Merge branch 'wip-2.6.34' into old-private-masterarchived-private-master

32 files changed, 4146 insertions, 1801 deletions

diff --git a/net/wireless/.gitignore b/net/wireless/.gitignore
new file mode 100644
index 000000000000..c33451b896d9
--- /dev/null
+++ b/net/wireless/.gitignore
@@ -0,0 +1 @@
+regdb.c
diff --git a/net/wireless/Kconfig b/net/wireless/Kconfig
index abf7ca3f9ff9..d0ee29063e5d 100644
--- a/net/wireless/Kconfig
+++ b/net/wireless/Kconfig
@@ -1,3 +1,21 @@
+config WIRELESS_EXT
+        bool
+
+config WEXT_CORE
+        def_bool y
+        depends on CFG80211_WEXT || WIRELESS_EXT
+
+config WEXT_PROC
+        def_bool y
+        depends on PROC_FS
+        depends on WEXT_CORE
+
+config WEXT_SPY
+        bool
+
+config WEXT_PRIV
+        bool
+
 config CFG80211
         tristate "cfg80211 - wireless configuration API"
         depends on RFKILL || !RFKILL
@@ -67,47 +85,44 @@ config CFG80211_DEFAULT_PS
           applications instead -- they need to register their network
           latency requirement, see Documentation/power/pm_qos_interface.txt.
 
-config CFG80211_DEFAULT_PS_VALUE
-        int
-        default 1 if CFG80211_DEFAULT_PS
-        default 0
-
 config CFG80211_DEBUGFS
         bool "cfg80211 DebugFS entries"
-        depends on CFG80211 && DEBUG_FS
+        depends on CFG80211
+        depends on DEBUG_FS
         ---help---
           You can enable this if you want to debugfs entries for cfg80211.
 
           If unsure, say N.
 
-config WIRELESS_OLD_REGULATORY
-        bool "Old wireless static regulatory definitions"
+config CFG80211_INTERNAL_REGDB
+        bool "use statically compiled regulatory rules database" if EMBEDDED
         default n
+        depends on CFG80211
         ---help---
-          This option enables the old static regulatory information
-          and uses it within the new framework. This option is available
-          for historical reasons and it is advised to leave it off.
+          This option generates an internal data structure representing
+          the wireless regulatory rules described in net/wireless/db.txt
+          and includes code to query that database.  This is an alternative
+          to using CRDA for defining regulatory rules for the kernel.
 
           For details see:
 
           http://wireless.kernel.org/en/developers/Regulatory
 
-          Say N and if you say Y, please tell us why. The default is N.
+          Most distributions have a CRDA package.  So if unsure, say N.
 
-config WIRELESS_EXT
-        bool "Wireless extensions"
+config CFG80211_WEXT
+        bool "cfg80211 wireless extensions compatibility"
+        depends on CFG80211
+        select WEXT_CORE
         default y
-        ---help---
-          This option enables the legacy wireless extensions
-          (wireless network interface configuration via ioctls.)
-
-          Say Y unless you've upgraded all your userspace to use
-          nl80211 instead of wireless extensions.
+        help
+          Enable this option if you need old userspace for wireless
+          extensions with cfg80211-based drivers.
 
 config WIRELESS_EXT_SYSFS
         bool "Wireless extensions sysfs files"
         default y
-        depends on WIRELESS_EXT && SYSFS
+        depends on WEXT_CORE && SYSFS
         help
           This option enables the deprecated wireless statistics
           files in /sys/class/net/*/wireless/. The same information
diff --git a/net/wireless/Makefile b/net/wireless/Makefile
index 3ecaa9179977..e77e508126fa 100644
--- a/net/wireless/Makefile
+++ b/net/wireless/Makefile
@@ -1,13 +1,23 @@
-obj-$(CONFIG_WIRELESS_EXT) += wext.o
 obj-$(CONFIG_CFG80211) += cfg80211.o
 obj-$(CONFIG_LIB80211) += lib80211.o
 obj-$(CONFIG_LIB80211_CRYPT_WEP) += lib80211_crypt_wep.o
 obj-$(CONFIG_LIB80211_CRYPT_CCMP) += lib80211_crypt_ccmp.o
 obj-$(CONFIG_LIB80211_CRYPT_TKIP) += lib80211_crypt_tkip.o
 
+obj-$(CONFIG_WEXT_CORE) += wext-core.o
+obj-$(CONFIG_WEXT_PROC) += wext-proc.o
+obj-$(CONFIG_WEXT_SPY) += wext-spy.o
+obj-$(CONFIG_WEXT_PRIV) += wext-priv.o
+
 cfg80211-y += core.o sysfs.o radiotap.o util.o reg.o scan.o nl80211.o
-cfg80211-y += mlme.o ibss.o sme.o chan.o
+cfg80211-y += mlme.o ibss.o sme.o chan.o ethtool.o
 cfg80211-$(CONFIG_CFG80211_DEBUGFS) += debugfs.o
-cfg80211-$(CONFIG_WIRELESS_EXT) += wext-compat.o wext-sme.o
+cfg80211-$(CONFIG_CFG80211_WEXT) += wext-compat.o wext-sme.o
+cfg80211-$(CONFIG_CFG80211_INTERNAL_REGDB) += regdb.o
 
 ccflags-y += -D__CHECK_ENDIAN__
+
+$(obj)/regdb.c: $(src)/db.txt $(src)/genregdb.awk
+        @$(AWK) -f $(srctree)/$(src)/genregdb.awk < $< > $@
+
+clean-files := regdb.c
diff --git a/net/wireless/chan.c b/net/wireless/chan.c
index a46ac6c9b365..bf1737fc9a7e 100644
--- a/net/wireless/chan.c
+++ b/net/wireless/chan.c
@@ -41,44 +41,57 @@ rdev_fixed_channel(struct cfg80211_registered_device *rdev,
         return result;
 }
 
-int rdev_set_freq(struct cfg80211_registered_device *rdev,
-                  struct wireless_dev *for_wdev,
+struct ieee80211_channel *
+rdev_freq_to_chan(struct cfg80211_registered_device *rdev,
                   int freq, enum nl80211_channel_type channel_type)
 {
         struct ieee80211_channel *chan;
         struct ieee80211_sta_ht_cap *ht_cap;
-        int result;
-
-        if (rdev_fixed_channel(rdev, for_wdev))
-                return -EBUSY;
-
-        if (!rdev->ops->set_channel)
-                return -EOPNOTSUPP;
 
         chan = ieee80211_get_channel(&rdev->wiphy, freq);
 
         /* Primary channel not allowed */
         if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
-                return -EINVAL;
+                return NULL;
 
         if (channel_type == NL80211_CHAN_HT40MINUS &&
             chan->flags & IEEE80211_CHAN_NO_HT40MINUS)
-                return -EINVAL;
+                return NULL;
         else if (channel_type == NL80211_CHAN_HT40PLUS &&
                  chan->flags & IEEE80211_CHAN_NO_HT40PLUS)
-                return -EINVAL;
+                return NULL;
 
         ht_cap = &rdev->wiphy.bands[chan->band]->ht_cap;
 
         if (channel_type != NL80211_CHAN_NO_HT) {
                 if (!ht_cap->ht_supported)
-                        return -EINVAL;
+                        return NULL;
 
                 if (!(ht_cap->cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) ||
                     ht_cap->cap & IEEE80211_HT_CAP_40MHZ_INTOLERANT)
-                        return -EINVAL;
+                        return NULL;
         }
 
+        return chan;
+}
+
+int rdev_set_freq(struct cfg80211_registered_device *rdev,
+                  struct wireless_dev *for_wdev,
+                  int freq, enum nl80211_channel_type channel_type)
+{
+        struct ieee80211_channel *chan;
+        int result;
+
+        if (rdev_fixed_channel(rdev, for_wdev))
+                return -EBUSY;
+
+        if (!rdev->ops->set_channel)
+                return -EOPNOTSUPP;
+
+        chan = rdev_freq_to_chan(rdev, freq, channel_type);
+        if (!chan)
+                return -EINVAL;
+
         result = rdev->ops->set_channel(&rdev->wiphy, chan, channel_type);
         if (result)
                 return result;
diff --git a/net/wireless/core.c b/net/wireless/core.c
index a595f712b5bf..6ac70c101523 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -1,13 +1,14 @@
 /*
  * This is the linux wireless configuration interface.
  *
- * Copyright 2006-2009          Johannes Berg <johannes@sipsolutions.net>
+ * Copyright 2006-2010          Johannes Berg <johannes@sipsolutions.net>
  */
 
 #include <linux/if.h>
 #include <linux/module.h>
 #include <linux/err.h>
 #include <linux/list.h>
+#include <linux/slab.h>
 #include <linux/nl80211.h>
 #include <linux/debugfs.h>
 #include <linux/notifier.h>
@@ -22,6 +23,7 @@
 #include "sysfs.h"
 #include "debugfs.h"
 #include "wext-compat.h"
+#include "ethtool.h"
 
 /* name for sysfs, %d is appended */
 #define PHY_NAME "phy"
@@ -30,20 +32,18 @@ MODULE_AUTHOR("Johannes Berg");
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("wireless configuration support");
 
-/* RCU might be appropriate here since we usually
- * only read the list, and that can happen quite
- * often because we need to do it for each command */
+/* RCU-protected (and cfg80211_mutex for writers) */
 LIST_HEAD(cfg80211_rdev_list);
 int cfg80211_rdev_list_generation;
 
-/*
- * This is used to protect the cfg80211_rdev_list
- */
 DEFINE_MUTEX(cfg80211_mutex);
 
 /* for debugfs */
 static struct dentry *ieee80211_debugfs_dir;
 
+/* for the cleanup, scan and event works */
+struct workqueue_struct *cfg80211_wq;
+
 /* requires cfg80211_mutex to be held! */
 struct cfg80211_registered_device *cfg80211_rdev_by_wiphy_idx(int wiphy_idx)
 {
@@ -230,7 +230,7 @@ int cfg80211_switch_netns(struct cfg80211_registered_device *rdev,
         struct wireless_dev *wdev;
         int err = 0;
 
-        if (!rdev->wiphy.netnsok)
+        if (!(rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK))
                 return -EOPNOTSUPP;
 
         list_for_each_entry(wdev, &rdev->netdev_list, list) {
@@ -359,11 +359,17 @@ struct wiphy *wiphy_new(const struct cfg80211_ops *ops, int sizeof_priv)
         INIT_LIST_HEAD(&rdev->bss_list);
         INIT_WORK(&rdev->scan_done_wk, __cfg80211_scan_done);
 
+#ifdef CONFIG_CFG80211_WEXT
+        rdev->wiphy.wext = &cfg80211_wext_handler;
+#endif
+
         device_initialize(&rdev->wiphy.dev);
         rdev->wiphy.dev.class = &ieee80211_class;
         rdev->wiphy.dev.platform_data = rdev;
 
-        rdev->wiphy.ps_default = CONFIG_CFG80211_DEFAULT_PS_VALUE;
+#ifdef CONFIG_CFG80211_DEFAULT_PS
+        rdev->wiphy.flags |= WIPHY_FLAG_PS_ON_BY_DEFAULT;
+#endif
 
         wiphy_net_set(&rdev->wiphy, &init_net);
 
@@ -392,6 +398,7 @@ struct wiphy *wiphy_new(const struct cfg80211_ops *ops, int sizeof_priv)
         rdev->wiphy.retry_long = 4;
         rdev->wiphy.frag_threshold = (u32) -1;
         rdev->wiphy.rts_threshold = (u32) -1;
+        rdev->wiphy.coverage_class = 0;
 
         return &rdev->wiphy;
 }
@@ -407,6 +414,18 @@ int wiphy_register(struct wiphy *wiphy)
         int i;
         u16 ifmodes = wiphy->interface_modes;
 
+        if (WARN_ON(wiphy->addresses && !wiphy->n_addresses))
+                return -EINVAL;
+
+        if (WARN_ON(wiphy->addresses &&
+                    !is_zero_ether_addr(wiphy->perm_addr) &&
+                    memcmp(wiphy->perm_addr, wiphy->addresses[0].addr,
+                           ETH_ALEN)))
+                return -EINVAL;
+
+        if (wiphy->addresses)
+                memcpy(wiphy->perm_addr, wiphy->addresses[0].addr, ETH_ALEN);
+
         /* sanity check ifmodes */
         WARN_ON(!ifmodes);
         ifmodes &= ((1 << __NL80211_IFTYPE_AFTER_LAST) - 1) & ~1;
@@ -466,7 +485,7 @@ int wiphy_register(struct wiphy *wiphy)
         /* set up regulatory info */
         wiphy_update_regulatory(wiphy, NL80211_REGDOM_SET_BY_CORE);
 
-        list_add(&rdev->list, &cfg80211_rdev_list);
+        list_add_rcu(&rdev->list, &cfg80211_rdev_list);
         cfg80211_rdev_list_generation++;
 
         mutex_unlock(&cfg80211_mutex);
@@ -478,7 +497,7 @@ int wiphy_register(struct wiphy *wiphy)
         if (IS_ERR(rdev->wiphy.debugfsdir))
                 rdev->wiphy.debugfsdir = NULL;
 
-        if (wiphy->custom_regulatory) {
+        if (wiphy->flags & WIPHY_FLAG_CUSTOM_REGULATORY) {
                 struct regulatory_request request;
 
                 request.wiphy_idx = get_wiphy_idx(wiphy);
@@ -542,8 +561,9 @@ void wiphy_unregister(struct wiphy *wiphy)
          * First remove the hardware from everywhere, this makes
          * it impossible to find from userspace.
          */
-        cfg80211_debugfs_rdev_del(rdev);
-        list_del(&rdev->list);
+        debugfs_remove_recursive(rdev->wiphy.debugfsdir);
+        list_del_rcu(&rdev->list);
+        synchronize_rcu();
 
         /*
          * Try to grab rdev->mtx. If a command is still in progress,
@@ -565,7 +585,6 @@ void wiphy_unregister(struct wiphy *wiphy)
 
         cfg80211_rdev_list_generation++;
         device_del(&rdev->wiphy.dev);
-        debugfs_remove(rdev->wiphy.debugfsdir);
 
         mutex_unlock(&cfg80211_mutex);
 
@@ -626,6 +645,10 @@ static void wdev_cleanup_work(struct work_struct *work)
         dev_put(wdev->netdev);
 }
 
+static struct device_type wiphy_type = {
+        .name   = "wlan",
+};
+
 static int cfg80211_netdev_notifier_call(struct notifier_block * nb,
                                          unsigned long state,
                                          void *ndev)
@@ -642,6 +665,9 @@ static int cfg80211_netdev_notifier_call(struct notifier_block * nb,
         WARN_ON(wdev->iftype == NL80211_IFTYPE_UNSPECIFIED);
 
         switch (state) {
+        case NETDEV_POST_INIT:
+                SET_NETDEV_DEVTYPE(dev, &wiphy_type);
+                break;
         case NETDEV_REGISTER:
                 /*
                  * NB: cannot take rdev->mtx here because this may be
@@ -652,8 +678,11 @@ static int cfg80211_netdev_notifier_call(struct notifier_block * nb,
                 INIT_WORK(&wdev->cleanup_work, wdev_cleanup_work);
                 INIT_LIST_HEAD(&wdev->event_list);
                 spin_lock_init(&wdev->event_lock);
+                INIT_LIST_HEAD(&wdev->action_registrations);
+                spin_lock_init(&wdev->action_registrations_lock);
+
                 mutex_lock(&rdev->devlist_mtx);
-                list_add(&wdev->list, &rdev->netdev_list);
+                list_add_rcu(&wdev->list, &rdev->netdev_list);
                 rdev->devlist_generation++;
                 /* can only change netns with wiphy */
                 dev->features |= NETIF_F_NETNS_LOCAL;
@@ -666,22 +695,31 @@ static int cfg80211_netdev_notifier_call(struct notifier_block * nb,
                 wdev->netdev = dev;
                 wdev->sme_state = CFG80211_SME_IDLE;
                 mutex_unlock(&rdev->devlist_mtx);
-#ifdef CONFIG_WIRELESS_EXT
-                if (!dev->wireless_handlers)
-                        dev->wireless_handlers = &cfg80211_wext_handler;
+#ifdef CONFIG_CFG80211_WEXT
                 wdev->wext.default_key = -1;
                 wdev->wext.default_mgmt_key = -1;
                 wdev->wext.connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
-                wdev->wext.ps = wdev->wiphy->ps_default;
-                wdev->wext.ps_timeout = 100;
+#endif
+
+                if (wdev->wiphy->flags & WIPHY_FLAG_PS_ON_BY_DEFAULT)
+                        wdev->ps = true;
+                else
+                        wdev->ps = false;
+                wdev->ps_timeout = 100;
                 if (rdev->ops->set_power_mgmt)
                         if (rdev->ops->set_power_mgmt(wdev->wiphy, dev,
-                                                      wdev->wext.ps,
-                                                      wdev->wext.ps_timeout)) {
+                                                      wdev->ps,
+                                                      wdev->ps_timeout)) {
                                 /* assume this means it's off */
-                                wdev->wext.ps = false;
+                                wdev->ps = false;
                         }
-#endif
+
+                if (!dev->ethtool_ops)
+                        dev->ethtool_ops = &cfg80211_ethtool_ops;
+
+                if ((wdev->iftype == NL80211_IFTYPE_STATION ||
+                     wdev->iftype == NL80211_IFTYPE_ADHOC) && !wdev->use_4addr)
+                        dev->priv_flags |= IFF_DONT_BRIDGE;
                 break;
         case NETDEV_GOING_DOWN:
                 switch (wdev->iftype) {
@@ -690,7 +728,7 @@ static int cfg80211_netdev_notifier_call(struct notifier_block * nb,
                         break;
                 case NL80211_IFTYPE_STATION:
                         wdev_lock(wdev);
-#ifdef CONFIG_WIRELESS_EXT
+#ifdef CONFIG_CFG80211_WEXT
                         kfree(wdev->wext.ie);
                         wdev->wext.ie = NULL;
                         wdev->wext.ie_len = 0;
@@ -707,7 +745,7 @@ static int cfg80211_netdev_notifier_call(struct notifier_block * nb,
                 break;
         case NETDEV_DOWN:
                 dev_hold(dev);
-                schedule_work(&wdev->cleanup_work);
+                queue_work(cfg80211_wq, &wdev->cleanup_work);
                 break;
         case NETDEV_UP:
                 /*
@@ -722,9 +760,9 @@ static int cfg80211_netdev_notifier_call(struct notifier_block * nb,
                         mutex_unlock(&rdev->devlist_mtx);
                         dev_put(dev);
                 }
-#ifdef CONFIG_WIRELESS_EXT
                 cfg80211_lock_rdev(rdev);
                 mutex_lock(&rdev->devlist_mtx);
+#ifdef CONFIG_CFG80211_WEXT
                 wdev_lock(wdev);
                 switch (wdev->iftype) {
                 case NL80211_IFTYPE_ADHOC:
@@ -737,10 +775,10 @@ static int cfg80211_netdev_notifier_call(struct notifier_block * nb,
                         break;
                 }
                 wdev_unlock(wdev);
+#endif
                 rdev->opencount++;
                 mutex_unlock(&rdev->devlist_mtx);
                 cfg80211_unlock_rdev(rdev);
-#endif
                 break;
         case NETDEV_UNREGISTER:
                 /*
@@ -758,13 +796,22 @@ static int cfg80211_netdev_notifier_call(struct notifier_block * nb,
                  */
                 if (!list_empty(&wdev->list)) {
                         sysfs_remove_link(&dev->dev.kobj, "phy80211");
-                        list_del_init(&wdev->list);
+                        list_del_rcu(&wdev->list);
                         rdev->devlist_generation++;
-#ifdef CONFIG_WIRELESS_EXT
+                        cfg80211_mlme_purge_actions(wdev);
+#ifdef CONFIG_CFG80211_WEXT
                         kfree(wdev->wext.keys);
 #endif
                 }
                 mutex_unlock(&rdev->devlist_mtx);
+                /*
+                 * synchronise (so that we won't find this netdev
+                 * from other code any more) and then clear the list
+                 * head so that the above code can safely check for
+                 * !list_empty() to avoid double-cleanup.
+                 */
+                synchronize_rcu();
+                INIT_LIST_HEAD(&wdev->list);
                 break;
         case NETDEV_PRE_UP:
                 if (!(wdev->wiphy->interface_modes & BIT(wdev->iftype)))
@@ -825,8 +872,14 @@ static int __init cfg80211_init(void)
         if (err)
                 goto out_fail_reg;
 
+        cfg80211_wq = create_singlethread_workqueue("cfg80211");
+        if (!cfg80211_wq)
+                goto out_fail_wq;
+
         return 0;
 
+out_fail_wq:
+        regulatory_exit();
 out_fail_reg:
         debugfs_remove(ieee80211_debugfs_dir);
 out_fail_nl80211:
@@ -848,5 +901,6 @@ static void cfg80211_exit(void)
         wiphy_sysfs_exit();
         regulatory_exit();
         unregister_pernet_device(&cfg80211_pernet_ops);
+        destroy_workqueue(cfg80211_wq);
 }
 module_exit(cfg80211_exit);
diff --git a/net/wireless/core.h b/net/wireless/core.h
index 68b321997d4c..d52da913145a 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -1,7 +1,7 @@
 /*
  * Wireless configuration interface internals.
  *
- * Copyright 2006-2009  Johannes Berg <johannes@sipsolutions.net>
+ * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
  */
 #ifndef __NET_WIRELESS_CORE_H
 #define __NET_WIRELESS_CORE_H
@@ -48,6 +48,7 @@ struct cfg80211_registered_device {
 
         /* associate netdev list */
         struct mutex devlist_mtx;
+        /* protected by devlist_mtx or RCU */
         struct list_head netdev_list;
         int devlist_generation;
         int opencount; /* also protected by devlist_mtx */
@@ -72,17 +73,6 @@ struct cfg80211_registered_device {
         /* current channel */
         struct ieee80211_channel *channel;
 
-#ifdef CONFIG_CFG80211_DEBUGFS
-        /* Debugfs entries */
-        struct wiphy_debugfsdentries {
-                struct dentry *rts_threshold;
-                struct dentry *fragmentation_threshold;
-                struct dentry *short_retry_limit;
-                struct dentry *long_retry_limit;
-                struct dentry *ht40allow_map;
-        } debugfs;
-#endif
-
         /* must be last because of the way we do wiphy_priv(),
          * and it should at least be aligned to NETDEV_ALIGN */
         struct wiphy wiphy __attribute__((__aligned__(NETDEV_ALIGN)));
@@ -102,6 +92,8 @@ bool wiphy_idx_valid(int wiphy_idx)
         return (wiphy_idx >= 0);
 }
 
+
+extern struct workqueue_struct *cfg80211_wq;
 extern struct mutex cfg80211_mutex;
 extern struct list_head cfg80211_rdev_list;
 extern int cfg80211_rdev_list_generation;
@@ -120,7 +112,8 @@ struct cfg80211_internal_bss {
         unsigned long ts;
         struct kref ref;
         atomic_t hold;
-        bool ies_allocated;
+        bool beacon_ies_allocated;
+        bool proberesp_ies_allocated;
 
         /* must be last because of priv member */
         struct cfg80211_bss pub;
@@ -284,6 +277,8 @@ int cfg80211_join_ibss(struct cfg80211_registered_device *rdev,
                        struct cfg80211_ibss_params *params,
                        struct cfg80211_cached_keys *connkeys);
 void cfg80211_clear_ibss(struct net_device *dev, bool nowext);
+int __cfg80211_leave_ibss(struct cfg80211_registered_device *rdev,
+                          struct net_device *dev, bool nowext);
 int cfg80211_leave_ibss(struct cfg80211_registered_device *rdev,
                         struct net_device *dev, bool nowext);
 void __cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid);
@@ -334,6 +329,15 @@ void __cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
                                const u8 *resp_ie, size_t resp_ie_len,
                                u16 status, bool wextev,
                                struct cfg80211_bss *bss);
+int cfg80211_mlme_register_action(struct wireless_dev *wdev, u32 snd_pid,
+                                  const u8 *match_data, int match_len);
+void cfg80211_mlme_unregister_actions(struct wireless_dev *wdev, u32 nlpid);
+void cfg80211_mlme_purge_actions(struct wireless_dev *wdev);
+int cfg80211_mlme_action(struct cfg80211_registered_device *rdev,
+                         struct net_device *dev,
+                         struct ieee80211_channel *chan,
+                         enum nl80211_channel_type channel_type,
+                         const u8 *buf, size_t len, u64 *cookie);
 
 /* SME */
 int __cfg80211_connect(struct cfg80211_registered_device *rdev,
@@ -381,10 +385,15 @@ void cfg80211_process_rdev_events(struct cfg80211_registered_device *rdev);
 struct ieee80211_channel *
 rdev_fixed_channel(struct cfg80211_registered_device *rdev,
                    struct wireless_dev *for_wdev);
+struct ieee80211_channel *
+rdev_freq_to_chan(struct cfg80211_registered_device *rdev,
+                  int freq, enum nl80211_channel_type channel_type);
 int rdev_set_freq(struct cfg80211_registered_device *rdev,
                   struct wireless_dev *for_wdev,
                   int freq, enum nl80211_channel_type channel_type);
 
+u16 cfg80211_calculate_bitrate(struct rate_info *rate);
+
 #ifdef CONFIG_CFG80211_DEVELOPER_WARNINGS
 #define CFG80211_DEV_WARN_ON(cond)      WARN_ON(cond)
 #else
diff --git a/net/wireless/db.txt b/net/wireless/db.txt
new file mode 100644
index 000000000000..a2fc3a09ccdc
--- /dev/null
+++ b/net/wireless/db.txt
@@ -0,0 +1,17 @@
+#
+# This file is a placeholder to prevent accidental build breakage if someone
+# enables CONFIG_CFG80211_INTERNAL_REGDB.  Almost no one actually needs to
+# enable that build option.
+#
+# You should be using CRDA instead.  It is even better if you use the CRDA
+# package provided by your distribution, since they will probably keep it
+# up-to-date on your behalf.
+#
+# If you _really_ intend to use CONFIG_CFG80211_INTERNAL_REGDB then you will
+# need to replace this file with one containing appropriately formatted
+# regulatory rules that cover the regulatory domains you will be using.  Your
+# best option is to extract the db.txt file from the wireless-regdb git
+# repository:
+#
+#   git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-regdb.git
+#
diff --git a/net/wireless/debugfs.c b/net/wireless/debugfs.c
index 13d93d84f902..a4991a3efec0 100644
--- a/net/wireless/debugfs.c
+++ b/net/wireless/debugfs.c
@@ -9,6 +9,7 @@
  * published by the Free Software Foundation.
  */
 
+#include <linux/slab.h>
 #include "core.h"
 #include "debugfs.h"
 
@@ -104,11 +105,7 @@ static const struct file_operations ht40allow_map_ops = {
 };
 
 #define DEBUGFS_ADD(name)                                               \
-        rdev->debugfs.name = debugfs_create_file(#name, S_IRUGO, phyd,  \
-                                                  &rdev->wiphy, &name## _ops);
-#define DEBUGFS_DEL(name)                                               \
-        debugfs_remove(rdev->debugfs.name);                             \
-        rdev->debugfs.name = NULL;
+        debugfs_create_file(#name, S_IRUGO, phyd, &rdev->wiphy, &name## _ops);
 
 void cfg80211_debugfs_rdev_add(struct cfg80211_registered_device *rdev)
 {
@@ -120,12 +117,3 @@ void cfg80211_debugfs_rdev_add(struct cfg80211_registered_device *rdev)
         DEBUGFS_ADD(long_retry_limit);
         DEBUGFS_ADD(ht40allow_map);
 }
-
-void cfg80211_debugfs_rdev_del(struct cfg80211_registered_device *rdev)
-{
-        DEBUGFS_DEL(rts_threshold);
-        DEBUGFS_DEL(fragmentation_threshold);
-        DEBUGFS_DEL(short_retry_limit);
-        DEBUGFS_DEL(long_retry_limit);
-        DEBUGFS_DEL(ht40allow_map);
-}
diff --git a/net/wireless/debugfs.h b/net/wireless/debugfs.h
index 6419b6d6ce3e..74fdd3811427 100644
--- a/net/wireless/debugfs.h
+++ b/net/wireless/debugfs.h
@@ -3,12 +3,9 @@
 
 #ifdef CONFIG_CFG80211_DEBUGFS
 void cfg80211_debugfs_rdev_add(struct cfg80211_registered_device *rdev);
-void cfg80211_debugfs_rdev_del(struct cfg80211_registered_device *rdev);
 #else
 static inline
 void cfg80211_debugfs_rdev_add(struct cfg80211_registered_device *rdev) {}
-static inline
-void cfg80211_debugfs_rdev_del(struct cfg80211_registered_device *rdev) {}
 #endif
 
 #endif /* __CFG80211_DEBUGFS_H */
diff --git a/net/wireless/ethtool.c b/net/wireless/ethtool.c
new file mode 100644
index 000000000000..ca4c825be93d
--- /dev/null
+++ b/net/wireless/ethtool.c
@@ -0,0 +1,45 @@
+#include <linux/utsname.h>
+#include <net/cfg80211.h>
+#include "ethtool.h"
+
+static void cfg80211_get_drvinfo(struct net_device *dev,
+                                        struct ethtool_drvinfo *info)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+
+        strlcpy(info->driver, wiphy_dev(wdev->wiphy)->driver->name,
+                sizeof(info->driver));
+
+        strlcpy(info->version, init_utsname()->release, sizeof(info->version));
+
+        if (wdev->wiphy->fw_version[0])
+                strncpy(info->fw_version, wdev->wiphy->fw_version,
+                        sizeof(info->fw_version));
+        else
+                strncpy(info->fw_version, "N/A", sizeof(info->fw_version));
+
+        strlcpy(info->bus_info, dev_name(wiphy_dev(wdev->wiphy)),
+                sizeof(info->bus_info));
+}
+
+static int cfg80211_get_regs_len(struct net_device *dev)
+{
+        /* For now, return 0... */
+        return 0;
+}
+
+static void cfg80211_get_regs(struct net_device *dev, struct ethtool_regs *regs,
+                        void *data)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+
+        regs->version = wdev->wiphy->hw_version;
+        regs->len = 0;
+}
+
+const struct ethtool_ops cfg80211_ethtool_ops = {
+        .get_drvinfo = cfg80211_get_drvinfo,
+        .get_regs_len = cfg80211_get_regs_len,
+        .get_regs = cfg80211_get_regs,
+        .get_link = ethtool_op_get_link,
+};
diff --git a/net/wireless/ethtool.h b/net/wireless/ethtool.h
new file mode 100644
index 000000000000..695ecad20bd6
--- /dev/null
+++ b/net/wireless/ethtool.h
@@ -0,0 +1,6 @@
+#ifndef __CFG80211_ETHTOOL__
+#define __CFG80211_ETHTOOL__
+
+extern const struct ethtool_ops cfg80211_ethtool_ops;
+
+#endif /* __CFG80211_ETHTOOL__ */
diff --git a/net/wireless/genregdb.awk b/net/wireless/genregdb.awk
new file mode 100644
index 000000000000..3cc9e69880a8
--- /dev/null
+++ b/net/wireless/genregdb.awk
@@ -0,0 +1,118 @@
+#!/usr/bin/awk -f
+#
+# genregdb.awk -- generate regdb.c from db.txt
+#
+# Actually, it reads from stdin (presumed to be db.txt) and writes
+# to stdout (presumed to be regdb.c), but close enough...
+#
+# Copyright 2009 John W. Linville <linville@tuxdriver.com>
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 as
+# published by the Free Software Foundation.
+#
+
+BEGIN {
+        active = 0
+        rules = 0;
+        print "/*"
+        print " * DO NOT EDIT -- file generated from data in db.txt"
+        print " */"
+        print ""
+        print "#include <linux/nl80211.h>"
+        print "#include <net/cfg80211.h>"
+        print ""
+        regdb = "const struct ieee80211_regdomain *reg_regdb[] = {\n"
+}
+
+/^[ \t]*#/ {
+        # Ignore
+}
+
+!active && /^[ \t]*$/ {
+        # Ignore
+}
+
+!active && /country/ {
+        country=$2
+        sub(/:/, "", country)
+        printf "static const struct ieee80211_regdomain regdom_%s = {\n", country
+        printf "\t.alpha2 = \"%s\",\n", country
+        printf "\t.reg_rules = {\n"
+        active = 1
+        regdb = regdb "\t&regdom_" country ",\n"
+}
+
+active && /^[ \t]*\(/ {
+        start = $1
+        sub(/\(/, "", start)
+        end = $3
+        bw = $5
+        sub(/\),/, "", bw)
+        gain = $6
+        sub(/\(/, "", gain)
+        sub(/,/, "", gain)
+        power = $7
+        sub(/\)/, "", power)
+        sub(/,/, "", power)
+        # power might be in mW...
+        units = $8
+        sub(/\)/, "", units)
+        sub(/,/, "", units)
+        if (units == "mW") {
+                if (power == 100) {
+                        power = 20
+                } else if (power == 200) {
+                        power = 23
+                } else if (power == 500) {
+                        power = 27
+                } else if (power == 1000) {
+                        power = 30
+                } else {
+                        print "Unknown power value in database!"
+                }
+        }
+        flagstr = ""
+        for (i=8; i<=NF; i++)
+                flagstr = flagstr $i
+        split(flagstr, flagarray, ",")
+        flags = ""
+        for (arg in flagarray) {
+                if (flagarray[arg] == "NO-OFDM") {
+                        flags = flags "\n\t\t\tNL80211_RRF_NO_OFDM | "
+                } else if (flagarray[arg] == "NO-CCK") {
+                        flags = flags "\n\t\t\tNL80211_RRF_NO_CCK | "
+                } else if (flagarray[arg] == "NO-INDOOR") {
+                        flags = flags "\n\t\t\tNL80211_RRF_NO_INDOOR | "
+                } else if (flagarray[arg] == "NO-OUTDOOR") {
+                        flags = flags "\n\t\t\tNL80211_RRF_NO_OUTDOOR | "
+                } else if (flagarray[arg] == "DFS") {
+                        flags = flags "\n\t\t\tNL80211_RRF_DFS | "
+                } else if (flagarray[arg] == "PTP-ONLY") {
+                        flags = flags "\n\t\t\tNL80211_RRF_PTP_ONLY | "
+                } else if (flagarray[arg] == "PTMP-ONLY") {
+                        flags = flags "\n\t\t\tNL80211_RRF_PTMP_ONLY | "
+                } else if (flagarray[arg] == "PASSIVE-SCAN") {
+                        flags = flags "\n\t\t\tNL80211_RRF_PASSIVE_SCAN | "
+                } else if (flagarray[arg] == "NO-IBSS") {
+                        flags = flags "\n\t\t\tNL80211_RRF_NO_IBSS | "
+                }
+        }
+        flags = flags "0"
+        printf "\t\tREG_RULE(%d, %d, %d, %d, %d, %s),\n", start, end, bw, gain, power, flags
+        rules++
+}
+
+active && /^[ \t]*$/ {
+        active = 0
+        printf "\t},\n"
+        printf "\t.n_reg_rules = %d\n", rules
+        printf "};\n\n"
+        rules = 0;
+}
+
+END {
+        print regdb "};"
+        print ""
+        print "int reg_regdb_size = ARRAY_SIZE(reg_regdb);"
+}
diff --git a/net/wireless/ibss.c b/net/wireless/ibss.c
index c88338911979..6a5acf750174 100644
--- a/net/wireless/ibss.c
+++ b/net/wireless/ibss.c
@@ -6,6 +6,7 @@
 
 #include <linux/etherdevice.h>
 #include <linux/if_arp.h>
+#include <linux/slab.h>
 #include <net/cfg80211.h>
 #include "wext-compat.h"
 #include "nl80211.h"
@@ -15,7 +16,7 @@ void __cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         struct cfg80211_bss *bss;
-#ifdef CONFIG_WIRELESS_EXT
+#ifdef CONFIG_CFG80211_WEXT
         union iwreq_data wrqu;
 #endif
 
@@ -44,7 +45,7 @@ void __cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid)
 
         nl80211_send_ibss_bssid(wiphy_to_dev(wdev->wiphy), dev, bssid,
                                 GFP_KERNEL);
-#ifdef CONFIG_WIRELESS_EXT
+#ifdef CONFIG_CFG80211_WEXT
         memset(&wrqu, 0, sizeof(wrqu));
         memcpy(wrqu.ap_addr.sa_data, bssid, ETH_ALEN);
         wireless_send_event(dev, SIOCGIWAP, &wrqu, NULL);
@@ -70,7 +71,7 @@ void cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid, gfp_t gfp)
         spin_lock_irqsave(&wdev->event_lock, flags);
         list_add_tail(&ev->list, &wdev->event_list);
         spin_unlock_irqrestore(&wdev->event_lock, flags);
-        schedule_work(&rdev->event_work);
+        queue_work(cfg80211_wq, &rdev->event_work);
 }
 EXPORT_SYMBOL(cfg80211_ibss_joined);
 
@@ -96,7 +97,7 @@ int __cfg80211_join_ibss(struct cfg80211_registered_device *rdev,
                 kfree(wdev->connect_keys);
         wdev->connect_keys = connkeys;
 
