                 /*
                  * we're currently scanning a different channel, let's
                  * see if we can scan another channel without interfering
@@ -503,7 +543,6 @@ static void ieee80211_scan_state_decision(struct ieee80211_local *local,
                  *
                  * Otherwise switch back to the operating channel.
                  */
-                next_chan = local->scan_req->channels[local->scan_channel_idx];
 
                 bad_latency = time_after(jiffies +
                                 ieee80211_scan_get_channel_time(next_chan),
@@ -521,12 +560,6 @@ static void ieee80211_scan_state_decision(struct ieee80211_local *local,
                         local->next_scan_state = SCAN_ENTER_OPER_CHANNEL;
                 else
                         local->next_scan_state = SCAN_SET_CHANNEL;
-        } else {
-                /*
-                 * we're on the operating channel currently, let's
-                 * leave that channel now to scan another one
-                 */
-                local->next_scan_state = SCAN_LEAVE_OPER_CHANNEL;
         }
 
         *next_delay = 0;
@@ -535,9 +568,10 @@ static void ieee80211_scan_state_decision(struct ieee80211_local *local,
 static void ieee80211_scan_state_leave_oper_channel(struct ieee80211_local *local,
                                                     unsigned long *next_delay)
 {
-        ieee80211_offchannel_stop_station(local);
-
-        __set_bit(SCAN_OFF_CHANNEL, &local->scanning);
+        /* PS will already be in off-channel mode,
+         * we do that once at the beginning of scanning.
+         */
+        ieee80211_offchannel_stop_vifs(local, false);
 
         /*
          * What if the nullfunc frames didn't arrive?
@@ -560,15 +594,15 @@ static void ieee80211_scan_state_enter_oper_channel(struct ieee80211_local *loca
 {
         /* switch back to the operating channel */
         local->scan_channel = NULL;
-        ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);
+        if (!ieee80211_cfg_on_oper_channel(local))
+                ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);
 
         /*
-         * Only re-enable station mode interface now; beaconing will be
-         * re-enabled once the full scan has been completed.
+         * Re-enable vifs and beaconing.  Leave PS
+         * in off-channel state..will put that back
+         * on-channel at the end of scanning.
          */
-        ieee80211_offchannel_return(local, false);
-
-        __clear_bit(SCAN_OFF_CHANNEL, &local->scanning);
+        ieee80211_offchannel_return(local, true, false);
 
         *next_delay = HZ / 5;
         local->next_scan_state = SCAN_DECISION;
@@ -584,8 +618,12 @@ static void ieee80211_scan_state_set_channel(struct ieee80211_local *local,
         chan = local->scan_req->channels[local->scan_channel_idx];
 
         local->scan_channel = chan;
-        if (ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL))
-                skip = 1;
+
+        /* Only call hw-config if we really need to change channels. */
+        if ((chan != local->hw.conf.channel) ||
+            (local->hw.conf.channel_type != NL80211_CHAN_NO_HT))
+                if (ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL))
+                        skip = 1;
 
         /* advance state machine to next channel/band */
         local->scan_channel_idx++;
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index c426504ed1c..5a11078827a 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -899,7 +899,8 @@ void ieee80211_sta_ps_deliver_wakeup(struct sta_info *sta)
         struct ieee80211_local *local = sdata->local;
         int sent, buffered;
 
-        drv_sta_notify(local, sdata, STA_NOTIFY_AWAKE, &sta->sta);
+        if (!(local->hw.flags & IEEE80211_HW_AP_LINK_PS))
+                drv_sta_notify(local, sdata, STA_NOTIFY_AWAKE, &sta->sta);
 
