121 files changed, 6402 insertions, 3199 deletions

diff --git a/net/802/psnap.c b/net/802/psnap.c
index 70980baeb682..6ed711748f26 100644
--- a/net/802/psnap.c
+++ b/net/802/psnap.c
@@ -51,7 +51,7 @@ static int snap_rcv(struct sk_buff *skb, struct net_device *dev,
         int rc = 1;
         struct datalink_proto *proto;
         static struct packet_type snap_packet_type = {
-                .type = __constant_htons(ETH_P_SNAP),
+                .type = cpu_to_be16(ETH_P_SNAP),
         };
 
         if (unlikely(!pskb_may_pull(skb, 5)))
diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
index 41e8f65bd3f0..4163ea65bf41 100644
--- a/net/8021q/vlan.c
+++ b/net/8021q/vlan.c
@@ -52,7 +52,7 @@ static const char vlan_copyright[] = "Ben Greear <greearb@candelatech.com>";
 static const char vlan_buggyright[] = "David S. Miller <davem@redhat.com>";
 
 static struct packet_type vlan_packet_type = {
-        .type = __constant_htons(ETH_P_8021Q),
+        .type = cpu_to_be16(ETH_P_8021Q),
         .func = vlan_skb_recv, /* VLAN receive method */
 };
 
diff --git a/net/8021q/vlan_core.c b/net/8021q/vlan_core.c
index e9db889d6222..70435af153f2 100644
--- a/net/8021q/vlan_core.c
+++ b/net/8021q/vlan_core.c
@@ -85,7 +85,9 @@ static int vlan_gro_common(struct napi_struct *napi, struct vlan_group *grp,
                 goto drop;
 
         for (p = napi->gro_list; p; p = p->next) {
-                NAPI_GRO_CB(p)->same_flow = p->dev == skb->dev;
+                NAPI_GRO_CB(p)->same_flow =
+                        p->dev == skb->dev && !compare_ether_header(
+                                skb_mac_header(p), skb_gro_mac_header(skb));
                 NAPI_GRO_CB(p)->flush = 0;
         }
 
@@ -98,22 +100,9 @@ drop:
 int vlan_gro_receive(struct napi_struct *napi, struct vlan_group *grp,
                      unsigned int vlan_tci, struct sk_buff *skb)
 {
-        int err = NET_RX_SUCCESS;
+        skb_gro_reset_offset(skb);
 
-        switch (vlan_gro_common(napi, grp, vlan_tci, skb)) {
-        case -1:
-                return netif_receive_skb(skb);
-
-        case 2:
-                err = NET_RX_DROP;
-                /* fall through */
-
-        case 1:
-                kfree_skb(skb);
-                break;
-        }
-
-        return err;
+        return napi_skb_finish(vlan_gro_common(napi, grp, vlan_tci, skb), skb);
 }
 EXPORT_SYMBOL(vlan_gro_receive);
 
@@ -121,27 +110,11 @@ int vlan_gro_frags(struct napi_struct *napi, struct vlan_group *grp,
                    unsigned int vlan_tci, struct napi_gro_fraginfo *info)
 {
         struct sk_buff *skb = napi_fraginfo_skb(napi, info);
-        int err = NET_RX_DROP;
 
         if (!skb)
-                goto out;
-
-        err = NET_RX_SUCCESS;
-
-        switch (vlan_gro_common(napi, grp, vlan_tci, skb)) {
-        case -1:
-                return netif_receive_skb(skb);
-
-        case 2:
-                err = NET_RX_DROP;
-                /* fall through */
-
-        case 1:
-                napi_reuse_skb(napi, skb);
-                break;
-        }
+                return NET_RX_DROP;
 
-out:
-        return err;
+        return napi_frags_finish(napi, skb,
+                                 vlan_gro_common(napi, grp, vlan_tci, skb));
 }
 EXPORT_SYMBOL(vlan_gro_frags);
diff --git a/net/Kconfig b/net/Kconfig
index cdb8fdef6c4a..a12bae0e3fe9 100644
--- a/net/Kconfig
+++ b/net/Kconfig
@@ -185,6 +185,7 @@ source "net/x25/Kconfig"
 source "net/lapb/Kconfig"
 source "net/econet/Kconfig"
 source "net/wanrouter/Kconfig"
+source "net/phonet/Kconfig"
 source "net/sched/Kconfig"
 source "net/dcb/Kconfig"
 
@@ -229,7 +230,6 @@ source "net/can/Kconfig"
 source "net/irda/Kconfig"
 source "net/bluetooth/Kconfig"
 source "net/rxrpc/Kconfig"
-source "net/phonet/Kconfig"
 
 config FIB_RULES
         bool
diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c
index 5abce07fb50a..510a6782da8f 100644
--- a/net/appletalk/ddp.c
+++ b/net/appletalk/ddp.c
@@ -1861,12 +1861,12 @@ static struct notifier_block ddp_notifier = {
 };
 
 static struct packet_type ltalk_packet_type = {
-        .type           = __constant_htons(ETH_P_LOCALTALK),
+        .type           = cpu_to_be16(ETH_P_LOCALTALK),
         .func           = ltalk_rcv,
 };
 
 static struct packet_type ppptalk_packet_type = {
-        .type           = __constant_htons(ETH_P_PPPTALK),
+        .type           = cpu_to_be16(ETH_P_PPPTALK),
         .func           = atalk_rcv,
 };
 
diff --git a/net/appletalk/dev.c b/net/appletalk/dev.c
index d856a62ab50f..72277d70c980 100644
--- a/net/appletalk/dev.c
+++ b/net/appletalk/dev.c
@@ -9,22 +9,20 @@
 #include <linux/if_arp.h>
 #include <linux/if_ltalk.h>
 
+#ifdef CONFIG_COMPAT_NET_DEV_OPS
 static int ltalk_change_mtu(struct net_device *dev, int mtu)
 {
         return -EINVAL;
 }
-
-static int ltalk_mac_addr(struct net_device *dev, void *addr)
-{
-        return -EINVAL;
-}
+#endif
 
 static void ltalk_setup(struct net_device *dev)
 {
         /* Fill in the fields of the device structure with localtalk-generic values. */
 
+#ifdef CONFIG_COMPAT_NET_DEV_OPS
         dev->change_mtu         = ltalk_change_mtu;
-        dev->set_mac_address    = ltalk_mac_addr;
+#endif
 
         dev->type               = ARPHRD_LOCALTLK;
         dev->hard_header_len    = LTALK_HLEN;
diff --git a/net/atm/br2684.c b/net/atm/br2684.c
index ea9438fc6855..334fcd4a4ea4 100644
--- a/net/atm/br2684.c
+++ b/net/atm/br2684.c
@@ -83,7 +83,6 @@ struct br2684_dev {
         struct list_head br2684_devs;
         int number;
         struct list_head brvccs;        /* one device <=> one vcc (before xmas) */
-        struct net_device_stats stats;
         int mac_was_set;
         enum br2684_payload payload;
 };
@@ -148,9 +147,10 @@ static struct net_device *br2684_find_dev(const struct br2684_if_spec *s)
  * the way for multiple vcc's per itf.  Returns true if we can send,
  * otherwise false
  */
-static int br2684_xmit_vcc(struct sk_buff *skb, struct br2684_dev *brdev,
+static int br2684_xmit_vcc(struct sk_buff *skb, struct net_device *dev,
                            struct br2684_vcc *brvcc)
 {
+        struct br2684_dev *brdev = BRPRIV(dev);
         struct atm_vcc *atmvcc;
         int minheadroom = (brvcc->encaps == e_llc) ? 10 : 2;
 
@@ -211,8 +211,8 @@ static int br2684_xmit_vcc(struct sk_buff *skb, struct br2684_dev *brdev,
         }
         atomic_add(skb->truesize, &sk_atm(atmvcc)->sk_wmem_alloc);
         ATM_SKB(skb)->atm_options = atmvcc->atm_options;
-        brdev->stats.tx_packets++;
-        brdev->stats.tx_bytes += skb->len;
+        dev->stats.tx_packets++;
+        dev->stats.tx_bytes += skb->len;
         atmvcc->send(atmvcc, skb);
         return 1;
 }
@@ -233,14 +233,14 @@ static int br2684_start_xmit(struct sk_buff *skb, struct net_device *dev)
         brvcc = pick_outgoing_vcc(skb, brdev);
         if (brvcc == NULL) {
                 pr_debug("no vcc attached to dev %s\n", dev->name);
-                brdev->stats.tx_errors++;
-                brdev->stats.tx_carrier_errors++;
+                dev->stats.tx_errors++;
+                dev->stats.tx_carrier_errors++;
                 /* netif_stop_queue(dev); */
                 dev_kfree_skb(skb);
                 read_unlock(&devs_lock);
                 return 0;
         }
-        if (!br2684_xmit_vcc(skb, brdev, brvcc)) {
+        if (!br2684_xmit_vcc(skb, dev, brvcc)) {
                 /*
                  * We should probably use netif_*_queue() here, but that
                  * involves added complication.  We need to walk before
@@ -248,27 +248,20 @@ static int br2684_start_xmit(struct sk_buff *skb, struct net_device *dev)
                  *
                  * Don't free here! this pointer might be no longer valid!
                  */
-                brdev->stats.tx_errors++;
-                brdev->stats.tx_fifo_errors++;
+                dev->stats.tx_errors++;
+                dev->stats.tx_fifo_errors++;
         }
         read_unlock(&devs_lock);
         return 0;
 }
 
-static struct net_device_stats *br2684_get_stats(struct net_device *dev)
-{
-        pr_debug("br2684_get_stats\n");
-        return &BRPRIV(dev)->stats;
-}
-
 /*
  * We remember when the MAC gets set, so we don't override it later with
  * the ESI of the ATM card of the first VC
  */
-static int (*my_eth_mac_addr) (struct net_device *, void *);
 static int br2684_mac_addr(struct net_device *dev, void *p)
 {
-        int err = my_eth_mac_addr(dev, p);
+        int err = eth_mac_addr(dev, p);
         if (!err)
                 BRPRIV(dev)->mac_was_set = 1;
         return err;
@@ -430,17 +423,17 @@ static void br2684_push(struct atm_vcc *atmvcc, struct sk_buff *skb)
         /* sigh, interface is down? */
         if (unlikely(!(net_dev->flags & IFF_UP)))
                 goto dropped;
-        brdev->stats.rx_packets++;
-        brdev->stats.rx_bytes += skb->len;
+        net_dev->stats.rx_packets++;
+        net_dev->stats.rx_bytes += skb->len;
         memset(ATM_SKB(skb), 0, sizeof(struct atm_skb_data));
         netif_rx(skb);
         return;
 
 dropped:
-        brdev->stats.rx_dropped++;
+        net_dev->stats.rx_dropped++;
         goto free_skb;
 error:
-        brdev->stats.rx_errors++;
+        net_dev->stats.rx_errors++;
 free_skb:
         dev_kfree_skb(skb);
         return;
@@ -531,8 +524,8 @@ static int br2684_regvcc(struct atm_vcc *atmvcc, void __user * arg)
 
                 skb->next = skb->prev = NULL;
                 br2684_push(atmvcc, skb);
-                BRPRIV(skb->dev)->stats.rx_bytes -= skb->len;
-                BRPRIV(skb->dev)->stats.rx_packets--;
+                skb->dev->stats.rx_bytes -= skb->len;
+                skb->dev->stats.rx_packets--;
 
                 skb = next;
         }
@@ -544,17 +537,20 @@ static int br2684_regvcc(struct atm_vcc *atmvcc, void __user * arg)
         return err;
 }
 
+static const struct net_device_ops br2684_netdev_ops = {
+        .ndo_start_xmit         = br2684_start_xmit,
+        .ndo_set_mac_address    = br2684_mac_addr,
+        .ndo_change_mtu         = eth_change_mtu,
+        .ndo_validate_addr      = eth_validate_addr,
+};
+
 static void br2684_setup(struct net_device *netdev)
 {
         struct br2684_dev *brdev = BRPRIV(netdev);
 
         ether_setup(netdev);
-        brdev->net_dev = netdev;
 
-        my_eth_mac_addr = netdev->set_mac_address;
-        netdev->set_mac_address = br2684_mac_addr;
-        netdev->hard_start_xmit = br2684_start_xmit;
-        netdev->get_stats = br2684_get_stats;
+        netdev->netdev_ops = &br2684_netdev_ops;
 
         INIT_LIST_HEAD(&brdev->brvccs);
 }
@@ -565,10 +561,8 @@ static void br2684_setup_routed(struct net_device *netdev)
         brdev->net_dev = netdev;
 
         netdev->hard_header_len = 0;
-        my_eth_mac_addr = netdev->set_mac_address;
-        netdev->set_mac_address = br2684_mac_addr;
-        netdev->hard_start_xmit = br2684_start_xmit;
-        netdev->get_stats = br2684_get_stats;
+
+        netdev->netdev_ops = &br2684_netdev_ops;
         netdev->addr_len = 0;
         netdev->mtu = 1500;
         netdev->type = ARPHRD_PPP;
diff --git a/net/atm/clip.c b/net/atm/clip.c
index 2d33a83be799..da42fd06b61f 100644
--- a/net/atm/clip.c
+++ b/net/atm/clip.c
@@ -214,15 +214,15 @@ static void clip_push(struct atm_vcc *vcc, struct sk_buff *skb)
                 skb->protocol = ((__be16 *) skb->data)[3];
                 skb_pull(skb, RFC1483LLC_LEN);
                 if (skb->protocol == htons(ETH_P_ARP)) {
-                        PRIV(skb->dev)->stats.rx_packets++;
-                        PRIV(skb->dev)->stats.rx_bytes += skb->len;
+                        skb->dev->stats.rx_packets++;
+                        skb->dev->stats.rx_bytes += skb->len;
                         clip_arp_rcv(skb);
                         return;
                 }
         }
         clip_vcc->last_use = jiffies;
-        PRIV(skb->dev)->stats.rx_packets++;
-        PRIV(skb->dev)->stats.rx_bytes += skb->len;
+        skb->dev->stats.rx_packets++;
+        skb->dev->stats.rx_bytes += skb->len;
         memset(ATM_SKB(skb), 0, sizeof(struct atm_skb_data));
         netif_rx(skb);
 }
@@ -372,7 +372,7 @@ static int clip_start_xmit(struct sk_buff *skb, struct net_device *dev)
         if (!skb->dst) {
                 printk(KERN_ERR "clip_start_xmit: skb->dst == NULL\n");
                 dev_kfree_skb(skb);
-                clip_priv->stats.tx_dropped++;
+                dev->stats.tx_dropped++;
                 return 0;
         }
         if (!skb->dst->neighbour) {
@@ -380,13 +380,13 @@ static int clip_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 skb->dst->neighbour = clip_find_neighbour(skb->dst, 1);
                 if (!skb->dst->neighbour) {
                         dev_kfree_skb(skb);     /* lost that one */
-                        clip_priv->stats.tx_dropped++;
+                        dev->stats.tx_dropped++;
                         return 0;
                 }
 #endif
                 printk(KERN_ERR "clip_start_xmit: NO NEIGHBOUR !\n");
                 dev_kfree_skb(skb);
-                clip_priv->stats.tx_dropped++;
+                dev->stats.tx_dropped++;
                 return 0;
         }
         entry = NEIGH2ENTRY(skb->dst->neighbour);
@@ -400,7 +400,7 @@ static int clip_start_xmit(struct sk_buff *skb, struct net_device *dev)
                         skb_queue_tail(&entry->neigh->arp_queue, skb);
                 else {
                         dev_kfree_skb(skb);
-                        clip_priv->stats.tx_dropped++;
+                        dev->stats.tx_dropped++;
                 }
                 return 0;
         }
@@ -423,8 +423,8 @@ static int clip_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 printk(KERN_WARNING "clip_start_xmit: XOFF->XOFF transition\n");
                 return 0;
         }
-        clip_priv->stats.tx_packets++;
-        clip_priv->stats.tx_bytes += skb->len;
+        dev->stats.tx_packets++;
+        dev->stats.tx_bytes += skb->len;
         vcc->send(vcc, skb);
         if (atm_may_send(vcc, 0)) {
                 entry->vccs->xoff = 0;
@@ -443,11 +443,6 @@ static int clip_start_xmit(struct sk_buff *skb, struct net_device *dev)
         return 0;
 }
 
-static struct net_device_stats *clip_get_stats(struct net_device *dev)
-{
-        return &PRIV(dev)->stats;
-}
-
 static int clip_mkip(struct atm_vcc *vcc, int timeout)
 {
         struct clip_vcc *clip_vcc;
@@ -501,8 +496,8 @@ static int clip_mkip(struct atm_vcc *vcc, int timeout)
 
                         skb_get(skb);
                         clip_push(vcc, skb);
-                        PRIV(skb->dev)->stats.rx_packets--;
-                        PRIV(skb->dev)->stats.rx_bytes -= len;
+                        skb->dev->stats.rx_packets--;
+                        skb->dev->stats.rx_bytes -= len;
                         kfree_skb(skb);
                 }
 
@@ -561,7 +556,6 @@ static void clip_setup(struct net_device *dev)
 {
         dev->hard_start_xmit = clip_start_xmit;
         /* sg_xmit ... */
-        dev->get_stats = clip_get_stats;
         dev->type = ARPHRD_ATM;
         dev->hard_header_len = RFC1483LLC_LEN;
         dev->mtu = RFC1626_MTU;
diff --git a/net/atm/lec.c b/net/atm/lec.c
index e5e301550e8a..c0cba9a037e8 100644
--- a/net/atm/lec.c
+++ b/net/atm/lec.c
@@ -62,7 +62,6 @@ static unsigned char bridge_ula_lec[] = { 0x01, 0x80, 0xc2, 0x00, 0x00 };
 static int lec_open(struct net_device *dev);
 static int lec_start_xmit(struct sk_buff *skb, struct net_device *dev);
 static int lec_close(struct net_device *dev);
-static struct net_device_stats *lec_get_stats(struct net_device *dev);
 static void lec_init(struct net_device *dev);
 static struct lec_arp_table *lec_arp_find(struct lec_priv *priv,
                                           const unsigned char *mac_addr);
@@ -218,28 +217,28 @@ static unsigned char *get_tr_dst(unsigned char *packet, unsigned char *rdesc)
 
 static int lec_open(struct net_device *dev)
 {
-        struct lec_priv *priv = netdev_priv(dev);
-
         netif_start_queue(dev);
-        memset(&priv->stats, 0, sizeof(struct net_device_stats));
+        memset(&dev->stats, 0, sizeof(struct net_device_stats));
 
         return 0;
 }
 
-static __inline__ void
-lec_send(struct atm_vcc *vcc, struct sk_buff *skb, struct lec_priv *priv)
+static void
+lec_send(struct atm_vcc *vcc, struct sk_buff *skb)
 {
+        struct net_device *dev = skb->dev;
+
         ATM_SKB(skb)->vcc = vcc;
         ATM_SKB(skb)->atm_options = vcc->atm_options;
 
         atomic_add(skb->truesize, &sk_atm(vcc)->sk_wmem_alloc);
         if (vcc->send(vcc, skb) < 0) {
-                priv->stats.tx_dropped++;
+                dev->stats.tx_dropped++;
                 return;
         }
 
-        priv->stats.tx_packets++;
-        priv->stats.tx_bytes += skb->len;
+        dev->stats.tx_packets++;
+        dev->stats.tx_bytes += skb->len;
 }
 
 static void lec_tx_timeout(struct net_device *dev)
@@ -270,7 +269,7 @@ static int lec_start_xmit(struct sk_buff *skb, struct net_device *dev)
         pr_debug("lec_start_xmit called\n");
         if (!priv->lecd) {
                 printk("%s:No lecd attached\n", dev->name);
-                priv->stats.tx_errors++;
+                dev->stats.tx_errors++;
                 netif_stop_queue(dev);
                 return -EUNATCH;
         }
@@ -345,7 +344,7 @@ static int lec_start_xmit(struct sk_buff *skb, struct net_device *dev)
                                                GFP_ATOMIC);
                         dev_kfree_skb(skb);
                         if (skb2 == NULL) {
-                                priv->stats.tx_dropped++;
+                                dev->stats.tx_dropped++;
                                 return 0;
                         }
                         skb = skb2;
@@ -380,7 +379,7 @@ static int lec_start_xmit(struct sk_buff *skb, struct net_device *dev)
                             ("%s:lec_start_xmit: tx queue full or no arp entry, dropping, ",
                              dev->name);
                         pr_debug("MAC address %pM\n", lec_h->h_dest);
-                        priv->stats.tx_dropped++;
+                        dev->stats.tx_dropped++;
                         dev_kfree_skb(skb);
                 }
                 goto out;
@@ -392,10 +391,10 @@ static int lec_start_xmit(struct sk_buff *skb, struct net_device *dev)
         while (entry && (skb2 = skb_dequeue(&entry->tx_wait))) {
                 pr_debug("lec.c: emptying tx queue, ");
                 pr_debug("MAC address %pM\n", lec_h->h_dest);
-                lec_send(vcc, skb2, priv);
+                lec_send(vcc, skb2);
         }
 
-        lec_send(vcc, skb, priv);
+        lec_send(vcc, skb);
 
         if (!atm_may_send(vcc, 0)) {
                 struct lec_vcc_priv *vpriv = LEC_VCC_PRIV(vcc);
@@ -427,15 +426,6 @@ static int lec_close(struct net_device *dev)
         return 0;
 }
 
-/*
- * Get the current statistics.
- * This may be called with the card open or closed.
- */
-static struct net_device_stats *lec_get_stats(struct net_device *dev)
-{
-        return &((struct lec_priv *)netdev_priv(dev))->stats;
-}
-
 static int lec_atm_send(struct atm_vcc *vcc, struct sk_buff *skb)
 {
         unsigned long flags;
@@ -677,17 +667,19 @@ static void lec_set_multicast_list(struct net_device *dev)
         return;
 }
 
+static const struct net_device_ops lec_netdev_ops = {
+        .ndo_open               = lec_open,
+        .ndo_stop               = lec_close,
+        .ndo_start_xmit         = lec_start_xmit,
+        .ndo_change_mtu         = lec_change_mtu,
+        .ndo_tx_timeout         = lec_tx_timeout,
+        .ndo_set_multicast_list = lec_set_multicast_list,
+};
+
+
 static void lec_init(struct net_device *dev)
 {
-        dev->change_mtu = lec_change_mtu;
-        dev->open = lec_open;
-        dev->stop = lec_close;
-        dev->hard_start_xmit = lec_start_xmit;
-        dev->tx_timeout = lec_tx_timeout;
-
-        dev->get_stats = lec_get_stats;
-        dev->set_multicast_list = lec_set_multicast_list;
-        dev->do_ioctl = NULL;
+        dev->netdev_ops = &lec_netdev_ops;
         printk("%s: Initialized!\n", dev->name);
 }
 
@@ -810,8 +802,8 @@ static void lec_push(struct atm_vcc *vcc, struct sk_buff *skb)
                 else
 #endif
                         skb->protocol = eth_type_trans(skb, dev);
-                priv->stats.rx_packets++;
-                priv->stats.rx_bytes += skb->len;
+                dev->stats.rx_packets++;
+                dev->stats.rx_bytes += skb->len;
                 memset(ATM_SKB(skb), 0, sizeof(struct atm_skb_data));
                 netif_rx(skb);
         }
@@ -1887,7 +1879,7 @@ restart:
                                         lec_arp_hold(entry);
                                         spin_unlock_irqrestore(&priv->lec_arp_lock, flags);
                                         while ((skb = skb_dequeue(&entry->tx_wait)) != NULL)
-                                                lec_send(vcc, skb, entry->priv);
+                                                lec_send(vcc, skb);
                                         entry->last_used = jiffies;
                                         entry->status = ESI_FORWARD_DIRECT;
                                         lec_arp_put(entry);
@@ -2305,7 +2297,7 @@ restart:
                                 lec_arp_hold(entry);
                                 spin_unlock_irqrestore(&priv->lec_arp_lock, flags);
                                 while ((skb = skb_dequeue(&entry->tx_wait)) != NULL)
-                                        lec_send(vcc, skb, entry->priv);
+                                        lec_send(vcc, skb);
                                 entry->last_used = jiffies;
                                 entry->status = ESI_FORWARD_DIRECT;
                                 lec_arp_put(entry);
diff --git a/net/atm/lec.h b/net/atm/lec.h
index 0d376682c1a3..9d14d196cc1d 100644
--- a/net/atm/lec.h
+++ b/net/atm/lec.h
@@ -69,7 +69,6 @@ struct lane2_ops {
 #define LEC_ARP_TABLE_SIZE 16
 
 struct lec_priv {
-        struct net_device_stats stats;
         unsigned short lecid;                   /* Lecid of this client */
         struct hlist_head lec_arp_empty_ones;
                                                 /* Used for storing VCC's that don't have a MAC address attached yet */
diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
index 00d9e5e13158..d127fd3ba5c6 100644
--- a/net/ax25/af_ax25.c
+++ b/net/ax25/af_ax25.c
@@ -1986,7 +1986,7 @@ static const struct proto_ops ax25_proto_ops = {
  *      Called by socket.c on kernel start up
  */
 static struct packet_type ax25_packet_type = {
-        .type   =       __constant_htons(ETH_P_AX25),
+        .type   =       cpu_to_be16(ETH_P_AX25),
         .dev    =       NULL,                           /* All devices */
         .func   =       ax25_kiss_rcv,
 };
diff --git a/net/ax25/ax25_iface.c b/net/ax25/ax25_iface.c
index 8443af57a374..71338f112108 100644
--- a/net/ax25/ax25_iface.c
+++ b/net/ax25/ax25_iface.c
@@ -61,27 +61,24 @@ void ax25_protocol_release(unsigned int pid)
 
         write_lock_bh(&protocol_list_lock);
         protocol = protocol_list;
-        if (protocol == NULL) {
-                write_unlock_bh(&protocol_list_lock);
-                return;
-        }
+        if (protocol == NULL)
+                goto out;
 
         if (protocol->pid == pid) {
                 protocol_list = protocol->next;
-                write_unlock_bh(&protocol_list_lock);
-                return;
+                goto out;
         }
 
         while (protocol != NULL && protocol->next != NULL) {
                 if (protocol->next->pid == pid) {
                         s = protocol->next;
                         protocol->next = protocol->next->next;
-                        write_unlock_bh(&protocol_list_lock);
-                        return;
+                        goto out;
                 }
 
                 protocol = protocol->next;
         }
+out:
         write_unlock_bh(&protocol_list_lock);
 }
 
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index cf754ace0b75..3953ac4214c8 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -107,7 +107,7 @@ static void fake_update_pmtu(struct dst_entry *dst, u32 mtu)
 
 static struct dst_ops fake_dst_ops = {
         .family =               AF_INET,
-        .protocol =             __constant_htons(ETH_P_IP),
+        .protocol =             cpu_to_be16(ETH_P_IP),
         .update_pmtu =          fake_update_pmtu,
         .entries =              ATOMIC_INIT(0),
 };
diff --git a/net/can/af_can.c b/net/can/af_can.c
index fa417ca6cbe6..d90e8dd975fc 100644
--- a/net/can/af_can.c
+++ b/net/can/af_can.c
@@ -828,7 +828,7 @@ static int can_notifier(struct notifier_block *nb, unsigned long msg,
  */
 
 static struct packet_type can_packet __read_mostly = {
-        .type = __constant_htons(ETH_P_CAN),
+        .type = cpu_to_be16(ETH_P_CAN),
         .dev  = NULL,
         .func = can_rcv,
 };
diff --git a/net/core/dev.c b/net/core/dev.c
index a17e00662363..1e27a67df242 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -135,6 +135,14 @@
 /* This should be increased if a protocol with a bigger head is added. */
 #define GRO_MAX_HEAD (MAX_HEADER + 128)
 
+enum {
+        GRO_MERGED,
+        GRO_MERGED_FREE,
+        GRO_HELD,
+        GRO_NORMAL,
+        GRO_DROP,
+};
+
 /*
  *      The list of packet types we will receive (as opposed to discard)
  *      and the routines to invoke.
@@ -1708,56 +1716,26 @@ out_kfree_skb:
         return 0;
 }
 
-static u32 simple_tx_hashrnd;
-static int simple_tx_hashrnd_initialized = 0;
+static u32 skb_tx_hashrnd;
+static int skb_tx_hashrnd_initialized = 0;
 
-static u16 simple_tx_hash(struct net_device *dev, struct sk_buff *skb)
+static u16 skb_tx_hash(struct net_device *dev, struct sk_buff *skb)
 {
-        u32 addr1, addr2, ports;
-        u32 hash, ihl;
-        u8 ip_proto = 0;
+        u32 hash;
 
-        if (unlikely(!simple_tx_hashrnd_initialized)) {
-                get_random_bytes(&simple_tx_hashrnd, 4);
-                simple_tx_hashrnd_initialized = 1;
+        if (unlikely(!skb_tx_hashrnd_initialized)) {
+                get_random_bytes(&skb_tx_hashrnd, 4);
+                skb_tx_hashrnd_initialized = 1;
         }
 
-        switch (skb->protocol) {
-        case htons(ETH_P_IP):
-                if (!(ip_hdr(skb)->frag_off & htons(IP_MF | IP_OFFSET)))
-                        ip_proto = ip_hdr(skb)->protocol;
-                addr1 = ip_hdr(skb)->saddr;
-                addr2 = ip_hdr(skb)->daddr;
-                ihl = ip_hdr(skb)->ihl;
-                break;
-        case htons(ETH_P_IPV6):
-                ip_proto = ipv6_hdr(skb)->nexthdr;
-                addr1 = ipv6_hdr(skb)->saddr.s6_addr32[3];
-                addr2 = ipv6_hdr(skb)->daddr.s6_addr32[3];
-                ihl = (40 >> 2);
-                break;
-        default:
-                return 0;
-        }
-
-
-        switch (ip_proto) {
-        case IPPROTO_TCP:
-        case IPPROTO_UDP:
-        case IPPROTO_DCCP:
-        case IPPROTO_ESP:
-        case IPPROTO_AH:
-        case IPPROTO_SCTP:
-        case IPPROTO_UDPLITE:
-                ports = *((u32 *) (skb_network_header(skb) + (ihl * 4)));
-                break;
-
-        default:
-                ports = 0;
-                break;
-        }
+        if (skb_rx_queue_recorded(skb)) {
+                hash = skb_get_rx_queue(skb);
+        } else if (skb->sk && skb->sk->sk_hash) {
+                hash = skb->sk->sk_hash;
+        } else
+                hash = skb->protocol;
 
-        hash = jhash_3words(addr1, addr2, ports, simple_tx_hashrnd);
+        hash = jhash_1word(hash, skb_tx_hashrnd);
 
         return (u16) (((u64) hash * dev->real_num_tx_queues) >> 32);
 }
@@ -1771,7 +1749,7 @@ static struct netdev_queue *dev_pick_tx(struct net_device *dev,
         if (ops->ndo_select_queue)
                 queue_index = ops->ndo_select_queue(dev, skb);
         else if (dev->real_num_tx_queues > 1)
-                queue_index = simple_tx_hash(dev, skb);
+                queue_index = skb_tx_hash(dev, skb);
 
         skb_set_queue_mapping(skb, queue_index);
         return netdev_get_tx_queue(dev, queue_index);
@@ -2303,6 +2281,8 @@ ncls:
         if (!skb)
                 goto out;
 
+        skb_orphan(skb);
+
         type = skb->protocol;
         list_for_each_entry_rcu(ptype,
                         &ptype_base[ntohs(type) & PTYPE_HASH_MASK], list) {
@@ -2372,7 +2352,6 @@ static int napi_gro_complete(struct sk_buff *skb)
 
 out:
         skb_shinfo(skb)->gso_size = 0;
-        __skb_push(skb, -skb_network_offset(skb));
         return netif_receive_skb(skb);
 }
 
@@ -2386,20 +2365,40 @@ void napi_gro_flush(struct napi_struct *napi)
                 napi_gro_complete(skb);
         }
 
+        napi->gro_count = 0;
         napi->gro_list = NULL;
 }
 EXPORT_SYMBOL(napi_gro_flush);
 
+void *skb_gro_header(struct sk_buff *skb, unsigned int hlen)
+{
+        unsigned int offset = skb_gro_offset(skb);
+
+        hlen += offset;
+        if (hlen <= skb_headlen(skb))
+                return skb->data + offset;
+
+        if (unlikely(!skb_shinfo(skb)->nr_frags ||
+                     skb_shinfo(skb)->frags[0].size <=
+                     hlen - skb_headlen(skb) ||
+                     PageHighMem(skb_shinfo(skb)->frags[0].page)))
+                return pskb_may_pull(skb, hlen) ? skb->data + offset : NULL;
+
+        return page_address(skb_shinfo(skb)->frags[0].page) +
+               skb_shinfo(skb)->frags[0].page_offset +
+               offset - skb_headlen(skb);
+}
+EXPORT_SYMBOL(skb_gro_header);
+
 int dev_gro_receive(struct napi_struct *napi, struct sk_buff *skb)
 {
         struct sk_buff **pp = NULL;
         struct packet_type *ptype;
         __be16 type = skb->protocol;
         struct list_head *head = &ptype_base[ntohs(type) & PTYPE_HASH_MASK];
-        int count = 0;
         int same_flow;
         int mac_len;
-        int free;
+        int ret;
 
         if (!(skb->dev->features & NETIF_F_GRO))
                 goto normal;
@@ -2409,30 +2408,16 @@ int dev_gro_receive(struct napi_struct *napi, struct sk_buff *skb)
 
         rcu_read_lock();
         list_for_each_entry_rcu(ptype, head, list) {
-                struct sk_buff *p;
-
                 if (ptype->type != type || ptype->dev || !ptype->gro_receive)
                         continue;
 
-                skb_reset_network_header(skb);
+                skb_set_network_header(skb, skb_gro_offset(skb));
                 mac_len = skb->network_header - skb->mac_header;
                 skb->mac_len = mac_len;
                 NAPI_GRO_CB(skb)->same_flow = 0;
                 NAPI_GRO_CB(skb)->flush = 0;
                 NAPI_GRO_CB(skb)->free = 0;
 
-                for (p = napi->gro_list; p; p = p->next) {
-                        count++;
-
-                        if (!NAPI_GRO_CB(p)->same_flow)
-                                continue;
-
-                        if (p->mac_len != mac_len ||
-                            memcmp(skb_mac_header(p), skb_mac_header(skb),
-                                   mac_len))
-                                NAPI_GRO_CB(p)->same_flow = 0;
-                }
-
                 pp = ptype->gro_receive(&napi->gro_list, skb);
                 break;
         }
@@ -2442,7 +2427,7 @@ int dev_gro_receive(struct napi_struct *napi, struct sk_buff *skb)
                 goto normal;
 
         same_flow = NAPI_GRO_CB(skb)->same_flow;
-        free = NAPI_GRO_CB(skb)->free;
+        ret = NAPI_GRO_CB(skb)->free ? GRO_MERGED_FREE : GRO_MERGED;
 
         if (pp) {
                 struct sk_buff *nskb = *pp;
@@ -2450,27 +2435,35 @@ int dev_gro_receive(struct napi_struct *napi, struct sk_buff *skb)
                 *pp = nskb->next;
                 nskb->next = NULL;
                 napi_gro_complete(nskb);
-                count--;
+                napi->gro_count--;
         }
 
         if (same_flow)
                 goto ok;
 
-        if (NAPI_GRO_CB(skb)->flush || count >= MAX_GRO_SKBS) {
-                __skb_push(skb, -skb_network_offset(skb));
+        if (NAPI_GRO_CB(skb)->flush || napi->gro_count >= MAX_GRO_SKBS)
                 goto normal;
-        }
 
+        napi->gro_count++;
         NAPI_GRO_CB(skb)->count = 1;
-        skb_shinfo(skb)->gso_size = skb->len;
+        skb_shinfo(skb)->gso_size = skb_gro_len(skb);
         skb->next = napi->gro_list;
         napi->gro_list = skb;
+        ret = GRO_HELD;
+
+pull:
+        if (unlikely(!pskb_may_pull(skb, skb_gro_offset(skb)))) {
+                if (napi->gro_list == skb)
+                        napi->gro_list = skb->next;
+                ret = GRO_DROP;
+        }
 
 ok:
-        return free;
+        return ret;
 
 normal:
-        return -1;
+        ret = GRO_NORMAL;
+        goto pull;
 }
 EXPORT_SYMBOL(dev_gro_receive);
 
@@ -2479,25 +2472,40 @@ static int __napi_gro_receive(struct napi_struct *napi, struct sk_buff *skb)
         struct sk_buff *p;
 
         for (p = napi->gro_list; p; p = p->next) {
-                NAPI_GRO_CB(p)->same_flow = 1;
+                NAPI_GRO_CB(p)->same_flow = !compare_ether_header(
+                        skb_mac_header(p), skb_gro_mac_header(skb));
                 NAPI_GRO_CB(p)->flush = 0;
         }
 
         return dev_gro_receive(napi, skb);
 }
 
-int napi_gro_receive(struct napi_struct *napi, struct sk_buff *skb)
+int napi_skb_finish(int ret, struct sk_buff *skb)
 {
-        switch (__napi_gro_receive(napi, skb)) {
-        case -1:
+        int err = NET_RX_SUCCESS;
+
+        switch (ret) {
+        case GRO_NORMAL:
                 return netif_receive_skb(skb);
 
-        case 1:
+        case GRO_DROP:
+                err = NET_RX_DROP;
+                /* fall through */
+
+        case GRO_MERGED_FREE:
                 kfree_skb(skb);
                 break;
         }
 
-        return NET_RX_SUCCESS;
+        return err;
+}
+EXPORT_SYMBOL(napi_skb_finish);
+
+int napi_gro_receive(struct napi_struct *napi, struct sk_buff *skb)
+{
+        skb_gro_reset_offset(skb);
+
+        return napi_skb_finish(__napi_gro_receive(napi, skb), skb);
 }
 EXPORT_SYMBOL(napi_gro_receive);
 
@@ -2515,6 +2523,9 @@ struct sk_buff *napi_fraginfo_skb(struct napi_struct *napi,
 {
         struct net_device *dev = napi->dev;
         struct sk_buff *skb = napi->skb;
+        struct ethhdr *eth;
+        skb_frag_t *frag;
+        int i;
 
         napi->skb = NULL;
 
@@ -2527,20 +2538,36 @@ struct sk_buff *napi_fraginfo_skb(struct napi_struct *napi,
         }
 
         BUG_ON(info->nr_frags > MAX_SKB_FRAGS);
+        frag = &info->frags[info->nr_frags - 1];
+
+        for (i = skb_shinfo(skb)->nr_frags; i < info->nr_frags; i++) {
+                skb_fill_page_desc(skb, i, frag->page, frag->page_offset,
+                                   frag->size);
+                frag++;
+        }
         skb_shinfo(skb)->nr_frags = info->nr_frags;
-        memcpy(skb_shinfo(skb)->frags, info->frags, sizeof(info->frags));
 
         skb->data_len = info->len;
         skb->len += info->len;
         skb->truesize += info->len;
 
-        if (!pskb_may_pull(skb, ETH_HLEN)) {
+        skb_reset_mac_header(skb);
+        skb_gro_reset_offset(skb);
+
+        eth = skb_gro_header(skb, sizeof(*eth));
+        if (!eth) {
                 napi_reuse_skb(napi, skb);
                 skb = NULL;
                 goto out;
         }
 
-        skb->protocol = eth_type_trans(skb, dev);
+        skb_gro_pull(skb, sizeof(*eth));
+
+        /*
+         * This works because the only protocols we care about don't require
+         * special handling.  We'll fix it up properly at the end.
+         */
+        skb->protocol = eth->h_proto;
 
         skb->ip_summed = info->ip_summed;
         skb->csum = info->csum;
@@ -2550,29 +2577,43 @@ out:
 }
 EXPORT_SYMBOL(napi_fraginfo_skb);
 
-int napi_gro_frags(struct napi_struct *napi, struct napi_gro_fraginfo *info)
+int napi_frags_finish(struct napi_struct *napi, struct sk_buff *skb, int ret)
 {
-        struct sk_buff *skb = napi_fraginfo_skb(napi, info);
-        int err = NET_RX_DROP;
+        int err = NET_RX_SUCCESS;
 
-        if (!skb)
-                goto out;
+        switch (ret) {
+        case GRO_NORMAL:
+        case GRO_HELD:
+                skb->protocol = eth_type_trans(skb, napi->dev);
 
-        err = NET_RX_SUCCESS;
+                if (ret == GRO_NORMAL)
+                        return netif_receive_skb(skb);
 
-        switch (__napi_gro_receive(napi, skb)) {
-        case -1:
-                return netif_receive_skb(skb);
+                skb_gro_pull(skb, -ETH_HLEN);
+                break;
 
-        case 0:
-                goto out;
-        }
+        case GRO_DROP:
+                err = NET_RX_DROP;
+                /* fall through */
 
-        napi_reuse_skb(napi, skb);
+        case GRO_MERGED_FREE:
+                napi_reuse_skb(napi, skb);
+                break;
+        }
 
-out:
         return err;
 }
+EXPORT_SYMBOL(napi_frags_finish);
+
+int napi_gro_frags(struct napi_struct *napi, struct napi_gro_fraginfo *info)
+{
+        struct sk_buff *skb = napi_fraginfo_skb(napi, info);
+
+        if (!skb)
+                return NET_RX_DROP;
+
+        return napi_frags_finish(napi, skb, __napi_gro_receive(napi, skb));
+}
 EXPORT_SYMBOL(napi_gro_frags);
 
 static int process_backlog(struct napi_struct *napi, int quota)
@@ -2652,6 +2693,7 @@ void netif_napi_add(struct net_device *dev, struct napi_struct *napi,
                     int (*poll)(struct napi_struct *, int), int weight)
 {
         INIT_LIST_HEAD(&napi->poll_list);
+        napi->gro_count = 0;
         napi->gro_list = NULL;
         napi->skb = NULL;
         napi->poll = poll;
@@ -2680,6 +2722,7 @@ void netif_napi_del(struct napi_struct *napi)
         }
 
         napi->gro_list = NULL;
+        napi->gro_count = 0;
 }
 EXPORT_SYMBOL(netif_napi_del);
 
@@ -5185,6 +5228,7 @@ static int __init net_dev_init(void)
                 queue->backlog.poll = process_backlog;
                 queue->backlog.weight = weight_p;
                 queue->backlog.gro_list = NULL;
+                queue->backlog.gro_count = 0;
         }
 
         dev_boot_phase = 0;
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index da74b844f4ea..ab7d2e9f02fa 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -123,6 +123,7 @@ void skb_over_panic(struct sk_buff *skb, int sz, void *here)
                skb->dev ? skb->dev->name : "<NULL>");
         BUG();
 }
+EXPORT_SYMBOL(skb_over_panic);
 
 /**
  *      skb_under_panic -       private function
@@ -142,6 +143,7 @@ void skb_under_panic(struct sk_buff *skb, int sz, void *here)
                skb->dev ? skb->dev->name : "<NULL>");
         BUG();
 }
+EXPORT_SYMBOL(skb_under_panic);
 
 void skb_truesize_bug(struct sk_buff *skb)
 {
@@ -231,6 +233,7 @@ nodata:
         skb = NULL;
         goto out;
 }
+EXPORT_SYMBOL(__alloc_skb);
 
 /**
  *      __netdev_alloc_skb - allocate an skbuff for rx on a specific device
@@ -258,6 +261,7 @@ struct sk_buff *__netdev_alloc_skb(struct net_device *dev,
         }
         return skb;
 }
+EXPORT_SYMBOL(__netdev_alloc_skb);
 
 struct page *__netdev_alloc_page(struct net_device *dev, gfp_t gfp_mask)
 {
@@ -426,6 +430,7 @@ void __kfree_skb(struct sk_buff *skb)
         skb_release_all(skb);
         kfree_skbmem(skb);
 }
+EXPORT_SYMBOL(__kfree_skb);
 
 /**
  *      kfree_skb - free an sk_buff
@@ -444,6 +449,7 @@ void kfree_skb(struct sk_buff *skb)
                 return;
         __kfree_skb(skb);
 }
+EXPORT_SYMBOL(kfree_skb);
 
 /**
  *      skb_recycle_check - check if skb can be reused for receive
@@ -613,6 +619,7 @@ struct sk_buff *skb_clone(struct sk_buff *skb, gfp_t gfp_mask)
 
         return __skb_clone(n, skb);
 }
+EXPORT_SYMBOL(skb_clone);
 
 static void copy_skb_header(struct sk_buff *new, const struct sk_buff *old)
 {
@@ -679,7 +686,7 @@ struct sk_buff *skb_copy(const struct sk_buff *skb, gfp_t gfp_mask)
         copy_skb_header(n, skb);
         return n;
 }
-
+EXPORT_SYMBOL(skb_copy);
 
 /**
  *      pskb_copy       -       create copy of an sk_buff with private head.
@@ -738,6 +745,7 @@ struct sk_buff *pskb_copy(struct sk_buff *skb, gfp_t gfp_mask)
 out:
         return n;
 }
+EXPORT_SYMBOL(pskb_copy);
 
 /**
  *      pskb_expand_head - reallocate header of &sk_buff
@@ -821,6 +829,7 @@ int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail,
 nodata:
         return -ENOMEM;
 }
+EXPORT_SYMBOL(pskb_expand_head);
 
 /* Make private copy of skb with writable head and some headroom */
 
@@ -841,7 +850,7 @@ struct sk_buff *skb_realloc_headroom(struct sk_buff *skb, unsigned int headroom)
         }
         return skb2;
 }
-
+EXPORT_SYMBOL(skb_realloc_headroom);
 
 /**
  *      skb_copy_expand -       copy and expand sk_buff
@@ -906,6 +915,7 @@ struct sk_buff *skb_copy_expand(const struct sk_buff *skb,
 
         return n;
 }
+EXPORT_SYMBOL(skb_copy_expand);
 
 /**
  *      skb_pad                 -       zero pad the tail of an skb
@@ -951,6 +961,7 @@ free_skb:
         kfree_skb(skb);
         return err;
 }
+EXPORT_SYMBOL(skb_pad);
 
 /**
  *      skb_put - add data to a buffer
@@ -1108,6 +1119,7 @@ done:
 
         return 0;
 }
+EXPORT_SYMBOL(___pskb_trim);
 
 /**
  *      __pskb_pull_tail - advance tail of skb header
@@ -1246,6 +1258,7 @@ pull_pages:
 
         return skb_tail_pointer(skb);
 }
+EXPORT_SYMBOL(__pskb_pull_tail);
 
 /* Copy some data bits from skb to kernel buffer. */
 
@@ -1323,6 +1336,7 @@ int skb_copy_bits(const struct sk_buff *skb, int offset, void *to, int len)
 fault:
         return -EFAULT;
 }
+EXPORT_SYMBOL(skb_copy_bits);
 
 /*
  * Callback from splice_to_pipe(), if we need to release some pages
@@ -1333,14 +1347,39 @@ static void sock_spd_release(struct splice_pipe_desc *spd, unsigned int i)
         put_page(spd->pages[i]);
 }
 
-static inline struct page *linear_to_page(struct page *page, unsigned int len,
-                                          unsigned int offset)
+static inline struct page *linear_to_page(struct page *page, unsigned int *len,
+                                          unsigned int *offset,
+                                          struct sk_buff *skb)
 {
-        struct page *p = alloc_pages(GFP_KERNEL, 0);
+        struct sock *sk = skb->sk;
+        struct page *p = sk->sk_sndmsg_page;
+        unsigned int off;
 
-        if (!p)
-                return NULL;
-        memcpy(page_address(p) + offset, page_address(page) + offset, len);
+        if (!p) {
+new_page:
+                p = sk->sk_sndmsg_page = alloc_pages(sk->sk_allocation, 0);
+                if (!p)
+                        return NULL;
+
+                off = sk->sk_sndmsg_off = 0;
+                /* hold one ref to this page until it's full */
+        } else {
+                unsigned int mlen;
+
+                off = sk->sk_sndmsg_off;
+                mlen = PAGE_SIZE - off;
+                if (mlen < 64 && mlen < *len) {
+                        put_page(p);
+                        goto new_page;
+                }
+
+                *len = min_t(unsigned int, *len, mlen);
+        }
+
+        memcpy(page_address(p) + off, page_address(page) + *offset, *len);
+        sk->sk_sndmsg_off += *len;
+        *offset = off;
+        get_page(p);
 
         return p;
 }
@@ -1349,21 +1388,21 @@ static inline struct page *linear_to_page(struct page *page, unsigned int len,
  * Fill page/offset/length into spd, if it can hold more pages.
  */
 static inline int spd_fill_page(struct splice_pipe_desc *spd, struct page *page,
-                                unsigned int len, unsigned int offset,
+                                unsigned int *len, unsigned int offset,
                                 struct sk_buff *skb, int linear)
 {
         if (unlikely(spd->nr_pages == PIPE_BUFFERS))
                 return 1;
 
         if (linear) {
-                page = linear_to_page(page, len, offset);
+                page = linear_to_page(page, len, &offset, skb);
                 if (!page)
                         return 1;
         } else
                 get_page(page);
 
         spd->pages[spd->nr_pages] = page;
-        spd->partial[spd->nr_pages].len = len;
+        spd->partial[spd->nr_pages].len = *len;
         spd->partial[spd->nr_pages].offset = offset;
         spd->nr_pages++;
 
@@ -1373,8 +1412,13 @@ static inline int spd_fill_page(struct splice_pipe_desc *spd, struct page *page,
 static inline void __segment_seek(struct page **page, unsigned int *poff,
                                   unsigned int *plen, unsigned int off)
 {
+        unsigned long n;
+
         *poff += off;
-        *page += *poff / PAGE_SIZE;
+        n = *poff / PAGE_SIZE;
+        if (n)
+                *page = nth_page(*page, n);
+
         *poff = *poff % PAGE_SIZE;
         *plen -= off;
 }
@@ -1405,7 +1449,7 @@ static inline int __splice_segment(struct page *page, unsigned int poff,
                 /* the linear region may spread across several pages  */
                 flen = min_t(unsigned int, flen, PAGE_SIZE - poff);
 
-                if (spd_fill_page(spd, page, flen, poff, skb, linear))
+                if (spd_fill_page(spd, page, &flen, poff, skb, linear))
                         return 1;
 
                 __segment_seek(&page, &poff, &plen, flen);
@@ -1598,7 +1642,6 @@ int skb_store_bits(struct sk_buff *skb, int offset, const void *from, int len)
 fault:
         return -EFAULT;
 }
-
 EXPORT_SYMBOL(skb_store_bits);
 
 /* Checksum skb data. */
@@ -1675,6 +1718,7 @@ __wsum skb_checksum(const struct sk_buff *skb, int offset,
 
         return csum;
 }
+EXPORT_SYMBOL(skb_checksum);
 
 /* Both of above in one bottle. */
 
@@ -1756,6 +1800,7 @@ __wsum skb_copy_and_csum_bits(const struct sk_buff *skb, int offset,
         BUG_ON(len);
         return csum;
 }
+EXPORT_SYMBOL(skb_copy_and_csum_bits);
 
 void skb_copy_and_csum_dev(const struct sk_buff *skb, u8 *to)
 {
@@ -1782,6 +1827,7 @@ void skb_copy_and_csum_dev(const struct sk_buff *skb, u8 *to)
                 *((__sum16 *)(to + csstuff)) = csum_fold(csum);
         }
 }
+EXPORT_SYMBOL(skb_copy_and_csum_dev);
 
 /**
  *      skb_dequeue - remove from the head of the queue
@@ -1802,6 +1848,7 @@ struct sk_buff *skb_dequeue(struct sk_buff_head *list)
         spin_unlock_irqrestore(&list->lock, flags);
         return result;
 }
+EXPORT_SYMBOL(skb_dequeue);
 
 /**
  *      skb_dequeue_tail - remove from the tail of the queue
@@ -1821,6 +1868,7 @@ struct sk_buff *skb_dequeue_tail(struct sk_buff_head *list)
         spin_unlock_irqrestore(&list->lock, flags);
         return result;
 }
+EXPORT_SYMBOL(skb_dequeue_tail);
 
 /**
  *      skb_queue_purge - empty a list
@@ -1836,6 +1884,7 @@ void skb_queue_purge(struct sk_buff_head *list)
         while ((skb = skb_dequeue(list)) != NULL)
                 kfree_skb(skb);
 }
+EXPORT_SYMBOL(skb_queue_purge);
 
 /**
  *      skb_queue_head - queue a buffer at the list head
@@ -1856,6 +1905,7 @@ void skb_queue_head(struct sk_buff_head *list, struct sk_buff *newsk)
         __skb_queue_head(list, newsk);
         spin_unlock_irqrestore(&list->lock, flags);
 }
+EXPORT_SYMBOL(skb_queue_head);
 
 /**
  *      skb_queue_tail - queue a buffer at the list tail
@@ -1876,6 +1926,7 @@ void skb_queue_tail(struct sk_buff_head *list, struct sk_buff *newsk)
         __skb_queue_tail(list, newsk);
         spin_unlock_irqrestore(&list->lock, flags);
 }
+EXPORT_SYMBOL(skb_queue_tail);
 
 /**
  *      skb_unlink      -       remove a buffer from a list
@@ -1895,6 +1946,7 @@ void skb_unlink(struct sk_buff *skb, struct sk_buff_head *list)
         __skb_unlink(skb, list);
         spin_unlock_irqrestore(&list->lock, flags);
 }
+EXPORT_SYMBOL(skb_unlink);
 
 /**
  *      skb_append      -       append a buffer
@@ -1914,7 +1966,7 @@ void skb_append(struct sk_buff *old, struct sk_buff *newsk, struct sk_buff_head
         __skb_queue_after(list, old, newsk);
         spin_unlock_irqrestore(&list->lock, flags);
 }
-
+EXPORT_SYMBOL(skb_append);
 
 /**
  *      skb_insert      -       insert a buffer
@@ -1936,6 +1988,7 @@ void skb_insert(struct sk_buff *old, struct sk_buff *newsk, struct sk_buff_head
         __skb_insert(newsk, old->prev, old, list);
         spin_unlock_irqrestore(&list->lock, flags);
 }
+EXPORT_SYMBOL(skb_insert);
 
 static inline void skb_split_inside_header(struct sk_buff *skb,
                                            struct sk_buff* skb1,
@@ -2014,6 +2067,7 @@ void skb_split(struct sk_buff *skb, struct sk_buff *skb1, const u32 len)
         else            /* Second chunk has no header, nothing to copy. */
                 skb_split_no_header(skb, skb1, len, pos);
 }
+EXPORT_SYMBOL(skb_split);
 
 /* Shifting from/to a cloned skb is a no-go.
  *
@@ -2176,6 +2230,7 @@ void skb_prepare_seq_read(struct sk_buff *skb, unsigned int from,
         st->frag_idx = st->stepped_offset = 0;
         st->frag_data = NULL;
 }
+EXPORT_SYMBOL(skb_prepare_seq_read);
 
 /**
  * skb_seq_read - Sequentially read skb data
@@ -2263,6 +2318,7 @@ next_skb:
 
         return 0;
 }
+EXPORT_SYMBOL(skb_seq_read);
 
 /**
  * skb_abort_seq_read - Abort a sequential read of skb data
@@ -2276,6 +2332,7 @@ void skb_abort_seq_read(struct skb_seq_state *st)
         if (st->frag_data)
                 kunmap_skb_frag(st->frag_data);
 }
+EXPORT_SYMBOL(skb_abort_seq_read);
 
 #define TS_SKB_CB(state)        ((struct skb_seq_state *) &((state)->cb))
 
@@ -2318,6 +2375,7 @@ unsigned int skb_find_text(struct sk_buff *skb, unsigned int from,
         ret = textsearch_find(config, state);
         return (ret <= to - from ? ret : UINT_MAX);
 }
+EXPORT_SYMBOL(skb_find_text);
 
 /**
  * skb_append_datato_frags: - append the user data to a skb
@@ -2390,6 +2448,7 @@ int skb_append_datato_frags(struct sock *sk, struct sk_buff *skb,
 
         return 0;
 }
+EXPORT_SYMBOL(skb_append_datato_frags);
 
 /**
  *      skb_pull_rcsum - pull skb and update receive checksum
@@ -2577,7 +2636,6 @@ err:
         }
         return ERR_PTR(err);
 }
-
 EXPORT_SYMBOL_GPL(skb_segment);
 
 int skb_gro_receive(struct sk_buff **head, struct sk_buff *skb)
@@ -2585,17 +2643,23 @@ int skb_gro_receive(struct sk_buff **head, struct sk_buff *skb)
         struct sk_buff *p = *head;
         struct sk_buff *nskb;
         unsigned int headroom;
-        unsigned int hlen = p->data - skb_mac_header(p);
-        unsigned int len = skb->len;
+        unsigned int len = skb_gro_len(skb);
 
-        if (hlen + p->len + len >= 65536)
+        if (p->len + len >= 65536)
                 return -E2BIG;
 
         if (skb_shinfo(p)->frag_list)
                 goto merge;
-        else if (!skb_headlen(p) && !skb_headlen(skb) &&
-                 skb_shinfo(p)->nr_frags + skb_shinfo(skb)->nr_frags <
-                 MAX_SKB_FRAGS) {
+        else if (skb_headlen(skb) <= skb_gro_offset(skb)) {
+                if (skb_shinfo(p)->nr_frags + skb_shinfo(skb)->nr_frags >
+                    MAX_SKB_FRAGS)
+                        return -E2BIG;
+
+                skb_shinfo(skb)->frags[0].page_offset +=
+                        skb_gro_offset(skb) - skb_headlen(skb);
+                skb_shinfo(skb)->frags[0].size -=
+                        skb_gro_offset(skb) - skb_headlen(skb);
+
                 memcpy(skb_shinfo(p)->frags + skb_shinfo(p)->nr_frags,
                        skb_shinfo(skb)->frags,
                        skb_shinfo(skb)->nr_frags * sizeof(skb_frag_t));
@@ -2612,7 +2676,7 @@ int skb_gro_receive(struct sk_buff **head, struct sk_buff *skb)
         }
 
         headroom = skb_headroom(p);
-        nskb = netdev_alloc_skb(p->dev, headroom);
+        nskb = netdev_alloc_skb(p->dev, headroom + skb_gro_offset(p));
         if (unlikely(!nskb))
                 return -ENOMEM;
 
@@ -2620,12 +2684,15 @@ int skb_gro_receive(struct sk_buff **head, struct sk_buff *skb)
         nskb->mac_len = p->mac_len;
 
         skb_reserve(nskb, headroom);
+        __skb_put(nskb, skb_gro_offset(p));
 
-        skb_set_mac_header(nskb, -hlen);
+        skb_set_mac_header(nskb, skb_mac_header(p) - p->data);
         skb_set_network_header(nskb, skb_network_offset(p));
         skb_set_transport_header(nskb, skb_transport_offset(p));
 
-        memcpy(skb_mac_header(nskb), skb_mac_header(p), hlen);
+        __skb_pull(p, skb_gro_offset(p));
+        memcpy(skb_mac_header(nskb), skb_mac_header(p),
+               p->data - skb_mac_header(p));
 
         *NAPI_GRO_CB(nskb) = *NAPI_GRO_CB(p);
         skb_shinfo(nskb)->frag_list = p;
@@ -2644,6 +2711,17 @@ int skb_gro_receive(struct sk_buff **head, struct sk_buff *skb)
         p = nskb;
 
 merge:
+        if (skb_gro_offset(skb) > skb_headlen(skb)) {
+                skb_shinfo(skb)->frags[0].page_offset +=
+                        skb_gro_offset(skb) - skb_headlen(skb);
+                skb_shinfo(skb)->frags[0].size -=
+                        skb_gro_offset(skb) - skb_headlen(skb);
+                skb_gro_reset_offset(skb);
+                skb_gro_pull(skb, skb_headlen(skb));
+        }
+
+        __skb_pull(skb, skb_gro_offset(skb));
+
         p->prev->next = skb;
         p->prev = skb;
         skb_header_release(skb);
@@ -2755,6 +2833,7 @@ int skb_to_sgvec(struct sk_buff *skb, struct scatterlist *sg, int offset, int le
 
         return nsg;
 }
+EXPORT_SYMBOL_GPL(skb_to_sgvec);
 
 /**
  *      skb_cow_data - Check that a socket buffer's data buffers are writable
@@ -2864,6 +2943,7 @@ int skb_cow_data(struct sk_buff *skb, int tailbits, struct sk_buff **trailer)
 
         return elt;
 }
+EXPORT_SYMBOL_GPL(skb_cow_data);
 
 /**
  * skb_partial_csum_set - set up and verify partial csum values for packet
@@ -2892,6 +2972,7 @@ bool skb_partial_csum_set(struct sk_buff *skb, u16 start, u16 off)
         skb->csum_offset = off;
         return true;
 }
+EXPORT_SYMBOL_GPL(skb_partial_csum_set);
 
 void __skb_warn_lro_forwarding(const struct sk_buff *skb)
 {
@@ -2899,42 +2980,4 @@ void __skb_warn_lro_forwarding(const struct sk_buff *skb)
                 pr_warning("%s: received packets cannot be forwarded"
                            " while LRO is enabled\n", skb->dev->name);
 }
-
-EXPORT_SYMBOL(___pskb_trim);
-EXPORT_SYMBOL(__kfree_skb);
-EXPORT_SYMBOL(kfree_skb);
-EXPORT_SYMBOL(__pskb_pull_tail);
-EXPORT_SYMBOL(__alloc_skb);
-EXPORT_SYMBOL(__netdev_alloc_skb);
-EXPORT_SYMBOL(pskb_copy);
-EXPORT_SYMBOL(pskb_expand_head);
-EXPORT_SYMBOL(skb_checksum);
-EXPORT_SYMBOL(skb_clone);
-EXPORT_SYMBOL(skb_copy);
-EXPORT_SYMBOL(skb_copy_and_csum_bits);
-EXPORT_SYMBOL(skb_copy_and_csum_dev);
-EXPORT_SYMBOL(skb_copy_bits);
-EXPORT_SYMBOL(skb_copy_expand);
-EXPORT_SYMBOL(skb_over_panic);
-EXPORT_SYMBOL(skb_pad);
-EXPORT_SYMBOL(skb_realloc_headroom);
-EXPORT_SYMBOL(skb_under_panic);
-EXPORT_SYMBOL(skb_dequeue);
-EXPORT_SYMBOL(skb_dequeue_tail);
-EXPORT_SYMBOL(skb_insert);
-EXPORT_SYMBOL(skb_queue_purge);
-EXPORT_SYMBOL(skb_queue_head);
-EXPORT_SYMBOL(skb_queue_tail);
-EXPORT_SYMBOL(skb_unlink);
-EXPORT_SYMBOL(skb_append);
-EXPORT_SYMBOL(skb_split);
-EXPORT_SYMBOL(skb_prepare_seq_read);
-EXPORT_SYMBOL(skb_seq_read);
-EXPORT_SYMBOL(skb_abort_seq_read);
-EXPORT_SYMBOL(skb_find_text);
-EXPORT_SYMBOL(skb_append_datato_frags);
 EXPORT_SYMBOL(__skb_warn_lro_forwarding);
-
-EXPORT_SYMBOL_GPL(skb_to_sgvec);
-EXPORT_SYMBOL_GPL(skb_cow_data);
-EXPORT_SYMBOL_GPL(skb_partial_csum_set);
diff --git a/net/core/sock.c b/net/core/sock.c
index 6f2e1337975d..4c64be4f8765 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -1256,10 +1256,9 @@ static long sock_wait_for_wmem(struct sock * sk, long timeo)
  *      Generic send/receive buffer handlers
  */
 
-static struct sk_buff *sock_alloc_send_pskb(struct sock *sk,
-                                            unsigned long header_len,
-                                            unsigned long data_len,
-                                            int noblock, int *errcode)
+struct sk_buff *sock_alloc_send_pskb(struct sock *sk, unsigned long header_len,
+                                     unsigned long data_len, int noblock,
+                                     int *errcode)
 {
         struct sk_buff *skb;
         gfp_t gfp_mask;
@@ -1339,6 +1338,7 @@ failure:
         *errcode = err;
         return NULL;
 }
+EXPORT_SYMBOL(sock_alloc_send_pskb);
 
 struct sk_buff *sock_alloc_send_skb(struct sock *sk, unsigned long size,
                                     int noblock, int *errcode)
diff --git a/net/dccp/dccp.h b/net/dccp/dccp.h
index f2230fc168e1..08a569ff02d1 100644
--- a/net/dccp/dccp.h
+++ b/net/dccp/dccp.h
@@ -42,9 +42,11 @@
 extern int dccp_debug;
 #define dccp_pr_debug(format, a...)       DCCP_PR_DEBUG(dccp_debug, format, ##a)
 #define dccp_pr_debug_cat(format, a...)   DCCP_PRINTK(dccp_debug, format, ##a)
+#define dccp_debug(fmt, a...)             dccp_pr_debug_cat(KERN_DEBUG fmt, ##a)
 #else
 #define dccp_pr_debug(format, a...)
 #define dccp_pr_debug_cat(format, a...)
+#define dccp_debug(format, a...)
 #endif
 
 extern struct inet_hashinfo dccp_hashinfo;
@@ -95,9 +97,6 @@ extern void dccp_time_wait(struct sock *sk, int state, int timeo);
 extern int  sysctl_dccp_request_retries;
 extern int  sysctl_dccp_retries1;
 extern int  sysctl_dccp_retries2;
-extern int  sysctl_dccp_feat_sequence_window;
-extern int  sysctl_dccp_feat_rx_ccid;
-extern int  sysctl_dccp_feat_tx_ccid;
 extern int  sysctl_dccp_tx_qlen;
 extern int  sysctl_dccp_sync_ratelimit;
 
@@ -409,23 +408,21 @@ static inline void dccp_hdr_set_ack(struct dccp_hdr_ack_bits *dhack,
 static inline void dccp_update_gsr(struct sock *sk, u64 seq)
 {
         struct dccp_sock *dp = dccp_sk(sk);
-        const struct dccp_minisock *dmsk = dccp_msk(sk);
 
         dp->dccps_gsr = seq;
-        dccp_set_seqno(&dp->dccps_swl,
-                       dp->dccps_gsr + 1 - (dmsk->dccpms_sequence_window / 4));
-        dccp_set_seqno(&dp->dccps_swh,
-                       dp->dccps_gsr + (3 * dmsk->dccpms_sequence_window) / 4);
+        /* Sequence validity window depends on remote Sequence Window (7.5.1) */
+        dp->dccps_swl = SUB48(ADD48(dp->dccps_gsr, 1), dp->dccps_r_seq_win / 4);
+        dp->dccps_swh = ADD48(dp->dccps_gsr, (3 * dp->dccps_r_seq_win) / 4);
 }
 
 static inline void dccp_update_gss(struct sock *sk, u64 seq)
 {
         struct dccp_sock *dp = dccp_sk(sk);
 
-        dp->dccps_awh = dp->dccps_gss = seq;
-        dccp_set_seqno(&dp->dccps_awl,
-                       (dp->dccps_gss -
-                        dccp_msk(sk)->dccpms_sequence_window + 1));
+        dp->dccps_gss = seq;
+        /* Ack validity window depends on local Sequence Window value (7.5.1) */
+        dp->dccps_awl = SUB48(ADD48(dp->dccps_gss, 1), dp->dccps_l_seq_win);
+        dp->dccps_awh = dp->dccps_gss;
 }
 
 static inline int dccp_ack_pending(const struct sock *sk)
diff --git a/net/dccp/feat.c b/net/dccp/feat.c
index 4152308958ab..b04160a2eea5 100644
--- a/net/dccp/feat.c
+++ b/net/dccp/feat.c
@@ -25,6 +25,11 @@
 #include "ccid.h"
 #include "feat.h"
 
+/* feature-specific sysctls - initialised to the defaults from RFC 4340, 6.4 */
+unsigned long   sysctl_dccp_sequence_window __read_mostly = 100;
+int             sysctl_dccp_rx_ccid         __read_mostly = 2,
+                sysctl_dccp_tx_ccid         __read_mostly = 2;
+
 /*
  * Feature activation handlers.
  *
@@ -51,8 +56,17 @@ static int dccp_hdlr_ccid(struct sock *sk, u64 ccid, bool rx)
 
 static int dccp_hdlr_seq_win(struct sock *sk, u64 seq_win, bool rx)
 {
-        if (!rx)
-                dccp_msk(sk)->dccpms_sequence_window = seq_win;
+        struct dccp_sock *dp = dccp_sk(sk);
+
+        if (rx) {
+                dp->dccps_r_seq_win = seq_win;
+                /* propagate changes to update SWL/SWH */
+                dccp_update_gsr(sk, dp->dccps_gsr);
+        } else {
+                dp->dccps_l_seq_win = seq_win;
+                /* propagate changes to update AWL */
+                dccp_update_gss(sk, dp->dccps_gss);
+        }
         return 0;
 }
 
@@ -194,6 +208,100 @@ static int dccp_feat_default_value(u8 feat_num)
         return idx < 0 ? 0 : dccp_feat_table[idx].default_value;
 }
 
+/*
+ *      Debugging and verbose-printing section
+ */
+static const char *dccp_feat_fname(const u8 feat)
+{
+        static const char *feature_names[] = {
+                [DCCPF_RESERVED]        = "Reserved",
+                [DCCPF_CCID]            = "CCID",
+                [DCCPF_SHORT_SEQNOS]    = "Allow Short Seqnos",
+                [DCCPF_SEQUENCE_WINDOW] = "Sequence Window",
+                [DCCPF_ECN_INCAPABLE]   = "ECN Incapable",
+                [DCCPF_ACK_RATIO]       = "Ack Ratio",
+                [DCCPF_SEND_ACK_VECTOR] = "Send ACK Vector",
+                [DCCPF_SEND_NDP_COUNT]  = "Send NDP Count",
+                [DCCPF_MIN_CSUM_COVER]  = "Min. Csum Coverage",
+                [DCCPF_DATA_CHECKSUM]   = "Send Data Checksum",
+        };
+        if (feat > DCCPF_DATA_CHECKSUM && feat < DCCPF_MIN_CCID_SPECIFIC)
+                return feature_names[DCCPF_RESERVED];
+
+        if (feat ==  DCCPF_SEND_LEV_RATE)
+                return "Send Loss Event Rate";
+        if (feat >= DCCPF_MIN_CCID_SPECIFIC)
+                return "CCID-specific";
+
+        return feature_names[feat];
+}
+
+static const char *dccp_feat_sname[] = { "DEFAULT", "INITIALISING", "CHANGING",
+                                         "UNSTABLE", "STABLE" };
+
+#ifdef CONFIG_IP_DCCP_DEBUG
+static const char *dccp_feat_oname(const u8 opt)
+{
+        switch (opt) {
+        case DCCPO_CHANGE_L:  return "Change_L";
+        case DCCPO_CONFIRM_L: return "Confirm_L";
+        case DCCPO_CHANGE_R:  return "Change_R";
+        case DCCPO_CONFIRM_R: return "Confirm_R";
+        }
+        return NULL;
+}
+
+static void dccp_feat_printval(u8 feat_num, dccp_feat_val const *val)
+{
+        u8 i, type = dccp_feat_type(feat_num);
+
+        if (val == NULL || (type == FEAT_SP && val->sp.vec == NULL))
+                dccp_pr_debug_cat("(NULL)");
+        else if (type == FEAT_SP)
+                for (i = 0; i < val->sp.len; i++)
+                        dccp_pr_debug_cat("%s%u", i ? " " : "", val->sp.vec[i]);
+        else if (type == FEAT_NN)
+                dccp_pr_debug_cat("%llu", (unsigned long long)val->nn);
+        else
+                dccp_pr_debug_cat("unknown type %u", type);
+}
+
+static void dccp_feat_printvals(u8 feat_num, u8 *list, u8 len)
+{
+        u8 type = dccp_feat_type(feat_num);
+        dccp_feat_val fval = { .sp.vec = list, .sp.len = len };
+
+        if (type == FEAT_NN)
+                fval.nn = dccp_decode_value_var(list, len);
+        dccp_feat_printval(feat_num, &fval);
+}
+
+static void dccp_feat_print_entry(struct dccp_feat_entry const *entry)
+{
+        dccp_debug("   * %s %s = ", entry->is_local ? "local" : "remote",
+                                    dccp_feat_fname(entry->feat_num));
+        dccp_feat_printval(entry->feat_num, &entry->val);
+        dccp_pr_debug_cat(", state=%s %s\n", dccp_feat_sname[entry->state],
+                          entry->needs_confirm ? "(Confirm pending)" : "");
+}
+
+#define dccp_feat_print_opt(opt, feat, val, len, mandatory)     do {          \
+        dccp_pr_debug("%s(%s, ", dccp_feat_oname(opt), dccp_feat_fname(feat));\
+        dccp_feat_printvals(feat, val, len);                                  \
+        dccp_pr_debug_cat(") %s\n", mandatory ? "!" : "");      } while (0)
+
+#define dccp_feat_print_fnlist(fn_list)  {              \
+        const struct dccp_feat_entry *___entry;         \
+                                                        \
+        dccp_pr_debug("List Dump:\n");                  \
+        list_for_each_entry(___entry, fn_list, node)    \
+                dccp_feat_print_entry(___entry);        \
+}
+#else   /* ! CONFIG_IP_DCCP_DEBUG */
+#define dccp_feat_print_opt(opt, feat, val, len, mandatory)
+#define dccp_feat_print_fnlist(fn_list)
+#endif
+
 static int __dccp_feat_activate(struct sock *sk, const int idx,
                                 const bool is_local, dccp_feat_val const *fval)
 {
@@ -226,6 +334,10 @@ static int __dccp_feat_activate(struct sock *sk, const int idx,
         /* Location is RX if this is a local-RX or remote-TX feature */
         rx = (is_local == (dccp_feat_table[idx].rxtx == FEAT_AT_RX));
 
+        dccp_debug("   -> activating %s %s, %sval=%llu\n", rx ? "RX" : "TX",
+                   dccp_feat_fname(dccp_feat_table[idx].feat_num),
+                   fval ? "" : "default ",  (unsigned long long)val);
+
         return dccp_feat_table[idx].activation_hdlr(sk, val, rx);
 }
 
@@ -530,6 +642,7 @@ int dccp_feat_insert_opts(struct dccp_sock *dp, struct dccp_request_sock *dreq,
                                 return -1;
                         }
                 }
+                dccp_feat_print_opt(opt, pos->feat_num, ptr, len, 0);
 
                 if (dccp_insert_fn_opt(skb, opt, pos->feat_num, ptr, len, rpt))
                         return -1;
@@ -783,6 +896,7 @@ int dccp_feat_finalise_settings(struct dccp_sock *dp)
         while (i--)
                 if (ccids[i] > 0 && dccp_feat_propagate_ccid(fn, ccids[i], i))
                         return -1;
+        dccp_feat_print_fnlist(fn);
         return 0;
 }
 
@@ -901,6 +1015,8 @@ static u8 dccp_feat_change_recv(struct list_head *fn, u8 is_mandatory, u8 opt,
         if (len == 0 || type == FEAT_UNKNOWN)           /* 6.1 and 6.6.8 */
                 goto unknown_feature_or_value;
 
+        dccp_feat_print_opt(opt, feat, val, len, is_mandatory);
+
         /*
          *      Negotiation of NN features: Change R is invalid, so there is no
          *      simultaneous negotiation; hence we do not look up in the list.
@@ -1006,6 +1122,8 @@ static u8 dccp_feat_confirm_recv(struct list_head *fn, u8 is_mandatory, u8 opt,
         const bool local = (opt == DCCPO_CONFIRM_R);
         struct dccp_feat_entry *entry = dccp_feat_list_lookup(fn, feat, local);
 
+        dccp_feat_print_opt(opt, feat, val, len, is_mandatory);
+
         if (entry == NULL) {    /* nothing queued: ignore or handle error */
                 if (is_mandatory && type == FEAT_UNKNOWN)
                         return DCCP_RESET_CODE_MANDATORY_ERROR;
@@ -1115,23 +1233,70 @@ int dccp_feat_parse_options(struct sock *sk, struct dccp_request_sock *dreq,
         return 0;       /* ignore FN options in all other states */
 }
 
+/**
+ * dccp_feat_init  -  Seed feature negotiation with host-specific defaults
+ * This initialises global defaults, depending on the value of the sysctls.
+ * These can later be overridden by registering changes via setsockopt calls.
+ * The last link in the chain is finalise_settings, to make sure that between
+ * here and the start of actual feature negotiation no inconsistencies enter.
+ *
+ * All features not appearing below use either defaults or are otherwise
+ * later adjusted through dccp_feat_finalise_settings().
+ */
 int dccp_feat_init(struct sock *sk)
 {
-        struct dccp_sock *dp = dccp_sk(sk);
-        struct dccp_minisock *dmsk = dccp_msk(sk);
+        struct list_head *fn = &dccp_sk(sk)->dccps_featneg;
+        u8 on = 1, off = 0;
         int rc;
+        struct {
+                u8 *val;
+                u8 len;
+        } tx, rx;
+
+        /* Non-negotiable (NN) features */
+        rc = __feat_register_nn(fn, DCCPF_SEQUENCE_WINDOW, 0,
+                                    sysctl_dccp_sequence_window);
+        if (rc)
+                return rc;
+
+        /* Server-priority (SP) features */
+
+        /* Advertise that short seqnos are not supported (7.6.1) */
+        rc = __feat_register_sp(fn, DCCPF_SHORT_SEQNOS, true, true, &off, 1);
+        if (rc)
+                return rc;
 
-        INIT_LIST_HEAD(&dmsk->dccpms_pending);  /* XXX no longer used */
-        INIT_LIST_HEAD(&dmsk->dccpms_conf);     /* XXX no longer used */
+        /* RFC 4340 12.1: "If a DCCP is not ECN capable, ..." */
+        rc = __feat_register_sp(fn, DCCPF_ECN_INCAPABLE, true, true, &on, 1);
+        if (rc)
+                return rc;
+
+        /*
+         * We advertise the available list of CCIDs and reorder according to
+         * preferences, to avoid failure resulting from negotiating different
+         * singleton values (which always leads to failure).
+         * These settings can still (later) be overridden via sockopts.
+         */
+        if (ccid_get_builtin_ccids(&tx.val, &tx.len) ||
+            ccid_get_builtin_ccids(&rx.val, &rx.len))
+                return -ENOBUFS;
+
+        if (!dccp_feat_prefer(sysctl_dccp_tx_ccid, tx.val, tx.len) ||
+            !dccp_feat_prefer(sysctl_dccp_rx_ccid, rx.val, rx.len))
+                goto free_ccid_lists;
+
+        rc = __feat_register_sp(fn, DCCPF_CCID, true, false, tx.val, tx.len);
+        if (rc)
+                goto free_ccid_lists;
+
+        rc = __feat_register_sp(fn, DCCPF_CCID, false, false, rx.val, rx.len);
 
-        /* Ack ratio */
-        rc = __feat_register_nn(&dp->dccps_featneg, DCCPF_ACK_RATIO, 0,
-                                dp->dccps_l_ack_ratio);
+free_ccid_lists:
+        kfree(tx.val);
+        kfree(rx.val);
         return rc;
 }
 
-EXPORT_SYMBOL_GPL(dccp_feat_init);
-
 int dccp_feat_activate_values(struct sock *sk, struct list_head *fn_list)
 {
         struct dccp_sock *dp = dccp_sk(sk);
@@ -1156,9 +1321,10 @@ int dccp_feat_activate_values(struct sock *sk, struct list_head *fn_list)
                         goto activation_failed;
                 }
                 if (cur->state != FEAT_STABLE) {
-                        DCCP_CRIT("Negotiation of %s %u failed in state %u",
+                        DCCP_CRIT("Negotiation of %s %s failed in state %s",
                                   cur->is_local ? "local" : "remote",
-                                  cur->feat_num, cur->state);
+                                  dccp_feat_fname(cur->feat_num),
+                                  dccp_feat_sname[cur->state]);
                         goto activation_failed;
                 }
                 fvals[idx][cur->is_local] = &cur->val;
@@ -1199,43 +1365,3 @@ activation_failed:
         dp->dccps_hc_rx_ackvec = NULL;
         return -1;
 }
-
-#ifdef CONFIG_IP_DCCP_DEBUG
-const char *dccp_feat_typename(const u8 type)
-{
-        switch(type) {
-        case DCCPO_CHANGE_L:  return("ChangeL");
-        case DCCPO_CONFIRM_L: return("ConfirmL");
-        case DCCPO_CHANGE_R:  return("ChangeR");
-        case DCCPO_CONFIRM_R: return("ConfirmR");
-        /* the following case must not appear in feature negotation  */
-        default:              dccp_pr_debug("unknown type %d [BUG!]\n", type);
-        }
-        return NULL;
-}
-
-const char *dccp_feat_name(const u8 feat)
-{
-        static const char *feature_names[] = {
-                [DCCPF_RESERVED]        = "Reserved",
-                [DCCPF_CCID]            = "CCID",
-                [DCCPF_SHORT_SEQNOS]    = "Allow Short Seqnos",
-                [DCCPF_SEQUENCE_WINDOW] = "Sequence Window",
-                [DCCPF_ECN_INCAPABLE]   = "ECN Incapable",
-                [DCCPF_ACK_RATIO]       = "Ack Ratio",
-                [DCCPF_SEND_ACK_VECTOR] = "Send ACK Vector",
-                [DCCPF_SEND_NDP_COUNT]  = "Send NDP Count",
-                [DCCPF_MIN_CSUM_COVER]  = "Min. Csum Coverage",
-                [DCCPF_DATA_CHECKSUM]   = "Send Data Checksum",
-        };
-        if (feat > DCCPF_DATA_CHECKSUM && feat < DCCPF_MIN_CCID_SPECIFIC)
-                return feature_names[DCCPF_RESERVED];
-
-        if (feat ==  DCCPF_SEND_LEV_RATE)
-                return "Send Loss Event Rate";
-        if (feat >= DCCPF_MIN_CCID_SPECIFIC)
-                return "CCID-specific";
-
-        return feature_names[feat];
-}
-#endif /* CONFIG_IP_DCCP_DEBUG */
diff --git a/net/dccp/feat.h b/net/dccp/feat.h
index 9b46e2a7866e..f96721619def 100644
--- a/net/dccp/feat.h
+++ b/net/dccp/feat.h
@@ -100,26 +100,21 @@ struct ccid_dependency {
         u8      val;
 };
 
