Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/linville/wireless-next-2.6

8 files changed, 342 insertions, 116 deletions

diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
index 2998e3b5f166..cffd6d0094f9 100644
--- a/include/linux/ieee80211.h
+++ b/include/linux/ieee80211.h
@@ -469,6 +469,40 @@ struct ieee80211s_hdr {
         u8 eaddr3[6];
 } __attribute__ ((packed));
 
+/**
+ * struct ieee80211_quiet_ie
+ *
+ * This structure refers to "Quiet information element"
+ */
+struct ieee80211_quiet_ie {
+        u8 count;
+        u8 period;
+        __le16 duration;
+        __le16 offset;
+} __attribute__ ((packed));
+
+/**
+ * struct ieee80211_msrment_ie
+ *
+ * This structure refers to "Measurement Request/Report information element"
+ */
+struct ieee80211_msrment_ie {
+        u8 token;
+        u8 mode;
+        u8 type;
+        u8 request[0];
+} __attribute__ ((packed));
+
+/**
+ * struct ieee80211_channel_sw_ie
+ *
+ * This structure refers to "Channel Switch Announcement information element"
+ */
+struct ieee80211_channel_sw_ie {
+        u8 mode;
+        u8 new_ch_num;
+        u8 count;
+} __attribute__ ((packed));
 
 struct ieee80211_mgmt {
         __le16 frame_control;
@@ -544,13 +578,18 @@ struct ieee80211_mgmt {
                                         u8 action_code;
                                         u8 element_id;
                                         u8 length;
-                                        u8 switch_mode;
-                                        u8 new_chan;
-                                        u8 switch_count;
+                                        struct ieee80211_channel_sw_ie sw_elem;
                                 } __attribute__((packed)) chan_switch;
                                 struct{
                                         u8 action_code;
                                         u8 dialog_token;
+                                        u8 element_id;
+                                        u8 length;
+                                        struct ieee80211_msrment_ie msr_elem;
+                                } __attribute__((packed)) measurement;
+                                struct{
+                                        u8 action_code;
+                                        u8 dialog_token;
                                         __le16 capab;
                                         __le16 timeout;
                                         __le16 start_seq_num;
@@ -700,11 +739,21 @@ struct ieee80211_ht_addt_info {
 #define WLAN_CAPABILITY_SHORT_PREAMBLE  (1<<5)
 #define WLAN_CAPABILITY_PBCC            (1<<6)
 #define WLAN_CAPABILITY_CHANNEL_AGILITY (1<<7)
+
 /* 802.11h */
 #define WLAN_CAPABILITY_SPECTRUM_MGMT   (1<<8)
 #define WLAN_CAPABILITY_QOS             (1<<9)
 #define WLAN_CAPABILITY_SHORT_SLOT_TIME (1<<10)
 #define WLAN_CAPABILITY_DSSS_OFDM       (1<<13)
+/* measurement */
+#define IEEE80211_SPCT_MSR_RPRT_MODE_LATE       (1<<0)
+#define IEEE80211_SPCT_MSR_RPRT_MODE_INCAPABLE  (1<<1)
+#define IEEE80211_SPCT_MSR_RPRT_MODE_REFUSED    (1<<2)
+
+#define IEEE80211_SPCT_MSR_RPRT_TYPE_BASIC      0
+#define IEEE80211_SPCT_MSR_RPRT_TYPE_CCA        1
+#define IEEE80211_SPCT_MSR_RPRT_TYPE_RPI        2
+
 
 /* 802.11g ERP information element */
 #define WLAN_ERP_NON_ERP_PRESENT (1<<0)
@@ -875,6 +924,15 @@ enum ieee80211_category {
         WLAN_CATEGORY_WMM = 17,
 };
 
+/* SPECTRUM_MGMT action code */
+enum ieee80211_spectrum_mgmt_actioncode {
+        WLAN_ACTION_SPCT_MSR_REQ = 0,
+        WLAN_ACTION_SPCT_MSR_RPRT = 1,
+        WLAN_ACTION_SPCT_TPC_REQ = 2,
+        WLAN_ACTION_SPCT_TPC_RPRT = 3,
+        WLAN_ACTION_SPCT_CHL_SWITCH = 4,
+};
+
 /* BACK action code */
 enum ieee80211_back_actioncode {
         WLAN_ACTION_ADDBA_REQ = 0,
diff --git a/include/linux/nl80211.h b/include/linux/nl80211.h
index aa8411e2a160..2be7c63bc0f2 100644
--- a/include/linux/nl80211.h
+++ b/include/linux/nl80211.h
@@ -241,7 +241,10 @@ enum nl80211_attrs {
         NL80211_ATTR_MAX = __NL80211_ATTR_AFTER_LAST - 1
 };
 
