Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/linville/wireless-next-2.6

13 files changed, 410 insertions, 243 deletions

diff --git a/net/mac80211/Kconfig b/net/mac80211/Kconfig
index 590e00b2766c..0d3661d9b6a0 100644
--- a/net/mac80211/Kconfig
+++ b/net/mac80211/Kconfig
@@ -150,7 +150,7 @@ config MAC80211_LOWTX_FRAME_DUMP
           If unsure, say N and insert the debugging code
           you require into the driver you are debugging.
 
-config TKIP_DEBUG
+config MAC80211_TKIP_DEBUG
         bool "TKIP debugging"
         depends on MAC80211_DEBUG
 
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 14fccf16b80f..af352c05c983 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -24,6 +24,7 @@
 #include <linux/spinlock.h>
 #include <linux/etherdevice.h>
 #include <net/wireless.h>
+#include <net/iw_handler.h>
 #include "key.h"
 #include "sta_info.h"
 
@@ -790,6 +791,10 @@ struct ieee802_11_elems {
         u8 *preq;
         u8 *prep;
         u8 *perr;
+        u8 *ch_switch_elem;
+        u8 *country_elem;
+        u8 *pwr_constr_elem;
+        u8 *quiet_elem;         /* first quite element */
 
         /* length of them, respectively */
         u8 ssid_len;
@@ -814,6 +819,11 @@ struct ieee802_11_elems {
         u8 preq_len;
         u8 prep_len;
         u8 perr_len;
+        u8 ch_switch_elem_len;
+        u8 country_elem_len;
+        u8 pwr_constr_elem_len;
+        u8 quiet_elem_len;
+        u8 num_of_quiet_elem;   /* can be more the one */
 };
 
 static inline struct ieee80211_local *hw_to_local(
@@ -867,7 +877,9 @@ int ieee80211_sta_set_bssid(struct net_device *dev, u8 *bssid);
 int ieee80211_sta_req_scan(struct net_device *dev, u8 *ssid, size_t ssid_len);
 void ieee80211_sta_req_auth(struct net_device *dev,
                             struct ieee80211_if_sta *ifsta);
-int ieee80211_sta_scan_results(struct net_device *dev, char *buf, size_t len);
+int ieee80211_sta_scan_results(struct net_device *dev,
+                               struct iw_request_info *info,
+                               char *buf, size_t len);
 ieee80211_rx_result ieee80211_sta_rx_scan(
         struct net_device *dev, struct sk_buff *skb,
         struct ieee80211_rx_status *rx_status);
diff --git a/net/mac80211/key.h b/net/mac80211/key.h
index a0f774aafa45..425816e0996c 100644
--- a/net/mac80211/key.h
+++ b/net/mac80211/key.h
@@ -16,31 +16,18 @@
 #include <linux/rcupdate.h>
 #include <net/mac80211.h>
 
-/* ALG_TKIP
- * struct ieee80211_key::key is encoded as a 256-bit (32 byte) data block:
- * Temporal Encryption Key (128 bits)
- * Temporal Authenticator Tx MIC Key (64 bits)
- * Temporal Authenticator Rx MIC Key (64 bits)
- */
-
-#define WEP_IV_LEN 4
-#define WEP_ICV_LEN 4
-
-#define ALG_TKIP_KEY_LEN 32
-/* Starting offsets for each key */
-#define ALG_TKIP_TEMP_ENCR_KEY 0
-#define ALG_TKIP_TEMP_AUTH_TX_MIC_KEY 16
-#define ALG_TKIP_TEMP_AUTH_RX_MIC_KEY 24
-#define TKIP_IV_LEN 8
-#define TKIP_ICV_LEN 4
-
-#define ALG_CCMP_KEY_LEN 16
-#define CCMP_HDR_LEN 8
-#define CCMP_MIC_LEN 8
-#define CCMP_TK_LEN 16
-#define CCMP_PN_LEN 6
-
-#define NUM_RX_DATA_QUEUES 17
+#define WEP_IV_LEN              4
+#define WEP_ICV_LEN             4
+#define ALG_TKIP_KEY_LEN        32
+#define ALG_CCMP_KEY_LEN        16
+#define CCMP_HDR_LEN            8
+#define CCMP_MIC_LEN            8
+#define CCMP_TK_LEN             16
+#define CCMP_PN_LEN             6
+#define TKIP_IV_LEN             8
+#define TKIP_ICV_LEN            4
+
+#define NUM_RX_DATA_QUEUES      17
 
 struct ieee80211_local;
 struct ieee80211_sub_if_data;
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 5c5396edad32..b661ee5bb824 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -1691,7 +1691,7 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
         list_add_tail(&sdata->list, &local->interfaces);
 
         name = wiphy_dev(local->hw.wiphy)->driver->name;
-        local->hw.workqueue = create_singlethread_workqueue(name);
+        local->hw.workqueue = create_freezeable_workqueue(name);
         if (!local->hw.workqueue) {
                 result = -ENOMEM;
                 goto fail_workqueue;
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 55659a730dc1..7b4d4d46843b 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -204,6 +204,25 @@ void ieee802_11_parse_elems(u8 *start, size_t len,
                         elems->perr = pos;
                         elems->perr_len = elen;
                         break;
+                case WLAN_EID_CHANNEL_SWITCH:
+                        elems->ch_switch_elem = pos;
+                        elems->ch_switch_elem_len = elen;
+                        break;
+                case WLAN_EID_QUIET:
+                        if (!elems->quiet_elem) {
+                                elems->quiet_elem = pos;
+                                elems->quiet_elem_len = elen;
+                        }
+                        elems->num_of_quiet_elem++;
+                        break;
+                case WLAN_EID_COUNTRY:
+                        elems->country_elem = pos;
+                        elems->country_elem_len = elen;
+                        break;
+                case WLAN_EID_PWR_CONSTRAINT:
+                        elems->pwr_constr_elem = pos;
+                        elems->pwr_constr_elem_len = elen;
+                        break;
                 default:
                         break;
                 }
@@ -1701,6 +1720,71 @@ void ieee80211_sta_tear_down_BA_sessions(struct net_device *dev, u8 *addr)
         }
 }
 
+static void ieee80211_send_refuse_measurement_request(struct net_device *dev,
+                                        struct ieee80211_msrment_ie *request_ie,
+                                        const u8 *da, const u8 *bssid,
+                                        u8 dialog_token)
+{
+        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+        struct sk_buff *skb;
+        struct ieee80211_mgmt *msr_report;
+
+        skb = dev_alloc_skb(sizeof(*msr_report) + local->hw.extra_tx_headroom +
+                                sizeof(struct ieee80211_msrment_ie));
+
+        if (!skb) {
+                printk(KERN_ERR "%s: failed to allocate buffer for "
+                                "measurement report frame\n", dev->name);
+                return;
+        }
+
+        skb_reserve(skb, local->hw.extra_tx_headroom);
+        msr_report = (struct ieee80211_mgmt *)skb_put(skb, 24);
+        memset(msr_report, 0, 24);
+        memcpy(msr_report->da, da, ETH_ALEN);
+        memcpy(msr_report->sa, dev->dev_addr, ETH_ALEN);
+        memcpy(msr_report->bssid, bssid, ETH_ALEN);
+        msr_report->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
+                                                IEEE80211_STYPE_ACTION);
+
+        skb_put(skb, 1 + sizeof(msr_report->u.action.u.measurement));
+        msr_report->u.action.category = WLAN_CATEGORY_SPECTRUM_MGMT;
+        msr_report->u.action.u.measurement.action_code =
+                                WLAN_ACTION_SPCT_MSR_RPRT;
+        msr_report->u.action.u.measurement.dialog_token = dialog_token;
+
+        msr_report->u.action.u.measurement.element_id = WLAN_EID_MEASURE_REPORT;
+        msr_report->u.action.u.measurement.length =
+                        sizeof(struct ieee80211_msrment_ie);
+
+        memset(&msr_report->u.action.u.measurement.msr_elem, 0,
+                sizeof(struct ieee80211_msrment_ie));
+        msr_report->u.action.u.measurement.msr_elem.token = request_ie->token;
+        msr_report->u.action.u.measurement.msr_elem.mode |=
+                        IEEE80211_SPCT_MSR_RPRT_MODE_REFUSED;
+        msr_report->u.action.u.measurement.msr_elem.type = request_ie->type;
+
+        ieee80211_sta_tx(dev, skb, 0);
+}
+
+static void ieee80211_sta_process_measurement_req(struct net_device *dev,
+                                                struct ieee80211_mgmt *mgmt,
+                                                size_t len)
+{
+        /*
+         * Ignoring measurement request is spec violation.
+         * Mandatory measurements must be reported optional
+         * measurements might be refused or reported incapable
+         * For now just refuse
+         * TODO: Answer basic measurement as unmeasured
+         */
+        ieee80211_send_refuse_measurement_request(dev,
+                        &mgmt->u.action.u.measurement.msr_elem,
+                        mgmt->sa, mgmt->bssid,
+                        mgmt->u.action.u.measurement.dialog_token);
+}
+
+
 static void ieee80211_rx_mgmt_auth(struct net_device *dev,
                                    struct ieee80211_if_sta *ifsta,
                                    struct ieee80211_mgmt *mgmt,
@@ -1753,11 +1837,12 @@ static void ieee80211_rx_mgmt_auth(struct net_device *dev,
                auth_transaction, status_code);
 
