11 files changed, 471 insertions, 61 deletions

diff --git a/net/wireless/Kconfig b/net/wireless/Kconfig
index 1f1ef70f34f..8e2a668c923 100644
--- a/net/wireless/Kconfig
+++ b/net/wireless/Kconfig
@@ -159,3 +159,14 @@ config LIB80211_DEBUG
           from lib80211.
 
           If unsure, say N.
+
+config CFG80211_ALLOW_RECONNECT
+        bool "Allow reconnect while already connected"
+        depends on CFG80211
+        default n
+        help
+          cfg80211 stack doesn't allow to connect if you are already
+          connected. This option allows to make a connection in this case.
+
+          Select this option ONLY for wlan drivers that are specifically
+          built for such purposes.
diff --git a/net/wireless/core.c b/net/wireless/core.c
index 880dbe2e6f9..c14865172da 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -488,6 +488,10 @@ int wiphy_register(struct wiphy *wiphy)
         int i;
         u16 ifmodes = wiphy->interface_modes;
 
+        if (WARN_ON((wiphy->wowlan.flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
+                    !(wiphy->wowlan.flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY)))
+                return -EINVAL;
+
         if (WARN_ON(wiphy->addresses && !wiphy->n_addresses))
                 return -EINVAL;
 
@@ -612,6 +616,9 @@ int wiphy_register(struct wiphy *wiphy)
         if (res)
                 goto out_rm_dev;
 
+        rtnl_lock();
+        rdev->wiphy.registered = true;
+        rtnl_unlock();
         return 0;
 
 out_rm_dev:
@@ -643,6 +650,10 @@ void wiphy_unregister(struct wiphy *wiphy)
 {
         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 
+        rtnl_lock();
+        rdev->wiphy.registered = false;
+        rtnl_unlock();
+
         rfkill_unregister(rdev->rfkill);
 
         /* protect the device list */
@@ -918,7 +929,8 @@ static int cfg80211_netdev_notifier_call(struct notifier_block * nb,
                  * Configure power management to the driver here so that its
                  * correctly set also after interface type changes etc.
                  */
-                if (wdev->iftype == NL80211_IFTYPE_STATION &&
+                if ((wdev->iftype == NL80211_IFTYPE_STATION ||
+                     wdev->iftype == NL80211_IFTYPE_P2P_CLIENT) &&
                     rdev->ops->set_power_mgmt)
                         if (rdev->ops->set_power_mgmt(wdev->wiphy, dev,
                                                       wdev->ps,
diff --git a/net/wireless/core.h b/net/wireless/core.h
index a570ff9214e..8672e028022 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -447,6 +447,10 @@ int cfg80211_set_freq(struct cfg80211_registered_device *rdev,
 
 u16 cfg80211_calculate_bitrate(struct rate_info *rate);
 
+int ieee80211_get_ratemask(struct ieee80211_supported_band *sband,
+                           const u8 *rates, unsigned int n_rates,
+                           u32 *mask);
+
 int cfg80211_validate_beacon_int(struct cfg80211_registered_device *rdev,
                                  u32 beacon_int);
 
diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c
index 493b939970c..832f6574e4e 100644
--- a/net/wireless/mlme.c
+++ b/net/wireless/mlme.c
@@ -170,7 +170,9 @@ void __cfg80211_send_deauth(struct net_device *dev,
                         break;
                 }
                 if (wdev->authtry_bsses[i] &&
-                    memcmp(wdev->authtry_bsses[i]->pub.bssid, bssid, ETH_ALEN) == 0) {
+                    memcmp(wdev->authtry_bsses[i]->pub.bssid, bssid,
+                           ETH_ALEN) == 0 &&
+                    memcmp(mgmt->sa, dev->dev_addr, ETH_ALEN) == 0) {
                         cfg80211_unhold_bss(wdev->authtry_bsses[i]);
                         cfg80211_put_bss(&wdev->authtry_bsses[i]->pub);
                         wdev->authtry_bsses[i] = NULL;
@@ -1082,3 +1084,14 @@ void cfg80211_cqm_pktloss_notify(struct net_device *dev,
         nl80211_send_cqm_pktloss_notify(rdev, dev, peer, num_packets, gfp);
 }
 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
+
+void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
+                               const u8 *replay_ctr, gfp_t gfp)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct wiphy *wiphy = wdev->wiphy;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+
+        nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
+}
+EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index cea338150d0..fb18bb4dea7 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -83,8 +83,8 @@ static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
 
