162 files changed, 7705 insertions, 3564 deletions

diff --git a/net/802/fddi.c b/net/802/fddi.c
index 539e6064e6d4..3ef0ab0a543a 100644
--- a/net/802/fddi.c
+++ b/net/802/fddi.c
@@ -185,10 +185,6 @@ static const struct header_ops fddi_header_ops = {
 static void fddi_setup(struct net_device *dev)
 {
         dev->header_ops         = &fddi_header_ops;
-#ifdef CONFIG_COMPAT_NET_DEV_OPS
-        dev->change_mtu         = fddi_change_mtu,
-#endif
-
         dev->type               = ARPHRD_FDDI;
         dev->hard_header_len    = FDDI_K_SNAP_HLEN+3;   /* Assume 802.2 SNAP hdr len + 3 pad bytes */
         dev->mtu                = FDDI_K_SNAP_DLEN;     /* Assume max payload of 802.2 SNAP frame */
diff --git a/net/802/hippi.c b/net/802/hippi.c
index 313b9ebf92ee..cd3e8e929529 100644
--- a/net/802/hippi.c
+++ b/net/802/hippi.c
@@ -193,11 +193,6 @@ static const struct header_ops hippi_header_ops = {
 
 static void hippi_setup(struct net_device *dev)
 {
-#ifdef CONFIG_COMPAT_NET_DEV_OPS
-        dev->change_mtu                 = hippi_change_mtu;
-        dev->set_mac_address            = hippi_mac_addr;
-        dev->neigh_setup                = hippi_neigh_setup_dev;
-#endif
         dev->header_ops                 = &hippi_header_ops;
 
         /*
diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
index d1e10546eb85..714e1c3536be 100644
--- a/net/8021q/vlan.c
+++ b/net/8021q/vlan.c
@@ -378,13 +378,13 @@ static void vlan_sync_address(struct net_device *dev,
          * the new address */
         if (compare_ether_addr(vlandev->dev_addr, vlan->real_dev_addr) &&
             !compare_ether_addr(vlandev->dev_addr, dev->dev_addr))
-                dev_unicast_delete(dev, vlandev->dev_addr, ETH_ALEN);
+                dev_unicast_delete(dev, vlandev->dev_addr);
 
         /* vlan address was equal to the old address and is different from
          * the new address */
         if (!compare_ether_addr(vlandev->dev_addr, vlan->real_dev_addr) &&
             compare_ether_addr(vlandev->dev_addr, dev->dev_addr))
-                dev_unicast_add(dev, vlandev->dev_addr, ETH_ALEN);
+                dev_unicast_add(dev, vlandev->dev_addr);
 
         memcpy(vlan->real_dev_addr, dev->dev_addr, ETH_ALEN);
 }
diff --git a/net/8021q/vlan_core.c b/net/8021q/vlan_core.c
index c67fe6f75653..7f7de1a04de6 100644
--- a/net/8021q/vlan_core.c
+++ b/net/8021q/vlan_core.c
@@ -114,9 +114,9 @@ int vlan_gro_receive(struct napi_struct *napi, struct vlan_group *grp,
 EXPORT_SYMBOL(vlan_gro_receive);
 
 int vlan_gro_frags(struct napi_struct *napi, struct vlan_group *grp,
-                   unsigned int vlan_tci, struct napi_gro_fraginfo *info)
+                   unsigned int vlan_tci)
 {
-        struct sk_buff *skb = napi_fraginfo_skb(napi, info);
+        struct sk_buff *skb = napi_frags_skb(napi);
 
         if (!skb)
                 return NET_RX_DROP;
diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index b4b9068e55a7..96bad8f233e2 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -290,7 +290,7 @@ static int vlan_dev_hard_header(struct sk_buff *skb, struct net_device *dev,
 
 static int vlan_dev_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
 {
-        struct net_device_stats *stats = &dev->stats;
+        struct netdev_queue *txq = netdev_get_tx_queue(dev, 0);
         struct vlan_ethhdr *veth = (struct vlan_ethhdr *)(skb->data);
 
         /* Handle non-VLAN frames if they are sent to us, for example by DHCP.
@@ -309,7 +309,7 @@ static int vlan_dev_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 vlan_tci |= vlan_dev_get_egress_qos_mask(dev, skb);
                 skb = __vlan_put_tag(skb, vlan_tci);
                 if (!skb) {
-                        stats->tx_dropped++;
+                        txq->tx_dropped++;
                         return NETDEV_TX_OK;
                 }
 
@@ -317,8 +317,8 @@ static int vlan_dev_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
                         vlan_dev_info(dev)->cnt_inc_headroom_on_tx++;
         }
 
-        stats->tx_packets++;
-        stats->tx_bytes += skb->len;
+        txq->tx_packets++;
+        txq->tx_bytes += skb->len;
 
         skb->dev = vlan_dev_info(dev)->real_dev;
         dev_queue_xmit(skb);
@@ -328,15 +328,15 @@ static int vlan_dev_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
 static int vlan_dev_hwaccel_hard_start_xmit(struct sk_buff *skb,
                                             struct net_device *dev)
 {
-        struct net_device_stats *stats = &dev->stats;
+        struct netdev_queue *txq = netdev_get_tx_queue(dev, 0);
         u16 vlan_tci;
 
         vlan_tci = vlan_dev_info(dev)->vlan_id;
         vlan_tci |= vlan_dev_get_egress_qos_mask(dev, skb);
         skb = __vlan_hwaccel_put_tag(skb, vlan_tci);
 
-        stats->tx_packets++;
-        stats->tx_bytes += skb->len;
+        txq->tx_packets++;
+        txq->tx_bytes += skb->len;
 
         skb->dev = vlan_dev_info(dev)->real_dev;
         dev_queue_xmit(skb);
@@ -441,7 +441,7 @@ static int vlan_dev_open(struct net_device *dev)
                 return -ENETDOWN;
 
         if (compare_ether_addr(dev->dev_addr, real_dev->dev_addr)) {
-                err = dev_unicast_add(real_dev, dev->dev_addr, ETH_ALEN);
+                err = dev_unicast_add(real_dev, dev->dev_addr);
                 if (err < 0)
                         goto out;
         }
@@ -470,7 +470,7 @@ clear_allmulti:
                 dev_set_allmulti(real_dev, -1);
 del_unicast:
         if (compare_ether_addr(dev->dev_addr, real_dev->dev_addr))
-                dev_unicast_delete(real_dev, dev->dev_addr, ETH_ALEN);
+                dev_unicast_delete(real_dev, dev->dev_addr);
 out:
         netif_carrier_off(dev);
         return err;
@@ -492,7 +492,7 @@ static int vlan_dev_stop(struct net_device *dev)
                 dev_set_promiscuity(real_dev, -1);
 
         if (compare_ether_addr(dev->dev_addr, real_dev->dev_addr))
-                dev_unicast_delete(real_dev, dev->dev_addr, dev->addr_len);
+                dev_unicast_delete(real_dev, dev->dev_addr);
 
         netif_carrier_off(dev);
         return 0;
@@ -511,13 +511,13 @@ static int vlan_dev_set_mac_address(struct net_device *dev, void *p)
                 goto out;
 
         if (compare_ether_addr(addr->sa_data, real_dev->dev_addr)) {
-                err = dev_unicast_add(real_dev, addr->sa_data, ETH_ALEN);
+                err = dev_unicast_add(real_dev, addr->sa_data);
                 if (err < 0)
                         return err;
         }
 
         if (compare_ether_addr(dev->dev_addr, real_dev->dev_addr))
-                dev_unicast_delete(real_dev, dev->dev_addr, ETH_ALEN);
+                dev_unicast_delete(real_dev, dev->dev_addr);
 
 out:
         memcpy(dev->dev_addr, addr->sa_data, ETH_ALEN);
@@ -644,7 +644,6 @@ static int vlan_dev_init(struct net_device *dev)
                 dev->hard_header_len = real_dev->hard_header_len + VLAN_HLEN;
                 dev->netdev_ops         = &vlan_netdev_ops;
         }
-        netdev_resync_ops(dev);
 
         if (is_vlan_dev(real_dev))
                 subclass = 1;
@@ -671,13 +670,7 @@ static int vlan_ethtool_get_settings(struct net_device *dev,
                                      struct ethtool_cmd *cmd)
 {
         const struct vlan_dev_info *vlan = vlan_dev_info(dev);
-        struct net_device *real_dev = vlan->real_dev;
-
-        if (!real_dev->ethtool_ops ||
-            !real_dev->ethtool_ops->get_settings)
-                return -EOPNOTSUPP;
-
-        return real_dev->ethtool_ops->get_settings(real_dev, cmd);
+        return dev_ethtool_get_settings(vlan->real_dev, cmd);
 }
 
 static void vlan_ethtool_get_drvinfo(struct net_device *dev,
@@ -691,24 +684,13 @@ static void vlan_ethtool_get_drvinfo(struct net_device *dev,
 static u32 vlan_ethtool_get_rx_csum(struct net_device *dev)
 {
         const struct vlan_dev_info *vlan = vlan_dev_info(dev);
-        struct net_device *real_dev = vlan->real_dev;
-
-        if (real_dev->ethtool_ops == NULL ||
-            real_dev->ethtool_ops->get_rx_csum == NULL)
-                return 0;
-        return real_dev->ethtool_ops->get_rx_csum(real_dev);
+        return dev_ethtool_get_rx_csum(vlan->real_dev);
 }
 
 static u32 vlan_ethtool_get_flags(struct net_device *dev)
 {
         const struct vlan_dev_info *vlan = vlan_dev_info(dev);
-        struct net_device *real_dev = vlan->real_dev;
-
-        if (!(real_dev->features & NETIF_F_HW_VLAN_RX) ||
-            real_dev->ethtool_ops == NULL ||
-            real_dev->ethtool_ops->get_flags == NULL)
-                return 0;
-        return real_dev->ethtool_ops->get_flags(real_dev);
+        return dev_ethtool_get_flags(vlan->real_dev);
 }
 
 static const struct ethtool_ops vlan_ethtool_ops = {
@@ -756,6 +738,7 @@ void vlan_setup(struct net_device *dev)
         ether_setup(dev);
 
         dev->priv_flags         |= IFF_802_1Q_VLAN;
+        dev->priv_flags         &= ~IFF_XMIT_DST_RELEASE;
         dev->tx_queue_len       = 0;
 
         dev->netdev_ops         = &vlan_netdev_ops;
diff --git a/net/8021q/vlanproc.c b/net/8021q/vlanproc.c
index 3628e0a81b40..b55a091a33df 100644
--- a/net/8021q/vlanproc.c
+++ b/net/8021q/vlanproc.c
@@ -279,13 +279,14 @@ static int vlandev_seq_show(struct seq_file *seq, void *offset)
 {
         struct net_device *vlandev = (struct net_device *) seq->private;
         const struct vlan_dev_info *dev_info = vlan_dev_info(vlandev);
-        struct net_device_stats *stats = &vlandev->stats;
+        const struct net_device_stats *stats;
         static const char fmt[] = "%30s %12lu\n";
         int i;
 
         if (!is_vlan_dev(vlandev))
                 return 0;
 
+        stats = dev_get_stats(vlandev);
         seq_printf(seq,
                    "%s  VID: %d  REORDER_HDR: %i  dev->priv_flags: %hx\n",
                    vlandev->name, dev_info->vlan_id,
diff --git a/net/appletalk/dev.c b/net/appletalk/dev.c
index 72277d70c980..6c8016f61866 100644
--- a/net/appletalk/dev.c
+++ b/net/appletalk/dev.c
@@ -9,21 +9,10 @@
 #include <linux/if_arp.h>
 #include <linux/if_ltalk.h>
 
-#ifdef CONFIG_COMPAT_NET_DEV_OPS
-static int ltalk_change_mtu(struct net_device *dev, int mtu)
-{
-        return -EINVAL;
-}
-#endif
-
 static void ltalk_setup(struct net_device *dev)
 {
         /* Fill in the fields of the device structure with localtalk-generic values. */
 
-#ifdef CONFIG_COMPAT_NET_DEV_OPS
-        dev->change_mtu         = ltalk_change_mtu;
-#endif
-
         dev->type               = ARPHRD_LOCALTLK;
         dev->hard_header_len    = LTALK_HLEN;
         dev->mtu                = LTALK_MTU;
diff --git a/net/atm/br2684.c b/net/atm/br2684.c
index 3100a8940afc..bfa8fa9894fc 100644
--- a/net/atm/br2684.c
+++ b/net/atm/br2684.c
@@ -445,9 +445,10 @@ free_skb:
  */
 static int br2684_regvcc(struct atm_vcc *atmvcc, void __user * arg)
 {
+        struct sk_buff_head queue;
         int err;
         struct br2684_vcc *brvcc;
-        struct sk_buff *skb;
+        struct sk_buff *skb, *tmp;
         struct sk_buff_head *rq;
         struct br2684_dev *brdev;
         struct net_device *net_dev;
@@ -505,29 +506,20 @@ static int br2684_regvcc(struct atm_vcc *atmvcc, void __user * arg)
         barrier();
         atmvcc->push = br2684_push;
 
+        __skb_queue_head_init(&queue);
         rq = &sk_atm(atmvcc)->sk_receive_queue;
 
         spin_lock_irqsave(&rq->lock, flags);
-        if (skb_queue_empty(rq)) {
-                skb = NULL;
-        } else {
-                /* NULL terminate the list.  */
-                rq->prev->next = NULL;
-                skb = rq->next;
-        }
-        rq->prev = rq->next = (struct sk_buff *)rq;
-        rq->qlen = 0;
+        skb_queue_splice_init(rq, &queue);
         spin_unlock_irqrestore(&rq->lock, flags);
 
-        while (skb) {
-                struct sk_buff *next = skb->next;
+        skb_queue_walk_safe(&queue, skb, tmp) {
+                struct net_device *dev = skb->dev;
 
-                skb->next = skb->prev = NULL;
-                br2684_push(atmvcc, skb);
-                skb->dev->stats.rx_bytes -= skb->len;
-                skb->dev->stats.rx_packets--;
+                dev->stats.rx_bytes -= skb->len;
+                dev->stats.rx_packets--;
 
-                skb = next;
+                br2684_push(atmvcc, skb);
         }
         __module_get(THIS_MODULE);
         return 0;
diff --git a/net/atm/clip.c b/net/atm/clip.c
index 3dc0a3a42a57..fb7623c080f8 100644
--- a/net/atm/clip.c
+++ b/net/atm/clip.c
@@ -445,9 +445,9 @@ static int clip_start_xmit(struct sk_buff *skb, struct net_device *dev)
 
 static int clip_mkip(struct atm_vcc *vcc, int timeout)
 {
+        struct sk_buff_head *rq, queue;
         struct clip_vcc *clip_vcc;
-        struct sk_buff *skb;
-        struct sk_buff_head *rq;
+        struct sk_buff *skb, *tmp;
         unsigned long flags;
 
         if (!vcc->push)
@@ -469,39 +469,28 @@ static int clip_mkip(struct atm_vcc *vcc, int timeout)
         vcc->push = clip_push;
         vcc->pop = clip_pop;
 
+        __skb_queue_head_init(&queue);
         rq = &sk_atm(vcc)->sk_receive_queue;
 
         spin_lock_irqsave(&rq->lock, flags);
-        if (skb_queue_empty(rq)) {
-                skb = NULL;
-        } else {
-                /* NULL terminate the list.  */
-                rq->prev->next = NULL;
-                skb = rq->next;
-        }
-        rq->prev = rq->next = (struct sk_buff *)rq;
-        rq->qlen = 0;
+        skb_queue_splice_init(rq, &queue);
         spin_unlock_irqrestore(&rq->lock, flags);
 
         /* re-process everything received between connection setup and MKIP */
-        while (skb) {
-                struct sk_buff *next = skb->next;
-
-                skb->next = skb->prev = NULL;
+        skb_queue_walk_safe(&queue, skb, tmp) {
                 if (!clip_devs) {
                         atm_return(vcc, skb->truesize);
                         kfree_skb(skb);
                 } else {
+                        struct net_device *dev = skb->dev;
                         unsigned int len = skb->len;
 
                         skb_get(skb);
                         clip_push(vcc, skb);
-                        skb->dev->stats.rx_packets--;
-                        skb->dev->stats.rx_bytes -= len;
+                        dev->stats.rx_packets--;
+                        dev->stats.rx_bytes -= len;
                         kfree_skb(skb);
                 }
-
-                skb = next;
         }
         return 0;
 }
@@ -568,6 +557,7 @@ static void clip_setup(struct net_device *dev)
         /* without any more elaborate queuing. 100 is a reasonable */
         /* compromise between decent burst-tolerance and protection */
         /* against memory hogs. */
+        dev->priv_flags &= ~IFF_XMIT_DST_RELEASE;
 }
 
 static int clip_create(int number)
diff --git a/net/bridge/br_fdb.c b/net/bridge/br_fdb.c
index a48f5efdb6bf..cb3e97b93aeb 100644
--- a/net/bridge/br_fdb.c
+++ b/net/bridge/br_fdb.c
@@ -398,7 +398,7 @@ void br_fdb_update(struct net_bridge *br, struct net_bridge_port *source,
                 if (unlikely(fdb->is_local)) {
                         if (net_ratelimit())
                                 printk(KERN_WARNING "%s: received packet with "
-                                       " own address as source address\n",
+                                       "own address as source address\n",
                                        source->dev->name);
                 } else {
                         /* fastpath: update of existing entry */
diff --git a/net/bridge/br_sysfs_br.c b/net/bridge/br_sysfs_br.c
index 603d89248e71..ee4820aa1843 100644
--- a/net/bridge/br_sysfs_br.c
+++ b/net/bridge/br_sysfs_br.c
@@ -172,7 +172,8 @@ static ssize_t store_stp_state(struct device *d,
         if (endp == buf)
                 return -EINVAL;
 
-        rtnl_lock();
+        if (!rtnl_trylock())
+                return restart_syscall();
         br_stp_set_enabled(br, val);
         rtnl_unlock();
 
diff --git a/net/bridge/br_sysfs_if.c b/net/bridge/br_sysfs_if.c
index 02b2d50cce4d..4a3cdf8f3813 100644
--- a/net/bridge/br_sysfs_if.c
+++ b/net/bridge/br_sysfs_if.c
@@ -189,7 +189,8 @@ static ssize_t brport_store(struct kobject * kobj,
 
         val = simple_strtoul(buf, &endp, 0);
         if (endp != buf) {
-                rtnl_lock();
+                if (!rtnl_trylock())
+                        return restart_syscall();
                 if (p->dev && p->br && brport_attr->store) {
                         spin_lock_bh(&p->br->lock);
                         ret = brport_attr->store(p, val);
diff --git a/net/core/datagram.c b/net/core/datagram.c
index b01a76abe1d2..e2a36f05cdf7 100644
--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -260,7 +260,9 @@ int skb_kill_datagram(struct sock *sk, struct sk_buff *skb, unsigned int flags)
                 spin_unlock_bh(&sk->sk_receive_queue.lock);
         }
 
-        skb_free_datagram(sk, skb);
+        kfree_skb(skb);
+        sk_mem_reclaim_partial(sk);
+
         return err;
 }
 
@@ -351,17 +353,111 @@ fault:
 }
 
 /**
+ *      skb_copy_datagram_const_iovec - Copy a datagram to an iovec.
+ *      @skb: buffer to copy
+ *      @offset: offset in the buffer to start copying from
+ *      @to: io vector to copy to
+ *      @to_offset: offset in the io vector to start copying to
+ *      @len: amount of data to copy from buffer to iovec
+ *
+ *      Returns 0 or -EFAULT.
+ *      Note: the iovec is not modified during the copy.
+ */
+int skb_copy_datagram_const_iovec(const struct sk_buff *skb, int offset,
+                                  const struct iovec *to, int to_offset,
+                                  int len)
+{
+        int start = skb_headlen(skb);
+        int i, copy = start - offset;
+
+        /* Copy header. */
+        if (copy > 0) {
+                if (copy > len)
+                        copy = len;
+                if (memcpy_toiovecend(to, skb->data + offset, to_offset, copy))
+                        goto fault;
+                if ((len -= copy) == 0)
+                        return 0;
+                offset += copy;
+                to_offset += copy;
+        }
+
+        /* Copy paged appendix. Hmm... why does this look so complicated? */
+        for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
+                int end;
+
+                WARN_ON(start > offset + len);
+
+                end = start + skb_shinfo(skb)->frags[i].size;
+                if ((copy = end - offset) > 0) {
+                        int err;
+                        u8  *vaddr;
+                        skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
+                        struct page *page = frag->page;
+
+                        if (copy > len)
+                                copy = len;
+                        vaddr = kmap(page);
+                        err = memcpy_toiovecend(to, vaddr + frag->page_offset +
+                                                offset - start, to_offset, copy);
+                        kunmap(page);
+                        if (err)
+                                goto fault;
+                        if (!(len -= copy))
+                                return 0;
+                        offset += copy;
+                        to_offset += copy;
+                }
+                start = end;
+        }
+
+        if (skb_shinfo(skb)->frag_list) {
+                struct sk_buff *list = skb_shinfo(skb)->frag_list;
+
+                for (; list; list = list->next) {
+                        int end;
+
+                        WARN_ON(start > offset + len);
+
+                        end = start + list->len;
+                        if ((copy = end - offset) > 0) {
+                                if (copy > len)
+                                        copy = len;
+                                if (skb_copy_datagram_const_iovec(list,
+                                                            offset - start,
+                                                            to, to_offset,
+                                                            copy))
+                                        goto fault;
+                                if ((len -= copy) == 0)
+                                        return 0;
+                                offset += copy;
+                                to_offset += copy;
+                        }
+                        start = end;
+                }
+        }
+        if (!len)
+                return 0;
+
+fault:
+        return -EFAULT;
+}
+EXPORT_SYMBOL(skb_copy_datagram_const_iovec);
+
+/**
  *      skb_copy_datagram_from_iovec - Copy a datagram from an iovec.
  *      @skb: buffer to copy
  *      @offset: offset in the buffer to start copying to
  *      @from: io vector to copy to
+ *      @from_offset: offset in the io vector to start copying from
  *      @len: amount of data to copy to buffer from iovec
  *
  *      Returns 0 or -EFAULT.
- *      Note: the iovec is modified during the copy.
+ *      Note: the iovec is not modified during the copy.
  */
 int skb_copy_datagram_from_iovec(struct sk_buff *skb, int offset,
-                                 struct iovec *from, int len)
+                                 const struct iovec *from, int from_offset,
+                                 int len)
 {
         int start = skb_headlen(skb);
         int i, copy = start - offset;
@@ -370,11 +466,12 @@ int skb_copy_datagram_from_iovec(struct sk_buff *skb, int offset,
         if (copy > 0) {
                 if (copy > len)
                         copy = len;
-                if (memcpy_fromiovec(skb->data + offset, from, copy))
+                if (memcpy_fromiovecend(skb->data + offset, from, 0, copy))
                         goto fault;
                 if ((len -= copy) == 0)
                         return 0;
                 offset += copy;
+                from_offset += copy;
         }
 
         /* Copy paged appendix. Hmm... why does this look so complicated? */
@@ -393,8 +490,9 @@ int skb_copy_datagram_from_iovec(struct sk_buff *skb, int offset,
                         if (copy > len)
                                 copy = len;
                         vaddr = kmap(page);
-                        err = memcpy_fromiovec(vaddr + frag->page_offset +
-                                               offset - start, from, copy);
+                        err = memcpy_fromiovecend(vaddr + frag->page_offset +
+                                                  offset - start,
+                                                  from, from_offset, copy);
                         kunmap(page);
                         if (err)
                                 goto fault;
@@ -402,6 +500,7 @@ int skb_copy_datagram_from_iovec(struct sk_buff *skb, int offset,
                         if (!(len -= copy))
                                 return 0;
                         offset += copy;
+                        from_offset += copy;
                 }
                 start = end;
         }
@@ -420,11 +519,14 @@ int skb_copy_datagram_from_iovec(struct sk_buff *skb, int offset,
                                         copy = len;
                                 if (skb_copy_datagram_from_iovec(list,
                                                                  offset - start,
-                                                                 from, copy))
+                                                                 from,
+                                                                 from_offset,
+                                                                 copy))
                                         goto fault;
                                 if ((len -= copy) == 0)
                                         return 0;
                                 offset += copy;
+                                from_offset += copy;
                         }
                         start = end;
                 }
diff --git a/net/core/dev.c b/net/core/dev.c
index e2e9e4af3ace..e2fcc5f10177 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -126,6 +126,7 @@
 #include <linux/in.h>
 #include <linux/jhash.h>
 #include <linux/random.h>
+#include <trace/napi.h>
 
 #include "net-sysfs.h"
 
@@ -1688,7 +1689,17 @@ int dev_hard_start_xmit(struct sk_buff *skb, struct net_device *dev,
                                 goto gso;
                 }
 
+                /*
+                 * If device doesnt need skb->dst, release it right now while
+                 * its hot in this cpu cache
+                 */
+                if ((dev->priv_flags & IFF_XMIT_DST_RELEASE) && skb->dst) {
+                        dst_release(skb->dst);
+                        skb->dst = NULL;
+                }
                 rc = ops->ndo_start_xmit(skb, dev);
+                if (rc == 0)
+                        txq_trans_update(txq);
                 /*
                  * TODO: if skb_orphan() was called by
                  * dev->hard_start_xmit() (for example, the unmodified
@@ -1718,6 +1729,7 @@ gso:
                         skb->next = nskb;
                         return rc;
                 }
+                txq_trans_update(txq);
                 if (unlikely(netif_tx_queue_stopped(txq) && skb->next))
                         return NETDEV_TX_BUSY;
         } while (skb->next);
@@ -1735,8 +1747,12 @@ u16 skb_tx_hash(const struct net_device *dev, const struct sk_buff *skb)
 {
         u32 hash;
 
-        if (skb_rx_queue_recorded(skb))
-                return skb_get_rx_queue(skb) % dev->real_num_tx_queues;
+        if (skb_rx_queue_recorded(skb)) {
+                hash = skb_get_rx_queue(skb);
+                while (unlikely (hash >= dev->real_num_tx_queues))
+                        hash -= dev->real_num_tx_queues;
+                return hash;
+        }
 
         if (skb->sk && skb->sk->sk_hash)
                 hash = skb->sk->sk_hash;
@@ -2374,26 +2390,6 @@ void napi_gro_flush(struct napi_struct *napi)
 }
 EXPORT_SYMBOL(napi_gro_flush);
 
-void *skb_gro_header(struct sk_buff *skb, unsigned int hlen)
-{
-        unsigned int offset = skb_gro_offset(skb);
-
-        hlen += offset;
-        if (hlen <= skb_headlen(skb))
-                return skb->data + offset;
-
-        if (unlikely(!skb_shinfo(skb)->nr_frags ||
-                     skb_shinfo(skb)->frags[0].size <=
-                     hlen - skb_headlen(skb) ||
-                     PageHighMem(skb_shinfo(skb)->frags[0].page)))
-                return pskb_may_pull(skb, hlen) ? skb->data + offset : NULL;
-
-        return page_address(skb_shinfo(skb)->frags[0].page) +
-               skb_shinfo(skb)->frags[0].page_offset +
-               offset - skb_headlen(skb);
-}
-EXPORT_SYMBOL(skb_gro_header);
-
 int dev_gro_receive(struct napi_struct *napi, struct sk_buff *skb)
 {
         struct sk_buff **pp = NULL;
@@ -2456,10 +2452,25 @@ int dev_gro_receive(struct napi_struct *napi, struct sk_buff *skb)
         ret = GRO_HELD;
 
 pull:
-        if (unlikely(!pskb_may_pull(skb, skb_gro_offset(skb)))) {
-                if (napi->gro_list == skb)
-                        napi->gro_list = skb->next;
-                ret = GRO_DROP;
+        if (skb_headlen(skb) < skb_gro_offset(skb)) {
+                int grow = skb_gro_offset(skb) - skb_headlen(skb);
+
+                BUG_ON(skb->end - skb->tail < grow);
+
+                memcpy(skb_tail_pointer(skb), NAPI_GRO_CB(skb)->frag0, grow);
+
+                skb->tail += grow;
+                skb->data_len -= grow;
+
+                skb_shinfo(skb)->frags[0].page_offset += grow;
+                skb_shinfo(skb)->frags[0].size -= grow;
+
+                if (unlikely(!skb_shinfo(skb)->frags[0].size)) {
+                        put_page(skb_shinfo(skb)->frags[0].page);
+                        memmove(skb_shinfo(skb)->frags,
+                                skb_shinfo(skb)->frags + 1,
+                                --skb_shinfo(skb)->nr_frags);
+                }
         }
 
 ok:
@@ -2509,6 +2520,22 @@ int napi_skb_finish(int ret, struct sk_buff *skb)
 }
 EXPORT_SYMBOL(napi_skb_finish);
 
+void skb_gro_reset_offset(struct sk_buff *skb)
+{
+        NAPI_GRO_CB(skb)->data_offset = 0;
+        NAPI_GRO_CB(skb)->frag0 = NULL;
+        NAPI_GRO_CB(skb)->frag0_len = 0;
+
+        if (skb->mac_header == skb->tail &&
+            !PageHighMem(skb_shinfo(skb)->frags[0].page)) {
+                NAPI_GRO_CB(skb)->frag0 =
+                        page_address(skb_shinfo(skb)->frags[0].page) +
+                        skb_shinfo(skb)->frags[0].page_offset;
+                NAPI_GRO_CB(skb)->frag0_len = skb_shinfo(skb)->frags[0].size;
+        }
+}
+EXPORT_SYMBOL(skb_gro_reset_offset);
+
 int napi_gro_receive(struct napi_struct *napi, struct sk_buff *skb)
 {
         skb_gro_reset_offset(skb);
@@ -2526,16 +2553,10 @@ void napi_reuse_skb(struct napi_struct *napi, struct sk_buff *skb)
 }
 EXPORT_SYMBOL(napi_reuse_skb);
 
-struct sk_buff *napi_fraginfo_skb(struct napi_struct *napi,
-                                  struct napi_gro_fraginfo *info)
+struct sk_buff *napi_get_frags(struct napi_struct *napi)
 {
         struct net_device *dev = napi->dev;
         struct sk_buff *skb = napi->skb;
-        struct ethhdr *eth;
-        skb_frag_t *frag;
-        int i;
-
-        napi->skb = NULL;
 
         if (!skb) {
                 skb = netdev_alloc_skb(dev, GRO_MAX_HEAD + NET_IP_ALIGN);
@@ -2543,47 +2564,14 @@ struct sk_buff *napi_fraginfo_skb(struct napi_struct *napi,
                         goto out;
 
                 skb_reserve(skb, NET_IP_ALIGN);
-        }
 
-        BUG_ON(info->nr_frags > MAX_SKB_FRAGS);
-        frag = info->frags;
-
-        for (i = 0; i < info->nr_frags; i++) {
-                skb_fill_page_desc(skb, i, frag->page, frag->page_offset,
-                                   frag->size);
-                frag++;
+                napi->skb = skb;
         }
-        skb_shinfo(skb)->nr_frags = info->nr_frags;
-
-        skb->data_len = info->len;
-        skb->len += info->len;
-        skb->truesize += info->len;
-
-        skb_reset_mac_header(skb);
-        skb_gro_reset_offset(skb);
-
-        eth = skb_gro_header(skb, sizeof(*eth));
-        if (!eth) {
-                napi_reuse_skb(napi, skb);
-                skb = NULL;
-                goto out;
-        }
-
-        skb_gro_pull(skb, sizeof(*eth));
-
-        /*
-         * This works because the only protocols we care about don't require
-         * special handling.  We'll fix it up properly at the end.
-         */
-        skb->protocol = eth->h_proto;
-
-        skb->ip_summed = info->ip_summed;
-        skb->csum = info->csum;
 
 out:
         return skb;
 }
-EXPORT_SYMBOL(napi_fraginfo_skb);
+EXPORT_SYMBOL(napi_get_frags);
 
 int napi_frags_finish(struct napi_struct *napi, struct sk_buff *skb, int ret)
 {
@@ -2613,9 +2601,46 @@ int napi_frags_finish(struct napi_struct *napi, struct sk_buff *skb, int ret)
 }
 EXPORT_SYMBOL(napi_frags_finish);
 
-int napi_gro_frags(struct napi_struct *napi, struct napi_gro_fraginfo *info)
+struct sk_buff *napi_frags_skb(struct napi_struct *napi)
 {
-        struct sk_buff *skb = napi_fraginfo_skb(napi, info);
+        struct sk_buff *skb = napi->skb;
+        struct ethhdr *eth;
+        unsigned int hlen;
+        unsigned int off;
+
+        napi->skb = NULL;
+
+        skb_reset_mac_header(skb);
+        skb_gro_reset_offset(skb);
+
+        off = skb_gro_offset(skb);
+        hlen = off + sizeof(*eth);
+        eth = skb_gro_header_fast(skb, off);
+        if (skb_gro_header_hard(skb, hlen)) {
+                eth = skb_gro_header_slow(skb, hlen, off);
+                if (unlikely(!eth)) {
+                        napi_reuse_skb(napi, skb);
+                        skb = NULL;
+                        goto out;
+                }
+        }
+
+        skb_gro_pull(skb, sizeof(*eth));
+
+        /*
+         * This works because the only protocols we care about don't require
+         * special handling.  We'll fix it up properly at the end.
+         */
+        skb->protocol = eth->h_proto;
+
+out:
+        return skb;
+}
+EXPORT_SYMBOL(napi_frags_skb);
+
+int napi_gro_frags(struct napi_struct *napi)
+{
+        struct sk_buff *skb = napi_frags_skb(napi);
 
         if (!skb)
                 return NET_RX_DROP;
@@ -2719,7 +2744,7 @@ void netif_napi_del(struct napi_struct *napi)
         struct sk_buff *skb, *next;
 
         list_del_init(&napi->dev_list);
-        kfree_skb(napi->skb);
+        napi_free_frags(napi);
 
         for (skb = napi->gro_list; skb; skb = next) {
                 next = skb->next;
@@ -2773,8 +2798,10 @@ static void net_rx_action(struct softirq_action *h)
                  * accidently calling ->poll() when NAPI is not scheduled.
                  */
                 work = 0;
-                if (test_bit(NAPI_STATE_SCHED, &n->state))
+                if (test_bit(NAPI_STATE_SCHED, &n->state)) {
                         work = n->poll(n, weight);
+                        trace_napi_poll(n);
+                }
 
                 WARN_ON_ONCE(work > weight);
 
@@ -3444,6 +3471,319 @@ void dev_set_rx_mode(struct net_device *dev)
         netif_addr_unlock_bh(dev);
 }
 
+/* hw addresses list handling functions */
+
+static int __hw_addr_add(struct list_head *list, int *delta,
+                         unsigned char *addr, int addr_len,
+                         unsigned char addr_type)
+{
+        struct netdev_hw_addr *ha;
+        int alloc_size;
+
+        if (addr_len > MAX_ADDR_LEN)
+                return -EINVAL;
+
+        list_for_each_entry(ha, list, list) {
+                if (!memcmp(ha->addr, addr, addr_len) &&
+                    ha->type == addr_type) {
+                        ha->refcount++;
+                        return 0;
+                }
+        }
+
+
+        alloc_size = sizeof(*ha);
+        if (alloc_size < L1_CACHE_BYTES)
+                alloc_size = L1_CACHE_BYTES;
+        ha = kmalloc(alloc_size, GFP_ATOMIC);
+        if (!ha)
+                return -ENOMEM;
+        memcpy(ha->addr, addr, addr_len);
+        ha->type = addr_type;
+        ha->refcount = 1;
+        ha->synced = false;
+        list_add_tail_rcu(&ha->list, list);
+        if (delta)
+                (*delta)++;
+        return 0;
+}
+
+static void ha_rcu_free(struct rcu_head *head)
+{
+        struct netdev_hw_addr *ha;
+
+        ha = container_of(head, struct netdev_hw_addr, rcu_head);
+        kfree(ha);
+}
+
+static int __hw_addr_del(struct list_head *list, int *delta,
+                         unsigned char *addr, int addr_len,
+                         unsigned char addr_type)
+{
+        struct netdev_hw_addr *ha;
+
+        list_for_each_entry(ha, list, list) {
+                if (!memcmp(ha->addr, addr, addr_len) &&
+                    (ha->type == addr_type || !addr_type)) {
+                        if (--ha->refcount)
+                                return 0;
+                        list_del_rcu(&ha->list);
+                        call_rcu(&ha->rcu_head, ha_rcu_free);
+                        if (delta)
+                                (*delta)--;
+                        return 0;
+                }
+        }
+        return -ENOENT;
+}
+
+static int __hw_addr_add_multiple(struct list_head *to_list, int *to_delta,
+                                  struct list_head *from_list, int addr_len,
+                                  unsigned char addr_type)
+{
+        int err;
+        struct netdev_hw_addr *ha, *ha2;
+        unsigned char type;
+
+        list_for_each_entry(ha, from_list, list) {
+                type = addr_type ? addr_type : ha->type;
+                err = __hw_addr_add(to_list, to_delta, ha->addr,
+                                    addr_len, type);
+                if (err)
+                        goto unroll;
+        }
+        return 0;
+
+unroll:
+        list_for_each_entry(ha2, from_list, list) {
+                if (ha2 == ha)
+                        break;
+                type = addr_type ? addr_type : ha2->type;
+                __hw_addr_del(to_list, to_delta, ha2->addr,
+                              addr_len, type);
+        }
+        return err;
+}
+
+static void __hw_addr_del_multiple(struct list_head *to_list, int *to_delta,
+                                   struct list_head *from_list, int addr_len,
+                                   unsigned char addr_type)
+{
+        struct netdev_hw_addr *ha;
+        unsigned char type;
+
+        list_for_each_entry(ha, from_list, list) {
+                type = addr_type ? addr_type : ha->type;
+                __hw_addr_del(to_list, to_delta, ha->addr,
+                              addr_len, addr_type);
+        }
+}
+
+static int __hw_addr_sync(struct list_head *to_list, int *to_delta,
+                          struct list_head *from_list, int *from_delta,
+                          int addr_len)
+{
+        int err = 0;
+        struct netdev_hw_addr *ha, *tmp;
+
+        list_for_each_entry_safe(ha, tmp, from_list, list) {
+                if (!ha->synced) {
+                        err = __hw_addr_add(to_list, to_delta, ha->addr,
+                                            addr_len, ha->type);
+                        if (err)
+                                break;
+                        ha->synced = true;
+                        ha->refcount++;
+                } else if (ha->refcount == 1) {
+                        __hw_addr_del(to_list, to_delta, ha->addr,
+                                      addr_len, ha->type);
+                        __hw_addr_del(from_list, from_delta, ha->addr,
+                                      addr_len, ha->type);
+                }
+        }
+        return err;
+}
+
+static void __hw_addr_unsync(struct list_head *to_list, int *to_delta,
+                             struct list_head *from_list, int *from_delta,
+                             int addr_len)
+{
+        struct netdev_hw_addr *ha, *tmp;
+
+        list_for_each_entry_safe(ha, tmp, from_list, list) {
+                if (ha->synced) {
+                        __hw_addr_del(to_list, to_delta, ha->addr,
+                                      addr_len, ha->type);
+                        ha->synced = false;
+                        __hw_addr_del(from_list, from_delta, ha->addr,
+                                      addr_len, ha->type);
+                }
+        }
+}
+
+
+static void __hw_addr_flush(struct list_head *list)
+{
+        struct netdev_hw_addr *ha, *tmp;
+
+        list_for_each_entry_safe(ha, tmp, list, list) {
+                list_del_rcu(&ha->list);
+                call_rcu(&ha->rcu_head, ha_rcu_free);
+        }
+}
+
+/* Device addresses handling functions */
+
+static void dev_addr_flush(struct net_device *dev)
+{
+        /* rtnl_mutex must be held here */
+
+        __hw_addr_flush(&dev->dev_addr_list);
+        dev->dev_addr = NULL;
+}
+
+static int dev_addr_init(struct net_device *dev)
+{
+        unsigned char addr[MAX_ADDR_LEN];
+        struct netdev_hw_addr *ha;
+        int err;
+
+        /* rtnl_mutex must be held here */
+
+        INIT_LIST_HEAD(&dev->dev_addr_list);
+        memset(addr, 0, sizeof(*addr));
+        err = __hw_addr_add(&dev->dev_addr_list, NULL, addr, sizeof(*addr),
+                            NETDEV_HW_ADDR_T_LAN);
+        if (!err) {
+                /*
+                 * Get the first (previously created) address from the list
+                 * and set dev_addr pointer to this location.
+                 */
+                ha = list_first_entry(&dev->dev_addr_list,
+                                      struct netdev_hw_addr, list);
+                dev->dev_addr = ha->addr;
+        }
+        return err;
+}
+
+/**
+ *      dev_addr_add    - Add a device address
+ *      @dev: device
+ *      @addr: address to add
+ *      @addr_type: address type
+ *
+ *      Add a device address to the device or increase the reference count if
+ *      it already exists.
+ *
+ *      The caller must hold the rtnl_mutex.
+ */
+int dev_addr_add(struct net_device *dev, unsigned char *addr,
+                 unsigned char addr_type)
+{
+        int err;
+
+        ASSERT_RTNL();
+
+        err = __hw_addr_add(&dev->dev_addr_list, NULL, addr, dev->addr_len,
+                            addr_type);
+        if (!err)
+                call_netdevice_notifiers(NETDEV_CHANGEADDR, dev);
+        return err;
+}
+EXPORT_SYMBOL(dev_addr_add);
+
+/**
+ *      dev_addr_del    - Release a device address.
+ *      @dev: device
+ *      @addr: address to delete
+ *      @addr_type: address type
+ *
+ *      Release reference to a device address and remove it from the device
+ *      if the reference count drops to zero.
+ *
+ *      The caller must hold the rtnl_mutex.
+ */
+int dev_addr_del(struct net_device *dev, unsigned char *addr,
+                 unsigned char addr_type)
+{
+        int err;
+        struct netdev_hw_addr *ha;
+
+        ASSERT_RTNL();
+
+        /*
+         * We can not remove the first address from the list because
+         * dev->dev_addr points to that.
+         */
+        ha = list_first_entry(&dev->dev_addr_list, struct netdev_hw_addr, list);
+        if (ha->addr == dev->dev_addr && ha->refcount == 1)
+                return -ENOENT;
+
+        err = __hw_addr_del(&dev->dev_addr_list, NULL, addr, dev->addr_len,
+                            addr_type);
+        if (!err)
+                call_netdevice_notifiers(NETDEV_CHANGEADDR, dev);
+        return err;
+}
+EXPORT_SYMBOL(dev_addr_del);
+
+/**
+ *      dev_addr_add_multiple   - Add device addresses from another device
+ *      @to_dev: device to which addresses will be added
+ *      @from_dev: device from which addresses will be added
+ *      @addr_type: address type - 0 means type will be used from from_dev
+ *
+ *      Add device addresses of the one device to another.
+ **
+ *      The caller must hold the rtnl_mutex.
+ */
+int dev_addr_add_multiple(struct net_device *to_dev,
+                          struct net_device *from_dev,
+                          unsigned char addr_type)
+{
+        int err;
+
+        ASSERT_RTNL();
+
+        if (from_dev->addr_len != to_dev->addr_len)
+                return -EINVAL;
+        err = __hw_addr_add_multiple(&to_dev->dev_addr_list, NULL,
+                                     &from_dev->dev_addr_list,
+                                     to_dev->addr_len, addr_type);
+        if (!err)
+                call_netdevice_notifiers(NETDEV_CHANGEADDR, to_dev);
+        return err;
+}
+EXPORT_SYMBOL(dev_addr_add_multiple);
+
+/**
+ *      dev_addr_del_multiple   - Delete device addresses by another device
+ *      @to_dev: device where the addresses will be deleted
+ *      @from_dev: device by which addresses the addresses will be deleted
+ *      @addr_type: address type - 0 means type will used from from_dev
+ *
+ *      Deletes addresses in to device by the list of addresses in from device.
+ *
+ *      The caller must hold the rtnl_mutex.
+ */
+int dev_addr_del_multiple(struct net_device *to_dev,
+                          struct net_device *from_dev,
+                          unsigned char addr_type)
+{
+        ASSERT_RTNL();
+
+        if (from_dev->addr_len != to_dev->addr_len)
+                return -EINVAL;
+        __hw_addr_del_multiple(&to_dev->dev_addr_list, NULL,
+                               &from_dev->dev_addr_list,
+                               to_dev->addr_len, addr_type);
+        call_netdevice_notifiers(NETDEV_CHANGEADDR, to_dev);
+        return 0;
+}
+EXPORT_SYMBOL(dev_addr_del_multiple);
+
+/* unicast and multicast addresses handling functions */
+
 int __dev_addr_delete(struct dev_addr_list **list, int *count,
                       void *addr, int alen, int glbl)
 {
@@ -3506,24 +3846,22 @@ int __dev_addr_add(struct dev_addr_list **list, int *count,
  *      dev_unicast_delete      - Release secondary unicast address.
  *      @dev: device
  *      @addr: address to delete
- *      @alen: length of @addr
  *
  *      Release reference to a secondary unicast address and remove it
  *      from the device if the reference count drops to zero.
  *
  *      The caller must hold the rtnl_mutex.
  */
-int dev_unicast_delete(struct net_device *dev, void *addr, int alen)
+int dev_unicast_delete(struct net_device *dev, void *addr)
 {
         int err;
 
         ASSERT_RTNL();
 
-        netif_addr_lock_bh(dev);
-        err = __dev_addr_delete(&dev->uc_list, &dev->uc_count, addr, alen, 0);
+        err = __hw_addr_del(&dev->uc_list, &dev->uc_count, addr,
+                            dev->addr_len, NETDEV_HW_ADDR_T_UNICAST);
         if (!err)
                 __dev_set_rx_mode(dev);
-        netif_addr_unlock_bh(dev);
         return err;
 }
 EXPORT_SYMBOL(dev_unicast_delete);
@@ -3532,24 +3870,22 @@ EXPORT_SYMBOL(dev_unicast_delete);
  *      dev_unicast_add         - add a secondary unicast address
  *      @dev: device
  *      @addr: address to add
- *      @alen: length of @addr
  *
  *      Add a secondary unicast address to the device or increase
  *      the reference count if it already exists.
  *
  *      The caller must hold the rtnl_mutex.
  */
-int dev_unicast_add(struct net_device *dev, void *addr, int alen)
+int dev_unicast_add(struct net_device *dev, void *addr)
 {
         int err;
 
         ASSERT_RTNL();
 
-        netif_addr_lock_bh(dev);
-        err = __dev_addr_add(&dev->uc_list, &dev->uc_count, addr, alen, 0);
+        err = __hw_addr_add(&dev->uc_list, &dev->uc_count, addr,
+                            dev->addr_len, NETDEV_HW_ADDR_T_UNICAST);
         if (!err)
                 __dev_set_rx_mode(dev);
-        netif_addr_unlock_bh(dev);
         return err;
 }
 EXPORT_SYMBOL(dev_unicast_add);
@@ -3606,8 +3942,7 @@ void __dev_addr_unsync(struct dev_addr_list **to, int *to_count,
  *      @from: source device
  *
  *      Add newly added addresses to the destination device and release
- *      addresses that have no users left. The source device must be
- *      locked by netif_tx_lock_bh.
+ *      addresses that have no users left.
  *
  *      This function is intended to be called from the dev->set_rx_mode
  *      function of layered software devices.
@@ -3616,12 +3951,15 @@ int dev_unicast_sync(struct net_device *to, struct net_device *from)
 {
         int err = 0;
 
-        netif_addr_lock_bh(to);
-        err = __dev_addr_sync(&to->uc_list, &to->uc_count,
-                              &from->uc_list, &from->uc_count);
+        ASSERT_RTNL();
+
+        if (to->addr_len != from->addr_len)
+                return -EINVAL;
+
+        err = __hw_addr_sync(&to->uc_list, &to->uc_count,
+                             &from->uc_list, &from->uc_count, to->addr_len);
         if (!err)
                 __dev_set_rx_mode(to);
-        netif_addr_unlock_bh(to);
         return err;
 }
 EXPORT_SYMBOL(dev_unicast_sync);
@@ -3637,18 +3975,33 @@ EXPORT_SYMBOL(dev_unicast_sync);
  */
 void dev_unicast_unsync(struct net_device *to, struct net_device *from)
 {
-        netif_addr_lock_bh(from);
-        netif_addr_lock(to);
+        ASSERT_RTNL();
 
-        __dev_addr_unsync(&to->uc_list, &to->uc_count,
-                          &from->uc_list, &from->uc_count);
-        __dev_set_rx_mode(to);
+        if (to->addr_len != from->addr_len)
+                return;
 
-        netif_addr_unlock(to);
-        netif_addr_unlock_bh(from);
+        __hw_addr_unsync(&to->uc_list, &to->uc_count,
+                         &from->uc_list, &from->uc_count, to->addr_len);
+        __dev_set_rx_mode(to);
 }
 EXPORT_SYMBOL(dev_unicast_unsync);
 
+static void dev_unicast_flush(struct net_device *dev)
+{
+        /* rtnl_mutex must be held here */
+
+        __hw_addr_flush(&dev->uc_list);
+        dev->uc_count = 0;
+}
+
+static void dev_unicast_init(struct net_device *dev)
+{
+        /* rtnl_mutex must be held here */
+
+        INIT_LIST_HEAD(&dev->uc_list);
+}
+
+
 static void __dev_addr_discard(struct dev_addr_list **list)
 {
         struct dev_addr_list *tmp;
@@ -3667,9 +4020,6 @@ static void dev_addr_discard(struct net_device *dev)
 {
         netif_addr_lock_bh(dev);
 
-        __dev_addr_discard(&dev->uc_list);
-        dev->uc_count = 0;
-
         __dev_addr_discard(&dev->mc_list);
         dev->mc_count = 0;
 
@@ -4262,6 +4612,7 @@ static void rollback_registered(struct net_device *dev)
         /*
          *      Flush the unicast and multicast chains
          */
+        dev_unicast_flush(dev);
         dev_addr_discard(dev);
 
         if (dev->netdev_ops->ndo_uninit)
@@ -4333,39 +4684,6 @@ unsigned long netdev_fix_features(unsigned long features, const char *name)
 }
 EXPORT_SYMBOL(netdev_fix_features);
 
-/* Some devices need to (re-)set their netdev_ops inside
- * ->init() or similar.  If that happens, we have to setup
- * the compat pointers again.
- */
-void netdev_resync_ops(struct net_device *dev)
-{
-#ifdef CONFIG_COMPAT_NET_DEV_OPS
-        const struct net_device_ops *ops = dev->netdev_ops;
-
-        dev->init = ops->ndo_init;
-        dev->uninit = ops->ndo_uninit;
-        dev->open = ops->ndo_open;
-        dev->change_rx_flags = ops->ndo_change_rx_flags;
-        dev->set_rx_mode = ops->ndo_set_rx_mode;
-        dev->set_multicast_list = ops->ndo_set_multicast_list;
-        dev->set_mac_address = ops->ndo_set_mac_address;
-        dev->validate_addr = ops->ndo_validate_addr;
-        dev->do_ioctl = ops->ndo_do_ioctl;
-        dev->set_config = ops->ndo_set_config;
-        dev->change_mtu = ops->ndo_change_mtu;
-        dev->neigh_setup = ops->ndo_neigh_setup;
-        dev->tx_timeout = ops->ndo_tx_timeout;
-        dev->get_stats = ops->ndo_get_stats;
-        dev->vlan_rx_register = ops->ndo_vlan_rx_register;
-        dev->vlan_rx_add_vid = ops->ndo_vlan_rx_add_vid;
-        dev->vlan_rx_kill_vid = ops->ndo_vlan_rx_kill_vid;
-#ifdef CONFIG_NET_POLL_CONTROLLER
-        dev->poll_controller = ops->ndo_poll_controller;
-#endif
-#endif
-}
-EXPORT_SYMBOL(netdev_resync_ops);
-
 /**
  *      register_netdevice      - register a network device
  *      @dev: device to register
@@ -4405,23 +4723,6 @@ int register_netdevice(struct net_device *dev)
 
         dev->iflink = -1;
 
-#ifdef CONFIG_COMPAT_NET_DEV_OPS
-        /* Netdevice_ops API compatibility support.
-         * This is temporary until all network devices are converted.
-         */
-        if (dev->netdev_ops) {
-                netdev_resync_ops(dev);
-        } else {
-                char drivername[64];
-                pr_info("%s (%s): not using net_device_ops yet\n",
-                        dev->name, netdev_drivername(dev, drivername, 64));
-
-                /* This works only because net_device_ops and the
-                   compatibility structure are the same. */
-                dev->netdev_ops = (void *) &(dev->init);
-        }
-#endif
-
         /* Init, if this function is available */
         if (dev->netdev_ops->ndo_init) {
                 ret = dev->netdev_ops->ndo_init(dev);
@@ -4707,13 +5008,30 @@ void netdev_run_todo(void)
  *      the internal statistics structure is used.
  */
 const struct net_device_stats *dev_get_stats(struct net_device *dev)
- {
+{
         const struct net_device_ops *ops = dev->netdev_ops;
 
         if (ops->ndo_get_stats)
                 return ops->ndo_get_stats(dev);
-        else
-                return &dev->stats;
+        else {
+                unsigned long tx_bytes = 0, tx_packets = 0, tx_dropped = 0;
+                struct net_device_stats *stats = &dev->stats;
+                unsigned int i;
+                struct netdev_queue *txq;
+
+                for (i = 0; i < dev->num_tx_queues; i++) {
+                        txq = netdev_get_tx_queue(dev, i);
+                        tx_bytes   += txq->tx_bytes;
+                        tx_packets += txq->tx_packets;
+                        tx_dropped += txq->tx_dropped;
+                }
+                if (tx_bytes || tx_packets || tx_dropped) {
+                        stats->tx_bytes   = tx_bytes;
+                        stats->tx_packets = tx_packets;
+                        stats->tx_dropped = tx_dropped;
+                }
+                return stats;
+        }
 }
 EXPORT_SYMBOL(dev_get_stats);
 
@@ -4748,18 +5066,18 @@ struct net_device *alloc_netdev_mq(int sizeof_priv, const char *name,
         struct netdev_queue *tx;
         struct net_device *dev;
         size_t alloc_size;
-        void *p;
+        struct net_device *p;
 
         BUG_ON(strlen(name) >= sizeof(dev->name));
 
         alloc_size = sizeof(struct net_device);
         if (sizeof_priv) {
                 /* ensure 32-byte alignment of private area */
-                alloc_size = (alloc_size + NETDEV_ALIGN_CONST) & ~NETDEV_ALIGN_CONST;
+                alloc_size = ALIGN(alloc_size, NETDEV_ALIGN);
                 alloc_size += sizeof_priv;
         }
         /* ensure 32-byte alignment of whole construct */
-        alloc_size += NETDEV_ALIGN_CONST;
+        alloc_size += NETDEV_ALIGN - 1;
 
         p = kzalloc(alloc_size, GFP_KERNEL);
         if (!p) {
@@ -4771,13 +5089,17 @@ struct net_device *alloc_netdev_mq(int sizeof_priv, const char *name,
         if (!tx) {
                 printk(KERN_ERR "alloc_netdev: Unable to allocate "
                        "tx qdiscs.\n");
-                kfree(p);
-                return NULL;
+                goto free_p;
         }
 
-        dev = (struct net_device *)
-                (((long)p + NETDEV_ALIGN_CONST) & ~NETDEV_ALIGN_CONST);
+        dev = PTR_ALIGN(p, NETDEV_ALIGN);
         dev->padded = (char *)dev - (char *)p;
+
+        if (dev_addr_init(dev))
+                goto free_tx;
+
+        dev_unicast_init(dev);
+
         dev_net_set(dev, &init_net);
 
         dev->_tx = tx;
@@ -4789,9 +5111,17 @@ struct net_device *alloc_netdev_mq(int sizeof_priv, const char *name,
         netdev_init_queues(dev);
 
         INIT_LIST_HEAD(&dev->napi_list);
+        dev->priv_flags = IFF_XMIT_DST_RELEASE;
         setup(dev);
         strcpy(dev->name, name);
         return dev;
+
+free_tx:
+        kfree(tx);
+
+free_p:
+        kfree(p);
+        return NULL;
 }
 EXPORT_SYMBOL(alloc_netdev_mq);
 
@@ -4811,6 +5141,9 @@ void free_netdev(struct net_device *dev)
 
         kfree(dev->_tx);
 
+        /* Flush device addresses */
+        dev_addr_flush(dev);
+
         list_for_each_entry_safe(p, n, &dev->napi_list, dev_list)
                 netif_napi_del(p);
 
@@ -4970,6 +5303,7 @@ int dev_change_net_namespace(struct net_device *dev, struct net *net, const char
         /*
          *      Flush the unicast and multicast chains
          */
+        dev_unicast_flush(dev);
         dev_addr_discard(dev);
 
         netdev_unregister_kobject(dev);
diff --git a/net/core/drop_monitor.c b/net/core/drop_monitor.c
index 9fd0dc3cca99..a6c2ac2828fb 100644
--- a/net/core/drop_monitor.c
+++ b/net/core/drop_monitor.c
@@ -22,8 +22,10 @@
 #include <linux/timer.h>
 #include <linux/bitops.h>
 #include <net/genetlink.h>
+#include <net/netevent.h>
 
 #include <trace/skb.h>
+#include <trace/napi.h>
 
 #include <asm/unaligned.h>
 
@@ -38,7 +40,8 @@ static void send_dm_alert(struct work_struct *unused);
  * and the work handle that will send up
  * netlink alerts
  */
-struct sock *dm_sock;
+static int trace_state = TRACE_OFF;
+static spinlock_t trace_state_lock = SPIN_LOCK_UNLOCKED;
 
 struct per_cpu_dm_data {
         struct work_struct dm_alert_work;
@@ -47,11 +50,18 @@ struct per_cpu_dm_data {
         struct timer_list send_timer;
 };
 
+struct dm_hw_stat_delta {
+        struct net_device *dev;
+        struct list_head list;
+        struct rcu_head rcu;
+        unsigned long last_drop_val;
+};
+
 static struct genl_family net_drop_monitor_family = {
         .id             = GENL_ID_GENERATE,
         .hdrsize        = 0,
         .name           = "NET_DM",
-        .version        = 1,
+        .version        = 2,
         .maxattr        = NET_DM_CMD_MAX,
 };
 
@@ -59,19 +69,24 @@ static DEFINE_PER_CPU(struct per_cpu_dm_data, dm_cpu_data);
 
 static int dm_hit_limit = 64;
 static int dm_delay = 1;
-
+static unsigned long dm_hw_check_delta = 2*HZ;
+static LIST_HEAD(hw_stats_list);
 
 static void reset_per_cpu_data(struct per_cpu_dm_data *data)
 {
         size_t al;
         struct net_dm_alert_msg *msg;
+        struct nlattr *nla;
 
         al = sizeof(struct net_dm_alert_msg);
         al += dm_hit_limit * sizeof(struct net_dm_drop_point);
+        al += sizeof(struct nlattr);
+
         data->skb = genlmsg_new(al, GFP_KERNEL);
         genlmsg_put(data->skb, 0, 0, &net_drop_monitor_family,
                         0, NET_DM_CMD_ALERT);
-        msg = __nla_reserve_nohdr(data->skb, sizeof(struct net_dm_alert_msg));
+        nla = nla_reserve(data->skb, NLA_UNSPEC, sizeof(struct net_dm_alert_msg));
+        msg = nla_data(nla);
         memset(msg, 0, al);
         atomic_set(&data->dm_hit_count, dm_hit_limit);
 }
@@ -111,10 +126,11 @@ static void sched_send_work(unsigned long unused)
         schedule_work(&data->dm_alert_work);
 }
 
-static void trace_kfree_skb_hit(struct sk_buff *skb, void *location)
+static void trace_drop_common(struct sk_buff *skb, void *location)
 {
         struct net_dm_alert_msg *msg;
         struct nlmsghdr *nlh;
+        struct nlattr *nla;
         int i;
         struct per_cpu_dm_data *data = &__get_cpu_var(dm_cpu_data);
 
@@ -127,7 +143,8 @@ static void trace_kfree_skb_hit(struct sk_buff *skb, void *location)
         }
 
         nlh = (struct nlmsghdr *)data->skb->data;
-        msg = genlmsg_data(nlmsg_data(nlh));
+        nla = genlmsg_data(nlmsg_data(nlh));
+        msg = nla_data(nla);
         for (i = 0; i < msg->entries; i++) {
                 if (!memcmp(&location, msg->points[i].pc, sizeof(void *))) {
                         msg->points[i].count++;
@@ -139,6 +156,7 @@ static void trace_kfree_skb_hit(struct sk_buff *skb, void *location)
          * We need to create a new entry
          */
         __nla_reserve_nohdr(data->skb, sizeof(struct net_dm_drop_point));
+        nla->nla_len += NLA_ALIGN(sizeof(struct net_dm_drop_point));
         memcpy(msg->points[msg->entries].pc, &location, sizeof(void *));
         msg->points[msg->entries].count = 1;
         msg->entries++;
@@ -152,24 +170,80 @@ out:
         return;
 }
 
+static void trace_kfree_skb_hit(struct sk_buff *skb, void *location)
+{
+        trace_drop_common(skb, location);
+}
+
+static void trace_napi_poll_hit(struct napi_struct *napi)
+{
+        struct dm_hw_stat_delta *new_stat;
+
+        /*
+         * Ratelimit our check time to dm_hw_check_delta jiffies
+         */
+        if (!time_after(jiffies, napi->dev->last_rx + dm_hw_check_delta))
+                return;
+
+        rcu_read_lock();
+        list_for_each_entry_rcu(new_stat, &hw_stats_list, list) {
+                if ((new_stat->dev == napi->dev)  &&
+                    (napi->dev->stats.rx_dropped != new_stat->last_drop_val)) {
+                        trace_drop_common(NULL, NULL);
+                        new_stat->last_drop_val = napi->dev->stats.rx_dropped;
+                        break;
+                }
+        }
+        rcu_read_unlock();
+}
+
+
+static void free_dm_hw_stat(struct rcu_head *head)
+{
+        struct dm_hw_stat_delta *n;
+        n = container_of(head, struct dm_hw_stat_delta, rcu);
+        kfree(n);
+}
+
 static int set_all_monitor_traces(int state)
 {
         int rc = 0;
+        struct dm_hw_stat_delta *new_stat = NULL;
+        struct dm_hw_stat_delta *temp;
+
+        spin_lock(&trace_state_lock);
 
         switch (state) {
         case TRACE_ON:
                 rc |= register_trace_kfree_skb(trace_kfree_skb_hit);
+                rc |= register_trace_napi_poll(trace_napi_poll_hit);
                 break;
         case TRACE_OFF:
                 rc |= unregister_trace_kfree_skb(trace_kfree_skb_hit);
+                rc |= unregister_trace_napi_poll(trace_napi_poll_hit);
 
                 tracepoint_synchronize_unregister();
+
+                /*
+                 * Clean the device list
+                 */
+                list_for_each_entry_safe(new_stat, temp, &hw_stats_list, list) {
+                        if (new_stat->dev == NULL) {
+                                list_del_rcu(&new_stat->list);
+                                call_rcu(&new_stat->rcu, free_dm_hw_stat);
+                        }
+                }
                 break;
         default:
                 rc = 1;
                 break;
         }
 
+        if (!rc)
+                trace_state = state;
+
+        spin_unlock(&trace_state_lock);
+
         if (rc)
                 return -EINPROGRESS;
         return rc;
@@ -197,6 +271,44 @@ static int net_dm_cmd_trace(struct sk_buff *skb,
         return -ENOTSUPP;
 }
 
+static int dropmon_net_event(struct notifier_block *ev_block,
+                        unsigned long event, void *ptr)
+{
+        struct net_device *dev = ptr;
+        struct dm_hw_stat_delta *new_stat = NULL;
+        struct dm_hw_stat_delta *tmp;
+
+        switch (event) {
+        case NETDEV_REGISTER:
+                new_stat = kzalloc(sizeof(struct dm_hw_stat_delta), GFP_KERNEL);
+
+                if (!new_stat)
+                        goto out;
+
+                new_stat->dev = dev;
+                INIT_RCU_HEAD(&new_stat->rcu);
+                spin_lock(&trace_state_lock);
+                list_add_rcu(&new_stat->list, &hw_stats_list);
+                spin_unlock(&trace_state_lock);
+                break;
+        case NETDEV_UNREGISTER:
+                spin_lock(&trace_state_lock);
+                list_for_each_entry_safe(new_stat, tmp, &hw_stats_list, list) {
+                        if (new_stat->dev == dev) {
+                                new_stat->dev = NULL;
+                                if (trace_state == TRACE_OFF) {
+                                        list_del_rcu(&new_stat->list);
+                                        call_rcu(&new_stat->rcu, free_dm_hw_stat);
+                                        break;
+                                }
+                        }
+                }
+                spin_unlock(&trace_state_lock);
+                break;
+        }
+out:
+        return NOTIFY_DONE;
+}
 
 static struct genl_ops dropmon_ops[] = {
         {
@@ -213,6 +325,10 @@ static struct genl_ops dropmon_ops[] = {
         },
 };
 
+static struct notifier_block dropmon_net_notifier = {
+        .notifier_call = dropmon_net_event
+};
+
 static int __init init_net_drop_monitor(void)
 {
         int cpu;
@@ -236,12 +352,18 @@ static int __init init_net_drop_monitor(void)
                 ret = genl_register_ops(&net_drop_monitor_family,
                                         &dropmon_ops[i]);
                 if (ret) {
-                        printk(KERN_CRIT "failed to register operation %d\n",
+                        printk(KERN_CRIT "Failed to register operation %d\n",
                                 dropmon_ops[i].cmd);
                         goto out_unreg;
                 }
         }
 
+        rc = register_netdevice_notifier(&dropmon_net_notifier);
+        if (rc < 0) {
+                printk(KERN_CRIT "Failed to register netdevice notifier\n");
+                goto out_unreg;
+        }
+
         rc = 0;
 
         for_each_present_cpu(cpu) {
@@ -252,6 +374,7 @@ static int __init init_net_drop_monitor(void)
                 data->send_timer.data = cpu;
                 data->send_timer.function = sched_send_work;
         }
+
         goto out;
 
 out_unreg:
diff --git a/net/core/fib_rules.c b/net/core/fib_rules.c
index 98691e1466b8..bd309384f8b8 100644
--- a/net/core/fib_rules.c
+++ b/net/core/fib_rules.c
@@ -299,7 +299,7 @@ static int fib_nl_newrule(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
         } else if (rule->action == FR_ACT_GOTO)
                 goto errout_free;
 
-        err = ops->configure(rule, skb, nlh, frh, tb);
+        err = ops->configure(rule, skb, frh, tb);
         if (err < 0)
                 goto errout_free;
 
@@ -500,7 +500,7 @@ static int fib_nl_fill_rule(struct sk_buff *skb, struct fib_rule *rule,
         if (rule->target)
                 NLA_PUT_U32(skb, FRA_GOTO, rule->target);
 
-        if (ops->fill(rule, skb, nlh, frh) < 0)
+        if (ops->fill(rule, skb, frh) < 0)
                 goto nla_put_failure;
 
         return nlmsg_end(skb, nlh);
diff --git a/net/core/gen_estimator.c b/net/core/gen_estimator.c
index 6d62d4618cfc..78e5bfc454ae 100644
--- a/net/core/gen_estimator.c
+++ b/net/core/gen_estimator.c
@@ -128,12 +128,12 @@ static void est_timer(unsigned long arg)
                 npackets = e->bstats->packets;
                 brate = (nbytes - e->last_bytes)<<(7 - idx);
                 e->last_bytes = nbytes;
-                e->avbps += ((s64)(brate - e->avbps)) >> e->ewma_log;
+                e->avbps += (brate >> e->ewma_log) - (e->avbps >> e->ewma_log);
                 e->rate_est->bps = (e->avbps+0xF)>>5;
 
                 rate = (npackets - e->last_packets)<<(12 - idx);
                 e->last_packets = npackets;
-                e->avpps += ((long)rate - (long)e->avpps) >> e->ewma_log;
+                e->avpps += (rate >> e->ewma_log) - (e->avpps >> e->ewma_log);
                 e->rate_est->pps = (e->avpps+0x1FF)>>10;
 skip:
                 read_unlock(&est_lock);
diff --git a/net/core/iovec.c b/net/core/iovec.c
index 4c9c0121c9da..40a76ce19d9f 100644
--- a/net/core/iovec.c
+++ b/net/core/iovec.c
@@ -98,6 +98,31 @@ int memcpy_toiovec(struct iovec *iov, unsigned char *kdata, int len)
 }
 
 /*
+ *      Copy kernel to iovec. Returns -EFAULT on error.
+ */
+
+int memcpy_toiovecend(const struct iovec *iov, unsigned char *kdata,
+                      int offset, int len)
+{
+        int copy;
+        for (; len > 0; ++iov) {
+                /* Skip over the finished iovecs */
+                if (unlikely(offset >= iov->iov_len)) {
+                        offset -= iov->iov_len;
+                        continue;
+                }
+                copy = min_t(unsigned int, iov->iov_len - offset, len);
+                offset = 0;
+                if (copy_to_user(iov->iov_base, kdata, copy))
+                        return -EFAULT;
+                kdata += copy;
+                len -= copy;
+        }
+
+        return 0;
+}
+
+/*
  *      Copy iovec to kernel. Returns -EFAULT on error.
  *
  *      Note: this modifies the original iovec.
@@ -122,10 +147,11 @@ int memcpy_fromiovec(unsigned char *kdata, struct iovec *iov, int len)
 }
 
 /*
- *      For use with ip_build_xmit
+ *      Copy iovec from kernel. Returns -EFAULT on error.
  */
-int memcpy_fromiovecend(unsigned char *kdata, struct iovec *iov, int offset,
-                        int len)
+
+int memcpy_fromiovecend(unsigned char *kdata, const struct iovec *iov,
+                        int offset, int len)
 {
         /* Skip over the finished iovecs */
         while (offset >= iov->iov_len) {
@@ -236,3 +262,4 @@ EXPORT_SYMBOL(csum_partial_copy_fromiovecend);
 EXPORT_SYMBOL(memcpy_fromiovec);
 EXPORT_SYMBOL(memcpy_fromiovecend);
 EXPORT_SYMBOL(memcpy_toiovec);
+EXPORT_SYMBOL(memcpy_toiovecend);
diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
index 2da59a0ac4ac..3994680c08b9 100644
--- a/net/core/net-sysfs.c
+++ b/net/core/net-sysfs.c
@@ -78,7 +78,7 @@ static ssize_t netdev_store(struct device *dev, struct device_attribute *attr,
                 goto err;
 
         if (!rtnl_trylock())
-                return -ERESTARTSYS;
+                return restart_syscall();
 
         if (dev_isalive(net)) {
                 if ((ret = (*set)(net, new)) == 0)
@@ -225,7 +225,8 @@ static ssize_t store_ifalias(struct device *dev, struct device_attribute *attr,
         if (len >  0 && buf[len - 1] == '\n')
                 --count;
 
-        rtnl_lock();
+        if (!rtnl_trylock())
+                return restart_syscall();
         ret = dev_set_alias(netdev, buf, count);
         rtnl_unlock();
 
@@ -238,7 +239,8 @@ static ssize_t show_ifalias(struct device *dev,
         const struct net_device *netdev = to_net_dev(dev);
         ssize_t ret = 0;
 
-        rtnl_lock();
+        if (!rtnl_trylock())
+                return restart_syscall();
         if (netdev->ifalias)
                 ret = sprintf(buf, "%s\n", netdev->ifalias);
         rtnl_unlock();
@@ -497,7 +499,6 @@ int netdev_register_kobject(struct net_device *net)
         dev->platform_data = net;
         dev->groups = groups;
 
-        BUILD_BUG_ON(BUS_ID_SIZE < IFNAMSIZ);
         dev_set_name(dev, "%s", net->name);
 
 #ifdef CONFIG_SYSFS
diff --git a/net/core/net-traces.c b/net/core/net-traces.c
index c8fb45665e4f..b07b25bd2cde 100644
--- a/net/core/net-traces.c
+++ b/net/core/net-traces.c
@@ -20,6 +20,7 @@
 #include <linux/netlink.h>
 #include <linux/net_dropmon.h>
 #include <trace/skb.h>
+#include <trace/napi.h>
 
 #include <asm/unaligned.h>
 #include <asm/bitops.h>
@@ -27,3 +28,6 @@
 
 DEFINE_TRACE(kfree_skb);
 EXPORT_TRACEPOINT_SYMBOL_GPL(kfree_skb);
+
+DEFINE_TRACE(napi_poll);
+EXPORT_TRACEPOINT_SYMBOL_GPL(napi_poll);
diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
index e3bebd36f053..b7292a2719dc 100644
--- a/net/core/net_namespace.c
+++ b/net/core/net_namespace.c
@@ -115,41 +115,34 @@ static void net_free(struct net *net)
         kmem_cache_free(net_cachep, net);
 }
 
-struct net *copy_net_ns(unsigned long flags, struct net *old_net)
+static struct net *net_create(void)
 {
-        struct net *new_net = NULL;
-        int err;
-
-        get_net(old_net);
-
-        if (!(flags & CLONE_NEWNET))
-                return old_net;
-
-        err = -ENOMEM;
-        new_net = net_alloc();
-        if (!new_net)
-                goto out_err;
+        struct net *net;
+        int rv;
 
+        net = net_alloc();
+        if (!net)
+                return ERR_PTR(-ENOMEM);
         mutex_lock(&net_mutex);
-        err = setup_net(new_net);
-        if (!err) {
+        rv = setup_net(net);
+        if (rv == 0) {
                 rtnl_lock();
-                list_add_tail(&new_net->list, &net_namespace_list);
+                list_add_tail(&net->list, &net_namespace_list);
                 rtnl_unlock();
         }
         mutex_unlock(&net_mutex);
+        if (rv < 0) {
+                net_free(net);
+                return ERR_PTR(rv);
+        }
+        return net;
+}
 
-        if (err)
-                goto out_free;
-out:
-        put_net(old_net);
-        return new_net;
-
-out_free:
-        net_free(new_net);
-out_err:
-        new_net = ERR_PTR(err);
-        goto out;
+struct net *copy_net_ns(unsigned long flags, struct net *old_net)
+{
+        if (!(flags & CLONE_NEWNET))
+                return get_net(old_net);
+        return net_create();
 }
 
 static void cleanup_net(struct work_struct *work)
@@ -203,9 +196,7 @@ struct net *copy_net_ns(unsigned long flags, struct net *old_net)
 static int __init net_ns_init(void)
 {
         struct net_generic *ng;
-        int err;
 
-        printk(KERN_INFO "net_namespace: %zd bytes\n", sizeof(struct net));
 #ifdef CONFIG_NET_NS
         net_cachep = kmem_cache_create("net_namespace", sizeof(struct net),
                                         SMP_CACHE_BYTES,
@@ -224,15 +215,14 @@ static int __init net_ns_init(void)
         rcu_assign_pointer(init_net.gen, ng);
 
         mutex_lock(&net_mutex);
-        err = setup_net(&init_net);
+        if (setup_net(&init_net))
+                panic("Could not setup the initial network namespace");
 
         rtnl_lock();
         list_add_tail(&init_net.list, &net_namespace_list);
         rtnl_unlock();
 
         mutex_unlock(&net_mutex);
-        if (err)
-                panic("Could not setup the initial network namespace");
 
         return 0;
 }
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index 64f51eec6576..7ab31a7576a1 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -24,6 +24,7 @@
 #include <net/tcp.h>
 #include <net/udp.h>
 #include <asm/unaligned.h>
+#include <trace/napi.h>
 
 /*
  * We maintain a small pool of fully-sized skbs, to make sure the
@@ -137,6 +138,7 @@ static int poll_one_napi(struct netpoll_info *npinfo,
         set_bit(NAPI_STATE_NPSVC, &napi->state);
 
         work = napi->poll(napi, budget);
+        trace_napi_poll(napi);
 
         clear_bit(NAPI_STATE_NPSVC, &napi->state);
         atomic_dec(&trapped);
@@ -300,8 +302,11 @@ static void netpoll_send_skb(struct netpoll *np, struct sk_buff *skb)
                 for (tries = jiffies_to_usecs(1)/USEC_PER_POLL;
                      tries > 0; --tries) {
                         if (__netif_tx_trylock(txq)) {
-                                if (!netif_tx_queue_stopped(txq))
+                                if (!netif_tx_queue_stopped(txq)) {
                                         status = ops->ndo_start_xmit(skb, dev);
+                                        if (status == NETDEV_TX_OK)
+                                                txq_trans_update(txq);
+                                }
                                 __netif_tx_unlock(txq);
 
                                 if (status == NETDEV_TX_OK)
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index 0666a827bc62..b8ccd3c88d63 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -3438,6 +3438,7 @@ static __inline__ void pktgen_xmit(struct pktgen_dev *pkt_dev)
               retry_now:
                 ret = (*xmit)(pkt_dev->skb, odev);
                 if (likely(ret == NETDEV_TX_OK)) {
+                        txq_trans_update(txq);
                         pkt_dev->last_ok = 1;
                         pkt_dev->sofar++;
                         pkt_dev->seq_num++;
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index e505b5392e1e..8e815e685f28 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -526,8 +526,7 @@ static void __copy_skb_header(struct sk_buff *new, const struct sk_buff *old)
         new->sp                 = secpath_get(old->sp);
 #endif
         memcpy(new->cb, old->cb, sizeof(old->cb));
-        new->csum_start         = old->csum_start;
-        new->csum_offset        = old->csum_offset;
+        new->csum               = old->csum;
         new->local_df           = old->local_df;
         new->pkt_type           = old->pkt_type;
         new->ip_summed          = old->ip_summed;
@@ -538,6 +537,7 @@ static void __copy_skb_header(struct sk_buff *new, const struct sk_buff *old)
 #endif
         new->protocol           = old->protocol;
         new->mark               = old->mark;
+        new->iif                = old->iif;
         __nf_copy(new, old);
 #if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \
     defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE)
@@ -550,10 +550,18 @@ static void __copy_skb_header(struct sk_buff *new, const struct sk_buff *old)
 #endif
 #endif
         new->vlan_tci           = old->vlan_tci;
+#if defined(CONFIG_MAC80211) || defined(CONFIG_MAC80211_MODULE)
+        new->do_not_encrypt     = old->do_not_encrypt;
+        new->requeue            = old->requeue;
+#endif
 
         skb_copy_secmark(new, old);
 }
 
+/*
+ * You should not add any new code to this function.  Add it to
+ * __copy_skb_header above instead.
+ */
 static struct sk_buff *__skb_clone(struct sk_buff *n, struct sk_buff *skb)
 {
 #define C(x) n->x = skb->x
@@ -569,16 +577,11 @@ static struct sk_buff *__skb_clone(struct sk_buff *n, struct sk_buff *skb)
         n->cloned = 1;
         n->nohdr = 0;
         n->destructor = NULL;
-        C(iif);
         C(tail);
         C(end);
         C(head);
         C(data);
         C(truesize);
-#if defined(CONFIG_MAC80211) || defined(CONFIG_MAC80211_MODULE)
-        C(do_not_encrypt);
-        C(requeue);
-#endif
         atomic_set(&n->users, 1);
 
         atomic_inc(&(skb_shinfo(skb)->dataref));
@@ -2661,30 +2664,40 @@ int skb_gro_receive(struct sk_buff **head, struct sk_buff *skb)
 {
         struct sk_buff *p = *head;
         struct sk_buff *nskb;
+        struct skb_shared_info *skbinfo = skb_shinfo(skb);
+        struct skb_shared_info *pinfo = skb_shinfo(p);
         unsigned int headroom;
         unsigned int len = skb_gro_len(skb);
+        unsigned int offset = skb_gro_offset(skb);
+        unsigned int headlen = skb_headlen(skb);
 
         if (p->len + len >= 65536)
                 return -E2BIG;
 
-        if (skb_shinfo(p)->frag_list)
+        if (pinfo->frag_list)
                 goto merge;
-        else if (skb_headlen(skb) <= skb_gro_offset(skb)) {
-                if (skb_shinfo(p)->nr_frags + skb_shinfo(skb)->nr_frags >
-                    MAX_SKB_FRAGS)
+        else if (headlen <= offset) {
+                skb_frag_t *frag;
+                skb_frag_t *frag2;
+                int i = skbinfo->nr_frags;
+                int nr_frags = pinfo->nr_frags + i;
+
+                offset -= headlen;
+
+                if (nr_frags > MAX_SKB_FRAGS)
                         return -E2BIG;
 
-                skb_shinfo(skb)->frags[0].page_offset +=
-                        skb_gro_offset(skb) - skb_headlen(skb);
-                skb_shinfo(skb)->frags[0].size -=
-                        skb_gro_offset(skb) - skb_headlen(skb);
+                pinfo->nr_frags = nr_frags;
+                skbinfo->nr_frags = 0;
 
-                memcpy(skb_shinfo(p)->frags + skb_shinfo(p)->nr_frags,
-                       skb_shinfo(skb)->frags,
-                       skb_shinfo(skb)->nr_frags * sizeof(skb_frag_t));
+                frag = pinfo->frags + nr_frags;
+                frag2 = skbinfo->frags + i;
+                do {
+                        *--frag = *--frag2;
+                } while (--i);
 
-                skb_shinfo(p)->nr_frags += skb_shinfo(skb)->nr_frags;
-                skb_shinfo(skb)->nr_frags = 0;
+                frag->page_offset += offset;
+                frag->size -= offset;
 
                 skb->truesize -= skb->data_len;
                 skb->len -= skb->data_len;
@@ -2715,7 +2728,7 @@ int skb_gro_receive(struct sk_buff **head, struct sk_buff *skb)
 
         *NAPI_GRO_CB(nskb) = *NAPI_GRO_CB(p);
         skb_shinfo(nskb)->frag_list = p;
-        skb_shinfo(nskb)->gso_size = skb_shinfo(p)->gso_size;
+        skb_shinfo(nskb)->gso_size = pinfo->gso_size;
         skb_header_release(p);
         nskb->prev = p;
 
@@ -2730,16 +2743,13 @@ int skb_gro_receive(struct sk_buff **head, struct sk_buff *skb)
         p = nskb;
 
 merge:
-        if (skb_gro_offset(skb) > skb_headlen(skb)) {
-                skb_shinfo(skb)->frags[0].page_offset +=
-                        skb_gro_offset(skb) - skb_headlen(skb);
-                skb_shinfo(skb)->frags[0].size -=
-                        skb_gro_offset(skb) - skb_headlen(skb);
-                skb_gro_reset_offset(skb);
-                skb_gro_pull(skb, skb_headlen(skb));
+        if (offset > headlen) {
+                skbinfo->frags[0].page_offset += offset - headlen;
+                skbinfo->frags[0].size -= offset - headlen;
+                offset = headlen;
         }
 
-        __skb_pull(skb, skb_gro_offset(skb));
+        __skb_pull(skb, offset);
 
         p->prev->next = skb;
         p->prev = skb;
diff --git a/net/core/sock.c b/net/core/sock.c
index 7dbf3ffb35cc..58dec9dff99a 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -212,6 +212,7 @@ __u32 sysctl_rmem_default __read_mostly = SK_RMEM_MAX;
 
 /* Maximal space eaten by iovec or ancilliary data plus some space */
 int sysctl_optmem_max __read_mostly = sizeof(unsigned long)*(2*UIO_MAXIOV+512);
+EXPORT_SYMBOL(sysctl_optmem_max);
 
 static int sock_set_timeout(long *timeo_p, char __user *optval, int optlen)
 {
@@ -444,7 +445,7 @@ static inline void sock_valbool_flag(struct sock *sk, int bit, int valbool)
 int sock_setsockopt(struct socket *sock, int level, int optname,
                     char __user *optval, int optlen)
 {
-        struct sock *sk=sock->sk;
+        struct sock *sk = sock->sk;
         int val;
         int valbool;
         struct linger ling;
@@ -463,15 +464,15 @@ int sock_setsockopt(struct socket *sock, int level, int optname,
         if (get_user(val, (int __user *)optval))
                 return -EFAULT;
 
-        valbool = val?1:0;
+        valbool = val ? 1 : 0;
 
         lock_sock(sk);
 
-        switch(optname) {
+        switch (optname) {
         case SO_DEBUG:
-                if (val && !capable(CAP_NET_ADMIN)) {
+                if (val && !capable(CAP_NET_ADMIN))
                         ret = -EACCES;
-                } else
+                else
                         sock_valbool_flag(sk, SOCK_DBG, valbool);
                 break;
         case SO_REUSEADDR:
@@ -582,7 +583,7 @@ set_rcvbuf:
                         ret = -EINVAL;  /* 1003.1g */
                         break;
                 }
-                if (copy_from_user(&ling,optval,sizeof(ling))) {
+                if (copy_from_user(&ling, optval, sizeof(ling))) {
                         ret = -EFAULT;
                         break;
                 }
@@ -690,9 +691,8 @@ set_rcvbuf:
         case SO_MARK:
                 if (!capable(CAP_NET_ADMIN))
                         ret = -EPERM;
-                else {
+                else
                         sk->sk_mark = val;
-                }
                 break;
 
                 /* We implement the SO_SNDLOWAT etc to
@@ -704,6 +704,7 @@ set_rcvbuf:
         release_sock(sk);
         return ret;
 }
+EXPORT_SYMBOL(sock_setsockopt);
 
 
 int sock_getsockopt(struct socket *sock, int level, int optname,
@@ -727,7 +728,7 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
 
         memset(&v, 0, sizeof(v));
 
-        switch(optname) {
+        switch (optname) {
         case SO_DEBUG:
                 v.val = sock_flag(sk, SOCK_DBG);
                 break;
@@ -762,7 +763,7 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
 
         case SO_ERROR:
                 v.val = -sock_error(sk);
-                if (v.val==0)
+                if (v.val == 0)
                         v.val = xchg(&sk->sk_err_soft, 0);
                 break;
 
@@ -816,7 +817,7 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
                 break;
 
         case SO_RCVTIMEO:
-                lv=sizeof(struct timeval);
+                lv = sizeof(struct timeval);
                 if (sk->sk_rcvtimeo == MAX_SCHEDULE_TIMEOUT) {
                         v.tm.tv_sec = 0;
                         v.tm.tv_usec = 0;
@@ -827,7 +828,7 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
                 break;
 
         case SO_SNDTIMEO:
-                lv=sizeof(struct timeval);
+                lv = sizeof(struct timeval);
                 if (sk->sk_sndtimeo == MAX_SCHEDULE_TIMEOUT) {
                         v.tm.tv_sec = 0;
                         v.tm.tv_usec = 0;
@@ -842,7 +843,7 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
                 break;
 
         case SO_SNDLOWAT:
-                v.val=1;
+                v.val = 1;
                 break;
 
         case SO_PASSCRED:
@@ -1002,6 +1003,7 @@ struct sock *sk_alloc(struct net *net, int family, gfp_t priority,
 
         return sk;
 }
+EXPORT_SYMBOL(sk_alloc);
 
 void sk_free(struct sock *sk)
 {
@@ -1026,6 +1028,7 @@ void sk_free(struct sock *sk)
         put_net(sock_net(sk));
         sk_prot_free(sk->sk_prot_creator, sk);
 }
+EXPORT_SYMBOL(sk_free);
 
 /*
  * Last sock_put should drop referrence to sk->sk_net. It has already
@@ -1126,7 +1129,6 @@ struct sock *sk_clone(const struct sock *sk, const gfp_t priority)
 out:
         return newsk;
 }
-
 EXPORT_SYMBOL_GPL(sk_clone);
 
 void sk_setup_caps(struct sock *sk, struct dst_entry *dst)
@@ -1177,6 +1179,7 @@ void sock_wfree(struct sk_buff *skb)
                 sk->sk_write_space(sk);
         sock_put(sk);
 }
+EXPORT_SYMBOL(sock_wfree);
 
 /*
  * Read buffer destructor automatically called from kfree_skb.
@@ -1188,6 +1191,7 @@ void sock_rfree(struct sk_buff *skb)
         atomic_sub(skb->truesize, &sk->sk_rmem_alloc);
         sk_mem_uncharge(skb->sk, skb->truesize);
 }
+EXPORT_SYMBOL(sock_rfree);
 
 
 int sock_i_uid(struct sock *sk)
@@ -1199,6 +1203,7 @@ int sock_i_uid(struct sock *sk)
         read_unlock(&sk->sk_callback_lock);
         return uid;
 }
+EXPORT_SYMBOL(sock_i_uid);
 
 unsigned long sock_i_ino(struct sock *sk)
 {
@@ -1209,6 +1214,7 @@ unsigned long sock_i_ino(struct sock *sk)
         read_unlock(&sk->sk_callback_lock);
         return ino;
 }
+EXPORT_SYMBOL(sock_i_ino);
 
 /*
  * Allocate a skb from the socket's send buffer.
@@ -1217,7 +1223,7 @@ struct sk_buff *sock_wmalloc(struct sock *sk, unsigned long size, int force,
                              gfp_t priority)
 {
         if (force || atomic_read(&sk->sk_wmem_alloc) < sk->sk_sndbuf) {
-                struct sk_buff * skb = alloc_skb(size, priority);
+                struct sk_buff *skb = alloc_skb(size, priority);
                 if (skb) {
                         skb_set_owner_w(skb, sk);
                         return skb;
@@ -1225,6 +1231,7 @@ struct sk_buff *sock_wmalloc(struct sock *sk, unsigned long size, int force,
         }
         return NULL;
 }
+EXPORT_SYMBOL(sock_wmalloc);
 
 /*
  * Allocate a skb from the socket's receive buffer.
@@ -1261,6 +1268,7 @@ void *sock_kmalloc(struct sock *sk, int size, gfp_t priority)
         }
         return NULL;
 }
+EXPORT_SYMBOL(sock_kmalloc);
 
 /*
  * Free an option memory block.
@@ -1270,11 +1278,12 @@ void sock_kfree_s(struct sock *sk, void *mem, int size)
         kfree(mem);
         atomic_sub(size, &sk->sk_omem_alloc);
 }
+EXPORT_SYMBOL(sock_kfree_s);
 
 /* It is almost wait_for_tcp_memory minus release_sock/lock_sock.
    I think, these locks should be removed for datagram sockets.
  */
-static long sock_wait_for_wmem(struct sock * sk, long timeo)
+static long sock_wait_for_wmem(struct sock *sk, long timeo)
 {
         DEFINE_WAIT(wait);
 
@@ -1392,6 +1401,7 @@ struct sk_buff *sock_alloc_send_skb(struct sock *sk, unsigned long size,
 {
         return sock_alloc_send_pskb(sk, size, 0, noblock, errcode);
 }
+EXPORT_SYMBOL(sock_alloc_send_skb);
 
 static void __lock_sock(struct sock *sk)
 {
@@ -1460,7 +1470,6 @@ int sk_wait_data(struct sock *sk, long *timeo)
         finish_wait(sk->sk_sleep, &wait);
         return rc;
 }
-
 EXPORT_SYMBOL(sk_wait_data);
 
 /**
@@ -1541,7 +1550,6 @@ suppress_allocation:
         atomic_sub(amt, prot->memory_allocated);
         return 0;
 }
-
 EXPORT_SYMBOL(__sk_mem_schedule);
 
 /**
@@ -1560,7 +1568,6 @@ void __sk_mem_reclaim(struct sock *sk)
             (atomic_read(prot->memory_allocated) < prot->sysctl_mem[0]))
                 *prot->memory_pressure = 0;
 }
-
 EXPORT_SYMBOL(__sk_mem_reclaim);
 
