Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next-2.6

17 files changed, 742 insertions, 291 deletions

diff --git a/net/mac80211/Kconfig b/net/mac80211/Kconfig
index 4d5543af3123..a10d508b07e1 100644
--- a/net/mac80211/Kconfig
+++ b/net/mac80211/Kconfig
@@ -194,6 +194,19 @@ config MAC80211_VERBOSE_MPL_DEBUG
 
           Do not select this option.
 
+config MAC80211_VERBOSE_MHWMP_DEBUG
+        bool "Verbose mesh HWMP routing debugging"
+        depends on MAC80211_DEBUG_MENU
+        depends on MAC80211_MESH
+        ---help---
+          Selecting this option causes mac80211 to print out very
+          verbose mesh routing (HWMP) debugging messages (when mac80211
+          is taking part in a mesh network).
+          It should not be selected on production systems as those
+          messages are remotely triggerable.
+
+          Do not select this option.
+
 config MAC80211_DEBUG_COUNTERS
         bool "Extra statistics for TX/RX debugging"
         depends on MAC80211_DEBUG_MENU
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 56319b51d170..7f18c8fa1880 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -36,6 +36,24 @@ static bool nl80211_type_check(enum nl80211_iftype type)
         }
 }
 
+static bool nl80211_params_check(enum nl80211_iftype type,
+                                 struct vif_params *params)
+{
+        if (!nl80211_type_check(type))
+                return false;
+
+        if (params->use_4addr > 0) {
+                switch(type) {
+                case NL80211_IFTYPE_AP_VLAN:
+                case NL80211_IFTYPE_STATION:
+                        break;
+                default:
+                        return false;
+                }
+        }
+        return true;
+}
+
 static int ieee80211_add_iface(struct wiphy *wiphy, char *name,
                                enum nl80211_iftype type, u32 *flags,
                                struct vif_params *params)
@@ -45,7 +63,7 @@ static int ieee80211_add_iface(struct wiphy *wiphy, char *name,
         struct ieee80211_sub_if_data *sdata;
         int err;
 
-        if (!nl80211_type_check(type))
+        if (!nl80211_params_check(type, params))
                 return -EINVAL;
 
         err = ieee80211_if_add(local, name, &dev, type, params);
@@ -75,7 +93,7 @@ static int ieee80211_change_iface(struct wiphy *wiphy,
         if (netif_running(dev))
                 return -EBUSY;
 
-        if (!nl80211_type_check(type))
+        if (!nl80211_params_check(type, params))
                 return -EINVAL;
 
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
@@ -89,6 +107,9 @@ static int ieee80211_change_iface(struct wiphy *wiphy,
                                             params->mesh_id_len,
                                             params->mesh_id);
 
+        if (params->use_4addr >= 0)
+                sdata->use_4addr = !!params->use_4addr;
+
         if (sdata->vif.type != NL80211_IFTYPE_MONITOR || !flags)
                 return 0;
 
@@ -806,6 +827,13 @@ static int ieee80211_change_station(struct wiphy *wiphy,
                         return -EINVAL;
                 }
 
+                if (vlansdata->use_4addr) {
+                        if (vlansdata->u.vlan.sta)
+                                return -EBUSY;
+
+                        rcu_assign_pointer(vlansdata->u.vlan.sta, sta);
+                }
+
                 sta->sdata = vlansdata;
                 ieee80211_send_layer2_update(sta);
         }
@@ -907,7 +935,7 @@ static void mpath_set_pinfo(struct mesh_path *mpath, u8 *next_hop,
         pinfo->generation = mesh_paths_generation;
 
         pinfo->filled = MPATH_INFO_FRAME_QLEN |
-                        MPATH_INFO_DSN |
+                        MPATH_INFO_SN |
                         MPATH_INFO_METRIC |
                         MPATH_INFO_EXPTIME |
                         MPATH_INFO_DISCOVERY_TIMEOUT |
@@ -915,7 +943,7 @@ static void mpath_set_pinfo(struct mesh_path *mpath, u8 *next_hop,
                         MPATH_INFO_FLAGS;
 
         pinfo->frame_qlen = mpath->frame_queue.qlen;
-        pinfo->dsn = mpath->dsn;
+        pinfo->sn = mpath->sn;
         pinfo->metric = mpath->metric;
         if (time_before(jiffies, mpath->exp_time))
                 pinfo->exptime = jiffies_to_msecs(mpath->exp_time - jiffies);
@@ -927,8 +955,8 @@ static void mpath_set_pinfo(struct mesh_path *mpath, u8 *next_hop,
                 pinfo->flags |= NL80211_MPATH_FLAG_ACTIVE;
         if (mpath->flags & MESH_PATH_RESOLVING)
                 pinfo->flags |= NL80211_MPATH_FLAG_RESOLVING;
-        if (mpath->flags & MESH_PATH_DSN_VALID)
-                pinfo->flags |= NL80211_MPATH_FLAG_DSN_VALID;
+        if (mpath->flags & MESH_PATH_SN_VALID)
+                pinfo->flags |= NL80211_MPATH_FLAG_SN_VALID;
         if (mpath->flags & MESH_PATH_FIXED)
                 pinfo->flags |= NL80211_MPATH_FLAG_FIXED;
         if (mpath->flags & MESH_PATH_RESOLVING)
@@ -1001,7 +1029,10 @@ static int ieee80211_set_mesh_params(struct wiphy *wiphy,
 {
         struct mesh_config *conf;
         struct ieee80211_sub_if_data *sdata;
+        struct ieee80211_if_mesh *ifmsh;
+
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        ifmsh = &sdata->u.mesh;
 
         /* Set the config options which we are interested in setting */
         conf = &(sdata->u.mesh.mshcfg);
@@ -1036,6 +1067,10 @@ static int ieee80211_set_mesh_params(struct wiphy *wiphy,
                            mask))
                 conf->dot11MeshHWMPnetDiameterTraversalTime =
                         nconf->dot11MeshHWMPnetDiameterTraversalTime;
+        if (_chg_mesh_attr(NL80211_MESHCONF_HWMP_ROOTMODE, mask)) {
+                conf->dot11MeshHWMPRootMode = nconf->dot11MeshHWMPRootMode;
+                ieee80211_mesh_root_setup(ifmsh);
+        }
         return 0;
 }
 
diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c
index 8782264f49e7..472b2039906c 100644
--- a/net/mac80211/debugfs_netdev.c
+++ b/net/mac80211/debugfs_netdev.c
@@ -149,6 +149,8 @@ IEEE80211_IF_FILE(path_refresh_time,
                 u.mesh.mshcfg.path_refresh_time, DEC);
 IEEE80211_IF_FILE(min_discovery_timeout,
                 u.mesh.mshcfg.min_discovery_timeout, DEC);
+IEEE80211_IF_FILE(dot11MeshHWMPRootMode,
+                u.mesh.mshcfg.dot11MeshHWMPRootMode, DEC);
 #endif
 
 
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 1ef767366b77..b63b99fb2fd3 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -208,6 +208,9 @@ struct ieee80211_if_wds {
 
 struct ieee80211_if_vlan {
         struct list_head list;
+
+        /* used for all tx if the VLAN is configured to 4-addr mode */
+        struct sta_info *sta;
 };
 
 struct mesh_stats {
@@ -352,6 +355,7 @@ struct ieee80211_if_mesh {
         struct work_struct work;
         struct timer_list housekeeping_timer;
         struct timer_list mesh_path_timer;
+        struct timer_list mesh_path_root_timer;
         struct sk_buff_head skb_queue;
 
         unsigned long timers_running;
@@ -361,23 +365,23 @@ struct ieee80211_if_mesh {
         u8 mesh_id[IEEE80211_MAX_MESH_ID_LEN];
         size_t mesh_id_len;
         /* Active Path Selection Protocol Identifier */
-        u8 mesh_pp_id[4];
+        u8 mesh_pp_id;
         /* Active Path Selection Metric Identifier */
-        u8 mesh_pm_id[4];
+        u8 mesh_pm_id;
         /* Congestion Control Mode Identifier */
-        u8 mesh_cc_id[4];
+        u8 mesh_cc_id;
         /* Synchronization Protocol Identifier */
-        u8 mesh_sp_id[4];
+        u8 mesh_sp_id;
         /* Authentication Protocol Identifier */
-        u8 mesh_auth_id[4];
-        /* Local mesh Destination Sequence Number */
-        u32 dsn;
+        u8 mesh_auth_id;
+        /* Local mesh Sequence Number */
+        u32 sn;
         /* Last used PREQ ID */
         u32 preq_id;
         atomic_t mpaths;
-        /* Timestamp of last DSN update */
-        unsigned long last_dsn_update;
-        /* Timestamp of last DSN sent */
+        /* Timestamp of last SN update */
+        unsigned long last_sn_update;
+        /* Timestamp of last SN sent */
         unsigned long last_preq;
         struct mesh_rmc *rmc;
         spinlock_t mesh_preq_queue_lock;
@@ -457,6 +461,8 @@ struct ieee80211_sub_if_data {
         int force_unicast_rateidx; /* forced TX rateidx for unicast frames */
         int max_ratectrl_rateidx; /* max TX rateidx for rate control */
 
+        bool use_4addr; /* use 4-address frames */
+
         union {
                 struct ieee80211_if_ap ap;
                 struct ieee80211_if_wds wds;
@@ -799,6 +805,7 @@ struct ieee802_11_elems {
         u8 *preq;
         u8 *prep;
         u8 *perr;
+        struct ieee80211_rann_ie *rann;
         u8 *ch_switch_elem;
         u8 *country_elem;
         u8 *pwr_constr_elem;
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 8495161b99b8..1f02b0610e82 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -752,6 +752,7 @@ int ieee80211_if_change_type(struct ieee80211_sub_if_data *sdata,
                 ieee80211_mandatory_rates(sdata->local,
                         sdata->local->hw.conf.channel->band);
         sdata->drop_unencrypted = 0;
+        sdata->use_4addr = 0;
 
         return 0;
 }
@@ -819,6 +820,9 @@ int ieee80211_if_add(struct ieee80211_local *local, const char *name,
                                             params->mesh_id_len,
                                             params->mesh_id);
 
+        if (params && params->use_4addr >= 0)
+                sdata->use_4addr = !!params->use_4addr;
+
         mutex_lock(&local->iflist_mtx);
         list_add_tail_rcu(&sdata->list, &local->interfaces);
         mutex_unlock(&local->iflist_mtx);
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index 9a733890eb47..bbd56b087899 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2008 open80211s Ltd.
+ * Copyright (c) 2008, 2009 open80211s Ltd.
  * Authors:    Luis Carlos Cobo <luisca@cozybit.com>
  *             Javier Cardona <javier@cozybit.com>
  *
@@ -14,18 +14,20 @@
 
 #define IEEE80211_MESH_PEER_INACTIVITY_LIMIT (1800 * HZ)
 #define IEEE80211_MESH_HOUSEKEEPING_INTERVAL (60 * HZ)
+#define IEEE80211_MESH_RANN_INTERVAL         (1 * HZ)
 
-#define PP_OFFSET       1               /* Path Selection Protocol */
-#define PM_OFFSET       5               /* Path Selection Metric   */
-#define CC_OFFSET       9               /* Congestion Control Mode */
-#define SP_OFFSET       13              /* Synchronization Protocol */
-#define AUTH_OFFSET     17              /* Authentication Protocol */
-#define CAPAB_OFFSET    22
-#define CAPAB_ACCEPT_PLINKS 0x80
-#define CAPAB_FORWARDING    0x10
+#define MESHCONF_PP_OFFSET      0               /* Path Selection Protocol */
+#define MESHCONF_PM_OFFSET      1               /* Path Selection Metric   */
+#define MESHCONF_CC_OFFSET      2               /* Congestion Control Mode */
+#define MESHCONF_SP_OFFSET      3               /* Synchronization Protocol */
+#define MESHCONF_AUTH_OFFSET    4               /* Authentication Protocol */
+#define MESHCONF_CAPAB_OFFSET   6
+#define MESHCONF_CAPAB_ACCEPT_PLINKS 0x01
+#define MESHCONF_CAPAB_FORWARDING    0x08
 
