Merge branch 'kbuild/rc-fixes' into kbuild/kconfig

We need to revert the temporary hack in 71ebc01, hence the merge.

43 files changed, 2885 insertions, 1538 deletions

diff --git a/net/mac80211/Kconfig b/net/mac80211/Kconfig
index 8a91f6c0bb18..4d6f8653ec88 100644
--- a/net/mac80211/Kconfig
+++ b/net/mac80211/Kconfig
@@ -33,6 +33,13 @@ config MAC80211_RC_MINSTREL
         ---help---
           This option enables the 'minstrel' TX rate control algorithm
 
+config MAC80211_RC_MINSTREL_HT
+        bool "Minstrel 802.11n support" if EMBEDDED
+        depends on MAC80211_RC_MINSTREL
+        default y
+        ---help---
+          This option enables the 'minstrel_ht' TX rate control algorithm
+
 choice
         prompt "Default rate control algorithm"
         depends on MAC80211_HAS_RC
@@ -62,6 +69,7 @@ endchoice
 
 config MAC80211_RC_DEFAULT
         string
+        default "minstrel_ht" if MAC80211_RC_DEFAULT_MINSTREL && MAC80211_RC_MINSTREL_HT
         default "minstrel" if MAC80211_RC_DEFAULT_MINSTREL
         default "pid" if MAC80211_RC_DEFAULT_PID
         default ""
diff --git a/net/mac80211/Makefile b/net/mac80211/Makefile
index 84b48ba8a77e..fdb54e61d637 100644
--- a/net/mac80211/Makefile
+++ b/net/mac80211/Makefile
@@ -51,7 +51,11 @@ rc80211_pid-$(CONFIG_MAC80211_DEBUGFS) += rc80211_pid_debugfs.o
 rc80211_minstrel-y := rc80211_minstrel.o
 rc80211_minstrel-$(CONFIG_MAC80211_DEBUGFS) += rc80211_minstrel_debugfs.o
 
+rc80211_minstrel_ht-y := rc80211_minstrel_ht.o
+rc80211_minstrel_ht-$(CONFIG_MAC80211_DEBUGFS) += rc80211_minstrel_ht_debugfs.o
+
 mac80211-$(CONFIG_MAC80211_RC_PID) += $(rc80211_pid-y)
 mac80211-$(CONFIG_MAC80211_RC_MINSTREL) += $(rc80211_minstrel-y)
+mac80211-$(CONFIG_MAC80211_RC_MINSTREL_HT) += $(rc80211_minstrel_ht-y)
 
 ccflags-y += -D__CHECK_ENDIAN__
diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c
index 6bb9a9a94960..965b272499fd 100644
--- a/net/mac80211/agg-rx.c
+++ b/net/mac80211/agg-rx.c
@@ -6,39 +6,70 @@
  * Copyright 2005-2006, Devicescape Software, Inc.
  * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
  * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
- * Copyright 2007-2008, Intel Corporation
+ * Copyright 2007-2010, Intel Corporation
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  */
 
+/**
+ * DOC: RX A-MPDU aggregation
+ *
+ * Aggregation on the RX side requires only implementing the
+ * @ampdu_action callback that is invoked to start/stop any
+ * block-ack sessions for RX aggregation.
+ *
+ * When RX aggregation is started by the peer, the driver is
+ * notified via @ampdu_action function, with the
+ * %IEEE80211_AMPDU_RX_START action, and may reject the request
+ * in which case a negative response is sent to the peer, if it
+ * accepts it a positive response is sent.
+ *
+ * While the session is active, the device/driver are required
+ * to de-aggregate frames and pass them up one by one to mac80211,
+ * which will handle the reorder buffer.
+ *
+ * When the aggregation session is stopped again by the peer or
+ * ourselves, the driver's @ampdu_action function will be called
+ * with the action %IEEE80211_AMPDU_RX_STOP. In this case, the
+ * call must not fail.
+ */
+
 #include <linux/ieee80211.h>
 #include <linux/slab.h>
 #include <net/mac80211.h>
 #include "ieee80211_i.h"
 #include "driver-ops.h"
 
-static void ___ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid,
-                                            u16 initiator, u16 reason,
-                                            bool from_timer)
+static void ieee80211_free_tid_rx(struct rcu_head *h)
 {
-        struct ieee80211_local *local = sta->local;
-        struct tid_ampdu_rx *tid_rx;
+        struct tid_ampdu_rx *tid_rx =
+                container_of(h, struct tid_ampdu_rx, rcu_head);
         int i;
 
-        spin_lock_bh(&sta->lock);
+        for (i = 0; i < tid_rx->buf_size; i++)
+                dev_kfree_skb(tid_rx->reorder_buf[i]);
+        kfree(tid_rx->reorder_buf);
+        kfree(tid_rx->reorder_time);
+        kfree(tid_rx);
+}
 
-        /* check if TID is in operational state */
-        if (!sta->ampdu_mlme.tid_active_rx[tid]) {
-                spin_unlock_bh(&sta->lock);
-                return;
-        }
+void ___ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid,
+                                     u16 initiator, u16 reason)
+{
+        struct ieee80211_local *local = sta->local;
+        struct tid_ampdu_rx *tid_rx;
 
-        sta->ampdu_mlme.tid_active_rx[tid] = false;
+        lockdep_assert_held(&sta->ampdu_mlme.mtx);
 
         tid_rx = sta->ampdu_mlme.tid_rx[tid];
 
+        if (!tid_rx)
+                return;
+
+        rcu_assign_pointer(sta->ampdu_mlme.tid_rx[tid], NULL);
+
 #ifdef CONFIG_MAC80211_HT_DEBUG
         printk(KERN_DEBUG "Rx BA session stop requested for %pM tid %u\n",
                sta->sta.addr, tid);
@@ -54,32 +85,17 @@ static void ___ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid,
                 ieee80211_send_delba(sta->sdata, sta->sta.addr,
                                      tid, 0, reason);
 
-        /* free the reordering buffer */
-        for (i = 0; i < tid_rx->buf_size; i++) {
-                if (tid_rx->reorder_buf[i]) {
-                        /* release the reordered frames */
-                        dev_kfree_skb(tid_rx->reorder_buf[i]);
-                        tid_rx->stored_mpdu_num--;
-                        tid_rx->reorder_buf[i] = NULL;
-                }
-        }
-
-        /* free resources */
-        kfree(tid_rx->reorder_buf);
-        kfree(tid_rx->reorder_time);
-        sta->ampdu_mlme.tid_rx[tid] = NULL;
-
-        spin_unlock_bh(&sta->lock);
+        del_timer_sync(&tid_rx->session_timer);
 
-        if (!from_timer)
-                del_timer_sync(&tid_rx->session_timer);
-        kfree(tid_rx);
+        call_rcu(&tid_rx->rcu_head, ieee80211_free_tid_rx);
 }
 
 void __ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid,
                                     u16 initiator, u16 reason)
 {
-        ___ieee80211_stop_rx_ba_session(sta, tid, initiator, reason, false);
+        mutex_lock(&sta->ampdu_mlme.mtx);
+        ___ieee80211_stop_rx_ba_session(sta, tid, initiator, reason);
+        mutex_unlock(&sta->ampdu_mlme.mtx);
 }
 
 /*
@@ -100,8 +116,8 @@ static void sta_rx_agg_session_timer_expired(unsigned long data)
 #ifdef CONFIG_MAC80211_HT_DEBUG
         printk(KERN_DEBUG "rx session timer expired on tid %d\n", (u16)*ptid);
 #endif
-        ___ieee80211_stop_rx_ba_session(sta, *ptid, WLAN_BACK_RECIPIENT,
-                                        WLAN_REASON_QSTA_TIMEOUT, true);
+        set_bit(*ptid, sta->ampdu_mlme.tid_rx_timer_expired);
+        ieee80211_queue_work(&sta->local->hw, &sta->ampdu_mlme.work);
 }
 
 static void ieee80211_send_addba_resp(struct ieee80211_sub_if_data *sdata, u8 *da, u16 tid,
@@ -212,9 +228,9 @@ void ieee80211_process_addba_request(struct ieee80211_local *local,
 
 
         /* examine state machine */
-        spin_lock_bh(&sta->lock);
+        mutex_lock(&sta->ampdu_mlme.mtx);
 
-        if (sta->ampdu_mlme.tid_active_rx[tid]) {
+        if (sta->ampdu_mlme.tid_rx[tid]) {
 #ifdef CONFIG_MAC80211_HT_DEBUG
                 if (net_ratelimit())
                         printk(KERN_DEBUG "unexpected AddBA Req from "
@@ -225,9 +241,8 @@ void ieee80211_process_addba_request(struct ieee80211_local *local,
         }
 
         /* prepare A-MPDU MLME for Rx aggregation */
-        sta->ampdu_mlme.tid_rx[tid] =
-                        kmalloc(sizeof(struct tid_ampdu_rx), GFP_ATOMIC);
-        if (!sta->ampdu_mlme.tid_rx[tid]) {
+        tid_agg_rx = kmalloc(sizeof(struct tid_ampdu_rx), GFP_ATOMIC);
+        if (!tid_agg_rx) {
 #ifdef CONFIG_MAC80211_HT_DEBUG
                 if (net_ratelimit())
                         printk(KERN_ERR "allocate rx mlme to tid %d failed\n",
@@ -235,14 +250,11 @@ void ieee80211_process_addba_request(struct ieee80211_local *local,
 #endif
                 goto end;
         }
-        /* rx timer */
-        sta->ampdu_mlme.tid_rx[tid]->session_timer.function =
-                                sta_rx_agg_session_timer_expired;
-        sta->ampdu_mlme.tid_rx[tid]->session_timer.data =
-                                (unsigned long)&sta->timer_to_tid[tid];
-        init_timer(&sta->ampdu_mlme.tid_rx[tid]->session_timer);
 
-        tid_agg_rx = sta->ampdu_mlme.tid_rx[tid];
+        /* rx timer */
+        tid_agg_rx->session_timer.function = sta_rx_agg_session_timer_expired;
+        tid_agg_rx->session_timer.data = (unsigned long)&sta->timer_to_tid[tid];
+        init_timer(&tid_agg_rx->session_timer);
 
         /* prepare reordering buffer */
         tid_agg_rx->reorder_buf =
@@ -257,8 +269,7 @@ void ieee80211_process_addba_request(struct ieee80211_local *local,
 #endif
                 kfree(tid_agg_rx->reorder_buf);
                 kfree(tid_agg_rx->reorder_time);
-                kfree(sta->ampdu_mlme.tid_rx[tid]);
-                sta->ampdu_mlme.tid_rx[tid] = NULL;
+                kfree(tid_agg_rx);
                 goto end;
         }
 
@@ -270,13 +281,12 @@ void ieee80211_process_addba_request(struct ieee80211_local *local,
 
         if (ret) {
                 kfree(tid_agg_rx->reorder_buf);
+                kfree(tid_agg_rx->reorder_time);
                 kfree(tid_agg_rx);
-                sta->ampdu_mlme.tid_rx[tid] = NULL;
                 goto end;
         }
 
-        /* change state and send addba resp */
-        sta->ampdu_mlme.tid_active_rx[tid] = true;
+        /* update data */
         tid_agg_rx->dialog_token = dialog_token;
         tid_agg_rx->ssn = start_seq_num;
         tid_agg_rx->head_seq_num = start_seq_num;
@@ -284,8 +294,15 @@ void ieee80211_process_addba_request(struct ieee80211_local *local,
         tid_agg_rx->timeout = timeout;
         tid_agg_rx->stored_mpdu_num = 0;
         status = WLAN_STATUS_SUCCESS;
+
+        /* activate it for RX */
+        rcu_assign_pointer(sta->ampdu_mlme.tid_rx[tid], tid_agg_rx);
+
+        if (timeout)
+                mod_timer(&tid_agg_rx->session_timer, TU_TO_EXP_TIME(timeout));
+
 end:
-        spin_unlock_bh(&sta->lock);
+        mutex_unlock(&sta->ampdu_mlme.mtx);
 
 end_no_lock:
         ieee80211_send_addba_resp(sta->sdata, sta->sta.addr, tid,
diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index 98258b7341e3..c893f236acea 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -6,7 +6,7 @@
  * Copyright 2005-2006, Devicescape Software, Inc.
  * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
  * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
- * Copyright 2007-2009, Intel Corporation
+ * Copyright 2007-2010, Intel Corporation
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
@@ -21,28 +21,39 @@
 #include "wme.h"
 
 /**
- * DOC: TX aggregation
+ * DOC: TX A-MPDU aggregation
  *
  * Aggregation on the TX side requires setting the hardware flag
- * %IEEE80211_HW_AMPDU_AGGREGATION as well as, if present, the @ampdu_queues
- * hardware parameter to the number of hardware AMPDU queues. If there are no
- * hardware queues then the driver will (currently) have to do all frame
- * buffering.
+ * %IEEE80211_HW_AMPDU_AGGREGATION. The driver will then be handed
+ * packets with a flag indicating A-MPDU aggregation. The driver
+ * or device is responsible for actually aggregating the frames,
+ * as well as deciding how many and which to aggregate.
  *
- * When TX aggregation is started by some subsystem (usually the rate control
- * algorithm would be appropriate) by calling the
- * ieee80211_start_tx_ba_session() function, the driver will be notified via
- * its @ampdu_action function, with the %IEEE80211_AMPDU_TX_START action.
+ * When TX aggregation is started by some subsystem (usually the rate
+ * control algorithm would be appropriate) by calling the
+ * ieee80211_start_tx_ba_session() function, the driver will be
+ * notified via its @ampdu_action function, with the
+ * %IEEE80211_AMPDU_TX_START action.
  *
  * In response to that, the driver is later required to call the
- * ieee80211_start_tx_ba_cb() (or ieee80211_start_tx_ba_cb_irqsafe())
- * function, which will start the aggregation session.
+ * ieee80211_start_tx_ba_cb_irqsafe() function, which will really
+ * start the aggregation session after the peer has also responded.
+ * If the peer responds negatively, the session will be stopped
+ * again right away. Note that it is possible for the aggregation
+ * session to be stopped before the driver has indicated that it
+ * is done setting it up, in which case it must not indicate the
+ * setup completion.
  *
- * Similarly, when the aggregation session is stopped by
- * ieee80211_stop_tx_ba_session(), the driver's @ampdu_action function will
- * be called with the action %IEEE80211_AMPDU_TX_STOP. In this case, the
- * call must not fail, and the driver must later call ieee80211_stop_tx_ba_cb()
- * (or ieee80211_stop_tx_ba_cb_irqsafe()).
+ * Also note that, since we also need to wait for a response from
+ * the peer, the driver is notified of the completion of the
+ * handshake by the %IEEE80211_AMPDU_TX_OPERATIONAL action to the
+ * @ampdu_action callback.
+ *
+ * Similarly, when the aggregation session is stopped by the peer
+ * or something calling ieee80211_stop_tx_ba_session(), the driver's
+ * @ampdu_action function will be called with the action
+ * %IEEE80211_AMPDU_TX_STOP. In this case, the call must not fail,
+ * and the driver must later call ieee80211_stop_tx_ba_cb_irqsafe().
  */
 
 static void ieee80211_send_addba_request(struct ieee80211_sub_if_data *sdata,
@@ -125,25 +136,53 @@ void ieee80211_send_bar(struct ieee80211_sub_if_data *sdata, u8 *ra, u16 tid, u1
         ieee80211_tx_skb(sdata, skb);
 }
 
+static void kfree_tid_tx(struct rcu_head *rcu_head)
+{
+        struct tid_ampdu_tx *tid_tx =
+            container_of(rcu_head, struct tid_ampdu_tx, rcu_head);
+
+        kfree(tid_tx);
+}
+
 int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
                                     enum ieee80211_back_parties initiator)
 {
         struct ieee80211_local *local = sta->local;
+        struct tid_ampdu_tx *tid_tx = sta->ampdu_mlme.tid_tx[tid];
         int ret;
-        u8 *state;
+
+        lockdep_assert_held(&sta->ampdu_mlme.mtx);
+
+        if (!tid_tx)
+                return -ENOENT;
+
+        spin_lock_bh(&sta->lock);
+
+        if (test_bit(HT_AGG_STATE_WANT_START, &tid_tx->state)) {
+                /* not even started yet! */
+                rcu_assign_pointer(sta->ampdu_mlme.tid_tx[tid], NULL);
+                spin_unlock_bh(&sta->lock);
+                call_rcu(&tid_tx->rcu_head, kfree_tid_tx);
+                return 0;
+        }
+
+        spin_unlock_bh(&sta->lock);
 
 #ifdef CONFIG_MAC80211_HT_DEBUG
         printk(KERN_DEBUG "Tx BA session stop requested for %pM tid %u\n",
                sta->sta.addr, tid);
 #endif /* CONFIG_MAC80211_HT_DEBUG */
 
-        state = &sta->ampdu_mlme.tid_state_tx[tid];
+        set_bit(HT_AGG_STATE_STOPPING, &tid_tx->state);
 
-        if (*state == HT_AGG_STATE_OPERATIONAL)
-                sta->ampdu_mlme.addba_req_num[tid] = 0;
+        /*
+         * After this packets are no longer handed right through
+         * to the driver but are put onto tid_tx->pending instead,
+         * with locking to ensure proper access.
+         */
+        clear_bit(HT_AGG_STATE_OPERATIONAL, &tid_tx->state);
 
-        *state = HT_AGG_STATE_REQ_STOP_BA_MSK |
-                (initiator << HT_AGG_STATE_INITIATOR_SHIFT);
+        tid_tx->stop_initiator = initiator;
 
         ret = drv_ampdu_action(local, sta->sdata,
                                IEEE80211_AMPDU_TX_STOP,
@@ -174,16 +213,14 @@ static void sta_addba_resp_timer_expired(unsigned long data)
         u16 tid = *(u8 *)data;
         struct sta_info *sta = container_of((void *)data,
                 struct sta_info, timer_to_tid[tid]);
-        u8 *state;
-
-        state = &sta->ampdu_mlme.tid_state_tx[tid];
+        struct tid_ampdu_tx *tid_tx;
 
         /* check if the TID waits for addBA response */
-        spin_lock_bh(&sta->lock);
-        if ((*state & (HT_ADDBA_REQUESTED_MSK | HT_ADDBA_RECEIVED_MSK |
-                       HT_AGG_STATE_REQ_STOP_BA_MSK)) !=
-                                                HT_ADDBA_REQUESTED_MSK) {
-                spin_unlock_bh(&sta->lock);
+        rcu_read_lock();
+        tid_tx = rcu_dereference(sta->ampdu_mlme.tid_tx[tid]);
+        if (!tid_tx ||
+            test_bit(HT_AGG_STATE_RESPONSE_RECEIVED, &tid_tx->state)) {
+                rcu_read_unlock();
 #ifdef CONFIG_MAC80211_HT_DEBUG
                 printk(KERN_DEBUG "timer expired on tid %d but we are not "
                                 "(or no longer) expecting addBA response there\n",
@@ -196,8 +233,8 @@ static void sta_addba_resp_timer_expired(unsigned long data)
         printk(KERN_DEBUG "addBA response timer expired on tid %d\n", tid);
 #endif
 
-        ___ieee80211_stop_tx_ba_session(sta, tid, WLAN_BACK_INITIATOR);
-        spin_unlock_bh(&sta->lock);
+        ieee80211_stop_tx_ba_session(&sta->sta, tid);
+        rcu_read_unlock();
 }
 
 static inline int ieee80211_ac_from_tid(int tid)
@@ -205,14 +242,112 @@ static inline int ieee80211_ac_from_tid(int tid)
         return ieee802_1d_to_ac[tid & 7];
 }
 
+/*
+ * When multiple aggregation sessions on multiple stations
+ * are being created/destroyed simultaneously, we need to
+ * refcount the global queue stop caused by that in order
+ * to not get into a situation where one of the aggregation
+ * setup or teardown re-enables queues before the other is
+ * ready to handle that.
+ *
+ * These two functions take care of this issue by keeping
+ * a global "agg_queue_stop" refcount.
+ */
+static void __acquires(agg_queue)
+ieee80211_stop_queue_agg(struct ieee80211_local *local, int tid)
+{
+        int queue = ieee80211_ac_from_tid(tid);
+
+        if (atomic_inc_return(&local->agg_queue_stop[queue]) == 1)
+                ieee80211_stop_queue_by_reason(
+                        &local->hw, queue,
+                        IEEE80211_QUEUE_STOP_REASON_AGGREGATION);
+        __acquire(agg_queue);
+}
+
+static void __releases(agg_queue)
+ieee80211_wake_queue_agg(struct ieee80211_local *local, int tid)
+{
+        int queue = ieee80211_ac_from_tid(tid);
+
+        if (atomic_dec_return(&local->agg_queue_stop[queue]) == 0)
+                ieee80211_wake_queue_by_reason(
+                        &local->hw, queue,
+                        IEEE80211_QUEUE_STOP_REASON_AGGREGATION);
+        __release(agg_queue);
+}
+
+void ieee80211_tx_ba_session_handle_start(struct sta_info *sta, int tid)
+{
+        struct tid_ampdu_tx *tid_tx = sta->ampdu_mlme.tid_tx[tid];
+        struct ieee80211_local *local = sta->local;
+        struct ieee80211_sub_if_data *sdata = sta->sdata;
+        u16 start_seq_num;
+        int ret;
+
+        lockdep_assert_held(&sta->ampdu_mlme.mtx);
+
+        /*
+         * While we're asking the driver about the aggregation,
+         * stop the AC queue so that we don't have to worry
+         * about frames that came in while we were doing that,
+         * which would require us to put them to the AC pending
+         * afterwards which just makes the code more complex.
+         */
+        ieee80211_stop_queue_agg(local, tid);
+
+        clear_bit(HT_AGG_STATE_WANT_START, &tid_tx->state);
+
+        /*
+         * make sure no packets are being processed to get
+         * valid starting sequence number
+         */
+        synchronize_net();
+
+        start_seq_num = sta->tid_seq[tid] >> 4;
+
+        ret = drv_ampdu_action(local, sdata, IEEE80211_AMPDU_TX_START,
+                               &sta->sta, tid, &start_seq_num);
+        if (ret) {
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                printk(KERN_DEBUG "BA request denied - HW unavailable for"
+                                        " tid %d\n", tid);
+#endif
+                spin_lock_bh(&sta->lock);
+                rcu_assign_pointer(sta->ampdu_mlme.tid_tx[tid], NULL);
+                spin_unlock_bh(&sta->lock);
+
+                ieee80211_wake_queue_agg(local, tid);
+                call_rcu(&tid_tx->rcu_head, kfree_tid_tx);
+                return;
+        }
+
+        /* we can take packets again now */
+        ieee80211_wake_queue_agg(local, tid);
+
+        /* activate the timer for the recipient's addBA response */
+        mod_timer(&tid_tx->addba_resp_timer, jiffies + ADDBA_RESP_INTERVAL);
+#ifdef CONFIG_MAC80211_HT_DEBUG
+        printk(KERN_DEBUG "activated addBA response timer on tid %d\n", tid);
+#endif
+
+        spin_lock_bh(&sta->lock);
+        sta->ampdu_mlme.addba_req_num[tid]++;
+        spin_unlock_bh(&sta->lock);
+
+        /* send AddBA request */
+        ieee80211_send_addba_request(sdata, sta->sta.addr, tid,
+                                     tid_tx->dialog_token, start_seq_num,
+                                     0x40, 5000);
+}
+
 int ieee80211_start_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid)
 {
         struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
         struct ieee80211_sub_if_data *sdata = sta->sdata;
         struct ieee80211_local *local = sdata->local;
-        u8 *state;
+        struct tid_ampdu_tx *tid_tx;
         int ret = 0;
-        u16 start_seq_num;
 
         trace_api_start_tx_ba_session(pubsta, tid);
 
@@ -239,24 +374,15 @@ int ieee80211_start_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid)
             sdata->vif.type != NL80211_IFTYPE_AP)
                 return -EINVAL;
 
-        if (test_sta_flags(sta, WLAN_STA_DISASSOC)) {
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                printk(KERN_DEBUG "Disassociation is in progress. "
-                       "Denying BA session request\n");
-#endif
-                return -EINVAL;
-        }
-
         if (test_sta_flags(sta, WLAN_STA_BLOCK_BA)) {
 #ifdef CONFIG_MAC80211_HT_DEBUG
-                printk(KERN_DEBUG "Suspend in progress. "
+                printk(KERN_DEBUG "BA sessions blocked. "
                        "Denying BA session request\n");
 #endif
                 return -EINVAL;
         }
 
         spin_lock_bh(&sta->lock);
-        spin_lock(&local->ampdu_lock);
 
         /* we have tried too many times, receiver does not want A-MPDU */
         if (sta->ampdu_mlme.addba_req_num[tid] > HT_AGG_MAX_RETRIES) {
@@ -264,9 +390,9 @@ int ieee80211_start_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid)
                 goto err_unlock_sta;
         }
 
-        state = &sta->ampdu_mlme.tid_state_tx[tid];
+        tid_tx = sta->ampdu_mlme.tid_tx[tid];
         /* check if the TID is not in aggregation flow already */
-        if (*state != HT_AGG_STATE_IDLE) {
+        if (tid_tx) {
 #ifdef CONFIG_MAC80211_HT_DEBUG
                 printk(KERN_DEBUG "BA request denied - session is not "
                                  "idle on tid %u\n", tid);
@@ -275,96 +401,37 @@ int ieee80211_start_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid)
                 goto err_unlock_sta;
         }
 
-        /*
-         * While we're asking the driver about the aggregation,
-         * stop the AC queue so that we don't have to worry
-         * about frames that came in while we were doing that,
-         * which would require us to put them to the AC pending
-         * afterwards which just makes the code more complex.
-         */
-        ieee80211_stop_queue_by_reason(
-                &local->hw, ieee80211_ac_from_tid(tid),
-                IEEE80211_QUEUE_STOP_REASON_AGGREGATION);
-
         /* prepare A-MPDU MLME for Tx aggregation */
-        sta->ampdu_mlme.tid_tx[tid] =
-                        kmalloc(sizeof(struct tid_ampdu_tx), GFP_ATOMIC);
-        if (!sta->ampdu_mlme.tid_tx[tid]) {
+        tid_tx = kzalloc(sizeof(struct tid_ampdu_tx), GFP_ATOMIC);
+        if (!tid_tx) {
 #ifdef CONFIG_MAC80211_HT_DEBUG
                 if (net_ratelimit())
                         printk(KERN_ERR "allocate tx mlme to tid %d failed\n",
                                         tid);
 #endif
                 ret = -ENOMEM;
-                goto err_wake_queue;
+                goto err_unlock_sta;
         }
 
-        skb_queue_head_init(&sta->ampdu_mlme.tid_tx[tid]->pending);
+        skb_queue_head_init(&tid_tx->pending);
+        __set_bit(HT_AGG_STATE_WANT_START, &tid_tx->state);
 
         /* Tx timer */
-        sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer.function =
-                        sta_addba_resp_timer_expired;
-        sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer.data =
-                        (unsigned long)&sta->timer_to_tid[tid];
-        init_timer(&sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer);
-
-        /* Ok, the Addba frame hasn't been sent yet, but if the driver calls the
-         * call back right away, it must see that the flow has begun */
-        *state |= HT_ADDBA_REQUESTED_MSK;
-
-        start_seq_num = sta->tid_seq[tid] >> 4;
-
-        ret = drv_ampdu_action(local, sdata, IEEE80211_AMPDU_TX_START,
-                               pubsta, tid, &start_seq_num);
+        tid_tx->addba_resp_timer.function = sta_addba_resp_timer_expired;
+        tid_tx->addba_resp_timer.data = (unsigned long)&sta->timer_to_tid[tid];
+        init_timer(&tid_tx->addba_resp_timer);
 
-        if (ret) {
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                printk(KERN_DEBUG "BA request denied - HW unavailable for"
-                                        " tid %d\n", tid);
-#endif /* CONFIG_MAC80211_HT_DEBUG */
-                *state = HT_AGG_STATE_IDLE;
-                goto err_free;
-        }
-
-        /* Driver vetoed or OKed, but we can take packets again now */
-        ieee80211_wake_queue_by_reason(
-                &local->hw, ieee80211_ac_from_tid(tid),
-                IEEE80211_QUEUE_STOP_REASON_AGGREGATION);
-
-        spin_unlock(&local->ampdu_lock);
-
-        /* prepare tid data */
+        /* assign a dialog token */
         sta->ampdu_mlme.dialog_token_allocator++;
-        sta->ampdu_mlme.tid_tx[tid]->dialog_token =
-                        sta->ampdu_mlme.dialog_token_allocator;
-        sta->ampdu_mlme.tid_tx[tid]->ssn = start_seq_num;
+        tid_tx->dialog_token = sta->ampdu_mlme.dialog_token_allocator;
 
-        spin_unlock_bh(&sta->lock);
+        /* finally, assign it to the array */
+        rcu_assign_pointer(sta->ampdu_mlme.tid_tx[tid], tid_tx);
 
-        /* send AddBA request */
-        ieee80211_send_addba_request(sdata, pubsta->addr, tid,
-                         sta->ampdu_mlme.tid_tx[tid]->dialog_token,
-                         sta->ampdu_mlme.tid_tx[tid]->ssn,
-                         0x40, 5000);
-        sta->ampdu_mlme.addba_req_num[tid]++;
-        /* activate the timer for the recipient's addBA response */
-        sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer.expires =
-                                jiffies + ADDBA_RESP_INTERVAL;
-        add_timer(&sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer);
-#ifdef CONFIG_MAC80211_HT_DEBUG
-        printk(KERN_DEBUG "activated addBA response timer on tid %d\n", tid);
-#endif
-        return 0;
-
- err_free:
-        kfree(sta->ampdu_mlme.tid_tx[tid]);
-        sta->ampdu_mlme.tid_tx[tid] = NULL;
- err_wake_queue:
-        ieee80211_wake_queue_by_reason(
-                &local->hw, ieee80211_ac_from_tid(tid),
-                IEEE80211_QUEUE_STOP_REASON_AGGREGATION);
+        ieee80211_queue_work(&local->hw, &sta->ampdu_mlme.work);
+
+        /* this flow continues off the work */
  err_unlock_sta:
-        spin_unlock(&local->ampdu_lock);
         spin_unlock_bh(&sta->lock);
         return ret;
 }
@@ -372,69 +439,65 @@ EXPORT_SYMBOL(ieee80211_start_tx_ba_session);
 
 /*
  * splice packets from the STA's pending to the local pending,
- * requires a call to ieee80211_agg_splice_finish and holding
- * local->ampdu_lock across both calls.
+ * requires a call to ieee80211_agg_splice_finish later
  */
-static void ieee80211_agg_splice_packets(struct ieee80211_local *local,
-                                         struct sta_info *sta, u16 tid)
+static void __acquires(agg_queue)
+ieee80211_agg_splice_packets(struct ieee80211_local *local,
+                             struct tid_ampdu_tx *tid_tx, u16 tid)
 {
+        int queue = ieee80211_ac_from_tid(tid);
         unsigned long flags;
-        u16 queue = ieee80211_ac_from_tid(tid);
-
-        ieee80211_stop_queue_by_reason(
-                &local->hw, queue,
-                IEEE80211_QUEUE_STOP_REASON_AGGREGATION);
 
-        if (!(sta->ampdu_mlme.tid_state_tx[tid] & HT_ADDBA_REQUESTED_MSK))
-                return;
+        ieee80211_stop_queue_agg(local, tid);
 
-        if (WARN(!sta->ampdu_mlme.tid_tx[tid],
-                 "TID %d gone but expected when splicing aggregates from"
-                 "the pending queue\n", tid))
+        if (WARN(!tid_tx, "TID %d gone but expected when splicing aggregates"
+                          " from the pending queue\n", tid))
                 return;
 
-        if (!skb_queue_empty(&sta->ampdu_mlme.tid_tx[tid]->pending)) {
+        if (!skb_queue_empty(&tid_tx->pending)) {
                 spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
                 /* copy over remaining packets */
-                skb_queue_splice_tail_init(
-                        &sta->ampdu_mlme.tid_tx[tid]->pending,
-                        &local->pending[queue]);
+                skb_queue_splice_tail_init(&tid_tx->pending,
+                                           &local->pending[queue]);
                 spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
         }
 }
 
-static void ieee80211_agg_splice_finish(struct ieee80211_local *local,
-                                        struct sta_info *sta, u16 tid)
+static void __releases(agg_queue)
+ieee80211_agg_splice_finish(struct ieee80211_local *local, u16 tid)
 {
-        u16 queue = ieee80211_ac_from_tid(tid);
-
-        ieee80211_wake_queue_by_reason(
-                &local->hw, queue,
-                IEEE80211_QUEUE_STOP_REASON_AGGREGATION);
+        ieee80211_wake_queue_agg(local, tid);
 }
 
-/* caller must hold sta->lock */
 static void ieee80211_agg_tx_operational(struct ieee80211_local *local,
                                          struct sta_info *sta, u16 tid)
 {
+        lockdep_assert_held(&sta->ampdu_mlme.mtx);
+
 #ifdef CONFIG_MAC80211_HT_DEBUG
         printk(KERN_DEBUG "Aggregation is on for tid %d\n", tid);
 #endif
 
-        spin_lock(&local->ampdu_lock);
-        ieee80211_agg_splice_packets(local, sta, tid);
-        /*
-         * NB: we rely on sta->lock being taken in the TX
-         * processing here when adding to the pending queue,
-         * otherwise we could only change the state of the
-         * session to OPERATIONAL _here_.
-         */
-        ieee80211_agg_splice_finish(local, sta, tid);
-        spin_unlock(&local->ampdu_lock);
-
         drv_ampdu_action(local, sta->sdata,
                          IEEE80211_AMPDU_TX_OPERATIONAL,
                          &sta->sta, tid, NULL);
+
+        /*
+         * synchronize with TX path, while splicing the TX path
+         * should block so it won't put more packets onto pending.
+         */
+        spin_lock_bh(&sta->lock);
+
+        ieee80211_agg_splice_packets(local, sta->ampdu_mlme.tid_tx[tid], tid);
+        /*
+         * Now mark as operational. This will be visible
+         * in the TX path, and lets it go lock-free in
+         * the common case.
+         */
+        set_bit(HT_AGG_STATE_OPERATIONAL, &sta->ampdu_mlme.tid_tx[tid]->state);
+        ieee80211_agg_splice_finish(local, tid);
+
+        spin_unlock_bh(&sta->lock);
 }
 
 void ieee80211_start_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u16 tid)
@@ -442,7 +505,7 @@ void ieee80211_start_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u16 tid)
         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
         struct ieee80211_local *local = sdata->local;
         struct sta_info *sta;
-        u8 *state;
+        struct tid_ampdu_tx *tid_tx;
 
         trace_api_start_tx_ba_cb(sdata, ra, tid);
 
@@ -454,42 +517,36 @@ void ieee80211_start_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u16 tid)
                 return;
         }
 
-        rcu_read_lock();
+        mutex_lock(&local->sta_mtx);
         sta = sta_info_get(sdata, ra);
         if (!sta) {
-                rcu_read_unlock();
+                mutex_unlock(&local->sta_mtx);
 #ifdef CONFIG_MAC80211_HT_DEBUG
                 printk(KERN_DEBUG "Could not find station: %pM\n", ra);
 #endif
                 return;
         }
 
-        state = &sta->ampdu_mlme.tid_state_tx[tid];
-        spin_lock_bh(&sta->lock);
+        mutex_lock(&sta->ampdu_mlme.mtx);
+        tid_tx = sta->ampdu_mlme.tid_tx[tid];
 
-        if (WARN_ON(!(*state & HT_ADDBA_REQUESTED_MSK))) {
+        if (WARN_ON(!tid_tx)) {
 #ifdef CONFIG_MAC80211_HT_DEBUG
-                printk(KERN_DEBUG "addBA was not requested yet, state is %d\n",
-                                *state);
+                printk(KERN_DEBUG "addBA was not requested!\n");
 #endif
-                spin_unlock_bh(&sta->lock);
-                rcu_read_unlock();
-                return;
+                goto unlock;
         }
 
-        if (WARN_ON(*state & HT_ADDBA_DRV_READY_MSK))
-                goto out;
-
-        *state |= HT_ADDBA_DRV_READY_MSK;
+        if (WARN_ON(test_and_set_bit(HT_AGG_STATE_DRV_READY, &tid_tx->state)))
+                goto unlock;
 
-        if (*state == HT_AGG_STATE_OPERATIONAL)
+        if (test_bit(HT_AGG_STATE_RESPONSE_RECEIVED, &tid_tx->state))
                 ieee80211_agg_tx_operational(local, sta, tid);
 
- out:
-        spin_unlock_bh(&sta->lock);
-        rcu_read_unlock();
+ unlock:
+        mutex_unlock(&sta->ampdu_mlme.mtx);
+        mutex_unlock(&local->sta_mtx);
 }
-EXPORT_SYMBOL(ieee80211_start_tx_ba_cb);
 
 void ieee80211_start_tx_ba_cb_irqsafe(struct ieee80211_vif *vif,
                                       const u8 *ra, u16 tid)
@@ -510,44 +567,36 @@ void ieee80211_start_tx_ba_cb_irqsafe(struct ieee80211_vif *vif,
         ra_tid = (struct ieee80211_ra_tid *) &skb->cb;
         memcpy(&ra_tid->ra, ra, ETH_ALEN);
         ra_tid->tid = tid;
-        ra_tid->vif = vif;
 
-        skb->pkt_type = IEEE80211_ADDBA_MSG;
-        skb_queue_tail(&local->skb_queue, skb);
-        tasklet_schedule(&local->tasklet);
+        skb->pkt_type = IEEE80211_SDATA_QUEUE_AGG_START;
+        skb_queue_tail(&sdata->skb_queue, skb);
+        ieee80211_queue_work(&local->hw, &sdata->work);
 }
 EXPORT_SYMBOL(ieee80211_start_tx_ba_cb_irqsafe);
 
 int __ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
                                    enum ieee80211_back_parties initiator)
 {
-        u8 *state;
         int ret;
 
-        /* check if the TID is in aggregation */
-        state = &sta->ampdu_mlme.tid_state_tx[tid];
-        spin_lock_bh(&sta->lock);
-
-        if (*state != HT_AGG_STATE_OPERATIONAL) {
-                ret = -ENOENT;
-                goto unlock;
-        }
+        mutex_lock(&sta->ampdu_mlme.mtx);
 
         ret = ___ieee80211_stop_tx_ba_session(sta, tid, initiator);
 
- unlock:
-        spin_unlock_bh(&sta->lock);
+        mutex_unlock(&sta->ampdu_mlme.mtx);
+
         return ret;
 }
 