 
@@ -1575,78 +1582,92 @@ int sock_no_bind(struct socket *sock, struct sockaddr *saddr, int len)
 {
         return -EOPNOTSUPP;
 }
+EXPORT_SYMBOL(sock_no_bind);
 
 int sock_no_connect(struct socket *sock, struct sockaddr *saddr,
                     int len, int flags)
 {
         return -EOPNOTSUPP;
 }
+EXPORT_SYMBOL(sock_no_connect);
 
 int sock_no_socketpair(struct socket *sock1, struct socket *sock2)
 {
         return -EOPNOTSUPP;
 }
+EXPORT_SYMBOL(sock_no_socketpair);
 
 int sock_no_accept(struct socket *sock, struct socket *newsock, int flags)
 {
         return -EOPNOTSUPP;
 }
+EXPORT_SYMBOL(sock_no_accept);
 
 int sock_no_getname(struct socket *sock, struct sockaddr *saddr,
                     int *len, int peer)
 {
         return -EOPNOTSUPP;
 }
+EXPORT_SYMBOL(sock_no_getname);
 
-unsigned int sock_no_poll(struct file * file, struct socket *sock, poll_table *pt)
+unsigned int sock_no_poll(struct file *file, struct socket *sock, poll_table *pt)
 {
         return 0;
 }
+EXPORT_SYMBOL(sock_no_poll);
 
 int sock_no_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
 {
         return -EOPNOTSUPP;
 }
+EXPORT_SYMBOL(sock_no_ioctl);
 
 int sock_no_listen(struct socket *sock, int backlog)
 {
         return -EOPNOTSUPP;
 }
+EXPORT_SYMBOL(sock_no_listen);
 
 int sock_no_shutdown(struct socket *sock, int how)
 {
         return -EOPNOTSUPP;
 }
+EXPORT_SYMBOL(sock_no_shutdown);
 
 int sock_no_setsockopt(struct socket *sock, int level, int optname,
                     char __user *optval, int optlen)
 {
         return -EOPNOTSUPP;
 }
+EXPORT_SYMBOL(sock_no_setsockopt);
 
 int sock_no_getsockopt(struct socket *sock, int level, int optname,
                     char __user *optval, int __user *optlen)
 {
         return -EOPNOTSUPP;
 }
+EXPORT_SYMBOL(sock_no_getsockopt);
 
 int sock_no_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *m,
                     size_t len)
 {
         return -EOPNOTSUPP;
 }
+EXPORT_SYMBOL(sock_no_sendmsg);
 
 int sock_no_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *m,
                     size_t len, int flags)
 {
         return -EOPNOTSUPP;
 }
+EXPORT_SYMBOL(sock_no_recvmsg);
 
 int sock_no_mmap(struct file *file, struct socket *sock, struct vm_area_struct *vma)
 {
         /* Mirror missing mmap method error code */
         return -ENODEV;
 }
+EXPORT_SYMBOL(sock_no_mmap);
 
 ssize_t sock_no_sendpage(struct socket *sock, struct page *page, int offset, size_t size, int flags)
 {
@@ -1660,6 +1681,7 @@ ssize_t sock_no_sendpage(struct socket *sock, struct page *page, int offset, siz
         kunmap(page);
         return res;
 }
+EXPORT_SYMBOL(sock_no_sendpage);
 
 /*
  *      Default Socket Callbacks
@@ -1723,6 +1745,7 @@ void sk_send_sigurg(struct sock *sk)
                 if (send_sigurg(&sk->sk_socket->file->f_owner))
                         sk_wake_async(sk, SOCK_WAKE_URG, POLL_PRI);
 }
+EXPORT_SYMBOL(sk_send_sigurg);
 
 void sk_reset_timer(struct sock *sk, struct timer_list* timer,
                     unsigned long expires)
@@ -1730,7 +1753,6 @@ void sk_reset_timer(struct sock *sk, struct timer_list* timer,
         if (!mod_timer(timer, expires))
                 sock_hold(sk);
 }
-
 EXPORT_SYMBOL(sk_reset_timer);
 
 void sk_stop_timer(struct sock *sk, struct timer_list* timer)
@@ -1738,7 +1760,6 @@ void sk_stop_timer(struct sock *sk, struct timer_list* timer)
         if (timer_pending(timer) && del_timer(timer))
                 __sock_put(sk);
 }
-
 EXPORT_SYMBOL(sk_stop_timer);
 
 void sock_init_data(struct socket *sock, struct sock *sk)
@@ -1797,6 +1818,7 @@ void sock_init_data(struct socket *sock, struct sock *sk)
         atomic_set(&sk->sk_refcnt, 1);
         atomic_set(&sk->sk_drops, 0);
 }
+EXPORT_SYMBOL(sock_init_data);
 
 void lock_sock_nested(struct sock *sk, int subclass)
 {
@@ -1812,7 +1834,6 @@ void lock_sock_nested(struct sock *sk, int subclass)
         mutex_acquire(&sk->sk_lock.dep_map, subclass, 0, _RET_IP_);
         local_bh_enable();
 }
-
 EXPORT_SYMBOL(lock_sock_nested);
 
 void release_sock(struct sock *sk)
@@ -1895,7 +1916,6 @@ int sock_common_getsockopt(struct socket *sock, int level, int optname,
 
         return sk->sk_prot->getsockopt(sk, level, optname, optval, optlen);
 }
-
 EXPORT_SYMBOL(sock_common_getsockopt);
 
 #ifdef CONFIG_COMPAT
@@ -1925,7 +1945,6 @@ int sock_common_recvmsg(struct kiocb *iocb, struct socket *sock,
                 msg->msg_namelen = addr_len;
         return err;
 }
-
 EXPORT_SYMBOL(sock_common_recvmsg);
 
 /*
@@ -1938,7 +1957,6 @@ int sock_common_setsockopt(struct socket *sock, int level, int optname,
 
         return sk->sk_prot->setsockopt(sk, level, optname, optval, optlen);
 }
-
 EXPORT_SYMBOL(sock_common_setsockopt);
 
 #ifdef CONFIG_COMPAT
@@ -1989,7 +2007,6 @@ void sk_common_release(struct sock *sk)
         sk_refcnt_debug_release(sk);
         sock_put(sk);
 }
-
 EXPORT_SYMBOL(sk_common_release);
 
 static DEFINE_RWLOCK(proto_list_lock);
@@ -2171,7 +2188,6 @@ out_free_sock_slab:
 out:
         return -ENOBUFS;
 }
-
 EXPORT_SYMBOL(proto_register);
 
 void proto_unregister(struct proto *prot)
@@ -2198,7 +2214,6 @@ void proto_unregister(struct proto *prot)
                 prot->twsk_prot->twsk_slab = NULL;
         }
 }
-
 EXPORT_SYMBOL(proto_unregister);
 
 #ifdef CONFIG_PROC_FS
@@ -2324,33 +2339,3 @@ static int __init proto_init(void)
 subsys_initcall(proto_init);
 
 #endif /* PROC_FS */
-
-EXPORT_SYMBOL(sk_alloc);
-EXPORT_SYMBOL(sk_free);
-EXPORT_SYMBOL(sk_send_sigurg);
-EXPORT_SYMBOL(sock_alloc_send_skb);
-EXPORT_SYMBOL(sock_init_data);
-EXPORT_SYMBOL(sock_kfree_s);
-EXPORT_SYMBOL(sock_kmalloc);
-EXPORT_SYMBOL(sock_no_accept);
-EXPORT_SYMBOL(sock_no_bind);
-EXPORT_SYMBOL(sock_no_connect);
-EXPORT_SYMBOL(sock_no_getname);
-EXPORT_SYMBOL(sock_no_getsockopt);
-EXPORT_SYMBOL(sock_no_ioctl);
-EXPORT_SYMBOL(sock_no_listen);
-EXPORT_SYMBOL(sock_no_mmap);
-EXPORT_SYMBOL(sock_no_poll);
-EXPORT_SYMBOL(sock_no_recvmsg);
-EXPORT_SYMBOL(sock_no_sendmsg);
-EXPORT_SYMBOL(sock_no_sendpage);
-EXPORT_SYMBOL(sock_no_setsockopt);
-EXPORT_SYMBOL(sock_no_shutdown);
-EXPORT_SYMBOL(sock_no_socketpair);
-EXPORT_SYMBOL(sock_rfree);
-EXPORT_SYMBOL(sock_setsockopt);
-EXPORT_SYMBOL(sock_wfree);
-EXPORT_SYMBOL(sock_wmalloc);
-EXPORT_SYMBOL(sock_i_uid);
-EXPORT_SYMBOL(sock_i_ino);
-EXPORT_SYMBOL(sysctl_optmem_max);
diff --git a/net/core/stream.c b/net/core/stream.c
index 8727cead64ad..a37debfeb1b2 100644
--- a/net/core/stream.c
+++ b/net/core/stream.c
@@ -33,7 +33,8 @@ void sk_stream_write_space(struct sock *sk)
                 clear_bit(SOCK_NOSPACE, &sock->flags);
 
                 if (sk->sk_sleep && waitqueue_active(sk->sk_sleep))
-                        wake_up_interruptible(sk->sk_sleep);
+                        wake_up_interruptible_poll(sk->sk_sleep, POLLOUT |
+                                                POLLWRNORM | POLLWRBAND);
                 if (sock->fasync_list && !(sk->sk_shutdown & SEND_SHUTDOWN))
                         sock_wake_async(sock, SOCK_WAKE_SPACE, POLL_OUT);
         }
diff --git a/net/decnet/af_decnet.c b/net/decnet/af_decnet.c
index 9647d911f916..bccb3887773e 100644
--- a/net/decnet/af_decnet.c
+++ b/net/decnet/af_decnet.c
@@ -1250,14 +1250,8 @@ static int dn_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
                 if (skb) {
                         amount = skb->len;
                 } else {
-                        skb = sk->sk_receive_queue.next;
-                        for (;;) {
-                                if (skb ==
-                                    (struct sk_buff *)&sk->sk_receive_queue)
-                                        break;
+                        skb_queue_walk(&sk->sk_receive_queue, skb)
                                 amount += skb->len;
-                                skb = skb->next;
-                        }
                 }
                 release_sock(sk);
                 err = put_user(amount, (int __user *)arg);
@@ -1644,13 +1638,13 @@ static int __dn_getsockopt(struct socket *sock, int level,int optname, char __us
 
 static int dn_data_ready(struct sock *sk, struct sk_buff_head *q, int flags, int target)
 {
-        struct sk_buff *skb = q->next;
+        struct sk_buff *skb;
         int len = 0;
 
         if (flags & MSG_OOB)
                 return !skb_queue_empty(q) ? 1 : 0;
 
-        while(skb != (struct sk_buff *)q) {
+        skb_queue_walk(q, skb) {
                 struct dn_skb_cb *cb = DN_SKB_CB(skb);
                 len += skb->len;
 
@@ -1666,8 +1660,6 @@ static int dn_data_ready(struct sock *sk, struct sk_buff_head *q, int flags, int
                 /* minimum data length for read exceeded */
                 if (len >= target)
                         return 1;
-
-                skb = skb->next;
         }
 
         return 0;
@@ -1683,7 +1675,7 @@ static int dn_recvmsg(struct kiocb *iocb, struct socket *sock,
         size_t target = size > 1 ? 1 : 0;
         size_t copied = 0;
         int rv = 0;
-        struct sk_buff *skb, *nskb;
+        struct sk_buff *skb, *n;
         struct dn_skb_cb *cb = NULL;
         unsigned char eor = 0;
         long timeo = sock_rcvtimeo(sk, flags & MSG_DONTWAIT);
@@ -1758,7 +1750,7 @@ static int dn_recvmsg(struct kiocb *iocb, struct socket *sock,
                 finish_wait(sk->sk_sleep, &wait);
         }
 
-        for(skb = queue->next; skb != (struct sk_buff *)queue; skb = nskb) {
+        skb_queue_walk_safe(queue, skb, n) {
                 unsigned int chunk = skb->len;
                 cb = DN_SKB_CB(skb);
 
@@ -1775,7 +1767,6 @@ static int dn_recvmsg(struct kiocb *iocb, struct socket *sock,
                         skb_pull(skb, chunk);
 
                 eor = cb->nsp_flags & 0x40;
-                nskb = skb->next;
 
                 if (skb->len == 0) {
                         skb_unlink(skb, queue);
diff --git a/net/decnet/dn_nsp_in.c b/net/decnet/dn_nsp_in.c
index 5d8a2a56fd39..932408dca86d 100644
--- a/net/decnet/dn_nsp_in.c
+++ b/net/decnet/dn_nsp_in.c
@@ -578,6 +578,7 @@ out:
 static __inline__ int dn_queue_skb(struct sock *sk, struct sk_buff *skb, int sig, struct sk_buff_head *queue)
 {
         int err;
+        int skb_len;
 
         /* Cast skb->rcvbuf to unsigned... It's pointless, but reduces
            number of warnings when compiling with -W --ANK
@@ -592,22 +593,12 @@ static __inline__ int dn_queue_skb(struct sock *sk, struct sk_buff *skb, int sig
         if (err)
                 goto out;
 
+        skb_len = skb->len;
         skb_set_owner_r(skb, sk);
         skb_queue_tail(queue, skb);
 
-        /* This code only runs from BH or BH protected context.
-         * Therefore the plain read_lock is ok here. -DaveM
-         */
-        read_lock(&sk->sk_callback_lock);
-        if (!sock_flag(sk, SOCK_DEAD)) {
-                struct socket *sock = sk->sk_socket;
-                wake_up_interruptible(sk->sk_sleep);
-                if (sock && sock->fasync_list &&
-                    !test_bit(SOCK_ASYNC_WAITDATA, &sock->flags))
-                        __kill_fasync(sock->fasync_list, sig,
-                                    (sig == SIGURG) ? POLL_PRI : POLL_IN);
-        }
-        read_unlock(&sk->sk_callback_lock);
+        if (!sock_flag(sk, SOCK_DEAD))
+                sk->sk_data_ready(sk, skb_len);
 out:
         return err;
 }
diff --git a/net/decnet/dn_nsp_out.c b/net/decnet/dn_nsp_out.c
index 2013c25b7f5a..da04f459337e 100644
--- a/net/decnet/dn_nsp_out.c
+++ b/net/decnet/dn_nsp_out.c
@@ -382,7 +382,7 @@ int dn_nsp_check_xmit_queue(struct sock *sk, struct sk_buff *skb, struct sk_buff
 {
         struct dn_skb_cb *cb = DN_SKB_CB(skb);
         struct dn_scp *scp = DN_SK(sk);
-        struct sk_buff *skb2, *list, *ack = NULL;
+        struct sk_buff *skb2, *n, *ack = NULL;
         int wakeup = 0;
         int try_retrans = 0;
         unsigned long reftime = cb->stamp;
@@ -390,9 +390,7 @@ int dn_nsp_check_xmit_queue(struct sock *sk, struct sk_buff *skb, struct sk_buff
         unsigned short xmit_count;
         unsigned short segnum;
 
-        skb2 = q->next;
-        list = (struct sk_buff *)q;
-        while(list != skb2) {
+        skb_queue_walk_safe(q, skb2, n) {
                 struct dn_skb_cb *cb2 = DN_SKB_CB(skb2);
 
                 if (dn_before_or_equal(cb2->segnum, acknum))
@@ -400,8 +398,6 @@ int dn_nsp_check_xmit_queue(struct sock *sk, struct sk_buff *skb, struct sk_buff
 
                 /* printk(KERN_DEBUG "ack: %s %04x %04x\n", ack ? "ACK" : "SKIP", (int)cb2->segnum, (int)acknum); */
 
-                skb2 = skb2->next;
-
                 if (ack == NULL)
                         continue;
 
diff --git a/net/decnet/dn_rules.c b/net/decnet/dn_rules.c
index 14fbca55e908..72495f25269f 100644
--- a/net/decnet/dn_rules.c
+++ b/net/decnet/dn_rules.c
@@ -115,7 +115,7 @@ static int dn_fib_rule_match(struct fib_rule *rule, struct flowi *fl, int flags)
 }
 
 static int dn_fib_rule_configure(struct fib_rule *rule, struct sk_buff *skb,
-                                 struct nlmsghdr *nlh, struct fib_rule_hdr *frh,
+                                 struct fib_rule_hdr *frh,
                                  struct nlattr **tb)
 {
         int err = -EINVAL;
@@ -192,7 +192,7 @@ unsigned dnet_addr_type(__le16 addr)
 }
 
 static int dn_fib_rule_fill(struct fib_rule *rule, struct sk_buff *skb,
-                            struct nlmsghdr *nlh, struct fib_rule_hdr *frh)
+                            struct fib_rule_hdr *frh)
 {
         struct dn_fib_rule *r = (struct dn_fib_rule *)rule;
 
diff --git a/net/dsa/slave.c b/net/dsa/slave.c
index ed131181215d..2175e6d5cc8d 100644
--- a/net/dsa/slave.c
+++ b/net/dsa/slave.c
@@ -67,7 +67,7 @@ static int dsa_slave_open(struct net_device *dev)
                 return -ENETDOWN;
 
         if (compare_ether_addr(dev->dev_addr, master->dev_addr)) {
-                err = dev_unicast_add(master, dev->dev_addr, ETH_ALEN);
+                err = dev_unicast_add(master, dev->dev_addr);
                 if (err < 0)
                         goto out;
         }
@@ -90,7 +90,7 @@ clear_allmulti:
                 dev_set_allmulti(master, -1);
 del_unicast:
         if (compare_ether_addr(dev->dev_addr, master->dev_addr))
-                dev_unicast_delete(master, dev->dev_addr, ETH_ALEN);
+                dev_unicast_delete(master, dev->dev_addr);
 out:
         return err;
 }
@@ -108,7 +108,7 @@ static int dsa_slave_close(struct net_device *dev)
                 dev_set_promiscuity(master, -1);
 
         if (compare_ether_addr(dev->dev_addr, master->dev_addr))
-                dev_unicast_delete(master, dev->dev_addr, ETH_ALEN);
+                dev_unicast_delete(master, dev->dev_addr);
 
         return 0;
 }
@@ -147,13 +147,13 @@ static int dsa_slave_set_mac_address(struct net_device *dev, void *a)
                 goto out;
 
         if (compare_ether_addr(addr->sa_data, master->dev_addr)) {
-                err = dev_unicast_add(master, addr->sa_data, ETH_ALEN);
+                err = dev_unicast_add(master, addr->sa_data);
                 if (err < 0)
                         return err;
         }
 
         if (compare_ether_addr(dev->dev_addr, master->dev_addr))
-                dev_unicast_delete(master, dev->dev_addr, ETH_ALEN);
+                dev_unicast_delete(master, dev->dev_addr);
 
 out:
         memcpy(dev->dev_addr, addr->sa_data, ETH_ALEN);
diff --git a/net/econet/af_econet.c b/net/econet/af_econet.c
index 6f479fa522c3..8121bf0029e3 100644
--- a/net/econet/af_econet.c
+++ b/net/econet/af_econet.c
@@ -901,15 +901,10 @@ static void aun_tx_ack(unsigned long seq, int result)
         struct ec_cb *eb;
 
         spin_lock_irqsave(&aun_queue_lock, flags);
-        skb = skb_peek(&aun_queue);
-        while (skb && skb != (struct sk_buff *)&aun_queue)
-        {
-                struct sk_buff *newskb = skb->next;
+        skb_queue_walk(&aun_queue, skb) {
                 eb = (struct ec_cb *)&skb->cb;
                 if (eb->seq == seq)
                         goto foundit;
-
-                skb = newskb;
         }
         spin_unlock_irqrestore(&aun_queue_lock, flags);
         printk(KERN_DEBUG "AUN: unknown sequence %ld\n", seq);
@@ -982,23 +977,18 @@ static void aun_data_available(struct sock *sk, int slen)
 
 static void ab_cleanup(unsigned long h)
 {
-        struct sk_buff *skb;
+        struct sk_buff *skb, *n;
         unsigned long flags;
 
         spin_lock_irqsave(&aun_queue_lock, flags);
-        skb = skb_peek(&aun_queue);
-        while (skb && skb != (struct sk_buff *)&aun_queue)
-        {
-                struct sk_buff *newskb = skb->next;
+        skb_queue_walk_safe(&aun_queue, skb, n) {
                 struct ec_cb *eb = (struct ec_cb *)&skb->cb;
-                if ((jiffies - eb->start) > eb->timeout)
-                {
+                if ((jiffies - eb->start) > eb->timeout) {
                         tx_result(skb->sk, eb->cookie,
                                   ECTYPE_TRANSMIT_NOT_PRESENT);
                         skb_unlink(skb, &aun_queue);
                         kfree_skb(skb);
                 }
-                skb = newskb;
         }
         spin_unlock_irqrestore(&aun_queue_lock, flags);
 
diff --git a/net/ethernet/eth.c b/net/ethernet/eth.c
index 280352aba403..5a883affecd3 100644
--- a/net/ethernet/eth.c
+++ b/net/ethernet/eth.c
@@ -337,11 +337,6 @@ const struct header_ops eth_header_ops ____cacheline_aligned = {
 void ether_setup(struct net_device *dev)
 {
         dev->header_ops         = &eth_header_ops;
-#ifdef CONFIG_COMPAT_NET_DEV_OPS
-        dev->change_mtu         = eth_change_mtu;
-        dev->set_mac_address    = eth_mac_addr;
-        dev->validate_addr      = eth_validate_addr;
-#endif
         dev->type               = ARPHRD_ETHER;
         dev->hard_header_len    = ETH_HLEN;
         dev->mtu                = ETH_DATA_LEN;
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index 7f03373b8c07..d87362178588 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -375,6 +375,7 @@ lookup_protocol:
         inet->uc_ttl    = -1;
         inet->mc_loop   = 1;
         inet->mc_ttl    = 1;
+        inet->mc_all    = 1;
         inet->mc_index  = 0;
         inet->mc_list   = NULL;
 
@@ -1003,8 +1004,6 @@ void inet_register_protosw(struct inet_protosw *p)
 out:
         spin_unlock_bh(&inetsw_lock);
 
-        synchronize_net();
-
         return;
 
 out_permanent:
@@ -1248,13 +1247,20 @@ static struct sk_buff **inet_gro_receive(struct sk_buff **head,
         struct sk_buff **pp = NULL;
         struct sk_buff *p;
         struct iphdr *iph;
+        unsigned int hlen;
+        unsigned int off;
+        unsigned int id;
         int flush = 1;
         int proto;
-        int id;
 
-        iph = skb_gro_header(skb, sizeof(*iph));
-        if (unlikely(!iph))
-                goto out;
+        off = skb_gro_offset(skb);
+        hlen = off + sizeof(*iph);
+        iph = skb_gro_header_fast(skb, off);
+        if (skb_gro_header_hard(skb, hlen)) {
+                iph = skb_gro_header_slow(skb, hlen, off);
+                if (unlikely(!iph))
+                        goto out;
+        }
 
         proto = iph->protocol & (MAX_INET_PROTOS - 1);
 
@@ -1269,9 +1275,9 @@ static struct sk_buff **inet_gro_receive(struct sk_buff **head,
         if (unlikely(ip_fast_csum((u8 *)iph, iph->ihl)))
                 goto out_unlock;
 
-        flush = ntohs(iph->tot_len) != skb_gro_len(skb) ||
-                iph->frag_off != htons(IP_DF);
-        id = ntohs(iph->id);
+        id = ntohl(*(u32 *)&iph->id);
+        flush = (u16)((ntohl(*(u32 *)iph) ^ skb_gro_len(skb)) | (id ^ IP_DF));
+        id >>= 16;
 
         for (p = *head; p; p = p->next) {
                 struct iphdr *iph2;
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index 126bb911880f..3863c3a4223f 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -1347,7 +1347,8 @@ static int devinet_sysctl_forward(ctl_table *ctl, int write,
                 struct net *net = ctl->extra2;
 
                 if (valp != &IPV4_DEVCONF_DFLT(net, FORWARDING)) {
-                        rtnl_lock();
+                        if (!rtnl_trylock())
+                                return restart_syscall();
                         if (valp == &IPV4_DEVCONF_ALL(net, FORWARDING)) {
                                 inet_forward_change(net);
                         } else if (*valp) {
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index cafcc49d0993..e2f950592566 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -40,7 +40,6 @@
 #include <net/route.h>
 #include <net/tcp.h>
 #include <net/sock.h>
-#include <net/icmp.h>
 #include <net/arp.h>
 #include <net/ip_fib.h>
 #include <net/rtnetlink.h>
diff --git a/net/ipv4/fib_hash.c b/net/ipv4/fib_hash.c
index ded8c44fb848..ecd39454235c 100644
--- a/net/ipv4/fib_hash.c
+++ b/net/ipv4/fib_hash.c
@@ -263,7 +263,6 @@ fn_hash_lookup(struct fib_table *tb, const struct flowi *flp, struct fib_result
 
                         err = fib_semantic_match(&f->fn_alias,
                                                  flp, res,
-                                                 f->fn_key, fz->fz_mask,
                                                  fz->fz_order);
                         if (err <= 0)
                                 goto out;
diff --git a/net/ipv4/fib_lookup.h b/net/ipv4/fib_lookup.h
index 2c1623d2768b..637b133973bd 100644
--- a/net/ipv4/fib_lookup.h
+++ b/net/ipv4/fib_lookup.h
@@ -22,8 +22,7 @@ struct fib_alias {
 /* Exported by fib_semantics.c */
 extern int fib_semantic_match(struct list_head *head,
                               const struct flowi *flp,
-                              struct fib_result *res, __be32 zone, __be32 mask,
-                                int prefixlen);
+                              struct fib_result *res, int prefixlen);
 extern void fib_release_info(struct fib_info *);
 extern struct fib_info *fib_create_info(struct fib_config *cfg);
 extern int fib_nh_match(struct fib_config *cfg, struct fib_info *fi);
diff --git a/net/ipv4/fib_rules.c b/net/ipv4/fib_rules.c
index 6080d7120821..92d9d97ec5e3 100644
--- a/net/ipv4/fib_rules.c
+++ b/net/ipv4/fib_rules.c
@@ -134,7 +134,7 @@ static const struct nla_policy fib4_rule_policy[FRA_MAX+1] = {
 };
 
 static int fib4_rule_configure(struct fib_rule *rule, struct sk_buff *skb,
-                               struct nlmsghdr *nlh, struct fib_rule_hdr *frh,
+                               struct fib_rule_hdr *frh,
                                struct nlattr **tb)
 {
         struct net *net = sock_net(skb->sk);
@@ -209,7 +209,7 @@ static int fib4_rule_compare(struct fib_rule *rule, struct fib_rule_hdr *frh,
 }
 
 static int fib4_rule_fill(struct fib_rule *rule, struct sk_buff *skb,
-                          struct nlmsghdr *nlh, struct fib_rule_hdr *frh)
+                          struct fib_rule_hdr *frh)
 {
         struct fib4_rule *rule4 = (struct fib4_rule *) rule;
 
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index f831df500907..9b096d6ff3f2 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -866,8 +866,7 @@ failure:
 
 /* Note! fib_semantic_match intentionally uses  RCU list functions. */
 int fib_semantic_match(struct list_head *head, const struct flowi *flp,
-                       struct fib_result *res, __be32 zone, __be32 mask,
-                        int prefixlen)
+                       struct fib_result *res, int prefixlen)
 {
         struct fib_alias *fa;
         int nh_sel = 0;
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 33c7c85dfe40..538d2a9a5115 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -1351,8 +1351,7 @@ static int check_leaf(struct trie *t, struct leaf *l,
                 if (l->key != (key & ntohl(mask)))
                         continue;
 
-                err = fib_semantic_match(&li->falh, flp, res,
-                                         htonl(l->key), mask, plen);
+                err = fib_semantic_match(&li->falh, flp, res, plen);
 
 #ifdef CONFIG_IP_FIB_TRIE_STATS
                 if (err <= 0)
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index 9eb6219af615..e6058a503796 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -2196,7 +2196,7 @@ int ip_mc_sf_allow(struct sock *sk, __be32 loc_addr, __be32 rmt_addr, int dif)
                         break;
         }
         if (!pmc)
-                return 1;
+                return inet->mc_all;
         psl = pmc->sflist;
         if (!psl)
                 return pmc->sfmode == MCAST_EXCLUDE;
diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
index 588a7796e3e3..b0b273503e2a 100644
--- a/net/ipv4/inet_diag.c
+++ b/net/ipv4/inet_diag.c
@@ -198,8 +198,6 @@ static int inet_twsk_diag_fill(struct inet_timewait_sock *tw,
                 tmo = 0;
 
         r->idiag_family       = tw->tw_family;
-        r->idiag_state        = tw->tw_state;
-        r->idiag_timer        = 0;
         r->idiag_retrans      = 0;
         r->id.idiag_if        = tw->tw_bound_dev_if;
         r->id.idiag_cookie[0] = (u32)(unsigned long)tw;
diff --git a/net/ipv4/inet_timewait_sock.c b/net/ipv4/inet_timewait_sock.c
index 8554d0ea1719..68a8d892c711 100644
--- a/net/ipv4/inet_timewait_sock.c
+++ b/net/ipv4/inet_timewait_sock.c
@@ -49,19 +49,22 @@ static void __inet_twsk_kill(struct inet_timewait_sock *tw,
         inet_twsk_put(tw);
 }
 
-void inet_twsk_put(struct inet_timewait_sock *tw)
+static noinline void inet_twsk_free(struct inet_timewait_sock *tw)
 {
-        if (atomic_dec_and_test(&tw->tw_refcnt)) {
-                struct module *owner = tw->tw_prot->owner;
-                twsk_destructor((struct sock *)tw);
+        struct module *owner = tw->tw_prot->owner;
+        twsk_destructor((struct sock *)tw);
 #ifdef SOCK_REFCNT_DEBUG
-                printk(KERN_DEBUG "%s timewait_sock %p released\n",
-                       tw->tw_prot->name, tw);
+        pr_debug("%s timewait_sock %p released\n", tw->tw_prot->name, tw);
 #endif
-                release_net(twsk_net(tw));
-                kmem_cache_free(tw->tw_prot->twsk_prot->twsk_slab, tw);
-                module_put(owner);
-        }
+        release_net(twsk_net(tw));
+        kmem_cache_free(tw->tw_prot->twsk_prot->twsk_slab, tw);
+        module_put(owner);
+}
+
+void inet_twsk_put(struct inet_timewait_sock *tw)
+{
+        if (atomic_dec_and_test(&tw->tw_refcnt))
+                inet_twsk_free(tw);
 }
 EXPORT_SYMBOL_GPL(inet_twsk_put);
 
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index e62510d5ea5a..77436e2732eb 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -1238,6 +1238,7 @@ static void ipgre_tunnel_setup(struct net_device *dev)
         dev->iflink             = 0;
         dev->addr_len           = 4;
         dev->features           |= NETIF_F_NETNS_LOCAL;
+        dev->priv_flags         &= ~IFF_XMIT_DST_RELEASE;
 }
 
 static int ipgre_tunnel_init(struct net_device *dev)
diff --git a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c
index 1a58a6fa1dc0..40f6206b2aa9 100644
--- a/net/ipv4/ip_input.c
+++ b/net/ipv4/ip_input.c
@@ -358,10 +358,12 @@ static int ip_rcv_finish(struct sk_buff *skb)
                 goto drop;
 
         rt = skb->rtable;
-        if (rt->rt_type == RTN_MULTICAST)
-                IP_INC_STATS_BH(dev_net(rt->u.dst.dev), IPSTATS_MIB_INMCASTPKTS);
-        else if (rt->rt_type == RTN_BROADCAST)
-                IP_INC_STATS_BH(dev_net(rt->u.dst.dev), IPSTATS_MIB_INBCASTPKTS);
+        if (rt->rt_type == RTN_MULTICAST) {
+                IP_UPD_PO_STATS_BH(dev_net(rt->u.dst.dev), IPSTATS_MIB_INMCAST,
+                                skb->len);
+        } else if (rt->rt_type == RTN_BROADCAST)
+                IP_UPD_PO_STATS_BH(dev_net(rt->u.dst.dev), IPSTATS_MIB_INBCAST,
+                                skb->len);
 
         return dst_input(skb);
 
@@ -384,7 +386,8 @@ int ip_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt,
         if (skb->pkt_type == PACKET_OTHERHOST)
                 goto drop;
 
-        IP_INC_STATS_BH(dev_net(dev), IPSTATS_MIB_INRECEIVES);
+
+        IP_UPD_PO_STATS_BH(dev_net(dev), IPSTATS_MIB_IN, skb->len);
 
         if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL) {
                 IP_INC_STATS_BH(dev_net(dev), IPSTATS_MIB_INDISCARDS);
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 3e7e910c7c0f..ea19c37ccc0c 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -181,10 +181,10 @@ static inline int ip_finish_output2(struct sk_buff *skb)
         struct net_device *dev = dst->dev;
         unsigned int hh_len = LL_RESERVED_SPACE(dev);
 
-        if (rt->rt_type == RTN_MULTICAST)
-                IP_INC_STATS(dev_net(dev), IPSTATS_MIB_OUTMCASTPKTS);
-        else if (rt->rt_type == RTN_BROADCAST)
-                IP_INC_STATS(dev_net(dev), IPSTATS_MIB_OUTBCASTPKTS);
+        if (rt->rt_type == RTN_MULTICAST) {
+                IP_UPD_PO_STATS(dev_net(dev), IPSTATS_MIB_OUTMCAST, skb->len);
+        } else if (rt->rt_type == RTN_BROADCAST)
+                IP_UPD_PO_STATS(dev_net(dev), IPSTATS_MIB_OUTBCAST, skb->len);
 
         /* Be paranoid, rather than too clever. */
         if (unlikely(skb_headroom(skb) < hh_len && dev->header_ops)) {
@@ -244,7 +244,7 @@ int ip_mc_output(struct sk_buff *skb)
         /*
          *      If the indicated interface is up and running, send the packet.
          */
-        IP_INC_STATS(dev_net(dev), IPSTATS_MIB_OUTREQUESTS);
+        IP_UPD_PO_STATS(dev_net(dev), IPSTATS_MIB_OUT, skb->len);
 
         skb->dev = dev;
         skb->protocol = htons(ETH_P_IP);
@@ -298,7 +298,7 @@ int ip_output(struct sk_buff *skb)
 {
         struct net_device *dev = skb->dst->dev;
 
-        IP_INC_STATS(dev_net(dev), IPSTATS_MIB_OUTREQUESTS);
+        IP_UPD_PO_STATS(dev_net(dev), IPSTATS_MIB_OUT, skb->len);
 
         skb->dev = dev;
         skb->protocol = htons(ETH_P_IP);
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index 43c05854d752..cb49936856e0 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -157,38 +157,39 @@ void ip_cmsg_recv(struct msghdr *msg, struct sk_buff *skb)
         /* Ordered by supposed usage frequency */
         if (flags & 1)
                 ip_cmsg_recv_pktinfo(msg, skb);
-        if ((flags>>=1) == 0)
+        if ((flags >>= 1) == 0)
                 return;
 
         if (flags & 1)
                 ip_cmsg_recv_ttl(msg, skb);
-        if ((flags>>=1) == 0)
+        if ((flags >>= 1) == 0)
                 return;
 
         if (flags & 1)
                 ip_cmsg_recv_tos(msg, skb);
-        if ((flags>>=1) == 0)
+        if ((flags >>= 1) == 0)
                 return;
 
         if (flags & 1)
                 ip_cmsg_recv_opts(msg, skb);
-        if ((flags>>=1) == 0)
+        if ((flags >>= 1) == 0)
                 return;
 
         if (flags & 1)
                 ip_cmsg_recv_retopts(msg, skb);
-        if ((flags>>=1) == 0)
+        if ((flags >>= 1) == 0)
                 return;
 
         if (flags & 1)
                 ip_cmsg_recv_security(msg, skb);
 
-        if ((flags>>=1) == 0)
+        if ((flags >>= 1) == 0)
                 return;
         if (flags & 1)
                 ip_cmsg_recv_dstaddr(msg, skb);
 
 }
+EXPORT_SYMBOL(ip_cmsg_recv);
 
 int ip_cmsg_send(struct net *net, struct msghdr *msg, struct ipcm_cookie *ipc)
 {
@@ -203,7 +204,8 @@ int ip_cmsg_send(struct net *net, struct msghdr *msg, struct ipcm_cookie *ipc)
                 switch (cmsg->cmsg_type) {
                 case IP_RETOPTS:
                         err = cmsg->cmsg_len - CMSG_ALIGN(sizeof(struct cmsghdr));
-                        err = ip_options_get(net, &ipc->opt, CMSG_DATA(cmsg), err < 40 ? err : 40);
+                        err = ip_options_get(net, &ipc->opt, CMSG_DATA(cmsg),
+                                             err < 40 ? err : 40);
                         if (err)
                                 return err;
                         break;
@@ -238,7 +240,8 @@ int ip_cmsg_send(struct net *net, struct msghdr *msg, struct ipcm_cookie *ipc)
 struct ip_ra_chain *ip_ra_chain;
 DEFINE_RWLOCK(ip_ra_lock);
 
-int ip_ra_control(struct sock *sk, unsigned char on, void (*destructor)(struct sock *))
+int ip_ra_control(struct sock *sk, unsigned char on,
+                  void (*destructor)(struct sock *))
 {
         struct ip_ra_chain *ra, *new_ra, **rap;
 
@@ -248,7 +251,7 @@ int ip_ra_control(struct sock *sk, unsigned char on, void (*destructor)(struct s
         new_ra = on ? kmalloc(sizeof(*new_ra), GFP_KERNEL) : NULL;
 
         write_lock_bh(&ip_ra_lock);
-        for (rap = &ip_ra_chain; (ra=*rap) != NULL; rap = &ra->next) {
+        for (rap = &ip_ra_chain; (ra = *rap) != NULL; rap = &ra->next) {
                 if (ra->sk == sk) {
                         if (on) {
                                 write_unlock_bh(&ip_ra_lock);
@@ -416,7 +419,8 @@ int ip_recv_error(struct sock *sk, struct msghdr *msg, int len)
         /* Reset and regenerate socket error */
         spin_lock_bh(&sk->sk_error_queue.lock);
         sk->sk_err = 0;
-        if ((skb2 = skb_peek(&sk->sk_error_queue)) != NULL) {
+        skb2 = skb_peek(&sk->sk_error_queue);
+        if (skb2 != NULL) {
                 sk->sk_err = SKB_EXT_ERR(skb2)->ee.ee_errno;
                 spin_unlock_bh(&sk->sk_error_queue.lock);
                 sk->sk_error_report(sk);
@@ -431,8 +435,8 @@ out:
 
 
 /*
- *      Socket option code for IP. This is the end of the line after any TCP,UDP etc options on
- *      an IP socket.
+ *      Socket option code for IP. This is the end of the line after any
+ *      TCP,UDP etc options on an IP socket.
  */
 
 static int do_ip_setsockopt(struct sock *sk, int level,
@@ -449,6 +453,7 @@ static int do_ip_setsockopt(struct sock *sk, int level,
                              (1<<IP_ROUTER_ALERT) | (1<<IP_FREEBIND) |
                              (1<<IP_PASSSEC) | (1<<IP_TRANSPARENT))) ||
             optname == IP_MULTICAST_TTL ||
+            optname == IP_MULTICAST_ALL ||
             optname == IP_MULTICAST_LOOP ||
             optname == IP_RECVORIGDSTADDR) {
                 if (optlen >= sizeof(int)) {
@@ -474,7 +479,7 @@ static int do_ip_setsockopt(struct sock *sk, int level,
         switch (optname) {
         case IP_OPTIONS:
         {
-                struct ip_options * opt = NULL;
+                struct ip_options *opt = NULL;
                 if (optlen > 40 || optlen < 0)
                         goto e_inval;
                 err = ip_options_get_from_user(sock_net(sk), &opt,
@@ -556,9 +561,9 @@ static int do_ip_setsockopt(struct sock *sk, int level,
                 }
                 break;
         case IP_TTL:
-                if (optlen<1)
+                if (optlen < 1)
                         goto e_inval;
-                if (val != -1 && (val < 1 || val>255))
+                if (val != -1 && (val < 0 || val > 255))
                         goto e_inval;
                 inet->uc_ttl = val;
                 break;
@@ -570,7 +575,7 @@ static int do_ip_setsockopt(struct sock *sk, int level,
                 inet->hdrincl = val ? 1 : 0;
                 break;
         case IP_MTU_DISCOVER:
-                if (val<0 || val>3)
+                if (val < 0 || val > 3)
                         goto e_inval;
                 inet->pmtudisc = val;
                 break;
@@ -582,7 +587,7 @@ static int do_ip_setsockopt(struct sock *sk, int level,
         case IP_MULTICAST_TTL:
                 if (sk->sk_type == SOCK_STREAM)
                         goto e_inval;
-                if (optlen<1)
+                if (optlen < 1)
                         goto e_inval;
                 if (val == -1)
                         val = 1;
@@ -591,7 +596,7 @@ static int do_ip_setsockopt(struct sock *sk, int level,
                 inet->mc_ttl = val;
                 break;
         case IP_MULTICAST_LOOP:
-                if (optlen<1)
+                if (optlen < 1)
                         goto e_inval;
                 inet->mc_loop = !!val;
                 break;
@@ -613,7 +618,8 @@ static int do_ip_setsockopt(struct sock *sk, int level,
                 } else {
                         memset(&mreq, 0, sizeof(mreq));
                         if (optlen >= sizeof(struct in_addr) &&
-                            copy_from_user(&mreq.imr_address, optval, sizeof(struct in_addr)))
+                            copy_from_user(&mreq.imr_address, optval,
+                                           sizeof(struct in_addr)))
                                 break;
                 }
 
@@ -677,7 +683,6 @@ static int do_ip_setsockopt(struct sock *sk, int level,
         }
         case IP_MSFILTER:
         {
-                extern int sysctl_igmp_max_msf;
                 struct ip_msfilter *msf;
 
                 if (optlen < IP_MSFILTER_SIZE(0))
@@ -831,7 +836,6 @@ static int do_ip_setsockopt(struct sock *sk, int level,
         }
         case MCAST_MSFILTER:
         {
-                extern int sysctl_igmp_max_msf;
                 struct sockaddr_in *psin;
                 struct ip_msfilter *msf = NULL;
                 struct group_filter *gsf = NULL;
@@ -849,9 +853,9 @@ static int do_ip_setsockopt(struct sock *sk, int level,
                         break;
                 }
                 err = -EFAULT;
-                if (copy_from_user(gsf, optval, optlen)) {
+                if (copy_from_user(gsf, optval, optlen))
                         goto mc_msf_out;
-                }
+
                 /* numsrc >= (4G-140)/128 overflow in 32 bits */
                 if (gsf->gf_numsrc >= 0x1ffffff ||
                     gsf->gf_numsrc > sysctl_igmp_max_msf) {
@@ -879,7 +883,7 @@ static int do_ip_setsockopt(struct sock *sk, int level,
                 msf->imsf_fmode = gsf->gf_fmode;
                 msf->imsf_numsrc = gsf->gf_numsrc;
                 err = -EADDRNOTAVAIL;
-                for (i=0; i<gsf->gf_numsrc; ++i) {
+                for (i = 0; i < gsf->gf_numsrc; ++i) {
                         psin = (struct sockaddr_in *)&gsf->gf_slist[i];
 
                         if (psin->sin_family != AF_INET)
@@ -890,17 +894,24 @@ static int do_ip_setsockopt(struct sock *sk, int level,
                 gsf = NULL;
 
                 err = ip_mc_msfilter(sk, msf, ifindex);
-        mc_msf_out:
+mc_msf_out:
                 kfree(msf);
                 kfree(gsf);
                 break;
         }
+        case IP_MULTICAST_ALL:
+                if (optlen < 1)
+                        goto e_inval;
+                if (val != 0 && val != 1)
+                        goto e_inval;
+                inet->mc_all = val;
+                break;
         case IP_ROUTER_ALERT:
                 err = ip_ra_control(sk, val ? 1 : 0, NULL);
                 break;
 
         case IP_FREEBIND:
-                if (optlen<1)
+                if (optlen < 1)
                         goto e_inval;
                 inet->freebind = !!val;
                 break;
@@ -957,6 +968,7 @@ int ip_setsockopt(struct sock *sk, int level,
 #endif
         return err;
 }
+EXPORT_SYMBOL(ip_setsockopt);
 
 #ifdef CONFIG_COMPAT
 int compat_ip_setsockopt(struct sock *sk, int level, int optname,
@@ -986,13 +998,12 @@ int compat_ip_setsockopt(struct sock *sk, int level, int optname,
 #endif
         return err;
 }
-
 EXPORT_SYMBOL(compat_ip_setsockopt);
 #endif
 
 /*
- *      Get the options. Note for future reference. The GET of IP options gets the
- *      _received_ ones. The set sets the _sent_ ones.
+ *      Get the options. Note for future reference. The GET of IP options gets
+ *      the _received_ ones. The set sets the _sent_ ones.
  */
 
 static int do_ip_getsockopt(struct sock *sk, int level, int optname,
@@ -1143,10 +1154,14 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname,
                         return -EFAULT;
                 }
                 err = ip_mc_gsfget(sk, &gsf,
-                                   (struct group_filter __user *)optval, optlen);
+                                   (struct group_filter __user *)optval,
+                                   optlen);
                 release_sock(sk);
                 return err;
         }
+        case IP_MULTICAST_ALL:
+                val = inet->mc_all;
+                break;
         case IP_PKTOPTIONS:
         {
                 struct msghdr msg;
@@ -1187,7 +1202,7 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname,
         }
         release_sock(sk);
 
-        if (len < sizeof(int) && len > 0 && val>=0 && val<=255) {
+        if (len < sizeof(int) && len > 0 && val >= 0 && val <= 255) {
                 unsigned char ucval = (unsigned char)val;
                 len = 1;
                 if (put_user(len, optlen))
@@ -1230,6 +1245,7 @@ int ip_getsockopt(struct sock *sk, int level,
 #endif
         return err;
 }
+EXPORT_SYMBOL(ip_getsockopt);
 
 #ifdef CONFIG_COMPAT
 int compat_ip_getsockopt(struct sock *sk, int level, int optname,
@@ -1262,11 +1278,5 @@ int compat_ip_getsockopt(struct sock *sk, int level, int optname,
 #endif
         return err;
 }
-
 EXPORT_SYMBOL(compat_ip_getsockopt);
 #endif
-
-EXPORT_SYMBOL(ip_cmsg_recv);
-
-EXPORT_SYMBOL(ip_getsockopt);
-EXPORT_SYMBOL(ip_setsockopt);
diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c
index 88bf051d0cbb..f8d04c256454 100644
--- a/net/ipv4/ipconfig.c
+++ b/net/ipv4/ipconfig.c
@@ -160,6 +160,9 @@ static char user_dev_name[IFNAMSIZ] __initdata = { 0, };
 /* Protocols supported by available interfaces */
 static int ic_proto_have_if __initdata = 0;
 
+/* MTU for boot device */
+static int ic_dev_mtu __initdata = 0;
+
 #ifdef IPCONFIG_DYNAMIC
 static DEFINE_SPINLOCK(ic_recv_lock);
 static volatile int ic_got_reply __initdata = 0;    /* Proto(s) that replied */
@@ -286,7 +289,7 @@ set_sockaddr(struct sockaddr_in *sin, __be32 addr, __be16 port)
         sin->sin_port = port;
 }
 
-static int __init ic_dev_ioctl(unsigned int cmd, struct ifreq *arg)
+static int __init ic_devinet_ioctl(unsigned int cmd, struct ifreq *arg)
 {
         int res;
 
@@ -297,6 +300,17 @@ static int __init ic_dev_ioctl(unsigned int cmd, struct ifreq *arg)
         return res;
 }
 
+static int __init ic_dev_ioctl(unsigned int cmd, struct ifreq *arg)
+{
+        int res;
+
+        mm_segment_t oldfs = get_fs();
+        set_fs(get_ds());
+        res = dev_ioctl(&init_net, cmd, (struct ifreq __user *) arg);
+        set_fs(oldfs);
+        return res;
+}
+
 static int __init ic_route_ioctl(unsigned int cmd, struct rtentry *arg)
 {
         int res;
@@ -321,20 +335,31 @@ static int __init ic_setup_if(void)
         memset(&ir, 0, sizeof(ir));
         strcpy(ir.ifr_ifrn.ifrn_name, ic_dev->name);
         set_sockaddr(sin, ic_myaddr, 0);
-        if ((err = ic_dev_ioctl(SIOCSIFADDR, &ir)) < 0) {
+        if ((err = ic_devinet_ioctl(SIOCSIFADDR, &ir)) < 0) {
                 printk(KERN_ERR "IP-Config: Unable to set interface address (%d).\n", err);
                 return -1;
         }
         set_sockaddr(sin, ic_netmask, 0);
-        if ((err = ic_dev_ioctl(SIOCSIFNETMASK, &ir)) < 0) {
+        if ((err = ic_devinet_ioctl(SIOCSIFNETMASK, &ir)) < 0) {
                 printk(KERN_ERR "IP-Config: Unable to set interface netmask (%d).\n", err);
                 return -1;
         }
         set_sockaddr(sin, ic_myaddr | ~ic_netmask, 0);
-        if ((err = ic_dev_ioctl(SIOCSIFBRDADDR, &ir)) < 0) {
+        if ((err = ic_devinet_ioctl(SIOCSIFBRDADDR, &ir)) < 0) {
                 printk(KERN_ERR "IP-Config: Unable to set interface broadcast address (%d).\n", err);
                 return -1;
         }
+        /* Handle the case where we need non-standard MTU on the boot link (a network
+         * using jumbo frames, for instance).  If we can't set the mtu, don't error
+         * out, we'll try to muddle along.
+         */
+        if (ic_dev_mtu != 0) {
+                strcpy(ir.ifr_name, ic_dev->name);
+                ir.ifr_mtu = ic_dev_mtu;
+                if ((err = ic_dev_ioctl(SIOCSIFMTU, &ir)) < 0)
+                        printk(KERN_ERR "IP-Config: Unable to set interface mtu to %d (%d).\n",
+                                         ic_dev_mtu, err);
+        }
         return 0;
 }
 
@@ -623,6 +648,7 @@ ic_dhcp_init_options(u8 *options)
                         12,     /* Host name */
                         15,     /* Domain name */
                         17,     /* Boot path */
+                        26,     /* MTU */
                         40,     /* NIS domain name */
                 };
 
@@ -798,6 +824,7 @@ static void __init ic_do_bootp_ext(u8 *ext)
 {
        u8 servers;
        int i;
+        u16 mtu;
 
 #ifdef IPCONFIG_DEBUG
         u8 *c;
@@ -837,6 +864,10 @@ static void __init ic_do_bootp_ext(u8 *ext)
                         if (!root_server_path[0])
                                 ic_bootp_string(root_server_path, ext+1, *ext, sizeof(root_server_path));
                         break;
+                case 26:        /* Interface MTU */
+                        memcpy(&mtu, ext+1, sizeof(mtu));
+                        ic_dev_mtu = ntohs(mtu);
+                        break;
                 case 40:        /* NIS Domain name (_not_ DNS) */
                         ic_bootp_string(utsname()->domainname, ext+1, *ext, __NEW_UTS_LEN);
                         break;
@@ -1403,6 +1434,8 @@ static int __init ip_auto_config(void)
         printk(",\n     bootserver=%pI4", &ic_servaddr);
         printk(", rootserver=%pI4", &root_server_addr);
         printk(", rootpath=%s", root_server_path);
+        if (ic_dev_mtu)
+                printk(", mtu=%d", ic_dev_mtu);
         printk("\n");
 #endif /* !SILENT */
 
diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c
index 9054139795af..bb2f1b17fbf1 100644
--- a/net/ipv4/ipip.c
+++ b/net/ipv4/ipip.c
@@ -713,6 +713,7 @@ static void ipip_tunnel_setup(struct net_device *dev)
         dev->iflink             = 0;
         dev->addr_len           = 4;
         dev->features           |= NETIF_F_NETNS_LOCAL;
+        dev->priv_flags         &= ~IFF_XMIT_DST_RELEASE;
 }
 
 static void ipip_tunnel_init(struct net_device *dev)
diff --git a/net/ipv4/proc.c b/net/ipv4/proc.c
index cf0cdeeb1db0..f25542c48b7d 100644
--- a/net/ipv4/proc.c
+++ b/net/ipv4/proc.c
@@ -90,14 +90,14 @@ static const struct file_operations sockstat_seq_fops = {
 
 /* snmp items */
 static const struct snmp_mib snmp4_ipstats_list[] = {
-        SNMP_MIB_ITEM("InReceives", IPSTATS_MIB_INRECEIVES),
+        SNMP_MIB_ITEM("InReceives", IPSTATS_MIB_INPKTS),
         SNMP_MIB_ITEM("InHdrErrors", IPSTATS_MIB_INHDRERRORS),
         SNMP_MIB_ITEM("InAddrErrors", IPSTATS_MIB_INADDRERRORS),
         SNMP_MIB_ITEM("ForwDatagrams", IPSTATS_MIB_OUTFORWDATAGRAMS),
         SNMP_MIB_ITEM("InUnknownProtos", IPSTATS_MIB_INUNKNOWNPROTOS),
         SNMP_MIB_ITEM("InDiscards", IPSTATS_MIB_INDISCARDS),
         SNMP_MIB_ITEM("InDelivers", IPSTATS_MIB_INDELIVERS),
-        SNMP_MIB_ITEM("OutRequests", IPSTATS_MIB_OUTREQUESTS),
+        SNMP_MIB_ITEM("OutRequests", IPSTATS_MIB_OUTPKTS),
         SNMP_MIB_ITEM("OutDiscards", IPSTATS_MIB_OUTDISCARDS),
         SNMP_MIB_ITEM("OutNoRoutes", IPSTATS_MIB_OUTNOROUTES),
         SNMP_MIB_ITEM("ReasmTimeout", IPSTATS_MIB_REASMTIMEOUT),
@@ -118,6 +118,12 @@ static const struct snmp_mib snmp4_ipextstats_list[] = {
         SNMP_MIB_ITEM("OutMcastPkts", IPSTATS_MIB_OUTMCASTPKTS),
         SNMP_MIB_ITEM("InBcastPkts", IPSTATS_MIB_INBCASTPKTS),
         SNMP_MIB_ITEM("OutBcastPkts", IPSTATS_MIB_OUTBCASTPKTS),
+        SNMP_MIB_ITEM("InOctets", IPSTATS_MIB_INOCTETS),
+        SNMP_MIB_ITEM("OutOctets", IPSTATS_MIB_OUTOCTETS),
+        SNMP_MIB_ITEM("InMcastOctets", IPSTATS_MIB_INMCASTOCTETS),
+        SNMP_MIB_ITEM("OutMcastOctets", IPSTATS_MIB_OUTMCASTOCTETS),
+        SNMP_MIB_ITEM("InBcastOctets", IPSTATS_MIB_INBCASTOCTETS),
+        SNMP_MIB_ITEM("OutBcastOctets", IPSTATS_MIB_OUTBCASTOCTETS),
         SNMP_MIB_SENTINEL
 };
 
diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
index b35a950d2e06..cd2b97f1b6e1 100644
--- a/net/ipv4/syncookies.c
+++ b/net/ipv4/syncookies.c
@@ -161,13 +161,12 @@ static __u16 const msstab[] = {
  */
 __u32 cookie_v4_init_sequence(struct sock *sk, struct sk_buff *skb, __u16 *mssp)
 {
-        struct tcp_sock *tp = tcp_sk(sk);
         const struct iphdr *iph = ip_hdr(skb);
         const struct tcphdr *th = tcp_hdr(skb);
         int mssind;
         const __u16 mss = *mssp;
 
-        tp->last_synq_overflow = jiffies;
+        tcp_synq_overflow(sk);
 
         /* XXX sort msstab[] by probability?  Binary search? */
         for (mssind = 0; mss > msstab[mssind + 1]; mssind++)
@@ -268,7 +267,7 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
         if (!sysctl_tcp_syncookies || !th->ack)
                 goto out;
 
-        if (time_after(jiffies, tp->last_synq_overflow + TCP_TIMEOUT_INIT) ||
+        if (tcp_synq_no_recent_overflow(sk) ||
             (mss = cookie_check(skb, cookie)) == 0) {
                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_SYNCOOKIESFAILED);
                 goto out;
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 7a0f0b27bf1f..17b89c523f9d 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -439,12 +439,14 @@ int tcp_ioctl(struct sock *sk, int cmd, unsigned long arg)
                          !tp->urg_data ||
                          before(tp->urg_seq, tp->copied_seq) ||
                          !before(tp->urg_seq, tp->rcv_nxt)) {
+                        struct sk_buff *skb;
+
                         answ = tp->rcv_nxt - tp->copied_seq;
 
                         /* Subtract 1, if FIN is in queue. */
-                        if (answ && !skb_queue_empty(&sk->sk_receive_queue))
-                                answ -=
-                       tcp_hdr((struct sk_buff *)sk->sk_receive_queue.prev)->fin;
+                        skb = skb_peek_tail(&sk->sk_receive_queue);
+                        if (answ && skb)
+                                answ -= tcp_hdr(skb)->fin;
                 } else
                         answ = tp->urg_seq - tp->copied_seq;
                 release_sock(sk);
@@ -1382,11 +1384,7 @@ int tcp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
 
                 /* Next get a buffer. */
 
-                skb = skb_peek(&sk->sk_receive_queue);
-                do {
-                        if (!skb)
-                                break;
-
+                skb_queue_walk(&sk->sk_receive_queue, skb) {
                         /* Now that we have two receive queues this
                          * shouldn't happen.
                          */
@@ -1403,8 +1401,7 @@ int tcp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                         if (tcp_hdr(skb)->fin)
                                 goto found_fin_ok;
                         WARN_ON(!(flags & MSG_PEEK));
-                        skb = skb->next;
-                } while (skb != (struct sk_buff *)&sk->sk_receive_queue);
+                }
 
                 /* Well, if we have backlog, try to process it now yet. */
 
@@ -2518,20 +2515,30 @@ struct sk_buff **tcp_gro_receive(struct sk_buff **head, struct sk_buff *skb)
         unsigned int thlen;
         unsigned int flags;
         unsigned int mss = 1;
+        unsigned int hlen;
+        unsigned int off;
         int flush = 1;
         int i;
 
-        th = skb_gro_header(skb, sizeof(*th));
-        if (unlikely(!th))
-                goto out;
+        off = skb_gro_offset(skb);
+        hlen = off + sizeof(*th);
+        th = skb_gro_header_fast(skb, off);
+        if (skb_gro_header_hard(skb, hlen)) {
+                th = skb_gro_header_slow(skb, hlen, off);
+                if (unlikely(!th))
+                        goto out;
+        }
 
         thlen = th->doff * 4;
         if (thlen < sizeof(*th))
                 goto out;
 
-        th = skb_gro_header(skb, thlen);
-        if (unlikely(!th))
-                goto out;
+        hlen = off + thlen;
+        if (skb_gro_header_hard(skb, hlen)) {
+                th = skb_gro_header_slow(skb, hlen, off);
+                if (unlikely(!th))
+                        goto out;
+        }
 
         skb_gro_pull(skb, thlen);
 
@@ -2544,7 +2551,7 @@ struct sk_buff **tcp_gro_receive(struct sk_buff **head, struct sk_buff *skb)
 
                 th2 = tcp_hdr(p);
 
-                if ((th->source ^ th2->source) | (th->dest ^ th2->dest)) {
+                if (*(u32 *)&th->source ^ *(u32 *)&th2->source) {
                         NAPI_GRO_CB(p)->same_flow = 0;
                         continue;
                 }
@@ -2559,14 +2566,14 @@ found:
         flush |= flags & TCP_FLAG_CWR;
         flush |= (flags ^ tcp_flag_word(th2)) &
                   ~(TCP_FLAG_CWR | TCP_FLAG_FIN | TCP_FLAG_PSH);
-        flush |= (th->ack_seq ^ th2->ack_seq) | (th->window ^ th2->window);
-        for (i = sizeof(*th); !flush && i < thlen; i += 4)
+        flush |= th->ack_seq ^ th2->ack_seq;
+        for (i = sizeof(*th); i < thlen; i += 4)
                 flush |= *(u32 *)((u8 *)th + i) ^
                          *(u32 *)((u8 *)th2 + i);
 
         mss = skb_shinfo(p)->gso_size;
 
-        flush |= (len > mss) | !len;
+        flush |= (len - 1) >= mss;
         flush |= (ntohl(th2->seq) + skb_gro_len(p)) ^ ntohl(th->seq);
 
         if (flush || skb_gro_receive(head, skb)) {
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index eec3e6f9956c..2bdb0da237e6 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -77,7 +77,7 @@ int sysctl_tcp_window_scaling __read_mostly = 1;
 int sysctl_tcp_sack __read_mostly = 1;
 int sysctl_tcp_fack __read_mostly = 1;
 int sysctl_tcp_reordering __read_mostly = TCP_FASTRETRANS_THRESH;
-int sysctl_tcp_ecn __read_mostly;
+int sysctl_tcp_ecn __read_mostly = 2;
 int sysctl_tcp_dsack __read_mostly = 1;
 int sysctl_tcp_app_win __read_mostly = 31;
 int sysctl_tcp_adv_win_scale __read_mostly = 2;
@@ -4426,7 +4426,7 @@ drop:
                 }
                 __skb_queue_head(&tp->out_of_order_queue, skb);
         } else {
-                struct sk_buff *skb1 = tp->out_of_order_queue.prev;
+                struct sk_buff *skb1 = skb_peek_tail(&tp->out_of_order_queue);
                 u32 seq = TCP_SKB_CB(skb)->seq;
                 u32 end_seq = TCP_SKB_CB(skb)->end_seq;
 
@@ -4443,15 +4443,18 @@ drop:
                 }
 
                 /* Find place to insert this segment. */
-                do {
+                while (1) {
                         if (!after(TCP_SKB_CB(skb1)->seq, seq))
                                 break;
-                } while ((skb1 = skb1->prev) !=
-                         (struct sk_buff *)&tp->out_of_order_queue);
+                        if (skb_queue_is_first(&tp->out_of_order_queue, skb1)) {
+                                skb1 = NULL;
+                                break;
+                        }
+                        skb1 = skb_queue_prev(&tp->out_of_order_queue, skb1);
+                }
 
                 /* Do skb overlap to previous one? */
-                if (skb1 != (struct sk_buff *)&tp->out_of_order_queue &&
-                    before(seq, TCP_SKB_CB(skb1)->end_seq)) {
+                if (skb1 && before(seq, TCP_SKB_CB(skb1)->end_seq)) {
                         if (!after(end_seq, TCP_SKB_CB(skb1)->end_seq)) {
                                 /* All the bits are present. Drop. */
                                 __kfree_skb(skb);
@@ -4463,15 +4466,26 @@ drop:
                                 tcp_dsack_set(sk, seq,
                                               TCP_SKB_CB(skb1)->end_seq);
                         } else {
-                                skb1 = skb1->prev;
+                                if (skb_queue_is_first(&tp->out_of_order_queue,
+                                                       skb1))
+                                        skb1 = NULL;
+                                else
+                                        skb1 = skb_queue_prev(
+                                                &tp->out_of_order_queue,
+                                                skb1);
                         }
                 }
-                __skb_queue_after(&tp->out_of_order_queue, skb1, skb);
+                if (!skb1)
+                        __skb_queue_head(&tp->out_of_order_queue, skb);
+                else
+                        __skb_queue_after(&tp->out_of_order_queue, skb1, skb);
 
                 /* And clean segments covered by new one as whole. */
-                while ((skb1 = skb->next) !=
-                       (struct sk_buff *)&tp->out_of_order_queue &&
-                       after(end_seq, TCP_SKB_CB(skb1)->seq)) {
+                while (!skb_queue_is_last(&tp->out_of_order_queue, skb)) {
+                        skb1 = skb_queue_next(&tp->out_of_order_queue, skb);
+
+                        if (!after(end_seq, TCP_SKB_CB(skb1)->seq))
+                                break;
                         if (before(end_seq, TCP_SKB_CB(skb1)->end_seq)) {
                                 tcp_dsack_extend(sk, TCP_SKB_CB(skb1)->seq,
                                                  end_seq);
@@ -4492,7 +4506,10 @@ add_sack:
 static struct sk_buff *tcp_collapse_one(struct sock *sk, struct sk_buff *skb,
                                         struct sk_buff_head *list)
 {
-        struct sk_buff *next = skb->next;
+        struct sk_buff *next = NULL;
+
+        if (!skb_queue_is_last(list, skb))
+                next = skb_queue_next(list, skb);
 
         __skb_unlink(skb, list);
         __kfree_skb(skb);
@@ -4503,6 +4520,9 @@ static struct sk_buff *tcp_collapse_one(struct sock *sk, struct sk_buff *skb,
 
 /* Collapse contiguous sequence of skbs head..tail with
  * sequence numbers start..end.
+ *
+ * If tail is NULL, this means until the end of the list.
+ *
  * Segments with FIN/SYN are not collapsed (only because this
  * simplifies code)
  */
@@ -4511,15 +4531,23 @@ tcp_collapse(struct sock *sk, struct sk_buff_head *list,
              struct sk_buff *head, struct sk_buff *tail,
              u32 start, u32 end)
 {
-        struct sk_buff *skb;
+        struct sk_buff *skb, *n;
+        bool end_of_skbs;
 
         /* First, check that queue is collapsible and find
          * the point where collapsing can be useful. */
-        for (skb = head; skb != tail;) {
+        skb = head;
+restart:
+        end_of_skbs = true;
+        skb_queue_walk_from_safe(list, skb, n) {
+                if (skb == tail)
+                        break;
                 /* No new bits? It is possible on ofo queue. */
                 if (!before(start, TCP_SKB_CB(skb)->end_seq)) {
                         skb = tcp_collapse_one(sk, skb, list);
-                        continue;
+                        if (!skb)
+                                break;
+                        goto restart;
                 }
 
                 /* The first skb to collapse is:
@@ -4529,16 +4557,24 @@ tcp_collapse(struct sock *sk, struct sk_buff_head *list,
                  */
                 if (!tcp_hdr(skb)->syn && !tcp_hdr(skb)->fin &&
                     (tcp_win_from_space(skb->truesize) > skb->len ||
-                     before(TCP_SKB_CB(skb)->seq, start) ||
-                     (skb->next != tail &&
-                      TCP_SKB_CB(skb)->end_seq != TCP_SKB_CB(skb->next)->seq)))
+                     before(TCP_SKB_CB(skb)->seq, start))) {
+                        end_of_skbs = false;
                         break;
+                }
+
+                if (!skb_queue_is_last(list, skb)) {
+                        struct sk_buff *next = skb_queue_next(list, skb);
+                        if (next != tail &&
+                            TCP_SKB_CB(skb)->end_seq != TCP_SKB_CB(next)->seq) {
+                                end_of_skbs = false;
+                                break;
+                        }
+                }
 
                 /* Decided to skip this, advance start seq. */
                 start = TCP_SKB_CB(skb)->end_seq;
-                skb = skb->next;
         }
-        if (skb == tail || tcp_hdr(skb)->syn || tcp_hdr(skb)->fin)
+        if (end_of_skbs || tcp_hdr(skb)->syn || tcp_hdr(skb)->fin)
                 return;
 
         while (before(start, end)) {
@@ -4583,7 +4619,8 @@ tcp_collapse(struct sock *sk, struct sk_buff_head *list,
                         }
                         if (!before(start, TCP_SKB_CB(skb)->end_seq)) {
                                 skb = tcp_collapse_one(sk, skb, list);
-                                if (skb == tail ||
+                                if (!skb ||
+                                    skb == tail ||
                                     tcp_hdr(skb)->syn ||
                                     tcp_hdr(skb)->fin)
                                         return;
@@ -4610,17 +4647,21 @@ static void tcp_collapse_ofo_queue(struct sock *sk)
         head = skb;
 
         for (;;) {
-                skb = skb->next;
+                struct sk_buff *next = NULL;
+
+                if (!skb_queue_is_last(&tp->out_of_order_queue, skb))
+                        next = skb_queue_next(&tp->out_of_order_queue, skb);
+                skb = next;
 
                 /* Segment is terminated when we see gap or when
                  * we are at the end of all the queue. */
-                if (skb == (struct sk_buff *)&tp->out_of_order_queue ||
+                if (!skb ||
                     after(TCP_SKB_CB(skb)->seq, end) ||
                     before(TCP_SKB_CB(skb)->end_seq, start)) {
                         tcp_collapse(sk, &tp->out_of_order_queue,
                                      head, skb, start, end);
                         head = skb;
-                        if (skb == (struct sk_buff *)&tp->out_of_order_queue)
+                        if (!skb)
                                 break;
                         /* Start new segment */
                         start = TCP_SKB_CB(skb)->seq;
@@ -4681,10 +4722,11 @@ static int tcp_prune_queue(struct sock *sk)
                 tp->rcv_ssthresh = min(tp->rcv_ssthresh, 4U * tp->advmss);
 
         tcp_collapse_ofo_queue(sk);
-        tcp_collapse(sk, &sk->sk_receive_queue,
-                     sk->sk_receive_queue.next,
-                     (struct sk_buff *)&sk->sk_receive_queue,
-                     tp->copied_seq, tp->rcv_nxt);
+        if (!skb_queue_empty(&sk->sk_receive_queue))
+                tcp_collapse(sk, &sk->sk_receive_queue,
+                             skb_peek(&sk->sk_receive_queue),
+                             NULL,
+                             tp->copied_seq, tp->rcv_nxt);
         sk_mem_reclaim(sk);
 
         if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf)
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 5d427f86b414..fc79e3416288 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1593,7 +1593,7 @@ process:
 #endif
                 {
                         if (!tcp_prequeue(sk, skb))
-                        ret = tcp_v4_do_rcv(sk, skb);
+                                ret = tcp_v4_do_rcv(sk, skb);
                 }
         } else
                 sk_add_backlog(sk, skb);
@@ -2343,7 +2343,7 @@ void tcp4_proc_exit(void)
 
 struct sk_buff **tcp4_gro_receive(struct sk_buff **head, struct sk_buff *skb)
 {
-        struct iphdr *iph = ip_hdr(skb);
+        struct iphdr *iph = skb_gro_network_header(skb);
 
         switch (skb->ip_summed) {
         case CHECKSUM_COMPLETE:
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 59aec609cec6..79c39dc9b01c 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -288,7 +288,7 @@ static inline void TCP_ECN_send_syn(struct sock *sk, struct sk_buff *skb)
         struct tcp_sock *tp = tcp_sk(sk);
 
         tp->ecn_flags = 0;
-        if (sysctl_tcp_ecn) {
+        if (sysctl_tcp_ecn == 1) {
                 TCP_SKB_CB(skb)->flags |= TCPCB_FLAG_ECE | TCPCB_FLAG_CWR;
                 tp->ecn_flags = TCP_ECN_OK;
         }
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index a8218bc1806a..c3488372f12d 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -503,7 +503,7 @@ static int addrconf_fixup_forwarding(struct ctl_table *table, int *p, int old)
                 return 0;
 
         if (!rtnl_trylock())
-                return -ERESTARTSYS;
+                return restart_syscall();
 
         if (p == &net->ipv6.devconf_all->forwarding) {
                 __s32 newf = net->ipv6.devconf_all->forwarding;
@@ -591,7 +591,6 @@ ipv6_add_addr(struct inet6_dev *idev, const struct in6_addr *addr, int pfxlen,
 {
         struct inet6_ifaddr *ifa = NULL;
         struct rt6_info *rt;
-        struct net *net = dev_net(idev->dev);
         int hash;
         int err = 0;
         int addr_type = ipv6_addr_type(addr);
@@ -608,7 +607,7 @@ ipv6_add_addr(struct inet6_dev *idev, const struct in6_addr *addr, int pfxlen,
                 goto out2;
         }
 
-        if (idev->cnf.disable_ipv6 || net->ipv6.devconf_all->disable_ipv6) {
+        if (idev->cnf.disable_ipv6) {
                 err = -EACCES;
                 goto out2;
         }
@@ -1520,6 +1519,8 @@ static int addrconf_ifid_infiniband(u8 *eui, struct net_device *dev)
 
 int __ipv6_isatap_ifid(u8 *eui, __be32 addr)
 {
+        if (addr == 0)
+                return -1;
         eui[0] = (ipv4_is_zeronet(addr) || ipv4_is_private_10(addr) ||
                   ipv4_is_loopback(addr) || ipv4_is_linklocal_169(addr) ||
                   ipv4_is_private_172(addr) || ipv4_is_test_192(addr) ||
@@ -1750,6 +1751,7 @@ void addrconf_prefix_rcv(struct net_device *dev, u8 *opt, int len)
         __u32 prefered_lft;
         int addr_type;
         struct inet6_dev *in6_dev;
+        struct net *net = dev_net(dev);
 
         pinfo = (struct prefix_info *) opt;
 
@@ -1807,7 +1809,7 @@ void addrconf_prefix_rcv(struct net_device *dev, u8 *opt, int len)
                 if (addrconf_finite_timeout(rt_expires))
                         rt_expires *= HZ;
 
-                rt = rt6_lookup(dev_net(dev), &pinfo->prefix, NULL,
+                rt = rt6_lookup(net, &pinfo->prefix, NULL,
                                 dev->ifindex, 1);
 
                 if (rt && addrconf_is_prefix_route(rt)) {
@@ -1844,7 +1846,6 @@ void addrconf_prefix_rcv(struct net_device *dev, u8 *opt, int len)
                 struct inet6_ifaddr * ifp;
                 struct in6_addr addr;
                 int create = 0, update_lft = 0;
-                struct net *net = dev_net(dev);
 
                 if (pinfo->prefix_len == 64) {
                         memcpy(&addr, &pinfo->prefix, 8);
@@ -3986,6 +3987,75 @@ static int addrconf_sysctl_forward_strategy(ctl_table *table,
         return addrconf_fixup_forwarding(table, valp, val);
 }
 
+static void dev_disable_change(struct inet6_dev *idev)
+{
+        if (!idev || !idev->dev)
+                return;
+
+        if (idev->cnf.disable_ipv6)
+                addrconf_notify(NULL, NETDEV_DOWN, idev->dev);
+        else
+                addrconf_notify(NULL, NETDEV_UP, idev->dev);
+}
+
+static void addrconf_disable_change(struct net *net, __s32 newf)
+{
+        struct net_device *dev;
+        struct inet6_dev *idev;
+
+        read_lock(&dev_base_lock);
+        for_each_netdev(net, dev) {
+                rcu_read_lock();
+                idev = __in6_dev_get(dev);
+                if (idev) {
+                        int changed = (!idev->cnf.disable_ipv6) ^ (!newf);
+                        idev->cnf.disable_ipv6 = newf;
+                        if (changed)
+                                dev_disable_change(idev);
+                }
+                rcu_read_unlock();
+        }
+        read_unlock(&dev_base_lock);
+}
+
+static int addrconf_disable_ipv6(struct ctl_table *table, int *p, int old)
+{
+        struct net *net;
+
+        net = (struct net *)table->extra2;
+
+        if (p == &net->ipv6.devconf_dflt->disable_ipv6)
+                return 0;
+
+        if (!rtnl_trylock())
+                return restart_syscall();
+
+        if (p == &net->ipv6.devconf_all->disable_ipv6) {
+                __s32 newf = net->ipv6.devconf_all->disable_ipv6;
+                net->ipv6.devconf_dflt->disable_ipv6 = newf;
+                addrconf_disable_change(net, newf);
+        } else if ((!*p) ^ (!old))
+                dev_disable_change((struct inet6_dev *)table->extra1);
+
+        rtnl_unlock();
+        return 0;
+}
+
+static
+int addrconf_sysctl_disable(ctl_table *ctl, int write, struct file * filp,
+                            void __user *buffer, size_t *lenp, loff_t *ppos)
+{
+        int *valp = ctl->data;
+        int val = *valp;
+        int ret;
+
+        ret = proc_dointvec(ctl, write, filp, buffer, lenp, ppos);
+
+        if (write)
+                ret = addrconf_disable_ipv6(ctl, valp, val);
+        return ret;
+}
+
 static struct addrconf_sysctl_table
 {
         struct ctl_table_header *sysctl_header;
@@ -4223,7 +4293,8 @@ static struct addrconf_sysctl_table
                         .data           =       &ipv6_devconf.disable_ipv6,
                         .maxlen         =       sizeof(int),
                         .mode           =       0644,
-                        .proc_handler   =       proc_dointvec,
+                        .proc_handler   =       addrconf_sysctl_disable,
+                        .strategy       =       sysctl_intvec,
                 },
                 {
                         .ctl_name       =       CTL_UNNUMBERED,
@@ -4344,6 +4415,10 @@ static int addrconf_init_net(struct net *net)
                 dflt = kmemdup(dflt, sizeof(ipv6_devconf_dflt), GFP_KERNEL);
                 if (dflt == NULL)
                         goto err_alloc_dflt;
+        } else {
+                /* these will be inherited by all namespaces */
+                dflt->autoconf = ipv6_defaults.autoconf;
+                dflt->disable_ipv6 = ipv6_defaults.disable_ipv6;
         }
 
         net->ipv6.devconf_all = all;
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index 61f55386a236..85b3d0036afd 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -72,9 +72,21 @@ MODULE_LICENSE("GPL");
 static struct list_head inetsw6[SOCK_MAX];
 static DEFINE_SPINLOCK(inetsw6_lock);
 
-static int disable_ipv6 = 0;
-module_param_named(disable, disable_ipv6, int, 0);
-MODULE_PARM_DESC(disable, "Disable IPv6 such that it is non-functional");
+struct ipv6_params ipv6_defaults = {
+        .disable_ipv6 = 0,
+        .autoconf = 1,
+};
+
+static int disable_ipv6_mod = 0;
+
+module_param_named(disable, disable_ipv6_mod, int, 0444);
+MODULE_PARM_DESC(disable, "Disable IPv6 module such that it is non-functional");
+
+module_param_named(disable_ipv6, ipv6_defaults.disable_ipv6, int, 0444);
+MODULE_PARM_DESC(disable_ipv6, "Disable IPv6 on all interfaces");
+
+module_param_named(autoconf, ipv6_defaults.autoconf, int, 0444);
+MODULE_PARM_DESC(autoconf, "Enable IPv6 address autoconfiguration on all interfaces");
 
 static __inline__ struct ipv6_pinfo *inet6_sk_generic(struct sock *sk)
 {
@@ -817,13 +829,20 @@ static struct sk_buff **ipv6_gro_receive(struct sk_buff **head,
         struct sk_buff *p;
         struct ipv6hdr *iph;
         unsigned int nlen;
+        unsigned int hlen;
+        unsigned int off;
         int flush = 1;
         int proto;
         __wsum csum;
 
-        iph = skb_gro_header(skb, sizeof(*iph));
-        if (unlikely(!iph))
-                goto out;
+        off = skb_gro_offset(skb);
+        hlen = off + sizeof(*iph);
+        iph = skb_gro_header_fast(skb, off);
+        if (skb_gro_header_hard(skb, hlen)) {
+                iph = skb_gro_header_slow(skb, hlen, off);
+                if (unlikely(!iph))
+                        goto out;
+        }
 
         skb_gro_pull(skb, sizeof(*iph));
         skb_set_transport_header(skb, skb_gro_offset(skb));
@@ -1031,7 +1050,7 @@ static int __init inet6_init(void)
         for(r = &inetsw6[0]; r < &inetsw6[SOCK_MAX]; ++r)
                 INIT_LIST_HEAD(r);
 
-        if (disable_ipv6) {
+        if (disable_ipv6_mod) {
                 printk(KERN_INFO
                        "IPv6: Loaded, but administratively disabled, "
                        "reboot required to enable\n");
@@ -1220,7 +1239,7 @@ module_init(inet6_init);
 
 static void __exit inet6_exit(void)
 {
-        if (disable_ipv6)
+        if (disable_ipv6_mod)
                 return;
 
         /* First of all disallow new sockets creation. */
diff --git a/net/ipv6/fib6_rules.c b/net/ipv6/fib6_rules.c
index f5de3f9dc692..00a7a5e4ac97 100644
--- a/net/ipv6/fib6_rules.c
+++ b/net/ipv6/fib6_rules.c
@@ -151,7 +151,7 @@ static const struct nla_policy fib6_rule_policy[FRA_MAX+1] = {
 };
 
 static int fib6_rule_configure(struct fib_rule *rule, struct sk_buff *skb,
-                               struct nlmsghdr *nlh, struct fib_rule_hdr *frh,
+                               struct fib_rule_hdr *frh,
                                struct nlattr **tb)
 {
         int err = -EINVAL;
@@ -211,7 +211,7 @@ static int fib6_rule_compare(struct fib_rule *rule, struct fib_rule_hdr *frh,
 }
 
 static int fib6_rule_fill(struct fib_rule *rule, struct sk_buff *skb,
-                          struct nlmsghdr *nlh, struct fib_rule_hdr *frh)
+                          struct fib_rule_hdr *frh)
 {
         struct fib6_rule *rule6 = (struct fib6_rule *) rule;
 
diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
index 8f04bd9da274..bc1a920c34a1 100644
--- a/net/ipv6/ip6_input.c
+++ b/net/ipv6/ip6_input.c
@@ -70,7 +70,7 @@ int ipv6_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt
 
         idev = __in6_dev_get(skb->dev);
 
-        IP6_INC_STATS_BH(net, idev, IPSTATS_MIB_INRECEIVES);
+        IP6_UPD_PO_STATS_BH(net, idev, IPSTATS_MIB_IN, skb->len);
 
         if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL ||
             !idev || unlikely(idev->cnf.disable_ipv6)) {
@@ -242,8 +242,9 @@ int ip6_mc_input(struct sk_buff *skb)
         struct ipv6hdr *hdr;
         int deliver;
 
-        IP6_INC_STATS_BH(dev_net(skb->dst->dev),
-                         ip6_dst_idev(skb->dst), IPSTATS_MIB_INMCASTPKTS);
+        IP6_UPD_PO_STATS_BH(dev_net(skb->dst->dev),
+                         ip6_dst_idev(skb->dst), IPSTATS_MIB_INMCAST,
+                         skb->len);
 
         hdr = ipv6_hdr(skb);
         deliver = ipv6_chk_mcast_addr(skb->dev, &hdr->daddr, NULL);
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 9fb49c3b518a..735a2bf4b5f1 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -159,7 +159,8 @@ static int ip6_output2(struct sk_buff *skb)
                         }
                 }
 
-                IP6_INC_STATS(dev_net(dev), idev, IPSTATS_MIB_OUTMCASTPKTS);
+                IP6_UPD_PO_STATS(dev_net(dev), idev, IPSTATS_MIB_OUTMCAST,
+                                skb->len);
         }
 
         return NF_HOOK(PF_INET6, NF_INET_POST_ROUTING, skb, NULL, skb->dev,
@@ -275,8 +276,8 @@ int ip6_xmit(struct sock *sk, struct sk_buff *skb, struct flowi *fl,
 
         mtu = dst_mtu(dst);
         if ((skb->len <= mtu) || skb->local_df || skb_is_gso(skb)) {
-                IP6_INC_STATS(net, ip6_dst_idev(skb->dst),
-                              IPSTATS_MIB_OUTREQUESTS);
+                IP6_UPD_PO_STATS(net, ip6_dst_idev(skb->dst),
+                              IPSTATS_MIB_OUT, skb->len);
                 return NF_HOOK(PF_INET6, NF_INET_LOCAL_OUT, skb, NULL, dst->dev,
                                 dst_output);
         }
@@ -1516,7 +1517,7 @@ int ip6_push_pending_frames(struct sock *sk)
         skb->mark = sk->sk_mark;
 
         skb->dst = dst_clone(&rt->u.dst);
-        IP6_INC_STATS(net, rt->rt6i_idev, IPSTATS_MIB_OUTREQUESTS);
+        IP6_UPD_PO_STATS(net, rt->rt6i_idev, IPSTATS_MIB_OUT, skb->len);
         if (proto == IPPROTO_ICMPV6) {
                 struct inet6_dev *idev = ip6_dst_idev(skb->dst);
 
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index d994c55a5b16..af256d47fd35 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -1100,8 +1100,8 @@ static void ip6_tnl_link_config(struct ip6_tnl *t)
         struct ip6_tnl_parm *p = &t->parms;
         struct flowi *fl = &t->fl;
 
-        memcpy(&dev->dev_addr, &p->laddr, sizeof(struct in6_addr));
-        memcpy(&dev->broadcast, &p->raddr, sizeof(struct in6_addr));
+        memcpy(dev->dev_addr, &p->laddr, sizeof(struct in6_addr));
+        memcpy(dev->broadcast, &p->raddr, sizeof(struct in6_addr));
 
         /* Set up flowi template */
         ipv6_addr_copy(&fl->fl6_src, &p->laddr);
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index a51fb33e6864..4b48819a5b8d 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -1449,7 +1449,8 @@ static void mld_sendpack(struct sk_buff *skb)
         int err;
         struct flowi fl;
 
-        IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTREQUESTS);
+        IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUT, skb->len);
+
         payload_len = (skb->tail - skb->network_header) - sizeof(*pip6);
         mldlen = skb->tail - skb->transport_header;
         pip6->payload_len = htons(payload_len);
@@ -1473,13 +1474,15 @@ static void mld_sendpack(struct sk_buff *skb)
         if (err)
                 goto err_out;
 
+        payload_len = skb->len;
+
         err = NF_HOOK(PF_INET6, NF_INET_LOCAL_OUT, skb, NULL, skb->dev,
                       dst_output);
 out:
         if (!err) {
                 ICMP6MSGOUT_INC_STATS_BH(net, idev, ICMPV6_MLD2_REPORT);
                 ICMP6_INC_STATS_BH(net, idev, ICMP6_MIB_OUTMSGS);
-                IP6_INC_STATS_BH(net, idev, IPSTATS_MIB_OUTMCASTPKTS);
+                IP6_UPD_PO_STATS_BH(net, idev, IPSTATS_MIB_OUTMCAST, payload_len);
         } else
                 IP6_INC_STATS_BH(net, idev, IPSTATS_MIB_OUTDISCARDS);
 
@@ -1773,10 +1776,6 @@ static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type)
                      IPV6_TLV_PADN, 0 };
         struct flowi fl;
 
-        rcu_read_lock();
-        IP6_INC_STATS(net, __in6_dev_get(dev),
-                      IPSTATS_MIB_OUTREQUESTS);
-        rcu_read_unlock();
         if (type == ICMPV6_MGM_REDUCTION)
                 snd_addr = &in6addr_linklocal_allrouters;
         else
@@ -1786,6 +1785,11 @@ static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type)
         payload_len = len + sizeof(ra);
         full_len = sizeof(struct ipv6hdr) + payload_len;
 
+        rcu_read_lock();
+        IP6_UPD_PO_STATS(net, __in6_dev_get(dev),
+                      IPSTATS_MIB_OUT, full_len);
+        rcu_read_unlock();
+
         skb = sock_alloc_send_skb(sk, LL_ALLOCATED_SPACE(dev) + full_len, 1, &err);
 
         if (skb == NULL) {
@@ -1838,13 +1842,14 @@ static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type)
         if (err)
                 goto err_out;
 
+
         err = NF_HOOK(PF_INET6, NF_INET_LOCAL_OUT, skb, NULL, skb->dev,
                       dst_output);
 out:
         if (!err) {
                 ICMP6MSGOUT_INC_STATS(net, idev, type);
                 ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTMSGS);
-                IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTMCASTPKTS);
+                IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUTMCAST, full_len);
         } else
                 IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTDISCARDS);
 
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 9f061d1adbc2..1d13d9964985 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -465,8 +465,8 @@ struct sk_buff *ndisc_build_skb(struct net_device *dev,
                                   1, &err);
         if (!skb) {
                 ND_PRINTK0(KERN_ERR
-                           "ICMPv6 ND: %s() failed to allocate an skb.\n",
-                           __func__);
+                           "ICMPv6 ND: %s() failed to allocate an skb, err=%d.\n",
+                           __func__, err);
                 return NULL;
         }
 
@@ -533,7 +533,7 @@ void ndisc_send_skb(struct sk_buff *skb,
         skb->dst = dst;
 
         idev = in6_dev_get(dst->dev);
-        IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTREQUESTS);
+        IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUT, skb->len);
 
         err = NF_HOOK(PF_INET6, NF_INET_LOCAL_OUT, skb, NULL, dst->dev,
                       dst_output);
@@ -658,6 +658,7 @@ void ndisc_send_rs(struct net_device *dev, const struct in6_addr *saddr,
                      &icmp6h, NULL,
                      send_sllao ? ND_OPT_SOURCE_LL_ADDR : 0);
 }
+EXPORT_SYMBOL(ndisc_send_rs);
 
 
 static void ndisc_error_report(struct neighbour *neigh, struct sk_buff *skb)
@@ -1561,8 +1562,8 @@ void ndisc_send_redirect(struct sk_buff *skb, struct neighbour *neigh,
                                    1, &err);
         if (buff == NULL) {
                 ND_PRINTK0(KERN_ERR
-                           "ICMPv6 Redirect: %s() failed to allocate an skb.\n",
-                           __func__);
+                           "ICMPv6 Redirect: %s() failed to allocate an skb, err=%d.\n",
+                           __func__, err);
                 goto release;
         }
 
@@ -1613,7 +1614,7 @@ void ndisc_send_redirect(struct sk_buff *skb, struct neighbour *neigh,
 
         buff->dst = dst;
         idev = in6_dev_get(dst->dev);
-        IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTREQUESTS);
+        IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUT, skb->len);
         err = NF_HOOK(PF_INET6, NF_INET_LOCAL_OUT, buff, NULL, dst->dev,
                       dst_output);
         if (!err) {
diff --git a/net/ipv6/proc.c b/net/ipv6/proc.c
index 97c17fdd6f75..590ddefb7ffc 100644
--- a/net/ipv6/proc.c
+++ b/net/ipv6/proc.c
@@ -61,7 +61,7 @@ static const struct file_operations sockstat6_seq_fops = {
 
 static struct snmp_mib snmp6_ipstats_list[] = {
 /* ipv6 mib according to RFC 2465 */
-        SNMP_MIB_ITEM("Ip6InReceives", IPSTATS_MIB_INRECEIVES),
+        SNMP_MIB_ITEM("Ip6InReceives", IPSTATS_MIB_INPKTS),
         SNMP_MIB_ITEM("Ip6InHdrErrors", IPSTATS_MIB_INHDRERRORS),
         SNMP_MIB_ITEM("Ip6InTooBigErrors", IPSTATS_MIB_INTOOBIGERRORS),
         SNMP_MIB_ITEM("Ip6InNoRoutes", IPSTATS_MIB_INNOROUTES),
@@ -71,7 +71,7 @@ static struct snmp_mib snmp6_ipstats_list[] = {
         SNMP_MIB_ITEM("Ip6InDiscards", IPSTATS_MIB_INDISCARDS),
         SNMP_MIB_ITEM("Ip6InDelivers", IPSTATS_MIB_INDELIVERS),
         SNMP_MIB_ITEM("Ip6OutForwDatagrams", IPSTATS_MIB_OUTFORWDATAGRAMS),
-        SNMP_MIB_ITEM("Ip6OutRequests", IPSTATS_MIB_OUTREQUESTS),
+        SNMP_MIB_ITEM("Ip6OutRequests", IPSTATS_MIB_OUTPKTS),
         SNMP_MIB_ITEM("Ip6OutDiscards", IPSTATS_MIB_OUTDISCARDS),
         SNMP_MIB_ITEM("Ip6OutNoRoutes", IPSTATS_MIB_OUTNOROUTES),
         SNMP_MIB_ITEM("Ip6ReasmTimeout", IPSTATS_MIB_REASMTIMEOUT),
@@ -83,6 +83,12 @@ static struct snmp_mib snmp6_ipstats_list[] = {
         SNMP_MIB_ITEM("Ip6FragCreates", IPSTATS_MIB_FRAGCREATES),
         SNMP_MIB_ITEM("Ip6InMcastPkts", IPSTATS_MIB_INMCASTPKTS),
         SNMP_MIB_ITEM("Ip6OutMcastPkts", IPSTATS_MIB_OUTMCASTPKTS),
+        SNMP_MIB_ITEM("Ip6InOctets", IPSTATS_MIB_INOCTETS),
+        SNMP_MIB_ITEM("Ip6OutOctets", IPSTATS_MIB_OUTOCTETS),
+        SNMP_MIB_ITEM("Ip6InMcastOctets", IPSTATS_MIB_INMCASTOCTETS),
+        SNMP_MIB_ITEM("Ip6OutMcastOctets", IPSTATS_MIB_OUTMCASTOCTETS),
+        SNMP_MIB_ITEM("Ip6InBcastOctets", IPSTATS_MIB_INBCASTOCTETS),
+        SNMP_MIB_ITEM("Ip6OutBcastOctets", IPSTATS_MIB_OUTBCASTOCTETS),
         SNMP_MIB_SENTINEL
 };
 
