11 files changed, 40 insertions, 320 deletions

diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index c8be8eff70d..b7075f33dc0 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -777,18 +777,14 @@ void ieee80211_process_addba_resp(struct ieee80211_local *local,
 #ifdef CONFIG_MAC80211_HT_DEBUG
         printk(KERN_DEBUG "switched off addBA timer for tid %d\n", tid);
 #endif
-
+        /*
+         * IEEE 802.11-2007 7.3.1.14:
+         * In an ADDBA Response frame, when the Status Code field
+         * is set to 0, the Buffer Size subfield is set to a value
+         * of at least 1.
+         */
         if (le16_to_cpu(mgmt->u.action.u.addba_resp.status)
-                        == WLAN_STATUS_SUCCESS) {
-                /*
-                 * IEEE 802.11-2007 7.3.1.14:
-                 * In an ADDBA Response frame, when the Status Code field
-                 * is set to 0, the Buffer Size subfield is set to a value
-                 * of at least 1.
-                 */
-                if (!buf_size)
-                        goto out;
-
+                        == WLAN_STATUS_SUCCESS && buf_size) {
                 if (test_and_set_bit(HT_AGG_STATE_RESPONSE_RECEIVED,
                                      &tid_tx->state)) {
                         /* ignore duplicate response */
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 86f8f49dae2..a589addf6ce 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -1898,33 +1898,6 @@ static int ieee80211_mgmt_tx(struct wiphy *wiphy, struct net_device *dev,
 
         *cookie = (unsigned long) skb;
 
-        if (is_offchan && local->ops->offchannel_tx) {
-                int ret;
-
-                IEEE80211_SKB_CB(skb)->band = chan->band;
-
-                mutex_lock(&local->mtx);
-
-                if (local->hw_offchan_tx_cookie) {
-                        mutex_unlock(&local->mtx);
-                        return -EBUSY;
-                }
-
-                /* TODO: bitrate control, TX processing? */
-                ret = drv_offchannel_tx(local, skb, chan, channel_type, wait);
-
-                if (ret == 0)
-                        local->hw_offchan_tx_cookie = *cookie;
-                mutex_unlock(&local->mtx);
-
-                /*
-                 * Allow driver to return 1 to indicate it wants to have the
-                 * frame transmitted with a remain_on_channel + regular TX.
-                 */
-                if (ret != 1)
-                        return ret;
-        }
-
         if (is_offchan && local->ops->remain_on_channel) {
                 unsigned int duration;
                 int ret;
@@ -2011,18 +1984,6 @@ static int ieee80211_mgmt_tx_cancel_wait(struct wiphy *wiphy,
 
         mutex_lock(&local->mtx);
 
-        if (local->ops->offchannel_tx_cancel_wait &&
-            local->hw_offchan_tx_cookie == cookie) {
-                ret = drv_offchannel_tx_cancel_wait(local);
-
-                if (!ret)
-                        local->hw_offchan_tx_cookie = 0;
-
-                mutex_unlock(&local->mtx);
-
-                return ret;
-        }
-
         if (local->ops->cancel_remain_on_channel) {
                 cookie ^= 2;
                 ret = ieee80211_cancel_remain_on_channel_hw(local, cookie);
diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
index 1425380983f..9001ff331f0 100644
--- a/net/mac80211/driver-ops.h
+++ b/net/mac80211/driver-ops.h
@@ -590,37 +590,6 @@ static inline int drv_cancel_remain_on_channel(struct ieee80211_local *local)
         return ret;
 }
 
