Merge master.kernel.org:/pub/scm/linux/kernel/git/davem/wireless-2.6

6 files changed, 443 insertions, 270 deletions

diff --git a/net/ieee80211/ieee80211_wx.c b/net/ieee80211/ieee80211_wx.c
index 822606b615ca..973832dd7faf 100644
--- a/net/ieee80211/ieee80211_wx.c
+++ b/net/ieee80211/ieee80211_wx.c
@@ -43,8 +43,9 @@ static const char *ieee80211_modes[] = {
 
 #define MAX_CUSTOM_LEN 64
 static char *ieee80211_translate_scan(struct ieee80211_device *ieee,
-                                           char *start, char *stop,
-                                           struct ieee80211_network *network)
+                                      char *start, char *stop,
+                                      struct ieee80211_network *network,
+                                      struct iw_request_info *info)
 {
         char custom[MAX_CUSTOM_LEN];
         char *p;
@@ -57,7 +58,7 @@ static char *ieee80211_translate_scan(struct ieee80211_device *ieee,
         iwe.cmd = SIOCGIWAP;
         iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
         memcpy(iwe.u.ap_addr.sa_data, network->bssid, ETH_ALEN);
-        start = iwe_stream_add_event(start, stop, &iwe, IW_EV_ADDR_LEN);
+        start = iwe_stream_add_event(info, start, stop, &iwe, IW_EV_ADDR_LEN);
 
         /* Remaining entries will be displayed in the order we provide them */
 
@@ -66,17 +67,19 @@ static char *ieee80211_translate_scan(struct ieee80211_device *ieee,
         iwe.u.data.flags = 1;
         if (network->flags & NETWORK_EMPTY_ESSID) {
                 iwe.u.data.length = sizeof("<hidden>");
-                start = iwe_stream_add_point(start, stop, &iwe, "<hidden>");
+                start = iwe_stream_add_point(info, start, stop,
+                                             &iwe, "<hidden>");
         } else {
                 iwe.u.data.length = min(network->ssid_len, (u8) 32);
-                start = iwe_stream_add_point(start, stop, &iwe, network->ssid);
+                start = iwe_stream_add_point(info, start, stop,
+                                             &iwe, network->ssid);
         }
 
         /* Add the protocol name */
         iwe.cmd = SIOCGIWNAME;
         snprintf(iwe.u.name, IFNAMSIZ, "IEEE 802.11%s",
                  ieee80211_modes[network->mode]);
-        start = iwe_stream_add_event(start, stop, &iwe, IW_EV_CHAR_LEN);
+        start = iwe_stream_add_event(info, start, stop, &iwe, IW_EV_CHAR_LEN);
 
         /* Add mode */
         iwe.cmd = SIOCGIWMODE;
@@ -86,7 +89,8 @@ static char *ieee80211_translate_scan(struct ieee80211_device *ieee,
                 else
                         iwe.u.mode = IW_MODE_ADHOC;
 
-                start = iwe_stream_add_event(start, stop, &iwe, IW_EV_UINT_LEN);
+                start = iwe_stream_add_event(info, start, stop,
+                                             &iwe, IW_EV_UINT_LEN);
         }
 
         /* Add channel and frequency */
@@ -95,7 +99,7 @@ static char *ieee80211_translate_scan(struct ieee80211_device *ieee,
         iwe.u.freq.m = ieee80211_channel_to_freq(ieee, network->channel);
         iwe.u.freq.e = 6;
         iwe.u.freq.i = 0;
-        start = iwe_stream_add_event(start, stop, &iwe, IW_EV_FREQ_LEN);
+        start = iwe_stream_add_event(info, start, stop, &iwe, IW_EV_FREQ_LEN);
 
         /* Add encryption capability */
         iwe.cmd = SIOCGIWENCODE;
@@ -104,12 +108,13 @@ static char *ieee80211_translate_scan(struct ieee80211_device *ieee,
         else
                 iwe.u.data.flags = IW_ENCODE_DISABLED;
         iwe.u.data.length = 0;
-        start = iwe_stream_add_point(start, stop, &iwe, network->ssid);
+        start = iwe_stream_add_point(info, start, stop,
+                                     &iwe, network->ssid);
 
         /* Add basic and extended rates */
         /* Rate : stuffing multiple values in a single event require a bit
          * more of magic - Jean II */
-        current_val = start + IW_EV_LCP_LEN;
+        current_val = start + iwe_stream_lcp_len(info);
         iwe.cmd = SIOCGIWRATE;
         /* Those two flags are ignored... */
         iwe.u.bitrate.fixed = iwe.u.bitrate.disabled = 0;
@@ -124,17 +129,19 @@ static char *ieee80211_translate_scan(struct ieee80211_device *ieee,
                 /* Bit rate given in 500 kb/s units (+ 0x80) */
                 iwe.u.bitrate.value = ((rate & 0x7f) * 500000);
                 /* Add new value to event */
-                current_val = iwe_stream_add_value(start, current_val, stop, &iwe, IW_EV_PARAM_LEN);
+                current_val = iwe_stream_add_value(info, start, current_val,
+                                                   stop, &iwe, IW_EV_PARAM_LEN);
         }
         for (; j < network->rates_ex_len; j++) {
                 rate = network->rates_ex[j] & 0x7F;
                 /* Bit rate given in 500 kb/s units (+ 0x80) */
                 iwe.u.bitrate.value = ((rate & 0x7f) * 500000);
                 /* Add new value to event */
-                current_val = iwe_stream_add_value(start, current_val, stop, &iwe, IW_EV_PARAM_LEN);
+                current_val = iwe_stream_add_value(info, start, current_val,
+                                                   stop, &iwe, IW_EV_PARAM_LEN);
         }
         /* Check if we added any rate */
-        if((current_val - start) > IW_EV_LCP_LEN)
+        if ((current_val - start) > iwe_stream_lcp_len(info))
                 start = current_val;
 
         /* Add quality statistics */
@@ -181,14 +188,14 @@ static char *ieee80211_translate_scan(struct ieee80211_device *ieee,
                 iwe.u.qual.level = network->stats.signal;
         }
 
