31 files changed, 1212 insertions, 512 deletions

diff --git a/net/mac80211/Kconfig b/net/mac80211/Kconfig
index 96ddb72760b9..8d249d705980 100644
--- a/net/mac80211/Kconfig
+++ b/net/mac80211/Kconfig
@@ -225,6 +225,17 @@ config MAC80211_VERBOSE_MHWMP_DEBUG
 
           Do not select this option.
 
+config MAC80211_VERBOSE_MESH_SYNC_DEBUG
+        bool "Verbose mesh mesh synchronization debugging"
+        depends on MAC80211_DEBUG_MENU
+        depends on MAC80211_MESH
+        ---help---
+          Selecting this option causes mac80211 to print out very verbose mesh
+          synchronization debugging messages (when mac80211 is taking part in a
+          mesh network).
+
+          Do not select this option.
+
 config MAC80211_VERBOSE_TDLS_DEBUG
         bool "Verbose TDLS debugging"
         depends on MAC80211_DEBUG_MENU
diff --git a/net/mac80211/Makefile b/net/mac80211/Makefile
index 1be7a454aa77..3e9d931bba35 100644
--- a/net/mac80211/Makefile
+++ b/net/mac80211/Makefile
@@ -38,7 +38,8 @@ mac80211-$(CONFIG_MAC80211_MESH) += \
         mesh.o \
         mesh_pathtbl.o \
         mesh_plink.o \
-        mesh_hwmp.o
+        mesh_hwmp.o \
+        mesh_sync.o
 
 mac80211-$(CONFIG_PM) += pm.o
 
diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c
index 64d3ce5ea1a0..a070d4f460ea 100644
--- a/net/mac80211/agg-rx.c
+++ b/net/mac80211/agg-rx.c
@@ -142,6 +142,18 @@ static void sta_rx_agg_session_timer_expired(unsigned long data)
         u8 *timer_to_id = ptid - *ptid;
         struct sta_info *sta = container_of(timer_to_id, struct sta_info,
                                          timer_to_tid[0]);
+        struct tid_ampdu_rx *tid_rx;
+        unsigned long timeout;
+
+        tid_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[*ptid]);
+        if (!tid_rx)
+                return;
+
+        timeout = tid_rx->last_rx + TU_TO_JIFFIES(tid_rx->timeout);
+        if (time_is_after_jiffies(timeout)) {
+                mod_timer(&tid_rx->session_timer, timeout);
+                return;
+        }
 
 #ifdef CONFIG_MAC80211_HT_DEBUG
         printk(KERN_DEBUG "rx session timer expired on tid %d\n", (u16)*ptid);
@@ -291,7 +303,7 @@ void ieee80211_process_addba_request(struct ieee80211_local *local,
         /* rx timer */
         tid_agg_rx->session_timer.function = sta_rx_agg_session_timer_expired;
         tid_agg_rx->session_timer.data = (unsigned long)&sta->timer_to_tid[tid];
-        init_timer(&tid_agg_rx->session_timer);
+        init_timer_deferrable(&tid_agg_rx->session_timer);
 
         /* rx reorder timer */
         tid_agg_rx->reorder_timer.function = sta_rx_agg_reorder_timer_expired;
@@ -335,8 +347,10 @@ void ieee80211_process_addba_request(struct ieee80211_local *local,
         /* activate it for RX */
         rcu_assign_pointer(sta->ampdu_mlme.tid_rx[tid], tid_agg_rx);
 
-        if (timeout)
+        if (timeout) {
                 mod_timer(&tid_agg_rx->session_timer, TU_TO_EXP_TIME(timeout));
+                tid_agg_rx->last_rx = jiffies;
+        }
 
 end:
         mutex_unlock(&sta->ampdu_mlme.mtx);
diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index 76be61744198..5b7053c58732 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -286,25 +286,25 @@ static inline int ieee80211_ac_from_tid(int tid)
  * a global "agg_queue_stop" refcount.
  */
 static void __acquires(agg_queue)
-ieee80211_stop_queue_agg(struct ieee80211_local *local, int tid)
+ieee80211_stop_queue_agg(struct ieee80211_sub_if_data *sdata, int tid)
 {
-        int queue = ieee80211_ac_from_tid(tid);
+        int queue = sdata->vif.hw_queue[ieee80211_ac_from_tid(tid)];
 
-        if (atomic_inc_return(&local->agg_queue_stop[queue]) == 1)
+        if (atomic_inc_return(&sdata->local->agg_queue_stop[queue]) == 1)
                 ieee80211_stop_queue_by_reason(
-                        &local->hw, queue,
+                        &sdata->local->hw, queue,
                         IEEE80211_QUEUE_STOP_REASON_AGGREGATION);
         __acquire(agg_queue);
 }
 
 static void __releases(agg_queue)
-ieee80211_wake_queue_agg(struct ieee80211_local *local, int tid)
+ieee80211_wake_queue_agg(struct ieee80211_sub_if_data *sdata, int tid)
 {
-        int queue = ieee80211_ac_from_tid(tid);
+        int queue = sdata->vif.hw_queue[ieee80211_ac_from_tid(tid)];
 
-        if (atomic_dec_return(&local->agg_queue_stop[queue]) == 0)
+        if (atomic_dec_return(&sdata->local->agg_queue_stop[queue]) == 0)
                 ieee80211_wake_queue_by_reason(
-                        &local->hw, queue,
+                        &sdata->local->hw, queue,
                         IEEE80211_QUEUE_STOP_REASON_AGGREGATION);
         __release(agg_queue);
 }
@@ -314,13 +314,14 @@ ieee80211_wake_queue_agg(struct ieee80211_local *local, int tid)
  * requires a call to ieee80211_agg_splice_finish later
  */
 static void __acquires(agg_queue)
-ieee80211_agg_splice_packets(struct ieee80211_local *local,
+ieee80211_agg_splice_packets(struct ieee80211_sub_if_data *sdata,
                              struct tid_ampdu_tx *tid_tx, u16 tid)
 {
-        int queue = ieee80211_ac_from_tid(tid);
+        struct ieee80211_local *local = sdata->local;
+        int queue = sdata->vif.hw_queue[ieee80211_ac_from_tid(tid)];
         unsigned long flags;
 
-        ieee80211_stop_queue_agg(local, tid);
+        ieee80211_stop_queue_agg(sdata, tid);
 
         if (WARN(!tid_tx, "TID %d gone but expected when splicing aggregates"
                           " from the pending queue\n", tid))
@@ -336,9 +337,9 @@ ieee80211_agg_splice_packets(struct ieee80211_local *local,
 }
 
 static void __releases(agg_queue)
-ieee80211_agg_splice_finish(struct ieee80211_local *local, u16 tid)
+ieee80211_agg_splice_finish(struct ieee80211_sub_if_data *sdata, u16 tid)
 {
-        ieee80211_wake_queue_agg(local, tid);
+        ieee80211_wake_queue_agg(sdata, tid);
 }
 
 void ieee80211_tx_ba_session_handle_start(struct sta_info *sta, int tid)
@@ -376,9 +377,9 @@ void ieee80211_tx_ba_session_handle_start(struct sta_info *sta, int tid)
                                         " tid %d\n", tid);
 #endif
                 spin_lock_bh(&sta->lock);
-                ieee80211_agg_splice_packets(local, tid_tx, tid);
+                ieee80211_agg_splice_packets(sdata, tid_tx, tid);
                 ieee80211_assign_tid_tx(sta, tid, NULL);
-                ieee80211_agg_splice_finish(local, tid);
+                ieee80211_agg_splice_finish(sdata, tid);
                 spin_unlock_bh(&sta->lock);
 
                 kfree_rcu(tid_tx, rcu_head);
@@ -417,6 +418,18 @@ static void sta_tx_agg_session_timer_expired(unsigned long data)
         u8 *timer_to_id = ptid - *ptid;
         struct sta_info *sta = container_of(timer_to_id, struct sta_info,
                                          timer_to_tid[0]);
+        struct tid_ampdu_tx *tid_tx;
+        unsigned long timeout;
+
+        tid_tx = rcu_dereference_protected_tid_tx(sta, *ptid);
+        if (!tid_tx)
+                return;
+
+        timeout = tid_tx->last_tx + TU_TO_JIFFIES(tid_tx->timeout);
+        if (time_is_after_jiffies(timeout)) {
+                mod_timer(&tid_tx->session_timer, timeout);
+                return;
+        }
 
 #ifdef CONFIG_MAC80211_HT_DEBUG
         printk(KERN_DEBUG "tx session timer expired on tid %d\n", (u16)*ptid);
@@ -542,7 +555,7 @@ int ieee80211_start_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid,
         /* tx timer */
         tid_tx->session_timer.function = sta_tx_agg_session_timer_expired;
         tid_tx->session_timer.data = (unsigned long)&sta->timer_to_tid[tid];
-        init_timer(&tid_tx->session_timer);
+        init_timer_deferrable(&tid_tx->session_timer);
 
         /* assign a dialog token */
         sta->ampdu_mlme.dialog_token_allocator++;
@@ -586,14 +599,14 @@ static void ieee80211_agg_tx_operational(struct ieee80211_local *local,
          */
         spin_lock_bh(&sta->lock);
 
-        ieee80211_agg_splice_packets(local, tid_tx, tid);
+        ieee80211_agg_splice_packets(sta->sdata, tid_tx, tid);
         /*
          * Now mark as operational. This will be visible
          * in the TX path, and lets it go lock-free in
          * the common case.
          */
         set_bit(HT_AGG_STATE_OPERATIONAL, &tid_tx->state);
-        ieee80211_agg_splice_finish(local, tid);
+        ieee80211_agg_splice_finish(sta->sdata, tid);
 
         spin_unlock_bh(&sta->lock);
 }
@@ -778,12 +791,12 @@ void ieee80211_stop_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u8 tid)
          * more.
          */
 
-        ieee80211_agg_splice_packets(local, tid_tx, tid);
+        ieee80211_agg_splice_packets(sta->sdata, tid_tx, tid);
 
         /* future packets must not find the tid_tx struct any more */
         ieee80211_assign_tid_tx(sta, tid, NULL);
 
-        ieee80211_agg_splice_finish(local, tid);
+        ieee80211_agg_splice_finish(sta->sdata, tid);
 
         kfree_rcu(tid_tx, rcu_head);
 
@@ -884,9 +897,11 @@ void ieee80211_process_addba_resp(struct ieee80211_local *local,
 
                 sta->ampdu_mlme.addba_req_num[tid] = 0;
 
-                if (tid_tx->timeout)
+                if (tid_tx->timeout) {
                         mod_timer(&tid_tx->session_timer,
                                   TU_TO_EXP_TIME(tid_tx->timeout));
+                        tid_tx->last_tx = jiffies;
+                }
 
         } else {
                 ___ieee80211_stop_tx_ba_session(sta, tid, WLAN_BACK_INITIATOR,
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 677d65929780..355735491252 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -412,6 +412,10 @@ static void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
                 sinfo->llid = le16_to_cpu(sta->llid);
                 sinfo->plid = le16_to_cpu(sta->plid);
                 sinfo->plink_state = sta->plink_state;
+                if (test_sta_flag(sta, WLAN_STA_TOFFSET_KNOWN)) {
+                        sinfo->filled |= STATION_INFO_T_OFFSET;
+                        sinfo->t_offset = sta->t_offset;
+                }
 #endif
         }
 
@@ -640,6 +644,10 @@ static int ieee80211_start_ap(struct wiphy *wiphy, struct net_device *dev,
 
         ieee80211_bss_info_change_notify(sdata, changed);
 
+        netif_carrier_on(dev);
+        list_for_each_entry(vlan, &sdata->u.ap.vlans, u.vlan.list)
+                netif_carrier_on(vlan->dev);
+
         return 0;
 }
 
@@ -665,7 +673,7 @@ static int ieee80211_change_beacon(struct wiphy *wiphy, struct net_device *dev,
 
 static int ieee80211_stop_ap(struct wiphy *wiphy, struct net_device *dev)
 {
-        struct ieee80211_sub_if_data *sdata;
+        struct ieee80211_sub_if_data *sdata, *vlan;
         struct beacon_data *old;
 
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
@@ -674,6 +682,10 @@ static int ieee80211_stop_ap(struct wiphy *wiphy, struct net_device *dev)
         if (!old)
                 return -ENOENT;
 
+        list_for_each_entry(vlan, &sdata->u.ap.vlans, u.vlan.list)
+                netif_carrier_off(vlan->dev);
+        netif_carrier_off(dev);
+
         RCU_INIT_POINTER(sdata->u.ap.beacon, NULL);
 
         kfree_rcu(old, rcu_head);
@@ -1235,6 +1247,7 @@ static int copy_mesh_setup(struct ieee80211_if_mesh *ifmsh,
         /* now copy the rest of the setup parameters */
         ifmsh->mesh_id_len = setup->mesh_id_len;
         memcpy(ifmsh->mesh_id, setup->mesh_id, ifmsh->mesh_id_len);
+        ifmsh->mesh_sp_id = setup->sync_method;
         ifmsh->mesh_pp_id = setup->path_sel_proto;
         ifmsh->mesh_pm_id = setup->path_metric;
         ifmsh->security = IEEE80211_MESH_SEC_NONE;
@@ -1279,6 +1292,9 @@ static int ieee80211_update_mesh_config(struct wiphy *wiphy,
                 conf->dot11MeshTTL = nconf->element_ttl;
         if (_chg_mesh_attr(NL80211_MESHCONF_AUTO_OPEN_PLINKS, mask))
                 conf->auto_open_plinks = nconf->auto_open_plinks;
+        if (_chg_mesh_attr(NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR, mask))
+                conf->dot11MeshNbrOffsetMaxNeighbor =
+                        nconf->dot11MeshNbrOffsetMaxNeighbor;
         if (_chg_mesh_attr(NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES, mask))
                 conf->dot11MeshHWMPmaxPREQretries =
                         nconf->dot11MeshHWMPmaxPREQretries;
@@ -1437,6 +1453,9 @@ static int ieee80211_set_txq_params(struct wiphy *wiphy,
         if (!local->ops->conf_tx)
                 return -EOPNOTSUPP;
 
+        if (local->hw.queues < IEEE80211_NUM_ACS)
+                return -EOPNOTSUPP;
+
         memset(&p, 0, sizeof(p));
         p.aifs = params->aifs;
         p.cw_max = params->cwmax;
@@ -1449,14 +1468,11 @@ static int ieee80211_set_txq_params(struct wiphy *wiphy,
          */
         p.uapsd = false;
 
-        if (params->queue >= local->hw.queues)
-                return -EINVAL;
-
-        sdata->tx_conf[params->queue] = p;
-        if (drv_conf_tx(local, sdata, params->queue, &p)) {
+        sdata->tx_conf[params->ac] = p;
+        if (drv_conf_tx(local, sdata, params->ac, &p)) {
                 wiphy_debug(local->hw.wiphy,
-                            "failed to set TX queue parameters for queue %d\n",
-                            params->queue);
+                            "failed to set TX queue parameters for AC %d\n",
+                            params->ac);
                 return -EINVAL;
         }
 
@@ -2090,6 +2106,10 @@ static int ieee80211_mgmt_tx(struct wiphy *wiphy, struct net_device *dev,
 
         IEEE80211_SKB_CB(skb)->flags = flags;
 
+        if (flags & IEEE80211_TX_CTL_TX_OFFCHAN)
+                IEEE80211_SKB_CB(skb)->hw_queue =
+                        local->hw.offchannel_tx_hw_queue;
+
         skb->dev = sdata->dev;
 
         *cookie = (unsigned long) skb;
@@ -2131,6 +2151,8 @@ static int ieee80211_mgmt_tx(struct wiphy *wiphy, struct net_device *dev,
                 /* modify cookie to prevent API mismatches */
                 *cookie ^= 2;
                 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_TX_OFFCHAN;
+                IEEE80211_SKB_CB(skb)->hw_queue =
+                        local->hw.offchannel_tx_hw_queue;
                 local->hw_roc_skb = skb;
                 local->hw_roc_skb_for_status = skb;
                 mutex_unlock(&local->mtx);
@@ -2350,8 +2372,8 @@ ieee80211_prep_tdls_encap_data(struct wiphy *wiphy, struct net_device *dev,
                 tf->u.setup_req.capability =
                         cpu_to_le16(ieee80211_get_tdls_sta_capab(sdata));
 
-                ieee80211_add_srates_ie(&sdata->vif, skb);
-                ieee80211_add_ext_srates_ie(&sdata->vif, skb);
+                ieee80211_add_srates_ie(&sdata->vif, skb, false);
+                ieee80211_add_ext_srates_ie(&sdata->vif, skb, false);
                 ieee80211_tdls_add_ext_capab(skb);
                 break;
         case WLAN_TDLS_SETUP_RESPONSE:
@@ -2364,8 +2386,8 @@ ieee80211_prep_tdls_encap_data(struct wiphy *wiphy, struct net_device *dev,
                 tf->u.setup_resp.capability =
                         cpu_to_le16(ieee80211_get_tdls_sta_capab(sdata));
 
-                ieee80211_add_srates_ie(&sdata->vif, skb);
-                ieee80211_add_ext_srates_ie(&sdata->vif, skb);
+                ieee80211_add_srates_ie(&sdata->vif, skb, false);
+                ieee80211_add_ext_srates_ie(&sdata->vif, skb, false);
                 ieee80211_tdls_add_ext_capab(skb);
                 break;
         case WLAN_TDLS_SETUP_CONFIRM:
@@ -2425,8 +2447,8 @@ ieee80211_prep_tdls_direct(struct wiphy *wiphy, struct net_device *dev,
                 mgmt->u.action.u.tdls_discover_resp.capability =
                         cpu_to_le16(ieee80211_get_tdls_sta_capab(sdata));
 
-                ieee80211_add_srates_ie(&sdata->vif, skb);
-                ieee80211_add_ext_srates_ie(&sdata->vif, skb);
+                ieee80211_add_srates_ie(&sdata->vif, skb, false);
+                ieee80211_add_ext_srates_ie(&sdata->vif, skb, false);
                 ieee80211_tdls_add_ext_capab(skb);
                 break;
         default:
@@ -2673,6 +2695,13 @@ ieee80211_wiphy_get_channel(struct wiphy *wiphy)
         return local->oper_channel;
 }
 