-#define NL80211_MAX_SUPP_RATES  32
+#define NL80211_MAX_SUPP_RATES                  32
+#define NL80211_TKIP_DATA_OFFSET_ENCR_KEY       0
+#define NL80211_TKIP_DATA_OFFSET_TX_MIC_KEY     16
+#define NL80211_TKIP_DATA_OFFSET_RX_MIC_KEY     24
 
 /**
  * enum nl80211_iftype - (virtual) interface types
diff --git a/include/linux/rfkill.h b/include/linux/rfkill.h
index e3ab21d7fc7f..c5f6e54ec6ae 100644
--- a/include/linux/rfkill.h
+++ b/include/linux/rfkill.h
@@ -34,26 +34,37 @@
  * RFKILL_TYPE_BLUETOOTH: switch is on a bluetooth device.
  * RFKILL_TYPE_UWB: switch is on a ultra wideband device.
  * RFKILL_TYPE_WIMAX: switch is on a WiMAX device.
+ * RFKILL_TYPE_WWAN: switch is on a wireless WAN device.
  */
 enum rfkill_type {
         RFKILL_TYPE_WLAN ,
         RFKILL_TYPE_BLUETOOTH,
         RFKILL_TYPE_UWB,
         RFKILL_TYPE_WIMAX,
+        RFKILL_TYPE_WWAN,
         RFKILL_TYPE_MAX,
 };
 
 enum rfkill_state {
-        RFKILL_STATE_OFF        = 0,
-        RFKILL_STATE_ON         = 1,
+        RFKILL_STATE_SOFT_BLOCKED = 0,  /* Radio output blocked */
+        RFKILL_STATE_UNBLOCKED    = 1,  /* Radio output allowed */
+        RFKILL_STATE_HARD_BLOCKED = 2,  /* Output blocked, non-overrideable */
 };
 
+/*
+ * These are DEPRECATED, drivers using them should be verified to
+ * comply with the rfkill usage guidelines in Documentation/rfkill.txt
+ * and then converted to use the new names for rfkill_state
+ */
+#define RFKILL_STATE_OFF RFKILL_STATE_SOFT_BLOCKED
+#define RFKILL_STATE_ON  RFKILL_STATE_UNBLOCKED
+
 /**
  * struct rfkill - rfkill control structure.
  * @name: Name of the switch.
  * @type: Radio type which the button controls, the value stored
  *      here should be a value from enum rfkill_type.
- * @state: State of the switch (on/off).
+ * @state: State of the switch, "UNBLOCKED" means radio can operate.
  * @user_claim_unsupported: Whether the hardware supports exclusive
  *      RF-kill control by userspace. Set this before registering.
  * @user_claim: Set when the switch is controlled exlusively by userspace.
@@ -61,6 +72,12 @@ enum rfkill_state {
  * @data: Pointer to the RF button drivers private data which will be
  *      passed along when toggling radio state.
  * @toggle_radio(): Mandatory handler to control state of the radio.
+ *      only RFKILL_STATE_SOFT_BLOCKED and RFKILL_STATE_UNBLOCKED are
+ *      valid parameters.
+ * @get_state(): handler to read current radio state from hardware,
+ *      may be called from atomic context, should return 0 on success.
+ *      Either this handler OR judicious use of rfkill_force_state() is
+ *      MANDATORY for any driver capable of RFKILL_STATE_HARD_BLOCKED.
  * @led_trigger: A LED trigger for this button's LED.
  * @dev: Device structure integrating the switch into device tree.
  * @node: Used to place switch into list of all switches known to the
@@ -80,6 +97,7 @@ struct rfkill {
 
         void *data;
         int (*toggle_radio)(void *data, enum rfkill_state state);
+        int (*get_state)(void *data, enum rfkill_state *state);
 
 #ifdef CONFIG_RFKILL_LEDS
         struct led_trigger led_trigger;
@@ -95,6 +113,21 @@ void rfkill_free(struct rfkill *rfkill);
 int rfkill_register(struct rfkill *rfkill);
 void rfkill_unregister(struct rfkill *rfkill);
 