         if (!skb_queue_empty(&sta->ps_tx_buf))
                 sta_info_clear_tim_bit(sta);
diff --git a/net/mac80211/status.c b/net/mac80211/status.c
index 38a797217a9..ffb0de9bc2f 100644
--- a/net/mac80211/status.c
+++ b/net/mac80211/status.c
@@ -98,6 +98,10 @@ static void ieee80211_handle_filtered_frame(struct ieee80211_local *local,
          *  (b) always process RX events before TX status events if ordering
          *      can be unknown, for example with different interrupt status
          *      bits.
+         *  (c) if PS mode transitions are manual (i.e. the flag
+         *      %IEEE80211_HW_AP_LINK_PS is set), always process PS state
+         *      changes before calling TX status events if ordering can be
+         *      unknown.
          */
         if (test_sta_flags(sta, WLAN_STA_PS_STA) &&
             skb_queue_len(&sta->tx_filtered) < STA_MAX_TX_BUFFER) {
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index ffc67491c38..38e59393972 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -257,7 +257,8 @@ ieee80211_tx_h_check_assoc(struct ieee80211_tx_data *tx)
         if (unlikely(info->flags & IEEE80211_TX_CTL_INJECTED))
                 return TX_CONTINUE;
 
-        if (unlikely(test_bit(SCAN_OFF_CHANNEL, &tx->local->scanning)) &&
+        if (unlikely(test_bit(SCAN_SW_SCANNING, &tx->local->scanning)) &&
+            test_bit(SDATA_STATE_OFFCHANNEL, &tx->sdata->state) &&
             !ieee80211_is_probe_req(hdr->frame_control) &&
             !ieee80211_is_nullfunc(hdr->frame_control))
                 /*
@@ -1394,7 +1395,8 @@ static int invoke_tx_handlers(struct ieee80211_tx_data *tx)
         /* handlers after fragment must be aware of tx info fragmentation! */
         CALL_TXH(ieee80211_tx_h_stats);
         CALL_TXH(ieee80211_tx_h_encrypt);
-        CALL_TXH(ieee80211_tx_h_calculate_duration);
+        if (!(tx->local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL))
+                CALL_TXH(ieee80211_tx_h_calculate_duration);
 #undef CALL_TXH
 
  txh_done:
@@ -2178,6 +2180,8 @@ static void ieee80211_beacon_add_tim(struct ieee80211_if_ap *bss,
         if (bss->dtim_count == 0 && !skb_queue_empty(&bss->ps_bc_buf))
                 aid0 = 1;
 
+        bss->dtim_bc_mc = aid0 == 1;
+
         if (have_bits) {
                 /* Find largest even number N1 so that bits numbered 1 through
                  * (N1 x 8) - 1 in the bitmap are 0 and number N2 so that bits
@@ -2241,7 +2245,7 @@ struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
         if (sdata->vif.type == NL80211_IFTYPE_AP) {
                 ap = &sdata->u.ap;
                 beacon = rcu_dereference(ap->beacon);
-                if (ap && beacon) {
+                if (beacon) {
                         /*
                          * headroom, head length,
                          * tail length and maximum TIM length
@@ -2548,7 +2552,7 @@ ieee80211_get_buffered_bc(struct ieee80211_hw *hw,
         if (sdata->vif.type != NL80211_IFTYPE_AP || !beacon || !beacon->head)
                 goto out;
 
-        if (bss->dtim_count != 0)
+        if (bss->dtim_count != 0 || !bss->dtim_bc_mc)
                 goto out; /* send buffered bc/mc only after DTIM beacon */
 
         while (1) {
diff --git a/net/mac80211/work.c b/net/mac80211/work.c
index 36305e0d06e..6bf787a5b38 100644
--- a/net/mac80211/work.c
+++ b/net/mac80211/work.c
@@ -924,18 +924,44 @@ static void ieee80211_work_work(struct work_struct *work)
                 }
 
                 if (!started && !local->tmp_channel) {
-                        /*
-                         * TODO: could optimize this by leaving the
-                         *       station vifs in awake mode if they
-                         *       happen to be on the same channel as
-                         *       the requested channel
-                         */
-                        ieee80211_offchannel_stop_beaconing(local);
-                        ieee80211_offchannel_stop_station(local);
+                        bool on_oper_chan;
+                        bool tmp_chan_changed = false;
+                        bool on_oper_chan2;
+                        on_oper_chan = ieee80211_cfg_on_oper_channel(local);
+                        if (local->tmp_channel)
+                                if ((local->tmp_channel != wk->chan) ||
+                                    (local->tmp_channel_type != wk->chan_type))
+                                        tmp_chan_changed = true;
 
