Merge branch 'master' of /repos/git/net-next-2.6

Conflicts:
	net/bridge/br_device.c
	net/bridge/br_forward.c

Signed-off-by: Patrick McHardy <kaber@trash.net>

17 files changed, 276 insertions, 73 deletions

diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c
index 9598fdb4ad01..6bb9a9a94960 100644
--- a/net/mac80211/agg-rx.c
+++ b/net/mac80211/agg-rx.c
@@ -19,8 +19,9 @@
 #include "ieee80211_i.h"
 #include "driver-ops.h"
 
-void __ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid,
-                                    u16 initiator, u16 reason)
+static void ___ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid,
+                                            u16 initiator, u16 reason,
+                                            bool from_timer)
 {
         struct ieee80211_local *local = sta->local;
         struct tid_ampdu_rx *tid_rx;
@@ -70,10 +71,17 @@ void __ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid,
 
         spin_unlock_bh(&sta->lock);
 
-        del_timer_sync(&tid_rx->session_timer);
+        if (!from_timer)
+                del_timer_sync(&tid_rx->session_timer);
         kfree(tid_rx);
 }
 
+void __ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid,
+                                    u16 initiator, u16 reason)
+{
+        ___ieee80211_stop_rx_ba_session(sta, tid, initiator, reason, false);
+}
+
 /*
  * After accepting the AddBA Request we activated a timer,
  * resetting it after each frame that arrives from the originator.
@@ -92,8 +100,8 @@ static void sta_rx_agg_session_timer_expired(unsigned long data)
 #ifdef CONFIG_MAC80211_HT_DEBUG
         printk(KERN_DEBUG "rx session timer expired on tid %d\n", (u16)*ptid);
 #endif
-        __ieee80211_stop_rx_ba_session(sta, *ptid, WLAN_BACK_RECIPIENT,
-                                       WLAN_REASON_QSTA_TIMEOUT);
+        ___ieee80211_stop_rx_ba_session(sta, *ptid, WLAN_BACK_RECIPIENT,
+                                        WLAN_REASON_QSTA_TIMEOUT, true);
 }
 
 static void ieee80211_send_addba_resp(struct ieee80211_sub_if_data *sdata, u8 *da, u16 tid,
diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index 608063f11797..c163d0a149f4 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -184,10 +184,9 @@ static void sta_addba_resp_timer_expired(unsigned long data)
                        HT_AGG_STATE_REQ_STOP_BA_MSK)) !=
                                                 HT_ADDBA_REQUESTED_MSK) {
                 spin_unlock_bh(&sta->lock);
-                *state = HT_AGG_STATE_IDLE;
 #ifdef CONFIG_MAC80211_HT_DEBUG
                 printk(KERN_DEBUG "timer expired on tid %d but we are not "
-                                "(or no longer) expecting addBA response there",
+                                "(or no longer) expecting addBA response there\n",
                         tid);
 #endif
                 return;
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 7dd7cda75cfa..ae37270a0633 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -97,9 +97,6 @@ static int ieee80211_change_iface(struct wiphy *wiphy,
                                             params->mesh_id_len,
                                             params->mesh_id);
 
-        if (sdata->vif.type != NL80211_IFTYPE_MONITOR || !flags)
-                return 0;
-
         if (type == NL80211_IFTYPE_AP_VLAN &&
             params && params->use_4addr == 0)
                 rcu_assign_pointer(sdata->u.vlan.sta, NULL);
@@ -107,7 +104,9 @@ static int ieee80211_change_iface(struct wiphy *wiphy,
                  params && params->use_4addr >= 0)
                 sdata->u.mgd.use_4addr = params->use_4addr;
 
-        sdata->u.mntr_flags = *flags;
+        if (sdata->vif.type == NL80211_IFTYPE_MONITOR && flags)
+                sdata->u.mntr_flags = *flags;
+
         return 0;
 }
 
@@ -411,6 +410,17 @@ static int ieee80211_dump_station(struct wiphy *wiphy, struct net_device *dev,
         return ret;
 }
 