 #define TMR_RUNNING_HK  0
 #define TMR_RUNNING_MP  1
+#define TMR_RUNNING_MPR 2
 
 int mesh_allocated;
 static struct kmem_cache *rm_cache;
@@ -85,11 +87,12 @@ bool mesh_matches_local(struct ieee802_11_elems *ie, struct ieee80211_sub_if_dat
          */
         if (ifmsh->mesh_id_len == ie->mesh_id_len &&
                 memcmp(ifmsh->mesh_id, ie->mesh_id, ie->mesh_id_len) == 0 &&
-                memcmp(ifmsh->mesh_pp_id, ie->mesh_config + PP_OFFSET, 4) == 0 &&
-                memcmp(ifmsh->mesh_pm_id, ie->mesh_config + PM_OFFSET, 4) == 0 &&
-                memcmp(ifmsh->mesh_cc_id, ie->mesh_config + CC_OFFSET, 4) == 0 &&
-                memcmp(ifmsh->mesh_sp_id, ie->mesh_config + SP_OFFSET, 4) == 0 &&
-                memcmp(ifmsh->mesh_auth_id, ie->mesh_config + AUTH_OFFSET, 4) == 0)
+                (ifmsh->mesh_pp_id == *(ie->mesh_config + MESHCONF_PP_OFFSET))&&
+                (ifmsh->mesh_pm_id == *(ie->mesh_config + MESHCONF_PM_OFFSET))&&
+                (ifmsh->mesh_cc_id == *(ie->mesh_config + MESHCONF_CC_OFFSET))&&
+                (ifmsh->mesh_sp_id == *(ie->mesh_config + MESHCONF_SP_OFFSET))&&
+                (ifmsh->mesh_auth_id == *(ie->mesh_config +
+                    MESHCONF_AUTH_OFFSET)))
                 return true;
 
         return false;
@@ -102,7 +105,8 @@ bool mesh_matches_local(struct ieee802_11_elems *ie, struct ieee80211_sub_if_dat
  */
 bool mesh_peer_accepts_plinks(struct ieee802_11_elems *ie)
 {
-        return (*(ie->mesh_config + CAPAB_OFFSET) & CAPAB_ACCEPT_PLINKS) != 0;
+        return (*(ie->mesh_config + MESHCONF_CAPAB_OFFSET) &
+            MESHCONF_CAPAB_ACCEPT_PLINKS) != 0;
 }
 
 /**
@@ -128,18 +132,11 @@ void mesh_accept_plinks_update(struct ieee80211_sub_if_data *sdata)
 
 void mesh_ids_set_default(struct ieee80211_if_mesh *sta)
 {
-        u8 oui[3] = {0x00, 0x0F, 0xAC};
-
-        memcpy(sta->mesh_pp_id, oui, sizeof(oui));
-        memcpy(sta->mesh_pm_id, oui, sizeof(oui));
-        memcpy(sta->mesh_cc_id, oui, sizeof(oui));
-        memcpy(sta->mesh_sp_id, oui, sizeof(oui));
-        memcpy(sta->mesh_auth_id, oui, sizeof(oui));
-        sta->mesh_pp_id[sizeof(oui)] = 0;
-        sta->mesh_pm_id[sizeof(oui)] = 0;
-        sta->mesh_cc_id[sizeof(oui)] = 0xff;
-        sta->mesh_sp_id[sizeof(oui)] = 0xff;
-        sta->mesh_auth_id[sizeof(oui)] = 0x0;
+        sta->mesh_pp_id = 0;    /* HWMP */
+        sta->mesh_pm_id = 0;    /* Airtime */
+        sta->mesh_cc_id = 0;    /* Disabled */
+        sta->mesh_sp_id = 0;    /* Neighbor Offset */
+        sta->mesh_auth_id = 0;  /* Disabled */
 }
 
 int mesh_rmc_init(struct ieee80211_sub_if_data *sdata)
@@ -228,6 +225,7 @@ void mesh_mgmt_ies_add(struct sk_buff *skb, struct ieee80211_sub_if_data *sdata)
         struct ieee80211_supported_band *sband;
         u8 *pos;
         int len, i, rate;
+        u8 neighbors;
 
         sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
         len = sband->n_bitrates;
@@ -251,6 +249,13 @@ void mesh_mgmt_ies_add(struct sk_buff *skb, struct ieee80211_sub_if_data *sdata)
                 }
         }
 
+        if (sband->band == IEEE80211_BAND_2GHZ) {
+                pos = skb_put(skb, 2 + 1);
+                *pos++ = WLAN_EID_DS_PARAMS;
+                *pos++ = 1;
+                *pos++ = ieee80211_frequency_to_channel(local->hw.conf.channel->center_freq);
+        }
+
         pos = skb_put(skb, 2 + sdata->u.mesh.mesh_id_len);
         *pos++ = WLAN_EID_MESH_ID;
         *pos++ = sdata->u.mesh.mesh_id_len;
@@ -260,37 +265,33 @@ void mesh_mgmt_ies_add(struct sk_buff *skb, struct ieee80211_sub_if_data *sdata)
         pos = skb_put(skb, 2 + IEEE80211_MESH_CONFIG_LEN);
         *pos++ = WLAN_EID_MESH_CONFIG;
         *pos++ = IEEE80211_MESH_CONFIG_LEN;
-        /* Version */
-        *pos++ = 1;
 
         /* Active path selection protocol ID */
-        memcpy(pos, sdata->u.mesh.mesh_pp_id, 4);
-        pos += 4;
+        *pos++ = sdata->u.mesh.mesh_pp_id;
 
         /* Active path selection metric ID   */
-        memcpy(pos, sdata->u.mesh.mesh_pm_id, 4);
-        pos += 4;
+        *pos++ = sdata->u.mesh.mesh_pm_id;
 
         /* Congestion control mode identifier */
-        memcpy(pos, sdata->u.mesh.mesh_cc_id, 4);
-        pos += 4;
+        *pos++ = sdata->u.mesh.mesh_cc_id;
 
         /* Synchronization protocol identifier */
-        memcpy(pos, sdata->u.mesh.mesh_sp_id, 4);
-        pos += 4;
+        *pos++ = sdata->u.mesh.mesh_sp_id;
 
         /* Authentication Protocol identifier */
-        memcpy(pos, sdata->u.mesh.mesh_auth_id, 4);
-        pos += 4;
+        *pos++ = sdata->u.mesh.mesh_auth_id;
 
-        /* Mesh Formation Info */
-        memset(pos, 0x00, 1);
-        pos += 1;
+        /* Mesh Formation Info - number of neighbors */
+        neighbors = atomic_read(&sdata->u.mesh.mshstats.estab_plinks);
+        /* Number of neighbor mesh STAs or 15 whichever is smaller */
+        neighbors = (neighbors > 15) ? 15 : neighbors;
+        *pos++ = neighbors << 1;
 
         /* Mesh capability */
         sdata->u.mesh.accepting_plinks = mesh_plink_availables(sdata);
-        *pos = CAPAB_FORWARDING;
-        *pos++ |= sdata->u.mesh.accepting_plinks ? CAPAB_ACCEPT_PLINKS : 0x00;
+        *pos = MESHCONF_CAPAB_FORWARDING;
+        *pos++ |= sdata->u.mesh.accepting_plinks ?
+            MESHCONF_CAPAB_ACCEPT_PLINKS : 0x00;
         *pos++ = 0x00;
 
         return;
@@ -355,6 +356,34 @@ static void ieee80211_mesh_path_timer(unsigned long data)
         ieee80211_queue_work(&local->hw, &ifmsh->work);
 }
 
+static void ieee80211_mesh_path_root_timer(unsigned long data)
+{
+        struct ieee80211_sub_if_data *sdata =
+                (struct ieee80211_sub_if_data *) data;
+        struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
+        struct ieee80211_local *local = sdata->local;
+
+        set_bit(MESH_WORK_ROOT, &ifmsh->wrkq_flags);
+
+        if (local->quiescing) {
+                set_bit(TMR_RUNNING_MPR, &ifmsh->timers_running);
+                return;
+        }
+
+        ieee80211_queue_work(&local->hw, &ifmsh->work);
+}
+
+void ieee80211_mesh_root_setup(struct ieee80211_if_mesh *ifmsh)
+{
+        if (ifmsh->mshcfg.dot11MeshHWMPRootMode)
+                set_bit(MESH_WORK_ROOT, &ifmsh->wrkq_flags);
+        else {
+                clear_bit(MESH_WORK_ROOT, &ifmsh->wrkq_flags);
+                /* stop running timer */
+                del_timer_sync(&ifmsh->mesh_path_root_timer);
+        }
+}
+
 /**
  * ieee80211_fill_mesh_addresses - fill addresses of a locally originated mesh frame
  * @hdr:        802.11 frame header
@@ -448,6 +477,15 @@ static void ieee80211_mesh_housekeeping(struct ieee80211_sub_if_data *sdata,
                   round_jiffies(jiffies + IEEE80211_MESH_HOUSEKEEPING_INTERVAL));
 }
 
+static void ieee80211_mesh_rootpath(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
+
+        mesh_path_tx_root_frame(sdata);
+        mod_timer(&ifmsh->mesh_path_root_timer,
+                  round_jiffies(jiffies + IEEE80211_MESH_RANN_INTERVAL));
+}
+
 #ifdef CONFIG_PM
 void ieee80211_mesh_quiesce(struct ieee80211_sub_if_data *sdata)
 {
@@ -462,6 +500,8 @@ void ieee80211_mesh_quiesce(struct ieee80211_sub_if_data *sdata)
                 set_bit(TMR_RUNNING_HK, &ifmsh->timers_running);
         if (del_timer_sync(&ifmsh->mesh_path_timer))
                 set_bit(TMR_RUNNING_MP, &ifmsh->timers_running);
+        if (del_timer_sync(&ifmsh->mesh_path_root_timer))
+                set_bit(TMR_RUNNING_MPR, &ifmsh->timers_running);
 }
 
 void ieee80211_mesh_restart(struct ieee80211_sub_if_data *sdata)
@@ -472,6 +512,9 @@ void ieee80211_mesh_restart(struct ieee80211_sub_if_data *sdata)
                 add_timer(&ifmsh->housekeeping_timer);
         if (test_and_clear_bit(TMR_RUNNING_MP, &ifmsh->timers_running))
                 add_timer(&ifmsh->mesh_path_timer);
+        if (test_and_clear_bit(TMR_RUNNING_MPR, &ifmsh->timers_running))
+                add_timer(&ifmsh->mesh_path_root_timer);
+        ieee80211_mesh_root_setup(ifmsh);
 }
 #endif
 