+#ifdef CONFIG_PM
+static void ieee80211_set_wakeup(struct wiphy *wiphy, bool enabled)
+{
+        drv_set_wakeup(wiphy_priv(wiphy), enabled);
+}
+#endif
+
 struct cfg80211_ops mac80211_config_ops = {
         .add_virtual_intf = ieee80211_add_iface,
         .del_virtual_intf = ieee80211_del_iface,
@@ -2741,4 +2770,7 @@ struct cfg80211_ops mac80211_config_ops = {
         .probe_client = ieee80211_probe_client,
         .get_channel = ieee80211_wiphy_get_channel,
         .set_noack_map = ieee80211_set_noack_map,
+#ifdef CONFIG_PM
+        .set_wakeup = ieee80211_set_wakeup,
+#endif
 };
diff --git a/net/mac80211/chan.c b/net/mac80211/chan.c
index e00ce8c3e28e..c76cf7230c7d 100644
--- a/net/mac80211/chan.c
+++ b/net/mac80211/chan.c
@@ -135,29 +135,3 @@ bool ieee80211_set_channel_type(struct ieee80211_local *local,
 
         return result;
 }
-
-/*
- * ieee80211_get_tx_channel_type returns the channel type we should
- * use for packet transmission, given the channel capability and
- * whatever regulatory flags we have been given.
- */
-enum nl80211_channel_type ieee80211_get_tx_channel_type(
-                                struct ieee80211_local *local,
-                                enum nl80211_channel_type channel_type)
-{
-        switch (channel_type) {
-        case NL80211_CHAN_HT40PLUS:
-                if (local->hw.conf.channel->flags &
-                                IEEE80211_CHAN_NO_HT40PLUS)
-                        return NL80211_CHAN_HT20;
-                break;
-        case NL80211_CHAN_HT40MINUS:
-                if (local->hw.conf.channel->flags &
-                                IEEE80211_CHAN_NO_HT40MINUS)
-                        return NL80211_CHAN_HT20;
-                break;
-        default:
-                break;
-        }
-        return channel_type;
-}
diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c
index 30f99c344847..e7af5227e322 100644
--- a/net/mac80211/debugfs_netdev.c
+++ b/net/mac80211/debugfs_netdev.c
@@ -424,6 +424,7 @@ static ssize_t ieee80211_if_parse_tsf(
         struct ieee80211_local *local = sdata->local;
         unsigned long long tsf;
         int ret;
+        int tsf_is_delta = 0;
 
         if (strncmp(buf, "reset", 5) == 0) {
                 if (local->ops->reset_tsf) {
@@ -431,9 +432,20 @@ static ssize_t ieee80211_if_parse_tsf(
                         wiphy_info(local->hw.wiphy, "debugfs reset TSF\n");
                 }
         } else {
+                if (buflen > 10 && buf[1] == '=') {
+                        if (buf[0] == '+')
+                                tsf_is_delta = 1;
+                        else if (buf[0] == '-')
+                                tsf_is_delta = -1;
+                        else
+                                return -EINVAL;
+                        buf += 2;
+                }
                 ret = kstrtoull(buf, 10, &tsf);
                 if (ret < 0)
                         return -EINVAL;
+                if (tsf_is_delta)
+                        tsf = drv_get_tsf(local, sdata) + tsf_is_delta * tsf;
                 if (local->ops->set_tsf) {
                         drv_set_tsf(local, sdata, tsf);
                         wiphy_info(local->hw.wiphy,
@@ -499,26 +511,23 @@ IEEE80211_IF_FILE(dot11MeshForwarding, u.mesh.mshcfg.dot11MeshForwarding, DEC);
 IEEE80211_IF_FILE(rssi_threshold, u.mesh.mshcfg.rssi_threshold, DEC);
 #endif
 
-
-#define DEBUGFS_ADD(name) \
-        debugfs_create_file(#name, 0400, sdata->debugfs.dir, \
-                            sdata, &name##_ops);
-
 #define DEBUGFS_ADD_MODE(name, mode) \
         debugfs_create_file(#name, mode, sdata->debugfs.dir, \
                             sdata, &name##_ops);
 
-static void add_sta_files(struct ieee80211_sub_if_data *sdata)
+#define DEBUGFS_ADD(name) DEBUGFS_ADD_MODE(name, 0400)
+
+static void add_common_files(struct ieee80211_sub_if_data *sdata)
 {
         DEBUGFS_ADD(drop_unencrypted);
-        DEBUGFS_ADD(flags);
-        DEBUGFS_ADD(state);
-        DEBUGFS_ADD(channel_type);
         DEBUGFS_ADD(rc_rateidx_mask_2ghz);
         DEBUGFS_ADD(rc_rateidx_mask_5ghz);
         DEBUGFS_ADD(rc_rateidx_mcs_mask_2ghz);
         DEBUGFS_ADD(rc_rateidx_mcs_mask_5ghz);
+}
 
+static void add_sta_files(struct ieee80211_sub_if_data *sdata)
+{
         DEBUGFS_ADD(bssid);
         DEBUGFS_ADD(aid);
         DEBUGFS_ADD(last_beacon);
@@ -531,15 +540,6 @@ static void add_sta_files(struct ieee80211_sub_if_data *sdata)
 
 static void add_ap_files(struct ieee80211_sub_if_data *sdata)
 {
-        DEBUGFS_ADD(drop_unencrypted);
-        DEBUGFS_ADD(flags);
-        DEBUGFS_ADD(state);
-        DEBUGFS_ADD(channel_type);
-        DEBUGFS_ADD(rc_rateidx_mask_2ghz);
-        DEBUGFS_ADD(rc_rateidx_mask_5ghz);
-        DEBUGFS_ADD(rc_rateidx_mcs_mask_2ghz);
-        DEBUGFS_ADD(rc_rateidx_mcs_mask_5ghz);
-
         DEBUGFS_ADD(num_sta_authorized);
         DEBUGFS_ADD(num_sta_ps);
         DEBUGFS_ADD(dtim_count);
@@ -549,48 +549,14 @@ static void add_ap_files(struct ieee80211_sub_if_data *sdata)
 
 static void add_ibss_files(struct ieee80211_sub_if_data *sdata)
 {
-        DEBUGFS_ADD(channel_type);
-        DEBUGFS_ADD(rc_rateidx_mask_2ghz);
-        DEBUGFS_ADD(rc_rateidx_mask_5ghz);
-        DEBUGFS_ADD(rc_rateidx_mcs_mask_2ghz);
-        DEBUGFS_ADD(rc_rateidx_mcs_mask_5ghz);
-
         DEBUGFS_ADD_MODE(tsf, 0600);
 }
 
 static void add_wds_files(struct ieee80211_sub_if_data *sdata)
 {
-        DEBUGFS_ADD(drop_unencrypted);
-        DEBUGFS_ADD(flags);
-        DEBUGFS_ADD(state);
-        DEBUGFS_ADD(channel_type);
-        DEBUGFS_ADD(rc_rateidx_mask_2ghz);
-        DEBUGFS_ADD(rc_rateidx_mask_5ghz);
-        DEBUGFS_ADD(rc_rateidx_mcs_mask_2ghz);
-        DEBUGFS_ADD(rc_rateidx_mcs_mask_5ghz);
-
         DEBUGFS_ADD(peer);
 }
 
-static void add_vlan_files(struct ieee80211_sub_if_data *sdata)
-{
-        DEBUGFS_ADD(drop_unencrypted);
-        DEBUGFS_ADD(flags);
-        DEBUGFS_ADD(state);
-        DEBUGFS_ADD(channel_type);
-        DEBUGFS_ADD(rc_rateidx_mask_2ghz);
-        DEBUGFS_ADD(rc_rateidx_mask_5ghz);
-        DEBUGFS_ADD(rc_rateidx_mcs_mask_2ghz);
-        DEBUGFS_ADD(rc_rateidx_mcs_mask_5ghz);
-}
-
-static void add_monitor_files(struct ieee80211_sub_if_data *sdata)
-{
-        DEBUGFS_ADD(flags);
-        DEBUGFS_ADD(state);
-        DEBUGFS_ADD(channel_type);
-}
-
 #ifdef CONFIG_MAC80211_MESH
 
 static void add_mesh_files(struct ieee80211_sub_if_data *sdata)
@@ -651,6 +617,13 @@ static void add_files(struct ieee80211_sub_if_data *sdata)
         if (!sdata->debugfs.dir)
                 return;
 
+        DEBUGFS_ADD(flags);
+        DEBUGFS_ADD(state);
+        DEBUGFS_ADD(channel_type);
+
+        if (sdata->vif.type != NL80211_IFTYPE_MONITOR)
+                add_common_files(sdata);
+
         switch (sdata->vif.type) {
         case NL80211_IFTYPE_MESH_POINT:
 #ifdef CONFIG_MAC80211_MESH
@@ -671,12 +644,6 @@ static void add_files(struct ieee80211_sub_if_data *sdata)
         case NL80211_IFTYPE_WDS:
                 add_wds_files(sdata);
                 break;
-        case NL80211_IFTYPE_MONITOR:
-                add_monitor_files(sdata);
-                break;
-        case NL80211_IFTYPE_AP_VLAN:
-                add_vlan_files(sdata);
-                break;
         default:
                 break;
         }
diff --git a/net/mac80211/debugfs_sta.c b/net/mac80211/debugfs_sta.c
index 832b2da5e4cd..5ccec2c1e9f6 100644
--- a/net/mac80211/debugfs_sta.c
+++ b/net/mac80211/debugfs_sta.c
@@ -63,7 +63,7 @@ static ssize_t sta_flags_read(struct file *file, char __user *userbuf,
         test_sta_flag(sta, WLAN_STA_##flg) ? #flg "\n" : ""
 
         int res = scnprintf(buf, sizeof(buf),
-                            "%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s",
+                            "%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s",
                             TEST(AUTH), TEST(ASSOC), TEST(PS_STA),
                             TEST(PS_DRIVER), TEST(AUTHORIZED),
                             TEST(SHORT_PREAMBLE),
@@ -71,7 +71,8 @@ static ssize_t sta_flags_read(struct file *file, char __user *userbuf,
                             TEST(MFP), TEST(BLOCK_BA), TEST(PSPOLL),
                             TEST(UAPSD), TEST(SP), TEST(TDLS_PEER),
                             TEST(TDLS_PEER_AUTH), TEST(4ADDR_EVENT),
-                            TEST(INSERTED), TEST(RATE_CONTROL));
+                            TEST(INSERTED), TEST(RATE_CONTROL),
+                            TEST(TOFFSET_KNOWN));
 #undef TEST
         return simple_read_from_buffer(userbuf, count, ppos, buf, res);
 }
diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
index af4691fed645..4a0e559cb26b 100644
--- a/net/mac80211/driver-ops.h
+++ b/net/mac80211/driver-ops.h
@@ -7,7 +7,9 @@
 
 static inline void check_sdata_in_driver(struct ieee80211_sub_if_data *sdata)
 {
-        WARN_ON(!(sdata->flags & IEEE80211_SDATA_IN_DRIVER));
+        WARN(!(sdata->flags & IEEE80211_SDATA_IN_DRIVER),
+             "%s:  Failed check-sdata-in-driver check, flags: 0x%x\n",
+             sdata->dev->name, sdata->flags);
 }
 
 static inline struct ieee80211_sub_if_data *
@@ -89,6 +91,19 @@ static inline int drv_resume(struct ieee80211_local *local)
         trace_drv_return_int(local, ret);
         return ret;
 }
+
+static inline void drv_set_wakeup(struct ieee80211_local *local,
+                                  bool enabled)
+{
+        might_sleep();
+
+        if (!local->ops->set_wakeup)
+                return;
+
+        trace_drv_set_wakeup(local, enabled);
+        local->ops->set_wakeup(&local->hw, enabled);
+        trace_drv_return_void(local);
+}
 #endif
 
 static inline int drv_add_interface(struct ieee80211_local *local,
@@ -99,7 +114,8 @@ static inline int drv_add_interface(struct ieee80211_local *local,
         might_sleep();
 
         if (WARN_ON(sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
-                    sdata->vif.type == NL80211_IFTYPE_MONITOR))
+                    (sdata->vif.type == NL80211_IFTYPE_MONITOR &&
+                     !(local->hw.flags & IEEE80211_HW_WANT_MONITOR_VIF))))
                 return -EINVAL;
 
         trace_drv_add_interface(local, sdata);
@@ -474,8 +490,23 @@ int drv_sta_state(struct ieee80211_local *local,
         return ret;
 }
 
+static inline void drv_sta_rc_update(struct ieee80211_local *local,
+                                     struct ieee80211_sub_if_data *sdata,
+                                     struct ieee80211_sta *sta, u32 changed)
+{
+        sdata = get_bss_sdata(sdata);
+        check_sdata_in_driver(sdata);
+
+        trace_drv_sta_rc_update(local, sdata, sta, changed);
+        if (local->ops->sta_rc_update)
+                local->ops->sta_rc_update(&local->hw, &sdata->vif,
+                                          sta, changed);
+
+        trace_drv_return_void(local);
+}
+
 static inline int drv_conf_tx(struct ieee80211_local *local,
-                              struct ieee80211_sub_if_data *sdata, u16 queue,
+                              struct ieee80211_sub_if_data *sdata, u16 ac,
                               const struct ieee80211_tx_queue_params *params)
 {
         int ret = -EOPNOTSUPP;
@@ -484,10 +515,10 @@ static inline int drv_conf_tx(struct ieee80211_local *local,
 
         check_sdata_in_driver(sdata);
 
-        trace_drv_conf_tx(local, sdata, queue, params);
+        trace_drv_conf_tx(local, sdata, ac, params);
         if (local->ops->conf_tx)
                 ret = local->ops->conf_tx(&local->hw, &sdata->vif,
-                                          queue, params);
+                                          ac, params);
         trace_drv_return_int(local, ret);
         return ret;
 }
diff --git a/net/mac80211/driver-trace.h b/net/mac80211/driver-trace.h
index 21d6f5290a1c..7c0754bed61b 100644
--- a/net/mac80211/driver-trace.h
+++ b/net/mac80211/driver-trace.h
@@ -171,6 +171,20 @@ DEFINE_EVENT(local_only_evt, drv_resume,
         TP_ARGS(local)
 );
 
+TRACE_EVENT(drv_set_wakeup,
+        TP_PROTO(struct ieee80211_local *local, bool enabled),
+        TP_ARGS(local, enabled),
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                __field(bool, enabled)
+        ),
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                __entry->enabled = enabled;
+        ),
+        TP_printk(LOCAL_PR_FMT " enabled:%d", LOCAL_PR_ARG, __entry->enabled)
+);
+
 DEFINE_EVENT(local_only_evt, drv_stop,
         TP_PROTO(struct ieee80211_local *local),
         TP_ARGS(local)
@@ -624,6 +638,34 @@ TRACE_EVENT(drv_sta_state,
         )
 );
 
+TRACE_EVENT(drv_sta_rc_update,
+        TP_PROTO(struct ieee80211_local *local,
+                 struct ieee80211_sub_if_data *sdata,
+                 struct ieee80211_sta *sta,
+                 u32 changed),
+
+        TP_ARGS(local, sdata, sta, changed),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                VIF_ENTRY
+                STA_ENTRY
+                __field(u32, changed)
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                VIF_ASSIGN;
+                STA_ASSIGN;
+                __entry->changed = changed;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT  VIF_PR_FMT  STA_PR_FMT " changed: 0x%x",
+                LOCAL_PR_ARG, VIF_PR_ARG, STA_PR_ARG, __entry->changed
+        )
+);
+
 TRACE_EVENT(drv_sta_add,
         TP_PROTO(struct ieee80211_local *local,
                  struct ieee80211_sub_if_data *sdata,
@@ -677,15 +719,14 @@ TRACE_EVENT(drv_sta_remove,
 TRACE_EVENT(drv_conf_tx,
         TP_PROTO(struct ieee80211_local *local,
                  struct ieee80211_sub_if_data *sdata,
-                 u16 queue,
-                 const struct ieee80211_tx_queue_params *params),
+                 u16 ac, const struct ieee80211_tx_queue_params *params),
 
-        TP_ARGS(local, sdata, queue, params),
+        TP_ARGS(local, sdata, ac, params),
 
         TP_STRUCT__entry(
                 LOCAL_ENTRY
                 VIF_ENTRY
-                __field(u16, queue)
+                __field(u16, ac)
                 __field(u16, txop)
                 __field(u16, cw_min)
                 __field(u16, cw_max)
@@ -696,7 +737,7 @@ TRACE_EVENT(drv_conf_tx,
         TP_fast_assign(
                 LOCAL_ASSIGN;
                 VIF_ASSIGN;
-                __entry->queue = queue;
+                __entry->ac = ac;
                 __entry->txop = params->txop;
                 __entry->cw_max = params->cw_max;
                 __entry->cw_min = params->cw_min;
@@ -705,8 +746,8 @@ TRACE_EVENT(drv_conf_tx,
         ),
 
         TP_printk(
-                LOCAL_PR_FMT  VIF_PR_FMT  " queue:%d",
-                LOCAL_PR_ARG, VIF_PR_ARG, __entry->queue
+                LOCAL_PR_FMT  VIF_PR_FMT  " AC:%d",
+                LOCAL_PR_ARG, VIF_PR_ARG, __entry->ac
         )
 );
 
diff --git a/net/mac80211/ht.c b/net/mac80211/ht.c
index f25fff7607d8..9b603366943c 100644
--- a/net/mac80211/ht.c
+++ b/net/mac80211/ht.c
@@ -19,15 +19,6 @@
 #include "ieee80211_i.h"
 #include "rate.h"
 
-bool ieee80111_cfg_override_disables_ht40(struct ieee80211_sub_if_data *sdata)
-{
-        const __le16 flg = cpu_to_le16(IEEE80211_HT_CAP_SUP_WIDTH_20_40);
-        if ((sdata->u.mgd.ht_capa_mask.cap_info & flg) &&
-            !(sdata->u.mgd.ht_capa.cap_info & flg))
-                return true;
-        return false;
-}
-
 static void __check_htcap_disable(struct ieee80211_sub_if_data *sdata,
                                   struct ieee80211_sta_ht_cap *ht_cap,
                                   u16 flag)
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index 33fd8d9f714e..49a207980338 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -160,16 +160,14 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
         if (channel_type && sband->ht_cap.ht_supported) {
                 pos = skb_put(skb, 4 +
                                    sizeof(struct ieee80211_ht_cap) +
-                                   sizeof(struct ieee80211_ht_info));
+                                   sizeof(struct ieee80211_ht_operation));
                 pos = ieee80211_ie_build_ht_cap(pos, &sband->ht_cap,
                                                 sband->ht_cap.cap);
-                pos = ieee80211_ie_build_ht_info(pos,
-                                                 &sband->ht_cap,
-                                                 chan,
-                                                 channel_type);
+                pos = ieee80211_ie_build_ht_oper(pos, &sband->ht_cap,
+                                                 chan, channel_type);
         }
 
-        if (local->hw.queues >= 4) {
+        if (local->hw.queues >= IEEE80211_NUM_ACS) {
                 pos = skb_put(skb, 9);
                 *pos++ = WLAN_EID_VENDOR_SPECIFIC;
                 *pos++ = 7; /* len */
@@ -410,7 +408,7 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
 
                 if (elems->supp_rates) {
                         supp_rates = ieee80211_sta_get_rates(local, elems,
-                                                             band);
+                                                             band, NULL);
                         if (sta) {
                                 u32 prev_rates;
 
@@ -441,13 +439,13 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
                 if (sta && elems->wmm_info)
                         set_sta_flag(sta, WLAN_STA_WME);
 
-                if (sta && elems->ht_info_elem && elems->ht_cap_elem &&
+                if (sta && elems->ht_operation && elems->ht_cap_elem &&
                     sdata->u.ibss.channel_type != NL80211_CHAN_NO_HT) {
                         /* we both use HT */
                         struct ieee80211_sta_ht_cap sta_ht_cap_new;
                         enum nl80211_channel_type channel_type =
-                                ieee80211_ht_info_to_channel_type(
-                                                        elems->ht_info_elem);
+                                ieee80211_ht_oper_to_channel_type(
+                                                        elems->ht_operation);
 
