16 files changed, 381 insertions, 53 deletions

diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 18bd0e55060..0c544074479 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -1299,6 +1299,13 @@ static int ieee80211_set_wiphy_params(struct wiphy *wiphy, u32 changed)
         struct ieee80211_local *local = wiphy_priv(wiphy);
         int err;
 
+        if (changed & WIPHY_PARAM_FRAG_THRESHOLD) {
+                err = drv_set_frag_threshold(local, wiphy->frag_threshold);
+
+                if (err)
+                        return err;
+        }
+
         if (changed & WIPHY_PARAM_COVERAGE_CLASS) {
                 err = drv_set_coverage_class(local, wiphy->coverage_class);
 
@@ -1621,6 +1628,23 @@ static void ieee80211_mgmt_frame_register(struct wiphy *wiphy,
         ieee80211_queue_work(&local->hw, &local->reconfig_filter);
 }
 
+static int ieee80211_set_antenna(struct wiphy *wiphy, u32 tx_ant, u32 rx_ant)
+{
+        struct ieee80211_local *local = wiphy_priv(wiphy);
+
+        if (local->started)
+                return -EOPNOTSUPP;
+
+        return drv_set_antenna(local, tx_ant, rx_ant);
+}
+
+static int ieee80211_get_antenna(struct wiphy *wiphy, u32 *tx_ant, u32 *rx_ant)
+{
+        struct ieee80211_local *local = wiphy_priv(wiphy);
+
+        return drv_get_antenna(local, tx_ant, rx_ant);
+}
+
 struct cfg80211_ops mac80211_config_ops = {
         .add_virtual_intf = ieee80211_add_iface,
         .del_virtual_intf = ieee80211_del_iface,
@@ -1673,4 +1697,6 @@ struct cfg80211_ops mac80211_config_ops = {
         .mgmt_tx = ieee80211_mgmt_tx,
         .set_cqm_rssi_config = ieee80211_set_cqm_rssi_config,
         .mgmt_frame_register = ieee80211_mgmt_frame_register,
+        .set_antenna = ieee80211_set_antenna,
+        .get_antenna = ieee80211_get_antenna,
 };
diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
index 16983825f8e..4244554d218 100644
--- a/net/mac80211/driver-ops.h
+++ b/net/mac80211/driver-ops.h
@@ -233,6 +233,20 @@ static inline void drv_get_tkip_seq(struct ieee80211_local *local,
         trace_drv_get_tkip_seq(local, hw_key_idx, iv32, iv16);
 }
 
+static inline int drv_set_frag_threshold(struct ieee80211_local *local,
+                                        u32 value)
+{
+        int ret = 0;
+
+        might_sleep();
+
+        trace_drv_set_frag_threshold(local, value);
+        if (local->ops->set_frag_threshold)
+                ret = local->ops->set_frag_threshold(&local->hw, value);
+        trace_drv_return_int(local, ret);
+        return ret;
+}
+
 static inline int drv_set_rts_threshold(struct ieee80211_local *local,
                                         u32 value)
 {
@@ -428,4 +442,27 @@ static inline void drv_channel_switch(struct ieee80211_local *local,
         trace_drv_return_void(local);
 }
 
+
+static inline int drv_set_antenna(struct ieee80211_local *local,
+                                  u32 tx_ant, u32 rx_ant)
+{
+        int ret = -EOPNOTSUPP;
+        might_sleep();
+        if (local->ops->set_antenna)
+                ret = local->ops->set_antenna(&local->hw, tx_ant, rx_ant);
+        trace_drv_set_antenna(local, tx_ant, rx_ant, ret);
+        return ret;
+}
+
+static inline int drv_get_antenna(struct ieee80211_local *local,
+                                  u32 *tx_ant, u32 *rx_ant)
+{
+        int ret = -EOPNOTSUPP;
+        might_sleep();
+        if (local->ops->get_antenna)
+                ret = local->ops->get_antenna(&local->hw, tx_ant, rx_ant);
+        trace_drv_get_antenna(local, *tx_ant, *rx_ant, ret);
+        return ret;
+}
+
 #endif /* __MAC80211_DRIVER_OPS */
diff --git a/net/mac80211/driver-trace.h b/net/mac80211/driver-trace.h
index 6831fb1641c..c2772f23ac9 100644
--- a/net/mac80211/driver-trace.h
+++ b/net/mac80211/driver-trace.h
@@ -531,6 +531,27 @@ TRACE_EVENT(drv_get_tkip_seq,
         )
 );
 