-        [NL80211_ATTR_MAC] = { .type = NLA_BINARY, .len = ETH_ALEN },
-        [NL80211_ATTR_PREV_BSSID] = { .type = NLA_BINARY, .len = ETH_ALEN },
+        [NL80211_ATTR_MAC] = { .len = ETH_ALEN },
+        [NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN },
 
         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
@@ -126,8 +126,7 @@ static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 
-        [NL80211_ATTR_HT_CAPABILITY] = { .type = NLA_BINARY,
-                                         .len = NL80211_HT_CAPABILITY_LEN },
+        [NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN },
 
         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
@@ -176,6 +175,8 @@ static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
         [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 },
         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
+        [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
+        [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
 };
 
 /* policy for the key attributes */
@@ -204,6 +205,18 @@ nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
+        [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
+        [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
+        [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
+        [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
+};
+
+/* policy for GTK rekey offload attributes */
+static const struct nla_policy
+nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
+        [NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN },
+        [NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
+        [NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
 };
 
 /* ifidx get helper */
@@ -683,8 +696,12 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
                     dev->wiphy.coverage_class);
         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
                    dev->wiphy.max_scan_ssids);
+        NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
+                   dev->wiphy.max_sched_scan_ssids);
         NLA_PUT_U16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
                     dev->wiphy.max_scan_ie_len);
+        NLA_PUT_U16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
+                    dev->wiphy.max_sched_scan_ie_len);
 
         if (dev->wiphy.flags & WIPHY_FLAG_IBSS_RSN)
                 NLA_PUT_FLAG(msg, NL80211_ATTR_SUPPORT_IBSS_RSN);
@@ -920,6 +937,16 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_DISCONNECT);
                 if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_MAGIC_PKT)
                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT);
+                if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY)
+                        NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED);
+                if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE)
+                        NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE);
+                if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ)
+                        NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST);
+                if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_4WAY_HANDSHAKE)
+                        NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE);
+                if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_RFKILL_RELEASE)
+                        NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE);
                 if (dev->wiphy.wowlan.n_patterns) {
                         struct nl80211_wowlan_pattern_support pat = {
                                 .max_patterns = dev->wiphy.wowlan.n_patterns,
@@ -2209,6 +2236,10 @@ static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
         }
         nla_nest_end(msg, sinfoattr);
 
+        if (sinfo->assoc_req_ies)
+                NLA_PUT(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
+                        sinfo->assoc_req_ies);
+
         return genlmsg_end(msg, hdr);
 
  nla_put_failure:
@@ -2236,6 +2267,7 @@ static int nl80211_dump_station(struct sk_buff *skb,
         }
 
         while (1) {
+                memset(&sinfo, 0, sizeof(sinfo));
                 err = dev->ops->dump_station(&dev->wiphy, netdev, sta_idx,
                                              mac_addr, &sinfo);
                 if (err == -ENOENT)
@@ -3297,7 +3329,6 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
         struct nlattr *attr;
         struct wiphy *wiphy;
         int err, tmp, n_ssids = 0, n_channels, i;
-        enum ieee80211_band band;
         size_t ie_len;
 
         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
@@ -3317,6 +3348,7 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
                 if (!n_channels)
                         return -EINVAL;
         } else {
+                enum ieee80211_band band;
                 n_channels = 0;
 
                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
@@ -3377,6 +3409,8 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
                         i++;
                 }
         } else {
+                enum ieee80211_band band;
+
                 /* all channels */
                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
                         int j;
@@ -3423,6 +3457,30 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
                        request->ie_len);
         }
 
+        for (i = 0; i < IEEE80211_NUM_BANDS; i++)
+                if (wiphy->bands[i])
+                        request->rates[i] =
+                                (1 << wiphy->bands[i]->n_bitrates) - 1;
+
+        if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
+                nla_for_each_nested(attr,
+                                    info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
+                                    tmp) {
+                        enum ieee80211_band band = nla_type(attr);
+
+                        if (band < 0 || band >= IEEE80211_NUM_BANDS) {
+                                err = -EINVAL;
+                                goto out_free;
+                        }
+                        err = ieee80211_get_ratemask(wiphy->bands[band],
+                                                     nla_data(attr),
+                                                     nla_len(attr),
+                                                     &request->rates[band]);
+                        if (err)
+                                goto out_free;
+                }
+        }
+
         request->dev = dev;
         request->wiphy = &rdev->wiphy;
 
@@ -3488,7 +3546,7 @@ static int nl80211_start_sched_scan(struct sk_buff *skb,
                                     tmp)
                         n_ssids++;
 
