Merge branch 'osd-devel' into nfs-for-next

36 files changed, 3355 insertions, 1657 deletions

diff --git a/net/mac80211/Kconfig b/net/mac80211/Kconfig
index f5fdfcbf552a..7d3b438755f0 100644
--- a/net/mac80211/Kconfig
+++ b/net/mac80211/Kconfig
@@ -199,6 +199,19 @@ config MAC80211_VERBOSE_MPL_DEBUG
 
           Do not select this option.
 
+config MAC80211_VERBOSE_MPATH_DEBUG
+        bool "Verbose mesh path debugging"
+        depends on MAC80211_DEBUG_MENU
+        depends on MAC80211_MESH
+        ---help---
+          Selecting this option causes mac80211 to print out very
+          verbose mesh path selection debugging messages (when mac80211
+          is taking part in a mesh network).
+          It should not be selected on production systems as those
+          messages are remotely triggerable.
+
+          Do not select this option.
+
 config MAC80211_VERBOSE_MHWMP_DEBUG
         bool "Verbose mesh HWMP routing debugging"
         depends on MAC80211_DEBUG_MENU
@@ -212,6 +225,18 @@ config MAC80211_VERBOSE_MHWMP_DEBUG
 
           Do not select this option.
 
+config MAC80211_VERBOSE_TDLS_DEBUG
+        bool "Verbose TDLS debugging"
+        depends on MAC80211_DEBUG_MENU
+        ---help---
+          Selecting this option causes mac80211 to print out very
+          verbose TDLS selection debugging messages (when mac80211
+          is a TDLS STA).
+          It should not be selected on production systems as those
+          messages are remotely triggerable.
+
+          Do not select this option.
+
 config MAC80211_DEBUG_COUNTERS
         bool "Extra statistics for TX/RX debugging"
         depends on MAC80211_DEBUG_MENU
diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c
index fd1aaf2a4a6c..97f33588b65f 100644
--- a/net/mac80211/agg-rx.c
+++ b/net/mac80211/agg-rx.c
@@ -69,7 +69,7 @@ void ___ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid,
         if (!tid_rx)
                 return;
 
-        rcu_assign_pointer(sta->ampdu_mlme.tid_rx[tid], NULL);
+        RCU_INIT_POINTER(sta->ampdu_mlme.tid_rx[tid], NULL);
 
 #ifdef CONFIG_MAC80211_HT_DEBUG
         printk(KERN_DEBUG "Rx BA session stop requested for %pM tid %u\n",
@@ -167,12 +167,8 @@ static void ieee80211_send_addba_resp(struct ieee80211_sub_if_data *sdata, u8 *d
         u16 capab;
 
         skb = dev_alloc_skb(sizeof(*mgmt) + local->hw.extra_tx_headroom);
-
-        if (!skb) {
-                printk(KERN_DEBUG "%s: failed to allocate buffer "
-                       "for addba resp frame\n", sdata->name);
+        if (!skb)
                 return;
-        }
 
         skb_reserve(skb, local->hw.extra_tx_headroom);
         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
@@ -227,7 +223,7 @@ void ieee80211_process_addba_request(struct ieee80211_local *local,
 
         status = WLAN_STATUS_REQUEST_DECLINED;
 
-        if (test_sta_flags(sta, WLAN_STA_BLOCK_BA)) {
+        if (test_sta_flag(sta, WLAN_STA_BLOCK_BA)) {
 #ifdef CONFIG_MAC80211_HT_DEBUG
                 printk(KERN_DEBUG "Suspend in progress. "
                        "Denying ADDBA request\n");
@@ -279,14 +275,8 @@ void ieee80211_process_addba_request(struct ieee80211_local *local,
 
         /* prepare A-MPDU MLME for Rx aggregation */
         tid_agg_rx = kmalloc(sizeof(struct tid_ampdu_rx), GFP_KERNEL);
-        if (!tid_agg_rx) {
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                if (net_ratelimit())
-                        printk(KERN_ERR "allocate rx mlme to tid %d failed\n",
-                                        tid);
-#endif
+        if (!tid_agg_rx)
                 goto end;
-        }
 
         spin_lock_init(&tid_agg_rx->reorder_lock);
 
@@ -306,11 +296,6 @@ void ieee80211_process_addba_request(struct ieee80211_local *local,
         tid_agg_rx->reorder_time =
                 kcalloc(buf_size, sizeof(unsigned long), GFP_KERNEL);
         if (!tid_agg_rx->reorder_buf || !tid_agg_rx->reorder_time) {
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                if (net_ratelimit())
-                        printk(KERN_ERR "can not allocate reordering buffer "
-                               "to tid %d\n", tid);
-#endif
                 kfree(tid_agg_rx->reorder_buf);
                 kfree(tid_agg_rx->reorder_time);
                 kfree(tid_agg_rx);
@@ -340,7 +325,7 @@ void ieee80211_process_addba_request(struct ieee80211_local *local,
         status = WLAN_STATUS_SUCCESS;
 
         /* activate it for RX */
-        rcu_assign_pointer(sta->ampdu_mlme.tid_rx[tid], tid_agg_rx);
+        RCU_INIT_POINTER(sta->ampdu_mlme.tid_rx[tid], tid_agg_rx);
 
         if (timeout)
                 mod_timer(&tid_agg_rx->session_timer, TU_TO_EXP_TIME(timeout));
diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index c8be8eff70da..2ac033989e01 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -68,11 +68,9 @@ static void ieee80211_send_addba_request(struct ieee80211_sub_if_data *sdata,
 
         skb = dev_alloc_skb(sizeof(*mgmt) + local->hw.extra_tx_headroom);
 
-        if (!skb) {
-                printk(KERN_ERR "%s: failed to allocate buffer "
-                                "for addba request frame\n", sdata->name);
+        if (!skb)
                 return;
-        }
+
         skb_reserve(skb, local->hw.extra_tx_headroom);
         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
         memset(mgmt, 0, 24);
@@ -106,19 +104,18 @@ static void ieee80211_send_addba_request(struct ieee80211_sub_if_data *sdata,
         ieee80211_tx_skb(sdata, skb);
 }
 
-void ieee80211_send_bar(struct ieee80211_sub_if_data *sdata, u8 *ra, u16 tid, u16 ssn)
+void ieee80211_send_bar(struct ieee80211_vif *vif, u8 *ra, u16 tid, u16 ssn)
 {
+        struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
         struct ieee80211_local *local = sdata->local;
         struct sk_buff *skb;
         struct ieee80211_bar *bar;
         u16 bar_control = 0;
 
         skb = dev_alloc_skb(sizeof(*bar) + local->hw.extra_tx_headroom);
-        if (!skb) {
-                printk(KERN_ERR "%s: failed to allocate buffer for "
-                        "bar frame\n", sdata->name);
+        if (!skb)
                 return;
-        }
+
         skb_reserve(skb, local->hw.extra_tx_headroom);
         bar = (struct ieee80211_bar *)skb_put(skb, sizeof(*bar));
         memset(bar, 0, sizeof(*bar));
@@ -128,13 +125,14 @@ void ieee80211_send_bar(struct ieee80211_sub_if_data *sdata, u8 *ra, u16 tid, u1
         memcpy(bar->ta, sdata->vif.addr, ETH_ALEN);
         bar_control |= (u16)IEEE80211_BAR_CTRL_ACK_POLICY_NORMAL;
         bar_control |= (u16)IEEE80211_BAR_CTRL_CBMTID_COMPRESSED_BA;
-        bar_control |= (u16)(tid << 12);
+        bar_control |= (u16)(tid << IEEE80211_BAR_CTRL_TID_INFO_SHIFT);
         bar->control = cpu_to_le16(bar_control);
         bar->start_seq_num = cpu_to_le16(ssn);
 
         IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
         ieee80211_tx_skb(sdata, skb);
 }
+EXPORT_SYMBOL(ieee80211_send_bar);
 
 void ieee80211_assign_tid_tx(struct sta_info *sta, int tid,
                              struct tid_ampdu_tx *tid_tx)
@@ -364,7 +362,8 @@ int ieee80211_start_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid,
                 return -EINVAL;
 
         if ((tid >= STA_TID_NUM) ||
-            !(local->hw.flags & IEEE80211_HW_AMPDU_AGGREGATION))
+            !(local->hw.flags & IEEE80211_HW_AMPDU_AGGREGATION) ||
+            (local->hw.flags & IEEE80211_HW_TX_AMPDU_SETUP_IN_HW))
                 return -EINVAL;
 
 #ifdef CONFIG_MAC80211_HT_DEBUG
@@ -383,7 +382,7 @@ int ieee80211_start_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid,
             sdata->vif.type != NL80211_IFTYPE_AP)
                 return -EINVAL;
 
-        if (test_sta_flags(sta, WLAN_STA_BLOCK_BA)) {
+        if (test_sta_flag(sta, WLAN_STA_BLOCK_BA)) {
 #ifdef CONFIG_MAC80211_HT_DEBUG
                 printk(KERN_DEBUG "BA sessions blocked. "
                        "Denying BA session request\n");
@@ -413,11 +412,6 @@ int ieee80211_start_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid,
         /* prepare A-MPDU MLME for Tx aggregation */
         tid_tx = kzalloc(sizeof(struct tid_ampdu_tx), GFP_ATOMIC);
         if (!tid_tx) {
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                if (net_ratelimit())
-                        printk(KERN_ERR "allocate tx mlme to tid %d failed\n",
-                                        tid);
-#endif
                 ret = -ENOMEM;
                 goto err_unlock_sta;
         }
@@ -574,14 +568,9 @@ void ieee80211_start_tx_ba_cb_irqsafe(struct ieee80211_vif *vif,
         struct ieee80211_ra_tid *ra_tid;
         struct sk_buff *skb = dev_alloc_skb(0);
 
-        if (unlikely(!skb)) {
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                if (net_ratelimit())
-                        printk(KERN_WARNING "%s: Not enough memory, "
-                               "dropping start BA session", sdata->name);
-#endif
+        if (unlikely(!skb))
                 return;
-        }
+
         ra_tid = (struct ieee80211_ra_tid *) &skb->cb;
         memcpy(&ra_tid->ra, ra, ETH_ALEN);
         ra_tid->tid = tid;
@@ -727,14 +716,9 @@ void ieee80211_stop_tx_ba_cb_irqsafe(struct ieee80211_vif *vif,
         struct ieee80211_ra_tid *ra_tid;
         struct sk_buff *skb = dev_alloc_skb(0);
 
-        if (unlikely(!skb)) {
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                if (net_ratelimit())
-                        printk(KERN_WARNING "%s: Not enough memory, "
-                               "dropping stop BA session", sdata->name);
-#endif
+        if (unlikely(!skb))
                 return;
-        }
+
         ra_tid = (struct ieee80211_ra_tid *) &skb->cb;
         memcpy(&ra_tid->ra, ra, ETH_ALEN);
         ra_tid->tid = tid;
@@ -777,18 +761,14 @@ void ieee80211_process_addba_resp(struct ieee80211_local *local,
 #ifdef CONFIG_MAC80211_HT_DEBUG
         printk(KERN_DEBUG "switched off addBA timer for tid %d\n", tid);
 #endif
-
+        /*
+         * IEEE 802.11-2007 7.3.1.14:
+         * In an ADDBA Response frame, when the Status Code field
+         * is set to 0, the Buffer Size subfield is set to a value
+         * of at least 1.
+         */
         if (le16_to_cpu(mgmt->u.action.u.addba_resp.status)
-                        == WLAN_STATUS_SUCCESS) {
-                /*
-                 * IEEE 802.11-2007 7.3.1.14:
-                 * In an ADDBA Response frame, when the Status Code field
-                 * is set to 0, the Buffer Size subfield is set to a value
-                 * of at least 1.
-                 */
-                if (!buf_size)
-                        goto out;
-
+                        == WLAN_STATUS_SUCCESS && buf_size) {
                 if (test_and_set_bit(HT_AGG_STATE_RESPONSE_RECEIVED,
                                      &tid_tx->state)) {
                         /* ignore duplicate response */
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 3d1b091d9b2e..ebd7fb101fbf 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -12,6 +12,7 @@
 #include <linux/slab.h>
 #include <net/net_namespace.h>
 #include <linux/rcupdate.h>
+#include <linux/if_ether.h>
 #include <net/cfg80211.h>
 #include "ieee80211_i.h"
 #include "driver-ops.h"
@@ -62,7 +63,7 @@ static int ieee80211_change_iface(struct wiphy *wiphy,
 
         if (type == NL80211_IFTYPE_AP_VLAN &&
             params && params->use_4addr == 0)
-                rcu_assign_pointer(sdata->u.vlan.sta, NULL);
+                RCU_INIT_POINTER(sdata->u.vlan.sta, NULL);
         else if (type == NL80211_IFTYPE_STATION &&
                  params && params->use_4addr >= 0)
                 sdata->u.mgd.use_4addr = params->use_4addr;
@@ -343,7 +344,8 @@ static void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
                         STATION_INFO_RX_BITRATE |
                         STATION_INFO_RX_DROP_MISC |
                         STATION_INFO_BSS_PARAM |
-                        STATION_INFO_CONNECTED_TIME;
+                        STATION_INFO_CONNECTED_TIME |
+                        STATION_INFO_STA_FLAGS;
 
         do_posix_clock_monotonic_gettime(&uptime);
         sinfo->connected_time = uptime.tv_sec - sta->last_connected;
@@ -403,6 +405,23 @@ static void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
                 sinfo->bss_param.flags |= BSS_PARAM_FLAGS_SHORT_SLOT_TIME;
         sinfo->bss_param.dtim_period = sdata->local->hw.conf.ps_dtim_period;
         sinfo->bss_param.beacon_interval = sdata->vif.bss_conf.beacon_int;
+
+        sinfo->sta_flags.set = 0;
+        sinfo->sta_flags.mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
+                                BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
+                                BIT(NL80211_STA_FLAG_WME) |
+                                BIT(NL80211_STA_FLAG_MFP) |
+                                BIT(NL80211_STA_FLAG_AUTHENTICATED);
+        if (test_sta_flag(sta, WLAN_STA_AUTHORIZED))
+                sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_AUTHORIZED);
+        if (test_sta_flag(sta, WLAN_STA_SHORT_PREAMBLE))
+                sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_SHORT_PREAMBLE);
+        if (test_sta_flag(sta, WLAN_STA_WME))
+                sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_WME);
+        if (test_sta_flag(sta, WLAN_STA_MFP))
+                sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_MFP);
+        if (test_sta_flag(sta, WLAN_STA_AUTH))
+                sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_AUTHENTICATED);
 }
 
 
@@ -455,6 +474,20 @@ static int ieee80211_get_station(struct wiphy *wiphy, struct net_device *dev,
         return ret;
 }
 
+static void ieee80211_config_ap_ssid(struct ieee80211_sub_if_data *sdata,
+                                     struct beacon_parameters *params)
+{
+        struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
+
+        bss_conf->ssid_len = params->ssid_len;
+
+        if (params->ssid_len)
+                memcpy(bss_conf->ssid, params->ssid, params->ssid_len);
+
+        bss_conf->hidden_ssid =
+                (params->hidden_ssid != NL80211_HIDDEN_SSID_NOT_IN_USE);
+}
+
 /*
  * This handles both adding a beacon and setting new beacon info
  */
@@ -542,14 +575,17 @@ static int ieee80211_config_beacon(struct ieee80211_sub_if_data *sdata,
 
         sdata->vif.bss_conf.dtim_period = new->dtim_period;
 
-        rcu_assign_pointer(sdata->u.ap.beacon, new);
+        RCU_INIT_POINTER(sdata->u.ap.beacon, new);
 
         synchronize_rcu();
 
         kfree(old);
 
+        ieee80211_config_ap_ssid(sdata, params);
+
         ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON_ENABLED |
-                                                BSS_CHANGED_BEACON);
+                                                BSS_CHANGED_BEACON |
+                                                BSS_CHANGED_SSID);
         return 0;
 }
 
@@ -594,7 +630,7 @@ static int ieee80211_del_beacon(struct wiphy *wiphy, struct net_device *dev)
         if (!old)
                 return -ENOENT;
 
-        rcu_assign_pointer(sdata->u.ap.beacon, NULL);
+        RCU_INIT_POINTER(sdata->u.ap.beacon, NULL);
         synchronize_rcu();
         kfree(old);
 
@@ -650,7 +686,6 @@ static void sta_apply_parameters(struct ieee80211_local *local,
                                  struct sta_info *sta,
                                  struct station_parameters *params)
 {
-        unsigned long flags;
         u32 rates;
         int i, j;
         struct ieee80211_supported_band *sband;
@@ -659,43 +694,58 @@ static void sta_apply_parameters(struct ieee80211_local *local,
 
         sband = local->hw.wiphy->bands[local->oper_channel->band];
 
-        spin_lock_irqsave(&sta->flaglock, flags);
         mask = params->sta_flags_mask;
         set = params->sta_flags_set;
 
         if (mask & BIT(NL80211_STA_FLAG_AUTHORIZED)) {
-                sta->flags &= ~WLAN_STA_AUTHORIZED;
                 if (set & BIT(NL80211_STA_FLAG_AUTHORIZED))
-                        sta->flags |= WLAN_STA_AUTHORIZED;
+                        set_sta_flag(sta, WLAN_STA_AUTHORIZED);
+                else
+                        clear_sta_flag(sta, WLAN_STA_AUTHORIZED);
         }
 
         if (mask & BIT(NL80211_STA_FLAG_SHORT_PREAMBLE)) {
-                sta->flags &= ~WLAN_STA_SHORT_PREAMBLE;
                 if (set & BIT(NL80211_STA_FLAG_SHORT_PREAMBLE))
-                        sta->flags |= WLAN_STA_SHORT_PREAMBLE;
+                        set_sta_flag(sta, WLAN_STA_SHORT_PREAMBLE);
+                else
+                        clear_sta_flag(sta, WLAN_STA_SHORT_PREAMBLE);
         }
 
         if (mask & BIT(NL80211_STA_FLAG_WME)) {
-                sta->flags &= ~WLAN_STA_WME;
-                sta->sta.wme = false;
                 if (set & BIT(NL80211_STA_FLAG_WME)) {
-                        sta->flags |= WLAN_STA_WME;
+                        set_sta_flag(sta, WLAN_STA_WME);
                         sta->sta.wme = true;
+                } else {
+                        clear_sta_flag(sta, WLAN_STA_WME);
+                        sta->sta.wme = false;
                 }
         }
 
         if (mask & BIT(NL80211_STA_FLAG_MFP)) {
-                sta->flags &= ~WLAN_STA_MFP;
                 if (set & BIT(NL80211_STA_FLAG_MFP))
-                        sta->flags |= WLAN_STA_MFP;
+                        set_sta_flag(sta, WLAN_STA_MFP);
+                else
+                        clear_sta_flag(sta, WLAN_STA_MFP);
         }
 
         if (mask & BIT(NL80211_STA_FLAG_AUTHENTICATED)) {
-                sta->flags &= ~WLAN_STA_AUTH;
                 if (set & BIT(NL80211_STA_FLAG_AUTHENTICATED))
-                        sta->flags |= WLAN_STA_AUTH;
+                        set_sta_flag(sta, WLAN_STA_AUTH);
+                else
+                        clear_sta_flag(sta, WLAN_STA_AUTH);
+        }
+
+        if (mask & BIT(NL80211_STA_FLAG_TDLS_PEER)) {
+                if (set & BIT(NL80211_STA_FLAG_TDLS_PEER))
+                        set_sta_flag(sta, WLAN_STA_TDLS_PEER);
+                else
+                        clear_sta_flag(sta, WLAN_STA_TDLS_PEER);
+        }
+
+        if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD) {
+                sta->sta.uapsd_queues = params->uapsd_queues;
+                sta->sta.max_sp = params->max_sp;
         }
-        spin_unlock_irqrestore(&sta->flaglock, flags);
 
         /*
          * cfg80211 validates this (1-2007) and allows setting the AID
@@ -786,10 +836,17 @@ static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev,
         if (!sta)
                 return -ENOMEM;
 
-        sta->flags = WLAN_STA_AUTH | WLAN_STA_ASSOC;
+        set_sta_flag(sta, WLAN_STA_AUTH);
+        set_sta_flag(sta, WLAN_STA_ASSOC);
 
         sta_apply_parameters(local, sta, params);
 
+        /* Only TDLS-supporting stations can add TDLS peers */
+        if (test_sta_flag(sta, WLAN_STA_TDLS_PEER) &&
+            !((wiphy->flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
+              sdata->vif.type == NL80211_IFTYPE_STATION))
+                return -ENOTSUPP;
+
         rate_control_rate_init(sta);
 
         layer2_update = sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
@@ -842,6 +899,14 @@ static int ieee80211_change_station(struct wiphy *wiphy,
                 return -ENOENT;
         }
 
+        /* The TDLS bit cannot be toggled after the STA was added */
+        if ((params->sta_flags_mask & BIT(NL80211_STA_FLAG_TDLS_PEER)) &&
+            !!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) !=
+            !!test_sta_flag(sta, WLAN_STA_TDLS_PEER)) {
+                rcu_read_unlock();
+                return -EINVAL;
+        }
+
         if (params->vlan && params->vlan != sta->sdata->dev) {
                 vlansdata = IEEE80211_DEV_TO_SUB_IF(params->vlan);
 
@@ -857,7 +922,7 @@ static int ieee80211_change_station(struct wiphy *wiphy,
                                 return -EBUSY;
                         }
 
-                        rcu_assign_pointer(vlansdata->u.vlan.sta, sta);
+                        RCU_INIT_POINTER(vlansdata->u.vlan.sta, sta);
                 }
 
                 sta->sdata = vlansdata;
@@ -918,7 +983,7 @@ static int ieee80211_del_mpath(struct wiphy *wiphy, struct net_device *dev,
         if (dst)
                 return mesh_path_del(dst, sdata);
 
-        mesh_path_flush(sdata);
+        mesh_path_flush_by_iface(sdata);
         return 0;
 }
 
@@ -1137,6 +1202,22 @@ static int ieee80211_update_mesh_config(struct wiphy *wiphy,
                 conf->dot11MeshHWMPRootMode = nconf->dot11MeshHWMPRootMode;
                 ieee80211_mesh_root_setup(ifmsh);
         }
+        if (_chg_mesh_attr(NL80211_MESHCONF_GATE_ANNOUNCEMENTS, mask)) {
+                /* our current gate announcement implementation rides on root
+                 * announcements, so require this ifmsh to also be a root node
+                 * */
+                if (nconf->dot11MeshGateAnnouncementProtocol &&
+                    !conf->dot11MeshHWMPRootMode) {
+                        conf->dot11MeshHWMPRootMode = 1;
+                        ieee80211_mesh_root_setup(ifmsh);
+                }
+                conf->dot11MeshGateAnnouncementProtocol =
+                        nconf->dot11MeshGateAnnouncementProtocol;
+        }
+        if (_chg_mesh_attr(NL80211_MESHCONF_HWMP_RANN_INTERVAL, mask)) {
+                conf->dot11MeshHWMPRannInterval =
+                        nconf->dot11MeshHWMPRannInterval;
+        }
         return 0;
 }
 
@@ -1235,9 +1316,11 @@ static int ieee80211_change_bss(struct wiphy *wiphy,
 }
 
 static int ieee80211_set_txq_params(struct wiphy *wiphy,
+                                    struct net_device *dev,
                                     struct ieee80211_txq_params *params)
 {
         struct ieee80211_local *local = wiphy_priv(wiphy);
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         struct ieee80211_tx_queue_params p;
 
         if (!local->ops->conf_tx)
@@ -1258,8 +1341,8 @@ static int ieee80211_set_txq_params(struct wiphy *wiphy,
         if (params->queue >= local->hw.queues)
                 return -EINVAL;
 
-        local->tx_conf[params->queue] = p;
-        if (drv_conf_tx(local, params->queue, &p)) {
+        sdata->tx_conf[params->queue] = p;
+        if (drv_conf_tx(local, sdata, params->queue, &p)) {
                 wiphy_debug(local->hw.wiphy,
                             "failed to set TX queue parameters for queue %d\n",
                             params->queue);
@@ -1821,7 +1904,7 @@ ieee80211_offchan_tx_done(struct ieee80211_work *wk, struct sk_buff *skb)
          * so in that case userspace will have to deal with it.
          */
 
-        if (wk->offchan_tx.wait && wk->offchan_tx.frame)
+        if (wk->offchan_tx.wait && !wk->offchan_tx.status)
                 cfg80211_mgmt_tx_status(wk->sdata->dev,
                                         (unsigned long) wk->offchan_tx.frame,
                                         wk->ie, wk->ie_len, false, GFP_KERNEL);
@@ -1833,7 +1916,8 @@ static int ieee80211_mgmt_tx(struct wiphy *wiphy, struct net_device *dev,
                              struct ieee80211_channel *chan, bool offchan,
                              enum nl80211_channel_type channel_type,
                              bool channel_type_valid, unsigned int wait,
-                             const u8 *buf, size_t len, u64 *cookie)
+                             const u8 *buf, size_t len, bool no_cck,
+                             u64 *cookie)
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         struct ieee80211_local *local = sdata->local;
@@ -1860,6 +1944,9 @@ static int ieee80211_mgmt_tx(struct wiphy *wiphy, struct net_device *dev,
                 flags |= IEEE80211_TX_CTL_TX_OFFCHAN;
         }
 
+        if (no_cck)
+                flags |= IEEE80211_TX_CTL_NO_CCK_RATE;
+
         if (is_offchan && !offchan)
                 return -EBUSY;
 
@@ -1898,33 +1985,6 @@ static int ieee80211_mgmt_tx(struct wiphy *wiphy, struct net_device *dev,
 
         *cookie = (unsigned long) skb;
 
-        if (is_offchan && local->ops->offchannel_tx) {
-                int ret;
-
-                IEEE80211_SKB_CB(skb)->band = chan->band;
-
-                mutex_lock(&local->mtx);
-
-                if (local->hw_offchan_tx_cookie) {
-                        mutex_unlock(&local->mtx);
-                        return -EBUSY;
-                }
-
-                /* TODO: bitrate control, TX processing? */
-                ret = drv_offchannel_tx(local, skb, chan, channel_type, wait);
-
-                if (ret == 0)
-                        local->hw_offchan_tx_cookie = *cookie;
-                mutex_unlock(&local->mtx);
-
-                /*
-                 * Allow driver to return 1 to indicate it wants to have the
-                 * frame transmitted with a remain_on_channel + regular TX.
-                 */
-                if (ret != 1)
-                        return ret;
-        }
-
         if (is_offchan && local->ops->remain_on_channel) {
                 unsigned int duration;
                 int ret;
@@ -2011,18 +2071,6 @@ static int ieee80211_mgmt_tx_cancel_wait(struct wiphy *wiphy,
 
         mutex_lock(&local->mtx);
 
-        if (local->ops->offchannel_tx_cancel_wait &&
-            local->hw_offchan_tx_cookie == cookie) {
-                ret = drv_offchannel_tx_cancel_wait(local);
-
-                if (!ret)
-                        local->hw_offchan_tx_cookie = 0;
-
-                mutex_unlock(&local->mtx);
-
-                return ret;
-        }
-
         if (local->ops->cancel_remain_on_channel) {
                 cookie ^= 2;
                 ret = ieee80211_cancel_remain_on_channel_hw(local, cookie);
@@ -2123,6 +2171,323 @@ static int ieee80211_set_rekey_data(struct wiphy *wiphy,
         return 0;
 }
 
+static void ieee80211_tdls_add_ext_capab(struct sk_buff *skb)
+{
+        u8 *pos = (void *)skb_put(skb, 7);
+
+        *pos++ = WLAN_EID_EXT_CAPABILITY;
+        *pos++ = 5; /* len */
+        *pos++ = 0x0;
+        *pos++ = 0x0;
+        *pos++ = 0x0;
+        *pos++ = 0x0;
+        *pos++ = WLAN_EXT_CAPA5_TDLS_ENABLED;
+}
+
+static u16 ieee80211_get_tdls_sta_capab(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_local *local = sdata->local;
+        u16 capab;
+
+        capab = 0;
+        if (local->oper_channel->band != IEEE80211_BAND_2GHZ)
+                return capab;
+
+        if (!(local->hw.flags & IEEE80211_HW_2GHZ_SHORT_SLOT_INCAPABLE))
+                capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME;
+        if (!(local->hw.flags & IEEE80211_HW_2GHZ_SHORT_PREAMBLE_INCAPABLE))
+                capab |= WLAN_CAPABILITY_SHORT_PREAMBLE;
+
+        return capab;
+}
+
+static void ieee80211_tdls_add_link_ie(struct sk_buff *skb, u8 *src_addr,
+                                       u8 *peer, u8 *bssid)
+{
+        struct ieee80211_tdls_lnkie *lnkid;
+
+        lnkid = (void *)skb_put(skb, sizeof(struct ieee80211_tdls_lnkie));
+
+        lnkid->ie_type = WLAN_EID_LINK_ID;
+        lnkid->ie_len = sizeof(struct ieee80211_tdls_lnkie) - 2;
+
+        memcpy(lnkid->bssid, bssid, ETH_ALEN);
+        memcpy(lnkid->init_sta, src_addr, ETH_ALEN);
+        memcpy(lnkid->resp_sta, peer, ETH_ALEN);
+}
+
+static int
+ieee80211_prep_tdls_encap_data(struct wiphy *wiphy, struct net_device *dev,
+                               u8 *peer, u8 action_code, u8 dialog_token,
+                               u16 status_code, struct sk_buff *skb)
+{
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_tdls_data *tf;
+
+        tf = (void *)skb_put(skb, offsetof(struct ieee80211_tdls_data, u));
+
+        memcpy(tf->da, peer, ETH_ALEN);
+        memcpy(tf->sa, sdata->vif.addr, ETH_ALEN);
+        tf->ether_type = cpu_to_be16(ETH_P_TDLS);
+        tf->payload_type = WLAN_TDLS_SNAP_RFTYPE;
+
+        switch (action_code) {
+        case WLAN_TDLS_SETUP_REQUEST:
+                tf->category = WLAN_CATEGORY_TDLS;
+                tf->action_code = WLAN_TDLS_SETUP_REQUEST;
+
+                skb_put(skb, sizeof(tf->u.setup_req));
+                tf->u.setup_req.dialog_token = dialog_token;
+                tf->u.setup_req.capability =
+                        cpu_to_le16(ieee80211_get_tdls_sta_capab(sdata));
+
+                ieee80211_add_srates_ie(&sdata->vif, skb);
+                ieee80211_add_ext_srates_ie(&sdata->vif, skb);
+                ieee80211_tdls_add_ext_capab(skb);
+                break;
+        case WLAN_TDLS_SETUP_RESPONSE:
+                tf->category = WLAN_CATEGORY_TDLS;
+                tf->action_code = WLAN_TDLS_SETUP_RESPONSE;
+
+                skb_put(skb, sizeof(tf->u.setup_resp));
+                tf->u.setup_resp.status_code = cpu_to_le16(status_code);
+                tf->u.setup_resp.dialog_token = dialog_token;
+                tf->u.setup_resp.capability =
+                        cpu_to_le16(ieee80211_get_tdls_sta_capab(sdata));
+
+                ieee80211_add_srates_ie(&sdata->vif, skb);
+                ieee80211_add_ext_srates_ie(&sdata->vif, skb);
+                ieee80211_tdls_add_ext_capab(skb);
+                break;
+        case WLAN_TDLS_SETUP_CONFIRM:
+                tf->category = WLAN_CATEGORY_TDLS;
+                tf->action_code = WLAN_TDLS_SETUP_CONFIRM;
+
+                skb_put(skb, sizeof(tf->u.setup_cfm));
+                tf->u.setup_cfm.status_code = cpu_to_le16(status_code);
+                tf->u.setup_cfm.dialog_token = dialog_token;
+                break;
+        case WLAN_TDLS_TEARDOWN:
+                tf->category = WLAN_CATEGORY_TDLS;
+                tf->action_code = WLAN_TDLS_TEARDOWN;
+
+                skb_put(skb, sizeof(tf->u.teardown));
+                tf->u.teardown.reason_code = cpu_to_le16(status_code);
+                break;
+        case WLAN_TDLS_DISCOVERY_REQUEST:
+                tf->category = WLAN_CATEGORY_TDLS;
+                tf->action_code = WLAN_TDLS_DISCOVERY_REQUEST;
+
+                skb_put(skb, sizeof(tf->u.discover_req));
+                tf->u.discover_req.dialog_token = dialog_token;
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
+static int
+ieee80211_prep_tdls_direct(struct wiphy *wiphy, struct net_device *dev,
+                           u8 *peer, u8 action_code, u8 dialog_token,
+                           u16 status_code, struct sk_buff *skb)
+{
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_mgmt *mgmt;
+
+        mgmt = (void *)skb_put(skb, 24);
+        memset(mgmt, 0, 24);
+        memcpy(mgmt->da, peer, ETH_ALEN);
+        memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
+        memcpy(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN);
+
+        mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
+                                          IEEE80211_STYPE_ACTION);
+
+        switch (action_code) {
+        case WLAN_PUB_ACTION_TDLS_DISCOVER_RES:
+                skb_put(skb, 1 + sizeof(mgmt->u.action.u.tdls_discover_resp));
+                mgmt->u.action.category = WLAN_CATEGORY_PUBLIC;
+                mgmt->u.action.u.tdls_discover_resp.action_code =
+                        WLAN_PUB_ACTION_TDLS_DISCOVER_RES;
+                mgmt->u.action.u.tdls_discover_resp.dialog_token =
+                        dialog_token;
+                mgmt->u.action.u.tdls_discover_resp.capability =
+                        cpu_to_le16(ieee80211_get_tdls_sta_capab(sdata));
+
+                ieee80211_add_srates_ie(&sdata->vif, skb);
+                ieee80211_add_ext_srates_ie(&sdata->vif, skb);
+                ieee80211_tdls_add_ext_capab(skb);
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
+static int ieee80211_tdls_mgmt(struct wiphy *wiphy, struct net_device *dev,
+                               u8 *peer, u8 action_code, u8 dialog_token,
+                               u16 status_code, const u8 *extra_ies,
+                               size_t extra_ies_len)
+{
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_tx_info *info;
+        struct sk_buff *skb = NULL;
+        bool send_direct;
+        int ret;
+
+        if (!(wiphy->flags & WIPHY_FLAG_SUPPORTS_TDLS))
+                return -ENOTSUPP;
+
+        /* make sure we are in managed mode, and associated */
+        if (sdata->vif.type != NL80211_IFTYPE_STATION ||
+            !sdata->u.mgd.associated)
+                return -EINVAL;
+
+#ifdef CONFIG_MAC80211_VERBOSE_TDLS_DEBUG
+        printk(KERN_DEBUG "TDLS mgmt action %d peer %pM\n", action_code, peer);
+#endif
+
+        skb = dev_alloc_skb(local->hw.extra_tx_headroom +
+                            max(sizeof(struct ieee80211_mgmt),
+                                sizeof(struct ieee80211_tdls_data)) +
+                            50 + /* supported rates */
+                            7 + /* ext capab */
+                            extra_ies_len +
+                            sizeof(struct ieee80211_tdls_lnkie));
+        if (!skb)
+                return -ENOMEM;
+
+        info = IEEE80211_SKB_CB(skb);
+        skb_reserve(skb, local->hw.extra_tx_headroom);
+
+        switch (action_code) {
+        case WLAN_TDLS_SETUP_REQUEST:
+        case WLAN_TDLS_SETUP_RESPONSE:
+        case WLAN_TDLS_SETUP_CONFIRM:
+        case WLAN_TDLS_TEARDOWN:
+        case WLAN_TDLS_DISCOVERY_REQUEST:
+                ret = ieee80211_prep_tdls_encap_data(wiphy, dev, peer,
+                                                     action_code, dialog_token,
+                                                     status_code, skb);
+                send_direct = false;
+                break;
+        case WLAN_PUB_ACTION_TDLS_DISCOVER_RES:
+                ret = ieee80211_prep_tdls_direct(wiphy, dev, peer, action_code,
+                                                 dialog_token, status_code,
+                                                 skb);
+                send_direct = true;
+                break;
+        default:
+                ret = -ENOTSUPP;
+                break;
+        }
+
+        if (ret < 0)
+                goto fail;
+
+        if (extra_ies_len)
+                memcpy(skb_put(skb, extra_ies_len), extra_ies, extra_ies_len);
+
+        /* the TDLS link IE is always added last */
+        switch (action_code) {
+        case WLAN_TDLS_SETUP_REQUEST:
+        case WLAN_TDLS_SETUP_CONFIRM:
+        case WLAN_TDLS_TEARDOWN:
+        case WLAN_TDLS_DISCOVERY_REQUEST:
+                /* we are the initiator */
+                ieee80211_tdls_add_link_ie(skb, sdata->vif.addr, peer,
+                                           sdata->u.mgd.bssid);
+                break;
+        case WLAN_TDLS_SETUP_RESPONSE:
+        case WLAN_PUB_ACTION_TDLS_DISCOVER_RES:
+                /* we are the responder */
+                ieee80211_tdls_add_link_ie(skb, peer, sdata->vif.addr,
+                                           sdata->u.mgd.bssid);
+                break;
+        default:
+                ret = -ENOTSUPP;
+                goto fail;
+        }
+
+        if (send_direct) {
+                ieee80211_tx_skb(sdata, skb);
+                return 0;
+        }
+
+        /*
+         * According to 802.11z: Setup req/resp are sent in AC_BK, otherwise
+         * we should default to AC_VI.
+         */
+        switch (action_code) {
+        case WLAN_TDLS_SETUP_REQUEST:
+        case WLAN_TDLS_SETUP_RESPONSE:
+                skb_set_queue_mapping(skb, IEEE80211_AC_BK);
+                skb->priority = 2;
+                break;
+        default:
+                skb_set_queue_mapping(skb, IEEE80211_AC_VI);
+                skb->priority = 5;
+                break;
+        }
+
+        /* disable bottom halves when entering the Tx path */
+        local_bh_disable();
+        ret = ieee80211_subif_start_xmit(skb, dev);
+        local_bh_enable();
+
+        return ret;
+
+fail:
+        dev_kfree_skb(skb);
+        return ret;
+}
+
+static int ieee80211_tdls_oper(struct wiphy *wiphy, struct net_device *dev,
+                               u8 *peer, enum nl80211_tdls_operation oper)
+{
+        struct sta_info *sta;
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+
+        if (!(wiphy->flags & WIPHY_FLAG_SUPPORTS_TDLS))
+                return -ENOTSUPP;
+
+        if (sdata->vif.type != NL80211_IFTYPE_STATION)
+                return -EINVAL;
+
+#ifdef CONFIG_MAC80211_VERBOSE_TDLS_DEBUG
+        printk(KERN_DEBUG "TDLS oper %d peer %pM\n", oper, peer);
+#endif
+
+        switch (oper) {
+        case NL80211_TDLS_ENABLE_LINK:
+                rcu_read_lock();
+                sta = sta_info_get(sdata, peer);
+                if (!sta) {
+                        rcu_read_unlock();
+                        return -ENOLINK;
+                }
+
+                set_sta_flag(sta, WLAN_STA_TDLS_PEER_AUTH);
+                rcu_read_unlock();
+                break;
+        case NL80211_TDLS_DISABLE_LINK:
+                return sta_info_destroy_addr(sdata, peer);
+        case NL80211_TDLS_TEARDOWN:
+        case NL80211_TDLS_SETUP:
+        case NL80211_TDLS_DISCOVERY_REQ:
+                /* We don't support in-driver setup/teardown/discovery */
+                return -ENOTSUPP;
+        default:
+                return -ENOTSUPP;
+        }
+
+        return 0;
+}
+
 struct cfg80211_ops mac80211_config_ops = {
         .add_virtual_intf = ieee80211_add_iface,
         .del_virtual_intf = ieee80211_del_iface,
@@ -2186,4 +2551,6 @@ struct cfg80211_ops mac80211_config_ops = {
         .set_ringparam = ieee80211_set_ringparam,
         .get_ringparam = ieee80211_get_ringparam,
         .set_rekey_data = ieee80211_set_rekey_data,
+        .tdls_oper = ieee80211_tdls_oper,
+        .tdls_mgmt = ieee80211_tdls_mgmt,
 };
diff --git a/net/mac80211/debugfs.c b/net/mac80211/debugfs.c
index 186e02f7cc32..883996b2f99f 100644
--- a/net/mac80211/debugfs.c
+++ b/net/mac80211/debugfs.c
@@ -78,57 +78,6 @@ DEBUGFS_READONLY_FILE(wep_iv, "%#08x",
 DEBUGFS_READONLY_FILE(rate_ctrl_alg, "%s",
         local->rate_ctrl ? local->rate_ctrl->ops->name : "hw/driver");
 
-static ssize_t tsf_read(struct file *file, char __user *user_buf,
-                             size_t count, loff_t *ppos)
-{
-        struct ieee80211_local *local = file->private_data;
-        u64 tsf;
-
-        tsf = drv_get_tsf(local);
-
-        return mac80211_format_buffer(user_buf, count, ppos, "0x%016llx\n",
-                                      (unsigned long long) tsf);
-}
-
-static ssize_t tsf_write(struct file *file,
-                         const char __user *user_buf,
-                         size_t count, loff_t *ppos)
-{
-        struct ieee80211_local *local = file->private_data;
-        unsigned long long tsf;
-        char buf[100];
-        size_t len;
-
-        len = min(count, sizeof(buf) - 1);
-        if (copy_from_user(buf, user_buf, len))
-                return -EFAULT;
-        buf[len] = '\0';
-
-        if (strncmp(buf, "reset", 5) == 0) {
-                if (local->ops->reset_tsf) {
-                        drv_reset_tsf(local);
-                        wiphy_info(local->hw.wiphy, "debugfs reset TSF\n");
-                }
-        } else {
-                tsf = simple_strtoul(buf, NULL, 0);
-                if (local->ops->set_tsf) {
-                        drv_set_tsf(local, tsf);
-                        wiphy_info(local->hw.wiphy,
-                                   "debugfs set TSF to %#018llx\n", tsf);
-
-                }
-        }
-
-        return count;
-}
-
-static const struct file_operations tsf_ops = {
-        .read = tsf_read,
-        .write = tsf_write,
-        .open = mac80211_open_file_generic,
-        .llseek = default_llseek,
-};
-
 static ssize_t reset_write(struct file *file, const char __user *user_buf,
                            size_t count, loff_t *ppos)
 {
@@ -195,20 +144,12 @@ static ssize_t uapsd_queues_write(struct file *file,
                                   size_t count, loff_t *ppos)
 {
         struct ieee80211_local *local = file->private_data;
-        unsigned long val;
-        char buf[10];
-        size_t len;
+        u8 val;
         int ret;
 
-        len = min(count, sizeof(buf) - 1);
-        if (copy_from_user(buf, user_buf, len))
-                return -EFAULT;
-        buf[len] = '\0';
-
-        ret = strict_strtoul(buf, 0, &val);
-
+        ret = kstrtou8_from_user(user_buf, count, 0, &val);
         if (ret)
-                return -EINVAL;
+                return ret;
 
         if (val & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
                 return -ERANGE;
@@ -305,6 +246,9 @@ static ssize_t hwflags_read(struct file *file, char __user *user_buf,
         char *buf = kzalloc(mxln, GFP_KERNEL);
         int sf = 0; /* how many written so far */
 