+static int ieee80211_dump_survey(struct wiphy *wiphy, struct net_device *dev,
+                                 int idx, struct survey_info *survey)
+{
+        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+
+        if (!local->ops->get_survey)
+                return -EOPNOTSUPP;
+
+        return drv_get_survey(local, idx, survey);
+}
+
 static int ieee80211_get_station(struct wiphy *wiphy, struct net_device *dev,
                                  u8 *mac, struct station_info *sinfo)
 {
@@ -1104,6 +1114,13 @@ static int ieee80211_change_bss(struct wiphy *wiphy,
                 changed |= BSS_CHANGED_BASIC_RATES;
         }
 
+        if (params->ap_isolate >= 0) {
+                if (params->ap_isolate)
+                        sdata->flags |= IEEE80211_SDATA_DONT_BRIDGE_PACKETS;
+                else
+                        sdata->flags &= ~IEEE80211_SDATA_DONT_BRIDGE_PACKETS;
+        }
+
         ieee80211_bss_info_change_notify(sdata, changed);
 
         return 0;
@@ -1388,11 +1405,11 @@ static int ieee80211_set_power_mgmt(struct wiphy *wiphy, struct net_device *dev,
                 return -EOPNOTSUPP;
 
         if (enabled == sdata->u.mgd.powersave &&
-            timeout == conf->dynamic_ps_timeout)
+            timeout == conf->dynamic_ps_forced_timeout)
                 return 0;
 
         sdata->u.mgd.powersave = enabled;
-        conf->dynamic_ps_timeout = timeout;
+        conf->dynamic_ps_forced_timeout = timeout;
 
         /* no change, but if automatic follow powersave */
         mutex_lock(&sdata->u.mgd.mtx);
@@ -1508,6 +1525,7 @@ struct cfg80211_ops mac80211_config_ops = {
         .change_station = ieee80211_change_station,
         .get_station = ieee80211_get_station,
         .dump_station = ieee80211_dump_station,
+        .dump_survey = ieee80211_dump_survey,
 #ifdef CONFIG_MAC80211_MESH
         .add_mpath = ieee80211_add_mpath,
         .del_mpath = ieee80211_del_mpath,
diff --git a/net/mac80211/debugfs_sta.c b/net/mac80211/debugfs_sta.c
index 6bc9b07c3eda..e763f1529ddb 100644
--- a/net/mac80211/debugfs_sta.c
+++ b/net/mac80211/debugfs_sta.c
@@ -39,6 +39,13 @@ static const struct file_operations sta_ ##name## _ops = {		\
         .open = mac80211_open_file_generic,                             \
 }
 
+#define STA_OPS_RW(name)                                                \
+static const struct file_operations sta_ ##name## _ops = {              \
+        .read = sta_##name##_read,                                      \
+        .write = sta_##name##_write,                                    \
+        .open = mac80211_open_file_generic,                             \
+}
+
 #define STA_FILE(name, field, format)                                   \
                 STA_READ_##format(name, field)                          \
                 STA_OPS(name)
@@ -156,7 +163,63 @@ static ssize_t sta_agg_status_read(struct file *file, char __user *userbuf,
 
         return simple_read_from_buffer(userbuf, count, ppos, buf, p - buf);
 }
-STA_OPS(agg_status);
+
+static ssize_t sta_agg_status_write(struct file *file, const char __user *userbuf,
+                                    size_t count, loff_t *ppos)
+{
+        char _buf[12], *buf = _buf;
+        struct sta_info *sta = file->private_data;
+        bool start, tx;
+        unsigned long tid;
+        int ret;
+
+        if (count > sizeof(_buf))
+                return -EINVAL;
+
+        if (copy_from_user(buf, userbuf, count))
+                return -EFAULT;
+
+        buf[sizeof(_buf) - 1] = '\0';
+
+        if (strncmp(buf, "tx ", 3) == 0) {
+                buf += 3;
+                tx = true;
+        } else if (strncmp(buf, "rx ", 3) == 0) {
+                buf += 3;
+                tx = false;
+        } else
+                return -EINVAL;
+
+        if (strncmp(buf, "start ", 6) == 0) {
+                buf += 6;
+                start = true;
+                if (!tx)
+                        return -EINVAL;
+        } else if (strncmp(buf, "stop ", 5) == 0) {
+                buf += 5;
+                start = false;
+        } else
+                return -EINVAL;
+
+        tid = simple_strtoul(buf, NULL, 0);
+
+        if (tid >= STA_TID_NUM)
+                return -EINVAL;
+
+        if (tx) {
+                if (start)
+                        ret = ieee80211_start_tx_ba_session(&sta->sta, tid);
+                else
+                        ret = ieee80211_stop_tx_ba_session(&sta->sta, tid,
+                                                           WLAN_BACK_RECIPIENT);
+        } else {
+                __ieee80211_stop_rx_ba_session(sta, tid, WLAN_BACK_RECIPIENT, 3);
+                ret = 0;
+        }
+
+        return ret ?: count;
+}
+STA_OPS_RW(agg_status);
 
