Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next into for-davem

16 files changed, 1148 insertions, 365 deletions

diff --git a/net/mac80211/Kconfig b/net/mac80211/Kconfig
index f5fdfcbf552a..d1886b59bec4 100644
--- a/net/mac80211/Kconfig
+++ b/net/mac80211/Kconfig
@@ -199,6 +199,19 @@ config MAC80211_VERBOSE_MPL_DEBUG
 
           Do not select this option.
 
+config MAC80211_VERBOSE_MPATH_DEBUG
+        bool "Verbose mesh path debugging"
+        depends on MAC80211_DEBUG_MENU
+        depends on MAC80211_MESH
+        ---help---
+          Selecting this option causes mac80211 to print out very
+          verbose mesh path selection debugging messages (when mac80211
+          is taking part in a mesh network).
+          It should not be selected on production systems as those
+          messages are remotely triggerable.
+
+          Do not select this option.
+
 config MAC80211_VERBOSE_MHWMP_DEBUG
         bool "Verbose mesh HWMP routing debugging"
         depends on MAC80211_DEBUG_MENU
diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index b7075f33dc06..018108d1a2fd 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -128,7 +128,7 @@ void ieee80211_send_bar(struct ieee80211_sub_if_data *sdata, u8 *ra, u16 tid, u1
         memcpy(bar->ta, sdata->vif.addr, ETH_ALEN);
         bar_control |= (u16)IEEE80211_BAR_CTRL_ACK_POLICY_NORMAL;
         bar_control |= (u16)IEEE80211_BAR_CTRL_CBMTID_COMPRESSED_BA;
-        bar_control |= (u16)(tid << 12);
+        bar_control |= (u16)(tid << IEEE80211_BAR_CTRL_TID_INFO_SHIFT);
         bar->control = cpu_to_le16(bar_control);
         bar->start_seq_num = cpu_to_le16(ssn);
 
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index a589addf6ce1..4baa03b1c251 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -697,6 +697,9 @@ static void sta_apply_parameters(struct ieee80211_local *local,
         }
         spin_unlock_irqrestore(&sta->flaglock, flags);
 
+        sta->sta.uapsd_queues = params->uapsd_queues;
+        sta->sta.max_sp = params->max_sp;
+
         /*
          * cfg80211 validates this (1-2007) and allows setting the AID
          * only when creating a new station entry
@@ -1137,6 +1140,22 @@ static int ieee80211_update_mesh_config(struct wiphy *wiphy,
                 conf->dot11MeshHWMPRootMode = nconf->dot11MeshHWMPRootMode;
                 ieee80211_mesh_root_setup(ifmsh);
         }
+        if (_chg_mesh_attr(NL80211_MESHCONF_GATE_ANNOUNCEMENTS, mask)) {
+                /* our current gate announcement implementation rides on root
+                 * announcements, so require this ifmsh to also be a root node
+                 * */
+                if (nconf->dot11MeshGateAnnouncementProtocol &&
+                    !conf->dot11MeshHWMPRootMode) {
+                        conf->dot11MeshHWMPRootMode = 1;
+                        ieee80211_mesh_root_setup(ifmsh);
+                }
+                conf->dot11MeshGateAnnouncementProtocol =
+                        nconf->dot11MeshGateAnnouncementProtocol;
+        }
+        if (_chg_mesh_attr(NL80211_MESHCONF_HWMP_RANN_INTERVAL, mask)) {
+                conf->dot11MeshHWMPRannInterval =
+                        nconf->dot11MeshHWMPRannInterval;
+        }
         return 0;
 }
 
diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c
index 9ea7c0d0103f..6e8eab7919e2 100644
--- a/net/mac80211/debugfs_netdev.c
+++ b/net/mac80211/debugfs_netdev.c
@@ -372,6 +372,10 @@ IEEE80211_IF_FILE(min_discovery_timeout,
                 u.mesh.mshcfg.min_discovery_timeout, DEC);
 IEEE80211_IF_FILE(dot11MeshHWMPRootMode,
                 u.mesh.mshcfg.dot11MeshHWMPRootMode, DEC);
+IEEE80211_IF_FILE(dot11MeshGateAnnouncementProtocol,
+                u.mesh.mshcfg.dot11MeshGateAnnouncementProtocol, DEC);
+IEEE80211_IF_FILE(dot11MeshHWMPRannInterval,
+                u.mesh.mshcfg.dot11MeshHWMPRannInterval, DEC);
 #endif
 
 
@@ -485,7 +489,9 @@ static void add_mesh_config(struct ieee80211_sub_if_data *sdata)
         MESHPARAMS_ADD(dot11MeshHWMPmaxPREQretries);
         MESHPARAMS_ADD(path_refresh_time);
         MESHPARAMS_ADD(min_discovery_timeout);
-
+        MESHPARAMS_ADD(dot11MeshHWMPRootMode);
+        MESHPARAMS_ADD(dot11MeshHWMPRannInterval);
+        MESHPARAMS_ADD(dot11MeshGateAnnouncementProtocol);
 #undef MESHPARAMS_ADD
 }
 #endif
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index ea7419050846..c204cee1189c 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -514,6 +514,7 @@ struct ieee80211_if_mesh {
         struct mesh_config mshcfg;
         u32 mesh_seqnum;
         bool accepting_plinks;
+        int num_gates;
         const u8 *ie;
         u8 ie_len;
         enum {
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index 29e9980c8e60..28ab510e621a 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -13,10 +13,6 @@
 #include "ieee80211_i.h"
 #include "mesh.h"
 
-#define IEEE80211_MESH_PEER_INACTIVITY_LIMIT (1800 * HZ)
-#define IEEE80211_MESH_HOUSEKEEPING_INTERVAL (60 * HZ)
-#define IEEE80211_MESH_RANN_INTERVAL         (1 * HZ)
-
 #define MESHCONF_CAPAB_ACCEPT_PLINKS 0x01
 #define MESHCONF_CAPAB_FORWARDING    0x08
 
@@ -27,6 +23,17 @@
 int mesh_allocated;
 static struct kmem_cache *rm_cache;
 
+#ifdef CONFIG_MAC80211_MESH
+bool mesh_action_is_path_sel(struct ieee80211_mgmt *mgmt)
+{
+        return (mgmt->u.action.u.mesh_action.action_code ==
+                        WLAN_MESH_ACTION_HWMP_PATH_SELECTION);
+}
+#else
+bool mesh_action_is_path_sel(struct ieee80211_mgmt *mgmt)
+{ return false; }
+#endif
+
 void ieee80211s_init(void)
 {
         mesh_pathtbl_init();
@@ -204,36 +211,185 @@ int mesh_rmc_check(u8 *sa, struct ieee80211s_hdr *mesh_hdr,
         return 0;
 }
 
-void mesh_mgmt_ies_add(struct sk_buff *skb, struct ieee80211_sub_if_data *sdata)
+int
+mesh_add_meshconf_ie(struct sk_buff *skb, struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
+        u8 *pos, neighbors;
+        u8 meshconf_len = sizeof(struct ieee80211_meshconf_ie);
+
+        if (skb_tailroom(skb) < 2 + meshconf_len)
+                return -ENOMEM;
+
+        pos = skb_put(skb, 2 + meshconf_len);
+        *pos++ = WLAN_EID_MESH_CONFIG;
+        *pos++ = meshconf_len;
+
+        /* Active path selection protocol ID */
+        *pos++ = ifmsh->mesh_pp_id;
+        /* Active path selection metric ID   */
+        *pos++ = ifmsh->mesh_pm_id;
+        /* Congestion control mode identifier */
+        *pos++ = ifmsh->mesh_cc_id;
+        /* Synchronization protocol identifier */
+        *pos++ = ifmsh->mesh_sp_id;
+        /* Authentication Protocol identifier */
+        *pos++ = ifmsh->mesh_auth_id;
+        /* Mesh Formation Info - number of neighbors */
+        neighbors = atomic_read(&ifmsh->mshstats.estab_plinks);
+        /* Number of neighbor mesh STAs or 15 whichever is smaller */
+        neighbors = (neighbors > 15) ? 15 : neighbors;
+        *pos++ = neighbors << 1;
+        /* Mesh capability */
+        ifmsh->accepting_plinks = mesh_plink_availables(sdata);
+        *pos = MESHCONF_CAPAB_FORWARDING;
+        *pos++ |= ifmsh->accepting_plinks ?
+            MESHCONF_CAPAB_ACCEPT_PLINKS : 0x00;
+        *pos++ = 0x00;
+
+        return 0;
+}
+
+int
+mesh_add_meshid_ie(struct sk_buff *skb, struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
+        u8 *pos;
+
+        if (skb_tailroom(skb) < 2 + ifmsh->mesh_id_len)
+                return -ENOMEM;
+
+        pos = skb_put(skb, 2 + ifmsh->mesh_id_len);
+        *pos++ = WLAN_EID_MESH_ID;
+        *pos++ = ifmsh->mesh_id_len;
+        if (ifmsh->mesh_id_len)
+                memcpy(pos, ifmsh->mesh_id, ifmsh->mesh_id_len);
+
+        return 0;
+}
+
+int
+mesh_add_vendor_ies(struct sk_buff *skb, struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
+        u8 offset, len;
+        const u8 *data;
+
+        if (!ifmsh->ie || !ifmsh->ie_len)
+                return 0;
+
+        /* fast-forward to vendor IEs */
+        offset = ieee80211_ie_split_vendor(ifmsh->ie, ifmsh->ie_len, 0);
+
+        if (offset) {
+                len = ifmsh->ie_len - offset;
+                data = ifmsh->ie + offset;
+                if (skb_tailroom(skb) < len)
+                        return -ENOMEM;
+                memcpy(skb_put(skb, len), data, len);
+        }
+
+        return 0;
+}
+
+int
+mesh_add_rsn_ie(struct sk_buff *skb, struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
+        u8 len = 0;
+        const u8 *data;
+
+        if (!ifmsh->ie || !ifmsh->ie_len)
+                return 0;
+
+        /* find RSN IE */
+        data = ifmsh->ie;
+        while (data < ifmsh->ie + ifmsh->ie_len) {
+                if (*data == WLAN_EID_RSN) {
+                        len = data[1] + 2;
+                        break;
+                }
+                data++;
+        }
+
+        if (len) {
+                if (skb_tailroom(skb) < len)
+                        return -ENOMEM;
+                memcpy(skb_put(skb, len), data, len);
+        }
+
+        return 0;
+}
+
+int
+mesh_add_srates_ie(struct sk_buff *skb, struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_supported_band *sband;
-        u8 *pos;
-        int len, i, rate;
-        u8 neighbors;
+        int rate;
+        u8 i, rates, *pos;
 
         sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
-        len = sband->n_bitrates;
-        if (len > 8)
-                len = 8;
-        pos = skb_put(skb, len + 2);
+        rates = sband->n_bitrates;
+        if (rates > 8)
+                rates = 8;
+
+        if (skb_tailroom(skb) < rates + 2)
+                return -ENOMEM;
+
+        pos = skb_put(skb, rates + 2);
         *pos++ = WLAN_EID_SUPP_RATES;
-        *pos++ = len;
-        for (i = 0; i < len; i++) {
+        *pos++ = rates;
+        for (i = 0; i < rates; i++) {
                 rate = sband->bitrates[i].bitrate;
                 *pos++ = (u8) (rate / 5);
         }
 
-        if (sband->n_bitrates > len) {
-                pos = skb_put(skb, sband->n_bitrates - len + 2);
+        return 0;
+}
+
+int
+mesh_add_ext_srates_ie(struct sk_buff *skb,
+                       struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_supported_band *sband;
+        int rate;
+        u8 i, exrates, *pos;
+
+        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
+        exrates = sband->n_bitrates;
+        if (exrates > 8)
+                exrates -= 8;
+        else
+                exrates = 0;
+
+        if (skb_tailroom(skb) < exrates + 2)
+                return -ENOMEM;
+
+        if (exrates) {
+                pos = skb_put(skb, exrates + 2);
                 *pos++ = WLAN_EID_EXT_SUPP_RATES;
-                *pos++ = sband->n_bitrates - len;
-                for (i = len; i < sband->n_bitrates; i++) {
+                *pos++ = exrates;
+                for (i = 8; i < sband->n_bitrates; i++) {
                         rate = sband->bitrates[i].bitrate;
                         *pos++ = (u8) (rate / 5);
                 }
         }
+        return 0;
+}
 
+int mesh_add_ds_params_ie(struct sk_buff *skb,
+                          struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_supported_band *sband;
+        u8 *pos;
+
+        if (skb_tailroom(skb) < 3)
+                return -ENOMEM;
+
+        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
         if (sband->band == IEEE80211_BAND_2GHZ) {
                 pos = skb_put(skb, 2 + 1);
                 *pos++ = WLAN_EID_DS_PARAMS;
@@ -241,53 +397,9 @@ void mesh_mgmt_ies_add(struct sk_buff *skb, struct ieee80211_sub_if_data *sdata)
                 *pos++ = ieee80211_frequency_to_channel(local->hw.conf.channel->center_freq);
         }
 
