Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next-2.6

20 files changed, 349 insertions, 183 deletions

diff --git a/net/mac80211/driver-trace.c b/net/mac80211/driver-trace.c
index 6da6f79932fc..8ed8711b1a6d 100644
--- a/net/mac80211/driver-trace.c
+++ b/net/mac80211/driver-trace.c
@@ -1,6 +1,9 @@
 /* bug in tracepoint.h, it should include this */
 #include <linux/module.h>
 
+/* sparse isn't too happy with all macros... */
+#ifndef __CHECKER__
 #include "driver-ops.h"
 #define CREATE_TRACE_POINTS
 #include "driver-trace.h"
+#endif
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index 6e3cca65c460..920ec8792f4b 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -781,7 +781,7 @@ static void ieee80211_ibss_timer(unsigned long data)
         }
 
         set_bit(IEEE80211_IBSS_REQ_RUN, &ifibss->request);
-        queue_work(local->hw.workqueue, &ifibss->work);
+        ieee80211_queue_work(&local->hw, &ifibss->work);
 }
 
 #ifdef CONFIG_PM
@@ -853,7 +853,7 @@ ieee80211_ibss_rx_mgmt(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb)
         case IEEE80211_STYPE_PROBE_REQ:
         case IEEE80211_STYPE_AUTH:
                 skb_queue_tail(&sdata->u.ibss.skb_queue, skb);
-                queue_work(local->hw.workqueue, &sdata->u.ibss.work);
+                ieee80211_queue_work(&local->hw, &sdata->u.ibss.work);
                 return RX_QUEUED;
         }
 
@@ -912,7 +912,7 @@ int ieee80211_ibss_join(struct ieee80211_sub_if_data *sdata,
         ieee80211_recalc_idle(sdata->local);
 
         set_bit(IEEE80211_IBSS_REQ_RUN, &sdata->u.ibss.request);
-        queue_work(sdata->local->hw.workqueue, &sdata->u.ibss.work);
+        ieee80211_queue_work(&sdata->local->hw, &sdata->u.ibss.work);
 
         return 0;
 }
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index aec6853cb435..630a438180fd 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -280,6 +280,7 @@ struct ieee80211_if_managed {
         struct work_struct beacon_loss_work;
 
         unsigned long probe_timeout;
+        int probe_send_count;
 
         struct mutex mtx;
         struct ieee80211_bss *associated;
@@ -614,6 +615,12 @@ struct ieee80211_local {
 
         const struct ieee80211_ops *ops;
 
+        /*
+         * private workqueue to mac80211. mac80211 makes this accessible
+         * via ieee80211_queue_work()
+         */
+        struct workqueue_struct *workqueue;
+
         unsigned long queue_stop_reasons[IEEE80211_MAX_QUEUES];
         /* also used to protect ampdu_ac_queue and amdpu_ac_stop_refcnt */
         spinlock_t queue_stop_reason_lock;
@@ -621,7 +628,7 @@ struct ieee80211_local {
         int open_count;
         int monitors, cooked_mntrs;
         /* number of interfaces with corresponding FIF_ flags */
-        int fif_fcsfail, fif_plcpfail, fif_control, fif_other_bss;
+        int fif_fcsfail, fif_plcpfail, fif_control, fif_other_bss, fif_pspoll;
         unsigned int filter_flags; /* FIF_* */
         struct iw_statistics wstats;
 
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 6c655b6547fb..e8fb03b91a44 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -220,8 +220,10 @@ static int ieee80211_open(struct net_device *dev)
                         local->fif_fcsfail++;
                 if (sdata->u.mntr_flags & MONITOR_FLAG_PLCPFAIL)
                         local->fif_plcpfail++;
-                if (sdata->u.mntr_flags & MONITOR_FLAG_CONTROL)
+                if (sdata->u.mntr_flags & MONITOR_FLAG_CONTROL) {
                         local->fif_control++;
+                        local->fif_pspoll++;
+                }
                 if (sdata->u.mntr_flags & MONITOR_FLAG_OTHER_BSS)
                         local->fif_other_bss++;
 
@@ -244,7 +246,14 @@ static int ieee80211_open(struct net_device *dev)
                         spin_unlock_bh(&local->filter_lock);
 
                         ieee80211_start_mesh(sdata);
+                } else if (sdata->vif.type == NL80211_IFTYPE_AP) {
+                        local->fif_pspoll++;
+
+                        spin_lock_bh(&local->filter_lock);
+                        ieee80211_configure_filter(local);
+                        spin_unlock_bh(&local->filter_lock);
                 }
+
                 changed |= ieee80211_reset_erp_info(sdata);
                 ieee80211_bss_info_change_notify(sdata, changed);
                 ieee80211_enable_keys(sdata);
@@ -312,7 +321,7 @@ static int ieee80211_open(struct net_device *dev)
          * to fix this.
          */
         if (sdata->vif.type == NL80211_IFTYPE_STATION)
-                queue_work(local->hw.workqueue, &sdata->u.mgd.work);
+                ieee80211_queue_work(&local->hw, &sdata->u.mgd.work);
 
         netif_tx_start_all_queues(dev);
 
@@ -388,6 +397,9 @@ static int ieee80211_stop(struct net_device *dev)
         if (sdata->flags & IEEE80211_SDATA_PROMISC)
                 atomic_dec(&local->iff_promiscs);
 
+        if (sdata->vif.type == NL80211_IFTYPE_AP)
+                local->fif_pspoll--;
+
         netif_addr_lock_bh(dev);
         spin_lock_bh(&local->filter_lock);
         __dev_addr_unsync(&local->mc_list, &local->mc_count,
@@ -401,7 +413,7 @@ static int ieee80211_stop(struct net_device *dev)
 
         /* APs need special treatment */
         if (sdata->vif.type == NL80211_IFTYPE_AP) {
-                struct ieee80211_sub_if_data *vlan, *tmp;
+                struct ieee80211_sub_if_data *vlan, *tmpsdata;
                 struct beacon_data *old_beacon = sdata->u.ap.beacon;
 
                 /* remove beacon */
@@ -410,7 +422,7 @@ static int ieee80211_stop(struct net_device *dev)
                 kfree(old_beacon);
 
                 /* down all dependent devices, that is VLANs */
-                list_for_each_entry_safe(vlan, tmp, &sdata->u.ap.vlans,
+                list_for_each_entry_safe(vlan, tmpsdata, &sdata->u.ap.vlans,
                                          u.vlan.list)
                         dev_close(vlan->dev);
                 WARN_ON(!list_empty(&sdata->u.ap.vlans));
@@ -439,8 +451,10 @@ static int ieee80211_stop(struct net_device *dev)
                         local->fif_fcsfail--;
                 if (sdata->u.mntr_flags & MONITOR_FLAG_PLCPFAIL)
                         local->fif_plcpfail--;
-                if (sdata->u.mntr_flags & MONITOR_FLAG_CONTROL)
+                if (sdata->u.mntr_flags & MONITOR_FLAG_CONTROL) {
+                        local->fif_pspoll--;
                         local->fif_control--;
+                }
                 if (sdata->u.mntr_flags & MONITOR_FLAG_OTHER_BSS)
                         local->fif_other_bss--;
 
@@ -522,6 +536,16 @@ static int ieee80211_stop(struct net_device *dev)
                                 ieee80211_scan_completed(&local->hw, true);
                 }
 