-        if (n_ssids > wiphy->max_scan_ssids)
+        if (n_ssids > wiphy->max_sched_scan_ssids)
                 return -EINVAL;
 
         if (info->attrs[NL80211_ATTR_IE])
@@ -3496,7 +3554,7 @@ static int nl80211_start_sched_scan(struct sk_buff *skb,
         else
                 ie_len = 0;
 
-        if (ie_len > wiphy->max_scan_ie_len)
+        if (ie_len > wiphy->max_sched_scan_ie_len)
                 return -EINVAL;
 
         mutex_lock(&rdev->sched_scan_mtx);
@@ -3632,7 +3690,8 @@ static int nl80211_stop_sched_scan(struct sk_buff *skb,
         return err;
 }
 
-static int nl80211_send_bss(struct sk_buff *msg, u32 pid, u32 seq, int flags,
+static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
+                            u32 seq, int flags,
                             struct cfg80211_registered_device *rdev,
                             struct wireless_dev *wdev,
                             struct cfg80211_internal_bss *intbss)
@@ -3644,11 +3703,13 @@ static int nl80211_send_bss(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 
         ASSERT_WDEV_LOCK(wdev);
 
-        hdr = nl80211hdr_put(msg, pid, seq, flags,
+        hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).pid, seq, flags,
                              NL80211_CMD_NEW_SCAN_RESULTS);
         if (!hdr)
                 return -1;
 
+        genl_dump_check_consistent(cb, hdr, &nl80211_fam);
+
         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation);
         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex);
 
@@ -3737,11 +3798,12 @@ static int nl80211_dump_scan(struct sk_buff *skb,
         spin_lock_bh(&rdev->bss_lock);
         cfg80211_bss_expire(rdev);
 
+        cb->seq = rdev->bss_generation;
+
         list_for_each_entry(scan, &rdev->bss_list, list) {
                 if (++idx <= start)
                         continue;
-                if (nl80211_send_bss(skb,
-                                NETLINK_CB(cb->skb).pid,
+                if (nl80211_send_bss(skb, cb,
                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
                                 rdev, wdev, scan) < 0) {
                         idx--;
@@ -3765,10 +3827,6 @@ static int nl80211_send_survey(struct sk_buff *msg, u32 pid, u32 seq,
         void *hdr;
         struct nlattr *infoattr;
 
-        /* Survey without a channel doesn't make sense */
-        if (!survey->channel)
-                return -EINVAL;
-
         hdr = nl80211hdr_put(msg, pid, seq, flags,
                              NL80211_CMD_NEW_SURVEY_RESULTS);
         if (!hdr)
@@ -3831,6 +3889,8 @@ static int nl80211_dump_survey(struct sk_buff *skb,
         }
 
         while (1) {
+                struct ieee80211_channel *chan;
+
                 res = dev->ops->dump_survey(&dev->wiphy, netdev, survey_idx,
                                             &survey);
                 if (res == -ENOENT)
@@ -3838,6 +3898,19 @@ static int nl80211_dump_survey(struct sk_buff *skb,
                 if (res)
                         goto out_err;
 
+                /* Survey without a channel doesn't make sense */
+                if (!survey.channel) {
+                        res = -EINVAL;
+                        goto out;
+                }
+
+                chan = ieee80211_get_channel(&dev->wiphy,
+                                             survey.channel->center_freq);
+                if (!chan || chan->flags & IEEE80211_CHAN_DISABLED) {
+                        survey_idx++;
+                        continue;
+                }
+
                 if (nl80211_send_survey(skb,
                                 NETLINK_CB(cb->skb).pid,
                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
@@ -4044,9 +4117,12 @@ static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
                 if (len % sizeof(u32))
                         return -EINVAL;
 
+                if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
+                        return -EINVAL;
+
                 memcpy(settings->akm_suites, data, len);
 
-                for (i = 0; i < settings->n_ciphers_pairwise; i++)
+                for (i = 0; i < settings->n_akm_suites; i++)
                         if (!nl80211_valid_akm_suite(settings->akm_suites[i]))
                                 return -EINVAL;
         }
@@ -4294,25 +4370,12 @@ static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
                 struct ieee80211_supported_band *sband =
                         wiphy->bands[ibss.channel->band];
-                int i, j;
-
-                if (n_rates == 0)
-                        return -EINVAL;
+                int err;
 
-                for (i = 0; i < n_rates; i++) {
-                        int rate = (rates[i] & 0x7f) * 5;
-                        bool found = false;
-
-                        for (j = 0; j < sband->n_bitrates; j++) {
-                                if (sband->bitrates[j].bitrate == rate) {
-                                        found = true;
-                                        ibss.basic_rates |= BIT(j);
-                                        break;
-                                }
-                        }
-                        if (!found)
-                                return -EINVAL;
-                }
+                err = ieee80211_get_ratemask(sband, rates, n_rates,
+                                             &ibss.basic_rates);
+                if (err)
+                        return err;
         }
 