-        pos = skb_put(skb, 2 + sdata->u.mesh.mesh_id_len);
-        *pos++ = WLAN_EID_MESH_ID;
-        *pos++ = sdata->u.mesh.mesh_id_len;
-        if (sdata->u.mesh.mesh_id_len)
-                memcpy(pos, sdata->u.mesh.mesh_id, sdata->u.mesh.mesh_id_len);
-
-        pos = skb_put(skb, 2 + sizeof(struct ieee80211_meshconf_ie));
-        *pos++ = WLAN_EID_MESH_CONFIG;
-        *pos++ = sizeof(struct ieee80211_meshconf_ie);
-
-        /* Active path selection protocol ID */
-        *pos++ = sdata->u.mesh.mesh_pp_id;
-
-        /* Active path selection metric ID   */
-        *pos++ = sdata->u.mesh.mesh_pm_id;
-
-        /* Congestion control mode identifier */
-        *pos++ = sdata->u.mesh.mesh_cc_id;
-
-        /* Synchronization protocol identifier */
-        *pos++ = sdata->u.mesh.mesh_sp_id;
-
-        /* Authentication Protocol identifier */
-        *pos++ = sdata->u.mesh.mesh_auth_id;
-
-        /* Mesh Formation Info - number of neighbors */
-        neighbors = atomic_read(&sdata->u.mesh.mshstats.estab_plinks);
-        /* Number of neighbor mesh STAs or 15 whichever is smaller */
-        neighbors = (neighbors > 15) ? 15 : neighbors;
-        *pos++ = neighbors << 1;
-
-        /* Mesh capability */
-        sdata->u.mesh.accepting_plinks = mesh_plink_availables(sdata);
-        *pos = MESHCONF_CAPAB_FORWARDING;
-        *pos++ |= sdata->u.mesh.accepting_plinks ?
-            MESHCONF_CAPAB_ACCEPT_PLINKS : 0x00;
-        *pos++ = 0x00;
-
-        if (sdata->u.mesh.ie) {
-                int len = sdata->u.mesh.ie_len;
-                const u8 *data = sdata->u.mesh.ie;
-                if (skb_tailroom(skb) > len)
-                        memcpy(skb_put(skb, len), data, len);
-        }
+        return 0;
 }
 
-
 static void ieee80211_mesh_path_timer(unsigned long data)
 {
         struct ieee80211_sub_if_data *sdata =
@@ -425,7 +537,8 @@ static void ieee80211_mesh_rootpath(struct ieee80211_sub_if_data *sdata)
 
         mesh_path_tx_root_frame(sdata);
         mod_timer(&ifmsh->mesh_path_root_timer,
-                  round_jiffies(jiffies + IEEE80211_MESH_RANN_INTERVAL));
+                  round_jiffies(TU_TO_EXP_TIME(
+                                  ifmsh->mshcfg.dot11MeshHWMPRannInterval)));
 }
 
 #ifdef CONFIG_PM
@@ -433,7 +546,7 @@ void ieee80211_mesh_quiesce(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
 
-        /* use atomic bitops in case both timers fire at the same time */
+        /* use atomic bitops in case all timers fire at the same time */
 
         if (del_timer_sync(&ifmsh->housekeeping_timer))
                 set_bit(TMR_RUNNING_HK, &ifmsh->timers_running);
@@ -557,11 +670,18 @@ static void ieee80211_mesh_rx_mgmt_action(struct ieee80211_sub_if_data *sdata,
                                           struct ieee80211_rx_status *rx_status)
 {
         switch (mgmt->u.action.category) {
-        case WLAN_CATEGORY_MESH_ACTION:
-                mesh_rx_plink_frame(sdata, mgmt, len, rx_status);
+        case WLAN_CATEGORY_SELF_PROTECTED:
+                switch (mgmt->u.action.u.self_prot.action_code) {
+                case WLAN_SP_MESH_PEERING_OPEN:
+                case WLAN_SP_MESH_PEERING_CLOSE:
+                case WLAN_SP_MESH_PEERING_CONFIRM:
+                        mesh_rx_plink_frame(sdata, mgmt, len, rx_status);
+                        break;
+                }
                 break;
-        case WLAN_CATEGORY_MESH_PATH_SEL:
-                mesh_rx_path_sel_frame(sdata, mgmt, len);
+        case WLAN_CATEGORY_MESH_ACTION:
+                if (mesh_action_is_path_sel(mgmt))
+                        mesh_rx_path_sel_frame(sdata, mgmt, len);
                 break;
         }
 }
@@ -633,6 +753,7 @@ void ieee80211_mesh_init_sdata(struct ieee80211_sub_if_data *sdata)
         ifmsh->accepting_plinks = true;
         ifmsh->preq_id = 0;
         ifmsh->sn = 0;
+        ifmsh->num_gates = 0;
         atomic_set(&ifmsh->mpaths, 0);
         mesh_rmc_init(sdata);
         ifmsh->last_preq = jiffies;
diff --git a/net/mac80211/mesh.h b/net/mac80211/mesh.h
index 249e733362e7..20272072171f 100644
--- a/net/mac80211/mesh.h
+++ b/net/mac80211/mesh.h
@@ -81,6 +81,7 @@ enum mesh_deferred_task_flags {
  * @discovery_retries: number of discovery retries
  * @flags: mesh path flags, as specified on &enum mesh_path_flags
  * @state_lock: mesh path state lock
+ * @is_gate: the destination station of this path is a mesh gate
  *
  *
  * The combination of dst and sdata is unique in the mesh path table. Since the
@@ -104,6 +105,7 @@ struct mesh_path {
         u8 discovery_retries;
         enum mesh_path_flags flags;
         spinlock_t state_lock;
+        bool is_gate;
 };
 
 /**
@@ -120,6 +122,9 @@ struct mesh_path {
  *      buckets
  * @mean_chain_len: maximum average length for the hash buckets' list, if it is
  *      reached, the table will grow
+ * @known_gates: list of known mesh gates and their mpaths by the station. The
+ * gate's mpath may or may not be resolved and active.
+ *
  * rcu_head: RCU head to free the table
  */
 struct mesh_table {
@@ -133,6 +138,8 @@ struct mesh_table {
         int (*copy_node) (struct hlist_node *p, struct mesh_table *newtbl);
         int size_order;
         int mean_chain_len;
+        struct hlist_head *known_gates;
+        spinlock_t gates_lock;
 
         struct rcu_head rcu_head;
 };
@@ -166,6 +173,8 @@ struct mesh_rmc {
         u32 idx_mask;
 };
 
+#define IEEE80211_MESH_PEER_INACTIVITY_LIMIT (1800 * HZ)
+#define IEEE80211_MESH_HOUSEKEEPING_INTERVAL (60 * HZ)
 
 #define MESH_DEFAULT_BEACON_INTERVAL            1000    /* in 1024 us units */
 
@@ -177,14 +186,6 @@ struct mesh_rmc {
 /* Maximum number of paths per interface */
 #define MESH_MAX_MPATHS         1024
 
-/* Pending ANA approval */
-#define MESH_PATH_SEL_ACTION    0
-
-/* PERR reason codes */
-#define PEER_RCODE_UNSPECIFIED  11
-#define PERR_RCODE_NO_ROUTE     12
-#define PERR_RCODE_DEST_UNREACH 13
-
 /* Public interfaces */
 /* Various */
 int ieee80211_fill_mesh_addresses(struct ieee80211_hdr *hdr, __le16 *fc,
@@ -199,6 +200,20 @@ bool mesh_matches_local(struct ieee802_11_elems *ie,
 void mesh_ids_set_default(struct ieee80211_if_mesh *mesh);
 void mesh_mgmt_ies_add(struct sk_buff *skb,
                 struct ieee80211_sub_if_data *sdata);
+int mesh_add_meshconf_ie(struct sk_buff *skb,
+                         struct ieee80211_sub_if_data *sdata);
+int mesh_add_meshid_ie(struct sk_buff *skb,
+                       struct ieee80211_sub_if_data *sdata);
+int mesh_add_rsn_ie(struct sk_buff *skb,
+                    struct ieee80211_sub_if_data *sdata);
+int mesh_add_vendor_ies(struct sk_buff *skb,
+                        struct ieee80211_sub_if_data *sdata);
+int mesh_add_srates_ie(struct sk_buff *skb,
+                       struct ieee80211_sub_if_data *sdata);
+int mesh_add_ext_srates_ie(struct sk_buff *skb,
+                           struct ieee80211_sub_if_data *sdata);
+int mesh_add_ds_params_ie(struct sk_buff *skb,
+                          struct ieee80211_sub_if_data *sdata);
 void mesh_rmc_free(struct ieee80211_sub_if_data *sdata);
 int mesh_rmc_init(struct ieee80211_sub_if_data *sdata);
 void ieee80211s_init(void);
@@ -227,6 +242,10 @@ void mesh_path_flush(struct ieee80211_sub_if_data *sdata);
 void mesh_rx_path_sel_frame(struct ieee80211_sub_if_data *sdata,
                 struct ieee80211_mgmt *mgmt, size_t len);
 int mesh_path_add(u8 *dst, struct ieee80211_sub_if_data *sdata);
+
+int mesh_path_add_gate(struct mesh_path *mpath);
+int mesh_path_send_to_gates(struct mesh_path *mpath);
+int mesh_gate_num(struct ieee80211_sub_if_data *sdata);
 /* Mesh plinks */
 void mesh_neighbour_update(u8 *hw_addr, u32 rates,
                 struct ieee80211_sub_if_data *sdata,
@@ -262,6 +281,7 @@ void mesh_path_quiesce(struct ieee80211_sub_if_data *sdata);
 void mesh_path_restart(struct ieee80211_sub_if_data *sdata);
 void mesh_path_tx_root_frame(struct ieee80211_sub_if_data *sdata);
 
+bool mesh_action_is_path_sel(struct ieee80211_mgmt *mgmt);
 extern int mesh_paths_generation;
 
 #ifdef CONFIG_MAC80211_MESH
diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
index 3d8e55ae6ab6..fd4f76a3e139 100644
--- a/net/mac80211/mesh_hwmp.c
+++ b/net/mac80211/mesh_hwmp.c
@@ -11,7 +11,8 @@
 #include "mesh.h"
 
 #ifdef CONFIG_MAC80211_VERBOSE_MHWMP_DEBUG
-#define mhwmp_dbg(fmt, args...)   printk(KERN_DEBUG "Mesh HWMP: " fmt, ##args)
+#define mhwmp_dbg(fmt, args...) \
+        printk(KERN_DEBUG "Mesh HWMP (%s): " fmt "\n", sdata->name, ##args)
 #else
 #define mhwmp_dbg(fmt, args...)   do { (void)(0); } while (0)
 #endif
@@ -68,12 +69,12 @@ static inline u32 u16_field_get(u8 *preq_elem, int offset, bool ae)
 #define PREP_IE_FLAGS(x)        PREQ_IE_FLAGS(x)
 #define PREP_IE_HOPCOUNT(x)     PREQ_IE_HOPCOUNT(x)
 #define PREP_IE_TTL(x)          PREQ_IE_TTL(x)
-#define PREP_IE_ORIG_ADDR(x)    (x + 3)
-#define PREP_IE_ORIG_SN(x)      u32_field_get(x, 9, 0)
+#define PREP_IE_ORIG_ADDR(x)    (AE_F_SET(x) ? x + 27 : x + 21)
+#define PREP_IE_ORIG_SN(x)      u32_field_get(x, 27, AE_F_SET(x))
 #define PREP_IE_LIFETIME(x)     u32_field_get(x, 13, AE_F_SET(x))
 #define PREP_IE_METRIC(x)       u32_field_get(x, 17, AE_F_SET(x))
-#define PREP_IE_TARGET_ADDR(x)  (AE_F_SET(x) ? x + 27 : x + 21)
-#define PREP_IE_TARGET_SN(x)    u32_field_get(x, 27, AE_F_SET(x))
+#define PREP_IE_TARGET_ADDR(x)  (x + 3)
+#define PREP_IE_TARGET_SN(x)    u32_field_get(x, 9, 0)
 
 #define PERR_IE_TTL(x)          (*(x))
 #define PERR_IE_TARGET_FLAGS(x) (*(x + 2))
@@ -132,24 +133,25 @@ static int mesh_path_sel_frame_tx(enum mpath_frame_type action, u8 flags,
         memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
         /* BSSID == SA */
         memcpy(mgmt->bssid, sdata->vif.addr, ETH_ALEN);
-        mgmt->u.action.category = WLAN_CATEGORY_MESH_PATH_SEL;
-        mgmt->u.action.u.mesh_action.action_code = MESH_PATH_SEL_ACTION;
+        mgmt->u.action.category = WLAN_CATEGORY_MESH_ACTION;
+        mgmt->u.action.u.mesh_action.action_code =
+                                        WLAN_MESH_ACTION_HWMP_PATH_SELECTION;
 
         switch (action) {
         case MPATH_PREQ:
-                mhwmp_dbg("sending PREQ to %pM\n", target);
+                mhwmp_dbg("sending PREQ to %pM", target);
                 ie_len = 37;
                 pos = skb_put(skb, 2 + ie_len);
                 *pos++ = WLAN_EID_PREQ;
                 break;
         case MPATH_PREP:
-                mhwmp_dbg("sending PREP to %pM\n", target);
+                mhwmp_dbg("sending PREP to %pM", target);
                 ie_len = 31;
                 pos = skb_put(skb, 2 + ie_len);
                 *pos++ = WLAN_EID_PREP;
                 break;
         case MPATH_RANN:
-                mhwmp_dbg("sending RANN from %pM\n", orig_addr);
+                mhwmp_dbg("sending RANN from %pM", orig_addr);
                 ie_len = sizeof(struct ieee80211_rann_ie);
                 pos = skb_put(skb, 2 + ie_len);
                 *pos++ = WLAN_EID_RANN;
@@ -163,29 +165,37 @@ static int mesh_path_sel_frame_tx(enum mpath_frame_type action, u8 flags,
         *pos++ = flags;
         *pos++ = hop_count;
         *pos++ = ttl;
-        if (action == MPATH_PREQ) {
-                memcpy(pos, &preq_id, 4);
+        if (action == MPATH_PREP) {
+                memcpy(pos, target, ETH_ALEN);
+                pos += ETH_ALEN;
+                memcpy(pos, &target_sn, 4);
                 pos += 4;
-        }
-        memcpy(pos, orig_addr, ETH_ALEN);
-        pos += ETH_ALEN;
-        memcpy(pos, &orig_sn, 4);
-        pos += 4;
-        if (action != MPATH_RANN) {
-                memcpy(pos, &lifetime, 4);
+        } else {
+                if (action == MPATH_PREQ) {
+                        memcpy(pos, &preq_id, 4);
+                        pos += 4;
+                }
+                memcpy(pos, orig_addr, ETH_ALEN);
+                pos += ETH_ALEN;
+                memcpy(pos, &orig_sn, 4);
                 pos += 4;
         }
+        memcpy(pos, &lifetime, 4);      /* interval for RANN */
+        pos += 4;
         memcpy(pos, &metric, 4);
         pos += 4;
         if (action == MPATH_PREQ) {
-                /* destination count */
-                *pos++ = 1;
+                *pos++ = 1; /* destination count */
                 *pos++ = target_flags;
-        }
-        if (action != MPATH_RANN) {
                 memcpy(pos, target, ETH_ALEN);
                 pos += ETH_ALEN;
                 memcpy(pos, &target_sn, 4);
+                pos += 4;
+        } else if (action == MPATH_PREP) {
+                memcpy(pos, orig_addr, ETH_ALEN);
+                pos += ETH_ALEN;
+                memcpy(pos, &orig_sn, 4);
+                pos += 4;
         }
 
