wireless: radiotap updates
[safe/jmp/linux-2.6] / net / mac80211 / rx.c
index 208563a..fcc0a59 100644 (file)
 #include "tkip.h"
 #include "wme.h"
 
-u8 ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
-                               struct tid_ampdu_rx *tid_agg_rx,
-                               struct sk_buff *skb, u16 mpdu_seq_num,
-                               int bar_req);
+static u8 ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
+                                          struct tid_ampdu_rx *tid_agg_rx,
+                                          struct sk_buff *skb,
+                                          u16 mpdu_seq_num,
+                                          int bar_req);
 /*
  * monitor mode reception
  *
@@ -85,8 +86,7 @@ ieee80211_rx_radiotap_len(struct ieee80211_local *local,
 
        if (status->flag & RX_FLAG_TSFT)
                len += 8;
-       if (local->hw.flags & IEEE80211_HW_SIGNAL_DB ||
-           local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
+       if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
                len += 1;
        if (local->hw.flags & IEEE80211_HW_NOISE_DBM)
                len += 1;
@@ -101,7 +101,7 @@ ieee80211_rx_radiotap_len(struct ieee80211_local *local,
        return len;
 }
 
-/**
+/*
  * ieee80211_add_rx_radiotap_header - add radiotap header
  *
  * add a radiotap header containing all the fields which the hardware provided.
@@ -122,7 +122,6 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
        /* radiotap header, set always present flags */
        rthdr->it_present =
                cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
-                           (1 << IEEE80211_RADIOTAP_RATE) |
                            (1 << IEEE80211_RADIOTAP_CHANNEL) |
                            (1 << IEEE80211_RADIOTAP_ANTENNA) |
                            (1 << IEEE80211_RADIOTAP_RX_FLAGS));
@@ -143,12 +142,26 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
        /* IEEE80211_RADIOTAP_FLAGS */
        if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)
                *pos |= IEEE80211_RADIOTAP_F_FCS;
+       if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
+               *pos |= IEEE80211_RADIOTAP_F_BADFCS;
        if (status->flag & RX_FLAG_SHORTPRE)
                *pos |= IEEE80211_RADIOTAP_F_SHORTPRE;
        pos++;
 
        /* IEEE80211_RADIOTAP_RATE */
-       *pos = rate->bitrate / 5;
+       if (status->flag & RX_FLAG_HT) {
+               /*
+                * TODO: add following information into radiotap header once
+                * suitable fields are defined for it:
+                * - MCS index (status->rate_idx)
+                * - HT40 (status->flag & RX_FLAG_40MHZ)
+                * - short-GI (status->flag & RX_FLAG_SHORT_GI)
+                */
+               *pos = 0;
+       } else {
+               rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_RATE);
+               *pos = rate->bitrate / 5;
+       }
        pos++;
 
        /* IEEE80211_RADIOTAP_CHANNEL */
@@ -187,23 +200,14 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
        *pos = status->antenna;
        pos++;
 
-       /* IEEE80211_RADIOTAP_DB_ANTSIGNAL */
-       if (local->hw.flags & IEEE80211_HW_SIGNAL_DB) {
-               *pos = status->signal;
-               rthdr->it_present |=
-                       cpu_to_le32(1 << IEEE80211_RADIOTAP_DB_ANTSIGNAL);
-               pos++;
-       }
-
        /* IEEE80211_RADIOTAP_DB_ANTNOISE is not used */
 
        /* IEEE80211_RADIOTAP_RX_FLAGS */
        /* ensure 2 byte alignment for the 2 byte field as required */
        if ((pos - (unsigned char *)rthdr) & 1)
                pos++;
-       /* FIXME: when radiotap gets a 'bad PLCP' flag use it here */
-       if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
-               *(__le16 *)pos |= cpu_to_le16(IEEE80211_RADIOTAP_F_RX_BADFCS);
+       if (status->flag & RX_FLAG_FAILED_PLCP_CRC)
+               *(__le16 *)pos |= cpu_to_le16(IEEE80211_RADIOTAP_F_RX_BADPLCP);
        pos += 2;
 }
 
@@ -295,7 +299,7 @@ ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
                if (!netif_running(sdata->dev))
                        continue;
 
-               if (sdata->vif.type != IEEE80211_IF_TYPE_MNTR)
+               if (sdata->vif.type != NL80211_IFTYPE_MONITOR)
                        continue;
 
                if (sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES)
@@ -359,39 +363,50 @@ static void ieee80211_parse_qos(struct ieee80211_rx_data *rx)
        rx->skb->priority = (tid > 7) ? 0 : tid;
 }
 
-static void ieee80211_verify_ip_alignment(struct ieee80211_rx_data *rx)
+/**
+ * DOC: Packet alignment
+ *
+ * Drivers always need to pass packets that are aligned to two-byte boundaries
+ * to the stack.
+ *
+ * Additionally, should, if possible, align the payload data in a way that
+ * guarantees that the contained IP header is aligned to a four-byte
+ * boundary. In the case of regular frames, this simply means aligning the
+ * payload to a four-byte boundary (because either the IP header is directly
+ * contained, or IV/RFC1042 headers that have a length divisible by four are
+ * in front of it).
+ *
+ * With A-MSDU frames, however, the payload data address must yield two modulo
+ * four because there are 14-byte 802.3 headers within the A-MSDU frames that
+ * push the IP header further back to a multiple of four again. Thankfully, the
+ * specs were sane enough this time around to require padding each A-MSDU
+ * subframe to a length that is a multiple of four.
+ *
+ * Padding like Atheros hardware adds which is inbetween the 802.11 header and
+ * the payload is not supported, the driver is required to move the 802.11
+ * header to be directly in front of the payload in that case.
+ */
+static void ieee80211_verify_alignment(struct ieee80211_rx_data *rx)
 {
-#ifdef CONFIG_MAC80211_DEBUG_PACKET_ALIGNMENT
        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
        int hdrlen;
 
+#ifndef CONFIG_MAC80211_DEBUG_PACKET_ALIGNMENT
+       return;
+#endif
+
+       if (WARN_ONCE((unsigned long)rx->skb->data & 1,
+                     "unaligned packet at 0x%p\n", rx->skb->data))
+               return;
+
        if (!ieee80211_is_data_present(hdr->frame_control))
                return;
 
-       /*
-        * Drivers are required to align the payload data in a way that
-        * guarantees that the contained IP header is aligned to a four-
-        * byte boundary. In the case of regular frames, this simply means
-        * aligning the payload to a four-byte boundary (because either
-        * the IP header is directly contained, or IV/RFC1042 headers that
-        * have a length divisible by four are in front of it.
-        *
-        * With A-MSDU frames, however, the payload data address must
-        * yield two modulo four because there are 14-byte 802.3 headers
-        * within the A-MSDU frames that push the IP header further back
-        * to a multiple of four again. Thankfully, the specs were sane
-        * enough this time around to require padding each A-MSDU subframe
-        * to a length that is a multiple of four.
-        *
-        * Padding like atheros hardware adds which is inbetween the 802.11
-        * header and the payload is not supported, the driver is required
-        * to move the 802.11 header further back in that case.
-        */
        hdrlen = ieee80211_hdrlen(hdr->frame_control);
        if (rx->flags & IEEE80211_RX_AMSDU)
                hdrlen += ETH_HLEN;
-       WARN_ON_ONCE(((unsigned long)(rx->skb->data + hdrlen)) & 3);
-#endif
+       WARN_ONCE(((unsigned long)(rx->skb->data + hdrlen)) & 3,
+                 "unaligned IP payload at 0x%p\n", rx->skb->data + hdrlen);
 }
 
