Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next-2.6 into for-davem

Conflicts:
	drivers/net/wireless/iwlwifi/iwl-core.c
	drivers/net/wireless/rt2x00/rt2x00queue.c
	drivers/net/wireless/rt2x00/rt2x00queue.h

15 files changed, 203 insertions, 66 deletions

diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index bf5d28da46e6..a6d191f2a0fe 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -330,6 +330,7 @@ static void rate_idx_to_bitrate(struct rate_info *rate, struct sta_info *sta, in
 static void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
 {
         struct ieee80211_sub_if_data *sdata = sta->sdata;
+        struct timespec uptime;
 
         sinfo->generation = sdata->local->sta_generation;
 
@@ -343,7 +344,11 @@ static void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
                         STATION_INFO_TX_BITRATE |
                         STATION_INFO_RX_BITRATE |
                         STATION_INFO_RX_DROP_MISC |
-                        STATION_INFO_BSS_PARAM;
+                        STATION_INFO_BSS_PARAM |
+                        STATION_INFO_CONNECTED_TIME;
+
+        do_posix_clock_monotonic_gettime(&uptime);
+        sinfo->connected_time = uptime.tv_sec - sta->last_connected;
 
         sinfo->inactive_time = jiffies_to_msecs(jiffies - sta->last_rx);
         sinfo->rx_bytes = sta->rx_bytes;
@@ -686,6 +691,12 @@ static void sta_apply_parameters(struct ieee80211_local *local,
                 if (set & BIT(NL80211_STA_FLAG_MFP))
                         sta->flags |= WLAN_STA_MFP;
         }
+
+        if (mask & BIT(NL80211_STA_FLAG_AUTHENTICATED)) {
+                sta->flags &= ~WLAN_STA_AUTH;
+                if (set & BIT(NL80211_STA_FLAG_AUTHENTICATED))
+                        sta->flags |= WLAN_STA_AUTH;
+        }
         spin_unlock_irqrestore(&sta->flaglock, flags);
 
         /*
@@ -1034,26 +1045,26 @@ static int copy_mesh_setup(struct ieee80211_if_mesh *ifmsh,
         u8 *new_ie;
         const u8 *old_ie;
 
-        /* first allocate the new vendor information element */
+        /* allocate information elements */
         new_ie = NULL;
-        old_ie = ifmsh->vendor_ie;
+        old_ie = ifmsh->ie;
 
-        ifmsh->vendor_ie_len = setup->vendor_ie_len;
-        if (setup->vendor_ie_len) {
-                new_ie = kmemdup(setup->vendor_ie, setup->vendor_ie_len,
+        if (setup->ie_len) {
+                new_ie = kmemdup(setup->ie, setup->ie_len,
                                 GFP_KERNEL);
                 if (!new_ie)
                         return -ENOMEM;
         }
+        ifmsh->ie_len = setup->ie_len;
+        ifmsh->ie = new_ie;
+        kfree(old_ie);
 
         /* now copy the rest of the setup parameters */
         ifmsh->mesh_id_len = setup->mesh_id_len;
         memcpy(ifmsh->mesh_id, setup->mesh_id, ifmsh->mesh_id_len);
         ifmsh->mesh_pp_id = setup->path_sel_proto;
         ifmsh->mesh_pm_id = setup->path_metric;
-        ifmsh->vendor_ie = new_ie;
-
-        kfree(old_ie);
+        ifmsh->is_secure = setup->is_secure;
 
         return 0;
 }
diff --git a/net/mac80211/debugfs_sta.c b/net/mac80211/debugfs_sta.c
index c04a1396cf8d..a01d2137fddc 100644
--- a/net/mac80211/debugfs_sta.c
+++ b/net/mac80211/debugfs_sta.c
@@ -92,6 +92,31 @@ static ssize_t sta_inactive_ms_read(struct file *file, char __user *userbuf,
 }
 STA_OPS(inactive_ms);
 