+TRACE_EVENT(drv_set_frag_threshold,
+        TP_PROTO(struct ieee80211_local *local, u32 value),
+
+        TP_ARGS(local, value),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                __field(u32, value)
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                __entry->value = value;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT " value:%d",
+                LOCAL_PR_ARG, __entry->value
+        )
+);
+
 TRACE_EVENT(drv_set_rts_threshold,
         TP_PROTO(struct ieee80211_local *local, u32 value),
 
@@ -862,6 +883,56 @@ TRACE_EVENT(drv_channel_switch,
         )
 );
 
+TRACE_EVENT(drv_set_antenna,
+        TP_PROTO(struct ieee80211_local *local, u32 tx_ant, u32 rx_ant, int ret),
+
+        TP_ARGS(local, tx_ant, rx_ant, ret),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                __field(u32, tx_ant)
+                __field(u32, rx_ant)
+                __field(int, ret)
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                __entry->tx_ant = tx_ant;
+                __entry->rx_ant = rx_ant;
+                __entry->ret = ret;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT " tx_ant:%d rx_ant:%d ret:%d",
+                LOCAL_PR_ARG, __entry->tx_ant, __entry->rx_ant, __entry->ret
+        )
+);
+
+TRACE_EVENT(drv_get_antenna,
+        TP_PROTO(struct ieee80211_local *local, u32 tx_ant, u32 rx_ant, int ret),
+
+        TP_ARGS(local, tx_ant, rx_ant, ret),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                __field(u32, tx_ant)
+                __field(u32, rx_ant)
+                __field(int, ret)
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                __entry->tx_ant = tx_ant;
+                __entry->rx_ant = rx_ant;
+                __entry->ret = ret;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT " tx_ant:%d rx_ant:%d ret:%d",
+                LOCAL_PR_ARG, __entry->tx_ant, __entry->rx_ant, __entry->ret
+        )
+);
+
 /*
  * Tracing for API calls that drivers call.
  */
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index 239c4836a94..410d104b134 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -915,6 +915,8 @@ int ieee80211_ibss_join(struct ieee80211_sub_if_data *sdata,
 
         sdata->u.ibss.privacy = params->privacy;
         sdata->u.ibss.basic_rates = params->basic_rates;
+        memcpy(sdata->vif.bss_conf.mcast_rate, params->mcast_rate,
+               sizeof(params->mcast_rate));
 
         sdata->vif.bss_conf.beacon_int = params->beacon_interval;
 
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index b80c3868992..5bc0745368f 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -349,6 +349,7 @@ struct ieee80211_if_managed {
         struct work_struct chswitch_work;
         struct work_struct beacon_connection_loss_work;
 
+        unsigned long beacon_timeout;
         unsigned long probe_timeout;
         int probe_send_count;
 
@@ -1264,6 +1265,8 @@ void ieee80211_send_nullfunc(struct ieee80211_local *local,
                              int powersave);
 void ieee80211_sta_rx_notify(struct ieee80211_sub_if_data *sdata,
                              struct ieee80211_hdr *hdr);
+void ieee80211_sta_tx_notify(struct ieee80211_sub_if_data *sdata,
+                             struct ieee80211_hdr *hdr);
 void ieee80211_beacon_connection_loss_work(struct work_struct *work);
 
 void ieee80211_wake_queues_by_reason(struct ieee80211_hw *hw,
@@ -1278,6 +1281,9 @@ void ieee80211_add_pending_skb(struct ieee80211_local *local,
                                struct sk_buff *skb);
 int ieee80211_add_pending_skbs(struct ieee80211_local *local,
                                struct sk_buff_head *skbs);
+int ieee80211_add_pending_skbs_fn(struct ieee80211_local *local,
+                                  struct sk_buff_head *skbs,
+                                  void (*fn)(void *data), void *data);
 
 void ieee80211_send_auth(struct ieee80211_sub_if_data *sdata,
                          u16 transaction, u16 auth_alg,
@@ -1287,6 +1293,10 @@ int ieee80211_build_preq_ies(struct ieee80211_local *local, u8 *buffer,
                              const u8 *ie, size_t ie_len,
                              enum ieee80211_band band, u32 rate_mask,
                              u8 channel);
+struct sk_buff *ieee80211_build_probe_req(struct ieee80211_sub_if_data *sdata,
+                                          u8 *dst,
+                                          const u8 *ssid, size_t ssid_len,
+                                          const u8 *ie, size_t ie_len);
 void ieee80211_send_probe_req(struct ieee80211_sub_if_data *sdata, u8 *dst,
                               const u8 *ssid, size_t ssid_len,
                               const u8 *ie, size_t ie_len);
diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index ccd676b2f59..72df1ca7299 100644
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -84,10 +84,17 @@ static int ieee80211_key_enable_hw_accel(struct ieee80211_key *key)
                 goto out_unsupported;
 