         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
@@ -4372,6 +4435,93 @@ static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
         return err;
 }
 
+static int nl80211_testmode_dump(struct sk_buff *skb,
+                                 struct netlink_callback *cb)
+{
+        struct cfg80211_registered_device *dev;
+        int err;
+        long phy_idx;
+        void *data = NULL;
+        int data_len = 0;
+
+        if (cb->args[0]) {
+                /*
+                 * 0 is a valid index, but not valid for args[0],
+                 * so we need to offset by 1.
+                 */
+                phy_idx = cb->args[0] - 1;
+        } else {
+                err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
+                                  nl80211_fam.attrbuf, nl80211_fam.maxattr,
+                                  nl80211_policy);
+                if (err)
+                        return err;
+                if (!nl80211_fam.attrbuf[NL80211_ATTR_WIPHY])
+                        return -EINVAL;
+                phy_idx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_WIPHY]);
+                if (nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA])
+                        cb->args[1] =
+                                (long)nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA];
+        }
+
+        if (cb->args[1]) {
+                data = nla_data((void *)cb->args[1]);
+                data_len = nla_len((void *)cb->args[1]);
+        }
+
+        mutex_lock(&cfg80211_mutex);
+        dev = cfg80211_rdev_by_wiphy_idx(phy_idx);
+        if (!dev) {
+                mutex_unlock(&cfg80211_mutex);
+                return -ENOENT;
+        }
+        cfg80211_lock_rdev(dev);
+        mutex_unlock(&cfg80211_mutex);
+
+        if (!dev->ops->testmode_dump) {
+                err = -EOPNOTSUPP;
+                goto out_err;
+        }
+
+        while (1) {
+                void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).pid,
+                                           cb->nlh->nlmsg_seq, NLM_F_MULTI,
+                                           NL80211_CMD_TESTMODE);
+                struct nlattr *tmdata;
+
+                if (nla_put_u32(skb, NL80211_ATTR_WIPHY, dev->wiphy_idx) < 0) {
+                        genlmsg_cancel(skb, hdr);
+                        break;
+                }
+
+                tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
+                if (!tmdata) {
+                        genlmsg_cancel(skb, hdr);
+                        break;
+                }
+                err = dev->ops->testmode_dump(&dev->wiphy, skb, cb,
+                                              data, data_len);
+                nla_nest_end(skb, tmdata);
+
+                if (err == -ENOBUFS || err == -ENOENT) {
+                        genlmsg_cancel(skb, hdr);
+                        break;
+                } else if (err) {
+                        genlmsg_cancel(skb, hdr);
+                        goto out_err;
+                }
+
+                genlmsg_end(skb, hdr);
+        }
+
+        err = skb->len;
+        /* see above */
+        cb->args[0] = phy_idx + 1;
+ out_err:
+        cfg80211_unlock_rdev(dev);
+        return err;
+}
+
 static struct sk_buff *
 __cfg80211_testmode_alloc_skb(struct cfg80211_registered_device *rdev,
                               int approxlen, u32 pid, u32 seq, gfp_t gfp)
@@ -5161,6 +5311,14 @@ static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_DISCONNECT);
                 if (rdev->wowlan->magic_pkt)
                         NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT);
+                if (rdev->wowlan->gtk_rekey_failure)
+                        NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE);
+                if (rdev->wowlan->eap_identity_req)
+                        NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST);
+                if (rdev->wowlan->four_way_handshake)
+                        NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE);
+                if (rdev->wowlan->rfkill_release)
+                        NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE);
                 if (rdev->wowlan->n_patterns) {
                         struct nlattr *nl_pats, *nl_pat;
                         int i, pat_len;
@@ -5237,6 +5395,33 @@ static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
                 new_triggers.magic_pkt = true;
         }
 
+        if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
+                return -EINVAL;
+
+        if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
+                if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
+                        return -EINVAL;
+                new_triggers.gtk_rekey_failure = true;
+        }
+
+        if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
+                if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
+                        return -EINVAL;
+                new_triggers.eap_identity_req = true;
+        }
+
+        if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
+                if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
+                        return -EINVAL;
+                new_triggers.four_way_handshake = true;
+        }
+
+        if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
+                if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
+                        return -EINVAL;
+                new_triggers.rfkill_release = true;
+        }
+
         if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
                 struct nlattr *pat;
                 int n_patterns = 0;
@@ -5318,6 +5503,57 @@ static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
         return err;
 }
 