 
@@ -403,12 +418,12 @@ ieee80211_rx_h_passive_scan(struct ieee80211_rx_data *rx)
        struct ieee80211_local *local = rx->local;
        struct sk_buff *skb = rx->skb;
 
-       if (unlikely(local->sta_hw_scanning))
-               return ieee80211_sta_rx_scan(rx->sdata, skb, rx->status);
+       if (unlikely(local->hw_scanning))
+               return ieee80211_scan_rx(rx->sdata, skb, rx->status);
 
-       if (unlikely(local->sta_sw_scanning)) {
+       if (unlikely(local->sw_scanning)) {
                /* drop all the other packets during a software scan anyway */
-               if (ieee80211_sta_rx_scan(rx->sdata, skb, rx->status)
+               if (ieee80211_scan_rx(rx->sdata, skb, rx->status)
                    != RX_QUEUED)
                        dev_kfree_skb(skb);
                return RX_QUEUED;
@@ -423,6 +438,52 @@ ieee80211_rx_h_passive_scan(struct ieee80211_rx_data *rx)
        return RX_CONTINUE;
 }
 
+
+static int ieee80211_is_unicast_robust_mgmt_frame(struct sk_buff *skb)
+{
+       struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
+
+       if (skb->len < 24 || is_multicast_ether_addr(hdr->addr1))
+               return 0;
+
+       return ieee80211_is_robust_mgmt_frame(hdr);
+}
+
+
+static int ieee80211_is_multicast_robust_mgmt_frame(struct sk_buff *skb)
+{
+       struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
+
+       if (skb->len < 24 || !is_multicast_ether_addr(hdr->addr1))
+               return 0;
+
+       return ieee80211_is_robust_mgmt_frame(hdr);
+}
+
+
+/* Get the BIP key index from MMIE; return -1 if this is not a BIP frame */
+static int ieee80211_get_mmie_keyidx(struct sk_buff *skb)
+{
+       struct ieee80211_mgmt *hdr = (struct ieee80211_mgmt *) skb->data;
+       struct ieee80211_mmie *mmie;
+
+       if (skb->len < 24 + sizeof(*mmie) ||
+           !is_multicast_ether_addr(hdr->da))
+               return -1;
+
+       if (!ieee80211_is_robust_mgmt_frame((struct ieee80211_hdr *) hdr))
+               return -1; /* not a robust management frame */
+
+       mmie = (struct ieee80211_mmie *)
+               (skb->data + skb->len - sizeof(*mmie));
+       if (mmie->element_id != WLAN_EID_MMIE ||
+           mmie->length != sizeof(*mmie) - 2)
+               return -1;
+
+       return le16_to_cpu(mmie->key_id);
+}
+
+
 static ieee80211_rx_result
 ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
 {
@@ -501,8 +562,8 @@ ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
        /* Drop disallowed frame classes based on STA auth/assoc state;
         * IEEE 802.11, Chap 5.5.
         *
-        * 80211.o does filtering only based on association state, i.e., it
-        * drops Class 3 frames from not associated stations. hostapd sends
+        * mac80211 filters only based on association state, i.e. it drops
+        * Class 3 frames from not associated stations. hostapd sends
         * deauth/disassoc frames when needed. In addition, hostapd is
         * responsible for filtering on both auth and assoc states.
         */
@@ -512,7 +573,7 @@ ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
 
        if (unlikely((ieee80211_is_data(hdr->frame_control) ||
                      ieee80211_is_pspoll(hdr->frame_control)) &&
-                    rx->sdata->vif.type != IEEE80211_IF_TYPE_IBSS &&
+                    rx->sdata->vif.type != NL80211_IFTYPE_ADHOC &&
                     (!rx->sta || !test_sta_flags(rx->sta, WLAN_STA_ASSOC)))) {
                if ((!ieee80211_has_fromds(hdr->frame_control) &&
                     !ieee80211_has_tods(hdr->frame_control) &&
@@ -538,21 +599,23 @@ ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
        int hdrlen;
        ieee80211_rx_result result = RX_DROP_UNUSABLE;
        struct ieee80211_key *stakey = NULL;
+       int mmie_keyidx = -1;
 
        /*
         * Key selection 101
         *
-        * There are three types of keys:
+        * There are four types of keys:
         *  - GTK (group keys)
+        *  - IGTK (group keys for management frames)
         *  - PTK (pairwise keys)
         *  - STK (station-to-station pairwise keys)
         *
         * When selecting a key, we have to distinguish between multicast
         * (including broadcast) and unicast frames, the latter can only
-        * use PTKs and STKs while the former always use GTKs. Unless, of
-        * course, actual WEP keys ("pre-RSNA") are used, then unicast
-        * frames can also use key indizes like GTKs. Hence, if we don't
-        * have a PTK/STK we check the key index for a WEP key.
+        * use PTKs and STKs while the former always use GTKs and IGTKs.
+        * Unless, of course, actual WEP keys ("pre-RSNA") are used, then
+        * unicast frames can also use key indices like GTKs. Hence, if we
+        * don't have a PTK/STK we check the key index for a WEP key.
         *
         * Note that in a regular BSS, multicast frames are sent by the
         * AP only, associated stations unicast the frame to the AP first
@@ -565,8 +628,14 @@ ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
         * possible.
         */
 
-       if (!ieee80211_has_protected(hdr->frame_control))
-               return RX_CONTINUE;
+       if (!ieee80211_has_protected(hdr->frame_control)) {
+               if (!ieee80211_is_mgmt(hdr->frame_control) ||
+                   rx->sta == NULL || !test_sta_flags(rx->sta, WLAN_STA_MFP))
+                       return RX_CONTINUE;
+               mmie_keyidx = ieee80211_get_mmie_keyidx(rx->skb);
+               if (mmie_keyidx < 0)
+                       return RX_CONTINUE;
+       }
 
        /*
         * No point in finding a key and decrypting if the frame is neither
@@ -580,6 +649,16 @@ ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
 
        if (!is_multicast_ether_addr(hdr->addr1) && stakey) {
                rx->key = stakey;
+       } else if (mmie_keyidx >= 0) {
+               /* Broadcast/multicast robust management frame / BIP */
+               if ((rx->status->flag & RX_FLAG_DECRYPTED) &&
+                   (rx->status->flag & RX_FLAG_IV_STRIPPED))
+                       return RX_CONTINUE;
+
+               if (mmie_keyidx < NUM_DEFAULT_KEYS ||
+                   mmie_keyidx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS)
+                       return RX_DROP_MONITOR; /* unexpected BIP keyidx */
+               rx->key = rcu_dereference(rx->sdata->keys[mmie_keyidx]);
        } else {
                /*
                 * The device doesn't give us the IV so we won't be
@@ -642,6 +721,9 @@ ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
        case ALG_CCMP:
                result = ieee80211_crypto_ccmp_decrypt(rx);
                break;
+       case ALG_AES_CMAC:
+               result = ieee80211_crypto_aes_cmac_decrypt(rx);
+               break;
        }
 