-        start = iwe_stream_add_event(start, stop, &iwe, IW_EV_QUAL_LEN);
+        start = iwe_stream_add_event(info, start, stop, &iwe, IW_EV_QUAL_LEN);
 
         iwe.cmd = IWEVCUSTOM;
         p = custom;
 
         iwe.u.data.length = p - custom;
         if (iwe.u.data.length)
-                start = iwe_stream_add_point(start, stop, &iwe, custom);
+                start = iwe_stream_add_point(info, start, stop, &iwe, custom);
 
         memset(&iwe, 0, sizeof(iwe));
         if (network->wpa_ie_len) {
@@ -196,7 +203,7 @@ static char *ieee80211_translate_scan(struct ieee80211_device *ieee,
                 memcpy(buf, network->wpa_ie, network->wpa_ie_len);
                 iwe.cmd = IWEVGENIE;
                 iwe.u.data.length = network->wpa_ie_len;
-                start = iwe_stream_add_point(start, stop, &iwe, buf);
+                start = iwe_stream_add_point(info, start, stop, &iwe, buf);
         }
 
         memset(&iwe, 0, sizeof(iwe));
@@ -205,7 +212,7 @@ static char *ieee80211_translate_scan(struct ieee80211_device *ieee,
                 memcpy(buf, network->rsn_ie, network->rsn_ie_len);
                 iwe.cmd = IWEVGENIE;
                 iwe.u.data.length = network->rsn_ie_len;
-                start = iwe_stream_add_point(start, stop, &iwe, buf);
+                start = iwe_stream_add_point(info, start, stop, &iwe, buf);
         }
 
         /* Add EXTRA: Age to display seconds since last beacon/probe response
@@ -217,7 +224,7 @@ static char *ieee80211_translate_scan(struct ieee80211_device *ieee,
                       jiffies_to_msecs(jiffies - network->last_scanned));
         iwe.u.data.length = p - custom;
         if (iwe.u.data.length)
-                start = iwe_stream_add_point(start, stop, &iwe, custom);
+                start = iwe_stream_add_point(info, start, stop, &iwe, custom);
 
         /* Add spectrum management information */
         iwe.cmd = -1;
@@ -238,7 +245,7 @@ static char *ieee80211_translate_scan(struct ieee80211_device *ieee,
 
         if (iwe.cmd == IWEVCUSTOM) {
                 iwe.u.data.length = p - custom;
-                start = iwe_stream_add_point(start, stop, &iwe, custom);
+                start = iwe_stream_add_point(info, start, stop, &iwe, custom);
         }
 
         return start;
@@ -272,7 +279,8 @@ int ieee80211_wx_get_scan(struct ieee80211_device *ieee,
 
                 if (ieee->scan_age == 0 ||
                     time_after(network->last_scanned + ieee->scan_age, jiffies))
-                        ev = ieee80211_translate_scan(ieee, ev, stop, network);
+                        ev = ieee80211_translate_scan(ieee, ev, stop, network,
+                                                      info);
                 else
                         IEEE80211_DEBUG_SCAN("Not showing network '%s ("
                                              "%s)' due to age (%dms).\n",
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 14fccf16b80f..80a9e7c07b47 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -24,6 +24,7 @@
 #include <linux/spinlock.h>
 #include <linux/etherdevice.h>
 #include <net/wireless.h>
+#include <net/iw_handler.h>
 #include "key.h"
 #include "sta_info.h"
 
@@ -867,7 +868,9 @@ int ieee80211_sta_set_bssid(struct net_device *dev, u8 *bssid);
 int ieee80211_sta_req_scan(struct net_device *dev, u8 *ssid, size_t ssid_len);
 void ieee80211_sta_req_auth(struct net_device *dev,
                             struct ieee80211_if_sta *ifsta);
-int ieee80211_sta_scan_results(struct net_device *dev, char *buf, size_t len);
+int ieee80211_sta_scan_results(struct net_device *dev,
+                               struct iw_request_info *info,
+                               char *buf, size_t len);
 ieee80211_rx_result ieee80211_sta_rx_scan(
         struct net_device *dev, struct sk_buff *skb,
         struct ieee80211_rx_status *rx_status);
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 55659a730dc1..e06d6450f215 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -4087,6 +4087,7 @@ int ieee80211_sta_req_scan(struct net_device *dev, u8 *ssid, size_t ssid_len)
 
 static char *
 ieee80211_sta_scan_result(struct net_device *dev,
+                          struct iw_request_info *info,
                           struct ieee80211_sta_bss *bss,
                           char *current_ev, char *end_buf)
 {
@@ -4101,7 +4102,7 @@ ieee80211_sta_scan_result(struct net_device *dev,
         iwe.cmd = SIOCGIWAP;
         iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
         memcpy(iwe.u.ap_addr.sa_data, bss->bssid, ETH_ALEN);
-        current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe,
+        current_ev = iwe_stream_add_event(info, current_ev, end_buf, &iwe,
                                           IW_EV_ADDR_LEN);
 
         memset(&iwe, 0, sizeof(iwe));
@@ -4109,13 +4110,13 @@ ieee80211_sta_scan_result(struct net_device *dev,
         if (bss_mesh_cfg(bss)) {
                 iwe.u.data.length = bss_mesh_id_len(bss);
                 iwe.u.data.flags = 1;
-                current_ev = iwe_stream_add_point(current_ev, end_buf, &iwe,
-                                                  bss_mesh_id(bss));
+                current_ev = iwe_stream_add_point(info, current_ev, end_buf,
+                                                  &iwe, bss_mesh_id(bss));
         } else {
                 iwe.u.data.length = bss->ssid_len;
                 iwe.u.data.flags = 1;
-                current_ev = iwe_stream_add_point(current_ev, end_buf, &iwe,
-                                                  bss->ssid);
+                current_ev = iwe_stream_add_point(info, current_ev, end_buf,
+                                                  &iwe, bss->ssid);
         }
 
