Merge branch 'master' of git://git.infradead.org/users/linville/wireless-next into for-davem

11 files changed, 292 insertions, 273 deletions

diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 55ee5a31756f..ebd7fb101fbf 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -344,7 +344,8 @@ static void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
                         STATION_INFO_RX_BITRATE |
                         STATION_INFO_RX_DROP_MISC |
                         STATION_INFO_BSS_PARAM |
-                        STATION_INFO_CONNECTED_TIME;
+                        STATION_INFO_CONNECTED_TIME |
+                        STATION_INFO_STA_FLAGS;
 
         do_posix_clock_monotonic_gettime(&uptime);
         sinfo->connected_time = uptime.tv_sec - sta->last_connected;
@@ -404,6 +405,23 @@ static void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
                 sinfo->bss_param.flags |= BSS_PARAM_FLAGS_SHORT_SLOT_TIME;
         sinfo->bss_param.dtim_period = sdata->local->hw.conf.ps_dtim_period;
         sinfo->bss_param.beacon_interval = sdata->vif.bss_conf.beacon_int;
+
+        sinfo->sta_flags.set = 0;
+        sinfo->sta_flags.mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
+                                BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
+                                BIT(NL80211_STA_FLAG_WME) |
+                                BIT(NL80211_STA_FLAG_MFP) |
+                                BIT(NL80211_STA_FLAG_AUTHENTICATED);
+        if (test_sta_flag(sta, WLAN_STA_AUTHORIZED))
+                sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_AUTHORIZED);
+        if (test_sta_flag(sta, WLAN_STA_SHORT_PREAMBLE))
+                sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_SHORT_PREAMBLE);
+        if (test_sta_flag(sta, WLAN_STA_WME))
+                sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_WME);
+        if (test_sta_flag(sta, WLAN_STA_MFP))
+                sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_MFP);
+        if (test_sta_flag(sta, WLAN_STA_AUTH))
+                sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_AUTHENTICATED);
 }
 
 
@@ -1886,7 +1904,7 @@ ieee80211_offchan_tx_done(struct ieee80211_work *wk, struct sk_buff *skb)
          * so in that case userspace will have to deal with it.
          */
 
-        if (wk->offchan_tx.wait && wk->offchan_tx.frame)
+        if (wk->offchan_tx.wait && !wk->offchan_tx.status)
                 cfg80211_mgmt_tx_status(wk->sdata->dev,
                                         (unsigned long) wk->offchan_tx.frame,
                                         wk->ie, wk->ie_len, false, GFP_KERNEL);
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 9fa5f8a674bc..4c3d1f591bec 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -136,7 +136,6 @@ typedef unsigned __bitwise__ ieee80211_tx_result;
 #define TX_DROP         ((__force ieee80211_tx_result) 1u)
 #define TX_QUEUED       ((__force ieee80211_tx_result) 2u)
 
-#define IEEE80211_TX_FRAGMENTED         BIT(0)
 #define IEEE80211_TX_UNICAST            BIT(1)
 #define IEEE80211_TX_PS_BUFFERED        BIT(2)
 
@@ -149,7 +148,6 @@ struct ieee80211_tx_data {
 
         struct ieee80211_channel *channel;
 
-        u16 ethertype;
         unsigned int flags;
 };
 
@@ -346,6 +344,7 @@ struct ieee80211_work {
                 struct {
                         struct sk_buff *frame;
                         u32 wait;
+                        bool status;
                 } offchan_tx;
         };
 
@@ -1178,18 +1177,6 @@ netdev_tx_t ieee80211_monitor_start_xmit(struct sk_buff *skb,
 netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
                                        struct net_device *dev);
 
-/*
- * radiotap header for status frames
- */
-struct ieee80211_tx_status_rtap_hdr {
-        struct ieee80211_radiotap_header hdr;
-        u8 rate;
-        u8 padding_for_rate;
-        __le16 tx_flags;
-        u8 data_retries;
-} __packed;
-
-
 /* HT */
 void ieee80211_ht_cap_ie_to_sta_ht_cap(struct ieee80211_supported_band *sband,
                                        struct ieee80211_ht_cap *ht_cap_ie,
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 17b038aeac9b..d4ee6d234a78 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -904,12 +904,8 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
          * and we need some headroom for passing the frame to monitor
          * interfaces, but never both at the same time.
          */
-#ifndef __CHECKER__
-        BUILD_BUG_ON(IEEE80211_TX_STATUS_HEADROOM !=
-                        sizeof(struct ieee80211_tx_status_rtap_hdr));
-#endif
         local->tx_headroom = max_t(unsigned int , local->hw.extra_tx_headroom,
-                                   sizeof(struct ieee80211_tx_status_rtap_hdr));
+                                   IEEE80211_TX_STATUS_HEADROOM);
 