        /* either the frame has been decrypted or will be dropped */
@@ -650,61 +732,92 @@ ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
        return result;
 }
 
-static void ap_sta_ps_start(struct net_device *dev, struct sta_info *sta)
+static ieee80211_rx_result debug_noinline
+ieee80211_rx_h_check_more_data(struct ieee80211_rx_data *rx)
 {
-       struct ieee80211_sub_if_data *sdata;
-       DECLARE_MAC_BUF(mac);
+       struct ieee80211_local *local;
+       struct ieee80211_hdr *hdr;
+       struct sk_buff *skb;
+
+       local = rx->local;
+       skb = rx->skb;
+       hdr = (struct ieee80211_hdr *) skb->data;
+
+       if (!local->pspolling)
+               return RX_CONTINUE;
+
+       if (!ieee80211_has_fromds(hdr->frame_control))
+               /* this is not from AP */
+               return RX_CONTINUE;
+
+       if (!ieee80211_is_data(hdr->frame_control))
+               return RX_CONTINUE;
+
+       if (!ieee80211_has_moredata(hdr->frame_control)) {
+               /* AP has no more frames buffered for us */
+               local->pspolling = false;
+               return RX_CONTINUE;
+       }
 
-       sdata = sta->sdata;
+       /* more data bit is set, let's request a new frame from the AP */
+       ieee80211_send_pspoll(local, rx->sdata);
+
+       return RX_CONTINUE;
+}
+
+static void ap_sta_ps_start(struct sta_info *sta)
+{
+       struct ieee80211_sub_if_data *sdata = sta->sdata;
+       struct ieee80211_local *local = sdata->local;
 
        atomic_inc(&sdata->bss->num_sta_ps);
        set_and_clear_sta_flags(sta, WLAN_STA_PS, WLAN_STA_PSPOLL);
+       if (local->ops->sta_notify)
+               local->ops->sta_notify(local_to_hw(local), &sdata->vif,
+                                       STA_NOTIFY_SLEEP, &sta->sta);
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
-       printk(KERN_DEBUG "%s: STA %s aid %d enters power save mode\n",
-              dev->name, print_mac(mac, sta->addr), sta->aid);
+       printk(KERN_DEBUG "%s: STA %pM aid %d enters power save mode\n",
+              sdata->dev->name, sta->sta.addr, sta->sta.aid);
 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
 }
 
-static int ap_sta_ps_end(struct net_device *dev, struct sta_info *sta)
+static int ap_sta_ps_end(struct sta_info *sta)
 {
-       struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+       struct ieee80211_sub_if_data *sdata = sta->sdata;
+       struct ieee80211_local *local = sdata->local;
        struct sk_buff *skb;
        int sent = 0;
-       struct ieee80211_sub_if_data *sdata;
-       struct ieee80211_tx_info *info;
-       DECLARE_MAC_BUF(mac);
-
-       sdata = sta->sdata;
 
        atomic_dec(&sdata->bss->num_sta_ps);
 
        clear_sta_flags(sta, WLAN_STA_PS | WLAN_STA_PSPOLL);
+       if (local->ops->sta_notify)
+               local->ops->sta_notify(local_to_hw(local), &sdata->vif,
+                                       STA_NOTIFY_AWAKE, &sta->sta);
 
        if (!skb_queue_empty(&sta->ps_tx_buf))
                sta_info_clear_tim_bit(sta);
 
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
-       printk(KERN_DEBUG "%s: STA %s aid %d exits power save mode\n",
-              dev->name, print_mac(mac, sta->addr), sta->aid);
+       printk(KERN_DEBUG "%s: STA %pM aid %d exits power save mode\n",
+              sdata->dev->name, sta->sta.addr, sta->sta.aid);
 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
 
        /* Send all buffered frames to the station */
        while ((skb = skb_dequeue(&sta->tx_filtered)) != NULL) {
-               info = IEEE80211_SKB_CB(skb);
                sent++;
-               info->flags |= IEEE80211_TX_CTL_REQUEUE;
+               skb->requeue = 1;
                dev_queue_xmit(skb);
        }
        while ((skb = skb_dequeue(&sta->ps_tx_buf)) != NULL) {
-               info = IEEE80211_SKB_CB(skb);
                local->total_ps_buffered--;
                sent++;
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
-               printk(KERN_DEBUG "%s: STA %s aid %d send PS frame "
-                      "since STA not sleeping anymore\n", dev->name,
-                      print_mac(mac, sta->addr), sta->aid);
+               printk(KERN_DEBUG "%s: STA %pM aid %d send PS frame "
+                      "since STA not sleeping anymore\n", sdata->dev->name,
+                      sta->sta.addr, sta->sta.aid);
 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
-               info->flags |= IEEE80211_TX_CTL_REQUEUE;
+               skb->requeue = 1;
                dev_queue_xmit(skb);
        }
 
@@ -715,7 +828,6 @@ static ieee80211_rx_result debug_noinline
 ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
 {
        struct sta_info *sta = rx->sta;
-       struct net_device *dev = rx->dev;
        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
 
        if (!sta)
@@ -724,14 +836,14 @@ ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
        /* Update last_rx only for IBSS packets which are for the current
         * BSSID to avoid keeping the current IBSS network alive in cases where
         * other STAs are using different BSSID. */
-       if (rx->sdata->vif.type == IEEE80211_IF_TYPE_IBSS) {
+       if (rx->sdata->vif.type == NL80211_IFTYPE_ADHOC) {
                u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len,
-                                               IEEE80211_IF_TYPE_IBSS);
-               if (compare_ether_addr(bssid, rx->sdata->u.sta.bssid) == 0)
+                                               NL80211_IFTYPE_ADHOC);
+               if (compare_ether_addr(bssid, rx->sdata->u.ibss.bssid) == 0)
                        sta->last_rx = jiffies;
        } else
        if (!is_multicast_ether_addr(hdr->addr1) ||
-           rx->sdata->vif.type == IEEE80211_IF_TYPE_STA) {
+           rx->sdata->vif.type == NL80211_IFTYPE_STATION) {
                /* Update last_rx only for unicast frames in order to prevent
                 * the Probe Request frames (the only broadcast frames from a
                 * STA in infrastructure mode) from keeping a connection alive.
@@ -750,17 +862,29 @@ ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
        sta->last_qual = rx->status->qual;
        sta->last_noise = rx->status->noise;
 