         if (bss->capability & (WLAN_CAPABILITY_ESS | WLAN_CAPABILITY_IBSS)
@@ -4128,22 +4129,22 @@ ieee80211_sta_scan_result(struct net_device *dev,
                         iwe.u.mode = IW_MODE_MASTER;
                 else
                         iwe.u.mode = IW_MODE_ADHOC;
-                current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe,
-                                                  IW_EV_UINT_LEN);
+                current_ev = iwe_stream_add_event(info, current_ev, end_buf,
+                                                  &iwe, IW_EV_UINT_LEN);
         }
 
         memset(&iwe, 0, sizeof(iwe));
         iwe.cmd = SIOCGIWFREQ;
         iwe.u.freq.m = ieee80211_frequency_to_channel(bss->freq);
         iwe.u.freq.e = 0;
-        current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe,
+        current_ev = iwe_stream_add_event(info, current_ev, end_buf, &iwe,
                                           IW_EV_FREQ_LEN);
 
         memset(&iwe, 0, sizeof(iwe));
         iwe.cmd = SIOCGIWFREQ;
         iwe.u.freq.m = bss->freq;
         iwe.u.freq.e = 6;
-        current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe,
+        current_ev = iwe_stream_add_event(info, current_ev, end_buf, &iwe,
                                           IW_EV_FREQ_LEN);
         memset(&iwe, 0, sizeof(iwe));
         iwe.cmd = IWEVQUAL;
@@ -4151,7 +4152,7 @@ ieee80211_sta_scan_result(struct net_device *dev,
         iwe.u.qual.level = bss->signal;
         iwe.u.qual.noise = bss->noise;
         iwe.u.qual.updated = local->wstats_flags;
-        current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe,
+        current_ev = iwe_stream_add_event(info, current_ev, end_buf, &iwe,
                                           IW_EV_QUAL_LEN);
 
         memset(&iwe, 0, sizeof(iwe));
@@ -4161,35 +4162,36 @@ ieee80211_sta_scan_result(struct net_device *dev,
         else
                 iwe.u.data.flags = IW_ENCODE_DISABLED;
         iwe.u.data.length = 0;
-        current_ev = iwe_stream_add_point(current_ev, end_buf, &iwe, "");
+        current_ev = iwe_stream_add_point(info, current_ev, end_buf,
+                                          &iwe, "");
 
         if (bss && bss->wpa_ie) {
                 memset(&iwe, 0, sizeof(iwe));
                 iwe.cmd = IWEVGENIE;
                 iwe.u.data.length = bss->wpa_ie_len;
-                current_ev = iwe_stream_add_point(current_ev, end_buf, &iwe,
-                                                  bss->wpa_ie);
+                current_ev = iwe_stream_add_point(info, current_ev, end_buf,
+                                                  &iwe, bss->wpa_ie);
         }
 
         if (bss && bss->rsn_ie) {
                 memset(&iwe, 0, sizeof(iwe));
                 iwe.cmd = IWEVGENIE;
                 iwe.u.data.length = bss->rsn_ie_len;
-                current_ev = iwe_stream_add_point(current_ev, end_buf, &iwe,
-                                                  bss->rsn_ie);
+                current_ev = iwe_stream_add_point(info, current_ev, end_buf,
+                                                  &iwe, bss->rsn_ie);
         }
 
         if (bss && bss->ht_ie) {
                 memset(&iwe, 0, sizeof(iwe));
                 iwe.cmd = IWEVGENIE;
                 iwe.u.data.length = bss->ht_ie_len;
-                current_ev = iwe_stream_add_point(current_ev, end_buf, &iwe,
-                                                  bss->ht_ie);
+                current_ev = iwe_stream_add_point(info, current_ev, end_buf,
+                                                  &iwe, bss->ht_ie);
         }
 
         if (bss && bss->supp_rates_len > 0) {
                 /* display all supported rates in readable format */
-                char *p = current_ev + IW_EV_LCP_LEN;
+                char *p = current_ev + iwe_stream_lcp_len(info);
                 int i;
 
                 memset(&iwe, 0, sizeof(iwe));
@@ -4200,7 +4202,7 @@ ieee80211_sta_scan_result(struct net_device *dev,
                 for (i = 0; i < bss->supp_rates_len; i++) {
                         iwe.u.bitrate.value = ((bss->supp_rates[i] &
                                                         0x7f) * 500000);
-                        p = iwe_stream_add_value(current_ev, p,
+                        p = iwe_stream_add_value(info, current_ev, p,
                                         end_buf, &iwe, IW_EV_PARAM_LEN);
                 }
                 current_ev = p;
@@ -4214,7 +4216,8 @@ ieee80211_sta_scan_result(struct net_device *dev,
                         iwe.cmd = IWEVCUSTOM;
                         sprintf(buf, "tsf=%016llx", (unsigned long long)(bss->timestamp));
                         iwe.u.data.length = strlen(buf);
-                        current_ev = iwe_stream_add_point(current_ev, end_buf,
+                        current_ev = iwe_stream_add_point(info, current_ev,
+                                                          end_buf,
                                                           &iwe, buf);
                         kfree(buf);
                 }
@@ -4229,31 +4232,36 @@ ieee80211_sta_scan_result(struct net_device *dev,
                         iwe.cmd = IWEVCUSTOM;
                         sprintf(buf, "Mesh network (version %d)", cfg[0]);
                         iwe.u.data.length = strlen(buf);
-                        current_ev = iwe_stream_add_point(current_ev, end_buf,
+                        current_ev = iwe_stream_add_point(info, current_ev,
+                                                          end_buf,
                                                           &iwe, buf);
                         sprintf(buf, "Path Selection Protocol ID: "
                                 "0x%02X%02X%02X%02X", cfg[1], cfg[2], cfg[3],
                                                         cfg[4]);
                         iwe.u.data.length = strlen(buf);
-                        current_ev = iwe_stream_add_point(current_ev, end_buf,
+                        current_ev = iwe_stream_add_point(info, current_ev,
+                                                          end_buf,
                                                           &iwe, buf);
                         sprintf(buf, "Path Selection Metric ID: "
                                 "0x%02X%02X%02X%02X", cfg[5], cfg[6], cfg[7],
                                                         cfg[8]);
                         iwe.u.data.length = strlen(buf);
-                        current_ev = iwe_stream_add_point(current_ev, end_buf,
+                        current_ev = iwe_stream_add_point(info, current_ev,
+                                                          end_buf,
                                                           &iwe, buf);
                         sprintf(buf, "Congestion Control Mode ID: "
                                 "0x%02X%02X%02X%02X", cfg[9], cfg[10],
                                                         cfg[11], cfg[12]);
                         iwe.u.data.length = strlen(buf);
-                        current_ev = iwe_stream_add_point(current_ev, end_buf,
+                        current_ev = iwe_stream_add_point(info, current_ev,
+                                                          end_buf,
                                                           &iwe, buf);
                         sprintf(buf, "Channel Precedence: "
                                 "0x%02X%02X%02X%02X", cfg[13], cfg[14],
                                                         cfg[15], cfg[16]);
                         iwe.u.data.length = strlen(buf);
-                        current_ev = iwe_stream_add_point(current_ev, end_buf,
+                        current_ev = iwe_stream_add_point(info, current_ev,
+                                                          end_buf,
                                                           &iwe, buf);
                         kfree(buf);
                 }
@@ -4263,7 +4271,9 @@ ieee80211_sta_scan_result(struct net_device *dev,
 }
 