                         ieee80211_ht_cap_ie_to_sta_ht_cap(sdata, sband,
                                                           elems->ht_cap_elem,
@@ -560,7 +558,7 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
                        sdata->name, mgmt->bssid);
 #endif
                 ieee80211_sta_join_ibss(sdata, bss);
-                supp_rates = ieee80211_sta_get_rates(local, elems, band);
+                supp_rates = ieee80211_sta_get_rates(local, elems, band, NULL);
                 ieee80211_ibss_add_sta(sdata, mgmt->bssid, mgmt->sa,
                                        supp_rates, true);
                 rcu_read_unlock();
@@ -1063,7 +1061,7 @@ int ieee80211_ibss_join(struct ieee80211_sub_if_data *sdata,
                             4 /* IBSS params */ +
                             2 + (IEEE80211_MAX_SUPP_RATES - 8) +
                             2 + sizeof(struct ieee80211_ht_cap) +
-                            2 + sizeof(struct ieee80211_ht_info) +
+                            2 + sizeof(struct ieee80211_ht_operation) +
                             params->ie_len);
         if (!skb)
                 return -ENOMEM;
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index d9798a307f20..4be11ea3dfc4 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -52,7 +52,8 @@ struct ieee80211_local;
  * increased memory use (about 2 kB of RAM per entry). */
 #define IEEE80211_FRAGMENT_MAX 4
 
-#define TU_TO_EXP_TIME(x)       (jiffies + usecs_to_jiffies((x) * 1024))
+#define TU_TO_JIFFIES(x)        (usecs_to_jiffies((x) * 1024))
+#define TU_TO_EXP_TIME(x)       (jiffies + TU_TO_JIFFIES(x))
 
 #define IEEE80211_DEFAULT_UAPSD_QUEUES \
         (IEEE80211_WMM_IE_STA_QOSINFO_AC_BK |   \
@@ -378,6 +379,7 @@ enum ieee80211_sta_flags {
         IEEE80211_STA_UAPSD_ENABLED     = BIT(7),
         IEEE80211_STA_NULLFUNC_ACKED    = BIT(8),
         IEEE80211_STA_RESET_SIGNAL_AVE  = BIT(9),
+        IEEE80211_STA_DISABLE_40MHZ     = BIT(10),
 };
 
 struct ieee80211_mgd_auth_data {
@@ -397,7 +399,7 @@ struct ieee80211_mgd_auth_data {
 struct ieee80211_mgd_assoc_data {
         struct cfg80211_bss *bss;
         const u8 *supp_rates;
-        const u8 *ht_information_ie;
+        const u8 *ht_operation_ie;
 
         unsigned long timeout;
         int tries;
@@ -552,6 +554,24 @@ struct ieee80211_if_ibss {
         } state;
 };
 
+/**
+ * struct ieee80211_mesh_sync_ops - Extensible synchronization framework interface
+ *
+ * these declarations define the interface, which enables
+ * vendor-specific mesh synchronization
+ *
+ */
+struct ieee802_11_elems;
+struct ieee80211_mesh_sync_ops {
+        void (*rx_bcn_presp)(struct ieee80211_sub_if_data *sdata,
+                             u16 stype,
+                             struct ieee80211_mgmt *mgmt,
+                             struct ieee802_11_elems *elems,
+                             struct ieee80211_rx_status *rx_status);
+        void (*adjust_tbtt)(struct ieee80211_sub_if_data *sdata);
+        /* add other framework functions here */
+};
+
 struct ieee80211_if_mesh {
         struct timer_list housekeeping_timer;
         struct timer_list mesh_path_timer;
@@ -600,6 +620,11 @@ struct ieee80211_if_mesh {
                 IEEE80211_MESH_SEC_AUTHED = 0x1,
                 IEEE80211_MESH_SEC_SECURED = 0x2,
         } security;
+        /* Extensible Synchronization Framework */
+        struct ieee80211_mesh_sync_ops *sync_ops;
+        s64 sync_offset_clockdrift_max;
+        spinlock_t sync_offset_lock;
+        bool adjusting_tbtt;
 };
 
 #ifdef CONFIG_MAC80211_MESH
@@ -666,12 +691,6 @@ struct ieee80211_sub_if_data {
 
         char name[IFNAMSIZ];
 
-        /*
-         * keep track of whether the HT opmode (stored in
-         * vif.bss_info.ht_operation_mode) is valid.
-         */
-        bool ht_opmode_valid;
-
         /* to detect idle changes */
         bool old_idle;
 
@@ -691,7 +710,7 @@ struct ieee80211_sub_if_data {
         __be16 control_port_protocol;
         bool control_port_no_encrypt;
 
-        struct ieee80211_tx_queue_params tx_conf[IEEE80211_MAX_QUEUES];
+        struct ieee80211_tx_queue_params tx_conf[IEEE80211_NUM_ACS];
 
         struct work_struct work;
         struct sk_buff_head skb_queue;
@@ -761,7 +780,6 @@ enum queue_stop_reason {
         IEEE80211_QUEUE_STOP_REASON_AGGREGATION,
         IEEE80211_QUEUE_STOP_REASON_SUSPEND,
         IEEE80211_QUEUE_STOP_REASON_SKB_ADD,
-        IEEE80211_QUEUE_STOP_REASON_CHTYPE_CHANGE,
 };
 
 #ifdef CONFIG_MAC80211_LEDS
@@ -1082,6 +1100,9 @@ struct ieee80211_local {
         struct net_device napi_dev;
 
         struct napi_struct napi;
+
+        /* virtual monitor interface */
+        struct ieee80211_sub_if_data __rcu *monitor_sdata;
 };
 
 static inline struct ieee80211_sub_if_data *
@@ -1117,7 +1138,7 @@ struct ieee802_11_elems {
         u8 *wmm_info;
         u8 *wmm_param;
         struct ieee80211_ht_cap *ht_cap_elem;
-        struct ieee80211_ht_info *ht_info_elem;
+        struct ieee80211_ht_operation *ht_operation;
         struct ieee80211_meshconf_ie *mesh_config;
         u8 *mesh_id;
         u8 *peering;
@@ -1299,7 +1320,6 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
                                        struct net_device *dev);
 
 /* HT */
-bool ieee80111_cfg_override_disables_ht40(struct ieee80211_sub_if_data *sdata);
 void ieee80211_apply_htcap_overrides(struct ieee80211_sub_if_data *sdata,
                                      struct ieee80211_sta_ht_cap *ht_cap);
 void ieee80211_ht_cap_ie_to_sta_ht_cap(struct ieee80211_sub_if_data *sdata,
@@ -1429,13 +1449,17 @@ void ieee80211_wake_queue_by_reason(struct ieee80211_hw *hw, int queue,
                                     enum queue_stop_reason reason);
 void ieee80211_stop_queue_by_reason(struct ieee80211_hw *hw, int queue,
                                     enum queue_stop_reason reason);
+void ieee80211_propagate_queue_wake(struct ieee80211_local *local, int queue);
 void ieee80211_add_pending_skb(struct ieee80211_local *local,
                                struct sk_buff *skb);
-void ieee80211_add_pending_skbs(struct ieee80211_local *local,
-                                struct sk_buff_head *skbs);
 void ieee80211_add_pending_skbs_fn(struct ieee80211_local *local,
                                    struct sk_buff_head *skbs,
                                    void (*fn)(void *data), void *data);
+static inline void ieee80211_add_pending_skbs(struct ieee80211_local *local,
+                                              struct sk_buff_head *skbs)
+{
+        ieee80211_add_pending_skbs_fn(local, skbs, NULL, NULL);
+}
 
 void ieee80211_send_auth(struct ieee80211_sub_if_data *sdata,
                          u16 transaction, u16 auth_alg,
@@ -1460,7 +1484,7 @@ void ieee80211_sta_def_wmm_params(struct ieee80211_sub_if_data *sdata,
                                   const u8 *supp_rates);
 u32 ieee80211_sta_get_rates(struct ieee80211_local *local,
                             struct ieee802_11_elems *elems,
-                            enum ieee80211_band band);
+                            enum ieee80211_band band, u32 *basic_rates);
 int __ieee80211_request_smps(struct ieee80211_sub_if_data *sdata,
                              enum ieee80211_smps_mode smps_mode);
 void ieee80211_recalc_smps(struct ieee80211_local *local);
@@ -1470,10 +1494,9 @@ size_t ieee80211_ie_split(const u8 *ies, size_t ielen,
 size_t ieee80211_ie_split_vendor(const u8 *ies, size_t ielen, size_t offset);
 u8 *ieee80211_ie_build_ht_cap(u8 *pos, struct ieee80211_sta_ht_cap *ht_cap,
                               u16 cap);
-u8 *ieee80211_ie_build_ht_info(u8 *pos,
-                                struct ieee80211_sta_ht_cap *ht_cap,
-                                struct ieee80211_channel *channel,
-                                enum nl80211_channel_type channel_type);
+u8 *ieee80211_ie_build_ht_oper(u8 *pos, struct ieee80211_sta_ht_cap *ht_cap,
+                               struct ieee80211_channel *channel,
+                               enum nl80211_channel_type channel_type);
 
 /* internal work items */
 void ieee80211_work_init(struct ieee80211_local *local);
@@ -1501,10 +1524,7 @@ bool ieee80211_set_channel_type(struct ieee80211_local *local,
                                 struct ieee80211_sub_if_data *sdata,
                                 enum nl80211_channel_type chantype);
 enum nl80211_channel_type
-ieee80211_ht_info_to_channel_type(struct ieee80211_ht_info *ht_info);
-enum nl80211_channel_type ieee80211_get_tx_channel_type(
-                                        struct ieee80211_local *local,
-                                        enum nl80211_channel_type channel_type);
+ieee80211_ht_oper_to_channel_type(struct ieee80211_ht_operation *ht_oper);
 
 #ifdef CONFIG_MAC80211_NOINLINE
 #define debug_noinline noinline
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 401c01f0731e..6e85faed053d 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -149,6 +149,34 @@ static int ieee80211_check_concurrent_iface(struct ieee80211_sub_if_data *sdata,
         return 0;
 }
 
+static int ieee80211_check_queues(struct ieee80211_sub_if_data *sdata)
+{
+        int n_queues = sdata->local->hw.queues;
+        int i;
+
+        for (i = 0; i < IEEE80211_NUM_ACS; i++) {
+                if (WARN_ON_ONCE(sdata->vif.hw_queue[i] ==
+                                 IEEE80211_INVAL_HW_QUEUE))
+                        return -EINVAL;
+                if (WARN_ON_ONCE(sdata->vif.hw_queue[i] >=
+                                 n_queues))
+                        return -EINVAL;
+        }
+
+        if (sdata->vif.type != NL80211_IFTYPE_AP) {
+                sdata->vif.cab_queue = IEEE80211_INVAL_HW_QUEUE;
+                return 0;
+        }
+
+        if (WARN_ON_ONCE(sdata->vif.cab_queue == IEEE80211_INVAL_HW_QUEUE))
+                return -EINVAL;
+
+        if (WARN_ON_ONCE(sdata->vif.cab_queue >= n_queues))
+                return -EINVAL;
+
+        return 0;
+}
+
 void ieee80211_adjust_monitor_flags(struct ieee80211_sub_if_data *sdata,
                                     const int offset)
 {
@@ -169,6 +197,81 @@ void ieee80211_adjust_monitor_flags(struct ieee80211_sub_if_data *sdata,
 #undef ADJUST
 }
 
+static void ieee80211_set_default_queues(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_local *local = sdata->local;
+        int i;
+
+        for (i = 0; i < IEEE80211_NUM_ACS; i++) {
+                if (local->hw.flags & IEEE80211_HW_QUEUE_CONTROL)
+                        sdata->vif.hw_queue[i] = IEEE80211_INVAL_HW_QUEUE;
+                else
+                        sdata->vif.hw_queue[i] = i;
+        }
+        sdata->vif.cab_queue = IEEE80211_INVAL_HW_QUEUE;
+}
+
+static int ieee80211_add_virtual_monitor(struct ieee80211_local *local)
+{
+        struct ieee80211_sub_if_data *sdata;
+        int ret;
+
+        if (!(local->hw.flags & IEEE80211_HW_WANT_MONITOR_VIF))
+                return 0;
+
+        if (local->monitor_sdata)
+                return 0;
+
+        sdata = kzalloc(sizeof(*sdata) + local->hw.vif_data_size, GFP_KERNEL);
+        if (!sdata)
+                return -ENOMEM;
+
+        /* set up data */
+        sdata->local = local;
+        sdata->vif.type = NL80211_IFTYPE_MONITOR;
+        snprintf(sdata->name, IFNAMSIZ, "%s-monitor",
+                 wiphy_name(local->hw.wiphy));
+
+        ieee80211_set_default_queues(sdata);
+
+        ret = drv_add_interface(local, sdata);
+        if (WARN_ON(ret)) {
+                /* ok .. stupid driver, it asked for this! */
+                kfree(sdata);
+                return ret;
+        }
+
+        ret = ieee80211_check_queues(sdata);
+        if (ret) {
+                kfree(sdata);
+                return ret;
+        }
+
+        rcu_assign_pointer(local->monitor_sdata, sdata);
+
+        return 0;
+}
+
+static void ieee80211_del_virtual_monitor(struct ieee80211_local *local)
+{
+        struct ieee80211_sub_if_data *sdata;
+
+        if (!(local->hw.flags & IEEE80211_HW_WANT_MONITOR_VIF))
+                return;
+
+        sdata = rtnl_dereference(local->monitor_sdata);
+
+        if (!sdata)
+                return;
+
+        rcu_assign_pointer(local->monitor_sdata, NULL);
+        synchronize_net();
+
+        drv_remove_interface(local, sdata);
+
+        kfree(sdata);
+}
+
 /*
  * NOTE: Be very careful when changing this function, it must NOT return
  * an error on interface type changes that have been pre-checked, so most
@@ -246,15 +349,18 @@ static int ieee80211_do_open(struct net_device *dev, bool coming_up)
                 memcpy(dev->perm_addr, dev->dev_addr, ETH_ALEN);
 
                 if (!is_valid_ether_addr(dev->dev_addr)) {
-                        if (!local->open_count)
-                                drv_stop(local);
-                        return -EADDRNOTAVAIL;
+                        res = -EADDRNOTAVAIL;
+                        goto err_stop;
                 }
         }
 
         switch (sdata->vif.type) {
         case NL80211_IFTYPE_AP_VLAN:
-                /* no need to tell driver */
+                /* no need to tell driver, but set carrier */
+                if (rtnl_dereference(sdata->bss->beacon))
+                        netif_carrier_on(dev);
+                else
+                        netif_carrier_off(dev);
                 break;
         case NL80211_IFTYPE_MONITOR:
                 if (sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES) {
@@ -262,6 +368,12 @@ static int ieee80211_do_open(struct net_device *dev, bool coming_up)
                         break;
                 }
 
+                if (local->monitors == 0 && local->open_count == 0) {
+                        res = ieee80211_add_virtual_monitor(local);
+                        if (res)
+                                goto err_stop;
+                }
+
                 /* must be before the call to ieee80211_configure_filter */
                 local->monitors++;
                 if (local->monitors == 1) {
@@ -276,9 +388,14 @@ static int ieee80211_do_open(struct net_device *dev, bool coming_up)
                 break;
         default:
                 if (coming_up) {
+                        ieee80211_del_virtual_monitor(local);
+
                         res = drv_add_interface(local, sdata);
                         if (res)
                                 goto err_stop;
+                        res = ieee80211_check_queues(sdata);
+                        if (res)
+                                goto err_del_interface;
                 }
 
                 if (sdata->vif.type == NL80211_IFTYPE_AP) {
@@ -294,7 +411,8 @@ static int ieee80211_do_open(struct net_device *dev, bool coming_up)
                 ieee80211_bss_info_change_notify(sdata, changed);
 
                 if (sdata->vif.type == NL80211_IFTYPE_STATION ||
-                    sdata->vif.type == NL80211_IFTYPE_ADHOC)
+                    sdata->vif.type == NL80211_IFTYPE_ADHOC ||
+                    sdata->vif.type == NL80211_IFTYPE_AP)
                         netif_carrier_off(dev);
                 else
                         netif_carrier_on(dev);
@@ -366,6 +484,7 @@ static int ieee80211_do_open(struct net_device *dev, bool coming_up)
         sdata->bss = NULL;
         if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
                 list_del(&sdata->u.vlan.list);
+        /* might already be clear but that doesn't matter */
         clear_bit(SDATA_STATE_RUNNING, &sdata->state);
         return res;
 }
@@ -506,6 +625,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
                 if (local->monitors == 0) {
                         local->hw.conf.flags &= ~IEEE80211_CONF_MONITOR;
                         hw_reconf_flags |= IEEE80211_CONF_CHANGE_MONITOR;
+                        ieee80211_del_virtual_monitor(local);
                 }
 
                 ieee80211_adjust_monitor_flags(sdata, -1);
@@ -579,6 +699,9 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
                 }
         }
         spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
+
+        if (local->monitors == local->open_count && local->monitors > 0)
+                ieee80211_add_virtual_monitor(local);
 }
 
 static int ieee80211_stop(struct net_device *dev)
@@ -676,7 +799,7 @@ static u16 ieee80211_monitor_select_queue(struct net_device *dev,
         struct ieee80211_hdr *hdr;
         struct ieee80211_radiotap_header *rtap = (void *)skb->data;
 
-        if (local->hw.queues < 4)
+        if (local->hw.queues < IEEE80211_NUM_ACS)
                 return 0;
 
         if (skb->len < 4 ||
@@ -970,6 +1093,13 @@ static int ieee80211_runtime_change_iftype(struct ieee80211_sub_if_data *sdata,
         if (ret)
                 type = sdata->vif.type;
 
+        /*
+         * Ignore return value here, there's not much we can do since
+         * the driver changed the interface type internally already.
+         * The warnings will hopefully make driver authors fix it :-)
+         */
+        ieee80211_check_queues(sdata);
+
         ieee80211_setup_sdata(sdata, type);
 
         err = ieee80211_do_open(sdata->dev, false);
@@ -1133,11 +1263,15 @@ int ieee80211_if_add(struct ieee80211_local *local, const char *name,
         struct net_device *ndev;
         struct ieee80211_sub_if_data *sdata = NULL;
         int ret, i;
+        int txqs = 1;
 
         ASSERT_RTNL();
 
+        if (local->hw.queues >= IEEE80211_NUM_ACS)
+                txqs = IEEE80211_NUM_ACS;
+
         ndev = alloc_netdev_mqs(sizeof(*sdata) + local->hw.vif_data_size,
-                                name, ieee80211_if_setup, local->hw.queues, 1);
+                                name, ieee80211_if_setup, txqs, 1);
         if (!ndev)
                 return -ENOMEM;
         dev_net_set(ndev, wiphy_net(local->hw.wiphy));
@@ -1192,6 +1326,8 @@ int ieee80211_if_add(struct ieee80211_local *local, const char *name,
                                sizeof(sdata->rc_rateidx_mcs_mask[i]));
         }
 