         debugfs_hw_add(local);
 
diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
index 6df7913d7ca4..174040a42887 100644
--- a/net/mac80211/mesh_hwmp.c
+++ b/net/mac80211/mesh_hwmp.c
@@ -789,11 +789,20 @@ void mesh_rx_path_sel_frame(struct ieee80211_sub_if_data *sdata,
         struct ieee802_11_elems elems;
         size_t baselen;
         u32 last_hop_metric;
+        struct sta_info *sta;
 
         /* need action_code */
         if (len < IEEE80211_MIN_ACTION_SIZE + 1)
                 return;
 
+        rcu_read_lock();
+        sta = sta_info_get(sdata, mgmt->sa);
+        if (!sta || sta->plink_state != NL80211_PLINK_ESTAB) {
+                rcu_read_unlock();
+                return;
+        }
+        rcu_read_unlock();
+
         baselen = (u8 *) mgmt->u.action.u.mesh_action.variable - (u8 *) mgmt;
         ieee802_11_parse_elems(mgmt->u.action.u.mesh_action.variable,
                         len - baselen, &elems);
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index 830e60f65779..397343a59275 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -254,6 +254,7 @@ static bool ieee80211_prep_hw_scan(struct ieee80211_local *local)
                                          req->ie, req->ie_len, band,
                                          req->rates[band], 0);
         local->hw_scan_req->ie_len = ielen;
+        local->hw_scan_req->no_cck = req->no_cck;
 
         return true;
 }
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index 58b1c2bb26d2..ce962d2c8782 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -1203,11 +1203,9 @@ static void ieee80211_send_null_response(struct ieee80211_sub_if_data *sdata,
         memcpy(nullfunc->addr2, sdata->vif.addr, ETH_ALEN);
         memcpy(nullfunc->addr3, sdata->vif.addr, ETH_ALEN);
 
+        skb->priority = tid;
+        skb_set_queue_mapping(skb, ieee802_1d_to_ac[tid]);
         if (qos) {
-                skb->priority = tid;
-
-                skb_set_queue_mapping(skb, ieee802_1d_to_ac[tid]);
-
                 nullfunc->qos_ctrl = cpu_to_le16(tid);
 
                 if (reason == IEEE80211_FRAME_RELEASE_UAPSD)
diff --git a/net/mac80211/status.c b/net/mac80211/status.c
index 864a9c3bcf46..df643cedf9b9 100644
--- a/net/mac80211/status.c
+++ b/net/mac80211/status.c
@@ -228,6 +228,102 @@ static void ieee80211_set_bar_pending(struct sta_info *sta, u8 tid, u16 ssn)
         tid_tx->bar_pending = true;
 }
 