+int rfkill_force_state(struct rfkill *rfkill, enum rfkill_state state);
+
+/**
+ * rfkill_state_complement - return complementar state
+ * @state: state to return the complement of
+ *
+ * Returns RFKILL_STATE_SOFT_BLOCKED if @state is RFKILL_STATE_UNBLOCKED,
+ * returns RFKILL_STATE_UNBLOCKED otherwise.
+ */
+static inline enum rfkill_state rfkill_state_complement(enum rfkill_state state)
+{
+        return (state == RFKILL_STATE_UNBLOCKED) ?
+                RFKILL_STATE_SOFT_BLOCKED : RFKILL_STATE_UNBLOCKED;
+}
+
 /**
  * rfkill_get_led_name - Get the LED trigger name for the button's LED.
  * This function might return a NULL pointer if registering of the
@@ -110,4 +143,11 @@ static inline char *rfkill_get_led_name(struct rfkill *rfkill)
 #endif
 }
 
+/* rfkill notification chain */
+#define RFKILL_STATE_CHANGED            0x0001  /* state of a normal rfkill
+                                                   switch has changed */
+
+int register_rfkill_notifier(struct notifier_block *nb);
+int unregister_rfkill_notifier(struct notifier_block *nb);
+
 #endif /* RFKILL_H */
diff --git a/include/linux/ssb/ssb.h b/include/linux/ssb/ssb.h
index 50dfd0dc4093..0fe5a0ded3ea 100644
--- a/include/linux/ssb/ssb.h
+++ b/include/linux/ssb/ssb.h
@@ -137,9 +137,6 @@ struct ssb_device {
         const struct ssb_bus_ops *ops;
 
         struct device *dev;
-        /* Pointer to the device that has to be used for
-         * any DMA related operation. */
-        struct device *dma_dev;
 
         struct ssb_bus *bus;
         struct ssb_device_id id;
@@ -399,13 +396,151 @@ static inline void ssb_block_write(struct ssb_device *dev, const void *buffer,
 #endif /* CONFIG_SSB_BLOCKIO */
 
 
+/* The SSB DMA API. Use this API for any DMA operation on the device.
+ * This API basically is a wrapper that calls the correct DMA API for
+ * the host device type the SSB device is attached to. */
+
 /* Translation (routing) bits that need to be ORed to DMA
  * addresses before they are given to a device. */
 extern u32 ssb_dma_translation(struct ssb_device *dev);
 #define SSB_DMA_TRANSLATION_MASK        0xC0000000
 #define SSB_DMA_TRANSLATION_SHIFT       30
 