 static ssize_t sta_ht_capa_read(struct file *file, char __user *userbuf,
                                 size_t count, loff_t *ppos)
diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
index 9179196da264..ee8b63f92f71 100644
--- a/net/mac80211/driver-ops.h
+++ b/net/mac80211/driver-ops.h
@@ -152,14 +152,15 @@ static inline void drv_update_tkip_key(struct ieee80211_local *local,
 }
 
 static inline int drv_hw_scan(struct ieee80211_local *local,
+                              struct ieee80211_sub_if_data *sdata,
                               struct cfg80211_scan_request *req)
 {
         int ret;
 
         might_sleep();
 
-        ret = local->ops->hw_scan(&local->hw, req);
-        trace_drv_hw_scan(local, req, ret);
+        ret = local->ops->hw_scan(&local->hw, &sdata->vif, req);
+        trace_drv_hw_scan(local, sdata, req, ret);
         return ret;
 }
 
@@ -344,6 +345,15 @@ static inline int drv_ampdu_action(struct ieee80211_local *local,
         return ret;
 }
 
+static inline int drv_get_survey(struct ieee80211_local *local, int idx,
+                                struct survey_info *survey)
+{
+        int ret = -EOPNOTSUPP;
+        if (local->ops->conf_tx)
+                ret = local->ops->get_survey(&local->hw, idx, survey);
+        /* trace_drv_get_survey(local, idx, survey, ret); */
+        return ret;
+}
 
 static inline void drv_rfkill_poll(struct ieee80211_local *local)
 {
diff --git a/net/mac80211/driver-trace.h b/net/mac80211/driver-trace.h
index e209cb82ff29..ce734b58d07a 100644
--- a/net/mac80211/driver-trace.h
+++ b/net/mac80211/driver-trace.h
@@ -363,23 +363,26 @@ TRACE_EVENT(drv_update_tkip_key,
 
 TRACE_EVENT(drv_hw_scan,
         TP_PROTO(struct ieee80211_local *local,
+                 struct ieee80211_sub_if_data *sdata,
                  struct cfg80211_scan_request *req, int ret),
 
-        TP_ARGS(local, req, ret),
+        TP_ARGS(local, sdata, req, ret),
 
         TP_STRUCT__entry(
                 LOCAL_ENTRY
+                VIF_ENTRY
                 __field(int, ret)
         ),
 
         TP_fast_assign(
                 LOCAL_ASSIGN;
+                VIF_ASSIGN;
                 __entry->ret = ret;
         ),
 
         TP_printk(
-                LOCAL_PR_FMT " ret:%d",
-                LOCAL_PR_ARG, __entry->ret
+                LOCAL_PR_FMT VIF_PR_FMT " ret:%d",
+                LOCAL_PR_ARG,VIF_PR_ARG, __entry->ret
         )
 );
 
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index e6f3b0c7a71f..b72ee6435fa3 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -92,6 +92,12 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
         if (memcmp(ifibss->bssid, bssid, ETH_ALEN))
                 sta_info_flush(sdata->local, sdata);
 