+static int ieee80211_tx_radiotap_len(struct ieee80211_tx_info *info)
+{
+        int len = sizeof(struct ieee80211_radiotap_header);
+
+        /* IEEE80211_RADIOTAP_RATE rate */
+        if (info->status.rates[0].idx >= 0 &&
+            !(info->status.rates[0].flags & IEEE80211_TX_RC_MCS))
+                len += 2;
+
+        /* IEEE80211_RADIOTAP_TX_FLAGS */
+        len += 2;
+
+        /* IEEE80211_RADIOTAP_DATA_RETRIES */
+        len += 1;
+
+        /* IEEE80211_TX_RC_MCS */
+        if (info->status.rates[0].idx >= 0 &&
+            info->status.rates[0].flags & IEEE80211_TX_RC_MCS)
+                len += 3;
+
+        return len;
+}
+
+static void ieee80211_add_tx_radiotap_header(struct ieee80211_supported_band
+                                             *sband, struct sk_buff *skb,
+                                             int retry_count, int rtap_len)
+{
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
+        struct ieee80211_radiotap_header *rthdr;
+        unsigned char *pos;
+        __le16 txflags;
+
+        rthdr = (struct ieee80211_radiotap_header *) skb_push(skb, rtap_len);
+
+        memset(rthdr, 0, rtap_len);
+        rthdr->it_len = cpu_to_le16(rtap_len);
+        rthdr->it_present =
+                cpu_to_le32((1 << IEEE80211_RADIOTAP_TX_FLAGS) |
+                            (1 << IEEE80211_RADIOTAP_DATA_RETRIES));
+        pos = (unsigned char *)(rthdr + 1);
+
+        /*
+         * XXX: Once radiotap gets the bitmap reset thing the vendor
+         *      extensions proposal contains, we can actually report
+         *      the whole set of tries we did.
+         */
+
+        /* IEEE80211_RADIOTAP_RATE */
+        if (info->status.rates[0].idx >= 0 &&
+            !(info->status.rates[0].flags & IEEE80211_TX_RC_MCS)) {
+                rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_RATE);
+                *pos = sband->bitrates[info->status.rates[0].idx].bitrate / 5;
+                /* padding for tx flags */
+                pos += 2;
+        }
+
+        /* IEEE80211_RADIOTAP_TX_FLAGS */
+        txflags = 0;
+        if (!(info->flags & IEEE80211_TX_STAT_ACK) &&
+            !is_multicast_ether_addr(hdr->addr1))
+                txflags |= cpu_to_le16(IEEE80211_RADIOTAP_F_TX_FAIL);
+
+        if ((info->status.rates[0].flags & IEEE80211_TX_RC_USE_RTS_CTS) ||
+            (info->status.rates[0].flags & IEEE80211_TX_RC_USE_CTS_PROTECT))
+                txflags |= cpu_to_le16(IEEE80211_RADIOTAP_F_TX_CTS);
+        else if (info->status.rates[0].flags & IEEE80211_TX_RC_USE_RTS_CTS)
+                txflags |= cpu_to_le16(IEEE80211_RADIOTAP_F_TX_RTS);
+
+        put_unaligned_le16(txflags, pos);
+        pos += 2;
+
+        /* IEEE80211_RADIOTAP_DATA_RETRIES */
+        /* for now report the total retry_count */
+        *pos = retry_count;
+        pos++;
+
+        /* IEEE80211_TX_RC_MCS */
+        if (info->status.rates[0].idx >= 0 &&
+            info->status.rates[0].flags & IEEE80211_TX_RC_MCS) {
+                rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_MCS);
+                pos[0] = IEEE80211_RADIOTAP_MCS_HAVE_MCS |
+                         IEEE80211_RADIOTAP_MCS_HAVE_GI |
+                         IEEE80211_RADIOTAP_MCS_HAVE_BW;
+                if (info->status.rates[0].flags & IEEE80211_TX_RC_SHORT_GI)
+                        pos[1] |= IEEE80211_RADIOTAP_MCS_SGI;
+                if (info->status.rates[0].flags & IEEE80211_TX_RC_40_MHZ_WIDTH)
+                        pos[1] |= IEEE80211_RADIOTAP_MCS_BW_40;
+                if (info->status.rates[0].flags & IEEE80211_TX_RC_GREEN_FIELD)
+                        pos[1] |= IEEE80211_RADIOTAP_MCS_FMT_GF;
+                pos[2] = info->status.rates[0].idx;
+                pos += 3;
+        }
+
+}
+
 /*
  * Use a static threshold for now, best value to be determined
  * by testing ...
@@ -246,7 +342,6 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
         u16 frag, type;
         __le16 fc;
         struct ieee80211_supported_band *sband;
-        struct ieee80211_tx_status_rtap_hdr *rthdr;
         struct ieee80211_sub_if_data *sdata;
         struct net_device *prev_dev = NULL;
         struct sta_info *sta, *tmp;
@@ -256,6 +351,7 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
         bool acked;
         struct ieee80211_bar *bar;
         u16 tid;
+        int rtap_len;
 
         for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
                 if (info->status.rates[i].idx < 0) {
@@ -429,7 +525,7 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
                                 continue;
                         if (wk->offchan_tx.frame != skb)
                                 continue;
-                        wk->offchan_tx.frame = NULL;
+                        wk->offchan_tx.status = true;
                         break;
                 }
                 rcu_read_unlock();
@@ -460,44 +556,13 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
         }
 