         if (sdata->vif.type == IEEE80211_IF_TYPE_IBSS) {
-                /* IEEE 802.11 standard does not require authentication in IBSS
+                /*
+                 * IEEE 802.11 standard does not require authentication in IBSS
                  * networks and most implementations do not seem to use it.
                  * However, try to reply to authentication attempts if someone
                  * has actually implemented this.
-                 * TODO: Could implement shared key authentication. */
+                 */
                 if (auth_alg != WLAN_AUTH_OPEN || auth_transaction != 1) {
                         printk(KERN_DEBUG "%s: unexpected IBSS authentication "
                                "frame (alg=%d transaction=%d)\n",
@@ -3025,11 +3110,24 @@ static void ieee80211_rx_mgmt_action(struct net_device *dev,
                                      struct ieee80211_rx_status *rx_status)
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
 
         if (len < IEEE80211_MIN_ACTION_SIZE)
                 return;
 
         switch (mgmt->u.action.category) {
+        case WLAN_CATEGORY_SPECTRUM_MGMT:
+                if (local->hw.conf.channel->band != IEEE80211_BAND_5GHZ)
+                        break;
+                switch (mgmt->u.action.u.chan_switch.action_code) {
+                case WLAN_ACTION_SPCT_MSR_REQ:
+                        if (len < (IEEE80211_MIN_ACTION_SIZE +
+                                   sizeof(mgmt->u.action.u.measurement)))
+                                break;
+                        ieee80211_sta_process_measurement_req(dev, mgmt, len);
+                        break;
+                }
+                break;
         case WLAN_CATEGORY_BACK:
                 switch (mgmt->u.action.u.addba_req.action_code) {
                 case WLAN_ACTION_ADDBA_REQ:
@@ -3173,33 +3271,32 @@ ieee80211_sta_rx_scan(struct net_device *dev, struct sk_buff *skb,
                       struct ieee80211_rx_status *rx_status)
 {
         struct ieee80211_mgmt *mgmt;
-        u16 fc;
+        __le16 fc;
 
         if (skb->len < 2)
                 return RX_DROP_UNUSABLE;
 
         mgmt = (struct ieee80211_mgmt *) skb->data;
-        fc = le16_to_cpu(mgmt->frame_control);
+        fc = mgmt->frame_control;
 
-        if ((fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_CTL)
+        if (ieee80211_is_ctl(fc))
                 return RX_CONTINUE;
 
         if (skb->len < 24)
                 return RX_DROP_MONITOR;
 
-        if ((fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_MGMT) {
-                if ((fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_PROBE_RESP) {
-                        ieee80211_rx_mgmt_probe_resp(dev, mgmt,
-                                                     skb->len, rx_status);
-                        dev_kfree_skb(skb);
-                        return RX_QUEUED;
-                } else if ((fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_BEACON) {
-                        ieee80211_rx_mgmt_beacon(dev, mgmt, skb->len,
-                                                 rx_status);
-                        dev_kfree_skb(skb);
-                        return RX_QUEUED;
-                }
+        if (ieee80211_is_probe_resp(fc)) {
+                ieee80211_rx_mgmt_probe_resp(dev, mgmt, skb->len, rx_status);
+                dev_kfree_skb(skb);
+                return RX_QUEUED;
         }
+
+        if (ieee80211_is_beacon(fc)) {
+                ieee80211_rx_mgmt_beacon(dev, mgmt, skb->len, rx_status);
+                dev_kfree_skb(skb);
+                return RX_QUEUED;
+        }
+
         return RX_CONTINUE;
 }
 
@@ -3777,7 +3874,7 @@ static void ieee80211_send_nullfunc(struct ieee80211_local *local,
 {
         struct sk_buff *skb;
         struct ieee80211_hdr *nullfunc;
-        u16 fc;
+        __le16 fc;
 
         skb = dev_alloc_skb(local->hw.extra_tx_headroom + 24);
         if (!skb) {
@@ -3789,11 +3886,11 @@ static void ieee80211_send_nullfunc(struct ieee80211_local *local,
 
         nullfunc = (struct ieee80211_hdr *) skb_put(skb, 24);
         memset(nullfunc, 0, 24);
-        fc = IEEE80211_FTYPE_DATA | IEEE80211_STYPE_NULLFUNC |
-             IEEE80211_FCTL_TODS;
+        fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_NULLFUNC |
+                         IEEE80211_FCTL_TODS);
         if (powersave)
-                fc |= IEEE80211_FCTL_PM;
-        nullfunc->frame_control = cpu_to_le16(fc);
+                fc |= cpu_to_le16(IEEE80211_FCTL_PM);
+        nullfunc->frame_control = fc;
         memcpy(nullfunc->addr1, sdata->u.sta.bssid, ETH_ALEN);
         memcpy(nullfunc->addr2, sdata->dev->dev_addr, ETH_ALEN);
         memcpy(nullfunc->addr3, sdata->u.sta.bssid, ETH_ALEN);
@@ -4087,6 +4184,7 @@ int ieee80211_sta_req_scan(struct net_device *dev, u8 *ssid, size_t ssid_len)
 
 static char *
 ieee80211_sta_scan_result(struct net_device *dev,
+                          struct iw_request_info *info,
                           struct ieee80211_sta_bss *bss,
                           char *current_ev, char *end_buf)
 {
@@ -4101,7 +4199,7 @@ ieee80211_sta_scan_result(struct net_device *dev,
         iwe.cmd = SIOCGIWAP;
         iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
         memcpy(iwe.u.ap_addr.sa_data, bss->bssid, ETH_ALEN);
-        current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe,
+        current_ev = iwe_stream_add_event(info, current_ev, end_buf, &iwe,
                                           IW_EV_ADDR_LEN);
 
         memset(&iwe, 0, sizeof(iwe));
@@ -4109,13 +4207,13 @@ ieee80211_sta_scan_result(struct net_device *dev,
         if (bss_mesh_cfg(bss)) {
                 iwe.u.data.length = bss_mesh_id_len(bss);
                 iwe.u.data.flags = 1;
-                current_ev = iwe_stream_add_point(current_ev, end_buf, &iwe,
-                                                  bss_mesh_id(bss));
+                current_ev = iwe_stream_add_point(info, current_ev, end_buf,
+                                                  &iwe, bss_mesh_id(bss));
         } else {
                 iwe.u.data.length = bss->ssid_len;
                 iwe.u.data.flags = 1;
-                current_ev = iwe_stream_add_point(current_ev, end_buf, &iwe,
-                                                  bss->ssid);
+                current_ev = iwe_stream_add_point(info, current_ev, end_buf,
+                                                  &iwe, bss->ssid);
         }
 
         if (bss->capability & (WLAN_CAPABILITY_ESS | WLAN_CAPABILITY_IBSS)
@@ -4128,22 +4226,22 @@ ieee80211_sta_scan_result(struct net_device *dev,
                         iwe.u.mode = IW_MODE_MASTER;
                 else
                         iwe.u.mode = IW_MODE_ADHOC;
-                current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe,
-                                                  IW_EV_UINT_LEN);
+                current_ev = iwe_stream_add_event(info, current_ev, end_buf,
+                                                  &iwe, IW_EV_UINT_LEN);
         }
 