-#ifdef CONFIG_IP_DCCP_DEBUG
-extern const char *dccp_feat_typename(const u8 type);
-extern const char *dccp_feat_name(const u8 feat);
-
-static inline void dccp_feat_debug(const u8 type, const u8 feat, const u8 val)
-{
-        dccp_pr_debug("%s(%s (%d), %d)\n", dccp_feat_typename(type),
-                                           dccp_feat_name(feat), feat, val);
-}
-#else
-#define dccp_feat_debug(type, feat, val)
-#endif /* CONFIG_IP_DCCP_DEBUG */
+/*
+ * Sysctls to seed defaults for feature negotiation
+ */
+extern unsigned long sysctl_dccp_sequence_window;
+extern int           sysctl_dccp_rx_ccid;
+extern int           sysctl_dccp_tx_ccid;
 
+extern int  dccp_feat_init(struct sock *sk);
+extern void dccp_feat_initialise_sysctls(void);
 extern int  dccp_feat_register_sp(struct sock *sk, u8 feat, u8 is_local,
                                   u8 const *list, u8 len);
 extern int  dccp_feat_register_nn(struct sock *sk, u8 feat, u64 val);
 extern int  dccp_feat_parse_options(struct sock *, struct dccp_request_sock *,
                                     u8 mand, u8 opt, u8 feat, u8 *val, u8 len);
 extern int  dccp_feat_clone_list(struct list_head const *, struct list_head *);
-extern int  dccp_feat_init(struct sock *sk);
 
 /*
  * Encoding variable-length options and their maximum length.
diff --git a/net/dccp/minisocks.c b/net/dccp/minisocks.c
index 6821ae33dd37..5ca49cec95f5 100644
--- a/net/dccp/minisocks.c
+++ b/net/dccp/minisocks.c
@@ -42,11 +42,6 @@ struct inet_timewait_death_row dccp_death_row = {
 
 EXPORT_SYMBOL_GPL(dccp_death_row);
 
-void dccp_minisock_init(struct dccp_minisock *dmsk)
-{
-        dmsk->dccpms_sequence_window = sysctl_dccp_feat_sequence_window;
-}
-
 void dccp_time_wait(struct sock *sk, int state, int timeo)
 {
         struct inet_timewait_sock *tw = NULL;
@@ -110,7 +105,6 @@ struct sock *dccp_create_openreq_child(struct sock *sk,
                 struct dccp_request_sock *dreq = dccp_rsk(req);
                 struct inet_connection_sock *newicsk = inet_csk(newsk);
                 struct dccp_sock *newdp = dccp_sk(newsk);
-                struct dccp_minisock *newdmsk = dccp_msk(newsk);
 
                 newdp->dccps_role           = DCCP_ROLE_SERVER;
                 newdp->dccps_hc_rx_ackvec   = NULL;
@@ -128,10 +122,6 @@ struct sock *dccp_create_openreq_child(struct sock *sk,
                  *    Initialize S.GAR := S.ISS
                  *    Set S.ISR, S.GSR, S.SWL, S.SWH from packet or Init Cookies
                  */
-
-                /* See dccp_v4_conn_request */
-                newdmsk->dccpms_sequence_window = req->rcv_wnd;
-
                 newdp->dccps_gar = newdp->dccps_iss = dreq->dreq_iss;
                 dccp_update_gss(newsk, dreq->dreq_iss);
 
@@ -290,7 +280,6 @@ int dccp_reqsk_init(struct request_sock *req,
         inet_rsk(req)->rmt_port   = dccp_hdr(skb)->dccph_sport;
         inet_rsk(req)->loc_port   = dccp_hdr(skb)->dccph_dport;
         inet_rsk(req)->acked      = 0;
-        req->rcv_wnd              = sysctl_dccp_feat_sequence_window;
         dreq->dreq_timestamp_echo = 0;
 
         /* inherit feature negotiation options from listening socket */
diff --git a/net/dccp/options.c b/net/dccp/options.c
index 7b1165c21f51..1b08cae9c65b 100644
--- a/net/dccp/options.c
+++ b/net/dccp/options.c
@@ -23,10 +23,6 @@
 #include "dccp.h"
 #include "feat.h"
 
-int sysctl_dccp_feat_sequence_window = DCCPF_INITIAL_SEQUENCE_WINDOW;
-int sysctl_dccp_feat_rx_ccid          = DCCPF_INITIAL_CCID;
-int sysctl_dccp_feat_tx_ccid          = DCCPF_INITIAL_CCID;
-
 u64 dccp_decode_value_var(const u8 *bf, const u8 len)
 {
         u64 value = 0;
@@ -502,10 +498,6 @@ int dccp_insert_fn_opt(struct sk_buff *skb, u8 type, u8 feat,
                 *to++ = *val;
         if (len)
                 memcpy(to, val, len);
-
-        dccp_pr_debug("%s(%s (%d), ...), length %d\n",
-                      dccp_feat_typename(type),
-                      dccp_feat_name(feat), feat, len);
         return 0;
 }
 
diff --git a/net/dccp/proto.c b/net/dccp/proto.c
index 945b4d5d23b3..314a1b5c033c 100644
--- a/net/dccp/proto.c
+++ b/net/dccp/proto.c
@@ -174,8 +174,6 @@ int dccp_init_sock(struct sock *sk, const __u8 ctl_sock_initialized)
         struct dccp_sock *dp = dccp_sk(sk);
         struct inet_connection_sock *icsk = inet_csk(sk);
 
-        dccp_minisock_init(&dp->dccps_minisock);
-
         icsk->icsk_rto          = DCCP_TIMEOUT_INIT;
         icsk->icsk_syn_retries  = sysctl_dccp_request_retries;
         sk->sk_state            = DCCP_CLOSED;
diff --git a/net/dccp/sysctl.c b/net/dccp/sysctl.c
index 018e210875e1..a5a1856234e7 100644
--- a/net/dccp/sysctl.c
+++ b/net/dccp/sysctl.c
@@ -18,55 +18,72 @@
 #error This file should not be compiled without CONFIG_SYSCTL defined
 #endif
 
+/* Boundary values */
+static int              zero     = 0,
+                        u8_max   = 0xFF;
+static unsigned long    seqw_min = 32;
+
 static struct ctl_table dccp_default_table[] = {
         {
                 .procname       = "seq_window",
-                .data           = &sysctl_dccp_feat_sequence_window,
-                .maxlen         = sizeof(sysctl_dccp_feat_sequence_window),
+                .data           = &sysctl_dccp_sequence_window,
+                .maxlen         = sizeof(sysctl_dccp_sequence_window),
                 .mode           = 0644,
-                .proc_handler   = proc_dointvec,
+                .proc_handler   = proc_doulongvec_minmax,
+                .extra1         = &seqw_min,            /* RFC 4340, 7.5.2 */
         },
         {
                 .procname       = "rx_ccid",
-                .data           = &sysctl_dccp_feat_rx_ccid,
-                .maxlen         = sizeof(sysctl_dccp_feat_rx_ccid),
+                .data           = &sysctl_dccp_rx_ccid,
+                .maxlen         = sizeof(sysctl_dccp_rx_ccid),
                 .mode           = 0644,
-                .proc_handler   = proc_dointvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .extra1         = &zero,
+                .extra2         = &u8_max,              /* RFC 4340, 10. */
         },
         {
                 .procname       = "tx_ccid",
-                .data           = &sysctl_dccp_feat_tx_ccid,
-                .maxlen         = sizeof(sysctl_dccp_feat_tx_ccid),
+                .data           = &sysctl_dccp_tx_ccid,
+                .maxlen         = sizeof(sysctl_dccp_tx_ccid),
                 .mode           = 0644,
-                .proc_handler   = proc_dointvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .extra1         = &zero,
+                .extra2         = &u8_max,              /* RFC 4340, 10. */
         },
         {
                 .procname       = "request_retries",
                 .data           = &sysctl_dccp_request_retries,
                 .maxlen         = sizeof(sysctl_dccp_request_retries),
                 .mode           = 0644,
-                .proc_handler   = proc_dointvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .extra1         = &zero,
+                .extra2         = &u8_max,
         },
         {
                 .procname       = "retries1",
                 .data           = &sysctl_dccp_retries1,
                 .maxlen         = sizeof(sysctl_dccp_retries1),
                 .mode           = 0644,
-                .proc_handler   = proc_dointvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .extra1         = &zero,
+                .extra2         = &u8_max,
         },
         {
                 .procname       = "retries2",
                 .data           = &sysctl_dccp_retries2,
                 .maxlen         = sizeof(sysctl_dccp_retries2),
                 .mode           = 0644,
-                .proc_handler   = proc_dointvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .extra1         = &zero,
+                .extra2         = &u8_max,
         },
         {
                 .procname       = "tx_qlen",
                 .data           = &sysctl_dccp_tx_qlen,
                 .maxlen         = sizeof(sysctl_dccp_tx_qlen),
                 .mode           = 0644,
-                .proc_handler   = proc_dointvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .extra1         = &zero,
         },
         {
                 .procname       = "sync_ratelimit",
diff --git a/net/decnet/af_decnet.c b/net/decnet/af_decnet.c
index cf0e18499297..12bf7d4c16c6 100644
--- a/net/decnet/af_decnet.c
+++ b/net/decnet/af_decnet.c
@@ -2113,7 +2113,7 @@ static struct notifier_block dn_dev_notifier = {
 extern int dn_route_rcv(struct sk_buff *, struct net_device *, struct packet_type *, struct net_device *);
 
 static struct packet_type dn_dix_packet_type = {
-        .type =         __constant_htons(ETH_P_DNA_RT),
+        .type =         cpu_to_be16(ETH_P_DNA_RT),
         .dev =          NULL,           /* All devices */
         .func =         dn_route_rcv,
 };
diff --git a/net/decnet/dn_route.c b/net/decnet/dn_route.c
index c754670b7fca..5130dee0b384 100644
--- a/net/decnet/dn_route.c
+++ b/net/decnet/dn_route.c
@@ -124,7 +124,7 @@ int decnet_dst_gc_interval = 2;
 
 static struct dst_ops dn_dst_ops = {
         .family =               PF_DECnet,
-        .protocol =             __constant_htons(ETH_P_DNA_RT),
+        .protocol =             cpu_to_be16(ETH_P_DNA_RT),
         .gc_thresh =            128,
         .gc =                   dn_dst_gc,
         .check =                dn_dst_check,
diff --git a/net/dsa/mv88e6123_61_65.c b/net/dsa/mv88e6123_61_65.c
index ec8c6a0482d3..100318722214 100644
--- a/net/dsa/mv88e6123_61_65.c
+++ b/net/dsa/mv88e6123_61_65.c
@@ -394,7 +394,7 @@ static int mv88e6123_61_65_get_sset_count(struct dsa_switch *ds)
 }
 
 static struct dsa_switch_driver mv88e6123_61_65_switch_driver = {
-        .tag_protocol           = __constant_htons(ETH_P_EDSA),
+        .tag_protocol           = cpu_to_be16(ETH_P_EDSA),
         .priv_size              = sizeof(struct mv88e6xxx_priv_state),
         .probe                  = mv88e6123_61_65_probe,
         .setup                  = mv88e6123_61_65_setup,
diff --git a/net/dsa/mv88e6131.c b/net/dsa/mv88e6131.c
index 374d46a01265..70fae2444cb6 100644
--- a/net/dsa/mv88e6131.c
+++ b/net/dsa/mv88e6131.c
@@ -353,7 +353,7 @@ static int mv88e6131_get_sset_count(struct dsa_switch *ds)
 }
 
 static struct dsa_switch_driver mv88e6131_switch_driver = {
-        .tag_protocol           = __constant_htons(ETH_P_DSA),
+        .tag_protocol           = cpu_to_be16(ETH_P_DSA),
         .priv_size              = sizeof(struct mv88e6xxx_priv_state),
         .probe                  = mv88e6131_probe,
         .setup                  = mv88e6131_setup,
diff --git a/net/dsa/tag_dsa.c b/net/dsa/tag_dsa.c
index f99a019b939e..63e532a69fdb 100644
--- a/net/dsa/tag_dsa.c
+++ b/net/dsa/tag_dsa.c
@@ -176,7 +176,7 @@ out:
 }
 
 static struct packet_type dsa_packet_type = {
-        .type   = __constant_htons(ETH_P_DSA),
+        .type   = cpu_to_be16(ETH_P_DSA),
         .func   = dsa_rcv,
 };
 
diff --git a/net/dsa/tag_edsa.c b/net/dsa/tag_edsa.c
index 328ec957f786..6197f9a7ef42 100644
--- a/net/dsa/tag_edsa.c
+++ b/net/dsa/tag_edsa.c
@@ -195,7 +195,7 @@ out:
 }
 
 static struct packet_type edsa_packet_type = {
-        .type   = __constant_htons(ETH_P_EDSA),
+        .type   = cpu_to_be16(ETH_P_EDSA),
         .func   = edsa_rcv,
 };
 
diff --git a/net/dsa/tag_trailer.c b/net/dsa/tag_trailer.c
index b59132878ad1..d7e7f424ff0c 100644
--- a/net/dsa/tag_trailer.c
+++ b/net/dsa/tag_trailer.c
@@ -112,7 +112,7 @@ out:
 }
 
 static struct packet_type trailer_packet_type = {
-        .type   = __constant_htons(ETH_P_TRAILER),
+        .type   = cpu_to_be16(ETH_P_TRAILER),
         .func   = trailer_rcv,
 };
 
diff --git a/net/econet/af_econet.c b/net/econet/af_econet.c
index 8789d2bb1b06..7bf35582f656 100644
--- a/net/econet/af_econet.c
+++ b/net/econet/af_econet.c
@@ -1103,7 +1103,7 @@ drop:
 }
 
 static struct packet_type econet_packet_type = {
-        .type =         __constant_htons(ETH_P_ECONET),
+        .type =         cpu_to_be16(ETH_P_ECONET),
         .func =         econet_rcv,
 };
 
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index 743f5542d65a..627be4dc7fb0 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -369,7 +369,6 @@ lookup_protocol:
         sock_init_data(sock, sk);
 
         sk->sk_destruct    = inet_sock_destruct;
-        sk->sk_family      = PF_INET;
         sk->sk_protocol    = protocol;
         sk->sk_backlog_rcv = sk->sk_prot->backlog_rcv;
 
@@ -1253,10 +1252,10 @@ static struct sk_buff **inet_gro_receive(struct sk_buff **head,
         int proto;
         int id;
 
-        if (unlikely(!pskb_may_pull(skb, sizeof(*iph))))
+        iph = skb_gro_header(skb, sizeof(*iph));
+        if (unlikely(!iph))
                 goto out;
 
-        iph = ip_hdr(skb);
         proto = iph->protocol & (MAX_INET_PROTOS - 1);
 
         rcu_read_lock();
@@ -1264,13 +1263,13 @@ static struct sk_buff **inet_gro_receive(struct sk_buff **head,
         if (!ops || !ops->gro_receive)
                 goto out_unlock;
 
-        if (iph->version != 4 || iph->ihl != 5)
+        if (*(u8 *)iph != 0x45)
                 goto out_unlock;
 
         if (unlikely(ip_fast_csum((u8 *)iph, iph->ihl)))
                 goto out_unlock;
 
-        flush = ntohs(iph->tot_len) != skb->len ||
+        flush = ntohs(iph->tot_len) != skb_gro_len(skb) ||
                 iph->frag_off != htons(IP_DF);
         id = ntohs(iph->id);
 
@@ -1282,24 +1281,25 @@ static struct sk_buff **inet_gro_receive(struct sk_buff **head,
 
                 iph2 = ip_hdr(p);
 
-                if (iph->protocol != iph2->protocol ||
-                    iph->tos != iph2->tos ||
-                    memcmp(&iph->saddr, &iph2->saddr, 8)) {
+                if ((iph->protocol ^ iph2->protocol) |
+                    (iph->tos ^ iph2->tos) |
+                    (iph->saddr ^ iph2->saddr) |
+                    (iph->daddr ^ iph2->daddr)) {
                         NAPI_GRO_CB(p)->same_flow = 0;
                         continue;
                 }
 
                 /* All fields must match except length and checksum. */
                 NAPI_GRO_CB(p)->flush |=
-                        memcmp(&iph->frag_off, &iph2->frag_off, 4) ||
-                        (u16)(ntohs(iph2->id) + NAPI_GRO_CB(p)->count) != id;
+                        (iph->ttl ^ iph2->ttl) |
+                        ((u16)(ntohs(iph2->id) + NAPI_GRO_CB(p)->count) ^ id);
 
                 NAPI_GRO_CB(p)->flush |= flush;
         }
 
         NAPI_GRO_CB(skb)->flush |= flush;
-        __skb_pull(skb, sizeof(*iph));
-        skb_reset_transport_header(skb);
+        skb_gro_pull(skb, sizeof(*iph));
+        skb_set_transport_header(skb, skb_gro_offset(skb));
 
         pp = ops->gro_receive(head, skb);
 
@@ -1501,7 +1501,7 @@ static int ipv4_proc_init(void);
  */
 
 static struct packet_type ip_packet_type = {
-        .type = __constant_htons(ETH_P_IP),
+        .type = cpu_to_be16(ETH_P_IP),
         .func = ip_rcv,
         .gso_send_check = inet_gso_send_check,
         .gso_segment = inet_gso_segment,
diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
index 29a74c01d8de..3f6b7354699b 100644
--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -1226,7 +1226,7 @@ void arp_ifdown(struct net_device *dev)
  */
 
 static struct packet_type arp_packet_type = {
-        .type = __constant_htons(ETH_P_ARP),
+        .type = cpu_to_be16(ETH_P_ARP),
         .func = arp_rcv,
 };
 
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index 309997edc8a5..d519a6a66726 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -1075,6 +1075,14 @@ static int inetdev_event(struct notifier_block *this, unsigned long event,
                         }
                 }
                 ip_mc_up(in_dev);
+                /* fall through */
+        case NETDEV_CHANGEADDR:
+                if (IN_DEV_ARP_NOTIFY(in_dev))
+                        arp_send(ARPOP_REQUEST, ETH_P_ARP,
+                                 in_dev->ifa_list->ifa_address,
+                                 dev,
+                                 in_dev->ifa_list->ifa_address,
+                                 NULL, dev->dev_addr, NULL);
                 break;
         case NETDEV_DOWN:
                 ip_mc_down(in_dev);
@@ -1439,6 +1447,7 @@ static struct devinet_sysctl_table {
                 DEVINET_SYSCTL_RW_ENTRY(ARP_ANNOUNCE, "arp_announce"),
                 DEVINET_SYSCTL_RW_ENTRY(ARP_IGNORE, "arp_ignore"),
                 DEVINET_SYSCTL_RW_ENTRY(ARP_ACCEPT, "arp_accept"),
+                DEVINET_SYSCTL_RW_ENTRY(ARP_NOTIFY, "arp_notify"),
 
                 DEVINET_SYSCTL_FLUSHING_ENTRY(NOXFRM, "disable_xfrm"),
                 DEVINET_SYSCTL_FLUSHING_ENTRY(NOPOLICY, "disable_policy"),
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index f26ab38680de..22cd19ee44e5 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -93,24 +93,40 @@ int inet_csk_get_port(struct sock *sk, unsigned short snum)
         struct inet_bind_hashbucket *head;
         struct hlist_node *node;
         struct inet_bind_bucket *tb;
-        int ret;
+        int ret, attempts = 5;
         struct net *net = sock_net(sk);
+        int smallest_size = -1, smallest_rover;
 
         local_bh_disable();
         if (!snum) {
                 int remaining, rover, low, high;
 
+again:
                 inet_get_local_port_range(&low, &high);
                 remaining = (high - low) + 1;
-                rover = net_random() % remaining + low;
+                smallest_rover = rover = net_random() % remaining + low;
 
+                smallest_size = -1;
                 do {
                         head = &hashinfo->bhash[inet_bhashfn(net, rover,
                                         hashinfo->bhash_size)];
                         spin_lock(&head->lock);
                         inet_bind_bucket_for_each(tb, node, &head->chain)
-                                if (ib_net(tb) == net && tb->port == rover)
+                                if (ib_net(tb) == net && tb->port == rover) {
+                                        if (tb->fastreuse > 0 &&
+                                            sk->sk_reuse &&
+                                            sk->sk_state != TCP_LISTEN &&
+                                            (tb->num_owners < smallest_size || smallest_size == -1)) {
+                                                smallest_size = tb->num_owners;
+                                                smallest_rover = rover;
+                                                if (atomic_read(&hashinfo->bsockets) > (high - low) + 1) {
+                                                        spin_unlock(&head->lock);
+                                                        snum = smallest_rover;
+                                                        goto have_snum;
+                                                }
+                                        }
                                         goto next;
+                                }
                         break;
                 next:
                         spin_unlock(&head->lock);
@@ -125,14 +141,19 @@ int inet_csk_get_port(struct sock *sk, unsigned short snum)
                  * the top level, not from the 'break;' statement.
                  */
                 ret = 1;
-                if (remaining <= 0)
+                if (remaining <= 0) {
+                        if (smallest_size != -1) {
+                                snum = smallest_rover;
+                                goto have_snum;
+                        }
                         goto fail;
-
+                }
                 /* OK, here is the one we will use.  HEAD is
                  * non-NULL and we hold it's mutex.
                  */
                 snum = rover;
         } else {
+have_snum:
                 head = &hashinfo->bhash[inet_bhashfn(net, snum,
                                 hashinfo->bhash_size)];
                 spin_lock(&head->lock);
@@ -145,12 +166,19 @@ int inet_csk_get_port(struct sock *sk, unsigned short snum)
 tb_found:
         if (!hlist_empty(&tb->owners)) {
                 if (tb->fastreuse > 0 &&
-                    sk->sk_reuse && sk->sk_state != TCP_LISTEN) {
+                    sk->sk_reuse && sk->sk_state != TCP_LISTEN &&
+                    smallest_size == -1) {
                         goto success;
                 } else {
                         ret = 1;
-                        if (inet_csk(sk)->icsk_af_ops->bind_conflict(sk, tb))
+                        if (inet_csk(sk)->icsk_af_ops->bind_conflict(sk, tb)) {
+                                if (sk->sk_reuse && sk->sk_state != TCP_LISTEN &&
+                                    smallest_size != -1 && --attempts >= 0) {
+                                        spin_unlock(&head->lock);
+                                        goto again;
+                                }
                                 goto fail_unlock;
+                        }
                 }
         }
 tb_not_found:
diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
index 6a1045da48d2..625cc5f64c94 100644
--- a/net/ipv4/inet_hashtables.c
+++ b/net/ipv4/inet_hashtables.c
@@ -38,6 +38,7 @@ struct inet_bind_bucket *inet_bind_bucket_create(struct kmem_cache *cachep,
                 write_pnet(&tb->ib_net, hold_net(net));
                 tb->port      = snum;
                 tb->fastreuse = 0;
+                tb->num_owners = 0;
                 INIT_HLIST_HEAD(&tb->owners);
                 hlist_add_head(&tb->node, &head->chain);
         }
@@ -59,8 +60,13 @@ void inet_bind_bucket_destroy(struct kmem_cache *cachep, struct inet_bind_bucket
 void inet_bind_hash(struct sock *sk, struct inet_bind_bucket *tb,
                     const unsigned short snum)
 {
+        struct inet_hashinfo *hashinfo = sk->sk_prot->h.hashinfo;
+
+        atomic_inc(&hashinfo->bsockets);
+
         inet_sk(sk)->num = snum;
         sk_add_bind_node(sk, &tb->owners);
+        tb->num_owners++;
         inet_csk(sk)->icsk_bind_hash = tb;
 }
 
@@ -75,9 +81,12 @@ static void __inet_put_port(struct sock *sk)
         struct inet_bind_hashbucket *head = &hashinfo->bhash[bhash];
         struct inet_bind_bucket *tb;
 
+        atomic_dec(&hashinfo->bsockets);
+
         spin_lock(&head->lock);
         tb = inet_csk(sk)->icsk_bind_hash;
         __sk_del_bind_node(sk);
+        tb->num_owners--;
         inet_csk(sk)->icsk_bind_hash = NULL;
         inet_sk(sk)->num = 0;
         inet_bind_bucket_destroy(hashinfo->bind_bucket_cachep, tb);
@@ -444,9 +453,9 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row,
                          */
                         inet_bind_bucket_for_each(tb, node, &head->chain) {
                                 if (ib_net(tb) == net && tb->port == port) {
-                                        WARN_ON(hlist_empty(&tb->owners));
                                         if (tb->fastreuse >= 0)
                                                 goto next_port;
+                                        WARN_ON(hlist_empty(&tb->owners));
                                         if (!check_established(death_row, sk,
                                                                 port, &tw))
                                                 goto ok;
@@ -523,6 +532,7 @@ void inet_hashinfo_init(struct inet_hashinfo *h)
 {
         int i;
 
+        atomic_set(&h->bsockets, 0);
         for (i = 0; i < INET_LHTABLE_SIZE; i++) {
                 spin_lock_init(&h->listening_hash[i].lock);
                 INIT_HLIST_NULLS_HEAD(&h->listening_hash[i].head,
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 0101521f366b..07a188afb3ac 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -164,67 +164,124 @@ static DEFINE_RWLOCK(ipgre_lock);
 
 /* Given src, dst and key, find appropriate for input tunnel. */
 
-static struct ip_tunnel * ipgre_tunnel_lookup(struct net *net,
+static struct ip_tunnel * ipgre_tunnel_lookup(struct net_device *dev,
                                               __be32 remote, __be32 local,
                                               __be32 key, __be16 gre_proto)
 {
+        struct net *net = dev_net(dev);
+        int link = dev->ifindex;
         unsigned h0 = HASH(remote);
         unsigned h1 = HASH(key);
-        struct ip_tunnel *t;
-        struct ip_tunnel *t2 = NULL;
+        struct ip_tunnel *t, *cand = NULL;
         struct ipgre_net *ign = net_generic(net, ipgre_net_id);
         int dev_type = (gre_proto == htons(ETH_P_TEB)) ?
                        ARPHRD_ETHER : ARPHRD_IPGRE;
+        int score, cand_score = 4;
 
         for (t = ign->tunnels_r_l[h0^h1]; t; t = t->next) {
-                if (local == t->parms.iph.saddr && remote == t->parms.iph.daddr) {
-                        if (t->parms.i_key == key && t->dev->flags & IFF_UP) {
-                                if (t->dev->type == dev_type)
-                                        return t;
-                                if (t->dev->type == ARPHRD_IPGRE && !t2)
-                                        t2 = t;
-                        }
+                if (local != t->parms.iph.saddr ||
+                    remote != t->parms.iph.daddr ||
+                    key != t->parms.i_key ||
+                    !(t->dev->flags & IFF_UP))
+                        continue;
+
+                if (t->dev->type != ARPHRD_IPGRE &&
+                    t->dev->type != dev_type)
+                        continue;
+
+                score = 0;
+                if (t->parms.link != link)
+                        score |= 1;
+                if (t->dev->type != dev_type)
+                        score |= 2;
+                if (score == 0)
+                        return t;
+
+                if (score < cand_score) {
+                        cand = t;
+                        cand_score = score;
                 }
         }
 
         for (t = ign->tunnels_r[h0^h1]; t; t = t->next) {
-                if (remote == t->parms.iph.daddr) {
-                        if (t->parms.i_key == key && t->dev->flags & IFF_UP) {
-                                if (t->dev->type == dev_type)
-                                        return t;
-                                if (t->dev->type == ARPHRD_IPGRE && !t2)
-                                        t2 = t;
-                        }
+                if (remote != t->parms.iph.daddr ||
+                    key != t->parms.i_key ||
+                    !(t->dev->flags & IFF_UP))
+                        continue;
+
+                if (t->dev->type != ARPHRD_IPGRE &&
+                    t->dev->type != dev_type)
+                        continue;
+
+                score = 0;
+                if (t->parms.link != link)
+                        score |= 1;
+                if (t->dev->type != dev_type)
+                        score |= 2;
+                if (score == 0)
+                        return t;
+
+                if (score < cand_score) {
+                        cand = t;
+                        cand_score = score;
                 }
         }
 
         for (t = ign->tunnels_l[h1]; t; t = t->next) {
-                if (local == t->parms.iph.saddr ||
-                     (local == t->parms.iph.daddr &&
-                      ipv4_is_multicast(local))) {
-                        if (t->parms.i_key == key && t->dev->flags & IFF_UP) {
-                                if (t->dev->type == dev_type)
-                                        return t;
-                                if (t->dev->type == ARPHRD_IPGRE && !t2)
-                                        t2 = t;
-                        }
+                if ((local != t->parms.iph.saddr &&
+                     (local != t->parms.iph.daddr ||
+                      !ipv4_is_multicast(local))) ||
+                    key != t->parms.i_key ||
+                    !(t->dev->flags & IFF_UP))
+                        continue;
+
+                if (t->dev->type != ARPHRD_IPGRE &&
+                    t->dev->type != dev_type)
+                        continue;
+
+                score = 0;
+                if (t->parms.link != link)
+                        score |= 1;
+                if (t->dev->type != dev_type)
+                        score |= 2;
+                if (score == 0)
+                        return t;
+
+                if (score < cand_score) {
+                        cand = t;
+                        cand_score = score;
                 }
         }
 
         for (t = ign->tunnels_wc[h1]; t; t = t->next) {
-                if (t->parms.i_key == key && t->dev->flags & IFF_UP) {
-                        if (t->dev->type == dev_type)
-                                return t;
-                        if (t->dev->type == ARPHRD_IPGRE && !t2)
-                                t2 = t;
+                if (t->parms.i_key != key ||
+                    !(t->dev->flags & IFF_UP))
+                        continue;
+
+                if (t->dev->type != ARPHRD_IPGRE &&
+                    t->dev->type != dev_type)
+                        continue;
+
+                score = 0;
+                if (t->parms.link != link)
+                        score |= 1;
+                if (t->dev->type != dev_type)
+                        score |= 2;
+                if (score == 0)
+                        return t;
+
+                if (score < cand_score) {
+                        cand = t;
+                        cand_score = score;
                 }
         }
 
-        if (t2)
-                return t2;
+        if (cand != NULL)
+                return cand;
 
-        if (ign->fb_tunnel_dev->flags&IFF_UP)
+        if (ign->fb_tunnel_dev->flags & IFF_UP)
                 return netdev_priv(ign->fb_tunnel_dev);
+
         return NULL;
 }
 
@@ -284,6 +341,7 @@ static struct ip_tunnel *ipgre_tunnel_find(struct net *net,
         __be32 remote = parms->iph.daddr;
         __be32 local = parms->iph.saddr;
         __be32 key = parms->i_key;
+        int link = parms->link;
         struct ip_tunnel *t, **tp;
         struct ipgre_net *ign = net_generic(net, ipgre_net_id);
 
@@ -291,6 +349,7 @@ static struct ip_tunnel *ipgre_tunnel_find(struct net *net,
                 if (local == t->parms.iph.saddr &&
                     remote == t->parms.iph.daddr &&
                     key == t->parms.i_key &&
+                    link == t->parms.link &&
                     type == t->dev->type)
                         break;
 
@@ -421,7 +480,7 @@ static void ipgre_err(struct sk_buff *skb, u32 info)
         }
 
         read_lock(&ipgre_lock);
-        t = ipgre_tunnel_lookup(dev_net(skb->dev), iph->daddr, iph->saddr,
+        t = ipgre_tunnel_lookup(skb->dev, iph->daddr, iph->saddr,
                                 flags & GRE_KEY ?
                                 *(((__be32 *)p) + (grehlen / 4) - 1) : 0,
                                 p[1]);
@@ -518,7 +577,7 @@ static int ipgre_rcv(struct sk_buff *skb)
         gre_proto = *(__be16 *)(h + 2);
 
         read_lock(&ipgre_lock);
-        if ((tunnel = ipgre_tunnel_lookup(dev_net(skb->dev),
+        if ((tunnel = ipgre_tunnel_lookup(skb->dev,
                                           iph->saddr, iph->daddr, key,
                                           gre_proto))) {
                 struct net_device_stats *stats = &tunnel->dev->stats;
diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c
index d722013c1cae..90d22ae0a419 100644
--- a/net/ipv4/ipconfig.c
+++ b/net/ipv4/ipconfig.c
@@ -100,8 +100,8 @@
 #define CONF_NAMESERVERS_MAX   3       /* Maximum number of nameservers
                                            - '3' from resolv.h */
 
-#define NONE __constant_htonl(INADDR_NONE)
-#define ANY __constant_htonl(INADDR_ANY)
+#define NONE cpu_to_be32(INADDR_NONE)
+#define ANY cpu_to_be32(INADDR_ANY)
 
 /*
  * Public IP configuration
@@ -406,7 +406,7 @@ static int __init ic_defaults(void)
 static int ic_rarp_recv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt, struct net_device *orig_dev);
 
 static struct packet_type rarp_packet_type __initdata = {
-        .type = __constant_htons(ETH_P_RARP),
+        .type = cpu_to_be16(ETH_P_RARP),
         .func = ic_rarp_recv,
 };
 
@@ -568,7 +568,7 @@ struct bootp_pkt {		/* BOOTP packet format */
 static int ic_bootp_recv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt, struct net_device *orig_dev);
 
 static struct packet_type bootp_packet_type __initdata = {
-        .type = __constant_htons(ETH_P_IP),
+        .type = cpu_to_be16(ETH_P_IP),
         .func = ic_bootp_recv,
 };
 
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index 14666449dc1c..13e9dd3012b3 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -67,9 +67,6 @@
 #define CONFIG_IP_PIMSM 1
 #endif
 
-static struct sock *mroute_socket;
-
-
 /* Big lock, protecting vif table, mrt cache and mroute socket state.
    Note that the changes are semaphored via rtnl_lock.
  */
@@ -80,18 +77,9 @@ static DEFINE_RWLOCK(mrt_lock);
  *      Multicast router control variables
  */
 
-static struct vif_device vif_table[MAXVIFS];            /* Devices              */
-static int maxvif;
-
-#define VIF_EXISTS(idx) (vif_table[idx].dev != NULL)
-
-static int mroute_do_assert;                            /* Set in PIM assert    */
-static int mroute_do_pim;
-
-static struct mfc_cache *mfc_cache_array[MFC_LINES];    /* Forwarding cache     */
+#define VIF_EXISTS(_net, _idx) ((_net)->ipv4.vif_table[_idx].dev != NULL)
 
 static struct mfc_cache *mfc_unres_queue;               /* Queue of unresolved entries */
-static atomic_t cache_resolve_queue_len;                /* Size of unresolved   */
 
 /* Special spinlock for queue of unresolved entries */
 static DEFINE_SPINLOCK(mfc_unres_lock);
@@ -107,7 +95,8 @@ static DEFINE_SPINLOCK(mfc_unres_lock);
 static struct kmem_cache *mrt_cachep __read_mostly;
 
 static int ip_mr_forward(struct sk_buff *skb, struct mfc_cache *cache, int local);
-static int ipmr_cache_report(struct sk_buff *pkt, vifi_t vifi, int assert);
+static int ipmr_cache_report(struct net *net,
+                             struct sk_buff *pkt, vifi_t vifi, int assert);
 static int ipmr_fill_mroute(struct sk_buff *skb, struct mfc_cache *c, struct rtmsg *rtm);
 
 #ifdef CONFIG_IP_PIMSM_V2
@@ -120,9 +109,11 @@ static struct timer_list ipmr_expire_timer;
 
 static void ipmr_del_tunnel(struct net_device *dev, struct vifctl *v)
 {
+        struct net *net = dev_net(dev);
+
         dev_close(dev);
 
-        dev = __dev_get_by_name(&init_net, "tunl0");
+        dev = __dev_get_by_name(net, "tunl0");
         if (dev) {
                 const struct net_device_ops *ops = dev->netdev_ops;
                 struct ifreq ifr;
@@ -148,11 +139,11 @@ static void ipmr_del_tunnel(struct net_device *dev, struct vifctl *v)
 }
 
 static
-struct net_device *ipmr_new_tunnel(struct vifctl *v)
+struct net_device *ipmr_new_tunnel(struct net *net, struct vifctl *v)
 {
         struct net_device  *dev;
 
-        dev = __dev_get_by_name(&init_net, "tunl0");
+        dev = __dev_get_by_name(net, "tunl0");
 
         if (dev) {
                 const struct net_device_ops *ops = dev->netdev_ops;
@@ -181,7 +172,8 @@ struct net_device *ipmr_new_tunnel(struct vifctl *v)
 
                 dev = NULL;
 
-                if (err == 0 && (dev = __dev_get_by_name(&init_net, p.name)) != NULL) {
+                if (err == 0 &&
+                    (dev = __dev_get_by_name(net, p.name)) != NULL) {
                         dev->flags |= IFF_MULTICAST;
 
                         in_dev = __in_dev_get_rtnl(dev);
@@ -209,14 +201,15 @@ failure:
 
 #ifdef CONFIG_IP_PIMSM
 
-static int reg_vif_num = -1;
-
 static int reg_vif_xmit(struct sk_buff *skb, struct net_device *dev)
 {
+        struct net *net = dev_net(dev);
+
         read_lock(&mrt_lock);
         dev->stats.tx_bytes += skb->len;
         dev->stats.tx_packets++;
-        ipmr_cache_report(skb, reg_vif_num, IGMPMSG_WHOLEPKT);
+        ipmr_cache_report(net, skb, net->ipv4.mroute_reg_vif_num,
+                          IGMPMSG_WHOLEPKT);
         read_unlock(&mrt_lock);
         kfree_skb(skb);
         return 0;
@@ -283,16 +276,16 @@ failure:
  *      @notify: Set to 1, if the caller is a notifier_call
  */
 
-static int vif_delete(int vifi, int notify)
+static int vif_delete(struct net *net, int vifi, int notify)
 {
         struct vif_device *v;
         struct net_device *dev;
         struct in_device *in_dev;
 
-        if (vifi < 0 || vifi >= maxvif)
+        if (vifi < 0 || vifi >= net->ipv4.maxvif)
                 return -EADDRNOTAVAIL;
 
-        v = &vif_table[vifi];
+        v = &net->ipv4.vif_table[vifi];
 
         write_lock_bh(&mrt_lock);
         dev = v->dev;
@@ -304,17 +297,17 @@ static int vif_delete(int vifi, int notify)
         }
 
 #ifdef CONFIG_IP_PIMSM
-        if (vifi == reg_vif_num)
-                reg_vif_num = -1;
+        if (vifi == net->ipv4.mroute_reg_vif_num)
+                net->ipv4.mroute_reg_vif_num = -1;
 #endif
 
-        if (vifi+1 == maxvif) {
+        if (vifi+1 == net->ipv4.maxvif) {
                 int tmp;
                 for (tmp=vifi-1; tmp>=0; tmp--) {
-                        if (VIF_EXISTS(tmp))
+                        if (VIF_EXISTS(net, tmp))
                                 break;
                 }
-                maxvif = tmp+1;
+                net->ipv4.maxvif = tmp+1;
         }
 
         write_unlock_bh(&mrt_lock);
@@ -333,6 +326,12 @@ static int vif_delete(int vifi, int notify)
         return 0;
 }
 
+static inline void ipmr_cache_free(struct mfc_cache *c)
+{
+        release_net(mfc_net(c));
+        kmem_cache_free(mrt_cachep, c);
+}
+
 /* Destroy an unresolved cache entry, killing queued skbs
    and reporting error to netlink readers.
  */
@@ -341,8 +340,9 @@ static void ipmr_destroy_unres(struct mfc_cache *c)
 {
         struct sk_buff *skb;
         struct nlmsgerr *e;
+        struct net *net = mfc_net(c);
 
-        atomic_dec(&cache_resolve_queue_len);
+        atomic_dec(&net->ipv4.cache_resolve_queue_len);
 
         while ((skb = skb_dequeue(&c->mfc_un.unres.unresolved))) {
                 if (ip_hdr(skb)->version == 0) {
@@ -354,12 +354,12 @@ static void ipmr_destroy_unres(struct mfc_cache *c)
                         e->error = -ETIMEDOUT;
                         memset(&e->msg, 0, sizeof(e->msg));
 
-                        rtnl_unicast(skb, &init_net, NETLINK_CB(skb).pid);
+                        rtnl_unicast(skb, net, NETLINK_CB(skb).pid);
                 } else
                         kfree_skb(skb);
         }
 
-        kmem_cache_free(mrt_cachep, c);
+        ipmr_cache_free(c);
 }
 
 
@@ -376,7 +376,7 @@ static void ipmr_expire_process(unsigned long dummy)
                 return;
         }
 
-        if (atomic_read(&cache_resolve_queue_len) == 0)
+        if (mfc_unres_queue == NULL)
                 goto out;
 
         now = jiffies;
@@ -397,7 +397,7 @@ static void ipmr_expire_process(unsigned long dummy)
                 ipmr_destroy_unres(c);
         }
 
-        if (atomic_read(&cache_resolve_queue_len))
+        if (mfc_unres_queue != NULL)
                 mod_timer(&ipmr_expire_timer, jiffies + expires);
 
 out:
@@ -409,13 +409,15 @@ out:
 static void ipmr_update_thresholds(struct mfc_cache *cache, unsigned char *ttls)
 {
         int vifi;
+        struct net *net = mfc_net(cache);
 
         cache->mfc_un.res.minvif = MAXVIFS;
         cache->mfc_un.res.maxvif = 0;
         memset(cache->mfc_un.res.ttls, 255, MAXVIFS);
 
-        for (vifi=0; vifi<maxvif; vifi++) {
-                if (VIF_EXISTS(vifi) && ttls[vifi] && ttls[vifi] < 255) {
+        for (vifi = 0; vifi < net->ipv4.maxvif; vifi++) {
+                if (VIF_EXISTS(net, vifi) &&
+                    ttls[vifi] && ttls[vifi] < 255) {
                         cache->mfc_un.res.ttls[vifi] = ttls[vifi];
                         if (cache->mfc_un.res.minvif > vifi)
                                 cache->mfc_un.res.minvif = vifi;
@@ -425,16 +427,16 @@ static void ipmr_update_thresholds(struct mfc_cache *cache, unsigned char *ttls)
         }
 }
 
-static int vif_add(struct vifctl *vifc, int mrtsock)
+static int vif_add(struct net *net, struct vifctl *vifc, int mrtsock)
 {
         int vifi = vifc->vifc_vifi;
-        struct vif_device *v = &vif_table[vifi];
+        struct vif_device *v = &net->ipv4.vif_table[vifi];
         struct net_device *dev;
         struct in_device *in_dev;
         int err;
 
         /* Is vif busy ? */
-        if (VIF_EXISTS(vifi))
+        if (VIF_EXISTS(net, vifi))
                 return -EADDRINUSE;
 
         switch (vifc->vifc_flags) {
@@ -444,7 +446,7 @@ static int vif_add(struct vifctl *vifc, int mrtsock)
                  * Special Purpose VIF in PIM
                  * All the packets will be sent to the daemon
                  */
-                if (reg_vif_num >= 0)
+                if (net->ipv4.mroute_reg_vif_num >= 0)
                         return -EADDRINUSE;
                 dev = ipmr_reg_vif();
                 if (!dev)
@@ -458,7 +460,7 @@ static int vif_add(struct vifctl *vifc, int mrtsock)
                 break;
 #endif
         case VIFF_TUNNEL:
-                dev = ipmr_new_tunnel(vifc);
+                dev = ipmr_new_tunnel(net, vifc);
                 if (!dev)
                         return -ENOBUFS;
                 err = dev_set_allmulti(dev, 1);
@@ -469,7 +471,7 @@ static int vif_add(struct vifctl *vifc, int mrtsock)
                 }
                 break;
         case 0:
-                dev = ip_dev_find(&init_net, vifc->vifc_lcl_addr.s_addr);
+                dev = ip_dev_find(net, vifc->vifc_lcl_addr.s_addr);
                 if (!dev)
                         return -EADDRNOTAVAIL;
                 err = dev_set_allmulti(dev, 1);
@@ -510,20 +512,22 @@ static int vif_add(struct vifctl *vifc, int mrtsock)
         v->dev = dev;
 #ifdef CONFIG_IP_PIMSM
         if (v->flags&VIFF_REGISTER)
-                reg_vif_num = vifi;
+                net->ipv4.mroute_reg_vif_num = vifi;
 #endif
-        if (vifi+1 > maxvif)
-                maxvif = vifi+1;
+        if (vifi+1 > net->ipv4.maxvif)
+                net->ipv4.maxvif = vifi+1;
         write_unlock_bh(&mrt_lock);
         return 0;
 }
 
-static struct mfc_cache *ipmr_cache_find(__be32 origin, __be32 mcastgrp)
+static struct mfc_cache *ipmr_cache_find(struct net *net,
+                                         __be32 origin,
+                                         __be32 mcastgrp)
 {
         int line = MFC_HASH(mcastgrp, origin);
         struct mfc_cache *c;
 
-        for (c=mfc_cache_array[line]; c; c = c->next) {
+        for (c = net->ipv4.mfc_cache_array[line]; c; c = c->next) {
                 if (c->mfc_origin==origin && c->mfc_mcastgrp==mcastgrp)
                         break;
         }
@@ -533,22 +537,24 @@ static struct mfc_cache *ipmr_cache_find(__be32 origin, __be32 mcastgrp)
 /*
  *      Allocate a multicast cache entry
  */
-static struct mfc_cache *ipmr_cache_alloc(void)
+static struct mfc_cache *ipmr_cache_alloc(struct net *net)
 {
         struct mfc_cache *c = kmem_cache_zalloc(mrt_cachep, GFP_KERNEL);
         if (c == NULL)
                 return NULL;
         c->mfc_un.res.minvif = MAXVIFS;
+        mfc_net_set(c, net);
         return c;
 }
 
-static struct mfc_cache *ipmr_cache_alloc_unres(void)
+static struct mfc_cache *ipmr_cache_alloc_unres(struct net *net)
 {
         struct mfc_cache *c = kmem_cache_zalloc(mrt_cachep, GFP_ATOMIC);
         if (c == NULL)
                 return NULL;
         skb_queue_head_init(&c->mfc_un.unres.unresolved);
         c->mfc_un.unres.expires = jiffies + 10*HZ;
+        mfc_net_set(c, net);
         return c;
 }
 
@@ -581,7 +587,7 @@ static void ipmr_cache_resolve(struct mfc_cache *uc, struct mfc_cache *c)
                                 memset(&e->msg, 0, sizeof(e->msg));
                         }
 
-                        rtnl_unicast(skb, &init_net, NETLINK_CB(skb).pid);
+                        rtnl_unicast(skb, mfc_net(c), NETLINK_CB(skb).pid);
                 } else
                         ip_mr_forward(skb, c, 0);
         }
@@ -594,7 +600,8 @@ static void ipmr_cache_resolve(struct mfc_cache *uc, struct mfc_cache *c)
  *      Called under mrt_lock.
  */
 
-static int ipmr_cache_report(struct sk_buff *pkt, vifi_t vifi, int assert)
+static int ipmr_cache_report(struct net *net,
+                             struct sk_buff *pkt, vifi_t vifi, int assert)
 {
         struct sk_buff *skb;
         const int ihl = ip_hdrlen(pkt);
@@ -626,7 +633,7 @@ static int ipmr_cache_report(struct sk_buff *pkt, vifi_t vifi, int assert)
                 memcpy(msg, skb_network_header(pkt), sizeof(struct iphdr));
                 msg->im_msgtype = IGMPMSG_WHOLEPKT;
                 msg->im_mbz = 0;
-                msg->im_vif = reg_vif_num;
+                msg->im_vif = net->ipv4.mroute_reg_vif_num;
                 ip_hdr(skb)->ihl = sizeof(struct iphdr) >> 2;
                 ip_hdr(skb)->tot_len = htons(ntohs(ip_hdr(pkt)->tot_len) +
                                              sizeof(struct iphdr));
@@ -658,7 +665,7 @@ static int ipmr_cache_report(struct sk_buff *pkt, vifi_t vifi, int assert)
         skb->transport_header = skb->network_header;
         }
 
-        if (mroute_socket == NULL) {
+        if (net->ipv4.mroute_sk == NULL) {
                 kfree_skb(skb);
                 return -EINVAL;
         }
@@ -666,7 +673,8 @@ static int ipmr_cache_report(struct sk_buff *pkt, vifi_t vifi, int assert)
         /*
          *      Deliver to mrouted
          */
-        if ((ret = sock_queue_rcv_skb(mroute_socket, skb))<0) {
+        ret = sock_queue_rcv_skb(net->ipv4.mroute_sk, skb);
+        if (ret < 0) {
                 if (net_ratelimit())
                         printk(KERN_WARNING "mroute: pending queue full, dropping entries.\n");
                 kfree_skb(skb);
@@ -680,7 +688,7 @@ static int ipmr_cache_report(struct sk_buff *pkt, vifi_t vifi, int assert)
  */
 
 static int
-ipmr_cache_unresolved(vifi_t vifi, struct sk_buff *skb)
+ipmr_cache_unresolved(struct net *net, vifi_t vifi, struct sk_buff *skb)
 {
         int err;
         struct mfc_cache *c;
@@ -688,7 +696,8 @@ ipmr_cache_unresolved(vifi_t vifi, struct sk_buff *skb)
 
         spin_lock_bh(&mfc_unres_lock);
         for (c=mfc_unres_queue; c; c=c->next) {
-                if (c->mfc_mcastgrp == iph->daddr &&
+                if (net_eq(mfc_net(c), net) &&
+                    c->mfc_mcastgrp == iph->daddr &&
                     c->mfc_origin == iph->saddr)
                         break;
         }
@@ -698,8 +707,8 @@ ipmr_cache_unresolved(vifi_t vifi, struct sk_buff *skb)
                  *      Create a new entry if allowable
                  */
 
-                if (atomic_read(&cache_resolve_queue_len) >= 10 ||
-                    (c=ipmr_cache_alloc_unres())==NULL) {
+                if (atomic_read(&net->ipv4.cache_resolve_queue_len) >= 10 ||
+                    (c = ipmr_cache_alloc_unres(net)) == NULL) {
                         spin_unlock_bh(&mfc_unres_lock);
 
                         kfree_skb(skb);
@@ -716,18 +725,19 @@ ipmr_cache_unresolved(vifi_t vifi, struct sk_buff *skb)
                 /*
                  *      Reflect first query at mrouted.
                  */
-                if ((err = ipmr_cache_report(skb, vifi, IGMPMSG_NOCACHE))<0) {
+                err = ipmr_cache_report(net, skb, vifi, IGMPMSG_NOCACHE);
+                if (err < 0) {
                         /* If the report failed throw the cache entry
                            out - Brad Parker
                          */
                         spin_unlock_bh(&mfc_unres_lock);
 
-                        kmem_cache_free(mrt_cachep, c);
+                        ipmr_cache_free(c);
                         kfree_skb(skb);
                         return err;
                 }
 
-                atomic_inc(&cache_resolve_queue_len);
+                atomic_inc(&net->ipv4.cache_resolve_queue_len);
                 c->next = mfc_unres_queue;
                 mfc_unres_queue = c;
 
@@ -753,35 +763,37 @@ ipmr_cache_unresolved(vifi_t vifi, struct sk_buff *skb)
  *      MFC cache manipulation by user space mroute daemon
  */
 
-static int ipmr_mfc_delete(struct mfcctl *mfc)
+static int ipmr_mfc_delete(struct net *net, struct mfcctl *mfc)
 {
         int line;
         struct mfc_cache *c, **cp;
 
         line = MFC_HASH(mfc->mfcc_mcastgrp.s_addr, mfc->mfcc_origin.s_addr);
 
-        for (cp=&mfc_cache_array[line]; (c=*cp) != NULL; cp = &c->next) {
+        for (cp = &net->ipv4.mfc_cache_array[line];
+             (c = *cp) != NULL; cp = &c->next) {
                 if (c->mfc_origin == mfc->mfcc_origin.s_addr &&
                     c->mfc_mcastgrp == mfc->mfcc_mcastgrp.s_addr) {
                         write_lock_bh(&mrt_lock);
                         *cp = c->next;
                         write_unlock_bh(&mrt_lock);
 
-                        kmem_cache_free(mrt_cachep, c);
+                        ipmr_cache_free(c);
                         return 0;
                 }
         }
         return -ENOENT;
 }
 
-static int ipmr_mfc_add(struct mfcctl *mfc, int mrtsock)
+static int ipmr_mfc_add(struct net *net, struct mfcctl *mfc, int mrtsock)
 {
         int line;
         struct mfc_cache *uc, *c, **cp;
 
         line = MFC_HASH(mfc->mfcc_mcastgrp.s_addr, mfc->mfcc_origin.s_addr);
 
-        for (cp=&mfc_cache_array[line]; (c=*cp) != NULL; cp = &c->next) {
+        for (cp = &net->ipv4.mfc_cache_array[line];
+             (c = *cp) != NULL; cp = &c->next) {
                 if (c->mfc_origin == mfc->mfcc_origin.s_addr &&
                     c->mfc_mcastgrp == mfc->mfcc_mcastgrp.s_addr)
                         break;
@@ -800,7 +812,7 @@ static int ipmr_mfc_add(struct mfcctl *mfc, int mrtsock)
         if (!ipv4_is_multicast(mfc->mfcc_mcastgrp.s_addr))
                 return -EINVAL;
 
-        c = ipmr_cache_alloc();
+        c = ipmr_cache_alloc(net);
         if (c == NULL)
                 return -ENOMEM;
 
@@ -812,8 +824,8 @@ static int ipmr_mfc_add(struct mfcctl *mfc, int mrtsock)
                 c->mfc_flags |= MFC_STATIC;
 
         write_lock_bh(&mrt_lock);
-        c->next = mfc_cache_array[line];
-        mfc_cache_array[line] = c;
+        c->next = net->ipv4.mfc_cache_array[line];
+        net->ipv4.mfc_cache_array[line] = c;
         write_unlock_bh(&mrt_lock);
 
         /*
@@ -823,19 +835,21 @@ static int ipmr_mfc_add(struct mfcctl *mfc, int mrtsock)
         spin_lock_bh(&mfc_unres_lock);
         for (cp = &mfc_unres_queue; (uc=*cp) != NULL;
              cp = &uc->next) {
-                if (uc->mfc_origin == c->mfc_origin &&
+                if (net_eq(mfc_net(uc), net) &&
+                    uc->mfc_origin == c->mfc_origin &&
                     uc->mfc_mcastgrp == c->mfc_mcastgrp) {
                         *cp = uc->next;
-                        if (atomic_dec_and_test(&cache_resolve_queue_len))
-                                del_timer(&ipmr_expire_timer);
+                        atomic_dec(&net->ipv4.cache_resolve_queue_len);
                         break;
                 }
         }
+        if (mfc_unres_queue == NULL)
+                del_timer(&ipmr_expire_timer);
         spin_unlock_bh(&mfc_unres_lock);
 
         if (uc) {
                 ipmr_cache_resolve(uc, c);
-                kmem_cache_free(mrt_cachep, uc);
+                ipmr_cache_free(uc);
         }
         return 0;
 }
@@ -844,16 +858,16 @@ static int ipmr_mfc_add(struct mfcctl *mfc, int mrtsock)
  *      Close the multicast socket, and clear the vif tables etc
  */
 
-static void mroute_clean_tables(struct sock *sk)
+static void mroute_clean_tables(struct net *net)
 {
         int i;
 
         /*
          *      Shut down all active vif entries
          */
-        for (i=0; i<maxvif; i++) {
-                if (!(vif_table[i].flags&VIFF_STATIC))
-                        vif_delete(i, 0);
+        for (i = 0; i < net->ipv4.maxvif; i++) {
+                if (!(net->ipv4.vif_table[i].flags&VIFF_STATIC))
+                        vif_delete(net, i, 0);
         }
 
         /*
@@ -862,7 +876,7 @@ static void mroute_clean_tables(struct sock *sk)
         for (i=0; i<MFC_LINES; i++) {
                 struct mfc_cache *c, **cp;
 
-                cp = &mfc_cache_array[i];
+                cp = &net->ipv4.mfc_cache_array[i];
                 while ((c = *cp) != NULL) {
                         if (c->mfc_flags&MFC_STATIC) {
                                 cp = &c->next;
@@ -872,22 +886,23 @@ static void mroute_clean_tables(struct sock *sk)
                         *cp = c->next;
                         write_unlock_bh(&mrt_lock);
 
-                        kmem_cache_free(mrt_cachep, c);
+                        ipmr_cache_free(c);
                 }
         }
 
-        if (atomic_read(&cache_resolve_queue_len) != 0) {
-                struct mfc_cache *c;
+        if (atomic_read(&net->ipv4.cache_resolve_queue_len) != 0) {
+                struct mfc_cache *c, **cp;
 
                 spin_lock_bh(&mfc_unres_lock);
-                while (mfc_unres_queue != NULL) {
-                        c = mfc_unres_queue;
-                        mfc_unres_queue = c->next;
-                        spin_unlock_bh(&mfc_unres_lock);
+                cp = &mfc_unres_queue;
+                while ((c = *cp) != NULL) {
+                        if (!net_eq(mfc_net(c), net)) {
+                                cp = &c->next;
+                                continue;
+                        }
+                        *cp = c->next;
 
                         ipmr_destroy_unres(c);
-
-                        spin_lock_bh(&mfc_unres_lock);
                 }
                 spin_unlock_bh(&mfc_unres_lock);
         }
@@ -895,15 +910,17 @@ static void mroute_clean_tables(struct sock *sk)
 
 static void mrtsock_destruct(struct sock *sk)
 {
+        struct net *net = sock_net(sk);
+
         rtnl_lock();
-        if (sk == mroute_socket) {
-                IPV4_DEVCONF_ALL(sock_net(sk), MC_FORWARDING)--;
+        if (sk == net->ipv4.mroute_sk) {
+                IPV4_DEVCONF_ALL(net, MC_FORWARDING)--;
 
                 write_lock_bh(&mrt_lock);
-                mroute_socket = NULL;
+                net->ipv4.mroute_sk = NULL;
                 write_unlock_bh(&mrt_lock);
 
-                mroute_clean_tables(sk);
+                mroute_clean_tables(net);
         }
         rtnl_unlock();
 }
@@ -920,9 +937,10 @@ int ip_mroute_setsockopt(struct sock *sk, int optname, char __user *optval, int
         int ret;
         struct vifctl vif;
         struct mfcctl mfc;
+        struct net *net = sock_net(sk);
 
         if (optname != MRT_INIT) {
-                if (sk != mroute_socket && !capable(CAP_NET_ADMIN))
+                if (sk != net->ipv4.mroute_sk && !capable(CAP_NET_ADMIN))
                         return -EACCES;
         }
 
@@ -935,7 +953,7 @@ int ip_mroute_setsockopt(struct sock *sk, int optname, char __user *optval, int
                         return -ENOPROTOOPT;
 
                 rtnl_lock();
-                if (mroute_socket) {
+                if (net->ipv4.mroute_sk) {
                         rtnl_unlock();
                         return -EADDRINUSE;
                 }
@@ -943,15 +961,15 @@ int ip_mroute_setsockopt(struct sock *sk, int optname, char __user *optval, int
                 ret = ip_ra_control(sk, 1, mrtsock_destruct);
                 if (ret == 0) {
                         write_lock_bh(&mrt_lock);
-                        mroute_socket = sk;
+                        net->ipv4.mroute_sk = sk;
                         write_unlock_bh(&mrt_lock);
 
-                        IPV4_DEVCONF_ALL(sock_net(sk), MC_FORWARDING)++;
+                        IPV4_DEVCONF_ALL(net, MC_FORWARDING)++;
                 }
                 rtnl_unlock();
                 return ret;
         case MRT_DONE:
-                if (sk != mroute_socket)
+                if (sk != net->ipv4.mroute_sk)
                         return -EACCES;
                 return ip_ra_control(sk, 0, NULL);
         case MRT_ADD_VIF:
@@ -964,9 +982,9 @@ int ip_mroute_setsockopt(struct sock *sk, int optname, char __user *optval, int
                         return -ENFILE;
                 rtnl_lock();
                 if (optname == MRT_ADD_VIF) {
-                        ret = vif_add(&vif, sk==mroute_socket);
+                        ret = vif_add(net, &vif, sk == net->ipv4.mroute_sk);
                 } else {
-                        ret = vif_delete(vif.vifc_vifi, 0);
+                        ret = vif_delete(net, vif.vifc_vifi, 0);
                 }
                 rtnl_unlock();
                 return ret;
@@ -983,9 +1001,9 @@ int ip_mroute_setsockopt(struct sock *sk, int optname, char __user *optval, int
                         return -EFAULT;
                 rtnl_lock();
                 if (optname == MRT_DEL_MFC)
-                        ret = ipmr_mfc_delete(&mfc);
+                        ret = ipmr_mfc_delete(net, &mfc);
                 else
-                        ret = ipmr_mfc_add(&mfc, sk==mroute_socket);
+                        ret = ipmr_mfc_add(net, &mfc, sk == net->ipv4.mroute_sk);
                 rtnl_unlock();
                 return ret;
                 /*
@@ -996,7 +1014,7 @@ int ip_mroute_setsockopt(struct sock *sk, int optname, char __user *optval, int
                 int v;
                 if (get_user(v,(int __user *)optval))
                         return -EFAULT;
-                mroute_do_assert=(v)?1:0;
+                net->ipv4.mroute_do_assert = (v) ? 1 : 0;
                 return 0;
         }
 #ifdef CONFIG_IP_PIMSM
@@ -1010,11 +1028,11 @@ int ip_mroute_setsockopt(struct sock *sk, int optname, char __user *optval, int
 
                 rtnl_lock();
                 ret = 0;
-                if (v != mroute_do_pim) {
-                        mroute_do_pim = v;
-                        mroute_do_assert = v;
+                if (v != net->ipv4.mroute_do_pim) {
+                        net->ipv4.mroute_do_pim = v;
+                        net->ipv4.mroute_do_assert = v;
 #ifdef CONFIG_IP_PIMSM_V2
-                        if (mroute_do_pim)
+                        if (net->ipv4.mroute_do_pim)
                                 ret = inet_add_protocol(&pim_protocol,
                                                         IPPROTO_PIM);
                         else
@@ -1045,6 +1063,7 @@ int ip_mroute_getsockopt(struct sock *sk, int optname, char __user *optval, int
 {
         int olr;
         int val;
+        struct net *net = sock_net(sk);
 
         if (optname != MRT_VERSION &&
 #ifdef CONFIG_IP_PIMSM
@@ -1066,10 +1085,10 @@ int ip_mroute_getsockopt(struct sock *sk, int optname, char __user *optval, int
                 val = 0x0305;
 #ifdef CONFIG_IP_PIMSM
         else if (optname == MRT_PIM)
-                val = mroute_do_pim;
+                val = net->ipv4.mroute_do_pim;
 #endif
         else
-                val = mroute_do_assert;
+                val = net->ipv4.mroute_do_assert;
         if (copy_to_user(optval, &val, olr))
                 return -EFAULT;
         return 0;
@@ -1085,16 +1104,17 @@ int ipmr_ioctl(struct sock *sk, int cmd, void __user *arg)
         struct sioc_vif_req vr;
         struct vif_device *vif;
         struct mfc_cache *c;
+        struct net *net = sock_net(sk);
 
         switch (cmd) {
         case SIOCGETVIFCNT:
                 if (copy_from_user(&vr, arg, sizeof(vr)))
                         return -EFAULT;
-                if (vr.vifi >= maxvif)
+                if (vr.vifi >= net->ipv4.maxvif)
                         return -EINVAL;
                 read_lock(&mrt_lock);
-                vif=&vif_table[vr.vifi];
-                if (VIF_EXISTS(vr.vifi))        {
+                vif = &net->ipv4.vif_table[vr.vifi];
+                if (VIF_EXISTS(net, vr.vifi)) {
                         vr.icount = vif->pkt_in;
                         vr.ocount = vif->pkt_out;
                         vr.ibytes = vif->bytes_in;
@@ -1112,7 +1132,7 @@ int ipmr_ioctl(struct sock *sk, int cmd, void __user *arg)
                         return -EFAULT;
 
                 read_lock(&mrt_lock);
-                c = ipmr_cache_find(sr.src.s_addr, sr.grp.s_addr);
+                c = ipmr_cache_find(net, sr.src.s_addr, sr.grp.s_addr);
                 if (c) {
                         sr.pktcnt = c->mfc_un.res.pkt;
                         sr.bytecnt = c->mfc_un.res.bytes;
@@ -1134,18 +1154,19 @@ int ipmr_ioctl(struct sock *sk, int cmd, void __user *arg)
 static int ipmr_device_event(struct notifier_block *this, unsigned long event, void *ptr)
 {
         struct net_device *dev = ptr;
+        struct net *net = dev_net(dev);
         struct vif_device *v;
         int ct;
 
-        if (!net_eq(dev_net(dev), &init_net))
+        if (!net_eq(dev_net(dev), net))
                 return NOTIFY_DONE;
 
         if (event != NETDEV_UNREGISTER)
                 return NOTIFY_DONE;
-        v=&vif_table[0];
-        for (ct=0; ct<maxvif; ct++,v++) {
+        v = &net->ipv4.vif_table[0];
+        for (ct = 0; ct < net->ipv4.maxvif; ct++, v++) {
                 if (v->dev == dev)
-                        vif_delete(ct, 1);
+                        vif_delete(net, ct, 1);
         }
         return NOTIFY_DONE;
 }
@@ -1205,8 +1226,9 @@ static inline int ipmr_forward_finish(struct sk_buff *skb)
 
 static void ipmr_queue_xmit(struct sk_buff *skb, struct mfc_cache *c, int vifi)
 {
+        struct net *net = mfc_net(c);
         const struct iphdr *iph = ip_hdr(skb);
-        struct vif_device *vif = &vif_table[vifi];
+        struct vif_device *vif = &net->ipv4.vif_table[vifi];
         struct net_device *dev;
         struct rtable *rt;
         int    encap = 0;
@@ -1220,9 +1242,8 @@ static void ipmr_queue_xmit(struct sk_buff *skb, struct mfc_cache *c, int vifi)
                 vif->bytes_out += skb->len;
                 vif->dev->stats.tx_bytes += skb->len;
                 vif->dev->stats.tx_packets++;
-                ipmr_cache_report(skb, vifi, IGMPMSG_WHOLEPKT);
-                kfree_skb(skb);
-                return;
+                ipmr_cache_report(net, skb, vifi, IGMPMSG_WHOLEPKT);
+                goto out_free;
         }
 #endif
 
@@ -1233,7 +1254,7 @@ static void ipmr_queue_xmit(struct sk_buff *skb, struct mfc_cache *c, int vifi)
                                                 .saddr = vif->local,
                                                 .tos = RT_TOS(iph->tos) } },
                                     .proto = IPPROTO_IPIP };
-                if (ip_route_output_key(&init_net, &rt, &fl))
+                if (ip_route_output_key(net, &rt, &fl))
                         goto out_free;
                 encap = sizeof(struct iphdr);
         } else {
@@ -1242,7 +1263,7 @@ static void ipmr_queue_xmit(struct sk_buff *skb, struct mfc_cache *c, int vifi)
                                               { .daddr = iph->daddr,
                                                 .tos = RT_TOS(iph->tos) } },
                                     .proto = IPPROTO_IPIP };
-                if (ip_route_output_key(&init_net, &rt, &fl))
+                if (ip_route_output_key(net, &rt, &fl))
                         goto out_free;
         }
 
@@ -1306,9 +1327,10 @@ out_free:
 
 static int ipmr_find_vif(struct net_device *dev)
 {
+        struct net *net = dev_net(dev);
         int ct;
-        for (ct=maxvif-1; ct>=0; ct--) {
-                if (vif_table[ct].dev == dev)
+        for (ct = net->ipv4.maxvif-1; ct >= 0; ct--) {
+                if (net->ipv4.vif_table[ct].dev == dev)
                         break;
         }
         return ct;
@@ -1320,6 +1342,7 @@ static int ip_mr_forward(struct sk_buff *skb, struct mfc_cache *cache, int local
 {
         int psend = -1;
         int vif, ct;
+        struct net *net = mfc_net(cache);
 
         vif = cache->mfc_parent;
         cache->mfc_un.res.pkt++;
@@ -1328,7 +1351,7 @@ static int ip_mr_forward(struct sk_buff *skb, struct mfc_cache *cache, int local
         /*
          * Wrong interface: drop packet and (maybe) send PIM assert.
          */
-        if (vif_table[vif].dev != skb->dev) {
+        if (net->ipv4.vif_table[vif].dev != skb->dev) {
                 int true_vifi;
 
                 if (skb->rtable->fl.iif == 0) {
@@ -1349,23 +1372,24 @@ static int ip_mr_forward(struct sk_buff *skb, struct mfc_cache *cache, int local
                 cache->mfc_un.res.wrong_if++;
                 true_vifi = ipmr_find_vif(skb->dev);
 
-                if (true_vifi >= 0 && mroute_do_assert &&
+                if (true_vifi >= 0 && net->ipv4.mroute_do_assert &&
                     /* pimsm uses asserts, when switching from RPT to SPT,
                        so that we cannot check that packet arrived on an oif.
                        It is bad, but otherwise we would need to move pretty
                        large chunk of pimd to kernel. Ough... --ANK
                      */
-                    (mroute_do_pim || cache->mfc_un.res.ttls[true_vifi] < 255) &&
+                    (net->ipv4.mroute_do_pim ||
+                     cache->mfc_un.res.ttls[true_vifi] < 255) &&
                     time_after(jiffies,
                                cache->mfc_un.res.last_assert + MFC_ASSERT_THRESH)) {
                         cache->mfc_un.res.last_assert = jiffies;
-                        ipmr_cache_report(skb, true_vifi, IGMPMSG_WRONGVIF);
+                        ipmr_cache_report(net, skb, true_vifi, IGMPMSG_WRONGVIF);
                 }
                 goto dont_forward;
         }
 
-        vif_table[vif].pkt_in++;
-        vif_table[vif].bytes_in += skb->len;
+        net->ipv4.vif_table[vif].pkt_in++;
+        net->ipv4.vif_table[vif].bytes_in += skb->len;
 
         /*
          *      Forward the frame
@@ -1405,6 +1429,7 @@ dont_forward:
 int ip_mr_input(struct sk_buff *skb)
 {
         struct mfc_cache *cache;
+        struct net *net = dev_net(skb->dev);
         int local = skb->rtable->rt_flags&RTCF_LOCAL;
 
         /* Packet is looped back after forward, it should not be
@@ -1425,9 +1450,9 @@ int ip_mr_input(struct sk_buff *skb)
                                that we can forward NO IGMP messages.
                              */
                             read_lock(&mrt_lock);
-                            if (mroute_socket) {
+                            if (net->ipv4.mroute_sk) {
                                     nf_reset(skb);
-                                    raw_rcv(mroute_socket, skb);
+                                    raw_rcv(net->ipv4.mroute_sk, skb);
                                     read_unlock(&mrt_lock);
                                     return 0;
                             }
@@ -1436,7 +1461,7 @@ int ip_mr_input(struct sk_buff *skb)
         }
 
         read_lock(&mrt_lock);
-        cache = ipmr_cache_find(ip_hdr(skb)->saddr, ip_hdr(skb)->daddr);
+        cache = ipmr_cache_find(net, ip_hdr(skb)->saddr, ip_hdr(skb)->daddr);
 
         /*
          *      No usable cache entry
@@ -1456,7 +1481,7 @@ int ip_mr_input(struct sk_buff *skb)
 
                 vif = ipmr_find_vif(skb->dev);
                 if (vif >= 0) {
-                        int err = ipmr_cache_unresolved(vif, skb);
+                        int err = ipmr_cache_unresolved(net, vif, skb);
                         read_unlock(&mrt_lock);
 
                         return err;
@@ -1487,6 +1512,7 @@ static int __pim_rcv(struct sk_buff *skb, unsigned int pimlen)
 {
         struct net_device *reg_dev = NULL;
         struct iphdr *encap;
+        struct net *net = dev_net(skb->dev);
 
         encap = (struct iphdr *)(skb_transport_header(skb) + pimlen);
         /*
@@ -1501,8 +1527,8 @@ static int __pim_rcv(struct sk_buff *skb, unsigned int pimlen)
                 return 1;
 
         read_lock(&mrt_lock);
-        if (reg_vif_num >= 0)
-                reg_dev = vif_table[reg_vif_num].dev;
+        if (net->ipv4.mroute_reg_vif_num >= 0)
+                reg_dev = net->ipv4.vif_table[net->ipv4.mroute_reg_vif_num].dev;
         if (reg_dev)
                 dev_hold(reg_dev);
         read_unlock(&mrt_lock);
@@ -1537,13 +1563,14 @@ static int __pim_rcv(struct sk_buff *skb, unsigned int pimlen)
 int pim_rcv_v1(struct sk_buff * skb)
 {
         struct igmphdr *pim;
+        struct net *net = dev_net(skb->dev);
 
         if (!pskb_may_pull(skb, sizeof(*pim) + sizeof(struct iphdr)))
                 goto drop;
 
         pim = igmp_hdr(skb);
 
-        if (!mroute_do_pim ||
+        if (!net->ipv4.mroute_do_pim ||
             pim->group != PIM_V1_VERSION || pim->code != PIM_V1_REGISTER)
                 goto drop;
 
@@ -1583,7 +1610,8 @@ ipmr_fill_mroute(struct sk_buff *skb, struct mfc_cache *c, struct rtmsg *rtm)
 {
         int ct;
         struct rtnexthop *nhp;
-        struct net_device *dev = vif_table[c->mfc_parent].dev;
+        struct net *net = mfc_net(c);
+        struct net_device *dev = net->ipv4.vif_table[c->mfc_parent].dev;
         u8 *b = skb_tail_pointer(skb);
         struct rtattr *mp_head;
 
@@ -1599,7 +1627,7 @@ ipmr_fill_mroute(struct sk_buff *skb, struct mfc_cache *c, struct rtmsg *rtm)
                         nhp = (struct rtnexthop *)skb_put(skb, RTA_ALIGN(sizeof(*nhp)));
                         nhp->rtnh_flags = 0;
                         nhp->rtnh_hops = c->mfc_un.res.ttls[ct];
-                        nhp->rtnh_ifindex = vif_table[ct].dev->ifindex;
+                        nhp->rtnh_ifindex = net->ipv4.vif_table[ct].dev->ifindex;
                         nhp->rtnh_len = sizeof(*nhp);
                 }
         }
@@ -1613,14 +1641,15 @@ rtattr_failure:
         return -EMSGSIZE;
 }
 
-int ipmr_get_route(struct sk_buff *skb, struct rtmsg *rtm, int nowait)
+int ipmr_get_route(struct net *net,
+                   struct sk_buff *skb, struct rtmsg *rtm, int nowait)
 {
         int err;
         struct mfc_cache *cache;
         struct rtable *rt = skb->rtable;
 
         read_lock(&mrt_lock);
-        cache = ipmr_cache_find(rt->rt_src, rt->rt_dst);
+        cache = ipmr_cache_find(net, rt->rt_src, rt->rt_dst);
 
         if (cache == NULL) {
                 struct sk_buff *skb2;
@@ -1651,7 +1680,7 @@ int ipmr_get_route(struct sk_buff *skb, struct rtmsg *rtm, int nowait)
                 iph->saddr = rt->rt_src;
                 iph->daddr = rt->rt_dst;
                 iph->version = 0;
-                err = ipmr_cache_unresolved(vif, skb2);
+                err = ipmr_cache_unresolved(net, vif, skb2);
                 read_unlock(&mrt_lock);
                 return err;
         }
@@ -1668,17 +1697,19 @@ int ipmr_get_route(struct sk_buff *skb, struct rtmsg *rtm, int nowait)
  *      The /proc interfaces to multicast routing /proc/ip_mr_cache /proc/ip_mr_vif
  */
 struct ipmr_vif_iter {
+        struct seq_net_private p;
         int ct;
 };
 
-static struct vif_device *ipmr_vif_seq_idx(struct ipmr_vif_iter *iter,
+static struct vif_device *ipmr_vif_seq_idx(struct net *net,
+                                           struct ipmr_vif_iter *iter,
                                            loff_t pos)
 {
-        for (iter->ct = 0; iter->ct < maxvif; ++iter->ct) {
-                if (!VIF_EXISTS(iter->ct))
+        for (iter->ct = 0; iter->ct < net->ipv4.maxvif; ++iter->ct) {
+                if (!VIF_EXISTS(net, iter->ct))
                         continue;
                 if (pos-- == 0)
-                        return &vif_table[iter->ct];
+                        return &net->ipv4.vif_table[iter->ct];
         }
         return NULL;
 }
@@ -1686,23 +1717,26 @@ static struct vif_device *ipmr_vif_seq_idx(struct ipmr_vif_iter *iter,
 static void *ipmr_vif_seq_start(struct seq_file *seq, loff_t *pos)
         __acquires(mrt_lock)
 {
+        struct net *net = seq_file_net(seq);
+
         read_lock(&mrt_lock);
-        return *pos ? ipmr_vif_seq_idx(seq->private, *pos - 1)
+        return *pos ? ipmr_vif_seq_idx(net, seq->private, *pos - 1)
                 : SEQ_START_TOKEN;
 }
 
 static void *ipmr_vif_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 {
         struct ipmr_vif_iter *iter = seq->private;
+        struct net *net = seq_file_net(seq);
 
         ++*pos;
         if (v == SEQ_START_TOKEN)
-                return ipmr_vif_seq_idx(iter, 0);
+                return ipmr_vif_seq_idx(net, iter, 0);
 
-        while (++iter->ct < maxvif) {
-                if (!VIF_EXISTS(iter->ct))
+        while (++iter->ct < net->ipv4.maxvif) {
+                if (!VIF_EXISTS(net, iter->ct))
                         continue;
-                return &vif_table[iter->ct];
+                return &net->ipv4.vif_table[iter->ct];
         }
         return NULL;
 }
@@ -1715,6 +1749,8 @@ static void ipmr_vif_seq_stop(struct seq_file *seq, void *v)
 
 static int ipmr_vif_seq_show(struct seq_file *seq, void *v)
 {
+        struct net *net = seq_file_net(seq);
+
         if (v == SEQ_START_TOKEN) {
                 seq_puts(seq,
                          "Interface      BytesIn  PktsIn  BytesOut PktsOut Flags Local    Remote\n");
@@ -1724,7 +1760,7 @@ static int ipmr_vif_seq_show(struct seq_file *seq, void *v)
 
                 seq_printf(seq,
                            "%2Zd %-10s %8ld %7ld  %8ld %7ld %05X %08X %08X\n",
-                           vif - vif_table,
+                           vif - net->ipv4.vif_table,
                            name, vif->bytes_in, vif->pkt_in,
                            vif->bytes_out, vif->pkt_out,
                            vif->flags, vif->local, vif->remote);
@@ -1741,8 +1777,8 @@ static const struct seq_operations ipmr_vif_seq_ops = {
 
 static int ipmr_vif_open(struct inode *inode, struct file *file)
 {
-        return seq_open_private(file, &ipmr_vif_seq_ops,
-                        sizeof(struct ipmr_vif_iter));
+        return seq_open_net(inode, file, &ipmr_vif_seq_ops,
+                            sizeof(struct ipmr_vif_iter));
 }
 
 static const struct file_operations ipmr_vif_fops = {
@@ -1750,23 +1786,26 @@ static const struct file_operations ipmr_vif_fops = {
         .open    = ipmr_vif_open,
         .read    = seq_read,
         .llseek  = seq_lseek,
-        .release = seq_release_private,
+        .release = seq_release_net,
 };
 
 struct ipmr_mfc_iter {
+        struct seq_net_private p;
         struct mfc_cache **cache;
         int ct;
 };
 
 
-static struct mfc_cache *ipmr_mfc_seq_idx(struct ipmr_mfc_iter *it, loff_t pos)
+static struct mfc_cache *ipmr_mfc_seq_idx(struct net *net,
+                                          struct ipmr_mfc_iter *it, loff_t pos)
 {
         struct mfc_cache *mfc;
 