+        if (!buf)
+                return 0;
+
         sf += snprintf(buf, mxln - sf, "0x%x\n", local->hw.flags);
         if (local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL)
                 sf += snprintf(buf + sf, mxln - sf, "HAS_RATE_CONTROL\n");
@@ -355,6 +299,8 @@ static ssize_t hwflags_read(struct file *file, char __user *user_buf,
                 sf += snprintf(buf + sf, mxln - sf, "SUPPORTS_PER_STA_GTK\n");
         if (local->hw.flags & IEEE80211_HW_AP_LINK_PS)
                 sf += snprintf(buf + sf, mxln - sf, "AP_LINK_PS\n");
+        if (local->hw.flags & IEEE80211_HW_TX_AMPDU_SETUP_IN_HW)
+                sf += snprintf(buf + sf, mxln - sf, "TX_AMPDU_SETUP_IN_HW\n");
 
         rv = simple_read_from_buffer(user_buf, count, ppos, buf, strlen(buf));
         kfree(buf);
@@ -450,7 +396,6 @@ void debugfs_hw_add(struct ieee80211_local *local)
         DEBUGFS_ADD(frequency);
         DEBUGFS_ADD(total_ps_buffered);
         DEBUGFS_ADD(wep_iv);
-        DEBUGFS_ADD(tsf);
         DEBUGFS_ADD(queues);
         DEBUGFS_ADD_MODE(reset, 0200);
         DEBUGFS_ADD(noack);
diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c
index 9ea7c0d0103f..9352819a986b 100644
--- a/net/mac80211/debugfs_netdev.c
+++ b/net/mac80211/debugfs_netdev.c
@@ -21,6 +21,7 @@
 #include "rate.h"
 #include "debugfs.h"
 #include "debugfs_netdev.h"
+#include "driver-ops.h"
 
 static ssize_t ieee80211_if_read(
         struct ieee80211_sub_if_data *sdata,
@@ -331,6 +332,46 @@ static ssize_t ieee80211_if_fmt_num_buffered_multicast(
 }
 __IEEE80211_IF_FILE(num_buffered_multicast, NULL);
 
+/* IBSS attributes */
+static ssize_t ieee80211_if_fmt_tsf(
+        const struct ieee80211_sub_if_data *sdata, char *buf, int buflen)
+{
+        struct ieee80211_local *local = sdata->local;
+        u64 tsf;
+
+        tsf = drv_get_tsf(local, (struct ieee80211_sub_if_data *)sdata);
+
+        return scnprintf(buf, buflen, "0x%016llx\n", (unsigned long long) tsf);
+}
+
+static ssize_t ieee80211_if_parse_tsf(
+        struct ieee80211_sub_if_data *sdata, const char *buf, int buflen)
+{
+        struct ieee80211_local *local = sdata->local;
+        unsigned long long tsf;
+        int ret;
+
+        if (strncmp(buf, "reset", 5) == 0) {
+                if (local->ops->reset_tsf) {
+                        drv_reset_tsf(local, sdata);
+                        wiphy_info(local->hw.wiphy, "debugfs reset TSF\n");
+                }
+        } else {
+                ret = kstrtoull(buf, 10, &tsf);
+                if (ret < 0)
+                        return -EINVAL;
+                if (local->ops->set_tsf) {
+                        drv_set_tsf(local, sdata, tsf);
+                        wiphy_info(local->hw.wiphy,
+                                   "debugfs set TSF to %#018llx\n", tsf);
+                }
+        }
+
+        return buflen;
+}
+__IEEE80211_IF_FILE_W(tsf);
+
+
 /* WDS attributes */
 IEEE80211_IF_FILE(peer, u.wds.remote_addr, MAC);
 
@@ -340,6 +381,8 @@ IEEE80211_IF_FILE(fwded_mcast, u.mesh.mshstats.fwded_mcast, DEC);
 IEEE80211_IF_FILE(fwded_unicast, u.mesh.mshstats.fwded_unicast, DEC);
 IEEE80211_IF_FILE(fwded_frames, u.mesh.mshstats.fwded_frames, DEC);
 IEEE80211_IF_FILE(dropped_frames_ttl, u.mesh.mshstats.dropped_frames_ttl, DEC);
+IEEE80211_IF_FILE(dropped_frames_congestion,
+                u.mesh.mshstats.dropped_frames_congestion, DEC);
 IEEE80211_IF_FILE(dropped_frames_no_route,
                 u.mesh.mshstats.dropped_frames_no_route, DEC);
 IEEE80211_IF_FILE(estab_plinks, u.mesh.mshstats.estab_plinks, ATOMIC);
@@ -372,6 +415,10 @@ IEEE80211_IF_FILE(min_discovery_timeout,
                 u.mesh.mshcfg.min_discovery_timeout, DEC);
 IEEE80211_IF_FILE(dot11MeshHWMPRootMode,
                 u.mesh.mshcfg.dot11MeshHWMPRootMode, DEC);
+IEEE80211_IF_FILE(dot11MeshGateAnnouncementProtocol,
+                u.mesh.mshcfg.dot11MeshGateAnnouncementProtocol, DEC);
+IEEE80211_IF_FILE(dot11MeshHWMPRannInterval,
+                u.mesh.mshcfg.dot11MeshHWMPRannInterval, DEC);
 #endif
 
 
@@ -415,6 +462,11 @@ static void add_ap_files(struct ieee80211_sub_if_data *sdata)
         DEBUGFS_ADD_MODE(tkip_mic_test, 0200);
 }
 
+static void add_ibss_files(struct ieee80211_sub_if_data *sdata)
+{
+        DEBUGFS_ADD_MODE(tsf, 0600);
+}
+
 static void add_wds_files(struct ieee80211_sub_if_data *sdata)
 {
         DEBUGFS_ADD(drop_unencrypted);
@@ -459,6 +511,7 @@ static void add_mesh_stats(struct ieee80211_sub_if_data *sdata)
         MESHSTATS_ADD(fwded_frames);
         MESHSTATS_ADD(dropped_frames_ttl);
         MESHSTATS_ADD(dropped_frames_no_route);
+        MESHSTATS_ADD(dropped_frames_congestion);
         MESHSTATS_ADD(estab_plinks);
 #undef MESHSTATS_ADD
 }
@@ -485,7 +538,9 @@ static void add_mesh_config(struct ieee80211_sub_if_data *sdata)
         MESHPARAMS_ADD(dot11MeshHWMPmaxPREQretries);
         MESHPARAMS_ADD(path_refresh_time);
         MESHPARAMS_ADD(min_discovery_timeout);
-
+        MESHPARAMS_ADD(dot11MeshHWMPRootMode);
+        MESHPARAMS_ADD(dot11MeshHWMPRannInterval);
+        MESHPARAMS_ADD(dot11MeshGateAnnouncementProtocol);
 #undef MESHPARAMS_ADD
 }
 #endif
@@ -506,7 +561,7 @@ static void add_files(struct ieee80211_sub_if_data *sdata)
                 add_sta_files(sdata);
                 break;
         case NL80211_IFTYPE_ADHOC:
-                /* XXX */
+                add_ibss_files(sdata);
                 break;
         case NL80211_IFTYPE_AP:
                 add_ap_files(sdata);
diff --git a/net/mac80211/debugfs_sta.c b/net/mac80211/debugfs_sta.c
index a01d2137fddc..c5f341798c16 100644
--- a/net/mac80211/debugfs_sta.c
+++ b/net/mac80211/debugfs_sta.c
@@ -56,19 +56,22 @@ STA_FILE(last_signal, last_signal, D);
 static ssize_t sta_flags_read(struct file *file, char __user *userbuf,
                               size_t count, loff_t *ppos)
 {
-        char buf[100];
+        char buf[121];
         struct sta_info *sta = file->private_data;
-        u32 staflags = get_sta_flags(sta);
-        int res = scnprintf(buf, sizeof(buf), "%s%s%s%s%s%s%s%s%s",
-                staflags & WLAN_STA_AUTH ? "AUTH\n" : "",
-                staflags & WLAN_STA_ASSOC ? "ASSOC\n" : "",
-                staflags & WLAN_STA_PS_STA ? "PS (sta)\n" : "",
-                staflags & WLAN_STA_PS_DRIVER ? "PS (driver)\n" : "",
-                staflags & WLAN_STA_AUTHORIZED ? "AUTHORIZED\n" : "",
-                staflags & WLAN_STA_SHORT_PREAMBLE ? "SHORT PREAMBLE\n" : "",
-                staflags & WLAN_STA_WME ? "WME\n" : "",
-                staflags & WLAN_STA_WDS ? "WDS\n" : "",
-                staflags & WLAN_STA_MFP ? "MFP\n" : "");
+
+#define TEST(flg) \
+        test_sta_flag(sta, WLAN_STA_##flg) ? #flg "\n" : ""
+
+        int res = scnprintf(buf, sizeof(buf),
+                            "%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s",
+                            TEST(AUTH), TEST(ASSOC), TEST(PS_STA),
+                            TEST(PS_DRIVER), TEST(AUTHORIZED),
+                            TEST(SHORT_PREAMBLE), TEST(ASSOC_AP),
+                            TEST(WME), TEST(WDS), TEST(CLEAR_PS_FILT),
+                            TEST(MFP), TEST(BLOCK_BA), TEST(PSPOLL),
+                            TEST(UAPSD), TEST(SP), TEST(TDLS_PEER),
+                            TEST(TDLS_PEER_AUTH));
+#undef TEST
         return simple_read_from_buffer(userbuf, count, ppos, buf, res);
 }
 STA_OPS(flags);
@@ -78,8 +81,14 @@ static ssize_t sta_num_ps_buf_frames_read(struct file *file,
                                           size_t count, loff_t *ppos)
 {
         struct sta_info *sta = file->private_data;
-        return mac80211_format_buffer(userbuf, count, ppos, "%u\n",
-                                      skb_queue_len(&sta->ps_tx_buf));
+        char buf[17*IEEE80211_NUM_ACS], *p = buf;
+        int ac;
+
+        for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
+                p += scnprintf(p, sizeof(buf)+buf-p, "AC%d: %d\n", ac,
+                               skb_queue_len(&sta->ps_tx_buf[ac]) +
+                               skb_queue_len(&sta->tx_filtered[ac]));
+        return simple_read_from_buffer(userbuf, count, ppos, buf, p - buf);
 }
 STA_OPS(num_ps_buf_frames);
 
diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
index 1425380983f7..5f165d7eb2db 100644
--- a/net/mac80211/driver-ops.h
+++ b/net/mac80211/driver-ops.h
@@ -413,50 +413,56 @@ static inline void drv_sta_remove(struct ieee80211_local *local,
         trace_drv_return_void(local);
 }
 
-static inline int drv_conf_tx(struct ieee80211_local *local, u16 queue,
+static inline int drv_conf_tx(struct ieee80211_local *local,
+                              struct ieee80211_sub_if_data *sdata, u16 queue,
                               const struct ieee80211_tx_queue_params *params)
 {
         int ret = -EOPNOTSUPP;
 
         might_sleep();
 
-        trace_drv_conf_tx(local, queue, params);
+        trace_drv_conf_tx(local, sdata, queue, params);
         if (local->ops->conf_tx)
-                ret = local->ops->conf_tx(&local->hw, queue, params);
+                ret = local->ops->conf_tx(&local->hw, &sdata->vif,
+                                          queue, params);
         trace_drv_return_int(local, ret);
         return ret;
 }
 
-static inline u64 drv_get_tsf(struct ieee80211_local *local)
+static inline u64 drv_get_tsf(struct ieee80211_local *local,
+                              struct ieee80211_sub_if_data *sdata)
 {
         u64 ret = -1ULL;
 
         might_sleep();
 
-        trace_drv_get_tsf(local);
+        trace_drv_get_tsf(local, sdata);
         if (local->ops->get_tsf)
-                ret = local->ops->get_tsf(&local->hw);
+                ret = local->ops->get_tsf(&local->hw, &sdata->vif);
         trace_drv_return_u64(local, ret);
         return ret;
 }
 
-static inline void drv_set_tsf(struct ieee80211_local *local, u64 tsf)
+static inline void drv_set_tsf(struct ieee80211_local *local,
+                               struct ieee80211_sub_if_data *sdata,
+                               u64 tsf)
 {
         might_sleep();
 
-        trace_drv_set_tsf(local, tsf);
+        trace_drv_set_tsf(local, sdata, tsf);
         if (local->ops->set_tsf)
-                local->ops->set_tsf(&local->hw, tsf);
+                local->ops->set_tsf(&local->hw, &sdata->vif, tsf);
         trace_drv_return_void(local);
 }
 
-static inline void drv_reset_tsf(struct ieee80211_local *local)
+static inline void drv_reset_tsf(struct ieee80211_local *local,
+                                 struct ieee80211_sub_if_data *sdata)
 {
         might_sleep();
 
-        trace_drv_reset_tsf(local);
+        trace_drv_reset_tsf(local, sdata);
         if (local->ops->reset_tsf)
-                local->ops->reset_tsf(&local->hw);
+                local->ops->reset_tsf(&local->hw, &sdata->vif);
         trace_drv_return_void(local);
 }
 
@@ -590,37 +596,6 @@ static inline int drv_cancel_remain_on_channel(struct ieee80211_local *local)
         return ret;
 }
 
-static inline int drv_offchannel_tx(struct ieee80211_local *local,
-                                    struct sk_buff *skb,
-                                    struct ieee80211_channel *chan,
-                                    enum nl80211_channel_type channel_type,
-                                    unsigned int wait)
-{
-        int ret;
-
-        might_sleep();
-
-        trace_drv_offchannel_tx(local, skb, chan, channel_type, wait);
-        ret = local->ops->offchannel_tx(&local->hw, skb, chan,
-                                        channel_type, wait);
-        trace_drv_return_int(local, ret);
-
-        return ret;
-}
-
-static inline int drv_offchannel_tx_cancel_wait(struct ieee80211_local *local)
-{
-        int ret;
-
-        might_sleep();
-
-        trace_drv_offchannel_tx_cancel_wait(local);
-        ret = local->ops->offchannel_tx_cancel_wait(&local->hw);
-        trace_drv_return_int(local, ret);
-
-        return ret;
-}
-
 static inline int drv_set_ringparam(struct ieee80211_local *local,
                                     u32 tx, u32 rx)
 {
@@ -696,4 +671,34 @@ static inline void drv_rssi_callback(struct ieee80211_local *local,
                 local->ops->rssi_callback(&local->hw, event);
         trace_drv_return_void(local);
 }
+
+static inline void
+drv_release_buffered_frames(struct ieee80211_local *local,
+                            struct sta_info *sta, u16 tids, int num_frames,
+                            enum ieee80211_frame_release_type reason,
+                            bool more_data)
+{
+        trace_drv_release_buffered_frames(local, &sta->sta, tids, num_frames,
+                                          reason, more_data);
+        if (local->ops->release_buffered_frames)
+                local->ops->release_buffered_frames(&local->hw, &sta->sta, tids,
+                                                    num_frames, reason,
+                                                    more_data);
+        trace_drv_return_void(local);
+}
+
+static inline void
+drv_allow_buffered_frames(struct ieee80211_local *local,
+                          struct sta_info *sta, u16 tids, int num_frames,
+                          enum ieee80211_frame_release_type reason,
+                          bool more_data)
+{
+        trace_drv_allow_buffered_frames(local, &sta->sta, tids, num_frames,
+                                        reason, more_data);
+        if (local->ops->allow_buffered_frames)
+                local->ops->allow_buffered_frames(&local->hw, &sta->sta,
+                                                  tids, num_frames, reason,
+                                                  more_data);
+        trace_drv_return_void(local);
+}
 #endif /* __MAC80211_DRIVER_OPS */
diff --git a/net/mac80211/driver-trace.h b/net/mac80211/driver-trace.h
index f47b00dc7afd..2af4fca55337 100644
--- a/net/mac80211/driver-trace.h
+++ b/net/mac80211/driver-trace.h
@@ -697,64 +697,76 @@ TRACE_EVENT(drv_sta_remove,
 );
 
 TRACE_EVENT(drv_conf_tx,
-        TP_PROTO(struct ieee80211_local *local, u16 queue,
+        TP_PROTO(struct ieee80211_local *local,
+                 struct ieee80211_sub_if_data *sdata,
+                 u16 queue,
                  const struct ieee80211_tx_queue_params *params),
 
-        TP_ARGS(local, queue, params),
+        TP_ARGS(local, sdata, queue, params),
 
         TP_STRUCT__entry(
                 LOCAL_ENTRY
+                VIF_ENTRY
                 __field(u16, queue)
                 __field(u16, txop)
                 __field(u16, cw_min)
                 __field(u16, cw_max)
                 __field(u8, aifs)
+                __field(bool, uapsd)
         ),
 
         TP_fast_assign(
                 LOCAL_ASSIGN;
+                VIF_ASSIGN;
                 __entry->queue = queue;
                 __entry->txop = params->txop;
                 __entry->cw_max = params->cw_max;
                 __entry->cw_min = params->cw_min;
                 __entry->aifs = params->aifs;
+                __entry->uapsd = params->uapsd;
         ),
 
         TP_printk(
-                LOCAL_PR_FMT " queue:%d",
-                LOCAL_PR_ARG, __entry->queue
+                LOCAL_PR_FMT  VIF_PR_FMT  " queue:%d",
+                LOCAL_PR_ARG, VIF_PR_ARG, __entry->queue
         )
 );
 
-DEFINE_EVENT(local_only_evt, drv_get_tsf,
-        TP_PROTO(struct ieee80211_local *local),
-        TP_ARGS(local)
+DEFINE_EVENT(local_sdata_evt, drv_get_tsf,
+        TP_PROTO(struct ieee80211_local *local,
+                 struct ieee80211_sub_if_data *sdata),
+        TP_ARGS(local, sdata)
 );
 
 TRACE_EVENT(drv_set_tsf,
-        TP_PROTO(struct ieee80211_local *local, u64 tsf),
+        TP_PROTO(struct ieee80211_local *local,
+                 struct ieee80211_sub_if_data *sdata,
+                 u64 tsf),
 
-        TP_ARGS(local, tsf),
+        TP_ARGS(local, sdata, tsf),
 
         TP_STRUCT__entry(
                 LOCAL_ENTRY
+                VIF_ENTRY
                 __field(u64, tsf)
         ),
 
         TP_fast_assign(
                 LOCAL_ASSIGN;
+                VIF_ASSIGN;
                 __entry->tsf = tsf;
         ),
 
         TP_printk(
-                LOCAL_PR_FMT " tsf:%llu",
-                LOCAL_PR_ARG, (unsigned long long)__entry->tsf
+                LOCAL_PR_FMT  VIF_PR_FMT  " tsf:%llu",
+                LOCAL_PR_ARG, VIF_PR_ARG, (unsigned long long)__entry->tsf
         )
 );
 
-DEFINE_EVENT(local_only_evt, drv_reset_tsf,
-        TP_PROTO(struct ieee80211_local *local),
-        TP_ARGS(local)
+DEFINE_EVENT(local_sdata_evt, drv_reset_tsf,
+        TP_PROTO(struct ieee80211_local *local,
+                 struct ieee80211_sub_if_data *sdata),
+        TP_ARGS(local, sdata)
 );
 
 DEFINE_EVENT(local_only_evt, drv_tx_last_beacon,
@@ -1117,6 +1129,61 @@ TRACE_EVENT(drv_rssi_callback,
         )
 );
 
+DECLARE_EVENT_CLASS(release_evt,
+        TP_PROTO(struct ieee80211_local *local,
+                 struct ieee80211_sta *sta,
+                 u16 tids, int num_frames,
+                 enum ieee80211_frame_release_type reason,
+                 bool more_data),
+
+        TP_ARGS(local, sta, tids, num_frames, reason, more_data),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                STA_ENTRY
+                __field(u16, tids)
+                __field(int, num_frames)
+                __field(int, reason)
+                __field(bool, more_data)
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                STA_ASSIGN;
+                __entry->tids = tids;
+                __entry->num_frames = num_frames;
+                __entry->reason = reason;
+                __entry->more_data = more_data;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT STA_PR_FMT
+                " TIDs:0x%.4x frames:%d reason:%d more:%d",
+                LOCAL_PR_ARG, STA_PR_ARG, __entry->tids, __entry->num_frames,
+                __entry->reason, __entry->more_data
+        )
+);
+
+DEFINE_EVENT(release_evt, drv_release_buffered_frames,
+        TP_PROTO(struct ieee80211_local *local,
+                 struct ieee80211_sta *sta,
+                 u16 tids, int num_frames,
+                 enum ieee80211_frame_release_type reason,
+                 bool more_data),
+
+        TP_ARGS(local, sta, tids, num_frames, reason, more_data)
+);
+
+DEFINE_EVENT(release_evt, drv_allow_buffered_frames,
+        TP_PROTO(struct ieee80211_local *local,
+                 struct ieee80211_sta *sta,
+                 u16 tids, int num_frames,
+                 enum ieee80211_frame_release_type reason,
+                 bool more_data),
+
+        TP_ARGS(local, sta, tids, num_frames, reason, more_data)
+);
+
 /*
  * Tracing for API calls that drivers call.
  */
@@ -1431,6 +1498,28 @@ TRACE_EVENT(api_enable_rssi_reports,
         )
 );
 
+TRACE_EVENT(api_eosp,
+        TP_PROTO(struct ieee80211_local *local,
+                 struct ieee80211_sta *sta),
+
+        TP_ARGS(local, sta),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                STA_ENTRY
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                STA_ASSIGN;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT STA_PR_FMT,
+                LOCAL_PR_ARG, STA_PR_FMT
+        )
+);
+
 /*
  * Tracing for internal functions
  * (which may also be called in response to driver calls)
diff --git a/net/mac80211/ht.c b/net/mac80211/ht.c
index 7cfc286946c0..f80a35c0d000 100644
--- a/net/mac80211/ht.c
+++ b/net/mac80211/ht.c
@@ -130,7 +130,7 @@ void ieee80211_ba_session_work(struct work_struct *work)
          * down by the code that set the flag, so this
          * need not run.
          */
-        if (test_sta_flags(sta, WLAN_STA_BLOCK_BA))
+        if (test_sta_flag(sta, WLAN_STA_BLOCK_BA))
                 return;
 
         mutex_lock(&sta->ampdu_mlme.mtx);
@@ -186,12 +186,8 @@ void ieee80211_send_delba(struct ieee80211_sub_if_data *sdata,
         u16 params;
 
         skb = dev_alloc_skb(sizeof(*mgmt) + local->hw.extra_tx_headroom);
-
-        if (!skb) {
-                printk(KERN_ERR "%s: failed to allocate buffer "
-                                        "for delba frame\n", sdata->name);
+        if (!skb)
                 return;
-        }
 
         skb_reserve(skb, local->hw.extra_tx_headroom);
         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index 56c24cabf26d..ede9a8b341ac 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -81,10 +81,10 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
         lockdep_assert_held(&ifibss->mtx);
 
         /* Reset own TSF to allow time synchronization work. */
-        drv_reset_tsf(local);
+        drv_reset_tsf(local, sdata);
 
         skb = ifibss->skb;
-        rcu_assign_pointer(ifibss->presp, NULL);
+        RCU_INIT_POINTER(ifibss->presp, NULL);
         synchronize_rcu();
         skb->data = skb->head;
         skb->len = 0;
@@ -184,7 +184,7 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
                 *pos++ = 0; /* U-APSD no in use */
         }
 
-        rcu_assign_pointer(ifibss->presp, skb);
+        RCU_INIT_POINTER(ifibss->presp, skb);
 
         sdata->vif.bss_conf.beacon_int = beacon_int;
         sdata->vif.bss_conf.basic_rates = basic_rates;
@@ -314,7 +314,7 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
                 }
 
                 if (sta && elems->wmm_info)
-                        set_sta_flags(sta, WLAN_STA_WME);
+                        set_sta_flag(sta, WLAN_STA_WME);
 
                 rcu_read_unlock();
         }
@@ -382,7 +382,7 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
                  * second best option: get current TSF
                  * (will return -1 if not supported)
                  */
-                rx_timestamp = drv_get_tsf(local);
+                rx_timestamp = drv_get_tsf(local, sdata);
         }
 
 #ifdef CONFIG_MAC80211_IBSS_DEBUG
@@ -417,7 +417,7 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
  * must be callable in atomic context.
  */
 struct sta_info *ieee80211_ibss_add_sta(struct ieee80211_sub_if_data *sdata,
-                                        u8 *bssid,u8 *addr, u32 supp_rates,
+                                        u8 *bssid, u8 *addr, u32 supp_rates,
                                         gfp_t gfp)
 {
         struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
@@ -452,7 +452,7 @@ struct sta_info *ieee80211_ibss_add_sta(struct ieee80211_sub_if_data *sdata,
                 return NULL;
 
         sta->last_rx = jiffies;
-        set_sta_flags(sta, WLAN_STA_AUTHORIZED);
+        set_sta_flag(sta, WLAN_STA_AUTHORIZED);
 
         /* make sure mandatory rates are always added */
         sta->sta.supp_rates[band] = supp_rates |
@@ -995,7 +995,7 @@ int ieee80211_ibss_leave(struct ieee80211_sub_if_data *sdata)
         kfree(sdata->u.ibss.ie);
         skb = rcu_dereference_protected(sdata->u.ibss.presp,
                                         lockdep_is_held(&sdata->u.ibss.mtx));
-        rcu_assign_pointer(sdata->u.ibss.presp, NULL);
+        RCU_INIT_POINTER(sdata->u.ibss.presp, NULL);
         sdata->vif.bss_conf.ibss_joined = false;
         ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON_ENABLED |
                                                 BSS_CHANGED_IBSS);
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 400c09bea639..4c3d1f591bec 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -136,7 +136,6 @@ typedef unsigned __bitwise__ ieee80211_tx_result;
 #define TX_DROP         ((__force ieee80211_tx_result) 1u)
 #define TX_QUEUED       ((__force ieee80211_tx_result) 2u)
 
-#define IEEE80211_TX_FRAGMENTED         BIT(0)
 #define IEEE80211_TX_UNICAST            BIT(1)
 #define IEEE80211_TX_PS_BUFFERED        BIT(2)
 
@@ -149,7 +148,6 @@ struct ieee80211_tx_data {
 
         struct ieee80211_channel *channel;
 
-        u16 ethertype;
         unsigned int flags;
 };
 
@@ -261,6 +259,7 @@ struct mesh_stats {
         __u32 fwded_frames;             /* Mesh total forwarded frames */
         __u32 dropped_frames_ttl;       /* Not transmitted since mesh_ttl == 0*/
         __u32 dropped_frames_no_route;  /* Not transmitted, no route found */
+        __u32 dropped_frames_congestion;/* Not forwarded due to congestion */
         atomic_t estab_plinks;
 };
 
@@ -345,6 +344,7 @@ struct ieee80211_work {
                 struct {
                         struct sk_buff *frame;
                         u32 wait;
+                        bool status;
                 } offchan_tx;
         };
 
@@ -514,6 +514,7 @@ struct ieee80211_if_mesh {
         struct mesh_config mshcfg;
         u32 mesh_seqnum;
         bool accepting_plinks;
+        int num_gates;
         const u8 *ie;
         u8 ie_len;
         enum {
@@ -607,6 +608,8 @@ struct ieee80211_sub_if_data {
         __be16 control_port_protocol;
         bool control_port_no_encrypt;
 
+        struct ieee80211_tx_queue_params tx_conf[IEEE80211_MAX_QUEUES];
+
         struct work_struct work;
         struct sk_buff_head skb_queue;
 
@@ -660,6 +663,11 @@ enum sdata_queue_type {
 enum {
         IEEE80211_RX_MSG        = 1,
         IEEE80211_TX_STATUS_MSG = 2,
+        IEEE80211_EOSP_MSG      = 3,
+};
+
+struct skb_eosp_msg_data {
+        u8 sta[ETH_ALEN], iface[ETH_ALEN];
 };
 
 enum queue_stop_reason {
@@ -669,6 +677,7 @@ enum queue_stop_reason {
         IEEE80211_QUEUE_STOP_REASON_AGGREGATION,
         IEEE80211_QUEUE_STOP_REASON_SUSPEND,
         IEEE80211_QUEUE_STOP_REASON_SKB_ADD,
+        IEEE80211_QUEUE_STOP_REASON_CHTYPE_CHANGE,
 };
 
 #ifdef CONFIG_MAC80211_LEDS
@@ -748,7 +757,6 @@ struct ieee80211_local {
         struct workqueue_struct *workqueue;
 
         unsigned long queue_stop_reasons[IEEE80211_MAX_QUEUES];
-        struct ieee80211_tx_queue_params tx_conf[IEEE80211_MAX_QUEUES];
         /* also used to protect ampdu_ac_queue and amdpu_ac_stop_refcnt */
         spinlock_t queue_stop_reason_lock;
 
@@ -1002,7 +1010,6 @@ struct ieee80211_local {
         unsigned int hw_roc_duration;
         u32 hw_roc_cookie;
         bool hw_roc_for_tx;
-        unsigned long hw_offchan_tx_cookie;
 
         /* dummy netdev for use w/ NAPI */
         struct net_device napi_dev;
@@ -1022,69 +1029,6 @@ struct ieee80211_ra_tid {
         u16 tid;
 };
 
-/* Parsed Information Elements */
-struct ieee802_11_elems {
-        u8 *ie_start;
-        size_t total_len;
-
-        /* pointers to IEs */
-        u8 *ssid;
-        u8 *supp_rates;
-        u8 *fh_params;
-        u8 *ds_params;
-        u8 *cf_params;
-        struct ieee80211_tim_ie *tim;
-        u8 *ibss_params;
-        u8 *challenge;
-        u8 *wpa;
-        u8 *rsn;
-        u8 *erp_info;
-        u8 *ext_supp_rates;
-        u8 *wmm_info;
-        u8 *wmm_param;
-        struct ieee80211_ht_cap *ht_cap_elem;
-        struct ieee80211_ht_info *ht_info_elem;
-        struct ieee80211_meshconf_ie *mesh_config;
-        u8 *mesh_id;
-        u8 *peer_link;
-        u8 *preq;
-        u8 *prep;
-        u8 *perr;
-        struct ieee80211_rann_ie *rann;
-        u8 *ch_switch_elem;
-        u8 *country_elem;
-        u8 *pwr_constr_elem;
-        u8 *quiet_elem;         /* first quite element */
-        u8 *timeout_int;
-
-        /* length of them, respectively */
-        u8 ssid_len;
-        u8 supp_rates_len;
-        u8 fh_params_len;
-        u8 ds_params_len;
-        u8 cf_params_len;
-        u8 tim_len;
-        u8 ibss_params_len;
-        u8 challenge_len;
-        u8 wpa_len;
-        u8 rsn_len;
-        u8 erp_info_len;
-        u8 ext_supp_rates_len;
-        u8 wmm_info_len;
-        u8 wmm_param_len;
-        u8 mesh_id_len;
-        u8 peer_link_len;
-        u8 preq_len;
-        u8 prep_len;
-        u8 perr_len;
-        u8 ch_switch_elem_len;
-        u8 country_elem_len;
-        u8 pwr_constr_elem_len;
-        u8 quiet_elem_len;
-        u8 num_of_quiet_elem;   /* can be more the one */
-        u8 timeout_int_len;
-};
-
 static inline struct ieee80211_local *hw_to_local(
         struct ieee80211_hw *hw)
 {
@@ -1233,23 +1177,10 @@ netdev_tx_t ieee80211_monitor_start_xmit(struct sk_buff *skb,
 netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
                                        struct net_device *dev);
 
-/*
- * radiotap header for status frames
- */
-struct ieee80211_tx_status_rtap_hdr {
-        struct ieee80211_radiotap_header hdr;
-        u8 rate;
-        u8 padding_for_rate;
-        __le16 tx_flags;
-        u8 data_retries;
-} __packed;
-
-
 /* HT */
 void ieee80211_ht_cap_ie_to_sta_ht_cap(struct ieee80211_supported_band *sband,
                                        struct ieee80211_ht_cap *ht_cap_ie,
                                        struct ieee80211_sta_ht_cap *ht_cap);
-void ieee80211_send_bar(struct ieee80211_sub_if_data *sdata, u8 *ra, u16 tid, u16 ssn);
 void ieee80211_send_delba(struct ieee80211_sub_if_data *sdata,
                           const u8 *da, u16 tid,
                           u16 initiator, u16 reason_code);
@@ -1333,6 +1264,7 @@ void mac80211_ev_michael_mic_failure(struct ieee80211_sub_if_data *sdata, int ke
                                      struct ieee80211_hdr *hdr, const u8 *tsc,
                                      gfp_t gfp);
 void ieee80211_set_wmm_default(struct ieee80211_sub_if_data *sdata);
+void ieee80211_xmit(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb);
 void ieee80211_tx_skb(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb);
 void ieee802_11_parse_elems(u8 *start, size_t len,
                             struct ieee802_11_elems *elems);
@@ -1364,11 +1296,11 @@ void ieee80211_stop_queue_by_reason(struct ieee80211_hw *hw, int queue,
                                     enum queue_stop_reason reason);
 void ieee80211_add_pending_skb(struct ieee80211_local *local,
                                struct sk_buff *skb);
-int ieee80211_add_pending_skbs(struct ieee80211_local *local,
-                               struct sk_buff_head *skbs);
-int ieee80211_add_pending_skbs_fn(struct ieee80211_local *local,
-                                  struct sk_buff_head *skbs,
-                                  void (*fn)(void *data), void *data);
+void ieee80211_add_pending_skbs(struct ieee80211_local *local,
+                                struct sk_buff_head *skbs);
+void ieee80211_add_pending_skbs_fn(struct ieee80211_local *local,
+                                   struct sk_buff_head *skbs,
+                                   void (*fn)(void *data), void *data);
 
 void ieee80211_send_auth(struct ieee80211_sub_if_data *sdata,
                          u16 transaction, u16 auth_alg,
@@ -1386,7 +1318,7 @@ struct sk_buff *ieee80211_build_probe_req(struct ieee80211_sub_if_data *sdata,
 void ieee80211_send_probe_req(struct ieee80211_sub_if_data *sdata, u8 *dst,
                               const u8 *ssid, size_t ssid_len,
                               const u8 *ie, size_t ie_len,
-                              u32 ratemask, bool directed);
+                              u32 ratemask, bool directed, bool no_cck);
 
 void ieee80211_sta_def_wmm_params(struct ieee80211_sub_if_data *sdata,
                                   const size_t supp_rates_len,
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 556e7e6ddf0a..30d73552e9ab 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -299,8 +299,8 @@ static int ieee80211_do_open(struct net_device *dev, bool coming_up)
                         goto err_del_interface;
                 }
 
-                /* no locking required since STA is not live yet */
-                sta->flags |= WLAN_STA_AUTHORIZED;
+                /* no atomic bitop required since STA is not live yet */
+                set_sta_flag(sta, WLAN_STA_AUTHORIZED);
 
                 res = sta_info_insert(sta);
                 if (res) {
@@ -456,21 +456,19 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
                                                  BSS_CHANGED_BEACON_ENABLED);
 
                 /* remove beacon */
-                rcu_assign_pointer(sdata->u.ap.beacon, NULL);
+                RCU_INIT_POINTER(sdata->u.ap.beacon, NULL);
                 synchronize_rcu();
                 kfree(old_beacon);
 
-                /* free all potentially still buffered bcast frames */
-                while ((skb = skb_dequeue(&sdata->u.ap.ps_bc_buf))) {
-                        local->total_ps_buffered--;
-                        dev_kfree_skb(skb);
-                }
-
                 /* down all dependent devices, that is VLANs */
                 list_for_each_entry_safe(vlan, tmpsdata, &sdata->u.ap.vlans,
                                          u.vlan.list)
                         dev_close(vlan->dev);
                 WARN_ON(!list_empty(&sdata->u.ap.vlans));
+
+                /* free all potentially still buffered bcast frames */
+                local->total_ps_buffered -= skb_queue_len(&sdata->u.ap.ps_bc_buf);
+                skb_queue_purge(&sdata->u.ap.ps_bc_buf);
         }
 
         if (going_down)
@@ -645,7 +643,7 @@ static const struct net_device_ops ieee80211_dataif_ops = {
         .ndo_stop               = ieee80211_stop,
         .ndo_uninit             = ieee80211_teardown_sdata,
         .ndo_start_xmit         = ieee80211_subif_start_xmit,
-        .ndo_set_multicast_list = ieee80211_set_multicast_list,
+        .ndo_set_rx_mode        = ieee80211_set_multicast_list,
         .ndo_change_mtu         = ieee80211_change_mtu,
         .ndo_set_mac_address    = ieee80211_change_mac,
         .ndo_select_queue       = ieee80211_netdev_select_queue,
@@ -689,7 +687,7 @@ static const struct net_device_ops ieee80211_monitorif_ops = {
         .ndo_stop               = ieee80211_stop,
         .ndo_uninit             = ieee80211_teardown_sdata,
         .ndo_start_xmit         = ieee80211_monitor_start_xmit,
-        .ndo_set_multicast_list = ieee80211_set_multicast_list,
+        .ndo_set_rx_mode        = ieee80211_set_multicast_list,
         .ndo_change_mtu         = ieee80211_change_mtu,
         .ndo_set_mac_address    = eth_mac_addr,
         .ndo_select_queue       = ieee80211_monitor_select_queue,
@@ -1214,6 +1212,9 @@ void ieee80211_if_remove(struct ieee80211_sub_if_data *sdata)
         list_del_rcu(&sdata->list);
         mutex_unlock(&sdata->local->iflist_mtx);
 
+        if (ieee80211_vif_is_mesh(&sdata->vif))
+                mesh_path_flush_by_iface(sdata);
+
         synchronize_rcu();
         unregister_netdevice(sdata->dev);
 }
@@ -1233,6 +1234,9 @@ void ieee80211_remove_interfaces(struct ieee80211_local *local)
         list_for_each_entry_safe(sdata, tmp, &local->interfaces, list) {
                 list_del(&sdata->list);
 
+                if (ieee80211_vif_is_mesh(&sdata->vif))
+                        mesh_path_flush_by_iface(sdata);
+
                 unregister_netdevice_queue(sdata->dev, &unreg_list);
         }
         mutex_unlock(&local->iflist_mtx);
diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index 5150c6d11b57..756b157c2edd 100644
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -464,7 +464,7 @@ int ieee80211_key_link(struct ieee80211_key *key,
                  * some hardware cannot handle TKIP with QoS, so
                  * we indicate whether QoS could be in use.
                  */
-                if (test_sta_flags(sta, WLAN_STA_WME))
+                if (test_sta_flag(sta, WLAN_STA_WME))
                         key->conf.flags |= IEEE80211_KEY_FLAG_WMM_STA;
         } else {
                 if (sdata->vif.type == NL80211_IFTYPE_STATION) {
@@ -478,7 +478,7 @@ int ieee80211_key_link(struct ieee80211_key *key,
                         /* same here, the AP could be using QoS */
                         ap = sta_info_get(key->sdata, key->sdata->u.mgd.bssid);
                         if (ap) {
-                                if (test_sta_flags(ap, WLAN_STA_WME))
+                                if (test_sta_flag(ap, WLAN_STA_WME))
                                         key->conf.flags |=
                                                 IEEE80211_KEY_FLAG_WMM_STA;
                         }
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index acb44230b251..d999bf3b84e1 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -19,7 +19,7 @@
 #include <linux/if_arp.h>
 #include <linux/rtnetlink.h>
 #include <linux/bitmap.h>
-#include <linux/pm_qos_params.h>
+#include <linux/pm_qos.h>
 #include <linux/inetdevice.h>
 #include <net/net_namespace.h>
 #include <net/cfg80211.h>
@@ -325,6 +325,8 @@ u32 ieee80211_reset_erp_info(struct ieee80211_sub_if_data *sdata)
 static void ieee80211_tasklet_handler(unsigned long data)
 {
         struct ieee80211_local *local = (struct ieee80211_local *) data;
+        struct sta_info *sta, *tmp;
+        struct skb_eosp_msg_data *eosp_data;
         struct sk_buff *skb;
 
         while ((skb = skb_dequeue(&local->skb_queue)) ||
@@ -340,6 +342,18 @@ static void ieee80211_tasklet_handler(unsigned long data)
                         skb->pkt_type = 0;
                         ieee80211_tx_status(local_to_hw(local), skb);
                         break;
+                case IEEE80211_EOSP_MSG:
+                        eosp_data = (void *)skb->cb;
+                        for_each_sta_info(local, eosp_data->sta, sta, tmp) {
+                                /* skip wrong virtual interface */
+                                if (memcmp(eosp_data->iface,
+                                           sta->sdata->vif.addr, ETH_ALEN))
+                                        continue;
+                                clear_sta_flag(sta, WLAN_STA_SP);
+                                break;
+                        }
+                        dev_kfree_skb(skb);
+                        break;
                 default:
                         WARN(1, "mac80211: Packet is of unknown type %d\n",
                              skb->pkt_type);
@@ -608,6 +622,7 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
         local->hw.max_rates = 1;
         local->hw.max_report_rates = 0;
         local->hw.max_rx_aggregation_subframes = IEEE80211_MAX_AMPDU_BUF;
+        local->hw.max_tx_aggregation_subframes = IEEE80211_MAX_AMPDU_BUF;
         local->hw.conf.long_frame_max_tx_count = wiphy->retry_long;
         local->hw.conf.short_frame_max_tx_count = wiphy->retry_short;
         local->user_power_level = -1;
@@ -862,6 +877,10 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
         if (local->ops->sched_scan_start)
                 local->hw.wiphy->flags |= WIPHY_FLAG_SUPPORTS_SCHED_SCAN;
 
+        /* mac80211 based drivers don't support internal TDLS setup */
+        if (local->hw.wiphy->flags & WIPHY_FLAG_SUPPORTS_TDLS)
+                local->hw.wiphy->flags |= WIPHY_FLAG_TDLS_EXTERNAL_SETUP;
+
         result = wiphy_register(local->hw.wiphy);
         if (result < 0)
                 goto fail_wiphy_register;
@@ -885,12 +904,8 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
          * and we need some headroom for passing the frame to monitor
          * interfaces, but never both at the same time.
          */
-#ifndef __CHECKER__
-        BUILD_BUG_ON(IEEE80211_TX_STATUS_HEADROOM !=
-                        sizeof(struct ieee80211_tx_status_rtap_hdr));
-#endif
         local->tx_headroom = max_t(unsigned int , local->hw.extra_tx_headroom,
-                                   sizeof(struct ieee80211_tx_status_rtap_hdr));
+                                   IEEE80211_TX_STATUS_HEADROOM);
 
         debugfs_hw_add(local);
 
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index 29e9980c8e60..a7078fdba8ca 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -13,10 +13,6 @@
 #include "ieee80211_i.h"
 #include "mesh.h"
 
-#define IEEE80211_MESH_PEER_INACTIVITY_LIMIT (1800 * HZ)
-#define IEEE80211_MESH_HOUSEKEEPING_INTERVAL (60 * HZ)
-#define IEEE80211_MESH_RANN_INTERVAL         (1 * HZ)
-
 #define MESHCONF_CAPAB_ACCEPT_PLINKS 0x01
 #define MESHCONF_CAPAB_FORWARDING    0x08
 
@@ -27,6 +23,17 @@
 int mesh_allocated;
 static struct kmem_cache *rm_cache;
 
+#ifdef CONFIG_MAC80211_MESH
+bool mesh_action_is_path_sel(struct ieee80211_mgmt *mgmt)
+{
+        return (mgmt->u.action.u.mesh_action.action_code ==
+                        WLAN_MESH_ACTION_HWMP_PATH_SELECTION);
+}
+#else
+bool mesh_action_is_path_sel(struct ieee80211_mgmt *mgmt)
+{ return false; }
+#endif
+
 void ieee80211s_init(void)
 {
         mesh_pathtbl_init();
@@ -193,10 +200,9 @@ int mesh_rmc_check(u8 *sa, struct ieee80211s_hdr *mesh_hdr,
         }
 
         p = kmem_cache_alloc(rm_cache, GFP_ATOMIC);
-        if (!p) {
-                printk(KERN_DEBUG "o11s: could not allocate RMC entry\n");
+        if (!p)
                 return 0;
-        }
+
         p->seqnum = seqnum;
         p->exp_time = jiffies + RMC_TIMEOUT;
         memcpy(p->sa, sa, ETH_ALEN);
@@ -204,89 +210,136 @@ int mesh_rmc_check(u8 *sa, struct ieee80211s_hdr *mesh_hdr,
         return 0;
 }
 