         memset(&iwe, 0, sizeof(iwe));
         iwe.cmd = SIOCGIWFREQ;
         iwe.u.freq.m = ieee80211_frequency_to_channel(bss->freq);
         iwe.u.freq.e = 0;
-        current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe,
+        current_ev = iwe_stream_add_event(info, current_ev, end_buf, &iwe,
                                           IW_EV_FREQ_LEN);
 
         memset(&iwe, 0, sizeof(iwe));
         iwe.cmd = SIOCGIWFREQ;
         iwe.u.freq.m = bss->freq;
         iwe.u.freq.e = 6;
-        current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe,
+        current_ev = iwe_stream_add_event(info, current_ev, end_buf, &iwe,
                                           IW_EV_FREQ_LEN);
         memset(&iwe, 0, sizeof(iwe));
         iwe.cmd = IWEVQUAL;
@@ -4151,7 +4249,7 @@ ieee80211_sta_scan_result(struct net_device *dev,
         iwe.u.qual.level = bss->signal;
         iwe.u.qual.noise = bss->noise;
         iwe.u.qual.updated = local->wstats_flags;
-        current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe,
+        current_ev = iwe_stream_add_event(info, current_ev, end_buf, &iwe,
                                           IW_EV_QUAL_LEN);
 
         memset(&iwe, 0, sizeof(iwe));
@@ -4161,35 +4259,36 @@ ieee80211_sta_scan_result(struct net_device *dev,
         else
                 iwe.u.data.flags = IW_ENCODE_DISABLED;
         iwe.u.data.length = 0;
-        current_ev = iwe_stream_add_point(current_ev, end_buf, &iwe, "");
+        current_ev = iwe_stream_add_point(info, current_ev, end_buf,
+                                          &iwe, "");
 
         if (bss && bss->wpa_ie) {
                 memset(&iwe, 0, sizeof(iwe));
                 iwe.cmd = IWEVGENIE;
                 iwe.u.data.length = bss->wpa_ie_len;
-                current_ev = iwe_stream_add_point(current_ev, end_buf, &iwe,
-                                                  bss->wpa_ie);
+                current_ev = iwe_stream_add_point(info, current_ev, end_buf,
+                                                  &iwe, bss->wpa_ie);
         }
 
         if (bss && bss->rsn_ie) {
                 memset(&iwe, 0, sizeof(iwe));
                 iwe.cmd = IWEVGENIE;
                 iwe.u.data.length = bss->rsn_ie_len;
-                current_ev = iwe_stream_add_point(current_ev, end_buf, &iwe,
-                                                  bss->rsn_ie);
+                current_ev = iwe_stream_add_point(info, current_ev, end_buf,
+                                                  &iwe, bss->rsn_ie);
         }
 
         if (bss && bss->ht_ie) {
                 memset(&iwe, 0, sizeof(iwe));
                 iwe.cmd = IWEVGENIE;
                 iwe.u.data.length = bss->ht_ie_len;
-                current_ev = iwe_stream_add_point(current_ev, end_buf, &iwe,
-                                                  bss->ht_ie);
+                current_ev = iwe_stream_add_point(info, current_ev, end_buf,
+                                                  &iwe, bss->ht_ie);
         }
 
         if (bss && bss->supp_rates_len > 0) {
                 /* display all supported rates in readable format */
-                char *p = current_ev + IW_EV_LCP_LEN;
+                char *p = current_ev + iwe_stream_lcp_len(info);
                 int i;
 
                 memset(&iwe, 0, sizeof(iwe));
@@ -4200,7 +4299,7 @@ ieee80211_sta_scan_result(struct net_device *dev,
                 for (i = 0; i < bss->supp_rates_len; i++) {
                         iwe.u.bitrate.value = ((bss->supp_rates[i] &
                                                         0x7f) * 500000);
-                        p = iwe_stream_add_value(current_ev, p,
+                        p = iwe_stream_add_value(info, current_ev, p,
                                         end_buf, &iwe, IW_EV_PARAM_LEN);
                 }
                 current_ev = p;
@@ -4214,7 +4313,8 @@ ieee80211_sta_scan_result(struct net_device *dev,
                         iwe.cmd = IWEVCUSTOM;
                         sprintf(buf, "tsf=%016llx", (unsigned long long)(bss->timestamp));
                         iwe.u.data.length = strlen(buf);
-                        current_ev = iwe_stream_add_point(current_ev, end_buf,
+                        current_ev = iwe_stream_add_point(info, current_ev,
+                                                          end_buf,
                                                           &iwe, buf);
                         kfree(buf);
                 }
@@ -4229,31 +4329,36 @@ ieee80211_sta_scan_result(struct net_device *dev,
                         iwe.cmd = IWEVCUSTOM;
                         sprintf(buf, "Mesh network (version %d)", cfg[0]);
                         iwe.u.data.length = strlen(buf);
-                        current_ev = iwe_stream_add_point(current_ev, end_buf,
+                        current_ev = iwe_stream_add_point(info, current_ev,
+                                                          end_buf,
                                                           &iwe, buf);
                         sprintf(buf, "Path Selection Protocol ID: "
                                 "0x%02X%02X%02X%02X", cfg[1], cfg[2], cfg[3],
                                                         cfg[4]);
                         iwe.u.data.length = strlen(buf);
-                        current_ev = iwe_stream_add_point(current_ev, end_buf,
+                        current_ev = iwe_stream_add_point(info, current_ev,
+                                                          end_buf,
                                                           &iwe, buf);
                         sprintf(buf, "Path Selection Metric ID: "
                                 "0x%02X%02X%02X%02X", cfg[5], cfg[6], cfg[7],
                                                         cfg[8]);
                         iwe.u.data.length = strlen(buf);
-                        current_ev = iwe_stream_add_point(current_ev, end_buf,
+                        current_ev = iwe_stream_add_point(info, current_ev,
+                                                          end_buf,
                                                           &iwe, buf);
                         sprintf(buf, "Congestion Control Mode ID: "
                                 "0x%02X%02X%02X%02X", cfg[9], cfg[10],
                                                         cfg[11], cfg[12]);
                         iwe.u.data.length = strlen(buf);
-                        current_ev = iwe_stream_add_point(current_ev, end_buf,
+                        current_ev = iwe_stream_add_point(info, current_ev,
+                                                          end_buf,
                                                           &iwe, buf);
                         sprintf(buf, "Channel Precedence: "
                                 "0x%02X%02X%02X%02X", cfg[13], cfg[14],
                                                         cfg[15], cfg[16]);
                         iwe.u.data.length = strlen(buf);
-                        current_ev = iwe_stream_add_point(current_ev, end_buf,
+                        current_ev = iwe_stream_add_point(info, current_ev,
+                                                          end_buf,
                                                           &iwe, buf);
                         kfree(buf);
                 }
@@ -4263,7 +4368,9 @@ ieee80211_sta_scan_result(struct net_device *dev,
 }
 
 
-int ieee80211_sta_scan_results(struct net_device *dev, char *buf, size_t len)
+int ieee80211_sta_scan_results(struct net_device *dev,
+                               struct iw_request_info *info,
+                               char *buf, size_t len)
 {
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
         char *current_ev = buf;
@@ -4276,8 +4383,8 @@ int ieee80211_sta_scan_results(struct net_device *dev, char *buf, size_t len)
                         spin_unlock_bh(&local->sta_bss_lock);
                         return -E2BIG;
                 }
-                current_ev = ieee80211_sta_scan_result(dev, bss, current_ev,
-                                                       end_buf);
+                current_ev = ieee80211_sta_scan_result(dev, info, bss,
+                                                       current_ev, end_buf);
         }
         spin_unlock_bh(&local->sta_bss_lock);
         return current_ev - buf;
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index c32a0bcd53b7..8962d1355f04 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -61,7 +61,7 @@ static inline int should_drop_frame(struct ieee80211_rx_status *status,
                                     int present_fcs_len,
                                     int radiotap_len)
 {
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
 
         if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
                 return 1;
@@ -2123,7 +2123,7 @@ static u8 ieee80211_rx_reorder_ampdu(struct ieee80211_local *local,
         struct tid_ampdu_rx *tid_agg_rx;
         u16 sc;
         u16 mpdu_seq_num;
-        u8 ret = 0, *qc;
+        u8 ret = 0;
         int tid;
 
         sta = sta_info_get(local, hdr->addr2);
@@ -2135,8 +2135,7 @@ static u8 ieee80211_rx_reorder_ampdu(struct ieee80211_local *local,
         if (!ieee80211_is_data_qos(hdr->frame_control))
                 goto end_reorder;
 
