+--- a/drivers/net/wireless/ath/ath9k/ar9003_mac.c
++++ b/drivers/net/wireless/ath/ath9k/ar9003_mac.c
+@@ -510,7 +510,11 @@ int ath9k_hw_process_rxdesc_edma(struct
+ */
+ if (rxsp->status11 & AR_CRCErr)
+ rxs->rs_status |= ATH9K_RXERR_CRC;
+- else if (rxsp->status11 & AR_PHYErr) {
++ else if (rxsp->status11 & AR_DecryptCRCErr)
++ rxs->rs_status |= ATH9K_RXERR_DECRYPT;
++ else if (rxsp->status11 & AR_MichaelErr)
++ rxs->rs_status |= ATH9K_RXERR_MIC;
++ if (rxsp->status11 & AR_PHYErr) {
+ phyerr = MS(rxsp->status11, AR_PHYErrCode);
+ /*
+ * If we reach a point here where AR_PostDelimCRCErr is
+@@ -532,11 +536,7 @@ int ath9k_hw_process_rxdesc_edma(struct
+ rxs->rs_status |= ATH9K_RXERR_PHY;
+ rxs->rs_phyerr = phyerr;
+ }
+-
+- } else if (rxsp->status11 & AR_DecryptCRCErr)
+- rxs->rs_status |= ATH9K_RXERR_DECRYPT;
+- else if (rxsp->status11 & AR_MichaelErr)
+- rxs->rs_status |= ATH9K_RXERR_MIC;
++ };
+ }
+
+ if (rxsp->status11 & AR_KeyMiss)
+--- a/drivers/net/wireless/ath/carl9170/tx.c
++++ b/drivers/net/wireless/ath/carl9170/tx.c
+@@ -1236,6 +1236,7 @@ static bool carl9170_tx_ps_drop(struct a
+ {
+ struct ieee80211_sta *sta;
+ struct carl9170_sta_info *sta_info;
++ struct ieee80211_tx_info *tx_info;
+
+ rcu_read_lock();
+ sta = __carl9170_get_tx_sta(ar, skb);
+@@ -1243,12 +1244,13 @@ static bool carl9170_tx_ps_drop(struct a
+ goto out_rcu;
+
+ sta_info = (void *) sta->drv_priv;
+- if (unlikely(sta_info->sleeping)) {
+- struct ieee80211_tx_info *tx_info;
++ tx_info = IEEE80211_SKB_CB(skb);
+
++ if (unlikely(sta_info->sleeping) &&
++ !(tx_info->flags & (IEEE80211_TX_CTL_NO_PS_BUFFER |
++ IEEE80211_TX_CTL_CLEAR_PS_FILT))) {
+ rcu_read_unlock();
+
+- tx_info = IEEE80211_SKB_CB(skb);
+ if (tx_info->flags & IEEE80211_TX_CTL_AMPDU)
+ atomic_dec(&ar->tx_ampdu_upload);
+
+--- a/drivers/net/wireless/iwlegacy/4965-mac.c
++++ b/drivers/net/wireless/iwlegacy/4965-mac.c
+@@ -1694,7 +1694,7 @@ il4965_tx_skb(struct il_priv *il, struct
+ sta_priv = (void *)sta->drv_priv;
+
+ if (sta_priv && sta_priv->asleep &&
+- (info->flags & IEEE80211_TX_CTL_POLL_RESPONSE)) {
++ (info->flags & IEEE80211_TX_CTL_NO_PS_BUFFER)) {
+ /*
+ * This sends an asynchronous command to the device,
+ * but we can rely on it being processed before the
+--- a/drivers/net/wireless/iwlwifi/iwl-agn-tx.c
++++ b/drivers/net/wireless/iwlwifi/iwl-agn-tx.c
+@@ -322,7 +322,7 @@ int iwlagn_tx_skb(struct iwl_priv *priv,
+ sta_priv = (void *)info->control.sta->drv_priv;
+
+ if (sta_priv && sta_priv->asleep &&
+- (info->flags & IEEE80211_TX_CTL_POLL_RESPONSE)) {
++ (info->flags & IEEE80211_TX_CTL_NO_PS_BUFFER)) {
+ /*
+ * This sends an asynchronous command to the device,
+ * but we can rely on it being processed before the
+@@ -331,6 +331,10 @@ int iwlagn_tx_skb(struct iwl_priv *priv,
+ * counter.