-void mesh_mgmt_ies_add(struct sk_buff *skb, struct ieee80211_sub_if_data *sdata)
+int
+mesh_add_meshconf_ie(struct sk_buff *skb, struct ieee80211_sub_if_data *sdata)
 {
-        struct ieee80211_local *local = sdata->local;
-        struct ieee80211_supported_band *sband;
-        u8 *pos;
-        int len, i, rate;
-        u8 neighbors;
-
-        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
-        len = sband->n_bitrates;
-        if (len > 8)
-                len = 8;
-        pos = skb_put(skb, len + 2);
-        *pos++ = WLAN_EID_SUPP_RATES;
-        *pos++ = len;
-        for (i = 0; i < len; i++) {
-                rate = sband->bitrates[i].bitrate;
-                *pos++ = (u8) (rate / 5);
-        }
-
-        if (sband->n_bitrates > len) {
-                pos = skb_put(skb, sband->n_bitrates - len + 2);
-                *pos++ = WLAN_EID_EXT_SUPP_RATES;
-                *pos++ = sband->n_bitrates - len;
-                for (i = len; i < sband->n_bitrates; i++) {
-                        rate = sband->bitrates[i].bitrate;
-                        *pos++ = (u8) (rate / 5);
-                }
-        }
-
-        if (sband->band == IEEE80211_BAND_2GHZ) {
-                pos = skb_put(skb, 2 + 1);
-                *pos++ = WLAN_EID_DS_PARAMS;
-                *pos++ = 1;
-                *pos++ = ieee80211_frequency_to_channel(local->hw.conf.channel->center_freq);
-        }
+        struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
+        u8 *pos, neighbors;
+        u8 meshconf_len = sizeof(struct ieee80211_meshconf_ie);
 
-        pos = skb_put(skb, 2 + sdata->u.mesh.mesh_id_len);
-        *pos++ = WLAN_EID_MESH_ID;
-        *pos++ = sdata->u.mesh.mesh_id_len;
-        if (sdata->u.mesh.mesh_id_len)
-                memcpy(pos, sdata->u.mesh.mesh_id, sdata->u.mesh.mesh_id_len);
+        if (skb_tailroom(skb) < 2 + meshconf_len)
+                return -ENOMEM;
 
-        pos = skb_put(skb, 2 + sizeof(struct ieee80211_meshconf_ie));
+        pos = skb_put(skb, 2 + meshconf_len);
         *pos++ = WLAN_EID_MESH_CONFIG;
-        *pos++ = sizeof(struct ieee80211_meshconf_ie);
+        *pos++ = meshconf_len;
 
         /* Active path selection protocol ID */
-        *pos++ = sdata->u.mesh.mesh_pp_id;
-
+        *pos++ = ifmsh->mesh_pp_id;
         /* Active path selection metric ID   */
-        *pos++ = sdata->u.mesh.mesh_pm_id;
-
+        *pos++ = ifmsh->mesh_pm_id;
         /* Congestion control mode identifier */
-        *pos++ = sdata->u.mesh.mesh_cc_id;
-
+        *pos++ = ifmsh->mesh_cc_id;
         /* Synchronization protocol identifier */
-        *pos++ = sdata->u.mesh.mesh_sp_id;
-
+        *pos++ = ifmsh->mesh_sp_id;
         /* Authentication Protocol identifier */
-        *pos++ = sdata->u.mesh.mesh_auth_id;
-
+        *pos++ = ifmsh->mesh_auth_id;
         /* Mesh Formation Info - number of neighbors */
-        neighbors = atomic_read(&sdata->u.mesh.mshstats.estab_plinks);
+        neighbors = atomic_read(&ifmsh->mshstats.estab_plinks);
         /* Number of neighbor mesh STAs or 15 whichever is smaller */
         neighbors = (neighbors > 15) ? 15 : neighbors;
         *pos++ = neighbors << 1;
-
         /* Mesh capability */
-        sdata->u.mesh.accepting_plinks = mesh_plink_availables(sdata);
+        ifmsh->accepting_plinks = mesh_plink_availables(sdata);
         *pos = MESHCONF_CAPAB_FORWARDING;
-        *pos++ |= sdata->u.mesh.accepting_plinks ?
+        *pos++ |= ifmsh->accepting_plinks ?
             MESHCONF_CAPAB_ACCEPT_PLINKS : 0x00;
         *pos++ = 0x00;
 
-        if (sdata->u.mesh.ie) {
-                int len = sdata->u.mesh.ie_len;
-                const u8 *data = sdata->u.mesh.ie;
-                if (skb_tailroom(skb) > len)
-                        memcpy(skb_put(skb, len), data, len);
+        return 0;
+}
+
+int
+mesh_add_meshid_ie(struct sk_buff *skb, struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
+        u8 *pos;
+
+        if (skb_tailroom(skb) < 2 + ifmsh->mesh_id_len)
+                return -ENOMEM;
+
+        pos = skb_put(skb, 2 + ifmsh->mesh_id_len);
+        *pos++ = WLAN_EID_MESH_ID;
+        *pos++ = ifmsh->mesh_id_len;
+        if (ifmsh->mesh_id_len)
+                memcpy(pos, ifmsh->mesh_id, ifmsh->mesh_id_len);
+
+        return 0;
+}
+
+int
+mesh_add_vendor_ies(struct sk_buff *skb, struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
+        u8 offset, len;
+        const u8 *data;
+
+        if (!ifmsh->ie || !ifmsh->ie_len)
+                return 0;
+
+        /* fast-forward to vendor IEs */
+        offset = ieee80211_ie_split_vendor(ifmsh->ie, ifmsh->ie_len, 0);
+
+        if (offset) {
+                len = ifmsh->ie_len - offset;
+                data = ifmsh->ie + offset;
+                if (skb_tailroom(skb) < len)
+                        return -ENOMEM;
+                memcpy(skb_put(skb, len), data, len);
         }
+
+        return 0;
 }
 
+int
+mesh_add_rsn_ie(struct sk_buff *skb, struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
+        u8 len = 0;
+        const u8 *data;
+
+        if (!ifmsh->ie || !ifmsh->ie_len)
+                return 0;
+
+        /* find RSN IE */
+        data = ifmsh->ie;
+        while (data < ifmsh->ie + ifmsh->ie_len) {
+                if (*data == WLAN_EID_RSN) {
+                        len = data[1] + 2;
+                        break;
+                }
+                data++;
+        }
+
+        if (len) {
+                if (skb_tailroom(skb) < len)
+                        return -ENOMEM;
+                memcpy(skb_put(skb, len), data, len);
+        }
+
+        return 0;
+}
+
+int mesh_add_ds_params_ie(struct sk_buff *skb,
+                          struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_supported_band *sband;
+        u8 *pos;
+
+        if (skb_tailroom(skb) < 3)
+                return -ENOMEM;
+
+        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
+        if (sband->band == IEEE80211_BAND_2GHZ) {
+                pos = skb_put(skb, 2 + 1);
+                *pos++ = WLAN_EID_DS_PARAMS;
+                *pos++ = 1;
+                *pos++ = ieee80211_frequency_to_channel(local->hw.conf.channel->center_freq);
+        }
+
+        return 0;
+}
 
 static void ieee80211_mesh_path_timer(unsigned long data)
 {
@@ -352,8 +405,7 @@ int ieee80211_fill_mesh_addresses(struct ieee80211_hdr *hdr, __le16 *fc,
                 memcpy(hdr->addr3, meshsa, ETH_ALEN);
                 return 24;
         } else {
-                *fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS |
-                                IEEE80211_FCTL_TODS);
+                *fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
                 /* RA TA DA SA */
                 memset(hdr->addr1, 0, ETH_ALEN);   /* RA is resolved later */
                 memcpy(hdr->addr2, meshsa, ETH_ALEN);
@@ -425,7 +477,8 @@ static void ieee80211_mesh_rootpath(struct ieee80211_sub_if_data *sdata)
 
         mesh_path_tx_root_frame(sdata);
         mod_timer(&ifmsh->mesh_path_root_timer,
-                  round_jiffies(jiffies + IEEE80211_MESH_RANN_INTERVAL));
+                  round_jiffies(TU_TO_EXP_TIME(
+                                  ifmsh->mshcfg.dot11MeshHWMPRannInterval)));
 }
 
 #ifdef CONFIG_PM
@@ -433,7 +486,7 @@ void ieee80211_mesh_quiesce(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
 
-        /* use atomic bitops in case both timers fire at the same time */
+        /* use atomic bitops in case all timers fire at the same time */
 
         if (del_timer_sync(&ifmsh->housekeeping_timer))
                 set_bit(TMR_RUNNING_HK, &ifmsh->timers_running);
@@ -557,11 +610,18 @@ static void ieee80211_mesh_rx_mgmt_action(struct ieee80211_sub_if_data *sdata,
                                           struct ieee80211_rx_status *rx_status)
 {
         switch (mgmt->u.action.category) {
-        case WLAN_CATEGORY_MESH_ACTION:
-                mesh_rx_plink_frame(sdata, mgmt, len, rx_status);
+        case WLAN_CATEGORY_SELF_PROTECTED:
+                switch (mgmt->u.action.u.self_prot.action_code) {
+                case WLAN_SP_MESH_PEERING_OPEN:
+                case WLAN_SP_MESH_PEERING_CLOSE:
+                case WLAN_SP_MESH_PEERING_CONFIRM:
+                        mesh_rx_plink_frame(sdata, mgmt, len, rx_status);
+                        break;
+                }
                 break;
-        case WLAN_CATEGORY_MESH_PATH_SEL:
-                mesh_rx_path_sel_frame(sdata, mgmt, len);
+        case WLAN_CATEGORY_MESH_ACTION:
+                if (mesh_action_is_path_sel(mgmt))
+                        mesh_rx_path_sel_frame(sdata, mgmt, len);
                 break;
         }
 }
@@ -633,6 +693,7 @@ void ieee80211_mesh_init_sdata(struct ieee80211_sub_if_data *sdata)
         ifmsh->accepting_plinks = true;
         ifmsh->preq_id = 0;
         ifmsh->sn = 0;
+        ifmsh->num_gates = 0;
         atomic_set(&ifmsh->mpaths, 0);
         mesh_rmc_init(sdata);
         ifmsh->last_preq = jiffies;
diff --git a/net/mac80211/mesh.h b/net/mac80211/mesh.h
index 249e733362e7..8c00e2d1d636 100644
--- a/net/mac80211/mesh.h
+++ b/net/mac80211/mesh.h
@@ -80,7 +80,10 @@ enum mesh_deferred_task_flags {
  *      retry
  * @discovery_retries: number of discovery retries
  * @flags: mesh path flags, as specified on &enum mesh_path_flags
- * @state_lock: mesh path state lock
+ * @state_lock: mesh path state lock used to protect changes to the
+ * mpath itself.  No need to take this lock when adding or removing
+ * an mpath to a hash bucket on a path table.
+ * @is_gate: the destination station of this path is a mesh gate
  *
  *
  * The combination of dst and sdata is unique in the mesh path table. Since the
@@ -104,6 +107,7 @@ struct mesh_path {
         u8 discovery_retries;
         enum mesh_path_flags flags;
         spinlock_t state_lock;
+        bool is_gate;
 };
 
 /**
@@ -120,6 +124,9 @@ struct mesh_path {
  *      buckets
  * @mean_chain_len: maximum average length for the hash buckets' list, if it is
  *      reached, the table will grow
+ * @known_gates: list of known mesh gates and their mpaths by the station. The
+ * gate's mpath may or may not be resolved and active.
+ *
  * rcu_head: RCU head to free the table
  */
 struct mesh_table {
@@ -133,6 +140,8 @@ struct mesh_table {
         int (*copy_node) (struct hlist_node *p, struct mesh_table *newtbl);
         int size_order;
         int mean_chain_len;
+        struct hlist_head *known_gates;
+        spinlock_t gates_lock;
 
         struct rcu_head rcu_head;
 };
@@ -166,6 +175,8 @@ struct mesh_rmc {
         u32 idx_mask;
 };
 
+#define IEEE80211_MESH_PEER_INACTIVITY_LIMIT (1800 * HZ)
+#define IEEE80211_MESH_HOUSEKEEPING_INTERVAL (60 * HZ)
 
 #define MESH_DEFAULT_BEACON_INTERVAL            1000    /* in 1024 us units */
 
@@ -177,14 +188,6 @@ struct mesh_rmc {
 /* Maximum number of paths per interface */
 #define MESH_MAX_MPATHS         1024
 
-/* Pending ANA approval */
-#define MESH_PATH_SEL_ACTION    0
-
-/* PERR reason codes */
-#define PEER_RCODE_UNSPECIFIED  11
-#define PERR_RCODE_NO_ROUTE     12
-#define PERR_RCODE_DEST_UNREACH 13
-
 /* Public interfaces */
 /* Various */
 int ieee80211_fill_mesh_addresses(struct ieee80211_hdr *hdr, __le16 *fc,
@@ -199,6 +202,16 @@ bool mesh_matches_local(struct ieee802_11_elems *ie,
 void mesh_ids_set_default(struct ieee80211_if_mesh *mesh);
 void mesh_mgmt_ies_add(struct sk_buff *skb,
                 struct ieee80211_sub_if_data *sdata);
+int mesh_add_meshconf_ie(struct sk_buff *skb,
+                         struct ieee80211_sub_if_data *sdata);
+int mesh_add_meshid_ie(struct sk_buff *skb,
+                       struct ieee80211_sub_if_data *sdata);
+int mesh_add_rsn_ie(struct sk_buff *skb,
+                    struct ieee80211_sub_if_data *sdata);
+int mesh_add_vendor_ies(struct sk_buff *skb,
+                        struct ieee80211_sub_if_data *sdata);
+int mesh_add_ds_params_ie(struct sk_buff *skb,
+                          struct ieee80211_sub_if_data *sdata);
 void mesh_rmc_free(struct ieee80211_sub_if_data *sdata);
 int mesh_rmc_init(struct ieee80211_sub_if_data *sdata);
 void ieee80211s_init(void);
@@ -223,10 +236,13 @@ struct mesh_path *mesh_path_lookup_by_idx(int idx,
                 struct ieee80211_sub_if_data *sdata);
 void mesh_path_fix_nexthop(struct mesh_path *mpath, struct sta_info *next_hop);
 void mesh_path_expire(struct ieee80211_sub_if_data *sdata);
-void mesh_path_flush(struct ieee80211_sub_if_data *sdata);
 void mesh_rx_path_sel_frame(struct ieee80211_sub_if_data *sdata,
                 struct ieee80211_mgmt *mgmt, size_t len);
 int mesh_path_add(u8 *dst, struct ieee80211_sub_if_data *sdata);
+
+int mesh_path_add_gate(struct mesh_path *mpath);
+int mesh_path_send_to_gates(struct mesh_path *mpath);
+int mesh_gate_num(struct ieee80211_sub_if_data *sdata);
 /* Mesh plinks */
 void mesh_neighbour_update(u8 *hw_addr, u32 rates,
                 struct ieee80211_sub_if_data *sdata,
@@ -256,12 +272,14 @@ void mesh_pathtbl_unregister(void);
 int mesh_path_del(u8 *addr, struct ieee80211_sub_if_data *sdata);
 void mesh_path_timer(unsigned long data);
 void mesh_path_flush_by_nexthop(struct sta_info *sta);
+void mesh_path_flush_by_iface(struct ieee80211_sub_if_data *sdata);
 void mesh_path_discard_frame(struct sk_buff *skb,
                 struct ieee80211_sub_if_data *sdata);
 void mesh_path_quiesce(struct ieee80211_sub_if_data *sdata);
 void mesh_path_restart(struct ieee80211_sub_if_data *sdata);
 void mesh_path_tx_root_frame(struct ieee80211_sub_if_data *sdata);
 
+bool mesh_action_is_path_sel(struct ieee80211_mgmt *mgmt);
 extern int mesh_paths_generation;
 
 #ifdef CONFIG_MAC80211_MESH
diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
index 3460108810d5..174040a42887 100644
--- a/net/mac80211/mesh_hwmp.c
+++ b/net/mac80211/mesh_hwmp.c
@@ -8,10 +8,12 @@
  */
 
 #include <linux/slab.h>
+#include "wme.h"
 #include "mesh.h"
 
 #ifdef CONFIG_MAC80211_VERBOSE_MHWMP_DEBUG
-#define mhwmp_dbg(fmt, args...)   printk(KERN_DEBUG "Mesh HWMP: " fmt, ##args)
+#define mhwmp_dbg(fmt, args...) \
+        printk(KERN_DEBUG "Mesh HWMP (%s): " fmt "\n", sdata->name, ##args)
 #else
 #define mhwmp_dbg(fmt, args...)   do { (void)(0); } while (0)
 #endif
@@ -68,12 +70,12 @@ static inline u32 u16_field_get(u8 *preq_elem, int offset, bool ae)
 #define PREP_IE_FLAGS(x)        PREQ_IE_FLAGS(x)
 #define PREP_IE_HOPCOUNT(x)     PREQ_IE_HOPCOUNT(x)
 #define PREP_IE_TTL(x)          PREQ_IE_TTL(x)
-#define PREP_IE_ORIG_ADDR(x)    (x + 3)
-#define PREP_IE_ORIG_SN(x)      u32_field_get(x, 9, 0)
+#define PREP_IE_ORIG_ADDR(x)    (AE_F_SET(x) ? x + 27 : x + 21)
+#define PREP_IE_ORIG_SN(x)      u32_field_get(x, 27, AE_F_SET(x))
 #define PREP_IE_LIFETIME(x)     u32_field_get(x, 13, AE_F_SET(x))
 #define PREP_IE_METRIC(x)       u32_field_get(x, 17, AE_F_SET(x))
-#define PREP_IE_TARGET_ADDR(x)  (AE_F_SET(x) ? x + 27 : x + 21)
-#define PREP_IE_TARGET_SN(x)    u32_field_get(x, 27, AE_F_SET(x))
+#define PREP_IE_TARGET_ADDR(x)  (x + 3)
+#define PREP_IE_TARGET_SN(x)    u32_field_get(x, 9, 0)
 
 #define PERR_IE_TTL(x)          (*(x))
 #define PERR_IE_TARGET_FLAGS(x) (*(x + 2))
@@ -132,24 +134,25 @@ static int mesh_path_sel_frame_tx(enum mpath_frame_type action, u8 flags,
         memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
         /* BSSID == SA */
         memcpy(mgmt->bssid, sdata->vif.addr, ETH_ALEN);
-        mgmt->u.action.category = WLAN_CATEGORY_MESH_PATH_SEL;
-        mgmt->u.action.u.mesh_action.action_code = MESH_PATH_SEL_ACTION;
+        mgmt->u.action.category = WLAN_CATEGORY_MESH_ACTION;
+        mgmt->u.action.u.mesh_action.action_code =
+                                        WLAN_MESH_ACTION_HWMP_PATH_SELECTION;
 
         switch (action) {
         case MPATH_PREQ:
-                mhwmp_dbg("sending PREQ to %pM\n", target);
+                mhwmp_dbg("sending PREQ to %pM", target);
                 ie_len = 37;
                 pos = skb_put(skb, 2 + ie_len);
                 *pos++ = WLAN_EID_PREQ;
                 break;
         case MPATH_PREP:
-                mhwmp_dbg("sending PREP to %pM\n", target);
+                mhwmp_dbg("sending PREP to %pM", target);
                 ie_len = 31;
                 pos = skb_put(skb, 2 + ie_len);
                 *pos++ = WLAN_EID_PREP;
                 break;
         case MPATH_RANN:
-                mhwmp_dbg("sending RANN from %pM\n", orig_addr);
+                mhwmp_dbg("sending RANN from %pM", orig_addr);
                 ie_len = sizeof(struct ieee80211_rann_ie);
                 pos = skb_put(skb, 2 + ie_len);
                 *pos++ = WLAN_EID_RANN;
@@ -163,35 +166,63 @@ static int mesh_path_sel_frame_tx(enum mpath_frame_type action, u8 flags,
         *pos++ = flags;
         *pos++ = hop_count;
         *pos++ = ttl;
-        if (action == MPATH_PREQ) {
-                memcpy(pos, &preq_id, 4);
+        if (action == MPATH_PREP) {
+                memcpy(pos, target, ETH_ALEN);
+                pos += ETH_ALEN;
+                memcpy(pos, &target_sn, 4);
                 pos += 4;
-        }
-        memcpy(pos, orig_addr, ETH_ALEN);
-        pos += ETH_ALEN;
-        memcpy(pos, &orig_sn, 4);
-        pos += 4;
-        if (action != MPATH_RANN) {
-                memcpy(pos, &lifetime, 4);
+        } else {
+                if (action == MPATH_PREQ) {
+                        memcpy(pos, &preq_id, 4);
+                        pos += 4;
+                }
+                memcpy(pos, orig_addr, ETH_ALEN);
+                pos += ETH_ALEN;
+                memcpy(pos, &orig_sn, 4);
                 pos += 4;
         }
+        memcpy(pos, &lifetime, 4);      /* interval for RANN */
+        pos += 4;
         memcpy(pos, &metric, 4);
         pos += 4;
         if (action == MPATH_PREQ) {
-                /* destination count */
-                *pos++ = 1;
+                *pos++ = 1; /* destination count */
                 *pos++ = target_flags;
-        }
-        if (action != MPATH_RANN) {
                 memcpy(pos, target, ETH_ALEN);
                 pos += ETH_ALEN;
                 memcpy(pos, &target_sn, 4);
+                pos += 4;
+        } else if (action == MPATH_PREP) {
+                memcpy(pos, orig_addr, ETH_ALEN);
+                pos += ETH_ALEN;
+                memcpy(pos, &orig_sn, 4);
+                pos += 4;
         }
 
         ieee80211_tx_skb(sdata, skb);
         return 0;
 }
 
+
+/*  Headroom is not adjusted.  Caller should ensure that skb has sufficient
+ *  headroom in case the frame is encrypted. */
+static void prepare_frame_for_deferred_tx(struct ieee80211_sub_if_data *sdata,
+                struct sk_buff *skb)
+{
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+
+        skb_set_mac_header(skb, 0);
+        skb_set_network_header(skb, 0);
+        skb_set_transport_header(skb, 0);
+
+        /* Send all internal mgmt frames on VO. Accordingly set TID to 7. */
+        skb_set_queue_mapping(skb, IEEE80211_AC_VO);
+        skb->priority = 7;
+
+        info->control.vif = &sdata->vif;
+        ieee80211_set_qos_hdr(sdata, skb);
+}
+
 /**
  * mesh_send_path error - Sends a PERR mesh management frame
  *
@@ -199,6 +230,10 @@ static int mesh_path_sel_frame_tx(enum mpath_frame_type action, u8 flags,
  * @target_sn: SN of the broken destination
  * @target_rcode: reason code for this PERR
  * @ra: node this frame is addressed to
+ *
+ * Note: This function may be called with driver locks taken that the driver
+ * also acquires in the TX path.  To avoid a deadlock we don't transmit the
+ * frame directly but add it to the pending queue instead.
  */
 int mesh_path_error_tx(u8 ttl, u8 *target, __le32 target_sn,
                        __le16 target_rcode, const u8 *ra,
@@ -212,7 +247,7 @@ int mesh_path_error_tx(u8 ttl, u8 *target, __le32 target_sn,
 
         if (!skb)
                 return -1;
-        skb_reserve(skb, local->hw.extra_tx_headroom);
+        skb_reserve(skb, local->tx_headroom + local->hw.extra_tx_headroom);
         /* 25 is the size of the common mgmt part (24) plus the size of the
          * common action part (1)
          */
@@ -224,9 +259,11 @@ int mesh_path_error_tx(u8 ttl, u8 *target, __le32 target_sn,
 
         memcpy(mgmt->da, ra, ETH_ALEN);
         memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
-        /* BSSID is left zeroed, wildcard value */
-        mgmt->u.action.category = WLAN_CATEGORY_MESH_PATH_SEL;
-        mgmt->u.action.u.mesh_action.action_code = MESH_PATH_SEL_ACTION;
+        /* BSSID == SA */
+        memcpy(mgmt->bssid, sdata->vif.addr, ETH_ALEN);
+        mgmt->u.action.category = WLAN_CATEGORY_MESH_ACTION;
+        mgmt->u.action.u.mesh_action.action_code =
+                                        WLAN_MESH_ACTION_HWMP_PATH_SELECTION;
         ie_len = 15;
         pos = skb_put(skb, 2 + ie_len);
         *pos++ = WLAN_EID_PERR;
@@ -251,7 +288,9 @@ int mesh_path_error_tx(u8 ttl, u8 *target, __le32 target_sn,
         pos += 4;
         memcpy(pos, &target_rcode, 2);
 
-        ieee80211_tx_skb(sdata, skb);
+        /* see note in function header */
+        prepare_frame_for_deferred_tx(sdata, skb);
+        ieee80211_add_pending_skb(local, skb);
         return 0;
 }
 
@@ -449,7 +488,6 @@ static u32 hwmp_route_info_get(struct ieee80211_sub_if_data *sdata,
 
                 if (fresh_info) {
                         mesh_path_assign_nexthop(mpath, sta);
-                        mpath->flags &= ~MESH_PATH_SN_VALID;
                         mpath->metric = last_hop_metric;
                         mpath->exp_time = time_after(mpath->exp_time, exp_time)
                                           ?  mpath->exp_time : exp_time;
@@ -484,10 +522,10 @@ static void hwmp_preq_frame_process(struct ieee80211_sub_if_data *sdata,
         orig_sn = PREQ_IE_ORIG_SN(preq_elem);
         target_flags = PREQ_IE_TARGET_F(preq_elem);
 
-        mhwmp_dbg("received PREQ from %pM\n", orig_addr);
+        mhwmp_dbg("received PREQ from %pM", orig_addr);
 
         if (memcmp(target_addr, sdata->vif.addr, ETH_ALEN) == 0) {
-                mhwmp_dbg("PREQ is for us\n");
+                mhwmp_dbg("PREQ is for us");
                 forward = false;
                 reply = true;
                 metric = 0;
@@ -523,7 +561,7 @@ static void hwmp_preq_frame_process(struct ieee80211_sub_if_data *sdata,
                 lifetime = PREQ_IE_LIFETIME(preq_elem);
                 ttl = ifmsh->mshcfg.element_ttl;
                 if (ttl != 0) {
-                        mhwmp_dbg("replying to the PREQ\n");
+                        mhwmp_dbg("replying to the PREQ");
                         mesh_path_sel_frame_tx(MPATH_PREP, 0, target_addr,
                                 cpu_to_le32(target_sn), 0, orig_addr,
                                 cpu_to_le32(orig_sn), mgmt->sa, 0, ttl,
@@ -543,7 +581,7 @@ static void hwmp_preq_frame_process(struct ieee80211_sub_if_data *sdata,
                         ifmsh->mshstats.dropped_frames_ttl++;
                         return;
                 }
-                mhwmp_dbg("forwarding the PREQ from %pM\n", orig_addr);
+                mhwmp_dbg("forwarding the PREQ from %pM", orig_addr);
                 --ttl;
                 flags = PREQ_IE_FLAGS(preq_elem);
                 preq_id = PREQ_IE_PREQ_ID(preq_elem);
@@ -578,7 +616,7 @@ static void hwmp_prep_frame_process(struct ieee80211_sub_if_data *sdata,
         u8 next_hop[ETH_ALEN];
         u32 target_sn, orig_sn, lifetime;
 
-        mhwmp_dbg("received PREP from %pM\n", PREP_IE_ORIG_ADDR(prep_elem));
+        mhwmp_dbg("received PREP from %pM", PREP_IE_ORIG_ADDR(prep_elem));
 
         /* Note that we divert from the draft nomenclature and denominate
          * destination to what the draft refers to as origininator. So in this
@@ -684,6 +722,8 @@ static void hwmp_rann_frame_process(struct ieee80211_sub_if_data *sdata,
         u8 ttl, flags, hopcount;
         u8 *orig_addr;
         u32 orig_sn, metric;
+        u32 interval = ifmsh->mshcfg.dot11MeshHWMPRannInterval;
+        bool root_is_gate;
 
         ttl = rann->rann_ttl;
         if (ttl <= 1) {
@@ -692,12 +732,19 @@ static void hwmp_rann_frame_process(struct ieee80211_sub_if_data *sdata,
         }
         ttl--;
         flags = rann->rann_flags;
+        root_is_gate = !!(flags & RANN_FLAG_IS_GATE);
         orig_addr = rann->rann_addr;
         orig_sn = rann->rann_seq;
         hopcount = rann->rann_hopcount;
         hopcount++;
         metric = rann->rann_metric;
-        mhwmp_dbg("received RANN from %pM\n", orig_addr);
+
+        /*  Ignore our own RANNs */
+        if (memcmp(orig_addr, sdata->vif.addr, ETH_ALEN) == 0)
+                return;
+
+        mhwmp_dbg("received RANN from %pM (is_gate=%d)", orig_addr,
+                        root_is_gate);
 
         rcu_read_lock();
         mpath = mesh_path_lookup(orig_addr, sdata);
@@ -709,18 +756,28 @@ static void hwmp_rann_frame_process(struct ieee80211_sub_if_data *sdata,
                         sdata->u.mesh.mshstats.dropped_frames_no_route++;
                         return;
                 }
-                mesh_queue_preq(mpath,
-                                PREQ_Q_F_START | PREQ_Q_F_REFRESH);
         }
+
+        if ((!(mpath->flags & (MESH_PATH_ACTIVE | MESH_PATH_RESOLVING)) ||
+             time_after(jiffies, mpath->exp_time - 1*HZ)) &&
+             !(mpath->flags & MESH_PATH_FIXED)) {
+                mhwmp_dbg("%s time to refresh root mpath %pM", sdata->name,
+                                                               orig_addr);
+                mesh_queue_preq(mpath, PREQ_Q_F_START | PREQ_Q_F_REFRESH);
+        }
+
         if (mpath->sn < orig_sn) {
                 mesh_path_sel_frame_tx(MPATH_RANN, flags, orig_addr,
                                        cpu_to_le32(orig_sn),
                                        0, NULL, 0, broadcast_addr,
-                                       hopcount, ttl, 0,
+                                       hopcount, ttl, cpu_to_le32(interval),
                                        cpu_to_le32(metric + mpath->metric),
                                        0, sdata);
                 mpath->sn = orig_sn;
         }
+        if (root_is_gate)
+                mesh_path_add_gate(mpath);
+
         rcu_read_unlock();
 }
 
@@ -732,11 +789,20 @@ void mesh_rx_path_sel_frame(struct ieee80211_sub_if_data *sdata,
         struct ieee802_11_elems elems;
         size_t baselen;
         u32 last_hop_metric;
+        struct sta_info *sta;
 
         /* need action_code */
         if (len < IEEE80211_MIN_ACTION_SIZE + 1)
                 return;
 
+        rcu_read_lock();
+        sta = sta_info_get(sdata, mgmt->sa);
+        if (!sta || sta->plink_state != NL80211_PLINK_ESTAB) {
+                rcu_read_unlock();
+                return;
+        }
+        rcu_read_unlock();
+
         baselen = (u8 *) mgmt->u.action.u.mesh_action.variable - (u8 *) mgmt;
         ieee802_11_parse_elems(mgmt->u.action.u.mesh_action.variable,
                         len - baselen, &elems);
@@ -788,16 +854,16 @@ static void mesh_queue_preq(struct mesh_path *mpath, u8 flags)
 
         preq_node = kmalloc(sizeof(struct mesh_preq_queue), GFP_ATOMIC);
         if (!preq_node) {
-                mhwmp_dbg("could not allocate PREQ node\n");
+                mhwmp_dbg("could not allocate PREQ node");
                 return;
         }
 
-        spin_lock(&ifmsh->mesh_preq_queue_lock);
+        spin_lock_bh(&ifmsh->mesh_preq_queue_lock);
         if (ifmsh->preq_queue_len == MAX_PREQ_QUEUE_LEN) {
-                spin_unlock(&ifmsh->mesh_preq_queue_lock);
+                spin_unlock_bh(&ifmsh->mesh_preq_queue_lock);
                 kfree(preq_node);
                 if (printk_ratelimit())
-                        mhwmp_dbg("PREQ node queue full\n");
+                        mhwmp_dbg("PREQ node queue full");
                 return;
         }
 
@@ -806,7 +872,7 @@ static void mesh_queue_preq(struct mesh_path *mpath, u8 flags)
 
         list_add_tail(&preq_node->list, &ifmsh->preq_queue.list);
         ++ifmsh->preq_queue_len;
-        spin_unlock(&ifmsh->mesh_preq_queue_lock);
+        spin_unlock_bh(&ifmsh->mesh_preq_queue_lock);
 
         if (time_after(jiffies, ifmsh->last_preq + min_preq_int_jiff(sdata)))
                 ieee80211_queue_work(&sdata->local->hw, &sdata->work);
@@ -982,35 +1048,46 @@ void mesh_path_timer(unsigned long data)
 {
         struct mesh_path *mpath = (void *) data;
         struct ieee80211_sub_if_data *sdata = mpath->sdata;
+        int ret;
 
         if (sdata->local->quiescing)
                 return;
 
         spin_lock_bh(&mpath->state_lock);
         if (mpath->flags & MESH_PATH_RESOLVED ||
-                        (!(mpath->flags & MESH_PATH_RESOLVING)))
+                        (!(mpath->flags & MESH_PATH_RESOLVING))) {
                 mpath->flags &= ~(MESH_PATH_RESOLVING | MESH_PATH_RESOLVED);
-        else if (mpath->discovery_retries < max_preq_retries(sdata)) {
+                spin_unlock_bh(&mpath->state_lock);
+        } else if (mpath->discovery_retries < max_preq_retries(sdata)) {
                 ++mpath->discovery_retries;
                 mpath->discovery_timeout *= 2;
+                spin_unlock_bh(&mpath->state_lock);
                 mesh_queue_preq(mpath, 0);
         } else {
                 mpath->flags = 0;
                 mpath->exp_time = jiffies;
-                mesh_path_flush_pending(mpath);
+                spin_unlock_bh(&mpath->state_lock);
+                if (!mpath->is_gate && mesh_gate_num(sdata) > 0) {
+                        ret = mesh_path_send_to_gates(mpath);
+                        if (ret)
+                                mhwmp_dbg("no gate was reachable");
+                } else
+                        mesh_path_flush_pending(mpath);
         }
-
-        spin_unlock_bh(&mpath->state_lock);
 }
 
 void
 mesh_path_tx_root_frame(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
+        u32 interval = ifmsh->mshcfg.dot11MeshHWMPRannInterval;
+        u8 flags;
 
-        mesh_path_sel_frame_tx(MPATH_RANN, 0, sdata->vif.addr,
+        flags = (ifmsh->mshcfg.dot11MeshGateAnnouncementProtocol)
+                        ? RANN_FLAG_IS_GATE : 0;
+        mesh_path_sel_frame_tx(MPATH_RANN, flags, sdata->vif.addr,
                                cpu_to_le32(++ifmsh->sn),
                                0, NULL, 0, broadcast_addr,
                                0, sdata->u.mesh.mshcfg.element_ttl,
-                               0, 0, 0, sdata);
+                               cpu_to_le32(interval), 0, 0, sdata);
 }
diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c
index 068ee6518254..7f54c5042235 100644
--- a/net/mac80211/mesh_pathtbl.c
+++ b/net/mac80211/mesh_pathtbl.c
@@ -14,9 +14,16 @@
 #include <linux/spinlock.h>
 #include <linux/string.h>
 #include <net/mac80211.h>
+#include "wme.h"
 #include "ieee80211_i.h"
 #include "mesh.h"
 
+#ifdef CONFIG_MAC80211_VERBOSE_MPATH_DEBUG
+#define mpath_dbg(fmt, args...) printk(KERN_DEBUG fmt, ##args)
+#else
+#define mpath_dbg(fmt, args...) do { (void)(0); } while (0)
+#endif
+
 /* There will be initially 2^INIT_PATHS_SIZE_ORDER buckets */
 #define INIT_PATHS_SIZE_ORDER   2
 
@@ -42,8 +49,10 @@ static struct mesh_table __rcu *mpp_paths; /* Store paths for MPP&MAP */
 int mesh_paths_generation;
 
 /* This lock will have the grow table function as writer and add / delete nodes
- * as readers. When reading the table (i.e. doing lookups) we are well protected
- * by RCU
+ * as readers. RCU provides sufficient protection only when reading the table
+ * (i.e. doing lookups).  Adding or adding or removing nodes requires we take
+ * the read lock or we risk operating on an old table.  The write lock is only
+ * needed when modifying the number of buckets a table.
  */
 static DEFINE_RWLOCK(pathtbl_resize_lock);
 
@@ -60,6 +69,8 @@ static inline struct mesh_table *resize_dereference_mpp_paths(void)
                 lockdep_is_held(&pathtbl_resize_lock));
 }
 
+static int mesh_gate_add(struct mesh_table *tbl, struct mesh_path *mpath);
+
 /*
  * CAREFUL -- "tbl" must not be an expression,
  * in particular not an rcu_dereference(), since
@@ -103,6 +114,7 @@ static struct mesh_table *mesh_table_alloc(int size_order)
                         sizeof(newtbl->hash_rnd));
         for (i = 0; i <= newtbl->hash_mask; i++)
                 spin_lock_init(&newtbl->hashwlock[i]);
+        spin_lock_init(&newtbl->gates_lock);
 
         return newtbl;
 }
@@ -118,6 +130,7 @@ static void mesh_table_free(struct mesh_table *tbl, bool free_leafs)
 {
         struct hlist_head *mesh_hash;
         struct hlist_node *p, *q;
+        struct mpath_node *gate;
         int i;
 
         mesh_hash = tbl->hash_buckets;
@@ -129,6 +142,17 @@ static void mesh_table_free(struct mesh_table *tbl, bool free_leafs)
                 }
                 spin_unlock_bh(&tbl->hashwlock[i]);
         }
+        if (free_leafs) {
+                spin_lock_bh(&tbl->gates_lock);
+                hlist_for_each_entry_safe(gate, p, q,
+                                         tbl->known_gates, list) {
+                        hlist_del(&gate->list);
+                        kfree(gate);
+                }
+                kfree(tbl->known_gates);
+                spin_unlock_bh(&tbl->gates_lock);
+        }
+
         __mesh_table_free(tbl);
 }
 
@@ -146,6 +170,7 @@ static int mesh_table_grow(struct mesh_table *oldtbl,
         newtbl->free_node = oldtbl->free_node;
         newtbl->mean_chain_len = oldtbl->mean_chain_len;
         newtbl->copy_node = oldtbl->copy_node;
+        newtbl->known_gates = oldtbl->known_gates;
         atomic_set(&newtbl->entries, atomic_read(&oldtbl->entries));
 
         oldhash = oldtbl->hash_buckets;
@@ -188,6 +213,7 @@ void mesh_path_assign_nexthop(struct mesh_path *mpath, struct sta_info *sta)
         struct ieee80211_hdr *hdr;
         struct sk_buff_head tmpq;
         unsigned long flags;
+        struct ieee80211_sub_if_data *sdata = mpath->sdata;
 
         rcu_assign_pointer(mpath->next_hop, sta);
 
@@ -198,6 +224,8 @@ void mesh_path_assign_nexthop(struct mesh_path *mpath, struct sta_info *sta)
         while ((skb = __skb_dequeue(&mpath->frame_queue)) != NULL) {
                 hdr = (struct ieee80211_hdr *) skb->data;
                 memcpy(hdr->addr1, sta->sta.addr, ETH_ALEN);
+                skb_set_queue_mapping(skb, ieee80211_select_queue(sdata, skb));
+                ieee80211_set_qos_hdr(sdata, skb);
                 __skb_queue_tail(&tmpq, skb);
         }
 
@@ -205,62 +233,128 @@ void mesh_path_assign_nexthop(struct mesh_path *mpath, struct sta_info *sta)
         spin_unlock_irqrestore(&mpath->frame_queue.lock, flags);
 }
 
+static void prepare_for_gate(struct sk_buff *skb, char *dst_addr,
+                             struct mesh_path *gate_mpath)
+{
+        struct ieee80211_hdr *hdr;
+        struct ieee80211s_hdr *mshdr;
+        int mesh_hdrlen, hdrlen;
+        char *next_hop;
+
+        hdr = (struct ieee80211_hdr *) skb->data;
+        hdrlen = ieee80211_hdrlen(hdr->frame_control);
+        mshdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
+
+        if (!(mshdr->flags & MESH_FLAGS_AE)) {
+                /* size of the fixed part of the mesh header */
+                mesh_hdrlen = 6;
+
+                /* make room for the two extended addresses */
+                skb_push(skb, 2 * ETH_ALEN);
+                memmove(skb->data, hdr, hdrlen + mesh_hdrlen);
+
+                hdr = (struct ieee80211_hdr *) skb->data;
+
+                /* we preserve the previous mesh header and only add
+                 * the new addreses */
+                mshdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
+                mshdr->flags = MESH_FLAGS_AE_A5_A6;
+                memcpy(mshdr->eaddr1, hdr->addr3, ETH_ALEN);
+                memcpy(mshdr->eaddr2, hdr->addr4, ETH_ALEN);
+        }
+
+        /* update next hop */
+        hdr = (struct ieee80211_hdr *) skb->data;
+        rcu_read_lock();
+        next_hop = rcu_dereference(gate_mpath->next_hop)->sta.addr;
+        memcpy(hdr->addr1, next_hop, ETH_ALEN);
+        rcu_read_unlock();
+        memcpy(hdr->addr3, dst_addr, ETH_ALEN);
+}
 
 /**
- * mesh_path_lookup - look up a path in the mesh path table
- * @dst: hardware address (ETH_ALEN length) of destination
- * @sdata: local subif
  *
- * Returns: pointer to the mesh path structure, or NULL if not found
+ * mesh_path_move_to_queue - Move or copy frames from one mpath queue to another
  *
- * Locking: must be called within a read rcu section.
+ * This function is used to transfer or copy frames from an unresolved mpath to
+ * a gate mpath.  The function also adds the Address Extension field and
+ * updates the next hop.
+ *
+ * If a frame already has an Address Extension field, only the next hop and
+ * destination addresses are updated.
+ *
+ * The gate mpath must be an active mpath with a valid mpath->next_hop.
+ *
+ * @mpath: An active mpath the frames will be sent to (i.e. the gate)
+ * @from_mpath: The failed mpath
+ * @copy: When true, copy all the frames to the new mpath queue.  When false,
+ * move them.
  */
-struct mesh_path *mesh_path_lookup(u8 *dst, struct ieee80211_sub_if_data *sdata)
+static void mesh_path_move_to_queue(struct mesh_path *gate_mpath,
+                                    struct mesh_path *from_mpath,
+                                    bool copy)
 {
-        struct mesh_path *mpath;
-        struct hlist_node *n;
-        struct hlist_head *bucket;
-        struct mesh_table *tbl;
-        struct mpath_node *node;
+        struct sk_buff *skb, *cp_skb = NULL;
+        struct sk_buff_head gateq, failq;
+        unsigned long flags;
+        int num_skbs;
 
-        tbl = rcu_dereference(mesh_paths);
+        BUG_ON(gate_mpath == from_mpath);
+        BUG_ON(!gate_mpath->next_hop);
 
-        bucket = &tbl->hash_buckets[mesh_table_hash(dst, sdata, tbl)];
-        hlist_for_each_entry_rcu(node, n, bucket, list) {
-                mpath = node->mpath;
-                if (mpath->sdata == sdata &&
-                                memcmp(dst, mpath->dst, ETH_ALEN) == 0) {
-                        if (MPATH_EXPIRED(mpath)) {
-                                spin_lock_bh(&mpath->state_lock);
-                                if (MPATH_EXPIRED(mpath))
-                                        mpath->flags &= ~MESH_PATH_ACTIVE;
-                                spin_unlock_bh(&mpath->state_lock);
-                        }
-                        return mpath;
+        __skb_queue_head_init(&gateq);
+        __skb_queue_head_init(&failq);
+
+        spin_lock_irqsave(&from_mpath->frame_queue.lock, flags);
+        skb_queue_splice_init(&from_mpath->frame_queue, &failq);
+        spin_unlock_irqrestore(&from_mpath->frame_queue.lock, flags);
+
+        num_skbs = skb_queue_len(&failq);
+
+        while (num_skbs--) {
+                skb = __skb_dequeue(&failq);
+                if (copy) {
+                        cp_skb = skb_copy(skb, GFP_ATOMIC);
+                        if (cp_skb)
+                                __skb_queue_tail(&failq, cp_skb);
                 }
+
+                prepare_for_gate(skb, gate_mpath->dst, gate_mpath);
+                __skb_queue_tail(&gateq, skb);
         }
-        return NULL;
+
+        spin_lock_irqsave(&gate_mpath->frame_queue.lock, flags);
+        skb_queue_splice(&gateq, &gate_mpath->frame_queue);
+        mpath_dbg("Mpath queue for gate %pM has %d frames\n",
+                        gate_mpath->dst,
+                        skb_queue_len(&gate_mpath->frame_queue));
+        spin_unlock_irqrestore(&gate_mpath->frame_queue.lock, flags);
+
+        if (!copy)
+                return;
+
+        spin_lock_irqsave(&from_mpath->frame_queue.lock, flags);
+        skb_queue_splice(&failq, &from_mpath->frame_queue);
+        spin_unlock_irqrestore(&from_mpath->frame_queue.lock, flags);
 }
 