                         local->tmp_channel = wk->chan;
                         local->tmp_channel_type = wk->chan_type;
-                        ieee80211_hw_config(local, 0);
+                        /*
+                         * Leave the station vifs in awake mode if they
+                         * happen to be on the same channel as
+                         * the requested channel.
+                         */
+                        on_oper_chan2 = ieee80211_cfg_on_oper_channel(local);
+                        if (on_oper_chan != on_oper_chan2) {
+                                if (on_oper_chan2) {
+                                        /* going off oper channel, PS too */
+                                        ieee80211_offchannel_stop_vifs(local,
+                                                                       true);
+                                        ieee80211_hw_config(local, 0);
+                                } else {
+                                        /* going on channel, but leave PS
+                                         * off-channel. */
+                                        ieee80211_hw_config(local, 0);
+                                        ieee80211_offchannel_return(local,
+                                                                    true,
+                                                                    false);
+                                }
+                        } else if (tmp_chan_changed)
+                                /* Still off-channel, but on some other
+                                 * channel, so update hardware.
+                                 * PS should already be off-channel.
+                                 */
+                                ieee80211_hw_config(local, 0);
+
                         started = true;
                         wk->timeout = jiffies;
                 }
@@ -1011,9 +1037,27 @@ static void ieee80211_work_work(struct work_struct *work)
         }
 
         if (!remain_off_channel && local->tmp_channel) {
+                bool on_oper_chan = ieee80211_cfg_on_oper_channel(local);
                 local->tmp_channel = NULL;
-                ieee80211_hw_config(local, 0);
-                ieee80211_offchannel_return(local, true);
+                /* If tmp_channel wasn't operating channel, then
+                 * we need to go back on-channel.
+                 * NOTE:  If we can ever be here while scannning,
+                 * or if the hw_config() channel config logic changes,
+                 * then we may need to do a more thorough check to see if
+                 * we still need to do a hardware config.  Currently,
+                 * we cannot be here while scanning, however.
+                 */
+                if (ieee80211_cfg_on_oper_channel(local) && !on_oper_chan)
+                        ieee80211_hw_config(local, 0);
+
+                /* At the least, we need to disable offchannel_ps,
+                 * so just go ahead and run the entire offchannel
+                 * return logic here.  We *could* skip enabling
+                 * beaconing if we were already on-oper-channel
+                 * as a future optimization.
+                 */
+                ieee80211_offchannel_return(local, true, true);
+
                 /* give connection some time to breathe */
                 run_again(local, jiffies + HZ/2);
         }
diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c
index bee230d8fd1..f1765de2f4b 100644
--- a/net/mac80211/wpa.c
+++ b/net/mac80211/wpa.c
@@ -26,13 +26,12 @@
 ieee80211_tx_result
 ieee80211_tx_h_michael_mic_add(struct ieee80211_tx_data *tx)
 {
-        u8 *data, *key, *mic, key_offset;
+        u8 *data, *key, *mic;
         size_t data_len;
         unsigned int hdrlen;
         struct ieee80211_hdr *hdr;
         struct sk_buff *skb = tx->skb;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-        int authenticator;
         int tail;
 
         hdr = (struct ieee80211_hdr *)skb->data;
@@ -47,6 +46,11 @@ ieee80211_tx_h_michael_mic_add(struct ieee80211_tx_data *tx)
         data = skb->data + hdrlen;
         data_len = skb->len - hdrlen;
 