+        /* if merging, indicate to driver that we leave the old IBSS */
+        if (sdata->vif.bss_conf.ibss_joined) {
+                sdata->vif.bss_conf.ibss_joined = false;
+                ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_IBSS);
+        }
+
         memcpy(ifibss->bssid, bssid, ETH_ALEN);
 
         sdata->drop_unencrypted = capability & WLAN_CAPABILITY_PRIVACY ? 1 : 0;
@@ -171,6 +177,8 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
         bss_change |= BSS_CHANGED_BSSID;
         bss_change |= BSS_CHANGED_BEACON;
         bss_change |= BSS_CHANGED_BEACON_ENABLED;
+        bss_change |= BSS_CHANGED_IBSS;
+        sdata->vif.bss_conf.ibss_joined = true;
         ieee80211_bss_info_change_notify(sdata, bss_change);
 
         ieee80211_sta_def_wmm_params(sdata, sband->n_bitrates, supp_rates);
@@ -481,7 +489,9 @@ static void ieee80211_sta_merge_ibss(struct ieee80211_sub_if_data *sdata)
         printk(KERN_DEBUG "%s: No active IBSS STAs - trying to scan for other "
                "IBSS networks with same SSID (merge)\n", sdata->name);
 
-        ieee80211_request_internal_scan(sdata, ifibss->ssid, ifibss->ssid_len);
+        ieee80211_request_internal_scan(sdata,
+                        ifibss->ssid, ifibss->ssid_len,
+                        ifibss->fixed_channel ? ifibss->channel : NULL);
 }
 
 static void ieee80211_sta_create_ibss(struct ieee80211_sub_if_data *sdata)
@@ -588,8 +598,9 @@ static void ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata)
                 printk(KERN_DEBUG "%s: Trigger new scan to find an IBSS to "
                        "join\n", sdata->name);
 
-                ieee80211_request_internal_scan(sdata, ifibss->ssid,
-                                                ifibss->ssid_len);
+                ieee80211_request_internal_scan(sdata,
+                                ifibss->ssid, ifibss->ssid_len,
+                                ifibss->fixed_channel ? ifibss->channel : NULL);
         } else {
                 int interval = IEEE80211_SCAN_INTERVAL;
 
@@ -897,6 +908,12 @@ int ieee80211_ibss_join(struct ieee80211_sub_if_data *sdata,
         sdata->u.ibss.channel = params->channel;
         sdata->u.ibss.fixed_channel = params->channel_fixed;
 
+        /* fix ourselves to that channel now already */
+        if (params->channel_fixed) {
+                sdata->local->oper_channel = params->channel;
+                sdata->local->oper_channel_type = NL80211_CHAN_NO_HT;
+        }
+
         if (params->ie) {
                 sdata->u.ibss.ie = kmemdup(params->ie, params->ie_len,
                                            GFP_KERNEL);
@@ -951,7 +968,9 @@ int ieee80211_ibss_leave(struct ieee80211_sub_if_data *sdata)
         kfree(sdata->u.ibss.ie);
         skb = sdata->u.ibss.presp;
         rcu_assign_pointer(sdata->u.ibss.presp, NULL);
-        ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON_ENABLED);
+        sdata->vif.bss_conf.ibss_joined = false;
+        ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON_ENABLED |
+                                                BSS_CHANGED_IBSS);
         synchronize_rcu();
         kfree_skb(skb);
 
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index c9712f35e596..cbaf4981e110 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -1019,7 +1019,8 @@ void ieee80211_ibss_restart(struct ieee80211_sub_if_data *sdata);
 /* scan/BSS handling */
 void ieee80211_scan_work(struct work_struct *work);
 int ieee80211_request_internal_scan(struct ieee80211_sub_if_data *sdata,
-                                    const u8 *ssid, u8 ssid_len);
+                                    const u8 *ssid, u8 ssid_len,
+                                    struct ieee80211_channel *chan);
 int ieee80211_request_scan(struct ieee80211_sub_if_data *sdata,
                            struct cfg80211_scan_request *req);
 void ieee80211_scan_cancel(struct ieee80211_local *local);
diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index e8f6e3b252d8..8d4b41787dcf 100644
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -140,6 +140,7 @@ static void ieee80211_key_enable_hw_accel(struct ieee80211_key *key)
                                      struct ieee80211_sub_if_data,
                                      u.ap);
 