+ * For now set the counter to just 1 since we do not
+ * support uAPSD yet.
++ *
++ * FIXME: If we get two non-bufferable frames one
++ * after the other, we might only send out one of
++ * them because this is racy.
+ */
+ iwl_sta_modify_sleep_tx_count(priv, sta_id, 1);
+ }
+--- a/drivers/net/wireless/p54/txrx.c
++++ b/drivers/net/wireless/p54/txrx.c
+@@ -690,7 +690,7 @@ static void p54_tx_80211_header(struct p
+ if (!(info->flags & IEEE80211_TX_CTL_ASSIGN_SEQ))
+ *flags |= P54_HDR_FLAG_DATA_OUT_SEQNR;
+
+- if (info->flags & IEEE80211_TX_CTL_POLL_RESPONSE)
++ if (info->flags & IEEE80211_TX_CTL_NO_PS_BUFFER)
+ *flags |= P54_HDR_FLAG_DATA_OUT_NOCANCEL;
+
+ if (info->flags & IEEE80211_TX_CTL_CLEAR_PS_FILT)
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -341,9 +341,9 @@ struct ieee80211_bss_conf {
+ * used to indicate that a frame was already retried due to PS
+ * @IEEE80211_TX_INTFL_DONT_ENCRYPT: completely internal to mac80211,
+ * used to indicate frame should not be encrypted
+- * @IEEE80211_TX_CTL_POLL_RESPONSE: This frame is a response to a poll
+- * frame (PS-Poll or uAPSD) and should be sent although the station
+- * is in powersave mode.
++ * @IEEE80211_TX_CTL_NO_PS_BUFFER: This frame is a response to a poll
++ * frame (PS-Poll or uAPSD) or a non-bufferable MMPDU and must
++ * be sent although the station is in powersave mode.
+ * @IEEE80211_TX_CTL_MORE_FRAMES: More frames will be passed to the
+ * transmit function after the current frame, this can be used
+ * by drivers to kick the DMA queue only if unset or when the
+@@ -399,7 +399,7 @@ enum mac80211_tx_control_flags {
+ IEEE80211_TX_INTFL_NEED_TXPROCESSING = BIT(14),
+ IEEE80211_TX_INTFL_RETRIED = BIT(15),
+ IEEE80211_TX_INTFL_DONT_ENCRYPT = BIT(16),
+- IEEE80211_TX_CTL_POLL_RESPONSE = BIT(17),
++ IEEE80211_TX_CTL_NO_PS_BUFFER = BIT(17),
+ IEEE80211_TX_CTL_MORE_FRAMES = BIT(18),
+ IEEE80211_TX_INTFL_RETRANSMISSION = BIT(19),
+ /* hole at 20, use later */
+@@ -425,7 +425,7 @@ enum mac80211_tx_control_flags {
+ IEEE80211_TX_CTL_SEND_AFTER_DTIM | IEEE80211_TX_CTL_AMPDU | \
+ IEEE80211_TX_STAT_TX_FILTERED | IEEE80211_TX_STAT_ACK | \
+ IEEE80211_TX_STAT_AMPDU | IEEE80211_TX_STAT_AMPDU_NO_BACK | \
+- IEEE80211_TX_CTL_RATE_CTRL_PROBE | IEEE80211_TX_CTL_POLL_RESPONSE | \
++ IEEE80211_TX_CTL_RATE_CTRL_PROBE | IEEE80211_TX_CTL_NO_PS_BUFFER | \
+ IEEE80211_TX_CTL_MORE_FRAMES | IEEE80211_TX_CTL_LDPC | \
+ IEEE80211_TX_CTL_STBC | IEEE80211_TX_STATUS_EOSP)
+
+@@ -1634,7 +1634,7 @@ void ieee80211_free_txskb(struct ieee802
+ * the station sends a PS-Poll or a uAPSD trigger frame, mac80211
+ * will inform the driver of this with the @allow_buffered_frames
+ * callback; this callback is optional. mac80211 will then transmit
+- * the frames as usual and set the %IEEE80211_TX_CTL_POLL_RESPONSE
++ * the frames as usual and set the %IEEE80211_TX_CTL_NO_PS_BUFFER
+ * on each frame. The last frame in the service period (or the only
+ * response to a PS-Poll) also has %IEEE80211_TX_STATUS_EOSP set to
+ * indicate that it ends the service period; as this frame must have
+@@ -1642,6 +1642,9 @@ void ieee80211_free_txskb(struct ieee802
+ * When TX status is reported for this frame, the service period is
+ * marked has having ended and a new one can be started by the peer.