         /* send frame to monitor interfaces now */
-
-        if (skb_headroom(skb) < sizeof(*rthdr)) {
+        rtap_len = ieee80211_tx_radiotap_len(info);
+        if (WARN_ON_ONCE(skb_headroom(skb) < rtap_len)) {
                 printk(KERN_ERR "ieee80211_tx_status: headroom too small\n");
                 dev_kfree_skb(skb);
                 return;
         }
-
-        rthdr = (struct ieee80211_tx_status_rtap_hdr *)
-                                skb_push(skb, sizeof(*rthdr));
-
-        memset(rthdr, 0, sizeof(*rthdr));
-        rthdr->hdr.it_len = cpu_to_le16(sizeof(*rthdr));
-        rthdr->hdr.it_present =
-                cpu_to_le32((1 << IEEE80211_RADIOTAP_TX_FLAGS) |
-                            (1 << IEEE80211_RADIOTAP_DATA_RETRIES) |
-                            (1 << IEEE80211_RADIOTAP_RATE));
-
-        if (!(info->flags & IEEE80211_TX_STAT_ACK) &&
-            !is_multicast_ether_addr(hdr->addr1))
-                rthdr->tx_flags |= cpu_to_le16(IEEE80211_RADIOTAP_F_TX_FAIL);
-
-        /*
-         * XXX: Once radiotap gets the bitmap reset thing the vendor
-         *      extensions proposal contains, we can actually report
-         *      the whole set of tries we did.
-         */
-        if ((info->status.rates[0].flags & IEEE80211_TX_RC_USE_RTS_CTS) ||
-            (info->status.rates[0].flags & IEEE80211_TX_RC_USE_CTS_PROTECT))
-                rthdr->tx_flags |= cpu_to_le16(IEEE80211_RADIOTAP_F_TX_CTS);
-        else if (info->status.rates[0].flags & IEEE80211_TX_RC_USE_RTS_CTS)
-                rthdr->tx_flags |= cpu_to_le16(IEEE80211_RADIOTAP_F_TX_RTS);
-        if (info->status.rates[0].idx >= 0 &&
-            !(info->status.rates[0].flags & IEEE80211_TX_RC_MCS))
-                rthdr->rate = sband->bitrates[
-                                info->status.rates[0].idx].bitrate / 5;
-
-        /* for now report the total retry_count */
-        rthdr->data_retries = retry_count;
+        ieee80211_add_tx_radiotap_header(sband, skb, retry_count, rtap_len);
 
         /* XXX: is this sufficient for BPF? */
         skb_set_mac_header(skb, 0);
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index ad2ee4a90ec4..48bbb96d8edb 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -898,7 +898,10 @@ ieee80211_tx_h_fragment(struct ieee80211_tx_data *tx)
         int hdrlen;
         int fragnum;
 
-        if (!(tx->flags & IEEE80211_TX_FRAGMENTED))
+        if (info->flags & IEEE80211_TX_CTL_DONTFRAG)
+                return TX_CONTINUE;
+
+        if (tx->local->ops->set_frag_threshold)
                 return TX_CONTINUE;
 
         /*
@@ -911,7 +914,7 @@ ieee80211_tx_h_fragment(struct ieee80211_tx_data *tx)
 
         hdrlen = ieee80211_hdrlen(hdr->frame_control);
 
-        /* internal error, why is TX_FRAGMENTED set? */
+        /* internal error, why isn't DONTFRAG set? */
         if (WARN_ON(skb->len + FCS_LEN <= frag_threshold))
                 return TX_DROP;
 
@@ -1032,108 +1035,6 @@ ieee80211_tx_h_calculate_duration(struct ieee80211_tx_data *tx)
 