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 61f6827e5906..e99307fba0b1 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -638,7 +638,7 @@ static int rawv6_send_hdrinc(struct sock *sk, void *from, int length,
         if (err)
                 goto error_fault;
 
-        IP6_INC_STATS(sock_net(sk), rt->rt6i_idev, IPSTATS_MIB_OUTREQUESTS);
+        IP6_UPD_PO_STATS(sock_net(sk), rt->rt6i_idev, IPSTATS_MIB_OUT, skb->len);
         err = NF_HOOK(PF_INET6, NF_INET_LOCAL_OUT, skb, NULL, rt->u.dst.dev,
                       dst_output);
         if (err > 0)
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 664ab82e03b2..b3a59bd40f01 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -15,6 +15,7 @@
  * Roger Venning <r.venning@telstra.com>:       6to4 support
  * Nate Thompson <nate@thebog.net>:             6to4 support
  * Fred Templin <fred.l.templin@boeing.com>:    isatap support
+ * Sascha Hlusiak <mail@saschahlusiak.de>:      stateless autoconf for isatap
  */
 
 #include <linux/module.h>
@@ -80,7 +81,7 @@ struct sit_net {
 static DEFINE_RWLOCK(ipip6_lock);
 
 static struct ip_tunnel * ipip6_tunnel_lookup(struct net *net,
-                __be32 remote, __be32 local)
+                struct net_device *dev, __be32 remote, __be32 local)
 {
         unsigned h0 = HASH(remote);
         unsigned h1 = HASH(local);
@@ -89,18 +90,25 @@ static struct ip_tunnel * ipip6_tunnel_lookup(struct net *net,
 
         for (t = sitn->tunnels_r_l[h0^h1]; t; t = t->next) {
                 if (local == t->parms.iph.saddr &&
-                    remote == t->parms.iph.daddr && (t->dev->flags&IFF_UP))
+                    remote == t->parms.iph.daddr &&
+                    (!dev || !t->parms.link || dev->iflink == t->parms.link) &&
+                    (t->dev->flags & IFF_UP))
                         return t;
         }
         for (t = sitn->tunnels_r[h0]; t; t = t->next) {
-                if (remote == t->parms.iph.daddr && (t->dev->flags&IFF_UP))
+                if (remote == t->parms.iph.daddr &&
+                    (!dev || !t->parms.link || dev->iflink == t->parms.link) &&
+                    (t->dev->flags & IFF_UP))
                         return t;
         }
         for (t = sitn->tunnels_l[h1]; t; t = t->next) {
-                if (local == t->parms.iph.saddr && (t->dev->flags&IFF_UP))
+                if (local == t->parms.iph.saddr &&
+                    (!dev || !t->parms.link || dev->iflink == t->parms.link) &&
+                    (t->dev->flags & IFF_UP))
                         return t;
         }
-        if ((t = sitn->tunnels_wc[0]) != NULL && (t->dev->flags&IFF_UP))
+        t = sitn->tunnels_wc[0];
+        if ((t != NULL) && (t->dev->flags & IFF_UP))
                 return t;
         return NULL;
 }
@@ -165,8 +173,14 @@ static struct ip_tunnel * ipip6_tunnel_locate(struct net *net,
         struct sit_net *sitn = net_generic(net, sit_net_id);
 
         for (tp = __ipip6_bucket(sitn, parms); (t = *tp) != NULL; tp = &t->next) {
-                if (local == t->parms.iph.saddr && remote == t->parms.iph.daddr)
-                        return t;
+                if (local == t->parms.iph.saddr &&
+                    remote == t->parms.iph.daddr &&
+                    parms->link == t->parms.link) {
+                        if (create)
+                                return NULL;
+                        else
+                                return t;
+                }
         }
         if (!create)
                 goto failed;
@@ -209,6 +223,44 @@ failed:
         return NULL;
 }
 
+static void ipip6_tunnel_rs_timer(unsigned long data)
+{
+        struct ip_tunnel_prl_entry *p = (struct ip_tunnel_prl_entry *) data;
+        struct inet6_dev *ifp;
+        struct inet6_ifaddr *addr;
+
+        spin_lock(&p->lock);
+        ifp = __in6_dev_get(p->tunnel->dev);
+
+        read_lock_bh(&ifp->lock);
+        for (addr = ifp->addr_list; addr; addr = addr->if_next) {
+                struct in6_addr rtr;
+
+                if (!(ipv6_addr_type(&addr->addr) & IPV6_ADDR_LINKLOCAL))
+                        continue;
+
+                /* Send RS to guessed linklocal address of router
+                 *
+                 * Better: send to ff02::2 encapsuled in unicast directly
+                 * to router-v4 instead of guessing the v6 address.
+                 *
+                 * Cisco/Windows seem to not set the u/l bit correctly,
+                 * so we won't guess right.
+                 */
+                ipv6_addr_set(&rtr,  htonl(0xFE800000), 0, 0, 0);
+                if (!__ipv6_isatap_ifid(rtr.s6_addr + 8,
+                                        p->addr)) {
+                        ndisc_send_rs(p->tunnel->dev, &addr->addr, &rtr);
+                }
+        }
+        read_unlock_bh(&ifp->lock);
+
+        mod_timer(&p->rs_timer, jiffies + HZ * p->rs_delay);
+        spin_unlock(&p->lock);
+
+        return;
+}
+
 static struct ip_tunnel_prl_entry *
 __ipip6_tunnel_locate_prl(struct ip_tunnel *t, __be32 addr)
 {
@@ -267,6 +319,7 @@ static int ipip6_tunnel_get_prl(struct ip_tunnel *t,
                         continue;
                 kp[c].addr = prl->addr;
                 kp[c].flags = prl->flags;
+                kp[c].rs_delay = prl->rs_delay;
                 c++;
                 if (kprl.addr != htonl(INADDR_ANY))
                         break;
@@ -316,11 +369,23 @@ ipip6_tunnel_add_prl(struct ip_tunnel *t, struct ip_tunnel_prl *a, int chg)
         }
 
         p->next = t->prl;
+        p->tunnel = t;
         t->prl = p;
         t->prl_count++;
+
+        spin_lock_init(&p->lock);
+        setup_timer(&p->rs_timer, ipip6_tunnel_rs_timer, (unsigned long) p);
 update:
         p->addr = a->addr;
         p->flags = a->flags;
+        p->rs_delay = a->rs_delay;
+        if (p->rs_delay == 0)
+                p->rs_delay = IPTUNNEL_RS_DEFAULT_DELAY;
+        spin_lock(&p->lock);
+        del_timer(&p->rs_timer);
+        if (p->flags & PRL_DEFAULT)
+                mod_timer(&p->rs_timer, jiffies + 1);
+        spin_unlock(&p->lock);
 out:
         write_unlock(&ipip6_lock);
         return err;
@@ -339,6 +404,9 @@ ipip6_tunnel_del_prl(struct ip_tunnel *t, struct ip_tunnel_prl *a)
                         if ((*p)->addr == a->addr) {
                                 x = *p;
                                 *p = x->next;
+                                spin_lock(&x->lock);
+                                del_timer(&x->rs_timer);
+                                spin_unlock(&x->lock);
                                 kfree(x);
                                 t->prl_count--;
                                 goto out;
@@ -349,13 +417,16 @@ ipip6_tunnel_del_prl(struct ip_tunnel *t, struct ip_tunnel_prl *a)
                 while (t->prl) {
                         x = t->prl;
                         t->prl = t->prl->next;
+                        spin_lock(&x->lock);
+                        del_timer(&x->rs_timer);
+                        spin_unlock(&x->lock);
                         kfree(x);
                         t->prl_count--;
                 }
         }
 out:
         write_unlock(&ipip6_lock);
-        return 0;
+        return err;
 }
 
 static int
@@ -446,7 +517,10 @@ static int ipip6_err(struct sk_buff *skb, u32 info)
         err = -ENOENT;
 
         read_lock(&ipip6_lock);
-        t = ipip6_tunnel_lookup(dev_net(skb->dev), iph->daddr, iph->saddr);
+        t = ipip6_tunnel_lookup(dev_net(skb->dev),
+                                skb->dev,
+                                iph->daddr,
+                                iph->saddr);
         if (t == NULL || t->parms.iph.daddr == 0)
                 goto out;
 
@@ -481,8 +555,9 @@ static int ipip6_rcv(struct sk_buff *skb)
         iph = ip_hdr(skb);
 
         read_lock(&ipip6_lock);
-        if ((tunnel = ipip6_tunnel_lookup(dev_net(skb->dev),
-                                        iph->saddr, iph->daddr)) != NULL) {
+        tunnel = ipip6_tunnel_lookup(dev_net(skb->dev), skb->dev,
+                                     iph->saddr, iph->daddr);
+        if (tunnel != NULL) {
                 secpath_reset(skb);
                 skb->mac_header = skb->network_header;
                 skb_reset_network_header(skb);
diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c
index 711175e0571f..8c2513982b61 100644
--- a/net/ipv6/syncookies.c
+++ b/net/ipv6/syncookies.c
@@ -131,7 +131,7 @@ __u32 cookie_v6_init_sequence(struct sock *sk, struct sk_buff *skb, __u16 *mssp)
         int mssind;
         const __u16 mss = *mssp;
 
-        tcp_sk(sk)->last_synq_overflow = jiffies;
+        tcp_synq_overflow(sk);
 
         for (mssind = 0; mss > msstab[mssind + 1]; mssind++)
                 ;
@@ -175,7 +175,7 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
         if (!sysctl_tcp_syncookies || !th->ack)
                 goto out;
 
-        if (time_after(jiffies, tp->last_synq_overflow + TCP_TIMEOUT_INIT) ||
+        if (tcp_synq_no_recent_overflow(sk) ||
                 (mss = cookie_check(skb, cookie)) == 0) {
                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_SYNCOOKIESFAILED);
                 goto out;
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 4b5aa1854260..ea37741062a9 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -941,9 +941,10 @@ static int tcp_v6_gso_send_check(struct sk_buff *skb)
         return 0;
 }
 
-struct sk_buff **tcp6_gro_receive(struct sk_buff **head, struct sk_buff *skb)
+static struct sk_buff **tcp6_gro_receive(struct sk_buff **head,
+                                         struct sk_buff *skb)
 {
-        struct ipv6hdr *iph = ipv6_hdr(skb);
+        struct ipv6hdr *iph = skb_gro_network_header(skb);
 
         switch (skb->ip_summed) {
         case CHECKSUM_COMPLETE:
@@ -961,9 +962,8 @@ struct sk_buff **tcp6_gro_receive(struct sk_buff **head, struct sk_buff *skb)
 
         return tcp_gro_receive(head, skb);
 }
-EXPORT_SYMBOL(tcp6_gro_receive);
 
-int tcp6_gro_complete(struct sk_buff *skb)
+static int tcp6_gro_complete(struct sk_buff *skb)
 {
         struct ipv6hdr *iph = ipv6_hdr(skb);
         struct tcphdr *th = tcp_hdr(skb);
@@ -974,7 +974,6 @@ int tcp6_gro_complete(struct sk_buff *skb)
 
         return tcp_gro_complete(skb);
 }
-EXPORT_SYMBOL(tcp6_gro_complete);
 
 static void tcp_v6_send_response(struct sk_buff *skb, u32 seq, u32 ack, u32 win,
                                  u32 ts, struct tcp_md5sig_key *key, int rst)
diff --git a/net/irda/irlap_frame.c b/net/irda/irlap_frame.c
index 2562ebc1b22c..7af2e74deda8 100644
--- a/net/irda/irlap_frame.c
+++ b/net/irda/irlap_frame.c
@@ -982,17 +982,12 @@ void irlap_resend_rejected_frames(struct irlap_cb *self, int command)
 {
         struct sk_buff *tx_skb;
         struct sk_buff *skb;
-        int count;
 
         IRDA_ASSERT(self != NULL, return;);
         IRDA_ASSERT(self->magic == LAP_MAGIC, return;);
 
-        /* Initialize variables */
-        count = skb_queue_len(&self->wx_list);
-
         /*  Resend unacknowledged frame(s) */
-        skb = skb_peek(&self->wx_list);
-        while (skb != NULL) {
+        skb_queue_walk(&self->wx_list, skb) {
                 irlap_wait_min_turn_around(self, &self->qos_tx);
 
                 /* We copy the skb to be retransmitted since we will have to
@@ -1011,21 +1006,12 @@ void irlap_resend_rejected_frames(struct irlap_cb *self, int command)
                 /*
                  *  Set poll bit on the last frame retransmitted
                  */
-                if (count-- == 1)
+                if (skb_queue_is_last(&self->wx_list, skb))
                         tx_skb->data[1] |= PF_BIT; /* Set p/f bit */
                 else
                         tx_skb->data[1] &= ~PF_BIT; /* Clear p/f bit */
 
                 irlap_send_i_frame(self, tx_skb, command);
-
-                /*
-                 *  If our skb is the last buffer in the list, then
-                 *  we are finished, if not, move to the next sk-buffer
-                 */
-                if (skb == skb_peek_tail(&self->wx_list))
-                        skb = NULL;
-                else
-                        skb = skb->next;
         }
 #if 0 /* Not yet */
         /*
diff --git a/net/irda/irnetlink.c b/net/irda/irnetlink.c
index 2f05ec1037ab..8dd7ed7e7c1f 100644
--- a/net/irda/irnetlink.c
+++ b/net/irda/irnetlink.c
@@ -87,7 +87,7 @@ static int irda_nl_get_mode(struct sk_buff *skb, struct genl_info *info)
         if (!dev)
                 return -ENODEV;
 
-        msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
+        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
         if (!msg) {
                 dev_put(dev);
                 return -ENOMEM;
@@ -148,21 +148,8 @@ static struct genl_ops irda_nl_ops[] = {
 
 int irda_nl_register(void)
 {
-        int err, i;
-
-        err = genl_register_family(&irda_nl_family);
-        if (err)
-                return err;
-
-        for (i = 0; i < ARRAY_SIZE(irda_nl_ops); i++) {
-                err = genl_register_ops(&irda_nl_family, &irda_nl_ops[i]);
-                if (err)
-                        goto err_out;
-        }
-        return 0;
- err_out:
-        genl_unregister_family(&irda_nl_family);
-        return err;
+        return genl_register_family_with_ops(&irda_nl_family,
+                irda_nl_ops, ARRAY_SIZE(irda_nl_ops));
 }
 
 void irda_nl_unregister(void)
diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
index b51c9187c347..a9b3a6f9ea95 100644
--- a/net/iucv/af_iucv.c
+++ b/net/iucv/af_iucv.c
@@ -29,10 +29,7 @@
 #include <net/iucv/iucv.h>
 #include <net/iucv/af_iucv.h>
 
-#define CONFIG_IUCV_SOCK_DEBUG 1
-
-#define IPRMDATA 0x80
-#define VERSION "1.0"
+#define VERSION "1.1"
 
 static char iucv_userid[80];
 
@@ -44,6 +41,19 @@ static struct proto iucv_proto = {
         .obj_size       = sizeof(struct iucv_sock),
 };
 
+/* special AF_IUCV IPRM messages */
+static const u8 iprm_shutdown[8] =
+        {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01};
+
+#define TRGCLS_SIZE     (sizeof(((struct iucv_message *)0)->class))
+
+/* macros to set/get socket control buffer at correct offset */
+#define CB_TAG(skb)     ((skb)->cb)             /* iucv message tag */
+#define CB_TAG_LEN      (sizeof(((struct iucv_message *) 0)->tag))
+#define CB_TRGCLS(skb)  ((skb)->cb + CB_TAG_LEN) /* iucv msg target class */
+#define CB_TRGCLS_LEN   (TRGCLS_SIZE)
+
+
 static void iucv_sock_kill(struct sock *sk);
 static void iucv_sock_close(struct sock *sk);
 
@@ -54,6 +64,7 @@ static void iucv_callback_connack(struct iucv_path *, u8 ipuser[16]);
 static int iucv_callback_connreq(struct iucv_path *, u8 ipvmid[8],
                                  u8 ipuser[16]);
 static void iucv_callback_connrej(struct iucv_path *, u8 ipuser[16]);
+static void iucv_callback_shutdown(struct iucv_path *, u8 ipuser[16]);
 
 static struct iucv_sock_list iucv_sk_list = {
         .lock = __RW_LOCK_UNLOCKED(iucv_sk_list.lock),
@@ -65,7 +76,8 @@ static struct iucv_handler af_iucv_handler = {
         .path_complete    = iucv_callback_connack,
         .path_severed     = iucv_callback_connrej,
         .message_pending  = iucv_callback_rx,
-        .message_complete = iucv_callback_txdone
+        .message_complete = iucv_callback_txdone,
+        .path_quiesced    = iucv_callback_shutdown,
 };
 
 static inline void high_nmcpy(unsigned char *dst, char *src)
@@ -78,6 +90,37 @@ static inline void low_nmcpy(unsigned char *dst, char *src)
        memcpy(&dst[8], src, 8);
 }
 
+/**
+ * iucv_msg_length() - Returns the length of an iucv message.
+ * @msg:        Pointer to struct iucv_message, MUST NOT be NULL
+ *
+ * The function returns the length of the specified iucv message @msg of data
+ * stored in a buffer and of data stored in the parameter list (PRMDATA).
+ *
+ * For IUCV_IPRMDATA, AF_IUCV uses the following convention to transport socket
+ * data:
+ *      PRMDATA[0..6]   socket data (max 7 bytes);
+ *      PRMDATA[7]      socket data length value (len is 0xff - PRMDATA[7])
+ *
+ * The socket data length is computed by substracting the socket data length
+ * value from 0xFF.
+ * If the socket data len is greater 7, then PRMDATA can be used for special
+ * notifications (see iucv_sock_shutdown); and further,
+ * if the socket data len is > 7, the function returns 8.
+ *
+ * Use this function to allocate socket buffers to store iucv message data.
+ */
+static inline size_t iucv_msg_length(struct iucv_message *msg)
+{
+        size_t datalen;
+
+        if (msg->flags & IUCV_IPRMDATA) {
+                datalen = 0xff - msg->rmmsg[7];
+                return (datalen < 8) ? datalen : 8;
+        }
+        return msg->length;
+}
+
 /* Timers */
 static void iucv_sock_timeout(unsigned long arg)
 {
@@ -225,6 +268,8 @@ static struct sock *iucv_sock_alloc(struct socket *sock, int proto, gfp_t prio)
         spin_lock_init(&iucv_sk(sk)->message_q.lock);
         skb_queue_head_init(&iucv_sk(sk)->backlog_skb_q);
         iucv_sk(sk)->send_tag = 0;
+        iucv_sk(sk)->flags = 0;
+        iucv_sk(sk)->msglimit = IUCV_QUEUELEN_DEFAULT;
         iucv_sk(sk)->path = NULL;
         memset(&iucv_sk(sk)->src_user_id , 0, 32);
 
@@ -248,11 +293,22 @@ static int iucv_sock_create(struct net *net, struct socket *sock, int protocol)
 {
         struct sock *sk;
 
-        if (sock->type != SOCK_STREAM)
-                return -ESOCKTNOSUPPORT;
+        if (protocol && protocol != PF_IUCV)
+                return -EPROTONOSUPPORT;
 
         sock->state = SS_UNCONNECTED;
-        sock->ops = &iucv_sock_ops;
+
+        switch (sock->type) {
+        case SOCK_STREAM:
+                sock->ops = &iucv_sock_ops;
+                break;
+        case SOCK_SEQPACKET:
+                /* currently, proto ops can handle both sk types */
+                sock->ops = &iucv_sock_ops;
+                break;
+        default:
+                return -ESOCKTNOSUPPORT;
+        }
 
         sk = iucv_sock_alloc(sock, protocol, GFP_KERNEL);
         if (!sk)
@@ -463,11 +519,9 @@ static int iucv_sock_connect(struct socket *sock, struct sockaddr *addr,
         if (sk->sk_state != IUCV_OPEN && sk->sk_state != IUCV_BOUND)
                 return -EBADFD;
 
-        if (sk->sk_type != SOCK_STREAM)
+        if (sk->sk_type != SOCK_STREAM && sk->sk_type != SOCK_SEQPACKET)
                 return -EINVAL;
 
-        iucv = iucv_sk(sk);
-
         if (sk->sk_state == IUCV_OPEN) {
                 err = iucv_sock_autobind(sk);
                 if (unlikely(err))
@@ -486,8 +540,8 @@ static int iucv_sock_connect(struct socket *sock, struct sockaddr *addr,
 
         iucv = iucv_sk(sk);
         /* Create path. */
-        iucv->path = iucv_path_alloc(IUCV_QUEUELEN_DEFAULT,
-                                     IPRMDATA, GFP_KERNEL);
+        iucv->path = iucv_path_alloc(iucv->msglimit,
+                                     IUCV_IPRMDATA, GFP_KERNEL);
         if (!iucv->path) {
                 err = -ENOMEM;
                 goto done;
@@ -521,8 +575,7 @@ static int iucv_sock_connect(struct socket *sock, struct sockaddr *addr,
         }
 
         if (sk->sk_state == IUCV_DISCONN) {
-                release_sock(sk);
-                return -ECONNREFUSED;
+                err = -ECONNREFUSED;
         }
 
         if (err) {
@@ -545,7 +598,10 @@ static int iucv_sock_listen(struct socket *sock, int backlog)
         lock_sock(sk);
 
         err = -EINVAL;
-        if (sk->sk_state != IUCV_BOUND || sock->type != SOCK_STREAM)
+        if (sk->sk_state != IUCV_BOUND)
+                goto done;
+
+        if (sock->type != SOCK_STREAM && sock->type != SOCK_SEQPACKET)
                 goto done;
 
         sk->sk_max_ack_backlog = backlog;
@@ -636,6 +692,30 @@ static int iucv_sock_getname(struct socket *sock, struct sockaddr *addr,
         return 0;
 }
 
+/**
+ * iucv_send_iprm() - Send socket data in parameter list of an iucv message.
+ * @path:       IUCV path
+ * @msg:        Pointer to a struct iucv_message
+ * @skb:        The socket data to send, skb->len MUST BE <= 7
+ *
+ * Send the socket data in the parameter list in the iucv message
+ * (IUCV_IPRMDATA). The socket data is stored at index 0 to 6 in the parameter
+ * list and the socket data len at index 7 (last byte).
+ * See also iucv_msg_length().
+ *
+ * Returns the error code from the iucv_message_send() call.
+ */
+static int iucv_send_iprm(struct iucv_path *path, struct iucv_message *msg,
+                          struct sk_buff *skb)
+{
+        u8 prmdata[8];
+
+        memcpy(prmdata, (void *) skb->data, skb->len);
+        prmdata[7] = 0xff - (u8) skb->len;
+        return iucv_message_send(path, msg, IUCV_IPRMDATA, 0,
+                                 (void *) prmdata, 8);
+}
+
 static int iucv_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
                              struct msghdr *msg, size_t len)
 {
@@ -643,6 +723,8 @@ static int iucv_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
         struct iucv_sock *iucv = iucv_sk(sk);
         struct sk_buff *skb;
         struct iucv_message txmsg;
+        struct cmsghdr *cmsg;
+        int cmsg_done;
         char user_id[9];
         char appl_id[9];
         int err;
@@ -654,6 +736,10 @@ static int iucv_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
         if (msg->msg_flags & MSG_OOB)
                 return -EOPNOTSUPP;
 
+        /* SOCK_SEQPACKET: we do not support segmented records */
+        if (sk->sk_type == SOCK_SEQPACKET && !(msg->msg_flags & MSG_EOR))
+                return -EOPNOTSUPP;
+
         lock_sock(sk);
 
         if (sk->sk_shutdown & SEND_SHUTDOWN) {
@@ -662,6 +748,52 @@ static int iucv_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
         }
 
         if (sk->sk_state == IUCV_CONNECTED) {
+                /* initialize defaults */
+                cmsg_done   = 0;        /* check for duplicate headers */
+                txmsg.class = 0;
+
+                /* iterate over control messages */
+                for (cmsg = CMSG_FIRSTHDR(msg); cmsg;
+                     cmsg = CMSG_NXTHDR(msg, cmsg)) {
+
+                        if (!CMSG_OK(msg, cmsg)) {
+                                err = -EINVAL;
+                                goto out;
+                        }
+
+                        if (cmsg->cmsg_level != SOL_IUCV)
+                                continue;
+
+                        if (cmsg->cmsg_type & cmsg_done) {
+                                err = -EINVAL;
+                                goto out;
+                        }
+                        cmsg_done |= cmsg->cmsg_type;
+
+                        switch (cmsg->cmsg_type) {
+                        case SCM_IUCV_TRGCLS:
+                                if (cmsg->cmsg_len != CMSG_LEN(TRGCLS_SIZE)) {
+                                        err = -EINVAL;
+                                        goto out;
+                                }
+
+                                /* set iucv message target class */
+                                memcpy(&txmsg.class,
+                                        (void *) CMSG_DATA(cmsg), TRGCLS_SIZE);
+
+                                break;
+
+                        default:
+                                err = -EINVAL;
+                                goto out;
+                                break;
+                        }
+                }
+
+                /* allocate one skb for each iucv message:
+                 * this is fine for SOCK_SEQPACKET (unless we want to support
+                 * segmented records using the MSG_EOR flag), but
+                 * for SOCK_STREAM we might want to improve it in future */
                 if (!(skb = sock_alloc_send_skb(sk, len,
                                                 msg->msg_flags & MSG_DONTWAIT,
                                                 &err)))
@@ -672,13 +804,33 @@ static int iucv_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
                         goto fail;
                 }
 
-                txmsg.class = 0;
-                memcpy(&txmsg.class, skb->data, skb->len >= 4 ? 4 : skb->len);
+                /* increment and save iucv message tag for msg_completion cbk */
                 txmsg.tag = iucv->send_tag++;
-                memcpy(skb->cb, &txmsg.tag, 4);
+                memcpy(CB_TAG(skb), &txmsg.tag, CB_TAG_LEN);
                 skb_queue_tail(&iucv->send_skb_q, skb);
-                err = iucv_message_send(iucv->path, &txmsg, 0, 0,
-                                        (void *) skb->data, skb->len);
+
+                if (((iucv->path->flags & IUCV_IPRMDATA) & iucv->flags)
+                    && skb->len <= 7) {
+                        err = iucv_send_iprm(iucv->path, &txmsg, skb);
+
+                        /* on success: there is no message_complete callback
+                         * for an IPRMDATA msg; remove skb from send queue */
+                        if (err == 0) {
+                                skb_unlink(skb, &iucv->send_skb_q);
+                                kfree_skb(skb);
+                        }
+
+                        /* this error should never happen since the
+                         * IUCV_IPRMDATA path flag is set... sever path */
+                        if (err == 0x15) {
+                                iucv_path_sever(iucv->path, NULL);
+                                skb_unlink(skb, &iucv->send_skb_q);
+                                err = -EPIPE;
+                                goto fail;
+                        }
+                } else
+                        err = iucv_message_send(iucv->path, &txmsg, 0, 0,
+                                                (void *) skb->data, skb->len);
                 if (err) {
                         if (err == 3) {
                                 user_id[8] = 0;
@@ -725,6 +877,10 @@ static int iucv_fragment_skb(struct sock *sk, struct sk_buff *skb, int len)
                 if (!nskb)
                         return -ENOMEM;
 
+                /* copy target class to control buffer of new skb */
+                memcpy(CB_TRGCLS(nskb), CB_TRGCLS(skb), CB_TRGCLS_LEN);
+
+                /* copy data fragment */
                 memcpy(nskb->data, skb->data + copied, size);
                 copied += size;
                 dataleft -= size;
@@ -744,19 +900,33 @@ static void iucv_process_message(struct sock *sk, struct sk_buff *skb,
                                  struct iucv_message *msg)
 {
         int rc;
+        unsigned int len;
+
+        len = iucv_msg_length(msg);
 
-        if (msg->flags & IPRMDATA) {
-                skb->data = NULL;
-                skb->len = 0;
+        /* store msg target class in the second 4 bytes of skb ctrl buffer */
+        /* Note: the first 4 bytes are reserved for msg tag */
+        memcpy(CB_TRGCLS(skb), &msg->class, CB_TRGCLS_LEN);
+
+        /* check for special IPRM messages (e.g. iucv_sock_shutdown) */
+        if ((msg->flags & IUCV_IPRMDATA) && len > 7) {
+                if (memcmp(msg->rmmsg, iprm_shutdown, 8) == 0) {
+                        skb->data = NULL;
+                        skb->len = 0;
+                }
         } else {
-                rc = iucv_message_receive(path, msg, 0, skb->data,
-                                          msg->length, NULL);
+                rc = iucv_message_receive(path, msg, msg->flags & IUCV_IPRMDATA,
+                                          skb->data, len, NULL);
                 if (rc) {
                         kfree_skb(skb);
                         return;
                 }
-                if (skb->truesize >= sk->sk_rcvbuf / 4) {
-                        rc = iucv_fragment_skb(sk, skb, msg->length);
+                /* we need to fragment iucv messages for SOCK_STREAM only;
+                 * for SOCK_SEQPACKET, it is only relevant if we support
+                 * record segmentation using MSG_EOR (see also recvmsg()) */
+                if (sk->sk_type == SOCK_STREAM &&
+                    skb->truesize >= sk->sk_rcvbuf / 4) {
+                        rc = iucv_fragment_skb(sk, skb, len);
                         kfree_skb(skb);
                         skb = NULL;
                         if (rc) {
@@ -767,7 +937,7 @@ static void iucv_process_message(struct sock *sk, struct sk_buff *skb,
                 } else {
                         skb_reset_transport_header(skb);
                         skb_reset_network_header(skb);
-                        skb->len = msg->length;
+                        skb->len = len;
                 }
         }
 
@@ -782,7 +952,7 @@ static void iucv_process_message_q(struct sock *sk)
         struct sock_msg_q *p, *n;
 
         list_for_each_entry_safe(p, n, &iucv->message_q.list, list) {
-                skb = alloc_skb(p->msg.length, GFP_ATOMIC | GFP_DMA);
+                skb = alloc_skb(iucv_msg_length(&p->msg), GFP_ATOMIC | GFP_DMA);
                 if (!skb)
                         break;
                 iucv_process_message(sk, skb, p->path, &p->msg);
@@ -799,7 +969,7 @@ static int iucv_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
         int noblock = flags & MSG_DONTWAIT;
         struct sock *sk = sock->sk;
         struct iucv_sock *iucv = iucv_sk(sk);
-        int target, copied = 0;
+        unsigned int copied, rlen;
         struct sk_buff *skb, *rskb, *cskb;
         int err = 0;
 
@@ -812,8 +982,6 @@ static int iucv_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
         if (flags & (MSG_OOB))
                 return -EOPNOTSUPP;
 
-        target = sock_rcvlowat(sk, flags & MSG_WAITALL, len);
-
         /* receive/dequeue next skb:
          * the function understands MSG_PEEK and, thus, does not dequeue skb */
         skb = skb_recv_datagram(sk, flags, noblock, &err);
@@ -823,25 +991,45 @@ static int iucv_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
                 return err;
         }
 
-        copied = min_t(unsigned int, skb->len, len);
+        rlen   = skb->len;              /* real length of skb */
+        copied = min_t(unsigned int, rlen, len);
 
         cskb = skb;
         if (memcpy_toiovec(msg->msg_iov, cskb->data, copied)) {
-                skb_queue_head(&sk->sk_receive_queue, skb);
-                if (copied == 0)
-                        return -EFAULT;
-                goto done;
+                if (!(flags & MSG_PEEK))
+                        skb_queue_head(&sk->sk_receive_queue, skb);
+                return -EFAULT;
         }
 
-        len -= copied;
+        /* SOCK_SEQPACKET: set MSG_TRUNC if recv buf size is too small */
+        if (sk->sk_type == SOCK_SEQPACKET) {
+                if (copied < rlen)
+                        msg->msg_flags |= MSG_TRUNC;
+                /* each iucv message contains a complete record */
+                msg->msg_flags |= MSG_EOR;
+        }
+
+        /* create control message to store iucv msg target class:
+         * get the trgcls from the control buffer of the skb due to
+         * fragmentation of original iucv message. */
+        err = put_cmsg(msg, SOL_IUCV, SCM_IUCV_TRGCLS,
+                        CB_TRGCLS_LEN, CB_TRGCLS(skb));
+        if (err) {
+                if (!(flags & MSG_PEEK))
+                        skb_queue_head(&sk->sk_receive_queue, skb);
+                return err;
+        }
 
         /* Mark read part of skb as used */
         if (!(flags & MSG_PEEK)) {
-                skb_pull(skb, copied);
 
-                if (skb->len) {
-                        skb_queue_head(&sk->sk_receive_queue, skb);
-                        goto done;
+                /* SOCK_STREAM: re-queue skb if it contains unreceived data */
+                if (sk->sk_type == SOCK_STREAM) {
+                        skb_pull(skb, copied);
+                        if (skb->len) {
+                                skb_queue_head(&sk->sk_receive_queue, skb);
+                                goto done;
+                        }
                 }
 
                 kfree_skb(skb);
@@ -866,7 +1054,11 @@ static int iucv_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
         }
 
 done:
-        return err ? : copied;
+        /* SOCK_SEQPACKET: return real length if MSG_TRUNC is set */
+        if (sk->sk_type == SOCK_SEQPACKET && (flags & MSG_TRUNC))
+                copied = rlen;
+
+        return copied;
 }
 
 static inline unsigned int iucv_accept_poll(struct sock *parent)
@@ -928,7 +1120,6 @@ static int iucv_sock_shutdown(struct socket *sock, int how)
         struct iucv_sock *iucv = iucv_sk(sk);
         struct iucv_message txmsg;
         int err = 0;
-        u8 prmmsg[8] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01};
 
         how++;
 
@@ -953,7 +1144,7 @@ static int iucv_sock_shutdown(struct socket *sock, int how)
                 txmsg.class = 0;
                 txmsg.tag = 0;
                 err = iucv_message_send(iucv->path, &txmsg, IUCV_IPRMDATA, 0,
-                                        (void *) prmmsg, 8);
+                                        (void *) iprm_shutdown, 8);
                 if (err) {
                         switch (err) {
                         case 1:
@@ -1007,6 +1198,98 @@ static int iucv_sock_release(struct socket *sock)
         return err;
 }
 
+/* getsockopt and setsockopt */
+static int iucv_sock_setsockopt(struct socket *sock, int level, int optname,
+                                char __user *optval, int optlen)
+{
+        struct sock *sk = sock->sk;
+        struct iucv_sock *iucv = iucv_sk(sk);
+        int val;
+        int rc;
+
+        if (level != SOL_IUCV)
+                return -ENOPROTOOPT;
+
+        if (optlen < sizeof(int))
+                return -EINVAL;
+
+        if (get_user(val, (int __user *) optval))
+                return -EFAULT;
+
+        rc = 0;
+
+        lock_sock(sk);
+        switch (optname) {
+        case SO_IPRMDATA_MSG:
+                if (val)
+                        iucv->flags |= IUCV_IPRMDATA;
+                else
+                        iucv->flags &= ~IUCV_IPRMDATA;
+                break;
+        case SO_MSGLIMIT:
+                switch (sk->sk_state) {
+                case IUCV_OPEN:
+                case IUCV_BOUND:
+                        if (val < 1 || val > (u16)(~0))
+                                rc = -EINVAL;
+                        else
+                                iucv->msglimit = val;
+                        break;
+                default:
+                        rc = -EINVAL;
+                        break;
+                }
+                break;
+        default:
+                rc = -ENOPROTOOPT;
+                break;
+        }
+        release_sock(sk);
+
+        return rc;
+}
+
+static int iucv_sock_getsockopt(struct socket *sock, int level, int optname,
+                                char __user *optval, int __user *optlen)
+{
+        struct sock *sk = sock->sk;
+        struct iucv_sock *iucv = iucv_sk(sk);
+        int val, len;
+
+        if (level != SOL_IUCV)
+                return -ENOPROTOOPT;
+
+        if (get_user(len, optlen))
+                return -EFAULT;
+
+        if (len < 0)
+                return -EINVAL;
+
+        len = min_t(unsigned int, len, sizeof(int));
+
+        switch (optname) {
+        case SO_IPRMDATA_MSG:
+                val = (iucv->flags & IUCV_IPRMDATA) ? 1 : 0;
+                break;
+        case SO_MSGLIMIT:
+                lock_sock(sk);
+                val = (iucv->path != NULL) ? iucv->path->msglim /* connected */
+                                           : iucv->msglimit;    /* default */
+                release_sock(sk);
+                break;
+        default:
+                return -ENOPROTOOPT;
+        }
+
+        if (put_user(len, optlen))
+                return -EFAULT;
+        if (copy_to_user(optval, &val, len))
+                return -EFAULT;
+
+        return 0;
+}
+
+
 /* Callback wrappers - called from iucv base support */
 static int iucv_callback_connreq(struct iucv_path *path,
                                  u8 ipvmid[8], u8 ipuser[16])
@@ -1060,7 +1343,7 @@ static int iucv_callback_connreq(struct iucv_path *path,
         }
 
         /* Create the new socket */
-        nsk = iucv_sock_alloc(NULL, SOCK_STREAM, GFP_ATOMIC);
+        nsk = iucv_sock_alloc(NULL, sk->sk_type, GFP_ATOMIC);
         if (!nsk) {
                 err = iucv_path_sever(path, user_data);
                 iucv_path_free(path);
@@ -1083,7 +1366,9 @@ static int iucv_callback_connreq(struct iucv_path *path,
         memcpy(nuser_data + 8, niucv->src_name, 8);
         ASCEBC(nuser_data + 8, 8);
 
-        path->msglim = IUCV_QUEUELEN_DEFAULT;
+        /* set message limit for path based on msglimit of accepting socket */
+        niucv->msglimit = iucv->msglimit;
+        path->msglim = iucv->msglimit;
         err = iucv_path_accept(path, &af_iucv_handler, nuser_data, nsk);
         if (err) {
                 err = iucv_path_sever(path, user_data);
@@ -1131,19 +1416,17 @@ static void iucv_callback_rx(struct iucv_path *path, struct iucv_message *msg)
                 goto save_message;
 
         len = atomic_read(&sk->sk_rmem_alloc);
-        len += msg->length + sizeof(struct sk_buff);
+        len += iucv_msg_length(msg) + sizeof(struct sk_buff);
         if (len > sk->sk_rcvbuf)
                 goto save_message;
 
-        skb = alloc_skb(msg->length, GFP_ATOMIC | GFP_DMA);
+        skb = alloc_skb(iucv_msg_length(msg), GFP_ATOMIC | GFP_DMA);
         if (!skb)
                 goto save_message;
 
         iucv_process_message(sk, skb, path, msg);
         goto out_unlock;
 
-        return;
-
 save_message:
         save_msg = kzalloc(sizeof(struct sock_msg_q), GFP_ATOMIC | GFP_DMA);
         if (!save_msg)
@@ -1170,7 +1453,7 @@ static void iucv_callback_txdone(struct iucv_path *path,
                 spin_lock_irqsave(&list->lock, flags);
 
                 while (list_skb != (struct sk_buff *)list) {
-                        if (!memcmp(&msg->tag, list_skb->cb, 4)) {
+                        if (!memcmp(&msg->tag, CB_TAG(list_skb), CB_TAG_LEN)) {
                                 this = list_skb;
                                 break;
                         }
@@ -1206,6 +1489,21 @@ static void iucv_callback_connrej(struct iucv_path *path, u8 ipuser[16])
         sk->sk_state_change(sk);
 }
 
+/* called if the other communication side shuts down its RECV direction;
+ * in turn, the callback sets SEND_SHUTDOWN to disable sending of data.
+ */
+static void iucv_callback_shutdown(struct iucv_path *path, u8 ipuser[16])
+{
+        struct sock *sk = path->private;
+
+        bh_lock_sock(sk);
+        if (sk->sk_state != IUCV_CLOSED) {
+                sk->sk_shutdown |= SEND_SHUTDOWN;
+                sk->sk_state_change(sk);
+        }
+        bh_unlock_sock(sk);
+}
+
 static struct proto_ops iucv_sock_ops = {
         .family         = PF_IUCV,
         .owner          = THIS_MODULE,
@@ -1222,8 +1520,8 @@ static struct proto_ops iucv_sock_ops = {
         .mmap           = sock_no_mmap,
         .socketpair     = sock_no_socketpair,
         .shutdown       = iucv_sock_shutdown,
-        .setsockopt     = sock_no_setsockopt,
-        .getsockopt     = sock_no_getsockopt
+        .setsockopt     = iucv_sock_setsockopt,
+        .getsockopt     = iucv_sock_getsockopt,
 };
 
 static struct net_proto_family iucv_sock_family_ops = {
diff --git a/net/iucv/iucv.c b/net/iucv/iucv.c
index a35240f61ec3..61e8038a55ee 100644
--- a/net/iucv/iucv.c
+++ b/net/iucv/iucv.c
@@ -280,6 +280,7 @@ union iucv_param {
  * Anchor for per-cpu IUCV command parameter block.
  */
 static union iucv_param *iucv_param[NR_CPUS];
+static union iucv_param *iucv_param_irq[NR_CPUS];
 
 /**
  * iucv_call_b2f0
@@ -358,7 +359,7 @@ static void iucv_allow_cpu(void *data)
          *      0x10 - Flag to allow priority message completion interrupts
          *      0x08 - Flag to allow IUCV control interrupts
          */
-        parm = iucv_param[cpu];
+        parm = iucv_param_irq[cpu];
         memset(parm, 0, sizeof(union iucv_param));
         parm->set_mask.ipmask = 0xf8;
         iucv_call_b2f0(IUCV_SETMASK, parm);
@@ -379,7 +380,7 @@ static void iucv_block_cpu(void *data)
         union iucv_param *parm;
 
         /* Disable all iucv interrupts. */
-        parm = iucv_param[cpu];
+        parm = iucv_param_irq[cpu];
         memset(parm, 0, sizeof(union iucv_param));
         iucv_call_b2f0(IUCV_SETMASK, parm);
 
@@ -403,7 +404,7 @@ static void iucv_declare_cpu(void *data)
                 return;
 
         /* Declare interrupt buffer. */
-        parm = iucv_param[cpu];
+        parm = iucv_param_irq[cpu];
         memset(parm, 0, sizeof(union iucv_param));
         parm->db.ipbfadr1 = virt_to_phys(iucv_irq_data[cpu]);
         rc = iucv_call_b2f0(IUCV_DECLARE_BUFFER, parm);
@@ -460,7 +461,7 @@ static void iucv_retrieve_cpu(void *data)
         iucv_block_cpu(NULL);
 
         /* Retrieve interrupt buffer. */
-        parm = iucv_param[cpu];
+        parm = iucv_param_irq[cpu];
         iucv_call_b2f0(IUCV_RETRIEVE_BUFFER, parm);
 
         /* Clear indication that an iucv buffer exists for this cpu. */
@@ -574,11 +575,22 @@ static int __cpuinit iucv_cpu_notify(struct notifier_block *self,
                         iucv_irq_data[cpu] = NULL;
                         return NOTIFY_BAD;
                 }
+                iucv_param_irq[cpu] = kmalloc_node(sizeof(union iucv_param),
+                                        GFP_KERNEL|GFP_DMA, cpu_to_node(cpu));
+                if (!iucv_param_irq[cpu]) {
+                        kfree(iucv_param[cpu]);
+                        iucv_param[cpu] = NULL;
+                        kfree(iucv_irq_data[cpu]);
+                        iucv_irq_data[cpu] = NULL;
+                        return NOTIFY_BAD;
+                }
                 break;
         case CPU_UP_CANCELED:
         case CPU_UP_CANCELED_FROZEN:
         case CPU_DEAD:
         case CPU_DEAD_FROZEN:
+                kfree(iucv_param_irq[cpu]);
+                iucv_param_irq[cpu] = NULL;
                 kfree(iucv_param[cpu]);
                 iucv_param[cpu] = NULL;
                 kfree(iucv_irq_data[cpu]);
@@ -625,7 +637,7 @@ static int iucv_sever_pathid(u16 pathid, u8 userdata[16])
 {
         union iucv_param *parm;
 
-        parm = iucv_param[smp_processor_id()];
+        parm = iucv_param_irq[smp_processor_id()];
         memset(parm, 0, sizeof(union iucv_param));
         if (userdata)
                 memcpy(parm->ctrl.ipuser, userdata, sizeof(parm->ctrl.ipuser));
@@ -918,10 +930,8 @@ int iucv_path_sever(struct iucv_path *path, u8 userdata[16])
         if (iucv_active_cpu != smp_processor_id())
                 spin_lock_bh(&iucv_table_lock);
         rc = iucv_sever_pathid(path->pathid, userdata);
-        if (!rc) {
-                iucv_path_table[path->pathid] = NULL;
-                list_del_init(&path->list);
-        }
+        iucv_path_table[path->pathid] = NULL;
+        list_del_init(&path->list);
         if (iucv_active_cpu != smp_processor_id())
                 spin_unlock_bh(&iucv_table_lock);
         preempt_enable();
@@ -1378,6 +1388,8 @@ static void iucv_path_complete(struct iucv_irq_data *data)
         struct iucv_path_complete *ipc = (void *) data;
         struct iucv_path *path = iucv_path_table[ipc->ippathid];
 
+        if (path)
+                path->flags = ipc->ipflags1;
         if (path && path->handler && path->handler->path_complete)
                 path->handler->path_complete(path, ipc->ipuser);
 }
@@ -1413,7 +1425,7 @@ static void iucv_path_severed(struct iucv_irq_data *data)
         else {
                 iucv_sever_pathid(path->pathid, NULL);
                 iucv_path_table[path->pathid] = NULL;
-                list_del_init(&path->list);
+                list_del(&path->list);
                 iucv_path_free(path);
         }
 }
@@ -1717,6 +1729,13 @@ static int __init iucv_init(void)
                         rc = -ENOMEM;
                         goto out_free;
                 }
+                iucv_param_irq[cpu] = kmalloc_node(sizeof(union iucv_param),
+                                  GFP_KERNEL|GFP_DMA, cpu_to_node(cpu));
+                if (!iucv_param_irq[cpu]) {
+                        rc = -ENOMEM;
+                        goto out_free;
+                }
+
         }
         rc = register_hotcpu_notifier(&iucv_cpu_notifier);
         if (rc)
@@ -1734,6 +1753,8 @@ out_cpu:
         unregister_hotcpu_notifier(&iucv_cpu_notifier);
 out_free:
         for_each_possible_cpu(cpu) {
+                kfree(iucv_param_irq[cpu]);
+                iucv_param_irq[cpu] = NULL;
                 kfree(iucv_param[cpu]);
                 iucv_param[cpu] = NULL;
                 kfree(iucv_irq_data[cpu]);
@@ -1764,6 +1785,8 @@ static void __exit iucv_exit(void)
         spin_unlock_irq(&iucv_queue_lock);
         unregister_hotcpu_notifier(&iucv_cpu_notifier);
         for_each_possible_cpu(cpu) {
+                kfree(iucv_param_irq[cpu]);
+                iucv_param_irq[cpu] = NULL;
                 kfree(iucv_param[cpu]);
                 iucv_param[cpu] = NULL;
                 kfree(iucv_irq_data[cpu]);
diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
index febae702685c..9208cf5f2bd5 100644
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -935,7 +935,7 @@ static int llc_ui_getname(struct socket *sock, struct sockaddr *uaddr,
 
                 if (llc->dev) {
                         sllc.sllc_arphrd = llc->dev->type;
-                        memcpy(&sllc.sllc_mac, &llc->dev->dev_addr,
+                        memcpy(&sllc.sllc_mac, llc->dev->dev_addr,
                                IFHWADDRLEN);
                 }
         }
diff --git a/net/llc/llc_conn.c b/net/llc/llc_conn.c
index 3477624a4906..c6bab39b018e 100644
--- a/net/llc/llc_conn.c
+++ b/net/llc/llc_conn.c
@@ -79,10 +79,6 @@ int llc_conn_state_process(struct sock *sk, struct sk_buff *skb)
 
         if (unlikely(!ev->ind_prim && !ev->cfm_prim)) {
                 /* indicate or confirm not required */
-                /* XXX this is not very pretty, perhaps we should store
-                 * XXX indicate/confirm-needed state in the llc_conn_state_ev
-                 * XXX control block of the SKB instead? -DaveM
-                 */
                 if (!skb->next)
                         goto out_kfree_skb;
                 goto out_skb_put;
diff --git a/net/mac80211/Kconfig b/net/mac80211/Kconfig
index ecc3faf9f11a..9cbf545e95a2 100644
--- a/net/mac80211/Kconfig
+++ b/net/mac80211/Kconfig
@@ -11,6 +11,22 @@ config MAC80211
           This option enables the hardware independent IEEE 802.11
           networking stack.
 
+config MAC80211_DEFAULT_PS
+        bool "enable powersave by default"
+        depends on MAC80211
+        default y
+        help
+          This option enables powersave mode by default.
+
+          If this causes your applications to misbehave you should fix your
+          applications instead -- they need to register their network
+          latency requirement, see Documentation/power/pm_qos_interface.txt.
+
+config MAC80211_DEFAULT_PS_VALUE
+        int
+        default 1 if MAC80211_DEFAULT_PS
+        default 0
+
 menu "Rate control algorithm selection"
         depends on MAC80211 != n
 
diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c
index 07656d830bc4..bc064d7933ff 100644
--- a/net/mac80211/agg-rx.c
+++ b/net/mac80211/agg-rx.c
@@ -16,12 +16,12 @@
 #include <linux/ieee80211.h>
 #include <net/mac80211.h>
 #include "ieee80211_i.h"
+#include "driver-ops.h"
 
 void __ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid,
                                     u16 initiator, u16 reason)
 {
         struct ieee80211_local *local = sta->local;
-        struct ieee80211_hw *hw = &local->hw;
         int i;
 
         /* check if TID is in operational state */
@@ -41,8 +41,8 @@ void __ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid,
                sta->sta.addr, tid);
 #endif /* CONFIG_MAC80211_HT_DEBUG */
 
-        if (local->ops->ampdu_action(hw, IEEE80211_AMPDU_RX_STOP,
-                                     &sta->sta, tid, NULL))
+        if (drv_ampdu_action(local, IEEE80211_AMPDU_RX_STOP,
+                             &sta->sta, tid, NULL))
                 printk(KERN_DEBUG "HW problem - can not stop rx "
                                 "aggregation for tid %d\n", tid);
 
@@ -68,6 +68,7 @@ void __ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid,
         spin_lock_bh(&sta->lock);
         /* free resources */
         kfree(sta->ampdu_mlme.tid_rx[tid]->reorder_buf);
+        kfree(sta->ampdu_mlme.tid_rx[tid]->reorder_time);
 
         if (!sta->ampdu_mlme.tid_rx[tid]->shutdown) {
                 kfree(sta->ampdu_mlme.tid_rx[tid]);
@@ -268,19 +269,23 @@ void ieee80211_process_addba_request(struct ieee80211_local *local,
         /* prepare reordering buffer */
         tid_agg_rx->reorder_buf =
                 kcalloc(buf_size, sizeof(struct sk_buff *), GFP_ATOMIC);
-        if (!tid_agg_rx->reorder_buf) {
+        tid_agg_rx->reorder_time =
+                kcalloc(buf_size, sizeof(unsigned long), GFP_ATOMIC);
+        if (!tid_agg_rx->reorder_buf || !tid_agg_rx->reorder_time) {
 #ifdef CONFIG_MAC80211_HT_DEBUG
                 if (net_ratelimit())
                         printk(KERN_ERR "can not allocate reordering buffer "
                                "to tid %d\n", tid);
 #endif
+                kfree(tid_agg_rx->reorder_buf);
+                kfree(tid_agg_rx->reorder_time);
                 kfree(sta->ampdu_mlme.tid_rx[tid]);
+                sta->ampdu_mlme.tid_rx[tid] = NULL;
                 goto end;
         }
 
-        if (local->ops->ampdu_action)
-                ret = local->ops->ampdu_action(hw, IEEE80211_AMPDU_RX_START,
-                                               &sta->sta, tid, &start_seq_num);
+        ret = drv_ampdu_action(local, IEEE80211_AMPDU_RX_START,
+                               &sta->sta, tid, &start_seq_num);
 #ifdef CONFIG_MAC80211_HT_DEBUG
         printk(KERN_DEBUG "Rx A-MPDU request on tid %d result %d\n", tid, ret);
 #endif /* CONFIG_MAC80211_HT_DEBUG */
diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index 947aaaad35d2..43d00ffd3988 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -16,6 +16,7 @@
 #include <linux/ieee80211.h>
 #include <net/mac80211.h>
 #include "ieee80211_i.h"
+#include "driver-ops.h"
 #include "wme.h"
 
 /**
@@ -134,8 +135,8 @@ static int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
         *state = HT_AGG_STATE_REQ_STOP_BA_MSK |
                 (initiator << HT_AGG_STATE_INITIATOR_SHIFT);
 
-        ret = local->ops->ampdu_action(&local->hw, IEEE80211_AMPDU_TX_STOP,
-                                       &sta->sta, tid, NULL);
+        ret = drv_ampdu_action(local, IEEE80211_AMPDU_TX_STOP,
+                               &sta->sta, tid, NULL);
 
         /* HW shall not deny going back to legacy */
         if (WARN_ON(ret)) {
@@ -306,8 +307,8 @@ int ieee80211_start_tx_ba_session(struct ieee80211_hw *hw, u8 *ra, u16 tid)
 
         start_seq_num = sta->tid_seq[tid];
 
-        ret = local->ops->ampdu_action(hw, IEEE80211_AMPDU_TX_START,
-                                       &sta->sta, tid, &start_seq_num);
+        ret = drv_ampdu_action(local, IEEE80211_AMPDU_TX_START,
+                               &sta->sta, tid, &start_seq_num);
 
         if (ret) {
 #ifdef CONFIG_MAC80211_HT_DEBUG
@@ -418,8 +419,8 @@ static void ieee80211_agg_tx_operational(struct ieee80211_local *local,
         ieee80211_agg_splice_finish(local, sta, tid);
         spin_unlock(&local->ampdu_lock);
 
-        local->ops->ampdu_action(&local->hw, IEEE80211_AMPDU_TX_OPERATIONAL,
-                                 &sta->sta, tid, NULL);
+        drv_ampdu_action(local, IEEE80211_AMPDU_TX_OPERATIONAL,
+                         &sta->sta, tid, NULL);
 }
 
 void ieee80211_start_tx_ba_cb(struct ieee80211_hw *hw, u8 *ra, u16 tid)
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index e677b751d468..77e9ff5ec4f3 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -13,6 +13,7 @@
 #include <linux/rcupdate.h>
 #include <net/cfg80211.h>
 #include "ieee80211_i.h"
+#include "driver-ops.h"
 #include "cfg.h"
 #include "rate.h"
 #include "mesh.h"
@@ -111,7 +112,7 @@ static int ieee80211_change_iface(struct wiphy *wiphy, int ifindex,
 }
 
 static int ieee80211_add_key(struct wiphy *wiphy, struct net_device *dev,
-                             u8 key_idx, u8 *mac_addr,
+                             u8 key_idx, const u8 *mac_addr,
                              struct key_params *params)
 {
         struct ieee80211_sub_if_data *sdata;
@@ -140,7 +141,8 @@ static int ieee80211_add_key(struct wiphy *wiphy, struct net_device *dev,
                 return -EINVAL;
         }
 
-        key = ieee80211_key_alloc(alg, key_idx, params->key_len, params->key);
+        key = ieee80211_key_alloc(alg, key_idx, params->key_len, params->key,
+                                  params->seq_len, params->seq);
         if (!key)
                 return -ENOMEM;
 
@@ -165,7 +167,7 @@ static int ieee80211_add_key(struct wiphy *wiphy, struct net_device *dev,
 }
 
 static int ieee80211_del_key(struct wiphy *wiphy, struct net_device *dev,
-                             u8 key_idx, u8 *mac_addr)
+                             u8 key_idx, const u8 *mac_addr)
 {
         struct ieee80211_sub_if_data *sdata;
         struct sta_info *sta;
@@ -207,7 +209,7 @@ static int ieee80211_del_key(struct wiphy *wiphy, struct net_device *dev,
 }
 
 static int ieee80211_get_key(struct wiphy *wiphy, struct net_device *dev,
-                             u8 key_idx, u8 *mac_addr, void *cookie,
+                             u8 key_idx, const u8 *mac_addr, void *cookie,
                              void (*callback)(void *cookie,
                                               struct key_params *params))
 {
@@ -245,12 +247,10 @@ static int ieee80211_get_key(struct wiphy *wiphy, struct net_device *dev,
                 iv32 = key->u.tkip.tx.iv32;
                 iv16 = key->u.tkip.tx.iv16;
 
-                if (key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE &&
-                    sdata->local->ops->get_tkip_seq)
-                        sdata->local->ops->get_tkip_seq(
-                                local_to_hw(sdata->local),
-                                key->conf.hw_key_idx,
-                                &iv32, &iv16);
+                if (key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE)
+                        drv_get_tkip_seq(sdata->local,
+                                         key->conf.hw_key_idx,
+                                         &iv32, &iv16);
 
                 seq[0] = iv16 & 0xff;
                 seq[1] = (iv16 >> 8) & 0xff;
@@ -451,18 +451,11 @@ static int ieee80211_config_beacon(struct ieee80211_sub_if_data *sdata,
          * This is a kludge. beacon interval should really be part
          * of the beacon information.
          */
-        if (params->interval && (sdata->local->hw.conf.beacon_int !=
-                                 params->interval)) {
-                sdata->local->hw.conf.beacon_int = params->interval;
-                err = ieee80211_hw_config(sdata->local,
-                                        IEEE80211_CONF_CHANGE_BEACON_INTERVAL);
-                if (err < 0)
-                        return err;
-                /*
-                 * We updated some parameter so if below bails out
-                 * it's not an error.
-                 */
-                err = 0;
+        if (params->interval &&
+            (sdata->vif.bss_conf.beacon_int != params->interval)) {
+                sdata->vif.bss_conf.beacon_int = params->interval;
+                ieee80211_bss_info_change_notify(sdata,
+                                                 BSS_CHANGED_BEACON_INT);
         }
 
         /* Need to have a beacon head if we don't have one yet */
@@ -528,8 +521,9 @@ static int ieee80211_config_beacon(struct ieee80211_sub_if_data *sdata,
 
         kfree(old);
 
-        return ieee80211_if_config(sdata, IEEE80211_IFCC_BEACON |
-                                          IEEE80211_IFCC_BEACON_ENABLED);
+        ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON_ENABLED |
+                                                BSS_CHANGED_BEACON);
+        return 0;
 }
 
 static int ieee80211_add_beacon(struct wiphy *wiphy, struct net_device *dev,
@@ -580,7 +574,8 @@ static int ieee80211_del_beacon(struct wiphy *wiphy, struct net_device *dev)
         synchronize_rcu();
         kfree(old);
 
-        return ieee80211_if_config(sdata, IEEE80211_IFCC_BEACON_ENABLED);
+        ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON_ENABLED);
+        return 0;
 }
 
 /* Layer 2 Update frame (802.2 Type 1 LLC XID Update response) */
@@ -635,34 +630,38 @@ static void sta_apply_parameters(struct ieee80211_local *local,
         int i, j;
         struct ieee80211_supported_band *sband;
         struct ieee80211_sub_if_data *sdata = sta->sdata;
+        u32 mask, set;
 
         sband = local->hw.wiphy->bands[local->oper_channel->band];
 
-        /*
-         * FIXME: updating the flags is racy when this function is
-         *        called from ieee80211_change_station(), this will
-         *        be resolved in a future patch.
-         */
+        spin_lock_bh(&sta->lock);
+        mask = params->sta_flags_mask;
+        set = params->sta_flags_set;
 
-        if (params->station_flags & STATION_FLAG_CHANGED) {
-                spin_lock_bh(&sta->lock);
+        if (mask & BIT(NL80211_STA_FLAG_AUTHORIZED)) {
                 sta->flags &= ~WLAN_STA_AUTHORIZED;
-                if (params->station_flags & STATION_FLAG_AUTHORIZED)
+                if (set & BIT(NL80211_STA_FLAG_AUTHORIZED))
                         sta->flags |= WLAN_STA_AUTHORIZED;
+        }
 
+        if (mask & BIT(NL80211_STA_FLAG_SHORT_PREAMBLE)) {
                 sta->flags &= ~WLAN_STA_SHORT_PREAMBLE;
-                if (params->station_flags & STATION_FLAG_SHORT_PREAMBLE)
+                if (set & BIT(NL80211_STA_FLAG_SHORT_PREAMBLE))
                         sta->flags |= WLAN_STA_SHORT_PREAMBLE;
+        }
 
+        if (mask & BIT(NL80211_STA_FLAG_WME)) {
                 sta->flags &= ~WLAN_STA_WME;
-                if (params->station_flags & STATION_FLAG_WME)
+                if (set & BIT(NL80211_STA_FLAG_WME))
                         sta->flags |= WLAN_STA_WME;
+        }
 
+        if (mask & BIT(NL80211_STA_FLAG_MFP)) {
                 sta->flags &= ~WLAN_STA_MFP;
-                if (params->station_flags & STATION_FLAG_MFP)
+                if (set & BIT(NL80211_STA_FLAG_MFP))
                         sta->flags |= WLAN_STA_MFP;
-                spin_unlock_bh(&sta->lock);
         }
+        spin_unlock_bh(&sta->lock);
 
         /*
          * FIXME: updating the following information is racy when this
@@ -1120,7 +1119,7 @@ static int ieee80211_set_txq_params(struct wiphy *wiphy,
         p.cw_max = params->cwmax;
         p.cw_min = params->cwmin;
         p.txop = params->txop;
-        if (local->ops->conf_tx(local_to_hw(local), params->queue, &p)) {
+        if (drv_conf_tx(local, params->queue, &p)) {
                 printk(KERN_DEBUG "%s: failed to set TX queue "
                        "parameters for queue %d\n", local->mdev->name,
                        params->queue);
@@ -1167,7 +1166,8 @@ static int ieee80211_scan(struct wiphy *wiphy,
 
         if (sdata->vif.type != NL80211_IFTYPE_STATION &&
             sdata->vif.type != NL80211_IFTYPE_ADHOC &&
-            sdata->vif.type != NL80211_IFTYPE_MESH_POINT)
+            sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
+            (sdata->vif.type != NL80211_IFTYPE_AP || sdata->u.ap.beacon))
                 return -EOPNOTSUPP;
 
         return ieee80211_request_scan(sdata, req);
@@ -1258,6 +1258,19 @@ static int ieee80211_assoc(struct wiphy *wiphy, struct net_device *dev,
         if (ret)
                 return ret;
 
+        if (req->use_mfp) {
+                sdata->u.mgd.mfp = IEEE80211_MFP_REQUIRED;
+                sdata->u.mgd.flags |= IEEE80211_STA_MFP_ENABLED;
+        } else {
+                sdata->u.mgd.mfp = IEEE80211_MFP_DISABLED;
+                sdata->u.mgd.flags &= ~IEEE80211_STA_MFP_ENABLED;
+        }
+
+        if (req->control_port)
+                sdata->u.mgd.flags |= IEEE80211_STA_CONTROL_PORT;
+        else
+                sdata->u.mgd.flags &= ~IEEE80211_STA_CONTROL_PORT;
+
         sdata->u.mgd.flags |= IEEE80211_STA_EXT_SME;
         sdata->u.mgd.state = IEEE80211_STA_MLME_ASSOCIATE;
         ieee80211_sta_req_auth(sdata);
@@ -1267,25 +1280,59 @@ static int ieee80211_assoc(struct wiphy *wiphy, struct net_device *dev,
 static int ieee80211_deauth(struct wiphy *wiphy, struct net_device *dev,
                             struct cfg80211_deauth_request *req)
 {
-        struct ieee80211_sub_if_data *sdata;
-
-        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
-        /* TODO: req->ie */
+        /* TODO: req->ie, req->peer_addr */
         return ieee80211_sta_deauthenticate(sdata, req->reason_code);
 }
 
 static int ieee80211_disassoc(struct wiphy *wiphy, struct net_device *dev,
                               struct cfg80211_disassoc_request *req)
 {
-        struct ieee80211_sub_if_data *sdata;
-
-        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
-        /* TODO: req->ie */
+        /* TODO: req->ie, req->peer_addr */
         return ieee80211_sta_disassociate(sdata, req->reason_code);
 }
 
+static int ieee80211_join_ibss(struct wiphy *wiphy, struct net_device *dev,
+                               struct cfg80211_ibss_params *params)
+{
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+
+        return ieee80211_ibss_join(sdata, params);
+}
+
+static int ieee80211_leave_ibss(struct wiphy *wiphy, struct net_device *dev)
+{
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+
+        return ieee80211_ibss_leave(sdata);
+}
+
+static int ieee80211_set_wiphy_params(struct wiphy *wiphy, u32 changed)
+{
+        struct ieee80211_local *local = wiphy_priv(wiphy);
+        int err;
+
+        if (changed & WIPHY_PARAM_RTS_THRESHOLD) {
+                err = drv_set_rts_threshold(local, wiphy->rts_threshold);
+
+                if (err)
+                        return err;
+        }
+
+        if (changed & WIPHY_PARAM_RETRY_SHORT)
+                local->hw.conf.short_frame_max_tx_count = wiphy->retry_short;
+        if (changed & WIPHY_PARAM_RETRY_LONG)
+                local->hw.conf.long_frame_max_tx_count = wiphy->retry_long;
+        if (changed &
+            (WIPHY_PARAM_RETRY_SHORT | WIPHY_PARAM_RETRY_LONG))
+                ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_RETRY_LIMITS);
+
+        return 0;
+}
+
 struct cfg80211_ops mac80211_config_ops = {
         .add_virtual_intf = ieee80211_add_iface,
         .del_virtual_intf = ieee80211_del_iface,
@@ -1322,4 +1369,7 @@ struct cfg80211_ops mac80211_config_ops = {
         .assoc = ieee80211_assoc,
         .deauth = ieee80211_deauth,
         .disassoc = ieee80211_disassoc,
+        .join_ibss = ieee80211_join_ibss,
+        .leave_ibss = ieee80211_leave_ibss,
+        .set_wiphy_params = ieee80211_set_wiphy_params,
 };
diff --git a/net/mac80211/debugfs.c b/net/mac80211/debugfs.c
index 210b9b6fecd2..11c72311f35b 100644
--- a/net/mac80211/debugfs.c
+++ b/net/mac80211/debugfs.c
@@ -10,6 +10,7 @@
 #include <linux/debugfs.h>
 #include <linux/rtnetlink.h>
 #include "ieee80211_i.h"
+#include "driver-ops.h"
 #include "rate.h"
 #include "debugfs.h"
 
@@ -51,14 +52,6 @@ static const struct file_operations name## _ops = {			\
 
 DEBUGFS_READONLY_FILE(frequency, 20, "%d",
                       local->hw.conf.channel->center_freq);
-DEBUGFS_READONLY_FILE(rts_threshold, 20, "%d",
-                      local->rts_threshold);
-DEBUGFS_READONLY_FILE(fragmentation_threshold, 20, "%d",
-                      local->fragmentation_threshold);
-DEBUGFS_READONLY_FILE(short_retry_limit, 20, "%d",
-                      local->hw.conf.short_frame_max_tx_count);
-DEBUGFS_READONLY_FILE(long_retry_limit, 20, "%d",
-                      local->hw.conf.long_frame_max_tx_count);
 DEBUGFS_READONLY_FILE(total_ps_buffered, 20, "%d",
                       local->total_ps_buffered);
 DEBUGFS_READONLY_FILE(wep_iv, 20, "%#08x",
@@ -70,11 +63,10 @@ static ssize_t tsf_read(struct file *file, char __user *user_buf,
                              size_t count, loff_t *ppos)
 {
         struct ieee80211_local *local = file->private_data;
-        u64 tsf = 0;
+        u64 tsf;
         char buf[100];
 
-        if (local->ops->get_tsf)
-                tsf = local->ops->get_tsf(local_to_hw(local));
+        tsf = drv_get_tsf(local);
 
         snprintf(buf, sizeof(buf), "0x%016llx\n", (unsigned long long) tsf);
 
@@ -97,13 +89,13 @@ static ssize_t tsf_write(struct file *file,
 
         if (strncmp(buf, "reset", 5) == 0) {
                 if (local->ops->reset_tsf) {
-                        local->ops->reset_tsf(local_to_hw(local));
+                        drv_reset_tsf(local);
                         printk(KERN_INFO "%s: debugfs reset TSF\n", wiphy_name(local->hw.wiphy));
                 }
         } else {
                 tsf = simple_strtoul(buf, NULL, 0);
                 if (local->ops->set_tsf) {
-                        local->ops->set_tsf(local_to_hw(local), tsf);
+                        drv_set_tsf(local, tsf);
                         printk(KERN_INFO "%s: debugfs set TSF to %#018llx\n", wiphy_name(local->hw.wiphy), tsf);
                 }
         }
@@ -135,6 +127,42 @@ static const struct file_operations reset_ops = {
         .open = mac80211_open_file_generic,
 };
 
+static ssize_t noack_read(struct file *file, char __user *user_buf,
+                          size_t count, loff_t *ppos)
+{
+        struct ieee80211_local *local = file->private_data;
+        int res;
+        char buf[10];
+
+        res = scnprintf(buf, sizeof(buf), "%d\n", local->wifi_wme_noack_test);
+
+        return simple_read_from_buffer(user_buf, count, ppos, buf, res);
+}
+
+static ssize_t noack_write(struct file *file,
+                           const char __user *user_buf,
+                           size_t count, loff_t *ppos)
+{
+        struct ieee80211_local *local = file->private_data;
+        char buf[10];
+        size_t len;
+
+        len = min(count, sizeof(buf) - 1);
+        if (copy_from_user(buf, user_buf, len))
+                return -EFAULT;
+        buf[len] = '\0';
+
+        local->wifi_wme_noack_test = !!simple_strtoul(buf, NULL, 0);
+
+        return count;
+}
+
+static const struct file_operations noack_ops = {
+        .read = noack_read,
+        .write = noack_write,
+        .open = mac80211_open_file_generic
+};
+
 /* statistics stuff */
 
 #define DEBUGFS_STATS_FILE(name, buflen, fmt, value...)                 \
@@ -150,14 +178,12 @@ static ssize_t format_devstat_counter(struct ieee80211_local *local,
         char buf[20];
         int res;
 
-        if (!local->ops->get_stats)
-                return -EOPNOTSUPP;
-
         rtnl_lock();
-        res = local->ops->get_stats(local_to_hw(local), &stats);
+        res = drv_get_stats(local, &stats);
         rtnl_unlock();
-        if (!res)
-                res = printvalue(&stats, buf, sizeof(buf));
+        if (res)
+                return res;
+        res = printvalue(&stats, buf, sizeof(buf));
         return simple_read_from_buffer(userbuf, count, ppos, buf, res);
 }
 
@@ -269,14 +295,11 @@ void debugfs_hw_add(struct ieee80211_local *local)
         local->debugfs.keys = debugfs_create_dir("keys", phyd);
 
         DEBUGFS_ADD(frequency);
-        DEBUGFS_ADD(rts_threshold);
-        DEBUGFS_ADD(fragmentation_threshold);
-        DEBUGFS_ADD(short_retry_limit);
-        DEBUGFS_ADD(long_retry_limit);
         DEBUGFS_ADD(total_ps_buffered);
         DEBUGFS_ADD(wep_iv);
         DEBUGFS_ADD(tsf);
         DEBUGFS_ADD_MODE(reset, 0200);
+        DEBUGFS_ADD(noack);
 
         statsd = debugfs_create_dir("statistics", phyd);
         local->debugfs.statistics = statsd;
@@ -324,14 +347,11 @@ void debugfs_hw_add(struct ieee80211_local *local)
 void debugfs_hw_del(struct ieee80211_local *local)
 {
         DEBUGFS_DEL(frequency);
-        DEBUGFS_DEL(rts_threshold);
-        DEBUGFS_DEL(fragmentation_threshold);
-        DEBUGFS_DEL(short_retry_limit);
-        DEBUGFS_DEL(long_retry_limit);
         DEBUGFS_DEL(total_ps_buffered);
         DEBUGFS_DEL(wep_iv);
         DEBUGFS_DEL(tsf);
         DEBUGFS_DEL(reset);
+        DEBUGFS_DEL(noack);
 
         DEBUGFS_STATS_DEL(transmitted_fragment_count);
         DEBUGFS_STATS_DEL(multicast_transmitted_frame_count);
diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
new file mode 100644
index 000000000000..3912b5334b9c
--- /dev/null
+++ b/net/mac80211/driver-ops.h
@@ -0,0 +1,184 @@
+#ifndef __MAC80211_DRIVER_OPS
+#define __MAC80211_DRIVER_OPS
+
+#include <net/mac80211.h>
+#include "ieee80211_i.h"
+
+static inline int drv_tx(struct ieee80211_local *local, struct sk_buff *skb)
+{
+        return local->ops->tx(&local->hw, skb);
+}
+
+static inline int drv_start(struct ieee80211_local *local)
+{
+        return local->ops->start(&local->hw);
+}
+
+static inline void drv_stop(struct ieee80211_local *local)
+{
+        local->ops->stop(&local->hw);
+}
+
+static inline int drv_add_interface(struct ieee80211_local *local,
+                                    struct ieee80211_if_init_conf *conf)
+{
+        return local->ops->add_interface(&local->hw, conf);
+}
+
+static inline void drv_remove_interface(struct ieee80211_local *local,
+                                        struct ieee80211_if_init_conf *conf)
+{
+        local->ops->remove_interface(&local->hw, conf);
+}
+
+static inline int drv_config(struct ieee80211_local *local, u32 changed)
+{
+        return local->ops->config(&local->hw, changed);
+}
+
+static inline void drv_bss_info_changed(struct ieee80211_local *local,
+                                        struct ieee80211_vif *vif,
+                                        struct ieee80211_bss_conf *info,
+                                        u32 changed)
+{
+        if (local->ops->bss_info_changed)
+                local->ops->bss_info_changed(&local->hw, vif, info, changed);
+}
+
+static inline void drv_configure_filter(struct ieee80211_local *local,
+                                        unsigned int changed_flags,
+                                        unsigned int *total_flags,
+                                        int mc_count,
+                                        struct dev_addr_list *mc_list)
+{
+        local->ops->configure_filter(&local->hw, changed_flags, total_flags,
+                                     mc_count, mc_list);
+}
+
+static inline int drv_set_tim(struct ieee80211_local *local,
+                              struct ieee80211_sta *sta, bool set)
+{
+        if (local->ops->set_tim)
+                return local->ops->set_tim(&local->hw, sta, set);
+        return 0;
+}
+
+static inline int drv_set_key(struct ieee80211_local *local,
+                              enum set_key_cmd cmd, struct ieee80211_vif *vif,
+                              struct ieee80211_sta *sta,
+                              struct ieee80211_key_conf *key)
+{
+        return local->ops->set_key(&local->hw, cmd, vif, sta, key);
+}
+
+static inline void drv_update_tkip_key(struct ieee80211_local *local,
+                                       struct ieee80211_key_conf *conf,
+                                       const u8 *address, u32 iv32,
+                                       u16 *phase1key)
+{
+        if (local->ops->update_tkip_key)
+                local->ops->update_tkip_key(&local->hw, conf, address,
+                                            iv32, phase1key);
+}
+
+static inline int drv_hw_scan(struct ieee80211_local *local,
+                              struct cfg80211_scan_request *req)
+{
+        return local->ops->hw_scan(&local->hw, req);
+}
+
+static inline void drv_sw_scan_start(struct ieee80211_local *local)
+{
+        if (local->ops->sw_scan_start)
+                local->ops->sw_scan_start(&local->hw);
+}
+
+static inline void drv_sw_scan_complete(struct ieee80211_local *local)
+{
+        if (local->ops->sw_scan_complete)
+                local->ops->sw_scan_complete(&local->hw);
+}
+
+static inline int drv_get_stats(struct ieee80211_local *local,
+                                struct ieee80211_low_level_stats *stats)
+{
+        if (!local->ops->get_stats)
+                return -EOPNOTSUPP;
+        return local->ops->get_stats(&local->hw, stats);
+}
+
+static inline void drv_get_tkip_seq(struct ieee80211_local *local,
+                                    u8 hw_key_idx, u32 *iv32, u16 *iv16)
+{
+        if (local->ops->get_tkip_seq)
+                local->ops->get_tkip_seq(&local->hw, hw_key_idx, iv32, iv16);
+}
+
+static inline int drv_set_rts_threshold(struct ieee80211_local *local,
+                                        u32 value)
+{
+        if (local->ops->set_rts_threshold)
+                return local->ops->set_rts_threshold(&local->hw, value);
+        return 0;
+}
+
+static inline void drv_sta_notify(struct ieee80211_local *local,
+                                  struct ieee80211_vif *vif,
+                                  enum sta_notify_cmd cmd,
+                                  struct ieee80211_sta *sta)
+{
+        if (local->ops->sta_notify)
+                local->ops->sta_notify(&local->hw, vif, cmd, sta);
+}
+
+static inline int drv_conf_tx(struct ieee80211_local *local, u16 queue,
+                              const struct ieee80211_tx_queue_params *params)
+{
+        if (local->ops->conf_tx)
+                return local->ops->conf_tx(&local->hw, queue, params);
+        return -EOPNOTSUPP;
+}
+
+static inline int drv_get_tx_stats(struct ieee80211_local *local,
+                                   struct ieee80211_tx_queue_stats *stats)
+{
+        return local->ops->get_tx_stats(&local->hw, stats);
+}
+
+static inline u64 drv_get_tsf(struct ieee80211_local *local)
+{
+        if (local->ops->get_tsf)
+                return local->ops->get_tsf(&local->hw);
+        return -1ULL;
+}
+
+static inline void drv_set_tsf(struct ieee80211_local *local, u64 tsf)
+{
+        if (local->ops->set_tsf)
+                local->ops->set_tsf(&local->hw, tsf);
+}
+
+static inline void drv_reset_tsf(struct ieee80211_local *local)
+{
+        if (local->ops->reset_tsf)
+                local->ops->reset_tsf(&local->hw);
+}
+
+static inline int drv_tx_last_beacon(struct ieee80211_local *local)
+{
+        if (local->ops->tx_last_beacon)
+                return local->ops->tx_last_beacon(&local->hw);
+        return 1;
+}
+
+static inline int drv_ampdu_action(struct ieee80211_local *local,
+                                   enum ieee80211_ampdu_mlme_action action,
+                                   struct ieee80211_sta *sta, u16 tid,
+                                   u16 *ssn)
+{
+        if (local->ops->ampdu_action)
+                return local->ops->ampdu_action(&local->hw, action,
+                                                sta, tid, ssn);
+        return -EOPNOTSUPP;
+}
+#endif /* __MAC80211_DRIVER_OPS */
diff --git a/net/mac80211/event.c b/net/mac80211/event.c
index 0d95561c0ee0..f288d01a6344 100644
--- a/net/mac80211/event.c
+++ b/net/mac80211/event.c
@@ -12,12 +12,12 @@
 #include "ieee80211_i.h"
 
 /*
- * indicate a failed Michael MIC to userspace; the passed packet
- * (in the variable hdr) must be long enough to extract the TKIP
- * fields like TSC
+ * Indicate a failed Michael MIC to userspace. If the caller knows the TSC of
+ * the frame that generated the MIC failure (i.e., if it was provided by the
+ * driver or is still in the frame), it should provide that information.
  */
 void mac80211_ev_michael_mic_failure(struct ieee80211_sub_if_data *sdata, int keyidx,
-                                     struct ieee80211_hdr *hdr)
+                                     struct ieee80211_hdr *hdr, const u8 *tsc)
 {
         union iwreq_data wrqu;
         char *buf = kmalloc(128, GFP_ATOMIC);
@@ -34,8 +34,9 @@ void mac80211_ev_michael_mic_failure(struct ieee80211_sub_if_data *sdata, int ke
                 kfree(buf);
         }
 
-        /*
-         * TODO: re-add support for sending MIC failure indication
-         * with all info via nl80211
-         */
+        cfg80211_michael_mic_failure(sdata->dev, hdr->addr2,
+                                     (hdr->addr1[0] & 0x01) ?
+                                     NL80211_KEYTYPE_GROUP :
+                                     NL80211_KEYTYPE_PAIRWISE,
+                                     keyidx, tsc);
 }
diff --git a/net/mac80211/ht.c b/net/mac80211/ht.c
index 4e3c72f20de7..0891bfb06996 100644
--- a/net/mac80211/ht.c
+++ b/net/mac80211/ht.c
@@ -14,7 +14,6 @@
  */
 
 #include <linux/ieee80211.h>
-#include <net/wireless.h>
 #include <net/mac80211.h>
 #include "ieee80211_i.h"
 #include "rate.h"
@@ -83,89 +82,6 @@ void ieee80211_ht_cap_ie_to_sta_ht_cap(struct ieee80211_supported_band *sband,
                 ht_cap->mcs.rx_mask[32/8] |= 1;
 }
 
-/*
- * ieee80211_enable_ht should be called only after the operating band
- * has been determined as ht configuration depends on the hw's
- * HT abilities for a specific band.
- */
-u32 ieee80211_enable_ht(struct ieee80211_sub_if_data *sdata,
-                        struct ieee80211_ht_info *hti,
-                        u16 ap_ht_cap_flags)
-{
-        struct ieee80211_local *local = sdata->local;
-        struct ieee80211_supported_band *sband;
-        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
-        struct ieee80211_bss_ht_conf ht;
-        struct sta_info *sta;
-        u32 changed = 0;
-        bool enable_ht = true, ht_changed;
-        enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
-
-        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
-
-        memset(&ht, 0, sizeof(ht));
-
-        /* HT is not supported */
-        if (!sband->ht_cap.ht_supported)
-                enable_ht = false;
-
-        /* check that channel matches the right operating channel */
-        if (local->hw.conf.channel->center_freq !=
-            ieee80211_channel_to_frequency(hti->control_chan))
-                enable_ht = false;
-
-        if (enable_ht) {
-                channel_type = NL80211_CHAN_HT20;
-
-                if (!(ap_ht_cap_flags & IEEE80211_HT_CAP_40MHZ_INTOLERANT) &&
-                    (sband->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) &&
-                    (hti->ht_param & IEEE80211_HT_PARAM_CHAN_WIDTH_ANY)) {
-                        switch(hti->ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
-                        case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
-                                channel_type = NL80211_CHAN_HT40PLUS;
-                                break;
-                        case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
-                                channel_type = NL80211_CHAN_HT40MINUS;
-                                break;
-                        }
-                }
-        }
-
-        ht_changed = conf_is_ht(&local->hw.conf) != enable_ht ||
-                     channel_type != local->hw.conf.channel_type;
-
-        local->oper_channel_type = channel_type;
-
-        if (ht_changed) {
-                /* channel_type change automatically detected */
-                ieee80211_hw_config(local, 0);
-
-                rcu_read_lock();
-
-                sta = sta_info_get(local, ifmgd->bssid);
-                if (sta)
-                        rate_control_rate_update(local, sband, sta,
-                                                 IEEE80211_RC_HT_CHANGED);
-
-                rcu_read_unlock();
-
-        }
-
-        /* disable HT */
-        if (!enable_ht)
-                return 0;
-
-        ht.operation_mode = le16_to_cpu(hti->operation_mode);
-
-        /* if bss configuration changed store the new one */
-        if (memcmp(&sdata->vif.bss_conf.ht, &ht, sizeof(ht))) {
-                changed |= BSS_CHANGED_HT;
-                sdata->vif.bss_conf.ht = ht;
-        }
-
-        return changed;
-}
-
 void ieee80211_sta_tear_down_BA_sessions(struct sta_info *sta)
 {
         int i;
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index 3201e1f96365..0b30277eb366 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -22,6 +22,7 @@
 #include <asm/unaligned.h>
 
 #include "ieee80211_i.h"
+#include "driver-ops.h"
 #include "rate.h"
 
 #define IEEE80211_SCAN_INTERVAL (2 * HZ)
@@ -59,74 +60,65 @@ static void ieee80211_rx_mgmt_auth_ibss(struct ieee80211_sub_if_data *sdata,
                                     sdata->u.ibss.bssid, 0);
 }
 
-static int __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
-                                     const u8 *bssid, const int beacon_int,
-                                     const int freq,
-                                     const size_t supp_rates_len,
-                                     const u8 *supp_rates,
-                                     const u16 capability, u64 tsf)
+static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
+                                      const u8 *bssid, const int beacon_int,
+                                      struct ieee80211_channel *chan,
+                                      const u32 basic_rates,
+                                      const u16 capability, u64 tsf)
 {
         struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
         struct ieee80211_local *local = sdata->local;
-        int res = 0, rates, i, j;
+        int rates, i;
         struct sk_buff *skb;
         struct ieee80211_mgmt *mgmt;
         u8 *pos;
         struct ieee80211_supported_band *sband;
-        union iwreq_data wrqu;
+        u32 bss_change;
+        u8 supp_rates[IEEE80211_MAX_SUPP_RATES];
 
-        if (local->ops->reset_tsf) {
-                /* Reset own TSF to allow time synchronization work. */
-                local->ops->reset_tsf(local_to_hw(local));
-        }
+        /* Reset own TSF to allow time synchronization work. */
+        drv_reset_tsf(local);
 
-        if ((ifibss->flags & IEEE80211_IBSS_PREV_BSSID_SET) &&
-           memcmp(ifibss->bssid, bssid, ETH_ALEN) == 0)
-                return res;
+        skb = ifibss->skb;
+        rcu_assign_pointer(ifibss->presp, NULL);
+        synchronize_rcu();
+        skb->data = skb->head;
+        skb->len = 0;
+        skb_reset_tail_pointer(skb);
+        skb_reserve(skb, sdata->local->hw.extra_tx_headroom);
 
-        skb = dev_alloc_skb(local->hw.extra_tx_headroom + 400);
-        if (!skb) {
-                printk(KERN_DEBUG "%s: failed to allocate buffer for probe "
-                       "response\n", sdata->dev->name);
-                return -ENOMEM;
-        }
-
-        if (!(ifibss->flags & IEEE80211_IBSS_PREV_BSSID_SET)) {
-                /* Remove possible STA entries from other IBSS networks. */
-                sta_info_flush_delayed(sdata);
-        }
+        if (memcmp(ifibss->bssid, bssid, ETH_ALEN))
+                sta_info_flush(sdata->local, sdata);
 
         memcpy(ifibss->bssid, bssid, ETH_ALEN);
-        res = ieee80211_if_config(sdata, IEEE80211_IFCC_BSSID);
-        if (res)
-                return res;
-
-        local->hw.conf.beacon_int = beacon_int >= 10 ? beacon_int : 10;
 
-        sdata->drop_unencrypted = capability &
-                WLAN_CAPABILITY_PRIVACY ? 1 : 0;
+        sdata->drop_unencrypted = capability & WLAN_CAPABILITY_PRIVACY ? 1 : 0;
 
-        res = ieee80211_set_freq(sdata, freq);
+        local->oper_channel = chan;
+        local->oper_channel_type = NL80211_CHAN_NO_HT;
+        ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);
 
-        if (res)
-                return res;
+        sband = local->hw.wiphy->bands[chan->band];
 
-        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
+        /* build supported rates array */
+        pos = supp_rates;
+        for (i = 0; i < sband->n_bitrates; i++) {
+                int rate = sband->bitrates[i].bitrate;
+                u8 basic = 0;
+                if (basic_rates & BIT(i))
+                        basic = 0x80;
+                *pos++ = basic | (u8) (rate / 5);
+        }
 
         /* Build IBSS probe response */
-
-        skb_reserve(skb, local->hw.extra_tx_headroom);
-
-        mgmt = (struct ieee80211_mgmt *)
-                skb_put(skb, 24 + sizeof(mgmt->u.beacon));
+        mgmt = (void *) skb_put(skb, 24 + sizeof(mgmt->u.beacon));
         memset(mgmt, 0, 24 + sizeof(mgmt->u.beacon));
         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
                                           IEEE80211_STYPE_PROBE_RESP);
         memset(mgmt->da, 0xff, ETH_ALEN);
         memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
         memcpy(mgmt->bssid, ifibss->bssid, ETH_ALEN);
-        mgmt->u.beacon.beacon_int =
-                cpu_to_le16(local->hw.conf.beacon_int);
+        mgmt->u.beacon.beacon_int = cpu_to_le16(beacon_int);
         mgmt->u.beacon.timestamp = cpu_to_le64(tsf);
         mgmt->u.beacon.capab_info = cpu_to_le16(capability);
 
@@ -135,7 +127,7 @@ static int __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
         *pos++ = ifibss->ssid_len;
         memcpy(pos, ifibss->ssid, ifibss->ssid_len);
 
-        rates = supp_rates_len;
+        rates = sband->n_bitrates;
         if (rates > 8)
                 rates = 8;
         pos = skb_put(skb, 2 + rates);
@@ -147,7 +139,7 @@ static int __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
                 pos = skb_put(skb, 2 + 1);
                 *pos++ = WLAN_EID_DS_PARAMS;
                 *pos++ = 1;
-                *pos++ = ieee80211_frequency_to_channel(freq);
+                *pos++ = ieee80211_frequency_to_channel(chan->center_freq);
         }
 
         pos = skb_put(skb, 2 + 2);
@@ -157,51 +149,73 @@ static int __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
         *pos++ = 0;
         *pos++ = 0;
 
-        if (supp_rates_len > 8) {
-                rates = supp_rates_len - 8;
+        if (sband->n_bitrates > 8) {
+                rates = sband->n_bitrates - 8;
                 pos = skb_put(skb, 2 + rates);
                 *pos++ = WLAN_EID_EXT_SUPP_RATES;
                 *pos++ = rates;
                 memcpy(pos, &supp_rates[8], rates);
         }
 
-        ifibss->probe_resp = skb;
+        if (ifibss->ie_len)
+                memcpy(skb_put(skb, ifibss->ie_len),
+                       ifibss->ie, ifibss->ie_len);
 
-        ieee80211_if_config(sdata, IEEE80211_IFCC_BEACON |
-                                   IEEE80211_IFCC_BEACON_ENABLED);
+        rcu_assign_pointer(ifibss->presp, skb);
 