@@ -481,6 +524,7 @@ void ieee80211_start_mesh(struct ieee80211_sub_if_data *sdata)
         struct ieee80211_local *local = sdata->local;
 
         set_bit(MESH_WORK_HOUSEKEEPING, &ifmsh->wrkq_flags);
+        ieee80211_mesh_root_setup(ifmsh);
         ieee80211_queue_work(&local->hw, &ifmsh->work);
         sdata->vif.bss_conf.beacon_int = MESH_DEFAULT_BEACON_INTERVAL;
         ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON |
@@ -491,6 +535,7 @@ void ieee80211_start_mesh(struct ieee80211_sub_if_data *sdata)
 void ieee80211_stop_mesh(struct ieee80211_sub_if_data *sdata)
 {
         del_timer_sync(&sdata->u.mesh.housekeeping_timer);
+        del_timer_sync(&sdata->u.mesh.mesh_path_root_timer);
         /*
          * If the timer fired while we waited for it, it will have
          * requeued the work. Now the work will be running again
@@ -561,7 +606,7 @@ static void ieee80211_mesh_rx_mgmt_action(struct ieee80211_sub_if_data *sdata,
                                           struct ieee80211_rx_status *rx_status)
 {
         switch (mgmt->u.action.category) {
-        case PLINK_CATEGORY:
+        case MESH_PLINK_CATEGORY:
                 mesh_rx_plink_frame(sdata, mgmt, len, rx_status);
                 break;
         case MESH_PATH_SEL_CATEGORY:
@@ -628,6 +673,9 @@ static void ieee80211_mesh_work(struct work_struct *work)
 
         if (test_and_clear_bit(MESH_WORK_HOUSEKEEPING, &ifmsh->wrkq_flags))
                 ieee80211_mesh_housekeeping(sdata, ifmsh);
+
+        if (test_and_clear_bit(MESH_WORK_ROOT, &ifmsh->wrkq_flags))
+                ieee80211_mesh_rootpath(sdata);
 }
 
 void ieee80211_mesh_notify_scan_completed(struct ieee80211_local *local)
@@ -673,7 +721,7 @@ void ieee80211_mesh_init_sdata(struct ieee80211_sub_if_data *sdata)
                 MESH_MIN_DISCOVERY_TIMEOUT;
         ifmsh->accepting_plinks = true;
         ifmsh->preq_id = 0;
-        ifmsh->dsn = 0;
+        ifmsh->sn = 0;
         atomic_set(&ifmsh->mpaths, 0);
         mesh_rmc_init(sdata);
         ifmsh->last_preq = jiffies;
@@ -684,6 +732,9 @@ void ieee80211_mesh_init_sdata(struct ieee80211_sub_if_data *sdata)
         setup_timer(&ifmsh->mesh_path_timer,
                     ieee80211_mesh_path_timer,
                     (unsigned long) sdata);
+        setup_timer(&ifmsh->mesh_path_root_timer,
+                    ieee80211_mesh_path_root_timer,
+                    (unsigned long) sdata);
         INIT_LIST_HEAD(&ifmsh->preq_queue.list);
         spin_lock_init(&ifmsh->mesh_preq_queue_lock);
 }
diff --git a/net/mac80211/mesh.h b/net/mac80211/mesh.h
index dd1c19319f0a..bd0e1cbb9a1e 100644
--- a/net/mac80211/mesh.h
+++ b/net/mac80211/mesh.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2008 open80211s Ltd.
+ * Copyright (c) 2008, 2009 open80211s Ltd.
  * Authors:    Luis Carlos Cobo <luisca@cozybit.com>
  *             Javier Cardona <javier@cozybit.com>
  *
@@ -26,7 +26,7 @@
  *
  * @MESH_PATH_ACTIVE: the mesh path can be used for forwarding
  * @MESH_PATH_RESOLVING: the discovery process is running for this mesh path
- * @MESH_PATH_DSN_VALID: the mesh path contains a valid destination sequence
+ * @MESH_PATH_SN_VALID: the mesh path contains a valid destination sequence
  *      number
  * @MESH_PATH_FIXED: the mesh path has been manually set and should not be
  *      modified
@@ -38,7 +38,7 @@
 enum mesh_path_flags {
         MESH_PATH_ACTIVE =      BIT(0),
         MESH_PATH_RESOLVING =   BIT(1),
-        MESH_PATH_DSN_VALID =   BIT(2),
+        MESH_PATH_SN_VALID =    BIT(2),
         MESH_PATH_FIXED =       BIT(3),
         MESH_PATH_RESOLVED =    BIT(4),
 };
@@ -53,11 +53,13 @@ enum mesh_path_flags {
  * to grow.
  * @MESH_WORK_GROW_MPP_TABLE: the mesh portals table is full and needs to
  * grow
+ * @MESH_WORK_ROOT: the mesh root station needs to send a frame
  */
 enum mesh_deferred_task_flags {
         MESH_WORK_HOUSEKEEPING,
         MESH_WORK_GROW_MPATH_TABLE,
         MESH_WORK_GROW_MPP_TABLE,
+        MESH_WORK_ROOT,
 };
 
 /**
@@ -70,7 +72,7 @@ enum mesh_deferred_task_flags {
  * @timer: mesh path discovery timer
  * @frame_queue: pending queue for frames sent to this destination while the
  *      path is unresolved
- * @dsn: destination sequence number of the destination
+ * @sn: target sequence number
  * @metric: current metric to this destination
  * @hop_count: hops to destination
  * @exp_time: in jiffies, when the path will expire or when it expired
@@ -94,7 +96,7 @@ struct mesh_path {
         struct timer_list timer;
         struct sk_buff_head frame_queue;
         struct rcu_head rcu;
-        u32 dsn;
+        u32 sn;
         u32 metric;
         u8 hop_count;
         unsigned long exp_time;
@@ -174,7 +176,7 @@ struct mesh_rmc {
 #define MESH_CFG_CMP_LEN        (IEEE80211_MESH_CONFIG_LEN - 2)
 
 /* Default values, timeouts in ms */
-#define MESH_TTL                5
+#define MESH_TTL                31
 #define MESH_MAX_RETR           3
 #define MESH_RET_T              100
 #define MESH_CONF_T             100
@@ -206,8 +208,14 @@ struct mesh_rmc {
 #define MESH_MAX_MPATHS         1024
 
 /* Pending ANA approval */
-#define PLINK_CATEGORY          30
+#define MESH_PLINK_CATEGORY     30
 #define MESH_PATH_SEL_CATEGORY  32
+#define MESH_PATH_SEL_ACTION    0
+
+/* PERR reason codes */
+#define PEER_RCODE_UNSPECIFIED  11
+#define PERR_RCODE_NO_ROUTE     12
+#define PERR_RCODE_DEST_UNREACH 13
 
 /* Public interfaces */
 /* Various */
@@ -234,6 +242,7 @@ ieee80211_rx_result
 ieee80211_mesh_rx_mgmt(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb);
 void ieee80211_start_mesh(struct ieee80211_sub_if_data *sdata);
 void ieee80211_stop_mesh(struct ieee80211_sub_if_data *sdata);
+void ieee80211_mesh_root_setup(struct ieee80211_if_mesh *ifmsh);
 
 /* Mesh paths */
 int mesh_nexthop_lookup(struct sk_buff *skb,
@@ -274,8 +283,8 @@ void mesh_mpp_table_grow(void);
 u32 mesh_table_hash(u8 *addr, struct ieee80211_sub_if_data *sdata,
                 struct mesh_table *tbl);
 /* Mesh paths */
-int mesh_path_error_tx(u8 *dest, __le32 dest_dsn, u8 *ra,
-                struct ieee80211_sub_if_data *sdata);
+int mesh_path_error_tx(u8 ttl, u8 *target, __le32 target_sn, __le16 target_rcode,
+                u8 *ra, struct ieee80211_sub_if_data *sdata);
 void mesh_path_assign_nexthop(struct mesh_path *mpath, struct sta_info *sta);
 void mesh_path_flush_pending(struct mesh_path *mpath);
 void mesh_path_tx_pending(struct mesh_path *mpath);
@@ -288,6 +297,7 @@ void mesh_path_discard_frame(struct sk_buff *skb,
                 struct ieee80211_sub_if_data *sdata);
 void mesh_path_quiesce(struct ieee80211_sub_if_data *sdata);
 void mesh_path_restart(struct ieee80211_sub_if_data *sdata);
+void mesh_path_tx_root_frame(struct ieee80211_sub_if_data *sdata);
 
 extern int mesh_paths_generation;
 
diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
index 29b82e98effa..5c67e7b8790f 100644
--- a/net/mac80211/mesh_hwmp.c
+++ b/net/mac80211/mesh_hwmp.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2008 open80211s Ltd.
+ * Copyright (c) 2008, 2009 open80211s Ltd.
  * Author:     Luis Carlos Cobo <luisca@cozybit.com>
  *
  * This program is free software; you can redistribute it and/or modify
@@ -9,6 +9,12 @@
 
 #include "mesh.h"
 
+#ifdef CONFIG_MAC80211_VERBOSE_MHWMP_DEBUG
+#define mhwmp_dbg(fmt, args...)   printk(KERN_DEBUG "Mesh HWMP: " fmt, ##args)
+#else
+#define mhwmp_dbg(fmt, args...)   do { (void)(0); } while (0)
+#endif
+
 #define TEST_FRAME_LEN  8192
 #define MAX_METRIC      0xffffffff
 #define ARITH_SHIFT     8
@@ -21,6 +27,12 @@
 #define MP_F_DO 0x1
 /* Reply and forward */
 #define MP_F_RF 0x2
+/* Unknown Sequence Number */
+#define MP_F_USN    0x01
+/* Reason code Present */
+#define MP_F_RCODE  0x02
+
+static void mesh_queue_preq(struct mesh_path *, u8);
 
 static inline u32 u32_field_get(u8 *preq_elem, int offset, bool ae)
 {
@@ -29,6 +41,13 @@ static inline u32 u32_field_get(u8 *preq_elem, int offset, bool ae)
         return get_unaligned_le32(preq_elem + offset);
 }
 
+static inline u32 u16_field_get(u8 *preq_elem, int offset, bool ae)
+{
+        if (ae)
+                offset += 6;
+        return get_unaligned_le16(preq_elem + offset);
+}
+
 /* HWMP IE processing macros */
 #define AE_F                    (1<<6)
 #define AE_F_SET(x)             (*x & AE_F)
@@ -37,30 +56,33 @@ static inline u32 u32_field_get(u8 *preq_elem, int offset, bool ae)
 #define PREQ_IE_TTL(x)          (*(x + 2))
 #define PREQ_IE_PREQ_ID(x)      u32_field_get(x, 3, 0)
 #define PREQ_IE_ORIG_ADDR(x)    (x + 7)
-#define PREQ_IE_ORIG_DSN(x)     u32_field_get(x, 13, 0);
+#define PREQ_IE_ORIG_SN(x)      u32_field_get(x, 13, 0);
 #define PREQ_IE_LIFETIME(x)     u32_field_get(x, 17, AE_F_SET(x));
 #define PREQ_IE_METRIC(x)       u32_field_get(x, 21, AE_F_SET(x));
-#define PREQ_IE_DST_F(x)        (*(AE_F_SET(x) ? x + 32 : x + 26))
-#define PREQ_IE_DST_ADDR(x)     (AE_F_SET(x) ? x + 33 : x + 27)
-#define PREQ_IE_DST_DSN(x)      u32_field_get(x, 33, AE_F_SET(x));
+#define PREQ_IE_TARGET_F(x)     (*(AE_F_SET(x) ? x + 32 : x + 26))
+#define PREQ_IE_TARGET_ADDR(x)  (AE_F_SET(x) ? x + 33 : x + 27)
+#define PREQ_IE_TARGET_SN(x)    u32_field_get(x, 33, AE_F_SET(x));
 
 
 #define PREP_IE_FLAGS(x)        PREQ_IE_FLAGS(x)
 #define PREP_IE_HOPCOUNT(x)     PREQ_IE_HOPCOUNT(x)
 #define PREP_IE_TTL(x)          PREQ_IE_TTL(x)
 #define PREP_IE_ORIG_ADDR(x)    (x + 3)
-#define PREP_IE_ORIG_DSN(x)     u32_field_get(x, 9, 0);
+#define PREP_IE_ORIG_SN(x)      u32_field_get(x, 9, 0);
 #define PREP_IE_LIFETIME(x)     u32_field_get(x, 13, AE_F_SET(x));
 #define PREP_IE_METRIC(x)       u32_field_get(x, 17, AE_F_SET(x));
-#define PREP_IE_DST_ADDR(x)     (AE_F_SET(x) ? x + 27 : x + 21)
-#define PREP_IE_DST_DSN(x)      u32_field_get(x, 27, AE_F_SET(x));
+#define PREP_IE_TARGET_ADDR(x)  (AE_F_SET(x) ? x + 27 : x + 21)
+#define PREP_IE_TARGET_SN(x)    u32_field_get(x, 27, AE_F_SET(x));
 
-#define PERR_IE_DST_ADDR(x)     (x + 2)
-#define PERR_IE_DST_DSN(x)      u32_field_get(x, 8, 0);
+#define PERR_IE_TTL(x)          (*(x))
+#define PERR_IE_TARGET_FLAGS(x) (*(x + 2))
+#define PERR_IE_TARGET_ADDR(x)  (x + 3)
+#define PERR_IE_TARGET_SN(x)    u32_field_get(x, 9, 0);
+#define PERR_IE_TARGET_RCODE(x) u16_field_get(x, 13, 0);
 