-extern int ssb_dma_set_mask(struct ssb_device *ssb_dev, u64 mask);
+extern int ssb_dma_set_mask(struct ssb_device *dev, u64 mask);
+
+extern void * ssb_dma_alloc_consistent(struct ssb_device *dev, size_t size,
+                                       dma_addr_t *dma_handle, gfp_t gfp_flags);
+extern void ssb_dma_free_consistent(struct ssb_device *dev, size_t size,
+                                    void *vaddr, dma_addr_t dma_handle,
+                                    gfp_t gfp_flags);
+
+static inline void __cold __ssb_dma_not_implemented(struct ssb_device *dev)
+{
+#ifdef CONFIG_SSB_DEBUG
+        printk(KERN_ERR "SSB: BUG! Calling DMA API for "
+               "unsupported bustype %d\n", dev->bus->bustype);
+#endif /* DEBUG */
+}
+
+static inline int ssb_dma_mapping_error(struct ssb_device *dev, dma_addr_t addr)
+{
+        switch (dev->bus->bustype) {
+        case SSB_BUSTYPE_PCI:
+                return pci_dma_mapping_error(addr);
+        case SSB_BUSTYPE_SSB:
+                return dma_mapping_error(addr);
+        default:
+                __ssb_dma_not_implemented(dev);
+        }
+        return -ENOSYS;
+}
+
+static inline dma_addr_t ssb_dma_map_single(struct ssb_device *dev, void *p,
+                                            size_t size, enum dma_data_direction dir)
+{
+        switch (dev->bus->bustype) {
+        case SSB_BUSTYPE_PCI:
+                return pci_map_single(dev->bus->host_pci, p, size, dir);
+        case SSB_BUSTYPE_SSB:
+                return dma_map_single(dev->dev, p, size, dir);
+        default:
+                __ssb_dma_not_implemented(dev);
+        }
+        return 0;
+}
+
+static inline void ssb_dma_unmap_single(struct ssb_device *dev, dma_addr_t dma_addr,
+                                        size_t size, enum dma_data_direction dir)
+{
+        switch (dev->bus->bustype) {
+        case SSB_BUSTYPE_PCI:
+                pci_unmap_single(dev->bus->host_pci, dma_addr, size, dir);
+                return;
+        case SSB_BUSTYPE_SSB:
+                dma_unmap_single(dev->dev, dma_addr, size, dir);
+                return;
+        default:
+                __ssb_dma_not_implemented(dev);
+        }
+}
+
+static inline void ssb_dma_sync_single_for_cpu(struct ssb_device *dev,
+                                               dma_addr_t dma_addr,
+                                               size_t size,
+                                               enum dma_data_direction dir)
+{
+        switch (dev->bus->bustype) {
+        case SSB_BUSTYPE_PCI:
+                pci_dma_sync_single_for_cpu(dev->bus->host_pci, dma_addr,
+                                            size, dir);
+                return;
+        case SSB_BUSTYPE_SSB:
+                dma_sync_single_for_cpu(dev->dev, dma_addr, size, dir);
+                return;
+        default:
+                __ssb_dma_not_implemented(dev);
+        }
+}
+
+static inline void ssb_dma_sync_single_for_device(struct ssb_device *dev,
+                                                  dma_addr_t dma_addr,
+                                                  size_t size,
+                                                  enum dma_data_direction dir)
+{
+        switch (dev->bus->bustype) {
+        case SSB_BUSTYPE_PCI:
+                pci_dma_sync_single_for_device(dev->bus->host_pci, dma_addr,
+                                               size, dir);
+                return;
+        case SSB_BUSTYPE_SSB:
+                dma_sync_single_for_device(dev->dev, dma_addr, size, dir);
+                return;
+        default:
+                __ssb_dma_not_implemented(dev);
+        }
+}
+
+static inline void ssb_dma_sync_single_range_for_cpu(struct ssb_device *dev,
+                                                     dma_addr_t dma_addr,
+                                                     unsigned long offset,
+                                                     size_t size,
+                                                     enum dma_data_direction dir)
+{
+        switch (dev->bus->bustype) {
+        case SSB_BUSTYPE_PCI:
+                /* Just sync everything. That's all the PCI API can do. */
+                pci_dma_sync_single_for_cpu(dev->bus->host_pci, dma_addr,
+                                            offset + size, dir);
+                return;
+        case SSB_BUSTYPE_SSB:
+                dma_sync_single_range_for_cpu(dev->dev, dma_addr, offset,
+                                              size, dir);
+                return;
+        default:
+                __ssb_dma_not_implemented(dev);
+        }
+}
+
+static inline void ssb_dma_sync_single_range_for_device(struct ssb_device *dev,
+                                                        dma_addr_t dma_addr,
+                                                        unsigned long offset,
+                                                        size_t size,
+                                                        enum dma_data_direction dir)
+{
+        switch (dev->bus->bustype) {
+        case SSB_BUSTYPE_PCI:
+                /* Just sync everything. That's all the PCI API can do. */
+                pci_dma_sync_single_for_device(dev->bus->host_pci, dma_addr,
+                                               offset + size, dir);
+                return;
+        case SSB_BUSTYPE_SSB:
+                dma_sync_single_range_for_device(dev->dev, dma_addr, offset,
+                                                 size, dir);
+                return;
+        default:
+                __ssb_dma_not_implemented(dev);
+        }
+}
 
 
 #ifdef CONFIG_SSB_PCIHOST
diff --git a/include/linux/wireless.h b/include/linux/wireless.h
index 4a95a0e5eeca..d7958f9b52cb 100644
--- a/include/linux/wireless.h
+++ b/include/linux/wireless.h
@@ -677,6 +677,19 @@ struct	iw_point
   __u16         flags;          /* Optional params */
 };
 
+#ifdef __KERNEL__
+#ifdef CONFIG_COMPAT
+
+#include <linux/compat.h>
+
+struct compat_iw_point {
+        compat_caddr_t pointer;
+        __u16 length;
+        __u16 flags;
+};
+#endif
+#endif
+
 /*
  *      A frequency
  *      For numbers lower than 10^9, we encode the number in 'm' and
@@ -1100,6 +1113,21 @@ struct iw_event
 #define IW_EV_POINT_LEN (IW_EV_LCP_LEN + sizeof(struct iw_point) - \
                          IW_EV_POINT_OFF)
 