-        qc = ieee80211_get_qos_ctl(hdr);
-        tid = qc[0] & QOS_CONTROL_TID_MASK;
+        tid = *ieee80211_get_qos_ctl(hdr) & QOS_CONTROL_TID_MASK;
 
         if (sta->ampdu_mlme.tid_state_rx[tid] != HT_AGG_STATE_OPERATIONAL)
                 goto end_reorder;
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index c24770cb02c5..b3c733162fc1 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -235,6 +235,7 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
                 return NULL;
 
         spin_lock_init(&sta->lock);
+        spin_lock_init(&sta->flaglock);
 
         memcpy(sta->addr, addr, ETH_ALEN);
         sta->local = local;
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index 95753f860acf..fd228c198e31 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -164,6 +164,7 @@ struct sta_ampdu_mlme {
  * @aid: STA's unique AID (1..2007, 0 = not assigned yet),
  *      only used in AP (and IBSS?) mode
  * @flags: STA flags, see &enum ieee80211_sta_info_flags
+ * @flaglock: spinlock for flags accesses
  * @ps_tx_buf: buffer of frames to transmit to this station
  *      when it leaves power saving state
  * @tx_filtered: buffer of frames we already tried to transmit
@@ -186,6 +187,7 @@ struct sta_info {
         struct rate_control_ref *rate_ctrl;
         void *rate_ctrl_priv;
         spinlock_t lock;
+        spinlock_t flaglock;
         struct ieee80211_ht_info ht_info;
         u64 supp_rates[IEEE80211_NUM_BANDS];
         u8 addr[ETH_ALEN];
@@ -198,7 +200,10 @@ struct sta_info {
          */
         u8 pin_status;
 
-        /* frequently updated information, locked with lock spinlock */
+        /*
+         * frequently updated, locked with own spinlock (flaglock),
+         * use the accessors defined below
+         */
         u32 flags;
 
         /*
@@ -293,34 +298,41 @@ static inline enum plink_state sta_plink_state(struct sta_info *sta)
 
 static inline void set_sta_flags(struct sta_info *sta, const u32 flags)
 {
-        spin_lock_bh(&sta->lock);
+        unsigned long irqfl;
+
+        spin_lock_irqsave(&sta->flaglock, irqfl);
         sta->flags |= flags;
-        spin_unlock_bh(&sta->lock);
+        spin_unlock_irqrestore(&sta->flaglock, irqfl);
 }
 
 static inline void clear_sta_flags(struct sta_info *sta, const u32 flags)
 {
-        spin_lock_bh(&sta->lock);
+        unsigned long irqfl;
+
+        spin_lock_irqsave(&sta->flaglock, irqfl);
         sta->flags &= ~flags;
-        spin_unlock_bh(&sta->lock);
+        spin_unlock_irqrestore(&sta->flaglock, irqfl);
 }
 
 static inline void set_and_clear_sta_flags(struct sta_info *sta,
                                            const u32 set, const u32 clear)
 {
-        spin_lock_bh(&sta->lock);
+        unsigned long irqfl;
+
+        spin_lock_irqsave(&sta->flaglock, irqfl);
         sta->flags |= set;
         sta->flags &= ~clear;
-        spin_unlock_bh(&sta->lock);
+        spin_unlock_irqrestore(&sta->flaglock, irqfl);
 }
 
 static inline u32 test_sta_flags(struct sta_info *sta, const u32 flags)
 {
         u32 ret;
+        unsigned long irqfl;
 
-        spin_lock_bh(&sta->lock);
+        spin_lock_irqsave(&sta->flaglock, irqfl);
         ret = sta->flags & flags;
-        spin_unlock_bh(&sta->lock);
+        spin_unlock_irqrestore(&sta->flaglock, irqfl);
 
         return ret;
 }
@@ -329,11 +341,12 @@ static inline u32 test_and_clear_sta_flags(struct sta_info *sta,
                                            const u32 flags)
 {
         u32 ret;
+        unsigned long irqfl;
 
-        spin_lock_bh(&sta->lock);
+        spin_lock_irqsave(&sta->flaglock, irqfl);
         ret = sta->flags & flags;
         sta->flags &= ~flags;
-        spin_unlock_bh(&sta->lock);
+        spin_unlock_irqrestore(&sta->flaglock, irqfl);
 
         return ret;
 }
@@ -341,10 +354,11 @@ static inline u32 test_and_clear_sta_flags(struct sta_info *sta,
 static inline u32 get_sta_flags(struct sta_info *sta)
 {
         u32 ret;
+        unsigned long irqfl;
 
-        spin_lock_bh(&sta->lock);
+        spin_lock_irqsave(&sta->flaglock, irqfl);
         ret = sta->flags;
-        spin_unlock_bh(&sta->lock);
+        spin_unlock_irqrestore(&sta->flaglock, irqfl);
 
         return ret;
 }
diff --git a/net/mac80211/tkip.c b/net/mac80211/tkip.c
index e710243d82e2..995f7af3d25e 100644
--- a/net/mac80211/tkip.c
+++ b/net/mac80211/tkip.c
@@ -164,10 +164,10 @@ void ieee80211_get_tkip_key(struct ieee80211_key_conf *keyconf,
         iv16 = data[2] | (data[0] << 8);
         iv32 = get_unaligned_le32(&data[4]);
 
-        tk = &key->conf.key[ALG_TKIP_TEMP_ENCR_KEY];
+        tk = &key->conf.key[NL80211_TKIP_DATA_OFFSET_ENCR_KEY];
         ctx = &key->u.tkip.tx;
 
-#ifdef CONFIG_TKIP_DEBUG
+#ifdef CONFIG_MAC80211_TKIP_DEBUG
         printk(KERN_DEBUG "TKIP encrypt: iv16 = 0x%04x, iv32 = 0x%08x\n",
                         iv16, iv32);
 
@@ -177,7 +177,7 @@ void ieee80211_get_tkip_key(struct ieee80211_key_conf *keyconf,
                 printk(KERN_DEBUG "Wrap around of iv16 in the middle of a "
                         "fragmented packet\n");
         }
-#endif /* CONFIG_TKIP_DEBUG */
+#endif
 
         /* Update the p1k only when the iv16 in the packet wraps around, this
          * might occur after the wrap around of iv16 in the key in case of
@@ -205,7 +205,7 @@ void ieee80211_tkip_encrypt_data(struct crypto_blkcipher *tfm,
 {
         u8 rc4key[16];
         struct tkip_ctx *ctx = &key->u.tkip.tx;
-        const u8 *tk = &key->conf.key[ALG_TKIP_TEMP_ENCR_KEY];
+        const u8 *tk = &key->conf.key[NL80211_TKIP_DATA_OFFSET_ENCR_KEY];
 