-struct mesh_path *mpp_path_lookup(u8 *dst, struct ieee80211_sub_if_data *sdata)
+
+static struct mesh_path *path_lookup(struct mesh_table *tbl, u8 *dst,
+                                          struct ieee80211_sub_if_data *sdata)
 {
         struct mesh_path *mpath;
         struct hlist_node *n;
         struct hlist_head *bucket;
-        struct mesh_table *tbl;
         struct mpath_node *node;
 
-        tbl = rcu_dereference(mpp_paths);
-
         bucket = &tbl->hash_buckets[mesh_table_hash(dst, sdata, tbl)];
         hlist_for_each_entry_rcu(node, n, bucket, list) {
                 mpath = node->mpath;
                 if (mpath->sdata == sdata &&
-                    memcmp(dst, mpath->dst, ETH_ALEN) == 0) {
+                                memcmp(dst, mpath->dst, ETH_ALEN) == 0) {
                         if (MPATH_EXPIRED(mpath)) {
                                 spin_lock_bh(&mpath->state_lock);
-                                if (MPATH_EXPIRED(mpath))
-                                        mpath->flags &= ~MESH_PATH_ACTIVE;
+                                mpath->flags &= ~MESH_PATH_ACTIVE;
                                 spin_unlock_bh(&mpath->state_lock);
                         }
                         return mpath;
@@ -269,6 +363,25 @@ struct mesh_path *mpp_path_lookup(u8 *dst, struct ieee80211_sub_if_data *sdata)
         return NULL;
 }
 
+/**
+ * mesh_path_lookup - look up a path in the mesh path table
+ * @dst: hardware address (ETH_ALEN length) of destination
+ * @sdata: local subif
+ *
+ * Returns: pointer to the mesh path structure, or NULL if not found
+ *
+ * Locking: must be called within a read rcu section.
+ */
+struct mesh_path *mesh_path_lookup(u8 *dst, struct ieee80211_sub_if_data *sdata)
+{
+        return path_lookup(rcu_dereference(mesh_paths), dst, sdata);
+}
+
+struct mesh_path *mpp_path_lookup(u8 *dst, struct ieee80211_sub_if_data *sdata)
+{
+        return path_lookup(rcu_dereference(mpp_paths), dst, sdata);
+}
+
 
 /**
  * mesh_path_lookup_by_idx - look up a path in the mesh path table by its index
@@ -293,8 +406,7 @@ struct mesh_path *mesh_path_lookup_by_idx(int idx, struct ieee80211_sub_if_data
                 if (j++ == idx) {
                         if (MPATH_EXPIRED(node->mpath)) {
                                 spin_lock_bh(&node->mpath->state_lock);
-                                if (MPATH_EXPIRED(node->mpath))
-                                        node->mpath->flags &= ~MESH_PATH_ACTIVE;
+                                node->mpath->flags &= ~MESH_PATH_ACTIVE;
                                 spin_unlock_bh(&node->mpath->state_lock);
                         }
                         return node->mpath;
@@ -304,6 +416,109 @@ struct mesh_path *mesh_path_lookup_by_idx(int idx, struct ieee80211_sub_if_data
         return NULL;
 }
 
+static void mesh_gate_node_reclaim(struct rcu_head *rp)
+{
+        struct mpath_node *node = container_of(rp, struct mpath_node, rcu);
+        kfree(node);
+}
+
+/**
+ * mesh_gate_add - mark mpath as path to a mesh gate and add to known_gates
+ * @mesh_tbl: table which contains known_gates list
+ * @mpath: mpath to known mesh gate
+ *
+ * Returns: 0 on success
+ *
+ */
+static int mesh_gate_add(struct mesh_table *tbl, struct mesh_path *mpath)
+{
+        struct mpath_node *gate, *new_gate;
+        struct hlist_node *n;
+        int err;
+
+        rcu_read_lock();
+        tbl = rcu_dereference(tbl);
+
+        hlist_for_each_entry_rcu(gate, n, tbl->known_gates, list)
+                if (gate->mpath == mpath) {
+                        err = -EEXIST;
+                        goto err_rcu;
+                }
+
+        new_gate = kzalloc(sizeof(struct mpath_node), GFP_ATOMIC);
+        if (!new_gate) {
+                err = -ENOMEM;
+                goto err_rcu;
+        }
+
+        mpath->is_gate = true;
+        mpath->sdata->u.mesh.num_gates++;
+        new_gate->mpath = mpath;
+        spin_lock_bh(&tbl->gates_lock);
+        hlist_add_head_rcu(&new_gate->list, tbl->known_gates);
+        spin_unlock_bh(&tbl->gates_lock);
+        rcu_read_unlock();
+        mpath_dbg("Mesh path (%s): Recorded new gate: %pM. %d known gates\n",
+                  mpath->sdata->name, mpath->dst,
+                  mpath->sdata->u.mesh.num_gates);
+        return 0;
+err_rcu:
+        rcu_read_unlock();
+        return err;
+}
+
+/**
+ * mesh_gate_del - remove a mesh gate from the list of known gates
+ * @tbl: table which holds our list of known gates
+ * @mpath: gate mpath
+ *
+ * Returns: 0 on success
+ *
+ * Locking: must be called inside rcu_read_lock() section
+ */
+static int mesh_gate_del(struct mesh_table *tbl, struct mesh_path *mpath)
+{
+        struct mpath_node *gate;
+        struct hlist_node *p, *q;
+
+        tbl = rcu_dereference(tbl);
+
+        hlist_for_each_entry_safe(gate, p, q, tbl->known_gates, list)
+                if (gate->mpath == mpath) {
+                        spin_lock_bh(&tbl->gates_lock);
+                        hlist_del_rcu(&gate->list);
+                        call_rcu(&gate->rcu, mesh_gate_node_reclaim);
+                        spin_unlock_bh(&tbl->gates_lock);
+                        mpath->sdata->u.mesh.num_gates--;
+                        mpath->is_gate = false;
+                        mpath_dbg("Mesh path (%s): Deleted gate: %pM. "
+                                  "%d known gates\n", mpath->sdata->name,
+                                  mpath->dst, mpath->sdata->u.mesh.num_gates);
+                        break;
+                }
+
+        return 0;
+}
+
+/**
+ *
+ * mesh_path_add_gate - add the given mpath to a mesh gate to our path table
+ * @mpath: gate path to add to table
+ */
+int mesh_path_add_gate(struct mesh_path *mpath)
+{
+        return mesh_gate_add(mesh_paths, mpath);
+}
+
+/**
+ * mesh_gate_num - number of gates known to this interface
+ * @sdata: subif data
+ */
+int mesh_gate_num(struct ieee80211_sub_if_data *sdata)
+{
+        return sdata->u.mesh.num_gates;
+}
+
 /**
  * mesh_path_add - allocate and add a new path to the mesh path table
  * @addr: destination address of the path (ETH_ALEN length)
@@ -481,6 +696,7 @@ int mpp_path_add(u8 *dst, u8 *mpp, struct ieee80211_sub_if_data *sdata)
         new_mpath->flags = 0;
         skb_queue_head_init(&new_mpath->frame_queue);
         new_node->mpath = new_mpath;
+        init_timer(&new_mpath->timer);
         new_mpath->exp_time = jiffies;
         spin_lock_init(&new_mpath->state_lock);
 
@@ -539,28 +755,53 @@ void mesh_plink_broken(struct sta_info *sta)
         struct hlist_node *p;
         struct ieee80211_sub_if_data *sdata = sta->sdata;
         int i;
+        __le16 reason = cpu_to_le16(WLAN_REASON_MESH_PATH_DEST_UNREACHABLE);
 
         rcu_read_lock();
         tbl = rcu_dereference(mesh_paths);
         for_each_mesh_entry(tbl, p, node, i) {
                 mpath = node->mpath;
-                spin_lock_bh(&mpath->state_lock);
                 if (rcu_dereference(mpath->next_hop) == sta &&
                     mpath->flags & MESH_PATH_ACTIVE &&
                     !(mpath->flags & MESH_PATH_FIXED)) {
+                        spin_lock_bh(&mpath->state_lock);
                         mpath->flags &= ~MESH_PATH_ACTIVE;
                         ++mpath->sn;
                         spin_unlock_bh(&mpath->state_lock);
                         mesh_path_error_tx(sdata->u.mesh.mshcfg.element_ttl,
                                         mpath->dst, cpu_to_le32(mpath->sn),
-                                        cpu_to_le16(PERR_RCODE_DEST_UNREACH),
-                                        bcast, sdata);
-                } else
-                spin_unlock_bh(&mpath->state_lock);
+                                        reason, bcast, sdata);
+                }
         }
         rcu_read_unlock();
 }
 
+static void mesh_path_node_reclaim(struct rcu_head *rp)
+{
+        struct mpath_node *node = container_of(rp, struct mpath_node, rcu);
+        struct ieee80211_sub_if_data *sdata = node->mpath->sdata;
+
+        del_timer_sync(&node->mpath->timer);
+        atomic_dec(&sdata->u.mesh.mpaths);
+        kfree(node->mpath);
+        kfree(node);
+}
+
+/* needs to be called with the corresponding hashwlock taken */
+static void __mesh_path_del(struct mesh_table *tbl, struct mpath_node *node)
+{
+        struct mesh_path *mpath;
+        mpath = node->mpath;
+        spin_lock(&mpath->state_lock);
+        mpath->flags |= MESH_PATH_RESOLVING;
+        if (mpath->is_gate)
+                mesh_gate_del(tbl, mpath);
+        hlist_del_rcu(&node->list);
+        call_rcu(&node->rcu, mesh_path_node_reclaim);
+        spin_unlock(&mpath->state_lock);
+        atomic_dec(&tbl->entries);
+}
+
 /**
  * mesh_path_flush_by_nexthop - Deletes mesh paths if their next hop matches
  *
@@ -581,42 +822,59 @@ void mesh_path_flush_by_nexthop(struct sta_info *sta)
         int i;
 
         rcu_read_lock();
-        tbl = rcu_dereference(mesh_paths);
+        read_lock_bh(&pathtbl_resize_lock);
+        tbl = resize_dereference_mesh_paths();
         for_each_mesh_entry(tbl, p, node, i) {
                 mpath = node->mpath;
-                if (rcu_dereference(mpath->next_hop) == sta)
-                        mesh_path_del(mpath->dst, mpath->sdata);
+                if (rcu_dereference(mpath->next_hop) == sta) {
+                        spin_lock_bh(&tbl->hashwlock[i]);
+                        __mesh_path_del(tbl, node);
+                        spin_unlock_bh(&tbl->hashwlock[i]);
+                }
         }
+        read_unlock_bh(&pathtbl_resize_lock);
         rcu_read_unlock();
 }
 
-void mesh_path_flush(struct ieee80211_sub_if_data *sdata)
+static void table_flush_by_iface(struct mesh_table *tbl,
+                                 struct ieee80211_sub_if_data *sdata)
 {
-        struct mesh_table *tbl;
         struct mesh_path *mpath;
         struct mpath_node *node;
         struct hlist_node *p;
         int i;
 
-        rcu_read_lock();
-        tbl = rcu_dereference(mesh_paths);
+        WARN_ON(!rcu_read_lock_held());
         for_each_mesh_entry(tbl, p, node, i) {
                 mpath = node->mpath;
-                if (mpath->sdata == sdata)
-                        mesh_path_del(mpath->dst, mpath->sdata);
+                if (mpath->sdata != sdata)
+                        continue;
+                spin_lock_bh(&tbl->hashwlock[i]);
+                __mesh_path_del(tbl, node);
+                spin_unlock_bh(&tbl->hashwlock[i]);
         }
-        rcu_read_unlock();
 }
 
-static void mesh_path_node_reclaim(struct rcu_head *rp)
+/**
+ * mesh_path_flush_by_iface - Deletes all mesh paths associated with a given iface
+ *
+ * This function deletes both mesh paths as well as mesh portal paths.
+ *
+ * @sdata - interface data to match
+ *
+ */
+void mesh_path_flush_by_iface(struct ieee80211_sub_if_data *sdata)
 {
-        struct mpath_node *node = container_of(rp, struct mpath_node, rcu);
-        struct ieee80211_sub_if_data *sdata = node->mpath->sdata;
+        struct mesh_table *tbl;
 
-        del_timer_sync(&node->mpath->timer);
-        atomic_dec(&sdata->u.mesh.mpaths);
-        kfree(node->mpath);
-        kfree(node);
+        rcu_read_lock();
+        read_lock_bh(&pathtbl_resize_lock);
+        tbl = resize_dereference_mesh_paths();
+        table_flush_by_iface(tbl, sdata);
+        tbl = resize_dereference_mpp_paths();
+        table_flush_by_iface(tbl, sdata);
+        read_unlock_bh(&pathtbl_resize_lock);
+        rcu_read_unlock();
 }
 
 /**
@@ -647,12 +905,7 @@ int mesh_path_del(u8 *addr, struct ieee80211_sub_if_data *sdata)
                 mpath = node->mpath;
                 if (mpath->sdata == sdata &&
                     memcmp(addr, mpath->dst, ETH_ALEN) == 0) {
-                        spin_lock(&mpath->state_lock);
-                        mpath->flags |= MESH_PATH_RESOLVING;
-                        hlist_del_rcu(&node->list);
-                        call_rcu(&node->rcu, mesh_path_node_reclaim);
-                        atomic_dec(&tbl->entries);
-                        spin_unlock(&mpath->state_lock);
+                        __mesh_path_del(tbl, node);
                         goto enddel;
                 }
         }
@@ -681,6 +934,58 @@ void mesh_path_tx_pending(struct mesh_path *mpath)
 }
 
 /**
+ * mesh_path_send_to_gates - sends pending frames to all known mesh gates
+ *
+ * @mpath: mesh path whose queue will be emptied
+ *
+ * If there is only one gate, the frames are transferred from the failed mpath
+ * queue to that gate's queue.  If there are more than one gates, the frames
+ * are copied from each gate to the next.  After frames are copied, the
+ * mpath queues are emptied onto the transmission queue.
+ */
+int mesh_path_send_to_gates(struct mesh_path *mpath)
+{
+        struct ieee80211_sub_if_data *sdata = mpath->sdata;
+        struct hlist_node *n;
+        struct mesh_table *tbl;
+        struct mesh_path *from_mpath = mpath;
+        struct mpath_node *gate = NULL;
+        bool copy = false;
+        struct hlist_head *known_gates;
+
+        rcu_read_lock();
+        tbl = rcu_dereference(mesh_paths);
+        known_gates = tbl->known_gates;
+        rcu_read_unlock();
+
+        if (!known_gates)
+                return -EHOSTUNREACH;
+
+        hlist_for_each_entry_rcu(gate, n, known_gates, list) {
+                if (gate->mpath->sdata != sdata)
+                        continue;
+
+                if (gate->mpath->flags & MESH_PATH_ACTIVE) {
+                        mpath_dbg("Forwarding to %pM\n", gate->mpath->dst);
+                        mesh_path_move_to_queue(gate->mpath, from_mpath, copy);
+                        from_mpath = gate->mpath;
+                        copy = true;
+                } else {
+                        mpath_dbg("Not forwarding %p\n", gate->mpath);
+                        mpath_dbg("flags %x\n", gate->mpath->flags);
+                }
+        }
+
+        hlist_for_each_entry_rcu(gate, n, known_gates, list)
+                if (gate->mpath->sdata == sdata) {
+                        mpath_dbg("Sending to %pM\n", gate->mpath->dst);
+                        mesh_path_tx_pending(gate->mpath);
+                }
+
+        return (from_mpath == mpath) ? -EHOSTUNREACH : 0;
+}
+
+/**
  * mesh_path_discard_frame - discard a frame whose path could not be resolved
  *
  * @skb: frame to discard
@@ -699,18 +1004,23 @@ void mesh_path_discard_frame(struct sk_buff *skb,
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
         struct mesh_path *mpath;
         u32 sn = 0;
+        __le16 reason = cpu_to_le16(WLAN_REASON_MESH_PATH_NOFORWARD);
 
         if (memcmp(hdr->addr4, sdata->vif.addr, ETH_ALEN) != 0) {
                 u8 *ra, *da;
 
                 da = hdr->addr3;
                 ra = hdr->addr1;
+                rcu_read_lock();
                 mpath = mesh_path_lookup(da, sdata);
-                if (mpath)
+                if (mpath) {
+                        spin_lock_bh(&mpath->state_lock);
                         sn = ++mpath->sn;
+                        spin_unlock_bh(&mpath->state_lock);
+                }
+                rcu_read_unlock();
                 mesh_path_error_tx(sdata->u.mesh.mshcfg.element_ttl, skb->data,
-                                   cpu_to_le32(sn),
-                                   cpu_to_le16(PERR_RCODE_NO_ROUTE), ra, sdata);
+                                   cpu_to_le32(sn), reason, ra, sdata);
         }
 
         kfree_skb(skb);
@@ -728,8 +1038,7 @@ void mesh_path_flush_pending(struct mesh_path *mpath)
 {
         struct sk_buff *skb;
 
-        while ((skb = skb_dequeue(&mpath->frame_queue)) &&
-                        (mpath->flags & MESH_PATH_ACTIVE))
+        while ((skb = skb_dequeue(&mpath->frame_queue)) != NULL)
                 mesh_path_discard_frame(skb, mpath->sdata);
 }
 
@@ -790,6 +1099,7 @@ static int mesh_path_node_copy(struct hlist_node *p, struct mesh_table *newtbl)
 int mesh_pathtbl_init(void)
 {
         struct mesh_table *tbl_path, *tbl_mpp;
+        int ret;
 
         tbl_path = mesh_table_alloc(INIT_PATHS_SIZE_ORDER);
         if (!tbl_path)
@@ -797,21 +1107,40 @@ int mesh_pathtbl_init(void)
         tbl_path->free_node = &mesh_path_node_free;
         tbl_path->copy_node = &mesh_path_node_copy;
         tbl_path->mean_chain_len = MEAN_CHAIN_LEN;
+        tbl_path->known_gates = kzalloc(sizeof(struct hlist_head), GFP_ATOMIC);
+        if (!tbl_path->known_gates) {
+                ret = -ENOMEM;
+                goto free_path;
+        }
+        INIT_HLIST_HEAD(tbl_path->known_gates);
+
 
         tbl_mpp = mesh_table_alloc(INIT_PATHS_SIZE_ORDER);
         if (!tbl_mpp) {
-                mesh_table_free(tbl_path, true);
-                return -ENOMEM;
+                ret = -ENOMEM;
+                goto free_path;
         }
         tbl_mpp->free_node = &mesh_path_node_free;
         tbl_mpp->copy_node = &mesh_path_node_copy;
         tbl_mpp->mean_chain_len = MEAN_CHAIN_LEN;
+        tbl_mpp->known_gates = kzalloc(sizeof(struct hlist_head), GFP_ATOMIC);
+        if (!tbl_mpp->known_gates) {
+                ret = -ENOMEM;
+                goto free_mpp;
+        }
+        INIT_HLIST_HEAD(tbl_mpp->known_gates);
 
         /* Need no locking since this is during init */
         RCU_INIT_POINTER(mesh_paths, tbl_path);
         RCU_INIT_POINTER(mpp_paths, tbl_mpp);
 
         return 0;
+
+free_mpp:
+        mesh_table_free(tbl_mpp, true);
+free_path:
+        mesh_table_free(tbl_path, true);
+        return ret;
 }
 
 void mesh_path_expire(struct ieee80211_sub_if_data *sdata)
@@ -828,14 +1157,10 @@ void mesh_path_expire(struct ieee80211_sub_if_data *sdata)
                 if (node->mpath->sdata != sdata)
                         continue;
                 mpath = node->mpath;
-                spin_lock_bh(&mpath->state_lock);
                 if ((!(mpath->flags & MESH_PATH_RESOLVING)) &&
                     (!(mpath->flags & MESH_PATH_FIXED)) &&
-                     time_after(jiffies, mpath->exp_time + MESH_PATH_EXPIRE)) {
-                        spin_unlock_bh(&mpath->state_lock);
+                     time_after(jiffies, mpath->exp_time + MESH_PATH_EXPIRE))
                         mesh_path_del(mpath->dst, mpath->sdata);
-                } else
-                        spin_unlock_bh(&mpath->state_lock);
         }
         rcu_read_unlock();
 }
@@ -843,6 +1168,6 @@ void mesh_path_expire(struct ieee80211_sub_if_data *sdata)
 void mesh_pathtbl_unregister(void)
 {
         /* no need for locking during exit path */
-        mesh_table_free(rcu_dereference_raw(mesh_paths), true);
-        mesh_table_free(rcu_dereference_raw(mpp_paths), true);
+        mesh_table_free(rcu_dereference_protected(mesh_paths, 1), true);
+        mesh_table_free(rcu_dereference_protected(mpp_paths, 1), true);
 }
diff --git a/net/mac80211/mesh_plink.c b/net/mac80211/mesh_plink.c
index f4adc0917888..7e57f5d07f66 100644
--- a/net/mac80211/mesh_plink.c
+++ b/net/mac80211/mesh_plink.c
@@ -19,35 +19,18 @@
 #define mpl_dbg(fmt, args...)   do { (void)(0); } while (0)
 #endif
 
-#define PLINK_GET_LLID(p) (p + 4)
-#define PLINK_GET_PLID(p) (p + 6)
+#define PLINK_GET_LLID(p) (p + 2)
+#define PLINK_GET_PLID(p) (p + 4)
 
 #define mod_plink_timer(s, t) (mod_timer(&s->plink_timer, \
                                 jiffies + HZ * t / 1000))
 
-/* Peer link cancel reasons, all subject to ANA approval */
-#define MESH_LINK_CANCELLED                     2
-#define MESH_MAX_NEIGHBORS                      3
-#define MESH_CAPABILITY_POLICY_VIOLATION        4
-#define MESH_CLOSE_RCVD                         5
-#define MESH_MAX_RETRIES                        6
-#define MESH_CONFIRM_TIMEOUT                    7
-#define MESH_SECURITY_ROLE_NEGOTIATION_DIFFERS  8
-#define MESH_SECURITY_AUTHENTICATION_IMPOSSIBLE 9
-#define MESH_SECURITY_FAILED_VERIFICATION       10
-
 #define dot11MeshMaxRetries(s) (s->u.mesh.mshcfg.dot11MeshMaxRetries)
 #define dot11MeshRetryTimeout(s) (s->u.mesh.mshcfg.dot11MeshRetryTimeout)
 #define dot11MeshConfirmTimeout(s) (s->u.mesh.mshcfg.dot11MeshConfirmTimeout)
 #define dot11MeshHoldingTimeout(s) (s->u.mesh.mshcfg.dot11MeshHoldingTimeout)
 #define dot11MeshMaxPeerLinks(s) (s->u.mesh.mshcfg.dot11MeshMaxPeerLinks)
 
-enum plink_frame_type {
-        PLINK_OPEN = 1,
-        PLINK_CONFIRM,
-        PLINK_CLOSE
-};
-
 enum plink_event {
         PLINK_UNDEFINED,
         OPN_ACPT,
@@ -60,6 +43,10 @@ enum plink_event {
         CLS_IGNR
 };
 
+static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata,
+                enum ieee80211_self_protected_actioncode action,
+                u8 *da, __le16 llid, __le16 plid, __le16 reason);
+
 static inline
 void mesh_plink_inc_estab_count(struct ieee80211_sub_if_data *sdata)
 {
@@ -105,7 +92,9 @@ static struct sta_info *mesh_plink_alloc(struct ieee80211_sub_if_data *sdata,
         if (!sta)
                 return NULL;
 
-        sta->flags = WLAN_STA_AUTHORIZED | WLAN_STA_AUTH;
+        set_sta_flag(sta, WLAN_STA_AUTH);
+        set_sta_flag(sta, WLAN_STA_AUTHORIZED);
+        set_sta_flag(sta, WLAN_STA_WME);
         sta->sta.supp_rates[local->hw.conf.channel->band] = rates;
         rate_control_rate_init(sta);
 
@@ -150,6 +139,10 @@ void mesh_plink_deactivate(struct sta_info *sta)
 
         spin_lock_bh(&sta->lock);
         deactivated = __mesh_plink_deactivate(sta);
+        sta->reason = cpu_to_le16(WLAN_REASON_MESH_PEER_CANCELED);
+        mesh_plink_frame_tx(sdata, WLAN_SP_MESH_PEERING_CLOSE,
+                            sta->sta.addr, sta->llid, sta->plid,
+                            sta->reason);
         spin_unlock_bh(&sta->lock);
 
         if (deactivated)
@@ -157,16 +150,16 @@ void mesh_plink_deactivate(struct sta_info *sta)
 }
 
 static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata,
-                enum plink_frame_type action, u8 *da, __le16 llid, __le16 plid,
-                __le16 reason) {
+                enum ieee80211_self_protected_actioncode action,
+                u8 *da, __le16 llid, __le16 plid, __le16 reason) {
         struct ieee80211_local *local = sdata->local;
         struct sk_buff *skb = dev_alloc_skb(local->hw.extra_tx_headroom + 400 +
                         sdata->u.mesh.ie_len);
         struct ieee80211_mgmt *mgmt;
         bool include_plid = false;
-        static const u8 meshpeeringproto[] = { 0x00, 0x0F, 0xAC, 0x2A };
+        int ie_len = 4;
+        u16 peering_proto = 0;
         u8 *pos;
-        int ie_len;
 
         if (!skb)
                 return -1;
@@ -175,63 +168,75 @@ static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata,
          * common action part (1)
          */
         mgmt = (struct ieee80211_mgmt *)
-                skb_put(skb, 25 + sizeof(mgmt->u.action.u.plink_action));
-        memset(mgmt, 0, 25 + sizeof(mgmt->u.action.u.plink_action));
+                skb_put(skb, 25 + sizeof(mgmt->u.action.u.self_prot));
+        memset(mgmt, 0, 25 + sizeof(mgmt->u.action.u.self_prot));
         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
                                           IEEE80211_STYPE_ACTION);
         memcpy(mgmt->da, da, ETH_ALEN);
         memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
         memcpy(mgmt->bssid, sdata->vif.addr, ETH_ALEN);
-        mgmt->u.action.category = WLAN_CATEGORY_MESH_ACTION;
-        mgmt->u.action.u.plink_action.action_code = action;
-
-        if (action == PLINK_CLOSE)
-                mgmt->u.action.u.plink_action.aux = reason;
-        else {
-                mgmt->u.action.u.plink_action.aux = cpu_to_le16(0x0);
-                if (action == PLINK_CONFIRM) {
-                        pos = skb_put(skb, 4);
-                        /* two-byte status code followed by two-byte AID */
-                        memset(pos, 0, 2);
+        mgmt->u.action.category = WLAN_CATEGORY_SELF_PROTECTED;
+        mgmt->u.action.u.self_prot.action_code = action;
+
+        if (action != WLAN_SP_MESH_PEERING_CLOSE) {
+                /* capability info */
+                pos = skb_put(skb, 2);
+                memset(pos, 0, 2);
+                if (action == WLAN_SP_MESH_PEERING_CONFIRM) {
+                        /* AID */
+                        pos = skb_put(skb, 2);
                         memcpy(pos + 2, &plid, 2);
                 }
-                mesh_mgmt_ies_add(skb, sdata);
+                if (ieee80211_add_srates_ie(&sdata->vif, skb) ||
+                    ieee80211_add_ext_srates_ie(&sdata->vif, skb) ||
+                    mesh_add_rsn_ie(skb, sdata) ||
+                    mesh_add_meshid_ie(skb, sdata) ||
+                    mesh_add_meshconf_ie(skb, sdata))
+                        return -1;
+        } else {        /* WLAN_SP_MESH_PEERING_CLOSE */
+                if (mesh_add_meshid_ie(skb, sdata))
+                        return -1;
         }
 
-        /* Add Peer Link Management element */
+        /* Add Mesh Peering Management element */
         switch (action) {
-        case PLINK_OPEN:
-                ie_len = 6;
+        case WLAN_SP_MESH_PEERING_OPEN:
                 break;
-        case PLINK_CONFIRM:
-                ie_len = 8;
+        case WLAN_SP_MESH_PEERING_CONFIRM:
+                ie_len += 2;
                 include_plid = true;
                 break;
-        case PLINK_CLOSE:
-        default:
-                if (!plid)
-                        ie_len = 8;
-                else {
-                        ie_len = 10;
+        case WLAN_SP_MESH_PEERING_CLOSE:
+                if (plid) {
+                        ie_len += 2;
                         include_plid = true;
                 }
+                ie_len += 2;    /* reason code */
                 break;
+        default:
+                return -EINVAL;
         }
 
+        if (WARN_ON(skb_tailroom(skb) < 2 + ie_len))
+                return -ENOMEM;
+
         pos = skb_put(skb, 2 + ie_len);
-        *pos++ = WLAN_EID_PEER_LINK;
+        *pos++ = WLAN_EID_PEER_MGMT;
         *pos++ = ie_len;
-        memcpy(pos, meshpeeringproto, sizeof(meshpeeringproto));
-        pos += 4;
+        memcpy(pos, &peering_proto, 2);
+        pos += 2;
         memcpy(pos, &llid, 2);
+        pos += 2;
         if (include_plid) {
-                pos += 2;
                 memcpy(pos, &plid, 2);
-        }
-        if (action == PLINK_CLOSE) {
                 pos += 2;
+        }
+        if (action == WLAN_SP_MESH_PEERING_CLOSE) {
                 memcpy(pos, &reason, 2);
+                pos += 2;
         }
+        if (mesh_add_vendor_ies(skb, sdata))
+                return -1;
 
         ieee80211_tx_skb(sdata, skb);
         return 0;
@@ -322,21 +327,21 @@ static void mesh_plink_timer(unsigned long data)
                         ++sta->plink_retries;
                         mod_plink_timer(sta, sta->plink_timeout);
                         spin_unlock_bh(&sta->lock);
-                        mesh_plink_frame_tx(sdata, PLINK_OPEN, sta->sta.addr, llid,
-                                            0, 0);
+                        mesh_plink_frame_tx(sdata, WLAN_SP_MESH_PEERING_OPEN,
+                                            sta->sta.addr, llid, 0, 0);
                         break;
                 }
-                reason = cpu_to_le16(MESH_MAX_RETRIES);
+                reason = cpu_to_le16(WLAN_REASON_MESH_MAX_RETRIES);
                 /* fall through on else */
         case NL80211_PLINK_CNF_RCVD:
                 /* confirm timer */
                 if (!reason)
-                        reason = cpu_to_le16(MESH_CONFIRM_TIMEOUT);
+                        reason = cpu_to_le16(WLAN_REASON_MESH_CONFIRM_TIMEOUT);
                 sta->plink_state = NL80211_PLINK_HOLDING;
                 mod_plink_timer(sta, dot11MeshHoldingTimeout(sdata));
                 spin_unlock_bh(&sta->lock);
-                mesh_plink_frame_tx(sdata, PLINK_CLOSE, sta->sta.addr, llid, plid,
-                                    reason);
+                mesh_plink_frame_tx(sdata, WLAN_SP_MESH_PEERING_CLOSE,
+                                    sta->sta.addr, llid, plid, reason);
                 break;
         case NL80211_PLINK_HOLDING:
                 /* holding timer */
@@ -380,7 +385,7 @@ int mesh_plink_open(struct sta_info *sta)
         __le16 llid;
         struct ieee80211_sub_if_data *sdata = sta->sdata;
 
-        if (!test_sta_flags(sta, WLAN_STA_AUTH))
+        if (!test_sta_flag(sta, WLAN_STA_AUTH))
                 return -EPERM;
 
         spin_lock_bh(&sta->lock);
@@ -396,7 +401,7 @@ int mesh_plink_open(struct sta_info *sta)
         mpl_dbg("Mesh plink: starting establishment with %pM\n",
                 sta->sta.addr);
 
-        return mesh_plink_frame_tx(sdata, PLINK_OPEN,
+        return mesh_plink_frame_tx(sdata, WLAN_SP_MESH_PEERING_OPEN,
                                    sta->sta.addr, llid, 0, 0);
 }
 
@@ -422,7 +427,7 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
         struct ieee802_11_elems elems;
         struct sta_info *sta;
         enum plink_event event;
-        enum plink_frame_type ftype;
+        enum ieee80211_self_protected_actioncode ftype;
         size_t baselen;
         bool deactivated, matches_local = true;
         u8 ie_len;
@@ -449,14 +454,15 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                 return;
         }
 
-        baseaddr = mgmt->u.action.u.plink_action.variable;
-        baselen = (u8 *) mgmt->u.action.u.plink_action.variable - (u8 *) mgmt;
-        if (mgmt->u.action.u.plink_action.action_code == PLINK_CONFIRM) {
+        baseaddr = mgmt->u.action.u.self_prot.variable;
+        baselen = (u8 *) mgmt->u.action.u.self_prot.variable - (u8 *) mgmt;
+        if (mgmt->u.action.u.self_prot.action_code ==
+                                                WLAN_SP_MESH_PEERING_CONFIRM) {
                 baseaddr += 4;
                 baselen += 4;
         }
         ieee802_11_parse_elems(baseaddr, len - baselen, &elems);
-        if (!elems.peer_link) {
+        if (!elems.peering) {
                 mpl_dbg("Mesh plink: missing necessary peer link ie\n");
                 return;
         }
@@ -466,37 +472,40 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                 return;
         }
 
-        ftype = mgmt->u.action.u.plink_action.action_code;
-        ie_len = elems.peer_link_len;
-        if ((ftype == PLINK_OPEN && ie_len != 6) ||
-            (ftype == PLINK_CONFIRM && ie_len != 8) ||
-            (ftype == PLINK_CLOSE && ie_len != 8 && ie_len != 10)) {
+        ftype = mgmt->u.action.u.self_prot.action_code;
+        ie_len = elems.peering_len;
+        if ((ftype == WLAN_SP_MESH_PEERING_OPEN && ie_len != 4) ||
+            (ftype == WLAN_SP_MESH_PEERING_CONFIRM && ie_len != 6) ||
+            (ftype == WLAN_SP_MESH_PEERING_CLOSE && ie_len != 6
+                                                        && ie_len != 8)) {
                 mpl_dbg("Mesh plink: incorrect plink ie length %d %d\n",
                     ftype, ie_len);
                 return;
         }
 
-        if (ftype != PLINK_CLOSE && (!elems.mesh_id || !elems.mesh_config)) {
+        if (ftype != WLAN_SP_MESH_PEERING_CLOSE &&
+                                (!elems.mesh_id || !elems.mesh_config)) {
                 mpl_dbg("Mesh plink: missing necessary ie\n");
                 return;
         }
         /* Note the lines below are correct, the llid in the frame is the plid
          * from the point of view of this host.
          */
-        memcpy(&plid, PLINK_GET_LLID(elems.peer_link), 2);
-        if (ftype == PLINK_CONFIRM || (ftype == PLINK_CLOSE && ie_len == 10))
-                memcpy(&llid, PLINK_GET_PLID(elems.peer_link), 2);
+        memcpy(&plid, PLINK_GET_LLID(elems.peering), 2);
+        if (ftype == WLAN_SP_MESH_PEERING_CONFIRM ||
+            (ftype == WLAN_SP_MESH_PEERING_CLOSE && ie_len == 8))
+                memcpy(&llid, PLINK_GET_PLID(elems.peering), 2);
 
         rcu_read_lock();
 
         sta = sta_info_get(sdata, mgmt->sa);
-        if (!sta && ftype != PLINK_OPEN) {
+        if (!sta && ftype != WLAN_SP_MESH_PEERING_OPEN) {
                 mpl_dbg("Mesh plink: cls or cnf from unknown peer\n");
                 rcu_read_unlock();
                 return;
         }
 
-        if (sta && !test_sta_flags(sta, WLAN_STA_AUTH)) {
+        if (sta && !test_sta_flag(sta, WLAN_STA_AUTH)) {
                 mpl_dbg("Mesh plink: Action frame from non-authed peer\n");
                 rcu_read_unlock();
                 return;
@@ -509,30 +518,30 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
 
         /* Now we will figure out the appropriate event... */
         event = PLINK_UNDEFINED;
-        if (ftype != PLINK_CLOSE && (!mesh_matches_local(&elems, sdata))) {
+        if (ftype != WLAN_SP_MESH_PEERING_CLOSE &&
+            (!mesh_matches_local(&elems, sdata))) {
                 matches_local = false;
                 switch (ftype) {
-                case PLINK_OPEN:
+                case WLAN_SP_MESH_PEERING_OPEN:
                         event = OPN_RJCT;
                         break;
-                case PLINK_CONFIRM:
+                case WLAN_SP_MESH_PEERING_CONFIRM:
                         event = CNF_RJCT;
                         break;
-                case PLINK_CLOSE:
-                        /* avoid warning */
+                default:
                         break;
                 }
         }
 
         if (!sta && !matches_local) {
                 rcu_read_unlock();
-                reason = cpu_to_le16(MESH_CAPABILITY_POLICY_VIOLATION);
+                reason = cpu_to_le16(WLAN_REASON_MESH_CONFIG);
                 llid = 0;
-                mesh_plink_frame_tx(sdata, PLINK_CLOSE, mgmt->sa, llid,
-                                    plid, reason);
+                mesh_plink_frame_tx(sdata, WLAN_SP_MESH_PEERING_CLOSE,
+                                    mgmt->sa, llid, plid, reason);
                 return;
         } else if (!sta) {
-                /* ftype == PLINK_OPEN */
+                /* ftype == WLAN_SP_MESH_PEERING_OPEN */
                 u32 rates;
 
                 rcu_read_unlock();
@@ -557,21 +566,21 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
         } else if (matches_local) {
                 spin_lock_bh(&sta->lock);
                 switch (ftype) {
-                case PLINK_OPEN:
+                case WLAN_SP_MESH_PEERING_OPEN:
                         if (!mesh_plink_free_count(sdata) ||
                             (sta->plid && sta->plid != plid))
                                 event = OPN_IGNR;
                         else
                                 event = OPN_ACPT;
                         break;
-                case PLINK_CONFIRM:
+                case WLAN_SP_MESH_PEERING_CONFIRM:
                         if (!mesh_plink_free_count(sdata) ||
                             (sta->llid != llid || sta->plid != plid))
                                 event = CNF_IGNR;
                         else
                                 event = CNF_ACPT;
                         break;
-                case PLINK_CLOSE:
+                case WLAN_SP_MESH_PEERING_CLOSE:
                         if (sta->plink_state == NL80211_PLINK_ESTAB)
                                 /* Do not check for llid or plid. This does not
                                  * follow the standard but since multiple plinks
@@ -620,10 +629,12 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                         sta->llid = llid;
                         mesh_plink_timer_set(sta, dot11MeshRetryTimeout(sdata));
                         spin_unlock_bh(&sta->lock);
-                        mesh_plink_frame_tx(sdata, PLINK_OPEN, sta->sta.addr, llid,
-                                            0, 0);
-                        mesh_plink_frame_tx(sdata, PLINK_CONFIRM, sta->sta.addr,
-                                            llid, plid, 0);
+                        mesh_plink_frame_tx(sdata,
+                                            WLAN_SP_MESH_PEERING_OPEN,
+                                            sta->sta.addr, llid, 0, 0);
+                        mesh_plink_frame_tx(sdata,
+                                            WLAN_SP_MESH_PEERING_CONFIRM,
+                                            sta->sta.addr, llid, plid, 0);
                         break;
                 default:
                         spin_unlock_bh(&sta->lock);
@@ -635,10 +646,10 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                 switch (event) {
                 case OPN_RJCT:
                 case CNF_RJCT:
-                        reason = cpu_to_le16(MESH_CAPABILITY_POLICY_VIOLATION);
+                        reason = cpu_to_le16(WLAN_REASON_MESH_CONFIG);
                 case CLS_ACPT:
                         if (!reason)
-                                reason = cpu_to_le16(MESH_CLOSE_RCVD);
+                                reason = cpu_to_le16(WLAN_REASON_MESH_CLOSE);
                         sta->reason = reason;
                         sta->plink_state = NL80211_PLINK_HOLDING;
                         if (!mod_plink_timer(sta,
@@ -647,8 +658,9 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
 
                         llid = sta->llid;
                         spin_unlock_bh(&sta->lock);
-                        mesh_plink_frame_tx(sdata, PLINK_CLOSE, sta->sta.addr, llid,
-                                            plid, reason);
+                        mesh_plink_frame_tx(sdata,
+                                            WLAN_SP_MESH_PEERING_CLOSE,
+                                            sta->sta.addr, llid, plid, reason);
                         break;
                 case OPN_ACPT:
                         /* retry timer is left untouched */
@@ -656,8 +668,9 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                         sta->plid = plid;
                         llid = sta->llid;
                         spin_unlock_bh(&sta->lock);
-                        mesh_plink_frame_tx(sdata, PLINK_CONFIRM, sta->sta.addr, llid,
-                                            plid, 0);
+                        mesh_plink_frame_tx(sdata,
+                                            WLAN_SP_MESH_PEERING_CONFIRM,
+                                            sta->sta.addr, llid, plid, 0);
                         break;
                 case CNF_ACPT:
                         sta->plink_state = NL80211_PLINK_CNF_RCVD;
@@ -677,10 +690,10 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                 switch (event) {
                 case OPN_RJCT:
                 case CNF_RJCT:
-                        reason = cpu_to_le16(MESH_CAPABILITY_POLICY_VIOLATION);
+                        reason = cpu_to_le16(WLAN_REASON_MESH_CONFIG);
                 case CLS_ACPT:
                         if (!reason)
-                                reason = cpu_to_le16(MESH_CLOSE_RCVD);
+                                reason = cpu_to_le16(WLAN_REASON_MESH_CLOSE);
                         sta->reason = reason;
                         sta->plink_state = NL80211_PLINK_HOLDING;
                         if (!mod_plink_timer(sta,
@@ -689,14 +702,15 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
 
                         llid = sta->llid;
                         spin_unlock_bh(&sta->lock);
-                        mesh_plink_frame_tx(sdata, PLINK_CLOSE, sta->sta.addr, llid,
-                                            plid, reason);
+                        mesh_plink_frame_tx(sdata, WLAN_SP_MESH_PEERING_CLOSE,
+                                            sta->sta.addr, llid, plid, reason);
                         break;
                 case OPN_ACPT:
                         llid = sta->llid;
                         spin_unlock_bh(&sta->lock);
-                        mesh_plink_frame_tx(sdata, PLINK_CONFIRM, sta->sta.addr, llid,
-                                            plid, 0);
+                        mesh_plink_frame_tx(sdata,
+                                            WLAN_SP_MESH_PEERING_CONFIRM,
+                                            sta->sta.addr, llid, plid, 0);
                         break;
                 case CNF_ACPT:
                         del_timer(&sta->plink_timer);
@@ -717,10 +731,10 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                 switch (event) {
                 case OPN_RJCT:
                 case CNF_RJCT:
-                        reason = cpu_to_le16(MESH_CAPABILITY_POLICY_VIOLATION);
+                        reason = cpu_to_le16(WLAN_REASON_MESH_CONFIG);
                 case CLS_ACPT:
                         if (!reason)
-                                reason = cpu_to_le16(MESH_CLOSE_RCVD);
+                                reason = cpu_to_le16(WLAN_REASON_MESH_CLOSE);
                         sta->reason = reason;
                         sta->plink_state = NL80211_PLINK_HOLDING;
                         if (!mod_plink_timer(sta,
@@ -729,8 +743,9 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
 