 #define MSEC_TO_TU(x) (x*1000/1024)
-#define DSN_GT(x, y) ((long) (y) - (long) (x) < 0)
-#define DSN_LT(x, y) ((long) (x) - (long) (y) < 0)
+#define SN_GT(x, y) ((long) (y) - (long) (x) < 0)
+#define SN_LT(x, y) ((long) (x) - (long) (y) < 0)
 
 #define net_traversal_jiffies(s) \
         msecs_to_jiffies(s->u.mesh.mshcfg.dot11MeshHWMPnetDiameterTraversalTime)
@@ -75,13 +97,15 @@ static inline u32 u32_field_get(u8 *preq_elem, int offset, bool ae)
 enum mpath_frame_type {
         MPATH_PREQ = 0,
         MPATH_PREP,
-        MPATH_PERR
+        MPATH_PERR,
+        MPATH_RANN
 };
 
 static int mesh_path_sel_frame_tx(enum mpath_frame_type action, u8 flags,
-                u8 *orig_addr, __le32 orig_dsn, u8 dst_flags, u8 *dst,
-                __le32 dst_dsn, u8 *da, u8 hop_count, u8 ttl, __le32 lifetime,
-                __le32 metric, __le32 preq_id, struct ieee80211_sub_if_data *sdata)
+                u8 *orig_addr, __le32 orig_sn, u8 target_flags, u8 *target,
+                __le32 target_sn, u8 *da, u8 hop_count, u8 ttl,__le32 lifetime,
+                __le32 metric, __le32 preq_id,
+                struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_local *local = sdata->local;
         struct sk_buff *skb = dev_alloc_skb(local->hw.extra_tx_headroom + 400);
@@ -103,21 +127,30 @@ static int mesh_path_sel_frame_tx(enum mpath_frame_type action, u8 flags,
 
         memcpy(mgmt->da, da, ETH_ALEN);
         memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
-        /* BSSID is left zeroed, wildcard value */
+        /* BSSID == SA */
+        memcpy(mgmt->bssid, sdata->dev->dev_addr, ETH_ALEN);
         mgmt->u.action.category = MESH_PATH_SEL_CATEGORY;
-        mgmt->u.action.u.mesh_action.action_code = action;
+        mgmt->u.action.u.mesh_action.action_code = MESH_PATH_SEL_ACTION;
 
         switch (action) {
         case MPATH_PREQ:
+                mhwmp_dbg("sending PREQ to %pM\n", target);
                 ie_len = 37;
                 pos = skb_put(skb, 2 + ie_len);
                 *pos++ = WLAN_EID_PREQ;
                 break;
         case MPATH_PREP:
+                mhwmp_dbg("sending PREP to %pM\n", target);
                 ie_len = 31;
                 pos = skb_put(skb, 2 + ie_len);
                 *pos++ = WLAN_EID_PREP;
                 break;
+        case MPATH_RANN:
+                mhwmp_dbg("sending RANN from %pM\n", orig_addr);
+                ie_len = sizeof(struct ieee80211_rann_ie);
+                pos = skb_put(skb, 2 + ie_len);
+                *pos++ = WLAN_EID_RANN;
+                break;
         default:
                 kfree_skb(skb);
                 return -ENOTSUPP;
@@ -133,20 +166,24 @@ static int mesh_path_sel_frame_tx(enum mpath_frame_type action, u8 flags,
         }
         memcpy(pos, orig_addr, ETH_ALEN);
         pos += ETH_ALEN;
-        memcpy(pos, &orig_dsn, 4);
-        pos += 4;
-        memcpy(pos, &lifetime, 4);
+        memcpy(pos, &orig_sn, 4);
         pos += 4;
+        if (action != MPATH_RANN) {
+                memcpy(pos, &lifetime, 4);
+                pos += 4;
+        }
         memcpy(pos, &metric, 4);
         pos += 4;
         if (action == MPATH_PREQ) {
                 /* destination count */
                 *pos++ = 1;
-                *pos++ = dst_flags;
+                *pos++ = target_flags;
+        }
+        if (action != MPATH_RANN) {
+                memcpy(pos, target, ETH_ALEN);
+                pos += ETH_ALEN;
+                memcpy(pos, &target_sn, 4);
         }
-        memcpy(pos, dst, ETH_ALEN);
-        pos += ETH_ALEN;
-        memcpy(pos, &dst_dsn, 4);
 
         ieee80211_tx_skb(sdata, skb, 1);
         return 0;
@@ -155,11 +192,13 @@ static int mesh_path_sel_frame_tx(enum mpath_frame_type action, u8 flags,
 /**
  * mesh_send_path error - Sends a PERR mesh management frame
  *
- * @dst: broken destination
- * @dst_dsn: dsn of the broken destination
+ * @target: broken destination
+ * @target_sn: SN of the broken destination
+ * @target_rcode: reason code for this PERR
  * @ra: node this frame is addressed to
  */
-int mesh_path_error_tx(u8 *dst, __le32 dst_dsn, u8 *ra,
+int mesh_path_error_tx(u8 ttl, u8 *target, __le32 target_sn,
+                __le16 target_rcode, u8 *ra,
                 struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_local *local = sdata->local;
@@ -184,18 +223,30 @@ int mesh_path_error_tx(u8 *dst, __le32 dst_dsn, u8 *ra,
         memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
         /* BSSID is left zeroed, wildcard value */
         mgmt->u.action.category = MESH_PATH_SEL_CATEGORY;
-        mgmt->u.action.u.mesh_action.action_code = MPATH_PERR;
-        ie_len = 12;
+        mgmt->u.action.u.mesh_action.action_code = MESH_PATH_SEL_ACTION;
+        ie_len = 15;
         pos = skb_put(skb, 2 + ie_len);
         *pos++ = WLAN_EID_PERR;
         *pos++ = ie_len;
-        /* mode flags, reserved */
-        *pos++ = 0;
+        /* ttl */
+        *pos++ = MESH_TTL;
         /* number of destinations */
         *pos++ = 1;
-        memcpy(pos, dst, ETH_ALEN);
+        /*
+         * flags bit, bit 1 is unset if we know the sequence number and
+         * bit 2 is set if we have a reason code
+         */
+        *pos = 0;
+        if (!target_sn)
+                *pos |= MP_F_USN;
+        if (target_rcode)
+                *pos |= MP_F_RCODE;
+        pos++;
+        memcpy(pos, target, ETH_ALEN);
         pos += ETH_ALEN;
-        memcpy(pos, &dst_dsn, 4);
+        memcpy(pos, &target_sn, 4);
+        pos += 4;
+        memcpy(pos, &target_rcode, 2);
 
         ieee80211_tx_skb(sdata, skb, 1);
         return 0;
@@ -269,18 +320,17 @@ static u32 airtime_link_metric_get(struct ieee80211_local *local,
  */
 static u32 hwmp_route_info_get(struct ieee80211_sub_if_data *sdata,
                             struct ieee80211_mgmt *mgmt,
-                            u8 *hwmp_ie)
+                            u8 *hwmp_ie, enum mpath_frame_type action)
 {
         struct ieee80211_local *local = sdata->local;
         struct mesh_path *mpath;
         struct sta_info *sta;
         bool fresh_info;
         u8 *orig_addr, *ta;
-        u32 orig_dsn, orig_metric;
+        u32 orig_sn, orig_metric;
         unsigned long orig_lifetime, exp_time;
         u32 last_hop_metric, new_metric;
         bool process = true;
-        u8 action = mgmt->u.action.u.mesh_action.action_code;
 
         rcu_read_lock();
         sta = sta_info_get(local, mgmt->sa);
@@ -296,7 +346,7 @@ static u32 hwmp_route_info_get(struct ieee80211_sub_if_data *sdata,
         switch (action) {
         case MPATH_PREQ:
                 orig_addr = PREQ_IE_ORIG_ADDR(hwmp_ie);
-                orig_dsn = PREQ_IE_ORIG_DSN(hwmp_ie);
+                orig_sn = PREQ_IE_ORIG_SN(hwmp_ie);
                 orig_lifetime = PREQ_IE_LIFETIME(hwmp_ie);
                 orig_metric = PREQ_IE_METRIC(hwmp_ie);
                 break;
@@ -309,7 +359,7 @@ static u32 hwmp_route_info_get(struct ieee80211_sub_if_data *sdata,
                  * information from both PREQ and PREP frames.
                  */
                 orig_addr = PREP_IE_ORIG_ADDR(hwmp_ie);
-                orig_dsn = PREP_IE_ORIG_DSN(hwmp_ie);
+                orig_sn = PREP_IE_ORIG_SN(hwmp_ie);
                 orig_lifetime = PREP_IE_LIFETIME(hwmp_ie);
                 orig_metric = PREP_IE_METRIC(hwmp_ie);
                 break;
@@ -335,9 +385,9 @@ static u32 hwmp_route_info_get(struct ieee80211_sub_if_data *sdata,
                         if (mpath->flags & MESH_PATH_FIXED)
                                 fresh_info = false;
                         else if ((mpath->flags & MESH_PATH_ACTIVE) &&
-                            (mpath->flags & MESH_PATH_DSN_VALID)) {
-                                if (DSN_GT(mpath->dsn, orig_dsn) ||
-                                    (mpath->dsn == orig_dsn &&
+                            (mpath->flags & MESH_PATH_SN_VALID)) {
+                                if (SN_GT(mpath->sn, orig_sn) ||
+                                    (mpath->sn == orig_sn &&
                                      action == MPATH_PREQ &&
                                      new_metric > mpath->metric)) {
                                         process = false;
@@ -356,9 +406,9 @@ static u32 hwmp_route_info_get(struct ieee80211_sub_if_data *sdata,
 
                 if (fresh_info) {
                         mesh_path_assign_nexthop(mpath, sta);
-                        mpath->flags |= MESH_PATH_DSN_VALID;
+                        mpath->flags |= MESH_PATH_SN_VALID;
                         mpath->metric = new_metric;
-                        mpath->dsn = orig_dsn;
+                        mpath->sn = orig_sn;
                         mpath->exp_time = time_after(mpath->exp_time, exp_time)
                                           ?  mpath->exp_time : exp_time;
                         mesh_path_activate(mpath);
@@ -397,7 +447,7 @@ static u32 hwmp_route_info_get(struct ieee80211_sub_if_data *sdata,
 
                 if (fresh_info) {
                         mesh_path_assign_nexthop(mpath, sta);
-                        mpath->flags &= ~MESH_PATH_DSN_VALID;
+                        mpath->flags &= ~MESH_PATH_SN_VALID;
                         mpath->metric = last_hop_metric;
                         mpath->exp_time = time_after(mpath->exp_time, exp_time)
                                           ?  mpath->exp_time : exp_time;
@@ -419,44 +469,47 @@ static void hwmp_preq_frame_process(struct ieee80211_sub_if_data *sdata,
 {
         struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
         struct mesh_path *mpath;
-        u8 *dst_addr, *orig_addr;
-        u8 dst_flags, ttl;
-        u32 orig_dsn, dst_dsn, lifetime;
+        u8 *target_addr, *orig_addr;
+        u8 target_flags, ttl;
+        u32 orig_sn, target_sn, lifetime;
         bool reply = false;
         bool forward = true;
 
-        /* Update destination DSN, if present */
-        dst_addr = PREQ_IE_DST_ADDR(preq_elem);
+        /* Update target SN, if present */
+        target_addr = PREQ_IE_TARGET_ADDR(preq_elem);
         orig_addr = PREQ_IE_ORIG_ADDR(preq_elem);
-        dst_dsn = PREQ_IE_DST_DSN(preq_elem);
-        orig_dsn = PREQ_IE_ORIG_DSN(preq_elem);
-        dst_flags = PREQ_IE_DST_F(preq_elem);
+        target_sn = PREQ_IE_TARGET_SN(preq_elem);
+        orig_sn = PREQ_IE_ORIG_SN(preq_elem);
+        target_flags = PREQ_IE_TARGET_F(preq_elem);
 
