ipv4: flush route cache after change accept_local
[linux-2.6.git] / net / mac80211 / work.c
index 0acea7c..7737f20 100644 (file)
 #include <linux/if_arp.h>
 #include <linux/etherdevice.h>
 #include <linux/crc32.h>
+#include <linux/slab.h>
 #include <net/mac80211.h>
 #include <asm/unaligned.h>
 
 #include "ieee80211_i.h"
 #include "rate.h"
+#include "driver-ops.h"
 
 #define IEEE80211_AUTH_TIMEOUT (HZ / 5)
 #define IEEE80211_AUTH_MAX_TRIES 3
 #define IEEE80211_ASSOC_TIMEOUT (HZ / 5)
 #define IEEE80211_ASSOC_MAX_TRIES 3
-#define IEEE80211_MAX_PROBE_TRIES 5
 
 enum work_action {
+       WORK_ACT_MISMATCH,
        WORK_ACT_NONE,
        WORK_ACT_TIMEOUT,
        WORK_ACT_DONE,
@@ -41,7 +43,7 @@ enum work_action {
 /* utils */
 static inline void ASSERT_WORK_MTX(struct ieee80211_local *local)
 {
-       WARN_ON(!mutex_is_locked(&local->work_mtx));
+       lockdep_assert_held(&local->mtx);
 }
 
 /*
@@ -64,17 +66,9 @@ static void run_again(struct ieee80211_local *local,
                mod_timer(&local->work_timer, timeout);
 }
 
-static void work_free_rcu(struct rcu_head *head)
-{
-       struct ieee80211_work *wk =
-               container_of(head, struct ieee80211_work, rcu_head);
-
-       kfree(wk);
-}
-
 void free_work(struct ieee80211_work *wk)
 {
-       call_rcu(&wk->rcu_head, work_free_rcu);
+       kfree_rcu(wk, rcu_head);
 }
 
 static int ieee80211_compatible_rates(const u8 *supp_rates, int supp_rates_len,
@@ -124,12 +118,6 @@ static void ieee80211_add_ht_ie(struct sk_buff *skb, const u8 *ht_info_ie,
 
        /* determine capability flags */
 
-       if (ieee80211_disable_40mhz_24ghz &&
-           sband->band == IEEE80211_BAND_2GHZ) {
-               cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
-               cap &= ~IEEE80211_HT_CAP_SGI_40;
-       }
-
        switch (ht_info->ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
        case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
                if (flags & IEEE80211_CHAN_NO_HT40PLUS) {
@@ -202,25 +190,34 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata,
        struct ieee80211_local *local = sdata->local;
        struct sk_buff *skb;
        struct ieee80211_mgmt *mgmt;
-       u8 *pos;
-       const u8 *ies;
+       u8 *pos, qos_info;
        size_t offset = 0, noffset;
-       int i, len, count, rates_len, supp_rates_len;
+       int i, count, rates_len, supp_rates_len;
        u16 capab;
        struct ieee80211_supported_band *sband;
        u32 rates = 0;
 
        sband = local->hw.wiphy->bands[wk->chan->band];
 
-       /*
-        * Get all rates supported by the device and the AP as
-        * some APs don't like getting a superset of their rates
-        * in the association request (e.g. D-Link DAP 1353 in
-        * b-only mode)...
-        */
-       rates_len = ieee80211_compatible_rates(wk->assoc.supp_rates,
-                                              wk->assoc.supp_rates_len,
-                                              sband, &rates);
+       if (wk->assoc.supp_rates_len) {
+               /*
+                * Get all rates supported by the device and the AP as
+                * some APs don't like getting a superset of their rates
+                * in the association request (e.g. D-Link DAP 1353 in
+                * b-only mode)...
+                */
+               rates_len = ieee80211_compatible_rates(wk->assoc.supp_rates,
+                                                      wk->assoc.supp_rates_len,
+                                                      sband, &rates);
+       } else {
+               /*
+                * In case AP not provide any supported rates information
+                * before association, we send information element(s) with
+                * all rates that we support.
+                */
+               rates = ~0;
+               rates_len = sband->n_bitrates;
+       }
 
        skb = alloc_skb(local->hw.extra_tx_headroom +
                        sizeof(*mgmt) + /* bit too much but doesn't matter */
@@ -280,7 +277,7 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata,
        }
 