+static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
+{
+        struct cfg80211_registered_device *rdev = info->user_ptr[0];
+        struct net_device *dev = info->user_ptr[1];
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct nlattr *tb[NUM_NL80211_REKEY_DATA];
+        struct cfg80211_gtk_rekey_data rekey_data;
+        int err;
+
+        if (!info->attrs[NL80211_ATTR_REKEY_DATA])
+                return -EINVAL;
+
+        err = nla_parse(tb, MAX_NL80211_REKEY_DATA,
+                        nla_data(info->attrs[NL80211_ATTR_REKEY_DATA]),
+                        nla_len(info->attrs[NL80211_ATTR_REKEY_DATA]),
+                        nl80211_rekey_policy);
+        if (err)
+                return err;
+
+        if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
+                return -ERANGE;
+        if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)
+                return -ERANGE;
+        if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)
+                return -ERANGE;
+
+        memcpy(rekey_data.kek, nla_data(tb[NL80211_REKEY_DATA_KEK]),
+               NL80211_KEK_LEN);
+        memcpy(rekey_data.kck, nla_data(tb[NL80211_REKEY_DATA_KCK]),
+               NL80211_KCK_LEN);
+        memcpy(rekey_data.replay_ctr,
+               nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]),
+               NL80211_REPLAY_CTR_LEN);
+
+        wdev_lock(wdev);
+        if (!wdev->current_bss) {
+                err = -ENOTCONN;
+                goto out;
+        }
+
+        if (!rdev->ops->set_rekey_data) {
+                err = -EOPNOTSUPP;
+                goto out;
+        }
+
+        err = rdev->ops->set_rekey_data(&rdev->wiphy, dev, &rekey_data);
+ out:
+        wdev_unlock(wdev);
+        return err;
+}
+
 #define NL80211_FLAG_NEED_WIPHY         0x01
 #define NL80211_FLAG_NEED_NETDEV        0x02
 #define NL80211_FLAG_NEED_RTNL          0x04
@@ -5669,6 +5905,7 @@ static struct genl_ops nl80211_ops[] = {
         {
                 .cmd = NL80211_CMD_TESTMODE,
                 .doit = nl80211_testmode_do,
+                .dumpit = nl80211_testmode_dump,
                 .policy = nl80211_policy,
                 .flags = GENL_ADMIN_PERM,
                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
@@ -5848,6 +6085,14 @@ static struct genl_ops nl80211_ops[] = {
                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
                                   NL80211_FLAG_NEED_RTNL,
         },
+        {
+                .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
+                .doit = nl80211_set_rekey_data,
+                .policy = nl80211_policy,
+                .flags = GENL_ADMIN_PERM,
+                .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
+                                  NL80211_FLAG_NEED_RTNL,
+        },
 };
 
 static struct genl_multicast_group nl80211_mlme_mcgrp = {
@@ -6792,6 +7037,51 @@ nl80211_send_cqm_rssi_notify(struct cfg80211_registered_device *rdev,
         nlmsg_free(msg);
 }
 
+void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
+                              struct net_device *netdev, const u8 *bssid,
+                              const u8 *replay_ctr, gfp_t gfp)
+{
+        struct sk_buff *msg;
+        struct nlattr *rekey_attr;
+        void *hdr;
+
+        msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
+        if (!msg)
+                return;
+
+        hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
+        if (!hdr) {
+                nlmsg_free(msg);
+                return;
+        }
+
+        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
+        NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
+        NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
+
+        rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
+        if (!rekey_attr)
+                goto nla_put_failure;
+
+        NLA_PUT(msg, NL80211_REKEY_DATA_REPLAY_CTR,
+                NL80211_REPLAY_CTR_LEN, replay_ctr);
+
+        nla_nest_end(msg, rekey_attr);
+
+        if (genlmsg_end(msg, hdr) < 0) {
+                nlmsg_free(msg);
+                return;
+        }
+
+        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
+                                nl80211_mlme_mcgrp.id, gfp);
+        return;
+
+ nla_put_failure:
+        genlmsg_cancel(msg, hdr);
+        nlmsg_free(msg);
+}
+
 void
 nl80211_send_cqm_pktloss_notify(struct cfg80211_registered_device *rdev,
                                 struct net_device *netdev, const u8 *peer,
diff --git a/net/wireless/nl80211.h b/net/wireless/nl80211.h
index 2f1bfb87a65..5d69c56400a 100644
--- a/net/wireless/nl80211.h
+++ b/net/wireless/nl80211.h
@@ -109,4 +109,8 @@ nl80211_send_cqm_pktloss_notify(struct cfg80211_registered_device *rdev,
                                 struct net_device *netdev, const u8 *peer,
                                 u32 num_packets, gfp_t gfp);
 