-int ieee80211_stop_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid,
-                                 enum ieee80211_back_parties initiator)
+int ieee80211_stop_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid)
 {
         struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
         struct ieee80211_sub_if_data *sdata = sta->sdata;
         struct ieee80211_local *local = sdata->local;
+        struct tid_ampdu_tx *tid_tx;
+        int ret = 0;
 
-        trace_api_stop_tx_ba_session(pubsta, tid, initiator);
+        trace_api_stop_tx_ba_session(pubsta, tid);
 
         if (!local->ops->ampdu_action)
                 return -EINVAL;
@@ -555,7 +604,26 @@ int ieee80211_stop_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid,
         if (tid >= STA_TID_NUM)
                 return -EINVAL;
 
-        return __ieee80211_stop_tx_ba_session(sta, tid, initiator);
+        spin_lock_bh(&sta->lock);
+        tid_tx = sta->ampdu_mlme.tid_tx[tid];
+
+        if (!tid_tx) {
+                ret = -ENOENT;
+                goto unlock;
+        }
+
+        if (test_bit(HT_AGG_STATE_STOPPING, &tid_tx->state)) {
+                /* already in progress stopping it */
+                ret = 0;
+                goto unlock;
+        }
+
+        set_bit(HT_AGG_STATE_WANT_STOP, &tid_tx->state);
+        ieee80211_queue_work(&local->hw, &sta->ampdu_mlme.work);
+
+ unlock:
+        spin_unlock_bh(&sta->lock);
+        return ret;
 }
 EXPORT_SYMBOL(ieee80211_stop_tx_ba_session);
 
@@ -564,7 +632,7 @@ void ieee80211_stop_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u8 tid)
         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
         struct ieee80211_local *local = sdata->local;
         struct sta_info *sta;
-        u8 *state;
+        struct tid_ampdu_tx *tid_tx;
 
         trace_api_stop_tx_ba_cb(sdata, ra, tid);
 
@@ -581,51 +649,56 @@ void ieee80211_stop_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u8 tid)
                ra, tid);
 #endif /* CONFIG_MAC80211_HT_DEBUG */
 
-        rcu_read_lock();
+        mutex_lock(&local->sta_mtx);
+
         sta = sta_info_get(sdata, ra);
         if (!sta) {
 #ifdef CONFIG_MAC80211_HT_DEBUG
                 printk(KERN_DEBUG "Could not find station: %pM\n", ra);
 #endif
-                rcu_read_unlock();
-                return;
+                goto unlock;
         }
-        state = &sta->ampdu_mlme.tid_state_tx[tid];
 
-        /* NOTE: no need to use sta->lock in this state check, as
-         * ieee80211_stop_tx_ba_session will let only one stop call to
-         * pass through per sta/tid
-         */
-        if ((*state & HT_AGG_STATE_REQ_STOP_BA_MSK) == 0) {
+        mutex_lock(&sta->ampdu_mlme.mtx);
+        spin_lock_bh(&sta->lock);
+        tid_tx = sta->ampdu_mlme.tid_tx[tid];
+
+        if (!tid_tx || !test_bit(HT_AGG_STATE_STOPPING, &tid_tx->state)) {
 #ifdef CONFIG_MAC80211_HT_DEBUG
                 printk(KERN_DEBUG "unexpected callback to A-MPDU stop\n");
 #endif
-                rcu_read_unlock();
-                return;
+                goto unlock_sta;
         }
 
-        if (*state & HT_AGG_STATE_INITIATOR_MSK)
+        if (tid_tx->stop_initiator == WLAN_BACK_INITIATOR)
                 ieee80211_send_delba(sta->sdata, ra, tid,
                         WLAN_BACK_INITIATOR, WLAN_REASON_QSTA_NOT_USE);
 
-        spin_lock_bh(&sta->lock);
-        spin_lock(&local->ampdu_lock);
+        /*
+         * When we get here, the TX path will not be lockless any more wrt.
+         * aggregation, since the OPERATIONAL bit has long been cleared.
+         * Thus it will block on getting the lock, if it occurs. So if we
+         * stop the queue now, we will not get any more packets, and any
+         * that might be being processed will wait for us here, thereby
+         * guaranteeing that no packets go to the tid_tx pending queue any
+         * more.
+         */
 
-        ieee80211_agg_splice_packets(local, sta, tid);
+        ieee80211_agg_splice_packets(local, tid_tx, tid);
 
-        *state = HT_AGG_STATE_IDLE;
-        /* from now on packets are no longer put onto sta->pending */
-        kfree(sta->ampdu_mlme.tid_tx[tid]);
-        sta->ampdu_mlme.tid_tx[tid] = NULL;
+        /* future packets must not find the tid_tx struct any more */
+        rcu_assign_pointer(sta->ampdu_mlme.tid_tx[tid], NULL);
 
-        ieee80211_agg_splice_finish(local, sta, tid);
+        ieee80211_agg_splice_finish(local, tid);
 
-        spin_unlock(&local->ampdu_lock);
-        spin_unlock_bh(&sta->lock);
+        call_rcu(&tid_tx->rcu_head, kfree_tid_tx);
 
-        rcu_read_unlock();
+ unlock_sta:
+        spin_unlock_bh(&sta->lock);
+        mutex_unlock(&sta->ampdu_mlme.mtx);
+ unlock:
+        mutex_unlock(&local->sta_mtx);
 }
-EXPORT_SYMBOL(ieee80211_stop_tx_ba_cb);
 
 void ieee80211_stop_tx_ba_cb_irqsafe(struct ieee80211_vif *vif,
                                      const u8 *ra, u16 tid)
@@ -646,11 +719,10 @@ void ieee80211_stop_tx_ba_cb_irqsafe(struct ieee80211_vif *vif,
         ra_tid = (struct ieee80211_ra_tid *) &skb->cb;
         memcpy(&ra_tid->ra, ra, ETH_ALEN);
         ra_tid->tid = tid;
-        ra_tid->vif = vif;
 
-        skb->pkt_type = IEEE80211_DELBA_MSG;
-        skb_queue_tail(&local->skb_queue, skb);
-        tasklet_schedule(&local->tasklet);
+        skb->pkt_type = IEEE80211_SDATA_QUEUE_AGG_STOP;
+        skb_queue_tail(&sdata->skb_queue, skb);
+        ieee80211_queue_work(&local->hw, &sdata->work);
 }
 EXPORT_SYMBOL(ieee80211_stop_tx_ba_cb_irqsafe);
 
@@ -660,40 +732,40 @@ void ieee80211_process_addba_resp(struct ieee80211_local *local,
                                   struct ieee80211_mgmt *mgmt,
                                   size_t len)
 {
+        struct tid_ampdu_tx *tid_tx;
         u16 capab, tid;
-        u8 *state;
 
         capab = le16_to_cpu(mgmt->u.action.u.addba_resp.capab);
         tid = (capab & IEEE80211_ADDBA_PARAM_TID_MASK) >> 2;
 
-        state = &sta->ampdu_mlme.tid_state_tx[tid];
-
-        spin_lock_bh(&sta->lock);
+        mutex_lock(&sta->ampdu_mlme.mtx);
 
-        if (!(*state & HT_ADDBA_REQUESTED_MSK))
+        tid_tx = sta->ampdu_mlme.tid_tx[tid];
+        if (!tid_tx)
                 goto out;
 
-        if (mgmt->u.action.u.addba_resp.dialog_token !=
-                sta->ampdu_mlme.tid_tx[tid]->dialog_token) {
+        if (mgmt->u.action.u.addba_resp.dialog_token != tid_tx->dialog_token) {
 #ifdef CONFIG_MAC80211_HT_DEBUG
                 printk(KERN_DEBUG "wrong addBA response token, tid %d\n", tid);
-#endif /* CONFIG_MAC80211_HT_DEBUG */
+#endif
                 goto out;
         }
 
-        del_timer(&sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer);
+        del_timer(&tid_tx->addba_resp_timer);
 
 #ifdef CONFIG_MAC80211_HT_DEBUG
         printk(KERN_DEBUG "switched off addBA timer for tid %d\n", tid);
-#endif /* CONFIG_MAC80211_HT_DEBUG */
+#endif
 
         if (le16_to_cpu(mgmt->u.action.u.addba_resp.status)
                         == WLAN_STATUS_SUCCESS) {
-                u8 curstate = *state;
-
-                *state |= HT_ADDBA_RECEIVED_MSK;
+                if (test_and_set_bit(HT_AGG_STATE_RESPONSE_RECEIVED,
+                                     &tid_tx->state)) {
+                        /* ignore duplicate response */
+                        goto out;
+                }
 
-                if (*state != curstate && *state == HT_AGG_STATE_OPERATIONAL)
+                if (test_bit(HT_AGG_STATE_DRV_READY, &tid_tx->state))
                         ieee80211_agg_tx_operational(local, sta, tid);
 
                 sta->ampdu_mlme.addba_req_num[tid] = 0;
@@ -702,5 +774,5 @@ void ieee80211_process_addba_resp(struct ieee80211_local *local,
         }
 
  out:
-        spin_unlock_bh(&sta->lock);
+        mutex_unlock(&sta->ampdu_mlme.mtx);
 }
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 67ee34f57df7..29ac8e1a509e 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -120,6 +120,9 @@ static int ieee80211_add_key(struct wiphy *wiphy, struct net_device *dev,
         struct ieee80211_key *key;
         int err;
 
+        if (!netif_running(dev))
+                return -ENETDOWN;
+
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
         switch (params->cipher) {
@@ -140,17 +143,22 @@ static int ieee80211_add_key(struct wiphy *wiphy, struct net_device *dev,
                 return -EINVAL;
         }
 
+        /* reject WEP and TKIP keys if WEP failed to initialize */
+        if ((alg == ALG_WEP || alg == ALG_TKIP) &&
+            IS_ERR(sdata->local->wep_tx_tfm))
+                return -EINVAL;
+
         key = ieee80211_key_alloc(alg, key_idx, params->key_len, params->key,
                                   params->seq_len, params->seq);
         if (!key)
                 return -ENOMEM;
 
-        rcu_read_lock();
+        mutex_lock(&sdata->local->sta_mtx);
 
         if (mac_addr) {
                 sta = sta_info_get_bss(sdata, mac_addr);
                 if (!sta) {
-                        ieee80211_key_free(key);
+                        ieee80211_key_free(sdata->local, key);
                         err = -ENOENT;
                         goto out_unlock;
                 }
@@ -160,7 +168,7 @@ static int ieee80211_add_key(struct wiphy *wiphy, struct net_device *dev,
 
         err = 0;
  out_unlock:
-        rcu_read_unlock();
+        mutex_unlock(&sdata->local->sta_mtx);
 
         return err;
 }
@@ -174,7 +182,7 @@ static int ieee80211_del_key(struct wiphy *wiphy, struct net_device *dev,
 
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
-        rcu_read_lock();
+        mutex_lock(&sdata->local->sta_mtx);
 
         if (mac_addr) {
                 ret = -ENOENT;
@@ -184,7 +192,7 @@ static int ieee80211_del_key(struct wiphy *wiphy, struct net_device *dev,
                         goto out_unlock;
 
                 if (sta->key) {
-                        ieee80211_key_free(sta->key);
+                        ieee80211_key_free(sdata->local, sta->key);
                         WARN_ON(sta->key);
                         ret = 0;
                 }
@@ -197,12 +205,12 @@ static int ieee80211_del_key(struct wiphy *wiphy, struct net_device *dev,
                 goto out_unlock;
         }
 
-        ieee80211_key_free(sdata->keys[key_idx]);
+        ieee80211_key_free(sdata->local, sdata->keys[key_idx]);
         WARN_ON(sdata->keys[key_idx]);
 
         ret = 0;
  out_unlock:
-        rcu_read_unlock();
+        mutex_unlock(&sdata->local->sta_mtx);
 
         return ret;
 }
@@ -305,15 +313,10 @@ static int ieee80211_config_default_key(struct wiphy *wiphy,
                                         struct net_device *dev,
                                         u8 key_idx)
 {
-        struct ieee80211_sub_if_data *sdata;
-
-        rcu_read_lock();
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
-        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         ieee80211_set_default_key(sdata, key_idx);
 
-        rcu_read_unlock();
-
         return 0;
 }
 
@@ -321,15 +324,10 @@ static int ieee80211_config_default_mgmt_key(struct wiphy *wiphy,
                                              struct net_device *dev,
                                              u8 key_idx)
 {
-        struct ieee80211_sub_if_data *sdata;
-
-        rcu_read_lock();
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
-        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         ieee80211_set_default_mgmt_key(sdata, key_idx);
 
-        rcu_read_unlock();
-
         return 0;
 }
 
@@ -415,9 +413,6 @@ static int ieee80211_dump_survey(struct wiphy *wiphy, struct net_device *dev,
 {
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
 
-        if (!local->ops->get_survey)
-                return -EOPNOTSUPP;
-
         return drv_get_survey(local, idx, survey);
 }
 
@@ -600,7 +595,7 @@ struct iapp_layer2_update {
         u8 ssap;                /* 0 */
         u8 control;
         u8 xid_info[3];
-} __attribute__ ((packed));
+} __packed;
 
 static void ieee80211_send_layer2_update(struct sta_info *sta)
 {
@@ -1154,10 +1149,6 @@ static int ieee80211_set_txq_params(struct wiphy *wiphy,
                 return -EINVAL;
         }
 
-        /* enable WMM or activate new settings */
-        local->hw.conf.flags |= IEEE80211_CONF_QOS;
-        drv_config(local, IEEE80211_CONF_CHANGE_QOS);
-
         return 0;
 }
 
@@ -1331,28 +1322,28 @@ static int ieee80211_set_wiphy_params(struct wiphy *wiphy, u32 changed)
 }
 
 static int ieee80211_set_tx_power(struct wiphy *wiphy,
-                                  enum tx_power_setting type, int dbm)
+                                  enum nl80211_tx_power_setting type, int mbm)
 {
         struct ieee80211_local *local = wiphy_priv(wiphy);
         struct ieee80211_channel *chan = local->hw.conf.channel;
         u32 changes = 0;
 
         switch (type) {
-        case TX_POWER_AUTOMATIC:
+        case NL80211_TX_POWER_AUTOMATIC:
                 local->user_power_level = -1;
                 break;
-        case TX_POWER_LIMITED:
-                if (dbm < 0)
-                        return -EINVAL;
-                local->user_power_level = dbm;
+        case NL80211_TX_POWER_LIMITED:
+                if (mbm < 0 || (mbm % 100))
+                        return -EOPNOTSUPP;
+                local->user_power_level = MBM_TO_DBM(mbm);
                 break;
-        case TX_POWER_FIXED:
-                if (dbm < 0)
-                        return -EINVAL;
+        case NL80211_TX_POWER_FIXED:
+                if (mbm < 0 || (mbm % 100))
+                        return -EOPNOTSUPP;
                 /* TODO: move to cfg80211 when it knows the channel */
-                if (dbm > chan->max_power)
+                if (MBM_TO_DBM(mbm) > chan->max_power)
                         return -EINVAL;
-                local->user_power_level = dbm;
+                local->user_power_level = MBM_TO_DBM(mbm);
                 break;
         }
 
@@ -1448,7 +1439,6 @@ static int ieee80211_set_power_mgmt(struct wiphy *wiphy, struct net_device *dev,
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        struct ieee80211_conf *conf = &local->hw.conf;
 
         if (sdata->vif.type != NL80211_IFTYPE_STATION)
                 return -EOPNOTSUPP;
@@ -1457,11 +1447,11 @@ static int ieee80211_set_power_mgmt(struct wiphy *wiphy, struct net_device *dev,
                 return -EOPNOTSUPP;
 
         if (enabled == sdata->u.mgd.powersave &&
-            timeout == conf->dynamic_ps_forced_timeout)
+            timeout == local->dynamic_ps_forced_timeout)
                 return 0;
 
         sdata->u.mgd.powersave = enabled;
-        conf->dynamic_ps_forced_timeout = timeout;
+        local->dynamic_ps_forced_timeout = timeout;
 
         /* no change, but if automatic follow powersave */
         mutex_lock(&sdata->u.mgd.mtx);
@@ -1554,10 +1544,58 @@ static int ieee80211_cancel_remain_on_channel(struct wiphy *wiphy,
 static int ieee80211_action(struct wiphy *wiphy, struct net_device *dev,
                             struct ieee80211_channel *chan,
                             enum nl80211_channel_type channel_type,
+                            bool channel_type_valid,
                             const u8 *buf, size_t len, u64 *cookie)
 {
-        return ieee80211_mgd_action(IEEE80211_DEV_TO_SUB_IF(dev), chan,
-                                    channel_type, buf, len, cookie);
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_local *local = sdata->local;
+        struct sk_buff *skb;
+        struct sta_info *sta;
+        const struct ieee80211_mgmt *mgmt = (void *)buf;
+        u32 flags = IEEE80211_TX_INTFL_NL80211_FRAME_TX |
+                    IEEE80211_TX_CTL_REQ_TX_STATUS;
+
+        /* Check that we are on the requested channel for transmission */
+        if (chan != local->tmp_channel &&
+            chan != local->oper_channel)
+                return -EBUSY;
+        if (channel_type_valid &&
+            (channel_type != local->tmp_channel_type &&
+             channel_type != local->_oper_channel_type))
+                return -EBUSY;
+
+        switch (sdata->vif.type) {
+        case NL80211_IFTYPE_ADHOC:
+                if (mgmt->u.action.category == WLAN_CATEGORY_PUBLIC)
+                        break;
+                rcu_read_lock();
+                sta = sta_info_get(sdata, mgmt->da);
+                rcu_read_unlock();
+                if (!sta)
+                        return -ENOLINK;
+                break;
+        case NL80211_IFTYPE_STATION:
+                if (!(sdata->u.mgd.flags & IEEE80211_STA_MFP_ENABLED))
+                        flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
+                break;
+        default:
+                return -EOPNOTSUPP;
+        }
+
+        skb = dev_alloc_skb(local->hw.extra_tx_headroom + len);
+        if (!skb)
+                return -ENOMEM;
+        skb_reserve(skb, local->hw.extra_tx_headroom);
+
+        memcpy(skb_put(skb, len), buf, len);
+
+        IEEE80211_SKB_CB(skb)->flags = flags;
+
+        skb->dev = sdata->dev;
+        ieee80211_tx_skb(sdata, skb);
+
+        *cookie = (unsigned long) skb;
+        return 0;
 }
 
 struct cfg80211_ops mac80211_config_ops = {
diff --git a/net/mac80211/debugfs.c b/net/mac80211/debugfs.c
index 637929b65ccc..a694c593ff6a 100644
--- a/net/mac80211/debugfs.c
+++ b/net/mac80211/debugfs.c
@@ -307,9 +307,6 @@ static const struct file_operations queues_ops = {
 
 /* statistics stuff */
 
-#define DEBUGFS_STATS_FILE(name, buflen, fmt, value...)                 \
-        DEBUGFS_READONLY_FILE(stats_ ##name, buflen, fmt, ##value)
-
 static ssize_t format_devstat_counter(struct ieee80211_local *local,
         char __user *userbuf,
         size_t count, loff_t *ppos,
@@ -351,75 +348,16 @@ static const struct file_operations stats_ ##name## _ops = {		\
         .open = mac80211_open_file_generic,                             \
 };
 
-#define DEBUGFS_STATS_ADD(name)                                         \
+#define DEBUGFS_STATS_ADD(name, field)                                  \
+        debugfs_create_u32(#name, 0400, statsd, (u32 *) &field);
+#define DEBUGFS_DEVSTATS_ADD(name)                                      \
         debugfs_create_file(#name, 0400, statsd, local, &stats_ ##name## _ops);
 
-DEBUGFS_STATS_FILE(transmitted_fragment_count, 20, "%u",
-                   local->dot11TransmittedFragmentCount);
-DEBUGFS_STATS_FILE(multicast_transmitted_frame_count, 20, "%u",
-                   local->dot11MulticastTransmittedFrameCount);
-DEBUGFS_STATS_FILE(failed_count, 20, "%u",
-                   local->dot11FailedCount);
-DEBUGFS_STATS_FILE(retry_count, 20, "%u",
-                   local->dot11RetryCount);
-DEBUGFS_STATS_FILE(multiple_retry_count, 20, "%u",
-                   local->dot11MultipleRetryCount);
-DEBUGFS_STATS_FILE(frame_duplicate_count, 20, "%u",
-                   local->dot11FrameDuplicateCount);
-DEBUGFS_STATS_FILE(received_fragment_count, 20, "%u",
-                   local->dot11ReceivedFragmentCount);
-DEBUGFS_STATS_FILE(multicast_received_frame_count, 20, "%u",
-                   local->dot11MulticastReceivedFrameCount);
-DEBUGFS_STATS_FILE(transmitted_frame_count, 20, "%u",
-                   local->dot11TransmittedFrameCount);
-#ifdef CONFIG_MAC80211_DEBUG_COUNTERS
-DEBUGFS_STATS_FILE(tx_handlers_drop, 20, "%u",
-                   local->tx_handlers_drop);
-DEBUGFS_STATS_FILE(tx_handlers_queued, 20, "%u",
-                   local->tx_handlers_queued);
-DEBUGFS_STATS_FILE(tx_handlers_drop_unencrypted, 20, "%u",
-                   local->tx_handlers_drop_unencrypted);
-DEBUGFS_STATS_FILE(tx_handlers_drop_fragment, 20, "%u",
-                   local->tx_handlers_drop_fragment);
-DEBUGFS_STATS_FILE(tx_handlers_drop_wep, 20, "%u",
-                   local->tx_handlers_drop_wep);
-DEBUGFS_STATS_FILE(tx_handlers_drop_not_assoc, 20, "%u",
-                   local->tx_handlers_drop_not_assoc);
-DEBUGFS_STATS_FILE(tx_handlers_drop_unauth_port, 20, "%u",
-                   local->tx_handlers_drop_unauth_port);
-DEBUGFS_STATS_FILE(rx_handlers_drop, 20, "%u",
-                   local->rx_handlers_drop);
-DEBUGFS_STATS_FILE(rx_handlers_queued, 20, "%u",
-                   local->rx_handlers_queued);
-DEBUGFS_STATS_FILE(rx_handlers_drop_nullfunc, 20, "%u",
-                   local->rx_handlers_drop_nullfunc);
-DEBUGFS_STATS_FILE(rx_handlers_drop_defrag, 20, "%u",
-                   local->rx_handlers_drop_defrag);
-DEBUGFS_STATS_FILE(rx_handlers_drop_short, 20, "%u",
-                   local->rx_handlers_drop_short);
-DEBUGFS_STATS_FILE(rx_handlers_drop_passive_scan, 20, "%u",
-                   local->rx_handlers_drop_passive_scan);
-DEBUGFS_STATS_FILE(tx_expand_skb_head, 20, "%u",
-                   local->tx_expand_skb_head);
-DEBUGFS_STATS_FILE(tx_expand_skb_head_cloned, 20, "%u",
-                   local->tx_expand_skb_head_cloned);
-DEBUGFS_STATS_FILE(rx_expand_skb_head, 20, "%u",
-                   local->rx_expand_skb_head);
-DEBUGFS_STATS_FILE(rx_expand_skb_head2, 20, "%u",
-                   local->rx_expand_skb_head2);
-DEBUGFS_STATS_FILE(rx_handlers_fragments, 20, "%u",
-                   local->rx_handlers_fragments);
-DEBUGFS_STATS_FILE(tx_status_drop, 20, "%u",
-                   local->tx_status_drop);
-
-#endif
-
 DEBUGFS_DEVSTATS_FILE(dot11ACKFailureCount);
 DEBUGFS_DEVSTATS_FILE(dot11RTSFailureCount);
 DEBUGFS_DEVSTATS_FILE(dot11FCSErrorCount);
 DEBUGFS_DEVSTATS_FILE(dot11RTSSuccessCount);
 
-
 void debugfs_hw_add(struct ieee80211_local *local)
 {
         struct dentry *phyd = local->hw.wiphy->debugfsdir;
@@ -448,38 +386,60 @@ void debugfs_hw_add(struct ieee80211_local *local)
         if (!statsd)
                 return;
 
-        DEBUGFS_STATS_ADD(transmitted_fragment_count);
-        DEBUGFS_STATS_ADD(multicast_transmitted_frame_count);
-        DEBUGFS_STATS_ADD(failed_count);
-        DEBUGFS_STATS_ADD(retry_count);
-        DEBUGFS_STATS_ADD(multiple_retry_count);
-        DEBUGFS_STATS_ADD(frame_duplicate_count);
-        DEBUGFS_STATS_ADD(received_fragment_count);
-        DEBUGFS_STATS_ADD(multicast_received_frame_count);
-        DEBUGFS_STATS_ADD(transmitted_frame_count);
+        DEBUGFS_STATS_ADD(transmitted_fragment_count,
+                local->dot11TransmittedFragmentCount);
+        DEBUGFS_STATS_ADD(multicast_transmitted_frame_count,
+                local->dot11MulticastTransmittedFrameCount);
+        DEBUGFS_STATS_ADD(failed_count, local->dot11FailedCount);
+        DEBUGFS_STATS_ADD(retry_count, local->dot11RetryCount);
+        DEBUGFS_STATS_ADD(multiple_retry_count,
+                local->dot11MultipleRetryCount);
+        DEBUGFS_STATS_ADD(frame_duplicate_count,
+                local->dot11FrameDuplicateCount);
+        DEBUGFS_STATS_ADD(received_fragment_count,
+                local->dot11ReceivedFragmentCount);
+        DEBUGFS_STATS_ADD(multicast_received_frame_count,
+                local->dot11MulticastReceivedFrameCount);
+        DEBUGFS_STATS_ADD(transmitted_frame_count,
+                local->dot11TransmittedFrameCount);
 #ifdef CONFIG_MAC80211_DEBUG_COUNTERS
-        DEBUGFS_STATS_ADD(tx_handlers_drop);
-        DEBUGFS_STATS_ADD(tx_handlers_queued);
-        DEBUGFS_STATS_ADD(tx_handlers_drop_unencrypted);
-        DEBUGFS_STATS_ADD(tx_handlers_drop_fragment);
-        DEBUGFS_STATS_ADD(tx_handlers_drop_wep);
-        DEBUGFS_STATS_ADD(tx_handlers_drop_not_assoc);
-        DEBUGFS_STATS_ADD(tx_handlers_drop_unauth_port);
-        DEBUGFS_STATS_ADD(rx_handlers_drop);
-        DEBUGFS_STATS_ADD(rx_handlers_queued);
-        DEBUGFS_STATS_ADD(rx_handlers_drop_nullfunc);
-        DEBUGFS_STATS_ADD(rx_handlers_drop_defrag);
-        DEBUGFS_STATS_ADD(rx_handlers_drop_short);
-        DEBUGFS_STATS_ADD(rx_handlers_drop_passive_scan);
-        DEBUGFS_STATS_ADD(tx_expand_skb_head);
-        DEBUGFS_STATS_ADD(tx_expand_skb_head_cloned);
-        DEBUGFS_STATS_ADD(rx_expand_skb_head);
-        DEBUGFS_STATS_ADD(rx_expand_skb_head2);
-        DEBUGFS_STATS_ADD(rx_handlers_fragments);
-        DEBUGFS_STATS_ADD(tx_status_drop);
+        DEBUGFS_STATS_ADD(tx_handlers_drop, local->tx_handlers_drop);
+        DEBUGFS_STATS_ADD(tx_handlers_queued, local->tx_handlers_queued);
+        DEBUGFS_STATS_ADD(tx_handlers_drop_unencrypted,
+                local->tx_handlers_drop_unencrypted);
+        DEBUGFS_STATS_ADD(tx_handlers_drop_fragment,
+                local->tx_handlers_drop_fragment);
+        DEBUGFS_STATS_ADD(tx_handlers_drop_wep,
+                local->tx_handlers_drop_wep);
+        DEBUGFS_STATS_ADD(tx_handlers_drop_not_assoc,
+                local->tx_handlers_drop_not_assoc);
+        DEBUGFS_STATS_ADD(tx_handlers_drop_unauth_port,
+                local->tx_handlers_drop_unauth_port);
+        DEBUGFS_STATS_ADD(rx_handlers_drop, local->rx_handlers_drop);
+        DEBUGFS_STATS_ADD(rx_handlers_queued, local->rx_handlers_queued);
+        DEBUGFS_STATS_ADD(rx_handlers_drop_nullfunc,
+                local->rx_handlers_drop_nullfunc);
+        DEBUGFS_STATS_ADD(rx_handlers_drop_defrag,
+                local->rx_handlers_drop_defrag);
+        DEBUGFS_STATS_ADD(rx_handlers_drop_short,
+                local->rx_handlers_drop_short);
+        DEBUGFS_STATS_ADD(rx_handlers_drop_passive_scan,
+                local->rx_handlers_drop_passive_scan);
+        DEBUGFS_STATS_ADD(tx_expand_skb_head,
+                local->tx_expand_skb_head);
+        DEBUGFS_STATS_ADD(tx_expand_skb_head_cloned,
+                local->tx_expand_skb_head_cloned);
+        DEBUGFS_STATS_ADD(rx_expand_skb_head,
+                local->rx_expand_skb_head);
+        DEBUGFS_STATS_ADD(rx_expand_skb_head2,
+                local->rx_expand_skb_head2);
+        DEBUGFS_STATS_ADD(rx_handlers_fragments,
+                local->rx_handlers_fragments);
+        DEBUGFS_STATS_ADD(tx_status_drop,
+                local->tx_status_drop);
 #endif
-        DEBUGFS_STATS_ADD(dot11ACKFailureCount);
-        DEBUGFS_STATS_ADD(dot11RTSFailureCount);
-        DEBUGFS_STATS_ADD(dot11FCSErrorCount);
-        DEBUGFS_STATS_ADD(dot11RTSSuccessCount);
+        DEBUGFS_DEVSTATS_ADD(dot11ACKFailureCount);
+        DEBUGFS_DEVSTATS_ADD(dot11RTSFailureCount);
+        DEBUGFS_DEVSTATS_ADD(dot11FCSErrorCount);
+        DEBUGFS_DEVSTATS_ADD(dot11RTSSuccessCount);
 }
diff --git a/net/mac80211/debugfs_key.c b/net/mac80211/debugfs_key.c
index 97c9e46e859e..fa5e76e658ef 100644
--- a/net/mac80211/debugfs_key.c
+++ b/net/mac80211/debugfs_key.c
@@ -143,7 +143,7 @@ static ssize_t key_rx_spec_read(struct file *file, char __user *userbuf,
                 len = p - buf;
                 break;
         case ALG_CCMP:
-                for (i = 0; i < NUM_RX_DATA_QUEUES; i++) {
+                for (i = 0; i < NUM_RX_DATA_QUEUES + 1; i++) {
                         rpn = key->u.ccmp.rx_pn[i];
                         p += scnprintf(p, sizeof(buf)+buf-p,
                                        "%02x%02x%02x%02x%02x%02x\n",
diff --git a/net/mac80211/debugfs_sta.c b/net/mac80211/debugfs_sta.c
index e763f1529ddb..76839d4dfaac 100644
--- a/net/mac80211/debugfs_sta.c
+++ b/net/mac80211/debugfs_sta.c
@@ -30,7 +30,6 @@ static ssize_t sta_ ##name## _read(struct file *file,			\
 }
 #define STA_READ_D(name, field) STA_READ(name, 20, field, "%d\n")
 #define STA_READ_U(name, field) STA_READ(name, 20, field, "%u\n")
-#define STA_READ_LU(name, field) STA_READ(name, 20, field, "%lu\n")
 #define STA_READ_S(name, field) STA_READ(name, 20, field, "%s\n")
 
 #define STA_OPS(name)                                                   \
@@ -52,19 +51,7 @@ static const struct file_operations sta_ ##name## _ops = {		\
 
 STA_FILE(aid, sta.aid, D);
 STA_FILE(dev, sdata->name, S);
-STA_FILE(rx_packets, rx_packets, LU);
-STA_FILE(tx_packets, tx_packets, LU);
-STA_FILE(rx_bytes, rx_bytes, LU);
-STA_FILE(tx_bytes, tx_bytes, LU);
-STA_FILE(rx_duplicates, num_duplicates, LU);
-STA_FILE(rx_fragments, rx_fragments, LU);
-STA_FILE(rx_dropped, rx_dropped, LU);
-STA_FILE(tx_fragments, tx_fragments, LU);
-STA_FILE(tx_filtered, tx_filtered_count, LU);
-STA_FILE(tx_retry_failed, tx_retry_failed, LU);
-STA_FILE(tx_retry_count, tx_retry_count, LU);
 STA_FILE(last_signal, last_signal, D);
-STA_FILE(wep_weak_iv_count, wep_weak_iv_count, LU);
 
 static ssize_t sta_flags_read(struct file *file, char __user *userbuf,
                               size_t count, loff_t *ppos)
@@ -134,28 +121,25 @@ static ssize_t sta_agg_status_read(struct file *file, char __user *userbuf,
         p += scnprintf(p, sizeof(buf) + buf - p, "next dialog_token: %#02x\n",
                         sta->ampdu_mlme.dialog_token_allocator + 1);
         p += scnprintf(p, sizeof(buf) + buf - p,
-                       "TID\t\tRX active\tDTKN\tSSN\t\tTX\tDTKN\tSSN\tpending\n");
+                       "TID\t\tRX active\tDTKN\tSSN\t\tTX\tDTKN\tpending\n");
         for (i = 0; i < STA_TID_NUM; i++) {
                 p += scnprintf(p, sizeof(buf) + buf - p, "%02d", i);
                 p += scnprintf(p, sizeof(buf) + buf - p, "\t\t%x",
-                                sta->ampdu_mlme.tid_active_rx[i]);
+                                !!sta->ampdu_mlme.tid_rx[i]);
                 p += scnprintf(p, sizeof(buf) + buf - p, "\t%#.2x",
-                                sta->ampdu_mlme.tid_active_rx[i] ?
+                                sta->ampdu_mlme.tid_rx[i] ?
                                 sta->ampdu_mlme.tid_rx[i]->dialog_token : 0);
                 p += scnprintf(p, sizeof(buf) + buf - p, "\t%#.3x",
-                                sta->ampdu_mlme.tid_active_rx[i] ?
+                                sta->ampdu_mlme.tid_rx[i] ?
                                 sta->ampdu_mlme.tid_rx[i]->ssn : 0);
 
                 p += scnprintf(p, sizeof(buf) + buf - p, "\t\t%x",
-                                sta->ampdu_mlme.tid_state_tx[i]);
+                                !!sta->ampdu_mlme.tid_tx[i]);
                 p += scnprintf(p, sizeof(buf) + buf - p, "\t%#.2x",
-                                sta->ampdu_mlme.tid_state_tx[i] ?
+                                sta->ampdu_mlme.tid_tx[i] ?
                                 sta->ampdu_mlme.tid_tx[i]->dialog_token : 0);
-                p += scnprintf(p, sizeof(buf) + buf - p, "\t%#.3x",
-                                sta->ampdu_mlme.tid_state_tx[i] ?
-                                sta->ampdu_mlme.tid_tx[i]->ssn : 0);
                 p += scnprintf(p, sizeof(buf) + buf - p, "\t%03d",
-                                sta->ampdu_mlme.tid_state_tx[i] ?
+                                sta->ampdu_mlme.tid_tx[i] ?
                                 skb_queue_len(&sta->ampdu_mlme.tid_tx[i]->pending) : 0);
                 p += scnprintf(p, sizeof(buf) + buf - p, "\n");
         }
@@ -210,8 +194,7 @@ static ssize_t sta_agg_status_write(struct file *file, const char __user *userbu
                 if (start)
                         ret = ieee80211_start_tx_ba_session(&sta->sta, tid);
                 else
-                        ret = ieee80211_stop_tx_ba_session(&sta->sta, tid,
-                                                           WLAN_BACK_RECIPIENT);
+                        ret = ieee80211_stop_tx_ba_session(&sta->sta, tid);
         } else {
                 __ieee80211_stop_rx_ba_session(sta, tid, WLAN_BACK_RECIPIENT, 3);
                 ret = 0;
@@ -307,6 +290,13 @@ STA_OPS(ht_capa);
         debugfs_create_file(#name, 0400, \
                 sta->debugfs.dir, sta, &sta_ ##name## _ops);
 
+#define DEBUGFS_ADD_COUNTER(name, field)                                \
+        if (sizeof(sta->field) == sizeof(u32))                          \
+                debugfs_create_u32(#name, 0400, sta->debugfs.dir,       \
+                        (u32 *) &sta->field);                           \
+        else                                                            \
+                debugfs_create_u64(#name, 0400, sta->debugfs.dir,       \
+                        (u64 *) &sta->field);
 
 void ieee80211_sta_debugfs_add(struct sta_info *sta)
 {
@@ -339,20 +329,21 @@ void ieee80211_sta_debugfs_add(struct sta_info *sta)
         DEBUGFS_ADD(last_seq_ctrl);
         DEBUGFS_ADD(agg_status);
         DEBUGFS_ADD(dev);
-        DEBUGFS_ADD(rx_packets);
-        DEBUGFS_ADD(tx_packets);
-        DEBUGFS_ADD(rx_bytes);
-        DEBUGFS_ADD(tx_bytes);
-        DEBUGFS_ADD(rx_duplicates);
-        DEBUGFS_ADD(rx_fragments);
-        DEBUGFS_ADD(rx_dropped);
-        DEBUGFS_ADD(tx_fragments);
-        DEBUGFS_ADD(tx_filtered);
-        DEBUGFS_ADD(tx_retry_failed);
-        DEBUGFS_ADD(tx_retry_count);
         DEBUGFS_ADD(last_signal);
-        DEBUGFS_ADD(wep_weak_iv_count);
         DEBUGFS_ADD(ht_capa);
+
+        DEBUGFS_ADD_COUNTER(rx_packets, rx_packets);
+        DEBUGFS_ADD_COUNTER(tx_packets, tx_packets);
+        DEBUGFS_ADD_COUNTER(rx_bytes, rx_bytes);
+        DEBUGFS_ADD_COUNTER(tx_bytes, tx_bytes);
+        DEBUGFS_ADD_COUNTER(rx_duplicates, num_duplicates);
+        DEBUGFS_ADD_COUNTER(rx_fragments, rx_fragments);
+        DEBUGFS_ADD_COUNTER(rx_dropped, rx_dropped);
+        DEBUGFS_ADD_COUNTER(tx_fragments, tx_fragments);
+        DEBUGFS_ADD_COUNTER(tx_filtered, tx_filtered_count);
+        DEBUGFS_ADD_COUNTER(tx_retry_failed, tx_retry_failed);
+        DEBUGFS_ADD_COUNTER(tx_retry_count, tx_retry_count);
+        DEBUGFS_ADD_COUNTER(wep_weak_iv_count, wep_weak_iv_count);
 }
 
 void ieee80211_sta_debugfs_remove(struct sta_info *sta)
diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
index 9c1da0809160..14123dce544b 100644
--- a/net/mac80211/driver-ops.h
+++ b/net/mac80211/driver-ops.h
@@ -16,10 +16,11 @@ static inline int drv_start(struct ieee80211_local *local)
 
         might_sleep();
 