         /* Calculate per-packet key */
         if (ctx->iv16 == 0 || !ctx->initialized)
@@ -231,7 +231,7 @@ int ieee80211_tkip_decrypt_data(struct crypto_blkcipher *tfm,
         u32 iv16;
         u8 rc4key[16], keyid, *pos = payload;
         int res;
-        const u8 *tk = &key->conf.key[ALG_TKIP_TEMP_ENCR_KEY];
+        const u8 *tk = &key->conf.key[NL80211_TKIP_DATA_OFFSET_ENCR_KEY];
 
         if (payload_len < 12)
                 return -1;
@@ -240,7 +240,7 @@ int ieee80211_tkip_decrypt_data(struct crypto_blkcipher *tfm,
         keyid = pos[3];
         iv32 = get_unaligned_le32(pos + 4);
         pos += 8;
-#ifdef CONFIG_TKIP_DEBUG
+#ifdef CONFIG_MAC80211_TKIP_DEBUG
         {
                 int i;
                 printk(KERN_DEBUG "TKIP decrypt: data(len=%zd)", payload_len);
@@ -250,7 +250,7 @@ int ieee80211_tkip_decrypt_data(struct crypto_blkcipher *tfm,
                 printk(KERN_DEBUG "TKIP decrypt: iv16=%04x iv32=%08x\n",
                        iv16, iv32);
         }
-#endif /* CONFIG_TKIP_DEBUG */
+#endif
 
         if (!(keyid & (1 << 5)))
                 return TKIP_DECRYPT_NO_EXT_IV;
@@ -262,14 +262,14 @@ int ieee80211_tkip_decrypt_data(struct crypto_blkcipher *tfm,
             (iv32 < key->u.tkip.rx[queue].iv32 ||
              (iv32 == key->u.tkip.rx[queue].iv32 &&
               iv16 <= key->u.tkip.rx[queue].iv16))) {
-#ifdef CONFIG_TKIP_DEBUG
+#ifdef CONFIG_MAC80211_TKIP_DEBUG
                 DECLARE_MAC_BUF(mac);
                 printk(KERN_DEBUG "TKIP replay detected for RX frame from "
                        "%s (RX IV (%04x,%02x) <= prev. IV (%04x,%02x)\n",
                        print_mac(mac, ta),
                        iv32, iv16, key->u.tkip.rx[queue].iv32,
                        key->u.tkip.rx[queue].iv16);
-#endif /* CONFIG_TKIP_DEBUG */
+#endif
                 return TKIP_DECRYPT_REPLAY;
         }
 
@@ -283,23 +283,23 @@ int ieee80211_tkip_decrypt_data(struct crypto_blkcipher *tfm,
             key->u.tkip.rx[queue].iv32 != iv32) {
                 /* IV16 wrapped around - perform TKIP phase 1 */
                 tkip_mixing_phase1(tk, &key->u.tkip.rx[queue], ta, iv32);
-#ifdef CONFIG_TKIP_DEBUG
+#ifdef CONFIG_MAC80211_TKIP_DEBUG
                 {
                         int i;
+                        u8 key_offset = NL80211_TKIP_DATA_OFFSET_ENCR_KEY;
                         DECLARE_MAC_BUF(mac);
                         printk(KERN_DEBUG "TKIP decrypt: Phase1 TA=%s"
                                " TK=", print_mac(mac, ta));
                         for (i = 0; i < 16; i++)
                                 printk("%02x ",
-                                       key->conf.key[
-                                                ALG_TKIP_TEMP_ENCR_KEY + i]);
+                                       key->conf.key[key_offset + i]);
                         printk("\n");
                         printk(KERN_DEBUG "TKIP decrypt: P1K=");
                         for (i = 0; i < 5; i++)
                                 printk("%04x ", key->u.tkip.rx[queue].p1k[i]);
                         printk("\n");
                 }
-#endif /* CONFIG_TKIP_DEBUG */
+#endif
                 if (key->local->ops->update_tkip_key &&
                         key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) {
                         u8 bcast[ETH_ALEN] =
@@ -316,7 +316,7 @@ int ieee80211_tkip_decrypt_data(struct crypto_blkcipher *tfm,
         }
 
         tkip_mixing_phase2(tk, &key->u.tkip.rx[queue], iv16, rc4key);
-#ifdef CONFIG_TKIP_DEBUG
+#ifdef CONFIG_MAC80211_TKIP_DEBUG
         {
                 int i;
                 printk(KERN_DEBUG "TKIP decrypt: Phase2 rc4key=");
@@ -324,7 +324,7 @@ int ieee80211_tkip_decrypt_data(struct crypto_blkcipher *tfm,
                         printk("%02x ", rc4key[i]);
                 printk("\n");
         }
-#endif /* CONFIG_TKIP_DEBUG */
+#endif
 
         res = ieee80211_wep_decrypt_data(tfm, rc4key, 16, pos, payload_len - 12);
  done:
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index ce06e791bf43..52ab85c4341b 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -52,9 +52,8 @@ static inline void ieee80211_include_sequence(struct ieee80211_sub_if_data *sdat
 static void ieee80211_dump_frame(const char *ifname, const char *title,
                                  const struct sk_buff *skb)
 {
-        const struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
-        u16 fc;
-        int hdrlen;
+        const struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+        unsigned int hdrlen;
         DECLARE_MAC_BUF(mac);
 
         printk(KERN_DEBUG "%s: %s (len=%d)", ifname, title, skb->len);
@@ -63,13 +62,12 @@ static void ieee80211_dump_frame(const char *ifname, const char *title,
                 return;
         }
 
-        fc = le16_to_cpu(hdr->frame_control);
-        hdrlen = ieee80211_get_hdrlen(fc);
+        hdrlen = ieee80211_hdrlen(hdr->frame_control);
         if (hdrlen > skb->len)
                 hdrlen = skb->len;
         if (hdrlen >= 4)
                 printk(" FC=0x%04x DUR=0x%04x",
-                       fc, le16_to_cpu(hdr->duration_id));
+                    le16_to_cpu(hdr->frame_control), le16_to_cpu(hdr->duration_id));
         if (hdrlen >= 10)
                 printk(" A1=%s", print_mac(mac, hdr->addr1));
         if (hdrlen >= 16)
@@ -87,8 +85,8 @@ static inline void ieee80211_dump_frame(const char *ifname, const char *title,
 }
 #endif /* CONFIG_MAC80211_LOWTX_FRAME_DUMP */
 
-static u16 ieee80211_duration(struct ieee80211_tx_data *tx, int group_addr,
-                              int next_frag_len)
+static __le16 ieee80211_duration(struct ieee80211_tx_data *tx, int group_addr,
+                                 int next_frag_len)
 {
         int rate, mrate, erp, dur, i;
         struct ieee80211_rate *txrate;
@@ -140,7 +138,7 @@ static u16 ieee80211_duration(struct ieee80211_tx_data *tx, int group_addr,
 
         /* data/mgmt */
         if (0 /* FIX: data/mgmt during CFP */)
-                return 32768;
+                return cpu_to_le16(32768);
 
         if (group_addr) /* Group address as the destination - no ACK */
                 return 0;
@@ -210,7 +208,7 @@ static u16 ieee80211_duration(struct ieee80211_tx_data *tx, int group_addr,
                                 tx->sdata->bss_conf.use_short_preamble);
         }
 
-        return dur;
+        return cpu_to_le16(dur);
 }
 
 static int inline is_ieee80211_device(struct net_device *dev,
@@ -281,7 +279,7 @@ ieee80211_tx_h_sequence(struct ieee80211_tx_data *tx)
 {
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
 
-        if (ieee80211_get_hdrlen(le16_to_cpu(hdr->frame_control)) >= 24)
+        if (ieee80211_hdrlen(hdr->frame_control) >= 24)
                 ieee80211_include_sequence(tx->sdata, hdr);
 
         return TX_CONTINUE;
@@ -542,9 +540,7 @@ ieee80211_tx_h_rate_ctrl(struct ieee80211_tx_data *tx)
 static ieee80211_tx_result
 ieee80211_tx_h_misc(struct ieee80211_tx_data *tx)
 {
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) tx->skb->data;
-        u16 fc = le16_to_cpu(hdr->frame_control);
-        u16 dur;
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
         struct ieee80211_supported_band *sband;
 
@@ -595,21 +591,13 @@ ieee80211_tx_h_misc(struct ieee80211_tx_data *tx)
         /* Transmit data frames using short preambles if the driver supports
          * short preambles at the selected rate and short preambles are
          * available on the network at the current point in time. */
-        if (((fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA) &&
+        if (ieee80211_is_data(hdr->frame_control) &&
             (sband->bitrates[tx->rate_idx].flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
             tx->sdata->bss_conf.use_short_preamble &&
             (!tx->sta || test_sta_flags(tx->sta, WLAN_STA_SHORT_PREAMBLE))) {
                 info->flags |= IEEE80211_TX_CTL_SHORT_PREAMBLE;
         }
 