-#ifdef CONFIG_WIRELESS_EXT
+#ifdef CONFIG_CFG80211_WEXT
         wdev->wext.ibss.channel = params->channel;
 #endif
         err = rdev->ops->join_ibss(&rdev->wiphy, dev, params);
@@ -154,7 +155,7 @@ static void __cfg80211_clear_ibss(struct net_device *dev, bool nowext)
 
         wdev->current_bss = NULL;
         wdev->ssid_len = 0;
-#ifdef CONFIG_WIRELESS_EXT
+#ifdef CONFIG_CFG80211_WEXT
         if (!nowext)
                 wdev->wext.ibss.ssid_len = 0;
 #endif
@@ -169,8 +170,8 @@ void cfg80211_clear_ibss(struct net_device *dev, bool nowext)
         wdev_unlock(wdev);
 }
 
-static int __cfg80211_leave_ibss(struct cfg80211_registered_device *rdev,
-                                 struct net_device *dev, bool nowext)
+int __cfg80211_leave_ibss(struct cfg80211_registered_device *rdev,
+                          struct net_device *dev, bool nowext)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         int err;
@@ -203,7 +204,7 @@ int cfg80211_leave_ibss(struct cfg80211_registered_device *rdev,
         return err;
 }
 
-#ifdef CONFIG_WIRELESS_EXT
+#ifdef CONFIG_CFG80211_WEXT
 int cfg80211_ibss_wext_join(struct cfg80211_registered_device *rdev,
                             struct wireless_dev *wdev)
 {
diff --git a/net/wireless/lib80211_crypt_ccmp.c b/net/wireless/lib80211_crypt_ccmp.c
index 2301dc1edc4c..b7fa31d5fd13 100644
--- a/net/wireless/lib80211_crypt_ccmp.c
+++ b/net/wireless/lib80211_crypt_ccmp.c
@@ -237,7 +237,6 @@ static int lib80211_ccmp_encrypt(struct sk_buff *skb, int hdr_len, void *priv)
                 return -1;
 
         pos = skb->data + hdr_len + CCMP_HDR_LEN;
-        mic = skb_put(skb, CCMP_MIC_LEN);
         hdr = (struct ieee80211_hdr *)skb->data;
         ccmp_init_blocks(key->tfm, hdr, key->tx_pn, data_len, b0, b, s0);
 
@@ -257,6 +256,7 @@ static int lib80211_ccmp_encrypt(struct sk_buff *skb, int hdr_len, void *priv)
                 pos += len;
         }
 
+        mic = skb_put(skb, CCMP_MIC_LEN);
         for (i = 0; i < CCMP_MIC_LEN; i++)
                 mic[i] = b[i] ^ s0[i];
 
diff --git a/net/wireless/lib80211_crypt_tkip.c b/net/wireless/lib80211_crypt_tkip.c
index c36287399d7e..8cbdb32ff316 100644
--- a/net/wireless/lib80211_crypt_tkip.c
+++ b/net/wireless/lib80211_crypt_tkip.c
@@ -36,6 +36,8 @@ MODULE_AUTHOR("Jouni Malinen");
 MODULE_DESCRIPTION("lib80211 crypt: TKIP");
 MODULE_LICENSE("GPL");
 
+#define TKIP_HDR_LEN 8
+
 struct lib80211_tkip_data {
 #define TKIP_KEY_LEN 32
         u8 key[TKIP_KEY_LEN];
@@ -314,13 +316,12 @@ static int lib80211_tkip_hdr(struct sk_buff *skb, int hdr_len,
                               u8 * rc4key, int keylen, void *priv)
 {
         struct lib80211_tkip_data *tkey = priv;
-        int len;
         u8 *pos;
         struct ieee80211_hdr *hdr;
 
         hdr = (struct ieee80211_hdr *)skb->data;
 
-        if (skb_headroom(skb) < 8 || skb->len < hdr_len)
+        if (skb_headroom(skb) < TKIP_HDR_LEN || skb->len < hdr_len)
                 return -1;
 
         if (rc4key == NULL || keylen < 16)
@@ -333,9 +334,8 @@ static int lib80211_tkip_hdr(struct sk_buff *skb, int hdr_len,
         }
         tkip_mixing_phase2(rc4key, tkey->key, tkey->tx_ttak, tkey->tx_iv16);
 
-        len = skb->len - hdr_len;
-        pos = skb_push(skb, 8);
-        memmove(pos, pos + 8, hdr_len);
+        pos = skb_push(skb, TKIP_HDR_LEN);
+        memmove(pos, pos + TKIP_HDR_LEN, hdr_len);
         pos += hdr_len;
 
         *pos++ = *rc4key;
@@ -353,7 +353,7 @@ static int lib80211_tkip_hdr(struct sk_buff *skb, int hdr_len,
                 tkey->tx_iv32++;
         }
 
-        return 8;
+        return TKIP_HDR_LEN;
 }
 
 static int lib80211_tkip_encrypt(struct sk_buff *skb, int hdr_len, void *priv)
@@ -384,9 +384,8 @@ static int lib80211_tkip_encrypt(struct sk_buff *skb, int hdr_len, void *priv)
         if ((lib80211_tkip_hdr(skb, hdr_len, rc4key, 16, priv)) < 0)
                 return -1;
 
-        icv = skb_put(skb, 4);
-
         crc = ~crc32_le(~0, pos, len);
+        icv = skb_put(skb, 4);
         icv[0] = crc;
         icv[1] = crc >> 8;
         icv[2] = crc >> 16;
@@ -434,7 +433,7 @@ static int lib80211_tkip_decrypt(struct sk_buff *skb, int hdr_len, void *priv)
                 return -1;
         }
 
-        if (skb->len < hdr_len + 8 + 4)
+        if (skb->len < hdr_len + TKIP_HDR_LEN + 4)
                 return -1;
 
         pos = skb->data + hdr_len;
@@ -462,7 +461,7 @@ static int lib80211_tkip_decrypt(struct sk_buff *skb, int hdr_len, void *priv)
         }
         iv16 = (pos[0] << 8) | pos[2];
         iv32 = pos[4] | (pos[5] << 8) | (pos[6] << 16) | (pos[7] << 24);
-        pos += 8;
+        pos += TKIP_HDR_LEN;
 
         if (tkip_replay_check(iv32, iv16, tkey->rx_iv32, tkey->rx_iv16)) {
 #ifdef CONFIG_LIB80211_DEBUG
@@ -523,8 +522,8 @@ static int lib80211_tkip_decrypt(struct sk_buff *skb, int hdr_len, void *priv)
         tkey->rx_iv16_new = iv16;
 
         /* Remove IV and ICV */
-        memmove(skb->data + 8, skb->data, hdr_len);
-        skb_pull(skb, 8);
+        memmove(skb->data + TKIP_HDR_LEN, skb->data, hdr_len);
+        skb_pull(skb, TKIP_HDR_LEN);
         skb_trim(skb, skb->len - 4);
 
         return keyidx;
diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c
index 0a6b7a0eca6b..22139fa46115 100644
--- a/net/wireless/mlme.c
+++ b/net/wireless/mlme.c
@@ -8,6 +8,7 @@
 #include <linux/module.h>
 #include <linux/netdevice.h>
 #include <linux/nl80211.h>
+#include <linux/slab.h>
 #include <linux/wireless.h>
 #include <net/cfg80211.h>
 #include <net/iw_handler.h>
@@ -62,7 +63,6 @@ void cfg80211_send_rx_assoc(struct net_device *dev, const u8 *buf, size_t len)
         u8 *ie = mgmt->u.assoc_resp.variable;
         int i, ieoffs = offsetof(struct ieee80211_mgmt, u.assoc_resp.variable);
         struct cfg80211_internal_bss *bss = NULL;
-        bool need_connect_result = true;
 
         wdev_lock(wdev);
 
@@ -94,10 +94,20 @@ void cfg80211_send_rx_assoc(struct net_device *dev, const u8 *buf, size_t len)
                         }
                 }
 
-                WARN_ON(!bss);
+                /*
+                 * We might be coming here because the driver reported
+                 * a successful association at the same time as the
+                 * user requested a deauth. In that case, we will have
+                 * removed the BSS from the auth_bsses list due to the
+                 * deauth request when the assoc response makes it. If
+                 * the two code paths acquire the lock the other way
+                 * around, that's just the standard situation of a
+                 * deauth being requested while connected.
+                 */
+                if (!bss)
+                        goto out;
         } else if (wdev->conn) {
                 cfg80211_sme_failed_assoc(wdev);
-                need_connect_result = false;
                 /*
                  * do not call connect_result() now because the
                  * sme will schedule work that does it later.
@@ -130,7 +140,7 @@ void cfg80211_send_rx_assoc(struct net_device *dev, const u8 *buf, size_t len)
 }
 EXPORT_SYMBOL(cfg80211_send_rx_assoc);
 
-static void __cfg80211_send_deauth(struct net_device *dev,
+void __cfg80211_send_deauth(struct net_device *dev,
                                    const u8 *buf, size_t len)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
@@ -139,25 +149,23 @@ static void __cfg80211_send_deauth(struct net_device *dev,
         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
         const u8 *bssid = mgmt->bssid;
         int i;
-        bool done = false;
+        bool found = false;
 
         ASSERT_WDEV_LOCK(wdev);
 
-        nl80211_send_deauth(rdev, dev, buf, len, GFP_KERNEL);
-
         if (wdev->current_bss &&
             memcmp(wdev->current_bss->pub.bssid, bssid, ETH_ALEN) == 0) {
-                done = true;
                 cfg80211_unhold_bss(wdev->current_bss);
                 cfg80211_put_bss(&wdev->current_bss->pub);
                 wdev->current_bss = NULL;
+                found = true;
         } else for (i = 0; i < MAX_AUTH_BSSES; i++) {
                 if (wdev->auth_bsses[i] &&
                     memcmp(wdev->auth_bsses[i]->pub.bssid, bssid, ETH_ALEN) == 0) {
                         cfg80211_unhold_bss(wdev->auth_bsses[i]);
                         cfg80211_put_bss(&wdev->auth_bsses[i]->pub);
                         wdev->auth_bsses[i] = NULL;
-                        done = true;
+                        found = true;
                         break;
                 }
                 if (wdev->authtry_bsses[i] &&
@@ -165,12 +173,15 @@ static void __cfg80211_send_deauth(struct net_device *dev,
                         cfg80211_unhold_bss(wdev->authtry_bsses[i]);
                         cfg80211_put_bss(&wdev->authtry_bsses[i]->pub);
                         wdev->authtry_bsses[i] = NULL;
-                        done = true;
+                        found = true;
                         break;
                 }
         }
 
-        WARN_ON(!done);
+        if (!found)
+                return;
+
+        nl80211_send_deauth(rdev, dev, buf, len, GFP_KERNEL);
 
         if (wdev->sme_state == CFG80211_SME_CONNECTED) {
                 u16 reason_code;
@@ -186,27 +197,19 @@ static void __cfg80211_send_deauth(struct net_device *dev,
                                           false, NULL);
         }
 }
+EXPORT_SYMBOL(__cfg80211_send_deauth);
 
-
-void cfg80211_send_deauth(struct net_device *dev, const u8 *buf, size_t len,
-                          void *cookie)
+void cfg80211_send_deauth(struct net_device *dev, const u8 *buf, size_t len)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
 
-        BUG_ON(cookie && wdev != cookie);
-
-        if (cookie) {
-                /* called within callback */
-                __cfg80211_send_deauth(dev, buf, len);
-        } else {
-                wdev_lock(wdev);
-                __cfg80211_send_deauth(dev, buf, len);
-                wdev_unlock(wdev);
-        }
+        wdev_lock(wdev);
+        __cfg80211_send_deauth(dev, buf, len);
+        wdev_unlock(wdev);
 }
 EXPORT_SYMBOL(cfg80211_send_deauth);
 
-static void __cfg80211_send_disassoc(struct net_device *dev,
+void __cfg80211_send_disassoc(struct net_device *dev,
                                      const u8 *buf, size_t len)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
@@ -247,40 +250,24 @@ static void __cfg80211_send_disassoc(struct net_device *dev,
         from_ap = memcmp(mgmt->sa, dev->dev_addr, ETH_ALEN) != 0;
         __cfg80211_disconnected(dev, NULL, 0, reason_code, from_ap);
 }
+EXPORT_SYMBOL(__cfg80211_send_disassoc);
 
-void cfg80211_send_disassoc(struct net_device *dev, const u8 *buf, size_t len,
-                            void *cookie)
+void cfg80211_send_disassoc(struct net_device *dev, const u8 *buf, size_t len)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
 
-        BUG_ON(cookie && wdev != cookie);
-
-        if (cookie) {
-                /* called within callback */
-                __cfg80211_send_disassoc(dev, buf, len);
-        } else {
-                wdev_lock(wdev);
-                __cfg80211_send_disassoc(dev, buf, len);
-                wdev_unlock(wdev);
-        }
+        wdev_lock(wdev);
+        __cfg80211_send_disassoc(dev, buf, len);
+        wdev_unlock(wdev);
 }
 EXPORT_SYMBOL(cfg80211_send_disassoc);
 
-void cfg80211_send_auth_timeout(struct net_device *dev, const u8 *addr)
+static void __cfg80211_auth_remove(struct wireless_dev *wdev, const u8 *addr)
 {
-        struct wireless_dev *wdev = dev->ieee80211_ptr;
-        struct wiphy *wiphy = wdev->wiphy;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
         int i;
         bool done = false;
 
-        wdev_lock(wdev);
-
-        nl80211_send_auth_timeout(rdev, dev, addr, GFP_KERNEL);
-        if (wdev->sme_state == CFG80211_SME_CONNECTING)
-                __cfg80211_connect_result(dev, addr, NULL, 0, NULL, 0,
-                                          WLAN_STATUS_UNSPECIFIED_FAILURE,
-                                          false, NULL);
+        ASSERT_WDEV_LOCK(wdev);
 
         for (i = 0; addr && i < MAX_AUTH_BSSES; i++) {
                 if (wdev->authtry_bsses[i] &&
@@ -295,6 +282,29 @@ void cfg80211_send_auth_timeout(struct net_device *dev, const u8 *addr)
         }
 
         WARN_ON(!done);
+}
+
+void __cfg80211_auth_canceled(struct net_device *dev, const u8 *addr)
+{
+        __cfg80211_auth_remove(dev->ieee80211_ptr, addr);
+}
+EXPORT_SYMBOL(__cfg80211_auth_canceled);
+
+void cfg80211_send_auth_timeout(struct net_device *dev, const u8 *addr)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct wiphy *wiphy = wdev->wiphy;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+
+        wdev_lock(wdev);
+
+        nl80211_send_auth_timeout(rdev, dev, addr, GFP_KERNEL);
+        if (wdev->sme_state == CFG80211_SME_CONNECTING)
+                __cfg80211_connect_result(dev, addr, NULL, 0, NULL, 0,
+                                          WLAN_STATUS_UNSPECIFIED_FAILURE,
+                                          false, NULL);
+
+        __cfg80211_auth_remove(wdev, addr);
 
         wdev_unlock(wdev);
 }
@@ -340,7 +350,7 @@ void cfg80211_michael_mic_failure(struct net_device *dev, const u8 *addr,
 {
         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
-#ifdef CONFIG_WIRELESS_EXT
+#ifdef CONFIG_CFG80211_WEXT
         union iwreq_data wrqu;
         char *buf = kmalloc(128, gfp);
 
@@ -469,12 +479,23 @@ int __cfg80211_mlme_assoc(struct cfg80211_registered_device *rdev,
         struct cfg80211_assoc_request req;
         struct cfg80211_internal_bss *bss;
         int i, err, slot = -1;
+        bool was_connected = false;
 
         ASSERT_WDEV_LOCK(wdev);
 
         memset(&req, 0, sizeof(req));
 
-        if (wdev->current_bss)
+        if (wdev->current_bss && prev_bssid &&
+            memcmp(wdev->current_bss->pub.bssid, prev_bssid, ETH_ALEN) == 0) {
+                /*
+                 * Trying to reassociate: Allow this to proceed and let the old
+                 * association to be dropped when the new one is completed.
+                 */
+                if (wdev->sme_state == CFG80211_SME_CONNECTED) {
+                        was_connected = true;
+                        wdev->sme_state = CFG80211_SME_CONNECTING;
+                }
+        } else if (wdev->current_bss)
                 return -EALREADY;
 
         req.ie = ie;
@@ -484,8 +505,11 @@ int __cfg80211_mlme_assoc(struct cfg80211_registered_device *rdev,
         req.prev_bssid = prev_bssid;
         req.bss = cfg80211_get_bss(&rdev->wiphy, chan, bssid, ssid, ssid_len,
                                    WLAN_CAPABILITY_ESS, WLAN_CAPABILITY_ESS);
-        if (!req.bss)
+        if (!req.bss) {
+                if (was_connected)
+                        wdev->sme_state = CFG80211_SME_CONNECTED;
                 return -ENOENT;
+        }
 
         bss = bss_from_pub(req.bss);
 
@@ -503,6 +527,8 @@ int __cfg80211_mlme_assoc(struct cfg80211_registered_device *rdev,
 
         err = rdev->ops->assoc(&rdev->wiphy, dev, &req);
  out:
+        if (err && was_connected)
+                wdev->sme_state = CFG80211_SME_CONNECTED;
         /* still a reference in wdev->auth_bsses[slot] */
         cfg80211_put_bss(req.bss);
         return err;
@@ -666,3 +692,206 @@ void cfg80211_mlme_down(struct cfg80211_registered_device *rdev,
                 }
         }
 }
+
+void cfg80211_ready_on_channel(struct net_device *dev, u64 cookie,
+                               struct ieee80211_channel *chan,
+                               enum nl80211_channel_type channel_type,
+                               unsigned int duration, gfp_t gfp)
+{
+        struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+
+        nl80211_send_remain_on_channel(rdev, dev, cookie, chan, channel_type,
+                                       duration, gfp);
+}
+EXPORT_SYMBOL(cfg80211_ready_on_channel);
+
+void cfg80211_remain_on_channel_expired(struct net_device *dev,
+                                        u64 cookie,
+                                        struct ieee80211_channel *chan,
+                                        enum nl80211_channel_type channel_type,
+                                        gfp_t gfp)
+{
+        struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+
+        nl80211_send_remain_on_channel_cancel(rdev, dev, cookie, chan,
+                                              channel_type, gfp);
+}
+EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
+
+void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
+                      struct station_info *sinfo, gfp_t gfp)
+{
+        struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+
+        nl80211_send_sta_event(rdev, dev, mac_addr, sinfo, gfp);
+}
+EXPORT_SYMBOL(cfg80211_new_sta);
+
+struct cfg80211_action_registration {
+        struct list_head list;
+
+        u32 nlpid;
+
+        int match_len;
+
+        u8 match[];
+};
+
+int cfg80211_mlme_register_action(struct wireless_dev *wdev, u32 snd_pid,
+                                  const u8 *match_data, int match_len)
+{
+        struct cfg80211_action_registration *reg, *nreg;
+        int err = 0;
+
+        nreg = kzalloc(sizeof(*reg) + match_len, GFP_KERNEL);
+        if (!nreg)
+                return -ENOMEM;
+
+        spin_lock_bh(&wdev->action_registrations_lock);
+
+        list_for_each_entry(reg, &wdev->action_registrations, list) {
+                int mlen = min(match_len, reg->match_len);
+
+                if (memcmp(reg->match, match_data, mlen) == 0) {
+                        err = -EALREADY;
+                        break;
+                }
+        }
+
+        if (err) {
+                kfree(nreg);
+                goto out;
+        }
+
+        memcpy(nreg->match, match_data, match_len);
+        nreg->match_len = match_len;
+        nreg->nlpid = snd_pid;
+        list_add(&nreg->list, &wdev->action_registrations);
+
+ out:
+        spin_unlock_bh(&wdev->action_registrations_lock);
+        return err;
+}
+
+void cfg80211_mlme_unregister_actions(struct wireless_dev *wdev, u32 nlpid)
+{
+        struct cfg80211_action_registration *reg, *tmp;
+
+        spin_lock_bh(&wdev->action_registrations_lock);
+
+        list_for_each_entry_safe(reg, tmp, &wdev->action_registrations, list) {
+                if (reg->nlpid == nlpid) {
+                        list_del(&reg->list);
+                        kfree(reg);
+                }
+        }
+
+        spin_unlock_bh(&wdev->action_registrations_lock);
+}
+
+void cfg80211_mlme_purge_actions(struct wireless_dev *wdev)
+{
+        struct cfg80211_action_registration *reg, *tmp;
+
+        spin_lock_bh(&wdev->action_registrations_lock);
+
+        list_for_each_entry_safe(reg, tmp, &wdev->action_registrations, list) {
+                list_del(&reg->list);
+                kfree(reg);
+        }
+
+        spin_unlock_bh(&wdev->action_registrations_lock);
+}
+
+int cfg80211_mlme_action(struct cfg80211_registered_device *rdev,
+                         struct net_device *dev,
+                         struct ieee80211_channel *chan,
+                         enum nl80211_channel_type channel_type,
+                         const u8 *buf, size_t len, u64 *cookie)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        const struct ieee80211_mgmt *mgmt;
+
+        if (rdev->ops->action == NULL)
+                return -EOPNOTSUPP;
+        if (len < 24 + 1)
+                return -EINVAL;
+
+        mgmt = (const struct ieee80211_mgmt *) buf;
+        if (!ieee80211_is_action(mgmt->frame_control))
+                return -EINVAL;
+        if (mgmt->u.action.category != WLAN_CATEGORY_PUBLIC) {
+                /* Verify that we are associated with the destination AP */
+                if (!wdev->current_bss ||
+                    memcmp(wdev->current_bss->pub.bssid, mgmt->bssid,
+                           ETH_ALEN) != 0 ||
+                    memcmp(wdev->current_bss->pub.bssid, mgmt->da,
+                           ETH_ALEN) != 0)
+                        return -ENOTCONN;
+        }
+
+        if (memcmp(mgmt->sa, dev->dev_addr, ETH_ALEN) != 0)
+                return -EINVAL;
+
+        /* Transmit the Action frame as requested by user space */
+        return rdev->ops->action(&rdev->wiphy, dev, chan, channel_type,
+                                 buf, len, cookie);
+}
+
+bool cfg80211_rx_action(struct net_device *dev, int freq, const u8 *buf,
+                        size_t len, gfp_t gfp)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct wiphy *wiphy = wdev->wiphy;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+        struct cfg80211_action_registration *reg;
+        const u8 *action_data;
+        int action_data_len;
+        bool result = false;
+
+        /* frame length - min size excluding category */
+        action_data_len = len - (IEEE80211_MIN_ACTION_SIZE - 1);
+
+        /* action data starts with category */
+        action_data = buf + IEEE80211_MIN_ACTION_SIZE - 1;
+
+        spin_lock_bh(&wdev->action_registrations_lock);
+
+        list_for_each_entry(reg, &wdev->action_registrations, list) {
+                if (reg->match_len > action_data_len)
+                        continue;
+
+                if (memcmp(reg->match, action_data, reg->match_len))
+                        continue;
+
+                /* found match! */
+
+                /* Indicate the received Action frame to user space */
+                if (nl80211_send_action(rdev, dev, reg->nlpid, freq,
+                                        buf, len, gfp))
+                        continue;
+
+                result = true;
+                break;
+        }
+
+        spin_unlock_bh(&wdev->action_registrations_lock);
+
+        return result;
+}
+EXPORT_SYMBOL(cfg80211_rx_action);
+
+void cfg80211_action_tx_status(struct net_device *dev, u64 cookie,
+                               const u8 *buf, size_t len, bool ack, gfp_t gfp)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct wiphy *wiphy = wdev->wiphy;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+
+        /* Indicate TX status of the Action frame to user space */
+        nl80211_send_action_tx_status(rdev, dev, cookie, buf, len, ack, gfp);
+}
+EXPORT_SYMBOL(cfg80211_action_tx_status);
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index ca3c92a0a14f..030cf153bea2 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -1,12 +1,13 @@
 /*
  * This is the new netlink-based wireless configuration interface.
  *
- * Copyright 2006-2009  Johannes Berg <johannes@sipsolutions.net>
+ * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
  */
 
 #include <linux/if.h>
 #include <linux/module.h>
 #include <linux/err.h>
+#include <linux/slab.h>
 #include <linux/list.h>
 #include <linux/if_ether.h>
 #include <linux/ieee80211.h>
@@ -58,7 +59,7 @@ static int get_rdev_dev_by_info_ifindex(struct genl_info *info,
 }
 
 /* policy for the attributes */
-static struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] __read_mostly = {
+static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
                                       .len = 20-1 },
@@ -69,6 +70,7 @@ static struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] __read_mostly = {
         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
+        [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
 
         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
@@ -138,11 +140,20 @@ static struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] __read_mostly = {
         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
         [NL80211_ATTR_PID] = { .type = NLA_U32 },
+        [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
+        [NL80211_ATTR_PMKID] = { .type = NLA_BINARY,
+                                 .len = WLAN_PMKID_LEN },
+        [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
+        [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
+        [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
+        [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
+                                 .len = IEEE80211_MAX_DATA_LEN },
+        [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
+        [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
 };
 
 /* policy for the attributes */
-static struct nla_policy
-nl80211_key_policy[NL80211_KEY_MAX + 1] __read_mostly = {
+static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
         [NL80211_KEY_IDX] = { .type = NLA_U8 },
         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
@@ -151,6 +162,26 @@ nl80211_key_policy[NL80211_KEY_MAX + 1] __read_mostly = {
         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 };
 
+/* ifidx get helper */
+static int nl80211_get_ifidx(struct netlink_callback *cb)
+{
+        int res;
+
+        res = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
+                          nl80211_fam.attrbuf, nl80211_fam.maxattr,
+                          nl80211_policy);
+        if (res)
+                return res;
+
+        if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
+                return -EINVAL;
+
+        res = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
+        if (!res)
+                return -EINVAL;
+        return res;
+}
+
 /* IE validation */
 static bool is_valid_ie_attr(const struct nlattr *attr)
 {
@@ -419,6 +450,8 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
                     dev->wiphy.frag_threshold);
         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
                     dev->wiphy.rts_threshold);
+        NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
+                    dev->wiphy.coverage_class);
 
         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
                    dev->wiphy.max_scan_ssids);
@@ -429,6 +462,9 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
                 sizeof(u32) * dev->wiphy.n_cipher_suites,
                 dev->wiphy.cipher_suites);
 
+        NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
+                   dev->wiphy.max_num_pmkids);
+
         nl_modes = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_IFTYPES);
         if (!nl_modes)
                 goto nla_put_failure;
@@ -540,7 +576,13 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
         CMD(deauth, DEAUTHENTICATE);
         CMD(disassoc, DISASSOCIATE);
         CMD(join_ibss, JOIN_IBSS);
-        if (dev->wiphy.netnsok) {
+        CMD(set_pmksa, SET_PMKSA);
+        CMD(del_pmksa, DEL_PMKSA);
+        CMD(flush_pmksa, FLUSH_PMKSA);
+        CMD(remain_on_channel, REMAIN_ON_CHANNEL);
+        CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
+        CMD(action, ACTION);
+        if (dev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
                 i++;
                 NLA_PUT_U32(msg, i, NL80211_CMD_SET_WIPHY_NETNS);
         }
@@ -652,6 +694,7 @@ static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
         u32 changed;
         u8 retry_short = 0, retry_long = 0;
         u32 frag_threshold = 0, rts_threshold = 0;
+        u8 coverage_class = 0;
 
         rtnl_lock();
 
@@ -774,9 +817,16 @@ static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
         }
 
+        if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
+                coverage_class = nla_get_u8(
+                        info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
+                changed |= WIPHY_PARAM_COVERAGE_CLASS;
+        }
+
         if (changed) {
                 u8 old_retry_short, old_retry_long;
                 u32 old_frag_threshold, old_rts_threshold;
+                u8 old_coverage_class;
 
                 if (!rdev->ops->set_wiphy_params) {
                         result = -EOPNOTSUPP;
@@ -787,6 +837,7 @@ static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
                 old_retry_long = rdev->wiphy.retry_long;
                 old_frag_threshold = rdev->wiphy.frag_threshold;
                 old_rts_threshold = rdev->wiphy.rts_threshold;
+                old_coverage_class = rdev->wiphy.coverage_class;
 
                 if (changed & WIPHY_PARAM_RETRY_SHORT)
                         rdev->wiphy.retry_short = retry_short;
@@ -796,6 +847,8 @@ static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
                         rdev->wiphy.frag_threshold = frag_threshold;
                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
                         rdev->wiphy.rts_threshold = rts_threshold;
+                if (changed & WIPHY_PARAM_COVERAGE_CLASS)
+                        rdev->wiphy.coverage_class = coverage_class;
 
                 result = rdev->ops->set_wiphy_params(&rdev->wiphy, changed);
                 if (result) {
@@ -803,6 +856,7 @@ static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
                         rdev->wiphy.retry_long = old_retry_long;
                         rdev->wiphy.frag_threshold = old_frag_threshold;
                         rdev->wiphy.rts_threshold = old_rts_threshold;
+                        rdev->wiphy.coverage_class = old_coverage_class;
                 }
         }
 
@@ -947,6 +1001,32 @@ static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
         return 0;
 }
 
+static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
+                               struct net_device *netdev, u8 use_4addr,
+                               enum nl80211_iftype iftype)
+{
+        if (!use_4addr) {
+                if (netdev && netdev->br_port)
+                        return -EBUSY;
+                return 0;
+        }
+
+        switch (iftype) {
+        case NL80211_IFTYPE_AP_VLAN:
+                if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
+                        return 0;
+                break;
+        case NL80211_IFTYPE_STATION:
+                if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
+                        return 0;
+                break;
+        default:
+                break;
+        }
+
+        return -EOPNOTSUPP;
+}
+
 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
 {
         struct cfg80211_registered_device *rdev;
@@ -987,6 +1067,16 @@ static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
                 change = true;
         }
 
+        if (info->attrs[NL80211_ATTR_4ADDR]) {
+                params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
+                change = true;
+                err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
+                if (err)
+                        goto unlock;
+        } else {
+                params.use_4addr = -1;
+        }
+
         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
                 if (ntype != NL80211_IFTYPE_MONITOR) {
                         err = -EINVAL;
@@ -1006,6 +1096,9 @@ static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
         else
                 err = 0;
 
+        if (!err && params.use_4addr != -1)
+                dev->ieee80211_ptr->use_4addr = params.use_4addr;
+
  unlock:
         dev_put(dev);
         cfg80211_unlock_rdev(rdev);
@@ -1053,6 +1146,13 @@ static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
                 params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
         }
 
+        if (info->attrs[NL80211_ATTR_4ADDR]) {
+                params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
+                err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
+                if (err)
+                        goto unlock;
+        }
+
         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
                                   &flags);
@@ -1264,7 +1364,7 @@ static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
         if (!err)
                 err = func(&rdev->wiphy, dev, key.idx);
 
-#ifdef CONFIG_WIRELESS_EXT
+#ifdef CONFIG_CFG80211_WEXT
         if (!err) {
                 if (func == rdev->ops->set_default_key)
                         dev->ieee80211_ptr->wext.default_key = key.idx;
@@ -1365,7 +1465,7 @@ static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
         if (!err)
                 err = rdev->ops->del_key(&rdev->wiphy, dev, key.idx, mac_addr);
 
-#ifdef CONFIG_WIRELESS_EXT
+#ifdef CONFIG_CFG80211_WEXT
         if (!err) {
                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
                         dev->ieee80211_ptr->wext.default_key = -1;
@@ -1562,42 +1662,9 @@ static int parse_station_flags(struct genl_info *info,
         return 0;
 }
 
-static u16 nl80211_calculate_bitrate(struct rate_info *rate)
-{
-        int modulation, streams, bitrate;
-
-        if (!(rate->flags & RATE_INFO_FLAGS_MCS))
-                return rate->legacy;
-
-        /* the formula below does only work for MCS values smaller than 32 */
-        if (rate->mcs >= 32)
-                return 0;
-
-        modulation = rate->mcs & 7;
-        streams = (rate->mcs >> 3) + 1;
-
-        bitrate = (rate->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH) ?
-                        13500000 : 6500000;
-
-        if (modulation < 4)
-                bitrate *= (modulation + 1);
-        else if (modulation == 4)
-                bitrate *= (modulation + 2);
-        else
-                bitrate *= (modulation + 3);
-
-        bitrate *= streams;
-
-        if (rate->flags & RATE_INFO_FLAGS_SHORT_GI)
-                bitrate = (bitrate / 9) * 10;
-
-        /* do NOT round down here */
-        return (bitrate + 50000) / 100000;
-}
-
 static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
                                 int flags, struct net_device *dev,
-                                u8 *mac_addr, struct station_info *sinfo)
+                                const u8 *mac_addr, struct station_info *sinfo)
 {
         void *hdr;
         struct nlattr *sinfoattr, *txrate;
@@ -1641,8 +1708,8 @@ static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
                 if (!txrate)
                         goto nla_put_failure;
 
-                /* nl80211_calculate_bitrate will return 0 for mcs >= 32 */
-                bitrate = nl80211_calculate_bitrate(&sinfo->txrate);
+                /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
+                bitrate = cfg80211_calculate_bitrate(&sinfo->txrate);
                 if (bitrate > 0)
                         NLA_PUT_U16(msg, NL80211_RATE_INFO_BITRATE, bitrate);
 
@@ -1682,20 +1749,10 @@ static int nl80211_dump_station(struct sk_buff *skb,
         int sta_idx = cb->args[1];
         int err;
 
-        if (!ifidx) {
-                err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
-                                  nl80211_fam.attrbuf, nl80211_fam.maxattr,
-                                  nl80211_policy);
-                if (err)
-                        return err;
-
-                if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
-                        return -EINVAL;
-
-                ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
-                if (!ifidx)
-                        return -EINVAL;
-        }
+        if (!ifidx)
+                ifidx = nl80211_get_ifidx(cb);
+        if (ifidx < 0)
+                return ifidx;
 
         rtnl_lock();
 
@@ -1800,7 +1857,7 @@ static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
 }
 
 /*
- * Get vlan interface making sure it is on the right wiphy.
+ * Get vlan interface making sure it is running and on the right wiphy.
  */
 static int get_vlan(struct genl_info *info,
                     struct cfg80211_registered_device *rdev,
@@ -1818,6 +1875,8 @@ static int get_vlan(struct genl_info *info,
                         return -EINVAL;
                 if ((*vlan)->ieee80211_ptr->wiphy != &rdev->wiphy)
                         return -EINVAL;
+                if (!netif_running(*vlan))
+                        return -ENETDOWN;
         }
         return 0;
 }
@@ -1956,6 +2015,9 @@ static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
                 return -EINVAL;
 
+        if (!info->attrs[NL80211_ATTR_STA_AID])
+                return -EINVAL;
+
         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
         params.supported_rates =
                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
@@ -1964,11 +2026,9 @@ static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
         params.listen_interval =
                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
 
-        if (info->attrs[NL80211_ATTR_STA_AID]) {
-                params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
-                if (!params.aid || params.aid > IEEE80211_MAX_AID)
-                        return -EINVAL;
-        }
+        params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
+        if (!params.aid || params.aid > IEEE80211_MAX_AID)
+                return -EINVAL;
 
         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
                 params.ht_capa =
@@ -1983,6 +2043,12 @@ static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
         if (err)
                 goto out_rtnl;
 
+        if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
+            dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN) {
+                err = -EINVAL;
+                goto out;
+        }
+
         err = get_vlan(info, rdev, &params.vlan);
         if (err)
                 goto out;
@@ -1990,35 +2056,6 @@ static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
         /* validate settings */
         err = 0;
 
-        switch (dev->ieee80211_ptr->iftype) {
-        case NL80211_IFTYPE_AP:
-        case NL80211_IFTYPE_AP_VLAN:
-                /* all ok but must have AID */
-                if (!params.aid)
-                        err = -EINVAL;
-                break;
-        case NL80211_IFTYPE_MESH_POINT:
-                /* disallow things mesh doesn't support */
-                if (params.vlan)
-                        err = -EINVAL;
-                if (params.aid)
-                        err = -EINVAL;
-                if (params.ht_capa)
-                        err = -EINVAL;
-                if (params.listen_interval >= 0)
-                        err = -EINVAL;
-                if (params.supported_rates)
-                        err = -EINVAL;
-                if (params.sta_flags_mask)
-                        err = -EINVAL;
-                break;
-        default:
-                err = -EINVAL;
-        }
-
-        if (err)
-                goto out;
-
         if (!rdev->ops->add_station) {
                 err = -EOPNOTSUPP;
                 goto out;
@@ -2059,8 +2096,7 @@ static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
                 goto out_rtnl;
 
         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
-            dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
-            dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
+            dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN) {
                 err = -EINVAL;
                 goto out;
         }
@@ -2105,9 +2141,9 @@ static int nl80211_send_mpath(struct sk_buff *msg, u32 pid, u32 seq,
         if (pinfo->filled & MPATH_INFO_FRAME_QLEN)
                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
                             pinfo->frame_qlen);
-        if (pinfo->filled & MPATH_INFO_DSN)
-                NLA_PUT_U32(msg, NL80211_MPATH_INFO_DSN,
-                            pinfo->dsn);
+        if (pinfo->filled & MPATH_INFO_SN)
+                NLA_PUT_U32(msg, NL80211_MPATH_INFO_SN,
+                            pinfo->sn);
         if (pinfo->filled & MPATH_INFO_METRIC)
                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_METRIC,
                             pinfo->metric);
@@ -2145,20 +2181,10 @@ static int nl80211_dump_mpath(struct sk_buff *skb,
         int path_idx = cb->args[1];
         int err;
 