-static inline int drv_offchannel_tx(struct ieee80211_local *local,
-                                    struct sk_buff *skb,
-                                    struct ieee80211_channel *chan,
-                                    enum nl80211_channel_type channel_type,
-                                    unsigned int wait)
-{
-        int ret;
-
-        might_sleep();
-
-        trace_drv_offchannel_tx(local, skb, chan, channel_type, wait);
-        ret = local->ops->offchannel_tx(&local->hw, skb, chan,
-                                        channel_type, wait);
-        trace_drv_return_int(local, ret);
-
-        return ret;
-}
-
-static inline int drv_offchannel_tx_cancel_wait(struct ieee80211_local *local)
-{
-        int ret;
-
-        might_sleep();
-
-        trace_drv_offchannel_tx_cancel_wait(local);
-        ret = local->ops->offchannel_tx_cancel_wait(&local->hw);
-        trace_drv_return_int(local, ret);
-
-        return ret;
-}
-
 static inline int drv_set_ringparam(struct ieee80211_local *local,
                                     u32 tx, u32 rx)
 {
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 400c09bea63..ea741905084 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -1002,7 +1002,6 @@ struct ieee80211_local {
         unsigned int hw_roc_duration;
         u32 hw_roc_cookie;
         bool hw_roc_for_tx;
-        unsigned long hw_offchan_tx_cookie;
 
         /* dummy netdev for use w/ NAPI */
         struct net_device napi_dev;
@@ -1022,69 +1021,6 @@ struct ieee80211_ra_tid {
         u16 tid;
 };
 
-/* Parsed Information Elements */
-struct ieee802_11_elems {
-        u8 *ie_start;
-        size_t total_len;
-
-        /* pointers to IEs */
-        u8 *ssid;
-        u8 *supp_rates;
-        u8 *fh_params;
-        u8 *ds_params;
-        u8 *cf_params;
-        struct ieee80211_tim_ie *tim;
-        u8 *ibss_params;
-        u8 *challenge;
-        u8 *wpa;
-        u8 *rsn;
-        u8 *erp_info;
-        u8 *ext_supp_rates;
-        u8 *wmm_info;
-        u8 *wmm_param;
-        struct ieee80211_ht_cap *ht_cap_elem;
-        struct ieee80211_ht_info *ht_info_elem;
-        struct ieee80211_meshconf_ie *mesh_config;
-        u8 *mesh_id;
-        u8 *peer_link;
-        u8 *preq;
-        u8 *prep;
-        u8 *perr;
-        struct ieee80211_rann_ie *rann;
-        u8 *ch_switch_elem;
-        u8 *country_elem;
-        u8 *pwr_constr_elem;
-        u8 *quiet_elem;         /* first quite element */
-        u8 *timeout_int;
-
-        /* length of them, respectively */
-        u8 ssid_len;
-        u8 supp_rates_len;
-        u8 fh_params_len;
-        u8 ds_params_len;
-        u8 cf_params_len;
-        u8 tim_len;
-        u8 ibss_params_len;
-        u8 challenge_len;
-        u8 wpa_len;
-        u8 rsn_len;
-        u8 erp_info_len;
-        u8 ext_supp_rates_len;
-        u8 wmm_info_len;
-        u8 wmm_param_len;
-        u8 mesh_id_len;
-        u8 peer_link_len;
-        u8 preq_len;
-        u8 prep_len;
-        u8 perr_len;
-        u8 ch_switch_elem_len;
-        u8 country_elem_len;
-        u8 pwr_constr_elem_len;
-        u8 quiet_elem_len;
-        u8 num_of_quiet_elem;   /* can be more the one */
-        u8 timeout_int_len;
-};
-
 static inline struct ieee80211_local *hw_to_local(
         struct ieee80211_hw *hw)
 {
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 866f269183c..104fdd9862b 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -608,6 +608,7 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
         local->hw.max_rates = 1;
         local->hw.max_report_rates = 0;
         local->hw.max_rx_aggregation_subframes = IEEE80211_MAX_AMPDU_BUF;
+        local->hw.max_tx_aggregation_subframes = IEEE80211_MAX_AMPDU_BUF;
         local->hw.conf.long_frame_max_tx_count = wiphy->retry_long;
         local->hw.conf.short_frame_max_tx_count = wiphy->retry_short;
         local->user_power_level = -1;
diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
index 3460108810d..3d8e55ae6ab 100644
--- a/net/mac80211/mesh_hwmp.c
+++ b/net/mac80211/mesh_hwmp.c
@@ -449,7 +449,6 @@ static u32 hwmp_route_info_get(struct ieee80211_sub_if_data *sdata,
 
                 if (fresh_info) {
                         mesh_path_assign_nexthop(mpath, sta);
-                        mpath->flags &= ~MESH_PATH_SN_VALID;
                         mpath->metric = last_hop_metric;
                         mpath->exp_time = time_after(mpath->exp_time, exp_time)
                                           ?  mpath->exp_time : exp_time;
@@ -792,9 +791,9 @@ static void mesh_queue_preq(struct mesh_path *mpath, u8 flags)
                 return;
         }
 