+                /*
+                 * Disable beaconing for AP and mesh, IBSS can't
+                 * still be joined to a network at this point.
+                 */
+                if (sdata->vif.type == NL80211_IFTYPE_AP ||
+                    sdata->vif.type == NL80211_IFTYPE_MESH_POINT) {
+                        ieee80211_bss_info_change_notify(sdata,
+                                BSS_CHANGED_BEACON_ENABLED);
+                }
+
                 conf.vif = &sdata->vif;
                 conf.type = sdata->vif.type;
                 conf.mac_addr = dev->dev_addr;
@@ -541,7 +565,7 @@ static int ieee80211_stop(struct net_device *dev)
 
                 ieee80211_led_radio(local, false);
 
-                flush_workqueue(local->hw.workqueue);
+                flush_workqueue(local->workqueue);
 
                 tasklet_disable(&local->tx_pending_tasklet);
                 tasklet_disable(&local->tasklet);
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index c1a799194fff..0c4f8e122ed6 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -77,6 +77,9 @@ void ieee80211_configure_filter(struct ieee80211_local *local)
         if (local->fif_other_bss)
                 new_flags |= FIF_OTHER_BSS;
 
+        if (local->fif_pspoll)
+                new_flags |= FIF_PSPOLL;
+
         changed_flags = local->filter_flags ^ new_flags;
 
         /* be a bit nasty */
@@ -198,7 +201,8 @@ void ieee80211_bss_info_change_notify(struct ieee80211_sub_if_data *sdata,
         }
 
         if (changed & BSS_CHANGED_BEACON_ENABLED) {
-                if (test_bit(SCAN_SW_SCANNING, &local->scanning)) {
+                if (local->quiescing || !netif_running(sdata->dev) ||
+                    test_bit(SCAN_SW_SCANNING, &local->scanning)) {
                         sdata->vif.bss_conf.enable_beacon = false;
                 } else {
                         /*
@@ -310,6 +314,31 @@ static void ieee80211_handle_filtered_frame(struct ieee80211_local *local,
 {
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 
+        /*
+         * XXX: This is temporary!
+         *
+         *      The problem here is that when we get here, the driver will
+         *      quite likely have pretty much overwritten info->control by
+         *      using info->driver_data or info->rate_driver_data. Thus,
+         *      when passing out the frame to the driver again, we would be
+         *      passing completely bogus data since the driver would then
+         *      expect a properly filled info->control. In mac80211 itself
+         *      the same problem occurs, since we need info->control.vif
+         *      internally.
+         *
+         *      To fix this, we should send the frame through TX processing
+         *      again. However, it's not that simple, since the frame will
+         *      have been software-encrypted (if applicable) already, and
+         *      encrypting it again doesn't do much good. So to properly do
+         *      that, we not only have to skip the actual 'raw' encryption
+         *      (key selection etc. still has to be done!) but also the
+         *      sequence number assignment since that impacts the crypto
+         *      encapsulation, of course.
+         *
+         *      Hence, for now, fix the bug by just dropping the frame.
+         */
+        goto drop;
+
         sta->tx_filtered_count++;
 
         /*
@@ -363,6 +392,7 @@ static void ieee80211_handle_filtered_frame(struct ieee80211_local *local,
                 return;
         }
 
+ drop:
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
         if (net_ratelimit())
                 printk(KERN_DEBUG "%s: dropped TX filtered frame, "
@@ -794,9 +824,9 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
         if (hw->queues > IEEE80211_MAX_QUEUES)
                 hw->queues = IEEE80211_MAX_QUEUES;
 
-        local->hw.workqueue =
+        local->workqueue =
                 create_singlethread_workqueue(wiphy_name(local->hw.wiphy));
-        if (!local->hw.workqueue) {
+        if (!local->workqueue) {
                 result = -ENOMEM;
                 goto fail_workqueue;
         }
@@ -886,7 +916,7 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
         sta_info_stop(local);
  fail_sta_info:
         debugfs_hw_del(local);
-        destroy_workqueue(local->hw.workqueue);
+        destroy_workqueue(local->workqueue);
  fail_workqueue:
         wiphy_unregister(local->hw.wiphy);
  fail_wiphy_register:
@@ -928,7 +958,7 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw)
         skb_queue_purge(&local->skb_queue);
         skb_queue_purge(&local->skb_queue_unreliable);
 
-        destroy_workqueue(local->hw.workqueue);
+        destroy_workqueue(local->workqueue);
         wiphy_unregister(local->hw.wiphy);
         ieee80211_wep_free(local);
         ieee80211_led_exit(local);
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index 9a3826978b1c..2f4f518ab45c 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -54,7 +54,7 @@ static void ieee80211_mesh_housekeeping_timer(unsigned long data)
                 return;
         }
 
-        queue_work(local->hw.workqueue, &ifmsh->work);
+        ieee80211_queue_work(local->hw.workqueue, &ifmsh->work);
 }
 
 /**
@@ -357,7 +357,7 @@ static void ieee80211_mesh_path_timer(unsigned long data)
                 return;
         }
 
-        queue_work(local->hw.workqueue, &ifmsh->work);
+        ieee80211_queue_work(local->hw.workqueue, &ifmsh->work);
 }
 
 struct mesh_table *mesh_table_grow(struct mesh_table *tbl)
@@ -471,7 +471,7 @@ void ieee80211_start_mesh(struct ieee80211_sub_if_data *sdata)
         struct ieee80211_local *local = sdata->local;
 
         ifmsh->housekeeping = true;
-        queue_work(local->hw.workqueue, &ifmsh->work);
+        ieee80211_queue_work(local->hw.workqueue, &ifmsh->work);
         ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON |
                                                 BSS_CHANGED_BEACON_ENABLED);
 }
@@ -619,7 +619,7 @@ void ieee80211_mesh_notify_scan_completed(struct ieee80211_local *local)
         rcu_read_lock();
         list_for_each_entry_rcu(sdata, &local->interfaces, list)
                 if (ieee80211_vif_is_mesh(&sdata->vif))
-                        queue_work(local->hw.workqueue, &sdata->u.mesh.work);
+                        ieee80211_queue_work(local->hw.workqueue, &sdata->u.mesh.work);
         rcu_read_unlock();
 }
 
@@ -692,7 +692,7 @@ ieee80211_mesh_rx_mgmt(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb)
         case IEEE80211_STYPE_PROBE_RESP:
         case IEEE80211_STYPE_BEACON:
                 skb_queue_tail(&ifmsh->skb_queue, skb);
-                queue_work(local->hw.workqueue, &ifmsh->work);
+                ieee80211_queue_work(local->hw.workqueue, &ifmsh->work);
                 return RX_QUEUED;
         }
 
diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
index e93c37ef6a48..11ab71a68ff9 100644
--- a/net/mac80211/mesh_hwmp.c
+++ b/net/mac80211/mesh_hwmp.c
@@ -660,14 +660,14 @@ static void mesh_queue_preq(struct mesh_path *mpath, u8 flags)
         spin_unlock(&ifmsh->mesh_preq_queue_lock);
 
         if (time_after(jiffies, ifmsh->last_preq + min_preq_int_jiff(sdata)))
-                queue_work(sdata->local->hw.workqueue, &ifmsh->work);
+                ieee80211_queue_work(sdata->local->hw.workqueue, &ifmsh->work);
 
         else if (time_before(jiffies, ifmsh->last_preq)) {
                 /* avoid long wait if did not send preqs for a long time
                  * and jiffies wrapped around
                  */
                 ifmsh->last_preq = jiffies - min_preq_int_jiff(sdata) - 1;
-                queue_work(sdata->local->hw.workqueue, &ifmsh->work);
+                ieee80211_queue_work(sdata->local->hw.workqueue, &ifmsh->work);
         } else
                 mod_timer(&ifmsh->mesh_path_timer, ifmsh->last_preq +
                                                 min_preq_int_jiff(sdata));
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index ee83125ed179..6d5a1ee0445f 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -31,6 +31,7 @@
 #define IEEE80211_AUTH_MAX_TRIES 3
 #define IEEE80211_ASSOC_TIMEOUT (HZ / 5)
 #define IEEE80211_ASSOC_MAX_TRIES 3
+#define IEEE80211_MAX_PROBE_TRIES 5
 