+        trace_drv_start(local);
         local->started = true;
         smp_mb();
         ret = local->ops->start(&local->hw);
-        trace_drv_start(local, ret);
+        trace_drv_return_int(local, ret);
         return ret;
 }
 
@@ -27,8 +28,9 @@ static inline void drv_stop(struct ieee80211_local *local)
 {
         might_sleep();
 
-        local->ops->stop(&local->hw);
         trace_drv_stop(local);
+        local->ops->stop(&local->hw);
+        trace_drv_return_void(local);
 
         /* sync away all work on the tasklet before clearing started */
         tasklet_disable(&local->tasklet);
@@ -46,8 +48,9 @@ static inline int drv_add_interface(struct ieee80211_local *local,
 
         might_sleep();
 
+        trace_drv_add_interface(local, vif_to_sdata(vif));
         ret = local->ops->add_interface(&local->hw, vif);
-        trace_drv_add_interface(local, vif_to_sdata(vif), ret);
+        trace_drv_return_int(local, ret);
         return ret;
 }
 
@@ -56,8 +59,9 @@ static inline void drv_remove_interface(struct ieee80211_local *local,
 {
         might_sleep();
 
-        local->ops->remove_interface(&local->hw, vif);
         trace_drv_remove_interface(local, vif_to_sdata(vif));
+        local->ops->remove_interface(&local->hw, vif);
+        trace_drv_return_void(local);
 }
 
 static inline int drv_config(struct ieee80211_local *local, u32 changed)
@@ -66,8 +70,9 @@ static inline int drv_config(struct ieee80211_local *local, u32 changed)
 
         might_sleep();
 
+        trace_drv_config(local, changed);
         ret = local->ops->config(&local->hw, changed);
-        trace_drv_config(local, changed, ret);
+        trace_drv_return_int(local, ret);
         return ret;
 }
 
@@ -78,9 +83,10 @@ static inline void drv_bss_info_changed(struct ieee80211_local *local,
 {
         might_sleep();
 
+        trace_drv_bss_info_changed(local, sdata, info, changed);
         if (local->ops->bss_info_changed)
                 local->ops->bss_info_changed(&local->hw, &sdata->vif, info, changed);
-        trace_drv_bss_info_changed(local, sdata, info, changed);
+        trace_drv_return_void(local);
 }
 
 static inline u64 drv_prepare_multicast(struct ieee80211_local *local,
@@ -88,10 +94,12 @@ static inline u64 drv_prepare_multicast(struct ieee80211_local *local,
 {
         u64 ret = 0;
 
+        trace_drv_prepare_multicast(local, mc_list->count);
+
         if (local->ops->prepare_multicast)
                 ret = local->ops->prepare_multicast(&local->hw, mc_list);
 
-        trace_drv_prepare_multicast(local, mc_list->count, ret);
+        trace_drv_return_u64(local, ret);
 
         return ret;
 }
@@ -103,19 +111,21 @@ static inline void drv_configure_filter(struct ieee80211_local *local,
 {
         might_sleep();
 
-        local->ops->configure_filter(&local->hw, changed_flags, total_flags,
-                                     multicast);
         trace_drv_configure_filter(local, changed_flags, total_flags,
                                    multicast);
+        local->ops->configure_filter(&local->hw, changed_flags, total_flags,
+                                     multicast);
+        trace_drv_return_void(local);
 }
 
 static inline int drv_set_tim(struct ieee80211_local *local,
                               struct ieee80211_sta *sta, bool set)
 {
         int ret = 0;
+        trace_drv_set_tim(local, sta, set);
         if (local->ops->set_tim)
                 ret = local->ops->set_tim(&local->hw, sta, set);
-        trace_drv_set_tim(local, sta, set, ret);
+        trace_drv_return_int(local, ret);
         return ret;
 }
 
@@ -129,8 +139,9 @@ static inline int drv_set_key(struct ieee80211_local *local,
 
         might_sleep();
 
+        trace_drv_set_key(local, cmd, sdata, sta, key);
         ret = local->ops->set_key(&local->hw, cmd, &sdata->vif, sta, key);
-        trace_drv_set_key(local, cmd, sdata, sta, key, ret);
+        trace_drv_return_int(local, ret);
         return ret;
 }
 
@@ -145,10 +156,11 @@ static inline void drv_update_tkip_key(struct ieee80211_local *local,
         if (sta)
                 ista = &sta->sta;
 
+        trace_drv_update_tkip_key(local, sdata, conf, ista, iv32);
         if (local->ops->update_tkip_key)
                 local->ops->update_tkip_key(&local->hw, &sdata->vif, conf,
                                             ista, iv32, phase1key);
-        trace_drv_update_tkip_key(local, sdata, conf, ista, iv32);
+        trace_drv_return_void(local);
 }
 
 static inline int drv_hw_scan(struct ieee80211_local *local,
@@ -159,8 +171,9 @@ static inline int drv_hw_scan(struct ieee80211_local *local,
 
         might_sleep();
 
+        trace_drv_hw_scan(local, sdata, req);
         ret = local->ops->hw_scan(&local->hw, &sdata->vif, req);
-        trace_drv_hw_scan(local, sdata, req, ret);
+        trace_drv_return_int(local, ret);
         return ret;
 }
 
@@ -168,18 +181,20 @@ static inline void drv_sw_scan_start(struct ieee80211_local *local)
 {
         might_sleep();
 
+        trace_drv_sw_scan_start(local);
         if (local->ops->sw_scan_start)
                 local->ops->sw_scan_start(&local->hw);
-        trace_drv_sw_scan_start(local);
+        trace_drv_return_void(local);
 }
 
 static inline void drv_sw_scan_complete(struct ieee80211_local *local)
 {
         might_sleep();
 
+        trace_drv_sw_scan_complete(local);
         if (local->ops->sw_scan_complete)
                 local->ops->sw_scan_complete(&local->hw);
-        trace_drv_sw_scan_complete(local);
+        trace_drv_return_void(local);
 }
 
 static inline int drv_get_stats(struct ieee80211_local *local,
@@ -211,9 +226,10 @@ static inline int drv_set_rts_threshold(struct ieee80211_local *local,
 
         might_sleep();
 
+        trace_drv_set_rts_threshold(local, value);
         if (local->ops->set_rts_threshold)
                 ret = local->ops->set_rts_threshold(&local->hw, value);
-        trace_drv_set_rts_threshold(local, value, ret);
+        trace_drv_return_int(local, ret);
         return ret;
 }
 
@@ -223,12 +239,13 @@ static inline int drv_set_coverage_class(struct ieee80211_local *local,
         int ret = 0;
         might_sleep();
 
+        trace_drv_set_coverage_class(local, value);
         if (local->ops->set_coverage_class)
                 local->ops->set_coverage_class(&local->hw, value);
         else
                 ret = -EOPNOTSUPP;
 
-        trace_drv_set_coverage_class(local, value, ret);
+        trace_drv_return_int(local, ret);
         return ret;
 }
 
@@ -237,9 +254,10 @@ static inline void drv_sta_notify(struct ieee80211_local *local,
                                   enum sta_notify_cmd cmd,
                                   struct ieee80211_sta *sta)
 {
+        trace_drv_sta_notify(local, sdata, cmd, sta);
         if (local->ops->sta_notify)
                 local->ops->sta_notify(&local->hw, &sdata->vif, cmd, sta);
-        trace_drv_sta_notify(local, sdata, cmd, sta);
+        trace_drv_return_void(local);
 }
 
 static inline int drv_sta_add(struct ieee80211_local *local,
@@ -250,13 +268,11 @@ static inline int drv_sta_add(struct ieee80211_local *local,
 
         might_sleep();
 
+        trace_drv_sta_add(local, sdata, sta);
         if (local->ops->sta_add)
                 ret = local->ops->sta_add(&local->hw, &sdata->vif, sta);
-        else if (local->ops->sta_notify)
-                local->ops->sta_notify(&local->hw, &sdata->vif,
-                                        STA_NOTIFY_ADD, sta);
 
-        trace_drv_sta_add(local, sdata, sta, ret);
+        trace_drv_return_int(local, ret);
 
         return ret;
 }
@@ -267,13 +283,11 @@ static inline void drv_sta_remove(struct ieee80211_local *local,
 {
         might_sleep();
 
+        trace_drv_sta_remove(local, sdata, sta);
         if (local->ops->sta_remove)
                 local->ops->sta_remove(&local->hw, &sdata->vif, sta);
-        else if (local->ops->sta_notify)
-                local->ops->sta_notify(&local->hw, &sdata->vif,
-                                        STA_NOTIFY_REMOVE, sta);
 
-        trace_drv_sta_remove(local, sdata, sta);
+        trace_drv_return_void(local);
 }
 
 static inline int drv_conf_tx(struct ieee80211_local *local, u16 queue,
@@ -283,9 +297,10 @@ static inline int drv_conf_tx(struct ieee80211_local *local, u16 queue,
 
         might_sleep();
 
+        trace_drv_conf_tx(local, queue, params);
         if (local->ops->conf_tx)
                 ret = local->ops->conf_tx(&local->hw, queue, params);
-        trace_drv_conf_tx(local, queue, params, ret);
+        trace_drv_return_int(local, ret);
         return ret;
 }
 
@@ -295,9 +310,10 @@ static inline u64 drv_get_tsf(struct ieee80211_local *local)
 
         might_sleep();
 
+        trace_drv_get_tsf(local);
         if (local->ops->get_tsf)
                 ret = local->ops->get_tsf(&local->hw);
-        trace_drv_get_tsf(local, ret);
+        trace_drv_return_u64(local, ret);
         return ret;
 }
 
@@ -305,18 +321,20 @@ static inline void drv_set_tsf(struct ieee80211_local *local, u64 tsf)
 {
         might_sleep();
 
+        trace_drv_set_tsf(local, tsf);
         if (local->ops->set_tsf)
                 local->ops->set_tsf(&local->hw, tsf);
-        trace_drv_set_tsf(local, tsf);
+        trace_drv_return_void(local);
 }
 
 static inline void drv_reset_tsf(struct ieee80211_local *local)
 {
         might_sleep();
 
+        trace_drv_reset_tsf(local);
         if (local->ops->reset_tsf)
                 local->ops->reset_tsf(&local->hw);
-        trace_drv_reset_tsf(local);
+        trace_drv_return_void(local);
 }
 
 static inline int drv_tx_last_beacon(struct ieee80211_local *local)
@@ -325,9 +343,10 @@ static inline int drv_tx_last_beacon(struct ieee80211_local *local)
 
         might_sleep();
 
+        trace_drv_tx_last_beacon(local);
         if (local->ops->tx_last_beacon)
                 ret = local->ops->tx_last_beacon(&local->hw);
-        trace_drv_tx_last_beacon(local, ret);
+        trace_drv_return_int(local, ret);
         return ret;
 }
 
@@ -338,10 +357,17 @@ static inline int drv_ampdu_action(struct ieee80211_local *local,
                                    u16 *ssn)
 {
         int ret = -EOPNOTSUPP;
+
+        might_sleep();
+
+        trace_drv_ampdu_action(local, sdata, action, sta, tid, ssn);
+
         if (local->ops->ampdu_action)
                 ret = local->ops->ampdu_action(&local->hw, &sdata->vif, action,
                                                sta, tid, ssn);
-        trace_drv_ampdu_action(local, sdata, action, sta, tid, ssn, ret);
+
+        trace_drv_return_int(local, ret);
+
         return ret;
 }
 
@@ -349,9 +375,14 @@ static inline int drv_get_survey(struct ieee80211_local *local, int idx,
                                 struct survey_info *survey)
 {
         int ret = -EOPNOTSUPP;
+
+        trace_drv_get_survey(local, idx, survey);
+
         if (local->ops->get_survey)
                 ret = local->ops->get_survey(&local->hw, idx, survey);
-        /* trace_drv_get_survey(local, idx, survey, ret); */
+
+        trace_drv_return_int(local, ret);
+
         return ret;
 }
 
@@ -370,6 +401,7 @@ static inline void drv_flush(struct ieee80211_local *local, bool drop)
         trace_drv_flush(local, drop);
         if (local->ops->flush)
                 local->ops->flush(&local->hw, drop);
+        trace_drv_return_void(local);
 }
 
 static inline void drv_channel_switch(struct ieee80211_local *local,
@@ -377,9 +409,9 @@ static inline void drv_channel_switch(struct ieee80211_local *local,
 {
         might_sleep();
 
-        local->ops->channel_switch(&local->hw, ch_switch);
-
         trace_drv_channel_switch(local, ch_switch);
+        local->ops->channel_switch(&local->hw, ch_switch);
+        trace_drv_return_void(local);
 }
 
 #endif /* __MAC80211_DRIVER_OPS */
diff --git a/net/mac80211/driver-trace.h b/net/mac80211/driver-trace.h
index 6a9b2342a9c2..5d5d2a974668 100644
--- a/net/mac80211/driver-trace.h
+++ b/net/mac80211/driver-trace.h
@@ -36,20 +36,58 @@ static inline void trace_ ## name(proto) {}
  * Tracing for driver callbacks.
  */
 
-TRACE_EVENT(drv_start,
-        TP_PROTO(struct ieee80211_local *local, int ret),
+TRACE_EVENT(drv_return_void,
+        TP_PROTO(struct ieee80211_local *local),
+        TP_ARGS(local),
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+        ),
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+        ),
+        TP_printk(LOCAL_PR_FMT, LOCAL_PR_ARG)
+);
 
+TRACE_EVENT(drv_return_int,
+        TP_PROTO(struct ieee80211_local *local, int ret),
         TP_ARGS(local, ret),
-
         TP_STRUCT__entry(
                 LOCAL_ENTRY
                 __field(int, ret)
         ),
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                __entry->ret = ret;
+        ),
+        TP_printk(LOCAL_PR_FMT " - %d", LOCAL_PR_ARG, __entry->ret)
+);
 
+TRACE_EVENT(drv_return_u64,
+        TP_PROTO(struct ieee80211_local *local, u64 ret),
+        TP_ARGS(local, ret),
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                __field(u64, ret)
+        ),
         TP_fast_assign(
                 LOCAL_ASSIGN;
                 __entry->ret = ret;
         ),
+        TP_printk(LOCAL_PR_FMT " - %llu", LOCAL_PR_ARG, __entry->ret)
+);
+
+TRACE_EVENT(drv_start,
+        TP_PROTO(struct ieee80211_local *local),
+
+        TP_ARGS(local),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+        ),
 
         TP_printk(
                 LOCAL_PR_FMT, LOCAL_PR_ARG
@@ -76,28 +114,25 @@ TRACE_EVENT(drv_stop,
 
 TRACE_EVENT(drv_add_interface,
         TP_PROTO(struct ieee80211_local *local,
-                 struct ieee80211_sub_if_data *sdata,
-                 int ret),
+                 struct ieee80211_sub_if_data *sdata),
 
-        TP_ARGS(local, sdata, ret),
+        TP_ARGS(local, sdata),
 
         TP_STRUCT__entry(
                 LOCAL_ENTRY
                 VIF_ENTRY
                 __array(char, addr, 6)
-                __field(int, ret)
         ),
 
         TP_fast_assign(
                 LOCAL_ASSIGN;
                 VIF_ASSIGN;
                 memcpy(__entry->addr, sdata->vif.addr, 6);
-                __entry->ret = ret;
         ),
 
         TP_printk(
-                LOCAL_PR_FMT  VIF_PR_FMT " addr:%pM ret:%d",
-                LOCAL_PR_ARG, VIF_PR_ARG, __entry->addr, __entry->ret
+                LOCAL_PR_FMT  VIF_PR_FMT " addr:%pM",
+                LOCAL_PR_ARG, VIF_PR_ARG, __entry->addr
         )
 );
 
@@ -126,15 +161,13 @@ TRACE_EVENT(drv_remove_interface,
 
 TRACE_EVENT(drv_config,
         TP_PROTO(struct ieee80211_local *local,
-                 u32 changed,
-                 int ret),
+                 u32 changed),
 
-        TP_ARGS(local, changed, ret),
+        TP_ARGS(local, changed),
 
         TP_STRUCT__entry(
                 LOCAL_ENTRY
                 __field(u32, changed)
-                __field(int, ret)
                 __field(u32, flags)
                 __field(int, power_level)
                 __field(int, dynamic_ps_timeout)
@@ -150,7 +183,6 @@ TRACE_EVENT(drv_config,
         TP_fast_assign(
                 LOCAL_ASSIGN;
                 __entry->changed = changed;
-                __entry->ret = ret;
                 __entry->flags = local->hw.conf.flags;
                 __entry->power_level = local->hw.conf.power_level;
                 __entry->dynamic_ps_timeout = local->hw.conf.dynamic_ps_timeout;
@@ -164,8 +196,8 @@ TRACE_EVENT(drv_config,
         ),
 
         TP_printk(
-                LOCAL_PR_FMT " ch:%#x freq:%d ret:%d",
-                LOCAL_PR_ARG, __entry->changed, __entry->center_freq, __entry->ret
+                LOCAL_PR_FMT " ch:%#x freq:%d",
+                LOCAL_PR_ARG, __entry->changed, __entry->center_freq
         )
 );
 
@@ -220,26 +252,23 @@ TRACE_EVENT(drv_bss_info_changed,
 );
 
 TRACE_EVENT(drv_prepare_multicast,
-        TP_PROTO(struct ieee80211_local *local, int mc_count, u64 ret),
+        TP_PROTO(struct ieee80211_local *local, int mc_count),
 
-        TP_ARGS(local, mc_count, ret),
+        TP_ARGS(local, mc_count),
 
         TP_STRUCT__entry(
                 LOCAL_ENTRY
                 __field(int, mc_count)
-                __field(u64, ret)
         ),
 
         TP_fast_assign(
                 LOCAL_ASSIGN;
                 __entry->mc_count = mc_count;
-                __entry->ret = ret;
         ),
 
         TP_printk(
-                LOCAL_PR_FMT " prepare mc (%d): %llx",
-                LOCAL_PR_ARG, __entry->mc_count,
-                (unsigned long long) __entry->ret
+                LOCAL_PR_FMT " prepare mc (%d)",
+                LOCAL_PR_ARG, __entry->mc_count
         )
 );
 
@@ -273,27 +302,25 @@ TRACE_EVENT(drv_configure_filter,
 
 TRACE_EVENT(drv_set_tim,
         TP_PROTO(struct ieee80211_local *local,
-                 struct ieee80211_sta *sta, bool set, int ret),
+                 struct ieee80211_sta *sta, bool set),
 
-        TP_ARGS(local, sta, set, ret),
+        TP_ARGS(local, sta, set),
 
         TP_STRUCT__entry(
                 LOCAL_ENTRY
                 STA_ENTRY
                 __field(bool, set)
-                __field(int, ret)
         ),
 
         TP_fast_assign(
                 LOCAL_ASSIGN;
                 STA_ASSIGN;
                 __entry->set = set;
-                __entry->ret = ret;
         ),
 
         TP_printk(
-                LOCAL_PR_FMT STA_PR_FMT " set:%d ret:%d",
-                LOCAL_PR_ARG, STA_PR_FMT, __entry->set, __entry->ret
+                LOCAL_PR_FMT STA_PR_FMT " set:%d",
+                LOCAL_PR_ARG, STA_PR_FMT, __entry->set
         )
 );
 
@@ -301,9 +328,9 @@ TRACE_EVENT(drv_set_key,
         TP_PROTO(struct ieee80211_local *local,
                  enum set_key_cmd cmd, struct ieee80211_sub_if_data *sdata,
                  struct ieee80211_sta *sta,
-                 struct ieee80211_key_conf *key, int ret),
+                 struct ieee80211_key_conf *key),
 
-        TP_ARGS(local, cmd, sdata, sta, key, ret),
+        TP_ARGS(local, cmd, sdata, sta, key),
 
         TP_STRUCT__entry(
                 LOCAL_ENTRY
@@ -313,7 +340,6 @@ TRACE_EVENT(drv_set_key,
                 __field(u8, hw_key_idx)
                 __field(u8, flags)
                 __field(s8, keyidx)
-                __field(int, ret)
         ),
 
         TP_fast_assign(
@@ -324,12 +350,11 @@ TRACE_EVENT(drv_set_key,
                 __entry->flags = key->flags;
                 __entry->keyidx = key->keyidx;
                 __entry->hw_key_idx = key->hw_key_idx;
-                __entry->ret = ret;
         ),
 
         TP_printk(
-                LOCAL_PR_FMT  VIF_PR_FMT  STA_PR_FMT " ret:%d",
-                LOCAL_PR_ARG, VIF_PR_ARG, STA_PR_ARG, __entry->ret
+                LOCAL_PR_FMT  VIF_PR_FMT  STA_PR_FMT,
+                LOCAL_PR_ARG, VIF_PR_ARG, STA_PR_ARG
         )
 );
 
@@ -364,25 +389,23 @@ TRACE_EVENT(drv_update_tkip_key,
 TRACE_EVENT(drv_hw_scan,
         TP_PROTO(struct ieee80211_local *local,
                  struct ieee80211_sub_if_data *sdata,
-                 struct cfg80211_scan_request *req, int ret),
+                 struct cfg80211_scan_request *req),
 
-        TP_ARGS(local, sdata, req, ret),
+        TP_ARGS(local, sdata, req),
 
         TP_STRUCT__entry(
                 LOCAL_ENTRY
                 VIF_ENTRY
-                __field(int, ret)
         ),
 
         TP_fast_assign(
                 LOCAL_ASSIGN;
                 VIF_ASSIGN;
-                __entry->ret = ret;
         ),
 
         TP_printk(
-                LOCAL_PR_FMT VIF_PR_FMT " ret:%d",
-                LOCAL_PR_ARG,VIF_PR_ARG, __entry->ret
+                LOCAL_PR_FMT VIF_PR_FMT,
+                LOCAL_PR_ARG,VIF_PR_ARG
         )
 );
 
@@ -479,48 +502,44 @@ TRACE_EVENT(drv_get_tkip_seq,
 );
 
 TRACE_EVENT(drv_set_rts_threshold,
-        TP_PROTO(struct ieee80211_local *local, u32 value, int ret),
+        TP_PROTO(struct ieee80211_local *local, u32 value),
 
-        TP_ARGS(local, value, ret),
+        TP_ARGS(local, value),
 
         TP_STRUCT__entry(
                 LOCAL_ENTRY
                 __field(u32, value)
-                __field(int, ret)
         ),
 
         TP_fast_assign(
                 LOCAL_ASSIGN;
-                __entry->ret = ret;
                 __entry->value = value;
         ),
 
         TP_printk(
-                LOCAL_PR_FMT " value:%d ret:%d",
-                LOCAL_PR_ARG, __entry->value, __entry->ret
+                LOCAL_PR_FMT " value:%d",
+                LOCAL_PR_ARG, __entry->value
         )
 );
 
 TRACE_EVENT(drv_set_coverage_class,
-        TP_PROTO(struct ieee80211_local *local, u8 value, int ret),
+        TP_PROTO(struct ieee80211_local *local, u8 value),
 
-        TP_ARGS(local, value, ret),
+        TP_ARGS(local, value),
 
         TP_STRUCT__entry(
                 LOCAL_ENTRY
                 __field(u8, value)
-                __field(int, ret)
         ),
 
         TP_fast_assign(
                 LOCAL_ASSIGN;
-                __entry->ret = ret;
                 __entry->value = value;
         ),
 
         TP_printk(
-                LOCAL_PR_FMT " value:%d ret:%d",
-                LOCAL_PR_ARG, __entry->value, __entry->ret
+                LOCAL_PR_FMT " value:%d",
+                LOCAL_PR_ARG, __entry->value
         )
 );
 
@@ -555,27 +574,25 @@ TRACE_EVENT(drv_sta_notify,
 TRACE_EVENT(drv_sta_add,
         TP_PROTO(struct ieee80211_local *local,
                  struct ieee80211_sub_if_data *sdata,
-                 struct ieee80211_sta *sta, int ret),
+                 struct ieee80211_sta *sta),
 
-        TP_ARGS(local, sdata, sta, ret),
+        TP_ARGS(local, sdata, sta),
 
         TP_STRUCT__entry(
                 LOCAL_ENTRY
                 VIF_ENTRY
                 STA_ENTRY
-                __field(int, ret)
         ),
 
         TP_fast_assign(
                 LOCAL_ASSIGN;
                 VIF_ASSIGN;
                 STA_ASSIGN;
-                __entry->ret = ret;
         ),
 
         TP_printk(
-                LOCAL_PR_FMT  VIF_PR_FMT  STA_PR_FMT " ret:%d",
-                LOCAL_PR_ARG, VIF_PR_ARG, STA_PR_ARG, __entry->ret
+                LOCAL_PR_FMT  VIF_PR_FMT  STA_PR_FMT,
+                LOCAL_PR_ARG, VIF_PR_ARG, STA_PR_ARG
         )
 );
 
@@ -606,10 +623,9 @@ TRACE_EVENT(drv_sta_remove,
 
 TRACE_EVENT(drv_conf_tx,
         TP_PROTO(struct ieee80211_local *local, u16 queue,
-                 const struct ieee80211_tx_queue_params *params,
-                 int ret),
+                 const struct ieee80211_tx_queue_params *params),
 
-        TP_ARGS(local, queue, params, ret),
+        TP_ARGS(local, queue, params),
 
         TP_STRUCT__entry(
                 LOCAL_ENTRY
@@ -618,13 +634,11 @@ TRACE_EVENT(drv_conf_tx,
                 __field(u16, cw_min)
                 __field(u16, cw_max)
                 __field(u8, aifs)
-                __field(int, ret)
         ),
 
         TP_fast_assign(
                 LOCAL_ASSIGN;
                 __entry->queue = queue;
-                __entry->ret = ret;
                 __entry->txop = params->txop;
                 __entry->cw_max = params->cw_max;
                 __entry->cw_min = params->cw_min;
@@ -632,29 +646,27 @@ TRACE_EVENT(drv_conf_tx,
         ),
 
         TP_printk(
-                LOCAL_PR_FMT " queue:%d ret:%d",
-                LOCAL_PR_ARG, __entry->queue, __entry->ret
+                LOCAL_PR_FMT " queue:%d",
+                LOCAL_PR_ARG, __entry->queue
         )
 );
 
 TRACE_EVENT(drv_get_tsf,
-        TP_PROTO(struct ieee80211_local *local, u64 ret),
+        TP_PROTO(struct ieee80211_local *local),
 
-        TP_ARGS(local, ret),
+        TP_ARGS(local),
 
         TP_STRUCT__entry(
                 LOCAL_ENTRY
-                __field(u64, ret)
         ),
 
         TP_fast_assign(
                 LOCAL_ASSIGN;
-                __entry->ret = ret;
         ),
 
         TP_printk(
-                LOCAL_PR_FMT " ret:%llu",
-                LOCAL_PR_ARG, (unsigned long long)__entry->ret
+                LOCAL_PR_FMT,
+                LOCAL_PR_ARG
         )
 );
 
@@ -698,23 +710,21 @@ TRACE_EVENT(drv_reset_tsf,
 );
 
 TRACE_EVENT(drv_tx_last_beacon,
-        TP_PROTO(struct ieee80211_local *local, int ret),
+        TP_PROTO(struct ieee80211_local *local),
 
-        TP_ARGS(local, ret),
+        TP_ARGS(local),
 
         TP_STRUCT__entry(
                 LOCAL_ENTRY
-                __field(int, ret)
         ),
 
         TP_fast_assign(
                 LOCAL_ASSIGN;
-                __entry->ret = ret;
         ),
 
         TP_printk(
-                LOCAL_PR_FMT " ret:%d",
-                LOCAL_PR_ARG, __entry->ret
+                LOCAL_PR_FMT,
+                LOCAL_PR_ARG
         )
 );
 
@@ -723,9 +733,9 @@ TRACE_EVENT(drv_ampdu_action,
                  struct ieee80211_sub_if_data *sdata,
                  enum ieee80211_ampdu_mlme_action action,
                  struct ieee80211_sta *sta, u16 tid,
-                 u16 *ssn, int ret),
+                 u16 *ssn),
 
-        TP_ARGS(local, sdata, action, sta, tid, ssn, ret),
+        TP_ARGS(local, sdata, action, sta, tid, ssn),
 
         TP_STRUCT__entry(
                 LOCAL_ENTRY
@@ -733,7 +743,6 @@ TRACE_EVENT(drv_ampdu_action,
                 __field(u32, action)
                 __field(u16, tid)
                 __field(u16, ssn)
-                __field(int, ret)
                 VIF_ENTRY
         ),
 
@@ -741,15 +750,36 @@ TRACE_EVENT(drv_ampdu_action,
                 LOCAL_ASSIGN;
                 VIF_ASSIGN;
                 STA_ASSIGN;
-                __entry->ret = ret;
                 __entry->action = action;
                 __entry->tid = tid;
                 __entry->ssn = ssn ? *ssn : 0;
         ),
 
         TP_printk(
-                LOCAL_PR_FMT VIF_PR_FMT STA_PR_FMT " action:%d tid:%d ret:%d",
-                LOCAL_PR_ARG, VIF_PR_ARG, STA_PR_ARG, __entry->action, __entry->tid, __entry->ret
+                LOCAL_PR_FMT VIF_PR_FMT STA_PR_FMT " action:%d tid:%d",
+                LOCAL_PR_ARG, VIF_PR_ARG, STA_PR_ARG, __entry->action, __entry->tid
+        )
+);
+
+TRACE_EVENT(drv_get_survey,
+        TP_PROTO(struct ieee80211_local *local, int idx,
+                 struct survey_info *survey),
+
+        TP_ARGS(local, idx, survey),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                __field(int, idx)
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                __entry->idx = idx;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT " idx:%d",
+                LOCAL_PR_ARG, __entry->idx
         )
 );
 
@@ -851,25 +881,23 @@ TRACE_EVENT(api_start_tx_ba_cb,
 );
 
 TRACE_EVENT(api_stop_tx_ba_session,
-        TP_PROTO(struct ieee80211_sta *sta, u16 tid, u16 initiator),
+        TP_PROTO(struct ieee80211_sta *sta, u16 tid),
 
-        TP_ARGS(sta, tid, initiator),
+        TP_ARGS(sta, tid),
 
         TP_STRUCT__entry(
                 STA_ENTRY
                 __field(u16, tid)
-                __field(u16, initiator)
         ),
 
         TP_fast_assign(
                 STA_ASSIGN;
                 __entry->tid = tid;
-                __entry->initiator = initiator;
         ),
 
         TP_printk(
-                STA_PR_FMT " tid:%d initiator:%d",
-                STA_PR_ARG, __entry->tid, __entry->initiator
+                STA_PR_FMT " tid:%d",
+                STA_PR_ARG, __entry->tid
         )
 );
 
diff --git a/net/mac80211/ht.c b/net/mac80211/ht.c
index 2ab106a0a491..9d101fb33861 100644
--- a/net/mac80211/ht.c
+++ b/net/mac80211/ht.c
@@ -6,7 +6,7 @@
  * Copyright 2005-2006, Devicescape Software, Inc.
  * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
  * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
- * Copyright 2007-2008, Intel Corporation
+ * Copyright 2007-2010, Intel Corporation
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
@@ -29,7 +29,7 @@ void ieee80211_ht_cap_ie_to_sta_ht_cap(struct ieee80211_supported_band *sband,
 
         memset(ht_cap, 0, sizeof(*ht_cap));
 
-        if (!ht_cap_ie)
+        if (!ht_cap_ie || !sband->ht_cap.ht_supported)
                 return;
 
         ht_cap->ht_supported = true;
@@ -105,6 +105,8 @@ void ieee80211_sta_tear_down_BA_sessions(struct sta_info *sta)
 {
         int i;
 
+        cancel_work_sync(&sta->ampdu_mlme.work);
+
         for (i = 0; i <  STA_TID_NUM; i++) {
                 __ieee80211_stop_tx_ba_session(sta, i, WLAN_BACK_INITIATOR);
                 __ieee80211_stop_rx_ba_session(sta, i, WLAN_BACK_RECIPIENT,
@@ -112,6 +114,43 @@ void ieee80211_sta_tear_down_BA_sessions(struct sta_info *sta)
         }
 }
 
+void ieee80211_ba_session_work(struct work_struct *work)
+{
+        struct sta_info *sta =
+                container_of(work, struct sta_info, ampdu_mlme.work);
+        struct tid_ampdu_tx *tid_tx;
+        int tid;
+
+        /*
+         * When this flag is set, new sessions should be
+         * blocked, and existing sessions will be torn
+         * down by the code that set the flag, so this
+         * need not run.
+         */
+        if (test_sta_flags(sta, WLAN_STA_BLOCK_BA))
+                return;
+
+        mutex_lock(&sta->ampdu_mlme.mtx);
+        for (tid = 0; tid < STA_TID_NUM; tid++) {
+                if (test_and_clear_bit(tid, sta->ampdu_mlme.tid_rx_timer_expired))
+                        ___ieee80211_stop_rx_ba_session(
+                                sta, tid, WLAN_BACK_RECIPIENT,
+                                WLAN_REASON_QSTA_TIMEOUT);
+
+                tid_tx = sta->ampdu_mlme.tid_tx[tid];
+                if (!tid_tx)
+                        continue;
+
+                if (test_bit(HT_AGG_STATE_WANT_START, &tid_tx->state))
+                        ieee80211_tx_ba_session_handle_start(sta, tid);
+                else if (test_and_clear_bit(HT_AGG_STATE_WANT_STOP,
+                                            &tid_tx->state))
+                        ___ieee80211_stop_tx_ba_session(sta, tid,
+                                                        WLAN_BACK_INITIATOR);
+        }
+        mutex_unlock(&sta->ampdu_mlme.mtx);
+}
+
 void ieee80211_send_delba(struct ieee80211_sub_if_data *sdata,
                           const u8 *da, u16 tid,
                           u16 initiator, u16 reason_code)
@@ -176,13 +215,8 @@ void ieee80211_process_delba(struct ieee80211_sub_if_data *sdata,
 
         if (initiator == WLAN_BACK_INITIATOR)
                 __ieee80211_stop_rx_ba_session(sta, tid, WLAN_BACK_INITIATOR, 0);
-        else { /* WLAN_BACK_RECIPIENT */
-                spin_lock_bh(&sta->lock);
-                if (sta->ampdu_mlme.tid_state_tx[tid] & HT_ADDBA_REQUESTED_MSK)
-                        ___ieee80211_stop_tx_ba_session(sta, tid,
-                                                        WLAN_BACK_RECIPIENT);
-                spin_unlock_bh(&sta->lock);
-        }
+        else
+                __ieee80211_stop_tx_ba_session(sta, tid, WLAN_BACK_RECIPIENT);
 }
 
 int ieee80211_send_smps_action(struct ieee80211_sub_if_data *sdata,
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index b2cc1fda6cfd..c691780725a7 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -43,6 +43,8 @@ static void ieee80211_rx_mgmt_auth_ibss(struct ieee80211_sub_if_data *sdata,
 {
         u16 auth_alg, auth_transaction, status_code;
 
+        lockdep_assert_held(&sdata->u.ibss.mtx);
+
         if (len < 24 + 6)
                 return;
 
@@ -78,6 +80,8 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
         u32 bss_change;
         u8 supp_rates[IEEE80211_MAX_SUPP_RATES];
 
+        lockdep_assert_held(&ifibss->mtx);
+
         /* Reset own TSF to allow time synchronization work. */
         drv_reset_tsf(local);
 
@@ -172,11 +176,13 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
         rcu_assign_pointer(ifibss->presp, skb);
 
         sdata->vif.bss_conf.beacon_int = beacon_int;
+        sdata->vif.bss_conf.basic_rates = basic_rates;
         bss_change = BSS_CHANGED_BEACON_INT;
         bss_change |= ieee80211_reset_erp_info(sdata);
         bss_change |= BSS_CHANGED_BSSID;
         bss_change |= BSS_CHANGED_BEACON;
         bss_change |= BSS_CHANGED_BEACON_ENABLED;
+        bss_change |= BSS_CHANGED_BASIC_RATES;
         bss_change |= BSS_CHANGED_IBSS;
         sdata->vif.bss_conf.ibss_joined = true;
         ieee80211_bss_info_change_notify(sdata, bss_change);
@@ -203,6 +209,8 @@ static void ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
         int i, j;
         u16 beacon_int = cbss->beacon_interval;
 
+        lockdep_assert_held(&sdata->u.ibss.mtx);
+
         if (beacon_int < 10)
                 beacon_int = 10;
 
@@ -447,6 +455,8 @@ static int ieee80211_sta_active_ibss(struct ieee80211_sub_if_data *sdata)
         int active = 0;
         struct sta_info *sta;
 
+        lockdep_assert_held(&sdata->u.ibss.mtx);
+
         rcu_read_lock();
 
         list_for_each_entry_rcu(sta, &local->sta_list, list) {
@@ -471,6 +481,8 @@ static void ieee80211_sta_merge_ibss(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
 
+        lockdep_assert_held(&ifibss->mtx);
+
         mod_timer(&ifibss->timer,
                   round_jiffies(jiffies + IEEE80211_IBSS_MERGE_INTERVAL));
 
@@ -503,6 +515,8 @@ static void ieee80211_sta_create_ibss(struct ieee80211_sub_if_data *sdata)
         u16 capability;
         int i;
 
+        lockdep_assert_held(&ifibss->mtx);
+
         if (ifibss->fixed_bssid) {
                 memcpy(bssid, ifibss->bssid, ETH_ALEN);
         } else {
@@ -529,7 +543,7 @@ static void ieee80211_sta_create_ibss(struct ieee80211_sub_if_data *sdata)
                 sdata->drop_unencrypted = 0;
 
         __ieee80211_sta_join_ibss(sdata, bssid, sdata->vif.bss_conf.beacon_int,
-                                  ifibss->channel, 3, /* first two are basic */
+                                  ifibss->channel, ifibss->basic_rates,
                                   capability, 0);
 }
 
@@ -547,6 +561,8 @@ static void ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata)
         int active_ibss;
         u16 capability;
 
+        lockdep_assert_held(&ifibss->mtx);
+
         active_ibss = ieee80211_sta_active_ibss(sdata);
 #ifdef CONFIG_MAC80211_IBSS_DEBUG
         printk(KERN_DEBUG "%s: sta_find_ibss (active_ibss=%d)\n",
@@ -635,6 +651,8 @@ static void ieee80211_rx_mgmt_probe_req(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_mgmt *resp;
         u8 *pos, *end;
 