+        sdata->vif.bss_conf.beacon_int = beacon_int;
+        bss_change = BSS_CHANGED_BEACON_INT;
+        bss_change |= ieee80211_reset_erp_info(sdata);
+        bss_change |= BSS_CHANGED_BSSID;
+        bss_change |= BSS_CHANGED_BEACON;
+        bss_change |= BSS_CHANGED_BEACON_ENABLED;
+        ieee80211_bss_info_change_notify(sdata, bss_change);
 
-        rates = 0;
-        for (i = 0; i < supp_rates_len; i++) {
-                int bitrate = (supp_rates[i] & 0x7f) * 5;
-                for (j = 0; j < sband->n_bitrates; j++)
-                        if (sband->bitrates[j].bitrate == bitrate)
-                                rates |= BIT(j);
-        }
+        ieee80211_sta_def_wmm_params(sdata, sband->n_bitrates, supp_rates);
 
-        ieee80211_sta_def_wmm_params(sdata, supp_rates_len, supp_rates);
-
-        ifibss->flags |= IEEE80211_IBSS_PREV_BSSID_SET;
         ifibss->state = IEEE80211_IBSS_MLME_JOINED;
-        mod_timer(&ifibss->timer, jiffies + IEEE80211_IBSS_MERGE_INTERVAL);
-
-        memset(&wrqu, 0, sizeof(wrqu));
-        memcpy(wrqu.ap_addr.sa_data, bssid, ETH_ALEN);
-        wireless_send_event(sdata->dev, SIOCGIWAP, &wrqu, NULL);
+        mod_timer(&ifibss->timer,
+                  round_jiffies(jiffies + IEEE80211_IBSS_MERGE_INTERVAL));
 
-        return res;
+        cfg80211_inform_bss_frame(local->hw.wiphy, local->hw.conf.channel,
+                                  mgmt, skb->len, 0, GFP_KERNEL);
+        cfg80211_ibss_joined(sdata->dev, ifibss->bssid, GFP_KERNEL);
 }
 
-static int ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
-                                   struct ieee80211_bss *bss)
+static void ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
+                                    struct ieee80211_bss *bss)
 {
-        return __ieee80211_sta_join_ibss(sdata,
-                                         bss->cbss.bssid,
-                                         bss->cbss.beacon_interval,
-                                         bss->cbss.channel->center_freq,
-                                         bss->supp_rates_len, bss->supp_rates,
-                                         bss->cbss.capability,
-                                         bss->cbss.tsf);
+        struct ieee80211_supported_band *sband;
+        u32 basic_rates;
+        int i, j;
+        u16 beacon_int = bss->cbss.beacon_interval;
+
+        if (beacon_int < 10)
+                beacon_int = 10;
+
+        sband = sdata->local->hw.wiphy->bands[bss->cbss.channel->band];
+
+        basic_rates = 0;
+
+        for (i = 0; i < bss->supp_rates_len; i++) {
+                int rate = (bss->supp_rates[i] & 0x7f) * 5;
+                bool is_basic = !!(bss->supp_rates[i] & 0x80);
+
+                for (j = 0; j < sband->n_bitrates; j++) {
+                        if (sband->bitrates[j].bitrate == rate) {
+                                if (is_basic)
+                                        basic_rates |= BIT(j);
+                                break;
+                        }
+                }
+        }
+
+        __ieee80211_sta_join_ibss(sdata, bss->cbss.bssid,
+                                  beacon_int,
+                                  bss->cbss.channel,
+                                  basic_rates,
+                                  bss->cbss.capability,
+                                  bss->cbss.tsf);
 }
 
 static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
@@ -277,7 +291,7 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
                 goto put_bss;
 
         /* we use a fixed BSSID */
-        if (sdata->u.ibss.flags & IEEE80211_IBSS_BSSID_SET)
+        if (sdata->u.ibss.bssid)
                 goto put_bss;
 
         /* not an IBSS */
@@ -322,12 +336,13 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
                                 bitrates[rx_status->rate_idx].bitrate;
 
                 rx_timestamp = rx_status->mactime + (24 * 8 * 10 / rate);
-        } else if (local && local->ops && local->ops->get_tsf)
-                /* second best option: get current TSF */
-                rx_timestamp = local->ops->get_tsf(local_to_hw(local));
-        else
-                /* can't merge without knowing the TSF */
-                rx_timestamp = -1LLU;
+        } else {
+                /*
+                 * second best option: get current TSF
+                 * (will return -1 if not supported)
+                 */
+                rx_timestamp = drv_get_tsf(local);
+        }
 
 #ifdef CONFIG_MAC80211_IBSS_DEBUG
         printk(KERN_DEBUG "RX beacon SA=%pM BSSID="
@@ -369,13 +384,14 @@ struct sta_info *ieee80211_ibss_add_sta(struct ieee80211_sub_if_data *sdata,
         struct sta_info *sta;
         int band = local->hw.conf.channel->band;
 
-        /* TODO: Could consider removing the least recently used entry and
-         * allow new one to be added. */
+        /*
+         * XXX: Consider removing the least recently used entry and
+         *      allow new one to be added.
+         */
         if (local->num_sta >= IEEE80211_IBSS_MAX_STA_ENTRIES) {
-                if (net_ratelimit()) {
-                        printk(KERN_DEBUG "%s: No room for a new IBSS STA "
-                               "entry %pM\n", sdata->dev->name, addr);
-                }
+                if (net_ratelimit())
+                        printk(KERN_DEBUG "%s: No room for a new IBSS STA entry %pM\n",
+                               sdata->dev->name, addr);
                 return NULL;
         }
 
@@ -432,41 +448,33 @@ static void ieee80211_sta_merge_ibss(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
 
-        mod_timer(&ifibss->timer, jiffies + IEEE80211_IBSS_MERGE_INTERVAL);
+        mod_timer(&ifibss->timer,
+                  round_jiffies(jiffies + IEEE80211_IBSS_MERGE_INTERVAL));
 
         ieee80211_sta_expire(sdata, IEEE80211_IBSS_INACTIVITY_LIMIT);
+
         if (ieee80211_sta_active_ibss(sdata))
                 return;
 
-        if ((ifibss->flags & IEEE80211_IBSS_BSSID_SET) &&
-            (!(ifibss->flags & IEEE80211_IBSS_AUTO_CHANNEL_SEL)))
+        if (ifibss->fixed_channel)
                 return;
 
         printk(KERN_DEBUG "%s: No active IBSS STAs - trying to scan for other "
                "IBSS networks with same SSID (merge)\n", sdata->dev->name);
 
-        /* XXX maybe racy? */
-        if (sdata->local->scan_req)
-                return;
-
-        memcpy(sdata->local->int_scan_req.ssids[0].ssid,
-               ifibss->ssid, IEEE80211_MAX_SSID_LEN);
-        sdata->local->int_scan_req.ssids[0].ssid_len = ifibss->ssid_len;
-        ieee80211_request_scan(sdata, &sdata->local->int_scan_req);
+        ieee80211_request_internal_scan(sdata, ifibss->ssid, ifibss->ssid_len);
 }
 
-static int ieee80211_sta_create_ibss(struct ieee80211_sub_if_data *sdata)
+static void ieee80211_sta_create_ibss(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_supported_band *sband;
-        u8 *pos;
         u8 bssid[ETH_ALEN];
-        u8 supp_rates[IEEE80211_MAX_SUPP_RATES];
         u16 capability;
         int i;
 
-        if (ifibss->flags & IEEE80211_IBSS_BSSID_SET) {
+        if (ifibss->fixed_bssid) {
                 memcpy(bssid, ifibss->bssid, ETH_ALEN);
         } else {
                 /* Generate random, not broadcast, locally administered BSSID. Mix in
@@ -482,10 +490,7 @@ static int ieee80211_sta_create_ibss(struct ieee80211_sub_if_data *sdata)
         printk(KERN_DEBUG "%s: Creating new IBSS network, BSSID %pM\n",
                sdata->dev->name, bssid);
 
-        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
-
-        if (local->hw.conf.beacon_int == 0)
-                local->hw.conf.beacon_int = 100;
+        sband = local->hw.wiphy->bands[ifibss->channel->band];
 
         capability = WLAN_CAPABILITY_IBSS;
 
@@ -494,29 +499,20 @@ static int ieee80211_sta_create_ibss(struct ieee80211_sub_if_data *sdata)
         else
                 sdata->drop_unencrypted = 0;
 
-        pos = supp_rates;
-        for (i = 0; i < sband->n_bitrates; i++) {
-                int rate = sband->bitrates[i].bitrate;
-                *pos++ = (u8) (rate / 5);
-        }
-
-        return __ieee80211_sta_join_ibss(sdata,
-                                         bssid, local->hw.conf.beacon_int,
-                                         local->hw.conf.channel->center_freq,
-                                         sband->n_bitrates, supp_rates,
-                                         capability, 0);
+        __ieee80211_sta_join_ibss(sdata, bssid, sdata->vif.bss_conf.beacon_int,
+                                  ifibss->channel, 3, /* first two are basic */
+                                  capability, 0);
 }
 
-static int ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata)
+static void ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_bss *bss;
+        struct ieee80211_channel *chan = NULL;
         const u8 *bssid = NULL;
         int active_ibss;
-
-        if (ifibss->ssid_len == 0)
-                return -EINVAL;
+        u16 capability;
 
         active_ibss = ieee80211_sta_active_ibss(sdata);
 #ifdef CONFIG_MAC80211_IBSS_DEBUG
@@ -525,14 +521,23 @@ static int ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata)
 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
 
         if (active_ibss)
-                return 0;
+                return;
 
-        if (ifibss->flags & IEEE80211_IBSS_BSSID_SET)
+        capability = WLAN_CAPABILITY_IBSS;
+        if (sdata->default_key)
+                capability |= WLAN_CAPABILITY_PRIVACY;
+
+        if (ifibss->fixed_bssid)
                 bssid = ifibss->bssid;
-        bss = (void *)cfg80211_get_bss(local->hw.wiphy, NULL, bssid,
+        if (ifibss->fixed_channel)
+                chan = ifibss->channel;
+        if (!is_zero_ether_addr(ifibss->bssid))
+                bssid = ifibss->bssid;
+        bss = (void *)cfg80211_get_bss(local->hw.wiphy, chan, bssid,
                                        ifibss->ssid, ifibss->ssid_len,
-                                       WLAN_CAPABILITY_IBSS,
-                                       WLAN_CAPABILITY_IBSS);
+                                       WLAN_CAPABILITY_IBSS |
+                                       WLAN_CAPABILITY_PRIVACY,
+                                       capability);
 
 #ifdef CONFIG_MAC80211_IBSS_DEBUG
         if (bss)
@@ -540,18 +545,14 @@ static int ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata)
                        "%pM\n", bss->cbss.bssid, ifibss->bssid);
 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
 
-        if (bss &&
-            (!(ifibss->flags & IEEE80211_IBSS_PREV_BSSID_SET) ||
-             memcmp(ifibss->bssid, bss->cbss.bssid, ETH_ALEN))) {
-                int ret;
-
+        if (bss && memcmp(ifibss->bssid, bss->cbss.bssid, ETH_ALEN)) {
                 printk(KERN_DEBUG "%s: Selected IBSS BSSID %pM"
                        " based on configured SSID\n",
                        sdata->dev->name, bss->cbss.bssid);
 
-                ret = ieee80211_sta_join_ibss(sdata, bss);
+                ieee80211_sta_join_ibss(sdata, bss);
                 ieee80211_rx_bss_put(local, bss);
-                return ret;
+                return;
         } else if (bss)
                 ieee80211_rx_bss_put(local, bss);
 
@@ -562,29 +563,24 @@ static int ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata)
         /* Selected IBSS not found in current scan results - try to scan */
         if (ifibss->state == IEEE80211_IBSS_MLME_JOINED &&
             !ieee80211_sta_active_ibss(sdata)) {
-                mod_timer(&ifibss->timer, jiffies +
-                                          IEEE80211_IBSS_MERGE_INTERVAL);
-        } else if (time_after(jiffies, local->last_scan_completed +
+                mod_timer(&ifibss->timer,
+                          round_jiffies(jiffies + IEEE80211_IBSS_MERGE_INTERVAL));
+        } else if (time_after(jiffies, ifibss->last_scan_completed +
                                         IEEE80211_SCAN_INTERVAL)) {
                 printk(KERN_DEBUG "%s: Trigger new scan to find an IBSS to "
                        "join\n", sdata->dev->name);
 
-                /* XXX maybe racy? */
-                if (local->scan_req)
-                        return -EBUSY;
-
-                memcpy(local->int_scan_req.ssids[0].ssid,
-                       ifibss->ssid, IEEE80211_MAX_SSID_LEN);
-                local->int_scan_req.ssids[0].ssid_len = ifibss->ssid_len;
-                return ieee80211_request_scan(sdata, &local->int_scan_req);
+                ieee80211_request_internal_scan(sdata, ifibss->ssid,
+                                                ifibss->ssid_len);
         } else if (ifibss->state != IEEE80211_IBSS_MLME_JOINED) {
                 int interval = IEEE80211_SCAN_INTERVAL;
 
                 if (time_after(jiffies, ifibss->ibss_join_req +
                                IEEE80211_IBSS_JOIN_TIMEOUT)) {
-                        if (!(local->oper_channel->flags &
-                                                IEEE80211_CHAN_NO_IBSS))
-                                return ieee80211_sta_create_ibss(sdata);
+                        if (!(local->oper_channel->flags & IEEE80211_CHAN_NO_IBSS)) {
+                                ieee80211_sta_create_ibss(sdata);
+                                return;
+                        }
                         printk(KERN_DEBUG "%s: IBSS not allowed on"
                                " %d MHz\n", sdata->dev->name,
                                local->hw.conf.channel->center_freq);
@@ -595,11 +591,9 @@ static int ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata)
                 }
 
                 ifibss->state = IEEE80211_IBSS_MLME_SEARCH;
-                mod_timer(&ifibss->timer, jiffies + interval);
-                return 0;
+                mod_timer(&ifibss->timer,
+                          round_jiffies(jiffies + interval));
         }
-
-        return 0;
 }
 
 static void ieee80211_rx_mgmt_probe_req(struct ieee80211_sub_if_data *sdata,
@@ -614,13 +608,10 @@ static void ieee80211_rx_mgmt_probe_req(struct ieee80211_sub_if_data *sdata,
         u8 *pos, *end;
 
         if (ifibss->state != IEEE80211_IBSS_MLME_JOINED ||
-            len < 24 + 2 || !ifibss->probe_resp)
+            len < 24 + 2 || !ifibss->presp)
                 return;
 
-        if (local->ops->tx_last_beacon)
-                tx_last_beacon = local->ops->tx_last_beacon(local_to_hw(local));
-        else
-                tx_last_beacon = 1;
+        tx_last_beacon = drv_tx_last_beacon(local);
 
 #ifdef CONFIG_MAC80211_IBSS_DEBUG
         printk(KERN_DEBUG "%s: RX ProbeReq SA=%pM DA=%pM BSSID=%pM"
@@ -649,13 +640,13 @@ static void ieee80211_rx_mgmt_probe_req(struct ieee80211_sub_if_data *sdata,
         }
         if (pos[1] != 0 &&
             (pos[1] != ifibss->ssid_len ||
-             memcmp(pos + 2, ifibss->ssid, ifibss->ssid_len) != 0)) {
+             !memcmp(pos + 2, ifibss->ssid, ifibss->ssid_len))) {
                 /* Ignore ProbeReq for foreign SSID */
                 return;
         }
 
         /* Reply with ProbeResp */
-        skb = skb_copy(ifibss->probe_resp, GFP_KERNEL);
+        skb = skb_copy(ifibss->presp, GFP_KERNEL);
         if (!skb)
                 return;
 
@@ -746,6 +737,9 @@ static void ieee80211_ibss_work(struct work_struct *work)
         struct ieee80211_if_ibss *ifibss;
         struct sk_buff *skb;
 
+        if (WARN_ON(local->suspended))
+                return;
+
         if (!netif_running(sdata->dev))
                 return;
 
@@ -782,101 +776,63 @@ static void ieee80211_ibss_timer(unsigned long data)
         struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
         struct ieee80211_local *local = sdata->local;
 
+        if (local->quiescing) {
+                ifibss->timer_running = true;
+                return;
+        }
+
         set_bit(IEEE80211_IBSS_REQ_RUN, &ifibss->request);
         queue_work(local->hw.workqueue, &ifibss->work);
 }
 
-void ieee80211_ibss_setup_sdata(struct ieee80211_sub_if_data *sdata)
+#ifdef CONFIG_PM
+void ieee80211_ibss_quiesce(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
 
-        INIT_WORK(&ifibss->work, ieee80211_ibss_work);
-        setup_timer(&ifibss->timer, ieee80211_ibss_timer,
-                    (unsigned long) sdata);
-        skb_queue_head_init(&ifibss->skb_queue);
-
-        ifibss->flags |= IEEE80211_IBSS_AUTO_BSSID_SEL |
-                        IEEE80211_IBSS_AUTO_CHANNEL_SEL;
+        cancel_work_sync(&ifibss->work);
+        if (del_timer_sync(&ifibss->timer))
+                ifibss->timer_running = true;
 }
 
-int ieee80211_ibss_commit(struct ieee80211_sub_if_data *sdata)
+void ieee80211_ibss_restart(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
 
-        ifibss->flags &= ~IEEE80211_IBSS_PREV_BSSID_SET;
-
-        if (ifibss->ssid_len)
-                ifibss->flags |= IEEE80211_IBSS_SSID_SET;
-        else
-                ifibss->flags &= ~IEEE80211_IBSS_SSID_SET;
-
-        ifibss->ibss_join_req = jiffies;
-        ifibss->state = IEEE80211_IBSS_MLME_SEARCH;
-        set_bit(IEEE80211_IBSS_REQ_RUN, &ifibss->request);
-
-        return 0;
-}
-
-int ieee80211_ibss_set_ssid(struct ieee80211_sub_if_data *sdata, char *ssid, size_t len)
-{
-        struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
-
-        if (len > IEEE80211_MAX_SSID_LEN)
-                return -EINVAL;
-
-        if (ifibss->ssid_len != len || memcmp(ifibss->ssid, ssid, len) != 0) {
-                memset(ifibss->ssid, 0, sizeof(ifibss->ssid));
-                memcpy(ifibss->ssid, ssid, len);
-                ifibss->ssid_len = len;
+        if (ifibss->timer_running) {
+                add_timer(&ifibss->timer);
+                ifibss->timer_running = false;
         }
-
-        return ieee80211_ibss_commit(sdata);
-}
-
-int ieee80211_ibss_get_ssid(struct ieee80211_sub_if_data *sdata, char *ssid, size_t *len)
-{
-        struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
-
-        memcpy(ssid, ifibss->ssid, ifibss->ssid_len);
-        *len = ifibss->ssid_len;
-
-        return 0;
 }
+#endif
 
-int ieee80211_ibss_set_bssid(struct ieee80211_sub_if_data *sdata, u8 *bssid)
+void ieee80211_ibss_setup_sdata(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
 
-        if (is_valid_ether_addr(bssid)) {
-                memcpy(ifibss->bssid, bssid, ETH_ALEN);
-                ifibss->flags |= IEEE80211_IBSS_BSSID_SET;
-        } else {
-                memset(ifibss->bssid, 0, ETH_ALEN);
-                ifibss->flags &= ~IEEE80211_IBSS_BSSID_SET;
-        }
-
-        if (netif_running(sdata->dev)) {
-                if (ieee80211_if_config(sdata, IEEE80211_IFCC_BSSID)) {
-                        printk(KERN_DEBUG "%s: Failed to config new BSSID to "
-                               "the low-level driver\n", sdata->dev->name);
-                }
-        }
-
-        return ieee80211_ibss_commit(sdata);
+        INIT_WORK(&ifibss->work, ieee80211_ibss_work);
+        setup_timer(&ifibss->timer, ieee80211_ibss_timer,
+                    (unsigned long) sdata);
+        skb_queue_head_init(&ifibss->skb_queue);
 }
 
 /* scan finished notification */
 void ieee80211_ibss_notify_scan_completed(struct ieee80211_local *local)
 {
-        struct ieee80211_sub_if_data *sdata = local->scan_sdata;
-        struct ieee80211_if_ibss *ifibss;
-
-        if (sdata && sdata->vif.type == NL80211_IFTYPE_ADHOC) {
-                ifibss = &sdata->u.ibss;
-                if ((!(ifibss->flags & IEEE80211_IBSS_PREV_BSSID_SET)) ||
-                    !ieee80211_sta_active_ibss(sdata))
-                        ieee80211_sta_find_ibss(sdata);
+        struct ieee80211_sub_if_data *sdata;
+
+        mutex_lock(&local->iflist_mtx);
+        list_for_each_entry(sdata, &local->interfaces, list) {
+                if (!netif_running(sdata->dev))
+                        continue;
+                if (sdata->vif.type != NL80211_IFTYPE_ADHOC)
+                        continue;
+                if (!sdata->u.ibss.ssid_len)
+                        continue;
+                sdata->u.ibss.last_scan_completed = jiffies;
+                ieee80211_sta_find_ibss(sdata);
         }
+        mutex_unlock(&local->iflist_mtx);
 }
 
 ieee80211_rx_result
@@ -906,3 +862,86 @@ ieee80211_ibss_rx_mgmt(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb,
 
         return RX_DROP_MONITOR;
 }
+
+int ieee80211_ibss_join(struct ieee80211_sub_if_data *sdata,
+                        struct cfg80211_ibss_params *params)
+{
+        struct sk_buff *skb;
+
+        if (params->bssid) {
+                memcpy(sdata->u.ibss.bssid, params->bssid, ETH_ALEN);
+                sdata->u.ibss.fixed_bssid = true;
+        } else
+                sdata->u.ibss.fixed_bssid = false;
+
+        sdata->vif.bss_conf.beacon_int = params->beacon_interval;
+
+        sdata->u.ibss.channel = params->channel;
+        sdata->u.ibss.fixed_channel = params->channel_fixed;
+
+        if (params->ie) {
+                sdata->u.ibss.ie = kmemdup(params->ie, params->ie_len,
+                                           GFP_KERNEL);
+                if (sdata->u.ibss.ie)
+                        sdata->u.ibss.ie_len = params->ie_len;
+        }
+
+        skb = dev_alloc_skb(sdata->local->hw.extra_tx_headroom +
+                            36 /* bitrates */ +
+                            34 /* SSID */ +
+                            3  /* DS params */ +
+                            4  /* IBSS params */ +
+                            params->ie_len);
+        if (!skb)
+                return -ENOMEM;
+
+        sdata->u.ibss.skb = skb;
+        sdata->u.ibss.state = IEEE80211_IBSS_MLME_SEARCH;
+        sdata->u.ibss.ibss_join_req = jiffies;
+
+        memcpy(sdata->u.ibss.ssid, params->ssid, IEEE80211_MAX_SSID_LEN);
+
+        /*
+         * The ssid_len setting below is used to see whether
+         * we are active, and we need all other settings
+         * before that may get visible.
+         */
+        mb();
+
+        sdata->u.ibss.ssid_len = params->ssid_len;
+
+        ieee80211_recalc_idle(sdata->local);
+
+        set_bit(IEEE80211_IBSS_REQ_RUN, &sdata->u.ibss.request);
+        queue_work(sdata->local->hw.workqueue, &sdata->u.ibss.work);
+
+        return 0;
+}
+
+int ieee80211_ibss_leave(struct ieee80211_sub_if_data *sdata)
+{
+        struct sk_buff *skb;
+
+        del_timer_sync(&sdata->u.ibss.timer);
+        clear_bit(IEEE80211_IBSS_REQ_RUN, &sdata->u.ibss.request);
+        cancel_work_sync(&sdata->u.ibss.work);
+        clear_bit(IEEE80211_IBSS_REQ_RUN, &sdata->u.ibss.request);
+
+        sta_info_flush(sdata->local, sdata);
+
+        /* remove beacon */
+        kfree(sdata->u.ibss.ie);
+        skb = sdata->u.ibss.presp;
+        rcu_assign_pointer(sdata->u.ibss.presp, NULL);
+        ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON_ENABLED);
+        synchronize_rcu();
+        kfree_skb(skb);
+
+        skb_queue_purge(&sdata->u.ibss.skb_queue);
+        memset(sdata->u.ibss.bssid, 0, ETH_ALEN);
+        sdata->u.ibss.ssid_len = 0;
+
+        ieee80211_recalc_idle(sdata->local);
+
+        return 0;
+}
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index e6ed78cb16b3..c088c46704a3 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -24,7 +24,6 @@
 #include <linux/spinlock.h>
 #include <linux/etherdevice.h>
 #include <net/cfg80211.h>
-#include <net/wireless.h>
 #include <net/iw_handler.h>
 #include <net/mac80211.h>
 #include "key.h"
@@ -236,7 +235,7 @@ struct mesh_preq_queue {
 #define IEEE80211_STA_ASSOCIATED        BIT(4)
 #define IEEE80211_STA_PROBEREQ_POLL     BIT(5)
 #define IEEE80211_STA_CREATE_IBSS       BIT(6)
-/* hole at 7, please re-use */
+#define IEEE80211_STA_CONTROL_PORT      BIT(7)
 #define IEEE80211_STA_WMM_ENABLED       BIT(8)
 /* hole at 9, please re-use */
 #define IEEE80211_STA_AUTO_SSID_SEL     BIT(10)
@@ -249,9 +248,8 @@ struct mesh_preq_queue {
 #define IEEE80211_STA_EXT_SME           BIT(17)
 /* flags for MLME request */
 #define IEEE80211_STA_REQ_SCAN 0
-#define IEEE80211_STA_REQ_DIRECT_PROBE 1
-#define IEEE80211_STA_REQ_AUTH 2
-#define IEEE80211_STA_REQ_RUN  3
+#define IEEE80211_STA_REQ_AUTH 1
+#define IEEE80211_STA_REQ_RUN  2
 
 /* bitfield of allowed auth algs */
 #define IEEE80211_AUTH_ALG_OPEN BIT(0)
@@ -295,6 +293,9 @@ struct ieee80211_if_managed {
         int auth_tries; /* retries for auth req */
         int assoc_tries; /* retries for assoc req */
 
+        unsigned long timers_running; /* used for quiesce/restart */
+        bool powersave; /* powersave requested for this iface */
+
         unsigned long request;
 
         unsigned long last_probe;
@@ -306,6 +307,8 @@ struct ieee80211_if_managed {
         int auth_alg; /* currently used IEEE 802.11 authentication algorithm */
         int auth_transaction;
 
+        u32 beacon_crc;
+
         enum {
                 IEEE80211_MFP_DISABLED,
                 IEEE80211_MFP_OPTIONAL,
@@ -319,14 +322,6 @@ struct ieee80211_if_managed {
         size_t sme_auth_ie_len;
 };
 
-enum ieee80211_ibss_flags {
-        IEEE80211_IBSS_AUTO_CHANNEL_SEL         = BIT(0),
-        IEEE80211_IBSS_AUTO_BSSID_SEL           = BIT(1),
-        IEEE80211_IBSS_BSSID_SET                = BIT(2),
-        IEEE80211_IBSS_PREV_BSSID_SET           = BIT(3),
-        IEEE80211_IBSS_SSID_SET                 = BIT(4),
-};
-
 enum ieee80211_ibss_request {
         IEEE80211_IBSS_REQ_RUN  = 0,
 };
@@ -337,17 +332,23 @@ struct ieee80211_if_ibss {
 
         struct sk_buff_head skb_queue;
 
-        u8 ssid[IEEE80211_MAX_SSID_LEN];
-        u8 ssid_len;
+        unsigned long request;
+        unsigned long last_scan_completed;
 
-        u32 flags;
+        bool timer_running;
 
-        u8 bssid[ETH_ALEN];
+        bool fixed_bssid;
+        bool fixed_channel;
 
-        unsigned long request;
+        u8 bssid[ETH_ALEN];
+        u8 ssid[IEEE80211_MAX_SSID_LEN];
+        u8 ssid_len, ie_len;
+        u8 *ie;
+        struct ieee80211_channel *channel;
 
         unsigned long ibss_join_req;
-        struct sk_buff *probe_resp; /* ProbeResp template for IBSS */
+        /* probe response/beacon for IBSS */
+        struct sk_buff *presp, *skb;
 
         enum {
                 IEEE80211_IBSS_MLME_SEARCH,
@@ -361,6 +362,8 @@ struct ieee80211_if_mesh {
         struct timer_list mesh_path_timer;
         struct sk_buff_head skb_queue;
 
+        unsigned long timers_running;
+
         bool housekeeping;
 
         u8 mesh_id[IEEE80211_MAX_MESH_ID_LEN];
@@ -430,6 +433,12 @@ struct ieee80211_sub_if_data {
 
         int drop_unencrypted;
 
+        /*
+         * keep track of whether the HT opmode (stored in
+         * vif.bss_info.ht_operation_mode) is valid.
+         */
+        bool ht_opmode_valid;
+
         /* Fragment table for host-based reassembly */
         struct ieee80211_fragment_entry fragments[IEEE80211_FRAGMENT_MAX];
         unsigned int fragment_next;
@@ -606,6 +615,21 @@ struct ieee80211_local {
         unsigned int filter_flags; /* FIF_* */
         struct iw_statistics wstats;
         bool tim_in_locked_section; /* see ieee80211_beacon_get() */
+
+        /*
+         * suspended is true if we finished all the suspend _and_ we have
+         * not yet come up from resume. This is to be used by mac80211
+         * to ensure driver sanity during suspend and mac80211's own
+         * sanity. It can eventually be used for WoW as well.
+         */
+        bool suspended;
+
+        /*
+         * quiescing is true during the suspend process _only_ to
+         * ease timer cancelling etc.
+         */
+        bool quiescing;
+
         int tx_headroom; /* required headroom for hardware/radiotap */
 
         /* Tasklet and skb queue to process calls from IRQ mode. All frames
@@ -626,8 +650,6 @@ struct ieee80211_local {
         spinlock_t sta_lock;
         unsigned long num_sta;
         struct list_head sta_list;
-        struct list_head sta_flush_list;
-        struct work_struct sta_flush_work;
         struct sta_info *sta_hash[STA_HASH_SIZE];
         struct timer_list sta_cleanup;
 
@@ -647,9 +669,6 @@ struct ieee80211_local {
 
         struct rate_control_ref *rate_ctrl;
 
-        int rts_threshold;
-        int fragmentation_threshold;
-
         struct crypto_blkcipher *wep_tx_tfm;
         struct crypto_blkcipher *wep_rx_tfm;
         u32 wep_iv;
@@ -666,15 +685,18 @@ struct ieee80211_local {
 
 
         /* Scanning and BSS list */
+        struct mutex scan_mtx;
         bool sw_scanning, hw_scanning;
         struct cfg80211_ssid scan_ssid;
         struct cfg80211_scan_request int_scan_req;
         struct cfg80211_scan_request *scan_req;
         struct ieee80211_channel *scan_channel;
+        const u8 *orig_ies;
+        int orig_ies_len;
         int scan_channel_idx;
+        int scan_ies_len;
 
         enum { SCAN_SET_CHANNEL, SCAN_SEND_PROBE } scan_state;
-        unsigned long last_scan_completed;
         struct delayed_work scan_work;
         struct ieee80211_sub_if_data *scan_sdata;
         enum nl80211_channel_type oper_channel_type;
@@ -736,28 +758,32 @@ struct ieee80211_local {
         int wifi_wme_noack_test;
         unsigned int wmm_acm; /* bit field of ACM bits (BIT(802.1D tag)) */
 
-        bool powersave;
         bool pspolling;
+        /*
+         * PS can only be enabled when we have exactly one managed
+         * interface (and monitors) in PS, this then points there.
+         */
+        struct ieee80211_sub_if_data *ps_sdata;
         struct work_struct dynamic_ps_enable_work;
         struct work_struct dynamic_ps_disable_work;
         struct timer_list dynamic_ps_timer;
+        struct notifier_block network_latency_notifier;
 
         int user_power_level; /* in dBm */
         int power_constr_level; /* in dBm */
 
+        struct work_struct restart_work;
+
 #ifdef CONFIG_MAC80211_DEBUGFS
         struct local_debugfsdentries {
                 struct dentry *rcdir;
                 struct dentry *rcname;
                 struct dentry *frequency;
-                struct dentry *rts_threshold;
-                struct dentry *fragmentation_threshold;
-                struct dentry *short_retry_limit;
-                struct dentry *long_retry_limit;
                 struct dentry *total_ps_buffered;
                 struct dentry *wep_iv;
                 struct dentry *tsf;
                 struct dentry *reset;
+                struct dentry *noack;
                 struct dentry *statistics;
                 struct local_debugfsdentries_statsdentries {
                         struct dentry *transmitted_fragment_count;
@@ -830,7 +856,7 @@ struct ieee802_11_elems {
         u8 *fh_params;
         u8 *ds_params;
         u8 *cf_params;
-        u8 *tim;
+        struct ieee80211_tim_ie *tim;
         u8 *ibss_params;
         u8 *challenge;
         u8 *wpa;
@@ -903,7 +929,6 @@ static inline int ieee80211_bssid_match(const u8 *raddr, const u8 *addr)
 
 
 int ieee80211_hw_config(struct ieee80211_local *local, u32 changed);
-int ieee80211_if_config(struct ieee80211_sub_if_data *sdata, u32 changed);
 void ieee80211_tx_set_protected(struct ieee80211_tx_data *tx);
 void ieee80211_bss_info_change_notify(struct ieee80211_sub_if_data *sdata,
                                       u32 changed);
@@ -927,12 +952,16 @@ int ieee80211_sta_deauthenticate(struct ieee80211_sub_if_data *sdata, u16 reason
 int ieee80211_sta_disassociate(struct ieee80211_sub_if_data *sdata, u16 reason);
 void ieee80211_send_pspoll(struct ieee80211_local *local,
                            struct ieee80211_sub_if_data *sdata);
+void ieee80211_recalc_ps(struct ieee80211_local *local, s32 latency);
+int ieee80211_max_network_latency(struct notifier_block *nb,
+                                  unsigned long data, void *dummy);
+void ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
+                                      struct ieee80211_channel_sw_ie *sw_elem,
+                                      struct ieee80211_bss *bss);
+void ieee80211_sta_quiesce(struct ieee80211_sub_if_data *sdata);
+void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata);
 
 /* IBSS code */
-int ieee80211_ibss_commit(struct ieee80211_sub_if_data *sdata);
-int ieee80211_ibss_set_ssid(struct ieee80211_sub_if_data *sdata, char *ssid, size_t len);
-int ieee80211_ibss_get_ssid(struct ieee80211_sub_if_data *sdata, char *ssid, size_t *len);
-int ieee80211_ibss_set_bssid(struct ieee80211_sub_if_data *sdata, u8 *bssid);
 void ieee80211_ibss_notify_scan_completed(struct ieee80211_local *local);
 void ieee80211_ibss_setup_sdata(struct ieee80211_sub_if_data *sdata);
 ieee80211_rx_result
@@ -940,14 +969,22 @@ ieee80211_ibss_rx_mgmt(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb,
                        struct ieee80211_rx_status *rx_status);
 struct sta_info *ieee80211_ibss_add_sta(struct ieee80211_sub_if_data *sdata,
                                         u8 *bssid, u8 *addr, u32 supp_rates);
+int ieee80211_ibss_join(struct ieee80211_sub_if_data *sdata,
+                        struct cfg80211_ibss_params *params);
+int ieee80211_ibss_leave(struct ieee80211_sub_if_data *sdata);
+void ieee80211_ibss_quiesce(struct ieee80211_sub_if_data *sdata);
+void ieee80211_ibss_restart(struct ieee80211_sub_if_data *sdata);
 
 /* scan/BSS handling */
 void ieee80211_scan_work(struct work_struct *work);
+int ieee80211_request_internal_scan(struct ieee80211_sub_if_data *sdata,
+                                    const u8 *ssid, u8 ssid_len);
 int ieee80211_request_scan(struct ieee80211_sub_if_data *sdata,
                            struct cfg80211_scan_request *req);
 int ieee80211_scan_results(struct ieee80211_local *local,
                            struct iw_request_info *info,
                            char *buf, size_t len);
+void ieee80211_scan_cancel(struct ieee80211_local *local);
 ieee80211_rx_result
 ieee80211_scan_rx(struct ieee80211_sub_if_data *sdata,
                   struct sk_buff *skb,
@@ -956,9 +993,6 @@ int ieee80211_sta_set_extra_ie(struct ieee80211_sub_if_data *sdata,
                                const char *ie, size_t len);
 
 void ieee80211_mlme_notify_scan_completed(struct ieee80211_local *local);
-void ieee80211_scan_failed(struct ieee80211_local *local);
-int ieee80211_start_scan(struct ieee80211_sub_if_data *scan_sdata,
-                         struct cfg80211_scan_request *req);
 struct ieee80211_bss *
 ieee80211_bss_info_update(struct ieee80211_local *local,
                           struct ieee80211_rx_status *rx_status,
@@ -983,6 +1017,8 @@ int ieee80211_if_change_type(struct ieee80211_sub_if_data *sdata,
                              enum nl80211_iftype type);
 void ieee80211_if_remove(struct ieee80211_sub_if_data *sdata);
 void ieee80211_remove_interfaces(struct ieee80211_local *local);
+u32 __ieee80211_recalc_idle(struct ieee80211_local *local);
+void ieee80211_recalc_idle(struct ieee80211_local *local);
 
 /* tx handling */
 void ieee80211_clear_tx_pending(struct ieee80211_local *local);
@@ -995,9 +1031,6 @@ int ieee80211_subif_start_xmit(struct sk_buff *skb, struct net_device *dev);
 void ieee80211_ht_cap_ie_to_sta_ht_cap(struct ieee80211_supported_band *sband,
                                        struct ieee80211_ht_cap *ht_cap_ie,
                                        struct ieee80211_sta_ht_cap *ht_cap);
-u32 ieee80211_enable_ht(struct ieee80211_sub_if_data *sdata,
-                        struct ieee80211_ht_info *hti,
-                        u16 ap_ht_cap_flags);
 void ieee80211_send_bar(struct ieee80211_sub_if_data *sdata, u8 *ra, u16 tid, u16 ssn);
 void ieee80211_send_delba(struct ieee80211_sub_if_data *sdata,
                           const u8 *da, u16 tid,
@@ -1027,24 +1060,23 @@ int __ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
 void ieee80211_process_measurement_req(struct ieee80211_sub_if_data *sdata,
                                        struct ieee80211_mgmt *mgmt,
                                        size_t len);
-void ieee80211_chswitch_timer(unsigned long data);
-void ieee80211_chswitch_work(struct work_struct *work);
-void ieee80211_process_chanswitch(struct ieee80211_sub_if_data *sdata,
-                                  struct ieee80211_channel_sw_ie *sw_elem,
-                                  struct ieee80211_bss *bss);
-void ieee80211_handle_pwr_constr(struct ieee80211_sub_if_data *sdata,
-                                 u16 capab_info, u8 *pwr_constr_elem,
-                                 u8 pwr_constr_elem_len);
-
-/* Suspend/resume */
+
+/* Suspend/resume and hw reconfiguration */
+int ieee80211_reconfig(struct ieee80211_local *local);
+
 #ifdef CONFIG_PM
 int __ieee80211_suspend(struct ieee80211_hw *hw);
-int __ieee80211_resume(struct ieee80211_hw *hw);
+
+static inline int __ieee80211_resume(struct ieee80211_hw *hw)
+{
+        return ieee80211_reconfig(hw_to_local(hw));
+}
 #else
 static inline int __ieee80211_suspend(struct ieee80211_hw *hw)
 {
         return 0;
 }
+
 static inline int __ieee80211_resume(struct ieee80211_hw *hw)
 {
         return 0;
@@ -1053,19 +1085,20 @@ static inline int __ieee80211_resume(struct ieee80211_hw *hw)
 
 /* utility functions/constants */
 extern void *mac80211_wiphy_privid; /* for wiphy privid */
-extern const unsigned char rfc1042_header[6];
-extern const unsigned char bridge_tunnel_header[6];
 u8 *ieee80211_get_bssid(struct ieee80211_hdr *hdr, size_t len,
                         enum nl80211_iftype type);
 int ieee80211_frame_duration(struct ieee80211_local *local, size_t len,
                              int rate, int erp, int short_preamble);
 void mac80211_ev_michael_mic_failure(struct ieee80211_sub_if_data *sdata, int keyidx,
-                                     struct ieee80211_hdr *hdr);
+                                     struct ieee80211_hdr *hdr, const u8 *tsc);
 void ieee80211_set_wmm_default(struct ieee80211_sub_if_data *sdata);
 void ieee80211_tx_skb(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb,
                       int encrypt);
 void ieee802_11_parse_elems(u8 *start, size_t len,
                             struct ieee802_11_elems *elems);
+u32 ieee802_11_parse_elems_crc(u8 *start, size_t len,
+                               struct ieee802_11_elems *elems,
+                               u64 filter, u32 crc);
 int ieee80211_set_freq(struct ieee80211_sub_if_data *sdata, int freq);
 u32 ieee80211_mandatory_rates(struct ieee80211_local *local,
                               enum ieee80211_band band);
@@ -1093,9 +1126,11 @@ void ieee80211_send_auth(struct ieee80211_sub_if_data *sdata,
                          u16 transaction, u16 auth_alg,
                          u8 *extra, size_t extra_len,
                          const u8 *bssid, int encrypt);
+int ieee80211_build_preq_ies(struct ieee80211_local *local, u8 *buffer,
+                             const u8 *ie, size_t ie_len);
 void ieee80211_send_probe_req(struct ieee80211_sub_if_data *sdata, u8 *dst,
-                              u8 *ssid, size_t ssid_len,
-                              u8 *ie, size_t ie_len);
+                              const u8 *ssid, size_t ssid_len,
+                              const u8 *ie, size_t ie_len);
 
 void ieee80211_sta_def_wmm_params(struct ieee80211_sub_if_data *sdata,
                                   const size_t supp_rates_len,
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 91e8e1bacaaa..8c9f1c722cdb 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -20,6 +20,7 @@
 #include "debugfs_netdev.h"
 #include "mesh.h"
 #include "led.h"
+#include "driver-ops.h"
 
 /**
  * DOC: Interface list locking
@@ -164,9 +165,7 @@ static int ieee80211_open(struct net_device *dev)
         }
 
         if (local->open_count == 0) {
-                res = 0;
-                if (local->ops->start)
-                        res = local->ops->start(local_to_hw(local));
+                res = drv_start(local);
                 if (res)
                         goto err_del_bss;
                 /* we're brought up, everything changes */
@@ -199,8 +198,8 @@ static int ieee80211_open(struct net_device *dev)
          * Validate the MAC address for this device.
          */
         if (!is_valid_ether_addr(dev->dev_addr)) {
-                if (!local->open_count && local->ops->stop)
-                        local->ops->stop(local_to_hw(local));
+                if (!local->open_count)
+                        drv_stop(local);
                 return -EADDRNOTAVAIL;
         }
 
@@ -235,17 +234,13 @@ static int ieee80211_open(struct net_device *dev)
                 netif_addr_unlock_bh(local->mdev);
                 break;
         case NL80211_IFTYPE_STATION:
-        case NL80211_IFTYPE_ADHOC:
-                if (sdata->vif.type == NL80211_IFTYPE_STATION)
-                        sdata->u.mgd.flags &= ~IEEE80211_STA_PREV_BSSID_SET;
-                else
-                        sdata->u.ibss.flags &= ~IEEE80211_IBSS_PREV_BSSID_SET;
+                sdata->u.mgd.flags &= ~IEEE80211_STA_PREV_BSSID_SET;
                 /* fall through */
         default:
                 conf.vif = &sdata->vif;
                 conf.type = sdata->vif.type;
                 conf.mac_addr = dev->dev_addr;
-                res = local->ops->add_interface(local_to_hw(local), &conf);
+                res = drv_add_interface(local, &conf);
                 if (res)
                         goto err_stop;
 
@@ -306,6 +301,8 @@ static int ieee80211_open(struct net_device *dev)
         if (sdata->flags & IEEE80211_SDATA_PROMISC)
                 atomic_inc(&local->iff_promiscs);
 
+        hw_reconf_flags |= __ieee80211_recalc_idle(local);
+
         local->open_count++;
         if (hw_reconf_flags) {
                 ieee80211_hw_config(local, hw_reconf_flags);
@@ -317,6 +314,8 @@ static int ieee80211_open(struct net_device *dev)
                 ieee80211_set_wmm_default(sdata);
         }
 
+        ieee80211_recalc_ps(local, -1);
+
         /*
          * ieee80211_sta_work is disabled while network interface
          * is down. Therefore, some configuration changes may not
@@ -325,17 +324,15 @@ static int ieee80211_open(struct net_device *dev)
          */
         if (sdata->vif.type == NL80211_IFTYPE_STATION)
                 queue_work(local->hw.workqueue, &sdata->u.mgd.work);
-        else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
-                queue_work(local->hw.workqueue, &sdata->u.ibss.work);
 
         netif_tx_start_all_queues(dev);
 
         return 0;
  err_del_interface:
-        local->ops->remove_interface(local_to_hw(local), &conf);
+        drv_remove_interface(local, &conf);
  err_stop:
-        if (!local->open_count && local->ops->stop)
-                local->ops->stop(local_to_hw(local));
+        if (!local->open_count)
+                drv_stop(local);
  err_del_bss:
         sdata->bss = NULL;
         if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
@@ -497,7 +494,6 @@ static int ieee80211_stop(struct net_device *dev)
                 /* fall through */
         case NL80211_IFTYPE_ADHOC:
                 if (sdata->vif.type == NL80211_IFTYPE_ADHOC) {
-                        memset(sdata->u.ibss.bssid, 0, ETH_ALEN);
                         del_timer_sync(&sdata->u.ibss.timer);
                         cancel_work_sync(&sdata->u.ibss.work);
                         synchronize_rcu();
@@ -549,17 +545,20 @@ static int ieee80211_stop(struct net_device *dev)
                 conf.mac_addr = dev->dev_addr;
                 /* disable all keys for as long as this netdev is down */
                 ieee80211_disable_keys(sdata);
-                local->ops->remove_interface(local_to_hw(local), &conf);
+                drv_remove_interface(local, &conf);
         }
 
         sdata->bss = NULL;
 
+        hw_reconf_flags |= __ieee80211_recalc_idle(local);
+
+        ieee80211_recalc_ps(local, -1);
+
         if (local->open_count == 0) {
                 if (netif_running(local->mdev))
                         dev_close(local->mdev);
 
-                if (local->ops->stop)
-                        local->ops->stop(local_to_hw(local));
+                drv_stop(local);
 
                 ieee80211_led_radio(local, 0);
 
@@ -649,7 +648,8 @@ static void ieee80211_teardown_sdata(struct net_device *dev)
                         mesh_rmc_free(sdata);
                 break;
         case NL80211_IFTYPE_ADHOC:
-                kfree_skb(sdata->u.ibss.probe_resp);
+                if (WARN_ON(sdata->u.ibss.presp))
+                        kfree_skb(sdata->u.ibss.presp);
                 break;
         case NL80211_IFTYPE_STATION:
                 kfree(sdata->u.mgd.extra_ie);
@@ -896,3 +896,74 @@ void ieee80211_remove_interfaces(struct ieee80211_local *local)
                 unregister_netdevice(sdata->dev);
         }
 }
+
+static u32 ieee80211_idle_off(struct ieee80211_local *local,
+                              const char *reason)
+{
+        if (!(local->hw.conf.flags & IEEE80211_CONF_IDLE))
+                return 0;
+
+#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
+        printk(KERN_DEBUG "%s: device no longer idle - %s\n",
+               wiphy_name(local->hw.wiphy), reason);
+#endif
+
+        local->hw.conf.flags &= ~IEEE80211_CONF_IDLE;
+        return IEEE80211_CONF_CHANGE_IDLE;
+}
+
+static u32 ieee80211_idle_on(struct ieee80211_local *local)
+{
+        if (local->hw.conf.flags & IEEE80211_CONF_IDLE)
+                return 0;
+
+#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
+        printk(KERN_DEBUG "%s: device now idle\n",
+               wiphy_name(local->hw.wiphy));
+#endif
+
+        local->hw.conf.flags |= IEEE80211_CONF_IDLE;
+        return IEEE80211_CONF_CHANGE_IDLE;
+}
+
+u32 __ieee80211_recalc_idle(struct ieee80211_local *local)
+{
+        struct ieee80211_sub_if_data *sdata;
+        int count = 0;
+
+        if (local->hw_scanning || local->sw_scanning)
+                return ieee80211_idle_off(local, "scanning");
+
+        list_for_each_entry(sdata, &local->interfaces, list) {
+                if (!netif_running(sdata->dev))
+                        continue;
+                /* do not count disabled managed interfaces */
+                if (sdata->vif.type == NL80211_IFTYPE_STATION &&
+                    sdata->u.mgd.state == IEEE80211_STA_MLME_DISABLED)
+                        continue;
+                /* do not count unused IBSS interfaces */
+                if (sdata->vif.type == NL80211_IFTYPE_ADHOC &&
+                    !sdata->u.ibss.ssid_len)
+                        continue;
+                /* count everything else */
+                count++;
+        }
+
+        if (!count)
+                return ieee80211_idle_on(local);
+        else
+                return ieee80211_idle_off(local, "in use");
+
+        return 0;
+}
+
+void ieee80211_recalc_idle(struct ieee80211_local *local)
+{
+        u32 chg;
+
+        mutex_lock(&local->iflist_mtx);
+        chg = __ieee80211_recalc_idle(local);
+        mutex_unlock(&local->iflist_mtx);
+        if (chg)
+                ieee80211_hw_config(local, chg);
+}
diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index 687acf23054d..ce267565e180 100644
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -16,6 +16,7 @@
 #include <linux/rtnetlink.h>
 #include <net/mac80211.h>
 #include "ieee80211_i.h"
+#include "driver-ops.h"
 #include "debugfs_key.h"
 #include "aes_ccm.h"
 #include "aes_cmac.h"
@@ -136,8 +137,7 @@ static void ieee80211_key_enable_hw_accel(struct ieee80211_key *key)
                                      struct ieee80211_sub_if_data,
                                      u.ap);
 
-        ret = key->local->ops->set_key(local_to_hw(key->local), SET_KEY,
-                                       &sdata->vif, sta, &key->conf);
+        ret = drv_set_key(key->local, SET_KEY, &sdata->vif, sta, &key->conf);
 
         if (!ret) {
                 spin_lock(&todo_lock);
@@ -179,8 +179,8 @@ static void ieee80211_key_disable_hw_accel(struct ieee80211_key *key)
                                      struct ieee80211_sub_if_data,
                                      u.ap);
 
-        ret = key->local->ops->set_key(local_to_hw(key->local), DISABLE_KEY,
-                                       &sdata->vif, sta, &key->conf);
+        ret = drv_set_key(key->local, DISABLE_KEY, &sdata->vif,
+                          sta, &key->conf);
 
         if (ret)
                 printk(KERN_ERR "mac80211-%s: failed to remove key "
@@ -290,9 +290,11 @@ static void __ieee80211_key_replace(struct ieee80211_sub_if_data *sdata,
 struct ieee80211_key *ieee80211_key_alloc(enum ieee80211_key_alg alg,
                                           int idx,
                                           size_t key_len,
-                                          const u8 *key_data)
+                                          const u8 *key_data,
+                                          size_t seq_len, const u8 *seq)
 {
         struct ieee80211_key *key;
+        int i, j;
 
         BUG_ON(idx < 0 || idx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS);
 
@@ -318,14 +320,31 @@ struct ieee80211_key *ieee80211_key_alloc(enum ieee80211_key_alg alg,
         case ALG_TKIP:
                 key->conf.iv_len = TKIP_IV_LEN;
                 key->conf.icv_len = TKIP_ICV_LEN;
+                if (seq) {
+                        for (i = 0; i < NUM_RX_DATA_QUEUES; i++) {
+                                key->u.tkip.rx[i].iv32 =
+                                        get_unaligned_le32(&seq[2]);
+                                key->u.tkip.rx[i].iv16 =
+                                        get_unaligned_le16(seq);
+                        }
+                }
                 break;
         case ALG_CCMP:
                 key->conf.iv_len = CCMP_HDR_LEN;
                 key->conf.icv_len = CCMP_MIC_LEN;
+                if (seq) {
+                        for (i = 0; i < NUM_RX_DATA_QUEUES; i++)
+                                for (j = 0; j < CCMP_PN_LEN; j++)
+                                        key->u.ccmp.rx_pn[i][j] =
+                                                seq[CCMP_PN_LEN - j - 1];
+                }
                 break;
         case ALG_AES_CMAC:
                 key->conf.iv_len = 0;
                 key->conf.icv_len = sizeof(struct ieee80211_mmie);
+                if (seq)
+                        for (j = 0; j < 6; j++)
+                                key->u.aes_cmac.rx_pn[j] = seq[6 - j - 1];
                 break;
         }
         memcpy(key->conf.key, key_data, key_len);
diff --git a/net/mac80211/key.h b/net/mac80211/key.h
index 215d3ef42a4f..9572e00f532c 100644
--- a/net/mac80211/key.h
+++ b/net/mac80211/key.h
@@ -144,7 +144,8 @@ struct ieee80211_key {
 struct ieee80211_key *ieee80211_key_alloc(enum ieee80211_key_alg alg,
                                           int idx,
                                           size_t key_len,
-                                          const u8 *key_data);
+                                          const u8 *key_data,
+                                          size_t seq_len, const u8 *seq);
 /*
  * Insert a key into data structures (sdata, sta if necessary)
  * to make it used, free old key.
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 14134193cd17..e37770ced53c 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -21,10 +21,12 @@
 #include <linux/wireless.h>
 #include <linux/rtnetlink.h>
 #include <linux/bitmap.h>
+#include <linux/pm_qos_params.h>
 #include <net/net_namespace.h>
 #include <net/cfg80211.h>
 
 #include "ieee80211_i.h"
+#include "driver-ops.h"
 #include "rate.h"
 #include "mesh.h"
 #include "wep.h"
@@ -80,10 +82,9 @@ void ieee80211_configure_filter(struct ieee80211_local *local)
         /* be a bit nasty */
         new_flags |= (1<<31);
 
-        local->ops->configure_filter(local_to_hw(local),
-                                     changed_flags, &new_flags,
-                                     local->mdev->mc_count,
-                                     local->mdev->mc_list);
+        drv_configure_filter(local, changed_flags, &new_flags,
+                             local->mdev->mc_count,
+                             local->mdev->mc_list);
 
         WARN_ON(new_flags & (1<<31));
 
@@ -151,93 +152,19 @@ static void ieee80211_master_set_multicast_list(struct net_device *dev)
         ieee80211_configure_filter(local);
 }
 
-/* everything else */
-
-int ieee80211_if_config(struct ieee80211_sub_if_data *sdata, u32 changed)
-{
-        struct ieee80211_local *local = sdata->local;
-        struct ieee80211_if_conf conf;
-
-        if (WARN_ON(!netif_running(sdata->dev)))
-                return 0;
-
-        memset(&conf, 0, sizeof(conf));
-
-        if (sdata->vif.type == NL80211_IFTYPE_STATION)
-                conf.bssid = sdata->u.mgd.bssid;
-        else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
-                conf.bssid = sdata->u.ibss.bssid;
-        else if (sdata->vif.type == NL80211_IFTYPE_AP)
-                conf.bssid = sdata->dev->dev_addr;
-        else if (ieee80211_vif_is_mesh(&sdata->vif)) {
-                static const u8 zero[ETH_ALEN] = { 0 };
-                conf.bssid = zero;
-        } else {
-                WARN_ON(1);
-                return -EINVAL;
-        }
-
-        if (!local->ops->config_interface)
-                return 0;
-
-        switch (sdata->vif.type) {
-        case NL80211_IFTYPE_AP:
-        case NL80211_IFTYPE_ADHOC:
-        case NL80211_IFTYPE_MESH_POINT:
-                break;
-        default:
-                /* do not warn to simplify caller in scan.c */
-                changed &= ~IEEE80211_IFCC_BEACON_ENABLED;
-                if (WARN_ON(changed & IEEE80211_IFCC_BEACON))
-                        return -EINVAL;
-                changed &= ~IEEE80211_IFCC_BEACON;
-                break;
-        }
-
-        if (changed & IEEE80211_IFCC_BEACON_ENABLED) {
-                if (local->sw_scanning) {
-                        conf.enable_beacon = false;
-                } else {
-                        /*
-                         * Beacon should be enabled, but AP mode must
-                         * check whether there is a beacon configured.
-                         */
-                        switch (sdata->vif.type) {
-                        case NL80211_IFTYPE_AP:
-                                conf.enable_beacon =
-                                        !!rcu_dereference(sdata->u.ap.beacon);
-                                break;
-                        case NL80211_IFTYPE_ADHOC:
-                                conf.enable_beacon = !!sdata->u.ibss.probe_resp;
-                                break;
-                        case NL80211_IFTYPE_MESH_POINT:
-                                conf.enable_beacon = true;
-                                break;
-                        default:
-                                /* not reached */
-                                WARN_ON(1);
-                                break;
-                        }
-                }
-        }
-
-        conf.changed = changed;
-
-        return local->ops->config_interface(local_to_hw(local),
-                                            &sdata->vif, &conf);
-}
-
 int ieee80211_hw_config(struct ieee80211_local *local, u32 changed)
 {
-        struct ieee80211_channel *chan;
+        struct ieee80211_channel *chan, *scan_chan;
         int ret = 0;
         int power;
         enum nl80211_channel_type channel_type;
 
         might_sleep();
 
-        if (local->sw_scanning) {
-                chan = local->scan_channel;
+        scan_chan = local->scan_channel;
+
+        if (scan_chan) {
+                chan = scan_chan;
                 channel_type = NL80211_CHAN_NO_HT;
         } else {
                 chan = local->oper_channel;
@@ -251,7 +178,7 @@ int ieee80211_hw_config(struct ieee80211_local *local, u32 changed)
                 changed |= IEEE80211_CONF_CHANGE_CHANNEL;
         }
 
-        if (local->sw_scanning)
+        if (scan_chan)
                 power = chan->max_power;
         else
                 power = local->power_constr_level ?
@@ -267,7 +194,7 @@ int ieee80211_hw_config(struct ieee80211_local *local, u32 changed)
         }
 
         if (changed && local->open_count) {
-                ret = local->ops->config(local_to_hw(local), changed);
+                ret = drv_config(local, changed);
                 /*
                  * Goal:
                  * HW reconfiguration should never fail, the driver has told
@@ -292,18 +219,86 @@ void ieee80211_bss_info_change_notify(struct ieee80211_sub_if_data *sdata,
                                       u32 changed)
 {
         struct ieee80211_local *local = sdata->local;
+        static const u8 zero[ETH_ALEN] = { 0 };
 
-        if (WARN_ON(sdata->vif.type == NL80211_IFTYPE_AP_VLAN))
+        if (!changed)
                 return;
 
-        if (!changed)
+        if (sdata->vif.type == NL80211_IFTYPE_STATION) {
+                /*
+                 * While not associated, claim a BSSID of all-zeroes
+                 * so that drivers don't do any weird things with the
+                 * BSSID at that time.
+                 */
+                if (sdata->vif.bss_conf.assoc)
+                        sdata->vif.bss_conf.bssid = sdata->u.mgd.bssid;
+                else
+                        sdata->vif.bss_conf.bssid = zero;
+        } else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
+                sdata->vif.bss_conf.bssid = sdata->u.ibss.bssid;
+        else if (sdata->vif.type == NL80211_IFTYPE_AP)
+                sdata->vif.bss_conf.bssid = sdata->dev->dev_addr;
+        else if (ieee80211_vif_is_mesh(&sdata->vif)) {
+                sdata->vif.bss_conf.bssid = zero;
+        } else {
+                WARN_ON(1);
                 return;
+        }
+
+        switch (sdata->vif.type) {
+        case NL80211_IFTYPE_AP:
+        case NL80211_IFTYPE_ADHOC:
+        case NL80211_IFTYPE_MESH_POINT:
+                break;
+        default:
+                /* do not warn to simplify caller in scan.c */
+                changed &= ~BSS_CHANGED_BEACON_ENABLED;
+                if (WARN_ON(changed & BSS_CHANGED_BEACON))
+                        return;
+                break;
+        }
+
+        if (changed & BSS_CHANGED_BEACON_ENABLED) {
+                if (local->sw_scanning) {
+                        sdata->vif.bss_conf.enable_beacon = false;
+                } else {
+                        /*
+                         * Beacon should be enabled, but AP mode must
+                         * check whether there is a beacon configured.
+                         */
+                        switch (sdata->vif.type) {
+                        case NL80211_IFTYPE_AP:
+                                sdata->vif.bss_conf.enable_beacon =
+                                        !!rcu_dereference(sdata->u.ap.beacon);
+                                break;
+                        case NL80211_IFTYPE_ADHOC:
+                                sdata->vif.bss_conf.enable_beacon =
+                                        !!rcu_dereference(sdata->u.ibss.presp);
+                                break;
+                        case NL80211_IFTYPE_MESH_POINT:
+                                sdata->vif.bss_conf.enable_beacon = true;
+                                break;
+                        default:
+                                /* not reached */
+                                WARN_ON(1);
+                                break;
+                        }
+                }
+        }
+
+        drv_bss_info_changed(local, &sdata->vif,
+                             &sdata->vif.bss_conf, changed);
 
-        if (local->ops->bss_info_changed)
-                local->ops->bss_info_changed(local_to_hw(local),
-                                             &sdata->vif,
-                                             &sdata->vif.bss_conf,
-                                             changed);
+        /*
+         * DEPRECATED
+         *
+         * ~changed is just there to not do this at resume time
+         */
+        if (changed & BSS_CHANGED_BEACON_INT && ~changed) {
+                local->hw.conf.beacon_int = sdata->vif.bss_conf.beacon_int;
+                ieee80211_hw_config(local,
+                                    _IEEE80211_CONF_CHANGE_BEACON_INTERVAL);
+        }
 }
 
 u32 ieee80211_reset_erp_info(struct ieee80211_sub_if_data *sdata)
@@ -696,6 +691,28 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
 }
 EXPORT_SYMBOL(ieee80211_tx_status);
 
+static void ieee80211_restart_work(struct work_struct *work)
+{
+        struct ieee80211_local *local =
+                container_of(work, struct ieee80211_local, restart_work);
+
+        rtnl_lock();
+        ieee80211_reconfig(local);
+        rtnl_unlock();
+}
+
+void ieee80211_restart_hw(struct ieee80211_hw *hw)
+{
+        struct ieee80211_local *local = hw_to_local(hw);
+
+        /* use this reason, __ieee80211_resume will unblock it */
+        ieee80211_stop_queues_by_reason(hw,
+                IEEE80211_QUEUE_STOP_REASON_SUSPEND);
+
+        schedule_work(&local->restart_work);
+}
+EXPORT_SYMBOL(ieee80211_restart_hw);
+
 struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
                                         const struct ieee80211_ops *ops)
 {
@@ -718,9 +735,7 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
          * +-------------------------+
          *
          */
-        priv_size = ((sizeof(struct ieee80211_local) +
-                      NETDEV_ALIGN_CONST) & ~NETDEV_ALIGN_CONST) +
-                    priv_data_len;
+        priv_size = ALIGN(sizeof(*local), NETDEV_ALIGN) + priv_data_len;
 
         wiphy = wiphy_new(&mac80211_config_ops, priv_size);
 
@@ -728,17 +743,16 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
                 return NULL;
 
         wiphy->privid = mac80211_wiphy_privid;
-        wiphy->max_scan_ssids = 4;
+
         /* Yes, putting cfg80211_bss into ieee80211_bss is a hack */
         wiphy->bss_priv_size = sizeof(struct ieee80211_bss) -
                                sizeof(struct cfg80211_bss);
 
         local = wiphy_priv(wiphy);
+
         local->hw.wiphy = wiphy;
 
-        local->hw.priv = (char *)local +
-                         ((sizeof(struct ieee80211_local) +
-                           NETDEV_ALIGN_CONST) & ~NETDEV_ALIGN_CONST);
+        local->hw.priv = (char *)local + ALIGN(sizeof(*local), NETDEV_ALIGN);
 
         BUG_ON(!ops->tx);
         BUG_ON(!ops->start);
@@ -752,15 +766,14 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
         /* set up some defaults */
         local->hw.queues = 1;
         local->hw.max_rates = 1;
-        local->rts_threshold = IEEE80211_MAX_RTS_THRESHOLD;
-        local->fragmentation_threshold = IEEE80211_MAX_FRAG_THRESHOLD;
-        local->hw.conf.long_frame_max_tx_count = 4;
-        local->hw.conf.short_frame_max_tx_count = 7;
+        local->hw.conf.long_frame_max_tx_count = wiphy->retry_long;
+        local->hw.conf.short_frame_max_tx_count = wiphy->retry_short;
         local->hw.conf.radio_enabled = true;
         local->user_power_level = -1;
 
         INIT_LIST_HEAD(&local->interfaces);
         mutex_init(&local->iflist_mtx);
+        mutex_init(&local->scan_mtx);
 
         spin_lock_init(&local->key_lock);
 
@@ -768,6 +781,8 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
 
         INIT_DELAYED_WORK(&local->scan_work, ieee80211_scan_work);
 
+        INIT_WORK(&local->restart_work, ieee80211_restart_work);
+
         INIT_WORK(&local->dynamic_ps_enable_work,
                   ieee80211_dynamic_ps_enable_work);
         INIT_WORK(&local->dynamic_ps_disable_work,
@@ -821,7 +836,17 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
         enum ieee80211_band band;
         struct net_device *mdev;
         struct ieee80211_master_priv *mpriv;
-        int channels, i, j;
+        int channels, i, j, max_bitrates;
+        bool supp_ht;
+        static const u32 cipher_suites[] = {
+                WLAN_CIPHER_SUITE_WEP40,
+                WLAN_CIPHER_SUITE_WEP104,
+                WLAN_CIPHER_SUITE_TKIP,
+                WLAN_CIPHER_SUITE_CCMP,
+
+                /* keep last -- depends on hw flags! */
+                WLAN_CIPHER_SUITE_AES_CMAC
+        };
 
         /*
          * generic code guarantees at least one band,
@@ -829,18 +854,25 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
          * that hw.conf.channel is assigned
          */
         channels = 0;
+        max_bitrates = 0;
+        supp_ht = false;
         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
                 struct ieee80211_supported_band *sband;
 
                 sband = local->hw.wiphy->bands[band];
-                if (sband && !local->oper_channel) {
+                if (!sband)
+                        continue;
+                if (!local->oper_channel) {
                         /* init channel we're on */
                         local->hw.conf.channel =
-                        local->oper_channel =
-                        local->scan_channel = &sband->channels[0];
+                        local->oper_channel = &sband->channels[0];
+                        local->hw.conf.channel_type = NL80211_CHAN_NO_HT;
                 }
-                if (sband)
-                        channels += sband->n_channels;
+                channels += sband->n_channels;
+
+                if (max_bitrates < sband->n_bitrates)
+                        max_bitrates = sband->n_bitrates;
+                supp_ht = supp_ht || sband->ht_cap.ht_supported;
         }
 
         local->int_scan_req.n_channels = channels;
@@ -860,6 +892,37 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
         else if (local->hw.flags & IEEE80211_HW_SIGNAL_UNSPEC)
                 local->hw.wiphy->signal_type = CFG80211_SIGNAL_TYPE_UNSPEC;
 
+        /*
+         * Calculate scan IE length -- we need this to alloc
+         * memory and to subtract from the driver limit. It
+         * includes the (extended) supported rates and HT
+         * information -- SSID is the driver's responsibility.
+         */
+        local->scan_ies_len = 4 + max_bitrates; /* (ext) supp rates */
+        if (supp_ht)
+                local->scan_ies_len += 2 + sizeof(struct ieee80211_ht_cap);
+
+        if (!local->ops->hw_scan) {
+                /* For hw_scan, driver needs to set these up. */
+                local->hw.wiphy->max_scan_ssids = 4;
+                local->hw.wiphy->max_scan_ie_len = IEEE80211_MAX_DATA_LEN;
+        }
+
+        /*
+         * If the driver supports any scan IEs, then assume the
+         * limit includes the IEs mac80211 will add, otherwise
+         * leave it at zero and let the driver sort it out; we
+         * still pass our IEs to the driver but userspace will
+         * not be allowed to in that case.
+         */
+        if (local->hw.wiphy->max_scan_ie_len)
+                local->hw.wiphy->max_scan_ie_len -= local->scan_ies_len;
+
+        local->hw.wiphy->cipher_suites = cipher_suites;
+        local->hw.wiphy->n_cipher_suites = ARRAY_SIZE(cipher_suites);
+        if (!(local->hw.flags & IEEE80211_HW_MFP_CAPABLE))
+                local->hw.wiphy->n_cipher_suites--;
+
         result = wiphy_register(local->hw.wiphy);
         if (result < 0)
                 goto fail_wiphy_register;
@@ -898,9 +961,6 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
 
         debugfs_hw_add(local);
 
-        if (local->hw.conf.beacon_int < 10)
-                local->hw.conf.beacon_int = 100;
-
         if (local->hw.max_listen_interval == 0)
                 local->hw.max_listen_interval = 1;
 
@@ -965,25 +1025,38 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
                 }
         }
 
+        local->network_latency_notifier.notifier_call =
+                ieee80211_max_network_latency;
+        result = pm_qos_add_notifier(PM_QOS_NETWORK_LATENCY,
+                                     &local->network_latency_notifier);
+
+        if (result) {
+                rtnl_lock();
+                goto fail_pm_qos;
+        }
+
         return 0;
 
-fail_rate:
+ fail_pm_qos:
+        ieee80211_led_exit(local);
+        ieee80211_remove_interfaces(local);
+ fail_rate:
         unregister_netdevice(local->mdev);
         local->mdev = NULL;
-fail_dev:
+ fail_dev:
         rtnl_unlock();
         ieee80211_wep_free(local);
-fail_wep:
+ fail_wep:
         sta_info_stop(local);
-fail_sta_info:
+ fail_sta_info:
         debugfs_hw_del(local);
         destroy_workqueue(local->hw.workqueue);
-fail_workqueue:
+ fail_workqueue:
         if (local->mdev)
                 free_netdev(local->mdev);
-fail_mdev_alloc:
+ fail_mdev_alloc:
         wiphy_unregister(local->hw.wiphy);
-fail_wiphy_register:
+ fail_wiphy_register:
         kfree(local->int_scan_req.channels);
         return result;
 }
@@ -996,6 +1069,9 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw)
         tasklet_kill(&local->tx_pending_tasklet);
         tasklet_kill(&local->tasklet);
 
+        pm_qos_remove_notifier(PM_QOS_NETWORK_LATENCY,
+                               &local->network_latency_notifier);
+
         rtnl_lock();
 
         /*
@@ -1038,6 +1114,7 @@ void ieee80211_free_hw(struct ieee80211_hw *hw)
         struct ieee80211_local *local = hw_to_local(hw);
 
         mutex_destroy(&local->iflist_mtx);
+        mutex_destroy(&local->scan_mtx);
 
         wiphy_free(local->hw.wiphy);
 }
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index 9a3e5de0410a..fc712e60705d 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -21,6 +21,9 @@
 #define CAPAB_OFFSET 17
 #define ACCEPT_PLINKS 0x80
 
+#define TMR_RUNNING_HK  0
+#define TMR_RUNNING_MP  1
+
 int mesh_allocated;
 static struct kmem_cache *rm_cache;
 
@@ -45,6 +48,12 @@ static void ieee80211_mesh_housekeeping_timer(unsigned long data)
         struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
 
         ifmsh->housekeeping = true;
+
+        if (local->quiescing) {
+                set_bit(TMR_RUNNING_HK, &ifmsh->timers_running);
+                return;
+        }
+
         queue_work(local->hw.workqueue, &ifmsh->work);
 }
 
@@ -343,6 +352,11 @@ static void ieee80211_mesh_path_timer(unsigned long data)
         struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
         struct ieee80211_local *local = sdata->local;
 
+        if (local->quiescing) {
+                set_bit(TMR_RUNNING_MP, &ifmsh->timers_running);
+                return;
+        }
+
         queue_work(local->hw.workqueue, &ifmsh->work);
 }
 
@@ -417,13 +431,39 @@ static void ieee80211_mesh_housekeeping(struct ieee80211_sub_if_data *sdata,
 
         free_plinks = mesh_plink_availables(sdata);
         if (free_plinks != sdata->u.mesh.accepting_plinks)
-                ieee80211_if_config(sdata, IEEE80211_IFCC_BEACON);
+                ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON);
 
         ifmsh->housekeeping = false;
         mod_timer(&ifmsh->housekeeping_timer,
                   round_jiffies(jiffies + IEEE80211_MESH_HOUSEKEEPING_INTERVAL));
 }
 
+#ifdef CONFIG_PM
+void ieee80211_mesh_quiesce(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
+
+        /* might restart the timer but that doesn't matter */
+        cancel_work_sync(&ifmsh->work);
+
+        /* use atomic bitops in case both timers fire at the same time */
+
+        if (del_timer_sync(&ifmsh->housekeeping_timer))
+                set_bit(TMR_RUNNING_HK, &ifmsh->timers_running);
+        if (del_timer_sync(&ifmsh->mesh_path_timer))
+                set_bit(TMR_RUNNING_MP, &ifmsh->timers_running);
+}
+
+void ieee80211_mesh_restart(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
+
+        if (test_and_clear_bit(TMR_RUNNING_HK, &ifmsh->timers_running))
+                add_timer(&ifmsh->housekeeping_timer);
+        if (test_and_clear_bit(TMR_RUNNING_MP, &ifmsh->timers_running))
+                add_timer(&ifmsh->mesh_path_timer);
+}
+#endif
 
 void ieee80211_start_mesh(struct ieee80211_sub_if_data *sdata)
 {
@@ -432,8 +472,8 @@ void ieee80211_start_mesh(struct ieee80211_sub_if_data *sdata)
 
         ifmsh->housekeeping = true;
         queue_work(local->hw.workqueue, &ifmsh->work);
-        ieee80211_if_config(sdata, IEEE80211_IFCC_BEACON |
-                                   IEEE80211_IFCC_BEACON_ENABLED);
+        ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON |
+                                                BSS_CHANGED_BEACON_ENABLED);
 }
 
 void ieee80211_stop_mesh(struct ieee80211_sub_if_data *sdata)
diff --git a/net/mac80211/mesh.h b/net/mac80211/mesh.h
index d891d7ddccd7..c7d72819cdd2 100644
--- a/net/mac80211/mesh.h
+++ b/net/mac80211/mesh.h
@@ -191,12 +191,8 @@ struct mesh_rmc {
 #define PLINK_CATEGORY          30
 #define MESH_PATH_SEL_CATEGORY  32
 
-/* Mesh Header Flags */
-#define IEEE80211S_FLAGS_AE     0x3
-
 /* Public interfaces */
 /* Various */
-int ieee80211_get_mesh_hdrlen(struct ieee80211s_hdr *meshhdr);
 int ieee80211_new_mesh_header(struct ieee80211s_hdr *meshhdr,
                 struct ieee80211_sub_if_data *sdata);
 int mesh_rmc_check(u8 *addr, struct ieee80211s_hdr *mesh_hdr,
@@ -267,6 +263,8 @@ void mesh_path_timer(unsigned long data);
 void mesh_path_flush_by_nexthop(struct sta_info *sta);
 void mesh_path_discard_frame(struct sk_buff *skb,
                 struct ieee80211_sub_if_data *sdata);
+void mesh_path_quiesce(struct ieee80211_sub_if_data *sdata);
+void mesh_path_restart(struct ieee80211_sub_if_data *sdata);
 
 #ifdef CONFIG_MAC80211_MESH
 extern int mesh_allocated;
@@ -294,10 +292,20 @@ static inline void mesh_path_activate(struct mesh_path *mpath)
 
 void ieee80211_mesh_notify_scan_completed(struct ieee80211_local *local);
 
+void ieee80211_mesh_quiesce(struct ieee80211_sub_if_data *sdata);
+void ieee80211_mesh_restart(struct ieee80211_sub_if_data *sdata);
+void mesh_plink_quiesce(struct sta_info *sta);
+void mesh_plink_restart(struct sta_info *sta);
 #else
 #define mesh_allocated  0
 static inline void
 ieee80211_mesh_notify_scan_completed(struct ieee80211_local *local) {}
+static inline void ieee80211_mesh_quiesce(struct ieee80211_sub_if_data *sdata)
+{}
+static inline void ieee80211_mesh_restart(struct ieee80211_sub_if_data *sdata)
+{}
+static inline void mesh_plink_quiesce(struct sta_info *sta) {}
+static inline void mesh_plink_restart(struct sta_info *sta) {}
 #endif
 
 #endif /* IEEE80211S_H */
diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
index 60b35accda91..003cb470ac84 100644
--- a/net/mac80211/mesh_hwmp.c
+++ b/net/mac80211/mesh_hwmp.c
@@ -836,8 +836,14 @@ void mesh_path_timer(unsigned long data)
         mpath = rcu_dereference(mpath);
         if (!mpath)
                 goto endmpathtimer;
-        spin_lock_bh(&mpath->state_lock);
         sdata = mpath->sdata;
+
+        if (sdata->local->quiescing) {
+                rcu_read_unlock();
+                return;
+        }
+
+        spin_lock_bh(&mpath->state_lock);
         if (mpath->flags & MESH_PATH_RESOLVED ||
                         (!(mpath->flags & MESH_PATH_RESOLVING)))
                 mpath->flags &= ~(MESH_PATH_RESOLVING | MESH_PATH_RESOLVED);
diff --git a/net/mac80211/mesh_plink.c b/net/mac80211/mesh_plink.c
index a8bbdeca013a..cb14253587f1 100644
--- a/net/mac80211/mesh_plink.c
+++ b/net/mac80211/mesh_plink.c
@@ -266,6 +266,11 @@ static void mesh_plink_timer(unsigned long data)
          */
         sta = (struct sta_info *) data;
 
+        if (sta->sdata->local->quiescing) {
+                sta->plink_timer_was_running = true;
+                return;
+        }
+
         spin_lock_bh(&sta->lock);
         if (sta->ignore_plink_timer) {
                 sta->ignore_plink_timer = false;
@@ -322,6 +327,22 @@ static void mesh_plink_timer(unsigned long data)
         }
 }
 
+#ifdef CONFIG_PM
+void mesh_plink_quiesce(struct sta_info *sta)
+{
+        if (del_timer_sync(&sta->plink_timer))
+                sta->plink_timer_was_running = true;
+}
+
+void mesh_plink_restart(struct sta_info *sta)
+{
+        if (sta->plink_timer_was_running) {
+                add_timer(&sta->plink_timer);
+                sta->plink_timer_was_running = false;
+        }
+}
+#endif
+
 static inline void mesh_plink_timer_set(struct sta_info *sta, int timeout)
 {
         sta->plink_timer.expires = jiffies + (HZ * timeout / 1000);
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 132938b073dc..509469cb9265 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -17,10 +17,13 @@
 #include <linux/if_arp.h>
 #include <linux/etherdevice.h>
 #include <linux/rtnetlink.h>
+#include <linux/pm_qos_params.h>
+#include <linux/crc32.h>
 #include <net/mac80211.h>
 #include <asm/unaligned.h>
 
 #include "ieee80211_i.h"
+#include "driver-ops.h"
 #include "rate.h"
 #include "led.h"
 
@@ -30,9 +33,13 @@
 #define IEEE80211_ASSOC_TIMEOUT (HZ / 5)
 #define IEEE80211_ASSOC_MAX_TRIES 3
 #define IEEE80211_MONITORING_INTERVAL (2 * HZ)
+#define IEEE80211_PROBE_WAIT (HZ / 5)
 #define IEEE80211_PROBE_IDLE_TIME (60 * HZ)
 #define IEEE80211_RETRY_AUTH_INTERVAL (1 * HZ)
 
+#define TMR_RUNNING_TIMER       0
+#define TMR_RUNNING_CHANSW      1
+
 /* utils */
 static int ecw2cw(int ecw)
 {
@@ -80,6 +87,92 @@ static int ieee80211_compatible_rates(struct ieee80211_bss *bss,
         return count;
 }
 
+/*
+ * ieee80211_enable_ht should be called only after the operating band
+ * has been determined as ht configuration depends on the hw's
+ * HT abilities for a specific band.
+ */
+static u32 ieee80211_enable_ht(struct ieee80211_sub_if_data *sdata,
+                               struct ieee80211_ht_info *hti,
+                               u16 ap_ht_cap_flags)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_supported_band *sband;
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+        struct sta_info *sta;
+        u32 changed = 0;
+        u16 ht_opmode;
+        bool enable_ht = true, ht_changed;
+        enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
+
+        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
+
+        /* HT is not supported */
+        if (!sband->ht_cap.ht_supported)
+                enable_ht = false;
+
+        /* check that channel matches the right operating channel */
+        if (local->hw.conf.channel->center_freq !=
+            ieee80211_channel_to_frequency(hti->control_chan))
+                enable_ht = false;
+
+        if (enable_ht) {
+                channel_type = NL80211_CHAN_HT20;
+
+                if (!(ap_ht_cap_flags & IEEE80211_HT_CAP_40MHZ_INTOLERANT) &&
+                    (sband->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) &&
+                    (hti->ht_param & IEEE80211_HT_PARAM_CHAN_WIDTH_ANY)) {
+                        switch(hti->ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
+                        case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
+                                if (!(local->hw.conf.channel->flags &
+                                    IEEE80211_CHAN_NO_HT40PLUS))
+                                        channel_type = NL80211_CHAN_HT40PLUS;
+                                break;
+                        case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
+                                if (!(local->hw.conf.channel->flags &
+                                    IEEE80211_CHAN_NO_HT40MINUS))
+                                        channel_type = NL80211_CHAN_HT40MINUS;
+                                break;
+                        }
+                }
+        }
+
+        ht_changed = conf_is_ht(&local->hw.conf) != enable_ht ||
+                     channel_type != local->hw.conf.channel_type;
+
+        local->oper_channel_type = channel_type;
+
+        if (ht_changed) {
+                /* channel_type change automatically detected */
+                ieee80211_hw_config(local, 0);
+
+                rcu_read_lock();
+
+                sta = sta_info_get(local, ifmgd->bssid);
+                if (sta)
+                        rate_control_rate_update(local, sband, sta,
+                                                 IEEE80211_RC_HT_CHANGED);
+
+                rcu_read_unlock();
+        }
+
+        /* disable HT */
+        if (!enable_ht)
+                return 0;
+
+        ht_opmode = le16_to_cpu(hti->operation_mode);
+
+        /* if bss configuration changed store the new one */
+        if (!sdata->ht_opmode_valid ||
+            sdata->vif.bss_conf.ht_operation_mode != ht_opmode) {
+                changed |= BSS_CHANGED_HT;
+                sdata->vif.bss_conf.ht_operation_mode = ht_opmode;
+                sdata->ht_opmode_valid = true;
+        }
+
+        return changed;
+}
+
 /* frame sending functions */
 
 static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
@@ -263,13 +356,13 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
 
                 switch (ht_info->ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
                 case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
-                        if (flags & IEEE80211_CHAN_NO_FAT_ABOVE) {
+                        if (flags & IEEE80211_CHAN_NO_HT40PLUS) {
                                 cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
                                 cap &= ~IEEE80211_HT_CAP_SGI_40;
                         }
                         break;
                 case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
-                        if (flags & IEEE80211_CHAN_NO_FAT_BELOW) {
+                        if (flags & IEEE80211_CHAN_NO_HT40MINUS) {
                                 cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
                                 cap &= ~IEEE80211_HT_CAP_SGI_40;
                         }
@@ -325,6 +418,10 @@ static void ieee80211_send_deauth_disassoc(struct ieee80211_sub_if_data *sdata,
         /* u.deauth.reason_code == u.disassoc.reason_code */
         mgmt->u.deauth.reason_code = cpu_to_le16(reason);
 
+        if (stype == IEEE80211_STYPE_DEAUTH)
+                cfg80211_send_deauth(sdata->dev, (u8 *) mgmt, skb->len);
+        else
+                cfg80211_send_disassoc(sdata->dev, (u8 *) mgmt, skb->len);
         ieee80211_tx_skb(sdata, skb, ifmgd->flags & IEEE80211_STA_MFP_ENABLED);
 }
 
@@ -359,6 +456,278 @@ void ieee80211_send_pspoll(struct ieee80211_local *local,
         ieee80211_tx_skb(sdata, skb, 0);
 }
 
+void ieee80211_send_nullfunc(struct ieee80211_local *local,
+                             struct ieee80211_sub_if_data *sdata,
+                             int powersave)
+{
+        struct sk_buff *skb;
+        struct ieee80211_hdr *nullfunc;
+        __le16 fc;
+
+        if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
+                return;
+
+        skb = dev_alloc_skb(local->hw.extra_tx_headroom + 24);
+        if (!skb) {
+                printk(KERN_DEBUG "%s: failed to allocate buffer for nullfunc "
+                       "frame\n", sdata->dev->name);
+                return;
+        }
+        skb_reserve(skb, local->hw.extra_tx_headroom);
+
+        nullfunc = (struct ieee80211_hdr *) skb_put(skb, 24);
+        memset(nullfunc, 0, 24);
+        fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_NULLFUNC |
+                         IEEE80211_FCTL_TODS);
+        if (powersave)
+                fc |= cpu_to_le16(IEEE80211_FCTL_PM);
+        nullfunc->frame_control = fc;
+        memcpy(nullfunc->addr1, sdata->u.mgd.bssid, ETH_ALEN);
+        memcpy(nullfunc->addr2, sdata->dev->dev_addr, ETH_ALEN);
+        memcpy(nullfunc->addr3, sdata->u.mgd.bssid, ETH_ALEN);
+
+        ieee80211_tx_skb(sdata, skb, 0);
+}
+
+/* spectrum management related things */
+static void ieee80211_chswitch_work(struct work_struct *work)
+{
+        struct ieee80211_sub_if_data *sdata =
+                container_of(work, struct ieee80211_sub_if_data, u.mgd.chswitch_work);
+        struct ieee80211_bss *bss;
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+
+        if (!netif_running(sdata->dev))
+                return;
+
+        bss = ieee80211_rx_bss_get(sdata->local, ifmgd->bssid,
+                                   sdata->local->hw.conf.channel->center_freq,
+                                   ifmgd->ssid, ifmgd->ssid_len);
+        if (!bss)
+                goto exit;
+
+        sdata->local->oper_channel = sdata->local->csa_channel;
+        /* XXX: shouldn't really modify cfg80211-owned data! */
+        if (!ieee80211_hw_config(sdata->local, IEEE80211_CONF_CHANGE_CHANNEL))
+                bss->cbss.channel = sdata->local->oper_channel;
+
+        ieee80211_rx_bss_put(sdata->local, bss);
+exit:
+        ifmgd->flags &= ~IEEE80211_STA_CSA_RECEIVED;
+        ieee80211_wake_queues_by_reason(&sdata->local->hw,
+                                        IEEE80211_QUEUE_STOP_REASON_CSA);
+}
+
+static void ieee80211_chswitch_timer(unsigned long data)
+{
+        struct ieee80211_sub_if_data *sdata =
+                (struct ieee80211_sub_if_data *) data;
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+
+        if (sdata->local->quiescing) {
+                set_bit(TMR_RUNNING_CHANSW, &ifmgd->timers_running);
+                return;
+        }
+
+        queue_work(sdata->local->hw.workqueue, &ifmgd->chswitch_work);
+}
+
+void ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
+                                      struct ieee80211_channel_sw_ie *sw_elem,
+                                      struct ieee80211_bss *bss)
+{
+        struct ieee80211_channel *new_ch;
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+        int new_freq = ieee80211_channel_to_frequency(sw_elem->new_ch_num);
+
+        if (ifmgd->state != IEEE80211_STA_MLME_ASSOCIATED)
+                return;
+
+        if (sdata->local->sw_scanning || sdata->local->hw_scanning)
+                return;
+
+        /* Disregard subsequent beacons if we are already running a timer
+           processing a CSA */
+
+        if (ifmgd->flags & IEEE80211_STA_CSA_RECEIVED)
+                return;
+
+        new_ch = ieee80211_get_channel(sdata->local->hw.wiphy, new_freq);
+        if (!new_ch || new_ch->flags & IEEE80211_CHAN_DISABLED)
+                return;
+
+        sdata->local->csa_channel = new_ch;
+
+        if (sw_elem->count <= 1) {
+                queue_work(sdata->local->hw.workqueue, &ifmgd->chswitch_work);
+        } else {
+                ieee80211_stop_queues_by_reason(&sdata->local->hw,
+                                        IEEE80211_QUEUE_STOP_REASON_CSA);
+                ifmgd->flags |= IEEE80211_STA_CSA_RECEIVED;
+                mod_timer(&ifmgd->chswitch_timer,
+                          jiffies +
+                          msecs_to_jiffies(sw_elem->count *
+                                           bss->cbss.beacon_interval));
+        }
+}
+
+static void ieee80211_handle_pwr_constr(struct ieee80211_sub_if_data *sdata,
+                                        u16 capab_info, u8 *pwr_constr_elem,
+                                        u8 pwr_constr_elem_len)
+{
+        struct ieee80211_conf *conf = &sdata->local->hw.conf;
+
+        if (!(capab_info & WLAN_CAPABILITY_SPECTRUM_MGMT))
+                return;
+
+        /* Power constraint IE length should be 1 octet */
+        if (pwr_constr_elem_len != 1)
+                return;
+
+        if ((*pwr_constr_elem <= conf->channel->max_power) &&
+            (*pwr_constr_elem != sdata->local->power_constr_level)) {
+                sdata->local->power_constr_level = *pwr_constr_elem;
+                ieee80211_hw_config(sdata->local, 0);
+        }
+}
+
+/* powersave */
+static void ieee80211_enable_ps(struct ieee80211_local *local,
+                                struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_conf *conf = &local->hw.conf;
+
+        /*
+         * If we are scanning right now then the parameters will
+         * take effect when scan finishes.
+         */
+        if (local->hw_scanning || local->sw_scanning)
+                return;
+
+        if (conf->dynamic_ps_timeout > 0 &&
+            !(local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_PS)) {
+                mod_timer(&local->dynamic_ps_timer, jiffies +
+                          msecs_to_jiffies(conf->dynamic_ps_timeout));
+        } else {
+                if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK)
+                        ieee80211_send_nullfunc(local, sdata, 1);
+                conf->flags |= IEEE80211_CONF_PS;
+                ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
+        }
+}
+
+static void ieee80211_change_ps(struct ieee80211_local *local)
+{
+        struct ieee80211_conf *conf = &local->hw.conf;
+
+        if (local->ps_sdata) {
+                if (!(local->ps_sdata->u.mgd.flags & IEEE80211_STA_ASSOCIATED))
+                        return;
+
+                ieee80211_enable_ps(local, local->ps_sdata);
+        } else if (conf->flags & IEEE80211_CONF_PS) {
+                conf->flags &= ~IEEE80211_CONF_PS;
+                ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
+                del_timer_sync(&local->dynamic_ps_timer);
+                cancel_work_sync(&local->dynamic_ps_enable_work);
+        }
+}
+
+/* need to hold RTNL or interface lock */
+void ieee80211_recalc_ps(struct ieee80211_local *local, s32 latency)
+{
+        struct ieee80211_sub_if_data *sdata, *found = NULL;
+        int count = 0;
+
+        if (!(local->hw.flags & IEEE80211_HW_SUPPORTS_PS)) {
+                local->ps_sdata = NULL;
+                return;
+        }
+
+        list_for_each_entry(sdata, &local->interfaces, list) {
+                if (!netif_running(sdata->dev))
+                        continue;
+                if (sdata->vif.type != NL80211_IFTYPE_STATION)
+                        continue;
+                found = sdata;
+                count++;
+        }
+
+        if (count == 1 && found->u.mgd.powersave) {
+                s32 beaconint_us;
+
+                if (latency < 0)
+                        latency = pm_qos_requirement(PM_QOS_NETWORK_LATENCY);
+
+                beaconint_us = ieee80211_tu_to_usec(
+                                        found->vif.bss_conf.beacon_int);
+
+                if (beaconint_us > latency) {
+                        local->ps_sdata = NULL;
+                } else {
+                        u8 dtimper = found->vif.bss_conf.dtim_period;
+                        int maxslp = 1;
+
+                        if (dtimper > 1)
+                                maxslp = min_t(int, dtimper,
+                                                    latency / beaconint_us);
+
+                        local->hw.conf.max_sleep_period = maxslp;
+                        local->ps_sdata = found;
+                }
+        } else {
+                local->ps_sdata = NULL;
+        }
+
+        ieee80211_change_ps(local);
+}
+
+void ieee80211_dynamic_ps_disable_work(struct work_struct *work)
+{
+        struct ieee80211_local *local =
+                container_of(work, struct ieee80211_local,
+                             dynamic_ps_disable_work);
+
+        if (local->hw.conf.flags & IEEE80211_CONF_PS) {
+                local->hw.conf.flags &= ~IEEE80211_CONF_PS;
+                ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
+        }
+
+        ieee80211_wake_queues_by_reason(&local->hw,
+                                        IEEE80211_QUEUE_STOP_REASON_PS);
+}
+
+void ieee80211_dynamic_ps_enable_work(struct work_struct *work)
+{
+        struct ieee80211_local *local =
+                container_of(work, struct ieee80211_local,
+                             dynamic_ps_enable_work);
+        struct ieee80211_sub_if_data *sdata = local->ps_sdata;
+
+        /* can only happen when PS was just disabled anyway */
+        if (!sdata)
+                return;
+
+        if (local->hw.conf.flags & IEEE80211_CONF_PS)
+                return;
+
+        if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK)
+                ieee80211_send_nullfunc(local, sdata, 1);
+
+        local->hw.conf.flags |= IEEE80211_CONF_PS;
+        ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
+}
+
+void ieee80211_dynamic_ps_timer(unsigned long data)
+{
+        struct ieee80211_local *local = (void *) data;
+
+        if (local->quiescing)
+                return;
+
+        queue_work(local->hw.workqueue, &local->dynamic_ps_enable_work);
+}
+
 /* MLME */
 static void ieee80211_sta_wmm_params(struct ieee80211_local *local,
                                      struct ieee80211_if_managed *ifmgd,
@@ -427,38 +796,13 @@ static void ieee80211_sta_wmm_params(struct ieee80211_local *local,
                        local->mdev->name, queue, aci, acm, params.aifs, params.cw_min,
                        params.cw_max, params.txop);
 #endif
-                if (local->ops->conf_tx &&
-                    local->ops->conf_tx(local_to_hw(local), queue, &params)) {
+                if (drv_conf_tx(local, queue, &params) && local->ops->conf_tx)
                         printk(KERN_DEBUG "%s: failed to set TX queue "
-                               "parameters for queue %d\n", local->mdev->name, queue);
-                }
+                               "parameters for queue %d\n", local->mdev->name,
+                               queue);
         }
 }
 