        /* SSID */
-       ies = pos = skb_put(skb, 2 + wk->assoc.ssid_len);
+       pos = skb_put(skb, 2 + wk->assoc.ssid_len);
        *pos++ = WLAN_EID_SSID;
        *pos++ = wk->assoc.ssid_len;
        memcpy(pos, wk->assoc.ssid, wk->assoc.ssid_len);
@@ -290,7 +287,6 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata,
        if (supp_rates_len > 8)
                supp_rates_len = 8;
 
-       len = sband->n_bitrates;
        pos = skb_put(skb, supp_rates_len + 2);
        *pos++ = WLAN_EID_SUPP_RATES;
        *pos++ = supp_rates_len;
@@ -375,6 +371,14 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata,
        }
 
        if (wk->assoc.wmm_used && local->hw.queues >= 4) {
+               if (wk->assoc.uapsd_used) {
+                       qos_info = local->uapsd_queues;
+                       qos_info |= (local->uapsd_max_sp_len <<
+                                    IEEE80211_WMM_IE_STA_QOSINFO_SP_SHIFT);
+               } else {
+                       qos_info = 0;
+               }
+
                pos = skb_put(skb, 9);
                *pos++ = WLAN_EID_VENDOR_SPECIFIC;
                *pos++ = 7; /* len */
@@ -384,7 +388,7 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata,
                *pos++ = 2; /* WME */
                *pos++ = 0; /* WME info */
                *pos++ = 1; /* WME ver */
-               *pos++ = 0;
+               *pos++ = qos_info;
        }
 
        /* add any remaining custom (i.e. vendor specific here) IEs */
@@ -424,6 +428,14 @@ ieee80211_direct_probe(struct ieee80211_work *wk)
        struct ieee80211_sub_if_data *sdata = wk->sdata;
        struct ieee80211_local *local = sdata->local;
 
+       if (!wk->probe_auth.synced) {
+               int ret = drv_tx_sync(local, sdata, wk->filter_ta,
+                                     IEEE80211_TX_SYNC_AUTH);
+               if (ret)
+                       return WORK_ACT_TIMEOUT;
+       }
+       wk->probe_auth.synced = true;
+
        wk->probe_auth.tries++;
        if (wk->probe_auth.tries > IEEE80211_AUTH_MAX_TRIES) {
                printk(KERN_DEBUG "%s: direct probe to %pM timed out\n",
@@ -435,24 +447,20 @@ ieee80211_direct_probe(struct ieee80211_work *wk)
                 */
                ieee80211_remove_auth_bss(local, wk);
 
-               /*
-                * We might have a pending scan which had no chance to run yet
-                * due to work needing to be done. Hence, queue the STAs work
-                * again for that.
-                */
-               ieee80211_queue_work(&local->hw, &local->work_work);
                return WORK_ACT_TIMEOUT;
        }
 
-       printk(KERN_DEBUG "%s: direct probe to %pM (try %d)\n",
-                       sdata->name, wk->filter_ta, wk->probe_auth.tries);
+       printk(KERN_DEBUG "%s: direct probe to %pM (try %d/%i)\n",
+              sdata->name, wk->filter_ta, wk->probe_auth.tries,
+              IEEE80211_AUTH_MAX_TRIES);
 
        /*
         * Direct probe is sent to broadcast address as some APs
         * will not answer to direct packet in unassociated state.
         */
        ieee80211_send_probe_req(sdata, NULL, wk->probe_auth.ssid,
-                                wk->probe_auth.ssid_len, NULL, 0);
+                                wk->probe_auth.ssid_len, NULL, 0,
+                                (u32) -1, true);
 
        wk->timeout = jiffies + IEEE80211_AUTH_TIMEOUT;
        run_again(local, wk->timeout);
@@ -467,6 +475,14 @@ ieee80211_authenticate(struct ieee80211_work *wk)
        struct ieee80211_sub_if_data *sdata = wk->sdata;
        struct ieee80211_local *local = sdata->local;
 