 
-int ieee80211_sta_scan_results(struct net_device *dev, char *buf, size_t len)
+int ieee80211_sta_scan_results(struct net_device *dev,
+                               struct iw_request_info *info,
+                               char *buf, size_t len)
 {
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
         char *current_ev = buf;
@@ -4276,8 +4286,8 @@ int ieee80211_sta_scan_results(struct net_device *dev, char *buf, size_t len)
                         spin_unlock_bh(&local->sta_bss_lock);
                         return -E2BIG;
                 }
-                current_ev = ieee80211_sta_scan_result(dev, bss, current_ev,
-                                                       end_buf);
+                current_ev = ieee80211_sta_scan_result(dev, info, bss,
+                                                       current_ev, end_buf);
         }
         spin_unlock_bh(&local->sta_bss_lock);
         return current_ev - buf;
diff --git a/net/mac80211/wext.c b/net/mac80211/wext.c
index 5af3862e7191..f47d13bdf7f7 100644
--- a/net/mac80211/wext.c
+++ b/net/mac80211/wext.c
@@ -567,7 +567,7 @@ static int ieee80211_ioctl_giwscan(struct net_device *dev,
         if (local->sta_sw_scanning || local->sta_hw_scanning)
                 return -EAGAIN;
 
-        res = ieee80211_sta_scan_results(dev, extra, data->length);
+        res = ieee80211_sta_scan_results(dev, info, extra, data->length);
         if (res >= 0) {
                 data->length = res;
                 return 0;
diff --git a/net/socket.c b/net/socket.c
index 66c4a8cf6db9..81fe82513046 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -90,6 +90,7 @@
 #include <asm/unistd.h>
 
 #include <net/compat.h>
+#include <net/wext.h>
 
 #include <net/sock.h>
 #include <linux/netfilter.h>
@@ -2210,10 +2211,19 @@ static long compat_sock_ioctl(struct file *file, unsigned cmd,
 {
         struct socket *sock = file->private_data;
         int ret = -ENOIOCTLCMD;
+        struct sock *sk;
+        struct net *net;
+
+        sk = sock->sk;
+        net = sock_net(sk);
 
         if (sock->ops->compat_ioctl)
                 ret = sock->ops->compat_ioctl(sock, cmd, arg);
 
+        if (ret == -ENOIOCTLCMD &&
+            (cmd >= SIOCIWFIRST && cmd <= SIOCIWLAST))
+                ret = compat_wext_handle_ioctl(net, cmd, arg);
+
         return ret;
 }
 #endif
diff --git a/net/wireless/wext.c b/net/wireless/wext.c
index 947188a5b937..273a84359998 100644
--- a/net/wireless/wext.c
+++ b/net/wireless/wext.c
@@ -500,7 +500,7 @@ static int call_commit_handler(struct net_device *dev)
 /*
  * Calculate size of private arguments
  */
-static inline int get_priv_size(__u16   args)
+static int get_priv_size(__u16 args)
 {
         int     num = args & IW_PRIV_SIZE_MASK;
         int     type = (args & IW_PRIV_TYPE_MASK) >> 12;
@@ -512,10 +512,9 @@ static inline int get_priv_size(__u16	args)
 /*
  * Re-calculate the size of private arguments
  */
-static inline int adjust_priv_size(__u16                args,
-                                   union iwreq_data *   wrqu)
+static int adjust_priv_size(__u16 args, struct iw_point *iwp)
 {
-        int     num = wrqu->data.length;
+        int     num = iwp->length;
         int     max = args & IW_PRIV_SIZE_MASK;
         int     type = (args & IW_PRIV_TYPE_MASK) >> 12;
 