-static bool ieee80211_check_tim(struct ieee802_11_elems *elems, u16 aid)
-{
-        u8 mask;
-        u8 index, indexn1, indexn2;
-        struct ieee80211_tim_ie *tim = (struct ieee80211_tim_ie *) elems->tim;
-
-        if (unlikely(!tim || elems->tim_len < 4))
-                return false;
-
-        aid &= 0x3fff;
-        index = aid / 8;
-        mask  = 1 << (aid & 7);
-
-        indexn1 = tim->bitmap_ctrl & 0xfe;
-        indexn2 = elems->tim_len + indexn1 - 4;
-
-        if (index < indexn1 || index > indexn2)
-                return false;
-
-        index -= indexn1;
-
-        return !!(tim->virtual_map[index] & mask);
-}
-
 static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,
                                            u16 capab, bool erp_valid, u8 erp)
 {
@@ -610,6 +954,7 @@ static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
                 sdata->vif.bss_conf.timestamp = bss->cbss.tsf;
                 sdata->vif.bss_conf.dtim_period = bss->dtim_period;
 
+                bss_info_changed |= BSS_CHANGED_BEACON_INT;
                 bss_info_changed |= ieee80211_handle_bss_capability(sdata,
                         bss->cbss.capability, bss->has_erp_value, bss->erp_value);
 
@@ -632,20 +977,17 @@ static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
          * changed or not.
          */
         bss_info_changed |= BSS_CHANGED_BASIC_RATES;
+
+        /* And the BSSID changed - we're associated now */
+        bss_info_changed |= BSS_CHANGED_BSSID;
+
         ieee80211_bss_info_change_notify(sdata, bss_info_changed);
 
-        if (local->powersave) {
-                if (!(local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_PS) &&
-                    local->hw.conf.dynamic_ps_timeout > 0) {
-                        mod_timer(&local->dynamic_ps_timer, jiffies +
-                                  msecs_to_jiffies(
-                                        local->hw.conf.dynamic_ps_timeout));
-                } else {
-                        if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK)
-                                ieee80211_send_nullfunc(local, sdata, 1);
-                        conf->flags |= IEEE80211_CONF_PS;
-                        ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
-                }
+        /* will be same as sdata */
+        if (local->ps_sdata) {
+                mutex_lock(&local->iflist_mtx);
+                ieee80211_recalc_ps(local, -1);
+                mutex_unlock(&local->iflist_mtx);
         }
 
         netif_tx_start_all_queues(sdata->dev);
@@ -664,7 +1006,8 @@ static void ieee80211_direct_probe(struct ieee80211_sub_if_data *sdata)
                 printk(KERN_DEBUG "%s: direct probe to AP %pM timed out\n",
                        sdata->dev->name, ifmgd->bssid);
                 ifmgd->state = IEEE80211_STA_MLME_DISABLED;
-                ieee80211_sta_send_apinfo(sdata);
+                ieee80211_recalc_idle(local);
+                cfg80211_send_auth_timeout(sdata->dev, ifmgd->bssid);
 
                 /*
                  * Most likely AP is not in the range so remove the
@@ -689,8 +1032,6 @@ static void ieee80211_direct_probe(struct ieee80211_sub_if_data *sdata)
 
         ifmgd->state = IEEE80211_STA_MLME_DIRECT_PROBE;
 
-        set_bit(IEEE80211_STA_REQ_DIRECT_PROBE, &ifmgd->request);
-
         /* Direct probe is sent to broadcast address as some APs
          * will not answer to direct packet in unassociated state.
          */
@@ -714,7 +1055,8 @@ static void ieee80211_authenticate(struct ieee80211_sub_if_data *sdata)
                        " timed out\n",
                        sdata->dev->name, ifmgd->bssid);
                 ifmgd->state = IEEE80211_STA_MLME_DISABLED;
-                ieee80211_sta_send_apinfo(sdata);
+                ieee80211_recalc_idle(local);
+                cfg80211_send_auth_timeout(sdata->dev, ifmgd->bssid);
                 ieee80211_rx_bss_remove(sdata, ifmgd->bssid,
                                 sdata->local->hw.conf.channel->center_freq,
                                 ifmgd->ssid, ifmgd->ssid_len);
@@ -817,9 +1159,16 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
 
         rcu_read_unlock();
 
+        ieee80211_set_wmm_default(sdata);
+
+        ieee80211_recalc_idle(local);
+
         /* channel(_type) changes are handled by ieee80211_hw_config */
         local->oper_channel_type = NL80211_CHAN_NO_HT;
 
+        /* on the next assoc, re-program HT parameters */
+        sdata->ht_opmode_valid = false;
+
         local->power_constr_level = 0;
 
         del_timer_sync(&local->dynamic_ps_timer);
@@ -831,6 +1180,9 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
         }
 
         ieee80211_hw_config(local, config_changed);
+
+        /* And the BSSID changed -- not very interesting here */
+        changed |= BSS_CHANGED_BSSID;
         ieee80211_bss_info_change_notify(sdata, changed);
 
         rcu_read_lock();
@@ -897,7 +1249,8 @@ static void ieee80211_associate(struct ieee80211_sub_if_data *sdata)
                        " timed out\n",
                        sdata->dev->name, ifmgd->bssid);
                 ifmgd->state = IEEE80211_STA_MLME_DISABLED;
-                ieee80211_sta_send_apinfo(sdata);
+                ieee80211_recalc_idle(local);
+                cfg80211_send_assoc_timeout(sdata->dev, ifmgd->bssid);
                 ieee80211_rx_bss_remove(sdata, ifmgd->bssid,
                                 sdata->local->hw.conf.channel->center_freq,
                                 ifmgd->ssid, ifmgd->ssid_len);
@@ -917,6 +1270,7 @@ static void ieee80211_associate(struct ieee80211_sub_if_data *sdata)
                 printk(KERN_DEBUG "%s: mismatch in privacy configuration and "
                        "mixed-cell disabled - abort association\n", sdata->dev->name);
                 ifmgd->state = IEEE80211_STA_MLME_DISABLED;
+                ieee80211_recalc_idle(local);
                 return;
         }
 
@@ -948,6 +1302,17 @@ void ieee80211_beacon_loss_work(struct work_struct *work)
                              u.mgd.beacon_loss_work);
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 
+        /*
+         * The driver has already reported this event and we have
+         * already sent a probe request. Maybe the AP died and the
+         * driver keeps reporting until we disassociate... We have
+         * to ignore that because otherwise we would continually
+         * reset the timer and never check whether we received a
+         * probe response!
+         */
+        if (ifmgd->flags & IEEE80211_STA_PROBEREQ_POLL)
+                return;
+
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
         if (net_ratelimit()) {
                 printk(KERN_DEBUG "%s: driver reports beacon loss from AP %pM "
@@ -960,7 +1325,7 @@ void ieee80211_beacon_loss_work(struct work_struct *work)
         ieee80211_send_probe_req(sdata, ifmgd->bssid, ifmgd->ssid,
                                  ifmgd->ssid_len, NULL, 0);
 
-        mod_timer(&ifmgd->timer, jiffies + IEEE80211_MONITORING_INTERVAL);
+        mod_timer(&ifmgd->timer, jiffies + IEEE80211_PROBE_WAIT);
 }
 
 void ieee80211_beacon_loss(struct ieee80211_vif *vif)
@@ -997,7 +1362,7 @@ static void ieee80211_associated(struct ieee80211_sub_if_data *sdata)
         }
 
         if ((ifmgd->flags & IEEE80211_STA_PROBEREQ_POLL) &&
-            time_after(jiffies, sta->last_rx + IEEE80211_MONITORING_INTERVAL)) {
+            time_after(jiffies, sta->last_rx + IEEE80211_PROBE_WAIT)) {
                 printk(KERN_DEBUG "%s: no probe response from AP %pM "
                        "- disassociating\n",
                        sdata->dev->name, ifmgd->bssid);
@@ -1024,8 +1389,8 @@ static void ieee80211_associated(struct ieee80211_sub_if_data *sdata)
                 ifmgd->flags |= IEEE80211_STA_PROBEREQ_POLL;
                 ieee80211_send_probe_req(sdata, ifmgd->bssid, ifmgd->ssid,
                                          ifmgd->ssid_len, NULL, 0);
+                mod_timer(&ifmgd->timer, jiffies + IEEE80211_PROBE_WAIT);
                 goto unlock;
-
         }
 
         if (time_after(jiffies, sta->last_rx + IEEE80211_PROBE_IDLE_TIME)) {
@@ -1034,15 +1399,16 @@ static void ieee80211_associated(struct ieee80211_sub_if_data *sdata)
                                          ifmgd->ssid_len, NULL, 0);
         }
 
+        if (!disassoc)
+                mod_timer(&ifmgd->timer,
+                          jiffies + IEEE80211_MONITORING_INTERVAL);
+
  unlock:
         rcu_read_unlock();
 
         if (disassoc)
                 ieee80211_set_disassoc(sdata, true, true,
                                         WLAN_REASON_PREV_AUTH_NOT_VALID);
-        else
-                mod_timer(&ifmgd->timer, jiffies +
-                                      IEEE80211_MONITORING_INTERVAL);
 }
 
 
@@ -1055,6 +1421,7 @@ static void ieee80211_auth_completed(struct ieee80211_sub_if_data *sdata)
         if (ifmgd->flags & IEEE80211_STA_EXT_SME) {
                 /* Wait for SME to request association */
                 ifmgd->state = IEEE80211_STA_MLME_DISABLED;
+                ieee80211_recalc_idle(sdata->local);
         } else
                 ieee80211_associate(sdata);
 }
@@ -1187,7 +1554,7 @@ static void ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata,
 
         ieee80211_set_disassoc(sdata, true, false, 0);
         ifmgd->flags &= ~IEEE80211_STA_AUTHENTICATED;
-        cfg80211_send_rx_deauth(sdata->dev, (u8 *) mgmt, len);
+        cfg80211_send_deauth(sdata->dev, (u8 *) mgmt, len);
 }
 
 
@@ -1218,7 +1585,7 @@ static void ieee80211_rx_mgmt_disassoc(struct ieee80211_sub_if_data *sdata,
         }
 
         ieee80211_set_disassoc(sdata, false, false, reason_code);
-        cfg80211_send_rx_disassoc(sdata->dev, (u8 *) mgmt, len);
+        cfg80211_send_disassoc(sdata->dev, (u8 *) mgmt, len);
 }
 
 
@@ -1287,6 +1654,12 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
                  * association next time. This works around some broken APs
                  * which do not correctly reject reassociation requests. */
                 ifmgd->flags &= ~IEEE80211_STA_PREV_BSSID_SET;
+                cfg80211_send_rx_assoc(sdata->dev, (u8 *) mgmt, len);
+                if (ifmgd->flags & IEEE80211_STA_EXT_SME) {
+                        /* Wait for SME to decide what to do next */
+                        ifmgd->state = IEEE80211_STA_MLME_DISABLED;
+                        ieee80211_recalc_idle(local);
+                }
                 return;
         }
 
@@ -1340,8 +1713,9 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
          *        to between the sta_info_alloc() and sta_info_insert() above.
          */
 
-        set_sta_flags(sta, WLAN_STA_AUTH | WLAN_STA_ASSOC | WLAN_STA_ASSOC_AP |
-                           WLAN_STA_AUTHORIZED);
+        set_sta_flags(sta, WLAN_STA_AUTH | WLAN_STA_ASSOC | WLAN_STA_ASSOC_AP);
+        if (!(ifmgd->flags & IEEE80211_STA_CONTROL_PORT))
+                set_sta_flags(sta, WLAN_STA_AUTHORIZED);
 
         rates = 0;
         basic_rates = 0;
@@ -1421,6 +1795,8 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
         if (elems.wmm_param)
                 ieee80211_sta_wmm_params(local, ifmgd, elems.wmm_param,
                                          elems.wmm_param_len);
+        else
+                ieee80211_set_wmm_default(sdata);
 
         if (elems.ht_info_elem && elems.wmm_param &&
             (ifmgd->flags & IEEE80211_STA_WMM_ENABLED) &&
@@ -1476,7 +1852,7 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
             (memcmp(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN) == 0)) {
                 struct ieee80211_channel_sw_ie *sw_elem =
                         (struct ieee80211_channel_sw_ie *)elems->ch_switch_elem;
-                ieee80211_process_chanswitch(sdata, sw_elem, bss);
+                ieee80211_sta_process_chanswitch(sdata, sw_elem, bss);
         }
 
         ieee80211_rx_bss_put(local, bss);
@@ -1507,8 +1883,7 @@ static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_sub_if_data *sdata,
         ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems, false);
 
         /* direct probe may be part of the association flow */
-        if (test_and_clear_bit(IEEE80211_STA_REQ_DIRECT_PROBE,
-                               &ifmgd->request)) {
+        if (ifmgd->state == IEEE80211_STA_MLME_DIRECT_PROBE) {
                 printk(KERN_DEBUG "%s direct probe responded\n",
                        sdata->dev->name);
                 ieee80211_authenticate(sdata);
@@ -1518,46 +1893,81 @@ static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_sub_if_data *sdata,
                 ifmgd->flags &= ~IEEE80211_STA_PROBEREQ_POLL;
 }
 
+/*
+ * This is the canonical list of information elements we care about,
+ * the filter code also gives us all changes to the Microsoft OUI
+ * (00:50:F2) vendor IE which is used for WMM which we need to track.
+ *
+ * We implement beacon filtering in software since that means we can
+ * avoid processing the frame here and in cfg80211, and userspace
+ * will not be able to tell whether the hardware supports it or not.
+ *
+ * XXX: This list needs to be dynamic -- userspace needs to be able to
+ *      add items it requires. It also needs to be able to tell us to
+ *      look out for other vendor IEs.
+ */
+static const u64 care_about_ies =
+        (1ULL << WLAN_EID_COUNTRY) |
+        (1ULL << WLAN_EID_ERP_INFO) |
+        (1ULL << WLAN_EID_CHANNEL_SWITCH) |
+        (1ULL << WLAN_EID_PWR_CONSTRAINT) |
+        (1ULL << WLAN_EID_HT_CAPABILITY) |
+        (1ULL << WLAN_EID_HT_INFORMATION);
+
 static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
                                      struct ieee80211_mgmt *mgmt,
                                      size_t len,
                                      struct ieee80211_rx_status *rx_status)
 {
-        struct ieee80211_if_managed *ifmgd;
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         size_t baselen;
         struct ieee802_11_elems elems;
         struct ieee80211_local *local = sdata->local;
         u32 changed = 0;
-        bool erp_valid, directed_tim;
+        bool erp_valid, directed_tim = false;
         u8 erp_value = 0;
+        u32 ncrc;
 
         /* Process beacon from the current BSS */
         baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
         if (baselen > len)
                 return;
 
-        ieee802_11_parse_elems(mgmt->u.beacon.variable, len - baselen, &elems);
-
-        ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems, true);
-
-        if (sdata->vif.type != NL80211_IFTYPE_STATION)
+        if (rx_status->freq != local->hw.conf.channel->center_freq)
                 return;
 
-        ifmgd = &sdata->u.mgd;
-
         if (!(ifmgd->flags & IEEE80211_STA_ASSOCIATED) ||
             memcmp(ifmgd->bssid, mgmt->bssid, ETH_ALEN) != 0)
                 return;
 
-        if (rx_status->freq != local->hw.conf.channel->center_freq)
-                return;
+        if (ifmgd->flags & IEEE80211_STA_PROBEREQ_POLL) {
+#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
+                if (net_ratelimit()) {
+                        printk(KERN_DEBUG "%s: cancelling probereq poll due "
+                               "to a received beacon\n", sdata->dev->name);
+                }
+#endif
+                ifmgd->flags &= ~IEEE80211_STA_PROBEREQ_POLL;
+        }
 
-        ieee80211_sta_wmm_params(local, ifmgd, elems.wmm_param,
-                                 elems.wmm_param_len);
+        ncrc = crc32_be(0, (void *)&mgmt->u.beacon.beacon_int, 4);
+        ncrc = ieee802_11_parse_elems_crc(mgmt->u.beacon.variable,
+                                          len - baselen, &elems,
+                                          care_about_ies, ncrc);
 
-        if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK) {
-                directed_tim = ieee80211_check_tim(&elems, ifmgd->aid);
+        if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK)
+                directed_tim = ieee80211_check_tim(elems.tim, elems.tim_len,
+                                                   ifmgd->aid);
 
+        if (ncrc != ifmgd->beacon_crc) {
+                ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems,
+                                      true);
+
+                ieee80211_sta_wmm_params(local, ifmgd, elems.wmm_param,
+                                         elems.wmm_param_len);
+        }
+
+        if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK) {
                 if (directed_tim) {
                         if (local->hw.conf.dynamic_ps_timeout > 0) {
                                 local->hw.conf.flags &= ~IEEE80211_CONF_PS;
@@ -1580,6 +1990,10 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
                 }
         }
 
+        if (ncrc == ifmgd->beacon_crc)
+                return;
+        ifmgd->beacon_crc = ncrc;
+
         if (elems.erp_info && elems.erp_info_len >= 1) {
                 erp_valid = true;
                 erp_value = elems.erp_info[0];
@@ -1714,6 +2128,11 @@ static void ieee80211_sta_timer(unsigned long data)
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_local *local = sdata->local;
 
+        if (local->quiescing) {
+                set_bit(TMR_RUNNING_TIMER, &ifmgd->timers_running);
+                return;
+        }
+
         set_bit(IEEE80211_STA_REQ_RUN, &ifmgd->request);
         queue_work(local->hw.workqueue, &ifmgd->work);
 }
@@ -1723,10 +2142,8 @@ static void ieee80211_sta_reset_auth(struct ieee80211_sub_if_data *sdata)
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_local *local = sdata->local;
 
-        if (local->ops->reset_tsf) {
-                /* Reset own TSF to allow time synchronization work. */
-                local->ops->reset_tsf(local_to_hw(local));
-        }
+        /* Reset own TSF to allow time synchronization work. */
+        drv_reset_tsf(local);
 
         ifmgd->wmm_last_param_set = -1; /* allow any WMM update */
 
@@ -1814,25 +2231,18 @@ static int ieee80211_sta_config_auth(struct ieee80211_sub_if_data *sdata)
                 return 0;
         } else {
                 if (ifmgd->assoc_scan_tries < IEEE80211_ASSOC_SCANS_MAX_TRIES) {
+
                         ifmgd->assoc_scan_tries++;
-                        /* XXX maybe racy? */
-                        if (local->scan_req)
-                                return -1;
-                        memcpy(local->int_scan_req.ssids[0].ssid,
-                               ifmgd->ssid, IEEE80211_MAX_SSID_LEN);
-                        if (ifmgd->flags & IEEE80211_STA_AUTO_SSID_SEL)
-                                local->int_scan_req.ssids[0].ssid_len = 0;
-                        else
-                                local->int_scan_req.ssids[0].ssid_len = ifmgd->ssid_len;
 
-                        if (ieee80211_start_scan(sdata, &local->int_scan_req))
-                                ieee80211_scan_failed(local);
+                        ieee80211_request_internal_scan(sdata, ifmgd->ssid,
+                                                        ssid_len);
 
                         ifmgd->state = IEEE80211_STA_MLME_AUTHENTICATE;
                         set_bit(IEEE80211_STA_REQ_AUTH, &ifmgd->request);
                 } else {
                         ifmgd->assoc_scan_tries = 0;
                         ifmgd->state = IEEE80211_STA_MLME_DISABLED;
+                        ieee80211_recalc_idle(local);
                 }
         }
         return -1;
@@ -1855,6 +2265,17 @@ static void ieee80211_sta_work(struct work_struct *work)
 
         if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
                 return;
+
+        /*
+         * Nothing should have been stuffed into the workqueue during
+         * the suspend->resume cycle. If this WARN is seen then there
+         * is a bug with either the driver suspend or something in
+         * mac80211 stuffing into the workqueue which we haven't yet
+         * cleared during mac80211's suspend cycle.
+         */
+        if (WARN_ON(local->suspended))
+                return;
+
         ifmgd = &sdata->u.mgd;
 
         while ((skb = skb_dequeue(&ifmgd->skb_queue)))
@@ -1864,14 +2285,8 @@ static void ieee80211_sta_work(struct work_struct *work)
             ifmgd->state != IEEE80211_STA_MLME_AUTHENTICATE &&
             ifmgd->state != IEEE80211_STA_MLME_ASSOCIATE &&
             test_and_clear_bit(IEEE80211_STA_REQ_SCAN, &ifmgd->request)) {
-                /*
-                 * The call to ieee80211_start_scan can fail but ieee80211_request_scan
-                 * (which queued ieee80211_sta_work) did not return an error. Thus, call
-                 * ieee80211_scan_failed here if ieee80211_start_scan fails in order to
-                 * notify the scan requester.
-                 */
-                if (ieee80211_start_scan(sdata, local->scan_req))
-                        ieee80211_scan_failed(local);
+                queue_delayed_work(local->hw.workqueue, &local->scan_work,
+                                   round_jiffies_relative(0));
                 return;
         }
 
@@ -1882,6 +2297,8 @@ static void ieee80211_sta_work(struct work_struct *work)
         } else if (!test_and_clear_bit(IEEE80211_STA_REQ_RUN, &ifmgd->request))
                 return;
 
+        ieee80211_recalc_idle(local);
+
         switch (ifmgd->state) {
         case IEEE80211_STA_MLME_DISABLED:
                 break;
@@ -1926,10 +2343,43 @@ static void ieee80211_restart_sta_timer(struct ieee80211_sub_if_data *sdata)
         }
 }
 
+#ifdef CONFIG_PM
+void ieee80211_sta_quiesce(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+
+        /*
+         * we need to use atomic bitops for the running bits
+         * only because both timers might fire at the same
+         * time -- the code here is properly synchronised.
+         */
+
+        cancel_work_sync(&ifmgd->work);
+        cancel_work_sync(&ifmgd->beacon_loss_work);
+        if (del_timer_sync(&ifmgd->timer))
+                set_bit(TMR_RUNNING_TIMER, &ifmgd->timers_running);
+
+        cancel_work_sync(&ifmgd->chswitch_work);
+        if (del_timer_sync(&ifmgd->chswitch_timer))
+                set_bit(TMR_RUNNING_CHANSW, &ifmgd->timers_running);
+}
+
+void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+
+        if (test_and_clear_bit(TMR_RUNNING_TIMER, &ifmgd->timers_running))
+                add_timer(&ifmgd->timer);
+        if (test_and_clear_bit(TMR_RUNNING_CHANSW, &ifmgd->timers_running))
+                add_timer(&ifmgd->chswitch_timer);
+}
+#endif
+
 /* interface setup */
 void ieee80211_sta_setup_sdata(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_if_managed *ifmgd;
+        u32 hw_flags;
 
         ifmgd = &sdata->u.mgd;
         INIT_WORK(&ifmgd->work, ieee80211_sta_work);
@@ -1949,6 +2399,13 @@ void ieee80211_sta_setup_sdata(struct ieee80211_sub_if_data *sdata)
                 IEEE80211_STA_AUTO_CHANNEL_SEL;
         if (sdata->local->hw.queues >= 4)
                 ifmgd->flags |= IEEE80211_STA_WMM_ENABLED;
+
+        hw_flags = sdata->local->hw.flags;
+
+        if (hw_flags & IEEE80211_HW_SUPPORTS_PS) {
+                ifmgd->powersave = CONFIG_MAC80211_DEFAULT_PS_VALUE;
+                sdata->local->hw.conf.dynamic_ps_timeout = 500;
+        }
 }
 
 /* configuration hooks */
@@ -2032,13 +2489,6 @@ int ieee80211_sta_set_bssid(struct ieee80211_sub_if_data *sdata, u8 *bssid)
                 ifmgd->flags &= ~IEEE80211_STA_BSSID_SET;
         }
 
-        if (netif_running(sdata->dev)) {
-                if (ieee80211_if_config(sdata, IEEE80211_IFCC_BSSID)) {
-                        printk(KERN_DEBUG "%s: Failed to config new BSSID to "
-                               "the low-level driver\n", sdata->dev->name);
-                }
-        }
-
         return ieee80211_sta_commit(sdata);
 }
 
@@ -2047,6 +2497,13 @@ int ieee80211_sta_set_extra_ie(struct ieee80211_sub_if_data *sdata,
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 
+        if (len == 0 && ifmgd->extra_ie_len == 0)
+                return -EALREADY;
+
+        if (len == ifmgd->extra_ie_len && ifmgd->extra_ie &&
+            memcmp(ifmgd->extra_ie, ie, len) == 0)
+                return -EALREADY;
+
         kfree(ifmgd->extra_ie);
         if (len == 0) {
                 ifmgd->extra_ie = NULL;
@@ -2068,9 +2525,6 @@ int ieee80211_sta_deauthenticate(struct ieee80211_sub_if_data *sdata, u16 reason
         printk(KERN_DEBUG "%s: deauthenticating by local choice (reason=%d)\n",
                sdata->dev->name, reason);
 
-        if (sdata->vif.type != NL80211_IFTYPE_STATION)
-                return -EINVAL;
-
         ieee80211_set_disassoc(sdata, true, true, reason);
         return 0;
 }
@@ -2082,9 +2536,6 @@ int ieee80211_sta_disassociate(struct ieee80211_sub_if_data *sdata, u16 reason)
         printk(KERN_DEBUG "%s: disassociating by local choice (reason=%d)\n",
                sdata->dev->name, reason);
 
-        if (sdata->vif.type != NL80211_IFTYPE_STATION)
-                return -EINVAL;
-
         if (!(ifmgd->flags & IEEE80211_STA_ASSOCIATED))
                 return -ENOLINK;
 
@@ -2104,75 +2555,17 @@ void ieee80211_mlme_notify_scan_completed(struct ieee80211_local *local)
         rcu_read_unlock();
 }
 
-void ieee80211_dynamic_ps_disable_work(struct work_struct *work)
+int ieee80211_max_network_latency(struct notifier_block *nb,
+                                  unsigned long data, void *dummy)
 {
+        s32 latency_usec = (s32) data;
         struct ieee80211_local *local =
-                container_of(work, struct ieee80211_local,
-                             dynamic_ps_disable_work);
-
-        if (local->hw.conf.flags & IEEE80211_CONF_PS) {
-                local->hw.conf.flags &= ~IEEE80211_CONF_PS;
-                ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
-        }
+                container_of(nb, struct ieee80211_local,
+                             network_latency_notifier);
 
-        ieee80211_wake_queues_by_reason(&local->hw,
-                                        IEEE80211_QUEUE_STOP_REASON_PS);
-}
-
-void ieee80211_dynamic_ps_enable_work(struct work_struct *work)
-{
-        struct ieee80211_local *local =
-                container_of(work, struct ieee80211_local,
-                             dynamic_ps_enable_work);
-        /* XXX: using scan_sdata is completely broken! */
-        struct ieee80211_sub_if_data *sdata = local->scan_sdata;
-
-        if (local->hw.conf.flags & IEEE80211_CONF_PS)
-                return;
+        mutex_lock(&local->iflist_mtx);
+        ieee80211_recalc_ps(local, latency_usec);
+        mutex_unlock(&local->iflist_mtx);
 
-        if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK && sdata)
-                ieee80211_send_nullfunc(local, sdata, 1);
-
-        local->hw.conf.flags |= IEEE80211_CONF_PS;
-        ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
-}
-
-void ieee80211_dynamic_ps_timer(unsigned long data)
-{
-        struct ieee80211_local *local = (void *) data;
-
-        queue_work(local->hw.workqueue, &local->dynamic_ps_enable_work);
-}
-
-void ieee80211_send_nullfunc(struct ieee80211_local *local,
-                             struct ieee80211_sub_if_data *sdata,
-                             int powersave)
-{
-        struct sk_buff *skb;
-        struct ieee80211_hdr *nullfunc;
-        __le16 fc;
-
-        if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
-                return;
-
-        skb = dev_alloc_skb(local->hw.extra_tx_headroom + 24);
-        if (!skb) {
-                printk(KERN_DEBUG "%s: failed to allocate buffer for nullfunc "
-                       "frame\n", sdata->dev->name);
-                return;
-        }
-        skb_reserve(skb, local->hw.extra_tx_headroom);
-
-        nullfunc = (struct ieee80211_hdr *) skb_put(skb, 24);
-        memset(nullfunc, 0, 24);
-        fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_NULLFUNC |
-                         IEEE80211_FCTL_TODS);
-        if (powersave)
-                fc |= cpu_to_le16(IEEE80211_FCTL_PM);
-        nullfunc->frame_control = fc;
-        memcpy(nullfunc->addr1, sdata->u.mgd.bssid, ETH_ALEN);
-        memcpy(nullfunc->addr2, sdata->dev->dev_addr, ETH_ALEN);
-        memcpy(nullfunc->addr3, sdata->u.mgd.bssid, ETH_ALEN);
-
-        ieee80211_tx_skb(sdata, skb, 0);
+        return 0;
 }
diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c
index 81985d27cbda..7a549f9deb96 100644
--- a/net/mac80211/pm.c
+++ b/net/mac80211/pm.c
@@ -2,6 +2,8 @@
 #include <net/rtnetlink.h>
 
 #include "ieee80211_i.h"
+#include "mesh.h"
+#include "driver-ops.h"
 #include "led.h"
 
 int __ieee80211_suspend(struct ieee80211_hw *hw)
@@ -12,11 +14,30 @@ int __ieee80211_suspend(struct ieee80211_hw *hw)
         struct sta_info *sta;
         unsigned long flags;
 
+        ieee80211_scan_cancel(local);
+
         ieee80211_stop_queues_by_reason(hw,
                         IEEE80211_QUEUE_STOP_REASON_SUSPEND);
 
+        /* flush out all packets */
+        synchronize_net();
+
+        local->quiescing = true;
+        /* make quiescing visible to timers everywhere */
+        mb();
+
         flush_workqueue(local->hw.workqueue);
 
+        /* Don't try to run timers while suspended. */
+        del_timer_sync(&local->sta_cleanup);
+
+         /*
+         * Note that this particular timer doesn't need to be
+         * restarted at resume.
+         */
+        cancel_work_sync(&local->dynamic_ps_enable_work);
+        del_timer_sync(&local->dynamic_ps_timer);
+
         /* disable keys */
         list_for_each_entry(sdata, &local->interfaces, list)
                 ieee80211_disable_keys(sdata);
@@ -34,157 +55,70 @@ int __ieee80211_suspend(struct ieee80211_hw *hw)
 
         rcu_read_unlock();
 
-        /* remove STAs */
-        if (local->ops->sta_notify) {
-                spin_lock_irqsave(&local->sta_lock, flags);
-                list_for_each_entry(sta, &local->sta_list, list) {
-                        if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
-                                sdata = container_of(sdata->bss,
-                                             struct ieee80211_sub_if_data,
-                                             u.ap);
-
-                        local->ops->sta_notify(hw, &sdata->vif,
-                                STA_NOTIFY_REMOVE, &sta->sta);
-                }
-                spin_unlock_irqrestore(&local->sta_lock, flags);
-        }
-
-        /* remove all interfaces */
-        list_for_each_entry(sdata, &local->interfaces, list) {
-                if (sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
-                    sdata->vif.type != NL80211_IFTYPE_MONITOR &&
-                    netif_running(sdata->dev)) {
-                        conf.vif = &sdata->vif;
-                        conf.type = sdata->vif.type;
-                        conf.mac_addr = sdata->dev->dev_addr;
-                        local->ops->remove_interface(hw, &conf);
-                }
-        }
-
         /* flush again, in case driver queued work */
         flush_workqueue(local->hw.workqueue);
 
-        /* stop hardware */
+        /* stop hardware - this must stop RX */
         if (local->open_count) {
                 ieee80211_led_radio(local, false);
-                local->ops->stop(hw);
-        }
-        return 0;
-}
-
-int __ieee80211_resume(struct ieee80211_hw *hw)
-{
-        struct ieee80211_local *local = hw_to_local(hw);
-        struct ieee80211_sub_if_data *sdata;
-        struct ieee80211_if_init_conf conf;
-        struct sta_info *sta;
-        unsigned long flags;
-        int res;
-
-        /* restart hardware */
-        if (local->open_count) {
-                res = local->ops->start(hw);
-
-                ieee80211_led_radio(local, hw->conf.radio_enabled);
+                drv_stop(local);
         }
 
-        /* add interfaces */
-        list_for_each_entry(sdata, &local->interfaces, list) {
-                if (sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
-                    sdata->vif.type != NL80211_IFTYPE_MONITOR &&
-                    netif_running(sdata->dev)) {
-                        conf.vif = &sdata->vif;
-                        conf.type = sdata->vif.type;
-                        conf.mac_addr = sdata->dev->dev_addr;
-                        res = local->ops->add_interface(hw, &conf);
-                }
-        }
-
-        /* add STAs back */
-        if (local->ops->sta_notify) {
-                spin_lock_irqsave(&local->sta_lock, flags);
-                list_for_each_entry(sta, &local->sta_list, list) {
+        /* remove STAs */
+        spin_lock_irqsave(&local->sta_lock, flags);
+        list_for_each_entry(sta, &local->sta_list, list) {
+                if (local->ops->sta_notify) {
+                        sdata = sta->sdata;
                         if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
                                 sdata = container_of(sdata->bss,
                                              struct ieee80211_sub_if_data,
                                              u.ap);
 
-                        local->ops->sta_notify(hw, &sdata->vif,
-                                STA_NOTIFY_ADD, &sta->sta);
+                        drv_sta_notify(local, &sdata->vif, STA_NOTIFY_REMOVE,
+                                       &sta->sta);
                 }
-                spin_unlock_irqrestore(&local->sta_lock, flags);
-        }
-
-        /* Clear Suspend state so that ADDBA requests can be processed */
-
-        rcu_read_lock();
 
-        if (hw->flags & IEEE80211_HW_AMPDU_AGGREGATION) {
-                list_for_each_entry_rcu(sta, &local->sta_list, list) {
-                        clear_sta_flags(sta, WLAN_STA_SUSPEND);
-                }
+                mesh_plink_quiesce(sta);
         }
+        spin_unlock_irqrestore(&local->sta_lock, flags);
 
-        rcu_read_unlock();
-
-        /* add back keys */
-        list_for_each_entry(sdata, &local->interfaces, list)
-                if (netif_running(sdata->dev))
-                        ieee80211_enable_keys(sdata);
-
-        /* setup RTS threshold */
-        if (local->ops->set_rts_threshold)
-                local->ops->set_rts_threshold(hw, local->rts_threshold);
-
-        /* reconfigure hardware */
-        ieee80211_hw_config(local, ~0);
-
-        netif_addr_lock_bh(local->mdev);
-        ieee80211_configure_filter(local);
-        netif_addr_unlock_bh(local->mdev);
-
-        /* Finally also reconfigure all the BSS information */
+        /* remove all interfaces */
         list_for_each_entry(sdata, &local->interfaces, list) {
-                u32 changed = ~0;
-                if (!netif_running(sdata->dev))
-                        continue;
-                switch (sdata->vif.type) {
+                switch(sdata->vif.type) {
                 case NL80211_IFTYPE_STATION:
-                        /* disable beacon change bits */
-                        changed &= ~IEEE80211_IFCC_BEACON;
-                        /* fall through */
+                        ieee80211_sta_quiesce(sdata);
+                        break;
                 case NL80211_IFTYPE_ADHOC:
-                case NL80211_IFTYPE_AP:
-                case NL80211_IFTYPE_MESH_POINT:
-                        /*
-                         * Driver's config_interface can fail if rfkill is
-                         * enabled. Accommodate this return code.
-                         * FIXME: When mac80211 has knowledge of rfkill
-                         * state the code below can change back to:
-                         *   WARN(ieee80211_if_config(sdata, changed));
-                         *   ieee80211_bss_info_change_notify(sdata, ~0);
-                         */
-                        if (ieee80211_if_config(sdata, changed))
-                                printk(KERN_DEBUG "%s: failed to configure interface during resume\n",
-                                       sdata->dev->name);
-                        else
-                                ieee80211_bss_info_change_notify(sdata, ~0);
+                        ieee80211_ibss_quiesce(sdata);
                         break;
-                case NL80211_IFTYPE_WDS:
+                case NL80211_IFTYPE_MESH_POINT:
+                        ieee80211_mesh_quiesce(sdata);
                         break;
                 case NL80211_IFTYPE_AP_VLAN:
                 case NL80211_IFTYPE_MONITOR:
-                        /* ignore virtual */
-                        break;
-                case NL80211_IFTYPE_UNSPECIFIED:
-                case __NL80211_IFTYPE_AFTER_LAST:
-                        WARN_ON(1);
+                        /* don't tell driver about this */
+                        continue;
+                default:
                         break;
                 }
+
+                if (!netif_running(sdata->dev))
+                        continue;
+
+                conf.vif = &sdata->vif;
+                conf.type = sdata->vif.type;
+                conf.mac_addr = sdata->dev->dev_addr;
+                drv_remove_interface(local, &conf);
         }
 
-        ieee80211_wake_queues_by_reason(hw,
-                        IEEE80211_QUEUE_STOP_REASON_SUSPEND);
+        local->suspended = true;
+        local->quiescing = false;
 
         return 0;
 }
+
+/*
+ * __ieee80211_resume() is a static inline which just calls
+ * ieee80211_reconfig(), which is also needed for hardware
+ * hang/firmware failure/etc. recovery.
+ */
diff --git a/net/mac80211/rc80211_minstrel.c b/net/mac80211/rc80211_minstrel.c
index d9233ec50610..0a11515341ba 100644
--- a/net/mac80211/rc80211_minstrel.c
+++ b/net/mac80211/rc80211_minstrel.c
@@ -80,8 +80,7 @@ use_low_rate(struct sk_buff *skb)
         fc = le16_to_cpu(hdr->frame_control);
 
         return ((info->flags & IEEE80211_TX_CTL_NO_ACK) ||
-                (fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA ||
-                is_multicast_ether_addr(hdr->addr1));
+                (fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA);
 }
 
 
@@ -245,7 +244,10 @@ minstrel_get_rate(void *priv, struct ieee80211_sta *sta,
 
         if (!sta || !mi || use_low_rate(skb)) {
                 ar[0].idx = rate_lowest_index(sband, sta);
-                ar[0].count = mp->max_retry;
+                if (info->flags & IEEE80211_TX_CTL_NO_ACK)
+                        ar[0].count = 1;
+                else
+                        ar[0].count = mp->max_retry;
                 return;
         }
 
diff --git a/net/mac80211/rc80211_pid_algo.c b/net/mac80211/rc80211_pid_algo.c
index 8bef9a1262ff..a0bef767ceb5 100644
--- a/net/mac80211/rc80211_pid_algo.c
+++ b/net/mac80211/rc80211_pid_algo.c
@@ -289,13 +289,15 @@ rate_control_pid_get_rate(void *priv, struct ieee80211_sta *sta,
                 info->control.rates[0].count =
                         txrc->hw->conf.short_frame_max_tx_count;
 
-        /* Send management frames and broadcast/multicast data using lowest
-         * rate. */
+        /* Send management frames and NO_ACK data using lowest rate. */
         fc = le16_to_cpu(hdr->frame_control);
         if (!sta || !spinfo ||
             (fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA ||
-            is_multicast_ether_addr(hdr->addr1)) {
+            info->flags & IEEE80211_TX_CTL_NO_ACK) {
                 info->control.rates[0].idx = rate_lowest_index(sband, sta);
+                if (info->flags & IEEE80211_TX_CTL_NO_ACK)
+                        info->control.rates[0].count = 1;
+
                 return;
         }
 
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 9776f73c51ad..6a9b8e63a6bf 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -19,6 +19,7 @@
 #include <net/ieee80211_radiotap.h>
 
 #include "ieee80211_i.h"
+#include "driver-ops.h"
 #include "led.h"
 #include "mesh.h"
 #include "wep.h"
@@ -629,15 +630,6 @@ ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
          * possible.
          */
 
-        if (!ieee80211_has_protected(hdr->frame_control)) {
-                if (!ieee80211_is_mgmt(hdr->frame_control) ||
-                    rx->sta == NULL || !test_sta_flags(rx->sta, WLAN_STA_MFP))
-                        return RX_CONTINUE;
-                mmie_keyidx = ieee80211_get_mmie_keyidx(rx->skb);
-                if (mmie_keyidx < 0)
-                        return RX_CONTINUE;
-        }
-
         /*
          * No point in finding a key and decrypting if the frame is neither
          * addressed to us nor a multicast frame.
@@ -648,8 +640,14 @@ ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
         if (rx->sta)
                 stakey = rcu_dereference(rx->sta->key);
 
+        if (!ieee80211_has_protected(hdr->frame_control))
+                mmie_keyidx = ieee80211_get_mmie_keyidx(rx->skb);
+
         if (!is_multicast_ether_addr(hdr->addr1) && stakey) {
                 rx->key = stakey;
+                /* Skip decryption if the frame is not protected. */
+                if (!ieee80211_has_protected(hdr->frame_control))
+                        return RX_CONTINUE;
         } else if (mmie_keyidx >= 0) {
                 /* Broadcast/multicast robust management frame / BIP */
                 if ((rx->status->flag & RX_FLAG_DECRYPTED) &&
@@ -660,6 +658,21 @@ ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
                     mmie_keyidx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS)
                         return RX_DROP_MONITOR; /* unexpected BIP keyidx */
                 rx->key = rcu_dereference(rx->sdata->keys[mmie_keyidx]);
+        } else if (!ieee80211_has_protected(hdr->frame_control)) {
+                /*
+                 * The frame was not protected, so skip decryption. However, we
+                 * need to set rx->key if there is a key that could have been
+                 * used so that the frame may be dropped if encryption would
+                 * have been expected.
+                 */
+                struct ieee80211_key *key = NULL;
+                if (ieee80211_is_mgmt(hdr->frame_control) &&
+                    is_multicast_ether_addr(hdr->addr1) &&
+                    (key = rcu_dereference(rx->sdata->default_mgmt_key)))
+                        rx->key = key;
+                else if ((key = rcu_dereference(rx->sdata->default_key)))
+                        rx->key = key;
+                return RX_CONTINUE;
         } else {
                 /*
                  * The device doesn't give us the IV so we won't be
@@ -773,9 +786,7 @@ static void ap_sta_ps_start(struct sta_info *sta)
 
         atomic_inc(&sdata->bss->num_sta_ps);
         set_and_clear_sta_flags(sta, WLAN_STA_PS, WLAN_STA_PSPOLL);
-        if (local->ops->sta_notify)
-                local->ops->sta_notify(local_to_hw(local), &sdata->vif,
-                                        STA_NOTIFY_SLEEP, &sta->sta);
+        drv_sta_notify(local, &sdata->vif, STA_NOTIFY_SLEEP, &sta->sta);
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
         printk(KERN_DEBUG "%s: STA %pM aid %d enters power save mode\n",
                sdata->dev->name, sta->sta.addr, sta->sta.aid);
@@ -792,9 +803,7 @@ static int ap_sta_ps_end(struct sta_info *sta)
         atomic_dec(&sdata->bss->num_sta_ps);
 
         clear_sta_flags(sta, WLAN_STA_PS | WLAN_STA_PSPOLL);
-        if (local->ops->sta_notify)
-                local->ops->sta_notify(local_to_hw(local), &sdata->vif,
-                                        STA_NOTIFY_AWAKE, &sta->sta);
+        drv_sta_notify(local, &sdata->vif, STA_NOTIFY_AWAKE, &sta->sta);
 
         if (!skb_queue_empty(&sta->ps_tx_buf))
                 sta_info_clear_tim_bit(sta);
@@ -1212,109 +1221,38 @@ ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc)
         /* Drop unencrypted frames if key is set. */
         if (unlikely(!ieee80211_has_protected(fc) &&
                      !ieee80211_is_nullfunc(fc) &&
-                     (!ieee80211_is_mgmt(fc) ||
-                      (ieee80211_is_unicast_robust_mgmt_frame(rx->skb) &&
-                       rx->sta && test_sta_flags(rx->sta, WLAN_STA_MFP))) &&
-                     (rx->key || rx->sdata->drop_unencrypted)))
-                return -EACCES;
-        /* BIP does not use Protected field, so need to check MMIE */
-        if (unlikely(rx->sta && test_sta_flags(rx->sta, WLAN_STA_MFP) &&
-                     ieee80211_is_multicast_robust_mgmt_frame(rx->skb) &&
-                     ieee80211_get_mmie_keyidx(rx->skb) < 0 &&
+                     ieee80211_is_data(fc) &&
                      (rx->key || rx->sdata->drop_unencrypted)))
                 return -EACCES;
+        if (rx->sta && test_sta_flags(rx->sta, WLAN_STA_MFP)) {
+                if (unlikely(ieee80211_is_unicast_robust_mgmt_frame(rx->skb) &&
+                             rx->key))
+                        return -EACCES;
+                /* BIP does not use Protected field, so need to check MMIE */
+                if (unlikely(ieee80211_is_multicast_robust_mgmt_frame(rx->skb)
+                             && ieee80211_get_mmie_keyidx(rx->skb) < 0 &&
+                             rx->key))
+                        return -EACCES;
+                /*
+                 * When using MFP, Action frames are not allowed prior to
+                 * having configured keys.
+                 */
+                if (unlikely(ieee80211_is_action(fc) && !rx->key &&
+                             ieee80211_is_robust_mgmt_frame(
+                                     (struct ieee80211_hdr *) rx->skb->data)))
+                        return -EACCES;
+        }
 
         return 0;
 }
 
 static int
-ieee80211_data_to_8023(struct ieee80211_rx_data *rx)
+__ieee80211_data_to_8023(struct ieee80211_rx_data *rx)
 {
         struct net_device *dev = rx->dev;
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) rx->skb->data;
-        u16 hdrlen, ethertype;
-        u8 *payload;
-        u8 dst[ETH_ALEN];
-        u8 src[ETH_ALEN] __aligned(2);
-        struct sk_buff *skb = rx->skb;
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
-        if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
-                return -1;
-
-        hdrlen = ieee80211_hdrlen(hdr->frame_control);
-
-        /* convert IEEE 802.11 header + possible LLC headers into Ethernet
-         * header
-         * IEEE 802.11 address fields:
-         * ToDS FromDS Addr1 Addr2 Addr3 Addr4
-         *   0     0   DA    SA    BSSID n/a
-         *   0     1   DA    BSSID SA    n/a
-         *   1     0   BSSID SA    DA    n/a
-         *   1     1   RA    TA    DA    SA
-         */
-        memcpy(dst, ieee80211_get_DA(hdr), ETH_ALEN);
-        memcpy(src, ieee80211_get_SA(hdr), ETH_ALEN);
-
-        switch (hdr->frame_control &
-                cpu_to_le16(IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) {
-        case cpu_to_le16(IEEE80211_FCTL_TODS):
-                if (unlikely(sdata->vif.type != NL80211_IFTYPE_AP &&
-                             sdata->vif.type != NL80211_IFTYPE_AP_VLAN))
-                        return -1;
-                break;
-        case cpu_to_le16(IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS):
-                if (unlikely(sdata->vif.type != NL80211_IFTYPE_WDS &&
-                             sdata->vif.type != NL80211_IFTYPE_MESH_POINT))
-                        return -1;
-                if (ieee80211_vif_is_mesh(&sdata->vif)) {
-                        struct ieee80211s_hdr *meshdr = (struct ieee80211s_hdr *)
-                                (skb->data + hdrlen);
-                        hdrlen += ieee80211_get_mesh_hdrlen(meshdr);
-                        if (meshdr->flags & MESH_FLAGS_AE_A5_A6) {
-                                memcpy(dst, meshdr->eaddr1, ETH_ALEN);
-                                memcpy(src, meshdr->eaddr2, ETH_ALEN);
-                        }
-                }
-                break;
-        case cpu_to_le16(IEEE80211_FCTL_FROMDS):
-                if (sdata->vif.type != NL80211_IFTYPE_STATION ||
-                    (is_multicast_ether_addr(dst) &&
-                     !compare_ether_addr(src, dev->dev_addr)))
-                        return -1;
-                break;
-        case cpu_to_le16(0):
-                if (sdata->vif.type != NL80211_IFTYPE_ADHOC)
-                        return -1;
-                break;
-        }
-
-        if (unlikely(skb->len - hdrlen < 8))
-                return -1;
-
-        payload = skb->data + hdrlen;
-        ethertype = (payload[6] << 8) | payload[7];
-
-        if (likely((compare_ether_addr(payload, rfc1042_header) == 0 &&
-                    ethertype != ETH_P_AARP && ethertype != ETH_P_IPX) ||
-                   compare_ether_addr(payload, bridge_tunnel_header) == 0)) {
-                /* remove RFC1042 or Bridge-Tunnel encapsulation and
-                 * replace EtherType */
-                skb_pull(skb, hdrlen + 6);
-                memcpy(skb_push(skb, ETH_ALEN), src, ETH_ALEN);
-                memcpy(skb_push(skb, ETH_ALEN), dst, ETH_ALEN);
-        } else {
-                struct ethhdr *ehdr;
-                __be16 len;
-
-                skb_pull(skb, hdrlen);
-                len = htons(skb->len);
-                ehdr = (struct ethhdr *) skb_push(skb, sizeof(struct ethhdr));
-                memcpy(ehdr->h_dest, dst, ETH_ALEN);
-                memcpy(ehdr->h_source, src, ETH_ALEN);
-                ehdr->h_proto = len;
-        }
-        return 0;
+        return ieee80211_data_to_8023(rx->skb, dev->dev_addr, sdata->vif.type);
 }
 
 /*
@@ -1453,7 +1391,7 @@ ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
         if (!(rx->flags & IEEE80211_RX_AMSDU))
                 return RX_CONTINUE;
 
-        err = ieee80211_data_to_8023(rx);
+        err = __ieee80211_data_to_8023(rx);
         if (unlikely(err))
                 return RX_DROP_UNUSABLE;
 
@@ -1639,7 +1577,7 @@ ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
         if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
                 return RX_DROP_MONITOR;
 
-        err = ieee80211_data_to_8023(rx);
+        err = __ieee80211_data_to_8023(rx);
         if (unlikely(err))
                 return RX_DROP_UNUSABLE;
 
@@ -1827,6 +1765,9 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
                                    sizeof(mgmt->u.action.u.chan_switch)))
                                 return RX_DROP_MONITOR;
 
+                        if (sdata->vif.type != NL80211_IFTYPE_STATION)
+                                return RX_DROP_MONITOR;
+
                         if (memcmp(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN))
                                 return RX_DROP_MONITOR;
 
@@ -1837,7 +1778,7 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
                         if (!bss)
                                 return RX_DROP_MONITOR;
 
-                        ieee80211_process_chanswitch(sdata,
+                        ieee80211_sta_process_chanswitch(sdata,
                                      &mgmt->u.action.u.chan_switch.sw_elem, bss);
                         ieee80211_rx_bss_put(local, bss);
                         break;
@@ -1932,7 +1873,7 @@ static void ieee80211_rx_michael_mic_report(struct net_device *dev,
             !ieee80211_is_auth(hdr->frame_control))
                 goto ignore;
 
-        mac80211_ev_michael_mic_failure(rx->sdata, keyidx, hdr);
+        mac80211_ev_michael_mic_failure(rx->sdata, keyidx, hdr, NULL);
  ignore:
         dev_kfree_skb(rx->skb);
         rx->skb = NULL;
@@ -2287,6 +2228,43 @@ static inline u16 seq_sub(u16 sq1, u16 sq2)
 }
 
 
+static void ieee80211_release_reorder_frame(struct ieee80211_hw *hw,
+                                            struct tid_ampdu_rx *tid_agg_rx,
+                                            int index)
+{
+        struct ieee80211_supported_band *sband;
+        struct ieee80211_rate *rate;
+        struct ieee80211_rx_status status;
+
+        if (!tid_agg_rx->reorder_buf[index])
+                goto no_frame;
+
+        /* release the reordered frames to stack */
+        memcpy(&status, tid_agg_rx->reorder_buf[index]->cb, sizeof(status));
+        sband = hw->wiphy->bands[status.band];
+        if (status.flag & RX_FLAG_HT)
+                rate = sband->bitrates; /* TODO: HT rates */
+        else
+                rate = &sband->bitrates[status.rate_idx];
+        __ieee80211_rx_handle_packet(hw, tid_agg_rx->reorder_buf[index],
+                                     &status, rate);
+        tid_agg_rx->stored_mpdu_num--;
+        tid_agg_rx->reorder_buf[index] = NULL;
+
+no_frame:
+        tid_agg_rx->head_seq_num = seq_inc(tid_agg_rx->head_seq_num);
+}
+
+
+/*
+ * Timeout (in jiffies) for skb's that are waiting in the RX reorder buffer. If
+ * the skb was added to the buffer longer than this time ago, the earlier
+ * frames that have not yet been received are assumed to be lost and the skb
+ * can be released for processing. This may also release other skb's from the
+ * reorder buffer if there are no additional gaps between the frames.
+ */
+#define HT_RX_REORDER_BUF_TIMEOUT (HZ / 10)
+
 /*
  * As it function blongs to Rx path it must be called with
  * the proper rcu_read_lock protection for its flow.
@@ -2298,12 +2276,8 @@ static u8 ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
                                            u16 mpdu_seq_num,
                                            int bar_req)
 {
-        struct ieee80211_local *local = hw_to_local(hw);
-        struct ieee80211_rx_status status;
         u16 head_seq_num, buf_size;
         int index;
-        struct ieee80211_supported_band *sband;
-        struct ieee80211_rate *rate;
 
         buf_size = tid_agg_rx->buf_size;
         head_seq_num = tid_agg_rx->head_seq_num;
@@ -2328,28 +2302,8 @@ static u8 ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
                         index = seq_sub(tid_agg_rx->head_seq_num,
                                 tid_agg_rx->ssn)
                                 % tid_agg_rx->buf_size;
-
-                        if (tid_agg_rx->reorder_buf[index]) {
-                                /* release the reordered frames to stack */
-                                memcpy(&status,
-                                        tid_agg_rx->reorder_buf[index]->cb,
-                                        sizeof(status));
-                                sband = local->hw.wiphy->bands[status.band];
-                                if (status.flag & RX_FLAG_HT) {
-                                        /* TODO: HT rates */
-                                        rate = sband->bitrates;
-                                } else {
-                                        rate = &sband->bitrates
-                                                [status.rate_idx];
-                                }
-                                __ieee80211_rx_handle_packet(hw,
-                                        tid_agg_rx->reorder_buf[index],
-                                        &status, rate);
-                                tid_agg_rx->stored_mpdu_num--;
-                                tid_agg_rx->reorder_buf[index] = NULL;
-                        }
-                        tid_agg_rx->head_seq_num =
-                                seq_inc(tid_agg_rx->head_seq_num);
+                        ieee80211_release_reorder_frame(hw, tid_agg_rx,
+                                                        index);
                 }
                 if (bar_req)
                         return 1;
@@ -2376,26 +2330,50 @@ static u8 ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
 
         /* put the frame in the reordering buffer */
         tid_agg_rx->reorder_buf[index] = skb;
+        tid_agg_rx->reorder_time[index] = jiffies;
         memcpy(tid_agg_rx->reorder_buf[index]->cb, rxstatus,
                sizeof(*rxstatus));
         tid_agg_rx->stored_mpdu_num++;
         /* release the buffer until next missing frame */
         index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn)
                                                 % tid_agg_rx->buf_size;
-        while (tid_agg_rx->reorder_buf[index]) {
-                /* release the reordered frame back to stack */
-                memcpy(&status, tid_agg_rx->reorder_buf[index]->cb,
-                        sizeof(status));
-                sband = local->hw.wiphy->bands[status.band];
-                if (status.flag & RX_FLAG_HT)
-                        rate = sband->bitrates; /* TODO: HT rates */
-                else
-                        rate = &sband->bitrates[status.rate_idx];
-                __ieee80211_rx_handle_packet(hw, tid_agg_rx->reorder_buf[index],
-                                             &status, rate);
-                tid_agg_rx->stored_mpdu_num--;
-                tid_agg_rx->reorder_buf[index] = NULL;
-                tid_agg_rx->head_seq_num = seq_inc(tid_agg_rx->head_seq_num);
+        if (!tid_agg_rx->reorder_buf[index] &&
+            tid_agg_rx->stored_mpdu_num > 1) {
+                /*
+                 * No buffers ready to be released, but check whether any
+                 * frames in the reorder buffer have timed out.
+                 */
+                int j;
+                int skipped = 1;
+                for (j = (index + 1) % tid_agg_rx->buf_size; j != index;
+                     j = (j + 1) % tid_agg_rx->buf_size) {
+                        if (tid_agg_rx->reorder_buf[j] == NULL) {
+                                skipped++;
+                                continue;
+                        }
+                        if (!time_after(jiffies, tid_agg_rx->reorder_time[j] +
+                                        HZ / 10))
+                                break;
+
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                        if (net_ratelimit())
+                                printk(KERN_DEBUG "%s: release an RX reorder "
+                                       "frame due to timeout on earlier "
+                                       "frames\n",
+                                       wiphy_name(hw->wiphy));
+#endif
+                        ieee80211_release_reorder_frame(hw, tid_agg_rx, j);
+
+                        /*
+                         * Increment the head seq# also for the skipped slots.
+                         */
+                        tid_agg_rx->head_seq_num =
+                                (tid_agg_rx->head_seq_num + skipped) &
+                                SEQ_MASK;
+                        skipped = 0;
+                }
+        } else while (tid_agg_rx->reorder_buf[index]) {
+                ieee80211_release_reorder_frame(hw, tid_agg_rx, index);
                 index = seq_sub(tid_agg_rx->head_seq_num,
                         tid_agg_rx->ssn) % tid_agg_rx->buf_size;
         }
@@ -2517,6 +2495,18 @@ void __ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb,
                 return;
         }
 
+        /*
+         * In theory, the block ack reordering should happen after duplicate
+         * removal (ieee80211_rx_h_check(), which is an RX handler). As such,
+         * the call to ieee80211_rx_reorder_ampdu() should really be moved to
+         * happen as a new RX handler between ieee80211_rx_h_check and
+         * ieee80211_rx_h_decrypt. This cleanup may eventually happen, but for
+         * the time being, the call can be here since RX reorder buf processing
+         * will implicitly skip duplicates. We could, in theory at least,
+         * process frames that ieee80211_rx_h_passive_scan would drop (e.g.,
+         * frames from other than operational channel), but that should not
+         * happen in normal networks.
+         */
         if (!ieee80211_rx_reorder_ampdu(local, skb, status))
                 __ieee80211_rx_handle_packet(hw, skb, status, rate);
 
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index 3bf9839f5916..2a8d09ad17ff 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -21,6 +21,7 @@
 #include <net/iw_handler.h>
 
 #include "ieee80211_i.h"
+#include "driver-ops.h"
 #include "mesh.h"
 
 #define IEEE80211_PROBE_DELAY (HZ / 33)
@@ -202,18 +203,6 @@ ieee80211_scan_rx(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb,
         return RX_QUEUED;
 }
 
-void ieee80211_scan_failed(struct ieee80211_local *local)
-{
-        if (WARN_ON(!local->scan_req))
-                return;
-
-        /* notify cfg80211 about the failed scan */
-        if (local->scan_req != &local->int_scan_req)
-                cfg80211_scan_done(local->scan_req, true);
-
-        local->scan_req = NULL;
-}
-
 /*
  * inform AP that we will go to sleep so that it will buffer the frames
  * while we scan
@@ -253,7 +242,7 @@ static void ieee80211_scan_ps_disable(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_local *local = sdata->local;
 
-        if (!local->powersave)
+        if (!local->ps_sdata)
                 ieee80211_send_nullfunc(local, sdata, 0);
         else {
                 /*
@@ -274,51 +263,62 @@ static void ieee80211_scan_ps_disable(struct ieee80211_sub_if_data *sdata)
         }
 }
 
+static void ieee80211_restore_scan_ies(struct ieee80211_local *local)
+{
+        kfree(local->scan_req->ie);
+        local->scan_req->ie = local->orig_ies;
+        local->scan_req->ie_len = local->orig_ies_len;
+}
+
 void ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted)
 {
         struct ieee80211_local *local = hw_to_local(hw);
         struct ieee80211_sub_if_data *sdata;
+        bool was_hw_scan;
 
-        if (WARN_ON(!local->hw_scanning && !local->sw_scanning))
+        mutex_lock(&local->scan_mtx);
+
+        if (WARN_ON(!local->hw_scanning && !local->sw_scanning)) {
+                mutex_unlock(&local->scan_mtx);
                 return;
+        }
 
-        if (WARN_ON(!local->scan_req))
+        if (WARN_ON(!local->scan_req)) {
+                mutex_unlock(&local->scan_mtx);
                 return;
+        }
+
+        if (local->hw_scanning)
+                ieee80211_restore_scan_ies(local);
 
         if (local->scan_req != &local->int_scan_req)
                 cfg80211_scan_done(local->scan_req, aborted);
         local->scan_req = NULL;
 
-        local->last_scan_completed = jiffies;
+        was_hw_scan = local->hw_scanning;
+        local->hw_scanning = false;
+        local->sw_scanning = false;
+        local->scan_channel = NULL;
 
-        if (local->hw_scanning) {
-                local->hw_scanning = false;
-                /*
-                 * Somebody might have requested channel change during scan
-                 * that we won't have acted upon, try now. ieee80211_hw_config
-                 * will set the flag based on actual changes.
-                 */
-                ieee80211_hw_config(local, 0);
-                goto done;
-        }
+        /* we only have to protect scan_req and hw/sw scan */
+        mutex_unlock(&local->scan_mtx);
 
-        local->sw_scanning = false;
         ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);
+        if (was_hw_scan)
+                goto done;
 
         netif_tx_lock_bh(local->mdev);
         netif_addr_lock(local->mdev);
         local->filter_flags &= ~FIF_BCN_PRBRESP_PROMISC;
-        local->ops->configure_filter(local_to_hw(local),
-                                     FIF_BCN_PRBRESP_PROMISC,
-                                     &local->filter_flags,
-                                     local->mdev->mc_count,
-                                     local->mdev->mc_list);
+        drv_configure_filter(local, FIF_BCN_PRBRESP_PROMISC,
+                             &local->filter_flags,
+                             local->mdev->mc_count,
+                             local->mdev->mc_list);
 
         netif_addr_unlock(local->mdev);
         netif_tx_unlock_bh(local->mdev);
 
-        if (local->ops->sw_scan_complete)
-                local->ops->sw_scan_complete(local_to_hw(local));
+        drv_sw_scan_complete(local);
 
         mutex_lock(&local->iflist_mtx);
         list_for_each_entry(sdata, &local->interfaces, list) {
@@ -338,18 +338,160 @@ void ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted)
                 if (sdata->vif.type == NL80211_IFTYPE_AP ||
                     sdata->vif.type == NL80211_IFTYPE_ADHOC ||
                     sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
-                        ieee80211_if_config(sdata,
-                                            IEEE80211_IFCC_BEACON_ENABLED);
+                        ieee80211_bss_info_change_notify(
+                                sdata, BSS_CHANGED_BEACON_ENABLED);
         }
         mutex_unlock(&local->iflist_mtx);
 
  done:
+        ieee80211_recalc_idle(local);
         ieee80211_mlme_notify_scan_completed(local);
         ieee80211_ibss_notify_scan_completed(local);
         ieee80211_mesh_notify_scan_completed(local);
 }
 EXPORT_SYMBOL(ieee80211_scan_completed);
 
+static int ieee80211_start_sw_scan(struct ieee80211_local *local)
+{
+        struct ieee80211_sub_if_data *sdata;
+
+        /*
+         * Hardware/driver doesn't support hw_scan, so use software
+         * scanning instead. First send a nullfunc frame with power save
+         * bit on so that AP will buffer the frames for us while we are not
+         * listening, then send probe requests to each channel and wait for
+         * the responses. After all channels are scanned, tune back to the
+         * original channel and send a nullfunc frame with power save bit
+         * off to trigger the AP to send us all the buffered frames.
+         *
+         * Note that while local->sw_scanning is true everything else but
+         * nullfunc frames and probe requests will be dropped in
+         * ieee80211_tx_h_check_assoc().
+         */
+        drv_sw_scan_start(local);
+
+        mutex_lock(&local->iflist_mtx);
+        list_for_each_entry(sdata, &local->interfaces, list) {
+                if (!netif_running(sdata->dev))
+                        continue;
+
+                /* disable beaconing */
+                if (sdata->vif.type == NL80211_IFTYPE_AP ||
+                    sdata->vif.type == NL80211_IFTYPE_ADHOC ||
+                    sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
+                        ieee80211_bss_info_change_notify(
+                                sdata, BSS_CHANGED_BEACON_ENABLED);
+
+                if (sdata->vif.type == NL80211_IFTYPE_STATION) {
+                        if (sdata->u.mgd.flags & IEEE80211_STA_ASSOCIATED) {
+                                netif_tx_stop_all_queues(sdata->dev);
+                                ieee80211_scan_ps_enable(sdata);
+                        }
+                } else
+                        netif_tx_stop_all_queues(sdata->dev);
+        }
+        mutex_unlock(&local->iflist_mtx);
+
+        local->scan_state = SCAN_SET_CHANNEL;
+        local->scan_channel_idx = 0;
+
+        netif_addr_lock_bh(local->mdev);
+        local->filter_flags |= FIF_BCN_PRBRESP_PROMISC;
+        drv_configure_filter(local, FIF_BCN_PRBRESP_PROMISC,
+                             &local->filter_flags,
+                             local->mdev->mc_count,
+                             local->mdev->mc_list);
+        netif_addr_unlock_bh(local->mdev);
+
+        /* TODO: start scan as soon as all nullfunc frames are ACKed */
+        queue_delayed_work(local->hw.workqueue, &local->scan_work,
+                           IEEE80211_CHANNEL_TIME);
+
+        return 0;
+}
+
+
+static int __ieee80211_start_scan(struct ieee80211_sub_if_data *sdata,
+                                  struct cfg80211_scan_request *req)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+        int rc;
+
+        if (local->scan_req)
+                return -EBUSY;
+
+        if (local->ops->hw_scan) {
+                u8 *ies;
+                int ielen;
+
+                ies = kmalloc(2 + IEEE80211_MAX_SSID_LEN +
+                              local->scan_ies_len + req->ie_len, GFP_KERNEL);
+                if (!ies)
+                        return -ENOMEM;
+
+                ielen = ieee80211_build_preq_ies(local, ies,
+                                                 req->ie, req->ie_len);
+                local->orig_ies = req->ie;
+                local->orig_ies_len = req->ie_len;
+                req->ie = ies;
+                req->ie_len = ielen;
+        }
+
+        local->scan_req = req;
+        local->scan_sdata = sdata;
+
+        if (req != &local->int_scan_req &&
+            sdata->vif.type == NL80211_IFTYPE_STATION &&
+            (ifmgd->state == IEEE80211_STA_MLME_DIRECT_PROBE ||
+             ifmgd->state == IEEE80211_STA_MLME_AUTHENTICATE ||
+             ifmgd->state == IEEE80211_STA_MLME_ASSOCIATE)) {
+                /* actually wait for the assoc to finish/time out */
+                set_bit(IEEE80211_STA_REQ_SCAN, &ifmgd->request);
+                return 0;
+        }
+
+        if (local->ops->hw_scan)
+                local->hw_scanning = true;
+        else
+                local->sw_scanning = true;
+        /*
+         * Kicking off the scan need not be protected,
+         * only the scan variable stuff, since now
+         * local->scan_req is assigned and other callers
+         * will abort their scan attempts.
+         *
+         * This avoids getting a scan_mtx -> iflist_mtx
+         * dependency, so that the scan completed calls
+         * have more locking freedom.
+         */
+
+        ieee80211_recalc_idle(local);
+        mutex_unlock(&local->scan_mtx);
+
+        if (local->ops->hw_scan)
+                rc = drv_hw_scan(local, local->scan_req);
+        else
+                rc = ieee80211_start_sw_scan(local);
+
+        mutex_lock(&local->scan_mtx);
+
+        if (rc) {
+                if (local->ops->hw_scan) {
+                        local->hw_scanning = false;
+                        ieee80211_restore_scan_ies(local);
+                } else
+                        local->sw_scanning = false;
+
+                ieee80211_recalc_idle(local);
+
+                local->scan_req = NULL;
+                local->scan_sdata = NULL;
+        }
+
+        return rc;
+}
+
 void ieee80211_scan_work(struct work_struct *work)
 {
         struct ieee80211_local *local =
@@ -359,17 +501,41 @@ void ieee80211_scan_work(struct work_struct *work)
         int skip, i;
         unsigned long next_delay = 0;
 
+        mutex_lock(&local->scan_mtx);
+        if (!sdata || !local->scan_req) {
+                mutex_unlock(&local->scan_mtx);
+                return;
+        }
+
+        if (local->scan_req && !(local->sw_scanning || local->hw_scanning)) {
+                struct cfg80211_scan_request *req = local->scan_req;
+                int rc;
+
+                local->scan_req = NULL;
+
+                rc = __ieee80211_start_scan(sdata, req);
+                mutex_unlock(&local->scan_mtx);
+
+                if (rc)
+                        ieee80211_scan_completed(&local->hw, true);
+                return;
+        }
+
+        mutex_unlock(&local->scan_mtx);
+
         /*
          * Avoid re-scheduling when the sdata is going away.
          */
-        if (!netif_running(sdata->dev))
+        if (!netif_running(sdata->dev)) {
+                ieee80211_scan_completed(&local->hw, true);
                 return;
+        }
 
         switch (local->scan_state) {
         case SCAN_SET_CHANNEL:
                 /* if no more bands/channels left, complete scan */
                 if (local->scan_channel_idx >= local->scan_req->n_channels) {
-                        ieee80211_scan_completed(local_to_hw(local), false);
+                        ieee80211_scan_completed(&local->hw, false);
                         return;
                 }
                 skip = 0;
@@ -393,24 +559,39 @@ void ieee80211_scan_work(struct work_struct *work)
                 if (skip)
                         break;
 
-                next_delay = IEEE80211_PROBE_DELAY +
-                             usecs_to_jiffies(local->hw.channel_change_time);
+                /*
+                 * Probe delay is used to update the NAV, cf. 11.1.3.2.2
+                 * (which unfortunately doesn't say _why_ step a) is done,
+                 * but it waits for the probe delay or until a frame is
+                 * received - and the received frame would update the NAV).
+                 * For now, we do not support waiting until a frame is
+                 * received.
+                 *
+                 * In any case, it is not necessary for a passive scan.
+                 */
+                if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN ||
+                    !local->scan_req->n_ssids) {
+                        next_delay = IEEE80211_PASSIVE_CHANNEL_TIME;
+                        break;
+                }
+
+                next_delay = IEEE80211_PROBE_DELAY;
                 local->scan_state = SCAN_SEND_PROBE;
                 break;
         case SCAN_SEND_PROBE:
-                next_delay = IEEE80211_PASSIVE_CHANNEL_TIME;
-                local->scan_state = SCAN_SET_CHANNEL;
-
-                if (local->scan_channel->flags & IEEE80211_CHAN_PASSIVE_SCAN ||
-                    !local->scan_req->n_ssids)
-                        break;
                 for (i = 0; i < local->scan_req->n_ssids; i++)
                         ieee80211_send_probe_req(
                                 sdata, NULL,
                                 local->scan_req->ssids[i].ssid,
                                 local->scan_req->ssids[i].ssid_len,
                                 local->scan_req->ie, local->scan_req->ie_len);
+
+                /*
+                 * After sending probe requests, wait for probe responses
+                 * on the channel.
+                 */
                 next_delay = IEEE80211_CHANNEL_TIME;
+                local->scan_state = SCAN_SET_CHANNEL;
                 break;
         }
 
@@ -418,150 +599,53 @@ void ieee80211_scan_work(struct work_struct *work)
                            next_delay);
 }
 
-
-int ieee80211_start_scan(struct ieee80211_sub_if_data *scan_sdata,
-                         struct cfg80211_scan_request *req)
+int ieee80211_request_scan(struct ieee80211_sub_if_data *sdata,
+                           struct cfg80211_scan_request *req)
 {
-        struct ieee80211_local *local = scan_sdata->local;
-        struct ieee80211_sub_if_data *sdata;
-
-        if (!req)
-                return -EINVAL;
-
-        if (local->scan_req && local->scan_req != req)
-                return -EBUSY;
-
-        local->scan_req = req;
-
-        /* MLME-SCAN.request (page 118)  page 144 (11.1.3.1)
-         * BSSType: INFRASTRUCTURE, INDEPENDENT, ANY_BSS
-         * BSSID: MACAddress
-         * SSID
-         * ScanType: ACTIVE, PASSIVE
-         * ProbeDelay: delay (in microseconds) to be used prior to transmitting
-         *    a Probe frame during active scanning
-         * ChannelList
-         * MinChannelTime (>= ProbeDelay), in TU
-         * MaxChannelTime: (>= MinChannelTime), in TU
-         */
-
-         /* MLME-SCAN.confirm
-          * BSSDescriptionSet
-          * ResultCode: SUCCESS, INVALID_PARAMETERS
-         */
-
-        if (local->sw_scanning || local->hw_scanning) {
-                if (local->scan_sdata == scan_sdata)
-                        return 0;
-                return -EBUSY;
-        }
-
-        if (local->ops->hw_scan) {
-                int rc;
-
-                local->hw_scanning = true;
-                rc = local->ops->hw_scan(local_to_hw(local), req);
-                if (rc) {
-                        local->hw_scanning = false;
-                        return rc;
-                }
-                local->scan_sdata = scan_sdata;
-                return 0;
-        }
-
-        /*
-         * Hardware/driver doesn't support hw_scan, so use software
-         * scanning instead. First send a nullfunc frame with power save
-         * bit on so that AP will buffer the frames for us while we are not
-         * listening, then send probe requests to each channel and wait for
-         * the responses. After all channels are scanned, tune back to the
-         * original channel and send a nullfunc frame with power save bit
-         * off to trigger the AP to send us all the buffered frames.
-         *
-         * Note that while local->sw_scanning is true everything else but
-         * nullfunc frames and probe requests will be dropped in
-         * ieee80211_tx_h_check_assoc().
-         */
-        local->sw_scanning = true;
-        if (local->ops->sw_scan_start)
-                local->ops->sw_scan_start(local_to_hw(local));
+        int res;
 
-        mutex_lock(&local->iflist_mtx);
-        list_for_each_entry(sdata, &local->interfaces, list) {
-                if (!netif_running(sdata->dev))
-                        continue;
+        mutex_lock(&sdata->local->scan_mtx);
+        res = __ieee80211_start_scan(sdata, req);
+        mutex_unlock(&sdata->local->scan_mtx);
 
-                /* disable beaconing */
-                if (sdata->vif.type == NL80211_IFTYPE_AP ||
-                    sdata->vif.type == NL80211_IFTYPE_ADHOC ||
-                    sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
-                        ieee80211_if_config(sdata,
-                                            IEEE80211_IFCC_BEACON_ENABLED);
+        return res;
+}
 
-                if (sdata->vif.type == NL80211_IFTYPE_STATION) {
-                        if (sdata->u.mgd.flags & IEEE80211_STA_ASSOCIATED) {
-                                netif_tx_stop_all_queues(sdata->dev);
-                                ieee80211_scan_ps_enable(sdata);
-                        }
-                } else
-                        netif_tx_stop_all_queues(sdata->dev);
-        }
-        mutex_unlock(&local->iflist_mtx);
+int ieee80211_request_internal_scan(struct ieee80211_sub_if_data *sdata,
+                                    const u8 *ssid, u8 ssid_len)
+{
+        struct ieee80211_local *local = sdata->local;
+        int ret = -EBUSY;
 
-        local->scan_state = SCAN_SET_CHANNEL;
-        local->scan_channel_idx = 0;
-        local->scan_sdata = scan_sdata;
-        local->scan_req = req;
+        mutex_lock(&local->scan_mtx);
 
-        netif_addr_lock_bh(local->mdev);
-        local->filter_flags |= FIF_BCN_PRBRESP_PROMISC;
-        local->ops->configure_filter(local_to_hw(local),
-                                     FIF_BCN_PRBRESP_PROMISC,
-                                     &local->filter_flags,
-                                     local->mdev->mc_count,
-                                     local->mdev->mc_list);
-        netif_addr_unlock_bh(local->mdev);
+        /* busy scanning */
+        if (local->scan_req)
+                goto unlock;
 
-        /* TODO: start scan as soon as all nullfunc frames are ACKed */
-        queue_delayed_work(local->hw.workqueue, &local->scan_work,
-                           IEEE80211_CHANNEL_TIME);
+        memcpy(local->int_scan_req.ssids[0].ssid, ssid, IEEE80211_MAX_SSID_LEN);
+        local->int_scan_req.ssids[0].ssid_len = ssid_len;
 
-        return 0;
+        ret = __ieee80211_start_scan(sdata, &sdata->local->int_scan_req);
+ unlock:
+        mutex_unlock(&local->scan_mtx);
+        return ret;
 }
 
-
-int ieee80211_request_scan(struct ieee80211_sub_if_data *sdata,
-                           struct cfg80211_scan_request *req)
+void ieee80211_scan_cancel(struct ieee80211_local *local)
 {
-        struct ieee80211_local *local = sdata->local;
-        struct ieee80211_if_managed *ifmgd;
-
-        if (!req)
-                return -EINVAL;
+        bool swscan;
 
-        if (local->scan_req && local->scan_req != req)
-                return -EBUSY;
-
-        local->scan_req = req;
-
-        if (sdata->vif.type != NL80211_IFTYPE_STATION)
-                return ieee80211_start_scan(sdata, req);
+        cancel_delayed_work_sync(&local->scan_work);
 
         /*
-         * STA has a state machine that might need to defer scanning
-         * while it's trying to associate/authenticate, therefore we
-         * queue it up to the state machine in that case.
+         * Only call this function when a scan can't be
+         * queued -- mostly at suspend under RTNL.
          */
+        mutex_lock(&local->scan_mtx);
+        swscan = local->sw_scanning;
+        mutex_unlock(&local->scan_mtx);
 
-        if (local->sw_scanning || local->hw_scanning) {
-                if (local->scan_sdata == sdata)
-                        return 0;
-                return -EBUSY;
-        }
-
-        ifmgd = &sdata->u.mgd;
-        set_bit(IEEE80211_STA_REQ_SCAN, &ifmgd->request);
-        queue_work(local->hw.workqueue, &ifmgd->work);
-
-        return 0;
+        if (swscan)
+                ieee80211_scan_completed(&local->hw, true);
 }
diff --git a/net/mac80211/spectmgmt.c b/net/mac80211/spectmgmt.c
index 5f7a2624ed74..68953033403d 100644
--- a/net/mac80211/spectmgmt.c
+++ b/net/mac80211/spectmgmt.c
@@ -15,7 +15,7 @@
  */
 
 #include <linux/ieee80211.h>
-#include <net/wireless.h>
+#include <net/cfg80211.h>
 #include <net/mac80211.h>
 #include "ieee80211_i.h"
 #include "sta_info.h"
@@ -84,104 +84,3 @@ void ieee80211_process_measurement_req(struct ieee80211_sub_if_data *sdata,
                         mgmt->sa, mgmt->bssid,
                         mgmt->u.action.u.measurement.dialog_token);
 }
-
-void ieee80211_chswitch_work(struct work_struct *work)
-{
-        struct ieee80211_sub_if_data *sdata =
-                container_of(work, struct ieee80211_sub_if_data, u.mgd.chswitch_work);
-        struct ieee80211_bss *bss;
-        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
-
-        if (!netif_running(sdata->dev))
-                return;
-
-        bss = ieee80211_rx_bss_get(sdata->local, ifmgd->bssid,
-                                   sdata->local->hw.conf.channel->center_freq,
-                                   ifmgd->ssid, ifmgd->ssid_len);
-        if (!bss)
-                goto exit;
-
-        sdata->local->oper_channel = sdata->local->csa_channel;
-        /* XXX: shouldn't really modify cfg80211-owned data! */
-        if (!ieee80211_hw_config(sdata->local, IEEE80211_CONF_CHANGE_CHANNEL))
-                bss->cbss.channel = sdata->local->oper_channel;
-
-        ieee80211_rx_bss_put(sdata->local, bss);
-exit:
-        ifmgd->flags &= ~IEEE80211_STA_CSA_RECEIVED;
-        ieee80211_wake_queues_by_reason(&sdata->local->hw,
-                                        IEEE80211_QUEUE_STOP_REASON_CSA);
-}
-
-void ieee80211_chswitch_timer(unsigned long data)
-{
-        struct ieee80211_sub_if_data *sdata =
-                (struct ieee80211_sub_if_data *) data;
-        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
-
-        queue_work(sdata->local->hw.workqueue, &ifmgd->chswitch_work);
-}
-
-void ieee80211_process_chanswitch(struct ieee80211_sub_if_data *sdata,
-                                  struct ieee80211_channel_sw_ie *sw_elem,
-                                  struct ieee80211_bss *bss)
-{
-        struct ieee80211_channel *new_ch;
-        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
-        int new_freq = ieee80211_channel_to_frequency(sw_elem->new_ch_num);
-
-        /* FIXME: Handle ADHOC later */
-        if (sdata->vif.type != NL80211_IFTYPE_STATION)
-                return;
-
-        if (ifmgd->state != IEEE80211_STA_MLME_ASSOCIATED)
-                return;
-
-        if (sdata->local->sw_scanning || sdata->local->hw_scanning)
-                return;
-
-        /* Disregard subsequent beacons if we are already running a timer
-           processing a CSA */
-
-        if (ifmgd->flags & IEEE80211_STA_CSA_RECEIVED)
-                return;
-
-        new_ch = ieee80211_get_channel(sdata->local->hw.wiphy, new_freq);
-        if (!new_ch || new_ch->flags & IEEE80211_CHAN_DISABLED)
-                return;
-
-        sdata->local->csa_channel = new_ch;
-
-        if (sw_elem->count <= 1) {
-                queue_work(sdata->local->hw.workqueue, &ifmgd->chswitch_work);
-        } else {
-                ieee80211_stop_queues_by_reason(&sdata->local->hw,
-                                                IEEE80211_QUEUE_STOP_REASON_CSA);
-                ifmgd->flags |= IEEE80211_STA_CSA_RECEIVED;
-                mod_timer(&ifmgd->chswitch_timer,
-                          jiffies +
-                          msecs_to_jiffies(sw_elem->count *
-                                           bss->cbss.beacon_interval));
-        }
-}
-
-void ieee80211_handle_pwr_constr(struct ieee80211_sub_if_data *sdata,
-                                 u16 capab_info, u8 *pwr_constr_elem,
-                                 u8 pwr_constr_elem_len)
-{
-        struct ieee80211_conf *conf = &sdata->local->hw.conf;
-
-        if (!(capab_info & WLAN_CAPABILITY_SPECTRUM_MGMT))
-                return;
-
-        /* Power constraint IE length should be 1 octet */
-        if (pwr_constr_elem_len != 1)
-                return;
-
-        if ((*pwr_constr_elem <= conf->channel->max_power) &&
-            (*pwr_constr_elem != sdata->local->power_constr_level)) {
-                sdata->local->power_constr_level = *pwr_constr_elem;
-                ieee80211_hw_config(sdata->local, 0);
-        }
-}
-
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index c5f14e6bbde2..d5611d8fd0d6 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -19,6 +19,7 @@
 
 #include <net/mac80211.h>
 #include "ieee80211_i.h"
+#include "driver-ops.h"
 #include "rate.h"
 #include "sta_info.h"
 #include "debugfs_sta.h"
@@ -292,6 +293,9 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
         skb_queue_head_init(&sta->ps_tx_buf);
         skb_queue_head_init(&sta->tx_filtered);
 
+        for (i = 0; i < NUM_RX_DATA_QUEUES; i++)
+                sta->last_seq_ctrl[i] = cpu_to_le16(USHORT_MAX);
+
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
         printk(KERN_DEBUG "%s: Allocated STA %pM\n",
                wiphy_name(local->hw.wiphy), sta->sta.addr);
@@ -346,8 +350,7 @@ int sta_info_insert(struct sta_info *sta)
                                              struct ieee80211_sub_if_data,
                                              u.ap);
 
-                local->ops->sta_notify(local_to_hw(local), &sdata->vif,
-                                       STA_NOTIFY_ADD, &sta->sta);
+                drv_sta_notify(local, &sdata->vif, STA_NOTIFY_ADD, &sta->sta);
         }
 
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
@@ -405,8 +408,7 @@ static void __sta_info_set_tim_bit(struct ieee80211_if_ap *bss,
 
         if (sta->local->ops->set_tim) {
                 sta->local->tim_in_locked_section = true;
-                sta->local->ops->set_tim(local_to_hw(sta->local),
-                                         &sta->sta, true);
+                drv_set_tim(sta->local, &sta->sta, true);
                 sta->local->tim_in_locked_section = false;
         }
 }
@@ -431,8 +433,7 @@ static void __sta_info_clear_tim_bit(struct ieee80211_if_ap *bss,
 
         if (sta->local->ops->set_tim) {
                 sta->local->tim_in_locked_section = true;
-                sta->local->ops->set_tim(local_to_hw(sta->local),
-                                         &sta->sta, false);
+                drv_set_tim(sta->local, &sta->sta, false);
                 sta->local->tim_in_locked_section = false;
         }
 }
@@ -482,8 +483,8 @@ static void __sta_info_unlink(struct sta_info **sta)
                                              struct ieee80211_sub_if_data,
                                              u.ap);
 
-                local->ops->sta_notify(local_to_hw(local), &sdata->vif,
-                                       STA_NOTIFY_REMOVE, &(*sta)->sta);
+                drv_sta_notify(local, &sdata->vif, STA_NOTIFY_REMOVE,
+                               &(*sta)->sta);
         }
 
         if (ieee80211_vif_is_mesh(&sdata->vif)) {
@@ -543,9 +544,8 @@ void sta_info_unlink(struct sta_info **sta)
         spin_unlock_irqrestore(&local->sta_lock, flags);
 }
 
-static inline int sta_info_buffer_expired(struct ieee80211_local *local,
-                                          struct sta_info *sta,
-                                          struct sk_buff *skb)
+static int sta_info_buffer_expired(struct sta_info *sta,
+                                   struct sk_buff *skb)
 {
         struct ieee80211_tx_info *info;
         int timeout;
@@ -556,8 +556,9 @@ static inline int sta_info_buffer_expired(struct ieee80211_local *local,
         info = IEEE80211_SKB_CB(skb);
 
         /* Timeout: (2 * listen_interval * beacon_int * 1024 / 1000000) sec */
-        timeout = (sta->listen_interval * local->hw.conf.beacon_int * 32 /
-                   15625) * HZ;
+        timeout = (sta->listen_interval *
+                   sta->sdata->vif.bss_conf.beacon_int *
+                   32 / 15625) * HZ;
         if (timeout < STA_TX_BUFFER_EXPIRE)
                 timeout = STA_TX_BUFFER_EXPIRE;
         return time_after(jiffies, info->control.jiffies + timeout);
@@ -577,7 +578,7 @@ static void sta_info_cleanup_expire_buffered(struct ieee80211_local *local,
         for (;;) {
                 spin_lock_irqsave(&sta->ps_tx_buf.lock, flags);
                 skb = skb_peek(&sta->ps_tx_buf);
-                if (sta_info_buffer_expired(local, sta, skb))
+                if (sta_info_buffer_expired(sta, skb))
                         skb = __skb_dequeue(&sta->ps_tx_buf);
                 else
                         skb = NULL;
@@ -610,6 +611,9 @@ static void sta_info_cleanup(unsigned long data)
                 sta_info_cleanup_expire_buffered(local, sta);
         rcu_read_unlock();
 
+        if (local->quiescing)
+                return;
+
         local->sta_cleanup.expires =
                 round_jiffies(jiffies + STA_INFO_CLEANUP_INTERVAL);
         add_timer(&local->sta_cleanup);
@@ -686,41 +690,10 @@ static void sta_info_debugfs_add_work(struct work_struct *work)
 }
 #endif
 