 /* actual transmit path */
 
-/*
- * deal with packet injection down monitor interface
- * with Radiotap Header -- only called for monitor mode interface
- */
-static bool __ieee80211_parse_tx_radiotap(struct ieee80211_tx_data *tx,
-                                          struct sk_buff *skb)
-{
-        /*
-         * this is the moment to interpret and discard the radiotap header that
-         * must be at the start of the packet injected in Monitor mode
-         *
-         * Need to take some care with endian-ness since radiotap
-         * args are little-endian
-         */
-
-        struct ieee80211_radiotap_iterator iterator;
-        struct ieee80211_radiotap_header *rthdr =
-                (struct ieee80211_radiotap_header *) skb->data;
-        bool hw_frag;
-        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-        int ret = ieee80211_radiotap_iterator_init(&iterator, rthdr, skb->len,
-                                                   NULL);
-        u16 txflags;
-
-        info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
-        tx->flags &= ~IEEE80211_TX_FRAGMENTED;
-
-        /* packet is fragmented in HW if we have a non-NULL driver callback */
-        hw_frag = (tx->local->ops->set_frag_threshold != NULL);
-
-        /*
-         * for every radiotap entry that is present
-         * (ieee80211_radiotap_iterator_next returns -ENOENT when no more
-         * entries present, or -EINVAL on error)
-         */
-
-        while (!ret) {
-                ret = ieee80211_radiotap_iterator_next(&iterator);
-
-                if (ret)
-                        continue;
-
-                /* see if this argument is something we can use */
-                switch (iterator.this_arg_index) {
-                /*
-                 * You must take care when dereferencing iterator.this_arg
-                 * for multibyte types... the pointer is not aligned.  Use
-                 * get_unaligned((type *)iterator.this_arg) to dereference
-                 * iterator.this_arg for type "type" safely on all arches.
-                */
-                case IEEE80211_RADIOTAP_FLAGS:
-                        if (*iterator.this_arg & IEEE80211_RADIOTAP_F_FCS) {
-                                /*
-                                 * this indicates that the skb we have been
-                                 * handed has the 32-bit FCS CRC at the end...
-                                 * we should react to that by snipping it off
-                                 * because it will be recomputed and added
-                                 * on transmission
-                                 */
-                                if (skb->len < (iterator._max_length + FCS_LEN))
-                                        return false;
-
-                                skb_trim(skb, skb->len - FCS_LEN);
-                        }
-                        if (*iterator.this_arg & IEEE80211_RADIOTAP_F_WEP)
-                                info->flags &= ~IEEE80211_TX_INTFL_DONT_ENCRYPT;
-                        if ((*iterator.this_arg & IEEE80211_RADIOTAP_F_FRAG) &&
-                                                                !hw_frag)
-                                tx->flags |= IEEE80211_TX_FRAGMENTED;
-                        break;
-
-                case IEEE80211_RADIOTAP_TX_FLAGS:
-                        txflags = le16_to_cpu(get_unaligned((__le16*)
-                                                iterator.this_arg));
-                        if (txflags & IEEE80211_RADIOTAP_F_TX_NOACK)
-                                info->flags |= IEEE80211_TX_CTL_NO_ACK;
-                        break;
-
-                /*
-                 * Please update the file
-                 * Documentation/networking/mac80211-injection.txt
-                 * when parsing new fields here.
-                 */
-
-                default:
-                        break;
-                }
-        }
-
-        if (ret != -ENOENT) /* ie, if we didn't simply run out of fields */
-                return false;
-
-        /*
-         * remove the radiotap header
-         * iterator->_max_length was sanity-checked against
-         * skb->len by iterator init
-         */
-        skb_pull(skb, iterator._max_length);
-
-        return true;
-}
-
 static bool ieee80211_tx_prep_agg(struct ieee80211_tx_data *tx,
                                   struct sk_buff *skb,
                                   struct ieee80211_tx_info *info,
@@ -1198,7 +1099,7 @@ ieee80211_tx_prepare(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_hdr *hdr;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-        int hdrlen, tid;
+        int tid;
         u8 *qc;
 
         memset(tx, 0, sizeof(*tx));
@@ -1206,26 +1107,6 @@ ieee80211_tx_prepare(struct ieee80211_sub_if_data *sdata,
         tx->local = local;
         tx->sdata = sdata;
         tx->channel = local->hw.conf.channel;
-        /*
-         * Set this flag (used below to indicate "automatic fragmentation"),
-         * it will be cleared/left by radiotap as desired.
-         * Only valid when fragmentation is done by the stack.
-         */
-        if (!local->ops->set_frag_threshold)
-                tx->flags |= IEEE80211_TX_FRAGMENTED;
-
-        /* process and remove the injection radiotap header */
-        if (unlikely(info->flags & IEEE80211_TX_INTFL_HAS_RADIOTAP)) {
-                if (!__ieee80211_parse_tx_radiotap(tx, skb))
-                        return TX_DROP;
-
-                /*
-                 * __ieee80211_parse_tx_radiotap has now removed
-                 * the radiotap header that was present and pre-filled
-                 * 'tx' with tx control information.
-                 */
-                info->flags &= ~IEEE80211_TX_INTFL_HAS_RADIOTAP;
-        }
 
         /*
          * If this flag is set to true anywhere, and we get here,
@@ -1281,13 +1162,11 @@ ieee80211_tx_prepare(struct ieee80211_sub_if_data *sdata,
                  */
         }
 
-        if (tx->flags & IEEE80211_TX_FRAGMENTED) {
-                if ((tx->flags & IEEE80211_TX_UNICAST) &&
-                    skb->len + FCS_LEN > local->hw.wiphy->frag_threshold &&
-                    !(info->flags & IEEE80211_TX_CTL_AMPDU))
-                        tx->flags |= IEEE80211_TX_FRAGMENTED;
-                else
-                        tx->flags &= ~IEEE80211_TX_FRAGMENTED;
+        if (!(info->flags & IEEE80211_TX_CTL_DONTFRAG)) {
+                if (!(tx->flags & IEEE80211_TX_UNICAST) ||
+                    skb->len + FCS_LEN <= local->hw.wiphy->frag_threshold ||
+                    info->flags & IEEE80211_TX_CTL_AMPDU)
+                        info->flags |= IEEE80211_TX_CTL_DONTFRAG;
         }
 
         if (!tx->sta)
@@ -1295,11 +1174,6 @@ ieee80211_tx_prepare(struct ieee80211_sub_if_data *sdata,
         else if (test_and_clear_sta_flag(tx->sta, WLAN_STA_CLEAR_PS_FILT))
                 info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT;
 