+       if (!wk->probe_auth.synced) {
+               int ret = drv_tx_sync(local, sdata, wk->filter_ta,
+                                     IEEE80211_TX_SYNC_AUTH);
+               if (ret)
+                       return WORK_ACT_TIMEOUT;
+       }
+       wk->probe_auth.synced = true;
+
        wk->probe_auth.tries++;
        if (wk->probe_auth.tries > IEEE80211_AUTH_MAX_TRIES) {
                printk(KERN_DEBUG "%s: authentication with %pM"
@@ -478,12 +494,6 @@ ieee80211_authenticate(struct ieee80211_work *wk)
                 */
                ieee80211_remove_auth_bss(local, wk);
 
-               /*
-                * We might have a pending scan which had no chance to run yet
-                * due to work needing to be done. Hence, queue the STAs work
-                * again for that.
-                */
-               ieee80211_queue_work(&local->hw, &local->work_work);
                return WORK_ACT_TIMEOUT;
        }
 
@@ -506,6 +516,14 @@ ieee80211_associate(struct ieee80211_work *wk)
        struct ieee80211_sub_if_data *sdata = wk->sdata;
        struct ieee80211_local *local = sdata->local;
 
+       if (!wk->assoc.synced) {
+               int ret = drv_tx_sync(local, sdata, wk->filter_ta,
+                                     IEEE80211_TX_SYNC_ASSOC);
+               if (ret)
+                       return WORK_ACT_TIMEOUT;
+       }
+       wk->assoc.synced = true;
+
        wk->assoc.tries++;
        if (wk->assoc.tries > IEEE80211_ASSOC_MAX_TRIES) {
                printk(KERN_DEBUG "%s: association with %pM"
@@ -519,12 +537,6 @@ ieee80211_associate(struct ieee80211_work *wk)
                if (wk->assoc.bss)
                        cfg80211_unlink_bss(local->hw.wiphy, wk->assoc.bss);
 
-               /*
-                * We might have a pending scan which had no chance to run yet
-                * due to work needing to be done. Hence, queue the STAs work
-                * again for that.
-                */
-               ieee80211_queue_work(&local->hw, &local->work_work);
                return WORK_ACT_TIMEOUT;
        }
 
@@ -541,38 +553,55 @@ ieee80211_associate(struct ieee80211_work *wk)
 static enum work_action __must_check
 ieee80211_remain_on_channel_timeout(struct ieee80211_work *wk)
 {
-       struct ieee80211_sub_if_data *sdata = wk->sdata;
-       struct ieee80211_local *local = sdata->local;
-
        /*
         * First time we run, do nothing -- the generic code will
         * have switched to the right channel etc.
         */
-       if (wk->timeout != wk->remain.timeout) {
-               wk->timeout = wk->remain.timeout;
+       if (!wk->started) {
+               wk->timeout = jiffies + msecs_to_jiffies(wk->remain.duration);
+
+               cfg80211_ready_on_channel(wk->sdata->dev, (unsigned long) wk,
+                                         wk->chan, wk->chan_type,
+                                         wk->remain.duration, GFP_KERNEL);
+
                return WORK_ACT_NONE;
        }
 
-       /*
-        * We are done serving the remain-on-channel command; kill the work
-        * item to allow idle state to be entered again. In addition, clear the
-        * temporary channel information to allow operational channel to be
-        * used.
-        */
-       list_del(&wk->list);
-       free_work(wk);
+       return WORK_ACT_TIMEOUT;
+}
 
-       if (local->tmp_channel) {
-               cfg80211_remain_on_channel_expired(sdata->dev, (u64)wk,
-                                                  local->tmp_channel,
-                                                  local->tmp_channel_type,
-                                                  GFP_KERNEL);
+static enum work_action __must_check
+ieee80211_offchannel_tx(struct ieee80211_work *wk)
+{
+       if (!wk->started) {
+               wk->timeout = jiffies + msecs_to_jiffies(wk->offchan_tx.wait);
 
-               local->tmp_channel = NULL;
-               ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);
-               ieee80211_offchannel_return(local, true);
+               /*
+                * After this, offchan_tx.frame remains but now is no
+                * longer a valid pointer -- we still need it as the
+                * cookie for canceling this work/status matching.
+                */
+               ieee80211_tx_skb(wk->sdata, wk->offchan_tx.frame);
+
+               return WORK_ACT_NONE;
        }
 