-        if (memcmp(dst_addr, sdata->dev->dev_addr, ETH_ALEN) == 0) {
+        mhwmp_dbg("received PREQ from %pM\n", orig_addr);
+
+        if (memcmp(target_addr, sdata->dev->dev_addr, ETH_ALEN) == 0) {
+                mhwmp_dbg("PREQ is for us\n");
                 forward = false;
                 reply = true;
                 metric = 0;
-                if (time_after(jiffies, ifmsh->last_dsn_update +
+                if (time_after(jiffies, ifmsh->last_sn_update +
                                         net_traversal_jiffies(sdata)) ||
-                    time_before(jiffies, ifmsh->last_dsn_update)) {
-                        dst_dsn = ++ifmsh->dsn;
-                        ifmsh->last_dsn_update = jiffies;
+                    time_before(jiffies, ifmsh->last_sn_update)) {
+                        target_sn = ++ifmsh->sn;
+                        ifmsh->last_sn_update = jiffies;
                 }
         } else {
                 rcu_read_lock();
-                mpath = mesh_path_lookup(dst_addr, sdata);
+                mpath = mesh_path_lookup(target_addr, sdata);
                 if (mpath) {
-                        if ((!(mpath->flags & MESH_PATH_DSN_VALID)) ||
-                                        DSN_LT(mpath->dsn, dst_dsn)) {
-                                mpath->dsn = dst_dsn;
-                                mpath->flags |= MESH_PATH_DSN_VALID;
-                        } else if ((!(dst_flags & MP_F_DO)) &&
+                        if ((!(mpath->flags & MESH_PATH_SN_VALID)) ||
+                                        SN_LT(mpath->sn, target_sn)) {
+                                mpath->sn = target_sn;
+                                mpath->flags |= MESH_PATH_SN_VALID;
+                        } else if ((!(target_flags & MP_F_DO)) &&
                                         (mpath->flags & MESH_PATH_ACTIVE)) {
                                 reply = true;
                                 metric = mpath->metric;
-                                dst_dsn = mpath->dsn;
-                                if (dst_flags & MP_F_RF)
-                                        dst_flags |= MP_F_DO;
+                                target_sn = mpath->sn;
+                                if (target_flags & MP_F_RF)
+                                        target_flags |= MP_F_DO;
                                 else
                                         forward = false;
                         }
@@ -467,13 +520,14 @@ static void hwmp_preq_frame_process(struct ieee80211_sub_if_data *sdata,
         if (reply) {
                 lifetime = PREQ_IE_LIFETIME(preq_elem);
                 ttl = ifmsh->mshcfg.dot11MeshTTL;
-                if (ttl != 0)
-                        mesh_path_sel_frame_tx(MPATH_PREP, 0, dst_addr,
-                                cpu_to_le32(dst_dsn), 0, orig_addr,
-                                cpu_to_le32(orig_dsn), mgmt->sa, 0, ttl,
+                if (ttl != 0) {
+                        mhwmp_dbg("replying to the PREQ\n");
+                        mesh_path_sel_frame_tx(MPATH_PREP, 0, target_addr,
+                                cpu_to_le32(target_sn), 0, orig_addr,
+                                cpu_to_le32(orig_sn), mgmt->sa, 0, ttl,
                                 cpu_to_le32(lifetime), cpu_to_le32(metric),
                                 0, sdata);
-                else
+                } else
                         ifmsh->mshstats.dropped_frames_ttl++;
         }
 
@@ -487,13 +541,14 @@ static void hwmp_preq_frame_process(struct ieee80211_sub_if_data *sdata,
                         ifmsh->mshstats.dropped_frames_ttl++;
                         return;
                 }
+                mhwmp_dbg("forwarding the PREQ from %pM\n", orig_addr);
                 --ttl;
                 flags = PREQ_IE_FLAGS(preq_elem);
                 preq_id = PREQ_IE_PREQ_ID(preq_elem);
                 hopcount = PREQ_IE_HOPCOUNT(preq_elem) + 1;
                 mesh_path_sel_frame_tx(MPATH_PREQ, flags, orig_addr,
-                                cpu_to_le32(orig_dsn), dst_flags, dst_addr,
-                                cpu_to_le32(dst_dsn), sdata->dev->broadcast,
+                                cpu_to_le32(orig_sn), target_flags, target_addr,
+                                cpu_to_le32(target_sn), sdata->dev->broadcast,
                                 hopcount, ttl, cpu_to_le32(lifetime),
                                 cpu_to_le32(metric), cpu_to_le32(preq_id),
                                 sdata);
@@ -508,10 +563,12 @@ static void hwmp_prep_frame_process(struct ieee80211_sub_if_data *sdata,
                                     u8 *prep_elem, u32 metric)
 {
         struct mesh_path *mpath;
-        u8 *dst_addr, *orig_addr;
+        u8 *target_addr, *orig_addr;
         u8 ttl, hopcount, flags;
         u8 next_hop[ETH_ALEN];
-        u32 dst_dsn, orig_dsn, lifetime;
+        u32 target_sn, orig_sn, lifetime;
+
+        mhwmp_dbg("received PREP from %pM\n", PREP_IE_ORIG_ADDR(prep_elem));
 
         /* Note that we divert from the draft nomenclature and denominate
          * destination to what the draft refers to as origininator. So in this
@@ -519,8 +576,8 @@ static void hwmp_prep_frame_process(struct ieee80211_sub_if_data *sdata,
          * which corresponds with the originator of the PREQ which this PREP
          * replies
          */
-        dst_addr = PREP_IE_DST_ADDR(prep_elem);
-        if (memcmp(dst_addr, sdata->dev->dev_addr, ETH_ALEN) == 0)
+        target_addr = PREP_IE_TARGET_ADDR(prep_elem);
+        if (memcmp(target_addr, sdata->dev->dev_addr, ETH_ALEN) == 0)
                 /* destination, no forwarding required */
                 return;
 
@@ -531,7 +588,7 @@ static void hwmp_prep_frame_process(struct ieee80211_sub_if_data *sdata,
         }
 
         rcu_read_lock();
-        mpath = mesh_path_lookup(dst_addr, sdata);
+        mpath = mesh_path_lookup(target_addr, sdata);
         if (mpath)
                 spin_lock_bh(&mpath->state_lock);
         else
@@ -547,13 +604,13 @@ static void hwmp_prep_frame_process(struct ieee80211_sub_if_data *sdata,
         lifetime = PREP_IE_LIFETIME(prep_elem);
         hopcount = PREP_IE_HOPCOUNT(prep_elem) + 1;
         orig_addr = PREP_IE_ORIG_ADDR(prep_elem);
-        dst_dsn = PREP_IE_DST_DSN(prep_elem);
-        orig_dsn = PREP_IE_ORIG_DSN(prep_elem);
+        target_sn = PREP_IE_TARGET_SN(prep_elem);
+        orig_sn = PREP_IE_ORIG_SN(prep_elem);
 
         mesh_path_sel_frame_tx(MPATH_PREP, flags, orig_addr,
-                cpu_to_le32(orig_dsn), 0, dst_addr,
-                cpu_to_le32(dst_dsn), mpath->next_hop->sta.addr, hopcount, ttl,
-                cpu_to_le32(lifetime), cpu_to_le32(metric),
+                cpu_to_le32(orig_sn), 0, target_addr,
+                cpu_to_le32(target_sn), mpath->next_hop->sta.addr, hopcount,
+                ttl, cpu_to_le32(lifetime), cpu_to_le32(metric),
                 0, sdata);
         rcu_read_unlock();
 
@@ -570,25 +627,39 @@ fail:
 static void hwmp_perr_frame_process(struct ieee80211_sub_if_data *sdata,
                              struct ieee80211_mgmt *mgmt, u8 *perr_elem)
 {
+        struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
         struct mesh_path *mpath;
-        u8 *ta, *dst_addr;
-        u32 dst_dsn;
+        u8 ttl;
+        u8 *ta, *target_addr;
+        u8 target_flags;
+        u32 target_sn;
+        u16 target_rcode;
 
         ta = mgmt->sa;
-        dst_addr = PERR_IE_DST_ADDR(perr_elem);
-        dst_dsn = PERR_IE_DST_DSN(perr_elem);
+        ttl = PERR_IE_TTL(perr_elem);
+        if (ttl <= 1) {
+                ifmsh->mshstats.dropped_frames_ttl++;
+                return;
+        }
+        ttl--;
+        target_flags = PERR_IE_TARGET_FLAGS(perr_elem);
+        target_addr = PERR_IE_TARGET_ADDR(perr_elem);
+        target_sn = PERR_IE_TARGET_SN(perr_elem);
+        target_rcode = PERR_IE_TARGET_RCODE(perr_elem);
+
         rcu_read_lock();
-        mpath = mesh_path_lookup(dst_addr, sdata);
+        mpath = mesh_path_lookup(target_addr, sdata);
         if (mpath) {
                 spin_lock_bh(&mpath->state_lock);
                 if (mpath->flags & MESH_PATH_ACTIVE &&
                     memcmp(ta, mpath->next_hop->sta.addr, ETH_ALEN) == 0 &&
-                    (!(mpath->flags & MESH_PATH_DSN_VALID) ||
-                    DSN_GT(dst_dsn, mpath->dsn))) {
+                    (!(mpath->flags & MESH_PATH_SN_VALID) ||
+                    SN_GT(target_sn, mpath->sn))) {
                         mpath->flags &= ~MESH_PATH_ACTIVE;
-                        mpath->dsn = dst_dsn;
+                        mpath->sn = target_sn;
                         spin_unlock_bh(&mpath->state_lock);
-                        mesh_path_error_tx(dst_addr, cpu_to_le32(dst_dsn),
+                        mesh_path_error_tx(ttl, target_addr, cpu_to_le32(target_sn),
+                                           cpu_to_le16(target_rcode),
                                            sdata->dev->broadcast, sdata);
                 } else
                         spin_unlock_bh(&mpath->state_lock);
@@ -596,6 +667,56 @@ static void hwmp_perr_frame_process(struct ieee80211_sub_if_data *sdata,
         rcu_read_unlock();
 }
 
+static void hwmp_rann_frame_process(struct ieee80211_sub_if_data *sdata,
+                                struct ieee80211_mgmt *mgmt,
+                                struct ieee80211_rann_ie *rann)
+{
+        struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
+        struct mesh_path *mpath;
+        u8 *ta;
+        u8 ttl, flags, hopcount;
+        u8 *orig_addr;
+        u32 orig_sn, metric;
+
+        ta = mgmt->sa;
+        ttl = rann->rann_ttl;
+        if (ttl <= 1) {
+                ifmsh->mshstats.dropped_frames_ttl++;
+                return;
+        }
+        ttl--;
+        flags = rann->rann_flags;
+        orig_addr = rann->rann_addr;
+        orig_sn = rann->rann_seq;
+        hopcount = rann->rann_hopcount;
+        hopcount++;
+        metric = rann->rann_metric;
+        mhwmp_dbg("received RANN from %pM\n", orig_addr);
+
+        rcu_read_lock();
+        mpath = mesh_path_lookup(orig_addr, sdata);
+        if (!mpath) {
+                mesh_path_add(orig_addr, sdata);
+                mpath = mesh_path_lookup(orig_addr, sdata);
+                if (!mpath) {
+                        rcu_read_unlock();
+                        sdata->u.mesh.mshstats.dropped_frames_no_route++;
+                        return;
+                }
+                mesh_queue_preq(mpath,
+                                PREQ_Q_F_START | PREQ_Q_F_REFRESH);
+        }
+        if (mpath->sn < orig_sn) {
+                mesh_path_sel_frame_tx(MPATH_RANN, flags, orig_addr,
+                                       cpu_to_le32(orig_sn),
+                                       0, NULL, 0, sdata->dev->broadcast,
+                                       hopcount, ttl, 0,
+                                       cpu_to_le32(metric + mpath->metric),
+                                       0, sdata);
+                mpath->sn = orig_sn;
+        }
+        rcu_read_unlock();
+}
 
 
 void mesh_rx_path_sel_frame(struct ieee80211_sub_if_data *sdata,
@@ -614,34 +735,34 @@ void mesh_rx_path_sel_frame(struct ieee80211_sub_if_data *sdata,
         ieee802_11_parse_elems(mgmt->u.action.u.mesh_action.variable,
                         len - baselen, &elems);
 