-        hdrlen = ieee80211_hdrlen(hdr->frame_control);
-        if (skb->len > hdrlen + sizeof(rfc1042_header) + 2) {
-                u8 *pos = &skb->data[hdrlen + sizeof(rfc1042_header)];
-                tx->ethertype = (pos[0] << 8) | pos[1];
-        }
         info->flags |= IEEE80211_TX_CTL_FIRST_FRAGMENT;
 
         return TX_CONTINUE;
@@ -1510,11 +1384,6 @@ static int ieee80211_skb_resize(struct ieee80211_sub_if_data *sdata,
                 tail_need = max_t(int, tail_need, 0);
         }
 
-        if (head_need || tail_need) {
-                /* Sorry. Can't account for this any more */
-                skb_orphan(skb);
-        }
-
         if (skb_cloned(skb))
                 I802_DEBUG_INC(local->tx_expand_skb_head_cloned);
         else if (head_need || tail_need)
@@ -1528,9 +1397,6 @@ static int ieee80211_skb_resize(struct ieee80211_sub_if_data *sdata,
                 return -ENOMEM;
         }
 
-        /* update truesize too */
-        skb->truesize += head_need + tail_need;
-
         return 0;
 }
 
@@ -1539,55 +1405,11 @@ void ieee80211_xmit(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb)
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
-        struct ieee80211_sub_if_data *tmp_sdata;
         int headroom;
         bool may_encrypt;
 
         rcu_read_lock();
 
-        if (unlikely(sdata->vif.type == NL80211_IFTYPE_MONITOR)) {
-                int hdrlen;
-                u16 len_rthdr;
-
-                info->flags |= IEEE80211_TX_CTL_INJECTED |
-                               IEEE80211_TX_INTFL_HAS_RADIOTAP;
-
-                len_rthdr = ieee80211_get_radiotap_len(skb->data);
-                hdr = (struct ieee80211_hdr *)(skb->data + len_rthdr);
-                hdrlen = ieee80211_hdrlen(hdr->frame_control);
-
-                /* check the header is complete in the frame */
-                if (likely(skb->len >= len_rthdr + hdrlen)) {
-                        /*
-                         * We process outgoing injected frames that have a
-                         * local address we handle as though they are our
-                         * own frames.
-                         * This code here isn't entirely correct, the local
-                         * MAC address is not necessarily enough to find
-                         * the interface to use; for that proper VLAN/WDS
-                         * support we will need a different mechanism.
-                         */
-
-                        list_for_each_entry_rcu(tmp_sdata, &local->interfaces,
-                                                list) {
-                                if (!ieee80211_sdata_running(tmp_sdata))
-                                        continue;
-                                if (tmp_sdata->vif.type ==
-                                    NL80211_IFTYPE_MONITOR ||
-                                    tmp_sdata->vif.type ==
-                                    NL80211_IFTYPE_AP_VLAN ||
-                                        tmp_sdata->vif.type ==
-                                    NL80211_IFTYPE_WDS)
-                                        continue;
-                                if (compare_ether_addr(tmp_sdata->vif.addr,
-                                                       hdr->addr2) == 0) {
-                                        sdata = tmp_sdata;
-                                        break;
-                                }
-                        }
-                }
-        }
-
         may_encrypt = !(info->flags & IEEE80211_TX_INTFL_DONT_ENCRYPT);
 
         headroom = local->tx_headroom;
@@ -1619,6 +1441,89 @@ void ieee80211_xmit(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb)
         rcu_read_unlock();
 }
 