+       return WORK_ACT_TIMEOUT;
+}
+
+static enum work_action __must_check
+ieee80211_assoc_beacon_wait(struct ieee80211_work *wk)
+{
+       if (wk->started)
+               return WORK_ACT_TIMEOUT;
+
+       /*
+        * Wait up to one beacon interval ...
+        * should this be more if we miss one?
+        */
+       printk(KERN_DEBUG "%s: waiting for beacon from %pM\n",
+              wk->sdata->name, wk->filter_ta);
+       wk->timeout = TU_TO_EXP_TIME(wk->assoc.bss->beacon_interval);
        return WORK_ACT_NONE;
 }
 
@@ -602,7 +631,7 @@ ieee80211_rx_mgmt_auth(struct ieee80211_work *wk,
        u16 auth_alg, auth_transaction, status_code;
 
        if (wk->type != IEEE80211_WORK_AUTH)
-               return WORK_ACT_NONE;
+               return WORK_ACT_MISMATCH;
 
        if (len < 24 + 6)
                return WORK_ACT_NONE;
@@ -653,6 +682,9 @@ ieee80211_rx_mgmt_assoc_resp(struct ieee80211_work *wk,
        struct ieee802_11_elems elems;
        u8 *pos;
 
+       if (wk->type != IEEE80211_WORK_ASSOC)
+               return WORK_ACT_MISMATCH;
+
        /*
         * AssocResp and ReassocResp have identical structure, so process both
         * of them in this function.
@@ -708,6 +740,12 @@ ieee80211_rx_mgmt_probe_resp(struct ieee80211_work *wk,
 
        ASSERT_WORK_MTX(local);
 
+       if (wk->type != IEEE80211_WORK_DIRECT_PROBE)
+               return WORK_ACT_MISMATCH;
+
+       if (len < 24 + 12)
+               return WORK_ACT_NONE;
+
        baselen = (u8 *) mgmt->u.probe_resp.variable - (u8 *) mgmt;
        if (baselen > len)
                return WORK_ACT_NONE;
@@ -716,6 +754,25 @@ ieee80211_rx_mgmt_probe_resp(struct ieee80211_work *wk,
        return WORK_ACT_DONE;
 }
 
+static enum work_action __must_check
+ieee80211_rx_mgmt_beacon(struct ieee80211_work *wk,
+                        struct ieee80211_mgmt *mgmt, size_t len)
+{
+       struct ieee80211_sub_if_data *sdata = wk->sdata;
+       struct ieee80211_local *local = sdata->local;
+
+       ASSERT_WORK_MTX(local);
+
+       if (wk->type != IEEE80211_WORK_ASSOC_BEACON_WAIT)
+               return WORK_ACT_MISMATCH;
+
+       if (len < 24 + 12)
+               return WORK_ACT_NONE;
+
+       printk(KERN_DEBUG "%s: beacon received\n", sdata->name);
+       return WORK_ACT_DONE;
+}
+
 static void ieee80211_work_rx_queued_mgmt(struct ieee80211_local *local,
                                          struct sk_buff *skb)
 {
@@ -729,7 +786,7 @@ static void ieee80211_work_rx_queued_mgmt(struct ieee80211_local *local,
        mgmt = (struct ieee80211_mgmt *) skb->data;
        fc = le16_to_cpu(mgmt->frame_control);
 
-       mutex_lock(&local->work_mtx);
+       mutex_lock(&local->mtx);
 
        list_for_each_entry(wk, &local->work_list, list) {
                const u8 *bssid = NULL;
@@ -738,6 +795,7 @@ static void ieee80211_work_rx_queued_mgmt(struct ieee80211_local *local,
                case IEEE80211_WORK_DIRECT_PROBE:
                case IEEE80211_WORK_AUTH:
                case IEEE80211_WORK_ASSOC:
+               case IEEE80211_WORK_ASSOC_BEACON_WAIT:
                        bssid = wk->filter_ta;
                        break;
                default:
@@ -752,6 +810,9 @@ static void ieee80211_work_rx_queued_mgmt(struct ieee80211_local *local,
                        continue;
 