+
+static ssize_t sta_connected_time_read(struct file *file, char __user *userbuf,
+                                        size_t count, loff_t *ppos)
+{
+        struct sta_info *sta = file->private_data;
+        struct timespec uptime;
+        struct tm result;
+        long connected_time_secs;
+        char buf[100];
+        int res;
+        do_posix_clock_monotonic_gettime(&uptime);
+        connected_time_secs = uptime.tv_sec - sta->last_connected;
+        time_to_tm(connected_time_secs, 0, &result);
+        result.tm_year -= 70;
+        result.tm_mday -= 1;
+        res = scnprintf(buf, sizeof(buf),
+                "years  - %ld\nmonths - %d\ndays   - %d\nclock  - %d:%d:%d\n\n",
+                        result.tm_year, result.tm_mon, result.tm_mday,
+                        result.tm_hour, result.tm_min, result.tm_sec);
+        return simple_read_from_buffer(userbuf, count, ppos, buf, res);
+}
+STA_OPS(connected_time);
+
+
+
 static ssize_t sta_last_seq_ctrl_read(struct file *file, char __user *userbuf,
                                       size_t count, loff_t *ppos)
 {
@@ -324,6 +349,7 @@ void ieee80211_sta_debugfs_add(struct sta_info *sta)
         DEBUGFS_ADD(flags);
         DEBUGFS_ADD(num_ps_buf_frames);
         DEBUGFS_ADD(inactive_ms);
+        DEBUGFS_ADD(connected_time);
         DEBUGFS_ADD(last_seq_ctrl);
         DEBUGFS_ADD(agg_status);
         DEBUGFS_ADD(dev);
diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
index 9c0d62bb0ea3..00a0685f2403 100644
--- a/net/mac80211/driver-ops.h
+++ b/net/mac80211/driver-ops.h
@@ -552,4 +552,17 @@ static inline void drv_get_ringparam(struct ieee80211_local *local,
         trace_drv_return_void(local);
 }
 
+static inline bool drv_tx_frames_pending(struct ieee80211_local *local)
+{
+        bool ret = false;
+
+        might_sleep();
+
+        trace_drv_tx_frames_pending(local);
+        if (local->ops->tx_frames_pending)
+                ret = local->ops->tx_frames_pending(&local->hw);
+        trace_drv_return_bool(local, ret);
+
+        return ret;
+}
 #endif /* __MAC80211_DRIVER_OPS */
diff --git a/net/mac80211/driver-trace.h b/net/mac80211/driver-trace.h
index 45aab80738e2..c8c934d48b7a 100644
--- a/net/mac80211/driver-trace.h
+++ b/net/mac80211/driver-trace.h
@@ -74,6 +74,21 @@ TRACE_EVENT(drv_return_int,
         TP_printk(LOCAL_PR_FMT " - %d", LOCAL_PR_ARG, __entry->ret)
 );
 
+TRACE_EVENT(drv_return_bool,
+        TP_PROTO(struct ieee80211_local *local, bool ret),
+        TP_ARGS(local, ret),
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                __field(bool, ret)
+        ),
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                __entry->ret = ret;
+        ),
+        TP_printk(LOCAL_PR_FMT " - %s", LOCAL_PR_ARG, (__entry->ret) ?
+                  "true" : "false")
+);
+
 TRACE_EVENT(drv_return_u64,
         TP_PROTO(struct ieee80211_local *local, u64 ret),
         TP_ARGS(local, ret),
@@ -964,6 +979,11 @@ TRACE_EVENT(drv_get_ringparam,
         )
 );
 
+DEFINE_EVENT(local_only_evt, drv_tx_frames_pending,
+        TP_PROTO(struct ieee80211_local *local),
+        TP_ARGS(local)
+);
+
 DEFINE_EVENT(local_only_evt, drv_offchannel_tx_cancel_wait,
         TP_PROTO(struct ieee80211_local *local),
         TP_ARGS(local)
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 89ce1e329b5d..a77849970914 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -488,8 +488,9 @@ struct ieee80211_if_mesh {
         struct mesh_config mshcfg;
         u32 mesh_seqnum;
         bool accepting_plinks;
-        const u8 *vendor_ie;
-        u8 vendor_ie_len;
+        const u8 *ie;
+        u8 ie_len;
+        bool is_secure;
 };
 