                         llid = sta->llid;
                         spin_unlock_bh(&sta->lock);
-                        mesh_plink_frame_tx(sdata, PLINK_CLOSE, sta->sta.addr, llid,
-                                            plid, reason);
+                        mesh_plink_frame_tx(sdata,
+                                            WLAN_SP_MESH_PEERING_CLOSE,
+                                            sta->sta.addr, llid, plid, reason);
                         break;
                 case OPN_ACPT:
                         del_timer(&sta->plink_timer);
@@ -740,8 +755,9 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                         ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON);
                         mpl_dbg("Mesh plink with %pM ESTABLISHED\n",
                                 sta->sta.addr);
-                        mesh_plink_frame_tx(sdata, PLINK_CONFIRM, sta->sta.addr, llid,
-                                            plid, 0);
+                        mesh_plink_frame_tx(sdata,
+                                            WLAN_SP_MESH_PEERING_CONFIRM,
+                                            sta->sta.addr, llid, plid, 0);
                         break;
                 default:
                         spin_unlock_bh(&sta->lock);
@@ -752,7 +768,7 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
         case NL80211_PLINK_ESTAB:
                 switch (event) {
                 case CLS_ACPT:
-                        reason = cpu_to_le16(MESH_CLOSE_RCVD);
+                        reason = cpu_to_le16(WLAN_REASON_MESH_CLOSE);
                         sta->reason = reason;
                         deactivated = __mesh_plink_deactivate(sta);
                         sta->plink_state = NL80211_PLINK_HOLDING;
@@ -761,14 +777,15 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                         spin_unlock_bh(&sta->lock);
                         if (deactivated)
                                 ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON);
-                        mesh_plink_frame_tx(sdata, PLINK_CLOSE, sta->sta.addr, llid,
-                                            plid, reason);
+                        mesh_plink_frame_tx(sdata, WLAN_SP_MESH_PEERING_CLOSE,
+                                            sta->sta.addr, llid, plid, reason);
                         break;
                 case OPN_ACPT:
                         llid = sta->llid;
                         spin_unlock_bh(&sta->lock);
-                        mesh_plink_frame_tx(sdata, PLINK_CONFIRM, sta->sta.addr, llid,
-                                            plid, 0);
+                        mesh_plink_frame_tx(sdata,
+                                            WLAN_SP_MESH_PEERING_CONFIRM,
+                                            sta->sta.addr, llid, plid, 0);
                         break;
                 default:
                         spin_unlock_bh(&sta->lock);
@@ -790,8 +807,8 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                         llid = sta->llid;
                         reason = sta->reason;
                         spin_unlock_bh(&sta->lock);
-                        mesh_plink_frame_tx(sdata, PLINK_CLOSE, sta->sta.addr,
-                                            llid, plid, reason);
+                        mesh_plink_frame_tx(sdata, WLAN_SP_MESH_PEERING_CLOSE,
+                                            sta->sta.addr, llid, plid, reason);
                         break;
                 default:
                         spin_unlock_bh(&sta->lock);
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index d6470c7fd6ce..ba2da11a997b 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -17,7 +17,7 @@
 #include <linux/if_arp.h>
 #include <linux/etherdevice.h>
 #include <linux/rtnetlink.h>
-#include <linux/pm_qos_params.h>
+#include <linux/pm_qos.h>
 #include <linux/crc32.h>
 #include <linux/slab.h>
 #include <net/mac80211.h>
@@ -160,7 +160,8 @@ static int ecw2cw(int ecw)
  */
 static u32 ieee80211_enable_ht(struct ieee80211_sub_if_data *sdata,
                                struct ieee80211_ht_info *hti,
-                               const u8 *bssid, u16 ap_ht_cap_flags)
+                               const u8 *bssid, u16 ap_ht_cap_flags,
+                               bool beacon_htcap_ie)
 {
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_supported_band *sband;
@@ -232,6 +233,21 @@ static u32 ieee80211_enable_ht(struct ieee80211_sub_if_data *sdata,
                 WARN_ON(!ieee80211_set_channel_type(local, sdata, channel_type));
         }
 
+        if (beacon_htcap_ie && (prev_chantype != channel_type)) {
+                /*
+                 * Whenever the AP announces the HT mode change that can be
+                 * 40MHz intolerant or etc., it would be safer to stop tx
+                 * queues before doing hw config to avoid buffer overflow.
+                 */
+                ieee80211_stop_queues_by_reason(&sdata->local->hw,
+                                IEEE80211_QUEUE_STOP_REASON_CHTYPE_CHANGE);
+
+                /* flush out all packets */
+                synchronize_net();
+
+                drv_flush(local, false);
+        }
+
         /* channel_type change automatically detected */
         ieee80211_hw_config(local, 0);
 
@@ -243,6 +259,10 @@ static u32 ieee80211_enable_ht(struct ieee80211_sub_if_data *sdata,
                                                  IEEE80211_RC_HT_CHANGED,
                                                  channel_type);
                 rcu_read_unlock();
+
+                if (beacon_htcap_ie)
+                        ieee80211_wake_queues_by_reason(&sdata->local->hw,
+                                IEEE80211_QUEUE_STOP_REASON_CHTYPE_CHANGE);
         }
 
         ht_opmode = le16_to_cpu(hti->operation_mode);
@@ -271,11 +291,9 @@ static void ieee80211_send_deauth_disassoc(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_mgmt *mgmt;
 
         skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*mgmt));
-        if (!skb) {
-                printk(KERN_DEBUG "%s: failed to allocate buffer for "
-                       "deauth/disassoc frame\n", sdata->name);
+        if (!skb)
                 return;
-        }
+
         skb_reserve(skb, local->hw.extra_tx_headroom);
 
         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
@@ -330,6 +348,7 @@ void ieee80211_send_nullfunc(struct ieee80211_local *local,
 {
         struct sk_buff *skb;
         struct ieee80211_hdr_3addr *nullfunc;
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 
         skb = ieee80211_nullfunc_get(&local->hw, &sdata->vif);
         if (!skb)
@@ -340,6 +359,10 @@ void ieee80211_send_nullfunc(struct ieee80211_local *local,
                 nullfunc->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
 
         IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
+        if (ifmgd->flags & (IEEE80211_STA_BEACON_POLL |
+                            IEEE80211_STA_CONNECTION_POLL))
+                IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_USE_MINRATE;
+
         ieee80211_tx_skb(sdata, skb);
 }
 
@@ -354,11 +377,9 @@ static void ieee80211_send_4addr_nullfunc(struct ieee80211_local *local,
                 return;
 
         skb = dev_alloc_skb(local->hw.extra_tx_headroom + 30);
-        if (!skb) {
-                printk(KERN_DEBUG "%s: failed to allocate buffer for 4addr "
-                       "nullfunc frame\n", sdata->name);
+        if (!skb)
                 return;
-        }
+
         skb_reserve(skb, local->hw.extra_tx_headroom);
 
         nullfunc = (struct ieee80211_hdr *) skb_put(skb, 30);
@@ -394,6 +415,9 @@ static void ieee80211_chswitch_work(struct work_struct *work)
                 /* call "hw_config" only if doing sw channel switch */
                 ieee80211_hw_config(sdata->local,
                         IEEE80211_CONF_CHANGE_CHANNEL);
+        } else {
+                /* update the device channel directly */
+                sdata->local->hw.conf.channel = sdata->local->oper_channel;
         }
 
         /* XXX: shouldn't really modify cfg80211-owned data! */
@@ -608,7 +632,7 @@ static bool ieee80211_powersave_allowed(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_if_managed *mgd = &sdata->u.mgd;
         struct sta_info *sta = NULL;
-        u32 sta_flags = 0;
+        bool authorized = false;
 
         if (!mgd->powersave)
                 return false;
@@ -626,13 +650,10 @@ static bool ieee80211_powersave_allowed(struct ieee80211_sub_if_data *sdata)
         rcu_read_lock();
         sta = sta_info_get(sdata, mgd->bssid);
         if (sta)
-                sta_flags = get_sta_flags(sta);
+                authorized = test_sta_flag(sta, WLAN_STA_AUTHORIZED);
         rcu_read_unlock();
 
-        if (!(sta_flags & WLAN_STA_AUTHORIZED))
-                return false;
-
-        return true;
+        return authorized;
 }
 
 /* need to hold RTNL or interface lock */
@@ -917,8 +938,8 @@ static void ieee80211_sta_wmm_params(struct ieee80211_local *local,
                             params.aifs, params.cw_min, params.cw_max,
                             params.txop, params.uapsd);
 #endif
-                local->tx_conf[queue] = params;
-                if (drv_conf_tx(local, queue, &params))
+                sdata->tx_conf[queue] = params;
+                if (drv_conf_tx(local, sdata, queue, &params))
                         wiphy_debug(local->hw.wiphy,
                                     "failed to set TX queue parameters for queue %d\n",
                                     queue);
@@ -1076,7 +1097,7 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
         mutex_lock(&local->sta_mtx);
         sta = sta_info_get(sdata, bssid);
         if (sta) {
-                set_sta_flags(sta, WLAN_STA_BLOCK_BA);
+                set_sta_flag(sta, WLAN_STA_BLOCK_BA);
                 ieee80211_sta_tear_down_BA_sessions(sta, tx);
         }
         mutex_unlock(&local->sta_mtx);
@@ -1118,8 +1139,9 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
         changed |= BSS_CHANGED_BSSID | BSS_CHANGED_HT;
         ieee80211_bss_info_change_notify(sdata, changed);
 
+        /* remove AP and TDLS peers */
         if (remove_sta)
-                sta_info_destroy_addr(sdata, bssid);
+                sta_info_flush(local, sdata);
 
         del_timer_sync(&sdata->u.mgd.conn_mon_timer);
         del_timer_sync(&sdata->u.mgd.bcn_mon_timer);
@@ -1220,7 +1242,7 @@ static void ieee80211_mgd_probe_ap_send(struct ieee80211_sub_if_data *sdata)
         } else {
                 ssid = ieee80211_bss_get_ie(ifmgd->associated, WLAN_EID_SSID);
                 ieee80211_send_probe_req(sdata, dst, ssid + 2, ssid[1], NULL, 0,
-                                         (u32) -1, true);
+                                         (u32) -1, true, false);
         }
 
         ifmgd->probe_send_count++;
@@ -1482,17 +1504,22 @@ static bool ieee80211_assoc_success(struct ieee80211_work *wk,
 
         ifmgd->aid = aid;
 
-        sta = sta_info_alloc(sdata, cbss->bssid, GFP_KERNEL);
-        if (!sta) {
-                printk(KERN_DEBUG "%s: failed to alloc STA entry for"
-                       " the AP\n", sdata->name);
+        mutex_lock(&sdata->local->sta_mtx);
+        /*
+         * station info was already allocated and inserted before
+         * the association and should be available to us
+         */
+        sta = sta_info_get_rx(sdata, cbss->bssid);
+        if (WARN_ON(!sta)) {
+                mutex_unlock(&sdata->local->sta_mtx);
                 return false;
         }
 
-        set_sta_flags(sta, WLAN_STA_AUTH | WLAN_STA_ASSOC |
-                           WLAN_STA_ASSOC_AP);
+        set_sta_flag(sta, WLAN_STA_AUTH);
+        set_sta_flag(sta, WLAN_STA_ASSOC);
+        set_sta_flag(sta, WLAN_STA_ASSOC_AP);
         if (!(ifmgd->flags & IEEE80211_STA_CONTROL_PORT))
-                set_sta_flags(sta, WLAN_STA_AUTHORIZED);
+                set_sta_flag(sta, WLAN_STA_AUTHORIZED);
 
         rates = 0;
         basic_rates = 0;
@@ -1551,12 +1578,13 @@ static bool ieee80211_assoc_success(struct ieee80211_work *wk,
         rate_control_rate_init(sta);
 
         if (ifmgd->flags & IEEE80211_STA_MFP_ENABLED)
-                set_sta_flags(sta, WLAN_STA_MFP);
+                set_sta_flag(sta, WLAN_STA_MFP);
 
         if (elems.wmm_param)
-                set_sta_flags(sta, WLAN_STA_WME);
+                set_sta_flag(sta, WLAN_STA_WME);
 
-        err = sta_info_insert(sta);
+        /* sta_info_reinsert will also unlock the mutex lock */
+        err = sta_info_reinsert(sta);
         sta = NULL;
         if (err) {
                 printk(KERN_DEBUG "%s: failed to insert STA entry for"
@@ -1584,7 +1612,8 @@ static bool ieee80211_assoc_success(struct ieee80211_work *wk,
             (sdata->local->hw.queues >= 4) &&
             !(ifmgd->flags & IEEE80211_STA_DISABLE_11N))
                 changed |= ieee80211_enable_ht(sdata, elems.ht_info_elem,
-                                               cbss->bssid, ap_ht_cap_flags);
+                                               cbss->bssid, ap_ht_cap_flags,
+                                               false);
 
         /* set AID and assoc capability,
          * ieee80211_set_associated() will tell the driver */
@@ -1918,7 +1947,7 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
                 rcu_read_unlock();
 
                 changed |= ieee80211_enable_ht(sdata, elems.ht_info_elem,
-                                               bssid, ap_ht_cap_flags);
+                                               bssid, ap_ht_cap_flags, true);
         }
 
         /* Note: country IE parsing is done for us by cfg80211 */
@@ -2429,6 +2458,29 @@ int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata,
         return 0;
 }
 
+/* create and insert a dummy station entry */
+static int ieee80211_pre_assoc(struct ieee80211_sub_if_data *sdata,
+                                u8 *bssid) {
+        struct sta_info *sta;
+        int err;
+
+        sta = sta_info_alloc(sdata, bssid, GFP_KERNEL);
+        if (!sta)
+                return -ENOMEM;
+
+        sta->dummy = true;
+
+        err = sta_info_insert(sta);
+        sta = NULL;
+        if (err) {
+                printk(KERN_DEBUG "%s: failed to insert Dummy STA entry for"
+                       " the AP (error %d)\n", sdata->name, err);
+                return err;
+        }
+
+        return 0;
+}
+
 static enum work_done_result ieee80211_assoc_done(struct ieee80211_work *wk,
                                                   struct sk_buff *skb)
 {
@@ -2436,9 +2488,11 @@ static enum work_done_result ieee80211_assoc_done(struct ieee80211_work *wk,
         struct ieee80211_mgmt *mgmt;
         struct ieee80211_rx_status *rx_status;
         struct ieee802_11_elems elems;
+        struct cfg80211_bss *cbss = wk->assoc.bss;
         u16 status;
 
         if (!skb) {
+                sta_info_destroy_addr(wk->sdata, cbss->bssid);
                 cfg80211_send_assoc_timeout(wk->sdata->dev, wk->filter_ta);
                 goto destroy;
         }
@@ -2468,12 +2522,16 @@ static enum work_done_result ieee80211_assoc_done(struct ieee80211_work *wk,
                 if (!ieee80211_assoc_success(wk, mgmt, skb->len)) {
                         mutex_unlock(&wk->sdata->u.mgd.mtx);
                         /* oops -- internal error -- send timeout for now */
+                        sta_info_destroy_addr(wk->sdata, cbss->bssid);
                         cfg80211_send_assoc_timeout(wk->sdata->dev,
                                                     wk->filter_ta);
                         return WORK_DONE_DESTROY;
                 }
 
                 mutex_unlock(&wk->sdata->u.mgd.mtx);
+        } else {
+                /* assoc failed - destroy the dummy station entry */
+                sta_info_destroy_addr(wk->sdata, cbss->bssid);
         }
 
         cfg80211_send_rx_assoc(wk->sdata->dev, skb->data, skb->len);
@@ -2492,7 +2550,7 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_bss *bss = (void *)req->bss->priv;
         struct ieee80211_work *wk;
         const u8 *ssid;
-        int i;
+        int i, err;
 
         mutex_lock(&ifmgd->mtx);
         if (ifmgd->associated) {
@@ -2517,6 +2575,16 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
         if (!wk)
                 return -ENOMEM;
 
+        /*
+         * create a dummy station info entry in order
+         * to start accepting incoming EAPOL packets from the station
+         */
+        err = ieee80211_pre_assoc(sdata, req->bss->bssid);
+        if (err) {
+                kfree(wk);
+                return err;
+        }
+
         ifmgd->flags &= ~IEEE80211_STA_DISABLE_11N;
         ifmgd->flags &= ~IEEE80211_STA_NULLFUNC_ACKED;
 
@@ -2674,7 +2742,7 @@ int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
                                        req->reason_code, cookie,
                                        !req->local_state_change);
         if (assoc_bss)
-                sta_info_destroy_addr(sdata, bssid);
+                sta_info_flush(sdata->local, sdata);
 
         mutex_lock(&sdata->local->mtx);
         ieee80211_recalc_idle(sdata->local);
@@ -2714,7 +2782,7 @@ int ieee80211_mgd_disassoc(struct ieee80211_sub_if_data *sdata,
         ieee80211_send_deauth_disassoc(sdata, req->bss->bssid,
                         IEEE80211_STYPE_DISASSOC, req->reason_code,
                         cookie, !req->local_state_change);
-        sta_info_destroy_addr(sdata, bssid);
+        sta_info_flush(sdata->local, sdata);
 
         mutex_lock(&sdata->local->mtx);
         ieee80211_recalc_idle(sdata->local);
diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c
index 6326d3439861..9ee7164b207c 100644
--- a/net/mac80211/pm.c
+++ b/net/mac80211/pm.c
@@ -42,7 +42,7 @@ int __ieee80211_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
         if (hw->flags & IEEE80211_HW_AMPDU_AGGREGATION) {
                 mutex_lock(&local->sta_mtx);
                 list_for_each_entry(sta, &local->sta_list, list) {
-                        set_sta_flags(sta, WLAN_STA_BLOCK_BA);
+                        set_sta_flag(sta, WLAN_STA_BLOCK_BA);
                         ieee80211_sta_tear_down_BA_sessions(sta, true);
                 }
                 mutex_unlock(&local->sta_mtx);
diff --git a/net/mac80211/rate.c b/net/mac80211/rate.c
index 3d5a2cb835c4..ff5c3aa48a15 100644
--- a/net/mac80211/rate.c
+++ b/net/mac80211/rate.c
@@ -199,7 +199,7 @@ static void rate_control_release(struct kref *kref)
         kfree(ctrl_ref);
 }
 
-static bool rc_no_data_or_no_ack(struct ieee80211_tx_rate_control *txrc)
+static bool rc_no_data_or_no_ack_use_min(struct ieee80211_tx_rate_control *txrc)
 {
         struct sk_buff *skb = txrc->skb;
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
@@ -208,7 +208,9 @@ static bool rc_no_data_or_no_ack(struct ieee80211_tx_rate_control *txrc)
 
         fc = hdr->frame_control;
 
-        return (info->flags & IEEE80211_TX_CTL_NO_ACK) || !ieee80211_is_data(fc);
+        return (info->flags & (IEEE80211_TX_CTL_NO_ACK |
+                               IEEE80211_TX_CTL_USE_MINRATE)) ||
+                !ieee80211_is_data(fc);
 }
 
 static void rc_send_low_broadcast(s8 *idx, u32 basic_rates,
@@ -233,6 +235,27 @@ static void rc_send_low_broadcast(s8 *idx, u32 basic_rates,
         /* could not find a basic rate; use original selection */
 }
 
+static inline s8
+rate_lowest_non_cck_index(struct ieee80211_supported_band *sband,
+                          struct ieee80211_sta *sta)
+{
+        int i;
+
+        for (i = 0; i < sband->n_bitrates; i++) {
+                struct ieee80211_rate *srate = &sband->bitrates[i];
+                if ((srate->bitrate == 10) || (srate->bitrate == 20) ||
+                    (srate->bitrate == 55) || (srate->bitrate == 110))
+                        continue;
+
+                if (rate_supported(sta, sband->band, i))
+                        return i;
+        }
+
+        /* No matching rate found */
+        return 0;
+}
+
+
 bool rate_control_send_low(struct ieee80211_sta *sta,
                            void *priv_sta,
                            struct ieee80211_tx_rate_control *txrc)
@@ -241,8 +264,14 @@ bool rate_control_send_low(struct ieee80211_sta *sta,
         struct ieee80211_supported_band *sband = txrc->sband;
         int mcast_rate;
 
-        if (!sta || !priv_sta || rc_no_data_or_no_ack(txrc)) {
-                info->control.rates[0].idx = rate_lowest_index(txrc->sband, sta);
+        if (!sta || !priv_sta || rc_no_data_or_no_ack_use_min(txrc)) {
+                if ((sband->band != IEEE80211_BAND_2GHZ) ||
+                    !(info->flags & IEEE80211_TX_CTL_NO_CCK_RATE))
+                        info->control.rates[0].idx =
+                                rate_lowest_index(txrc->sband, sta);
+                else
+                        info->control.rates[0].idx =
+                                rate_lowest_non_cck_index(txrc->sband, sta);
                 info->control.rates[0].count =
                         (info->flags & IEEE80211_TX_CTL_NO_ACK) ?
                         1 : txrc->hw->max_rate_tries;
diff --git a/net/mac80211/rc80211_minstrel_ht.c b/net/mac80211/rc80211_minstrel_ht.c
index 66a1eeb279c6..cdb28535716b 100644
--- a/net/mac80211/rc80211_minstrel_ht.c
+++ b/net/mac80211/rc80211_minstrel_ht.c
@@ -281,6 +281,8 @@ minstrel_ht_update_stats(struct minstrel_priv *mp, struct minstrel_ht_sta *mi)
 
                 mr = minstrel_get_ratestats(mi, mg->max_tp_rate);
                 if (cur_tp < mr->cur_tp) {
+                        mi->max_tp_rate2 = mi->max_tp_rate;
+                        cur_tp2 = cur_tp;
                         mi->max_tp_rate = mg->max_tp_rate;
                         cur_tp = mr->cur_tp;
                 }
@@ -452,7 +454,8 @@ minstrel_ht_tx_status(void *priv, struct ieee80211_supported_band *sband,
 
         if (time_after(jiffies, mi->stats_update + (mp->update_interval / 2 * HZ) / 1000)) {
                 minstrel_ht_update_stats(mp, mi);
-                minstrel_aggr_check(mp, sta, skb);
+                if (!(info->flags & IEEE80211_TX_CTL_AMPDU))
+                        minstrel_aggr_check(mp, sta, skb);
         }
 }
 
@@ -608,7 +611,13 @@ minstrel_ht_get_rate(void *priv, struct ieee80211_sta *sta, void *priv_sta,
                 return mac80211_minstrel.get_rate(priv, sta, &msp->legacy, txrc);
 
         info->flags |= mi->tx_flags;
-        sample_idx = minstrel_get_sample_rate(mp, mi);
+
+        /* Don't use EAPOL frames for sampling on non-mrr hw */
+        if (mp->hw->max_rates == 1 &&
+            txrc->skb->protocol == cpu_to_be16(ETH_P_PAE))
+                sample_idx = -1;
+        else
+                sample_idx = minstrel_get_sample_rate(mp, mi);
 
 #ifdef CONFIG_MAC80211_DEBUGFS
         /* use fixed index if set */
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index fe2c2a717793..b867bd55de7a 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -476,7 +476,6 @@ static ieee80211_rx_result
 ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
 {
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
-        unsigned int hdrlen = ieee80211_hdrlen(hdr->frame_control);
         char *dev_addr = rx->sdata->vif.addr;
 
         if (ieee80211_is_data(hdr->frame_control)) {
@@ -524,14 +523,6 @@ ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
 
         }
 
-#define msh_h_get(h, l) ((struct ieee80211s_hdr *) ((u8 *)h + l))
-
-        if (ieee80211_is_data(hdr->frame_control) &&
-            is_multicast_ether_addr(hdr->addr1) &&
-            mesh_rmc_check(hdr->addr3, msh_h_get(hdr, hdrlen), rx->sdata))
-                return RX_DROP_MONITOR;
-#undef msh_h_get
-
         return RX_CONTINUE;
 }
 
@@ -850,8 +841,21 @@ ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
                       ieee80211_is_pspoll(hdr->frame_control)) &&
                      rx->sdata->vif.type != NL80211_IFTYPE_ADHOC &&
                      rx->sdata->vif.type != NL80211_IFTYPE_WDS &&
-                     (!rx->sta || !test_sta_flags(rx->sta, WLAN_STA_ASSOC))))
+                     (!rx->sta || !test_sta_flag(rx->sta, WLAN_STA_ASSOC)))) {
+                if (rx->sta && rx->sta->dummy &&
+                    ieee80211_is_data_present(hdr->frame_control)) {
+                        u16 ethertype;
+                        u8 *payload;
+
+                        payload = rx->skb->data +
+                                ieee80211_hdrlen(hdr->frame_control);
+                        ethertype = (payload[6] << 8) | payload[7];
+                        if (cpu_to_be16(ethertype) ==
+                            rx->sdata->control_port_protocol)
+                                return RX_CONTINUE;
+                }
                 return RX_DROP_MONITOR;
+        }
 
         return RX_CONTINUE;
 }
@@ -1106,7 +1110,7 @@ static void ap_sta_ps_start(struct sta_info *sta)
         struct ieee80211_local *local = sdata->local;
 
         atomic_inc(&sdata->bss->num_sta_ps);
-        set_sta_flags(sta, WLAN_STA_PS_STA);
+        set_sta_flag(sta, WLAN_STA_PS_STA);
         if (!(local->hw.flags & IEEE80211_HW_AP_LINK_PS))
                 drv_sta_notify(local, sdata, STA_NOTIFY_SLEEP, &sta->sta);
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
@@ -1126,7 +1130,7 @@ static void ap_sta_ps_end(struct sta_info *sta)
                sdata->name, sta->sta.addr, sta->sta.aid);
 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
 
-        if (test_sta_flags(sta, WLAN_STA_PS_DRIVER)) {
+        if (test_sta_flag(sta, WLAN_STA_PS_DRIVER)) {
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
                 printk(KERN_DEBUG "%s: STA %pM aid %d driver-ps-blocked\n",
                        sdata->name, sta->sta.addr, sta->sta.aid);
@@ -1145,7 +1149,7 @@ int ieee80211_sta_ps_transition(struct ieee80211_sta *sta, bool start)
         WARN_ON(!(sta_inf->local->hw.flags & IEEE80211_HW_AP_LINK_PS));
 
         /* Don't let the same PS state be set twice */
-        in_ps = test_sta_flags(sta_inf, WLAN_STA_PS_STA);
+        in_ps = test_sta_flag(sta_inf, WLAN_STA_PS_STA);
         if ((start && in_ps) || (!start && !in_ps))
                 return -EINVAL;
 
@@ -1159,6 +1163,81 @@ int ieee80211_sta_ps_transition(struct ieee80211_sta *sta, bool start)
 EXPORT_SYMBOL(ieee80211_sta_ps_transition);
 
 static ieee80211_rx_result debug_noinline
+ieee80211_rx_h_uapsd_and_pspoll(struct ieee80211_rx_data *rx)
+{
+        struct ieee80211_sub_if_data *sdata = rx->sdata;
+        struct ieee80211_hdr *hdr = (void *)rx->skb->data;
+        struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
+        int tid, ac;
+
+        if (!rx->sta || !(status->rx_flags & IEEE80211_RX_RA_MATCH))
+                return RX_CONTINUE;
+
+        if (sdata->vif.type != NL80211_IFTYPE_AP &&
+            sdata->vif.type != NL80211_IFTYPE_AP_VLAN)
+                return RX_CONTINUE;
+
+        /*
+         * The device handles station powersave, so don't do anything about
+         * uAPSD and PS-Poll frames (the latter shouldn't even come up from
+         * it to mac80211 since they're handled.)
+         */
+        if (sdata->local->hw.flags & IEEE80211_HW_AP_LINK_PS)
+                return RX_CONTINUE;
+
+        /*
+         * Don't do anything if the station isn't already asleep. In
+         * the uAPSD case, the station will probably be marked asleep,
+         * in the PS-Poll case the station must be confused ...
+         */
+        if (!test_sta_flag(rx->sta, WLAN_STA_PS_STA))
+                return RX_CONTINUE;
+
+        if (unlikely(ieee80211_is_pspoll(hdr->frame_control))) {
+                if (!test_sta_flag(rx->sta, WLAN_STA_SP)) {
+                        if (!test_sta_flag(rx->sta, WLAN_STA_PS_DRIVER))
+                                ieee80211_sta_ps_deliver_poll_response(rx->sta);
+                        else
+                                set_sta_flag(rx->sta, WLAN_STA_PSPOLL);
+                }
+
+                /* Free PS Poll skb here instead of returning RX_DROP that would
+                 * count as an dropped frame. */
+                dev_kfree_skb(rx->skb);
+
+                return RX_QUEUED;
+        } else if (!ieee80211_has_morefrags(hdr->frame_control) &&
+                   !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&
+                   ieee80211_has_pm(hdr->frame_control) &&
+                   (ieee80211_is_data_qos(hdr->frame_control) ||
+                    ieee80211_is_qos_nullfunc(hdr->frame_control))) {
+                tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK;
+                ac = ieee802_1d_to_ac[tid & 7];
+
+                /*
+                 * If this AC is not trigger-enabled do nothing.
+                 *
+                 * NB: This could/should check a separate bitmap of trigger-
+                 * enabled queues, but for now we only implement uAPSD w/o
+                 * TSPEC changes to the ACs, so they're always the same.
+                 */
+                if (!(rx->sta->sta.uapsd_queues & BIT(ac)))
+                        return RX_CONTINUE;
+
+                /* if we are in a service period, do nothing */
+                if (test_sta_flag(rx->sta, WLAN_STA_SP))
+                        return RX_CONTINUE;
+
+                if (!test_sta_flag(rx->sta, WLAN_STA_PS_DRIVER))
+                        ieee80211_sta_ps_deliver_uapsd(rx->sta);
+                else
+                        set_sta_flag(rx->sta, WLAN_STA_UAPSD);
+        }
+
+        return RX_CONTINUE;
+}
+
+static ieee80211_rx_result debug_noinline
 ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
 {
         struct sta_info *sta = rx->sta;
@@ -1216,7 +1295,7 @@ ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
             !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&
             (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
              rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)) {
-                if (test_sta_flags(sta, WLAN_STA_PS_STA)) {
+                if (test_sta_flag(sta, WLAN_STA_PS_STA)) {
                         /*
                          * Ignore doze->wake transitions that are
                          * indicated by non-data frames, the standard
@@ -1469,33 +1548,6 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
 }
 
 static ieee80211_rx_result debug_noinline
-ieee80211_rx_h_ps_poll(struct ieee80211_rx_data *rx)
-{
-        struct ieee80211_sub_if_data *sdata = rx->sdata;
-        __le16 fc = ((struct ieee80211_hdr *)rx->skb->data)->frame_control;
-        struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
-
-        if (likely(!rx->sta || !ieee80211_is_pspoll(fc) ||
-                   !(status->rx_flags & IEEE80211_RX_RA_MATCH)))
-                return RX_CONTINUE;
-
-        if ((sdata->vif.type != NL80211_IFTYPE_AP) &&
-            (sdata->vif.type != NL80211_IFTYPE_AP_VLAN))
-                return RX_DROP_UNUSABLE;
-
-        if (!test_sta_flags(rx->sta, WLAN_STA_PS_DRIVER))
-                ieee80211_sta_ps_deliver_poll_response(rx->sta);
-        else
-                set_sta_flags(rx->sta, WLAN_STA_PSPOLL);
-
-        /* Free PS Poll skb here instead of returning RX_DROP that would
-         * count as an dropped frame. */
-        dev_kfree_skb(rx->skb);
-
-        return RX_QUEUED;
-}
-
-static ieee80211_rx_result debug_noinline
 ieee80211_rx_h_remove_qos_control(struct ieee80211_rx_data *rx)
 {
         u8 *data = rx->skb->data;
@@ -1518,7 +1570,7 @@ static int
 ieee80211_802_1x_port_control(struct ieee80211_rx_data *rx)
 {
         if (unlikely(!rx->sta ||
-            !test_sta_flags(rx->sta, WLAN_STA_AUTHORIZED)))
+            !test_sta_flag(rx->sta, WLAN_STA_AUTHORIZED)))
                 return -EACCES;
 
         return 0;
@@ -1561,7 +1613,7 @@ ieee80211_drop_unencrypted_mgmt(struct ieee80211_rx_data *rx)
         if (status->flag & RX_FLAG_DECRYPTED)
                 return 0;
 
-        if (rx->sta && test_sta_flags(rx->sta, WLAN_STA_MFP)) {
+        if (rx->sta && test_sta_flag(rx->sta, WLAN_STA_MFP)) {
                 if (unlikely(!ieee80211_has_protected(fc) &&
                              ieee80211_is_unicast_robust_mgmt_frame(rx->skb) &&
                              rx->key)) {
@@ -1827,6 +1879,12 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
         hdrlen = ieee80211_hdrlen(hdr->frame_control);
         mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
 
+        /* frame is in RMC, don't forward */
+        if (ieee80211_is_data(hdr->frame_control) &&
+            is_multicast_ether_addr(hdr->addr1) &&
+            mesh_rmc_check(hdr->addr3, mesh_hdr, rx->sdata))
+                return RX_DROP_MONITOR;
+
         if (!ieee80211_is_data(hdr->frame_control))
                 return RX_CONTINUE;
 
@@ -1834,6 +1892,12 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
                 /* illegal frame */
                 return RX_DROP_MONITOR;
 
+        if (ieee80211_queue_stopped(&local->hw, skb_get_queue_mapping(skb))) {
+                IEEE80211_IFSTA_MESH_CTR_INC(&sdata->u.mesh,
+                                                dropped_frames_congestion);
+                return RX_DROP_MONITOR;
+        }
+
         if (mesh_hdr->flags & MESH_FLAGS_AE) {
                 struct mesh_path *mppath;
                 char *proxied_addr;
@@ -1889,13 +1953,13 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
                         memset(info, 0, sizeof(*info));
                         info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
                         info->control.vif = &rx->sdata->vif;
-                        skb_set_queue_mapping(skb,
-                                ieee80211_select_queue(rx->sdata, fwd_skb));
-                        ieee80211_set_qos_hdr(local, skb);
-                        if (is_multicast_ether_addr(fwd_hdr->addr1))
+                        if (is_multicast_ether_addr(fwd_hdr->addr1)) {
                                 IEEE80211_IFSTA_MESH_CTR_INC(&sdata->u.mesh,
                                                                 fwded_mcast);
-                        else {
+                                skb_set_queue_mapping(fwd_skb,
+                                        ieee80211_select_queue(sdata, fwd_skb));
+                                ieee80211_set_qos_hdr(sdata, fwd_skb);
+                        } else {
                                 int err;
                                 /*
                                  * Save TA to addr1 to send TA a path error if a
@@ -2220,12 +2284,29 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
                         goto handled;
                 }
                 break;
+        case WLAN_CATEGORY_SELF_PROTECTED:
+                switch (mgmt->u.action.u.self_prot.action_code) {
+                case WLAN_SP_MESH_PEERING_OPEN:
+                case WLAN_SP_MESH_PEERING_CLOSE:
+                case WLAN_SP_MESH_PEERING_CONFIRM:
+                        if (!ieee80211_vif_is_mesh(&sdata->vif))
+                                goto invalid;
+                        if (sdata->u.mesh.security != IEEE80211_MESH_SEC_NONE)
+                                /* userspace handles this frame */
+                                break;
+                        goto queue;
+                case WLAN_SP_MGK_INFORM:
+                case WLAN_SP_MGK_ACK:
+                        if (!ieee80211_vif_is_mesh(&sdata->vif))
+                                goto invalid;
+                        break;
+                }
+                break;
         case WLAN_CATEGORY_MESH_ACTION:
                 if (!ieee80211_vif_is_mesh(&sdata->vif))
                         break;
-                goto queue;
-        case WLAN_CATEGORY_MESH_PATH_SEL:
-                if (!mesh_path_sel_is_hwmp(sdata))
+                if (mesh_action_is_path_sel(mgmt) &&
+                  (!mesh_path_sel_is_hwmp(sdata)))
                         break;
                 goto queue;
         }
@@ -2534,17 +2615,17 @@ static void ieee80211_rx_handlers(struct ieee80211_rx_data *rx)
 
                 CALL_RXH(ieee80211_rx_h_decrypt)
                 CALL_RXH(ieee80211_rx_h_check_more_data)
+                CALL_RXH(ieee80211_rx_h_uapsd_and_pspoll)
                 CALL_RXH(ieee80211_rx_h_sta_process)
                 CALL_RXH(ieee80211_rx_h_defragment)
-                CALL_RXH(ieee80211_rx_h_ps_poll)
                 CALL_RXH(ieee80211_rx_h_michael_mic_verify)
                 /* must be after MMIC verify so header is counted in MPDU mic */
-                CALL_RXH(ieee80211_rx_h_remove_qos_control)
-                CALL_RXH(ieee80211_rx_h_amsdu)
 #ifdef CONFIG_MAC80211_MESH
                 if (ieee80211_vif_is_mesh(&rx->sdata->vif))
                         CALL_RXH(ieee80211_rx_h_mesh_fwding);
 #endif
+                CALL_RXH(ieee80211_rx_h_remove_qos_control)
+                CALL_RXH(ieee80211_rx_h_amsdu)
                 CALL_RXH(ieee80211_rx_h_data)
                 CALL_RXH(ieee80211_rx_h_ctrl);
                 CALL_RXH(ieee80211_rx_h_mgmt_check)
@@ -2686,7 +2767,9 @@ static int prepare_for_handlers(struct ieee80211_rx_data *rx,
                 } else if (!ieee80211_bssid_match(bssid,
                                         sdata->vif.addr)) {
                         if (!(status->rx_flags & IEEE80211_RX_IN_SCAN) &&
-                            !ieee80211_is_beacon(hdr->frame_control))
+                            !ieee80211_is_beacon(hdr->frame_control) &&
+                            !(ieee80211_is_action(hdr->frame_control) &&
+                              sdata->vif.p2p))
                                 return 0;
                         status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
                 }
@@ -2791,7 +2874,7 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
         if (ieee80211_is_data(fc)) {
                 prev_sta = NULL;
 
-                for_each_sta_info(local, hdr->addr2, sta, tmp) {
+                for_each_sta_info_rx(local, hdr->addr2, sta, tmp) {
                         if (!prev_sta) {
                                 prev_sta = sta;
                                 continue;
@@ -2835,7 +2918,7 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
                         continue;
                 }
 
-                rx.sta = sta_info_get_bss(prev, hdr->addr2);
+                rx.sta = sta_info_get_bss_rx(prev, hdr->addr2);
                 rx.sdata = prev;
                 ieee80211_prepare_and_rx_handle(&rx, skb, false);
 
@@ -2843,7 +2926,7 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
         }
 
         if (prev) {
-                rx.sta = sta_info_get_bss(prev, hdr->addr2);
+                rx.sta = sta_info_get_bss_rx(prev, hdr->addr2);
                 rx.sdata = prev;
 
                 if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index 6f09eca01112..83a0b050b374 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -14,7 +14,7 @@
 
 #include <linux/if_arp.h>
 #include <linux/rtnetlink.h>
-#include <linux/pm_qos_params.h>
+#include <linux/pm_qos.h>
 #include <net/sch_generic.h>
 #include <linux/slab.h>
 #include <net/mac80211.h>
@@ -254,6 +254,7 @@ static bool ieee80211_prep_hw_scan(struct ieee80211_local *local)
                                          req->ie, req->ie_len, band,
                                          req->rates[band], 0);
         local->hw_scan_req->ie_len = ielen;
+        local->hw_scan_req->no_cck = req->no_cck;
 
         return true;
 }
@@ -660,7 +661,8 @@ static void ieee80211_scan_state_send_probe(struct ieee80211_local *local,
                         local->scan_req->ssids[i].ssid,
                         local->scan_req->ssids[i].ssid_len,
                         local->scan_req->ie, local->scan_req->ie_len,
-                        local->scan_req->rates[band], false);
+                        local->scan_req->rates[band], false,
+                        local->scan_req->no_cck);
 
         /*
          * After sending probe requests, wait for probe responses
diff --git a/net/mac80211/spectmgmt.c b/net/mac80211/spectmgmt.c
index 7733f66ee2c4..578eea3fc04d 100644
--- a/net/mac80211/spectmgmt.c
+++ b/net/mac80211/spectmgmt.c
@@ -32,12 +32,8 @@ static void ieee80211_send_refuse_measurement_request(struct ieee80211_sub_if_da
 
         skb = dev_alloc_skb(sizeof(*msr_report) + local->hw.extra_tx_headroom +
                                 sizeof(struct ieee80211_msrment_ie));
-
-        if (!skb) {
-                printk(KERN_ERR "%s: failed to allocate buffer for "
-                                "measurement report frame\n", sdata->name);
+        if (!skb)
                 return;
-        }
 
         skb_reserve(skb, local->hw.extra_tx_headroom);
         msr_report = (struct ieee80211_mgmt *)skb_put(skb, 24);
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index 21070e9bc8d0..ce962d2c8782 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -24,6 +24,7 @@
 #include "sta_info.h"
 #include "debugfs_sta.h"
 #include "mesh.h"
+#include "wme.h"
 
 /**
  * DOC: STA information lifetime rules
@@ -72,7 +73,7 @@ static int sta_info_hash_del(struct ieee80211_local *local,
         if (!s)
                 return -ENOENT;
         if (s == sta) {
-                rcu_assign_pointer(local->sta_hash[STA_HASH(sta->sta.addr)],
+                RCU_INIT_POINTER(local->sta_hash[STA_HASH(sta->sta.addr)],
                                    s->hnext);
                 return 0;
         }
@@ -82,7 +83,7 @@ static int sta_info_hash_del(struct ieee80211_local *local,
                 s = rcu_dereference_protected(s->hnext,
                                         lockdep_is_held(&local->sta_lock));
         if (rcu_access_pointer(s->hnext)) {
-                rcu_assign_pointer(s->hnext, sta->hnext);
+                RCU_INIT_POINTER(s->hnext, sta->hnext);
                 return 0;
         }
 
@@ -100,6 +101,27 @@ struct sta_info *sta_info_get(struct ieee80211_sub_if_data *sdata,
                                     lockdep_is_held(&local->sta_lock) ||
                                     lockdep_is_held(&local->sta_mtx));
         while (sta) {
+                if (sta->sdata == sdata && !sta->dummy &&
+                    memcmp(sta->sta.addr, addr, ETH_ALEN) == 0)
+                        break;
+                sta = rcu_dereference_check(sta->hnext,
+                                            lockdep_is_held(&local->sta_lock) ||
+                                            lockdep_is_held(&local->sta_mtx));
+        }
+        return sta;
+}
+
+/* get a station info entry even if it is a dummy station*/
+struct sta_info *sta_info_get_rx(struct ieee80211_sub_if_data *sdata,
+                              const u8 *addr)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct sta_info *sta;
+
+        sta = rcu_dereference_check(local->sta_hash[STA_HASH(addr)],
+                                    lockdep_is_held(&local->sta_lock) ||
+                                    lockdep_is_held(&local->sta_mtx));
+        while (sta) {
                 if (sta->sdata == sdata &&
                     memcmp(sta->sta.addr, addr, ETH_ALEN) == 0)
                         break;
@@ -126,6 +148,32 @@ struct sta_info *sta_info_get_bss(struct ieee80211_sub_if_data *sdata,
         while (sta) {
                 if ((sta->sdata == sdata ||
                      (sta->sdata->bss && sta->sdata->bss == sdata->bss)) &&
+                    !sta->dummy &&
+                    memcmp(sta->sta.addr, addr, ETH_ALEN) == 0)
+                        break;
+                sta = rcu_dereference_check(sta->hnext,
+                                            lockdep_is_held(&local->sta_lock) ||
+                                            lockdep_is_held(&local->sta_mtx));
+        }
+        return sta;
+}
+
+/*
+ * Get sta info either from the specified interface
+ * or from one of its vlans (including dummy stations)
+ */
+struct sta_info *sta_info_get_bss_rx(struct ieee80211_sub_if_data *sdata,
+                                  const u8 *addr)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct sta_info *sta;
+
+        sta = rcu_dereference_check(local->sta_hash[STA_HASH(addr)],
+                                    lockdep_is_held(&local->sta_lock) ||
+                                    lockdep_is_held(&local->sta_mtx));
+        while (sta) {
+                if ((sta->sdata == sdata ||
+                     (sta->sdata->bss && sta->sdata->bss == sdata->bss)) &&
                     memcmp(sta->sta.addr, addr, ETH_ALEN) == 0)
                         break;
                 sta = rcu_dereference_check(sta->hnext,
@@ -184,7 +232,7 @@ static void sta_info_hash_add(struct ieee80211_local *local,
                               struct sta_info *sta)
 {
         sta->hnext = local->sta_hash[STA_HASH(sta->sta.addr)];
-        rcu_assign_pointer(local->sta_hash[STA_HASH(sta->sta.addr)], sta);
+        RCU_INIT_POINTER(local->sta_hash[STA_HASH(sta->sta.addr)], sta);
 }
 
 static void sta_unblock(struct work_struct *wk)
@@ -196,13 +244,22 @@ static void sta_unblock(struct work_struct *wk)
         if (sta->dead)
                 return;
 