+        lockdep_assert_held(&ifibss->mtx);
+
         if (ifibss->state != IEEE80211_IBSS_MLME_JOINED ||
             len < 24 + 2 || !ifibss->presp)
                 return;
@@ -727,8 +745,8 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
         ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems, true);
 }
 
-static void ieee80211_ibss_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
-                                          struct sk_buff *skb)
+void ieee80211_ibss_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
+                                   struct sk_buff *skb)
 {
         struct ieee80211_rx_status *rx_status;
         struct ieee80211_mgmt *mgmt;
@@ -738,6 +756,8 @@ static void ieee80211_ibss_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
         mgmt = (struct ieee80211_mgmt *) skb->data;
         fc = le16_to_cpu(mgmt->frame_control);
 
+        mutex_lock(&sdata->u.ibss.mtx);
+
         switch (fc & IEEE80211_FCTL_STYPE) {
         case IEEE80211_STYPE_PROBE_REQ:
                 ieee80211_rx_mgmt_probe_req(sdata, mgmt, skb->len);
@@ -755,35 +775,22 @@ static void ieee80211_ibss_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
                 break;
         }
 
-        kfree_skb(skb);
+        mutex_unlock(&sdata->u.ibss.mtx);
 }
 
-static void ieee80211_ibss_work(struct work_struct *work)
+void ieee80211_ibss_work(struct ieee80211_sub_if_data *sdata)
 {
-        struct ieee80211_sub_if_data *sdata =
-                container_of(work, struct ieee80211_sub_if_data, u.ibss.work);
-        struct ieee80211_local *local = sdata->local;
-        struct ieee80211_if_ibss *ifibss;
-        struct sk_buff *skb;
-
-        if (WARN_ON(local->suspended))
-                return;
-
-        if (!ieee80211_sdata_running(sdata))
-                return;
-
-        if (local->scanning)
-                return;
-
-        if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_ADHOC))
-                return;
-        ifibss = &sdata->u.ibss;
+        struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
 
-        while ((skb = skb_dequeue(&ifibss->skb_queue)))
-                ieee80211_ibss_rx_queued_mgmt(sdata, skb);
+        mutex_lock(&ifibss->mtx);
 
-        if (!test_and_clear_bit(IEEE80211_IBSS_REQ_RUN, &ifibss->request))
-                return;
+        /*
+         * Work could be scheduled after scan or similar
+         * when we aren't even joined (or trying) with a
+         * network.
+         */
+        if (!ifibss->ssid_len)
+                goto out;
 
         switch (ifibss->state) {
         case IEEE80211_IBSS_MLME_SEARCH:
@@ -796,6 +803,9 @@ static void ieee80211_ibss_work(struct work_struct *work)
                 WARN_ON(1);
                 break;
         }
+
+ out:
+        mutex_unlock(&ifibss->mtx);
 }
 
 static void ieee80211_ibss_timer(unsigned long data)
@@ -810,8 +820,7 @@ static void ieee80211_ibss_timer(unsigned long data)
                 return;
         }
 
-        set_bit(IEEE80211_IBSS_REQ_RUN, &ifibss->request);
-        ieee80211_queue_work(&local->hw, &ifibss->work);
+        ieee80211_queue_work(&local->hw, &sdata->work);
 }
 
 #ifdef CONFIG_PM
@@ -819,7 +828,6 @@ void ieee80211_ibss_quiesce(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
 
-        cancel_work_sync(&ifibss->work);
         if (del_timer_sync(&ifibss->timer))
                 ifibss->timer_running = true;
 }
@@ -839,10 +847,9 @@ void ieee80211_ibss_setup_sdata(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
 
-        INIT_WORK(&ifibss->work, ieee80211_ibss_work);
         setup_timer(&ifibss->timer, ieee80211_ibss_timer,
                     (unsigned long) sdata);
-        skb_queue_head_init(&ifibss->skb_queue);
+        mutex_init(&ifibss->mtx);
 }
 
 /* scan finished notification */
@@ -856,45 +863,28 @@ void ieee80211_ibss_notify_scan_completed(struct ieee80211_local *local)
                         continue;
                 if (sdata->vif.type != NL80211_IFTYPE_ADHOC)
                         continue;
-                if (!sdata->u.ibss.ssid_len)
-                        continue;
                 sdata->u.ibss.last_scan_completed = jiffies;
-                mod_timer(&sdata->u.ibss.timer, 0);
+                ieee80211_queue_work(&local->hw, &sdata->work);
         }
         mutex_unlock(&local->iflist_mtx);
 }
 
-ieee80211_rx_result
-ieee80211_ibss_rx_mgmt(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb)
-{
-        struct ieee80211_local *local = sdata->local;
-        struct ieee80211_mgmt *mgmt;
-        u16 fc;
-
-        if (skb->len < 24)
-                return RX_DROP_MONITOR;
-
-        mgmt = (struct ieee80211_mgmt *) skb->data;
-        fc = le16_to_cpu(mgmt->frame_control);
-
-        switch (fc & IEEE80211_FCTL_STYPE) {
-        case IEEE80211_STYPE_PROBE_RESP:
-        case IEEE80211_STYPE_BEACON:
-        case IEEE80211_STYPE_PROBE_REQ:
-        case IEEE80211_STYPE_AUTH:
-                skb_queue_tail(&sdata->u.ibss.skb_queue, skb);
-                ieee80211_queue_work(&local->hw, &sdata->u.ibss.work);
-                return RX_QUEUED;
-        }
-
-        return RX_DROP_MONITOR;
-}
-
 int ieee80211_ibss_join(struct ieee80211_sub_if_data *sdata,
                         struct cfg80211_ibss_params *params)
 {
         struct sk_buff *skb;
 
+        skb = dev_alloc_skb(sdata->local->hw.extra_tx_headroom +
+                            36 /* bitrates */ +
+                            34 /* SSID */ +
+                            3  /* DS params */ +
+                            4  /* IBSS params */ +
+                            params->ie_len);
+        if (!skb)
+                return -ENOMEM;
+
+        mutex_lock(&sdata->u.ibss.mtx);
+
         if (params->bssid) {
                 memcpy(sdata->u.ibss.bssid, params->bssid, ETH_ALEN);
                 sdata->u.ibss.fixed_bssid = true;
@@ -902,6 +892,7 @@ int ieee80211_ibss_join(struct ieee80211_sub_if_data *sdata,
                 sdata->u.ibss.fixed_bssid = false;
 
         sdata->u.ibss.privacy = params->privacy;
+        sdata->u.ibss.basic_rates = params->basic_rates;
 
         sdata->vif.bss_conf.beacon_int = params->beacon_interval;
 
@@ -922,34 +913,18 @@ int ieee80211_ibss_join(struct ieee80211_sub_if_data *sdata,
                         sdata->u.ibss.ie_len = params->ie_len;
         }
 
-        skb = dev_alloc_skb(sdata->local->hw.extra_tx_headroom +
-                            36 /* bitrates */ +
-                            34 /* SSID */ +
-                            3  /* DS params */ +
-                            4  /* IBSS params */ +
-                            params->ie_len);
-        if (!skb)
-                return -ENOMEM;
-
         sdata->u.ibss.skb = skb;
         sdata->u.ibss.state = IEEE80211_IBSS_MLME_SEARCH;
         sdata->u.ibss.ibss_join_req = jiffies;
 
         memcpy(sdata->u.ibss.ssid, params->ssid, IEEE80211_MAX_SSID_LEN);
-
-        /*
-         * The ssid_len setting below is used to see whether
-         * we are active, and we need all other settings
-         * before that may get visible.
-         */
-        mb();
-
         sdata->u.ibss.ssid_len = params->ssid_len;
 
         ieee80211_recalc_idle(sdata->local);
 
-        set_bit(IEEE80211_IBSS_REQ_RUN, &sdata->u.ibss.request);
-        ieee80211_queue_work(&sdata->local->hw, &sdata->u.ibss.work);
+        ieee80211_queue_work(&sdata->local->hw, &sdata->work);
+
+        mutex_unlock(&sdata->u.ibss.mtx);
 
         return 0;
 }
@@ -957,11 +932,33 @@ int ieee80211_ibss_join(struct ieee80211_sub_if_data *sdata,
 int ieee80211_ibss_leave(struct ieee80211_sub_if_data *sdata)
 {
         struct sk_buff *skb;
+        struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
+        struct ieee80211_local *local = sdata->local;
+        struct cfg80211_bss *cbss;
+        u16 capability;
+        int active_ibss;
 
-        del_timer_sync(&sdata->u.ibss.timer);
-        clear_bit(IEEE80211_IBSS_REQ_RUN, &sdata->u.ibss.request);
-        cancel_work_sync(&sdata->u.ibss.work);
-        clear_bit(IEEE80211_IBSS_REQ_RUN, &sdata->u.ibss.request);
+        mutex_lock(&sdata->u.ibss.mtx);
+
+        active_ibss = ieee80211_sta_active_ibss(sdata);
+
+        if (!active_ibss && !is_zero_ether_addr(ifibss->bssid)) {
+                capability = WLAN_CAPABILITY_IBSS;
+
+                if (ifibss->privacy)
+                        capability |= WLAN_CAPABILITY_PRIVACY;
+
+                cbss = cfg80211_get_bss(local->hw.wiphy, ifibss->channel,
+                                        ifibss->bssid, ifibss->ssid,
+                                        ifibss->ssid_len, WLAN_CAPABILITY_IBSS |
+                                        WLAN_CAPABILITY_PRIVACY,
+                                        capability);
+
+                if (cbss) {
+                        cfg80211_unlink_bss(local->hw.wiphy, cbss);
+                        cfg80211_put_bss(cbss);
+                }
+        }
 
         sta_info_flush(sdata->local, sdata);
 
@@ -975,10 +972,14 @@ int ieee80211_ibss_leave(struct ieee80211_sub_if_data *sdata)
         synchronize_rcu();
         kfree_skb(skb);
 
-        skb_queue_purge(&sdata->u.ibss.skb_queue);
+        skb_queue_purge(&sdata->skb_queue);
         memset(sdata->u.ibss.bssid, 0, ETH_ALEN);
         sdata->u.ibss.ssid_len = 0;
 
+        del_timer_sync(&sdata->u.ibss.timer);
+
+        mutex_unlock(&sdata->u.ibss.mtx);
+
         ieee80211_recalc_idle(sdata->local);
 
         return 0;
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 1a9e2da37a93..65e0ed6c2975 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -238,6 +238,7 @@ enum ieee80211_work_type {
         IEEE80211_WORK_ABORT,
         IEEE80211_WORK_DIRECT_PROBE,
         IEEE80211_WORK_AUTH,
+        IEEE80211_WORK_ASSOC_BEACON_WAIT,
         IEEE80211_WORK_ASSOC,
         IEEE80211_WORK_REMAIN_ON_CHANNEL,
 };
@@ -325,7 +326,6 @@ struct ieee80211_if_managed {
         struct timer_list conn_mon_timer;
         struct timer_list bcn_mon_timer;
         struct timer_list chswitch_timer;
-        struct work_struct work;
         struct work_struct monitor_work;
         struct work_struct chswitch_work;
         struct work_struct beacon_connection_loss_work;
@@ -340,8 +340,6 @@ struct ieee80211_if_managed {
 
         u16 aid;
 
-        struct sk_buff_head skb_queue;
-
         unsigned long timers_running; /* used for quiesce/restart */
         bool powersave; /* powersave requested for this iface */
         enum ieee80211_smps_mode req_smps, /* requested smps mode */
@@ -380,19 +378,15 @@ struct ieee80211_if_managed {
         int last_cqm_event_signal;
 };
 
-enum ieee80211_ibss_request {
-        IEEE80211_IBSS_REQ_RUN  = 0,
-};
-
 struct ieee80211_if_ibss {
         struct timer_list timer;
-        struct work_struct work;
 
-        struct sk_buff_head skb_queue;
+        struct mutex mtx;
 
-        unsigned long request;
         unsigned long last_scan_completed;
 
+        u32 basic_rates;
+
         bool timer_running;
 
         bool fixed_bssid;
@@ -416,11 +410,9 @@ struct ieee80211_if_ibss {
 };
 
 struct ieee80211_if_mesh {
-        struct work_struct work;
         struct timer_list housekeeping_timer;
         struct timer_list mesh_path_timer;
         struct timer_list mesh_path_root_timer;
-        struct sk_buff_head skb_queue;
 
         unsigned long timers_running;
 
@@ -517,6 +509,11 @@ struct ieee80211_sub_if_data {
 
         u16 sequence_number;
 
+        struct work_struct work;
+        struct sk_buff_head skb_queue;
+
+        bool arp_filter_state;
+
         /*
          * AP this belongs to: self in AP mode and
          * corresponding AP in VLAN mode, NULL for
@@ -569,11 +566,15 @@ ieee80211_sdata_set_mesh_id(struct ieee80211_sub_if_data *sdata,
 #endif
 }
 
+enum sdata_queue_type {
+        IEEE80211_SDATA_QUEUE_TYPE_FRAME        = 0,
+        IEEE80211_SDATA_QUEUE_AGG_START         = 1,
+        IEEE80211_SDATA_QUEUE_AGG_STOP          = 2,
+};
+
 enum {
         IEEE80211_RX_MSG        = 1,
         IEEE80211_TX_STATUS_MSG = 2,
-        IEEE80211_DELBA_MSG     = 3,
-        IEEE80211_ADDBA_MSG     = 4,
 };
 
 enum queue_stop_reason {
@@ -724,13 +725,7 @@ struct ieee80211_local {
         struct sk_buff_head pending[IEEE80211_MAX_QUEUES];
         struct tasklet_struct tx_pending_tasklet;
 
-        /*
-         * This lock is used to prevent concurrent A-MPDU
-         * session start/stop processing, this thus also
-         * synchronises the ->ampdu_action() callback to
-         * drivers and limits it to one at a time.
-         */
-        spinlock_t ampdu_lock;
+        atomic_t agg_queue_stop[IEEE80211_MAX_QUEUES];
 
         /* number of interfaces with corresponding IFF_ flags */
         atomic_t iff_allmultis, iff_promiscs;
@@ -746,10 +741,10 @@ struct ieee80211_local {
         struct mutex iflist_mtx;
 
         /*
-         * Key lock, protects sdata's key_list and sta_info's
+         * Key mutex, protects sdata's key_list and sta_info's
          * key pointers (write access, they're RCU.)
          */
-        spinlock_t key_lock;
+        struct mutex key_mtx;
 
 
         /* Scanning and BSS list */
@@ -851,6 +846,15 @@ struct ieee80211_local {
         struct work_struct dynamic_ps_disable_work;
         struct timer_list dynamic_ps_timer;
         struct notifier_block network_latency_notifier;
+        struct notifier_block ifa_notifier;
+
+        /*
+         * The dynamic ps timeout configured from user space via WEXT -
+         * this will override whatever chosen by mac80211 internally.
+         */
+        int dynamic_ps_forced_timeout;
+        int dynamic_ps_user_timeout;
+        bool disable_dynamic_ps;
 
         int user_power_level; /* in dBm */
         int power_constr_level; /* in dBm */
@@ -874,9 +878,8 @@ IEEE80211_DEV_TO_SUB_IF(struct net_device *dev)
         return netdev_priv(dev);
 }
 
-/* this struct represents 802.11n's RA/TID combination along with our vif */
+/* this struct represents 802.11n's RA/TID combination */
 struct ieee80211_ra_tid {
-        struct ieee80211_vif *vif;
         u8 ra[ETH_ALEN];
         u16 tid;
 };
@@ -985,29 +988,25 @@ int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
 int ieee80211_mgd_disassoc(struct ieee80211_sub_if_data *sdata,
                            struct cfg80211_disassoc_request *req,
                            void *cookie);
-int ieee80211_mgd_action(struct ieee80211_sub_if_data *sdata,
-                         struct ieee80211_channel *chan,
-                         enum nl80211_channel_type channel_type,
-                         const u8 *buf, size_t len, u64 *cookie);
-ieee80211_rx_result ieee80211_sta_rx_mgmt(struct ieee80211_sub_if_data *sdata,
-                                          struct sk_buff *skb);
 void ieee80211_send_pspoll(struct ieee80211_local *local,
                            struct ieee80211_sub_if_data *sdata);
 void ieee80211_recalc_ps(struct ieee80211_local *local, s32 latency);
 int ieee80211_max_network_latency(struct notifier_block *nb,
                                   unsigned long data, void *dummy);
+int ieee80211_set_arp_filter(struct ieee80211_sub_if_data *sdata);
 void ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
                                       struct ieee80211_channel_sw_ie *sw_elem,
                                       struct ieee80211_bss *bss,
                                       u64 timestamp);
 void ieee80211_sta_quiesce(struct ieee80211_sub_if_data *sdata);
 void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata);
+void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata);
+void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
+                                  struct sk_buff *skb);
 
 /* IBSS code */
 void ieee80211_ibss_notify_scan_completed(struct ieee80211_local *local);
 void ieee80211_ibss_setup_sdata(struct ieee80211_sub_if_data *sdata);
-ieee80211_rx_result
-ieee80211_ibss_rx_mgmt(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb);
 struct sta_info *ieee80211_ibss_add_sta(struct ieee80211_sub_if_data *sdata,
                                         u8 *bssid, u8 *addr, u32 supp_rates,
                                         gfp_t gfp);
@@ -1016,6 +1015,14 @@ int ieee80211_ibss_join(struct ieee80211_sub_if_data *sdata,
 int ieee80211_ibss_leave(struct ieee80211_sub_if_data *sdata);
 void ieee80211_ibss_quiesce(struct ieee80211_sub_if_data *sdata);
 void ieee80211_ibss_restart(struct ieee80211_sub_if_data *sdata);
+void ieee80211_ibss_work(struct ieee80211_sub_if_data *sdata);
+void ieee80211_ibss_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
+                                   struct sk_buff *skb);
+
+/* mesh code */
+void ieee80211_mesh_work(struct ieee80211_sub_if_data *sdata);
+void ieee80211_mesh_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
+                                   struct sk_buff *skb);
 
 /* scan/BSS handling */
 void ieee80211_scan_work(struct work_struct *work);
@@ -1084,7 +1091,7 @@ struct ieee80211_tx_status_rtap_hdr {
         u8 padding_for_rate;
         __le16 tx_flags;
         u8 data_retries;
-} __attribute__ ((packed));
+} __packed;
 
 
 /* HT */
@@ -1099,6 +1106,8 @@ int ieee80211_send_smps_action(struct ieee80211_sub_if_data *sdata,
                                enum ieee80211_smps_mode smps, const u8 *da,
                                const u8 *bssid);
 
+void ___ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid,
+                                     u16 initiator, u16 reason);
 void __ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid,
                                     u16 initiator, u16 reason);
 void ieee80211_sta_tear_down_BA_sessions(struct sta_info *sta);
@@ -1118,6 +1127,10 @@ int __ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
                                    enum ieee80211_back_parties initiator);
 int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
                                     enum ieee80211_back_parties initiator);
+void ieee80211_start_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u16 tid);
+void ieee80211_stop_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u8 tid);
+void ieee80211_ba_session_work(struct work_struct *work);
+void ieee80211_tx_ba_session_handle_start(struct sta_info *sta, int tid);
 
 /* Spectrum management */
 void ieee80211_process_measurement_req(struct ieee80211_sub_if_data *sdata,
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 50deb017fd6e..ebbe264e2b0b 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -249,6 +249,8 @@ static int ieee80211_open(struct net_device *dev)
                         local->fif_other_bss++;
 
                 ieee80211_configure_filter(local);
+
+                netif_carrier_on(dev);
                 break;
         default:
                 res = drv_add_interface(local, &sdata->vif);
@@ -268,7 +270,6 @@ static int ieee80211_open(struct net_device *dev)
 
                 changed |= ieee80211_reset_erp_info(sdata);
                 ieee80211_bss_info_change_notify(sdata, changed);
-                ieee80211_enable_keys(sdata);
 
                 if (sdata->vif.type == NL80211_IFTYPE_STATION)
                         netif_carrier_off(dev);
@@ -321,15 +322,6 @@ static int ieee80211_open(struct net_device *dev)
 
         ieee80211_recalc_ps(local, -1);
 
-        /*
-         * ieee80211_sta_work is disabled while network interface
-         * is down. Therefore, some configuration changes may not
-         * yet be effective. Trigger execution of ieee80211_sta_work
-         * to fix this.
-         */
-        if (sdata->vif.type == NL80211_IFTYPE_STATION)
-                ieee80211_queue_work(&local->hw, &sdata->u.mgd.work);
-
         netif_tx_start_all_queues(dev);
 
         return 0;
@@ -349,7 +341,6 @@ static int ieee80211_stop(struct net_device *dev)
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         struct ieee80211_local *local = sdata->local;
-        struct sta_info *sta;
         unsigned long flags;
         struct sk_buff *skb, *tmp;
         u32 hw_reconf_flags = 0;
@@ -366,18 +357,6 @@ static int ieee80211_stop(struct net_device *dev)
         ieee80211_work_purge(sdata);
 
         /*
-         * Now delete all active aggregation sessions.
-         */
-        rcu_read_lock();
-
-        list_for_each_entry_rcu(sta, &local->sta_list, list) {
-                if (sta->sdata == sdata)
-                        ieee80211_sta_tear_down_BA_sessions(sta);
-        }
-
-        rcu_read_unlock();
-
-        /*
          * Remove all stations associated with this interface.
          *
          * This must be done before calling ops->remove_interface()
@@ -483,27 +462,14 @@ static int ieee80211_stop(struct net_device *dev)
                  * whether the interface is running, which, at this point,
                  * it no longer is.
                  */
-                cancel_work_sync(&sdata->u.mgd.work);
                 cancel_work_sync(&sdata->u.mgd.chswitch_work);
                 cancel_work_sync(&sdata->u.mgd.monitor_work);
                 cancel_work_sync(&sdata->u.mgd.beacon_connection_loss_work);
 
-                /*
-                 * When we get here, the interface is marked down.
-                 * Call synchronize_rcu() to wait for the RX path
-                 * should it be using the interface and enqueuing
-                 * frames at this very time on another CPU.
-                 */
-                synchronize_rcu();
-                skb_queue_purge(&sdata->u.mgd.skb_queue);
                 /* fall through */
         case NL80211_IFTYPE_ADHOC:
-                if (sdata->vif.type == NL80211_IFTYPE_ADHOC) {
+                if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
                         del_timer_sync(&sdata->u.ibss.timer);
-                        cancel_work_sync(&sdata->u.ibss.work);
-                        synchronize_rcu();
-                        skb_queue_purge(&sdata->u.ibss.skb_queue);
-                }
                 /* fall through */
         case NL80211_IFTYPE_MESH_POINT:
                 if (ieee80211_vif_is_mesh(&sdata->vif)) {
@@ -518,6 +484,16 @@ static int ieee80211_stop(struct net_device *dev)
                 }
                 /* fall through */
         default:
+                flush_work(&sdata->work);
+                /*
+                 * When we get here, the interface is marked down.
+                 * Call synchronize_rcu() to wait for the RX path
+                 * should it be using the interface and enqueuing
+                 * frames at this very time on another CPU.
+                 */
+                synchronize_rcu();
+                skb_queue_purge(&sdata->skb_queue);
+
                 if (local->scan_sdata == sdata)
                         ieee80211_scan_cancel(local);
 
@@ -531,8 +507,8 @@ static int ieee80211_stop(struct net_device *dev)
                                 BSS_CHANGED_BEACON_ENABLED);
                 }
 
-                /* disable all keys for as long as this netdev is down */
-                ieee80211_disable_keys(sdata);
+                /* free all remaining keys, there shouldn't be any */
+                ieee80211_free_keys(sdata);
                 drv_remove_interface(local, &sdata->vif);
         }
 
@@ -727,6 +703,136 @@ static void ieee80211_if_setup(struct net_device *dev)
         dev->destructor = free_netdev;
 }
 
+static void ieee80211_iface_work(struct work_struct *work)
+{
+        struct ieee80211_sub_if_data *sdata =
+                container_of(work, struct ieee80211_sub_if_data, work);
+        struct ieee80211_local *local = sdata->local;
+        struct sk_buff *skb;
+        struct sta_info *sta;
+        struct ieee80211_ra_tid *ra_tid;
+
+        if (!ieee80211_sdata_running(sdata))
+                return;
+
+        if (local->scanning)
+                return;
+
+        /*
+         * ieee80211_queue_work() should have picked up most cases,
+         * here we'll pick the rest.
+         */
+        if (WARN(local->suspended,
+                 "interface work scheduled while going to suspend\n"))
+                return;
+
+        /* first process frames */
+        while ((skb = skb_dequeue(&sdata->skb_queue))) {
+                struct ieee80211_mgmt *mgmt = (void *)skb->data;
+
+                if (skb->pkt_type == IEEE80211_SDATA_QUEUE_AGG_START) {
+                        ra_tid = (void *)&skb->cb;
+                        ieee80211_start_tx_ba_cb(&sdata->vif, ra_tid->ra,
+                                                 ra_tid->tid);
+                } else if (skb->pkt_type == IEEE80211_SDATA_QUEUE_AGG_STOP) {
+                        ra_tid = (void *)&skb->cb;
+                        ieee80211_stop_tx_ba_cb(&sdata->vif, ra_tid->ra,
+                                                ra_tid->tid);
+                } else if (ieee80211_is_action(mgmt->frame_control) &&
+                           mgmt->u.action.category == WLAN_CATEGORY_BACK) {
+                        int len = skb->len;
+
+                        mutex_lock(&local->sta_mtx);
+                        sta = sta_info_get_bss(sdata, mgmt->sa);
+                        if (sta) {
+                                switch (mgmt->u.action.u.addba_req.action_code) {
+                                case WLAN_ACTION_ADDBA_REQ:
+                                        ieee80211_process_addba_request(
+                                                        local, sta, mgmt, len);
+                                        break;
+                                case WLAN_ACTION_ADDBA_RESP:
+                                        ieee80211_process_addba_resp(local, sta,
+                                                                     mgmt, len);
+                                        break;
+                                case WLAN_ACTION_DELBA:
+                                        ieee80211_process_delba(sdata, sta,
+                                                                mgmt, len);
+                                        break;
+                                default:
+                                        WARN_ON(1);
+                                        break;
+                                }
+                        }
+                        mutex_unlock(&local->sta_mtx);
+                } else if (ieee80211_is_data_qos(mgmt->frame_control)) {
+                        struct ieee80211_hdr *hdr = (void *)mgmt;
+                        /*
+                         * So the frame isn't mgmt, but frame_control
+                         * is at the right place anyway, of course, so
+                         * the if statement is correct.
+                         *
+                         * Warn if we have other data frame types here,
+                         * they must not get here.
+                         */
+                        WARN_ON(hdr->frame_control &
+                                        cpu_to_le16(IEEE80211_STYPE_NULLFUNC));
+                        WARN_ON(!(hdr->seq_ctrl &
+                                        cpu_to_le16(IEEE80211_SCTL_FRAG)));
+                        /*
+                         * This was a fragment of a frame, received while
+                         * a block-ack session was active. That cannot be
+                         * right, so terminate the session.
+                         */
+                        mutex_lock(&local->sta_mtx);
+                        sta = sta_info_get_bss(sdata, mgmt->sa);
+                        if (sta) {
+                                u16 tid = *ieee80211_get_qos_ctl(hdr) &
+                                                IEEE80211_QOS_CTL_TID_MASK;
+
+                                __ieee80211_stop_rx_ba_session(
+                                        sta, tid, WLAN_BACK_RECIPIENT,
+                                        WLAN_REASON_QSTA_REQUIRE_SETUP);
+                        }
+                        mutex_unlock(&local->sta_mtx);
+                } else switch (sdata->vif.type) {
+                case NL80211_IFTYPE_STATION:
+                        ieee80211_sta_rx_queued_mgmt(sdata, skb);
+                        break;
+                case NL80211_IFTYPE_ADHOC:
+                        ieee80211_ibss_rx_queued_mgmt(sdata, skb);
+                        break;
+                case NL80211_IFTYPE_MESH_POINT:
+                        if (!ieee80211_vif_is_mesh(&sdata->vif))
+                                break;
+                        ieee80211_mesh_rx_queued_mgmt(sdata, skb);
+                        break;
+                default:
+                        WARN(1, "frame for unexpected interface type");
+                        break;
+                }
+
+                kfree_skb(skb);
+        }
+
+        /* then other type-dependent work */
+        switch (sdata->vif.type) {
+        case NL80211_IFTYPE_STATION:
+                ieee80211_sta_work(sdata);
+                break;
+        case NL80211_IFTYPE_ADHOC:
+                ieee80211_ibss_work(sdata);
+                break;
+        case NL80211_IFTYPE_MESH_POINT:
+                if (!ieee80211_vif_is_mesh(&sdata->vif))
+                        break;
+                ieee80211_mesh_work(sdata);
+                break;
+        default:
+                break;
+        }
+}
+
+
 /*
  * Helper function to initialise an interface to a specific type.
  */
@@ -744,6 +850,9 @@ static void ieee80211_setup_sdata(struct ieee80211_sub_if_data *sdata,
         /* only monitor differs */
         sdata->dev->type = ARPHRD_ETHER;
 
+        skb_queue_head_init(&sdata->skb_queue);
+        INIT_WORK(&sdata->work, ieee80211_iface_work);
+
         switch (type) {
         case NL80211_IFTYPE_AP:
                 skb_queue_head_init(&sdata->u.ap.ps_bc_buf);
@@ -969,6 +1078,9 @@ int ieee80211_if_add(struct ieee80211_local *local, const char *name,
         sdata->wdev.wiphy = local->hw.wiphy;
         sdata->local = local;
         sdata->dev = ndev;
+#ifdef CONFIG_INET
+        sdata->arp_filter_state = true;
+#endif
 
         for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++)
                 skb_queue_head_init(&sdata->fragments[i].skb_list);
diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index e8f6e3b252d8..1b9d87ed143a 100644
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -36,80 +36,20 @@
  * There is currently no way of knowing this except by looking into
  * debugfs.
  *
- * All key operations are protected internally so you can call them at
- * any time.
+ * All key operations are protected internally.
  *
  * Within mac80211, key references are, just as STA structure references,
  * protected by RCU. Note, however, that some things are unprotected,
  * namely the key->sta dereferences within the hardware acceleration
- * functions. This means that sta_info_destroy() must flush the key todo
- * list.
- *
- * All the direct key list manipulation functions must not sleep because
- * they can operate on STA info structs that are protected by RCU.
+ * functions. This means that sta_info_destroy() must remove the key
+ * which waits for an RCU grace period.
  */
 
 static const u8 bcast_addr[ETH_ALEN] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
 
-/* key mutex: used to synchronise todo runners */
-static DEFINE_MUTEX(key_mutex);
-static DEFINE_SPINLOCK(todo_lock);
-static LIST_HEAD(todo_list);
-
-static void key_todo(struct work_struct *work)
-{
-        ieee80211_key_todo();
-}
-
-static DECLARE_WORK(todo_work, key_todo);
-
-/**
- * add_todo - add todo item for a key
- *
- * @key: key to add to do item for
- * @flag: todo flag(s)
- *
- * Must be called with IRQs or softirqs disabled.
- */
-static void add_todo(struct ieee80211_key *key, u32 flag)
-{
-        if (!key)
-                return;
-
-        spin_lock(&todo_lock);
-        key->flags |= flag;
-        /*
-         * Remove again if already on the list so that we move it to the end.
-         */
-        if (!list_empty(&key->todo))
-                list_del(&key->todo);
-        list_add_tail(&key->todo, &todo_list);
-        schedule_work(&todo_work);
-        spin_unlock(&todo_lock);
-}
-
-/**
- * ieee80211_key_lock - lock the mac80211 key operation lock
- *
- * This locks the (global) mac80211 key operation lock, all
- * key operations must be done under this lock.
- */
-static void ieee80211_key_lock(void)
-{
-        mutex_lock(&key_mutex);
-}
-
-/**
- * ieee80211_key_unlock - unlock the mac80211 key operation lock
- */
-static void ieee80211_key_unlock(void)
-{
-        mutex_unlock(&key_mutex);
-}
-
-static void assert_key_lock(void)
+static void assert_key_lock(struct ieee80211_local *local)
 {
-        WARN_ON(!mutex_is_locked(&key_mutex));
+        WARN_ON(!mutex_is_locked(&local->key_mtx));
 }
 
 static struct ieee80211_sta *get_sta_for_key(struct ieee80211_key *key)
@@ -126,12 +66,13 @@ static void ieee80211_key_enable_hw_accel(struct ieee80211_key *key)
         struct ieee80211_sta *sta;
         int ret;
 
-        assert_key_lock();
         might_sleep();
 
         if (!key->local->ops->set_key)
                 return;
 
+        assert_key_lock(key->local);
+
         sta = get_sta_for_key(key);
 
         sdata = key->sdata;
@@ -142,11 +83,8 @@ static void ieee80211_key_enable_hw_accel(struct ieee80211_key *key)
 
         ret = drv_set_key(key->local, SET_KEY, sdata, sta, &key->conf);
 
-        if (!ret) {
-                spin_lock_bh(&todo_lock);
+        if (!ret)
                 key->flags |= KEY_FLAG_UPLOADED_TO_HARDWARE;
-                spin_unlock_bh(&todo_lock);
-        }
 
         if (ret && ret != -ENOSPC && ret != -EOPNOTSUPP)
                 printk(KERN_ERR "mac80211-%s: failed to set key "
@@ -161,18 +99,15 @@ static void ieee80211_key_disable_hw_accel(struct ieee80211_key *key)
         struct ieee80211_sta *sta;
         int ret;
 
-        assert_key_lock();
         might_sleep();
 
         if (!key || !key->local->ops->set_key)
                 return;
 
-        spin_lock_bh(&todo_lock);
-        if (!(key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE)) {
-                spin_unlock_bh(&todo_lock);
+        assert_key_lock(key->local);
+
+        if (!(key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE))
                 return;
-        }
-        spin_unlock_bh(&todo_lock);
 
         sta = get_sta_for_key(key);
         sdata = key->sdata;
@@ -191,9 +126,7 @@ static void ieee80211_key_disable_hw_accel(struct ieee80211_key *key)
                        wiphy_name(key->local->hw.wiphy),
                        key->conf.keyidx, sta ? sta->addr : bcast_addr, ret);
 
-        spin_lock_bh(&todo_lock);
         key->flags &= ~KEY_FLAG_UPLOADED_TO_HARDWARE;
-        spin_unlock_bh(&todo_lock);
 }
 
 static void __ieee80211_set_default_key(struct ieee80211_sub_if_data *sdata,
@@ -201,22 +134,24 @@ static void __ieee80211_set_default_key(struct ieee80211_sub_if_data *sdata,
 {
         struct ieee80211_key *key = NULL;
 
+        assert_key_lock(sdata->local);
+
         if (idx >= 0 && idx < NUM_DEFAULT_KEYS)
                 key = sdata->keys[idx];
 
         rcu_assign_pointer(sdata->default_key, key);
 
-        if (key)
-                add_todo(key, KEY_FLAG_TODO_DEFKEY);
+        if (key) {
+                ieee80211_debugfs_key_remove_default(key->sdata);
+                ieee80211_debugfs_key_add_default(key->sdata);
+        }
 }
 
 void ieee80211_set_default_key(struct ieee80211_sub_if_data *sdata, int idx)
 {
-        unsigned long flags;
-
-        spin_lock_irqsave(&sdata->local->key_lock, flags);
+        mutex_lock(&sdata->local->key_mtx);
         __ieee80211_set_default_key(sdata, idx);
-        spin_unlock_irqrestore(&sdata->local->key_lock, flags);
+        mutex_unlock(&sdata->local->key_mtx);
 }
 
 static void
@@ -224,24 +159,26 @@ __ieee80211_set_default_mgmt_key(struct ieee80211_sub_if_data *sdata, int idx)
 {
         struct ieee80211_key *key = NULL;
 
+        assert_key_lock(sdata->local);
+
         if (idx >= NUM_DEFAULT_KEYS &&
             idx < NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS)
                 key = sdata->keys[idx];
 
         rcu_assign_pointer(sdata->default_mgmt_key, key);
 
-        if (key)
-                add_todo(key, KEY_FLAG_TODO_DEFMGMTKEY);
+        if (key) {
+                ieee80211_debugfs_key_remove_mgmt_default(key->sdata);
+                ieee80211_debugfs_key_add_mgmt_default(key->sdata);
+        }
 }
 
 void ieee80211_set_default_mgmt_key(struct ieee80211_sub_if_data *sdata,
                                     int idx)
 {
-        unsigned long flags;
-
-        spin_lock_irqsave(&sdata->local->key_lock, flags);
+        mutex_lock(&sdata->local->key_mtx);
         __ieee80211_set_default_mgmt_key(sdata, idx);
-        spin_unlock_irqrestore(&sdata->local->key_lock, flags);
+        mutex_unlock(&sdata->local->key_mtx);
 }
 
 
@@ -336,7 +273,7 @@ struct ieee80211_key *ieee80211_key_alloc(enum ieee80211_key_alg alg,
                 key->conf.iv_len = CCMP_HDR_LEN;
                 key->conf.icv_len = CCMP_MIC_LEN;
                 if (seq) {
-                        for (i = 0; i < NUM_RX_DATA_QUEUES; i++)
+                        for (i = 0; i < NUM_RX_DATA_QUEUES + 1; i++)
                                 for (j = 0; j < CCMP_PN_LEN; j++)
                                         key->u.ccmp.rx_pn[i][j] =
                                                 seq[CCMP_PN_LEN - j - 1];
@@ -352,7 +289,6 @@ struct ieee80211_key *ieee80211_key_alloc(enum ieee80211_key_alg alg,
         }
         memcpy(key->conf.key, key_data, key_len);
         INIT_LIST_HEAD(&key->list);
-        INIT_LIST_HEAD(&key->todo);
 
         if (alg == ALG_CCMP) {
                 /*
@@ -382,12 +318,29 @@ struct ieee80211_key *ieee80211_key_alloc(enum ieee80211_key_alg alg,
         return key;
 }
 
+static void __ieee80211_key_destroy(struct ieee80211_key *key)
+{
+        if (!key)
+                return;
+
+        if (key->local)
+                ieee80211_key_disable_hw_accel(key);
+
+        if (key->conf.alg == ALG_CCMP)
+                ieee80211_aes_key_free(key->u.ccmp.tfm);
+        if (key->conf.alg == ALG_AES_CMAC)
+                ieee80211_aes_cmac_key_free(key->u.aes_cmac.tfm);
+        if (key->local)
+                ieee80211_debugfs_key_remove(key);
+
+        kfree(key);
+}
+
 void ieee80211_key_link(struct ieee80211_key *key,
                         struct ieee80211_sub_if_data *sdata,
                         struct sta_info *sta)
 {
         struct ieee80211_key *old_key;
-        unsigned long flags;
         int idx;
 