@@ -695,19 +694,150 @@ void wext_proc_exit(struct net *net)
  */
 
 /* ---------------------------------------------------------------- */
+static int ioctl_standard_iw_point(struct iw_point *iwp, unsigned int cmd,
+                                   const struct iw_ioctl_description *descr,
+                                   iw_handler handler, struct net_device *dev,
+                                   struct iw_request_info *info)
+{
+        int err, extra_size, user_length = 0, essid_compat = 0;
+        char *extra;
+
+        /* Calculate space needed by arguments. Always allocate
+         * for max space.
+         */
+        extra_size = descr->max_tokens * descr->token_size;
+
+        /* Check need for ESSID compatibility for WE < 21 */
+        switch (cmd) {
+        case SIOCSIWESSID:
+        case SIOCGIWESSID:
+        case SIOCSIWNICKN:
+        case SIOCGIWNICKN:
+                if (iwp->length == descr->max_tokens + 1)
+                        essid_compat = 1;
+                else if (IW_IS_SET(cmd) && (iwp->length != 0)) {
+                        char essid[IW_ESSID_MAX_SIZE + 1];
+
+                        err = copy_from_user(essid, iwp->pointer,
+                                             iwp->length *
+                                             descr->token_size);
+                        if (err)
+                                return -EFAULT;
+
+                        if (essid[iwp->length - 1] == '\0')
+                                essid_compat = 1;
+                }
+                break;
+        default:
+                break;
+        }
+
+        iwp->length -= essid_compat;
+
+        /* Check what user space is giving us */
+        if (IW_IS_SET(cmd)) {
+                /* Check NULL pointer */
+                if (!iwp->pointer && iwp->length != 0)
+                        return -EFAULT;
+                /* Check if number of token fits within bounds */
+                if (iwp->length > descr->max_tokens)
+                        return -E2BIG;
+                if (iwp->length < descr->min_tokens)
+                        return -EINVAL;
+        } else {
+                /* Check NULL pointer */
+                if (!iwp->pointer)
+                        return -EFAULT;
+                /* Save user space buffer size for checking */
+                user_length = iwp->length;
+
+                /* Don't check if user_length > max to allow forward
+                 * compatibility. The test user_length < min is
+                 * implied by the test at the end.
+                 */
+
+                /* Support for very large requests */
+                if ((descr->flags & IW_DESCR_FLAG_NOMAX) &&
+                    (user_length > descr->max_tokens)) {
+                        /* Allow userspace to GET more than max so
+                         * we can support any size GET requests.
+                         * There is still a limit : -ENOMEM.
+                         */
+                        extra_size = user_length * descr->token_size;
+
+                        /* Note : user_length is originally a __u16,
+                         * and token_size is controlled by us,
+                         * so extra_size won't get negative and
+                         * won't overflow...
+                         */
+                }
+        }
+
+        /* kzalloc() ensures NULL-termination for essid_compat. */
+        extra = kzalloc(extra_size, GFP_KERNEL);
+        if (!extra)
+                return -ENOMEM;
+
+        /* If it is a SET, get all the extra data in here */
+        if (IW_IS_SET(cmd) && (iwp->length != 0)) {
+                if (copy_from_user(extra, iwp->pointer,
+                                   iwp->length *
+                                   descr->token_size)) {
+                        err = -EFAULT;
+                        goto out;
+                }
+        }
+
+        err = handler(dev, info, (union iwreq_data *) iwp, extra);
+
+        iwp->length += essid_compat;
+
+        /* If we have something to return to the user */
+        if (!err && IW_IS_GET(cmd)) {
+                /* Check if there is enough buffer up there */
+                if (user_length < iwp->length) {
+                        err = -E2BIG;
+                        goto out;
+                }
+
+                if (copy_to_user(iwp->pointer, extra,
+                                 iwp->length *
+                                 descr->token_size)) {
+                        err = -EFAULT;
+                        goto out;
+                }
+        }
+
+        /* Generate an event to notify listeners of the change */
+        if ((descr->flags & IW_DESCR_FLAG_EVENT) && err == -EIWCOMMIT) {
+                union iwreq_data *data = (union iwreq_data *) iwp;
+
+                if (descr->flags & IW_DESCR_FLAG_RESTRICT)
+                        /* If the event is restricted, don't
+                         * export the payload.
+                         */
+                        wireless_send_event(dev, cmd, data, NULL);
+                else
+                        wireless_send_event(dev, cmd, data, extra);
+        }
+
+out:
+        kfree(extra);
+        return err;
+}
+
 /*
  * Wrapper to call a standard Wireless Extension handler.
  * We do various checks and also take care of moving data between
  * user space and kernel space.
  */
 static int ioctl_standard_call(struct net_device *      dev,
-                               struct ifreq *           ifr,
+                               struct iwreq             *iwr,
                                unsigned int             cmd,
+                               struct iw_request_info   *info,
                                iw_handler               handler)
 {
-        struct iwreq *                          iwr = (struct iwreq *) ifr;
         const struct iw_ioctl_description *     descr;
-        struct iw_request_info                  info;
         int                                     ret = -EINVAL;
 
         /* Get the description of the IOCTL */
@@ -715,145 +845,19 @@ static int ioctl_standard_call(struct net_device *	dev,
                 return -EOPNOTSUPP;
         descr = &(standard_ioctl[cmd - SIOCIWFIRST]);
 
-        /* Prepare the call */
-        info.cmd = cmd;
-        info.flags = 0;
-
         /* Check if we have a pointer to user space data or not */
         if (descr->header_type != IW_HEADER_TYPE_POINT) {
 
                 /* No extra arguments. Trivial to handle */
-                ret = handler(dev, &info, &(iwr->u), NULL);
+                ret = handler(dev, info, &(iwr->u), NULL);
 