 #ifdef CONFIG_MAC80211_MESH
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index dc50fc3153e5..0ab2a8df312d 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -545,7 +545,9 @@ ieee80211_default_mgmt_stypes[NUM_NL80211_IFTYPES] = {
         },
         [NL80211_IFTYPE_MESH_POINT] = {
                 .tx = 0xffff,
-                .rx = BIT(IEEE80211_STYPE_ACTION >> 4),
+                .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
+                        BIT(IEEE80211_STYPE_AUTH >> 4) |
+                        BIT(IEEE80211_STYPE_DEAUTH >> 4),
         },
 };
 
@@ -760,6 +762,11 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
         local->hw.wiphy->interface_modes &= ~BIT(NL80211_IFTYPE_MESH_POINT);
 #endif
 
+        /* if the underlying driver supports mesh, mac80211 will (at least)
+         * provide routing of mesh authentication frames to userspace */
+        if (local->hw.wiphy->interface_modes & BIT(NL80211_IFTYPE_MESH_POINT))
+                local->hw.wiphy->flags |= WIPHY_FLAG_MESH_AUTH;
+
         /* mac80211 supports control port protocol changing */
         local->hw.wiphy->flags |= WIPHY_FLAG_CONTROL_PORT_PROTOCOL;
 
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index 2a57cc02c618..11207979e2e2 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -279,9 +279,9 @@ void mesh_mgmt_ies_add(struct sk_buff *skb, struct ieee80211_sub_if_data *sdata)
             MESHCONF_CAPAB_ACCEPT_PLINKS : 0x00;
         *pos++ = 0x00;
 
-        if (sdata->u.mesh.vendor_ie) {
-                int len = sdata->u.mesh.vendor_ie_len;
-                const u8 *data = sdata->u.mesh.vendor_ie;
+        if (sdata->u.mesh.ie) {
+                int len = sdata->u.mesh.ie_len;
+                const u8 *data = sdata->u.mesh.ie;
                 if (skb_tailroom(skb) > len)
                         memcpy(skb_put(skb, len), data, len);
         }
@@ -573,6 +573,10 @@ static void ieee80211_mesh_rx_bcn_presp(struct ieee80211_sub_if_data *sdata,
         ieee802_11_parse_elems(mgmt->u.probe_resp.variable, len - baselen,
                                &elems);
 
+        /* ignore beacons from secure mesh peers if our security is off */
+        if (elems.rsn_len && !sdata->u.mesh.is_secure)
+                return;
+
         if (elems.ds_params && elems.ds_params_len == 1)
                 freq = ieee80211_channel_to_frequency(elems.ds_params[0], band);
         else
@@ -586,9 +590,7 @@ static void ieee80211_mesh_rx_bcn_presp(struct ieee80211_sub_if_data *sdata,
         if (elems.mesh_id && elems.mesh_config &&
             mesh_matches_local(&elems, sdata)) {
                 supp_rates = ieee80211_sta_get_rates(local, &elems, band);
-
-                mesh_neighbour_update(mgmt->sa, supp_rates, sdata,
-                                      mesh_peer_accepts_plinks(&elems));
+                mesh_neighbour_update(mgmt->sa, supp_rates, sdata, &elems);
         }
 }
 
diff --git a/net/mac80211/mesh.h b/net/mac80211/mesh.h
index b99e230fe31c..10acf1cc8082 100644
--- a/net/mac80211/mesh.h
+++ b/net/mac80211/mesh.h
@@ -226,7 +226,8 @@ void mesh_rx_path_sel_frame(struct ieee80211_sub_if_data *sdata,
 int mesh_path_add(u8 *dst, struct ieee80211_sub_if_data *sdata);
 /* Mesh plinks */
 void mesh_neighbour_update(u8 *hw_addr, u32 rates,
-                struct ieee80211_sub_if_data *sdata, bool add);
+                struct ieee80211_sub_if_data *sdata,
+                struct ieee802_11_elems *ie);
 bool mesh_peer_accepts_plinks(struct ieee802_11_elems *ie);
 void mesh_accept_plinks_update(struct ieee80211_sub_if_data *sdata);
 void mesh_plink_broken(struct sta_info *sta);
diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c
index 336ca9d0c5c4..35c715adaae2 100644
--- a/net/mac80211/mesh_pathtbl.c
+++ b/net/mac80211/mesh_pathtbl.c
@@ -65,42 +65,37 @@ void mesh_table_free(struct mesh_table *tbl, bool free_leafs)
         __mesh_table_free(tbl);
 }
 