         ieee80211_tx_skb(sdata, skb);
@@ -224,9 +234,11 @@ int mesh_path_error_tx(u8 ttl, u8 *target, __le32 target_sn,
 
         memcpy(mgmt->da, ra, ETH_ALEN);
         memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
-        /* BSSID is left zeroed, wildcard value */
-        mgmt->u.action.category = WLAN_CATEGORY_MESH_PATH_SEL;
-        mgmt->u.action.u.mesh_action.action_code = MESH_PATH_SEL_ACTION;
+        /* BSSID == SA */
+        memcpy(mgmt->bssid, sdata->vif.addr, ETH_ALEN);
+        mgmt->u.action.category = WLAN_CATEGORY_MESH_ACTION;
+        mgmt->u.action.u.mesh_action.action_code =
+                                        WLAN_MESH_ACTION_HWMP_PATH_SELECTION;
         ie_len = 15;
         pos = skb_put(skb, 2 + ie_len);
         *pos++ = WLAN_EID_PERR;
@@ -483,10 +495,10 @@ static void hwmp_preq_frame_process(struct ieee80211_sub_if_data *sdata,
         orig_sn = PREQ_IE_ORIG_SN(preq_elem);
         target_flags = PREQ_IE_TARGET_F(preq_elem);
 
-        mhwmp_dbg("received PREQ from %pM\n", orig_addr);
+        mhwmp_dbg("received PREQ from %pM", orig_addr);
 
         if (memcmp(target_addr, sdata->vif.addr, ETH_ALEN) == 0) {
-                mhwmp_dbg("PREQ is for us\n");
+                mhwmp_dbg("PREQ is for us");
                 forward = false;
                 reply = true;
                 metric = 0;
@@ -522,7 +534,7 @@ static void hwmp_preq_frame_process(struct ieee80211_sub_if_data *sdata,
                 lifetime = PREQ_IE_LIFETIME(preq_elem);
                 ttl = ifmsh->mshcfg.element_ttl;
                 if (ttl != 0) {
-                        mhwmp_dbg("replying to the PREQ\n");
+                        mhwmp_dbg("replying to the PREQ");
                         mesh_path_sel_frame_tx(MPATH_PREP, 0, target_addr,
                                 cpu_to_le32(target_sn), 0, orig_addr,
                                 cpu_to_le32(orig_sn), mgmt->sa, 0, ttl,
@@ -542,7 +554,7 @@ static void hwmp_preq_frame_process(struct ieee80211_sub_if_data *sdata,
                         ifmsh->mshstats.dropped_frames_ttl++;
                         return;
                 }
-                mhwmp_dbg("forwarding the PREQ from %pM\n", orig_addr);
+                mhwmp_dbg("forwarding the PREQ from %pM", orig_addr);
                 --ttl;
                 flags = PREQ_IE_FLAGS(preq_elem);
                 preq_id = PREQ_IE_PREQ_ID(preq_elem);
@@ -577,7 +589,7 @@ static void hwmp_prep_frame_process(struct ieee80211_sub_if_data *sdata,
         u8 next_hop[ETH_ALEN];
         u32 target_sn, orig_sn, lifetime;
 
-        mhwmp_dbg("received PREP from %pM\n", PREP_IE_ORIG_ADDR(prep_elem));
+        mhwmp_dbg("received PREP from %pM", PREP_IE_ORIG_ADDR(prep_elem));
 
         /* Note that we divert from the draft nomenclature and denominate
          * destination to what the draft refers to as origininator. So in this
@@ -683,6 +695,8 @@ static void hwmp_rann_frame_process(struct ieee80211_sub_if_data *sdata,
         u8 ttl, flags, hopcount;
         u8 *orig_addr;
         u32 orig_sn, metric;
+        u32 interval = ifmsh->mshcfg.dot11MeshHWMPRannInterval;
+        bool root_is_gate;
 
         ttl = rann->rann_ttl;
         if (ttl <= 1) {
@@ -691,12 +705,19 @@ static void hwmp_rann_frame_process(struct ieee80211_sub_if_data *sdata,
         }
         ttl--;
         flags = rann->rann_flags;
+        root_is_gate = !!(flags & RANN_FLAG_IS_GATE);
         orig_addr = rann->rann_addr;
         orig_sn = rann->rann_seq;
         hopcount = rann->rann_hopcount;
         hopcount++;
         metric = rann->rann_metric;
-        mhwmp_dbg("received RANN from %pM\n", orig_addr);
+
+        /*  Ignore our own RANNs */
+        if (memcmp(orig_addr, sdata->vif.addr, ETH_ALEN) == 0)
+                return;
+
+        mhwmp_dbg("received RANN from %pM (is_gate=%d)", orig_addr,
+                        root_is_gate);
 
         rcu_read_lock();
         mpath = mesh_path_lookup(orig_addr, sdata);
@@ -708,18 +729,28 @@ static void hwmp_rann_frame_process(struct ieee80211_sub_if_data *sdata,
                         sdata->u.mesh.mshstats.dropped_frames_no_route++;
                         return;
                 }
-                mesh_queue_preq(mpath,
-                                PREQ_Q_F_START | PREQ_Q_F_REFRESH);
         }
+
+        if ((!(mpath->flags & (MESH_PATH_ACTIVE | MESH_PATH_RESOLVING)) ||
+             time_after(jiffies, mpath->exp_time - 1*HZ)) &&
+             !(mpath->flags & MESH_PATH_FIXED)) {
+                mhwmp_dbg("%s time to refresh root mpath %pM", sdata->name,
+                                                               orig_addr);
+                mesh_queue_preq(mpath, PREQ_Q_F_START | PREQ_Q_F_REFRESH);
+        }
+
         if (mpath->sn < orig_sn) {
                 mesh_path_sel_frame_tx(MPATH_RANN, flags, orig_addr,
                                        cpu_to_le32(orig_sn),
                                        0, NULL, 0, broadcast_addr,
-                                       hopcount, ttl, 0,
+                                       hopcount, ttl, cpu_to_le32(interval),
                                        cpu_to_le32(metric + mpath->metric),
                                        0, sdata);
                 mpath->sn = orig_sn;
         }
+        if (root_is_gate)
+                mesh_path_add_gate(mpath);
+
         rcu_read_unlock();
 }
 
@@ -787,7 +818,7 @@ static void mesh_queue_preq(struct mesh_path *mpath, u8 flags)
 
         preq_node = kmalloc(sizeof(struct mesh_preq_queue), GFP_ATOMIC);
         if (!preq_node) {
-                mhwmp_dbg("could not allocate PREQ node\n");
+                mhwmp_dbg("could not allocate PREQ node");
                 return;
         }
 
@@ -796,7 +827,7 @@ static void mesh_queue_preq(struct mesh_path *mpath, u8 flags)
                 spin_unlock_bh(&ifmsh->mesh_preq_queue_lock);
                 kfree(preq_node);
                 if (printk_ratelimit())
-                        mhwmp_dbg("PREQ node queue full\n");
+                        mhwmp_dbg("PREQ node queue full");
                 return;
         }
 
@@ -981,35 +1012,46 @@ void mesh_path_timer(unsigned long data)
 {
         struct mesh_path *mpath = (void *) data;
         struct ieee80211_sub_if_data *sdata = mpath->sdata;
+        int ret;
 
         if (sdata->local->quiescing)
                 return;
 
         spin_lock_bh(&mpath->state_lock);
         if (mpath->flags & MESH_PATH_RESOLVED ||
-                        (!(mpath->flags & MESH_PATH_RESOLVING)))
+                        (!(mpath->flags & MESH_PATH_RESOLVING))) {
                 mpath->flags &= ~(MESH_PATH_RESOLVING | MESH_PATH_RESOLVED);
-        else if (mpath->discovery_retries < max_preq_retries(sdata)) {
+                spin_unlock_bh(&mpath->state_lock);
+        } else if (mpath->discovery_retries < max_preq_retries(sdata)) {
                 ++mpath->discovery_retries;
                 mpath->discovery_timeout *= 2;
+                spin_unlock_bh(&mpath->state_lock);
                 mesh_queue_preq(mpath, 0);
         } else {
                 mpath->flags = 0;
                 mpath->exp_time = jiffies;
-                mesh_path_flush_pending(mpath);
+                spin_unlock_bh(&mpath->state_lock);
+                if (!mpath->is_gate && mesh_gate_num(sdata) > 0) {
+                        ret = mesh_path_send_to_gates(mpath);
+                        if (ret)
+                                mhwmp_dbg("no gate was reachable");
+                } else
+                        mesh_path_flush_pending(mpath);
         }
-
-        spin_unlock_bh(&mpath->state_lock);
 }
 
 void
 mesh_path_tx_root_frame(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
+        u32 interval = ifmsh->mshcfg.dot11MeshHWMPRannInterval;
+        u8 flags;
 
-        mesh_path_sel_frame_tx(MPATH_RANN, 0, sdata->vif.addr,
+        flags = (ifmsh->mshcfg.dot11MeshGateAnnouncementProtocol)
+                        ? RANN_FLAG_IS_GATE : 0;
+        mesh_path_sel_frame_tx(MPATH_RANN, flags, sdata->vif.addr,
                                cpu_to_le32(++ifmsh->sn),
                                0, NULL, 0, broadcast_addr,
                                0, sdata->u.mesh.mshcfg.element_ttl,
-                               0, 0, 0, sdata);
+                               cpu_to_le32(interval), 0, 0, sdata);
 }
diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c
index dc7ae8d31aaf..7fde32159fdc 100644
--- a/net/mac80211/mesh_pathtbl.c
+++ b/net/mac80211/mesh_pathtbl.c
@@ -17,6 +17,12 @@
 #include "ieee80211_i.h"
 #include "mesh.h"
 
+#ifdef CONFIG_MAC80211_VERBOSE_MPATH_DEBUG
+#define mpath_dbg(fmt, args...) printk(KERN_DEBUG fmt, ##args)
+#else
+#define mpath_dbg(fmt, args...) do { (void)(0); } while (0)
+#endif
+
 /* There will be initially 2^INIT_PATHS_SIZE_ORDER buckets */
 #define INIT_PATHS_SIZE_ORDER   2
 
@@ -60,6 +66,8 @@ static inline struct mesh_table *resize_dereference_mpp_paths(void)
                 lockdep_is_held(&pathtbl_resize_lock));
 }
 
+static int mesh_gate_add(struct mesh_table *tbl, struct mesh_path *mpath);
+
 /*
  * CAREFUL -- "tbl" must not be an expression,
  * in particular not an rcu_dereference(), since
@@ -103,6 +111,7 @@ static struct mesh_table *mesh_table_alloc(int size_order)
                         sizeof(newtbl->hash_rnd));
         for (i = 0; i <= newtbl->hash_mask; i++)
                 spin_lock_init(&newtbl->hashwlock[i]);
+        spin_lock_init(&newtbl->gates_lock);
 
         return newtbl;
 }
@@ -118,6 +127,7 @@ static void mesh_table_free(struct mesh_table *tbl, bool free_leafs)
 {
         struct hlist_head *mesh_hash;
         struct hlist_node *p, *q;
+        struct mpath_node *gate;
         int i;
 
         mesh_hash = tbl->hash_buckets;
@@ -129,6 +139,17 @@ static void mesh_table_free(struct mesh_table *tbl, bool free_leafs)
                 }
                 spin_unlock_bh(&tbl->hashwlock[i]);
         }
+        if (free_leafs) {
+                spin_lock_bh(&tbl->gates_lock);
+                hlist_for_each_entry_safe(gate, p, q,
+                                         tbl->known_gates, list) {
+                        hlist_del(&gate->list);
+                        kfree(gate);
+                }
+                kfree(tbl->known_gates);
+                spin_unlock_bh(&tbl->gates_lock);
+        }
+
         __mesh_table_free(tbl);
 }
 
@@ -146,6 +167,7 @@ static int mesh_table_grow(struct mesh_table *oldtbl,
         newtbl->free_node = oldtbl->free_node;
         newtbl->mean_chain_len = oldtbl->mean_chain_len;
         newtbl->copy_node = oldtbl->copy_node;
+        newtbl->known_gates = oldtbl->known_gates;
         atomic_set(&newtbl->entries, atomic_read(&oldtbl->entries));
 
         oldhash = oldtbl->hash_buckets;
@@ -205,6 +227,111 @@ void mesh_path_assign_nexthop(struct mesh_path *mpath, struct sta_info *sta)
         spin_unlock_irqrestore(&mpath->frame_queue.lock, flags);
 }
 