         sdata = key->sdata;
-        if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
+        if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
+                /*
+                 * The driver doesn't know anything about VLAN interfaces.
+                 * Hence, don't send GTKs for VLAN interfaces to the driver.
+                 */
+                if (!(key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE))
+                        goto out_unsupported;
                 sdata = container_of(sdata->bss,
                                      struct ieee80211_sub_if_data,
                                      u.ap);
+        }
 
         ret = drv_set_key(key->local, SET_KEY, sdata, sta, &key->conf);
 
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index a3a9421555a..79480791494 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -28,13 +28,19 @@
 #include "rate.h"
 #include "led.h"
 
+#define IEEE80211_MAX_NULLFUNC_TRIES 2
 #define IEEE80211_MAX_PROBE_TRIES 5
 
 /*
- * beacon loss detection timeout
- * XXX: should depend on beacon interval
+ * Beacon loss timeout is calculated as N frames times the
+ * advertised beacon interval.  This may need to be somewhat
+ * higher than what hardware might detect to account for
+ * delays in the host processing frames. But since we also
+ * probe on beacon miss before declaring the connection lost
+ * default to what we want.
  */
-#define IEEE80211_BEACON_LOSS_TIME      (2 * HZ)
+#define IEEE80211_BEACON_LOSS_COUNT     7
+
 /*
  * Time the connection can be idle before we probe
  * it to see if we can still talk to the AP.
@@ -121,7 +127,7 @@ void ieee80211_sta_reset_beacon_monitor(struct ieee80211_sub_if_data *sdata)
                 return;
 
         mod_timer(&sdata->u.mgd.bcn_mon_timer,
-                  round_jiffies_up(jiffies + IEEE80211_BEACON_LOSS_TIME));
+                  round_jiffies_up(jiffies + sdata->u.mgd.beacon_timeout));
 }
 
 void ieee80211_sta_reset_conn_monitor(struct ieee80211_sub_if_data *sdata)
@@ -871,6 +877,9 @@ static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
         bss_info_changed |= ieee80211_handle_bss_capability(sdata,
                 cbss->capability, bss->has_erp_value, bss->erp_value);
 
+        sdata->u.mgd.beacon_timeout = usecs_to_jiffies(ieee80211_tu_to_usec(
+                IEEE80211_BEACON_LOSS_COUNT * bss_conf->beacon_int));
+
         sdata->u.mgd.associated = cbss;
         memcpy(sdata->u.mgd.bssid, cbss->bssid, ETH_ALEN);
 
@@ -1026,6 +1035,51 @@ void ieee80211_sta_rx_notify(struct ieee80211_sub_if_data *sdata,
         ieee80211_sta_reset_conn_monitor(sdata);
 }
 
+static void ieee80211_reset_ap_probe(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+
+        if (!(ifmgd->flags & (IEEE80211_STA_BEACON_POLL |
+                              IEEE80211_STA_CONNECTION_POLL)))
+            return;
+
+        ifmgd->flags &= ~(IEEE80211_STA_CONNECTION_POLL |
+                          IEEE80211_STA_BEACON_POLL);
+        mutex_lock(&sdata->local->iflist_mtx);
+        ieee80211_recalc_ps(sdata->local, -1);
+        mutex_unlock(&sdata->local->iflist_mtx);
+
+        if (sdata->local->hw.flags & IEEE80211_HW_CONNECTION_MONITOR)
+                return;
+
+        /*
+         * We've received a probe response, but are not sure whether
+         * we have or will be receiving any beacons or data, so let's
+         * schedule the timers again, just in case.
+         */
+        ieee80211_sta_reset_beacon_monitor(sdata);
+
+        mod_timer(&ifmgd->conn_mon_timer,
+                  round_jiffies_up(jiffies +
+                                   IEEE80211_CONNECTION_IDLE_TIME));
+}
+
+void ieee80211_sta_tx_notify(struct ieee80211_sub_if_data *sdata,
+                             struct ieee80211_hdr *hdr)
+{
+        if (!ieee80211_is_data(hdr->frame_control) &&
+            !ieee80211_is_nullfunc(hdr->frame_control))
+            return;
+
+        ieee80211_sta_reset_conn_monitor(sdata);
+
+        if (ieee80211_is_nullfunc(hdr->frame_control) &&
+            sdata->u.mgd.probe_send_count > 0) {
+                sdata->u.mgd.probe_send_count = 0;
+                ieee80211_queue_work(&sdata->local->hw, &sdata->work);
+        }
+}
+
 static void ieee80211_mgd_probe_ap_send(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
@@ -1041,8 +1095,19 @@ static void ieee80211_mgd_probe_ap_send(struct ieee80211_sub_if_data *sdata)
         if (ifmgd->probe_send_count >= unicast_limit)
                 dst = NULL;
 