-        spin_lock(&ifmsh->mesh_preq_queue_lock);
+        spin_lock_bh(&ifmsh->mesh_preq_queue_lock);
         if (ifmsh->preq_queue_len == MAX_PREQ_QUEUE_LEN) {
-                spin_unlock(&ifmsh->mesh_preq_queue_lock);
+                spin_unlock_bh(&ifmsh->mesh_preq_queue_lock);
                 kfree(preq_node);
                 if (printk_ratelimit())
                         mhwmp_dbg("PREQ node queue full\n");
@@ -806,7 +805,7 @@ static void mesh_queue_preq(struct mesh_path *mpath, u8 flags)
 
         list_add_tail(&preq_node->list, &ifmsh->preq_queue.list);
         ++ifmsh->preq_queue_len;
-        spin_unlock(&ifmsh->mesh_preq_queue_lock);
+        spin_unlock_bh(&ifmsh->mesh_preq_queue_lock);
 
         if (time_after(jiffies, ifmsh->last_preq + min_preq_int_jiff(sdata)))
                 ieee80211_queue_work(&sdata->local->hw, &sdata->work);
diff --git a/net/mac80211/rc80211_minstrel_ht.c b/net/mac80211/rc80211_minstrel_ht.c
index 66a1eeb279c..21588386a30 100644
--- a/net/mac80211/rc80211_minstrel_ht.c
+++ b/net/mac80211/rc80211_minstrel_ht.c
@@ -608,7 +608,13 @@ minstrel_ht_get_rate(void *priv, struct ieee80211_sta *sta, void *priv_sta,
                 return mac80211_minstrel.get_rate(priv, sta, &msp->legacy, txrc);
 
         info->flags |= mi->tx_flags;
-        sample_idx = minstrel_get_sample_rate(mp, mi);
+
+        /* Don't use EAPOL frames for sampling on non-mrr hw */
+        if (mp->hw->max_rates == 1 &&
+            txrc->skb->protocol == cpu_to_be16(ETH_P_PAE))
+                sample_idx = -1;
+        else
+                sample_idx = minstrel_get_sample_rate(mp, mi);
 
 #ifdef CONFIG_MAC80211_DEBUGFS
         /* use fixed index if set */
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index 8b6ebee073e..0bdbf3b8f28 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -330,6 +330,7 @@ static int sta_info_finish_insert(struct sta_info *sta, bool async)
         ieee80211_sta_debugfs_add(sta);
         rate_control_add_sta_debugfs(sta);
 
+        memset(&sinfo, 0, sizeof(sinfo));
         sinfo.filled = 0;
         sinfo.generation = local->sta_generation;
         cfg80211_new_sta(sdata->dev, sta->sta.addr, &sinfo, GFP_KERNEL);
diff --git a/net/mac80211/status.c b/net/mac80211/status.c
index 1658efaa2e8..a89cca3491b 100644
--- a/net/mac80211/status.c
+++ b/net/mac80211/status.c
@@ -345,9 +345,6 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
                         local->hw_roc_skb_for_status = NULL;
                 }
 
-                if (cookie == local->hw_offchan_tx_cookie)
-                        local->hw_offchan_tx_cookie = 0;
-
                 cfg80211_mgmt_tx_status(
                         skb->dev, cookie, skb->data, skb->len,
                         !!(info->flags & IEEE80211_TX_STAT_ACK), GFP_ATOMIC);
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 8cb0d2d0ac6..69fd494f32f 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1608,7 +1608,9 @@ netdev_tx_t ieee80211_monitor_start_xmit(struct sk_buff *skb,
         struct ieee80211_radiotap_header *prthdr =
                 (struct ieee80211_radiotap_header *)skb->data;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+        struct ieee80211_hdr *hdr;
         u16 len_rthdr;
+        u8 *payload;
 
