18 files changed, 101 insertions, 48 deletions

diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index 8a61dbd320e6..ff9085502bea 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -2223,7 +2223,7 @@ static int __init init_mac80211_hwsim(void)
                                 IEEE80211_VHT_CAP_RXSTBC_2 |
                                 IEEE80211_VHT_CAP_RXSTBC_3 |
                                 IEEE80211_VHT_CAP_RXSTBC_4 |
-                                IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT;
+                                IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK;
                         sband->vht_cap.vht_mcs.rx_mcs_map =
                                 cpu_to_le16(IEEE80211_VHT_MCS_SUPPORT_0_8 << 0 |
                                             IEEE80211_VHT_MCS_SUPPORT_0_8 << 2 |
diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c
index d4d0c3664eb2..197b4466a5d2 100644
--- a/drivers/net/wireless/rt2x00/rt2800lib.c
+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
@@ -5090,7 +5090,8 @@ static int rt2800_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
             IEEE80211_HW_SUPPORTS_PS |
             IEEE80211_HW_PS_NULLFUNC_STACK |
             IEEE80211_HW_AMPDU_AGGREGATION |
-            IEEE80211_HW_REPORTS_TX_ACK_STATUS;
+            IEEE80211_HW_REPORTS_TX_ACK_STATUS |
+            IEEE80211_HW_TEARDOWN_AGGR_ON_BAR_FAIL;
 
         /*
          * Don't set IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING for USB devices
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
index 3248b4224c4e..4ffb6a584cd0 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -392,10 +392,9 @@ void rt2x00lib_txdone(struct queue_entry *entry,
                 tx_info->flags |= IEEE80211_TX_STAT_AMPDU;
                 tx_info->status.ampdu_len = 1;
                 tx_info->status.ampdu_ack_len = success ? 1 : 0;
-                /*
-                 * TODO: Need to tear down BA session here
-                 * if not successful.
-                 */
+
+                if (!success)
+                        tx_info->flags |= IEEE80211_TX_STAT_AMPDU_NO_BACK;
         }
 
         if (rate_flags & IEEE80211_TX_RC_USE_RTS_CTS) {
diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
index 8f690e53dd89..f0859cc73861 100644
--- a/include/linux/ieee80211.h
+++ b/include/linux/ieee80211.h
@@ -1251,32 +1251,34 @@ struct ieee80211_vht_operation {
 #define IEEE80211_VHT_MCS_NOT_SUPPORTED 3
 
 /* 802.11ac VHT Capabilities */
-#define IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_3895                0x00000000
-#define IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_7991                0x00000001
-#define IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454               0x00000002
-#define IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ              0x00000004
-#define IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ     0x00000008
-#define IEEE80211_VHT_CAP_RXLDPC                              0x00000010
-#define IEEE80211_VHT_CAP_SHORT_GI_80                         0x00000020
-#define IEEE80211_VHT_CAP_SHORT_GI_160                        0x00000040
-#define IEEE80211_VHT_CAP_TXSTBC                              0x00000080
-#define IEEE80211_VHT_CAP_RXSTBC_1                            0x00000100
-#define IEEE80211_VHT_CAP_RXSTBC_2                            0x00000200
-#define IEEE80211_VHT_CAP_RXSTBC_3                            0x00000300
-#define IEEE80211_VHT_CAP_RXSTBC_4                            0x00000400
-#define IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE               0x00000800
-#define IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE               0x00001000
-#define IEEE80211_VHT_CAP_BEAMFORMER_ANTENNAS_MAX             0x00006000
-#define IEEE80211_VHT_CAP_SOUNDING_DIMENTION_MAX              0x00030000
-#define IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE               0x00080000
-#define IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE               0x00100000
-#define IEEE80211_VHT_CAP_VHT_TXOP_PS                         0x00200000
-#define IEEE80211_VHT_CAP_HTC_VHT                             0x00400000
-#define IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT          0x00800000
-#define IEEE80211_VHT_CAP_VHT_LINK_ADAPTATION_VHT_UNSOL_MFB   0x08000000
-#define IEEE80211_VHT_CAP_VHT_LINK_ADAPTATION_VHT_MRQ_MFB     0x0c000000
-#define IEEE80211_VHT_CAP_RX_ANTENNA_PATTERN                  0x10000000
-#define IEEE80211_VHT_CAP_TX_ANTENNA_PATTERN                  0x20000000
+#define IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_3895                  0x00000000
+#define IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_7991                  0x00000001
+#define IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454                 0x00000002
+#define IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ                0x00000004
+#define IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ       0x00000008
+#define IEEE80211_VHT_CAP_RXLDPC                                0x00000010
+#define IEEE80211_VHT_CAP_SHORT_GI_80                           0x00000020
+#define IEEE80211_VHT_CAP_SHORT_GI_160                          0x00000040
+#define IEEE80211_VHT_CAP_TXSTBC                                0x00000080
+#define IEEE80211_VHT_CAP_RXSTBC_1                              0x00000100
+#define IEEE80211_VHT_CAP_RXSTBC_2                              0x00000200
+#define IEEE80211_VHT_CAP_RXSTBC_3                              0x00000300
+#define IEEE80211_VHT_CAP_RXSTBC_4                              0x00000400
+#define IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE                 0x00000800
+#define IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE                 0x00001000
+#define IEEE80211_VHT_CAP_BEAMFORMER_ANTENNAS_MAX               0x00006000
+#define IEEE80211_VHT_CAP_SOUNDING_DIMENTION_MAX                0x00030000
+#define IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE                 0x00080000
+#define IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE                 0x00100000
+#define IEEE80211_VHT_CAP_VHT_TXOP_PS                           0x00200000
+#define IEEE80211_VHT_CAP_HTC_VHT                               0x00400000
+#define IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_SHIFT      23
+#define IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK       \
+                (7 << IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_SHIFT)
+#define IEEE80211_VHT_CAP_VHT_LINK_ADAPTATION_VHT_UNSOL_MFB     0x08000000
+#define IEEE80211_VHT_CAP_VHT_LINK_ADAPTATION_VHT_MRQ_MFB       0x0c000000
+#define IEEE80211_VHT_CAP_RX_ANTENNA_PATTERN                    0x10000000
+#define IEEE80211_VHT_CAP_TX_ANTENNA_PATTERN                    0x20000000
 