-        /* Setup duration field for the first fragment of the frame. Duration
-         * for remaining fragments will be updated when they are being sent
-         * to low-level driver in ieee80211_tx(). */
-        dur = ieee80211_duration(tx, is_multicast_ether_addr(hdr->addr1),
-                                 (tx->flags & IEEE80211_TX_FRAGMENTED) ?
-                                 tx->extra_frag[0]->len : 0);
-        hdr->duration_id = cpu_to_le16(dur);
-
         if ((info->flags & IEEE80211_TX_CTL_USE_RTS_CTS) ||
             (info->flags & IEEE80211_TX_CTL_USE_CTS_PROTECT)) {
                 struct ieee80211_rate *rate;
@@ -647,7 +635,7 @@ ieee80211_tx_h_misc(struct ieee80211_tx_data *tx)
 static ieee80211_tx_result
 ieee80211_tx_h_fragment(struct ieee80211_tx_data *tx)
 {
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) tx->skb->data;
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
         size_t hdrlen, per_fragm, num_fragm, payload_len, left;
         struct sk_buff **frags, *first, *frag;
         int i;
@@ -670,7 +658,7 @@ ieee80211_tx_h_fragment(struct ieee80211_tx_data *tx)
 
         first = tx->skb;
 
-        hdrlen = ieee80211_get_hdrlen(tx->fc);
+        hdrlen = ieee80211_hdrlen(hdr->frame_control);
         payload_len = first->len - hdrlen;
         per_fragm = frag_threshold - hdrlen - FCS_LEN;
         num_fragm = DIV_ROUND_UP(payload_len, per_fragm);
@@ -711,6 +699,8 @@ ieee80211_tx_h_fragment(struct ieee80211_tx_data *tx)
                 fhdr->seq_ctrl = cpu_to_le16(seq | ((i + 1) & IEEE80211_SCTL_FRAG));
                 copylen = left > per_fragm ? per_fragm : left;
                 memcpy(skb_put(frag, copylen), pos, copylen);
+                memcpy(frag->cb, first->cb, sizeof(frag->cb));
+                skb_copy_queue_mapping(frag, first);
 
                 pos += copylen;
                 left -= copylen;
@@ -755,6 +745,36 @@ ieee80211_tx_h_encrypt(struct ieee80211_tx_data *tx)
 }
 
 static ieee80211_tx_result
+ieee80211_tx_h_calculate_duration(struct ieee80211_tx_data *tx)
+{
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
+        int next_len, i;
+        int group_addr = is_multicast_ether_addr(hdr->addr1);
+
+        if (!(tx->flags & IEEE80211_TX_FRAGMENTED)) {
+                hdr->duration_id = ieee80211_duration(tx, group_addr, 0);
+                return TX_CONTINUE;
+        }
+
+        hdr->duration_id = ieee80211_duration(tx, group_addr,
+                                              tx->extra_frag[0]->len);
+
+        for (i = 0; i < tx->num_extra_frag; i++) {
+                if (i + 1 < tx->num_extra_frag) {
+                        next_len = tx->extra_frag[i + 1]->len;
+                } else {
+                        next_len = 0;
+                        tx->rate_idx = tx->last_frag_rate_idx;
+                }
+
+                hdr = (struct ieee80211_hdr *)tx->extra_frag[i]->data;
+                hdr->duration_id = ieee80211_duration(tx, 0, next_len);
+        }
+
+        return TX_CONTINUE;
+}
+
+static ieee80211_tx_result
 ieee80211_tx_h_stats(struct ieee80211_tx_data *tx)
 {
         int i;
@@ -788,6 +808,7 @@ static ieee80211_tx_handler ieee80211_tx_handlers[] =
         ieee80211_tx_h_fragment,
         /* handlers after fragment must be aware of tx info fragmentation! */
         ieee80211_tx_h_encrypt,
+        ieee80211_tx_h_calculate_duration,
         ieee80211_tx_h_stats,
         NULL
 };
@@ -1083,13 +1104,46 @@ static int __ieee80211_tx(struct ieee80211_local *local, struct sk_buff *skb,
         return IEEE80211_TX_OK;
 }
 
+/*
+ * Invoke TX handlers, return 0 on success and non-zero if the
+ * frame was dropped or queued.
+ */
+static int invoke_tx_handlers(struct ieee80211_tx_data *tx)
+{
+        struct ieee80211_local *local = tx->local;
+        struct sk_buff *skb = tx->skb;
+        ieee80211_tx_handler *handler;
+        ieee80211_tx_result res = TX_DROP;
+        int i;
+
+        for (handler = ieee80211_tx_handlers; *handler != NULL; handler++) {
+                res = (*handler)(tx);
+                if (res != TX_CONTINUE)
+                        break;
+        }
+
+        if (unlikely(res == TX_DROP)) {
+                I802_DEBUG_INC(local->tx_handlers_drop);
+                dev_kfree_skb(skb);
+                for (i = 0; i < tx->num_extra_frag; i++)
+                        if (tx->extra_frag[i])
+                                dev_kfree_skb(tx->extra_frag[i]);
+                kfree(tx->extra_frag);
+                return -1;
+        } else if (unlikely(res == TX_QUEUED)) {
+                I802_DEBUG_INC(local->tx_handlers_queued);
+                return -1;
+        }
+
+        return 0;
+}
+
 static int ieee80211_tx(struct net_device *dev, struct sk_buff *skb)
 {
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
         struct sta_info *sta;
-        ieee80211_tx_handler *handler;
         struct ieee80211_tx_data tx;
-        ieee80211_tx_result res = TX_DROP, res_prepare;
+        ieee80211_tx_result res_prepare;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         int ret, i;
         u16 queue;
@@ -1118,44 +1172,8 @@ static int ieee80211_tx(struct net_device *dev, struct sk_buff *skb)
         tx.channel = local->hw.conf.channel;
         info->band = tx.channel->band;
 
-        for (handler = ieee80211_tx_handlers; *handler != NULL;
-             handler++) {
-                res = (*handler)(&tx);
-                if (res != TX_CONTINUE)
-                        break;
-        }
-
-        if (WARN_ON(tx.skb != skb))
-                goto drop;
-
-        if (unlikely(res == TX_DROP)) {
-                I802_DEBUG_INC(local->tx_handlers_drop);
-                goto drop;
-        }
-
-        if (unlikely(res == TX_QUEUED)) {
-                I802_DEBUG_INC(local->tx_handlers_queued);
-                rcu_read_unlock();
-                return 0;
-        }
-
-        if (tx.extra_frag) {
-                for (i = 0; i < tx.num_extra_frag; i++) {
-                        int next_len, dur;
-                        struct ieee80211_hdr *hdr =
-                                (struct ieee80211_hdr *)
-                                tx.extra_frag[i]->data;
-
-                        if (i + 1 < tx.num_extra_frag) {
-                                next_len = tx.extra_frag[i + 1]->len;
-                        } else {
-                                next_len = 0;
-                                tx.rate_idx = tx.last_frag_rate_idx;
-                        }
-                        dur = ieee80211_duration(&tx, 0, next_len);
-                        hdr->duration_id = cpu_to_le16(dur);
-                }
-        }
+        if (invoke_tx_handlers(&tx))
+                goto out;
 
 retry:
         ret = __ieee80211_tx(local, skb, &tx);
@@ -1198,6 +1216,7 @@ retry:
                 store->last_frag_rate_ctrl_probe =
                         !!(tx.flags & IEEE80211_TX_PROBE_LAST_FRAG);
         }
+ out:
         rcu_read_unlock();
         return 0;
 