+static void prepare_for_gate(struct sk_buff *skb, char *dst_addr,
+                             struct mesh_path *gate_mpath)
+{
+        struct ieee80211_hdr *hdr;
+        struct ieee80211s_hdr *mshdr;
+        int mesh_hdrlen, hdrlen;
+        char *next_hop;
+
+        hdr = (struct ieee80211_hdr *) skb->data;
+        hdrlen = ieee80211_hdrlen(hdr->frame_control);
+        mshdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
+
+        if (!(mshdr->flags & MESH_FLAGS_AE)) {
+                /* size of the fixed part of the mesh header */
+                mesh_hdrlen = 6;
+
+                /* make room for the two extended addresses */
+                skb_push(skb, 2 * ETH_ALEN);
+                memmove(skb->data, hdr, hdrlen + mesh_hdrlen);
+
+                hdr = (struct ieee80211_hdr *) skb->data;
+
+                /* we preserve the previous mesh header and only add
+                 * the new addreses */
+                mshdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
+                mshdr->flags = MESH_FLAGS_AE_A5_A6;
+                memcpy(mshdr->eaddr1, hdr->addr3, ETH_ALEN);
+                memcpy(mshdr->eaddr2, hdr->addr4, ETH_ALEN);
+        }
+
+        /* update next hop */
+        hdr = (struct ieee80211_hdr *) skb->data;
+        rcu_read_lock();
+        next_hop = rcu_dereference(gate_mpath->next_hop)->sta.addr;
+        memcpy(hdr->addr1, next_hop, ETH_ALEN);
+        rcu_read_unlock();
+        memcpy(hdr->addr3, dst_addr, ETH_ALEN);
+}
+
+/**
+ *
+ * mesh_path_move_to_queue - Move or copy frames from one mpath queue to another
+ *
+ * This function is used to transfer or copy frames from an unresolved mpath to
+ * a gate mpath.  The function also adds the Address Extension field and
+ * updates the next hop.
+ *
+ * If a frame already has an Address Extension field, only the next hop and
+ * destination addresses are updated.
+ *
+ * The gate mpath must be an active mpath with a valid mpath->next_hop.
+ *
+ * @mpath: An active mpath the frames will be sent to (i.e. the gate)
+ * @from_mpath: The failed mpath
+ * @copy: When true, copy all the frames to the new mpath queue.  When false,
+ * move them.
+ */
+static void mesh_path_move_to_queue(struct mesh_path *gate_mpath,
+                                    struct mesh_path *from_mpath,
+                                    bool copy)
+{
+        struct sk_buff *skb, *cp_skb = NULL;
+        struct sk_buff_head gateq, failq;
+        unsigned long flags;
+        int num_skbs;
+
+        BUG_ON(gate_mpath == from_mpath);
+        BUG_ON(!gate_mpath->next_hop);
+
+        __skb_queue_head_init(&gateq);
+        __skb_queue_head_init(&failq);
+
+        spin_lock_irqsave(&from_mpath->frame_queue.lock, flags);
+        skb_queue_splice_init(&from_mpath->frame_queue, &failq);
+        spin_unlock_irqrestore(&from_mpath->frame_queue.lock, flags);
+
+        num_skbs = skb_queue_len(&failq);
+
+        while (num_skbs--) {
+                skb = __skb_dequeue(&failq);
+                if (copy)
+                        cp_skb = skb_copy(skb, GFP_ATOMIC);
+
+                prepare_for_gate(skb, gate_mpath->dst, gate_mpath);
+                __skb_queue_tail(&gateq, skb);
+
+                if (copy && cp_skb)
+                        __skb_queue_tail(&failq, cp_skb);
+        }
+
+        spin_lock_irqsave(&gate_mpath->frame_queue.lock, flags);
+        skb_queue_splice(&gateq, &gate_mpath->frame_queue);
+        mpath_dbg("Mpath queue for gate %pM has %d frames\n",
+                        gate_mpath->dst,
+                        skb_queue_len(&gate_mpath->frame_queue));
+        spin_unlock_irqrestore(&gate_mpath->frame_queue.lock, flags);
+
+        if (!copy)
+                return;
+
+        spin_lock_irqsave(&from_mpath->frame_queue.lock, flags);
+        skb_queue_splice(&failq, &from_mpath->frame_queue);
+        spin_unlock_irqrestore(&from_mpath->frame_queue.lock, flags);
+}
+
 
 /**
  * mesh_path_lookup - look up a path in the mesh path table
@@ -304,6 +431,109 @@ struct mesh_path *mesh_path_lookup_by_idx(int idx, struct ieee80211_sub_if_data
         return NULL;
 }
 
+static void mesh_gate_node_reclaim(struct rcu_head *rp)
+{
+        struct mpath_node *node = container_of(rp, struct mpath_node, rcu);
+        kfree(node);
+}
+
+/**
+ * mesh_gate_add - mark mpath as path to a mesh gate and add to known_gates
+ * @mesh_tbl: table which contains known_gates list
+ * @mpath: mpath to known mesh gate
+ *
+ * Returns: 0 on success
+ *
+ */
+static int mesh_gate_add(struct mesh_table *tbl, struct mesh_path *mpath)
+{
+        struct mpath_node *gate, *new_gate;
+        struct hlist_node *n;
+        int err;
+
+        rcu_read_lock();
+        tbl = rcu_dereference(tbl);
+
+        hlist_for_each_entry_rcu(gate, n, tbl->known_gates, list)
+                if (gate->mpath == mpath) {
+                        err = -EEXIST;
+                        goto err_rcu;
+                }
+
+        new_gate = kzalloc(sizeof(struct mpath_node), GFP_ATOMIC);
+        if (!new_gate) {
+                err = -ENOMEM;
+                goto err_rcu;
+        }
+
+        mpath->is_gate = true;
+        mpath->sdata->u.mesh.num_gates++;
+        new_gate->mpath = mpath;
+        spin_lock_bh(&tbl->gates_lock);
+        hlist_add_head_rcu(&new_gate->list, tbl->known_gates);
+        spin_unlock_bh(&tbl->gates_lock);
+        rcu_read_unlock();
+        mpath_dbg("Mesh path (%s): Recorded new gate: %pM. %d known gates\n",
+                  mpath->sdata->name, mpath->dst,
+                  mpath->sdata->u.mesh.num_gates);
+        return 0;
+err_rcu:
+        rcu_read_unlock();
+        return err;
+}
+
+/**
+ * mesh_gate_del - remove a mesh gate from the list of known gates
+ * @tbl: table which holds our list of known gates
+ * @mpath: gate mpath
+ *
+ * Returns: 0 on success
+ *
+ * Locking: must be called inside rcu_read_lock() section
+ */
+static int mesh_gate_del(struct mesh_table *tbl, struct mesh_path *mpath)
+{
+        struct mpath_node *gate;
+        struct hlist_node *p, *q;
+
+        tbl = rcu_dereference(tbl);
+
+        hlist_for_each_entry_safe(gate, p, q, tbl->known_gates, list)
+                if (gate->mpath == mpath) {
+                        spin_lock_bh(&tbl->gates_lock);
+                        hlist_del_rcu(&gate->list);
+                        call_rcu(&gate->rcu, mesh_gate_node_reclaim);
+                        spin_unlock_bh(&tbl->gates_lock);
+                        mpath->sdata->u.mesh.num_gates--;
+                        mpath->is_gate = false;
+                        mpath_dbg("Mesh path (%s): Deleted gate: %pM. "
+                                  "%d known gates\n", mpath->sdata->name,
+                                  mpath->dst, mpath->sdata->u.mesh.num_gates);
+                        break;
+                }
+
+        return 0;
+}
+
+/**
+ *
+ * mesh_path_add_gate - add the given mpath to a mesh gate to our path table
+ * @mpath: gate path to add to table
+ */
+int mesh_path_add_gate(struct mesh_path *mpath)
+{
+        return mesh_gate_add(mesh_paths, mpath);
+}
+
+/**
+ * mesh_gate_num - number of gates known to this interface
+ * @sdata: subif data
+ */
+int mesh_gate_num(struct ieee80211_sub_if_data *sdata)
+{
+        return sdata->u.mesh.num_gates;
+}
+
 /**
  * mesh_path_add - allocate and add a new path to the mesh path table
  * @addr: destination address of the path (ETH_ALEN length)
@@ -481,6 +711,7 @@ int mpp_path_add(u8 *dst, u8 *mpp, struct ieee80211_sub_if_data *sdata)
         new_mpath->flags = 0;
         skb_queue_head_init(&new_mpath->frame_queue);
         new_node->mpath = new_mpath;
+        init_timer(&new_mpath->timer);
         new_mpath->exp_time = jiffies;
         spin_lock_init(&new_mpath->state_lock);
 
@@ -539,6 +770,7 @@ void mesh_plink_broken(struct sta_info *sta)
         struct hlist_node *p;
         struct ieee80211_sub_if_data *sdata = sta->sdata;
         int i;
+        __le16 reason = cpu_to_le16(WLAN_REASON_MESH_PATH_DEST_UNREACHABLE);
 
         rcu_read_lock();
         tbl = rcu_dereference(mesh_paths);
@@ -553,8 +785,7 @@ void mesh_plink_broken(struct sta_info *sta)
                         spin_unlock_bh(&mpath->state_lock);
                         mesh_path_error_tx(sdata->u.mesh.mshcfg.element_ttl,
                                         mpath->dst, cpu_to_le32(mpath->sn),
-                                        cpu_to_le16(PERR_RCODE_DEST_UNREACH),
-                                        bcast, sdata);
+                                        reason, bcast, sdata);
                 } else
                 spin_unlock_bh(&mpath->state_lock);
         }
@@ -647,12 +878,14 @@ int mesh_path_del(u8 *addr, struct ieee80211_sub_if_data *sdata)
                 mpath = node->mpath;
                 if (mpath->sdata == sdata &&
                     memcmp(addr, mpath->dst, ETH_ALEN) == 0) {
-                        spin_lock(&mpath->state_lock);
+                        spin_lock_bh(&mpath->state_lock);
+                        if (mpath->is_gate)
+                                mesh_gate_del(tbl, mpath);
                         mpath->flags |= MESH_PATH_RESOLVING;
                         hlist_del_rcu(&node->list);
                         call_rcu(&node->rcu, mesh_path_node_reclaim);
                         atomic_dec(&tbl->entries);
-                        spin_unlock(&mpath->state_lock);
+                        spin_unlock_bh(&mpath->state_lock);
                         goto enddel;
                 }
         }
@@ -681,6 +914,58 @@ void mesh_path_tx_pending(struct mesh_path *mpath)
 }
 
 /**
+ * mesh_path_send_to_gates - sends pending frames to all known mesh gates
+ *
+ * @mpath: mesh path whose queue will be emptied
+ *
+ * If there is only one gate, the frames are transferred from the failed mpath
+ * queue to that gate's queue.  If there are more than one gates, the frames
+ * are copied from each gate to the next.  After frames are copied, the
+ * mpath queues are emptied onto the transmission queue.
+ */
+int mesh_path_send_to_gates(struct mesh_path *mpath)
+{
+        struct ieee80211_sub_if_data *sdata = mpath->sdata;
+        struct hlist_node *n;
+        struct mesh_table *tbl;
+        struct mesh_path *from_mpath = mpath;
+        struct mpath_node *gate = NULL;
+        bool copy = false;
+        struct hlist_head *known_gates;
+
+        rcu_read_lock();
+        tbl = rcu_dereference(mesh_paths);
+        known_gates = tbl->known_gates;
+        rcu_read_unlock();
+
+        if (!known_gates)
+                return -EHOSTUNREACH;
+
+        hlist_for_each_entry_rcu(gate, n, known_gates, list) {
+                if (gate->mpath->sdata != sdata)
+                        continue;
+
+                if (gate->mpath->flags & MESH_PATH_ACTIVE) {
+                        mpath_dbg("Forwarding to %pM\n", gate->mpath->dst);
+                        mesh_path_move_to_queue(gate->mpath, from_mpath, copy);
+                        from_mpath = gate->mpath;
+                        copy = true;
+                } else {
+                        mpath_dbg("Not forwarding %p\n", gate->mpath);
+                        mpath_dbg("flags %x\n", gate->mpath->flags);
+                }
+        }
+
+        hlist_for_each_entry_rcu(gate, n, known_gates, list)
+                if (gate->mpath->sdata == sdata) {
+                        mpath_dbg("Sending to %pM\n", gate->mpath->dst);
+                        mesh_path_tx_pending(gate->mpath);
+                }
+
+        return (from_mpath == mpath) ? -EHOSTUNREACH : 0;
+}
+
+/**
  * mesh_path_discard_frame - discard a frame whose path could not be resolved
  *
  * @skb: frame to discard
@@ -699,6 +984,7 @@ void mesh_path_discard_frame(struct sk_buff *skb,
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
         struct mesh_path *mpath;
         u32 sn = 0;
+        __le16 reason = cpu_to_le16(WLAN_REASON_MESH_PATH_NOFORWARD);
 
         if (memcmp(hdr->addr4, sdata->vif.addr, ETH_ALEN) != 0) {
                 u8 *ra, *da;
@@ -709,8 +995,7 @@ void mesh_path_discard_frame(struct sk_buff *skb,
                 if (mpath)
                         sn = ++mpath->sn;
                 mesh_path_error_tx(sdata->u.mesh.mshcfg.element_ttl, skb->data,
-                                   cpu_to_le32(sn),
-                                   cpu_to_le16(PERR_RCODE_NO_ROUTE), ra, sdata);
+                                   cpu_to_le32(sn), reason, ra, sdata);
         }
 
         kfree_skb(skb);
@@ -728,8 +1013,7 @@ void mesh_path_flush_pending(struct mesh_path *mpath)
 {
         struct sk_buff *skb;
 
-        while ((skb = skb_dequeue(&mpath->frame_queue)) &&
-                        (mpath->flags & MESH_PATH_ACTIVE))
+        while ((skb = skb_dequeue(&mpath->frame_queue)) != NULL)
                 mesh_path_discard_frame(skb, mpath->sdata);
 }
 