-        if (!test_sta_flags(sta, WLAN_STA_PS_STA))
+        if (!test_sta_flag(sta, WLAN_STA_PS_STA))
                 ieee80211_sta_ps_deliver_wakeup(sta);
-        else if (test_and_clear_sta_flags(sta, WLAN_STA_PSPOLL)) {
-                clear_sta_flags(sta, WLAN_STA_PS_DRIVER);
+        else if (test_and_clear_sta_flag(sta, WLAN_STA_PSPOLL)) {
+                clear_sta_flag(sta, WLAN_STA_PS_DRIVER);
+
+                local_bh_disable();
                 ieee80211_sta_ps_deliver_poll_response(sta);
+                local_bh_enable();
+        } else if (test_and_clear_sta_flag(sta, WLAN_STA_UAPSD)) {
+                clear_sta_flag(sta, WLAN_STA_PS_DRIVER);
+
+                local_bh_disable();
+                ieee80211_sta_ps_deliver_uapsd(sta);
+                local_bh_enable();
         } else
-                clear_sta_flags(sta, WLAN_STA_PS_DRIVER);
+                clear_sta_flag(sta, WLAN_STA_PS_DRIVER);
 }
 
 static int sta_prepare_rate_control(struct ieee80211_local *local,
@@ -235,7 +292,6 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
                 return NULL;
 
         spin_lock_init(&sta->lock);
-        spin_lock_init(&sta->flaglock);
         INIT_WORK(&sta->drv_unblock_wk, sta_unblock);
         INIT_WORK(&sta->ampdu_mlme.work, ieee80211_ba_session_work);
         mutex_init(&sta->ampdu_mlme.mtx);
@@ -262,8 +318,10 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
                  */
                 sta->timer_to_tid[i] = i;
         }
-        skb_queue_head_init(&sta->ps_tx_buf);
-        skb_queue_head_init(&sta->tx_filtered);
+        for (i = 0; i < IEEE80211_NUM_ACS; i++) {
+                skb_queue_head_init(&sta->ps_tx_buf[i]);
+                skb_queue_head_init(&sta->tx_filtered[i]);
+        }
 
         for (i = 0; i < NUM_RX_DATA_QUEUES; i++)
                 sta->last_seq_ctrl[i] = cpu_to_le16(USHRT_MAX);
@@ -280,7 +338,8 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
         return sta;
 }
 
-static int sta_info_finish_insert(struct sta_info *sta, bool async)
+static int sta_info_finish_insert(struct sta_info *sta,
+                                bool async, bool dummy_reinsert)
 {
         struct ieee80211_local *local = sta->local;
         struct ieee80211_sub_if_data *sdata = sta->sdata;
@@ -290,50 +349,58 @@ static int sta_info_finish_insert(struct sta_info *sta, bool async)
 
         lockdep_assert_held(&local->sta_mtx);
 
-        /* notify driver */
-        if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
-                sdata = container_of(sdata->bss,
-                                     struct ieee80211_sub_if_data,
-                                     u.ap);
-        err = drv_sta_add(local, sdata, &sta->sta);
-        if (err) {
-                if (!async)
-                        return err;
-                printk(KERN_DEBUG "%s: failed to add IBSS STA %pM to driver (%d)"
-                                  " - keeping it anyway.\n",
-                       sdata->name, sta->sta.addr, err);
-        } else {
-                sta->uploaded = true;
+        if (!sta->dummy || dummy_reinsert) {
+                /* notify driver */
+                if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
+                        sdata = container_of(sdata->bss,
+                                             struct ieee80211_sub_if_data,
+                                             u.ap);
+                err = drv_sta_add(local, sdata, &sta->sta);
+                if (err) {
+                        if (!async)
+                                return err;
+                        printk(KERN_DEBUG "%s: failed to add IBSS STA %pM to "
+                                          "driver (%d) - keeping it anyway.\n",
+                               sdata->name, sta->sta.addr, err);
+                } else {
+                        sta->uploaded = true;
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
-                if (async)
-                        wiphy_debug(local->hw.wiphy,
-                                    "Finished adding IBSS STA %pM\n",
-                                    sta->sta.addr);
+                        if (async)
+                                wiphy_debug(local->hw.wiphy,
+                                            "Finished adding IBSS STA %pM\n",
+                                            sta->sta.addr);
 #endif
+                }
+
+                sdata = sta->sdata;
         }
 
-        sdata = sta->sdata;
+        if (!dummy_reinsert) {
+                if (!async) {
+                        local->num_sta++;
+                        local->sta_generation++;
+                        smp_mb();
 
-        if (!async) {
-                local->num_sta++;
-                local->sta_generation++;
-                smp_mb();
+                        /* make the station visible */
+                        spin_lock_irqsave(&local->sta_lock, flags);
+                        sta_info_hash_add(local, sta);
+                        spin_unlock_irqrestore(&local->sta_lock, flags);
+                }
 
-                /* make the station visible */
-                spin_lock_irqsave(&local->sta_lock, flags);
-                sta_info_hash_add(local, sta);
-                spin_unlock_irqrestore(&local->sta_lock, flags);
+                list_add(&sta->list, &local->sta_list);
+        } else {
+                sta->dummy = false;
         }
 
-        list_add(&sta->list, &local->sta_list);
-
-        ieee80211_sta_debugfs_add(sta);
-        rate_control_add_sta_debugfs(sta);
-
-        sinfo.filled = 0;
-        sinfo.generation = local->sta_generation;
-        cfg80211_new_sta(sdata->dev, sta->sta.addr, &sinfo, GFP_KERNEL);
+        if (!sta->dummy) {
+                ieee80211_sta_debugfs_add(sta);
+                rate_control_add_sta_debugfs(sta);
 
+                memset(&sinfo, 0, sizeof(sinfo));
+                sinfo.filled = 0;
+                sinfo.generation = local->sta_generation;
+                cfg80211_new_sta(sdata->dev, sta->sta.addr, &sinfo, GFP_KERNEL);
+        }
 
         return 0;
 }
@@ -350,7 +417,7 @@ static void sta_info_finish_pending(struct ieee80211_local *local)
                 list_del(&sta->list);
                 spin_unlock_irqrestore(&local->sta_lock, flags);
 
-                sta_info_finish_insert(sta, true);
+                sta_info_finish_insert(sta, true, false);
 
                 spin_lock_irqsave(&local->sta_lock, flags);
         }
@@ -367,106 +434,117 @@ static void sta_info_finish_work(struct work_struct *work)
         mutex_unlock(&local->sta_mtx);
 }
 
-int sta_info_insert_rcu(struct sta_info *sta) __acquires(RCU)
+static int sta_info_insert_check(struct sta_info *sta)
 {
-        struct ieee80211_local *local = sta->local;
         struct ieee80211_sub_if_data *sdata = sta->sdata;
-        unsigned long flags;
-        int err = 0;
 
         /*
          * Can't be a WARN_ON because it can be triggered through a race:
          * something inserts a STA (on one CPU) without holding the RTNL
          * and another CPU turns off the net device.
          */
-        if (unlikely(!ieee80211_sdata_running(sdata))) {
-                err = -ENETDOWN;
-                rcu_read_lock();
-                goto out_free;
-        }
+        if (unlikely(!ieee80211_sdata_running(sdata)))
+                return -ENETDOWN;
 
         if (WARN_ON(compare_ether_addr(sta->sta.addr, sdata->vif.addr) == 0 ||
-                    is_multicast_ether_addr(sta->sta.addr))) {
-                err = -EINVAL;
+                    is_multicast_ether_addr(sta->sta.addr)))
+                return -EINVAL;
+
+        return 0;
+}
+
+static int sta_info_insert_ibss(struct sta_info *sta) __acquires(RCU)
+{
+        struct ieee80211_local *local = sta->local;
+        struct ieee80211_sub_if_data *sdata = sta->sdata;
+        unsigned long flags;
+
+        spin_lock_irqsave(&local->sta_lock, flags);
+        /* check if STA exists already */
+        if (sta_info_get_bss_rx(sdata, sta->sta.addr)) {
+                spin_unlock_irqrestore(&local->sta_lock, flags);
                 rcu_read_lock();
-                goto out_free;
+                return -EEXIST;
         }
 
-        /*
-         * In ad-hoc mode, we sometimes need to insert stations
-         * from tasklet context from the RX path. To avoid races,
-         * always do so in that case -- see the comment below.
-         */
-        if (sdata->vif.type == NL80211_IFTYPE_ADHOC) {
-                spin_lock_irqsave(&local->sta_lock, flags);
-                /* check if STA exists already */
-                if (sta_info_get_bss(sdata, sta->sta.addr)) {
-                        spin_unlock_irqrestore(&local->sta_lock, flags);
-                        rcu_read_lock();
-                        err = -EEXIST;
-                        goto out_free;
-                }
-
-                local->num_sta++;
-                local->sta_generation++;
-                smp_mb();
-                sta_info_hash_add(local, sta);
+        local->num_sta++;
+        local->sta_generation++;
+        smp_mb();
+        sta_info_hash_add(local, sta);
 
-                list_add_tail(&sta->list, &local->sta_pending_list);
+        list_add_tail(&sta->list, &local->sta_pending_list);
 
-                rcu_read_lock();
-                spin_unlock_irqrestore(&local->sta_lock, flags);
+        rcu_read_lock();
+        spin_unlock_irqrestore(&local->sta_lock, flags);
 
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
-                wiphy_debug(local->hw.wiphy, "Added IBSS STA %pM\n",
-                            sta->sta.addr);
+        wiphy_debug(local->hw.wiphy, "Added IBSS STA %pM\n",
+                        sta->sta.addr);
 #endif /* CONFIG_MAC80211_VERBOSE_DEBUG */
 
-                ieee80211_queue_work(&local->hw, &local->sta_finish_work);
+        ieee80211_queue_work(&local->hw, &local->sta_finish_work);
 
-                return 0;
-        }
+        return 0;
+}
+
+/*
+ * should be called with sta_mtx locked
+ * this function replaces the mutex lock
+ * with a RCU lock
+ */
+static int sta_info_insert_non_ibss(struct sta_info *sta) __acquires(RCU)
+{
+        struct ieee80211_local *local = sta->local;
+        struct ieee80211_sub_if_data *sdata = sta->sdata;
+        unsigned long flags;
+        struct sta_info *exist_sta;
+        bool dummy_reinsert = false;
+        int err = 0;
+
+        lockdep_assert_held(&local->sta_mtx);
 
         /*
          * On first glance, this will look racy, because the code
-         * below this point, which inserts a station with sleeping,
+         * in this function, which inserts a station with sleeping,
          * unlocks the sta_lock between checking existence in the
          * hash table and inserting into it.
          *
          * However, it is not racy against itself because it keeps
-         * the mutex locked. It still seems to race against the
-         * above code that atomically inserts the station... That,
-         * however, is not true because the above code can only
-         * be invoked for IBSS interfaces, and the below code will
-         * not be -- and the two do not race against each other as
-         * the hash table also keys off the interface.
+         * the mutex locked.
          */
 
-        might_sleep();
-
-        mutex_lock(&local->sta_mtx);
-
         spin_lock_irqsave(&local->sta_lock, flags);
-        /* check if STA exists already */
-        if (sta_info_get_bss(sdata, sta->sta.addr)) {
-                spin_unlock_irqrestore(&local->sta_lock, flags);
-                mutex_unlock(&local->sta_mtx);
-                rcu_read_lock();
-                err = -EEXIST;
-                goto out_free;
+        /*
+         * check if STA exists already.
+         * only accept a scenario of a second call to sta_info_insert_non_ibss
+         * with a dummy station entry that was inserted earlier
+         * in that case - assume that the dummy station flag should
+         * be removed.
+         */
+        exist_sta = sta_info_get_bss_rx(sdata, sta->sta.addr);
+        if (exist_sta) {
+                if (exist_sta == sta && sta->dummy) {
+                        dummy_reinsert = true;
+                } else {
+                        spin_unlock_irqrestore(&local->sta_lock, flags);
+                        mutex_unlock(&local->sta_mtx);
+                        rcu_read_lock();
+                        return -EEXIST;
+                }
         }
 
         spin_unlock_irqrestore(&local->sta_lock, flags);
 
-        err = sta_info_finish_insert(sta, false);
+        err = sta_info_finish_insert(sta, false, dummy_reinsert);
         if (err) {
                 mutex_unlock(&local->sta_mtx);
                 rcu_read_lock();
-                goto out_free;
+                return err;
         }
 
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
-        wiphy_debug(local->hw.wiphy, "Inserted STA %pM\n", sta->sta.addr);
+        wiphy_debug(local->hw.wiphy, "Inserted %sSTA %pM\n",
+                        sta->dummy ? "dummy " : "", sta->sta.addr);
 #endif /* CONFIG_MAC80211_VERBOSE_DEBUG */
 
         /* move reference to rcu-protected */
@@ -477,6 +555,51 @@ int sta_info_insert_rcu(struct sta_info *sta) __acquires(RCU)
                 mesh_accept_plinks_update(sdata);
 
         return 0;
+}
+
+int sta_info_insert_rcu(struct sta_info *sta) __acquires(RCU)
+{
+        struct ieee80211_local *local = sta->local;
+        struct ieee80211_sub_if_data *sdata = sta->sdata;
+        int err = 0;
+
+        err = sta_info_insert_check(sta);
+        if (err) {
+                rcu_read_lock();
+                goto out_free;
+        }
+
+        /*
+         * In ad-hoc mode, we sometimes need to insert stations
+         * from tasklet context from the RX path. To avoid races,
+         * always do so in that case -- see the comment below.
+         */
+        if (sdata->vif.type == NL80211_IFTYPE_ADHOC) {
+                err = sta_info_insert_ibss(sta);
+                if (err)
+                        goto out_free;
+
+                return 0;
+        }
+
+        /*
+         * It might seem that the function called below is in race against
+         * the function call above that atomically inserts the station... That,
+         * however, is not true because the above code can only
+         * be invoked for IBSS interfaces, and the below code will
+         * not be -- and the two do not race against each other as
+         * the hash table also keys off the interface.
+         */
+
+        might_sleep();
+
+        mutex_lock(&local->sta_mtx);
+
+        err = sta_info_insert_non_ibss(sta);
+        if (err)
+                goto out_free;
+
+        return 0;
  out_free:
         BUG_ON(!err);
         __sta_info_free(local, sta);
@@ -492,6 +615,25 @@ int sta_info_insert(struct sta_info *sta)
         return err;
 }
 
+/* Caller must hold sta->local->sta_mtx */
+int sta_info_reinsert(struct sta_info *sta)
+{
+        struct ieee80211_local *local = sta->local;
+        int err = 0;
+
+        err = sta_info_insert_check(sta);
+        if (err) {
+                mutex_unlock(&local->sta_mtx);
+                return err;
+        }
+
+        might_sleep();
+
+        err = sta_info_insert_non_ibss(sta);
+        rcu_read_unlock();
+        return err;
+}
+
 static inline void __bss_tim_set(struct ieee80211_if_ap *bss, u16 aid)
 {
         /*
@@ -510,64 +652,93 @@ static inline void __bss_tim_clear(struct ieee80211_if_ap *bss, u16 aid)
         bss->tim[aid / 8] &= ~(1 << (aid % 8));
 }
 
-static void __sta_info_set_tim_bit(struct ieee80211_if_ap *bss,
-                                   struct sta_info *sta)
+static unsigned long ieee80211_tids_for_ac(int ac)
 {
-        BUG_ON(!bss);
-
-        __bss_tim_set(bss, sta->sta.aid);
-
-        if (sta->local->ops->set_tim) {
-                sta->local->tim_in_locked_section = true;
-                drv_set_tim(sta->local, &sta->sta, true);
-                sta->local->tim_in_locked_section = false;
+        /* If we ever support TIDs > 7, this obviously needs to be adjusted */
+        switch (ac) {
+        case IEEE80211_AC_VO:
+                return BIT(6) | BIT(7);
+        case IEEE80211_AC_VI:
+                return BIT(4) | BIT(5);
+        case IEEE80211_AC_BE:
+                return BIT(0) | BIT(3);
+        case IEEE80211_AC_BK:
+                return BIT(1) | BIT(2);
+        default:
+                WARN_ON(1);
+                return 0;
         }
 }
 
-void sta_info_set_tim_bit(struct sta_info *sta)
+void sta_info_recalc_tim(struct sta_info *sta)
 {
+        struct ieee80211_local *local = sta->local;
+        struct ieee80211_if_ap *bss = sta->sdata->bss;
         unsigned long flags;
+        bool indicate_tim = false;
+        u8 ignore_for_tim = sta->sta.uapsd_queues;
+        int ac;
 
-        BUG_ON(!sta->sdata->bss);
+        if (WARN_ON_ONCE(!sta->sdata->bss))
+                return;
 
-        spin_lock_irqsave(&sta->local->sta_lock, flags);
-        __sta_info_set_tim_bit(sta->sdata->bss, sta);
-        spin_unlock_irqrestore(&sta->local->sta_lock, flags);
-}
+        /* No need to do anything if the driver does all */
+        if (local->hw.flags & IEEE80211_HW_AP_LINK_PS)
+                return;
 
-static void __sta_info_clear_tim_bit(struct ieee80211_if_ap *bss,
-                                     struct sta_info *sta)
-{
-        BUG_ON(!bss);
+        if (sta->dead)
+                goto done;
+
+        /*
+         * If all ACs are delivery-enabled then we should build
+         * the TIM bit for all ACs anyway; if only some are then
+         * we ignore those and build the TIM bit using only the
+         * non-enabled ones.
+         */
+        if (ignore_for_tim == BIT(IEEE80211_NUM_ACS) - 1)
+                ignore_for_tim = 0;
+
+        for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
+                unsigned long tids;
 
-        __bss_tim_clear(bss, sta->sta.aid);
+                if (ignore_for_tim & BIT(ac))
+                        continue;
+
+                indicate_tim |= !skb_queue_empty(&sta->tx_filtered[ac]) ||
+                                !skb_queue_empty(&sta->ps_tx_buf[ac]);
+                if (indicate_tim)
+                        break;
 
-        if (sta->local->ops->set_tim) {
-                sta->local->tim_in_locked_section = true;
-                drv_set_tim(sta->local, &sta->sta, false);
-                sta->local->tim_in_locked_section = false;
+                tids = ieee80211_tids_for_ac(ac);
+
+                indicate_tim |=
+                        sta->driver_buffered_tids & tids;
         }
-}
 
-void sta_info_clear_tim_bit(struct sta_info *sta)
-{
-        unsigned long flags;
+ done:
+        spin_lock_irqsave(&local->sta_lock, flags);
 
-        BUG_ON(!sta->sdata->bss);
+        if (indicate_tim)
+                __bss_tim_set(bss, sta->sta.aid);
+        else
+                __bss_tim_clear(bss, sta->sta.aid);
 
-        spin_lock_irqsave(&sta->local->sta_lock, flags);
-        __sta_info_clear_tim_bit(sta->sdata->bss, sta);
-        spin_unlock_irqrestore(&sta->local->sta_lock, flags);
+        if (local->ops->set_tim) {
+                local->tim_in_locked_section = true;
+                drv_set_tim(local, &sta->sta, indicate_tim);
+                local->tim_in_locked_section = false;
+        }
+
+        spin_unlock_irqrestore(&local->sta_lock, flags);
 }
 
-static int sta_info_buffer_expired(struct sta_info *sta,
-                                   struct sk_buff *skb)
+static bool sta_info_buffer_expired(struct sta_info *sta, struct sk_buff *skb)
 {
         struct ieee80211_tx_info *info;
         int timeout;
 
         if (!skb)
-                return 0;
+                return false;
 
         info = IEEE80211_SKB_CB(skb);
 
@@ -581,24 +752,59 @@ static int sta_info_buffer_expired(struct sta_info *sta,
 }
 
 
-static bool sta_info_cleanup_expire_buffered(struct ieee80211_local *local,
-                                             struct sta_info *sta)
+static bool sta_info_cleanup_expire_buffered_ac(struct ieee80211_local *local,
+                                                struct sta_info *sta, int ac)
 {
         unsigned long flags;
         struct sk_buff *skb;
 
-        if (skb_queue_empty(&sta->ps_tx_buf))
-                return false;
+        /*
+         * First check for frames that should expire on the filtered
+         * queue. Frames here were rejected by the driver and are on
+         * a separate queue to avoid reordering with normal PS-buffered
+         * frames. They also aren't accounted for right now in the
+         * total_ps_buffered counter.
+         */
+        for (;;) {
+                spin_lock_irqsave(&sta->tx_filtered[ac].lock, flags);
+                skb = skb_peek(&sta->tx_filtered[ac]);
+                if (sta_info_buffer_expired(sta, skb))
+                        skb = __skb_dequeue(&sta->tx_filtered[ac]);
+                else
+                        skb = NULL;
+                spin_unlock_irqrestore(&sta->tx_filtered[ac].lock, flags);
 
+                /*
+                 * Frames are queued in order, so if this one
+                 * hasn't expired yet we can stop testing. If
+                 * we actually reached the end of the queue we
+                 * also need to stop, of course.
+                 */
+                if (!skb)
+                        break;
+                dev_kfree_skb(skb);
+        }
+
+        /*
+         * Now also check the normal PS-buffered queue, this will
+         * only find something if the filtered queue was emptied
+         * since the filtered frames are all before the normal PS
+         * buffered frames.
+         */
         for (;;) {
-                spin_lock_irqsave(&sta->ps_tx_buf.lock, flags);
-                skb = skb_peek(&sta->ps_tx_buf);
+                spin_lock_irqsave(&sta->ps_tx_buf[ac].lock, flags);
+                skb = skb_peek(&sta->ps_tx_buf[ac]);
                 if (sta_info_buffer_expired(sta, skb))
-                        skb = __skb_dequeue(&sta->ps_tx_buf);
+                        skb = __skb_dequeue(&sta->ps_tx_buf[ac]);
                 else
                         skb = NULL;
-                spin_unlock_irqrestore(&sta->ps_tx_buf.lock, flags);
+                spin_unlock_irqrestore(&sta->ps_tx_buf[ac].lock, flags);
 
+                /*
+                 * frames are queued in order, so if this one
+                 * hasn't expired yet (or we reached the end of
+                 * the queue) we can stop testing
+                 */
                 if (!skb)
                         break;
 
@@ -608,22 +814,47 @@ static bool sta_info_cleanup_expire_buffered(struct ieee80211_local *local,
                        sta->sta.addr);
 #endif
                 dev_kfree_skb(skb);
-
-                if (skb_queue_empty(&sta->ps_tx_buf) &&
-                    !test_sta_flags(sta, WLAN_STA_PS_DRIVER_BUF))
-                        sta_info_clear_tim_bit(sta);
         }
 
-        return true;
+        /*
+         * Finally, recalculate the TIM bit for this station -- it might
+         * now be clear because the station was too slow to retrieve its
+         * frames.
+         */
+        sta_info_recalc_tim(sta);
+
+        /*
+         * Return whether there are any frames still buffered, this is
+         * used to check whether the cleanup timer still needs to run,
+         * if there are no frames we don't need to rearm the timer.
+         */
+        return !(skb_queue_empty(&sta->ps_tx_buf[ac]) &&
+                 skb_queue_empty(&sta->tx_filtered[ac]));
+}
+
+static bool sta_info_cleanup_expire_buffered(struct ieee80211_local *local,
+                                             struct sta_info *sta)
+{
+        bool have_buffered = false;
+        int ac;
+
+        /* This is only necessary for stations on BSS interfaces */
+        if (!sta->sdata->bss)
+                return false;
+
+        for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
+                have_buffered |=
+                        sta_info_cleanup_expire_buffered_ac(local, sta, ac);
+
+        return have_buffered;
 }
 
 static int __must_check __sta_info_destroy(struct sta_info *sta)
 {
         struct ieee80211_local *local;
         struct ieee80211_sub_if_data *sdata;
-        struct sk_buff *skb;
         unsigned long flags;
-        int ret, i;
+        int ret, i, ac;
 
         might_sleep();
 
@@ -639,7 +870,7 @@ static int __must_check __sta_info_destroy(struct sta_info *sta)
          * sessions -- block that to make sure the tear-down
          * will be sufficient.
          */
-        set_sta_flags(sta, WLAN_STA_BLOCK_BA);
+        set_sta_flag(sta, WLAN_STA_BLOCK_BA);
         ieee80211_sta_tear_down_BA_sessions(sta, true);
 
         spin_lock_irqsave(&local->sta_lock, flags);
@@ -660,19 +891,22 @@ static int __must_check __sta_info_destroy(struct sta_info *sta)
 
         sta->dead = true;
 
-        if (test_and_clear_sta_flags(sta,
-                                WLAN_STA_PS_STA | WLAN_STA_PS_DRIVER)) {
+        if (test_sta_flag(sta, WLAN_STA_PS_STA) ||
+            test_sta_flag(sta, WLAN_STA_PS_DRIVER)) {
                 BUG_ON(!sdata->bss);
 
+                clear_sta_flag(sta, WLAN_STA_PS_STA);
+                clear_sta_flag(sta, WLAN_STA_PS_DRIVER);
+
                 atomic_dec(&sdata->bss->num_sta_ps);
-                sta_info_clear_tim_bit(sta);
+                sta_info_recalc_tim(sta);
         }
 
         local->num_sta--;
         local->sta_generation++;
 
         if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
-                rcu_assign_pointer(sdata->u.vlan.sta, NULL);
+                RCU_INIT_POINTER(sdata->u.vlan.sta, NULL);
 
         if (sta->uploaded) {
                 if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
@@ -691,6 +925,12 @@ static int __must_check __sta_info_destroy(struct sta_info *sta)
          */
         synchronize_rcu();
 
+        for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
+                local->total_ps_buffered -= skb_queue_len(&sta->ps_tx_buf[ac]);
+                __skb_queue_purge(&sta->ps_tx_buf[ac]);
+                __skb_queue_purge(&sta->tx_filtered[ac]);
+        }
+
 #ifdef CONFIG_MAC80211_MESH
         if (ieee80211_vif_is_mesh(&sdata->vif))
                 mesh_accept_plinks_update(sdata);
@@ -713,14 +953,6 @@ static int __must_check __sta_info_destroy(struct sta_info *sta)
         }
 #endif
 
-        while ((skb = skb_dequeue(&sta->ps_tx_buf)) != NULL) {
-                local->total_ps_buffered--;
-                dev_kfree_skb_any(skb);
-        }
-
-        while ((skb = skb_dequeue(&sta->tx_filtered)) != NULL)
-                dev_kfree_skb_any(skb);
-
         __sta_info_free(local, sta);
 
         return 0;
@@ -732,7 +964,7 @@ int sta_info_destroy_addr(struct ieee80211_sub_if_data *sdata, const u8 *addr)
         int ret;
 
         mutex_lock(&sdata->local->sta_mtx);
-        sta = sta_info_get(sdata, addr);
+        sta = sta_info_get_rx(sdata, addr);
         ret = __sta_info_destroy(sta);
         mutex_unlock(&sdata->local->sta_mtx);
 
@@ -746,7 +978,7 @@ int sta_info_destroy_addr_bss(struct ieee80211_sub_if_data *sdata,
         int ret;
 
         mutex_lock(&sdata->local->sta_mtx);
-        sta = sta_info_get_bss(sdata, addr);
+        sta = sta_info_get_bss_rx(sdata, addr);
         ret = __sta_info_destroy(sta);
         mutex_unlock(&sdata->local->sta_mtx);
 
@@ -886,7 +1118,8 @@ static void clear_sta_ps_flags(void *_sta)
 {
         struct sta_info *sta = _sta;
 
-        clear_sta_flags(sta, WLAN_STA_PS_DRIVER | WLAN_STA_PS_STA);
+        clear_sta_flag(sta, WLAN_STA_PS_DRIVER);
+        clear_sta_flag(sta, WLAN_STA_PS_STA);
 }
 
 /* powersave support code */
@@ -894,88 +1127,341 @@ void ieee80211_sta_ps_deliver_wakeup(struct sta_info *sta)
 {
         struct ieee80211_sub_if_data *sdata = sta->sdata;
         struct ieee80211_local *local = sdata->local;
-        int sent, buffered;
+        struct sk_buff_head pending;
+        int filtered = 0, buffered = 0, ac;
+
+        clear_sta_flag(sta, WLAN_STA_SP);
+
+        BUILD_BUG_ON(BITS_TO_LONGS(STA_TID_NUM) > 1);
+        sta->driver_buffered_tids = 0;
 
-        clear_sta_flags(sta, WLAN_STA_PS_DRIVER_BUF);
         if (!(local->hw.flags & IEEE80211_HW_AP_LINK_PS))
                 drv_sta_notify(local, sdata, STA_NOTIFY_AWAKE, &sta->sta);
 
-        if (!skb_queue_empty(&sta->ps_tx_buf))
-                sta_info_clear_tim_bit(sta);
+        skb_queue_head_init(&pending);
 
         /* Send all buffered frames to the station */
-        sent = ieee80211_add_pending_skbs(local, &sta->tx_filtered);
-        buffered = ieee80211_add_pending_skbs_fn(local, &sta->ps_tx_buf,
-                                                 clear_sta_ps_flags, sta);
-        sent += buffered;
+        for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
+                int count = skb_queue_len(&pending), tmp;
+
+                skb_queue_splice_tail_init(&sta->tx_filtered[ac], &pending);
+                tmp = skb_queue_len(&pending);
+                filtered += tmp - count;
+                count = tmp;
+
+                skb_queue_splice_tail_init(&sta->ps_tx_buf[ac], &pending);
+                tmp = skb_queue_len(&pending);
+                buffered += tmp - count;
+        }
+
+        ieee80211_add_pending_skbs_fn(local, &pending, clear_sta_ps_flags, sta);
+
         local->total_ps_buffered -= buffered;
 
+        sta_info_recalc_tim(sta);
+
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
         printk(KERN_DEBUG "%s: STA %pM aid %d sending %d filtered/%d PS frames "
                "since STA not sleeping anymore\n", sdata->name,
-               sta->sta.addr, sta->sta.aid, sent - buffered, buffered);
+               sta->sta.addr, sta->sta.aid, filtered, buffered);
 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
 }
 
-void ieee80211_sta_ps_deliver_poll_response(struct sta_info *sta)
+static void ieee80211_send_null_response(struct ieee80211_sub_if_data *sdata,
+                                         struct sta_info *sta, int tid,
+                                         enum ieee80211_frame_release_type reason)
 {
-        struct ieee80211_sub_if_data *sdata = sta->sdata;
         struct ieee80211_local *local = sdata->local;
+        struct ieee80211_qos_hdr *nullfunc;
         struct sk_buff *skb;
-        int no_pending_pkts;
+        int size = sizeof(*nullfunc);
+        __le16 fc;
+        bool qos = test_sta_flag(sta, WLAN_STA_WME);
+        struct ieee80211_tx_info *info;
 
-        skb = skb_dequeue(&sta->tx_filtered);
-        if (!skb) {
-                skb = skb_dequeue(&sta->ps_tx_buf);
-                if (skb)
-                        local->total_ps_buffered--;
+        if (qos) {
+                fc = cpu_to_le16(IEEE80211_FTYPE_DATA |
+                                 IEEE80211_STYPE_QOS_NULLFUNC |
+                                 IEEE80211_FCTL_FROMDS);
+        } else {
+                size -= 2;
+                fc = cpu_to_le16(IEEE80211_FTYPE_DATA |
+                                 IEEE80211_STYPE_NULLFUNC |
+                                 IEEE80211_FCTL_FROMDS);
+        }
+
+        skb = dev_alloc_skb(local->hw.extra_tx_headroom + size);
+        if (!skb)
+                return;
+
+        skb_reserve(skb, local->hw.extra_tx_headroom);
+
+        nullfunc = (void *) skb_put(skb, size);
+        nullfunc->frame_control = fc;
+        nullfunc->duration_id = 0;
+        memcpy(nullfunc->addr1, sta->sta.addr, ETH_ALEN);
+        memcpy(nullfunc->addr2, sdata->vif.addr, ETH_ALEN);
+        memcpy(nullfunc->addr3, sdata->vif.addr, ETH_ALEN);
+
+        skb->priority = tid;
+        skb_set_queue_mapping(skb, ieee802_1d_to_ac[tid]);
+        if (qos) {
+                nullfunc->qos_ctrl = cpu_to_le16(tid);
+
+                if (reason == IEEE80211_FRAME_RELEASE_UAPSD)
+                        nullfunc->qos_ctrl |=
+                                cpu_to_le16(IEEE80211_QOS_CTL_EOSP);
         }
-        no_pending_pkts = skb_queue_empty(&sta->tx_filtered) &&
-                skb_queue_empty(&sta->ps_tx_buf);
 
-        if (skb) {
-                struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-                struct ieee80211_hdr *hdr =
-                        (struct ieee80211_hdr *) skb->data;
+        info = IEEE80211_SKB_CB(skb);
+
+        /*
+         * Tell TX path to send this frame even though the
+         * STA may still remain is PS mode after this frame
+         * exchange. Also set EOSP to indicate this packet
+         * ends the poll/service period.
+         */
+        info->flags |= IEEE80211_TX_CTL_POLL_RESPONSE |
+                       IEEE80211_TX_STATUS_EOSP |
+                       IEEE80211_TX_CTL_REQ_TX_STATUS;
+
+        drv_allow_buffered_frames(local, sta, BIT(tid), 1, reason, false);
+
+        ieee80211_xmit(sdata, skb);
+}
+
+static void
+ieee80211_sta_ps_deliver_response(struct sta_info *sta,
+                                  int n_frames, u8 ignored_acs,
+                                  enum ieee80211_frame_release_type reason)
+{
+        struct ieee80211_sub_if_data *sdata = sta->sdata;
+        struct ieee80211_local *local = sdata->local;
+        bool found = false;
+        bool more_data = false;
+        int ac;
+        unsigned long driver_release_tids = 0;
+        struct sk_buff_head frames;
+
+        /* Service or PS-Poll period starts */
+        set_sta_flag(sta, WLAN_STA_SP);
+
+        __skb_queue_head_init(&frames);
+
+        /*
+         * Get response frame(s) and more data bit for it.
+         */
+        for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
+                unsigned long tids;
+
+                if (ignored_acs & BIT(ac))
+                        continue;
+
+                tids = ieee80211_tids_for_ac(ac);
+
+                if (!found) {
+                        driver_release_tids = sta->driver_buffered_tids & tids;
+                        if (driver_release_tids) {
+                                found = true;
+                        } else {
+                                struct sk_buff *skb;
+
+                                while (n_frames > 0) {
+                                        skb = skb_dequeue(&sta->tx_filtered[ac]);
+                                        if (!skb) {
+                                                skb = skb_dequeue(
+                                                        &sta->ps_tx_buf[ac]);
+                                                if (skb)
+                                                        local->total_ps_buffered--;
+                                        }
+                                        if (!skb)
+                                                break;
+                                        n_frames--;
+                                        found = true;
+                                        __skb_queue_tail(&frames, skb);
+                                }
+                        }
+
+                        /*
+                         * If the driver has data on more than one TID then
+                         * certainly there's more data if we release just a
+                         * single frame now (from a single TID).
+                         */
+                        if (reason == IEEE80211_FRAME_RELEASE_PSPOLL &&
+                            hweight16(driver_release_tids) > 1) {
+                                more_data = true;
+                                driver_release_tids =
+                                        BIT(ffs(driver_release_tids) - 1);
+                                break;
+                        }
+                }
+
+                if (!skb_queue_empty(&sta->tx_filtered[ac]) ||
+                    !skb_queue_empty(&sta->ps_tx_buf[ac])) {
+                        more_data = true;
+                        break;
+                }
+        }
+
+        if (!found) {
+                int tid;
 
                 /*
-                 * Tell TX path to send this frame even though the STA may
-                 * still remain is PS mode after this frame exchange.
+                 * For PS-Poll, this can only happen due to a race condition
+                 * when we set the TIM bit and the station notices it, but
+                 * before it can poll for the frame we expire it.
+                 *
+                 * For uAPSD, this is said in the standard (11.2.1.5 h):
+                 *      At each unscheduled SP for a non-AP STA, the AP shall
+                 *      attempt to transmit at least one MSDU or MMPDU, but no
+                 *      more than the value specified in the Max SP Length field
+                 *      in the QoS Capability element from delivery-enabled ACs,
+                 *      that are destined for the non-AP STA.
+                 *
+                 * Since we have no other MSDU/MMPDU, transmit a QoS null frame.
                  */
-                info->flags |= IEEE80211_TX_CTL_PSPOLL_RESPONSE;
 
-#ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
-                printk(KERN_DEBUG "STA %pM aid %d: PS Poll (entries after %d)\n",
-                       sta->sta.addr, sta->sta.aid,
-                       skb_queue_len(&sta->ps_tx_buf));
-#endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
+                /* This will evaluate to 1, 3, 5 or 7. */
+                tid = 7 - ((ffs(~ignored_acs) - 1) << 1);
 
-                /* Use MoreData flag to indicate whether there are more
-                 * buffered frames for this STA */
-                if (no_pending_pkts)
-                        hdr->frame_control &= cpu_to_le16(~IEEE80211_FCTL_MOREDATA);
-                else
-                        hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_MOREDATA);
+                ieee80211_send_null_response(sdata, sta, tid, reason);
+                return;
+        }
+
+        if (!driver_release_tids) {
+                struct sk_buff_head pending;
+                struct sk_buff *skb;
+                int num = 0;
+                u16 tids = 0;
+
+                skb_queue_head_init(&pending);
+
+                while ((skb = __skb_dequeue(&frames))) {
+                        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+                        struct ieee80211_hdr *hdr = (void *) skb->data;
+                        u8 *qoshdr = NULL;
+
+                        num++;
+
+                        /*
+                         * Tell TX path to send this frame even though the
+                         * STA may still remain is PS mode after this frame
+                         * exchange.
+                         */
+                        info->flags |= IEEE80211_TX_CTL_POLL_RESPONSE;
+
+                        /*
+                         * Use MoreData flag to indicate whether there are
+                         * more buffered frames for this STA
+                         */
+                        if (!more_data)
+                                hdr->frame_control &=
+                                        cpu_to_le16(~IEEE80211_FCTL_MOREDATA);
+                        else
+                                hdr->frame_control |=
+                                        cpu_to_le16(IEEE80211_FCTL_MOREDATA);
+
+                        if (ieee80211_is_data_qos(hdr->frame_control) ||
+                            ieee80211_is_qos_nullfunc(hdr->frame_control))
+                                qoshdr = ieee80211_get_qos_ctl(hdr);
+
+                        /* set EOSP for the frame */
+                        if (reason == IEEE80211_FRAME_RELEASE_UAPSD &&
+                            qoshdr && skb_queue_empty(&frames))
+                                *qoshdr |= IEEE80211_QOS_CTL_EOSP;
+
+                        info->flags |= IEEE80211_TX_STATUS_EOSP |
+                                       IEEE80211_TX_CTL_REQ_TX_STATUS;
+
+                        if (qoshdr)
+                                tids |= BIT(*qoshdr & IEEE80211_QOS_CTL_TID_MASK);
+                        else
+                                tids |= BIT(0);
+
+                        __skb_queue_tail(&pending, skb);
+                }
 
-                ieee80211_add_pending_skb(local, skb);
+                drv_allow_buffered_frames(local, sta, tids, num,
+                                          reason, more_data);
 
-                if (no_pending_pkts)
-                        sta_info_clear_tim_bit(sta);
-#ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
+                ieee80211_add_pending_skbs(local, &pending);
+
+                sta_info_recalc_tim(sta);
         } else {
                 /*
-                 * FIXME: This can be the result of a race condition between
-                 *        us expiring a frame and the station polling for it.
-                 *        Should we send it a null-func frame indicating we
-                 *        have nothing buffered for it?
+                 * We need to release a frame that is buffered somewhere in the
+                 * driver ... it'll have to handle that.
+                 * Note that, as per the comment above, it'll also have to see
+                 * if there is more than just one frame on the specific TID that
+                 * we're releasing from, and it needs to set the more-data bit
+                 * accordingly if we tell it that there's no more data. If we do
+                 * tell it there's more data, then of course the more-data bit
+                 * needs to be set anyway.
+                 */
+                drv_release_buffered_frames(local, sta, driver_release_tids,
+                                            n_frames, reason, more_data);
+
+                /*
+                 * Note that we don't recalculate the TIM bit here as it would
+                 * most likely have no effect at all unless the driver told us
+                 * that the TID became empty before returning here from the
+                 * release function.
+                 * Either way, however, when the driver tells us that the TID
+                 * became empty we'll do the TIM recalculation.
                  */
-                printk(KERN_DEBUG "%s: STA %pM sent PS Poll even "
-                       "though there are no buffered frames for it\n",
-                       sdata->name, sta->sta.addr);
-#endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
         }
 }
 
+void ieee80211_sta_ps_deliver_poll_response(struct sta_info *sta)
+{
+        u8 ignore_for_response = sta->sta.uapsd_queues;
+
+        /*
+         * If all ACs are delivery-enabled then we should reply
+         * from any of them, if only some are enabled we reply
+         * only from the non-enabled ones.
+         */
+        if (ignore_for_response == BIT(IEEE80211_NUM_ACS) - 1)
+                ignore_for_response = 0;
+
+        ieee80211_sta_ps_deliver_response(sta, 1, ignore_for_response,
+                                          IEEE80211_FRAME_RELEASE_PSPOLL);
+}
+
+void ieee80211_sta_ps_deliver_uapsd(struct sta_info *sta)
+{
+        int n_frames = sta->sta.max_sp;
+        u8 delivery_enabled = sta->sta.uapsd_queues;
+
+        /*
+         * If we ever grow support for TSPEC this might happen if
+         * the TSPEC update from hostapd comes in between a trigger
+         * frame setting WLAN_STA_UAPSD in the RX path and this
+         * actually getting called.
+         */
+        if (!delivery_enabled)
+                return;
+
+        switch (sta->sta.max_sp) {
+        case 1:
+                n_frames = 2;
+                break;
+        case 2:
+                n_frames = 4;
+                break;
+        case 3:
+                n_frames = 6;
+                break;
+        case 0:
+                /* XXX: what is a good value? */
+                n_frames = 8;
+                break;
+        }
+
+        ieee80211_sta_ps_deliver_response(sta, n_frames, ~delivery_enabled,
+                                          IEEE80211_FRAME_RELEASE_UAPSD);
+}
+
 void ieee80211_sta_block_awake(struct ieee80211_hw *hw,
                                struct ieee80211_sta *pubsta, bool block)
 {
@@ -984,17 +1470,50 @@ void ieee80211_sta_block_awake(struct ieee80211_hw *hw,
         trace_api_sta_block_awake(sta->local, pubsta, block);
 
         if (block)
-                set_sta_flags(sta, WLAN_STA_PS_DRIVER);
-        else if (test_sta_flags(sta, WLAN_STA_PS_DRIVER))
+                set_sta_flag(sta, WLAN_STA_PS_DRIVER);
+        else if (test_sta_flag(sta, WLAN_STA_PS_DRIVER))
                 ieee80211_queue_work(hw, &sta->drv_unblock_wk);
 }
 EXPORT_SYMBOL(ieee80211_sta_block_awake);
 