-static struct mesh_table *mesh_table_grow(struct mesh_table *tbl)
+static int mesh_table_grow(struct mesh_table *oldtbl,
+                struct mesh_table *newtbl)
 {
-        struct mesh_table *newtbl;
         struct hlist_head *oldhash;
         struct hlist_node *p, *q;
         int i;
 
-        if (atomic_read(&tbl->entries)
-                        < tbl->mean_chain_len * (tbl->hash_mask + 1))
-                goto endgrow;
+        if (atomic_read(&oldtbl->entries)
+                        < oldtbl->mean_chain_len * (oldtbl->hash_mask + 1))
+                return -EAGAIN;
 
-        newtbl = mesh_table_alloc(tbl->size_order + 1);
-        if (!newtbl)
-                goto endgrow;
 
-        newtbl->free_node = tbl->free_node;
-        newtbl->mean_chain_len = tbl->mean_chain_len;
-        newtbl->copy_node = tbl->copy_node;
-        atomic_set(&newtbl->entries, atomic_read(&tbl->entries));
+        newtbl->free_node = oldtbl->free_node;
+        newtbl->mean_chain_len = oldtbl->mean_chain_len;
+        newtbl->copy_node = oldtbl->copy_node;
+        atomic_set(&newtbl->entries, atomic_read(&oldtbl->entries));
 
-        oldhash = tbl->hash_buckets;
-        for (i = 0; i <= tbl->hash_mask; i++)
+        oldhash = oldtbl->hash_buckets;
+        for (i = 0; i <= oldtbl->hash_mask; i++)
                 hlist_for_each(p, &oldhash[i])
-                        if (tbl->copy_node(p, newtbl) < 0)
+                        if (oldtbl->copy_node(p, newtbl) < 0)
                                 goto errcopy;
 
-        return newtbl;
+        return 0;
 
 errcopy:
         for (i = 0; i <= newtbl->hash_mask; i++) {
                 hlist_for_each_safe(p, q, &newtbl->hash_buckets[i])
-                        tbl->free_node(p, 0);
+                        oldtbl->free_node(p, 0);
         }
-        __mesh_table_free(newtbl);
-endgrow:
-        return NULL;
+        return -ENOMEM;
 }
 
 
@@ -334,10 +329,13 @@ void mesh_mpath_table_grow(void)
 {
         struct mesh_table *oldtbl, *newtbl;
 
+        newtbl = mesh_table_alloc(mesh_paths->size_order + 1);
+        if (!newtbl)
+                return;
         write_lock(&pathtbl_resize_lock);
         oldtbl = mesh_paths;
-        newtbl = mesh_table_grow(mesh_paths);
-        if (!newtbl) {
+        if (mesh_table_grow(mesh_paths, newtbl) < 0) {
+                __mesh_table_free(newtbl);
                 write_unlock(&pathtbl_resize_lock);
                 return;
         }
@@ -352,10 +350,13 @@ void mesh_mpp_table_grow(void)
 {
         struct mesh_table *oldtbl, *newtbl;
 
+        newtbl = mesh_table_alloc(mpp_paths->size_order + 1);
+        if (!newtbl)
+                return;
         write_lock(&pathtbl_resize_lock);
         oldtbl = mpp_paths;
-        newtbl = mesh_table_grow(mpp_paths);
-        if (!newtbl) {
+        if (mesh_table_grow(mpp_paths, newtbl) < 0) {
+                __mesh_table_free(newtbl);
                 write_unlock(&pathtbl_resize_lock);
                 return;
         }
diff --git a/net/mac80211/mesh_plink.c b/net/mac80211/mesh_plink.c
index 44b53931ba5e..84e5b056af02 100644
--- a/net/mac80211/mesh_plink.c
+++ b/net/mac80211/mesh_plink.c
@@ -105,7 +105,7 @@ static struct sta_info *mesh_plink_alloc(struct ieee80211_sub_if_data *sdata,
         if (!sta)
                 return NULL;
 
-        sta->flags = WLAN_STA_AUTHORIZED;
+        sta->flags = WLAN_STA_AUTHORIZED | WLAN_STA_AUTH;
         sta->sta.supp_rates[local->hw.conf.channel->band] = rates;
         rate_control_rate_init(sta);
 