-        ssid = ieee80211_bss_get_ie(ifmgd->associated, WLAN_EID_SSID);
-        ieee80211_send_probe_req(sdata, dst, ssid + 2, ssid[1], NULL, 0);
+        /*
+         * When the hardware reports an accurate Tx ACK status, it's
+         * better to send a nullfunc frame instead of a probe request,
+         * as it will kick us off the AP quickly if we aren't associated
+         * anymore. The timeout will be reset if the frame is ACKed by
+         * the AP.
+         */
+        if (sdata->local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
+                ieee80211_send_nullfunc(sdata->local, sdata, 0);
+        else {
+                ssid = ieee80211_bss_get_ie(ifmgd->associated, WLAN_EID_SSID);
+                ieee80211_send_probe_req(sdata, dst, ssid + 2, ssid[1], NULL, 0);
+        }
 
         ifmgd->probe_send_count++;
         ifmgd->probe_timeout = jiffies + IEEE80211_PROBE_WAIT;
@@ -1108,6 +1173,30 @@ static void ieee80211_mgd_probe_ap(struct ieee80211_sub_if_data *sdata,
         mutex_unlock(&ifmgd->mtx);
 }
 
+struct sk_buff *ieee80211_ap_probereq_get(struct ieee80211_hw *hw,
+                                          struct ieee80211_vif *vif)
+{
+        struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+        struct sk_buff *skb;
+        const u8 *ssid;
+
+        if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
+                return NULL;
+
+        ASSERT_MGD_MTX(ifmgd);
+
+        if (!ifmgd->associated)
+                return NULL;
+
+        ssid = ieee80211_bss_get_ie(ifmgd->associated, WLAN_EID_SSID);
+        skb = ieee80211_build_probe_req(sdata, ifmgd->associated->bssid,
+                                        ssid + 2, ssid[1], NULL, 0);
+
+        return skb;
+}
+EXPORT_SYMBOL(ieee80211_ap_probereq_get);
+
 static void __ieee80211_connection_loss(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
@@ -1485,29 +1574,8 @@ static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_sub_if_data *sdata,
         ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems, false);
 
         if (ifmgd->associated &&
-            memcmp(mgmt->bssid, ifmgd->associated->bssid, ETH_ALEN) == 0 &&
-            ifmgd->flags & (IEEE80211_STA_BEACON_POLL |
-                            IEEE80211_STA_CONNECTION_POLL)) {
-                ifmgd->flags &= ~(IEEE80211_STA_CONNECTION_POLL |
-                                  IEEE80211_STA_BEACON_POLL);
-                mutex_lock(&sdata->local->iflist_mtx);
-                ieee80211_recalc_ps(sdata->local, -1);
-                mutex_unlock(&sdata->local->iflist_mtx);
-
-                if (sdata->local->hw.flags & IEEE80211_HW_CONNECTION_MONITOR)
-                        return;
-
-                /*
-                 * We've received a probe response, but are not sure whether
-                 * we have or will be receiving any beacons or data, so let's
-                 * schedule the timers again, just in case.
-                 */
-                ieee80211_sta_reset_beacon_monitor(sdata);
-
-                mod_timer(&ifmgd->conn_mon_timer,
-                          round_jiffies_up(jiffies +
-                                           IEEE80211_CONNECTION_IDLE_TIME));
-        }
+            memcmp(mgmt->bssid, ifmgd->associated->bssid, ETH_ALEN) == 0)
+                ieee80211_reset_ap_probe(sdata);
 }
 