+        ieee80211_set_default_queues(sdata);
+
         /* setup type-dependent data */
         ieee80211_setup_sdata(sdata, type);
 
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 16336480c631..ac79d5e8e0d0 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -557,8 +557,10 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
                         WIPHY_FLAG_4ADDR_AP |
                         WIPHY_FLAG_4ADDR_STATION |
                         WIPHY_FLAG_REPORTS_OBSS |
-                        WIPHY_FLAG_OFFCHAN_TX |
-                        WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL;
+                        WIPHY_FLAG_OFFCHAN_TX;
+
+        if (ops->remain_on_channel)
+                wiphy->flags |= WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL;
 
         wiphy->features = NL80211_FEATURE_SK_TX_STATUS |
                           NL80211_FEATURE_HT_IBSS;
@@ -589,6 +591,7 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
         local->hw.max_report_rates = 0;
         local->hw.max_rx_aggregation_subframes = IEEE80211_MAX_AMPDU_BUF;
         local->hw.max_tx_aggregation_subframes = IEEE80211_MAX_AMPDU_BUF;
+        local->hw.offchannel_tx_hw_queue = IEEE80211_INVAL_HW_QUEUE;
         local->hw.conf.long_frame_max_tx_count = wiphy->retry_long;
         local->hw.conf.short_frame_max_tx_count = wiphy->retry_short;
         local->user_power_level = -1;
@@ -685,6 +688,11 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
                 WLAN_CIPHER_SUITE_AES_CMAC
         };
 
+        if (hw->flags & IEEE80211_HW_QUEUE_CONTROL &&
+            (local->hw.offchannel_tx_hw_queue == IEEE80211_INVAL_HW_QUEUE ||
+             local->hw.offchannel_tx_hw_queue >= local->hw.queues))
+                return -EINVAL;
+
         if ((hw->wiphy->wowlan.flags || hw->wiphy->wowlan.n_patterns)
 #ifdef CONFIG_PM
             && (!local->ops->suspend || !local->ops->resume)
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index e5fbb7cf3562..133c118526fb 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -13,9 +13,6 @@
 #include "ieee80211_i.h"
 #include "mesh.h"
 
-#define MESHCONF_CAPAB_ACCEPT_PLINKS 0x01
-#define MESHCONF_CAPAB_FORWARDING    0x08
-
 #define TMR_RUNNING_HK  0
 #define TMR_RUNNING_MP  1
 #define TMR_RUNNING_MPR 2
@@ -69,11 +66,13 @@ static void ieee80211_mesh_housekeeping_timer(unsigned long data)
  *
  * @ie: information elements of a management frame from the mesh peer
  * @sdata: local mesh subif
+ * @basic_rates: BSSBasicRateSet of the peer candidate
  *
  * This function checks if the mesh configuration of a mesh point matches the
  * local mesh configuration, i.e. if both nodes belong to the same mesh network.
  */
-bool mesh_matches_local(struct ieee802_11_elems *ie, struct ieee80211_sub_if_data *sdata)
+bool mesh_matches_local(struct ieee802_11_elems *ie,
+                        struct ieee80211_sub_if_data *sdata, u32 basic_rates)
 {
         struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
         struct ieee80211_local *local = sdata->local;
@@ -97,10 +96,13 @@ bool mesh_matches_local(struct ieee802_11_elems *ie, struct ieee80211_sub_if_dat
              (ifmsh->mesh_auth_id == ie->mesh_config->meshconf_auth)))
                 goto mismatch;
 
+        if (sdata->vif.bss_conf.basic_rates != basic_rates)
+                goto mismatch;
+
         /* disallow peering with mismatched channel types for now */
-        if (ie->ht_info_elem &&
+        if (ie->ht_operation &&
             (local->_oper_channel_type !=
-             ieee80211_ht_info_to_channel_type(ie->ht_info_elem)))
+             ieee80211_ht_oper_to_channel_type(ie->ht_operation)))
                 goto mismatch;
 
         return true;
@@ -251,8 +253,10 @@ mesh_add_meshconf_ie(struct sk_buff *skb, struct ieee80211_sub_if_data *sdata)
         /* Mesh capability */
         ifmsh->accepting_plinks = mesh_plink_availables(sdata);
         *pos = MESHCONF_CAPAB_FORWARDING;
-        *pos++ |= ifmsh->accepting_plinks ?
+        *pos |= ifmsh->accepting_plinks ?
             MESHCONF_CAPAB_ACCEPT_PLINKS : 0x00;
+        *pos++ |= ifmsh->adjusting_tbtt ?
+            MESHCONF_CAPAB_TBTT_ADJUSTING : 0x00;
         *pos++ = 0x00;
 
         return 0;
@@ -371,7 +375,7 @@ int mesh_add_ht_cap_ie(struct sk_buff *skb,
         return 0;
 }
 
-int mesh_add_ht_info_ie(struct sk_buff *skb,
+int mesh_add_ht_oper_ie(struct sk_buff *skb,
                         struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_local *local = sdata->local;
@@ -385,11 +389,11 @@ int mesh_add_ht_info_ie(struct sk_buff *skb,
         if (!ht_cap->ht_supported || channel_type == NL80211_CHAN_NO_HT)
                 return 0;
 
-        if (skb_tailroom(skb) < 2 + sizeof(struct ieee80211_ht_info))
+        if (skb_tailroom(skb) < 2 + sizeof(struct ieee80211_ht_operation))
                 return -ENOMEM;
 
-        pos = skb_put(skb, 2 + sizeof(struct ieee80211_ht_info));
-        ieee80211_ie_build_ht_info(pos, ht_cap, channel, channel_type);
+        pos = skb_put(skb, 2 + sizeof(struct ieee80211_ht_operation));
+        ieee80211_ie_build_ht_oper(pos, ht_cap, channel, channel_type);
 
         return 0;
 }
@@ -573,14 +577,21 @@ void ieee80211_start_mesh(struct ieee80211_sub_if_data *sdata)
         ieee80211_configure_filter(local);
 
         ifmsh->mesh_cc_id = 0;  /* Disabled */
-        ifmsh->mesh_sp_id = 0;  /* Neighbor Offset */
         ifmsh->mesh_auth_id = 0;        /* Disabled */
+        /* register sync ops from extensible synchronization framework */
+        ifmsh->sync_ops = ieee80211_mesh_sync_ops_get(ifmsh->mesh_sp_id);
+        ifmsh->adjusting_tbtt = false;
+        ifmsh->sync_offset_clockdrift_max = 0;
         set_bit(MESH_WORK_HOUSEKEEPING, &ifmsh->wrkq_flags);
         ieee80211_mesh_root_setup(ifmsh);
         ieee80211_queue_work(&local->hw, &sdata->work);
         sdata->vif.bss_conf.beacon_int = MESH_DEFAULT_BEACON_INTERVAL;
+        sdata->vif.bss_conf.basic_rates =
+                ieee80211_mandatory_rates(sdata->local,
+                                          sdata->local->hw.conf.channel->band);
         ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON |
                                                 BSS_CHANGED_BEACON_ENABLED |
+                                                BSS_CHANGED_BASIC_RATES |
                                                 BSS_CHANGED_BEACON_INT);
 }
 
@@ -616,9 +627,10 @@ static void ieee80211_mesh_rx_bcn_presp(struct ieee80211_sub_if_data *sdata,
                                         struct ieee80211_rx_status *rx_status)
 {
         struct ieee80211_local *local = sdata->local;
+        struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
         struct ieee802_11_elems elems;
         struct ieee80211_channel *channel;
-        u32 supp_rates = 0;
+        u32 supp_rates = 0, basic_rates = 0;
         size_t baselen;
         int freq;
         enum ieee80211_band band = rx_status->band;
@@ -649,11 +661,16 @@ static void ieee80211_mesh_rx_bcn_presp(struct ieee80211_sub_if_data *sdata,
         if (!channel || channel->flags & IEEE80211_CHAN_DISABLED)
                 return;
 
+        supp_rates = ieee80211_sta_get_rates(local, &elems,
+                                             band, &basic_rates);
+
         if (elems.mesh_id && elems.mesh_config &&
-            mesh_matches_local(&elems, sdata)) {
-                supp_rates = ieee80211_sta_get_rates(local, &elems, band);
+            mesh_matches_local(&elems, sdata, basic_rates))
                 mesh_neighbour_update(mgmt->sa, supp_rates, sdata, &elems);
-        }
+
+        if (ifmsh->sync_ops)
+                ifmsh->sync_ops->rx_bcn_presp(sdata,
+                        stype, mgmt, &elems, rx_status);
 }
 
 static void ieee80211_mesh_rx_mgmt_action(struct ieee80211_sub_if_data *sdata,
@@ -721,6 +738,9 @@ void ieee80211_mesh_work(struct ieee80211_sub_if_data *sdata)
 
         if (test_and_clear_bit(MESH_WORK_ROOT, &ifmsh->wrkq_flags))
                 ieee80211_mesh_rootpath(sdata);
+
+        if (test_and_clear_bit(MESH_WORK_DRIFT_ADJUST, &ifmsh->wrkq_flags))
+                mesh_sync_adjust_tbtt(sdata);
 }
 
 void ieee80211_mesh_notify_scan_completed(struct ieee80211_local *local)
@@ -761,4 +781,5 @@ void ieee80211_mesh_init_sdata(struct ieee80211_sub_if_data *sdata)
                     (unsigned long) sdata);
         INIT_LIST_HEAD(&ifmsh->preq_queue.list);
         spin_lock_init(&ifmsh->mesh_preq_queue_lock);
+        spin_lock_init(&ifmsh->sync_offset_lock);
 }
diff --git a/net/mac80211/mesh.h b/net/mac80211/mesh.h
index 8d53b71378e3..4ad738988801 100644
--- a/net/mac80211/mesh.h
+++ b/net/mac80211/mesh.h
@@ -19,6 +19,20 @@
 /* Data structures */
 
 /**
+ * enum mesh_config_capab_flags - mesh config IE capability flags
+ *
+ * @MESHCONF_CAPAB_ACCEPT_PLINKS: STA is willing to establish
+ * additional mesh peerings with other mesh STAs
+ * @MESHCONF_CAPAB_FORWARDING: the STA forwards MSDUs
+ * @MESHCONF_CAPAB_TBTT_ADJUSTING: TBTT adjustment procedure is ongoing
+ */
+enum mesh_config_capab_flags {
+        MESHCONF_CAPAB_ACCEPT_PLINKS = BIT(0),
+        MESHCONF_CAPAB_FORWARDING = BIT(3),
+        MESHCONF_CAPAB_TBTT_ADJUSTING = BIT(5),
+};
+
+/**
  * enum mesh_path_flags - mac80211 mesh path flags
  *
  *
@@ -56,12 +70,15 @@ enum mesh_path_flags {
  * @MESH_WORK_GROW_MPP_TABLE: the mesh portals table is full and needs to
  * grow
  * @MESH_WORK_ROOT: the mesh root station needs to send a frame
+ * @MESH_WORK_DRIFT_ADJUST: time to compensate for clock drift relative to other
+ * mesh nodes
  */
 enum mesh_deferred_task_flags {
         MESH_WORK_HOUSEKEEPING,
         MESH_WORK_GROW_MPATH_TABLE,
         MESH_WORK_GROW_MPP_TABLE,
         MESH_WORK_ROOT,
+        MESH_WORK_DRIFT_ADJUST,
 };
 
 /**
@@ -86,6 +103,7 @@ enum mesh_deferred_task_flags {
  * mpath itself.  No need to take this lock when adding or removing
  * an mpath to a hash bucket on a path table.
  * @rann_snd_addr: the RANN sender address
+ * @rann_metric: the aggregated path metric towards the root node
  * @is_root: the destination station of this path is a root node
  * @is_gate: the destination station of this path is a mesh gate
  *
@@ -112,6 +130,7 @@ struct mesh_path {
         enum mesh_path_flags flags;
         spinlock_t state_lock;
         u8 rann_snd_addr[ETH_ALEN];
+        u32 rann_metric;
         bool is_root;
         bool is_gate;
 };
@@ -204,7 +223,7 @@ int ieee80211_new_mesh_header(struct ieee80211s_hdr *meshhdr,
 int mesh_rmc_check(u8 *addr, struct ieee80211s_hdr *mesh_hdr,
                 struct ieee80211_sub_if_data *sdata);
 bool mesh_matches_local(struct ieee802_11_elems *ie,
-                struct ieee80211_sub_if_data *sdata);
+                        struct ieee80211_sub_if_data *sdata, u32 basic_rates);
 void mesh_ids_set_default(struct ieee80211_if_mesh *mesh);
 void mesh_mgmt_ies_add(struct sk_buff *skb,
                 struct ieee80211_sub_if_data *sdata);
@@ -220,7 +239,7 @@ int mesh_add_ds_params_ie(struct sk_buff *skb,
                           struct ieee80211_sub_if_data *sdata);
 int mesh_add_ht_cap_ie(struct sk_buff *skb,
                        struct ieee80211_sub_if_data *sdata);
-int mesh_add_ht_info_ie(struct sk_buff *skb,
+int mesh_add_ht_oper_ie(struct sk_buff *skb,
                         struct ieee80211_sub_if_data *sdata);
 void mesh_rmc_free(struct ieee80211_sub_if_data *sdata);
 int mesh_rmc_init(struct ieee80211_sub_if_data *sdata);
@@ -232,6 +251,7 @@ void ieee80211_mesh_init_sdata(struct ieee80211_sub_if_data *sdata);
 void ieee80211_start_mesh(struct ieee80211_sub_if_data *sdata);
 void ieee80211_stop_mesh(struct ieee80211_sub_if_data *sdata);
 void ieee80211_mesh_root_setup(struct ieee80211_if_mesh *ifmsh);
+struct ieee80211_mesh_sync_ops *ieee80211_mesh_sync_ops_get(u8 method);
 
 /* Mesh paths */
 int mesh_nexthop_lookup(struct sk_buff *skb,
@@ -325,6 +345,7 @@ void ieee80211_mesh_quiesce(struct ieee80211_sub_if_data *sdata);
 void ieee80211_mesh_restart(struct ieee80211_sub_if_data *sdata);
 void mesh_plink_quiesce(struct sta_info *sta);
 void mesh_plink_restart(struct sta_info *sta);
+void mesh_sync_adjust_tbtt(struct ieee80211_sub_if_data *sdata);
 #else
 #define mesh_allocated  0
 static inline void
diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
index 1c6f3d02aebf..a80da3784a25 100644
--- a/net/mac80211/mesh_hwmp.c
+++ b/net/mac80211/mesh_hwmp.c
@@ -86,8 +86,8 @@ static inline u32 u16_field_get(u8 *preq_elem, int offset, bool ae)
 #define PERR_IE_TARGET_RCODE(x) u16_field_get(x, 13, 0)
 
 #define MSEC_TO_TU(x) (x*1000/1024)
-#define SN_GT(x, y) ((long) (y) - (long) (x) < 0)
-#define SN_LT(x, y) ((long) (x) - (long) (y) < 0)
+#define SN_GT(x, y) ((s32)(y - x) < 0)
+#define SN_LT(x, y) ((s32)(x - y) < 0)
 
 #define net_traversal_jiffies(s) \
         msecs_to_jiffies(s->u.mesh.mshcfg.dot11MeshHWMPnetDiameterTraversalTime)
@@ -732,11 +732,12 @@ static void hwmp_rann_frame_process(struct ieee80211_sub_if_data *sdata,
                                 struct ieee80211_rann_ie *rann)
 {
         struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
+        struct ieee80211_local *local = sdata->local;
+        struct sta_info *sta;
         struct mesh_path *mpath;
         u8 ttl, flags, hopcount;
         u8 *orig_addr;
-        u32 orig_sn, metric;
-        u32 interval = ifmsh->mshcfg.dot11MeshHWMPRannInterval;
+        u32 orig_sn, metric, metric_txsta, interval;
         bool root_is_gate;
 
         ttl = rann->rann_ttl;
@@ -748,10 +749,11 @@ static void hwmp_rann_frame_process(struct ieee80211_sub_if_data *sdata,
         flags = rann->rann_flags;
         root_is_gate = !!(flags & RANN_FLAG_IS_GATE);
         orig_addr = rann->rann_addr;
-        orig_sn = rann->rann_seq;
+        orig_sn = le32_to_cpu(rann->rann_seq);
+        interval = le32_to_cpu(rann->rann_interval);
         hopcount = rann->rann_hopcount;
         hopcount++;
-        metric = rann->rann_metric;
+        metric = le32_to_cpu(rann->rann_metric);
 
         /*  Ignore our own RANNs */
         if (compare_ether_addr(orig_addr, sdata->vif.addr) == 0)
@@ -761,6 +763,14 @@ static void hwmp_rann_frame_process(struct ieee80211_sub_if_data *sdata,
                         orig_addr, mgmt->sa, root_is_gate);
 
         rcu_read_lock();
+        sta = sta_info_get(sdata, mgmt->sa);
+        if (!sta) {
+                rcu_read_unlock();
+                return;
+        }
+
+        metric_txsta = airtime_link_metric_get(local, sta);
+
         mpath = mesh_path_lookup(orig_addr, sdata);
         if (!mpath) {
                 mesh_path_add(orig_addr, sdata);
@@ -780,14 +790,16 @@ static void hwmp_rann_frame_process(struct ieee80211_sub_if_data *sdata,
                 mesh_queue_preq(mpath, PREQ_Q_F_START | PREQ_Q_F_REFRESH);
         }
 
-        if (mpath->sn < orig_sn && ifmsh->mshcfg.dot11MeshForwarding) {
+        if ((SN_LT(mpath->sn, orig_sn) || (mpath->sn == orig_sn &&
+           metric < mpath->rann_metric)) && ifmsh->mshcfg.dot11MeshForwarding) {
                 mesh_path_sel_frame_tx(MPATH_RANN, flags, orig_addr,
                                        cpu_to_le32(orig_sn),
                                        0, NULL, 0, broadcast_addr,
                                        hopcount, ttl, cpu_to_le32(interval),
-                                       cpu_to_le32(metric + mpath->metric),
+                                       cpu_to_le32(metric + metric_txsta),
                                        0, sdata);
                 mpath->sn = orig_sn;
+                mpath->rann_metric = metric + metric_txsta;
         }
 