@@ -797,6 +1081,9 @@ int mesh_pathtbl_init(void)
         tbl_path->free_node = &mesh_path_node_free;
         tbl_path->copy_node = &mesh_path_node_copy;
         tbl_path->mean_chain_len = MEAN_CHAIN_LEN;
+        tbl_path->known_gates = kzalloc(sizeof(struct hlist_head), GFP_ATOMIC);
+        INIT_HLIST_HEAD(tbl_path->known_gates);
+
 
         tbl_mpp = mesh_table_alloc(INIT_PATHS_SIZE_ORDER);
         if (!tbl_mpp) {
@@ -806,6 +1093,8 @@ int mesh_pathtbl_init(void)
         tbl_mpp->free_node = &mesh_path_node_free;
         tbl_mpp->copy_node = &mesh_path_node_copy;
         tbl_mpp->mean_chain_len = MEAN_CHAIN_LEN;
+        tbl_mpp->known_gates = kzalloc(sizeof(struct hlist_head), GFP_ATOMIC);
+        INIT_HLIST_HEAD(tbl_mpp->known_gates);
 
         /* Need no locking since this is during init */
         RCU_INIT_POINTER(mesh_paths, tbl_path);
diff --git a/net/mac80211/mesh_plink.c b/net/mac80211/mesh_plink.c
index f4adc0917888..1a00d0f701c3 100644
--- a/net/mac80211/mesh_plink.c
+++ b/net/mac80211/mesh_plink.c
@@ -19,35 +19,18 @@
 #define mpl_dbg(fmt, args...)   do { (void)(0); } while (0)
 #endif
 
-#define PLINK_GET_LLID(p) (p + 4)
-#define PLINK_GET_PLID(p) (p + 6)
+#define PLINK_GET_LLID(p) (p + 2)
+#define PLINK_GET_PLID(p) (p + 4)
 
 #define mod_plink_timer(s, t) (mod_timer(&s->plink_timer, \
                                 jiffies + HZ * t / 1000))
 
-/* Peer link cancel reasons, all subject to ANA approval */
-#define MESH_LINK_CANCELLED                     2
-#define MESH_MAX_NEIGHBORS                      3
-#define MESH_CAPABILITY_POLICY_VIOLATION        4
-#define MESH_CLOSE_RCVD                         5
-#define MESH_MAX_RETRIES                        6
-#define MESH_CONFIRM_TIMEOUT                    7
-#define MESH_SECURITY_ROLE_NEGOTIATION_DIFFERS  8
-#define MESH_SECURITY_AUTHENTICATION_IMPOSSIBLE 9
-#define MESH_SECURITY_FAILED_VERIFICATION       10
-
 #define dot11MeshMaxRetries(s) (s->u.mesh.mshcfg.dot11MeshMaxRetries)
 #define dot11MeshRetryTimeout(s) (s->u.mesh.mshcfg.dot11MeshRetryTimeout)
 #define dot11MeshConfirmTimeout(s) (s->u.mesh.mshcfg.dot11MeshConfirmTimeout)
 #define dot11MeshHoldingTimeout(s) (s->u.mesh.mshcfg.dot11MeshHoldingTimeout)
 #define dot11MeshMaxPeerLinks(s) (s->u.mesh.mshcfg.dot11MeshMaxPeerLinks)
 
-enum plink_frame_type {
-        PLINK_OPEN = 1,
-        PLINK_CONFIRM,
-        PLINK_CLOSE
-};
-
 enum plink_event {
         PLINK_UNDEFINED,
         OPN_ACPT,
@@ -157,16 +140,16 @@ void mesh_plink_deactivate(struct sta_info *sta)
 }
 
 static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata,
-                enum plink_frame_type action, u8 *da, __le16 llid, __le16 plid,
-                __le16 reason) {
+                enum ieee80211_self_protected_actioncode action,
+                u8 *da, __le16 llid, __le16 plid, __le16 reason) {
         struct ieee80211_local *local = sdata->local;
         struct sk_buff *skb = dev_alloc_skb(local->hw.extra_tx_headroom + 400 +
                         sdata->u.mesh.ie_len);
         struct ieee80211_mgmt *mgmt;
         bool include_plid = false;
-        static const u8 meshpeeringproto[] = { 0x00, 0x0F, 0xAC, 0x2A };
+        int ie_len = 4;
+        u16 peering_proto = 0;
         u8 *pos;
-        int ie_len;
 
         if (!skb)
                 return -1;
@@ -175,63 +158,75 @@ static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata,
          * common action part (1)
          */
         mgmt = (struct ieee80211_mgmt *)
-                skb_put(skb, 25 + sizeof(mgmt->u.action.u.plink_action));
-        memset(mgmt, 0, 25 + sizeof(mgmt->u.action.u.plink_action));
+                skb_put(skb, 25 + sizeof(mgmt->u.action.u.self_prot));
+        memset(mgmt, 0, 25 + sizeof(mgmt->u.action.u.self_prot));
         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
                                           IEEE80211_STYPE_ACTION);
         memcpy(mgmt->da, da, ETH_ALEN);
         memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
         memcpy(mgmt->bssid, sdata->vif.addr, ETH_ALEN);
-        mgmt->u.action.category = WLAN_CATEGORY_MESH_ACTION;
-        mgmt->u.action.u.plink_action.action_code = action;
-
-        if (action == PLINK_CLOSE)
-                mgmt->u.action.u.plink_action.aux = reason;
-        else {
-                mgmt->u.action.u.plink_action.aux = cpu_to_le16(0x0);
-                if (action == PLINK_CONFIRM) {
-                        pos = skb_put(skb, 4);
-                        /* two-byte status code followed by two-byte AID */
-                        memset(pos, 0, 2);
+        mgmt->u.action.category = WLAN_CATEGORY_SELF_PROTECTED;
+        mgmt->u.action.u.self_prot.action_code = action;
+
+        if (action != WLAN_SP_MESH_PEERING_CLOSE) {
+                /* capability info */
+                pos = skb_put(skb, 2);
+                memset(pos, 0, 2);
+                if (action == WLAN_SP_MESH_PEERING_CONFIRM) {
+                        /* AID */
+                        pos = skb_put(skb, 2);
                         memcpy(pos + 2, &plid, 2);
                 }
-                mesh_mgmt_ies_add(skb, sdata);
+                if (mesh_add_srates_ie(skb, sdata) ||
+                    mesh_add_ext_srates_ie(skb, sdata) ||
+                    mesh_add_rsn_ie(skb, sdata) ||
+                    mesh_add_meshid_ie(skb, sdata) ||
+                    mesh_add_meshconf_ie(skb, sdata))
+                        return -1;
+        } else {        /* WLAN_SP_MESH_PEERING_CLOSE */
+                if (mesh_add_meshid_ie(skb, sdata))
+                        return -1;
         }
 
-        /* Add Peer Link Management element */
+        /* Add Mesh Peering Management element */
         switch (action) {
-        case PLINK_OPEN:
-                ie_len = 6;
+        case WLAN_SP_MESH_PEERING_OPEN:
                 break;
-        case PLINK_CONFIRM:
-                ie_len = 8;
+        case WLAN_SP_MESH_PEERING_CONFIRM:
+                ie_len += 2;
                 include_plid = true;
                 break;
-        case PLINK_CLOSE:
-        default:
-                if (!plid)
-                        ie_len = 8;
-                else {
-                        ie_len = 10;
+        case WLAN_SP_MESH_PEERING_CLOSE:
+                if (plid) {
+                        ie_len += 2;
                         include_plid = true;
                 }
+                ie_len += 2;    /* reason code */
                 break;
+        default:
+                return -EINVAL;
         }
 
+        if (WARN_ON(skb_tailroom(skb) < 2 + ie_len))
+                return -ENOMEM;
+
         pos = skb_put(skb, 2 + ie_len);
-        *pos++ = WLAN_EID_PEER_LINK;
+        *pos++ = WLAN_EID_PEER_MGMT;
         *pos++ = ie_len;
-        memcpy(pos, meshpeeringproto, sizeof(meshpeeringproto));
-        pos += 4;
+        memcpy(pos, &peering_proto, 2);
+        pos += 2;
         memcpy(pos, &llid, 2);
+        pos += 2;
         if (include_plid) {
-                pos += 2;
                 memcpy(pos, &plid, 2);
-        }
-        if (action == PLINK_CLOSE) {
                 pos += 2;
+        }
+        if (action == WLAN_SP_MESH_PEERING_CLOSE) {
                 memcpy(pos, &reason, 2);
+                pos += 2;
         }
+        if (mesh_add_vendor_ies(skb, sdata))
+                return -1;
 
         ieee80211_tx_skb(sdata, skb);
         return 0;
@@ -322,21 +317,21 @@ static void mesh_plink_timer(unsigned long data)
                         ++sta->plink_retries;
                         mod_plink_timer(sta, sta->plink_timeout);
                         spin_unlock_bh(&sta->lock);
-                        mesh_plink_frame_tx(sdata, PLINK_OPEN, sta->sta.addr, llid,
-                                            0, 0);
+                        mesh_plink_frame_tx(sdata, WLAN_SP_MESH_PEERING_OPEN,
+                                            sta->sta.addr, llid, 0, 0);
                         break;
                 }
-                reason = cpu_to_le16(MESH_MAX_RETRIES);
+                reason = cpu_to_le16(WLAN_REASON_MESH_MAX_RETRIES);
                 /* fall through on else */
         case NL80211_PLINK_CNF_RCVD:
                 /* confirm timer */
                 if (!reason)
-                        reason = cpu_to_le16(MESH_CONFIRM_TIMEOUT);
+                        reason = cpu_to_le16(WLAN_REASON_MESH_CONFIRM_TIMEOUT);
                 sta->plink_state = NL80211_PLINK_HOLDING;
                 mod_plink_timer(sta, dot11MeshHoldingTimeout(sdata));
                 spin_unlock_bh(&sta->lock);
-                mesh_plink_frame_tx(sdata, PLINK_CLOSE, sta->sta.addr, llid, plid,
-                                    reason);
+                mesh_plink_frame_tx(sdata, WLAN_SP_MESH_PEERING_CLOSE,
+                                    sta->sta.addr, llid, plid, reason);
                 break;
         case NL80211_PLINK_HOLDING:
                 /* holding timer */
@@ -396,7 +391,7 @@ int mesh_plink_open(struct sta_info *sta)
         mpl_dbg("Mesh plink: starting establishment with %pM\n",
                 sta->sta.addr);
 
-        return mesh_plink_frame_tx(sdata, PLINK_OPEN,
+        return mesh_plink_frame_tx(sdata, WLAN_SP_MESH_PEERING_OPEN,
                                    sta->sta.addr, llid, 0, 0);
 }
 
@@ -422,7 +417,7 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
         struct ieee802_11_elems elems;
         struct sta_info *sta;
         enum plink_event event;
-        enum plink_frame_type ftype;
+        enum ieee80211_self_protected_actioncode ftype;
         size_t baselen;
         bool deactivated, matches_local = true;
         u8 ie_len;
@@ -449,14 +444,15 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                 return;
         }
 
-        baseaddr = mgmt->u.action.u.plink_action.variable;
-        baselen = (u8 *) mgmt->u.action.u.plink_action.variable - (u8 *) mgmt;
-        if (mgmt->u.action.u.plink_action.action_code == PLINK_CONFIRM) {
+        baseaddr = mgmt->u.action.u.self_prot.variable;
+        baselen = (u8 *) mgmt->u.action.u.self_prot.variable - (u8 *) mgmt;
+        if (mgmt->u.action.u.self_prot.action_code ==
+                                                WLAN_SP_MESH_PEERING_CONFIRM) {
                 baseaddr += 4;
                 baselen += 4;
         }
         ieee802_11_parse_elems(baseaddr, len - baselen, &elems);
-        if (!elems.peer_link) {
+        if (!elems.peering) {
                 mpl_dbg("Mesh plink: missing necessary peer link ie\n");
                 return;
         }
@@ -466,31 +462,34 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                 return;
         }
 
-        ftype = mgmt->u.action.u.plink_action.action_code;
-        ie_len = elems.peer_link_len;
-        if ((ftype == PLINK_OPEN && ie_len != 6) ||
-            (ftype == PLINK_CONFIRM && ie_len != 8) ||
-            (ftype == PLINK_CLOSE && ie_len != 8 && ie_len != 10)) {
+        ftype = mgmt->u.action.u.self_prot.action_code;
+        ie_len = elems.peering_len;
+        if ((ftype == WLAN_SP_MESH_PEERING_OPEN && ie_len != 4) ||
+            (ftype == WLAN_SP_MESH_PEERING_CONFIRM && ie_len != 6) ||
+            (ftype == WLAN_SP_MESH_PEERING_CLOSE && ie_len != 6
+                                                        && ie_len != 8)) {
                 mpl_dbg("Mesh plink: incorrect plink ie length %d %d\n",
                     ftype, ie_len);
                 return;
         }
 
-        if (ftype != PLINK_CLOSE && (!elems.mesh_id || !elems.mesh_config)) {
+        if (ftype != WLAN_SP_MESH_PEERING_CLOSE &&
+                                (!elems.mesh_id || !elems.mesh_config)) {
                 mpl_dbg("Mesh plink: missing necessary ie\n");
                 return;
         }
         /* Note the lines below are correct, the llid in the frame is the plid
          * from the point of view of this host.
          */
-        memcpy(&plid, PLINK_GET_LLID(elems.peer_link), 2);
-        if (ftype == PLINK_CONFIRM || (ftype == PLINK_CLOSE && ie_len == 10))
-                memcpy(&llid, PLINK_GET_PLID(elems.peer_link), 2);
+        memcpy(&plid, PLINK_GET_LLID(elems.peering), 2);
+        if (ftype == WLAN_SP_MESH_PEERING_CONFIRM ||
+            (ftype == WLAN_SP_MESH_PEERING_CLOSE && ie_len == 8))
+                memcpy(&llid, PLINK_GET_PLID(elems.peering), 2);
 
         rcu_read_lock();
 
         sta = sta_info_get(sdata, mgmt->sa);
-        if (!sta && ftype != PLINK_OPEN) {
+        if (!sta && ftype != WLAN_SP_MESH_PEERING_OPEN) {
                 mpl_dbg("Mesh plink: cls or cnf from unknown peer\n");
                 rcu_read_unlock();
                 return;
@@ -509,30 +508,30 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
 