+        if (unlikely(info->flags & IEEE80211_TX_INTFL_TKIP_MIC_FAILURE)) {
+                /* Need to use software crypto for the test */
+                info->control.hw_key = NULL;
+        }
+
         if (info->control.hw_key &&
             !(tx->flags & IEEE80211_TX_FRAGMENTED) &&
             !(tx->key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC)) {
@@ -62,17 +66,11 @@ ieee80211_tx_h_michael_mic_add(struct ieee80211_tx_data *tx)
                     skb_headroom(skb) < TKIP_IV_LEN))
                 return TX_DROP;
 
-#if 0
-        authenticator = fc & IEEE80211_FCTL_FROMDS; /* FIX */
-#else
-        authenticator = 1;
-#endif
-        key_offset = authenticator ?
-                NL80211_TKIP_DATA_OFFSET_TX_MIC_KEY :
-                NL80211_TKIP_DATA_OFFSET_RX_MIC_KEY;
-        key = &tx->key->conf.key[key_offset];
+        key = &tx->key->conf.key[NL80211_TKIP_DATA_OFFSET_TX_MIC_KEY];
         mic = skb_put(skb, MICHAEL_MIC_LEN);
         michael_mic(key, hdr, data, data_len, mic);
+        if (unlikely(info->flags & IEEE80211_TX_INTFL_TKIP_MIC_FAILURE))
+                mic[0]++;
 
         return TX_CONTINUE;
 }
@@ -81,14 +79,13 @@ ieee80211_tx_h_michael_mic_add(struct ieee80211_tx_data *tx)
 ieee80211_rx_result
 ieee80211_rx_h_michael_mic_verify(struct ieee80211_rx_data *rx)
 {
-        u8 *data, *key = NULL, key_offset;
+        u8 *data, *key = NULL;
         size_t data_len;
         unsigned int hdrlen;
         u8 mic[MICHAEL_MIC_LEN];
         struct sk_buff *skb = rx->skb;
         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
-        int authenticator = 1, wpa_test = 0;
 
         /* No way to verify the MIC if the hardware stripped it */
         if (status->flag & RX_FLAG_MMIC_STRIPPED)
@@ -106,17 +103,9 @@ ieee80211_rx_h_michael_mic_verify(struct ieee80211_rx_data *rx)
         data = skb->data + hdrlen;
         data_len = skb->len - hdrlen - MICHAEL_MIC_LEN;
 
-#if 0
-        authenticator = fc & IEEE80211_FCTL_TODS; /* FIX */
-#else
-        authenticator = 1;
-#endif
-        key_offset = authenticator ?
-                NL80211_TKIP_DATA_OFFSET_RX_MIC_KEY :
-                NL80211_TKIP_DATA_OFFSET_TX_MIC_KEY;
-        key = &rx->key->conf.key[key_offset];
+        key = &rx->key->conf.key[NL80211_TKIP_DATA_OFFSET_RX_MIC_KEY];
         michael_mic(key, hdr, data, data_len, mic);
-        if (memcmp(mic, data + data_len, MICHAEL_MIC_LEN) != 0 || wpa_test) {
+        if (memcmp(mic, data + data_len, MICHAEL_MIC_LEN) != 0) {
                 if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
                         return RX_DROP_UNUSABLE;
 
@@ -208,7 +197,7 @@ ieee80211_rx_result
 ieee80211_crypto_tkip_decrypt(struct ieee80211_rx_data *rx)
 {
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) rx->skb->data;
-        int hdrlen, res, hwaccel = 0, wpa_test = 0;
+        int hdrlen, res, hwaccel = 0;
         struct ieee80211_key *key = rx->key;
         struct sk_buff *skb = rx->skb;
         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
@@ -235,7 +224,7 @@ ieee80211_crypto_tkip_decrypt(struct ieee80211_rx_data *rx)
                                           hdr->addr1, hwaccel, rx->queue,
                                           &rx->tkip_iv32,
                                           &rx->tkip_iv16);
-        if (res != TKIP_DECRYPT_OK || wpa_test)
+        if (res != TKIP_DECRYPT_OK)
                 return RX_DROP_UNUSABLE;
 
         /* Trim ICV */