-        it->cache = mfc_cache_array;
+        it->cache = net->ipv4.mfc_cache_array;
         read_lock(&mrt_lock);
         for (it->ct = 0; it->ct < MFC_LINES; it->ct++)
-                for (mfc = mfc_cache_array[it->ct]; mfc; mfc = mfc->next)
+                for (mfc = net->ipv4.mfc_cache_array[it->ct];
+                     mfc; mfc = mfc->next)
                         if (pos-- == 0)
                                 return mfc;
         read_unlock(&mrt_lock);
@@ -1774,7 +1813,8 @@ static struct mfc_cache *ipmr_mfc_seq_idx(struct ipmr_mfc_iter *it, loff_t pos)
         it->cache = &mfc_unres_queue;
         spin_lock_bh(&mfc_unres_lock);
         for (mfc = mfc_unres_queue; mfc; mfc = mfc->next)
-                if (pos-- == 0)
+                if (net_eq(mfc_net(mfc), net) &&
+                    pos-- == 0)
                         return mfc;
         spin_unlock_bh(&mfc_unres_lock);
 
@@ -1786,9 +1826,11 @@ static struct mfc_cache *ipmr_mfc_seq_idx(struct ipmr_mfc_iter *it, loff_t pos)
 static void *ipmr_mfc_seq_start(struct seq_file *seq, loff_t *pos)
 {
         struct ipmr_mfc_iter *it = seq->private;
+        struct net *net = seq_file_net(seq);
+
         it->cache = NULL;
         it->ct = 0;
-        return *pos ? ipmr_mfc_seq_idx(seq->private, *pos - 1)
+        return *pos ? ipmr_mfc_seq_idx(net, seq->private, *pos - 1)
                 : SEQ_START_TOKEN;
 }
 
@@ -1796,11 +1838,12 @@ static void *ipmr_mfc_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 {
         struct mfc_cache *mfc = v;
         struct ipmr_mfc_iter *it = seq->private;
+        struct net *net = seq_file_net(seq);
 
         ++*pos;
 
         if (v == SEQ_START_TOKEN)
-                return ipmr_mfc_seq_idx(seq->private, 0);
+                return ipmr_mfc_seq_idx(net, seq->private, 0);
 
         if (mfc->next)
                 return mfc->next;
@@ -1808,10 +1851,10 @@ static void *ipmr_mfc_seq_next(struct seq_file *seq, void *v, loff_t *pos)
         if (it->cache == &mfc_unres_queue)
                 goto end_of_list;
 
-        BUG_ON(it->cache != mfc_cache_array);
+        BUG_ON(it->cache != net->ipv4.mfc_cache_array);
 
         while (++it->ct < MFC_LINES) {
-                mfc = mfc_cache_array[it->ct];
+                mfc = net->ipv4.mfc_cache_array[it->ct];
                 if (mfc)
                         return mfc;
         }
@@ -1823,6 +1866,8 @@ static void *ipmr_mfc_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 
         spin_lock_bh(&mfc_unres_lock);
         mfc = mfc_unres_queue;
+        while (mfc && !net_eq(mfc_net(mfc), net))
+                mfc = mfc->next;
         if (mfc)
                 return mfc;
 
@@ -1836,16 +1881,18 @@ static void *ipmr_mfc_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 static void ipmr_mfc_seq_stop(struct seq_file *seq, void *v)
 {
         struct ipmr_mfc_iter *it = seq->private;
+        struct net *net = seq_file_net(seq);
 
         if (it->cache == &mfc_unres_queue)
                 spin_unlock_bh(&mfc_unres_lock);
-        else if (it->cache == mfc_cache_array)
+        else if (it->cache == net->ipv4.mfc_cache_array)
                 read_unlock(&mrt_lock);
 }
 
 static int ipmr_mfc_seq_show(struct seq_file *seq, void *v)
 {
         int n;
+        struct net *net = seq_file_net(seq);
 
         if (v == SEQ_START_TOKEN) {
                 seq_puts(seq,
@@ -1866,9 +1913,9 @@ static int ipmr_mfc_seq_show(struct seq_file *seq, void *v)
                                    mfc->mfc_un.res.wrong_if);
                         for (n = mfc->mfc_un.res.minvif;
                              n < mfc->mfc_un.res.maxvif; n++ ) {
-                                if (VIF_EXISTS(n)
-                                   && mfc->mfc_un.res.ttls[n] < 255)
-                                seq_printf(seq,
+                                if (VIF_EXISTS(net, n) &&
+                                    mfc->mfc_un.res.ttls[n] < 255)
+                                        seq_printf(seq,
                                            " %2d:%-3d",
                                            n, mfc->mfc_un.res.ttls[n]);
                         }
@@ -1892,8 +1939,8 @@ static const struct seq_operations ipmr_mfc_seq_ops = {
 
 static int ipmr_mfc_open(struct inode *inode, struct file *file)
 {
-        return seq_open_private(file, &ipmr_mfc_seq_ops,
-                        sizeof(struct ipmr_mfc_iter));
+        return seq_open_net(inode, file, &ipmr_mfc_seq_ops,
+                            sizeof(struct ipmr_mfc_iter));
 }
 
 static const struct file_operations ipmr_mfc_fops = {
@@ -1901,7 +1948,7 @@ static const struct file_operations ipmr_mfc_fops = {
         .open    = ipmr_mfc_open,
         .read    = seq_read,
         .llseek  = seq_lseek,
-        .release = seq_release_private,
+        .release = seq_release_net,
 };
 #endif
 
@@ -1915,6 +1962,65 @@ static struct net_protocol pim_protocol = {
 /*
  *      Setup for IP multicast routing
  */
+static int __net_init ipmr_net_init(struct net *net)
+{
+        int err = 0;
+
+        net->ipv4.vif_table = kcalloc(MAXVIFS, sizeof(struct vif_device),
+                                      GFP_KERNEL);
+        if (!net->ipv4.vif_table) {
+                err = -ENOMEM;
+                goto fail;
+        }
+
+        /* Forwarding cache */
+        net->ipv4.mfc_cache_array = kcalloc(MFC_LINES,
+                                            sizeof(struct mfc_cache *),
+                                            GFP_KERNEL);
+        if (!net->ipv4.mfc_cache_array) {
+                err = -ENOMEM;
+                goto fail_mfc_cache;
+        }
+
+#ifdef CONFIG_IP_PIMSM
+        net->ipv4.mroute_reg_vif_num = -1;
+#endif
+
+#ifdef CONFIG_PROC_FS
+        err = -ENOMEM;
+        if (!proc_net_fops_create(net, "ip_mr_vif", 0, &ipmr_vif_fops))
+                goto proc_vif_fail;
+        if (!proc_net_fops_create(net, "ip_mr_cache", 0, &ipmr_mfc_fops))
+                goto proc_cache_fail;
+#endif
+        return 0;
+
+#ifdef CONFIG_PROC_FS
+proc_cache_fail:
+        proc_net_remove(net, "ip_mr_vif");
+proc_vif_fail:
+        kfree(net->ipv4.mfc_cache_array);
+#endif
+fail_mfc_cache:
+        kfree(net->ipv4.vif_table);
+fail:
+        return err;
+}
+
+static void __net_exit ipmr_net_exit(struct net *net)
+{
+#ifdef CONFIG_PROC_FS
+        proc_net_remove(net, "ip_mr_cache");
+        proc_net_remove(net, "ip_mr_vif");
+#endif
+        kfree(net->ipv4.mfc_cache_array);
+        kfree(net->ipv4.vif_table);
+}
+
+static struct pernet_operations ipmr_net_ops = {
+        .init = ipmr_net_init,
+        .exit = ipmr_net_exit,
+};
 
 int __init ip_mr_init(void)
 {
@@ -1927,26 +2033,20 @@ int __init ip_mr_init(void)
         if (!mrt_cachep)
                 return -ENOMEM;
 
+        err = register_pernet_subsys(&ipmr_net_ops);
+        if (err)
+                goto reg_pernet_fail;
+
         setup_timer(&ipmr_expire_timer, ipmr_expire_process, 0);
         err = register_netdevice_notifier(&ip_mr_notifier);
         if (err)
                 goto reg_notif_fail;
-#ifdef CONFIG_PROC_FS
-        err = -ENOMEM;
-        if (!proc_net_fops_create(&init_net, "ip_mr_vif", 0, &ipmr_vif_fops))
-                goto proc_vif_fail;
-        if (!proc_net_fops_create(&init_net, "ip_mr_cache", 0, &ipmr_mfc_fops))
-                goto proc_cache_fail;
-#endif
         return 0;
-#ifdef CONFIG_PROC_FS
-proc_cache_fail:
-        proc_net_remove(&init_net, "ip_mr_vif");
-proc_vif_fail:
-        unregister_netdevice_notifier(&ip_mr_notifier);
-#endif
+
 reg_notif_fail:
         del_timer(&ipmr_expire_timer);
+        unregister_pernet_subsys(&ipmr_net_ops);
+reg_pernet_fail:
         kmem_cache_destroy(mrt_cachep);
         return err;
 }
diff --git a/net/ipv4/netfilter/nf_nat_snmp_basic.c b/net/ipv4/netfilter/nf_nat_snmp_basic.c
index 182f845de92f..d9521f6f9ed0 100644
--- a/net/ipv4/netfilter/nf_nat_snmp_basic.c
+++ b/net/ipv4/netfilter/nf_nat_snmp_basic.c
@@ -1292,7 +1292,7 @@ static struct nf_conntrack_helper snmp_helper __read_mostly = {
         .expect_policy          = &snmp_exp_policy,
         .name                   = "snmp",
         .tuple.src.l3num        = AF_INET,
-        .tuple.src.u.udp.port   = __constant_htons(SNMP_PORT),
+        .tuple.src.u.udp.port   = cpu_to_be16(SNMP_PORT),
         .tuple.dst.protonum     = IPPROTO_UDP,
 };
 
@@ -1302,7 +1302,7 @@ static struct nf_conntrack_helper snmp_trap_helper __read_mostly = {
         .expect_policy          = &snmp_exp_policy,
         .name                   = "snmp_trap",
         .tuple.src.l3num        = AF_INET,
-        .tuple.src.u.udp.port   = __constant_htons(SNMP_TRAP_PORT),
+        .tuple.src.u.udp.port   = cpu_to_be16(SNMP_TRAP_PORT),
         .tuple.dst.protonum     = IPPROTO_UDP,
 };
 
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 97f71153584f..5caee609be06 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -151,7 +151,7 @@ static void rt_emergency_hash_rebuild(struct net *net);
 
 static struct dst_ops ipv4_dst_ops = {
         .family =               AF_INET,
-        .protocol =             __constant_htons(ETH_P_IP),
+        .protocol =             cpu_to_be16(ETH_P_IP),
         .gc =                   rt_garbage_collect,
         .check =                ipv4_dst_check,
         .destroy =              ipv4_dst_destroy,
@@ -2696,7 +2696,7 @@ static void ipv4_rt_blackhole_update_pmtu(struct dst_entry *dst, u32 mtu)
 
 static struct dst_ops ipv4_dst_blackhole_ops = {
         .family                 =       AF_INET,
-        .protocol               =       __constant_htons(ETH_P_IP),
+        .protocol               =       cpu_to_be16(ETH_P_IP),
         .destroy                =       ipv4_dst_destroy,
         .check                  =       ipv4_dst_check,
         .update_pmtu            =       ipv4_rt_blackhole_update_pmtu,
@@ -2779,7 +2779,8 @@ int ip_route_output_key(struct net *net, struct rtable **rp, struct flowi *flp)
         return ip_route_output_flow(net, rp, flp, NULL, 0);
 }
 
-static int rt_fill_info(struct sk_buff *skb, u32 pid, u32 seq, int event,
+static int rt_fill_info(struct net *net,
+                        struct sk_buff *skb, u32 pid, u32 seq, int event,
                         int nowait, unsigned int flags)
 {
         struct rtable *rt = skb->rtable;
@@ -2844,8 +2845,8 @@ static int rt_fill_info(struct sk_buff *skb, u32 pid, u32 seq, int event,
                 __be32 dst = rt->rt_dst;
 
                 if (ipv4_is_multicast(dst) && !ipv4_is_local_multicast(dst) &&
-                    IPV4_DEVCONF_ALL(&init_net, MC_FORWARDING)) {
-                        int err = ipmr_get_route(skb, r, nowait);
+                    IPV4_DEVCONF_ALL(net, MC_FORWARDING)) {
+                        int err = ipmr_get_route(net, skb, r, nowait);
                         if (err <= 0) {
                                 if (!nowait) {
                                         if (err == 0)
@@ -2950,7 +2951,7 @@ static int inet_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr* nlh, void
         if (rtm->rtm_flags & RTM_F_NOTIFY)
                 rt->rt_flags |= RTCF_NOTIFY;
 
-        err = rt_fill_info(skb, NETLINK_CB(in_skb).pid, nlh->nlmsg_seq,
+        err = rt_fill_info(net, skb, NETLINK_CB(in_skb).pid, nlh->nlmsg_seq,
                            RTM_NEWROUTE, 0, 0);
         if (err <= 0)
                 goto errout_free;
@@ -2988,7 +2989,7 @@ int ip_rt_dump(struct sk_buff *skb,  struct netlink_callback *cb)
                         if (rt_is_expired(rt))
                                 continue;
                         skb->dst = dst_clone(&rt->u.dst);
-                        if (rt_fill_info(skb, NETLINK_CB(cb->skb).pid,
+                        if (rt_fill_info(net, skb, NETLINK_CB(cb->skb).pid,
                                          cb->nlh->nlmsg_seq, RTM_NEWROUTE,
                                          1, NLM_F_MULTI) <= 0) {
                                 dst_release(xchg(&skb->dst, NULL));
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 76b148bcb0dc..90b2f3c192ff 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -2478,23 +2478,23 @@ struct sk_buff **tcp_gro_receive(struct sk_buff **head, struct sk_buff *skb)
         struct tcphdr *th2;
         unsigned int thlen;
         unsigned int flags;
-        unsigned int total;
         unsigned int mss = 1;
         int flush = 1;
+        int i;
 
-        if (!pskb_may_pull(skb, sizeof(*th)))
+        th = skb_gro_header(skb, sizeof(*th));
+        if (unlikely(!th))
                 goto out;
 
-        th = tcp_hdr(skb);
         thlen = th->doff * 4;
         if (thlen < sizeof(*th))
                 goto out;
 
-        if (!pskb_may_pull(skb, thlen))
+        th = skb_gro_header(skb, thlen);
+        if (unlikely(!th))
                 goto out;
 
-        th = tcp_hdr(skb);
-        __skb_pull(skb, thlen);
+        skb_gro_pull(skb, thlen);
 
         flags = tcp_flag_word(th);
 
@@ -2504,7 +2504,7 @@ struct sk_buff **tcp_gro_receive(struct sk_buff **head, struct sk_buff *skb)
 
                 th2 = tcp_hdr(p);
 
-                if (th->source != th2->source || th->dest != th2->dest) {
+                if ((th->source ^ th2->source) | (th->dest ^ th2->dest)) {
                         NAPI_GRO_CB(p)->same_flow = 0;
                         continue;
                 }
@@ -2519,14 +2519,15 @@ found:
         flush |= flags & TCP_FLAG_CWR;
         flush |= (flags ^ tcp_flag_word(th2)) &
                   ~(TCP_FLAG_CWR | TCP_FLAG_FIN | TCP_FLAG_PSH);
-        flush |= th->ack_seq != th2->ack_seq || th->window != th2->window;
-        flush |= memcmp(th + 1, th2 + 1, thlen - sizeof(*th));
+        flush |= (th->ack_seq ^ th2->ack_seq) | (th->window ^ th2->window);
+        for (i = sizeof(*th); !flush && i < thlen; i += 4)
+                flush |= *(u32 *)((u8 *)th + i) ^
+                         *(u32 *)((u8 *)th2 + i);
 
-        total = p->len;
         mss = skb_shinfo(p)->gso_size;
 
-        flush |= skb->len > mss || skb->len <= 0;
-        flush |= ntohl(th2->seq) + total != ntohl(th->seq);
+        flush |= (skb_gro_len(skb) > mss) | !skb_gro_len(skb);
+        flush |= (ntohl(th2->seq) + skb_gro_len(p)) ^ ntohl(th->seq);
 
         if (flush || skb_gro_receive(head, skb)) {
                 mss = 1;
@@ -2538,7 +2539,7 @@ found:
         tcp_flag_word(th2) |= flags & (TCP_FLAG_FIN | TCP_FLAG_PSH);
 
 out_check_final:
-        flush = skb->len < mss;
+        flush = skb_gro_len(skb) < mss;
         flush |= flags & (TCP_FLAG_URG | TCP_FLAG_PSH | TCP_FLAG_RST |
                           TCP_FLAG_SYN | TCP_FLAG_FIN);
 
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 19d7b429a262..f6b962f56ab4 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -2355,7 +2355,7 @@ struct sk_buff **tcp4_gro_receive(struct sk_buff **head, struct sk_buff *skb)
 
         switch (skb->ip_summed) {
         case CHECKSUM_COMPLETE:
-                if (!tcp_v4_check(skb->len, iph->saddr, iph->daddr,
+                if (!tcp_v4_check(skb_gro_len(skb), iph->saddr, iph->daddr,
                                   skb->csum)) {
                         skb->ip_summed = CHECKSUM_UNNECESSARY;
                         break;
diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
index 2ad24ba31f9d..60d918c96a4f 100644
--- a/net/ipv4/xfrm4_policy.c
+++ b/net/ipv4/xfrm4_policy.c
@@ -241,7 +241,7 @@ static void xfrm4_dst_ifdown(struct dst_entry *dst, struct net_device *dev,
 
 static struct dst_ops xfrm4_dst_ops = {
         .family =               AF_INET,
-        .protocol =             __constant_htons(ETH_P_IP),
+        .protocol =             cpu_to_be16(ETH_P_IP),
         .gc =                   xfrm4_garbage_collect,
         .update_pmtu =          xfrm4_update_pmtu,
         .destroy =              xfrm4_dst_destroy,
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index f9afb452249c..03e2a1ad71e9 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -2224,10 +2224,24 @@ int addrconf_del_ifaddr(struct net *net, void __user *arg)
         return err;
 }
 
+static void add_addr(struct inet6_dev *idev, const struct in6_addr *addr,
+                     int plen, int scope)
+{
+        struct inet6_ifaddr *ifp;
+
+        ifp = ipv6_add_addr(idev, addr, plen, scope, IFA_F_PERMANENT);
+        if (!IS_ERR(ifp)) {
+                spin_lock_bh(&ifp->lock);
+                ifp->flags &= ~IFA_F_TENTATIVE;
+                spin_unlock_bh(&ifp->lock);
+                ipv6_ifa_notify(RTM_NEWADDR, ifp);
+                in6_ifa_put(ifp);
+        }
+}
+
 #if defined(CONFIG_IPV6_SIT) || defined(CONFIG_IPV6_SIT_MODULE)
 static void sit_add_v4_addrs(struct inet6_dev *idev)
 {
-        struct inet6_ifaddr * ifp;
         struct in6_addr addr;
         struct net_device *dev;
         struct net *net = dev_net(idev->dev);
@@ -2246,14 +2260,7 @@ static void sit_add_v4_addrs(struct inet6_dev *idev)
         }
 
         if (addr.s6_addr32[3]) {
-                ifp = ipv6_add_addr(idev, &addr, 128, scope, IFA_F_PERMANENT);
-                if (!IS_ERR(ifp)) {
-                        spin_lock_bh(&ifp->lock);
-                        ifp->flags &= ~IFA_F_TENTATIVE;
-                        spin_unlock_bh(&ifp->lock);
-                        ipv6_ifa_notify(RTM_NEWADDR, ifp);
-                        in6_ifa_put(ifp);
-                }
+                add_addr(idev, &addr, 128, scope);
                 return;
         }
 
@@ -2281,15 +2288,7 @@ static void sit_add_v4_addrs(struct inet6_dev *idev)
                                 else
                                         plen = 96;
 
-                                ifp = ipv6_add_addr(idev, &addr, plen, flag,
-                                                    IFA_F_PERMANENT);
-                                if (!IS_ERR(ifp)) {
-                                        spin_lock_bh(&ifp->lock);
-                                        ifp->flags &= ~IFA_F_TENTATIVE;
-                                        spin_unlock_bh(&ifp->lock);
-                                        ipv6_ifa_notify(RTM_NEWADDR, ifp);
-                                        in6_ifa_put(ifp);
-                                }
+                                add_addr(idev, &addr, plen, flag);
                         }
                 }
         }
@@ -2299,7 +2298,6 @@ static void sit_add_v4_addrs(struct inet6_dev *idev)
 static void init_loopback(struct net_device *dev)
 {
         struct inet6_dev  *idev;
-        struct inet6_ifaddr * ifp;
 
         /* ::1 */
 
@@ -2310,14 +2308,7 @@ static void init_loopback(struct net_device *dev)
                 return;
         }
 
-        ifp = ipv6_add_addr(idev, &in6addr_loopback, 128, IFA_HOST, IFA_F_PERMANENT);
-        if (!IS_ERR(ifp)) {
-                spin_lock_bh(&ifp->lock);
-                ifp->flags &= ~IFA_F_TENTATIVE;
-                spin_unlock_bh(&ifp->lock);
-                ipv6_ifa_notify(RTM_NEWADDR, ifp);
-                in6_ifa_put(ifp);
-        }
+        add_addr(idev, &in6addr_loopback, 128, IFA_HOST);
 }
 
 static void addrconf_add_linklocal(struct inet6_dev *idev, struct in6_addr *addr)
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index c802bc1658a8..fa2ac7ee662f 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -799,24 +799,34 @@ static struct sk_buff **ipv6_gro_receive(struct sk_buff **head,
         int proto;
         __wsum csum;
 
-        if (unlikely(!pskb_may_pull(skb, sizeof(*iph))))
+        iph = skb_gro_header(skb, sizeof(*iph));
+        if (unlikely(!iph))
                 goto out;
 
-        iph = ipv6_hdr(skb);
-        __skb_pull(skb, sizeof(*iph));
+        skb_gro_pull(skb, sizeof(*iph));
+        skb_set_transport_header(skb, skb_gro_offset(skb));
 
-        flush += ntohs(iph->payload_len) != skb->len;
+        flush += ntohs(iph->payload_len) != skb_gro_len(skb);
 
         rcu_read_lock();
-        proto = ipv6_gso_pull_exthdrs(skb, iph->nexthdr);
-        iph = ipv6_hdr(skb);
-        IPV6_GRO_CB(skb)->proto = proto;
+        proto = iph->nexthdr;
         ops = rcu_dereference(inet6_protos[proto]);
-        if (!ops || !ops->gro_receive)
-                goto out_unlock;
+        if (!ops || !ops->gro_receive) {
+                __pskb_pull(skb, skb_gro_offset(skb));
+                proto = ipv6_gso_pull_exthdrs(skb, proto);
+                skb_gro_pull(skb, -skb_transport_offset(skb));
+                skb_reset_transport_header(skb);
+                __skb_push(skb, skb_gro_offset(skb));
+
+                if (!ops || !ops->gro_receive)
+                        goto out_unlock;
+
+                iph = ipv6_hdr(skb);
+        }
+
+        IPV6_GRO_CB(skb)->proto = proto;
 
         flush--;
-        skb_reset_transport_header(skb);
         nlen = skb_network_header_len(skb);
 
         for (p = *head; p; p = p->next) {
@@ -880,7 +890,7 @@ out_unlock:
 }
 
 static struct packet_type ipv6_packet_type = {
-        .type = __constant_htons(ETH_P_IPV6),
+        .type = cpu_to_be16(ETH_P_IPV6),
         .func = ipv6_rcv,
         .gso_send_check = ipv6_gso_send_check,
         .gso_segment = ipv6_gso_segment,
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 3e2970841bd8..3cd83b85e9ef 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -1538,13 +1538,10 @@ void ndisc_send_redirect(struct sk_buff *skb, struct neighbour *neigh,
         if (rt->rt6i_flags & RTF_GATEWAY) {
                 ND_PRINTK2(KERN_WARNING
                            "ICMPv6 Redirect: destination is not a neighbour.\n");
-                dst_release(dst);
-                return;
-        }
-        if (!xrlim_allow(dst, 1*HZ)) {
-                dst_release(dst);
-                return;
+                goto release;
         }
+        if (!xrlim_allow(dst, 1*HZ))
+                goto release;
 
         if (dev->addr_len) {
                 read_lock_bh(&neigh->lock);
@@ -1570,8 +1567,7 @@ void ndisc_send_redirect(struct sk_buff *skb, struct neighbour *neigh,
                 ND_PRINTK0(KERN_ERR
                            "ICMPv6 Redirect: %s() failed to allocate an skb.\n",
                            __func__);
-                dst_release(dst);
-                return;
+                goto release;
         }
 
         skb_reserve(buff, LL_RESERVED_SPACE(dev));
@@ -1631,6 +1627,10 @@ void ndisc_send_redirect(struct sk_buff *skb, struct neighbour *neigh,
 
         if (likely(idev != NULL))
                 in6_dev_put(idev);
+        return;
+
+release:
+        dst_release(dst);
 }
 
 static void pndisc_redo(struct sk_buff *skb)
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 9c574235c905..c3d486a3edad 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -98,7 +98,7 @@ static struct rt6_info *rt6_get_route_info(struct net *net,
 
 static struct dst_ops ip6_dst_ops_template = {
         .family                 =       AF_INET6,
-        .protocol               =       __constant_htons(ETH_P_IPV6),
+        .protocol               =       cpu_to_be16(ETH_P_IPV6),
         .gc                     =       ip6_dst_gc,
         .gc_thresh              =       1024,
         .check                  =       ip6_dst_check,
@@ -117,7 +117,7 @@ static void ip6_rt_blackhole_update_pmtu(struct dst_entry *dst, u32 mtu)
 
 static struct dst_ops ip6_dst_blackhole_ops = {
         .family                 =       AF_INET6,
-        .protocol               =       __constant_htons(ETH_P_IPV6),
+        .protocol               =       cpu_to_be16(ETH_P_IPV6),
         .destroy                =       ip6_dst_destroy,
         .check                  =       ip6_dst_check,
         .update_pmtu            =       ip6_rt_blackhole_update_pmtu,
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index e5b85d45bee8..00f1269e11e9 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -948,7 +948,7 @@ struct sk_buff **tcp6_gro_receive(struct sk_buff **head, struct sk_buff *skb)
 
         switch (skb->ip_summed) {
         case CHECKSUM_COMPLETE:
-                if (!tcp_v6_check(skb->len, &iph->saddr, &iph->daddr,
+                if (!tcp_v6_check(skb_gro_len(skb), &iph->saddr, &iph->daddr,
                                   skb->csum)) {
                         skb->ip_summed = CHECKSUM_UNNECESSARY;
                         break;
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 97ab068e8ccc..b4b16a43f277 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -272,7 +272,7 @@ static void xfrm6_dst_ifdown(struct dst_entry *dst, struct net_device *dev,
 
 static struct dst_ops xfrm6_dst_ops = {
         .family =               AF_INET6,
-        .protocol =             __constant_htons(ETH_P_IPV6),
+        .protocol =             cpu_to_be16(ETH_P_IPV6),
         .gc =                   xfrm6_garbage_collect,
         .update_pmtu =          xfrm6_update_pmtu,
         .destroy =              xfrm6_dst_destroy,
diff --git a/net/ipx/af_ipx.c b/net/ipx/af_ipx.c
index b6e70f92e7fb..43d0ffc6d565 100644
--- a/net/ipx/af_ipx.c
+++ b/net/ipx/af_ipx.c
@@ -1959,12 +1959,12 @@ static const struct proto_ops SOCKOPS_WRAPPED(ipx_dgram_ops) = {
 SOCKOPS_WRAP(ipx_dgram, PF_IPX);
 
 static struct packet_type ipx_8023_packet_type = {
-        .type           = __constant_htons(ETH_P_802_3),
+        .type           = cpu_to_be16(ETH_P_802_3),
         .func           = ipx_rcv,
 };
 
 static struct packet_type ipx_dix_packet_type = {
-        .type           = __constant_htons(ETH_P_IPX),
+        .type           = cpu_to_be16(ETH_P_IPX),
         .func           = ipx_rcv,
 };
 
diff --git a/net/irda/irmod.c b/net/irda/irmod.c
index 4c487a883725..1bb607f2f5c7 100644
--- a/net/irda/irmod.c
+++ b/net/irda/irmod.c
@@ -56,7 +56,7 @@ EXPORT_SYMBOL(irda_debug);
  * Tell the kernel how IrDA packets should be handled.
  */
 static struct packet_type irda_packet_type = {
-        .type   = __constant_htons(ETH_P_IRDA),
+        .type   = cpu_to_be16(ETH_P_IRDA),
         .func   = irlap_driver_rcv,     /* Packet type handler irlap_frame.c */
 };
 
diff --git a/net/llc/llc_core.c b/net/llc/llc_core.c
index 50d5b10e23a2..a7fe1adc378d 100644
--- a/net/llc/llc_core.c
+++ b/net/llc/llc_core.c
@@ -148,12 +148,12 @@ void llc_sap_close(struct llc_sap *sap)
 }
 
 static struct packet_type llc_packet_type = {
-        .type = __constant_htons(ETH_P_802_2),
+        .type = cpu_to_be16(ETH_P_802_2),
         .func = llc_rcv,
 };
 
 static struct packet_type llc_tr_packet_type = {
-        .type = __constant_htons(ETH_P_TR_802_2),
+        .type = cpu_to_be16(ETH_P_TR_802_2),
         .func = llc_rcv,
 };
 
diff --git a/net/mac80211/Makefile b/net/mac80211/Makefile
index 7d4971aa443f..3503a3d21318 100644
--- a/net/mac80211/Makefile
+++ b/net/mac80211/Makefile
@@ -8,13 +8,14 @@ mac80211-y := \
         wep.o \
         wpa.o \
         scan.o \
-        ht.o \
+        ht.o agg-tx.o agg-rx.o \
         mlme.o \
         iface.o \
         rate.o \
         michael.o \
         tkip.o \
         aes_ccm.o \
+        aes_cmac.o \
         cfg.o \
         rx.o \
         spectmgmt.o \
@@ -37,6 +38,8 @@ mac80211-$(CONFIG_MAC80211_MESH) += \
         mesh_plink.o \
         mesh_hwmp.o
 
+mac80211-$(CONFIG_PM) += pm.o
+
 # objects for PID algorithm
 rc80211_pid-y := rc80211_pid_algo.o
 rc80211_pid-$(CONFIG_MAC80211_DEBUGFS) += rc80211_pid_debugfs.o
diff --git a/net/mac80211/aes_cmac.c b/net/mac80211/aes_cmac.c
new file mode 100644
index 000000000000..3d097b3d7b62
--- /dev/null
+++ b/net/mac80211/aes_cmac.c
@@ -0,0 +1,135 @@
+/*
+ * AES-128-CMAC with TLen 16 for IEEE 802.11w BIP
+ * Copyright 2008, Jouni Malinen <j@w1.fi>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/kernel.h>
+#include <linux/types.h>
+#include <linux/crypto.h>
+#include <linux/err.h>
+
+#include <net/mac80211.h>
+#include "key.h"
+#include "aes_cmac.h"
+
+#define AES_BLOCK_SIZE 16
+#define AES_CMAC_KEY_LEN 16
+#define CMAC_TLEN 8 /* CMAC TLen = 64 bits (8 octets) */
+#define AAD_LEN 20
+
+
+static void gf_mulx(u8 *pad)
+{
+        int i, carry;
+
+        carry = pad[0] & 0x80;
+        for (i = 0; i < AES_BLOCK_SIZE - 1; i++)
+                pad[i] = (pad[i] << 1) | (pad[i + 1] >> 7);
+        pad[AES_BLOCK_SIZE - 1] <<= 1;
+        if (carry)
+                pad[AES_BLOCK_SIZE - 1] ^= 0x87;
+}
+
+
+static void aes_128_cmac_vector(struct crypto_cipher *tfm, u8 *scratch,
+                                size_t num_elem,
+                                const u8 *addr[], const size_t *len, u8 *mac)
+{
+        u8 *cbc, *pad;
+        const u8 *pos, *end;
+        size_t i, e, left, total_len;
+
+        cbc = scratch;
+        pad = scratch + AES_BLOCK_SIZE;
+
+        memset(cbc, 0, AES_BLOCK_SIZE);
+
+        total_len = 0;
+        for (e = 0; e < num_elem; e++)
+                total_len += len[e];
+        left = total_len;
+
+        e = 0;
+        pos = addr[0];
+        end = pos + len[0];
+
+        while (left >= AES_BLOCK_SIZE) {
+                for (i = 0; i < AES_BLOCK_SIZE; i++) {
+                        cbc[i] ^= *pos++;
+                        if (pos >= end) {
+                                e++;
+                                pos = addr[e];
+                                end = pos + len[e];
+                        }
+                }
+                if (left > AES_BLOCK_SIZE)
+                        crypto_cipher_encrypt_one(tfm, cbc, cbc);
+                left -= AES_BLOCK_SIZE;
+        }
+
+        memset(pad, 0, AES_BLOCK_SIZE);
+        crypto_cipher_encrypt_one(tfm, pad, pad);
+        gf_mulx(pad);
+
+        if (left || total_len == 0) {
+                for (i = 0; i < left; i++) {
+                        cbc[i] ^= *pos++;
+                        if (pos >= end) {
+                                e++;
+                                pos = addr[e];
+                                end = pos + len[e];
+                        }
+                }
+                cbc[left] ^= 0x80;
+                gf_mulx(pad);
+        }
+
+        for (i = 0; i < AES_BLOCK_SIZE; i++)
+                pad[i] ^= cbc[i];
+        crypto_cipher_encrypt_one(tfm, pad, pad);
+        memcpy(mac, pad, CMAC_TLEN);
+}
+
+
+void ieee80211_aes_cmac(struct crypto_cipher *tfm, u8 *scratch, const u8 *aad,
+                        const u8 *data, size_t data_len, u8 *mic)
+{
+        const u8 *addr[3];
+        size_t len[3];
+        u8 zero[CMAC_TLEN];
+
+        memset(zero, 0, CMAC_TLEN);
+        addr[0] = aad;
+        len[0] = AAD_LEN;
+        addr[1] = data;
+        len[1] = data_len - CMAC_TLEN;
+        addr[2] = zero;
+        len[2] = CMAC_TLEN;
+
+        aes_128_cmac_vector(tfm, scratch, 3, addr, len, mic);
+}
+
+
+struct crypto_cipher * ieee80211_aes_cmac_key_setup(const u8 key[])
+{
+        struct crypto_cipher *tfm;
+
+        tfm = crypto_alloc_cipher("aes", 0, CRYPTO_ALG_ASYNC);
+        if (IS_ERR(tfm))
+                return NULL;
+
+        crypto_cipher_setkey(tfm, key, AES_CMAC_KEY_LEN);
+
+        return tfm;
+}
+
+
+void ieee80211_aes_cmac_key_free(struct crypto_cipher *tfm)
+{
+        if (tfm)
+                crypto_free_cipher(tfm);
+}
diff --git a/net/mac80211/aes_cmac.h b/net/mac80211/aes_cmac.h
new file mode 100644
index 000000000000..0eb9a4831508
--- /dev/null
+++ b/net/mac80211/aes_cmac.h
@@ -0,0 +1,19 @@
+/*
+ * Copyright 2008, Jouni Malinen <j@w1.fi>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#ifndef AES_CMAC_H
+#define AES_CMAC_H
+
+#include <linux/crypto.h>
+
+struct crypto_cipher * ieee80211_aes_cmac_key_setup(const u8 key[]);
+void ieee80211_aes_cmac(struct crypto_cipher *tfm, u8 *scratch, const u8 *aad,
+                        const u8 *data, size_t data_len, u8 *mic);
+void ieee80211_aes_cmac_key_free(struct crypto_cipher *tfm);
+
+#endif /* AES_CMAC_H */
diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c
new file mode 100644
index 000000000000..3112bfd441b6
--- /dev/null
+++ b/net/mac80211/agg-rx.c
@@ -0,0 +1,302 @@
+/*
+ * HT handling
+ *
+ * Copyright 2003, Jouni Malinen <jkmaline@cc.hut.fi>
+ * Copyright 2002-2005, Instant802 Networks, Inc.
+ * Copyright 2005-2006, Devicescape Software, Inc.
+ * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
+ * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
+ * Copyright 2007-2008, Intel Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/ieee80211.h>
+#include <net/mac80211.h>
+#include "ieee80211_i.h"
+
+void __ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid,
+                                    u16 initiator, u16 reason)
+{
+        struct ieee80211_local *local = sta->local;
+        struct ieee80211_hw *hw = &local->hw;
+        int i;
+
+        /* check if TID is in operational state */
+        spin_lock_bh(&sta->lock);
+        if (sta->ampdu_mlme.tid_state_rx[tid] != HT_AGG_STATE_OPERATIONAL) {
+                spin_unlock_bh(&sta->lock);
+                return;
+        }
+
+        sta->ampdu_mlme.tid_state_rx[tid] =
+                HT_AGG_STATE_REQ_STOP_BA_MSK |
+                (initiator << HT_AGG_STATE_INITIATOR_SHIFT);
+        spin_unlock_bh(&sta->lock);
+
+#ifdef CONFIG_MAC80211_HT_DEBUG
+        printk(KERN_DEBUG "Rx BA session stop requested for %pM tid %u\n",
+               sta->sta.addr, tid);
+#endif /* CONFIG_MAC80211_HT_DEBUG */
+
+        if (local->ops->ampdu_action(hw, IEEE80211_AMPDU_RX_STOP,
+                                     &sta->sta, tid, NULL))
+                printk(KERN_DEBUG "HW problem - can not stop rx "
+                                "aggregation for tid %d\n", tid);
+
+        /* shutdown timer has not expired */
+        if (initiator != WLAN_BACK_TIMER)
+                del_timer_sync(&sta->ampdu_mlme.tid_rx[tid]->session_timer);
+
+        /* check if this is a self generated aggregation halt */
+        if (initiator == WLAN_BACK_RECIPIENT || initiator == WLAN_BACK_TIMER)
+                ieee80211_send_delba(sta->sdata, sta->sta.addr,
+                                     tid, 0, reason);
+
+        /* free the reordering buffer */
+        for (i = 0; i < sta->ampdu_mlme.tid_rx[tid]->buf_size; i++) {
+                if (sta->ampdu_mlme.tid_rx[tid]->reorder_buf[i]) {
+                        /* release the reordered frames */
+                        dev_kfree_skb(sta->ampdu_mlme.tid_rx[tid]->reorder_buf[i]);
+                        sta->ampdu_mlme.tid_rx[tid]->stored_mpdu_num--;
+                        sta->ampdu_mlme.tid_rx[tid]->reorder_buf[i] = NULL;
+                }
+        }
+
+        spin_lock_bh(&sta->lock);
+        /* free resources */
+        kfree(sta->ampdu_mlme.tid_rx[tid]->reorder_buf);
+
+        if (!sta->ampdu_mlme.tid_rx[tid]->shutdown) {
+                kfree(sta->ampdu_mlme.tid_rx[tid]);
+                sta->ampdu_mlme.tid_rx[tid] = NULL;
+        }
+
+        sta->ampdu_mlme.tid_state_rx[tid] = HT_AGG_STATE_IDLE;
+        spin_unlock_bh(&sta->lock);
+}
+
+void ieee80211_sta_stop_rx_ba_session(struct ieee80211_sub_if_data *sdata, u8 *ra, u16 tid,
+                                        u16 initiator, u16 reason)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct sta_info *sta;
+
+        /* stop HW Rx aggregation. ampdu_action existence
+         * already verified in session init so we add the BUG_ON */
+        BUG_ON(!local->ops->ampdu_action);
+
+        rcu_read_lock();
+
+        sta = sta_info_get(local, ra);
+        if (!sta) {
+                rcu_read_unlock();
+                return;
+        }
+
+        __ieee80211_stop_rx_ba_session(sta, tid, initiator, reason);
+
+        rcu_read_unlock();
+}
+
+/*
+ * After accepting the AddBA Request we activated a timer,
+ * resetting it after each frame that arrives from the originator.
+ * if this timer expires ieee80211_sta_stop_rx_ba_session will be executed.
+ */
+static void sta_rx_agg_session_timer_expired(unsigned long data)
+{
+        /* not an elegant detour, but there is no choice as the timer passes
+         * only one argument, and various sta_info are needed here, so init
+         * flow in sta_info_create gives the TID as data, while the timer_to_id
+         * array gives the sta through container_of */
+        u8 *ptid = (u8 *)data;
+        u8 *timer_to_id = ptid - *ptid;
+        struct sta_info *sta = container_of(timer_to_id, struct sta_info,
+                                         timer_to_tid[0]);
+
+#ifdef CONFIG_MAC80211_HT_DEBUG
+        printk(KERN_DEBUG "rx session timer expired on tid %d\n", (u16)*ptid);
+#endif
+        ieee80211_sta_stop_rx_ba_session(sta->sdata, sta->sta.addr,
+                                         (u16)*ptid, WLAN_BACK_TIMER,
+                                         WLAN_REASON_QSTA_TIMEOUT);
+}
+
+static void ieee80211_send_addba_resp(struct ieee80211_sub_if_data *sdata, u8 *da, u16 tid,
+                                      u8 dialog_token, u16 status, u16 policy,
+                                      u16 buf_size, u16 timeout)
+{
+        struct ieee80211_if_sta *ifsta = &sdata->u.sta;
+        struct ieee80211_local *local = sdata->local;
+        struct sk_buff *skb;
+        struct ieee80211_mgmt *mgmt;
+        u16 capab;
+
+        skb = dev_alloc_skb(sizeof(*mgmt) + local->hw.extra_tx_headroom);
+
+        if (!skb) {
+                printk(KERN_DEBUG "%s: failed to allocate buffer "
+                       "for addba resp frame\n", sdata->dev->name);
+                return;
+        }
+
+        skb_reserve(skb, local->hw.extra_tx_headroom);
+        mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
+        memset(mgmt, 0, 24);
+        memcpy(mgmt->da, da, ETH_ALEN);
+        memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
+        if (sdata->vif.type == NL80211_IFTYPE_AP ||
+            sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
+                memcpy(mgmt->bssid, sdata->dev->dev_addr, ETH_ALEN);
+        else
+                memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
+        mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
+                                          IEEE80211_STYPE_ACTION);
+
+        skb_put(skb, 1 + sizeof(mgmt->u.action.u.addba_resp));
+        mgmt->u.action.category = WLAN_CATEGORY_BACK;
+        mgmt->u.action.u.addba_resp.action_code = WLAN_ACTION_ADDBA_RESP;
+        mgmt->u.action.u.addba_resp.dialog_token = dialog_token;
+
+        capab = (u16)(policy << 1);     /* bit 1 aggregation policy */
+        capab |= (u16)(tid << 2);       /* bit 5:2 TID number */
+        capab |= (u16)(buf_size << 6);  /* bit 15:6 max size of aggregation */
+
+        mgmt->u.action.u.addba_resp.capab = cpu_to_le16(capab);
+        mgmt->u.action.u.addba_resp.timeout = cpu_to_le16(timeout);
+        mgmt->u.action.u.addba_resp.status = cpu_to_le16(status);
+
+        ieee80211_tx_skb(sdata, skb, 1);
+}
+
+void ieee80211_process_addba_request(struct ieee80211_local *local,
+                                     struct sta_info *sta,
+                                     struct ieee80211_mgmt *mgmt,
+                                     size_t len)
+{
+        struct ieee80211_hw *hw = &local->hw;
+        struct ieee80211_conf *conf = &hw->conf;
+        struct tid_ampdu_rx *tid_agg_rx;
+        u16 capab, tid, timeout, ba_policy, buf_size, start_seq_num, status;
+        u8 dialog_token;
+        int ret = -EOPNOTSUPP;
+
+        /* extract session parameters from addba request frame */
+        dialog_token = mgmt->u.action.u.addba_req.dialog_token;
+        timeout = le16_to_cpu(mgmt->u.action.u.addba_req.timeout);
+        start_seq_num =
+                le16_to_cpu(mgmt->u.action.u.addba_req.start_seq_num) >> 4;
+
+        capab = le16_to_cpu(mgmt->u.action.u.addba_req.capab);
+        ba_policy = (capab & IEEE80211_ADDBA_PARAM_POLICY_MASK) >> 1;
+        tid = (capab & IEEE80211_ADDBA_PARAM_TID_MASK) >> 2;
+        buf_size = (capab & IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK) >> 6;
+
+        status = WLAN_STATUS_REQUEST_DECLINED;
+
+        /* sanity check for incoming parameters:
+         * check if configuration can support the BA policy
+         * and if buffer size does not exceeds max value */
+        /* XXX: check own ht delayed BA capability?? */
+        if (((ba_policy != 1)
+                && (!(sta->sta.ht_cap.cap & IEEE80211_HT_CAP_DELAY_BA)))
+                || (buf_size > IEEE80211_MAX_AMPDU_BUF)) {
+                status = WLAN_STATUS_INVALID_QOS_PARAM;
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                if (net_ratelimit())
+                        printk(KERN_DEBUG "AddBA Req with bad params from "
+                                "%pM on tid %u. policy %d, buffer size %d\n",
+                                mgmt->sa, tid, ba_policy,
+                                buf_size);
+#endif /* CONFIG_MAC80211_HT_DEBUG */
+                goto end_no_lock;
+        }
+        /* determine default buffer size */
+        if (buf_size == 0) {
+                struct ieee80211_supported_band *sband;
+
+                sband = local->hw.wiphy->bands[conf->channel->band];
+                buf_size = IEEE80211_MIN_AMPDU_BUF;
+                buf_size = buf_size << sband->ht_cap.ampdu_factor;
+        }
+
+
+        /* examine state machine */
+        spin_lock_bh(&sta->lock);
+
+        if (sta->ampdu_mlme.tid_state_rx[tid] != HT_AGG_STATE_IDLE) {
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                if (net_ratelimit())
+                        printk(KERN_DEBUG "unexpected AddBA Req from "
+                                "%pM on tid %u\n",
+                                mgmt->sa, tid);
+#endif /* CONFIG_MAC80211_HT_DEBUG */
+                goto end;
+        }
+
+        /* prepare A-MPDU MLME for Rx aggregation */
+        sta->ampdu_mlme.tid_rx[tid] =
+                        kmalloc(sizeof(struct tid_ampdu_rx), GFP_ATOMIC);
+        if (!sta->ampdu_mlme.tid_rx[tid]) {
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                if (net_ratelimit())
+                        printk(KERN_ERR "allocate rx mlme to tid %d failed\n",
+                                        tid);
+#endif
+                goto end;
+        }
+        /* rx timer */
+        sta->ampdu_mlme.tid_rx[tid]->session_timer.function =
+                                sta_rx_agg_session_timer_expired;
+        sta->ampdu_mlme.tid_rx[tid]->session_timer.data =
+                                (unsigned long)&sta->timer_to_tid[tid];
+        init_timer(&sta->ampdu_mlme.tid_rx[tid]->session_timer);
+
+        tid_agg_rx = sta->ampdu_mlme.tid_rx[tid];
+
+        /* prepare reordering buffer */
+        tid_agg_rx->reorder_buf =
+                kcalloc(buf_size, sizeof(struct sk_buff *), GFP_ATOMIC);
+        if (!tid_agg_rx->reorder_buf) {
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                if (net_ratelimit())
+                        printk(KERN_ERR "can not allocate reordering buffer "
+                               "to tid %d\n", tid);
+#endif
+                kfree(sta->ampdu_mlme.tid_rx[tid]);
+                goto end;
+        }
+
+        if (local->ops->ampdu_action)
+                ret = local->ops->ampdu_action(hw, IEEE80211_AMPDU_RX_START,
+                                               &sta->sta, tid, &start_seq_num);
+#ifdef CONFIG_MAC80211_HT_DEBUG
+        printk(KERN_DEBUG "Rx A-MPDU request on tid %d result %d\n", tid, ret);
+#endif /* CONFIG_MAC80211_HT_DEBUG */
+
+        if (ret) {
+                kfree(tid_agg_rx->reorder_buf);
+                kfree(tid_agg_rx);
+                sta->ampdu_mlme.tid_rx[tid] = NULL;
+                goto end;
+        }
+
+        /* change state and send addba resp */
+        sta->ampdu_mlme.tid_state_rx[tid] = HT_AGG_STATE_OPERATIONAL;
+        tid_agg_rx->dialog_token = dialog_token;
+        tid_agg_rx->ssn = start_seq_num;
+        tid_agg_rx->head_seq_num = start_seq_num;
+        tid_agg_rx->buf_size = buf_size;
+        tid_agg_rx->timeout = timeout;
+        tid_agg_rx->stored_mpdu_num = 0;
+        status = WLAN_STATUS_SUCCESS;
+end:
+        spin_unlock_bh(&sta->lock);
+
+end_no_lock:
+        ieee80211_send_addba_resp(sta->sdata, sta->sta.addr, tid,
+                                  dialog_token, status, 1, buf_size, timeout);
+}
diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
new file mode 100644
index 000000000000..1232d9f01ca9
--- /dev/null
+++ b/net/mac80211/agg-tx.c
@@ -0,0 +1,636 @@
+/*
+ * HT handling
+ *
+ * Copyright 2003, Jouni Malinen <jkmaline@cc.hut.fi>
+ * Copyright 2002-2005, Instant802 Networks, Inc.
+ * Copyright 2005-2006, Devicescape Software, Inc.
+ * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
+ * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
+ * Copyright 2007-2009, Intel Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/ieee80211.h>
+#include <net/mac80211.h>
+#include "ieee80211_i.h"
+#include "wme.h"
+
+/**
+ * DOC: TX aggregation
+ *
+ * Aggregation on the TX side requires setting the hardware flag
+ * %IEEE80211_HW_AMPDU_AGGREGATION as well as, if present, the @ampdu_queues
+ * hardware parameter to the number of hardware AMPDU queues. If there are no
+ * hardware queues then the driver will (currently) have to do all frame
+ * buffering.
+ *
+ * When TX aggregation is started by some subsystem (usually the rate control
+ * algorithm would be appropriate) by calling the
+ * ieee80211_start_tx_ba_session() function, the driver will be notified via
+ * its @ampdu_action function, with the %IEEE80211_AMPDU_TX_START action.
+ *
+ * In response to that, the driver is later required to call the
+ * ieee80211_start_tx_ba_cb() (or ieee80211_start_tx_ba_cb_irqsafe())
+ * function, which will start the aggregation session.
+ *
+ * Similarly, when the aggregation session is stopped by
+ * ieee80211_stop_tx_ba_session(), the driver's @ampdu_action function will
+ * be called with the action %IEEE80211_AMPDU_TX_STOP. In this case, the
+ * call must not fail, and the driver must later call ieee80211_stop_tx_ba_cb()
+ * (or ieee80211_stop_tx_ba_cb_irqsafe()).
+ */
+
+static void ieee80211_send_addba_request(struct ieee80211_sub_if_data *sdata,
+                                         const u8 *da, u16 tid,
+                                         u8 dialog_token, u16 start_seq_num,
+                                         u16 agg_size, u16 timeout)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_if_sta *ifsta = &sdata->u.sta;
+        struct sk_buff *skb;
+        struct ieee80211_mgmt *mgmt;
+        u16 capab;
+
+        skb = dev_alloc_skb(sizeof(*mgmt) + local->hw.extra_tx_headroom);
+
+        if (!skb) {
+                printk(KERN_ERR "%s: failed to allocate buffer "
+                                "for addba request frame\n", sdata->dev->name);
+                return;
+        }
+        skb_reserve(skb, local->hw.extra_tx_headroom);
+        mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
+        memset(mgmt, 0, 24);
+        memcpy(mgmt->da, da, ETH_ALEN);
+        memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
+        if (sdata->vif.type == NL80211_IFTYPE_AP ||
+            sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
+                memcpy(mgmt->bssid, sdata->dev->dev_addr, ETH_ALEN);
+        else
+                memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
+
+        mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
+                                          IEEE80211_STYPE_ACTION);
+
+        skb_put(skb, 1 + sizeof(mgmt->u.action.u.addba_req));
+
+        mgmt->u.action.category = WLAN_CATEGORY_BACK;
+        mgmt->u.action.u.addba_req.action_code = WLAN_ACTION_ADDBA_REQ;
+
+        mgmt->u.action.u.addba_req.dialog_token = dialog_token;
+        capab = (u16)(1 << 1);          /* bit 1 aggregation policy */
+        capab |= (u16)(tid << 2);       /* bit 5:2 TID number */
+        capab |= (u16)(agg_size << 6);  /* bit 15:6 max size of aggergation */
+
+        mgmt->u.action.u.addba_req.capab = cpu_to_le16(capab);
+
+        mgmt->u.action.u.addba_req.timeout = cpu_to_le16(timeout);
+        mgmt->u.action.u.addba_req.start_seq_num =
+                                        cpu_to_le16(start_seq_num << 4);
+
+        ieee80211_tx_skb(sdata, skb, 1);
+}
+
+void ieee80211_send_bar(struct ieee80211_sub_if_data *sdata, u8 *ra, u16 tid, u16 ssn)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct sk_buff *skb;
+        struct ieee80211_bar *bar;
+        u16 bar_control = 0;
+
+        skb = dev_alloc_skb(sizeof(*bar) + local->hw.extra_tx_headroom);
+        if (!skb) {
+                printk(KERN_ERR "%s: failed to allocate buffer for "
+                        "bar frame\n", sdata->dev->name);
+                return;
+        }
+        skb_reserve(skb, local->hw.extra_tx_headroom);
+        bar = (struct ieee80211_bar *)skb_put(skb, sizeof(*bar));
+        memset(bar, 0, sizeof(*bar));
+        bar->frame_control = cpu_to_le16(IEEE80211_FTYPE_CTL |
+                                         IEEE80211_STYPE_BACK_REQ);
+        memcpy(bar->ra, ra, ETH_ALEN);
+        memcpy(bar->ta, sdata->dev->dev_addr, ETH_ALEN);
+        bar_control |= (u16)IEEE80211_BAR_CTRL_ACK_POLICY_NORMAL;
+        bar_control |= (u16)IEEE80211_BAR_CTRL_CBMTID_COMPRESSED_BA;
+        bar_control |= (u16)(tid << 12);
+        bar->control = cpu_to_le16(bar_control);
+        bar->start_seq_num = cpu_to_le16(ssn);
+
+        ieee80211_tx_skb(sdata, skb, 0);
+}
+
+static int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
+                                           enum ieee80211_back_parties initiator)
+{
+        struct ieee80211_local *local = sta->local;
+        int ret;
+        u8 *state;
+
+        state = &sta->ampdu_mlme.tid_state_tx[tid];
+
+        if (local->hw.ampdu_queues)
+                ieee80211_stop_queue(&local->hw, sta->tid_to_tx_q[tid]);
+
+        *state = HT_AGG_STATE_REQ_STOP_BA_MSK |
+                (initiator << HT_AGG_STATE_INITIATOR_SHIFT);
+
+        ret = local->ops->ampdu_action(&local->hw, IEEE80211_AMPDU_TX_STOP,
+                                       &sta->sta, tid, NULL);
+
+        /* HW shall not deny going back to legacy */
+        if (WARN_ON(ret)) {
+                *state = HT_AGG_STATE_OPERATIONAL;
+                if (local->hw.ampdu_queues)
+                        ieee80211_wake_queue(&local->hw, sta->tid_to_tx_q[tid]);
+        }
+
+        return ret;
+}
+
+/*
+ * After sending add Block Ack request we activated a timer until
+ * add Block Ack response will arrive from the recipient.
+ * If this timer expires sta_addba_resp_timer_expired will be executed.
+ */
+static void sta_addba_resp_timer_expired(unsigned long data)
+{
+        /* not an elegant detour, but there is no choice as the timer passes
+         * only one argument, and both sta_info and TID are needed, so init
+         * flow in sta_info_create gives the TID as data, while the timer_to_id
+         * array gives the sta through container_of */
+        u16 tid = *(u8 *)data;
+        struct sta_info *sta = container_of((void *)data,
+                struct sta_info, timer_to_tid[tid]);
+        u8 *state;
+
+        state = &sta->ampdu_mlme.tid_state_tx[tid];
+
+        /* check if the TID waits for addBA response */
+        spin_lock_bh(&sta->lock);
+        if (!(*state & HT_ADDBA_REQUESTED_MSK)) {
+                spin_unlock_bh(&sta->lock);
+                *state = HT_AGG_STATE_IDLE;
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                printk(KERN_DEBUG "timer expired on tid %d but we are not "
+                                "expecting addBA response there", tid);
+#endif
+                return;
+        }
+
+#ifdef CONFIG_MAC80211_HT_DEBUG
+        printk(KERN_DEBUG "addBA response timer expired on tid %d\n", tid);
+#endif
+
+        ___ieee80211_stop_tx_ba_session(sta, tid, WLAN_BACK_INITIATOR);
+        spin_unlock_bh(&sta->lock);
+}
+
+int ieee80211_start_tx_ba_session(struct ieee80211_hw *hw, u8 *ra, u16 tid)
+{
+        struct ieee80211_local *local = hw_to_local(hw);
+        struct sta_info *sta;
+        struct ieee80211_sub_if_data *sdata;
+        u16 start_seq_num;
+        u8 *state;
+        int ret = 0;
+
+        if (WARN_ON(!local->ops->ampdu_action))
+                return -EINVAL;
+
+        if ((tid >= STA_TID_NUM) || !(hw->flags & IEEE80211_HW_AMPDU_AGGREGATION))
+                return -EINVAL;
+
+#ifdef CONFIG_MAC80211_HT_DEBUG
+        printk(KERN_DEBUG "Open BA session requested for %pM tid %u\n",
+               ra, tid);
+#endif /* CONFIG_MAC80211_HT_DEBUG */
+
+        rcu_read_lock();
+
+        sta = sta_info_get(local, ra);
+        if (!sta) {
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                printk(KERN_DEBUG "Could not find the station\n");
+#endif
+                ret = -ENOENT;
+                goto exit;
+        }
+
+        /*
+         * The aggregation code is not prepared to handle
+         * anything but STA/AP due to the BSSID handling.
+         * IBSS could work in the code but isn't supported
+         * by drivers or the standard.
+         */
+        if (sta->sdata->vif.type != NL80211_IFTYPE_STATION &&
+            sta->sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
+            sta->sdata->vif.type != NL80211_IFTYPE_AP) {
+                ret = -EINVAL;
+                goto exit;
+        }
+
+        spin_lock_bh(&sta->lock);
+
+        /* we have tried too many times, receiver does not want A-MPDU */
+        if (sta->ampdu_mlme.addba_req_num[tid] > HT_AGG_MAX_RETRIES) {
+                ret = -EBUSY;
+                goto err_unlock_sta;
+        }
+
+        state = &sta->ampdu_mlme.tid_state_tx[tid];
+        /* check if the TID is not in aggregation flow already */
+        if (*state != HT_AGG_STATE_IDLE) {
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                printk(KERN_DEBUG "BA request denied - session is not "
+                                 "idle on tid %u\n", tid);
+#endif /* CONFIG_MAC80211_HT_DEBUG */
+                ret = -EAGAIN;
+                goto err_unlock_sta;
+        }
+
+        /* prepare A-MPDU MLME for Tx aggregation */
+        sta->ampdu_mlme.tid_tx[tid] =
+                        kmalloc(sizeof(struct tid_ampdu_tx), GFP_ATOMIC);
+        if (!sta->ampdu_mlme.tid_tx[tid]) {
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                if (net_ratelimit())
+                        printk(KERN_ERR "allocate tx mlme to tid %d failed\n",
+                                        tid);
+#endif
+                ret = -ENOMEM;
+                goto err_unlock_sta;
+        }
+        /* Tx timer */
+        sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer.function =
+                        sta_addba_resp_timer_expired;
+        sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer.data =
+                        (unsigned long)&sta->timer_to_tid[tid];
+        init_timer(&sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer);
+
+        if (hw->ampdu_queues) {
+                /* create a new queue for this aggregation */
+                ret = ieee80211_ht_agg_queue_add(local, sta, tid);
+
+                /* case no queue is available to aggregation
+                 * don't switch to aggregation */
+                if (ret) {
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                        printk(KERN_DEBUG "BA request denied - "
+                               "queue unavailable for tid %d\n", tid);
+#endif /* CONFIG_MAC80211_HT_DEBUG */
+                        goto err_unlock_queue;
+                }
+        }
+        sdata = sta->sdata;
+
+        /* Ok, the Addba frame hasn't been sent yet, but if the driver calls the
+         * call back right away, it must see that the flow has begun */
+        *state |= HT_ADDBA_REQUESTED_MSK;
+
+        /* This is slightly racy because the queue isn't stopped */
+        start_seq_num = sta->tid_seq[tid];
+
+        ret = local->ops->ampdu_action(hw, IEEE80211_AMPDU_TX_START,
+                                       &sta->sta, tid, &start_seq_num);
+
+        if (ret) {
+                /* No need to requeue the packets in the agg queue, since we
+                 * held the tx lock: no packet could be enqueued to the newly
+                 * allocated queue */
+                if (hw->ampdu_queues)
+                        ieee80211_ht_agg_queue_remove(local, sta, tid, 0);
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                printk(KERN_DEBUG "BA request denied - HW unavailable for"
+                                        " tid %d\n", tid);
+#endif /* CONFIG_MAC80211_HT_DEBUG */
+                *state = HT_AGG_STATE_IDLE;
+                goto err_unlock_queue;
+        }
+
+        /* Will put all the packets in the new SW queue */
+        if (hw->ampdu_queues)
+                ieee80211_requeue(local, ieee802_1d_to_ac[tid]);
+        spin_unlock_bh(&sta->lock);
+
+        /* send an addBA request */
+        sta->ampdu_mlme.dialog_token_allocator++;
+        sta->ampdu_mlme.tid_tx[tid]->dialog_token =
+                        sta->ampdu_mlme.dialog_token_allocator;
+        sta->ampdu_mlme.tid_tx[tid]->ssn = start_seq_num;
+
+
+        ieee80211_send_addba_request(sta->sdata, ra, tid,
+                         sta->ampdu_mlme.tid_tx[tid]->dialog_token,
+                         sta->ampdu_mlme.tid_tx[tid]->ssn,
+                         0x40, 5000);
+        /* activate the timer for the recipient's addBA response */
+        sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer.expires =
+                                jiffies + ADDBA_RESP_INTERVAL;
+        add_timer(&sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer);
+#ifdef CONFIG_MAC80211_HT_DEBUG
+        printk(KERN_DEBUG "activated addBA response timer on tid %d\n", tid);
+#endif
+        goto exit;
+
+err_unlock_queue:
+        kfree(sta->ampdu_mlme.tid_tx[tid]);
+        sta->ampdu_mlme.tid_tx[tid] = NULL;
+        ret = -EBUSY;
+err_unlock_sta:
+        spin_unlock_bh(&sta->lock);
+exit:
+        rcu_read_unlock();
+        return ret;
+}
+EXPORT_SYMBOL(ieee80211_start_tx_ba_session);
+
+void ieee80211_start_tx_ba_cb(struct ieee80211_hw *hw, u8 *ra, u16 tid)
+{
+        struct ieee80211_local *local = hw_to_local(hw);
+        struct sta_info *sta;
+        u8 *state;
+
+        if (tid >= STA_TID_NUM) {
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                printk(KERN_DEBUG "Bad TID value: tid = %d (>= %d)\n",
+                                tid, STA_TID_NUM);
+#endif
+                return;
+        }
+
+        rcu_read_lock();
+        sta = sta_info_get(local, ra);
+        if (!sta) {
+                rcu_read_unlock();
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                printk(KERN_DEBUG "Could not find station: %pM\n", ra);
+#endif
+                return;
+        }
+
+        state = &sta->ampdu_mlme.tid_state_tx[tid];
+        spin_lock_bh(&sta->lock);
+
+        if (!(*state & HT_ADDBA_REQUESTED_MSK)) {
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                printk(KERN_DEBUG "addBA was not requested yet, state is %d\n",
+                                *state);
+#endif
+                spin_unlock_bh(&sta->lock);
+                rcu_read_unlock();
+                return;
+        }
+
+        WARN_ON_ONCE(*state & HT_ADDBA_DRV_READY_MSK);
+
+        *state |= HT_ADDBA_DRV_READY_MSK;
+
+        if (*state == HT_AGG_STATE_OPERATIONAL) {
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                printk(KERN_DEBUG "Aggregation is on for tid %d \n", tid);
+#endif
+                if (hw->ampdu_queues)
+                        ieee80211_wake_queue(hw, sta->tid_to_tx_q[tid]);
+        }
+        spin_unlock_bh(&sta->lock);
+        rcu_read_unlock();
+}
+EXPORT_SYMBOL(ieee80211_start_tx_ba_cb);
+
+void ieee80211_start_tx_ba_cb_irqsafe(struct ieee80211_hw *hw,
+                                      const u8 *ra, u16 tid)
+{
+        struct ieee80211_local *local = hw_to_local(hw);
+        struct ieee80211_ra_tid *ra_tid;
+        struct sk_buff *skb = dev_alloc_skb(0);
+
+        if (unlikely(!skb)) {
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                if (net_ratelimit())
+                        printk(KERN_WARNING "%s: Not enough memory, "
+                               "dropping start BA session", skb->dev->name);
+#endif
+                return;
+        }
+        ra_tid = (struct ieee80211_ra_tid *) &skb->cb;
+        memcpy(&ra_tid->ra, ra, ETH_ALEN);
+        ra_tid->tid = tid;
+
+        skb->pkt_type = IEEE80211_ADDBA_MSG;
+        skb_queue_tail(&local->skb_queue, skb);
+        tasklet_schedule(&local->tasklet);
+}
+EXPORT_SYMBOL(ieee80211_start_tx_ba_cb_irqsafe);
+
+int __ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
+                                   enum ieee80211_back_parties initiator)
+{
+        u8 *state;
+        int ret;
+
+        /* check if the TID is in aggregation */
+        state = &sta->ampdu_mlme.tid_state_tx[tid];
+        spin_lock_bh(&sta->lock);
+
+        if (*state != HT_AGG_STATE_OPERATIONAL) {
+                ret = -ENOENT;
+                goto unlock;
+        }
+
+#ifdef CONFIG_MAC80211_HT_DEBUG
+        printk(KERN_DEBUG "Tx BA session stop requested for %pM tid %u\n",
+               sta->sta.addr, tid);
+#endif /* CONFIG_MAC80211_HT_DEBUG */
+
+        ret = ___ieee80211_stop_tx_ba_session(sta, tid, initiator);
+
+ unlock:
+        spin_unlock_bh(&sta->lock);
+        return ret;
+}
+
+int ieee80211_stop_tx_ba_session(struct ieee80211_hw *hw,
+                                 u8 *ra, u16 tid,
+                                 enum ieee80211_back_parties initiator)
+{
+        struct ieee80211_local *local = hw_to_local(hw);
+        struct sta_info *sta;
+        int ret = 0;
+
+        if (WARN_ON(!local->ops->ampdu_action))
+                return -EINVAL;
+
+        if (tid >= STA_TID_NUM)
+                return -EINVAL;
+
+        rcu_read_lock();
+        sta = sta_info_get(local, ra);
+        if (!sta) {
+                rcu_read_unlock();
+                return -ENOENT;
+        }
+
+        ret = __ieee80211_stop_tx_ba_session(sta, tid, initiator);
+        rcu_read_unlock();
+        return ret;
+}
+EXPORT_SYMBOL(ieee80211_stop_tx_ba_session);
+
+void ieee80211_stop_tx_ba_cb(struct ieee80211_hw *hw, u8 *ra, u8 tid)
+{
+        struct ieee80211_local *local = hw_to_local(hw);
+        struct sta_info *sta;
+        u8 *state;
+        int agg_queue;
+
+        if (tid >= STA_TID_NUM) {
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                printk(KERN_DEBUG "Bad TID value: tid = %d (>= %d)\n",
+                                tid, STA_TID_NUM);
+#endif
+                return;
+        }
+
+#ifdef CONFIG_MAC80211_HT_DEBUG
+        printk(KERN_DEBUG "Stopping Tx BA session for %pM tid %d\n",
+               ra, tid);
+#endif /* CONFIG_MAC80211_HT_DEBUG */
+
+        rcu_read_lock();
+        sta = sta_info_get(local, ra);
+        if (!sta) {
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                printk(KERN_DEBUG "Could not find station: %pM\n", ra);
+#endif
+                rcu_read_unlock();
+                return;
+        }
+        state = &sta->ampdu_mlme.tid_state_tx[tid];
+
+        /* NOTE: no need to use sta->lock in this state check, as
+         * ieee80211_stop_tx_ba_session will let only one stop call to
+         * pass through per sta/tid
+         */
+        if ((*state & HT_AGG_STATE_REQ_STOP_BA_MSK) == 0) {
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                printk(KERN_DEBUG "unexpected callback to A-MPDU stop\n");
+#endif
+                rcu_read_unlock();
+                return;
+        }
+
+        if (*state & HT_AGG_STATE_INITIATOR_MSK)
+                ieee80211_send_delba(sta->sdata, ra, tid,
+                        WLAN_BACK_INITIATOR, WLAN_REASON_QSTA_NOT_USE);
+
+        if (hw->ampdu_queues) {
+                agg_queue = sta->tid_to_tx_q[tid];
+                ieee80211_ht_agg_queue_remove(local, sta, tid, 1);
+
+                /* We just requeued the all the frames that were in the
+                 * removed queue, and since we might miss a softirq we do
+                 * netif_schedule_queue.  ieee80211_wake_queue is not used
+                 * here as this queue is not necessarily stopped
+                 */
+                netif_schedule_queue(netdev_get_tx_queue(local->mdev,
+                                                         agg_queue));
+        }
+        spin_lock_bh(&sta->lock);
+        *state = HT_AGG_STATE_IDLE;
+        sta->ampdu_mlme.addba_req_num[tid] = 0;
+        kfree(sta->ampdu_mlme.tid_tx[tid]);
+        sta->ampdu_mlme.tid_tx[tid] = NULL;
+        spin_unlock_bh(&sta->lock);
+
+        rcu_read_unlock();
+}
+EXPORT_SYMBOL(ieee80211_stop_tx_ba_cb);
+
+void ieee80211_stop_tx_ba_cb_irqsafe(struct ieee80211_hw *hw,
+                                     const u8 *ra, u16 tid)
+{
+        struct ieee80211_local *local = hw_to_local(hw);
+        struct ieee80211_ra_tid *ra_tid;
+        struct sk_buff *skb = dev_alloc_skb(0);
+
+        if (unlikely(!skb)) {
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                if (net_ratelimit())
+                        printk(KERN_WARNING "%s: Not enough memory, "
+                               "dropping stop BA session", skb->dev->name);
+#endif
+                return;
+        }
+        ra_tid = (struct ieee80211_ra_tid *) &skb->cb;
+        memcpy(&ra_tid->ra, ra, ETH_ALEN);
+        ra_tid->tid = tid;
+
+        skb->pkt_type = IEEE80211_DELBA_MSG;
+        skb_queue_tail(&local->skb_queue, skb);
+        tasklet_schedule(&local->tasklet);
+}
+EXPORT_SYMBOL(ieee80211_stop_tx_ba_cb_irqsafe);
+
+
+void ieee80211_process_addba_resp(struct ieee80211_local *local,
+                                  struct sta_info *sta,
+                                  struct ieee80211_mgmt *mgmt,
+                                  size_t len)
+{
+        struct ieee80211_hw *hw = &local->hw;
+        u16 capab;
+        u16 tid, start_seq_num;
+        u8 *state;
+
+        capab = le16_to_cpu(mgmt->u.action.u.addba_resp.capab);
+        tid = (capab & IEEE80211_ADDBA_PARAM_TID_MASK) >> 2;
+
+        state = &sta->ampdu_mlme.tid_state_tx[tid];
+
+        spin_lock_bh(&sta->lock);
+
+        if (!(*state & HT_ADDBA_REQUESTED_MSK)) {
+                spin_unlock_bh(&sta->lock);
+                return;
+        }
+
+        if (mgmt->u.action.u.addba_resp.dialog_token !=
+                sta->ampdu_mlme.tid_tx[tid]->dialog_token) {
+                spin_unlock_bh(&sta->lock);
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                printk(KERN_DEBUG "wrong addBA response token, tid %d\n", tid);
+#endif /* CONFIG_MAC80211_HT_DEBUG */
+                return;
+        }
+
+        del_timer_sync(&sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer);
+#ifdef CONFIG_MAC80211_HT_DEBUG
+        printk(KERN_DEBUG "switched off addBA timer for tid %d \n", tid);
+#endif /* CONFIG_MAC80211_HT_DEBUG */
+        if (le16_to_cpu(mgmt->u.action.u.addba_resp.status)
+                        == WLAN_STATUS_SUCCESS) {
+                *state |= HT_ADDBA_RECEIVED_MSK;
+                sta->ampdu_mlme.addba_req_num[tid] = 0;
+
+                if (*state == HT_AGG_STATE_OPERATIONAL &&
+                    local->hw.ampdu_queues)
+                        ieee80211_wake_queue(hw, sta->tid_to_tx_q[tid]);
+
+                if (local->ops->ampdu_action) {
+                        (void)local->ops->ampdu_action(hw,
+                                               IEEE80211_AMPDU_TX_RESUME,
+                                               &sta->sta, tid, &start_seq_num);
+                }
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                printk(KERN_DEBUG "Resuming TX aggregation for tid %d\n", tid);
+#endif /* CONFIG_MAC80211_HT_DEBUG */
+        } else {
+                sta->ampdu_mlme.addba_req_num[tid]++;
+                ___ieee80211_stop_tx_ba_session(sta, tid, WLAN_BACK_INITIATOR);
+        }
+        spin_unlock_bh(&sta->lock);
+}
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 9d4e4d846ec1..c8d969be440b 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -133,6 +133,9 @@ static int ieee80211_add_key(struct wiphy *wiphy, struct net_device *dev,
         case WLAN_CIPHER_SUITE_CCMP:
                 alg = ALG_CCMP;
                 break;
+        case WLAN_CIPHER_SUITE_AES_CMAC:
+                alg = ALG_AES_CMAC;
+                break;
         default:
                 return -EINVAL;
         }
@@ -275,6 +278,17 @@ static int ieee80211_get_key(struct wiphy *wiphy, struct net_device *dev,
                 else
                         params.cipher = WLAN_CIPHER_SUITE_WEP104;
                 break;
+        case ALG_AES_CMAC:
+                params.cipher = WLAN_CIPHER_SUITE_AES_CMAC;
+                seq[0] = key->u.aes_cmac.tx_pn[5];
+                seq[1] = key->u.aes_cmac.tx_pn[4];
+                seq[2] = key->u.aes_cmac.tx_pn[3];
+                seq[3] = key->u.aes_cmac.tx_pn[2];
+                seq[4] = key->u.aes_cmac.tx_pn[1];
+                seq[5] = key->u.aes_cmac.tx_pn[0];
+                params.seq = seq;
+                params.seq_len = 6;
+                break;
         }
 
         params.key = key->conf.key;
@@ -304,6 +318,22 @@ static int ieee80211_config_default_key(struct wiphy *wiphy,
         return 0;
 }
 
+static int ieee80211_config_default_mgmt_key(struct wiphy *wiphy,
+                                             struct net_device *dev,
+                                             u8 key_idx)
+{
+        struct ieee80211_sub_if_data *sdata;
+
+        rcu_read_lock();
+
+        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        ieee80211_set_default_mgmt_key(sdata, key_idx);
+
+        rcu_read_unlock();
+
+        return 0;
+}
+
 static void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
 {
         struct ieee80211_sub_if_data *sdata = sta->sdata;
@@ -493,7 +523,8 @@ static int ieee80211_config_beacon(struct ieee80211_sub_if_data *sdata,
 
         kfree(old);
 
-        return ieee80211_if_config(sdata, IEEE80211_IFCC_BEACON);
+        return ieee80211_if_config(sdata, IEEE80211_IFCC_BEACON |
+                                          IEEE80211_IFCC_BEACON_ENABLED);
 }
 
 static int ieee80211_add_beacon(struct wiphy *wiphy, struct net_device *dev,
@@ -553,7 +584,7 @@ static int ieee80211_del_beacon(struct wiphy *wiphy, struct net_device *dev)
         synchronize_rcu();
         kfree(old);
 
-        return ieee80211_if_config(sdata, IEEE80211_IFCC_BEACON);
+        return ieee80211_if_config(sdata, IEEE80211_IFCC_BEACON_ENABLED);
 }
 
 /* Layer 2 Update frame (802.2 Type 1 LLC XID Update response) */
@@ -630,6 +661,10 @@ static void sta_apply_parameters(struct ieee80211_local *local,
                 sta->flags &= ~WLAN_STA_WME;
                 if (params->station_flags & STATION_FLAG_WME)
                         sta->flags |= WLAN_STA_WME;
+
+                sta->flags &= ~WLAN_STA_MFP;
+                if (params->station_flags & STATION_FLAG_MFP)
+                        sta->flags |= WLAN_STA_MFP;
                 spin_unlock_bh(&sta->lock);
         }
 
@@ -1141,6 +1176,126 @@ static int ieee80211_set_channel(struct wiphy *wiphy,
         return ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);
 }
 
+static int set_mgmt_extra_ie_sta(struct ieee80211_sub_if_data *sdata,
+                                 u8 subtype, u8 *ies, size_t ies_len)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_if_sta *ifsta = &sdata->u.sta;
+
+        switch (subtype) {
+        case IEEE80211_STYPE_PROBE_REQ >> 4:
+                if (local->ops->hw_scan)
+                        break;
+                kfree(ifsta->ie_probereq);
+                ifsta->ie_probereq = ies;
+                ifsta->ie_probereq_len = ies_len;
+                return 0;
+        case IEEE80211_STYPE_PROBE_RESP >> 4:
+                kfree(ifsta->ie_proberesp);
+                ifsta->ie_proberesp = ies;
+                ifsta->ie_proberesp_len = ies_len;
+                return 0;
+        case IEEE80211_STYPE_AUTH >> 4:
+                kfree(ifsta->ie_auth);
+                ifsta->ie_auth = ies;
+                ifsta->ie_auth_len = ies_len;
+                return 0;
+        case IEEE80211_STYPE_ASSOC_REQ >> 4:
+                kfree(ifsta->ie_assocreq);
+                ifsta->ie_assocreq = ies;
+                ifsta->ie_assocreq_len = ies_len;
+                return 0;
+        case IEEE80211_STYPE_REASSOC_REQ >> 4:
+                kfree(ifsta->ie_reassocreq);
+                ifsta->ie_reassocreq = ies;
+                ifsta->ie_reassocreq_len = ies_len;
+                return 0;
+        case IEEE80211_STYPE_DEAUTH >> 4:
+                kfree(ifsta->ie_deauth);
+                ifsta->ie_deauth = ies;
+                ifsta->ie_deauth_len = ies_len;
+                return 0;
+        case IEEE80211_STYPE_DISASSOC >> 4:
+                kfree(ifsta->ie_disassoc);
+                ifsta->ie_disassoc = ies;
+                ifsta->ie_disassoc_len = ies_len;
+                return 0;
+        }
+
+        return -EOPNOTSUPP;
+}
+
+static int ieee80211_set_mgmt_extra_ie(struct wiphy *wiphy,
+                                       struct net_device *dev,
+                                       struct mgmt_extra_ie_params *params)
+{
+        struct ieee80211_sub_if_data *sdata;
+        u8 *ies;
+        size_t ies_len;
+        int ret = -EOPNOTSUPP;
+
+        if (params->ies) {
+                ies = kmemdup(params->ies, params->ies_len, GFP_KERNEL);
+                if (ies == NULL)
+                        return -ENOMEM;
+                ies_len = params->ies_len;
+        } else {
+                ies = NULL;
+                ies_len = 0;
+        }
+
+        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+
+        switch (sdata->vif.type) {
+        case NL80211_IFTYPE_STATION:
+        case NL80211_IFTYPE_ADHOC:
+                ret = set_mgmt_extra_ie_sta(sdata, params->subtype,
+                                            ies, ies_len);
+                break;
+        default:
+                ret = -EOPNOTSUPP;
+                break;
+        }
+
+        if (ret)
+                kfree(ies);
+        return ret;
+}
+
+#ifdef CONFIG_PM
+static int ieee80211_suspend(struct wiphy *wiphy)
+{
+        return __ieee80211_suspend(wiphy_priv(wiphy));
+}
+
+static int ieee80211_resume(struct wiphy *wiphy)
+{
+        return __ieee80211_resume(wiphy_priv(wiphy));
+}
+#else
+#define ieee80211_suspend NULL
+#define ieee80211_resume NULL
+#endif
+
+static int ieee80211_scan(struct wiphy *wiphy,
+                          struct net_device *dev,
+                          struct cfg80211_scan_request *req)
+{
+        struct ieee80211_sub_if_data *sdata;
+
+        if (!netif_running(dev))
+                return -ENETDOWN;
+
+        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+
+        if (sdata->vif.type != NL80211_IFTYPE_STATION &&
+            sdata->vif.type != NL80211_IFTYPE_ADHOC &&
+            sdata->vif.type != NL80211_IFTYPE_MESH_POINT)
+                return -EOPNOTSUPP;
+
+        return ieee80211_request_scan(sdata, req);
+}
+
 struct cfg80211_ops mac80211_config_ops = {
         .add_virtual_intf = ieee80211_add_iface,
         .del_virtual_intf = ieee80211_del_iface,
@@ -1149,6 +1304,7 @@ struct cfg80211_ops mac80211_config_ops = {
         .del_key = ieee80211_del_key,
         .get_key = ieee80211_get_key,
         .set_default_key = ieee80211_config_default_key,
+        .set_default_mgmt_key = ieee80211_config_default_mgmt_key,
         .add_beacon = ieee80211_add_beacon,
         .set_beacon = ieee80211_set_beacon,
         .del_beacon = ieee80211_del_beacon,
@@ -1169,4 +1325,8 @@ struct cfg80211_ops mac80211_config_ops = {
         .change_bss = ieee80211_change_bss,
         .set_txq_params = ieee80211_set_txq_params,
         .set_channel = ieee80211_set_channel,
+        .set_mgmt_extra_ie = ieee80211_set_mgmt_extra_ie,
+        .suspend = ieee80211_suspend,
+        .resume = ieee80211_resume,
+        .scan = ieee80211_scan,
 };
diff --git a/net/mac80211/debugfs.c b/net/mac80211/debugfs.c
index 2697a2fe608f..e37f557de3f3 100644
--- a/net/mac80211/debugfs.c
+++ b/net/mac80211/debugfs.c
@@ -57,11 +57,62 @@ DEBUGFS_READONLY_FILE(long_retry_limit, 20, "%d",
                       local->hw.conf.long_frame_max_tx_count);
 DEBUGFS_READONLY_FILE(total_ps_buffered, 20, "%d",
                       local->total_ps_buffered);
-DEBUGFS_READONLY_FILE(wep_iv, 20, "%#06x",
+DEBUGFS_READONLY_FILE(wep_iv, 20, "%#08x",
                       local->wep_iv & 0xffffff);
 DEBUGFS_READONLY_FILE(rate_ctrl_alg, 100, "%s",
                       local->rate_ctrl ? local->rate_ctrl->ops->name : "<unset>");
 