 /* Authentication algorithms */
 #define WLAN_AUTH_OPEN 0
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index 1c02fb3b3817..ee50c5eba50c 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -1369,6 +1369,10 @@ struct ieee80211_tx_control {
  * @IEEE80211_HW_P2P_DEV_ADDR_FOR_INTF: Use the P2P Device address for any
  *      P2P Interface. This will be honoured even if more than one interface
  *      is supported.
+ *
+ * @IEEE80211_HW_TEARDOWN_AGGR_ON_BAR_FAIL: On this hardware TX BA session
+ *      should be tear down once BAR frame will not be acked.
+ *
  */
 enum ieee80211_hw_flags {
         IEEE80211_HW_HAS_RATE_CONTROL                   = 1<<0,
@@ -1397,6 +1401,7 @@ enum ieee80211_hw_flags {
         IEEE80211_HW_TX_AMPDU_SETUP_IN_HW               = 1<<23,
         IEEE80211_HW_SCAN_WHILE_IDLE                    = 1<<24,
         IEEE80211_HW_P2P_DEV_ADDR_FOR_INTF              = 1<<25,
+        IEEE80211_HW_TEARDOWN_AGGR_ON_BAR_FAIL          = 1<<26,
 };
 
 /**
diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index 4152ed1034b8..eb9df22418f0 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -445,7 +445,7 @@ int ieee80211_start_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid,
 
         trace_api_start_tx_ba_session(pubsta, tid);
 
-        if (WARN_ON(!local->ops->ampdu_action))
+        if (WARN_ON_ONCE(!local->ops->ampdu_action))
                 return -EINVAL;
 
         if ((tid >= IEEE80211_NUM_TIDS) ||
diff --git a/net/mac80211/debugfs_key.c b/net/mac80211/debugfs_key.c
index 2d4235497f1b..c3a3082b72e5 100644
--- a/net/mac80211/debugfs_key.c
+++ b/net/mac80211/debugfs_key.c
@@ -199,6 +199,22 @@ static ssize_t key_icverrors_read(struct file *file, char __user *userbuf,
 }
 KEY_OPS(icverrors);
 