-        if (!ifidx) {
-                err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
-                                  nl80211_fam.attrbuf, nl80211_fam.maxattr,
-                                  nl80211_policy);
-                if (err)
-                        return err;
-
-                if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
-                        return -EINVAL;
-
-                ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
-                if (!ifidx)
-                        return -EINVAL;
-        }
+        if (!ifidx)
+                ifidx = nl80211_get_ifidx(cb);
+        if (ifidx < 0)
+                return ifidx;
 
         rtnl_lock();
 
@@ -2457,8 +2483,7 @@ static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
         return err;
 }
 
-static const struct nla_policy
-        reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
+static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
@@ -2526,12 +2551,6 @@ static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
 
         data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
 
-#ifdef CONFIG_WIRELESS_OLD_REGULATORY
-        /* We ignore world regdom requests with the old regdom setup */
-        if (is_world_regdom(data))
-                return -EINVAL;
-#endif
-
         r = regulatory_hint_user(data);
 
         return r;
@@ -2605,6 +2624,8 @@ static int nl80211_get_mesh_params(struct sk_buff *skb,
                         cur_params.dot11MeshHWMPpreqMinInterval);
         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
                         cur_params.dot11MeshHWMPnetDiameterTraversalTime);
+        NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
+                        cur_params.dot11MeshHWMPRootMode);
         nla_nest_end(msg, pinfoattr);
         genlmsg_end(msg, hdr);
         err = genlmsg_reply(msg, info);
@@ -2631,8 +2652,7 @@ do {\
         } \
 } while (0);\
 
-static struct nla_policy
-nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] __read_mostly = {
+static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
@@ -2715,6 +2735,10 @@ static int nl80211_set_mesh_params(struct sk_buff *skb, struct genl_info *info)
                         dot11MeshHWMPnetDiameterTraversalTime,
                         mask, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
                         nla_get_u16);
+        FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
+                        dot11MeshHWMPRootMode, mask,
+                        NL80211_MESHCONF_HWMP_ROOTMODE,
+                        nla_get_u8);
 
         /* Apply changes */
         err = rdev->ops->set_mesh_params(&rdev->wiphy, dev, &cfg, mask);
@@ -2988,7 +3012,6 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
                 goto out;
         }
 
-        request->n_channels = n_channels;
         if (n_ssids)
                 request->ssids = (void *)&request->channels[n_channels];
         request->n_ssids = n_ssids;
@@ -2999,32 +3022,53 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
                         request->ie = (void *)(request->channels + n_channels);
         }
 
+        i = 0;
         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
                 /* user specified, bail out if channel not found */
-                request->n_channels = n_channels;
-                i = 0;
                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
-                        request->channels[i] = ieee80211_get_channel(wiphy, nla_get_u32(attr));
-                        if (!request->channels[i]) {
+                        struct ieee80211_channel *chan;
+
+                        chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
+
+                        if (!chan) {
                                 err = -EINVAL;
                                 goto out_free;
                         }
+
+                        /* ignore disabled channels */
+                        if (chan->flags & IEEE80211_CHAN_DISABLED)
+                                continue;
+
+                        request->channels[i] = chan;
                         i++;
                 }
         } else {
                 /* all channels */
-                i = 0;
                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
                         int j;
                         if (!wiphy->bands[band])
                                 continue;
                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
-                                request->channels[i] = &wiphy->bands[band]->channels[j];
+                                struct ieee80211_channel *chan;
+
+                                chan = &wiphy->bands[band]->channels[j];
+
+                                if (chan->flags & IEEE80211_CHAN_DISABLED)
+                                        continue;
+
+                                request->channels[i] = chan;
                                 i++;
                         }
                 }
         }
 
+        if (!i) {
+                err = -EINVAL;
+                goto out_free;
+        }
+
+        request->n_channels = i;
+
         i = 0;
         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
@@ -3099,12 +3143,18 @@ static int nl80211_send_bss(struct sk_buff *msg, u32 pid, u32 seq, int flags,
                 NLA_PUT(msg, NL80211_BSS_INFORMATION_ELEMENTS,
                         res->len_information_elements,
                         res->information_elements);
+        if (res->beacon_ies && res->len_beacon_ies &&
+            res->beacon_ies != res->information_elements)
+                NLA_PUT(msg, NL80211_BSS_BEACON_IES,
+                        res->len_beacon_ies, res->beacon_ies);
         if (res->tsf)
                 NLA_PUT_U64(msg, NL80211_BSS_TSF, res->tsf);
         if (res->beacon_interval)
                 NLA_PUT_U16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval);
         NLA_PUT_U16(msg, NL80211_BSS_CAPABILITY, res->capability);
         NLA_PUT_U32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq);
+        NLA_PUT_U32(msg, NL80211_BSS_SEEN_MS_AGO,
+                jiffies_to_msecs(jiffies - intbss->ts));
 
         switch (rdev->wiphy.signal_type) {
         case CFG80211_SIGNAL_TYPE_MBM:
@@ -3159,21 +3209,11 @@ static int nl80211_dump_scan(struct sk_buff *skb,
         int start = cb->args[1], idx = 0;
         int err;
 
-        if (!ifidx) {
-                err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
-                                  nl80211_fam.attrbuf, nl80211_fam.maxattr,
-                                  nl80211_policy);
-                if (err)
-                        return err;
-
-                if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
-                        return -EINVAL;
-
-                ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
-                if (!ifidx)
-                        return -EINVAL;
-                cb->args[0] = ifidx;
-        }
+        if (!ifidx)
+                ifidx = nl80211_get_ifidx(cb);
+        if (ifidx < 0)
+                return ifidx;
+        cb->args[0] = ifidx;
 
         dev = dev_get_by_index(sock_net(skb->sk), ifidx);
         if (!dev)
@@ -3216,6 +3256,106 @@ static int nl80211_dump_scan(struct sk_buff *skb,
         return err;
 }
 
+static int nl80211_send_survey(struct sk_buff *msg, u32 pid, u32 seq,
+                                int flags, struct net_device *dev,
+                                struct survey_info *survey)
+{
+        void *hdr;
+        struct nlattr *infoattr;
+
+        /* Survey without a channel doesn't make sense */
+        if (!survey->channel)
+                return -EINVAL;
+
+        hdr = nl80211hdr_put(msg, pid, seq, flags,
+                             NL80211_CMD_NEW_SURVEY_RESULTS);
+        if (!hdr)
+                return -ENOMEM;
+
+        NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
+
+        infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
+        if (!infoattr)
+                goto nla_put_failure;
+
+        NLA_PUT_U32(msg, NL80211_SURVEY_INFO_FREQUENCY,
+                    survey->channel->center_freq);
+        if (survey->filled & SURVEY_INFO_NOISE_DBM)
+                NLA_PUT_U8(msg, NL80211_SURVEY_INFO_NOISE,
+                            survey->noise);
+
+        nla_nest_end(msg, infoattr);
+
+        return genlmsg_end(msg, hdr);
+
+ nla_put_failure:
+        genlmsg_cancel(msg, hdr);
+        return -EMSGSIZE;
+}
+
+static int nl80211_dump_survey(struct sk_buff *skb,
+                        struct netlink_callback *cb)
+{
+        struct survey_info survey;
+        struct cfg80211_registered_device *dev;
+        struct net_device *netdev;
+        int ifidx = cb->args[0];
+        int survey_idx = cb->args[1];
+        int res;
+
+        if (!ifidx)
+                ifidx = nl80211_get_ifidx(cb);
+        if (ifidx < 0)
+                return ifidx;
+        cb->args[0] = ifidx;
+
+        rtnl_lock();
+
+        netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
+        if (!netdev) {
+                res = -ENODEV;
+                goto out_rtnl;
+        }
+
+        dev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
+        if (IS_ERR(dev)) {
+                res = PTR_ERR(dev);
+                goto out_rtnl;
+        }
+
+        if (!dev->ops->dump_survey) {
+                res = -EOPNOTSUPP;
+                goto out_err;
+        }
+
+        while (1) {
+                res = dev->ops->dump_survey(&dev->wiphy, netdev, survey_idx,
+                                            &survey);
+                if (res == -ENOENT)
+                        break;
+                if (res)
+                        goto out_err;
+
+                if (nl80211_send_survey(skb,
+                                NETLINK_CB(cb->skb).pid,
+                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
+                                netdev,
+                                &survey) < 0)
+                        goto out;
+                survey_idx++;
+        }
+
+ out:
+        cb->args[1] = survey_idx;
+        res = skb->len;
+ out_err:
+        cfg80211_unlock_rdev(dev);
+ out_rtnl:
+        rtnl_unlock();
+
+        return res;
+}
+
 static bool nl80211_valid_auth_type(enum nl80211_auth_type auth_type)
 {
         return auth_type <= NL80211_AUTHTYPE_MAX;
@@ -3411,6 +3551,7 @@ static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
 {
         struct cfg80211_registered_device *rdev;
         struct net_device *dev;
+        struct wireless_dev *wdev;
         struct cfg80211_crypto_settings crypto;
         struct ieee80211_channel *chan, *fixedchan;
         const u8 *bssid, *ssid, *ie = NULL, *prev_bssid = NULL;
@@ -3456,7 +3597,8 @@ static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
         }
 
         mutex_lock(&rdev->devlist_mtx);
-        fixedchan = rdev_fixed_channel(rdev, NULL);
+        wdev = dev->ieee80211_ptr;
+        fixedchan = rdev_fixed_channel(rdev, wdev);
         if (fixedchan && chan != fixedchan) {
                 err = -EBUSY;
                 mutex_unlock(&rdev->devlist_mtx);
@@ -4054,6 +4196,589 @@ static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
         return err;
 }
 
+static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
+{
+        struct cfg80211_registered_device *rdev;
+        int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
+                        struct cfg80211_pmksa *pmksa) = NULL;
+        int err;
+        struct net_device *dev;
+        struct cfg80211_pmksa pmksa;
+
+        memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
+
+        if (!info->attrs[NL80211_ATTR_MAC])
+                return -EINVAL;
+
+        if (!info->attrs[NL80211_ATTR_PMKID])
+                return -EINVAL;
+
+        rtnl_lock();
+
+        err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
+        if (err)
+                goto out_rtnl;
+
+        pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
+        pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
+
+        if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
+                err = -EOPNOTSUPP;
+                goto out;
+        }
+
+        switch (info->genlhdr->cmd) {
+        case NL80211_CMD_SET_PMKSA:
+                rdev_ops = rdev->ops->set_pmksa;
+                break;
+        case NL80211_CMD_DEL_PMKSA:
+                rdev_ops = rdev->ops->del_pmksa;
+                break;
+        default:
+                WARN_ON(1);
+                break;
+        }
+
+        if (!rdev_ops) {
+                err = -EOPNOTSUPP;
+                goto out;
+        }
+
+        err = rdev_ops(&rdev->wiphy, dev, &pmksa);
+
+ out:
+        cfg80211_unlock_rdev(rdev);
+        dev_put(dev);
+ out_rtnl:
+        rtnl_unlock();
+
+        return err;
+}
+
+static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
+{
+        struct cfg80211_registered_device *rdev;
+        int err;
+        struct net_device *dev;
+
+        rtnl_lock();
+
+        err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
+        if (err)
+                goto out_rtnl;
+
+        if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
+                err = -EOPNOTSUPP;
+                goto out;
+        }
+
+        if (!rdev->ops->flush_pmksa) {
+                err = -EOPNOTSUPP;
+                goto out;
+        }
+
+        err = rdev->ops->flush_pmksa(&rdev->wiphy, dev);
+
+ out:
+        cfg80211_unlock_rdev(rdev);
+        dev_put(dev);
+ out_rtnl:
+        rtnl_unlock();
+
+        return err;
+
+}
+
+static int nl80211_remain_on_channel(struct sk_buff *skb,
+                                     struct genl_info *info)
+{
+        struct cfg80211_registered_device *rdev;
+        struct net_device *dev;
+        struct ieee80211_channel *chan;
+        struct sk_buff *msg;
+        void *hdr;
+        u64 cookie;
+        enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
+        u32 freq, duration;
+        int err;
+
+        if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
+            !info->attrs[NL80211_ATTR_DURATION])
+                return -EINVAL;
+
+        duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
+
+        /*
+         * We should be on that channel for at least one jiffie,
+         * and more than 5 seconds seems excessive.
+         */
+        if (!duration || !msecs_to_jiffies(duration) || duration > 5000)
+                return -EINVAL;
+
+        rtnl_lock();
+
+        err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
+        if (err)
+                goto unlock_rtnl;
+
+        if (!rdev->ops->remain_on_channel) {
+                err = -EOPNOTSUPP;
+                goto out;
+        }
+
+        if (!netif_running(dev)) {
+                err = -ENETDOWN;
+                goto out;
+        }
+
+        if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
+                channel_type = nla_get_u32(
+                        info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
+                if (channel_type != NL80211_CHAN_NO_HT &&
+                    channel_type != NL80211_CHAN_HT20 &&
+                    channel_type != NL80211_CHAN_HT40PLUS &&
+                    channel_type != NL80211_CHAN_HT40MINUS)
+                        err = -EINVAL;
+                        goto out;
+        }
+
+        freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
+        chan = rdev_freq_to_chan(rdev, freq, channel_type);
+        if (chan == NULL) {
+                err = -EINVAL;
+                goto out;
+        }
+
+        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
+        if (!msg) {
+                err = -ENOMEM;
+                goto out;
+        }
+
+        hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
+                             NL80211_CMD_REMAIN_ON_CHANNEL);
+
+        if (IS_ERR(hdr)) {
+                err = PTR_ERR(hdr);
+                goto free_msg;
+        }
+
+        err = rdev->ops->remain_on_channel(&rdev->wiphy, dev, chan,
+                                           channel_type, duration, &cookie);
+
+        if (err)
+                goto free_msg;
+
+        NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
+
+        genlmsg_end(msg, hdr);
+        err = genlmsg_reply(msg, info);
+        goto out;
+
+ nla_put_failure:
+        err = -ENOBUFS;
+ free_msg:
+        nlmsg_free(msg);
+ out:
+        cfg80211_unlock_rdev(rdev);
+        dev_put(dev);
+ unlock_rtnl:
+        rtnl_unlock();
+        return err;
+}
+
+static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
+                                            struct genl_info *info)
+{
+        struct cfg80211_registered_device *rdev;
+        struct net_device *dev;
+        u64 cookie;
+        int err;
+
+        if (!info->attrs[NL80211_ATTR_COOKIE])
+                return -EINVAL;
+
+        rtnl_lock();
+
+        err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
+        if (err)
+                goto unlock_rtnl;
+
+        if (!rdev->ops->cancel_remain_on_channel) {
+                err = -EOPNOTSUPP;
+                goto out;
+        }
+
+        if (!netif_running(dev)) {
+                err = -ENETDOWN;
+                goto out;
+        }
+
+        cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
+
+        err = rdev->ops->cancel_remain_on_channel(&rdev->wiphy, dev, cookie);
+
+ out:
+        cfg80211_unlock_rdev(rdev);
+        dev_put(dev);
+ unlock_rtnl:
+        rtnl_unlock();
+        return err;
+}
+
+static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
+                           u8 *rates, u8 rates_len)
+{
+        u8 i;
+        u32 mask = 0;
+
+        for (i = 0; i < rates_len; i++) {
+                int rate = (rates[i] & 0x7f) * 5;
+                int ridx;
+                for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
+                        struct ieee80211_rate *srate =
+                                &sband->bitrates[ridx];
+                        if (rate == srate->bitrate) {
+                                mask |= 1 << ridx;
+                                break;
+                        }
+                }
+                if (ridx == sband->n_bitrates)
+                        return 0; /* rate not found */
+        }
+
+        return mask;
+}
+
+static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
+        [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
+                                    .len = NL80211_MAX_SUPP_RATES },
+};
+
+static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
+                                       struct genl_info *info)
+{
+        struct nlattr *tb[NL80211_TXRATE_MAX + 1];
+        struct cfg80211_registered_device *rdev;
+        struct cfg80211_bitrate_mask mask;
+        int err, rem, i;
+        struct net_device *dev;
+        struct nlattr *tx_rates;
+        struct ieee80211_supported_band *sband;
+
+        if (info->attrs[NL80211_ATTR_TX_RATES] == NULL)
+                return -EINVAL;
+
+        rtnl_lock();
+
+        err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
+        if (err)
+                goto unlock_rtnl;
+
+        if (!rdev->ops->set_bitrate_mask) {
+                err = -EOPNOTSUPP;
+                goto unlock;
+        }
+
+        memset(&mask, 0, sizeof(mask));
+        /* Default to all rates enabled */
+        for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
+                sband = rdev->wiphy.bands[i];
+                mask.control[i].legacy =
+                        sband ? (1 << sband->n_bitrates) - 1 : 0;
+        }
+
+        /*
+         * The nested attribute uses enum nl80211_band as the index. This maps
+         * directly to the enum ieee80211_band values used in cfg80211.
+         */
+        nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem)
+        {
+                enum ieee80211_band band = nla_type(tx_rates);
+                if (band < 0 || band >= IEEE80211_NUM_BANDS) {
+                        err = -EINVAL;
+                        goto unlock;
+                }
+                sband = rdev->wiphy.bands[band];
+                if (sband == NULL) {
+                        err = -EINVAL;
+                        goto unlock;
+                }
+                nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
+                          nla_len(tx_rates), nl80211_txattr_policy);
+                if (tb[NL80211_TXRATE_LEGACY]) {
+                        mask.control[band].legacy = rateset_to_mask(
+                                sband,
+                                nla_data(tb[NL80211_TXRATE_LEGACY]),
+                                nla_len(tb[NL80211_TXRATE_LEGACY]));
+                        if (mask.control[band].legacy == 0) {
+                                err = -EINVAL;
+                                goto unlock;
+                        }
+                }
+        }
+
+        err = rdev->ops->set_bitrate_mask(&rdev->wiphy, dev, NULL, &mask);
+
+ unlock:
+        dev_put(dev);
+        cfg80211_unlock_rdev(rdev);
+ unlock_rtnl:
+        rtnl_unlock();
+        return err;
+}
+
+static int nl80211_register_action(struct sk_buff *skb, struct genl_info *info)
+{
+        struct cfg80211_registered_device *rdev;
+        struct net_device *dev;
+        int err;
+
+        if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
+                return -EINVAL;
+
+        if (nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]) < 1)
+                return -EINVAL;
+
+        rtnl_lock();
+
+        err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
+        if (err)
+                goto unlock_rtnl;
+
+        if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
+                err = -EOPNOTSUPP;
+                goto out;
+        }
+
+        /* not much point in registering if we can't reply */
+        if (!rdev->ops->action) {
+                err = -EOPNOTSUPP;
+                goto out;
+        }
+
+        err = cfg80211_mlme_register_action(dev->ieee80211_ptr, info->snd_pid,
+                        nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
+                        nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
+ out:
+        cfg80211_unlock_rdev(rdev);
+        dev_put(dev);
+ unlock_rtnl:
+        rtnl_unlock();
+        return err;
+}
+
+static int nl80211_action(struct sk_buff *skb, struct genl_info *info)
+{
+        struct cfg80211_registered_device *rdev;
+        struct net_device *dev;
+        struct ieee80211_channel *chan;
+        enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
+        u32 freq;
+        int err;
+        void *hdr;
+        u64 cookie;
+        struct sk_buff *msg;
+
+        if (!info->attrs[NL80211_ATTR_FRAME] ||
+            !info->attrs[NL80211_ATTR_WIPHY_FREQ])
+                return -EINVAL;
+
+        rtnl_lock();
+
+        err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
+        if (err)
+                goto unlock_rtnl;
+
+        if (!rdev->ops->action) {
+                err = -EOPNOTSUPP;
+                goto out;
+        }
+
+        if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
+                err = -EOPNOTSUPP;
+                goto out;
+        }
+
+        if (!netif_running(dev)) {
+                err = -ENETDOWN;
+                goto out;
+        }
+
+        if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
+                channel_type = nla_get_u32(
+                        info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
+                if (channel_type != NL80211_CHAN_NO_HT &&
+                    channel_type != NL80211_CHAN_HT20 &&
+                    channel_type != NL80211_CHAN_HT40PLUS &&
+                    channel_type != NL80211_CHAN_HT40MINUS)
+                        err = -EINVAL;
+                        goto out;
+        }
+
+        freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
+        chan = rdev_freq_to_chan(rdev, freq, channel_type);
+        if (chan == NULL) {
+                err = -EINVAL;
+                goto out;
+        }
+
+        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
+        if (!msg) {
+                err = -ENOMEM;
+                goto out;
+        }
+
+        hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
+                             NL80211_CMD_ACTION);
+
+        if (IS_ERR(hdr)) {
+                err = PTR_ERR(hdr);
+                goto free_msg;
+        }
+        err = cfg80211_mlme_action(rdev, dev, chan, channel_type,
+                                   nla_data(info->attrs[NL80211_ATTR_FRAME]),
+                                   nla_len(info->attrs[NL80211_ATTR_FRAME]),
+                                   &cookie);
+        if (err)
+                goto free_msg;
+
+        NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
+
+        genlmsg_end(msg, hdr);
+        err = genlmsg_reply(msg, info);
+        goto out;
+
+ nla_put_failure:
+        err = -ENOBUFS;
+ free_msg:
+        nlmsg_free(msg);
+ out:
+        cfg80211_unlock_rdev(rdev);
+        dev_put(dev);
+unlock_rtnl:
+        rtnl_unlock();
+        return err;
+}
+
+static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
+{
+        struct cfg80211_registered_device *rdev;
+        struct wireless_dev *wdev;
+        struct net_device *dev;
+        u8 ps_state;
+        bool state;
+        int err;
+
+        if (!info->attrs[NL80211_ATTR_PS_STATE]) {
+                err = -EINVAL;
+                goto out;
+        }
+
+        ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
+
+        if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED) {
+                err = -EINVAL;
+                goto out;
+        }
+
+        rtnl_lock();
+
+        err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
+        if (err)
+                goto unlock_rdev;
+
+        wdev = dev->ieee80211_ptr;
+
+        if (!rdev->ops->set_power_mgmt) {
+                err = -EOPNOTSUPP;
+                goto unlock_rdev;
+        }
+
+        state = (ps_state == NL80211_PS_ENABLED) ? true : false;
+
+        if (state == wdev->ps)
+                goto unlock_rdev;
+
+        wdev->ps = state;
+
+        if (rdev->ops->set_power_mgmt(wdev->wiphy, dev, wdev->ps,
+                                      wdev->ps_timeout))
+                /* assume this means it's off */
+                wdev->ps = false;
+
+unlock_rdev:
+        cfg80211_unlock_rdev(rdev);
+        dev_put(dev);
+        rtnl_unlock();
+
+out:
+        return err;
+}
+
+static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
+{
+        struct cfg80211_registered_device *rdev;
+        enum nl80211_ps_state ps_state;
+        struct wireless_dev *wdev;
+        struct net_device *dev;
+        struct sk_buff *msg;
+        void *hdr;
+        int err;
+
+        rtnl_lock();
+
+        err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
+        if (err)
+                goto unlock_rtnl;
+
+        wdev = dev->ieee80211_ptr;
+
+        if (!rdev->ops->set_power_mgmt) {
+                err = -EOPNOTSUPP;
+                goto out;
+        }
+
+        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
+        if (!msg) {
+                err = -ENOMEM;
+                goto out;
+        }
+
+        hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
+                             NL80211_CMD_GET_POWER_SAVE);
+        if (!hdr) {
+                err = -ENOMEM;
+                goto free_msg;
+        }
+
+        if (wdev->ps)
+                ps_state = NL80211_PS_ENABLED;
+        else
+                ps_state = NL80211_PS_DISABLED;
+
+        NLA_PUT_U32(msg, NL80211_ATTR_PS_STATE, ps_state);
+
+        genlmsg_end(msg, hdr);
+        err = genlmsg_reply(msg, info);
+        goto out;
+
+nla_put_failure:
+        err = -ENOBUFS;
+
+free_msg:
+        nlmsg_free(msg);
+
+out:
+        cfg80211_unlock_rdev(rdev);
+        dev_put(dev);
+
+unlock_rtnl:
+        rtnl_unlock();
+
+        return err;
+}
+
 static struct genl_ops nl80211_ops[] = {
         {
                 .cmd = NL80211_CMD_GET_WIPHY,
@@ -4293,7 +5018,73 @@ static struct genl_ops nl80211_ops[] = {
                 .policy = nl80211_policy,
                 .flags = GENL_ADMIN_PERM,
         },
+        {
+                .cmd = NL80211_CMD_GET_SURVEY,
+                .policy = nl80211_policy,
+                .dumpit = nl80211_dump_survey,
+        },
+        {
+                .cmd = NL80211_CMD_SET_PMKSA,
+                .doit = nl80211_setdel_pmksa,
+                .policy = nl80211_policy,
+                .flags = GENL_ADMIN_PERM,
+        },
+        {
+                .cmd = NL80211_CMD_DEL_PMKSA,
+                .doit = nl80211_setdel_pmksa,
+                .policy = nl80211_policy,
+                .flags = GENL_ADMIN_PERM,
+        },
+        {
+                .cmd = NL80211_CMD_FLUSH_PMKSA,
+                .doit = nl80211_flush_pmksa,
+                .policy = nl80211_policy,
+                .flags = GENL_ADMIN_PERM,
+        },
+        {
+                .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
+                .doit = nl80211_remain_on_channel,
+                .policy = nl80211_policy,
+                .flags = GENL_ADMIN_PERM,
+        },
+        {
+                .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
+                .doit = nl80211_cancel_remain_on_channel,
+                .policy = nl80211_policy,
+                .flags = GENL_ADMIN_PERM,
+        },
+        {
+                .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
+                .doit = nl80211_set_tx_bitrate_mask,
+                .policy = nl80211_policy,
+                .flags = GENL_ADMIN_PERM,
+        },
+        {
+                .cmd = NL80211_CMD_REGISTER_ACTION,
+                .doit = nl80211_register_action,
+                .policy = nl80211_policy,
+                .flags = GENL_ADMIN_PERM,
+        },
+        {
+                .cmd = NL80211_CMD_ACTION,
+                .doit = nl80211_action,
+                .policy = nl80211_policy,
+                .flags = GENL_ADMIN_PERM,
+        },
+        {
+                .cmd = NL80211_CMD_SET_POWER_SAVE,
+                .doit = nl80211_set_power_save,
+                .policy = nl80211_policy,
+                .flags = GENL_ADMIN_PERM,
+        },
+        {
+                .cmd = NL80211_CMD_GET_POWER_SAVE,
+                .doit = nl80211_get_power_save,
+                .policy = nl80211_policy,
+                /* can be retrieved by unprivileged users */
+        },
 };
+
 static struct genl_multicast_group nl80211_mlme_mcgrp = {
         .name = "mlme",
 };
@@ -4881,6 +5672,193 @@ nla_put_failure:
         nlmsg_free(msg);
 }
 
+static void nl80211_send_remain_on_chan_event(
+        int cmd, struct cfg80211_registered_device *rdev,
+        struct net_device *netdev, u64 cookie,
+        struct ieee80211_channel *chan,
+        enum nl80211_channel_type channel_type,
+        unsigned int duration, gfp_t gfp)
+{
+        struct sk_buff *msg;
+        void *hdr;
+
+        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
+        if (!msg)
+                return;
+
+        hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
+        if (!hdr) {
+                nlmsg_free(msg);
+                return;
+        }
+
+        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
+        NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
+        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq);
+        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, channel_type);
+        NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
+
+        if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL)
+                NLA_PUT_U32(msg, NL80211_ATTR_DURATION, duration);
+
+        if (genlmsg_end(msg, hdr) < 0) {
+                nlmsg_free(msg);
+                return;
+        }
+
+        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
+                                nl80211_mlme_mcgrp.id, gfp);
+        return;
+
+ nla_put_failure:
+        genlmsg_cancel(msg, hdr);
+        nlmsg_free(msg);
+}
+
+void nl80211_send_remain_on_channel(struct cfg80211_registered_device *rdev,
+                                    struct net_device *netdev, u64 cookie,
+                                    struct ieee80211_channel *chan,
+                                    enum nl80211_channel_type channel_type,
+                                    unsigned int duration, gfp_t gfp)
+{
+        nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
+                                          rdev, netdev, cookie, chan,
+                                          channel_type, duration, gfp);
+}
+
+void nl80211_send_remain_on_channel_cancel(
+        struct cfg80211_registered_device *rdev, struct net_device *netdev,
+        u64 cookie, struct ieee80211_channel *chan,
+        enum nl80211_channel_type channel_type, gfp_t gfp)
+{
+        nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
+                                          rdev, netdev, cookie, chan,
+                                          channel_type, 0, gfp);
+}
+
+void nl80211_send_sta_event(struct cfg80211_registered_device *rdev,
+                            struct net_device *dev, const u8 *mac_addr,
+                            struct station_info *sinfo, gfp_t gfp)
+{
+        struct sk_buff *msg;
+
+        msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
+        if (!msg)
+                return;
+
+        if (nl80211_send_station(msg, 0, 0, 0, dev, mac_addr, sinfo) < 0) {
+                nlmsg_free(msg);
+                return;
+        }
+
+        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
+                                nl80211_mlme_mcgrp.id, gfp);
+}
+
+int nl80211_send_action(struct cfg80211_registered_device *rdev,
+                        struct net_device *netdev, u32 nlpid,
+                        int freq, const u8 *buf, size_t len, gfp_t gfp)
+{
+        struct sk_buff *msg;
+        void *hdr;
+        int err;
+
+        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
+        if (!msg)
+                return -ENOMEM;
+
+        hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ACTION);
+        if (!hdr) {
+                nlmsg_free(msg);
+                return -ENOMEM;
+        }
+
+        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
+        NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
+        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, freq);
+        NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
+
+        err = genlmsg_end(msg, hdr);
+        if (err < 0) {
+                nlmsg_free(msg);
+                return err;
+        }
+
+        err = genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlpid);
+        if (err < 0)
+                return err;
+        return 0;
+
+ nla_put_failure:
+        genlmsg_cancel(msg, hdr);
+        nlmsg_free(msg);
+        return -ENOBUFS;
+}
+
+void nl80211_send_action_tx_status(struct cfg80211_registered_device *rdev,
+                                   struct net_device *netdev, u64 cookie,
+                                   const u8 *buf, size_t len, bool ack,
+                                   gfp_t gfp)
+{
+        struct sk_buff *msg;
+        void *hdr;
+
+        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
+        if (!msg)
+                return;
+
+        hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ACTION_TX_STATUS);
+        if (!hdr) {
+                nlmsg_free(msg);
+                return;
+        }
+
+        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
+        NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
+        NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
+        NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
+        if (ack)
+                NLA_PUT_FLAG(msg, NL80211_ATTR_ACK);
+
+        if (genlmsg_end(msg, hdr) < 0) {
+                nlmsg_free(msg);
+                return;
+        }
+
+        genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
+        return;
+
+ nla_put_failure:
+        genlmsg_cancel(msg, hdr);
+        nlmsg_free(msg);
+}
+
+static int nl80211_netlink_notify(struct notifier_block * nb,
+                                  unsigned long state,
+                                  void *_notify)
+{
+        struct netlink_notify *notify = _notify;
+        struct cfg80211_registered_device *rdev;
+        struct wireless_dev *wdev;
+
+        if (state != NETLINK_URELEASE)
+                return NOTIFY_DONE;
+
+        rcu_read_lock();
+
+        list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list)
+                list_for_each_entry_rcu(wdev, &rdev->netdev_list, list)
+                        cfg80211_mlme_unregister_actions(wdev, notify->pid);
+
+        rcu_read_unlock();
+
+        return NOTIFY_DONE;
+}
+
+static struct notifier_block nl80211_netlink_notifier = {
+        .notifier_call = nl80211_netlink_notify,
+};
+
 /* initialisation/exit functions */
 
 int nl80211_init(void)
@@ -4914,6 +5892,10 @@ int nl80211_init(void)
                 goto err_out;
 #endif
 
+        err = netlink_register_notifier(&nl80211_netlink_notifier);
+        if (err)
+                goto err_out;
+
         return 0;
  err_out:
         genl_unregister_family(&nl80211_fam);
@@ -4922,5 +5904,6 @@ int nl80211_init(void)
 
 void nl80211_exit(void)
 {
+        netlink_unregister_notifier(&nl80211_netlink_notifier);
         genl_unregister_family(&nl80211_fam);
 }
diff --git a/net/wireless/nl80211.h b/net/wireless/nl80211.h
index 44cc2a76a1b0..4ca511102c6c 100644
--- a/net/wireless/nl80211.h
+++ b/net/wireless/nl80211.h
@@ -59,4 +59,27 @@ void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
                              struct net_device *netdev, const u8 *bssid,
                              gfp_t gfp);
 
+void nl80211_send_remain_on_channel(struct cfg80211_registered_device *rdev,
+                                    struct net_device *netdev,
+                                    u64 cookie,
+                                    struct ieee80211_channel *chan,
+                                    enum nl80211_channel_type channel_type,
+                                    unsigned int duration, gfp_t gfp);
+void nl80211_send_remain_on_channel_cancel(
+        struct cfg80211_registered_device *rdev, struct net_device *netdev,
+        u64 cookie, struct ieee80211_channel *chan,
+        enum nl80211_channel_type channel_type, gfp_t gfp);
+
+void nl80211_send_sta_event(struct cfg80211_registered_device *rdev,
+                            struct net_device *dev, const u8 *mac_addr,
+                            struct station_info *sinfo, gfp_t gfp);
+
+int nl80211_send_action(struct cfg80211_registered_device *rdev,
+                        struct net_device *netdev, u32 nlpid, int freq,
+                        const u8 *buf, size_t len, gfp_t gfp);
+void nl80211_send_action_tx_status(struct cfg80211_registered_device *rdev,
+                                   struct net_device *netdev, u64 cookie,
+                                   const u8 *buf, size_t len, bool ack,
+                                   gfp_t gfp);
+
 #endif /* __NET_WIRELESS_NL80211_H */
diff --git a/net/wireless/radiotap.c b/net/wireless/radiotap.c
index f591871a7b4f..1332c445d1c7 100644
--- a/net/wireless/radiotap.c
+++ b/net/wireless/radiotap.c
@@ -2,6 +2,16 @@
  * Radiotap parser
  *
  * Copyright 2007               Andy Green <andy@warmcat.com>
+ * Copyright 2009               Johannes Berg <johannes@sipsolutions.net>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * Alternatively, this software may be distributed under the terms of BSD
+ * license.
+ *
+ * See COPYING for more details.
  */
 
 #include <net/cfg80211.h>
@@ -10,6 +20,35 @@
 
 /* function prototypes and related defs are in include/net/cfg80211.h */
 
+static const struct radiotap_align_size rtap_namespace_sizes[] = {
+        [IEEE80211_RADIOTAP_TSFT] = { .align = 8, .size = 8, },
+        [IEEE80211_RADIOTAP_FLAGS] = { .align = 1, .size = 1, },
+        [IEEE80211_RADIOTAP_RATE] = { .align = 1, .size = 1, },
+        [IEEE80211_RADIOTAP_CHANNEL] = { .align = 2, .size = 4, },
+        [IEEE80211_RADIOTAP_FHSS] = { .align = 2, .size = 2, },
+        [IEEE80211_RADIOTAP_DBM_ANTSIGNAL] = { .align = 1, .size = 1, },
+        [IEEE80211_RADIOTAP_DBM_ANTNOISE] = { .align = 1, .size = 1, },
+        [IEEE80211_RADIOTAP_LOCK_QUALITY] = { .align = 2, .size = 2, },
+        [IEEE80211_RADIOTAP_TX_ATTENUATION] = { .align = 2, .size = 2, },
+        [IEEE80211_RADIOTAP_DB_TX_ATTENUATION] = { .align = 2, .size = 2, },
+        [IEEE80211_RADIOTAP_DBM_TX_POWER] = { .align = 1, .size = 1, },
+        [IEEE80211_RADIOTAP_ANTENNA] = { .align = 1, .size = 1, },
+        [IEEE80211_RADIOTAP_DB_ANTSIGNAL] = { .align = 1, .size = 1, },
+        [IEEE80211_RADIOTAP_DB_ANTNOISE] = { .align = 1, .size = 1, },
+        [IEEE80211_RADIOTAP_RX_FLAGS] = { .align = 2, .size = 2, },
+        [IEEE80211_RADIOTAP_TX_FLAGS] = { .align = 2, .size = 2, },
+        [IEEE80211_RADIOTAP_RTS_RETRIES] = { .align = 1, .size = 1, },
+        [IEEE80211_RADIOTAP_DATA_RETRIES] = { .align = 1, .size = 1, },
+        /*
+         * add more here as they are defined in radiotap.h
+         */
+};
+
+static const struct ieee80211_radiotap_namespace radiotap_ns = {
+        .n_bits = sizeof(rtap_namespace_sizes) / sizeof(rtap_namespace_sizes[0]),
+        .align_size = rtap_namespace_sizes,
+};
+
 /**
  * ieee80211_radiotap_iterator_init - radiotap parser iterator initialization
  * @iterator: radiotap_iterator to initialize
@@ -50,9 +89,9 @@
  */
 
 int ieee80211_radiotap_iterator_init(
-    struct ieee80211_radiotap_iterator *iterator,
-    struct ieee80211_radiotap_header *radiotap_header,
-    int max_length)
+        struct ieee80211_radiotap_iterator *iterator,
+        struct ieee80211_radiotap_header *radiotap_header,
+        int max_length, const struct ieee80211_radiotap_vendor_namespaces *vns)
 {
         /* Linux only supports version 0 radiotap format */
         if (radiotap_header->it_version)
@@ -62,19 +101,24 @@ int ieee80211_radiotap_iterator_init(
         if (max_length < get_unaligned_le16(&radiotap_header->it_len))
                 return -EINVAL;
 