+#ifdef __KERNEL__
+#ifdef CONFIG_COMPAT
+struct __compat_iw_event {
+        __u16           len;                    /* Real length of this stuff */
+        __u16           cmd;                    /* Wireless IOCTL */
+        compat_caddr_t  pointer;
+};
+#define IW_EV_COMPAT_LCP_LEN offsetof(struct __compat_iw_event, pointer)
+#define IW_EV_COMPAT_POINT_OFF offsetof(struct compat_iw_point, length)
+#define IW_EV_COMPAT_POINT_LEN  \
+        (IW_EV_COMPAT_LCP_LEN + sizeof(struct compat_iw_point) - \
+         IW_EV_COMPAT_POINT_OFF)
+#endif
+#endif
+
 /* Size of the Event prefix when packed in stream */
 #define IW_EV_LCP_PK_LEN        (4)
 /* Size of the various events when packed in stream */
diff --git a/include/net/iw_handler.h b/include/net/iw_handler.h
index 369d50e08b99..51b9a37de991 100644
--- a/include/net/iw_handler.h
+++ b/include/net/iw_handler.h
@@ -256,7 +256,7 @@
 #define EIWCOMMIT       EINPROGRESS
 
 /* Flags available in struct iw_request_info */
-#define IW_REQUEST_FLAG_NONE    0x0000  /* No flag so far */
+#define IW_REQUEST_FLAG_COMPAT  0x0001  /* Compat ioctl call */
 
 /* Type of headers we know about (basically union iwreq_data) */
 #define IW_HEADER_TYPE_NULL     0       /* Not available */
@@ -478,105 +478,58 @@ extern void wireless_spy_update(struct net_device *	dev,
  * Function that are so simple that it's more efficient inlining them
  */
 
-/*------------------------------------------------------------------*/
-/*
- * Wrapper to add an Wireless Event to a stream of events.
- */
-static inline char *
-iwe_stream_add_event(char *     stream,         /* Stream of events */
-                     char *     ends,           /* End of stream */
-                     struct iw_event *iwe,      /* Payload */
-                     int        event_len)      /* Real size of payload */
+static inline int iwe_stream_lcp_len(struct iw_request_info *info)
 {
-        /* Check if it's possible */
-        if(likely((stream + event_len) < ends)) {
-                iwe->len = event_len;
-                /* Beware of alignement issues on 64 bits */
-                memcpy(stream, (char *) iwe, IW_EV_LCP_PK_LEN);
-                memcpy(stream + IW_EV_LCP_LEN,
-                       ((char *) iwe) + IW_EV_LCP_LEN,
-                       event_len - IW_EV_LCP_LEN);
-                stream += event_len;
-        }
-        return stream;
+#ifdef CONFIG_COMPAT
+        if (info->flags & IW_REQUEST_FLAG_COMPAT)
+                return IW_EV_COMPAT_LCP_LEN;
+#endif
+        return IW_EV_LCP_LEN;
 }
 
-/*------------------------------------------------------------------*/
-/*
- * Wrapper to add an short Wireless Event containing a pointer to a
- * stream of events.
- */
-static inline char *
-iwe_stream_add_point(char *     stream,         /* Stream of events */
-                     char *     ends,           /* End of stream */
-                     struct iw_event *iwe,      /* Payload length + flags */
-                     char *     extra)          /* More payload */
+static inline int iwe_stream_point_len(struct iw_request_info *info)
 {
-        int     event_len = IW_EV_POINT_LEN + iwe->u.data.length;
-        /* Check if it's possible */
-        if(likely((stream + event_len) < ends)) {
-                iwe->len = event_len;
-                memcpy(stream, (char *) iwe, IW_EV_LCP_PK_LEN);
-                memcpy(stream + IW_EV_LCP_LEN,
-                       ((char *) iwe) + IW_EV_LCP_LEN + IW_EV_POINT_OFF,
-                       IW_EV_POINT_PK_LEN - IW_EV_LCP_PK_LEN);
-                memcpy(stream + IW_EV_POINT_LEN, extra, iwe->u.data.length);
-                stream += event_len;
-        }
-        return stream;
+#ifdef CONFIG_COMPAT
+        if (info->flags & IW_REQUEST_FLAG_COMPAT)
+                return IW_EV_COMPAT_POINT_LEN;
+#endif
+        return IW_EV_POINT_LEN;
 }
 