+static ssize_t key_mic_failures_read(struct file *file, char __user *userbuf,
+                                     size_t count, loff_t *ppos)
+{
+        struct ieee80211_key *key = file->private_data;
+        char buf[20];
+        int len;
+
+        if (key->conf.cipher != WLAN_CIPHER_SUITE_TKIP)
+                return -EINVAL;
+
+        len = scnprintf(buf, sizeof(buf), "%u\n", key->u.tkip.mic_failures);
+
+        return simple_read_from_buffer(userbuf, count, ppos, buf, len);
+}
+KEY_OPS(mic_failures);
+
 static ssize_t key_key_read(struct file *file, char __user *userbuf,
                             size_t count, loff_t *ppos)
 {
@@ -260,6 +276,7 @@ void ieee80211_debugfs_key_add(struct ieee80211_key *key)
         DEBUGFS_ADD(rx_spec);
         DEBUGFS_ADD(replays);
         DEBUGFS_ADD(icverrors);
+        DEBUGFS_ADD(mic_failures);
         DEBUGFS_ADD(key);
         DEBUGFS_ADD(ifindex);
 };
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index fa862b24a7e0..8881fc77fb13 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -201,6 +201,20 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
         bss_change |= BSS_CHANGED_BASIC_RATES;
         bss_change |= BSS_CHANGED_HT;
         bss_change |= BSS_CHANGED_IBSS;
+
+        /*
+         * In 5 GHz/802.11a, we can always use short slot time.
+         * (IEEE 802.11-2012 18.3.8.7)
+         *
+         * In 2.4GHz, we must always use long slots in IBSS for compatibility
+         * reasons.
+         * (IEEE 802.11-2012 19.4.5)
+         *
+         * HT follows these specifications (IEEE 802.11-2012 20.3.18)
+         */
+        sdata->vif.bss_conf.use_short_slot = chan->band == IEEE80211_BAND_5GHZ;
+        bss_change |= BSS_CHANGED_ERP_SLOT;
+
         sdata->vif.bss_conf.ibss_joined = true;
         sdata->vif.bss_conf.ibss_creator = creator;
         ieee80211_bss_info_change_notify(sdata, bss_change);
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 40c36d5d7377..09a80b55cf5a 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -862,7 +862,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
                 rcu_assign_pointer(local->p2p_sdata, NULL);
                 /* fall through */
         default:
-                flush_work(&sdata->work);
+                cancel_work_sync(&sdata->work);
                 /*
                  * When we get here, the interface is marked down.
                  * Call rcu_barrier() to wait both for the RX path
diff --git a/net/mac80211/key.h b/net/mac80211/key.h
index 7cff0d3a519c..382dc44ed330 100644
--- a/net/mac80211/key.h
+++ b/net/mac80211/key.h
@@ -81,6 +81,9 @@ struct ieee80211_key {
 
                         /* last received RSC */
                         struct tkip_ctx rx[IEEE80211_NUM_TIDS];
+
+                        /* number of mic failures */
+                        u32 mic_failures;
                 } tkip;
                 struct {
                         atomic64_t tx_pn;
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 09556303c7e1..7753a9ca98a6 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -2360,9 +2360,9 @@ ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
 
         return RX_MGMT_CFG80211_RX_ASSOC;
 }
+
 static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
-                                  struct ieee80211_mgmt *mgmt,
-                                  size_t len,
+                                  struct ieee80211_mgmt *mgmt, size_t len,
                                   struct ieee80211_rx_status *rx_status,
                                   struct ieee802_11_elems *elems,
                                   bool beacon)
diff --git a/net/mac80211/rc80211_minstrel.c b/net/mac80211/rc80211_minstrel.c
index 79633ae06fd6..8c5acdc06226 100644
--- a/net/mac80211/rc80211_minstrel.c
+++ b/net/mac80211/rc80211_minstrel.c
@@ -154,6 +154,7 @@ minstrel_tx_status(void *priv, struct ieee80211_supported_band *sband,
                    struct ieee80211_sta *sta, void *priv_sta,
                    struct sk_buff *skb)
 {
+        struct minstrel_priv *mp = priv;
         struct minstrel_sta_info *mi = priv_sta;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         struct ieee80211_tx_rate *ar = info->status.rates;
@@ -181,6 +182,10 @@ minstrel_tx_status(void *priv, struct ieee80211_supported_band *sband,
 
         if (mi->sample_deferred > 0)
                 mi->sample_deferred--;
+
+        if (time_after(jiffies, mi->stats_update +
+                                (mp->update_interval * HZ) / 1000))
+                minstrel_update_stats(mp, mi);
 }
 
 
@@ -235,10 +240,6 @@ minstrel_get_rate(void *priv, struct ieee80211_sta *sta,
 
         mrr = mp->has_mrr && !txrc->rts && !txrc->bss_conf->use_cts_prot;
 
-        if (time_after(jiffies, mi->stats_update + (mp->update_interval *
-                        HZ) / 1000))
-                minstrel_update_stats(mp, mi);
-
         ndx = mi->max_tp_rate;
 
         if (mrr)
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index db343fa8033c..580704eba8b8 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -378,9 +378,6 @@ ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
          * the SKB because it has a bad FCS/PLCP checksum.
          */
 
-        /* room for the radiotap header based on driver features */
-        needed_headroom = ieee80211_rx_radiotap_space(local, status);
-
         if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)
                 present_fcs_len = FCS_LEN;
 
@@ -399,6 +396,9 @@ ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
                 return remove_monitor_info(local, origskb);
         }
 