+       /*
+        * Change STA power saving mode only at the end of a frame
+        * exchange sequence.
+        */
        if (!ieee80211_has_morefrags(hdr->frame_control) &&
-           (rx->sdata->vif.type == IEEE80211_IF_TYPE_AP ||
-            rx->sdata->vif.type == IEEE80211_IF_TYPE_VLAN)) {
-               /* Change STA power saving mode only in the end of a frame
-                * exchange sequence */
-               if (test_sta_flags(sta, WLAN_STA_PS) &&
-                   !ieee80211_has_pm(hdr->frame_control))
-                       rx->sent_ps_buffered += ap_sta_ps_end(dev, sta);
-               else if (!test_sta_flags(sta, WLAN_STA_PS) &&
-                        ieee80211_has_pm(hdr->frame_control))
-                       ap_sta_ps_start(dev, sta);
+           (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
+            rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)) {
+               if (test_sta_flags(sta, WLAN_STA_PS)) {
+                       /*
+                        * Ignore doze->wake transitions that are
+                        * indicated by non-data frames, the standard
+                        * is unclear here, but for example going to
+                        * PS mode and then scanning would cause a
+                        * doze->wake transition for the probe request,
+                        * and that is clearly undesirable.
+                        */
+                       if (ieee80211_is_data(hdr->frame_control) &&
+                           !ieee80211_has_pm(hdr->frame_control))
+                               rx->sent_ps_buffered += ap_sta_ps_end(sta);
+               } else {
+                       if (ieee80211_has_pm(hdr->frame_control))
+                               ap_sta_ps_start(sta);
+               }
        }
 
        /* Drop data::nullfunc frames silently, since they are used only to
@@ -794,15 +918,12 @@ ieee80211_reassemble_add(struct ieee80211_sub_if_data *sdata,
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
                struct ieee80211_hdr *hdr =
                        (struct ieee80211_hdr *) entry->skb_list.next->data;
-               DECLARE_MAC_BUF(mac);
-               DECLARE_MAC_BUF(mac2);
                printk(KERN_DEBUG "%s: RX reassembly removed oldest "
                       "fragment entry (idx=%d age=%lu seq=%d last_frag=%d "
-                      "addr1=%s addr2=%s\n",
+                      "addr1=%pM addr2=%pM\n",
                       sdata->dev->name, idx,
                       jiffies - entry->first_frag_time, entry->seq,
-                      entry->last_frag, print_mac(mac, hdr->addr1),
-                      print_mac(mac2, hdr->addr2));
+                      entry->last_frag, hdr->addr1, hdr->addr2);
 #endif
                __skb_queue_purge(&entry->skb_list);
        }
@@ -871,7 +992,6 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
        unsigned int frag, seq;
        struct ieee80211_fragment_entry *entry;
        struct sk_buff *skb;
-       DECLARE_MAC_BUF(mac);
 
        hdr = (struct ieee80211_hdr *)rx->skb->data;
        fc = hdr->frame_control;
@@ -975,15 +1095,14 @@ ieee80211_rx_h_ps_poll(struct ieee80211_rx_data *rx)
        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(rx->dev);
        struct sk_buff *skb;
        int no_pending_pkts;
-       DECLARE_MAC_BUF(mac);
        __le16 fc = ((struct ieee80211_hdr *)rx->skb->data)->frame_control;
 
        if (likely(!rx->sta || !ieee80211_is_pspoll(fc) ||
                   !(rx->flags & IEEE80211_RX_RA_MATCH)))
                return RX_CONTINUE;
 
-       if ((sdata->vif.type != IEEE80211_IF_TYPE_AP) &&
-           (sdata->vif.type != IEEE80211_IF_TYPE_VLAN))
+       if ((sdata->vif.type != NL80211_IFTYPE_AP) &&
+           (sdata->vif.type != NL80211_IFTYPE_AP_VLAN))
                return RX_DROP_UNUSABLE;
 
        skb = skb_dequeue(&rx->sta->tx_filtered);
@@ -1006,8 +1125,8 @@ ieee80211_rx_h_ps_poll(struct ieee80211_rx_data *rx)
                set_sta_flags(rx->sta, WLAN_STA_PSPOLL);
 
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
-               printk(KERN_DEBUG "STA %s aid %d: PS Poll (entries after %d)\n",
-                      print_mac(mac, rx->sta->addr), rx->sta->aid,
+               printk(KERN_DEBUG "STA %pM aid %d: PS Poll (entries after %d)\n",
+                      rx->sta->sta.addr, rx->sta->sta.aid,
                       skb_queue_len(&rx->sta->ps_tx_buf));
 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
 
@@ -1030,9 +1149,9 @@ ieee80211_rx_h_ps_poll(struct ieee80211_rx_data *rx)
                 *        Should we send it a null-func frame indicating we
                 *        have nothing buffered for it?
                 */
-               printk(KERN_DEBUG "%s: STA %s sent PS Poll even "
+               printk(KERN_DEBUG "%s: STA %pM sent PS Poll even "
                       "though there are no buffered frames for it\n",
-                      rx->dev->name, print_mac(mac, rx->sta->addr));
+                      rx->dev->name, rx->sta->sta.addr);
 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
        }
 
@@ -1085,6 +1204,15 @@ ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc)
        /* Drop unencrypted frames if key is set. */
        if (unlikely(!ieee80211_has_protected(fc) &&
                     !ieee80211_is_nullfunc(fc) &&
+                    (!ieee80211_is_mgmt(fc) ||
+                     (ieee80211_is_unicast_robust_mgmt_frame(rx->skb) &&
+                      rx->sta && test_sta_flags(rx->sta, WLAN_STA_MFP))) &&
+                    (rx->key || rx->sdata->drop_unencrypted)))
+               return -EACCES;
+       /* BIP does not use Protected field, so need to check MMIE */
+       if (unlikely(rx->sta && test_sta_flags(rx->sta, WLAN_STA_MFP) &&
+                    ieee80211_is_multicast_robust_mgmt_frame(rx->skb) &&
+                    ieee80211_get_mmie_keyidx(rx->skb) < 0 &&
                     (rx->key || rx->sdata->drop_unencrypted)))
                return -EACCES;
 
@@ -1102,20 +1230,12 @@ ieee80211_data_to_8023(struct ieee80211_rx_data *rx)
        u8 src[ETH_ALEN] __aligned(2);
        struct sk_buff *skb = rx->skb;
        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-       DECLARE_MAC_BUF(mac);
-       DECLARE_MAC_BUF(mac2);
-       DECLARE_MAC_BUF(mac3);
-       DECLARE_MAC_BUF(mac4);
 
        if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
                return -1;
 
        hdrlen = ieee80211_hdrlen(hdr->frame_control);
 
-       if (ieee80211_vif_is_mesh(&sdata->vif))
-               hdrlen += ieee80211_get_mesh_hdrlen(
-                               (struct ieee80211s_hdr *) (skb->data + hdrlen));
-
        /* convert IEEE 802.11 header + possible LLC headers into Ethernet
         * header
         * IEEE 802.11 address fields:
@@ -1130,24 +1250,33 @@ ieee80211_data_to_8023(struct ieee80211_rx_data *rx)
 