-static void __ieee80211_run_pending_flush(struct ieee80211_local *local)
-{
-        struct sta_info *sta;
-        unsigned long flags;
-
-        ASSERT_RTNL();
-
-        spin_lock_irqsave(&local->sta_lock, flags);
-        while (!list_empty(&local->sta_flush_list)) {
-                sta = list_first_entry(&local->sta_flush_list,
-                                       struct sta_info, list);
-                list_del(&sta->list);
-                spin_unlock_irqrestore(&local->sta_lock, flags);
-                sta_info_destroy(sta);
-                spin_lock_irqsave(&local->sta_lock, flags);
-        }
-        spin_unlock_irqrestore(&local->sta_lock, flags);
-}
-
-static void ieee80211_sta_flush_work(struct work_struct *work)
-{
-        struct ieee80211_local *local =
-                container_of(work, struct ieee80211_local, sta_flush_work);
-
-        rtnl_lock();
-        __ieee80211_run_pending_flush(local);
-        rtnl_unlock();
-}
-
 void sta_info_init(struct ieee80211_local *local)
 {
         spin_lock_init(&local->sta_lock);
         INIT_LIST_HEAD(&local->sta_list);
-        INIT_LIST_HEAD(&local->sta_flush_list);
-        INIT_WORK(&local->sta_flush_work, ieee80211_sta_flush_work);
 
         setup_timer(&local->sta_cleanup, sta_info_cleanup,
                     (unsigned long)local);
@@ -741,7 +714,6 @@ int sta_info_start(struct ieee80211_local *local)
 void sta_info_stop(struct ieee80211_local *local)
 {
         del_timer(&local->sta_cleanup);
-        cancel_work_sync(&local->sta_flush_work);
 #ifdef CONFIG_MAC80211_DEBUGFS
         /*
          * Make sure the debugfs adding work isn't pending after this
@@ -752,10 +724,7 @@ void sta_info_stop(struct ieee80211_local *local)
         cancel_work_sync(&local->sta_debugfs_add);
 #endif
 
-        rtnl_lock();
         sta_info_flush(local, NULL);
-        __ieee80211_run_pending_flush(local);
-        rtnl_unlock();
 }
 
 /**
@@ -767,7 +736,7 @@ void sta_info_stop(struct ieee80211_local *local)
  * @sdata: matching rule for the net device (sta->dev) or %NULL to match all STAs
  */
 int sta_info_flush(struct ieee80211_local *local,
-                    struct ieee80211_sub_if_data *sdata)
+                   struct ieee80211_sub_if_data *sdata)
 {
         struct sta_info *sta, *tmp;
         LIST_HEAD(tmp_list);
@@ -775,7 +744,6 @@ int sta_info_flush(struct ieee80211_local *local,
         unsigned long flags;
 
         might_sleep();
-        ASSERT_RTNL();
 
         spin_lock_irqsave(&local->sta_lock, flags);
         list_for_each_entry_safe(sta, tmp, &local->sta_list, list) {
@@ -795,39 +763,6 @@ int sta_info_flush(struct ieee80211_local *local,
         return ret;
 }
 
-/**
- * sta_info_flush_delayed - flush matching STA entries from the STA table
- *
- * This function unlinks all stations for a given interface and queues
- * them for freeing. Note that the workqueue function scheduled here has
- * to run before any new keys can be added to the system to avoid set_key()
- * callback ordering issues.
- *
- * @sdata: the interface
- */
-void sta_info_flush_delayed(struct ieee80211_sub_if_data *sdata)
-{
-        struct ieee80211_local *local = sdata->local;
-        struct sta_info *sta, *tmp;
-        unsigned long flags;
-        bool work = false;
-
-        spin_lock_irqsave(&local->sta_lock, flags);
-        list_for_each_entry_safe(sta, tmp, &local->sta_list, list) {
-                if (sdata == sta->sdata) {
-                        __sta_info_unlink(&sta);
-                        if (sta) {
-                                list_add_tail(&sta->list,
-                                              &local->sta_flush_list);
-                                work = true;
-                        }
-                }
-        }
-        if (work)
-                schedule_work(&local->sta_flush_work);
-        spin_unlock_irqrestore(&local->sta_lock, flags);
-}
-
 void ieee80211_sta_expire(struct ieee80211_sub_if_data *sdata,
                           unsigned long exp_time)
 {
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index 5534d489f506..49a1a1f76511 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -88,6 +88,7 @@ struct tid_ampdu_tx {
  * struct tid_ampdu_rx - TID aggregation information (Rx).
  *
  * @reorder_buf: buffer to reorder incoming aggregated MPDUs
+ * @reorder_time: jiffies when skb was added
  * @session_timer: check if peer keeps Tx-ing on the TID (by timeout value)
  * @head_seq_num: head sequence number in reordering buffer.
  * @stored_mpdu_num: number of MPDUs in reordering buffer
@@ -99,6 +100,7 @@ struct tid_ampdu_tx {
  */
 struct tid_ampdu_rx {
         struct sk_buff **reorder_buf;
+        unsigned long *reorder_time;
         struct timer_list session_timer;
         u16 head_seq_num;
         u16 stored_mpdu_num;
@@ -214,6 +216,7 @@ struct sta_ampdu_mlme {
  * @plink_state: peer link state
  * @plink_timeout: timeout of peer link
  * @plink_timer: peer link watch timer
+ * @plink_timer_was_running: used by suspend/resume to restore timers
  * @debugfs: debug filesystem info
  * @sta: station information we share with the driver
  */
@@ -291,6 +294,7 @@ struct sta_info {
         __le16 reason;
         u8 plink_retries;
         bool ignore_plink_timer;
+        bool plink_timer_was_running;
         enum plink_state plink_state;
         u32 plink_timeout;
         struct timer_list plink_timer;
@@ -442,8 +446,7 @@ void sta_info_init(struct ieee80211_local *local);
 int sta_info_start(struct ieee80211_local *local);
 void sta_info_stop(struct ieee80211_local *local);
 int sta_info_flush(struct ieee80211_local *local,
-                    struct ieee80211_sub_if_data *sdata);
-void sta_info_flush_delayed(struct ieee80211_sub_if_data *sdata);
+                   struct ieee80211_sub_if_data *sdata);
 void ieee80211_sta_expire(struct ieee80211_sub_if_data *sdata,
                           unsigned long exp_time);
 
diff --git a/net/mac80211/tkip.c b/net/mac80211/tkip.c
index 38fa111d2dc6..964b7faa7f17 100644
--- a/net/mac80211/tkip.c
+++ b/net/mac80211/tkip.c
@@ -13,6 +13,7 @@
 #include <asm/unaligned.h>
 
 #include <net/mac80211.h>
+#include "driver-ops.h"
 #include "key.h"
 #include "tkip.h"
 #include "wep.h"
@@ -307,9 +308,8 @@ int ieee80211_tkip_decrypt_data(struct crypto_blkcipher *tfm,
                         if (is_multicast_ether_addr(ra))
                                 sta_addr = bcast;
 
-                        key->local->ops->update_tkip_key(
-                                local_to_hw(key->local), &key->conf,
-                                sta_addr, iv32, key->u.tkip.rx[queue].p1k);
+                        drv_update_tkip_key(key->local, &key->conf, sta_addr,
+                                            iv32, key->u.tkip.rx[queue].p1k);
                 }
         }
 
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 63656266d567..a910148b8228 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -25,6 +25,7 @@
 #include <asm/unaligned.h>
 
 #include "ieee80211_i.h"
+#include "driver-ops.h"
 #include "led.h"
 #include "mesh.h"
 #include "wep.h"
@@ -409,8 +410,24 @@ ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx)
                        sta->sta.addr);
         }
 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
-        clear_sta_flags(sta, WLAN_STA_PSPOLL);
+        if (test_and_clear_sta_flags(sta, WLAN_STA_PSPOLL)) {
+                /*
+                 * The sleeping station with pending data is now snoozing.
+                 * It queried us for its buffered frames and will go back
+                 * to deep sleep once it got everything.
+                 *
+                 * inform the driver, in case the hardware does powersave
+                 * frame filtering and keeps a station  blacklist on its own
+                 * (e.g: p54), so that frames can be delivered unimpeded.
+                 *
+                 * Note: It should be save to disable the filter now.
+                 * As, it is really unlikely that we still have any pending
+                 * frame for this station in the hw's buffers/fifos left,
+                 * that is not rejected with a unsuccessful tx_status yet.
+                 */
 
+                info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT;
+        }
         return TX_CONTINUE;
 }
 
@@ -429,7 +446,7 @@ ieee80211_tx_h_ps_buf(struct ieee80211_tx_data *tx)
 static ieee80211_tx_result debug_noinline
 ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx)
 {
-        struct ieee80211_key *key;
+        struct ieee80211_key *key = NULL;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
 
@@ -500,7 +517,7 @@ ieee80211_tx_h_rate_ctrl(struct ieee80211_tx_data *tx)
         sband = tx->local->hw.wiphy->bands[tx->channel->band];
 
         len = min_t(int, tx->skb->len + FCS_LEN,
-                         tx->local->fragmentation_threshold);
+                         tx->local->hw.wiphy->frag_threshold);
 
         /* set up the tx rate control struct we give the RC algo */
         txrc.hw = local_to_hw(tx->local);
@@ -511,8 +528,7 @@ ieee80211_tx_h_rate_ctrl(struct ieee80211_tx_data *tx)
         txrc.max_rate_idx = tx->sdata->max_ratectrl_rateidx;
 
         /* set up RTS protection if desired */
-        if (tx->local->rts_threshold < IEEE80211_MAX_RTS_THRESHOLD &&
-            len > tx->local->rts_threshold) {
+        if (len > tx->local->hw.wiphy->rts_threshold) {
                 txrc.rts = rts = true;
         }
 
@@ -542,6 +558,10 @@ ieee80211_tx_h_rate_ctrl(struct ieee80211_tx_data *tx)
         if (unlikely(!info->control.rates[0].count))
                 info->control.rates[0].count = 1;
 
+        if (WARN_ON_ONCE((info->control.rates[0].count > 1) &&
+                         (info->flags & IEEE80211_TX_CTL_NO_ACK)))
+                info->control.rates[0].count = 1;
+
         if (is_multicast_ether_addr(hdr->addr1)) {
                 /*
                  * XXX: verify the rate is in the basic rateset
@@ -754,7 +774,7 @@ ieee80211_tx_h_fragment(struct ieee80211_tx_data *tx)
         struct sk_buff *skb = tx->skb;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         struct ieee80211_hdr *hdr = (void *)skb->data;
-        int frag_threshold = tx->local->fragmentation_threshold;
+        int frag_threshold = tx->local->hw.wiphy->frag_threshold;
         int hdrlen;
         int fragnum;
 
@@ -852,6 +872,8 @@ ieee80211_tx_h_calculate_duration(struct ieee80211_tx_data *tx)
 
         do {
                 hdr = (void *) skb->data;
+                if (unlikely(ieee80211_is_pspoll(hdr->frame_control)))
+                        break; /* must not overwrite AID */
                 next_len = skb->next ? skb->next->len : 0;
                 group_addr = is_multicast_ether_addr(hdr->addr1);
 
@@ -1067,12 +1089,15 @@ __ieee80211_tx_prepare(struct ieee80211_tx_data *tx,
                 info->flags |= IEEE80211_TX_CTL_NO_ACK;
         } else {
                 tx->flags |= IEEE80211_TX_UNICAST;
-                info->flags &= ~IEEE80211_TX_CTL_NO_ACK;
+                if (unlikely(local->wifi_wme_noack_test))
+                        info->flags |= IEEE80211_TX_CTL_NO_ACK;
+                else
+                        info->flags &= ~IEEE80211_TX_CTL_NO_ACK;
         }
 
         if (tx->flags & IEEE80211_TX_FRAGMENTED) {
                 if ((tx->flags & IEEE80211_TX_UNICAST) &&
-                    skb->len + FCS_LEN > local->fragmentation_threshold &&
+                    skb->len + FCS_LEN > local->hw.wiphy->frag_threshold &&
                     !(info->flags & IEEE80211_TX_CTL_AMPDU))
                         tx->flags |= IEEE80211_TX_FRAGMENTED;
                 else
@@ -1147,7 +1172,7 @@ static int __ieee80211_tx(struct ieee80211_local *local,
 
                 next = skb->next;
                 len = skb->len;
-                ret = local->ops->tx(local_to_hw(local), skb);
+                ret = drv_tx(local, skb);
                 if (WARN_ON(ret != NETDEV_TX_OK && skb->len != len)) {
                         dev_kfree_skb(skb);
                         ret = NETDEV_TX_OK;
@@ -2086,18 +2111,18 @@ struct sk_buff *ieee80211_beacon_get(struct ieee80211_hw *hw,
         } else if (sdata->vif.type == NL80211_IFTYPE_ADHOC) {
                 struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
                 struct ieee80211_hdr *hdr;
+                struct sk_buff *presp = rcu_dereference(ifibss->presp);
 
-                if (!ifibss->probe_resp)
+                if (!presp)
                         goto out;
 
-                skb = skb_copy(ifibss->probe_resp, GFP_ATOMIC);
+                skb = skb_copy(presp, GFP_ATOMIC);
                 if (!skb)
                         goto out;
 
                 hdr = (struct ieee80211_hdr *) skb->data;
                 hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
                                                  IEEE80211_STYPE_BEACON);
-
         } else if (ieee80211_vif_is_mesh(&sdata->vif)) {
                 struct ieee80211_mgmt *mgmt;
                 u8 *pos;
@@ -2117,7 +2142,7 @@ struct sk_buff *ieee80211_beacon_get(struct ieee80211_hw *hw,
                 memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
                 /* BSSID is left zeroed, wildcard value */
                 mgmt->u.beacon.beacon_int =
-                        cpu_to_le16(local->hw.conf.beacon_int);
+                        cpu_to_le16(sdata->vif.bss_conf.beacon_int);
                 mgmt->u.beacon.capab_info = 0x0; /* 0x0 for MPs */
 
                 pos = skb_put(skb, 2);
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index fdf432f14554..949d857debd8 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -20,27 +20,21 @@
 #include <linux/if_arp.h>
 #include <linux/wireless.h>
 #include <linux/bitmap.h>
+#include <linux/crc32.h>
 #include <net/net_namespace.h>
 #include <net/cfg80211.h>
 #include <net/rtnetlink.h>
 
 #include "ieee80211_i.h"
+#include "driver-ops.h"
 #include "rate.h"
 #include "mesh.h"
 #include "wme.h"
+#include "led.h"
 
 /* privid for wiphys to determine whether they belong to us or not */
 void *mac80211_wiphy_privid = &mac80211_wiphy_privid;
 
-/* See IEEE 802.1H for LLC/SNAP encapsulation/decapsulation */
-/* Ethernet-II snap header (RFC1042 for most EtherTypes) */
-const unsigned char rfc1042_header[] __aligned(2) =
-        { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00 };
-
-/* Bridge-Tunnel header (for EtherTypes ETH_P_AARP and ETH_P_IPX) */
-const unsigned char bridge_tunnel_header[] __aligned(2) =
-        { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0xf8 };
-
 struct ieee80211_hw *wiphy_to_ieee80211_hw(struct wiphy *wiphy)
 {
         struct ieee80211_local *local;
@@ -100,70 +94,6 @@ u8 *ieee80211_get_bssid(struct ieee80211_hdr *hdr, size_t len,
         return NULL;
 }
 
-unsigned int ieee80211_hdrlen(__le16 fc)
-{
-        unsigned int hdrlen = 24;
-
-        if (ieee80211_is_data(fc)) {
-                if (ieee80211_has_a4(fc))
-                        hdrlen = 30;
-                if (ieee80211_is_data_qos(fc))
-                        hdrlen += IEEE80211_QOS_CTL_LEN;
-                goto out;
-        }
-
-        if (ieee80211_is_ctl(fc)) {
-                /*
-                 * ACK and CTS are 10 bytes, all others 16. To see how
-                 * to get this condition consider
-                 *   subtype mask:   0b0000000011110000 (0x00F0)
-                 *   ACK subtype:    0b0000000011010000 (0x00D0)
-                 *   CTS subtype:    0b0000000011000000 (0x00C0)
-                 *   bits that matter:         ^^^      (0x00E0)
-                 *   value of those: 0b0000000011000000 (0x00C0)
-                 */
-                if ((fc & cpu_to_le16(0x00E0)) == cpu_to_le16(0x00C0))
-                        hdrlen = 10;
-                else
-                        hdrlen = 16;
-        }
-out:
-        return hdrlen;
-}
-EXPORT_SYMBOL(ieee80211_hdrlen);
-
-unsigned int ieee80211_get_hdrlen_from_skb(const struct sk_buff *skb)
-{
-        const struct ieee80211_hdr *hdr = (const struct ieee80211_hdr *)skb->data;
-        unsigned int hdrlen;
-
-        if (unlikely(skb->len < 10))
-                return 0;
-        hdrlen = ieee80211_hdrlen(hdr->frame_control);
-        if (unlikely(hdrlen > skb->len))
-                return 0;
-        return hdrlen;
-}
-EXPORT_SYMBOL(ieee80211_get_hdrlen_from_skb);
-
-int ieee80211_get_mesh_hdrlen(struct ieee80211s_hdr *meshhdr)
-{
-        int ae = meshhdr->flags & IEEE80211S_FLAGS_AE;
-        /* 7.1.3.5a.2 */
-        switch (ae) {
-        case 0:
-                return 6;
-        case 1:
-                return 12;
-        case 2:
-                return 18;
-        case 3:
-                return 24;
-        default:
-                return 6;
-        }
-}
-
 void ieee80211_tx_set_protected(struct ieee80211_tx_data *tx)
 {
         struct sk_buff *skb = tx->skb;
@@ -536,8 +466,16 @@ EXPORT_SYMBOL_GPL(ieee80211_iterate_active_interfaces_atomic);
 void ieee802_11_parse_elems(u8 *start, size_t len,
                             struct ieee802_11_elems *elems)
 {
+        ieee802_11_parse_elems_crc(start, len, elems, 0, 0);
+}
+
+u32 ieee802_11_parse_elems_crc(u8 *start, size_t len,
+                               struct ieee802_11_elems *elems,
+                               u64 filter, u32 crc)
+{
         size_t left = len;
         u8 *pos = start;
+        bool calc_crc = filter != 0;
 
         memset(elems, 0, sizeof(*elems));
         elems->ie_start = start;
@@ -551,7 +489,10 @@ void ieee802_11_parse_elems(u8 *start, size_t len,
                 left -= 2;
 
                 if (elen > left)
-                        return;
+                        break;
+
+                if (calc_crc && id < 64 && (filter & BIT(id)))
+                        crc = crc32_be(crc, pos - 2, elen + 2);
 
                 switch (id) {
                 case WLAN_EID_SSID:
@@ -575,8 +516,10 @@ void ieee802_11_parse_elems(u8 *start, size_t len,
                         elems->cf_params_len = elen;
                         break;
                 case WLAN_EID_TIM:
-                        elems->tim = pos;
-                        elems->tim_len = elen;
+                        if (elen >= sizeof(struct ieee80211_tim_ie)) {
+                                elems->tim = (void *)pos;
+                                elems->tim_len = elen;
+                        }
                         break;
                 case WLAN_EID_IBSS_PARAMS:
                         elems->ibss_params = pos;
@@ -586,15 +529,20 @@ void ieee802_11_parse_elems(u8 *start, size_t len,
                         elems->challenge = pos;
                         elems->challenge_len = elen;
                         break;
-                case WLAN_EID_WPA:
+                case WLAN_EID_VENDOR_SPECIFIC:
                         if (elen >= 4 && pos[0] == 0x00 && pos[1] == 0x50 &&
                             pos[2] == 0xf2) {
                                 /* Microsoft OUI (00:50:F2) */
+
+                                if (calc_crc)
+                                        crc = crc32_be(crc, pos - 2, elen + 2);
+
                                 if (pos[3] == 1) {
                                         /* OUI Type 1 - WPA IE */
                                         elems->wpa = pos;
                                         elems->wpa_len = elen;
                                 } else if (elen >= 5 && pos[3] == 2) {
+                                        /* OUI Type 2 - WMM IE */
                                         if (pos[4] == 0) {
                                                 elems->wmm_info = pos;
                                                 elems->wmm_info_len = elen;
@@ -679,32 +627,70 @@ void ieee802_11_parse_elems(u8 *start, size_t len,
                 left -= elen;
                 pos += elen;
         }
+
+        return crc;
 }
 
 void ieee80211_set_wmm_default(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_tx_queue_params qparam;
-        int i;
+        int queue;
+        bool use_11b;
+        int aCWmin, aCWmax;
 
         if (!local->ops->conf_tx)
                 return;
 
         memset(&qparam, 0, sizeof(qparam));
 
-        qparam.aifs = 2;
+        use_11b = (local->hw.conf.channel->band == IEEE80211_BAND_2GHZ) &&
+                 !(sdata->flags & IEEE80211_SDATA_OPERATING_GMODE);
 
-        if (local->hw.conf.channel->band == IEEE80211_BAND_2GHZ &&
-            !(sdata->flags & IEEE80211_SDATA_OPERATING_GMODE))
-                qparam.cw_min = 31;
-        else
-                qparam.cw_min = 15;
-
-        qparam.cw_max = 1023;
-        qparam.txop = 0;
+        for (queue = 0; queue < local_to_hw(local)->queues; queue++) {
+                /* Set defaults according to 802.11-2007 Table 7-37 */
+                aCWmax = 1023;
+                if (use_11b)
+                        aCWmin = 31;
+                else
+                        aCWmin = 15;
+
+                switch (queue) {
+                case 3: /* AC_BK */
+                        qparam.cw_max = aCWmin;
+                        qparam.cw_min = aCWmax;
+                        qparam.txop = 0;
+                        qparam.aifs = 7;
+                        break;
+                default: /* never happens but let's not leave undefined */
+                case 2: /* AC_BE */
+                        qparam.cw_max = aCWmin;
+                        qparam.cw_min = aCWmax;
+                        qparam.txop = 0;
+                        qparam.aifs = 3;
+                        break;
+                case 1: /* AC_VI */
+                        qparam.cw_max = aCWmin;
+                        qparam.cw_min = (aCWmin + 1) / 2 - 1;
+                        if (use_11b)
+                                qparam.txop = 6016/32;
+                        else
+                                qparam.txop = 3008/32;
+                        qparam.aifs = 2;
+                        break;
+                case 0: /* AC_VO */
+                        qparam.cw_max = (aCWmin + 1) / 2 - 1;
+                        qparam.cw_min = (aCWmin + 1) / 4 - 1;
+                        if (use_11b)
+                                qparam.txop = 3264/32;
+                        else
+                                qparam.txop = 1504/32;
+                        qparam.aifs = 2;
+                        break;
+                }
 
-        for (i = 0; i < local_to_hw(local)->queues; i++)
-                local->ops->conf_tx(local_to_hw(local), i, &qparam);
+                drv_conf_tx(local, queue, &qparam);
+        }
 }
 
 void ieee80211_sta_def_wmm_params(struct ieee80211_sub_if_data *sdata,
@@ -831,16 +817,73 @@ void ieee80211_send_auth(struct ieee80211_sub_if_data *sdata,
         ieee80211_tx_skb(sdata, skb, encrypt);
 }
 
+int ieee80211_build_preq_ies(struct ieee80211_local *local, u8 *buffer,
+                             const u8 *ie, size_t ie_len)
+{
+        struct ieee80211_supported_band *sband;
+        u8 *pos, *supp_rates_len, *esupp_rates_len = NULL;
+        int i;
+
+        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
+
+        pos = buffer;
+
+        *pos++ = WLAN_EID_SUPP_RATES;
+        supp_rates_len = pos;
+        *pos++ = 0;
+
+        for (i = 0; i < sband->n_bitrates; i++) {
+                struct ieee80211_rate *rate = &sband->bitrates[i];
+
+                if (esupp_rates_len) {
+                        *esupp_rates_len += 1;
+                } else if (*supp_rates_len == 8) {
+                        *pos++ = WLAN_EID_EXT_SUPP_RATES;
+                        esupp_rates_len = pos;
+                        *pos++ = 1;
+                } else
+                        *supp_rates_len += 1;
+
+                *pos++ = rate->bitrate / 5;
+        }
+
+        if (sband->ht_cap.ht_supported) {
+                __le16 tmp = cpu_to_le16(sband->ht_cap.cap);
+
+                *pos++ = WLAN_EID_HT_CAPABILITY;
+                *pos++ = sizeof(struct ieee80211_ht_cap);
+                memset(pos, 0, sizeof(struct ieee80211_ht_cap));
+                memcpy(pos, &tmp, sizeof(u16));
+                pos += sizeof(u16);
+                /* TODO: needs a define here for << 2 */
+                *pos++ = sband->ht_cap.ampdu_factor |
+                         (sband->ht_cap.ampdu_density << 2);
+                memcpy(pos, &sband->ht_cap.mcs, sizeof(sband->ht_cap.mcs));
+                pos += sizeof(sband->ht_cap.mcs);
+                pos += 2 + 4 + 1; /* ext info, BF cap, antsel */
+        }
+
+        /*
+         * If adding more here, adjust code in main.c
+         * that calculates local->scan_ies_len.
+         */
+
+        if (ie) {
+                memcpy(pos, ie, ie_len);
+                pos += ie_len;
+        }
+
+        return pos - buffer;
+}
+
 void ieee80211_send_probe_req(struct ieee80211_sub_if_data *sdata, u8 *dst,
-                              u8 *ssid, size_t ssid_len,
-                              u8 *ie, size_t ie_len)
+                              const u8 *ssid, size_t ssid_len,
+                              const u8 *ie, size_t ie_len)
 {
         struct ieee80211_local *local = sdata->local;
-        struct ieee80211_supported_band *sband;
         struct sk_buff *skb;
         struct ieee80211_mgmt *mgmt;
-        u8 *pos, *supp_rates, *esupp_rates = NULL;
-        int i;
+        u8 *pos;
 
         skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*mgmt) + 200 +
                             ie_len);
@@ -867,31 +910,9 @@ void ieee80211_send_probe_req(struct ieee80211_sub_if_data *sdata, u8 *dst,
         *pos++ = WLAN_EID_SSID;
         *pos++ = ssid_len;
         memcpy(pos, ssid, ssid_len);
+        pos += ssid_len;
 
-        supp_rates = skb_put(skb, 2);
-        supp_rates[0] = WLAN_EID_SUPP_RATES;
-        supp_rates[1] = 0;
-        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
-
-        for (i = 0; i < sband->n_bitrates; i++) {
-                struct ieee80211_rate *rate = &sband->bitrates[i];
-                if (esupp_rates) {
-                        pos = skb_put(skb, 1);
-                        esupp_rates[1]++;
-                } else if (supp_rates[1] == 8) {
-                        esupp_rates = skb_put(skb, 3);
-                        esupp_rates[0] = WLAN_EID_EXT_SUPP_RATES;
-                        esupp_rates[1] = 1;
-                        pos = &esupp_rates[2];
-                } else {
-                        pos = skb_put(skb, 1);
-                        supp_rates[1]++;
-                }
-                *pos = rate->bitrate / 5;
-        }
-
-        if (ie)
-                memcpy(skb_put(skb, ie_len), ie, ie_len);
+        skb_put(skb, ieee80211_build_preq_ies(local, pos, ie, ie_len));
 
         ieee80211_tx_skb(sdata, skb, 0);
 }
@@ -931,3 +952,151 @@ u32 ieee80211_sta_get_rates(struct ieee80211_local *local,
         }
         return supp_rates;
 }
+
+int ieee80211_reconfig(struct ieee80211_local *local)
+{
+        struct ieee80211_hw *hw = &local->hw;
+        struct ieee80211_sub_if_data *sdata;
+        struct ieee80211_if_init_conf conf;
+        struct sta_info *sta;
+        unsigned long flags;
+        int res;
+        bool from_suspend = local->suspended;
+
+        /*
+         * We're going to start the hardware, at that point
+         * we are no longer suspended and can RX frames.
+         */
+        local->suspended = false;
+
+        /* restart hardware */
+        if (local->open_count) {
+                res = drv_start(local);
+
+                ieee80211_led_radio(local, hw->conf.radio_enabled);
+        }
+
+        /* add interfaces */
+        list_for_each_entry(sdata, &local->interfaces, list) {
+                if (sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
+                    sdata->vif.type != NL80211_IFTYPE_MONITOR &&
+                    netif_running(sdata->dev)) {
+                        conf.vif = &sdata->vif;
+                        conf.type = sdata->vif.type;
+                        conf.mac_addr = sdata->dev->dev_addr;
+                        res = drv_add_interface(local, &conf);
+                }
+        }
+
+        /* add STAs back */
+        if (local->ops->sta_notify) {
+                spin_lock_irqsave(&local->sta_lock, flags);
+                list_for_each_entry(sta, &local->sta_list, list) {
+                        sdata = sta->sdata;
+                        if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
+                                sdata = container_of(sdata->bss,
+                                             struct ieee80211_sub_if_data,
+                                             u.ap);
+
+                        drv_sta_notify(local, &sdata->vif, STA_NOTIFY_ADD,
+                                       &sta->sta);
+                }
+                spin_unlock_irqrestore(&local->sta_lock, flags);
+        }
+
+        /* Clear Suspend state so that ADDBA requests can be processed */
+
+        rcu_read_lock();
+
+        if (hw->flags & IEEE80211_HW_AMPDU_AGGREGATION) {
+                list_for_each_entry_rcu(sta, &local->sta_list, list) {
+                        clear_sta_flags(sta, WLAN_STA_SUSPEND);
+                }
+        }
+
+        rcu_read_unlock();
+
+        /* setup RTS threshold */
+        drv_set_rts_threshold(local, hw->wiphy->rts_threshold);
+
+        /* reconfigure hardware */
+        ieee80211_hw_config(local, ~0);
+
+        netif_addr_lock_bh(local->mdev);
+        ieee80211_configure_filter(local);
+        netif_addr_unlock_bh(local->mdev);
+
+        /* Finally also reconfigure all the BSS information */
+        list_for_each_entry(sdata, &local->interfaces, list) {
+                u32 changed = ~0;
+                if (!netif_running(sdata->dev))
+                        continue;
+                switch (sdata->vif.type) {
+                case NL80211_IFTYPE_STATION:
+                        /* disable beacon change bits */
+                        changed &= ~(BSS_CHANGED_BEACON |
+                                     BSS_CHANGED_BEACON_ENABLED);
+                        /* fall through */
+                case NL80211_IFTYPE_ADHOC:
+                case NL80211_IFTYPE_AP:
+                case NL80211_IFTYPE_MESH_POINT:
+                        ieee80211_bss_info_change_notify(sdata, changed);
+                        break;
+                case NL80211_IFTYPE_WDS:
+                        break;
+                case NL80211_IFTYPE_AP_VLAN:
+                case NL80211_IFTYPE_MONITOR:
+                        /* ignore virtual */
+                        break;
+                case NL80211_IFTYPE_UNSPECIFIED:
+                case __NL80211_IFTYPE_AFTER_LAST:
+                        WARN_ON(1);
+                        break;
+                }
+        }
+
+        /* add back keys */
+        list_for_each_entry(sdata, &local->interfaces, list)
+                if (netif_running(sdata->dev))
+                        ieee80211_enable_keys(sdata);
+
+        ieee80211_wake_queues_by_reason(hw,
+                        IEEE80211_QUEUE_STOP_REASON_SUSPEND);
+
+        /*
+         * If this is for hw restart things are still running.
+         * We may want to change that later, however.
+         */
+        if (!from_suspend)
+                return 0;
+
+#ifdef CONFIG_PM
+        local->suspended = false;
+
+        list_for_each_entry(sdata, &local->interfaces, list) {
+                switch(sdata->vif.type) {
+                case NL80211_IFTYPE_STATION:
+                        ieee80211_sta_restart(sdata);
+                        break;
+                case NL80211_IFTYPE_ADHOC:
+                        ieee80211_ibss_restart(sdata);
+                        break;
+                case NL80211_IFTYPE_MESH_POINT:
+                        ieee80211_mesh_restart(sdata);
+                        break;
+                default:
+                        break;
+                }
+        }
+
+        add_timer(&local->sta_cleanup);
+
+        spin_lock_irqsave(&local->sta_lock, flags);
+        list_for_each_entry(sta, &local->sta_list, list)
+                mesh_plink_restart(sta);
+        spin_unlock_irqrestore(&local->sta_lock, flags);
+#else
+        WARN_ON(1);
+#endif
+        return 0;
+}
diff --git a/net/mac80211/wext.c b/net/mac80211/wext.c
index 959aa8379ccf..a01154e127f0 100644
--- a/net/mac80211/wext.c
+++ b/net/mac80211/wext.c
@@ -27,100 +27,6 @@
 #include "aes_ccm.h"
 
 
-static int ieee80211_set_encryption(struct ieee80211_sub_if_data *sdata, u8 *sta_addr,
-                                    int idx, int alg, int remove,
-                                    int set_tx_key, const u8 *_key,
-                                    size_t key_len)
-{
-        struct ieee80211_local *local = sdata->local;
-        struct sta_info *sta;
-        struct ieee80211_key *key;
-        int err;
-
-        if (alg == ALG_AES_CMAC) {
-                if (idx < NUM_DEFAULT_KEYS ||
-                    idx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS) {
-                        printk(KERN_DEBUG "%s: set_encrypt - invalid idx=%d "
-                               "(BIP)\n", sdata->dev->name, idx);
-                        return -EINVAL;
-                }
-        } else if (idx < 0 || idx >= NUM_DEFAULT_KEYS) {
-                printk(KERN_DEBUG "%s: set_encrypt - invalid idx=%d\n",
-                       sdata->dev->name, idx);
-                return -EINVAL;
-        }
-
-        if (remove) {
-                rcu_read_lock();
-
-                err = 0;
-
-                if (is_broadcast_ether_addr(sta_addr)) {
-                        key = sdata->keys[idx];
-                } else {
-                        sta = sta_info_get(local, sta_addr);
-                        if (!sta) {
-                                err = -ENOENT;
-                                goto out_unlock;
-                        }
-                        key = sta->key;
-                }
-
-                ieee80211_key_free(key);
-        } else {
-                key = ieee80211_key_alloc(alg, idx, key_len, _key);
-                if (!key)
-                        return -ENOMEM;
-
-                sta = NULL;
-                err = 0;
-
-                rcu_read_lock();
-
-                if (!is_broadcast_ether_addr(sta_addr)) {
-                        set_tx_key = 0;
-                        /*
-                         * According to the standard, the key index of a
-                         * pairwise key must be zero. However, some AP are
-                         * broken when it comes to WEP key indices, so we
-                         * work around this.
-                         */
-                        if (idx != 0 && alg != ALG_WEP) {
-                                ieee80211_key_free(key);
-                                err = -EINVAL;
-                                goto out_unlock;
-                        }
-
-                        sta = sta_info_get(local, sta_addr);
-                        if (!sta) {
-                                ieee80211_key_free(key);
-                                err = -ENOENT;
-                                goto out_unlock;
-                        }
-                }
-
-                if (alg == ALG_WEP &&
-                        key_len != LEN_WEP40 && key_len != LEN_WEP104) {
-                        ieee80211_key_free(key);
-                        err = -EINVAL;
-                        goto out_unlock;
-                }
-
-                ieee80211_key_link(key, sdata, sta);
-
-                if (set_tx_key || (!sta && !sdata->default_key && key))
-                        ieee80211_set_default_key(sdata, idx);
-                if (alg == ALG_AES_CMAC &&
-                    (set_tx_key || (!sta && !sdata->default_mgmt_key && key)))
-                        ieee80211_set_default_mgmt_key(sdata, idx);
-        }
-
- out_unlock:
-        rcu_read_unlock();
-
-        return err;
-}
-
 static int ieee80211_ioctl_siwgenie(struct net_device *dev,
                                     struct iw_request_info *info,
                                     struct iw_point *data, char *extra)
@@ -131,11 +37,13 @@ static int ieee80211_ioctl_siwgenie(struct net_device *dev,
 
         if (sdata->vif.type == NL80211_IFTYPE_STATION) {
                 int ret = ieee80211_sta_set_extra_ie(sdata, extra, data->length);
-                if (ret)
+                if (ret && ret != -EALREADY)
                         return ret;
                 sdata->u.mgd.flags &= ~IEEE80211_STA_AUTO_BSSID_SEL;
                 sdata->u.mgd.flags &= ~IEEE80211_STA_EXT_SME;
-                ieee80211_sta_req_auth(sdata);
+                sdata->u.mgd.flags &= ~IEEE80211_STA_CONTROL_PORT;
+                if (ret != -EALREADY)
+                        ieee80211_sta_req_auth(sdata);
                 return 0;
         }
 
@@ -149,17 +57,14 @@ static int ieee80211_ioctl_siwfreq(struct net_device *dev,
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
         if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
-                sdata->u.ibss.flags &= ~IEEE80211_IBSS_AUTO_CHANNEL_SEL;
+                return cfg80211_ibss_wext_siwfreq(dev, info, freq, extra);
         else if (sdata->vif.type == NL80211_IFTYPE_STATION)
                 sdata->u.mgd.flags &= ~IEEE80211_STA_AUTO_CHANNEL_SEL;
 
         /* freq->e == 0: freq->m = channel; otherwise freq = m * 10^e */
         if (freq->e == 0) {
                 if (freq->m < 0) {
-                        if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
-                                sdata->u.ibss.flags |=
-                                        IEEE80211_IBSS_AUTO_CHANNEL_SEL;
-                        else if (sdata->vif.type == NL80211_IFTYPE_STATION)
+                        if (sdata->vif.type == NL80211_IFTYPE_STATION)
                                 sdata->u.mgd.flags |=
                                         IEEE80211_STA_AUTO_CHANNEL_SEL;
                         return 0;
@@ -183,8 +88,12 @@ static int ieee80211_ioctl_giwfreq(struct net_device *dev,
                                    struct iw_freq *freq, char *extra)
 {
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
-        freq->m = local->hw.conf.channel->center_freq;
+        if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
+                return cfg80211_ibss_wext_giwfreq(dev, info, freq, extra);
+
+        freq->m = local->oper_channel->center_freq;
         freq->e = 6;
 
         return 0;
@@ -195,15 +104,17 @@ static int ieee80211_ioctl_siwessid(struct net_device *dev,
                                     struct iw_request_info *info,
                                     struct iw_point *data, char *ssid)
 {
-        struct ieee80211_sub_if_data *sdata;
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         size_t len = data->length;
         int ret;
 
+        if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
+                return cfg80211_ibss_wext_siwessid(dev, info, data, ssid);
+
         /* iwconfig uses nul termination in SSID.. */
         if (len > 0 && ssid[len - 1] == '\0')
                 len--;
 
-        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         if (sdata->vif.type == NL80211_IFTYPE_STATION) {
                 if (data->flags)
                         sdata->u.mgd.flags &= ~IEEE80211_STA_AUTO_SSID_SEL;
@@ -215,10 +126,10 @@ static int ieee80211_ioctl_siwessid(struct net_device *dev,
                         return ret;
 
                 sdata->u.mgd.flags &= ~IEEE80211_STA_EXT_SME;
+                sdata->u.mgd.flags &= ~IEEE80211_STA_CONTROL_PORT;
                 ieee80211_sta_req_auth(sdata);
                 return 0;
-        } else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
-                return ieee80211_ibss_set_ssid(sdata, ssid, len);
+        }
 
         return -EOPNOTSUPP;
 }
@@ -229,9 +140,13 @@ static int ieee80211_ioctl_giwessid(struct net_device *dev,
                                     struct iw_point *data, char *ssid)
 {
         size_t len;
-
         struct ieee80211_sub_if_data *sdata;
+
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+
+        if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
+                return cfg80211_ibss_wext_giwessid(dev, info, data, ssid);
+
         if (sdata->vif.type == NL80211_IFTYPE_STATION) {
                 int res = ieee80211_sta_get_ssid(sdata, ssid, &len);
                 if (res == 0) {
@@ -240,14 +155,6 @@ static int ieee80211_ioctl_giwessid(struct net_device *dev,
                 } else
                         data->flags = 0;
                 return res;
-        } else if (sdata->vif.type == NL80211_IFTYPE_ADHOC) {
-                int res = ieee80211_ibss_get_ssid(sdata, ssid, &len);
-                if (res == 0) {
-                        data->length = len;
-                        data->flags = 1;
-                } else
-                        data->flags = 0;
-                return res;
         }
 
         return -EOPNOTSUPP;
@@ -258,9 +165,11 @@ static int ieee80211_ioctl_siwap(struct net_device *dev,
                                  struct iw_request_info *info,
                                  struct sockaddr *ap_addr, char *extra)
 {
-        struct ieee80211_sub_if_data *sdata;
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+
+        if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
+                return cfg80211_ibss_wext_siwap(dev, info, ap_addr, extra);
 
-        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         if (sdata->vif.type == NL80211_IFTYPE_STATION) {
                 int ret;
 
@@ -275,18 +184,9 @@ static int ieee80211_ioctl_siwap(struct net_device *dev,
                 if (ret)
                         return ret;
                 sdata->u.mgd.flags &= ~IEEE80211_STA_EXT_SME;
+                sdata->u.mgd.flags &= ~IEEE80211_STA_CONTROL_PORT;
                 ieee80211_sta_req_auth(sdata);
                 return 0;
-        } else if (sdata->vif.type == NL80211_IFTYPE_ADHOC) {
-                if (is_zero_ether_addr((u8 *) &ap_addr->sa_data))
-                        sdata->u.ibss.flags |= IEEE80211_IBSS_AUTO_BSSID_SEL |
-                                               IEEE80211_IBSS_AUTO_CHANNEL_SEL;
-                else if (is_broadcast_ether_addr((u8 *) &ap_addr->sa_data))
-                        sdata->u.ibss.flags |= IEEE80211_IBSS_AUTO_BSSID_SEL;
-                else
-                        sdata->u.ibss.flags &= ~IEEE80211_IBSS_AUTO_BSSID_SEL;
-
-                return ieee80211_ibss_set_bssid(sdata, (u8 *) &ap_addr->sa_data);
         } else if (sdata->vif.type == NL80211_IFTYPE_WDS) {
                 /*
                  * If it is necessary to update the WDS peer address
@@ -312,9 +212,11 @@ static int ieee80211_ioctl_giwap(struct net_device *dev,
                                  struct iw_request_info *info,
                                  struct sockaddr *ap_addr, char *extra)
 {
-        struct ieee80211_sub_if_data *sdata;
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+
+        if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
+                return cfg80211_ibss_wext_giwap(dev, info, ap_addr, extra);
 
-        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         if (sdata->vif.type == NL80211_IFTYPE_STATION) {
                 if (sdata->u.mgd.state == IEEE80211_STA_MLME_ASSOCIATED) {
                         ap_addr->sa_family = ARPHRD_ETHER;
@@ -322,13 +224,6 @@ static int ieee80211_ioctl_giwap(struct net_device *dev,
                 } else
                         memset(&ap_addr->sa_data, 0, ETH_ALEN);
                 return 0;
-        } else if (sdata->vif.type == NL80211_IFTYPE_ADHOC) {
-                if (sdata->u.ibss.state == IEEE80211_IBSS_MLME_JOINED) {
-                        ap_addr->sa_family = ARPHRD_ETHER;
-                        memcpy(&ap_addr->sa_data, sdata->u.ibss.bssid, ETH_ALEN);
-                } else
-                        memset(&ap_addr->sa_data, 0, ETH_ALEN);
-                return 0;
         } else if (sdata->vif.type == NL80211_IFTYPE_WDS) {
                 ap_addr->sa_family = ARPHRD_ETHER;
                 memcpy(&ap_addr->sa_data, sdata->u.wds.remote_addr, ETH_ALEN);
@@ -487,258 +382,6 @@ static int ieee80211_ioctl_giwtxpower(struct net_device *dev,
         return 0;
 }
 
-static int ieee80211_ioctl_siwrts(struct net_device *dev,
-                                  struct iw_request_info *info,
-                                  struct iw_param *rts, char *extra)
-{
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-
-        if (rts->disabled)
-                local->rts_threshold = IEEE80211_MAX_RTS_THRESHOLD;
-        else if (!rts->fixed)
-                /* if the rts value is not fixed, then take default */
-                local->rts_threshold = IEEE80211_MAX_RTS_THRESHOLD;
-        else if (rts->value < 0 || rts->value > IEEE80211_MAX_RTS_THRESHOLD)
-                return -EINVAL;
-        else
-                local->rts_threshold = rts->value;
-
-        /* If the wlan card performs RTS/CTS in hardware/firmware,
-         * configure it here */
-
-        if (local->ops->set_rts_threshold)
-                local->ops->set_rts_threshold(local_to_hw(local),
-                                             local->rts_threshold);
-
-        return 0;
-}
-
-static int ieee80211_ioctl_giwrts(struct net_device *dev,
-                                  struct iw_request_info *info,
-                                  struct iw_param *rts, char *extra)
-{
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-
-        rts->value = local->rts_threshold;
-        rts->disabled = (rts->value >= IEEE80211_MAX_RTS_THRESHOLD);
-        rts->fixed = 1;
-
-        return 0;
-}
-
-
-static int ieee80211_ioctl_siwfrag(struct net_device *dev,
-                                   struct iw_request_info *info,
-                                   struct iw_param *frag, char *extra)
-{
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-
-        if (frag->disabled)
-                local->fragmentation_threshold = IEEE80211_MAX_FRAG_THRESHOLD;
-        else if (!frag->fixed)
-                local->fragmentation_threshold = IEEE80211_MAX_FRAG_THRESHOLD;
-        else if (frag->value < 256 ||
-                 frag->value > IEEE80211_MAX_FRAG_THRESHOLD)
-                return -EINVAL;
-        else {
-                /* Fragment length must be even, so strip LSB. */
-                local->fragmentation_threshold = frag->value & ~0x1;
-        }
-
-        return 0;
-}
-
-static int ieee80211_ioctl_giwfrag(struct net_device *dev,
-                                   struct iw_request_info *info,
-                                   struct iw_param *frag, char *extra)
-{
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-
-        frag->value = local->fragmentation_threshold;
-        frag->disabled = (frag->value >= IEEE80211_MAX_FRAG_THRESHOLD);
-        frag->fixed = 1;
-
-        return 0;
-}
-
-
-static int ieee80211_ioctl_siwretry(struct net_device *dev,
-                                    struct iw_request_info *info,
-                                    struct iw_param *retry, char *extra)
-{
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-
-        if (retry->disabled ||
-            (retry->flags & IW_RETRY_TYPE) != IW_RETRY_LIMIT)
-                return -EINVAL;
-
-        if (retry->flags & IW_RETRY_MAX) {
-                local->hw.conf.long_frame_max_tx_count = retry->value;
-        } else if (retry->flags & IW_RETRY_MIN) {
-                local->hw.conf.short_frame_max_tx_count = retry->value;
-        } else {
-                local->hw.conf.long_frame_max_tx_count = retry->value;
-                local->hw.conf.short_frame_max_tx_count = retry->value;
-        }
-
-        ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_RETRY_LIMITS);
-
-        return 0;
-}
-
-
-static int ieee80211_ioctl_giwretry(struct net_device *dev,
-                                    struct iw_request_info *info,
-                                    struct iw_param *retry, char *extra)
-{
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-
-        retry->disabled = 0;
-        if (retry->flags == 0 || retry->flags & IW_RETRY_MIN) {
-                /* first return min value, iwconfig will ask max value
-                 * later if needed */
-                retry->flags |= IW_RETRY_LIMIT;
-                retry->value = local->hw.conf.short_frame_max_tx_count;
-                if (local->hw.conf.long_frame_max_tx_count !=
-                    local->hw.conf.short_frame_max_tx_count)
-                        retry->flags |= IW_RETRY_MIN;
-                return 0;
-        }
-        if (retry->flags & IW_RETRY_MAX) {
-                retry->flags = IW_RETRY_LIMIT | IW_RETRY_MAX;
-                retry->value = local->hw.conf.long_frame_max_tx_count;
-        }
-
-        return 0;
-}
-
-static int ieee80211_ioctl_siwmlme(struct net_device *dev,
-                                   struct iw_request_info *info,
-                                   struct iw_point *data, char *extra)
-{
-        struct ieee80211_sub_if_data *sdata;
-        struct iw_mlme *mlme = (struct iw_mlme *) extra;
-
-        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        if (!(sdata->vif.type == NL80211_IFTYPE_STATION))
-                return -EINVAL;
-
-        switch (mlme->cmd) {
-        case IW_MLME_DEAUTH:
-                /* TODO: mlme->addr.sa_data */
-                return ieee80211_sta_deauthenticate(sdata, mlme->reason_code);
-        case IW_MLME_DISASSOC:
-                /* TODO: mlme->addr.sa_data */
-                return ieee80211_sta_disassociate(sdata, mlme->reason_code);
-        default:
-                return -EOPNOTSUPP;
-        }
-}
-
-
-static int ieee80211_ioctl_siwencode(struct net_device *dev,
-                                     struct iw_request_info *info,
-                                     struct iw_point *erq, char *keybuf)
-{
-        struct ieee80211_sub_if_data *sdata;
-        int idx, i, alg = ALG_WEP;
-        u8 bcaddr[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
-        int remove = 0, ret;
-
-        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-
-        idx = erq->flags & IW_ENCODE_INDEX;
-        if (idx == 0) {
-                if (sdata->default_key)
-                        for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
-                                if (sdata->default_key == sdata->keys[i]) {
-                                        idx = i;
-                                        break;
-                                }
-                        }
-        } else if (idx < 1 || idx > 4)
-                return -EINVAL;
-        else
-                idx--;
-
-        if (erq->flags & IW_ENCODE_DISABLED)
-                remove = 1;
-        else if (erq->length == 0) {
-                /* No key data - just set the default TX key index */
-                ieee80211_set_default_key(sdata, idx);
-                return 0;
-        }
-
-        ret = ieee80211_set_encryption(
-                sdata, bcaddr,
-                idx, alg, remove,
-                !sdata->default_key,
-                keybuf, erq->length);
-
-        if (!ret) {
-                if (remove)
-                        sdata->u.mgd.flags &= ~IEEE80211_STA_TKIP_WEP_USED;
-                else
-                        sdata->u.mgd.flags |= IEEE80211_STA_TKIP_WEP_USED;
-        }
-
-        return ret;
-}
-
-
-static int ieee80211_ioctl_giwencode(struct net_device *dev,
-                                     struct iw_request_info *info,
-                                     struct iw_point *erq, char *key)
-{
-        struct ieee80211_sub_if_data *sdata;
-        int idx, i;
-
-        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-
-        idx = erq->flags & IW_ENCODE_INDEX;
-        if (idx < 1 || idx > 4) {
-                idx = -1;
-                if (!sdata->default_key)
-                        idx = 0;
-                else for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
-                        if (sdata->default_key == sdata->keys[i]) {
-                                idx = i;
-                                break;
-                        }
-                }
-                if (idx < 0)
-                        return -EINVAL;
-        } else
-                idx--;
-
-        erq->flags = idx + 1;
-
-        if (!sdata->keys[idx]) {
-                erq->length = 0;
-                erq->flags |= IW_ENCODE_DISABLED;
-                return 0;
-        }
-
-        memcpy(key, sdata->keys[idx]->conf.key,
-               min_t(int, erq->length, sdata->keys[idx]->conf.keylen));
-        erq->length = sdata->keys[idx]->conf.keylen;
-        erq->flags |= IW_ENCODE_ENABLED;
-
-        if (sdata->vif.type == NL80211_IFTYPE_STATION) {
-                switch (sdata->u.mgd.auth_alg) {
-                case WLAN_AUTH_OPEN:
-                case WLAN_AUTH_LEAP:
-                        erq->flags |= IW_ENCODE_OPEN;
-                        break;
-                case WLAN_AUTH_SHARED_KEY:
-                        erq->flags |= IW_ENCODE_RESTRICTED;
-                        break;
-                }
-        }
-
-        return 0;
-}
-
 static int ieee80211_ioctl_siwpower(struct net_device *dev,
                                     struct iw_request_info *info,
                                     struct iw_param *wrq,
@@ -747,7 +390,7 @@ static int ieee80211_ioctl_siwpower(struct net_device *dev,
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
         struct ieee80211_conf *conf = &local->hw.conf;
-        int ret = 0, timeout = 0;
+        int timeout = 0;
         bool ps;
 
         if (!(local->hw.flags & IEEE80211_HW_SUPPORTS_PS))
@@ -779,42 +422,18 @@ static int ieee80211_ioctl_siwpower(struct net_device *dev,
                 timeout = wrq->value / 1000;
 
  set:
-        if (ps == local->powersave && timeout == conf->dynamic_ps_timeout)
-                return ret;
+        if (ps == sdata->u.mgd.powersave && timeout == conf->dynamic_ps_timeout)
+                return 0;
 
-        local->powersave = ps;
+        sdata->u.mgd.powersave = ps;
         conf->dynamic_ps_timeout = timeout;
 
         if (local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_PS)
-                ret = ieee80211_hw_config(local,
-                                          IEEE80211_CONF_CHANGE_DYNPS_TIMEOUT);
+                ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
 
-        if (!(sdata->u.mgd.flags & IEEE80211_STA_ASSOCIATED))
-                return ret;
-
-        if (conf->dynamic_ps_timeout > 0 &&
-            !(local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_PS)) {
-                mod_timer(&local->dynamic_ps_timer, jiffies +
-                          msecs_to_jiffies(conf->dynamic_ps_timeout));
-        } else {
-                if (local->powersave) {
-                        if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK)
-                                ieee80211_send_nullfunc(local, sdata, 1);
-                        conf->flags |= IEEE80211_CONF_PS;
-                        ret = ieee80211_hw_config(local,
-                                        IEEE80211_CONF_CHANGE_PS);
-                } else {
-                        conf->flags &= ~IEEE80211_CONF_PS;
-                        ret = ieee80211_hw_config(local,
-                                        IEEE80211_CONF_CHANGE_PS);
-                        if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK)
-                                ieee80211_send_nullfunc(local, sdata, 0);
-                        del_timer_sync(&local->dynamic_ps_timer);
-                        cancel_work_sync(&local->dynamic_ps_enable_work);
-                }
-        }
+        ieee80211_recalc_ps(local, -1);
 
-        return ret;
+        return 0;
 }
 
 static int ieee80211_ioctl_giwpower(struct net_device *dev,
@@ -822,9 +441,9 @@ static int ieee80211_ioctl_giwpower(struct net_device *dev,
                                     union iwreq_data *wrqu,
                                     char *extra)
 {
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
-        wrqu->power.disabled = !local->powersave;
+        wrqu->power.disabled = !sdata->u.mgd.powersave;
 
         return 0;
 }
@@ -997,82 +616,6 @@ static int ieee80211_ioctl_giwauth(struct net_device *dev,
 }
 
 
-static int ieee80211_ioctl_siwencodeext(struct net_device *dev,
-                                        struct iw_request_info *info,
-                                        struct iw_point *erq, char *extra)
-{
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        struct iw_encode_ext *ext = (struct iw_encode_ext *) extra;
-        int uninitialized_var(alg), idx, i, remove = 0;
-
-        switch (ext->alg) {
-        case IW_ENCODE_ALG_NONE:
-                remove = 1;
-                break;
-        case IW_ENCODE_ALG_WEP:
-                alg = ALG_WEP;
-                break;
-        case IW_ENCODE_ALG_TKIP:
-                alg = ALG_TKIP;
-                break;
-        case IW_ENCODE_ALG_CCMP:
-                alg = ALG_CCMP;
-                break;
-        case IW_ENCODE_ALG_AES_CMAC:
-                alg = ALG_AES_CMAC;
-                break;
-        default:
-                return -EOPNOTSUPP;
-        }
-
-        if (erq->flags & IW_ENCODE_DISABLED)
-                remove = 1;
-
-        idx = erq->flags & IW_ENCODE_INDEX;
-        if (alg == ALG_AES_CMAC) {
-                if (idx < NUM_DEFAULT_KEYS + 1 ||
-                    idx > NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS) {
-                        idx = -1;
-                        if (!sdata->default_mgmt_key)
-                                idx = 0;
-                        else for (i = NUM_DEFAULT_KEYS;
-                                  i < NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS;
-                                  i++) {
-                                if (sdata->default_mgmt_key == sdata->keys[i])
-                                {
-                                        idx = i;
-                                        break;
-                                }
-                        }
-                        if (idx < 0)
-                                return -EINVAL;
-                } else
-                        idx--;
-        } else {
-                if (idx < 1 || idx > 4) {
-                        idx = -1;
-                        if (!sdata->default_key)
-                                idx = 0;
-                        else for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
-                                if (sdata->default_key == sdata->keys[i]) {
-                                        idx = i;
-                                        break;
-                                }
-                        }
-                        if (idx < 0)
-                                return -EINVAL;
-                } else
-                        idx--;
-        }
-
-        return ieee80211_set_encryption(sdata, ext->addr.sa_data, idx, alg,
-                                        remove,
-                                        ext->ext_flags &
-                                        IW_ENCODE_EXT_SET_TX_KEY,
-                                        ext->key, ext->key_len);
-}
-
-
 /* Structures to export the Wireless Handlers */
 
 static const iw_handler ieee80211_handler[] =
@@ -1099,7 +642,7 @@ static const iw_handler ieee80211_handler[] =
         (iw_handler) NULL,                              /* SIOCGIWTHRSPY */
         (iw_handler) ieee80211_ioctl_siwap,             /* SIOCSIWAP */
         (iw_handler) ieee80211_ioctl_giwap,             /* SIOCGIWAP */
-        (iw_handler) ieee80211_ioctl_siwmlme,           /* SIOCSIWMLME */
+        (iw_handler) cfg80211_wext_siwmlme,             /* SIOCSIWMLME */
         (iw_handler) NULL,                              /* SIOCGIWAPLIST */
         (iw_handler) cfg80211_wext_siwscan,             /* SIOCSIWSCAN */
         (iw_handler) cfg80211_wext_giwscan,             /* SIOCGIWSCAN */
@@ -1111,16 +654,16 @@ static const iw_handler ieee80211_handler[] =
         (iw_handler) NULL,                              /* -- hole -- */
         (iw_handler) ieee80211_ioctl_siwrate,           /* SIOCSIWRATE */
         (iw_handler) ieee80211_ioctl_giwrate,           /* SIOCGIWRATE */
-        (iw_handler) ieee80211_ioctl_siwrts,            /* SIOCSIWRTS */
-        (iw_handler) ieee80211_ioctl_giwrts,            /* SIOCGIWRTS */
-        (iw_handler) ieee80211_ioctl_siwfrag,           /* SIOCSIWFRAG */
-        (iw_handler) ieee80211_ioctl_giwfrag,           /* SIOCGIWFRAG */
+        (iw_handler) cfg80211_wext_siwrts,              /* SIOCSIWRTS */
+        (iw_handler) cfg80211_wext_giwrts,              /* SIOCGIWRTS */
+        (iw_handler) cfg80211_wext_siwfrag,             /* SIOCSIWFRAG */
+        (iw_handler) cfg80211_wext_giwfrag,             /* SIOCGIWFRAG */
         (iw_handler) ieee80211_ioctl_siwtxpower,        /* SIOCSIWTXPOW */
         (iw_handler) ieee80211_ioctl_giwtxpower,        /* SIOCGIWTXPOW */
-        (iw_handler) ieee80211_ioctl_siwretry,          /* SIOCSIWRETRY */
-        (iw_handler) ieee80211_ioctl_giwretry,          /* SIOCGIWRETRY */
-        (iw_handler) ieee80211_ioctl_siwencode,         /* SIOCSIWENCODE */
-        (iw_handler) ieee80211_ioctl_giwencode,         /* SIOCGIWENCODE */
+        (iw_handler) cfg80211_wext_siwretry,            /* SIOCSIWRETRY */
+        (iw_handler) cfg80211_wext_giwretry,            /* SIOCGIWRETRY */
+        (iw_handler) cfg80211_wext_siwencode,           /* SIOCSIWENCODE */
+        (iw_handler) cfg80211_wext_giwencode,           /* SIOCGIWENCODE */
         (iw_handler) ieee80211_ioctl_siwpower,          /* SIOCSIWPOWER */
         (iw_handler) ieee80211_ioctl_giwpower,          /* SIOCGIWPOWER */
         (iw_handler) NULL,                              /* -- hole -- */
@@ -1129,7 +672,7 @@ static const iw_handler ieee80211_handler[] =
         (iw_handler) NULL,                              /* SIOCGIWGENIE */
         (iw_handler) ieee80211_ioctl_siwauth,           /* SIOCSIWAUTH */
         (iw_handler) ieee80211_ioctl_giwauth,           /* SIOCGIWAUTH */
-        (iw_handler) ieee80211_ioctl_siwencodeext,      /* SIOCSIWENCODEEXT */
+        (iw_handler) cfg80211_wext_siwencodeext,        /* SIOCSIWENCODEEXT */
         (iw_handler) NULL,                              /* SIOCGIWENCODEEXT */
         (iw_handler) NULL,                              /* SIOCSIWPMKSA */
         (iw_handler) NULL,                              /* -- hole -- */
diff --git a/net/mac80211/wme.c b/net/mac80211/wme.c
index 0b8ad1f4ecdd..694343b9102b 100644
--- a/net/mac80211/wme.c
+++ b/net/mac80211/wme.c
@@ -23,34 +23,6 @@
  */
 const int ieee802_1d_to_ac[8] = { 2, 3, 3, 2, 1, 1, 0, 0 };
 
-static const char llc_ip_hdr[8] = {0xAA, 0xAA, 0x3, 0, 0, 0, 0x08, 0};
-
-/* Given a data frame determine the 802.1p/1d tag to use.  */
-static unsigned int classify_1d(struct sk_buff *skb)
-{
-        unsigned int dscp;
-
-        /* skb->priority values from 256->263 are magic values to
-         * directly indicate a specific 802.1d priority.  This is used
-         * to allow 802.1d priority to be passed directly in from VLAN
-         * tags, etc.
-         */
-        if (skb->priority >= 256 && skb->priority <= 263)
-                return skb->priority - 256;
-
-        switch (skb->protocol) {
-        case htons(ETH_P_IP):
-                dscp = ip_hdr(skb)->tos & 0xfc;
-                break;
-
-        default:
-                return 0;
-        }
-
-        return dscp >> 5;
-}
-
-
 static int wme_downgrade_ac(struct sk_buff *skb)
 {
         switch (skb->priority) {
@@ -94,7 +66,7 @@ static u16 classify80211(struct ieee80211_local *local, struct sk_buff *skb)
 
         /* use the data classifier to determine what 802.1d tag the
          * data frame has */
-        skb->priority = classify_1d(skb);
+        skb->priority = cfg80211_classify8021d(skb);
 
         /* in case we are a client verify acm is not set for this ac */
         while (unlikely(local->wmm_acm & BIT(skb->priority))) {
@@ -133,7 +105,7 @@ u16 ieee80211_select_queue(struct net_device *dev, struct sk_buff *skb)
                 u8 *p = ieee80211_get_qos_ctl(hdr);
                 u8 ack_policy = 0;
                 tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
-                if (local->wifi_wme_noack_test)
+                if (unlikely(local->wifi_wme_noack_test))
                         ack_policy |= QOS_CONTROL_ACK_POLICY_NOACK <<
                                         QOS_CONTROL_ACK_POLICY_SHIFT;
                 /* qos header is 2 bytes, second reserved */
diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c
index 4f8bfea278f2..dcfae8884b86 100644
--- a/net/mac80211/wpa.c
+++ b/net/mac80211/wpa.c
@@ -122,7 +122,7 @@ ieee80211_rx_h_michael_mic_verify(struct ieee80211_rx_data *rx)
                         return RX_DROP_UNUSABLE;
 
                 mac80211_ev_michael_mic_failure(rx->sdata, rx->key->conf.keyidx,
-                                                (void *) skb->data);
+                                                (void *) skb->data, NULL);
                 return RX_DROP_UNUSABLE;
         }
 
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index e01061f49cdc..7c1333c67ff3 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -3345,22 +3345,8 @@ static struct genl_ops ip_vs_genl_ops[] __read_mostly = {
 
 static int __init ip_vs_genl_register(void)
 {
-        int ret, i;
-
-        ret = genl_register_family(&ip_vs_genl_family);
-        if (ret)
-                return ret;
-
-        for (i = 0; i < ARRAY_SIZE(ip_vs_genl_ops); i++) {
-                ret = genl_register_ops(&ip_vs_genl_family, &ip_vs_genl_ops[i]);
-                if (ret)
-                        goto err_out;
-        }
-        return 0;
-
-err_out:
-        genl_unregister_family(&ip_vs_genl_family);
-        return ret;
+        return genl_register_family_with_ops(&ip_vs_genl_family,
+                ip_vs_genl_ops, ARRAY_SIZE(ip_vs_genl_ops));
 }
 
 static void ip_vs_genl_unregister(void)
diff --git a/net/netlabel/netlabel_cipso_v4.c b/net/netlabel/netlabel_cipso_v4.c
index bf1ab1a6790d..e639298bc9c8 100644
--- a/net/netlabel/netlabel_cipso_v4.c
+++ b/net/netlabel/netlabel_cipso_v4.c
@@ -785,18 +785,6 @@ static struct genl_ops netlbl_cipsov4_ops[] = {
  */
 int __init netlbl_cipsov4_genl_init(void)
 {
-        int ret_val, i;
-
-        ret_val = genl_register_family(&netlbl_cipsov4_gnl_family);
-        if (ret_val != 0)
-                return ret_val;
-
-        for (i = 0; i < ARRAY_SIZE(netlbl_cipsov4_ops); i++) {
-                ret_val = genl_register_ops(&netlbl_cipsov4_gnl_family,
-                                &netlbl_cipsov4_ops[i]);
-                if (ret_val != 0)
-                        return ret_val;
-        }
-
-        return 0;
+        return genl_register_family_with_ops(&netlbl_cipsov4_gnl_family,
+                netlbl_cipsov4_ops, ARRAY_SIZE(netlbl_cipsov4_ops));
 }
diff --git a/net/netlabel/netlabel_mgmt.c b/net/netlabel/netlabel_mgmt.c
index 1821c5d50fb8..8203623e65ad 100644
--- a/net/netlabel/netlabel_mgmt.c
+++ b/net/netlabel/netlabel_mgmt.c
@@ -779,18 +779,6 @@ static struct genl_ops netlbl_mgmt_genl_ops[] = {
  */
 int __init netlbl_mgmt_genl_init(void)
 {
-        int ret_val, i;
-
-        ret_val = genl_register_family(&netlbl_mgmt_gnl_family);
-        if (ret_val != 0)
-                return ret_val;
-
-        for (i = 0; i < ARRAY_SIZE(netlbl_mgmt_genl_ops); i++) {
-                ret_val = genl_register_ops(&netlbl_mgmt_gnl_family,
-                                &netlbl_mgmt_genl_ops[i]);
-                if (ret_val != 0)
-                        return ret_val;
-        }
-
-        return 0;
+        return genl_register_family_with_ops(&netlbl_mgmt_gnl_family,
+                netlbl_mgmt_genl_ops, ARRAY_SIZE(netlbl_mgmt_genl_ops));
 }
diff --git a/net/netlabel/netlabel_unlabeled.c b/net/netlabel/netlabel_unlabeled.c
index f3c5c68c6848..fb357f010189 100644
--- a/net/netlabel/netlabel_unlabeled.c
+++ b/net/netlabel/netlabel_unlabeled.c
@@ -1478,20 +1478,8 @@ static struct genl_ops netlbl_unlabel_genl_ops[] = {
  */
 int __init netlbl_unlabel_genl_init(void)
 {
-        int ret_val, i;
-
-        ret_val = genl_register_family(&netlbl_unlabel_gnl_family);
-        if (ret_val != 0)
-                return ret_val;
-
-        for (i = 0; i < ARRAY_SIZE(netlbl_unlabel_genl_ops); i++) {
-                ret_val = genl_register_ops(&netlbl_unlabel_gnl_family,
-                                &netlbl_unlabel_genl_ops[i]);
-                if (ret_val != 0)
-                        return ret_val;
-        }
-
-        return 0;
+        return genl_register_family_with_ops(&netlbl_unlabel_gnl_family,
+                netlbl_unlabel_genl_ops, ARRAY_SIZE(netlbl_unlabel_genl_ops));
 }
 
 /*
diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
index 1d3dd30099df..eed4c6a8afc0 100644
--- a/net/netlink/genetlink.c
+++ b/net/netlink/genetlink.c
@@ -384,6 +384,52 @@ errout:
 }
 
 /**
+ * genl_register_family_with_ops - register a generic netlink family
+ * @family: generic netlink family
+ * @ops: operations to be registered
+ * @n_ops: number of elements to register
+ *
+ * Registers the specified family and operations from the specified table.
+ * Only one family may be registered with the same family name or identifier.
+ *
+ * The family id may equal GENL_ID_GENERATE causing an unique id to
+ * be automatically generated and assigned.
+ *
+ * Either a doit or dumpit callback must be specified for every registered
+ * operation or the function will fail. Only one operation structure per
+ * command identifier may be registered.
+ *
+ * See include/net/genetlink.h for more documenation on the operations
+ * structure.
+ *
+ * This is equivalent to calling genl_register_family() followed by
+ * genl_register_ops() for every operation entry in the table taking
+ * care to unregister the family on error path.
+ *
+ * Return 0 on success or a negative error code.
+ */
+int genl_register_family_with_ops(struct genl_family *family,
+        struct genl_ops *ops, size_t n_ops)
+{
+        int err, i;
+
+        err = genl_register_family(family);
+        if (err)
+                return err;
+
+        for (i = 0; i < n_ops; ++i, ++ops) {
+                err = genl_register_ops(family, ops);
+                if (err)
+                        goto err_out;
+        }
+        return 0;
+err_out:
+        genl_unregister_family(family);
+        return err;
+}
+EXPORT_SYMBOL(genl_register_family_with_ops);
+
+/**
  * genl_unregister_family - unregister generic netlink family
  * @family: generic netlink family
  *
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index f546e81acc45..6da9f38ef5c1 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -39,6 +39,7 @@
  *                                      will simply extend the hardware address
  *                                      byte arrays at the end of sockaddr_ll
  *                                      and packet_mreq.
+ *              Johann Baudy    :       Added TX RING.
  *
  *              This program is free software; you can redistribute it and/or
  *              modify it under the terms of the GNU General Public License
@@ -157,7 +158,25 @@ struct packet_mreq_max
 };
 
 #ifdef CONFIG_PACKET_MMAP
-static int packet_set_ring(struct sock *sk, struct tpacket_req *req, int closing);
+static int packet_set_ring(struct sock *sk, struct tpacket_req *req,
+                int closing, int tx_ring);
+
+struct packet_ring_buffer {
+        char *                  *pg_vec;
+        unsigned int            head;
+        unsigned int            frames_per_block;
+        unsigned int            frame_size;
+        unsigned int            frame_max;
+
+        unsigned int            pg_vec_order;
+        unsigned int            pg_vec_pages;
+        unsigned int            pg_vec_len;
+
+        atomic_t                pending;
+};
+
+struct packet_sock;
+static int tpacket_snd(struct packet_sock *po, struct msghdr *msg);
 #endif
 
 static void packet_flush_mclist(struct sock *sk);
@@ -167,11 +186,8 @@ struct packet_sock {
         struct sock             sk;
         struct tpacket_stats    stats;
 #ifdef CONFIG_PACKET_MMAP
-        char *                  *pg_vec;
-        unsigned int            head;
-        unsigned int            frames_per_block;
-        unsigned int            frame_size;
-        unsigned int            frame_max;
+        struct packet_ring_buffer       rx_ring;
+        struct packet_ring_buffer       tx_ring;
         int                     copy_thresh;
 #endif
         struct packet_type      prot_hook;
@@ -185,12 +201,10 @@ struct packet_sock {
         struct packet_mclist    *mclist;
 #ifdef CONFIG_PACKET_MMAP
         atomic_t                mapped;
-        unsigned int            pg_vec_order;
-        unsigned int            pg_vec_pages;
-        unsigned int            pg_vec_len;
         enum tpacket_versions   tp_version;
         unsigned int            tp_hdrlen;
         unsigned int            tp_reserve;
+        unsigned int            tp_loss:1;
 #endif
 };
 
@@ -206,36 +220,33 @@ struct packet_skb_cb {
 
 #ifdef CONFIG_PACKET_MMAP
 
-static void *packet_lookup_frame(struct packet_sock *po, unsigned int position,
-                                 int status)
+static void __packet_set_status(struct packet_sock *po, void *frame, int status)
 {
-        unsigned int pg_vec_pos, frame_offset;
         union {
                 struct tpacket_hdr *h1;
                 struct tpacket2_hdr *h2;
                 void *raw;
         } h;
 
-        pg_vec_pos = position / po->frames_per_block;
-        frame_offset = position % po->frames_per_block;
-
-        h.raw = po->pg_vec[pg_vec_pos] + (frame_offset * po->frame_size);
+        h.raw = frame;
         switch (po->tp_version) {
         case TPACKET_V1:
-                if (status != (h.h1->tp_status ? TP_STATUS_USER :
-                                                TP_STATUS_KERNEL))
-                        return NULL;
+                h.h1->tp_status = status;
+                flush_dcache_page(virt_to_page(&h.h1->tp_status));
                 break;
         case TPACKET_V2:
-                if (status != (h.h2->tp_status ? TP_STATUS_USER :
-                                                TP_STATUS_KERNEL))
-                        return NULL;
+                h.h2->tp_status = status;
+                flush_dcache_page(virt_to_page(&h.h2->tp_status));
                 break;
+        default:
+                printk(KERN_ERR "TPACKET version not supported\n");
+                BUG();
         }
-        return h.raw;
+
+        smp_wmb();
 }
 
-static void __packet_set_status(struct packet_sock *po, void *frame, int status)
+static int __packet_get_status(struct packet_sock *po, void *frame)
 {
         union {
                 struct tpacket_hdr *h1;
@@ -243,16 +254,66 @@ static void __packet_set_status(struct packet_sock *po, void *frame, int status)
                 void *raw;
         } h;
 
+        smp_rmb();
+
         h.raw = frame;
         switch (po->tp_version) {
         case TPACKET_V1:
-                h.h1->tp_status = status;
-                break;
+                flush_dcache_page(virt_to_page(&h.h1->tp_status));
+                return h.h1->tp_status;
         case TPACKET_V2:
-                h.h2->tp_status = status;
-                break;
+                flush_dcache_page(virt_to_page(&h.h2->tp_status));
+                return h.h2->tp_status;
+        default:
+                printk(KERN_ERR "TPACKET version not supported\n");
+                BUG();
+                return 0;
         }
 }
+
+static void *packet_lookup_frame(struct packet_sock *po,
+                struct packet_ring_buffer *rb,
+                unsigned int position,
+                int status)
+{
+        unsigned int pg_vec_pos, frame_offset;
+        union {
+                struct tpacket_hdr *h1;
+                struct tpacket2_hdr *h2;
+                void *raw;
+        } h;
+
+        pg_vec_pos = position / rb->frames_per_block;
+        frame_offset = position % rb->frames_per_block;
+
+        h.raw = rb->pg_vec[pg_vec_pos] + (frame_offset * rb->frame_size);
+
+        if (status != __packet_get_status(po, h.raw))
+                return NULL;
+
+        return h.raw;
+}
+
+static inline void *packet_current_frame(struct packet_sock *po,
+                struct packet_ring_buffer *rb,
+                int status)
+{
+        return packet_lookup_frame(po, rb, rb->head, status);
+}
+
+static inline void *packet_previous_frame(struct packet_sock *po,
+                struct packet_ring_buffer *rb,
+                int status)
+{
+        unsigned int previous = rb->head ? rb->head - 1 : rb->frame_max;
+        return packet_lookup_frame(po, rb, previous, status);
+}
+
+static inline void packet_increment_head(struct packet_ring_buffer *buff)
+{
+        buff->head = buff->head != buff->frame_max ? buff->head+1 : 0;
+}
+
 #endif
 
 static inline struct packet_sock *pkt_sk(struct sock *sk)
@@ -648,7 +709,7 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, struct packe
                 macoff = netoff - maclen;
         }
 
-        if (macoff + snaplen > po->frame_size) {
+        if (macoff + snaplen > po->rx_ring.frame_size) {
                 if (po->copy_thresh &&
                     atomic_read(&sk->sk_rmem_alloc) + skb->truesize <
                     (unsigned)sk->sk_rcvbuf) {
@@ -661,16 +722,16 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, struct packe
                         if (copy_skb)
                                 skb_set_owner_r(copy_skb, sk);
                 }
-                snaplen = po->frame_size - macoff;
+                snaplen = po->rx_ring.frame_size - macoff;
                 if ((int)snaplen < 0)
                         snaplen = 0;
         }
 
         spin_lock(&sk->sk_receive_queue.lock);
-        h.raw = packet_lookup_frame(po, po->head, TP_STATUS_KERNEL);
+        h.raw = packet_current_frame(po, &po->rx_ring, TP_STATUS_KERNEL);
         if (!h.raw)
                 goto ring_is_full;
-        po->head = po->head != po->frame_max ? po->head+1 : 0;
+        packet_increment_head(&po->rx_ring);
         po->stats.tp_packets++;
         if (copy_skb) {
                 status |= TP_STATUS_COPY;
@@ -727,7 +788,6 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, struct packe
 
         __packet_set_status(po, h.raw, status);
         smp_mb();
-
         {
                 struct page *p_start, *p_end;
                 u8 *h_end = h.raw + macoff + snaplen - 1;
@@ -760,10 +820,249 @@ ring_is_full:
         goto drop_n_restore;
 }
 
-#endif
+static void tpacket_destruct_skb(struct sk_buff *skb)
+{
+        struct packet_sock *po = pkt_sk(skb->sk);
+        void * ph;
 
+        BUG_ON(skb == NULL);
 
-static int packet_sendmsg(struct kiocb *iocb, struct socket *sock,
+        if (likely(po->tx_ring.pg_vec)) {
+                ph = skb_shinfo(skb)->destructor_arg;
+                BUG_ON(__packet_get_status(po, ph) != TP_STATUS_SENDING);
+                BUG_ON(atomic_read(&po->tx_ring.pending) == 0);
+                atomic_dec(&po->tx_ring.pending);
+                __packet_set_status(po, ph, TP_STATUS_AVAILABLE);
+        }
+
+        sock_wfree(skb);
+}
+
+static int tpacket_fill_skb(struct packet_sock *po, struct sk_buff * skb,
+                void * frame, struct net_device *dev, int size_max,
+                __be16 proto, unsigned char * addr)
+{
+        union {
+                struct tpacket_hdr *h1;
+                struct tpacket2_hdr *h2;
+                void *raw;
+        } ph;
+        int to_write, offset, len, tp_len, nr_frags, len_max;
+        struct socket *sock = po->sk.sk_socket;
+        struct page *page;
+        void *data;
+        int err;
+
+        ph.raw = frame;
+
+        skb->protocol = proto;
+        skb->dev = dev;
+        skb->priority = po->sk.sk_priority;
+        skb_shinfo(skb)->destructor_arg = ph.raw;
+
+        switch (po->tp_version) {
+        case TPACKET_V2:
+                tp_len = ph.h2->tp_len;
+                break;
+        default:
+                tp_len = ph.h1->tp_len;
+                break;
+        }
+        if (unlikely(tp_len > size_max)) {
+                printk(KERN_ERR "packet size is too long (%d > %d)\n",
+                                tp_len, size_max);
+                return -EMSGSIZE;
+        }
+
+        skb_reserve(skb, LL_RESERVED_SPACE(dev));
+        skb_reset_network_header(skb);
+
+        data = ph.raw + po->tp_hdrlen - sizeof(struct sockaddr_ll);
+        to_write = tp_len;
+
+        if (sock->type == SOCK_DGRAM) {
+                err = dev_hard_header(skb, dev, ntohs(proto), addr,
+                                NULL, tp_len);
+                if (unlikely(err < 0))
+                        return -EINVAL;
+        } else if (dev->hard_header_len ) {
+                /* net device doesn't like empty head */
+                if (unlikely(tp_len <= dev->hard_header_len)) {
+                        printk(KERN_ERR "packet size is too short "
+                                        "(%d < %d)\n", tp_len,
+                                        dev->hard_header_len);
+                        return -EINVAL;
+                }
+
+                skb_push(skb, dev->hard_header_len);
+                err = skb_store_bits(skb, 0, data,
+                                dev->hard_header_len);
+                if (unlikely(err))
+                        return err;
+
+                data += dev->hard_header_len;
+                to_write -= dev->hard_header_len;
+        }
+
+        err = -EFAULT;
+        page = virt_to_page(data);
+        offset = offset_in_page(data);
+        len_max = PAGE_SIZE - offset;
+        len = ((to_write > len_max) ? len_max : to_write);
+
+        skb->data_len = to_write;
+        skb->len += to_write;
+        skb->truesize += to_write;
+        atomic_add(to_write, &po->sk.sk_wmem_alloc);
+
+        while (likely(to_write)) {
+                nr_frags = skb_shinfo(skb)->nr_frags;
+
+                if (unlikely(nr_frags >= MAX_SKB_FRAGS)) {
+                        printk(KERN_ERR "Packet exceed the number "
+                                        "of skb frags(%lu)\n",
+                                        MAX_SKB_FRAGS);
+                        return -EFAULT;
+                }
+
+                flush_dcache_page(page);
+                get_page(page);
+                skb_fill_page_desc(skb,
+                                nr_frags,
+                                page++, offset, len);
+                to_write -= len;
+                offset = 0;
+                len_max = PAGE_SIZE;
+                len = ((to_write > len_max) ? len_max : to_write);
+        }
+
+        return tp_len;
+}
+
+static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
+{
+        struct socket *sock;
+        struct sk_buff *skb;
+        struct net_device *dev;
+        __be16 proto;
+        int ifindex, err, reserve = 0;
+        void * ph;
+        struct sockaddr_ll *saddr=(struct sockaddr_ll *)msg->msg_name;
+        int tp_len, size_max;
+        unsigned char *addr;
+        int len_sum = 0;
+        int status = 0;
+
+        sock = po->sk.sk_socket;
+
+        mutex_lock(&po->pg_vec_lock);
+
+        err = -EBUSY;
+        if (saddr == NULL) {
+                ifindex = po->ifindex;
+                proto   = po->num;
+                addr    = NULL;
+        } else {
+                err = -EINVAL;
+                if (msg->msg_namelen < sizeof(struct sockaddr_ll))
+                        goto out;
+                if (msg->msg_namelen < (saddr->sll_halen
+                                        + offsetof(struct sockaddr_ll,
+                                                sll_addr)))
+                        goto out;
+                ifindex = saddr->sll_ifindex;
+                proto   = saddr->sll_protocol;
+                addr    = saddr->sll_addr;
+        }
+
+        dev = dev_get_by_index(sock_net(&po->sk), ifindex);
+        err = -ENXIO;
+        if (unlikely(dev == NULL))
+                goto out;
+
+        reserve = dev->hard_header_len;
+
+        err = -ENETDOWN;
+        if (unlikely(!(dev->flags & IFF_UP)))
+                goto out_put;
+
+        size_max = po->tx_ring.frame_size
+                - sizeof(struct skb_shared_info)
+                - po->tp_hdrlen
+                - LL_ALLOCATED_SPACE(dev)
+                - sizeof(struct sockaddr_ll);
+
+        if (size_max > dev->mtu + reserve)
+                size_max = dev->mtu + reserve;
+
+        do {
+                ph = packet_current_frame(po, &po->tx_ring,
+                                TP_STATUS_SEND_REQUEST);
+
+                if (unlikely(ph == NULL)) {
+                        schedule();
+                        continue;
+                }
+
+                status = TP_STATUS_SEND_REQUEST;
+                skb = sock_alloc_send_skb(&po->sk,
+                                LL_ALLOCATED_SPACE(dev)
+                                + sizeof(struct sockaddr_ll),
+                                0, &err);
+
+                if (unlikely(skb == NULL))
+                        goto out_status;
+
+                tp_len = tpacket_fill_skb(po, skb, ph, dev, size_max, proto,
+                                addr);
+
+                if (unlikely(tp_len < 0)) {
+                        if (po->tp_loss) {
+                                __packet_set_status(po, ph,
+                                                TP_STATUS_AVAILABLE);
+                                packet_increment_head(&po->tx_ring);
+                                kfree_skb(skb);
+                                continue;
+                        } else {
+                                status = TP_STATUS_WRONG_FORMAT;
+                                err = tp_len;
+                                goto out_status;
+                        }
+                }
+
+                skb->destructor = tpacket_destruct_skb;
+                __packet_set_status(po, ph, TP_STATUS_SENDING);
+                atomic_inc(&po->tx_ring.pending);
+
+                status = TP_STATUS_SEND_REQUEST;
+                err = dev_queue_xmit(skb);
+                if (unlikely(err > 0 && (err = net_xmit_errno(err)) != 0))
+                        goto out_xmit;
+                packet_increment_head(&po->tx_ring);
+                len_sum += tp_len;
+        }
+        while (likely((ph != NULL) || ((!(msg->msg_flags & MSG_DONTWAIT))
+                                        && (atomic_read(&po->tx_ring.pending))))
+              );
+
+        err = len_sum;
+        goto out_put;
+
+out_xmit:
+        skb->destructor = sock_wfree;
+        atomic_dec(&po->tx_ring.pending);
+out_status:
+        __packet_set_status(po, ph, status);
+        kfree_skb(skb);
+out_put:
+        dev_put(dev);
+out:
+        mutex_unlock(&po->pg_vec_lock);
+        return err;
+}
+#endif
+
+static int packet_snd(struct socket *sock,
                           struct msghdr *msg, size_t len)
 {
         struct sock *sk = sock->sk;
@@ -854,6 +1153,19 @@ out:
         return err;
 }
 
+static int packet_sendmsg(struct kiocb *iocb, struct socket *sock,
+                struct msghdr *msg, size_t len)
+{
+#ifdef CONFIG_PACKET_MMAP
+        struct sock *sk = sock->sk;
+        struct packet_sock *po = pkt_sk(sk);
+        if (po->tx_ring.pg_vec)
+                return tpacket_snd(po, msg);
+        else
+#endif
+                return packet_snd(sock, msg, len);
+}
+
 /*
  *      Close a PACKET socket. This is fairly simple. We immediately go
  *      to 'closed' state and remove our protocol entry in the device list.
@@ -864,6 +1176,9 @@ static int packet_release(struct socket *sock)
         struct sock *sk = sock->sk;
         struct packet_sock *po;
         struct net *net;
+#ifdef CONFIG_PACKET_MMAP
+        struct tpacket_req req;
+#endif
 
         if (!sk)
                 return 0;
@@ -893,11 +1208,13 @@ static int packet_release(struct socket *sock)
         packet_flush_mclist(sk);
 
 #ifdef CONFIG_PACKET_MMAP
-        if (po->pg_vec) {
-                struct tpacket_req req;
-                memset(&req, 0, sizeof(req));
-                packet_set_ring(sk, &req, 1);
-        }
+        memset(&req, 0, sizeof(req));
+
+        if (po->rx_ring.pg_vec)
+                packet_set_ring(sk, &req, 1, 0);
+
+        if (po->tx_ring.pg_vec)
+                packet_set_ring(sk, &req, 1, 1);
 #endif
 
         /*
@@ -1253,9 +1570,9 @@ static int packet_dev_mc(struct net_device *dev, struct packet_mclist *i,
         switch (i->type) {
         case PACKET_MR_MULTICAST:
                 if (what > 0)
-                        dev_mc_add(dev, i->addr, i->alen, 0);
+                        return dev_mc_add(dev, i->addr, i->alen, 0);
                 else
-                        dev_mc_delete(dev, i->addr, i->alen, 0);
+                        return dev_mc_delete(dev, i->addr, i->alen, 0);
                 break;
         case PACKET_MR_PROMISC:
                 return dev_set_promiscuity(dev, what);
@@ -1263,6 +1580,12 @@ static int packet_dev_mc(struct net_device *dev, struct packet_mclist *i,
         case PACKET_MR_ALLMULTI:
                 return dev_set_allmulti(dev, what);
                 break;
+        case PACKET_MR_UNICAST:
+                if (what > 0)
+                        return dev_unicast_add(dev, i->addr);
+                else
+                        return dev_unicast_delete(dev, i->addr);
+                break;
         default:;
         }
         return 0;
@@ -1391,7 +1714,7 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv
         if (level != SOL_PACKET)
                 return -ENOPROTOOPT;
 
-        switch(optname) {
+        switch (optname) {
         case PACKET_ADD_MEMBERSHIP:
         case PACKET_DROP_MEMBERSHIP:
         {
@@ -1415,6 +1738,7 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv
 
 #ifdef CONFIG_PACKET_MMAP
         case PACKET_RX_RING:
+        case PACKET_TX_RING:
         {
                 struct tpacket_req req;
 
@@ -1422,7 +1746,7 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv
                         return -EINVAL;
                 if (copy_from_user(&req,optval,sizeof(req)))
                         return -EFAULT;
-                return packet_set_ring(sk, &req, 0);
+                return packet_set_ring(sk, &req, 0, optname == PACKET_TX_RING);
         }
         case PACKET_COPY_THRESH:
         {
@@ -1442,7 +1766,7 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv
 
                 if (optlen != sizeof(val))
                         return -EINVAL;
-                if (po->pg_vec)
+                if (po->rx_ring.pg_vec || po->tx_ring.pg_vec)
                         return -EBUSY;
                 if (copy_from_user(&val, optval, sizeof(val)))
                         return -EFAULT;
@@ -1461,13 +1785,26 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv
 
                 if (optlen != sizeof(val))
                         return -EINVAL;
-                if (po->pg_vec)
+                if (po->rx_ring.pg_vec || po->tx_ring.pg_vec)
                         return -EBUSY;
                 if (copy_from_user(&val, optval, sizeof(val)))
                         return -EFAULT;
                 po->tp_reserve = val;
                 return 0;
         }
+        case PACKET_LOSS:
+        {
+                unsigned int val;
+
+                if (optlen != sizeof(val))
+                        return -EINVAL;
+                if (po->rx_ring.pg_vec || po->tx_ring.pg_vec)
+                        return -EBUSY;
+                if (copy_from_user(&val, optval, sizeof(val)))
+                        return -EFAULT;
+                po->tp_loss = !!val;
+                return 0;
+        }
 #endif
         case PACKET_AUXDATA:
         {
@@ -1517,7 +1854,7 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
         if (len < 0)
                 return -EINVAL;
 
-        switch(optname) {
+        switch (optname) {
         case PACKET_STATISTICS:
                 if (len > sizeof(struct tpacket_stats))
                         len = sizeof(struct tpacket_stats);
@@ -1573,6 +1910,12 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
                 val = po->tp_reserve;
                 data = &val;
                 break;
+        case PACKET_LOSS:
+                if (len > sizeof(unsigned int))
+                        len = sizeof(unsigned int);
+                val = po->tp_loss;
+                data = &val;
+                break;
 #endif
         default:
                 return -ENOPROTOOPT;
@@ -1643,7 +1986,7 @@ static int packet_ioctl(struct socket *sock, unsigned int cmd,
 {
         struct sock *sk = sock->sk;
 
-        switch(cmd) {
+        switch (cmd) {
                 case SIOCOUTQ:
                 {
                         int amount = atomic_read(&sk->sk_wmem_alloc);
@@ -1705,13 +2048,17 @@ static unsigned int packet_poll(struct file * file, struct socket *sock,
         unsigned int mask = datagram_poll(file, sock, wait);
 
         spin_lock_bh(&sk->sk_receive_queue.lock);
-        if (po->pg_vec) {
-                unsigned last = po->head ? po->head-1 : po->frame_max;
-
-                if (packet_lookup_frame(po, last, TP_STATUS_USER))
+        if (po->rx_ring.pg_vec) {
+                if (!packet_previous_frame(po, &po->rx_ring, TP_STATUS_KERNEL))
                         mask |= POLLIN | POLLRDNORM;
         }
         spin_unlock_bh(&sk->sk_receive_queue.lock);
+        spin_lock_bh(&sk->sk_write_queue.lock);
+        if (po->tx_ring.pg_vec) {
+                if (packet_current_frame(po, &po->tx_ring, TP_STATUS_AVAILABLE))
+                        mask |= POLLOUT | POLLWRNORM;
+        }
+        spin_unlock_bh(&sk->sk_write_queue.lock);
         return mask;
 }
 
