Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless

7 files changed, 52 insertions, 19 deletions

diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 000a8ba987cd..65b72ae2b4e0 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -832,6 +832,12 @@ static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev,
         if (is_multicast_ether_addr(mac))
                 return -EINVAL;
 
+        /* Only TDLS-supporting stations can add TDLS peers */
+        if ((params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) &&
+            !((wiphy->flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
+              sdata->vif.type == NL80211_IFTYPE_STATION))
+                return -ENOTSUPP;
+
         sta = sta_info_alloc(sdata, mac, GFP_KERNEL);
         if (!sta)
                 return -ENOMEM;
@@ -841,12 +847,6 @@ static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev,
 
         sta_apply_parameters(local, sta, params);
 
-        /* Only TDLS-supporting stations can add TDLS peers */
-        if (test_sta_flag(sta, WLAN_STA_TDLS_PEER) &&
-            !((wiphy->flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
-              sdata->vif.type == NL80211_IFTYPE_STATION))
-                return -ENOTSUPP;
-
         rate_control_rate_init(sta);
 
         layer2_update = sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 30fc9e7c5c53..e2447096c94a 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -389,6 +389,7 @@ struct ieee80211_if_managed {
 
         unsigned long timers_running; /* used for quiesce/restart */
         bool powersave; /* powersave requested for this iface */
+        bool broken_ap; /* AP is broken -- turn off powersave */
         enum ieee80211_smps_mode req_smps, /* requested smps mode */
                                  ap_smps, /* smps mode AP thinks we're in */
                                  driver_smps_mode; /* smps mode request */
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index d4ee6d234a78..d999bf3b84e1 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -19,7 +19,7 @@
 #include <linux/if_arp.h>
 #include <linux/rtnetlink.h>
 #include <linux/bitmap.h>
-#include <linux/pm_qos_params.h>
+#include <linux/pm_qos.h>
 #include <linux/inetdevice.h>
 #include <net/net_namespace.h>
 #include <net/cfg80211.h>
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 0e5d8daba1ee..d3b408cda08d 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -17,7 +17,7 @@
 #include <linux/if_arp.h>
 #include <linux/etherdevice.h>
 #include <linux/rtnetlink.h>
-#include <linux/pm_qos_params.h>
+#include <linux/pm_qos.h>
 #include <linux/crc32.h>
 #include <linux/slab.h>
 #include <net/mac80211.h>
@@ -637,6 +637,9 @@ static bool ieee80211_powersave_allowed(struct ieee80211_sub_if_data *sdata)
         if (!mgd->powersave)
                 return false;
 
+        if (mgd->broken_ap)
+                return false;
+
         if (!mgd->associated)
                 return false;
 
@@ -1482,6 +1485,7 @@ static bool ieee80211_assoc_success(struct ieee80211_work *wk,
         int i, j, err;
         bool have_higher_than_11mbit = false;
         u16 ap_ht_cap_flags;
+        int min_rate = INT_MAX, min_rate_index = -1;
 
         /* AssocResp and ReassocResp have identical structure */
 
@@ -1489,10 +1493,21 @@ static bool ieee80211_assoc_success(struct ieee80211_work *wk,
         capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
 
         if ((aid & (BIT(15) | BIT(14))) != (BIT(15) | BIT(14)))
-                printk(KERN_DEBUG "%s: invalid aid value %d; bits 15:14 not "
-                       "set\n", sdata->name, aid);
+                printk(KERN_DEBUG
+                       "%s: invalid AID value 0x%x; bits 15:14 not set\n",
+                       sdata->name, aid);
         aid &= ~(BIT(15) | BIT(14));
 
+        ifmgd->broken_ap = false;
+
+        if (aid == 0 || aid > IEEE80211_MAX_AID) {
+                printk(KERN_DEBUG
+                       "%s: invalid AID value %d (out of range), turn off PS\n",
+                       sdata->name, aid);
+                aid = 0;
+                ifmgd->broken_ap = true;
+        }
+
         pos = mgmt->u.assoc_resp.variable;
         ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems);
 