+static bool ieee80211_parse_tx_radiotap(struct sk_buff *skb)
+{
+        struct ieee80211_radiotap_iterator iterator;
+        struct ieee80211_radiotap_header *rthdr =
+                (struct ieee80211_radiotap_header *) skb->data;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+        int ret = ieee80211_radiotap_iterator_init(&iterator, rthdr, skb->len,
+                                                   NULL);
+        u16 txflags;
+
+        info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT |
+                       IEEE80211_TX_CTL_DONTFRAG;
+
+        /*
+         * for every radiotap entry that is present
+         * (ieee80211_radiotap_iterator_next returns -ENOENT when no more
+         * entries present, or -EINVAL on error)
+         */
+
+        while (!ret) {
+                ret = ieee80211_radiotap_iterator_next(&iterator);
+
+                if (ret)
+                        continue;
+
+                /* see if this argument is something we can use */
+                switch (iterator.this_arg_index) {
+                /*
+                 * You must take care when dereferencing iterator.this_arg
+                 * for multibyte types... the pointer is not aligned.  Use
+                 * get_unaligned((type *)iterator.this_arg) to dereference
+                 * iterator.this_arg for type "type" safely on all arches.
+                */
+                case IEEE80211_RADIOTAP_FLAGS:
+                        if (*iterator.this_arg & IEEE80211_RADIOTAP_F_FCS) {
+                                /*
+                                 * this indicates that the skb we have been
+                                 * handed has the 32-bit FCS CRC at the end...
+                                 * we should react to that by snipping it off
+                                 * because it will be recomputed and added
+                                 * on transmission
+                                 */
+                                if (skb->len < (iterator._max_length + FCS_LEN))
+                                        return false;
+
+                                skb_trim(skb, skb->len - FCS_LEN);
+                        }
+                        if (*iterator.this_arg & IEEE80211_RADIOTAP_F_WEP)
+                                info->flags &= ~IEEE80211_TX_INTFL_DONT_ENCRYPT;
+                        if (*iterator.this_arg & IEEE80211_RADIOTAP_F_FRAG)
+                                info->flags &= ~IEEE80211_TX_CTL_DONTFRAG;
+                        break;
+
+                case IEEE80211_RADIOTAP_TX_FLAGS:
+                        txflags = get_unaligned_le16(iterator.this_arg);
+                        if (txflags & IEEE80211_RADIOTAP_F_TX_NOACK)
+                                info->flags |= IEEE80211_TX_CTL_NO_ACK;
+                        break;
+
+                /*
+                 * Please update the file
+                 * Documentation/networking/mac80211-injection.txt
+                 * when parsing new fields here.
+                 */
+
+                default:
+                        break;
+                }
+        }
+
+        if (ret != -ENOENT) /* ie, if we didn't simply run out of fields */
+                return false;
+
+        /*
+         * remove the radiotap header
+         * iterator->_max_length was sanity-checked against
+         * skb->len by iterator init
+         */
+        skb_pull(skb, iterator._max_length);
+
+        return true;
+}
+
 netdev_tx_t ieee80211_monitor_start_xmit(struct sk_buff *skb,
                                          struct net_device *dev)
 {
@@ -1628,8 +1533,9 @@ netdev_tx_t ieee80211_monitor_start_xmit(struct sk_buff *skb,
                 (struct ieee80211_radiotap_header *)skb->data;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         struct ieee80211_hdr *hdr;
+        struct ieee80211_sub_if_data *tmp_sdata, *sdata;
         u16 len_rthdr;
-        u8 *payload;
+        int hdrlen;
 
         /*
          * Frame injection is not allowed if beaconing is not allowed
@@ -1680,30 +1586,65 @@ netdev_tx_t ieee80211_monitor_start_xmit(struct sk_buff *skb,
         skb_set_network_header(skb, len_rthdr);
         skb_set_transport_header(skb, len_rthdr);
 
+        if (skb->len < len_rthdr + 2)
+                goto fail;
+
+        hdr = (struct ieee80211_hdr *)(skb->data + len_rthdr);
+        hdrlen = ieee80211_hdrlen(hdr->frame_control);
+
+        if (skb->len < len_rthdr + hdrlen)
+                goto fail;
+
         /*
          * Initialize skb->protocol if the injected frame is a data frame
          * carrying a rfc1042 header
          */
-        if (skb->len > len_rthdr + 2) {
-                hdr = (struct ieee80211_hdr *)(skb->data + len_rthdr);
-                if (ieee80211_is_data(hdr->frame_control) &&
-                    skb->len >= len_rthdr +
-                                ieee80211_hdrlen(hdr->frame_control) +
-                                sizeof(rfc1042_header) + 2) {
-                        payload = (u8 *)hdr +
-                                  ieee80211_hdrlen(hdr->frame_control);
-                        if (compare_ether_addr(payload, rfc1042_header) == 0)
-                                skb->protocol = cpu_to_be16((payload[6] << 8) |
-                                                            payload[7]);
-                }
+        if (ieee80211_is_data(hdr->frame_control) &&
+            skb->len >= len_rthdr + hdrlen + sizeof(rfc1042_header) + 2) {
+                u8 *payload = (u8 *)hdr + hdrlen;
+
+                if (compare_ether_addr(payload, rfc1042_header) == 0)
+                        skb->protocol = cpu_to_be16((payload[6] << 8) |
+                                                    payload[7]);
         }
 
         memset(info, 0, sizeof(*info));
 