                switch (fc & IEEE80211_FCTL_STYPE) {
+               case IEEE80211_STYPE_BEACON:
+                       rma = ieee80211_rx_mgmt_beacon(wk, mgmt, skb->len);
+                       break;
                case IEEE80211_STYPE_PROBE_RESP:
                        rma = ieee80211_rx_mgmt_probe_resp(wk, mgmt, skb->len,
                                                           rx_status);
@@ -769,7 +830,17 @@ static void ieee80211_work_rx_queued_mgmt(struct ieee80211_local *local,
                        break;
                default:
                        WARN_ON(1);
+                       rma = WORK_ACT_NONE;
                }
+
+               /*
+                * We've either received an unexpected frame, or we have
+                * multiple work items and need to match the frame to the
+                * right one.
+                */
+               if (rma == WORK_ACT_MISMATCH)
+                       continue;
+
                /*
                 * We've processed this frame for that work, so it can't
                 * belong to another work struct.
@@ -779,6 +850,9 @@ static void ieee80211_work_rx_queued_mgmt(struct ieee80211_local *local,
        }
 
        switch (rma) {
+       case WORK_ACT_MISMATCH:
+               /* ignore this unmatched frame */
+               break;
        case WORK_ACT_NONE:
                break;
        case WORK_ACT_DONE:
@@ -788,7 +862,7 @@ static void ieee80211_work_rx_queued_mgmt(struct ieee80211_local *local,
                WARN(1, "unexpected: %d", rma);
        }
 
-       mutex_unlock(&local->work_mtx);
+       mutex_unlock(&local->mtx);
 
        if (rma != WORK_ACT_DONE)
                goto out;
@@ -799,16 +873,54 @@ static void ieee80211_work_rx_queued_mgmt(struct ieee80211_local *local,
                break;
        case WORK_DONE_REQUEUE:
                synchronize_rcu();
-               wk->timeout = jiffies; /* run again directly */
-               mutex_lock(&local->work_mtx);
+               wk->started = false; /* restart */
+               mutex_lock(&local->mtx);
                list_add_tail(&wk->list, &local->work_list);
-               mutex_unlock(&local->work_mtx);
+               mutex_unlock(&local->mtx);
        }
 
  out:
        kfree_skb(skb);
 }
 
+static bool ieee80211_work_ct_coexists(enum nl80211_channel_type wk_ct,
+                                      enum nl80211_channel_type oper_ct)
+{
+       switch (wk_ct) {
+       case NL80211_CHAN_NO_HT:
+               return true;
+       case NL80211_CHAN_HT20:
+               if (oper_ct != NL80211_CHAN_NO_HT)
+                       return true;
+               return false;
+       case NL80211_CHAN_HT40MINUS:
+       case NL80211_CHAN_HT40PLUS:
+               return (wk_ct == oper_ct);
+       }
+       WARN_ON(1); /* shouldn't get here */
+       return false;
+}
+
+static enum nl80211_channel_type
+ieee80211_calc_ct(enum nl80211_channel_type wk_ct,
+                 enum nl80211_channel_type oper_ct)
+{
+       switch (wk_ct) {
+       case NL80211_CHAN_NO_HT:
+               return oper_ct;
+       case NL80211_CHAN_HT20:
+               if (oper_ct != NL80211_CHAN_NO_HT)
+                       return oper_ct;
+               return wk_ct;
+       case NL80211_CHAN_HT40MINUS:
+       case NL80211_CHAN_HT40PLUS:
+               return wk_ct;
+       }
+       WARN_ON(1); /* shouldn't get here */
+       return wk_ct;
+}
+
+
 static void ieee80211_work_timer(unsigned long data)
 {
        struct ieee80211_local *local = (void *) data;
@@ -827,13 +939,14 @@ static void ieee80211_work_work(struct work_struct *work)
        struct ieee80211_work *wk, *tmp;
        LIST_HEAD(free_work);
        enum work_action rma;
+       bool remain_off_channel = false;
 
        if (local->scanning)
                return;
 
        /*
         * ieee80211_queue_work() should have picked up most cases,
-        * here we'll pick the the rest.
+        * here we'll pick the rest.
         */
        if (WARN(local->suspended, "work scheduled while going to suspend\n"))
                return;
@@ -842,11 +955,76 @@ static void ieee80211_work_work(struct work_struct *work)
        while ((skb = skb_dequeue(&local->work_skb_queue)))
                ieee80211_work_rx_queued_mgmt(local, skb);
 