         /* Using individually addressed PREQ for root node */
diff --git a/net/mac80211/mesh_plink.c b/net/mac80211/mesh_plink.c
index 4e53c4cbca9e..9c836e774fbd 100644
--- a/net/mac80211/mesh_plink.c
+++ b/net/mac80211/mesh_plink.c
@@ -187,7 +187,7 @@ static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata,
                             2 + sdata->u.mesh.mesh_id_len +
                             2 + sizeof(struct ieee80211_meshconf_ie) +
                             2 + sizeof(struct ieee80211_ht_cap) +
-                            2 + sizeof(struct ieee80211_ht_info) +
+                            2 + sizeof(struct ieee80211_ht_operation) +
                             2 + 8 + /* peering IE */
                             sdata->u.mesh.ie_len);
         if (!skb)
@@ -212,8 +212,8 @@ static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata,
                         pos = skb_put(skb, 2);
                         memcpy(pos + 2, &plid, 2);
                 }
-                if (ieee80211_add_srates_ie(&sdata->vif, skb) ||
-                    ieee80211_add_ext_srates_ie(&sdata->vif, skb) ||
+                if (ieee80211_add_srates_ie(&sdata->vif, skb, true) ||
+                    ieee80211_add_ext_srates_ie(&sdata->vif, skb, true) ||
                     mesh_add_rsn_ie(skb, sdata) ||
                     mesh_add_meshid_ie(skb, sdata) ||
                     mesh_add_meshconf_ie(skb, sdata))
@@ -263,7 +263,7 @@ static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata,
 
         if (action != WLAN_SP_MESH_PEERING_CLOSE) {
                 if (mesh_add_ht_cap_ie(skb, sdata) ||
-                    mesh_add_ht_info_ie(skb, sdata))
+                    mesh_add_ht_oper_ie(skb, sdata))
                         return -1;
         }
 
@@ -465,6 +465,7 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
         bool deactivated, matches_local = true;
         u8 ie_len;
         u8 *baseaddr;
+        u32 rates, basic_rates = 0;
         __le16 plid, llid, reason;
 #ifdef CONFIG_MAC80211_VERBOSE_MPL_DEBUG
         static const char *mplstates[] = {
@@ -559,8 +560,11 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
 
         /* Now we will figure out the appropriate event... */
         event = PLINK_UNDEFINED;
+        rates = ieee80211_sta_get_rates(local, &elems,
+                                        rx_status->band, &basic_rates);
+
         if (ftype != WLAN_SP_MESH_PEERING_CLOSE &&
-            (!mesh_matches_local(&elems, sdata))) {
+            (!mesh_matches_local(&elems, sdata, basic_rates))) {
                 matches_local = false;
                 switch (ftype) {
                 case WLAN_SP_MESH_PEERING_OPEN:
@@ -583,7 +587,6 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                 return;
         } else if (!sta) {
                 /* ftype == WLAN_SP_MESH_PEERING_OPEN */
-                u32 rates;
 
                 rcu_read_unlock();
 
@@ -591,8 +594,6 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                         mpl_dbg("Mesh plink error: no more free plinks\n");
                         return;
                 }
-
-                rates = ieee80211_sta_get_rates(local, &elems, rx_status->band);
                 sta = mesh_plink_alloc(sdata, mgmt->sa, rates, &elems);
                 if (!sta) {
                         mpl_dbg("Mesh plink error: plink table full\n");
diff --git a/net/mac80211/mesh_sync.c b/net/mac80211/mesh_sync.c
new file mode 100644
index 000000000000..f78b0139856f
--- /dev/null
+++ b/net/mac80211/mesh_sync.c
@@ -0,0 +1,296 @@
+/*
+ * Copyright 2011-2012, Pavel Zubarev <pavel.zubarev@gmail.com>
+ * Copyright 2011-2012, Marco Porsch <marco.porsch@s2005.tu-chemnitz.de>
+ * Copyright 2011-2012, cozybit Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include "ieee80211_i.h"
+#include "mesh.h"
+#include "driver-ops.h"
+
+#ifdef CONFIG_MAC80211_VERBOSE_MESH_SYNC_DEBUG
+#define msync_dbg(fmt, args...) \
+        printk(KERN_DEBUG "Mesh sync (%s): " fmt "\n", sdata->name, ##args)
+#else
+#define msync_dbg(fmt, args...)   do { (void)(0); } while (0)
+#endif
+
+/* This is not in the standard.  It represents a tolerable tbtt drift below
+ * which we do no TSF adjustment.
+ */
+#define TBTT_MINIMUM_ADJUSTMENT 10
+
+struct sync_method {
+        u8 method;
+        struct ieee80211_mesh_sync_ops ops;
+};
+
+/**
+ * mesh_peer_tbtt_adjusting - check if an mp is currently adjusting its TBTT
+ *
+ * @ie: information elements of a management frame from the mesh peer
+ */
+static bool mesh_peer_tbtt_adjusting(struct ieee802_11_elems *ie)
+{
+        return (ie->mesh_config->meshconf_cap &
+            MESHCONF_CAPAB_TBTT_ADJUSTING) != 0;
+}
+
+void mesh_sync_adjust_tbtt(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
+        /* sdata->vif.bss_conf.beacon_int in 1024us units, 0.04% */
+        u64 beacon_int_fraction = sdata->vif.bss_conf.beacon_int * 1024 / 2500;
+        u64 tsf;
+        u64 tsfdelta;
+
+        spin_lock_bh(&ifmsh->sync_offset_lock);
+
+        if (ifmsh->sync_offset_clockdrift_max < beacon_int_fraction) {
+                msync_dbg("TBTT : max clockdrift=%lld; adjusting",
+                        (long long) ifmsh->sync_offset_clockdrift_max);
+                tsfdelta = -ifmsh->sync_offset_clockdrift_max;
+                ifmsh->sync_offset_clockdrift_max = 0;
+        } else {
+                msync_dbg("TBTT : max clockdrift=%lld; adjusting by %llu",
+                        (long long) ifmsh->sync_offset_clockdrift_max,
+                        (unsigned long long) beacon_int_fraction);
+                tsfdelta = -beacon_int_fraction;
+                ifmsh->sync_offset_clockdrift_max -= beacon_int_fraction;
+        }
+
+        tsf = drv_get_tsf(local, sdata);
+        if (tsf != -1ULL)
+                drv_set_tsf(local, sdata, tsf + tsfdelta);
+        spin_unlock_bh(&ifmsh->sync_offset_lock);
+}
+
+static void mesh_sync_offset_rx_bcn_presp(struct ieee80211_sub_if_data *sdata,
+                                   u16 stype,
+                                   struct ieee80211_mgmt *mgmt,
+                                   struct ieee802_11_elems *elems,
+                                   struct ieee80211_rx_status *rx_status)
+{
+        struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
+        struct ieee80211_local *local = sdata->local;
+        struct sta_info *sta;
+        u64 t_t, t_r;
+
+        WARN_ON(ifmsh->mesh_sp_id != IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET);
+
+        /* standard mentions only beacons */
+        if (stype != IEEE80211_STYPE_BEACON)
+                return;
+
+        /* The current tsf is a first approximation for the timestamp
+         * for the received beacon.  Further down we try to get a
+         * better value from the rx_status->mactime field if
+         * available. Also we have to call drv_get_tsf() before
+         * entering the rcu-read section.*/
+        t_r = drv_get_tsf(local, sdata);
+
+        rcu_read_lock();
+        sta = sta_info_get(sdata, mgmt->sa);
+        if (!sta)
+                goto no_sync;
+
+        /* check offset sync conditions (13.13.2.2.1)
+         *
+         * TODO also sync to
+         * dot11MeshNbrOffsetMaxNeighbor non-peer non-MBSS neighbors
+         */
+
+        if (elems->mesh_config && mesh_peer_tbtt_adjusting(elems)) {
+                clear_sta_flag(sta, WLAN_STA_TOFFSET_KNOWN);
+                msync_dbg("STA %pM : is adjusting TBTT", sta->sta.addr);
+                goto no_sync;
+        }
+
+        if (rx_status->flag & RX_FLAG_MACTIME_MPDU && rx_status->mactime) {
+                /*
+                 * The mactime is defined as the time the first data symbol
+                 * of the frame hits the PHY, and the timestamp of the beacon
+                 * is defined as "the time that the data symbol containing the
+                 * first bit of the timestamp is transmitted to the PHY plus
+                 * the transmitting STA's delays through its local PHY from the
+                 * MAC-PHY interface to its interface with the WM" (802.11
+                 * 11.1.2)
+                 *
+                 * T_r, in 13.13.2.2.2, is just defined as "the frame reception
+                 * time" but we unless we interpret that time to be the same
+                 * time of the beacon timestamp, the offset calculation will be
+                 * off.  Below we adjust t_r to be "the time at which the first
+                 * symbol of the timestamp element in the beacon is received".
+                 * This correction depends on the rate.
+                 *
+                 * Based on similar code in ibss.c
+                 */
+                int rate;
+
+                if (rx_status->flag & RX_FLAG_HT) {
+                        /* TODO:
+                         * In principle there could be HT-beacons (Dual Beacon
+                         * HT Operation options), but for now ignore them and
+                         * just use the primary (i.e. non-HT) beacons for
+                         * synchronization.
+                         * */
+                        goto no_sync;
+                } else
+                        rate = local->hw.wiphy->bands[rx_status->band]->
+                                bitrates[rx_status->rate_idx].bitrate;
+
+                /* 24 bytes of header * 8 bits/byte *
+                 * 10*(100 Kbps)/Mbps / rate (100 Kbps)*/
+                t_r = rx_status->mactime + (24 * 8 * 10 / rate);
+        }
+
+        /* Timing offset calculation (see 13.13.2.2.2) */
+        t_t = le64_to_cpu(mgmt->u.beacon.timestamp);
+        sta->t_offset = t_t - t_r;
+
+        if (test_sta_flag(sta, WLAN_STA_TOFFSET_KNOWN)) {
+                s64 t_clockdrift = sta->t_offset_setpoint
+                                   - sta->t_offset;
+
+                msync_dbg("STA %pM : sta->t_offset=%lld,"
+                          " sta->t_offset_setpoint=%lld,"
+                          " t_clockdrift=%lld",
+                          sta->sta.addr,
+                          (long long) sta->t_offset,
+                          (long long)
+                          sta->t_offset_setpoint,
+                          (long long) t_clockdrift);
+                rcu_read_unlock();
+
+                spin_lock_bh(&ifmsh->sync_offset_lock);
+                if (t_clockdrift >
+                    ifmsh->sync_offset_clockdrift_max)
+                        ifmsh->sync_offset_clockdrift_max
+                                = t_clockdrift;
+                spin_unlock_bh(&ifmsh->sync_offset_lock);
+
+        } else {
+                sta->t_offset_setpoint = sta->t_offset;
+                set_sta_flag(sta, WLAN_STA_TOFFSET_KNOWN);
+                msync_dbg("STA %pM : offset was invalid, "
+                          " sta->t_offset=%lld",
+                          sta->sta.addr,
+                          (long long) sta->t_offset);
+                rcu_read_unlock();
+        }
+        return;
+
+no_sync:
+        rcu_read_unlock();
+}
+
+static void mesh_sync_offset_adjust_tbtt(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
+
+        WARN_ON(ifmsh->mesh_sp_id
+                != IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET);
+        BUG_ON(!rcu_read_lock_held());
+
+        spin_lock_bh(&ifmsh->sync_offset_lock);
+
+        if (ifmsh->sync_offset_clockdrift_max >
+                TBTT_MINIMUM_ADJUSTMENT) {
+                /* Since ajusting the tsf here would
+                 * require a possibly blocking call
+                 * to the driver tsf setter, we punt
+                 * the tsf adjustment to the mesh tasklet
+                 */
+                msync_dbg("TBTT : kicking off TBTT "
+                          "adjustment with "
+                          "clockdrift_max=%lld",
+                  ifmsh->sync_offset_clockdrift_max);
+                set_bit(MESH_WORK_DRIFT_ADJUST,
+                        &ifmsh->wrkq_flags);
+        } else {
+                msync_dbg("TBTT : max clockdrift=%lld; "
+                          "too small to adjust",
+                          (long long)
+                       ifmsh->sync_offset_clockdrift_max);
+                ifmsh->sync_offset_clockdrift_max = 0;
+        }
+        spin_unlock_bh(&ifmsh->sync_offset_lock);
+}
+
+static const u8 *mesh_get_vendor_oui(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
+        u8 offset;
+
+        if (!ifmsh->ie || !ifmsh->ie_len)
+                return NULL;
+
+        offset = ieee80211_ie_split_vendor(ifmsh->ie,
+                                        ifmsh->ie_len, 0);
+
+        if (!offset)
+                return NULL;
+
+        return ifmsh->ie + offset + 2;
+}
+
+static void mesh_sync_vendor_rx_bcn_presp(struct ieee80211_sub_if_data *sdata,
+                                   u16 stype,
+                                   struct ieee80211_mgmt *mgmt,
+                                   struct ieee802_11_elems *elems,
+                                   struct ieee80211_rx_status *rx_status)
+{
+        const u8 *oui;
+
+        WARN_ON(sdata->u.mesh.mesh_sp_id != IEEE80211_SYNC_METHOD_VENDOR);
+        msync_dbg("called mesh_sync_vendor_rx_bcn_presp");
+        oui = mesh_get_vendor_oui(sdata);
+        /*  here you would implement the vendor offset tracking for this oui */
+}
+
+static void mesh_sync_vendor_adjust_tbtt(struct ieee80211_sub_if_data *sdata)
+{
+        const u8 *oui;
+
+        WARN_ON(sdata->u.mesh.mesh_sp_id != IEEE80211_SYNC_METHOD_VENDOR);
+        msync_dbg("called mesh_sync_vendor_adjust_tbtt");
+        oui = mesh_get_vendor_oui(sdata);
+        /*  here you would implement the vendor tsf adjustment for this oui */
+}
+
+/* global variable */
+static struct sync_method sync_methods[] = {
+        {
+                .method = IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET,
+                .ops = {
+                        .rx_bcn_presp = &mesh_sync_offset_rx_bcn_presp,
+                        .adjust_tbtt = &mesh_sync_offset_adjust_tbtt,
+                }
+        },
+        {
+                .method = IEEE80211_SYNC_METHOD_VENDOR,
+                .ops = {
+                        .rx_bcn_presp = &mesh_sync_vendor_rx_bcn_presp,
+                        .adjust_tbtt = &mesh_sync_vendor_adjust_tbtt,
+                }
+        },
+};
+
+struct ieee80211_mesh_sync_ops *ieee80211_mesh_sync_ops_get(u8 method)
+{
+        struct ieee80211_mesh_sync_ops *ops = NULL;
+        u8 i;
+
+        for (i = 0 ; i < ARRAY_SIZE(sync_methods); ++i) {
+                if (sync_methods[i].method == method) {
+                        ops = &sync_methods[i].ops;
+                        break;
+                }
+        }
+        return ops;
+}
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index f76da5b3f5c5..bbf1100d90d6 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -171,122 +171,64 @@ static int ecw2cw(int ecw)
         return (1 << ecw) - 1;
 }
 
-/*
- * ieee80211_enable_ht should be called only after the operating band
- * has been determined as ht configuration depends on the hw's
- * HT abilities for a specific band.
- */
-static u32 ieee80211_enable_ht(struct ieee80211_sub_if_data *sdata,
-                               struct ieee80211_ht_info *hti,
-                               const u8 *bssid, u16 ap_ht_cap_flags,
-                               bool beacon_htcap_ie)
+static u32 ieee80211_config_ht_tx(struct ieee80211_sub_if_data *sdata,
+                                  struct ieee80211_ht_operation *ht_oper,
+                                  const u8 *bssid, bool reconfig)
 {
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_supported_band *sband;
         struct sta_info *sta;
         u32 changed = 0;
-        int hti_cfreq;
         u16 ht_opmode;
-        bool enable_ht = true;
-        enum nl80211_channel_type prev_chantype;
-        enum nl80211_channel_type rx_channel_type = NL80211_CHAN_NO_HT;
-        enum nl80211_channel_type tx_channel_type;
+        bool disable_40 = false;
 
         sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
-        prev_chantype = sdata->vif.bss_conf.channel_type;
-
 
-        hti_cfreq = ieee80211_channel_to_frequency(hti->control_chan,
-                                                   sband->band);
-        /* check that channel matches the right operating channel */
-        if (local->hw.conf.channel->center_freq != hti_cfreq) {
-                /* Some APs mess this up, evidently.
-                 * Netgear WNDR3700 sometimes reports 4 higher than
-                 * the actual channel, for instance.
-                 */
-                printk(KERN_DEBUG
-                       "%s: Wrong control channel in association"
-                       " response: configured center-freq: %d"
-                       " hti-cfreq: %d  hti->control_chan: %d"
-                       " band: %d.  Disabling HT.\n",
-                       sdata->name,
-                       local->hw.conf.channel->center_freq,
-                       hti_cfreq, hti->control_chan,
-                       sband->band);
-                enable_ht = false;
-        }
-
-        if (enable_ht) {
-                rx_channel_type = NL80211_CHAN_HT20;
-
-                if (!(ap_ht_cap_flags & IEEE80211_HT_CAP_40MHZ_INTOLERANT) &&
-                    !ieee80111_cfg_override_disables_ht40(sdata) &&
-                    (sband->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) &&
-                    (hti->ht_param & IEEE80211_HT_PARAM_CHAN_WIDTH_ANY)) {
-                        switch(hti->ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
-                        case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
-                                rx_channel_type = NL80211_CHAN_HT40PLUS;
-                                break;
-                        case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
-                                rx_channel_type = NL80211_CHAN_HT40MINUS;
-                                break;
-                        }
-                }
+        switch (sdata->vif.bss_conf.channel_type) {
+        case NL80211_CHAN_HT40PLUS:
+                if (local->hw.conf.channel->flags & IEEE80211_CHAN_NO_HT40PLUS)
+                        disable_40 = true;
+                break;
+        case NL80211_CHAN_HT40MINUS:
+                if (local->hw.conf.channel->flags & IEEE80211_CHAN_NO_HT40MINUS)
+                        disable_40 = true;
+                break;
+        default:
+                break;
         }
 
-        tx_channel_type = ieee80211_get_tx_channel_type(local, rx_channel_type);
-
-        if (local->tmp_channel)
-                local->tmp_channel_type = rx_channel_type;
+        /* This can change during the lifetime of the BSS */
+        if (!(ht_oper->ht_param & IEEE80211_HT_PARAM_CHAN_WIDTH_ANY))
+                disable_40 = true;
 
-        if (!ieee80211_set_channel_type(local, sdata, rx_channel_type)) {
-                /* can only fail due to HT40+/- mismatch */
-                rx_channel_type = NL80211_CHAN_HT20;
-                WARN_ON(!ieee80211_set_channel_type(local, sdata,
-                                                    rx_channel_type));
-        }
-
-        if (beacon_htcap_ie && (prev_chantype != rx_channel_type)) {
-                /*
-                 * Whenever the AP announces the HT mode change that can be
-                 * 40MHz intolerant or etc., it would be safer to stop tx
-                 * queues before doing hw config to avoid buffer overflow.
-                 */
-                ieee80211_stop_queues_by_reason(&sdata->local->hw,
-                                IEEE80211_QUEUE_STOP_REASON_CHTYPE_CHANGE);
+        mutex_lock(&local->sta_mtx);
+        sta = sta_info_get(sdata, bssid);
 
-                /* flush out all packets */
-                synchronize_net();
+        WARN_ON_ONCE(!sta);
 
-                drv_flush(local, false);
-        }
+        if (sta && !sta->supports_40mhz)
+                disable_40 = true;
 
-        /* channel_type change automatically detected */
-        ieee80211_hw_config(local, 0);
+        if (sta && (!reconfig ||
+                    (disable_40 != !!(sta->sta.ht_cap.cap &
+                                        IEEE80211_HT_CAP_SUP_WIDTH_20_40)))) {
 