+        /* room for the radiotap header based on driver features */
+        needed_headroom = ieee80211_rx_radiotap_space(local, status);
+
         if (should_drop_frame(origskb, present_fcs_len)) {
                 /* only need to expand headroom if necessary */
                 skb = origskb;
@@ -2333,7 +2333,8 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
         if (len < IEEE80211_MIN_ACTION_SIZE)
                 return RX_DROP_UNUSABLE;
 
-        if (!rx->sta && mgmt->u.action.category != WLAN_CATEGORY_PUBLIC)
+        if (!rx->sta && mgmt->u.action.category != WLAN_CATEGORY_PUBLIC &&
+            mgmt->u.action.category != WLAN_CATEGORY_SELF_PROTECTED)
                 return RX_DROP_UNUSABLE;
 
         if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index f7176ac5a535..8ed83dcc149f 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -118,7 +118,7 @@ ieee80211_bss_info_update(struct ieee80211_local *local,
                 struct ieee80211_tim_ie *tim_ie = elems->tim;
                 bss->dtim_period = tim_ie->dtim_period;
                 if (!elems->parse_error)
-                                bss->valid_data |= IEEE80211_BSS_VALID_DTIM;
+                        bss->valid_data |= IEEE80211_BSS_VALID_DTIM;
         }
 
         /* If the beacon had no TIM IE, or it was invalid, use 1 */
diff --git a/net/mac80211/status.c b/net/mac80211/status.c
index ab50285fcbab..07d99578a2b1 100644
--- a/net/mac80211/status.c
+++ b/net/mac80211/status.c
@@ -502,7 +502,11 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
                                        IEEE80211_BAR_CTRL_TID_INFO_MASK) >>
                                       IEEE80211_BAR_CTRL_TID_INFO_SHIFT;
 
-                                ieee80211_set_bar_pending(sta, tid, ssn);
+                                if (local->hw.flags &
+                                    IEEE80211_HW_TEARDOWN_AGGR_ON_BAR_FAIL)
+                                        ieee80211_stop_tx_ba_session(&sta->sta, tid);
+                                else
+                                        ieee80211_set_bar_pending(sta, tid, ssn);
                         }
                 }
 
diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c
index 8bd2f5c6a56e..c175ee866ff4 100644
--- a/net/mac80211/wpa.c
+++ b/net/mac80211/wpa.c
@@ -104,7 +104,7 @@ ieee80211_rx_h_michael_mic_verify(struct ieee80211_rx_data *rx)
          */
         if (status->flag & (RX_FLAG_MMIC_STRIPPED | RX_FLAG_IV_STRIPPED)) {
                 if (status->flag & RX_FLAG_MMIC_ERROR)
-                        goto mic_fail;
+                        goto mic_fail_no_key;
 
                 if (!(status->flag & RX_FLAG_IV_STRIPPED) && rx->key &&
                     rx->key->conf.cipher == WLAN_CIPHER_SUITE_TKIP)
@@ -161,6 +161,9 @@ update_iv:
         return RX_CONTINUE;
 
 mic_fail:
+        rx->key->u.tkip.mic_failures++;
+
+mic_fail_no_key:
         /*
          * In some cases the key can be unset - e.g. a multicast packet, in
          * a driver that supports HW encryption. Send up the key idx only if
diff --git a/net/wireless/chan.c b/net/wireless/chan.c
index b5f69831e318..a7990bb16529 100644
--- a/net/wireless/chan.c
+++ b/net/wireless/chan.c
@@ -265,6 +265,9 @@ bool cfg80211_chandef_usable(struct wiphy *wiphy,
 
         /* TODO: missing regulatory check on 80/160 bandwidth */
 
+        if (width > 20)
+                prohibited_flags |= IEEE80211_CHAN_NO_OFDM;
+
         if (!cfg80211_secondary_chans_ok(wiphy, chandef->center_freq1,
                                          width, prohibited_flags))
                 return false;
diff --git a/net/wireless/wext-compat.c b/net/wireless/wext-compat.c
index f9680c9cf9b3..d997d0f0c54a 100644
--- a/net/wireless/wext-compat.c
+++ b/net/wireless/wext-compat.c
@@ -176,7 +176,7 @@ int cfg80211_wext_giwrange(struct net_device *dev,
         case CFG80211_SIGNAL_TYPE_NONE:
                 break;
         case CFG80211_SIGNAL_TYPE_MBM:
-                range->max_qual.level = -110;
+                range->max_qual.level = (u8)-110;
                 range->max_qual.qual = 70;
                 range->avg_qual.qual = 35;
                 range->max_qual.updated |= IW_QUAL_DBM;