+        key->conf.ap_addr = sdata->dev->dev_addr;
         ret = drv_set_key(key->local, SET_KEY, sdata, sta, &key->conf);
 
         if (!ret) {
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 011ee85bcd57..bd632e1ee2c5 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -442,7 +442,7 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
         struct ieee80211_local *local = hw_to_local(hw);
         int result;
         enum ieee80211_band band;
-        int channels, i, j, max_bitrates;
+        int channels, max_bitrates;
         bool supp_ht;
         static const u32 cipher_suites[] = {
                 WLAN_CIPHER_SUITE_WEP40,
@@ -572,6 +572,8 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
 
         local->hw.conf.listen_interval = local->hw.max_listen_interval;
 
+        local->hw.conf.dynamic_ps_forced_timeout = -1;
+
         result = sta_info_start(local);
         if (result < 0)
                 goto fail_sta_info;
@@ -606,21 +608,6 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
 
         ieee80211_led_init(local);
 
-        /* alloc internal scan request */
-        i = 0;
-        local->int_scan_req->ssids = &local->scan_ssid;
-        local->int_scan_req->n_ssids = 1;
-        for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
-                if (!hw->wiphy->bands[band])
-                        continue;
-                for (j = 0; j < hw->wiphy->bands[band]->n_channels; j++) {
-                        local->int_scan_req->channels[i] =
-                                &hw->wiphy->bands[band]->channels[j];
-                        i++;
-                }
-        }
-        local->int_scan_req->n_channels = i;
-
         local->network_latency_notifier.notifier_call =
                 ieee80211_max_network_latency;
         result = pm_qos_add_notifier(PM_QOS_NETWORK_LATENCY,
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 35d850223a75..358226f63b81 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -175,6 +175,8 @@ static u32 ieee80211_enable_ht(struct ieee80211_sub_if_data *sdata,
         ht_changed = conf_is_ht(&local->hw.conf) != enable_ht ||
                      channel_type != local->hw.conf.channel_type;
 
+        if (local->tmp_channel)
+                local->tmp_channel_type = channel_type;
         local->oper_channel_type = channel_type;
 
         if (ht_changed) {
@@ -476,6 +478,7 @@ void ieee80211_recalc_ps(struct ieee80211_local *local, s32 latency)
 {
         struct ieee80211_sub_if_data *sdata, *found = NULL;
         int count = 0;
+        int timeout;
 
         if (!(local->hw.flags & IEEE80211_HW_SUPPORTS_PS)) {
                 local->ps_sdata = NULL;
@@ -509,6 +512,26 @@ void ieee80211_recalc_ps(struct ieee80211_local *local, s32 latency)
                 beaconint_us = ieee80211_tu_to_usec(
                                         found->vif.bss_conf.beacon_int);
 
+                timeout = local->hw.conf.dynamic_ps_forced_timeout;
+                if (timeout < 0) {
+                        /*
+                         * The 2 second value is there for compatibility until
+                         * the PM_QOS_NETWORK_LATENCY is configured with real
+                         * values.
+                         */
+                        if (latency == 2000000000)
+                                timeout = 100;
+                        else if (latency <= 50000)
+                                timeout = 300;
+                        else if (latency <= 100000)
+                                timeout = 100;
+                        else if (latency <= 500000)
+                                timeout = 50;
+                        else
+                                timeout = 0;
+                }
+                local->hw.conf.dynamic_ps_timeout = timeout;
+
                 if (beaconint_us > latency) {
                         local->ps_sdata = NULL;
                 } else {
@@ -1331,12 +1354,17 @@ static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_sub_if_data *sdata,
                 mutex_lock(&sdata->local->iflist_mtx);
                 ieee80211_recalc_ps(sdata->local, -1);
                 mutex_unlock(&sdata->local->iflist_mtx);
+
+                if (sdata->local->hw.flags & IEEE80211_HW_CONNECTION_MONITOR)
+                        return;
+
                 /*
                  * We've received a probe response, but are not sure whether
                  * we have or will be receiving any beacons or data, so let's
                  * schedule the timers again, just in case.
                  */
                 mod_beacon_timer(sdata);
+
                 mod_timer(&ifmgd->conn_mon_timer,
                           round_jiffies_up(jiffies +
                                            IEEE80211_CONNECTION_IDLE_TIME));
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 72efbd87c1eb..9a08f2c446c6 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -81,8 +81,6 @@ ieee80211_rx_radiotap_len(struct ieee80211_local *local,
                 len += 8;
         if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
                 len += 1;
-        if (local->hw.flags & IEEE80211_HW_NOISE_DBM)
-                len += 1;
 