         /*
          * Frame injection is not allowed if beaconing is not allowed
@@ -1659,6 +1661,24 @@ netdev_tx_t ieee80211_monitor_start_xmit(struct sk_buff *skb,
         skb_set_network_header(skb, len_rthdr);
         skb_set_transport_header(skb, len_rthdr);
 
+        /*
+         * Initialize skb->protocol if the injected frame is a data frame
+         * carrying a rfc1042 header
+         */
+        if (skb->len > len_rthdr + 2) {
+                hdr = (struct ieee80211_hdr *)(skb->data + len_rthdr);
+                if (ieee80211_is_data(hdr->frame_control) &&
+                    skb->len >= len_rthdr +
+                                ieee80211_hdrlen(hdr->frame_control) +
+                                sizeof(rfc1042_header) + 2) {
+                        payload = (u8 *)hdr +
+                                  ieee80211_hdrlen(hdr->frame_control);
+                        if (compare_ether_addr(payload, rfc1042_header) == 0)
+                                skb->protocol = cpu_to_be16((payload[6] << 8) |
+                                                            payload[7]);
+                }
+        }
+
         memset(info, 0, sizeof(*info));
 
         info->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index ddeb1b99838..ce916ff6ef0 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -19,7 +19,6 @@
 #include <linux/etherdevice.h>
 #include <linux/if_arp.h>
 #include <linux/bitmap.h>
-#include <linux/crc32.h>
 #include <net/net_namespace.h>
 #include <net/cfg80211.h>
 #include <net/rtnetlink.h>
@@ -573,172 +572,6 @@ void ieee802_11_parse_elems(u8 *start, size_t len,
         ieee802_11_parse_elems_crc(start, len, elems, 0, 0);
 }
 