        switch (hdr->frame_control &
                cpu_to_le16(IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) {
-       case __constant_cpu_to_le16(IEEE80211_FCTL_TODS):
-               if (unlikely(sdata->vif.type != IEEE80211_IF_TYPE_AP &&
-                            sdata->vif.type != IEEE80211_IF_TYPE_VLAN))
+       case cpu_to_le16(IEEE80211_FCTL_TODS):
+               if (unlikely(sdata->vif.type != NL80211_IFTYPE_AP &&
+                            sdata->vif.type != NL80211_IFTYPE_AP_VLAN))
                        return -1;
                break;
-       case __constant_cpu_to_le16(IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS):
-               if (unlikely(sdata->vif.type != IEEE80211_IF_TYPE_WDS &&
-                            sdata->vif.type != IEEE80211_IF_TYPE_MESH_POINT))
+       case cpu_to_le16(IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS):
+               if (unlikely(sdata->vif.type != NL80211_IFTYPE_WDS &&
+                            sdata->vif.type != NL80211_IFTYPE_MESH_POINT))
                        return -1;
+               if (ieee80211_vif_is_mesh(&sdata->vif)) {
+                       struct ieee80211s_hdr *meshdr = (struct ieee80211s_hdr *)
+                               (skb->data + hdrlen);
+                       hdrlen += ieee80211_get_mesh_hdrlen(meshdr);
+                       if (meshdr->flags & MESH_FLAGS_AE_A5_A6) {
+                               memcpy(dst, meshdr->eaddr1, ETH_ALEN);
+                               memcpy(src, meshdr->eaddr2, ETH_ALEN);
+                       }
+               }
                break;
-       case __constant_cpu_to_le16(IEEE80211_FCTL_FROMDS):
-               if (sdata->vif.type != IEEE80211_IF_TYPE_STA ||
+       case cpu_to_le16(IEEE80211_FCTL_FROMDS):
+               if (sdata->vif.type != NL80211_IFTYPE_STATION ||
                    (is_multicast_ether_addr(dst) &&
                     !compare_ether_addr(src, dev->dev_addr)))
                        return -1;
                break;
-       case __constant_cpu_to_le16(0):
-               if (sdata->vif.type != IEEE80211_IF_TYPE_IBSS)
+       case cpu_to_le16(0):
+               if (sdata->vif.type != NL80211_IFTYPE_ADHOC)
                        return -1;
                break;
        }
@@ -1221,8 +1350,9 @@ ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
        skb = rx->skb;
        xmit_skb = NULL;
 
-       if (local->bridge_packets && (sdata->vif.type == IEEE80211_IF_TYPE_AP ||
-                                     sdata->vif.type == IEEE80211_IF_TYPE_VLAN) &&
+       if ((sdata->vif.type == NL80211_IFTYPE_AP ||
+            sdata->vif.type == NL80211_IFTYPE_AP_VLAN) &&
+           !(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) &&
            (rx->flags & IEEE80211_RX_RA_MATCH)) {
                if (is_multicast_ether_addr(ehdr->h_dest)) {
                        /*
@@ -1249,10 +1379,37 @@ ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
        }
 
        if (skb) {
-               /* deliver to local stack */
-               skb->protocol = eth_type_trans(skb, dev);
-               memset(skb->cb, 0, sizeof(skb->cb));
-               netif_rx(skb);
+               int align __maybe_unused;
+
+#if defined(CONFIG_MAC80211_DEBUG_PACKET_ALIGNMENT) || !defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS)
+               /*
+                * 'align' will only take the values 0 or 2 here
+                * since all frames are required to be aligned
+                * to 2-byte boundaries when being passed to
+                * mac80211. That also explains the __skb_push()
+                * below.
+                */
+               align = (unsigned long)skb->data & 4;
+               if (align) {
+                       if (WARN_ON(skb_headroom(skb) < 3)) {
+                               dev_kfree_skb(skb);
+                               skb = NULL;
+                       } else {
+                               u8 *data = skb->data;
+                               size_t len = skb->len;
+                               u8 *new = __skb_push(skb, align);
+                               memmove(new, data, len);
+                               __skb_trim(skb, len);
+                       }
+               }
+#endif
+
+               if (skb) {
+                       /* deliver to local stack */
+                       skb->protocol = eth_type_trans(skb, dev);
+                       memset(skb->cb, 0, sizeof(skb->cb));
+                       netif_rx(skb);
+               }
        }
 
        if (xmit_skb) {
@@ -1278,7 +1435,6 @@ ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
        int remaining, err;
        u8 dst[ETH_ALEN];
        u8 src[ETH_ALEN];
-       DECLARE_MAC_BUF(mac);
 
        if (unlikely(!ieee80211_is_data(fc)))
                return RX_CONTINUE;
@@ -1322,14 +1478,20 @@ ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
                if (remaining <= subframe_len + padding)
                        frame = skb;
                else {
-                       frame = dev_alloc_skb(local->hw.extra_tx_headroom +
-                                             subframe_len);
+                       /*
+                        * Allocate and reserve two bytes more for payload
+                        * alignment since sizeof(struct ethhdr) is 14.
+                        */
+                       frame = dev_alloc_skb(
+                               ALIGN(local->hw.extra_tx_headroom, 4) +
+                               subframe_len + 2);
 
                        if (frame == NULL)
                                return RX_DROP_UNUSABLE;
 
-                       skb_reserve(frame, local->hw.extra_tx_headroom +
-                                   sizeof(struct ethhdr));
+                       skb_reserve(frame,
+                                   ALIGN(local->hw.extra_tx_headroom, 4) +
+                                   sizeof(struct ethhdr) + 2);
                        memcpy(skb_put(frame, ntohs(len)), skb->data,
                                ntohs(len));
 
@@ -1378,7 +1540,8 @@ ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
        return RX_QUEUED;
 }
 
-static ieee80211_rx_result debug_noinline
+#ifdef CONFIG_MAC80211_MESH
+static ieee80211_rx_result
 ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
 {
        struct ieee80211_hdr *hdr;
@@ -1397,6 +1560,25 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
                /* illegal frame */
                return RX_DROP_MONITOR;
 
+       if (mesh_hdr->flags & MESH_FLAGS_AE_A5_A6){
+               struct ieee80211_sub_if_data *sdata;
+               struct mesh_path *mppath;
+
+               sdata = IEEE80211_DEV_TO_SUB_IF(rx->dev);
+               rcu_read_lock();
+               mppath = mpp_path_lookup(mesh_hdr->eaddr2, sdata);
+               if (!mppath) {
+                       mpp_path_add(mesh_hdr->eaddr2, hdr->addr4, sdata);
+               } else {
+                       spin_lock_bh(&mppath->state_lock);
+                       mppath->exp_time = jiffies;
+                       if (compare_ether_addr(mppath->mpp, hdr->addr4) != 0)
+                               memcpy(mppath->mpp, hdr->addr4, ETH_ALEN);
+                       spin_unlock_bh(&mppath->state_lock);
+               }
+               rcu_read_unlock();
+       }
+
        if (compare_ether_addr(rx->dev->dev_addr, hdr->addr3) == 0)
                return RX_CONTINUE;
 
@@ -1433,7 +1615,7 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
        else
                return RX_DROP_MONITOR;
 }
-
+#endif
 
 static ieee80211_rx_result debug_noinline
 ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
@@ -1492,11 +1674,9 @@ ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx)
                start_seq_num = le16_to_cpu(bar->start_seq_num) >> 4;
 
                /* reset session timer */
-               if (tid_agg_rx->timeout) {
-                       unsigned long expires =
-                               jiffies + (tid_agg_rx->timeout / 1000) * HZ;
-                       mod_timer(&tid_agg_rx->session_timer, expires);
-               }
+               if (tid_agg_rx->timeout)
+                       mod_timer(&tid_agg_rx->session_timer,
+                                 TU_TO_EXP_TIME(tid_agg_rx->timeout));
 
                /* manage reordering buffer according to requested */
                /* sequence number */
@@ -1510,12 +1690,64 @@ ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx)
        return RX_CONTINUE;
 }
 