 /*
  * beacon loss detection timeout
@@ -41,13 +42,13 @@
  * Time the connection can be idle before we probe
  * it to see if we can still talk to the AP.
  */
-#define IEEE80211_CONNECTION_IDLE_TIME  (2 * HZ)
+#define IEEE80211_CONNECTION_IDLE_TIME  (30 * HZ)
 /*
  * Time we wait for a probe response after sending
  * a probe request because of beacon loss or for
  * checking the connection still works.
  */
-#define IEEE80211_PROBE_WAIT            (HZ / 5)
+#define IEEE80211_PROBE_WAIT            (HZ / 2)
 
 #define TMR_RUNNING_TIMER       0
 #define TMR_RUNNING_CHANSW      1
@@ -565,7 +566,7 @@ static void ieee80211_chswitch_timer(unsigned long data)
                 return;
         }
 
-        queue_work(sdata->local->hw.workqueue, &ifmgd->chswitch_work);
+        ieee80211_queue_work(&sdata->local->hw, &ifmgd->chswitch_work);
 }
 
 void ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
@@ -597,7 +598,7 @@ void ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
         sdata->local->csa_channel = new_ch;
 
         if (sw_elem->count <= 1) {
-                queue_work(sdata->local->hw.workqueue, &ifmgd->chswitch_work);
+                ieee80211_queue_work(&sdata->local->hw, &ifmgd->chswitch_work);
         } else {
                 ieee80211_stop_queues_by_reason(&sdata->local->hw,
                                         IEEE80211_QUEUE_STOP_REASON_CSA);
@@ -763,7 +764,7 @@ void ieee80211_dynamic_ps_timer(unsigned long data)
         if (local->quiescing || local->suspended)
                 return;
 
-        queue_work(local->hw.workqueue, &local->dynamic_ps_enable_work);
+        ieee80211_queue_work(&local->hw, &local->dynamic_ps_enable_work);
 }
 
 /* MLME */
@@ -916,12 +917,9 @@ static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
 
         ieee80211_bss_info_change_notify(sdata, bss_info_changed);
 
-        /* will be same as sdata */
-        if (local->ps_sdata) {
-                mutex_lock(&local->iflist_mtx);
-                ieee80211_recalc_ps(local, -1);
-                mutex_unlock(&local->iflist_mtx);
-        }
+        mutex_lock(&local->iflist_mtx);
+        ieee80211_recalc_ps(local, -1);
+        mutex_unlock(&local->iflist_mtx);
 
         netif_tx_start_all_queues(sdata->dev);
         netif_carrier_on(sdata->dev);
@@ -950,7 +948,7 @@ ieee80211_direct_probe(struct ieee80211_sub_if_data *sdata,
                  * due to work needing to be done. Hence, queue the STAs work
                  * again for that.
                  */
-                queue_work(local->hw.workqueue, &ifmgd->work);
+                ieee80211_queue_work(&local->hw, &ifmgd->work);
                 return RX_MGMT_CFG80211_AUTH_TO;
         }
 
@@ -995,7 +993,7 @@ ieee80211_authenticate(struct ieee80211_sub_if_data *sdata,
                  * due to work needing to be done. Hence, queue the STAs work
                  * again for that.
                  */
-                queue_work(local->hw.workqueue, &ifmgd->work);
+                ieee80211_queue_work(&local->hw, &ifmgd->work);
                 return RX_MGMT_CFG80211_AUTH_TO;
         }
 
@@ -1124,7 +1122,7 @@ ieee80211_associate(struct ieee80211_sub_if_data *sdata,
                  * due to work needing to be done. Hence, queue the STAs work
                  * again for that.
                  */
-                queue_work(local->hw.workqueue, &ifmgd->work);
+                ieee80211_queue_work(&local->hw, &ifmgd->work);
                 return RX_MGMT_CFG80211_ASSOC_TO;
         }
 
@@ -1156,11 +1154,24 @@ void ieee80211_sta_rx_notify(struct ieee80211_sub_if_data *sdata,
                   round_jiffies_up(jiffies + IEEE80211_CONNECTION_IDLE_TIME));
 }
 
+static void ieee80211_mgd_probe_ap_send(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+        const u8 *ssid;
+
+        ssid = ieee80211_bss_get_ie(&ifmgd->associated->cbss, WLAN_EID_SSID);
+        ieee80211_send_probe_req(sdata, ifmgd->associated->cbss.bssid,
+                                 ssid + 2, ssid[1], NULL, 0);
+
+        ifmgd->probe_send_count++;
+        ifmgd->probe_timeout = jiffies + IEEE80211_PROBE_WAIT;
+        run_again(ifmgd, ifmgd->probe_timeout);
+}
+
 static void ieee80211_mgd_probe_ap(struct ieee80211_sub_if_data *sdata,
                                    bool beacon)
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
-        const u8 *ssid;
         bool already = false;
 
         if (!netif_running(sdata->dev))
@@ -1203,18 +1214,12 @@ static void ieee80211_mgd_probe_ap(struct ieee80211_sub_if_data *sdata,
         if (already)
                 goto out;
 
-        ifmgd->probe_timeout = jiffies + IEEE80211_PROBE_WAIT;
-
         mutex_lock(&sdata->local->iflist_mtx);
         ieee80211_recalc_ps(sdata->local, -1);
         mutex_unlock(&sdata->local->iflist_mtx);
 
-        ssid = ieee80211_bss_get_ie(&ifmgd->associated->cbss, WLAN_EID_SSID);
-        ieee80211_send_probe_req(sdata, ifmgd->associated->cbss.bssid,
-                                 ssid + 2, ssid[1], NULL, 0);
-
-        run_again(ifmgd, ifmgd->probe_timeout);
-
+        ifmgd->probe_send_count = 0;
+        ieee80211_mgd_probe_ap_send(sdata);
  out:
         mutex_unlock(&ifmgd->mtx);
 }
@@ -1232,8 +1237,7 @@ void ieee80211_beacon_loss(struct ieee80211_vif *vif)
 {
         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
 
-        queue_work(sdata->local->hw.workqueue,
-                   &sdata->u.mgd.beacon_loss_work);
+        ieee80211_queue_work(&sdata->local->hw, &sdata->u.mgd.beacon_loss_work);
 }
 EXPORT_SYMBOL(ieee80211_beacon_loss);
 
@@ -1570,6 +1574,9 @@ ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
                                                wk->bss->cbss.bssid,
                                                ap_ht_cap_flags);
 
+        /* delete work item -- must be before set_associated for PS */
+        list_del(&wk->list);
+
         /* set AID and assoc capability,
          * ieee80211_set_associated() will tell the driver */
         bss_conf->aid = aid;
@@ -1583,7 +1590,6 @@ ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
         ieee80211_sta_rx_notify(sdata, (struct ieee80211_hdr *)mgmt);
         mod_beacon_timer(sdata);
 
-        list_del(&wk->list);
         kfree(wk);
         return RX_MGMT_CFG80211_ASSOC;
 }
@@ -1847,12 +1853,8 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
                                                bssid, ap_ht_cap_flags);
         }
 