@@ -1788,21 +2135,33 @@ out_free_pgvec:
         goto out;
 }
 
-static int packet_set_ring(struct sock *sk, struct tpacket_req *req, int closing)
+static int packet_set_ring(struct sock *sk, struct tpacket_req *req,
+                int closing, int tx_ring)
 {
         char **pg_vec = NULL;
         struct packet_sock *po = pkt_sk(sk);
         int was_running, order = 0;
+        struct packet_ring_buffer *rb;
+        struct sk_buff_head *rb_queue;
         __be16 num;
-        int err = 0;
+        int err;
 
-        if (req->tp_block_nr) {
-                int i;
+        rb = tx_ring ? &po->tx_ring : &po->rx_ring;
+        rb_queue = tx_ring ? &sk->sk_write_queue : &sk->sk_receive_queue;
 
-                /* Sanity tests and some calculations */
+        err = -EBUSY;
+        if (!closing) {
+                if (atomic_read(&po->mapped))
+                        goto out;
+                if (atomic_read(&rb->pending))
+                        goto out;
+        }
 
-                if (unlikely(po->pg_vec))
-                        return -EBUSY;
+        if (req->tp_block_nr) {
+                /* Sanity tests and some calculations */
+                err = -EBUSY;
+                if (unlikely(rb->pg_vec))
+                        goto out;
 
                 switch (po->tp_version) {
                 case TPACKET_V1:
@@ -1813,42 +2172,35 @@ static int packet_set_ring(struct sock *sk, struct tpacket_req *req, int closing
                         break;
                 }
 
+                err = -EINVAL;
                 if (unlikely((int)req->tp_block_size <= 0))
-                        return -EINVAL;
+                        goto out;
                 if (unlikely(req->tp_block_size & (PAGE_SIZE - 1)))
-                        return -EINVAL;
+                        goto out;
                 if (unlikely(req->tp_frame_size < po->tp_hdrlen +
-                                                  po->tp_reserve))
-                        return -EINVAL;
+                                        po->tp_reserve))
+                        goto out;
                 if (unlikely(req->tp_frame_size & (TPACKET_ALIGNMENT - 1)))
-                        return -EINVAL;
+                        goto out;
 
-                po->frames_per_block = req->tp_block_size/req->tp_frame_size;
-                if (unlikely(po->frames_per_block <= 0))
-                        return -EINVAL;
-                if (unlikely((po->frames_per_block * req->tp_block_nr) !=
-                             req->tp_frame_nr))
-                        return -EINVAL;
+                rb->frames_per_block = req->tp_block_size/req->tp_frame_size;
+                if (unlikely(rb->frames_per_block <= 0))
+                        goto out;
+                if (unlikely((rb->frames_per_block * req->tp_block_nr) !=
+                                        req->tp_frame_nr))
+                        goto out;
 
                 err = -ENOMEM;
                 order = get_order(req->tp_block_size);
                 pg_vec = alloc_pg_vec(req, order);
                 if (unlikely(!pg_vec))
                         goto out;
-
-                for (i = 0; i < req->tp_block_nr; i++) {
-                        void *ptr = pg_vec[i];
-                        int k;
-
-                        for (k = 0; k < po->frames_per_block; k++) {
-                                __packet_set_status(po, ptr, TP_STATUS_KERNEL);
-                                ptr += req->tp_frame_size;
-                        }
-                }
-                /* Done */
-        } else {
+        }
+        /* Done */
+        else {
+                err = -EINVAL;
                 if (unlikely(req->tp_frame_nr))
-                        return -EINVAL;
+                        goto out;
         }
 
         lock_sock(sk);
@@ -1872,23 +2224,24 @@ static int packet_set_ring(struct sock *sk, struct tpacket_req *req, int closing
         if (closing || atomic_read(&po->mapped) == 0) {
                 err = 0;
 #define XC(a, b) ({ __typeof__ ((a)) __t; __t = (a); (a) = (b); __t; })
-
-                spin_lock_bh(&sk->sk_receive_queue.lock);
-                pg_vec = XC(po->pg_vec, pg_vec);
-                po->frame_max = (req->tp_frame_nr - 1);
-                po->head = 0;
-                po->frame_size = req->tp_frame_size;
-                spin_unlock_bh(&sk->sk_receive_queue.lock);
-
-                order = XC(po->pg_vec_order, order);
-                req->tp_block_nr = XC(po->pg_vec_len, req->tp_block_nr);
-
-                po->pg_vec_pages = req->tp_block_size/PAGE_SIZE;
-                po->prot_hook.func = po->pg_vec ? tpacket_rcv : packet_rcv;
-                skb_queue_purge(&sk->sk_receive_queue);
+                spin_lock_bh(&rb_queue->lock);
+                pg_vec = XC(rb->pg_vec, pg_vec);
+                rb->frame_max = (req->tp_frame_nr - 1);
+                rb->head = 0;
+                rb->frame_size = req->tp_frame_size;
+                spin_unlock_bh(&rb_queue->lock);
+
+                order = XC(rb->pg_vec_order, order);
+                req->tp_block_nr = XC(rb->pg_vec_len, req->tp_block_nr);
+
+                rb->pg_vec_pages = req->tp_block_size/PAGE_SIZE;
+                po->prot_hook.func = (po->rx_ring.pg_vec) ?
+                                                tpacket_rcv : packet_rcv;
+                skb_queue_purge(rb_queue);
 #undef XC
                 if (atomic_read(&po->mapped))
-                        printk(KERN_DEBUG "packet_mmap: vma is busy: %d\n", atomic_read(&po->mapped));
+                        printk(KERN_DEBUG "packet_mmap: vma is busy: %d\n",
+                                                atomic_read(&po->mapped));
         }
         mutex_unlock(&po->pg_vec_lock);
 
@@ -1909,11 +2262,13 @@ out:
         return err;
 }
 
-static int packet_mmap(struct file *file, struct socket *sock, struct vm_area_struct *vma)
+static int packet_mmap(struct file *file, struct socket *sock,
+                struct vm_area_struct *vma)
 {
         struct sock *sk = sock->sk;
         struct packet_sock *po = pkt_sk(sk);
-        unsigned long size;
+        unsigned long size, expected_size;
+        struct packet_ring_buffer *rb;
         unsigned long start;
         int err = -EINVAL;
         int i;
@@ -1921,26 +2276,43 @@ static int packet_mmap(struct file *file, struct socket *sock, struct vm_area_st
         if (vma->vm_pgoff)
                 return -EINVAL;
 
-        size = vma->vm_end - vma->vm_start;
-
         mutex_lock(&po->pg_vec_lock);
-        if (po->pg_vec == NULL)
+
+        expected_size = 0;
+        for (rb = &po->rx_ring; rb <= &po->tx_ring; rb++) {
+                if (rb->pg_vec) {
+                        expected_size += rb->pg_vec_len
+                                                * rb->pg_vec_pages
+                                                * PAGE_SIZE;
+                }
+        }
+
+        if (expected_size == 0)
                 goto out;
-        if (size != po->pg_vec_len*po->pg_vec_pages*PAGE_SIZE)
+
+        size = vma->vm_end - vma->vm_start;
+        if (size != expected_size)
                 goto out;
 
         start = vma->vm_start;
-        for (i = 0; i < po->pg_vec_len; i++) {
-                struct page *page = virt_to_page(po->pg_vec[i]);
-                int pg_num;
-
-                for (pg_num = 0; pg_num < po->pg_vec_pages; pg_num++, page++) {
-                        err = vm_insert_page(vma, start, page);
-                        if (unlikely(err))
-                                goto out;
-                        start += PAGE_SIZE;
+        for (rb = &po->rx_ring; rb <= &po->tx_ring; rb++) {
+                if (rb->pg_vec == NULL)
+                        continue;
+
+                for (i = 0; i < rb->pg_vec_len; i++) {
+                        struct page *page = virt_to_page(rb->pg_vec[i]);
+                        int pg_num;
+
+                        for (pg_num = 0; pg_num < rb->pg_vec_pages;
+                                        pg_num++,page++) {
+                                err = vm_insert_page(vma, start, page);
+                                if (unlikely(err))
+                                        goto out;
+                                start += PAGE_SIZE;
+                        }
                 }
         }
+
         atomic_inc(&po->mapped);
         vma->vm_ops = &packet_mmap_ops;
         err = 0;
diff --git a/net/phonet/pep-gprs.c b/net/phonet/pep-gprs.c
index 4aa888584d20..851f6a3f8ddd 100644
--- a/net/phonet/pep-gprs.c
+++ b/net/phonet/pep-gprs.c
@@ -212,8 +212,9 @@ static int gprs_xmit(struct sk_buff *skb, struct net_device *dev)
                 dev->stats.tx_bytes += len;
         }
 
-        if (!pep_writeable(sk))
-                netif_stop_queue(dev);
+        netif_stop_queue(dev);
+        if (pep_writeable(sk))
+                netif_wake_queue(dev);
         return 0;
 }
 
diff --git a/net/rds/af_rds.c b/net/rds/af_rds.c
index 20cf16fc572f..b11e7e527864 100644
--- a/net/rds/af_rds.c
+++ b/net/rds/af_rds.c
@@ -35,7 +35,6 @@
 #include <linux/kernel.h>
 #include <linux/in.h>
 #include <linux/poll.h>
-#include <linux/version.h>
 #include <net/sock.h>
 
 #include "rds.h"
diff --git a/net/rds/connection.c b/net/rds/connection.c
index 273f064930a8..d14445c48304 100644
--- a/net/rds/connection.c
+++ b/net/rds/connection.c
@@ -148,14 +148,12 @@ static struct rds_connection *__rds_conn_create(__be32 laddr, __be32 faddr,
         if (conn)
                 goto out;
 
-        conn = kmem_cache_alloc(rds_conn_slab, gfp);
+        conn = kmem_cache_zalloc(rds_conn_slab, gfp);
         if (conn == NULL) {
                 conn = ERR_PTR(-ENOMEM);
                 goto out;
         }
 
-        memset(conn, 0, sizeof(*conn));
-
         INIT_HLIST_NODE(&conn->c_hash_node);
         conn->c_version = RDS_PROTOCOL_3_0;
         conn->c_laddr = laddr;
diff --git a/net/rds/ib.c b/net/rds/ib.c
index 4933b380985e..b9bcd32431e1 100644
--- a/net/rds/ib.c
+++ b/net/rds/ib.c
@@ -224,8 +224,8 @@ static int rds_ib_laddr_check(__be32 addr)
          * IB and iWARP capable NICs.
          */
         cm_id = rdma_create_id(NULL, NULL, RDMA_PS_TCP);
-        if (!cm_id)
-                return -EADDRNOTAVAIL;
+        if (IS_ERR(cm_id))
+                return PTR_ERR(cm_id);
 
         memset(&sin, 0, sizeof(sin));
         sin.sin_family = AF_INET;
diff --git a/net/rds/ib.h b/net/rds/ib.h
index 069206cae733..455ae73047fe 100644
--- a/net/rds/ib.h
+++ b/net/rds/ib.h
@@ -333,7 +333,7 @@ int rds_ib_xmit_rdma(struct rds_connection *conn, struct rds_rdma_op *op);
 void rds_ib_send_add_credits(struct rds_connection *conn, unsigned int credits);
 void rds_ib_advertise_credits(struct rds_connection *conn, unsigned int posted);
 int rds_ib_send_grab_credits(struct rds_ib_connection *ic, u32 wanted,
-                             u32 *adv_credits, int need_posted);
+                             u32 *adv_credits, int need_posted, int max_posted);
 
 /* ib_stats.c */
 DECLARE_PER_CPU(struct rds_ib_statistics, rds_ib_stats);
diff --git a/net/rds/ib_recv.c b/net/rds/ib_recv.c
index 36d931573ff4..5709bad28329 100644
--- a/net/rds/ib_recv.c
+++ b/net/rds/ib_recv.c
@@ -524,7 +524,7 @@ void rds_ib_attempt_ack(struct rds_ib_connection *ic)
         }
 
         /* Can we get a send credit? */
-        if (!rds_ib_send_grab_credits(ic, 1, &adv_credits, 0)) {
+        if (!rds_ib_send_grab_credits(ic, 1, &adv_credits, 0, RDS_MAX_ADV_CREDIT)) {
                 rds_ib_stats_inc(s_ib_tx_throttle);
                 clear_bit(IB_ACK_IN_FLIGHT, &ic->i_ack_flags);
                 return;
diff --git a/net/rds/ib_ring.c b/net/rds/ib_ring.c
index 99a6ccae964c..ff97e8eda858 100644
--- a/net/rds/ib_ring.c
+++ b/net/rds/ib_ring.c
@@ -137,7 +137,7 @@ int rds_ib_ring_empty(struct rds_ib_work_ring *ring)
 
 int rds_ib_ring_low(struct rds_ib_work_ring *ring)
 {
-        return __rds_ib_ring_used(ring) <= (ring->w_nr >> 2);
+        return __rds_ib_ring_used(ring) <= (ring->w_nr >> 1);
 }
 
 /*
diff --git a/net/rds/ib_send.c b/net/rds/ib_send.c
index cb6c52cb1c4c..23bf830db2d5 100644
--- a/net/rds/ib_send.c
+++ b/net/rds/ib_send.c
@@ -311,7 +311,7 @@ void rds_ib_send_cq_comp_handler(struct ib_cq *cq, void *context)
  * and using atomic_cmpxchg when updating the two counters.
  */
 int rds_ib_send_grab_credits(struct rds_ib_connection *ic,
-                             u32 wanted, u32 *adv_credits, int need_posted)
+                             u32 wanted, u32 *adv_credits, int need_posted, int max_posted)
 {
         unsigned int avail, posted, got = 0, advertise;
         long oldval, newval;
@@ -351,7 +351,7 @@ try_again:
          * available.
          */
         if (posted && (got || need_posted)) {
-                advertise = min_t(unsigned int, posted, RDS_MAX_ADV_CREDIT);
+                advertise = min_t(unsigned int, posted, max_posted);
                 newval -= IB_SET_POST_CREDITS(advertise);
         }
 
@@ -498,7 +498,7 @@ int rds_ib_xmit(struct rds_connection *conn, struct rds_message *rm,
 
         credit_alloc = work_alloc;
         if (ic->i_flowctl) {
-                credit_alloc = rds_ib_send_grab_credits(ic, work_alloc, &posted, 0);
+                credit_alloc = rds_ib_send_grab_credits(ic, work_alloc, &posted, 0, RDS_MAX_ADV_CREDIT);
                 adv_credits += posted;
                 if (credit_alloc < work_alloc) {
                         rds_ib_ring_unalloc(&ic->i_send_ring, work_alloc - credit_alloc);
@@ -506,7 +506,7 @@ int rds_ib_xmit(struct rds_connection *conn, struct rds_message *rm,
                         flow_controlled++;
                 }
                 if (work_alloc == 0) {
-                        rds_ib_ring_unalloc(&ic->i_send_ring, work_alloc);
+                        set_bit(RDS_LL_SEND_FULL, &conn->c_flags);
                         rds_ib_stats_inc(s_ib_tx_throttle);
                         ret = -ENOMEM;
                         goto out;
@@ -571,7 +571,7 @@ int rds_ib_xmit(struct rds_connection *conn, struct rds_message *rm,
                 /*
                  * Update adv_credits since we reset the ACK_REQUIRED bit.
                  */
-                rds_ib_send_grab_credits(ic, 0, &posted, 1);
+                rds_ib_send_grab_credits(ic, 0, &posted, 1, RDS_MAX_ADV_CREDIT - adv_credits);
                 adv_credits += posted;
                 BUG_ON(adv_credits > 255);
         } else if (ic->i_rm != rm)
diff --git a/net/rds/info.c b/net/rds/info.c
index 1d885535214d..62aeef37aefe 100644
--- a/net/rds/info.c
+++ b/net/rds/info.c
@@ -188,10 +188,7 @@ int rds_info_getsockopt(struct socket *sock, int optname, char __user *optval,
                 ret = -ENOMEM;
                 goto out;
         }
-        down_read(&current->mm->mmap_sem);
-        ret = get_user_pages(current, current->mm, start, nr_pages, 1, 0,
-                             pages, NULL);
-        up_read(&current->mm->mmap_sem);
+        ret = get_user_pages_fast(start, nr_pages, 1, pages);
         if (ret != nr_pages) {
                 if (ret > 0)
                         nr_pages = ret;
diff --git a/net/rds/iw.c b/net/rds/iw.c
index b732efb5b634..d16e1cbc8e83 100644
--- a/net/rds/iw.c
+++ b/net/rds/iw.c
@@ -233,8 +233,8 @@ static int rds_iw_laddr_check(__be32 addr)
          * IB and iWARP capable NICs.
          */
         cm_id = rdma_create_id(NULL, NULL, RDMA_PS_TCP);
-        if (!cm_id)
-                return -EADDRNOTAVAIL;
+        if (IS_ERR(cm_id))
+                return PTR_ERR(cm_id);
 
         memset(&sin, 0, sizeof(sin));
         sin.sin_family = AF_INET;
diff --git a/net/rds/iw.h b/net/rds/iw.h
index b4fb27252895..0715dde323e7 100644
--- a/net/rds/iw.h
+++ b/net/rds/iw.h
@@ -361,7 +361,7 @@ int rds_iw_xmit_rdma(struct rds_connection *conn, struct rds_rdma_op *op);
 void rds_iw_send_add_credits(struct rds_connection *conn, unsigned int credits);
 void rds_iw_advertise_credits(struct rds_connection *conn, unsigned int posted);
 int rds_iw_send_grab_credits(struct rds_iw_connection *ic, u32 wanted,
-                             u32 *adv_credits, int need_posted);
+                             u32 *adv_credits, int need_posted, int max_posted);
 
 /* ib_stats.c */
 DECLARE_PER_CPU(struct rds_iw_statistics, rds_iw_stats);
diff --git a/net/rds/iw_recv.c b/net/rds/iw_recv.c
index fde470fa50d5..8683f5f66c4b 100644
--- a/net/rds/iw_recv.c
+++ b/net/rds/iw_recv.c
@@ -524,7 +524,7 @@ void rds_iw_attempt_ack(struct rds_iw_connection *ic)
         }
 
         /* Can we get a send credit? */
-        if (!rds_iw_send_grab_credits(ic, 1, &adv_credits, 0)) {
+        if (!rds_iw_send_grab_credits(ic, 1, &adv_credits, 0, RDS_MAX_ADV_CREDIT)) {
                 rds_iw_stats_inc(s_iw_tx_throttle);
                 clear_bit(IB_ACK_IN_FLIGHT, &ic->i_ack_flags);
                 return;
diff --git a/net/rds/iw_ring.c b/net/rds/iw_ring.c
index d422d4b5deef..da8e3b63f663 100644
--- a/net/rds/iw_ring.c
+++ b/net/rds/iw_ring.c
@@ -137,7 +137,7 @@ int rds_iw_ring_empty(struct rds_iw_work_ring *ring)
 
 int rds_iw_ring_low(struct rds_iw_work_ring *ring)
 {
-        return __rds_iw_ring_used(ring) <= (ring->w_nr >> 2);
+        return __rds_iw_ring_used(ring) <= (ring->w_nr >> 1);
 }
 
 
diff --git a/net/rds/iw_send.c b/net/rds/iw_send.c
index 22dd38ffd608..44a6a0551f28 100644
--- a/net/rds/iw_send.c
+++ b/net/rds/iw_send.c
@@ -347,7 +347,7 @@ void rds_iw_send_cq_comp_handler(struct ib_cq *cq, void *context)
  * and using atomic_cmpxchg when updating the two counters.
  */
 int rds_iw_send_grab_credits(struct rds_iw_connection *ic,
-                             u32 wanted, u32 *adv_credits, int need_posted)
+                             u32 wanted, u32 *adv_credits, int need_posted, int max_posted)
 {
         unsigned int avail, posted, got = 0, advertise;
         long oldval, newval;
@@ -387,7 +387,7 @@ try_again:
          * available.
          */
         if (posted && (got || need_posted)) {
-                advertise = min_t(unsigned int, posted, RDS_MAX_ADV_CREDIT);
+                advertise = min_t(unsigned int, posted, max_posted);
                 newval -= IB_SET_POST_CREDITS(advertise);
         }
 
@@ -541,7 +541,7 @@ int rds_iw_xmit(struct rds_connection *conn, struct rds_message *rm,
 
         credit_alloc = work_alloc;
         if (ic->i_flowctl) {
-                credit_alloc = rds_iw_send_grab_credits(ic, work_alloc, &posted, 0);
+                credit_alloc = rds_iw_send_grab_credits(ic, work_alloc, &posted, 0, RDS_MAX_ADV_CREDIT);
                 adv_credits += posted;
                 if (credit_alloc < work_alloc) {
                         rds_iw_ring_unalloc(&ic->i_send_ring, work_alloc - credit_alloc);
@@ -549,7 +549,7 @@ int rds_iw_xmit(struct rds_connection *conn, struct rds_message *rm,
                         flow_controlled++;
                 }
                 if (work_alloc == 0) {
-                        rds_iw_ring_unalloc(&ic->i_send_ring, work_alloc);
+                        set_bit(RDS_LL_SEND_FULL, &conn->c_flags);
                         rds_iw_stats_inc(s_iw_tx_throttle);
                         ret = -ENOMEM;
                         goto out;
@@ -614,7 +614,7 @@ int rds_iw_xmit(struct rds_connection *conn, struct rds_message *rm,
                 /*
                  * Update adv_credits since we reset the ACK_REQUIRED bit.
                  */
-                rds_iw_send_grab_credits(ic, 0, &posted, 1);
+                rds_iw_send_grab_credits(ic, 0, &posted, 1, RDS_MAX_ADV_CREDIT - adv_credits);
                 adv_credits += posted;
                 BUG_ON(adv_credits > 255);
         } else if (ic->i_rm != rm)
diff --git a/net/rds/rdma.c b/net/rds/rdma.c
index eaeeb91e1119..8dc83d2caa58 100644
--- a/net/rds/rdma.c
+++ b/net/rds/rdma.c
@@ -150,12 +150,9 @@ static int rds_pin_pages(unsigned long user_addr, unsigned int nr_pages,
 {
         int ret;
 
-        down_read(&current->mm->mmap_sem);
-        ret = get_user_pages(current, current->mm, user_addr,
-                             nr_pages, write, 0, pages, NULL);
-        up_read(&current->mm->mmap_sem);
+        ret = get_user_pages_fast(user_addr, nr_pages, write, pages);
 
-        if (0 <= ret && (unsigned) ret < nr_pages) {
+        if (ret >= 0 && ret < nr_pages) {
                 while (ret--)
                         put_page(pages[ret]);
                 ret = -EFAULT;
diff --git a/net/rds/rdma_transport.c b/net/rds/rdma_transport.c
index 7b19024f9706..7d0f901c93d5 100644
--- a/net/rds/rdma_transport.c
+++ b/net/rds/rdma_transport.c
@@ -34,7 +34,7 @@
 
 #include "rdma_transport.h"
 
-static struct rdma_cm_id *rds_iw_listen_id;
+static struct rdma_cm_id *rds_rdma_listen_id;
 
 int rds_rdma_cm_event_handler(struct rdma_cm_id *cm_id,
                               struct rdma_cm_event *event)
@@ -161,7 +161,7 @@ static int __init rds_rdma_listen_init(void)
 
         rdsdebug("cm %p listening on port %u\n", cm_id, RDS_PORT);
 
-        rds_iw_listen_id = cm_id;
+        rds_rdma_listen_id = cm_id;
         cm_id = NULL;
 out:
         if (cm_id)
@@ -171,10 +171,10 @@ out:
 
 static void rds_rdma_listen_stop(void)
 {
-        if (rds_iw_listen_id) {
-                rdsdebug("cm %p\n", rds_iw_listen_id);
-                rdma_destroy_id(rds_iw_listen_id);
-                rds_iw_listen_id = NULL;
+        if (rds_rdma_listen_id) {
+                rdsdebug("cm %p\n", rds_rdma_listen_id);
+                rdma_destroy_id(rds_rdma_listen_id);
+                rds_rdma_listen_id = NULL;
         }
 }
 
diff --git a/net/rds/rds.h b/net/rds/rds.h
index 71794449ca4e..dbe111236783 100644
--- a/net/rds/rds.h
+++ b/net/rds/rds.h
@@ -132,7 +132,7 @@ struct rds_connection {
 #define RDS_FLAG_CONG_BITMAP    0x01
 #define RDS_FLAG_ACK_REQUIRED   0x02
 #define RDS_FLAG_RETRANSMITTED  0x04
-#define RDS_MAX_ADV_CREDIT      127
+#define RDS_MAX_ADV_CREDIT      255
 
 /*
  * Maximum space available for extension headers.
diff --git a/net/rds/send.c b/net/rds/send.c
index 104fe033203d..a4a7f428cd76 100644
--- a/net/rds/send.c
+++ b/net/rds/send.c
@@ -854,11 +854,6 @@ int rds_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
 
         rm->m_daddr = daddr;
 
-        /* Parse any control messages the user may have included. */
-        ret = rds_cmsg_send(rs, rm, msg, &allocated_mr);
-        if (ret)
-                goto out;
-
         /* rds_conn_create has a spinlock that runs with IRQ off.
          * Caching the conn in the socket helps a lot. */
         if (rs->rs_conn && rs->rs_conn->c_faddr == daddr)
@@ -874,6 +869,11 @@ int rds_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
                 rs->rs_conn = conn;
         }
 
+        /* Parse any control messages the user may have included. */
+        ret = rds_cmsg_send(rs, rm, msg, &allocated_mr);
+        if (ret)
+                goto out;
+
         if ((rm->m_rdma_cookie || rm->m_rdma_op)
          && conn->c_trans->xmit_rdma == NULL) {
                 if (printk_ratelimit())
diff --git a/net/rfkill/rfkill-input.c b/net/rfkill/rfkill-input.c
index 84efde97c5a7..60a34f3b5f65 100644
--- a/net/rfkill/rfkill-input.c
+++ b/net/rfkill/rfkill-input.c
@@ -47,12 +47,6 @@ enum rfkill_global_sched_op {
         RFKILL_GLOBAL_OP_UNBLOCK,
 };
 
-/*
- * Currently, the code marked with RFKILL_NEED_SWSET is inactive.
- * If handling of EV_SW SW_WLAN/WWAN/BLUETOOTH/etc is needed in the
- * future, when such events are added, that code will be necessary.
- */
-
 struct rfkill_task {
         struct delayed_work dwork;
 
@@ -65,14 +59,6 @@ struct rfkill_task {
         /* pending regular switch operations (1=pending) */
         unsigned long sw_pending[BITS_TO_LONGS(RFKILL_TYPE_MAX)];
 
-#ifdef RFKILL_NEED_SWSET
-        /* set operation pending (1=pending) */
-        unsigned long sw_setpending[BITS_TO_LONGS(RFKILL_TYPE_MAX)];
-
-        /* desired state for pending set operation (1=unblock) */
-        unsigned long sw_newstate[BITS_TO_LONGS(RFKILL_TYPE_MAX)];
-#endif
-
         /* should the state be complemented (1=yes) */
         unsigned long sw_togglestate[BITS_TO_LONGS(RFKILL_TYPE_MAX)];
 
@@ -111,24 +97,6 @@ static void __rfkill_handle_global_op(enum rfkill_global_sched_op op)
         }
 }
 
-#ifdef RFKILL_NEED_SWSET
-static void __rfkill_handle_normal_op(const enum rfkill_type type,
-                        const bool sp, const bool s, const bool c)
-{
-        enum rfkill_state state;
-
-        if (sp)
-                state = (s) ? RFKILL_STATE_UNBLOCKED :
-                              RFKILL_STATE_SOFT_BLOCKED;
-        else
-                state = rfkill_get_global_state(type);
-
-        if (c)
-                state = rfkill_state_complement(state);
-
-        rfkill_switch_all(type, state);
-}
-#else
 static void __rfkill_handle_normal_op(const enum rfkill_type type,
                         const bool c)
 {
@@ -140,7 +108,6 @@ static void __rfkill_handle_normal_op(const enum rfkill_type type,
 
         rfkill_switch_all(type, state);
 }
-#endif
 
 static void rfkill_task_handler(struct work_struct *work)
 {
@@ -171,21 +138,11 @@ static void rfkill_task_handler(struct work_struct *work)
                                                 i < RFKILL_TYPE_MAX) {
                                 if (test_and_clear_bit(i, task->sw_pending)) {
                                         bool c;
-#ifdef RFKILL_NEED_SWSET
-                                        bool sp, s;
-                                        sp = test_and_clear_bit(i,
-                                                        task->sw_setpending);
-                                        s = test_bit(i, task->sw_newstate);
-#endif
                                         c = test_and_clear_bit(i,
                                                         task->sw_togglestate);
                                         spin_unlock_irq(&task->lock);
 
-#ifdef RFKILL_NEED_SWSET
-                                        __rfkill_handle_normal_op(i, sp, s, c);
-#else
                                         __rfkill_handle_normal_op(i, c);
-#endif
 
                                         spin_lock_irq(&task->lock);
                                 }
@@ -238,32 +195,6 @@ static void rfkill_schedule_global_op(enum rfkill_global_sched_op op)
         spin_unlock_irqrestore(&rfkill_task.lock, flags);
 }
 
-#ifdef RFKILL_NEED_SWSET
-/* Use this if you need to add EV_SW SW_WLAN/WWAN/BLUETOOTH/etc handling */
-
-static void rfkill_schedule_set(enum rfkill_type type,
-                                enum rfkill_state desired_state)
-{
-        unsigned long flags;
-
-        if (rfkill_is_epo_lock_active())
-                return;
-
-        spin_lock_irqsave(&rfkill_task.lock, flags);
-        if (!rfkill_task.global_op_pending) {
-                set_bit(type, rfkill_task.sw_pending);
-                set_bit(type, rfkill_task.sw_setpending);
-                clear_bit(type, rfkill_task.sw_togglestate);
-                if (desired_state)
-                        set_bit(type,  rfkill_task.sw_newstate);
-                else
-                        clear_bit(type, rfkill_task.sw_newstate);
-                rfkill_schedule_ratelimited();
-        }
-        spin_unlock_irqrestore(&rfkill_task.lock, flags);
-}
-#endif
-
 static void rfkill_schedule_toggle(enum rfkill_type type)
 {
         unsigned long flags;
diff --git a/net/rfkill/rfkill.c b/net/rfkill/rfkill.c
index 3eaa39403c13..4f5a83183c95 100644
--- a/net/rfkill/rfkill.c
+++ b/net/rfkill/rfkill.c
@@ -75,6 +75,11 @@ static void rfkill_led_trigger_activate(struct led_classdev *led)
 
         rfkill_led_trigger(rfkill, rfkill->state);
 }
+#else
+static inline void rfkill_led_trigger(struct rfkill *rfkill,
+                                        enum rfkill_state state)
+{
+}
 #endif /* CONFIG_RFKILL_LEDS */
 
 static void rfkill_uevent(struct rfkill *rfkill)
@@ -96,6 +101,7 @@ static void update_rfkill_state(struct rfkill *rfkill)
                 }
                 mutex_unlock(&rfkill->mutex);
         }
+        rfkill_led_trigger(rfkill, rfkill->state);
 }
 
 /**
@@ -136,8 +142,9 @@ static int rfkill_toggle_radio(struct rfkill *rfkill,
         oldstate = rfkill->state;
 
         if (rfkill->get_state && !force &&
-            !rfkill->get_state(rfkill->data, &newstate))
+            !rfkill->get_state(rfkill->data, &newstate)) {
                 rfkill->state = newstate;
+        }
 
         switch (state) {
         case RFKILL_STATE_HARD_BLOCKED:
@@ -172,6 +179,7 @@ static int rfkill_toggle_radio(struct rfkill *rfkill,
         if (force || rfkill->state != oldstate)
                 rfkill_uevent(rfkill);
 
+        rfkill_led_trigger(rfkill, rfkill->state);
         return retval;
 }
 
@@ -200,10 +208,11 @@ static void __rfkill_switch_all(const enum rfkill_type type,
 
         rfkill_global_states[type].current_state = state;
         list_for_each_entry(rfkill, &rfkill_list, node) {
-                if ((!rfkill->user_claim) && (rfkill->type == type)) {
+                if (rfkill->type == type) {
                         mutex_lock(&rfkill->mutex);
                         rfkill_toggle_radio(rfkill, state, 0);
                         mutex_unlock(&rfkill->mutex);
+                        rfkill_led_trigger(rfkill, rfkill->state);
                 }
         }
 }
@@ -256,6 +265,7 @@ void rfkill_epo(void)
                                 RFKILL_STATE_SOFT_BLOCKED;
         }
         mutex_unlock(&rfkill_global_mutex);
+        rfkill_led_trigger(rfkill, rfkill->state);
 }
 EXPORT_SYMBOL_GPL(rfkill_epo);
 
@@ -358,6 +368,7 @@ int rfkill_force_state(struct rfkill *rfkill, enum rfkill_state state)
                 rfkill_uevent(rfkill);
 
         mutex_unlock(&rfkill->mutex);
+        rfkill_led_trigger(rfkill, rfkill->state);
 
         return 0;
 }
@@ -447,53 +458,14 @@ static ssize_t rfkill_claim_show(struct device *dev,
                                  struct device_attribute *attr,
                                  char *buf)
 {
-        struct rfkill *rfkill = to_rfkill(dev);
-
-        return sprintf(buf, "%d\n", rfkill->user_claim);
+        return sprintf(buf, "%d\n", 0);
 }
 
 static ssize_t rfkill_claim_store(struct device *dev,
                                   struct device_attribute *attr,
                                   const char *buf, size_t count)
 {
-        struct rfkill *rfkill = to_rfkill(dev);
-        unsigned long claim_tmp;
-        bool claim;
-        int error;
-
-        if (!capable(CAP_NET_ADMIN))
-                return -EPERM;
-
-        if (rfkill->user_claim_unsupported)
-                return -EOPNOTSUPP;
-
-        error = strict_strtoul(buf, 0, &claim_tmp);
-        if (error)
-                return error;
-        claim = !!claim_tmp;
-
-        /*
-         * Take the global lock to make sure the kernel is not in
-         * the middle of rfkill_switch_all
-         */
-        error = mutex_lock_killable(&rfkill_global_mutex);
-        if (error)
-                return error;
-
-        if (rfkill->user_claim != claim) {
-                if (!claim && !rfkill_epo_lock_active) {
-                        mutex_lock(&rfkill->mutex);
-                        rfkill_toggle_radio(rfkill,
-                                        rfkill_global_states[rfkill->type].current_state,
-                                        0);
-                        mutex_unlock(&rfkill->mutex);
-                }
-                rfkill->user_claim = claim;
-        }
-
-        mutex_unlock(&rfkill_global_mutex);
-
-        return error ? error : count;
+        return -EOPNOTSUPP;
 }
 
 static struct device_attribute rfkill_dev_attrs[] = {
@@ -559,6 +531,7 @@ static int rfkill_resume(struct device *dev)
                                 1);
 
                 mutex_unlock(&rfkill->mutex);
+                rfkill_led_trigger(rfkill, rfkill->state);
         }
 
         return 0;
diff --git a/net/sched/cls_cgroup.c b/net/sched/cls_cgroup.c
index cc29b44b1500..0f815cc6a3db 100644
--- a/net/sched/cls_cgroup.c
+++ b/net/sched/cls_cgroup.c
@@ -62,13 +62,7 @@ static u64 read_classid(struct cgroup *cgrp, struct cftype *cft)
 
 static int write_classid(struct cgroup *cgrp, struct cftype *cft, u64 value)
 {
-        if (!cgroup_lock_live_group(cgrp))
-                return -ENODEV;
-
         cgrp_cls_state(cgrp)->classid = (u32) value;
-
-        cgroup_unlock();
-
         return 0;
 }
 
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index 5f5efe4e6072..27d03816ec3e 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -196,6 +196,21 @@ void __qdisc_run(struct Qdisc *q)
         clear_bit(__QDISC_STATE_RUNNING, &q->state);
 }
 
+unsigned long dev_trans_start(struct net_device *dev)
+{
+        unsigned long val, res = dev->trans_start;
+        unsigned int i;
+
+        for (i = 0; i < dev->num_tx_queues; i++) {
+                val = netdev_get_tx_queue(dev, i)->trans_start;
+                if (val && time_after(val, res))
+                        res = val;
+        }
+        dev->trans_start = res;
+        return res;
+}
+EXPORT_SYMBOL(dev_trans_start);
+
 static void dev_watchdog(unsigned long arg)
 {
         struct net_device *dev = (struct net_device *)arg;
@@ -205,25 +220,30 @@ static void dev_watchdog(unsigned long arg)
                 if (netif_device_present(dev) &&
                     netif_running(dev) &&
                     netif_carrier_ok(dev)) {
-                        int some_queue_stopped = 0;
+                        int some_queue_timedout = 0;
                         unsigned int i;
+                        unsigned long trans_start;
 
                         for (i = 0; i < dev->num_tx_queues; i++) {
                                 struct netdev_queue *txq;
 
                                 txq = netdev_get_tx_queue(dev, i);
-                                if (netif_tx_queue_stopped(txq)) {
-                                        some_queue_stopped = 1;
+                                /*
+                                 * old device drivers set dev->trans_start
+                                 */
+                                trans_start = txq->trans_start ? : dev->trans_start;
+                                if (netif_tx_queue_stopped(txq) &&
+                                    time_after(jiffies, (trans_start +
+                                                         dev->watchdog_timeo))) {
+                                        some_queue_timedout = 1;
                                         break;
                                 }
                         }
 
-                        if (some_queue_stopped &&
-                            time_after(jiffies, (dev->trans_start +
-                                                 dev->watchdog_timeo))) {
+                        if (some_queue_timedout) {
                                 char drivername[64];
-                                WARN_ONCE(1, KERN_INFO "NETDEV WATCHDOG: %s (%s): transmit timed out\n",
-                                       dev->name, netdev_drivername(dev, drivername, 64));
+                                WARN_ONCE(1, KERN_INFO "NETDEV WATCHDOG: %s (%s): transmit queue %u timed out\n",
+                                       dev->name, netdev_drivername(dev, drivername, 64), i);
                                 dev->netdev_ops->ndo_tx_timeout(dev);
                         }
                         if (!mod_timer(&dev->watchdog_timer,
@@ -602,8 +622,10 @@ static void transition_one_qdisc(struct net_device *dev,
                 clear_bit(__QDISC_STATE_DEACTIVATED, &new_qdisc->state);
 
         rcu_assign_pointer(dev_queue->qdisc, new_qdisc);
-        if (need_watchdog_p && new_qdisc != &noqueue_qdisc)
+        if (need_watchdog_p && new_qdisc != &noqueue_qdisc) {
+                dev_queue->trans_start = 0;
                 *need_watchdog_p = 1;
+        }
 }
 
 void dev_activate(struct net_device *dev)
diff --git a/net/sched/sch_teql.c b/net/sched/sch_teql.c
index 3b6418297231..a886496bdc3a 100644
--- a/net/sched/sch_teql.c
+++ b/net/sched/sch_teql.c
@@ -58,7 +58,6 @@ struct teql_master
         struct net_device *dev;
         struct Qdisc *slaves;
         struct list_head master_list;
-        struct net_device_stats stats;
 };
 
 struct teql_sched_data
@@ -272,6 +271,7 @@ static inline int teql_resolve(struct sk_buff *skb,
 static int teql_master_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         struct teql_master *master = netdev_priv(dev);
+        struct netdev_queue *txq = netdev_get_tx_queue(dev, 0);
         struct Qdisc *start, *q;
         int busy;
         int nores;
@@ -308,11 +308,12 @@ restart:
                                 if (!netif_tx_queue_stopped(slave_txq) &&
                                     !netif_tx_queue_frozen(slave_txq) &&
                                     slave_ops->ndo_start_xmit(skb, slave) == 0) {
+                                        txq_trans_update(slave_txq);
                                         __netif_tx_unlock(slave_txq);
                                         master->slaves = NEXT_SLAVE(q);
                                         netif_wake_queue(dev);
-                                        master->stats.tx_packets++;
-                                        master->stats.tx_bytes += length;
+                                        txq->tx_packets++;
+                                        txq->tx_bytes += length;
                                         return 0;
                                 }
                                 __netif_tx_unlock(slave_txq);
@@ -339,10 +340,10 @@ restart:
                 netif_stop_queue(dev);
                 return 1;
         }
-        master->stats.tx_errors++;
+        dev->stats.tx_errors++;
 
 drop:
-        master->stats.tx_dropped++;
+        txq->tx_dropped++;
         dev_kfree_skb(skb);
         return 0;
 }
@@ -395,12 +396,6 @@ static int teql_master_close(struct net_device *dev)
         return 0;
 }
 
-static struct net_device_stats *teql_master_stats(struct net_device *dev)
-{
-        struct teql_master *m = netdev_priv(dev);
-        return &m->stats;
-}
-
 static int teql_master_mtu(struct net_device *dev, int new_mtu)
 {
         struct teql_master *m = netdev_priv(dev);
@@ -425,7 +420,6 @@ static const struct net_device_ops teql_netdev_ops = {
         .ndo_open       = teql_master_open,
         .ndo_stop       = teql_master_close,
         .ndo_start_xmit = teql_master_xmit,
-        .ndo_get_stats  = teql_master_stats,
         .ndo_change_mtu = teql_master_mtu,
 };
 
diff --git a/net/sctp/output.c b/net/sctp/output.c
index 7d08f522ec84..f0c91df59d4e 100644
--- a/net/sctp/output.c
+++ b/net/sctp/output.c
@@ -412,6 +412,7 @@ int sctp_packet_transmit(struct sctp_packet *packet)
 
         /* Build the SCTP header.  */
         sh = (struct sctphdr *)skb_push(nskb, sizeof(struct sctphdr));
+        skb_reset_transport_header(nskb);
         sh->source = htons(packet->source_port);
         sh->dest   = htons(packet->destination_port);
 
@@ -527,15 +528,25 @@ int sctp_packet_transmit(struct sctp_packet *packet)
          * Note: Adler-32 is no longer applicable, as has been replaced
          * by CRC32-C as described in <draft-ietf-tsvwg-sctpcsum-02.txt>.
          */
-        if (!sctp_checksum_disable && !(dst->dev->features & NETIF_F_NO_CSUM)) {
+        if (!sctp_checksum_disable &&
+            !(dst->dev->features & (NETIF_F_NO_CSUM | NETIF_F_SCTP_CSUM))) {
                 __u32 crc32 = sctp_start_cksum((__u8 *)sh, cksum_buf_len);
 
                 /* 3) Put the resultant value into the checksum field in the
                  *    common header, and leave the rest of the bits unchanged.
                  */
                 sh->checksum = sctp_end_cksum(crc32);
-        } else
-                nskb->ip_summed = CHECKSUM_UNNECESSARY;
+        } else {
+                if (dst->dev->features & NETIF_F_SCTP_CSUM) {
+                        /* no need to seed psuedo checksum for SCTP */
+                        nskb->ip_summed = CHECKSUM_PARTIAL;
+                        nskb->csum_start = (skb_transport_header(nskb) -
+                                            nskb->head);
+                        nskb->csum_offset = offsetof(struct sctphdr, checksum);
+                } else {
+                        nskb->ip_summed = CHECKSUM_UNNECESSARY;
+                }
+        }
 
         /* IP layer ECN support
          * From RFC 2481
diff --git a/net/tipc/eth_media.c b/net/tipc/eth_media.c
index f72ba774c246..524ba5696d4d 100644
--- a/net/tipc/eth_media.c
+++ b/net/tipc/eth_media.c
@@ -167,7 +167,7 @@ static int enable_bearer(struct tipc_bearer *tb_ptr)
         tb_ptr->mtu = dev->mtu;
         tb_ptr->blocked = 0;
         tb_ptr->addr.type = htonl(TIPC_MEDIA_TYPE_ETH);
-        memcpy(&tb_ptr->addr.dev_addr, &dev->dev_addr, ETH_ALEN);
+        memcpy(&tb_ptr->addr.dev_addr, dev->dev_addr, ETH_ALEN);
         return 0;
 }
 
diff --git a/net/tipc/netlink.c b/net/tipc/netlink.c
index c387217bb230..3c57005e44d1 100644
--- a/net/tipc/netlink.c
+++ b/net/tipc/netlink.c
@@ -68,7 +68,7 @@ static int handle_cmd(struct sk_buff *skb, struct genl_info *info)
         return 0;
 }
 
-static struct genl_family family = {
+static struct genl_family tipc_genl_family = {
         .id             = GENL_ID_GENERATE,
         .name           = TIPC_GENL_NAME,
         .version        = TIPC_GENL_VERSION,
@@ -76,39 +76,33 @@ static struct genl_family family = {
         .maxattr        = 0,
 };
 
-static struct genl_ops ops = {
+static struct genl_ops tipc_genl_ops = {
         .cmd            = TIPC_GENL_CMD,
         .doit           = handle_cmd,
 };
 
-static int family_registered = 0;
+static int tipc_genl_family_registered;
 
 int tipc_netlink_start(void)
 {
+        int res;
 
+        res = genl_register_family_with_ops(&tipc_genl_family,
+                &tipc_genl_ops, 1);
+        if (res) {
+                err("Failed to register netlink interface\n");
+                return res;
+        }
 
-        if (genl_register_family(&family))
-                goto err;
-
-        family_registered = 1;
-
-        if (genl_register_ops(&family, &ops))
-                goto err_unregister;
-
+        tipc_genl_family_registered = 1;
         return 0;
-
- err_unregister:
-        genl_unregister_family(&family);
-        family_registered = 0;
- err:
-        err("Failed to register netlink interface\n");
-        return -EFAULT;
 }
 
 void tipc_netlink_stop(void)
 {
-        if (family_registered) {
-                genl_unregister_family(&family);
-                family_registered = 0;
-        }
+        if (!tipc_genl_family_registered)
+                return;
+
+        genl_unregister_family(&tipc_genl_family);
+        tipc_genl_family_registered = 0;
 }
diff --git a/net/wimax/Makefile b/net/wimax/Makefile
index 5b80b941c2c9..8f1510d0cc2b 100644
--- a/net/wimax/Makefile
+++ b/net/wimax/Makefile
@@ -6,6 +6,7 @@ wimax-y :=		\
         op-msg.o        \
         op-reset.o      \
         op-rfkill.o     \
+        op-state-get.o  \
         stack.o
 
 wimax-$(CONFIG_DEBUG_FS) += debugfs.o
diff --git a/net/wimax/debug-levels.h b/net/wimax/debug-levels.h
index 1c29123a3aa9..0975adba6b71 100644
--- a/net/wimax/debug-levels.h
+++ b/net/wimax/debug-levels.h
@@ -36,6 +36,7 @@ enum d_module {
         D_SUBMODULE_DECLARE(op_msg),
         D_SUBMODULE_DECLARE(op_reset),
         D_SUBMODULE_DECLARE(op_rfkill),
+        D_SUBMODULE_DECLARE(op_state_get),
         D_SUBMODULE_DECLARE(stack),
 };
 
diff --git a/net/wimax/debugfs.c b/net/wimax/debugfs.c
index 94d216a46407..6c9bedb7431e 100644
--- a/net/wimax/debugfs.c
+++ b/net/wimax/debugfs.c
@@ -61,6 +61,7 @@ int wimax_debugfs_add(struct wimax_dev *wimax_dev)
         __debugfs_register("wimax_dl_", op_msg, dentry);
         __debugfs_register("wimax_dl_", op_reset, dentry);
         __debugfs_register("wimax_dl_", op_rfkill, dentry);
+        __debugfs_register("wimax_dl_", op_state_get, dentry);
         __debugfs_register("wimax_dl_", stack, dentry);
         result = 0;
 out:
diff --git a/net/wimax/op-msg.c b/net/wimax/op-msg.c
index 9ad4d893a566..d631a17186bc 100644
--- a/net/wimax/op-msg.c
+++ b/net/wimax/op-msg.c
@@ -108,6 +108,12 @@
  * Don't use skb_push()/skb_pull()/skb_reserve() on the skb, as
  * wimax_msg_send() depends on skb->data being placed at the
  * beginning of the user message.
+ *
+ * Unlike other WiMAX stack calls, this call can be used way early,
+ * even before wimax_dev_add() is called, as long as the
+ * wimax_dev->net_dev pointer is set to point to a proper
+ * net_dev. This is so that drivers can use it early in case they need
+ * to send stuff around or communicate with user space.
  */
 struct sk_buff *wimax_msg_alloc(struct wimax_dev *wimax_dev,
                                 const char *pipe_name,
@@ -115,7 +121,7 @@ struct sk_buff *wimax_msg_alloc(struct wimax_dev *wimax_dev,
                                 gfp_t gfp_flags)
 {
         int result;
-        struct device *dev = wimax_dev->net_dev->dev.parent;
+        struct device *dev = wimax_dev_to_dev(wimax_dev);
         size_t msg_size;
         void *genl_msg;
         struct sk_buff *skb;
@@ -161,7 +167,6 @@ error_genlmsg_put:
 error_new:
         nlmsg_free(skb);
         return ERR_PTR(result);
-
 }
 EXPORT_SYMBOL_GPL(wimax_msg_alloc);
 
@@ -256,10 +261,16 @@ EXPORT_SYMBOL_GPL(wimax_msg_len);
  * Don't use skb_push()/skb_pull()/skb_reserve() on the skb, as
  * wimax_msg_send() depends on skb->data being placed at the
  * beginning of the user message.
+ *
+ * Unlike other WiMAX stack calls, this call can be used way early,
+ * even before wimax_dev_add() is called, as long as the
+ * wimax_dev->net_dev pointer is set to point to a proper
+ * net_dev. This is so that drivers can use it early in case they need
+ * to send stuff around or communicate with user space.
  */
 int wimax_msg_send(struct wimax_dev *wimax_dev, struct sk_buff *skb)
 {
-        struct device *dev = wimax_dev->net_dev->dev.parent;
+        struct device *dev = wimax_dev_to_dev(wimax_dev);
         void *msg = skb->data;
         size_t size = skb->len;
         might_sleep();
diff --git a/net/wimax/op-rfkill.c b/net/wimax/op-rfkill.c
index 2b75aee04217..a3616e2ccb8a 100644
--- a/net/wimax/op-rfkill.c
+++ b/net/wimax/op-rfkill.c
@@ -113,7 +113,7 @@ void wimax_report_rfkill_hw(struct wimax_dev *wimax_dev,
         if (state != wimax_dev->rf_hw) {
                 wimax_dev->rf_hw = state;
                 rfkill_state = state == WIMAX_RF_ON ?
-                        RFKILL_STATE_OFF : RFKILL_STATE_ON;
+                        RFKILL_STATE_UNBLOCKED : RFKILL_STATE_SOFT_BLOCKED;
                 if (wimax_dev->rf_hw == WIMAX_RF_ON
                     && wimax_dev->rf_sw == WIMAX_RF_ON)
                         wimax_state = WIMAX_ST_READY;
@@ -259,10 +259,10 @@ int wimax_rfkill_toggle_radio(void *data, enum rfkill_state state)
 
         d_fnstart(3, dev, "(wimax_dev %p state %u)\n", wimax_dev, state);
         switch (state) {
-        case RFKILL_STATE_ON:
+        case RFKILL_STATE_SOFT_BLOCKED:
                 rf_state = WIMAX_RF_OFF;
                 break;
-        case RFKILL_STATE_OFF:
+        case RFKILL_STATE_UNBLOCKED:
                 rf_state = WIMAX_RF_ON;
                 break;
         default:
@@ -361,10 +361,9 @@ int wimax_rfkill_add(struct wimax_dev *wimax_dev)
         wimax_dev->rfkill = rfkill;
 
         rfkill->name = wimax_dev->name;
-        rfkill->state = RFKILL_STATE_OFF;
+        rfkill->state = RFKILL_STATE_UNBLOCKED;
         rfkill->data = wimax_dev;
         rfkill->toggle_radio = wimax_rfkill_toggle_radio;
-        rfkill->user_claim_unsupported = 1;
 
         /* Initialize the input device for the hw key */
         input_dev = input_allocate_device();
diff --git a/net/wimax/op-state-get.c b/net/wimax/op-state-get.c
new file mode 100644
index 000000000000..a76b8fcb056d
--- /dev/null
+++ b/net/wimax/op-state-get.c
@@ -0,0 +1,86 @@
+/*
+ * Linux WiMAX
+ * Implement and export a method for getting a WiMAX device current state
+ *
+ * Copyright (C) 2009 Paulius Zaleckas <paulius.zaleckas@teltonika.lt>
+ *
+ * Based on previous WiMAX core work by:
+ *  Copyright (C) 2008 Intel Corporation <linux-wimax@intel.com>
+ *  Inaky Perez-Gonzalez <inaky.perez-gonzalez@intel.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License version
+ * 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ */
+
+#include <net/wimax.h>
+#include <net/genetlink.h>
+#include <linux/wimax.h>
+#include <linux/security.h>
+#include "wimax-internal.h"
+
+#define D_SUBMODULE op_state_get
+#include "debug-levels.h"
+
+
+static const
+struct nla_policy wimax_gnl_state_get_policy[WIMAX_GNL_ATTR_MAX + 1] = {
+        [WIMAX_GNL_STGET_IFIDX] = {
+                .type = NLA_U32,
+        },
+};
+
+
+/*
+ * Exporting to user space over generic netlink
+ *
+ * Parse the state get command from user space, return a combination
+ * value that describe the current state.
+ *
+ * No attributes.
+ */
+static
+int wimax_gnl_doit_state_get(struct sk_buff *skb, struct genl_info *info)
+{
+        int result, ifindex;
+        struct wimax_dev *wimax_dev;
+        struct device *dev;
+
+        d_fnstart(3, NULL, "(skb %p info %p)\n", skb, info);
+        result = -ENODEV;
+        if (info->attrs[WIMAX_GNL_STGET_IFIDX] == NULL) {
+                printk(KERN_ERR "WIMAX_GNL_OP_STATE_GET: can't find IFIDX "
+                        "attribute\n");
+                goto error_no_wimax_dev;
+        }
+        ifindex = nla_get_u32(info->attrs[WIMAX_GNL_STGET_IFIDX]);
+        wimax_dev = wimax_dev_get_by_genl_info(info, ifindex);
+        if (wimax_dev == NULL)
+                goto error_no_wimax_dev;
+        dev = wimax_dev_to_dev(wimax_dev);
+        /* Execute the operation and send the result back to user space */
+        result = wimax_state_get(wimax_dev);
+        dev_put(wimax_dev->net_dev);
+error_no_wimax_dev:
+        d_fnend(3, NULL, "(skb %p info %p) = %d\n", skb, info, result);
+        return result;
+}
+
+
+struct genl_ops wimax_gnl_state_get = {
+        .cmd = WIMAX_GNL_OP_STATE_GET,
+        .flags = GENL_ADMIN_PERM,
+        .policy = wimax_gnl_state_get_policy,
+        .doit = wimax_gnl_doit_state_get,
+        .dumpit = NULL,
+};
diff --git a/net/wimax/stack.c b/net/wimax/stack.c
index 933e1422b09f..79fb7d7c640f 100644
--- a/net/wimax/stack.c
+++ b/net/wimax/stack.c
@@ -402,13 +402,15 @@ EXPORT_SYMBOL_GPL(wimax_dev_init);
 extern struct genl_ops
         wimax_gnl_msg_from_user,
         wimax_gnl_reset,
-        wimax_gnl_rfkill;
+        wimax_gnl_rfkill,
+        wimax_gnl_state_get;
 
 static
 struct genl_ops *wimax_gnl_ops[] = {
         &wimax_gnl_msg_from_user,
         &wimax_gnl_reset,
         &wimax_gnl_rfkill,
+        &wimax_gnl_state_get,
 };
 
 
@@ -533,6 +535,7 @@ struct d_level D_LEVEL[] = {
         D_SUBMODULE_DEFINE(op_msg),
         D_SUBMODULE_DEFINE(op_reset),
         D_SUBMODULE_DEFINE(op_rfkill),
+        D_SUBMODULE_DEFINE(op_state_get),
         D_SUBMODULE_DEFINE(stack),
 };
 size_t D_LEVEL_SIZE = ARRAY_SIZE(D_LEVEL);
diff --git a/net/wireless/Kconfig b/net/wireless/Kconfig
index 3c3bc9e579ed..45005497c634 100644
--- a/net/wireless/Kconfig
+++ b/net/wireless/Kconfig
@@ -10,6 +10,14 @@ config CFG80211_REG_DEBUG
 
           If unsure, say N.
 
+config CFG80211_DEBUGFS
+        bool "cfg80211 DebugFS entries"
+        depends on CFG80211 && DEBUG_FS
+        ---help---
+          You can enable this if you want to debugfs entries for cfg80211.
+
+          If unsure, say N.
+
 config WIRELESS_OLD_REGULATORY
         bool "Old wireless static regulatory definitions"
         default n
diff --git a/net/wireless/Makefile b/net/wireless/Makefile
index 6d1e7b27b752..f78c4832a9ca 100644
--- a/net/wireless/Makefile
+++ b/net/wireless/Makefile
@@ -5,7 +5,8 @@ obj-$(CONFIG_LIB80211_CRYPT_WEP) += lib80211_crypt_wep.o
 obj-$(CONFIG_LIB80211_CRYPT_CCMP) += lib80211_crypt_ccmp.o
 obj-$(CONFIG_LIB80211_CRYPT_TKIP) += lib80211_crypt_tkip.o
 
-cfg80211-y += core.o sysfs.o radiotap.o util.o reg.o scan.o nl80211.o mlme.o
+cfg80211-y += core.o sysfs.o radiotap.o util.o reg.o scan.o nl80211.o mlme.o ibss.o
+cfg80211-$(CONFIG_CFG80211_DEBUGFS) += debugfs.o
 cfg80211-$(CONFIG_WIRELESS_EXT) += wext-compat.o
 
 ccflags-y += -D__CHECK_ENDIAN__
diff --git a/net/wireless/core.c b/net/wireless/core.c
index d1f556535f6d..a5dbea1da476 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -1,7 +1,7 @@
 /*
  * This is the linux wireless configuration interface.
  *
- * Copyright 2006-2008          Johannes Berg <johannes@sipsolutions.net>
+ * Copyright 2006-2009          Johannes Berg <johannes@sipsolutions.net>
  */
 
 #include <linux/if.h>
@@ -14,10 +14,10 @@
 #include <linux/device.h>
 #include <net/genetlink.h>
 #include <net/cfg80211.h>
-#include <net/wireless.h>
 #include "nl80211.h"
 #include "core.h"
 #include "sysfs.h"
+#include "debugfs.h"
 
 /* name for sysfs, %d is appended */
 #define PHY_NAME "phy"
@@ -229,7 +229,7 @@ int cfg80211_dev_rename(struct cfg80211_registered_device *rdev,
 
 /* exported functions */
 
-struct wiphy *wiphy_new(struct cfg80211_ops *ops, int sizeof_priv)
+struct wiphy *wiphy_new(const struct cfg80211_ops *ops, int sizeof_priv)
 {
         static int wiphy_counter;
 
@@ -274,6 +274,16 @@ struct wiphy *wiphy_new(struct cfg80211_ops *ops, int sizeof_priv)
         drv->wiphy.dev.class = &ieee80211_class;
         drv->wiphy.dev.platform_data = drv;
 
+        /*
+         * Initialize wiphy parameters to IEEE 802.11 MIB default values.
+         * Fragmentation and RTS threshold are disabled by default with the
+         * special -1 value.
+         */
+        drv->wiphy.retry_short = 7;
+        drv->wiphy.retry_long = 4;
+        drv->wiphy.frag_threshold = (u32) -1;
+        drv->wiphy.rts_threshold = (u32) -1;
+
         return &drv->wiphy;
 }
 EXPORT_SYMBOL(wiphy_new);
@@ -366,6 +376,8 @@ int wiphy_register(struct wiphy *wiphy)
                 nl80211_send_reg_change_event(&request);
         }
 
+        cfg80211_debugfs_drv_add(drv);
+
         res = 0;
 out_unlock:
         mutex_unlock(&cfg80211_mutex);
@@ -396,6 +408,8 @@ void wiphy_unregister(struct wiphy *wiphy)
         /* unlock again before freeing */
         mutex_unlock(&drv->mtx);
 
+        cfg80211_debugfs_drv_del(drv);
+
         /* If this device got a regulatory hint tell core its
          * free to listen now to a new shiny device regulatory hint */
         reg_device_remove(wiphy);
@@ -448,8 +462,28 @@ static int cfg80211_netdev_notifier_call(struct notifier_block * nb,
                                 "symlink to netdev!\n");
                 }
                 dev->ieee80211_ptr->netdev = dev;
+#ifdef CONFIG_WIRELESS_EXT
+                dev->ieee80211_ptr->wext.default_key = -1;
+                dev->ieee80211_ptr->wext.default_mgmt_key = -1;
+#endif
                 mutex_unlock(&rdev->devlist_mtx);
                 break;
+        case NETDEV_GOING_DOWN:
+                if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
+                        break;
+                if (!dev->ieee80211_ptr->ssid_len)
+                        break;
+                cfg80211_leave_ibss(rdev, dev, true);
+                break;
+        case NETDEV_UP:
+#ifdef CONFIG_WIRELESS_EXT
+                if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
+                        break;
+                if (!dev->ieee80211_ptr->wext.ibss.ssid_len)
+                        break;
+                cfg80211_join_ibss(rdev, dev, &dev->ieee80211_ptr->wext.ibss);
+                break;
+#endif
         case NETDEV_UNREGISTER:
                 mutex_lock(&rdev->devlist_mtx);
                 if (!list_empty(&dev->ieee80211_ptr->list)) {
diff --git a/net/wireless/core.h b/net/wireless/core.h
index 0a592e4295f0..ab512bcd8153 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -1,7 +1,7 @@
 /*
  * Wireless configuration interface internals.
  *
- * Copyright 2006, 2007 Johannes Berg <johannes@sipsolutions.net>
+ * Copyright 2006-2009  Johannes Berg <johannes@sipsolutions.net>
  */
 #ifndef __NET_WIRELESS_CORE_H
 #define __NET_WIRELESS_CORE_H
@@ -10,14 +10,13 @@
 #include <linux/netdevice.h>
 #include <linux/kref.h>
 #include <linux/rbtree.h>
-#include <linux/mutex.h>
+#include <linux/debugfs.h>
 #include <net/genetlink.h>
-#include <net/wireless.h>
 #include <net/cfg80211.h>
 #include "reg.h"
 
 struct cfg80211_registered_device {
-        struct cfg80211_ops *ops;
+        const struct cfg80211_ops *ops;
         struct list_head list;
         /* we hold this mutex during any call so that
          * we cannot do multiple calls at once, and also
@@ -52,6 +51,17 @@ struct cfg80211_registered_device {
         struct cfg80211_scan_request *scan_req; /* protected by RTNL */
         unsigned long suspend_at;
 
+#ifdef CONFIG_CFG80211_DEBUGFS
+        /* Debugfs entries */
+        struct wiphy_debugfsdentries {
+                struct dentry *rts_threshold;
+                struct dentry *fragmentation_threshold;
+                struct dentry *short_retry_limit;
+                struct dentry *long_retry_limit;
+                struct dentry *ht40allow_map;
+        } debugfs;
+#endif
+
         /* must be last because of the way we do wiphy_priv(),
          * and it should at least be aligned to NETDEV_ALIGN */
         struct wiphy wiphy __attribute__((__aligned__(NETDEV_ALIGN)));
@@ -74,10 +84,7 @@ bool wiphy_idx_valid(int wiphy_idx)
 extern struct mutex cfg80211_mutex;
 extern struct list_head cfg80211_drv_list;
 
-static inline void assert_cfg80211_lock(void)
-{
-        WARN_ON(!mutex_is_locked(&cfg80211_mutex));
-}
+#define assert_cfg80211_lock() WARN_ON(!mutex_is_locked(&cfg80211_mutex))
 
 /*
  * You can use this to mark a wiphy_idx as not having an associated wiphy.
@@ -148,4 +155,16 @@ void cfg80211_bss_expire(struct cfg80211_registered_device *dev);
 void cfg80211_bss_age(struct cfg80211_registered_device *dev,
                       unsigned long age_secs);
 
+/* IBSS */
+int cfg80211_join_ibss(struct cfg80211_registered_device *rdev,
+                       struct net_device *dev,
+                       struct cfg80211_ibss_params *params);
+void cfg80211_clear_ibss(struct net_device *dev, bool nowext);
+int cfg80211_leave_ibss(struct cfg80211_registered_device *rdev,
+                        struct net_device *dev, bool nowext);
+
+/* internal helpers */
+int cfg80211_validate_key_settings(struct key_params *params, int key_idx,
+                                   const u8 *mac_addr);
+
 #endif /* __NET_WIRELESS_CORE_H */
diff --git a/net/wireless/debugfs.c b/net/wireless/debugfs.c
new file mode 100644
index 000000000000..679ddfcec1ee
--- /dev/null
+++ b/net/wireless/debugfs.c
@@ -0,0 +1,131 @@
+/*
+ * cfg80211 debugfs
+ *
+ * Copyright 2009       Luis R. Rodriguez <lrodriguez@atheros.com>
+ * Copyright 2007       Johannes Berg <johannes@sipsolutions.net>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include "core.h"
+#include "debugfs.h"
+
+static int cfg80211_open_file_generic(struct inode *inode, struct file *file)
+{
+        file->private_data = inode->i_private;
+        return 0;
+}
+
+#define DEBUGFS_READONLY_FILE(name, buflen, fmt, value...)              \
+static ssize_t name## _read(struct file *file, char __user *userbuf,    \
+                            size_t count, loff_t *ppos)                 \
+{                                                                       \
+        struct wiphy *wiphy= file->private_data;                \
+        char buf[buflen];                                               \
+        int res;                                                        \
+                                                                        \
+        res = scnprintf(buf, buflen, fmt "\n", ##value);                \
+        return simple_read_from_buffer(userbuf, count, ppos, buf, res); \
+}                                                                       \
+                                                                        \
+static const struct file_operations name## _ops = {                     \
+        .read = name## _read,                                           \
+        .open = cfg80211_open_file_generic,                             \
+};
+
+DEBUGFS_READONLY_FILE(rts_threshold, 20, "%d",
+                      wiphy->rts_threshold)
+DEBUGFS_READONLY_FILE(fragmentation_threshold, 20, "%d",
+                      wiphy->frag_threshold);
+DEBUGFS_READONLY_FILE(short_retry_limit, 20, "%d",
+                      wiphy->retry_short)
+DEBUGFS_READONLY_FILE(long_retry_limit, 20, "%d",
+                      wiphy->retry_long);
+
+static int ht_print_chan(struct ieee80211_channel *chan,
+                         char *buf, int buf_size, int offset)
+{
+        if (WARN_ON(offset > buf_size))
+                return 0;
+
+        if (chan->flags & IEEE80211_CHAN_DISABLED)
+                return snprintf(buf + offset,
+                                buf_size - offset,
+                                "%d Disabled\n",
+                                chan->center_freq);
+
+        return snprintf(buf + offset,
+                        buf_size - offset,
+                        "%d HT40 %c%c\n",
+                        chan->center_freq,
+                        (chan->flags & IEEE80211_CHAN_NO_HT40MINUS) ? ' ' : '-',
+                        (chan->flags & IEEE80211_CHAN_NO_HT40PLUS)  ? ' ' : '+');
+}
+
+static ssize_t ht40allow_map_read(struct file *file,
+                                  char __user *user_buf,
+                                  size_t count, loff_t *ppos)
+{
+        struct wiphy *wiphy = file->private_data;
+        char *buf;
+        unsigned int offset = 0, buf_size = PAGE_SIZE, i, r;
+        enum ieee80211_band band;
+        struct ieee80211_supported_band *sband;
+
+        buf = kzalloc(buf_size, GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+
+        mutex_lock(&cfg80211_mutex);
+
+        for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
+                sband = wiphy->bands[band];
+                if (!sband)
+                        continue;
+                for (i = 0; i < sband->n_channels; i++)
+                        offset += ht_print_chan(&sband->channels[i],
+                                                buf, buf_size, offset);
+        }
+
+        mutex_unlock(&cfg80211_mutex);
+
+        r = simple_read_from_buffer(user_buf, count, ppos, buf, offset);
+
+        kfree(buf);
+
+        return r;
+}
+
+static const struct file_operations ht40allow_map_ops = {
+        .read = ht40allow_map_read,
+        .open = cfg80211_open_file_generic,
+};
+
+#define DEBUGFS_ADD(name)                                               \
+        drv->debugfs.name = debugfs_create_file(#name, S_IRUGO, phyd,   \
+                                                  &drv->wiphy, &name## _ops);
+#define DEBUGFS_DEL(name)                                               \
+        debugfs_remove(drv->debugfs.name);                              \
+        drv->debugfs.name = NULL;
+
+void cfg80211_debugfs_drv_add(struct cfg80211_registered_device *drv)
+{
+        struct dentry *phyd = drv->wiphy.debugfsdir;
+
+        DEBUGFS_ADD(rts_threshold);
+        DEBUGFS_ADD(fragmentation_threshold);
+        DEBUGFS_ADD(short_retry_limit);
+        DEBUGFS_ADD(long_retry_limit);
+        DEBUGFS_ADD(ht40allow_map);
+}
+
+void cfg80211_debugfs_drv_del(struct cfg80211_registered_device *drv)
+{
+        DEBUGFS_DEL(rts_threshold);
+        DEBUGFS_DEL(fragmentation_threshold);
+        DEBUGFS_DEL(short_retry_limit);
+        DEBUGFS_DEL(long_retry_limit);
+        DEBUGFS_DEL(ht40allow_map);
+}
diff --git a/net/wireless/debugfs.h b/net/wireless/debugfs.h
new file mode 100644
index 000000000000..c226983ae66b
--- /dev/null
+++ b/net/wireless/debugfs.h
@@ -0,0 +1,14 @@
+#ifndef __CFG80211_DEBUGFS_H
+#define __CFG80211_DEBUGFS_H
+
+#ifdef CONFIG_CFG80211_DEBUGFS
+void cfg80211_debugfs_drv_add(struct cfg80211_registered_device *drv);
+void cfg80211_debugfs_drv_del(struct cfg80211_registered_device *drv);
+#else
+static inline
+void cfg80211_debugfs_drv_add(struct cfg80211_registered_device *drv) {}
+static inline
+void cfg80211_debugfs_drv_del(struct cfg80211_registered_device *drv) {}
+#endif
+
+#endif /* __CFG80211_DEBUGFS_H */
diff --git a/net/wireless/ibss.c b/net/wireless/ibss.c
new file mode 100644
index 000000000000..a4a1c3498ff2
--- /dev/null
+++ b/net/wireless/ibss.c
@@ -0,0 +1,369 @@
+/*
+ * Some IBSS support code for cfg80211.
+ *
+ * Copyright 2009       Johannes Berg <johannes@sipsolutions.net>
+ */
+
+#include <linux/etherdevice.h>
+#include <linux/if_arp.h>
+#include <net/cfg80211.h>
+#include "nl80211.h"
+
+
+void cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid, gfp_t gfp)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_bss *bss;
+#ifdef CONFIG_WIRELESS_EXT
+        union iwreq_data wrqu;
+#endif
+
+        if (WARN_ON(wdev->iftype != NL80211_IFTYPE_ADHOC))
+                return;
+
+        if (WARN_ON(!wdev->ssid_len))
+                return;
+
+        if (memcmp(bssid, wdev->bssid, ETH_ALEN) == 0)
+                return;
+
+        bss = cfg80211_get_bss(wdev->wiphy, NULL, bssid,
+                               wdev->ssid, wdev->ssid_len,
+                               WLAN_CAPABILITY_IBSS, WLAN_CAPABILITY_IBSS);
+
+        if (WARN_ON(!bss))
+                return;
+
+        if (wdev->current_bss) {
+                cfg80211_unhold_bss(wdev->current_bss);
+                cfg80211_put_bss(wdev->current_bss);
+        }
+
+        cfg80211_hold_bss(bss);
+        wdev->current_bss = bss;
+        memcpy(wdev->bssid, bssid, ETH_ALEN);
+
+        nl80211_send_ibss_bssid(wiphy_to_dev(wdev->wiphy), dev, bssid, gfp);
+#ifdef CONFIG_WIRELESS_EXT
+        memset(&wrqu, 0, sizeof(wrqu));
+        memcpy(wrqu.ap_addr.sa_data, bssid, ETH_ALEN);
+        wireless_send_event(dev, SIOCGIWAP, &wrqu, NULL);
+#endif
+}
+EXPORT_SYMBOL(cfg80211_ibss_joined);
+
+int cfg80211_join_ibss(struct cfg80211_registered_device *rdev,
+                       struct net_device *dev,
+                       struct cfg80211_ibss_params *params)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        int err;
+
+        if (wdev->ssid_len)
+                return -EALREADY;
+
+#ifdef CONFIG_WIRELESS_EXT
+        wdev->wext.ibss.channel = params->channel;
+#endif
+        err = rdev->ops->join_ibss(&rdev->wiphy, dev, params);
+
+        if (err)
+                return err;
+
+        memcpy(wdev->ssid, params->ssid, params->ssid_len);
+        wdev->ssid_len = params->ssid_len;
+
+        return 0;
+}
+
+void cfg80211_clear_ibss(struct net_device *dev, bool nowext)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+
+        if (wdev->current_bss) {
+                cfg80211_unhold_bss(wdev->current_bss);
+                cfg80211_put_bss(wdev->current_bss);
+        }
+
+        wdev->current_bss = NULL;
+        wdev->ssid_len = 0;
+        memset(wdev->bssid, 0, ETH_ALEN);
+#ifdef CONFIG_WIRELESS_EXT
+        if (!nowext)
+                wdev->wext.ibss.ssid_len = 0;
+#endif
+}
+
+int cfg80211_leave_ibss(struct cfg80211_registered_device *rdev,
+                        struct net_device *dev, bool nowext)
+{
+        int err;
+
+        err = rdev->ops->leave_ibss(&rdev->wiphy, dev);
+
+        if (err)
+                return err;
+
+        cfg80211_clear_ibss(dev, nowext);
+
+        return 0;
+}
+
+#ifdef CONFIG_WIRELESS_EXT
+static int cfg80211_ibss_wext_join(struct cfg80211_registered_device *rdev,
+                                   struct wireless_dev *wdev)
+{
+        enum ieee80211_band band;
+        int i;
+
+        if (!wdev->wext.ibss.beacon_interval)
+                wdev->wext.ibss.beacon_interval = 100;
+
+        /* try to find an IBSS channel if none requested ... */
+        if (!wdev->wext.ibss.channel) {
+                for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
+                        struct ieee80211_supported_band *sband;
+                        struct ieee80211_channel *chan;
+
+                        sband = rdev->wiphy.bands[band];
+                        if (!sband)
+                                continue;
+
+                        for (i = 0; i < sband->n_channels; i++) {
+                                chan = &sband->channels[i];
+                                if (chan->flags & IEEE80211_CHAN_NO_IBSS)
+                                        continue;
+                                if (chan->flags & IEEE80211_CHAN_DISABLED)
+                                        continue;
+                                wdev->wext.ibss.channel = chan;
+                                break;
+                        }
+
+                        if (wdev->wext.ibss.channel)
+                                break;
+                }
+
+                if (!wdev->wext.ibss.channel)
+                        return -EINVAL;
+        }
+
+        /* don't join -- SSID is not there */
+        if (!wdev->wext.ibss.ssid_len)
+                return 0;
+
+        if (!netif_running(wdev->netdev))
+                return 0;
+
+        return cfg80211_join_ibss(wiphy_to_dev(wdev->wiphy),
+                                  wdev->netdev, &wdev->wext.ibss);
+}
+
+int cfg80211_ibss_wext_siwfreq(struct net_device *dev,
+                               struct iw_request_info *info,
+                               struct iw_freq *freq, char *extra)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct ieee80211_channel *chan;
+        int err;
+
+        /* call only for ibss! */
+        if (WARN_ON(wdev->iftype != NL80211_IFTYPE_ADHOC))
+                return -EINVAL;
+
+        if (!wiphy_to_dev(wdev->wiphy)->ops->join_ibss)
+                return -EOPNOTSUPP;
+
+        chan = cfg80211_wext_freq(wdev->wiphy, freq);
+        if (chan && IS_ERR(chan))
+                return PTR_ERR(chan);
+
+        if (chan &&
+            (chan->flags & IEEE80211_CHAN_NO_IBSS ||
+             chan->flags & IEEE80211_CHAN_DISABLED))
+                return -EINVAL;
+
+        if (wdev->wext.ibss.channel == chan)
+                return 0;
+
+        if (wdev->ssid_len) {
+                err = cfg80211_leave_ibss(wiphy_to_dev(wdev->wiphy),
+                                          dev, true);
+                if (err)
+                        return err;
+        }
+
+        if (chan) {
+                wdev->wext.ibss.channel = chan;
+                wdev->wext.ibss.channel_fixed = true;
+        } else {
+                /* cfg80211_ibss_wext_join will pick one if needed */
+                wdev->wext.ibss.channel_fixed = false;
+        }
+
+        return cfg80211_ibss_wext_join(wiphy_to_dev(wdev->wiphy), wdev);
+}
+/* temporary symbol - mark GPL - in the future the handler won't be */
+EXPORT_SYMBOL_GPL(cfg80211_ibss_wext_siwfreq);
+
+int cfg80211_ibss_wext_giwfreq(struct net_device *dev,
+                               struct iw_request_info *info,
+                               struct iw_freq *freq, char *extra)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct ieee80211_channel *chan = NULL;
+
+        /* call only for ibss! */
+        if (WARN_ON(wdev->iftype != NL80211_IFTYPE_ADHOC))
+                return -EINVAL;
+
+        if (wdev->current_bss)
+                chan = wdev->current_bss->channel;
+        else if (wdev->wext.ibss.channel)
+                chan = wdev->wext.ibss.channel;
+
+        if (chan) {
+                freq->m = chan->center_freq;
+                freq->e = 6;
+                return 0;
+        }
+
+        /* no channel if not joining */
+        return -EINVAL;
+}
+/* temporary symbol - mark GPL - in the future the handler won't be */
+EXPORT_SYMBOL_GPL(cfg80211_ibss_wext_giwfreq);
+
+int cfg80211_ibss_wext_siwessid(struct net_device *dev,
+                                struct iw_request_info *info,
+                                struct iw_point *data, char *ssid)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        size_t len = data->length;
+        int err;
+
+        /* call only for ibss! */
+        if (WARN_ON(wdev->iftype != NL80211_IFTYPE_ADHOC))
+                return -EINVAL;
+
+        if (!wiphy_to_dev(wdev->wiphy)->ops->join_ibss)
+                return -EOPNOTSUPP;
+
+        if (wdev->ssid_len) {
+                err = cfg80211_leave_ibss(wiphy_to_dev(wdev->wiphy),
+                                          dev, true);
+                if (err)
+                        return err;
+        }
+
+        /* iwconfig uses nul termination in SSID.. */
+        if (len > 0 && ssid[len - 1] == '\0')
+                len--;
+
+        wdev->wext.ibss.ssid = wdev->ssid;
+        memcpy(wdev->wext.ibss.ssid, ssid, len);
+        wdev->wext.ibss.ssid_len = len;
+
+        return cfg80211_ibss_wext_join(wiphy_to_dev(wdev->wiphy), wdev);
+}
+/* temporary symbol - mark GPL - in the future the handler won't be */
+EXPORT_SYMBOL_GPL(cfg80211_ibss_wext_siwessid);
+
+int cfg80211_ibss_wext_giwessid(struct net_device *dev,
+                                struct iw_request_info *info,
+                                struct iw_point *data, char *ssid)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+
+        /* call only for ibss! */
+        if (WARN_ON(wdev->iftype != NL80211_IFTYPE_ADHOC))
+                return -EINVAL;
+
+        data->flags = 0;
+
+        if (wdev->ssid_len) {
+                data->flags = 1;
+                data->length = wdev->ssid_len;
+                memcpy(ssid, wdev->ssid, data->length);
+        } else if (wdev->wext.ibss.ssid && wdev->wext.ibss.ssid_len) {
+                data->flags = 1;
+                data->length = wdev->wext.ibss.ssid_len;
+                memcpy(ssid, wdev->wext.ibss.ssid, data->length);
+        }
+
+        return 0;
+}
+/* temporary symbol - mark GPL - in the future the handler won't be */
+EXPORT_SYMBOL_GPL(cfg80211_ibss_wext_giwessid);
+
+int cfg80211_ibss_wext_siwap(struct net_device *dev,
+                             struct iw_request_info *info,
+                             struct sockaddr *ap_addr, char *extra)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        u8 *bssid = ap_addr->sa_data;
+        int err;
+
+        /* call only for ibss! */
+        if (WARN_ON(wdev->iftype != NL80211_IFTYPE_ADHOC))
+                return -EINVAL;
+
+        if (!wiphy_to_dev(wdev->wiphy)->ops->join_ibss)
+                return -EOPNOTSUPP;
+
+        if (ap_addr->sa_family != ARPHRD_ETHER)
+                return -EINVAL;
+
+        /* automatic mode */
+        if (is_zero_ether_addr(bssid) || is_broadcast_ether_addr(bssid))
+                bssid = NULL;
+
+        /* both automatic */
+        if (!bssid && !wdev->wext.ibss.bssid)
+                return 0;
+
+        /* fixed already - and no change */
+        if (wdev->wext.ibss.bssid && bssid &&
+            compare_ether_addr(bssid, wdev->wext.ibss.bssid) == 0)
+                return 0;
+
+        if (wdev->ssid_len) {
+                err = cfg80211_leave_ibss(wiphy_to_dev(wdev->wiphy),
+                                          dev, true);
+                if (err)
+                        return err;
+        }
+
+        if (bssid) {
+                memcpy(wdev->wext.bssid, bssid, ETH_ALEN);
+                wdev->wext.ibss.bssid = wdev->wext.bssid;
+        } else
+                wdev->wext.ibss.bssid = NULL;
+
+        return cfg80211_ibss_wext_join(wiphy_to_dev(wdev->wiphy), wdev);
+}
+/* temporary symbol - mark GPL - in the future the handler won't be */
+EXPORT_SYMBOL_GPL(cfg80211_ibss_wext_siwap);
+
+int cfg80211_ibss_wext_giwap(struct net_device *dev,
+                             struct iw_request_info *info,
+                             struct sockaddr *ap_addr, char *extra)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+
+        /* call only for ibss! */
+        if (WARN_ON(wdev->iftype != NL80211_IFTYPE_ADHOC))
+                return -EINVAL;
+
+        ap_addr->sa_family = ARPHRD_ETHER;
+
+        if (wdev->wext.ibss.bssid) {
+                memcpy(ap_addr->sa_data, wdev->wext.ibss.bssid, ETH_ALEN);
+                return 0;
+        }
+
+        memcpy(ap_addr->sa_data, wdev->bssid, ETH_ALEN);
+        return 0;
+}
+/* temporary symbol - mark GPL - in the future the handler won't be */
+EXPORT_SYMBOL_GPL(cfg80211_ibss_wext_giwap);
+#endif
diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c
index bec5721b6f99..42184361a109 100644
--- a/net/wireless/mlme.c
+++ b/net/wireless/mlme.c
@@ -28,19 +28,55 @@ void cfg80211_send_rx_assoc(struct net_device *dev, const u8 *buf, size_t len)
 }
 EXPORT_SYMBOL(cfg80211_send_rx_assoc);
 
-void cfg80211_send_rx_deauth(struct net_device *dev, const u8 *buf, size_t len)
+void cfg80211_send_deauth(struct net_device *dev, const u8 *buf, size_t len)
 {
         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
-        nl80211_send_rx_deauth(rdev, dev, buf, len);
+        nl80211_send_deauth(rdev, dev, buf, len);
 }
-EXPORT_SYMBOL(cfg80211_send_rx_deauth);
+EXPORT_SYMBOL(cfg80211_send_deauth);
 
-void cfg80211_send_rx_disassoc(struct net_device *dev, const u8 *buf,
-                               size_t len)
+void cfg80211_send_disassoc(struct net_device *dev, const u8 *buf, size_t len)
 {
         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
-        nl80211_send_rx_disassoc(rdev, dev, buf, len);
+        nl80211_send_disassoc(rdev, dev, buf, len);
 }
-EXPORT_SYMBOL(cfg80211_send_rx_disassoc);
+EXPORT_SYMBOL(cfg80211_send_disassoc);
+
+static void cfg80211_wext_disconnected(struct net_device *dev)
+{
+#ifdef CONFIG_WIRELESS_EXT
+        union iwreq_data wrqu;
+        memset(&wrqu, 0, sizeof(wrqu));
+        wireless_send_event(dev, SIOCGIWAP, &wrqu, NULL);
+#endif
+}
+
+void cfg80211_send_auth_timeout(struct net_device *dev, const u8 *addr)
+{
+        struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+        nl80211_send_auth_timeout(rdev, dev, addr);
+        cfg80211_wext_disconnected(dev);
+}
+EXPORT_SYMBOL(cfg80211_send_auth_timeout);
+
+void cfg80211_send_assoc_timeout(struct net_device *dev, const u8 *addr)
+{
+        struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+        nl80211_send_assoc_timeout(rdev, dev, addr);
+        cfg80211_wext_disconnected(dev);
+}
+EXPORT_SYMBOL(cfg80211_send_assoc_timeout);
+
+void cfg80211_michael_mic_failure(struct net_device *dev, const u8 *addr,
+                                  enum nl80211_key_type key_type, int key_id,
+                                  const u8 *tsc)
+{
+        struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+        nl80211_michael_mic_failure(rdev, dev, addr, key_type, key_id, tsc);
+}
+EXPORT_SYMBOL(cfg80211_michael_mic_failure);
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 2456e4ee445e..4b4d3c8a1aed 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -1,7 +1,7 @@
 /*
  * This is the new netlink-based wireless configuration interface.
  *
- * Copyright 2006, 2007 Johannes Berg <johannes@sipsolutions.net>
+ * Copyright 2006-2009  Johannes Berg <johannes@sipsolutions.net>
  */
 
 #include <linux/if.h>
@@ -57,10 +57,14 @@ static int get_drv_dev_by_info_ifindex(struct nlattr **attrs,
 static struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] __read_mostly = {
         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
-                                      .len = BUS_ID_SIZE-1 },
+                                      .len = 20-1 },
         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
+        [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
+        [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
+        [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
+        [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
 
         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
@@ -73,6 +77,7 @@ static struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] __read_mostly = {
         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
+        [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 8 },
 
         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
@@ -116,8 +121,45 @@ static struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] __read_mostly = {
                                 .len = IEEE80211_MAX_SSID_LEN },
         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
+        [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
+        [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
+        [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
+        [NL80211_ATTR_STA_FLAGS2] = {
+                .len = sizeof(struct nl80211_sta_flag_update),
+        },
+        [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 };
 
+/* IE validation */
+static bool is_valid_ie_attr(const struct nlattr *attr)
+{
+        const u8 *pos;
+        int len;
+
+        if (!attr)
+                return true;
+
+        pos = nla_data(attr);
+        len = nla_len(attr);
+
+        while (len) {
+                u8 elemlen;
+
+                if (len < 2)
+                        return false;
+                len -= 2;
+
+                elemlen = pos[1];
+                if (elemlen > len)
+                        return false;
+
+                len -= elemlen;
+                pos += 2 + elemlen;
+        }
+
+        return true;
+}
+
 /* message building helper */
 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 pid, u32 seq,
                                    int flags, u8 cmd)
@@ -126,6 +168,30 @@ static inline void *nl80211hdr_put(struct sk_buff *skb, u32 pid, u32 seq,
         return genlmsg_put(skb, pid, seq, &nl80211_fam, flags, cmd);
 }
 
+static int nl80211_msg_put_channel(struct sk_buff *msg,
+                                   struct ieee80211_channel *chan)
+{
+        NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_FREQ,
+                    chan->center_freq);
+
+        if (chan->flags & IEEE80211_CHAN_DISABLED)
+                NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_DISABLED);
+        if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN)
+                NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN);
+        if (chan->flags & IEEE80211_CHAN_NO_IBSS)
+                NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_NO_IBSS);
+        if (chan->flags & IEEE80211_CHAN_RADAR)
+                NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_RADAR);
+
+        NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
+                    DBM_TO_MBM(chan->max_power));
+
+        return 0;
+
+ nla_put_failure:
+        return -ENOBUFS;
+}
+
 /* netlink command implementations */
 
 static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
@@ -149,8 +215,24 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 
         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx);
         NLA_PUT_STRING(msg, NL80211_ATTR_WIPHY_NAME, wiphy_name(&dev->wiphy));
+
+        NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
+                   dev->wiphy.retry_short);
+        NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
+                   dev->wiphy.retry_long);
+        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
+                    dev->wiphy.frag_threshold);
+        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
+                    dev->wiphy.rts_threshold);
+
         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
                    dev->wiphy.max_scan_ssids);
+        NLA_PUT_U16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
+                    dev->wiphy.max_scan_ie_len);
+
+        NLA_PUT(msg, NL80211_ATTR_CIPHER_SUITES,
+                sizeof(u32) * dev->wiphy.n_cipher_suites,
+                dev->wiphy.cipher_suites);
 
         nl_modes = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_IFTYPES);
         if (!nl_modes)
@@ -202,20 +284,9 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
                                 goto nla_put_failure;
 
                         chan = &dev->wiphy.bands[band]->channels[i];
-                        NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_FREQ,
-                                    chan->center_freq);
-
-                        if (chan->flags & IEEE80211_CHAN_DISABLED)
-                                NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_DISABLED);
-                        if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN)
-                                NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN);
-                        if (chan->flags & IEEE80211_CHAN_NO_IBSS)
-                                NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_NO_IBSS);
-                        if (chan->flags & IEEE80211_CHAN_RADAR)
-                                NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_RADAR);
 
-                        NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
-                                    DBM_TO_MBM(chan->max_power));
+                        if (nl80211_msg_put_channel(msg, chan))
+                                goto nla_put_failure;
 
                         nla_nest_end(msg, nl_freq);
                 }
@@ -273,6 +344,7 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
         CMD(assoc, ASSOCIATE);
         CMD(deauth, DEAUTHENTICATE);
         CMD(disassoc, DISASSOCIATE);
+        CMD(join_ibss, JOIN_IBSS);
 
 #undef CMD
         nla_nest_end(msg, nl_cmds);
@@ -317,7 +389,7 @@ static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
         if (IS_ERR(dev))
                 return PTR_ERR(dev);
 
-        msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
+        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
         if (!msg)
                 goto out_err;
 
@@ -365,6 +437,9 @@ static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
         struct cfg80211_registered_device *rdev;
         int result = 0, rem_txq_params = 0;
         struct nlattr *nl_txq_params;
+        u32 changed;
+        u8 retry_short = 0, retry_long = 0;
+        u32 frag_threshold = 0, rts_threshold = 0;
 
         rtnl_lock();
 
@@ -418,7 +493,7 @@ static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
                 enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
                 struct ieee80211_channel *chan;
                 struct ieee80211_sta_ht_cap *ht_cap;
-                u32 freq, sec_freq;
+                u32 freq;
 
                 if (!rdev->ops->set_channel) {
                         result = -EOPNOTSUPP;
@@ -444,33 +519,28 @@ static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
                 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
                         goto bad_res;
 