-/*------------------------------------------------------------------*/
-/*
- * Wrapper to add a value to a Wireless Event in a stream of events.
- * Be careful, this one is tricky to use properly :
- * At the first run, you need to have (value = event + IW_EV_LCP_LEN).
- */
-static inline char *
-iwe_stream_add_value(char *     event,          /* Event in the stream */
-                     char *     value,          /* Value in event */
-                     char *     ends,           /* End of stream */
-                     struct iw_event *iwe,      /* Payload */
-                     int        event_len)      /* Real size of payload */
+static inline int iwe_stream_event_len_adjust(struct iw_request_info *info,
+                                              int event_len)
 {
-        /* Don't duplicate LCP */
-        event_len -= IW_EV_LCP_LEN;
-
-        /* Check if it's possible */
-        if(likely((value + event_len) < ends)) {
-                /* Add new value */
-                memcpy(value, (char *) iwe + IW_EV_LCP_LEN, event_len);
-                value += event_len;
-                /* Patch LCP */
-                iwe->len = value - event;
-                memcpy(event, (char *) iwe, IW_EV_LCP_LEN);
+#ifdef CONFIG_COMPAT
+        if (info->flags & IW_REQUEST_FLAG_COMPAT) {
+                event_len -= IW_EV_LCP_LEN;
+                event_len += IW_EV_COMPAT_LCP_LEN;
         }
-        return value;
+#endif
+
+        return event_len;
 }
 
 /*------------------------------------------------------------------*/
 /*
  * Wrapper to add an Wireless Event to a stream of events.
- * Same as above, with explicit error check...
  */
 static inline char *
-iwe_stream_check_add_event(char *       stream,         /* Stream of events */
-                           char *       ends,           /* End of stream */
-                           struct iw_event *iwe,        /* Payload */
-                           int          event_len,      /* Size of payload */
-                           int *        perr)           /* Error report */
+iwe_stream_add_event(struct iw_request_info *info, char *stream, char *ends,
+                     struct iw_event *iwe, int event_len)
 {
-        /* Check if it's possible, set error if not */
+        int lcp_len = iwe_stream_lcp_len(info);
+
+        event_len = iwe_stream_event_len_adjust(info, event_len);
+
+        /* Check if it's possible */
         if(likely((stream + event_len) < ends)) {
                 iwe->len = event_len;
                 /* Beware of alignement issues on 64 bits */
                 memcpy(stream, (char *) iwe, IW_EV_LCP_PK_LEN);
-                memcpy(stream + IW_EV_LCP_LEN,
-                       ((char *) iwe) + IW_EV_LCP_LEN,
-                       event_len - IW_EV_LCP_LEN);
+                memcpy(stream + lcp_len, &iwe->u,
+                       event_len - lcp_len);
                 stream += event_len;
-        } else
-                *perr = -E2BIG;
+        }
         return stream;
 }
 
@@ -584,27 +537,25 @@ iwe_stream_check_add_event(char *	stream,		/* Stream of events */
 /*
  * Wrapper to add an short Wireless Event containing a pointer to a
  * stream of events.
- * Same as above, with explicit error check...
  */
 static inline char *
-iwe_stream_check_add_point(char *       stream,         /* Stream of events */
-                           char *       ends,           /* End of stream */
-                           struct iw_event *iwe,        /* Payload length + flags */
-                           char *       extra,          /* More payload */
-                           int *        perr)           /* Error report */
+iwe_stream_add_point(struct iw_request_info *info, char *stream, char *ends,
+                     struct iw_event *iwe, char *extra)
 {
-        int     event_len = IW_EV_POINT_LEN + iwe->u.data.length;
+        int event_len = iwe_stream_point_len(info) + iwe->u.data.length;
+        int point_len = iwe_stream_point_len(info);
+        int lcp_len   = iwe_stream_lcp_len(info);
+
         /* Check if it's possible */
         if(likely((stream + event_len) < ends)) {
                 iwe->len = event_len;
                 memcpy(stream, (char *) iwe, IW_EV_LCP_PK_LEN);
-                memcpy(stream + IW_EV_LCP_LEN,
-                       ((char *) iwe) + IW_EV_LCP_LEN + IW_EV_POINT_OFF,
+                memcpy(stream + lcp_len,
+                       ((char *) &iwe->u) + IW_EV_POINT_OFF,
                        IW_EV_POINT_PK_LEN - IW_EV_LCP_PK_LEN);
-                memcpy(stream + IW_EV_POINT_LEN, extra, iwe->u.data.length);
+                memcpy(stream + point_len, extra, iwe->u.data.length);
                 stream += event_len;
-        } else
-                *perr = -E2BIG;
+        }
         return stream;
 }
 