-        if (prev_chantype != tx_channel_type) {
-                rcu_read_lock();
-                sta = sta_info_get(sdata, bssid);
-                if (sta)
-                        rate_control_rate_update(local, sband, sta,
-                                                 IEEE80211_RC_HT_CHANGED,
-                                                 tx_channel_type);
-                rcu_read_unlock();
+                if (disable_40)
+                        sta->sta.ht_cap.cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
+                else
+                        sta->sta.ht_cap.cap |= IEEE80211_HT_CAP_SUP_WIDTH_20_40;
 
-                if (beacon_htcap_ie)
-                        ieee80211_wake_queues_by_reason(&sdata->local->hw,
-                                IEEE80211_QUEUE_STOP_REASON_CHTYPE_CHANGE);
+                rate_control_rate_update(local, sband, sta,
+                                         IEEE80211_RC_BW_CHANGED);
         }
+        mutex_unlock(&local->sta_mtx);
 
-        ht_opmode = le16_to_cpu(hti->operation_mode);
+        ht_opmode = le16_to_cpu(ht_oper->operation_mode);
 
         /* if bss configuration changed store the new one */
-        if (sdata->ht_opmode_valid != enable_ht ||
-            sdata->vif.bss_conf.ht_operation_mode != ht_opmode ||
-            prev_chantype != rx_channel_type) {
+        if (!reconfig || (sdata->vif.bss_conf.ht_operation_mode != ht_opmode)) {
                 changed |= BSS_CHANGED_HT;
                 sdata->vif.bss_conf.ht_operation_mode = ht_opmode;
-                sdata->ht_opmode_valid = enable_ht;
         }
 
         return changed;
@@ -316,12 +258,12 @@ static int ieee80211_compatible_rates(const u8 *supp_rates, int supp_rates_len,
 }
 
 static void ieee80211_add_ht_ie(struct ieee80211_sub_if_data *sdata,
-                                struct sk_buff *skb, const u8 *ht_info_ie,
+                                struct sk_buff *skb, const u8 *ht_oper_ie,
                                 struct ieee80211_supported_band *sband,
                                 struct ieee80211_channel *channel,
                                 enum ieee80211_smps_mode smps)
 {
-        struct ieee80211_ht_info *ht_info;
+        struct ieee80211_ht_operation *ht_oper;
         u8 *pos;
         u32 flags = channel->flags;
         u16 cap;
@@ -329,21 +271,21 @@ static void ieee80211_add_ht_ie(struct ieee80211_sub_if_data *sdata,
 
         BUILD_BUG_ON(sizeof(ht_cap) != sizeof(sband->ht_cap));
 
-        if (!ht_info_ie)
+        if (!ht_oper_ie)
                 return;
 
-        if (ht_info_ie[1] < sizeof(struct ieee80211_ht_info))
+        if (ht_oper_ie[1] < sizeof(struct ieee80211_ht_operation))
                 return;
 
         memcpy(&ht_cap, &sband->ht_cap, sizeof(ht_cap));
         ieee80211_apply_htcap_overrides(sdata, &ht_cap);
 
-        ht_info = (struct ieee80211_ht_info *)(ht_info_ie + 2);
+        ht_oper = (struct ieee80211_ht_operation *)(ht_oper_ie + 2);
 
         /* determine capability flags */
         cap = ht_cap.cap;
 
-        switch (ht_info->ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
+        switch (ht_oper->ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
         case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
                 if (flags & IEEE80211_CHAN_NO_HT40PLUS) {
                         cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
@@ -358,6 +300,16 @@ static void ieee80211_add_ht_ie(struct ieee80211_sub_if_data *sdata,
                 break;
         }
 
+        /*
+         * If 40 MHz was disabled associate as though we weren't
+         * capable of 40 MHz -- some broken APs will never fall
+         * back to trying to transmit in 20 MHz.
+         */
+        if (sdata->u.mgd.flags & IEEE80211_STA_DISABLE_40MHZ) {
+                cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
+                cap &= ~IEEE80211_HT_CAP_SGI_40;
+        }
+
         /* set SM PS mode properly */
         cap &= ~IEEE80211_HT_CAP_SM_PS;
         switch (smps) {
@@ -557,7 +509,7 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
         }
 
         if (!(ifmgd->flags & IEEE80211_STA_DISABLE_11N))
-                ieee80211_add_ht_ie(sdata, skb, assoc_data->ht_information_ie,
+                ieee80211_add_ht_ie(sdata, skb, assoc_data->ht_operation_ie,
                                     sband, local->oper_channel, ifmgd->ap_smps);
 
         /* if present, add any custom non-vendor IEs that go after HT */
@@ -1182,7 +1134,7 @@ static void ieee80211_sta_wmm_params(struct ieee80211_local *local,
         if (!local->ops->conf_tx)
                 return;
 
-        if (local->hw.queues < 4)
+        if (local->hw.queues < IEEE80211_NUM_ACS)
                 return;
 
         if (!wmm_param)
@@ -1435,7 +1387,6 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
         sdata->vif.bss_conf.assoc = false;
 
         /* on the next assoc, re-program HT parameters */
-        sdata->ht_opmode_valid = false;
         memset(&ifmgd->ht_capa, 0, sizeof(ifmgd->ht_capa));
         memset(&ifmgd->ht_capa_mask, 0, sizeof(ifmgd->ht_capa_mask));
 
@@ -1567,14 +1518,23 @@ static void ieee80211_mgd_probe_ap_send(struct ieee80211_sub_if_data *sdata)
                 ifmgd->nullfunc_failed = false;
                 ieee80211_send_nullfunc(sdata->local, sdata, 0);
         } else {
+                int ssid_len;
+
                 ssid = ieee80211_bss_get_ie(ifmgd->associated, WLAN_EID_SSID);
-                ieee80211_send_probe_req(sdata, dst, ssid + 2, ssid[1], NULL, 0,
-                                         (u32) -1, true, false);
+                if (WARN_ON_ONCE(ssid == NULL))
+                        ssid_len = 0;
+                else
+                        ssid_len = ssid[1];
+
+                ieee80211_send_probe_req(sdata, dst, ssid + 2, ssid_len, NULL,
+                                         0, (u32) -1, true, false);
         }
 
         ifmgd->probe_send_count++;
         ifmgd->probe_timeout = jiffies + msecs_to_jiffies(probe_wait_ms);
         run_again(ifmgd, ifmgd->probe_timeout);
+        if (sdata->local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
+                drv_flush(sdata->local, false);
 }
 
 static void ieee80211_mgd_probe_ap(struct ieee80211_sub_if_data *sdata,
@@ -1643,6 +1603,7 @@ struct sk_buff *ieee80211_ap_probereq_get(struct ieee80211_hw *hw,
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct sk_buff *skb;
         const u8 *ssid;
+        int ssid_len;
 
         if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
                 return NULL;
@@ -1653,8 +1614,13 @@ struct sk_buff *ieee80211_ap_probereq_get(struct ieee80211_hw *hw,
                 return NULL;
 
         ssid = ieee80211_bss_get_ie(ifmgd->associated, WLAN_EID_SSID);
+        if (WARN_ON_ONCE(ssid == NULL))
+                ssid_len = 0;
+        else
+                ssid_len = ssid[1];
+
         skb = ieee80211_build_probe_req(sdata, ifmgd->associated->bssid,
-                                        (u32) -1, ssid + 2, ssid[1],
+                                        (u32) -1, ssid + 2, ssid_len,
                                         NULL, 0, true);
 
         return skb;
@@ -2000,7 +1966,6 @@ static bool ieee80211_assoc_success(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
         u32 changed = 0;
         int err;
-        u16 ap_ht_cap_flags;
 
         /* AssocResp and ReassocResp have identical structure */
 
@@ -2051,7 +2016,8 @@ static bool ieee80211_assoc_success(struct ieee80211_sub_if_data *sdata,
                 ieee80211_ht_cap_ie_to_sta_ht_cap(sdata, sband,
                                 elems.ht_cap_elem, &sta->sta.ht_cap);
 
-        ap_ht_cap_flags = sta->sta.ht_cap.cap;
+        sta->supports_40mhz =
+                sta->sta.ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40;
 
         rate_control_rate_init(sta);
 
@@ -2092,11 +2058,10 @@ static bool ieee80211_assoc_success(struct ieee80211_sub_if_data *sdata,
                 ieee80211_set_wmm_default(sdata, false);
         changed |= BSS_CHANGED_QOS;
 
-        if (elems.ht_info_elem && elems.wmm_param &&
+        if (elems.ht_operation && elems.wmm_param &&
             !(ifmgd->flags & IEEE80211_STA_DISABLE_11N))
-                changed |= ieee80211_enable_ht(sdata, elems.ht_info_elem,
-                                               cbss->bssid, ap_ht_cap_flags,
-                                               false);
+                changed |= ieee80211_config_ht_tx(sdata, elems.ht_operation,
+                                                  cbss->bssid, false);
 
         /* set AID and assoc capability,
          * ieee80211_set_associated() will tell the driver */
@@ -2319,7 +2284,7 @@ static const u64 care_about_ies =
         (1ULL << WLAN_EID_CHANNEL_SWITCH) |
         (1ULL << WLAN_EID_PWR_CONSTRAINT) |
         (1ULL << WLAN_EID_HT_CAPABILITY) |
-        (1ULL << WLAN_EID_HT_INFORMATION);
+        (1ULL << WLAN_EID_HT_OPERATION);
 
 static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
                                      struct ieee80211_mgmt *mgmt,
@@ -2468,11 +2433,13 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
         if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK) {
                 if (directed_tim) {
                         if (local->hw.conf.dynamic_ps_timeout > 0) {
-                                local->hw.conf.flags &= ~IEEE80211_CONF_PS;
-                                ieee80211_hw_config(local,
-                                                    IEEE80211_CONF_CHANGE_PS);
+                                if (local->hw.conf.flags & IEEE80211_CONF_PS) {
+                                        local->hw.conf.flags &= ~IEEE80211_CONF_PS;
+                                        ieee80211_hw_config(local,
+                                                            IEEE80211_CONF_CHANGE_PS);
+                                }
                                 ieee80211_send_nullfunc(local, sdata, 0);
-                        } else {
+                        } else if (!local->pspolling && sdata->u.mgd.powersave) {
                                 local->pspolling = true;
 
                                 /*
@@ -2504,31 +2471,14 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
                         erp_valid, erp_value);
 
 
-        if (elems.ht_cap_elem && elems.ht_info_elem && elems.wmm_param &&
+        if (elems.ht_cap_elem && elems.ht_operation && elems.wmm_param &&
             !(ifmgd->flags & IEEE80211_STA_DISABLE_11N)) {
-                struct sta_info *sta;
                 struct ieee80211_supported_band *sband;
-                u16 ap_ht_cap_flags;
-
-                rcu_read_lock();
-
-                sta = sta_info_get(sdata, bssid);
-                if (WARN_ON(!sta)) {
-                        rcu_read_unlock();
-                        return;
-                }
 
                 sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
 
-                ieee80211_ht_cap_ie_to_sta_ht_cap(sdata, sband,
-                                elems.ht_cap_elem, &sta->sta.ht_cap);
-
-                ap_ht_cap_flags = sta->sta.ht_cap.cap;
-
-                rcu_read_unlock();
-
-                changed |= ieee80211_enable_ht(sdata, elems.ht_info_elem,
-                                               bssid, ap_ht_cap_flags, true);
+                changed |= ieee80211_config_ht_tx(sdata, elems.ht_operation,
+                                                  bssid, true);
         }
 
         /* Note: country IE parsing is done for us by cfg80211 */
@@ -3060,6 +3010,11 @@ static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata,
         struct sta_info *sta;
         bool have_sta = false;
         int err;
+        int ht_cfreq;
+        enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
+        const u8 *ht_oper_ie;
+        const struct ieee80211_ht_operation *ht_oper = NULL;
+        struct ieee80211_supported_band *sband;
 
         if (WARN_ON(!ifmgd->auth_data && !ifmgd->assoc_data))
                 return -EINVAL;
@@ -3081,17 +3036,76 @@ static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata,
         mutex_unlock(&local->mtx);
 
         /* switch to the right channel */
+        sband = local->hw.wiphy->bands[cbss->channel->band];
+
+        ifmgd->flags &= ~IEEE80211_STA_DISABLE_40MHZ;
+
+        if (sband->ht_cap.ht_supported) {
+                ht_oper_ie = cfg80211_find_ie(WLAN_EID_HT_OPERATION,
+                                              cbss->information_elements,
+                                              cbss->len_information_elements);
+                if (ht_oper_ie && ht_oper_ie[1] >= sizeof(*ht_oper))
+                        ht_oper = (void *)(ht_oper_ie + 2);
+        }
+
+        if (ht_oper) {
+                ht_cfreq = ieee80211_channel_to_frequency(ht_oper->primary_chan,
+                                                          cbss->channel->band);
+                /* check that channel matches the right operating channel */
+                if (cbss->channel->center_freq != ht_cfreq) {
+                        /*
+                         * It's possible that some APs are confused here;
+                         * Netgear WNDR3700 sometimes reports 4 higher than
+                         * the actual channel in association responses, but
+                         * since we look at probe response/beacon data here
+                         * it should be OK.
+                         */
+                        printk(KERN_DEBUG
+                               "%s: Wrong control channel: center-freq: %d"
+                               " ht-cfreq: %d ht->primary_chan: %d"
+                               " band: %d. Disabling HT.\n",
+                               sdata->name, cbss->channel->center_freq,
+                               ht_cfreq, ht_oper->primary_chan,
+                               cbss->channel->band);
+                        ht_oper = NULL;
+                }
+        }
+
+        if (ht_oper) {
+                channel_type = NL80211_CHAN_HT20;
+
+                if (sband->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) {
+                        switch (ht_oper->ht_param &
+                                        IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
+                        case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
+                                channel_type = NL80211_CHAN_HT40PLUS;
+                                break;
+                        case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
+                                channel_type = NL80211_CHAN_HT40MINUS;
+                                break;
+                        }
+                }
+        }
+
+        if (!ieee80211_set_channel_type(local, sdata, channel_type)) {
+                /* can only fail due to HT40+/- mismatch */
+                channel_type = NL80211_CHAN_HT20;
+                printk(KERN_DEBUG
+                       "%s: disabling 40 MHz due to multi-vif mismatch\n",
+                       sdata->name);
+                ifmgd->flags |= IEEE80211_STA_DISABLE_40MHZ;
+                WARN_ON(!ieee80211_set_channel_type(local, sdata,
+                                                    channel_type));
+        }
+
         local->oper_channel = cbss->channel;
-        ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);
+        ieee80211_hw_config(local, 0);
 
         if (!have_sta) {
-                struct ieee80211_supported_band *sband;
                 u32 rates = 0, basic_rates = 0;
                 bool have_higher_than_11mbit;
                 int min_rate = INT_MAX, min_rate_index = -1;
 
-                sband = sdata->local->hw.wiphy->bands[cbss->channel->band];
-
                 ieee80211_get_rates(sband, bss->supp_rates,
                                     bss->supp_rates_len,
                                     &rates, &basic_rates,
@@ -3311,7 +3325,7 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
         /* Also disable HT if we don't support it or the AP doesn't use WMM */
         sband = local->hw.wiphy->bands[req->bss->channel->band];
         if (!sband->ht_cap.ht_supported ||
-            local->hw.queues < 4 || !bss->wmm_used)
+            local->hw.queues < IEEE80211_NUM_ACS || !bss->wmm_used)
                 ifmgd->flags |= IEEE80211_STA_DISABLE_11N;
 
         memcpy(&ifmgd->ht_capa, &req->ht_capa, sizeof(ifmgd->ht_capa));
@@ -3334,11 +3348,12 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
                 ifmgd->ap_smps = ifmgd->req_smps;
 
         assoc_data->capability = req->bss->capability;
-        assoc_data->wmm = bss->wmm_used && (local->hw.queues >= 4);
+        assoc_data->wmm = bss->wmm_used &&
+                          (local->hw.queues >= IEEE80211_NUM_ACS);
         assoc_data->supp_rates = bss->supp_rates;
         assoc_data->supp_rates_len = bss->supp_rates_len;
-        assoc_data->ht_information_ie =
-                ieee80211_bss_get_ie(req->bss, WLAN_EID_HT_INFORMATION);
+        assoc_data->ht_operation_ie =
+                ieee80211_bss_get_ie(req->bss, WLAN_EID_HT_OPERATION);
 
         if (bss->wmm_used && bss->uapsd_supported &&
             (sdata->local->hw.flags & IEEE80211_HW_SUPPORTS_UAPSD)) {
diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c
index ef8eba1d736d..af1c4e26e965 100644
--- a/net/mac80211/pm.c
+++ b/net/mac80211/pm.c
@@ -127,6 +127,10 @@ int __ieee80211_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
                 drv_remove_interface(local, sdata);
         }
 
+        sdata = rtnl_dereference(local->monitor_sdata);
+        if (sdata)
+                drv_remove_interface(local, sdata);
+
         /* stop hardware - this must stop RX */
         if (local->open_count)
                 ieee80211_stop_device(local);
diff --git a/net/mac80211/rate.h b/net/mac80211/rate.h
index fbb1efdc4d04..6e4fd32c6617 100644
--- a/net/mac80211/rate.h
+++ b/net/mac80211/rate.h
@@ -17,6 +17,7 @@
 #include <net/mac80211.h>
 #include "ieee80211_i.h"
 #include "sta_info.h"
+#include "driver-ops.h"
 
 struct rate_control_ref {
         struct ieee80211_local *local;
@@ -63,8 +64,7 @@ static inline void rate_control_rate_init(struct sta_info *sta)
 
 static inline void rate_control_rate_update(struct ieee80211_local *local,
                                     struct ieee80211_supported_band *sband,
-                                    struct sta_info *sta, u32 changed,
-                                    enum nl80211_channel_type oper_chan_type)
+                                    struct sta_info *sta, u32 changed)
 {
         struct rate_control_ref *ref = local->rate_ctrl;
         struct ieee80211_sta *ista = &sta->sta;
@@ -72,7 +72,8 @@ static inline void rate_control_rate_update(struct ieee80211_local *local,
 
         if (ref && ref->ops->rate_update)
                 ref->ops->rate_update(ref->priv, sband, ista,
-                                      priv_sta, changed, oper_chan_type);
+                                      priv_sta, changed);
+        drv_sta_rc_update(local, sta->sdata, &sta->sta, changed);
 }
 
 static inline void *rate_control_alloc_sta(struct rate_control_ref *ref,
diff --git a/net/mac80211/rc80211_minstrel_ht.c b/net/mac80211/rc80211_minstrel_ht.c
index 16e0b277b9a8..3b3dcae13bbc 100644
--- a/net/mac80211/rc80211_minstrel_ht.c
+++ b/net/mac80211/rc80211_minstrel_ht.c
@@ -686,8 +686,7 @@ minstrel_ht_get_rate(void *priv, struct ieee80211_sta *sta, void *priv_sta,
 
 static void
 minstrel_ht_update_caps(void *priv, struct ieee80211_supported_band *sband,
-                        struct ieee80211_sta *sta, void *priv_sta,
-                        enum nl80211_channel_type oper_chan_type)
+                        struct ieee80211_sta *sta, void *priv_sta)
 {
         struct minstrel_priv *mp = priv;
         struct minstrel_ht_sta_priv *msp = priv_sta;
@@ -735,10 +734,6 @@ minstrel_ht_update_caps(void *priv, struct ieee80211_supported_band *sband,
         if (sta_cap & IEEE80211_HT_CAP_LDPC_CODING)
                 mi->tx_flags |= IEEE80211_TX_CTL_LDPC;
 