-        switch (mgmt->u.action.u.mesh_action.action_code) {
-        case MPATH_PREQ:
-                if (!elems.preq || elems.preq_len != 37)
+        if (elems.preq) {
+                if (elems.preq_len != 37)
                         /* Right now we support just 1 destination and no AE */
                         return;
-                last_hop_metric = hwmp_route_info_get(sdata, mgmt, elems.preq);
-                if (!last_hop_metric)
-                        return;
-                hwmp_preq_frame_process(sdata, mgmt, elems.preq, last_hop_metric);
-                break;
-        case MPATH_PREP:
-                if (!elems.prep || elems.prep_len != 31)
+                last_hop_metric = hwmp_route_info_get(sdata, mgmt, elems.preq,
+                                                      MPATH_PREQ);
+                if (last_hop_metric)
+                        hwmp_preq_frame_process(sdata, mgmt, elems.preq,
+                                                last_hop_metric);
+        }
+        if (elems.prep) {
+                if (elems.prep_len != 31)
                         /* Right now we support no AE */
                         return;
-                last_hop_metric = hwmp_route_info_get(sdata, mgmt, elems.prep);
-                if (!last_hop_metric)
-                        return;
-                hwmp_prep_frame_process(sdata, mgmt, elems.prep, last_hop_metric);
-                break;
-        case MPATH_PERR:
-                if (!elems.perr || elems.perr_len != 12)
+                last_hop_metric = hwmp_route_info_get(sdata, mgmt, elems.prep,
+                                                      MPATH_PREP);
+                if (last_hop_metric)
+                        hwmp_prep_frame_process(sdata, mgmt, elems.prep,
+                                                last_hop_metric);
+        }
+        if (elems.perr) {
+                if (elems.perr_len != 15)
                         /* Right now we support only one destination per PERR */
                         return;
                 hwmp_perr_frame_process(sdata, mgmt, elems.perr);
-        default:
-                return;
         }
-
+        if (elems.rann)
+                hwmp_rann_frame_process(sdata, mgmt, elems.rann);
 }
 
 /**
@@ -661,7 +782,7 @@ static void mesh_queue_preq(struct mesh_path *mpath, u8 flags)
 
         preq_node = kmalloc(sizeof(struct mesh_preq_queue), GFP_ATOMIC);
         if (!preq_node) {
-                printk(KERN_DEBUG "Mesh HWMP: could not allocate PREQ node\n");
+                mhwmp_dbg("could not allocate PREQ node\n");
                 return;
         }
 
@@ -670,7 +791,7 @@ static void mesh_queue_preq(struct mesh_path *mpath, u8 flags)
                 spin_unlock(&ifmsh->mesh_preq_queue_lock);
                 kfree(preq_node);
                 if (printk_ratelimit())
-                        printk(KERN_DEBUG "Mesh HWMP: PREQ node queue full\n");
+                        mhwmp_dbg("PREQ node queue full\n");
                 return;
         }
 
@@ -705,7 +826,7 @@ void mesh_path_start_discovery(struct ieee80211_sub_if_data *sdata)
         struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
         struct mesh_preq_queue *preq_node;
         struct mesh_path *mpath;
-        u8 ttl, dst_flags;
+        u8 ttl, target_flags;
         u32 lifetime;
 
         spin_lock_bh(&ifmsh->mesh_preq_queue_lock);
@@ -747,11 +868,11 @@ void mesh_path_start_discovery(struct ieee80211_sub_if_data *sdata)
 
         ifmsh->last_preq = jiffies;
 
-        if (time_after(jiffies, ifmsh->last_dsn_update +
+        if (time_after(jiffies, ifmsh->last_sn_update +
                                 net_traversal_jiffies(sdata)) ||
-            time_before(jiffies, ifmsh->last_dsn_update)) {
-                ++ifmsh->dsn;
-                sdata->u.mesh.last_dsn_update = jiffies;
+            time_before(jiffies, ifmsh->last_sn_update)) {
+                ++ifmsh->sn;
+                sdata->u.mesh.last_sn_update = jiffies;
         }
         lifetime = default_lifetime(sdata);
         ttl = sdata->u.mesh.mshcfg.dot11MeshTTL;
@@ -762,14 +883,14 @@ void mesh_path_start_discovery(struct ieee80211_sub_if_data *sdata)
         }
 
         if (preq_node->flags & PREQ_Q_F_REFRESH)
-                dst_flags = MP_F_DO;
+                target_flags = MP_F_DO;
         else
-                dst_flags = MP_F_RF;
+                target_flags = MP_F_RF;
 
         spin_unlock_bh(&mpath->state_lock);
         mesh_path_sel_frame_tx(MPATH_PREQ, 0, sdata->dev->dev_addr,
-                        cpu_to_le32(ifmsh->dsn), dst_flags, mpath->dst,
-                        cpu_to_le32(mpath->dsn), sdata->dev->broadcast, 0,
+                        cpu_to_le32(ifmsh->sn), target_flags, mpath->dst,
+                        cpu_to_le32(mpath->sn), sdata->dev->broadcast, 0,
                         ttl, cpu_to_le32(lifetime), 0,
                         cpu_to_le32(ifmsh->preq_id++), sdata);
         mod_timer(&mpath->timer, jiffies + mpath->discovery_timeout);
@@ -796,15 +917,15 @@ int mesh_nexthop_lookup(struct sk_buff *skb,
         struct sk_buff *skb_to_free = NULL;
         struct mesh_path *mpath;
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
-        u8 *dst_addr = hdr->addr3;
+        u8 *target_addr = hdr->addr3;
         int err = 0;
 
         rcu_read_lock();
-        mpath = mesh_path_lookup(dst_addr, sdata);
+        mpath = mesh_path_lookup(target_addr, sdata);
 
         if (!mpath) {
-                mesh_path_add(dst_addr, sdata);
-                mpath = mesh_path_lookup(dst_addr, sdata);
+                mesh_path_add(target_addr, sdata);
+                mpath = mesh_path_lookup(target_addr, sdata);
                 if (!mpath) {
                         sdata->u.mesh.mshstats.dropped_frames_no_route++;
                         err = -ENOSPC;
@@ -882,3 +1003,14 @@ void mesh_path_timer(unsigned long data)
 endmpathtimer:
         rcu_read_unlock();
 }
+
+void
+mesh_path_tx_root_frame(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
+
+        mesh_path_sel_frame_tx(MPATH_RANN, 0, sdata->dev->dev_addr,
+                               cpu_to_le32(++ifmsh->sn),
+                               0, NULL, 0, sdata->dev->broadcast,
+                               0, MESH_TTL, 0, 0, 0, sdata);
+}
diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c
index 751c4d0e2b36..5399e7a9ec6e 100644
--- a/net/mac80211/mesh_pathtbl.c
+++ b/net/mac80211/mesh_pathtbl.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2008 open80211s Ltd.
+ * Copyright (c) 2008, 2009 open80211s Ltd.
  * Author:     Luis Carlos Cobo <luisca@cozybit.com>
  *
  * This program is free software; you can redistribute it and/or modify
@@ -463,10 +463,11 @@ void mesh_plink_broken(struct sta_info *sta)
                     mpath->flags & MESH_PATH_ACTIVE &&
                     !(mpath->flags & MESH_PATH_FIXED)) {
                         mpath->flags &= ~MESH_PATH_ACTIVE;
-                        ++mpath->dsn;
+                        ++mpath->sn;
                         spin_unlock_bh(&mpath->state_lock);
-                        mesh_path_error_tx(mpath->dst,
-                                        cpu_to_le32(mpath->dsn),
+                        mesh_path_error_tx(MESH_TTL, mpath->dst,
+                                        cpu_to_le32(mpath->sn),
+                                        PERR_RCODE_DEST_UNREACH,
                                         sdata->dev->broadcast, sdata);
                 } else
                 spin_unlock_bh(&mpath->state_lock);
@@ -601,7 +602,7 @@ void mesh_path_discard_frame(struct sk_buff *skb,
 {
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
         struct mesh_path *mpath;
-        u32 dsn = 0;
+        u32 sn = 0;
 
         if (memcmp(hdr->addr4, sdata->dev->dev_addr, ETH_ALEN) != 0) {
                 u8 *ra, *da;
@@ -610,8 +611,9 @@ void mesh_path_discard_frame(struct sk_buff *skb,
                 ra = hdr->addr1;
                 mpath = mesh_path_lookup(da, sdata);
                 if (mpath)
-                        dsn = ++mpath->dsn;
-                mesh_path_error_tx(skb->data, cpu_to_le32(dsn), ra, sdata);
+                        sn = ++mpath->sn;
+                mesh_path_error_tx(MESH_TTL, skb->data, cpu_to_le32(sn),
+                                   PERR_RCODE_NO_ROUTE, ra, sdata);
         }
 
         kfree_skb(skb);
@@ -646,7 +648,7 @@ void mesh_path_fix_nexthop(struct mesh_path *mpath, struct sta_info *next_hop)
 {
         spin_lock_bh(&mpath->state_lock);
         mesh_path_assign_nexthop(mpath, next_hop);
-        mpath->dsn = 0xffff;
+        mpath->sn = 0xffff;
         mpath->metric = 0;
         mpath->hop_count = 0;
         mpath->exp_time = 0;
diff --git a/net/mac80211/mesh_plink.c b/net/mac80211/mesh_plink.c
index ffcbad75e09b..f21329afdae3 100644
--- a/net/mac80211/mesh_plink.c
+++ b/net/mac80211/mesh_plink.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2008 open80211s Ltd.
+ * Copyright (c) 2008, 2009 open80211s Ltd.
  * Author:     Luis Carlos Cobo <luisca@cozybit.com>
  *
  * This program is free software; you can redistribute it and/or modify
@@ -18,9 +18,8 @@
 #define mpl_dbg(fmt, args...)   do { (void)(0); } while (0)
 #endif
 
-#define PLINK_GET_FRAME_SUBTYPE(p) (p)
-#define PLINK_GET_LLID(p) (p + 1)
-#define PLINK_GET_PLID(p) (p + 3)
+#define PLINK_GET_LLID(p) (p + 4)
+#define PLINK_GET_PLID(p) (p + 6)
 
 #define mod_plink_timer(s, t) (mod_timer(&s->plink_timer, \
                                 jiffies + HZ * t / 1000))
@@ -65,6 +64,7 @@ void mesh_plink_inc_estab_count(struct ieee80211_sub_if_data *sdata)
 {
         atomic_inc(&sdata->u.mesh.mshstats.estab_plinks);
         mesh_accept_plinks_update(sdata);
+        ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON);
 }
 
 static inline
@@ -72,12 +72,13 @@ void mesh_plink_dec_estab_count(struct ieee80211_sub_if_data *sdata)
 {
         atomic_dec(&sdata->u.mesh.mshstats.estab_plinks);
         mesh_accept_plinks_update(sdata);
+        ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON);
 }
 
 /**
  * mesh_plink_fsm_restart - restart a mesh peer link finite state machine
  *
- * @sta: mes peer link to restart
+ * @sta: mesh peer link to restart
  *
  * Locking: this function must be called holding sta->lock
  */
@@ -152,6 +153,7 @@ static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata,
         struct sk_buff *skb = dev_alloc_skb(local->hw.extra_tx_headroom + 400);
         struct ieee80211_mgmt *mgmt;
         bool include_plid = false;
+        static const u8 meshpeeringproto[] = { 0x00, 0x0F, 0xAC, 0x2A };
         u8 *pos;
         int ie_len;
 