@@ -161,7 +161,7 @@ static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata,
                 __le16 reason) {
         struct ieee80211_local *local = sdata->local;
         struct sk_buff *skb = dev_alloc_skb(local->hw.extra_tx_headroom + 400 +
-                        sdata->u.mesh.vendor_ie_len);
+                        sdata->u.mesh.ie_len);
         struct ieee80211_mgmt *mgmt;
         bool include_plid = false;
         static const u8 meshpeeringproto[] = { 0x00, 0x0F, 0xAC, 0x2A };
@@ -237,8 +237,9 @@ static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata,
         return 0;
 }
 
-void mesh_neighbour_update(u8 *hw_addr, u32 rates, struct ieee80211_sub_if_data *sdata,
-                           bool peer_accepting_plinks)
+void mesh_neighbour_update(u8 *hw_addr, u32 rates,
+                struct ieee80211_sub_if_data *sdata,
+                struct ieee802_11_elems *elems)
 {
         struct ieee80211_local *local = sdata->local;
         struct sta_info *sta;
@@ -248,8 +249,14 @@ void mesh_neighbour_update(u8 *hw_addr, u32 rates, struct ieee80211_sub_if_data
         sta = sta_info_get(sdata, hw_addr);
         if (!sta) {
                 rcu_read_unlock();
-
-                sta = mesh_plink_alloc(sdata, hw_addr, rates);
+                /* Userspace handles peer allocation when security is enabled
+                 * */
+                if (sdata->u.mesh.is_secure)
+                        cfg80211_notify_new_peer_candidate(sdata->dev, hw_addr,
+                                        elems->ie_start, elems->total_len,
+                                        GFP_KERNEL);
+                else
+                        sta = mesh_plink_alloc(sdata, hw_addr, rates);
                 if (!sta)
                         return;
                 if (sta_info_insert_rcu(sta)) {
@@ -260,7 +267,8 @@ void mesh_neighbour_update(u8 *hw_addr, u32 rates, struct ieee80211_sub_if_data
 
         sta->last_rx = jiffies;
         sta->sta.supp_rates[local->hw.conf.channel->band] = rates;
-        if (peer_accepting_plinks && sta->plink_state == PLINK_LISTEN &&
+        if (mesh_peer_accepts_plinks(elems) &&
+                        sta->plink_state == PLINK_LISTEN &&
                         sdata->u.mesh.accepting_plinks &&
                         sdata->u.mesh.mshcfg.auto_open_plinks)
                 mesh_plink_open(sta);
@@ -372,6 +380,9 @@ int mesh_plink_open(struct sta_info *sta)
         __le16 llid;
         struct ieee80211_sub_if_data *sdata = sta->sdata;
 
+        if (!test_sta_flags(sta, WLAN_STA_AUTH))
+                return -EPERM;
+
         spin_lock_bh(&sta->lock);
         get_random_bytes(&llid, 2);
         sta->llid = llid;
@@ -449,6 +460,10 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                 mpl_dbg("Mesh plink: missing necessary peer link ie\n");
                 return;
         }
+        if (elems.rsn_len && !sdata->u.mesh.is_secure) {
+                mpl_dbg("Mesh plink: can't establish link with secure peer\n");
+                return;
+        }
 
         ftype = mgmt->u.action.u.plink_action.action_code;
         ie_len = elems.peer_link_len;
@@ -480,6 +495,12 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                 return;
         }
 
+        if (sta && !test_sta_flags(sta, WLAN_STA_AUTH)) {
+                mpl_dbg("Mesh plink: Action frame from non-authed peer\n");
+                rcu_read_unlock();
+                return;
+        }
+
         if (sta && sta->plink_state == PLINK_BLOCKED) {
                 rcu_read_unlock();
                 return;
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 865fed4cc18b..a41f234bd486 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -761,15 +761,16 @@ void ieee80211_dynamic_ps_enable_work(struct work_struct *work)
         if ((local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK) &&
             (!(ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED))) {
                 netif_tx_stop_all_queues(sdata->dev);
-                /*
-                 * Flush all the frames queued in the driver before
-                 * going to power save
-                 */
-                drv_flush(local, false);
-                ieee80211_send_nullfunc(local, sdata, 1);
 