-       ieee80211_recalc_idle(local);
+       mutex_lock(&local->mtx);
 
-       mutex_lock(&local->work_mtx);
+       ieee80211_recalc_idle(local);
 
        list_for_each_entry_safe(wk, tmp, &local->work_list, list) {
+               bool started = wk->started;
+
+               /* mark work as started if it's on the current off-channel */
+               if (!started && local->tmp_channel &&
+                   wk->chan == local->tmp_channel &&
+                   wk->chan_type == local->tmp_channel_type) {
+                       started = true;
+                       wk->timeout = jiffies;
+               }
+
+               if (!started && !local->tmp_channel) {
+                       bool on_oper_chan;
+                       bool tmp_chan_changed = false;
+                       bool on_oper_chan2;
+                       enum nl80211_channel_type wk_ct;
+                       on_oper_chan = ieee80211_cfg_on_oper_channel(local);
+
+                       /* Work with existing channel type if possible. */
+                       wk_ct = wk->chan_type;
+                       if (wk->chan == local->hw.conf.channel)
+                               wk_ct = ieee80211_calc_ct(wk->chan_type,
+                                               local->hw.conf.channel_type);
+
+                       if (local->tmp_channel)
+                               if ((local->tmp_channel != wk->chan) ||
+                                   (local->tmp_channel_type != wk_ct))
+                                       tmp_chan_changed = true;
+
+                       local->tmp_channel = wk->chan;
+                       local->tmp_channel_type = wk_ct;
+                       /*
+                        * Leave the station vifs in awake mode if they
+                        * happen to be on the same channel as
+                        * the requested channel.
+                        */
+                       on_oper_chan2 = ieee80211_cfg_on_oper_channel(local);
+                       if (on_oper_chan != on_oper_chan2) {
+                               if (on_oper_chan2) {
+                                       /* going off oper channel, PS too */
+                                       ieee80211_offchannel_stop_vifs(local,
+                                                                      true);
+                                       ieee80211_hw_config(local, 0);
+                               } else {
+                                       /* going on channel, but leave PS
+                                        * off-channel. */
+                                       ieee80211_hw_config(local, 0);
+                                       ieee80211_offchannel_return(local,
+                                                                   true,
+                                                                   false);
+                               }
+                       } else if (tmp_chan_changed)
+                               /* Still off-channel, but on some other
+                                * channel, so update hardware.
+                                * PS should already be off-channel.
+                                */
+                               ieee80211_hw_config(local, 0);
+
+                       started = true;
+                       wk->timeout = jiffies;
+               }
+
+               /* don't try to work with items that aren't started */
+               if (!started)
+                       continue;
+
                if (time_is_after_jiffies(wk->timeout)) {
                        /*
                         * This work item isn't supposed to be worked on
@@ -865,6 +1043,7 @@ static void ieee80211_work_work(struct work_struct *work)
                        break;
                case IEEE80211_WORK_ABORT:
                        rma = WORK_ACT_TIMEOUT;
+                       break;
                case IEEE80211_WORK_DIRECT_PROBE:
                        rma = ieee80211_direct_probe(wk);
                        break;
@@ -877,11 +1056,20 @@ static void ieee80211_work_work(struct work_struct *work)
                case IEEE80211_WORK_REMAIN_ON_CHANNEL:
                        rma = ieee80211_remain_on_channel_timeout(wk);
                        break;
+               case IEEE80211_WORK_OFFCHANNEL_TX:
+                       rma = ieee80211_offchannel_tx(wk);
+                       break;
+               case IEEE80211_WORK_ASSOC_BEACON_WAIT:
+                       rma = ieee80211_assoc_beacon_wait(wk);
+                       break;
                }
 
+               wk->started = started;
+
                switch (rma) {
                case WORK_ACT_NONE:
-                       /* no action required */
+                       /* might have changed the timeout */
+                       run_again(local, wk->timeout);
                        break;
                case WORK_ACT_TIMEOUT:
                        list_del_rcu(&wk->list);
@@ -893,12 +1081,51 @@ static void ieee80211_work_work(struct work_struct *work)
                }
        }
 