@@ -169,7 +171,7 @@ static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata,
         memcpy(mgmt->da, da, ETH_ALEN);
         memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
         /* BSSID is left zeroed, wildcard value */
-        mgmt->u.action.category = PLINK_CATEGORY;
+        mgmt->u.action.category = MESH_PLINK_CATEGORY;
         mgmt->u.action.u.plink_action.action_code = action;
 
         if (action == PLINK_CLOSE)
@@ -179,7 +181,8 @@ static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata,
                 if (action == PLINK_CONFIRM) {
                         pos = skb_put(skb, 4);
                         /* two-byte status code followed by two-byte AID */
-                        memset(pos, 0, 4);
+                        memset(pos, 0, 2);
+                        memcpy(pos + 2, &plid, 2);
                 }
                 mesh_mgmt_ies_add(skb, sdata);
         }
@@ -187,18 +190,18 @@ static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata,
         /* Add Peer Link Management element */
         switch (action) {
         case PLINK_OPEN:
-                ie_len = 3;
+                ie_len = 6;
                 break;
         case PLINK_CONFIRM:
-                ie_len = 5;
+                ie_len = 8;
                 include_plid = true;
                 break;
         case PLINK_CLOSE:
         default:
                 if (!plid)
-                        ie_len = 5;
+                        ie_len = 8;
                 else {
-                        ie_len = 7;
+                        ie_len = 10;
                         include_plid = true;
                 }
                 break;
@@ -207,7 +210,8 @@ static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata,
         pos = skb_put(skb, 2 + ie_len);
         *pos++ = WLAN_EID_PEER_LINK;
         *pos++ = ie_len;
-        *pos++ = action;
+        memcpy(pos, meshpeeringproto, sizeof(meshpeeringproto));
+        pos += 4;
         memcpy(pos, &llid, 2);
         if (include_plid) {
                 pos += 2;
@@ -395,6 +399,17 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
         u8 ie_len;
         u8 *baseaddr;
         __le16 plid, llid, reason;
+#ifdef CONFIG_MAC80211_VERBOSE_MPL_DEBUG
+        static const char *mplstates[] = {
+                [PLINK_LISTEN] = "LISTEN",
+                [PLINK_OPN_SNT] = "OPN-SNT",
+                [PLINK_OPN_RCVD] = "OPN-RCVD",
+                [PLINK_CNF_RCVD] = "CNF_RCVD",
+                [PLINK_ESTAB] = "ESTAB",
+                [PLINK_HOLDING] = "HOLDING",
+                [PLINK_BLOCKED] = "BLOCKED"
+        };
+#endif
 
         /* need action_code, aux */
         if (len < IEEE80211_MIN_ACTION_SIZE + 3)
@@ -417,12 +432,13 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                 return;
         }
 
-        ftype = *((u8 *)PLINK_GET_FRAME_SUBTYPE(elems.peer_link));
+        ftype = mgmt->u.action.u.plink_action.action_code;
         ie_len = elems.peer_link_len;
-        if ((ftype == PLINK_OPEN && ie_len != 3) ||
-            (ftype == PLINK_CONFIRM && ie_len != 5) ||
-            (ftype == PLINK_CLOSE && ie_len != 5 && ie_len != 7)) {
-                mpl_dbg("Mesh plink: incorrect plink ie length\n");
+        if ((ftype == PLINK_OPEN && ie_len != 6) ||
+            (ftype == PLINK_CONFIRM && ie_len != 8) ||
+            (ftype == PLINK_CLOSE && ie_len != 8 && ie_len != 10)) {
+                mpl_dbg("Mesh plink: incorrect plink ie length %d %d\n",
+                    ftype, ie_len);
                 return;
         }
 
@@ -434,7 +450,7 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
          * from the point of view of this host.
          */
         memcpy(&plid, PLINK_GET_LLID(elems.peer_link), 2);
-        if (ftype == PLINK_CONFIRM || (ftype == PLINK_CLOSE && ie_len == 7))
+        if (ftype == PLINK_CONFIRM || (ftype == PLINK_CLOSE && ie_len == 10))
                 memcpy(&llid, PLINK_GET_PLID(elems.peer_link), 2);
 
         rcu_read_lock();
@@ -532,8 +548,8 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                 }
         }
 
-        mpl_dbg("Mesh plink (peer, state, llid, plid, event): %pM %d %d %d %d\n",
-                mgmt->sa, sta->plink_state,
+        mpl_dbg("Mesh plink (peer, state, llid, plid, event): %pM %s %d %d %d\n",
+                mgmt->sa, mplstates[sta->plink_state],
                 le16_to_cpu(sta->llid), le16_to_cpu(sta->plid),
                 event);
         reason = 0;
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index dcc14e99227c..2af306f67d78 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -1898,7 +1898,6 @@ ieee80211_rx_result ieee80211_sta_rx_mgmt(struct ieee80211_sub_if_data *sdata,
         fc = le16_to_cpu(mgmt->frame_control);
 
         switch (fc & IEEE80211_FCTL_STYPE) {
-        case IEEE80211_STYPE_PROBE_REQ:
         case IEEE80211_STYPE_PROBE_RESP:
         case IEEE80211_STYPE_BEACON:
         case IEEE80211_STYPE_AUTH:
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 28316b2a585f..6bce97ee2534 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -507,7 +507,7 @@ ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
 
                 if (ieee80211_is_action(hdr->frame_control)) {
                         mgmt = (struct ieee80211_mgmt *)hdr;
-                        if (mgmt->u.action.category != PLINK_CATEGORY)
+                        if (mgmt->u.action.category != MESH_PLINK_CATEGORY)
                                 return RX_DROP_MONITOR;
                         return RX_CONTINUE;
                 }
@@ -1181,6 +1181,13 @@ __ieee80211_data_to_8023(struct ieee80211_rx_data *rx)
 {
         struct net_device *dev = rx->dev;
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
+
+        if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN && !sdata->use_4addr &&
+            ieee80211_has_a4(hdr->frame_control))
+                return -1;
+        if (sdata->use_4addr && is_multicast_ether_addr(hdr->addr1))
+                return -1;
 
         return ieee80211_data_to_8023(rx->skb, dev->dev_addr, sdata->vif.type);
 }
@@ -1229,7 +1236,7 @@ ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
         if ((sdata->vif.type == NL80211_IFTYPE_AP ||
              sdata->vif.type == NL80211_IFTYPE_AP_VLAN) &&
             !(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) &&
-            (rx->flags & IEEE80211_RX_RA_MATCH)) {
+            (rx->flags & IEEE80211_RX_RA_MATCH) && !rx->sdata->use_4addr) {
                 if (is_multicast_ether_addr(ehdr->h_dest)) {
                         /*
                          * send multicast frames both to higher layers in
@@ -1534,6 +1541,7 @@ ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
 {
         struct net_device *dev = rx->dev;
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         __le16 fc = hdr->frame_control;
         int err;
 
@@ -1543,6 +1551,14 @@ ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
         if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
                 return RX_DROP_MONITOR;
 
+        /*
+         * Allow the cooked monitor interface of an AP to see 4-addr frames so
+         * that a 4-addr station can be detected and moved into a separate VLAN
+         */
+        if (ieee80211_has_a4(hdr->frame_control) &&
+            sdata->vif.type == NL80211_IFTYPE_AP)
+                return RX_DROP_MONITOR;
+
         err = __ieee80211_data_to_8023(rx);
         if (unlikely(err))
                 return RX_DROP_UNUSABLE;
@@ -1983,7 +1999,7 @@ static int prepare_for_handlers(struct ieee80211_sub_if_data *sdata,
 
         switch (sdata->vif.type) {
         case NL80211_IFTYPE_STATION:
-                if (!bssid)
+                if (!bssid && !sdata->use_4addr)
                         return 0;
                 if (!multicast &&
                     compare_ether_addr(sdata->dev->dev_addr, hdr->addr1) != 0) {
@@ -2425,9 +2441,21 @@ void ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb)
                 goto drop;
 
         if (status->flag & RX_FLAG_HT) {
-                /* rate_idx is MCS index */
-                if (WARN_ON(status->rate_idx < 0 ||
-                            status->rate_idx >= 76))
+                /*
+                 * rate_idx is MCS index, which can be [0-76] as documented on:
+                 *
+                 * http://wireless.kernel.org/en/developers/Documentation/ieee80211/802.11n
+                 *
+                 * Anything else would be some sort of driver or hardware error.
+                 * The driver should catch hardware errors.
+                 */
+                if (WARN((status->rate_idx < 0 ||
+                         status->rate_idx > 76),
+                         "Rate marked as an HT rate but passed "
+                         "status->rate_idx is not "
+                         "an MCS index [0-76]: %d (0x%02x)\n",
+                         status->rate_idx,
+                         status->rate_idx))
                         goto drop;
                 /* HT rates are not in the table - use the highest legacy rate
                  * for now since other parts of mac80211 may not yet be fully
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index be59456e8a42..396a94806de9 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -509,6 +509,9 @@ static void __sta_info_unlink(struct sta_info **sta)
         local->num_sta--;
         local->sta_generation++;
 
+        if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
+                rcu_assign_pointer(sdata->u.vlan.sta, NULL);
+
         if (local->ops->sta_notify) {
                 if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
                         sdata = container_of(sdata->bss,
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index bfaa43e096d2..3ad053f6de12 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1051,7 +1051,10 @@ ieee80211_tx_prepare(struct ieee80211_sub_if_data *sdata,
 
         hdr = (struct ieee80211_hdr *) skb->data;
 
-        tx->sta = sta_info_get(local, hdr->addr1);
+        if ((sdata->vif.type == NL80211_IFTYPE_AP_VLAN) && sdata->use_4addr)
+                tx->sta = rcu_dereference(sdata->u.vlan.sta);
+        if (!tx->sta)
+                tx->sta = sta_info_get(local, hdr->addr1);
 
         if (tx->sta && ieee80211_is_data_qos(hdr->frame_control) &&
             (local->hw.flags & IEEE80211_HW_AMPDU_AGGREGATION)) {
@@ -1613,7 +1616,7 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
         const u8 *encaps_data;
         int encaps_len, skip_header_bytes;
         int nh_pos, h_pos;
-        struct sta_info *sta;
+        struct sta_info *sta = NULL;
         u32 sta_flags = 0;
 
         if (unlikely(skb->len < ETH_HLEN)) {
@@ -1630,8 +1633,25 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
         fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_DATA);
 