         /* Now we will figure out the appropriate event... */
         event = PLINK_UNDEFINED;
-        if (ftype != PLINK_CLOSE && (!mesh_matches_local(&elems, sdata))) {
+        if (ftype != WLAN_SP_MESH_PEERING_CLOSE &&
+            (!mesh_matches_local(&elems, sdata))) {
                 matches_local = false;
                 switch (ftype) {
-                case PLINK_OPEN:
+                case WLAN_SP_MESH_PEERING_OPEN:
                         event = OPN_RJCT;
                         break;
-                case PLINK_CONFIRM:
+                case WLAN_SP_MESH_PEERING_CONFIRM:
                         event = CNF_RJCT;
                         break;
-                case PLINK_CLOSE:
-                        /* avoid warning */
+                default:
                         break;
                 }
         }
 
         if (!sta && !matches_local) {
                 rcu_read_unlock();
-                reason = cpu_to_le16(MESH_CAPABILITY_POLICY_VIOLATION);
+                reason = cpu_to_le16(WLAN_REASON_MESH_CONFIG);
                 llid = 0;
-                mesh_plink_frame_tx(sdata, PLINK_CLOSE, mgmt->sa, llid,
-                                    plid, reason);
+                mesh_plink_frame_tx(sdata, WLAN_SP_MESH_PEERING_CLOSE,
+                                    mgmt->sa, llid, plid, reason);
                 return;
         } else if (!sta) {
-                /* ftype == PLINK_OPEN */
+                /* ftype == WLAN_SP_MESH_PEERING_OPEN */
                 u32 rates;
 
                 rcu_read_unlock();
@@ -557,21 +556,21 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
         } else if (matches_local) {
                 spin_lock_bh(&sta->lock);
                 switch (ftype) {
-                case PLINK_OPEN:
+                case WLAN_SP_MESH_PEERING_OPEN:
                         if (!mesh_plink_free_count(sdata) ||
                             (sta->plid && sta->plid != plid))
                                 event = OPN_IGNR;
                         else
                                 event = OPN_ACPT;
                         break;
-                case PLINK_CONFIRM:
+                case WLAN_SP_MESH_PEERING_CONFIRM:
                         if (!mesh_plink_free_count(sdata) ||
                             (sta->llid != llid || sta->plid != plid))
                                 event = CNF_IGNR;
                         else
                                 event = CNF_ACPT;
                         break;
-                case PLINK_CLOSE:
+                case WLAN_SP_MESH_PEERING_CLOSE:
                         if (sta->plink_state == NL80211_PLINK_ESTAB)
                                 /* Do not check for llid or plid. This does not
                                  * follow the standard but since multiple plinks
@@ -620,10 +619,12 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                         sta->llid = llid;
                         mesh_plink_timer_set(sta, dot11MeshRetryTimeout(sdata));
                         spin_unlock_bh(&sta->lock);
-                        mesh_plink_frame_tx(sdata, PLINK_OPEN, sta->sta.addr, llid,
-                                            0, 0);
-                        mesh_plink_frame_tx(sdata, PLINK_CONFIRM, sta->sta.addr,
-                                            llid, plid, 0);
+                        mesh_plink_frame_tx(sdata,
+                                            WLAN_SP_MESH_PEERING_OPEN,
+                                            sta->sta.addr, llid, 0, 0);
+                        mesh_plink_frame_tx(sdata,
+                                            WLAN_SP_MESH_PEERING_CONFIRM,
+                                            sta->sta.addr, llid, plid, 0);
                         break;
                 default:
                         spin_unlock_bh(&sta->lock);
@@ -635,10 +636,10 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                 switch (event) {
                 case OPN_RJCT:
                 case CNF_RJCT:
-                        reason = cpu_to_le16(MESH_CAPABILITY_POLICY_VIOLATION);
+                        reason = cpu_to_le16(WLAN_REASON_MESH_CONFIG);
                 case CLS_ACPT:
                         if (!reason)
-                                reason = cpu_to_le16(MESH_CLOSE_RCVD);
+                                reason = cpu_to_le16(WLAN_REASON_MESH_CLOSE);
                         sta->reason = reason;
                         sta->plink_state = NL80211_PLINK_HOLDING;
                         if (!mod_plink_timer(sta,
@@ -647,8 +648,9 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
 
                         llid = sta->llid;
                         spin_unlock_bh(&sta->lock);
-                        mesh_plink_frame_tx(sdata, PLINK_CLOSE, sta->sta.addr, llid,
-                                            plid, reason);
+                        mesh_plink_frame_tx(sdata,
+                                            WLAN_SP_MESH_PEERING_CLOSE,
+                                            sta->sta.addr, llid, plid, reason);
                         break;
                 case OPN_ACPT:
                         /* retry timer is left untouched */
@@ -656,8 +658,9 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                         sta->plid = plid;
                         llid = sta->llid;
                         spin_unlock_bh(&sta->lock);
-                        mesh_plink_frame_tx(sdata, PLINK_CONFIRM, sta->sta.addr, llid,
-                                            plid, 0);
+                        mesh_plink_frame_tx(sdata,
+                                            WLAN_SP_MESH_PEERING_CONFIRM,
+                                            sta->sta.addr, llid, plid, 0);
                         break;
                 case CNF_ACPT:
                         sta->plink_state = NL80211_PLINK_CNF_RCVD;
@@ -677,10 +680,10 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                 switch (event) {
                 case OPN_RJCT:
                 case CNF_RJCT:
-                        reason = cpu_to_le16(MESH_CAPABILITY_POLICY_VIOLATION);
+                        reason = cpu_to_le16(WLAN_REASON_MESH_CONFIG);
                 case CLS_ACPT:
                         if (!reason)
-                                reason = cpu_to_le16(MESH_CLOSE_RCVD);
+                                reason = cpu_to_le16(WLAN_REASON_MESH_CLOSE);
                         sta->reason = reason;
                         sta->plink_state = NL80211_PLINK_HOLDING;
                         if (!mod_plink_timer(sta,
@@ -689,14 +692,15 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
 
                         llid = sta->llid;
                         spin_unlock_bh(&sta->lock);
-                        mesh_plink_frame_tx(sdata, PLINK_CLOSE, sta->sta.addr, llid,
-                                            plid, reason);
+                        mesh_plink_frame_tx(sdata, WLAN_SP_MESH_PEERING_CLOSE,
+                                            sta->sta.addr, llid, plid, reason);
                         break;
                 case OPN_ACPT:
                         llid = sta->llid;
                         spin_unlock_bh(&sta->lock);
-                        mesh_plink_frame_tx(sdata, PLINK_CONFIRM, sta->sta.addr, llid,
-                                            plid, 0);
+                        mesh_plink_frame_tx(sdata,
+                                            WLAN_SP_MESH_PEERING_CONFIRM,
+                                            sta->sta.addr, llid, plid, 0);
                         break;
                 case CNF_ACPT:
                         del_timer(&sta->plink_timer);
@@ -717,10 +721,10 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                 switch (event) {
                 case OPN_RJCT:
                 case CNF_RJCT:
-                        reason = cpu_to_le16(MESH_CAPABILITY_POLICY_VIOLATION);
+                        reason = cpu_to_le16(WLAN_REASON_MESH_CONFIG);
                 case CLS_ACPT:
                         if (!reason)
-                                reason = cpu_to_le16(MESH_CLOSE_RCVD);
+                                reason = cpu_to_le16(WLAN_REASON_MESH_CLOSE);
                         sta->reason = reason;
                         sta->plink_state = NL80211_PLINK_HOLDING;
                         if (!mod_plink_timer(sta,
@@ -729,8 +733,9 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
 
                         llid = sta->llid;
                         spin_unlock_bh(&sta->lock);
-                        mesh_plink_frame_tx(sdata, PLINK_CLOSE, sta->sta.addr, llid,
-                                            plid, reason);
+                        mesh_plink_frame_tx(sdata,
+                                            WLAN_SP_MESH_PEERING_CLOSE,
+                                            sta->sta.addr, llid, plid, reason);
                         break;
                 case OPN_ACPT:
                         del_timer(&sta->plink_timer);
@@ -740,8 +745,9 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                         ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON);
                         mpl_dbg("Mesh plink with %pM ESTABLISHED\n",
                                 sta->sta.addr);
-                        mesh_plink_frame_tx(sdata, PLINK_CONFIRM, sta->sta.addr, llid,
-                                            plid, 0);
+                        mesh_plink_frame_tx(sdata,
+                                            WLAN_SP_MESH_PEERING_CONFIRM,
+                                            sta->sta.addr, llid, plid, 0);
                         break;
                 default:
                         spin_unlock_bh(&sta->lock);
@@ -752,7 +758,7 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
         case NL80211_PLINK_ESTAB:
                 switch (event) {
                 case CLS_ACPT:
-                        reason = cpu_to_le16(MESH_CLOSE_RCVD);
+                        reason = cpu_to_le16(WLAN_REASON_MESH_CLOSE);
                         sta->reason = reason;
                         deactivated = __mesh_plink_deactivate(sta);
                         sta->plink_state = NL80211_PLINK_HOLDING;
@@ -761,14 +767,15 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                         spin_unlock_bh(&sta->lock);
                         if (deactivated)
                                 ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON);
-                        mesh_plink_frame_tx(sdata, PLINK_CLOSE, sta->sta.addr, llid,
-                                            plid, reason);
+                        mesh_plink_frame_tx(sdata, WLAN_SP_MESH_PEERING_CLOSE,
+                                            sta->sta.addr, llid, plid, reason);
                         break;
                 case OPN_ACPT:
                         llid = sta->llid;
                         spin_unlock_bh(&sta->lock);
-                        mesh_plink_frame_tx(sdata, PLINK_CONFIRM, sta->sta.addr, llid,
-                                            plid, 0);
+                        mesh_plink_frame_tx(sdata,
+                                            WLAN_SP_MESH_PEERING_CONFIRM,
+                                            sta->sta.addr, llid, plid, 0);
                         break;
                 default:
                         spin_unlock_bh(&sta->lock);
@@ -790,8 +797,8 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                         llid = sta->llid;
                         reason = sta->reason;
                         spin_unlock_bh(&sta->lock);
-                        mesh_plink_frame_tx(sdata, PLINK_CLOSE, sta->sta.addr,
-                                            llid, plid, reason);
+                        mesh_plink_frame_tx(sdata, WLAN_SP_MESH_PEERING_CLOSE,
+                                            sta->sta.addr, llid, plid, reason);
                         break;
                 default:
                         spin_unlock_bh(&sta->lock);
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index d6470c7fd6ce..60a6f273cd30 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -1482,10 +1482,14 @@ static bool ieee80211_assoc_success(struct ieee80211_work *wk,
 
         ifmgd->aid = aid;
 
-        sta = sta_info_alloc(sdata, cbss->bssid, GFP_KERNEL);
-        if (!sta) {
-                printk(KERN_DEBUG "%s: failed to alloc STA entry for"
-                       " the AP\n", sdata->name);
+        mutex_lock(&sdata->local->sta_mtx);
+        /*
+         * station info was already allocated and inserted before
+         * the association and should be available to us
+         */
+        sta = sta_info_get_rx(sdata, cbss->bssid);
+        if (WARN_ON(!sta)) {
+                mutex_unlock(&sdata->local->sta_mtx);
                 return false;
         }
 
@@ -1556,7 +1560,8 @@ static bool ieee80211_assoc_success(struct ieee80211_work *wk,
         if (elems.wmm_param)
                 set_sta_flags(sta, WLAN_STA_WME);
 
-        err = sta_info_insert(sta);
+        /* sta_info_reinsert will also unlock the mutex lock */
+        err = sta_info_reinsert(sta);
         sta = NULL;
         if (err) {
                 printk(KERN_DEBUG "%s: failed to insert STA entry for"
@@ -2429,6 +2434,32 @@ int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata,
         return 0;
 }
 
+/* create and insert a dummy station entry */
+static int ieee80211_pre_assoc(struct ieee80211_sub_if_data *sdata,
+                                u8 *bssid) {
+        struct sta_info *sta;
+        int err;
+
+        sta = sta_info_alloc(sdata, bssid, GFP_KERNEL);
+        if (!sta) {
+                printk(KERN_DEBUG "%s: failed to alloc STA entry for"
+                           " the AP\n", sdata->name);
+                return -ENOMEM;
+        }
+
+        sta->dummy = true;
+
+        err = sta_info_insert(sta);
+        sta = NULL;
+        if (err) {
+                printk(KERN_DEBUG "%s: failed to insert Dummy STA entry for"
+                       " the AP (error %d)\n", sdata->name, err);
+                return err;
+        }
+
+        return 0;
+}
+
 static enum work_done_result ieee80211_assoc_done(struct ieee80211_work *wk,
                                                   struct sk_buff *skb)
 {
@@ -2436,9 +2467,11 @@ static enum work_done_result ieee80211_assoc_done(struct ieee80211_work *wk,
         struct ieee80211_mgmt *mgmt;
         struct ieee80211_rx_status *rx_status;
         struct ieee802_11_elems elems;
+        struct cfg80211_bss *cbss = wk->assoc.bss;
         u16 status;
 
         if (!skb) {
+                sta_info_destroy_addr(wk->sdata, cbss->bssid);
                 cfg80211_send_assoc_timeout(wk->sdata->dev, wk->filter_ta);
                 goto destroy;
         }
@@ -2468,12 +2501,16 @@ static enum work_done_result ieee80211_assoc_done(struct ieee80211_work *wk,
                 if (!ieee80211_assoc_success(wk, mgmt, skb->len)) {
                         mutex_unlock(&wk->sdata->u.mgd.mtx);
                         /* oops -- internal error -- send timeout for now */
+                        sta_info_destroy_addr(wk->sdata, cbss->bssid);
                         cfg80211_send_assoc_timeout(wk->sdata->dev,
                                                     wk->filter_ta);
                         return WORK_DONE_DESTROY;
                 }
 
                 mutex_unlock(&wk->sdata->u.mgd.mtx);
+        } else {
+                /* assoc failed - destroy the dummy station entry */
+                sta_info_destroy_addr(wk->sdata, cbss->bssid);
         }
 
         cfg80211_send_rx_assoc(wk->sdata->dev, skb->data, skb->len);
@@ -2492,7 +2529,7 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_bss *bss = (void *)req->bss->priv;
         struct ieee80211_work *wk;
         const u8 *ssid;
-        int i;
+        int i, err;
 
         mutex_lock(&ifmgd->mtx);
         if (ifmgd->associated) {
@@ -2517,6 +2554,16 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
         if (!wk)
                 return -ENOMEM;
 