         if (len & 1) /* padding for RX_FLAGS if necessary */
                 len++;
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index e1a3defdf581..e14c44195ae9 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -85,7 +85,7 @@ ieee80211_bss_info_update(struct ieee80211_local *local,
 {
         struct cfg80211_bss *cbss;
         struct ieee80211_bss *bss;
-        int clen;
+        int clen, srlen;
         s32 signal = 0;
 
         if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
@@ -114,23 +114,24 @@ ieee80211_bss_info_update(struct ieee80211_local *local,
                 bss->dtim_period = tim_ie->dtim_period;
         }
 
-        bss->supp_rates_len = 0;
+        /* replace old supported rates if we get new values */
+        srlen = 0;
         if (elems->supp_rates) {
-                clen = IEEE80211_MAX_SUPP_RATES - bss->supp_rates_len;
+                clen = IEEE80211_MAX_SUPP_RATES;
                 if (clen > elems->supp_rates_len)
                         clen = elems->supp_rates_len;
-                memcpy(&bss->supp_rates[bss->supp_rates_len], elems->supp_rates,
-                       clen);
-                bss->supp_rates_len += clen;
+                memcpy(bss->supp_rates, elems->supp_rates, clen);
+                srlen += clen;
         }
         if (elems->ext_supp_rates) {
-                clen = IEEE80211_MAX_SUPP_RATES - bss->supp_rates_len;
+                clen = IEEE80211_MAX_SUPP_RATES - srlen;
                 if (clen > elems->ext_supp_rates_len)
                         clen = elems->ext_supp_rates_len;
-                memcpy(&bss->supp_rates[bss->supp_rates_len],
-                       elems->ext_supp_rates, clen);
-                bss->supp_rates_len += clen;
+                memcpy(bss->supp_rates + srlen, elems->ext_supp_rates, clen);
+                srlen += clen;
         }
+        if (srlen)
+                bss->supp_rates_len = srlen;
 
         bss->wmm_used = elems->wmm_param || elems->wmm_info;
         bss->uapsd_supported = is_uapsd_supported(elems);
@@ -411,7 +412,7 @@ static int __ieee80211_start_scan(struct ieee80211_sub_if_data *sdata,
 
         if (local->ops->hw_scan) {
                 WARN_ON(!ieee80211_prep_hw_scan(local));
-                rc = drv_hw_scan(local, local->hw_scan_req);
+                rc = drv_hw_scan(local, sdata, local->hw_scan_req);
         } else
                 rc = ieee80211_start_sw_scan(local);
 
@@ -655,7 +656,7 @@ void ieee80211_scan_work(struct work_struct *work)
         }
 
         if (local->hw_scan_req) {
-                int rc = drv_hw_scan(local, local->hw_scan_req);
+                int rc = drv_hw_scan(local, sdata, local->hw_scan_req);
                 mutex_unlock(&local->scan_mtx);
                 if (rc)
                         ieee80211_scan_completed(&local->hw, true);
@@ -728,10 +729,12 @@ int ieee80211_request_scan(struct ieee80211_sub_if_data *sdata,
 }
 
 int ieee80211_request_internal_scan(struct ieee80211_sub_if_data *sdata,
-                                    const u8 *ssid, u8 ssid_len)
+                                    const u8 *ssid, u8 ssid_len,
+                                    struct ieee80211_channel *chan)
 {
         struct ieee80211_local *local = sdata->local;
         int ret = -EBUSY;
+        enum nl80211_band band;
 
         mutex_lock(&local->scan_mtx);
 
@@ -739,6 +742,30 @@ int ieee80211_request_internal_scan(struct ieee80211_sub_if_data *sdata,
         if (local->scan_req)
                 goto unlock;
 