+static ssize_t tsf_read(struct file *file, char __user *user_buf,
+                             size_t count, loff_t *ppos)
+{
+        struct ieee80211_local *local = file->private_data;
+        u64 tsf = 0;
+        char buf[100];
+
+        if (local->ops->get_tsf)
+                tsf = local->ops->get_tsf(local_to_hw(local));
+
+        snprintf(buf, sizeof(buf), "0x%016llx\n", (unsigned long long) tsf);
+
+        return simple_read_from_buffer(user_buf, count, ppos, buf, 19);
+}
+
+static ssize_t tsf_write(struct file *file,
+                         const char __user *user_buf,
+                         size_t count, loff_t *ppos)
+{
+        struct ieee80211_local *local = file->private_data;
+        unsigned long long tsf;
+        char buf[100];
+        size_t len;
+
+        len = min(count, sizeof(buf) - 1);
+        if (copy_from_user(buf, user_buf, len))
+                return -EFAULT;
+        buf[len] = '\0';
+
+        if (strncmp(buf, "reset", 5) == 0) {
+                if (local->ops->reset_tsf) {
+                        local->ops->reset_tsf(local_to_hw(local));
+                        printk(KERN_INFO "%s: debugfs reset TSF\n", wiphy_name(local->hw.wiphy));
+                }
+        } else {
+                tsf = simple_strtoul(buf, NULL, 0);
+                if (local->ops->set_tsf) {
+                        local->ops->set_tsf(local_to_hw(local), tsf);
+                        printk(KERN_INFO "%s: debugfs set TSF to %#018llx\n", wiphy_name(local->hw.wiphy), tsf);
+                }
+        }
+
+        return count;
+}
+
+static const struct file_operations tsf_ops = {
+        .read = tsf_read,
+        .write = tsf_write,
+        .open = mac80211_open_file_generic
+};
+
 /* statistics stuff */
 
 #define DEBUGFS_STATS_FILE(name, buflen, fmt, value...)                 \
@@ -136,8 +187,6 @@ DEBUGFS_STATS_FILE(multicast_received_frame_count, 20, "%u",
                    local->dot11MulticastReceivedFrameCount);
 DEBUGFS_STATS_FILE(transmitted_frame_count, 20, "%u",
                    local->dot11TransmittedFrameCount);
-DEBUGFS_STATS_FILE(wep_undecryptable_count, 20, "%u",
-                   local->dot11WEPUndecryptableCount);
 #ifdef CONFIG_MAC80211_DEBUG_COUNTERS
 DEBUGFS_STATS_FILE(tx_handlers_drop, 20, "%u",
                    local->tx_handlers_drop);
@@ -204,6 +253,7 @@ void debugfs_hw_add(struct ieee80211_local *local)
         DEBUGFS_ADD(long_retry_limit);
         DEBUGFS_ADD(total_ps_buffered);
         DEBUGFS_ADD(wep_iv);
+        DEBUGFS_ADD(tsf);
 
         statsd = debugfs_create_dir("statistics", phyd);
         local->debugfs.statistics = statsd;
@@ -221,7 +271,6 @@ void debugfs_hw_add(struct ieee80211_local *local)
         DEBUGFS_STATS_ADD(received_fragment_count);
         DEBUGFS_STATS_ADD(multicast_received_frame_count);
         DEBUGFS_STATS_ADD(transmitted_frame_count);
-        DEBUGFS_STATS_ADD(wep_undecryptable_count);
 #ifdef CONFIG_MAC80211_DEBUG_COUNTERS
         DEBUGFS_STATS_ADD(tx_handlers_drop);
         DEBUGFS_STATS_ADD(tx_handlers_queued);
@@ -258,6 +307,7 @@ void debugfs_hw_del(struct ieee80211_local *local)
         DEBUGFS_DEL(long_retry_limit);
         DEBUGFS_DEL(total_ps_buffered);
         DEBUGFS_DEL(wep_iv);
+        DEBUGFS_DEL(tsf);
 
         DEBUGFS_STATS_DEL(transmitted_fragment_count);
         DEBUGFS_STATS_DEL(multicast_transmitted_frame_count);
@@ -268,7 +318,6 @@ void debugfs_hw_del(struct ieee80211_local *local)
         DEBUGFS_STATS_DEL(received_fragment_count);
         DEBUGFS_STATS_DEL(multicast_received_frame_count);
         DEBUGFS_STATS_DEL(transmitted_frame_count);
-        DEBUGFS_STATS_DEL(wep_undecryptable_count);
         DEBUGFS_STATS_DEL(num_scans);
 #ifdef CONFIG_MAC80211_DEBUG_COUNTERS
         DEBUGFS_STATS_DEL(tx_handlers_drop);
diff --git a/net/mac80211/debugfs_key.c b/net/mac80211/debugfs_key.c
index 6424ac565ae0..99c752588b30 100644
--- a/net/mac80211/debugfs_key.c
+++ b/net/mac80211/debugfs_key.c
@@ -76,6 +76,9 @@ static ssize_t key_algorithm_read(struct file *file,
         case ALG_CCMP:
                 alg = "CCMP\n";
                 break;
+        case ALG_AES_CMAC:
+                alg = "AES-128-CMAC\n";
+                break;
         default:
                 return 0;
         }
@@ -105,6 +108,12 @@ static ssize_t key_tx_spec_read(struct file *file, char __user *userbuf,
                 len = scnprintf(buf, sizeof(buf), "%02x%02x%02x%02x%02x%02x\n",
                                 tpn[0], tpn[1], tpn[2], tpn[3], tpn[4], tpn[5]);
                 break;
+        case ALG_AES_CMAC:
+                tpn = key->u.aes_cmac.tx_pn;
+                len = scnprintf(buf, sizeof(buf), "%02x%02x%02x%02x%02x%02x\n",
+                                tpn[0], tpn[1], tpn[2], tpn[3], tpn[4],
+                                tpn[5]);
+                break;
         default:
                 return 0;
         }
@@ -142,6 +151,14 @@ static ssize_t key_rx_spec_read(struct file *file, char __user *userbuf,
                 }
                 len = p - buf;
                 break;
+        case ALG_AES_CMAC:
+                rpn = key->u.aes_cmac.rx_pn;
+                p += scnprintf(p, sizeof(buf)+buf-p,
+                               "%02x%02x%02x%02x%02x%02x\n",
+                               rpn[0], rpn[1], rpn[2],
+                               rpn[3], rpn[4], rpn[5]);
+                len = p - buf;
+                break;
         default:
                 return 0;
         }
@@ -156,13 +173,40 @@ static ssize_t key_replays_read(struct file *file, char __user *userbuf,
         char buf[20];
         int len;
 
-        if (key->conf.alg != ALG_CCMP)
+        switch (key->conf.alg) {
+        case ALG_CCMP:
+                len = scnprintf(buf, sizeof(buf), "%u\n", key->u.ccmp.replays);
+                break;
+        case ALG_AES_CMAC:
+                len = scnprintf(buf, sizeof(buf), "%u\n",
+                                key->u.aes_cmac.replays);
+                break;
+        default:
                 return 0;
-        len = scnprintf(buf, sizeof(buf), "%u\n", key->u.ccmp.replays);
+        }
         return simple_read_from_buffer(userbuf, count, ppos, buf, len);
 }
 KEY_OPS(replays);
 
+static ssize_t key_icverrors_read(struct file *file, char __user *userbuf,
+                                  size_t count, loff_t *ppos)
+{
+        struct ieee80211_key *key = file->private_data;
+        char buf[20];
+        int len;
+
+        switch (key->conf.alg) {
+        case ALG_AES_CMAC:
+                len = scnprintf(buf, sizeof(buf), "%u\n",
+                                key->u.aes_cmac.icverrors);
+                break;
+        default:
+                return 0;
+        }
+        return simple_read_from_buffer(userbuf, count, ppos, buf, len);
+}
+KEY_OPS(icverrors);
+
 static ssize_t key_key_read(struct file *file, char __user *userbuf,
                             size_t count, loff_t *ppos)
 {
@@ -222,6 +266,7 @@ void ieee80211_debugfs_key_add(struct ieee80211_key *key)
         DEBUGFS_ADD(tx_spec);
         DEBUGFS_ADD(rx_spec);
         DEBUGFS_ADD(replays);
+        DEBUGFS_ADD(icverrors);
         DEBUGFS_ADD(key);
         DEBUGFS_ADD(ifindex);
 };
@@ -243,6 +288,7 @@ void ieee80211_debugfs_key_remove(struct ieee80211_key *key)
         DEBUGFS_DEL(tx_spec);
         DEBUGFS_DEL(rx_spec);
         DEBUGFS_DEL(replays);
+        DEBUGFS_DEL(icverrors);
         DEBUGFS_DEL(key);
         DEBUGFS_DEL(ifindex);
 
@@ -280,6 +326,35 @@ void ieee80211_debugfs_key_remove_default(struct ieee80211_sub_if_data *sdata)
         sdata->common_debugfs.default_key = NULL;
 }
 
+void ieee80211_debugfs_key_add_mgmt_default(struct ieee80211_sub_if_data *sdata)
+{
+        char buf[50];
+        struct ieee80211_key *key;
+
+        if (!sdata->debugfsdir)
+                return;
+
+        /* this is running under the key lock */
+
+        key = sdata->default_mgmt_key;
+        if (key) {
+                sprintf(buf, "../keys/%d", key->debugfs.cnt);
+                sdata->common_debugfs.default_mgmt_key =
+                        debugfs_create_symlink("default_mgmt_key",
+                                               sdata->debugfsdir, buf);
+        } else
+                ieee80211_debugfs_key_remove_mgmt_default(sdata);
+}
+
+void ieee80211_debugfs_key_remove_mgmt_default(struct ieee80211_sub_if_data *sdata)
+{
+        if (!sdata)
+                return;
+
+        debugfs_remove(sdata->common_debugfs.default_mgmt_key);
+        sdata->common_debugfs.default_mgmt_key = NULL;
+}
+
 void ieee80211_debugfs_key_sta_del(struct ieee80211_key *key,
                                    struct sta_info *sta)
 {
diff --git a/net/mac80211/debugfs_key.h b/net/mac80211/debugfs_key.h
index b1a3754ee240..54717b4e1371 100644
--- a/net/mac80211/debugfs_key.h
+++ b/net/mac80211/debugfs_key.h
@@ -6,6 +6,10 @@ void ieee80211_debugfs_key_add(struct ieee80211_key *key);
 void ieee80211_debugfs_key_remove(struct ieee80211_key *key);
 void ieee80211_debugfs_key_add_default(struct ieee80211_sub_if_data *sdata);
 void ieee80211_debugfs_key_remove_default(struct ieee80211_sub_if_data *sdata);
+void ieee80211_debugfs_key_add_mgmt_default(
+        struct ieee80211_sub_if_data *sdata);
+void ieee80211_debugfs_key_remove_mgmt_default(
+        struct ieee80211_sub_if_data *sdata);
 void ieee80211_debugfs_key_sta_del(struct ieee80211_key *key,
                                    struct sta_info *sta);
 #else
@@ -19,6 +23,12 @@ static inline void ieee80211_debugfs_key_add_default(
 static inline void ieee80211_debugfs_key_remove_default(
         struct ieee80211_sub_if_data *sdata)
 {}
+static inline void ieee80211_debugfs_key_add_mgmt_default(
+        struct ieee80211_sub_if_data *sdata)
+{}
+static inline void ieee80211_debugfs_key_remove_mgmt_default(
+        struct ieee80211_sub_if_data *sdata)
+{}
 static inline void ieee80211_debugfs_key_sta_del(struct ieee80211_key *key,
                                                  struct sta_info *sta)
 {}
diff --git a/net/mac80211/debugfs_sta.c b/net/mac80211/debugfs_sta.c
index a2fbe0131312..90230c718b5b 100644
--- a/net/mac80211/debugfs_sta.c
+++ b/net/mac80211/debugfs_sta.c
@@ -67,14 +67,15 @@ static ssize_t sta_flags_read(struct file *file, char __user *userbuf,
         char buf[100];
         struct sta_info *sta = file->private_data;
         u32 staflags = get_sta_flags(sta);
-        int res = scnprintf(buf, sizeof(buf), "%s%s%s%s%s%s%s",
+        int res = scnprintf(buf, sizeof(buf), "%s%s%s%s%s%s%s%s",
                 staflags & WLAN_STA_AUTH ? "AUTH\n" : "",
                 staflags & WLAN_STA_ASSOC ? "ASSOC\n" : "",
                 staflags & WLAN_STA_PS ? "PS\n" : "",
                 staflags & WLAN_STA_AUTHORIZED ? "AUTHORIZED\n" : "",
                 staflags & WLAN_STA_SHORT_PREAMBLE ? "SHORT PREAMBLE\n" : "",
                 staflags & WLAN_STA_WME ? "WME\n" : "",
-                staflags & WLAN_STA_WDS ? "WDS\n" : "");
+                staflags & WLAN_STA_WDS ? "WDS\n" : "",
+                staflags & WLAN_STA_MFP ? "MFP\n" : "");
         return simple_read_from_buffer(userbuf, count, ppos, buf, res);
 }
 STA_OPS(flags);
diff --git a/net/mac80211/ht.c b/net/mac80211/ht.c
index c5c0c5271096..82ea0b63a386 100644
--- a/net/mac80211/ht.c
+++ b/net/mac80211/ht.c
@@ -17,8 +17,6 @@
 #include <net/wireless.h>
 #include <net/mac80211.h>
 #include "ieee80211_i.h"
-#include "sta_info.h"
-#include "wme.h"
 
 void ieee80211_ht_cap_ie_to_sta_ht_cap(struct ieee80211_supported_band *sband,
                                        struct ieee80211_ht_cap *ht_cap_ie,
@@ -130,14 +128,15 @@ u32 ieee80211_enable_ht(struct ieee80211_sub_if_data *sdata,
                 }
         }
 
-        ht_changed = local->hw.conf.ht.enabled != enable_ht ||
-                     channel_type != local->hw.conf.ht.channel_type;
+        ht_changed = conf_is_ht(&local->hw.conf) != enable_ht ||
+                     channel_type != local->hw.conf.channel_type;
 
         local->oper_channel_type = channel_type;
-        local->hw.conf.ht.enabled = enable_ht;
 
-        if (ht_changed)
-                ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_HT);
+        if (ht_changed) {
+                /* channel_type change automatically detected */
+                ieee80211_hw_config(local, 0);
+        }
 
         /* disable HT */
         if (!enable_ht)
@@ -154,105 +153,20 @@ u32 ieee80211_enable_ht(struct ieee80211_sub_if_data *sdata,
         return changed;
 }
 
-static void ieee80211_send_addba_request(struct ieee80211_sub_if_data *sdata,
-                                         const u8 *da, u16 tid,
-                                         u8 dialog_token, u16 start_seq_num,
-                                         u16 agg_size, u16 timeout)
+void ieee80211_sta_tear_down_BA_sessions(struct sta_info *sta)
 {
-        struct ieee80211_local *local = sdata->local;
-        struct ieee80211_if_sta *ifsta = &sdata->u.sta;
-        struct sk_buff *skb;
-        struct ieee80211_mgmt *mgmt;
-        u16 capab;
-
-        skb = dev_alloc_skb(sizeof(*mgmt) + local->hw.extra_tx_headroom);
-
-        if (!skb) {
-                printk(KERN_ERR "%s: failed to allocate buffer "
-                                "for addba request frame\n", sdata->dev->name);
-                return;
-        }
-        skb_reserve(skb, local->hw.extra_tx_headroom);
-        mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
-        memset(mgmt, 0, 24);
-        memcpy(mgmt->da, da, ETH_ALEN);
-        memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
-        if (sdata->vif.type == NL80211_IFTYPE_AP)
-                memcpy(mgmt->bssid, sdata->dev->dev_addr, ETH_ALEN);
-        else
-                memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
-
-        mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
-                                          IEEE80211_STYPE_ACTION);
-
-        skb_put(skb, 1 + sizeof(mgmt->u.action.u.addba_req));
-
-        mgmt->u.action.category = WLAN_CATEGORY_BACK;
-        mgmt->u.action.u.addba_req.action_code = WLAN_ACTION_ADDBA_REQ;
-
-        mgmt->u.action.u.addba_req.dialog_token = dialog_token;
-        capab = (u16)(1 << 1);          /* bit 1 aggregation policy */
-        capab |= (u16)(tid << 2);       /* bit 5:2 TID number */
-        capab |= (u16)(agg_size << 6);  /* bit 15:6 max size of aggergation */
-
-        mgmt->u.action.u.addba_req.capab = cpu_to_le16(capab);
-
-        mgmt->u.action.u.addba_req.timeout = cpu_to_le16(timeout);
-        mgmt->u.action.u.addba_req.start_seq_num =
-                                        cpu_to_le16(start_seq_num << 4);
-
-        ieee80211_tx_skb(sdata, skb, 0);
-}
-
-static void ieee80211_send_addba_resp(struct ieee80211_sub_if_data *sdata, u8 *da, u16 tid,
-                                      u8 dialog_token, u16 status, u16 policy,
-                                      u16 buf_size, u16 timeout)
-{
-        struct ieee80211_if_sta *ifsta = &sdata->u.sta;
-        struct ieee80211_local *local = sdata->local;
-        struct sk_buff *skb;
-        struct ieee80211_mgmt *mgmt;
-        u16 capab;
-
-        skb = dev_alloc_skb(sizeof(*mgmt) + local->hw.extra_tx_headroom);
+        int i;
 
-        if (!skb) {
-                printk(KERN_DEBUG "%s: failed to allocate buffer "
-                       "for addba resp frame\n", sdata->dev->name);
-                return;
+        for (i = 0; i <  STA_TID_NUM; i++) {
+                __ieee80211_stop_tx_ba_session(sta, i, WLAN_BACK_INITIATOR);
+                __ieee80211_stop_rx_ba_session(sta, i, WLAN_BACK_RECIPIENT,
+                                               WLAN_REASON_QSTA_LEAVE_QBSS);
         }
-
-        skb_reserve(skb, local->hw.extra_tx_headroom);
-        mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
-        memset(mgmt, 0, 24);
-        memcpy(mgmt->da, da, ETH_ALEN);
-        memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
-        if (sdata->vif.type == NL80211_IFTYPE_AP)
-                memcpy(mgmt->bssid, sdata->dev->dev_addr, ETH_ALEN);
-        else
-                memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
-        mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
-                                          IEEE80211_STYPE_ACTION);
-
-        skb_put(skb, 1 + sizeof(mgmt->u.action.u.addba_resp));
-        mgmt->u.action.category = WLAN_CATEGORY_BACK;
-        mgmt->u.action.u.addba_resp.action_code = WLAN_ACTION_ADDBA_RESP;
-        mgmt->u.action.u.addba_resp.dialog_token = dialog_token;
-
-        capab = (u16)(policy << 1);     /* bit 1 aggregation policy */
-        capab |= (u16)(tid << 2);       /* bit 5:2 TID number */
-        capab |= (u16)(buf_size << 6);  /* bit 15:6 max size of aggregation */
-
-        mgmt->u.action.u.addba_resp.capab = cpu_to_le16(capab);
-        mgmt->u.action.u.addba_resp.timeout = cpu_to_le16(timeout);
-        mgmt->u.action.u.addba_resp.status = cpu_to_le16(status);
-
-        ieee80211_tx_skb(sdata, skb, 0);
 }
 
-static void ieee80211_send_delba(struct ieee80211_sub_if_data *sdata,
-                                 const u8 *da, u16 tid,
-                                 u16 initiator, u16 reason_code)
+void ieee80211_send_delba(struct ieee80211_sub_if_data *sdata,
+                          const u8 *da, u16 tid,
+                          u16 initiator, u16 reason_code)
 {
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
@@ -273,7 +187,8 @@ static void ieee80211_send_delba(struct ieee80211_sub_if_data *sdata,
         memset(mgmt, 0, 24);
         memcpy(mgmt->da, da, ETH_ALEN);
         memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
-        if (sdata->vif.type == NL80211_IFTYPE_AP)
+        if (sdata->vif.type == NL80211_IFTYPE_AP ||
+            sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
                 memcpy(mgmt->bssid, sdata->dev->dev_addr, ETH_ALEN);
         else
                 memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
@@ -290,770 +205,7 @@ static void ieee80211_send_delba(struct ieee80211_sub_if_data *sdata,
         mgmt->u.action.u.delba.params = cpu_to_le16(params);
         mgmt->u.action.u.delba.reason_code = cpu_to_le16(reason_code);
 
-        ieee80211_tx_skb(sdata, skb, 0);
-}
-
-void ieee80211_send_bar(struct ieee80211_sub_if_data *sdata, u8 *ra, u16 tid, u16 ssn)
-{
-        struct ieee80211_local *local = sdata->local;
-        struct sk_buff *skb;
-        struct ieee80211_bar *bar;
-        u16 bar_control = 0;
-
-        skb = dev_alloc_skb(sizeof(*bar) + local->hw.extra_tx_headroom);
-        if (!skb) {
-                printk(KERN_ERR "%s: failed to allocate buffer for "
-                        "bar frame\n", sdata->dev->name);
-                return;
-        }
-        skb_reserve(skb, local->hw.extra_tx_headroom);
-        bar = (struct ieee80211_bar *)skb_put(skb, sizeof(*bar));
-        memset(bar, 0, sizeof(*bar));
-        bar->frame_control = cpu_to_le16(IEEE80211_FTYPE_CTL |
-                                         IEEE80211_STYPE_BACK_REQ);
-        memcpy(bar->ra, ra, ETH_ALEN);
-        memcpy(bar->ta, sdata->dev->dev_addr, ETH_ALEN);
-        bar_control |= (u16)IEEE80211_BAR_CTRL_ACK_POLICY_NORMAL;
-        bar_control |= (u16)IEEE80211_BAR_CTRL_CBMTID_COMPRESSED_BA;
-        bar_control |= (u16)(tid << 12);
-        bar->control = cpu_to_le16(bar_control);
-        bar->start_seq_num = cpu_to_le16(ssn);
-
-        ieee80211_tx_skb(sdata, skb, 0);
-}
-
-void ieee80211_sta_stop_rx_ba_session(struct ieee80211_sub_if_data *sdata, u8 *ra, u16 tid,
-                                        u16 initiator, u16 reason)
-{
-        struct ieee80211_local *local = sdata->local;
-        struct ieee80211_hw *hw = &local->hw;
-        struct sta_info *sta;
-        int ret, i;
-
-        rcu_read_lock();
-
-        sta = sta_info_get(local, ra);
-        if (!sta) {
-                rcu_read_unlock();
-                return;
-        }
-
-        /* check if TID is in operational state */
-        spin_lock_bh(&sta->lock);
-        if (sta->ampdu_mlme.tid_state_rx[tid]
-                                != HT_AGG_STATE_OPERATIONAL) {
-                spin_unlock_bh(&sta->lock);
-                rcu_read_unlock();
-                return;
-        }
-        sta->ampdu_mlme.tid_state_rx[tid] =
-                HT_AGG_STATE_REQ_STOP_BA_MSK |
-                (initiator << HT_AGG_STATE_INITIATOR_SHIFT);
-        spin_unlock_bh(&sta->lock);
-
-        /* stop HW Rx aggregation. ampdu_action existence
-         * already verified in session init so we add the BUG_ON */
-        BUG_ON(!local->ops->ampdu_action);
-
-#ifdef CONFIG_MAC80211_HT_DEBUG
-        printk(KERN_DEBUG "Rx BA session stop requested for %pM tid %u\n",
-               ra, tid);
-#endif /* CONFIG_MAC80211_HT_DEBUG */
-
-        ret = local->ops->ampdu_action(hw, IEEE80211_AMPDU_RX_STOP,
-                                       &sta->sta, tid, NULL);
-        if (ret)
-                printk(KERN_DEBUG "HW problem - can not stop rx "
-                                "aggregation for tid %d\n", tid);
-
-        /* shutdown timer has not expired */
-        if (initiator != WLAN_BACK_TIMER)
-                del_timer_sync(&sta->ampdu_mlme.tid_rx[tid]->session_timer);
-
-        /* check if this is a self generated aggregation halt */
-        if (initiator == WLAN_BACK_RECIPIENT || initiator == WLAN_BACK_TIMER)
-                ieee80211_send_delba(sdata, ra, tid, 0, reason);
-
-        /* free the reordering buffer */
-        for (i = 0; i < sta->ampdu_mlme.tid_rx[tid]->buf_size; i++) {
-                if (sta->ampdu_mlme.tid_rx[tid]->reorder_buf[i]) {
-                        /* release the reordered frames */
-                        dev_kfree_skb(sta->ampdu_mlme.tid_rx[tid]->reorder_buf[i]);
-                        sta->ampdu_mlme.tid_rx[tid]->stored_mpdu_num--;
-                        sta->ampdu_mlme.tid_rx[tid]->reorder_buf[i] = NULL;
-                }
-        }
-        /* free resources */
-        kfree(sta->ampdu_mlme.tid_rx[tid]->reorder_buf);
-        kfree(sta->ampdu_mlme.tid_rx[tid]);
-        sta->ampdu_mlme.tid_rx[tid] = NULL;
-        sta->ampdu_mlme.tid_state_rx[tid] = HT_AGG_STATE_IDLE;
-
-        rcu_read_unlock();
-}
-
-
-/*
- * After sending add Block Ack request we activated a timer until
- * add Block Ack response will arrive from the recipient.
- * If this timer expires sta_addba_resp_timer_expired will be executed.
- */
-static void sta_addba_resp_timer_expired(unsigned long data)
-{
-        /* not an elegant detour, but there is no choice as the timer passes
-         * only one argument, and both sta_info and TID are needed, so init
-         * flow in sta_info_create gives the TID as data, while the timer_to_id
-         * array gives the sta through container_of */
-        u16 tid = *(u8 *)data;
-        struct sta_info *temp_sta = container_of((void *)data,
-                struct sta_info, timer_to_tid[tid]);
-
-        struct ieee80211_local *local = temp_sta->local;
-        struct ieee80211_hw *hw = &local->hw;
-        struct sta_info *sta;
-        u8 *state;
-
-        rcu_read_lock();
-
-        sta = sta_info_get(local, temp_sta->sta.addr);
-        if (!sta) {
-                rcu_read_unlock();
-                return;
-        }
-
-        state = &sta->ampdu_mlme.tid_state_tx[tid];
-        /* check if the TID waits for addBA response */
-        spin_lock_bh(&sta->lock);
-        if (!(*state & HT_ADDBA_REQUESTED_MSK)) {
-                spin_unlock_bh(&sta->lock);
-                *state = HT_AGG_STATE_IDLE;
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                printk(KERN_DEBUG "timer expired on tid %d but we are not "
-                                "expecting addBA response there", tid);
-#endif
-                goto timer_expired_exit;
-        }
-
-#ifdef CONFIG_MAC80211_HT_DEBUG
-        printk(KERN_DEBUG "addBA response timer expired on tid %d\n", tid);
-#endif
-
-        /* go through the state check in stop_BA_session */
-        *state = HT_AGG_STATE_OPERATIONAL;
-        spin_unlock_bh(&sta->lock);
-        ieee80211_stop_tx_ba_session(hw, temp_sta->sta.addr, tid,
-                                     WLAN_BACK_INITIATOR);
-
-timer_expired_exit:
-        rcu_read_unlock();
-}
-
-void ieee80211_sta_tear_down_BA_sessions(struct ieee80211_sub_if_data *sdata, u8 *addr)
-{
-        struct ieee80211_local *local = sdata->local;
-        int i;
-
-        for (i = 0; i <  STA_TID_NUM; i++) {
-                ieee80211_stop_tx_ba_session(&local->hw, addr, i,
-                                             WLAN_BACK_INITIATOR);
-                ieee80211_sta_stop_rx_ba_session(sdata, addr, i,
-                                                 WLAN_BACK_RECIPIENT,
-                                                 WLAN_REASON_QSTA_LEAVE_QBSS);
-        }
-}
-
-int ieee80211_start_tx_ba_session(struct ieee80211_hw *hw, u8 *ra, u16 tid)
-{
-        struct ieee80211_local *local = hw_to_local(hw);
-        struct sta_info *sta;
-        struct ieee80211_sub_if_data *sdata;
-        u16 start_seq_num;
-        u8 *state;
-        int ret = 0;
-
-        if ((tid >= STA_TID_NUM) || !(hw->flags & IEEE80211_HW_AMPDU_AGGREGATION))
-                return -EINVAL;
-
-#ifdef CONFIG_MAC80211_HT_DEBUG
-        printk(KERN_DEBUG "Open BA session requested for %pM tid %u\n",
-               ra, tid);
-#endif /* CONFIG_MAC80211_HT_DEBUG */
-
-        rcu_read_lock();
-
-        sta = sta_info_get(local, ra);
-        if (!sta) {
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                printk(KERN_DEBUG "Could not find the station\n");
-#endif
-                ret = -ENOENT;
-                goto exit;
-        }
-
-        spin_lock_bh(&sta->lock);
-
-        /* we have tried too many times, receiver does not want A-MPDU */
-        if (sta->ampdu_mlme.addba_req_num[tid] > HT_AGG_MAX_RETRIES) {
-                ret = -EBUSY;
-                goto err_unlock_sta;
-        }
-
-        state = &sta->ampdu_mlme.tid_state_tx[tid];
-        /* check if the TID is not in aggregation flow already */
-        if (*state != HT_AGG_STATE_IDLE) {
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                printk(KERN_DEBUG "BA request denied - session is not "
-                                 "idle on tid %u\n", tid);
-#endif /* CONFIG_MAC80211_HT_DEBUG */
-                ret = -EAGAIN;
-                goto err_unlock_sta;
-        }
-
-        /* prepare A-MPDU MLME for Tx aggregation */
-        sta->ampdu_mlme.tid_tx[tid] =
-                        kmalloc(sizeof(struct tid_ampdu_tx), GFP_ATOMIC);
-        if (!sta->ampdu_mlme.tid_tx[tid]) {
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                if (net_ratelimit())
-                        printk(KERN_ERR "allocate tx mlme to tid %d failed\n",
-                                        tid);
-#endif
-                ret = -ENOMEM;
-                goto err_unlock_sta;
-        }
-        /* Tx timer */
-        sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer.function =
-                        sta_addba_resp_timer_expired;
-        sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer.data =
-                        (unsigned long)&sta->timer_to_tid[tid];
-        init_timer(&sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer);
-
-        if (hw->ampdu_queues) {
-                /* create a new queue for this aggregation */
-                ret = ieee80211_ht_agg_queue_add(local, sta, tid);
-
-                /* case no queue is available to aggregation
-                 * don't switch to aggregation */
-                if (ret) {
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                        printk(KERN_DEBUG "BA request denied - "
-                               "queue unavailable for tid %d\n", tid);
-#endif /* CONFIG_MAC80211_HT_DEBUG */
-                        goto err_unlock_queue;
-                }
-        }
-        sdata = sta->sdata;
-
-        /* Ok, the Addba frame hasn't been sent yet, but if the driver calls the
-         * call back right away, it must see that the flow has begun */
-        *state |= HT_ADDBA_REQUESTED_MSK;
-
-        /* This is slightly racy because the queue isn't stopped */
-        start_seq_num = sta->tid_seq[tid];
-
-        if (local->ops->ampdu_action)
-                ret = local->ops->ampdu_action(hw, IEEE80211_AMPDU_TX_START,
-                                               &sta->sta, tid, &start_seq_num);
-
-        if (ret) {
-                /* No need to requeue the packets in the agg queue, since we
-                 * held the tx lock: no packet could be enqueued to the newly
-                 * allocated queue */
-                if (hw->ampdu_queues)
-                        ieee80211_ht_agg_queue_remove(local, sta, tid, 0);
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                printk(KERN_DEBUG "BA request denied - HW unavailable for"
-                                        " tid %d\n", tid);
-#endif /* CONFIG_MAC80211_HT_DEBUG */
-                *state = HT_AGG_STATE_IDLE;
-                goto err_unlock_queue;
-        }
-
-        /* Will put all the packets in the new SW queue */
-        if (hw->ampdu_queues)
-                ieee80211_requeue(local, ieee802_1d_to_ac[tid]);
-        spin_unlock_bh(&sta->lock);
-
-        /* send an addBA request */
-        sta->ampdu_mlme.dialog_token_allocator++;
-        sta->ampdu_mlme.tid_tx[tid]->dialog_token =
-                        sta->ampdu_mlme.dialog_token_allocator;
-        sta->ampdu_mlme.tid_tx[tid]->ssn = start_seq_num;
-
-
-        ieee80211_send_addba_request(sta->sdata, ra, tid,
-                         sta->ampdu_mlme.tid_tx[tid]->dialog_token,
-                         sta->ampdu_mlme.tid_tx[tid]->ssn,
-                         0x40, 5000);
-        /* activate the timer for the recipient's addBA response */
-        sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer.expires =
-                                jiffies + ADDBA_RESP_INTERVAL;
-        add_timer(&sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer);
-#ifdef CONFIG_MAC80211_HT_DEBUG
-        printk(KERN_DEBUG "activated addBA response timer on tid %d\n", tid);
-#endif
-        goto exit;
-
-err_unlock_queue:
-        kfree(sta->ampdu_mlme.tid_tx[tid]);
-        sta->ampdu_mlme.tid_tx[tid] = NULL;
-        ret = -EBUSY;
-err_unlock_sta:
-        spin_unlock_bh(&sta->lock);
-exit:
-        rcu_read_unlock();
-        return ret;
-}
-EXPORT_SYMBOL(ieee80211_start_tx_ba_session);
-
-int ieee80211_stop_tx_ba_session(struct ieee80211_hw *hw,
-                                 u8 *ra, u16 tid,
-                                 enum ieee80211_back_parties initiator)
-{
-        struct ieee80211_local *local = hw_to_local(hw);
-        struct sta_info *sta;
-        u8 *state;
-        int ret = 0;
-
-        if (tid >= STA_TID_NUM)
-                return -EINVAL;
-
-        rcu_read_lock();
-        sta = sta_info_get(local, ra);
-        if (!sta) {
-                rcu_read_unlock();
-                return -ENOENT;
-        }
-
-        /* check if the TID is in aggregation */
-        state = &sta->ampdu_mlme.tid_state_tx[tid];
-        spin_lock_bh(&sta->lock);
-
-        if (*state != HT_AGG_STATE_OPERATIONAL) {
-                ret = -ENOENT;
-                goto stop_BA_exit;
-        }
-
-#ifdef CONFIG_MAC80211_HT_DEBUG
-        printk(KERN_DEBUG "Tx BA session stop requested for %pM tid %u\n",
-               ra, tid);
-#endif /* CONFIG_MAC80211_HT_DEBUG */
-
-        if (hw->ampdu_queues)
-                ieee80211_stop_queue(hw, sta->tid_to_tx_q[tid]);
-
-        *state = HT_AGG_STATE_REQ_STOP_BA_MSK |
-                (initiator << HT_AGG_STATE_INITIATOR_SHIFT);
-
-        if (local->ops->ampdu_action)
-                ret = local->ops->ampdu_action(hw, IEEE80211_AMPDU_TX_STOP,
-                                               &sta->sta, tid, NULL);
-
-        /* case HW denied going back to legacy */
-        if (ret) {
-                WARN_ON(ret != -EBUSY);
-                *state = HT_AGG_STATE_OPERATIONAL;
-                if (hw->ampdu_queues)
-                        ieee80211_wake_queue(hw, sta->tid_to_tx_q[tid]);
-                goto stop_BA_exit;
-        }
-
-stop_BA_exit:
-        spin_unlock_bh(&sta->lock);
-        rcu_read_unlock();
-        return ret;
-}
-EXPORT_SYMBOL(ieee80211_stop_tx_ba_session);
-
-void ieee80211_start_tx_ba_cb(struct ieee80211_hw *hw, u8 *ra, u16 tid)
-{
-        struct ieee80211_local *local = hw_to_local(hw);
-        struct sta_info *sta;
-        u8 *state;
-
-        if (tid >= STA_TID_NUM) {
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                printk(KERN_DEBUG "Bad TID value: tid = %d (>= %d)\n",
-                                tid, STA_TID_NUM);
-#endif
-                return;
-        }
-
-        rcu_read_lock();
-        sta = sta_info_get(local, ra);
-        if (!sta) {
-                rcu_read_unlock();
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                printk(KERN_DEBUG "Could not find station: %pM\n", ra);
-#endif
-                return;
-        }
-
-        state = &sta->ampdu_mlme.tid_state_tx[tid];
-        spin_lock_bh(&sta->lock);
-
-        if (!(*state & HT_ADDBA_REQUESTED_MSK)) {
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                printk(KERN_DEBUG "addBA was not requested yet, state is %d\n",
-                                *state);
-#endif
-                spin_unlock_bh(&sta->lock);
-                rcu_read_unlock();
-                return;
-        }
-
-        WARN_ON_ONCE(*state & HT_ADDBA_DRV_READY_MSK);
-
-        *state |= HT_ADDBA_DRV_READY_MSK;
-
-        if (*state == HT_AGG_STATE_OPERATIONAL) {
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                printk(KERN_DEBUG "Aggregation is on for tid %d \n", tid);
-#endif
-                if (hw->ampdu_queues)
-                        ieee80211_wake_queue(hw, sta->tid_to_tx_q[tid]);
-        }
-        spin_unlock_bh(&sta->lock);
-        rcu_read_unlock();
-}
-EXPORT_SYMBOL(ieee80211_start_tx_ba_cb);
-
-void ieee80211_stop_tx_ba_cb(struct ieee80211_hw *hw, u8 *ra, u8 tid)
-{
-        struct ieee80211_local *local = hw_to_local(hw);
-        struct sta_info *sta;
-        u8 *state;
-        int agg_queue;
-
-        if (tid >= STA_TID_NUM) {
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                printk(KERN_DEBUG "Bad TID value: tid = %d (>= %d)\n",
-                                tid, STA_TID_NUM);
-#endif
-                return;
-        }
-
-#ifdef CONFIG_MAC80211_HT_DEBUG
-        printk(KERN_DEBUG "Stopping Tx BA session for %pM tid %d\n",
-               ra, tid);
-#endif /* CONFIG_MAC80211_HT_DEBUG */
-
-        rcu_read_lock();
-        sta = sta_info_get(local, ra);
-        if (!sta) {
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                printk(KERN_DEBUG "Could not find station: %pM\n", ra);
-#endif
-                rcu_read_unlock();
-                return;
-        }
-        state = &sta->ampdu_mlme.tid_state_tx[tid];
-
-        /* NOTE: no need to use sta->lock in this state check, as
-         * ieee80211_stop_tx_ba_session will let only one stop call to
-         * pass through per sta/tid
-         */
-        if ((*state & HT_AGG_STATE_REQ_STOP_BA_MSK) == 0) {
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                printk(KERN_DEBUG "unexpected callback to A-MPDU stop\n");
-#endif
-                rcu_read_unlock();
-                return;
-        }
-
-        if (*state & HT_AGG_STATE_INITIATOR_MSK)
-                ieee80211_send_delba(sta->sdata, ra, tid,
-                        WLAN_BACK_INITIATOR, WLAN_REASON_QSTA_NOT_USE);
-
-        if (hw->ampdu_queues) {
-                agg_queue = sta->tid_to_tx_q[tid];
-                ieee80211_ht_agg_queue_remove(local, sta, tid, 1);
-
-                /* We just requeued the all the frames that were in the
-                 * removed queue, and since we might miss a softirq we do
-                 * netif_schedule_queue.  ieee80211_wake_queue is not used
-                 * here as this queue is not necessarily stopped
-                 */
-                netif_schedule_queue(netdev_get_tx_queue(local->mdev,
-                                                         agg_queue));
-        }
-        spin_lock_bh(&sta->lock);
-        *state = HT_AGG_STATE_IDLE;
-        sta->ampdu_mlme.addba_req_num[tid] = 0;
-        kfree(sta->ampdu_mlme.tid_tx[tid]);
-        sta->ampdu_mlme.tid_tx[tid] = NULL;
-        spin_unlock_bh(&sta->lock);
-
-        rcu_read_unlock();
-}
-EXPORT_SYMBOL(ieee80211_stop_tx_ba_cb);
-
-void ieee80211_start_tx_ba_cb_irqsafe(struct ieee80211_hw *hw,
-                                      const u8 *ra, u16 tid)
-{
-        struct ieee80211_local *local = hw_to_local(hw);
-        struct ieee80211_ra_tid *ra_tid;
-        struct sk_buff *skb = dev_alloc_skb(0);
-
-        if (unlikely(!skb)) {
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                if (net_ratelimit())
-                        printk(KERN_WARNING "%s: Not enough memory, "
-                               "dropping start BA session", skb->dev->name);
-#endif
-                return;
-        }
-        ra_tid = (struct ieee80211_ra_tid *) &skb->cb;
-        memcpy(&ra_tid->ra, ra, ETH_ALEN);
-        ra_tid->tid = tid;
-
-        skb->pkt_type = IEEE80211_ADDBA_MSG;
-        skb_queue_tail(&local->skb_queue, skb);
-        tasklet_schedule(&local->tasklet);
-}
-EXPORT_SYMBOL(ieee80211_start_tx_ba_cb_irqsafe);
-
-void ieee80211_stop_tx_ba_cb_irqsafe(struct ieee80211_hw *hw,
-                                     const u8 *ra, u16 tid)
-{
-        struct ieee80211_local *local = hw_to_local(hw);
-        struct ieee80211_ra_tid *ra_tid;
-        struct sk_buff *skb = dev_alloc_skb(0);
-
-        if (unlikely(!skb)) {
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                if (net_ratelimit())
-                        printk(KERN_WARNING "%s: Not enough memory, "
-                               "dropping stop BA session", skb->dev->name);
-#endif
-                return;
-        }
-        ra_tid = (struct ieee80211_ra_tid *) &skb->cb;
-        memcpy(&ra_tid->ra, ra, ETH_ALEN);
-        ra_tid->tid = tid;
-
-        skb->pkt_type = IEEE80211_DELBA_MSG;
-        skb_queue_tail(&local->skb_queue, skb);
-        tasklet_schedule(&local->tasklet);
-}
-EXPORT_SYMBOL(ieee80211_stop_tx_ba_cb_irqsafe);
-
-/*
- * After accepting the AddBA Request we activated a timer,
- * resetting it after each frame that arrives from the originator.
- * if this timer expires ieee80211_sta_stop_rx_ba_session will be executed.
- */
-static void sta_rx_agg_session_timer_expired(unsigned long data)
-{
-        /* not an elegant detour, but there is no choice as the timer passes
-         * only one argument, and various sta_info are needed here, so init
-         * flow in sta_info_create gives the TID as data, while the timer_to_id
-         * array gives the sta through container_of */
-        u8 *ptid = (u8 *)data;
-        u8 *timer_to_id = ptid - *ptid;
-        struct sta_info *sta = container_of(timer_to_id, struct sta_info,
-                                         timer_to_tid[0]);
-
-#ifdef CONFIG_MAC80211_HT_DEBUG
-        printk(KERN_DEBUG "rx session timer expired on tid %d\n", (u16)*ptid);
-#endif
-        ieee80211_sta_stop_rx_ba_session(sta->sdata, sta->sta.addr,
-                                         (u16)*ptid, WLAN_BACK_TIMER,
-                                         WLAN_REASON_QSTA_TIMEOUT);
-}
-
-void ieee80211_process_addba_request(struct ieee80211_local *local,
-                                     struct sta_info *sta,
-                                     struct ieee80211_mgmt *mgmt,
-                                     size_t len)
-{
-        struct ieee80211_hw *hw = &local->hw;
-        struct ieee80211_conf *conf = &hw->conf;
-        struct tid_ampdu_rx *tid_agg_rx;
-        u16 capab, tid, timeout, ba_policy, buf_size, start_seq_num, status;
-        u8 dialog_token;
-        int ret = -EOPNOTSUPP;
-
-        /* extract session parameters from addba request frame */
-        dialog_token = mgmt->u.action.u.addba_req.dialog_token;
-        timeout = le16_to_cpu(mgmt->u.action.u.addba_req.timeout);
-        start_seq_num =
-                le16_to_cpu(mgmt->u.action.u.addba_req.start_seq_num) >> 4;
-
-        capab = le16_to_cpu(mgmt->u.action.u.addba_req.capab);
-        ba_policy = (capab & IEEE80211_ADDBA_PARAM_POLICY_MASK) >> 1;
-        tid = (capab & IEEE80211_ADDBA_PARAM_TID_MASK) >> 2;
-        buf_size = (capab & IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK) >> 6;
-
-        status = WLAN_STATUS_REQUEST_DECLINED;
-
-        /* sanity check for incoming parameters:
-         * check if configuration can support the BA policy
-         * and if buffer size does not exceeds max value */
-        /* XXX: check own ht delayed BA capability?? */
-        if (((ba_policy != 1)
-                && (!(sta->sta.ht_cap.cap & IEEE80211_HT_CAP_DELAY_BA)))
-                || (buf_size > IEEE80211_MAX_AMPDU_BUF)) {
-                status = WLAN_STATUS_INVALID_QOS_PARAM;
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                if (net_ratelimit())
-                        printk(KERN_DEBUG "AddBA Req with bad params from "
-                                "%pM on tid %u. policy %d, buffer size %d\n",
-                                mgmt->sa, tid, ba_policy,
-                                buf_size);
-#endif /* CONFIG_MAC80211_HT_DEBUG */
-                goto end_no_lock;
-        }
-        /* determine default buffer size */
-        if (buf_size == 0) {
-                struct ieee80211_supported_band *sband;
-
-                sband = local->hw.wiphy->bands[conf->channel->band];
-                buf_size = IEEE80211_MIN_AMPDU_BUF;
-                buf_size = buf_size << sband->ht_cap.ampdu_factor;
-        }
-
-
-        /* examine state machine */
-        spin_lock_bh(&sta->lock);
-
-        if (sta->ampdu_mlme.tid_state_rx[tid] != HT_AGG_STATE_IDLE) {
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                if (net_ratelimit())
-                        printk(KERN_DEBUG "unexpected AddBA Req from "
-                                "%pM on tid %u\n",
-                                mgmt->sa, tid);
-#endif /* CONFIG_MAC80211_HT_DEBUG */
-                goto end;
-        }
-
-        /* prepare A-MPDU MLME for Rx aggregation */
-        sta->ampdu_mlme.tid_rx[tid] =
-                        kmalloc(sizeof(struct tid_ampdu_rx), GFP_ATOMIC);
-        if (!sta->ampdu_mlme.tid_rx[tid]) {
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                if (net_ratelimit())
-                        printk(KERN_ERR "allocate rx mlme to tid %d failed\n",
-                                        tid);
-#endif
-                goto end;
-        }
-        /* rx timer */
-        sta->ampdu_mlme.tid_rx[tid]->session_timer.function =
-                                sta_rx_agg_session_timer_expired;
-        sta->ampdu_mlme.tid_rx[tid]->session_timer.data =
-                                (unsigned long)&sta->timer_to_tid[tid];
-        init_timer(&sta->ampdu_mlme.tid_rx[tid]->session_timer);
-
-        tid_agg_rx = sta->ampdu_mlme.tid_rx[tid];
-
-        /* prepare reordering buffer */
-        tid_agg_rx->reorder_buf =
-                kmalloc(buf_size * sizeof(struct sk_buff *), GFP_ATOMIC);
-        if (!tid_agg_rx->reorder_buf) {
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                if (net_ratelimit())
-                        printk(KERN_ERR "can not allocate reordering buffer "
-                               "to tid %d\n", tid);
-#endif
-                kfree(sta->ampdu_mlme.tid_rx[tid]);
-                goto end;
-        }
-        memset(tid_agg_rx->reorder_buf, 0,
-                buf_size * sizeof(struct sk_buff *));
-
-        if (local->ops->ampdu_action)
-                ret = local->ops->ampdu_action(hw, IEEE80211_AMPDU_RX_START,
-                                               &sta->sta, tid, &start_seq_num);
-#ifdef CONFIG_MAC80211_HT_DEBUG
-        printk(KERN_DEBUG "Rx A-MPDU request on tid %d result %d\n", tid, ret);
-#endif /* CONFIG_MAC80211_HT_DEBUG */
-
-        if (ret) {
-                kfree(tid_agg_rx->reorder_buf);
-                kfree(tid_agg_rx);
-                sta->ampdu_mlme.tid_rx[tid] = NULL;
-                goto end;
-        }
-
-        /* change state and send addba resp */
-        sta->ampdu_mlme.tid_state_rx[tid] = HT_AGG_STATE_OPERATIONAL;
-        tid_agg_rx->dialog_token = dialog_token;
-        tid_agg_rx->ssn = start_seq_num;
-        tid_agg_rx->head_seq_num = start_seq_num;
-        tid_agg_rx->buf_size = buf_size;
-        tid_agg_rx->timeout = timeout;
-        tid_agg_rx->stored_mpdu_num = 0;
-        status = WLAN_STATUS_SUCCESS;
-end:
-        spin_unlock_bh(&sta->lock);
-
-end_no_lock:
-        ieee80211_send_addba_resp(sta->sdata, sta->sta.addr, tid,
-                                  dialog_token, status, 1, buf_size, timeout);
-}
-
-void ieee80211_process_addba_resp(struct ieee80211_local *local,
-                                  struct sta_info *sta,
-                                  struct ieee80211_mgmt *mgmt,
-                                  size_t len)
-{
-        struct ieee80211_hw *hw = &local->hw;
-        u16 capab;
-        u16 tid, start_seq_num;
-        u8 *state;
-
-        capab = le16_to_cpu(mgmt->u.action.u.addba_resp.capab);
-        tid = (capab & IEEE80211_ADDBA_PARAM_TID_MASK) >> 2;
-
-        state = &sta->ampdu_mlme.tid_state_tx[tid];
-
-        spin_lock_bh(&sta->lock);
-
-        if (!(*state & HT_ADDBA_REQUESTED_MSK)) {
-                spin_unlock_bh(&sta->lock);
-                return;
-        }
-
-        if (mgmt->u.action.u.addba_resp.dialog_token !=
-                sta->ampdu_mlme.tid_tx[tid]->dialog_token) {
-                spin_unlock_bh(&sta->lock);
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                printk(KERN_DEBUG "wrong addBA response token, tid %d\n", tid);
-#endif /* CONFIG_MAC80211_HT_DEBUG */
-                return;
-        }
-
-        del_timer_sync(&sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer);
-#ifdef CONFIG_MAC80211_HT_DEBUG
-        printk(KERN_DEBUG "switched off addBA timer for tid %d \n", tid);
-#endif /* CONFIG_MAC80211_HT_DEBUG */
-        if (le16_to_cpu(mgmt->u.action.u.addba_resp.status)
-                        == WLAN_STATUS_SUCCESS) {
-                *state |= HT_ADDBA_RECEIVED_MSK;
-                sta->ampdu_mlme.addba_req_num[tid] = 0;
-
-                if (*state == HT_AGG_STATE_OPERATIONAL &&
-                    local->hw.ampdu_queues)
-                        ieee80211_wake_queue(hw, sta->tid_to_tx_q[tid]);
-
-                if (local->ops->ampdu_action) {
-                        (void)local->ops->ampdu_action(hw,
-                                               IEEE80211_AMPDU_TX_RESUME,
-                                               &sta->sta, tid, &start_seq_num);
-                }
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                printk(KERN_DEBUG "Resuming TX aggregation for tid %d\n", tid);
-#endif /* CONFIG_MAC80211_HT_DEBUG */
-                spin_unlock_bh(&sta->lock);
-        } else {
-                sta->ampdu_mlme.addba_req_num[tid]++;
-                /* this will allow the state check in stop_BA_session */
-                *state = HT_AGG_STATE_OPERATIONAL;
-                spin_unlock_bh(&sta->lock);
-                ieee80211_stop_tx_ba_session(hw, sta->sta.addr, tid,
-                                             WLAN_BACK_INITIATOR);
-        }
+        ieee80211_tx_skb(sdata, skb, 1);
 }
 
 void ieee80211_process_delba(struct ieee80211_sub_if_data *sdata,
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index f3eec989662b..2cb743ed9f9c 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -43,7 +43,7 @@ struct ieee80211_local;
 
 /* Required encryption head and tailroom */
 #define IEEE80211_ENCRYPT_HEADROOM 8
-#define IEEE80211_ENCRYPT_TAILROOM 12
+#define IEEE80211_ENCRYPT_TAILROOM 18
 
 /* IEEE 802.11 (Ch. 9.5 Defragmentation) requires support for concurrent
  * reception of at least three fragmented frames. This limit can be increased
@@ -57,6 +57,8 @@ struct ieee80211_local;
  */
 #define IEEE80211_SCAN_RESULT_EXPIRE (10 * HZ)
 
+#define TU_TO_EXP_TIME(x)       (jiffies + usecs_to_jiffies((x) * 1024))
+
 struct ieee80211_fragment_entry {
         unsigned long first_frag_time;
         unsigned int seq;
@@ -70,43 +72,36 @@ struct ieee80211_fragment_entry {
 
 
 struct ieee80211_bss {
-        struct list_head list;
-        struct ieee80211_bss *hnext;
-        size_t ssid_len;
+        /* Yes, this is a hack */
+        struct cfg80211_bss cbss;
 
-        atomic_t users;
-
-        u8 bssid[ETH_ALEN];
+        /* don't want to look up all the time */
+        size_t ssid_len;
         u8 ssid[IEEE80211_MAX_SSID_LEN];
+
         u8 dtim_period;
-        u16 capability; /* host byte order */
-        enum ieee80211_band band;
-        int freq;
-        int signal, noise, qual;
-        u8 *ies; /* all information elements from the last Beacon or Probe
-                  * Response frames; note Beacon frame is not allowed to
-                  * override values from Probe Response */
-        size_t ies_len;
+
         bool wmm_used;
+
+        unsigned long last_probe_resp;
+
 #ifdef CONFIG_MAC80211_MESH
         u8 *mesh_id;
         size_t mesh_id_len;
         u8 *mesh_cfg;
 #endif
+
 #define IEEE80211_MAX_SUPP_RATES 32
         u8 supp_rates[IEEE80211_MAX_SUPP_RATES];
         size_t supp_rates_len;
-        u64 timestamp;
-        int beacon_int;
 
-        unsigned long last_probe_resp;
-        unsigned long last_update;
-
-        /* during assocation, we save an ERP value from a probe response so
+        /*
+         * During assocation, we save an ERP value from a probe response so
          * that we can feed ERP info to the driver when handling the
          * association completes. these fields probably won't be up-to-date
-         * otherwise, you probably don't want to use them. */
-        int has_erp_value;
+         * otherwise, you probably don't want to use them.
+         */
+        bool has_erp_value;
         u8 erp_value;
 };
 
@@ -258,6 +253,9 @@ struct mesh_preq_queue {
 #define IEEE80211_STA_AUTO_BSSID_SEL    BIT(11)
 #define IEEE80211_STA_AUTO_CHANNEL_SEL  BIT(12)
 #define IEEE80211_STA_PRIVACY_INVOKED   BIT(13)
+#define IEEE80211_STA_TKIP_WEP_USED     BIT(14)
+#define IEEE80211_STA_CSA_RECEIVED      BIT(15)
+#define IEEE80211_STA_MFP_ENABLED       BIT(16)
 /* flags for MLME request */
 #define IEEE80211_STA_REQ_SCAN 0
 #define IEEE80211_STA_REQ_DIRECT_PROBE 1
@@ -282,13 +280,13 @@ enum ieee80211_sta_mlme_state {
 
 struct ieee80211_if_sta {
         struct timer_list timer;
+        struct timer_list chswitch_timer;
         struct work_struct work;
+        struct work_struct chswitch_work;
         u8 bssid[ETH_ALEN], prev_bssid[ETH_ALEN];
         u8 ssid[IEEE80211_MAX_SSID_LEN];
         enum ieee80211_sta_mlme_state state;
         size_t ssid_len;
-        u8 scan_ssid[IEEE80211_MAX_SSID_LEN];
-        size_t scan_ssid_len;
         u16 aid;
         u16 ap_capab, capab;
         u8 *extra_ie; /* to be added to the end of AssocReq */
@@ -315,11 +313,33 @@ struct ieee80211_if_sta {
         int auth_alg; /* currently used IEEE 802.11 authentication algorithm */
         int auth_transaction;
 
+        enum {
+                IEEE80211_MFP_DISABLED,
+                IEEE80211_MFP_OPTIONAL,
+                IEEE80211_MFP_REQUIRED
+        } mfp; /* management frame protection */
+
         unsigned long ibss_join_req;
         struct sk_buff *probe_resp; /* ProbeResp template for IBSS */
         u32 supp_rates_bits[IEEE80211_NUM_BANDS];
 
         int wmm_last_param_set;
+
+        /* Extra IE data for management frames */
+        u8 *ie_probereq;
+        size_t ie_probereq_len;
+        u8 *ie_proberesp;
+        size_t ie_proberesp_len;
+        u8 *ie_auth;
+        size_t ie_auth_len;
+        u8 *ie_assocreq;
+        size_t ie_assocreq_len;
+        u8 *ie_reassocreq;
+        size_t ie_reassocreq_len;
+        u8 *ie_deauth;
+        size_t ie_deauth_len;
+        u8 *ie_disassoc;
+        size_t ie_disassoc_len;
 };
 
 struct ieee80211_if_mesh {
@@ -404,8 +424,10 @@ struct ieee80211_sub_if_data {
         unsigned int fragment_next;
 
 #define NUM_DEFAULT_KEYS 4
-        struct ieee80211_key *keys[NUM_DEFAULT_KEYS];
+#define NUM_DEFAULT_MGMT_KEYS 2
+        struct ieee80211_key *keys[NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS];
         struct ieee80211_key *default_key;
+        struct ieee80211_key *default_mgmt_key;
 
         u16 sequence_number;
 
@@ -477,6 +499,7 @@ struct ieee80211_sub_if_data {
         } debugfs;
         struct {
                 struct dentry *default_key;
+                struct dentry *default_mgmt_key;
         } common_debugfs;
 
 #ifdef CONFIG_MAC80211_MESH
@@ -541,6 +564,7 @@ enum {
 enum queue_stop_reason {
         IEEE80211_QUEUE_STOP_REASON_DRIVER,
         IEEE80211_QUEUE_STOP_REASON_PS,
+        IEEE80211_QUEUE_STOP_REASON_CSA
 };
 
 /* maximum number of hardware queues we support. */
@@ -568,7 +592,6 @@ struct ieee80211_local {
         int fif_fcsfail, fif_plcpfail, fif_control, fif_other_bss;
         unsigned int filter_flags; /* FIF_* */
         struct iw_statistics wstats;
-        u8 wstats_flags;
         bool tim_in_locked_section; /* see ieee80211_beacon_get() */
         int tx_headroom; /* required headroom for hardware/radiotap */
 
@@ -612,7 +635,9 @@ struct ieee80211_local {
         struct crypto_blkcipher *wep_rx_tfm;
         u32 wep_iv;
 
+        /* see iface.c */
         struct list_head interfaces;
+        struct mutex iflist_mtx;
 
         /*
          * Key lock, protects sdata's key_list and sta_info's
@@ -623,20 +648,18 @@ struct ieee80211_local {
 
         /* Scanning and BSS list */
         bool sw_scanning, hw_scanning;
+        struct cfg80211_ssid scan_ssid;
+        struct cfg80211_scan_request int_scan_req;
+        struct cfg80211_scan_request *scan_req;
+        struct ieee80211_channel *scan_channel;
         int scan_channel_idx;
-        enum ieee80211_band scan_band;
 
         enum { SCAN_SET_CHANNEL, SCAN_SEND_PROBE } scan_state;
         unsigned long last_scan_completed;
         struct delayed_work scan_work;
         struct ieee80211_sub_if_data *scan_sdata;
-        struct ieee80211_channel *oper_channel, *scan_channel;
         enum nl80211_channel_type oper_channel_type;
-        u8 scan_ssid[IEEE80211_MAX_SSID_LEN];
-        size_t scan_ssid_len;
-        struct list_head bss_list;
-        struct ieee80211_bss *bss_hash[STA_HASH_SIZE];
-        spinlock_t bss_lock;
+        struct ieee80211_channel *oper_channel, *csa_channel;
 
         /* SNMP counters */
         /* dot11CountersTable */
@@ -649,7 +672,6 @@ struct ieee80211_local {
         u32 dot11ReceivedFragmentCount;
         u32 dot11MulticastReceivedFrameCount;
         u32 dot11TransmittedFrameCount;
-        u32 dot11WEPUndecryptableCount;
 
 #ifdef CONFIG_MAC80211_LEDS
         int tx_led_counter, rx_led_counter;
@@ -696,11 +718,14 @@ struct ieee80211_local {
         unsigned int wmm_acm; /* bit field of ACM bits (BIT(802.1D tag)) */
 
         bool powersave;
-        int dynamic_ps_timeout;
+        bool pspolling;
         struct work_struct dynamic_ps_enable_work;
         struct work_struct dynamic_ps_disable_work;
         struct timer_list dynamic_ps_timer;
 
+        int user_power_level; /* in dBm */
+        int power_constr_level; /* in dBm */
+
 #ifdef CONFIG_MAC80211_DEBUGFS
         struct local_debugfsdentries {
                 struct dentry *rcdir;
@@ -712,6 +737,7 @@ struct ieee80211_local {
                 struct dentry *long_retry_limit;
                 struct dentry *total_ps_buffered;
                 struct dentry *wep_iv;
+                struct dentry *tsf;
                 struct dentry *statistics;
                 struct local_debugfsdentries_statsdentries {
                         struct dentry *transmitted_fragment_count;
@@ -805,6 +831,7 @@ struct ieee802_11_elems {
         u8 *country_elem;
         u8 *pwr_constr_elem;
         u8 *quiet_elem;         /* first quite element */
+        u8 *timeout_int;
 
         /* length of them, respectively */
         u8 ssid_len;
@@ -832,6 +859,7 @@ struct ieee802_11_elems {
         u8 pwr_constr_elem_len;
         u8 quiet_elem_len;
         u8 num_of_quiet_elem;   /* can be more the one */
+        u8 timeout_int_len;
 };
 
 static inline struct ieee80211_local *hw_to_local(
@@ -875,19 +903,21 @@ int ieee80211_sta_set_bssid(struct ieee80211_sub_if_data *sdata, u8 *bssid);
 void ieee80211_sta_req_auth(struct ieee80211_sub_if_data *sdata,
                             struct ieee80211_if_sta *ifsta);
 struct sta_info *ieee80211_ibss_add_sta(struct ieee80211_sub_if_data *sdata,
-                                        u8 *bssid, u8 *addr, u64 supp_rates);
+                                        u8 *bssid, u8 *addr, u32 supp_rates);
 int ieee80211_sta_deauthenticate(struct ieee80211_sub_if_data *sdata, u16 reason);
 int ieee80211_sta_disassociate(struct ieee80211_sub_if_data *sdata, u16 reason);
 u32 ieee80211_reset_erp_info(struct ieee80211_sub_if_data *sdata);
-u64 ieee80211_sta_get_rates(struct ieee80211_local *local,
+u32 ieee80211_sta_get_rates(struct ieee80211_local *local,
                             struct ieee802_11_elems *elems,
                             enum ieee80211_band band);
 void ieee80211_send_probe_req(struct ieee80211_sub_if_data *sdata, u8 *dst,
                               u8 *ssid, size_t ssid_len);
+void ieee80211_send_pspoll(struct ieee80211_local *local,
+                           struct ieee80211_sub_if_data *sdata);
 
 /* scan/BSS handling */
 int ieee80211_request_scan(struct ieee80211_sub_if_data *sdata,
-                           u8 *ssid, size_t ssid_len);
+                           struct cfg80211_scan_request *req);
 int ieee80211_scan_results(struct ieee80211_local *local,
                            struct iw_request_info *info,
                            char *buf, size_t len);
@@ -895,29 +925,27 @@ ieee80211_rx_result
 ieee80211_scan_rx(struct ieee80211_sub_if_data *sdata,
                   struct sk_buff *skb,
                   struct ieee80211_rx_status *rx_status);
-void ieee80211_rx_bss_list_init(struct ieee80211_local *local);
-void ieee80211_rx_bss_list_deinit(struct ieee80211_local *local);
 int ieee80211_sta_set_extra_ie(struct ieee80211_sub_if_data *sdata,
                                char *ie, size_t len);
 
 void ieee80211_mlme_notify_scan_completed(struct ieee80211_local *local);
 int ieee80211_start_scan(struct ieee80211_sub_if_data *scan_sdata,
-                         u8 *ssid, size_t ssid_len);
+                         struct cfg80211_scan_request *req);
 struct ieee80211_bss *
 ieee80211_bss_info_update(struct ieee80211_local *local,
                           struct ieee80211_rx_status *rx_status,
                           struct ieee80211_mgmt *mgmt,
                           size_t len,
                           struct ieee802_11_elems *elems,
-                          int freq, bool beacon);
-struct ieee80211_bss *
-ieee80211_rx_bss_add(struct ieee80211_local *local, u8 *bssid, int freq,
-                     u8 *ssid, u8 ssid_len);
+                          struct ieee80211_channel *channel,
+                          bool beacon);
 struct ieee80211_bss *
 ieee80211_rx_bss_get(struct ieee80211_local *local, u8 *bssid, int freq,
                      u8 *ssid, u8 ssid_len);
 void ieee80211_rx_bss_put(struct ieee80211_local *local,
                           struct ieee80211_bss *bss);
+void ieee80211_rx_bss_remove(struct ieee80211_sub_if_data *sdata, u8 *bssid,
+                             int freq, u8 *ssid, u8 ssid_len);
 
 /* interface handling */
 int ieee80211_if_add(struct ieee80211_local *local, const char *name,
@@ -943,10 +971,15 @@ u32 ieee80211_enable_ht(struct ieee80211_sub_if_data *sdata,
                         struct ieee80211_ht_info *hti,
                         u16 ap_ht_cap_flags);
 void ieee80211_send_bar(struct ieee80211_sub_if_data *sdata, u8 *ra, u16 tid, u16 ssn);
+void ieee80211_send_delba(struct ieee80211_sub_if_data *sdata,
+                          const u8 *da, u16 tid,
+                          u16 initiator, u16 reason_code);
 
 void ieee80211_sta_stop_rx_ba_session(struct ieee80211_sub_if_data *sdata, u8 *da,
                                 u16 tid, u16 initiator, u16 reason);
-void ieee80211_sta_tear_down_BA_sessions(struct ieee80211_sub_if_data *sdata, u8 *addr);
+void __ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid,
+                                    u16 initiator, u16 reason);
+void ieee80211_sta_tear_down_BA_sessions(struct sta_info *sta);
 void ieee80211_process_delba(struct ieee80211_sub_if_data *sdata,
                              struct sta_info *sta,
                              struct ieee80211_mgmt *mgmt, size_t len);
@@ -959,10 +992,25 @@ void ieee80211_process_addba_request(struct ieee80211_local *local,
                                      struct ieee80211_mgmt *mgmt,
                                      size_t len);
 
+int __ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
+                                   enum ieee80211_back_parties initiator);
+
 /* Spectrum management */
 void ieee80211_process_measurement_req(struct ieee80211_sub_if_data *sdata,
                                        struct ieee80211_mgmt *mgmt,
                                        size_t len);
+void ieee80211_chswitch_timer(unsigned long data);
+void ieee80211_chswitch_work(struct work_struct *work);
+void ieee80211_process_chanswitch(struct ieee80211_sub_if_data *sdata,
+                                  struct ieee80211_channel_sw_ie *sw_elem,
+                                  struct ieee80211_bss *bss);
+void ieee80211_handle_pwr_constr(struct ieee80211_sub_if_data *sdata,
+                                 u16 capab_info, u8 *pwr_constr_elem,
+                                 u8 pwr_constr_elem_len);
+
+/* Suspend/resume */
+int __ieee80211_suspend(struct ieee80211_hw *hw);
+int __ieee80211_resume(struct ieee80211_hw *hw);
 
 /* utility functions/constants */
 extern void *mac80211_wiphy_privid; /* for wiphy privid */
@@ -980,12 +1028,15 @@ void ieee80211_tx_skb(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb,
 void ieee802_11_parse_elems(u8 *start, size_t len,
                             struct ieee802_11_elems *elems);
 int ieee80211_set_freq(struct ieee80211_sub_if_data *sdata, int freq);
-u64 ieee80211_mandatory_rates(struct ieee80211_local *local,
+u32 ieee80211_mandatory_rates(struct ieee80211_local *local,
                               enum ieee80211_band band);
 
 void ieee80211_dynamic_ps_enable_work(struct work_struct *work);
 void ieee80211_dynamic_ps_disable_work(struct work_struct *work);
 void ieee80211_dynamic_ps_timer(unsigned long data);
+void ieee80211_send_nullfunc(struct ieee80211_local *local,
+                             struct ieee80211_sub_if_data *sdata,
+                             int powersave);
 
 void ieee80211_wake_queues_by_reason(struct ieee80211_hw *hw,
                                      enum queue_stop_reason reason);
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index b9074824862a..df94b9365264 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -21,6 +21,23 @@
 #include "mesh.h"
 #include "led.h"
 
+/**
+ * DOC: Interface list locking
+ *
+ * The interface list in each struct ieee80211_local is protected
+ * three-fold:
+ *
+ * (1) modifications may only be done under the RTNL
+ * (2) modifications and readers are protected against each other by
+ *     the iflist_mtx.
+ * (3) modifications are done in an RCU manner so atomic readers
+ *     can traverse the list in RCU-safe blocks.
+ *
+ * As a consequence, reads (traversals) of the list can be protected
+ * by either the RTNL, the iflist_mtx or RCU.
+ */
+
+
 static int ieee80211_change_mtu(struct net_device *dev, int new_mtu)
 {
         int meshhdrlen;
@@ -345,8 +362,7 @@ static int ieee80211_stop(struct net_device *dev)
 
         list_for_each_entry_rcu(sta, &local->sta_list, list) {
                 if (sta->sdata == sdata)
-                        ieee80211_sta_tear_down_BA_sessions(sdata,
-                                                            sta->sta.addr);
+                        ieee80211_sta_tear_down_BA_sessions(sta);
         }
 
         rcu_read_unlock();
@@ -383,6 +399,8 @@ static int ieee80211_stop(struct net_device *dev)
                 atomic_dec(&local->iff_promiscs);
 
         dev_mc_unsync(local->mdev, dev);
+        del_timer_sync(&local->dynamic_ps_timer);
+        cancel_work_sync(&local->dynamic_ps_enable_work);
 
         /* APs need special treatment */
         if (sdata->vif.type == NL80211_IFTYPE_AP) {
@@ -441,6 +459,7 @@ static int ieee80211_stop(struct net_device *dev)
                                                 WLAN_REASON_DEAUTH_LEAVING);
 
                 memset(sdata->u.sta.bssid, 0, ETH_ALEN);
+                del_timer_sync(&sdata->u.sta.chswitch_timer);
                 del_timer_sync(&sdata->u.sta.timer);
                 /*
                  * If the timer fired while we waited for it, it will have
@@ -450,6 +469,7 @@ static int ieee80211_stop(struct net_device *dev)
                  * it no longer is.
                  */
                 cancel_work_sync(&sdata->u.sta.work);
+                cancel_work_sync(&sdata->u.sta.chswitch_work);
                 /*
                  * When we get here, the interface is marked down.
                  * Call synchronize_rcu() to wait for the RX path
@@ -459,7 +479,8 @@ static int ieee80211_stop(struct net_device *dev)
                 synchronize_rcu();
                 skb_queue_purge(&sdata->u.sta.skb_queue);
 
-                sdata->u.sta.flags &= ~IEEE80211_STA_PRIVACY_INVOKED;
+                sdata->u.sta.flags &= ~(IEEE80211_STA_PRIVACY_INVOKED |
+                                        IEEE80211_STA_TKIP_WEP_USED);
                 kfree(sdata->u.sta.extra_ie);
                 sdata->u.sta.extra_ie = NULL;
                 sdata->u.sta.extra_ie_len = 0;
@@ -501,7 +522,7 @@ static int ieee80211_stop(struct net_device *dev)
                          * scan event to userspace -- the scan is incomplete.
                          */
                         if (local->sw_scanning)
-                                ieee80211_scan_completed(&local->hw);
+                                ieee80211_scan_completed(&local->hw, true);
                 }
 
                 conf.vif = &sdata->vif;
@@ -569,19 +590,6 @@ static void ieee80211_set_multicast_list(struct net_device *dev)
         dev_mc_sync(local->mdev, dev);
 }
 
-static void ieee80211_if_setup(struct net_device *dev)
-{
-        ether_setup(dev);
-        dev->hard_start_xmit = ieee80211_subif_start_xmit;
-        dev->wireless_handlers = &ieee80211_iw_handler_def;
-        dev->set_multicast_list = ieee80211_set_multicast_list;
-        dev->change_mtu = ieee80211_change_mtu;
-        dev->open = ieee80211_open;
-        dev->stop = ieee80211_stop;
-        dev->destructor = free_netdev;
-        /* we will validate the address ourselves in ->open */
-        dev->validate_addr = NULL;
-}
 /*
  * Called when the netdev is removed or, by the code below, before
  * the interface type changes.
@@ -627,6 +635,13 @@ static void ieee80211_teardown_sdata(struct net_device *dev)
                 kfree(sdata->u.sta.assocreq_ies);
                 kfree(sdata->u.sta.assocresp_ies);
                 kfree_skb(sdata->u.sta.probe_resp);
+                kfree(sdata->u.sta.ie_probereq);
+                kfree(sdata->u.sta.ie_proberesp);
+                kfree(sdata->u.sta.ie_auth);
+                kfree(sdata->u.sta.ie_assocreq);
+                kfree(sdata->u.sta.ie_reassocreq);
+                kfree(sdata->u.sta.ie_deauth);
+                kfree(sdata->u.sta.ie_disassoc);
                 break;
         case NL80211_IFTYPE_WDS:
         case NL80211_IFTYPE_AP_VLAN:
@@ -642,6 +657,34 @@ static void ieee80211_teardown_sdata(struct net_device *dev)
         WARN_ON(flushed);
 }
 
+static const struct net_device_ops ieee80211_dataif_ops = {
+        .ndo_open               = ieee80211_open,
+        .ndo_stop               = ieee80211_stop,
+        .ndo_uninit             = ieee80211_teardown_sdata,
+        .ndo_start_xmit         = ieee80211_subif_start_xmit,
+        .ndo_set_multicast_list = ieee80211_set_multicast_list,
+        .ndo_change_mtu         = ieee80211_change_mtu,
+        .ndo_set_mac_address    = eth_mac_addr,
+};
+
+static const struct net_device_ops ieee80211_monitorif_ops = {
+        .ndo_open               = ieee80211_open,
+        .ndo_stop               = ieee80211_stop,
+        .ndo_uninit             = ieee80211_teardown_sdata,
+        .ndo_start_xmit         = ieee80211_monitor_start_xmit,
+        .ndo_set_multicast_list = ieee80211_set_multicast_list,
+        .ndo_change_mtu         = ieee80211_change_mtu,
+        .ndo_set_mac_address    = eth_mac_addr,
+};
+
+static void ieee80211_if_setup(struct net_device *dev)
+{
+        ether_setup(dev);
+        dev->netdev_ops = &ieee80211_dataif_ops;
+        dev->wireless_handlers = &ieee80211_iw_handler_def;
+        dev->destructor = free_netdev;
+}
+
 /*
  * Helper function to initialise an interface to a specific type.
  */
@@ -653,7 +696,7 @@ static void ieee80211_setup_sdata(struct ieee80211_sub_if_data *sdata,
 
         /* and set some type-dependent values */
         sdata->vif.type = type;
-        sdata->dev->hard_start_xmit = ieee80211_subif_start_xmit;
+        sdata->dev->netdev_ops = &ieee80211_dataif_ops;
         sdata->wdev.iftype = type;
 
         /* only monitor differs */
@@ -674,7 +717,7 @@ static void ieee80211_setup_sdata(struct ieee80211_sub_if_data *sdata,
                 break;
         case NL80211_IFTYPE_MONITOR:
                 sdata->dev->type = ARPHRD_IEEE80211_RADIOTAP;
-                sdata->dev->hard_start_xmit = ieee80211_monitor_start_xmit;
+                sdata->dev->netdev_ops = &ieee80211_monitorif_ops;
                 sdata->u.mntr_flags = MONITOR_FLAG_CONTROL |
                                       MONITOR_FLAG_OTHER_BSS;
                 break;
@@ -780,15 +823,15 @@ int ieee80211_if_add(struct ieee80211_local *local, const char *name,
         if (ret)
                 goto fail;
 
-        ndev->uninit = ieee80211_teardown_sdata;
-
         if (ieee80211_vif_is_mesh(&sdata->vif) &&
             params && params->mesh_id_len)
                 ieee80211_sdata_set_mesh_id(sdata,
                                             params->mesh_id_len,
                                             params->mesh_id);
 
+        mutex_lock(&local->iflist_mtx);
         list_add_tail_rcu(&sdata->list, &local->interfaces);
+        mutex_unlock(&local->iflist_mtx);
 
         if (new_dev)
                 *new_dev = ndev;
@@ -804,7 +847,10 @@ void ieee80211_if_remove(struct ieee80211_sub_if_data *sdata)
 {
         ASSERT_RTNL();
 
+        mutex_lock(&sdata->local->iflist_mtx);
         list_del_rcu(&sdata->list);
+        mutex_unlock(&sdata->local->iflist_mtx);
+
         synchronize_rcu();
         unregister_netdevice(sdata->dev);
 }
@@ -820,7 +866,16 @@ void ieee80211_remove_interfaces(struct ieee80211_local *local)
         ASSERT_RTNL();
 
         list_for_each_entry_safe(sdata, tmp, &local->interfaces, list) {
+                /*
+                 * we cannot hold the iflist_mtx across unregister_netdevice,
+                 * but we only need to hold it for list modifications to lock
+                 * out readers since we're under the RTNL here as all other
+                 * writers.
+                 */
+                mutex_lock(&local->iflist_mtx);
                 list_del(&sdata->list);
+                mutex_unlock(&local->iflist_mtx);
+
                 unregister_netdevice(sdata->dev);
         }
 }
diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index 999f7aa42326..19b480de4bbc 100644
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -18,6 +18,7 @@
 #include "ieee80211_i.h"
 #include "debugfs_key.h"
 #include "aes_ccm.h"
+#include "aes_cmac.h"
 
 
 /**
@@ -47,7 +48,6 @@
  */
 
 static const u8 bcast_addr[ETH_ALEN] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
-static const u8 zero_addr[ETH_ALEN];
 
 /* key mutex: used to synchronise todo runners */
 static DEFINE_MUTEX(key_mutex);
@@ -108,29 +108,18 @@ static void assert_key_lock(void)
         WARN_ON(!mutex_is_locked(&key_mutex));
 }
 