@@ -1537,6 +1552,10 @@ static bool ieee80211_assoc_success(struct ieee80211_work *wk,
                                 rates |= BIT(j);
                                 if (is_basic)
                                         basic_rates |= BIT(j);
+                                if (rate < min_rate) {
+                                        min_rate = rate;
+                                        min_rate_index = j;
+                                }
                                 break;
                         }
                 }
@@ -1554,11 +1573,25 @@ static bool ieee80211_assoc_success(struct ieee80211_work *wk,
                                 rates |= BIT(j);
                                 if (is_basic)
                                         basic_rates |= BIT(j);
+                                if (rate < min_rate) {
+                                        min_rate = rate;
+                                        min_rate_index = j;
+                                }
                                 break;
                         }
                 }
         }
 
+        /*
+         * some buggy APs don't advertise basic_rates. use the lowest
+         * supported rate instead.
+         */
+        if (unlikely(!basic_rates) && min_rate_index >= 0) {
+                printk(KERN_DEBUG "%s: No basic rates in AssocResp. "
+                       "Using min supported rate instead.\n", sdata->name);
+                basic_rates = BIT(min_rate_index);
+        }
+
         sta->sta.supp_rates[wk->chan->band] = rates;
         sdata->vif.bss_conf.basic_rates = basic_rates;
 
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index 397343a59275..83a0b050b374 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -14,7 +14,7 @@
 
 #include <linux/if_arp.h>
 #include <linux/rtnetlink.h>
-#include <linux/pm_qos_params.h>
+#include <linux/pm_qos.h>
 #include <net/sch_generic.h>
 #include <linux/slab.h>
 #include <net/mac80211.h>
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index ce962d2c8782..8eaa746ec7a2 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -1354,12 +1354,12 @@ ieee80211_sta_ps_deliver_response(struct sta_info *sta,
                          * Use MoreData flag to indicate whether there are
                          * more buffered frames for this STA
                          */
-                        if (!more_data)
-                                hdr->frame_control &=
-                                        cpu_to_le16(~IEEE80211_FCTL_MOREDATA);
-                        else
+                        if (more_data || !skb_queue_empty(&frames))
                                 hdr->frame_control |=
                                         cpu_to_le16(IEEE80211_FCTL_MOREDATA);
+                        else
+                                hdr->frame_control &=
+                                        cpu_to_le16(~IEEE80211_FCTL_MOREDATA);
 
                         if (ieee80211_is_data_qos(hdr->frame_control) ||
                             ieee80211_is_qos_nullfunc(hdr->frame_control))
diff --git a/net/mac80211/work.c b/net/mac80211/work.c
index fab5092e3788..30da4e3f19f7 100644
--- a/net/mac80211/work.c
+++ b/net/mac80211/work.c
@@ -1057,14 +1057,13 @@ static void ieee80211_work_work(struct work_struct *work)
                         continue;
                 if (wk->chan != local->tmp_channel)
                         continue;
-                if (ieee80211_work_ct_coexists(wk->chan_type,
-                                               local->tmp_channel_type))
+                if (!ieee80211_work_ct_coexists(wk->chan_type,
+                                                local->tmp_channel_type))
                         continue;
                 remain_off_channel = true;
         }
 
         if (!remain_off_channel && local->tmp_channel) {
-                bool on_oper_chan = ieee80211_cfg_on_oper_channel(local);
                 local->tmp_channel = NULL;
                 /* If tmp_channel wasn't operating channel, then
                  * we need to go back on-channel.
@@ -1074,7 +1073,7 @@ static void ieee80211_work_work(struct work_struct *work)
                  * we still need to do a hardware config.  Currently,
                  * we cannot be here while scanning, however.
                  */
-                if (ieee80211_cfg_on_oper_channel(local) && !on_oper_chan)
+                if (!ieee80211_cfg_on_oper_channel(local))
                         ieee80211_hw_config(local, 0);
 
                 /* At the least, we need to disable offchannel_ps,