+        /* fill internal scan request */
+        if (!chan) {
+                int i, nchan = 0;
+
+                for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
+                        if (!local->hw.wiphy->bands[band])
+                                continue;
+                        for (i = 0;
+                             i < local->hw.wiphy->bands[band]->n_channels;
+                             i++) {
+                                local->int_scan_req->channels[nchan] =
+                                    &local->hw.wiphy->bands[band]->channels[i];
+                                nchan++;
+                        }
+                }
+
+                local->int_scan_req->n_channels = nchan;
+        } else {
+                local->int_scan_req->channels[0] = chan;
+                local->int_scan_req->n_channels = 1;
+        }
+
+        local->int_scan_req->ssids = &local->scan_ssid;
+        local->int_scan_req->n_ssids = 1;
         memcpy(local->int_scan_req->ssids[0].ssid, ssid, IEEE80211_MAX_SSID_LEN);
         local->int_scan_req->ssids[0].ssid_len = ssid_len;
 
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index ff0eb948917b..730197591ab5 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -575,7 +575,7 @@ static int sta_info_buffer_expired(struct sta_info *sta,
 }
 
 
-static void sta_info_cleanup_expire_buffered(struct ieee80211_local *local,
+static bool sta_info_cleanup_expire_buffered(struct ieee80211_local *local,
                                              struct sta_info *sta)
 {
         unsigned long flags;
@@ -583,7 +583,7 @@ static void sta_info_cleanup_expire_buffered(struct ieee80211_local *local,
         struct ieee80211_sub_if_data *sdata;
 
         if (skb_queue_empty(&sta->ps_tx_buf))
-                return;
+                return false;
 
         for (;;) {
                 spin_lock_irqsave(&sta->ps_tx_buf.lock, flags);
@@ -608,6 +608,8 @@ static void sta_info_cleanup_expire_buffered(struct ieee80211_local *local,
                 if (skb_queue_empty(&sta->ps_tx_buf))
                         sta_info_clear_tim_bit(sta);
         }
+
+        return true;
 }
 
 static int __must_check __sta_info_destroy(struct sta_info *sta)
@@ -755,15 +757,20 @@ static void sta_info_cleanup(unsigned long data)
 {
         struct ieee80211_local *local = (struct ieee80211_local *) data;
         struct sta_info *sta;
+        bool timer_needed = false;
 
         rcu_read_lock();
         list_for_each_entry_rcu(sta, &local->sta_list, list)
-                sta_info_cleanup_expire_buffered(local, sta);
+                if (sta_info_cleanup_expire_buffered(local, sta))
+                        timer_needed = true;
         rcu_read_unlock();
 
         if (local->quiescing)
                 return;
 
+        if (!timer_needed)
+                return;
+
         local->sta_cleanup.expires =
                 round_jiffies(jiffies + STA_INFO_CLEANUP_INTERVAL);
         add_timer(&local->sta_cleanup);
@@ -848,8 +855,12 @@ struct ieee80211_sta *ieee80211_find_sta_by_hw(struct ieee80211_hw *hw,
         struct sta_info *sta, *nxt;
 
         /* Just return a random station ... first in list ... */
-        for_each_sta_info(hw_to_local(hw), addr, sta, nxt)
+        for_each_sta_info(hw_to_local(hw), addr, sta, nxt) {
+                if (!sta->uploaded)
+                        return NULL;
                 return &sta->sta;
+        }
+
         return NULL;
 }
 EXPORT_SYMBOL_GPL(ieee80211_find_sta_by_hw);
@@ -857,14 +868,19 @@ EXPORT_SYMBOL_GPL(ieee80211_find_sta_by_hw);
 struct ieee80211_sta *ieee80211_find_sta(struct ieee80211_vif *vif,
                                          const u8 *addr)
 {
-        struct ieee80211_sub_if_data *sdata;
+        struct sta_info *sta;
 
         if (!vif)
                 return NULL;
 
-        sdata = vif_to_sdata(vif);
+        sta = sta_info_get_bss(vif_to_sdata(vif), addr);
+        if (!sta)
+                return NULL;
+
+        if (!sta->uploaded)
+                return NULL;
 