@@ -1379,7 +1398,8 @@ int ieee80211_subif_start_xmit(struct sk_buff *skb,
         struct ieee80211_tx_info *info;
         struct ieee80211_sub_if_data *sdata;
         int ret = 1, head_need;
-        u16 ethertype, hdrlen,  meshhdrlen = 0, fc;
+        u16 ethertype, hdrlen,  meshhdrlen = 0;
+        __le16 fc;
         struct ieee80211_hdr hdr;
         struct ieee80211s_hdr mesh_hdr;
         const u8 *encaps_data;
@@ -1402,12 +1422,12 @@ int ieee80211_subif_start_xmit(struct sk_buff *skb,
         /* convert Ethernet header to proper 802.11 header (based on
          * operation mode) */
         ethertype = (skb->data[12] << 8) | skb->data[13];
-        fc = IEEE80211_FTYPE_DATA | IEEE80211_STYPE_DATA;
+        fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_DATA);
 
         switch (sdata->vif.type) {
         case IEEE80211_IF_TYPE_AP:
         case IEEE80211_IF_TYPE_VLAN:
-                fc |= IEEE80211_FCTL_FROMDS;
+                fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS);
                 /* DA BSSID SA */
                 memcpy(hdr.addr1, skb->data, ETH_ALEN);
                 memcpy(hdr.addr2, dev->dev_addr, ETH_ALEN);
@@ -1415,7 +1435,7 @@ int ieee80211_subif_start_xmit(struct sk_buff *skb,
                 hdrlen = 24;
                 break;
         case IEEE80211_IF_TYPE_WDS:
-                fc |= IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS;
+                fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
                 /* RA TA DA SA */
                 memcpy(hdr.addr1, sdata->u.wds.remote_addr, ETH_ALEN);
                 memcpy(hdr.addr2, dev->dev_addr, ETH_ALEN);
@@ -1425,7 +1445,7 @@ int ieee80211_subif_start_xmit(struct sk_buff *skb,
                 break;
 #ifdef CONFIG_MAC80211_MESH
         case IEEE80211_IF_TYPE_MESH_POINT:
-                fc |= IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS;
+                fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
                 /* RA TA DA SA */
                 if (is_multicast_ether_addr(skb->data))
                         memcpy(hdr.addr1, skb->data, ETH_ALEN);
@@ -1455,7 +1475,7 @@ int ieee80211_subif_start_xmit(struct sk_buff *skb,
                 break;
 #endif
         case IEEE80211_IF_TYPE_STA:
-                fc |= IEEE80211_FCTL_TODS;
+                fc |= cpu_to_le16(IEEE80211_FCTL_TODS);
                 /* BSSID SA DA */
                 memcpy(hdr.addr1, sdata->u.sta.bssid, ETH_ALEN);
                 memcpy(hdr.addr2, skb->data + ETH_ALEN, ETH_ALEN);
@@ -1490,7 +1510,7 @@ int ieee80211_subif_start_xmit(struct sk_buff *skb,
         /* receiver and we are QoS enabled, use a QoS type frame */
         if (sta_flags & WLAN_STA_WME &&
             ieee80211_num_regular_queues(&local->hw) >= 4) {
-                fc |= IEEE80211_STYPE_QOS_DATA;
+                fc |= cpu_to_le16(IEEE80211_STYPE_QOS_DATA);
                 hdrlen += 2;
         }
 
@@ -1518,7 +1538,7 @@ int ieee80211_subif_start_xmit(struct sk_buff *skb,
                 goto fail;
         }
 
-        hdr.frame_control = cpu_to_le16(fc);
+        hdr.frame_control = fc;
         hdr.duration_id = 0;
         hdr.seq_ctrl = 0;
 
@@ -1587,7 +1607,7 @@ int ieee80211_subif_start_xmit(struct sk_buff *skb,
                 h_pos += meshhdrlen;
         }
 
-        if (fc & IEEE80211_STYPE_QOS_DATA) {
+        if (ieee80211_is_data_qos(fc)) {
                 __le16 *qos_control;
 
                 qos_control = (__le16*) skb_push(skb, 2);
@@ -1845,8 +1865,8 @@ struct sk_buff *ieee80211_beacon_get(struct ieee80211_hw *hw,
                 mgmt = (struct ieee80211_mgmt *)
                         skb_put(skb, 24 + sizeof(mgmt->u.beacon));
                 memset(mgmt, 0, 24 + sizeof(mgmt->u.beacon));
-                mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
-                                                   IEEE80211_STYPE_BEACON);
+                mgmt->frame_control =
+                    cpu_to_le16(IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_BEACON);
                 memset(mgmt->da, 0xff, ETH_ALEN);
                 memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
                 /* BSSID is left zeroed, wildcard value */
@@ -1914,10 +1934,9 @@ void ieee80211_rts_get(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                        struct ieee80211_rts *rts)
 {
         const struct ieee80211_hdr *hdr = frame;
-        u16 fctl;
 
-        fctl = IEEE80211_FTYPE_CTL | IEEE80211_STYPE_RTS;
-        rts->frame_control = cpu_to_le16(fctl);
+        rts->frame_control =
+            cpu_to_le16(IEEE80211_FTYPE_CTL | IEEE80211_STYPE_RTS);
         rts->duration = ieee80211_rts_duration(hw, vif, frame_len,
                                                frame_txctl);
         memcpy(rts->ra, hdr->addr1, sizeof(rts->ra));
@@ -1931,10 +1950,9 @@ void ieee80211_ctstoself_get(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                              struct ieee80211_cts *cts)
 {
         const struct ieee80211_hdr *hdr = frame;
-        u16 fctl;
 
-        fctl = IEEE80211_FTYPE_CTL | IEEE80211_STYPE_CTS;
-        cts->frame_control = cpu_to_le16(fctl);
+        cts->frame_control =
+            cpu_to_le16(IEEE80211_FTYPE_CTL | IEEE80211_STYPE_CTS);
         cts->duration = ieee80211_ctstoself_duration(hw, vif,
                                                      frame_len, frame_txctl);
         memcpy(cts->ra, hdr->addr1, sizeof(cts->ra));
@@ -1948,9 +1966,7 @@ ieee80211_get_buffered_bc(struct ieee80211_hw *hw,
         struct ieee80211_local *local = hw_to_local(hw);
         struct sk_buff *skb = NULL;
         struct sta_info *sta;
-        ieee80211_tx_handler *handler;
         struct ieee80211_tx_data tx;
-        ieee80211_tx_result res = TX_DROP;
         struct net_device *bdev;
         struct ieee80211_sub_if_data *sdata;
         struct ieee80211_if_ap *bss = NULL;
@@ -2001,25 +2017,9 @@ ieee80211_get_buffered_bc(struct ieee80211_hw *hw,
         tx.channel = local->hw.conf.channel;
         info->band = tx.channel->band;
 
-        for (handler = ieee80211_tx_handlers; *handler != NULL; handler++) {
-                res = (*handler)(&tx);
-                if (res == TX_DROP || res == TX_QUEUED)
-                        break;
-        }
-
-        if (WARN_ON(tx.skb != skb))
-                res = TX_DROP;
-
-        if (res == TX_DROP) {
-                I802_DEBUG_INC(local->tx_handlers_drop);
-                dev_kfree_skb(skb);
+        if (invoke_tx_handlers(&tx))
                 skb = NULL;
-        } else if (res == TX_QUEUED) {
-                I802_DEBUG_INC(local->tx_handlers_queued);
-                skb = NULL;
-        }
-
-out:
+ out:
         rcu_read_unlock();
 
         return skb;
diff --git a/net/mac80211/wep.c b/net/mac80211/wep.c
index e7b6344c900a..35b664d00e23 100644
--- a/net/mac80211/wep.c
+++ b/net/mac80211/wep.c
@@ -84,20 +84,17 @@ static u8 *ieee80211_wep_add_iv(struct ieee80211_local *local,
                                 struct sk_buff *skb,
                                 struct ieee80211_key *key)
 {
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
-        u16 fc;
-        int hdrlen;
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+        unsigned int hdrlen;
         u8 *newhdr;
 
-        fc = le16_to_cpu(hdr->frame_control);
-        fc |= IEEE80211_FCTL_PROTECTED;
-        hdr->frame_control = cpu_to_le16(fc);
+        hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
 
         if (WARN_ON(skb_tailroom(skb) < WEP_ICV_LEN ||
                     skb_headroom(skb) < WEP_IV_LEN))
                 return NULL;
 
-        hdrlen = ieee80211_get_hdrlen(fc);
+        hdrlen = ieee80211_hdrlen(hdr->frame_control);
         newhdr = skb_push(skb, WEP_IV_LEN);
         memmove(newhdr, newhdr + WEP_IV_LEN, hdrlen);
         ieee80211_wep_get_iv(local, key, newhdr + hdrlen);
@@ -109,12 +106,10 @@ static void ieee80211_wep_remove_iv(struct ieee80211_local *local,
                                     struct sk_buff *skb,
                                     struct ieee80211_key *key)
 {
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
-        u16 fc;
-        int hdrlen;
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+        unsigned int hdrlen;
 