-        info->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
+        info->flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
+                      IEEE80211_TX_CTL_INJECTED;
+
+        /* process and remove the injection radiotap header */
+        if (!ieee80211_parse_tx_radiotap(skb))
+                goto fail;
+
+        rcu_read_lock();
+
+        /*
+         * We process outgoing injected frames that have a local address
+         * we handle as though they are non-injected frames.
+         * This code here isn't entirely correct, the local MAC address
+         * isn't always enough to find the interface to use; for proper
+         * VLAN/WDS support we will need a different mechanism (which
+         * likely isn't going to be monitor interfaces).
+         */
+        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+
+        list_for_each_entry_rcu(tmp_sdata, &local->interfaces, list) {
+                if (!ieee80211_sdata_running(tmp_sdata))
+                        continue;
+                if (tmp_sdata->vif.type == NL80211_IFTYPE_MONITOR ||
+                    tmp_sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
+                    tmp_sdata->vif.type == NL80211_IFTYPE_WDS)
+                        continue;
+                if (compare_ether_addr(tmp_sdata->vif.addr, hdr->addr2) == 0) {
+                        sdata = tmp_sdata;
+                        break;
+                }
+        }
+
+        ieee80211_xmit(sdata, skb);
+        rcu_read_unlock();
 
-        /* pass the radiotap header up to xmit */
-        ieee80211_xmit(IEEE80211_DEV_TO_SUB_IF(dev), skb);
         return NETDEV_TX_OK;
 
 fail:
@@ -1955,11 +1896,10 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
          * Drop unicast frames to unauthorised stations unless they are
          * EAPOL frames from the local station.
          */
-        if (!ieee80211_vif_is_mesh(&sdata->vif) &&
-                unlikely(!is_multicast_ether_addr(hdr.addr1) && !authorized &&
-                      !(cpu_to_be16(ethertype) == sdata->control_port_protocol &&
-                       compare_ether_addr(sdata->vif.addr,
-                                          skb->data + ETH_ALEN) == 0))) {
+        if (unlikely(!ieee80211_vif_is_mesh(&sdata->vif) &&
+                     !is_multicast_ether_addr(hdr.addr1) && !authorized &&
+                     (cpu_to_be16(ethertype) != sdata->control_port_protocol ||
+                      compare_ether_addr(sdata->vif.addr, skb->data + ETH_ALEN)))) {
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
                 if (net_ratelimit())
                         printk(KERN_DEBUG "%s: dropped frame to %pM"
diff --git a/net/mac80211/work.c b/net/mac80211/work.c
index af374fab1a12..94472eb34d76 100644
--- a/net/mac80211/work.c
+++ b/net/mac80211/work.c
@@ -577,7 +577,7 @@ ieee80211_offchannel_tx(struct ieee80211_work *wk)
                 /*
                  * After this, offchan_tx.frame remains but now is no
                  * longer a valid pointer -- we still need it as the
-                 * cookie for canceling this work.
+                 * cookie for canceling this work/status matching.
                  */
                 ieee80211_tx_skb(wk->sdata, wk->offchan_tx.frame);
 
diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c
index 7bc8702808fa..f614ce7bb6e3 100644
--- a/net/mac80211/wpa.c
+++ b/net/mac80211/wpa.c
@@ -53,7 +53,8 @@ ieee80211_tx_h_michael_mic_add(struct ieee80211_tx_data *tx)
         }
 
         if (info->control.hw_key &&
-            !(tx->flags & IEEE80211_TX_FRAGMENTED) &&
+            (info->flags & IEEE80211_TX_CTL_DONTFRAG ||
+             tx->local->ops->set_frag_threshold) &&
             !(tx->key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC)) {
                 /* hwaccel - with no need for SW-generated MMIC */
                 return TX_CONTINUE;
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index edf655aeea00..48260c2d092a 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -2344,6 +2344,10 @@ static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
 
                 nla_nest_end(msg, bss_param);
         }
+        if (sinfo->filled & STATION_INFO_STA_FLAGS)
+                NLA_PUT(msg, NL80211_STA_INFO_STA_FLAGS,
+                        sizeof(struct nl80211_sta_flag_update),
+                        &sinfo->sta_flags);
         nla_nest_end(msg, sinfoattr);
 
         if (sinfo->filled & STATION_INFO_ASSOC_REQ_IES)