+static void ieee80211_process_sa_query_req(struct ieee80211_sub_if_data *sdata,
+                                          struct ieee80211_mgmt *mgmt,
+                                          size_t len)
+{
+       struct ieee80211_local *local = sdata->local;
+       struct sk_buff *skb;
+       struct ieee80211_mgmt *resp;
+
+       if (compare_ether_addr(mgmt->da, sdata->dev->dev_addr) != 0) {
+               /* Not to own unicast address */
+               return;
+       }
+
+       if (compare_ether_addr(mgmt->sa, sdata->u.mgd.bssid) != 0 ||
+           compare_ether_addr(mgmt->bssid, sdata->u.mgd.bssid) != 0) {
+               /* Not from the current AP. */
+               return;
+       }
+
+       if (sdata->u.mgd.state == IEEE80211_STA_MLME_ASSOCIATE) {
+               /* Association in progress; ignore SA Query */
+               return;
+       }
+
+       if (len < 24 + 1 + sizeof(resp->u.action.u.sa_query)) {
+               /* Too short SA Query request frame */
+               return;
+       }
+
+       skb = dev_alloc_skb(sizeof(*resp) + local->hw.extra_tx_headroom);
+       if (skb == NULL)
+               return;
+
+       skb_reserve(skb, local->hw.extra_tx_headroom);
+       resp = (struct ieee80211_mgmt *) skb_put(skb, 24);
+       memset(resp, 0, 24);
+       memcpy(resp->da, mgmt->sa, ETH_ALEN);
+       memcpy(resp->sa, sdata->dev->dev_addr, ETH_ALEN);
+       memcpy(resp->bssid, sdata->u.mgd.bssid, ETH_ALEN);
+       resp->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
+                                         IEEE80211_STYPE_ACTION);
+       skb_put(skb, 1 + sizeof(resp->u.action.u.sa_query));
+       resp->u.action.category = WLAN_CATEGORY_SA_QUERY;
+       resp->u.action.u.sa_query.action = WLAN_ACTION_SA_QUERY_RESPONSE;
+       memcpy(resp->u.action.u.sa_query.trans_id,
+              mgmt->u.action.u.sa_query.trans_id,
+              WLAN_SA_QUERY_TR_ID_LEN);
+
+       ieee80211_tx_skb(sdata, skb, 1);
+}
+
 static ieee80211_rx_result debug_noinline
 ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
 {
        struct ieee80211_local *local = rx->local;
        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(rx->dev);
        struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
+       struct ieee80211_bss *bss;
        int len = rx->skb->len;
 
        if (!ieee80211_is_action(mgmt->frame_control))
@@ -1527,20 +1759,26 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
        if (!(rx->flags & IEEE80211_RX_RA_MATCH))
                return RX_DROP_MONITOR;
 
-       /* all categories we currently handle have action_code */
-       if (len < IEEE80211_MIN_ACTION_SIZE + 1)
+       if (ieee80211_drop_unencrypted(rx, mgmt->frame_control))
                return RX_DROP_MONITOR;
 
-       /*
-        * FIXME: revisit this, I'm sure we should handle most
-        *        of these frames in other modes as well!
-        */
-       if (sdata->vif.type != IEEE80211_IF_TYPE_STA &&
-           sdata->vif.type != IEEE80211_IF_TYPE_IBSS)
+       /* all categories we currently handle have action_code */
+       if (len < IEEE80211_MIN_ACTION_SIZE + 1)
                return RX_DROP_MONITOR;
 
        switch (mgmt->u.action.category) {
        case WLAN_CATEGORY_BACK:
+               /*
+                * The aggregation code is not prepared to handle
+                * anything but STA/AP due to the BSSID handling;
+                * IBSS could work in the code but isn't supported
+                * by drivers or the standard.
+                */
+               if (sdata->vif.type != NL80211_IFTYPE_STATION &&
+                   sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
+                   sdata->vif.type != NL80211_IFTYPE_AP)
+                       return RX_DROP_MONITOR;
+
                switch (mgmt->u.action.u.addba_req.action_code) {
                case WLAN_ACTION_ADDBA_REQ:
                        if (len < (IEEE80211_MIN_ACTION_SIZE +
@@ -1565,6 +1803,10 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
        case WLAN_CATEGORY_SPECTRUM_MGMT:
                if (local->hw.conf.channel->band != IEEE80211_BAND_5GHZ)
                        return RX_DROP_MONITOR;
+
+               if (sdata->vif.type != NL80211_IFTYPE_STATION)
+                       return RX_DROP_MONITOR;
+
                switch (mgmt->u.action.u.measurement.action_code) {
                case WLAN_ACTION_SPCT_MSR_REQ:
                        if (len < (IEEE80211_MIN_ACTION_SIZE +
@@ -1572,6 +1814,43 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
                                return RX_DROP_MONITOR;
                        ieee80211_process_measurement_req(sdata, mgmt, len);
                        break;
+               case WLAN_ACTION_SPCT_CHL_SWITCH:
+                       if (len < (IEEE80211_MIN_ACTION_SIZE +
+                                  sizeof(mgmt->u.action.u.chan_switch)))
+                               return RX_DROP_MONITOR;
+
+                       if (memcmp(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN))
+                               return RX_DROP_MONITOR;
+
+                       bss = ieee80211_rx_bss_get(local, sdata->u.mgd.bssid,
+                                          local->hw.conf.channel->center_freq,
+                                          sdata->u.mgd.ssid,
+                                          sdata->u.mgd.ssid_len);
+                       if (!bss)
+                               return RX_DROP_MONITOR;
+
+                       ieee80211_process_chanswitch(sdata,
+                                    &mgmt->u.action.u.chan_switch.sw_elem, bss);
+                       ieee80211_rx_bss_put(local, bss);
+                       break;
+               }
+               break;
+       case WLAN_CATEGORY_SA_QUERY:
+               if (len < (IEEE80211_MIN_ACTION_SIZE +
+                          sizeof(mgmt->u.action.u.sa_query)))
+                       return RX_DROP_MONITOR;
+               switch (mgmt->u.action.u.sa_query.action) {
+               case WLAN_ACTION_SA_QUERY_REQUEST:
+                       if (sdata->vif.type != NL80211_IFTYPE_STATION)
+                               return RX_DROP_MONITOR;
+                       ieee80211_process_sa_query_req(sdata, mgmt, len);
+                       break;
+               case WLAN_ACTION_SA_QUERY_RESPONSE:
+                       /*
+                        * SA Query response is currently only used in AP mode
+                        * and it is processed in user space.
+                        */
+                       return RX_CONTINUE;
                }
                break;
        default:
@@ -1587,22 +1866,29 @@ static ieee80211_rx_result debug_noinline
 ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
 {
        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(rx->dev);
+       struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
 
        if (!(rx->flags & IEEE80211_RX_RA_MATCH))
                return RX_DROP_MONITOR;
 
+       if (ieee80211_drop_unencrypted(rx, mgmt->frame_control))
+               return RX_DROP_MONITOR;
+
        if (ieee80211_vif_is_mesh(&sdata->vif))
                return ieee80211_mesh_rx_mgmt(sdata, rx->skb, rx->status);
 