-void ieee80211_sta_set_tim(struct ieee80211_sta *pubsta)
+void ieee80211_sta_eosp_irqsafe(struct ieee80211_sta *pubsta)
 {
         struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
+        struct ieee80211_local *local = sta->local;
+        struct sk_buff *skb;
+        struct skb_eosp_msg_data *data;
+
+        trace_api_eosp(local, pubsta);
+
+        skb = alloc_skb(0, GFP_ATOMIC);
+        if (!skb) {
+                /* too bad ... but race is better than loss */
+                clear_sta_flag(sta, WLAN_STA_SP);
+                return;
+        }
+
+        data = (void *)skb->cb;
+        memcpy(data->sta, pubsta->addr, ETH_ALEN);
+        memcpy(data->iface, sta->sdata->vif.addr, ETH_ALEN);
+        skb->pkt_type = IEEE80211_EOSP_MSG;
+        skb_queue_tail(&local->skb_queue, skb);
+        tasklet_schedule(&local->tasklet);
+}
+EXPORT_SYMBOL(ieee80211_sta_eosp_irqsafe);
+
+void ieee80211_sta_set_buffered(struct ieee80211_sta *pubsta,
+                                u8 tid, bool buffered)
+{
+        struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
+
+        if (WARN_ON(tid >= STA_TID_NUM))
+                return;
+
+        if (buffered)
+                set_bit(tid, &sta->driver_buffered_tids);
+        else
+                clear_bit(tid, &sta->driver_buffered_tids);
 
-        set_sta_flags(sta, WLAN_STA_PS_DRIVER_BUF);
-        sta_info_set_tim_bit(sta);
+        sta_info_recalc_tim(sta);
 }
-EXPORT_SYMBOL(ieee80211_sta_set_tim);
+EXPORT_SYMBOL(ieee80211_sta_set_buffered);
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index 28beb78e601e..8c8ce05ad26f 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -19,7 +19,8 @@
 /**
  * enum ieee80211_sta_info_flags - Stations flags
  *
- * These flags are used with &struct sta_info's @flags member.
+ * These flags are used with &struct sta_info's @flags member, but
+ * only indirectly with set_sta_flag() and friends.
  *
  * @WLAN_STA_AUTH: Station is authenticated.
  * @WLAN_STA_ASSOC: Station is associated.
@@ -43,24 +44,33 @@
  *      be in the queues
  * @WLAN_STA_PSPOLL: Station sent PS-poll while driver was keeping
  *      station in power-save mode, reply when the driver unblocks.
- * @WLAN_STA_PS_DRIVER_BUF: Station has frames pending in driver internal
- *      buffers. Automatically cleared on station wake-up.
+ * @WLAN_STA_TDLS_PEER: Station is a TDLS peer.
+ * @WLAN_STA_TDLS_PEER_AUTH: This TDLS peer is authorized to send direct
+ *      packets. This means the link is enabled.
+ * @WLAN_STA_UAPSD: Station requested unscheduled SP while driver was
+ *      keeping station in power-save mode, reply when the driver
+ *      unblocks the station.
+ * @WLAN_STA_SP: Station is in a service period, so don't try to
+ *      reply to other uAPSD trigger frames or PS-Poll.
  */
 enum ieee80211_sta_info_flags {
-        WLAN_STA_AUTH           = 1<<0,
-        WLAN_STA_ASSOC          = 1<<1,
-        WLAN_STA_PS_STA         = 1<<2,
-        WLAN_STA_AUTHORIZED     = 1<<3,
-        WLAN_STA_SHORT_PREAMBLE = 1<<4,
-        WLAN_STA_ASSOC_AP       = 1<<5,
-        WLAN_STA_WME            = 1<<6,
-        WLAN_STA_WDS            = 1<<7,
-        WLAN_STA_CLEAR_PS_FILT  = 1<<9,
-        WLAN_STA_MFP            = 1<<10,
-        WLAN_STA_BLOCK_BA       = 1<<11,
-        WLAN_STA_PS_DRIVER      = 1<<12,
-        WLAN_STA_PSPOLL         = 1<<13,
-        WLAN_STA_PS_DRIVER_BUF  = 1<<14,
+        WLAN_STA_AUTH,
+        WLAN_STA_ASSOC,
+        WLAN_STA_PS_STA,
+        WLAN_STA_AUTHORIZED,
+        WLAN_STA_SHORT_PREAMBLE,
+        WLAN_STA_ASSOC_AP,
+        WLAN_STA_WME,
+        WLAN_STA_WDS,
+        WLAN_STA_CLEAR_PS_FILT,
+        WLAN_STA_MFP,
+        WLAN_STA_BLOCK_BA,
+        WLAN_STA_PS_DRIVER,
+        WLAN_STA_PSPOLL,
+        WLAN_STA_TDLS_PEER,
+        WLAN_STA_TDLS_PEER_AUTH,
+        WLAN_STA_UAPSD,
+        WLAN_STA_SP,
 };
 
 #define STA_TID_NUM 16
@@ -86,6 +96,8 @@ enum ieee80211_sta_info_flags {
  * @stop_initiator: initiator of a session stop
  * @tx_stop: TX DelBA frame when stopping
  * @buf_size: reorder buffer size at receiver
+ * @failed_bar_ssn: ssn of the last failed BAR tx attempt
+ * @bar_pending: BAR needs to be re-sent
  *
  * This structure's lifetime is managed by RCU, assignments to
  * the array holding it must hold the aggregation mutex.
@@ -106,6 +118,9 @@ struct tid_ampdu_tx {
         u8 stop_initiator;
         bool tx_stop;
         u8 buf_size;
+
+        u16 failed_bar_ssn;
+        bool bar_pending;
 };
 
 /**
@@ -198,15 +213,16 @@ struct sta_ampdu_mlme {
  * @last_rx_rate_flag: rx status flag of the last data packet
  * @lock: used for locking all fields that require locking, see comments
  *      in the header file.
- * @flaglock: spinlock for flags accesses
  * @drv_unblock_wk: used for driver PS unblocking
  * @listen_interval: listen interval of this station, when we're acting as AP
- * @flags: STA flags, see &enum ieee80211_sta_info_flags
- * @ps_tx_buf: buffer of frames to transmit to this station
- *      when it leaves power saving state
- * @tx_filtered: buffer of frames we already tried to transmit
- *      but were filtered by hardware due to STA having entered
- *      power saving state
+ * @_flags: STA flags, see &enum ieee80211_sta_info_flags, do not use directly
+ * @ps_tx_buf: buffers (per AC) of frames to transmit to this station
+ *      when it leaves power saving state or polls
+ * @tx_filtered: buffers (per AC) of frames we already tried to
+ *      transmit but were filtered by hardware due to STA having
+ *      entered power saving state, these are also delivered to
+ *      the station when it leaves powersave or polls for frames
+ * @driver_buffered_tids: bitmap of TIDs the driver has data buffered on
  * @rx_packets: Number of MSDUs received from this STA
  * @rx_bytes: Number of bytes received from this STA
  * @wep_weak_iv_count: number of weak WEP IVs received from this station
@@ -238,10 +254,12 @@ struct sta_ampdu_mlme {
  * @plink_timer: peer link watch timer
  * @plink_timer_was_running: used by suspend/resume to restore timers
  * @debugfs: debug filesystem info
- * @sta: station information we share with the driver
  * @dead: set to true when sta is unlinked
  * @uploaded: set to true when sta is uploaded to the driver
  * @lost_packets: number of consecutive lost packets
+ * @dummy: indicate a dummy station created for receiving
+ *      EAP frames before association
+ * @sta: station information we share with the driver
  */
 struct sta_info {
         /* General information, mostly static */
@@ -254,7 +272,6 @@ struct sta_info {
         struct rate_control_ref *rate_ctrl;
         void *rate_ctrl_priv;
         spinlock_t lock;
-        spinlock_t flaglock;
 
         struct work_struct drv_unblock_wk;
 
@@ -264,18 +281,16 @@ struct sta_info {
 
         bool uploaded;
 
-        /*
-         * frequently updated, locked with own spinlock (flaglock),
-         * use the accessors defined below
-         */
-        u32 flags;
+        /* use the accessors defined below */
+        unsigned long _flags;
 
         /*
          * STA powersave frame queues, no more than the internal
          * locking required.
          */
-        struct sk_buff_head ps_tx_buf;
-        struct sk_buff_head tx_filtered;
+        struct sk_buff_head ps_tx_buf[IEEE80211_NUM_ACS];
+        struct sk_buff_head tx_filtered[IEEE80211_NUM_ACS];
+        unsigned long driver_buffered_tids;
 
         /* Updated from RX path only, no locking requirements */
         unsigned long rx_packets, rx_bytes;
@@ -336,6 +351,9 @@ struct sta_info {
 
         unsigned int lost_packets;
 
+        /* should be right in front of sta to be in the same cache line */
+        bool dummy;
+
         /* keep last! */
         struct ieee80211_sta sta;
 };
@@ -348,60 +366,28 @@ static inline enum nl80211_plink_state sta_plink_state(struct sta_info *sta)
         return NL80211_PLINK_LISTEN;
 }
 
-static inline void set_sta_flags(struct sta_info *sta, const u32 flags)
+static inline void set_sta_flag(struct sta_info *sta,
+                                enum ieee80211_sta_info_flags flag)
 {
-        unsigned long irqfl;
-
-        spin_lock_irqsave(&sta->flaglock, irqfl);
-        sta->flags |= flags;
-        spin_unlock_irqrestore(&sta->flaglock, irqfl);
+        set_bit(flag, &sta->_flags);
 }
 
-static inline void clear_sta_flags(struct sta_info *sta, const u32 flags)
+static inline void clear_sta_flag(struct sta_info *sta,
+                                  enum ieee80211_sta_info_flags flag)
 {
-        unsigned long irqfl;
-
-        spin_lock_irqsave(&sta->flaglock, irqfl);
-        sta->flags &= ~flags;
-        spin_unlock_irqrestore(&sta->flaglock, irqfl);
+        clear_bit(flag, &sta->_flags);
 }
 
-static inline u32 test_sta_flags(struct sta_info *sta, const u32 flags)
+static inline int test_sta_flag(struct sta_info *sta,
+                                enum ieee80211_sta_info_flags flag)
 {
-        u32 ret;
-        unsigned long irqfl;
-
-        spin_lock_irqsave(&sta->flaglock, irqfl);
-        ret = sta->flags & flags;
-        spin_unlock_irqrestore(&sta->flaglock, irqfl);
-
-        return ret;
-}
-
-static inline u32 test_and_clear_sta_flags(struct sta_info *sta,
-                                           const u32 flags)
-{
-        u32 ret;
-        unsigned long irqfl;
-
-        spin_lock_irqsave(&sta->flaglock, irqfl);
-        ret = sta->flags & flags;
-        sta->flags &= ~flags;
-        spin_unlock_irqrestore(&sta->flaglock, irqfl);
-
-        return ret;
+        return test_bit(flag, &sta->_flags);
 }
 
-static inline u32 get_sta_flags(struct sta_info *sta)
+static inline int test_and_clear_sta_flag(struct sta_info *sta,
+                                          enum ieee80211_sta_info_flags flag)
 {
-        u32 ret;
-        unsigned long irqfl;
-
-        spin_lock_irqsave(&sta->flaglock, irqfl);
-        ret = sta->flags;
-        spin_unlock_irqrestore(&sta->flaglock, irqfl);
-
-        return ret;
+        return test_and_clear_bit(flag, &sta->_flags);
 }
 
 void ieee80211_assign_tid_tx(struct sta_info *sta, int tid,
@@ -419,8 +405,8 @@ rcu_dereference_protected_tid_tx(struct sta_info *sta, int tid)
 #define STA_HASH(sta) (sta[5])
 
 
-/* Maximum number of frames to buffer per power saving station */
-#define STA_MAX_TX_BUFFER 128
+/* Maximum number of frames to buffer per power saving station per AC */
+#define STA_MAX_TX_BUFFER       64
 
 /* Minimum buffered frame expiry time. If STA uses listen interval that is
  * smaller than this value, the minimum value here is used instead. */
@@ -436,9 +422,15 @@ rcu_dereference_protected_tid_tx(struct sta_info *sta, int tid)
 struct sta_info *sta_info_get(struct ieee80211_sub_if_data *sdata,
                               const u8 *addr);
 
+struct sta_info *sta_info_get_rx(struct ieee80211_sub_if_data *sdata,
+                              const u8 *addr);
+
 struct sta_info *sta_info_get_bss(struct ieee80211_sub_if_data *sdata,
                                   const u8 *addr);
 
+struct sta_info *sta_info_get_bss_rx(struct ieee80211_sub_if_data *sdata,
+                                  const u8 *addr);
+
 static inline
 void for_each_sta_info_type_check(struct ieee80211_local *local,
                                   const u8 *addr,
@@ -459,6 +451,22 @@ void for_each_sta_info_type_check(struct ieee80211_local *local,
                 _sta = nxt,                                             \
                 nxt = _sta ? rcu_dereference(_sta->hnext) : NULL        \
              )                                                          \
+        /* run code only if address matches and it's not a dummy sta */ \
+        if (memcmp(_sta->sta.addr, (_addr), ETH_ALEN) == 0 &&           \
+                !_sta->dummy)
+
+#define for_each_sta_info_rx(local, _addr, _sta, nxt)                   \
+        for (   /* initialise loop */                                   \
+                _sta = rcu_dereference(local->sta_hash[STA_HASH(_addr)]),\
+                nxt = _sta ? rcu_dereference(_sta->hnext) : NULL;       \
+                /* typecheck */                                         \
+                for_each_sta_info_type_check(local, (_addr), _sta, nxt),\
+                /* continue condition */                                \
+                _sta;                                                   \
+                /* advance loop */                                      \
+                _sta = nxt,                                             \
+                nxt = _sta ? rcu_dereference(_sta->hnext) : NULL        \
+             )                                                          \
         /* compare address and run code only if it matches */           \
         if (memcmp(_sta->sta.addr, (_addr), ETH_ALEN) == 0)
 
@@ -484,14 +492,14 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
 int sta_info_insert(struct sta_info *sta);
 int sta_info_insert_rcu(struct sta_info *sta) __acquires(RCU);
 int sta_info_insert_atomic(struct sta_info *sta);
+int sta_info_reinsert(struct sta_info *sta);
 
 int sta_info_destroy_addr(struct ieee80211_sub_if_data *sdata,
                           const u8 *addr);
 int sta_info_destroy_addr_bss(struct ieee80211_sub_if_data *sdata,
                               const u8 *addr);
 
-void sta_info_set_tim_bit(struct sta_info *sta);
-void sta_info_clear_tim_bit(struct sta_info *sta);
+void sta_info_recalc_tim(struct sta_info *sta);
 
 void sta_info_init(struct ieee80211_local *local);
 void sta_info_stop(struct ieee80211_local *local);
@@ -502,5 +510,6 @@ void ieee80211_sta_expire(struct ieee80211_sub_if_data *sdata,
 
 void ieee80211_sta_ps_deliver_wakeup(struct sta_info *sta);
 void ieee80211_sta_ps_deliver_poll_response(struct sta_info *sta);
+void ieee80211_sta_ps_deliver_uapsd(struct sta_info *sta);
 
 #endif /* STA_INFO_H */
diff --git a/net/mac80211/status.c b/net/mac80211/status.c
index 1658efaa2e8e..df643cedf9b9 100644
--- a/net/mac80211/status.c
+++ b/net/mac80211/status.c
@@ -14,6 +14,7 @@
 #include "rate.h"
 #include "mesh.h"
 #include "led.h"
+#include "wme.h"
 
 
 void ieee80211_tx_status_irqsafe(struct ieee80211_hw *hw,
@@ -43,6 +44,8 @@ static void ieee80211_handle_filtered_frame(struct ieee80211_local *local,
                                             struct sk_buff *skb)
 {
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+        struct ieee80211_hdr *hdr = (void *)skb->data;
+        int ac;
 
         /*
          * This skb 'survived' a round-trip through the driver, and
@@ -63,11 +66,37 @@ static void ieee80211_handle_filtered_frame(struct ieee80211_local *local,
         sta->tx_filtered_count++;
 
         /*
+         * Clear more-data bit on filtered frames, it might be set
+         * but later frames might time out so it might have to be
+         * clear again ... It's all rather unlikely (this frame
+         * should time out first, right?) but let's not confuse
+         * peers unnecessarily.
+         */
+        if (hdr->frame_control & cpu_to_le16(IEEE80211_FCTL_MOREDATA))
+                hdr->frame_control &= ~cpu_to_le16(IEEE80211_FCTL_MOREDATA);
+
+        if (ieee80211_is_data_qos(hdr->frame_control)) {
+                u8 *p = ieee80211_get_qos_ctl(hdr);
+                int tid = *p & IEEE80211_QOS_CTL_TID_MASK;
+
+                /*
+                 * Clear EOSP if set, this could happen e.g.
+                 * if an absence period (us being a P2P GO)
+                 * shortens the SP.
+                 */
+                if (*p & IEEE80211_QOS_CTL_EOSP)
+                        *p &= ~IEEE80211_QOS_CTL_EOSP;
+                ac = ieee802_1d_to_ac[tid & 7];
+        } else {
+                ac = IEEE80211_AC_BE;
+        }
+
+        /*
          * Clear the TX filter mask for this STA when sending the next
          * packet. If the STA went to power save mode, this will happen
          * when it wakes up for the next time.
          */
-        set_sta_flags(sta, WLAN_STA_CLEAR_PS_FILT);
+        set_sta_flag(sta, WLAN_STA_CLEAR_PS_FILT);
 
         /*
          * This code races in the following way:
@@ -103,13 +132,19 @@ static void ieee80211_handle_filtered_frame(struct ieee80211_local *local,
          *      changes before calling TX status events if ordering can be
          *      unknown.
          */
-        if (test_sta_flags(sta, WLAN_STA_PS_STA) &&
-            skb_queue_len(&sta->tx_filtered) < STA_MAX_TX_BUFFER) {
-                skb_queue_tail(&sta->tx_filtered, skb);
+        if (test_sta_flag(sta, WLAN_STA_PS_STA) &&
+            skb_queue_len(&sta->tx_filtered[ac]) < STA_MAX_TX_BUFFER) {
+                skb_queue_tail(&sta->tx_filtered[ac], skb);
+                sta_info_recalc_tim(sta);
+
+                if (!timer_pending(&local->sta_cleanup))
+                        mod_timer(&local->sta_cleanup,
+                                  round_jiffies(jiffies +
+                                                STA_INFO_CLEANUP_INTERVAL));
                 return;
         }
 
-        if (!test_sta_flags(sta, WLAN_STA_PS_STA) &&
+        if (!test_sta_flag(sta, WLAN_STA_PS_STA) &&
             !(info->flags & IEEE80211_TX_INTFL_RETRIED)) {
                 /* Software retry the packet once */
                 info->flags |= IEEE80211_TX_INTFL_RETRIED;
@@ -121,18 +156,38 @@ static void ieee80211_handle_filtered_frame(struct ieee80211_local *local,
         if (net_ratelimit())
                 wiphy_debug(local->hw.wiphy,
                             "dropped TX filtered frame, queue_len=%d PS=%d @%lu\n",
-                            skb_queue_len(&sta->tx_filtered),
-                            !!test_sta_flags(sta, WLAN_STA_PS_STA), jiffies);
+                            skb_queue_len(&sta->tx_filtered[ac]),
+                            !!test_sta_flag(sta, WLAN_STA_PS_STA), jiffies);
 #endif
         dev_kfree_skb(skb);
 }
 
+static void ieee80211_check_pending_bar(struct sta_info *sta, u8 *addr, u8 tid)
+{
+        struct tid_ampdu_tx *tid_tx;
+
+        tid_tx = rcu_dereference(sta->ampdu_mlme.tid_tx[tid]);
+        if (!tid_tx || !tid_tx->bar_pending)
+                return;
+
+        tid_tx->bar_pending = false;
+        ieee80211_send_bar(&sta->sdata->vif, addr, tid, tid_tx->failed_bar_ssn);
+}
+
 static void ieee80211_frame_acked(struct sta_info *sta, struct sk_buff *skb)
 {
         struct ieee80211_mgmt *mgmt = (void *) skb->data;
         struct ieee80211_local *local = sta->local;
         struct ieee80211_sub_if_data *sdata = sta->sdata;
 
+        if (ieee80211_is_data_qos(mgmt->frame_control)) {
+                struct ieee80211_hdr *hdr = (void *) skb->data;
+                u8 *qc = ieee80211_get_qos_ctl(hdr);
+                u16 tid = qc[0] & 0xf;
+
+                ieee80211_check_pending_bar(sta, hdr->addr1, tid);
+        }
+
         if (ieee80211_is_action(mgmt->frame_control) &&
             sdata->vif.type == NL80211_IFTYPE_STATION &&
             mgmt->u.action.category == WLAN_CATEGORY_HT &&
@@ -161,6 +216,114 @@ static void ieee80211_frame_acked(struct sta_info *sta, struct sk_buff *skb)
         }
 }
 
+static void ieee80211_set_bar_pending(struct sta_info *sta, u8 tid, u16 ssn)
+{
+        struct tid_ampdu_tx *tid_tx;
+
+        tid_tx = rcu_dereference(sta->ampdu_mlme.tid_tx[tid]);
+        if (!tid_tx)
+                return;
+
+        tid_tx->failed_bar_ssn = ssn;
+        tid_tx->bar_pending = true;
+}
+
+static int ieee80211_tx_radiotap_len(struct ieee80211_tx_info *info)
+{
+        int len = sizeof(struct ieee80211_radiotap_header);
+
+        /* IEEE80211_RADIOTAP_RATE rate */
+        if (info->status.rates[0].idx >= 0 &&
+            !(info->status.rates[0].flags & IEEE80211_TX_RC_MCS))
+                len += 2;
+
+        /* IEEE80211_RADIOTAP_TX_FLAGS */
+        len += 2;
+
+        /* IEEE80211_RADIOTAP_DATA_RETRIES */
+        len += 1;
+
+        /* IEEE80211_TX_RC_MCS */
+        if (info->status.rates[0].idx >= 0 &&
+            info->status.rates[0].flags & IEEE80211_TX_RC_MCS)
+                len += 3;
+
+        return len;
+}
+
+static void ieee80211_add_tx_radiotap_header(struct ieee80211_supported_band
+                                             *sband, struct sk_buff *skb,
+                                             int retry_count, int rtap_len)
+{
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
+        struct ieee80211_radiotap_header *rthdr;
+        unsigned char *pos;
+        __le16 txflags;
+
+        rthdr = (struct ieee80211_radiotap_header *) skb_push(skb, rtap_len);
+
+        memset(rthdr, 0, rtap_len);
+        rthdr->it_len = cpu_to_le16(rtap_len);
+        rthdr->it_present =
+                cpu_to_le32((1 << IEEE80211_RADIOTAP_TX_FLAGS) |
+                            (1 << IEEE80211_RADIOTAP_DATA_RETRIES));
+        pos = (unsigned char *)(rthdr + 1);
+
+        /*
+         * XXX: Once radiotap gets the bitmap reset thing the vendor
+         *      extensions proposal contains, we can actually report
+         *      the whole set of tries we did.
+         */
+
+        /* IEEE80211_RADIOTAP_RATE */
+        if (info->status.rates[0].idx >= 0 &&
+            !(info->status.rates[0].flags & IEEE80211_TX_RC_MCS)) {
+                rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_RATE);
+                *pos = sband->bitrates[info->status.rates[0].idx].bitrate / 5;
+                /* padding for tx flags */
+                pos += 2;
+        }
+
+        /* IEEE80211_RADIOTAP_TX_FLAGS */
+        txflags = 0;
+        if (!(info->flags & IEEE80211_TX_STAT_ACK) &&
+            !is_multicast_ether_addr(hdr->addr1))
+                txflags |= cpu_to_le16(IEEE80211_RADIOTAP_F_TX_FAIL);
+
+        if ((info->status.rates[0].flags & IEEE80211_TX_RC_USE_RTS_CTS) ||
+            (info->status.rates[0].flags & IEEE80211_TX_RC_USE_CTS_PROTECT))
+                txflags |= cpu_to_le16(IEEE80211_RADIOTAP_F_TX_CTS);
+        else if (info->status.rates[0].flags & IEEE80211_TX_RC_USE_RTS_CTS)
+                txflags |= cpu_to_le16(IEEE80211_RADIOTAP_F_TX_RTS);
+
+        put_unaligned_le16(txflags, pos);
+        pos += 2;
+
+        /* IEEE80211_RADIOTAP_DATA_RETRIES */
+        /* for now report the total retry_count */
+        *pos = retry_count;
+        pos++;
+
+        /* IEEE80211_TX_RC_MCS */
+        if (info->status.rates[0].idx >= 0 &&
+            info->status.rates[0].flags & IEEE80211_TX_RC_MCS) {
+                rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_MCS);
+                pos[0] = IEEE80211_RADIOTAP_MCS_HAVE_MCS |
+                         IEEE80211_RADIOTAP_MCS_HAVE_GI |
+                         IEEE80211_RADIOTAP_MCS_HAVE_BW;
+                if (info->status.rates[0].flags & IEEE80211_TX_RC_SHORT_GI)
+                        pos[1] |= IEEE80211_RADIOTAP_MCS_SGI;
+                if (info->status.rates[0].flags & IEEE80211_TX_RC_40_MHZ_WIDTH)
+                        pos[1] |= IEEE80211_RADIOTAP_MCS_BW_40;
+                if (info->status.rates[0].flags & IEEE80211_TX_RC_GREEN_FIELD)
+                        pos[1] |= IEEE80211_RADIOTAP_MCS_FMT_GF;
+                pos[2] = info->status.rates[0].idx;
+                pos += 3;
+        }
+
+}
+
 /*
  * Use a static threshold for now, best value to be determined
  * by testing ...
@@ -179,7 +342,6 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
         u16 frag, type;
         __le16 fc;
         struct ieee80211_supported_band *sband;
-        struct ieee80211_tx_status_rtap_hdr *rthdr;
         struct ieee80211_sub_if_data *sdata;
         struct net_device *prev_dev = NULL;
         struct sta_info *sta, *tmp;
@@ -187,6 +349,9 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
         int rates_idx = -1;
         bool send_to_cooked;
         bool acked;
+        struct ieee80211_bar *bar;
+        u16 tid;
+        int rtap_len;
 
         for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
                 if (info->status.rates[i].idx < 0) {
@@ -215,8 +380,11 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
                 if (memcmp(hdr->addr2, sta->sdata->vif.addr, ETH_ALEN))
                         continue;
 
+                if (info->flags & IEEE80211_TX_STATUS_EOSP)
+                        clear_sta_flag(sta, WLAN_STA_SP);
+
                 acked = !!(info->flags & IEEE80211_TX_STAT_ACK);
-                if (!acked && test_sta_flags(sta, WLAN_STA_PS_STA)) {
+                if (!acked && test_sta_flag(sta, WLAN_STA_PS_STA)) {
                         /*
                          * The STA is in power save mode, so assume
                          * that this TX packet failed because of that.
@@ -239,10 +407,31 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
                         tid = qc[0] & 0xf;
                         ssn = ((le16_to_cpu(hdr->seq_ctrl) + 0x10)
                                                 & IEEE80211_SCTL_SEQ);
-                        ieee80211_send_bar(sta->sdata, hdr->addr1,
+                        ieee80211_send_bar(&sta->sdata->vif, hdr->addr1,
                                            tid, ssn);
                 }
 
+                if (!acked && ieee80211_is_back_req(fc)) {
+                        u16 control;
+
+                        /*
+                         * BAR failed, store the last SSN and retry sending
+                         * the BAR when the next unicast transmission on the
+                         * same TID succeeds.
+                         */
+                        bar = (struct ieee80211_bar *) skb->data;
+                        control = le16_to_cpu(bar->control);
+                        if (!(control & IEEE80211_BAR_CTRL_MULTI_TID)) {
+                                u16 ssn = le16_to_cpu(bar->start_seq_num);
+
+                                tid = (control &
+                                       IEEE80211_BAR_CTRL_TID_INFO_MASK) >>
+                                      IEEE80211_BAR_CTRL_TID_INFO_SHIFT;
+
+                                ieee80211_set_bar_pending(sta, tid, ssn);
+                        }
+                }
+
                 if (info->flags & IEEE80211_TX_STAT_TX_FILTERED) {
                         ieee80211_handle_filtered_frame(local, sta, skb);
                         rcu_read_unlock();
@@ -336,7 +525,7 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
                                 continue;
                         if (wk->offchan_tx.frame != skb)
                                 continue;
-                        wk->offchan_tx.frame = NULL;
+                        wk->offchan_tx.status = true;
                         break;
                 }
                 rcu_read_unlock();
@@ -345,9 +534,6 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
                         local->hw_roc_skb_for_status = NULL;
                 }
 
-                if (cookie == local->hw_offchan_tx_cookie)
-                        local->hw_offchan_tx_cookie = 0;
-
                 cfg80211_mgmt_tx_status(
                         skb->dev, cookie, skb->data, skb->len,
                         !!(info->flags & IEEE80211_TX_STAT_ACK), GFP_ATOMIC);
@@ -370,44 +556,13 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
         }
 
         /* send frame to monitor interfaces now */
-
-        if (skb_headroom(skb) < sizeof(*rthdr)) {
+        rtap_len = ieee80211_tx_radiotap_len(info);
+        if (WARN_ON_ONCE(skb_headroom(skb) < rtap_len)) {
                 printk(KERN_ERR "ieee80211_tx_status: headroom too small\n");
                 dev_kfree_skb(skb);
                 return;
         }
-
-        rthdr = (struct ieee80211_tx_status_rtap_hdr *)
-                                skb_push(skb, sizeof(*rthdr));
-
-        memset(rthdr, 0, sizeof(*rthdr));
-        rthdr->hdr.it_len = cpu_to_le16(sizeof(*rthdr));
-        rthdr->hdr.it_present =
-                cpu_to_le32((1 << IEEE80211_RADIOTAP_TX_FLAGS) |
-                            (1 << IEEE80211_RADIOTAP_DATA_RETRIES) |
-                            (1 << IEEE80211_RADIOTAP_RATE));
-
-        if (!(info->flags & IEEE80211_TX_STAT_ACK) &&
-            !is_multicast_ether_addr(hdr->addr1))
-                rthdr->tx_flags |= cpu_to_le16(IEEE80211_RADIOTAP_F_TX_FAIL);
-
-        /*
-         * XXX: Once radiotap gets the bitmap reset thing the vendor
-         *      extensions proposal contains, we can actually report
-         *      the whole set of tries we did.
-         */
-        if ((info->status.rates[0].flags & IEEE80211_TX_RC_USE_RTS_CTS) ||
-            (info->status.rates[0].flags & IEEE80211_TX_RC_USE_CTS_PROTECT))
-                rthdr->tx_flags |= cpu_to_le16(IEEE80211_RADIOTAP_F_TX_CTS);
-        else if (info->status.rates[0].flags & IEEE80211_TX_RC_USE_RTS_CTS)
-                rthdr->tx_flags |= cpu_to_le16(IEEE80211_RADIOTAP_F_TX_RTS);
-        if (info->status.rates[0].idx >= 0 &&
-            !(info->status.rates[0].flags & IEEE80211_TX_RC_MCS))
-                rthdr->rate = sband->bitrates[
-                                info->status.rates[0].idx].bitrate / 5;
-
-        /* for now report the total retry_count */
-        rthdr->data_retries = retry_count;
+        ieee80211_add_tx_radiotap_header(sband, skb, retry_count, rtap_len);
 
         /* XXX: is this sufficient for BPF? */
         skb_set_mac_header(skb, 0);
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 8cb0d2d0ac69..48bbb96d8edb 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -253,7 +253,7 @@ ieee80211_tx_h_check_assoc(struct ieee80211_tx_data *tx)
 
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
-        u32 sta_flags;
+        bool assoc = false;
 
         if (unlikely(info->flags & IEEE80211_TX_CTL_INJECTED))
                 return TX_CONTINUE;
@@ -284,10 +284,11 @@ ieee80211_tx_h_check_assoc(struct ieee80211_tx_data *tx)
         if (tx->flags & IEEE80211_TX_PS_BUFFERED)
                 return TX_CONTINUE;
 
-        sta_flags = tx->sta ? get_sta_flags(tx->sta) : 0;
+        if (tx->sta)
+                assoc = test_sta_flag(tx->sta, WLAN_STA_ASSOC);
 
         if (likely(tx->flags & IEEE80211_TX_UNICAST)) {
-                if (unlikely(!(sta_flags & WLAN_STA_ASSOC) &&
+                if (unlikely(!assoc &&
                              tx->sdata->vif.type != NL80211_IFTYPE_ADHOC &&
                              ieee80211_is_data(hdr->frame_control))) {
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
@@ -343,13 +344,22 @@ static void purge_old_ps_buffers(struct ieee80211_local *local)
                 total += skb_queue_len(&ap->ps_bc_buf);
         }
 
+        /*
+         * Drop one frame from each station from the lowest-priority
+         * AC that has frames at all.
+         */
         list_for_each_entry_rcu(sta, &local->sta_list, list) {
-                skb = skb_dequeue(&sta->ps_tx_buf);
-                if (skb) {
-                        purged++;
-                        dev_kfree_skb(skb);
+                int ac;
+
+                for (ac = IEEE80211_AC_BK; ac >= IEEE80211_AC_VO; ac--) {
+                        skb = skb_dequeue(&sta->ps_tx_buf[ac]);
+                        total += skb_queue_len(&sta->ps_tx_buf[ac]);
+                        if (skb) {
+                                purged++;
+                                dev_kfree_skb(skb);
+                                break;
+                        }
                 }
-                total += skb_queue_len(&sta->ps_tx_buf);
         }
 
         rcu_read_unlock();
@@ -418,7 +428,7 @@ static int ieee80211_use_mfp(__le16 fc, struct sta_info *sta,
         if (!ieee80211_is_mgmt(fc))
                 return 0;
 
-        if (sta == NULL || !test_sta_flags(sta, WLAN_STA_MFP))
+        if (sta == NULL || !test_sta_flag(sta, WLAN_STA_MFP))
                 return 0;
 
         if (!ieee80211_is_robust_mgmt_frame((struct ieee80211_hdr *)
@@ -435,7 +445,6 @@ ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx)
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
         struct ieee80211_local *local = tx->local;
-        u32 staflags;
 
         if (unlikely(!sta ||
                      ieee80211_is_probe_resp(hdr->frame_control) ||
@@ -444,57 +453,52 @@ ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx)
                      ieee80211_is_reassoc_resp(hdr->frame_control)))
                 return TX_CONTINUE;
 
-        staflags = get_sta_flags(sta);
+        if (unlikely((test_sta_flag(sta, WLAN_STA_PS_STA) ||
+                      test_sta_flag(sta, WLAN_STA_PS_DRIVER)) &&
+                     !(info->flags & IEEE80211_TX_CTL_POLL_RESPONSE))) {
+                int ac = skb_get_queue_mapping(tx->skb);
 
-        if (unlikely((staflags & (WLAN_STA_PS_STA | WLAN_STA_PS_DRIVER)) &&
-                     !(info->flags & IEEE80211_TX_CTL_PSPOLL_RESPONSE))) {
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
-                printk(KERN_DEBUG "STA %pM aid %d: PS buffer (entries "
-                       "before %d)\n",
-                       sta->sta.addr, sta->sta.aid,
-                       skb_queue_len(&sta->ps_tx_buf));
+                printk(KERN_DEBUG "STA %pM aid %d: PS buffer for AC %d\n",
+                       sta->sta.addr, sta->sta.aid, ac);
 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
                 if (tx->local->total_ps_buffered >= TOTAL_MAX_TX_BUFFER)
                         purge_old_ps_buffers(tx->local);
-                if (skb_queue_len(&sta->ps_tx_buf) >= STA_MAX_TX_BUFFER) {
-                        struct sk_buff *old = skb_dequeue(&sta->ps_tx_buf);
+                if (skb_queue_len(&sta->ps_tx_buf[ac]) >= STA_MAX_TX_BUFFER) {
+                        struct sk_buff *old = skb_dequeue(&sta->ps_tx_buf[ac]);
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
-                        if (net_ratelimit()) {
-                                printk(KERN_DEBUG "%s: STA %pM TX "
-                                       "buffer full - dropping oldest frame\n",
-                                       tx->sdata->name, sta->sta.addr);
-                        }
+                        if (net_ratelimit())
+                                printk(KERN_DEBUG "%s: STA %pM TX buffer for "
+                                       "AC %d full - dropping oldest frame\n",
+                                       tx->sdata->name, sta->sta.addr, ac);
 #endif
                         dev_kfree_skb(old);
                 } else
                         tx->local->total_ps_buffered++;
 
-                /*
-                 * Queue frame to be sent after STA wakes up/polls,
-                 * but don't set the TIM bit if the driver is blocking
-                 * wakeup or poll response transmissions anyway.
-                 */
-                if (skb_queue_empty(&sta->ps_tx_buf) &&
-                    !(staflags & WLAN_STA_PS_DRIVER))
-                        sta_info_set_tim_bit(sta);
-
                 info->control.jiffies = jiffies;
                 info->control.vif = &tx->sdata->vif;
                 info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
-                skb_queue_tail(&sta->ps_tx_buf, tx->skb);
+                skb_queue_tail(&sta->ps_tx_buf[ac], tx->skb);
 
                 if (!timer_pending(&local->sta_cleanup))
                         mod_timer(&local->sta_cleanup,
                                   round_jiffies(jiffies +
                                                 STA_INFO_CLEANUP_INTERVAL));
 
+                /*
+                 * We queued up some frames, so the TIM bit might
+                 * need to be set, recalculate it.
+                 */
+                sta_info_recalc_tim(sta);
+
                 return TX_QUEUED;
         }
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
-        else if (unlikely(staflags & WLAN_STA_PS_STA)) {
-                printk(KERN_DEBUG "%s: STA %pM in PS mode, but pspoll "
-                       "set -> send frame\n", tx->sdata->name,
-                       sta->sta.addr);
+        else if (unlikely(test_sta_flag(sta, WLAN_STA_PS_STA))) {
+                printk(KERN_DEBUG
+                       "%s: STA %pM in PS mode, but polling/in SP -> send frame\n",
+                       tx->sdata->name, sta->sta.addr);
         }
 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
 
@@ -552,7 +556,7 @@ ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx)
                  !(info->flags & IEEE80211_TX_CTL_INJECTED) &&
                  (!ieee80211_is_robust_mgmt_frame(hdr) ||
                   (ieee80211_is_action(hdr->frame_control) &&
-                   tx->sta && test_sta_flags(tx->sta, WLAN_STA_MFP)))) {
+                   tx->sta && test_sta_flag(tx->sta, WLAN_STA_MFP)))) {
                 I802_DEBUG_INC(tx->local->tx_handlers_drop_unencrypted);
                 return TX_DROP;
         } else
@@ -611,7 +615,7 @@ ieee80211_tx_h_rate_ctrl(struct ieee80211_tx_data *tx)
         u32 len;
         bool inval = false, rts = false, short_preamble = false;
         struct ieee80211_tx_rate_control txrc;
-        u32 sta_flags;
+        bool assoc = false;
 
         memset(&txrc, 0, sizeof(txrc));
 
@@ -647,17 +651,17 @@ ieee80211_tx_h_rate_ctrl(struct ieee80211_tx_data *tx)
          */
         if (tx->sdata->vif.bss_conf.use_short_preamble &&
             (ieee80211_is_data(hdr->frame_control) ||
-             (tx->sta && test_sta_flags(tx->sta, WLAN_STA_SHORT_PREAMBLE))))
+             (tx->sta && test_sta_flag(tx->sta, WLAN_STA_SHORT_PREAMBLE))))
                 txrc.short_preamble = short_preamble = true;
 
-        sta_flags = tx->sta ? get_sta_flags(tx->sta) : 0;
+        if (tx->sta)
+                assoc = test_sta_flag(tx->sta, WLAN_STA_ASSOC);
 
         /*
          * Lets not bother rate control if we're associated and cannot
          * talk to the sta. This should not happen.
          */
-        if (WARN(test_bit(SCAN_SW_SCANNING, &tx->local->scanning) &&
-                 (sta_flags & WLAN_STA_ASSOC) &&
+        if (WARN(test_bit(SCAN_SW_SCANNING, &tx->local->scanning) && assoc &&
                  !rate_usable_index_exists(sband, &tx->sta->sta),
                  "%s: Dropped data frame as no usable bitrate found while "
                  "scanning and associated. Target station: "
@@ -800,6 +804,9 @@ ieee80211_tx_h_sequence(struct ieee80211_tx_data *tx)
         if (ieee80211_hdrlen(hdr->frame_control) < 24)
                 return TX_CONTINUE;
 
+        if (ieee80211_is_qos_nullfunc(hdr->frame_control))
+                return TX_CONTINUE;
+
         /*
          * Anything but QoS data that has a sequence number field
          * (is long enough) gets a sequence number from the global
@@ -891,7 +898,10 @@ ieee80211_tx_h_fragment(struct ieee80211_tx_data *tx)
         int hdrlen;
         int fragnum;
 
-        if (!(tx->flags & IEEE80211_TX_FRAGMENTED))
+        if (info->flags & IEEE80211_TX_CTL_DONTFRAG)
+                return TX_CONTINUE;
+
+        if (tx->local->ops->set_frag_threshold)
                 return TX_CONTINUE;
 
         /*
@@ -904,7 +914,7 @@ ieee80211_tx_h_fragment(struct ieee80211_tx_data *tx)
 
         hdrlen = ieee80211_hdrlen(hdr->frame_control);
 
-        /* internal error, why is TX_FRAGMENTED set? */
+        /* internal error, why isn't DONTFRAG set? */
         if (WARN_ON(skb->len + FCS_LEN <= frag_threshold))
                 return TX_DROP;
 
@@ -1025,100 +1035,6 @@ ieee80211_tx_h_calculate_duration(struct ieee80211_tx_data *tx)
 