 /*
@@ -1857,12 +1925,23 @@ void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
                             IEEE80211_STA_CONNECTION_POLL) &&
             ifmgd->associated) {
                 u8 bssid[ETH_ALEN];
+                int max_tries;
 
                 memcpy(bssid, ifmgd->associated->bssid, ETH_ALEN);
-                if (time_is_after_jiffies(ifmgd->probe_timeout))
+
+                if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
+                        max_tries = IEEE80211_MAX_NULLFUNC_TRIES;
+                else
+                        max_tries = IEEE80211_MAX_PROBE_TRIES;
+
+                /* ACK received for nullfunc probing frame */
+                if (!ifmgd->probe_send_count)
+                        ieee80211_reset_ap_probe(sdata);
+
+                else if (time_is_after_jiffies(ifmgd->probe_timeout))
                         run_again(ifmgd, ifmgd->probe_timeout);
 
-                else if (ifmgd->probe_send_count < IEEE80211_MAX_PROBE_TRIES) {
+                else if (ifmgd->probe_send_count < max_tries) {
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
                         wiphy_debug(local->hw.wiphy,
                                     "%s: No probe response from AP %pM"
@@ -1988,6 +2067,8 @@ void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata)
                 add_timer(&ifmgd->timer);
         if (test_and_clear_bit(TMR_RUNNING_CHANSW, &ifmgd->timers_running))
                 add_timer(&ifmgd->chswitch_timer);
+        ieee80211_sta_reset_beacon_monitor(sdata);
+        ieee80211_restart_sta_timer(sdata);
 }
 #endif
 
diff --git a/net/mac80211/rate.c b/net/mac80211/rate.c
index 33f76993da0..3d5a2cb835c 100644
--- a/net/mac80211/rate.c
+++ b/net/mac80211/rate.c
@@ -211,7 +211,8 @@ static bool rc_no_data_or_no_ack(struct ieee80211_tx_rate_control *txrc)
         return (info->flags & IEEE80211_TX_CTL_NO_ACK) || !ieee80211_is_data(fc);
 }
 
-static void rc_send_low_broadcast(s8 *idx, u32 basic_rates, u8 max_rate_idx)
+static void rc_send_low_broadcast(s8 *idx, u32 basic_rates,
+                                  struct ieee80211_supported_band *sband)
 {
         u8 i;
 
@@ -222,7 +223,7 @@ static void rc_send_low_broadcast(s8 *idx, u32 basic_rates, u8 max_rate_idx)
         if (basic_rates & (1 << *idx))
                 return; /* selected rate is a basic rate */
 
-        for (i = *idx + 1; i <= max_rate_idx; i++) {
+        for (i = *idx + 1; i <= sband->n_bitrates; i++) {
                 if (basic_rates & (1 << i)) {
                         *idx = i;
                         return;
@@ -237,16 +238,25 @@ bool rate_control_send_low(struct ieee80211_sta *sta,
                            struct ieee80211_tx_rate_control *txrc)
 {
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(txrc->skb);
+        struct ieee80211_supported_band *sband = txrc->sband;
+        int mcast_rate;
 
         if (!sta || !priv_sta || rc_no_data_or_no_ack(txrc)) {
                 info->control.rates[0].idx = rate_lowest_index(txrc->sband, sta);
                 info->control.rates[0].count =
                         (info->flags & IEEE80211_TX_CTL_NO_ACK) ?
                         1 : txrc->hw->max_rate_tries;
-                if (!sta && txrc->ap)
+                if (!sta && txrc->bss) {
+                        mcast_rate = txrc->bss_conf->mcast_rate[sband->band];
+                        if (mcast_rate > 0) {
+                                info->control.rates[0].idx = mcast_rate - 1;
+                                return true;
+                        }
+
                         rc_send_low_broadcast(&info->control.rates[0].idx,
                                               txrc->bss_conf->basic_rates,
-                                              txrc->sband->n_bitrates);
+                                              sband);
+                }
                 return true;
         }
         return false;
diff --git a/net/mac80211/rc80211_minstrel_ht.c b/net/mac80211/rc80211_minstrel_ht.c
index 2d6f0259e0c..4ad7a362fcc 100644
--- a/net/mac80211/rc80211_minstrel_ht.c
+++ b/net/mac80211/rc80211_minstrel_ht.c
@@ -371,6 +371,9 @@ minstrel_aggr_check(struct minstrel_priv *mp, struct ieee80211_sta *pubsta, stru
         if (likely(sta->ampdu_mlme.tid_tx[tid]))
                 return;
 
+        if (skb_get_queue_mapping(skb) == IEEE80211_AC_VO)
+                return;
+
         ieee80211_start_tx_ba_session(pubsta, tid);
 }
 