+void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
+                              struct net_device *netdev, const u8 *bssid,
+                              const u8 *replay_ctr, gfp_t gfp);
+
 #endif /* __NET_WIRELESS_NL80211_H */
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 1ad0f39fe09..ca754451e76 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -57,8 +57,17 @@
 #define REG_DBG_PRINT(args...)
 #endif
 
+static struct regulatory_request core_request_world = {
+        .initiator = NL80211_REGDOM_SET_BY_CORE,
+        .alpha2[0] = '0',
+        .alpha2[1] = '0',
+        .intersect = false,
+        .processed = true,
+        .country_ie_env = ENVIRON_ANY,
+};
+
 /* Receipt of information from last regulatory request */
-static struct regulatory_request *last_request;
+static struct regulatory_request *last_request = &core_request_world;
 
 /* To trigger userspace events */
 static struct platform_device *reg_pdev;
@@ -150,7 +159,7 @@ static char user_alpha2[2];
 module_param(ieee80211_regdom, charp, 0444);
 MODULE_PARM_DESC(ieee80211_regdom, "IEEE 802.11 regulatory domain code");
 
-static void reset_regdomains(void)
+static void reset_regdomains(bool full_reset)
 {
         /* avoid freeing static information or freeing something twice */
         if (cfg80211_regdomain == cfg80211_world_regdom)
@@ -165,6 +174,13 @@ static void reset_regdomains(void)
 
         cfg80211_world_regdom = &world_regdom;
         cfg80211_regdomain = NULL;
+
+        if (!full_reset)
+                return;
+
+        if (last_request != &core_request_world)
+                kfree(last_request);
+        last_request = &core_request_world;
 }
 
 /*
@@ -175,7 +191,7 @@ static void update_world_regdomain(const struct ieee80211_regdomain *rd)
 {
         BUG_ON(!last_request);
 
-        reset_regdomains();
+        reset_regdomains(false);
 
         cfg80211_world_regdom = rd;
         cfg80211_regdomain = rd;
@@ -852,6 +868,7 @@ static void handle_channel(struct wiphy *wiphy,
                 return;
         }
 
+        chan->beacon_found = false;
         chan->flags = flags | bw_flags | map_regdom_flags(reg_rule->flags);
         chan->max_antenna_gain = min(chan->orig_mag,
                 (int) MBI_TO_DBI(power_rule->max_antenna_gain));
@@ -903,7 +920,7 @@ static bool ignore_reg_update(struct wiphy *wiphy,
             initiator != NL80211_REGDOM_SET_BY_COUNTRY_IE &&
             !is_world_regdom(last_request->alpha2)) {
                 REG_DBG_PRINT("Ignoring regulatory request %s "
-                              "since the driver requires its own regulaotry "
+                              "since the driver requires its own regulatory "
                               "domain to be set first",
                               reg_initiator_name(initiator));
                 return true;
@@ -1125,12 +1142,13 @@ void wiphy_update_regulatory(struct wiphy *wiphy,
         enum ieee80211_band band;
 
         if (ignore_reg_update(wiphy, initiator))
-                goto out;
+                return;
+
         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
                 if (wiphy->bands[band])
                         handle_band(wiphy, band, initiator);
         }
-out:
+
         reg_process_beacons(wiphy);
         reg_process_ht_flags(wiphy);
         if (wiphy->reg_notifier)
@@ -1394,7 +1412,8 @@ static int __regulatory_hint(struct wiphy *wiphy,
         }
 
 new_request:
-        kfree(last_request);
+        if (last_request != &core_request_world)
+                kfree(last_request);
 
         last_request = pending_request;
         last_request->intersect = intersect;
@@ -1564,9 +1583,6 @@ static int regulatory_hint_core(const char *alpha2)
 {
         struct regulatory_request *request;
 
-        kfree(last_request);
-        last_request = NULL;
-
         request = kzalloc(sizeof(struct regulatory_request),
                           GFP_KERNEL);
         if (!request)
@@ -1757,6 +1773,7 @@ static void restore_alpha2(char *alpha2, bool reset_user)
 static void restore_regulatory_settings(bool reset_user)
 {
         char alpha2[2];
+        char world_alpha2[2];
         struct reg_beacon *reg_beacon, *btmp;
         struct regulatory_request *reg_request, *tmp;
         LIST_HEAD(tmp_reg_req_list);
@@ -1764,7 +1781,7 @@ static void restore_regulatory_settings(bool reset_user)
         mutex_lock(&cfg80211_mutex);
         mutex_lock(&reg_mutex);
 