-                if (channel_type == NL80211_CHAN_HT40MINUS)
-                        sec_freq = freq - 20;
-                else if (channel_type == NL80211_CHAN_HT40PLUS)
-                        sec_freq = freq + 20;
-                else
-                        sec_freq = 0;
-
-                ht_cap = &rdev->wiphy.bands[chan->band]->ht_cap;
-
-                /* no HT capabilities */
-                if (channel_type != NL80211_CHAN_NO_HT &&
-                    !ht_cap->ht_supported)
+                if (channel_type == NL80211_CHAN_HT40MINUS &&
+                    (chan->flags & IEEE80211_CHAN_NO_HT40MINUS))
                         goto bad_res;
+                else if (channel_type == NL80211_CHAN_HT40PLUS &&
+                         (chan->flags & IEEE80211_CHAN_NO_HT40PLUS))
+                        goto bad_res;
+
+                /*
+                 * At this point we know if that if HT40 was requested
+                 * we are allowed to use it and the extension channel
+                 * exists.
+                 */
 
-                if (sec_freq) {
-                        struct ieee80211_channel *schan;
+                ht_cap = &rdev->wiphy.bands[chan->band]->ht_cap;
 
-                        /* no 40 MHz capabilities */
+                /* no HT capabilities or intolerant */
+                if (channel_type != NL80211_CHAN_NO_HT) {
+                        if (!ht_cap->ht_supported)
+                                goto bad_res;
                         if (!(ht_cap->cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) ||
                             (ht_cap->cap & IEEE80211_HT_CAP_40MHZ_INTOLERANT))
                                 goto bad_res;
-
-                        schan = ieee80211_get_channel(&rdev->wiphy, sec_freq);
-
-                        /* Secondary channel not allowed */
-                        if (!schan || schan->flags & IEEE80211_CHAN_DISABLED)
-                                goto bad_res;
                 }
 
                 result = rdev->ops->set_channel(&rdev->wiphy, chan,
@@ -479,6 +549,84 @@ static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
                         goto bad_res;
         }
 
+        changed = 0;
+
+        if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
+                retry_short = nla_get_u8(
+                        info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
+                if (retry_short == 0) {
+                        result = -EINVAL;
+                        goto bad_res;
+                }
+                changed |= WIPHY_PARAM_RETRY_SHORT;
+        }
+
+        if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
+                retry_long = nla_get_u8(
+                        info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
+                if (retry_long == 0) {
+                        result = -EINVAL;
+                        goto bad_res;
+                }
+                changed |= WIPHY_PARAM_RETRY_LONG;
+        }
+
+        if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
+                frag_threshold = nla_get_u32(
+                        info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
+                if (frag_threshold < 256) {
+                        result = -EINVAL;
+                        goto bad_res;
+                }
+                if (frag_threshold != (u32) -1) {
+                        /*
+                         * Fragments (apart from the last one) are required to
+                         * have even length. Make the fragmentation code
+                         * simpler by stripping LSB should someone try to use
+                         * odd threshold value.
+                         */
+                        frag_threshold &= ~0x1;
+                }
+                changed |= WIPHY_PARAM_FRAG_THRESHOLD;
+        }
+
+        if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
+                rts_threshold = nla_get_u32(
+                        info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
+                changed |= WIPHY_PARAM_RTS_THRESHOLD;
+        }
+
+        if (changed) {
+                u8 old_retry_short, old_retry_long;
+                u32 old_frag_threshold, old_rts_threshold;
+
+                if (!rdev->ops->set_wiphy_params) {
+                        result = -EOPNOTSUPP;
+                        goto bad_res;
+                }
+
+                old_retry_short = rdev->wiphy.retry_short;
+                old_retry_long = rdev->wiphy.retry_long;
+                old_frag_threshold = rdev->wiphy.frag_threshold;
+                old_rts_threshold = rdev->wiphy.rts_threshold;
+
+                if (changed & WIPHY_PARAM_RETRY_SHORT)
+                        rdev->wiphy.retry_short = retry_short;
+                if (changed & WIPHY_PARAM_RETRY_LONG)
+                        rdev->wiphy.retry_long = retry_long;
+                if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
+                        rdev->wiphy.frag_threshold = frag_threshold;
+                if (changed & WIPHY_PARAM_RTS_THRESHOLD)
+                        rdev->wiphy.rts_threshold = rts_threshold;
+
+                result = rdev->ops->set_wiphy_params(&rdev->wiphy, changed);
+                if (result) {
+                        rdev->wiphy.retry_short = old_retry_short;
+                        rdev->wiphy.retry_long = old_retry_long;
+                        rdev->wiphy.frag_threshold = old_frag_threshold;
+                        rdev->wiphy.rts_threshold = old_rts_threshold;
+                }
+        }
 
  bad_res:
         mutex_unlock(&rdev->mtx);
@@ -489,6 +637,7 @@ static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
 
 
 static int nl80211_send_iface(struct sk_buff *msg, u32 pid, u32 seq, int flags,
+                              struct cfg80211_registered_device *rdev,
                               struct net_device *dev)
 {
         void *hdr;
@@ -498,6 +647,7 @@ static int nl80211_send_iface(struct sk_buff *msg, u32 pid, u32 seq, int flags,
                 return -1;
 
         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
+        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
         NLA_PUT_STRING(msg, NL80211_ATTR_IFNAME, dev->name);
         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, dev->ieee80211_ptr->iftype);
         return genlmsg_end(msg, hdr);
@@ -532,7 +682,7 @@ static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *
                         }
                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).pid,
                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
-                                               wdev->netdev) < 0) {
+                                               dev, wdev->netdev) < 0) {
                                 mutex_unlock(&dev->devlist_mtx);
                                 goto out;
                         }
@@ -562,11 +712,12 @@ static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
         if (err)
                 return err;
 
-        msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
+        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
         if (!msg)
                 goto out_err;
 
-        if (nl80211_send_iface(msg, info->snd_pid, info->snd_seq, 0, netdev) < 0)
+        if (nl80211_send_iface(msg, info->snd_pid, info->snd_seq, 0,
+                               dev, netdev) < 0)
                 goto out_free;
 
         dev_put(netdev);
@@ -616,7 +767,7 @@ static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
         struct cfg80211_registered_device *drv;
         struct vif_params params;
         int err, ifindex;
-        enum nl80211_iftype type;
+        enum nl80211_iftype otype, ntype;
         struct net_device *dev;
         u32 _flags, *flags = NULL;
         bool change = false;
@@ -630,30 +781,27 @@ static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
                 goto unlock_rtnl;
 
         ifindex = dev->ifindex;
-        type = dev->ieee80211_ptr->iftype;
+        otype = ntype = dev->ieee80211_ptr->iftype;
         dev_put(dev);
 
         if (info->attrs[NL80211_ATTR_IFTYPE]) {
-                enum nl80211_iftype ntype;
-
                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
-                if (type != ntype)
+                if (otype != ntype)
                         change = true;
-                type = ntype;
-                if (type > NL80211_IFTYPE_MAX) {
+                if (ntype > NL80211_IFTYPE_MAX) {
                         err = -EINVAL;
                         goto unlock;
                 }
         }
 
         if (!drv->ops->change_virtual_intf ||
-            !(drv->wiphy.interface_modes & (1 << type))) {
+            !(drv->wiphy.interface_modes & (1 << ntype))) {
                 err = -EOPNOTSUPP;
                 goto unlock;
         }
 
         if (info->attrs[NL80211_ATTR_MESH_ID]) {
-                if (type != NL80211_IFTYPE_MESH_POINT) {
+                if (ntype != NL80211_IFTYPE_MESH_POINT) {
                         err = -EINVAL;
                         goto unlock;
                 }
@@ -663,7 +811,7 @@ static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
         }
 
         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
-                if (type != NL80211_IFTYPE_MONITOR) {
+                if (ntype != NL80211_IFTYPE_MONITOR) {
                         err = -EINVAL;
                         goto unlock;
                 }
@@ -678,12 +826,17 @@ static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
 
         if (change)
                 err = drv->ops->change_virtual_intf(&drv->wiphy, ifindex,
-                                                    type, flags, &params);
+                                                    ntype, flags, &params);
         else
                 err = 0;
 
         dev = __dev_get_by_index(&init_net, ifindex);
-        WARN_ON(!dev || (!err && dev->ieee80211_ptr->iftype != type));
+        WARN_ON(!dev || (!err && dev->ieee80211_ptr->iftype != ntype));
+
+        if (dev && !err && (ntype != otype)) {
+                if (otype == NL80211_IFTYPE_ADHOC)
+                        cfg80211_clear_ibss(dev, false);
+        }
 
  unlock:
         cfg80211_put_dev(drv);
@@ -832,7 +985,7 @@ static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
                 goto out;
         }
 
-        msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
+        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
         if (!msg) {
                 err = -ENOMEM;
                 goto out;
@@ -920,6 +1073,14 @@ static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
         }
 
         err = func(&drv->wiphy, dev, key_idx);
+#ifdef CONFIG_WIRELESS_EXT
+        if (!err) {
+                if (func == drv->ops->set_default_key)
+                        dev->ieee80211_ptr->wext.default_key = key_idx;
+                else
+                        dev->ieee80211_ptr->wext.default_mgmt_key = key_idx;
+        }
+#endif
 
  out:
         cfg80211_put_dev(drv);
@@ -934,7 +1095,7 @@ static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
 {
         struct cfg80211_registered_device *drv;
-        int err;
+        int err, i;
         struct net_device *dev;
         struct key_params params;
         u8 key_idx = 0;
@@ -950,6 +1111,11 @@ static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
                 params.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
         }
 
+        if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
+                params.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
+                params.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
+        }
+
         if (info->attrs[NL80211_ATTR_KEY_IDX])
                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 
@@ -958,51 +1124,23 @@ static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
         if (info->attrs[NL80211_ATTR_MAC])
                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
 
-        if (key_idx > 5)
+        if (cfg80211_validate_key_settings(&params, key_idx, mac_addr))
                 return -EINVAL;
 
-        /*
-         * Disallow pairwise keys with non-zero index unless it's WEP
-         * (because current deployments use pairwise WEP keys with
-         * non-zero indizes but 802.11i clearly specifies to use zero)
-         */
-        if (mac_addr && key_idx &&
-            params.cipher != WLAN_CIPHER_SUITE_WEP40 &&
-            params.cipher != WLAN_CIPHER_SUITE_WEP104)
-                return -EINVAL;
-
-        /* TODO: add definitions for the lengths to linux/ieee80211.h */
-        switch (params.cipher) {
-        case WLAN_CIPHER_SUITE_WEP40:
-                if (params.key_len != 5)
-                        return -EINVAL;
-                break;
-        case WLAN_CIPHER_SUITE_TKIP:
-                if (params.key_len != 32)
-                        return -EINVAL;
-                break;
-        case WLAN_CIPHER_SUITE_CCMP:
-                if (params.key_len != 16)
-                        return -EINVAL;
-                break;
-        case WLAN_CIPHER_SUITE_WEP104:
-                if (params.key_len != 13)
-                        return -EINVAL;
-                break;
-        case WLAN_CIPHER_SUITE_AES_CMAC:
-                if (params.key_len != 16)
-                        return -EINVAL;
-                break;
-        default:
-                return -EINVAL;
-        }
-
         rtnl_lock();
 
         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
         if (err)
                 goto unlock_rtnl;
 
+        for (i = 0; i < drv->wiphy.n_cipher_suites; i++)
+                if (params.cipher == drv->wiphy.cipher_suites[i])
+                        break;
+        if (i == drv->wiphy.n_cipher_suites) {
+                err = -EINVAL;
+                goto out;
+        }
+
         if (!drv->ops->add_key) {
                 err = -EOPNOTSUPP;
                 goto out;
@@ -1049,6 +1187,15 @@ static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
 
         err = drv->ops->del_key(&drv->wiphy, dev, key_idx, mac_addr);
 
+#ifdef CONFIG_WIRELESS_EXT
+        if (!err) {
+                if (key_idx == dev->ieee80211_ptr->wext.default_key)
+                        dev->ieee80211_ptr->wext.default_key = -1;
+                else if (key_idx == dev->ieee80211_ptr->wext.default_mgmt_key)
+                        dev->ieee80211_ptr->wext.default_mgmt_key = -1;
+        }
+#endif
+
  out:
         cfg80211_put_dev(drv);
         dev_put(dev);
@@ -1069,6 +1216,9 @@ static int nl80211_addset_beacon(struct sk_buff *skb, struct genl_info *info)
         struct beacon_parameters params;
         int haveinfo = 0;
 
+        if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_BEACON_TAIL]))
+                return -EINVAL;
+
         rtnl_lock();
 
         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
@@ -1186,15 +1336,36 @@ static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
+        [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
 };
 
-static int parse_station_flags(struct nlattr *nla, u32 *staflags)
+static int parse_station_flags(struct genl_info *info,
+                               struct station_parameters *params)
 {
         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
+        struct nlattr *nla;
         int flag;
 
-        *staflags = 0;
+        /*
+         * Try parsing the new attribute first so userspace
+         * can specify both for older kernels.
+         */
+        nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
+        if (nla) {
+                struct nl80211_sta_flag_update *sta_flags;
+
+                sta_flags = nla_data(nla);
+                params->sta_flags_mask = sta_flags->mask;
+                params->sta_flags_set = sta_flags->set;
+                if ((params->sta_flags_mask |
+                     params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
+                        return -EINVAL;
+                return 0;
+        }
 
+        /* if present, parse the old attribute */
+
+        nla = info->attrs[NL80211_ATTR_STA_FLAGS];
         if (!nla)
                 return 0;
 
@@ -1202,11 +1373,12 @@ static int parse_station_flags(struct nlattr *nla, u32 *staflags)
                              nla, sta_flags_policy))
                 return -EINVAL;
 
-        *staflags = STATION_FLAG_CHANGED;
+        params->sta_flags_mask = (1 << __NL80211_STA_FLAG_AFTER_LAST) - 1;
+        params->sta_flags_mask &= ~1;
 
         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++)
                 if (flags[flag])
-                        *staflags |= (1<<flag);
+                        params->sta_flags_set |= (1<<flag);
 
         return 0;
 }
@@ -1424,7 +1596,7 @@ static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
         if (err)
                 goto out;
 
-        msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
+        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
         if (!msg)
                 goto out;
 
@@ -1502,8 +1674,7 @@ static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
                 params.ht_capa =
                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
 
-        if (parse_station_flags(info->attrs[NL80211_ATTR_STA_FLAGS],
-                                &params.station_flags))
+        if (parse_station_flags(info, &params))
                 return -EINVAL;
 
         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
@@ -1572,8 +1743,7 @@ static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
                 params.ht_capa =
                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
 
-        if (parse_station_flags(info->attrs[NL80211_ATTR_STA_FLAGS],
-                                &params.station_flags))
+        if (parse_station_flags(info, &params))
                 return -EINVAL;
 
         rtnl_lock();
@@ -1582,6 +1752,12 @@ static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
         if (err)
                 goto out_rtnl;
 
+        if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
+            dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN) {
+                err = -EINVAL;
+                goto out;
+        }
+
         err = get_vlan(info->attrs[NL80211_ATTR_STA_VLAN], drv, &params.vlan);
         if (err)
                 goto out;
@@ -1625,6 +1801,12 @@ static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
         if (err)
                 goto out_rtnl;
 
+        if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
+            dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN) {
+                err = -EINVAL;
+                goto out;
+        }
+
         if (!drv->ops->del_station) {
                 err = -EOPNOTSUPP;
                 goto out;
@@ -1808,7 +1990,7 @@ static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
         if (err)
                 goto out;
 
-        msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
+        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
         if (!msg)
                 goto out;
 
@@ -2124,7 +2306,7 @@ static int nl80211_get_mesh_params(struct sk_buff *skb,
                 goto out;
 
         /* Draw up a netlink message to send back */
-        msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
+        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
         if (!msg) {
                 err = -ENOBUFS;
                 goto out;
@@ -2302,7 +2484,7 @@ static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
         if (!cfg80211_regdomain)
                 goto out;
 
-        msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
+        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
         if (!msg) {
                 err = -ENOBUFS;
                 goto out;
@@ -2385,18 +2567,24 @@ static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
                         rem_reg_rules) {
                 num_rules++;
                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
-                        goto bad_reg;
+                        return -EINVAL;
         }
 
-        if (!reg_is_valid_request(alpha2))
-                return -EINVAL;
+        mutex_lock(&cfg80211_mutex);
+
+        if (!reg_is_valid_request(alpha2)) {
+                r = -EINVAL;
+                goto bad_reg;
+        }
 
         size_of_regd = sizeof(struct ieee80211_regdomain) +
                 (num_rules * sizeof(struct ieee80211_reg_rule));
 
         rd = kzalloc(size_of_regd, GFP_KERNEL);
-        if (!rd)
-                return -ENOMEM;
+        if (!rd) {
+                r = -ENOMEM;
+                goto bad_reg;
+        }
 
         rd->n_reg_rules = num_rules;
         rd->alpha2[0] = alpha2[0];
@@ -2413,20 +2601,24 @@ static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
 
                 rule_idx++;
 
-                if (rule_idx > NL80211_MAX_SUPP_REG_RULES)
+                if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
+                        r = -EINVAL;
                         goto bad_reg;
+                }
         }
 
         BUG_ON(rule_idx != num_rules);
 
-        mutex_lock(&cfg80211_mutex);
         r = set_regdom(rd);
+
         mutex_unlock(&cfg80211_mutex);
+
         return r;
 
  bad_reg:
+        mutex_unlock(&cfg80211_mutex);
         kfree(rd);
-        return -EINVAL;
+        return r;
 }
 
 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
@@ -2442,6 +2634,9 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
         enum ieee80211_band band;
         size_t ie_len;
 
+        if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
+                return -EINVAL;
+
         rtnl_lock();
 
         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
@@ -2492,6 +2687,11 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
         else
                 ie_len = 0;
 
+        if (ie_len > wiphy->max_scan_ie_len) {
+                err = -EINVAL;
+                goto out;
+        }
+
         request = kzalloc(sizeof(*request)
                         + sizeof(*ssid) * n_ssids
                         + sizeof(channel) * n_channels
@@ -2554,7 +2754,8 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
 
         if (info->attrs[NL80211_ATTR_IE]) {
                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
-                memcpy(request->ie, nla_data(info->attrs[NL80211_ATTR_IE]),
+                memcpy((void *)request->ie,
+                       nla_data(info->attrs[NL80211_ATTR_IE]),
                        request->ie_len);
         }
 
@@ -2710,6 +2911,15 @@ static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
         struct wiphy *wiphy;
         int err;
 
+        if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
+                return -EINVAL;
+
+        if (!info->attrs[NL80211_ATTR_MAC])
+                return -EINVAL;
+
+        if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
+                return -EINVAL;
+
         rtnl_lock();
 
         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
@@ -2731,11 +2941,6 @@ static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
                 goto out;
         }
 
-        if (!info->attrs[NL80211_ATTR_MAC]) {
-                err = -EINVAL;
-                goto out;
-        }
-
         wiphy = &drv->wiphy;
         memset(&req, 0, sizeof(req));
 
@@ -2761,13 +2966,10 @@ static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
         }
 
-        if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
-                req.auth_type =
-                        nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
-                if (!nl80211_valid_auth_type(req.auth_type)) {
-                        err = -EINVAL;
-                        goto out;
-                }
+        req.auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
+        if (!nl80211_valid_auth_type(req.auth_type)) {
+                err = -EINVAL;
+                goto out;
         }
 
         err = drv->ops->auth(&drv->wiphy, dev, &req);
@@ -2788,6 +2990,13 @@ static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
         struct wiphy *wiphy;
         int err;
 
+        if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
+                return -EINVAL;
+
+        if (!info->attrs[NL80211_ATTR_MAC] ||
+            !info->attrs[NL80211_ATTR_SSID])
+                return -EINVAL;
+
         rtnl_lock();
 
         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
@@ -2809,12 +3018,6 @@ static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
                 goto out;
         }
 
-        if (!info->attrs[NL80211_ATTR_MAC] ||
-            !info->attrs[NL80211_ATTR_SSID]) {
-                err = -EINVAL;
-                goto out;
-        }
-
         wiphy = &drv->wiphy;
         memset(&req, 0, sizeof(req));
 
@@ -2838,6 +3041,19 @@ static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
         }
 
+        if (info->attrs[NL80211_ATTR_USE_MFP]) {
+                enum nl80211_mfp use_mfp =
+                        nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
+                if (use_mfp == NL80211_MFP_REQUIRED)
+                        req.use_mfp = true;
+                else if (use_mfp != NL80211_MFP_NO) {
+                        err = -EINVAL;
+                        goto out;
+                }
+        }
+
+        req.control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
+
         err = drv->ops->assoc(&drv->wiphy, dev, &req);
 
 out:
@@ -2856,6 +3072,15 @@ static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
         struct wiphy *wiphy;
         int err;
 
+        if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
+                return -EINVAL;
+
+        if (!info->attrs[NL80211_ATTR_MAC])
+                return -EINVAL;
+
+        if (!info->attrs[NL80211_ATTR_REASON_CODE])
+                return -EINVAL;
+
         rtnl_lock();
 
         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
@@ -2877,24 +3102,16 @@ static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
                 goto out;
         }
 
-        if (!info->attrs[NL80211_ATTR_MAC]) {
-                err = -EINVAL;
-                goto out;
-        }
-
         wiphy = &drv->wiphy;
         memset(&req, 0, sizeof(req));
 
         req.peer_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
 
-        if (info->attrs[NL80211_ATTR_REASON_CODE]) {
-                req.reason_code =
-                        nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
-                if (req.reason_code == 0) {
-                        /* Reason Code 0 is reserved */
-                        err = -EINVAL;
-                        goto out;
-                }
+        req.reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
+        if (req.reason_code == 0) {
+                /* Reason Code 0 is reserved */
+                err = -EINVAL;
+                goto out;
         }
 
         if (info->attrs[NL80211_ATTR_IE]) {
@@ -2920,6 +3137,15 @@ static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
         struct wiphy *wiphy;
         int err;
 
+        if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
+                return -EINVAL;
+
+        if (!info->attrs[NL80211_ATTR_MAC])
+                return -EINVAL;
+
+        if (!info->attrs[NL80211_ATTR_REASON_CODE])
+                return -EINVAL;
+
         rtnl_lock();
 
         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
@@ -2941,24 +3167,16 @@ static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
                 goto out;
         }
 
-        if (!info->attrs[NL80211_ATTR_MAC]) {
-                err = -EINVAL;
-                goto out;
-        }
-
         wiphy = &drv->wiphy;
         memset(&req, 0, sizeof(req));
 
         req.peer_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
 
-        if (info->attrs[NL80211_ATTR_REASON_CODE]) {
-                req.reason_code =
-                        nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
-                if (req.reason_code == 0) {
-                        /* Reason Code 0 is reserved */
-                        err = -EINVAL;
-                        goto out;
-                }
+        req.reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
+        if (req.reason_code == 0) {
+                /* Reason Code 0 is reserved */
+                err = -EINVAL;
+                goto out;
         }
 
         if (info->attrs[NL80211_ATTR_IE]) {
@@ -2976,6 +3194,124 @@ unlock_rtnl:
         return err;
 }
 
+static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
+{
+        struct cfg80211_registered_device *drv;
+        struct net_device *dev;
+        struct cfg80211_ibss_params ibss;
+        struct wiphy *wiphy;
+        int err;
+
+        memset(&ibss, 0, sizeof(ibss));
+
+        if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
+                return -EINVAL;
+
+        if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
+            !info->attrs[NL80211_ATTR_SSID] ||
+            !nla_len(info->attrs[NL80211_ATTR_SSID]))
+                return -EINVAL;
+
+        ibss.beacon_interval = 100;
+
+        if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
+                ibss.beacon_interval =
+                        nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
+                if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
+                        return -EINVAL;
+        }
+
+        rtnl_lock();
+
+        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
+        if (err)
+                goto unlock_rtnl;
+
+        if (!drv->ops->join_ibss) {
+                err = -EOPNOTSUPP;
+                goto out;
+        }
+
+        if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) {
+                err = -EOPNOTSUPP;
+                goto out;
+        }
+
+        if (!netif_running(dev)) {
+                err = -ENETDOWN;
+                goto out;
+        }
+
+        wiphy = &drv->wiphy;
+
+        if (info->attrs[NL80211_ATTR_MAC])
+                ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
+        ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
+        ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
+
+        if (info->attrs[NL80211_ATTR_IE]) {
+                ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
+                ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
+        }
+
+        ibss.channel = ieee80211_get_channel(wiphy,
+                nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
+        if (!ibss.channel ||
+            ibss.channel->flags & IEEE80211_CHAN_NO_IBSS ||
+            ibss.channel->flags & IEEE80211_CHAN_DISABLED) {
+                err = -EINVAL;
+                goto out;
+        }
+
+        ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
+
+        err = cfg80211_join_ibss(drv, dev, &ibss);
+
+out:
+        cfg80211_put_dev(drv);
+        dev_put(dev);
+unlock_rtnl:
+        rtnl_unlock();
+        return err;
+}
+
+static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
+{
+        struct cfg80211_registered_device *drv;
+        struct net_device *dev;
+        int err;
+
+        rtnl_lock();
+
+        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
+        if (err)
+                goto unlock_rtnl;
+
+        if (!drv->ops->leave_ibss) {
+                err = -EOPNOTSUPP;
+                goto out;
+        }
+
+        if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) {
+                err = -EOPNOTSUPP;
+                goto out;
+        }
+
+        if (!netif_running(dev)) {
+                err = -ENETDOWN;
+                goto out;
+        }
+
+        err = cfg80211_leave_ibss(drv, dev, false);
+
+out:
+        cfg80211_put_dev(drv);
+        dev_put(dev);
+unlock_rtnl:
+        rtnl_unlock();
+        return err;
+}
+
 static struct genl_ops nl80211_ops[] = {
         {
                 .cmd = NL80211_CMD_GET_WIPHY,
@@ -3177,6 +3513,18 @@ static struct genl_ops nl80211_ops[] = {
                 .policy = nl80211_policy,
                 .flags = GENL_ADMIN_PERM,
         },
+        {
+                .cmd = NL80211_CMD_JOIN_IBSS,
+                .doit = nl80211_join_ibss,
+                .policy = nl80211_policy,
+                .flags = GENL_ADMIN_PERM,
+        },
+        {
+                .cmd = NL80211_CMD_LEAVE_IBSS,
+                .doit = nl80211_leave_ibss,
+                .policy = nl80211_policy,
+                .flags = GENL_ADMIN_PERM,
+        },
 };
 static struct genl_multicast_group nl80211_mlme_mcgrp = {
         .name = "mlme",
@@ -3199,7 +3547,7 @@ void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
 {
         struct sk_buff *msg;
 
-        msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
+        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
         if (!msg)
                 return;
 
@@ -3240,7 +3588,7 @@ void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
 {
         struct sk_buff *msg;
 
-        msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
+        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
         if (!msg)
                 return;
 
@@ -3258,7 +3606,7 @@ void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
 {
         struct sk_buff *msg;
 
-        msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
+        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
         if (!msg)
                 return;
 
@@ -3280,7 +3628,7 @@ void nl80211_send_reg_change_event(struct regulatory_request *request)
         struct sk_buff *msg;
         void *hdr;
 
-        msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
+        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
         if (!msg)
                 return;
 
@@ -3334,7 +3682,7 @@ static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
         struct sk_buff *msg;
         void *hdr;
 
-        msg = nlmsg_new(NLMSG_GOODSIZE, GFP_ATOMIC);
+        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
         if (!msg)
                 return;
 
@@ -3375,38 +3723,208 @@ void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
         nl80211_send_mlme_event(rdev, netdev, buf, len, NL80211_CMD_ASSOCIATE);
 }
 
-void nl80211_send_rx_deauth(struct cfg80211_registered_device *rdev,
-                            struct net_device *netdev, const u8 *buf,
-                            size_t len)
+void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
+                         struct net_device *netdev, const u8 *buf, size_t len)
 {
         nl80211_send_mlme_event(rdev, netdev, buf, len,
                                 NL80211_CMD_DEAUTHENTICATE);
 }
 
-void nl80211_send_rx_disassoc(struct cfg80211_registered_device *rdev,
-                              struct net_device *netdev, const u8 *buf,
-                              size_t len)
+void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
+                           struct net_device *netdev, const u8 *buf,
+                           size_t len)
 {
         nl80211_send_mlme_event(rdev, netdev, buf, len,
                                 NL80211_CMD_DISASSOCIATE);
 }
 
+static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
+                                      struct net_device *netdev, int cmd,
+                                      const u8 *addr)
+{
+        struct sk_buff *msg;
+        void *hdr;
+
+        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
+        if (!msg)
+                return;
+
+        hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
+        if (!hdr) {
+                nlmsg_free(msg);
+                return;
+        }
+
+        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
+        NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
+        NLA_PUT_FLAG(msg, NL80211_ATTR_TIMED_OUT);
+        NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
+
+        if (genlmsg_end(msg, hdr) < 0) {
+                nlmsg_free(msg);
+                return;
+        }
+
+        genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, GFP_ATOMIC);
+        return;
+
+ nla_put_failure:
+        genlmsg_cancel(msg, hdr);
+        nlmsg_free(msg);
+}
+
+void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
+                               struct net_device *netdev, const u8 *addr)
+{
+        nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
+                                  addr);
+}
+
+void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
+                                struct net_device *netdev, const u8 *addr)
+{
+        nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE, addr);
+}
+
+void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
+                             struct net_device *netdev, const u8 *bssid,
+                             gfp_t gfp)
+{
+        struct sk_buff *msg;
+        void *hdr;
+
+        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
+        if (!msg)
+                return;
+
+        hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
+        if (!hdr) {
+                nlmsg_free(msg);
+                return;
+        }
+
+        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
+        NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
+        NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
+
+        if (genlmsg_end(msg, hdr) < 0) {
+                nlmsg_free(msg);
+                return;
+        }
+
+        genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
+        return;
+
+ nla_put_failure:
+        genlmsg_cancel(msg, hdr);
+        nlmsg_free(msg);
+}
+
+void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
+                                 struct net_device *netdev, const u8 *addr,
+                                 enum nl80211_key_type key_type, int key_id,
+                                 const u8 *tsc)
+{
+        struct sk_buff *msg;
+        void *hdr;
+
+        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
+        if (!msg)
+                return;
+
+        hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
+        if (!hdr) {
+                nlmsg_free(msg);
+                return;
+        }
+
+        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
+        NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
+        if (addr)
+                NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
+        NLA_PUT_U32(msg, NL80211_ATTR_KEY_TYPE, key_type);
+        NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_id);
+        if (tsc)
+                NLA_PUT(msg, NL80211_ATTR_KEY_SEQ, 6, tsc);
+
+        if (genlmsg_end(msg, hdr) < 0) {
+                nlmsg_free(msg);
+                return;
+        }
+
+        genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, GFP_KERNEL);
+        return;
+
+ nla_put_failure:
+        genlmsg_cancel(msg, hdr);
+        nlmsg_free(msg);
+}
+
+void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
+                                    struct ieee80211_channel *channel_before,
+                                    struct ieee80211_channel *channel_after)
+{
+        struct sk_buff *msg;
+        void *hdr;
+        struct nlattr *nl_freq;
+
+        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
+        if (!msg)
+                return;
+
+        hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
+        if (!hdr) {
+                nlmsg_free(msg);
+                return;
+        }
+
+        /*
+         * Since we are applying the beacon hint to a wiphy we know its
+         * wiphy_idx is valid
+         */
+        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy));
+
+        /* Before */
+        nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
+        if (!nl_freq)
+                goto nla_put_failure;
+        if (nl80211_msg_put_channel(msg, channel_before))
+                goto nla_put_failure;
+        nla_nest_end(msg, nl_freq);
+
+        /* After */
+        nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
+        if (!nl_freq)
+                goto nla_put_failure;
+        if (nl80211_msg_put_channel(msg, channel_after))
+                goto nla_put_failure;
+        nla_nest_end(msg, nl_freq);
+
+        if (genlmsg_end(msg, hdr) < 0) {
+                nlmsg_free(msg);
+                return;
+        }
+
+        genlmsg_multicast(msg, 0, nl80211_regulatory_mcgrp.id, GFP_ATOMIC);
+
+        return;
+
+nla_put_failure:
+        genlmsg_cancel(msg, hdr);
+        nlmsg_free(msg);
+}
+
 /* initialisation/exit functions */
 
 int nl80211_init(void)
 {
-        int err, i;
+        int err;
 
-        err = genl_register_family(&nl80211_fam);
+        err = genl_register_family_with_ops(&nl80211_fam,
+                nl80211_ops, ARRAY_SIZE(nl80211_ops));
         if (err)
                 return err;
 
-        for (i = 0; i < ARRAY_SIZE(nl80211_ops); i++) {
-                err = genl_register_ops(&nl80211_fam, &nl80211_ops[i]);
-                if (err)
-                        goto err_out;
-        }
-
         err = genl_register_mc_group(&nl80211_fam, &nl80211_config_mcgrp);
         if (err)
                 goto err_out;
diff --git a/net/wireless/nl80211.h b/net/wireless/nl80211.h
index b77af4ab80be..5c12ad13499b 100644
--- a/net/wireless/nl80211.h
+++ b/net/wireless/nl80211.h
@@ -17,11 +17,31 @@ extern void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
 extern void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
                                   struct net_device *netdev,
                                   const u8 *buf, size_t len);
-extern void nl80211_send_rx_deauth(struct cfg80211_registered_device *rdev,
-                                   struct net_device *netdev,
-                                   const u8 *buf, size_t len);
-extern void nl80211_send_rx_disassoc(struct cfg80211_registered_device *rdev,
-                                     struct net_device *netdev,
-                                     const u8 *buf, size_t len);
+extern void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
+                                struct net_device *netdev,
+                                const u8 *buf, size_t len);
+extern void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
+                                  struct net_device *netdev,
+                                  const u8 *buf, size_t len);
+extern void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
+                                      struct net_device *netdev,
+                                      const u8 *addr);
+extern void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
+                                       struct net_device *netdev,
+                                       const u8 *addr);
+extern void
+nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
+                            struct net_device *netdev, const u8 *addr,
+                            enum nl80211_key_type key_type,
+                            int key_id, const u8 *tsc);
+
+extern void
+nl80211_send_beacon_hint_event(struct wiphy *wiphy,
+                               struct ieee80211_channel *channel_before,
+                               struct ieee80211_channel *channel_after);
+
+void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
+                             struct net_device *netdev, const u8 *bssid,
+                             gfp_t gfp);
 
 #endif /* __NET_WIRELESS_NL80211_H */
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 487cb627ddba..f87ac1df2df5 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -37,7 +37,6 @@
 #include <linux/random.h>
 #include <linux/nl80211.h>
 #include <linux/platform_device.h>
-#include <net/wireless.h>
 #include <net/cfg80211.h>
 #include "core.h"
 #include "reg.h"
@@ -49,12 +48,6 @@ static struct regulatory_request *last_request;
 /* To trigger userspace events */
 static struct platform_device *reg_pdev;
 
-/* Keep the ordering from large to small */
-static u32 supported_bandwidths[] = {
-        MHZ_TO_KHZ(40),
-        MHZ_TO_KHZ(20),
-};
-
 /*
  * Central wireless core regulatory domains, we only need two,
  * the current one and a world regulatory domain in case we have no
@@ -389,6 +382,8 @@ static int call_crda(const char *alpha2)
 /* Used by nl80211 before kmalloc'ing our regulatory domain */
 bool reg_is_valid_request(const char *alpha2)
 {
+        assert_cfg80211_lock();
+
         if (!last_request)
                 return false;
 
@@ -436,19 +431,20 @@ static bool is_valid_rd(const struct ieee80211_regdomain *rd)
         return true;
 }
 
-/* Returns value in KHz */
-static u32 freq_max_bandwidth(const struct ieee80211_freq_range *freq_range,
-        u32 freq)
+static bool reg_does_bw_fit(const struct ieee80211_freq_range *freq_range,
+                            u32 center_freq_khz,
+                            u32 bw_khz)
 {
-        unsigned int i;
-        for (i = 0; i < ARRAY_SIZE(supported_bandwidths); i++) {
-                u32 start_freq_khz = freq - supported_bandwidths[i]/2;
-                u32 end_freq_khz = freq + supported_bandwidths[i]/2;
-                if (start_freq_khz >= freq_range->start_freq_khz &&
-                        end_freq_khz <= freq_range->end_freq_khz)
-                        return supported_bandwidths[i];
-        }
-        return 0;
+        u32 start_freq_khz, end_freq_khz;
+
+        start_freq_khz = center_freq_khz - (bw_khz/2);
+        end_freq_khz = center_freq_khz + (bw_khz/2);
+
+        if (start_freq_khz >= freq_range->start_freq_khz &&
+            end_freq_khz <= freq_range->end_freq_khz)
+                return true;
+
+        return false;
 }
 
 /**
@@ -848,14 +844,17 @@ static u32 map_regdom_flags(u32 rd_flags)
 
 static int freq_reg_info_regd(struct wiphy *wiphy,
                               u32 center_freq,
-                              u32 *bandwidth,
+                              u32 desired_bw_khz,
                               const struct ieee80211_reg_rule **reg_rule,
                               const struct ieee80211_regdomain *custom_regd)
 {
         int i;
         bool band_rule_found = false;
         const struct ieee80211_regdomain *regd;
-        u32 max_bandwidth = 0;
+        bool bw_fits = false;
+
+        if (!desired_bw_khz)
+                desired_bw_khz = MHZ_TO_KHZ(20);
 
         regd = custom_regd ? custom_regd : cfg80211_regdomain;
 
@@ -888,38 +887,54 @@ static int freq_reg_info_regd(struct wiphy *wiphy,
                 if (!band_rule_found)
                         band_rule_found = freq_in_rule_band(fr, center_freq);
 
-                max_bandwidth = freq_max_bandwidth(fr, center_freq);
+                bw_fits = reg_does_bw_fit(fr,
+                                          center_freq,
+                                          desired_bw_khz);
 
-                if (max_bandwidth && *bandwidth <= max_bandwidth) {
+                if (band_rule_found && bw_fits) {
                         *reg_rule = rr;
-                        *bandwidth = max_bandwidth;
-                        break;
+                        return 0;
                 }
         }
 
         if (!band_rule_found)
                 return -ERANGE;
 
-        return !max_bandwidth;
+        return -EINVAL;
 }
 EXPORT_SYMBOL(freq_reg_info);
 
-int freq_reg_info(struct wiphy *wiphy, u32 center_freq, u32 *bandwidth,
-                         const struct ieee80211_reg_rule **reg_rule)
+int freq_reg_info(struct wiphy *wiphy,
+                  u32 center_freq,
+                  u32 desired_bw_khz,
+                  const struct ieee80211_reg_rule **reg_rule)
 {
         assert_cfg80211_lock();
-        return freq_reg_info_regd(wiphy, center_freq,
-                bandwidth, reg_rule, NULL);
+        return freq_reg_info_regd(wiphy,
+                                  center_freq,
+                                  desired_bw_khz,
+                                  reg_rule,
+                                  NULL);
 }
 
+/*
+ * Note that right now we assume the desired channel bandwidth
+ * is always 20 MHz for each individual channel (HT40 uses 20 MHz
+ * per channel, the primary and the extension channel). To support
+ * smaller custom bandwidths such as 5 MHz or 10 MHz we'll need a
+ * new ieee80211_channel.target_bw and re run the regulatory check
+ * on the wiphy with the target_bw specified. Then we can simply use
+ * that below for the desired_bw_khz below.
+ */
 static void handle_channel(struct wiphy *wiphy, enum ieee80211_band band,
                            unsigned int chan_idx)
 {
         int r;
-        u32 flags;
-        u32 max_bandwidth = 0;
+        u32 flags, bw_flags = 0;
+        u32 desired_bw_khz = MHZ_TO_KHZ(20);
         const struct ieee80211_reg_rule *reg_rule = NULL;
         const struct ieee80211_power_rule *power_rule = NULL;
+        const struct ieee80211_freq_range *freq_range = NULL;
         struct ieee80211_supported_band *sband;
         struct ieee80211_channel *chan;
         struct wiphy *request_wiphy = NULL;
@@ -934,8 +949,10 @@ static void handle_channel(struct wiphy *wiphy, enum ieee80211_band band,
 
         flags = chan->orig_flags;
 
-        r = freq_reg_info(wiphy, MHZ_TO_KHZ(chan->center_freq),
-                &max_bandwidth, &reg_rule);
+        r = freq_reg_info(wiphy,
+                          MHZ_TO_KHZ(chan->center_freq),
+                          desired_bw_khz,
+                          &reg_rule);
 
         if (r) {
                 /*
@@ -978,6 +995,10 @@ static void handle_channel(struct wiphy *wiphy, enum ieee80211_band band,
         }
 
         power_rule = &reg_rule->power_rule;
+        freq_range = &reg_rule->freq_range;
+
+        if (freq_range->max_bandwidth_khz < MHZ_TO_KHZ(40))
+                bw_flags = IEEE80211_CHAN_NO_HT40;
 
         if (last_request->initiator == NL80211_REGDOM_SET_BY_DRIVER &&
             request_wiphy && request_wiphy == wiphy &&
@@ -988,19 +1009,19 @@ static void handle_channel(struct wiphy *wiphy, enum ieee80211_band band,
                  * settings
                  */
                 chan->flags = chan->orig_flags =
-                        map_regdom_flags(reg_rule->flags);
+                        map_regdom_flags(reg_rule->flags) | bw_flags;
                 chan->max_antenna_gain = chan->orig_mag =
                         (int) MBI_TO_DBI(power_rule->max_antenna_gain);
-                chan->max_bandwidth = KHZ_TO_MHZ(max_bandwidth);
+                chan->max_bandwidth = KHZ_TO_MHZ(desired_bw_khz);
                 chan->max_power = chan->orig_mpwr =
                         (int) MBM_TO_DBM(power_rule->max_eirp);
                 return;
         }
 
-        chan->flags = flags | map_regdom_flags(reg_rule->flags);
+        chan->flags = flags | bw_flags | map_regdom_flags(reg_rule->flags);
         chan->max_antenna_gain = min(chan->orig_mag,
                 (int) MBI_TO_DBI(power_rule->max_antenna_gain));
-        chan->max_bandwidth = KHZ_TO_MHZ(max_bandwidth);
+        chan->max_bandwidth = KHZ_TO_MHZ(desired_bw_khz);
         if (chan->orig_mpwr)
                 chan->max_power = min(chan->orig_mpwr,
                         (int) MBM_TO_DBM(power_rule->max_eirp));
@@ -1050,18 +1071,10 @@ static void handle_reg_beacon(struct wiphy *wiphy,
                               unsigned int chan_idx,
                               struct reg_beacon *reg_beacon)
 {
-#ifdef CONFIG_CFG80211_REG_DEBUG
-#define REG_DEBUG_BEACON_FLAG(desc) \
-        printk(KERN_DEBUG "cfg80211: Enabling " desc " on " \
-                "frequency: %d MHz (Ch %d) on %s\n", \
-                reg_beacon->chan.center_freq, \
-                ieee80211_frequency_to_channel(reg_beacon->chan.center_freq), \
-                wiphy_name(wiphy));
-#else
-#define REG_DEBUG_BEACON_FLAG(desc) do {} while (0)
-#endif
         struct ieee80211_supported_band *sband;
         struct ieee80211_channel *chan;
+        bool channel_changed = false;
+        struct ieee80211_channel chan_before;
 
         assert_cfg80211_lock();
 
@@ -1071,18 +1084,28 @@ static void handle_reg_beacon(struct wiphy *wiphy,
         if (likely(chan->center_freq != reg_beacon->chan.center_freq))
                 return;
 
-        if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN) {
+        if (chan->beacon_found)
+                return;
+
+        chan->beacon_found = true;
+
+        chan_before.center_freq = chan->center_freq;
+        chan_before.flags = chan->flags;
+
+        if ((chan->flags & IEEE80211_CHAN_PASSIVE_SCAN) &&
+            !(chan->orig_flags & IEEE80211_CHAN_PASSIVE_SCAN)) {
                 chan->flags &= ~IEEE80211_CHAN_PASSIVE_SCAN;
-                REG_DEBUG_BEACON_FLAG("active scanning");
+                channel_changed = true;
         }
 
-        if (chan->flags & IEEE80211_CHAN_NO_IBSS) {
+        if ((chan->flags & IEEE80211_CHAN_NO_IBSS) &&
+            !(chan->orig_flags & IEEE80211_CHAN_NO_IBSS)) {
                 chan->flags &= ~IEEE80211_CHAN_NO_IBSS;
-                REG_DEBUG_BEACON_FLAG("beaconing");
+                channel_changed = true;
         }
 
-        chan->beacon_found = true;
-#undef REG_DEBUG_BEACON_FLAG
+        if (channel_changed)
+                nl80211_send_beacon_hint_event(wiphy, &chan_before, chan);
 }
 
 /*
@@ -1155,6 +1178,93 @@ static void reg_process_beacons(struct wiphy *wiphy)
         wiphy_update_beacon_reg(wiphy);
 }
 
+static bool is_ht40_not_allowed(struct ieee80211_channel *chan)
+{
+        if (!chan)
+                return true;
+        if (chan->flags & IEEE80211_CHAN_DISABLED)
+                return true;
+        /* This would happen when regulatory rules disallow HT40 completely */
+        if (IEEE80211_CHAN_NO_HT40 == (chan->flags & (IEEE80211_CHAN_NO_HT40)))
+                return true;
+        return false;
+}
+
+static void reg_process_ht_flags_channel(struct wiphy *wiphy,
+                                         enum ieee80211_band band,
+                                         unsigned int chan_idx)
+{
+        struct ieee80211_supported_band *sband;
+        struct ieee80211_channel *channel;
+        struct ieee80211_channel *channel_before = NULL, *channel_after = NULL;
+        unsigned int i;
+
+        assert_cfg80211_lock();
+
+        sband = wiphy->bands[band];
+        BUG_ON(chan_idx >= sband->n_channels);
+        channel = &sband->channels[chan_idx];
+
+        if (is_ht40_not_allowed(channel)) {
+                channel->flags |= IEEE80211_CHAN_NO_HT40;
+                return;
+        }
+
+        /*
+         * We need to ensure the extension channels exist to
+         * be able to use HT40- or HT40+, this finds them (or not)
+         */
+        for (i = 0; i < sband->n_channels; i++) {
+                struct ieee80211_channel *c = &sband->channels[i];
+                if (c->center_freq == (channel->center_freq - 20))
+                        channel_before = c;
+                if (c->center_freq == (channel->center_freq + 20))
+                        channel_after = c;
+        }
+
+        /*
+         * Please note that this assumes target bandwidth is 20 MHz,
+         * if that ever changes we also need to change the below logic
+         * to include that as well.
+         */
+        if (is_ht40_not_allowed(channel_before))
+                channel->flags |= IEEE80211_CHAN_NO_HT40MINUS;
+        else
+                channel->flags &= ~IEEE80211_CHAN_NO_HT40MINUS;
+
+        if (is_ht40_not_allowed(channel_after))
+                channel->flags |= IEEE80211_CHAN_NO_HT40PLUS;
+        else
+                channel->flags &= ~IEEE80211_CHAN_NO_HT40PLUS;
+}
+
+static void reg_process_ht_flags_band(struct wiphy *wiphy,
+                                      enum ieee80211_band band)
+{
+        unsigned int i;
+        struct ieee80211_supported_band *sband;
+
+        BUG_ON(!wiphy->bands[band]);
+        sband = wiphy->bands[band];
+
+        for (i = 0; i < sband->n_channels; i++)
+                reg_process_ht_flags_channel(wiphy, band, i);
+}
+
+static void reg_process_ht_flags(struct wiphy *wiphy)
+{
+        enum ieee80211_band band;
+
+        if (!wiphy)
+                return;
+
+        for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
+                if (wiphy->bands[band])
+                        reg_process_ht_flags_band(wiphy, band);
+        }
+
+}
+
 void wiphy_update_regulatory(struct wiphy *wiphy,
                              enum nl80211_reg_initiator initiator)
 {
@@ -1168,6 +1278,7 @@ void wiphy_update_regulatory(struct wiphy *wiphy,
         }
 out:
         reg_process_beacons(wiphy);
+        reg_process_ht_flags(wiphy);
         if (wiphy->reg_notifier)
                 wiphy->reg_notifier(wiphy, last_request);
 }
@@ -1178,9 +1289,11 @@ static void handle_channel_custom(struct wiphy *wiphy,
                                   const struct ieee80211_regdomain *regd)
 {
         int r;
-        u32 max_bandwidth = 0;
+        u32 desired_bw_khz = MHZ_TO_KHZ(20);
+        u32 bw_flags = 0;
         const struct ieee80211_reg_rule *reg_rule = NULL;
         const struct ieee80211_power_rule *power_rule = NULL;
+        const struct ieee80211_freq_range *freq_range = NULL;
         struct ieee80211_supported_band *sband;
         struct ieee80211_channel *chan;
 
@@ -1190,8 +1303,11 @@ static void handle_channel_custom(struct wiphy *wiphy,
         BUG_ON(chan_idx >= sband->n_channels);
         chan = &sband->channels[chan_idx];
 
-        r = freq_reg_info_regd(wiphy, MHZ_TO_KHZ(chan->center_freq),
-                &max_bandwidth, &reg_rule, regd);
+        r = freq_reg_info_regd(wiphy,
+                               MHZ_TO_KHZ(chan->center_freq),
+                               desired_bw_khz,
+                               &reg_rule,
+                               regd);
 
         if (r) {
                 chan->flags = IEEE80211_CHAN_DISABLED;
@@ -1199,10 +1315,14 @@ static void handle_channel_custom(struct wiphy *wiphy,
         }
 
         power_rule = &reg_rule->power_rule;
+        freq_range = &reg_rule->freq_range;
 
-        chan->flags |= map_regdom_flags(reg_rule->flags);
+        if (freq_range->max_bandwidth_khz < MHZ_TO_KHZ(40))
+                bw_flags = IEEE80211_CHAN_NO_HT40;
+
+        chan->flags |= map_regdom_flags(reg_rule->flags) | bw_flags;
         chan->max_antenna_gain = (int) MBI_TO_DBI(power_rule->max_antenna_gain);
-        chan->max_bandwidth = KHZ_TO_MHZ(max_bandwidth);
+        chan->max_bandwidth = KHZ_TO_MHZ(desired_bw_khz);
         chan->max_power = (int) MBM_TO_DBM(power_rule->max_eirp);
 }
 
@@ -1224,13 +1344,22 @@ void wiphy_apply_custom_regulatory(struct wiphy *wiphy,
                                    const struct ieee80211_regdomain *regd)
 {
         enum ieee80211_band band;
+        unsigned int bands_set = 0;
 
         mutex_lock(&cfg80211_mutex);
         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
-                if (wiphy->bands[band])
-                        handle_band_custom(wiphy, band, regd);
+                if (!wiphy->bands[band])
+                        continue;
+                handle_band_custom(wiphy, band, regd);
+                bands_set++;
         }
         mutex_unlock(&cfg80211_mutex);
+
+        /*
+         * no point in calling this if it won't have any effect
+         * on your device's supportd bands.
+         */
+        WARN_ON(!bands_set);
 }
 EXPORT_SYMBOL(wiphy_apply_custom_regulatory);
 
@@ -2119,14 +2248,14 @@ void reg_device_remove(struct wiphy *wiphy)
 
         assert_cfg80211_lock();
 
+        kfree(wiphy->regd);
+
         if (last_request)
                 request_wiphy = wiphy_idx_to_wiphy(last_request->wiphy_idx);
 
-        kfree(wiphy->regd);
-        if (!last_request || !request_wiphy)
-                return;
-        if (request_wiphy != wiphy)
+        if (!request_wiphy || request_wiphy != wiphy)
                 return;
+
         last_request->wiphy_idx = WIPHY_IDX_STALE;
         last_request->country_ie_env = ENVIRON_ANY;
 }
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index 1f260c40b6ca..df59440290e5 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -377,18 +377,16 @@ cfg80211_bss_update(struct cfg80211_registered_device *dev,
                         size_t used = dev->wiphy.bss_priv_size + sizeof(*res);
                         size_t ielen = res->pub.len_information_elements;
 
-                        if (ksize(found) >= used + ielen) {
+                        if (!found->ies_allocated && ksize(found) >= used + ielen) {
                                 memcpy(found->pub.information_elements,
                                        res->pub.information_elements, ielen);
                                 found->pub.len_information_elements = ielen;
                         } else {
                                 u8 *ies = found->pub.information_elements;
 
-                                if (found->ies_allocated) {
-                                        if (ksize(ies) < ielen)
-                                                ies = krealloc(ies, ielen,
-                                                               GFP_ATOMIC);
-                                } else
+                                if (found->ies_allocated)
+                                        ies = krealloc(ies, ielen, GFP_ATOMIC);
+                                else
                                         ies = kmalloc(ielen, GFP_ATOMIC);
 
                                 if (ies) {
@@ -415,6 +413,55 @@ cfg80211_bss_update(struct cfg80211_registered_device *dev,
         return found;
 }
 
+struct cfg80211_bss*
+cfg80211_inform_bss(struct wiphy *wiphy,
+                    struct ieee80211_channel *channel,
+                    const u8 *bssid,
+                    u64 timestamp, u16 capability, u16 beacon_interval,
+                    const u8 *ie, size_t ielen,
+                    s32 signal, gfp_t gfp)
+{
+        struct cfg80211_internal_bss *res;
+        size_t privsz;
+
+        if (WARN_ON(!wiphy))
+                return NULL;
+
+        privsz = wiphy->bss_priv_size;
+
+        if (WARN_ON(wiphy->signal_type == NL80211_BSS_SIGNAL_UNSPEC &&
+                        (signal < 0 || signal > 100)))
+                return NULL;
+
+        res = kzalloc(sizeof(*res) + privsz + ielen, gfp);
+        if (!res)
+                return NULL;
+
+        memcpy(res->pub.bssid, bssid, ETH_ALEN);
+        res->pub.channel = channel;
+        res->pub.signal = signal;
+        res->pub.tsf = timestamp;
+        res->pub.beacon_interval = beacon_interval;
+        res->pub.capability = capability;
+        /* point to after the private area */
+        res->pub.information_elements = (u8 *)res + sizeof(*res) + privsz;
+        memcpy(res->pub.information_elements, ie, ielen);
+        res->pub.len_information_elements = ielen;
+
+        kref_init(&res->ref);
+
+        res = cfg80211_bss_update(wiphy_to_dev(wiphy), res, 0);
+        if (!res)
+                return NULL;
+
+        if (res->pub.capability & WLAN_CAPABILITY_ESS)
+                regulatory_hint_found_beacon(wiphy, channel, gfp);
+
+        /* cfg80211_bss_update gives us a referenced result */
+        return &res->pub;
+}
+EXPORT_SYMBOL(cfg80211_inform_bss);
+
 struct cfg80211_bss *
 cfg80211_inform_bss_frame(struct wiphy *wiphy,
                           struct ieee80211_channel *channel,
@@ -605,7 +652,7 @@ int cfg80211_wext_siwscan(struct net_device *dev,
         cfg80211_put_dev(rdev);
         return err;
 }
-EXPORT_SYMBOL(cfg80211_wext_siwscan);
+EXPORT_SYMBOL_GPL(cfg80211_wext_siwscan);
 
 static void ieee80211_scan_add_ies(struct iw_request_info *info,
                                    struct cfg80211_bss *bss,
@@ -914,5 +961,5 @@ int cfg80211_wext_giwscan(struct net_device *dev,
         cfg80211_put_dev(rdev);
         return res;
 }
-EXPORT_SYMBOL(cfg80211_wext_giwscan);
+EXPORT_SYMBOL_GPL(cfg80211_wext_giwscan);
 #endif
diff --git a/net/wireless/util.c b/net/wireless/util.c
index 487cdd9bcffc..d072bff463aa 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -1,10 +1,12 @@
 /*
  * Wireless utility functions
  *
- * Copyright 2007       Johannes Berg <johannes@sipsolutions.net>
+ * Copyright 2007-2009  Johannes Berg <johannes@sipsolutions.net>
  */
-#include <net/wireless.h>
-#include <asm/bitops.h>
+#include <linux/bitops.h>
+#include <linux/etherdevice.h>
+#include <net/cfg80211.h>
+#include <net/ip.h>
 #include "core.h"
 
 struct ieee80211_rate *
@@ -138,3 +140,366 @@ void ieee80211_set_bitrate_flags(struct wiphy *wiphy)
                 if (wiphy->bands[band])
                         set_mandatory_flags_band(wiphy->bands[band], band);
 }
+
+int cfg80211_validate_key_settings(struct key_params *params, int key_idx,
+                                   const u8 *mac_addr)
+{
+        if (key_idx > 5)
+                return -EINVAL;
+
+        /*
+         * Disallow pairwise keys with non-zero index unless it's WEP
+         * (because current deployments use pairwise WEP keys with
+         * non-zero indizes but 802.11i clearly specifies to use zero)
+         */
+        if (mac_addr && key_idx &&
+            params->cipher != WLAN_CIPHER_SUITE_WEP40 &&
+            params->cipher != WLAN_CIPHER_SUITE_WEP104)
+                return -EINVAL;
+
+        /* TODO: add definitions for the lengths to linux/ieee80211.h */
+        switch (params->cipher) {
+        case WLAN_CIPHER_SUITE_WEP40:
+                if (params->key_len != 5)
+                        return -EINVAL;
+                break;
+        case WLAN_CIPHER_SUITE_TKIP:
+                if (params->key_len != 32)
+                        return -EINVAL;
+                break;
+        case WLAN_CIPHER_SUITE_CCMP:
+                if (params->key_len != 16)
+                        return -EINVAL;
+                break;
+        case WLAN_CIPHER_SUITE_WEP104:
+                if (params->key_len != 13)
+                        return -EINVAL;
+                break;
+        case WLAN_CIPHER_SUITE_AES_CMAC:
+                if (params->key_len != 16)
+                        return -EINVAL;
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        if (params->seq) {
+                switch (params->cipher) {
+                case WLAN_CIPHER_SUITE_WEP40:
+                case WLAN_CIPHER_SUITE_WEP104:
+                        /* These ciphers do not use key sequence */
+                        return -EINVAL;
+                case WLAN_CIPHER_SUITE_TKIP:
+                case WLAN_CIPHER_SUITE_CCMP:
+                case WLAN_CIPHER_SUITE_AES_CMAC:
+                        if (params->seq_len != 6)
+                                return -EINVAL;
+                        break;
+                }
+        }
+
+        return 0;
+}
+
+/* See IEEE 802.1H for LLC/SNAP encapsulation/decapsulation */
+/* Ethernet-II snap header (RFC1042 for most EtherTypes) */
+const unsigned char rfc1042_header[] __aligned(2) =
+        { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00 };
+EXPORT_SYMBOL(rfc1042_header);
+
+/* Bridge-Tunnel header (for EtherTypes ETH_P_AARP and ETH_P_IPX) */
+const unsigned char bridge_tunnel_header[] __aligned(2) =
+        { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0xf8 };
+EXPORT_SYMBOL(bridge_tunnel_header);
+
+unsigned int ieee80211_hdrlen(__le16 fc)
+{
+        unsigned int hdrlen = 24;
+
+        if (ieee80211_is_data(fc)) {
+                if (ieee80211_has_a4(fc))
+                        hdrlen = 30;
+                if (ieee80211_is_data_qos(fc))
+                        hdrlen += IEEE80211_QOS_CTL_LEN;
+                goto out;
+        }
+
+        if (ieee80211_is_ctl(fc)) {
+                /*
+                 * ACK and CTS are 10 bytes, all others 16. To see how
+                 * to get this condition consider
+                 *   subtype mask:   0b0000000011110000 (0x00F0)
+                 *   ACK subtype:    0b0000000011010000 (0x00D0)
+                 *   CTS subtype:    0b0000000011000000 (0x00C0)
+                 *   bits that matter:         ^^^      (0x00E0)
+                 *   value of those: 0b0000000011000000 (0x00C0)
+                 */
+                if ((fc & cpu_to_le16(0x00E0)) == cpu_to_le16(0x00C0))
+                        hdrlen = 10;
+                else
+                        hdrlen = 16;
+        }
+out:
+        return hdrlen;
+}
+EXPORT_SYMBOL(ieee80211_hdrlen);
+
+unsigned int ieee80211_get_hdrlen_from_skb(const struct sk_buff *skb)
+{
+        const struct ieee80211_hdr *hdr =
+                        (const struct ieee80211_hdr *)skb->data;
+        unsigned int hdrlen;
+
+        if (unlikely(skb->len < 10))
+                return 0;
+        hdrlen = ieee80211_hdrlen(hdr->frame_control);
+        if (unlikely(hdrlen > skb->len))
+                return 0;
+        return hdrlen;
+}
+EXPORT_SYMBOL(ieee80211_get_hdrlen_from_skb);
+
+int ieee80211_get_mesh_hdrlen(struct ieee80211s_hdr *meshhdr)
+{
+        int ae = meshhdr->flags & MESH_FLAGS_AE;
+        /* 7.1.3.5a.2 */
+        switch (ae) {
+        case 0:
+                return 6;
+        case 1:
+                return 12;
+        case 2:
+                return 18;
+        case 3:
+                return 24;
+        default:
+                return 6;
+        }
+}
+
+int ieee80211_data_to_8023(struct sk_buff *skb, u8 *addr,
+                           enum nl80211_iftype iftype)
+{
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
+        u16 hdrlen, ethertype;
+        u8 *payload;
+        u8 dst[ETH_ALEN];
+        u8 src[ETH_ALEN] __aligned(2);
+
+        if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
+                return -1;
+
+        hdrlen = ieee80211_hdrlen(hdr->frame_control);
+
+        /* convert IEEE 802.11 header + possible LLC headers into Ethernet
+         * header
+         * IEEE 802.11 address fields:
+         * ToDS FromDS Addr1 Addr2 Addr3 Addr4
+         *   0     0   DA    SA    BSSID n/a
+         *   0     1   DA    BSSID SA    n/a
+         *   1     0   BSSID SA    DA    n/a
+         *   1     1   RA    TA    DA    SA
+         */
+        memcpy(dst, ieee80211_get_DA(hdr), ETH_ALEN);
+        memcpy(src, ieee80211_get_SA(hdr), ETH_ALEN);
+
+        switch (hdr->frame_control &
+                cpu_to_le16(IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) {
+        case cpu_to_le16(IEEE80211_FCTL_TODS):
+                if (unlikely(iftype != NL80211_IFTYPE_AP &&
+                             iftype != NL80211_IFTYPE_AP_VLAN))
+                        return -1;
+                break;
+        case cpu_to_le16(IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS):
+                if (unlikely(iftype != NL80211_IFTYPE_WDS &&
+                             iftype != NL80211_IFTYPE_MESH_POINT))
+                        return -1;
+                if (iftype == NL80211_IFTYPE_MESH_POINT) {
+                        struct ieee80211s_hdr *meshdr =
+                                (struct ieee80211s_hdr *) (skb->data + hdrlen);
+                        hdrlen += ieee80211_get_mesh_hdrlen(meshdr);
+                        if (meshdr->flags & MESH_FLAGS_AE_A5_A6) {
+                                memcpy(dst, meshdr->eaddr1, ETH_ALEN);
+                                memcpy(src, meshdr->eaddr2, ETH_ALEN);
+                        }
+                }
+                break;
+        case cpu_to_le16(IEEE80211_FCTL_FROMDS):
+                if (iftype != NL80211_IFTYPE_STATION ||
+                    (is_multicast_ether_addr(dst) &&
+                     !compare_ether_addr(src, addr)))
+                        return -1;
+                break;
+        case cpu_to_le16(0):
+                if (iftype != NL80211_IFTYPE_ADHOC)
+                        return -1;
+                break;
+        }
+
+        if (unlikely(skb->len - hdrlen < 8))
+                return -1;
+
+        payload = skb->data + hdrlen;
+        ethertype = (payload[6] << 8) | payload[7];
+
+        if (likely((compare_ether_addr(payload, rfc1042_header) == 0 &&
+                    ethertype != ETH_P_AARP && ethertype != ETH_P_IPX) ||
+                   compare_ether_addr(payload, bridge_tunnel_header) == 0)) {
+                /* remove RFC1042 or Bridge-Tunnel encapsulation and
+                 * replace EtherType */
+                skb_pull(skb, hdrlen + 6);
+                memcpy(skb_push(skb, ETH_ALEN), src, ETH_ALEN);
+                memcpy(skb_push(skb, ETH_ALEN), dst, ETH_ALEN);
+        } else {
+                struct ethhdr *ehdr;
+                __be16 len;
+
+                skb_pull(skb, hdrlen);
+                len = htons(skb->len);
+                ehdr = (struct ethhdr *) skb_push(skb, sizeof(struct ethhdr));
+                memcpy(ehdr->h_dest, dst, ETH_ALEN);
+                memcpy(ehdr->h_source, src, ETH_ALEN);
+                ehdr->h_proto = len;
+        }
+        return 0;
+}
+EXPORT_SYMBOL(ieee80211_data_to_8023);
+
+int ieee80211_data_from_8023(struct sk_buff *skb, u8 *addr,
+                             enum nl80211_iftype iftype, u8 *bssid, bool qos)
+{
+        struct ieee80211_hdr hdr;
+        u16 hdrlen, ethertype;
+        __le16 fc;
+        const u8 *encaps_data;
+        int encaps_len, skip_header_bytes;
+        int nh_pos, h_pos;
+        int head_need;
+
+        if (unlikely(skb->len < ETH_HLEN))
+                return -EINVAL;
+
+        nh_pos = skb_network_header(skb) - skb->data;
+        h_pos = skb_transport_header(skb) - skb->data;
+
+        /* convert Ethernet header to proper 802.11 header (based on
+         * operation mode) */
+        ethertype = (skb->data[12] << 8) | skb->data[13];
+        fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_DATA);
+
+        switch (iftype) {
+        case NL80211_IFTYPE_AP:
+        case NL80211_IFTYPE_AP_VLAN:
+                fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS);
+                /* DA BSSID SA */
+                memcpy(hdr.addr1, skb->data, ETH_ALEN);
+                memcpy(hdr.addr2, addr, ETH_ALEN);
+                memcpy(hdr.addr3, skb->data + ETH_ALEN, ETH_ALEN);
+                hdrlen = 24;
+                break;
+        case NL80211_IFTYPE_STATION:
+                fc |= cpu_to_le16(IEEE80211_FCTL_TODS);
+                /* BSSID SA DA */
+                memcpy(hdr.addr1, bssid, ETH_ALEN);
+                memcpy(hdr.addr2, skb->data + ETH_ALEN, ETH_ALEN);
+                memcpy(hdr.addr3, skb->data, ETH_ALEN);
+                hdrlen = 24;
+                break;
+        case NL80211_IFTYPE_ADHOC:
+                /* DA SA BSSID */
+                memcpy(hdr.addr1, skb->data, ETH_ALEN);
+                memcpy(hdr.addr2, skb->data + ETH_ALEN, ETH_ALEN);
+                memcpy(hdr.addr3, bssid, ETH_ALEN);
+                hdrlen = 24;
+                break;
+        default:
+                return -EOPNOTSUPP;
+        }
+
+        if (qos) {
+                fc |= cpu_to_le16(IEEE80211_STYPE_QOS_DATA);
+                hdrlen += 2;
+        }
+
+        hdr.frame_control = fc;
+        hdr.duration_id = 0;
+        hdr.seq_ctrl = 0;
+
+        skip_header_bytes = ETH_HLEN;
+        if (ethertype == ETH_P_AARP || ethertype == ETH_P_IPX) {
+                encaps_data = bridge_tunnel_header;
+                encaps_len = sizeof(bridge_tunnel_header);
+                skip_header_bytes -= 2;
+        } else if (ethertype > 0x600) {
+                encaps_data = rfc1042_header;
+                encaps_len = sizeof(rfc1042_header);
+                skip_header_bytes -= 2;
+        } else {
+                encaps_data = NULL;
+                encaps_len = 0;
+        }
+
+        skb_pull(skb, skip_header_bytes);
+        nh_pos -= skip_header_bytes;
+        h_pos -= skip_header_bytes;
+
+        head_need = hdrlen + encaps_len - skb_headroom(skb);
+
+        if (head_need > 0 || skb_cloned(skb)) {
+                head_need = max(head_need, 0);
+                if (head_need)
+                        skb_orphan(skb);
+
+                if (pskb_expand_head(skb, head_need, 0, GFP_ATOMIC)) {
+                        printk(KERN_ERR "failed to reallocate Tx buffer\n");
+                        return -ENOMEM;
+                }
+                skb->truesize += head_need;
+        }
+
+        if (encaps_data) {
+                memcpy(skb_push(skb, encaps_len), encaps_data, encaps_len);
+                nh_pos += encaps_len;
+                h_pos += encaps_len;
+        }
+
+        memcpy(skb_push(skb, hdrlen), &hdr, hdrlen);
+
+        nh_pos += hdrlen;
+        h_pos += hdrlen;
+
+        /* Update skb pointers to various headers since this modified frame
+         * is going to go through Linux networking code that may potentially
+         * need things like pointer to IP header. */
+        skb_set_mac_header(skb, 0);
+        skb_set_network_header(skb, nh_pos);
+        skb_set_transport_header(skb, h_pos);
+
+        return 0;
+}
+EXPORT_SYMBOL(ieee80211_data_from_8023);
+
+/* Given a data frame determine the 802.1p/1d tag to use. */
+unsigned int cfg80211_classify8021d(struct sk_buff *skb)
+{
+        unsigned int dscp;
+
+        /* skb->priority values from 256->263 are magic values to
+         * directly indicate a specific 802.1d priority.  This is used
+         * to allow 802.1d priority to be passed directly in from VLAN
+         * tags, etc.
+         */
+        if (skb->priority >= 256 && skb->priority <= 263)
+                return skb->priority - 256;
+
+        switch (skb->protocol) {
+        case htons(ETH_P_IP):
+                dscp = ip_hdr(skb)->tos & 0xfc;
+                break;
+        default:
+                return 0;
+        }
+
+        return dscp >> 5;
+}
+EXPORT_SYMBOL(cfg80211_classify8021d);
diff --git a/net/wireless/wext-compat.c b/net/wireless/wext-compat.c
index 0fd1db6e95bb..711e00a0c9b5 100644
--- a/net/wireless/wext-compat.c
+++ b/net/wireless/wext-compat.c
@@ -5,13 +5,14 @@
  * into cfg80211, when that happens all the exports here go away and
  * we directly assign the wireless handlers of wireless interfaces.
  *
- * Copyright 2008       Johannes Berg <johannes@sipsolutions.net>
+ * Copyright 2008-2009  Johannes Berg <johannes@sipsolutions.net>
  */
 
 #include <linux/wireless.h>
 #include <linux/nl80211.h>
+#include <linux/if_arp.h>
+#include <linux/etherdevice.h>
 #include <net/iw_handler.h>
-#include <net/wireless.h>
 #include <net/cfg80211.h>
 #include "core.h"
 
@@ -57,7 +58,7 @@ int cfg80211_wext_giwname(struct net_device *dev,
 
         return 0;
 }
-EXPORT_SYMBOL(cfg80211_wext_giwname);
+EXPORT_SYMBOL_GPL(cfg80211_wext_giwname);
 
 int cfg80211_wext_siwmode(struct net_device *dev, struct iw_request_info *info,
                           u32 *mode, char *extra)
@@ -108,7 +109,7 @@ int cfg80211_wext_siwmode(struct net_device *dev, struct iw_request_info *info,
 
         return ret;
 }
-EXPORT_SYMBOL(cfg80211_wext_siwmode);
+EXPORT_SYMBOL_GPL(cfg80211_wext_siwmode);
 
 int cfg80211_wext_giwmode(struct net_device *dev, struct iw_request_info *info,
                           u32 *mode, char *extra)
@@ -143,7 +144,7 @@ int cfg80211_wext_giwmode(struct net_device *dev, struct iw_request_info *info,
         }
         return 0;
 }
-EXPORT_SYMBOL(cfg80211_wext_giwmode);
+EXPORT_SYMBOL_GPL(cfg80211_wext_giwmode);
 
 
 int cfg80211_wext_giwrange(struct net_device *dev,
@@ -206,7 +207,6 @@ int cfg80211_wext_giwrange(struct net_device *dev,
         range->enc_capa = IW_ENC_CAPA_WPA | IW_ENC_CAPA_WPA2 |
                           IW_ENC_CAPA_CIPHER_TKIP | IW_ENC_CAPA_CIPHER_CCMP;
 
-
         for (band = 0; band < IEEE80211_NUM_BANDS; band ++) {
                 int i;
                 struct ieee80211_supported_band *sband;
@@ -240,4 +240,507 @@ int cfg80211_wext_giwrange(struct net_device *dev,
 
         return 0;
 }
-EXPORT_SYMBOL(cfg80211_wext_giwrange);
+EXPORT_SYMBOL_GPL(cfg80211_wext_giwrange);
+
+int cfg80211_wext_siwmlme(struct net_device *dev,
+                          struct iw_request_info *info,
+                          struct iw_point *data, char *extra)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct iw_mlme *mlme = (struct iw_mlme *)extra;
+        struct cfg80211_registered_device *rdev;
+        union {
+                struct cfg80211_disassoc_request disassoc;
+                struct cfg80211_deauth_request deauth;
+        } cmd;
+
+        if (!wdev)
+                return -EOPNOTSUPP;
+
+        rdev = wiphy_to_dev(wdev->wiphy);
+
+        if (wdev->iftype != NL80211_IFTYPE_STATION)
+                return -EINVAL;
+
+        if (mlme->addr.sa_family != ARPHRD_ETHER)
+                return -EINVAL;
+
+        memset(&cmd, 0, sizeof(cmd));
+
+        switch (mlme->cmd) {
+        case IW_MLME_DEAUTH:
+                if (!rdev->ops->deauth)
+                        return -EOPNOTSUPP;
+                cmd.deauth.peer_addr = mlme->addr.sa_data;
+                cmd.deauth.reason_code = mlme->reason_code;
+                return rdev->ops->deauth(wdev->wiphy, dev, &cmd.deauth);
+        case IW_MLME_DISASSOC:
+                if (!rdev->ops->disassoc)
+                        return -EOPNOTSUPP;
+                cmd.disassoc.peer_addr = mlme->addr.sa_data;
+                cmd.disassoc.reason_code = mlme->reason_code;
+                return rdev->ops->disassoc(wdev->wiphy, dev, &cmd.disassoc);
+        default:
+                return -EOPNOTSUPP;
+        }
+}
+EXPORT_SYMBOL_GPL(cfg80211_wext_siwmlme);
+
+
+/**
+ * cfg80211_wext_freq - get wext frequency for non-"auto"
+ * @wiphy: the wiphy
+ * @freq: the wext freq encoding
+ *
+ * Returns a channel, %NULL for auto, or an ERR_PTR for errors!
+ */
+struct ieee80211_channel *cfg80211_wext_freq(struct wiphy *wiphy,
+                                             struct iw_freq *freq)
+{
+        struct ieee80211_channel *chan;
+        int f;
+
+        /*
+         * Parse frequency - return NULL for auto and
+         * -EINVAL for impossible things.
+         */
+        if (freq->e == 0) {
+                if (freq->m < 0)
+                        return NULL;
+                f = ieee80211_channel_to_frequency(freq->m);
+        } else {
+                int i, div = 1000000;
+                for (i = 0; i < freq->e; i++)
+                        div /= 10;
+                if (div <= 0)
+                        return ERR_PTR(-EINVAL);
+                f = freq->m / div;
+        }
+
+        /*
+         * Look up channel struct and return -EINVAL when
+         * it cannot be found.
+         */
+        chan = ieee80211_get_channel(wiphy, f);
+        if (!chan)
+                return ERR_PTR(-EINVAL);
+        return chan;
+}
+EXPORT_SYMBOL_GPL(cfg80211_wext_freq);
+
+int cfg80211_wext_siwrts(struct net_device *dev,
+                         struct iw_request_info *info,
+                         struct iw_param *rts, char *extra)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        u32 orts = wdev->wiphy->rts_threshold;
+        int err;
+
+        if (rts->disabled || !rts->fixed)
+                wdev->wiphy->rts_threshold = (u32) -1;
+        else if (rts->value < 0)
+                return -EINVAL;
+        else
+                wdev->wiphy->rts_threshold = rts->value;
+
+        err = rdev->ops->set_wiphy_params(wdev->wiphy,
+                                          WIPHY_PARAM_RTS_THRESHOLD);
+        if (err)
+                wdev->wiphy->rts_threshold = orts;
+
+        return err;
+}
+EXPORT_SYMBOL_GPL(cfg80211_wext_siwrts);
+
+int cfg80211_wext_giwrts(struct net_device *dev,
+                         struct iw_request_info *info,
+                         struct iw_param *rts, char *extra)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+
+        rts->value = wdev->wiphy->rts_threshold;
+        rts->disabled = rts->value == (u32) -1;
+        rts->fixed = 1;
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(cfg80211_wext_giwrts);
+
+int cfg80211_wext_siwfrag(struct net_device *dev,
+                          struct iw_request_info *info,
+                          struct iw_param *frag, char *extra)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        u32 ofrag = wdev->wiphy->frag_threshold;
+        int err;
+
+        if (frag->disabled || !frag->fixed)
+                wdev->wiphy->frag_threshold = (u32) -1;
+        else if (frag->value < 256)
+                return -EINVAL;
+        else {
+                /* Fragment length must be even, so strip LSB. */
+                wdev->wiphy->frag_threshold = frag->value & ~0x1;
+        }
+
+        err = rdev->ops->set_wiphy_params(wdev->wiphy,
+                                          WIPHY_PARAM_FRAG_THRESHOLD);
+        if (err)
+                wdev->wiphy->frag_threshold = ofrag;
+
+        return err;
+}
+EXPORT_SYMBOL_GPL(cfg80211_wext_siwfrag);
+
+int cfg80211_wext_giwfrag(struct net_device *dev,
+                          struct iw_request_info *info,
+                          struct iw_param *frag, char *extra)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+
+        frag->value = wdev->wiphy->frag_threshold;
+        frag->disabled = frag->value == (u32) -1;
+        frag->fixed = 1;
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(cfg80211_wext_giwfrag);
+
+int cfg80211_wext_siwretry(struct net_device *dev,
+                           struct iw_request_info *info,
+                           struct iw_param *retry, char *extra)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        u32 changed = 0;
+        u8 olong = wdev->wiphy->retry_long;
+        u8 oshort = wdev->wiphy->retry_short;
+        int err;
+
+        if (retry->disabled ||
+            (retry->flags & IW_RETRY_TYPE) != IW_RETRY_LIMIT)
+                return -EINVAL;
+
+        if (retry->flags & IW_RETRY_LONG) {
+                wdev->wiphy->retry_long = retry->value;
+                changed |= WIPHY_PARAM_RETRY_LONG;
+        } else if (retry->flags & IW_RETRY_SHORT) {
+                wdev->wiphy->retry_short = retry->value;
+                changed |= WIPHY_PARAM_RETRY_SHORT;
+        } else {
+                wdev->wiphy->retry_short = retry->value;
+                wdev->wiphy->retry_long = retry->value;
+                changed |= WIPHY_PARAM_RETRY_LONG;
+                changed |= WIPHY_PARAM_RETRY_SHORT;
+        }
+
+        if (!changed)
+                return 0;
+
+        err = rdev->ops->set_wiphy_params(wdev->wiphy, changed);
+        if (err) {
+                wdev->wiphy->retry_short = oshort;
+                wdev->wiphy->retry_long = olong;
+        }
+
+        return err;
+}
+EXPORT_SYMBOL_GPL(cfg80211_wext_siwretry);
+
+int cfg80211_wext_giwretry(struct net_device *dev,
+                           struct iw_request_info *info,
+                           struct iw_param *retry, char *extra)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+
+        retry->disabled = 0;
+
+        if (retry->flags == 0 || (retry->flags & IW_RETRY_SHORT)) {
+                /*
+                 * First return short value, iwconfig will ask long value
+                 * later if needed
+                 */
+                retry->flags |= IW_RETRY_LIMIT;
+                retry->value = wdev->wiphy->retry_short;
+                if (wdev->wiphy->retry_long != wdev->wiphy->retry_short)
+                        retry->flags |= IW_RETRY_LONG;
+
+                return 0;
+        }
+
+        if (retry->flags & IW_RETRY_LONG) {
+                retry->flags = IW_RETRY_LIMIT | IW_RETRY_LONG;
+                retry->value = wdev->wiphy->retry_long;
+        }
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(cfg80211_wext_giwretry);
+
+static int cfg80211_set_encryption(struct cfg80211_registered_device *rdev,
+                                   struct net_device *dev, const u8 *addr,
+                                   bool remove, bool tx_key, int idx,
+                                   struct key_params *params)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        int err;
+
+        if (params->cipher == WLAN_CIPHER_SUITE_AES_CMAC) {
+                if (!rdev->ops->set_default_mgmt_key)
+                        return -EOPNOTSUPP;
+
+                if (idx < 4 || idx > 5)
+                        return -EINVAL;
+        } else if (idx < 0 || idx > 3)
+                return -EINVAL;
+
+        if (remove) {
+                err = rdev->ops->del_key(&rdev->wiphy, dev, idx, addr);
+                if (!err) {
+                        if (idx == wdev->wext.default_key)
+                                wdev->wext.default_key = -1;
+                        else if (idx == wdev->wext.default_mgmt_key)
+                                wdev->wext.default_mgmt_key = -1;
+                }
+                /*
+                 * Applications using wireless extensions expect to be
+                 * able to delete keys that don't exist, so allow that.
+                 */
+                if (err == -ENOENT)
+                        return 0;
+
+                return err;
+        } else {
+                if (addr)
+                        tx_key = false;
+
+                if (cfg80211_validate_key_settings(params, idx, addr))
+                        return -EINVAL;
+
+                err = rdev->ops->add_key(&rdev->wiphy, dev, idx, addr, params);
+                if (err)
+                        return err;
+
+                if (tx_key || (!addr && wdev->wext.default_key == -1)) {
+                        err = rdev->ops->set_default_key(&rdev->wiphy,
+                                                         dev, idx);
+                        if (!err)
+                                wdev->wext.default_key = idx;
+                        return err;
+                }
+
+                if (params->cipher == WLAN_CIPHER_SUITE_AES_CMAC &&
+                    (tx_key || (!addr && wdev->wext.default_mgmt_key == -1))) {
+                        err = rdev->ops->set_default_mgmt_key(&rdev->wiphy,
+                                                              dev, idx);
+                        if (!err)
+                                wdev->wext.default_mgmt_key = idx;
+                        return err;
+                }
+
+                return 0;
+        }
+}
+
+int cfg80211_wext_siwencode(struct net_device *dev,
+                            struct iw_request_info *info,
+                            struct iw_point *erq, char *keybuf)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        int idx, err;
+        bool remove = false;
+        struct key_params params;
+
+        /* no use -- only MFP (set_default_mgmt_key) is optional */
+        if (!rdev->ops->del_key ||
+            !rdev->ops->add_key ||
+            !rdev->ops->set_default_key)
+                return -EOPNOTSUPP;
+
+        idx = erq->flags & IW_ENCODE_INDEX;
+        if (idx == 0) {
+                idx = wdev->wext.default_key;
+                if (idx < 0)
+                        idx = 0;
+        } else if (idx < 1 || idx > 4)
+                return -EINVAL;
+        else
+                idx--;
+
+        if (erq->flags & IW_ENCODE_DISABLED)
+                remove = true;
+        else if (erq->length == 0) {
+                /* No key data - just set the default TX key index */
+                err = rdev->ops->set_default_key(&rdev->wiphy, dev, idx);
+                if (!err)
+                        wdev->wext.default_key = idx;
+                return err;
+        }
+
+        memset(&params, 0, sizeof(params));
+        params.key = keybuf;
+        params.key_len = erq->length;
+        if (erq->length == 5)
+                params.cipher = WLAN_CIPHER_SUITE_WEP40;
+        else if (erq->length == 13)
+                params.cipher = WLAN_CIPHER_SUITE_WEP104;
+        else if (!remove)
+                return -EINVAL;
+
+        return cfg80211_set_encryption(rdev, dev, NULL, remove,
+                                       wdev->wext.default_key == -1,
+                                       idx, &params);
+}
+EXPORT_SYMBOL_GPL(cfg80211_wext_siwencode);
+
+int cfg80211_wext_siwencodeext(struct net_device *dev,
+                               struct iw_request_info *info,
+                               struct iw_point *erq, char *extra)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct iw_encode_ext *ext = (struct iw_encode_ext *) extra;
+        const u8 *addr;
+        int idx;
+        bool remove = false;
+        struct key_params params;
+        u32 cipher;
+
+        /* no use -- only MFP (set_default_mgmt_key) is optional */
+        if (!rdev->ops->del_key ||
+            !rdev->ops->add_key ||
+            !rdev->ops->set_default_key)
+                return -EOPNOTSUPP;
+
+        switch (ext->alg) {
+        case IW_ENCODE_ALG_NONE:
+                remove = true;
+                cipher = 0;
+                break;
+        case IW_ENCODE_ALG_WEP:
+                if (ext->key_len == 5)
+                        cipher = WLAN_CIPHER_SUITE_WEP40;
+                else if (ext->key_len == 13)
+                        cipher = WLAN_CIPHER_SUITE_WEP104;
+                else
+                        return -EINVAL;
+                break;
+        case IW_ENCODE_ALG_TKIP:
+                cipher = WLAN_CIPHER_SUITE_TKIP;
+                break;
+        case IW_ENCODE_ALG_CCMP:
+                cipher = WLAN_CIPHER_SUITE_CCMP;
+                break;
+        case IW_ENCODE_ALG_AES_CMAC:
+                cipher = WLAN_CIPHER_SUITE_AES_CMAC;
+                break;
+        default:
+                return -EOPNOTSUPP;
+        }
+
+        if (erq->flags & IW_ENCODE_DISABLED)
+                remove = true;
+
+        idx = erq->flags & IW_ENCODE_INDEX;
+        if (cipher == WLAN_CIPHER_SUITE_AES_CMAC) {
+                if (idx < 4 || idx > 5) {
+                        idx = wdev->wext.default_mgmt_key;
+                        if (idx < 0)
+                                return -EINVAL;
+                } else
+                        idx--;
+        } else {
+                if (idx < 1 || idx > 4) {
+                        idx = wdev->wext.default_key;
+                        if (idx < 0)
+                                return -EINVAL;
+                } else
+                        idx--;
+        }
+
+        addr = ext->addr.sa_data;
+        if (is_broadcast_ether_addr(addr))
+                addr = NULL;
+
+        memset(&params, 0, sizeof(params));
+        params.key = ext->key;
+        params.key_len = ext->key_len;
+        params.cipher = cipher;
+
+        if (ext->ext_flags & IW_ENCODE_EXT_RX_SEQ_VALID) {
+                params.seq = ext->rx_seq;
+                params.seq_len = 6;
+        }
+
+        return cfg80211_set_encryption(
+                        rdev, dev, addr, remove,
+                        ext->ext_flags & IW_ENCODE_EXT_SET_TX_KEY,
+                        idx, &params);
+}
+EXPORT_SYMBOL_GPL(cfg80211_wext_siwencodeext);
+
+struct giwencode_cookie {
+        size_t buflen;
+        char *keybuf;
+};
+
+static void giwencode_get_key_cb(void *cookie, struct key_params *params)
+{
+        struct giwencode_cookie *data = cookie;
+
+        if (!params->key) {
+                data->buflen = 0;
+                return;
+        }
+
+        data->buflen = min_t(size_t, data->buflen, params->key_len);
+        memcpy(data->keybuf, params->key, data->buflen);
+}
+
+int cfg80211_wext_giwencode(struct net_device *dev,
+                            struct iw_request_info *info,
+                            struct iw_point *erq, char *keybuf)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        int idx, err;
+        struct giwencode_cookie data = {
+                .keybuf = keybuf,
+                .buflen = erq->length,
+        };
+
+        if (!rdev->ops->get_key)
+                return -EOPNOTSUPP;
+
+        idx = erq->flags & IW_ENCODE_INDEX;
+        if (idx == 0) {
+                idx = wdev->wext.default_key;
+                if (idx < 0)
+                        idx = 0;
+        } else if (idx < 1 || idx > 4)
+                return -EINVAL;
+        else
+                idx--;
+
+        erq->flags = idx + 1;
+
+        err = rdev->ops->get_key(&rdev->wiphy, dev, idx, NULL, &data,
+                                 giwencode_get_key_cb);
+        if (!err) {
+                erq->length = data.buflen;
+                erq->flags |= IW_ENCODE_ENABLED;
+                return 0;
+        }
+
+        if (err == -ENOENT) {
+                erq->flags |= IW_ENCODE_DISABLED;
+                erq->length = 0;
+                return 0;
+        }
+
+        return err;
+}
+EXPORT_SYMBOL_GPL(cfg80211_wext_giwencode);
diff --git a/net/wireless/wext.c b/net/wireless/wext.c
index 0e59f9ae9b81..252c2010c2e2 100644
--- a/net/wireless/wext.c
+++ b/net/wireless/wext.c
@@ -636,8 +636,10 @@ static void wireless_seq_printf_stats(struct seq_file *seq,
 /*
  * Print info for /proc/net/wireless (print all entries)
  */
-static int wireless_seq_show(struct seq_file *seq, void *v)
+static int wireless_dev_seq_show(struct seq_file *seq, void *v)
 {
+        might_sleep();
+
         if (v == SEQ_START_TOKEN)
                 seq_printf(seq, "Inter-| sta-|   Quality        |   Discarded "
                                 "packets               | Missed | WE\n"
@@ -649,14 +651,46 @@ static int wireless_seq_show(struct seq_file *seq, void *v)
         return 0;
 }
 
+static void *wireless_dev_seq_start(struct seq_file *seq, loff_t *pos)
+{
+        struct net *net = seq_file_net(seq);
+        loff_t off;
+        struct net_device *dev;
+
+        rtnl_lock();
+        if (!*pos)
+                return SEQ_START_TOKEN;
+
+        off = 1;
+        for_each_netdev(net, dev)
+                if (off++ == *pos)
+                        return dev;
+        return NULL;
+}
+
+static void *wireless_dev_seq_next(struct seq_file *seq, void *v, loff_t *pos)
+{
+        struct net *net = seq_file_net(seq);
+
+        ++*pos;
+
+        return v == SEQ_START_TOKEN ?
+                first_net_device(net) : next_net_device(v);
+}
+
+static void wireless_dev_seq_stop(struct seq_file *seq, void *v)
+{
+        rtnl_unlock();
+}
+
 static const struct seq_operations wireless_seq_ops = {
-        .start = dev_seq_start,
-        .next  = dev_seq_next,
-        .stop  = dev_seq_stop,
-        .show  = wireless_seq_show,
+        .start = wireless_dev_seq_start,
+        .next  = wireless_dev_seq_next,
+        .stop  = wireless_dev_seq_stop,
+        .show  = wireless_dev_seq_show,
 };
 
-static int wireless_seq_open(struct inode *inode, struct file *file)
+static int seq_open_wireless(struct inode *inode, struct file *file)
 {
         return seq_open_net(inode, file, &wireless_seq_ops,
                             sizeof(struct seq_net_private));
@@ -664,7 +698,7 @@ static int wireless_seq_open(struct inode *inode, struct file *file)
 
 static const struct file_operations wireless_seq_fops = {
         .owner   = THIS_MODULE,
-        .open    = wireless_seq_open,
+        .open    = seq_open_wireless,
         .read    = seq_read,
         .llseek  = seq_lseek,
         .release = seq_release_net,