+        /* Note: country IE parsing is done for us by cfg80211 */
         if (elems.country_elem) {
-                /* Note we are only reviewing this on beacons
-                 * for the BSSID we are associated to */
-                regulatory_hint_11d(local->hw.wiphy,
-                        elems.country_elem, elems.country_elem_len);
-
                 /* TODO: IBSS also needs this */
                 if (elems.pwr_constr_elem)
                         ieee80211_handle_pwr_constr(sdata,
@@ -1888,7 +1890,7 @@ ieee80211_rx_result ieee80211_sta_rx_mgmt(struct ieee80211_sub_if_data *sdata,
         case IEEE80211_STYPE_DISASSOC:
         case IEEE80211_STYPE_ACTION:
                 skb_queue_tail(&sdata->u.mgd.skb_queue, skb);
-                queue_work(local->hw.workqueue, &sdata->u.mgd.work);
+                ieee80211_queue_work(&local->hw, &sdata->u.mgd.work);
                 return RX_QUEUED;
         }
 
@@ -2026,7 +2028,7 @@ static void ieee80211_sta_timer(unsigned long data)
                 return;
         }
 
-        queue_work(local->hw.workqueue, &ifmgd->work);
+        ieee80211_queue_work(&local->hw, &ifmgd->work);
 }
 
 static void ieee80211_sta_work(struct work_struct *work)
@@ -2051,13 +2053,11 @@ static void ieee80211_sta_work(struct work_struct *work)
                 return;
 
         /*
-         * Nothing should have been stuffed into the workqueue during
-         * the suspend->resume cycle. If this WARN is seen then there
-         * is a bug with either the driver suspend or something in
-         * mac80211 stuffing into the workqueue which we haven't yet
-         * cleared during mac80211's suspend cycle.
+         * ieee80211_queue_work() should have picked up most cases,
+         * here we'll pick the the rest.
          */
-        if (WARN_ON(local->suspended))
+        if (WARN(local->suspended, "STA MLME work scheduled while "
+                 "going to suspend\n"))
                 return;
 
         ifmgd = &sdata->u.mgd;
@@ -2072,17 +2072,27 @@ static void ieee80211_sta_work(struct work_struct *work)
         if (ifmgd->flags & (IEEE80211_STA_BEACON_POLL |
                             IEEE80211_STA_CONNECTION_POLL) &&
             ifmgd->associated) {
+                u8 bssid[ETH_ALEN];
+
+                memcpy(bssid, ifmgd->associated->cbss.bssid, ETH_ALEN);
                 if (time_is_after_jiffies(ifmgd->probe_timeout))
                         run_again(ifmgd, ifmgd->probe_timeout);
-                else {
-                        u8 bssid[ETH_ALEN];
+
+                else if (ifmgd->probe_send_count < IEEE80211_MAX_PROBE_TRIES) {
+#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
+                        printk(KERN_DEBUG "No probe response from AP %pM"
+                                " after %dms, try %d\n", bssid,
+                                (1000 * IEEE80211_PROBE_WAIT)/HZ,
+                                ifmgd->probe_send_count);
+#endif
+                        ieee80211_mgd_probe_ap_send(sdata);
+                } else {
                         /*
                          * We actually lost the connection ... or did we?
                          * Let's make sure!
                          */
                         ifmgd->flags &= ~(IEEE80211_STA_CONNECTION_POLL |
                                           IEEE80211_STA_BEACON_POLL);
-                        memcpy(bssid, ifmgd->associated->cbss.bssid, ETH_ALEN);
                         printk(KERN_DEBUG "No probe response from AP %pM"
                                 " after %dms, disconnecting.\n",
                                 bssid, (1000 * IEEE80211_PROBE_WAIT)/HZ);
@@ -2113,9 +2123,9 @@ static void ieee80211_sta_work(struct work_struct *work)
                 mutex_unlock(&ifmgd->mtx);
 
                 if (test_and_clear_bit(IEEE80211_STA_REQ_SCAN, &ifmgd->request))
-                        queue_delayed_work(local->hw.workqueue,
-                                           &local->scan_work,
-                                           round_jiffies_relative(0));
+                        ieee80211_queue_delayed_work(&local->hw,
+                                                     &local->scan_work,
+                                                     round_jiffies_relative(0));
                 return;
         }
 
@@ -2196,8 +2206,7 @@ static void ieee80211_sta_bcn_mon_timer(unsigned long data)
         if (local->quiescing)
                 return;
 
-        queue_work(sdata->local->hw.workqueue,
-                   &sdata->u.mgd.beacon_loss_work);
+        ieee80211_queue_work(&sdata->local->hw, &sdata->u.mgd.beacon_loss_work);
 }
 
 static void ieee80211_sta_conn_mon_timer(unsigned long data)
@@ -2210,7 +2219,7 @@ static void ieee80211_sta_conn_mon_timer(unsigned long data)
         if (local->quiescing)
                 return;
 
-        queue_work(local->hw.workqueue, &ifmgd->monitor_work);
+        ieee80211_queue_work(&local->hw, &ifmgd->monitor_work);
 }
 
 static void ieee80211_sta_monitor_work(struct work_struct *work)
@@ -2229,10 +2238,10 @@ static void ieee80211_restart_sta_timer(struct ieee80211_sub_if_data *sdata)
                                         IEEE80211_STA_CONNECTION_POLL);
 
                 /* let's probe the connection once */
-                queue_work(sdata->local->hw.workqueue,
+                ieee80211_queue_work(&sdata->local->hw,
                            &sdata->u.mgd.monitor_work);
                 /* and do all the other regular work too */
-                queue_work(sdata->local->hw.workqueue,
+                ieee80211_queue_work(&sdata->local->hw,
                            &sdata->u.mgd.work);
         }
 }
@@ -2393,7 +2402,7 @@ int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata,
         list_add(&wk->list, &sdata->u.mgd.work_list);
         mutex_unlock(&ifmgd->mtx);
 
-        queue_work(sdata->local->hw.workqueue, &sdata->u.mgd.work);
+        ieee80211_queue_work(&sdata->local->hw, &sdata->u.mgd.work);
         return 0;
 }
 
@@ -2467,7 +2476,7 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
         else
                 ifmgd->flags &= ~IEEE80211_STA_CONTROL_PORT;
 
-        queue_work(sdata->local->hw.workqueue, &sdata->u.mgd.work);
+        ieee80211_queue_work(&sdata->local->hw, &sdata->u.mgd.work);
 
         err = 0;
 
diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c
index 5e3d476972f9..a5d2f1fb4417 100644
--- a/net/mac80211/pm.c
+++ b/net/mac80211/pm.c
@@ -26,7 +26,7 @@ int __ieee80211_suspend(struct ieee80211_hw *hw)
         /* make quiescing visible to timers everywhere */
         mb();
 
-        flush_workqueue(local->hw.workqueue);
+        flush_workqueue(local->workqueue);
 
         /* Don't try to run timers while suspended. */
         del_timer_sync(&local->sta_cleanup);
@@ -96,6 +96,10 @@ int __ieee80211_suspend(struct ieee80211_hw *hw)
                 if (!netif_running(sdata->dev))
                         continue;
 