-        iterator->rtheader = radiotap_header;
-        iterator->max_length = get_unaligned_le16(&radiotap_header->it_len);
-        iterator->arg_index = 0;
-        iterator->bitmap_shifter = get_unaligned_le32(&radiotap_header->it_present);
-        iterator->arg = (u8 *)radiotap_header + sizeof(*radiotap_header);
-        iterator->this_arg = NULL;
+        iterator->_rtheader = radiotap_header;
+        iterator->_max_length = get_unaligned_le16(&radiotap_header->it_len);
+        iterator->_arg_index = 0;
+        iterator->_bitmap_shifter = get_unaligned_le32(&radiotap_header->it_present);
+        iterator->_arg = (uint8_t *)radiotap_header + sizeof(*radiotap_header);
+        iterator->_reset_on_ext = 0;
+        iterator->_next_bitmap = &radiotap_header->it_present;
+        iterator->_next_bitmap++;
+        iterator->_vns = vns;
+        iterator->current_namespace = &radiotap_ns;
+        iterator->is_radiotap_ns = 1;
 
         /* find payload start allowing for extended bitmap(s) */
 
-        if (unlikely(iterator->bitmap_shifter & (1<<IEEE80211_RADIOTAP_EXT))) {
-                while (get_unaligned_le32(iterator->arg) &
-                       (1 << IEEE80211_RADIOTAP_EXT)) {
-                        iterator->arg += sizeof(u32);
+        if (iterator->_bitmap_shifter & (1<<IEEE80211_RADIOTAP_EXT)) {
+                while (get_unaligned_le32(iterator->_arg) &
+                                        (1 << IEEE80211_RADIOTAP_EXT)) {
+                        iterator->_arg += sizeof(uint32_t);
 
                         /*
                          * check for insanity where the present bitmaps
@@ -82,12 +126,13 @@ int ieee80211_radiotap_iterator_init(
                          * stated radiotap header length
                          */
 
-                        if (((ulong)iterator->arg -
-                             (ulong)iterator->rtheader) > iterator->max_length)
+                        if ((unsigned long)iterator->_arg -
+                            (unsigned long)iterator->_rtheader >
+                            (unsigned long)iterator->_max_length)
                                 return -EINVAL;
                 }
 
-                iterator->arg += sizeof(u32);
+                iterator->_arg += sizeof(uint32_t);
 
                 /*
                  * no need to check again for blowing past stated radiotap
@@ -96,12 +141,36 @@ int ieee80211_radiotap_iterator_init(
                  */
         }
 
+        iterator->this_arg = iterator->_arg;
+
         /* we are all initialized happily */
 
         return 0;
 }
 EXPORT_SYMBOL(ieee80211_radiotap_iterator_init);
 
+static void find_ns(struct ieee80211_radiotap_iterator *iterator,
+                    uint32_t oui, uint8_t subns)
+{
+        int i;
+
+        iterator->current_namespace = NULL;
+
+        if (!iterator->_vns)
+                return;
+
+        for (i = 0; i < iterator->_vns->n_ns; i++) {
+                if (iterator->_vns->ns[i].oui != oui)
+                        continue;
+                if (iterator->_vns->ns[i].subns != subns)
+                        continue;
+
+                iterator->current_namespace = &iterator->_vns->ns[i];
+                break;
+        }
+}
+
+
 
 /**
  * ieee80211_radiotap_iterator_next - return next radiotap parser iterator arg
@@ -127,99 +196,80 @@ EXPORT_SYMBOL(ieee80211_radiotap_iterator_init);
  */
 
 int ieee80211_radiotap_iterator_next(
-    struct ieee80211_radiotap_iterator *iterator)
+        struct ieee80211_radiotap_iterator *iterator)
 {
-
-        /*
-         * small length lookup table for all radiotap types we heard of
-         * starting from b0 in the bitmap, so we can walk the payload
-         * area of the radiotap header
-         *
-         * There is a requirement to pad args, so that args
-         * of a given length must begin at a boundary of that length
-         * -- but note that compound args are allowed (eg, 2 x u16
-         * for IEEE80211_RADIOTAP_CHANNEL) so total arg length is not
-         * a reliable indicator of alignment requirement.
-         *
-         * upper nybble: content alignment for arg
-         * lower nybble: content length for arg
-         */
-
-        static const u8 rt_sizes[] = {
-                [IEEE80211_RADIOTAP_TSFT] = 0x88,
-                [IEEE80211_RADIOTAP_FLAGS] = 0x11,
-                [IEEE80211_RADIOTAP_RATE] = 0x11,
-                [IEEE80211_RADIOTAP_CHANNEL] = 0x24,
-                [IEEE80211_RADIOTAP_FHSS] = 0x22,
-                [IEEE80211_RADIOTAP_DBM_ANTSIGNAL] = 0x11,
-                [IEEE80211_RADIOTAP_DBM_ANTNOISE] = 0x11,
-                [IEEE80211_RADIOTAP_LOCK_QUALITY] = 0x22,
-                [IEEE80211_RADIOTAP_TX_ATTENUATION] = 0x22,
-                [IEEE80211_RADIOTAP_DB_TX_ATTENUATION] = 0x22,
-                [IEEE80211_RADIOTAP_DBM_TX_POWER] = 0x11,
-                [IEEE80211_RADIOTAP_ANTENNA] = 0x11,
-                [IEEE80211_RADIOTAP_DB_ANTSIGNAL] = 0x11,
-                [IEEE80211_RADIOTAP_DB_ANTNOISE] = 0x11,
-                [IEEE80211_RADIOTAP_RX_FLAGS] = 0x22,
-                [IEEE80211_RADIOTAP_TX_FLAGS] = 0x22,
-                [IEEE80211_RADIOTAP_RTS_RETRIES] = 0x11,
-                [IEEE80211_RADIOTAP_DATA_RETRIES] = 0x11,
-                /*
-                 * add more here as they are defined in
-                 * include/net/ieee80211_radiotap.h
-                 */
-        };
-
-        /*
-         * for every radiotap entry we can at
-         * least skip (by knowing the length)...
-         */
-
-        while (iterator->arg_index < sizeof(rt_sizes)) {
+        while (1) {
                 int hit = 0;
-                int pad;
+                int pad, align, size, subns, vnslen;
+                uint32_t oui;
 
-                if (!(iterator->bitmap_shifter & 1))
+                /* if no more EXT bits, that's it */
+                if ((iterator->_arg_index % 32) == IEEE80211_RADIOTAP_EXT &&
+                    !(iterator->_bitmap_shifter & 1))
+                        return -ENOENT;
+
+                if (!(iterator->_bitmap_shifter & 1))
                         goto next_entry; /* arg not present */
 
+                /* get alignment/size of data */
+                switch (iterator->_arg_index % 32) {
+                case IEEE80211_RADIOTAP_RADIOTAP_NAMESPACE:
+                case IEEE80211_RADIOTAP_EXT:
+                        align = 1;
+                        size = 0;
+                        break;
+                case IEEE80211_RADIOTAP_VENDOR_NAMESPACE:
+                        align = 2;
+                        size = 6;
+                        break;
+                default:
+                        if (!iterator->current_namespace ||
+                            iterator->_arg_index >= iterator->current_namespace->n_bits) {
+                                if (iterator->current_namespace == &radiotap_ns)
+                                        return -ENOENT;
+                                align = 0;
+                        } else {
+                                align = iterator->current_namespace->align_size[iterator->_arg_index].align;
+                                size = iterator->current_namespace->align_size[iterator->_arg_index].size;
+                        }
+                        if (!align) {
+                                /* skip all subsequent data */
+                                iterator->_arg = iterator->_next_ns_data;
+                                /* give up on this namespace */
+                                iterator->current_namespace = NULL;
+                                goto next_entry;
+                        }
+                        break;
+                }
+
                 /*
                  * arg is present, account for alignment padding
-                 *  8-bit args can be at any alignment
-                 * 16-bit args must start on 16-bit boundary
-                 * 32-bit args must start on 32-bit boundary
-                 * 64-bit args must start on 64-bit boundary
                  *
-                 * note that total arg size can differ from alignment of
-                 * elements inside arg, so we use upper nybble of length
-                 * table to base alignment on
-                 *
-                 * also note: these alignments are ** relative to the
-                 * start of the radiotap header **.  There is no guarantee
+                 * Note that these alignments are relative to the start
+                 * of the radiotap header.  There is no guarantee
                  * that the radiotap header itself is aligned on any
                  * kind of boundary.
                  *
-                 * the above is why get_unaligned() is used to dereference
-                 * multibyte elements from the radiotap area
+                 * The above is why get_unaligned() is used to dereference
+                 * multibyte elements from the radiotap area.
                  */
 
-                pad = (((ulong)iterator->arg) -
-                        ((ulong)iterator->rtheader)) &
-                        ((rt_sizes[iterator->arg_index] >> 4) - 1);
+                pad = ((unsigned long)iterator->_arg -
+                       (unsigned long)iterator->_rtheader) & (align - 1);
 
                 if (pad)
-                        iterator->arg +=
-                                (rt_sizes[iterator->arg_index] >> 4) - pad;
+                        iterator->_arg += align - pad;
 
                 /*
                  * this is what we will return to user, but we need to
                  * move on first so next call has something fresh to test
                  */
-                iterator->this_arg_index = iterator->arg_index;
-                iterator->this_arg = iterator->arg;
-                hit = 1;
+                iterator->this_arg_index = iterator->_arg_index;
+                iterator->this_arg = iterator->_arg;
+                iterator->this_arg_size = size;
 
                 /* internally move on the size of this arg */
-                iterator->arg += rt_sizes[iterator->arg_index] & 0x0f;
+                iterator->_arg += size;
 
                 /*
                  * check for insanity where we are given a bitmap that
@@ -228,32 +278,73 @@ int ieee80211_radiotap_iterator_next(
                  * max_length on the last arg, never exceeding it.
                  */
 
-                if (((ulong)iterator->arg - (ulong)iterator->rtheader) >
-                    iterator->max_length)
+                if ((unsigned long)iterator->_arg -
+                    (unsigned long)iterator->_rtheader >
+                    (unsigned long)iterator->_max_length)
                         return -EINVAL;
 
-        next_entry:
-                iterator->arg_index++;
-                if (unlikely((iterator->arg_index & 31) == 0)) {
-                        /* completed current u32 bitmap */
-                        if (iterator->bitmap_shifter & 1) {
-                                /* b31 was set, there is more */
-                                /* move to next u32 bitmap */
-                                iterator->bitmap_shifter =
-                                    get_unaligned_le32(iterator->next_bitmap);
-                                iterator->next_bitmap++;
-                        } else
-                                /* no more bitmaps: end */
-                                iterator->arg_index = sizeof(rt_sizes);
-                } else /* just try the next bit */
-                        iterator->bitmap_shifter >>= 1;
+                /* these special ones are valid in each bitmap word */
+                switch (iterator->_arg_index % 32) {
+                case IEEE80211_RADIOTAP_VENDOR_NAMESPACE:
+                        iterator->_bitmap_shifter >>= 1;
+                        iterator->_arg_index++;
+
+                        iterator->_reset_on_ext = 1;
+
+                        vnslen = get_unaligned_le16(iterator->this_arg + 4);
+                        iterator->_next_ns_data = iterator->_arg + vnslen;
+                        oui = (*iterator->this_arg << 16) |
+                                (*(iterator->this_arg + 1) << 8) |
+                                *(iterator->this_arg + 2);
+                        subns = *(iterator->this_arg + 3);
+
+                        find_ns(iterator, oui, subns);
+
+                        iterator->is_radiotap_ns = 0;
+                        /* allow parsers to show this information */
+                        iterator->this_arg_index =
+                                IEEE80211_RADIOTAP_VENDOR_NAMESPACE;
+                        iterator->this_arg_size += vnslen;
+                        if ((unsigned long)iterator->this_arg +
+                            iterator->this_arg_size -
+                            (unsigned long)iterator->_rtheader >
+                            (unsigned long)(unsigned long)iterator->_max_length)
+                                return -EINVAL;
+                        hit = 1;
+                        break;
+                case IEEE80211_RADIOTAP_RADIOTAP_NAMESPACE:
+                        iterator->_bitmap_shifter >>= 1;
+                        iterator->_arg_index++;
+
+                        iterator->_reset_on_ext = 1;
+                        iterator->current_namespace = &radiotap_ns;
+                        iterator->is_radiotap_ns = 1;
+                        break;
+                case IEEE80211_RADIOTAP_EXT:
+                        /*
+                         * bit 31 was set, there is more
+                         * -- move to next u32 bitmap
+                         */
+                        iterator->_bitmap_shifter =
+                                get_unaligned_le32(iterator->_next_bitmap);
+                        iterator->_next_bitmap++;
+                        if (iterator->_reset_on_ext)
+                                iterator->_arg_index = 0;
+                        else
+                                iterator->_arg_index++;
+                        iterator->_reset_on_ext = 0;
+                        break;
+                default:
+                        /* we've got a hit! */
+                        hit = 1;
+ next_entry:
+                        iterator->_bitmap_shifter >>= 1;
+                        iterator->_arg_index++;
+                }
 
                 /* if we found a valid arg earlier, return it now */
                 if (hit)
                         return 0;
         }
-
-        /* we don't know how to handle any more args, we're done */
-        return -ENOENT;
 }
 EXPORT_SYMBOL(ieee80211_radiotap_iterator_next);
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index f256dfffbf46..422da20d1e5b 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -33,6 +33,7 @@
  *
  */
 #include <linux/kernel.h>
+#include <linux/slab.h>
 #include <linux/list.h>
 #include <linux/random.h>
 #include <linux/nl80211.h>
@@ -40,8 +41,18 @@
 #include <net/cfg80211.h>
 #include "core.h"
 #include "reg.h"
+#include "regdb.h"
 #include "nl80211.h"
 
+#ifdef CONFIG_CFG80211_REG_DEBUG
+#define REG_DBG_PRINT(format, args...) \
+        do { \
+                printk(KERN_DEBUG format , ## args); \
+        } while (0)
+#else
+#define REG_DBG_PRINT(args...)
+#endif
+
 /* Receipt of information from last regulatory request */
 static struct regulatory_request *last_request;
 
@@ -124,107 +135,11 @@ static const struct ieee80211_regdomain *cfg80211_world_regdom =
         &world_regdom;
 
 static char *ieee80211_regdom = "00";
+static char user_alpha2[2];
 
 module_param(ieee80211_regdom, charp, 0444);
 MODULE_PARM_DESC(ieee80211_regdom, "IEEE 802.11 regulatory domain code");
 
-#ifdef CONFIG_WIRELESS_OLD_REGULATORY
-/*
- * We assume 40 MHz bandwidth for the old regulatory work.
- * We make emphasis we are using the exact same frequencies
- * as before
- */
-
-static const struct ieee80211_regdomain us_regdom = {
-        .n_reg_rules = 6,
-        .alpha2 =  "US",
-        .reg_rules = {
-                /* IEEE 802.11b/g, channels 1..11 */
-                REG_RULE(2412-10, 2462+10, 40, 6, 27, 0),
-                /* IEEE 802.11a, channel 36 */
-                REG_RULE(5180-10, 5180+10, 40, 6, 23, 0),
-                /* IEEE 802.11a, channel 40 */
-                REG_RULE(5200-10, 5200+10, 40, 6, 23, 0),
-                /* IEEE 802.11a, channel 44 */
-                REG_RULE(5220-10, 5220+10, 40, 6, 23, 0),
-                /* IEEE 802.11a, channels 48..64 */
-                REG_RULE(5240-10, 5320+10, 40, 6, 23, 0),
-                /* IEEE 802.11a, channels 149..165, outdoor */
-                REG_RULE(5745-10, 5825+10, 40, 6, 30, 0),
-        }
-};
-
-static const struct ieee80211_regdomain jp_regdom = {
-        .n_reg_rules = 3,
-        .alpha2 =  "JP",
-        .reg_rules = {
-                /* IEEE 802.11b/g, channels 1..14 */
-                REG_RULE(2412-10, 2484+10, 40, 6, 20, 0),
-                /* IEEE 802.11a, channels 34..48 */
-                REG_RULE(5170-10, 5240+10, 40, 6, 20,
-                        NL80211_RRF_PASSIVE_SCAN),
-                /* IEEE 802.11a, channels 52..64 */
-                REG_RULE(5260-10, 5320+10, 40, 6, 20,
-                        NL80211_RRF_NO_IBSS |
-                        NL80211_RRF_DFS),
-        }
-};
-
-static const struct ieee80211_regdomain eu_regdom = {
-        .n_reg_rules = 6,
-        /*
-         * This alpha2 is bogus, we leave it here just for stupid
-         * backward compatibility
-         */
-        .alpha2 =  "EU",
-        .reg_rules = {
-                /* IEEE 802.11b/g, channels 1..13 */
-                REG_RULE(2412-10, 2472+10, 40, 6, 20, 0),
-                /* IEEE 802.11a, channel 36 */
-                REG_RULE(5180-10, 5180+10, 40, 6, 23,
-                        NL80211_RRF_PASSIVE_SCAN),
-                /* IEEE 802.11a, channel 40 */
-                REG_RULE(5200-10, 5200+10, 40, 6, 23,
-                        NL80211_RRF_PASSIVE_SCAN),
-                /* IEEE 802.11a, channel 44 */
-                REG_RULE(5220-10, 5220+10, 40, 6, 23,
-                        NL80211_RRF_PASSIVE_SCAN),
-                /* IEEE 802.11a, channels 48..64 */
-                REG_RULE(5240-10, 5320+10, 40, 6, 20,
-                        NL80211_RRF_NO_IBSS |
-                        NL80211_RRF_DFS),
-                /* IEEE 802.11a, channels 100..140 */
-                REG_RULE(5500-10, 5700+10, 40, 6, 30,
-                        NL80211_RRF_NO_IBSS |
-                        NL80211_RRF_DFS),
-        }
-};
-
-static const struct ieee80211_regdomain *static_regdom(char *alpha2)
-{
-        if (alpha2[0] == 'U' && alpha2[1] == 'S')
-                return &us_regdom;
-        if (alpha2[0] == 'J' && alpha2[1] == 'P')
-                return &jp_regdom;
-        if (alpha2[0] == 'E' && alpha2[1] == 'U')
-                return &eu_regdom;
-        /* Default, as per the old rules */
-        return &us_regdom;
-}
-
-static bool is_old_static_regdom(const struct ieee80211_regdomain *rd)
-{
-        if (rd == &us_regdom || rd == &jp_regdom || rd == &eu_regdom)
-                return true;
-        return false;
-}
-#else
-static inline bool is_old_static_regdom(const struct ieee80211_regdomain *rd)
-{
-        return false;
-}
-#endif
-
 static void reset_regdomains(void)
 {
         /* avoid freeing static information or freeing something twice */
@@ -234,8 +149,6 @@ static void reset_regdomains(void)
                 cfg80211_world_regdom = NULL;
         if (cfg80211_regdomain == &world_regdom)
                 cfg80211_regdomain = NULL;
-        if (is_old_static_regdom(cfg80211_regdomain))
-                cfg80211_regdomain = NULL;
 
         kfree(cfg80211_regdomain);
         kfree(cfg80211_world_regdom);
@@ -341,6 +254,27 @@ static bool regdom_changes(const char *alpha2)
         return true;
 }
 
+/*
+ * The NL80211_REGDOM_SET_BY_USER regdom alpha2 is cached, this lets
+ * you know if a valid regulatory hint with NL80211_REGDOM_SET_BY_USER
+ * has ever been issued.
+ */
+static bool is_user_regdom_saved(void)
+{
+        if (user_alpha2[0] == '9' && user_alpha2[1] == '7')
+                return false;
+
+        /* This would indicate a mistake on the design */
+        if (WARN((!is_world_regdom(user_alpha2) &&
+                  !is_an_alpha2(user_alpha2)),
+                 "Unexpected user alpha2: %c%c\n",
+                 user_alpha2[0],
+                 user_alpha2[1]))
+                return false;
+
+        return true;
+}
+
 /**
  * country_ie_integrity_changes - tells us if the country IE has changed
  * @checksum: checksum of country IE of fields we are interested in
@@ -360,6 +294,96 @@ static bool country_ie_integrity_changes(u32 checksum)
         return false;
 }
 
+static int reg_copy_regd(const struct ieee80211_regdomain **dst_regd,
+                         const struct ieee80211_regdomain *src_regd)
+{
+        struct ieee80211_regdomain *regd;
+        int size_of_regd = 0;
+        unsigned int i;
+
+        size_of_regd = sizeof(struct ieee80211_regdomain) +
+          ((src_regd->n_reg_rules + 1) * sizeof(struct ieee80211_reg_rule));
+
+        regd = kzalloc(size_of_regd, GFP_KERNEL);
+        if (!regd)
+                return -ENOMEM;
+
+        memcpy(regd, src_regd, sizeof(struct ieee80211_regdomain));
+
+        for (i = 0; i < src_regd->n_reg_rules; i++)
+                memcpy(&regd->reg_rules[i], &src_regd->reg_rules[i],
+                        sizeof(struct ieee80211_reg_rule));
+
+        *dst_regd = regd;
+        return 0;
+}
+
+#ifdef CONFIG_CFG80211_INTERNAL_REGDB
+struct reg_regdb_search_request {
+        char alpha2[2];
+        struct list_head list;
+};
+
+static LIST_HEAD(reg_regdb_search_list);
+static DEFINE_MUTEX(reg_regdb_search_mutex);
+
+static void reg_regdb_search(struct work_struct *work)
+{
+        struct reg_regdb_search_request *request;
+        const struct ieee80211_regdomain *curdom, *regdom;
+        int i, r;
+
+        mutex_lock(&reg_regdb_search_mutex);
+        while (!list_empty(&reg_regdb_search_list)) {
+                request = list_first_entry(&reg_regdb_search_list,
+                                           struct reg_regdb_search_request,
+                                           list);
+                list_del(&request->list);
+
+                for (i=0; i<reg_regdb_size; i++) {
+                        curdom = reg_regdb[i];
+
+                        if (!memcmp(request->alpha2, curdom->alpha2, 2)) {
+                                r = reg_copy_regd(&regdom, curdom);
+                                if (r)
+                                        break;
+                                mutex_lock(&cfg80211_mutex);
+                                set_regdom(regdom);
+                                mutex_unlock(&cfg80211_mutex);
+                                break;
+                        }
+                }
+
+                kfree(request);
+        }
+        mutex_unlock(&reg_regdb_search_mutex);
+}
+
+static DECLARE_WORK(reg_regdb_work, reg_regdb_search);
+
+static void reg_regdb_query(const char *alpha2)
+{
+        struct reg_regdb_search_request *request;
+
+        if (!alpha2)
+                return;
+
+        request = kzalloc(sizeof(struct reg_regdb_search_request), GFP_KERNEL);
+        if (!request)
+                return;
+
+        memcpy(request->alpha2, alpha2, 2);
+
+        mutex_lock(&reg_regdb_search_mutex);
+        list_add_tail(&request->list, &reg_regdb_search_list);
+        mutex_unlock(&reg_regdb_search_mutex);
+
+        schedule_work(&reg_regdb_work);
+}
+#else
+static inline void reg_regdb_query(const char *alpha2) {}
+#endif /* CONFIG_CFG80211_INTERNAL_REGDB */
+
 /*
  * This lets us keep regulatory code which is updated on a regulatory
  * basis in userspace.
@@ -379,6 +403,9 @@ static int call_crda(const char *alpha2)
                 printk(KERN_INFO "cfg80211: Calling CRDA to update world "
                         "regulatory domain\n");
 
+        /* query internal regulatory database (if it exists) */
+        reg_regdb_query(alpha2);
+
         country_env[8] = alpha2[0];
         country_env[9] = alpha2[1];
 
@@ -479,12 +506,212 @@ static bool freq_in_rule_band(const struct ieee80211_freq_range *freq_range,
 }
 
 /*
+ * This is a work around for sanity checking ieee80211_channel_to_frequency()'s
+ * work. ieee80211_channel_to_frequency() can for example currently provide a
+ * 2 GHz channel when in fact a 5 GHz channel was desired. An example would be
+ * an AP providing channel 8 on a country IE triplet when it sent this on the
+ * 5 GHz band, that channel is designed to be channel 8 on 5 GHz, not a 2 GHz
+ * channel.
+ *
+ * This can be removed once ieee80211_channel_to_frequency() takes in a band.
+ */
+static bool chan_in_band(int chan, enum ieee80211_band band)
+{
+        int center_freq = ieee80211_channel_to_frequency(chan);
+
+        switch (band) {
+        case IEEE80211_BAND_2GHZ:
+                if (center_freq <= 2484)
+                        return true;
+                return false;
+        case IEEE80211_BAND_5GHZ:
+                if (center_freq >= 5005)
+                        return true;
+                return false;
+        default:
+                return false;
+        }
+}
+
+/*
+ * Some APs may send a country IE triplet for each channel they
+ * support and while this is completely overkill and silly we still
+ * need to support it. We avoid making a single rule for each channel
+ * though and to help us with this we use this helper to find the
+ * actual subband end channel. These type of country IE triplet
+ * scenerios are handled then, all yielding two regulaotry rules from
+ * parsing a country IE:
+ *
+ * [1]
+ * [2]
+ * [36]
+ * [40]
+ *
+ * [1]
+ * [2-4]
+ * [5-12]
+ * [36]
+ * [40-44]
+ *
+ * [1-4]
+ * [5-7]
+ * [36-44]
+ * [48-64]
+ *
+ * [36-36]
+ * [40-40]
+ * [44-44]
+ * [48-48]
+ * [52-52]
+ * [56-56]
+ * [60-60]
+ * [64-64]
+ * [100-100]
+ * [104-104]
+ * [108-108]
+ * [112-112]
+ * [116-116]
+ * [120-120]
+ * [124-124]
+ * [128-128]
+ * [132-132]
+ * [136-136]
+ * [140-140]
+ *
+ * Returns 0 if the IE has been found to be invalid in the middle
+ * somewhere.
+ */
+static int max_subband_chan(enum ieee80211_band band,
+                            int orig_cur_chan,
+                            int orig_end_channel,
+                            s8 orig_max_power,
+                            u8 **country_ie,
+                            u8 *country_ie_len)
+{
+        u8 *triplets_start = *country_ie;
+        u8 len_at_triplet = *country_ie_len;
+        int end_subband_chan = orig_end_channel;
+
+        /*
+         * We'll deal with padding for the caller unless
+         * its not immediate and we don't process any channels
+         */
+        if (*country_ie_len == 1) {
+                *country_ie += 1;
+                *country_ie_len -= 1;
+                return orig_end_channel;
+        }
+
+        /* Move to the next triplet and then start search */
+        *country_ie += 3;
+        *country_ie_len -= 3;
+
+        if (!chan_in_band(orig_cur_chan, band))
+                return 0;
+
+        while (*country_ie_len >= 3) {
+                int end_channel = 0;
+                struct ieee80211_country_ie_triplet *triplet =
+                        (struct ieee80211_country_ie_triplet *) *country_ie;
+                int cur_channel = 0, next_expected_chan;
+
+                /* means last triplet is completely unrelated to this one */
+                if (triplet->ext.reg_extension_id >=
+                                IEEE80211_COUNTRY_EXTENSION_ID) {
+                        *country_ie -= 3;
+                        *country_ie_len += 3;
+                        break;
+                }
+
+                if (triplet->chans.first_channel == 0) {
+                        *country_ie += 1;
+                        *country_ie_len -= 1;
+                        if (*country_ie_len != 0)
+                                return 0;
+                        break;
+                }
+
+                if (triplet->chans.num_channels == 0)
+                        return 0;
+
+                /* Monitonically increasing channel order */
+                if (triplet->chans.first_channel <= end_subband_chan)
+                        return 0;
+
+                if (!chan_in_band(triplet->chans.first_channel, band))
+                        return 0;
+
+                /* 2 GHz */
+                if (triplet->chans.first_channel <= 14) {
+                        end_channel = triplet->chans.first_channel +
+                                triplet->chans.num_channels - 1;
+                }
+                else {
+                        end_channel =  triplet->chans.first_channel +
+                                (4 * (triplet->chans.num_channels - 1));
+                }
+
+                if (!chan_in_band(end_channel, band))
+                        return 0;
+
+                if (orig_max_power != triplet->chans.max_power) {
+                        *country_ie -= 3;
+                        *country_ie_len += 3;
+                        break;
+                }
+
+                cur_channel = triplet->chans.first_channel;
+
+                /* The key is finding the right next expected channel */
+                if (band == IEEE80211_BAND_2GHZ)
+                        next_expected_chan = end_subband_chan + 1;
+                 else
+                        next_expected_chan = end_subband_chan + 4;
+
+                if (cur_channel != next_expected_chan) {
+                        *country_ie -= 3;
+                        *country_ie_len += 3;
+                        break;
+                }
+
+                end_subband_chan = end_channel;
+
+                /* Move to the next one */
+                *country_ie += 3;
+                *country_ie_len -= 3;
+
+                /*
+                 * Padding needs to be dealt with if we processed
+                 * some channels.
+                 */
+                if (*country_ie_len == 1) {
+                        *country_ie += 1;
+                        *country_ie_len -= 1;
+                        break;
+                }
+
+                /* If seen, the IE is invalid */
+                if (*country_ie_len == 2)
+                        return 0;
+        }
+
+        if (end_subband_chan == orig_end_channel) {
+                *country_ie = triplets_start;
+                *country_ie_len = len_at_triplet;
+                return orig_end_channel;
+        }
+
+        return end_subband_chan;
+}
+
+/*
  * Converts a country IE to a regulatory domain. A regulatory domain
  * structure has a lot of information which the IE doesn't yet have,
  * so for the other values we use upper max values as we will intersect
  * with our userspace regulatory agent to get lower bounds.
  */
 static struct ieee80211_regdomain *country_ie_2_rd(
+                                enum ieee80211_band band,
                                 u8 *country_ie,
                                 u8 country_ie_len,
                                 u32 *checksum)
@@ -546,10 +773,29 @@ static struct ieee80211_regdomain *country_ie_2_rd(
                         continue;
                 }
 
+                /*
+                 * APs can add padding to make length divisible
+                 * by two, required by the spec.
+                 */
+                if (triplet->chans.first_channel == 0) {
+                        country_ie++;
+                        country_ie_len--;
+                        /* This is expected to be at the very end only */
+                        if (country_ie_len != 0)
+                                return NULL;
+                        break;
+                }
+
+                if (triplet->chans.num_channels == 0)
+                        return NULL;
+
+                if (!chan_in_band(triplet->chans.first_channel, band))
+                        return NULL;
+
                 /* 2 GHz */
-                if (triplet->chans.first_channel <= 14)
+                if (band == IEEE80211_BAND_2GHZ)
                         end_channel = triplet->chans.first_channel +
-                                triplet->chans.num_channels;
+                                triplet->chans.num_channels - 1;
                 else
                         /*
                          * 5 GHz -- For example in country IEs if the first
@@ -564,6 +810,24 @@ static struct ieee80211_regdomain *country_ie_2_rd(
                                 (4 * (triplet->chans.num_channels - 1));
 
                 cur_channel = triplet->chans.first_channel;
+
+                /*
+                 * Enhancement for APs that send a triplet for every channel
+                 * or for whatever reason sends triplets with multiple channels
+                 * separated when in fact they should be together.
+                 */
+                end_channel = max_subband_chan(band,
+                                               cur_channel,
+                                               end_channel,
+                                               triplet->chans.max_power,
+                                               &country_ie,
+                                               &country_ie_len);
+                if (!end_channel)
+                        return NULL;
+
+                if (!chan_in_band(end_channel, band))
+                        return NULL;
+
                 cur_sub_max_channel = end_channel;
 
                 /* Basic sanity check */
@@ -594,10 +858,13 @@ static struct ieee80211_regdomain *country_ie_2_rd(
 
                 last_sub_max_channel = cur_sub_max_channel;
 
-                country_ie += 3;
-                country_ie_len -= 3;
                 num_rules++;
 
+                if (country_ie_len >= 3) {
+                        country_ie += 3;
+                        country_ie_len -= 3;
+                }
+
                 /*
                  * Note: this is not a IEEE requirement but
                  * simply a memory requirement
@@ -640,6 +907,12 @@ static struct ieee80211_regdomain *country_ie_2_rd(
                         continue;
                 }
 
+                if (triplet->chans.first_channel == 0) {
+                        country_ie++;
+                        country_ie_len--;
+                        break;
+                }
+
                 reg_rule = &rd->reg_rules[i];
                 freq_range = &reg_rule->freq_range;
                 power_rule = &reg_rule->power_rule;
@@ -647,13 +920,20 @@ static struct ieee80211_regdomain *country_ie_2_rd(
                 reg_rule->flags = flags;
 
                 /* 2 GHz */
-                if (triplet->chans.first_channel <= 14)
+                if (band == IEEE80211_BAND_2GHZ)
                         end_channel = triplet->chans.first_channel +
-                                triplet->chans.num_channels;
+                                triplet->chans.num_channels -1;
                 else
                         end_channel =  triplet->chans.first_channel +
                                 (4 * (triplet->chans.num_channels - 1));
 
+                end_channel = max_subband_chan(band,
+                                               triplet->chans.first_channel,
+                                               end_channel,
+                                               triplet->chans.max_power,
+                                               &country_ie,
+                                               &country_ie_len);
+
                 /*
                  * The +10 is since the regulatory domain expects
                  * the actual band edge, not the center of freq for
@@ -674,12 +954,15 @@ static struct ieee80211_regdomain *country_ie_2_rd(
                  */
                 freq_range->max_bandwidth_khz = MHZ_TO_KHZ(40);
                 power_rule->max_antenna_gain = DBI_TO_MBI(100);
-                power_rule->max_eirp = DBM_TO_MBM(100);
+                power_rule->max_eirp = DBM_TO_MBM(triplet->chans.max_power);
 
-                country_ie += 3;
-                country_ie_len -= 3;
                 i++;
 
+                if (country_ie_len >= 3) {
+                        country_ie += 3;
+                        country_ie_len -= 3;
+                }
+
                 BUG_ON(i > NL80211_MAX_SUPP_REG_RULES);
         }
 
@@ -975,25 +1258,21 @@ static void handle_channel(struct wiphy *wiphy, enum ieee80211_band band,
                 if (r == -ERANGE &&
                     last_request->initiator ==
                     NL80211_REGDOM_SET_BY_COUNTRY_IE) {
-#ifdef CONFIG_CFG80211_REG_DEBUG
-                        printk(KERN_DEBUG "cfg80211: Leaving channel %d MHz "
+                        REG_DBG_PRINT("cfg80211: Leaving channel %d MHz "
                                 "intact on %s - no rule found in band on "
                                 "Country IE\n",
-                                chan->center_freq, wiphy_name(wiphy));
-#endif
+                        chan->center_freq, wiphy_name(wiphy));
                 } else {
                 /*
                  * In this case we know the country IE has at least one reg rule
                  * for the band so we respect its band definitions
                  */
-#ifdef CONFIG_CFG80211_REG_DEBUG
                         if (last_request->initiator ==
                             NL80211_REGDOM_SET_BY_COUNTRY_IE)
-                                printk(KERN_DEBUG "cfg80211: Disabling "
+                                REG_DBG_PRINT("cfg80211: Disabling "
                                         "channel %d MHz on %s due to "
                                         "Country IE\n",
                                         chan->center_freq, wiphy_name(wiphy));
-#endif
                         flags |= IEEE80211_CHAN_DISABLED;
                         chan->flags = flags;
                 }
@@ -1008,7 +1287,7 @@ static void handle_channel(struct wiphy *wiphy, enum ieee80211_band band,
 
         if (last_request->initiator == NL80211_REGDOM_SET_BY_DRIVER &&
             request_wiphy && request_wiphy == wiphy &&
-            request_wiphy->strict_regulatory) {
+            request_wiphy->flags & WIPHY_FLAG_STRICT_REGULATORY) {
                 /*
                  * This gaurantees the driver's requested regulatory domain
                  * will always be used as a base for further regulatory
@@ -1051,13 +1330,13 @@ static bool ignore_reg_update(struct wiphy *wiphy,
         if (!last_request)
                 return true;
         if (initiator == NL80211_REGDOM_SET_BY_CORE &&
-                  wiphy->custom_regulatory)
+            wiphy->flags & WIPHY_FLAG_CUSTOM_REGULATORY)
                 return true;
         /*
          * wiphy->regd will be set once the device has its own
          * desired regulatory domain set
          */
-        if (wiphy->strict_regulatory && !wiphy->regd &&
+        if (wiphy->flags & WIPHY_FLAG_STRICT_REGULATORY && !wiphy->regd &&
             !is_world_regdom(last_request->alpha2))
                 return true;
         return false;
@@ -1093,7 +1372,7 @@ static void handle_reg_beacon(struct wiphy *wiphy,
 
         chan->beacon_found = true;
 