-                /* Flush once again to get the tx status of nullfunc frame */
-                drv_flush(local, false);
+                if (drv_tx_frames_pending(local))
+                        mod_timer(&local->dynamic_ps_timer, jiffies +
+                                  msecs_to_jiffies(
+                                  local->hw.conf.dynamic_ps_timeout));
+                else {
+                        ieee80211_send_nullfunc(local, sdata, 1);
+                        /* Flush to get the tx status of nullfunc frame */
+                        drv_flush(local, false);
+                }
         }
 
         if (!((local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS) &&
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 1f0b010904b8..a864890e4d03 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -143,7 +143,8 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
         if (status->flag & RX_FLAG_HT) {
                 /*
                  * MCS information is a separate field in radiotap,
-                 * added below.
+                 * added below. The byte here is needed as padding
+                 * for the channel though, so initialise it to 0.
                  */
                 *pos = 0;
         } else {
@@ -502,7 +503,8 @@ ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
 
                 if (ieee80211_is_probe_req(hdr->frame_control) ||
                     ieee80211_is_probe_resp(hdr->frame_control) ||
-                    ieee80211_is_beacon(hdr->frame_control))
+                    ieee80211_is_beacon(hdr->frame_control) ||
+                    ieee80211_is_auth(hdr->frame_control))
                         return RX_CONTINUE;
 
                 return RX_DROP_MONITOR;
@@ -1585,7 +1587,7 @@ ieee80211_drop_unencrypted_mgmt(struct ieee80211_rx_data *rx)
 }
 
 static int
-__ieee80211_data_to_8023(struct ieee80211_rx_data *rx)
+__ieee80211_data_to_8023(struct ieee80211_rx_data *rx, bool *port_control)
 {
         struct ieee80211_sub_if_data *sdata = rx->sdata;
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
@@ -1593,6 +1595,7 @@ __ieee80211_data_to_8023(struct ieee80211_rx_data *rx)
         struct ethhdr *ehdr;
         int ret;
 
+        *port_control = false;
         if (ieee80211_has_a4(hdr->frame_control) &&
             sdata->vif.type == NL80211_IFTYPE_AP_VLAN && !sdata->u.vlan.sta)
                 return -1;
@@ -1611,11 +1614,13 @@ __ieee80211_data_to_8023(struct ieee80211_rx_data *rx)
                 return -1;
 
         ret = ieee80211_data_to_8023(rx->skb, sdata->vif.addr, sdata->vif.type);
-        if (ret < 0 || !check_port_control)
+        if (ret < 0)
                 return ret;
 
         ehdr = (struct ethhdr *) rx->skb->data;
-        if (ehdr->h_proto != rx->sdata->control_port_protocol)
+        if (ehdr->h_proto == rx->sdata->control_port_protocol)
+                *port_control = true;
+        else if (check_port_control)
                 return -1;
 
         return 0;
@@ -1916,6 +1921,7 @@ ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
         struct net_device *dev = sdata->dev;
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
         __le16 fc = hdr->frame_control;
+        bool port_control;
         int err;
 
         if (unlikely(!ieee80211_is_data(hdr->frame_control)))
@@ -1932,13 +1938,21 @@ ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
             sdata->vif.type == NL80211_IFTYPE_AP)
                 return RX_DROP_MONITOR;
 
-        err = __ieee80211_data_to_8023(rx);
+        err = __ieee80211_data_to_8023(rx, &port_control);
         if (unlikely(err))
                 return RX_DROP_UNUSABLE;
 
         if (!ieee80211_frame_allowed(rx, fc))
                 return RX_DROP_MONITOR;
 
+        if (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
+            unlikely(port_control) && sdata->bss) {
+                sdata = container_of(sdata->bss, struct ieee80211_sub_if_data,
+                                     u.ap);
+                dev = sdata->dev;
+                rx->sdata = sdata;
+        }
+
         rx->skb->dev = dev;
 
         dev->stats.rx_packets++;
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index 52d4b1a695c9..a03d8a312875 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -228,6 +228,7 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
 {
         struct ieee80211_local *local = sdata->local;
         struct sta_info *sta;
+        struct timespec uptime;
         int i;
 
         sta = kzalloc(sizeof(*sta) + local->hw.sta_data_size, gfp);
@@ -245,6 +246,8 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
         sta->sdata = sdata;
         sta->last_rx = jiffies;
 