-u32 ieee802_11_parse_elems_crc(u8 *start, size_t len,
-                               struct ieee802_11_elems *elems,
-                               u64 filter, u32 crc)
-{
-        size_t left = len;
-        u8 *pos = start;
-        bool calc_crc = filter != 0;
-
-        memset(elems, 0, sizeof(*elems));
-        elems->ie_start = start;
-        elems->total_len = len;
-
-        while (left >= 2) {
-                u8 id, elen;
-
-                id = *pos++;
-                elen = *pos++;
-                left -= 2;
-
-                if (elen > left)
-                        break;
-
-                if (calc_crc && id < 64 && (filter & (1ULL << id)))
-                        crc = crc32_be(crc, pos - 2, elen + 2);
-
-                switch (id) {
-                case WLAN_EID_SSID:
-                        elems->ssid = pos;
-                        elems->ssid_len = elen;
-                        break;
-                case WLAN_EID_SUPP_RATES:
-                        elems->supp_rates = pos;
-                        elems->supp_rates_len = elen;
-                        break;
-                case WLAN_EID_FH_PARAMS:
-                        elems->fh_params = pos;
-                        elems->fh_params_len = elen;
-                        break;
-                case WLAN_EID_DS_PARAMS:
-                        elems->ds_params = pos;
-                        elems->ds_params_len = elen;
-                        break;
-                case WLAN_EID_CF_PARAMS:
-                        elems->cf_params = pos;
-                        elems->cf_params_len = elen;
-                        break;
-                case WLAN_EID_TIM:
-                        if (elen >= sizeof(struct ieee80211_tim_ie)) {
-                                elems->tim = (void *)pos;
-                                elems->tim_len = elen;
-                        }
-                        break;
-                case WLAN_EID_IBSS_PARAMS:
-                        elems->ibss_params = pos;
-                        elems->ibss_params_len = elen;
-                        break;
-                case WLAN_EID_CHALLENGE:
-                        elems->challenge = pos;
-                        elems->challenge_len = elen;
-                        break;
-                case WLAN_EID_VENDOR_SPECIFIC:
-                        if (elen >= 4 && pos[0] == 0x00 && pos[1] == 0x50 &&
-                            pos[2] == 0xf2) {
-                                /* Microsoft OUI (00:50:F2) */
-
-                                if (calc_crc)
-                                        crc = crc32_be(crc, pos - 2, elen + 2);
-
-                                if (pos[3] == 1) {
-                                        /* OUI Type 1 - WPA IE */
-                                        elems->wpa = pos;
-                                        elems->wpa_len = elen;
-                                } else if (elen >= 5 && pos[3] == 2) {
-                                        /* OUI Type 2 - WMM IE */
-                                        if (pos[4] == 0) {
-                                                elems->wmm_info = pos;
-                                                elems->wmm_info_len = elen;
-                                        } else if (pos[4] == 1) {
-                                                elems->wmm_param = pos;
-                                                elems->wmm_param_len = elen;
-                                        }
-                                }
-                        }
-                        break;
-                case WLAN_EID_RSN:
-                        elems->rsn = pos;
-                        elems->rsn_len = elen;
-                        break;
-                case WLAN_EID_ERP_INFO:
-                        elems->erp_info = pos;
-                        elems->erp_info_len = elen;
-                        break;
-                case WLAN_EID_EXT_SUPP_RATES:
-                        elems->ext_supp_rates = pos;
-                        elems->ext_supp_rates_len = elen;
-                        break;
-                case WLAN_EID_HT_CAPABILITY:
-                        if (elen >= sizeof(struct ieee80211_ht_cap))
-                                elems->ht_cap_elem = (void *)pos;
-                        break;
-                case WLAN_EID_HT_INFORMATION:
-                        if (elen >= sizeof(struct ieee80211_ht_info))
-                                elems->ht_info_elem = (void *)pos;
-                        break;
-                case WLAN_EID_MESH_ID:
-                        elems->mesh_id = pos;
-                        elems->mesh_id_len = elen;
-                        break;
-                case WLAN_EID_MESH_CONFIG:
-                        if (elen >= sizeof(struct ieee80211_meshconf_ie))
-                                elems->mesh_config = (void *)pos;
-                        break;
-                case WLAN_EID_PEER_LINK:
-                        elems->peer_link = pos;
-                        elems->peer_link_len = elen;
-                        break;
-                case WLAN_EID_PREQ:
-                        elems->preq = pos;
-                        elems->preq_len = elen;
-                        break;
-                case WLAN_EID_PREP:
-                        elems->prep = pos;
-                        elems->prep_len = elen;
-                        break;
-                case WLAN_EID_PERR:
-                        elems->perr = pos;
-                        elems->perr_len = elen;
-                        break;
-                case WLAN_EID_RANN:
-                        if (elen >= sizeof(struct ieee80211_rann_ie))
-                                elems->rann = (void *)pos;
-                        break;
-                case WLAN_EID_CHANNEL_SWITCH:
-                        elems->ch_switch_elem = pos;
-                        elems->ch_switch_elem_len = elen;
-                        break;
-                case WLAN_EID_QUIET:
-                        if (!elems->quiet_elem) {
-                                elems->quiet_elem = pos;
-                                elems->quiet_elem_len = elen;
-                        }
-                        elems->num_of_quiet_elem++;
-                        break;
-                case WLAN_EID_COUNTRY:
-                        elems->country_elem = pos;
-                        elems->country_elem_len = elen;
-                        break;
-                case WLAN_EID_PWR_CONSTRAINT:
-                        elems->pwr_constr_elem = pos;
-                        elems->pwr_constr_elem_len = elen;
-                        break;
-                case WLAN_EID_TIMEOUT_INTERVAL:
-                        elems->timeout_int = pos;
-                        elems->timeout_int_len = elen;
-                        break;
-                default:
-                        break;
-                }
-
-                left -= elen;
-                pos += elen;
-        }
-
-        return crc;
-}
-
 void ieee80211_set_wmm_default(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_local *local = sdata->local;
@@ -1205,6 +1038,7 @@ int ieee80211_reconfig(struct ieee80211_local *local)
                                              struct ieee80211_sub_if_data,
                                              u.ap);
 
+                        memset(&sta->sta.drv_priv, 0, hw->sta_data_size);
                         WARN_ON(drv_sta_add(local, sdata, &sta->sta));
                 }
         }