-        if (wiphy->disable_beacon_hints)
+        if (wiphy->flags & WIPHY_FLAG_DISABLE_BEACON_HINTS)
                 return;
 
         chan_before.center_freq = chan->center_freq;
@@ -1164,7 +1443,7 @@ static bool reg_is_world_roaming(struct wiphy *wiphy)
                 return true;
         if (last_request &&
             last_request->initiator != NL80211_REGDOM_SET_BY_COUNTRY_IE &&
-            wiphy->custom_regulatory)
+            wiphy->flags & WIPHY_FLAG_CUSTOM_REGULATORY)
                 return true;
         return false;
 }
@@ -1367,30 +1646,6 @@ void wiphy_apply_custom_regulatory(struct wiphy *wiphy,
 }
 EXPORT_SYMBOL(wiphy_apply_custom_regulatory);
 
-static int reg_copy_regd(const struct ieee80211_regdomain **dst_regd,
-                         const struct ieee80211_regdomain *src_regd)
-{
-        struct ieee80211_regdomain *regd;
-        int size_of_regd = 0;
-        unsigned int i;
-
-        size_of_regd = sizeof(struct ieee80211_regdomain) +
-          ((src_regd->n_reg_rules + 1) * sizeof(struct ieee80211_reg_rule));
-
-        regd = kzalloc(size_of_regd, GFP_KERNEL);
-        if (!regd)
-                return -ENOMEM;
-
-        memcpy(regd, src_regd, sizeof(struct ieee80211_regdomain));
-
-        for (i = 0; i < src_regd->n_reg_rules; i++)
-                memcpy(&regd->reg_rules[i], &src_regd->reg_rules[i],
-                        sizeof(struct ieee80211_reg_rule));
-
-        *dst_regd = regd;
-        return 0;
-}
-
 /*
  * Return value which can be used by ignore_request() to indicate
  * it has been determined we should intersect two regulatory domains
@@ -1412,7 +1667,7 @@ static int ignore_request(struct wiphy *wiphy,
 
         switch (pending_request->initiator) {
         case NL80211_REGDOM_SET_BY_CORE:
-                return -EINVAL;
+                return 0;
         case NL80211_REGDOM_SET_BY_COUNTRY_IE:
 
                 last_wiphy = wiphy_idx_to_wiphy(last_request->wiphy_idx);
@@ -1443,8 +1698,6 @@ static int ignore_request(struct wiphy *wiphy,
                 return REG_INTERSECT;
         case NL80211_REGDOM_SET_BY_DRIVER:
                 if (last_request->initiator == NL80211_REGDOM_SET_BY_CORE) {
-                        if (is_old_static_regdom(cfg80211_regdomain))
-                                return 0;
                         if (regdom_changes(pending_request->alpha2))
                                 return 0;
                         return -EALREADY;
@@ -1481,8 +1734,7 @@ static int ignore_request(struct wiphy *wiphy,
                                 return -EAGAIN;
                 }
 
-                if (!is_old_static_regdom(cfg80211_regdomain) &&
-                    !regdom_changes(pending_request->alpha2))
+                if (!regdom_changes(pending_request->alpha2))
                         return -EALREADY;
 
                 return 0;
@@ -1554,6 +1806,11 @@ new_request:
 
         pending_request = NULL;
 
+        if (last_request->initiator == NL80211_REGDOM_SET_BY_USER) {
+                user_alpha2[0] = last_request->alpha2[0];
+                user_alpha2[1] = last_request->alpha2[1];
+        }
+
         /* When r == REG_INTERSECT we do need to call CRDA */
         if (r < 0) {
                 /*
@@ -1591,7 +1848,8 @@ static void reg_process_hint(struct regulatory_request *reg_request)
 
         r = __regulatory_hint(wiphy, reg_request);
         /* This is required so that the orig_* parameters are saved */
-        if (r == -EALREADY && wiphy && wiphy->strict_regulatory)
+        if (r == -EALREADY && wiphy &&
+            wiphy->flags & WIPHY_FLAG_STRICT_REGULATORY)
                 wiphy_update_regulatory(wiphy, reg_request->initiator);
 out:
         mutex_unlock(&reg_mutex);
@@ -1672,12 +1930,16 @@ static void queue_regulatory_request(struct regulatory_request *request)
         schedule_work(&reg_work);
 }
 
-/* Core regulatory hint -- happens once during cfg80211_init() */
+/*
+ * Core regulatory hint -- happens during cfg80211_init()
+ * and when we restore regulatory settings.
+ */
 static int regulatory_hint_core(const char *alpha2)
 {
         struct regulatory_request *request;
 
-        BUG_ON(last_request);
+        kfree(last_request);
+        last_request = NULL;
 
         request = kzalloc(sizeof(struct regulatory_request),
                           GFP_KERNEL);
@@ -1688,14 +1950,12 @@ static int regulatory_hint_core(const char *alpha2)
         request->alpha2[1] = alpha2[1];
         request->initiator = NL80211_REGDOM_SET_BY_CORE;
 
-        queue_regulatory_request(request);
-
         /*
          * This ensures last_request is populated once modules
          * come swinging in and calling regulatory hints and
          * wiphy_apply_custom_regulatory().
          */
-        flush_scheduled_work();
+        reg_process_hint(request);
 
         return 0;
 }
@@ -1714,7 +1974,7 @@ int regulatory_hint_user(const char *alpha2)
         request->wiphy_idx = WIPHY_IDX_STALE;
         request->alpha2[0] = alpha2[0];
         request->alpha2[1] = alpha2[1];
-        request->initiator = NL80211_REGDOM_SET_BY_USER,
+        request->initiator = NL80211_REGDOM_SET_BY_USER;
 
         queue_regulatory_request(request);
 
@@ -1782,8 +2042,9 @@ static bool reg_same_country_ie_hint(struct wiphy *wiphy,
  * therefore cannot iterate over the rdev list here.
  */
 void regulatory_hint_11d(struct wiphy *wiphy,
-                        u8 *country_ie,
-                        u8 country_ie_len)
+                         enum ieee80211_band band,
+                         u8 *country_ie,
+                         u8 country_ie_len)
 {
         struct ieee80211_regdomain *rd = NULL;
         char alpha2[2];
@@ -1829,9 +2090,11 @@ void regulatory_hint_11d(struct wiphy *wiphy,
             wiphy_idx_valid(last_request->wiphy_idx)))
                 goto out;
 
-        rd = country_ie_2_rd(country_ie, country_ie_len, &checksum);
-        if (!rd)
+        rd = country_ie_2_rd(band, country_ie, country_ie_len, &checksum);
+        if (!rd) {
+                REG_DBG_PRINT("cfg80211: Ignoring bogus country IE\n");
                 goto out;
+        }
 
         /*
          * This will not happen right now but we leave it here for the
@@ -1874,6 +2137,123 @@ out:
         mutex_unlock(&reg_mutex);
 }
 
+static void restore_alpha2(char *alpha2, bool reset_user)
+{
+        /* indicates there is no alpha2 to consider for restoration */
+        alpha2[0] = '9';
+        alpha2[1] = '7';
+
+        /* The user setting has precedence over the module parameter */
+        if (is_user_regdom_saved()) {
+                /* Unless we're asked to ignore it and reset it */
+                if (reset_user) {
+                        REG_DBG_PRINT("cfg80211: Restoring regulatory settings "
+                               "including user preference\n");
+                        user_alpha2[0] = '9';
+                        user_alpha2[1] = '7';
+
+                        /*
+                         * If we're ignoring user settings, we still need to
+                         * check the module parameter to ensure we put things
+                         * back as they were for a full restore.
+                         */
+                        if (!is_world_regdom(ieee80211_regdom)) {
+                                REG_DBG_PRINT("cfg80211: Keeping preference on "
+                                       "module parameter ieee80211_regdom: %c%c\n",
+                                       ieee80211_regdom[0],
+                                       ieee80211_regdom[1]);
+                                alpha2[0] = ieee80211_regdom[0];
+                                alpha2[1] = ieee80211_regdom[1];
+                        }
+                } else {
+                        REG_DBG_PRINT("cfg80211: Restoring regulatory settings "
+                               "while preserving user preference for: %c%c\n",
+                               user_alpha2[0],
+                               user_alpha2[1]);
+                        alpha2[0] = user_alpha2[0];
+                        alpha2[1] = user_alpha2[1];
+                }
+        } else if (!is_world_regdom(ieee80211_regdom)) {
+                REG_DBG_PRINT("cfg80211: Keeping preference on "
+                       "module parameter ieee80211_regdom: %c%c\n",
+                       ieee80211_regdom[0],
+                       ieee80211_regdom[1]);
+                alpha2[0] = ieee80211_regdom[0];
+                alpha2[1] = ieee80211_regdom[1];
+        } else
+                REG_DBG_PRINT("cfg80211: Restoring regulatory settings\n");
+}
+
+/*
+ * Restoring regulatory settings involves ingoring any
+ * possibly stale country IE information and user regulatory
+ * settings if so desired, this includes any beacon hints
+ * learned as we could have traveled outside to another country
+ * after disconnection. To restore regulatory settings we do
+ * exactly what we did at bootup:
+ *
+ *   - send a core regulatory hint
+ *   - send a user regulatory hint if applicable
+ *
+ * Device drivers that send a regulatory hint for a specific country
+ * keep their own regulatory domain on wiphy->regd so that does does
+ * not need to be remembered.
+ */
+static void restore_regulatory_settings(bool reset_user)
+{
+        char alpha2[2];
+        struct reg_beacon *reg_beacon, *btmp;
+
+        mutex_lock(&cfg80211_mutex);
+        mutex_lock(&reg_mutex);
+
+        reset_regdomains();
+        restore_alpha2(alpha2, reset_user);
+
+        /* Clear beacon hints */
+        spin_lock_bh(&reg_pending_beacons_lock);
+        if (!list_empty(&reg_pending_beacons)) {
+                list_for_each_entry_safe(reg_beacon, btmp,
+                                         &reg_pending_beacons, list) {
+                        list_del(&reg_beacon->list);
+                        kfree(reg_beacon);
+                }
+        }
+        spin_unlock_bh(&reg_pending_beacons_lock);
+
+        if (!list_empty(&reg_beacon_list)) {
+                list_for_each_entry_safe(reg_beacon, btmp,
+                                         &reg_beacon_list, list) {
+                        list_del(&reg_beacon->list);
+                        kfree(reg_beacon);
+                }
+        }
+
+        /* First restore to the basic regulatory settings */
+        cfg80211_regdomain = cfg80211_world_regdom;
+
+        mutex_unlock(&reg_mutex);
+        mutex_unlock(&cfg80211_mutex);
+
+        regulatory_hint_core(cfg80211_regdomain->alpha2);
+
+        /*
+         * This restores the ieee80211_regdom module parameter
+         * preference or the last user requested regulatory
+         * settings, user regulatory settings takes precedence.
+         */
+        if (is_an_alpha2(alpha2))
+                regulatory_hint_user(user_alpha2);
+}
+
+
+void regulatory_hint_disconnect(void)
+{
+        REG_DBG_PRINT("cfg80211: All devices are disconnected, going to "
+                      "restore regulatory settings\n");
+        restore_regulatory_settings(false);
+}
+
 static bool freq_is_chan_12_13_14(u16 freq)
 {
         if (freq == ieee80211_channel_to_frequency(12) ||
@@ -1899,13 +2279,12 @@ int regulatory_hint_found_beacon(struct wiphy *wiphy,
         if (!reg_beacon)
                 return -ENOMEM;
 
-#ifdef CONFIG_CFG80211_REG_DEBUG
-        printk(KERN_DEBUG "cfg80211: Found new beacon on "
-                "frequency: %d MHz (Ch %d) on %s\n",
-                beacon_chan->center_freq,
-                ieee80211_frequency_to_channel(beacon_chan->center_freq),
-                wiphy_name(wiphy));
-#endif
+        REG_DBG_PRINT("cfg80211: Found new beacon on "
+                      "frequency: %d MHz (Ch %d) on %s\n",
+                      beacon_chan->center_freq,
+                      ieee80211_frequency_to_channel(beacon_chan->center_freq),
+                      wiphy_name(wiphy));
+
         memcpy(&reg_beacon->chan, beacon_chan,
                 sizeof(struct ieee80211_channel));
 
@@ -1930,7 +2309,7 @@ static void print_rd_rules(const struct ieee80211_regdomain *rd)
         const struct ieee80211_freq_range *freq_range = NULL;
         const struct ieee80211_power_rule *power_rule = NULL;
 
-        printk(KERN_INFO "\t(start_freq - end_freq @ bandwidth), "
+        printk(KERN_INFO "    (start_freq - end_freq @ bandwidth), "
                 "(max_antenna_gain, max_eirp)\n");
 
         for (i = 0; i < rd->n_reg_rules; i++) {
@@ -1943,7 +2322,7 @@ static void print_rd_rules(const struct ieee80211_regdomain *rd)
                  * in certain regions
                  */
                 if (power_rule->max_antenna_gain)
-                        printk(KERN_INFO "\t(%d KHz - %d KHz @ %d KHz), "
+                        printk(KERN_INFO "    (%d KHz - %d KHz @ %d KHz), "
                                 "(%d mBi, %d mBm)\n",
                                 freq_range->start_freq_khz,
                                 freq_range->end_freq_khz,
@@ -1951,7 +2330,7 @@ static void print_rd_rules(const struct ieee80211_regdomain *rd)
                                 power_rule->max_antenna_gain,
                                 power_rule->max_eirp);
                 else
-                        printk(KERN_INFO "\t(%d KHz - %d KHz @ %d KHz), "
+                        printk(KERN_INFO "    (%d KHz - %d KHz @ %d KHz), "
                                 "(N/A, %d mBm)\n",
                                 freq_range->start_freq_khz,
                                 freq_range->end_freq_khz,
@@ -2063,8 +2442,7 @@ static int __set_regdom(const struct ieee80211_regdomain *rd)
                  * If someone else asked us to change the rd lets only bother
                  * checking if the alpha2 changes if CRDA was already called
                  */
-                if (!is_old_static_regdom(cfg80211_regdomain) &&
-                    !regdom_changes(rd->alpha2))
+                if (!regdom_changes(rd->alpha2))
                         return -EINVAL;
         }
 
@@ -2263,15 +2641,11 @@ int regulatory_init(void)
         spin_lock_init(&reg_requests_lock);
         spin_lock_init(&reg_pending_beacons_lock);
 
-#ifdef CONFIG_WIRELESS_OLD_REGULATORY
-        cfg80211_regdomain = static_regdom(ieee80211_regdom);
-
-        printk(KERN_INFO "cfg80211: Using static regulatory domain info\n");
-        print_regdomain_info(cfg80211_regdomain);
-#else
         cfg80211_regdomain = cfg80211_world_regdom;
 
-#endif
+        user_alpha2[0] = '9';
+        user_alpha2[1] = '7';
+
         /* We always try to get an update for the static regdomain */
         err = regulatory_hint_core(cfg80211_regdomain->alpha2);
         if (err) {
diff --git a/net/wireless/reg.h b/net/wireless/reg.h
index 3362c7c069b2..b26224a9f3bc 100644
--- a/net/wireless/reg.h
+++ b/net/wireless/reg.h
@@ -41,15 +41,44 @@ int regulatory_hint_found_beacon(struct wiphy *wiphy,
  * regulatory_hint_11d - hints a country IE as a regulatory domain
  * @wiphy: the wireless device giving the hint (used only for reporting
  *      conflicts)
+ * @band: the band on which the country IE was received on. This determines
+ *      the band we'll process the country IE channel triplets for.
  * @country_ie: pointer to the country IE
  * @country_ie_len: length of the country IE
  *
  * We will intersect the rd with the what CRDA tells us should apply
  * for the alpha2 this country IE belongs to, this prevents APs from
  * sending us incorrect or outdated information against a country.
+ *
+ * The AP is expected to provide Country IE channel triplets for the
+ * band it is on. It is technically possible for APs to send channel
+ * country IE triplets even for channels outside of the band they are
+ * in but for that they would have to use the regulatory extension
+ * in combination with a triplet but this behaviour is currently
+ * not observed. For this reason if a triplet is seen with channel
+ * information for a band the BSS is not present in it will be ignored.
  */
 void regulatory_hint_11d(struct wiphy *wiphy,
+                         enum ieee80211_band band,
                          u8 *country_ie,
                          u8 country_ie_len);
 
+/**
+ * regulatory_hint_disconnect - informs all devices have been disconneted
+ *
+ * Regulotory rules can be enhanced further upon scanning and upon
+ * connection to an AP. These rules become stale if we disconnect
+ * and go to another country, whether or not we suspend and resume.
+ * If we suspend, go to another country and resume we'll automatically
+ * get disconnected shortly after resuming and things will be reset as well.
+ * This routine is a helper to restore regulatory settings to how they were
+ * prior to our first connect attempt. This includes ignoring country IE and
+ * beacon regulatory hints. The ieee80211_regdom module parameter will always
+ * be respected but if a user had set the regulatory domain that will take
+ * precedence.
+ *
+ * Must be called from process context.
+ */
+void regulatory_hint_disconnect(void);
+
 #endif  /* __NET_WIRELESS_REG_H */
diff --git a/net/wireless/regdb.h b/net/wireless/regdb.h
new file mode 100644
index 000000000000..818222c92513
--- /dev/null
+++ b/net/wireless/regdb.h
@@ -0,0 +1,7 @@
+#ifndef __REGDB_H__
+#define __REGDB_H__
+
+extern const struct ieee80211_regdomain *reg_regdb[];
+extern int reg_regdb_size;
+
+#endif /* __REGDB_H__ */
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index e5f92ee758f4..a026c6d56bd3 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -4,6 +4,7 @@
  * Copyright 2008 Johannes Berg <johannes@sipsolutions.net>
  */
 #include <linux/kernel.h>
+#include <linux/slab.h>
 #include <linux/module.h>
 #include <linux/netdevice.h>
 #include <linux/wireless.h>
@@ -22,7 +23,7 @@ void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev, bool leak)
 {
         struct cfg80211_scan_request *request;
         struct net_device *dev;
-#ifdef CONFIG_WIRELESS_EXT
+#ifdef CONFIG_CFG80211_WEXT
         union iwreq_data wrqu;
 #endif
 
@@ -47,7 +48,7 @@ void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev, bool leak)
         else
                 nl80211_send_scan_done(rdev, dev);
 
-#ifdef CONFIG_WIRELESS_EXT
+#ifdef CONFIG_CFG80211_WEXT
         if (!request->aborted) {
                 memset(&wrqu, 0, sizeof(wrqu));
 
@@ -88,7 +89,7 @@ void cfg80211_scan_done(struct cfg80211_scan_request *request, bool aborted)
         WARN_ON(request != wiphy_to_dev(request->wiphy)->scan_req);
 
         request->aborted = aborted;
-        schedule_work(&wiphy_to_dev(request->wiphy)->scan_done_wk);
+        queue_work(cfg80211_wq, &wiphy_to_dev(request->wiphy)->scan_done_wk);
 }
 EXPORT_SYMBOL(cfg80211_scan_done);
 
@@ -100,8 +101,10 @@ static void bss_release(struct kref *ref)
         if (bss->pub.free_priv)
                 bss->pub.free_priv(&bss->pub);
 
-        if (bss->ies_allocated)
-                kfree(bss->pub.information_elements);
+        if (bss->beacon_ies_allocated)
+                kfree(bss->pub.beacon_ies);
+        if (bss->proberesp_ies_allocated)
+                kfree(bss->pub.proberesp_ies);
 
         BUG_ON(atomic_read(&bss->hold));
 
@@ -141,9 +144,9 @@ void cfg80211_bss_expire(struct cfg80211_registered_device *dev)
                 dev->bss_generation++;
 }
 
-static u8 *find_ie(u8 num, u8 *ies, int len)
+const u8 *cfg80211_find_ie(u8 eid, const u8 *ies, int len)
 {
-        while (len > 2 && ies[0] != num) {
+        while (len > 2 && ies[0] != eid) {
                 len -= ies[1] + 2;
                 ies += ies[1] + 2;
         }
@@ -153,11 +156,12 @@ static u8 *find_ie(u8 num, u8 *ies, int len)
                 return NULL;
         return ies;
 }
+EXPORT_SYMBOL(cfg80211_find_ie);
 
 static int cmp_ies(u8 num, u8 *ies1, size_t len1, u8 *ies2, size_t len2)
 {
-        const u8 *ie1 = find_ie(num, ies1, len1);
-        const u8 *ie2 = find_ie(num, ies2, len2);
+        const u8 *ie1 = cfg80211_find_ie(num, ies1, len1);
+        const u8 *ie2 = cfg80211_find_ie(num, ies2, len2);
         int r;
 
         if (!ie1 && !ie2)
@@ -183,9 +187,9 @@ static bool is_bss(struct cfg80211_bss *a,
         if (!ssid)
                 return true;
 
-        ssidie = find_ie(WLAN_EID_SSID,
-                         a->information_elements,
-                         a->len_information_elements);
+        ssidie = cfg80211_find_ie(WLAN_EID_SSID,
+                                  a->information_elements,
+                                  a->len_information_elements);
         if (!ssidie)
                 return false;
         if (ssidie[1] != ssid_len)
@@ -202,9 +206,9 @@ static bool is_mesh(struct cfg80211_bss *a,
         if (!is_zero_ether_addr(a->bssid))
                 return false;
 
-        ie = find_ie(WLAN_EID_MESH_ID,
-                     a->information_elements,
-                     a->len_information_elements);
+        ie = cfg80211_find_ie(WLAN_EID_MESH_ID,
+                              a->information_elements,
+                              a->len_information_elements);
         if (!ie)
                 return false;
         if (ie[1] != meshidlen)
@@ -212,12 +216,12 @@ static bool is_mesh(struct cfg80211_bss *a,
         if (memcmp(ie + 2, meshid, meshidlen))
                 return false;
 
-        ie = find_ie(WLAN_EID_MESH_CONFIG,
-                     a->information_elements,
-                     a->len_information_elements);
+        ie = cfg80211_find_ie(WLAN_EID_MESH_CONFIG,
+                              a->information_elements,
+                              a->len_information_elements);
         if (!ie)
                 return false;
-        if (ie[1] != IEEE80211_MESH_CONFIG_LEN)
+        if (ie[1] != sizeof(struct ieee80211_meshconf_ie))
                 return false;
 
         /*
@@ -225,7 +229,8 @@ static bool is_mesh(struct cfg80211_bss *a,
          * comparing since that may differ between stations taking
          * part in the same mesh.
          */
-        return memcmp(ie + 2, meshcfg, IEEE80211_MESH_CONFIG_LEN - 2) == 0;
+        return memcmp(ie + 2, meshcfg,
+            sizeof(struct ieee80211_meshconf_ie) - 2) == 0;
 }
 
 static int cmp_bss(struct cfg80211_bss *a,
@@ -374,8 +379,7 @@ rb_find_bss(struct cfg80211_registered_device *dev,
 
 static struct cfg80211_internal_bss *
 cfg80211_bss_update(struct cfg80211_registered_device *dev,
-                    struct cfg80211_internal_bss *res,
-                    bool overwrite)
+                    struct cfg80211_internal_bss *res)
 {
         struct cfg80211_internal_bss *found = NULL;
         const u8 *meshid, *meshcfg;
@@ -393,13 +397,14 @@ cfg80211_bss_update(struct cfg80211_registered_device *dev,
 
         if (is_zero_ether_addr(res->pub.bssid)) {
                 /* must be mesh, verify */
-                meshid = find_ie(WLAN_EID_MESH_ID, res->pub.information_elements,
-                                 res->pub.len_information_elements);
-                meshcfg = find_ie(WLAN_EID_MESH_CONFIG,
-                                  res->pub.information_elements,
-                                  res->pub.len_information_elements);
+                meshid = cfg80211_find_ie(WLAN_EID_MESH_ID,
+                                          res->pub.information_elements,
+                                          res->pub.len_information_elements);
+                meshcfg = cfg80211_find_ie(WLAN_EID_MESH_CONFIG,
+                                           res->pub.information_elements,
+                                           res->pub.len_information_elements);
                 if (!meshid || !meshcfg ||
-                    meshcfg[1] != IEEE80211_MESH_CONFIG_LEN) {
+                    meshcfg[1] != sizeof(struct ieee80211_meshconf_ie)) {
                         /* bogus mesh */
                         kref_put(&res->ref, bss_release);
                         return NULL;
@@ -417,28 +422,64 @@ cfg80211_bss_update(struct cfg80211_registered_device *dev,
                 found->pub.capability = res->pub.capability;
                 found->ts = res->ts;
 
-                /* overwrite IEs */
-                if (overwrite) {
+                /* Update IEs */
+                if (res->pub.proberesp_ies) {
                         size_t used = dev->wiphy.bss_priv_size + sizeof(*res);
-                        size_t ielen = res->pub.len_information_elements;
+                        size_t ielen = res->pub.len_proberesp_ies;
+
+                        if (found->pub.proberesp_ies &&
+                            !found->proberesp_ies_allocated &&
+                            ksize(found) >= used + ielen) {
+                                memcpy(found->pub.proberesp_ies,
+                                       res->pub.proberesp_ies, ielen);
+                                found->pub.len_proberesp_ies = ielen;
+                        } else {
+                                u8 *ies = found->pub.proberesp_ies;
+
+                                if (found->proberesp_ies_allocated)
+                                        ies = krealloc(ies, ielen, GFP_ATOMIC);
+                                else
+                                        ies = kmalloc(ielen, GFP_ATOMIC);
 
-                        if (!found->ies_allocated && ksize(found) >= used + ielen) {
-                                memcpy(found->pub.information_elements,
-                                       res->pub.information_elements, ielen);
-                                found->pub.len_information_elements = ielen;
+                                if (ies) {
+                                        memcpy(ies, res->pub.proberesp_ies,
+                                               ielen);
+                                        found->proberesp_ies_allocated = true;
+                                        found->pub.proberesp_ies = ies;
+                                        found->pub.len_proberesp_ies = ielen;
+                                }
+                        }
+
+                        /* Override possible earlier Beacon frame IEs */
+                        found->pub.information_elements =
+                                found->pub.proberesp_ies;
+                        found->pub.len_information_elements =
+                                found->pub.len_proberesp_ies;
+                }
+                if (res->pub.beacon_ies) {
+                        size_t used = dev->wiphy.bss_priv_size + sizeof(*res);
+                        size_t ielen = res->pub.len_beacon_ies;
+
+                        if (found->pub.beacon_ies &&
+                            !found->beacon_ies_allocated &&
+                            ksize(found) >= used + ielen) {
+                                memcpy(found->pub.beacon_ies,
+                                       res->pub.beacon_ies, ielen);
+                                found->pub.len_beacon_ies = ielen;
                         } else {
-                                u8 *ies = found->pub.information_elements;
+                                u8 *ies = found->pub.beacon_ies;
 
-                                if (found->ies_allocated)
+                                if (found->beacon_ies_allocated)
                                         ies = krealloc(ies, ielen, GFP_ATOMIC);
                                 else
                                         ies = kmalloc(ielen, GFP_ATOMIC);
 
                                 if (ies) {
-                                        memcpy(ies, res->pub.information_elements, ielen);
-                                        found->ies_allocated = true;
-                                        found->pub.information_elements = ies;
-                                        found->pub.len_information_elements = ielen;
+                                        memcpy(ies, res->pub.beacon_ies,
+                                               ielen);
+                                        found->beacon_ies_allocated = true;
+                                        found->pub.beacon_ies = ies;
+                                        found->pub.len_beacon_ies = ielen;
                                 }
                         }
                 }
@@ -488,14 +529,26 @@ cfg80211_inform_bss(struct wiphy *wiphy,
         res->pub.tsf = timestamp;
         res->pub.beacon_interval = beacon_interval;
         res->pub.capability = capability;
-        /* point to after the private area */
-        res->pub.information_elements = (u8 *)res + sizeof(*res) + privsz;
-        memcpy(res->pub.information_elements, ie, ielen);
-        res->pub.len_information_elements = ielen;
+        /*
+         * Since we do not know here whether the IEs are from a Beacon or Probe
+         * Response frame, we need to pick one of the options and only use it
+         * with the driver that does not provide the full Beacon/Probe Response
+         * frame. Use Beacon frame pointer to avoid indicating that this should
+         * override the information_elements pointer should we have received an
+         * earlier indication of Probe Response data.
+         *
+         * The initial buffer for the IEs is allocated with the BSS entry and
+         * is located after the private area.
+         */
+        res->pub.beacon_ies = (u8 *)res + sizeof(*res) + privsz;
+        memcpy(res->pub.beacon_ies, ie, ielen);
+        res->pub.len_beacon_ies = ielen;
+        res->pub.information_elements = res->pub.beacon_ies;
+        res->pub.len_information_elements = res->pub.len_beacon_ies;
 
         kref_init(&res->ref);
 
-        res = cfg80211_bss_update(wiphy_to_dev(wiphy), res, 0);
+        res = cfg80211_bss_update(wiphy_to_dev(wiphy), res);
         if (!res)
                 return NULL;
 
@@ -516,7 +569,6 @@ cfg80211_inform_bss_frame(struct wiphy *wiphy,
         struct cfg80211_internal_bss *res;
         size_t ielen = len - offsetof(struct ieee80211_mgmt,
                                       u.probe_resp.variable);
-        bool overwrite;
         size_t privsz = wiphy->bss_priv_size;
 
         if (WARN_ON(wiphy->signal_type == NL80211_BSS_SIGNAL_UNSPEC &&
@@ -537,16 +589,28 @@ cfg80211_inform_bss_frame(struct wiphy *wiphy,
         res->pub.tsf = le64_to_cpu(mgmt->u.probe_resp.timestamp);
         res->pub.beacon_interval = le16_to_cpu(mgmt->u.probe_resp.beacon_int);
         res->pub.capability = le16_to_cpu(mgmt->u.probe_resp.capab_info);
-        /* point to after the private area */
-        res->pub.information_elements = (u8 *)res + sizeof(*res) + privsz;
-        memcpy(res->pub.information_elements, mgmt->u.probe_resp.variable, ielen);
-        res->pub.len_information_elements = ielen;
+        /*
+         * The initial buffer for the IEs is allocated with the BSS entry and
+         * is located after the private area.
+         */
+        if (ieee80211_is_probe_resp(mgmt->frame_control)) {
+                res->pub.proberesp_ies = (u8 *) res + sizeof(*res) + privsz;
+                memcpy(res->pub.proberesp_ies, mgmt->u.probe_resp.variable,
+                       ielen);
+                res->pub.len_proberesp_ies = ielen;
+                res->pub.information_elements = res->pub.proberesp_ies;
+                res->pub.len_information_elements = res->pub.len_proberesp_ies;
+        } else {
+                res->pub.beacon_ies = (u8 *) res + sizeof(*res) + privsz;
+                memcpy(res->pub.beacon_ies, mgmt->u.beacon.variable, ielen);
+                res->pub.len_beacon_ies = ielen;
+                res->pub.information_elements = res->pub.beacon_ies;
+                res->pub.len_information_elements = res->pub.len_beacon_ies;
+        }
 
         kref_init(&res->ref);
 
-        overwrite = ieee80211_is_probe_resp(mgmt->frame_control);
-
-        res = cfg80211_bss_update(wiphy_to_dev(wiphy), res, overwrite);
+        res = cfg80211_bss_update(wiphy_to_dev(wiphy), res);
         if (!res)
                 return NULL;
 
@@ -592,7 +656,7 @@ void cfg80211_unlink_bss(struct wiphy *wiphy, struct cfg80211_bss *pub)
 }
 EXPORT_SYMBOL(cfg80211_unlink_bss);
 
-#ifdef CONFIG_WIRELESS_EXT
+#ifdef CONFIG_CFG80211_WEXT
 int cfg80211_wext_siwscan(struct net_device *dev,
                           struct iw_request_info *info,
                           union iwreq_data *wrqu, char *extra)
@@ -600,7 +664,7 @@ int cfg80211_wext_siwscan(struct net_device *dev,
         struct cfg80211_registered_device *rdev;
         struct wiphy *wiphy;
         struct iw_scan_req *wreq = NULL;
-        struct cfg80211_scan_request *creq;
+        struct cfg80211_scan_request *creq = NULL;
         int i, err, n_channels = 0;
         enum ieee80211_band band;
 
@@ -650,9 +714,15 @@ int cfg80211_wext_siwscan(struct net_device *dev,
         i = 0;
         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
                 int j;
+
                 if (!wiphy->bands[band])
                         continue;
+
                 for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
+                        /* ignore disabled channels */
+                        if (wiphy->bands[band]->channels[j].flags &
+                                                IEEE80211_CHAN_DISABLED)
+                                continue;
 
                         /* If we have a wireless request structure and the
                          * wireless request specifies frequencies, then search
@@ -687,8 +757,10 @@ int cfg80211_wext_siwscan(struct net_device *dev,
         /* translate "Scan for SSID" request */
         if (wreq) {
                 if (wrqu->data.flags & IW_SCAN_THIS_ESSID) {
-                        if (wreq->essid_len > IEEE80211_MAX_SSID_LEN)
-                                return -EINVAL;
+                        if (wreq->essid_len > IEEE80211_MAX_SSID_LEN) {
+                                err = -EINVAL;
+                                goto out;
+                        }
                         memcpy(creq->ssids[0].ssid, wreq->essid, wreq->essid_len);
                         creq->ssids[0].ssid_len = wreq->essid_len;
                 }
@@ -700,12 +772,15 @@ int cfg80211_wext_siwscan(struct net_device *dev,
         err = rdev->ops->scan(wiphy, dev, creq);
         if (err) {
                 rdev->scan_req = NULL;
-                kfree(creq);
+                /* creq will be freed below */
         } else {
                 nl80211_send_scan_start(rdev, dev);
+                /* creq now owned by driver */
+                creq = NULL;
                 dev_hold(dev);
         }
  out:
+        kfree(creq);
         cfg80211_unlock_rdev(rdev);
         return err;
 }
@@ -859,7 +934,7 @@ ieee80211_bss(struct wiphy *wiphy, struct iw_request_info *info,
                         break;
                 case WLAN_EID_MESH_CONFIG:
                         ismesh = true;
-                        if (ie[1] != IEEE80211_MESH_CONFIG_LEN)
+                        if (ie[1] != sizeof(struct ieee80211_meshconf_ie))
                                 break;
                         buf = kmalloc(50, GFP_ATOMIC);
                         if (!buf)
@@ -867,35 +942,40 @@ ieee80211_bss(struct wiphy *wiphy, struct iw_request_info *info,
                         cfg = ie + 2;
                         memset(&iwe, 0, sizeof(iwe));
                         iwe.cmd = IWEVCUSTOM;
-                        sprintf(buf, "Mesh network (version %d)", cfg[0]);
+                        sprintf(buf, "Mesh Network Path Selection Protocol ID: "
+                                "0x%02X", cfg[0]);
+                        iwe.u.data.length = strlen(buf);
+                        current_ev = iwe_stream_add_point(info, current_ev,
+                                                          end_buf,
+                                                          &iwe, buf);
+                        sprintf(buf, "Path Selection Metric ID: 0x%02X",
+                                cfg[1]);
+                        iwe.u.data.length = strlen(buf);
+                        current_ev = iwe_stream_add_point(info, current_ev,
+                                                          end_buf,
+                                                          &iwe, buf);
+                        sprintf(buf, "Congestion Control Mode ID: 0x%02X",
+                                cfg[2]);
                         iwe.u.data.length = strlen(buf);
                         current_ev = iwe_stream_add_point(info, current_ev,
                                                           end_buf,
                                                           &iwe, buf);
-                        sprintf(buf, "Path Selection Protocol ID: "
-                                "0x%02X%02X%02X%02X", cfg[1], cfg[2], cfg[3],
-                                                        cfg[4]);
+                        sprintf(buf, "Synchronization ID: 0x%02X", cfg[3]);
                         iwe.u.data.length = strlen(buf);
                         current_ev = iwe_stream_add_point(info, current_ev,
                                                           end_buf,
                                                           &iwe, buf);
-                        sprintf(buf, "Path Selection Metric ID: "
-                                "0x%02X%02X%02X%02X", cfg[5], cfg[6], cfg[7],
-                                                        cfg[8]);
+                        sprintf(buf, "Authentication ID: 0x%02X", cfg[4]);
                         iwe.u.data.length = strlen(buf);
                         current_ev = iwe_stream_add_point(info, current_ev,
                                                           end_buf,
                                                           &iwe, buf);
-                        sprintf(buf, "Congestion Control Mode ID: "
-                                "0x%02X%02X%02X%02X", cfg[9], cfg[10],
-                                                        cfg[11], cfg[12]);
+                        sprintf(buf, "Formation Info: 0x%02X", cfg[5]);
                         iwe.u.data.length = strlen(buf);
                         current_ev = iwe_stream_add_point(info, current_ev,
                                                           end_buf,
                                                           &iwe, buf);
-                        sprintf(buf, "Channel Precedence: "
-                                "0x%02X%02X%02X%02X", cfg[13], cfg[14],
-                                                        cfg[15], cfg[16]);
+                        sprintf(buf, "Capabilities: 0x%02X", cfg[6]);
                         iwe.u.data.length = strlen(buf);
                         current_ev = iwe_stream_add_point(info, current_ev,
                                                           end_buf,
@@ -925,8 +1005,8 @@ ieee80211_bss(struct wiphy *wiphy, struct iw_request_info *info,
                 ie += ie[1] + 2;
         }
 
-        if (bss->pub.capability & (WLAN_CAPABILITY_ESS | WLAN_CAPABILITY_IBSS)
-            || ismesh) {
+        if (bss->pub.capability & (WLAN_CAPABILITY_ESS | WLAN_CAPABILITY_IBSS) ||
+            ismesh) {
                 memset(&iwe, 0, sizeof(iwe));
                 iwe.cmd = SIOCGIWMODE;
                 if (ismesh)
diff --git a/net/wireless/sme.c b/net/wireless/sme.c
index 9f0b2800a9d7..f4dfd5f5f2ea 100644
--- a/net/wireless/sme.c
+++ b/net/wireless/sme.c
@@ -7,6 +7,7 @@
 