+ *
++ * Additionally, non-bufferable MMPDUs can also be transmitted by
++ * mac80211 with the %IEEE80211_TX_CTL_NO_PS_BUFFER set in them.
++ *
+ * Another race condition can happen on some devices like iwlwifi
+ * when there are frames queued for the station and it wakes up
+ * or polls; the frames that are already queued could end up being
+@@ -2140,7 +2143,7 @@ enum ieee80211_frame_release_type {
+ * @allow_buffered_frames: Prepare device to allow the given number of frames
+ * to go out to the given station. The frames will be sent by mac80211
+ * via the usual TX path after this call. The TX information for frames
+- * released will also have the %IEEE80211_TX_CTL_POLL_RESPONSE flag set
++ * released will also have the %IEEE80211_TX_CTL_NO_PS_BUFFER flag set
+ * and the last one will also have %IEEE80211_TX_STATUS_EOSP set. In case
+ * frames from multiple TIDs are released and the driver might reorder
+ * them between the TIDs, it must set the %IEEE80211_TX_STATUS_EOSP flag
--- a/net/mac80211/agg-rx.c
+++ b/net/mac80211/agg-rx.c
@@ -187,6 +187,8 @@ static void ieee80211_send_addba_resp(st
err_stop:
if (!local->open_count)
drv_stop(local);
-@@ -720,6 +696,70 @@ static void ieee80211_if_setup(struct ne
+@@ -722,6 +698,70 @@ static void ieee80211_if_setup(struct ne
dev->destructor = free_netdev;
}
static void ieee80211_iface_work(struct work_struct *work)
{
struct ieee80211_sub_if_data *sdata =
-@@ -824,6 +864,9 @@ static void ieee80211_iface_work(struct
+@@ -826,6 +866,9 @@ static void ieee80211_iface_work(struct
break;
ieee80211_mesh_rx_queued_mgmt(sdata, skb);
break;
break;
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
-@@ -2281,6 +2281,7 @@ ieee80211_rx_h_action(struct ieee80211_r
+@@ -2282,6 +2282,7 @@ ieee80211_rx_h_action(struct ieee80211_r
sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
sdata->vif.type != NL80211_IFTYPE_AP &&
sdata->vif.type != NL80211_IFTYPE_ADHOC)
break;
-@@ -2491,14 +2492,15 @@ ieee80211_rx_h_mgmt(struct ieee80211_rx_
+@@ -2492,14 +2493,15 @@ ieee80211_rx_h_mgmt(struct ieee80211_rx_
if (!ieee80211_vif_is_mesh(&sdata->vif) &&
sdata->vif.type != NL80211_IFTYPE_ADHOC &&
break;
case cpu_to_le16(IEEE80211_STYPE_ASSOC_RESP):
case cpu_to_le16(IEEE80211_STYPE_REASSOC_RESP):
-@@ -2852,10 +2854,16 @@ static int prepare_for_handlers(struct i
+@@ -2853,10 +2855,16 @@ static int prepare_for_handlers(struct i
}
break;
case NL80211_IFTYPE_WDS:
/* should never get here */
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
-@@ -1379,8 +1379,10 @@ int sta_info_move_state(struct sta_info
- return -EINVAL;
- }
+@@ -1050,7 +1050,7 @@ static void ieee80211_send_null_response
+ * exchange. Also set EOSP to indicate this packet
+ * ends the poll/service period.