 /* actual transmit path */
 
-/*
- * deal with packet injection down monitor interface
- * with Radiotap Header -- only called for monitor mode interface
- */
-static bool __ieee80211_parse_tx_radiotap(struct ieee80211_tx_data *tx,
-                                          struct sk_buff *skb)
-{
-        /*
-         * this is the moment to interpret and discard the radiotap header that
-         * must be at the start of the packet injected in Monitor mode
-         *
-         * Need to take some care with endian-ness since radiotap
-         * args are little-endian
-         */
-
-        struct ieee80211_radiotap_iterator iterator;
-        struct ieee80211_radiotap_header *rthdr =
-                (struct ieee80211_radiotap_header *) skb->data;
-        bool hw_frag;
-        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-        int ret = ieee80211_radiotap_iterator_init(&iterator, rthdr, skb->len,
-                                                   NULL);
-
-        info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
-        tx->flags &= ~IEEE80211_TX_FRAGMENTED;
-
-        /* packet is fragmented in HW if we have a non-NULL driver callback */
-        hw_frag = (tx->local->ops->set_frag_threshold != NULL);
-
-        /*
-         * for every radiotap entry that is present
-         * (ieee80211_radiotap_iterator_next returns -ENOENT when no more
-         * entries present, or -EINVAL on error)
-         */
-
-        while (!ret) {
-                ret = ieee80211_radiotap_iterator_next(&iterator);
-
-                if (ret)
-                        continue;
-
-                /* see if this argument is something we can use */
-                switch (iterator.this_arg_index) {
-                /*
-                 * You must take care when dereferencing iterator.this_arg
-                 * for multibyte types... the pointer is not aligned.  Use
-                 * get_unaligned((type *)iterator.this_arg) to dereference
-                 * iterator.this_arg for type "type" safely on all arches.
-                */
-                case IEEE80211_RADIOTAP_FLAGS:
-                        if (*iterator.this_arg & IEEE80211_RADIOTAP_F_FCS) {
-                                /*
-                                 * this indicates that the skb we have been
-                                 * handed has the 32-bit FCS CRC at the end...
-                                 * we should react to that by snipping it off
-                                 * because it will be recomputed and added
-                                 * on transmission
-                                 */
-                                if (skb->len < (iterator._max_length + FCS_LEN))
-                                        return false;
-
-                                skb_trim(skb, skb->len - FCS_LEN);
-                        }
-                        if (*iterator.this_arg & IEEE80211_RADIOTAP_F_WEP)
-                                info->flags &= ~IEEE80211_TX_INTFL_DONT_ENCRYPT;
-                        if ((*iterator.this_arg & IEEE80211_RADIOTAP_F_FRAG) &&
-                                                                !hw_frag)
-                                tx->flags |= IEEE80211_TX_FRAGMENTED;
-                        break;
-
-                /*
-                 * Please update the file
-                 * Documentation/networking/mac80211-injection.txt
-                 * when parsing new fields here.
-                 */
-
-                default:
-                        break;
-                }
-        }
-
-        if (ret != -ENOENT) /* ie, if we didn't simply run out of fields */
-                return false;
-
-        /*
-         * remove the radiotap header
-         * iterator->_max_length was sanity-checked against
-         * skb->len by iterator init
-         */
-        skb_pull(skb, iterator._max_length);
-
-        return true;
-}
-
 static bool ieee80211_tx_prep_agg(struct ieee80211_tx_data *tx,
                                   struct sk_buff *skb,
                                   struct ieee80211_tx_info *info,
@@ -1183,7 +1099,7 @@ ieee80211_tx_prepare(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_hdr *hdr;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-        int hdrlen, tid;
+        int tid;
         u8 *qc;
 
         memset(tx, 0, sizeof(*tx));
@@ -1191,26 +1107,6 @@ ieee80211_tx_prepare(struct ieee80211_sub_if_data *sdata,
         tx->local = local;
         tx->sdata = sdata;
         tx->channel = local->hw.conf.channel;
-        /*
-         * Set this flag (used below to indicate "automatic fragmentation"),
-         * it will be cleared/left by radiotap as desired.
-         * Only valid when fragmentation is done by the stack.
-         */
-        if (!local->ops->set_frag_threshold)
-                tx->flags |= IEEE80211_TX_FRAGMENTED;
-
-        /* process and remove the injection radiotap header */
-        if (unlikely(info->flags & IEEE80211_TX_INTFL_HAS_RADIOTAP)) {
-                if (!__ieee80211_parse_tx_radiotap(tx, skb))
-                        return TX_DROP;
-
-                /*
-                 * __ieee80211_parse_tx_radiotap has now removed
-                 * the radiotap header that was present and pre-filled
-                 * 'tx' with tx control information.
-                 */
-                info->flags &= ~IEEE80211_TX_INTFL_HAS_RADIOTAP;
-        }
 
         /*
          * If this flag is set to true anywhere, and we get here,
@@ -1232,7 +1128,9 @@ ieee80211_tx_prepare(struct ieee80211_sub_if_data *sdata,
                 tx->sta = sta_info_get(sdata, hdr->addr1);
 
         if (tx->sta && ieee80211_is_data_qos(hdr->frame_control) &&
-            (local->hw.flags & IEEE80211_HW_AMPDU_AGGREGATION)) {
+            !ieee80211_is_qos_nullfunc(hdr->frame_control) &&
+            (local->hw.flags & IEEE80211_HW_AMPDU_AGGREGATION) &&
+            !(local->hw.flags & IEEE80211_HW_TX_AMPDU_SETUP_IN_HW)) {
                 struct tid_ampdu_tx *tid_tx;
 
                 qc = ieee80211_get_qos_ctl(hdr);
@@ -1257,29 +1155,25 @@ ieee80211_tx_prepare(struct ieee80211_sub_if_data *sdata,
                 tx->flags |= IEEE80211_TX_UNICAST;
                 if (unlikely(local->wifi_wme_noack_test))
                         info->flags |= IEEE80211_TX_CTL_NO_ACK;
-                else
-                        info->flags &= ~IEEE80211_TX_CTL_NO_ACK;
+                /*
+                 * Flags are initialized to 0. Hence, no need to
+                 * explicitly unset IEEE80211_TX_CTL_NO_ACK since
+                 * it might already be set for injected frames.
+                 */
         }
 
-        if (tx->flags & IEEE80211_TX_FRAGMENTED) {
-                if ((tx->flags & IEEE80211_TX_UNICAST) &&
-                    skb->len + FCS_LEN > local->hw.wiphy->frag_threshold &&
-                    !(info->flags & IEEE80211_TX_CTL_AMPDU))
-                        tx->flags |= IEEE80211_TX_FRAGMENTED;
-                else
-                        tx->flags &= ~IEEE80211_TX_FRAGMENTED;
+        if (!(info->flags & IEEE80211_TX_CTL_DONTFRAG)) {
+                if (!(tx->flags & IEEE80211_TX_UNICAST) ||
+                    skb->len + FCS_LEN <= local->hw.wiphy->frag_threshold ||
+                    info->flags & IEEE80211_TX_CTL_AMPDU)
+                        info->flags |= IEEE80211_TX_CTL_DONTFRAG;
         }
 
         if (!tx->sta)
                 info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT;
-        else if (test_and_clear_sta_flags(tx->sta, WLAN_STA_CLEAR_PS_FILT))
+        else if (test_and_clear_sta_flag(tx->sta, WLAN_STA_CLEAR_PS_FILT))
                 info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT;
 
-        hdrlen = ieee80211_hdrlen(hdr->frame_control);
-        if (skb->len > hdrlen + sizeof(rfc1042_header) + 2) {
-                u8 *pos = &skb->data[hdrlen + sizeof(rfc1042_header)];
-                tx->ethertype = (pos[0] << 8) | pos[1];
-        }
         info->flags |= IEEE80211_TX_CTL_FIRST_FRAGMENT;
 
         return TX_CONTINUE;
@@ -1490,11 +1384,6 @@ static int ieee80211_skb_resize(struct ieee80211_sub_if_data *sdata,
                 tail_need = max_t(int, tail_need, 0);
         }
 
-        if (head_need || tail_need) {
-                /* Sorry. Can't account for this any more */
-                skb_orphan(skb);
-        }
-
         if (skb_cloned(skb))
                 I802_DEBUG_INC(local->tx_expand_skb_head_cloned);
         else if (head_need || tail_need)
@@ -1508,67 +1397,19 @@ static int ieee80211_skb_resize(struct ieee80211_sub_if_data *sdata,
                 return -ENOMEM;
         }
 
-        /* update truesize too */
-        skb->truesize += head_need + tail_need;
-
         return 0;
 }
 
-static void ieee80211_xmit(struct ieee80211_sub_if_data *sdata,
-                           struct sk_buff *skb)
+void ieee80211_xmit(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb)
 {
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
-        struct ieee80211_sub_if_data *tmp_sdata;
         int headroom;
         bool may_encrypt;
 
         rcu_read_lock();
 
-        if (unlikely(sdata->vif.type == NL80211_IFTYPE_MONITOR)) {
-                int hdrlen;
-                u16 len_rthdr;
-
-                info->flags |= IEEE80211_TX_CTL_INJECTED |
-                               IEEE80211_TX_INTFL_HAS_RADIOTAP;
-
-                len_rthdr = ieee80211_get_radiotap_len(skb->data);
-                hdr = (struct ieee80211_hdr *)(skb->data + len_rthdr);
-                hdrlen = ieee80211_hdrlen(hdr->frame_control);
-
-                /* check the header is complete in the frame */
-                if (likely(skb->len >= len_rthdr + hdrlen)) {
-                        /*
-                         * We process outgoing injected frames that have a
-                         * local address we handle as though they are our
-                         * own frames.
-                         * This code here isn't entirely correct, the local
-                         * MAC address is not necessarily enough to find
-                         * the interface to use; for that proper VLAN/WDS
-                         * support we will need a different mechanism.
-                         */
-
-                        list_for_each_entry_rcu(tmp_sdata, &local->interfaces,
-                                                list) {
-                                if (!ieee80211_sdata_running(tmp_sdata))
-                                        continue;
-                                if (tmp_sdata->vif.type ==
-                                    NL80211_IFTYPE_MONITOR ||
-                                    tmp_sdata->vif.type ==
-                                    NL80211_IFTYPE_AP_VLAN ||
-                                        tmp_sdata->vif.type ==
-                                    NL80211_IFTYPE_WDS)
-                                        continue;
-                                if (compare_ether_addr(tmp_sdata->vif.addr,
-                                                       hdr->addr2) == 0) {
-                                        sdata = tmp_sdata;
-                                        break;
-                                }
-                        }
-                }
-        }
-
         may_encrypt = !(info->flags & IEEE80211_TX_INTFL_DONT_ENCRYPT);
 
         headroom = local->tx_headroom;
@@ -1595,11 +1436,94 @@ static void ieee80211_xmit(struct ieee80211_sub_if_data *sdata,
                                 return;
                         }
 
-        ieee80211_set_qos_hdr(local, skb);
+        ieee80211_set_qos_hdr(sdata, skb);
         ieee80211_tx(sdata, skb, false);
         rcu_read_unlock();
 }
 
+static bool ieee80211_parse_tx_radiotap(struct sk_buff *skb)
+{
+        struct ieee80211_radiotap_iterator iterator;
+        struct ieee80211_radiotap_header *rthdr =
+                (struct ieee80211_radiotap_header *) skb->data;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+        int ret = ieee80211_radiotap_iterator_init(&iterator, rthdr, skb->len,
+                                                   NULL);
+        u16 txflags;
+
+        info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT |
+                       IEEE80211_TX_CTL_DONTFRAG;
+
+        /*
+         * for every radiotap entry that is present
+         * (ieee80211_radiotap_iterator_next returns -ENOENT when no more
+         * entries present, or -EINVAL on error)
+         */
+
+        while (!ret) {
+                ret = ieee80211_radiotap_iterator_next(&iterator);
+
+                if (ret)
+                        continue;
+
+                /* see if this argument is something we can use */
+                switch (iterator.this_arg_index) {
+                /*
+                 * You must take care when dereferencing iterator.this_arg
+                 * for multibyte types... the pointer is not aligned.  Use
+                 * get_unaligned((type *)iterator.this_arg) to dereference
+                 * iterator.this_arg for type "type" safely on all arches.
+                */
+                case IEEE80211_RADIOTAP_FLAGS:
+                        if (*iterator.this_arg & IEEE80211_RADIOTAP_F_FCS) {
+                                /*
+                                 * this indicates that the skb we have been
+                                 * handed has the 32-bit FCS CRC at the end...
+                                 * we should react to that by snipping it off
+                                 * because it will be recomputed and added
+                                 * on transmission
+                                 */
+                                if (skb->len < (iterator._max_length + FCS_LEN))
+                                        return false;
+
+                                skb_trim(skb, skb->len - FCS_LEN);
+                        }
+                        if (*iterator.this_arg & IEEE80211_RADIOTAP_F_WEP)
+                                info->flags &= ~IEEE80211_TX_INTFL_DONT_ENCRYPT;
+                        if (*iterator.this_arg & IEEE80211_RADIOTAP_F_FRAG)
+                                info->flags &= ~IEEE80211_TX_CTL_DONTFRAG;
+                        break;
+
+                case IEEE80211_RADIOTAP_TX_FLAGS:
+                        txflags = get_unaligned_le16(iterator.this_arg);
+                        if (txflags & IEEE80211_RADIOTAP_F_TX_NOACK)
+                                info->flags |= IEEE80211_TX_CTL_NO_ACK;
+                        break;
+
+                /*
+                 * Please update the file
+                 * Documentation/networking/mac80211-injection.txt
+                 * when parsing new fields here.
+                 */
+
+                default:
+                        break;
+                }
+        }
+
+        if (ret != -ENOENT) /* ie, if we didn't simply run out of fields */
+                return false;
+
+        /*
+         * remove the radiotap header
+         * iterator->_max_length was sanity-checked against
+         * skb->len by iterator init
+         */
+        skb_pull(skb, iterator._max_length);
+
+        return true;
+}
+
 netdev_tx_t ieee80211_monitor_start_xmit(struct sk_buff *skb,
                                          struct net_device *dev)
 {
@@ -1608,7 +1532,10 @@ netdev_tx_t ieee80211_monitor_start_xmit(struct sk_buff *skb,
         struct ieee80211_radiotap_header *prthdr =
                 (struct ieee80211_radiotap_header *)skb->data;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+        struct ieee80211_hdr *hdr;
+        struct ieee80211_sub_if_data *tmp_sdata, *sdata;
         u16 len_rthdr;
+        int hdrlen;
 
         /*
          * Frame injection is not allowed if beaconing is not allowed
@@ -1659,12 +1586,65 @@ netdev_tx_t ieee80211_monitor_start_xmit(struct sk_buff *skb,
         skb_set_network_header(skb, len_rthdr);
         skb_set_transport_header(skb, len_rthdr);
 
+        if (skb->len < len_rthdr + 2)
+                goto fail;
+
+        hdr = (struct ieee80211_hdr *)(skb->data + len_rthdr);
+        hdrlen = ieee80211_hdrlen(hdr->frame_control);
+
+        if (skb->len < len_rthdr + hdrlen)
+                goto fail;
+
+        /*
+         * Initialize skb->protocol if the injected frame is a data frame
+         * carrying a rfc1042 header
+         */
+        if (ieee80211_is_data(hdr->frame_control) &&
+            skb->len >= len_rthdr + hdrlen + sizeof(rfc1042_header) + 2) {
+                u8 *payload = (u8 *)hdr + hdrlen;
+
+                if (compare_ether_addr(payload, rfc1042_header) == 0)
+                        skb->protocol = cpu_to_be16((payload[6] << 8) |
+                                                    payload[7]);
+        }
+
         memset(info, 0, sizeof(*info));
 
-        info->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
+        info->flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
+                      IEEE80211_TX_CTL_INJECTED;
+
+        /* process and remove the injection radiotap header */
+        if (!ieee80211_parse_tx_radiotap(skb))
+                goto fail;
+
+        rcu_read_lock();
+
+        /*
+         * We process outgoing injected frames that have a local address
+         * we handle as though they are non-injected frames.
+         * This code here isn't entirely correct, the local MAC address
+         * isn't always enough to find the interface to use; for proper
+         * VLAN/WDS support we will need a different mechanism (which
+         * likely isn't going to be monitor interfaces).
+         */
+        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+
+        list_for_each_entry_rcu(tmp_sdata, &local->interfaces, list) {
+                if (!ieee80211_sdata_running(tmp_sdata))
+                        continue;
+                if (tmp_sdata->vif.type == NL80211_IFTYPE_MONITOR ||
+                    tmp_sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
+                    tmp_sdata->vif.type == NL80211_IFTYPE_WDS)
+                        continue;
+                if (compare_ether_addr(tmp_sdata->vif.addr, hdr->addr2) == 0) {
+                        sdata = tmp_sdata;
+                        break;
+                }
+        }
+
+        ieee80211_xmit(sdata, skb);
+        rcu_read_unlock();
 
-        /* pass the radiotap header up to xmit */
-        ieee80211_xmit(IEEE80211_DEV_TO_SUB_IF(dev), skb);
         return NETDEV_TX_OK;
 
 fail:
@@ -1703,8 +1683,9 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
         int encaps_len, skip_header_bytes;
         int nh_pos, h_pos;
         struct sta_info *sta = NULL;
-        u32 sta_flags = 0;
+        bool wme_sta = false, authorized = false, tdls_auth = false;
         struct sk_buff *tmp_skb;
+        bool tdls_direct = false;
 
         if (unlikely(skb->len < ETH_HLEN)) {
                 ret = NETDEV_TX_OK;
@@ -1728,7 +1709,8 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
                         memcpy(hdr.addr3, skb->data, ETH_ALEN);
                         memcpy(hdr.addr4, skb->data + ETH_ALEN, ETH_ALEN);
                         hdrlen = 30;
-                        sta_flags = get_sta_flags(sta);
+                        authorized = test_sta_flag(sta, WLAN_STA_AUTHORIZED);
+                        wme_sta = test_sta_flag(sta, WLAN_STA_WME);
                 }
                 rcu_read_unlock();
                 if (sta)
@@ -1816,11 +1798,50 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
                 break;
 #endif
         case NL80211_IFTYPE_STATION:
-                memcpy(hdr.addr1, sdata->u.mgd.bssid, ETH_ALEN);
-                if (sdata->u.mgd.use_4addr &&
-                    cpu_to_be16(ethertype) != sdata->control_port_protocol) {
-                        fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
+                if (sdata->wdev.wiphy->flags & WIPHY_FLAG_SUPPORTS_TDLS) {
+                        bool tdls_peer = false;
+
+                        rcu_read_lock();
+                        sta = sta_info_get(sdata, skb->data);
+                        if (sta) {
+                                authorized = test_sta_flag(sta,
+                                                        WLAN_STA_AUTHORIZED);
+                                wme_sta = test_sta_flag(sta, WLAN_STA_WME);
+                                tdls_peer = test_sta_flag(sta,
+                                                         WLAN_STA_TDLS_PEER);
+                                tdls_auth = test_sta_flag(sta,
+                                                WLAN_STA_TDLS_PEER_AUTH);
+                        }
+                        rcu_read_unlock();
+
+                        /*
+                         * If the TDLS link is enabled, send everything
+                         * directly. Otherwise, allow TDLS setup frames
+                         * to be transmitted indirectly.
+                         */
+                        tdls_direct = tdls_peer && (tdls_auth ||
+                                 !(ethertype == ETH_P_TDLS && skb->len > 14 &&
+                                   skb->data[14] == WLAN_TDLS_SNAP_RFTYPE));
+                }
+
+                if (tdls_direct) {
+                        /* link during setup - throw out frames to peer */
+                        if (!tdls_auth) {
+                                ret = NETDEV_TX_OK;
+                                goto fail;
+                        }
+
+                        /* DA SA BSSID */
+                        memcpy(hdr.addr1, skb->data, ETH_ALEN);
+                        memcpy(hdr.addr2, skb->data + ETH_ALEN, ETH_ALEN);
+                        memcpy(hdr.addr3, sdata->u.mgd.bssid, ETH_ALEN);
+                        hdrlen = 24;
+                }  else if (sdata->u.mgd.use_4addr &&
+                            cpu_to_be16(ethertype) != sdata->control_port_protocol) {
+                        fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS |
+                                          IEEE80211_FCTL_TODS);
                         /* RA TA DA SA */
+                        memcpy(hdr.addr1, sdata->u.mgd.bssid, ETH_ALEN);
                         memcpy(hdr.addr2, sdata->vif.addr, ETH_ALEN);
                         memcpy(hdr.addr3, skb->data, ETH_ALEN);
                         memcpy(hdr.addr4, skb->data + ETH_ALEN, ETH_ALEN);
@@ -1828,6 +1849,7 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
                 } else {
                         fc |= cpu_to_le16(IEEE80211_FCTL_TODS);
                         /* BSSID SA DA */
+                        memcpy(hdr.addr1, sdata->u.mgd.bssid, ETH_ALEN);
                         memcpy(hdr.addr2, skb->data + ETH_ALEN, ETH_ALEN);
                         memcpy(hdr.addr3, skb->data, ETH_ALEN);
                         hdrlen = 24;
@@ -1853,13 +1875,19 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
         if (!is_multicast_ether_addr(hdr.addr1)) {
                 rcu_read_lock();
                 sta = sta_info_get(sdata, hdr.addr1);
-                if (sta)
-                        sta_flags = get_sta_flags(sta);
+                if (sta) {
+                        authorized = test_sta_flag(sta, WLAN_STA_AUTHORIZED);
+                        wme_sta = test_sta_flag(sta, WLAN_STA_WME);
+                }
                 rcu_read_unlock();
         }
 
+        /* For mesh, the use of the QoS header is mandatory */
+        if (ieee80211_vif_is_mesh(&sdata->vif))
+                wme_sta = true;
+
         /* receiver and we are QoS enabled, use a QoS type frame */
-        if ((sta_flags & WLAN_STA_WME) && local->hw.queues >= 4) {
+        if (wme_sta && local->hw.queues >= 4) {
                 fc |= cpu_to_le16(IEEE80211_STYPE_QOS_DATA);
                 hdrlen += 2;
         }
@@ -1868,12 +1896,10 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
          * Drop unicast frames to unauthorised stations unless they are
          * EAPOL frames from the local station.
          */
-        if (!ieee80211_vif_is_mesh(&sdata->vif) &&
-                unlikely(!is_multicast_ether_addr(hdr.addr1) &&
-                      !(sta_flags & WLAN_STA_AUTHORIZED) &&
-                      !(cpu_to_be16(ethertype) == sdata->control_port_protocol &&
-                       compare_ether_addr(sdata->vif.addr,
-                                          skb->data + ETH_ALEN) == 0))) {
+        if (unlikely(!ieee80211_vif_is_mesh(&sdata->vif) &&
+                     !is_multicast_ether_addr(hdr.addr1) && !authorized &&
+                     (cpu_to_be16(ethertype) != sdata->control_port_protocol ||
+                      compare_ether_addr(sdata->vif.addr, skb->data + ETH_ALEN)))) {
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
                 if (net_ratelimit())
                         printk(KERN_DEBUG "%s: dropped frame to %pM"
@@ -2275,13 +2301,23 @@ struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
                 memcpy(mgmt->bssid, sdata->vif.addr, ETH_ALEN);
                 mgmt->u.beacon.beacon_int =
                         cpu_to_le16(sdata->vif.bss_conf.beacon_int);
-                mgmt->u.beacon.capab_info = 0x0; /* 0x0 for MPs */
+                mgmt->u.beacon.capab_info |= cpu_to_le16(
+                        sdata->u.mesh.security ? WLAN_CAPABILITY_PRIVACY : 0);
 
                 pos = skb_put(skb, 2);
                 *pos++ = WLAN_EID_SSID;
                 *pos++ = 0x0;
 
-                mesh_mgmt_ies_add(skb, sdata);
+                if (ieee80211_add_srates_ie(&sdata->vif, skb) ||
+                    mesh_add_ds_params_ie(skb, sdata) ||
+                    ieee80211_add_ext_srates_ie(&sdata->vif, skb) ||
+                    mesh_add_rsn_ie(skb, sdata) ||
+                    mesh_add_meshid_ie(skb, sdata) ||
+                    mesh_add_meshconf_ie(skb, sdata) ||
+                    mesh_add_vendor_ies(skb, sdata)) {
+                        pr_err("o11s: couldn't add ies!\n");
+                        goto out;
+                }
         } else {
                 WARN_ON(1);
                 goto out;
@@ -2335,11 +2371,9 @@ struct sk_buff *ieee80211_pspoll_get(struct ieee80211_hw *hw,
         local = sdata->local;
 
         skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*pspoll));
-        if (!skb) {
-                printk(KERN_DEBUG "%s: failed to allocate buffer for "
-                       "pspoll template\n", sdata->name);
+        if (!skb)
                 return NULL;
-        }
+
         skb_reserve(skb, local->hw.extra_tx_headroom);
 
         pspoll = (struct ieee80211_pspoll *) skb_put(skb, sizeof(*pspoll));
@@ -2375,11 +2409,9 @@ struct sk_buff *ieee80211_nullfunc_get(struct ieee80211_hw *hw,
         local = sdata->local;
 
         skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*nullfunc));
-        if (!skb) {
-                printk(KERN_DEBUG "%s: failed to allocate buffer for nullfunc "
-                       "template\n", sdata->name);
+        if (!skb)
                 return NULL;
-        }
+
         skb_reserve(skb, local->hw.extra_tx_headroom);
 
         nullfunc = (struct ieee80211_hdr_3addr *) skb_put(skb,
@@ -2414,11 +2446,8 @@ struct sk_buff *ieee80211_probereq_get(struct ieee80211_hw *hw,
 
         skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*hdr) +
                             ie_ssid_len + ie_len);
-        if (!skb) {
-                printk(KERN_DEBUG "%s: failed to allocate buffer for probe "
-                       "request template\n", sdata->name);
+        if (!skb)
                 return NULL;
-        }
 
         skb_reserve(skb, local->hw.extra_tx_headroom);
 
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index ddeb1b998383..7439d26bf5f9 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -19,7 +19,6 @@
 #include <linux/etherdevice.h>
 #include <linux/if_arp.h>
 #include <linux/bitmap.h>
-#include <linux/crc32.h>
 #include <net/net_namespace.h>
 #include <net/cfg80211.h>
 #include <net/rtnetlink.h>
@@ -368,14 +367,14 @@ void ieee80211_add_pending_skb(struct ieee80211_local *local,
         spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
 }
 
-int ieee80211_add_pending_skbs_fn(struct ieee80211_local *local,
-                                  struct sk_buff_head *skbs,
-                                  void (*fn)(void *data), void *data)
+void ieee80211_add_pending_skbs_fn(struct ieee80211_local *local,
+                                   struct sk_buff_head *skbs,
+                                   void (*fn)(void *data), void *data)
 {
         struct ieee80211_hw *hw = &local->hw;
         struct sk_buff *skb;
         unsigned long flags;
-        int queue, ret = 0, i;
+        int queue, i;
 
         spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
         for (i = 0; i < hw->queues; i++)
@@ -390,7 +389,6 @@ int ieee80211_add_pending_skbs_fn(struct ieee80211_local *local,
                         continue;
                 }
 
-                ret++;
                 queue = skb_get_queue_mapping(skb);
                 __skb_queue_tail(&local->pending[queue], skb);
         }
@@ -402,14 +400,12 @@ int ieee80211_add_pending_skbs_fn(struct ieee80211_local *local,
                 __ieee80211_wake_queue(hw, i,
                         IEEE80211_QUEUE_STOP_REASON_SKB_ADD);
         spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
-
-        return ret;
 }
 
-int ieee80211_add_pending_skbs(struct ieee80211_local *local,
-                               struct sk_buff_head *skbs)
+void ieee80211_add_pending_skbs(struct ieee80211_local *local,
+                                struct sk_buff_head *skbs)
 {
-        return ieee80211_add_pending_skbs_fn(local, skbs, NULL, NULL);
+        ieee80211_add_pending_skbs_fn(local, skbs, NULL, NULL);
 }
 
 void ieee80211_stop_queues_by_reason(struct ieee80211_hw *hw,
@@ -573,172 +569,6 @@ void ieee802_11_parse_elems(u8 *start, size_t len,
         ieee802_11_parse_elems_crc(start, len, elems, 0, 0);
 }
 
-u32 ieee802_11_parse_elems_crc(u8 *start, size_t len,
-                               struct ieee802_11_elems *elems,
-                               u64 filter, u32 crc)
-{
-        size_t left = len;
-        u8 *pos = start;
-        bool calc_crc = filter != 0;
-
-        memset(elems, 0, sizeof(*elems));
-        elems->ie_start = start;
-        elems->total_len = len;
-
-        while (left >= 2) {
-                u8 id, elen;
-
-                id = *pos++;
-                elen = *pos++;
-                left -= 2;
-
-                if (elen > left)
-                        break;
-
-                if (calc_crc && id < 64 && (filter & (1ULL << id)))
-                        crc = crc32_be(crc, pos - 2, elen + 2);
-
-                switch (id) {
-                case WLAN_EID_SSID:
-                        elems->ssid = pos;
-                        elems->ssid_len = elen;
-                        break;
-                case WLAN_EID_SUPP_RATES:
-                        elems->supp_rates = pos;
-                        elems->supp_rates_len = elen;
-                        break;
-                case WLAN_EID_FH_PARAMS:
-                        elems->fh_params = pos;
-                        elems->fh_params_len = elen;
-                        break;
-                case WLAN_EID_DS_PARAMS:
-                        elems->ds_params = pos;
-                        elems->ds_params_len = elen;
-                        break;
-                case WLAN_EID_CF_PARAMS:
-                        elems->cf_params = pos;
-                        elems->cf_params_len = elen;
-                        break;
-                case WLAN_EID_TIM:
-                        if (elen >= sizeof(struct ieee80211_tim_ie)) {
-                                elems->tim = (void *)pos;
-                                elems->tim_len = elen;
-                        }
-                        break;
-                case WLAN_EID_IBSS_PARAMS:
-                        elems->ibss_params = pos;
-                        elems->ibss_params_len = elen;
-                        break;
-                case WLAN_EID_CHALLENGE:
-                        elems->challenge = pos;
-                        elems->challenge_len = elen;
-                        break;
-                case WLAN_EID_VENDOR_SPECIFIC:
-                        if (elen >= 4 && pos[0] == 0x00 && pos[1] == 0x50 &&
-                            pos[2] == 0xf2) {
-                                /* Microsoft OUI (00:50:F2) */
-
-                                if (calc_crc)
-                                        crc = crc32_be(crc, pos - 2, elen + 2);
-
-                                if (pos[3] == 1) {
-                                        /* OUI Type 1 - WPA IE */
-                                        elems->wpa = pos;
-                                        elems->wpa_len = elen;
-                                } else if (elen >= 5 && pos[3] == 2) {
-                                        /* OUI Type 2 - WMM IE */
-                                        if (pos[4] == 0) {
-                                                elems->wmm_info = pos;
-                                                elems->wmm_info_len = elen;
-                                        } else if (pos[4] == 1) {
-                                                elems->wmm_param = pos;
-                                                elems->wmm_param_len = elen;
-                                        }
-                                }
-                        }
-                        break;
-                case WLAN_EID_RSN:
-                        elems->rsn = pos;
-                        elems->rsn_len = elen;
-                        break;
-                case WLAN_EID_ERP_INFO:
-                        elems->erp_info = pos;
-                        elems->erp_info_len = elen;
-                        break;
-                case WLAN_EID_EXT_SUPP_RATES:
-                        elems->ext_supp_rates = pos;
-                        elems->ext_supp_rates_len = elen;
-                        break;
-                case WLAN_EID_HT_CAPABILITY:
-                        if (elen >= sizeof(struct ieee80211_ht_cap))
-                                elems->ht_cap_elem = (void *)pos;
-                        break;
-                case WLAN_EID_HT_INFORMATION:
-                        if (elen >= sizeof(struct ieee80211_ht_info))
-                                elems->ht_info_elem = (void *)pos;
-                        break;
-                case WLAN_EID_MESH_ID:
-                        elems->mesh_id = pos;
-                        elems->mesh_id_len = elen;
-                        break;
-                case WLAN_EID_MESH_CONFIG:
-                        if (elen >= sizeof(struct ieee80211_meshconf_ie))
-                                elems->mesh_config = (void *)pos;
-                        break;
-                case WLAN_EID_PEER_LINK:
-                        elems->peer_link = pos;
-                        elems->peer_link_len = elen;
-                        break;
-                case WLAN_EID_PREQ:
-                        elems->preq = pos;
-                        elems->preq_len = elen;
-                        break;
-                case WLAN_EID_PREP:
-                        elems->prep = pos;
-                        elems->prep_len = elen;
-                        break;
-                case WLAN_EID_PERR:
-                        elems->perr = pos;
-                        elems->perr_len = elen;
-                        break;
-                case WLAN_EID_RANN:
-                        if (elen >= sizeof(struct ieee80211_rann_ie))
-                                elems->rann = (void *)pos;
-                        break;
-                case WLAN_EID_CHANNEL_SWITCH:
-                        elems->ch_switch_elem = pos;
-                        elems->ch_switch_elem_len = elen;
-                        break;
-                case WLAN_EID_QUIET:
-                        if (!elems->quiet_elem) {
-                                elems->quiet_elem = pos;
-                                elems->quiet_elem_len = elen;
-                        }
-                        elems->num_of_quiet_elem++;
-                        break;
-                case WLAN_EID_COUNTRY:
-                        elems->country_elem = pos;
-                        elems->country_elem_len = elen;
-                        break;
-                case WLAN_EID_PWR_CONSTRAINT:
-                        elems->pwr_constr_elem = pos;
-                        elems->pwr_constr_elem_len = elen;
-                        break;
-                case WLAN_EID_TIMEOUT_INTERVAL:
-                        elems->timeout_int = pos;
-                        elems->timeout_int_len = elen;
-                        break;
-                default:
-                        break;
-                }
-
-                left -= elen;
-                pos += elen;
-        }
-
-        return crc;
-}
-
 void ieee80211_set_wmm_default(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_local *local = sdata->local;
@@ -799,8 +629,8 @@ void ieee80211_set_wmm_default(struct ieee80211_sub_if_data *sdata)
 
                 qparam.uapsd = false;
 
-                local->tx_conf[queue] = qparam;
-                drv_conf_tx(local, queue, &qparam);
+                sdata->tx_conf[queue] = qparam;
+                drv_conf_tx(local, sdata, queue, &qparam);
         }
 
         /* after reinitialize QoS TX queues setting to default,
@@ -874,11 +704,9 @@ void ieee80211_send_auth(struct ieee80211_sub_if_data *sdata,
 
         skb = dev_alloc_skb(local->hw.extra_tx_headroom +
                             sizeof(*mgmt) + 6 + extra_len);
-        if (!skb) {
-                printk(KERN_DEBUG "%s: failed to allocate buffer for auth "
-                       "frame\n", sdata->name);
+        if (!skb)
                 return;
-        }
+
         skb_reserve(skb, local->hw.extra_tx_headroom);
 
         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24 + 6);
@@ -1031,11 +859,8 @@ struct sk_buff *ieee80211_build_probe_req(struct ieee80211_sub_if_data *sdata,
 
         /* FIXME: come up with a proper value */
         buf = kmalloc(200 + ie_len, GFP_KERNEL);
-        if (!buf) {
-                printk(KERN_DEBUG "%s: failed to allocate temporary IE "
-                       "buffer\n", sdata->name);
+        if (!buf)
                 return NULL;
-        }
 
         /*
          * Do not send DS Channel parameter for directed probe requests
@@ -1071,14 +896,18 @@ struct sk_buff *ieee80211_build_probe_req(struct ieee80211_sub_if_data *sdata,
 void ieee80211_send_probe_req(struct ieee80211_sub_if_data *sdata, u8 *dst,
                               const u8 *ssid, size_t ssid_len,
                               const u8 *ie, size_t ie_len,
-                              u32 ratemask, bool directed)
+                              u32 ratemask, bool directed, bool no_cck)
 {
         struct sk_buff *skb;
 
         skb = ieee80211_build_probe_req(sdata, dst, ratemask, ssid, ssid_len,
                                         ie, ie_len, directed);
-        if (skb)
+        if (skb) {
+                if (no_cck)
+                        IEEE80211_SKB_CB(skb)->flags |=
+                                IEEE80211_TX_CTL_NO_CCK_RATE;
                 ieee80211_tx_skb(sdata, skb);
+        }
 }
 
 u32 ieee80211_sta_get_rates(struct ieee80211_local *local,
@@ -1205,14 +1034,22 @@ int ieee80211_reconfig(struct ieee80211_local *local)
                                              struct ieee80211_sub_if_data,
                                              u.ap);
 
+                        memset(&sta->sta.drv_priv, 0, hw->sta_data_size);
                         WARN_ON(drv_sta_add(local, sdata, &sta->sta));
                 }
         }
         mutex_unlock(&local->sta_mtx);
 
         /* reconfigure tx conf */
-        for (i = 0; i < hw->queues; i++)
-                drv_conf_tx(local, i, &local->tx_conf[i]);
+        list_for_each_entry(sdata, &local->interfaces, list) {
+                if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
+                    sdata->vif.type == NL80211_IFTYPE_MONITOR ||
+                    !ieee80211_sdata_running(sdata))
+                        continue;
+
+                for (i = 0; i < hw->queues; i++)
+                        drv_conf_tx(local, sdata, i, &sdata->tx_conf[i]);
+        }
 
         /* reconfigure hardware */
         ieee80211_hw_config(local, ~0);
@@ -1248,6 +1085,8 @@ int ieee80211_reconfig(struct ieee80211_local *local)
                         changed |= BSS_CHANGED_IBSS;
                         /* fall through */
                 case NL80211_IFTYPE_AP:
+                        changed |= BSS_CHANGED_SSID;
+                        /* fall through */
                 case NL80211_IFTYPE_MESH_POINT:
                         changed |= BSS_CHANGED_BEACON |
                                    BSS_CHANGED_BEACON_ENABLED;
@@ -1283,7 +1122,7 @@ int ieee80211_reconfig(struct ieee80211_local *local)
 
                 list_for_each_entry(sta, &local->sta_list, list) {
                         ieee80211_sta_tear_down_BA_sessions(sta, true);
-                        clear_sta_flags(sta, WLAN_STA_BLOCK_BA);
+                        clear_sta_flag(sta, WLAN_STA_BLOCK_BA);
                 }
 
                 mutex_unlock(&local->sta_mtx);
@@ -1522,3 +1361,60 @@ void ieee80211_disable_rssi_reports(struct ieee80211_vif *vif)
         _ieee80211_enable_rssi_reports(sdata, 0, 0);
 }
 EXPORT_SYMBOL(ieee80211_disable_rssi_reports);
+
+int ieee80211_add_srates_ie(struct ieee80211_vif *vif, struct sk_buff *skb)
+{
+        struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_supported_band *sband;
+        int rate;
+        u8 i, rates, *pos;
+
+        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
+        rates = sband->n_bitrates;
+        if (rates > 8)
+                rates = 8;
+
+        if (skb_tailroom(skb) < rates + 2)
+                return -ENOMEM;
+
+        pos = skb_put(skb, rates + 2);
+        *pos++ = WLAN_EID_SUPP_RATES;
+        *pos++ = rates;
+        for (i = 0; i < rates; i++) {
+                rate = sband->bitrates[i].bitrate;
+                *pos++ = (u8) (rate / 5);
+        }
+
+        return 0;
+}
+
+int ieee80211_add_ext_srates_ie(struct ieee80211_vif *vif, struct sk_buff *skb)
+{
+        struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_supported_band *sband;
+        int rate;
+        u8 i, exrates, *pos;
+
+        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
+        exrates = sband->n_bitrates;
+        if (exrates > 8)
+                exrates -= 8;
+        else
+                exrates = 0;
+
+        if (skb_tailroom(skb) < exrates + 2)
+                return -ENOMEM;
+
+        if (exrates) {
+                pos = skb_put(skb, exrates + 2);
+                *pos++ = WLAN_EID_EXT_SUPP_RATES;
+                *pos++ = exrates;
+                for (i = 8; i < sband->n_bitrates; i++) {
+                        rate = sband->bitrates[i].bitrate;
+                        *pos++ = (u8) (rate / 5);
+                }
+        }
+        return 0;
+}
diff --git a/net/mac80211/wme.c b/net/mac80211/wme.c
index 7a49532f14cb..fd52e695c071 100644
--- a/net/mac80211/wme.c
+++ b/net/mac80211/wme.c
@@ -72,7 +72,7 @@ u16 ieee80211_select_queue(struct ieee80211_sub_if_data *sdata,
         case NL80211_IFTYPE_AP_VLAN:
                 sta = rcu_dereference(sdata->u.vlan.sta);
                 if (sta) {
-                        qos = get_sta_flags(sta) & WLAN_STA_WME;
+                        qos = test_sta_flag(sta, WLAN_STA_WME);
                         break;
                 }
         case NL80211_IFTYPE_AP:
@@ -83,11 +83,7 @@ u16 ieee80211_select_queue(struct ieee80211_sub_if_data *sdata,
                 break;
 #ifdef CONFIG_MAC80211_MESH
         case NL80211_IFTYPE_MESH_POINT:
-                /*
-                 * XXX: This is clearly broken ... but already was before,
-                 * because ieee80211_fill_mesh_addresses() would clear A1
-                 * except for multicast addresses.
-                 */
+                ra = skb->data;
                 break;
 #endif
         case NL80211_IFTYPE_STATION:
@@ -103,7 +99,7 @@ u16 ieee80211_select_queue(struct ieee80211_sub_if_data *sdata,
         if (!sta && ra && !is_multicast_ether_addr(ra)) {
                 sta = sta_info_get(sdata, ra);
                 if (sta)
-                        qos = get_sta_flags(sta) & WLAN_STA_WME;
+                        qos = test_sta_flag(sta, WLAN_STA_WME);
         }
         rcu_read_unlock();
 
@@ -139,7 +135,8 @@ u16 ieee80211_downgrade_queue(struct ieee80211_local *local,
         return ieee802_1d_to_ac[skb->priority];
 }
 
-void ieee80211_set_qos_hdr(struct ieee80211_local *local, struct sk_buff *skb)
+void ieee80211_set_qos_hdr(struct ieee80211_sub_if_data *sdata,
+                           struct sk_buff *skb)
 {
         struct ieee80211_hdr *hdr = (void *)skb->data;
 
@@ -150,10 +147,11 @@ void ieee80211_set_qos_hdr(struct ieee80211_local *local, struct sk_buff *skb)
 
                 tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
 
-                if (unlikely(local->wifi_wme_noack_test))
+                if (unlikely(sdata->local->wifi_wme_noack_test))
                         ack_policy |= IEEE80211_QOS_CTL_ACK_POLICY_NOACK;
-                /* qos header is 2 bytes, second reserved */
+                /* qos header is 2 bytes */
                 *p++ = ack_policy | tid;
-                *p = 0;
+                *p = ieee80211_vif_is_mesh(&sdata->vif) ?
+                        (IEEE80211_QOS_CTL_MESH_CONTROL_PRESENT >> 8) : 0;
         }
 }
diff --git a/net/mac80211/wme.h b/net/mac80211/wme.h
index faead6d02026..34e166fbf4d4 100644
--- a/net/mac80211/wme.h
+++ b/net/mac80211/wme.h
@@ -17,7 +17,8 @@ extern const int ieee802_1d_to_ac[8];
 
 u16 ieee80211_select_queue(struct ieee80211_sub_if_data *sdata,
                            struct sk_buff *skb);
-void ieee80211_set_qos_hdr(struct ieee80211_local *local, struct sk_buff *skb);
+void ieee80211_set_qos_hdr(struct ieee80211_sub_if_data *sdata,
+                           struct sk_buff *skb);
 u16 ieee80211_downgrade_queue(struct ieee80211_local *local,
                               struct sk_buff *skb);
 
diff --git a/net/mac80211/work.c b/net/mac80211/work.c
index 380b9a7462b6..94472eb34d76 100644
--- a/net/mac80211/work.c
+++ b/net/mac80211/work.c
@@ -229,11 +229,9 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata,
                         wk->ie_len + /* extra IEs */
                         9, /* WMM */
                         GFP_KERNEL);
-        if (!skb) {
-                printk(KERN_DEBUG "%s: failed to allocate buffer for assoc "
-                       "frame\n", sdata->name);
+        if (!skb)
                 return;
-        }
+
         skb_reserve(skb, local->hw.extra_tx_headroom);
 
         capab = WLAN_CAPABILITY_ESS;
@@ -460,7 +458,7 @@ ieee80211_direct_probe(struct ieee80211_work *wk)
          */
         ieee80211_send_probe_req(sdata, NULL, wk->probe_auth.ssid,
                                  wk->probe_auth.ssid_len, NULL, 0,
-                                 (u32) -1, true);
+                                 (u32) -1, true, false);
 
         wk->timeout = jiffies + IEEE80211_AUTH_TIMEOUT;
         run_again(local, wk->timeout);
@@ -579,7 +577,7 @@ ieee80211_offchannel_tx(struct ieee80211_work *wk)
                 /*
                  * After this, offchan_tx.frame remains but now is no
                  * longer a valid pointer -- we still need it as the
-                 * cookie for canceling this work.
+                 * cookie for canceling this work/status matching.
                  */
                 ieee80211_tx_skb(wk->sdata, wk->offchan_tx.frame);
 
diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c
index 7bc8702808fa..f614ce7bb6e3 100644
--- a/net/mac80211/wpa.c
+++ b/net/mac80211/wpa.c
@@ -53,7 +53,8 @@ ieee80211_tx_h_michael_mic_add(struct ieee80211_tx_data *tx)
         }
 
         if (info->control.hw_key &&
-            !(tx->flags & IEEE80211_TX_FRAGMENTED) &&
+            (info->flags & IEEE80211_TX_CTL_DONTFRAG ||
+             tx->local->ops->set_frag_threshold) &&
             !(tx->key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC)) {
                 /* hwaccel - with no need for SW-generated MMIC */
                 return TX_CONTINUE;