 #include <linux/etherdevice.h>
 #include <linux/if_arp.h>
+#include <linux/slab.h>
 #include <linux/workqueue.h>
 #include <linux/wireless.h>
 #include <net/iw_handler.h>
@@ -34,6 +35,44 @@ struct cfg80211_conn {
         bool auto_auth, prev_bssid_valid;
 };
 
+bool cfg80211_is_all_idle(void)
+{
+        struct cfg80211_registered_device *rdev;
+        struct wireless_dev *wdev;
+        bool is_all_idle = true;
+
+        mutex_lock(&cfg80211_mutex);
+
+        /*
+         * All devices must be idle as otherwise if you are actively
+         * scanning some new beacon hints could be learned and would
+         * count as new regulatory hints.
+         */
+        list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
+                cfg80211_lock_rdev(rdev);
+                list_for_each_entry(wdev, &rdev->netdev_list, list) {
+                        wdev_lock(wdev);
+                        if (wdev->sme_state != CFG80211_SME_IDLE)
+                                is_all_idle = false;
+                        wdev_unlock(wdev);
+                }
+                cfg80211_unlock_rdev(rdev);
+        }
+
+        mutex_unlock(&cfg80211_mutex);
+
+        return is_all_idle;
+}
+
+static void disconnect_work(struct work_struct *work)
+{
+        if (!cfg80211_is_all_idle())
+                return;
+
+        regulatory_hint_disconnect();
+}
+
+static DECLARE_WORK(cfg80211_disconnect_work, disconnect_work);
 
 static int cfg80211_conn_scan(struct wireless_dev *wdev)
 {
@@ -365,7 +404,7 @@ void __cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         u8 *country_ie;
-#ifdef CONFIG_WIRELESS_EXT
+#ifdef CONFIG_CFG80211_WEXT
         union iwreq_data wrqu;
 #endif
 
@@ -382,7 +421,7 @@ void __cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
                                     resp_ie, resp_ie_len,
                                     status, GFP_KERNEL);
 
-#ifdef CONFIG_WIRELESS_EXT
+#ifdef CONFIG_CFG80211_WEXT
         if (wextev) {
                 if (req_ie && status == WLAN_STATUS_SUCCESS) {
                         memset(&wrqu, 0, sizeof(wrqu));
@@ -454,6 +493,7 @@ void __cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
          * - and country_ie[1] which is the IE length
          */
         regulatory_hint_11d(wdev->wiphy,
+                            bss->channel->band,
                             country_ie + 2,
                             country_ie[1]);
 }
@@ -488,7 +528,7 @@ void cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
         spin_lock_irqsave(&wdev->event_lock, flags);
         list_add_tail(&ev->list, &wdev->event_list);
         spin_unlock_irqrestore(&wdev->event_lock, flags);
-        schedule_work(&rdev->event_work);
+        queue_work(cfg80211_wq, &rdev->event_work);
 }
 EXPORT_SYMBOL(cfg80211_connect_result);
 
@@ -497,7 +537,7 @@ void __cfg80211_roamed(struct wireless_dev *wdev, const u8 *bssid,
                        const u8 *resp_ie, size_t resp_ie_len)
 {
         struct cfg80211_bss *bss;
-#ifdef CONFIG_WIRELESS_EXT
+#ifdef CONFIG_CFG80211_WEXT
         union iwreq_data wrqu;
 #endif
 
@@ -532,7 +572,7 @@ void __cfg80211_roamed(struct wireless_dev *wdev, const u8 *bssid,
                             req_ie, req_ie_len, resp_ie, resp_ie_len,
                             GFP_KERNEL);
 
-#ifdef CONFIG_WIRELESS_EXT
+#ifdef CONFIG_CFG80211_WEXT
         if (req_ie) {
                 memset(&wrqu, 0, sizeof(wrqu));
                 wrqu.data.length = req_ie_len;
@@ -583,7 +623,7 @@ void cfg80211_roamed(struct net_device *dev, const u8 *bssid,
         spin_lock_irqsave(&wdev->event_lock, flags);
         list_add_tail(&ev->list, &wdev->event_list);
         spin_unlock_irqrestore(&wdev->event_lock, flags);
-        schedule_work(&rdev->event_work);
+        queue_work(cfg80211_wq, &rdev->event_work);
 }
 EXPORT_SYMBOL(cfg80211_roamed);
 
@@ -593,7 +633,7 @@ void __cfg80211_disconnected(struct net_device *dev, const u8 *ie,
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
         int i;
-#ifdef CONFIG_WIRELESS_EXT
+#ifdef CONFIG_CFG80211_WEXT
         union iwreq_data wrqu;
 #endif
 
@@ -651,11 +691,14 @@ void __cfg80211_disconnected(struct net_device *dev, const u8 *ie,
                 for (i = 0; i < 6; i++)
                         rdev->ops->del_key(wdev->wiphy, dev, i, NULL);
 
-#ifdef CONFIG_WIRELESS_EXT
+#ifdef CONFIG_CFG80211_WEXT
         memset(&wrqu, 0, sizeof(wrqu));
         wrqu.ap_addr.sa_family = ARPHRD_ETHER;
         wireless_send_event(dev, SIOCGIWAP, &wrqu, NULL);
+        wdev->wext.connect.ssid_len = 0;
 #endif
+
+        schedule_work(&cfg80211_disconnect_work);
 }
 
 void cfg80211_disconnected(struct net_device *dev, u16 reason,
@@ -681,7 +724,7 @@ void cfg80211_disconnected(struct net_device *dev, u16 reason,
         spin_lock_irqsave(&wdev->event_lock, flags);
         list_add_tail(&ev->list, &wdev->event_list);
         spin_unlock_irqrestore(&wdev->event_lock, flags);
-        schedule_work(&rdev->event_work);
+        queue_work(cfg80211_wq, &rdev->event_work);
 }
 EXPORT_SYMBOL(cfg80211_disconnected);
 
diff --git a/net/wireless/sysfs.c b/net/wireless/sysfs.c
index efe3c5c92b2d..9f2cef3e0ca0 100644
--- a/net/wireless/sysfs.c
+++ b/net/wireless/sysfs.c
@@ -33,10 +33,30 @@ static ssize_t name ## _show(struct device *dev,			\
 
 SHOW_FMT(index, "%d", wiphy_idx);
 SHOW_FMT(macaddress, "%pM", wiphy.perm_addr);
+SHOW_FMT(address_mask, "%pM", wiphy.addr_mask);
+
+static ssize_t addresses_show(struct device *dev,
+                              struct device_attribute *attr,
+                              char *buf)
+{
+        struct wiphy *wiphy = &dev_to_rdev(dev)->wiphy;
+        char *start = buf;
+        int i;
+
+        if (!wiphy->addresses)
+                return sprintf(buf, "%pM\n", wiphy->perm_addr);
+
+        for (i = 0; i < wiphy->n_addresses; i++)
+                buf += sprintf(buf, "%pM\n", &wiphy->addresses[i].addr);
+
+        return buf - start;
+}
 
 static struct device_attribute ieee80211_dev_attrs[] = {
         __ATTR_RO(index),
         __ATTR_RO(macaddress),
+        __ATTR_RO(address_mask),
+        __ATTR_RO(addresses),
         {}
 };
 
diff --git a/net/wireless/util.c b/net/wireless/util.c
index 3fc2df86278f..d3574a4eb3ba 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -5,6 +5,7 @@
  */
 #include <linux/bitops.h>
 #include <linux/etherdevice.h>
+#include <linux/slab.h>
 #include <net/cfg80211.h>
 #include <net/ip.h>
 #include "core.h"
@@ -227,8 +228,11 @@ unsigned int ieee80211_hdrlen(__le16 fc)
         if (ieee80211_is_data(fc)) {
                 if (ieee80211_has_a4(fc))
                         hdrlen = 30;
-                if (ieee80211_is_data_qos(fc))
+                if (ieee80211_is_data_qos(fc)) {
                         hdrlen += IEEE80211_QOS_CTL_LEN;
+                        if (ieee80211_has_order(fc))
+                                hdrlen += IEEE80211_HT_CTL_LEN;
+                }
                 goto out;
         }
 
@@ -285,7 +289,7 @@ static int ieee80211_get_mesh_hdrlen(struct ieee80211s_hdr *meshhdr)
         }
 }
 
-int ieee80211_data_to_8023(struct sk_buff *skb, u8 *addr,
+int ieee80211_data_to_8023(struct sk_buff *skb, const u8 *addr,
                            enum nl80211_iftype iftype)
 {
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
@@ -320,7 +324,9 @@ int ieee80211_data_to_8023(struct sk_buff *skb, u8 *addr,
                 break;
         case cpu_to_le16(IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS):
                 if (unlikely(iftype != NL80211_IFTYPE_WDS &&
-                             iftype != NL80211_IFTYPE_MESH_POINT))
+                             iftype != NL80211_IFTYPE_MESH_POINT &&
+                             iftype != NL80211_IFTYPE_AP_VLAN &&
+                             iftype != NL80211_IFTYPE_STATION))
                         return -1;
                 if (iftype == NL80211_IFTYPE_MESH_POINT) {
                         struct ieee80211s_hdr *meshdr =
@@ -381,7 +387,7 @@ int ieee80211_data_to_8023(struct sk_buff *skb, u8 *addr,
 }
 EXPORT_SYMBOL(ieee80211_data_to_8023);
 
-int ieee80211_data_from_8023(struct sk_buff *skb, u8 *addr,
+int ieee80211_data_from_8023(struct sk_buff *skb, const u8 *addr,
                              enum nl80211_iftype iftype, u8 *bssid, bool qos)
 {
         struct ieee80211_hdr hdr;
@@ -495,6 +501,101 @@ int ieee80211_data_from_8023(struct sk_buff *skb, u8 *addr,
 }
 EXPORT_SYMBOL(ieee80211_data_from_8023);
 
+
+void ieee80211_amsdu_to_8023s(struct sk_buff *skb, struct sk_buff_head *list,
+                              const u8 *addr, enum nl80211_iftype iftype,
+                              const unsigned int extra_headroom)
+{
+        struct sk_buff *frame = NULL;
+        u16 ethertype;
+        u8 *payload;
+        const struct ethhdr *eth;
+        int remaining, err;
+        u8 dst[ETH_ALEN], src[ETH_ALEN];
+
+        err = ieee80211_data_to_8023(skb, addr, iftype);
+        if (err)
+                goto out;
+
+        /* skip the wrapping header */
+        eth = (struct ethhdr *) skb_pull(skb, sizeof(struct ethhdr));
+        if (!eth)
+                goto out;
+
+        while (skb != frame) {
+                u8 padding;
+                __be16 len = eth->h_proto;
+                unsigned int subframe_len = sizeof(struct ethhdr) + ntohs(len);
+
+                remaining = skb->len;
+                memcpy(dst, eth->h_dest, ETH_ALEN);
+                memcpy(src, eth->h_source, ETH_ALEN);
+
+                padding = (4 - subframe_len) & 0x3;
+                /* the last MSDU has no padding */
+                if (subframe_len > remaining)
+                        goto purge;
+
+                skb_pull(skb, sizeof(struct ethhdr));
+                /* reuse skb for the last subframe */
+                if (remaining <= subframe_len + padding)
+                        frame = skb;
+                else {
+                        unsigned int hlen = ALIGN(extra_headroom, 4);
+                        /*
+                         * Allocate and reserve two bytes more for payload
+                         * alignment since sizeof(struct ethhdr) is 14.
+                         */
+                        frame = dev_alloc_skb(hlen + subframe_len + 2);
+                        if (!frame)
+                                goto purge;
+
+                        skb_reserve(frame, hlen + sizeof(struct ethhdr) + 2);
+                        memcpy(skb_put(frame, ntohs(len)), skb->data,
+                                ntohs(len));
+
+                        eth = (struct ethhdr *)skb_pull(skb, ntohs(len) +
+                                                        padding);
+                        if (!eth) {
+                                dev_kfree_skb(frame);
+                                goto purge;
+                        }
+                }
+
+                skb_reset_network_header(frame);
+                frame->dev = skb->dev;
+                frame->priority = skb->priority;
+
+                payload = frame->data;
+                ethertype = (payload[6] << 8) | payload[7];
+
+                if (likely((compare_ether_addr(payload, rfc1042_header) == 0 &&
+                            ethertype != ETH_P_AARP && ethertype != ETH_P_IPX) ||
+                           compare_ether_addr(payload,
+                                              bridge_tunnel_header) == 0)) {
+                        /* remove RFC1042 or Bridge-Tunnel
+                         * encapsulation and replace EtherType */
+                        skb_pull(frame, 6);
+                        memcpy(skb_push(frame, ETH_ALEN), src, ETH_ALEN);
+                        memcpy(skb_push(frame, ETH_ALEN), dst, ETH_ALEN);
+                } else {
+                        memcpy(skb_push(frame, sizeof(__be16)), &len,
+                                sizeof(__be16));
+                        memcpy(skb_push(frame, ETH_ALEN), src, ETH_ALEN);
+                        memcpy(skb_push(frame, ETH_ALEN), dst, ETH_ALEN);
+                }
+                __skb_queue_tail(list, frame);
+        }
+
+        return;
+
+ purge:
+        __skb_queue_purge(list);
+ out:
+        dev_kfree_skb(skb);
+}
+EXPORT_SYMBOL(ieee80211_amsdu_to_8023s);
+
 /* Given a data frame determine the 802.1p/1d tag to use. */
 unsigned int cfg80211_classify8021d(struct sk_buff *skb)
 {
@@ -656,7 +757,14 @@ int cfg80211_change_iface(struct cfg80211_registered_device *rdev,
             !(rdev->wiphy.interface_modes & (1 << ntype)))
                 return -EOPNOTSUPP;
 
+        /* if it's part of a bridge, reject changing type to station/ibss */
+        if (dev->br_port && (ntype == NL80211_IFTYPE_ADHOC ||
+                             ntype == NL80211_IFTYPE_STATION))
+                return -EBUSY;
+
         if (ntype != otype) {
+                dev->ieee80211_ptr->use_4addr = false;
+
                 switch (otype) {
                 case NL80211_IFTYPE_ADHOC:
                         cfg80211_leave_ibss(rdev, dev, false);
@@ -680,5 +788,67 @@ int cfg80211_change_iface(struct cfg80211_registered_device *rdev,
 
         WARN_ON(!err && dev->ieee80211_ptr->iftype != ntype);
 
+        if (!err && params && params->use_4addr != -1)
+                dev->ieee80211_ptr->use_4addr = params->use_4addr;
+
+        if (!err) {
+                dev->priv_flags &= ~IFF_DONT_BRIDGE;
+                switch (ntype) {
+                case NL80211_IFTYPE_STATION:
+                        if (dev->ieee80211_ptr->use_4addr)
+                                break;
+                        /* fall through */
+                case NL80211_IFTYPE_ADHOC:
+                        dev->priv_flags |= IFF_DONT_BRIDGE;
+                        break;
+                case NL80211_IFTYPE_AP:
+                case NL80211_IFTYPE_AP_VLAN:
+                case NL80211_IFTYPE_WDS:
+                case NL80211_IFTYPE_MESH_POINT:
+                        /* bridging OK */
+                        break;
+                case NL80211_IFTYPE_MONITOR:
+                        /* monitor can't bridge anyway */
+                        break;
+                case NL80211_IFTYPE_UNSPECIFIED:
+                case __NL80211_IFTYPE_AFTER_LAST:
+                        /* not happening */
+                        break;
+                }
+        }
+
         return err;
 }
+
+u16 cfg80211_calculate_bitrate(struct rate_info *rate)
+{
+        int modulation, streams, bitrate;
+
+        if (!(rate->flags & RATE_INFO_FLAGS_MCS))
+                return rate->legacy;
+
+        /* the formula below does only work for MCS values smaller than 32 */
+        if (rate->mcs >= 32)
+                return 0;
+
+        modulation = rate->mcs & 7;
+        streams = (rate->mcs >> 3) + 1;
+
+        bitrate = (rate->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH) ?
+                        13500000 : 6500000;
+
+        if (modulation < 4)
+                bitrate *= (modulation + 1);
+        else if (modulation == 4)
+                bitrate *= (modulation + 2);
+        else
+                bitrate *= (modulation + 3);
+
+        bitrate *= streams;
+
+        if (rate->flags & RATE_INFO_FLAGS_SHORT_GI)
+                bitrate = (bitrate / 9) * 10;
+
+        /* do NOT round down here */
+        return (bitrate + 50000) / 100000;
+}
diff --git a/net/wireless/wext-compat.c b/net/wireless/wext-compat.c
index 561a45cf2a6a..a60a2773b497 100644
--- a/net/wireless/wext-compat.c
+++ b/net/wireless/wext-compat.c
@@ -12,6 +12,7 @@
 #include <linux/nl80211.h>
 #include <linux/if_arp.h>
 #include <linux/etherdevice.h>
+#include <linux/slab.h>
 #include <net/iw_handler.h>
 #include <net/cfg80211.h>
 #include "wext-compat.h"
@@ -437,6 +438,7 @@ static int __cfg80211_set_encryption(struct cfg80211_registered_device *rdev,
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         int err, i;
+        bool rejoin = false;
 
         if (!wdev->wext.keys) {
                 wdev->wext.keys = kzalloc(sizeof(*wdev->wext.keys),
@@ -466,8 +468,25 @@ static int __cfg80211_set_encryption(struct cfg80211_registered_device *rdev,
 
         if (remove) {
                 err = 0;
-                if (wdev->current_bss)
+                if (wdev->current_bss) {
+                        /*
+                         * If removing the current TX key, we will need to
+                         * join a new IBSS without the privacy bit clear.
+                         */
+                        if (idx == wdev->wext.default_key &&
+                            wdev->iftype == NL80211_IFTYPE_ADHOC) {
+                                __cfg80211_leave_ibss(rdev, wdev->netdev, true);
+                                rejoin = true;
+                        }
                         err = rdev->ops->del_key(&rdev->wiphy, dev, idx, addr);
+                }
+                wdev->wext.connect.privacy = false;
+                /*
+                 * Applications using wireless extensions expect to be
+                 * able to delete keys that don't exist, so allow that.
+                 */
+                if (err == -ENOENT)
+                        err = 0;
                 if (!err) {
                         if (!addr) {
                                 wdev->wext.keys->params[idx].key_len = 0;
@@ -478,12 +497,9 @@ static int __cfg80211_set_encryption(struct cfg80211_registered_device *rdev,
                         else if (idx == wdev->wext.default_mgmt_key)
                                 wdev->wext.default_mgmt_key = -1;
                 }
-                /*
-                 * Applications using wireless extensions expect to be
-                 * able to delete keys that don't exist, so allow that.
-                 */
-                if (err == -ENOENT)
-                        return 0;
+
+                if (!err && rejoin)
+                        err = cfg80211_ibss_wext_join(rdev, wdev);
 
                 return err;
         }
@@ -511,11 +527,25 @@ static int __cfg80211_set_encryption(struct cfg80211_registered_device *rdev,
         if ((params->cipher == WLAN_CIPHER_SUITE_WEP40 ||
              params->cipher == WLAN_CIPHER_SUITE_WEP104) &&
             (tx_key || (!addr && wdev->wext.default_key == -1))) {
-                if (wdev->current_bss)
+                if (wdev->current_bss) {
+                        /*
+                         * If we are getting a new TX key from not having
+                         * had one before we need to join a new IBSS with
+                         * the privacy bit set.
+                         */
+                        if (wdev->iftype == NL80211_IFTYPE_ADHOC &&
+                            wdev->wext.default_key == -1) {
+                                __cfg80211_leave_ibss(rdev, wdev->netdev, true);
+                                rejoin = true;
+                        }
                         err = rdev->ops->set_default_key(&rdev->wiphy,
                                                          dev, idx);
-                if (!err)
+                }
+                if (!err) {
                         wdev->wext.default_key = idx;
+                        if (rejoin)
+                                err = cfg80211_ibss_wext_join(rdev, wdev);
+                }
                 return err;
         }
 
@@ -539,10 +569,13 @@ static int cfg80211_set_encryption(struct cfg80211_registered_device *rdev,
 {
         int err;
 
+        /* devlist mutex needed for possible IBSS re-join */
+        mutex_lock(&rdev->devlist_mtx);
         wdev_lock(dev->ieee80211_ptr);
         err = __cfg80211_set_encryption(rdev, dev, addr, remove,
                                         tx_key, idx, params);
         wdev_unlock(dev->ieee80211_ptr);
+        mutex_unlock(&rdev->devlist_mtx);
 
         return err;
 }
@@ -904,8 +937,6 @@ static int cfg80211_set_auth_alg(struct wireless_dev *wdev,
 
 static int cfg80211_set_wpa_version(struct wireless_dev *wdev, u32 wpa_versions)
 {
-        wdev->wext.connect.crypto.wpa_versions = 0;
-
         if (wpa_versions & ~(IW_AUTH_WPA_VERSION_WPA |
                              IW_AUTH_WPA_VERSION_WPA2|
                              IW_AUTH_WPA_VERSION_DISABLED))
@@ -933,8 +964,6 @@ static int cfg80211_set_wpa_version(struct wireless_dev *wdev, u32 wpa_versions)
 
 static int cfg80211_set_cipher_group(struct wireless_dev *wdev, u32 cipher)
 {
-        wdev->wext.connect.crypto.cipher_group = 0;
-
         if (cipher & IW_AUTH_CIPHER_WEP40)
                 wdev->wext.connect.crypto.cipher_group =
                         WLAN_CIPHER_SUITE_WEP40;
@@ -950,6 +979,8 @@ static int cfg80211_set_cipher_group(struct wireless_dev *wdev, u32 cipher)
         else if (cipher & IW_AUTH_CIPHER_AES_CMAC)
                 wdev->wext.connect.crypto.cipher_group =
                         WLAN_CIPHER_SUITE_AES_CMAC;
+        else if (cipher & IW_AUTH_CIPHER_NONE)
+                wdev->wext.connect.crypto.cipher_group = 0;
         else
                 return -EINVAL;
 
@@ -1069,8 +1100,8 @@ int cfg80211_wext_siwpower(struct net_device *dev,
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
-        bool ps = wdev->wext.ps;
-        int timeout = wdev->wext.ps_timeout;
+        bool ps = wdev->ps;
+        int timeout = wdev->ps_timeout;
         int err;
 
         if (wdev->iftype != NL80211_IFTYPE_STATION)
@@ -1103,8 +1134,8 @@ int cfg80211_wext_siwpower(struct net_device *dev,
         if (err)
                 return err;
 
-        wdev->wext.ps = ps;
-        wdev->wext.ps_timeout = timeout;
+        wdev->ps = ps;
+        wdev->ps_timeout = timeout;
 
         return 0;
 
@@ -1117,7 +1148,7 @@ int cfg80211_wext_giwpower(struct net_device *dev,
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
 
-        wrq->disabled = !wdev->wext.ps;
+        wrq->disabled = !wdev->ps;
 
         return 0;
 }
@@ -1174,21 +1205,47 @@ int cfg80211_wext_siwrate(struct net_device *dev,
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
         struct cfg80211_bitrate_mask mask;
+        u32 fixed, maxrate;
+        struct ieee80211_supported_band *sband;
+        int band, ridx;
+        bool match = false;
 
         if (!rdev->ops->set_bitrate_mask)
                 return -EOPNOTSUPP;
 
-        mask.fixed = 0;
-        mask.maxrate = 0;
+        memset(&mask, 0, sizeof(mask));
+        fixed = 0;
+        maxrate = (u32)-1;
 
         if (rate->value < 0) {
                 /* nothing */
         } else if (rate->fixed) {
-                mask.fixed = rate->value / 1000; /* kbps */
+                fixed = rate->value / 100000;
         } else {
-                mask.maxrate = rate->value / 1000; /* kbps */
+                maxrate = rate->value / 100000;
         }
 
+        for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
+                sband = wdev->wiphy->bands[band];
+                if (sband == NULL)
+                        continue;
+                for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
+                        struct ieee80211_rate *srate = &sband->bitrates[ridx];
+                        if (fixed == srate->bitrate) {
+                                mask.control[band].legacy = 1 << ridx;
+                                match = true;
+                                break;
+                        }
+                        if (srate->bitrate <= maxrate) {
+                                mask.control[band].legacy |= 1 << ridx;
+                                match = true;
+                        }
+                }
+        }
+
+        if (!match)
+                return -EINVAL;
+
         return rdev->ops->set_bitrate_mask(wdev->wiphy, dev, NULL, &mask);
 }
 EXPORT_SYMBOL_GPL(cfg80211_wext_siwrate);
@@ -1227,10 +1284,7 @@ int cfg80211_wext_giwrate(struct net_device *dev,
         if (!(sinfo.filled & STATION_INFO_TX_BITRATE))
                 return -EOPNOTSUPP;
 
-        rate->value = 0;
-
-        if (!(sinfo.txrate.flags & RATE_INFO_FLAGS_MCS))
-                rate->value = 100000 * sinfo.txrate.legacy;
+        rate->value = 100000 * cfg80211_calculate_bitrate(&sinfo.txrate);
 
         return 0;
 }
@@ -1372,6 +1426,47 @@ int cfg80211_wext_giwessid(struct net_device *dev,
 }
 EXPORT_SYMBOL_GPL(cfg80211_wext_giwessid);
 
+int cfg80211_wext_siwpmksa(struct net_device *dev,
+                           struct iw_request_info *info,
+                           struct iw_point *data, char *extra)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct cfg80211_pmksa cfg_pmksa;
+        struct iw_pmksa *pmksa = (struct iw_pmksa *)extra;
+
+        memset(&cfg_pmksa, 0, sizeof(struct cfg80211_pmksa));
+
+        if (wdev->iftype != NL80211_IFTYPE_STATION)
+                return -EINVAL;
+
+        cfg_pmksa.bssid = pmksa->bssid.sa_data;
+        cfg_pmksa.pmkid = pmksa->pmkid;
+
+        switch (pmksa->cmd) {
+        case IW_PMKSA_ADD:
+                if (!rdev->ops->set_pmksa)
+                        return -EOPNOTSUPP;
+
+                return rdev->ops->set_pmksa(&rdev->wiphy, dev, &cfg_pmksa);
+
+        case IW_PMKSA_REMOVE:
+                if (!rdev->ops->del_pmksa)
+                        return -EOPNOTSUPP;
+
+                return rdev->ops->del_pmksa(&rdev->wiphy, dev, &cfg_pmksa);
+
+        case IW_PMKSA_FLUSH:
+                if (!rdev->ops->flush_pmksa)
+                        return -EOPNOTSUPP;
+
+                return rdev->ops->flush_pmksa(&rdev->wiphy, dev);
+
+        default:
+                return -EOPNOTSUPP;
+        }
+}
+
 static const iw_handler cfg80211_handlers[] = {
         [IW_IOCTL_IDX(SIOCGIWNAME)]     = (iw_handler) cfg80211_wext_giwname,
         [IW_IOCTL_IDX(SIOCSIWFREQ)]     = (iw_handler) cfg80211_wext_siwfreq,
@@ -1404,6 +1499,7 @@ static const iw_handler cfg80211_handlers[] = {
         [IW_IOCTL_IDX(SIOCSIWAUTH)]     = (iw_handler) cfg80211_wext_siwauth,
         [IW_IOCTL_IDX(SIOCGIWAUTH)]     = (iw_handler) cfg80211_wext_giwauth,
         [IW_IOCTL_IDX(SIOCSIWENCODEEXT)]= (iw_handler) cfg80211_wext_siwencodeext,
+        [IW_IOCTL_IDX(SIOCSIWPMKSA)]    = (iw_handler) cfg80211_wext_siwpmksa,
 };
 
 const struct iw_handler_def cfg80211_wext_handler = {
diff --git a/net/wireless/wext.c b/net/wireless/wext-core.c
index 60fe57761ca9..4f5a47091fde 100644
--- a/net/wireless/wext.c
+++ b/net/wireless/wext-core.c
@@ -1,112 +1,29 @@
 /*
- * This file implement the Wireless Extensions APIs.
+ * This file implement the Wireless Extensions core API.
  *
  * Authors :    Jean Tourrilhes - HPL - <jt@hpl.hp.com>
  * Copyright (c) 1997-2007 Jean Tourrilhes, All Rights Reserved.
+ * Copyright    2009 Johannes Berg <johannes@sipsolutions.net>
  *
  * (As all part of the Linux kernel, this file is GPL)
  */
-
-/************************** DOCUMENTATION **************************/
-/*
- * API definition :
- * --------------
- * See <linux/wireless.h> for details of the APIs and the rest.
- *
- * History :
- * -------
- *
- * v1 - 5.12.01 - Jean II
- *      o Created this file.
- *
- * v2 - 13.12.01 - Jean II
- *      o Move /proc/net/wireless stuff from net/core/dev.c to here
- *      o Make Wireless Extension IOCTLs go through here
- *      o Added iw_handler handling ;-)
- *      o Added standard ioctl description
- *      o Initial dumb commit strategy based on orinoco.c
- *
- * v3 - 19.12.01 - Jean II
- *      o Make sure we don't go out of standard_ioctl[] in ioctl_standard_call
- *      o Add event dispatcher function
- *      o Add event description
- *      o Propagate events as rtnetlink IFLA_WIRELESS option
- *      o Generate event on selected SET requests
- *
- * v4 - 18.04.02 - Jean II
- *      o Fix stupid off by one in iw_ioctl_description : IW_ESSID_MAX_SIZE + 1
- *
- * v5 - 21.06.02 - Jean II
- *      o Add IW_PRIV_TYPE_ADDR in priv_type_size (+cleanup)
- *      o Reshuffle IW_HEADER_TYPE_XXX to map IW_PRIV_TYPE_XXX changes
- *      o Add IWEVCUSTOM for driver specific event/scanning token
- *      o Turn on WE_STRICT_WRITE by default + kernel warning
- *      o Fix WE_STRICT_WRITE in ioctl_export_private() (32 => iw_num)
- *      o Fix off-by-one in test (extra_size <= IFNAMSIZ)
- *
- * v6 - 9.01.03 - Jean II
- *      o Add common spy support : iw_handler_set_spy(), wireless_spy_update()
- *      o Add enhanced spy support : iw_handler_set_thrspy() and event.
- *      o Add WIRELESS_EXT version display in /proc/net/wireless
- *
- * v6 - 18.06.04 - Jean II
- *      o Change get_spydata() method for added safety
- *      o Remove spy #ifdef, they are always on -> cleaner code
- *      o Allow any size GET request if user specifies length > max
- *              and if request has IW_DESCR_FLAG_NOMAX flag or is SIOCGIWPRIV
- *      o Start migrating get_wireless_stats to struct iw_handler_def
- *      o Add wmb() in iw_handler_set_spy() for non-coherent archs/cpus
- * Based on patch from Pavel Roskin <proski@gnu.org> :
- *      o Fix kernel data leak to user space in private handler handling
- *
- * v7 - 18.3.05 - Jean II
- *      o Remove (struct iw_point *)->pointer from events and streams
- *      o Remove spy_offset from struct iw_handler_def
- *      o Start deprecating dev->get_wireless_stats, output a warning
- *      o If IW_QUAL_DBM is set, show dBm values in /proc/net/wireless
- *      o Don't lose INVALID/DBM flags when clearing UPDATED flags (iwstats)
- *
- * v8 - 17.02.06 - Jean II
- *      o RtNetlink requests support (SET/GET)
- *
- * v8b - 03.08.06 - Herbert Xu
- *      o Fix Wireless Event locking issues.
- *
- * v9 - 14.3.06 - Jean II
- *      o Change length in ESSID and NICK to strlen() instead of strlen()+1
- *      o Make standard_ioctl_num and standard_event_num unsigned
- *      o Remove (struct net_device *)->get_wireless_stats()
- *
- * v10 - 16.3.07 - Jean II
- *      o Prevent leaking of kernel space in stream on 64 bits.
- */
-
-/***************************** INCLUDES *****************************/
-
-#include <linux/module.h>
-#include <linux/types.h>                /* off_t */
-#include <linux/netdevice.h>            /* struct ifreq, dev_get_by_name() */
-#include <linux/proc_fs.h>
-#include <linux/rtnetlink.h>            /* rtnetlink stuff */
-#include <linux/seq_file.h>
-#include <linux/init.h>                 /* for __init */
-#include <linux/if_arp.h>               /* ARPHRD_ETHER */
-#include <linux/etherdevice.h>          /* compare_ether_addr */
-#include <linux/interrupt.h>
-#include <net/net_namespace.h>
-
-#include <linux/wireless.h>             /* Pretty obvious */
-#include <net/iw_handler.h>             /* New driver API */
+#include <linux/kernel.h>
+#include <linux/netdevice.h>
+#include <linux/rtnetlink.h>
+#include <linux/slab.h>
+#include <linux/wireless.h>
+#include <linux/uaccess.h>
+#include <net/cfg80211.h>
+#include <net/iw_handler.h>
 #include <net/netlink.h>
 #include <net/wext.h>
+#include <net/net_namespace.h>
+
+typedef int (*wext_ioctl_func)(struct net_device *, struct iwreq *,
+                               unsigned int, struct iw_request_info *,
+                               iw_handler);
 
-#include <asm/uaccess.h>                /* copy_to_user() */
 
-/************************* GLOBAL VARIABLES *************************/
-/*
- * You should not use global variables, because of re-entrancy.
- * On our case, it's only const, so it's OK...
- */
 /*
  * Meta-data about all the standard Wireless Extension request we
  * know about.
@@ -390,18 +307,6 @@ static const struct iw_ioctl_description standard_event[] = {
 };
 static const unsigned standard_event_num = ARRAY_SIZE(standard_event);
 
-/* Size (in bytes) of the various private data types */
-static const char iw_priv_type_size[] = {
-        0,                              /* IW_PRIV_TYPE_NONE */
-        1,                              /* IW_PRIV_TYPE_BYTE */
-        1,                              /* IW_PRIV_TYPE_CHAR */
-        0,                              /* Not defined */
-        sizeof(__u32),                  /* IW_PRIV_TYPE_INT */
-        sizeof(struct iw_freq),         /* IW_PRIV_TYPE_FLOAT */
-        sizeof(struct sockaddr),        /* IW_PRIV_TYPE_ADDR */
-        0,                              /* Not defined */
-};
-
 /* Size (in bytes) of various events */
 static const int event_type_size[] = {
         IW_EV_LCP_LEN,                  /* IW_HEADER_TYPE_NULL */
@@ -433,323 +338,346 @@ static const int compat_event_type_size[] = {
 };
 #endif
 
-/************************ COMMON SUBROUTINES ************************/
-/*
- * Stuff that may be used in various place or doesn't fit in one
- * of the section below.
- */
-
-/* ---------------------------------------------------------------- */
-/*
- * Return the driver handler associated with a specific Wireless Extension.
- */
-static iw_handler get_handler(struct net_device *dev, unsigned int cmd)
-{
-        /* Don't "optimise" the following variable, it will crash */
-        unsigned int    index;          /* *MUST* be unsigned */
 
-        /* Check if we have some wireless handlers defined */
-        if (dev->wireless_handlers == NULL)
-                return NULL;
-
-        /* Try as a standard command */
-        index = cmd - SIOCIWFIRST;
-        if (index < dev->wireless_handlers->num_standard)
-                return dev->wireless_handlers->standard[index];
-
-        /* Try as a private command */
-        index = cmd - SIOCIWFIRSTPRIV;
-        if (index < dev->wireless_handlers->num_private)
-                return dev->wireless_handlers->private[index];
+/* IW event code */
 
-        /* Not found */
-        return NULL;
-}
-
-/* ---------------------------------------------------------------- */
-/*
- * Get statistics out of the driver
- */
-struct iw_statistics *get_wireless_stats(struct net_device *dev)
+static int __net_init wext_pernet_init(struct net *net)
 {
-        /* New location */
-        if ((dev->wireless_handlers != NULL) &&
-           (dev->wireless_handlers->get_wireless_stats != NULL))
-                return dev->wireless_handlers->get_wireless_stats(dev);
-
-        /* Not found */
-        return NULL;
+        skb_queue_head_init(&net->wext_nlevents);
+        return 0;
 }
 
-/* ---------------------------------------------------------------- */
-/*
- * Call the commit handler in the driver
- * (if exist and if conditions are right)
- *
- * Note : our current commit strategy is currently pretty dumb,
- * but we will be able to improve on that...
- * The goal is to try to agreagate as many changes as possible
- * before doing the commit. Drivers that will define a commit handler
- * are usually those that need a reset after changing parameters, so
- * we want to minimise the number of reset.
- * A cool idea is to use a timer : at each "set" command, we re-set the
- * timer, when the timer eventually fires, we call the driver.
- * Hopefully, more on that later.
- *
- * Also, I'm waiting to see how many people will complain about the
- * netif_running(dev) test. I'm open on that one...
- * Hopefully, the driver will remember to do a commit in "open()" ;-)
- */
-static int call_commit_handler(struct net_device *dev)
+static void __net_exit wext_pernet_exit(struct net *net)
 {
-        if ((netif_running(dev)) &&
-           (dev->wireless_handlers->standard[0] != NULL))
-                /* Call the commit handler on the driver */
-                return dev->wireless_handlers->standard[0](dev, NULL,
-                                                           NULL, NULL);
-        else
-                return 0;               /* Command completed successfully */
+        skb_queue_purge(&net->wext_nlevents);
 }
 