-       if (list_empty(&local->work_list) && local->scan_req)
+       list_for_each_entry(wk, &local->work_list, list) {
+               if (!wk->started)
+                       continue;
+               if (wk->chan != local->tmp_channel)
+                       continue;
+               if (!ieee80211_work_ct_coexists(wk->chan_type,
+                                               local->tmp_channel_type))
+                       continue;
+               remain_off_channel = true;
+       }
+
+       if (!remain_off_channel && local->tmp_channel) {
+               local->tmp_channel = NULL;
+               /* If tmp_channel wasn't operating channel, then
+                * we need to go back on-channel.
+                * NOTE:  If we can ever be here while scannning,
+                * or if the hw_config() channel config logic changes,
+                * then we may need to do a more thorough check to see if
+                * we still need to do a hardware config.  Currently,
+                * we cannot be here while scanning, however.
+                */
+               if (!ieee80211_cfg_on_oper_channel(local))
+                       ieee80211_hw_config(local, 0);
+
+               /* At the least, we need to disable offchannel_ps,
+                * so just go ahead and run the entire offchannel
+                * return logic here.  We *could* skip enabling
+                * beaconing if we were already on-oper-channel
+                * as a future optimization.
+                */
+               ieee80211_offchannel_return(local, true, true);
+
+               /* give connection some time to breathe */
+               run_again(local, jiffies + HZ/2);
+       }
+
+       if (list_empty(&local->work_list) && local->scan_req &&
+           !local->scanning)
                ieee80211_queue_delayed_work(&local->hw,
                                             &local->scan_work,
                                             round_jiffies_relative(0));
 
-       mutex_unlock(&local->work_mtx);
+       ieee80211_recalc_idle(local);
+
+       mutex_unlock(&local->mtx);
 
        list_for_each_entry_safe(wk, tmp, &free_work, list) {
                wk->done(wk, NULL);
@@ -920,19 +1147,21 @@ void ieee80211_add_work(struct ieee80211_work *wk)
        if (WARN_ON(!wk->done))
                return;
 
-       wk->timeout = jiffies;
+       if (WARN_ON(!ieee80211_sdata_running(wk->sdata)))
+               return;
+
+       wk->started = false;
 
        local = wk->sdata->local;
-       mutex_lock(&local->work_mtx);
+       mutex_lock(&local->mtx);
        list_add_tail(&wk->list, &local->work_list);
-       mutex_unlock(&local->work_mtx);
+       mutex_unlock(&local->mtx);
 
        ieee80211_queue_work(&local->hw, &local->work_work);
 }
 
 void ieee80211_work_init(struct ieee80211_local *local)
 {
-       mutex_init(&local->work_mtx);
        INIT_LIST_HEAD(&local->work_list);
        setup_timer(&local->work_timer, ieee80211_work_timer,
                    (unsigned long)local);
@@ -944,26 +1173,31 @@ void ieee80211_work_purge(struct ieee80211_sub_if_data *sdata)
 {
        struct ieee80211_local *local = sdata->local;
        struct ieee80211_work *wk;
+       bool cleanup = false;
 
-       mutex_lock(&local->work_mtx);
+       mutex_lock(&local->mtx);
        list_for_each_entry(wk, &local->work_list, list) {
                if (wk->sdata != sdata)
                        continue;
+               cleanup = true;
                wk->type = IEEE80211_WORK_ABORT;
+               wk->started = true;
+               wk->timeout = jiffies;
        }
-       mutex_unlock(&local->work_mtx);
+       mutex_unlock(&local->mtx);
 
        /* run cleanups etc. */
-       ieee80211_work_work(&local->work_work);
+       if (cleanup)
+               ieee80211_work_work(&local->work_work);
 