-       if (sdata->vif.type != IEEE80211_IF_TYPE_STA &&
-           sdata->vif.type != IEEE80211_IF_TYPE_IBSS)
+       if (sdata->vif.type != NL80211_IFTYPE_STATION &&
+           sdata->vif.type != NL80211_IFTYPE_ADHOC)
                return RX_DROP_MONITOR;
 
-       if (sdata->flags & IEEE80211_SDATA_USERSPACE_MLME)
-               return RX_DROP_MONITOR;
 
-       ieee80211_sta_rx_mgmt(sdata, rx->skb, rx->status);
-       return RX_QUEUED;
+       if (sdata->vif.type == NL80211_IFTYPE_STATION) {
+               if (sdata->flags & IEEE80211_SDATA_USERSPACE_MLME)
+                       return RX_DROP_MONITOR;
+               return ieee80211_sta_rx_mgmt(sdata, rx->skb, rx->status);
+       }
+
+       return ieee80211_ibss_rx_mgmt(sdata, rx->skb, rx->status);
 }
 
 static void ieee80211_rx_michael_mic_report(struct net_device *dev,
@@ -1611,8 +1897,6 @@ static void ieee80211_rx_michael_mic_report(struct net_device *dev,
 {
        int keyidx;
        unsigned int hdrlen;
-       DECLARE_MAC_BUF(mac);
-       DECLARE_MAC_BUF(mac2);
 
        hdrlen = ieee80211_hdrlen(hdr->frame_control);
        if (rx->skb->len >= hdrlen + 4)
@@ -1631,7 +1915,7 @@ static void ieee80211_rx_michael_mic_report(struct net_device *dev,
        if (!ieee80211_has_protected(hdr->frame_control))
                goto ignore;
 
-       if (rx->sdata->vif.type == IEEE80211_IF_TYPE_AP && keyidx) {
+       if (rx->sdata->vif.type == NL80211_IFTYPE_AP && keyidx) {
                /*
                 * APs with pairwise keys should never receive Michael MIC
                 * errors for non-zero keyidx because these are reserved for
@@ -1701,7 +1985,7 @@ static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx)
                if (!netif_running(sdata->dev))
                        continue;
 
-               if (sdata->vif.type != IEEE80211_IF_TYPE_MNTR ||
+               if (sdata->vif.type != NL80211_IFTYPE_MONITOR ||
                    !(sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES))
                        continue;
 
@@ -1753,6 +2037,7 @@ static void ieee80211_invoke_rx_handlers(struct ieee80211_sub_if_data *sdata,
        CALL_RXH(ieee80211_rx_h_passive_scan)
        CALL_RXH(ieee80211_rx_h_check)
        CALL_RXH(ieee80211_rx_h_decrypt)
+       CALL_RXH(ieee80211_rx_h_check_more_data)
        CALL_RXH(ieee80211_rx_h_sta_process)
        CALL_RXH(ieee80211_rx_h_defragment)
        CALL_RXH(ieee80211_rx_h_ps_poll)
@@ -1760,8 +2045,10 @@ static void ieee80211_invoke_rx_handlers(struct ieee80211_sub_if_data *sdata,
        /* must be after MMIC verify so header is counted in MPDU mic */
        CALL_RXH(ieee80211_rx_h_remove_qos_control)
        CALL_RXH(ieee80211_rx_h_amsdu)
+#ifdef CONFIG_MAC80211_MESH
        if (ieee80211_vif_is_mesh(&sdata->vif))
                CALL_RXH(ieee80211_rx_h_mesh_fwding);
+#endif
        CALL_RXH(ieee80211_rx_h_data)
        CALL_RXH(ieee80211_rx_h_ctrl)
        CALL_RXH(ieee80211_rx_h_action)
@@ -1794,16 +2081,17 @@ static void ieee80211_invoke_rx_handlers(struct ieee80211_sub_if_data *sdata,
 /* main receive path */
 
 static int prepare_for_handlers(struct ieee80211_sub_if_data *sdata,
-                               u8 *bssid, struct ieee80211_rx_data *rx,
+                               struct ieee80211_rx_data *rx,
                                struct ieee80211_hdr *hdr)
 {
+       u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len, sdata->vif.type);
        int multicast = is_multicast_ether_addr(hdr->addr1);
 
        switch (sdata->vif.type) {
-       case IEEE80211_IF_TYPE_STA:
+       case NL80211_IFTYPE_STATION:
                if (!bssid)
                        return 0;
-               if (!ieee80211_bssid_match(bssid, sdata->u.sta.bssid)) {
+               if (!ieee80211_bssid_match(bssid, sdata->u.mgd.bssid)) {
                        if (!(rx->flags & IEEE80211_RX_IN_SCAN))
                                return 0;
                        rx->flags &= ~IEEE80211_RX_RA_MATCH;
@@ -1815,13 +2103,13 @@ static int prepare_for_handlers(struct ieee80211_sub_if_data *sdata,
                        rx->flags &= ~IEEE80211_RX_RA_MATCH;
                }
                break;
-       case IEEE80211_IF_TYPE_IBSS:
+       case NL80211_IFTYPE_ADHOC:
                if (!bssid)
                        return 0;
                if (ieee80211_is_beacon(hdr->frame_control)) {
                        return 1;
                }
-               else if (!ieee80211_bssid_match(bssid, sdata->u.sta.bssid)) {
+               else if (!ieee80211_bssid_match(bssid, sdata->u.ibss.bssid)) {
                        if (!(rx->flags & IEEE80211_RX_IN_SCAN))
                                return 0;
                        rx->flags &= ~IEEE80211_RX_RA_MATCH;
@@ -1831,12 +2119,17 @@ static int prepare_for_handlers(struct ieee80211_sub_if_data *sdata,
                        if (!(sdata->dev->flags & IFF_PROMISC))
                                return 0;
                        rx->flags &= ~IEEE80211_RX_RA_MATCH;
-               } else if (!rx->sta)
-                       rx->sta = ieee80211_ibss_add_sta(sdata, rx->skb,
-                                               bssid, hdr->addr2,
-                                               BIT(rx->status->rate_idx));
+               } else if (!rx->sta) {
+                       int rate_idx;
+                       if (rx->status->flag & RX_FLAG_HT)
+                               rate_idx = 0; /* TODO: HT rates */
+                       else
+                               rate_idx = rx->status->rate_idx;
+                       rx->sta = ieee80211_ibss_add_sta(sdata, bssid, hdr->addr2,
+                               BIT(rate_idx));
+               }
                break;
-       case IEEE80211_IF_TYPE_MESH_POINT:
+       case NL80211_IFTYPE_MESH_POINT:
                if (!multicast &&
                    compare_ether_addr(sdata->dev->dev_addr,
                                       hdr->addr1) != 0) {
@@ -1846,8 +2139,8 @@ static int prepare_for_handlers(struct ieee80211_sub_if_data *sdata,
                        rx->flags &= ~IEEE80211_RX_RA_MATCH;
                }
                break;
-       case IEEE80211_IF_TYPE_VLAN:
-       case IEEE80211_IF_TYPE_AP:
+       case NL80211_IFTYPE_AP_VLAN:
+       case NL80211_IFTYPE_AP:
                if (!bssid) {
                        if (compare_ether_addr(sdata->dev->dev_addr,
                                               hdr->addr1))
@@ -1859,16 +2152,17 @@ static int prepare_for_handlers(struct ieee80211_sub_if_data *sdata,
                        rx->flags &= ~IEEE80211_RX_RA_MATCH;
                }
                break;
-       case IEEE80211_IF_TYPE_WDS:
+       case NL80211_IFTYPE_WDS:
                if (bssid || !ieee80211_is_data(hdr->frame_control))
                        return 0;
                if (compare_ether_addr(sdata->u.wds.remote_addr, hdr->addr2))
                        return 0;
                break;
-       case IEEE80211_IF_TYPE_MNTR:
+       case NL80211_IFTYPE_MONITOR:
                /* take everything */
                break;
-       case IEEE80211_IF_TYPE_INVALID:
+       case NL80211_IFTYPE_UNSPECIFIED:
+       case __NL80211_IFTYPE_AFTER_LAST:
                /* should never get here */
                WARN_ON(1);
                break;
@@ -1893,7 +2187,6 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
        int prepares;
        struct ieee80211_sub_if_data *prev = NULL;
        struct sk_buff *skb_new;
-       u8 *bssid;
 