         BUG_ON(!sdata);
@@ -431,7 +384,7 @@ void ieee80211_key_link(struct ieee80211_key *key,
                 }
         }
 
-        spin_lock_irqsave(&sdata->local->key_lock, flags);
+        mutex_lock(&sdata->local->key_mtx);
 
         if (sta)
                 old_key = sta->key;
@@ -439,15 +392,13 @@ void ieee80211_key_link(struct ieee80211_key *key,
                 old_key = sdata->keys[idx];
 
         __ieee80211_key_replace(sdata, sta, old_key, key);
+        __ieee80211_key_destroy(old_key);
 
-        /* free old key later */
-        add_todo(old_key, KEY_FLAG_TODO_DELETE);
+        ieee80211_debugfs_key_add(key);
 
-        add_todo(key, KEY_FLAG_TODO_ADD_DEBUGFS);
-        if (ieee80211_sdata_running(sdata))
-                add_todo(key, KEY_FLAG_TODO_HWACCEL_ADD);
+        ieee80211_key_enable_hw_accel(key);
 
-        spin_unlock_irqrestore(&sdata->local->key_lock, flags);
+        mutex_unlock(&sdata->local->key_mtx);
 }
 
 static void __ieee80211_key_free(struct ieee80211_key *key)
@@ -458,170 +409,62 @@ static void __ieee80211_key_free(struct ieee80211_key *key)
         if (key->sdata)
                 __ieee80211_key_replace(key->sdata, key->sta,
                                         key, NULL);
-
-        add_todo(key, KEY_FLAG_TODO_DELETE);
+        __ieee80211_key_destroy(key);
 }
 
-void ieee80211_key_free(struct ieee80211_key *key)
+void ieee80211_key_free(struct ieee80211_local *local,
+                        struct ieee80211_key *key)
 {
-        unsigned long flags;
-
         if (!key)
                 return;
 
-        if (!key->sdata) {
-                /* The key has not been linked yet, simply free it
-                 * and don't Oops */
-                if (key->conf.alg == ALG_CCMP)
-                        ieee80211_aes_key_free(key->u.ccmp.tfm);
-                kfree(key);
-                return;
-        }
-
-        spin_lock_irqsave(&key->sdata->local->key_lock, flags);
+        mutex_lock(&local->key_mtx);
         __ieee80211_key_free(key);
-        spin_unlock_irqrestore(&key->sdata->local->key_lock, flags);
+        mutex_unlock(&local->key_mtx);
 }
 
-/*
- * To be safe against concurrent manipulations of the list (which shouldn't
- * actually happen) we need to hold the spinlock. But under the spinlock we
- * can't actually do much, so we defer processing to the todo list. Then run
- * the todo list to be sure the operation and possibly previously pending
- * operations are completed.
- */
-static void ieee80211_todo_for_each_key(struct ieee80211_sub_if_data *sdata,
-                                        u32 todo_flags)
+void ieee80211_enable_keys(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_key *key;
-        unsigned long flags;
-
-        might_sleep();
-
-        spin_lock_irqsave(&sdata->local->key_lock, flags);
-        list_for_each_entry(key, &sdata->key_list, list)
-                add_todo(key, todo_flags);
-        spin_unlock_irqrestore(&sdata->local->key_lock, flags);
 
-        ieee80211_key_todo();
-}
-
-void ieee80211_enable_keys(struct ieee80211_sub_if_data *sdata)
-{
         ASSERT_RTNL();
 
         if (WARN_ON(!ieee80211_sdata_running(sdata)))
                 return;
 
-        ieee80211_todo_for_each_key(sdata, KEY_FLAG_TODO_HWACCEL_ADD);
-}
+        mutex_lock(&sdata->local->key_mtx);
 
-void ieee80211_disable_keys(struct ieee80211_sub_if_data *sdata)
-{
-        ASSERT_RTNL();
-
-        ieee80211_todo_for_each_key(sdata, KEY_FLAG_TODO_HWACCEL_REMOVE);
-}
-
-static void __ieee80211_key_destroy(struct ieee80211_key *key)
-{
-        if (!key)
-                return;
-
-        ieee80211_key_disable_hw_accel(key);
-
-        if (key->conf.alg == ALG_CCMP)
-                ieee80211_aes_key_free(key->u.ccmp.tfm);
-        if (key->conf.alg == ALG_AES_CMAC)
-                ieee80211_aes_cmac_key_free(key->u.aes_cmac.tfm);
-        ieee80211_debugfs_key_remove(key);
+        list_for_each_entry(key, &sdata->key_list, list)
+                ieee80211_key_enable_hw_accel(key);
 
-        kfree(key);
+        mutex_unlock(&sdata->local->key_mtx);
 }
 
-static void __ieee80211_key_todo(void)
+void ieee80211_disable_keys(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_key *key;
-        bool work_done;
-        u32 todoflags;
 
-        /*
-         * NB: sta_info_destroy relies on this!
-         */
-        synchronize_rcu();
-
-        spin_lock_bh(&todo_lock);
-        while (!list_empty(&todo_list)) {
-                key = list_first_entry(&todo_list, struct ieee80211_key, todo);
-                list_del_init(&key->todo);
-                todoflags = key->flags & (KEY_FLAG_TODO_ADD_DEBUGFS |
-                                          KEY_FLAG_TODO_DEFKEY |
-                                          KEY_FLAG_TODO_DEFMGMTKEY |
-                                          KEY_FLAG_TODO_HWACCEL_ADD |
-                                          KEY_FLAG_TODO_HWACCEL_REMOVE |
-                                          KEY_FLAG_TODO_DELETE);
-                key->flags &= ~todoflags;
-                spin_unlock_bh(&todo_lock);
-
-                work_done = false;
-
-                if (todoflags & KEY_FLAG_TODO_ADD_DEBUGFS) {
-                        ieee80211_debugfs_key_add(key);
-                        work_done = true;
-                }
-                if (todoflags & KEY_FLAG_TODO_DEFKEY) {
-                        ieee80211_debugfs_key_remove_default(key->sdata);
-                        ieee80211_debugfs_key_add_default(key->sdata);
-                        work_done = true;
-                }
-                if (todoflags & KEY_FLAG_TODO_DEFMGMTKEY) {
-                        ieee80211_debugfs_key_remove_mgmt_default(key->sdata);
-                        ieee80211_debugfs_key_add_mgmt_default(key->sdata);
-                        work_done = true;
-                }
-                if (todoflags & KEY_FLAG_TODO_HWACCEL_ADD) {
-                        ieee80211_key_enable_hw_accel(key);
-                        work_done = true;
-                }
-                if (todoflags & KEY_FLAG_TODO_HWACCEL_REMOVE) {
-                        ieee80211_key_disable_hw_accel(key);
-                        work_done = true;
-                }
-                if (todoflags & KEY_FLAG_TODO_DELETE) {
-                        __ieee80211_key_destroy(key);
-                        work_done = true;
-                }
+        ASSERT_RTNL();
 
-                WARN_ON(!work_done);
+        mutex_lock(&sdata->local->key_mtx);
 
-                spin_lock_bh(&todo_lock);
-        }
-        spin_unlock_bh(&todo_lock);
-}
+        list_for_each_entry(key, &sdata->key_list, list)
+                ieee80211_key_disable_hw_accel(key);
 
-void ieee80211_key_todo(void)
-{
-        ieee80211_key_lock();
-        __ieee80211_key_todo();
-        ieee80211_key_unlock();
+        mutex_unlock(&sdata->local->key_mtx);
 }
 
 void ieee80211_free_keys(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_key *key, *tmp;
-        unsigned long flags;
 
-        ieee80211_key_lock();
+        mutex_lock(&sdata->local->key_mtx);
 
         ieee80211_debugfs_key_remove_default(sdata);
         ieee80211_debugfs_key_remove_mgmt_default(sdata);
 
-        spin_lock_irqsave(&sdata->local->key_lock, flags);
         list_for_each_entry_safe(key, tmp, &sdata->key_list, list)
                 __ieee80211_key_free(key);
-        spin_unlock_irqrestore(&sdata->local->key_lock, flags);
-
-        __ieee80211_key_todo();
 
-        ieee80211_key_unlock();
+        mutex_unlock(&sdata->local->key_mtx);
 }
diff --git a/net/mac80211/key.h b/net/mac80211/key.h
index bdc2968c2bbe..b665bbb7a471 100644
--- a/net/mac80211/key.h
+++ b/net/mac80211/key.h
@@ -38,25 +38,9 @@ struct sta_info;
  *
  * @KEY_FLAG_UPLOADED_TO_HARDWARE: Indicates that this key is present
  *      in the hardware for TX crypto hardware acceleration.
- * @KEY_FLAG_TODO_DELETE: Key is marked for deletion and will, after an
- *      RCU grace period, no longer be reachable other than from the
- *      todo list.
- * @KEY_FLAG_TODO_HWACCEL_ADD: Key needs to be added to hardware acceleration.
- * @KEY_FLAG_TODO_HWACCEL_REMOVE: Key needs to be removed from hardware
- *      acceleration.
- * @KEY_FLAG_TODO_DEFKEY: Key is default key and debugfs needs to be updated.
- * @KEY_FLAG_TODO_ADD_DEBUGFS: Key needs to be added to debugfs.
- * @KEY_FLAG_TODO_DEFMGMTKEY: Key is default management key and debugfs needs
- *      to be updated.
  */
 enum ieee80211_internal_key_flags {
         KEY_FLAG_UPLOADED_TO_HARDWARE   = BIT(0),
-        KEY_FLAG_TODO_DELETE            = BIT(1),
-        KEY_FLAG_TODO_HWACCEL_ADD       = BIT(2),
-        KEY_FLAG_TODO_HWACCEL_REMOVE    = BIT(3),
-        KEY_FLAG_TODO_DEFKEY            = BIT(4),
-        KEY_FLAG_TODO_ADD_DEBUGFS       = BIT(5),
-        KEY_FLAG_TODO_DEFMGMTKEY        = BIT(6),
 };
 
 enum ieee80211_internal_tkip_state {
@@ -79,10 +63,8 @@ struct ieee80211_key {
 
         /* for sdata list */
         struct list_head list;
-        /* for todo list */
-        struct list_head todo;
 
-        /* protected by todo lock! */
+        /* protected by key mutex */
         unsigned int flags;
 
         union {
@@ -95,7 +77,13 @@ struct ieee80211_key {
                 } tkip;
                 struct {
                         u8 tx_pn[6];
-                        u8 rx_pn[NUM_RX_DATA_QUEUES][6];
+                        /*
+                         * Last received packet number. The first
+                         * NUM_RX_DATA_QUEUES counters are used with Data
+                         * frames and the last counter is used with Robust
+                         * Management frames.
+                         */
+                        u8 rx_pn[NUM_RX_DATA_QUEUES + 1][6];
                         struct crypto_cipher *tfm;
                         u32 replays; /* dot11RSNAStatsCCMPReplays */
                         /* scratch buffers for virt_to_page() (crypto API) */
@@ -147,7 +135,8 @@ struct ieee80211_key *ieee80211_key_alloc(enum ieee80211_key_alg alg,
 void ieee80211_key_link(struct ieee80211_key *key,
                         struct ieee80211_sub_if_data *sdata,
                         struct sta_info *sta);
-void ieee80211_key_free(struct ieee80211_key *key);
+void ieee80211_key_free(struct ieee80211_local *local,
+                        struct ieee80211_key *key);
 void ieee80211_set_default_key(struct ieee80211_sub_if_data *sdata, int idx);
 void ieee80211_set_default_mgmt_key(struct ieee80211_sub_if_data *sdata,
                                     int idx);
@@ -155,6 +144,4 @@ void ieee80211_free_keys(struct ieee80211_sub_if_data *sdata);
 void ieee80211_enable_keys(struct ieee80211_sub_if_data *sdata);
 void ieee80211_disable_keys(struct ieee80211_sub_if_data *sdata);
 
-void ieee80211_key_todo(void);
-
 #endif /* IEEE80211_KEY_H */
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 22a384dfab65..798a91b100cc 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -20,6 +20,7 @@
 #include <linux/rtnetlink.h>
 #include <linux/bitmap.h>
 #include <linux/pm_qos_params.h>
+#include <linux/inetdevice.h>
 #include <net/net_namespace.h>
 #include <net/cfg80211.h>
 
@@ -106,12 +107,15 @@ int ieee80211_hw_config(struct ieee80211_local *local, u32 changed)
         if (scan_chan) {
                 chan = scan_chan;
                 channel_type = NL80211_CHAN_NO_HT;
+                local->hw.conf.flags |= IEEE80211_CONF_OFFCHANNEL;
         } else if (local->tmp_channel) {
                 chan = scan_chan = local->tmp_channel;
                 channel_type = local->tmp_channel_type;
+                local->hw.conf.flags |= IEEE80211_CONF_OFFCHANNEL;
         } else {
                 chan = local->oper_channel;
                 channel_type = local->_oper_channel_type;
+                local->hw.conf.flags &= ~IEEE80211_CONF_OFFCHANNEL;
         }
 
         if (chan != local->hw.conf.channel ||
@@ -259,7 +263,6 @@ static void ieee80211_tasklet_handler(unsigned long data)
 {
         struct ieee80211_local *local = (struct ieee80211_local *) data;
         struct sk_buff *skb;
-        struct ieee80211_ra_tid *ra_tid;
 
         while ((skb = skb_dequeue(&local->skb_queue)) ||
                (skb = skb_dequeue(&local->skb_queue_unreliable))) {
@@ -274,18 +277,6 @@ static void ieee80211_tasklet_handler(unsigned long data)
                         skb->pkt_type = 0;
                         ieee80211_tx_status(local_to_hw(local), skb);
                         break;
-                case IEEE80211_DELBA_MSG:
-                        ra_tid = (struct ieee80211_ra_tid *) &skb->cb;
-                        ieee80211_stop_tx_ba_cb(ra_tid->vif, ra_tid->ra,
-                                                ra_tid->tid);
-                        dev_kfree_skb(skb);
-                        break;
-                case IEEE80211_ADDBA_MSG:
-                        ra_tid = (struct ieee80211_ra_tid *) &skb->cb;
-                        ieee80211_start_tx_ba_cb(ra_tid->vif, ra_tid->ra,
-                                                 ra_tid->tid);
-                        dev_kfree_skb(skb);
-                        break ;
                 default:
                         WARN(1, "mac80211: Packet is of unknown type %d\n",
                              skb->pkt_type);
@@ -329,6 +320,76 @@ static void ieee80211_recalc_smps_work(struct work_struct *work)
         mutex_unlock(&local->iflist_mtx);
 }
 
+#ifdef CONFIG_INET
+static int ieee80211_ifa_changed(struct notifier_block *nb,
+                                 unsigned long data, void *arg)
+{
+        struct in_ifaddr *ifa = arg;
+        struct ieee80211_local *local =
+                container_of(nb, struct ieee80211_local,
+                             ifa_notifier);
+        struct net_device *ndev = ifa->ifa_dev->dev;
+        struct wireless_dev *wdev = ndev->ieee80211_ptr;
+        struct in_device *idev;
+        struct ieee80211_sub_if_data *sdata;
+        struct ieee80211_bss_conf *bss_conf;
+        struct ieee80211_if_managed *ifmgd;
+        int c = 0;
+
+        if (!netif_running(ndev))
+                return NOTIFY_DONE;
+
+        /* Make sure it's our interface that got changed */
+        if (!wdev)
+                return NOTIFY_DONE;
+
+        if (wdev->wiphy != local->hw.wiphy)
+                return NOTIFY_DONE;
+
+        sdata = IEEE80211_DEV_TO_SUB_IF(ndev);
+        bss_conf = &sdata->vif.bss_conf;
+
+        /* ARP filtering is only supported in managed mode */
+        if (sdata->vif.type != NL80211_IFTYPE_STATION)
+                return NOTIFY_DONE;
+
+        idev = sdata->dev->ip_ptr;
+        if (!idev)
+                return NOTIFY_DONE;
+
+        ifmgd = &sdata->u.mgd;
+        mutex_lock(&ifmgd->mtx);
+
+        /* Copy the addresses to the bss_conf list */
+        ifa = idev->ifa_list;
+        while (c < IEEE80211_BSS_ARP_ADDR_LIST_LEN && ifa) {
+                bss_conf->arp_addr_list[c] = ifa->ifa_address;
+                ifa = ifa->ifa_next;
+                c++;
+        }
+
+        /* If not all addresses fit the list, disable filtering */
+        if (ifa) {
+                sdata->arp_filter_state = false;
+                c = 0;
+        } else {
+                sdata->arp_filter_state = true;
+        }
+        bss_conf->arp_addr_cnt = c;
+
+        /* Configure driver only if associated */
+        if (ifmgd->associated) {
+                bss_conf->arp_filter_enabled = sdata->arp_filter_state;
+                ieee80211_bss_info_change_notify(sdata,
+                                                 BSS_CHANGED_ARP_FILTER);
+        }
+
+        mutex_unlock(&ifmgd->mtx);
+
+        return NOTIFY_DONE;
+}
+#endif
+
 struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
                                         const struct ieee80211_ops *ops)
 {
@@ -396,7 +457,7 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
         mutex_init(&local->iflist_mtx);
         mutex_init(&local->scan_mtx);
 
-        spin_lock_init(&local->key_lock);
+        mutex_init(&local->key_mtx);
         spin_lock_init(&local->filter_lock);
         spin_lock_init(&local->queue_stop_reason_lock);
 
@@ -419,8 +480,10 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
 
         sta_info_init(local);
 
-        for (i = 0; i < IEEE80211_MAX_QUEUES; i++)
+        for (i = 0; i < IEEE80211_MAX_QUEUES; i++) {
                 skb_queue_head_init(&local->pending[i]);
+                atomic_set(&local->agg_queue_stop[i], 0);
+        }
         tasklet_init(&local->tx_pending_tasklet, ieee80211_tx_pending,
                      (unsigned long)local);
 
@@ -431,8 +494,6 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
         skb_queue_head_init(&local->skb_queue);
         skb_queue_head_init(&local->skb_queue_unreliable);
 
-        spin_lock_init(&local->ampdu_lock);
-
         return local_to_hw(local);
 }
 EXPORT_SYMBOL(ieee80211_alloc_hw);
@@ -572,18 +633,16 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
 
         local->hw.conf.listen_interval = local->hw.max_listen_interval;
 
-        local->hw.conf.dynamic_ps_forced_timeout = -1;
+        local->dynamic_ps_forced_timeout = -1;
 
         result = sta_info_start(local);
         if (result < 0)
                 goto fail_sta_info;
 
         result = ieee80211_wep_init(local);
-        if (result < 0) {
+        if (result < 0)
                 printk(KERN_DEBUG "%s: Failed to initialize wep: %d\n",
                        wiphy_name(local->hw.wiphy), result);
-                goto fail_wep;
-        }
 
         rtnl_lock();
 
@@ -612,21 +671,32 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
                 ieee80211_max_network_latency;
         result = pm_qos_add_notifier(PM_QOS_NETWORK_LATENCY,
                                      &local->network_latency_notifier);
-
         if (result) {
                 rtnl_lock();
                 goto fail_pm_qos;
         }
 
+#ifdef CONFIG_INET
+        local->ifa_notifier.notifier_call = ieee80211_ifa_changed;
+        result = register_inetaddr_notifier(&local->ifa_notifier);
+        if (result)
+                goto fail_ifa;
+#endif
+
         return 0;
 
+#ifdef CONFIG_INET
+ fail_ifa:
+        pm_qos_remove_notifier(PM_QOS_NETWORK_LATENCY,
+                               &local->network_latency_notifier);
+        rtnl_lock();
+#endif
  fail_pm_qos:
         ieee80211_led_exit(local);
         ieee80211_remove_interfaces(local);
  fail_rate:
         rtnl_unlock();
         ieee80211_wep_free(local);
- fail_wep:
         sta_info_stop(local);
  fail_sta_info:
         destroy_workqueue(local->workqueue);
@@ -647,6 +717,9 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw)
 
         pm_qos_remove_notifier(PM_QOS_NETWORK_LATENCY,
                                &local->network_latency_notifier);
+#ifdef CONFIG_INET
+        unregister_inetaddr_notifier(&local->ifa_notifier);
+#endif
 
         rtnl_lock();
 
@@ -704,6 +777,10 @@ static int __init ieee80211_init(void)
         if (ret)
                 return ret;
 
+        ret = rc80211_minstrel_ht_init();
+        if (ret)
+                goto err_minstrel;
+
         ret = rc80211_pid_init();
         if (ret)
                 goto err_pid;
@@ -716,6 +793,8 @@ static int __init ieee80211_init(void)
  err_netdev:
         rc80211_pid_exit();
  err_pid:
+        rc80211_minstrel_ht_exit();
+ err_minstrel:
         rc80211_minstrel_exit();
 
         return ret;
@@ -724,6 +803,7 @@ static int __init ieee80211_init(void)
 static void __exit ieee80211_exit(void)
 {
         rc80211_pid_exit();
+        rc80211_minstrel_ht_exit();
         rc80211_minstrel_exit();
 
         /*
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index bde81031727a..c8a4f19ed13b 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -54,7 +54,7 @@ static void ieee80211_mesh_housekeeping_timer(unsigned long data)
                 return;
         }
 
-        ieee80211_queue_work(&local->hw, &ifmsh->work);
+        ieee80211_queue_work(&local->hw, &sdata->work);
 }
 
 /**
@@ -345,7 +345,7 @@ static void ieee80211_mesh_path_timer(unsigned long data)
                 return;
         }
 
-        ieee80211_queue_work(&local->hw, &ifmsh->work);
+        ieee80211_queue_work(&local->hw, &sdata->work);
 }
 
 static void ieee80211_mesh_path_root_timer(unsigned long data)
@@ -362,7 +362,7 @@ static void ieee80211_mesh_path_root_timer(unsigned long data)
                 return;
         }
 
-        ieee80211_queue_work(&local->hw, &ifmsh->work);
+        ieee80211_queue_work(&local->hw, &sdata->work);
 }
 
 void ieee80211_mesh_root_setup(struct ieee80211_if_mesh *ifmsh)
@@ -484,9 +484,6 @@ void ieee80211_mesh_quiesce(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
 
-        /* might restart the timer but that doesn't matter */
-        cancel_work_sync(&ifmsh->work);
-
         /* use atomic bitops in case both timers fire at the same time */
 
         if (del_timer_sync(&ifmsh->housekeeping_timer))
@@ -518,7 +515,7 @@ void ieee80211_start_mesh(struct ieee80211_sub_if_data *sdata)
 
         set_bit(MESH_WORK_HOUSEKEEPING, &ifmsh->wrkq_flags);
         ieee80211_mesh_root_setup(ifmsh);
-        ieee80211_queue_work(&local->hw, &ifmsh->work);
+        ieee80211_queue_work(&local->hw, &sdata->work);
         sdata->vif.bss_conf.beacon_int = MESH_DEFAULT_BEACON_INTERVAL;
         ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON |
                                                 BSS_CHANGED_BEACON_ENABLED |
@@ -536,16 +533,7 @@ void ieee80211_stop_mesh(struct ieee80211_sub_if_data *sdata)
          * whether the interface is running, which, at this point,
          * it no longer is.
          */
-        cancel_work_sync(&sdata->u.mesh.work);
-
-        /*
-         * When we get here, the interface is marked down.
-         * Call synchronize_rcu() to wait for the RX path
-         * should it be using the interface and enqueuing
-         * frames at this very time on another CPU.
-         */
-        rcu_barrier(); /* Wait for RX path and call_rcu()'s */
-        skb_queue_purge(&sdata->u.mesh.skb_queue);
+        cancel_work_sync(&sdata->work);
 }
 
 static void ieee80211_mesh_rx_bcn_presp(struct ieee80211_sub_if_data *sdata,
@@ -608,8 +596,8 @@ static void ieee80211_mesh_rx_mgmt_action(struct ieee80211_sub_if_data *sdata,
         }
 }
 
-static void ieee80211_mesh_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
-                                          struct sk_buff *skb)
+void ieee80211_mesh_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
+                                   struct sk_buff *skb)
 {
         struct ieee80211_rx_status *rx_status;
         struct ieee80211_if_mesh *ifmsh;
@@ -632,26 +620,11 @@ static void ieee80211_mesh_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
                 ieee80211_mesh_rx_mgmt_action(sdata, mgmt, skb->len, rx_status);
                 break;
         }
-
-        kfree_skb(skb);
 }
 
-static void ieee80211_mesh_work(struct work_struct *work)
+void ieee80211_mesh_work(struct ieee80211_sub_if_data *sdata)
 {
-        struct ieee80211_sub_if_data *sdata =
-                container_of(work, struct ieee80211_sub_if_data, u.mesh.work);
-        struct ieee80211_local *local = sdata->local;
         struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
-        struct sk_buff *skb;
-
-        if (!ieee80211_sdata_running(sdata))
-                return;
-
-        if (local->scanning)
-                return;
-
-        while ((skb = skb_dequeue(&ifmsh->skb_queue)))
-                ieee80211_mesh_rx_queued_mgmt(sdata, skb);
 
         if (ifmsh->preq_queue_len &&
             time_after(jiffies,
@@ -678,7 +651,7 @@ void ieee80211_mesh_notify_scan_completed(struct ieee80211_local *local)
         rcu_read_lock();
         list_for_each_entry_rcu(sdata, &local->interfaces, list)
                 if (ieee80211_vif_is_mesh(&sdata->vif))
-                        ieee80211_queue_work(&local->hw, &sdata->u.mesh.work);
+                        ieee80211_queue_work(&local->hw, &sdata->work);
         rcu_read_unlock();
 }
 
@@ -686,11 +659,9 @@ void ieee80211_mesh_init_sdata(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
 
-        INIT_WORK(&ifmsh->work, ieee80211_mesh_work);
         setup_timer(&ifmsh->housekeeping_timer,
                     ieee80211_mesh_housekeeping_timer,
                     (unsigned long) sdata);
-        skb_queue_head_init(&sdata->u.mesh.skb_queue);
 
         ifmsh->mshcfg.dot11MeshRetryTimeout = MESH_RET_T;
         ifmsh->mshcfg.dot11MeshConfirmTimeout = MESH_CONF_T;
@@ -731,29 +702,3 @@ void ieee80211_mesh_init_sdata(struct ieee80211_sub_if_data *sdata)
         INIT_LIST_HEAD(&ifmsh->preq_queue.list);
         spin_lock_init(&ifmsh->mesh_preq_queue_lock);
 }
-
-ieee80211_rx_result
-ieee80211_mesh_rx_mgmt(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb)
-{
-        struct ieee80211_local *local = sdata->local;
-        struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
-        struct ieee80211_mgmt *mgmt;
-        u16 fc;
-
-        if (skb->len < 24)
-                return RX_DROP_MONITOR;
-
-        mgmt = (struct ieee80211_mgmt *) skb->data;
-        fc = le16_to_cpu(mgmt->frame_control);
-
-        switch (fc & IEEE80211_FCTL_STYPE) {
-        case IEEE80211_STYPE_ACTION:
-        case IEEE80211_STYPE_PROBE_RESP:
-        case IEEE80211_STYPE_BEACON:
-                skb_queue_tail(&ifmsh->skb_queue, skb);
-                ieee80211_queue_work(&local->hw, &ifmsh->work);
-                return RX_QUEUED;
-        }
-
-        return RX_CONTINUE;
-}
diff --git a/net/mac80211/mesh.h b/net/mac80211/mesh.h
index c88087f1cd0f..ebd3f1d9d889 100644
--- a/net/mac80211/mesh.h
+++ b/net/mac80211/mesh.h
@@ -237,8 +237,6 @@ void ieee80211s_update_metric(struct ieee80211_local *local,
                 struct sta_info *stainfo, struct sk_buff *skb);
 void ieee80211s_stop(void);
 void ieee80211_mesh_init_sdata(struct ieee80211_sub_if_data *sdata);
-ieee80211_rx_result
-ieee80211_mesh_rx_mgmt(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb);
 void ieee80211_start_mesh(struct ieee80211_sub_if_data *sdata);
 void ieee80211_stop_mesh(struct ieee80211_sub_if_data *sdata);
 void ieee80211_mesh_root_setup(struct ieee80211_if_mesh *ifmsh);
diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
index 0705018d8d1e..829e08a657d0 100644
--- a/net/mac80211/mesh_hwmp.c
+++ b/net/mac80211/mesh_hwmp.c
@@ -805,14 +805,14 @@ static void mesh_queue_preq(struct mesh_path *mpath, u8 flags)
         spin_unlock(&ifmsh->mesh_preq_queue_lock);
 
         if (time_after(jiffies, ifmsh->last_preq + min_preq_int_jiff(sdata)))
-                ieee80211_queue_work(&sdata->local->hw, &ifmsh->work);
+                ieee80211_queue_work(&sdata->local->hw, &sdata->work);
 
         else if (time_before(jiffies, ifmsh->last_preq)) {
                 /* avoid long wait if did not send preqs for a long time
                  * and jiffies wrapped around
                  */
                 ifmsh->last_preq = jiffies - min_preq_int_jiff(sdata) - 1;
-                ieee80211_queue_work(&sdata->local->hw, &ifmsh->work);
+                ieee80211_queue_work(&sdata->local->hw, &sdata->work);
         } else
                 mod_timer(&ifmsh->mesh_path_timer, ifmsh->last_preq +
                                                 min_preq_int_jiff(sdata));
diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c
index 181ffd6efd81..349e466cf08b 100644
--- a/net/mac80211/mesh_pathtbl.c
+++ b/net/mac80211/mesh_pathtbl.c
@@ -315,7 +315,7 @@ int mesh_path_add(u8 *dst, struct ieee80211_sub_if_data *sdata)
         read_unlock(&pathtbl_resize_lock);
         if (grow) {
                 set_bit(MESH_WORK_GROW_MPATH_TABLE,  &ifmsh->wrkq_flags);
-                ieee80211_queue_work(&local->hw, &ifmsh->work);
+                ieee80211_queue_work(&local->hw, &sdata->work);
         }
         return 0;
 
@@ -425,7 +425,7 @@ int mpp_path_add(u8 *dst, u8 *mpp, struct ieee80211_sub_if_data *sdata)
         read_unlock(&pathtbl_resize_lock);
         if (grow) {
                 set_bit(MESH_WORK_GROW_MPP_TABLE,  &ifmsh->wrkq_flags);
-                ieee80211_queue_work(&local->hw, &ifmsh->work);
+                ieee80211_queue_work(&local->hw, &sdata->work);
         }
         return 0;
 
diff --git a/net/mac80211/mesh_plink.c b/net/mac80211/mesh_plink.c
index 3cd5f7b5d693..ea13a80a476c 100644
--- a/net/mac80211/mesh_plink.c
+++ b/net/mac80211/mesh_plink.c
@@ -65,7 +65,6 @@ void mesh_plink_inc_estab_count(struct ieee80211_sub_if_data *sdata)
 {
         atomic_inc(&sdata->u.mesh.mshstats.estab_plinks);
         mesh_accept_plinks_update(sdata);
-        ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON);
 }
 
 static inline
@@ -73,7 +72,6 @@ void mesh_plink_dec_estab_count(struct ieee80211_sub_if_data *sdata)
 {
         atomic_dec(&sdata->u.mesh.mshstats.estab_plinks);
         mesh_accept_plinks_update(sdata);
-        ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON);
 }
 
 /**
@@ -115,7 +113,7 @@ static struct sta_info *mesh_plink_alloc(struct ieee80211_sub_if_data *sdata,
 }
 
 /**
- * mesh_plink_deactivate - deactivate mesh peer link
+ * __mesh_plink_deactivate - deactivate mesh peer link
  *
  * @sta: mesh peer link to deactivate
  *
@@ -123,18 +121,23 @@ static struct sta_info *mesh_plink_alloc(struct ieee80211_sub_if_data *sdata,
  *
  * Locking: the caller must hold sta->lock
  */
-static void __mesh_plink_deactivate(struct sta_info *sta)
+static bool __mesh_plink_deactivate(struct sta_info *sta)
 {
         struct ieee80211_sub_if_data *sdata = sta->sdata;
+        bool deactivated = false;
 
-        if (sta->plink_state == PLINK_ESTAB)
+        if (sta->plink_state == PLINK_ESTAB) {
                 mesh_plink_dec_estab_count(sdata);
+                deactivated = true;
+        }
         sta->plink_state = PLINK_BLOCKED;
         mesh_path_flush_by_nexthop(sta);
+
+        return deactivated;
 }
 
 /**
- * __mesh_plink_deactivate - deactivate mesh peer link
+ * mesh_plink_deactivate - deactivate mesh peer link
  *
  * @sta: mesh peer link to deactivate
  *
@@ -142,9 +145,15 @@ static void __mesh_plink_deactivate(struct sta_info *sta)
  */
 void mesh_plink_deactivate(struct sta_info *sta)
 {
+        struct ieee80211_sub_if_data *sdata = sta->sdata;
+        bool deactivated;
+
         spin_lock_bh(&sta->lock);
-        __mesh_plink_deactivate(sta);
+        deactivated = __mesh_plink_deactivate(sta);
         spin_unlock_bh(&sta->lock);
+
+        if (deactivated)
+                ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON);
 }
 
 static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata,
@@ -381,10 +390,16 @@ int mesh_plink_open(struct sta_info *sta)
 
 void mesh_plink_block(struct sta_info *sta)
 {
+        struct ieee80211_sub_if_data *sdata = sta->sdata;
+        bool deactivated;
+
         spin_lock_bh(&sta->lock);
-        __mesh_plink_deactivate(sta);
+        deactivated = __mesh_plink_deactivate(sta);
         sta->plink_state = PLINK_BLOCKED;
         spin_unlock_bh(&sta->lock);
+
+        if (deactivated)
+                ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON);
 }
 
 
@@ -397,6 +412,7 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
         enum plink_event event;
         enum plink_frame_type ftype;
         size_t baselen;
+        bool deactivated;
         u8 ie_len;
         u8 *baseaddr;
         __le16 plid, llid, reason;
@@ -651,8 +667,9 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                 case CNF_ACPT:
                         del_timer(&sta->plink_timer);
                         sta->plink_state = PLINK_ESTAB;
-                        mesh_plink_inc_estab_count(sdata);
                         spin_unlock_bh(&sta->lock);
+                        mesh_plink_inc_estab_count(sdata);
+                        ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON);
                         mpl_dbg("Mesh plink with %pM ESTABLISHED\n",
                                 sta->sta.addr);
                         break;
@@ -684,8 +701,9 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                 case OPN_ACPT:
                         del_timer(&sta->plink_timer);
                         sta->plink_state = PLINK_ESTAB;
-                        mesh_plink_inc_estab_count(sdata);
                         spin_unlock_bh(&sta->lock);
+                        mesh_plink_inc_estab_count(sdata);
+                        ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON);
                         mpl_dbg("Mesh plink with %pM ESTABLISHED\n",
                                 sta->sta.addr);
                         mesh_plink_frame_tx(sdata, PLINK_CONFIRM, sta->sta.addr, llid,
@@ -702,11 +720,13 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                 case CLS_ACPT:
                         reason = cpu_to_le16(MESH_CLOSE_RCVD);
                         sta->reason = reason;
-                        __mesh_plink_deactivate(sta);
+                        deactivated = __mesh_plink_deactivate(sta);
                         sta->plink_state = PLINK_HOLDING;
                         llid = sta->llid;
                         mod_plink_timer(sta, dot11MeshHoldingTimeout(sdata));
                         spin_unlock_bh(&sta->lock);
+                        if (deactivated)
+                                ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON);
                         mesh_plink_frame_tx(sdata, PLINK_CLOSE, sta->sta.addr, llid,
                                             plid, reason);
                         break;
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index f803f8b72a93..b6c163ac22da 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -478,6 +478,39 @@ static void ieee80211_handle_pwr_constr(struct ieee80211_sub_if_data *sdata,
         }
 }
 
+void ieee80211_enable_dyn_ps(struct ieee80211_vif *vif)
+{
+        struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_conf *conf = &local->hw.conf;
+
+        WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION ||
+                !(local->hw.flags & IEEE80211_HW_SUPPORTS_PS) ||
+                (local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_PS));
+
+        local->disable_dynamic_ps = false;
+        conf->dynamic_ps_timeout = local->dynamic_ps_user_timeout;
+}
+EXPORT_SYMBOL(ieee80211_enable_dyn_ps);
+
+void ieee80211_disable_dyn_ps(struct ieee80211_vif *vif)
+{
+        struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_conf *conf = &local->hw.conf;
+
+        WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION ||
+                !(local->hw.flags & IEEE80211_HW_SUPPORTS_PS) ||
+                (local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_PS));
+
+        local->disable_dynamic_ps = true;
+        conf->dynamic_ps_timeout = 0;
+        del_timer_sync(&local->dynamic_ps_timer);
+        ieee80211_queue_work(&local->hw,
+                             &local->dynamic_ps_enable_work);
+}
+EXPORT_SYMBOL(ieee80211_disable_dyn_ps);
+
 /* powersave */
 static void ieee80211_enable_ps(struct ieee80211_local *local,
                                 struct ieee80211_sub_if_data *sdata)
@@ -553,6 +586,7 @@ void ieee80211_recalc_ps(struct ieee80211_local *local, s32 latency)
             found->u.mgd.associated->beacon_ies &&
             !(found->u.mgd.flags & (IEEE80211_STA_BEACON_POLL |
                                     IEEE80211_STA_CONNECTION_POLL))) {
+                struct ieee80211_conf *conf = &local->hw.conf;
                 s32 beaconint_us;
 
                 if (latency < 0)
@@ -561,25 +595,24 @@ void ieee80211_recalc_ps(struct ieee80211_local *local, s32 latency)
                 beaconint_us = ieee80211_tu_to_usec(
                                         found->vif.bss_conf.beacon_int);
 
-                timeout = local->hw.conf.dynamic_ps_forced_timeout;
+                timeout = local->dynamic_ps_forced_timeout;
                 if (timeout < 0) {
                         /*
+                         * Go to full PSM if the user configures a very low
+                         * latency requirement.
                          * The 2 second value is there for compatibility until
                          * the PM_QOS_NETWORK_LATENCY is configured with real
                          * values.
                          */
-                        if (latency == 2000000000)
-                                timeout = 100;
-                        else if (latency <= 50000)
-                                timeout = 300;
-                        else if (latency <= 100000)
-                                timeout = 100;
-                        else if (latency <= 500000)
-                                timeout = 50;
-                        else
+                        if (latency > 1900000000 && latency != 2000000000)
                                 timeout = 0;
+                        else
+                                timeout = 100;
                 }
-                local->hw.conf.dynamic_ps_timeout = timeout;
+                local->dynamic_ps_user_timeout = timeout;
+                if (!local->disable_dynamic_ps)
+                        conf->dynamic_ps_timeout =
+                                local->dynamic_ps_user_timeout;
 
                 if (beaconint_us > latency) {
                         local->ps_sdata = NULL;
@@ -665,10 +698,11 @@ void ieee80211_dynamic_ps_timer(unsigned long data)
 