                 /* Generate an event to notify listeners of the change */
                 if ((descr->flags & IW_DESCR_FLAG_EVENT) &&
                    ((ret == 0) || (ret == -EIWCOMMIT)))
                         wireless_send_event(dev, cmd, &(iwr->u), NULL);
         } else {
-                char *  extra;
-                int     extra_size;
-                int     user_length = 0;
-                int     err;
-                int     essid_compat = 0;
-
-                /* Calculate space needed by arguments. Always allocate
-                 * for max space. Easier, and won't last long... */
-                extra_size = descr->max_tokens * descr->token_size;
-
-                /* Check need for ESSID compatibility for WE < 21 */
-                switch (cmd) {
-                case SIOCSIWESSID:
-                case SIOCGIWESSID:
-                case SIOCSIWNICKN:
-                case SIOCGIWNICKN:
-                        if (iwr->u.data.length == descr->max_tokens + 1)
-                                essid_compat = 1;
-                        else if (IW_IS_SET(cmd) && (iwr->u.data.length != 0)) {
-                                char essid[IW_ESSID_MAX_SIZE + 1];
-
-                                err = copy_from_user(essid, iwr->u.data.pointer,
-                                                     iwr->u.data.length *
-                                                     descr->token_size);
-                                if (err)
-                                        return -EFAULT;
-
-                                if (essid[iwr->u.data.length - 1] == '\0')
-                                        essid_compat = 1;
-                        }
-                        break;
-                default:
-                        break;
-                }
-
-                iwr->u.data.length -= essid_compat;
-
-                /* Check what user space is giving us */
-                if (IW_IS_SET(cmd)) {
-                        /* Check NULL pointer */
-                        if ((iwr->u.data.pointer == NULL) &&
-                           (iwr->u.data.length != 0))
-                                return -EFAULT;
-                        /* Check if number of token fits within bounds */
-                        if (iwr->u.data.length > descr->max_tokens)
-                                return -E2BIG;
-                        if (iwr->u.data.length < descr->min_tokens)
-                                return -EINVAL;
-                } else {
-                        /* Check NULL pointer */
-                        if (iwr->u.data.pointer == NULL)
-                                return -EFAULT;
-                        /* Save user space buffer size for checking */
-                        user_length = iwr->u.data.length;
-
-                        /* Don't check if user_length > max to allow forward
-                         * compatibility. The test user_length < min is
-                         * implied by the test at the end. */
-
-                        /* Support for very large requests */
-                        if ((descr->flags & IW_DESCR_FLAG_NOMAX) &&
-                           (user_length > descr->max_tokens)) {
-                                /* Allow userspace to GET more than max so
-                                 * we can support any size GET requests.
-                                 * There is still a limit : -ENOMEM. */
-                                extra_size = user_length * descr->token_size;
-                                /* Note : user_length is originally a __u16,
-                                 * and token_size is controlled by us,
-                                 * so extra_size won't get negative and
-                                 * won't overflow... */
-                        }
-                }
-
-                /* Create the kernel buffer */
-                /*    kzalloc ensures NULL-termination for essid_compat */
-                extra = kzalloc(extra_size, GFP_KERNEL);
-                if (extra == NULL)
-                        return -ENOMEM;
-
-                /* If it is a SET, get all the extra data in here */
-                if (IW_IS_SET(cmd) && (iwr->u.data.length != 0)) {
-                        err = copy_from_user(extra, iwr->u.data.pointer,
-                                             iwr->u.data.length *
-                                             descr->token_size);
-                        if (err) {
-                                kfree(extra);
-                                return -EFAULT;
-                        }
-                }
-
-                /* Call the handler */
-                ret = handler(dev, &info, &(iwr->u), extra);
-
-                iwr->u.data.length += essid_compat;
-
-                /* If we have something to return to the user */
-                if (!ret && IW_IS_GET(cmd)) {
-                        /* Check if there is enough buffer up there */
-                        if (user_length < iwr->u.data.length) {
-                                kfree(extra);
-                                return -E2BIG;
-                        }
-
-                        err = copy_to_user(iwr->u.data.pointer, extra,
-                                           iwr->u.data.length *
-                                           descr->token_size);
-                        if (err)
-                                ret =  -EFAULT;
-                }
-
-                /* Generate an event to notify listeners of the change */
-                if ((descr->flags & IW_DESCR_FLAG_EVENT) &&
-                   ((ret == 0) || (ret == -EIWCOMMIT))) {
-                        if (descr->flags & IW_DESCR_FLAG_RESTRICT)
-                                /* If the event is restricted, don't
-                                 * export the payload */
-                                wireless_send_event(dev, cmd, &(iwr->u), NULL);
-                        else
-                                wireless_send_event(dev, cmd, &(iwr->u),
-                                                    extra);
-                }
-
-                /* Cleanup - I told you it wasn't that long ;-) */
-                kfree(extra);
+                ret = ioctl_standard_iw_point(&iwr->u.data, cmd, descr,
+                                              handler, dev, info);
         }
 
         /* Call commit handler if needed and defined */
@@ -881,25 +885,22 @@ static int ioctl_standard_call(struct net_device *	dev,
  * a iw_handler but process it in your ioctl handler (i.e. use the
  * old driver API).
  */
-static int ioctl_private_call(struct net_device *dev, struct ifreq *ifr,
-                              unsigned int cmd, iw_handler handler)
+static int get_priv_descr_and_size(struct net_device *dev, unsigned int cmd,
+                                   const struct iw_priv_args **descrp)
 {
-        struct iwreq *                  iwr = (struct iwreq *) ifr;
-        const struct iw_priv_args *     descr = NULL;
-        struct iw_request_info          info;
-        int                             extra_size = 0;
-        int                             i;
-        int                             ret = -EINVAL;
+        const struct iw_priv_args *descr;
+        int i, extra_size;
 
-        /* Get the description of the IOCTL */
-        for (i = 0; i < dev->wireless_handlers->num_private_args; i++)
+        descr = NULL;
+        for (i = 0; i < dev->wireless_handlers->num_private_args; i++) {
                 if (cmd == dev->wireless_handlers->private_args[i].cmd) {
-                        descr = &(dev->wireless_handlers->private_args[i]);
+                        descr = &dev->wireless_handlers->private_args[i];
                         break;
                 }
+        }
 
-        /* Compute the size of the set/get arguments */
-        if (descr != NULL) {
+        extra_size = 0;
+        if (descr) {
                 if (IW_IS_SET(cmd)) {
                         int     offset = 0;     /* For sub-ioctls */
                         /* Check for sub-ioctl handler */
@@ -924,72 +925,77 @@ static int ioctl_private_call(struct net_device *dev, struct ifreq *ifr,
                                 extra_size = 0;
                 }
         }
+        *descrp = descr;
+        return extra_size;
+}
 
-        /* Prepare the call */
-        info.cmd = cmd;
-        info.flags = 0;
+static int ioctl_private_iw_point(struct iw_point *iwp, unsigned int cmd,
+                                  const struct iw_priv_args *descr,
+                                  iw_handler handler, struct net_device *dev,
+                                  struct iw_request_info *info, int extra_size)
+{
+        char *extra;
+        int err;
 
-        /* Check if we have a pointer to user space data or not. */
-        if (extra_size == 0) {
-                /* No extra arguments. Trivial to handle */
-                ret = handler(dev, &info, &(iwr->u), (char *) &(iwr->u));
-        } else {
-                char *  extra;
-                int     err;
+        /* Check what user space is giving us */
+        if (IW_IS_SET(cmd)) {
+                if (!iwp->pointer && iwp->length != 0)
+                        return -EFAULT;
 