-        reset_regdomains();
+        reset_regdomains(true);
         restore_alpha2(alpha2, reset_user);
 
         /*
@@ -1807,11 +1824,13 @@ static void restore_regulatory_settings(bool reset_user)
 
         /* First restore to the basic regulatory settings */
         cfg80211_regdomain = cfg80211_world_regdom;
+        world_alpha2[0] = cfg80211_regdomain->alpha2[0];
+        world_alpha2[1] = cfg80211_regdomain->alpha2[1];
 
         mutex_unlock(&reg_mutex);
         mutex_unlock(&cfg80211_mutex);
 
-        regulatory_hint_core(cfg80211_regdomain->alpha2);
+        regulatory_hint_core(world_alpha2);
 
         /*
          * This restores the ieee80211_regdom module parameter
@@ -2024,12 +2043,18 @@ static int __set_regdom(const struct ieee80211_regdomain *rd)
         }
 
         request_wiphy = wiphy_idx_to_wiphy(last_request->wiphy_idx);
+        if (!request_wiphy &&
+            (last_request->initiator == NL80211_REGDOM_SET_BY_DRIVER ||
+             last_request->initiator == NL80211_REGDOM_SET_BY_COUNTRY_IE)) {
+                schedule_delayed_work(&reg_timeout, 0);
+                return -ENODEV;
+        }
 
         if (!last_request->intersect) {
                 int r;
 
                 if (last_request->initiator != NL80211_REGDOM_SET_BY_DRIVER) {
-                        reset_regdomains();
+                        reset_regdomains(false);
                         cfg80211_regdomain = rd;
                         return 0;
                 }
@@ -2050,7 +2075,7 @@ static int __set_regdom(const struct ieee80211_regdomain *rd)
                 if (r)
                         return r;
 
-                reset_regdomains();
+                reset_regdomains(false);
                 cfg80211_regdomain = rd;
                 return 0;
         }
@@ -2075,7 +2100,7 @@ static int __set_regdom(const struct ieee80211_regdomain *rd)
 
                 rd = NULL;
 
-                reset_regdomains();
+                reset_regdomains(false);
                 cfg80211_regdomain = intersected_rd;
 
                 return 0;
@@ -2095,7 +2120,7 @@ static int __set_regdom(const struct ieee80211_regdomain *rd)
         kfree(rd);
         rd = NULL;
 
-        reset_regdomains();
+        reset_regdomains(false);
         cfg80211_regdomain = intersected_rd;
 
         return 0;
@@ -2248,9 +2273,9 @@ void /* __init_or_exit */ regulatory_exit(void)
         mutex_lock(&cfg80211_mutex);
         mutex_lock(&reg_mutex);
 
-        reset_regdomains();
+        reset_regdomains(true);
 
-        kfree(last_request);
+        dev_set_uevent_suppress(&reg_pdev->dev, true);
 
         platform_device_unregister(reg_pdev);
 
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index ae0c2256ba3..1c100d331e1 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -17,7 +17,7 @@
 #include "nl80211.h"
 #include "wext-compat.h"
 
-#define IEEE80211_SCAN_RESULT_EXPIRE    (15 * HZ)
+#define IEEE80211_SCAN_RESULT_EXPIRE    (3 * HZ)
 
 void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev, bool leak)
 {
@@ -132,18 +132,17 @@ EXPORT_SYMBOL(cfg80211_sched_scan_stopped);
 int __cfg80211_stop_sched_scan(struct cfg80211_registered_device *rdev,
                                bool driver_initiated)
 {
-        int err;
         struct net_device *dev;
 
         lockdep_assert_held(&rdev->sched_scan_mtx);
 
         if (!rdev->sched_scan_req)
-                return 0;
+                return -ENOENT;
 
         dev = rdev->sched_scan_req->dev;
 
         if (!driver_initiated) {
-                err = rdev->ops->sched_scan_stop(&rdev->wiphy, dev);
+                int err = rdev->ops->sched_scan_stop(&rdev->wiphy, dev);
                 if (err)
                         return err;
         }
@@ -153,7 +152,7 @@ int __cfg80211_stop_sched_scan(struct cfg80211_registered_device *rdev,
         kfree(rdev->sched_scan_req);
         rdev->sched_scan_req = NULL;
 