 /* MLME */
 static void ieee80211_sta_wmm_params(struct ieee80211_local *local,
-                                     struct ieee80211_if_managed *ifmgd,
+                                     struct ieee80211_sub_if_data *sdata,
                                      u8 *wmm_param, size_t wmm_param_len)
 {
         struct ieee80211_tx_queue_params params;
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         size_t left;
         int count;
         u8 *pos, uapsd_queues = 0;
@@ -757,8 +791,8 @@ static void ieee80211_sta_wmm_params(struct ieee80211_local *local,
         }
 
         /* enable WMM or activate new settings */
-        local->hw.conf.flags |= IEEE80211_CONF_QOS;
-        drv_config(local, IEEE80211_CONF_CHANGE_QOS);
+        sdata->vif.bss_conf.qos = true;
+        ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_QOS);
 }
 
 static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,
@@ -806,11 +840,12 @@ static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
 {
         struct ieee80211_bss *bss = (void *)cbss->priv;
         struct ieee80211_local *local = sdata->local;
+        struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
 
         bss_info_changed |= BSS_CHANGED_ASSOC;
         /* set timing information */
-        sdata->vif.bss_conf.beacon_int = cbss->beacon_interval;
-        sdata->vif.bss_conf.timestamp = cbss->tsf;
+        bss_conf->beacon_int = cbss->beacon_interval;
+        bss_conf->timestamp = cbss->tsf;
 
         bss_info_changed |= BSS_CHANGED_BEACON_INT;
         bss_info_changed |= ieee80211_handle_bss_capability(sdata,
@@ -835,7 +870,12 @@ static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
 
         ieee80211_led_assoc(local, 1);
 
-        sdata->vif.bss_conf.assoc = 1;
+        if (local->hw.flags & IEEE80211_HW_NEED_DTIM_PERIOD)
+                bss_conf->dtim_period = bss->dtim_period;
+        else
+                bss_conf->dtim_period = 0;
+
+        bss_conf->assoc = 1;
         /*
          * For now just always ask the driver to update the basic rateset
          * when we have associated, we aren't checking whether it actually
@@ -848,9 +888,15 @@ static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
 
         /* Tell the driver to monitor connection quality (if supported) */
         if ((local->hw.flags & IEEE80211_HW_SUPPORTS_CQM_RSSI) &&
-            sdata->vif.bss_conf.cqm_rssi_thold)
+            bss_conf->cqm_rssi_thold)
                 bss_info_changed |= BSS_CHANGED_CQM;
 
+        /* Enable ARP filtering */
+        if (bss_conf->arp_filter_enabled != sdata->arp_filter_state) {
+                bss_conf->arp_filter_enabled = sdata->arp_filter_state;
+                bss_info_changed |= BSS_CHANGED_ARP_FILTER;
+        }
+
         ieee80211_bss_info_change_notify(sdata, bss_info_changed);
 
         mutex_lock(&local->iflist_mtx);
@@ -898,13 +944,13 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
         netif_tx_stop_all_queues(sdata->dev);
         netif_carrier_off(sdata->dev);
 
-        rcu_read_lock();
+        mutex_lock(&local->sta_mtx);
         sta = sta_info_get(sdata, bssid);
         if (sta) {
-                set_sta_flags(sta, WLAN_STA_DISASSOC);
+                set_sta_flags(sta, WLAN_STA_BLOCK_BA);
                 ieee80211_sta_tear_down_BA_sessions(sta);
         }
-        rcu_read_unlock();
+        mutex_unlock(&local->sta_mtx);
 
         changed |= ieee80211_reset_erp_info(sdata);
 
@@ -932,6 +978,12 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
 
         ieee80211_hw_config(local, config_changed);
 
+        /* Disable ARP filtering */
+        if (sdata->vif.bss_conf.arp_filter_enabled) {
+                sdata->vif.bss_conf.arp_filter_enabled = false;
+                changed |= BSS_CHANGED_ARP_FILTER;
+        }
+
         /* The BSSID (not really interesting) and HT changed */
         changed |= BSS_CHANGED_BSSID | BSS_CHANGED_HT;
         ieee80211_bss_info_change_notify(sdata, changed);
@@ -1279,7 +1331,7 @@ static bool ieee80211_assoc_success(struct ieee80211_work *wk,
         }
 
         if (elems.wmm_param)
-                ieee80211_sta_wmm_params(local, ifmgd, elems.wmm_param,
+                ieee80211_sta_wmm_params(local, sdata, elems.wmm_param,
                                          elems.wmm_param_len);
         else
                 ieee80211_set_wmm_default(sdata);
@@ -1551,7 +1603,7 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
                 ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems,
                                       true);
 
-                ieee80211_sta_wmm_params(local, ifmgd, elems.wmm_param,
+                ieee80211_sta_wmm_params(local, sdata, elems.wmm_param,
                                          elems.wmm_param_len);
         }
 
@@ -1633,35 +1685,8 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
         ieee80211_bss_info_change_notify(sdata, changed);
 }
 
-ieee80211_rx_result ieee80211_sta_rx_mgmt(struct ieee80211_sub_if_data *sdata,
-                                          struct sk_buff *skb)
-{
-        struct ieee80211_local *local = sdata->local;
-        struct ieee80211_mgmt *mgmt;
-        u16 fc;
-
-        if (skb->len < 24)
-                return RX_DROP_MONITOR;
-
-        mgmt = (struct ieee80211_mgmt *) skb->data;
-        fc = le16_to_cpu(mgmt->frame_control);
-
-        switch (fc & IEEE80211_FCTL_STYPE) {
-        case IEEE80211_STYPE_PROBE_RESP:
-        case IEEE80211_STYPE_BEACON:
-        case IEEE80211_STYPE_DEAUTH:
-        case IEEE80211_STYPE_DISASSOC:
-        case IEEE80211_STYPE_ACTION:
-                skb_queue_tail(&sdata->u.mgd.skb_queue, skb);
-                ieee80211_queue_work(&local->hw, &sdata->u.mgd.work);
-                return RX_QUEUED;
-        }
-
-        return RX_DROP_MONITOR;
-}
-
-static void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
-                                         struct sk_buff *skb)
+void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
+                                  struct sk_buff *skb)
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_rx_status *rx_status;
@@ -1693,44 +1718,6 @@ static void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
                         break;
                 case IEEE80211_STYPE_ACTION:
                         switch (mgmt->u.action.category) {
-                        case WLAN_CATEGORY_BACK: {
-                                struct ieee80211_local *local = sdata->local;
-                                int len = skb->len;
-                                struct sta_info *sta;
-
-                                rcu_read_lock();
-                                sta = sta_info_get(sdata, mgmt->sa);
-                                if (!sta) {
-                                        rcu_read_unlock();
-                                        break;
-                                }
-
-                                local_bh_disable();
-
-                                switch (mgmt->u.action.u.addba_req.action_code) {
-                                case WLAN_ACTION_ADDBA_REQ:
-                                        if (len < (IEEE80211_MIN_ACTION_SIZE +
-                                                   sizeof(mgmt->u.action.u.addba_req)))
-                                                break;
-                                        ieee80211_process_addba_request(local, sta, mgmt, len);
-                                        break;
-                                case WLAN_ACTION_ADDBA_RESP:
-                                        if (len < (IEEE80211_MIN_ACTION_SIZE +
-                                                   sizeof(mgmt->u.action.u.addba_resp)))
-                                                break;
-                                        ieee80211_process_addba_resp(local, sta, mgmt, len);
-                                        break;
-                                case WLAN_ACTION_DELBA:
-                                        if (len < (IEEE80211_MIN_ACTION_SIZE +
-                                                   sizeof(mgmt->u.action.u.delba)))
-                                                break;
-                                        ieee80211_process_delba(sdata, sta, mgmt, len);
-                                        break;
-                                }
-                                local_bh_enable();
-                                rcu_read_unlock();
-                                break;
-                                }
                         case WLAN_CATEGORY_SPECTRUM_MGMT:
                                 ieee80211_sta_process_chanswitch(sdata,
                                                 &mgmt->u.action.u.chan_switch.sw_elem,
@@ -1754,7 +1741,7 @@ static void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
                 default:
                         WARN(1, "unexpected: %d", rma);
                 }
-                goto out;
+                return;
         }
 
         mutex_unlock(&ifmgd->mtx);
@@ -1769,7 +1756,8 @@ static void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
                         if (wk->sdata != sdata)
                                 continue;
 
-                        if (wk->type != IEEE80211_WORK_ASSOC)
+                        if (wk->type != IEEE80211_WORK_ASSOC &&
+                            wk->type != IEEE80211_WORK_ASSOC_BEACON_WAIT)
                                 continue;
 
                         if (memcmp(mgmt->bssid, wk->filter_ta, ETH_ALEN))
@@ -1799,8 +1787,6 @@ static void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
 
                 cfg80211_send_deauth(sdata->dev, (u8 *)mgmt, skb->len);
         }
- out:
-        kfree_skb(skb);
 }
 
 static void ieee80211_sta_timer(unsigned long data)
@@ -1815,39 +1801,13 @@ static void ieee80211_sta_timer(unsigned long data)
                 return;
         }
 
-        ieee80211_queue_work(&local->hw, &ifmgd->work);
+        ieee80211_queue_work(&local->hw, &sdata->work);
 }
 
-static void ieee80211_sta_work(struct work_struct *work)
+void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
 {
-        struct ieee80211_sub_if_data *sdata =
-                container_of(work, struct ieee80211_sub_if_data, u.mgd.work);
         struct ieee80211_local *local = sdata->local;
-        struct ieee80211_if_managed *ifmgd;
-        struct sk_buff *skb;
-
-        if (!ieee80211_sdata_running(sdata))
-                return;
-
-        if (local->scanning)
-                return;
-
-        if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
-                return;
-
-        /*
-         * ieee80211_queue_work() should have picked up most cases,
-         * here we'll pick the the rest.
-         */
-        if (WARN(local->suspended, "STA MLME work scheduled while "
-                 "going to suspend\n"))
-                return;
-
-        ifmgd = &sdata->u.mgd;
-
-        /* first process frames to avoid timing out while a frame is pending */
-        while ((skb = skb_dequeue(&ifmgd->skb_queue)))
-                ieee80211_sta_rx_queued_mgmt(sdata, skb);
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 
         /* then process the rest of the work */
         mutex_lock(&ifmgd->mtx);
@@ -1942,8 +1902,7 @@ static void ieee80211_restart_sta_timer(struct ieee80211_sub_if_data *sdata)
                 ieee80211_queue_work(&sdata->local->hw,
                            &sdata->u.mgd.monitor_work);
                 /* and do all the other regular work too */
-                ieee80211_queue_work(&sdata->local->hw,
-                           &sdata->u.mgd.work);
+                ieee80211_queue_work(&sdata->local->hw, &sdata->work);
         }
 }
 
@@ -1958,7 +1917,6 @@ void ieee80211_sta_quiesce(struct ieee80211_sub_if_data *sdata)
          * time -- the code here is properly synchronised.
          */
 
-        cancel_work_sync(&ifmgd->work);
         cancel_work_sync(&ifmgd->beacon_connection_loss_work);
         if (del_timer_sync(&ifmgd->timer))
                 set_bit(TMR_RUNNING_TIMER, &ifmgd->timers_running);
@@ -1990,7 +1948,6 @@ void ieee80211_sta_setup_sdata(struct ieee80211_sub_if_data *sdata)
         struct ieee80211_if_managed *ifmgd;
 
         ifmgd = &sdata->u.mgd;
-        INIT_WORK(&ifmgd->work, ieee80211_sta_work);
         INIT_WORK(&ifmgd->monitor_work, ieee80211_sta_monitor_work);
         INIT_WORK(&ifmgd->chswitch_work, ieee80211_chswitch_work);
         INIT_WORK(&ifmgd->beacon_connection_loss_work,
@@ -2003,7 +1960,6 @@ void ieee80211_sta_setup_sdata(struct ieee80211_sub_if_data *sdata)
                     (unsigned long) sdata);
         setup_timer(&ifmgd->chswitch_timer, ieee80211_chswitch_timer,
                     (unsigned long) sdata);
-        skb_queue_head_init(&ifmgd->skb_queue);
 
         ifmgd->flags = 0;
 
@@ -2081,6 +2037,8 @@ int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata,
                 auth_alg = WLAN_AUTH_OPEN;
                 break;
         case NL80211_AUTHTYPE_SHARED_KEY:
+                if (IS_ERR(sdata->local->wep_tx_tfm))
+                        return -EOPNOTSUPP;
                 auth_alg = WLAN_AUTH_SHARED_KEY;
                 break;
         case NL80211_AUTHTYPE_FT:
@@ -2134,6 +2092,8 @@ static enum work_done_result ieee80211_assoc_done(struct ieee80211_work *wk,
                                                   struct sk_buff *skb)
 {
         struct ieee80211_mgmt *mgmt;
+        struct ieee80211_rx_status *rx_status;
+        struct ieee802_11_elems elems;
         u16 status;
 
         if (!skb) {
@@ -2141,6 +2101,19 @@ static enum work_done_result ieee80211_assoc_done(struct ieee80211_work *wk,
                 return WORK_DONE_DESTROY;
         }
 
+        if (wk->type == IEEE80211_WORK_ASSOC_BEACON_WAIT) {
+                mutex_lock(&wk->sdata->u.mgd.mtx);
+                rx_status = (void *) skb->cb;
+                ieee802_11_parse_elems(skb->data + 24 + 12, skb->len - 24 - 12, &elems);
+                ieee80211_rx_bss_info(wk->sdata, (void *)skb->data, skb->len, rx_status,
+                                      &elems, true);
+                mutex_unlock(&wk->sdata->u.mgd.mtx);
+
+                wk->type = IEEE80211_WORK_ASSOC;
+                /* not really done yet */
+                return WORK_DONE_REQUEUE;
+        }
+
         mgmt = (void *)skb->data;
         status = le16_to_cpu(mgmt->u.assoc_resp.status_code);
 
@@ -2153,6 +2126,7 @@ static enum work_done_result ieee80211_assoc_done(struct ieee80211_work *wk,
                                                     wk->filter_ta);
                         return WORK_DONE_DESTROY;
                 }
+
                 mutex_unlock(&wk->sdata->u.mgd.mtx);
         }
 
@@ -2253,10 +2227,14 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
         if (req->prev_bssid)
                 memcpy(wk->assoc.prev_bssid, req->prev_bssid, ETH_ALEN);
 
-        wk->type = IEEE80211_WORK_ASSOC;
         wk->chan = req->bss->channel;
         wk->sdata = sdata;
         wk->done = ieee80211_assoc_done;
+        if (!bss->dtim_period &&
+            sdata->local->hw.flags & IEEE80211_HW_NEED_DTIM_PERIOD)
+                wk->type = IEEE80211_WORK_ASSOC_BEACON_WAIT;
+        else
+                wk->type = IEEE80211_WORK_ASSOC;
 
         if (req->use_mfp) {
                 ifmgd->mfp = IEEE80211_MFP_REQUIRED;
@@ -2282,14 +2260,16 @@ int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_work *wk;
-        const u8 *bssid = req->bss->bssid;
+        u8 bssid[ETH_ALEN];
+        bool assoc_bss = false;
 
         mutex_lock(&ifmgd->mtx);
 
+        memcpy(bssid, req->bss->bssid, ETH_ALEN);
         if (ifmgd->associated == req->bss) {
-                bssid = req->bss->bssid;
-                ieee80211_set_disassoc(sdata, true);
+                ieee80211_set_disassoc(sdata, false);
                 mutex_unlock(&ifmgd->mtx);
+                assoc_bss = true;
         } else {
                 bool not_auth_yet = false;
 
@@ -2302,7 +2282,8 @@ int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
 
                         if (wk->type != IEEE80211_WORK_DIRECT_PROBE &&
                             wk->type != IEEE80211_WORK_AUTH &&
-                            wk->type != IEEE80211_WORK_ASSOC)
+                            wk->type != IEEE80211_WORK_ASSOC &&
+                            wk->type != IEEE80211_WORK_ASSOC_BEACON_WAIT)
                                 continue;
 
                         if (memcmp(req->bss->bssid, wk->filter_ta, ETH_ALEN))
@@ -2335,6 +2316,8 @@ int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
         ieee80211_send_deauth_disassoc(sdata, bssid, IEEE80211_STYPE_DEAUTH,
                                        req->reason_code, cookie,
                                        !req->local_state_change);
+        if (assoc_bss)
+                sta_info_destroy_addr(sdata, bssid);
 
         ieee80211_recalc_idle(sdata->local);
 
@@ -2379,41 +2362,6 @@ int ieee80211_mgd_disassoc(struct ieee80211_sub_if_data *sdata,
         return 0;
 }
 
-int ieee80211_mgd_action(struct ieee80211_sub_if_data *sdata,
-                         struct ieee80211_channel *chan,
-                         enum nl80211_channel_type channel_type,
-                         const u8 *buf, size_t len, u64 *cookie)
-{
-        struct ieee80211_local *local = sdata->local;
-        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
-        struct sk_buff *skb;
-
-        /* Check that we are on the requested channel for transmission */
-        if ((chan != local->tmp_channel ||
-             channel_type != local->tmp_channel_type) &&
-            (chan != local->oper_channel ||
-             channel_type != local->_oper_channel_type))
-                return -EBUSY;
-
-        skb = dev_alloc_skb(local->hw.extra_tx_headroom + len);
-        if (!skb)
-                return -ENOMEM;
-        skb_reserve(skb, local->hw.extra_tx_headroom);
-
-        memcpy(skb_put(skb, len), buf, len);
-
-        if (!(ifmgd->flags & IEEE80211_STA_MFP_ENABLED))
-                IEEE80211_SKB_CB(skb)->flags |=
-                        IEEE80211_TX_INTFL_DONT_ENCRYPT;
-        IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_NL80211_FRAME_TX |
-                IEEE80211_TX_CTL_REQ_TX_STATUS;
-        skb->dev = sdata->dev;
-        ieee80211_tx_skb(sdata, skb);
-
-        *cookie = (unsigned long) skb;
-        return 0;
-}
-
 void ieee80211_cqm_rssi_notify(struct ieee80211_vif *vif,
                                enum nl80211_cqm_rssi_threshold_event rssi_event,
                                gfp_t gfp)
diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c
index 75202b295a4e..d287fde0431d 100644
--- a/net/mac80211/pm.c
+++ b/net/mac80211/pm.c
@@ -40,22 +40,14 @@ int __ieee80211_suspend(struct ieee80211_hw *hw)
         list_for_each_entry(sdata, &local->interfaces, list)
                 ieee80211_disable_keys(sdata);
 
-        /* Tear down aggregation sessions */
-
-        rcu_read_lock();
-
-        if (hw->flags & IEEE80211_HW_AMPDU_AGGREGATION) {
-                list_for_each_entry_rcu(sta, &local->sta_list, list) {
+        /* tear down aggregation sessions and remove STAs */
+        mutex_lock(&local->sta_mtx);
+        list_for_each_entry(sta, &local->sta_list, list) {
+                if (hw->flags & IEEE80211_HW_AMPDU_AGGREGATION) {
                         set_sta_flags(sta, WLAN_STA_BLOCK_BA);
                         ieee80211_sta_tear_down_BA_sessions(sta);
                 }
-        }
 
-        rcu_read_unlock();
-
-        /* remove STAs */
-        mutex_lock(&local->sta_mtx);
-        list_for_each_entry(sta, &local->sta_list, list) {
                 if (sta->uploaded) {
                         sdata = sta->sdata;
                         if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
@@ -72,6 +64,8 @@ int __ieee80211_suspend(struct ieee80211_hw *hw)
 
         /* remove all interfaces */
         list_for_each_entry(sdata, &local->interfaces, list) {
+                cancel_work_sync(&sdata->work);
+
                 switch(sdata->vif.type) {
                 case NL80211_IFTYPE_STATION:
                         ieee80211_sta_quiesce(sdata);
diff --git a/net/mac80211/rate.c b/net/mac80211/rate.c
index 6d0bd198af19..be04d46110fe 100644
--- a/net/mac80211/rate.c
+++ b/net/mac80211/rate.c
@@ -103,6 +103,7 @@ ieee80211_rate_control_ops_get(const char *name)
         struct rate_control_ops *ops;
         const char *alg_name;
 
+        kparam_block_sysfs_write(ieee80211_default_rc_algo);
         if (!name)
                 alg_name = ieee80211_default_rc_algo;
         else
@@ -120,6 +121,7 @@ ieee80211_rate_control_ops_get(const char *name)
         /* try built-in one if specific alg requested but not found */
         if (!ops && strlen(CONFIG_MAC80211_RC_DEFAULT))
                 ops = ieee80211_try_rate_control_ops_get(CONFIG_MAC80211_RC_DEFAULT);
+        kparam_unblock_sysfs_write(ieee80211_default_rc_algo);
 
         return ops;
 }
diff --git a/net/mac80211/rate.h b/net/mac80211/rate.h
index 065a96190e32..168427b0ffdc 100644
--- a/net/mac80211/rate.h
+++ b/net/mac80211/rate.h
@@ -147,5 +147,18 @@ static inline void rc80211_minstrel_exit(void)
 }
 #endif
 
+#ifdef CONFIG_MAC80211_RC_MINSTREL_HT
+extern int rc80211_minstrel_ht_init(void);
+extern void rc80211_minstrel_ht_exit(void);
+#else
+static inline int rc80211_minstrel_ht_init(void)
+{
+        return 0;
+}
+static inline void rc80211_minstrel_ht_exit(void)
+{
+}
+#endif
+
 
 #endif /* IEEE80211_RATE_H */
diff --git a/net/mac80211/rc80211_minstrel.c b/net/mac80211/rc80211_minstrel.c
index f65ce6dcc8e2..778c604d7939 100644
--- a/net/mac80211/rc80211_minstrel.c
+++ b/net/mac80211/rc80211_minstrel.c
@@ -67,7 +67,6 @@ rix_to_ndx(struct minstrel_sta_info *mi, int rix)
         for (i = rix; i >= 0; i--)
                 if (mi->r[i].rix == rix)
                         break;
-        WARN_ON(i < 0);
         return i;
 }
 