+                /* disable beaconing */
+                ieee80211_bss_info_change_notify(sdata,
+                        BSS_CHANGED_BEACON_ENABLED);
+
                 conf.vif = &sdata->vif;
                 conf.type = sdata->vif.type;
                 conf.mac_addr = sdata->dev->dev_addr;
@@ -113,7 +117,7 @@ int __ieee80211_suspend(struct ieee80211_hw *hw)
          * shouldn't be doing (or cancel everything in the
          * stop callback) that but better safe than sorry.
          */
-        flush_workqueue(local->hw.workqueue);
+        flush_workqueue(local->workqueue);
 
         local->suspended = true;
         /* need suspended to be visible before quiescing is false */
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index 45731000eb8d..244f53f3c8b4 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -385,8 +385,9 @@ static int ieee80211_start_sw_scan(struct ieee80211_local *local)
         spin_unlock_bh(&local->filter_lock);
 
         /* TODO: start scan as soon as all nullfunc frames are ACKed */
-        queue_delayed_work(local->hw.workqueue, &local->scan_work,
-                           IEEE80211_CHANNEL_TIME);
+        ieee80211_queue_delayed_work(&local->hw,
+                                     &local->scan_work,
+                                     IEEE80211_CHANNEL_TIME);
 
         return 0;
 }
@@ -715,8 +716,7 @@ void ieee80211_scan_work(struct work_struct *work)
                 }
         } while (next_delay == 0);
 
-        queue_delayed_work(local->hw.workqueue, &local->scan_work,
-                           next_delay);
+        ieee80211_queue_delayed_work(&local->hw, &local->scan_work, next_delay);
 }
 
 int ieee80211_request_scan(struct ieee80211_sub_if_data *sdata,
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 4e1b2ba122cd..7cffaa046b33 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1400,7 +1400,7 @@ static void ieee80211_xmit(struct ieee80211_sub_if_data *sdata,
                 if (local->hw.conf.flags & IEEE80211_CONF_PS) {
                         ieee80211_stop_queues_by_reason(&local->hw,
                                         IEEE80211_QUEUE_STOP_REASON_PS);
-                        queue_work(local->hw.workqueue,
+                        ieee80211_queue_work(&local->hw,
                                         &local->dynamic_ps_disable_work);
                 }
 
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 8502936e5314..e55d57f559ec 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -511,6 +511,46 @@ void ieee80211_iterate_active_interfaces_atomic(
 }
 EXPORT_SYMBOL_GPL(ieee80211_iterate_active_interfaces_atomic);
 
+/*
+ * Nothing should have been stuffed into the workqueue during
+ * the suspend->resume cycle. If this WARN is seen then there
+ * is a bug with either the driver suspend or something in
+ * mac80211 stuffing into the workqueue which we haven't yet
+ * cleared during mac80211's suspend cycle.
+ */
+static bool ieee80211_can_queue_work(struct ieee80211_local *local)
+{
+        if (WARN(local->suspended, "queueing ieee80211 work while "
+                 "going to suspend\n"))
+                return false;
+
+        return true;
+}
+
+void ieee80211_queue_work(struct ieee80211_hw *hw, struct work_struct *work)
+{
+        struct ieee80211_local *local = hw_to_local(hw);
+
+        if (!ieee80211_can_queue_work(local))
+                return;
+
+        queue_work(local->workqueue, work);
+}
+EXPORT_SYMBOL(ieee80211_queue_work);
+
+void ieee80211_queue_delayed_work(struct ieee80211_hw *hw,
+                                  struct delayed_work *dwork,
+                                  unsigned long delay)
+{
+        struct ieee80211_local *local = hw_to_local(hw);
+
+        if (!ieee80211_can_queue_work(local))
+                return;
+
+        queue_delayed_work(local->workqueue, dwork, delay);
+}
+EXPORT_SYMBOL(ieee80211_queue_delayed_work);
+
 void ieee802_11_parse_elems(u8 *start, size_t len,
                             struct ieee802_11_elems *elems)
 {
@@ -1114,3 +1154,4 @@ int ieee80211_reconfig(struct ieee80211_local *local)
 #endif
         return 0;
 }
+
diff --git a/net/rfkill/core.c b/net/rfkill/core.c
index 044de1c6af3d..dbeaf2983822 100644
--- a/net/rfkill/core.c
+++ b/net/rfkill/core.c
@@ -589,11 +589,13 @@ static const char *rfkill_get_type_str(enum rfkill_type type)
                 return "wimax";
         case RFKILL_TYPE_WWAN:
                 return "wwan";
+        case RFKILL_TYPE_GPS:
+                return "gps";
         default:
                 BUG();
         }
 
-        BUILD_BUG_ON(NUM_RFKILL_TYPES != RFKILL_TYPE_WWAN + 1);
+        BUILD_BUG_ON(NUM_RFKILL_TYPES != RFKILL_TYPE_GPS + 1);
 }
 
 static ssize_t rfkill_type_show(struct device *dev,
diff --git a/net/wireless/core.c b/net/wireless/core.c
index f9fee65dc06a..1e189306560d 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -34,9 +34,7 @@ MODULE_DESCRIPTION("wireless configuration support");
 LIST_HEAD(cfg80211_rdev_list);
 
 /*
- * This is used to protect the cfg80211_rdev_list, cfg80211_regdomain,
- * country_ie_regdomain, the reg_beacon_list and the the last regulatory
- * request receipt (last_request).
+ * This is used to protect the cfg80211_rdev_list
  */
 DEFINE_MUTEX(cfg80211_mutex);
 
@@ -314,7 +312,8 @@ static void cfg80211_process_events(struct wireless_dev *wdev)
                                 ev->cr.req_ie, ev->cr.req_ie_len,
                                 ev->cr.resp_ie, ev->cr.resp_ie_len,
                                 ev->cr.status,
-                                ev->cr.status == WLAN_STATUS_SUCCESS);
+                                ev->cr.status == WLAN_STATUS_SUCCESS,
+                                NULL);
                         break;
                 case EVENT_ROAMED:
                         __cfg80211_roamed(wdev, ev->rm.bssid,
@@ -672,7 +671,7 @@ static int cfg80211_netdev_notifier_call(struct notifier_block * nb,
                 wdev->wext.default_mgmt_key = -1;
                 wdev->wext.connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
                 wdev->wext.ps = CONFIG_CFG80211_DEFAULT_PS_VALUE;
-                wdev->wext.ps_timeout = 500;
+                wdev->wext.ps_timeout = 100;
                 if (rdev->ops->set_power_mgmt)
                         if (rdev->ops->set_power_mgmt(wdev->wiphy, dev,
                                                       wdev->wext.ps,
@@ -724,15 +723,22 @@ static int cfg80211_netdev_notifier_call(struct notifier_block * nb,
                 break;
         case NETDEV_UNREGISTER:
                 mutex_lock(&rdev->devlist_mtx);
+                /*
+                 * It is possible to get NETDEV_UNREGISTER
+                 * multiple times. To detect that, check
+                 * that the interface is still on the list
+                 * of registered interfaces, and only then
+                 * remove and clean it up.
+                 */
                 if (!list_empty(&wdev->list)) {
                         sysfs_remove_link(&dev->dev.kobj, "phy80211");
                         list_del_init(&wdev->list);
-                }
-                mutex_unlock(&rdev->devlist_mtx);
-                mutex_destroy(&wdev->mtx);
+                        mutex_destroy(&wdev->mtx);
 #ifdef CONFIG_WIRELESS_EXT
-                kfree(wdev->wext.keys);
+                        kfree(wdev->wext.keys);
 #endif
+                }
+                mutex_unlock(&rdev->devlist_mtx);
                 break;
         case NETDEV_PRE_UP:
                 if (!(wdev->wiphy->interface_modes & BIT(wdev->iftype)))
diff --git a/net/wireless/core.h b/net/wireless/core.h
index 6d903c1d721d..325c17e6198c 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -127,6 +127,11 @@ static inline struct cfg80211_internal_bss *bss_from_pub(struct cfg80211_bss *pu
         return container_of(pub, struct cfg80211_internal_bss, pub);
 }
 