-        if (oper_chan_type != NL80211_CHAN_HT40MINUS &&
-            oper_chan_type != NL80211_CHAN_HT40PLUS)
-                sta_cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
-
         smps = (sta_cap & IEEE80211_HT_CAP_SM_PS) >>
                 IEEE80211_HT_CAP_SM_PS_SHIFT;
 
@@ -788,17 +783,15 @@ static void
 minstrel_ht_rate_init(void *priv, struct ieee80211_supported_band *sband,
                       struct ieee80211_sta *sta, void *priv_sta)
 {
-        struct minstrel_priv *mp = priv;
-
-        minstrel_ht_update_caps(priv, sband, sta, priv_sta, mp->hw->conf.channel_type);
+        minstrel_ht_update_caps(priv, sband, sta, priv_sta);
 }
 
 static void
 minstrel_ht_rate_update(void *priv, struct ieee80211_supported_band *sband,
                         struct ieee80211_sta *sta, void *priv_sta,
-                        u32 changed, enum nl80211_channel_type oper_chan_type)
+                        u32 changed)
 {
-        minstrel_ht_update_caps(priv, sband, sta, priv_sta, oper_chan_type);
+        minstrel_ht_update_caps(priv, sband, sta, priv_sta);
 }
 
 static void *
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index bcfe8c77c839..54a049123a60 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -793,8 +793,7 @@ static void ieee80211_rx_reorder_ampdu(struct ieee80211_rx_data *rx)
 
         /* reset session timer */
         if (tid_agg_rx->timeout)
-                mod_timer(&tid_agg_rx->session_timer,
-                          TU_TO_EXP_TIME(tid_agg_rx->timeout));
+                tid_agg_rx->last_rx = jiffies;
 
         /* if this mpdu is fragmented - terminate rx aggregation session */
         sc = le16_to_cpu(hdr->seq_ctrl);
@@ -2269,11 +2268,8 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
 
                         sband = rx->local->hw.wiphy->bands[status->band];
 
-                        rate_control_rate_update(
-                                local, sband, rx->sta,
-                                IEEE80211_RC_SMPS_CHANGED,
-                                ieee80211_get_tx_channel_type(
-                                        local, local->_oper_channel_type));
+                        rate_control_rate_update(local, sband, rx->sta,
+                                                 IEEE80211_RC_SMPS_CHANGED);
                         goto handled;
                 }
                 default:
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index 38137cb5f6f0..7fd7ac48f893 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -1195,13 +1195,15 @@ ieee80211_sta_ps_deliver_response(struct sta_info *sta,
                             ieee80211_is_qos_nullfunc(hdr->frame_control))
                                 qoshdr = ieee80211_get_qos_ctl(hdr);
 
-                        /* set EOSP for the frame */
-                        if (reason == IEEE80211_FRAME_RELEASE_UAPSD &&
-                            qoshdr && skb_queue_empty(&frames))
-                                *qoshdr |= IEEE80211_QOS_CTL_EOSP;
-
-                        info->flags |= IEEE80211_TX_STATUS_EOSP |
-                                       IEEE80211_TX_CTL_REQ_TX_STATUS;
+                        /* end service period after last frame */
+                        if (skb_queue_empty(&frames)) {
+                                if (reason == IEEE80211_FRAME_RELEASE_UAPSD &&
+                                    qoshdr)
+                                        *qoshdr |= IEEE80211_QOS_CTL_EOSP;
+
+                                info->flags |= IEEE80211_TX_STATUS_EOSP |
+                                               IEEE80211_TX_CTL_REQ_TX_STATUS;
+                        }
 
                         if (qoshdr)
                                 tids |= BIT(*qoshdr & IEEE80211_QOS_CTL_TID_MASK);
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index ab0576827baf..f75f5d9ac06d 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -55,6 +55,7 @@
  * @WLAN_STA_4ADDR_EVENT: 4-addr event was already sent for this frame.
  * @WLAN_STA_INSERTED: This station is inserted into the hash table.
  * @WLAN_STA_RATE_CONTROL: rate control was initialized for this station.
+ * @WLAN_STA_TOFFSET_KNOWN: toffset calculated for this station is valid.
  */
 enum ieee80211_sta_info_flags {
         WLAN_STA_AUTH,
@@ -76,6 +77,7 @@ enum ieee80211_sta_info_flags {
         WLAN_STA_4ADDR_EVENT,
         WLAN_STA_INSERTED,
         WLAN_STA_RATE_CONTROL,
+        WLAN_STA_TOFFSET_KNOWN,
 };
 
 #define STA_TID_NUM 16
@@ -101,6 +103,7 @@ enum ieee80211_sta_info_flags {
  * @dialog_token: dialog token for aggregation session
  * @timeout: session timeout value to be filled in ADDBA requests
  * @state: session state (see above)
+ * @last_tx: jiffies of last tx activity
  * @stop_initiator: initiator of a session stop
  * @tx_stop: TX DelBA frame when stopping
  * @buf_size: reorder buffer size at receiver
@@ -122,6 +125,7 @@ struct tid_ampdu_tx {
         struct timer_list addba_resp_timer;
         struct sk_buff_head pending;
         unsigned long state;
+        unsigned long last_tx;
         u16 timeout;
         u8 dialog_token;
         u8 stop_initiator;
@@ -139,6 +143,7 @@ struct tid_ampdu_tx {
  * @reorder_time: jiffies when skb was added
  * @session_timer: check if peer keeps Tx-ing on the TID (by timeout value)
  * @reorder_timer: releases expired frames from the reorder buffer.
+ * @last_rx: jiffies of last rx activity
  * @head_seq_num: head sequence number in reordering buffer.
  * @stored_mpdu_num: number of MPDUs in reordering buffer
  * @ssn: Starting Sequence Number expected to be aggregated.
@@ -163,6 +168,7 @@ struct tid_ampdu_rx {
         unsigned long *reorder_time;
         struct timer_list session_timer;
         struct timer_list reorder_timer;
+        unsigned long last_rx;
         u16 head_seq_num;
         u16 stored_mpdu_num;
         u16 ssn;
@@ -264,6 +270,7 @@ struct sta_ampdu_mlme {
  * @plink_timeout: timeout of peer link
  * @plink_timer: peer link watch timer
  * @plink_timer_was_running: used by suspend/resume to restore timers
+ * @t_offset: timing offset relative to this host
  * @debugfs: debug filesystem info
  * @dead: set to true when sta is unlinked
  * @uploaded: set to true when sta is uploaded to the driver
@@ -353,6 +360,8 @@ struct sta_info {
         enum nl80211_plink_state plink_state;
         u32 plink_timeout;
         struct timer_list plink_timer;
+        s64 t_offset;
+        s64 t_offset_setpoint;
 #endif
 
 #ifdef CONFIG_MAC80211_DEBUGFS
@@ -365,6 +374,8 @@ struct sta_info {
         unsigned int lost_packets;
         unsigned int beacon_loss_count;
 
+        bool supports_40mhz;
+
         /* keep last! */
         struct ieee80211_sta sta;
 };
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 782a60198df4..4f6aac16ac3a 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -230,9 +230,9 @@ ieee80211_tx_h_dynamic_ps(struct ieee80211_tx_data *tx)
          * changed via debugfs, user needs to reassociate manually to have
          * everything in sync.
          */
-        if ((ifmgd->flags & IEEE80211_STA_UAPSD_ENABLED)
-            && (ifmgd->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VO)
-            && skb_get_queue_mapping(tx->skb) == 0)
+        if ((ifmgd->flags & IEEE80211_STA_UAPSD_ENABLED) &&
+            (ifmgd->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VO) &&
+            skb_get_queue_mapping(tx->skb) == IEEE80211_AC_VO)
                 return TX_CONTINUE;
 
         if (local->hw.conf.flags & IEEE80211_CONF_PS) {
@@ -400,6 +400,8 @@ ieee80211_tx_h_multicast_ps_buf(struct ieee80211_tx_data *tx)
                 return TX_CONTINUE;
 
         info->flags |= IEEE80211_TX_CTL_SEND_AFTER_DTIM;
+        if (tx->local->hw.flags & IEEE80211_HW_QUEUE_CONTROL)
+                info->hw_queue = tx->sdata->vif.cab_queue;
 
         /* device releases frame after DTIM beacon */
         if (!(tx->local->hw.flags & IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING))
@@ -1118,8 +1120,7 @@ static bool ieee80211_tx_prep_agg(struct ieee80211_tx_data *tx,
 
         /* reset session timer */
         if (reset_agg_timer && tid_tx->timeout)
-                mod_timer(&tid_tx->session_timer,
-                          TU_TO_EXP_TIME(tid_tx->timeout));
+                tid_tx->last_tx = jiffies;
 
         return queued;
 }
@@ -1215,11 +1216,19 @@ static bool ieee80211_tx_frags(struct ieee80211_local *local,
                                bool txpending)
 {
         struct sk_buff *skb, *tmp;
-        struct ieee80211_tx_info *info;
         unsigned long flags;
 
         skb_queue_walk_safe(skbs, skb, tmp) {
-                int q = skb_get_queue_mapping(skb);
+                struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+                int q = info->hw_queue;
+
+#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
+                if (WARN_ON_ONCE(q >= local->hw.queues)) {
+                        __skb_unlink(skb, skbs);
+                        dev_kfree_skb(skb);
+                        continue;
+                }
+#endif
 
                 spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
                 if (local->queue_stop_reasons[q] ||
@@ -1241,7 +1250,6 @@ static bool ieee80211_tx_frags(struct ieee80211_local *local,
                 }
                 spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
 
-                info = IEEE80211_SKB_CB(skb);
                 info->control.vif = vif;
                 info->control.sta = sta;
 
@@ -1284,8 +1292,16 @@ static bool __ieee80211_tx(struct ieee80211_local *local,
 
         switch (sdata->vif.type) {
         case NL80211_IFTYPE_MONITOR:
-                sdata = NULL;
-                vif = NULL;
+                sdata = rcu_dereference(local->monitor_sdata);
+                if (sdata) {
+                        vif = &sdata->vif;
+                        info->hw_queue =
+                                vif->hw_queue[skb_get_queue_mapping(skb)];
+                } else if (local->hw.flags & IEEE80211_HW_QUEUE_CONTROL) {
+                        dev_kfree_skb(skb);
+                        return true;
+                } else
+                        vif = NULL;
                 break;
         case NL80211_IFTYPE_AP_VLAN:
                 sdata = container_of(sdata->bss,
@@ -1400,6 +1416,12 @@ static bool ieee80211_tx(struct ieee80211_sub_if_data *sdata,
         tx.channel = local->hw.conf.channel;
         info->band = tx.channel->band;
 
+        /* set up hw_queue value early */
+        if (!(info->flags & IEEE80211_TX_CTL_TX_OFFCHAN) ||
+            !(local->hw.flags & IEEE80211_HW_QUEUE_CONTROL))
+                info->hw_queue =
+                        sdata->vif.hw_queue[skb_get_queue_mapping(skb)];
+
         if (!invoke_tx_handlers(&tx))
                 result = __ieee80211_tx(local, &tx.skbs, led_len,
                                         tx.sta, txpending);
@@ -1468,12 +1490,12 @@ void ieee80211_xmit(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb)
 
         if (ieee80211_vif_is_mesh(&sdata->vif) &&
             ieee80211_is_data(hdr->frame_control) &&
-                !is_multicast_ether_addr(hdr->addr1))
-                        if (mesh_nexthop_resolve(skb, sdata)) {
-                                /* skb queued: don't free */
-                                rcu_read_unlock();
-                                return;
-                        }
+            !is_multicast_ether_addr(hdr->addr1) &&
+            mesh_nexthop_resolve(skb, sdata)) {
+                /* skb queued: don't free */
+                rcu_read_unlock();
+                return;
+        }
 
         ieee80211_set_qos_hdr(sdata, skb);
         ieee80211_tx(sdata, skb, false);
@@ -1929,7 +1951,7 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
                 wme_sta = true;
 
         /* receiver and we are QoS enabled, use a QoS type frame */
-        if (wme_sta && local->hw.queues >= 4) {
+        if (wme_sta && local->hw.queues >= IEEE80211_NUM_ACS) {
                 fc |= cpu_to_le16(IEEE80211_STYPE_QOS_DATA);
                 hdrlen += 2;
         }
@@ -2170,7 +2192,6 @@ static bool ieee80211_tx_pending_skb(struct ieee80211_local *local,
 void ieee80211_tx_pending(unsigned long data)
 {
         struct ieee80211_local *local = (struct ieee80211_local *)data;
-        struct ieee80211_sub_if_data *sdata;
         unsigned long flags;
         int i;
         bool txok;
@@ -2207,8 +2228,7 @@ void ieee80211_tx_pending(unsigned long data)
                 }
 
                 if (skb_queue_empty(&local->pending[i]))
-                        list_for_each_entry_rcu(sdata, &local->interfaces, list)
-                                netif_wake_subqueue(sdata->dev, i);
+                        ieee80211_propagate_queue_wake(local, i);
         }
         spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
 
@@ -2374,6 +2394,7 @@ struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
                                                  IEEE80211_STYPE_BEACON);
         } else if (ieee80211_vif_is_mesh(&sdata->vif)) {
                 struct ieee80211_mgmt *mgmt;
+                struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
                 u8 *pos;
                 int hdr_len = offsetof(struct ieee80211_mgmt, u.beacon) +
                               sizeof(mgmt->u.beacon);
@@ -2383,6 +2404,10 @@ struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
                         goto out;
 #endif
 
+                if (ifmsh->sync_ops)
+                        ifmsh->sync_ops->adjust_tbtt(
+                                                sdata);
+
                 skb = dev_alloc_skb(local->tx_headroom +
                                     hdr_len +
                                     2 + /* NULL SSID */
@@ -2390,7 +2415,7 @@ struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
                                     2 + 3 + /* DS params */
                                     2 + (IEEE80211_MAX_SUPP_RATES - 8) +
                                     2 + sizeof(struct ieee80211_ht_cap) +
-                                    2 + sizeof(struct ieee80211_ht_info) +
+                                    2 + sizeof(struct ieee80211_ht_operation) +
                                     2 + sdata->u.mesh.mesh_id_len +
                                     2 + sizeof(struct ieee80211_meshconf_ie) +
                                     sdata->u.mesh.ie_len);
@@ -2414,12 +2439,12 @@ struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
                 *pos++ = WLAN_EID_SSID;
                 *pos++ = 0x0;
 
-                if (ieee80211_add_srates_ie(&sdata->vif, skb) ||
+                if (ieee80211_add_srates_ie(&sdata->vif, skb, true) ||
                     mesh_add_ds_params_ie(skb, sdata) ||
-                    ieee80211_add_ext_srates_ie(&sdata->vif, skb) ||
+                    ieee80211_add_ext_srates_ie(&sdata->vif, skb, true) ||
                     mesh_add_rsn_ie(skb, sdata) ||
                     mesh_add_ht_cap_ie(skb, sdata) ||
-                    mesh_add_ht_info_ie(skb, sdata) ||
+                    mesh_add_ht_oper_ie(skb, sdata) ||
                     mesh_add_meshid_ie(skb, sdata) ||
                     mesh_add_meshconf_ie(skb, sdata) ||
                     mesh_add_vendor_ies(skb, sdata)) {
@@ -2603,7 +2628,7 @@ struct sk_buff *ieee80211_probereq_get(struct ieee80211_hw *hw,
         pos = skb_put(skb, ie_ssid_len);
         *pos++ = WLAN_EID_SSID;
         *pos++ = ssid_len;
-        if (ssid)
+        if (ssid_len)
                 memcpy(pos, ssid, ssid_len);
         pos += ssid_len;
 
@@ -2710,11 +2735,13 @@ EXPORT_SYMBOL(ieee80211_get_buffered_bc);
 void ieee80211_tx_skb_tid(struct ieee80211_sub_if_data *sdata,
                           struct sk_buff *skb, int tid)
 {
+        int ac = ieee802_1d_to_ac[tid];
+
         skb_set_mac_header(skb, 0);
         skb_set_network_header(skb, 0);
         skb_set_transport_header(skb, 0);
 
-        skb_set_queue_mapping(skb, ieee802_1d_to_ac[tid]);
+        skb_set_queue_mapping(skb, ac);
         skb->priority = tid;
 
         /*
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 32f7a3b3d43c..e67fe5c1def9 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -265,17 +265,45 @@ __le16 ieee80211_ctstoself_duration(struct ieee80211_hw *hw,
 }
 EXPORT_SYMBOL(ieee80211_ctstoself_duration);
 
+void ieee80211_propagate_queue_wake(struct ieee80211_local *local, int queue)
+{
+        struct ieee80211_sub_if_data *sdata;
+
+        list_for_each_entry_rcu(sdata, &local->interfaces, list) {
+                int ac;
+
+                if (test_bit(SDATA_STATE_OFFCHANNEL, &sdata->state))
+                        continue;
+
+                if (sdata->vif.cab_queue != IEEE80211_INVAL_HW_QUEUE &&
+                    local->queue_stop_reasons[sdata->vif.cab_queue] != 0)
+                        continue;
+
+                for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
+                        int ac_queue = sdata->vif.hw_queue[ac];
+
+                        if (ac_queue == queue ||
+                            (sdata->vif.cab_queue == queue &&
+                             local->queue_stop_reasons[ac_queue] == 0 &&
+                             skb_queue_empty(&local->pending[ac_queue])))
+                                netif_wake_subqueue(sdata->dev, ac);
+                }
+        }
+}
+
 static void __ieee80211_wake_queue(struct ieee80211_hw *hw, int queue,
                                    enum queue_stop_reason reason)
 {
         struct ieee80211_local *local = hw_to_local(hw);
-        struct ieee80211_sub_if_data *sdata;
 
         trace_wake_queue(local, queue, reason);
 
         if (WARN_ON(queue >= hw->queues))
                 return;
 
+        if (!test_bit(reason, &local->queue_stop_reasons[queue]))
+                return;
+
         __clear_bit(reason, &local->queue_stop_reasons[queue]);
 
         if (local->queue_stop_reasons[queue] != 0)
@@ -284,11 +312,7 @@ static void __ieee80211_wake_queue(struct ieee80211_hw *hw, int queue,
 
         if (skb_queue_empty(&local->pending[queue])) {
                 rcu_read_lock();
-                list_for_each_entry_rcu(sdata, &local->interfaces, list) {
-                        if (test_bit(SDATA_STATE_OFFCHANNEL, &sdata->state))
-                                continue;
-                        netif_wake_subqueue(sdata->dev, queue);
-                }
+                ieee80211_propagate_queue_wake(local, queue);
                 rcu_read_unlock();
         } else
                 tasklet_schedule(&local->tx_pending_tasklet);
@@ -323,11 +347,21 @@ static void __ieee80211_stop_queue(struct ieee80211_hw *hw, int queue,
         if (WARN_ON(queue >= hw->queues))
                 return;
 