-                /* Check what user space is giving us */
-                if (IW_IS_SET(cmd)) {
-                        /* Check NULL pointer */
-                        if ((iwr->u.data.pointer == NULL) &&
-                           (iwr->u.data.length != 0))
-                                return -EFAULT;
+                if (iwp->length > (descr->set_args & IW_PRIV_SIZE_MASK))
+                        return -E2BIG;
+        } else if (!iwp->pointer)
+                return -EFAULT;
 
-                        /* Does it fits within bounds ? */
-                        if (iwr->u.data.length > (descr->set_args &
-                                                 IW_PRIV_SIZE_MASK))
-                                return -E2BIG;
-                } else if (iwr->u.data.pointer == NULL)
-                        return -EFAULT;
+        extra = kmalloc(extra_size, GFP_KERNEL);
+        if (!extra)
+                return -ENOMEM;
 
-                /* Always allocate for max space. Easier, and won't last
-                 * long... */
-                extra = kmalloc(extra_size, GFP_KERNEL);
-                if (extra == NULL)
-                        return -ENOMEM;
-
-                /* If it is a SET, get all the extra data in here */
-                if (IW_IS_SET(cmd) && (iwr->u.data.length != 0)) {
-                        err = copy_from_user(extra, iwr->u.data.pointer,
-                                             extra_size);
-                        if (err) {
-                                kfree(extra);
-                                return -EFAULT;
-                        }
+        /* If it is a SET, get all the extra data in here */
+        if (IW_IS_SET(cmd) && (iwp->length != 0)) {
+                if (copy_from_user(extra, iwp->pointer, extra_size)) {
+                        err = -EFAULT;
+                        goto out;
                 }
+        }
 
-                /* Call the handler */
-                ret = handler(dev, &info, &(iwr->u), extra);
+        /* Call the handler */
+        err = handler(dev, info, (union iwreq_data *) iwp, extra);
 
-                /* If we have something to return to the user */
-                if (!ret && IW_IS_GET(cmd)) {
+        /* If we have something to return to the user */
+        if (!err && IW_IS_GET(cmd)) {
+                /* Adjust for the actual length if it's variable,
+                 * avoid leaking kernel bits outside.
+                 */
+                if (!(descr->get_args & IW_PRIV_SIZE_FIXED))
+                        extra_size = adjust_priv_size(descr->get_args, iwp);
 
-                        /* Adjust for the actual length if it's variable,
-                         * avoid leaking kernel bits outside. */
-                        if (!(descr->get_args & IW_PRIV_SIZE_FIXED)) {
-                                extra_size = adjust_priv_size(descr->get_args,
-                                                              &(iwr->u));
-                        }
+                if (copy_to_user(iwp->pointer, extra, extra_size))
+                        err =  -EFAULT;
+        }
 
-                        err = copy_to_user(iwr->u.data.pointer, extra,
-                                           extra_size);
-                        if (err)
-                                ret =  -EFAULT;
-                }
+out:
+        kfree(extra);
+        return err;
+}
 
-                /* Cleanup - I told you it wasn't that long ;-) */
-                kfree(extra);
-        }
+static int ioctl_private_call(struct net_device *dev, struct iwreq *iwr,
+                              unsigned int cmd, struct iw_request_info *info,
+                              iw_handler handler)
+{
+        int extra_size = 0, ret = -EINVAL;
+        const struct iw_priv_args *descr;
 
+        extra_size = get_priv_descr_and_size(dev, cmd, &descr);
+
+        /* Check if we have a pointer to user space data or not. */
+        if (extra_size == 0) {
+                /* No extra arguments. Trivial to handle */
+                ret = handler(dev, info, &(iwr->u), (char *) &(iwr->u));
+        } else {
+                ret = ioctl_private_iw_point(&iwr->u.data, cmd, descr,
+                                             handler, dev, info, extra_size);
+        }
 
         /* Call commit handler if needed and defined */
         if (ret == -EIWCOMMIT)
@@ -999,12 +1005,21 @@ static int ioctl_private_call(struct net_device *dev, struct ifreq *ifr,
 }
 
 /* ---------------------------------------------------------------- */
+typedef int (*wext_ioctl_func)(struct net_device *, struct iwreq *,
+                               unsigned int, struct iw_request_info *,
+                               iw_handler);
+
 /*
  * Main IOCTl dispatcher.
  * Check the type of IOCTL and call the appropriate wrapper...
  */
-static int wireless_process_ioctl(struct net *net, struct ifreq *ifr, unsigned int cmd)
+static int wireless_process_ioctl(struct net *net, struct ifreq *ifr,
+                                  unsigned int cmd,
+                                  struct iw_request_info *info,
+                                  wext_ioctl_func standard,
+                                  wext_ioctl_func private)
 {
+        struct iwreq *iwr = (struct iwreq *) ifr;
         struct net_device *dev;
         iw_handler      handler;
 
@@ -1019,12 +1034,12 @@ static int wireless_process_ioctl(struct net *net, struct ifreq *ifr, unsigned i
          * Note that 'cmd' is already filtered in dev_ioctl() with
          * (cmd >= SIOCIWFIRST && cmd <= SIOCIWLAST) */
         if (cmd == SIOCGIWSTATS)
-                return ioctl_standard_call(dev, ifr, cmd,
-                                           &iw_handler_get_iwstats);
+                return standard(dev, iwr, cmd, info,
+                                &iw_handler_get_iwstats);
 
         if (cmd == SIOCGIWPRIV && dev->wireless_handlers)
-                return ioctl_standard_call(dev, ifr, cmd,
-                                           &iw_handler_get_private);
+                return standard(dev, iwr, cmd, info,
+                                &iw_handler_get_private);
 
         /* Basic check */
         if (!netif_device_present(dev))
@@ -1035,9 +1050,9 @@ static int wireless_process_ioctl(struct net *net, struct ifreq *ifr, unsigned i
         if (handler) {
                 /* Standard and private are not the same */
                 if (cmd < SIOCIWFIRSTPRIV)
-                        return ioctl_standard_call(dev, ifr, cmd, handler);
+                        return standard(dev, iwr, cmd, info, handler);
                 else
-                        return ioctl_private_call(dev, ifr, cmd, handler);
+                        return private(dev, iwr, cmd, info, handler);
         }
         /* Old driver API : call driver ioctl handler */
         if (dev->do_ioctl)
@@ -1045,27 +1060,154 @@ static int wireless_process_ioctl(struct net *net, struct ifreq *ifr, unsigned i
         return -EOPNOTSUPP;
 }
 