+static inline void cfg80211_ref_bss(struct cfg80211_internal_bss *bss)
+{
+        kref_get(&bss->ref);
+}
+
 static inline void cfg80211_hold_bss(struct cfg80211_internal_bss *bss)
 {
         atomic_inc(&bss->hold);
@@ -323,7 +328,8 @@ void cfg80211_mlme_down(struct cfg80211_registered_device *rdev,
 void __cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
                                const u8 *req_ie, size_t req_ie_len,
                                const u8 *resp_ie, size_t resp_ie_len,
-                               u16 status, bool wextev);
+                               u16 status, bool wextev,
+                               struct cfg80211_bss *bss);
 
 /* SME */
 int __cfg80211_connect(struct cfg80211_registered_device *rdev,
diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c
index 097a87d7bae1..525e8e247b30 100644
--- a/net/wireless/mlme.c
+++ b/net/wireless/mlme.c
@@ -61,7 +61,7 @@ void cfg80211_send_rx_assoc(struct net_device *dev, const u8 *buf, size_t len)
         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
         u8 *ie = mgmt->u.assoc_resp.variable;
         int i, ieoffs = offsetof(struct ieee80211_mgmt, u.assoc_resp.variable);
-        bool done;
+        struct cfg80211_internal_bss *bss = NULL;
 
         wdev_lock(wdev);
 
@@ -69,22 +69,32 @@ void cfg80211_send_rx_assoc(struct net_device *dev, const u8 *buf, size_t len)
 
         nl80211_send_rx_assoc(rdev, dev, buf, len, GFP_KERNEL);
 
-        __cfg80211_connect_result(dev, mgmt->bssid, NULL, 0, ie, len - ieoffs,
-                                  status_code,
-                                  status_code == WLAN_STATUS_SUCCESS);
-
         if (status_code == WLAN_STATUS_SUCCESS) {
-                for (i = 0; wdev->current_bss && i < MAX_AUTH_BSSES; i++) {
-                        if (wdev->auth_bsses[i] == wdev->current_bss) {
-                                cfg80211_unhold_bss(wdev->auth_bsses[i]);
-                                cfg80211_put_bss(&wdev->auth_bsses[i]->pub);
+                for (i = 0; i < MAX_AUTH_BSSES; i++) {
+                        if (!wdev->auth_bsses[i])
+                                continue;
+                        if (memcmp(wdev->auth_bsses[i]->pub.bssid, mgmt->bssid,
+                                   ETH_ALEN) == 0) {
+                                bss = wdev->auth_bsses[i];
                                 wdev->auth_bsses[i] = NULL;
-                                done = true;
+                                /* additional reference to drop hold */
+                                cfg80211_ref_bss(bss);
                                 break;
                         }
                 }
 
-                WARN_ON(!done);
+                WARN_ON(!bss);
+        }
+
+        /* this consumes one bss reference (unless bss is NULL) */
+        __cfg80211_connect_result(dev, mgmt->bssid, NULL, 0, ie, len - ieoffs,
+                                  status_code,
+                                  status_code == WLAN_STATUS_SUCCESS,
+                                  bss ? &bss->pub : NULL);
+        /* drop hold now, and also reference acquired above */
+        if (bss) {
+                cfg80211_unhold_bss(bss);
+                cfg80211_put_bss(&bss->pub);
         }
 
         wdev_unlock(wdev);
@@ -144,7 +154,7 @@ static void __cfg80211_send_deauth(struct net_device *dev,
         } else if (wdev->sme_state == CFG80211_SME_CONNECTING) {
                 __cfg80211_connect_result(dev, mgmt->bssid, NULL, 0, NULL, 0,
                                           WLAN_STATUS_UNSPECIFIED_FAILURE,
-                                          false);
+                                          false, NULL);
         }
 }
 
@@ -241,7 +251,7 @@ void cfg80211_send_auth_timeout(struct net_device *dev, const u8 *addr)
         if (wdev->sme_state == CFG80211_SME_CONNECTING)
                 __cfg80211_connect_result(dev, addr, NULL, 0, NULL, 0,
                                           WLAN_STATUS_UNSPECIFIED_FAILURE,
-                                          false);
+                                          false, NULL);
 
         for (i = 0; addr && i < MAX_AUTH_BSSES; i++) {
                 if (wdev->authtry_bsses[i] &&
@@ -275,7 +285,7 @@ void cfg80211_send_assoc_timeout(struct net_device *dev, const u8 *addr)
         if (wdev->sme_state == CFG80211_SME_CONNECTING)
                 __cfg80211_connect_result(dev, addr, NULL, 0, NULL, 0,
                                           WLAN_STATUS_UNSPECIFIED_FAILURE,
-                                          false);
+                                          false, NULL);
 
         for (i = 0; addr && i < MAX_AUTH_BSSES; i++) {
                 if (wdev->auth_bsses[i] &&
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index fb40428a5946..b3ac0aace0e5 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -62,6 +62,16 @@ const struct ieee80211_regdomain *cfg80211_regdomain;
  */
 static const struct ieee80211_regdomain *country_ie_regdomain;
 
+/*
+ * Protects static reg.c components:
+ *     - cfg80211_world_regdom
+ *     - cfg80211_regdom
+ *     - country_ie_regdomain
+ *     - last_request
+ */
+DEFINE_MUTEX(reg_mutex);
+#define assert_reg_lock() WARN_ON(!mutex_is_locked(&reg_mutex))
+
 /* Used to queue up regulatory hints */
 static LIST_HEAD(reg_requests_list);
 static spinlock_t reg_requests_lock;
@@ -1293,7 +1303,7 @@ static void handle_channel_custom(struct wiphy *wiphy,
         struct ieee80211_supported_band *sband;
         struct ieee80211_channel *chan;
 
-        assert_cfg80211_lock();
+        assert_reg_lock();
 
         sband = wiphy->bands[band];
         BUG_ON(chan_idx >= sband->n_channels);
@@ -1342,14 +1352,14 @@ void wiphy_apply_custom_regulatory(struct wiphy *wiphy,
         enum ieee80211_band band;
         unsigned int bands_set = 0;
 
-        mutex_lock(&cfg80211_mutex);
+        mutex_lock(&reg_mutex);
         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
                 if (!wiphy->bands[band])
                         continue;
                 handle_band_custom(wiphy, band, regd);
                 bands_set++;
         }
-        mutex_unlock(&cfg80211_mutex);
+        mutex_unlock(&reg_mutex);
 
         /*
          * no point in calling this if it won't have any effect
@@ -1495,7 +1505,7 @@ static int ignore_request(struct wiphy *wiphy,
  * Returns zero if all went fine, %-EALREADY if a regulatory domain had
  * already been set or other standard error codes.
  *
- * Caller must hold &cfg80211_mutex
+ * Caller must hold &cfg80211_mutex and &reg_mutex
  */
 static int __regulatory_hint(struct wiphy *wiphy,
                              struct regulatory_request *pending_request)
@@ -1570,6 +1580,7 @@ static void reg_process_hint(struct regulatory_request *reg_request)
         BUG_ON(!reg_request->alpha2);
 
         mutex_lock(&cfg80211_mutex);
+        mutex_lock(&reg_mutex);
 
         if (wiphy_idx_valid(reg_request->wiphy_idx))
                 wiphy = wiphy_idx_to_wiphy(reg_request->wiphy_idx);
@@ -1585,6 +1596,7 @@ static void reg_process_hint(struct regulatory_request *reg_request)
         if (r == -EALREADY && wiphy && wiphy->strict_regulatory)
                 wiphy_update_regulatory(wiphy, reg_request->initiator);
 out:
+        mutex_unlock(&reg_mutex);
         mutex_unlock(&cfg80211_mutex);
 }
 