diff --git a/net/mac80211/rc80211_minstrel_ht.c b/net/mac80211/rc80211_minstrel_ht.c
new file mode 100644
index 000000000000..c5b465904e3b
--- /dev/null
+++ b/net/mac80211/rc80211_minstrel_ht.c
@@ -0,0 +1,827 @@
+/*
+ * Copyright (C) 2010 Felix Fietkau <nbd@openwrt.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+#include <linux/netdevice.h>
+#include <linux/types.h>
+#include <linux/skbuff.h>
+#include <linux/debugfs.h>
+#include <linux/random.h>
+#include <linux/ieee80211.h>
+#include <net/mac80211.h>
+#include "rate.h"
+#include "rc80211_minstrel.h"
+#include "rc80211_minstrel_ht.h"
+
+#define AVG_PKT_SIZE    1200
+#define SAMPLE_COLUMNS  10
+#define EWMA_LEVEL              75
+
+/* Number of bits for an average sized packet */
+#define MCS_NBITS (AVG_PKT_SIZE << 3)
+
+/* Number of symbols for a packet with (bps) bits per symbol */
+#define MCS_NSYMS(bps) ((MCS_NBITS + (bps) - 1) / (bps))
+
+/* Transmission time for a packet containing (syms) symbols */
+#define MCS_SYMBOL_TIME(sgi, syms)                                      \
+        (sgi ?                                                          \
+          ((syms) * 18 + 4) / 5 :       /* syms * 3.6 us */             \
+          (syms) << 2                   /* syms * 4 us */               \
+        )
+
+/* Transmit duration for the raw data part of an average sized packet */
+#define MCS_DURATION(streams, sgi, bps) MCS_SYMBOL_TIME(sgi, MCS_NSYMS((streams) * (bps)))
+
+/* MCS rate information for an MCS group */
+#define MCS_GROUP(_streams, _sgi, _ht40) {                              \
+        .streams = _streams,                                            \
+        .flags =                                                        \
+                (_sgi ? IEEE80211_TX_RC_SHORT_GI : 0) |                 \
+                (_ht40 ? IEEE80211_TX_RC_40_MHZ_WIDTH : 0),             \
+        .duration = {                                                   \
+                MCS_DURATION(_streams, _sgi, _ht40 ? 54 : 26),          \
+                MCS_DURATION(_streams, _sgi, _ht40 ? 108 : 52),         \
+                MCS_DURATION(_streams, _sgi, _ht40 ? 162 : 78),         \
+                MCS_DURATION(_streams, _sgi, _ht40 ? 216 : 104),        \
+                MCS_DURATION(_streams, _sgi, _ht40 ? 324 : 156),        \
+                MCS_DURATION(_streams, _sgi, _ht40 ? 432 : 208),        \
+                MCS_DURATION(_streams, _sgi, _ht40 ? 486 : 234),        \
+                MCS_DURATION(_streams, _sgi, _ht40 ? 540 : 260)         \
+        }                                                               \
+}
+
+/*
+ * To enable sufficiently targeted rate sampling, MCS rates are divided into
+ * groups, based on the number of streams and flags (HT40, SGI) that they
+ * use.
+ */
+const struct mcs_group minstrel_mcs_groups[] = {
+        MCS_GROUP(1, 0, 0),
+        MCS_GROUP(2, 0, 0),
+#if MINSTREL_MAX_STREAMS >= 3
+        MCS_GROUP(3, 0, 0),
+#endif
+
+        MCS_GROUP(1, 1, 0),
+        MCS_GROUP(2, 1, 0),
+#if MINSTREL_MAX_STREAMS >= 3
+        MCS_GROUP(3, 1, 0),
+#endif
+
+        MCS_GROUP(1, 0, 1),
+        MCS_GROUP(2, 0, 1),
+#if MINSTREL_MAX_STREAMS >= 3
+        MCS_GROUP(3, 0, 1),
+#endif
+
+        MCS_GROUP(1, 1, 1),
+        MCS_GROUP(2, 1, 1),
+#if MINSTREL_MAX_STREAMS >= 3
+        MCS_GROUP(3, 1, 1),
+#endif
+};
+
+static u8 sample_table[SAMPLE_COLUMNS][MCS_GROUP_RATES];
+
+/*
+ * Perform EWMA (Exponentially Weighted Moving Average) calculation
+ */
+static int
+minstrel_ewma(int old, int new, int weight)
+{
+        return (new * (100 - weight) + old * weight) / 100;
+}
+
+/*
+ * Look up an MCS group index based on mac80211 rate information
+ */
+static int
+minstrel_ht_get_group_idx(struct ieee80211_tx_rate *rate)
+{
+        int streams = (rate->idx / MCS_GROUP_RATES) + 1;
+        u32 flags = IEEE80211_TX_RC_SHORT_GI | IEEE80211_TX_RC_40_MHZ_WIDTH;
+        int i;
+
+        for (i = 0; i < ARRAY_SIZE(minstrel_mcs_groups); i++) {
+                if (minstrel_mcs_groups[i].streams != streams)
+                        continue;
+                if (minstrel_mcs_groups[i].flags != (rate->flags & flags))
+                        continue;
+
+                return i;
+        }
+
+        WARN_ON(1);
+        return 0;
+}
+
+static inline struct minstrel_rate_stats *
+minstrel_get_ratestats(struct minstrel_ht_sta *mi, int index)
+{
+        return &mi->groups[index / MCS_GROUP_RATES].rates[index % MCS_GROUP_RATES];
+}
+
+
+/*
+ * Recalculate success probabilities and counters for a rate using EWMA
+ */
+static void
+minstrel_calc_rate_ewma(struct minstrel_priv *mp, struct minstrel_rate_stats *mr)
+{
+        if (unlikely(mr->attempts > 0)) {
+                mr->sample_skipped = 0;
+                mr->cur_prob = MINSTREL_FRAC(mr->success, mr->attempts);
+                if (!mr->att_hist)
+                        mr->probability = mr->cur_prob;
+                else
+                        mr->probability = minstrel_ewma(mr->probability,
+                                mr->cur_prob, EWMA_LEVEL);
+                mr->att_hist += mr->attempts;
+                mr->succ_hist += mr->success;
+        } else {
+                mr->sample_skipped++;
+        }
+        mr->last_success = mr->success;
+        mr->last_attempts = mr->attempts;
+        mr->success = 0;
+        mr->attempts = 0;
+}
+
+/*
+ * Calculate throughput based on the average A-MPDU length, taking into account
+ * the expected number of retransmissions and their expected length
+ */
+static void
+minstrel_ht_calc_tp(struct minstrel_priv *mp, struct minstrel_ht_sta *mi,
+                    int group, int rate)
+{
+        struct minstrel_rate_stats *mr;
+        unsigned int usecs;
+
+        mr = &mi->groups[group].rates[rate];
+
+        if (mr->probability < MINSTREL_FRAC(1, 10)) {
+                mr->cur_tp = 0;
+                return;
+        }
+
+        usecs = mi->overhead / MINSTREL_TRUNC(mi->avg_ampdu_len);
+        usecs += minstrel_mcs_groups[group].duration[rate];
+        mr->cur_tp = MINSTREL_TRUNC((1000000 / usecs) * mr->probability);
+}
+
+/*
+ * Update rate statistics and select new primary rates
+ *
+ * Rules for rate selection:
+ *  - max_prob_rate must use only one stream, as a tradeoff between delivery
+ *    probability and throughput during strong fluctuations
+ *  - as long as the max prob rate has a probability of more than 3/4, pick
+ *    higher throughput rates, even if the probablity is a bit lower
+ */
+static void
+minstrel_ht_update_stats(struct minstrel_priv *mp, struct minstrel_ht_sta *mi)
+{
+        struct minstrel_mcs_group_data *mg;
+        struct minstrel_rate_stats *mr;
+        int cur_prob, cur_prob_tp, cur_tp, cur_tp2;
+        int group, i, index;
+
+        if (mi->ampdu_packets > 0) {
+                mi->avg_ampdu_len = minstrel_ewma(mi->avg_ampdu_len,
+                        MINSTREL_FRAC(mi->ampdu_len, mi->ampdu_packets), EWMA_LEVEL);
+                mi->ampdu_len = 0;
+                mi->ampdu_packets = 0;
+        }
+
+        mi->sample_slow = 0;
+        mi->sample_count = 0;
+        mi->max_tp_rate = 0;
+        mi->max_tp_rate2 = 0;
+        mi->max_prob_rate = 0;
+
+        for (group = 0; group < ARRAY_SIZE(minstrel_mcs_groups); group++) {
+                cur_prob = 0;
+                cur_prob_tp = 0;
+                cur_tp = 0;
+                cur_tp2 = 0;
+
+                mg = &mi->groups[group];
+                if (!mg->supported)
+                        continue;
+
+                mg->max_tp_rate = 0;
+                mg->max_tp_rate2 = 0;
+                mg->max_prob_rate = 0;
+                mi->sample_count++;
+
+                for (i = 0; i < MCS_GROUP_RATES; i++) {
+                        if (!(mg->supported & BIT(i)))
+                                continue;
+
+                        mr = &mg->rates[i];
+                        mr->retry_updated = false;
+                        index = MCS_GROUP_RATES * group + i;
+                        minstrel_calc_rate_ewma(mp, mr);
+                        minstrel_ht_calc_tp(mp, mi, group, i);
+
+                        if (!mr->cur_tp)
+                                continue;
+
+                        /* ignore the lowest rate of each single-stream group */
+                        if (!i && minstrel_mcs_groups[group].streams == 1)
+                                continue;
+
+                        if ((mr->cur_tp > cur_prob_tp && mr->probability >
+                             MINSTREL_FRAC(3, 4)) || mr->probability > cur_prob) {
+                                mg->max_prob_rate = index;
+                                cur_prob = mr->probability;
+                                cur_prob_tp = mr->cur_tp;
+                        }
+
+                        if (mr->cur_tp > cur_tp) {
+                                swap(index, mg->max_tp_rate);
+                                cur_tp = mr->cur_tp;
+                                mr = minstrel_get_ratestats(mi, index);
+                        }
+
+                        if (index >= mg->max_tp_rate)
+                                continue;
+
+                        if (mr->cur_tp > cur_tp2) {
+                                mg->max_tp_rate2 = index;
+                                cur_tp2 = mr->cur_tp;
+                        }
+                }
+        }
+
+        /* try to sample up to half of the availble rates during each interval */
+        mi->sample_count *= 4;
+
+        cur_prob = 0;
+        cur_prob_tp = 0;
+        cur_tp = 0;
+        cur_tp2 = 0;
+        for (group = 0; group < ARRAY_SIZE(minstrel_mcs_groups); group++) {
+                mg = &mi->groups[group];
+                if (!mg->supported)
+                        continue;
+
+                mr = minstrel_get_ratestats(mi, mg->max_prob_rate);
+                if (cur_prob_tp < mr->cur_tp &&
+                    minstrel_mcs_groups[group].streams == 1) {
+                        mi->max_prob_rate = mg->max_prob_rate;
+                        cur_prob = mr->cur_prob;
+                        cur_prob_tp = mr->cur_tp;
+                }
+
+                mr = minstrel_get_ratestats(mi, mg->max_tp_rate);
+                if (cur_tp < mr->cur_tp) {
+                        mi->max_tp_rate = mg->max_tp_rate;
+                        cur_tp = mr->cur_tp;
+                }
+
+                mr = minstrel_get_ratestats(mi, mg->max_tp_rate2);
+                if (cur_tp2 < mr->cur_tp) {
+                        mi->max_tp_rate2 = mg->max_tp_rate2;
+                        cur_tp2 = mr->cur_tp;
+                }
+        }
+
+        mi->stats_update = jiffies;
+}
+
+static bool
+minstrel_ht_txstat_valid(struct ieee80211_tx_rate *rate)
+{
+        if (!rate->count)
+                return false;
+
+        if (rate->idx < 0)
+                return false;
+
+        return !!(rate->flags & IEEE80211_TX_RC_MCS);
+}
+
+static void
+minstrel_next_sample_idx(struct minstrel_ht_sta *mi)
+{
+        struct minstrel_mcs_group_data *mg;
+
+        for (;;) {
+                mi->sample_group++;
+                mi->sample_group %= ARRAY_SIZE(minstrel_mcs_groups);
+                mg = &mi->groups[mi->sample_group];
+
+                if (!mg->supported)
+                        continue;
+
+                if (++mg->index >= MCS_GROUP_RATES) {
+                        mg->index = 0;
+                        if (++mg->column >= ARRAY_SIZE(sample_table))
+                                mg->column = 0;
+                }
+                break;
+        }
+}
+
+static void
+minstrel_downgrade_rate(struct minstrel_ht_sta *mi, unsigned int *idx,
+                        bool primary)
+{
+        int group, orig_group;
+
+        orig_group = group = *idx / MCS_GROUP_RATES;
+        while (group > 0) {
+                group--;
+
+                if (!mi->groups[group].supported)
+                        continue;
+
+                if (minstrel_mcs_groups[group].streams >
+                    minstrel_mcs_groups[orig_group].streams)
+                        continue;
+
+                if (primary)
+                        *idx = mi->groups[group].max_tp_rate;
+                else
+                        *idx = mi->groups[group].max_tp_rate2;
+                break;
+        }
+}
+
+static void
+minstrel_aggr_check(struct minstrel_priv *mp, struct ieee80211_sta *pubsta, struct sk_buff *skb)
+{
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
+        struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
+        u16 tid;
+
+        if (unlikely(!ieee80211_is_data_qos(hdr->frame_control)))
+                return;
+
+        if (unlikely(skb->protocol == cpu_to_be16(ETH_P_PAE)))
+                return;
+
+        tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK;
+        if (likely(sta->ampdu_mlme.tid_tx[tid]))
+                return;
+
+        ieee80211_start_tx_ba_session(pubsta, tid);
+}
+
+static void
+minstrel_ht_tx_status(void *priv, struct ieee80211_supported_band *sband,
+                      struct ieee80211_sta *sta, void *priv_sta,
+                      struct sk_buff *skb)
+{
+        struct minstrel_ht_sta_priv *msp = priv_sta;
+        struct minstrel_ht_sta *mi = &msp->ht;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+        struct ieee80211_tx_rate *ar = info->status.rates;
+        struct minstrel_rate_stats *rate, *rate2;
+        struct minstrel_priv *mp = priv;
+        bool last = false;
+        int group;
+        int i = 0;
+
+        if (!msp->is_ht)
+                return mac80211_minstrel.tx_status(priv, sband, sta, &msp->legacy, skb);
+
+        /* This packet was aggregated but doesn't carry status info */
+        if ((info->flags & IEEE80211_TX_CTL_AMPDU) &&
+            !(info->flags & IEEE80211_TX_STAT_AMPDU))
+                return;
+
+        if (!info->status.ampdu_len) {
+                info->status.ampdu_ack_len = 1;
+                info->status.ampdu_len = 1;
+        }
+
+        mi->ampdu_packets++;
+        mi->ampdu_len += info->status.ampdu_len;
+
+        if (!mi->sample_wait && !mi->sample_tries && mi->sample_count > 0) {
+                mi->sample_wait = 4 + 2 * MINSTREL_TRUNC(mi->avg_ampdu_len);
+                mi->sample_tries = 3;
+                mi->sample_count--;
+        }
+
+        if (info->flags & IEEE80211_TX_CTL_RATE_CTRL_PROBE) {
+                mi->sample_packets += info->status.ampdu_len;
+                minstrel_next_sample_idx(mi);
+        }
+
+        for (i = 0; !last; i++) {
+                last = (i == IEEE80211_TX_MAX_RATES - 1) ||
+                       !minstrel_ht_txstat_valid(&ar[i + 1]);
+
+                if (!minstrel_ht_txstat_valid(&ar[i]))
+                        break;
+
+                group = minstrel_ht_get_group_idx(&ar[i]);
+                rate = &mi->groups[group].rates[ar[i].idx % 8];
+
+                if (last && (info->flags & IEEE80211_TX_STAT_ACK))
+                        rate->success += info->status.ampdu_ack_len;
+
+                rate->attempts += ar[i].count * info->status.ampdu_len;
+        }
+
+        /*
+         * check for sudden death of spatial multiplexing,
+         * downgrade to a lower number of streams if necessary.
+         */
+        rate = minstrel_get_ratestats(mi, mi->max_tp_rate);
+        if (rate->attempts > 30 &&
+            MINSTREL_FRAC(rate->success, rate->attempts) <
+            MINSTREL_FRAC(20, 100))
+                minstrel_downgrade_rate(mi, &mi->max_tp_rate, true);
+
+        rate2 = minstrel_get_ratestats(mi, mi->max_tp_rate2);
+        if (rate2->attempts > 30 &&
+            MINSTREL_FRAC(rate2->success, rate2->attempts) <
+            MINSTREL_FRAC(20, 100))
+                minstrel_downgrade_rate(mi, &mi->max_tp_rate2, false);
+
+        if (time_after(jiffies, mi->stats_update + (mp->update_interval / 2 * HZ) / 1000)) {
+                minstrel_ht_update_stats(mp, mi);
+                minstrel_aggr_check(mp, sta, skb);
+        }
+}
+
+static void
+minstrel_calc_retransmit(struct minstrel_priv *mp, struct minstrel_ht_sta *mi,
+                         int index)
+{
+        struct minstrel_rate_stats *mr;
+        const struct mcs_group *group;
+        unsigned int tx_time, tx_time_rtscts, tx_time_data;
+        unsigned int cw = mp->cw_min;
+        unsigned int t_slot = 9; /* FIXME */
+        unsigned int ampdu_len = MINSTREL_TRUNC(mi->avg_ampdu_len);
+
+        mr = minstrel_get_ratestats(mi, index);
+        if (mr->probability < MINSTREL_FRAC(1, 10)) {
+                mr->retry_count = 1;
+                mr->retry_count_rtscts = 1;
+                return;
+        }
+
+        mr->retry_count = 2;
+        mr->retry_count_rtscts = 2;
+        mr->retry_updated = true;
+
+        group = &minstrel_mcs_groups[index / MCS_GROUP_RATES];
+        tx_time_data = group->duration[index % MCS_GROUP_RATES] * ampdu_len;
+        tx_time = 2 * (t_slot + mi->overhead + tx_time_data);
+        tx_time_rtscts = 2 * (t_slot + mi->overhead_rtscts + tx_time_data);
+        do {
+                cw = (cw << 1) | 1;
+                cw = min(cw, mp->cw_max);
+                tx_time += cw + t_slot + mi->overhead;
+                tx_time_rtscts += cw + t_slot + mi->overhead_rtscts;
+                if (tx_time_rtscts < mp->segment_size)
+                        mr->retry_count_rtscts++;
+        } while ((tx_time < mp->segment_size) &&
+                 (++mr->retry_count < mp->max_retry));
+}
+
+
+static void
+minstrel_ht_set_rate(struct minstrel_priv *mp, struct minstrel_ht_sta *mi,
+                     struct ieee80211_tx_rate *rate, int index,
+                     struct ieee80211_tx_rate_control *txrc,
+                     bool sample, bool rtscts)
+{
+        const struct mcs_group *group = &minstrel_mcs_groups[index / MCS_GROUP_RATES];
+        struct minstrel_rate_stats *mr;
+
+        mr = minstrel_get_ratestats(mi, index);
+        if (!mr->retry_updated)
+                minstrel_calc_retransmit(mp, mi, index);
+
+        if (mr->probability < MINSTREL_FRAC(20, 100))
+                rate->count = 2;
+        else if (rtscts)
+                rate->count = mr->retry_count_rtscts;
+        else
+                rate->count = mr->retry_count;
+
+        rate->flags = IEEE80211_TX_RC_MCS | group->flags;
+        if (txrc->short_preamble)
+                rate->flags |= IEEE80211_TX_RC_USE_SHORT_PREAMBLE;
+        if (txrc->rts || rtscts)
+                rate->flags |= IEEE80211_TX_RC_USE_RTS_CTS;
+        rate->idx = index % MCS_GROUP_RATES + (group->streams - 1) * MCS_GROUP_RATES;
+}
+
+static inline int
+minstrel_get_duration(int index)
+{
+        const struct mcs_group *group = &minstrel_mcs_groups[index / MCS_GROUP_RATES];
+        return group->duration[index % MCS_GROUP_RATES];
+}
+
+static int
+minstrel_get_sample_rate(struct minstrel_priv *mp, struct minstrel_ht_sta *mi)
+{
+        struct minstrel_rate_stats *mr;
+        struct minstrel_mcs_group_data *mg;
+        int sample_idx = 0;
+
+        if (mi->sample_wait > 0) {
+                mi->sample_wait--;
+                return -1;
+        }
+
+        if (!mi->sample_tries)
+                return -1;
+
+        mi->sample_tries--;
+        mg = &mi->groups[mi->sample_group];
+        sample_idx = sample_table[mg->column][mg->index];
+        mr = &mg->rates[sample_idx];
+        sample_idx += mi->sample_group * MCS_GROUP_RATES;
+
+        /*
+         * When not using MRR, do not sample if the probability is already
+         * higher than 95% to avoid wasting airtime
+         */
+        if (!mp->has_mrr && (mr->probability > MINSTREL_FRAC(95, 100)))
+                goto next;
+
+        /*
+         * Make sure that lower rates get sampled only occasionally,
+         * if the link is working perfectly.
+         */
+        if (minstrel_get_duration(sample_idx) >
+            minstrel_get_duration(mi->max_tp_rate)) {
+                if (mr->sample_skipped < 10)
+                        goto next;
+
+                if (mi->sample_slow++ > 2)
+                        goto next;
+        }
+
+        return sample_idx;
+
+next:
+        minstrel_next_sample_idx(mi);
+        return -1;
+}
+
+static void
+minstrel_ht_get_rate(void *priv, struct ieee80211_sta *sta, void *priv_sta,
+                     struct ieee80211_tx_rate_control *txrc)
+{
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(txrc->skb);
+        struct ieee80211_tx_rate *ar = info->status.rates;
+        struct minstrel_ht_sta_priv *msp = priv_sta;
+        struct minstrel_ht_sta *mi = &msp->ht;
+        struct minstrel_priv *mp = priv;
+        int sample_idx;
+
+        if (rate_control_send_low(sta, priv_sta, txrc))
+                return;
+
+        if (!msp->is_ht)
+                return mac80211_minstrel.get_rate(priv, sta, &msp->legacy, txrc);
+
+        info->flags |= mi->tx_flags;
+        sample_idx = minstrel_get_sample_rate(mp, mi);
+        if (sample_idx >= 0) {
+                minstrel_ht_set_rate(mp, mi, &ar[0], sample_idx,
+                        txrc, true, false);
+                minstrel_ht_set_rate(mp, mi, &ar[1], mi->max_tp_rate,
+                        txrc, false, true);
+                info->flags |= IEEE80211_TX_CTL_RATE_CTRL_PROBE;
+        } else {
+                minstrel_ht_set_rate(mp, mi, &ar[0], mi->max_tp_rate,
+                        txrc, false, false);
+                minstrel_ht_set_rate(mp, mi, &ar[1], mi->max_tp_rate2,
+                        txrc, false, true);
+        }
+        minstrel_ht_set_rate(mp, mi, &ar[2], mi->max_prob_rate, txrc, false, true);
+
+        ar[3].count = 0;
+        ar[3].idx = -1;
+
+        mi->total_packets++;
+
+        /* wraparound */
+        if (mi->total_packets == ~0) {
+                mi->total_packets = 0;
+                mi->sample_packets = 0;
+        }
+}
+
+static void
+minstrel_ht_update_caps(void *priv, struct ieee80211_supported_band *sband,
+                        struct ieee80211_sta *sta, void *priv_sta,
+                        enum nl80211_channel_type oper_chan_type)
+{
+        struct minstrel_priv *mp = priv;
+        struct minstrel_ht_sta_priv *msp = priv_sta;
+        struct minstrel_ht_sta *mi = &msp->ht;
+        struct ieee80211_mcs_info *mcs = &sta->ht_cap.mcs;
+        struct ieee80211_local *local = hw_to_local(mp->hw);
+        u16 sta_cap = sta->ht_cap.cap;
+        int ack_dur;
+        int stbc;
+        int i;
+
+        /* fall back to the old minstrel for legacy stations */
+        if (!sta->ht_cap.ht_supported) {
+                msp->is_ht = false;
+                memset(&msp->legacy, 0, sizeof(msp->legacy));
+                msp->legacy.r = msp->ratelist;
+                msp->legacy.sample_table = msp->sample_table;
+                return mac80211_minstrel.rate_init(priv, sband, sta, &msp->legacy);
+        }
+
+        BUILD_BUG_ON(ARRAY_SIZE(minstrel_mcs_groups) !=
+                MINSTREL_MAX_STREAMS * MINSTREL_STREAM_GROUPS);
+
+        msp->is_ht = true;
+        memset(mi, 0, sizeof(*mi));
+        mi->stats_update = jiffies;
+
+        ack_dur = ieee80211_frame_duration(local, 10, 60, 1, 1);
+        mi->overhead = ieee80211_frame_duration(local, 0, 60, 1, 1) + ack_dur;
+        mi->overhead_rtscts = mi->overhead + 2 * ack_dur;
+
+        mi->avg_ampdu_len = MINSTREL_FRAC(1, 1);
+
+        /* When using MRR, sample more on the first attempt, without delay */
+        if (mp->has_mrr) {
+                mi->sample_count = 16;
+                mi->sample_wait = 0;
+        } else {
+                mi->sample_count = 8;
+                mi->sample_wait = 8;
+        }
+        mi->sample_tries = 4;
+
+        stbc = (sta_cap & IEEE80211_HT_CAP_RX_STBC) >>
+                IEEE80211_HT_CAP_RX_STBC_SHIFT;
+        mi->tx_flags |= stbc << IEEE80211_TX_CTL_STBC_SHIFT;
+
+        if (sta_cap & IEEE80211_HT_CAP_LDPC_CODING)
+                mi->tx_flags |= IEEE80211_TX_CTL_LDPC;
+
+        if (oper_chan_type != NL80211_CHAN_HT40MINUS &&
+            oper_chan_type != NL80211_CHAN_HT40PLUS)
+                sta_cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
+
+        for (i = 0; i < ARRAY_SIZE(mi->groups); i++) {
+                u16 req = 0;
+
+                mi->groups[i].supported = 0;
+                if (minstrel_mcs_groups[i].flags & IEEE80211_TX_RC_SHORT_GI) {
+                        if (minstrel_mcs_groups[i].flags & IEEE80211_TX_RC_40_MHZ_WIDTH)
+                                req |= IEEE80211_HT_CAP_SGI_40;
+                        else
+                                req |= IEEE80211_HT_CAP_SGI_20;
+                }
+
+                if (minstrel_mcs_groups[i].flags & IEEE80211_TX_RC_40_MHZ_WIDTH)
+                        req |= IEEE80211_HT_CAP_SUP_WIDTH_20_40;
+
+                if ((sta_cap & req) != req)
+                        continue;
+
+                mi->groups[i].supported =
+                        mcs->rx_mask[minstrel_mcs_groups[i].streams - 1];
+        }
+}
+
+static void
+minstrel_ht_rate_init(void *priv, struct ieee80211_supported_band *sband,
+                      struct ieee80211_sta *sta, void *priv_sta)
+{
+        struct minstrel_priv *mp = priv;
+
+        minstrel_ht_update_caps(priv, sband, sta, priv_sta, mp->hw->conf.channel_type);
+}
+
+static void
+minstrel_ht_rate_update(void *priv, struct ieee80211_supported_band *sband,
+                        struct ieee80211_sta *sta, void *priv_sta,
+                        u32 changed, enum nl80211_channel_type oper_chan_type)
+{
+        minstrel_ht_update_caps(priv, sband, sta, priv_sta, oper_chan_type);
+}
+
+static void *
+minstrel_ht_alloc_sta(void *priv, struct ieee80211_sta *sta, gfp_t gfp)
+{
+        struct ieee80211_supported_band *sband;
+        struct minstrel_ht_sta_priv *msp;
+        struct minstrel_priv *mp = priv;
+        struct ieee80211_hw *hw = mp->hw;
+        int max_rates = 0;
+        int i;
+
+        for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
+                sband = hw->wiphy->bands[i];
+                if (sband && sband->n_bitrates > max_rates)
+                        max_rates = sband->n_bitrates;
+        }
+
+        msp = kzalloc(sizeof(struct minstrel_ht_sta), gfp);
+        if (!msp)
+                return NULL;
+
+        msp->ratelist = kzalloc(sizeof(struct minstrel_rate) * max_rates, gfp);
+        if (!msp->ratelist)
+                goto error;
+
+        msp->sample_table = kmalloc(SAMPLE_COLUMNS * max_rates, gfp);
+        if (!msp->sample_table)
+                goto error1;
+
+        return msp;
+
+error1:
+        kfree(msp->ratelist);
+error:
+        kfree(msp);
+        return NULL;
+}
+
+static void
+minstrel_ht_free_sta(void *priv, struct ieee80211_sta *sta, void *priv_sta)
+{
+        struct minstrel_ht_sta_priv *msp = priv_sta;
+
+        kfree(msp->sample_table);
+        kfree(msp->ratelist);
+        kfree(msp);
+}
+
+static void *
+minstrel_ht_alloc(struct ieee80211_hw *hw, struct dentry *debugfsdir)
+{
+        return mac80211_minstrel.alloc(hw, debugfsdir);
+}
+
+static void
+minstrel_ht_free(void *priv)
+{
+        mac80211_minstrel.free(priv);
+}
+
+static struct rate_control_ops mac80211_minstrel_ht = {
+        .name = "minstrel_ht",
+        .tx_status = minstrel_ht_tx_status,
+        .get_rate = minstrel_ht_get_rate,
+        .rate_init = minstrel_ht_rate_init,
+        .rate_update = minstrel_ht_rate_update,
+        .alloc_sta = minstrel_ht_alloc_sta,
+        .free_sta = minstrel_ht_free_sta,
+        .alloc = minstrel_ht_alloc,
+        .free = minstrel_ht_free,
+#ifdef CONFIG_MAC80211_DEBUGFS
+        .add_sta_debugfs = minstrel_ht_add_sta_debugfs,
+        .remove_sta_debugfs = minstrel_ht_remove_sta_debugfs,
+#endif
+};
+
+
+static void
+init_sample_table(void)
+{
+        int col, i, new_idx;
+        u8 rnd[MCS_GROUP_RATES];
+
+        memset(sample_table, 0xff, sizeof(sample_table));
+        for (col = 0; col < SAMPLE_COLUMNS; col++) {
+                for (i = 0; i < MCS_GROUP_RATES; i++) {
+                        get_random_bytes(rnd, sizeof(rnd));
+                        new_idx = (i + rnd[i]) % MCS_GROUP_RATES;
+
+                        while (sample_table[col][new_idx] != 0xff)
+                                new_idx = (new_idx + 1) % MCS_GROUP_RATES;
+
+                        sample_table[col][new_idx] = i;
+                }
+        }
+}
+
+int __init
+rc80211_minstrel_ht_init(void)
+{
+        init_sample_table();
+        return ieee80211_rate_control_register(&mac80211_minstrel_ht);
+}
+
+void
+rc80211_minstrel_ht_exit(void)
+{
+        ieee80211_rate_control_unregister(&mac80211_minstrel_ht);
+}
diff --git a/net/mac80211/rc80211_minstrel_ht.h b/net/mac80211/rc80211_minstrel_ht.h
new file mode 100644
index 000000000000..462d2b227ed5
--- /dev/null
+++ b/net/mac80211/rc80211_minstrel_ht.h
@@ -0,0 +1,130 @@
+/*
+ * Copyright (C) 2010 Felix Fietkau <nbd@openwrt.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#ifndef __RC_MINSTREL_HT_H
+#define __RC_MINSTREL_HT_H
+
+/*
+ * The number of streams can be changed to 2 to reduce code
+ * size and memory footprint.
+ */
+#define MINSTREL_MAX_STREAMS    3
+#define MINSTREL_STREAM_GROUPS  4
+
+/* scaled fraction values */
+#define MINSTREL_SCALE  16
+#define MINSTREL_FRAC(val, div) (((val) << MINSTREL_SCALE) / div)
+#define MINSTREL_TRUNC(val) ((val) >> MINSTREL_SCALE)
+
+#define MCS_GROUP_RATES 8
+
+struct mcs_group {
+        u32 flags;
+        unsigned int streams;
+        unsigned int duration[MCS_GROUP_RATES];
+};
+
+extern const struct mcs_group minstrel_mcs_groups[];
+
+struct minstrel_rate_stats {
+        /* current / last sampling period attempts/success counters */
+        unsigned int attempts, last_attempts;
+        unsigned int success, last_success;
+
+        /* total attempts/success counters */
+        u64 att_hist, succ_hist;
+
+        /* current throughput */
+        unsigned int cur_tp;
+
+        /* packet delivery probabilities */
+        unsigned int cur_prob, probability;
+
+        /* maximum retry counts */
+        unsigned int retry_count;
+        unsigned int retry_count_rtscts;
+
+        bool retry_updated;
+        u8 sample_skipped;
+};
+
+struct minstrel_mcs_group_data {
+        u8 index;
+        u8 column;
+
+        /* bitfield of supported MCS rates of this group */
+        u8 supported;
+
+        /* selected primary rates */
+        unsigned int max_tp_rate;
+        unsigned int max_tp_rate2;
+        unsigned int max_prob_rate;
+
+        /* MCS rate statistics */
+        struct minstrel_rate_stats rates[MCS_GROUP_RATES];
+};
+
+struct minstrel_ht_sta {
+        /* ampdu length (average, per sampling interval) */
+        unsigned int ampdu_len;
+        unsigned int ampdu_packets;
+
+        /* ampdu length (EWMA) */
+        unsigned int avg_ampdu_len;
+
+        /* best throughput rate */
+        unsigned int max_tp_rate;
+
+        /* second best throughput rate */
+        unsigned int max_tp_rate2;
+
+        /* best probability rate */
+        unsigned int max_prob_rate;
+
+        /* time of last status update */
+        unsigned long stats_update;
+
+        /* overhead time in usec for each frame */
+        unsigned int overhead;
+        unsigned int overhead_rtscts;
+
+        unsigned int total_packets;
+        unsigned int sample_packets;
+
+        /* tx flags to add for frames for this sta */
+        u32 tx_flags;
+
+        u8 sample_wait;
+        u8 sample_tries;
+        u8 sample_count;
+        u8 sample_slow;
+
+        /* current MCS group to be sampled */
+        u8 sample_group;
+
+        /* MCS rate group info and statistics */
+        struct minstrel_mcs_group_data groups[MINSTREL_MAX_STREAMS * MINSTREL_STREAM_GROUPS];
+};
+
+struct minstrel_ht_sta_priv {
+        union {
+                struct minstrel_ht_sta ht;
+                struct minstrel_sta_info legacy;
+        };
+#ifdef CONFIG_MAC80211_DEBUGFS
+        struct dentry *dbg_stats;
+#endif
+        void *ratelist;
+        void *sample_table;
+        bool is_ht;
+};
+
+void minstrel_ht_add_sta_debugfs(void *priv, void *priv_sta, struct dentry *dir);
+void minstrel_ht_remove_sta_debugfs(void *priv, void *priv_sta);
+
+#endif
diff --git a/net/mac80211/rc80211_minstrel_ht_debugfs.c b/net/mac80211/rc80211_minstrel_ht_debugfs.c
new file mode 100644
index 000000000000..4a5a4b3e7799
--- /dev/null
+++ b/net/mac80211/rc80211_minstrel_ht_debugfs.c
@@ -0,0 +1,118 @@
+/*
+ * Copyright (C) 2010 Felix Fietkau <nbd@openwrt.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+#include <linux/netdevice.h>
+#include <linux/types.h>
+#include <linux/skbuff.h>
+#include <linux/debugfs.h>
+#include <linux/ieee80211.h>
+#include <net/mac80211.h>
+#include "rc80211_minstrel.h"
+#include "rc80211_minstrel_ht.h"
+
+static int
+minstrel_ht_stats_open(struct inode *inode, struct file *file)
+{
+        struct minstrel_ht_sta_priv *msp = inode->i_private;
+        struct minstrel_ht_sta *mi = &msp->ht;
+        struct minstrel_debugfs_info *ms;
+        unsigned int i, j, tp, prob, eprob;
+        char *p;
+        int ret;
+
+        if (!msp->is_ht) {
+                inode->i_private = &msp->legacy;
+                ret = minstrel_stats_open(inode, file);
+                inode->i_private = msp;
+                return ret;
+        }
+
+        ms = kmalloc(sizeof(*ms) + 8192, GFP_KERNEL);
+        if (!ms)
+                return -ENOMEM;
+
+        file->private_data = ms;
+        p = ms->buf;
+        p += sprintf(p, "type      rate     throughput  ewma prob   this prob  "
+                        "this succ/attempt   success    attempts\n");
+        for (i = 0; i < MINSTREL_MAX_STREAMS * MINSTREL_STREAM_GROUPS; i++) {
+                char htmode = '2';
+                char gimode = 'L';
+
+                if (!mi->groups[i].supported)
+                        continue;
+
+                if (minstrel_mcs_groups[i].flags & IEEE80211_TX_RC_40_MHZ_WIDTH)
+                        htmode = '4';
+                if (minstrel_mcs_groups[i].flags & IEEE80211_TX_RC_SHORT_GI)
+                        gimode = 'S';
+
+                for (j = 0; j < MCS_GROUP_RATES; j++) {
+                        struct minstrel_rate_stats *mr = &mi->groups[i].rates[j];
+                        int idx = i * MCS_GROUP_RATES + j;
+
+                        if (!(mi->groups[i].supported & BIT(j)))
+                                continue;
+
+                        p += sprintf(p, "HT%c0/%cGI ", htmode, gimode);
+
+                        *(p++) = (idx == mi->max_tp_rate) ? 'T' : ' ';
+                        *(p++) = (idx == mi->max_tp_rate2) ? 't' : ' ';
+                        *(p++) = (idx == mi->max_prob_rate) ? 'P' : ' ';
+                        p += sprintf(p, "MCS%-2u", (minstrel_mcs_groups[i].streams - 1) *
+                                        MCS_GROUP_RATES + j);
+
+                        tp = mr->cur_tp / 10;
+                        prob = MINSTREL_TRUNC(mr->cur_prob * 1000);
+                        eprob = MINSTREL_TRUNC(mr->probability * 1000);
+
+                        p += sprintf(p, "  %6u.%1u   %6u.%1u   %6u.%1u        "
+                                        "%3u(%3u)   %8llu    %8llu\n",
+                                        tp / 10, tp % 10,
+                                        eprob / 10, eprob % 10,
+                                        prob / 10, prob % 10,
+                                        mr->last_success,
+                                        mr->last_attempts,
+                                        (unsigned long long)mr->succ_hist,
+                                        (unsigned long long)mr->att_hist);
+                }
+        }
+        p += sprintf(p, "\nTotal packet count::    ideal %d      "
+                        "lookaround %d\n",
+                        max(0, (int) mi->total_packets - (int) mi->sample_packets),
+                        mi->sample_packets);
+        p += sprintf(p, "Average A-MPDU length: %d.%d\n",
+                MINSTREL_TRUNC(mi->avg_ampdu_len),
+                MINSTREL_TRUNC(mi->avg_ampdu_len * 10) % 10);
+        ms->len = p - ms->buf;
+
+        return 0;
+}
+
+static const struct file_operations minstrel_ht_stat_fops = {
+        .owner = THIS_MODULE,
+        .open = minstrel_ht_stats_open,
+        .read = minstrel_stats_read,
+        .release = minstrel_stats_release,
+};
+
+void
+minstrel_ht_add_sta_debugfs(void *priv, void *priv_sta, struct dentry *dir)
+{
+        struct minstrel_ht_sta_priv *msp = priv_sta;
+
+        msp->dbg_stats = debugfs_create_file("rc_stats", S_IRUGO, dir, msp,
+                        &minstrel_ht_stat_fops);
+}
+
+void
+minstrel_ht_remove_sta_debugfs(void *priv, void *priv_sta)
+{
+        struct minstrel_ht_sta_priv *msp = priv_sta;
+
+        debugfs_remove(msp->dbg_stats);
+}
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index be9abc2e6348..fa0f37e4afe4 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -293,7 +293,7 @@ ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
                         skb2 = skb_clone(skb, GFP_ATOMIC);
                         if (skb2) {
                                 skb2->dev = prev_dev;
-                                netif_rx(skb2);
+                                netif_receive_skb(skb2);
                         }
                 }
 
@@ -304,7 +304,7 @@ ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
 
         if (prev_dev) {
                 skb->dev = prev_dev;
-                netif_rx(skb);
+                netif_receive_skb(skb);
         } else
                 dev_kfree_skb(skb);
 
@@ -719,16 +719,13 @@ static void ieee80211_rx_reorder_ampdu(struct ieee80211_rx_data *rx,
 
         tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK;
 
-        spin_lock(&sta->lock);
-
-        if (!sta->ampdu_mlme.tid_active_rx[tid])
-                goto dont_reorder_unlock;
-
-        tid_agg_rx = sta->ampdu_mlme.tid_rx[tid];
+        tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
+        if (!tid_agg_rx)
+                goto dont_reorder;
 
         /* qos null data frames are excluded */
         if (unlikely(hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_NULLFUNC)))
-                goto dont_reorder_unlock;
+                goto dont_reorder;
 
         /* new, potentially un-ordered, ampdu frame - process it */
 
@@ -740,20 +737,22 @@ static void ieee80211_rx_reorder_ampdu(struct ieee80211_rx_data *rx,
         /* if this mpdu is fragmented - terminate rx aggregation session */
         sc = le16_to_cpu(hdr->seq_ctrl);
         if (sc & IEEE80211_SCTL_FRAG) {
-                spin_unlock(&sta->lock);
-                __ieee80211_stop_rx_ba_session(sta, tid, WLAN_BACK_RECIPIENT,
-                                               WLAN_REASON_QSTA_REQUIRE_SETUP);
-                dev_kfree_skb(skb);
+                skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
+                skb_queue_tail(&rx->sdata->skb_queue, skb);
+                ieee80211_queue_work(&local->hw, &rx->sdata->work);
                 return;
         }
 
-        if (ieee80211_sta_manage_reorder_buf(hw, tid_agg_rx, skb, frames)) {
-                spin_unlock(&sta->lock);
+        /*
+         * No locking needed -- we will only ever process one
+         * RX packet at a time, and thus own tid_agg_rx. All
+         * other code manipulating it needs to (and does) make
+         * sure that we cannot get to it any more before doing
+         * anything with it.
+         */
+        if (ieee80211_sta_manage_reorder_buf(hw, tid_agg_rx, skb, frames))
                 return;
-        }
 
- dont_reorder_unlock:
-        spin_unlock(&sta->lock);
  dont_reorder:
         __skb_queue_tail(frames, skb);
 }
@@ -825,6 +824,7 @@ ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
         ieee80211_rx_result result = RX_DROP_UNUSABLE;
         struct ieee80211_key *stakey = NULL;
         int mmie_keyidx = -1;
+        __le16 fc;
 
         /*
          * Key selection 101
@@ -866,13 +866,15 @@ ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
         if (rx->sta)
                 stakey = rcu_dereference(rx->sta->key);
 
-        if (!ieee80211_has_protected(hdr->frame_control))
+        fc = hdr->frame_control;
+
+        if (!ieee80211_has_protected(fc))
                 mmie_keyidx = ieee80211_get_mmie_keyidx(rx->skb);
 
         if (!is_multicast_ether_addr(hdr->addr1) && stakey) {
                 rx->key = stakey;
                 /* Skip decryption if the frame is not protected. */
-                if (!ieee80211_has_protected(hdr->frame_control))
+                if (!ieee80211_has_protected(fc))
                         return RX_CONTINUE;
         } else if (mmie_keyidx >= 0) {
                 /* Broadcast/multicast robust management frame / BIP */
@@ -884,7 +886,7 @@ ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
                     mmie_keyidx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS)
                         return RX_DROP_MONITOR; /* unexpected BIP keyidx */
                 rx->key = rcu_dereference(rx->sdata->keys[mmie_keyidx]);
-        } else if (!ieee80211_has_protected(hdr->frame_control)) {
+        } else if (!ieee80211_has_protected(fc)) {
                 /*
                  * The frame was not protected, so skip decryption. However, we
                  * need to set rx->key if there is a key that could have been
@@ -892,7 +894,7 @@ ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
                  * have been expected.
                  */
                 struct ieee80211_key *key = NULL;
-                if (ieee80211_is_mgmt(hdr->frame_control) &&
+                if (ieee80211_is_mgmt(fc) &&
                     is_multicast_ether_addr(hdr->addr1) &&
                     (key = rcu_dereference(rx->sdata->default_mgmt_key)))
                         rx->key = key;
@@ -914,7 +916,7 @@ ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
                     (status->flag & RX_FLAG_IV_STRIPPED))
                         return RX_CONTINUE;
 
-                hdrlen = ieee80211_hdrlen(hdr->frame_control);
+                hdrlen = ieee80211_hdrlen(fc);
 
                 if (rx->skb->len < 8 + hdrlen)
                         return RX_DROP_UNUSABLE; /* TODO: count this? */
@@ -947,19 +949,17 @@ ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
 
         if (skb_linearize(rx->skb))
                 return RX_DROP_UNUSABLE;
-
-        hdr = (struct ieee80211_hdr *)rx->skb->data;
-
-        /* Check for weak IVs if possible */
-        if (rx->sta && rx->key->conf.alg == ALG_WEP &&
-            ieee80211_is_data(hdr->frame_control) &&
-            (!(status->flag & RX_FLAG_IV_STRIPPED) ||
-             !(status->flag & RX_FLAG_DECRYPTED)) &&
-            ieee80211_wep_is_weak_iv(rx->skb, rx->key))
-                rx->sta->wep_weak_iv_count++;
+        /* the hdr variable is invalid now! */
 
         switch (rx->key->conf.alg) {
         case ALG_WEP:
+                /* Check for weak IVs if possible */
+                if (rx->sta && ieee80211_is_data(fc) &&
+                    (!(status->flag & RX_FLAG_IV_STRIPPED) ||
+                     !(status->flag & RX_FLAG_DECRYPTED)) &&
+                    ieee80211_wep_is_weak_iv(rx->skb, rx->key))
+                        rx->sta->wep_weak_iv_count++;
+
                 result = ieee80211_crypto_wep_decrypt(rx);
                 break;
         case ALG_TKIP:
@@ -1267,11 +1267,13 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
                                                  rx->queue, &(rx->skb));
                 if (rx->key && rx->key->conf.alg == ALG_CCMP &&
                     ieee80211_has_protected(fc)) {
+                        int queue = ieee80211_is_mgmt(fc) ?
+                                NUM_RX_DATA_QUEUES : rx->queue;
                         /* Store CCMP PN so that we can verify that the next
                          * fragment has a sequential PN value. */
                         entry->ccmp = 1;
                         memcpy(entry->last_pn,
-                               rx->key->u.ccmp.rx_pn[rx->queue],
+                               rx->key->u.ccmp.rx_pn[queue],
                                CCMP_PN_LEN);
                 }
                 return RX_QUEUED;
@@ -1291,6 +1293,7 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
         if (entry->ccmp) {
                 int i;
                 u8 pn[CCMP_PN_LEN], *rpn;
+                int queue;
                 if (!rx->key || rx->key->conf.alg != ALG_CCMP)
                         return RX_DROP_UNUSABLE;
                 memcpy(pn, entry->last_pn, CCMP_PN_LEN);
@@ -1299,7 +1302,9 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
                         if (pn[i])
                                 break;
                 }
-                rpn = rx->key->u.ccmp.rx_pn[rx->queue];
+                queue = ieee80211_is_mgmt(fc) ?
+                        NUM_RX_DATA_QUEUES : rx->queue;
+                rpn = rx->key->u.ccmp.rx_pn[queue];
                 if (memcmp(pn, rpn, CCMP_PN_LEN))
                         return RX_DROP_UNUSABLE;
                 memcpy(entry->last_pn, pn, CCMP_PN_LEN);
@@ -1573,7 +1578,7 @@ ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
                         /* deliver to local stack */
                         skb->protocol = eth_type_trans(skb, dev);
                         memset(skb->cb, 0, sizeof(skb->cb));
-                        netif_rx(skb);
+                        netif_receive_skb(skb);
                 }
         }
 
@@ -1829,13 +1834,11 @@ ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx, struct sk_buff_head *frames)
                                   &bar_data, sizeof(bar_data)))
                         return RX_DROP_MONITOR;
 
-                spin_lock(&rx->sta->lock);
                 tid = le16_to_cpu(bar_data.control) >> 12;
-                if (!rx->sta->ampdu_mlme.tid_active_rx[tid]) {
-                        spin_unlock(&rx->sta->lock);
+
+                tid_agg_rx = rcu_dereference(rx->sta->ampdu_mlme.tid_rx[tid]);
+                if (!tid_agg_rx)
                         return RX_DROP_MONITOR;
-                }
-                tid_agg_rx = rx->sta->ampdu_mlme.tid_rx[tid];
 
                 start_seq_num = le16_to_cpu(bar_data.start_seq_num) >> 4;
 
@@ -1848,11 +1851,15 @@ ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx, struct sk_buff_head *frames)
                 ieee80211_release_reorder_frames(hw, tid_agg_rx, start_seq_num,
                                                  frames);
                 kfree_skb(skb);
-                spin_unlock(&rx->sta->lock);
                 return RX_QUEUED;
         }
 
-        return RX_CONTINUE;
+        /*
+         * After this point, we only want management frames,
+         * so we can drop all remaining control frames to
+         * cooked monitor interfaces.
+         */
+        return RX_DROP_MONITOR;
 }
 
 static void ieee80211_process_sa_query_req(struct ieee80211_sub_if_data *sdata,
@@ -1944,30 +1951,27 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
                 if (len < IEEE80211_MIN_ACTION_SIZE + 1)
                         break;
 
-                if (sdata->vif.type == NL80211_IFTYPE_STATION)
-                        return ieee80211_sta_rx_mgmt(sdata, rx->skb);
-
                 switch (mgmt->u.action.u.addba_req.action_code) {
                 case WLAN_ACTION_ADDBA_REQ:
                         if (len < (IEEE80211_MIN_ACTION_SIZE +
                                    sizeof(mgmt->u.action.u.addba_req)))
-                                return RX_DROP_MONITOR;
-                        ieee80211_process_addba_request(local, rx->sta, mgmt, len);
-                        goto handled;
+                                goto invalid;
+                        break;
                 case WLAN_ACTION_ADDBA_RESP:
                         if (len < (IEEE80211_MIN_ACTION_SIZE +
                                    sizeof(mgmt->u.action.u.addba_resp)))
-                                break;
-                        ieee80211_process_addba_resp(local, rx->sta, mgmt, len);
-                        goto handled;
+                                goto invalid;
+                        break;
                 case WLAN_ACTION_DELBA:
                         if (len < (IEEE80211_MIN_ACTION_SIZE +
                                    sizeof(mgmt->u.action.u.delba)))
-                                break;
-                        ieee80211_process_delba(sdata, rx->sta, mgmt, len);
-                        goto handled;
+                                goto invalid;
+                        break;
+                default:
+                        goto invalid;
                 }
-                break;
+
+                goto queue;
         case WLAN_CATEGORY_SPECTRUM_MGMT:
                 if (local->hw.conf.channel->band != IEEE80211_BAND_5GHZ)
                         break;
@@ -1997,7 +2001,7 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
                         if (memcmp(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN))
                                 break;
 
-                        return ieee80211_sta_rx_mgmt(sdata, rx->skb);
+                        goto queue;
                 }
                 break;
         case WLAN_CATEGORY_SA_QUERY:
@@ -2015,11 +2019,12 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
                 break;
         case WLAN_CATEGORY_MESH_PLINK:
         case WLAN_CATEGORY_MESH_PATH_SEL:
-                if (ieee80211_vif_is_mesh(&sdata->vif))
-                        return ieee80211_mesh_rx_mgmt(sdata, rx->skb);
-                break;
+                if (!ieee80211_vif_is_mesh(&sdata->vif))
+                        break;
+                goto queue;
         }
 
+ invalid:
         /*
          * For AP mode, hostapd is responsible for handling any action
          * frames that we didn't handle, including returning unknown
@@ -2039,8 +2044,7 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
          */
         status = IEEE80211_SKB_RXCB(rx->skb);
 
-        if (sdata->vif.type == NL80211_IFTYPE_STATION &&
-            cfg80211_rx_action(rx->sdata->dev, status->freq,
+        if (cfg80211_rx_action(rx->sdata->dev, status->freq,
                                rx->skb->data, rx->skb->len,
                                GFP_ATOMIC))
                 goto handled;
@@ -2052,11 +2056,11 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
         nskb = skb_copy_expand(rx->skb, local->hw.extra_tx_headroom, 0,
                                GFP_ATOMIC);
         if (nskb) {
-                struct ieee80211_mgmt *mgmt = (void *)nskb->data;
+                struct ieee80211_mgmt *nmgmt = (void *)nskb->data;
 
-                mgmt->u.action.category |= 0x80;
-                memcpy(mgmt->da, mgmt->sa, ETH_ALEN);
-                memcpy(mgmt->sa, rx->sdata->vif.addr, ETH_ALEN);
+                nmgmt->u.action.category |= 0x80;
+                memcpy(nmgmt->da, nmgmt->sa, ETH_ALEN);
+                memcpy(nmgmt->sa, rx->sdata->vif.addr, ETH_ALEN);
 
                 memset(nskb->cb, 0, sizeof(nskb->cb));
 
@@ -2068,6 +2072,14 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
                 rx->sta->rx_packets++;
         dev_kfree_skb(rx->skb);
         return RX_QUEUED;
+
+ queue:
+        rx->skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
+        skb_queue_tail(&sdata->skb_queue, rx->skb);
+        ieee80211_queue_work(&local->hw, &sdata->work);
+        if (rx->sta)
+                rx->sta->rx_packets++;
+        return RX_QUEUED;
 }
 
 static ieee80211_rx_result debug_noinline
@@ -2075,10 +2087,15 @@ ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
 {
         struct ieee80211_sub_if_data *sdata = rx->sdata;
         ieee80211_rx_result rxs;
+        struct ieee80211_mgmt *mgmt = (void *)rx->skb->data;
+        __le16 stype;
 
         if (!(rx->flags & IEEE80211_RX_RA_MATCH))
                 return RX_DROP_MONITOR;
 
+        if (rx->skb->len < 24)
+                return RX_DROP_MONITOR;
+
         if (ieee80211_drop_unencrypted_mgmt(rx))
                 return RX_DROP_UNUSABLE;
 
@@ -2086,16 +2103,42 @@ ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
         if (rxs != RX_CONTINUE)
                 return rxs;
 