-static const u8 *get_mac_for_key(struct ieee80211_key *key)
+static struct ieee80211_sta *get_sta_for_key(struct ieee80211_key *key)
 {
-        const u8 *addr = bcast_addr;
-
-        /*
-         * If we're an AP we won't ever receive frames with a non-WEP
-         * group key so we tell the driver that by using the zero MAC
-         * address to indicate a transmit-only key.
-         */
-        if (key->conf.alg != ALG_WEP &&
-            (key->sdata->vif.type == NL80211_IFTYPE_AP ||
-             key->sdata->vif.type == NL80211_IFTYPE_AP_VLAN))
-                addr = zero_addr;
-
         if (key->sta)
-                addr = key->sta->sta.addr;
+                return &key->sta->sta;
 
-        return addr;
+        return NULL;
 }
 
 static void ieee80211_key_enable_hw_accel(struct ieee80211_key *key)
 {
-        const u8 *addr;
+        struct ieee80211_sub_if_data *sdata;
+        struct ieee80211_sta *sta;
         int ret;
 
         assert_key_lock();
@@ -139,11 +128,16 @@ static void ieee80211_key_enable_hw_accel(struct ieee80211_key *key)
         if (!key->local->ops->set_key)
                 return;
 
-        addr = get_mac_for_key(key);
+        sta = get_sta_for_key(key);
+
+        sdata = key->sdata;
+        if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
+                sdata = container_of(sdata->bss,
+                                     struct ieee80211_sub_if_data,
+                                     u.ap);
 
         ret = key->local->ops->set_key(local_to_hw(key->local), SET_KEY,
-                                       key->sdata->dev->dev_addr, addr,
-                                       &key->conf);
+                                       &sdata->vif, sta, &key->conf);
 
         if (!ret) {
                 spin_lock(&todo_lock);
@@ -155,12 +149,13 @@ static void ieee80211_key_enable_hw_accel(struct ieee80211_key *key)
                 printk(KERN_ERR "mac80211-%s: failed to set key "
                        "(%d, %pM) to hardware (%d)\n",
                        wiphy_name(key->local->hw.wiphy),
-                       key->conf.keyidx, addr, ret);
+                       key->conf.keyidx, sta ? sta->addr : bcast_addr, ret);
 }
 
 static void ieee80211_key_disable_hw_accel(struct ieee80211_key *key)
 {
-        const u8 *addr;
+        struct ieee80211_sub_if_data *sdata;
+        struct ieee80211_sta *sta;
         int ret;
 
         assert_key_lock();
@@ -176,17 +171,22 @@ static void ieee80211_key_disable_hw_accel(struct ieee80211_key *key)
         }
         spin_unlock(&todo_lock);
 
-        addr = get_mac_for_key(key);
+        sta = get_sta_for_key(key);
+        sdata = key->sdata;
+
+        if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
+                sdata = container_of(sdata->bss,
+                                     struct ieee80211_sub_if_data,
+                                     u.ap);
 
         ret = key->local->ops->set_key(local_to_hw(key->local), DISABLE_KEY,
-                                       key->sdata->dev->dev_addr, addr,
-                                       &key->conf);
+                                       &sdata->vif, sta, &key->conf);
 
         if (ret)
                 printk(KERN_ERR "mac80211-%s: failed to remove key "
                        "(%d, %pM) from hardware (%d)\n",
                        wiphy_name(key->local->hw.wiphy),
-                       key->conf.keyidx, addr, ret);
+                       key->conf.keyidx, sta ? sta->addr : bcast_addr, ret);
 
         spin_lock(&todo_lock);
         key->flags &= ~KEY_FLAG_UPLOADED_TO_HARDWARE;
@@ -216,13 +216,38 @@ void ieee80211_set_default_key(struct ieee80211_sub_if_data *sdata, int idx)
         spin_unlock_irqrestore(&sdata->local->key_lock, flags);
 }
 
+static void
+__ieee80211_set_default_mgmt_key(struct ieee80211_sub_if_data *sdata, int idx)
+{
+        struct ieee80211_key *key = NULL;
+
+        if (idx >= NUM_DEFAULT_KEYS &&
+            idx < NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS)
+                key = sdata->keys[idx];
+
+        rcu_assign_pointer(sdata->default_mgmt_key, key);
+
+        if (key)
+                add_todo(key, KEY_FLAG_TODO_DEFMGMTKEY);
+}
+
+void ieee80211_set_default_mgmt_key(struct ieee80211_sub_if_data *sdata,
+                                    int idx)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&sdata->local->key_lock, flags);
+        __ieee80211_set_default_mgmt_key(sdata, idx);
+        spin_unlock_irqrestore(&sdata->local->key_lock, flags);
+}
+
 
 static void __ieee80211_key_replace(struct ieee80211_sub_if_data *sdata,
                                     struct sta_info *sta,
                                     struct ieee80211_key *old,
                                     struct ieee80211_key *new)
 {
-        int idx, defkey;
+        int idx, defkey, defmgmtkey;
 
         if (new)
                 list_add(&new->list, &sdata->key_list);
@@ -238,13 +263,19 @@ static void __ieee80211_key_replace(struct ieee80211_sub_if_data *sdata,
                         idx = new->conf.keyidx;
 
                 defkey = old && sdata->default_key == old;
+                defmgmtkey = old && sdata->default_mgmt_key == old;
 
                 if (defkey && !new)
                         __ieee80211_set_default_key(sdata, -1);
+                if (defmgmtkey && !new)
+                        __ieee80211_set_default_mgmt_key(sdata, -1);
 
                 rcu_assign_pointer(sdata->keys[idx], new);
                 if (defkey && new)
                         __ieee80211_set_default_key(sdata, new->conf.keyidx);
+                if (defmgmtkey && new)
+                        __ieee80211_set_default_mgmt_key(sdata,
+                                                         new->conf.keyidx);
         }
 
         if (old) {
@@ -263,7 +294,7 @@ struct ieee80211_key *ieee80211_key_alloc(enum ieee80211_key_alg alg,
 {
         struct ieee80211_key *key;
 
-        BUG_ON(idx < 0 || idx >= NUM_DEFAULT_KEYS);
+        BUG_ON(idx < 0 || idx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS);
 
         key = kzalloc(sizeof(struct ieee80211_key) + key_len, GFP_KERNEL);
         if (!key)
@@ -292,6 +323,10 @@ struct ieee80211_key *ieee80211_key_alloc(enum ieee80211_key_alg alg,
                 key->conf.iv_len = CCMP_HDR_LEN;
                 key->conf.icv_len = CCMP_MIC_LEN;
                 break;
+        case ALG_AES_CMAC:
+                key->conf.iv_len = 0;
+                key->conf.icv_len = sizeof(struct ieee80211_mmie);
+                break;
         }
         memcpy(key->conf.key, key_data, key_len);
         INIT_LIST_HEAD(&key->list);
@@ -309,6 +344,19 @@ struct ieee80211_key *ieee80211_key_alloc(enum ieee80211_key_alg alg,
                 }
         }
 
+        if (alg == ALG_AES_CMAC) {
+                /*
+                 * Initialize AES key state here as an optimization so that
+                 * it does not need to be initialized for every packet.
+                 */
+                key->u.aes_cmac.tfm =
+                        ieee80211_aes_cmac_key_setup(key_data);
+                if (!key->u.aes_cmac.tfm) {
+                        kfree(key);
+                        return NULL;
+                }
+        }
+
         return key;
 }
 
@@ -462,6 +510,8 @@ static void __ieee80211_key_destroy(struct ieee80211_key *key)
 
         if (key->conf.alg == ALG_CCMP)
                 ieee80211_aes_key_free(key->u.ccmp.tfm);
+        if (key->conf.alg == ALG_AES_CMAC)
+                ieee80211_aes_cmac_key_free(key->u.aes_cmac.tfm);
         ieee80211_debugfs_key_remove(key);
 
         kfree(key);
@@ -484,6 +534,7 @@ static void __ieee80211_key_todo(void)
                 list_del_init(&key->todo);
                 todoflags = key->flags & (KEY_FLAG_TODO_ADD_DEBUGFS |
                                           KEY_FLAG_TODO_DEFKEY |
+                                          KEY_FLAG_TODO_DEFMGMTKEY |
                                           KEY_FLAG_TODO_HWACCEL_ADD |
                                           KEY_FLAG_TODO_HWACCEL_REMOVE |
                                           KEY_FLAG_TODO_DELETE);
@@ -501,6 +552,11 @@ static void __ieee80211_key_todo(void)
                         ieee80211_debugfs_key_add_default(key->sdata);
                         work_done = true;
                 }
+                if (todoflags & KEY_FLAG_TODO_DEFMGMTKEY) {
+                        ieee80211_debugfs_key_remove_mgmt_default(key->sdata);
+                        ieee80211_debugfs_key_add_mgmt_default(key->sdata);
+                        work_done = true;
+                }
                 if (todoflags & KEY_FLAG_TODO_HWACCEL_ADD) {
                         ieee80211_key_enable_hw_accel(key);
                         work_done = true;
@@ -536,6 +592,7 @@ void ieee80211_free_keys(struct ieee80211_sub_if_data *sdata)
         ieee80211_key_lock();
 
         ieee80211_debugfs_key_remove_default(sdata);
+        ieee80211_debugfs_key_remove_mgmt_default(sdata);
 
         spin_lock_irqsave(&sdata->local->key_lock, flags);
         list_for_each_entry_safe(key, tmp, &sdata->key_list, list)
diff --git a/net/mac80211/key.h b/net/mac80211/key.h
index 425816e0996c..215d3ef42a4f 100644
--- a/net/mac80211/key.h
+++ b/net/mac80211/key.h
@@ -46,6 +46,8 @@ struct sta_info;
  *      acceleration.
  * @KEY_FLAG_TODO_DEFKEY: Key is default key and debugfs needs to be updated.
  * @KEY_FLAG_TODO_ADD_DEBUGFS: Key needs to be added to debugfs.
+ * @KEY_FLAG_TODO_DEFMGMTKEY: Key is default management key and debugfs needs
+ *      to be updated.
  */
 enum ieee80211_internal_key_flags {
         KEY_FLAG_UPLOADED_TO_HARDWARE   = BIT(0),
@@ -54,6 +56,7 @@ enum ieee80211_internal_key_flags {
         KEY_FLAG_TODO_HWACCEL_REMOVE    = BIT(3),
         KEY_FLAG_TODO_DEFKEY            = BIT(4),
         KEY_FLAG_TODO_ADD_DEBUGFS       = BIT(5),
+        KEY_FLAG_TODO_DEFMGMTKEY        = BIT(6),
 };
 
 struct tkip_ctx {
@@ -96,6 +99,16 @@ struct ieee80211_key {
                         u8 tx_crypto_buf[6 * AES_BLOCK_LEN];
                         u8 rx_crypto_buf[6 * AES_BLOCK_LEN];
                 } ccmp;
+                struct {
+                        u8 tx_pn[6];
+                        u8 rx_pn[6];
+                        struct crypto_cipher *tfm;
+                        u32 replays; /* dot11RSNAStatsCMACReplays */
+                        u32 icverrors; /* dot11RSNAStatsCMACICVErrors */
+                        /* scratch buffers for virt_to_page() (crypto API) */
+                        u8 tx_crypto_buf[2 * AES_BLOCK_LEN];
+                        u8 rx_crypto_buf[2 * AES_BLOCK_LEN];
+                } aes_cmac;
         } u;
 
         /* number of times this key has been used */
@@ -114,6 +127,7 @@ struct ieee80211_key {
                 struct dentry *tx_spec;
                 struct dentry *rx_spec;
                 struct dentry *replays;
+                struct dentry *icverrors;
                 struct dentry *key;
                 struct dentry *ifindex;
                 int cnt;
@@ -140,6 +154,8 @@ void ieee80211_key_link(struct ieee80211_key *key,
                         struct sta_info *sta);
 void ieee80211_key_free(struct ieee80211_key *key);
 void ieee80211_set_default_key(struct ieee80211_sub_if_data *sdata, int idx);
+void ieee80211_set_default_mgmt_key(struct ieee80211_sub_if_data *sdata,
+                                    int idx);
 void ieee80211_free_keys(struct ieee80211_sub_if_data *sdata);
 void ieee80211_enable_keys(struct ieee80211_sub_if_data *sdata);
 void ieee80211_disable_keys(struct ieee80211_sub_if_data *sdata);
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 24b14363d6e7..5667f4e8067f 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -168,7 +168,6 @@ int ieee80211_if_config(struct ieee80211_sub_if_data *sdata, u32 changed)
                 return 0;
 
         memset(&conf, 0, sizeof(conf));
-        conf.changed = changed;
 
         if (sdata->vif.type == NL80211_IFTYPE_STATION ||
             sdata->vif.type == NL80211_IFTYPE_ADHOC)
@@ -176,16 +175,59 @@ int ieee80211_if_config(struct ieee80211_sub_if_data *sdata, u32 changed)
         else if (sdata->vif.type == NL80211_IFTYPE_AP)
                 conf.bssid = sdata->dev->dev_addr;
         else if (ieee80211_vif_is_mesh(&sdata->vif)) {
-                u8 zero[ETH_ALEN] = { 0 };
+                static const u8 zero[ETH_ALEN] = { 0 };
                 conf.bssid = zero;
         } else {
                 WARN_ON(1);
                 return -EINVAL;
         }
 
+        switch (sdata->vif.type) {
+        case NL80211_IFTYPE_AP:
+        case NL80211_IFTYPE_ADHOC:
+        case NL80211_IFTYPE_MESH_POINT:
+                break;
+        default:
+                /* do not warn to simplify caller in scan.c */
+                changed &= ~IEEE80211_IFCC_BEACON_ENABLED;
+                if (WARN_ON(changed & IEEE80211_IFCC_BEACON))
+                        return -EINVAL;
+                changed &= ~IEEE80211_IFCC_BEACON;
+                break;
+        }
+
+        if (changed & IEEE80211_IFCC_BEACON_ENABLED) {
+                if (local->sw_scanning) {
+                        conf.enable_beacon = false;
+                } else {
+                        /*
+                         * Beacon should be enabled, but AP mode must
+                         * check whether there is a beacon configured.
+                         */
+                        switch (sdata->vif.type) {
+                        case NL80211_IFTYPE_AP:
+                                conf.enable_beacon =
+                                        !!rcu_dereference(sdata->u.ap.beacon);
+                                break;
+                        case NL80211_IFTYPE_ADHOC:
+                                conf.enable_beacon = !!sdata->u.sta.probe_resp;
+                                break;
+                        case NL80211_IFTYPE_MESH_POINT:
+                                conf.enable_beacon = true;
+                                break;
+                        default:
+                                /* not reached */
+                                WARN_ON(1);
+                                break;
+                        }
+                }
+        }
+
         if (WARN_ON(!conf.bssid && (changed & IEEE80211_IFCC_BSSID)))
                 return -EINVAL;
 
+        conf.changed = changed;
+
         return local->ops->config_interface(local_to_hw(local),
                                             &sdata->vif, &conf);
 }
@@ -208,26 +250,22 @@ int ieee80211_hw_config(struct ieee80211_local *local, u32 changed)
         }
 
         if (chan != local->hw.conf.channel ||
-            channel_type != local->hw.conf.ht.channel_type) {
+            channel_type != local->hw.conf.channel_type) {
                 local->hw.conf.channel = chan;
-                local->hw.conf.ht.channel_type = channel_type;
-                switch (channel_type) {
-                case NL80211_CHAN_NO_HT:
-                        local->hw.conf.ht.enabled = false;
-                        break;
-                case NL80211_CHAN_HT20:
-                case NL80211_CHAN_HT40MINUS:
-                case NL80211_CHAN_HT40PLUS:
-                        local->hw.conf.ht.enabled = true;
-                        break;
-                }
+                local->hw.conf.channel_type = channel_type;
                 changed |= IEEE80211_CONF_CHANGE_CHANNEL;
         }
 
-        if (!local->hw.conf.power_level)
+        if (local->sw_scanning)
                 power = chan->max_power;
         else
-                power = min(chan->max_power, local->hw.conf.power_level);
+                power = local->power_constr_level ?
+                        (chan->max_power - local->power_constr_level) :
+                        chan->max_power;
+
+        if (local->user_power_level)
+                power = min(power, local->user_power_level);
+
         if (local->hw.conf.power_level != power) {
                 changed |= IEEE80211_CONF_CHANGE_POWER;
                 local->hw.conf.power_level = power;
@@ -695,6 +733,10 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
                 return NULL;
 
         wiphy->privid = mac80211_wiphy_privid;
+        wiphy->max_scan_ssids = 4;
+        /* Yes, putting cfg80211_bss into ieee80211_bss is a hack */
+        wiphy->bss_priv_size = sizeof(struct ieee80211_bss) -
+                               sizeof(struct cfg80211_bss);
 
         local = wiphy_priv(wiphy);
         local->hw.wiphy = wiphy;
@@ -722,6 +764,7 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
         local->hw.conf.radio_enabled = true;
 
         INIT_LIST_HEAD(&local->interfaces);
+        mutex_init(&local->iflist_mtx);
 
         spin_lock_init(&local->key_lock);
 
@@ -754,6 +797,23 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
 }
 EXPORT_SYMBOL(ieee80211_alloc_hw);
 
+static const struct net_device_ops ieee80211_master_ops = {
+        .ndo_start_xmit = ieee80211_master_start_xmit,
+        .ndo_open = ieee80211_master_open,
+        .ndo_stop = ieee80211_master_stop,
+        .ndo_set_multicast_list = ieee80211_master_set_multicast_list,
+        .ndo_select_queue = ieee80211_select_queue,
+};
+
+static void ieee80211_master_setup(struct net_device *mdev)
+{
+        mdev->type = ARPHRD_IEEE80211;
+        mdev->netdev_ops = &ieee80211_master_ops;
+        mdev->header_ops = &ieee80211_header_ops;
+        mdev->tx_queue_len = 1000;
+        mdev->addr_len = ETH_ALEN;
+}
+
 int ieee80211_register_hw(struct ieee80211_hw *hw)
 {
         struct ieee80211_local *local = hw_to_local(hw);
@@ -761,25 +821,33 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
         enum ieee80211_band band;
         struct net_device *mdev;
         struct ieee80211_master_priv *mpriv;
+        int channels, i, j;
 
         /*
          * generic code guarantees at least one band,
          * set this very early because much code assumes
          * that hw.conf.channel is assigned
          */
+        channels = 0;
         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
                 struct ieee80211_supported_band *sband;
 
                 sband = local->hw.wiphy->bands[band];
-                if (sband) {
+                if (sband && !local->oper_channel) {
                         /* init channel we're on */
                         local->hw.conf.channel =
                         local->oper_channel =
                         local->scan_channel = &sband->channels[0];
-                        break;
                 }
+                if (sband)
+                        channels += sband->n_channels;
         }
 
+        local->int_scan_req.n_channels = channels;
+        local->int_scan_req.channels = kzalloc(sizeof(void *) * channels, GFP_KERNEL);
+        if (!local->int_scan_req.channels)
+                return -ENOMEM;
+
         /* if low-level driver supports AP, we also support VLAN */
         if (local->hw.wiphy->interface_modes & BIT(NL80211_IFTYPE_AP))
                 local->hw.wiphy->interface_modes |= BIT(NL80211_IFTYPE_AP_VLAN);
@@ -789,7 +857,7 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
 
         result = wiphy_register(local->hw.wiphy);
         if (result < 0)
-                return result;
+                goto fail_wiphy_register;
 
         /*
          * We use the number of queues for feature tests (QoS, HT) internally
@@ -803,7 +871,7 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
                 hw->ampdu_queues = 0;
 
         mdev = alloc_netdev_mq(sizeof(struct ieee80211_master_priv),
-                               "wmaster%d", ether_setup,
+                               "wmaster%d", ieee80211_master_setup,
                                ieee80211_num_queues(hw));
         if (!mdev)
                 goto fail_mdev_alloc;
@@ -812,17 +880,8 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
         mpriv->local = local;
         local->mdev = mdev;
 
-        ieee80211_rx_bss_list_init(local);
-
-        mdev->hard_start_xmit = ieee80211_master_start_xmit;
-        mdev->open = ieee80211_master_open;
-        mdev->stop = ieee80211_master_stop;
-        mdev->type = ARPHRD_IEEE80211;
-        mdev->header_ops = &ieee80211_header_ops;
-        mdev->set_multicast_list = ieee80211_master_set_multicast_list;
-
         local->hw.workqueue =
-                create_freezeable_workqueue(wiphy_name(local->hw.wiphy));
+                create_singlethread_workqueue(wiphy_name(local->hw.wiphy));
         if (!local->hw.workqueue) {
                 result = -ENOMEM;
                 goto fail_workqueue;
@@ -846,15 +905,6 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
 
         local->hw.conf.listen_interval = local->hw.max_listen_interval;
 
-        local->wstats_flags |= local->hw.flags & (IEEE80211_HW_SIGNAL_UNSPEC |
-                                                  IEEE80211_HW_SIGNAL_DB |
-                                                  IEEE80211_HW_SIGNAL_DBM) ?
-                               IW_QUAL_QUAL_UPDATED : IW_QUAL_QUAL_INVALID;
-        local->wstats_flags |= local->hw.flags & IEEE80211_HW_NOISE_DBM ?
-                               IW_QUAL_NOISE_UPDATED : IW_QUAL_NOISE_INVALID;
-        if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
-                local->wstats_flags |= IW_QUAL_DBM;
-
         result = sta_info_start(local);
         if (result < 0)
                 goto fail_sta_info;
@@ -887,8 +937,6 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
                 goto fail_wep;
         }
 
-        local->mdev->select_queue = ieee80211_select_queue;
-
         /* add one default STA interface if supported */
         if (local->hw.wiphy->interface_modes & BIT(NL80211_IFTYPE_STATION)) {
                 result = ieee80211_if_add(local, "wlan%d", NULL,
@@ -902,6 +950,20 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
 
         ieee80211_led_init(local);
 
+        /* alloc internal scan request */
+        i = 0;
+        local->int_scan_req.ssids = &local->scan_ssid;
+        local->int_scan_req.n_ssids = 1;
+        for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
+                if (!hw->wiphy->bands[band])
+                        continue;
+                for (j = 0; j < hw->wiphy->bands[band]->n_channels; j++) {
+                        local->int_scan_req.channels[i] =
+                                &hw->wiphy->bands[band]->channels[j];
+                        i++;
+                }
+        }
+
         return 0;
 
 fail_wep:
@@ -920,6 +982,8 @@ fail_workqueue:
                 free_netdev(local->mdev);
 fail_mdev_alloc:
         wiphy_unregister(local->hw.wiphy);
+fail_wiphy_register:
+        kfree(local->int_scan_req.channels);
         return result;
 }
 EXPORT_SYMBOL(ieee80211_register_hw);
@@ -947,7 +1011,6 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw)
 
         rtnl_unlock();
 
-        ieee80211_rx_bss_list_deinit(local);
         ieee80211_clear_tx_pending(local);
         sta_info_stop(local);
         rate_control_deinitialize(local);
@@ -965,6 +1028,7 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw)
         ieee80211_wep_free(local);
         ieee80211_led_exit(local);
         free_netdev(local->mdev);
+        kfree(local->int_scan_req.channels);
 }
 EXPORT_SYMBOL(ieee80211_unregister_hw);
 
@@ -972,6 +1036,8 @@ void ieee80211_free_hw(struct ieee80211_hw *hw)
 {
         struct ieee80211_local *local = hw_to_local(hw);
 
+        mutex_destroy(&local->iflist_mtx);
+
         wiphy_free(local->hw.wiphy);
 }
 EXPORT_SYMBOL(ieee80211_free_hw);
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index 82f568e94365..9a3e5de0410a 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -275,16 +275,6 @@ u32 mesh_table_hash(u8 *addr, struct ieee80211_sub_if_data *sdata, struct mesh_t
                 & tbl->hash_mask;
 }
 
-u8 mesh_id_hash(u8 *mesh_id, int mesh_id_len)
-{
-        if (!mesh_id_len)
-                return 1;
-        else if (mesh_id_len == 1)
-                return (u8) mesh_id[0];
-        else
-                return (u8) (mesh_id[0] + 2 * mesh_id[1]);
-}
-
 struct mesh_table *mesh_table_alloc(int size_order)
 {
         int i;
@@ -442,7 +432,8 @@ void ieee80211_start_mesh(struct ieee80211_sub_if_data *sdata)
 
         ifmsh->housekeeping = true;
         queue_work(local->hw.workqueue, &ifmsh->work);
-        ieee80211_if_config(sdata, IEEE80211_IFCC_BEACON);
+        ieee80211_if_config(sdata, IEEE80211_IFCC_BEACON |
+                                   IEEE80211_IFCC_BEACON_ENABLED);
 }
 
 void ieee80211_stop_mesh(struct ieee80211_sub_if_data *sdata)
@@ -476,7 +467,7 @@ static void ieee80211_mesh_rx_bcn_presp(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_local *local = sdata->local;
         struct ieee802_11_elems elems;
         struct ieee80211_channel *channel;
-        u64 supp_rates = 0;
+        u32 supp_rates = 0;
         size_t baselen;
         int freq;
         enum ieee80211_band band = rx_status->band;
diff --git a/net/mac80211/mesh.h b/net/mac80211/mesh.h
index c197ab545e54..d891d7ddccd7 100644
--- a/net/mac80211/mesh.h
+++ b/net/mac80211/mesh.h
@@ -24,15 +24,15 @@
  *
  *
  *
- * @MESH_PATH_ACTIVE: the mesh path is can be used for forwarding
- * @MESH_PATH_RESOLVED: the discovery process is running for this mesh path
+ * @MESH_PATH_ACTIVE: the mesh path can be used for forwarding
+ * @MESH_PATH_RESOLVING: the discovery process is running for this mesh path
  * @MESH_PATH_DSN_VALID: the mesh path contains a valid destination sequence
  *      number
  * @MESH_PATH_FIXED: the mesh path has been manually set and should not be
  *      modified
  * @MESH_PATH_RESOLVED: the mesh path can has been resolved
  *
- * MESH_PATH_RESOLVED and MESH_PATH_DELETE are used by the mesh path timer to
+ * MESH_PATH_RESOLVED is used by the mesh path timer to
  * decide when to stop or cancel the mesh path discovery.
  */
 enum mesh_path_flags {
@@ -196,7 +196,6 @@ struct mesh_rmc {
 
 /* Public interfaces */
 /* Various */
-u8 mesh_id_hash(u8 *mesh_id, int mesh_id_len);
 int ieee80211_get_mesh_hdrlen(struct ieee80211s_hdr *meshhdr);
 int ieee80211_new_mesh_header(struct ieee80211s_hdr *meshhdr,
                 struct ieee80211_sub_if_data *sdata);
@@ -236,14 +235,13 @@ void mesh_rx_path_sel_frame(struct ieee80211_sub_if_data *sdata,
                 struct ieee80211_mgmt *mgmt, size_t len);
 int mesh_path_add(u8 *dst, struct ieee80211_sub_if_data *sdata);
 /* Mesh plinks */
-void mesh_neighbour_update(u8 *hw_addr, u64 rates,
+void mesh_neighbour_update(u8 *hw_addr, u32 rates,
                 struct ieee80211_sub_if_data *sdata, bool add);
 bool mesh_peer_accepts_plinks(struct ieee802_11_elems *ie);
 void mesh_accept_plinks_update(struct ieee80211_sub_if_data *sdata);
 void mesh_plink_broken(struct sta_info *sta);
 void mesh_plink_deactivate(struct sta_info *sta);
 int mesh_plink_open(struct sta_info *sta);
-int mesh_plink_close(struct sta_info *sta);
 void mesh_plink_block(struct sta_info *sta);
 void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata,
                          struct ieee80211_mgmt *mgmt, size_t len,
diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
index 71fe60961230..60b35accda91 100644
--- a/net/mac80211/mesh_hwmp.c
+++ b/net/mac80211/mesh_hwmp.c
@@ -58,7 +58,6 @@ static inline u32 u32_field_get(u8 *preq_elem, int offset, bool ae)
 #define PERR_IE_DST_ADDR(x)     (x + 2)
 #define PERR_IE_DST_DSN(x)      u32_field_get(x, 8, 0);
 
-#define TU_TO_EXP_TIME(x) (jiffies + msecs_to_jiffies(x * 1024 / 1000))
 #define MSEC_TO_TU(x) (x*1000/1024)
 #define DSN_GT(x, y) ((long) (y) - (long) (x) < 0)
 #define DSN_LT(x, y) ((long) (x) - (long) (y) < 0)
@@ -149,7 +148,7 @@ static int mesh_path_sel_frame_tx(enum mpath_frame_type action, u8 flags,
         pos += ETH_ALEN;
         memcpy(pos, &dst_dsn, 4);
 
-        ieee80211_tx_skb(sdata, skb, 0);
+        ieee80211_tx_skb(sdata, skb, 1);
         return 0;
 }
 
@@ -198,7 +197,7 @@ int mesh_path_error_tx(u8 *dst, __le32 dst_dsn, u8 *ra,
         pos += ETH_ALEN;
         memcpy(pos, &dst_dsn, 4);
 
-        ieee80211_tx_skb(sdata, skb, 0);
+        ieee80211_tx_skb(sdata, skb, 1);
         return 0;
 }
 
@@ -759,7 +758,7 @@ enddiscovery:
 }
 
 /**
- * ieee80211s_lookup_nexthop - put the appropriate next hop on a mesh frame
+ * mesh_nexthop_lookup - put the appropriate next hop on a mesh frame
  *
  * @skb: 802.11 frame to be sent
  * @sdata: network subif the frame will be sent through
diff --git a/net/mac80211/mesh_plink.c b/net/mac80211/mesh_plink.c
index 1159bdb4119c..a8bbdeca013a 100644
--- a/net/mac80211/mesh_plink.c
+++ b/net/mac80211/mesh_plink.c
@@ -93,7 +93,7 @@ static inline void mesh_plink_fsm_restart(struct sta_info *sta)
  *       on it in the lifecycle management section!
  */
 static struct sta_info *mesh_plink_alloc(struct ieee80211_sub_if_data *sdata,
-                                         u8 *hw_addr, u64 rates)
+                                         u8 *hw_addr, u32 rates)
 {
         struct ieee80211_local *local = sdata->local;
         struct sta_info *sta;
@@ -218,11 +218,11 @@ static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata,
                 memcpy(pos, &reason, 2);
         }
 
-        ieee80211_tx_skb(sdata, skb, 0);
+        ieee80211_tx_skb(sdata, skb, 1);
         return 0;
 }
 
-void mesh_neighbour_update(u8 *hw_addr, u64 rates, struct ieee80211_sub_if_data *sdata,
+void mesh_neighbour_update(u8 *hw_addr, u32 rates, struct ieee80211_sub_if_data *sdata,
                            bool peer_accepting_plinks)
 {
         struct ieee80211_local *local = sdata->local;
@@ -361,36 +361,6 @@ void mesh_plink_block(struct sta_info *sta)
         spin_unlock_bh(&sta->lock);
 }
 
-int mesh_plink_close(struct sta_info *sta)
-{
-        struct ieee80211_sub_if_data *sdata = sta->sdata;
-        __le16 llid, plid, reason;
-
-        mpl_dbg("Mesh plink: closing link with %pM\n", sta->sta.addr);
-        spin_lock_bh(&sta->lock);
-        sta->reason = cpu_to_le16(MESH_LINK_CANCELLED);
-        reason = sta->reason;
-
-        if (sta->plink_state == PLINK_LISTEN ||
-            sta->plink_state == PLINK_BLOCKED) {
-                mesh_plink_fsm_restart(sta);
-                spin_unlock_bh(&sta->lock);
-                return 0;
-        } else if (sta->plink_state == PLINK_ESTAB) {
-                __mesh_plink_deactivate(sta);
-                /* The timer should not be running */
-                mod_plink_timer(sta, dot11MeshHoldingTimeout(sdata));
-        } else if (!mod_plink_timer(sta, dot11MeshHoldingTimeout(sdata)))
-                sta->ignore_plink_timer = true;
-
-        sta->plink_state = PLINK_HOLDING;
-        llid = sta->llid;
-        plid = sta->plid;
-        spin_unlock_bh(&sta->lock);
-        mesh_plink_frame_tx(sta->sdata, PLINK_CLOSE, sta->sta.addr, llid,
-                            plid, reason);
-        return 0;
-}
 
 void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_mgmt *mgmt,
                          size_t len, struct ieee80211_rx_status *rx_status)
@@ -477,7 +447,7 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                 spin_lock_bh(&sta->lock);
         } else if (!sta) {
                 /* ftype == PLINK_OPEN */
-                u64 rates;
+                u32 rates;
                 if (!mesh_plink_free_count(sdata)) {
                         mpl_dbg("Mesh plink error: no more free plinks\n");
                         rcu_read_unlock();
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 2b890af01ba4..fbb766afe599 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -1,6 +1,6 @@
 /*
  * BSS client mode implementation
- * Copyright 2003, Jouni Malinen <jkmaline@cc.hut.fi>
+ * Copyright 2003-2008, Jouni Malinen <j@w1.fi>
  * Copyright 2004, Instant802 Networks, Inc.
  * Copyright 2005, Devicescape Software, Inc.
  * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
@@ -55,10 +55,10 @@ static u8 *ieee80211_bss_get_ie(struct ieee80211_bss *bss, u8 ie)
 {
         u8 *end, *pos;
 
-        pos = bss->ies;
+        pos = bss->cbss.information_elements;
         if (pos == NULL)
                 return NULL;
-        end = pos + bss->ies_len;
+        end = pos + bss->cbss.len_information_elements;
 
         while (pos + 1 < end) {
                 if (pos + 2 + pos[1] > end)
@@ -73,7 +73,7 @@ static u8 *ieee80211_bss_get_ie(struct ieee80211_bss *bss, u8 ie)
 
 static int ieee80211_compatible_rates(struct ieee80211_bss *bss,
                                       struct ieee80211_supported_band *sband,
-                                      u64 *rates)
+                                      u32 *rates)
 {
         int i, j, count;
         *rates = 0;
@@ -93,14 +93,14 @@ static int ieee80211_compatible_rates(struct ieee80211_bss *bss,
 }
 
 /* also used by mesh code */
-u64 ieee80211_sta_get_rates(struct ieee80211_local *local,
+u32 ieee80211_sta_get_rates(struct ieee80211_local *local,
                             struct ieee802_11_elems *elems,
                             enum ieee80211_band band)
 {
         struct ieee80211_supported_band *sband;
         struct ieee80211_rate *bitrates;
         size_t num_rates;
-        u64 supp_rates;
+        u32 supp_rates;
         int i, j;
         sband = local->hw.wiphy->bands[band];
 
@@ -131,6 +131,12 @@ u64 ieee80211_sta_get_rates(struct ieee80211_local *local,
 
 /* frame sending functions */
 
+static void add_extra_ies(struct sk_buff *skb, u8 *ies, size_t ies_len)
+{
+        if (ies)
+                memcpy(skb_put(skb, ies_len), ies, ies_len);
+}
+
 /* also used by scanning code */
 void ieee80211_send_probe_req(struct ieee80211_sub_if_data *sdata, u8 *dst,
                               u8 *ssid, size_t ssid_len)
@@ -142,7 +148,8 @@ void ieee80211_send_probe_req(struct ieee80211_sub_if_data *sdata, u8 *dst,
         u8 *pos, *supp_rates, *esupp_rates = NULL;
         int i;
 
-        skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*mgmt) + 200);
+        skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*mgmt) + 200 +
+                            sdata->u.sta.ie_probereq_len);
         if (!skb) {
                 printk(KERN_DEBUG "%s: failed to allocate buffer for probe "
                        "request\n", sdata->dev->name);
@@ -189,6 +196,9 @@ void ieee80211_send_probe_req(struct ieee80211_sub_if_data *sdata, u8 *dst,
                 *pos = rate->bitrate / 5;
         }
 
+        add_extra_ies(skb, sdata->u.sta.ie_probereq,
+                      sdata->u.sta.ie_probereq_len);
+
         ieee80211_tx_skb(sdata, skb, 0);
 }
 
@@ -202,7 +212,8 @@ static void ieee80211_send_auth(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_mgmt *mgmt;
 
         skb = dev_alloc_skb(local->hw.extra_tx_headroom +
-                            sizeof(*mgmt) + 6 + extra_len);
+                            sizeof(*mgmt) + 6 + extra_len +
+                            sdata->u.sta.ie_auth_len);
         if (!skb) {
                 printk(KERN_DEBUG "%s: failed to allocate buffer for auth "
                        "frame\n", sdata->dev->name);
@@ -225,6 +236,7 @@ static void ieee80211_send_auth(struct ieee80211_sub_if_data *sdata,
         mgmt->u.auth.status_code = cpu_to_le16(0);
         if (extra)
                 memcpy(skb_put(skb, extra_len), extra, extra_len);
+        add_extra_ies(skb, sdata->u.sta.ie_auth, sdata->u.sta.ie_auth_len);
 
         ieee80211_tx_skb(sdata, skb, encrypt);
 }
@@ -235,17 +247,26 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_local *local = sdata->local;
         struct sk_buff *skb;
         struct ieee80211_mgmt *mgmt;
-        u8 *pos, *ies, *ht_ie;
+        u8 *pos, *ies, *ht_ie, *e_ies;
         int i, len, count, rates_len, supp_rates_len;
         u16 capab;
         struct ieee80211_bss *bss;
         int wmm = 0;
         struct ieee80211_supported_band *sband;
-        u64 rates = 0;
+        u32 rates = 0;
+        size_t e_ies_len;
+
+        if (ifsta->flags & IEEE80211_STA_PREV_BSSID_SET) {
+                e_ies = sdata->u.sta.ie_reassocreq;
+                e_ies_len = sdata->u.sta.ie_reassocreq_len;
+        } else {
+                e_ies = sdata->u.sta.ie_assocreq;
+                e_ies_len = sdata->u.sta.ie_assocreq_len;
+        }
 
         skb = dev_alloc_skb(local->hw.extra_tx_headroom +
                             sizeof(*mgmt) + 200 + ifsta->extra_ie_len +
-                            ifsta->ssid_len);
+                            ifsta->ssid_len + e_ies_len);
         if (!skb) {
                 printk(KERN_DEBUG "%s: failed to allocate buffer for assoc "
                        "frame\n", sdata->dev->name);
@@ -268,7 +289,7 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata,
                                    local->hw.conf.channel->center_freq,
                                    ifsta->ssid, ifsta->ssid_len);
         if (bss) {
-                if (bss->capability & WLAN_CAPABILITY_PRIVACY)
+                if (bss->cbss.capability & WLAN_CAPABILITY_PRIVACY)
                         capab |= WLAN_CAPABILITY_PRIVACY;
                 if (bss->wmm_used)
                         wmm = 1;
@@ -279,7 +300,7 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata,
                  * b-only mode) */
                 rates_len = ieee80211_compatible_rates(bss, sband, &rates);
 
-                if ((bss->capability & WLAN_CAPABILITY_SPECTRUM_MGMT) &&
+                if ((bss->cbss.capability & WLAN_CAPABILITY_SPECTRUM_MGMT) &&
                     (local->hw.flags & IEEE80211_HW_SPECTRUM_MGMT))
                         capab |= WLAN_CAPABILITY_SPECTRUM_MGMT;
 
@@ -391,10 +412,17 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata,
         }
 
         /* wmm support is a must to HT */
+        /*
+         * IEEE802.11n does not allow TKIP/WEP as pairwise
+         * ciphers in HT mode. We still associate in non-ht
+         * mode (11a/b/g) if any one of these ciphers is
+         * configured as pairwise.
+         */
         if (wmm && (ifsta->flags & IEEE80211_STA_WMM_ENABLED) &&
             sband->ht_cap.ht_supported &&
             (ht_ie = ieee80211_bss_get_ie(bss, WLAN_EID_HT_INFORMATION)) &&
-            ht_ie[1] >= sizeof(struct ieee80211_ht_info)) {
+            ht_ie[1] >= sizeof(struct ieee80211_ht_info) &&
+            (!(ifsta->flags & IEEE80211_STA_TKIP_WEP_USED))) {
                 struct ieee80211_ht_info *ht_info =
                         (struct ieee80211_ht_info *)(ht_ie + 2);
                 u16 cap = sband->ht_cap.cap;
@@ -429,6 +457,8 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata,
                 memcpy(pos, &sband->ht_cap.mcs, sizeof(sband->ht_cap.mcs));
         }
 
+        add_extra_ies(skb, e_ies, e_ies_len);
+
         kfree(ifsta->assocreq_ies);
         ifsta->assocreq_ies_len = (skb->data + skb->len) - ies;
         ifsta->assocreq_ies = kmalloc(ifsta->assocreq_ies_len, GFP_KERNEL);
@@ -446,8 +476,19 @@ static void ieee80211_send_deauth_disassoc(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
         struct sk_buff *skb;
         struct ieee80211_mgmt *mgmt;
+        u8 *ies;
+        size_t ies_len;
+
+        if (stype == IEEE80211_STYPE_DEAUTH) {
+                ies = sdata->u.sta.ie_deauth;
+                ies_len = sdata->u.sta.ie_deauth_len;
+        } else {
+                ies = sdata->u.sta.ie_disassoc;
+                ies_len = sdata->u.sta.ie_disassoc_len;
+        }
 
-        skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*mgmt));
+        skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*mgmt) +
+                            ies_len);
         if (!skb) {
                 printk(KERN_DEBUG "%s: failed to allocate buffer for "
                        "deauth/disassoc frame\n", sdata->dev->name);
@@ -465,19 +506,55 @@ static void ieee80211_send_deauth_disassoc(struct ieee80211_sub_if_data *sdata,
         /* u.deauth.reason_code == u.disassoc.reason_code */
         mgmt->u.deauth.reason_code = cpu_to_le16(reason);
 
+        add_extra_ies(skb, ies, ies_len);
+
+        ieee80211_tx_skb(sdata, skb, ifsta->flags & IEEE80211_STA_MFP_ENABLED);
+}
+
+void ieee80211_send_pspoll(struct ieee80211_local *local,
+                           struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_if_sta *ifsta = &sdata->u.sta;
+        struct ieee80211_pspoll *pspoll;
+        struct sk_buff *skb;
+        u16 fc;
+
+        skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*pspoll));
+        if (!skb) {
+                printk(KERN_DEBUG "%s: failed to allocate buffer for "
+                       "pspoll frame\n", sdata->dev->name);
+                return;
+        }
+        skb_reserve(skb, local->hw.extra_tx_headroom);
+
+        pspoll = (struct ieee80211_pspoll *) skb_put(skb, sizeof(*pspoll));
+        memset(pspoll, 0, sizeof(*pspoll));
+        fc = IEEE80211_FTYPE_CTL | IEEE80211_STYPE_PSPOLL | IEEE80211_FCTL_PM;
+        pspoll->frame_control = cpu_to_le16(fc);
+        pspoll->aid = cpu_to_le16(ifsta->aid);
+
+        /* aid in PS-Poll has its two MSBs each set to 1 */
+        pspoll->aid |= cpu_to_le16(1 << 15 | 1 << 14);
+
+        memcpy(pspoll->bssid, ifsta->bssid, ETH_ALEN);
+        memcpy(pspoll->ta, sdata->dev->dev_addr, ETH_ALEN);
+
         ieee80211_tx_skb(sdata, skb, 0);
+
+        return;
 }
 
 /* MLME */
 static void ieee80211_sta_def_wmm_params(struct ieee80211_sub_if_data *sdata,
-                                         struct ieee80211_bss *bss)
+                                         const size_t supp_rates_len,
+                                         const u8 *supp_rates)
 {
         struct ieee80211_local *local = sdata->local;
         int i, have_higher_than_11mbit = 0;
 
         /* cf. IEEE 802.11 9.2.12 */
-        for (i = 0; i < bss->supp_rates_len; i++)
-                if ((bss->supp_rates[i] & 0x7f) * 5 > 110)
+        for (i = 0; i < supp_rates_len; i++)
+                if ((supp_rates[i] & 0x7f) * 5 > 110)
                         have_higher_than_11mbit = 1;
 
         if (local->hw.conf.channel->band == IEEE80211_BAND_2GHZ &&
@@ -568,6 +645,27 @@ static void ieee80211_sta_wmm_params(struct ieee80211_local *local,
         }
 }
 
+static bool ieee80211_check_tim(struct ieee802_11_elems *elems, u16 aid)
+{
+        u8 mask;
+        u8 index, indexn1, indexn2;
+        struct ieee80211_tim_ie *tim = (struct ieee80211_tim_ie *) elems->tim;
+
+        aid &= 0x3fff;
+        index = aid / 8;
+        mask  = 1 << (aid & 7);
+
+        indexn1 = tim->bitmap_ctrl & 0xfe;
+        indexn2 = elems->tim_len + indexn1 - 4;
+
+        if (index < indexn1 || index > indexn2)
+                return false;
+
+        index -= indexn1;
+
+        return !!(tim->virtual_map[index] & mask);
+}
+
 static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,
                                            u16 capab, bool erp_valid, u8 erp)
 {
@@ -710,20 +808,17 @@ static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
         bss_info_changed |= BSS_CHANGED_ASSOC;
         ifsta->flags |= IEEE80211_STA_ASSOCIATED;
 
-        if (sdata->vif.type != NL80211_IFTYPE_STATION)
-                return;
-
         bss = ieee80211_rx_bss_get(local, ifsta->bssid,
                                    conf->channel->center_freq,
                                    ifsta->ssid, ifsta->ssid_len);
         if (bss) {
                 /* set timing information */
-                sdata->vif.bss_conf.beacon_int = bss->beacon_int;
-                sdata->vif.bss_conf.timestamp = bss->timestamp;
+                sdata->vif.bss_conf.beacon_int = bss->cbss.beacon_interval;
+                sdata->vif.bss_conf.timestamp = bss->cbss.tsf;
                 sdata->vif.bss_conf.dtim_period = bss->dtim_period;
 
                 bss_info_changed |= ieee80211_handle_bss_capability(sdata,
-                        bss->capability, bss->has_erp_value, bss->erp_value);
+                        bss->cbss.capability, bss->has_erp_value, bss->erp_value);
 
                 ieee80211_rx_bss_put(local, bss);
         }
@@ -745,13 +840,16 @@ static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
         ieee80211_bss_info_change_notify(sdata, bss_info_changed);
 
         if (local->powersave) {
-                if (local->dynamic_ps_timeout > 0)
+                if (!(local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_PS) &&
+                    local->hw.conf.dynamic_ps_timeout > 0) {
                         mod_timer(&local->dynamic_ps_timer, jiffies +
-                                  msecs_to_jiffies(local->dynamic_ps_timeout));
-                else {
+                                  msecs_to_jiffies(
+                                        local->hw.conf.dynamic_ps_timeout));
+                } else {
+                        if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK)
+                                ieee80211_send_nullfunc(local, sdata, 1);
                         conf->flags |= IEEE80211_CONF_PS;
-                        ieee80211_hw_config(local,
-                                            IEEE80211_CONF_CHANGE_PS);
+                        ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
                 }
         }
 
@@ -770,6 +868,14 @@ static void ieee80211_direct_probe(struct ieee80211_sub_if_data *sdata,
                        sdata->dev->name, ifsta->bssid);
                 ifsta->state = IEEE80211_STA_MLME_DISABLED;
                 ieee80211_sta_send_apinfo(sdata, ifsta);
+
+                /*
+                 * Most likely AP is not in the range so remove the
+                 * bss information associated to the AP
+                 */
+                ieee80211_rx_bss_remove(sdata, ifsta->bssid,
+                                sdata->local->hw.conf.channel->center_freq,
+                                ifsta->ssid, ifsta->ssid_len);
                 return;
         }
 
@@ -801,6 +907,9 @@ static void ieee80211_authenticate(struct ieee80211_sub_if_data *sdata,
                        sdata->dev->name, ifsta->bssid);
                 ifsta->state = IEEE80211_STA_MLME_DISABLED;
                 ieee80211_sta_send_apinfo(sdata, ifsta);
+                ieee80211_rx_bss_remove(sdata, ifsta->bssid,
+                                sdata->local->hw.conf.channel->center_freq,
+                                ifsta->ssid, ifsta->ssid_len);
                 return;
         }
 
@@ -843,7 +952,7 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
         netif_tx_stop_all_queues(sdata->dev);
         netif_carrier_off(sdata->dev);
 
-        ieee80211_sta_tear_down_BA_sessions(sdata, sta->sta.addr);
+        ieee80211_sta_tear_down_BA_sessions(sta);
 
         if (self_disconnected) {
                 if (deauth)
@@ -863,14 +972,19 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
 
         ieee80211_sta_send_apinfo(sdata, ifsta);
 
-        if (self_disconnected || reason == WLAN_REASON_DISASSOC_STA_HAS_LEFT)
+        if (self_disconnected || reason == WLAN_REASON_DISASSOC_STA_HAS_LEFT) {
                 ifsta->state = IEEE80211_STA_MLME_DISABLED;
+                ieee80211_rx_bss_remove(sdata, ifsta->bssid,
+                                sdata->local->hw.conf.channel->center_freq,
+                                ifsta->ssid, ifsta->ssid_len);
+        }
 
         rcu_read_unlock();
 
-        local->hw.conf.ht.enabled = false;
+        /* channel(_type) changes are handled by ieee80211_hw_config */
         local->oper_channel_type = NL80211_CHAN_NO_HT;
-        config_changed |= IEEE80211_CONF_CHANGE_HT;
+
+        local->power_constr_level = 0;
 
         del_timer_sync(&local->dynamic_ps_timer);
         cancel_work_sync(&local->dynamic_ps_enable_work);
@@ -924,7 +1038,7 @@ static int ieee80211_privacy_mismatch(struct ieee80211_sub_if_data *sdata,
         if (!bss)
                 return 0;
 
-        bss_privacy = !!(bss->capability & WLAN_CAPABILITY_PRIVACY);
+        bss_privacy = !!(bss->cbss.capability & WLAN_CAPABILITY_PRIVACY);
         wep_privacy = !!ieee80211_sta_wep_configured(sdata);
         privacy_invoked = !!(ifsta->flags & IEEE80211_STA_PRIVACY_INVOKED);
 
@@ -946,6 +1060,9 @@ static void ieee80211_associate(struct ieee80211_sub_if_data *sdata,
                        sdata->dev->name, ifsta->bssid);
                 ifsta->state = IEEE80211_STA_MLME_DISABLED;
                 ieee80211_sta_send_apinfo(sdata, ifsta);
+                ieee80211_rx_bss_remove(sdata, ifsta->bssid,
+                                sdata->local->hw.conf.channel->center_freq,
+                                ifsta->ssid, ifsta->ssid_len);
                 return;
         }
 
@@ -1049,6 +1166,30 @@ static void ieee80211_auth_challenge(struct ieee80211_sub_if_data *sdata,
                             elems.challenge_len + 2, 1);
 }
 
+static void ieee80211_rx_mgmt_auth_ibss(struct ieee80211_sub_if_data *sdata,
+                                        struct ieee80211_if_sta *ifsta,
+                                        struct ieee80211_mgmt *mgmt,
+                                        size_t len)
+{
+        u16 auth_alg, auth_transaction, status_code;
+
+        if (len < 24 + 6)
+                return;
+
+        auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg);
+        auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction);
+        status_code = le16_to_cpu(mgmt->u.auth.status_code);
+
+        /*
+         * IEEE 802.11 standard does not require authentication in IBSS
+         * networks and most implementations do not seem to use it.
+         * However, try to reply to authentication attempts if someone
+         * has actually implemented this.
+         */
+        if (auth_alg == WLAN_AUTH_OPEN && auth_transaction == 1)
+                ieee80211_send_auth(sdata, ifsta, 2, NULL, 0, 0);
+}
+
 static void ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
                                    struct ieee80211_if_sta *ifsta,
                                    struct ieee80211_mgmt *mgmt,
@@ -1056,37 +1197,22 @@ static void ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
 {
         u16 auth_alg, auth_transaction, status_code;
 
-        if (ifsta->state != IEEE80211_STA_MLME_AUTHENTICATE &&
-            sdata->vif.type != NL80211_IFTYPE_ADHOC)
+        if (ifsta->state != IEEE80211_STA_MLME_AUTHENTICATE)
                 return;
 
         if (len < 24 + 6)
                 return;
 
-        if (sdata->vif.type != NL80211_IFTYPE_ADHOC &&
-            memcmp(ifsta->bssid, mgmt->sa, ETH_ALEN) != 0)
+        if (memcmp(ifsta->bssid, mgmt->sa, ETH_ALEN) != 0)
                 return;
 
-        if (sdata->vif.type != NL80211_IFTYPE_ADHOC &&
-            memcmp(ifsta->bssid, mgmt->bssid, ETH_ALEN) != 0)
+        if (memcmp(ifsta->bssid, mgmt->bssid, ETH_ALEN) != 0)
                 return;
 
         auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg);
         auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction);
         status_code = le16_to_cpu(mgmt->u.auth.status_code);
 
-        if (sdata->vif.type == NL80211_IFTYPE_ADHOC) {
-                /*
-                 * IEEE 802.11 standard does not require authentication in IBSS
-                 * networks and most implementations do not seem to use it.
-                 * However, try to reply to authentication attempts if someone
-                 * has actually implemented this.
-                 */
-                if (auth_alg != WLAN_AUTH_OPEN || auth_transaction != 1)
-                        return;
-                ieee80211_send_auth(sdata, ifsta, 2, NULL, 0, 0);
-        }
-
         if (auth_alg != ifsta->auth_alg ||
             auth_transaction != ifsta->auth_transaction)
                 return;
@@ -1211,7 +1337,7 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_supported_band *sband;
         struct sta_info *sta;
-        u64 rates, basic_rates;
+        u32 rates, basic_rates;
         u16 capab_info, status_code, aid;
         struct ieee802_11_elems elems;
         struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
@@ -1242,6 +1368,24 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
                sdata->dev->name, reassoc ? "Rea" : "A", mgmt->sa,
                capab_info, status_code, (u16)(aid & ~(BIT(15) | BIT(14))));
 
+        pos = mgmt->u.assoc_resp.variable;
+        ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems);
+
+        if (status_code == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY &&
+            elems.timeout_int && elems.timeout_int_len == 5 &&
+            elems.timeout_int[0] == WLAN_TIMEOUT_ASSOC_COMEBACK) {
+                u32 tu, ms;
+                tu = get_unaligned_le32(elems.timeout_int + 1);
+                ms = tu * 1024 / 1000;
+                printk(KERN_DEBUG "%s: AP rejected association temporarily; "
+                       "comeback duration %u TU (%u ms)\n",
+                       sdata->dev->name, tu, ms);
+                if (ms > IEEE80211_ASSOC_TIMEOUT)
+                        mod_timer(&ifsta->timer,
+                                  jiffies + msecs_to_jiffies(ms));
+                return;
+        }
+
         if (status_code != WLAN_STATUS_SUCCESS) {
                 printk(KERN_DEBUG "%s: AP denied association (code=%d)\n",
                        sdata->dev->name, status_code);
@@ -1257,9 +1401,6 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
                        "set\n", sdata->dev->name, aid);
         aid &= ~(BIT(15) | BIT(14));
 
-        pos = mgmt->u.assoc_resp.variable;
-        ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems);
-
         if (!elems.supp_rates) {
                 printk(KERN_DEBUG "%s: no SuppRates element in AssocResp\n",
                        sdata->dev->name);
@@ -1281,8 +1422,6 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
         /* Add STA entry for the AP */
         sta = sta_info_get(local, ifsta->bssid);
         if (!sta) {
-                struct ieee80211_bss *bss;
-
                 newsta = true;
 
                 sta = sta_info_alloc(sdata, ifsta->bssid, GFP_ATOMIC);
@@ -1292,15 +1431,6 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
                         rcu_read_unlock();
                         return;
                 }
-                bss = ieee80211_rx_bss_get(local, ifsta->bssid,
-                                           local->hw.conf.channel->center_freq,
-                                           ifsta->ssid, ifsta->ssid_len);
-                if (bss) {
-                        sta->last_signal = bss->signal;
-                        sta->last_qual = bss->qual;
-                        sta->last_noise = bss->noise;
-                        ieee80211_rx_bss_put(local, bss);
-                }
 
                 /* update new sta with its last rx activity */
                 sta->last_rx = jiffies;
@@ -1375,6 +1505,9 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
 
         rate_control_rate_init(sta);
 
+        if (ifsta->flags & IEEE80211_STA_MFP_ENABLED)
+                set_sta_flags(sta, WLAN_STA_MFP);
+
         if (elems.wmm_param)
                 set_sta_flags(sta, WLAN_STA_WME);
 
@@ -1409,49 +1542,61 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
 }
 
 
-static int ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
-                                   struct ieee80211_if_sta *ifsta,
-                                   struct ieee80211_bss *bss)
+static int __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
+                                     struct ieee80211_if_sta *ifsta,
+                                     const u8 *bssid, const int beacon_int,
+                                     const int freq,
+                                     const size_t supp_rates_len,
+                                     const u8 *supp_rates,
+                                     const u16 capability)
 {
         struct ieee80211_local *local = sdata->local;
-        int res, rates, i, j;
+        int res = 0, rates, i, j;
         struct sk_buff *skb;
         struct ieee80211_mgmt *mgmt;
         u8 *pos;
         struct ieee80211_supported_band *sband;
         union iwreq_data wrqu;
 
-        skb = dev_alloc_skb(local->hw.extra_tx_headroom + 400);
+        if (local->ops->reset_tsf) {
+                /* Reset own TSF to allow time synchronization work. */
+                local->ops->reset_tsf(local_to_hw(local));
+        }
+
+        if ((ifsta->flags & IEEE80211_STA_PREV_BSSID_SET) &&
+           memcmp(ifsta->bssid, bssid, ETH_ALEN) == 0)
+                return res;
+
+        skb = dev_alloc_skb(local->hw.extra_tx_headroom + 400 +
+                            sdata->u.sta.ie_proberesp_len);
         if (!skb) {
                 printk(KERN_DEBUG "%s: failed to allocate buffer for probe "
                        "response\n", sdata->dev->name);
                 return -ENOMEM;
         }
 
-        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
-
-        /* Remove possible STA entries from other IBSS networks. */
-        sta_info_flush_delayed(sdata);
-
-        if (local->ops->reset_tsf) {
-                /* Reset own TSF to allow time synchronization work. */
-                local->ops->reset_tsf(local_to_hw(local));
+        if (!(ifsta->flags & IEEE80211_STA_PREV_BSSID_SET)) {
+                /* Remove possible STA entries from other IBSS networks. */
+                sta_info_flush_delayed(sdata);
         }
-        memcpy(ifsta->bssid, bss->bssid, ETH_ALEN);
+
+        memcpy(ifsta->bssid, bssid, ETH_ALEN);
         res = ieee80211_if_config(sdata, IEEE80211_IFCC_BSSID);
         if (res)
                 return res;
 
-        local->hw.conf.beacon_int = bss->beacon_int >= 10 ? bss->beacon_int : 10;
+        local->hw.conf.beacon_int = beacon_int >= 10 ? beacon_int : 10;
 
-        sdata->drop_unencrypted = bss->capability &
+        sdata->drop_unencrypted = capability &
                 WLAN_CAPABILITY_PRIVACY ? 1 : 0;
 
-        res = ieee80211_set_freq(sdata, bss->freq);
+        res = ieee80211_set_freq(sdata, freq);
 
         if (res)
                 return res;
 
+        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
+
         /* Build IBSS probe response */
 
         skb_reserve(skb, local->hw.extra_tx_headroom);
@@ -1460,33 +1605,32 @@ static int ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
                 skb_put(skb, 24 + sizeof(mgmt->u.beacon));
         memset(mgmt, 0, 24 + sizeof(mgmt->u.beacon));
         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
-                                                IEEE80211_STYPE_PROBE_RESP);
+                                          IEEE80211_STYPE_PROBE_RESP);
         memset(mgmt->da, 0xff, ETH_ALEN);
         memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
         memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
         mgmt->u.beacon.beacon_int =
                 cpu_to_le16(local->hw.conf.beacon_int);
-        mgmt->u.beacon.timestamp = cpu_to_le64(bss->timestamp);
-        mgmt->u.beacon.capab_info = cpu_to_le16(bss->capability);
+        mgmt->u.beacon.capab_info = cpu_to_le16(capability);
 
         pos = skb_put(skb, 2 + ifsta->ssid_len);
         *pos++ = WLAN_EID_SSID;
         *pos++ = ifsta->ssid_len;
         memcpy(pos, ifsta->ssid, ifsta->ssid_len);
 
-        rates = bss->supp_rates_len;
+        rates = supp_rates_len;
         if (rates > 8)
                 rates = 8;
         pos = skb_put(skb, 2 + rates);
         *pos++ = WLAN_EID_SUPP_RATES;
         *pos++ = rates;
-        memcpy(pos, bss->supp_rates, rates);
+        memcpy(pos, supp_rates, rates);
 
-        if (bss->band == IEEE80211_BAND_2GHZ) {
+        if (sband->band == IEEE80211_BAND_2GHZ) {
                 pos = skb_put(skb, 2 + 1);
                 *pos++ = WLAN_EID_DS_PARAMS;
                 *pos++ = 1;
-                *pos++ = ieee80211_frequency_to_channel(bss->freq);
+                *pos++ = ieee80211_frequency_to_channel(freq);
         }
 
         pos = skb_put(skb, 2 + 2);
@@ -1496,43 +1640,59 @@ static int ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
         *pos++ = 0;
         *pos++ = 0;
 
-        if (bss->supp_rates_len > 8) {
-                rates = bss->supp_rates_len - 8;
+        if (supp_rates_len > 8) {
+                rates = supp_rates_len - 8;
                 pos = skb_put(skb, 2 + rates);
                 *pos++ = WLAN_EID_EXT_SUPP_RATES;
                 *pos++ = rates;
-                memcpy(pos, &bss->supp_rates[8], rates);
+                memcpy(pos, &supp_rates[8], rates);
         }
 
+        add_extra_ies(skb, sdata->u.sta.ie_proberesp,
+                      sdata->u.sta.ie_proberesp_len);
+
         ifsta->probe_resp = skb;
 
-        ieee80211_if_config(sdata, IEEE80211_IFCC_BEACON);
+        ieee80211_if_config(sdata, IEEE80211_IFCC_BEACON |
+                                   IEEE80211_IFCC_BEACON_ENABLED);
 
 
         rates = 0;
-        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
-        for (i = 0; i < bss->supp_rates_len; i++) {
-                int bitrate = (bss->supp_rates[i] & 0x7f) * 5;
+        for (i = 0; i < supp_rates_len; i++) {
+                int bitrate = (supp_rates[i] & 0x7f) * 5;
                 for (j = 0; j < sband->n_bitrates; j++)
                         if (sband->bitrates[j].bitrate == bitrate)
                                 rates |= BIT(j);
         }
         ifsta->supp_rates_bits[local->hw.conf.channel->band] = rates;
 
-        ieee80211_sta_def_wmm_params(sdata, bss);
+        ieee80211_sta_def_wmm_params(sdata, supp_rates_len, supp_rates);
 
+        ifsta->flags |= IEEE80211_STA_PREV_BSSID_SET;
         ifsta->state = IEEE80211_STA_MLME_IBSS_JOINED;
         mod_timer(&ifsta->timer, jiffies + IEEE80211_IBSS_MERGE_INTERVAL);
 
         ieee80211_led_assoc(local, true);
 
         memset(&wrqu, 0, sizeof(wrqu));
-        memcpy(wrqu.ap_addr.sa_data, bss->bssid, ETH_ALEN);
+        memcpy(wrqu.ap_addr.sa_data, bssid, ETH_ALEN);
         wireless_send_event(sdata->dev, SIOCGIWAP, &wrqu, NULL);
 
         return res;
 }
 
+static int ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
+                                   struct ieee80211_if_sta *ifsta,
+                                   struct ieee80211_bss *bss)
+{
+        return __ieee80211_sta_join_ibss(sdata, ifsta,
+                                         bss->cbss.bssid,
+                                         bss->cbss.beacon_interval,
+                                         bss->cbss.channel->center_freq,
+                                         bss->supp_rates_len, bss->supp_rates,
+                                         bss->cbss.capability);
+}
+
 static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
                                   struct ieee80211_mgmt *mgmt,
                                   size_t len,
@@ -1546,7 +1706,7 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
         struct sta_info *sta;
         struct ieee80211_channel *channel;
         u64 beacon_timestamp, rx_timestamp;
-        u64 supp_rates = 0;
+        u32 supp_rates = 0;
         enum ieee80211_band band = rx_status->band;
 
         if (elems->ds_params && elems->ds_params_len == 1)
@@ -1567,7 +1727,7 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
 
                 sta = sta_info_get(local, mgmt->sa);
                 if (sta) {
-                        u64 prev_rates;
+                        u32 prev_rates;
 
                         prev_rates = sta->sta.supp_rates[band];
                         /* make sure mandatory rates are always added */
@@ -1593,80 +1753,99 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
         }
 
         bss = ieee80211_bss_info_update(local, rx_status, mgmt, len, elems,
-                                        freq, beacon);
+                                        channel, beacon);
         if (!bss)
                 return;
 
+        if (elems->ch_switch_elem && (elems->ch_switch_elem_len == 3) &&
+            (memcmp(mgmt->bssid, sdata->u.sta.bssid, ETH_ALEN) == 0)) {
+                struct ieee80211_channel_sw_ie *sw_elem =
+                        (struct ieee80211_channel_sw_ie *)elems->ch_switch_elem;
+                ieee80211_process_chanswitch(sdata, sw_elem, bss);
+        }
+
         /* was just updated in ieee80211_bss_info_update */
-        beacon_timestamp = bss->timestamp;
+        beacon_timestamp = bss->cbss.tsf;
 
-        /*
-         * In STA mode, the remaining parameters should not be overridden
-         * by beacons because they're not necessarily accurate there.
-         */
-        if (sdata->vif.type != NL80211_IFTYPE_ADHOC &&
-            bss->last_probe_resp && beacon) {
-                ieee80211_rx_bss_put(local, bss);
-                return;
-        }
+        if (sdata->vif.type != NL80211_IFTYPE_ADHOC)
+                goto put_bss;
 
         /* check if we need to merge IBSS */
-        if (sdata->vif.type == NL80211_IFTYPE_ADHOC && beacon &&
-            bss->capability & WLAN_CAPABILITY_IBSS &&
-            bss->freq == local->oper_channel->center_freq &&
-            elems->ssid_len == sdata->u.sta.ssid_len &&
+
+        /* merge only on beacons (???) */
+        if (!beacon)
+                goto put_bss;
+
+        /* we use a fixed BSSID */
+        if (sdata->u.sta.flags & IEEE80211_STA_BSSID_SET)
+                goto put_bss;
+
+        /* not an IBSS */
+        if (!(bss->cbss.capability & WLAN_CAPABILITY_IBSS))
+                goto put_bss;
+
+        /* different channel */
+        if (bss->cbss.channel != local->oper_channel)
+                goto put_bss;
+
+        /* different SSID */
+        if (elems->ssid_len != sdata->u.sta.ssid_len ||
             memcmp(elems->ssid, sdata->u.sta.ssid,
-                                sdata->u.sta.ssid_len) == 0) {
-                if (rx_status->flag & RX_FLAG_TSFT) {
-                        /* in order for correct IBSS merging we need mactime
-                         *
-                         * since mactime is defined as the time the first data
-                         * symbol of the frame hits the PHY, and the timestamp
-                         * of the beacon is defined as "the time that the data
-                         * symbol containing the first bit of the timestamp is
-                         * transmitted to the PHY plus the transmitting STA’s
-                         * delays through its local PHY from the MAC-PHY
-                         * interface to its interface with the WM"
-                         * (802.11 11.1.2) - equals the time this bit arrives at
-                         * the receiver - we have to take into account the
-                         * offset between the two.
-                         * e.g: at 1 MBit that means mactime is 192 usec earlier
-                         * (=24 bytes * 8 usecs/byte) than the beacon timestamp.
-                         */
-                        int rate;
-                        if (rx_status->flag & RX_FLAG_HT) {
-                                rate = 65; /* TODO: HT rates */
-                        } else {
-                                rate = local->hw.wiphy->bands[band]->
-                                        bitrates[rx_status->rate_idx].bitrate;
-                        }
-                        rx_timestamp = rx_status->mactime + (24 * 8 * 10 / rate);
-                } else if (local && local->ops && local->ops->get_tsf)
-                        /* second best option: get current TSF */
-                        rx_timestamp = local->ops->get_tsf(local_to_hw(local));
+                                sdata->u.sta.ssid_len))
+                goto put_bss;
+
+        if (rx_status->flag & RX_FLAG_TSFT) {
+                /*
+                 * For correct IBSS merging we need mactime; since mactime is
+                 * defined as the time the first data symbol of the frame hits
+                 * the PHY, and the timestamp of the beacon is defined as "the
+                 * time that the data symbol containing the first bit of the
+                 * timestamp is transmitted to the PHY plus the transmitting
+                 * STA's delays through its local PHY from the MAC-PHY
+                 * interface to its interface with the WM" (802.11 11.1.2)
+                 * - equals the time this bit arrives at the receiver - we have
+                 * to take into account the offset between the two.
+                 *
+                 * E.g. at 1 MBit that means mactime is 192 usec earlier
+                 * (=24 bytes * 8 usecs/byte) than the beacon timestamp.
+                 */
+                int rate;
+
+                if (rx_status->flag & RX_FLAG_HT)
+                        rate = 65; /* TODO: HT rates */
                 else
-                        /* can't merge without knowing the TSF */
-                        rx_timestamp = -1LLU;
+                        rate = local->hw.wiphy->bands[band]->
+                                bitrates[rx_status->rate_idx].bitrate;
+
+                rx_timestamp = rx_status->mactime + (24 * 8 * 10 / rate);
+        } else if (local && local->ops && local->ops->get_tsf)
+                /* second best option: get current TSF */
+                rx_timestamp = local->ops->get_tsf(local_to_hw(local));
+        else
+                /* can't merge without knowing the TSF */
+                rx_timestamp = -1LLU;
+
 #ifdef CONFIG_MAC80211_IBSS_DEBUG
-                printk(KERN_DEBUG "RX beacon SA=%pM BSSID="
-                       "%pM TSF=0x%llx BCN=0x%llx diff=%lld @%lu\n",
-                       mgmt->sa, mgmt->bssid,
-                       (unsigned long long)rx_timestamp,
-                       (unsigned long long)beacon_timestamp,
-                       (unsigned long long)(rx_timestamp - beacon_timestamp),
-                       jiffies);
-#endif /* CONFIG_MAC80211_IBSS_DEBUG */
-                if (beacon_timestamp > rx_timestamp) {
+        printk(KERN_DEBUG "RX beacon SA=%pM BSSID="
+               "%pM TSF=0x%llx BCN=0x%llx diff=%lld @%lu\n",
+               mgmt->sa, mgmt->bssid,
+               (unsigned long long)rx_timestamp,
+               (unsigned long long)beacon_timestamp,
+               (unsigned long long)(rx_timestamp - beacon_timestamp),
+               jiffies);
+#endif
+
+        if (beacon_timestamp > rx_timestamp) {
 #ifdef CONFIG_MAC80211_IBSS_DEBUG
-                        printk(KERN_DEBUG "%s: beacon TSF higher than "
-                               "local TSF - IBSS merge with BSSID %pM\n",
-                               sdata->dev->name, mgmt->bssid);
+                printk(KERN_DEBUG "%s: beacon TSF higher than "
+                       "local TSF - IBSS merge with BSSID %pM\n",
+                       sdata->dev->name, mgmt->bssid);
 #endif
-                        ieee80211_sta_join_ibss(sdata, &sdata->u.sta, bss);
-                        ieee80211_ibss_add_sta(sdata, mgmt->bssid, mgmt->sa, supp_rates);
-                }
+                ieee80211_sta_join_ibss(sdata, &sdata->u.sta, bss);
+                ieee80211_ibss_add_sta(sdata, mgmt->bssid, mgmt->sa, supp_rates);
         }
 
+ put_bss:
         ieee80211_rx_bss_put(local, bss);
 }
 
@@ -1712,7 +1891,7 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
         struct ieee802_11_elems elems;
         struct ieee80211_local *local = sdata->local;
         u32 changed = 0;
-        bool erp_valid;
+        bool erp_valid, directed_tim;
         u8 erp_value = 0;
 
         /* Process beacon from the current BSS */
@@ -1732,9 +1911,37 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
             memcmp(ifsta->bssid, mgmt->bssid, ETH_ALEN) != 0)
                 return;
 
+        if (rx_status->freq != local->hw.conf.channel->center_freq)
+                return;
+
         ieee80211_sta_wmm_params(local, ifsta, elems.wmm_param,
                                  elems.wmm_param_len);
 
+        if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK &&
+            local->hw.conf.flags & IEEE80211_CONF_PS) {
+                directed_tim = ieee80211_check_tim(&elems, ifsta->aid);
+
+                if (directed_tim) {
+                        if (local->hw.conf.dynamic_ps_timeout > 0) {
+                                local->hw.conf.flags &= ~IEEE80211_CONF_PS;
+                                ieee80211_hw_config(local,
+                                                    IEEE80211_CONF_CHANGE_PS);
+                                ieee80211_send_nullfunc(local, sdata, 0);
+                        } else {
+                                local->pspolling = true;
+
+                                /*
+                                 * Here is assumed that the driver will be
+                                 * able to send ps-poll frame and receive a
+                                 * response even though power save mode is
+                                 * enabled, but some drivers might require
+                                 * to disable power save here. This needs
+                                 * to be investigated.
+                                 */
+                                ieee80211_send_pspoll(local, sdata);
+                        }
+                }
+        }
 
         if (elems.erp_info && elems.erp_info_len >= 1) {
                 erp_valid = true;
@@ -1778,6 +1985,13 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
                  * for the BSSID we are associated to */
                 regulatory_hint_11d(local->hw.wiphy,
                         elems.country_elem, elems.country_elem_len);
+
+                /* TODO: IBSS also needs this */
+                if (elems.pwr_constr_elem)
+                        ieee80211_handle_pwr_constr(sdata,
+                                le16_to_cpu(mgmt->u.probe_resp.capab_info),
+                                elems.pwr_constr_elem,
+                                elems.pwr_constr_elem_len);
         }
 
         ieee80211_bss_info_change_notify(sdata, changed);
@@ -1787,8 +2001,7 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
 static void ieee80211_rx_mgmt_probe_req(struct ieee80211_sub_if_data *sdata,
                                         struct ieee80211_if_sta *ifsta,
                                         struct ieee80211_mgmt *mgmt,
-                                        size_t len,
-                                        struct ieee80211_rx_status *rx_status)
+                                        size_t len)
 {
         struct ieee80211_local *local = sdata->local;
         int tx_last_beacon;
@@ -1796,8 +2009,7 @@ static void ieee80211_rx_mgmt_probe_req(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_mgmt *resp;
         u8 *pos, *end;
 
-        if (sdata->vif.type != NL80211_IFTYPE_ADHOC ||
-            ifsta->state != IEEE80211_STA_MLME_IBSS_JOINED ||
+        if (ifsta->state != IEEE80211_STA_MLME_IBSS_JOINED ||
             len < 24 + 2 || !ifsta->probe_resp)
                 return;
 
@@ -1901,32 +2113,54 @@ static void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
         mgmt = (struct ieee80211_mgmt *) skb->data;
         fc = le16_to_cpu(mgmt->frame_control);
 
-        switch (fc & IEEE80211_FCTL_STYPE) {
-        case IEEE80211_STYPE_PROBE_REQ:
-                ieee80211_rx_mgmt_probe_req(sdata, ifsta, mgmt, skb->len,
-                                            rx_status);
-                break;
-        case IEEE80211_STYPE_PROBE_RESP:
-                ieee80211_rx_mgmt_probe_resp(sdata, mgmt, skb->len, rx_status);
-                break;
-        case IEEE80211_STYPE_BEACON:
-                ieee80211_rx_mgmt_beacon(sdata, mgmt, skb->len, rx_status);
-                break;
-        case IEEE80211_STYPE_AUTH:
-                ieee80211_rx_mgmt_auth(sdata, ifsta, mgmt, skb->len);
-                break;
-        case IEEE80211_STYPE_ASSOC_RESP:
-                ieee80211_rx_mgmt_assoc_resp(sdata, ifsta, mgmt, skb->len, 0);
-                break;
-        case IEEE80211_STYPE_REASSOC_RESP:
-                ieee80211_rx_mgmt_assoc_resp(sdata, ifsta, mgmt, skb->len, 1);
-                break;
-        case IEEE80211_STYPE_DEAUTH:
-                ieee80211_rx_mgmt_deauth(sdata, ifsta, mgmt, skb->len);
-                break;
-        case IEEE80211_STYPE_DISASSOC:
-                ieee80211_rx_mgmt_disassoc(sdata, ifsta, mgmt, skb->len);
-                break;
+        if (sdata->vif.type == NL80211_IFTYPE_ADHOC) {
+                switch (fc & IEEE80211_FCTL_STYPE) {
+                case IEEE80211_STYPE_PROBE_REQ:
+                        ieee80211_rx_mgmt_probe_req(sdata, ifsta, mgmt,
+                                                    skb->len);
+                        break;
+                case IEEE80211_STYPE_PROBE_RESP:
+                        ieee80211_rx_mgmt_probe_resp(sdata, mgmt, skb->len,
+                                                     rx_status);
+                        break;
+                case IEEE80211_STYPE_BEACON:
+                        ieee80211_rx_mgmt_beacon(sdata, mgmt, skb->len,
+                                                 rx_status);
+                        break;
+                case IEEE80211_STYPE_AUTH:
+                        ieee80211_rx_mgmt_auth_ibss(sdata, ifsta, mgmt,
+                                                    skb->len);
+                        break;
+                }
+        } else { /* NL80211_IFTYPE_STATION */
+                switch (fc & IEEE80211_FCTL_STYPE) {
+                case IEEE80211_STYPE_PROBE_RESP:
+                        ieee80211_rx_mgmt_probe_resp(sdata, mgmt, skb->len,
+                                                     rx_status);
+                        break;
+                case IEEE80211_STYPE_BEACON:
+                        ieee80211_rx_mgmt_beacon(sdata, mgmt, skb->len,
+                                                 rx_status);
+                        break;
+                case IEEE80211_STYPE_AUTH:
+                        ieee80211_rx_mgmt_auth(sdata, ifsta, mgmt, skb->len);
+                        break;
+                case IEEE80211_STYPE_ASSOC_RESP:
+                        ieee80211_rx_mgmt_assoc_resp(sdata, ifsta, mgmt,
+                                                     skb->len, 0);
+                        break;
+                case IEEE80211_STYPE_REASSOC_RESP:
+                        ieee80211_rx_mgmt_assoc_resp(sdata, ifsta, mgmt,
+                                                     skb->len, 1);
+                        break;
+                case IEEE80211_STYPE_DEAUTH:
+                        ieee80211_rx_mgmt_deauth(sdata, ifsta, mgmt, skb->len);
+                        break;
+                case IEEE80211_STYPE_DISASSOC:
+                        ieee80211_rx_mgmt_disassoc(sdata, ifsta, mgmt,
+                                                   skb->len);
+                        break;
+                }
         }
 
         kfree_skb(skb);
@@ -1965,9 +2199,21 @@ static void ieee80211_sta_merge_ibss(struct ieee80211_sub_if_data *sdata,
         if (ieee80211_sta_active_ibss(sdata))
                 return;
 
+        if ((sdata->u.sta.flags & IEEE80211_STA_BSSID_SET) &&
+            (!(sdata->u.sta.flags & IEEE80211_STA_AUTO_CHANNEL_SEL)))
+                return;
+
         printk(KERN_DEBUG "%s: No active IBSS STAs - trying to scan for other "
                "IBSS networks with same SSID (merge)\n", sdata->dev->name);
-        ieee80211_request_scan(sdata, ifsta->ssid, ifsta->ssid_len);
+
+        /* XXX maybe racy? */
+        if (sdata->local->scan_req)
+                return;
+
+        memcpy(sdata->local->int_scan_req.ssids[0].ssid,
+               ifsta->ssid, IEEE80211_MAX_SSID_LEN);
+        sdata->local->int_scan_req.ssids[0].ssid_len = ifsta->ssid_len;
+        ieee80211_request_scan(sdata, &sdata->local->int_scan_req);
 }
 
 
@@ -2013,94 +2259,56 @@ static void ieee80211_sta_reset_auth(struct ieee80211_sub_if_data *sdata,
         netif_carrier_off(sdata->dev);
 }
 