         switch (sdata->vif.type) {
-        case NL80211_IFTYPE_AP:
         case NL80211_IFTYPE_AP_VLAN:
+                rcu_read_lock();
+                if (sdata->use_4addr)
+                        sta = rcu_dereference(sdata->u.vlan.sta);
+                if (sta) {
+                        fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
+                        /* RA TA DA SA */
+                        memcpy(hdr.addr1, sta->sta.addr, ETH_ALEN);
+                        memcpy(hdr.addr2, dev->dev_addr, ETH_ALEN);
+                        memcpy(hdr.addr3, skb->data, ETH_ALEN);
+                        memcpy(hdr.addr4, skb->data + ETH_ALEN, ETH_ALEN);
+                        hdrlen = 30;
+                        sta_flags = get_sta_flags(sta);
+                }
+                rcu_read_unlock();
+                if (sta)
+                        break;
+                /* fall through */
+        case NL80211_IFTYPE_AP:
                 fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS);
                 /* DA BSSID SA */
                 memcpy(hdr.addr1, skb->data, ETH_ALEN);
@@ -1705,12 +1725,21 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
                 break;
 #endif
         case NL80211_IFTYPE_STATION:
-                fc |= cpu_to_le16(IEEE80211_FCTL_TODS);
-                /* BSSID SA DA */
                 memcpy(hdr.addr1, sdata->u.mgd.bssid, ETH_ALEN);
-                memcpy(hdr.addr2, skb->data + ETH_ALEN, ETH_ALEN);
-                memcpy(hdr.addr3, skb->data, ETH_ALEN);
-                hdrlen = 24;
+                if (sdata->use_4addr && ethertype != ETH_P_PAE) {
+                        fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
+                        /* RA TA DA SA */
+                        memcpy(hdr.addr2, dev->dev_addr, ETH_ALEN);
+                        memcpy(hdr.addr3, skb->data, ETH_ALEN);
+                        memcpy(hdr.addr4, skb->data + ETH_ALEN, ETH_ALEN);
+                        hdrlen = 30;
+                } else {
+                        fc |= cpu_to_le16(IEEE80211_FCTL_TODS);
+                        /* BSSID SA DA */
+                        memcpy(hdr.addr2, skb->data + ETH_ALEN, ETH_ALEN);
+                        memcpy(hdr.addr3, skb->data, ETH_ALEN);
+                        hdrlen = 24;
+                }
                 break;
         case NL80211_IFTYPE_ADHOC:
                 /* DA SA BSSID */
@@ -2119,7 +2148,7 @@ struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
                     cpu_to_le16(IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_BEACON);
                 memset(mgmt->da, 0xff, ETH_ALEN);
                 memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
-                /* BSSID is left zeroed, wildcard value */
+                memcpy(mgmt->bssid, sdata->dev->dev_addr, ETH_ALEN);
                 mgmt->u.beacon.beacon_int =
                         cpu_to_le16(sdata->vif.bss_conf.beacon_int);
                 mgmt->u.beacon.capab_info = 0x0; /* 0x0 for MPs */
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index aedbaaa067e6..da86e1592f8c 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -685,6 +685,10 @@ u32 ieee802_11_parse_elems_crc(u8 *start, size_t len,
                         elems->perr = pos;
                         elems->perr_len = elen;
                         break;
+                case WLAN_EID_RANN:
+                        if (elen >= sizeof(struct ieee80211_rann_ie))
+                                elems->rann = (void *)pos;
+                        break;
                 case WLAN_EID_CHANNEL_SWITCH:
                         elems->ch_switch_elem = pos;
                         elems->ch_switch_elem_len = elen;
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 8ed62b6c172b..37264d56bace 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -138,6 +138,7 @@ static struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] __read_mostly = {
         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
         [NL80211_ATTR_PID] = { .type = NLA_U32 },
+        [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 };
 
 /* policy for the attributes */
@@ -151,6 +152,26 @@ nl80211_key_policy[NL80211_KEY_MAX + 1] __read_mostly = {
         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 };
 
+/* ifidx get helper */
+static int nl80211_get_ifidx(struct netlink_callback *cb)
+{
+        int res;
+
+        res = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
+                          nl80211_fam.attrbuf, nl80211_fam.maxattr,
+                          nl80211_policy);
+        if (res)
+                return res;
+
+        if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
+                return -EINVAL;
+
+        res = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
+        if (!res)
+                return -EINVAL;
+        return res;
+}
+
 /* IE validation */
 static bool is_valid_ie_attr(const struct nlattr *attr)
 {
@@ -987,6 +1008,13 @@ static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
                 change = true;
         }
 
+        if (info->attrs[NL80211_ATTR_4ADDR]) {
+                params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
+                change = true;
+        } else {
+                params.use_4addr = -1;
+        }
+
         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
                 if (ntype != NL80211_IFTYPE_MONITOR) {
                         err = -EINVAL;
@@ -1053,6 +1081,9 @@ static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
                 params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
         }
 
+        if (info->attrs[NL80211_ATTR_4ADDR])
+                params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
+
         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
                                   &flags);
@@ -1682,20 +1713,10 @@ static int nl80211_dump_station(struct sk_buff *skb,
         int sta_idx = cb->args[1];
         int err;
 
-        if (!ifidx) {
-                err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
-                                  nl80211_fam.attrbuf, nl80211_fam.maxattr,
-                                  nl80211_policy);
-                if (err)
-                        return err;
-
-                if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
-                        return -EINVAL;
-
-                ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
-                if (!ifidx)
-                        return -EINVAL;
-        }
+        if (!ifidx)
+                ifidx = nl80211_get_ifidx(cb);
+        if (ifidx < 0)
+                return ifidx;
 
         rtnl_lock();
 
@@ -1800,7 +1821,7 @@ static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
 }
 
 /*
- * Get vlan interface making sure it is on the right wiphy.
+ * Get vlan interface making sure it is running and on the right wiphy.
  */
 static int get_vlan(struct genl_info *info,
                     struct cfg80211_registered_device *rdev,
@@ -1818,6 +1839,8 @@ static int get_vlan(struct genl_info *info,
                         return -EINVAL;
                 if ((*vlan)->ieee80211_ptr->wiphy != &rdev->wiphy)
                         return -EINVAL;
+                if (!netif_running(*vlan))
+                        return -ENETDOWN;
         }
         return 0;
 }
@@ -2105,9 +2128,9 @@ static int nl80211_send_mpath(struct sk_buff *msg, u32 pid, u32 seq,
         if (pinfo->filled & MPATH_INFO_FRAME_QLEN)
                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
                             pinfo->frame_qlen);
-        if (pinfo->filled & MPATH_INFO_DSN)
-                NLA_PUT_U32(msg, NL80211_MPATH_INFO_DSN,
-                            pinfo->dsn);
+        if (pinfo->filled & MPATH_INFO_SN)
+                NLA_PUT_U32(msg, NL80211_MPATH_INFO_SN,
+                            pinfo->sn);
         if (pinfo->filled & MPATH_INFO_METRIC)
                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_METRIC,
                             pinfo->metric);
@@ -2145,20 +2168,10 @@ static int nl80211_dump_mpath(struct sk_buff *skb,
         int path_idx = cb->args[1];
         int err;
 
-        if (!ifidx) {
-                err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
-                                  nl80211_fam.attrbuf, nl80211_fam.maxattr,
-                                  nl80211_policy);
-                if (err)
-                        return err;
-
-                if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
-                        return -EINVAL;
-
-                ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
-                if (!ifidx)
-                        return -EINVAL;
-        }
+        if (!ifidx)
+                ifidx = nl80211_get_ifidx(cb);
+        if (ifidx < 0)
+                return ifidx;
 
         rtnl_lock();
 
@@ -2605,6 +2618,8 @@ static int nl80211_get_mesh_params(struct sk_buff *skb,
                         cur_params.dot11MeshHWMPpreqMinInterval);
         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
                         cur_params.dot11MeshHWMPnetDiameterTraversalTime);
+        NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
+                        cur_params.dot11MeshHWMPRootMode);
         nla_nest_end(msg, pinfoattr);
         genlmsg_end(msg, hdr);
         err = genlmsg_reply(msg, info);
@@ -2715,6 +2730,10 @@ static int nl80211_set_mesh_params(struct sk_buff *skb, struct genl_info *info)
                         dot11MeshHWMPnetDiameterTraversalTime,
                         mask, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
                         nla_get_u16);
+        FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
+                        dot11MeshHWMPRootMode, mask,
+                        NL80211_MESHCONF_HWMP_ROOTMODE,
+                        nla_get_u8);
 
         /* Apply changes */
         err = rdev->ops->set_mesh_params(&rdev->wiphy, dev, &cfg, mask);
@@ -3181,21 +3200,11 @@ static int nl80211_dump_scan(struct sk_buff *skb,
         int start = cb->args[1], idx = 0;
         int err;
 
-        if (!ifidx) {
-                err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
-                                  nl80211_fam.attrbuf, nl80211_fam.maxattr,
-                                  nl80211_policy);
-                if (err)
-                        return err;
-
-                if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
-                        return -EINVAL;
-
-                ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
-                if (!ifidx)
-                        return -EINVAL;
-                cb->args[0] = ifidx;
-        }
+        if (!ifidx)
+                ifidx = nl80211_get_ifidx(cb);
+        if (ifidx < 0)
+                return ifidx;
+        cb->args[0] = ifidx;
 
         dev = dev_get_by_index(sock_net(skb->sk), ifidx);
         if (!dev)
@@ -3238,6 +3247,106 @@ static int nl80211_dump_scan(struct sk_buff *skb,
         return err;
 }
 
+static int nl80211_send_survey(struct sk_buff *msg, u32 pid, u32 seq,
+                                int flags, struct net_device *dev,
+                                struct survey_info *survey)
+{
+        void *hdr;
+        struct nlattr *infoattr;
+
+        /* Survey without a channel doesn't make sense */
+        if (!survey->channel)
+                return -EINVAL;
+
+        hdr = nl80211hdr_put(msg, pid, seq, flags,
+                             NL80211_CMD_NEW_SURVEY_RESULTS);
+        if (!hdr)
+                return -ENOMEM;
+
+        NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
+
+        infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
+        if (!infoattr)
+                goto nla_put_failure;
+
+        NLA_PUT_U32(msg, NL80211_SURVEY_INFO_FREQUENCY,
+                    survey->channel->center_freq);
+        if (survey->filled & SURVEY_INFO_NOISE_DBM)
+                NLA_PUT_U8(msg, NL80211_SURVEY_INFO_NOISE,
+                            survey->noise);
+
+        nla_nest_end(msg, infoattr);
+
+        return genlmsg_end(msg, hdr);
+
+ nla_put_failure:
+        genlmsg_cancel(msg, hdr);
+        return -EMSGSIZE;
+}
+
+static int nl80211_dump_survey(struct sk_buff *skb,
+                        struct netlink_callback *cb)
+{
+        struct survey_info survey;
+        struct cfg80211_registered_device *dev;
+        struct net_device *netdev;
+        int ifidx = cb->args[0];
+        int survey_idx = cb->args[1];
+        int res;
+
+        if (!ifidx)
+                ifidx = nl80211_get_ifidx(cb);
+        if (ifidx < 0)
+                return ifidx;
+        cb->args[0] = ifidx;
+
+        rtnl_lock();
+
+        netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
+        if (!netdev) {
+                res = -ENODEV;
+                goto out_rtnl;
+        }
+
+        dev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
+        if (IS_ERR(dev)) {
+                res = PTR_ERR(dev);
+                goto out_rtnl;
+        }
+
+        if (!dev->ops->dump_survey) {
+                res = -EOPNOTSUPP;
+                goto out_err;
+        }
+
+        while (1) {
+                res = dev->ops->dump_survey(&dev->wiphy, netdev, survey_idx,
+                                            &survey);
+                if (res == -ENOENT)
+                        break;
+                if (res)
+                        goto out_err;
+
+                if (nl80211_send_survey(skb,
+                                NETLINK_CB(cb->skb).pid,
+                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
+                                netdev,
+                                &survey) < 0)
+                        goto out;
+                survey_idx++;
+        }
+
+ out:
+        cb->args[1] = survey_idx;
+        res = skb->len;
+ out_err:
+        cfg80211_unlock_rdev(dev);
+ out_rtnl:
+        rtnl_unlock();
+
+        return res;
+}
+
 static bool nl80211_valid_auth_type(enum nl80211_auth_type auth_type)
 {
         return auth_type <= NL80211_AUTHTYPE_MAX;
@@ -4315,6 +4424,11 @@ static struct genl_ops nl80211_ops[] = {
                 .policy = nl80211_policy,
                 .flags = GENL_ADMIN_PERM,
         },
+        {
+                .cmd = NL80211_CMD_GET_SURVEY,
+                .policy = nl80211_policy,
+                .dumpit = nl80211_dump_survey,
+        },
 };
 static struct genl_multicast_group nl80211_mlme_mcgrp = {
         .name = "mlme",
diff --git a/net/wireless/util.c b/net/wireless/util.c
index 3fc2df86278f..5aa39f7cf9b9 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -320,7 +320,9 @@ int ieee80211_data_to_8023(struct sk_buff *skb, u8 *addr,
                 break;
         case cpu_to_le16(IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS):
                 if (unlikely(iftype != NL80211_IFTYPE_WDS &&
-                             iftype != NL80211_IFTYPE_MESH_POINT))
+                             iftype != NL80211_IFTYPE_MESH_POINT &&
+                             iftype != NL80211_IFTYPE_AP_VLAN &&
+                             iftype != NL80211_IFTYPE_STATION))
                         return -1;
                 if (iftype == NL80211_IFTYPE_MESH_POINT) {
                         struct ieee80211s_hdr *meshdr =