-/* entry point from dev ioctl */
-int wext_handle_ioctl(struct net *net, struct ifreq *ifr, unsigned int cmd,
-                      void __user *arg)
+/* If command is `set a parameter', or `get the encoding parameters',
+ * check if the user has the right to do it.
+ */
+static int wext_permission_check(unsigned int cmd)
 {
-        int ret;
-
-        /* If command is `set a parameter', or
-         * `get the encoding parameters', check if
-         * the user has the right to do it */
         if ((IW_IS_SET(cmd) || cmd == SIOCGIWENCODE || cmd == SIOCGIWENCODEEXT)
             && !capable(CAP_NET_ADMIN))
                 return -EPERM;
 
+        return 0;
+}
+
+/* entry point from dev ioctl */
+static int wext_ioctl_dispatch(struct net *net, struct ifreq *ifr,
+                               unsigned int cmd, struct iw_request_info *info,
+                               wext_ioctl_func standard,
+                               wext_ioctl_func private)
+{
+        int ret = wext_permission_check(cmd);
+
+        if (ret)
+                return ret;
+
         dev_load(net, ifr->ifr_name);
         rtnl_lock();
-        ret = wireless_process_ioctl(net, ifr, cmd);
+        ret = wireless_process_ioctl(net, ifr, cmd, info, standard, private);
         rtnl_unlock();
-        if (IW_IS_GET(cmd) && copy_to_user(arg, ifr, sizeof(struct iwreq)))
+
+        return ret;
+}
+
+int wext_handle_ioctl(struct net *net, struct ifreq *ifr, unsigned int cmd,
+                      void __user *arg)
+{
+        struct iw_request_info info = { .cmd = cmd, .flags = 0 };
+        int ret;
+
+        ret = wext_ioctl_dispatch(net, ifr, cmd, &info,
+                                  ioctl_standard_call,
+                                  ioctl_private_call);
+        if (ret >= 0 &&
+            IW_IS_GET(cmd) &&
+            copy_to_user(arg, ifr, sizeof(struct iwreq)))
+                return -EFAULT;
+
+        return ret;
+}
+
+#ifdef CONFIG_COMPAT
+static int compat_standard_call(struct net_device       *dev,
+                                struct iwreq            *iwr,
+                                unsigned int            cmd,
+                                struct iw_request_info  *info,
+                                iw_handler              handler)
+{
+        const struct iw_ioctl_description *descr;
+        struct compat_iw_point *iwp_compat;
+        struct iw_point iwp;
+        int err;
+
+        descr = standard_ioctl + (cmd - SIOCIWFIRST);
+
+        if (descr->header_type != IW_HEADER_TYPE_POINT)
+                return ioctl_standard_call(dev, iwr, cmd, info, handler);
+
+        iwp_compat = (struct compat_iw_point *) &iwr->u.data;
+        iwp.pointer = compat_ptr(iwp_compat->pointer);
+        iwp.length = iwp_compat->length;
+        iwp.flags = iwp_compat->flags;
+
+        err = ioctl_standard_iw_point(&iwp, cmd, descr, handler, dev, info);
+
+        iwp_compat->pointer = ptr_to_compat(iwp.pointer);
+        iwp_compat->length = iwp.length;
+        iwp_compat->flags = iwp.flags;
+
+        return err;
+}
+
+static int compat_private_call(struct net_device *dev, struct iwreq *iwr,
+                               unsigned int cmd, struct iw_request_info *info,
+                               iw_handler handler)
+{
+        const struct iw_priv_args *descr;
+        int ret, extra_size;
+
+        extra_size = get_priv_descr_and_size(dev, cmd, &descr);
+
+        /* Check if we have a pointer to user space data or not. */
+        if (extra_size == 0) {
+                /* No extra arguments. Trivial to handle */
+                ret = handler(dev, info, &(iwr->u), (char *) &(iwr->u));
+        } else {
+                struct compat_iw_point *iwp_compat;
+                struct iw_point iwp;
+
+                iwp_compat = (struct compat_iw_point *) &iwr->u.data;
+                iwp.pointer = compat_ptr(iwp_compat->pointer);
+                iwp.length = iwp_compat->length;
+                iwp.flags = iwp_compat->flags;
+
+                ret = ioctl_private_iw_point(&iwp, cmd, descr,
+                                             handler, dev, info, extra_size);
+
+                iwp_compat->pointer = ptr_to_compat(iwp.pointer);
+                iwp_compat->length = iwp.length;
+                iwp_compat->flags = iwp.flags;
+        }
+
+        /* Call commit handler if needed and defined */
+        if (ret == -EIWCOMMIT)
+                ret = call_commit_handler(dev);
+
+        return ret;
+}
+
+int compat_wext_handle_ioctl(struct net *net, unsigned int cmd,
+                             unsigned long arg)
+{
+        void __user *argp = (void __user *)arg;
+        struct iw_request_info info;
+        struct iwreq iwr;
+        char *colon;
+        int ret;
+
+        if (copy_from_user(&iwr, argp, sizeof(struct iwreq)))
+                return -EFAULT;
+
+        iwr.ifr_name[IFNAMSIZ-1] = 0;
+        colon = strchr(iwr.ifr_name, ':');
+        if (colon)
+                *colon = 0;
+
+        info.cmd = cmd;
+        info.flags = IW_REQUEST_FLAG_COMPAT;
+
+        ret = wext_ioctl_dispatch(net, (struct ifreq *) &iwr, cmd, &info,
+                                  compat_standard_call,
+                                  compat_private_call);
+
+        if (ret >= 0 &&
+            IW_IS_GET(cmd) &&
+            copy_to_user(argp, &iwr, sizeof(struct iwreq)))
                 return -EFAULT;
+
         return ret;
 }
+#endif
 
 /************************* EVENT PROCESSING *************************/
 /*