+ */
+- info->flags |= IEEE80211_TX_CTL_POLL_RESPONSE |
++ info->flags |= IEEE80211_TX_CTL_NO_PS_BUFFER |
+ IEEE80211_TX_STATUS_EOSP |
+ IEEE80211_TX_CTL_REQ_TX_STATUS;
-+#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
- printk(KERN_DEBUG "%s: moving STA %pM to state %d\n",
- sta->sdata->name, sta->sta.addr, new_state);
-+#endif
+@@ -1177,7 +1177,7 @@ ieee80211_sta_ps_deliver_response(struct
+ * STA may still remain is PS mode after this frame
+ * exchange.
+ */
+- info->flags |= IEEE80211_TX_CTL_POLL_RESPONSE;
++ info->flags |= IEEE80211_TX_CTL_NO_PS_BUFFER;
- /*
- * notify the driver before the actual changes so it can
+ /*
+ * Use MoreData flag to indicate whether there are
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -31,7 +31,6 @@
WLAN_STA_CLEAR_PS_FILT,
WLAN_STA_MFP,
WLAN_STA_BLOCK_BA,
---- a/net/mac80211/rate.h
-+++ b/net/mac80211/rate.h
-@@ -37,7 +37,7 @@ static inline void rate_control_tx_statu
- struct ieee80211_sta *ista = &sta->sta;
- void *priv_sta = sta->rate_ctrl_priv;
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -448,18 +448,23 @@ ieee80211_tx_h_unicast_ps_buf(struct iee
+ struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
+ struct ieee80211_local *local = tx->local;
+
+- if (unlikely(!sta ||
+- ieee80211_is_probe_resp(hdr->frame_control) ||
+- ieee80211_is_auth(hdr->frame_control) ||
+- ieee80211_is_assoc_resp(hdr->frame_control) ||
+- ieee80211_is_reassoc_resp(hdr->frame_control)))
++ if (unlikely(!sta))
+ return TX_CONTINUE;
+
+ if (unlikely((test_sta_flag(sta, WLAN_STA_PS_STA) ||
+ test_sta_flag(sta, WLAN_STA_PS_DRIVER)) &&
+- !(info->flags & IEEE80211_TX_CTL_POLL_RESPONSE))) {
++ !(info->flags & IEEE80211_TX_CTL_NO_PS_BUFFER))) {
+ int ac = skb_get_queue_mapping(tx->skb);
+
++ /* only deauth, disassoc and action are bufferable MMPDUs */
++ if (ieee80211_is_mgmt(hdr->frame_control) &&
++ !ieee80211_is_deauth(hdr->frame_control) &&
++ !ieee80211_is_disassoc(hdr->frame_control) &&
++ !ieee80211_is_action(hdr->frame_control)) {
++ info->flags |= IEEE80211_TX_CTL_NO_PS_BUFFER;
++ return TX_CONTINUE;
++ }
++
+ #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
+ printk(KERN_DEBUG "STA %pM aid %d: PS buffer for AC %d\n",
+ sta->sta.addr, sta->sta.aid, ac);
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -480,7 +480,7 @@ struct ieee80211_if_ibss {
-- if (!ref)
-+ if (!ref || !test_sta_flag(sta, WLAN_STA_RATE_CONTROL))
- return;
+ bool control_port;
- ref->ops->tx_status(ref->priv, sband, ista, priv_sta, skb);
+- u8 bssid[ETH_ALEN];
++ u8 bssid[ETH_ALEN] __aligned(2);
+ u8 ssid[IEEE80211_MAX_SSID_LEN];
+ u8 ssid_len, ie_len;
+ u8 *ie;