+        /*
+         * create a dummy station info entry in order
+         * to start accepting incoming EAPOL packets from the station
+         */
+        err = ieee80211_pre_assoc(sdata, req->bss->bssid);
+        if (err) {
+                kfree(wk);
+                return err;
+        }
+
         ifmgd->flags &= ~IEEE80211_STA_DISABLE_11N;
         ifmgd->flags &= ~IEEE80211_STA_NULLFUNC_ACKED;
 
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index fe2c2a717793..f45fd2fedc24 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -850,8 +850,21 @@ ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
                       ieee80211_is_pspoll(hdr->frame_control)) &&
                      rx->sdata->vif.type != NL80211_IFTYPE_ADHOC &&
                      rx->sdata->vif.type != NL80211_IFTYPE_WDS &&
-                     (!rx->sta || !test_sta_flags(rx->sta, WLAN_STA_ASSOC))))
+                     (!rx->sta || !test_sta_flags(rx->sta, WLAN_STA_ASSOC)))) {
+                if (rx->sta && rx->sta->dummy &&
+                    ieee80211_is_data_present(hdr->frame_control)) {
+                        u16 ethertype;
+                        u8 *payload;
+
+                        payload = rx->skb->data +
+                                ieee80211_hdrlen(hdr->frame_control);
+                        ethertype = (payload[6] << 8) | payload[7];
+                        if (cpu_to_be16(ethertype) ==
+                            rx->sdata->control_port_protocol)
+                                return RX_CONTINUE;
+                }
                 return RX_DROP_MONITOR;
+        }
 
         return RX_CONTINUE;
 }
@@ -2220,12 +2233,29 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
                         goto handled;
                 }
                 break;
+        case WLAN_CATEGORY_SELF_PROTECTED:
+                switch (mgmt->u.action.u.self_prot.action_code) {
+                case WLAN_SP_MESH_PEERING_OPEN:
+                case WLAN_SP_MESH_PEERING_CLOSE:
+                case WLAN_SP_MESH_PEERING_CONFIRM:
+                        if (!ieee80211_vif_is_mesh(&sdata->vif))
+                                goto invalid;
+                        if (sdata->u.mesh.security != IEEE80211_MESH_SEC_NONE)
+                                /* userspace handles this frame */
+                                break;
+                        goto queue;
+                case WLAN_SP_MGK_INFORM:
+                case WLAN_SP_MGK_ACK:
+                        if (!ieee80211_vif_is_mesh(&sdata->vif))
+                                goto invalid;
+                        break;
+                }
+                break;
         case WLAN_CATEGORY_MESH_ACTION:
                 if (!ieee80211_vif_is_mesh(&sdata->vif))
                         break;
-                goto queue;
-        case WLAN_CATEGORY_MESH_PATH_SEL:
-                if (!mesh_path_sel_is_hwmp(sdata))
+                if (mesh_action_is_path_sel(mgmt) &&
+                  (!mesh_path_sel_is_hwmp(sdata)))
                         break;
                 goto queue;
         }
@@ -2686,7 +2716,9 @@ static int prepare_for_handlers(struct ieee80211_rx_data *rx,
                 } else if (!ieee80211_bssid_match(bssid,
                                         sdata->vif.addr)) {
                         if (!(status->rx_flags & IEEE80211_RX_IN_SCAN) &&
-                            !ieee80211_is_beacon(hdr->frame_control))
+                            !ieee80211_is_beacon(hdr->frame_control) &&
+                            !(ieee80211_is_action(hdr->frame_control) &&
+                              sdata->vif.p2p))
                                 return 0;
                         status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
                 }
@@ -2791,7 +2823,7 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
         if (ieee80211_is_data(fc)) {
                 prev_sta = NULL;
 
-                for_each_sta_info(local, hdr->addr2, sta, tmp) {
+                for_each_sta_info_rx(local, hdr->addr2, sta, tmp) {
                         if (!prev_sta) {
                                 prev_sta = sta;
                                 continue;
@@ -2835,7 +2867,7 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
                         continue;
                 }
 
-                rx.sta = sta_info_get_bss(prev, hdr->addr2);
+                rx.sta = sta_info_get_bss_rx(prev, hdr->addr2);
                 rx.sdata = prev;
                 ieee80211_prepare_and_rx_handle(&rx, skb, false);
 
@@ -2843,7 +2875,7 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
         }
 
         if (prev) {
-                rx.sta = sta_info_get_bss(prev, hdr->addr2);
+                rx.sta = sta_info_get_bss_rx(prev, hdr->addr2);
                 rx.sdata = prev;
 
                 if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index 0bdbf3b8f28b..6bc17fb80ee9 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -100,6 +100,27 @@ struct sta_info *sta_info_get(struct ieee80211_sub_if_data *sdata,
                                     lockdep_is_held(&local->sta_lock) ||
                                     lockdep_is_held(&local->sta_mtx));
         while (sta) {
+                if (sta->sdata == sdata && !sta->dummy &&
+                    memcmp(sta->sta.addr, addr, ETH_ALEN) == 0)
+                        break;
+                sta = rcu_dereference_check(sta->hnext,
+                                            lockdep_is_held(&local->sta_lock) ||
+                                            lockdep_is_held(&local->sta_mtx));
+        }
+        return sta;
+}
+
+/* get a station info entry even if it is a dummy station*/
+struct sta_info *sta_info_get_rx(struct ieee80211_sub_if_data *sdata,
+                              const u8 *addr)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct sta_info *sta;
+
+        sta = rcu_dereference_check(local->sta_hash[STA_HASH(addr)],
+                                    lockdep_is_held(&local->sta_lock) ||
+                                    lockdep_is_held(&local->sta_mtx));
+        while (sta) {
                 if (sta->sdata == sdata &&
                     memcmp(sta->sta.addr, addr, ETH_ALEN) == 0)
                         break;
@@ -126,6 +147,32 @@ struct sta_info *sta_info_get_bss(struct ieee80211_sub_if_data *sdata,
         while (sta) {
                 if ((sta->sdata == sdata ||
                      (sta->sdata->bss && sta->sdata->bss == sdata->bss)) &&
+                    !sta->dummy &&
+                    memcmp(sta->sta.addr, addr, ETH_ALEN) == 0)
+                        break;
+                sta = rcu_dereference_check(sta->hnext,
+                                            lockdep_is_held(&local->sta_lock) ||
+                                            lockdep_is_held(&local->sta_mtx));
+        }
+        return sta;
+}
+
+/*
+ * Get sta info either from the specified interface
+ * or from one of its vlans (including dummy stations)
+ */
+struct sta_info *sta_info_get_bss_rx(struct ieee80211_sub_if_data *sdata,
+                                  const u8 *addr)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct sta_info *sta;
+
+        sta = rcu_dereference_check(local->sta_hash[STA_HASH(addr)],
+                                    lockdep_is_held(&local->sta_lock) ||
+                                    lockdep_is_held(&local->sta_mtx));
+        while (sta) {
+                if ((sta->sdata == sdata ||
+                     (sta->sdata->bss && sta->sdata->bss == sdata->bss)) &&
                     memcmp(sta->sta.addr, addr, ETH_ALEN) == 0)
                         break;
                 sta = rcu_dereference_check(sta->hnext,
@@ -280,7 +327,8 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
         return sta;
 }
 
-static int sta_info_finish_insert(struct sta_info *sta, bool async)
+static int sta_info_finish_insert(struct sta_info *sta,
+                                bool async, bool dummy_reinsert)
 {
         struct ieee80211_local *local = sta->local;
         struct ieee80211_sub_if_data *sdata = sta->sdata;
@@ -290,51 +338,58 @@ static int sta_info_finish_insert(struct sta_info *sta, bool async)
 
         lockdep_assert_held(&local->sta_mtx);
 
-        /* notify driver */
-        if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
-                sdata = container_of(sdata->bss,
-                                     struct ieee80211_sub_if_data,
-                                     u.ap);
-        err = drv_sta_add(local, sdata, &sta->sta);
-        if (err) {
-                if (!async)
-                        return err;
-                printk(KERN_DEBUG "%s: failed to add IBSS STA %pM to driver (%d)"
-                                  " - keeping it anyway.\n",
-                       sdata->name, sta->sta.addr, err);
-        } else {
-                sta->uploaded = true;
+        if (!sta->dummy || dummy_reinsert) {
+                /* notify driver */
+                if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
+                        sdata = container_of(sdata->bss,
+                                             struct ieee80211_sub_if_data,
+                                             u.ap);
+                err = drv_sta_add(local, sdata, &sta->sta);
+                if (err) {
+                        if (!async)
+                                return err;
+                        printk(KERN_DEBUG "%s: failed to add IBSS STA %pM to "
+                                          "driver (%d) - keeping it anyway.\n",
+                               sdata->name, sta->sta.addr, err);
+                } else {
+                        sta->uploaded = true;
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
-                if (async)
-                        wiphy_debug(local->hw.wiphy,
-                                    "Finished adding IBSS STA %pM\n",
-                                    sta->sta.addr);
+                        if (async)
+                                wiphy_debug(local->hw.wiphy,
+                                            "Finished adding IBSS STA %pM\n",
+                                            sta->sta.addr);
 #endif
+                }
+
+                sdata = sta->sdata;
         }
 
-        sdata = sta->sdata;
+        if (!dummy_reinsert) {
+                if (!async) {
+                        local->num_sta++;
+                        local->sta_generation++;
+                        smp_mb();
 
-        if (!async) {
-                local->num_sta++;
-                local->sta_generation++;
-                smp_mb();
+                        /* make the station visible */
+                        spin_lock_irqsave(&local->sta_lock, flags);
+                        sta_info_hash_add(local, sta);
+                        spin_unlock_irqrestore(&local->sta_lock, flags);
+                }
 
-                /* make the station visible */
-                spin_lock_irqsave(&local->sta_lock, flags);
-                sta_info_hash_add(local, sta);
-                spin_unlock_irqrestore(&local->sta_lock, flags);
+                list_add(&sta->list, &local->sta_list);
+        } else {
+                sta->dummy = false;
         }
 
-        list_add(&sta->list, &local->sta_list);
-
-        ieee80211_sta_debugfs_add(sta);
-        rate_control_add_sta_debugfs(sta);
-
-        memset(&sinfo, 0, sizeof(sinfo));
-        sinfo.filled = 0;
-        sinfo.generation = local->sta_generation;
-        cfg80211_new_sta(sdata->dev, sta->sta.addr, &sinfo, GFP_KERNEL);
+        if (!sta->dummy) {
+                ieee80211_sta_debugfs_add(sta);
+                rate_control_add_sta_debugfs(sta);
 
+                memset(&sinfo, 0, sizeof(sinfo));
+                sinfo.filled = 0;
+                sinfo.generation = local->sta_generation;
+                cfg80211_new_sta(sdata->dev, sta->sta.addr, &sinfo, GFP_KERNEL);
+        }
 
         return 0;
 }
@@ -351,7 +406,7 @@ static void sta_info_finish_pending(struct ieee80211_local *local)
                 list_del(&sta->list);
                 spin_unlock_irqrestore(&local->sta_lock, flags);
 
-                sta_info_finish_insert(sta, true);
+                sta_info_finish_insert(sta, true, false);
 
                 spin_lock_irqsave(&local->sta_lock, flags);
         }
@@ -368,106 +423,117 @@ static void sta_info_finish_work(struct work_struct *work)
         mutex_unlock(&local->sta_mtx);
 }
 
-int sta_info_insert_rcu(struct sta_info *sta) __acquires(RCU)
+static int sta_info_insert_check(struct sta_info *sta)
 {
-        struct ieee80211_local *local = sta->local;
         struct ieee80211_sub_if_data *sdata = sta->sdata;
-        unsigned long flags;
-        int err = 0;
 
         /*
          * Can't be a WARN_ON because it can be triggered through a race:
          * something inserts a STA (on one CPU) without holding the RTNL
          * and another CPU turns off the net device.
          */
-        if (unlikely(!ieee80211_sdata_running(sdata))) {
-                err = -ENETDOWN;
-                rcu_read_lock();
-                goto out_free;
-        }
+        if (unlikely(!ieee80211_sdata_running(sdata)))
+                return -ENETDOWN;
 
         if (WARN_ON(compare_ether_addr(sta->sta.addr, sdata->vif.addr) == 0 ||
-                    is_multicast_ether_addr(sta->sta.addr))) {
-                err = -EINVAL;
+                    is_multicast_ether_addr(sta->sta.addr)))
+                return -EINVAL;
+
+        return 0;
+}
+
+static int sta_info_insert_ibss(struct sta_info *sta) __acquires(RCU)
+{
+        struct ieee80211_local *local = sta->local;
+        struct ieee80211_sub_if_data *sdata = sta->sdata;
+        unsigned long flags;
+
+        spin_lock_irqsave(&local->sta_lock, flags);
+        /* check if STA exists already */
+        if (sta_info_get_bss_rx(sdata, sta->sta.addr)) {
+                spin_unlock_irqrestore(&local->sta_lock, flags);
                 rcu_read_lock();
-                goto out_free;
+                return -EEXIST;
         }
 