-        return err;
+        return 0;
 }
 
 static void bss_release(struct kref *ref)
@@ -863,6 +862,10 @@ int cfg80211_wext_siwscan(struct net_device *dev,
                         creq->n_ssids = 0;
         }
 
+        for (i = 0; i < IEEE80211_NUM_BANDS; i++)
+                if (wiphy->bands[i])
+                        creq->rates[i] = (1 << wiphy->bands[i]->n_bitrates) - 1;
+
         rdev->scan_req = creq;
         err = rdev->ops->scan(wiphy, dev, creq);
         if (err) {
diff --git a/net/wireless/sme.c b/net/wireless/sme.c
index b7b6ff8be55..c0fe1a8a6ee 100644
--- a/net/wireless/sme.c
+++ b/net/wireless/sme.c
@@ -118,6 +118,8 @@ static int cfg80211_conn_scan(struct wireless_dev *wdev)
                              i++, j++)
                                 request->channels[i] =
                                         &wdev->wiphy->bands[band]->channels[j];
+                        request->rates[band] =
+                                (1 << wdev->wiphy->bands[band]->n_bitrates) - 1;
                 }
         }
         request->n_channels = n_channels;
@@ -659,8 +661,10 @@ void __cfg80211_disconnected(struct net_device *dev, const u8 *ie,
                     wdev->iftype != NL80211_IFTYPE_P2P_CLIENT))
                 return;
 
+#ifndef CONFIG_CFG80211_ALLOW_RECONNECT
         if (wdev->sme_state != CFG80211_SME_CONNECTED)
                 return;
+#endif
 
         if (wdev->current_bss) {
                 cfg80211_unhold_bss(wdev->current_bss);
@@ -758,10 +762,14 @@ int __cfg80211_connect(struct cfg80211_registered_device *rdev,
 
         ASSERT_WDEV_LOCK(wdev);
 
+#ifndef CONFIG_CFG80211_ALLOW_RECONNECT
         if (wdev->sme_state != CFG80211_SME_IDLE)
                 return -EALREADY;
 
         if (WARN_ON(wdev->connect_keys)) {
+#else
+        if (wdev->connect_keys) {
+#endif
                 kfree(wdev->connect_keys);
                 wdev->connect_keys = NULL;
         }
diff --git a/net/wireless/sysfs.c b/net/wireless/sysfs.c
index c6e4ca6a7d2..ff574597a85 100644
--- a/net/wireless/sysfs.c
+++ b/net/wireless/sysfs.c
@@ -93,7 +93,8 @@ static int wiphy_suspend(struct device *dev, pm_message_t state)
 
         if (rdev->ops->suspend) {
                 rtnl_lock();
-                ret = rdev->ops->suspend(&rdev->wiphy, rdev->wowlan);
+                if (rdev->wiphy.registered)
+                        ret = rdev->ops->suspend(&rdev->wiphy, rdev->wowlan);
                 rtnl_unlock();
         }
 
@@ -112,7 +113,8 @@ static int wiphy_resume(struct device *dev)
 
         if (rdev->ops->resume) {
                 rtnl_lock();
-                ret = rdev->ops->resume(&rdev->wiphy);
+                if (rdev->wiphy.registered)
+                        ret = rdev->ops->resume(&rdev->wiphy);
                 rtnl_unlock();
         }
 
diff --git a/net/wireless/util.c b/net/wireless/util.c
index 4d7b83fbc32..be75a3a0424 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -1006,3 +1006,41 @@ int cfg80211_can_change_interface(struct cfg80211_registered_device *rdev,
 
         return -EBUSY;
 }
+
+int ieee80211_get_ratemask(struct ieee80211_supported_band *sband,
+                           const u8 *rates, unsigned int n_rates,
+                           u32 *mask)
+{
+        int i, j;
+
+        if (!sband)
+                return -EINVAL;
+
+        if (n_rates == 0 || n_rates > NL80211_MAX_SUPP_RATES)
+                return -EINVAL;
+
+        *mask = 0;
+
+        for (i = 0; i < n_rates; i++) {
+                int rate = (rates[i] & 0x7f) * 5;
+                bool found = false;
+
+                for (j = 0; j < sband->n_bitrates; j++) {
+                        if (sband->bitrates[j].bitrate == rate) {
+                                found = true;
+                                *mask |= BIT(j);
+                                break;
+                        }
+                }
+                if (!found)
+                        return -EINVAL;
+        }
+
+        /*
+         * mask must have at least one bit set here since we
+         * didn't accept a 0-length rates array nor allowed
+         * entries in the array that didn't exist
+         */
+
+        return 0;
+}