@@ -1613,6 +1625,10 @@ static void reg_process_pending_beacon_hints(void)
         struct cfg80211_registered_device *rdev;
         struct reg_beacon *pending_beacon, *tmp;
 
+        /*
+         * No need to hold the reg_mutex here as we just touch wiphys
+         * and do not read or access regulatory variables.
+         */
         mutex_lock(&cfg80211_mutex);
 
         /* This goes through the _pending_ beacon list */
@@ -1734,12 +1750,13 @@ int regulatory_hint(struct wiphy *wiphy, const char *alpha2)
 }
 EXPORT_SYMBOL(regulatory_hint);
 
+/* Caller must hold reg_mutex */
 static bool reg_same_country_ie_hint(struct wiphy *wiphy,
                         u32 country_ie_checksum)
 {
         struct wiphy *request_wiphy;
 
-        assert_cfg80211_lock();
+        assert_reg_lock();
 
         if (unlikely(last_request->initiator !=
             NL80211_REGDOM_SET_BY_COUNTRY_IE))
@@ -1762,6 +1779,10 @@ static bool reg_same_country_ie_hint(struct wiphy *wiphy,
         return false;
 }
 
+/*
+ * We hold wdev_lock() here so we cannot hold cfg80211_mutex() and
+ * therefore cannot iterate over the rdev list here.
+ */
 void regulatory_hint_11d(struct wiphy *wiphy,
                         u8 *country_ie,
                         u8 country_ie_len)
@@ -1772,12 +1793,10 @@ void regulatory_hint_11d(struct wiphy *wiphy,
         enum environment_cap env = ENVIRON_ANY;
         struct regulatory_request *request;
 
-        mutex_lock(&cfg80211_mutex);
+        mutex_lock(&reg_mutex);
 
-        if (unlikely(!last_request)) {
-                mutex_unlock(&cfg80211_mutex);
-                return;
-        }
+        if (unlikely(!last_request))
+                goto out;
 
         /* IE len must be evenly divisible by 2 */
         if (country_ie_len & 0x01)
@@ -1803,54 +1822,14 @@ void regulatory_hint_11d(struct wiphy *wiphy,
                 env = ENVIRON_OUTDOOR;
 
         /*
-         * We will run this for *every* beacon processed for the BSSID, so
-         * we optimize an early check to exit out early if we don't have to
-         * do anything
+         * We will run this only upon a successful connection on cfg80211.
+         * We leave conflict resolution to the workqueue, where can hold
+         * cfg80211_mutex.
          */
         if (likely(last_request->initiator ==
             NL80211_REGDOM_SET_BY_COUNTRY_IE &&
-            wiphy_idx_valid(last_request->wiphy_idx))) {
-                struct cfg80211_registered_device *rdev_last_ie;
-
-                rdev_last_ie =
-                        cfg80211_rdev_by_wiphy_idx(last_request->wiphy_idx);
-
-                /*
-                 * Lets keep this simple -- we trust the first AP
-                 * after we intersect with CRDA
-                 */
-                if (likely(&rdev_last_ie->wiphy == wiphy)) {
-                        /*
-                         * Ignore IEs coming in on this wiphy with
-                         * the same alpha2 and environment cap
-                         */
-                        if (likely(alpha2_equal(rdev_last_ie->country_ie_alpha2,
-                                  alpha2) &&
-                                  env == rdev_last_ie->env)) {
-                                goto out;
-                        }
-                        /*
-                         * the wiphy moved on to another BSSID or the AP
-                         * was reconfigured. XXX: We need to deal with the
-                         * case where the user suspends and goes to goes
-                         * to another country, and then gets IEs from an
-                         * AP with different settings
-                         */
-                        goto out;
-                } else {
-                        /*
-                         * Ignore IEs coming in on two separate wiphys with
-                         * the same alpha2 and environment cap
-                         */
-                        if (likely(alpha2_equal(rdev_last_ie->country_ie_alpha2,
-                                  alpha2) &&
-                                  env == rdev_last_ie->env)) {
-                                goto out;
-                        }
-                        /* We could potentially intersect though */
-                        goto out;
-                }
-        }
+            wiphy_idx_valid(last_request->wiphy_idx)))
+                goto out;
 
         rd = country_ie_2_rd(country_ie, country_ie_len, &checksum);
         if (!rd)
@@ -1885,7 +1864,7 @@ void regulatory_hint_11d(struct wiphy *wiphy,
         request->country_ie_checksum = checksum;
         request->country_ie_env = env;
 
-        mutex_unlock(&cfg80211_mutex);
+        mutex_unlock(&reg_mutex);
 
         queue_regulatory_request(request);
 
@@ -1894,9 +1873,8 @@ void regulatory_hint_11d(struct wiphy *wiphy,
 free_rd_out:
         kfree(rd);
 out:
-        mutex_unlock(&cfg80211_mutex);
+        mutex_unlock(&reg_mutex);
 }
-EXPORT_SYMBOL(regulatory_hint_11d);
 
 static bool freq_is_chan_12_13_14(u16 freq)
 {
@@ -2227,10 +2205,13 @@ int set_regdom(const struct ieee80211_regdomain *rd)
 
         assert_cfg80211_lock();
 
+        mutex_lock(&reg_mutex);
+
         /* Note that this doesn't update the wiphys, this is done below */
         r = __set_regdom(rd);
         if (r) {
                 kfree(rd);
+                mutex_unlock(&reg_mutex);
                 return r;
         }
 
@@ -2245,6 +2226,8 @@ int set_regdom(const struct ieee80211_regdomain *rd)
 
         nl80211_send_reg_change_event(last_request);
 
+        mutex_unlock(&reg_mutex);
+
         return r;
 }
 
@@ -2255,16 +2238,20 @@ void reg_device_remove(struct wiphy *wiphy)
 
         assert_cfg80211_lock();
 
+        mutex_lock(&reg_mutex);
+
         kfree(wiphy->regd);
 
         if (last_request)
                 request_wiphy = wiphy_idx_to_wiphy(last_request->wiphy_idx);
 
         if (!request_wiphy || request_wiphy != wiphy)
-                return;
+                goto out;
 
         last_request->wiphy_idx = WIPHY_IDX_STALE;
         last_request->country_ie_env = ENVIRON_ANY;
+out:
+        mutex_unlock(&reg_mutex);
 }
 
 int regulatory_init(void)
@@ -2325,6 +2312,7 @@ void regulatory_exit(void)
         cancel_work_sync(&reg_work);
 
         mutex_lock(&cfg80211_mutex);
+        mutex_lock(&reg_mutex);
 
         reset_regdomains();
 
@@ -2363,5 +2351,6 @@ void regulatory_exit(void)
         }
         spin_unlock(&reg_requests_lock);
 
+        mutex_unlock(&reg_mutex);
         mutex_unlock(&cfg80211_mutex);
 }
diff --git a/net/wireless/reg.h b/net/wireless/reg.h
index e37829a49dc4..662a9dad76d5 100644
--- a/net/wireless/reg.h
+++ b/net/wireless/reg.h
@@ -36,4 +36,19 @@ int regulatory_hint_found_beacon(struct wiphy *wiphy,
                                         struct ieee80211_channel *beacon_chan,
                                         gfp_t gfp);
 