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 902b03ee8f6..d2fcd22ab06 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -1102,8 +1102,6 @@ static void ap_sta_ps_end(struct sta_info *sta)
 
         atomic_dec(&sdata->bss->num_sta_ps);
 
-        clear_sta_flags(sta, WLAN_STA_PS_STA);
-
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
         printk(KERN_DEBUG "%s: STA %pM aid %d exits power save mode\n",
                sdata->name, sta->sta.addr, sta->sta.aid);
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index 6d8f897d876..eff58571fd7 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -199,8 +199,11 @@ static void sta_unblock(struct work_struct *wk)
 
         if (!test_sta_flags(sta, WLAN_STA_PS_STA))
                 ieee80211_sta_ps_deliver_wakeup(sta);
-        else if (test_and_clear_sta_flags(sta, WLAN_STA_PSPOLL))
+        else if (test_and_clear_sta_flags(sta, WLAN_STA_PSPOLL)) {
+                clear_sta_flags(sta, WLAN_STA_PS_DRIVER);
                 ieee80211_sta_ps_deliver_poll_response(sta);
+        } else
+                clear_sta_flags(sta, WLAN_STA_PS_DRIVER);
 }
 
 static int sta_prepare_rate_control(struct ieee80211_local *local,
@@ -880,6 +883,13 @@ struct ieee80211_sta *ieee80211_find_sta(struct ieee80211_vif *vif,
 }
 EXPORT_SYMBOL(ieee80211_find_sta);
 
+static void clear_sta_ps_flags(void *_sta)
+{
+        struct sta_info *sta = _sta;
+
+        clear_sta_flags(sta, WLAN_STA_PS_DRIVER | WLAN_STA_PS_STA);
+}
+
 /* powersave support code */
 void ieee80211_sta_ps_deliver_wakeup(struct sta_info *sta)
 {
@@ -894,7 +904,8 @@ void ieee80211_sta_ps_deliver_wakeup(struct sta_info *sta)
 
         /* Send all buffered frames to the station */
         sent = ieee80211_add_pending_skbs(local, &sta->tx_filtered);
-        buffered = ieee80211_add_pending_skbs(local, &sta->ps_tx_buf);
+        buffered = ieee80211_add_pending_skbs_fn(local, &sta->ps_tx_buf,
+                                                 clear_sta_ps_flags, sta);
         sent += buffered;
         local->total_ps_buffered -= buffered;
 
@@ -973,7 +984,7 @@ void ieee80211_sta_block_awake(struct ieee80211_hw *hw,
 
         if (block)
                 set_sta_flags(sta, WLAN_STA_PS_DRIVER);
-        else
+        else if (test_sta_flags(sta, WLAN_STA_PS_DRIVER))
                 ieee80211_queue_work(hw, &sta->drv_unblock_wk);
 }
 EXPORT_SYMBOL(ieee80211_sta_block_awake);
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index 9265acadef3..b562d9b6a70 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -248,6 +248,7 @@ enum plink_state {
  * @sta: station information we share with the driver
  * @dead: set to true when sta is unlinked
  * @uploaded: set to true when sta is uploaded to the driver
+ * @lost_packets: number of consecutive lost packets
  */
 struct sta_info {
         /* General information, mostly static */
@@ -335,6 +336,8 @@ struct sta_info {
         } debugfs;
 #endif
 
+        unsigned int lost_packets;
+
         /* keep last! */
         struct ieee80211_sta sta;
 };
diff --git a/net/mac80211/status.c b/net/mac80211/status.c
index 3153c19893b..bed7e32ed90 100644
--- a/net/mac80211/status.c
+++ b/net/mac80211/status.c
@@ -155,8 +155,21 @@ static void ieee80211_frame_acked(struct sta_info *sta, struct sk_buff *skb)
 
                 ieee80211_queue_work(&local->hw, &local->recalc_smps);
         }
+
+        if ((sdata->vif.type == NL80211_IFTYPE_STATION) &&
+            (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS))
+                ieee80211_sta_tx_notify(sdata, (void *) skb->data);
 }
 