-        /*
-         * In ad-hoc mode, we sometimes need to insert stations
-         * from tasklet context from the RX path. To avoid races,
-         * always do so in that case -- see the comment below.
-         */
-        if (sdata->vif.type == NL80211_IFTYPE_ADHOC) {
-                spin_lock_irqsave(&local->sta_lock, flags);
-                /* check if STA exists already */
-                if (sta_info_get_bss(sdata, sta->sta.addr)) {
-                        spin_unlock_irqrestore(&local->sta_lock, flags);
-                        rcu_read_lock();
-                        err = -EEXIST;
-                        goto out_free;
-                }
-
-                local->num_sta++;
-                local->sta_generation++;
-                smp_mb();
-                sta_info_hash_add(local, sta);
+        local->num_sta++;
+        local->sta_generation++;
+        smp_mb();
+        sta_info_hash_add(local, sta);
 
-                list_add_tail(&sta->list, &local->sta_pending_list);
+        list_add_tail(&sta->list, &local->sta_pending_list);
 
-                rcu_read_lock();
-                spin_unlock_irqrestore(&local->sta_lock, flags);
+        rcu_read_lock();
+        spin_unlock_irqrestore(&local->sta_lock, flags);
 
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
-                wiphy_debug(local->hw.wiphy, "Added IBSS STA %pM\n",
-                            sta->sta.addr);
+        wiphy_debug(local->hw.wiphy, "Added IBSS STA %pM\n",
+                        sta->sta.addr);
 #endif /* CONFIG_MAC80211_VERBOSE_DEBUG */
 
-                ieee80211_queue_work(&local->hw, &local->sta_finish_work);
+        ieee80211_queue_work(&local->hw, &local->sta_finish_work);
 
-                return 0;
-        }
+        return 0;
+}
+
+/*
+ * should be called with sta_mtx locked
+ * this function replaces the mutex lock
+ * with a RCU lock
+ */
+static int sta_info_insert_non_ibss(struct sta_info *sta) __acquires(RCU)
+{
+        struct ieee80211_local *local = sta->local;
+        struct ieee80211_sub_if_data *sdata = sta->sdata;
+        unsigned long flags;
+        struct sta_info *exist_sta;
+        bool dummy_reinsert = false;
+        int err = 0;
+
+        lockdep_assert_held(&local->sta_mtx);
 
         /*
          * On first glance, this will look racy, because the code
-         * below this point, which inserts a station with sleeping,
+         * in this function, which inserts a station with sleeping,
          * unlocks the sta_lock between checking existence in the
          * hash table and inserting into it.
          *
          * However, it is not racy against itself because it keeps
-         * the mutex locked. It still seems to race against the
-         * above code that atomically inserts the station... That,
-         * however, is not true because the above code can only
-         * be invoked for IBSS interfaces, and the below code will
-         * not be -- and the two do not race against each other as
-         * the hash table also keys off the interface.
+         * the mutex locked.
          */
 
-        might_sleep();
-
-        mutex_lock(&local->sta_mtx);
-
         spin_lock_irqsave(&local->sta_lock, flags);
-        /* check if STA exists already */
-        if (sta_info_get_bss(sdata, sta->sta.addr)) {
-                spin_unlock_irqrestore(&local->sta_lock, flags);
-                mutex_unlock(&local->sta_mtx);
-                rcu_read_lock();
-                err = -EEXIST;
-                goto out_free;
+        /*
+         * check if STA exists already.
+         * only accept a scenario of a second call to sta_info_insert_non_ibss
+         * with a dummy station entry that was inserted earlier
+         * in that case - assume that the dummy station flag should
+         * be removed.
+         */
+        exist_sta = sta_info_get_bss_rx(sdata, sta->sta.addr);
+        if (exist_sta) {
+                if (exist_sta == sta && sta->dummy) {
+                        dummy_reinsert = true;
+                } else {
+                        spin_unlock_irqrestore(&local->sta_lock, flags);
+                        mutex_unlock(&local->sta_mtx);
+                        rcu_read_lock();
+                        return -EEXIST;
+                }
         }
 
         spin_unlock_irqrestore(&local->sta_lock, flags);
 
-        err = sta_info_finish_insert(sta, false);
+        err = sta_info_finish_insert(sta, false, dummy_reinsert);
         if (err) {
                 mutex_unlock(&local->sta_mtx);
                 rcu_read_lock();
-                goto out_free;
+                return err;
         }
 
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
-        wiphy_debug(local->hw.wiphy, "Inserted STA %pM\n", sta->sta.addr);
+        wiphy_debug(local->hw.wiphy, "Inserted %sSTA %pM\n",
+                        sta->dummy ? "dummy " : "", sta->sta.addr);
 #endif /* CONFIG_MAC80211_VERBOSE_DEBUG */
 
         /* move reference to rcu-protected */
@@ -478,6 +544,51 @@ int sta_info_insert_rcu(struct sta_info *sta) __acquires(RCU)
                 mesh_accept_plinks_update(sdata);
 
         return 0;
+}
+
+int sta_info_insert_rcu(struct sta_info *sta) __acquires(RCU)
+{
+        struct ieee80211_local *local = sta->local;
+        struct ieee80211_sub_if_data *sdata = sta->sdata;
+        int err = 0;
+
+        err = sta_info_insert_check(sta);
+        if (err) {
+                rcu_read_lock();
+                goto out_free;
+        }
+
+        /*
+         * In ad-hoc mode, we sometimes need to insert stations
+         * from tasklet context from the RX path. To avoid races,
+         * always do so in that case -- see the comment below.
+         */
+        if (sdata->vif.type == NL80211_IFTYPE_ADHOC) {
+                err = sta_info_insert_ibss(sta);
+                if (err)
+                        goto out_free;
+
+                return 0;
+        }
+
+        /*
+         * It might seem that the function called below is in race against
+         * the function call above that atomically inserts the station... That,
+         * however, is not true because the above code can only
+         * be invoked for IBSS interfaces, and the below code will
+         * not be -- and the two do not race against each other as
+         * the hash table also keys off the interface.
+         */
+
+        might_sleep();
+
+        mutex_lock(&local->sta_mtx);
+
+        err = sta_info_insert_non_ibss(sta);
+        if (err)
+                goto out_free;
+
+        return 0;
  out_free:
         BUG_ON(!err);
         __sta_info_free(local, sta);
@@ -493,6 +604,25 @@ int sta_info_insert(struct sta_info *sta)
         return err;
 }
 
+/* Caller must hold sta->local->sta_mtx */
+int sta_info_reinsert(struct sta_info *sta)
+{
+        struct ieee80211_local *local = sta->local;
+        int err = 0;
+
+        err = sta_info_insert_check(sta);
+        if (err) {
+                mutex_unlock(&local->sta_mtx);
+                return err;
+        }
+
+        might_sleep();
+
+        err = sta_info_insert_non_ibss(sta);
+        rcu_read_unlock();
+        return err;
+}
+
 static inline void __bss_tim_set(struct ieee80211_if_ap *bss, u16 aid)
 {
         /*
@@ -733,7 +863,7 @@ int sta_info_destroy_addr(struct ieee80211_sub_if_data *sdata, const u8 *addr)
         int ret;
 
         mutex_lock(&sdata->local->sta_mtx);
-        sta = sta_info_get(sdata, addr);
+        sta = sta_info_get_rx(sdata, addr);
         ret = __sta_info_destroy(sta);
         mutex_unlock(&sdata->local->sta_mtx);
 
@@ -747,7 +877,7 @@ int sta_info_destroy_addr_bss(struct ieee80211_sub_if_data *sdata,
         int ret;
 
         mutex_lock(&sdata->local->sta_mtx);
-        sta = sta_info_get_bss(sdata, addr);
+        sta = sta_info_get_bss_rx(sdata, addr);
         ret = __sta_info_destroy(sta);
         mutex_unlock(&sdata->local->sta_mtx);
 
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index 28beb78e601e..e9eb565506da 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -238,10 +238,12 @@ struct sta_ampdu_mlme {
  * @plink_timer: peer link watch timer
  * @plink_timer_was_running: used by suspend/resume to restore timers
  * @debugfs: debug filesystem info
- * @sta: station information we share with the driver
  * @dead: set to true when sta is unlinked
  * @uploaded: set to true when sta is uploaded to the driver
  * @lost_packets: number of consecutive lost packets
+ * @dummy: indicate a dummy station created for receiving
+ *      EAP frames before association
+ * @sta: station information we share with the driver
  */
 struct sta_info {
         /* General information, mostly static */
@@ -336,6 +338,9 @@ struct sta_info {
 
         unsigned int lost_packets;
 
+        /* should be right in front of sta to be in the same cache line */
+        bool dummy;
+
         /* keep last! */
         struct ieee80211_sta sta;
 };
@@ -436,9 +441,15 @@ rcu_dereference_protected_tid_tx(struct sta_info *sta, int tid)
 struct sta_info *sta_info_get(struct ieee80211_sub_if_data *sdata,
                               const u8 *addr);
 
+struct sta_info *sta_info_get_rx(struct ieee80211_sub_if_data *sdata,
+                              const u8 *addr);
+
 struct sta_info *sta_info_get_bss(struct ieee80211_sub_if_data *sdata,
                                   const u8 *addr);
 
+struct sta_info *sta_info_get_bss_rx(struct ieee80211_sub_if_data *sdata,
+                                  const u8 *addr);
+
 static inline
 void for_each_sta_info_type_check(struct ieee80211_local *local,
                                   const u8 *addr,
@@ -459,6 +470,22 @@ void for_each_sta_info_type_check(struct ieee80211_local *local,
                 _sta = nxt,                                             \
                 nxt = _sta ? rcu_dereference(_sta->hnext) : NULL        \
              )                                                          \
+        /* run code only if address matches and it's not a dummy sta */ \
+        if (memcmp(_sta->sta.addr, (_addr), ETH_ALEN) == 0 &&           \
+                !_sta->dummy)
+
+#define for_each_sta_info_rx(local, _addr, _sta, nxt)                   \
+        for (   /* initialise loop */                                   \
+                _sta = rcu_dereference(local->sta_hash[STA_HASH(_addr)]),\
+                nxt = _sta ? rcu_dereference(_sta->hnext) : NULL;       \
+                /* typecheck */                                         \
+                for_each_sta_info_type_check(local, (_addr), _sta, nxt),\
+                /* continue condition */                                \
+                _sta;                                                   \
+                /* advance loop */                                      \
+                _sta = nxt,                                             \
+                nxt = _sta ? rcu_dereference(_sta->hnext) : NULL        \
+             )                                                          \
         /* compare address and run code only if it matches */           \
         if (memcmp(_sta->sta.addr, (_addr), ETH_ALEN) == 0)
 
@@ -484,6 +511,7 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
 int sta_info_insert(struct sta_info *sta);
 int sta_info_insert_rcu(struct sta_info *sta) __acquires(RCU);
 int sta_info_insert_atomic(struct sta_info *sta);
+int sta_info_reinsert(struct sta_info *sta);
 
 int sta_info_destroy_addr(struct ieee80211_sub_if_data *sdata,
                           const u8 *addr);
diff --git a/net/mac80211/status.c b/net/mac80211/status.c
index a89cca3491b4..e51bd2a1a073 100644
--- a/net/mac80211/status.c
+++ b/net/mac80211/status.c
@@ -187,6 +187,8 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
         int rates_idx = -1;
         bool send_to_cooked;
         bool acked;
+        struct ieee80211_bar *bar;
+        u16 tid;
 
         for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
                 if (info->status.rates[i].idx < 0) {
@@ -243,6 +245,22 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
                                            tid, ssn);
                 }
 
+                if (!acked && ieee80211_is_back_req(fc)) {
+                        /*
+                         * BAR failed, let's tear down the BA session as a
+                         * last resort as some STAs (Intel 5100 on Windows)
+                         * can get stuck when the BA window isn't flushed
+                         * correctly.
+                         */
+                        bar = (struct ieee80211_bar *) skb->data;
+                        if (!(bar->control & IEEE80211_BAR_CTRL_MULTI_TID)) {
+                                tid = (bar->control &
+                                       IEEE80211_BAR_CTRL_TID_INFO_MASK) >>
+                                      IEEE80211_BAR_CTRL_TID_INFO_SHIFT;
+                                ieee80211_stop_tx_ba_session(&sta->sta, tid);
+                        }
+                }
+
                 if (info->flags & IEEE80211_TX_STAT_TX_FILTERED) {
                         ieee80211_handle_filtered_frame(local, sta, skb);
                         rcu_read_unlock();
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 69fd494f32f9..01072639666f 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -2295,13 +2295,23 @@ struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
                 memcpy(mgmt->bssid, sdata->vif.addr, ETH_ALEN);
                 mgmt->u.beacon.beacon_int =
                         cpu_to_le16(sdata->vif.bss_conf.beacon_int);
-                mgmt->u.beacon.capab_info = 0x0; /* 0x0 for MPs */
+                mgmt->u.beacon.capab_info |= cpu_to_le16(
+                        sdata->u.mesh.security ? WLAN_CAPABILITY_PRIVACY : 0);
 
                 pos = skb_put(skb, 2);
                 *pos++ = WLAN_EID_SSID;
                 *pos++ = 0x0;
 
-                mesh_mgmt_ies_add(skb, sdata);
+                if (mesh_add_srates_ie(skb, sdata) ||
+                    mesh_add_ds_params_ie(skb, sdata) ||
+                    mesh_add_ext_srates_ie(skb, sdata) ||
+                    mesh_add_rsn_ie(skb, sdata) ||
+                    mesh_add_meshid_ie(skb, sdata) ||
+                    mesh_add_meshconf_ie(skb, sdata) ||
+                    mesh_add_vendor_ies(skb, sdata)) {
+                        pr_err("o11s: couldn't add ies!\n");
+                        goto out;
+                }
         } else {
                 WARN_ON(1);
                 goto out;