-
-static int ieee80211_sta_match_ssid(struct ieee80211_if_sta *ifsta,
-                                    const char *ssid, int ssid_len)
-{
-        int tmp, hidden_ssid;
-
-        if (ssid_len == ifsta->ssid_len &&
-            !memcmp(ifsta->ssid, ssid, ssid_len))
-                return 1;
-
-        if (ifsta->flags & IEEE80211_STA_AUTO_BSSID_SEL)
-                return 0;
-
-        hidden_ssid = 1;
-        tmp = ssid_len;
-        while (tmp--) {
-                if (ssid[tmp] != '\0') {
-                        hidden_ssid = 0;
-                        break;
-                }
-        }
-
-        if (hidden_ssid && (ifsta->ssid_len == ssid_len || ssid_len == 0))
-                return 1;
-
-        if (ssid_len == 1 && ssid[0] == ' ')
-                return 1;
-
-        return 0;
-}
-
 static int ieee80211_sta_create_ibss(struct ieee80211_sub_if_data *sdata,
                                      struct ieee80211_if_sta *ifsta)
 {
         struct ieee80211_local *local = sdata->local;
-        struct ieee80211_bss *bss;
         struct ieee80211_supported_band *sband;
-        u8 bssid[ETH_ALEN], *pos;
+        u8 *pos;
+        u8 bssid[ETH_ALEN];
+        u8 supp_rates[IEEE80211_MAX_SUPP_RATES];
+        u16 capability;
         int i;
-        int ret;
-
-#if 0
-        /* Easier testing, use fixed BSSID. */
-        memset(bssid, 0xfe, ETH_ALEN);
-#else
-        /* Generate random, not broadcast, locally administered BSSID. Mix in
-         * own MAC address to make sure that devices that do not have proper
-         * random number generator get different BSSID. */
-        get_random_bytes(bssid, ETH_ALEN);
-        for (i = 0; i < ETH_ALEN; i++)
-                bssid[i] ^= sdata->dev->dev_addr[i];
-        bssid[0] &= ~0x01;
-        bssid[0] |= 0x02;
-#endif
+
+        if (sdata->u.sta.flags & IEEE80211_STA_BSSID_SET) {
+                memcpy(bssid, ifsta->bssid, ETH_ALEN);
+        } else {
+                /* Generate random, not broadcast, locally administered BSSID. Mix in
+                 * own MAC address to make sure that devices that do not have proper
+                 * random number generator get different BSSID. */
+                get_random_bytes(bssid, ETH_ALEN);
+                for (i = 0; i < ETH_ALEN; i++)
+                        bssid[i] ^= sdata->dev->dev_addr[i];
+                bssid[0] &= ~0x01;
+                bssid[0] |= 0x02;
+        }
 
         printk(KERN_DEBUG "%s: Creating new IBSS network, BSSID %pM\n",
                sdata->dev->name, bssid);
 
-        bss = ieee80211_rx_bss_add(local, bssid,
-                                   local->hw.conf.channel->center_freq,
-                                   sdata->u.sta.ssid, sdata->u.sta.ssid_len);
-        if (!bss)
-                return -ENOMEM;
-
-        bss->band = local->hw.conf.channel->band;
-        sband = local->hw.wiphy->bands[bss->band];
+        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
 
         if (local->hw.conf.beacon_int == 0)
                 local->hw.conf.beacon_int = 100;
-        bss->beacon_int = local->hw.conf.beacon_int;
-        bss->last_update = jiffies;
-        bss->capability = WLAN_CAPABILITY_IBSS;
+
+        capability = WLAN_CAPABILITY_IBSS;
 
         if (sdata->default_key)
-                bss->capability |= WLAN_CAPABILITY_PRIVACY;
+                capability |= WLAN_CAPABILITY_PRIVACY;
         else
                 sdata->drop_unencrypted = 0;
 
-        bss->supp_rates_len = sband->n_bitrates;
-        pos = bss->supp_rates;
+        pos = supp_rates;
         for (i = 0; i < sband->n_bitrates; i++) {
                 int rate = sband->bitrates[i].bitrate;
                 *pos++ = (u8) (rate / 5);
         }
 
-        ret = ieee80211_sta_join_ibss(sdata, ifsta, bss);
-        ieee80211_rx_bss_put(local, bss);
-        return ret;
+        return __ieee80211_sta_join_ibss(sdata, ifsta,
+                                         bssid, local->hw.conf.beacon_int,
+                                         local->hw.conf.channel->center_freq,
+                                         sband->n_bitrates, supp_rates,
+                                         capability);
 }
 
 
@@ -2109,8 +2317,6 @@ static int ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata,
 {
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_bss *bss;
-        int found = 0;
-        u8 bssid[ETH_ALEN];
         int active_ibss;
 
         if (ifsta->ssid_len == 0)
@@ -2121,51 +2327,39 @@ static int ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata,
         printk(KERN_DEBUG "%s: sta_find_ibss (active_ibss=%d)\n",
                sdata->dev->name, active_ibss);
 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
-        spin_lock_bh(&local->bss_lock);
-        list_for_each_entry(bss, &local->bss_list, list) {
-                if (ifsta->ssid_len != bss->ssid_len ||
-                    memcmp(ifsta->ssid, bss->ssid, bss->ssid_len) != 0
-                    || !(bss->capability & WLAN_CAPABILITY_IBSS))
-                        continue;
-#ifdef CONFIG_MAC80211_IBSS_DEBUG
-                printk(KERN_DEBUG "   bssid=%pM found\n", bss->bssid);
-#endif /* CONFIG_MAC80211_IBSS_DEBUG */
-                memcpy(bssid, bss->bssid, ETH_ALEN);
-                found = 1;
-                if (active_ibss || memcmp(bssid, ifsta->bssid, ETH_ALEN) != 0)
-                        break;
-        }
-        spin_unlock_bh(&local->bss_lock);
+
+        if (active_ibss)
+                return 0;
+
+        if (ifsta->flags & IEEE80211_STA_BSSID_SET)
+                bss = ieee80211_rx_bss_get(local, ifsta->bssid, 0,
+                                           ifsta->ssid, ifsta->ssid_len);
+        else
+                bss = (void *)cfg80211_get_ibss(local->hw.wiphy,
+                                                NULL,
+                                                ifsta->ssid, ifsta->ssid_len);
 
 #ifdef CONFIG_MAC80211_IBSS_DEBUG
-        if (found)
+        if (bss)
                 printk(KERN_DEBUG "   sta_find_ibss: selected %pM current "
-                       "%pM\n", bssid, ifsta->bssid);
+                       "%pM\n", bss->cbss.bssid, ifsta->bssid);
 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
 
-        if (found && memcmp(ifsta->bssid, bssid, ETH_ALEN) != 0) {
+        if (bss &&
+            (!(ifsta->flags & IEEE80211_STA_PREV_BSSID_SET) ||
+             memcmp(ifsta->bssid, bss->cbss.bssid, ETH_ALEN))) {
                 int ret;
-                int search_freq;
-
-                if (ifsta->flags & IEEE80211_STA_AUTO_CHANNEL_SEL)
-                        search_freq = bss->freq;
-                else
-                        search_freq = local->hw.conf.channel->center_freq;
-
-                bss = ieee80211_rx_bss_get(local, bssid, search_freq,
-                                           ifsta->ssid, ifsta->ssid_len);
-                if (!bss)
-                        goto dont_join;
 
                 printk(KERN_DEBUG "%s: Selected IBSS BSSID %pM"
                        " based on configured SSID\n",
-                       sdata->dev->name, bssid);
+                       sdata->dev->name, bss->cbss.bssid);
+
                 ret = ieee80211_sta_join_ibss(sdata, ifsta, bss);
                 ieee80211_rx_bss_put(local, bss);
                 return ret;
-        }
+        } else if (bss)
+                ieee80211_rx_bss_put(local, bss);
 
-dont_join:
 #ifdef CONFIG_MAC80211_IBSS_DEBUG
         printk(KERN_DEBUG "   did not try to join ibss\n");
 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
@@ -2179,8 +2373,15 @@ dont_join:
                               IEEE80211_SCAN_INTERVAL)) {
                 printk(KERN_DEBUG "%s: Trigger new scan to find an IBSS to "
                        "join\n", sdata->dev->name);
-                return ieee80211_request_scan(sdata, ifsta->ssid,
-                                              ifsta->ssid_len);
+
+                /* XXX maybe racy? */
+                if (local->scan_req)
+                        return -EBUSY;
+
+                memcpy(local->int_scan_req.ssids[0].ssid,
+                       ifsta->ssid, IEEE80211_MAX_SSID_LEN);
+                local->int_scan_req.ssids[0].ssid_len = ifsta->ssid_len;
+                return ieee80211_request_scan(sdata, &local->int_scan_req);
         } else if (ifsta->state != IEEE80211_STA_MLME_IBSS_JOINED) {
                 int interval = IEEE80211_SCAN_INTERVAL;
 
@@ -2214,76 +2415,81 @@ static int ieee80211_sta_config_auth(struct ieee80211_sub_if_data *sdata,
                                      struct ieee80211_if_sta *ifsta)
 {
         struct ieee80211_local *local = sdata->local;
-        struct ieee80211_bss *bss, *selected = NULL;
-        int top_rssi = 0, freq;
-
-        spin_lock_bh(&local->bss_lock);
-        freq = local->oper_channel->center_freq;
-        list_for_each_entry(bss, &local->bss_list, list) {
-                if (!(bss->capability & WLAN_CAPABILITY_ESS))
-                        continue;
-
-                if ((ifsta->flags & (IEEE80211_STA_AUTO_SSID_SEL |
-                        IEEE80211_STA_AUTO_BSSID_SEL |
-                        IEEE80211_STA_AUTO_CHANNEL_SEL)) &&
-                    (!!(bss->capability & WLAN_CAPABILITY_PRIVACY) ^
-                     !!sdata->default_key))
-                        continue;
-
-                if (!(ifsta->flags & IEEE80211_STA_AUTO_CHANNEL_SEL) &&
-                    bss->freq != freq)
-                        continue;
-
-                if (!(ifsta->flags & IEEE80211_STA_AUTO_BSSID_SEL) &&
-                    memcmp(bss->bssid, ifsta->bssid, ETH_ALEN))
-                        continue;
-
-                if (!(ifsta->flags & IEEE80211_STA_AUTO_SSID_SEL) &&
-                    !ieee80211_sta_match_ssid(ifsta, bss->ssid, bss->ssid_len))
-                        continue;
-
-                if (!selected || top_rssi < bss->signal) {
-                        selected = bss;
-                        top_rssi = bss->signal;
-                }
+        struct ieee80211_bss *bss;
+        u8 *bssid = ifsta->bssid, *ssid = ifsta->ssid;
+        u8 ssid_len = ifsta->ssid_len;
+        u16 capa_mask = WLAN_CAPABILITY_ESS;
+        u16 capa_val = WLAN_CAPABILITY_ESS;
+        struct ieee80211_channel *chan = local->oper_channel;
+
+        if (ifsta->flags & (IEEE80211_STA_AUTO_SSID_SEL |
+                            IEEE80211_STA_AUTO_BSSID_SEL |
+                            IEEE80211_STA_AUTO_CHANNEL_SEL)) {
+                capa_mask |= WLAN_CAPABILITY_PRIVACY;
+                if (sdata->default_key)
+                        capa_val |= WLAN_CAPABILITY_PRIVACY;
         }
-        if (selected)
-                atomic_inc(&selected->users);
-        spin_unlock_bh(&local->bss_lock);
 
-        if (selected) {
-                ieee80211_set_freq(sdata, selected->freq);
+        if (ifsta->flags & IEEE80211_STA_AUTO_CHANNEL_SEL)
+                chan = NULL;
+
+        if (ifsta->flags & IEEE80211_STA_AUTO_BSSID_SEL)
+                bssid = NULL;
+
+        if (ifsta->flags & IEEE80211_STA_AUTO_SSID_SEL) {
+                ssid = NULL;
+                ssid_len = 0;
+        }
+
+        bss = (void *)cfg80211_get_bss(local->hw.wiphy, chan,
+                                       bssid, ssid, ssid_len,
+                                       capa_mask, capa_val);
+
+        if (bss) {
+                ieee80211_set_freq(sdata, bss->cbss.channel->center_freq);
                 if (!(ifsta->flags & IEEE80211_STA_SSID_SET))
-                        ieee80211_sta_set_ssid(sdata, selected->ssid,
-                                               selected->ssid_len);
-                ieee80211_sta_set_bssid(sdata, selected->bssid);
-                ieee80211_sta_def_wmm_params(sdata, selected);
+                        ieee80211_sta_set_ssid(sdata, bss->ssid,
+                                               bss->ssid_len);
+                ieee80211_sta_set_bssid(sdata, bss->cbss.bssid);
+                ieee80211_sta_def_wmm_params(sdata, bss->supp_rates_len,
+                                                    bss->supp_rates);
+                if (sdata->u.sta.mfp == IEEE80211_MFP_REQUIRED)
+                        sdata->u.sta.flags |= IEEE80211_STA_MFP_ENABLED;
+                else
+                        sdata->u.sta.flags &= ~IEEE80211_STA_MFP_ENABLED;
 
                 /* Send out direct probe if no probe resp was received or
                  * the one we have is outdated
                  */
-                if (!selected->last_probe_resp ||
-                    time_after(jiffies, selected->last_probe_resp
+                if (!bss->last_probe_resp ||
+                    time_after(jiffies, bss->last_probe_resp
                                         + IEEE80211_SCAN_RESULT_EXPIRE))
                         ifsta->state = IEEE80211_STA_MLME_DIRECT_PROBE;
                 else
                         ifsta->state = IEEE80211_STA_MLME_AUTHENTICATE;
 
-                ieee80211_rx_bss_put(local, selected);
+                ieee80211_rx_bss_put(local, bss);
                 ieee80211_sta_reset_auth(sdata, ifsta);
                 return 0;
         } else {
                 if (ifsta->assoc_scan_tries < IEEE80211_ASSOC_SCANS_MAX_TRIES) {
                         ifsta->assoc_scan_tries++;
+                        /* XXX maybe racy? */
+                        if (local->scan_req)
+                                return -1;
+                        memcpy(local->int_scan_req.ssids[0].ssid,
+                               ifsta->ssid, IEEE80211_MAX_SSID_LEN);
                         if (ifsta->flags & IEEE80211_STA_AUTO_SSID_SEL)
-                                ieee80211_start_scan(sdata, NULL, 0);
+                                local->int_scan_req.ssids[0].ssid_len = 0;
                         else
-                                ieee80211_start_scan(sdata, ifsta->ssid,
-                                                         ifsta->ssid_len);
+                                local->int_scan_req.ssids[0].ssid_len = ifsta->ssid_len;
+                        ieee80211_start_scan(sdata, &local->int_scan_req);
                         ifsta->state = IEEE80211_STA_MLME_AUTHENTICATE;
                         set_bit(IEEE80211_STA_REQ_AUTH, &ifsta->request);
-                } else
+                } else {
+                        ifsta->assoc_scan_tries = 0;
                         ifsta->state = IEEE80211_STA_MLME_DISABLED;
+                }
         }
         return -1;
 }
@@ -2315,8 +2521,7 @@ static void ieee80211_sta_work(struct work_struct *work)
             ifsta->state != IEEE80211_STA_MLME_AUTHENTICATE &&
             ifsta->state != IEEE80211_STA_MLME_ASSOCIATE &&
             test_and_clear_bit(IEEE80211_STA_REQ_SCAN, &ifsta->request)) {
-                ieee80211_start_scan(sdata, ifsta->scan_ssid,
-                                     ifsta->scan_ssid_len);
+                ieee80211_start_scan(sdata, local->scan_req);
                 return;
         }
 
@@ -2376,8 +2581,11 @@ void ieee80211_sta_setup_sdata(struct ieee80211_sub_if_data *sdata)
 
         ifsta = &sdata->u.sta;
         INIT_WORK(&ifsta->work, ieee80211_sta_work);
+        INIT_WORK(&ifsta->chswitch_work, ieee80211_chswitch_work);
         setup_timer(&ifsta->timer, ieee80211_sta_timer,
                     (unsigned long) sdata);
+        setup_timer(&ifsta->chswitch_timer, ieee80211_chswitch_timer,
+                    (unsigned long) sdata);
         skb_queue_head_init(&ifsta->skb_queue);
 
         ifsta->capab = WLAN_CAPABILITY_ESS;
@@ -2396,7 +2604,7 @@ void ieee80211_sta_setup_sdata(struct ieee80211_sub_if_data *sdata)
  * must be callable in atomic context.
  */
 struct sta_info *ieee80211_ibss_add_sta(struct ieee80211_sub_if_data *sdata,
-                                        u8 *bssid,u8 *addr, u64 supp_rates)
+                                        u8 *bssid,u8 *addr, u32 supp_rates)
 {
         struct ieee80211_local *local = sdata->local;
         struct sta_info *sta;
@@ -2474,16 +2682,16 @@ int ieee80211_sta_set_ssid(struct ieee80211_sub_if_data *sdata, char *ssid, size
                 memset(ifsta->ssid, 0, sizeof(ifsta->ssid));
                 memcpy(ifsta->ssid, ssid, len);
                 ifsta->ssid_len = len;
-                ifsta->flags &= ~IEEE80211_STA_PREV_BSSID_SET;
         }
 
+        ifsta->flags &= ~IEEE80211_STA_PREV_BSSID_SET;
+
         if (len)
                 ifsta->flags |= IEEE80211_STA_SSID_SET;
         else
                 ifsta->flags &= ~IEEE80211_STA_SSID_SET;
 
-        if (sdata->vif.type == NL80211_IFTYPE_ADHOC &&
-            !(ifsta->flags & IEEE80211_STA_BSSID_SET)) {
+        if (sdata->vif.type == NL80211_IFTYPE_ADHOC) {
                 ifsta->ibss_join_req = jiffies;
                 ifsta->state = IEEE80211_STA_MLME_IBSS_SEARCH;
                 return ieee80211_sta_find_ibss(sdata, ifsta);
@@ -2503,31 +2711,25 @@ int ieee80211_sta_get_ssid(struct ieee80211_sub_if_data *sdata, char *ssid, size
 int ieee80211_sta_set_bssid(struct ieee80211_sub_if_data *sdata, u8 *bssid)
 {
         struct ieee80211_if_sta *ifsta;
-        int res;
 
         ifsta = &sdata->u.sta;
 
-        if (memcmp(ifsta->bssid, bssid, ETH_ALEN) != 0) {
+        if (is_valid_ether_addr(bssid)) {
                 memcpy(ifsta->bssid, bssid, ETH_ALEN);
-                res = 0;
-                /*
-                 * Hack! See also ieee80211_sta_set_ssid.
-                 */
-                if (netif_running(sdata->dev))
-                        res = ieee80211_if_config(sdata, IEEE80211_IFCC_BSSID);
-                if (res) {
+                ifsta->flags |= IEEE80211_STA_BSSID_SET;
+        } else {
+                memset(ifsta->bssid, 0, ETH_ALEN);
+                ifsta->flags &= ~IEEE80211_STA_BSSID_SET;
+        }
+
+        if (netif_running(sdata->dev)) {
+                if (ieee80211_if_config(sdata, IEEE80211_IFCC_BSSID)) {
                         printk(KERN_DEBUG "%s: Failed to config new BSSID to "
                                "the low-level driver\n", sdata->dev->name);
-                        return res;
                 }
         }
 
-        if (is_valid_ether_addr(bssid))
-                ifsta->flags |= IEEE80211_STA_BSSID_SET;
-        else
-                ifsta->flags &= ~IEEE80211_STA_BSSID_SET;
-
-        return 0;
+        return ieee80211_sta_set_ssid(sdata, ifsta->ssid, ifsta->ssid_len);
 }
 
 int ieee80211_sta_set_extra_ie(struct ieee80211_sub_if_data *sdata, char *ie, size_t len)
@@ -2590,9 +2792,8 @@ void ieee80211_mlme_notify_scan_completed(struct ieee80211_local *local)
 
         if (sdata && sdata->vif.type == NL80211_IFTYPE_ADHOC) {
                 ifsta = &sdata->u.sta;
-                if (!(ifsta->flags & IEEE80211_STA_BSSID_SET) ||
-                    (!(ifsta->state == IEEE80211_STA_MLME_IBSS_JOINED) &&
-                    !ieee80211_sta_active_ibss(sdata)))
+                if ((!(ifsta->flags & IEEE80211_STA_PREV_BSSID_SET)) ||
+                    !ieee80211_sta_active_ibss(sdata))
                         ieee80211_sta_find_ibss(sdata, ifsta);
         }
 
@@ -2623,12 +2824,15 @@ void ieee80211_dynamic_ps_enable_work(struct work_struct *work)
         struct ieee80211_local *local =
                 container_of(work, struct ieee80211_local,
                              dynamic_ps_enable_work);
+        struct ieee80211_sub_if_data *sdata = local->scan_sdata;
 
         if (local->hw.conf.flags & IEEE80211_CONF_PS)
                 return;
 
-        local->hw.conf.flags |= IEEE80211_CONF_PS;
+        if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK)
+                ieee80211_send_nullfunc(local, sdata, 1);
 
+        local->hw.conf.flags |= IEEE80211_CONF_PS;
         ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
 }
 
diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c
new file mode 100644
index 000000000000..44525f517077
--- /dev/null
+++ b/net/mac80211/pm.c
@@ -0,0 +1,117 @@
+#include <net/mac80211.h>
+#include <net/rtnetlink.h>
+
+#include "ieee80211_i.h"
+#include "led.h"
+
+int __ieee80211_suspend(struct ieee80211_hw *hw)
+{
+        struct ieee80211_local *local = hw_to_local(hw);
+        struct ieee80211_sub_if_data *sdata;
+        struct ieee80211_if_init_conf conf;
+        struct sta_info *sta;
+
+        flush_workqueue(local->hw.workqueue);
+
+        /* disable keys */
+        list_for_each_entry(sdata, &local->interfaces, list)
+                ieee80211_disable_keys(sdata);
+
+        /* remove STAs */
+        list_for_each_entry(sta, &local->sta_list, list) {
+
+                if (local->ops->sta_notify) {
+                        if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
+                                sdata = container_of(sdata->bss,
+                                             struct ieee80211_sub_if_data,
+                                             u.ap);
+
+                        local->ops->sta_notify(hw, &sdata->vif,
+                                STA_NOTIFY_REMOVE, &sta->sta);
+                }
+        }
+
+        /* remove all interfaces */
+        list_for_each_entry(sdata, &local->interfaces, list) {
+
+                if (sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
+                    sdata->vif.type != NL80211_IFTYPE_MONITOR &&
+                    netif_running(sdata->dev)) {
+                        conf.vif = &sdata->vif;
+                        conf.type = sdata->vif.type;
+                        conf.mac_addr = sdata->dev->dev_addr;
+                        local->ops->remove_interface(hw, &conf);
+                }
+        }
+
+        /* flush again, in case driver queued work */
+        flush_workqueue(local->hw.workqueue);
+
+        /* stop hardware */
+        if (local->open_count) {
+                ieee80211_led_radio(local, false);
+                local->ops->stop(hw);
+        }
+        return 0;
+}
+
+int __ieee80211_resume(struct ieee80211_hw *hw)
+{
+        struct ieee80211_local *local = hw_to_local(hw);
+        struct ieee80211_sub_if_data *sdata;
+        struct ieee80211_if_init_conf conf;
+        struct sta_info *sta;
+        int res;
+
+        /* restart hardware */
+        if (local->open_count) {
+                res = local->ops->start(hw);
+
+                ieee80211_led_radio(local, hw->conf.radio_enabled);
+        }
+
+        /* add interfaces */
+        list_for_each_entry(sdata, &local->interfaces, list) {
+
+                if (sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
+                    sdata->vif.type != NL80211_IFTYPE_MONITOR &&
+                    netif_running(sdata->dev)) {
+                        conf.vif = &sdata->vif;
+                        conf.type = sdata->vif.type;
+                        conf.mac_addr = sdata->dev->dev_addr;
+                        res = local->ops->add_interface(hw, &conf);
+                }
+        }
+
+        /* add STAs back */
+        list_for_each_entry(sta, &local->sta_list, list) {
+
+                if (local->ops->sta_notify) {
+                        if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
+                                sdata = container_of(sdata->bss,
+                                             struct ieee80211_sub_if_data,
+                                             u.ap);
+
+                        local->ops->sta_notify(hw, &sdata->vif,
+                                STA_NOTIFY_ADD, &sta->sta);
+                }
+        }
+
+        /* add back keys */
+        list_for_each_entry(sdata, &local->interfaces, list)
+                if (netif_running(sdata->dev))
+                        ieee80211_enable_keys(sdata);
+
+        /* setup RTS threshold */
+        if (local->ops->set_rts_threshold)
+                local->ops->set_rts_threshold(hw, local->rts_threshold);
+
+        /* reconfigure hardware */
+        ieee80211_hw_config(local, ~0);
+
+        netif_addr_lock_bh(local->mdev);
+        ieee80211_configure_filter(local);
+        netif_addr_unlock_bh(local->mdev);
+
+        return 0;
+}
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 7175ae80c36a..1327d424bf31 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -86,8 +86,7 @@ ieee80211_rx_radiotap_len(struct ieee80211_local *local,
 
         if (status->flag & RX_FLAG_TSFT)
                 len += 8;
-        if (local->hw.flags & IEEE80211_HW_SIGNAL_DB ||
-            local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
+        if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
                 len += 1;
         if (local->hw.flags & IEEE80211_HW_NOISE_DBM)
                 len += 1;
@@ -102,7 +101,7 @@ ieee80211_rx_radiotap_len(struct ieee80211_local *local,
         return len;
 }
 
-/**
+/*
  * ieee80211_add_rx_radiotap_header - add radiotap header
  *
  * add a radiotap header containing all the fields which the hardware provided.
@@ -158,7 +157,7 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
                  */
                 *pos = 0;
         } else {
-                rthdr->it_present |= (1 << IEEE80211_RADIOTAP_RATE);
+                rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_RATE);
                 *pos = rate->bitrate / 5;
         }
         pos++;
@@ -199,14 +198,6 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
         *pos = status->antenna;
         pos++;
 
-        /* IEEE80211_RADIOTAP_DB_ANTSIGNAL */
-        if (local->hw.flags & IEEE80211_HW_SIGNAL_DB) {
-                *pos = status->signal;
-                rthdr->it_present |=
-                        cpu_to_le32(1 << IEEE80211_RADIOTAP_DB_ANTSIGNAL);
-                pos++;
-        }
-
         /* IEEE80211_RADIOTAP_DB_ANTNOISE is not used */
 
         /* IEEE80211_RADIOTAP_RX_FLAGS */
@@ -371,39 +362,50 @@ static void ieee80211_parse_qos(struct ieee80211_rx_data *rx)
         rx->skb->priority = (tid > 7) ? 0 : tid;
 }
 
-static void ieee80211_verify_ip_alignment(struct ieee80211_rx_data *rx)
+/**
+ * DOC: Packet alignment
+ *
+ * Drivers always need to pass packets that are aligned to two-byte boundaries
+ * to the stack.
+ *
+ * Additionally, should, if possible, align the payload data in a way that
+ * guarantees that the contained IP header is aligned to a four-byte
+ * boundary. In the case of regular frames, this simply means aligning the
+ * payload to a four-byte boundary (because either the IP header is directly
+ * contained, or IV/RFC1042 headers that have a length divisible by four are
+ * in front of it).
+ *
+ * With A-MSDU frames, however, the payload data address must yield two modulo
+ * four because there are 14-byte 802.3 headers within the A-MSDU frames that
+ * push the IP header further back to a multiple of four again. Thankfully, the
+ * specs were sane enough this time around to require padding each A-MSDU
+ * subframe to a length that is a multiple of four.
+ *
+ * Padding like Atheros hardware adds which is inbetween the 802.11 header and
+ * the payload is not supported, the driver is required to move the 802.11
+ * header to be directly in front of the payload in that case.
+ */
+static void ieee80211_verify_alignment(struct ieee80211_rx_data *rx)
 {
-#ifdef CONFIG_MAC80211_DEBUG_PACKET_ALIGNMENT
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
         int hdrlen;
 
+#ifndef CONFIG_MAC80211_DEBUG_PACKET_ALIGNMENT
+        return;
+#endif
+
+        if (WARN_ONCE((unsigned long)rx->skb->data & 1,
+                      "unaligned packet at 0x%p\n", rx->skb->data))
+                return;
+
         if (!ieee80211_is_data_present(hdr->frame_control))
                 return;
 
-        /*
-         * Drivers are required to align the payload data in a way that
-         * guarantees that the contained IP header is aligned to a four-
-         * byte boundary. In the case of regular frames, this simply means
-         * aligning the payload to a four-byte boundary (because either
-         * the IP header is directly contained, or IV/RFC1042 headers that
-         * have a length divisible by four are in front of it.
-         *
-         * With A-MSDU frames, however, the payload data address must
-         * yield two modulo four because there are 14-byte 802.3 headers
-         * within the A-MSDU frames that push the IP header further back
-         * to a multiple of four again. Thankfully, the specs were sane
-         * enough this time around to require padding each A-MSDU subframe
-         * to a length that is a multiple of four.
-         *
-         * Padding like atheros hardware adds which is inbetween the 802.11
-         * header and the payload is not supported, the driver is required
-         * to move the 802.11 header further back in that case.
-         */
         hdrlen = ieee80211_hdrlen(hdr->frame_control);
         if (rx->flags & IEEE80211_RX_AMSDU)
                 hdrlen += ETH_HLEN;
-        WARN_ON_ONCE(((unsigned long)(rx->skb->data + hdrlen)) & 3);
-#endif
+        WARN_ONCE(((unsigned long)(rx->skb->data + hdrlen)) & 3,
+                  "unaligned IP payload at 0x%p\n", rx->skb->data + hdrlen);
 }
 
 
@@ -435,6 +437,52 @@ ieee80211_rx_h_passive_scan(struct ieee80211_rx_data *rx)
         return RX_CONTINUE;
 }
 
+
+static int ieee80211_is_unicast_robust_mgmt_frame(struct sk_buff *skb)
+{
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
+
+        if (skb->len < 24 || is_multicast_ether_addr(hdr->addr1))
+                return 0;
+
+        return ieee80211_is_robust_mgmt_frame(hdr);
+}
+
+
+static int ieee80211_is_multicast_robust_mgmt_frame(struct sk_buff *skb)
+{
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
+
+        if (skb->len < 24 || !is_multicast_ether_addr(hdr->addr1))
+                return 0;
+
+        return ieee80211_is_robust_mgmt_frame(hdr);
+}
+
+
+/* Get the BIP key index from MMIE; return -1 if this is not a BIP frame */
+static int ieee80211_get_mmie_keyidx(struct sk_buff *skb)
+{
+        struct ieee80211_mgmt *hdr = (struct ieee80211_mgmt *) skb->data;
+        struct ieee80211_mmie *mmie;
+
+        if (skb->len < 24 + sizeof(*mmie) ||
+            !is_multicast_ether_addr(hdr->da))
+                return -1;
+
+        if (!ieee80211_is_robust_mgmt_frame((struct ieee80211_hdr *) hdr))
+                return -1; /* not a robust management frame */
+
+        mmie = (struct ieee80211_mmie *)
+                (skb->data + skb->len - sizeof(*mmie));
+        if (mmie->element_id != WLAN_EID_MMIE ||
+            mmie->length != sizeof(*mmie) - 2)
+                return -1;
+
+        return le16_to_cpu(mmie->key_id);
+}
+
+
 static ieee80211_rx_result
 ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
 {
@@ -550,21 +598,23 @@ ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
         int hdrlen;
         ieee80211_rx_result result = RX_DROP_UNUSABLE;
         struct ieee80211_key *stakey = NULL;
+        int mmie_keyidx = -1;
 
         /*
          * Key selection 101
          *
-         * There are three types of keys:
+         * There are four types of keys:
          *  - GTK (group keys)
+         *  - IGTK (group keys for management frames)
          *  - PTK (pairwise keys)
          *  - STK (station-to-station pairwise keys)
          *
          * When selecting a key, we have to distinguish between multicast
          * (including broadcast) and unicast frames, the latter can only
-         * use PTKs and STKs while the former always use GTKs. Unless, of
-         * course, actual WEP keys ("pre-RSNA") are used, then unicast
-         * frames can also use key indizes like GTKs. Hence, if we don't
-         * have a PTK/STK we check the key index for a WEP key.
+         * use PTKs and STKs while the former always use GTKs and IGTKs.
+         * Unless, of course, actual WEP keys ("pre-RSNA") are used, then
+         * unicast frames can also use key indices like GTKs. Hence, if we
+         * don't have a PTK/STK we check the key index for a WEP key.
          *
          * Note that in a regular BSS, multicast frames are sent by the
          * AP only, associated stations unicast the frame to the AP first
@@ -577,8 +627,14 @@ ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
          * possible.
          */
 
-        if (!ieee80211_has_protected(hdr->frame_control))
-                return RX_CONTINUE;
+        if (!ieee80211_has_protected(hdr->frame_control)) {
+                if (!ieee80211_is_mgmt(hdr->frame_control) ||
+                    rx->sta == NULL || !test_sta_flags(rx->sta, WLAN_STA_MFP))
+                        return RX_CONTINUE;
+                mmie_keyidx = ieee80211_get_mmie_keyidx(rx->skb);
+                if (mmie_keyidx < 0)
+                        return RX_CONTINUE;
+        }
 
         /*
          * No point in finding a key and decrypting if the frame is neither
@@ -592,6 +648,16 @@ ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
 
         if (!is_multicast_ether_addr(hdr->addr1) && stakey) {
                 rx->key = stakey;
+        } else if (mmie_keyidx >= 0) {
+                /* Broadcast/multicast robust management frame / BIP */
+                if ((rx->status->flag & RX_FLAG_DECRYPTED) &&
+                    (rx->status->flag & RX_FLAG_IV_STRIPPED))
+                        return RX_CONTINUE;
+
+                if (mmie_keyidx < NUM_DEFAULT_KEYS ||
+                    mmie_keyidx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS)
+                        return RX_DROP_MONITOR; /* unexpected BIP keyidx */
+                rx->key = rcu_dereference(rx->sdata->keys[mmie_keyidx]);
         } else {
                 /*
                  * The device doesn't give us the IV so we won't be
@@ -654,6 +720,9 @@ ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
         case ALG_CCMP:
                 result = ieee80211_crypto_ccmp_decrypt(rx);
                 break;
+        case ALG_AES_CMAC:
+                result = ieee80211_crypto_aes_cmac_decrypt(rx);
+                break;
         }
 
         /* either the frame has been decrypted or will be dropped */
@@ -662,6 +731,39 @@ ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
         return result;
 }
 
+static ieee80211_rx_result debug_noinline
+ieee80211_rx_h_check_more_data(struct ieee80211_rx_data *rx)
+{
+        struct ieee80211_local *local;
+        struct ieee80211_hdr *hdr;
+        struct sk_buff *skb;
+
+        local = rx->local;
+        skb = rx->skb;
+        hdr = (struct ieee80211_hdr *) skb->data;
+
+        if (!local->pspolling)
+                return RX_CONTINUE;
+
+        if (!ieee80211_has_fromds(hdr->frame_control))
+                /* this is not from AP */
+                return RX_CONTINUE;
+
+        if (!ieee80211_is_data(hdr->frame_control))
+                return RX_CONTINUE;
+
+        if (!ieee80211_has_moredata(hdr->frame_control)) {
+                /* AP has no more frames buffered for us */
+                local->pspolling = false;
+                return RX_CONTINUE;
+        }
+
+        /* more data bit is set, let's request a new frame from the AP */
+        ieee80211_send_pspoll(local, rx->sdata);
+
+        return RX_CONTINUE;
+}
+
 static void ap_sta_ps_start(struct sta_info *sta)
 {
         struct ieee80211_sub_if_data *sdata = sta->sdata;
@@ -1101,6 +1203,15 @@ ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc)
         /* Drop unencrypted frames if key is set. */
         if (unlikely(!ieee80211_has_protected(fc) &&
                      !ieee80211_is_nullfunc(fc) &&
+                     (!ieee80211_is_mgmt(fc) ||
+                      (ieee80211_is_unicast_robust_mgmt_frame(rx->skb) &&
+                       rx->sta && test_sta_flags(rx->sta, WLAN_STA_MFP))) &&
+                     (rx->key || rx->sdata->drop_unencrypted)))
+                return -EACCES;
+        /* BIP does not use Protected field, so need to check MMIE */
+        if (unlikely(rx->sta && test_sta_flags(rx->sta, WLAN_STA_MFP) &&
+                     ieee80211_is_multicast_robust_mgmt_frame(rx->skb) &&
+                     ieee80211_get_mmie_keyidx(rx->skb) < 0 &&
                      (rx->key || rx->sdata->drop_unencrypted)))
                 return -EACCES;
 
@@ -1138,12 +1249,12 @@ ieee80211_data_to_8023(struct ieee80211_rx_data *rx)
 
         switch (hdr->frame_control &
                 cpu_to_le16(IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) {
-        case __constant_cpu_to_le16(IEEE80211_FCTL_TODS):
+        case cpu_to_le16(IEEE80211_FCTL_TODS):
                 if (unlikely(sdata->vif.type != NL80211_IFTYPE_AP &&
                              sdata->vif.type != NL80211_IFTYPE_AP_VLAN))
                         return -1;
                 break;
-        case __constant_cpu_to_le16(IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS):
+        case cpu_to_le16(IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS):
                 if (unlikely(sdata->vif.type != NL80211_IFTYPE_WDS &&
                              sdata->vif.type != NL80211_IFTYPE_MESH_POINT))
                         return -1;
@@ -1157,13 +1268,13 @@ ieee80211_data_to_8023(struct ieee80211_rx_data *rx)
                         }
                 }
                 break;
-        case __constant_cpu_to_le16(IEEE80211_FCTL_FROMDS):
+        case cpu_to_le16(IEEE80211_FCTL_FROMDS):
                 if (sdata->vif.type != NL80211_IFTYPE_STATION ||
                     (is_multicast_ether_addr(dst) &&
                      !compare_ether_addr(src, dev->dev_addr)))
                         return -1;
                 break;
-        case __constant_cpu_to_le16(0):
+        case cpu_to_le16(0):
                 if (sdata->vif.type != NL80211_IFTYPE_ADHOC)
                         return -1;
                 break;
@@ -1267,10 +1378,37 @@ ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
         }
 
         if (skb) {
-                /* deliver to local stack */
-                skb->protocol = eth_type_trans(skb, dev);
-                memset(skb->cb, 0, sizeof(skb->cb));
-                netif_rx(skb);
+                int align __maybe_unused;
+
+#if defined(CONFIG_MAC80211_DEBUG_PACKET_ALIGNMENT) || !defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS)
+                /*
+                 * 'align' will only take the values 0 or 2 here
+                 * since all frames are required to be aligned
+                 * to 2-byte boundaries when being passed to
+                 * mac80211. That also explains the __skb_push()
+                 * below.
+                 */
+                align = (unsigned long)skb->data & 4;
+                if (align) {
+                        if (WARN_ON(skb_headroom(skb) < 3)) {
+                                dev_kfree_skb(skb);
+                                skb = NULL;
+                        } else {
+                                u8 *data = skb->data;
+                                size_t len = skb->len;
+                                u8 *new = __skb_push(skb, align);
+                                memmove(new, data, len);
+                                __skb_trim(skb, len);
+                        }
+                }
+#endif
+
+                if (skb) {
+                        /* deliver to local stack */
+                        skb->protocol = eth_type_trans(skb, dev);
+                        memset(skb->cb, 0, sizeof(skb->cb));
+                        netif_rx(skb);
+                }
         }
 
         if (xmit_skb) {
@@ -1339,14 +1477,20 @@ ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
                 if (remaining <= subframe_len + padding)
                         frame = skb;
                 else {
-                        frame = dev_alloc_skb(local->hw.extra_tx_headroom +
-                                              subframe_len);
+                        /*
+                         * Allocate and reserve two bytes more for payload
+                         * alignment since sizeof(struct ethhdr) is 14.
+                         */
+                        frame = dev_alloc_skb(
+                                ALIGN(local->hw.extra_tx_headroom, 4) +
+                                subframe_len + 2);
 
                         if (frame == NULL)
                                 return RX_DROP_UNUSABLE;
 
-                        skb_reserve(frame, local->hw.extra_tx_headroom +
-                                    sizeof(struct ethhdr));
+                        skb_reserve(frame,
+                                    ALIGN(local->hw.extra_tx_headroom, 4) +
+                                    sizeof(struct ethhdr) + 2);
                         memcpy(skb_put(frame, ntohs(len)), skb->data,
                                 ntohs(len));
 
@@ -1529,11 +1673,9 @@ ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx)
                 start_seq_num = le16_to_cpu(bar->start_seq_num) >> 4;
 
                 /* reset session timer */
-                if (tid_agg_rx->timeout) {
-                        unsigned long expires =
-                                jiffies + (tid_agg_rx->timeout / 1000) * HZ;
-                        mod_timer(&tid_agg_rx->session_timer, expires);
-                }
+                if (tid_agg_rx->timeout)
+                        mod_timer(&tid_agg_rx->session_timer,
+                                  TU_TO_EXP_TIME(tid_agg_rx->timeout));
 
                 /* manage reordering buffer according to requested */
                 /* sequence number */
@@ -1547,12 +1689,65 @@ ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx)
         return RX_CONTINUE;
 }
 
+static void ieee80211_process_sa_query_req(struct ieee80211_sub_if_data *sdata,
+                                           struct ieee80211_mgmt *mgmt,
+                                           size_t len)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct sk_buff *skb;
+        struct ieee80211_mgmt *resp;
+
+        if (compare_ether_addr(mgmt->da, sdata->dev->dev_addr) != 0) {
+                /* Not to own unicast address */
+                return;
+        }
+
+        if (compare_ether_addr(mgmt->sa, sdata->u.sta.bssid) != 0 ||
+            compare_ether_addr(mgmt->bssid, sdata->u.sta.bssid) != 0) {
+                /* Not from the current AP. */
+                return;
+        }
+
+        if (sdata->u.sta.state == IEEE80211_STA_MLME_ASSOCIATE) {
+                /* Association in progress; ignore SA Query */
+                return;
+        }
+
+        if (len < 24 + 1 + sizeof(resp->u.action.u.sa_query)) {
+                /* Too short SA Query request frame */
+                return;
+        }
+
+        skb = dev_alloc_skb(sizeof(*resp) + local->hw.extra_tx_headroom);
+        if (skb == NULL)
+                return;
+
+        skb_reserve(skb, local->hw.extra_tx_headroom);
+        resp = (struct ieee80211_mgmt *) skb_put(skb, 24);
+        memset(resp, 0, 24);
+        memcpy(resp->da, mgmt->sa, ETH_ALEN);
+        memcpy(resp->sa, sdata->dev->dev_addr, ETH_ALEN);
+        memcpy(resp->bssid, sdata->u.sta.bssid, ETH_ALEN);
+        resp->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
+                                          IEEE80211_STYPE_ACTION);
+        skb_put(skb, 1 + sizeof(resp->u.action.u.sa_query));
+        resp->u.action.category = WLAN_CATEGORY_SA_QUERY;
+        resp->u.action.u.sa_query.action = WLAN_ACTION_SA_QUERY_RESPONSE;
+        memcpy(resp->u.action.u.sa_query.trans_id,
+               mgmt->u.action.u.sa_query.trans_id,
+               WLAN_SA_QUERY_TR_ID_LEN);
+
+        ieee80211_tx_skb(sdata, skb, 1);
+}
+
 static ieee80211_rx_result debug_noinline
 ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
 {
         struct ieee80211_local *local = rx->local;
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(rx->dev);
+        struct ieee80211_if_sta *ifsta = &sdata->u.sta;
         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
+        struct ieee80211_bss *bss;
         int len = rx->skb->len;
 
         if (!ieee80211_is_action(mgmt->frame_control))
@@ -1564,12 +1759,26 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
         if (!(rx->flags & IEEE80211_RX_RA_MATCH))
                 return RX_DROP_MONITOR;
 
+        if (ieee80211_drop_unencrypted(rx, mgmt->frame_control))
+                return RX_DROP_MONITOR;
+
         /* all categories we currently handle have action_code */
         if (len < IEEE80211_MIN_ACTION_SIZE + 1)
                 return RX_DROP_MONITOR;
 
         switch (mgmt->u.action.category) {
         case WLAN_CATEGORY_BACK:
+                /*
+                 * The aggregation code is not prepared to handle
+                 * anything but STA/AP due to the BSSID handling;
+                 * IBSS could work in the code but isn't supported
+                 * by drivers or the standard.
+                 */
+                if (sdata->vif.type != NL80211_IFTYPE_STATION &&
+                    sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
+                    sdata->vif.type != NL80211_IFTYPE_AP)
+                        return RX_DROP_MONITOR;
+
                 switch (mgmt->u.action.u.addba_req.action_code) {
                 case WLAN_ACTION_ADDBA_REQ:
                         if (len < (IEEE80211_MIN_ACTION_SIZE +
@@ -1601,6 +1810,42 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
                                 return RX_DROP_MONITOR;
                         ieee80211_process_measurement_req(sdata, mgmt, len);
                         break;
+                case WLAN_ACTION_SPCT_CHL_SWITCH:
+                        if (len < (IEEE80211_MIN_ACTION_SIZE +
+                                   sizeof(mgmt->u.action.u.chan_switch)))
+                                return RX_DROP_MONITOR;
+
+                        if (memcmp(mgmt->bssid, ifsta->bssid, ETH_ALEN) != 0)
+                                return RX_DROP_MONITOR;
+
+                        bss = ieee80211_rx_bss_get(local, ifsta->bssid,
+                                           local->hw.conf.channel->center_freq,
+                                           ifsta->ssid, ifsta->ssid_len);
+                        if (!bss)
+                                return RX_DROP_MONITOR;
+
+                        ieee80211_process_chanswitch(sdata,
+                                     &mgmt->u.action.u.chan_switch.sw_elem, bss);
+                        ieee80211_rx_bss_put(local, bss);
+                        break;
+                }
+                break;
+        case WLAN_CATEGORY_SA_QUERY:
+                if (len < (IEEE80211_MIN_ACTION_SIZE +
+                           sizeof(mgmt->u.action.u.sa_query)))
+                        return RX_DROP_MONITOR;
+                switch (mgmt->u.action.u.sa_query.action) {
+                case WLAN_ACTION_SA_QUERY_REQUEST:
+                        if (sdata->vif.type != NL80211_IFTYPE_STATION)
+                                return RX_DROP_MONITOR;
+                        ieee80211_process_sa_query_req(sdata, mgmt, len);
+                        break;
+                case WLAN_ACTION_SA_QUERY_RESPONSE:
+                        /*
+                         * SA Query response is currently only used in AP mode
+                         * and it is processed in user space.
+                         */
+                        return RX_CONTINUE;
                 }
                 break;
         default:
@@ -1616,10 +1861,14 @@ static ieee80211_rx_result debug_noinline
 ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(rx->dev);
+        struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
 
         if (!(rx->flags & IEEE80211_RX_RA_MATCH))
                 return RX_DROP_MONITOR;
 
+        if (ieee80211_drop_unencrypted(rx, mgmt->frame_control))
+                return RX_DROP_MONITOR;
+
         if (ieee80211_vif_is_mesh(&sdata->vif))
                 return ieee80211_mesh_rx_mgmt(sdata, rx->skb, rx->status);
 
@@ -1780,6 +2029,7 @@ static void ieee80211_invoke_rx_handlers(struct ieee80211_sub_if_data *sdata,
         CALL_RXH(ieee80211_rx_h_passive_scan)
         CALL_RXH(ieee80211_rx_h_check)
         CALL_RXH(ieee80211_rx_h_decrypt)
+        CALL_RXH(ieee80211_rx_h_check_more_data)
         CALL_RXH(ieee80211_rx_h_sta_process)
         CALL_RXH(ieee80211_rx_h_defragment)
         CALL_RXH(ieee80211_rx_h_ps_poll)
@@ -1823,9 +2073,10 @@ static void ieee80211_invoke_rx_handlers(struct ieee80211_sub_if_data *sdata,
 /* main receive path */
 
 static int prepare_for_handlers(struct ieee80211_sub_if_data *sdata,
-                                u8 *bssid, struct ieee80211_rx_data *rx,
+                                struct ieee80211_rx_data *rx,
                                 struct ieee80211_hdr *hdr)
 {
+        u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len, sdata->vif.type);
         int multicast = is_multicast_ether_addr(hdr->addr1);
 
         switch (sdata->vif.type) {
@@ -1928,7 +2179,6 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
         int prepares;
         struct ieee80211_sub_if_data *prev = NULL;
         struct sk_buff *skb_new;
-        u8 *bssid;
 
         hdr = (struct ieee80211_hdr *)skb->data;
         memset(&rx, 0, sizeof(rx));
@@ -1956,7 +2206,7 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
                 rx.flags |= IEEE80211_RX_IN_SCAN;
 
         ieee80211_parse_qos(&rx);
-        ieee80211_verify_ip_alignment(&rx);
+        ieee80211_verify_alignment(&rx);
 
         skb = rx.skb;
 
@@ -1967,9 +2217,8 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
                 if (sdata->vif.type == NL80211_IFTYPE_MONITOR)
                         continue;
 
-                bssid = ieee80211_get_bssid(hdr, skb->len, sdata->vif.type);
                 rx.flags |= IEEE80211_RX_RA_MATCH;
-                prepares = prepare_for_handlers(sdata, bssid, &rx, hdr);
+                prepares = prepare_for_handlers(sdata, &rx, hdr);
 
                 if (!prepares)
                         continue;
@@ -2174,11 +2423,9 @@ static u8 ieee80211_rx_reorder_ampdu(struct ieee80211_local *local,
         /* new un-ordered ampdu frame - process it */
 
         /* reset session timer */
-        if (tid_agg_rx->timeout) {
-                unsigned long expires =
-                        jiffies + (tid_agg_rx->timeout / 1000) * HZ;
-                mod_timer(&tid_agg_rx->session_timer, expires);
-        }
+        if (tid_agg_rx->timeout)
+                mod_timer(&tid_agg_rx->session_timer,
+                          TU_TO_EXP_TIME(tid_agg_rx->timeout));
 
         /* if this mpdu is fragmented - terminate rx aggregation session */
         sc = le16_to_cpu(hdr->seq_ctrl);
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index f5c7c3371929..f883ab9f1e6e 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -12,14 +12,11 @@
  * published by the Free Software Foundation.
  */
 
-/* TODO:
- * order BSS list by RSSI(?) ("quality of AP")
- * scan result table filtering (by capability (privacy, IBSS/BSS, WPA/RSN IE,
- *    SSID)
- */
+/* TODO: figure out how to avoid that the "current BSS" expires */
 
 #include <linux/wireless.h>
 #include <linux/if_arp.h>
+#include <linux/rtnetlink.h>
 #include <net/mac80211.h>
 #include <net/iw_handler.h>
 
@@ -30,192 +27,29 @@
 #define IEEE80211_CHANNEL_TIME (HZ / 33)
 #define IEEE80211_PASSIVE_CHANNEL_TIME (HZ / 5)
 
-void ieee80211_rx_bss_list_init(struct ieee80211_local *local)
-{
-        spin_lock_init(&local->bss_lock);
-        INIT_LIST_HEAD(&local->bss_list);
-}
-
-void ieee80211_rx_bss_list_deinit(struct ieee80211_local *local)
-{
-        struct ieee80211_bss *bss, *tmp;
-
-        list_for_each_entry_safe(bss, tmp, &local->bss_list, list)
-                ieee80211_rx_bss_put(local, bss);
-}
-
 struct ieee80211_bss *
 ieee80211_rx_bss_get(struct ieee80211_local *local, u8 *bssid, int freq,
                      u8 *ssid, u8 ssid_len)
 {
-        struct ieee80211_bss *bss;
-
-        spin_lock_bh(&local->bss_lock);
-        bss = local->bss_hash[STA_HASH(bssid)];
-        while (bss) {
-                if (!bss_mesh_cfg(bss) &&
-                    !memcmp(bss->bssid, bssid, ETH_ALEN) &&
-                    bss->freq == freq &&
-                    bss->ssid_len == ssid_len &&
-                    (ssid_len == 0 || !memcmp(bss->ssid, ssid, ssid_len))) {
-                        atomic_inc(&bss->users);
-                        break;
-                }
-                bss = bss->hnext;
-        }
-        spin_unlock_bh(&local->bss_lock);
-        return bss;
-}
-
-/* Caller must hold local->bss_lock */
-static void __ieee80211_rx_bss_hash_add(struct ieee80211_local *local,
-                                        struct ieee80211_bss *bss)
-{
-        u8 hash_idx;
-
-        if (bss_mesh_cfg(bss))
-                hash_idx = mesh_id_hash(bss_mesh_id(bss),
-                                        bss_mesh_id_len(bss));
-        else
-                hash_idx = STA_HASH(bss->bssid);
-
-        bss->hnext = local->bss_hash[hash_idx];
-        local->bss_hash[hash_idx] = bss;
-}
-
-/* Caller must hold local->bss_lock */
-static void __ieee80211_rx_bss_hash_del(struct ieee80211_local *local,
-                                        struct ieee80211_bss *bss)
-{
-        struct ieee80211_bss *b, *prev = NULL;
-        b = local->bss_hash[STA_HASH(bss->bssid)];
-        while (b) {
-                if (b == bss) {
-                        if (!prev)
-                                local->bss_hash[STA_HASH(bss->bssid)] =
-                                        bss->hnext;
-                        else
-                                prev->hnext = bss->hnext;
-                        break;
-                }
-                prev = b;
-                b = b->hnext;
-        }
-}
-
-struct ieee80211_bss *
-ieee80211_rx_bss_add(struct ieee80211_local *local, u8 *bssid, int freq,
-                     u8 *ssid, u8 ssid_len)
-{
-        struct ieee80211_bss *bss;
-
-        bss = kzalloc(sizeof(*bss), GFP_ATOMIC);
-        if (!bss)
-                return NULL;
-        atomic_set(&bss->users, 2);
-        memcpy(bss->bssid, bssid, ETH_ALEN);
-        bss->freq = freq;
-        if (ssid && ssid_len <= IEEE80211_MAX_SSID_LEN) {
-                memcpy(bss->ssid, ssid, ssid_len);
-                bss->ssid_len = ssid_len;
-        }
-
-        spin_lock_bh(&local->bss_lock);
-        /* TODO: order by RSSI? */
-        list_add_tail(&bss->list, &local->bss_list);
-        __ieee80211_rx_bss_hash_add(local, bss);
-        spin_unlock_bh(&local->bss_lock);
-        return bss;
-}
-
-#ifdef CONFIG_MAC80211_MESH
-static struct ieee80211_bss *
-ieee80211_rx_mesh_bss_get(struct ieee80211_local *local, u8 *mesh_id, int mesh_id_len,
-                          u8 *mesh_cfg, int freq)
-{
-        struct ieee80211_bss *bss;
-
-        spin_lock_bh(&local->bss_lock);
-        bss = local->bss_hash[mesh_id_hash(mesh_id, mesh_id_len)];
-        while (bss) {
-                if (bss_mesh_cfg(bss) &&
-                    !memcmp(bss_mesh_cfg(bss), mesh_cfg, MESH_CFG_CMP_LEN) &&
-                    bss->freq == freq &&
-                    mesh_id_len == bss->mesh_id_len &&
-                    (mesh_id_len == 0 || !memcmp(bss->mesh_id, mesh_id,
-                                                 mesh_id_len))) {
-                        atomic_inc(&bss->users);
-                        break;
-                }
-                bss = bss->hnext;
-        }
-        spin_unlock_bh(&local->bss_lock);
-        return bss;
+        return (void *)cfg80211_get_bss(local->hw.wiphy,
+                                        ieee80211_get_channel(local->hw.wiphy,
+                                                              freq),
+                                        bssid, ssid, ssid_len,
+                                        0, 0);
 }
 
-static struct ieee80211_bss *
-ieee80211_rx_mesh_bss_add(struct ieee80211_local *local, u8 *mesh_id, int mesh_id_len,
-                          u8 *mesh_cfg, int mesh_config_len, int freq)
+static void ieee80211_rx_bss_free(struct cfg80211_bss *cbss)
 {
-        struct ieee80211_bss *bss;
-
-        if (mesh_config_len != IEEE80211_MESH_CONFIG_LEN)
-                return NULL;
-
-        bss = kzalloc(sizeof(*bss), GFP_ATOMIC);
-        if (!bss)
-                return NULL;
-
-        bss->mesh_cfg = kmalloc(MESH_CFG_CMP_LEN, GFP_ATOMIC);
-        if (!bss->mesh_cfg) {
-                kfree(bss);
-                return NULL;
-        }
-
-        if (mesh_id_len && mesh_id_len <= IEEE80211_MAX_MESH_ID_LEN) {
-                bss->mesh_id = kmalloc(mesh_id_len, GFP_ATOMIC);
-                if (!bss->mesh_id) {
-                        kfree(bss->mesh_cfg);
-                        kfree(bss);
-                        return NULL;
-                }
-                memcpy(bss->mesh_id, mesh_id, mesh_id_len);
-        }
+        struct ieee80211_bss *bss = (void *)cbss;
 
-        atomic_set(&bss->users, 2);
-        memcpy(bss->mesh_cfg, mesh_cfg, MESH_CFG_CMP_LEN);
-        bss->mesh_id_len = mesh_id_len;
-        bss->freq = freq;
-        spin_lock_bh(&local->bss_lock);
-        /* TODO: order by RSSI? */
-        list_add_tail(&bss->list, &local->bss_list);
-        __ieee80211_rx_bss_hash_add(local, bss);
-        spin_unlock_bh(&local->bss_lock);
-        return bss;
-}
-#endif
-
-static void ieee80211_rx_bss_free(struct ieee80211_bss *bss)
-{
-        kfree(bss->ies);
         kfree(bss_mesh_id(bss));
         kfree(bss_mesh_cfg(bss));
-        kfree(bss);
 }
 
 void ieee80211_rx_bss_put(struct ieee80211_local *local,
                           struct ieee80211_bss *bss)
 {
-        local_bh_disable();
-        if (!atomic_dec_and_lock(&bss->users, &local->bss_lock)) {
-                local_bh_enable();
-                return;
-        }
-
-        __ieee80211_rx_bss_hash_del(local, bss);
-        list_del(&bss->list);
-        spin_unlock_bh(&local->bss_lock);
-        ieee80211_rx_bss_free(bss);
+        cfg80211_put_bss((struct cfg80211_bss *)bss);
 }
 
 struct ieee80211_bss *
@@ -224,49 +58,37 @@ ieee80211_bss_info_update(struct ieee80211_local *local,
                           struct ieee80211_mgmt *mgmt,
                           size_t len,
                           struct ieee802_11_elems *elems,
-                          int freq, bool beacon)
+                          struct ieee80211_channel *channel,
+                          bool beacon)
 {
         struct ieee80211_bss *bss;
         int clen;
-
-#ifdef CONFIG_MAC80211_MESH
-        if (elems->mesh_config)
-                bss = ieee80211_rx_mesh_bss_get(local, elems->mesh_id,
-                                elems->mesh_id_len, elems->mesh_config, freq);
-        else
-#endif
-                bss = ieee80211_rx_bss_get(local, mgmt->bssid, freq,
-                                           elems->ssid, elems->ssid_len);
-        if (!bss) {
-#ifdef CONFIG_MAC80211_MESH
-                if (elems->mesh_config)
-                        bss = ieee80211_rx_mesh_bss_add(local, elems->mesh_id,
-                                elems->mesh_id_len, elems->mesh_config,
-                                elems->mesh_config_len, freq);
-                else
-#endif
-                        bss = ieee80211_rx_bss_add(local, mgmt->bssid, freq,
-                                                  elems->ssid, elems->ssid_len);
-                if (!bss)
-                        return NULL;
-        } else {
-#if 0
-                /* TODO: order by RSSI? */
-                spin_lock_bh(&local->bss_lock);
-                list_move_tail(&bss->list, &local->bss_list);
-                spin_unlock_bh(&local->bss_lock);
-#endif
+        enum cfg80211_signal_type sigtype = CFG80211_SIGNAL_TYPE_NONE;
+        s32 signal = 0;
+
+        if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM) {
+                sigtype = CFG80211_SIGNAL_TYPE_MBM;
+                signal = rx_status->signal * 100;
+        } else if (local->hw.flags & IEEE80211_HW_SIGNAL_UNSPEC) {
+                sigtype = CFG80211_SIGNAL_TYPE_UNSPEC;
+                signal = (rx_status->signal * 100) / local->hw.max_signal;
         }
 
+        bss = (void *)cfg80211_inform_bss_frame(local->hw.wiphy, channel,
+                                                mgmt, len, signal, sigtype,
+                                                GFP_ATOMIC);
+
+        if (!bss)
+                return NULL;
+
+        bss->cbss.free_priv = ieee80211_rx_bss_free;
+
         /* save the ERP value so that it is available at association time */
         if (elems->erp_info && elems->erp_info_len >= 1) {
                 bss->erp_value = elems->erp_info[0];
                 bss->has_erp_value = 1;
         }
 
-        bss->beacon_int = le16_to_cpu(mgmt->u.beacon.beacon_int);
-        bss->capability = le16_to_cpu(mgmt->u.beacon.capab_info);
-
         if (elems->tim) {
                 struct ieee80211_tim_ie *tim_ie =
                         (struct ieee80211_tim_ie *)elems->tim;
@@ -295,37 +117,27 @@ ieee80211_bss_info_update(struct ieee80211_local *local,
                 bss->supp_rates_len += clen;
         }
 
-        bss->band = rx_status->band;
-
-        bss->timestamp = le64_to_cpu(mgmt->u.beacon.timestamp);
-        bss->last_update = jiffies;
-        bss->signal = rx_status->signal;
-        bss->noise = rx_status->noise;
-        bss->qual = rx_status->qual;
         bss->wmm_used = elems->wmm_param || elems->wmm_info;
 
         if (!beacon)
                 bss->last_probe_resp = jiffies;
 
-        /*
-         * For probe responses, or if we don't have any information yet,
-         * use the IEs from the beacon.
-         */
-        if (!bss->ies || !beacon) {
-                if (bss->ies == NULL || bss->ies_len < elems->total_len) {
-                        kfree(bss->ies);
-                        bss->ies = kmalloc(elems->total_len, GFP_ATOMIC);
-                }
-                if (bss->ies) {
-                        memcpy(bss->ies, elems->ie_start, elems->total_len);
-                        bss->ies_len = elems->total_len;
-                } else
-                        bss->ies_len = 0;
-        }
-
         return bss;
 }
 
+void ieee80211_rx_bss_remove(struct ieee80211_sub_if_data *sdata, u8 *bssid,
+                             int freq, u8 *ssid, u8 ssid_len)
+{
+        struct ieee80211_bss *bss;
+        struct ieee80211_local *local = sdata->local;
+
+        bss = ieee80211_rx_bss_get(local, bssid, freq, ssid, ssid_len);
+        if (bss) {
+                cfg80211_unlink_bss(local->hw.wiphy, (void *)bss);
+                ieee80211_rx_bss_put(local, bss);
+        }
+}
+
 ieee80211_rx_result
 ieee80211_scan_rx(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb,
                   struct ieee80211_rx_status *rx_status)
@@ -387,7 +199,7 @@ ieee80211_scan_rx(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb,
 
         bss = ieee80211_bss_info_update(sdata->local, rx_status,
                                         mgmt, skb->len, &elems,
-                                        freq, beacon);
+                                        channel, beacon);
         if (bss)
                 ieee80211_rx_bss_put(sdata->local, bss);
 
@@ -395,7 +207,7 @@ ieee80211_scan_rx(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb,
         return RX_QUEUED;
 }
 
-static void ieee80211_send_nullfunc(struct ieee80211_local *local,
+void ieee80211_send_nullfunc(struct ieee80211_local *local,
                                     struct ieee80211_sub_if_data *sdata,
                                     int powersave)
 {
@@ -425,26 +237,22 @@ static void ieee80211_send_nullfunc(struct ieee80211_local *local,
         ieee80211_tx_skb(sdata, skb, 0);
 }
 
-void ieee80211_scan_completed(struct ieee80211_hw *hw)
+void ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted)
 {
         struct ieee80211_local *local = hw_to_local(hw);
         struct ieee80211_sub_if_data *sdata;
-        union iwreq_data wrqu;
 
         if (WARN_ON(!local->hw_scanning && !local->sw_scanning))
                 return;
 
-        local->last_scan_completed = jiffies;
-        memset(&wrqu, 0, sizeof(wrqu));
+        if (WARN_ON(!local->scan_req))
+                return;
 
-        /*
-         * local->scan_sdata could have been NULLed by the interface
-         * down code in case we were scanning on an interface that is
-         * being taken down.
-         */
-        sdata = local->scan_sdata;
-        if (sdata)
-                wireless_send_event(sdata->dev, SIOCGIWSCAN, &wrqu, NULL);
+        if (local->scan_req != &local->int_scan_req)
+                cfg80211_scan_done(local->scan_req, aborted);
+        local->scan_req = NULL;
+
+        local->last_scan_completed = jiffies;
 
         if (local->hw_scanning) {
                 local->hw_scanning = false;
@@ -472,8 +280,11 @@ void ieee80211_scan_completed(struct ieee80211_hw *hw)
         netif_addr_unlock(local->mdev);
         netif_tx_unlock_bh(local->mdev);
 
-        rcu_read_lock();
-        list_for_each_entry_rcu(sdata, &local->interfaces, list) {
+        mutex_lock(&local->iflist_mtx);
+        list_for_each_entry(sdata, &local->interfaces, list) {
+                if (!netif_running(sdata->dev))
+                        continue;
+
                 /* Tell AP we're back */
                 if (sdata->vif.type == NL80211_IFTYPE_STATION) {
                         if (sdata->u.sta.flags & IEEE80211_STA_ASSOCIATED) {
@@ -482,8 +293,15 @@ void ieee80211_scan_completed(struct ieee80211_hw *hw)
                         }
                 } else
                         netif_tx_wake_all_queues(sdata->dev);
+
+                /* re-enable beaconing */
+                if (sdata->vif.type == NL80211_IFTYPE_AP ||
+                    sdata->vif.type == NL80211_IFTYPE_ADHOC ||
+                    sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
+                        ieee80211_if_config(sdata,
+                                            IEEE80211_IFCC_BEACON_ENABLED);
         }
-        rcu_read_unlock();
+        mutex_unlock(&local->iflist_mtx);
 
  done:
         ieee80211_mlme_notify_scan_completed(local);
@@ -491,15 +309,13 @@ void ieee80211_scan_completed(struct ieee80211_hw *hw)
 }
 EXPORT_SYMBOL(ieee80211_scan_completed);
 
-
 void ieee80211_scan_work(struct work_struct *work)
 {
         struct ieee80211_local *local =
                 container_of(work, struct ieee80211_local, scan_work.work);
         struct ieee80211_sub_if_data *sdata = local->scan_sdata;
-        struct ieee80211_supported_band *sband;
         struct ieee80211_channel *chan;
-        int skip;
+        int skip, i;
         unsigned long next_delay = 0;
 
         /*
@@ -510,33 +326,13 @@ void ieee80211_scan_work(struct work_struct *work)
 
         switch (local->scan_state) {
         case SCAN_SET_CHANNEL:
-                /*
-                 * Get current scan band. scan_band may be IEEE80211_NUM_BANDS
-                 * after we successfully scanned the last channel of the last
-                 * band (and the last band is supported by the hw)
-                 */
-                if (local->scan_band < IEEE80211_NUM_BANDS)
-                        sband = local->hw.wiphy->bands[local->scan_band];
-                else
-                        sband = NULL;
-
-                /*
-                 * If we are at an unsupported band and have more bands
-                 * left to scan, advance to the next supported one.
-                 */
-                while (!sband && local->scan_band < IEEE80211_NUM_BANDS - 1) {
-                        local->scan_band++;
-                        sband = local->hw.wiphy->bands[local->scan_band];
-                        local->scan_channel_idx = 0;
-                }
-
                 /* if no more bands/channels left, complete scan */
-                if (!sband || local->scan_channel_idx >= sband->n_channels) {
-                        ieee80211_scan_completed(local_to_hw(local));
+                if (local->scan_channel_idx >= local->scan_req->n_channels) {
+                        ieee80211_scan_completed(local_to_hw(local), false);
                         return;
                 }
                 skip = 0;
-                chan = &sband->channels[local->scan_channel_idx];
+                chan = local->scan_req->channels[local->scan_channel_idx];
 
                 if (chan->flags & IEEE80211_CHAN_DISABLED ||
                     (sdata->vif.type == NL80211_IFTYPE_ADHOC &&
@@ -552,15 +348,6 @@ void ieee80211_scan_work(struct work_struct *work)
 
                 /* advance state machine to next channel/band */
                 local->scan_channel_idx++;
-                if (local->scan_channel_idx >= sband->n_channels) {
-                        /*
-                         * scan_band may end up == IEEE80211_NUM_BANDS, but
-                         * we'll catch that case above and complete the scan
-                         * if that is the case.
-                         */
-                        local->scan_band++;
-                        local->scan_channel_idx = 0;
-                }
 
                 if (skip)
                         break;
@@ -573,10 +360,14 @@ void ieee80211_scan_work(struct work_struct *work)
                 next_delay = IEEE80211_PASSIVE_CHANNEL_TIME;
                 local->scan_state = SCAN_SET_CHANNEL;
 
-                if (local->scan_channel->flags & IEEE80211_CHAN_PASSIVE_SCAN)
+                if (local->scan_channel->flags & IEEE80211_CHAN_PASSIVE_SCAN ||
+                    !local->scan_req->n_ssids)
                         break;
-                ieee80211_send_probe_req(sdata, NULL, local->scan_ssid,
-                                         local->scan_ssid_len);
+                for (i = 0; i < local->scan_req->n_ssids; i++)
+                        ieee80211_send_probe_req(
+                                sdata, NULL,
+                                local->scan_req->ssids[i].ssid,
+                                local->scan_req->ssids[i].ssid_len);
                 next_delay = IEEE80211_CHANNEL_TIME;
                 break;
         }
@@ -587,14 +378,19 @@ void ieee80211_scan_work(struct work_struct *work)
 
 
 int ieee80211_start_scan(struct ieee80211_sub_if_data *scan_sdata,
-                         u8 *ssid, size_t ssid_len)
+                         struct cfg80211_scan_request *req)
 {
         struct ieee80211_local *local = scan_sdata->local;
         struct ieee80211_sub_if_data *sdata;
 
-        if (ssid_len > IEEE80211_MAX_SSID_LEN)
+        if (!req)
                 return -EINVAL;
 
+        if (local->scan_req && local->scan_req != req)
+                return -EBUSY;
+
+        local->scan_req = req;
+
         /* MLME-SCAN.request (page 118)  page 144 (11.1.3.1)
          * BSSType: INFRASTRUCTURE, INDEPENDENT, ANY_BSS
          * BSSID: MACAddress
@@ -622,7 +418,7 @@ int ieee80211_start_scan(struct ieee80211_sub_if_data *scan_sdata,
                 int rc;
 
                 local->hw_scanning = true;
-                rc = local->ops->hw_scan(local_to_hw(local), ssid, ssid_len);
+                rc = local->ops->hw_scan(local_to_hw(local), req);
                 if (rc) {
                         local->hw_scanning = false;
                         return rc;
@@ -633,8 +429,18 @@ int ieee80211_start_scan(struct ieee80211_sub_if_data *scan_sdata,
 
         local->sw_scanning = true;
 
-        rcu_read_lock();
-        list_for_each_entry_rcu(sdata, &local->interfaces, list) {
+        mutex_lock(&local->iflist_mtx);
+        list_for_each_entry(sdata, &local->interfaces, list) {
+                if (!netif_running(sdata->dev))
+                        continue;
+
+                /* disable beaconing */
+                if (sdata->vif.type == NL80211_IFTYPE_AP ||
+                    sdata->vif.type == NL80211_IFTYPE_ADHOC ||
+                    sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
+                        ieee80211_if_config(sdata,
+                                            IEEE80211_IFCC_BEACON_ENABLED);
+
                 if (sdata->vif.type == NL80211_IFTYPE_STATION) {
                         if (sdata->u.sta.flags & IEEE80211_STA_ASSOCIATED) {
                                 netif_tx_stop_all_queues(sdata->dev);
@@ -643,17 +449,12 @@ int ieee80211_start_scan(struct ieee80211_sub_if_data *scan_sdata,
                 } else
                         netif_tx_stop_all_queues(sdata->dev);
         }
-        rcu_read_unlock();
+        mutex_unlock(&local->iflist_mtx);
 
-        if (ssid) {
-                local->scan_ssid_len = ssid_len;
-                memcpy(local->scan_ssid, ssid, ssid_len);
-        } else
-                local->scan_ssid_len = 0;
         local->scan_state = SCAN_SET_CHANNEL;
         local->scan_channel_idx = 0;
-        local->scan_band = IEEE80211_BAND_2GHZ;
         local->scan_sdata = scan_sdata;
+        local->scan_req = req;
 
         netif_addr_lock_bh(local->mdev);
         local->filter_flags |= FIF_BCN_PRBRESP_PROMISC;
@@ -673,13 +474,21 @@ int ieee80211_start_scan(struct ieee80211_sub_if_data *scan_sdata,
 
 
 int ieee80211_request_scan(struct ieee80211_sub_if_data *sdata,
-                           u8 *ssid, size_t ssid_len)
+                           struct cfg80211_scan_request *req)
 {
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_if_sta *ifsta;
 
+        if (!req)
+                return -EINVAL;
+
+        if (local->scan_req && local->scan_req != req)
+                return -EBUSY;
+
+        local->scan_req = req;
+
         if (sdata->vif.type != NL80211_IFTYPE_STATION)
-                return ieee80211_start_scan(sdata, ssid, ssid_len);
+                return ieee80211_start_scan(sdata, req);
 
         /*
          * STA has a state machine that might need to defer scanning
@@ -694,241 +503,8 @@ int ieee80211_request_scan(struct ieee80211_sub_if_data *sdata,
         }
 
         ifsta = &sdata->u.sta;
-
-        ifsta->scan_ssid_len = ssid_len;
-        if (ssid_len)
-                memcpy(ifsta->scan_ssid, ssid, ssid_len);
         set_bit(IEEE80211_STA_REQ_SCAN, &ifsta->request);
         queue_work(local->hw.workqueue, &ifsta->work);
 
         return 0;
 }
-
-
-static void ieee80211_scan_add_ies(struct iw_request_info *info,
-                                   struct ieee80211_bss *bss,
-                                   char **current_ev, char *end_buf)
-{
-        u8 *pos, *end, *next;
-        struct iw_event iwe;
-
-        if (bss == NULL || bss->ies == NULL)
-                return;
-
-        /*
-         * If needed, fragment the IEs buffer (at IE boundaries) into short
-         * enough fragments to fit into IW_GENERIC_IE_MAX octet messages.
-         */
-        pos = bss->ies;
-        end = pos + bss->ies_len;
-
-        while (end - pos > IW_GENERIC_IE_MAX) {
-                next = pos + 2 + pos[1];
-                while (next + 2 + next[1] - pos < IW_GENERIC_IE_MAX)
-                        next = next + 2 + next[1];
-
-                memset(&iwe, 0, sizeof(iwe));
-                iwe.cmd = IWEVGENIE;
-                iwe.u.data.length = next - pos;
-                *current_ev = iwe_stream_add_point(info, *current_ev,
-                                                   end_buf, &iwe, pos);
-
-                pos = next;
-        }
-
-        if (end > pos) {
-                memset(&iwe, 0, sizeof(iwe));
-                iwe.cmd = IWEVGENIE;
-                iwe.u.data.length = end - pos;
-                *current_ev = iwe_stream_add_point(info, *current_ev,
-                                                   end_buf, &iwe, pos);
-        }
-}
-
-
-static char *
-ieee80211_scan_result(struct ieee80211_local *local,
-                      struct iw_request_info *info,
-                      struct ieee80211_bss *bss,
-                      char *current_ev, char *end_buf)
-{
-        struct iw_event iwe;
-        char *buf;
-
-        if (time_after(jiffies,
-                       bss->last_update + IEEE80211_SCAN_RESULT_EXPIRE))
-                return current_ev;
-
-        memset(&iwe, 0, sizeof(iwe));
-        iwe.cmd = SIOCGIWAP;
-        iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
-        memcpy(iwe.u.ap_addr.sa_data, bss->bssid, ETH_ALEN);
-        current_ev = iwe_stream_add_event(info, current_ev, end_buf, &iwe,
-                                          IW_EV_ADDR_LEN);
-
-        memset(&iwe, 0, sizeof(iwe));
-        iwe.cmd = SIOCGIWESSID;
-        if (bss_mesh_cfg(bss)) {
-                iwe.u.data.length = bss_mesh_id_len(bss);
-                iwe.u.data.flags = 1;
-                current_ev = iwe_stream_add_point(info, current_ev, end_buf,
-                                                  &iwe, bss_mesh_id(bss));
-        } else {
-                iwe.u.data.length = bss->ssid_len;
-                iwe.u.data.flags = 1;
-                current_ev = iwe_stream_add_point(info, current_ev, end_buf,
-                                                  &iwe, bss->ssid);
-        }
-
-        if (bss->capability & (WLAN_CAPABILITY_ESS | WLAN_CAPABILITY_IBSS)
-            || bss_mesh_cfg(bss)) {
-                memset(&iwe, 0, sizeof(iwe));
-                iwe.cmd = SIOCGIWMODE;
-                if (bss_mesh_cfg(bss))
-                        iwe.u.mode = IW_MODE_MESH;
-                else if (bss->capability & WLAN_CAPABILITY_ESS)
-                        iwe.u.mode = IW_MODE_MASTER;
-                else
-                        iwe.u.mode = IW_MODE_ADHOC;
-                current_ev = iwe_stream_add_event(info, current_ev, end_buf,
-                                                  &iwe, IW_EV_UINT_LEN);
-        }
-
-        memset(&iwe, 0, sizeof(iwe));
-        iwe.cmd = SIOCGIWFREQ;
-        iwe.u.freq.m = ieee80211_frequency_to_channel(bss->freq);
-        iwe.u.freq.e = 0;
-        current_ev = iwe_stream_add_event(info, current_ev, end_buf, &iwe,
-                                          IW_EV_FREQ_LEN);
-
-        memset(&iwe, 0, sizeof(iwe));
-        iwe.cmd = SIOCGIWFREQ;
-        iwe.u.freq.m = bss->freq;
-        iwe.u.freq.e = 6;
-        current_ev = iwe_stream_add_event(info, current_ev, end_buf, &iwe,
-                                          IW_EV_FREQ_LEN);
-        memset(&iwe, 0, sizeof(iwe));
-        iwe.cmd = IWEVQUAL;
-        iwe.u.qual.qual = bss->qual;
-        iwe.u.qual.level = bss->signal;
-        iwe.u.qual.noise = bss->noise;
-        iwe.u.qual.updated = local->wstats_flags;
-        current_ev = iwe_stream_add_event(info, current_ev, end_buf, &iwe,
-                                          IW_EV_QUAL_LEN);
-
-        memset(&iwe, 0, sizeof(iwe));
-        iwe.cmd = SIOCGIWENCODE;
-        if (bss->capability & WLAN_CAPABILITY_PRIVACY)
-                iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
-        else
-                iwe.u.data.flags = IW_ENCODE_DISABLED;
-        iwe.u.data.length = 0;
-        current_ev = iwe_stream_add_point(info, current_ev, end_buf,
-                                          &iwe, "");
-
-        ieee80211_scan_add_ies(info, bss, &current_ev, end_buf);
-
-        if (bss->supp_rates_len > 0) {
-                /* display all supported rates in readable format */
-                char *p = current_ev + iwe_stream_lcp_len(info);
-                int i;
-
-                memset(&iwe, 0, sizeof(iwe));
-                iwe.cmd = SIOCGIWRATE;
-                /* Those two flags are ignored... */
-                iwe.u.bitrate.fixed = iwe.u.bitrate.disabled = 0;
-
-                for (i = 0; i < bss->supp_rates_len; i++) {
-                        iwe.u.bitrate.value = ((bss->supp_rates[i] &
-                                                        0x7f) * 500000);
-                        p = iwe_stream_add_value(info, current_ev, p,
-                                        end_buf, &iwe, IW_EV_PARAM_LEN);
-                }
-                current_ev = p;
-        }
-
-        buf = kmalloc(30, GFP_ATOMIC);
-        if (buf) {
-                memset(&iwe, 0, sizeof(iwe));
-                iwe.cmd = IWEVCUSTOM;
-                sprintf(buf, "tsf=%016llx", (unsigned long long)(bss->timestamp));
-                iwe.u.data.length = strlen(buf);
-                current_ev = iwe_stream_add_point(info, current_ev, end_buf,
-                                                  &iwe, buf);
-                memset(&iwe, 0, sizeof(iwe));
-                iwe.cmd = IWEVCUSTOM;
-                sprintf(buf, " Last beacon: %dms ago",
-                        jiffies_to_msecs(jiffies - bss->last_update));
-                iwe.u.data.length = strlen(buf);
-                current_ev = iwe_stream_add_point(info, current_ev,
-                                                  end_buf, &iwe, buf);
-                kfree(buf);
-        }
-
-        if (bss_mesh_cfg(bss)) {
-                u8 *cfg = bss_mesh_cfg(bss);
-                buf = kmalloc(50, GFP_ATOMIC);
-                if (buf) {
-                        memset(&iwe, 0, sizeof(iwe));
-                        iwe.cmd = IWEVCUSTOM;
-                        sprintf(buf, "Mesh network (version %d)", cfg[0]);
-                        iwe.u.data.length = strlen(buf);
-                        current_ev = iwe_stream_add_point(info, current_ev,
-                                                          end_buf,
-                                                          &iwe, buf);
-                        sprintf(buf, "Path Selection Protocol ID: "
-                                "0x%02X%02X%02X%02X", cfg[1], cfg[2], cfg[3],
-                                                        cfg[4]);
-                        iwe.u.data.length = strlen(buf);
-                        current_ev = iwe_stream_add_point(info, current_ev,
-                                                          end_buf,
-                                                          &iwe, buf);
-                        sprintf(buf, "Path Selection Metric ID: "
-                                "0x%02X%02X%02X%02X", cfg[5], cfg[6], cfg[7],
-                                                        cfg[8]);
-                        iwe.u.data.length = strlen(buf);
-                        current_ev = iwe_stream_add_point(info, current_ev,
-                                                          end_buf,
-                                                          &iwe, buf);
-                        sprintf(buf, "Congestion Control Mode ID: "
-                                "0x%02X%02X%02X%02X", cfg[9], cfg[10],
-                                                        cfg[11], cfg[12]);
-                        iwe.u.data.length = strlen(buf);
-                        current_ev = iwe_stream_add_point(info, current_ev,
-                                                          end_buf,
-                                                          &iwe, buf);
-                        sprintf(buf, "Channel Precedence: "
-                                "0x%02X%02X%02X%02X", cfg[13], cfg[14],
-                                                        cfg[15], cfg[16]);
-                        iwe.u.data.length = strlen(buf);
-                        current_ev = iwe_stream_add_point(info, current_ev,
-                                                          end_buf,
-                                                          &iwe, buf);
-                        kfree(buf);
-                }
-        }
-
-        return current_ev;
-}
-
-
-int ieee80211_scan_results(struct ieee80211_local *local,
-                           struct iw_request_info *info,
-                           char *buf, size_t len)
-{
-        char *current_ev = buf;
-        char *end_buf = buf + len;
-        struct ieee80211_bss *bss;
-
-        spin_lock_bh(&local->bss_lock);
-        list_for_each_entry(bss, &local->bss_list, list) {
-                if (buf + len - current_ev <= IW_EV_ADDR_LEN) {
-                        spin_unlock_bh(&local->bss_lock);
-                        return -E2BIG;
-                }
-                current_ev = ieee80211_scan_result(local, info, bss,
-                                                       current_ev, end_buf);
-        }
-        spin_unlock_bh(&local->bss_lock);
-        return current_ev - buf;
-}
diff --git a/net/mac80211/spectmgmt.c b/net/mac80211/spectmgmt.c
index f72bad636d8e..47bb2aed2813 100644
--- a/net/mac80211/spectmgmt.c
+++ b/net/mac80211/spectmgmt.c
@@ -65,7 +65,7 @@ static void ieee80211_send_refuse_measurement_request(struct ieee80211_sub_if_da
                         IEEE80211_SPCT_MSR_RPRT_MODE_REFUSED;
         msr_report->u.action.u.measurement.msr_elem.type = request_ie->type;
 