-        return ieee80211_find_sta_by_hw(&sdata->local->hw, addr);
+        return &sta->sta;
 }
 EXPORT_SYMBOL(ieee80211_find_sta);
 
diff --git a/net/mac80211/status.c b/net/mac80211/status.c
index 11805a3a626f..94613af009f3 100644
--- a/net/mac80211/status.c
+++ b/net/mac80211/status.c
@@ -171,6 +171,7 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
         struct net_device *prev_dev = NULL;
         struct sta_info *sta, *tmp;
         int retry_count = -1, i;
+        int rates_idx = -1;
         bool send_to_cooked;
 
         for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
@@ -178,6 +179,8 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
                 if (i >= hw->max_rates) {
                         info->status.rates[i].idx = -1;
                         info->status.rates[i].count = 0;
+                } else if (info->status.rates[i].idx >= 0) {
+                        rates_idx = i;
                 }
 
                 retry_count += info->status.rates[i].count;
@@ -206,6 +209,10 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
                         return;
                 }
 
+                if ((local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL) &&
+                    (rates_idx != -1))
+                        sta->last_tx_rate = info->status.rates[rates_idx];
+
                 if ((info->flags & IEEE80211_TX_STAT_AMPDU_NO_BACK) &&
                     (ieee80211_is_data_qos(fc))) {
                         u16 tid, ssn;
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 2cb77267f733..f3841f43249e 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -429,6 +429,7 @@ ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx)
         struct sta_info *sta = tx->sta;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
+        struct ieee80211_local *local = tx->local;
         u32 staflags;
 
         if (unlikely(!sta ||
@@ -476,6 +477,12 @@ ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx)
                 info->control.vif = &tx->sdata->vif;
                 info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
                 skb_queue_tail(&sta->ps_tx_buf, tx->skb);
+
+                if (!timer_pending(&local->sta_cleanup))
+                        mod_timer(&local->sta_cleanup,
+                                  round_jiffies(jiffies +
+                                                STA_INFO_CLEANUP_INTERVAL));
+
                 return TX_QUEUED;
         }
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
@@ -586,7 +593,8 @@ ieee80211_tx_h_rate_ctrl(struct ieee80211_tx_data *tx)
         struct ieee80211_hdr *hdr = (void *)tx->skb->data;
         struct ieee80211_supported_band *sband;
         struct ieee80211_rate *rate;
-        int i, len;
+        int i;
+        u32 len;
         bool inval = false, rts = false, short_preamble = false;
         struct ieee80211_tx_rate_control txrc;
         u32 sta_flags;
@@ -595,7 +603,7 @@ ieee80211_tx_h_rate_ctrl(struct ieee80211_tx_data *tx)
 
         sband = tx->local->hw.wiphy->bands[tx->channel->band];
 
-        len = min_t(int, tx->skb->len + FCS_LEN,
+        len = min_t(u32, tx->skb->len + FCS_LEN,
                          tx->local->hw.wiphy->frag_threshold);
 
         /* set up the tx rate control struct we give the RC algo */
diff --git a/net/mac80211/work.c b/net/mac80211/work.c
index bdb1d05b16fc..3dd07600199d 100644
--- a/net/mac80211/work.c
+++ b/net/mac80211/work.c
@@ -213,15 +213,25 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata,
 
         sband = local->hw.wiphy->bands[wk->chan->band];
 
-        /*
-         * Get all rates supported by the device and the AP as
-         * some APs don't like getting a superset of their rates
-         * in the association request (e.g. D-Link DAP 1353 in
-         * b-only mode)...
-         */
-        rates_len = ieee80211_compatible_rates(wk->assoc.supp_rates,
-                                               wk->assoc.supp_rates_len,
-                                               sband, &rates);
+        if (wk->assoc.supp_rates_len) {
+                /*
+                 * Get all rates supported by the device and the AP as
+                 * some APs don't like getting a superset of their rates
+                 * in the association request (e.g. D-Link DAP 1353 in
+                 * b-only mode)...
+                 */
+                rates_len = ieee80211_compatible_rates(wk->assoc.supp_rates,
+                                                       wk->assoc.supp_rates_len,
+                                                       sband, &rates);
+        } else {
+                /*
+                 * In case AP not provide any supported rates information
+                 * before association, we send information element(s) with
+                 * all rates that we support.
+                 */
+                rates = ~0;
+                rates_len = sband->n_bitrates;
+        }
 
         skb = alloc_skb(local->hw.extra_tx_headroom +
                         sizeof(*mgmt) + /* bit too much but doesn't matter */