-/* ---------------------------------------------------------------- */
-/*
- * Calculate size of private arguments
- */
-static int get_priv_size(__u16 args)
-{
-        int     num = args & IW_PRIV_SIZE_MASK;
-        int     type = (args & IW_PRIV_TYPE_MASK) >> 12;
+static struct pernet_operations wext_pernet_ops = {
+        .init = wext_pernet_init,
+        .exit = wext_pernet_exit,
+};
 
-        return num * iw_priv_type_size[type];
+static int __init wireless_nlevent_init(void)
+{
+        return register_pernet_subsys(&wext_pernet_ops);
 }
 
-/* ---------------------------------------------------------------- */
-/*
- * Re-calculate the size of private arguments
- */
-static int adjust_priv_size(__u16 args, struct iw_point *iwp)
+subsys_initcall(wireless_nlevent_init);
+
+/* Process events generated by the wireless layer or the driver. */
+static void wireless_nlevent_process(struct work_struct *work)
 {
-        int     num = iwp->length;
-        int     max = args & IW_PRIV_SIZE_MASK;
-        int     type = (args & IW_PRIV_TYPE_MASK) >> 12;
+        struct sk_buff *skb;
+        struct net *net;
 
-        /* Make sure the driver doesn't goof up */
-        if (max < num)
-                num = max;
+        rtnl_lock();
+
+        for_each_net(net) {
+                while ((skb = skb_dequeue(&net->wext_nlevents)))
+                        rtnl_notify(skb, net, 0, RTNLGRP_LINK, NULL,
+                                    GFP_KERNEL);
+        }
 
-        return num * iw_priv_type_size[type];
+        rtnl_unlock();
 }
 
-/* ---------------------------------------------------------------- */
-/*
- * Standard Wireless Handler : get wireless stats
- *      Allow programatic access to /proc/net/wireless even if /proc
- *      doesn't exist... Also more efficient...
- */
-static int iw_handler_get_iwstats(struct net_device *           dev,
-                                  struct iw_request_info *      info,
-                                  union iwreq_data *            wrqu,
-                                  char *                        extra)
+static DECLARE_WORK(wireless_nlevent_work, wireless_nlevent_process);
+
+static struct nlmsghdr *rtnetlink_ifinfo_prep(struct net_device *dev,
+                                              struct sk_buff *skb)
 {
-        /* Get stats from the driver */
-        struct iw_statistics *stats;
+        struct ifinfomsg *r;
+        struct nlmsghdr  *nlh;
 
-        stats = get_wireless_stats(dev);
-        if (stats) {
-                /* Copy statistics to extra */
-                memcpy(extra, stats, sizeof(struct iw_statistics));
-                wrqu->data.length = sizeof(struct iw_statistics);
+        nlh = nlmsg_put(skb, 0, 0, RTM_NEWLINK, sizeof(*r), 0);
+        if (!nlh)
+                return NULL;
 
-                /* Check if we need to clear the updated flag */
-                if (wrqu->data.flags != 0)
-                        stats->qual.updated &= ~IW_QUAL_ALL_UPDATED;
-                return 0;
-        } else
-                return -EOPNOTSUPP;
+        r = nlmsg_data(nlh);
+        r->ifi_family = AF_UNSPEC;
+        r->__ifi_pad = 0;
+        r->ifi_type = dev->type;
+        r->ifi_index = dev->ifindex;
+        r->ifi_flags = dev_get_flags(dev);
+        r->ifi_change = 0;      /* Wireless changes don't affect those flags */
+
+        NLA_PUT_STRING(skb, IFLA_IFNAME, dev->name);
+
+        return nlh;
+ nla_put_failure:
+        nlmsg_cancel(skb, nlh);
+        return NULL;
 }
 
-/* ---------------------------------------------------------------- */
+
 /*
- * Standard Wireless Handler : get iwpriv definitions
- * Export the driver private handler definition
- * They will be picked up by tools like iwpriv...
+ * Main event dispatcher. Called from other parts and drivers.
+ * Send the event on the appropriate channels.
+ * May be called from interrupt context.
  */
-static int iw_handler_get_private(struct net_device *           dev,
-                                  struct iw_request_info *      info,
-                                  union iwreq_data *            wrqu,
-                                  char *                        extra)
+void wireless_send_event(struct net_device *    dev,
+                         unsigned int           cmd,
+                         union iwreq_data *     wrqu,
+                         const char *           extra)
 {
-        /* Check if the driver has something to export */
-        if ((dev->wireless_handlers->num_private_args == 0) ||
-           (dev->wireless_handlers->private_args == NULL))
-                return -EOPNOTSUPP;
+        const struct iw_ioctl_description *     descr = NULL;
+        int extra_len = 0;
+        struct iw_event  *event;                /* Mallocated whole event */
+        int event_len;                          /* Its size */
+        int hdr_len;                            /* Size of the event header */
+        int wrqu_off = 0;                       /* Offset in wrqu */
+        /* Don't "optimise" the following variable, it will crash */
+        unsigned        cmd_index;              /* *MUST* be unsigned */
+        struct sk_buff *skb;
+        struct nlmsghdr *nlh;
+        struct nlattr *nla;
+#ifdef CONFIG_COMPAT
+        struct __compat_iw_event *compat_event;
+        struct compat_iw_point compat_wrqu;
+        struct sk_buff *compskb;
+#endif
 
-        /* Check if there is enough buffer up there */
-        if (wrqu->data.length < dev->wireless_handlers->num_private_args) {
-                /* User space can't know in advance how large the buffer
-                 * needs to be. Give it a hint, so that we can support
-                 * any size buffer we want somewhat efficiently... */
-                wrqu->data.length = dev->wireless_handlers->num_private_args;
-                return -E2BIG;
+        /*
+         * Nothing in the kernel sends scan events with data, be safe.
+         * This is necessary because we cannot fix up scan event data
+         * for compat, due to being contained in 'extra', but normally
+         * applications are required to retrieve the scan data anyway
+         * and no data is included in the event, this codifies that
+         * practice.
+         */
+        if (WARN_ON(cmd == SIOCGIWSCAN && extra))
+                extra = NULL;
+
+        /* Get the description of the Event */
+        if (cmd <= SIOCIWLAST) {
+                cmd_index = cmd - SIOCIWFIRST;
+                if (cmd_index < standard_ioctl_num)
+                        descr = &(standard_ioctl[cmd_index]);
+        } else {
+                cmd_index = cmd - IWEVFIRST;
+                if (cmd_index < standard_event_num)
+                        descr = &(standard_event[cmd_index]);
+        }
+        /* Don't accept unknown events */
+        if (descr == NULL) {
+                /* Note : we don't return an error to the driver, because
+                 * the driver would not know what to do about it. It can't
+                 * return an error to the user, because the event is not
+                 * initiated by a user request.
+                 * The best the driver could do is to log an error message.
+                 * We will do it ourselves instead...
+                 */
+                printk(KERN_ERR "%s (WE) : Invalid/Unknown Wireless Event (0x%04X)\n",
+                       dev->name, cmd);
+                return;
         }
 
-        /* Set the number of available ioctls. */
-        wrqu->data.length = dev->wireless_handlers->num_private_args;
+        /* Check extra parameters and set extra_len */
+        if (descr->header_type == IW_HEADER_TYPE_POINT) {
+                /* Check if number of token fits within bounds */
+                if (wrqu->data.length > descr->max_tokens) {
+                        printk(KERN_ERR "%s (WE) : Wireless Event too big (%d)\n", dev->name, wrqu->data.length);
+                        return;
+                }
+                if (wrqu->data.length < descr->min_tokens) {
+                        printk(KERN_ERR "%s (WE) : Wireless Event too small (%d)\n", dev->name, wrqu->data.length);
+                        return;
+                }
+                /* Calculate extra_len - extra is NULL for restricted events */
+                if (extra != NULL)
+                        extra_len = wrqu->data.length * descr->token_size;
+                /* Always at an offset in wrqu */
+                wrqu_off = IW_EV_POINT_OFF;
+        }
 
-        /* Copy structure to the user buffer. */
-        memcpy(extra, dev->wireless_handlers->private_args,
-               sizeof(struct iw_priv_args) * wrqu->data.length);
+        /* Total length of the event */
+        hdr_len = event_type_size[descr->header_type];
+        event_len = hdr_len + extra_len;
 
-        return 0;
-}
+        /*
+         * The problem for 64/32 bit.
+         *
+         * On 64-bit, a regular event is laid out as follows:
+         *      |  0  |  1  |  2  |  3  |  4  |  5  |  6  |  7  |
+         *      | event.len | event.cmd |     p a d d i n g     |
+         *      | wrqu data ... (with the correct size)         |
+         *
+         * This padding exists because we manipulate event->u,
+         * and 'event' is not packed.
+         *
+         * An iw_point event is laid out like this instead:
+         *      |  0  |  1  |  2  |  3  |  4  |  5  |  6  |  7  |
+         *      | event.len | event.cmd |     p a d d i n g     |
+         *      | iwpnt.len | iwpnt.flg |     p a d d i n g     |
+         *      | extra data  ...
+         *
+         * The second padding exists because struct iw_point is extended,
+         * but this depends on the platform...
+         *
+         * On 32-bit, all the padding shouldn't be there.
+         */
 
+        skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
+        if (!skb)
+                return;
 
-/******************** /proc/net/wireless SUPPORT ********************/
-/*
- * The /proc/net/wireless file is a human readable user-space interface
- * exporting various wireless specific statistics from the wireless devices.
- * This is the most popular part of the Wireless Extensions ;-)
- *
- * This interface is a pure clone of /proc/net/dev (in net/core/dev.c).
- * The content of the file is basically the content of "struct iw_statistics".
- */
+        /* Send via the RtNetlink event channel */
+        nlh = rtnetlink_ifinfo_prep(dev, skb);
+        if (WARN_ON(!nlh)) {
+                kfree_skb(skb);
+                return;
+        }
 
-#ifdef CONFIG_PROC_FS
+        /* Add the wireless events in the netlink packet */
+        nla = nla_reserve(skb, IFLA_WIRELESS, event_len);
+        if (!nla) {
+                kfree_skb(skb);
+                return;
+        }
+        event = nla_data(nla);
 
-/* ---------------------------------------------------------------- */
-/*
- * Print one entry (line) of /proc/net/wireless
- */
-static void wireless_seq_printf_stats(struct seq_file *seq,
-                                      struct net_device *dev)
-{
-        /* Get stats from the driver */
-        struct iw_statistics *stats = get_wireless_stats(dev);
-        static struct iw_statistics nullstats = {};
+        /* Fill event - first clear to avoid data leaking */
+        memset(event, 0, hdr_len);
+        event->len = event_len;
+        event->cmd = cmd;
+        memcpy(&event->u, ((char *) wrqu) + wrqu_off, hdr_len - IW_EV_LCP_LEN);
+        if (extra_len)
+                memcpy(((char *) event) + hdr_len, extra, extra_len);
 
-        /* show device if it's wireless regardless of current stats */
-        if (!stats && dev->wireless_handlers)
-                stats = &nullstats;
+        nlmsg_end(skb, nlh);
+#ifdef CONFIG_COMPAT
+        hdr_len = compat_event_type_size[descr->header_type];
+        event_len = hdr_len + extra_len;
 
-        if (stats) {
-                seq_printf(seq, "%6s: %04x  %3d%c  %3d%c  %3d%c  %6d %6d %6d "
-                                "%6d %6d   %6d\n",
-                           dev->name, stats->status, stats->qual.qual,
-                           stats->qual.updated & IW_QUAL_QUAL_UPDATED
-                           ? '.' : ' ',
-                           ((__s32) stats->qual.level) -
-                           ((stats->qual.updated & IW_QUAL_DBM) ? 0x100 : 0),
-                           stats->qual.updated & IW_QUAL_LEVEL_UPDATED
-                           ? '.' : ' ',
-                           ((__s32) stats->qual.noise) -
-                           ((stats->qual.updated & IW_QUAL_DBM) ? 0x100 : 0),
-                           stats->qual.updated & IW_QUAL_NOISE_UPDATED
-                           ? '.' : ' ',
-                           stats->discard.nwid, stats->discard.code,
-                           stats->discard.fragment, stats->discard.retries,
-                           stats->discard.misc, stats->miss.beacon);
-
-                if (stats != &nullstats)
-                        stats->qual.updated &= ~IW_QUAL_ALL_UPDATED;
+        compskb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
+        if (!compskb) {
+                kfree_skb(skb);
+                return;
         }
-}
 
-/* ---------------------------------------------------------------- */
-/*
- * Print info for /proc/net/wireless (print all entries)
- */
-static int wireless_dev_seq_show(struct seq_file *seq, void *v)
-{
-        might_sleep();
-
-        if (v == SEQ_START_TOKEN)
-                seq_printf(seq, "Inter-| sta-|   Quality        |   Discarded "
-                                "packets               | Missed | WE\n"
-                                " face | tus | link level noise |  nwid  "
-                                "crypt   frag  retry   misc | beacon | %d\n",
-                           WIRELESS_EXT);
-        else
-                wireless_seq_printf_stats(seq, v);
-        return 0;
+        /* Send via the RtNetlink event channel */
+        nlh = rtnetlink_ifinfo_prep(dev, compskb);
+        if (WARN_ON(!nlh)) {
+                kfree_skb(skb);
+                kfree_skb(compskb);
+                return;
+        }
+
+        /* Add the wireless events in the netlink packet */
+        nla = nla_reserve(compskb, IFLA_WIRELESS, event_len);
+        if (!nla) {
+                kfree_skb(skb);
+                kfree_skb(compskb);
+                return;
+        }
+        compat_event = nla_data(nla);
+
+        compat_event->len = event_len;
+        compat_event->cmd = cmd;
+        if (descr->header_type == IW_HEADER_TYPE_POINT) {
+                compat_wrqu.length = wrqu->data.length;
+                compat_wrqu.flags = wrqu->data.flags;
+                memcpy(&compat_event->pointer,
+                        ((char *) &compat_wrqu) + IW_EV_COMPAT_POINT_OFF,
+                        hdr_len - IW_EV_COMPAT_LCP_LEN);
+                if (extra_len)
+                        memcpy(((char *) compat_event) + hdr_len,
+                                extra, extra_len);
+        } else {
+                /* extra_len must be zero, so no if (extra) needed */
+                memcpy(&compat_event->pointer, wrqu,
+                        hdr_len - IW_EV_COMPAT_LCP_LEN);
+        }
+
+        nlmsg_end(compskb, nlh);
+
+        skb_shinfo(skb)->frag_list = compskb;
+#endif
+        skb_queue_tail(&dev_net(dev)->wext_nlevents, skb);
+        schedule_work(&wireless_nlevent_work);
 }
+EXPORT_SYMBOL(wireless_send_event);
+
+
+
+/* IW handlers */
 
-static void *wireless_dev_seq_start(struct seq_file *seq, loff_t *pos)
+struct iw_statistics *get_wireless_stats(struct net_device *dev)
 {
-        struct net *net = seq_file_net(seq);
-        loff_t off;
-        struct net_device *dev;
+#ifdef CONFIG_WIRELESS_EXT
+        if ((dev->wireless_handlers != NULL) &&
+           (dev->wireless_handlers->get_wireless_stats != NULL))
+                return dev->wireless_handlers->get_wireless_stats(dev);
+#endif
 
-        rtnl_lock();
-        if (!*pos)
-                return SEQ_START_TOKEN;
+#ifdef CONFIG_CFG80211_WEXT
+        if (dev->ieee80211_ptr && dev->ieee80211_ptr &&
+            dev->ieee80211_ptr->wiphy &&
+            dev->ieee80211_ptr->wiphy->wext &&
+            dev->ieee80211_ptr->wiphy->wext->get_wireless_stats)
+                return dev->ieee80211_ptr->wiphy->wext->get_wireless_stats(dev);
+#endif
 
-        off = 1;
-        for_each_netdev(net, dev)
-                if (off++ == *pos)
-                        return dev;
+        /* not found */
         return NULL;
 }
 
-static void *wireless_dev_seq_next(struct seq_file *seq, void *v, loff_t *pos)
+static int iw_handler_get_iwstats(struct net_device *           dev,
+                                  struct iw_request_info *      info,
+                                  union iwreq_data *            wrqu,
+                                  char *                        extra)
 {
-        struct net *net = seq_file_net(seq);
+        /* Get stats from the driver */
+        struct iw_statistics *stats;
 
-        ++*pos;
+        stats = get_wireless_stats(dev);
+        if (stats) {
+                /* Copy statistics to extra */
+                memcpy(extra, stats, sizeof(struct iw_statistics));
+                wrqu->data.length = sizeof(struct iw_statistics);
 
-        return v == SEQ_START_TOKEN ?
-                first_net_device(net) : next_net_device(v);
+                /* Check if we need to clear the updated flag */
+                if (wrqu->data.flags != 0)
+                        stats->qual.updated &= ~IW_QUAL_ALL_UPDATED;
+                return 0;
+        } else
+                return -EOPNOTSUPP;
 }
 
-static void wireless_dev_seq_stop(struct seq_file *seq, void *v)
+static iw_handler get_handler(struct net_device *dev, unsigned int cmd)
 {
-        rtnl_unlock();
-}
-
-static const struct seq_operations wireless_seq_ops = {
-        .start = wireless_dev_seq_start,
-        .next  = wireless_dev_seq_next,
-        .stop  = wireless_dev_seq_stop,
-        .show  = wireless_dev_seq_show,
-};
+        /* Don't "optimise" the following variable, it will crash */
+        unsigned int    index;          /* *MUST* be unsigned */
+        const struct iw_handler_def *handlers = NULL;
 
-static int seq_open_wireless(struct inode *inode, struct file *file)
-{
-        return seq_open_net(inode, file, &wireless_seq_ops,
-                            sizeof(struct seq_net_private));
-}
+#ifdef CONFIG_CFG80211_WEXT
+        if (dev->ieee80211_ptr && dev->ieee80211_ptr->wiphy)
+                handlers = dev->ieee80211_ptr->wiphy->wext;
+#endif
+#ifdef CONFIG_WIRELESS_EXT
+        if (dev->wireless_handlers)
+                handlers = dev->wireless_handlers;
+#endif
 
-static const struct file_operations wireless_seq_fops = {
-        .owner   = THIS_MODULE,
-        .open    = seq_open_wireless,
-        .read    = seq_read,
-        .llseek  = seq_lseek,
-        .release = seq_release_net,
-};
+        if (!handlers)
+                return NULL;
 
-int wext_proc_init(struct net *net)
-{
-        /* Create /proc/net/wireless entry */
-        if (!proc_net_fops_create(net, "wireless", S_IRUGO, &wireless_seq_fops))
-                return -ENOMEM;
+        /* Try as a standard command */
+        index = cmd - SIOCIWFIRST;
+        if (index < handlers->num_standard)
+                return handlers->standard[index];
 
-        return 0;
-}
+#ifdef CONFIG_WEXT_PRIV
+        /* Try as a private command */
+        index = cmd - SIOCIWFIRSTPRIV;
+        if (index < handlers->num_private)
+                return handlers->private[index];
+#endif
 
-void wext_proc_exit(struct net *net)
-{
-        proc_net_remove(net, "wireless");
+        /* Not found */
+        return NULL;
 }
-#endif  /* CONFIG_PROC_FS */
 
-/************************** IOCTL SUPPORT **************************/
-/*
- * The original user space API to configure all those Wireless Extensions
- * is through IOCTLs.
- * In there, we check if we need to call the new driver API (iw_handler)
- * or just call the driver ioctl handler.
- */
-
-/* ---------------------------------------------------------------- */
 static int ioctl_standard_iw_point(struct iw_point *iwp, unsigned int cmd,
                                    const struct iw_ioctl_description *descr,
                                    iw_handler handler, struct net_device *dev,
@@ -875,7 +803,8 @@ static int ioctl_standard_iw_point(struct iw_point *iwp, unsigned int cmd,
         }
 
         /* Generate an event to notify listeners of the change */
-        if ((descr->flags & IW_DESCR_FLAG_EVENT) && err == -EIWCOMMIT) {
+        if ((descr->flags & IW_DESCR_FLAG_EVENT) &&
+            ((err == 0) || (err == -EIWCOMMIT))) {
                 union iwreq_data *data = (union iwreq_data *) iwp;
 
                 if (descr->flags & IW_DESCR_FLAG_RESTRICT)
@@ -893,188 +822,39 @@ out:
 }
 
 /*
- * Wrapper to call a standard Wireless Extension handler.
- * We do various checks and also take care of moving data between
- * user space and kernel space.
- */
-static int ioctl_standard_call(struct net_device *      dev,
-                               struct iwreq             *iwr,
-                               unsigned int             cmd,
-                               struct iw_request_info   *info,
-                               iw_handler               handler)
-{
-        const struct iw_ioctl_description *     descr;
-        int                                     ret = -EINVAL;
-
-        /* Get the description of the IOCTL */
-        if ((cmd - SIOCIWFIRST) >= standard_ioctl_num)
-                return -EOPNOTSUPP;
-        descr = &(standard_ioctl[cmd - SIOCIWFIRST]);
-
-        /* Check if we have a pointer to user space data or not */
-        if (descr->header_type != IW_HEADER_TYPE_POINT) {
-
-                /* No extra arguments. Trivial to handle */
-                ret = handler(dev, info, &(iwr->u), NULL);
-
-                /* Generate an event to notify listeners of the change */
-                if ((descr->flags & IW_DESCR_FLAG_EVENT) &&
-                   ((ret == 0) || (ret == -EIWCOMMIT)))
-                        wireless_send_event(dev, cmd, &(iwr->u), NULL);
-        } else {
-                ret = ioctl_standard_iw_point(&iwr->u.data, cmd, descr,
-                                              handler, dev, info);
-        }
-
-        /* Call commit handler if needed and defined */
-        if (ret == -EIWCOMMIT)
-                ret = call_commit_handler(dev);
-
-        /* Here, we will generate the appropriate event if needed */
-
-        return ret;
-}
-
-/* ---------------------------------------------------------------- */
-/*
- * Wrapper to call a private Wireless Extension handler.
- * We do various checks and also take care of moving data between
- * user space and kernel space.
- * It's not as nice and slimline as the standard wrapper. The cause
- * is struct iw_priv_args, which was not really designed for the
- * job we are going here.
+ * Call the commit handler in the driver
+ * (if exist and if conditions are right)
+ *
+ * Note : our current commit strategy is currently pretty dumb,
+ * but we will be able to improve on that...
+ * The goal is to try to agreagate as many changes as possible
+ * before doing the commit. Drivers that will define a commit handler
+ * are usually those that need a reset after changing parameters, so
+ * we want to minimise the number of reset.
+ * A cool idea is to use a timer : at each "set" command, we re-set the
+ * timer, when the timer eventually fires, we call the driver.
+ * Hopefully, more on that later.
  *
- * IMPORTANT : This function prevent to set and get data on the same
- * IOCTL and enforce the SET/GET convention. Not doing it would be
- * far too hairy...
- * If you need to set and get data at the same time, please don't use
- * a iw_handler but process it in your ioctl handler (i.e. use the
- * old driver API).
+ * Also, I'm waiting to see how many people will complain about the
+ * netif_running(dev) test. I'm open on that one...
+ * Hopefully, the driver will remember to do a commit in "open()" ;-)
  */
-static int get_priv_descr_and_size(struct net_device *dev, unsigned int cmd,
-                                   const struct iw_priv_args **descrp)
-{
-        const struct iw_priv_args *descr;
-        int i, extra_size;
-
-        descr = NULL;
-        for (i = 0; i < dev->wireless_handlers->num_private_args; i++) {
-                if (cmd == dev->wireless_handlers->private_args[i].cmd) {
-                        descr = &dev->wireless_handlers->private_args[i];
-                        break;
-                }
-        }
-
-        extra_size = 0;
-        if (descr) {
-                if (IW_IS_SET(cmd)) {
-                        int     offset = 0;     /* For sub-ioctls */
-                        /* Check for sub-ioctl handler */
-                        if (descr->name[0] == '\0')
-                                /* Reserve one int for sub-ioctl index */
-                                offset = sizeof(__u32);
-
-                        /* Size of set arguments */
-                        extra_size = get_priv_size(descr->set_args);
-
-                        /* Does it fits in iwr ? */
-                        if ((descr->set_args & IW_PRIV_SIZE_FIXED) &&
-                           ((extra_size + offset) <= IFNAMSIZ))
-                                extra_size = 0;
-                } else {
-                        /* Size of get arguments */
-                        extra_size = get_priv_size(descr->get_args);
-
-                        /* Does it fits in iwr ? */
-                        if ((descr->get_args & IW_PRIV_SIZE_FIXED) &&
-                           (extra_size <= IFNAMSIZ))
-                                extra_size = 0;
-                }
-        }
-        *descrp = descr;
-        return extra_size;
-}
-
-static int ioctl_private_iw_point(struct iw_point *iwp, unsigned int cmd,
-                                  const struct iw_priv_args *descr,
-                                  iw_handler handler, struct net_device *dev,
-                                  struct iw_request_info *info, int extra_size)
-{
-        char *extra;
-        int err;
-
-        /* Check what user space is giving us */
-        if (IW_IS_SET(cmd)) {
-                if (!iwp->pointer && iwp->length != 0)
-                        return -EFAULT;
-
-                if (iwp->length > (descr->set_args & IW_PRIV_SIZE_MASK))
-                        return -E2BIG;
-        } else if (!iwp->pointer)
-                return -EFAULT;
-
-        extra = kmalloc(extra_size, GFP_KERNEL);
-        if (!extra)
-                return -ENOMEM;
-
-        /* If it is a SET, get all the extra data in here */
-        if (IW_IS_SET(cmd) && (iwp->length != 0)) {
-                if (copy_from_user(extra, iwp->pointer, extra_size)) {
-                        err = -EFAULT;
-                        goto out;
-                }
-        }
-
-        /* Call the handler */
-        err = handler(dev, info, (union iwreq_data *) iwp, extra);
-
-        /* If we have something to return to the user */
-        if (!err && IW_IS_GET(cmd)) {
-                /* Adjust for the actual length if it's variable,
-                 * avoid leaking kernel bits outside.
-                 */
-                if (!(descr->get_args & IW_PRIV_SIZE_FIXED))
-                        extra_size = adjust_priv_size(descr->get_args, iwp);
-
-                if (copy_to_user(iwp->pointer, extra, extra_size))
-                        err =  -EFAULT;
-        }
-
-out:
-        kfree(extra);
-        return err;
-}
-
-static int ioctl_private_call(struct net_device *dev, struct iwreq *iwr,
-                              unsigned int cmd, struct iw_request_info *info,
-                              iw_handler handler)
+int call_commit_handler(struct net_device *dev)
 {
-        int extra_size = 0, ret = -EINVAL;
-        const struct iw_priv_args *descr;
-
-        extra_size = get_priv_descr_and_size(dev, cmd, &descr);
-
-        /* Check if we have a pointer to user space data or not. */
-        if (extra_size == 0) {
-                /* No extra arguments. Trivial to handle */
-                ret = handler(dev, info, &(iwr->u), (char *) &(iwr->u));
-        } else {
-                ret = ioctl_private_iw_point(&iwr->u.data, cmd, descr,
-                                             handler, dev, info, extra_size);
-        }
-
-        /* Call commit handler if needed and defined */
-        if (ret == -EIWCOMMIT)
-                ret = call_commit_handler(dev);
-
-        return ret;
+#ifdef CONFIG_WIRELESS_EXT
+        if ((netif_running(dev)) &&
+           (dev->wireless_handlers->standard[0] != NULL))
+                /* Call the commit handler on the driver */
+                return dev->wireless_handlers->standard[0](dev, NULL,
+                                                           NULL, NULL);
+        else
+                return 0;               /* Command completed successfully */
+#else
+        /* cfg80211 has no commit */
+        return 0;
+#endif
 }
 
-/* ---------------------------------------------------------------- */
-typedef int (*wext_ioctl_func)(struct net_device *, struct iwreq *,
-                               unsigned int, struct iw_request_info *,
-                               iw_handler);
-
 /*
  * Main IOCTl dispatcher.
  * Check the type of IOCTL and call the appropriate wrapper...
@@ -1103,9 +883,11 @@ static int wireless_process_ioctl(struct net *net, struct ifreq *ifr,
                 return standard(dev, iwr, cmd, info,
                                 &iw_handler_get_iwstats);
 
+#ifdef CONFIG_WEXT_PRIV
         if (cmd == SIOCGIWPRIV && dev->wireless_handlers)
                 return standard(dev, iwr, cmd, info,
-                                &iw_handler_get_private);
+                                iw_handler_get_private);
+#endif
 
         /* Basic check */
         if (!netif_device_present(dev))
@@ -1117,7 +899,7 @@ static int wireless_process_ioctl(struct net *net, struct ifreq *ifr,
                 /* Standard and private are not the same */
                 if (cmd < SIOCIWFIRSTPRIV)
                         return standard(dev, iwr, cmd, info, handler);
-                else
+                else if (private)
                         return private(dev, iwr, cmd, info, handler);
         }
         /* Old driver API : call driver ioctl handler */
@@ -1131,8 +913,9 @@ static int wireless_process_ioctl(struct net *net, struct ifreq *ifr,
  */
 static int wext_permission_check(unsigned int cmd)
 {
-        if ((IW_IS_SET(cmd) || cmd == SIOCGIWENCODE || cmd == SIOCGIWENCODEEXT)
-            && !capable(CAP_NET_ADMIN))
+        if ((IW_IS_SET(cmd) || cmd == SIOCGIWENCODE ||
+             cmd == SIOCGIWENCODEEXT) &&
+            !capable(CAP_NET_ADMIN))
                 return -EPERM;
 
         return 0;
@@ -1157,6 +940,50 @@ static int wext_ioctl_dispatch(struct net *net, struct ifreq *ifr,
         return ret;
 }
 
+/*
+ * Wrapper to call a standard Wireless Extension handler.
+ * We do various checks and also take care of moving data between
+ * user space and kernel space.
+ */
+static int ioctl_standard_call(struct net_device *      dev,
+                               struct iwreq             *iwr,
+                               unsigned int             cmd,
+                               struct iw_request_info   *info,
+                               iw_handler               handler)
+{
+        const struct iw_ioctl_description *     descr;
+        int                                     ret = -EINVAL;
+
+        /* Get the description of the IOCTL */
+        if ((cmd - SIOCIWFIRST) >= standard_ioctl_num)
+                return -EOPNOTSUPP;
+        descr = &(standard_ioctl[cmd - SIOCIWFIRST]);
+
+        /* Check if we have a pointer to user space data or not */
+        if (descr->header_type != IW_HEADER_TYPE_POINT) {
+
+                /* No extra arguments. Trivial to handle */
+                ret = handler(dev, info, &(iwr->u), NULL);
+
+                /* Generate an event to notify listeners of the change */
+                if ((descr->flags & IW_DESCR_FLAG_EVENT) &&
+                   ((ret == 0) || (ret == -EIWCOMMIT)))
+                        wireless_send_event(dev, cmd, &(iwr->u), NULL);
+        } else {
+                ret = ioctl_standard_iw_point(&iwr->u.data, cmd, descr,
+                                              handler, dev, info);
+        }
+
+        /* Call commit handler if needed and defined */
+        if (ret == -EIWCOMMIT)
+                ret = call_commit_handler(dev);
+
+        /* Here, we will generate the appropriate event if needed */
+
+        return ret;
+}
+
+
 int wext_handle_ioctl(struct net *net, struct ifreq *ifr, unsigned int cmd,
                       void __user *arg)
 {
@@ -1205,43 +1032,6 @@ static int compat_standard_call(struct net_device	*dev,
         return err;
 }
 