-       mutex_lock(&local->work_mtx);
+       mutex_lock(&local->mtx);
        list_for_each_entry(wk, &local->work_list, list) {
                if (wk->sdata != sdata)
                        continue;
                WARN_ON(1);
                break;
        }
-       mutex_unlock(&local->work_mtx);
+       mutex_unlock(&local->mtx);
 }
 
 ieee80211_rx_result ieee80211_work_rx_mgmt(struct ieee80211_sub_if_data *sdata,
@@ -993,8 +1227,7 @@ ieee80211_rx_result ieee80211_work_rx_mgmt(struct ieee80211_sub_if_data *sdata,
                case IEEE80211_STYPE_PROBE_RESP:
                case IEEE80211_STYPE_ASSOC_RESP:
                case IEEE80211_STYPE_REASSOC_RESP:
-               case IEEE80211_STYPE_DEAUTH:
-               case IEEE80211_STYPE_DISASSOC:
+               case IEEE80211_STYPE_BEACON:
                        skb_queue_tail(&local->work_skb_queue, skb);
                        ieee80211_queue_work(&local->hw, &local->work_work);
                        return RX_QUEUED;
@@ -1004,12 +1237,24 @@ ieee80211_rx_result ieee80211_work_rx_mgmt(struct ieee80211_sub_if_data *sdata,
        return RX_CONTINUE;
 }
 
+static enum work_done_result ieee80211_remain_done(struct ieee80211_work *wk,
+                                                  struct sk_buff *skb)
+{
+       /*
+        * We are done serving the remain-on-channel command.
+        */
+       cfg80211_remain_on_channel_expired(wk->sdata->dev, (unsigned long) wk,
+                                          wk->chan, wk->chan_type,
+                                          GFP_KERNEL);
+
+       return WORK_DONE_DESTROY;
+}
+
 int ieee80211_wk_remain_on_channel(struct ieee80211_sub_if_data *sdata,
                                   struct ieee80211_channel *chan,
                                   enum nl80211_channel_type channel_type,
                                   unsigned int duration, u64 *cookie)
 {
-       struct ieee80211_local *local = sdata->local;
        struct ieee80211_work *wk;
 
        wk = kzalloc(sizeof(*wk), GFP_KERNEL);
@@ -1018,28 +1263,16 @@ int ieee80211_wk_remain_on_channel(struct ieee80211_sub_if_data *sdata,
 
        wk->type = IEEE80211_WORK_REMAIN_ON_CHANNEL;
        wk->chan = chan;
+       wk->chan_type = channel_type;
        wk->sdata = sdata;
+       wk->done = ieee80211_remain_done;
 
-       wk->remain.timeout = jiffies + msecs_to_jiffies(duration);
+       wk->remain.duration = duration;
 
-       *cookie = (u64)wk;
+       *cookie = (unsigned long) wk;
 
        ieee80211_add_work(wk);
 
-       /*
-        * TODO: could optimize this by leaving the station vifs in awake mode
-        * if they happen to be on the same channel as the requested channel
-        */
-       ieee80211_offchannel_stop_beaconing(local);
-       ieee80211_offchannel_stop_station(local);
-
-       sdata->local->tmp_channel = chan;
-       sdata->local->tmp_channel_type = channel_type;
-       ieee80211_hw_config(sdata->local, IEEE80211_CONF_CHANGE_CHANNEL);
-
-       cfg80211_ready_on_channel(sdata->dev, (u64)wk, chan, channel_type,
-                                 duration, GFP_KERNEL);
-
        return 0;
 }
 
@@ -1050,28 +1283,20 @@ int ieee80211_wk_cancel_remain_on_channel(struct ieee80211_sub_if_data *sdata,
        struct ieee80211_work *wk, *tmp;
        bool found = false;
 
-       mutex_lock(&local->work_mtx);
+       mutex_lock(&local->mtx);
        list_for_each_entry_safe(wk, tmp, &local->work_list, list) {
-               if ((u64)wk == cookie) {
+               if ((unsigned long) wk == cookie) {
+                       wk->timeout = jiffies;
                        found = true;
-                       list_del(&wk->list);
-                       free_work(wk);
                        break;
                }
        }
-       mutex_unlock(&local->work_mtx);
+       mutex_unlock(&local->mtx);
 
        if (!found)
                return -ENOENT;
 
-       if (sdata->local->tmp_channel) {
-               sdata->local->tmp_channel = NULL;
-               ieee80211_hw_config(sdata->local,
-                                   IEEE80211_CONF_CHANGE_CHANNEL);
-               ieee80211_offchannel_return(sdata->local, true);
-       }
-
-       ieee80211_recalc_idle(local);
+       ieee80211_queue_work(&local->hw, &local->work_work);
 
        return 0;
 }