+        if (test_bit(reason, &local->queue_stop_reasons[queue]))
+                return;
+
         __set_bit(reason, &local->queue_stop_reasons[queue]);
 
         rcu_read_lock();
-        list_for_each_entry_rcu(sdata, &local->interfaces, list)
-                netif_stop_subqueue(sdata->dev, queue);
+        list_for_each_entry_rcu(sdata, &local->interfaces, list) {
+                int ac;
+
+                for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
+                        if (sdata->vif.hw_queue[ac] == queue ||
+                            sdata->vif.cab_queue == queue)
+                                netif_stop_subqueue(sdata->dev, ac);
+                }
+        }
         rcu_read_unlock();
 }
 
@@ -354,8 +388,8 @@ void ieee80211_add_pending_skb(struct ieee80211_local *local,
 {
         struct ieee80211_hw *hw = &local->hw;
         unsigned long flags;
-        int queue = skb_get_queue_mapping(skb);
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+        int queue = info->hw_queue;
 
         if (WARN_ON(!info->control.vif)) {
                 kfree_skb(skb);
@@ -379,10 +413,6 @@ void ieee80211_add_pending_skbs_fn(struct ieee80211_local *local,
         int queue, i;
 
         spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
-        for (i = 0; i < hw->queues; i++)
-                __ieee80211_stop_queue(hw, i,
-                        IEEE80211_QUEUE_STOP_REASON_SKB_ADD);
-
         while ((skb = skb_dequeue(skbs))) {
                 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 
@@ -391,7 +421,11 @@ void ieee80211_add_pending_skbs_fn(struct ieee80211_local *local,
                         continue;
                 }
 
-                queue = skb_get_queue_mapping(skb);
+                queue = info->hw_queue;
+
+                __ieee80211_stop_queue(hw, queue,
+                                IEEE80211_QUEUE_STOP_REASON_SKB_ADD);
+
                 __skb_queue_tail(&local->pending[queue], skb);
         }
 
@@ -404,12 +438,6 @@ void ieee80211_add_pending_skbs_fn(struct ieee80211_local *local,
         spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
 }
 
-void ieee80211_add_pending_skbs(struct ieee80211_local *local,
-                                struct sk_buff_head *skbs)
-{
-        ieee80211_add_pending_skbs_fn(local, skbs, NULL, NULL);
-}
-
 void ieee80211_stop_queues_by_reason(struct ieee80211_hw *hw,
                                     enum queue_stop_reason reason)
 {
@@ -684,9 +712,9 @@ u32 ieee802_11_parse_elems_crc(u8 *start, size_t len,
                         else
                                 elem_parse_failed = true;
                         break;
-                case WLAN_EID_HT_INFORMATION:
-                        if (elen >= sizeof(struct ieee80211_ht_info))
-                                elems->ht_info_elem = (void *)pos;
+                case WLAN_EID_HT_OPERATION:
+                        if (elen >= sizeof(struct ieee80211_ht_operation))
+                                elems->ht_operation = (void *)pos;
                         else
                                 elem_parse_failed = true;
                         break;
@@ -775,19 +803,22 @@ void ieee80211_set_wmm_default(struct ieee80211_sub_if_data *sdata,
 {
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_tx_queue_params qparam;
-        int queue;
+        int ac;
         bool use_11b;
         int aCWmin, aCWmax;
 
         if (!local->ops->conf_tx)
                 return;
 
+        if (local->hw.queues < IEEE80211_NUM_ACS)
+                return;
+
         memset(&qparam, 0, sizeof(qparam));
 
         use_11b = (local->hw.conf.channel->band == IEEE80211_BAND_2GHZ) &&
                  !(sdata->flags & IEEE80211_SDATA_OPERATING_GMODE);
 
-        for (queue = 0; queue < local->hw.queues; queue++) {
+        for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
                 /* Set defaults according to 802.11-2007 Table 7-37 */
                 aCWmax = 1023;
                 if (use_11b)
@@ -795,21 +826,21 @@ void ieee80211_set_wmm_default(struct ieee80211_sub_if_data *sdata,
                 else
                         aCWmin = 15;
 
-                switch (queue) {
-                case 3: /* AC_BK */
+                switch (ac) {
+                case IEEE80211_AC_BK:
                         qparam.cw_max = aCWmax;
                         qparam.cw_min = aCWmin;
                         qparam.txop = 0;
                         qparam.aifs = 7;
                         break;
                 default: /* never happens but let's not leave undefined */
-                case 2: /* AC_BE */
+                case IEEE80211_AC_BE:
                         qparam.cw_max = aCWmax;
                         qparam.cw_min = aCWmin;
                         qparam.txop = 0;
                         qparam.aifs = 3;
                         break;
-                case 1: /* AC_VI */
+                case IEEE80211_AC_VI:
                         qparam.cw_max = aCWmin;
                         qparam.cw_min = (aCWmin + 1) / 2 - 1;
                         if (use_11b)
@@ -818,7 +849,7 @@ void ieee80211_set_wmm_default(struct ieee80211_sub_if_data *sdata,
                                 qparam.txop = 3008/32;
                         qparam.aifs = 2;
                         break;
-                case 0: /* AC_VO */
+                case IEEE80211_AC_VO:
                         qparam.cw_max = (aCWmin + 1) / 2 - 1;
                         qparam.cw_min = (aCWmin + 1) / 4 - 1;
                         if (use_11b)
@@ -831,8 +862,8 @@ void ieee80211_set_wmm_default(struct ieee80211_sub_if_data *sdata,
 
                 qparam.uapsd = false;
 
-                sdata->tx_conf[queue] = qparam;
-                drv_conf_tx(local, sdata, queue, &qparam);
+                sdata->tx_conf[ac] = qparam;
+                drv_conf_tx(local, sdata, ac, &qparam);
         }
 
         /* after reinitialize QoS TX queues setting to default,
@@ -1106,7 +1137,7 @@ void ieee80211_send_probe_req(struct ieee80211_sub_if_data *sdata, u8 *dst,
 
 u32 ieee80211_sta_get_rates(struct ieee80211_local *local,
                             struct ieee802_11_elems *elems,
-                            enum ieee80211_band band)
+                            enum ieee80211_band band, u32 *basic_rates)
 {
         struct ieee80211_supported_band *sband;
         struct ieee80211_rate *bitrates;
@@ -1127,15 +1158,25 @@ u32 ieee80211_sta_get_rates(struct ieee80211_local *local,
                      elems->ext_supp_rates_len; i++) {
                 u8 rate = 0;
                 int own_rate;
+                bool is_basic;
                 if (i < elems->supp_rates_len)
                         rate = elems->supp_rates[i];
                 else if (elems->ext_supp_rates)
                         rate = elems->ext_supp_rates
                                 [i - elems->supp_rates_len];
                 own_rate = 5 * (rate & 0x7f);
-                for (j = 0; j < num_rates; j++)
-                        if (bitrates[j].bitrate == own_rate)
+                is_basic = !!(rate & 0x80);
+
+                if (is_basic && (rate & 0x7f) == BSS_MEMBERSHIP_SELECTOR_HT_PHY)
+                        continue;
+
+                for (j = 0; j < num_rates; j++) {
+                        if (bitrates[j].bitrate == own_rate) {
                                 supp_rates |= BIT(j);
+                                if (basic_rates && is_basic)
+                                        *basic_rates |= BIT(j);
+                        }
+                }
         }
         return supp_rates;
 }
@@ -1210,6 +1251,16 @@ int ieee80211_reconfig(struct ieee80211_local *local)
                                    IEEE80211_TPT_LEDTRIG_FL_RADIO, 0);
 
         /* add interfaces */
+        sdata = rtnl_dereference(local->monitor_sdata);
+        if (sdata) {
+                res = drv_add_interface(local, sdata);
+                if (WARN_ON(res)) {
+                        rcu_assign_pointer(local->monitor_sdata, NULL);
+                        synchronize_net();
+                        kfree(sdata);
+                }
+        }
+
         list_for_each_entry(sdata, &local->interfaces, list) {
                 if (sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
                     sdata->vif.type != NL80211_IFTYPE_MONITOR &&
@@ -1232,14 +1283,17 @@ int ieee80211_reconfig(struct ieee80211_local *local)
         mutex_unlock(&local->sta_mtx);
 
         /* reconfigure tx conf */
-        list_for_each_entry(sdata, &local->interfaces, list) {
-                if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
-                    sdata->vif.type == NL80211_IFTYPE_MONITOR ||
-                    !ieee80211_sdata_running(sdata))
-                        continue;
+        if (hw->queues >= IEEE80211_NUM_ACS) {
+                list_for_each_entry(sdata, &local->interfaces, list) {
+                        if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
+                            sdata->vif.type == NL80211_IFTYPE_MONITOR ||
+                            !ieee80211_sdata_running(sdata))
+                                continue;
 
-                for (i = 0; i < hw->queues; i++)
-                        drv_conf_tx(local, sdata, i, &sdata->tx_conf[i]);
+                        for (i = 0; i < IEEE80211_NUM_ACS; i++)
+                                drv_conf_tx(local, sdata, i,
+                                            &sdata->tx_conf[i]);
+                }
         }
 
         /* reconfigure hardware */
@@ -1611,57 +1665,56 @@ u8 *ieee80211_ie_build_ht_cap(u8 *pos, struct ieee80211_sta_ht_cap *ht_cap,
         return pos;
 }
 
-u8 *ieee80211_ie_build_ht_info(u8 *pos,
-                               struct ieee80211_sta_ht_cap *ht_cap,
+u8 *ieee80211_ie_build_ht_oper(u8 *pos, struct ieee80211_sta_ht_cap *ht_cap,
                                struct ieee80211_channel *channel,
                                enum nl80211_channel_type channel_type)
 {
-        struct ieee80211_ht_info *ht_info;
+        struct ieee80211_ht_operation *ht_oper;
         /* Build HT Information */
-        *pos++ = WLAN_EID_HT_INFORMATION;
-        *pos++ = sizeof(struct ieee80211_ht_info);
-        ht_info = (struct ieee80211_ht_info *)pos;
-        ht_info->control_chan =
+        *pos++ = WLAN_EID_HT_OPERATION;
+        *pos++ = sizeof(struct ieee80211_ht_operation);
+        ht_oper = (struct ieee80211_ht_operation *)pos;
+        ht_oper->primary_chan =
                         ieee80211_frequency_to_channel(channel->center_freq);
         switch (channel_type) {
         case NL80211_CHAN_HT40MINUS:
-                ht_info->ht_param = IEEE80211_HT_PARAM_CHA_SEC_BELOW;
+                ht_oper->ht_param = IEEE80211_HT_PARAM_CHA_SEC_BELOW;
                 break;
         case NL80211_CHAN_HT40PLUS:
-                ht_info->ht_param = IEEE80211_HT_PARAM_CHA_SEC_ABOVE;
+                ht_oper->ht_param = IEEE80211_HT_PARAM_CHA_SEC_ABOVE;
                 break;
         case NL80211_CHAN_HT20:
         default:
-                ht_info->ht_param = IEEE80211_HT_PARAM_CHA_SEC_NONE;
+                ht_oper->ht_param = IEEE80211_HT_PARAM_CHA_SEC_NONE;
                 break;
         }
         if (ht_cap->cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40)
-                ht_info->ht_param |= IEEE80211_HT_PARAM_CHAN_WIDTH_ANY;
+                ht_oper->ht_param |= IEEE80211_HT_PARAM_CHAN_WIDTH_ANY;
 
         /*
          * Note: According to 802.11n-2009 9.13.3.1, HT Protection field and
          * RIFS Mode are reserved in IBSS mode, therefore keep them at 0
          */
-        ht_info->operation_mode = 0x0000;
-        ht_info->stbc_param = 0x0000;
+        ht_oper->operation_mode = 0x0000;
+        ht_oper->stbc_param = 0x0000;
 
         /* It seems that Basic MCS set and Supported MCS set
            are identical for the first 10 bytes */
-        memset(&ht_info->basic_set, 0, 16);
-        memcpy(&ht_info->basic_set, &ht_cap->mcs, 10);
+        memset(&ht_oper->basic_set, 0, 16);
+        memcpy(&ht_oper->basic_set, &ht_cap->mcs, 10);
 
-        return pos + sizeof(struct ieee80211_ht_info);
+        return pos + sizeof(struct ieee80211_ht_operation);
 }
 
 enum nl80211_channel_type
-ieee80211_ht_info_to_channel_type(struct ieee80211_ht_info *ht_info)
+ieee80211_ht_oper_to_channel_type(struct ieee80211_ht_operation *ht_oper)
 {
         enum nl80211_channel_type channel_type;
 
-        if (!ht_info)
+        if (!ht_oper)
                 return NL80211_CHAN_NO_HT;
 
-        switch (ht_info->ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
+        switch (ht_oper->ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
         case IEEE80211_HT_PARAM_CHA_SEC_NONE:
                 channel_type = NL80211_CHAN_HT20;
                 break;
@@ -1678,13 +1731,15 @@ ieee80211_ht_info_to_channel_type(struct ieee80211_ht_info *ht_info)
         return channel_type;
 }
 
-int ieee80211_add_srates_ie(struct ieee80211_vif *vif, struct sk_buff *skb)
+int ieee80211_add_srates_ie(struct ieee80211_vif *vif,
+                            struct sk_buff *skb, bool need_basic)
 {
         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_supported_band *sband;
         int rate;
         u8 i, rates, *pos;
+        u32 basic_rates = vif->bss_conf.basic_rates;
 
         sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
         rates = sband->n_bitrates;
@@ -1698,20 +1753,25 @@ int ieee80211_add_srates_ie(struct ieee80211_vif *vif, struct sk_buff *skb)
         *pos++ = WLAN_EID_SUPP_RATES;
         *pos++ = rates;
         for (i = 0; i < rates; i++) {
+                u8 basic = 0;
+                if (need_basic && basic_rates & BIT(i))
+                        basic = 0x80;
                 rate = sband->bitrates[i].bitrate;
-                *pos++ = (u8) (rate / 5);
+                *pos++ = basic | (u8) (rate / 5);
         }
 
         return 0;
 }
 
-int ieee80211_add_ext_srates_ie(struct ieee80211_vif *vif, struct sk_buff *skb)
+int ieee80211_add_ext_srates_ie(struct ieee80211_vif *vif,
+                                struct sk_buff *skb, bool need_basic)
 {
         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_supported_band *sband;
         int rate;
         u8 i, exrates, *pos;
+        u32 basic_rates = vif->bss_conf.basic_rates;
 
         sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
         exrates = sband->n_bitrates;
@@ -1728,8 +1788,11 @@ int ieee80211_add_ext_srates_ie(struct ieee80211_vif *vif, struct sk_buff *skb)
                 *pos++ = WLAN_EID_EXT_SUPP_RATES;
                 *pos++ = exrates;
                 for (i = 8; i < sband->n_bitrates; i++) {
+                        u8 basic = 0;
+                        if (need_basic && basic_rates & BIT(i))
+                                basic = 0x80;
                         rate = sband->bitrates[i].bitrate;
-                        *pos++ = (u8) (rate / 5);
+                        *pos++ = basic | (u8) (rate / 5);
                 }
         }
         return 0;
diff --git a/net/mac80211/wme.c b/net/mac80211/wme.c
index 89511be3111e..c3d643a6536c 100644
--- a/net/mac80211/wme.c
+++ b/net/mac80211/wme.c
@@ -52,6 +52,26 @@ static int wme_downgrade_ac(struct sk_buff *skb)
         }
 }
 
+static u16 ieee80211_downgrade_queue(struct ieee80211_local *local,
+                                     struct sk_buff *skb)
+{
+        /* in case we are a client verify acm is not set for this ac */
+        while (unlikely(local->wmm_acm & BIT(skb->priority))) {
+                if (wme_downgrade_ac(skb)) {
+                        /*
+                         * This should not really happen. The AP has marked all
+                         * lower ACs to require admission control which is not
+                         * a reasonable configuration. Allow the frame to be
+                         * transmitted using AC_BK as a workaround.
+                         */
+                        break;
+                }
+        }
+
+        /* look up which queue to use for frames with this 1d tag */
+        return ieee802_1d_to_ac[skb->priority];
+}
+
 /* Indicate which queue to use for this fully formed 802.11 frame */
 u16 ieee80211_select_queue_80211(struct ieee80211_local *local,
                                  struct sk_buff *skb,
@@ -59,7 +79,7 @@ u16 ieee80211_select_queue_80211(struct ieee80211_local *local,
 {
         u8 *p;
 
-        if (local->hw.queues < 4)
+        if (local->hw.queues < IEEE80211_NUM_ACS)
                 return 0;
 
         if (!ieee80211_is_data(hdr->frame_control)) {
@@ -86,9 +106,9 @@ u16 ieee80211_select_queue(struct ieee80211_sub_if_data *sdata,
         const u8 *ra = NULL;
         bool qos = false;
 
-        if (local->hw.queues < 4 || skb->len < 6) {
+        if (local->hw.queues < IEEE80211_NUM_ACS || skb->len < 6) {
                 skb->priority = 0; /* required for correct WPA/11i MIC */
-                return min_t(u16, local->hw.queues - 1, IEEE80211_AC_BE);
+                return 0;
         }
 
         rcu_read_lock();
@@ -139,26 +159,6 @@ u16 ieee80211_select_queue(struct ieee80211_sub_if_data *sdata,
         return ieee80211_downgrade_queue(local, skb);
 }
 
-u16 ieee80211_downgrade_queue(struct ieee80211_local *local,
-                              struct sk_buff *skb)
-{
-        /* in case we are a client verify acm is not set for this ac */
-        while (unlikely(local->wmm_acm & BIT(skb->priority))) {
-                if (wme_downgrade_ac(skb)) {
-                        /*
-                         * This should not really happen. The AP has marked all
-                         * lower ACs to require admission control which is not
-                         * a reasonable configuration. Allow the frame to be
-                         * transmitted using AC_BK as a workaround.
-                         */
-                        break;
-                }
-        }
-
-        /* look up which queue to use for frames with this 1d tag */
-        return ieee802_1d_to_ac[skb->priority];
-}
-
 void ieee80211_set_qos_hdr(struct ieee80211_sub_if_data *sdata,
                            struct sk_buff *skb)
 {
diff --git a/net/mac80211/wme.h b/net/mac80211/wme.h
index 94edceb617ff..ca80818b7b66 100644
--- a/net/mac80211/wme.h
+++ b/net/mac80211/wme.h
@@ -22,8 +22,5 @@ u16 ieee80211_select_queue(struct ieee80211_sub_if_data *sdata,
                            struct sk_buff *skb);
 void ieee80211_set_qos_hdr(struct ieee80211_sub_if_data *sdata,
                            struct sk_buff *skb);
-u16 ieee80211_downgrade_queue(struct ieee80211_local *local,
-                              struct sk_buff *skb);
-
 
 #endif /* _WME_H */