-static int compat_private_call(struct net_device *dev, struct iwreq *iwr,
-                               unsigned int cmd, struct iw_request_info *info,
-                               iw_handler handler)
-{
-        const struct iw_priv_args *descr;
-        int ret, extra_size;
-
-        extra_size = get_priv_descr_and_size(dev, cmd, &descr);
-
-        /* Check if we have a pointer to user space data or not. */
-        if (extra_size == 0) {
-                /* No extra arguments. Trivial to handle */
-                ret = handler(dev, info, &(iwr->u), (char *) &(iwr->u));
-        } else {
-                struct compat_iw_point *iwp_compat;
-                struct iw_point iwp;
-
-                iwp_compat = (struct compat_iw_point *) &iwr->u.data;
-                iwp.pointer = compat_ptr(iwp_compat->pointer);
-                iwp.length = iwp_compat->length;
-                iwp.flags = iwp_compat->flags;
-
-                ret = ioctl_private_iw_point(&iwp, cmd, descr,
-                                             handler, dev, info, extra_size);
-
-                iwp_compat->pointer = ptr_to_compat(iwp.pointer);
-                iwp_compat->length = iwp.length;
-                iwp_compat->flags = iwp.flags;
-        }
-
-        /* Call commit handler if needed and defined */
-        if (ret == -EIWCOMMIT)
-                ret = call_commit_handler(dev);
-
-        return ret;
-}
-
 int compat_wext_handle_ioctl(struct net *net, unsigned int cmd,
                              unsigned long arg)
 {
@@ -1274,502 +1064,3 @@ int compat_wext_handle_ioctl(struct net *net, unsigned int cmd,
         return ret;
 }
 #endif
-
-static int __net_init wext_pernet_init(struct net *net)
-{
-        skb_queue_head_init(&net->wext_nlevents);
-        return 0;
-}
-
-static void __net_exit wext_pernet_exit(struct net *net)
-{
-        skb_queue_purge(&net->wext_nlevents);
-}
-
-static struct pernet_operations wext_pernet_ops = {
-        .init = wext_pernet_init,
-        .exit = wext_pernet_exit,
-};
-
-static int __init wireless_nlevent_init(void)
-{
-        return register_pernet_subsys(&wext_pernet_ops);
-}
-
-subsys_initcall(wireless_nlevent_init);
-
-/* Process events generated by the wireless layer or the driver. */
-static void wireless_nlevent_process(struct work_struct *work)
-{
-        struct sk_buff *skb;
-        struct net *net;
-
-        rtnl_lock();
-
-        for_each_net(net) {
-                while ((skb = skb_dequeue(&net->wext_nlevents)))
-                        rtnl_notify(skb, net, 0, RTNLGRP_LINK, NULL,
-                                    GFP_KERNEL);
-        }
-
-        rtnl_unlock();
-}
-
-static DECLARE_WORK(wireless_nlevent_work, wireless_nlevent_process);
-
-static struct nlmsghdr *rtnetlink_ifinfo_prep(struct net_device *dev,
-                                              struct sk_buff *skb)
-{
-        struct ifinfomsg *r;
-        struct nlmsghdr  *nlh;
-
-        nlh = nlmsg_put(skb, 0, 0, RTM_NEWLINK, sizeof(*r), 0);
-        if (!nlh)
-                return NULL;
-
-        r = nlmsg_data(nlh);
-        r->ifi_family = AF_UNSPEC;
-        r->__ifi_pad = 0;
-        r->ifi_type = dev->type;
-        r->ifi_index = dev->ifindex;
-        r->ifi_flags = dev_get_flags(dev);
-        r->ifi_change = 0;      /* Wireless changes don't affect those flags */
-
-        NLA_PUT_STRING(skb, IFLA_IFNAME, dev->name);
-
-        return nlh;
- nla_put_failure:
-        nlmsg_cancel(skb, nlh);
-        return NULL;
-}
-
-
-/*
- * Main event dispatcher. Called from other parts and drivers.
- * Send the event on the appropriate channels.
- * May be called from interrupt context.
- */
-void wireless_send_event(struct net_device *    dev,
-                         unsigned int           cmd,
-                         union iwreq_data *     wrqu,
-                         const char *           extra)
-{
-        const struct iw_ioctl_description *     descr = NULL;
-        int extra_len = 0;
-        struct iw_event  *event;                /* Mallocated whole event */
-        int event_len;                          /* Its size */
-        int hdr_len;                            /* Size of the event header */
-        int wrqu_off = 0;                       /* Offset in wrqu */
-        /* Don't "optimise" the following variable, it will crash */
-        unsigned        cmd_index;              /* *MUST* be unsigned */
-        struct sk_buff *skb;
-        struct nlmsghdr *nlh;
-        struct nlattr *nla;
-#ifdef CONFIG_COMPAT
-        struct __compat_iw_event *compat_event;
-        struct compat_iw_point compat_wrqu;
-        struct sk_buff *compskb;
-#endif
-
-        /*
-         * Nothing in the kernel sends scan events with data, be safe.
-         * This is necessary because we cannot fix up scan event data
-         * for compat, due to being contained in 'extra', but normally
-         * applications are required to retrieve the scan data anyway
-         * and no data is included in the event, this codifies that
-         * practice.
-         */
-        if (WARN_ON(cmd == SIOCGIWSCAN && extra))
-                extra = NULL;
-
-        /* Get the description of the Event */
-        if (cmd <= SIOCIWLAST) {
-                cmd_index = cmd - SIOCIWFIRST;
-                if (cmd_index < standard_ioctl_num)
-                        descr = &(standard_ioctl[cmd_index]);
-        } else {
-                cmd_index = cmd - IWEVFIRST;
-                if (cmd_index < standard_event_num)
-                        descr = &(standard_event[cmd_index]);
-        }
-        /* Don't accept unknown events */
-        if (descr == NULL) {
-                /* Note : we don't return an error to the driver, because
-                 * the driver would not know what to do about it. It can't
-                 * return an error to the user, because the event is not
-                 * initiated by a user request.
-                 * The best the driver could do is to log an error message.
-                 * We will do it ourselves instead...
-                 */
-                printk(KERN_ERR "%s (WE) : Invalid/Unknown Wireless Event (0x%04X)\n",
-                       dev->name, cmd);
-                return;
-        }
-
-        /* Check extra parameters and set extra_len */
-        if (descr->header_type == IW_HEADER_TYPE_POINT) {
-                /* Check if number of token fits within bounds */
-                if (wrqu->data.length > descr->max_tokens) {
-                        printk(KERN_ERR "%s (WE) : Wireless Event too big (%d)\n", dev->name, wrqu->data.length);
-                        return;
-                }
-                if (wrqu->data.length < descr->min_tokens) {
-                        printk(KERN_ERR "%s (WE) : Wireless Event too small (%d)\n", dev->name, wrqu->data.length);
-                        return;
-                }
-                /* Calculate extra_len - extra is NULL for restricted events */
-                if (extra != NULL)
-                        extra_len = wrqu->data.length * descr->token_size;
-                /* Always at an offset in wrqu */
-                wrqu_off = IW_EV_POINT_OFF;
-        }
-
-        /* Total length of the event */
-        hdr_len = event_type_size[descr->header_type];
-        event_len = hdr_len + extra_len;
-
-        /*
-         * The problem for 64/32 bit.
-         *
-         * On 64-bit, a regular event is laid out as follows:
-         *      |  0  |  1  |  2  |  3  |  4  |  5  |  6  |  7  |
-         *      | event.len | event.cmd |     p a d d i n g     |
-         *      | wrqu data ... (with the correct size)         |
-         *
-         * This padding exists because we manipulate event->u,
-         * and 'event' is not packed.
-         *
-         * An iw_point event is laid out like this instead:
-         *      |  0  |  1  |  2  |  3  |  4  |  5  |  6  |  7  |
-         *      | event.len | event.cmd |     p a d d i n g     |
-         *      | iwpnt.len | iwpnt.flg |     p a d d i n g     |
-         *      | extra data  ...
-         *
-         * The second padding exists because struct iw_point is extended,
-         * but this depends on the platform...
-         *
-         * On 32-bit, all the padding shouldn't be there.
-         */
-
-        skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
-        if (!skb)
-                return;
-
-        /* Send via the RtNetlink event channel */
-        nlh = rtnetlink_ifinfo_prep(dev, skb);
-        if (WARN_ON(!nlh)) {
-                kfree_skb(skb);
-                return;
-        }
-
-        /* Add the wireless events in the netlink packet */
-        nla = nla_reserve(skb, IFLA_WIRELESS, event_len);
-        if (!nla) {
-                kfree_skb(skb);
-                return;
-        }
-        event = nla_data(nla);
-
-        /* Fill event - first clear to avoid data leaking */
-        memset(event, 0, hdr_len);
-        event->len = event_len;
-        event->cmd = cmd;
-        memcpy(&event->u, ((char *) wrqu) + wrqu_off, hdr_len - IW_EV_LCP_LEN);
-        if (extra_len)
-                memcpy(((char *) event) + hdr_len, extra, extra_len);
-
-        nlmsg_end(skb, nlh);
-#ifdef CONFIG_COMPAT
-        hdr_len = compat_event_type_size[descr->header_type];
-        event_len = hdr_len + extra_len;
-
-        compskb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
-        if (!compskb) {
-                kfree_skb(skb);
-                return;
-        }
-
-        /* Send via the RtNetlink event channel */
-        nlh = rtnetlink_ifinfo_prep(dev, compskb);
-        if (WARN_ON(!nlh)) {
-                kfree_skb(skb);
-                kfree_skb(compskb);
-                return;
-        }
-
-        /* Add the wireless events in the netlink packet */
-        nla = nla_reserve(compskb, IFLA_WIRELESS, event_len);
-        if (!nla) {
-                kfree_skb(skb);
-                kfree_skb(compskb);
-                return;
-        }
-        compat_event = nla_data(nla);
-
-        compat_event->len = event_len;
-        compat_event->cmd = cmd;
-        if (descr->header_type == IW_HEADER_TYPE_POINT) {
-                compat_wrqu.length = wrqu->data.length;
-                compat_wrqu.flags = wrqu->data.flags;
-                memcpy(&compat_event->pointer,
-                        ((char *) &compat_wrqu) + IW_EV_COMPAT_POINT_OFF,
-                        hdr_len - IW_EV_COMPAT_LCP_LEN);
-                if (extra_len)
-                        memcpy(((char *) compat_event) + hdr_len,
-                                extra, extra_len);
-        } else {
-                /* extra_len must be zero, so no if (extra) needed */
-                memcpy(&compat_event->pointer, wrqu,
-                        hdr_len - IW_EV_COMPAT_LCP_LEN);
-        }
-
-        nlmsg_end(compskb, nlh);
-
-        skb_shinfo(skb)->frag_list = compskb;
-#endif
-        skb_queue_tail(&dev_net(dev)->wext_nlevents, skb);
-        schedule_work(&wireless_nlevent_work);
-}
-EXPORT_SYMBOL(wireless_send_event);
-
-/********************** ENHANCED IWSPY SUPPORT **********************/
-/*
- * In the old days, the driver was handling spy support all by itself.
- * Now, the driver can delegate this task to Wireless Extensions.
- * It needs to use those standard spy iw_handler in struct iw_handler_def,
- * push data to us via wireless_spy_update() and include struct iw_spy_data
- * in its private part (and export it in net_device->wireless_data->spy_data).
- * One of the main advantage of centralising spy support here is that
- * it becomes much easier to improve and extend it without having to touch
- * the drivers. One example is the addition of the Spy-Threshold events.
- */
-
-/* ---------------------------------------------------------------- */
-/*
- * Return the pointer to the spy data in the driver.
- * Because this is called on the Rx path via wireless_spy_update(),
- * we want it to be efficient...
- */
-static inline struct iw_spy_data *get_spydata(struct net_device *dev)
-{
-        /* This is the new way */
-        if (dev->wireless_data)
-                return dev->wireless_data->spy_data;
-        return NULL;
-}
-
-/*------------------------------------------------------------------*/
-/*
- * Standard Wireless Handler : set Spy List
- */
-int iw_handler_set_spy(struct net_device *      dev,
-                       struct iw_request_info * info,
-                       union iwreq_data *       wrqu,
-                       char *                   extra)
-{
-        struct iw_spy_data *    spydata = get_spydata(dev);
-        struct sockaddr *       address = (struct sockaddr *) extra;
-
-        /* Make sure driver is not buggy or using the old API */
-        if (!spydata)
-                return -EOPNOTSUPP;
-
-        /* Disable spy collection while we copy the addresses.
-         * While we copy addresses, any call to wireless_spy_update()
-         * will NOP. This is OK, as anyway the addresses are changing. */
-        spydata->spy_number = 0;
-
-        /* We want to operate without locking, because wireless_spy_update()
-         * most likely will happen in the interrupt handler, and therefore
-         * have its own locking constraints and needs performance.
-         * The rtnl_lock() make sure we don't race with the other iw_handlers.
-         * This make sure wireless_spy_update() "see" that the spy list
-         * is temporarily disabled. */
-        smp_wmb();
-
-        /* Are there are addresses to copy? */
-        if (wrqu->data.length > 0) {
-                int i;
-
-                /* Copy addresses */
-                for (i = 0; i < wrqu->data.length; i++)
-                        memcpy(spydata->spy_address[i], address[i].sa_data,
-                               ETH_ALEN);
-                /* Reset stats */
-                memset(spydata->spy_stat, 0,
-                       sizeof(struct iw_quality) * IW_MAX_SPY);
-        }
-
-        /* Make sure above is updated before re-enabling */
-        smp_wmb();
-
-        /* Enable addresses */
-        spydata->spy_number = wrqu->data.length;
-
-        return 0;
-}
-EXPORT_SYMBOL(iw_handler_set_spy);
-
-/*------------------------------------------------------------------*/
-/*
- * Standard Wireless Handler : get Spy List
- */
-int iw_handler_get_spy(struct net_device *      dev,
-                       struct iw_request_info * info,
-                       union iwreq_data *       wrqu,
-                       char *                   extra)
-{
-        struct iw_spy_data *    spydata = get_spydata(dev);
-        struct sockaddr *       address = (struct sockaddr *) extra;
-        int                     i;
-
-        /* Make sure driver is not buggy or using the old API */
-        if (!spydata)
-                return -EOPNOTSUPP;
-
-        wrqu->data.length = spydata->spy_number;
-
-        /* Copy addresses. */
-        for (i = 0; i < spydata->spy_number; i++)       {
-                memcpy(address[i].sa_data, spydata->spy_address[i], ETH_ALEN);
-                address[i].sa_family = AF_UNIX;
-        }
-        /* Copy stats to the user buffer (just after). */
-        if (spydata->spy_number > 0)
-                memcpy(extra  + (sizeof(struct sockaddr) *spydata->spy_number),
-                       spydata->spy_stat,
-                       sizeof(struct iw_quality) * spydata->spy_number);
-        /* Reset updated flags. */
-        for (i = 0; i < spydata->spy_number; i++)
-                spydata->spy_stat[i].updated &= ~IW_QUAL_ALL_UPDATED;
-        return 0;
-}
-EXPORT_SYMBOL(iw_handler_get_spy);
-
-/*------------------------------------------------------------------*/
-/*
- * Standard Wireless Handler : set spy threshold
- */
-int iw_handler_set_thrspy(struct net_device *   dev,
-                          struct iw_request_info *info,
-                          union iwreq_data *    wrqu,
-                          char *                extra)
-{
-        struct iw_spy_data *    spydata = get_spydata(dev);
-        struct iw_thrspy *      threshold = (struct iw_thrspy *) extra;
-
-        /* Make sure driver is not buggy or using the old API */
-        if (!spydata)
-                return -EOPNOTSUPP;
-
-        /* Just do it */
-        memcpy(&(spydata->spy_thr_low), &(threshold->low),
-               2 * sizeof(struct iw_quality));
-
-        /* Clear flag */
-        memset(spydata->spy_thr_under, '\0', sizeof(spydata->spy_thr_under));
-
-        return 0;
-}
-EXPORT_SYMBOL(iw_handler_set_thrspy);
-
-/*------------------------------------------------------------------*/
-/*
- * Standard Wireless Handler : get spy threshold
- */
-int iw_handler_get_thrspy(struct net_device *   dev,
-                          struct iw_request_info *info,
-                          union iwreq_data *    wrqu,
-                          char *                extra)
-{
-        struct iw_spy_data *    spydata = get_spydata(dev);
-        struct iw_thrspy *      threshold = (struct iw_thrspy *) extra;
-
-        /* Make sure driver is not buggy or using the old API */
-        if (!spydata)
-                return -EOPNOTSUPP;
-
-        /* Just do it */
-        memcpy(&(threshold->low), &(spydata->spy_thr_low),
-               2 * sizeof(struct iw_quality));
-
-        return 0;
-}
-EXPORT_SYMBOL(iw_handler_get_thrspy);
-
-/*------------------------------------------------------------------*/
-/*
- * Prepare and send a Spy Threshold event
- */
-static void iw_send_thrspy_event(struct net_device *    dev,
-                                 struct iw_spy_data *   spydata,
-                                 unsigned char *        address,
-                                 struct iw_quality *    wstats)
-{
-        union iwreq_data        wrqu;
-        struct iw_thrspy        threshold;
-
-        /* Init */
-        wrqu.data.length = 1;
-        wrqu.data.flags = 0;
-        /* Copy address */
-        memcpy(threshold.addr.sa_data, address, ETH_ALEN);
-        threshold.addr.sa_family = ARPHRD_ETHER;
-        /* Copy stats */
-        memcpy(&(threshold.qual), wstats, sizeof(struct iw_quality));
-        /* Copy also thresholds */
-        memcpy(&(threshold.low), &(spydata->spy_thr_low),
-               2 * sizeof(struct iw_quality));
-
-        /* Send event to user space */
-        wireless_send_event(dev, SIOCGIWTHRSPY, &wrqu, (char *) &threshold);
-}
-
-/* ---------------------------------------------------------------- */
-/*
- * Call for the driver to update the spy data.
- * For now, the spy data is a simple array. As the size of the array is
- * small, this is good enough. If we wanted to support larger number of
- * spy addresses, we should use something more efficient...
- */
-void wireless_spy_update(struct net_device *    dev,
-                         unsigned char *        address,
-                         struct iw_quality *    wstats)
-{
-        struct iw_spy_data *    spydata = get_spydata(dev);
-        int                     i;
-        int                     match = -1;
-
-        /* Make sure driver is not buggy or using the old API */
-        if (!spydata)
-                return;
-
-        /* Update all records that match */
-        for (i = 0; i < spydata->spy_number; i++)
-                if (!compare_ether_addr(address, spydata->spy_address[i])) {
-                        memcpy(&(spydata->spy_stat[i]), wstats,
-                               sizeof(struct iw_quality));
-                        match = i;
-                }
-
-        /* Generate an event if we cross the spy threshold.
-         * To avoid event storms, we have a simple hysteresis : we generate
-         * event only when we go under the low threshold or above the
-         * high threshold. */
-        if (match >= 0) {
-                if (spydata->spy_thr_under[match]) {
-                        if (wstats->level > spydata->spy_thr_high.level) {
-                                spydata->spy_thr_under[match] = 0;
-                                iw_send_thrspy_event(dev, spydata,
-                                                     address, wstats);
-                        }
-                } else {
-                        if (wstats->level < spydata->spy_thr_low.level) {
-                                spydata->spy_thr_under[match] = 1;
-                                iw_send_thrspy_event(dev, spydata,
-                                                     address, wstats);
-                        }
-                }
-        }
-}
-EXPORT_SYMBOL(wireless_spy_update);
diff --git a/net/wireless/wext-priv.c b/net/wireless/wext-priv.c
new file mode 100644
index 000000000000..3feb28e41c53
--- /dev/null
+++ b/net/wireless/wext-priv.c
@@ -0,0 +1,249 @@
+/*
+ * This file implement the Wireless Extensions priv API.
+ *
+ * Authors :    Jean Tourrilhes - HPL - <jt@hpl.hp.com>
+ * Copyright (c) 1997-2007 Jean Tourrilhes, All Rights Reserved.
+ * Copyright    2009 Johannes Berg <johannes@sipsolutions.net>
+ *
+ * (As all part of the Linux kernel, this file is GPL)
+ */
+#include <linux/slab.h>
+#include <linux/wireless.h>
+#include <linux/netdevice.h>
+#include <net/iw_handler.h>
+#include <net/wext.h>
+
+int iw_handler_get_private(struct net_device *          dev,
+                           struct iw_request_info *     info,
+                           union iwreq_data *           wrqu,
+                           char *                       extra)
+{
+        /* Check if the driver has something to export */
+        if ((dev->wireless_handlers->num_private_args == 0) ||
+           (dev->wireless_handlers->private_args == NULL))
+                return -EOPNOTSUPP;
+
+        /* Check if there is enough buffer up there */
+        if (wrqu->data.length < dev->wireless_handlers->num_private_args) {
+                /* User space can't know in advance how large the buffer
+                 * needs to be. Give it a hint, so that we can support
+                 * any size buffer we want somewhat efficiently... */
+                wrqu->data.length = dev->wireless_handlers->num_private_args;
+                return -E2BIG;
+        }
+
+        /* Set the number of available ioctls. */
+        wrqu->data.length = dev->wireless_handlers->num_private_args;
+
+        /* Copy structure to the user buffer. */
+        memcpy(extra, dev->wireless_handlers->private_args,
+               sizeof(struct iw_priv_args) * wrqu->data.length);
+
+        return 0;
+}
+
+/* Size (in bytes) of the various private data types */
+static const char iw_priv_type_size[] = {
+        0,                              /* IW_PRIV_TYPE_NONE */
+        1,                              /* IW_PRIV_TYPE_BYTE */
+        1,                              /* IW_PRIV_TYPE_CHAR */
+        0,                              /* Not defined */
+        sizeof(__u32),                  /* IW_PRIV_TYPE_INT */
+        sizeof(struct iw_freq),         /* IW_PRIV_TYPE_FLOAT */
+        sizeof(struct sockaddr),        /* IW_PRIV_TYPE_ADDR */
+        0,                              /* Not defined */
+};
+
+static int get_priv_size(__u16 args)
+{
+        int     num = args & IW_PRIV_SIZE_MASK;
+        int     type = (args & IW_PRIV_TYPE_MASK) >> 12;
+
+        return num * iw_priv_type_size[type];
+}
+
+static int adjust_priv_size(__u16 args, struct iw_point *iwp)
+{
+        int     num = iwp->length;
+        int     max = args & IW_PRIV_SIZE_MASK;
+        int     type = (args & IW_PRIV_TYPE_MASK) >> 12;
+
+        /* Make sure the driver doesn't goof up */
+        if (max < num)
+                num = max;
+
+        return num * iw_priv_type_size[type];
+}
+
+/*
+ * Wrapper to call a private Wireless Extension handler.
+ * We do various checks and also take care of moving data between
+ * user space and kernel space.
+ * It's not as nice and slimline as the standard wrapper. The cause
+ * is struct iw_priv_args, which was not really designed for the
+ * job we are going here.
+ *
+ * IMPORTANT : This function prevent to set and get data on the same
+ * IOCTL and enforce the SET/GET convention. Not doing it would be
+ * far too hairy...
+ * If you need to set and get data at the same time, please don't use
+ * a iw_handler but process it in your ioctl handler (i.e. use the
+ * old driver API).
+ */
+static int get_priv_descr_and_size(struct net_device *dev, unsigned int cmd,
+                                   const struct iw_priv_args **descrp)
+{
+        const struct iw_priv_args *descr;
+        int i, extra_size;
+
+        descr = NULL;
+        for (i = 0; i < dev->wireless_handlers->num_private_args; i++) {
+                if (cmd == dev->wireless_handlers->private_args[i].cmd) {
+                        descr = &dev->wireless_handlers->private_args[i];
+                        break;
+                }
+        }
+
+        extra_size = 0;
+        if (descr) {
+                if (IW_IS_SET(cmd)) {
+                        int     offset = 0;     /* For sub-ioctls */
+                        /* Check for sub-ioctl handler */
+                        if (descr->name[0] == '\0')
+                                /* Reserve one int for sub-ioctl index */
+                                offset = sizeof(__u32);
+
+                        /* Size of set arguments */
+                        extra_size = get_priv_size(descr->set_args);
+
+                        /* Does it fits in iwr ? */
+                        if ((descr->set_args & IW_PRIV_SIZE_FIXED) &&
+                           ((extra_size + offset) <= IFNAMSIZ))
+                                extra_size = 0;
+                } else {
+                        /* Size of get arguments */
+                        extra_size = get_priv_size(descr->get_args);
+
+                        /* Does it fits in iwr ? */
+                        if ((descr->get_args & IW_PRIV_SIZE_FIXED) &&
+                           (extra_size <= IFNAMSIZ))
+                                extra_size = 0;
+                }
+        }
+        *descrp = descr;
+        return extra_size;
+}
+
+static int ioctl_private_iw_point(struct iw_point *iwp, unsigned int cmd,
+                                  const struct iw_priv_args *descr,
+                                  iw_handler handler, struct net_device *dev,
+                                  struct iw_request_info *info, int extra_size)
+{
+        char *extra;
+        int err;
+
+        /* Check what user space is giving us */
+        if (IW_IS_SET(cmd)) {
+                if (!iwp->pointer && iwp->length != 0)
+                        return -EFAULT;
+
+                if (iwp->length > (descr->set_args & IW_PRIV_SIZE_MASK))
+                        return -E2BIG;
+        } else if (!iwp->pointer)
+                return -EFAULT;
+
+        extra = kmalloc(extra_size, GFP_KERNEL);
+        if (!extra)
+                return -ENOMEM;
+
+        /* If it is a SET, get all the extra data in here */
+        if (IW_IS_SET(cmd) && (iwp->length != 0)) {
+                if (copy_from_user(extra, iwp->pointer, extra_size)) {
+                        err = -EFAULT;
+                        goto out;
+                }
+        }
+
+        /* Call the handler */
+        err = handler(dev, info, (union iwreq_data *) iwp, extra);
+
+        /* If we have something to return to the user */
+        if (!err && IW_IS_GET(cmd)) {
+                /* Adjust for the actual length if it's variable,
+                 * avoid leaking kernel bits outside.
+                 */
+                if (!(descr->get_args & IW_PRIV_SIZE_FIXED))
+                        extra_size = adjust_priv_size(descr->get_args, iwp);
+
+                if (copy_to_user(iwp->pointer, extra, extra_size))
+                        err =  -EFAULT;
+        }
+
+out:
+        kfree(extra);
+        return err;
+}
+
+int ioctl_private_call(struct net_device *dev, struct iwreq *iwr,
+                       unsigned int cmd, struct iw_request_info *info,
+                       iw_handler handler)
+{
+        int extra_size = 0, ret = -EINVAL;
+        const struct iw_priv_args *descr;
+
+        extra_size = get_priv_descr_and_size(dev, cmd, &descr);
+
+        /* Check if we have a pointer to user space data or not. */
+        if (extra_size == 0) {
+                /* No extra arguments. Trivial to handle */
+                ret = handler(dev, info, &(iwr->u), (char *) &(iwr->u));
+        } else {
+                ret = ioctl_private_iw_point(&iwr->u.data, cmd, descr,
+                                             handler, dev, info, extra_size);
+        }
+
+        /* Call commit handler if needed and defined */
+        if (ret == -EIWCOMMIT)
+                ret = call_commit_handler(dev);
+
+        return ret;
+}
+
+#ifdef CONFIG_COMPAT
+int compat_private_call(struct net_device *dev, struct iwreq *iwr,
+                        unsigned int cmd, struct iw_request_info *info,
+                        iw_handler handler)
+{
+        const struct iw_priv_args *descr;
+        int ret, extra_size;
+
+        extra_size = get_priv_descr_and_size(dev, cmd, &descr);
+
+        /* Check if we have a pointer to user space data or not. */
+        if (extra_size == 0) {
+                /* No extra arguments. Trivial to handle */
+                ret = handler(dev, info, &(iwr->u), (char *) &(iwr->u));
+        } else {
+                struct compat_iw_point *iwp_compat;
+                struct iw_point iwp;
+
+                iwp_compat = (struct compat_iw_point *) &iwr->u.data;
+                iwp.pointer = compat_ptr(iwp_compat->pointer);
+                iwp.length = iwp_compat->length;
+                iwp.flags = iwp_compat->flags;
+
+                ret = ioctl_private_iw_point(&iwp, cmd, descr,
+                                             handler, dev, info, extra_size);
+
+                iwp_compat->pointer = ptr_to_compat(iwp.pointer);
+                iwp_compat->length = iwp.length;
+                iwp_compat->flags = iwp.flags;
+        }
+
+        /* Call commit handler if needed and defined */
+        if (ret == -EIWCOMMIT)
+                ret = call_commit_handler(dev);
+
+        return ret;
+}
+#endif
diff --git a/net/wireless/wext-proc.c b/net/wireless/wext-proc.c
new file mode 100644
index 000000000000..8bafa31fa9f8
--- /dev/null
+++ b/net/wireless/wext-proc.c
@@ -0,0 +1,155 @@
+/*
+ * This file implement the Wireless Extensions proc API.
+ *
+ * Authors :    Jean Tourrilhes - HPL - <jt@hpl.hp.com>
+ * Copyright (c) 1997-2007 Jean Tourrilhes, All Rights Reserved.
+ *
+ * (As all part of the Linux kernel, this file is GPL)
+ */
+
+/*
+ * The /proc/net/wireless file is a human readable user-space interface
+ * exporting various wireless specific statistics from the wireless devices.
+ * This is the most popular part of the Wireless Extensions ;-)
+ *
+ * This interface is a pure clone of /proc/net/dev (in net/core/dev.c).
+ * The content of the file is basically the content of "struct iw_statistics".
+ */
+
+#include <linux/module.h>
+#include <linux/proc_fs.h>
+#include <linux/seq_file.h>
+#include <linux/wireless.h>
+#include <linux/netdevice.h>
+#include <linux/rtnetlink.h>
+#include <net/iw_handler.h>
+#include <net/wext.h>
+
+
+static void wireless_seq_printf_stats(struct seq_file *seq,
+                                      struct net_device *dev)
+{
+        /* Get stats from the driver */
+        struct iw_statistics *stats = get_wireless_stats(dev);
+        static struct iw_statistics nullstats = {};
+
+        /* show device if it's wireless regardless of current stats */
+        if (!stats) {
+#ifdef CONFIG_WIRELESS_EXT
+                if (dev->wireless_handlers)
+                        stats = &nullstats;
+#endif
+#ifdef CONFIG_CFG80211
+                if (dev->ieee80211_ptr)
+                        stats = &nullstats;
+#endif
+        }
+
+        if (stats) {
+                seq_printf(seq, "%6s: %04x  %3d%c  %3d%c  %3d%c  %6d %6d %6d "
+                                "%6d %6d   %6d\n",
+                           dev->name, stats->status, stats->qual.qual,
+                           stats->qual.updated & IW_QUAL_QUAL_UPDATED
+                           ? '.' : ' ',
+                           ((__s32) stats->qual.level) -
+                           ((stats->qual.updated & IW_QUAL_DBM) ? 0x100 : 0),
+                           stats->qual.updated & IW_QUAL_LEVEL_UPDATED
+                           ? '.' : ' ',
+                           ((__s32) stats->qual.noise) -
+                           ((stats->qual.updated & IW_QUAL_DBM) ? 0x100 : 0),
+                           stats->qual.updated & IW_QUAL_NOISE_UPDATED
+                           ? '.' : ' ',
+                           stats->discard.nwid, stats->discard.code,
+                           stats->discard.fragment, stats->discard.retries,
+                           stats->discard.misc, stats->miss.beacon);
+
+                if (stats != &nullstats)
+                        stats->qual.updated &= ~IW_QUAL_ALL_UPDATED;
+        }
+}
+
+/* ---------------------------------------------------------------- */
+/*
+ * Print info for /proc/net/wireless (print all entries)
+ */
+static int wireless_dev_seq_show(struct seq_file *seq, void *v)
+{
+        might_sleep();
+
+        if (v == SEQ_START_TOKEN)
+                seq_printf(seq, "Inter-| sta-|   Quality        |   Discarded "
+                                "packets               | Missed | WE\n"
+                                " face | tus | link level noise |  nwid  "
+                                "crypt   frag  retry   misc | beacon | %d\n",
+                           WIRELESS_EXT);
+        else
+                wireless_seq_printf_stats(seq, v);
+        return 0;
+}
+
+static void *wireless_dev_seq_start(struct seq_file *seq, loff_t *pos)
+{
+        struct net *net = seq_file_net(seq);
+        loff_t off;
+        struct net_device *dev;
+
+        rtnl_lock();
+        if (!*pos)
+                return SEQ_START_TOKEN;
+
+        off = 1;
+        for_each_netdev(net, dev)
+                if (off++ == *pos)
+                        return dev;
+        return NULL;
+}
+
+static void *wireless_dev_seq_next(struct seq_file *seq, void *v, loff_t *pos)
+{
+        struct net *net = seq_file_net(seq);
+
+        ++*pos;
+
+        return v == SEQ_START_TOKEN ?
+                first_net_device(net) : next_net_device(v);
+}
+
+static void wireless_dev_seq_stop(struct seq_file *seq, void *v)
+{
+        rtnl_unlock();
+}
+
+static const struct seq_operations wireless_seq_ops = {
+        .start = wireless_dev_seq_start,
+        .next  = wireless_dev_seq_next,
+        .stop  = wireless_dev_seq_stop,
+        .show  = wireless_dev_seq_show,
+};
+
+static int seq_open_wireless(struct inode *inode, struct file *file)
+{
+        return seq_open_net(inode, file, &wireless_seq_ops,
+                            sizeof(struct seq_net_private));
+}
+
+static const struct file_operations wireless_seq_fops = {
+        .owner   = THIS_MODULE,
+        .open    = seq_open_wireless,
+        .read    = seq_read,
+        .llseek  = seq_lseek,
+        .release = seq_release_net,
+};
+
+int __net_init wext_proc_init(struct net *net)
+{
+        /* Create /proc/net/wireless entry */
+        if (!proc_net_fops_create(net, "wireless", S_IRUGO, &wireless_seq_fops))
+                return -ENOMEM;
+
+        return 0;
+}
+
+void __net_exit wext_proc_exit(struct net *net)
+{
+        proc_net_remove(net, "wireless");
+}
diff --git a/net/wireless/wext-sme.c b/net/wireless/wext-sme.c
index 5615a8802536..d5c6140f4cb8 100644
--- a/net/wireless/wext-sme.c
+++ b/net/wireless/wext-sme.c
@@ -7,6 +7,7 @@
 
 #include <linux/etherdevice.h>
 #include <linux/if_arp.h>
+#include <linux/slab.h>
 #include <net/cfg80211.h>
 #include "wext-compat.h"
 #include "nl80211.h"
diff --git a/net/wireless/wext-spy.c b/net/wireless/wext-spy.c
new file mode 100644
index 000000000000..6dcfe65a2d1a
--- /dev/null
+++ b/net/wireless/wext-spy.c
@@ -0,0 +1,231 @@
+/*
+ * This file implement the Wireless Extensions spy API.
+ *
+ * Authors :    Jean Tourrilhes - HPL - <jt@hpl.hp.com>
+ * Copyright (c) 1997-2007 Jean Tourrilhes, All Rights Reserved.
+ *
+ * (As all part of the Linux kernel, this file is GPL)
+ */
+
+#include <linux/wireless.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <net/iw_handler.h>
+#include <net/arp.h>
+#include <net/wext.h>
+
+static inline struct iw_spy_data *get_spydata(struct net_device *dev)
+{
+        /* This is the new way */
+        if (dev->wireless_data)
+                return dev->wireless_data->spy_data;
+        return NULL;
+}
+
+int iw_handler_set_spy(struct net_device *      dev,
+                       struct iw_request_info * info,
+                       union iwreq_data *       wrqu,
+                       char *                   extra)
+{
+        struct iw_spy_data *    spydata = get_spydata(dev);
+        struct sockaddr *       address = (struct sockaddr *) extra;
+
+        /* Make sure driver is not buggy or using the old API */
+        if (!spydata)
+                return -EOPNOTSUPP;
+
+        /* Disable spy collection while we copy the addresses.
+         * While we copy addresses, any call to wireless_spy_update()
+         * will NOP. This is OK, as anyway the addresses are changing. */
+        spydata->spy_number = 0;
+
+        /* We want to operate without locking, because wireless_spy_update()
+         * most likely will happen in the interrupt handler, and therefore
+         * have its own locking constraints and needs performance.
+         * The rtnl_lock() make sure we don't race with the other iw_handlers.
+         * This make sure wireless_spy_update() "see" that the spy list
+         * is temporarily disabled. */
+        smp_wmb();
+
+        /* Are there are addresses to copy? */
+        if (wrqu->data.length > 0) {
+                int i;
+
+                /* Copy addresses */
+                for (i = 0; i < wrqu->data.length; i++)
+                        memcpy(spydata->spy_address[i], address[i].sa_data,
+                               ETH_ALEN);
+                /* Reset stats */
+                memset(spydata->spy_stat, 0,
+                       sizeof(struct iw_quality) * IW_MAX_SPY);
+        }
+
+        /* Make sure above is updated before re-enabling */
+        smp_wmb();
+
+        /* Enable addresses */
+        spydata->spy_number = wrqu->data.length;
+
+        return 0;
+}
+EXPORT_SYMBOL(iw_handler_set_spy);
+
+int iw_handler_get_spy(struct net_device *      dev,
+                       struct iw_request_info * info,
+                       union iwreq_data *       wrqu,
+                       char *                   extra)
+{
+        struct iw_spy_data *    spydata = get_spydata(dev);
+        struct sockaddr *       address = (struct sockaddr *) extra;
+        int                     i;
+
+        /* Make sure driver is not buggy or using the old API */
+        if (!spydata)
+                return -EOPNOTSUPP;
+
+        wrqu->data.length = spydata->spy_number;
+
+        /* Copy addresses. */
+        for (i = 0; i < spydata->spy_number; i++)       {
+                memcpy(address[i].sa_data, spydata->spy_address[i], ETH_ALEN);
+                address[i].sa_family = AF_UNIX;
+        }
+        /* Copy stats to the user buffer (just after). */
+        if (spydata->spy_number > 0)
+                memcpy(extra  + (sizeof(struct sockaddr) *spydata->spy_number),
+                       spydata->spy_stat,
+                       sizeof(struct iw_quality) * spydata->spy_number);
+        /* Reset updated flags. */
+        for (i = 0; i < spydata->spy_number; i++)
+                spydata->spy_stat[i].updated &= ~IW_QUAL_ALL_UPDATED;
+        return 0;
+}
+EXPORT_SYMBOL(iw_handler_get_spy);
+
+/*------------------------------------------------------------------*/
+/*
+ * Standard Wireless Handler : set spy threshold
+ */
+int iw_handler_set_thrspy(struct net_device *   dev,
+                          struct iw_request_info *info,
+                          union iwreq_data *    wrqu,
+                          char *                extra)
+{
+        struct iw_spy_data *    spydata = get_spydata(dev);
+        struct iw_thrspy *      threshold = (struct iw_thrspy *) extra;
+
+        /* Make sure driver is not buggy or using the old API */
+        if (!spydata)
+                return -EOPNOTSUPP;
+
+        /* Just do it */
+        memcpy(&(spydata->spy_thr_low), &(threshold->low),
+               2 * sizeof(struct iw_quality));
+
+        /* Clear flag */
+        memset(spydata->spy_thr_under, '\0', sizeof(spydata->spy_thr_under));
+
+        return 0;
+}
+EXPORT_SYMBOL(iw_handler_set_thrspy);
+
+/*------------------------------------------------------------------*/
+/*
+ * Standard Wireless Handler : get spy threshold
+ */
+int iw_handler_get_thrspy(struct net_device *   dev,
+                          struct iw_request_info *info,
+                          union iwreq_data *    wrqu,
+                          char *                extra)
+{
+        struct iw_spy_data *    spydata = get_spydata(dev);
+        struct iw_thrspy *      threshold = (struct iw_thrspy *) extra;
+
+        /* Make sure driver is not buggy or using the old API */
+        if (!spydata)
+                return -EOPNOTSUPP;
+
+        /* Just do it */
+        memcpy(&(threshold->low), &(spydata->spy_thr_low),
+               2 * sizeof(struct iw_quality));
+
+        return 0;
+}
+EXPORT_SYMBOL(iw_handler_get_thrspy);
+
+/*------------------------------------------------------------------*/
+/*
+ * Prepare and send a Spy Threshold event
+ */
+static void iw_send_thrspy_event(struct net_device *    dev,
+                                 struct iw_spy_data *   spydata,
+                                 unsigned char *        address,
+                                 struct iw_quality *    wstats)
+{
+        union iwreq_data        wrqu;
+        struct iw_thrspy        threshold;
+
+        /* Init */
+        wrqu.data.length = 1;
+        wrqu.data.flags = 0;
+        /* Copy address */
+        memcpy(threshold.addr.sa_data, address, ETH_ALEN);
+        threshold.addr.sa_family = ARPHRD_ETHER;
+        /* Copy stats */
+        memcpy(&(threshold.qual), wstats, sizeof(struct iw_quality));
+        /* Copy also thresholds */
+        memcpy(&(threshold.low), &(spydata->spy_thr_low),
+               2 * sizeof(struct iw_quality));
+
+        /* Send event to user space */
+        wireless_send_event(dev, SIOCGIWTHRSPY, &wrqu, (char *) &threshold);
+}
+
+/* ---------------------------------------------------------------- */
+/*
+ * Call for the driver to update the spy data.
+ * For now, the spy data is a simple array. As the size of the array is
+ * small, this is good enough. If we wanted to support larger number of
+ * spy addresses, we should use something more efficient...
+ */
+void wireless_spy_update(struct net_device *    dev,
+                         unsigned char *        address,
+                         struct iw_quality *    wstats)
+{
+        struct iw_spy_data *    spydata = get_spydata(dev);
+        int                     i;
+        int                     match = -1;
+
+        /* Make sure driver is not buggy or using the old API */
+        if (!spydata)
+                return;
+
+        /* Update all records that match */
+        for (i = 0; i < spydata->spy_number; i++)
+                if (!compare_ether_addr(address, spydata->spy_address[i])) {
+                        memcpy(&(spydata->spy_stat[i]), wstats,
+                               sizeof(struct iw_quality));
+                        match = i;
+                }
+
+        /* Generate an event if we cross the spy threshold.
+         * To avoid event storms, we have a simple hysteresis : we generate
+         * event only when we go under the low threshold or above the
+         * high threshold. */
+        if (match >= 0) {
+                if (spydata->spy_thr_under[match]) {
+                        if (wstats->level > spydata->spy_thr_high.level) {
+                                spydata->spy_thr_under[match] = 0;
+                                iw_send_thrspy_event(dev, spydata,
+                                                     address, wstats);
+                        }
+                } else {
+                        if (wstats->level < spydata->spy_thr_low.level) {
+                                spydata->spy_thr_under[match] = 1;
+                                iw_send_thrspy_event(dev, spydata,
+                                                     address, wstats);
+                        }
+                }
+        }
+}
+EXPORT_SYMBOL(wireless_spy_update);