+/*
+ * Use a static threshold for now, best value to be determined
+ * by testing ...
+ * Should it depend on:
+ *  - on # of retransmissions
+ *  - current throughput (higher value for higher tpt)?
+ */
+#define STA_LOST_PKT_THRESHOLD  50
+
 void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
 {
         struct sk_buff *skb2;
@@ -243,6 +256,19 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
                 if (!(info->flags & IEEE80211_TX_CTL_INJECTED) &&
                     (info->flags & IEEE80211_TX_STAT_ACK))
                         ieee80211_frame_acked(sta, skb);
+
+                if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS) {
+                        if (info->flags & IEEE80211_TX_STAT_ACK) {
+                                if (sta->lost_packets)
+                                        sta->lost_packets = 0;
+                        } else if (++sta->lost_packets >= STA_LOST_PKT_THRESHOLD) {
+                                cfg80211_cqm_pktloss_notify(sta->sdata->dev,
+                                                            sta->sta.addr,
+                                                            sta->lost_packets,
+                                                            GFP_ATOMIC);
+                                sta->lost_packets = 0;
+                        }
+                }
         }
 
         rcu_read_unlock();
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 96c59430950..e69483647f3 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -622,7 +622,8 @@ ieee80211_tx_h_rate_ctrl(struct ieee80211_tx_data *tx)
                 txrc.max_rate_idx = -1;
         else
                 txrc.max_rate_idx = fls(txrc.rate_idx_mask) - 1;
-        txrc.ap = tx->sdata->vif.type == NL80211_IFTYPE_AP;
+        txrc.bss = (tx->sdata->vif.type == NL80211_IFTYPE_AP ||
+                    tx->sdata->vif.type == NL80211_IFTYPE_ADHOC);
 
         /* set up RTS protection if desired */
         if (len > tx->local->hw.wiphy->rts_threshold) {
@@ -1033,6 +1034,7 @@ static bool __ieee80211_parse_tx_radiotap(struct ieee80211_tx_data *tx,
         struct ieee80211_radiotap_header *rthdr =
                 (struct ieee80211_radiotap_header *) skb->data;
         struct ieee80211_supported_band *sband;
+        bool hw_frag;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         int ret = ieee80211_radiotap_iterator_init(&iterator, rthdr, skb->len,
                                                    NULL);
@@ -1042,6 +1044,9 @@ static bool __ieee80211_parse_tx_radiotap(struct ieee80211_tx_data *tx,
         info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
         tx->flags &= ~IEEE80211_TX_FRAGMENTED;
 
+        /* packet is fragmented in HW if we have a non-NULL driver callback */
+        hw_frag = (tx->local->ops->set_frag_threshold != NULL);
+
         /*
          * for every radiotap entry that is present
          * (ieee80211_radiotap_iterator_next returns -ENOENT when no more
@@ -1078,7 +1083,8 @@ static bool __ieee80211_parse_tx_radiotap(struct ieee80211_tx_data *tx,
                         }
                         if (*iterator.this_arg & IEEE80211_RADIOTAP_F_WEP)
                                 info->flags &= ~IEEE80211_TX_INTFL_DONT_ENCRYPT;
-                        if (*iterator.this_arg & IEEE80211_RADIOTAP_F_FRAG)
+                        if ((*iterator.this_arg & IEEE80211_RADIOTAP_F_FRAG) &&
+                                                                !hw_frag)
                                 tx->flags |= IEEE80211_TX_FRAGMENTED;
                         break;
 
@@ -1181,8 +1187,10 @@ ieee80211_tx_prepare(struct ieee80211_sub_if_data *sdata,
         /*
          * Set this flag (used below to indicate "automatic fragmentation"),
          * it will be cleared/left by radiotap as desired.
+         * Only valid when fragmentation is done by the stack.
          */
-        tx->flags |= IEEE80211_TX_FRAGMENTED;
+        if (!local->ops->set_frag_threshold)
+                tx->flags |= IEEE80211_TX_FRAGMENTED;
 
         /* process and remove the injection radiotap header */
         if (unlikely(info->flags & IEEE80211_TX_INTFL_HAS_RADIOTAP)) {
@@ -2301,7 +2309,7 @@ struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
                 txrc.max_rate_idx = -1;
         else
                 txrc.max_rate_idx = fls(txrc.rate_idx_mask) - 1;
-        txrc.ap = true;
+        txrc.bss = true;
         rate_control_get_rate(sdata, NULL, &txrc);
 
         info->control.vif = vif;
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 0b6fc92bc0d..e497476174c 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -368,8 +368,9 @@ void ieee80211_add_pending_skb(struct ieee80211_local *local,
         spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
 }
 