-        ieee80211_tx_skb(sdata, skb, 0);
+        ieee80211_tx_skb(sdata, skb, 1);
 }
 
 void ieee80211_process_measurement_req(struct ieee80211_sub_if_data *sdata,
@@ -84,3 +84,104 @@ void ieee80211_process_measurement_req(struct ieee80211_sub_if_data *sdata,
                         mgmt->sa, mgmt->bssid,
                         mgmt->u.action.u.measurement.dialog_token);
 }
+
+void ieee80211_chswitch_work(struct work_struct *work)
+{
+        struct ieee80211_sub_if_data *sdata =
+                container_of(work, struct ieee80211_sub_if_data, u.sta.chswitch_work);
+        struct ieee80211_bss *bss;
+        struct ieee80211_if_sta *ifsta = &sdata->u.sta;
+
+        if (!netif_running(sdata->dev))
+                return;
+
+        bss = ieee80211_rx_bss_get(sdata->local, ifsta->bssid,
+                                   sdata->local->hw.conf.channel->center_freq,
+                                   ifsta->ssid, ifsta->ssid_len);
+        if (!bss)
+                goto exit;
+
+        sdata->local->oper_channel = sdata->local->csa_channel;
+        /* XXX: shouldn't really modify cfg80211-owned data! */
+        if (!ieee80211_hw_config(sdata->local, IEEE80211_CONF_CHANGE_CHANNEL))
+                bss->cbss.channel = sdata->local->oper_channel;
+
+        ieee80211_rx_bss_put(sdata->local, bss);
+exit:
+        ifsta->flags &= ~IEEE80211_STA_CSA_RECEIVED;
+        ieee80211_wake_queues_by_reason(&sdata->local->hw,
+                                        IEEE80211_QUEUE_STOP_REASON_CSA);
+}
+
+void ieee80211_chswitch_timer(unsigned long data)
+{
+        struct ieee80211_sub_if_data *sdata =
+                (struct ieee80211_sub_if_data *) data;
+        struct ieee80211_if_sta *ifsta = &sdata->u.sta;
+
+        queue_work(sdata->local->hw.workqueue, &ifsta->chswitch_work);
+}
+
+void ieee80211_process_chanswitch(struct ieee80211_sub_if_data *sdata,
+                                  struct ieee80211_channel_sw_ie *sw_elem,
+                                  struct ieee80211_bss *bss)
+{
+        struct ieee80211_channel *new_ch;
+        struct ieee80211_if_sta *ifsta = &sdata->u.sta;
+        int new_freq = ieee80211_channel_to_frequency(sw_elem->new_ch_num);
+
+        /* FIXME: Handle ADHOC later */
+        if (sdata->vif.type != NL80211_IFTYPE_STATION)
+                return;
+
+        if (ifsta->state != IEEE80211_STA_MLME_ASSOCIATED)
+                return;
+
+        if (sdata->local->sw_scanning || sdata->local->hw_scanning)
+                return;
+
+        /* Disregard subsequent beacons if we are already running a timer
+           processing a CSA */
+
+        if (ifsta->flags & IEEE80211_STA_CSA_RECEIVED)
+                return;
+
+        new_ch = ieee80211_get_channel(sdata->local->hw.wiphy, new_freq);
+        if (!new_ch || new_ch->flags & IEEE80211_CHAN_DISABLED)
+                return;
+
+        sdata->local->csa_channel = new_ch;
+
+        if (sw_elem->count <= 1) {
+                queue_work(sdata->local->hw.workqueue, &ifsta->chswitch_work);
+        } else {
+                ieee80211_stop_queues_by_reason(&sdata->local->hw,
+                                                IEEE80211_QUEUE_STOP_REASON_CSA);
+                ifsta->flags |= IEEE80211_STA_CSA_RECEIVED;
+                mod_timer(&ifsta->chswitch_timer,
+                          jiffies +
+                          msecs_to_jiffies(sw_elem->count *
+                                           bss->cbss.beacon_interval));
+        }
+}
+
+void ieee80211_handle_pwr_constr(struct ieee80211_sub_if_data *sdata,
+                                 u16 capab_info, u8 *pwr_constr_elem,
+                                 u8 pwr_constr_elem_len)
+{
+        struct ieee80211_conf *conf = &sdata->local->hw.conf;
+
+        if (!(capab_info & WLAN_CAPABILITY_SPECTRUM_MGMT))
+                return;
+
+        /* Power constraint IE length should be 1 octet */
+        if (pwr_constr_elem_len != 1)
+                return;
+
+        if ((*pwr_constr_elem <= conf->channel->max_power) &&
+            (*pwr_constr_elem != sdata->local->power_constr_level)) {
+                sdata->local->power_constr_level = *pwr_constr_elem;
+                ieee80211_hw_config(sdata->local, 0);
+        }
+}
+
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index 10c5539c20ab..634f65c0130e 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -194,12 +194,41 @@ void sta_info_destroy(struct sta_info *sta)
                 dev_kfree_skb_any(skb);
 
         for (i = 0; i <  STA_TID_NUM; i++) {
+                struct tid_ampdu_rx *tid_rx;
+                struct tid_ampdu_tx *tid_tx;
+
                 spin_lock_bh(&sta->lock);
-                if (sta->ampdu_mlme.tid_rx[i])
-                  del_timer_sync(&sta->ampdu_mlme.tid_rx[i]->session_timer);
-                if (sta->ampdu_mlme.tid_tx[i])
-                  del_timer_sync(&sta->ampdu_mlme.tid_tx[i]->addba_resp_timer);
+                tid_rx = sta->ampdu_mlme.tid_rx[i];
+                /* Make sure timer won't free the tid_rx struct, see below */
+                if (tid_rx)
+                        tid_rx->shutdown = true;
                 spin_unlock_bh(&sta->lock);
+
+                /*
+                 * Outside spinlock - shutdown is true now so that the timer
+                 * won't free tid_rx, we have to do that now. Can't let the
+                 * timer do it because we have to sync the timer outside the
+                 * lock that it takes itself.
+                 */
+                if (tid_rx) {
+                        del_timer_sync(&tid_rx->session_timer);
+                        kfree(tid_rx);
+                }
+
+                /*
+                 * No need to do such complications for TX agg sessions, the
+                 * path leading to freeing the tid_tx struct goes via a call
+                 * from the driver, and thus needs to look up the sta struct
+                 * again, which cannot be found when we get here. Hence, we
+                 * just need to delete the timer and free the aggregation
+                 * info; we won't be telling the peer about it then but that
+                 * doesn't matter if we're not talking to it again anyway.
+                 */
+                tid_tx = sta->ampdu_mlme.tid_tx[i];
+                if (tid_tx) {
+                        del_timer_sync(&tid_tx->addba_resp_timer);
+                        kfree(tid_tx);
+                }
         }
 
         __sta_info_free(local, sta);
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index e49a5b99cf10..d9653231992f 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -34,6 +34,7 @@
  * @WLAN_STA_CLEAR_PS_FILT: Clear PS filter in hardware (using the
  *      IEEE80211_TX_CTL_CLEAR_PS_FILT control flag) when the next
  *      frame to this station is transmitted.
+ * @WLAN_STA_MFP: Management frame protection is used with this STA.
  */
 enum ieee80211_sta_info_flags {
         WLAN_STA_AUTH           = 1<<0,
@@ -46,6 +47,7 @@ enum ieee80211_sta_info_flags {
         WLAN_STA_WDS            = 1<<7,
         WLAN_STA_PSPOLL         = 1<<8,
         WLAN_STA_CLEAR_PS_FILT  = 1<<9,
+        WLAN_STA_MFP            = 1<<10,
 };
 
 #define STA_TID_NUM 16
@@ -63,7 +65,6 @@ enum ieee80211_sta_info_flags {
 #define HT_AGG_STATE_OPERATIONAL        (HT_ADDBA_REQUESTED_MSK |       \
                                          HT_ADDBA_DRV_READY_MSK |       \
                                          HT_ADDBA_RECEIVED_MSK)
-#define HT_AGG_STATE_DEBUGFS_CTL        BIT(7)
 
 /**
  * struct tid_ampdu_tx - TID aggregation information (Tx).
@@ -87,7 +88,7 @@ struct tid_ampdu_tx {
  * @stored_mpdu_num: number of MPDUs in reordering buffer
  * @ssn: Starting Sequence Number expected to be aggregated.
  * @buf_size: buffer size for incoming A-MPDUs
- * @timeout: reset timer value.
+ * @timeout: reset timer value (in TUs).
  * @dialog_token: dialog token for aggregation session
  */
 struct tid_ampdu_rx {
@@ -99,6 +100,7 @@ struct tid_ampdu_rx {
         u16 buf_size;
         u16 timeout;
         u8 dialog_token;
+        bool shutdown;
 };
 
 /**
@@ -382,8 +384,6 @@ static inline u32 get_sta_flags(struct sta_info *sta)
 }
 
 
-/* Maximum number of concurrently registered stations */
-#define MAX_STA_COUNT 2007
 
 #define STA_HASH_SIZE 256
 #define STA_HASH(sta) (sta[5])
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 94de5033f0b6..33926831c648 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -35,6 +35,7 @@
 #define IEEE80211_TX_OK         0
 #define IEEE80211_TX_AGAIN      1
 #define IEEE80211_TX_FRAG_AGAIN 2
+#define IEEE80211_TX_PENDING    3
 
 /* misc utils */
 
@@ -330,6 +331,22 @@ ieee80211_tx_h_multicast_ps_buf(struct ieee80211_tx_data *tx)
         return TX_CONTINUE;
 }
 
+static int ieee80211_use_mfp(__le16 fc, struct sta_info *sta,
+                             struct sk_buff *skb)
+{
+        if (!ieee80211_is_mgmt(fc))
+                return 0;
+
+        if (sta == NULL || !test_sta_flags(sta, WLAN_STA_MFP))
+                return 0;
+
+        if (!ieee80211_is_robust_mgmt_frame((struct ieee80211_hdr *)
+                                            skb->data))
+                return 0;
+
+        return 1;
+}
+
 static ieee80211_tx_result
 ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx)
 {
@@ -409,11 +426,17 @@ ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx)
                 tx->key = NULL;
         else if (tx->sta && (key = rcu_dereference(tx->sta->key)))
                 tx->key = key;
+        else if (ieee80211_is_mgmt(hdr->frame_control) &&
+                 (key = rcu_dereference(tx->sdata->default_mgmt_key)))
+                tx->key = key;
         else if ((key = rcu_dereference(tx->sdata->default_key)))
                 tx->key = key;
         else if (tx->sdata->drop_unencrypted &&
                  (tx->skb->protocol != cpu_to_be16(ETH_P_PAE)) &&
-                 !(info->flags & IEEE80211_TX_CTL_INJECTED)) {
+                 !(info->flags & IEEE80211_TX_CTL_INJECTED) &&
+                 (!ieee80211_is_robust_mgmt_frame(hdr) ||
+                  (ieee80211_is_action(hdr->frame_control) &&
+                   tx->sta && test_sta_flags(tx->sta, WLAN_STA_MFP)))) {
                 I802_DEBUG_INC(tx->local->tx_handlers_drop_unencrypted);
                 return TX_DROP;
         } else
@@ -428,10 +451,19 @@ ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx)
                         if (ieee80211_is_auth(hdr->frame_control))
                                 break;
                 case ALG_TKIP:
-                case ALG_CCMP:
                         if (!ieee80211_is_data_present(hdr->frame_control))
                                 tx->key = NULL;
                         break;
+                case ALG_CCMP:
+                        if (!ieee80211_is_data_present(hdr->frame_control) &&
+                            !ieee80211_use_mfp(hdr->frame_control, tx->sta,
+                                               tx->skb))
+                                tx->key = NULL;
+                        break;
+                case ALG_AES_CMAC:
+                        if (!ieee80211_is_mgmt(hdr->frame_control))
+                                tx->key = NULL;
+                        break;
                 }
         }
 
@@ -787,6 +819,8 @@ ieee80211_tx_h_encrypt(struct ieee80211_tx_data *tx)
                 return ieee80211_crypto_tkip_encrypt(tx);
         case ALG_CCMP:
                 return ieee80211_crypto_ccmp_encrypt(tx);
+        case ALG_AES_CMAC:
+                return ieee80211_crypto_aes_cmac_encrypt(tx);
         }
 
         /* not reached */
@@ -1052,8 +1086,7 @@ static int __ieee80211_tx(struct ieee80211_local *local, struct sk_buff *skb,
 
         if (skb) {
                 if (netif_subqueue_stopped(local->mdev, skb))
-                        return IEEE80211_TX_AGAIN;
-                info =  IEEE80211_SKB_CB(skb);
+                        return IEEE80211_TX_PENDING;
 
                 ret = local->ops->tx(local_to_hw(local), skb);
                 if (ret)
@@ -1179,8 +1212,9 @@ retry:
                  * queues, there's no reason for a driver to reject
                  * a frame there, warn and drop it.
                  */
-                if (WARN_ON(info->flags & IEEE80211_TX_CTL_AMPDU))
-                        goto drop;
+                if (ret != IEEE80211_TX_PENDING)
+                        if (WARN_ON(info->flags & IEEE80211_TX_CTL_AMPDU))
+                                goto drop;
 
                 store = &local->pending_packet[queue];
 
@@ -1296,6 +1330,19 @@ int ieee80211_master_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 return 0;
         }
 
+        if ((local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK) &&
+            local->hw.conf.dynamic_ps_timeout > 0) {
+                if (local->hw.conf.flags & IEEE80211_CONF_PS) {
+                        ieee80211_stop_queues_by_reason(&local->hw,
+                                        IEEE80211_QUEUE_STOP_REASON_PS);
+                        queue_work(local->hw.workqueue,
+                                        &local->dynamic_ps_disable_work);
+                }
+
+                mod_timer(&local->dynamic_ps_timer, jiffies +
+                        msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout));
+        }
+
         memset(info, 0, sizeof(*info));
 
         info->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
@@ -1390,10 +1437,31 @@ int ieee80211_monitor_start_xmit(struct sk_buff *skb,
                                  struct net_device *dev)
 {
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+        struct ieee80211_channel *chan = local->hw.conf.channel;
         struct ieee80211_radiotap_header *prthdr =
                 (struct ieee80211_radiotap_header *)skb->data;
         u16 len_rthdr;
 
+        /*
+         * Frame injection is not allowed if beaconing is not allowed
+         * or if we need radar detection. Beaconing is usually not allowed when
+         * the mode or operation (Adhoc, AP, Mesh) does not support DFS.
+         * Passive scan is also used in world regulatory domains where
+         * your country is not known and as such it should be treated as
+         * NO TX unless the channel is explicitly allowed in which case
+         * your current regulatory domain would not have the passive scan
+         * flag.
+         *
+         * Since AP mode uses monitor interfaces to inject/TX management
+         * frames we can make AP mode the exception to this rule once it
+         * supports radar detection as its implementation can deal with
+         * radar detection by itself. We can do that later by adding a
+         * monitor flag interfaces used for AP support.
+         */
+        if ((chan->flags & (IEEE80211_CHAN_NO_IBSS | IEEE80211_CHAN_RADAR |
+             IEEE80211_CHAN_PASSIVE_SCAN)))
+                goto fail;
+
         /* check for not even having the fixed radiotap header part */
         if (unlikely(skb->len < sizeof(struct ieee80211_radiotap_header)))
                 goto fail; /* too short to be possibly valid */
@@ -1477,19 +1545,6 @@ int ieee80211_subif_start_xmit(struct sk_buff *skb,
                 goto fail;
         }
 
-        if (!(local->hw.flags & IEEE80211_HW_NO_STACK_DYNAMIC_PS) &&
-            local->dynamic_ps_timeout > 0) {
-                if (local->hw.conf.flags & IEEE80211_CONF_PS) {
-                        ieee80211_stop_queues_by_reason(&local->hw,
-                                                        IEEE80211_QUEUE_STOP_REASON_PS);
-                        queue_work(local->hw.workqueue,
-                                   &local->dynamic_ps_disable_work);
-                }
-
-                mod_timer(&local->dynamic_ps_timer, jiffies +
-                          msecs_to_jiffies(local->dynamic_ps_timeout));
-        }
-
         nh_pos = skb_network_header(skb) - skb->data;
         h_pos = skb_transport_header(skb) - skb->data;
 
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index fb89e1d0aa03..73c7d7345abd 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -41,6 +41,15 @@ const unsigned char rfc1042_header[] __aligned(2) =
 const unsigned char bridge_tunnel_header[] __aligned(2) =
         { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0xf8 };
 
+struct ieee80211_hw *wiphy_to_ieee80211_hw(struct wiphy *wiphy)
+{
+        struct ieee80211_local *local;
+        BUG_ON(!wiphy);
+
+        local = wiphy_priv(wiphy);
+        return &local->hw;
+}
+EXPORT_SYMBOL(wiphy_to_ieee80211_hw);
 
 u8 *ieee80211_get_bssid(struct ieee80211_hdr *hdr, size_t len,
                         enum nl80211_iftype type)
@@ -352,8 +361,8 @@ static void __ieee80211_wake_queue(struct ieee80211_hw *hw, int queue,
         }
 }
 
-void ieee80211_wake_queue_by_reason(struct ieee80211_hw *hw, int queue,
-                                    enum queue_stop_reason reason)
+static void ieee80211_wake_queue_by_reason(struct ieee80211_hw *hw, int queue,
+                                           enum queue_stop_reason reason)
 {
         struct ieee80211_local *local = hw_to_local(hw);
         unsigned long flags;
@@ -382,8 +391,8 @@ static void __ieee80211_stop_queue(struct ieee80211_hw *hw, int queue,
         netif_stop_subqueue(local->mdev, queue);
 }
 
-void ieee80211_stop_queue_by_reason(struct ieee80211_hw *hw, int queue,
-                                    enum queue_stop_reason reason)
+static void ieee80211_stop_queue_by_reason(struct ieee80211_hw *hw, int queue,
+                                           enum queue_stop_reason reason)
 {
         struct ieee80211_local *local = hw_to_local(hw);
         unsigned long flags;
@@ -459,7 +468,7 @@ void ieee80211_iterate_active_interfaces(
         struct ieee80211_local *local = hw_to_local(hw);
         struct ieee80211_sub_if_data *sdata;
 
-        rtnl_lock();
+        mutex_lock(&local->iflist_mtx);
 
         list_for_each_entry(sdata, &local->interfaces, list) {
                 switch (sdata->vif.type) {
@@ -480,7 +489,7 @@ void ieee80211_iterate_active_interfaces(
                                  &sdata->vif);
         }
 
-        rtnl_unlock();
+        mutex_unlock(&local->iflist_mtx);
 }
 EXPORT_SYMBOL_GPL(ieee80211_iterate_active_interfaces);
 
@@ -653,6 +662,10 @@ void ieee802_11_parse_elems(u8 *start, size_t len,
                         elems->pwr_constr_elem = pos;
                         elems->pwr_constr_elem_len = elen;
                         break;
+                case WLAN_EID_TIMEOUT_INTERVAL:
+                        elems->timeout_int = pos;
+                        elems->timeout_int_len = elen;
+                        break;
                 default:
                         break;
                 }
@@ -727,12 +740,12 @@ int ieee80211_set_freq(struct ieee80211_sub_if_data *sdata, int freqMHz)
         return ret;
 }
 
-u64 ieee80211_mandatory_rates(struct ieee80211_local *local,
+u32 ieee80211_mandatory_rates(struct ieee80211_local *local,
                               enum ieee80211_band band)
 {
         struct ieee80211_supported_band *sband;
         struct ieee80211_rate *bitrates;
-        u64 mandatory_rates;
+        u32 mandatory_rates;
         enum ieee80211_rate_flags mandatory_flag;
         int i;
 
diff --git a/net/mac80211/wext.c b/net/mac80211/wext.c
index 7162d5816f39..2b023dce8b24 100644
--- a/net/mac80211/wext.c
+++ b/net/mac80211/wext.c
@@ -37,7 +37,14 @@ static int ieee80211_set_encryption(struct ieee80211_sub_if_data *sdata, u8 *sta
         struct ieee80211_key *key;
         int err;
 
-        if (idx < 0 || idx >= NUM_DEFAULT_KEYS) {
+        if (alg == ALG_AES_CMAC) {
+                if (idx < NUM_DEFAULT_KEYS ||
+                    idx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS) {
+                        printk(KERN_DEBUG "%s: set_encrypt - invalid idx=%d "
+                               "(BIP)\n", sdata->dev->name, idx);
+                        return -EINVAL;
+                }
+        } else if (idx < 0 || idx >= NUM_DEFAULT_KEYS) {
                 printk(KERN_DEBUG "%s: set_encrypt - invalid idx=%d\n",
                        sdata->dev->name, idx);
                 return -EINVAL;
@@ -103,6 +110,9 @@ static int ieee80211_set_encryption(struct ieee80211_sub_if_data *sdata, u8 *sta
 
                 if (set_tx_key || (!sta && !sdata->default_key && key))
                         ieee80211_set_default_key(sdata, idx);
+                if (alg == ALG_AES_CMAC &&
+                    (set_tx_key || (!sta && !sdata->default_mgmt_key && key)))
+                        ieee80211_set_default_mgmt_key(sdata, idx);
         }
 
  out_unlock:
@@ -135,6 +145,21 @@ static int ieee80211_ioctl_siwgenie(struct net_device *dev,
         return -EOPNOTSUPP;
 }
 
+static u8 ieee80211_get_wstats_flags(struct ieee80211_local *local)
+{
+        u8 wstats_flags = 0;
+
+        wstats_flags |= local->hw.flags & (IEEE80211_HW_SIGNAL_UNSPEC |
+                                           IEEE80211_HW_SIGNAL_DBM) ?
+                                IW_QUAL_QUAL_UPDATED : IW_QUAL_QUAL_INVALID;
+        wstats_flags |= local->hw.flags & IEEE80211_HW_NOISE_DBM ?
+                                IW_QUAL_NOISE_UPDATED : IW_QUAL_NOISE_INVALID;
+        if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
+                wstats_flags |= IW_QUAL_DBM;
+
+        return wstats_flags;
+}
+
 static int ieee80211_ioctl_giwrange(struct net_device *dev,
                                  struct iw_request_info *info,
                                  struct iw_point *data, char *extra)
@@ -163,9 +188,9 @@ static int ieee80211_ioctl_giwrange(struct net_device *dev,
         range->num_encoding_sizes = 2;
         range->max_encoding_tokens = NUM_DEFAULT_KEYS;
 
-        if (local->hw.flags & IEEE80211_HW_SIGNAL_UNSPEC ||
-            local->hw.flags & IEEE80211_HW_SIGNAL_DB)
-                range->max_qual.level = local->hw.max_signal;
+        /* cfg80211 requires this, and enforces 0..100 */
+        if (local->hw.flags & IEEE80211_HW_SIGNAL_UNSPEC)
+                range->max_qual.level = 100;
         else if  (local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
                 range->max_qual.level = -110;
         else
@@ -177,13 +202,13 @@ static int ieee80211_ioctl_giwrange(struct net_device *dev,
                 range->max_qual.noise = 0;
 
         range->max_qual.qual = 100;
-        range->max_qual.updated = local->wstats_flags;
+        range->max_qual.updated = ieee80211_get_wstats_flags(local);
 
         range->avg_qual.qual = 50;
         /* not always true but better than nothing */
         range->avg_qual.level = range->max_qual.level / 2;
         range->avg_qual.noise = range->max_qual.noise / 2;
-        range->avg_qual.updated = local->wstats_flags;
+        range->avg_qual.updated = ieee80211_get_wstats_flags(local);
 
         range->enc_capa = IW_ENC_CAPA_WPA | IW_ENC_CAPA_WPA2 |
                           IW_ENC_CAPA_CIPHER_TKIP | IW_ENC_CAPA_CIPHER_CCMP;
@@ -230,13 +255,15 @@ static int ieee80211_ioctl_siwfreq(struct net_device *dev,
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
-        if (sdata->vif.type == NL80211_IFTYPE_STATION)
+        if (sdata->vif.type == NL80211_IFTYPE_ADHOC ||
+            sdata->vif.type == NL80211_IFTYPE_STATION)
                 sdata->u.sta.flags &= ~IEEE80211_STA_AUTO_CHANNEL_SEL;
 
         /* freq->e == 0: freq->m = channel; otherwise freq = m * 10^e */
         if (freq->e == 0) {
                 if (freq->m < 0) {
-                        if (sdata->vif.type == NL80211_IFTYPE_STATION)
+                        if (sdata->vif.type == NL80211_IFTYPE_ADHOC ||
+                            sdata->vif.type == NL80211_IFTYPE_STATION)
                                 sdata->u.sta.flags |=
                                         IEEE80211_STA_AUTO_CHANNEL_SEL;
                         return 0;
@@ -404,58 +431,6 @@ static int ieee80211_ioctl_giwap(struct net_device *dev,
 }
 
 
-static int ieee80211_ioctl_siwscan(struct net_device *dev,
-                                   struct iw_request_info *info,
-                                   union iwreq_data *wrqu, char *extra)
-{
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        struct iw_scan_req *req = NULL;
-        u8 *ssid = NULL;
-        size_t ssid_len = 0;
-
-        if (!netif_running(dev))
-                return -ENETDOWN;
-
-        if (sdata->vif.type != NL80211_IFTYPE_STATION &&
-            sdata->vif.type != NL80211_IFTYPE_ADHOC &&
-            sdata->vif.type != NL80211_IFTYPE_MESH_POINT)
-                return -EOPNOTSUPP;
-
-        /* if SSID was specified explicitly then use that */
-        if (wrqu->data.length == sizeof(struct iw_scan_req) &&
-            wrqu->data.flags & IW_SCAN_THIS_ESSID) {
-                req = (struct iw_scan_req *)extra;
-                ssid = req->essid;
-                ssid_len = req->essid_len;
-        }
-
-        return ieee80211_request_scan(sdata, ssid, ssid_len);
-}
-
-
-static int ieee80211_ioctl_giwscan(struct net_device *dev,
-                                   struct iw_request_info *info,
-                                   struct iw_point *data, char *extra)
-{
-        int res;
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        struct ieee80211_sub_if_data *sdata;
-
-        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-
-        if (local->sw_scanning || local->hw_scanning)
-                return -EAGAIN;
-
-        res = ieee80211_scan_results(local, info, extra, data->length);
-        if (res >= 0) {
-                data->length = res;
-                return 0;
-        }
-        data->length = 0;
-        return res;
-}
-
-
 static int ieee80211_ioctl_siwrate(struct net_device *dev,
                                   struct iw_request_info *info,
                                   struct iw_param *rate, char *extra)
@@ -549,10 +524,9 @@ static int ieee80211_ioctl_siwtxpower(struct net_device *dev,
         else /* Automatic power level setting */
                 new_power_level = chan->max_power;
 
-        if (local->hw.conf.power_level != new_power_level) {
-                local->hw.conf.power_level = new_power_level;
+        local->user_power_level = new_power_level;
+        if (local->hw.conf.power_level != new_power_level)
                 reconf_flags |= IEEE80211_CONF_CHANGE_POWER;
-        }
 
         if (local->hw.conf.radio_enabled != !(data->txpower.disabled)) {
                 local->hw.conf.radio_enabled = !(data->txpower.disabled);
@@ -836,6 +810,9 @@ static int ieee80211_ioctl_siwpower(struct net_device *dev,
         int ret = 0, timeout = 0;
         bool ps;
 
+        if (!(local->hw.flags & IEEE80211_HW_SUPPORTS_PS))
+                return -EOPNOTSUPP;
+
         if (sdata->vif.type != NL80211_IFTYPE_STATION)
                 return -EINVAL;
 
@@ -852,31 +829,49 @@ static int ieee80211_ioctl_siwpower(struct net_device *dev,
                 ps = true;
                 break;
         default:                /* Otherwise we ignore */
-                break;
+                return -EINVAL;
         }
 
+        if (wrq->flags & ~(IW_POWER_MODE | IW_POWER_TIMEOUT))
+                return -EINVAL;
+
         if (wrq->flags & IW_POWER_TIMEOUT)
                 timeout = wrq->value / 1000;
 
-set:
-        if (ps == local->powersave && timeout == local->dynamic_ps_timeout)
+ set:
+        if (ps == local->powersave && timeout == conf->dynamic_ps_timeout)
                 return ret;
 
         local->powersave = ps;
-        local->dynamic_ps_timeout = timeout;
+        conf->dynamic_ps_timeout = timeout;
 
-        if (sdata->u.sta.flags & IEEE80211_STA_ASSOCIATED) {
-                if (!(local->hw.flags & IEEE80211_HW_NO_STACK_DYNAMIC_PS) &&
-                    local->dynamic_ps_timeout > 0)
-                        mod_timer(&local->dynamic_ps_timer, jiffies +
-                                  msecs_to_jiffies(local->dynamic_ps_timeout));
-                else {
-                        if (local->powersave)
-                                conf->flags |= IEEE80211_CONF_PS;
-                        else
-                                conf->flags &= ~IEEE80211_CONF_PS;
+        if (local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_PS)
+                ret = ieee80211_hw_config(local,
+                                          IEEE80211_CONF_CHANGE_DYNPS_TIMEOUT);
+
+        if (!(sdata->u.sta.flags & IEEE80211_STA_ASSOCIATED))
+                return ret;
+
+        if (conf->dynamic_ps_timeout > 0 &&
+            !(local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_PS)) {
+                mod_timer(&local->dynamic_ps_timer, jiffies +
+                          msecs_to_jiffies(conf->dynamic_ps_timeout));
+        } else {
+                if (local->powersave) {
+                        if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK)
+                                ieee80211_send_nullfunc(local, sdata, 1);
+                        conf->flags |= IEEE80211_CONF_PS;
+                        ret = ieee80211_hw_config(local,
+                                        IEEE80211_CONF_CHANGE_PS);
+                } else {
+                        conf->flags &= ~IEEE80211_CONF_PS;
+                        ret = ieee80211_hw_config(local,
+                                        IEEE80211_CONF_CHANGE_PS);
+                        if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK)
+                                ieee80211_send_nullfunc(local, sdata, 0);
+                        del_timer_sync(&local->dynamic_ps_timer);
+                        cancel_work_sync(&local->dynamic_ps_enable_work);
                 }
-                ret = ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
         }
 
         return ret;
@@ -903,11 +898,22 @@ static int ieee80211_ioctl_siwauth(struct net_device *dev,
 
         switch (data->flags & IW_AUTH_INDEX) {
         case IW_AUTH_WPA_VERSION:
-        case IW_AUTH_CIPHER_PAIRWISE:
         case IW_AUTH_CIPHER_GROUP:
         case IW_AUTH_WPA_ENABLED:
         case IW_AUTH_RX_UNENCRYPTED_EAPOL:
         case IW_AUTH_KEY_MGMT:
+        case IW_AUTH_CIPHER_GROUP_MGMT:
+                break;
+        case IW_AUTH_CIPHER_PAIRWISE:
+                if (sdata->vif.type == NL80211_IFTYPE_STATION) {
+                        if (data->value & (IW_AUTH_CIPHER_WEP40 |
+                            IW_AUTH_CIPHER_WEP104 | IW_AUTH_CIPHER_TKIP))
+                                sdata->u.sta.flags |=
+                                        IEEE80211_STA_TKIP_WEP_USED;
+                        else
+                                sdata->u.sta.flags &=
+                                        ~IEEE80211_STA_TKIP_WEP_USED;
+                }
                 break;
         case IW_AUTH_DROP_UNENCRYPTED:
                 sdata->drop_unencrypted = !!data->value;
@@ -934,6 +940,29 @@ static int ieee80211_ioctl_siwauth(struct net_device *dev,
                 else
                         ret = -EOPNOTSUPP;
                 break;
+        case IW_AUTH_MFP:
+                if (!(sdata->local->hw.flags & IEEE80211_HW_MFP_CAPABLE)) {
+                        ret = -EOPNOTSUPP;
+                        break;
+                }
+                if (sdata->vif.type == NL80211_IFTYPE_STATION ||
+                    sdata->vif.type == NL80211_IFTYPE_ADHOC) {
+                        switch (data->value) {
+                        case IW_AUTH_MFP_DISABLED:
+                                sdata->u.sta.mfp = IEEE80211_MFP_DISABLED;
+                                break;
+                        case IW_AUTH_MFP_OPTIONAL:
+                                sdata->u.sta.mfp = IEEE80211_MFP_OPTIONAL;
+                                break;
+                        case IW_AUTH_MFP_REQUIRED:
+                                sdata->u.sta.mfp = IEEE80211_MFP_REQUIRED;
+                                break;
+                        default:
+                                ret = -EINVAL;
+                        }
+                } else
+                        ret = -EOPNOTSUPP;
+                break;
         default:
                 ret = -EOPNOTSUPP;
                 break;
@@ -965,7 +994,7 @@ static struct iw_statistics *ieee80211_get_wireless_stats(struct net_device *dev
                 wstats->qual.level = sta->last_signal;
                 wstats->qual.qual = sta->last_qual;
                 wstats->qual.noise = sta->last_noise;
-                wstats->qual.updated = local->wstats_flags;
+                wstats->qual.updated = ieee80211_get_wstats_flags(local);
         }
 
         rcu_read_unlock();
@@ -1017,6 +1046,9 @@ static int ieee80211_ioctl_siwencodeext(struct net_device *dev,
         case IW_ENCODE_ALG_CCMP:
                 alg = ALG_CCMP;
                 break;
+        case IW_ENCODE_ALG_AES_CMAC:
+                alg = ALG_AES_CMAC;
+                break;
         default:
                 return -EOPNOTSUPP;
         }
@@ -1025,20 +1057,41 @@ static int ieee80211_ioctl_siwencodeext(struct net_device *dev,
                 remove = 1;
 
         idx = erq->flags & IW_ENCODE_INDEX;
-        if (idx < 1 || idx > 4) {
-                idx = -1;
-                if (!sdata->default_key)
-                        idx = 0;
-                else for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
-                        if (sdata->default_key == sdata->keys[i]) {
-                                idx = i;
-                                break;
+        if (alg == ALG_AES_CMAC) {
+                if (idx < NUM_DEFAULT_KEYS + 1 ||
+                    idx > NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS) {
+                        idx = -1;
+                        if (!sdata->default_mgmt_key)
+                                idx = 0;
+                        else for (i = NUM_DEFAULT_KEYS;
+                                  i < NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS;
+                                  i++) {
+                                if (sdata->default_mgmt_key == sdata->keys[i])
+                                {
+                                        idx = i;
+                                        break;
+                                }
                         }
-                }
-                if (idx < 0)
-                        return -EINVAL;
-        } else
-                idx--;
+                        if (idx < 0)
+                                return -EINVAL;
+                } else
+                        idx--;
+        } else {
+                if (idx < 1 || idx > 4) {
+                        idx = -1;
+                        if (!sdata->default_key)
+                                idx = 0;
+                        else for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
+                                if (sdata->default_key == sdata->keys[i]) {
+                                        idx = i;
+                                        break;
+                                }
+                        }
+                        if (idx < 0)
+                                return -EINVAL;
+                } else
+                        idx--;
+        }
 
         return ieee80211_set_encryption(sdata, ext->addr.sa_data, idx, alg,
                                         remove,
@@ -1076,8 +1129,8 @@ static const iw_handler ieee80211_handler[] =
         (iw_handler) ieee80211_ioctl_giwap,             /* SIOCGIWAP */
         (iw_handler) ieee80211_ioctl_siwmlme,           /* SIOCSIWMLME */
         (iw_handler) NULL,                              /* SIOCGIWAPLIST */
-        (iw_handler) ieee80211_ioctl_siwscan,           /* SIOCSIWSCAN */
-        (iw_handler) ieee80211_ioctl_giwscan,           /* SIOCGIWSCAN */
+        (iw_handler) cfg80211_wext_siwscan,             /* SIOCSIWSCAN */
+        (iw_handler) cfg80211_wext_giwscan,             /* SIOCGIWSCAN */
         (iw_handler) ieee80211_ioctl_siwessid,          /* SIOCSIWESSID */
         (iw_handler) ieee80211_ioctl_giwessid,          /* SIOCGIWESSID */
         (iw_handler) NULL,                              /* SIOCSIWNICKN */
diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c
index 7aa63caf8d50..9101b48ec2ae 100644
--- a/net/mac80211/wpa.c
+++ b/net/mac80211/wpa.c
@@ -1,5 +1,6 @@
 /*
  * Copyright 2002-2004, Instant802 Networks, Inc.
+ * Copyright 2008, Jouni Malinen <j@w1.fi>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
@@ -19,6 +20,7 @@
 #include "michael.h"
 #include "tkip.h"
 #include "aes_ccm.h"
+#include "aes_cmac.h"
 #include "wpa.h"
 
 ieee80211_tx_result
@@ -266,7 +268,7 @@ static void ccmp_special_blocks(struct sk_buff *skb, u8 *pn, u8 *scratch,
                                 int encrypted)
 {
         __le16 mask_fc;
-        int a4_included;
+        int a4_included, mgmt;
         u8 qos_tid;
         u8 *b_0, *aad;
         u16 data_len, len_a;
@@ -277,12 +279,15 @@ static void ccmp_special_blocks(struct sk_buff *skb, u8 *pn, u8 *scratch,
         aad = scratch + 4 * AES_BLOCK_LEN;
 
         /*
-         * Mask FC: zero subtype b4 b5 b6
+         * Mask FC: zero subtype b4 b5 b6 (if not mgmt)
          * Retry, PwrMgt, MoreData; set Protected
          */
+        mgmt = ieee80211_is_mgmt(hdr->frame_control);
         mask_fc = hdr->frame_control;
-        mask_fc &= ~cpu_to_le16(0x0070 | IEEE80211_FCTL_RETRY |
+        mask_fc &= ~cpu_to_le16(IEEE80211_FCTL_RETRY |
                                 IEEE80211_FCTL_PM | IEEE80211_FCTL_MOREDATA);
+        if (!mgmt)
+                mask_fc &= ~cpu_to_le16(0x0070);
         mask_fc |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
 
         hdrlen = ieee80211_hdrlen(hdr->frame_control);
@@ -300,8 +305,10 @@ static void ccmp_special_blocks(struct sk_buff *skb, u8 *pn, u8 *scratch,
 
         /* First block, b_0 */
         b_0[0] = 0x59; /* flags: Adata: 1, M: 011, L: 001 */
-        /* Nonce: QoS Priority | A2 | PN */
-        b_0[1] = qos_tid;
+        /* Nonce: Nonce Flags | A2 | PN
+         * Nonce Flags: Priority (b0..b3) | Management (b4) | Reserved (b5..b7)
+         */
+        b_0[1] = qos_tid | (mgmt << 4);
         memcpy(&b_0[2], hdr->addr2, ETH_ALEN);
         memcpy(&b_0[8], pn, CCMP_PN_LEN);
         /* l(m) */
@@ -360,9 +367,14 @@ static int ccmp_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
         int hdrlen, len, tail;
         u8 *pos, *pn;
         int i;
+        bool skip_hw;
+
+        skip_hw = (tx->key->conf.flags & IEEE80211_KEY_FLAG_SW_MGMT) &&
+                ieee80211_is_mgmt(hdr->frame_control);
 
         if ((tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) &&
-            !(tx->key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV)) {
+            !(tx->key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV) &&
+            !skip_hw) {
                 /* hwaccel - with no need for preallocated room for CCMP
                  * header or MIC fields */
                 info->control.hw_key = &tx->key->conf;
@@ -397,7 +409,7 @@ static int ccmp_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
 
         ccmp_pn2hdr(pos, pn, key->conf.keyidx);
 
-        if (key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) {
+        if ((key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) && !skip_hw) {
                 /* hwaccel - with preallocated room for CCMP header */
                 info->control.hw_key = &tx->key->conf;
                 return 0;
@@ -446,7 +458,8 @@ ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx)
 
         hdrlen = ieee80211_hdrlen(hdr->frame_control);
 
-        if (!ieee80211_is_data(hdr->frame_control))
+        if (!ieee80211_is_data(hdr->frame_control) &&
+            !ieee80211_is_robust_mgmt_frame(hdr))
                 return RX_CONTINUE;
 
         data_len = skb->len - hdrlen - CCMP_HDR_LEN - CCMP_MIC_LEN;
@@ -485,3 +498,126 @@ ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx)
 
         return RX_CONTINUE;
 }
+
+
+static void bip_aad(struct sk_buff *skb, u8 *aad)
+{
+        /* BIP AAD: FC(masked) || A1 || A2 || A3 */
+
+        /* FC type/subtype */
+        aad[0] = skb->data[0];
+        /* Mask FC Retry, PwrMgt, MoreData flags to zero */
+        aad[1] = skb->data[1] & ~(BIT(4) | BIT(5) | BIT(6));
+        /* A1 || A2 || A3 */
+        memcpy(aad + 2, skb->data + 4, 3 * ETH_ALEN);
+}
+
+
+static inline void bip_ipn_swap(u8 *d, const u8 *s)
+{
+        *d++ = s[5];
+        *d++ = s[4];
+        *d++ = s[3];
+        *d++ = s[2];
+        *d++ = s[1];
+        *d = s[0];
+}
+
+
+ieee80211_tx_result
+ieee80211_crypto_aes_cmac_encrypt(struct ieee80211_tx_data *tx)
+{
+        struct sk_buff *skb = tx->skb;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+        struct ieee80211_key *key = tx->key;
+        struct ieee80211_mmie *mmie;
+        u8 *pn, aad[20];
+        int i;
+
+        if (tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) {
+                /* hwaccel */
+                info->control.hw_key = &tx->key->conf;
+                return 0;
+        }
+
+        if (WARN_ON(skb_tailroom(skb) < sizeof(*mmie)))
+                return TX_DROP;
+
+        mmie = (struct ieee80211_mmie *) skb_put(skb, sizeof(*mmie));
+        mmie->element_id = WLAN_EID_MMIE;
+        mmie->length = sizeof(*mmie) - 2;
+        mmie->key_id = cpu_to_le16(key->conf.keyidx);
+
+        /* PN = PN + 1 */
+        pn = key->u.aes_cmac.tx_pn;
+
+        for (i = sizeof(key->u.aes_cmac.tx_pn) - 1; i >= 0; i--) {
+                pn[i]++;
+                if (pn[i])
+                        break;
+        }
+        bip_ipn_swap(mmie->sequence_number, pn);
+
+        bip_aad(skb, aad);
+
+        /*
+         * MIC = AES-128-CMAC(IGTK, AAD || Management Frame Body || MMIE, 64)
+         */
+        ieee80211_aes_cmac(key->u.aes_cmac.tfm, key->u.aes_cmac.tx_crypto_buf,
+                           aad, skb->data + 24, skb->len - 24, mmie->mic);
+
+        return TX_CONTINUE;
+}
+
+
+ieee80211_rx_result
+ieee80211_crypto_aes_cmac_decrypt(struct ieee80211_rx_data *rx)
+{
+        struct sk_buff *skb = rx->skb;
+        struct ieee80211_key *key = rx->key;
+        struct ieee80211_mmie *mmie;
+        u8 aad[20], mic[8], ipn[6];
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
+
+        if (!ieee80211_is_mgmt(hdr->frame_control))
+                return RX_CONTINUE;
+
+        if ((rx->status->flag & RX_FLAG_DECRYPTED) &&
+            (rx->status->flag & RX_FLAG_IV_STRIPPED))
+                return RX_CONTINUE;
+
+        if (skb->len < 24 + sizeof(*mmie))
+                return RX_DROP_UNUSABLE;
+
+        mmie = (struct ieee80211_mmie *)
+                (skb->data + skb->len - sizeof(*mmie));
+        if (mmie->element_id != WLAN_EID_MMIE ||
+            mmie->length != sizeof(*mmie) - 2)
+                return RX_DROP_UNUSABLE; /* Invalid MMIE */
+
+        bip_ipn_swap(ipn, mmie->sequence_number);
+
+        if (memcmp(ipn, key->u.aes_cmac.rx_pn, 6) <= 0) {
+                key->u.aes_cmac.replays++;
+                return RX_DROP_UNUSABLE;
+        }
+
+        if (!(rx->status->flag & RX_FLAG_DECRYPTED)) {
+                /* hardware didn't decrypt/verify MIC */
+                bip_aad(skb, aad);
+                ieee80211_aes_cmac(key->u.aes_cmac.tfm,
+                                   key->u.aes_cmac.rx_crypto_buf, aad,
+                                   skb->data + 24, skb->len - 24, mic);
+                if (memcmp(mic, mmie->mic, sizeof(mmie->mic)) != 0) {
+                        key->u.aes_cmac.icverrors++;
+                        return RX_DROP_UNUSABLE;
+                }
+        }
+
+        memcpy(key->u.aes_cmac.rx_pn, ipn, 6);
+
+        /* Remove MMIE */
+        skb_trim(skb, skb->len - sizeof(*mmie));
+
+        return RX_CONTINUE;
+}
diff --git a/net/mac80211/wpa.h b/net/mac80211/wpa.h
index d42d221d8a1d..baba0608313e 100644
--- a/net/mac80211/wpa.h
+++ b/net/mac80211/wpa.h
@@ -28,4 +28,9 @@ ieee80211_crypto_ccmp_encrypt(struct ieee80211_tx_data *tx);
 ieee80211_rx_result
 ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx);
 
+ieee80211_tx_result
+ieee80211_crypto_aes_cmac_encrypt(struct ieee80211_tx_data *tx);
+ieee80211_rx_result
+ieee80211_crypto_aes_cmac_decrypt(struct ieee80211_rx_data *rx);
+
 #endif /* WPA_H */
diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c
index 6be5d4efa51b..5c48378a852f 100644
--- a/net/netfilter/ipvs/ip_vs_sync.c
+++ b/net/netfilter/ipvs/ip_vs_sync.c
@@ -149,8 +149,8 @@ static struct task_struct *sync_backup_thread;
 /* multicast addr */
 static struct sockaddr_in mcast_addr = {
         .sin_family             = AF_INET,
-        .sin_port               = __constant_htons(IP_VS_SYNC_PORT),
-        .sin_addr.s_addr        = __constant_htonl(IP_VS_SYNC_GROUP),
+        .sin_port               = cpu_to_be16(IP_VS_SYNC_PORT),
+        .sin_addr.s_addr        = cpu_to_be32(IP_VS_SYNC_GROUP),
 };
 
 
diff --git a/net/netfilter/nf_conntrack_amanda.c b/net/netfilter/nf_conntrack_amanda.c
index 4f8fcf498545..07d9d8857e5d 100644
--- a/net/netfilter/nf_conntrack_amanda.c
+++ b/net/netfilter/nf_conntrack_amanda.c
@@ -177,7 +177,7 @@ static struct nf_conntrack_helper amanda_helper[2] __read_mostly = {
                 .me                     = THIS_MODULE,
                 .help                   = amanda_help,
                 .tuple.src.l3num        = AF_INET,
-                .tuple.src.u.udp.port   = __constant_htons(10080),
+                .tuple.src.u.udp.port   = cpu_to_be16(10080),
                 .tuple.dst.protonum     = IPPROTO_UDP,
                 .expect_policy          = &amanda_exp_policy,
         },
@@ -186,7 +186,7 @@ static struct nf_conntrack_helper amanda_helper[2] __read_mostly = {
                 .me                     = THIS_MODULE,
                 .help                   = amanda_help,
                 .tuple.src.l3num        = AF_INET6,
-                .tuple.src.u.udp.port   = __constant_htons(10080),
+                .tuple.src.u.udp.port   = cpu_to_be16(10080),
                 .tuple.dst.protonum     = IPPROTO_UDP,
                 .expect_policy          = &amanda_exp_policy,
         },
diff --git a/net/netfilter/nf_conntrack_h323_main.c b/net/netfilter/nf_conntrack_h323_main.c
index 687bd633c3d7..66369490230e 100644
--- a/net/netfilter/nf_conntrack_h323_main.c
+++ b/net/netfilter/nf_conntrack_h323_main.c
@@ -1167,7 +1167,7 @@ static struct nf_conntrack_helper nf_conntrack_helper_q931[] __read_mostly = {
                 .name                   = "Q.931",
                 .me                     = THIS_MODULE,
                 .tuple.src.l3num        = AF_INET,
-                .tuple.src.u.tcp.port   = __constant_htons(Q931_PORT),
+                .tuple.src.u.tcp.port   = cpu_to_be16(Q931_PORT),
                 .tuple.dst.protonum     = IPPROTO_TCP,
                 .help                   = q931_help,
                 .expect_policy          = &q931_exp_policy,
@@ -1176,7 +1176,7 @@ static struct nf_conntrack_helper nf_conntrack_helper_q931[] __read_mostly = {
                 .name                   = "Q.931",
                 .me                     = THIS_MODULE,
                 .tuple.src.l3num        = AF_INET6,
-                .tuple.src.u.tcp.port   = __constant_htons(Q931_PORT),
+                .tuple.src.u.tcp.port   = cpu_to_be16(Q931_PORT),
                 .tuple.dst.protonum     = IPPROTO_TCP,
                 .help                   = q931_help,
                 .expect_policy          = &q931_exp_policy,
@@ -1741,7 +1741,7 @@ static struct nf_conntrack_helper nf_conntrack_helper_ras[] __read_mostly = {
                 .name                   = "RAS",
                 .me                     = THIS_MODULE,
                 .tuple.src.l3num        = AF_INET,
-                .tuple.src.u.udp.port   = __constant_htons(RAS_PORT),
+                .tuple.src.u.udp.port   = cpu_to_be16(RAS_PORT),
                 .tuple.dst.protonum     = IPPROTO_UDP,
                 .help                   = ras_help,
                 .expect_policy          = &ras_exp_policy,
@@ -1750,7 +1750,7 @@ static struct nf_conntrack_helper nf_conntrack_helper_ras[] __read_mostly = {
                 .name                   = "RAS",
                 .me                     = THIS_MODULE,
                 .tuple.src.l3num        = AF_INET6,
-                .tuple.src.u.udp.port   = __constant_htons(RAS_PORT),
+                .tuple.src.u.udp.port   = cpu_to_be16(RAS_PORT),
                 .tuple.dst.protonum     = IPPROTO_UDP,
                 .help                   = ras_help,
                 .expect_policy          = &ras_exp_policy,
diff --git a/net/netfilter/nf_conntrack_netbios_ns.c b/net/netfilter/nf_conntrack_netbios_ns.c
index 5af4273b4668..8a3875e36ec2 100644
--- a/net/netfilter/nf_conntrack_netbios_ns.c
+++ b/net/netfilter/nf_conntrack_netbios_ns.c
@@ -105,7 +105,7 @@ static struct nf_conntrack_expect_policy exp_policy = {
 static struct nf_conntrack_helper helper __read_mostly = {
         .name                   = "netbios-ns",
         .tuple.src.l3num        = AF_INET,
-        .tuple.src.u.udp.port   = __constant_htons(NMBD_PORT),
+        .tuple.src.u.udp.port   = cpu_to_be16(NMBD_PORT),
         .tuple.dst.protonum     = IPPROTO_UDP,
         .me                     = THIS_MODULE,
         .help                   = help,
diff --git a/net/netfilter/nf_conntrack_pptp.c b/net/netfilter/nf_conntrack_pptp.c
index 9e169ef2e854..72cca638a82d 100644
--- a/net/netfilter/nf_conntrack_pptp.c
+++ b/net/netfilter/nf_conntrack_pptp.c
@@ -591,7 +591,7 @@ static struct nf_conntrack_helper pptp __read_mostly = {
         .name                   = "pptp",
         .me                     = THIS_MODULE,
         .tuple.src.l3num        = AF_INET,
-        .tuple.src.u.tcp.port   = __constant_htons(PPTP_CONTROL_PORT),
+        .tuple.src.u.tcp.port   = cpu_to_be16(PPTP_CONTROL_PORT),
         .tuple.dst.protonum     = IPPROTO_TCP,
         .help                   = conntrack_pptp_help,
         .destroy                = pptp_destroy_siblings,
diff --git a/net/netfilter/nf_tproxy_core.c b/net/netfilter/nf_tproxy_core.c
index cdc97f3105a3..5490fc37c92d 100644
--- a/net/netfilter/nf_tproxy_core.c
+++ b/net/netfilter/nf_tproxy_core.c
@@ -71,6 +71,7 @@ int
 nf_tproxy_assign_sock(struct sk_buff *skb, struct sock *sk)
 {
         if (inet_sk(sk)->transparent) {
+                skb_orphan(skb);
                 skb->sk = sk;
                 skb->destructor = nf_tproxy_destructor;
                 return 1;
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 9eb895c7a2a9..6ee69c27f806 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -950,6 +950,7 @@ struct netlink_broadcast_data {
         u32 pid;
         u32 group;
         int failure;
+        int delivery_failure;
         int congested;
         int delivered;
         gfp_t allocation;
@@ -999,6 +1000,7 @@ static inline int do_one_broadcast(struct sock *sk,
                 p->skb2 = NULL;
         } else if ((val = netlink_broadcast_deliver(sk, p->skb2)) < 0) {
                 netlink_overrun(sk);
+                p->delivery_failure = 1;
         } else {
                 p->congested |= val;
                 p->delivered = 1;
@@ -1025,6 +1027,7 @@ int netlink_broadcast(struct sock *ssk, struct sk_buff *skb, u32 pid,
         info.pid = pid;
         info.group = group;
         info.failure = 0;
+        info.delivery_failure = 0;
         info.congested = 0;
         info.delivered = 0;
         info.allocation = allocation;
@@ -1045,13 +1048,14 @@ int netlink_broadcast(struct sock *ssk, struct sk_buff *skb, u32 pid,
         if (info.skb2)
                 kfree_skb(info.skb2);
 
+        if (info.delivery_failure || info.failure)
+                return -ENOBUFS;
+
         if (info.delivered) {
                 if (info.congested && (allocation & __GFP_WAIT))
                         yield();
                 return 0;
         }
-        if (info.failure)
-                return -ENOBUFS;
         return -ESRCH;
 }
 EXPORT_SYMBOL(netlink_broadcast);
diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
index e9c05b8f4f45..cba7849de98e 100644
--- a/net/netrom/af_netrom.c
+++ b/net/netrom/af_netrom.c
@@ -1432,7 +1432,7 @@ static int __init nr_proto_init(void)
                 struct net_device *dev;
 
                 sprintf(name, "nr%d", i);
-                dev = alloc_netdev(sizeof(struct nr_private), name, nr_setup);
+                dev = alloc_netdev(0, name, nr_setup);
                 if (!dev) {
                         printk(KERN_ERR "NET/ROM: nr_proto_init - unable to allocate device structure\n");
                         goto fail;
diff --git a/net/netrom/nr_dev.c b/net/netrom/nr_dev.c
index 6caf459665f2..351372463fed 100644
--- a/net/netrom/nr_dev.c
+++ b/net/netrom/nr_dev.c
@@ -42,7 +42,7 @@
 
 int nr_rx_ip(struct sk_buff *skb, struct net_device *dev)
 {
-        struct net_device_stats *stats = netdev_priv(dev);
+        struct net_device_stats *stats = &dev->stats;
 
         if (!netif_running(dev)) {
                 stats->rx_dropped++;
@@ -171,8 +171,7 @@ static int nr_close(struct net_device *dev)
 
 static int nr_xmit(struct sk_buff *skb, struct net_device *dev)
 {
-        struct nr_private *nr = netdev_priv(dev);
-        struct net_device_stats *stats = &nr->stats;
+        struct net_device_stats *stats = &dev->stats;
         unsigned int len = skb->len;
 
         if (!nr_route_frame(skb, NULL)) {
@@ -187,34 +186,27 @@ static int nr_xmit(struct sk_buff *skb, struct net_device *dev)
         return 0;
 }
 
-static struct net_device_stats *nr_get_stats(struct net_device *dev)
-{
-        struct nr_private *nr = netdev_priv(dev);
-
-        return &nr->stats;
-}
-
 static const struct header_ops nr_header_ops = {
         .create = nr_header,
         .rebuild= nr_rebuild_header,
 };
 
+static const struct net_device_ops nr_netdev_ops = {
+        .ndo_open               = nr_open,
+        .ndo_stop               = nr_close,
+        .ndo_start_xmit         = nr_xmit,
+        .ndo_set_mac_address    = nr_set_mac_address,
+};
 
 void nr_setup(struct net_device *dev)
 {
         dev->mtu                = NR_MAX_PACKET_SIZE;
-        dev->hard_start_xmit    = nr_xmit;
-        dev->open               = nr_open;
-        dev->stop               = nr_close;
-
+        dev->netdev_ops         = &nr_netdev_ops;
         dev->header_ops         = &nr_header_ops;
         dev->hard_header_len    = NR_NETWORK_LEN + NR_TRANSPORT_LEN;
         dev->addr_len           = AX25_ADDR_LEN;
         dev->type               = ARPHRD_NETROM;
-        dev->set_mac_address    = nr_set_mac_address;
 
         /* New-style flags. */
         dev->flags              = IFF_NOARP;
-
-        dev->get_stats          = nr_get_stats;
 }
diff --git a/net/phonet/af_phonet.c b/net/phonet/af_phonet.c
index 13cb323f8c38..81795ea87794 100644
--- a/net/phonet/af_phonet.c
+++ b/net/phonet/af_phonet.c
@@ -275,8 +275,6 @@ static inline int can_respond(struct sk_buff *skb)
                 return 0;
 
         ph = pn_hdr(skb);
-        if (phonet_address_get(skb->dev, ph->pn_rdev) != ph->pn_rdev)
-                return 0; /* we are not the destination */
         if (ph->pn_res == PN_PREFIX && !pskb_may_pull(skb, 5))
                 return 0;
         if (ph->pn_res == PN_COMMGR) /* indications */
@@ -344,8 +342,8 @@ static int phonet_rcv(struct sk_buff *skb, struct net_device *dev,
                         struct packet_type *pkttype,
                         struct net_device *orig_dev)
 {
+        struct net *net = dev_net(dev);
         struct phonethdr *ph;
-        struct sock *sk;
         struct sockaddr_pn sa;
         u16 len;
 
@@ -364,28 +362,28 @@ static int phonet_rcv(struct sk_buff *skb, struct net_device *dev,
         skb_reset_transport_header(skb);
 
         pn_skb_get_dst_sockaddr(skb, &sa);
-        if (pn_sockaddr_get_addr(&sa) == 0)
-                goto out; /* currently, we cannot be device 0 */
 
-        sk = pn_find_sock_by_sa(dev_net(dev), &sa);
-        if (sk == NULL) {
+        /* check if we are the destination */
+        if (phonet_address_lookup(net, pn_sockaddr_get_addr(&sa)) == 0) {
+                /* Phonet packet input */
+                struct sock *sk = pn_find_sock_by_sa(net, &sa);
+
+                if (sk)
+                        return sk_receive_skb(sk, skb, 0);
+
                 if (can_respond(skb)) {
                         send_obj_unreachable(skb);
                         send_reset_indications(skb);
                 }
-                goto out;
         }
 
-        /* Push data to the socket (or other sockets connected to it). */
-        return sk_receive_skb(sk, skb, 0);
-
 out:
         kfree_skb(skb);
         return NET_RX_DROP;
 }
 
 static struct packet_type phonet_packet_type = {
-        .type = __constant_htons(ETH_P_PHONET),
+        .type = cpu_to_be16(ETH_P_PHONET),
         .dev = NULL,
         .func = phonet_rcv,
 };
@@ -428,16 +426,18 @@ static int __init phonet_init(void)
 {
         int err;
 
+        err = phonet_device_init();
+        if (err)
+                return err;
+
         err = sock_register(&phonet_proto_family);
         if (err) {
                 printk(KERN_ALERT
                         "phonet protocol family initialization failed\n");
-                return err;
+                goto err_sock;
         }
 
-        phonet_device_init();
         dev_add_pack(&phonet_packet_type);
-        phonet_netlink_register();
         phonet_sysctl_init();
 
         err = isi_register();
@@ -449,6 +449,7 @@ err:
         phonet_sysctl_exit();
         sock_unregister(PF_PHONET);
         dev_remove_pack(&phonet_packet_type);
+err_sock:
         phonet_device_exit();
         return err;
 }
diff --git a/net/phonet/pn_dev.c b/net/phonet/pn_dev.c
index 5491bf5e354b..80a322d77909 100644
--- a/net/phonet/pn_dev.c
+++ b/net/phonet/pn_dev.c
@@ -28,32 +28,41 @@
 #include <linux/netdevice.h>
 #include <linux/phonet.h>
 #include <net/sock.h>
+#include <net/netns/generic.h>
 #include <net/phonet/pn_dev.h>
 
-/* when accessing, remember to lock with spin_lock(&pndevs.lock); */
-struct phonet_device_list pndevs = {
-        .list = LIST_HEAD_INIT(pndevs.list),
-        .lock = __SPIN_LOCK_UNLOCKED(pndevs.lock),
+struct phonet_net {
+        struct phonet_device_list pndevs;
 };
 
+int phonet_net_id;
+
+struct phonet_device_list *phonet_device_list(struct net *net)
+{
+        struct phonet_net *pnn = net_generic(net, phonet_net_id);
+        return &pnn->pndevs;
+}
+
 /* Allocate new Phonet device. */
 static struct phonet_device *__phonet_device_alloc(struct net_device *dev)
 {
+        struct phonet_device_list *pndevs = phonet_device_list(dev_net(dev));
         struct phonet_device *pnd = kmalloc(sizeof(*pnd), GFP_ATOMIC);
         if (pnd == NULL)
                 return NULL;
         pnd->netdev = dev;
         bitmap_zero(pnd->addrs, 64);
 
-        list_add(&pnd->list, &pndevs.list);
+        list_add(&pnd->list, &pndevs->list);
         return pnd;
 }
 
 static struct phonet_device *__phonet_get(struct net_device *dev)
 {
+        struct phonet_device_list *pndevs = phonet_device_list(dev_net(dev));
         struct phonet_device *pnd;
 
-        list_for_each_entry(pnd, &pndevs.list, list) {
+        list_for_each_entry(pnd, &pndevs->list, list) {
                 if (pnd->netdev == dev)
                         return pnd;
         }
@@ -68,32 +77,33 @@ static void __phonet_device_free(struct phonet_device *pnd)
 
 struct net_device *phonet_device_get(struct net *net)
 {
+        struct phonet_device_list *pndevs = phonet_device_list(net);
         struct phonet_device *pnd;
         struct net_device *dev;
 
-        spin_lock_bh(&pndevs.lock);
-        list_for_each_entry(pnd, &pndevs.list, list) {
+        spin_lock_bh(&pndevs->lock);
+        list_for_each_entry(pnd, &pndevs->list, list) {
                 dev = pnd->netdev;
                 BUG_ON(!dev);
 
-                if (net_eq(dev_net(dev), net) &&
-                        (dev->reg_state == NETREG_REGISTERED) &&
+                if ((dev->reg_state == NETREG_REGISTERED) &&
                         ((pnd->netdev->flags & IFF_UP)) == IFF_UP)
                         break;
                 dev = NULL;
         }
         if (dev)
                 dev_hold(dev);
-        spin_unlock_bh(&pndevs.lock);
+        spin_unlock_bh(&pndevs->lock);
         return dev;
 }
 
 int phonet_address_add(struct net_device *dev, u8 addr)
 {
+        struct phonet_device_list *pndevs = phonet_device_list(dev_net(dev));
         struct phonet_device *pnd;
         int err = 0;
 
-        spin_lock_bh(&pndevs.lock);
+        spin_lock_bh(&pndevs->lock);
         /* Find or create Phonet-specific device data */
         pnd = __phonet_get(dev);
         if (pnd == NULL)
@@ -102,31 +112,33 @@ int phonet_address_add(struct net_device *dev, u8 addr)
                 err = -ENOMEM;
         else if (test_and_set_bit(addr >> 2, pnd->addrs))
                 err = -EEXIST;
-        spin_unlock_bh(&pndevs.lock);
+        spin_unlock_bh(&pndevs->lock);
         return err;
 }
 
 int phonet_address_del(struct net_device *dev, u8 addr)
 {
+        struct phonet_device_list *pndevs = phonet_device_list(dev_net(dev));
         struct phonet_device *pnd;
         int err = 0;
 
-        spin_lock_bh(&pndevs.lock);
+        spin_lock_bh(&pndevs->lock);
         pnd = __phonet_get(dev);
         if (!pnd || !test_and_clear_bit(addr >> 2, pnd->addrs))
                 err = -EADDRNOTAVAIL;
         else if (bitmap_empty(pnd->addrs, 64))
                 __phonet_device_free(pnd);
-        spin_unlock_bh(&pndevs.lock);
+        spin_unlock_bh(&pndevs->lock);
         return err;
 }
 
 /* Gets a source address toward a destination, through a interface. */
 u8 phonet_address_get(struct net_device *dev, u8 addr)
 {
+        struct phonet_device_list *pndevs = phonet_device_list(dev_net(dev));
         struct phonet_device *pnd;
 
-        spin_lock_bh(&pndevs.lock);
+        spin_lock_bh(&pndevs->lock);
         pnd = __phonet_get(dev);
         if (pnd) {
                 BUG_ON(bitmap_empty(pnd->addrs, 64));
@@ -136,30 +148,31 @@ u8 phonet_address_get(struct net_device *dev, u8 addr)
                         addr = find_first_bit(pnd->addrs, 64) << 2;
         } else
                 addr = PN_NO_ADDR;
-        spin_unlock_bh(&pndevs.lock);
+        spin_unlock_bh(&pndevs->lock);
         return addr;
 }
 
 int phonet_address_lookup(struct net *net, u8 addr)
 {
+        struct phonet_device_list *pndevs = phonet_device_list(net);
         struct phonet_device *pnd;
+        int err = -EADDRNOTAVAIL;
 
-        spin_lock_bh(&pndevs.lock);
-        list_for_each_entry(pnd, &pndevs.list, list) {
-                if (!net_eq(dev_net(pnd->netdev), net))
-                        continue;
+        spin_lock_bh(&pndevs->lock);
+        list_for_each_entry(pnd, &pndevs->list, list) {
                 /* Don't allow unregistering devices! */
                 if ((pnd->netdev->reg_state != NETREG_REGISTERED) ||
                                 ((pnd->netdev->flags & IFF_UP)) != IFF_UP)
                         continue;
 
                 if (test_bit(addr >> 2, pnd->addrs)) {
-                        spin_unlock_bh(&pndevs.lock);
-                        return 0;
+                        err = 0;
+                        goto found;
                 }
         }
-        spin_unlock_bh(&pndevs.lock);
-        return -EADDRNOTAVAIL;
+found:
+        spin_unlock_bh(&pndevs->lock);
+        return err;
 }
 
 /* notify Phonet of device events */
@@ -169,14 +182,16 @@ static int phonet_device_notify(struct notifier_block *me, unsigned long what,
         struct net_device *dev = arg;
 
         if (what == NETDEV_UNREGISTER) {
+                struct phonet_device_list *pndevs;
                 struct phonet_device *pnd;
 
                 /* Destroy phonet-specific device data */
-                spin_lock_bh(&pndevs.lock);
+                pndevs = phonet_device_list(dev_net(dev));
+                spin_lock_bh(&pndevs->lock);
                 pnd = __phonet_get(dev);
                 if (pnd)
                         __phonet_device_free(pnd);
-                spin_unlock_bh(&pndevs.lock);
+                spin_unlock_bh(&pndevs->lock);
         }
         return 0;
 
@@ -187,24 +202,52 @@ static struct notifier_block phonet_device_notifier = {
         .priority = 0,
 };
 
-/* Initialize Phonet devices list */
-void phonet_device_init(void)
+/* Per-namespace Phonet devices handling */
+static int phonet_init_net(struct net *net)
 {
-        register_netdevice_notifier(&phonet_device_notifier);
+        struct phonet_net *pnn = kmalloc(sizeof(*pnn), GFP_KERNEL);
+        if (!pnn)
+                return -ENOMEM;
+
+        INIT_LIST_HEAD(&pnn->pndevs.list);
+        spin_lock_init(&pnn->pndevs.lock);
+        net_assign_generic(net, phonet_net_id, pnn);
+        return 0;
 }
 
-void phonet_device_exit(void)
+static void phonet_exit_net(struct net *net)
 {
+        struct phonet_net *pnn = net_generic(net, phonet_net_id);
         struct phonet_device *pnd, *n;
 
-        rtnl_unregister_all(PF_PHONET);
-        rtnl_lock();
-        spin_lock_bh(&pndevs.lock);
-
-        list_for_each_entry_safe(pnd, n, &pndevs.list, list)
+        list_for_each_entry_safe(pnd, n, &pnn->pndevs.list, list)
                 __phonet_device_free(pnd);
 
-        spin_unlock_bh(&pndevs.lock);
-        rtnl_unlock();
+        kfree(pnn);
+}
+
+static struct pernet_operations phonet_net_ops = {
+        .init = phonet_init_net,
+        .exit = phonet_exit_net,
+};
+
+/* Initialize Phonet devices list */
+int __init phonet_device_init(void)
+{
+        int err = register_pernet_gen_device(&phonet_net_id, &phonet_net_ops);
+        if (err)
+                return err;
+
+        register_netdevice_notifier(&phonet_device_notifier);
+        err = phonet_netlink_register();
+        if (err)
+                phonet_device_exit();
+        return err;
+}
+
+void phonet_device_exit(void)
+{
+        rtnl_unregister_all(PF_PHONET);
         unregister_netdevice_notifier(&phonet_device_notifier);
+        unregister_pernet_gen_device(phonet_net_id, &phonet_net_ops);
 }
diff --git a/net/phonet/pn_netlink.c b/net/phonet/pn_netlink.c
index 242fe8f8c322..1ceea1f92413 100644
--- a/net/phonet/pn_netlink.c
+++ b/net/phonet/pn_netlink.c
@@ -123,17 +123,16 @@ nla_put_failure:
 
 static int getaddr_dumpit(struct sk_buff *skb, struct netlink_callback *cb)
 {
-        struct net *net = sock_net(skb->sk);
+        struct phonet_device_list *pndevs;
         struct phonet_device *pnd;
         int dev_idx = 0, dev_start_idx = cb->args[0];
         int addr_idx = 0, addr_start_idx = cb->args[1];
 
-        spin_lock_bh(&pndevs.lock);
-        list_for_each_entry(pnd, &pndevs.list, list) {
+        pndevs = phonet_device_list(sock_net(skb->sk));
+        spin_lock_bh(&pndevs->lock);
+        list_for_each_entry(pnd, &pndevs->list, list) {
                 u8 addr;
 
-                if (!net_eq(dev_net(pnd->netdev), net))
-                        continue;
                 if (dev_idx > dev_start_idx)
                         addr_start_idx = 0;
                 if (dev_idx++ < dev_start_idx)
@@ -153,16 +152,21 @@ static int getaddr_dumpit(struct sk_buff *skb, struct netlink_callback *cb)
         }
 
 out:
-        spin_unlock_bh(&pndevs.lock);
+        spin_unlock_bh(&pndevs->lock);
         cb->args[0] = dev_idx;
         cb->args[1] = addr_idx;
 
         return skb->len;
 }
 
-void __init phonet_netlink_register(void)
+int __init phonet_netlink_register(void)
 {
-        rtnl_register(PF_PHONET, RTM_NEWADDR, addr_doit, NULL);
-        rtnl_register(PF_PHONET, RTM_DELADDR, addr_doit, NULL);
-        rtnl_register(PF_PHONET, RTM_GETADDR, NULL, getaddr_dumpit);
+        int err = __rtnl_register(PF_PHONET, RTM_NEWADDR, addr_doit, NULL);
+        if (err)
+                return err;
+
+        /* Further __rtnl_register() cannot fail */
+        __rtnl_register(PF_PHONET, RTM_DELADDR, addr_doit, NULL);
+        __rtnl_register(PF_PHONET, RTM_GETADDR, NULL, getaddr_dumpit);
+        return 0;
 }
diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index 01392649b462..650139626581 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -1587,8 +1587,7 @@ static int __init rose_proto_init(void)
                 char name[IFNAMSIZ];
 
                 sprintf(name, "rose%d", i);
-                dev = alloc_netdev(sizeof(struct net_device_stats),
-                                   name, rose_setup);
+                dev = alloc_netdev(0, name, rose_setup);
                 if (!dev) {
                         printk(KERN_ERR "ROSE: rose_proto_init - unable to allocate memory\n");
                         rc = -ENOMEM;
diff --git a/net/rose/rose_dev.c b/net/rose/rose_dev.c
index 12cfcf09556b..7dcf2569613b 100644
--- a/net/rose/rose_dev.c
+++ b/net/rose/rose_dev.c
@@ -57,7 +57,7 @@ static int rose_rebuild_header(struct sk_buff *skb)
 {
 #ifdef CONFIG_INET
         struct net_device *dev = skb->dev;
-        struct net_device_stats *stats = netdev_priv(dev);
+        struct net_device_stats *stats = &dev->stats;
         unsigned char *bp = (unsigned char *)skb->data;
         struct sk_buff *skbn;
         unsigned int len;
@@ -133,7 +133,7 @@ static int rose_close(struct net_device *dev)
 
 static int rose_xmit(struct sk_buff *skb, struct net_device *dev)
 {
-        struct net_device_stats *stats = netdev_priv(dev);
+        struct net_device_stats *stats = &dev->stats;
 
         if (!netif_running(dev)) {
                 printk(KERN_ERR "ROSE: rose_xmit - called when iface is down\n");
@@ -144,30 +144,28 @@ static int rose_xmit(struct sk_buff *skb, struct net_device *dev)
         return 0;
 }
 
-static struct net_device_stats *rose_get_stats(struct net_device *dev)
-{
-        return netdev_priv(dev);
-}
-
 static const struct header_ops rose_header_ops = {
         .create = rose_header,
         .rebuild= rose_rebuild_header,
 };
 
+static const struct net_device_ops rose_netdev_ops = {
+        .ndo_open               = rose_open,
+        .ndo_stop               = rose_close,
+        .ndo_start_xmit         = rose_xmit,
+        .ndo_set_mac_address    = rose_set_mac_address,
+};
+
 void rose_setup(struct net_device *dev)
 {
         dev->mtu                = ROSE_MAX_PACKET_SIZE - 2;
-        dev->hard_start_xmit    = rose_xmit;
-        dev->open               = rose_open;
-        dev->stop               = rose_close;
+        dev->netdev_ops         = &rose_netdev_ops;
 
         dev->header_ops         = &rose_header_ops;
         dev->hard_header_len    = AX25_BPQ_HEADER_LEN + AX25_MAX_HEADER_LEN + ROSE_MIN_LEN;
         dev->addr_len           = ROSE_ADDR_LEN;
         dev->type               = ARPHRD_ROSE;
-        dev->set_mac_address    = rose_set_mac_address;
 
         /* New-style flags. */
         dev->flags              = IFF_NOARP;
-        dev->get_stats = rose_get_stats;
 }
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index 0fc4a18fd96f..32009793307b 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -444,6 +444,17 @@ out:
 }
 EXPORT_SYMBOL(qdisc_calculate_pkt_len);
 
+void qdisc_warn_nonwc(char *txt, struct Qdisc *qdisc)
+{
+        if (!(qdisc->flags & TCQ_F_WARN_NONWC)) {
+                printk(KERN_WARNING
+                       "%s: %s qdisc %X: is non-work-conserving?\n",
+                       txt, qdisc->ops->id, qdisc->handle >> 16);
+                qdisc->flags |= TCQ_F_WARN_NONWC;
+        }
+}
+EXPORT_SYMBOL(qdisc_warn_nonwc);
+
 static enum hrtimer_restart qdisc_watchdog(struct hrtimer *timer)
 {
         struct qdisc_watchdog *wd = container_of(timer, struct qdisc_watchdog,
diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c
index 45c31b1a4e1d..74226b265528 100644
--- a/net/sched/sch_hfsc.c
+++ b/net/sched/sch_hfsc.c
@@ -887,8 +887,7 @@ qdisc_peek_len(struct Qdisc *sch)
 
         skb = sch->ops->peek(sch);
         if (skb == NULL) {
-                if (net_ratelimit())
-                        printk("qdisc_peek_len: non work-conserving qdisc ?\n");
+                qdisc_warn_nonwc("qdisc_peek_len", sch);
                 return 0;
         }
         len = qdisc_pkt_len(skb);
@@ -1642,8 +1641,7 @@ hfsc_dequeue(struct Qdisc *sch)
 
         skb = qdisc_dequeue_peeked(cl->qdisc);
         if (skb == NULL) {
-                if (net_ratelimit())
-                        printk("HFSC: Non-work-conserving qdisc ?\n");
+                qdisc_warn_nonwc("HFSC", cl->qdisc);
                 return NULL;
         }
 
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index 2f0f0b04d3fb..355974f610c5 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -35,6 +35,7 @@
 #include <linux/list.h>
 #include <linux/compiler.h>
 #include <linux/rbtree.h>
+#include <linux/workqueue.h>
 #include <net/netlink.h>
 #include <net/pkt_sched.h>
 
@@ -114,8 +115,6 @@ struct htb_class {
         struct tcf_proto *filter_list;
         int filter_cnt;
 
-        int warned;             /* only one warning about non work conserving .. */
-
         /* token bucket parameters */
         struct qdisc_rate_table *rate;  /* rate table of the class itself */
         struct qdisc_rate_table *ceil;  /* ceiling rate (limits borrows too) */
@@ -155,6 +154,10 @@ struct htb_sched {
         int direct_qlen;        /* max qlen of above */
 
         long direct_pkts;
+
+#define HTB_WARN_TOOMANYEVENTS  0x1
+        unsigned int warned;    /* only one warning */
+        struct work_struct work;
 };
 
 /* find class in global hash table using given handle */
@@ -658,7 +661,7 @@ static void htb_charge_class(struct htb_sched *q, struct htb_class *cl,
  * htb_do_events - make mode changes to classes at the level
  *
  * Scans event queue for pending events and applies them. Returns time of
- * next pending event (0 for no event in pq).
+ * next pending event (0 for no event in pq, q->now for too many events).
  * Note: Applied are events whose have cl->pq_key <= q->now.
  */
 static psched_time_t htb_do_events(struct htb_sched *q, int level,
@@ -686,8 +689,14 @@ static psched_time_t htb_do_events(struct htb_sched *q, int level,
                 if (cl->cmode != HTB_CAN_SEND)
                         htb_add_to_wait_tree(q, cl, diff);
         }
-        /* too much load - let's continue on next jiffie (including above) */
-        return q->now + 2 * PSCHED_TICKS_PER_SEC / HZ;
+
+        /* too much load - let's continue after a break for scheduling */
+        if (!(q->warned & HTB_WARN_TOOMANYEVENTS)) {
+                printk(KERN_WARNING "htb: too many events!\n");
+                q->warned |= HTB_WARN_TOOMANYEVENTS;
+        }
+
+        return q->now;
 }
 