@@ -613,29 +564,25 @@ iwe_stream_check_add_point(char *	stream,		/* Stream of events */
  * Wrapper to add a value to a Wireless Event in a stream of events.
  * Be careful, this one is tricky to use properly :
  * At the first run, you need to have (value = event + IW_EV_LCP_LEN).
- * Same as above, with explicit error check...
  */
 static inline char *
-iwe_stream_check_add_value(char *       event,          /* Event in the stream */
-                           char *       value,          /* Value in event */
-                           char *       ends,           /* End of stream */
-                           struct iw_event *iwe,        /* Payload */
-                           int          event_len,      /* Size of payload */
-                           int *        perr)           /* Error report */
+iwe_stream_add_value(struct iw_request_info *info, char *event, char *value,
+                     char *ends, struct iw_event *iwe, int event_len)
 {
+        int lcp_len = iwe_stream_lcp_len(info);
+
         /* Don't duplicate LCP */
         event_len -= IW_EV_LCP_LEN;
 
         /* Check if it's possible */
         if(likely((value + event_len) < ends)) {
                 /* Add new value */
-                memcpy(value, (char *) iwe + IW_EV_LCP_LEN, event_len);
+                memcpy(value, &iwe->u, event_len);
                 value += event_len;
                 /* Patch LCP */
                 iwe->len = value - event;
-                memcpy(event, (char *) iwe, IW_EV_LCP_LEN);
-        } else
-                *perr = -E2BIG;
+                memcpy(event, (char *) iwe, lcp_len);
+        }
         return value;
 }
 
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index 7ab4ff6159a2..02c79e6b309e 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -595,7 +595,12 @@ enum ieee80211_key_flags {
  * @flags: key flags, see &enum ieee80211_key_flags.
  * @keyidx: the key index (0-3)
  * @keylen: key material length
- * @key: key material
+ * @key: key material. For ALG_TKIP the key is encoded as a 256-bit (32 byte)
+ *      data block:
+ *      - Temporal Encryption Key (128 bits)
+ *      - Temporal Authenticator Tx MIC Key (64 bits)
+ *      - Temporal Authenticator Rx MIC Key (64 bits)
+ *
  */
 struct ieee80211_key_conf {
         enum ieee80211_key_alg alg;
@@ -733,8 +738,11 @@ enum ieee80211_hw_flags {
  * @conf: &struct ieee80211_conf, device configuration, don't use.
  *
  * @workqueue: single threaded workqueue available for driver use,
- *      allocated by mac80211 on registration and flushed on
- *      unregistration.
+ *      allocated by mac80211 on registration and flushed when an
+ *      interface is removed.
+ *      NOTICE: All work performed on this workqueue should NEVER
+ *      acquire the RTNL lock (i.e. Don't use the function
+ *      ieee80211_iterate_active_interfaces())
  *
  * @priv: pointer to private area that was allocated for driver use
  *      along with this structure.
diff --git a/include/net/wext.h b/include/net/wext.h
index 80b31d826b7a..6d76a39a9c5b 100644
--- a/include/net/wext.h
+++ b/include/net/wext.h
@@ -12,6 +12,8 @@ extern int wext_proc_init(struct net *net);
 extern void wext_proc_exit(struct net *net);
 extern int wext_handle_ioctl(struct net *net, struct ifreq *ifr, unsigned int cmd,
                              void __user *arg);
+extern int compat_wext_handle_ioctl(struct net *net, unsigned int cmd,
+                                    unsigned long arg);
 #else
 static inline int wext_proc_init(struct net *net)
 {
@@ -26,6 +28,11 @@ static inline int wext_handle_ioctl(struct net *net, struct ifreq *ifr, unsigned
 {
         return -EINVAL;
 }
+static inline int compat_wext_handle_ioctl(struct net *net, unsigned int cmd,
+                                           unsigned long arg)
+{
+        return -EINVAL;
+}
 #endif
 
 #endif /* __NET_WEXT_H */