-int ieee80211_add_pending_skbs(struct ieee80211_local *local,
-                               struct sk_buff_head *skbs)
+int ieee80211_add_pending_skbs_fn(struct ieee80211_local *local,
+                                  struct sk_buff_head *skbs,
+                                  void (*fn)(void *data), void *data)
 {
         struct ieee80211_hw *hw = &local->hw;
         struct sk_buff *skb;
@@ -394,6 +395,9 @@ int ieee80211_add_pending_skbs(struct ieee80211_local *local,
                 __skb_queue_tail(&local->pending[queue], skb);
         }
 
+        if (fn)
+                fn(data);
+
         for (i = 0; i < hw->queues; i++)
                 __ieee80211_wake_queue(hw, i,
                         IEEE80211_QUEUE_STOP_REASON_SKB_ADD);
@@ -402,6 +406,12 @@ int ieee80211_add_pending_skbs(struct ieee80211_local *local,
         return ret;
 }
 
+int ieee80211_add_pending_skbs(struct ieee80211_local *local,
+                               struct sk_buff_head *skbs)
+{
+        return ieee80211_add_pending_skbs_fn(local, skbs, NULL, NULL);
+}
+
 void ieee80211_stop_queues_by_reason(struct ieee80211_hw *hw,
                                     enum queue_stop_reason reason)
 {
@@ -1011,9 +1021,10 @@ int ieee80211_build_preq_ies(struct ieee80211_local *local, u8 *buffer,
         return pos - buffer;
 }
 
-void ieee80211_send_probe_req(struct ieee80211_sub_if_data *sdata, u8 *dst,
-                              const u8 *ssid, size_t ssid_len,
-                              const u8 *ie, size_t ie_len)
+struct sk_buff *ieee80211_build_probe_req(struct ieee80211_sub_if_data *sdata,
+                                          u8 *dst,
+                                          const u8 *ssid, size_t ssid_len,
+                                          const u8 *ie, size_t ie_len)
 {
         struct ieee80211_local *local = sdata->local;
         struct sk_buff *skb;
@@ -1027,7 +1038,7 @@ void ieee80211_send_probe_req(struct ieee80211_sub_if_data *sdata, u8 *dst,
         if (!buf) {
                 printk(KERN_DEBUG "%s: failed to allocate temporary IE "
                        "buffer\n", sdata->name);
-                return;
+                return NULL;
         }
 
         chan = ieee80211_frequency_to_channel(
@@ -1050,8 +1061,20 @@ void ieee80211_send_probe_req(struct ieee80211_sub_if_data *sdata, u8 *dst,
         }
 
         IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
-        ieee80211_tx_skb(sdata, skb);
         kfree(buf);
+
+        return skb;
+}
+
+void ieee80211_send_probe_req(struct ieee80211_sub_if_data *sdata, u8 *dst,
+                              const u8 *ssid, size_t ssid_len,
+                              const u8 *ie, size_t ie_len)
+{
+        struct sk_buff *skb;
+
+        skb = ieee80211_build_probe_req(sdata, dst, ssid, ssid_len, ie, ie_len);
+        if (skb)
+                ieee80211_tx_skb(sdata, skb);
 }
 
 u32 ieee80211_sta_get_rates(struct ieee80211_local *local,
@@ -1152,6 +1175,9 @@ int ieee80211_reconfig(struct ieee80211_local *local)
         }
         mutex_unlock(&local->sta_mtx);
 
+        /* setup fragmentation threshold */
+        drv_set_frag_threshold(local, hw->wiphy->frag_threshold);
+
         /* setup RTS threshold */
         drv_set_rts_threshold(local, hw->wiphy->rts_threshold);
 
diff --git a/net/mac80211/wme.c b/net/mac80211/wme.c
index 34e6d02da77..58e75bbc1f9 100644
--- a/net/mac80211/wme.c
+++ b/net/mac80211/wme.c
@@ -21,7 +21,16 @@
 /* Default mapping in classifier to work with default
  * queue setup.
  */
-const int ieee802_1d_to_ac[8] = { 2, 3, 3, 2, 1, 1, 0, 0 };
+const int ieee802_1d_to_ac[8] = {
+        IEEE80211_AC_BE,
+        IEEE80211_AC_BK,
+        IEEE80211_AC_BK,
+        IEEE80211_AC_BE,
+        IEEE80211_AC_VI,
+        IEEE80211_AC_VI,
+        IEEE80211_AC_VO,
+        IEEE80211_AC_VO
+};
 
 static int wme_downgrade_ac(struct sk_buff *skb)
 {