+        do_posix_clock_monotonic_gettime(&uptime);
+        sta->last_connected = uptime.tv_sec;
         ewma_init(&sta->avg_signal, 1024, 8);
 
         if (sta_prepare_rate_control(local, sta, gfp)) {
@@ -609,7 +612,8 @@ static bool sta_info_cleanup_expire_buffered(struct ieee80211_local *local,
 #endif
                 dev_kfree_skb(skb);
 
-                if (skb_queue_empty(&sta->ps_tx_buf))
+                if (skb_queue_empty(&sta->ps_tx_buf) &&
+                    !test_sta_flags(sta, WLAN_STA_PS_DRIVER_BUF))
                         sta_info_clear_tim_bit(sta);
         }
 
@@ -893,6 +897,7 @@ void ieee80211_sta_ps_deliver_wakeup(struct sta_info *sta)
         struct ieee80211_local *local = sdata->local;
         int sent, buffered;
 
+        clear_sta_flags(sta, WLAN_STA_PS_DRIVER_BUF);
         if (!(local->hw.flags & IEEE80211_HW_AP_LINK_PS))
                 drv_sta_notify(local, sdata, STA_NOTIFY_AWAKE, &sta->sta);
 
@@ -985,3 +990,12 @@ void ieee80211_sta_block_awake(struct ieee80211_hw *hw,
                 ieee80211_queue_work(hw, &sta->drv_unblock_wk);
 }
 EXPORT_SYMBOL(ieee80211_sta_block_awake);
+
+void ieee80211_sta_set_tim(struct ieee80211_sta *pubsta)
+{
+        struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
+
+        set_sta_flags(sta, WLAN_STA_PS_DRIVER_BUF);
+        sta_info_set_tim_bit(sta);
+}
+EXPORT_SYMBOL(ieee80211_sta_set_tim);
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index 87b18ba1e0e9..aa0adcbf3a93 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -43,6 +43,8 @@
  *      be in the queues
  * @WLAN_STA_PSPOLL: Station sent PS-poll while driver was keeping
  *      station in power-save mode, reply when the driver unblocks.
+ * @WLAN_STA_PS_DRIVER_BUF: Station has frames pending in driver internal
+ *      buffers. Automatically cleared on station wake-up.
  */
 enum ieee80211_sta_info_flags {
         WLAN_STA_AUTH           = 1<<0,
@@ -58,6 +60,7 @@ enum ieee80211_sta_info_flags {
         WLAN_STA_BLOCK_BA       = 1<<11,
         WLAN_STA_PS_DRIVER      = 1<<12,
         WLAN_STA_PSPOLL         = 1<<13,
+        WLAN_STA_PS_DRIVER_BUF  = 1<<14,
 };
 
 #define STA_TID_NUM 16
@@ -226,6 +229,7 @@ enum plink_state {
  * @rx_bytes: Number of bytes received from this STA
  * @wep_weak_iv_count: number of weak WEP IVs received from this station
  * @last_rx: time (in jiffies) when last frame was received from this STA
+ * @last_connected: time (in seconds) when a station got connected
  * @num_duplicates: number of duplicate frames received from this STA
  * @rx_fragments: number of received MPDUs
  * @rx_dropped: number of dropped MPDUs from this STA
@@ -295,6 +299,7 @@ struct sta_info {
         unsigned long rx_packets, rx_bytes;
         unsigned long wep_weak_iv_count;
         unsigned long last_rx;
+        long last_connected;
         unsigned long num_duplicates;
         unsigned long rx_fragments;
         unsigned long rx_dropped;
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index ce4596ed1268..17b10be31f55 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -2262,7 +2262,7 @@ struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
 
                 /* headroom, head length, tail length and maximum TIM length */
                 skb = dev_alloc_skb(local->tx_headroom + 400 +
-                                sdata->u.mesh.vendor_ie_len);
+                                sdata->u.mesh.ie_len);
                 if (!skb)
                         goto out;