+/**
+ * regulatory_hint_11d - hints a country IE as a regulatory domain
+ * @wiphy: the wireless device giving the hint (used only for reporting
+ *      conflicts)
+ * @country_ie: pointer to the country IE
+ * @country_ie_len: length of the country IE
+ *
+ * We will intersect the rd with the what CRDA tells us should apply
+ * for the alpha2 this country IE belongs to, this prevents APs from
+ * sending us incorrect or outdated information against a country.
+ */
+void regulatory_hint_11d(struct wiphy *wiphy,
+                         u8 *country_ie,
+                         u8 country_ie_len);
+
 #endif  /* __NET_WIRELESS_REG_H */
diff --git a/net/wireless/sme.c b/net/wireless/sme.c
index d2b5d4ce0a00..8a7dcbf90602 100644
--- a/net/wireless/sme.c
+++ b/net/wireless/sme.c
@@ -13,6 +13,7 @@
 #include <net/cfg80211.h>
 #include <net/rtnetlink.h>
 #include "nl80211.h"
+#include "reg.h"
 
 struct cfg80211_conn {
         struct cfg80211_connect_params params;
@@ -182,7 +183,7 @@ void cfg80211_conn_work(struct work_struct *work)
                                         wdev->conn->params.bssid,
                                         NULL, 0, NULL, 0,
                                         WLAN_STATUS_UNSPECIFIED_FAILURE,
-                                        false);
+                                        false, NULL);
                 wdev_unlock(wdev);
         }
 
@@ -247,7 +248,7 @@ static void __cfg80211_sme_scan_done(struct net_device *dev)
                                         wdev->conn->params.bssid,
                                         NULL, 0, NULL, 0,
                                         WLAN_STATUS_UNSPECIFIED_FAILURE,
-                                        false);
+                                        false, NULL);
         }
 }
 
@@ -305,7 +306,7 @@ void cfg80211_sme_rx_auth(struct net_device *dev,
                 schedule_work(&rdev->conn_work);
         } else if (status_code != WLAN_STATUS_SUCCESS) {
                 __cfg80211_connect_result(dev, mgmt->bssid, NULL, 0, NULL, 0,
-                                          status_code, false);
+                                          status_code, false, NULL);
         } else if (wdev->sme_state == CFG80211_SME_CONNECTING &&
                  wdev->conn->state == CFG80211_CONN_AUTHENTICATING) {
                 wdev->conn->state = CFG80211_CONN_ASSOCIATE_NEXT;
@@ -316,10 +317,11 @@ void cfg80211_sme_rx_auth(struct net_device *dev,
 void __cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
                                const u8 *req_ie, size_t req_ie_len,
                                const u8 *resp_ie, size_t resp_ie_len,
-                               u16 status, bool wextev)
+                               u16 status, bool wextev,
+                               struct cfg80211_bss *bss)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
-        struct cfg80211_bss *bss;
+        u8 *country_ie;
 #ifdef CONFIG_WIRELESS_EXT
         union iwreq_data wrqu;
 #endif
@@ -361,6 +363,12 @@ void __cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
         }
 #endif
 
+        if (wdev->current_bss) {
+                cfg80211_unhold_bss(wdev->current_bss);
+                cfg80211_put_bss(&wdev->current_bss->pub);
+                wdev->current_bss = NULL;
+        }
+
         if (status == WLAN_STATUS_SUCCESS &&
             wdev->sme_state == CFG80211_SME_IDLE)
                 goto success;
@@ -368,12 +376,6 @@ void __cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
         if (wdev->sme_state != CFG80211_SME_CONNECTING)
                 return;
 
-        if (wdev->current_bss) {
-                cfg80211_unhold_bss(wdev->current_bss);
-                cfg80211_put_bss(&wdev->current_bss->pub);
-                wdev->current_bss = NULL;
-        }
-
         if (wdev->conn)
                 wdev->conn->state = CFG80211_CONN_IDLE;
 
@@ -383,13 +385,16 @@ void __cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
                 wdev->conn = NULL;
                 kfree(wdev->connect_keys);
                 wdev->connect_keys = NULL;
+                wdev->ssid_len = 0;
                 return;
         }
 
-        bss = cfg80211_get_bss(wdev->wiphy, NULL, bssid,
-                               wdev->ssid, wdev->ssid_len,
-                               WLAN_CAPABILITY_ESS,
-                               WLAN_CAPABILITY_ESS);
+ success:
+        if (!bss)
+                bss = cfg80211_get_bss(wdev->wiphy, NULL, bssid,
+                                       wdev->ssid, wdev->ssid_len,
+                                       WLAN_CAPABILITY_ESS,
+                                       WLAN_CAPABILITY_ESS);
 
         if (WARN_ON(!bss))
                 return;
@@ -397,9 +402,22 @@ void __cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
         cfg80211_hold_bss(bss_from_pub(bss));
         wdev->current_bss = bss_from_pub(bss);
 
- success:
         wdev->sme_state = CFG80211_SME_CONNECTED;
         cfg80211_upload_connect_keys(wdev);
+
+        country_ie = (u8 *) ieee80211_bss_get_ie(bss, WLAN_EID_COUNTRY);
+
+        if (!country_ie)
+                return;
+
+        /*
+         * ieee80211_bss_get_ie() ensures we can access:
+         * - country_ie + 2, the start of the country ie data, and
+         * - and country_ie[1] which is the IE length
+         */
+        regulatory_hint_11d(wdev->wiphy,
+                            country_ie + 2,
+                            country_ie[1]);
 }
 
 void cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
@@ -549,6 +567,7 @@ void __cfg80211_disconnected(struct net_device *dev, const u8 *ie,
 
         wdev->current_bss = NULL;
         wdev->sme_state = CFG80211_SME_IDLE;
+        wdev->ssid_len = 0;
 
         if (wdev->conn) {
                 kfree(wdev->conn->ie);
@@ -704,6 +723,7 @@ int __cfg80211_connect(struct cfg80211_registered_device *rdev,
                         wdev->conn = NULL;
                         wdev->sme_state = CFG80211_SME_IDLE;
                         wdev->connect_keys = NULL;
+                        wdev->ssid_len = 0;
                 }
 
                 return err;
@@ -768,6 +788,7 @@ int __cfg80211_disconnect(struct cfg80211_registered_device *rdev,
                         wdev->sme_state = CFG80211_SME_IDLE;
                         kfree(wdev->conn);
                         wdev->conn = NULL;
+                        wdev->ssid_len = 0;
                         return 0;
                 }
 
@@ -788,7 +809,7 @@ int __cfg80211_disconnect(struct cfg80211_registered_device *rdev,
         else if (wdev->sme_state == CFG80211_SME_CONNECTING)
                 __cfg80211_connect_result(dev, NULL, NULL, 0, NULL, 0,
                                           WLAN_STATUS_UNSPECIFIED_FAILURE,
-                                          wextev);
+                                          wextev, NULL);
 
         return 0;
 }
diff --git a/net/wireless/wext.c b/net/wireless/wext.c
index 3fe3c2c0ce11..5b4a0cee4418 100644
--- a/net/wireless/wext.c
+++ b/net/wireless/wext.c
@@ -1291,7 +1291,6 @@ static struct pernet_operations wext_pernet_ops = {
 static int __init wireless_nlevent_init(void)
 {
         return register_pernet_subsys(&wext_pernet_ops);
-        return 0;
 }
 
 subsys_initcall(wireless_nlevent_init);