-        fc = le16_to_cpu(hdr->frame_control);
-        hdrlen = ieee80211_get_hdrlen(fc);
+        hdrlen = ieee80211_hdrlen(hdr->frame_control);
         memmove(skb->data + WEP_IV_LEN, skb->data, hdrlen);
         skb_pull(skb, WEP_IV_LEN);
 }
@@ -224,17 +219,15 @@ int ieee80211_wep_decrypt(struct ieee80211_local *local, struct sk_buff *skb,
         u32 klen;
         u8 *rc4key;
         u8 keyidx;
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
-        u16 fc;
-        int hdrlen;
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+        unsigned int hdrlen;
         size_t len;
         int ret = 0;
 
-        fc = le16_to_cpu(hdr->frame_control);
-        if (!(fc & IEEE80211_FCTL_PROTECTED))
+        if (!ieee80211_has_protected(hdr->frame_control))
                 return -1;
 
-        hdrlen = ieee80211_get_hdrlen(fc);
+        hdrlen = ieee80211_hdrlen(hdr->frame_control);
 
         if (skb->len < 8 + hdrlen)
                 return -1;
@@ -281,17 +274,15 @@ int ieee80211_wep_decrypt(struct ieee80211_local *local, struct sk_buff *skb,
 
 u8 * ieee80211_wep_is_weak_iv(struct sk_buff *skb, struct ieee80211_key *key)
 {
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
-        u16 fc;
-        int hdrlen;
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+        unsigned int hdrlen;
         u8 *ivpos;
         u32 iv;
 
-        fc = le16_to_cpu(hdr->frame_control);
-        if (!(fc & IEEE80211_FCTL_PROTECTED))
+        if (!ieee80211_has_protected(hdr->frame_control))
                 return NULL;
 
-        hdrlen = ieee80211_get_hdrlen(fc);
+        hdrlen = ieee80211_hdrlen(hdr->frame_control);
         ivpos = skb->data + hdrlen;
         iv = (ivpos[0] << 16) | (ivpos[1] << 8) | ivpos[2];
 
diff --git a/net/mac80211/wext.c b/net/mac80211/wext.c
index 5af3862e7191..df0531c28141 100644
--- a/net/mac80211/wext.c
+++ b/net/mac80211/wext.c
@@ -135,7 +135,39 @@ static int ieee80211_ioctl_giwname(struct net_device *dev,
                                    struct iw_request_info *info,
                                    char *name, char *extra)
 {
+        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+        struct ieee80211_supported_band *sband;
+        u8 is_ht = 0, is_a = 0, is_b = 0, is_g = 0;
+
+
+        sband = local->hw.wiphy->bands[IEEE80211_BAND_5GHZ];
+        if (sband) {
+                is_a = 1;
+                is_ht |= sband->ht_info.ht_supported;
+        }
+
+        sband = local->hw.wiphy->bands[IEEE80211_BAND_2GHZ];
+        if (sband) {
+                int i;
+                /* Check for mandatory rates */
+                for (i = 0; i < sband->n_bitrates; i++) {
+                        if (sband->bitrates[i].bitrate == 10)
+                                is_b = 1;
+                        if (sband->bitrates[i].bitrate == 60)
+                                is_g = 1;
+                }
+                is_ht |= sband->ht_info.ht_supported;
+        }
+
         strcpy(name, "IEEE 802.11");
+        if (is_a)
+                strcat(name, "a");
+        if (is_b)
+                strcat(name, "b");
+        if (is_g)
+                strcat(name, "g");
+        if (is_ht)
+                strcat(name, "n");
 
         return 0;
 }
@@ -567,7 +599,7 @@ static int ieee80211_ioctl_giwscan(struct net_device *dev,
         if (local->sta_sw_scanning || local->sta_hw_scanning)
                 return -EAGAIN;
 
-        res = ieee80211_sta_scan_results(dev, extra, data->length);
+        res = ieee80211_sta_scan_results(dev, info, extra, data->length);
         if (res >= 0) {
                 data->length = res;
                 return 0;
@@ -721,6 +753,9 @@ static int ieee80211_ioctl_siwrts(struct net_device *dev,
 
         if (rts->disabled)
                 local->rts_threshold = IEEE80211_MAX_RTS_THRESHOLD;
+        else if (!rts->fixed)
+                /* if the rts value is not fixed, then take default */
+                local->rts_threshold = IEEE80211_MAX_RTS_THRESHOLD;
         else if (rts->value < 0 || rts->value > IEEE80211_MAX_RTS_THRESHOLD)
                 return -EINVAL;
         else
@@ -949,6 +984,19 @@ static int ieee80211_ioctl_giwencode(struct net_device *dev,
         erq->length = sdata->keys[idx]->conf.keylen;
         erq->flags |= IW_ENCODE_ENABLED;
 
+        if (sdata->vif.type == IEEE80211_IF_TYPE_STA) {
+                struct ieee80211_if_sta *ifsta = &sdata->u.sta;
+                switch (ifsta->auth_alg) {
+                case WLAN_AUTH_OPEN:
+                case WLAN_AUTH_LEAP:
+                        erq->flags |= IW_ENCODE_OPEN;
+                        break;
+                case WLAN_AUTH_SHARED_KEY:
+                        erq->flags |= IW_ENCODE_RESTRICTED;
+                        break;
+                }
+        }
+
         return 0;
 }
 
diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c
index 345e10e9b313..f809761fbfb5 100644
--- a/net/mac80211/wpa.c
+++ b/net/mac80211/wpa.c
@@ -49,7 +49,7 @@ static int ieee80211_get_hdr_info(const struct sk_buff *skb, u8 **sa, u8 **da,
 ieee80211_tx_result
 ieee80211_tx_h_michael_mic_add(struct ieee80211_tx_data *tx)
 {
-        u8 *data, *sa, *da, *key, *mic, qos_tid;
+        u8 *data, *sa, *da, *key, *mic, qos_tid, key_offset;
         size_t data_len;
         u16 fc;
         struct sk_buff *skb = tx->skb;
@@ -88,8 +88,12 @@ ieee80211_tx_h_michael_mic_add(struct ieee80211_tx_data *tx)
 #else
         authenticator = 1;
 #endif
-        key = &tx->key->conf.key[authenticator ? ALG_TKIP_TEMP_AUTH_TX_MIC_KEY :
-                                 ALG_TKIP_TEMP_AUTH_RX_MIC_KEY];
+        /* At this point we know we're using ALG_TKIP. To get the MIC key
+         * we now will rely on the offset from the ieee80211_key_conf::key */
+        key_offset = authenticator ?
+                NL80211_TKIP_DATA_OFFSET_TX_MIC_KEY :
+                NL80211_TKIP_DATA_OFFSET_RX_MIC_KEY;
+        key = &tx->key->conf.key[key_offset];
         mic = skb_put(skb, MICHAEL_MIC_LEN);
         michael_mic(key, da, sa, qos_tid & 0x0f, data, data_len, mic);
 
@@ -100,7 +104,7 @@ ieee80211_tx_h_michael_mic_add(struct ieee80211_tx_data *tx)
 ieee80211_rx_result
 ieee80211_rx_h_michael_mic_verify(struct ieee80211_rx_data *rx)
 {
-        u8 *data, *sa, *da, *key = NULL, qos_tid;
+        u8 *data, *sa, *da, *key = NULL, qos_tid, key_offset;
         size_t data_len;
         u16 fc;
         u8 mic[MICHAEL_MIC_LEN];
@@ -131,8 +135,12 @@ ieee80211_rx_h_michael_mic_verify(struct ieee80211_rx_data *rx)
 #else
         authenticator = 1;
 #endif
-        key = &rx->key->conf.key[authenticator ? ALG_TKIP_TEMP_AUTH_RX_MIC_KEY :
-                                 ALG_TKIP_TEMP_AUTH_TX_MIC_KEY];
+        /* At this point we know we're using ALG_TKIP. To get the MIC key
+         * we now will rely on the offset from the ieee80211_key_conf::key */
+        key_offset = authenticator ?
+                NL80211_TKIP_DATA_OFFSET_RX_MIC_KEY :
+                NL80211_TKIP_DATA_OFFSET_TX_MIC_KEY;
+        key = &rx->key->conf.key[key_offset];
         michael_mic(key, da, sa, qos_tid & 0x0f, data, data_len, mic);
         if (memcmp(mic, data + data_len, MICHAEL_MIC_LEN) != 0 || wpa_test) {
                 if (!(rx->flags & IEEE80211_RX_RA_MATCH))