        hdr = (struct ieee80211_hdr *)skb->data;
        memset(&rx, 0, sizeof(rx));
@@ -1917,11 +2210,11 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
                return;
        }
 
-       if (unlikely(local->sta_sw_scanning || local->sta_hw_scanning))
+       if (unlikely(local->sw_scanning || local->hw_scanning))
                rx.flags |= IEEE80211_RX_IN_SCAN;
 
        ieee80211_parse_qos(&rx);
-       ieee80211_verify_ip_alignment(&rx);
+       ieee80211_verify_alignment(&rx);
 
        skb = rx.skb;
 
@@ -1929,12 +2222,11 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
                if (!netif_running(sdata->dev))
                        continue;
 
-               if (sdata->vif.type == IEEE80211_IF_TYPE_MNTR)
+               if (sdata->vif.type == NL80211_IFTYPE_MONITOR)
                        continue;
 
-               bssid = ieee80211_get_bssid(hdr, skb->len, sdata->vif.type);
                rx.flags |= IEEE80211_RX_RA_MATCH;
-               prepares = prepare_for_handlers(sdata, bssid, &rx, hdr);
+               prepares = prepare_for_handlers(sdata, &rx, hdr);
 
                if (!prepares)
                        continue;
@@ -1978,17 +2270,17 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
 
 static inline int seq_less(u16 sq1, u16 sq2)
 {
-       return (((sq1 - sq2) & SEQ_MASK) > (SEQ_MODULO >> 1));
+       return ((sq1 - sq2) & SEQ_MASK) > (SEQ_MODULO >> 1);
 }
 
 static inline u16 seq_inc(u16 sq)
 {
-       return ((sq + 1) & SEQ_MASK);
+       return (sq + 1) & SEQ_MASK;
 }
 
 static inline u16 seq_sub(u16 sq1, u16 sq2)
 {
-       return ((sq1 - sq2) & SEQ_MASK);
+       return (sq1 - sq2) & SEQ_MASK;
 }
 
 
@@ -1996,10 +2288,11 @@ static inline u16 seq_sub(u16 sq1, u16 sq2)
  * As it function blongs to Rx path it must be called with
  * the proper rcu_read_lock protection for its flow.
  */
-u8 ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
-                               struct tid_ampdu_rx *tid_agg_rx,
-                               struct sk_buff *skb, u16 mpdu_seq_num,
-                               int bar_req)
+static u8 ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
+                                          struct tid_ampdu_rx *tid_agg_rx,
+                                          struct sk_buff *skb,
+                                          u16 mpdu_seq_num,
+                                          int bar_req)
 {
        struct ieee80211_local *local = hw_to_local(hw);
        struct ieee80211_rx_status status;
@@ -2038,7 +2331,13 @@ u8 ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
                                        tid_agg_rx->reorder_buf[index]->cb,
                                        sizeof(status));
                                sband = local->hw.wiphy->bands[status.band];
-                               rate = &sband->bitrates[status.rate_idx];
+                               if (status.flag & RX_FLAG_HT) {
+                                       /* TODO: HT rates */
+                                       rate = sband->bitrates;
+                               } else {
+                                       rate = &sband->bitrates
+                                               [status.rate_idx];
+                               }
                                __ieee80211_rx_handle_packet(hw,
                                        tid_agg_rx->reorder_buf[index],
                                        &status, rate);
@@ -2082,7 +2381,10 @@ u8 ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
                memcpy(&status, tid_agg_rx->reorder_buf[index]->cb,
                        sizeof(status));
                sband = local->hw.wiphy->bands[status.band];
-               rate = &sband->bitrates[status.rate_idx];
+               if (status.flag & RX_FLAG_HT)
+                       rate = sband->bitrates; /* TODO: HT rates */
+               else
+                       rate = &sband->bitrates[status.rate_idx];
                __ieee80211_rx_handle_packet(hw, tid_agg_rx->reorder_buf[index],
                                             &status, rate);
                tid_agg_rx->stored_mpdu_num--;
@@ -2129,16 +2431,14 @@ static u8 ieee80211_rx_reorder_ampdu(struct ieee80211_local *local,
        /* new un-ordered ampdu frame - process it */
 
        /* reset session timer */
-       if (tid_agg_rx->timeout) {
-               unsigned long expires =
-                       jiffies + (tid_agg_rx->timeout / 1000) * HZ;
-               mod_timer(&tid_agg_rx->session_timer, expires);
-       }
+       if (tid_agg_rx->timeout)
+               mod_timer(&tid_agg_rx->session_timer,
+                         TU_TO_EXP_TIME(tid_agg_rx->timeout));
 
        /* if this mpdu is fragmented - terminate rx aggregation session */
        sc = le16_to_cpu(hdr->seq_ctrl);
        if (sc & IEEE80211_SCTL_FRAG) {
-               ieee80211_sta_stop_rx_ba_session(sta->sdata, sta->addr,
+               ieee80211_sta_stop_rx_ba_session(sta->sdata, sta->sta.addr,
                        tid, 0, WLAN_REASON_QSTA_REQUIRE_SETUP);
                ret = 1;
                goto end_reorder;
@@ -2170,15 +2470,26 @@ void __ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb,
        }
 
        sband = local->hw.wiphy->bands[status->band];
-
-       if (!sband ||
-           status->rate_idx < 0 ||
-           status->rate_idx >= sband->n_bitrates) {
+       if (!sband) {
                WARN_ON(1);
                return;
        }
 
-       rate = &sband->bitrates[status->rate_idx];
+       if (status->flag & RX_FLAG_HT) {
+               /* rate_idx is MCS index */
+               if (WARN_ON(status->rate_idx < 0 ||
+                           status->rate_idx >= 76))
+                       return;
+               /* HT rates are not in the table - use the highest legacy rate
+                * for now since other parts of mac80211 may not yet be fully
+                * MCS aware. */
+               rate = &sband->bitrates[sband->n_bitrates - 1];
+       } else {
+               if (WARN_ON(status->rate_idx < 0 ||
+                           status->rate_idx >= sband->n_bitrates))
+                       return;
+               rate = &sband->bitrates[status->rate_idx];
+       }
 
        /*
         * key references and virtual interfaces are protected using RCU