-        if (ieee80211_vif_is_mesh(&sdata->vif))
-                return ieee80211_mesh_rx_mgmt(sdata, rx->skb);
+        stype = mgmt->frame_control & cpu_to_le16(IEEE80211_FCTL_STYPE);
 
-        if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
-                return ieee80211_ibss_rx_mgmt(sdata, rx->skb);
+        if (!ieee80211_vif_is_mesh(&sdata->vif) &&
+            sdata->vif.type != NL80211_IFTYPE_ADHOC &&
+            sdata->vif.type != NL80211_IFTYPE_STATION)
+                return RX_DROP_MONITOR;
+
+        switch (stype) {
+        case cpu_to_le16(IEEE80211_STYPE_BEACON):
+        case cpu_to_le16(IEEE80211_STYPE_PROBE_RESP):
+                /* process for all: mesh, mlme, ibss */
+                break;
+        case cpu_to_le16(IEEE80211_STYPE_DEAUTH):
+        case cpu_to_le16(IEEE80211_STYPE_DISASSOC):
+                /* process only for station */
+                if (sdata->vif.type != NL80211_IFTYPE_STATION)
+                        return RX_DROP_MONITOR;
+                break;
+        case cpu_to_le16(IEEE80211_STYPE_PROBE_REQ):
+        case cpu_to_le16(IEEE80211_STYPE_AUTH):
+                /* process only for ibss */
+                if (sdata->vif.type != NL80211_IFTYPE_ADHOC)
+                        return RX_DROP_MONITOR;
+                break;
+        default:
+                return RX_DROP_MONITOR;
+        }
 
-        if (sdata->vif.type == NL80211_IFTYPE_STATION)
-                return ieee80211_sta_rx_mgmt(sdata, rx->skb);
+        /* queue up frame and kick off work to process it */
+        rx->skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
+        skb_queue_tail(&sdata->skb_queue, rx->skb);
+        ieee80211_queue_work(&rx->local->hw, &sdata->work);
+        if (rx->sta)
+                rx->sta->rx_packets++;
 
-        return RX_DROP_MONITOR;
+        return RX_QUEUED;
 }
 
 static void ieee80211_rx_michael_mic_report(struct ieee80211_hdr *hdr,
@@ -2151,7 +2194,7 @@ static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx,
                 u8 rate_or_pad;
                 __le16 chan_freq;
                 __le16 chan_flags;
-        } __attribute__ ((packed)) *rthdr;
+        } __packed *rthdr;
         struct sk_buff *skb = rx->skb, *skb2;
         struct net_device *prev_dev = NULL;
         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
@@ -2201,7 +2244,7 @@ static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx,
                         skb2 = skb_clone(skb, GFP_ATOMIC);
                         if (skb2) {
                                 skb2->dev = prev_dev;
-                                netif_rx(skb2);
+                                netif_receive_skb(skb2);
                         }
                 }
 
@@ -2212,7 +2255,7 @@ static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx,
 
         if (prev_dev) {
                 skb->dev = prev_dev;
-                netif_rx(skb);
+                netif_receive_skb(skb);
                 skb = NULL;
         } else
                 goto out_free_skb;
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index e1b0be7a57b9..872d7b6ef6b3 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -114,6 +114,10 @@ ieee80211_bss_info_update(struct ieee80211_local *local,
                 bss->dtim_period = tim_ie->dtim_period;
         }
 
+        /* If the beacon had no TIM IE, or it was invalid, use 1 */
+        if (beacon && !bss->dtim_period)
+                bss->dtim_period = 1;
+
         /* replace old supported rates if we get new values */
         srlen = 0;
         if (elems->supp_rates) {
@@ -396,19 +400,7 @@ static int __ieee80211_start_scan(struct ieee80211_sub_if_data *sdata,
         else
                 __set_bit(SCAN_SW_SCANNING, &local->scanning);
 
-        /*
-         * Kicking off the scan need not be protected,
-         * only the scan variable stuff, since now
-         * local->scan_req is assigned and other callers
-         * will abort their scan attempts.
-         *
-         * This avoids too many locking dependencies
-         * so that the scan completed calls have more
-         * locking freedom.
-         */
-
         ieee80211_recalc_idle(local);
-        mutex_unlock(&local->scan_mtx);
 
         if (local->ops->hw_scan) {
                 WARN_ON(!ieee80211_prep_hw_scan(local));
@@ -416,8 +408,6 @@ static int __ieee80211_start_scan(struct ieee80211_sub_if_data *sdata,
         } else
                 rc = ieee80211_start_sw_scan(local);
 
-        mutex_lock(&local->scan_mtx);
-
         if (rc) {
                 kfree(local->hw_scan_req);
                 local->hw_scan_req = NULL;
@@ -734,7 +724,7 @@ int ieee80211_request_internal_scan(struct ieee80211_sub_if_data *sdata,
 {
         struct ieee80211_local *local = sdata->local;
         int ret = -EBUSY;
-        enum nl80211_band band;
+        enum ieee80211_band band;
 
         mutex_lock(&local->scan_mtx);
 
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index ba9360a475b0..6d86f0c1ad04 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -235,6 +235,8 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
         spin_lock_init(&sta->lock);
         spin_lock_init(&sta->flaglock);
         INIT_WORK(&sta->drv_unblock_wk, sta_unblock);
+        INIT_WORK(&sta->ampdu_mlme.work, ieee80211_ba_session_work);
+        mutex_init(&sta->ampdu_mlme.mtx);
 
         memcpy(sta->sta.addr, addr, ETH_ALEN);
         sta->local = local;
@@ -246,14 +248,12 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
         }
 
         for (i = 0; i < STA_TID_NUM; i++) {
-                /* timer_to_tid must be initialized with identity mapping to
-                 * enable session_timer's data differentiation. refer to
-                 * sta_rx_agg_session_timer_expired for useage */
+                /*
+                 * timer_to_tid must be initialized with identity mapping
+                 * to enable session_timer's data differentiation. See
+                 * sta_rx_agg_session_timer_expired for usage.
+                 */
                 sta->timer_to_tid[i] = i;
-                /* tx */
-                sta->ampdu_mlme.tid_state_tx[i] = HT_AGG_STATE_IDLE;
-                sta->ampdu_mlme.tid_tx[i] = NULL;
-                sta->ampdu_mlme.addba_req_num[i] = 0;
         }
         skb_queue_head_init(&sta->ps_tx_buf);
         skb_queue_head_init(&sta->tx_filtered);
@@ -647,15 +647,7 @@ static int __must_check __sta_info_destroy(struct sta_info *sta)
                 return ret;
 
         if (sta->key) {
-                ieee80211_key_free(sta->key);
-                /*
-                 * We have only unlinked the key, and actually destroying it
-                 * may mean it is removed from hardware which requires that
-                 * the key->sta pointer is still valid, so flush the key todo
-                 * list here.
-                 */
-                ieee80211_key_todo();
-
+                ieee80211_key_free(local, sta->key);
                 WARN_ON(sta->key);
         }
 
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index df9d45544ca5..54262e72376d 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -42,9 +42,6 @@
  *      be in the queues
  * @WLAN_STA_PSPOLL: Station sent PS-poll while driver was keeping
  *      station in power-save mode, reply when the driver unblocks.
- * @WLAN_STA_DISASSOC: Disassociation in progress.
- *      This is used to reject TX BA session requests when disassociation
- *      is in progress.
  */
 enum ieee80211_sta_info_flags {
         WLAN_STA_AUTH           = 1<<0,
@@ -60,38 +57,44 @@ enum ieee80211_sta_info_flags {
         WLAN_STA_BLOCK_BA       = 1<<11,
         WLAN_STA_PS_DRIVER      = 1<<12,
         WLAN_STA_PSPOLL         = 1<<13,
-        WLAN_STA_DISASSOC       = 1<<14,
 };
 
 #define STA_TID_NUM 16
 #define ADDBA_RESP_INTERVAL HZ
-#define HT_AGG_MAX_RETRIES              (0x3)
+#define HT_AGG_MAX_RETRIES              0x3
 
-#define HT_AGG_STATE_INITIATOR_SHIFT    (4)
-
-#define HT_ADDBA_REQUESTED_MSK          BIT(0)
-#define HT_ADDBA_DRV_READY_MSK          BIT(1)
-#define HT_ADDBA_RECEIVED_MSK           BIT(2)
-#define HT_AGG_STATE_REQ_STOP_BA_MSK    BIT(3)
-#define HT_AGG_STATE_INITIATOR_MSK      BIT(HT_AGG_STATE_INITIATOR_SHIFT)
-#define HT_AGG_STATE_IDLE               (0x0)
-#define HT_AGG_STATE_OPERATIONAL        (HT_ADDBA_REQUESTED_MSK |       \
-                                         HT_ADDBA_DRV_READY_MSK |       \
-                                         HT_ADDBA_RECEIVED_MSK)
+#define HT_AGG_STATE_DRV_READY          0
+#define HT_AGG_STATE_RESPONSE_RECEIVED  1
+#define HT_AGG_STATE_OPERATIONAL        2
+#define HT_AGG_STATE_STOPPING           3
+#define HT_AGG_STATE_WANT_START         4
+#define HT_AGG_STATE_WANT_STOP          5
 
 /**
  * struct tid_ampdu_tx - TID aggregation information (Tx).
  *
+ * @rcu_head: rcu head for freeing structure
  * @addba_resp_timer: timer for peer's response to addba request
  * @pending: pending frames queue -- use sta's spinlock to protect
- * @ssn: Starting Sequence Number expected to be aggregated.
  * @dialog_token: dialog token for aggregation session
+ * @state: session state (see above)
+ * @stop_initiator: initiator of a session stop
+ *
+ * This structure is protected by RCU and the per-station
+ * spinlock. Assignments to the array holding it must hold
+ * the spinlock, only the TX path can access it under RCU
+ * lock-free if, and only if, the state has  the flag
+ * %HT_AGG_STATE_OPERATIONAL set. Otherwise, the TX path
+ * must also acquire the spinlock and re-check the state,
+ * see comments in the tx code touching it.
  */
 struct tid_ampdu_tx {
+        struct rcu_head rcu_head;
         struct timer_list addba_resp_timer;
         struct sk_buff_head pending;
-        u16 ssn;
+        unsigned long state;
         u8 dialog_token;
+        u8 stop_initiator;
 };
 
 /**
@@ -106,8 +109,18 @@ struct tid_ampdu_tx {
  * @buf_size: buffer size for incoming A-MPDUs
  * @timeout: reset timer value (in TUs).
  * @dialog_token: dialog token for aggregation session
+ * @rcu_head: RCU head used for freeing this struct
+ *
+ * This structure is protected by RCU and the per-station
+ * spinlock. Assignments to the array holding it must hold
+ * the spinlock, only the RX path can access it under RCU
+ * lock-free. The RX path, since it is single-threaded,
+ * can even modify the structure without locking since the
+ * only other modifications to it are done when the struct
+ * can not yet or no longer be found by the RX path.
  */
 struct tid_ampdu_rx {
+        struct rcu_head rcu_head;
         struct sk_buff **reorder_buf;
         unsigned long *reorder_time;
         struct timer_list session_timer;
@@ -120,6 +133,32 @@ struct tid_ampdu_rx {
 };
 
 /**
+ * struct sta_ampdu_mlme - STA aggregation information.
+ *
+ * @tid_rx: aggregation info for Rx per TID -- RCU protected
+ * @tid_tx: aggregation info for Tx per TID
+ * @addba_req_num: number of times addBA request has been sent.
+ * @dialog_token_allocator: dialog token enumerator for each new session;
+ * @work: work struct for starting/stopping aggregation
+ * @tid_rx_timer_expired: bitmap indicating on which TIDs the
+ *      RX timer expired until the work for it runs
+ * @mtx: mutex to protect all TX data (except non-NULL assignments
+ *      to tid_tx[idx], which are protected by the sta spinlock)
+ */
+struct sta_ampdu_mlme {
+        struct mutex mtx;
+        /* rx */
+        struct tid_ampdu_rx *tid_rx[STA_TID_NUM];
+        unsigned long tid_rx_timer_expired[BITS_TO_LONGS(STA_TID_NUM)];
+        /* tx */
+        struct work_struct work;
+        struct tid_ampdu_tx *tid_tx[STA_TID_NUM];
+        u8 addba_req_num[STA_TID_NUM];
+        u8 dialog_token_allocator;
+};
+
+
+/**
  * enum plink_state - state of a mesh peer link finite state machine
  *
  * @PLINK_LISTEN: initial state, considered the implicit state of non existant
@@ -143,28 +182,6 @@ enum plink_state {
 };
 
 /**
- * struct sta_ampdu_mlme - STA aggregation information.
- *
- * @tid_active_rx: TID's state in Rx session state machine.
- * @tid_rx: aggregation info for Rx per TID
- * @tid_state_tx: TID's state in Tx session state machine.
- * @tid_tx: aggregation info for Tx per TID
- * @addba_req_num: number of times addBA request has been sent.
- * @dialog_token_allocator: dialog token enumerator for each new session;
- */
-struct sta_ampdu_mlme {
-        /* rx */
-        bool tid_active_rx[STA_TID_NUM];
-        struct tid_ampdu_rx *tid_rx[STA_TID_NUM];
-        /* tx */
-        u8 tid_state_tx[STA_TID_NUM];
-        struct tid_ampdu_tx *tid_tx[STA_TID_NUM];
-        u8 addba_req_num[STA_TID_NUM];
-        u8 dialog_token_allocator;
-};
-
-
-/**
  * struct sta_info - STA information
  *
  * This structure collects information about a station that
@@ -410,20 +427,20 @@ void for_each_sta_info_type_check(struct ieee80211_local *local,
 {
 }
 
-#define for_each_sta_info(local, _addr, sta, nxt)                       \
+#define for_each_sta_info(local, _addr, _sta, nxt)                      \
         for (   /* initialise loop */                                   \
-                sta = rcu_dereference(local->sta_hash[STA_HASH(_addr)]),\
-                nxt = sta ? rcu_dereference(sta->hnext) : NULL;         \
+                _sta = rcu_dereference(local->sta_hash[STA_HASH(_addr)]),\
+                nxt = _sta ? rcu_dereference(_sta->hnext) : NULL;       \
                 /* typecheck */                                         \
-                for_each_sta_info_type_check(local, (_addr), sta, nxt), \
+                for_each_sta_info_type_check(local, (_addr), _sta, nxt),\
                 /* continue condition */                                \
-                sta;                                                    \
+                _sta;                                                   \
                 /* advance loop */                                      \
-                sta = nxt,                                              \
-                nxt = sta ? rcu_dereference(sta->hnext) : NULL          \
+                _sta = nxt,                                             \
+                nxt = _sta ? rcu_dereference(_sta->hnext) : NULL        \
              )                                                          \
         /* compare address and run code only if it matches */           \
-        if (memcmp(sta->sta.addr, (_addr), ETH_ALEN) == 0)
+        if (memcmp(_sta->sta.addr, (_addr), ETH_ALEN) == 0)
 
 /*
  * Get STA info by index, BROKEN!
diff --git a/net/mac80211/status.c b/net/mac80211/status.c
index 94613af009f3..10caec5ea8fa 100644
--- a/net/mac80211/status.c
+++ b/net/mac80211/status.c
@@ -47,7 +47,7 @@ static void ieee80211_handle_filtered_frame(struct ieee80211_local *local,
         /*
          * This skb 'survived' a round-trip through the driver, and
          * hopefully the driver didn't mangle it too badly. However,
-         * we can definitely not rely on the the control information
+         * we can definitely not rely on the control information
          * being correct. Clear it so we don't get junk there, and
          * indicate that it needs new processing, but must not be
          * modified/encrypted again.
@@ -377,7 +377,7 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
                                 skb2 = skb_clone(skb, GFP_ATOMIC);
                                 if (skb2) {
                                         skb2->dev = prev_dev;
-                                        netif_rx(skb2);
+                                        netif_receive_skb(skb2);
                                 }
                         }
 
@@ -386,7 +386,7 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
         }
         if (prev_dev) {
                 skb->dev = prev_dev;
-                netif_rx(skb);
+                netif_receive_skb(skb);
                 skb = NULL;
         }
         rcu_read_unlock();
diff --git a/net/mac80211/tkip.c b/net/mac80211/tkip.c
index 7ef491e9d66d..e840c9cd46db 100644
--- a/net/mac80211/tkip.c
+++ b/net/mac80211/tkip.c
@@ -202,9 +202,9 @@ EXPORT_SYMBOL(ieee80211_get_tkip_key);
  * @payload_len is the length of payload (_not_ including IV/ICV length).
  * @ta is the transmitter addresses.
  */
-void ieee80211_tkip_encrypt_data(struct crypto_blkcipher *tfm,
-                                 struct ieee80211_key *key,
-                                 u8 *pos, size_t payload_len, u8 *ta)
+int ieee80211_tkip_encrypt_data(struct crypto_blkcipher *tfm,
+                                struct ieee80211_key *key,
+                                u8 *pos, size_t payload_len, u8 *ta)
 {
         u8 rc4key[16];
         struct tkip_ctx *ctx = &key->u.tkip.tx;
@@ -216,7 +216,7 @@ void ieee80211_tkip_encrypt_data(struct crypto_blkcipher *tfm,
 
         tkip_mixing_phase2(tk, ctx, ctx->iv16, rc4key);
 
-        ieee80211_wep_encrypt_data(tfm, rc4key, 16, pos, payload_len);
+        return ieee80211_wep_encrypt_data(tfm, rc4key, 16, pos, payload_len);
 }
 
 /* Decrypt packet payload with TKIP using @key. @pos is a pointer to the
diff --git a/net/mac80211/tkip.h b/net/mac80211/tkip.h
index d4714383f5fc..7e83dee976fa 100644
--- a/net/mac80211/tkip.h
+++ b/net/mac80211/tkip.h
@@ -15,7 +15,7 @@
 
 u8 *ieee80211_tkip_add_iv(u8 *pos, struct ieee80211_key *key, u16 iv16);
 
-void ieee80211_tkip_encrypt_data(struct crypto_blkcipher *tfm,
+int ieee80211_tkip_encrypt_data(struct crypto_blkcipher *tfm,
                                  struct ieee80211_key *key,
                                  u8 *pos, size_t payload_len, u8 *ta);
 enum {
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 680bcb7093db..c54db966926b 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -576,17 +576,6 @@ ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx)
 }
 
 static ieee80211_tx_result debug_noinline
-ieee80211_tx_h_sta(struct ieee80211_tx_data *tx)
-{
-        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
-
-        if (tx->sta && tx->sta->uploaded)
-                info->control.sta = &tx->sta->sta;
-
-        return TX_CONTINUE;
-}
-
-static ieee80211_tx_result debug_noinline
 ieee80211_tx_h_rate_ctrl(struct ieee80211_tx_data *tx)
 {
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
@@ -1092,6 +1081,59 @@ static bool __ieee80211_parse_tx_radiotap(struct ieee80211_tx_data *tx,
         return true;
 }
 
+static bool ieee80211_tx_prep_agg(struct ieee80211_tx_data *tx,
+                                  struct sk_buff *skb,
+                                  struct ieee80211_tx_info *info,
+                                  struct tid_ampdu_tx *tid_tx,
+                                  int tid)
+{
+        bool queued = false;
+
+        if (test_bit(HT_AGG_STATE_OPERATIONAL, &tid_tx->state)) {
+                info->flags |= IEEE80211_TX_CTL_AMPDU;
+        } else if (test_bit(HT_AGG_STATE_WANT_START, &tid_tx->state)) {
+                /*
+                 * nothing -- this aggregation session is being started
+                 * but that might still fail with the driver
+                 */
+        } else {
+                spin_lock(&tx->sta->lock);
+                /*
+                 * Need to re-check now, because we may get here
+                 *
+                 *  1) in the window during which the setup is actually
+                 *     already done, but not marked yet because not all
+                 *     packets are spliced over to the driver pending
+                 *     queue yet -- if this happened we acquire the lock
+                 *     either before or after the splice happens, but
+                 *     need to recheck which of these cases happened.
+                 *
+                 *  2) during session teardown, if the OPERATIONAL bit
+                 *     was cleared due to the teardown but the pointer
+                 *     hasn't been assigned NULL yet (or we loaded it
+                 *     before it was assigned) -- in this case it may
+                 *     now be NULL which means we should just let the
+                 *     packet pass through because splicing the frames
+                 *     back is already done.
+                 */
+                tid_tx = tx->sta->ampdu_mlme.tid_tx[tid];
+
+                if (!tid_tx) {
+                        /* do nothing, let packet pass through */
+                } else if (test_bit(HT_AGG_STATE_OPERATIONAL, &tid_tx->state)) {
+                        info->flags |= IEEE80211_TX_CTL_AMPDU;
+                } else {
+                        queued = true;
+                        info->control.vif = &tx->sdata->vif;
+                        info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
+                        __skb_queue_tail(&tid_tx->pending, skb);
+                }
+                spin_unlock(&tx->sta->lock);
+        }
+
+        return queued;
+}
+
 /*
  * initialises @tx
  */
@@ -1104,8 +1146,7 @@ ieee80211_tx_prepare(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_hdr *hdr;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         int hdrlen, tid;
-        u8 *qc, *state;
-        bool queued = false;
+        u8 *qc;
 
         memset(tx, 0, sizeof(*tx));
         tx->skb = skb;
@@ -1157,35 +1198,16 @@ ieee80211_tx_prepare(struct ieee80211_sub_if_data *sdata,
                 qc = ieee80211_get_qos_ctl(hdr);
                 tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
 
-                spin_lock(&tx->sta->lock);
-                /*
-                 * XXX: This spinlock could be fairly expensive, but see the
-                 *      comment in agg-tx.c:ieee80211_agg_tx_operational().
-                 *      One way to solve this would be to do something RCU-like
-                 *      for managing the tid_tx struct and using atomic bitops
-                 *      for the actual state -- by introducing an actual
-                 *      'operational' bit that would be possible. It would
-                 *      require changing ieee80211_agg_tx_operational() to
-                 *      set that bit, and changing the way tid_tx is managed
-                 *      everywhere, including races between that bit and
-                 *      tid_tx going away (tid_tx being added can be easily
-                 *      committed to memory before the 'operational' bit).
-                 */
-                tid_tx = tx->sta->ampdu_mlme.tid_tx[tid];
-                state = &tx->sta->ampdu_mlme.tid_state_tx[tid];
-                if (*state == HT_AGG_STATE_OPERATIONAL) {
-                        info->flags |= IEEE80211_TX_CTL_AMPDU;
-                } else if (*state != HT_AGG_STATE_IDLE) {
-                        /* in progress */
-                        queued = true;
-                        info->control.vif = &sdata->vif;
-                        info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
-                        __skb_queue_tail(&tid_tx->pending, skb);
-                }
-                spin_unlock(&tx->sta->lock);
+                tid_tx = rcu_dereference(tx->sta->ampdu_mlme.tid_tx[tid]);
+                if (tid_tx) {
+                        bool queued;
 
-                if (unlikely(queued))
-                        return TX_QUEUED;
+                        queued = ieee80211_tx_prep_agg(tx, skb, info,
+                                                       tid_tx, tid);
+
+                        if (unlikely(queued))
+                                return TX_QUEUED;
+                }
         }
 
         if (is_multicast_ether_addr(hdr->addr1)) {
@@ -1274,6 +1296,11 @@ static int __ieee80211_tx(struct ieee80211_local *local,
                         break;
                 }
 
+                if (sta && sta->uploaded)
+                        info->control.sta = &sta->sta;
+                else
+                        info->control.sta = NULL;
+
                 ret = drv_tx(local, skb);
                 if (WARN_ON(ret != NETDEV_TX_OK && skb->len != len)) {
                         dev_kfree_skb(skb);
@@ -1313,7 +1340,6 @@ static int invoke_tx_handlers(struct ieee80211_tx_data *tx)
         CALL_TXH(ieee80211_tx_h_check_assoc);
         CALL_TXH(ieee80211_tx_h_ps_buf);
         CALL_TXH(ieee80211_tx_h_select_key);
-        CALL_TXH(ieee80211_tx_h_sta);
         if (!(tx->local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL))
                 CALL_TXH(ieee80211_tx_h_rate_ctrl);
 
@@ -1909,11 +1935,13 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
                 h_pos += encaps_len;
         }
 
+#ifdef CONFIG_MAC80211_MESH
         if (meshhdrlen > 0) {
                 memcpy(skb_push(skb, meshhdrlen), &mesh_hdr, meshhdrlen);
                 nh_pos += meshhdrlen;
                 h_pos += meshhdrlen;
         }
+#endif
 
         if (ieee80211_is_data_qos(fc)) {
                 __le16 *qos_control;
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 5b79d552780a..748387d45bc0 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -803,8 +803,12 @@ void ieee80211_set_wmm_default(struct ieee80211_sub_if_data *sdata)
 
         /* after reinitialize QoS TX queues setting to default,
          * disable QoS at all */
-        local->hw.conf.flags &= ~IEEE80211_CONF_QOS;
-        drv_config(local, IEEE80211_CONF_CHANGE_QOS);
+
+        if (sdata->vif.type != NL80211_IFTYPE_MONITOR) {
+                sdata->vif.bss_conf.qos =
+                        sdata->vif.type != NL80211_IFTYPE_STATION;
+                ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_QOS);
+        }
 }
 
 void ieee80211_sta_def_wmm_params(struct ieee80211_sub_if_data *sdata,
@@ -1138,18 +1142,6 @@ int ieee80211_reconfig(struct ieee80211_local *local)
         }
         mutex_unlock(&local->sta_mtx);
 
-        /* Clear Suspend state so that ADDBA requests can be processed */
-
-        rcu_read_lock();
-
-        if (hw->flags & IEEE80211_HW_AMPDU_AGGREGATION) {
-                list_for_each_entry_rcu(sta, &local->sta_list, list) {
-                        clear_sta_flags(sta, WLAN_STA_BLOCK_BA);
-                }
-        }
-
-        rcu_read_unlock();
-
         /* setup RTS threshold */
         drv_set_rts_threshold(local, hw->wiphy->rts_threshold);
 
@@ -1173,7 +1165,8 @@ int ieee80211_reconfig(struct ieee80211_local *local)
                           BSS_CHANGED_BASIC_RATES |
                           BSS_CHANGED_BEACON_INT |
                           BSS_CHANGED_BSSID |
-                          BSS_CHANGED_CQM;
+                          BSS_CHANGED_CQM |
+                          BSS_CHANGED_QOS;
 
                 switch (sdata->vif.type) {
                 case NL80211_IFTYPE_STATION:
@@ -1202,13 +1195,26 @@ int ieee80211_reconfig(struct ieee80211_local *local)
                 }
         }
 
-        rcu_read_lock();
+        /*
+         * Clear the WLAN_STA_BLOCK_BA flag so new aggregation
+         * sessions can be established after a resume.
+         *
+         * Also tear down aggregation sessions since reconfiguring
+         * them in a hardware restart scenario is not easily done
+         * right now, and the hardware will have lost information
+         * about the sessions, but we and the AP still think they
+         * are active. This is really a workaround though.
+         */
         if (hw->flags & IEEE80211_HW_AMPDU_AGGREGATION) {
-                list_for_each_entry_rcu(sta, &local->sta_list, list) {
+                mutex_lock(&local->sta_mtx);
+
+                list_for_each_entry(sta, &local->sta_list, list) {
                         ieee80211_sta_tear_down_BA_sessions(sta);
+                        clear_sta_flags(sta, WLAN_STA_BLOCK_BA);
                 }
+
+                mutex_unlock(&local->sta_mtx);
         }
-        rcu_read_unlock();
 
         /* add back keys */
         list_for_each_entry(sdata, &local->interfaces, list)
diff --git a/net/mac80211/wep.c b/net/mac80211/wep.c
index 5f3a4113bda1..9ebc8d8a1f5b 100644
--- a/net/mac80211/wep.c
+++ b/net/mac80211/wep.c
@@ -32,13 +32,16 @@ int ieee80211_wep_init(struct ieee80211_local *local)
 
         local->wep_tx_tfm = crypto_alloc_blkcipher("ecb(arc4)", 0,
                                                 CRYPTO_ALG_ASYNC);
-        if (IS_ERR(local->wep_tx_tfm))
+        if (IS_ERR(local->wep_tx_tfm)) {
+                local->wep_rx_tfm = ERR_PTR(-EINVAL);
                 return PTR_ERR(local->wep_tx_tfm);
+        }
 
         local->wep_rx_tfm = crypto_alloc_blkcipher("ecb(arc4)", 0,
                                                 CRYPTO_ALG_ASYNC);
         if (IS_ERR(local->wep_rx_tfm)) {
                 crypto_free_blkcipher(local->wep_tx_tfm);
+                local->wep_tx_tfm = ERR_PTR(-EINVAL);
                 return PTR_ERR(local->wep_rx_tfm);
         }
 
@@ -47,8 +50,10 @@ int ieee80211_wep_init(struct ieee80211_local *local)
 
 void ieee80211_wep_free(struct ieee80211_local *local)
 {
-        crypto_free_blkcipher(local->wep_tx_tfm);
-        crypto_free_blkcipher(local->wep_rx_tfm);
+        if (!IS_ERR(local->wep_tx_tfm))
+                crypto_free_blkcipher(local->wep_tx_tfm);
+        if (!IS_ERR(local->wep_rx_tfm))
+                crypto_free_blkcipher(local->wep_rx_tfm);
 }
 
 static inline bool ieee80211_wep_weak_iv(u32 iv, int keylen)
@@ -122,19 +127,24 @@ static void ieee80211_wep_remove_iv(struct ieee80211_local *local,
 /* Perform WEP encryption using given key. data buffer must have tailroom
  * for 4-byte ICV. data_len must not include this ICV. Note: this function
  * does _not_ add IV. data = RC4(data | CRC32(data)) */
-void ieee80211_wep_encrypt_data(struct crypto_blkcipher *tfm, u8 *rc4key,
-                                size_t klen, u8 *data, size_t data_len)
+int ieee80211_wep_encrypt_data(struct crypto_blkcipher *tfm, u8 *rc4key,
+                               size_t klen, u8 *data, size_t data_len)
 {
         struct blkcipher_desc desc = { .tfm = tfm };
         struct scatterlist sg;
         __le32 icv;
 
+        if (IS_ERR(tfm))
+                return -1;
+
         icv = cpu_to_le32(~crc32_le(~0, data, data_len));
         put_unaligned(icv, (__le32 *)(data + data_len));
 
         crypto_blkcipher_setkey(tfm, rc4key, klen);
         sg_init_one(&sg, data, data_len + WEP_ICV_LEN);
         crypto_blkcipher_encrypt(&desc, &sg, &sg, sg.length);
+
+        return 0;
 }
 
 
@@ -168,10 +178,8 @@ int ieee80211_wep_encrypt(struct ieee80211_local *local,
         /* Add room for ICV */
         skb_put(skb, WEP_ICV_LEN);
 
-        ieee80211_wep_encrypt_data(local->wep_tx_tfm, rc4key, keylen + 3,
-                                   iv + WEP_IV_LEN, len);
-
-        return 0;
+        return ieee80211_wep_encrypt_data(local->wep_tx_tfm, rc4key, keylen + 3,
+                                          iv + WEP_IV_LEN, len);
 }
 
 
@@ -185,6 +193,9 @@ int ieee80211_wep_decrypt_data(struct crypto_blkcipher *tfm, u8 *rc4key,
         struct scatterlist sg;
         __le32 crc;
 
+        if (IS_ERR(tfm))
+                return -1;
+
         crypto_blkcipher_setkey(tfm, rc4key, klen);
         sg_init_one(&sg, data, data_len + WEP_ICV_LEN);
         crypto_blkcipher_decrypt(&desc, &sg, &sg, sg.length);
diff --git a/net/mac80211/wep.h b/net/mac80211/wep.h
index fe29d7e5759f..58654ee33518 100644
--- a/net/mac80211/wep.h
+++ b/net/mac80211/wep.h
@@ -18,7 +18,7 @@
 
 int ieee80211_wep_init(struct ieee80211_local *local);
 void ieee80211_wep_free(struct ieee80211_local *local);
-void ieee80211_wep_encrypt_data(struct crypto_blkcipher *tfm, u8 *rc4key,
+int ieee80211_wep_encrypt_data(struct crypto_blkcipher *tfm, u8 *rc4key,
                                 size_t klen, u8 *data, size_t data_len);
 int ieee80211_wep_encrypt(struct ieee80211_local *local,
                           struct sk_buff *skb,
diff --git a/net/mac80211/work.c b/net/mac80211/work.c
index b025dc7bb0fd..81d4ad64184a 100644
--- a/net/mac80211/work.c
+++ b/net/mac80211/work.c
@@ -560,6 +560,22 @@ ieee80211_remain_on_channel_timeout(struct ieee80211_work *wk)
         return WORK_ACT_TIMEOUT;
 }
 
+static enum work_action __must_check
+ieee80211_assoc_beacon_wait(struct ieee80211_work *wk)
+{
+        if (wk->started)
+                return WORK_ACT_TIMEOUT;
+
+        /*
+         * Wait up to one beacon interval ...
+         * should this be more if we miss one?
+         */
+        printk(KERN_DEBUG "%s: waiting for beacon from %pM\n",
+               wk->sdata->name, wk->filter_ta);
+        wk->timeout = TU_TO_EXP_TIME(wk->assoc.bss->beacon_interval);
+        return WORK_ACT_NONE;
+}
+
 static void ieee80211_auth_challenge(struct ieee80211_work *wk,
                                      struct ieee80211_mgmt *mgmt,
                                      size_t len)
@@ -709,6 +725,25 @@ ieee80211_rx_mgmt_probe_resp(struct ieee80211_work *wk,
         return WORK_ACT_DONE;
 }
 
+static enum work_action __must_check
+ieee80211_rx_mgmt_beacon(struct ieee80211_work *wk,
+                         struct ieee80211_mgmt *mgmt, size_t len)
+{
+        struct ieee80211_sub_if_data *sdata = wk->sdata;
+        struct ieee80211_local *local = sdata->local;
+
+        ASSERT_WORK_MTX(local);
+
+        if (wk->type != IEEE80211_WORK_ASSOC_BEACON_WAIT)
+                return WORK_ACT_MISMATCH;
+
+        if (len < 24 + 12)
+                return WORK_ACT_NONE;
+
+        printk(KERN_DEBUG "%s: beacon received\n", sdata->name);
+        return WORK_ACT_DONE;
+}
+
 static void ieee80211_work_rx_queued_mgmt(struct ieee80211_local *local,
                                           struct sk_buff *skb)
 {
@@ -731,6 +766,7 @@ static void ieee80211_work_rx_queued_mgmt(struct ieee80211_local *local,
                 case IEEE80211_WORK_DIRECT_PROBE:
                 case IEEE80211_WORK_AUTH:
                 case IEEE80211_WORK_ASSOC:
+                case IEEE80211_WORK_ASSOC_BEACON_WAIT:
                         bssid = wk->filter_ta;
                         break;
                 default:
@@ -745,6 +781,9 @@ static void ieee80211_work_rx_queued_mgmt(struct ieee80211_local *local,
                         continue;
 
                 switch (fc & IEEE80211_FCTL_STYPE) {
+                case IEEE80211_STYPE_BEACON:
+                        rma = ieee80211_rx_mgmt_beacon(wk, mgmt, skb->len);
+                        break;
                 case IEEE80211_STYPE_PROBE_RESP:
                         rma = ieee80211_rx_mgmt_probe_resp(wk, mgmt, skb->len,
                                                            rx_status);
@@ -840,7 +879,7 @@ static void ieee80211_work_work(struct work_struct *work)
 
         /*
          * ieee80211_queue_work() should have picked up most cases,
-         * here we'll pick the the rest.
+         * here we'll pick the rest.
          */
         if (WARN(local->suspended, "work scheduled while going to suspend\n"))
                 return;
@@ -916,6 +955,9 @@ static void ieee80211_work_work(struct work_struct *work)
                 case IEEE80211_WORK_REMAIN_ON_CHANNEL:
                         rma = ieee80211_remain_on_channel_timeout(wk);
                         break;
+                case IEEE80211_WORK_ASSOC_BEACON_WAIT:
+                        rma = ieee80211_assoc_beacon_wait(wk);
+                        break;
                 }
 
                 wk->started = started;
@@ -1065,6 +1107,7 @@ ieee80211_rx_result ieee80211_work_rx_mgmt(struct ieee80211_sub_if_data *sdata,
                 case IEEE80211_STYPE_PROBE_RESP:
                 case IEEE80211_STYPE_ASSOC_RESP:
                 case IEEE80211_STYPE_REASSOC_RESP:
+                case IEEE80211_STYPE_BEACON:
                         skb_queue_tail(&local->work_skb_queue, skb);
                         ieee80211_queue_work(&local->hw, &local->work_work);
                         return RX_QUEUED;
diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c
index 0adbcc941ac9..8d59d27d887e 100644
--- a/net/mac80211/wpa.c
+++ b/net/mac80211/wpa.c
@@ -183,9 +183,8 @@ static int tkip_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
         skb_put(skb, TKIP_ICV_LEN);
 
         hdr = (struct ieee80211_hdr *) skb->data;
-        ieee80211_tkip_encrypt_data(tx->local->wep_tx_tfm,
-                                    key, pos, len, hdr->addr2);
-        return 0;
+        return ieee80211_tkip_encrypt_data(tx->local->wep_tx_tfm,
+                                           key, pos, len, hdr->addr2);
 }
 
 
@@ -436,6 +435,7 @@ ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx)
         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
         u8 pn[CCMP_PN_LEN];
         int data_len;
+        int queue;
 
         hdrlen = ieee80211_hdrlen(hdr->frame_control);
 
@@ -453,7 +453,10 @@ ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx)
 
         ccmp_hdr2pn(pn, skb->data + hdrlen);
 
-        if (memcmp(pn, key->u.ccmp.rx_pn[rx->queue], CCMP_PN_LEN) <= 0) {
+        queue = ieee80211_is_mgmt(hdr->frame_control) ?
+                NUM_RX_DATA_QUEUES : rx->queue;
+
+        if (memcmp(pn, key->u.ccmp.rx_pn[queue], CCMP_PN_LEN) <= 0) {
                 key->u.ccmp.replays++;
                 return RX_DROP_UNUSABLE;
         }
@@ -470,7 +473,7 @@ ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx)
                         return RX_DROP_UNUSABLE;
         }
 
-        memcpy(key->u.ccmp.rx_pn[rx->queue], pn, CCMP_PN_LEN);
+        memcpy(key->u.ccmp.rx_pn[queue], pn, CCMP_PN_LEN);
 
         /* Remove CCMP header and MIC */
         skb_trim(skb, skb->len - CCMP_MIC_LEN);