 /* Returns class->node+prio from id-tree where classe's id is >= id. NULL
@@ -809,13 +818,8 @@ next:
                 skb = cl->un.leaf.q->dequeue(cl->un.leaf.q);
                 if (likely(skb != NULL))
                         break;
-                if (!cl->warned) {
-                        printk(KERN_WARNING
-                               "htb: class %X isn't work conserving ?!\n",
-                               cl->common.classid);
-                        cl->warned = 1;
-                }
 
+                qdisc_warn_nonwc("htb", cl->un.leaf.q);
                 htb_next_rb_node((level ? cl->parent->un.inner.ptr : q->
                                   ptr[0]) + prio);
                 cl = htb_lookup_leaf(q->row[level] + prio, prio,
@@ -892,7 +896,10 @@ static struct sk_buff *htb_dequeue(struct Qdisc *sch)
                 }
         }
         sch->qstats.overlimits++;
-        qdisc_watchdog_schedule(&q->watchdog, next_event);
+        if (likely(next_event > q->now))
+                qdisc_watchdog_schedule(&q->watchdog, next_event);
+        else
+                schedule_work(&q->work);
 fin:
         return skb;
 }
@@ -962,6 +969,14 @@ static const struct nla_policy htb_policy[TCA_HTB_MAX + 1] = {
         [TCA_HTB_RTAB]  = { .type = NLA_BINARY, .len = TC_RTAB_SIZE },
 };
 
+static void htb_work_func(struct work_struct *work)
+{
+        struct htb_sched *q = container_of(work, struct htb_sched, work);
+        struct Qdisc *sch = q->watchdog.qdisc;
+
+        __netif_schedule(qdisc_root(sch));
+}
+
 static int htb_init(struct Qdisc *sch, struct nlattr *opt)
 {
         struct htb_sched *q = qdisc_priv(sch);
@@ -996,6 +1011,7 @@ static int htb_init(struct Qdisc *sch, struct nlattr *opt)
                 INIT_LIST_HEAD(q->drops + i);
 
         qdisc_watchdog_init(&q->watchdog, sch);
+        INIT_WORK(&q->work, htb_work_func);
         skb_queue_head_init(&q->direct_queue);
 
         q->direct_qlen = qdisc_dev(sch)->tx_queue_len;
@@ -1188,7 +1204,6 @@ static void htb_destroy_class(struct Qdisc *sch, struct htb_class *cl)
         kfree(cl);
 }
 
-/* always caled under BH & queue lock */
 static void htb_destroy(struct Qdisc *sch)
 {
         struct htb_sched *q = qdisc_priv(sch);
@@ -1196,6 +1211,7 @@ static void htb_destroy(struct Qdisc *sch)
         struct htb_class *cl;
         unsigned int i;
 
+        cancel_work_sync(&q->work);
         qdisc_watchdog_cancel(&q->watchdog);
         /* This line used to be after htb_destroy_class call below
            and surprisingly it worked in 2.4. But it must precede it
diff --git a/net/sched/sch_multiq.c b/net/sched/sch_multiq.c
index 7e151861794b..912731203047 100644
--- a/net/sched/sch_multiq.c
+++ b/net/sched/sch_multiq.c
@@ -202,7 +202,7 @@ static int multiq_tune(struct Qdisc *sch, struct nlattr *opt)
         int i;
 
         if (!netif_is_multiqueue(qdisc_dev(sch)))
-                return -EINVAL;
+                return -EOPNOTSUPP;
         if (nla_len(opt) < sizeof(*qopt))
                 return -EINVAL;
 
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index ceaa4aa066ea..786227566696 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -97,8 +97,7 @@ static int sctp_inet6addr_event(struct notifier_block *this, unsigned long ev,
                 if (addr) {
                         addr->a.v6.sin6_family = AF_INET6;
                         addr->a.v6.sin6_port = 0;
-                        memcpy(&addr->a.v6.sin6_addr, &ifa->addr,
-                                 sizeof(struct in6_addr));
+                        ipv6_addr_copy(&addr->a.v6.sin6_addr, &ifa->addr);
                         addr->a.v6.sin6_scope_id = ifa->idev->dev->ifindex;
                         addr->valid = 1;
                         spin_lock_bh(&sctp_local_addr_lock);
diff --git a/net/sctp/output.c b/net/sctp/output.c
index 73639355157e..47bfba6c03ec 100644
--- a/net/sctp/output.c
+++ b/net/sctp/output.c
@@ -367,7 +367,7 @@ int sctp_packet_transmit(struct sctp_packet *packet)
         struct sctp_transport *tp = packet->transport;
         struct sctp_association *asoc = tp->asoc;
         struct sctphdr *sh;
-        __be32 crc32 = __constant_cpu_to_be32(0);
+        __be32 crc32 = cpu_to_be32(0);
         struct sk_buff *nskb;
         struct sctp_chunk *chunk, *tmp;
         struct sock *sk;
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index fd8acb48c3f2..b40e95f9851b 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -100,11 +100,11 @@ int sctp_chunk_iif(const struct sctp_chunk *chunk)
  */
 static const struct sctp_paramhdr ecap_param = {
         SCTP_PARAM_ECN_CAPABLE,
-        __constant_htons(sizeof(struct sctp_paramhdr)),
+        cpu_to_be16(sizeof(struct sctp_paramhdr)),
 };
 static const struct sctp_paramhdr prsctp_param = {
         SCTP_PARAM_FWD_TSN_SUPPORT,
-        __constant_htons(sizeof(struct sctp_paramhdr)),
+        cpu_to_be16(sizeof(struct sctp_paramhdr)),
 };
 
 /* A helper to initialize to initialize an op error inside a
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index 5cbb404c4cdf..b49e434c094f 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -1215,6 +1215,23 @@ out:
         read_unlock(&sk->sk_callback_lock);
 }
 
+static void xs_write_space(struct sock *sk)
+{
+        struct socket *sock;
+        struct rpc_xprt *xprt;
+
+        if (unlikely(!(sock = sk->sk_socket)))
+                return;
+        clear_bit(SOCK_NOSPACE, &sock->flags);
+
+        if (unlikely(!(xprt = xprt_from_sock(sk))))
+                return;
+        if (test_and_clear_bit(SOCK_ASYNC_NOSPACE, &sock->flags) == 0)
+                return;
+
+        xprt_write_space(xprt);
+}
+
 /**
  * xs_udp_write_space - callback invoked when socket buffer space
  *                             becomes available
@@ -1230,23 +1247,9 @@ static void xs_udp_write_space(struct sock *sk)
         read_lock(&sk->sk_callback_lock);
 
         /* from net/core/sock.c:sock_def_write_space */
-        if (sock_writeable(sk)) {
-                struct socket *sock;
-                struct rpc_xprt *xprt;
-
-                if (unlikely(!(sock = sk->sk_socket)))
-                        goto out;
-                clear_bit(SOCK_NOSPACE, &sock->flags);
-
-                if (unlikely(!(xprt = xprt_from_sock(sk))))
-                        goto out;
-                if (test_and_clear_bit(SOCK_ASYNC_NOSPACE, &sock->flags) == 0)
-                        goto out;
-
-                xprt_write_space(xprt);
-        }
+        if (sock_writeable(sk))
+                xs_write_space(sk);
 
- out:
         read_unlock(&sk->sk_callback_lock);
 }
 
@@ -1265,23 +1268,9 @@ static void xs_tcp_write_space(struct sock *sk)
         read_lock(&sk->sk_callback_lock);
 
         /* from net/core/stream.c:sk_stream_write_space */
-        if (sk_stream_wspace(sk) >= sk_stream_min_wspace(sk)) {
-                struct socket *sock;
-                struct rpc_xprt *xprt;
-
-                if (unlikely(!(sock = sk->sk_socket)))
-                        goto out;
-                clear_bit(SOCK_NOSPACE, &sock->flags);
+        if (sk_stream_wspace(sk) >= sk_stream_min_wspace(sk))
+                xs_write_space(sk);
 
-                if (unlikely(!(xprt = xprt_from_sock(sk))))
-                        goto out;
-                if (test_and_clear_bit(SOCK_ASYNC_NOSPACE, &sock->flags) == 0)
-                        goto out;
-
-                xprt_write_space(xprt);
-        }
-
- out:
         read_unlock(&sk->sk_callback_lock);
 }
 
diff --git a/net/wimax/op-msg.c b/net/wimax/op-msg.c
index cb3b4ad53683..5d149c1b5f0d 100644
--- a/net/wimax/op-msg.c
+++ b/net/wimax/op-msg.c
@@ -258,7 +258,6 @@ EXPORT_SYMBOL_GPL(wimax_msg_len);
  */
 int wimax_msg_send(struct wimax_dev *wimax_dev, struct sk_buff *skb)
 {
-        int result;
         struct device *dev = wimax_dev->net_dev->dev.parent;
         void *msg = skb->data;
         size_t size = skb->len;
@@ -266,11 +265,9 @@ int wimax_msg_send(struct wimax_dev *wimax_dev, struct sk_buff *skb)
 
         d_printf(1, dev, "CTX: wimax msg, %zu bytes\n", size);
         d_dump(2, dev, msg, size);
-        result = genlmsg_multicast(skb, 0, wimax_gnl_mcg.id, GFP_KERNEL);
-        d_printf(1, dev, "CTX: genl multicast result %d\n", result);
-        if (result == -ESRCH)   /* Nobody connected, ignore it */
-                result = 0;     /* btw, the skb is freed already */
-        return result;
+        genlmsg_multicast(skb, 0, wimax_gnl_mcg.id, GFP_KERNEL);
+        d_printf(1, dev, "CTX: genl multicast done\n");
+        return 0;
 }
 EXPORT_SYMBOL_GPL(wimax_msg_send);
 
diff --git a/net/wimax/stack.c b/net/wimax/stack.c
index 3869c0327882..a0ee76b52510 100644
--- a/net/wimax/stack.c
+++ b/net/wimax/stack.c
@@ -163,16 +163,12 @@ int wimax_gnl_re_state_change_send(
         struct device *dev = wimax_dev_to_dev(wimax_dev);
         d_fnstart(3, dev, "(wimax_dev %p report_skb %p)\n",
                   wimax_dev, report_skb);
-        if (report_skb == NULL)
+        if (report_skb == NULL) {
+                result = -ENOMEM;
                 goto out;
-        genlmsg_end(report_skb, header);
-        result = genlmsg_multicast(report_skb, 0, wimax_gnl_mcg.id, GFP_KERNEL);
-        if (result == -ESRCH)   /* Nobody connected, ignore it */
-                result = 0;     /* btw, the skb is freed already */
-        if (result < 0) {
-                dev_err(dev, "RE_STCH: Error sending: %d\n", result);
-                nlmsg_free(report_skb);
         }
+        genlmsg_end(report_skb, header);
+        genlmsg_multicast(report_skb, 0, wimax_gnl_mcg.id, GFP_KERNEL);
 out:
         d_fnend(3, dev, "(wimax_dev %p report_skb %p) = %d\n",
                 wimax_dev, report_skb, result);
diff --git a/net/wireless/Makefile b/net/wireless/Makefile
index 938a334c8dbc..dad43c24f695 100644
--- a/net/wireless/Makefile
+++ b/net/wireless/Makefile
@@ -5,7 +5,7 @@ obj-$(CONFIG_LIB80211_CRYPT_WEP) += lib80211_crypt_wep.o
 obj-$(CONFIG_LIB80211_CRYPT_CCMP) += lib80211_crypt_ccmp.o
 obj-$(CONFIG_LIB80211_CRYPT_TKIP) += lib80211_crypt_tkip.o
 
-cfg80211-y += core.o sysfs.o radiotap.o util.o reg.o
+cfg80211-y += core.o sysfs.o radiotap.o util.o reg.o scan.o
 cfg80211-$(CONFIG_WIRELESS_EXT) += wext-compat.o
 cfg80211-$(CONFIG_NL80211) += nl80211.o
 
diff --git a/net/wireless/core.c b/net/wireless/core.c
index b96fc0c3f1c4..0668b2bfc1da 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -240,6 +240,8 @@ struct wiphy *wiphy_new(struct cfg80211_ops *ops, int sizeof_priv)
         mutex_init(&drv->mtx);
         mutex_init(&drv->devlist_mtx);
         INIT_LIST_HEAD(&drv->netdev_list);
+        spin_lock_init(&drv->bss_lock);
+        INIT_LIST_HEAD(&drv->bss_list);
 
         device_initialize(&drv->wiphy.dev);
         drv->wiphy.dev.class = &ieee80211_class;
@@ -259,6 +261,9 @@ int wiphy_register(struct wiphy *wiphy)
         int i;
         u16 ifmodes = wiphy->interface_modes;
 
+        if (WARN_ON(wiphy->max_scan_ssids < 1))
+                return -EINVAL;
+
         /* sanity check ifmodes */
         WARN_ON(!ifmodes);
         ifmodes &= ((1 << __NL80211_IFTYPE_AFTER_LAST) - 1) & ~1;
@@ -273,10 +278,16 @@ int wiphy_register(struct wiphy *wiphy)
 
                 sband->band = band;
 
-                if (!sband->n_channels || !sband->n_bitrates) {
-                        WARN_ON(1);
+                if (WARN_ON(!sband->n_channels || !sband->n_bitrates))
+                        return -EINVAL;
+
+                /*
+                 * Since we use a u32 for rate bitmaps in
+                 * ieee80211_get_response_rate, we cannot
+                 * have more than 32 legacy rates.
+                 */
+                if (WARN_ON(sband->n_bitrates > 32))
                         return -EINVAL;
-                }
 
                 for (i = 0; i < sband->n_channels; i++) {
                         sband->channels[i].orig_flags =
@@ -361,8 +372,11 @@ EXPORT_SYMBOL(wiphy_unregister);
 
 void cfg80211_dev_free(struct cfg80211_registered_device *drv)
 {
+        struct cfg80211_internal_bss *scan, *tmp;
         mutex_destroy(&drv->mtx);
         mutex_destroy(&drv->devlist_mtx);
+        list_for_each_entry_safe(scan, tmp, &drv->bss_list, list)
+                cfg80211_put_bss(&scan->pub);
         kfree(drv);
 }
 
diff --git a/net/wireless/core.h b/net/wireless/core.h
index f7fb9f413028..e29ad4cd464f 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -8,6 +8,8 @@
 #include <linux/mutex.h>
 #include <linux/list.h>
 #include <linux/netdevice.h>
+#include <linux/kref.h>
+#include <linux/rbtree.h>
 #include <net/genetlink.h>
 #include <net/wireless.h>
 #include <net/cfg80211.h>
@@ -41,6 +43,13 @@ struct cfg80211_registered_device {
         struct mutex devlist_mtx;
         struct list_head netdev_list;
 
+        /* BSSes/scanning */
+        spinlock_t bss_lock;
+        struct list_head bss_list;
+        struct rb_root bss_tree;
+        u32 bss_generation;
+        struct cfg80211_scan_request *scan_req; /* protected by RTNL */
+
         /* must be last because of the way we do wiphy_priv(),
          * and it should at least be aligned to NETDEV_ALIGN */
         struct wiphy wiphy __attribute__((__aligned__(NETDEV_ALIGN)));
@@ -56,6 +65,15 @@ struct cfg80211_registered_device *wiphy_to_dev(struct wiphy *wiphy)
 extern struct mutex cfg80211_drv_mutex;
 extern struct list_head cfg80211_drv_list;
 
+struct cfg80211_internal_bss {
+        struct list_head list;
+        struct rb_node rbn;
+        unsigned long ts;
+        struct kref ref;
+        /* must be last because of priv member */
+        struct cfg80211_bss pub;
+};
+
 /*
  * This function returns a pointer to the driver
  * that the genl_info item that is passed refers to.
@@ -94,4 +112,6 @@ extern int cfg80211_dev_rename(struct cfg80211_registered_device *drv,
 void ieee80211_set_bitrate_flags(struct wiphy *wiphy);
 void wiphy_update_regulatory(struct wiphy *wiphy, enum reg_set_by setby);
 
+void cfg80211_bss_expire(struct cfg80211_registered_device *dev);
+
 #endif /* __NET_WIRELESS_CORE_H */
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 1e728fff474e..298a4de59948 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -14,6 +14,7 @@
 #include <linux/nl80211.h>
 #include <linux/rtnetlink.h>
 #include <linux/netlink.h>
+#include <linux/etherdevice.h>
 #include <net/genetlink.h>
 #include <net/cfg80211.h>
 #include "core.h"
@@ -105,6 +106,12 @@ static struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] __read_mostly = {
 
         [NL80211_ATTR_HT_CAPABILITY] = { .type = NLA_BINARY,
                                          .len = NL80211_HT_CAPABILITY_LEN },
+
+        [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
+        [NL80211_ATTR_IE] = { .type = NLA_BINARY,
+                              .len = IEEE80211_MAX_DATA_LEN },
+        [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
+        [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 };
 
 /* message building helper */
@@ -137,6 +144,8 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 
         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, dev->idx);
         NLA_PUT_STRING(msg, NL80211_ATTR_WIPHY_NAME, wiphy_name(&dev->wiphy));
+        NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
+                   dev->wiphy.max_scan_ssids);
 
         nl_modes = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_IFTYPES);
         if (!nl_modes)
@@ -738,7 +747,7 @@ static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
         if (info->attrs[NL80211_ATTR_KEY_IDX])
                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 
-        if (key_idx > 3)
+        if (key_idx > 5)
                 return -EINVAL;
 
         if (info->attrs[NL80211_ATTR_MAC])
@@ -804,30 +813,41 @@ static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
         int err;
         struct net_device *dev;
         u8 key_idx;
+        int (*func)(struct wiphy *wiphy, struct net_device *netdev,
+                    u8 key_index);
 
         if (!info->attrs[NL80211_ATTR_KEY_IDX])
                 return -EINVAL;
 
         key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 
-        if (key_idx > 3)
+        if (info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT]) {
+                if (key_idx < 4 || key_idx > 5)
+                        return -EINVAL;
+        } else if (key_idx > 3)
                 return -EINVAL;
 
         /* currently only support setting default key */
-        if (!info->attrs[NL80211_ATTR_KEY_DEFAULT])
+        if (!info->attrs[NL80211_ATTR_KEY_DEFAULT] &&
+            !info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT])
                 return -EINVAL;
 
         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
         if (err)
                 return err;
 
-        if (!drv->ops->set_default_key) {
+        if (info->attrs[NL80211_ATTR_KEY_DEFAULT])
+                func = drv->ops->set_default_key;
+        else
+                func = drv->ops->set_default_mgmt_key;
+
+        if (!func) {
                 err = -EOPNOTSUPP;
                 goto out;
         }
 
         rtnl_lock();
-        err = drv->ops->set_default_key(&drv->wiphy, dev, key_idx);
+        err = func(&drv->wiphy, dev, key_idx);
         rtnl_unlock();
 
  out:
@@ -863,7 +883,7 @@ static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
         if (info->attrs[NL80211_ATTR_MAC])
                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
 
-        if (key_idx > 3)
+        if (key_idx > 5)
                 return -EINVAL;
 
         /*
@@ -894,6 +914,10 @@ static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
                 if (params.key_len != 13)
                         return -EINVAL;
                 break;
+        case WLAN_CIPHER_SUITE_AES_CMAC:
+                if (params.key_len != 16)
+                        return -EINVAL;
+                break;
         default:
                 return -EINVAL;
         }
@@ -928,7 +952,7 @@ static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
         if (info->attrs[NL80211_ATTR_KEY_IDX])
                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 
-        if (key_idx > 3)
+        if (key_idx > 5)
                 return -EINVAL;
 
         if (info->attrs[NL80211_ATTR_MAC])
@@ -1889,6 +1913,11 @@ static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
         mutex_lock(&cfg80211_drv_mutex);
         r = __regulatory_hint(NULL, REGDOM_SET_BY_USER, data, 0, ENVIRON_ANY);
         mutex_unlock(&cfg80211_drv_mutex);
+        /* This means the regulatory domain was already set, however
+         * we don't want to confuse userspace with a "successful error"
+         * message so lets just treat it as a success */
+        if (r == -EALREADY)
+                r = 0;
         return r;
 }
 
@@ -2069,6 +2098,81 @@ static int nl80211_set_mesh_params(struct sk_buff *skb, struct genl_info *info)
 
 #undef FILL_IN_MESH_PARAM_IF_SET
 
+static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
+{
+        struct sk_buff *msg;
+        void *hdr = NULL;
+        struct nlattr *nl_reg_rules;
+        unsigned int i;
+        int err = -EINVAL;
+
+        mutex_lock(&cfg80211_drv_mutex);
+
+        if (!cfg80211_regdomain)
+                goto out;
+
+        msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
+        if (!msg) {
+                err = -ENOBUFS;
+                goto out;
+        }
+
+        hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
+                             NL80211_CMD_GET_REG);
+        if (!hdr)
+                goto nla_put_failure;
+
+        NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2,
+                cfg80211_regdomain->alpha2);
+
+        nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
+        if (!nl_reg_rules)
+                goto nla_put_failure;
+
+        for (i = 0; i < cfg80211_regdomain->n_reg_rules; i++) {
+                struct nlattr *nl_reg_rule;
+                const struct ieee80211_reg_rule *reg_rule;
+                const struct ieee80211_freq_range *freq_range;
+                const struct ieee80211_power_rule *power_rule;
+
+                reg_rule = &cfg80211_regdomain->reg_rules[i];
+                freq_range = &reg_rule->freq_range;
+                power_rule = &reg_rule->power_rule;
+
+                nl_reg_rule = nla_nest_start(msg, i);
+                if (!nl_reg_rule)
+                        goto nla_put_failure;
+
+                NLA_PUT_U32(msg, NL80211_ATTR_REG_RULE_FLAGS,
+                        reg_rule->flags);
+                NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_START,
+                        freq_range->start_freq_khz);
+                NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_END,
+                        freq_range->end_freq_khz);
+                NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
+                        freq_range->max_bandwidth_khz);
+                NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
+                        power_rule->max_antenna_gain);
+                NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
+                        power_rule->max_eirp);
+
+                nla_nest_end(msg, nl_reg_rule);
+        }
+
+        nla_nest_end(msg, nl_reg_rules);
+
+        genlmsg_end(msg, hdr);
+        err = genlmsg_unicast(msg, info->snd_pid);
+        goto out;
+
+nla_put_failure:
+        genlmsg_cancel(msg, hdr);
+        err = -EMSGSIZE;
+out:
+        mutex_unlock(&cfg80211_drv_mutex);
+        return err;
+}
+
 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
 {
         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
@@ -2134,6 +2238,283 @@ static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
         return -EINVAL;
 }
 
+static int nl80211_set_mgmt_extra_ie(struct sk_buff *skb,
+                                     struct genl_info *info)
+{
+        struct cfg80211_registered_device *drv;
+        int err;
+        struct net_device *dev;
+        struct mgmt_extra_ie_params params;
+
+        memset(&params, 0, sizeof(params));
+
+        if (!info->attrs[NL80211_ATTR_MGMT_SUBTYPE])
+                return -EINVAL;
+        params.subtype = nla_get_u8(info->attrs[NL80211_ATTR_MGMT_SUBTYPE]);
+        if (params.subtype > 15)
+                return -EINVAL; /* FC Subtype field is 4 bits (0..15) */
+
+        if (info->attrs[NL80211_ATTR_IE]) {
+                params.ies = nla_data(info->attrs[NL80211_ATTR_IE]);
+                params.ies_len = nla_len(info->attrs[NL80211_ATTR_IE]);
+        }
+
+        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
+        if (err)
+                return err;
+
+        if (drv->ops->set_mgmt_extra_ie) {
+                rtnl_lock();
+                err = drv->ops->set_mgmt_extra_ie(&drv->wiphy, dev, &params);
+                rtnl_unlock();
+        } else
+                err = -EOPNOTSUPP;
+
+        cfg80211_put_dev(drv);
+        dev_put(dev);
+        return err;
+}
+
+static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
+{
+        struct cfg80211_registered_device *drv;
+        struct net_device *dev;
+        struct cfg80211_scan_request *request;
+        struct cfg80211_ssid *ssid;
+        struct ieee80211_channel *channel;
+        struct nlattr *attr;
+        struct wiphy *wiphy;
+        int err, tmp, n_ssids = 0, n_channels = 0, i;
+        enum ieee80211_band band;
+
+        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
+        if (err)
+                return err;
+
+        wiphy = &drv->wiphy;
+
+        if (!drv->ops->scan) {
+                err = -EOPNOTSUPP;
+                goto out;
+        }
+
+        rtnl_lock();
+
+        if (drv->scan_req) {
+                err = -EBUSY;
+                goto out_unlock;
+        }
+
+        if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
+                nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp)
+                        n_channels++;
+                if (!n_channels) {
+                        err = -EINVAL;
+                        goto out_unlock;
+                }
+        } else {
+                for (band = 0; band < IEEE80211_NUM_BANDS; band++)
+                        if (wiphy->bands[band])
+                                n_channels += wiphy->bands[band]->n_channels;
+        }
+
+        if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
+                nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
+                        n_ssids++;
+
+        if (n_ssids > wiphy->max_scan_ssids) {
+                err = -EINVAL;
+                goto out_unlock;
+        }
+
+        request = kzalloc(sizeof(*request)
+                        + sizeof(*ssid) * n_ssids
+                        + sizeof(channel) * n_channels, GFP_KERNEL);
+        if (!request) {
+                err = -ENOMEM;
+                goto out_unlock;
+        }
+
+        request->channels = (void *)((char *)request + sizeof(*request));
+        request->n_channels = n_channels;
+        if (n_ssids)
+                request->ssids = (void *)(request->channels + n_channels);
+        request->n_ssids = n_ssids;
+
+        if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
+                /* user specified, bail out if channel not found */
+                request->n_channels = n_channels;
+                i = 0;
+                nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
+                        request->channels[i] = ieee80211_get_channel(wiphy, nla_get_u32(attr));
+                        if (!request->channels[i]) {
+                                err = -EINVAL;
+                                goto out_free;
+                        }
+                        i++;
+                }
+        } else {
+                /* all channels */
+                i = 0;
+                for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
+                        int j;
+                        if (!wiphy->bands[band])
+                                continue;
+                        for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
+                                request->channels[i] = &wiphy->bands[band]->channels[j];
+                                i++;
+                        }
+                }
+        }
+
+        i = 0;
+        if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
+                nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
+                        if (request->ssids[i].ssid_len > IEEE80211_MAX_SSID_LEN) {
+                                err = -EINVAL;
+                                goto out_free;
+                        }
+                        memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
+                        request->ssids[i].ssid_len = nla_len(attr);
+                        i++;
+                }
+        }
+
+        request->ifidx = dev->ifindex;
+        request->wiphy = &drv->wiphy;
+
+        drv->scan_req = request;
+        err = drv->ops->scan(&drv->wiphy, dev, request);
+
+ out_free:
+        if (err) {
+                drv->scan_req = NULL;
+                kfree(request);
+        }
+ out_unlock:
+        rtnl_unlock();
+ out:
+        cfg80211_put_dev(drv);
+        dev_put(dev);
+        return err;
+}
+
+static int nl80211_send_bss(struct sk_buff *msg, u32 pid, u32 seq, int flags,
+                            struct cfg80211_registered_device *rdev,
+                            struct net_device *dev,
+                            struct cfg80211_bss *res)
+{
+        void *hdr;
+        struct nlattr *bss;
+
+        hdr = nl80211hdr_put(msg, pid, seq, flags,
+                             NL80211_CMD_NEW_SCAN_RESULTS);
+        if (!hdr)
+                return -1;
+
+        NLA_PUT_U32(msg, NL80211_ATTR_SCAN_GENERATION,
+                    rdev->bss_generation);
+        NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
+
+        bss = nla_nest_start(msg, NL80211_ATTR_BSS);
+        if (!bss)
+                goto nla_put_failure;
+        if (!is_zero_ether_addr(res->bssid))
+                NLA_PUT(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid);
+        if (res->information_elements && res->len_information_elements)
+                NLA_PUT(msg, NL80211_BSS_INFORMATION_ELEMENTS,
+                        res->len_information_elements,
+                        res->information_elements);
+        if (res->tsf)
+                NLA_PUT_U64(msg, NL80211_BSS_TSF, res->tsf);
+        if (res->beacon_interval)
+                NLA_PUT_U16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval);
+        NLA_PUT_U16(msg, NL80211_BSS_CAPABILITY, res->capability);
+        NLA_PUT_U32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq);
+
+        switch (res->signal_type) {
+        case CFG80211_SIGNAL_TYPE_MBM:
+                NLA_PUT_U32(msg, NL80211_BSS_SIGNAL_MBM, res->signal);
+                break;
+        case CFG80211_SIGNAL_TYPE_UNSPEC:
+                NLA_PUT_U8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal);
+                break;
+        default:
+                break;
+        }
+
+        nla_nest_end(msg, bss);
+
+        return genlmsg_end(msg, hdr);
+
+ nla_put_failure:
+        genlmsg_cancel(msg, hdr);
+        return -EMSGSIZE;
+}
+
+static int nl80211_dump_scan(struct sk_buff *skb,
+                             struct netlink_callback *cb)
+{
+        struct cfg80211_registered_device *dev;
+        struct net_device *netdev;
+        struct cfg80211_internal_bss *scan;
+        int ifidx = cb->args[0];
+        int start = cb->args[1], idx = 0;
+        int err;
+
+        if (!ifidx) {
+                err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
+                                  nl80211_fam.attrbuf, nl80211_fam.maxattr,
+                                  nl80211_policy);
+                if (err)
+                        return err;
+
+                if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
+                        return -EINVAL;
+
+                ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
+                if (!ifidx)
+                        return -EINVAL;
+                cb->args[0] = ifidx;
+        }
+
+        netdev = dev_get_by_index(&init_net, ifidx);
+        if (!netdev)
+                return -ENODEV;
+
+        dev = cfg80211_get_dev_from_ifindex(ifidx);
+        if (IS_ERR(dev)) {
+                err = PTR_ERR(dev);
+                goto out_put_netdev;
+        }
+
+        spin_lock_bh(&dev->bss_lock);
+        cfg80211_bss_expire(dev);
+
+        list_for_each_entry(scan, &dev->bss_list, list) {
+                if (++idx <= start)
+                        continue;
+                if (nl80211_send_bss(skb,
+                                NETLINK_CB(cb->skb).pid,
+                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
+                                dev, netdev, &scan->pub) < 0) {
+                        idx--;
+                        goto out;
+                }
+        }
+
+ out:
+        spin_unlock_bh(&dev->bss_lock);
+
+        cb->args[1] = idx;
+        err = skb->len;
+        cfg80211_put_dev(dev);
+ out_put_netdev:
+        dev_put(netdev);
+
+        return err;
+}
+
 static struct genl_ops nl80211_ops[] = {
         {
                 .cmd = NL80211_CMD_GET_WIPHY,
@@ -2272,6 +2653,12 @@ static struct genl_ops nl80211_ops[] = {
                 .flags = GENL_ADMIN_PERM,
         },
         {
+                .cmd = NL80211_CMD_GET_REG,
+                .doit = nl80211_get_reg,
+                .policy = nl80211_policy,
+                /* can be retrieved by unprivileged users */
+        },
+        {
                 .cmd = NL80211_CMD_SET_REG,
                 .doit = nl80211_set_reg,
                 .policy = nl80211_policy,
@@ -2295,12 +2682,32 @@ static struct genl_ops nl80211_ops[] = {
                 .policy = nl80211_policy,
                 .flags = GENL_ADMIN_PERM,
         },
+        {
+                .cmd = NL80211_CMD_SET_MGMT_EXTRA_IE,
+                .doit = nl80211_set_mgmt_extra_ie,
+                .policy = nl80211_policy,
+                .flags = GENL_ADMIN_PERM,
+        },
+        {
+                .cmd = NL80211_CMD_TRIGGER_SCAN,
+                .doit = nl80211_trigger_scan,
+                .policy = nl80211_policy,
+                .flags = GENL_ADMIN_PERM,
+        },
+        {
+                .cmd = NL80211_CMD_GET_SCAN,
+                .policy = nl80211_policy,
+                .dumpit = nl80211_dump_scan,
+        },
 };
 
 /* multicast groups */
 static struct genl_multicast_group nl80211_config_mcgrp = {
         .name = "config",
 };
+static struct genl_multicast_group nl80211_scan_mcgrp = {
+        .name = "scan",
+};
 
 /* notification functions */
 
@@ -2320,6 +2727,66 @@ void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
         genlmsg_multicast(msg, 0, nl80211_config_mcgrp.id, GFP_KERNEL);
 }
 
+static int nl80211_send_scan_donemsg(struct sk_buff *msg,
+                                    struct cfg80211_registered_device *rdev,
+                                    struct net_device *netdev,
+                                    u32 pid, u32 seq, int flags,
+                                    u32 cmd)
+{
+        void *hdr;
+
+        hdr = nl80211hdr_put(msg, pid, seq, flags, cmd);
+        if (!hdr)
+                return -1;
+
+        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->idx);
+        NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
+
+        /* XXX: we should probably bounce back the request? */
+
+        return genlmsg_end(msg, hdr);
+
+ nla_put_failure:
+        genlmsg_cancel(msg, hdr);
+        return -EMSGSIZE;
+}
+
+void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
+                            struct net_device *netdev)
+{
+        struct sk_buff *msg;
+
+        msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
+        if (!msg)
+                return;
+
+        if (nl80211_send_scan_donemsg(msg, rdev, netdev, 0, 0, 0,
+                                      NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
+                nlmsg_free(msg);
+                return;
+        }
+
+        genlmsg_multicast(msg, 0, nl80211_scan_mcgrp.id, GFP_KERNEL);
+}
+
+void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
+                               struct net_device *netdev)
+{
+        struct sk_buff *msg;
+
+        msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
+        if (!msg)
+                return;
+
+        if (nl80211_send_scan_donemsg(msg, rdev, netdev, 0, 0, 0,
+                                      NL80211_CMD_SCAN_ABORTED) < 0) {
+                nlmsg_free(msg);
+                return;
+        }
+
+        genlmsg_multicast(msg, 0, nl80211_scan_mcgrp.id, GFP_KERNEL);
+}
+
 /* initialisation/exit functions */
 
 int nl80211_init(void)
@@ -2340,6 +2807,10 @@ int nl80211_init(void)
         if (err)
                 goto err_out;
 
+        err = genl_register_mc_group(&nl80211_fam, &nl80211_scan_mcgrp);
+        if (err)
+                goto err_out;
+
         return 0;
  err_out:
         genl_unregister_family(&nl80211_fam);
diff --git a/net/wireless/nl80211.h b/net/wireless/nl80211.h
index f3ea5c029aee..b565a5f84e97 100644
--- a/net/wireless/nl80211.h
+++ b/net/wireless/nl80211.h
@@ -7,6 +7,10 @@
 extern int nl80211_init(void);
 extern void nl80211_exit(void);
 extern void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev);
+extern void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
+                                   struct net_device *netdev);
+extern void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
+                                      struct net_device *netdev);
 #else
 static inline int nl80211_init(void)
 {
@@ -19,6 +23,10 @@ static inline void nl80211_notify_dev_rename(
         struct cfg80211_registered_device *rdev)
 {
 }
+static inline void
+nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
+                       struct net_device *netdev)
+{}
 #endif /* CONFIG_NL80211 */
 
 #endif /* __NET_WIRELESS_NL80211_H */
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 85c9034c59b2..2323644330cd 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -42,38 +42,6 @@
 #include "core.h"
 #include "reg.h"
 
-/**
- * struct regulatory_request - receipt of last regulatory request
- *
- * @wiphy: this is set if this request's initiator is
- *      %REGDOM_SET_BY_COUNTRY_IE or %REGDOM_SET_BY_DRIVER. This
- *      can be used by the wireless core to deal with conflicts
- *      and potentially inform users of which devices specifically
- *      cased the conflicts.
- * @initiator: indicates who sent this request, could be any of
- *      of those set in reg_set_by, %REGDOM_SET_BY_*
- * @alpha2: the ISO / IEC 3166 alpha2 country code of the requested
- *      regulatory domain. We have a few special codes:
- *      00 - World regulatory domain
- *      99 - built by driver but a specific alpha2 cannot be determined
- *      98 - result of an intersection between two regulatory domains
- * @intersect: indicates whether the wireless core should intersect
- *      the requested regulatory domain with the presently set regulatory
- *      domain.
- * @country_ie_checksum: checksum of the last processed and accepted
- *      country IE
- * @country_ie_env: lets us know if the AP is telling us we are outdoor,
- *      indoor, or if it doesn't matter
- */
-struct regulatory_request {
-        struct wiphy *wiphy;
-        enum reg_set_by initiator;
-        char alpha2[2];
-        bool intersect;
-        u32 country_ie_checksum;
-        enum environment_cap country_ie_env;
-};
-
 /* Receipt of information from last regulatory request */
 static struct regulatory_request *last_request;
 
@@ -89,7 +57,7 @@ static u32 supported_bandwidths[] = {
 /* Central wireless core regulatory domains, we only need two,
  * the current one and a world regulatory domain in case we have no
  * information to give us an alpha2 */
-static const struct ieee80211_regdomain *cfg80211_regdomain;
+const struct ieee80211_regdomain *cfg80211_regdomain;
 
 /* We use this as a place for the rd structure built from the
  * last parsed country IE to rest until CRDA gets back to us with
@@ -790,42 +758,35 @@ static u32 map_regdom_flags(u32 rd_flags)
         return channel_flags;
 }
 
-/**
- * freq_reg_info - get regulatory information for the given frequency
- * @center_freq: Frequency in KHz for which we want regulatory information for
- * @bandwidth: the bandwidth requirement you have in KHz, if you do not have one
- *      you can set this to 0. If this frequency is allowed we then set
- *      this value to the maximum allowed bandwidth.
- * @reg_rule: the regulatory rule which we have for this frequency
- *
- * Use this function to get the regulatory rule for a specific frequency on
- * a given wireless device. If the device has a specific regulatory domain
- * it wants to follow we respect that unless a country IE has been received
- * and processed already.
- *
- * Returns 0 if it was able to find a valid regulatory rule which does
- * apply to the given center_freq otherwise it returns non-zero. It will
- * also return -ERANGE if we determine the given center_freq does not even have
- * a regulatory rule for a frequency range in the center_freq's band. See
- * freq_in_rule_band() for our current definition of a band -- this is purely
- * subjective and right now its 802.11 specific.
- */
-static int freq_reg_info(u32 center_freq, u32 *bandwidth,
-                         const struct ieee80211_reg_rule **reg_rule)
+static int freq_reg_info_regd(struct wiphy *wiphy,
+                              u32 center_freq,
+                              u32 *bandwidth,
+                              const struct ieee80211_reg_rule **reg_rule,
+                              const struct ieee80211_regdomain *custom_regd)
 {
         int i;
         bool band_rule_found = false;
+        const struct ieee80211_regdomain *regd;
         u32 max_bandwidth = 0;
 
-        if (!cfg80211_regdomain)
+        regd = custom_regd ? custom_regd : cfg80211_regdomain;
+
+        /* Follow the driver's regulatory domain, if present, unless a country
+         * IE has been processed or a user wants to help complaince further */
+        if (last_request->initiator != REGDOM_SET_BY_COUNTRY_IE &&
+            last_request->initiator != REGDOM_SET_BY_USER &&
+            wiphy->regd)
+                regd = wiphy->regd;
+
+        if (!regd)
                 return -EINVAL;
 
-        for (i = 0; i < cfg80211_regdomain->n_reg_rules; i++) {
+        for (i = 0; i < regd->n_reg_rules; i++) {
                 const struct ieee80211_reg_rule *rr;
                 const struct ieee80211_freq_range *fr = NULL;
                 const struct ieee80211_power_rule *pr = NULL;
 
-                rr = &cfg80211_regdomain->reg_rules[i];
+                rr = &regd->reg_rules[i];
                 fr = &rr->freq_range;
                 pr = &rr->power_rule;
 
@@ -849,6 +810,14 @@ static int freq_reg_info(u32 center_freq, u32 *bandwidth,
 
         return !max_bandwidth;
 }
+EXPORT_SYMBOL(freq_reg_info);
+
+int freq_reg_info(struct wiphy *wiphy, u32 center_freq, u32 *bandwidth,
+                         const struct ieee80211_reg_rule **reg_rule)
+{
+        return freq_reg_info_regd(wiphy, center_freq,
+                bandwidth, reg_rule, NULL);
+}
 
 static void handle_channel(struct wiphy *wiphy, enum ieee80211_band band,
                            unsigned int chan_idx)
@@ -867,7 +836,7 @@ static void handle_channel(struct wiphy *wiphy, enum ieee80211_band band,
 
         flags = chan->orig_flags;
 
-        r = freq_reg_info(MHZ_TO_KHZ(chan->center_freq),
+        r = freq_reg_info(wiphy, MHZ_TO_KHZ(chan->center_freq),
                 &max_bandwidth, &reg_rule);
 
         if (r) {
@@ -907,6 +876,22 @@ static void handle_channel(struct wiphy *wiphy, enum ieee80211_band band,
 
         power_rule = &reg_rule->power_rule;
 
+        if (last_request->initiator == REGDOM_SET_BY_DRIVER &&
+            last_request->wiphy && last_request->wiphy == wiphy &&
+            last_request->wiphy->strict_regulatory) {
+                /* This gaurantees the driver's requested regulatory domain
+                 * will always be used as a base for further regulatory
+                 * settings */
+                chan->flags = chan->orig_flags =
+                        map_regdom_flags(reg_rule->flags);
+                chan->max_antenna_gain = chan->orig_mag =
+                        (int) MBI_TO_DBI(power_rule->max_antenna_gain);
+                chan->max_bandwidth = KHZ_TO_MHZ(max_bandwidth);
+                chan->max_power = chan->orig_mpwr =
+                        (int) MBM_TO_DBM(power_rule->max_eirp);
+                return;
+        }
+
         chan->flags = flags | map_regdom_flags(reg_rule->flags);
         chan->max_antenna_gain = min(chan->orig_mag,
                 (int) MBI_TO_DBI(power_rule->max_antenna_gain));
@@ -935,7 +920,12 @@ static bool ignore_reg_update(struct wiphy *wiphy, enum reg_set_by setby)
         if (!last_request)
                 return true;
         if (setby == REGDOM_SET_BY_CORE &&
-                  wiphy->fw_handles_regulatory)
+                  wiphy->custom_regulatory)
+                return true;
+        /* wiphy->regd will be set once the device has its own
+         * desired regulatory domain set */
+        if (wiphy->strict_regulatory && !wiphy->regd &&
+            !is_world_regdom(last_request->alpha2))
                 return true;
         return false;
 }
@@ -945,20 +935,103 @@ static void update_all_wiphy_regulatory(enum reg_set_by setby)
         struct cfg80211_registered_device *drv;
 
         list_for_each_entry(drv, &cfg80211_drv_list, list)
-                if (!ignore_reg_update(&drv->wiphy, setby))
-                        wiphy_update_regulatory(&drv->wiphy, setby);
+                wiphy_update_regulatory(&drv->wiphy, setby);
 }
 
 void wiphy_update_regulatory(struct wiphy *wiphy, enum reg_set_by setby)
 {
         enum ieee80211_band band;
+
+        if (ignore_reg_update(wiphy, setby))
+                return;
         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
                 if (wiphy->bands[band])
                         handle_band(wiphy, band);
-                if (wiphy->reg_notifier)
-                        wiphy->reg_notifier(wiphy, setby);
+        }
+        if (wiphy->reg_notifier)
+                wiphy->reg_notifier(wiphy, last_request);
+}
+
+static void handle_channel_custom(struct wiphy *wiphy,
+                                  enum ieee80211_band band,
+                                  unsigned int chan_idx,
+                                  const struct ieee80211_regdomain *regd)
+{
+        int r;
+        u32 max_bandwidth = 0;
+        const struct ieee80211_reg_rule *reg_rule = NULL;
+        const struct ieee80211_power_rule *power_rule = NULL;
+        struct ieee80211_supported_band *sband;
+        struct ieee80211_channel *chan;
+
+        sband = wiphy->bands[band];
+        BUG_ON(chan_idx >= sband->n_channels);
+        chan = &sband->channels[chan_idx];
+
+        r = freq_reg_info_regd(wiphy, MHZ_TO_KHZ(chan->center_freq),
+                &max_bandwidth, &reg_rule, regd);
+
+        if (r) {
+                chan->flags = IEEE80211_CHAN_DISABLED;
+                return;
+        }
+
+        power_rule = &reg_rule->power_rule;
+
+        chan->flags |= map_regdom_flags(reg_rule->flags);
+        chan->max_antenna_gain = (int) MBI_TO_DBI(power_rule->max_antenna_gain);
+        chan->max_bandwidth = KHZ_TO_MHZ(max_bandwidth);
+        chan->max_power = (int) MBM_TO_DBM(power_rule->max_eirp);
+}
+
+static void handle_band_custom(struct wiphy *wiphy, enum ieee80211_band band,
+                               const struct ieee80211_regdomain *regd)
+{
+        unsigned int i;
+        struct ieee80211_supported_band *sband;
+
+        BUG_ON(!wiphy->bands[band]);
+        sband = wiphy->bands[band];
+
+        for (i = 0; i < sband->n_channels; i++)
+                handle_channel_custom(wiphy, band, i, regd);
+}
+
+/* Used by drivers prior to wiphy registration */
+void wiphy_apply_custom_regulatory(struct wiphy *wiphy,
+                                   const struct ieee80211_regdomain *regd)
+{
+        enum ieee80211_band band;
+        for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
+                if (wiphy->bands[band])
+                        handle_band_custom(wiphy, band, regd);
         }
 }
+EXPORT_SYMBOL(wiphy_apply_custom_regulatory);
+
+static int reg_copy_regd(const struct ieee80211_regdomain **dst_regd,
+                         const struct ieee80211_regdomain *src_regd)
+{
+        struct ieee80211_regdomain *regd;
+        int size_of_regd = 0;
+        unsigned int i;
+
+        size_of_regd = sizeof(struct ieee80211_regdomain) +
+          ((src_regd->n_reg_rules + 1) * sizeof(struct ieee80211_reg_rule));
+
+        regd = kzalloc(size_of_regd, GFP_KERNEL);
+        if (!regd)
+                return -ENOMEM;
+
+        memcpy(regd, src_regd, sizeof(struct ieee80211_regdomain));
+
+        for (i = 0; i < src_regd->n_reg_rules; i++)
+                memcpy(&regd->reg_rules[i], &src_regd->reg_rules[i],
+                        sizeof(struct ieee80211_reg_rule));
+
+        *dst_regd = regd;
+        return 0;
+}
 
 /* Return value which can be used by ignore_request() to indicate
  * it has been determined we should intersect two regulatory domains */
@@ -1007,9 +1080,14 @@ static int ignore_request(struct wiphy *wiphy, enum reg_set_by set_by,
                 }
                 return REG_INTERSECT;
         case REGDOM_SET_BY_DRIVER:
-                if (last_request->initiator == REGDOM_SET_BY_DRIVER)
+                if (last_request->initiator == REGDOM_SET_BY_CORE) {
+                        if (is_old_static_regdom(cfg80211_regdomain))
+                                return 0;
+                        if (!alpha2_equal(cfg80211_regdomain->alpha2, alpha2))
+                                return 0;
                         return -EALREADY;
-                return 0;
+                }
+                return REG_INTERSECT;
         case REGDOM_SET_BY_USER:
                 if (last_request->initiator == REGDOM_SET_BY_COUNTRY_IE)
                         return REG_INTERSECT;
@@ -1018,6 +1096,20 @@ static int ignore_request(struct wiphy *wiphy, enum reg_set_by set_by,
                 if (last_request->initiator == REGDOM_SET_BY_USER &&
                           last_request->intersect)
                         return -EOPNOTSUPP;
+                /* Process user requests only after previous user/driver/core
+                 * requests have been processed */
+                if (last_request->initiator == REGDOM_SET_BY_CORE ||
+                    last_request->initiator == REGDOM_SET_BY_DRIVER ||
+                    last_request->initiator == REGDOM_SET_BY_USER) {
+                        if (!alpha2_equal(last_request->alpha2,
+                            cfg80211_regdomain->alpha2))
+                                return -EAGAIN;
+                }
+
+                if (!is_old_static_regdom(cfg80211_regdomain) &&
+                    alpha2_equal(cfg80211_regdomain->alpha2, alpha2))
+                        return -EALREADY;
+
                 return 0;
         }
 
@@ -1036,11 +1128,28 @@ int __regulatory_hint(struct wiphy *wiphy, enum reg_set_by set_by,
 
         r = ignore_request(wiphy, set_by, alpha2);
 
-        if (r == REG_INTERSECT)
+        if (r == REG_INTERSECT) {
+                if (set_by == REGDOM_SET_BY_DRIVER) {
+                        r = reg_copy_regd(&wiphy->regd, cfg80211_regdomain);
+                        if (r)
+                                return r;
+                }
                 intersect = true;
-        else if (r)
+        } else if (r) {
+                /* If the regulatory domain being requested by the
+                 * driver has already been set just copy it to the
+                 * wiphy */
+                if (r == -EALREADY && set_by == REGDOM_SET_BY_DRIVER) {
+                        r = reg_copy_regd(&wiphy->regd, cfg80211_regdomain);
+                        if (r)
+                                return r;
+                        r = -EALREADY;
+                        goto new_request;
+                }
                 return r;
+        }
 
+new_request:
         request = kzalloc(sizeof(struct regulatory_request),
                           GFP_KERNEL);
         if (!request)
@@ -1056,6 +1165,11 @@ int __regulatory_hint(struct wiphy *wiphy, enum reg_set_by set_by,
 
         kfree(last_request);
         last_request = request;
+
+        /* When r == REG_INTERSECT we do need to call CRDA */
+        if (r < 0)
+                return r;
+
         /*
          * Note: When CONFIG_WIRELESS_OLD_REGULATORY is enabled
          * AND if CRDA is NOT present nothing will happen, if someone
@@ -1071,10 +1185,15 @@ int __regulatory_hint(struct wiphy *wiphy, enum reg_set_by set_by,
 
 void regulatory_hint(struct wiphy *wiphy, const char *alpha2)
 {
+        int r;
         BUG_ON(!alpha2);
 
         mutex_lock(&cfg80211_drv_mutex);
-        __regulatory_hint(wiphy, REGDOM_SET_BY_DRIVER, alpha2, 0, ENVIRON_ANY);
+        r = __regulatory_hint(wiphy, REGDOM_SET_BY_DRIVER,
+                alpha2, 0, ENVIRON_ANY);
+        /* This is required so that the orig_* parameters are saved */
+        if (r == -EALREADY && wiphy->strict_regulatory)
+                wiphy_update_regulatory(wiphy, REGDOM_SET_BY_DRIVER);
         mutex_unlock(&cfg80211_drv_mutex);
 }
 EXPORT_SYMBOL(regulatory_hint);
@@ -1247,7 +1366,7 @@ static void print_regdomain(const struct ieee80211_regdomain *rd)
                                         "domain intersected: \n");
                 } else
                                 printk(KERN_INFO "cfg80211: Current regulatory "
-                                        "intersected: \n");
+                                        "domain intersected: \n");
         } else if (is_world_regdom(rd->alpha2))
                 printk(KERN_INFO "cfg80211: World regulatory "
                         "domain updated:\n");
@@ -1349,6 +1468,23 @@ static int __set_regdom(const struct ieee80211_regdomain *rd)
         }
 
         if (!last_request->intersect) {
+                int r;
+
+                if (last_request->initiator != REGDOM_SET_BY_DRIVER) {
+                        reset_regdomains();
+                        cfg80211_regdomain = rd;
+                        return 0;
+                }
+
+                /* For a driver hint, lets copy the regulatory domain the
+                 * driver wanted to the wiphy to deal with conflicts */
+
+                BUG_ON(last_request->wiphy->regd);
+
+                r = reg_copy_regd(&last_request->wiphy->regd, rd);
+                if (r)
+                        return r;
+
                 reset_regdomains();
                 cfg80211_regdomain = rd;
                 return 0;
@@ -1362,8 +1498,14 @@ static int __set_regdom(const struct ieee80211_regdomain *rd)
                 if (!intersected_rd)
                         return -EINVAL;
 
-                /* We can trash what CRDA provided now */
-                kfree(rd);
+                /* We can trash what CRDA provided now.
+                 * However if a driver requested this specific regulatory
+                 * domain we keep it for its private use */
+                if (last_request->initiator == REGDOM_SET_BY_DRIVER)
+                        last_request->wiphy->regd = rd;
+                else
+                        kfree(rd);
+
                 rd = NULL;
 
                 reset_regdomains();
@@ -1447,6 +1589,7 @@ int set_regdom(const struct ieee80211_regdomain *rd)
 /* Caller must hold cfg80211_drv_mutex */
 void reg_device_remove(struct wiphy *wiphy)
 {
+        kfree(wiphy->regd);
         if (!last_request || !last_request->wiphy)
                 return;
         if (last_request->wiphy != wiphy)
diff --git a/net/wireless/reg.h b/net/wireless/reg.h
index a76ea3ff7cd6..fe8c83f34fb7 100644
--- a/net/wireless/reg.h
+++ b/net/wireless/reg.h
@@ -1,6 +1,8 @@
 #ifndef __NET_WIRELESS_REG_H
 #define __NET_WIRELESS_REG_H
 
+extern const struct ieee80211_regdomain *cfg80211_regdomain;
+
 bool is_world_regdom(const char *alpha2);
 bool reg_is_valid_request(const char *alpha2);
 
@@ -11,13 +13,6 @@ void regulatory_exit(void);
 
 int set_regdom(const struct ieee80211_regdomain *rd);
 
-enum environment_cap {
-        ENVIRON_ANY,
-        ENVIRON_INDOOR,
-        ENVIRON_OUTDOOR,
-};
-
-
 /**
  * __regulatory_hint - hint to the wireless core a regulatory domain
  * @wiphy: if the hint comes from country information from an AP, this
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
new file mode 100644
index 000000000000..b1893c863b97
--- /dev/null
+++ b/net/wireless/scan.c
@@ -0,0 +1,836 @@
+/*
+ * cfg80211 scan result handling
+ *
+ * Copyright 2008 Johannes Berg <johannes@sipsolutions.net>
+ */
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/netdevice.h>
+#include <linux/wireless.h>
+#include <linux/nl80211.h>
+#include <linux/etherdevice.h>
+#include <net/arp.h>
+#include <net/cfg80211.h>
+#include <net/iw_handler.h>
+#include "core.h"
+#include "nl80211.h"
+
+#define IEEE80211_SCAN_RESULT_EXPIRE    (10 * HZ)
+
+void cfg80211_scan_done(struct cfg80211_scan_request *request, bool aborted)
+{
+        struct net_device *dev;
+#ifdef CONFIG_WIRELESS_EXT
+        union iwreq_data wrqu;
+#endif
+
+        dev = dev_get_by_index(&init_net, request->ifidx);
+        if (!dev)
+                goto out;
+
+        WARN_ON(request != wiphy_to_dev(request->wiphy)->scan_req);
+        wiphy_to_dev(request->wiphy)->scan_req = NULL;
+
+        if (aborted)
+                nl80211_send_scan_aborted(wiphy_to_dev(request->wiphy), dev);
+        else
+                nl80211_send_scan_done(wiphy_to_dev(request->wiphy), dev);
+
+#ifdef CONFIG_WIRELESS_EXT
+        if (!aborted) {
+                memset(&wrqu, 0, sizeof(wrqu));
+
+                wireless_send_event(dev, SIOCGIWSCAN, &wrqu, NULL);
+        }
+#endif
+
+        dev_put(dev);
+
+ out:
+        kfree(request);
+}
+EXPORT_SYMBOL(cfg80211_scan_done);
+
+static void bss_release(struct kref *ref)
+{
+        struct cfg80211_internal_bss *bss;
+
+        bss = container_of(ref, struct cfg80211_internal_bss, ref);
+        if (bss->pub.free_priv)
+                bss->pub.free_priv(&bss->pub);
+        kfree(bss);
+}
+
+/* must hold dev->bss_lock! */
+void cfg80211_bss_expire(struct cfg80211_registered_device *dev)
+{
+        struct cfg80211_internal_bss *bss, *tmp;
+        bool expired = false;
+
+        list_for_each_entry_safe(bss, tmp, &dev->bss_list, list) {
+                if (!time_after(jiffies, bss->ts + IEEE80211_SCAN_RESULT_EXPIRE))
+                        continue;
+                list_del(&bss->list);
+                rb_erase(&bss->rbn, &dev->bss_tree);
+                kref_put(&bss->ref, bss_release);
+                expired = true;
+        }
+
+        if (expired)
+                dev->bss_generation++;
+}
+
+static u8 *find_ie(u8 num, u8 *ies, size_t len)
+{
+        while (len > 2 && ies[0] != num) {
+                len -= ies[1] + 2;
+                ies += ies[1] + 2;
+        }
+        if (len < 2)
+                return NULL;
+        if (len < 2 + ies[1])
+                return NULL;
+        return ies;
+}
+
+static int cmp_ies(u8 num, u8 *ies1, size_t len1, u8 *ies2, size_t len2)
+{
+        const u8 *ie1 = find_ie(num, ies1, len1);
+        const u8 *ie2 = find_ie(num, ies2, len2);
+        int r;
+
+        if (!ie1 && !ie2)
+                return 0;
+        if (!ie1)
+                return -1;
+
+        r = memcmp(ie1 + 2, ie2 + 2, min(ie1[1], ie2[1]));
+        if (r == 0 && ie1[1] != ie2[1])
+                return ie2[1] - ie1[1];
+        return r;
+}
+
+static bool is_bss(struct cfg80211_bss *a,
+                   const u8 *bssid,
+                   const u8 *ssid, size_t ssid_len)
+{
+        const u8 *ssidie;
+
+        if (bssid && compare_ether_addr(a->bssid, bssid))
+                return false;
+
+        if (!ssid)
+                return true;
+
+        ssidie = find_ie(WLAN_EID_SSID,
+                         a->information_elements,
+                         a->len_information_elements);
+        if (!ssidie)
+                return false;
+        if (ssidie[1] != ssid_len)
+                return false;
+        return memcmp(ssidie + 2, ssid, ssid_len) == 0;
+}
+
+static bool is_mesh(struct cfg80211_bss *a,
+                    const u8 *meshid, size_t meshidlen,
+                    const u8 *meshcfg)
+{
+        const u8 *ie;
+
+        if (!is_zero_ether_addr(a->bssid))
+                return false;
+
+        ie = find_ie(WLAN_EID_MESH_ID,
+                     a->information_elements,
+                     a->len_information_elements);
+        if (!ie)
+                return false;
+        if (ie[1] != meshidlen)
+                return false;
+        if (memcmp(ie + 2, meshid, meshidlen))
+                return false;
+
+        ie = find_ie(WLAN_EID_MESH_CONFIG,
+                     a->information_elements,
+                     a->len_information_elements);
+        if (ie[1] != IEEE80211_MESH_CONFIG_LEN)
+                return false;
+
+        /*
+         * Ignore mesh capability (last two bytes of the IE) when
+         * comparing since that may differ between stations taking
+         * part in the same mesh.
+         */
+        return memcmp(ie + 2, meshcfg, IEEE80211_MESH_CONFIG_LEN - 2) == 0;
+}
+
+static int cmp_bss(struct cfg80211_bss *a,
+                   struct cfg80211_bss *b)
+{
+        int r;
+
+        if (a->channel != b->channel)
+                return b->channel->center_freq - a->channel->center_freq;
+
+        r = memcmp(a->bssid, b->bssid, ETH_ALEN);
+        if (r)
+                return r;
+
+        if (is_zero_ether_addr(a->bssid)) {
+                r = cmp_ies(WLAN_EID_MESH_ID,
+                            a->information_elements,
+                            a->len_information_elements,
+                            b->information_elements,
+                            b->len_information_elements);
+                if (r)
+                        return r;
+                return cmp_ies(WLAN_EID_MESH_CONFIG,
+                               a->information_elements,
+                               a->len_information_elements,
+                               b->information_elements,
+                               b->len_information_elements);
+        }
+
+        return cmp_ies(WLAN_EID_SSID,
+                       a->information_elements,
+                       a->len_information_elements,
+                       b->information_elements,
+                       b->len_information_elements);
+}
+
+struct cfg80211_bss *cfg80211_get_bss(struct wiphy *wiphy,
+                                      struct ieee80211_channel *channel,
+                                      const u8 *bssid,
+                                      const u8 *ssid, size_t ssid_len,
+                                      u16 capa_mask, u16 capa_val)
+{
+        struct cfg80211_registered_device *dev = wiphy_to_dev(wiphy);
+        struct cfg80211_internal_bss *bss, *res = NULL;
+
+        spin_lock_bh(&dev->bss_lock);
+
+        list_for_each_entry(bss, &dev->bss_list, list) {
+                if ((bss->pub.capability & capa_mask) != capa_val)
+                        continue;
+                if (channel && bss->pub.channel != channel)
+                        continue;
+                if (is_bss(&bss->pub, bssid, ssid, ssid_len)) {
+                        res = bss;
+                        kref_get(&res->ref);
+                        break;
+                }
+        }
+
+        spin_unlock_bh(&dev->bss_lock);
+        if (!res)
+                return NULL;
+        return &res->pub;
+}
+EXPORT_SYMBOL(cfg80211_get_bss);
+
+struct cfg80211_bss *cfg80211_get_mesh(struct wiphy *wiphy,
+                                       struct ieee80211_channel *channel,
+                                       const u8 *meshid, size_t meshidlen,
+                                       const u8 *meshcfg)
+{
+        struct cfg80211_registered_device *dev = wiphy_to_dev(wiphy);
+        struct cfg80211_internal_bss *bss, *res = NULL;
+
+        spin_lock_bh(&dev->bss_lock);
+
+        list_for_each_entry(bss, &dev->bss_list, list) {
+                if (channel && bss->pub.channel != channel)
+                        continue;
+                if (is_mesh(&bss->pub, meshid, meshidlen, meshcfg)) {
+                        res = bss;
+                        kref_get(&res->ref);
+                        break;
+                }
+        }
+
+        spin_unlock_bh(&dev->bss_lock);
+        if (!res)
+                return NULL;
+        return &res->pub;
+}
+EXPORT_SYMBOL(cfg80211_get_mesh);
+
+
+static void rb_insert_bss(struct cfg80211_registered_device *dev,
+                          struct cfg80211_internal_bss *bss)
+{
+        struct rb_node **p = &dev->bss_tree.rb_node;
+        struct rb_node *parent = NULL;
+        struct cfg80211_internal_bss *tbss;
+        int cmp;
+
+        while (*p) {
+                parent = *p;
+                tbss = rb_entry(parent, struct cfg80211_internal_bss, rbn);
+
+                cmp = cmp_bss(&bss->pub, &tbss->pub);
+
+                if (WARN_ON(!cmp)) {
+                        /* will sort of leak this BSS */
+                        return;
+                }
+
+                if (cmp < 0)
+                        p = &(*p)->rb_left;
+                else
+                        p = &(*p)->rb_right;
+        }
+
+        rb_link_node(&bss->rbn, parent, p);
+        rb_insert_color(&bss->rbn, &dev->bss_tree);
+}
+
+static struct cfg80211_internal_bss *
+rb_find_bss(struct cfg80211_registered_device *dev,
+            struct cfg80211_internal_bss *res)
+{
+        struct rb_node *n = dev->bss_tree.rb_node;
+        struct cfg80211_internal_bss *bss;
+        int r;
+
+        while (n) {
+                bss = rb_entry(n, struct cfg80211_internal_bss, rbn);
+                r = cmp_bss(&res->pub, &bss->pub);
+
+                if (r == 0)
+                        return bss;
+                else if (r < 0)
+                        n = n->rb_left;
+                else
+                        n = n->rb_right;
+        }
+
+        return NULL;
+}
+
+static struct cfg80211_internal_bss *
+cfg80211_bss_update(struct cfg80211_registered_device *dev,
+                    struct cfg80211_internal_bss *res,
+                    bool overwrite)
+{
+        struct cfg80211_internal_bss *found = NULL;
+        const u8 *meshid, *meshcfg;
+
+        /*
+         * The reference to "res" is donated to this function.
+         */
+
+        if (WARN_ON(!res->pub.channel)) {
+                kref_put(&res->ref, bss_release);
+                return NULL;
+        }
+
+        res->ts = jiffies;
+
+        if (is_zero_ether_addr(res->pub.bssid)) {
+                /* must be mesh, verify */
+                meshid = find_ie(WLAN_EID_MESH_ID, res->pub.information_elements,
+                                 res->pub.len_information_elements);
+                meshcfg = find_ie(WLAN_EID_MESH_CONFIG,
+                                  res->pub.information_elements,
+                                  res->pub.len_information_elements);
+                if (!meshid || !meshcfg ||
+                    meshcfg[1] != IEEE80211_MESH_CONFIG_LEN) {
+                        /* bogus mesh */
+                        kref_put(&res->ref, bss_release);
+                        return NULL;
+                }
+        }
+
+        spin_lock_bh(&dev->bss_lock);
+
+        found = rb_find_bss(dev, res);
+
+        if (found && overwrite) {
+                list_replace(&found->list, &res->list);
+                rb_replace_node(&found->rbn, &res->rbn,
+                                &dev->bss_tree);
+                kref_put(&found->ref, bss_release);
+                found = res;
+        } else if (found) {
+                kref_get(&found->ref);
+                found->pub.beacon_interval = res->pub.beacon_interval;
+                found->pub.tsf = res->pub.tsf;
+                found->pub.signal = res->pub.signal;
+                found->pub.signal_type = res->pub.signal_type;
+                found->pub.capability = res->pub.capability;
+                found->ts = res->ts;
+                kref_put(&res->ref, bss_release);
+        } else {
+                /* this "consumes" the reference */
+                list_add_tail(&res->list, &dev->bss_list);
+                rb_insert_bss(dev, res);
+                found = res;
+        }
+
+        dev->bss_generation++;
+        spin_unlock_bh(&dev->bss_lock);
+
+        kref_get(&found->ref);
+        return found;
+}
+
+struct cfg80211_bss *
+cfg80211_inform_bss_frame(struct wiphy *wiphy,
+                          struct ieee80211_channel *channel,
+                          struct ieee80211_mgmt *mgmt, size_t len,
+                          s32 signal, enum cfg80211_signal_type sigtype,
+                          gfp_t gfp)
+{
+        struct cfg80211_internal_bss *res;
+        size_t ielen = len - offsetof(struct ieee80211_mgmt,
+                                      u.probe_resp.variable);
+        bool overwrite;
+        size_t privsz = wiphy->bss_priv_size;
+
+        if (WARN_ON(sigtype == NL80211_BSS_SIGNAL_UNSPEC &&
+                    (signal < 0 || signal > 100)))
+                return NULL;
+
+        if (WARN_ON(!mgmt || !wiphy ||
+                    len < offsetof(struct ieee80211_mgmt, u.probe_resp.variable)))
+                return NULL;
+
+        res = kzalloc(sizeof(*res) + privsz + ielen, gfp);
+        if (!res)
+                return NULL;
+
+        memcpy(res->pub.bssid, mgmt->bssid, ETH_ALEN);
+        res->pub.channel = channel;
+        res->pub.signal_type = sigtype;
+        res->pub.signal = signal;
+        res->pub.tsf = le64_to_cpu(mgmt->u.probe_resp.timestamp);
+        res->pub.beacon_interval = le16_to_cpu(mgmt->u.probe_resp.beacon_int);
+        res->pub.capability = le16_to_cpu(mgmt->u.probe_resp.capab_info);
+        /* point to after the private area */
+        res->pub.information_elements = (u8 *)res + sizeof(*res) + privsz;
+        memcpy(res->pub.information_elements, mgmt->u.probe_resp.variable, ielen);
+        res->pub.len_information_elements = ielen;
+
+        kref_init(&res->ref);
+
+        overwrite = ieee80211_is_probe_resp(mgmt->frame_control);
+
+        res = cfg80211_bss_update(wiphy_to_dev(wiphy), res, overwrite);
+        if (!res)
+                return NULL;
+
+        /* cfg80211_bss_update gives us a referenced result */
+        return &res->pub;
+}
+EXPORT_SYMBOL(cfg80211_inform_bss_frame);
+
+void cfg80211_put_bss(struct cfg80211_bss *pub)
+{
+        struct cfg80211_internal_bss *bss;
+
+        if (!pub)
+                return;
+
+        bss = container_of(pub, struct cfg80211_internal_bss, pub);
+        kref_put(&bss->ref, bss_release);
+}
+EXPORT_SYMBOL(cfg80211_put_bss);
+
+void cfg80211_unlink_bss(struct wiphy *wiphy, struct cfg80211_bss *pub)
+{
+        struct cfg80211_registered_device *dev = wiphy_to_dev(wiphy);
+        struct cfg80211_internal_bss *bss;
+
+        if (WARN_ON(!pub))
+                return;
+
+        bss = container_of(pub, struct cfg80211_internal_bss, pub);
+
+        spin_lock_bh(&dev->bss_lock);
+
+        list_del(&bss->list);
+        rb_erase(&bss->rbn, &dev->bss_tree);
+
+        spin_unlock_bh(&dev->bss_lock);
+
+        kref_put(&bss->ref, bss_release);
+}
+EXPORT_SYMBOL(cfg80211_unlink_bss);
+
+#ifdef CONFIG_WIRELESS_EXT
+int cfg80211_wext_siwscan(struct net_device *dev,
+                          struct iw_request_info *info,
+                          union iwreq_data *wrqu, char *extra)
+{
+        struct cfg80211_registered_device *rdev;
+        struct wiphy *wiphy;
+        struct iw_scan_req *wreq = NULL;
+        struct cfg80211_scan_request *creq;
+        int i, err, n_channels = 0;
+        enum ieee80211_band band;
+
+        if (!netif_running(dev))
+                return -ENETDOWN;
+
+        rdev = cfg80211_get_dev_from_ifindex(dev->ifindex);
+
+        if (IS_ERR(rdev))
+                return PTR_ERR(rdev);
+
+        if (rdev->scan_req) {
+                err = -EBUSY;
+                goto out;
+        }
+
+        wiphy = &rdev->wiphy;
+
+        for (band = 0; band < IEEE80211_NUM_BANDS; band++)
+                if (wiphy->bands[band])
+                        n_channels += wiphy->bands[band]->n_channels;
+
+        creq = kzalloc(sizeof(*creq) + sizeof(struct cfg80211_ssid) +
+                       n_channels * sizeof(void *),
+                       GFP_ATOMIC);
+        if (!creq) {
+                err = -ENOMEM;
+                goto out;
+        }
+
+        creq->wiphy = wiphy;
+        creq->ifidx = dev->ifindex;
+        creq->ssids = (void *)(creq + 1);
+        creq->channels = (void *)(creq->ssids + 1);
+        creq->n_channels = n_channels;
+        creq->n_ssids = 1;
+
+        /* all channels */
+        i = 0;
+        for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
+                int j;
+                if (!wiphy->bands[band])
+                        continue;
+                for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
+                        creq->channels[i] = &wiphy->bands[band]->channels[j];
+                        i++;
+                }
+        }
+
+        /* translate scan request */
+        if (wrqu->data.length == sizeof(struct iw_scan_req)) {
+                wreq = (struct iw_scan_req *)extra;
+
+                if (wrqu->data.flags & IW_SCAN_THIS_ESSID) {
+                        if (wreq->essid_len > IEEE80211_MAX_SSID_LEN)
+                                return -EINVAL;
+                        memcpy(creq->ssids[0].ssid, wreq->essid, wreq->essid_len);
+                        creq->ssids[0].ssid_len = wreq->essid_len;
+                }
+                if (wreq->scan_type == IW_SCAN_TYPE_PASSIVE)
+                        creq->n_ssids = 0;
+        }
+
+        rdev->scan_req = creq;
+        err = rdev->ops->scan(wiphy, dev, creq);
+        if (err) {
+                rdev->scan_req = NULL;
+                kfree(creq);
+        }
+ out:
+        cfg80211_put_dev(rdev);
+        return err;
+}
+EXPORT_SYMBOL(cfg80211_wext_siwscan);
+
+static void ieee80211_scan_add_ies(struct iw_request_info *info,
+                                   struct cfg80211_bss *bss,
+                                   char **current_ev, char *end_buf)
+{
+        u8 *pos, *end, *next;
+        struct iw_event iwe;
+
+        if (!bss->information_elements ||
+            !bss->len_information_elements)
+                return;
+
+        /*
+         * If needed, fragment the IEs buffer (at IE boundaries) into short
+         * enough fragments to fit into IW_GENERIC_IE_MAX octet messages.
+         */
+        pos = bss->information_elements;
+        end = pos + bss->len_information_elements;
+
+        while (end - pos > IW_GENERIC_IE_MAX) {
+                next = pos + 2 + pos[1];
+                while (next + 2 + next[1] - pos < IW_GENERIC_IE_MAX)
+                        next = next + 2 + next[1];
+
+                memset(&iwe, 0, sizeof(iwe));
+                iwe.cmd = IWEVGENIE;
+                iwe.u.data.length = next - pos;
+                *current_ev = iwe_stream_add_point(info, *current_ev,
+                                                   end_buf, &iwe, pos);
+
+                pos = next;
+        }
+
+        if (end > pos) {
+                memset(&iwe, 0, sizeof(iwe));
+                iwe.cmd = IWEVGENIE;
+                iwe.u.data.length = end - pos;
+                *current_ev = iwe_stream_add_point(info, *current_ev,
+                                                   end_buf, &iwe, pos);
+        }
+}
+
+
+static char *
+ieee80211_bss(struct iw_request_info *info,
+                      struct cfg80211_internal_bss *bss,
+                      char *current_ev, char *end_buf)
+{
+        struct iw_event iwe;
+        u8 *buf, *cfg, *p;
+        u8 *ie = bss->pub.information_elements;
+        int rem = bss->pub.len_information_elements, i;
+        bool ismesh = false;
+
+        memset(&iwe, 0, sizeof(iwe));
+        iwe.cmd = SIOCGIWAP;
+        iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
+        memcpy(iwe.u.ap_addr.sa_data, bss->pub.bssid, ETH_ALEN);
+        current_ev = iwe_stream_add_event(info, current_ev, end_buf, &iwe,
+                                          IW_EV_ADDR_LEN);
+
+        memset(&iwe, 0, sizeof(iwe));
+        iwe.cmd = SIOCGIWFREQ;
+        iwe.u.freq.m = ieee80211_frequency_to_channel(bss->pub.channel->center_freq);
+        iwe.u.freq.e = 0;
+        current_ev = iwe_stream_add_event(info, current_ev, end_buf, &iwe,
+                                          IW_EV_FREQ_LEN);
+
+        memset(&iwe, 0, sizeof(iwe));
+        iwe.cmd = SIOCGIWFREQ;
+        iwe.u.freq.m = bss->pub.channel->center_freq;
+        iwe.u.freq.e = 6;
+        current_ev = iwe_stream_add_event(info, current_ev, end_buf, &iwe,
+                                          IW_EV_FREQ_LEN);
+
+        if (bss->pub.signal_type != CFG80211_SIGNAL_TYPE_NONE) {
+                memset(&iwe, 0, sizeof(iwe));
+                iwe.cmd = IWEVQUAL;
+                iwe.u.qual.updated = IW_QUAL_LEVEL_UPDATED |
+                                     IW_QUAL_NOISE_INVALID |
+                                     IW_QUAL_QUAL_INVALID;
+                switch (bss->pub.signal_type) {
+                case CFG80211_SIGNAL_TYPE_MBM:
+                        iwe.u.qual.level = bss->pub.signal / 100;
+                        iwe.u.qual.updated |= IW_QUAL_DBM;
+                        break;
+                case CFG80211_SIGNAL_TYPE_UNSPEC:
+                        iwe.u.qual.level = bss->pub.signal;
+                        break;
+                default:
+                        /* not reached */
+                        break;
+                }
+                current_ev = iwe_stream_add_event(info, current_ev, end_buf,
+                                                  &iwe, IW_EV_QUAL_LEN);
+        }
+
+        memset(&iwe, 0, sizeof(iwe));
+        iwe.cmd = SIOCGIWENCODE;
+        if (bss->pub.capability & WLAN_CAPABILITY_PRIVACY)
+                iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
+        else
+                iwe.u.data.flags = IW_ENCODE_DISABLED;
+        iwe.u.data.length = 0;
+        current_ev = iwe_stream_add_point(info, current_ev, end_buf,
+                                          &iwe, "");
+
+        while (rem >= 2) {
+                /* invalid data */
+                if (ie[1] > rem - 2)
+                        break;
+
+                switch (ie[0]) {
+                case WLAN_EID_SSID:
+                        memset(&iwe, 0, sizeof(iwe));
+                        iwe.cmd = SIOCGIWESSID;
+                        iwe.u.data.length = ie[1];
+                        iwe.u.data.flags = 1;
+                        current_ev = iwe_stream_add_point(info, current_ev, end_buf,
+                                                          &iwe, ie + 2);
+                        break;
+                case WLAN_EID_MESH_ID:
+                        memset(&iwe, 0, sizeof(iwe));
+                        iwe.cmd = SIOCGIWESSID;
+                        iwe.u.data.length = ie[1];
+                        iwe.u.data.flags = 1;
+                        current_ev = iwe_stream_add_point(info, current_ev, end_buf,
+                                                          &iwe, ie + 2);
+                        break;
+                case WLAN_EID_MESH_CONFIG:
+                        ismesh = true;
+                        if (ie[1] != IEEE80211_MESH_CONFIG_LEN)
+                                break;
+                        buf = kmalloc(50, GFP_ATOMIC);
+                        if (!buf)
+                                break;
+                        cfg = ie + 2;
+                        memset(&iwe, 0, sizeof(iwe));
+                        iwe.cmd = IWEVCUSTOM;
+                        sprintf(buf, "Mesh network (version %d)", cfg[0]);
+                        iwe.u.data.length = strlen(buf);
+                        current_ev = iwe_stream_add_point(info, current_ev,
+                                                          end_buf,
+                                                          &iwe, buf);
+                        sprintf(buf, "Path Selection Protocol ID: "
+                                "0x%02X%02X%02X%02X", cfg[1], cfg[2], cfg[3],
+                                                        cfg[4]);
+                        iwe.u.data.length = strlen(buf);
+                        current_ev = iwe_stream_add_point(info, current_ev,
+                                                          end_buf,
+                                                          &iwe, buf);
+                        sprintf(buf, "Path Selection Metric ID: "
+                                "0x%02X%02X%02X%02X", cfg[5], cfg[6], cfg[7],
+                                                        cfg[8]);
+                        iwe.u.data.length = strlen(buf);
+                        current_ev = iwe_stream_add_point(info, current_ev,
+                                                          end_buf,
+                                                          &iwe, buf);
+                        sprintf(buf, "Congestion Control Mode ID: "
+                                "0x%02X%02X%02X%02X", cfg[9], cfg[10],
+                                                        cfg[11], cfg[12]);
+                        iwe.u.data.length = strlen(buf);
+                        current_ev = iwe_stream_add_point(info, current_ev,
+                                                          end_buf,
+                                                          &iwe, buf);
+                        sprintf(buf, "Channel Precedence: "
+                                "0x%02X%02X%02X%02X", cfg[13], cfg[14],
+                                                        cfg[15], cfg[16]);
+                        iwe.u.data.length = strlen(buf);
+                        current_ev = iwe_stream_add_point(info, current_ev,
+                                                          end_buf,
+                                                          &iwe, buf);
+                        kfree(buf);
+                        break;
+                case WLAN_EID_SUPP_RATES:
+                case WLAN_EID_EXT_SUPP_RATES:
+                        /* display all supported rates in readable format */
+                        p = current_ev + iwe_stream_lcp_len(info);
+
+                        memset(&iwe, 0, sizeof(iwe));
+                        iwe.cmd = SIOCGIWRATE;
+                        /* Those two flags are ignored... */
+                        iwe.u.bitrate.fixed = iwe.u.bitrate.disabled = 0;
+
+                        for (i = 0; i < ie[1]; i++) {
+                                iwe.u.bitrate.value =
+                                        ((ie[i + 2] & 0x7f) * 500000);
+                                p = iwe_stream_add_value(info, current_ev, p,
+                                                end_buf, &iwe, IW_EV_PARAM_LEN);
+                        }
+                        current_ev = p;
+                        break;
+                }
+                rem -= ie[1] + 2;
+                ie += ie[1] + 2;
+        }
+
+        if (bss->pub.capability & (WLAN_CAPABILITY_ESS | WLAN_CAPABILITY_IBSS)
+            || ismesh) {
+                memset(&iwe, 0, sizeof(iwe));
+                iwe.cmd = SIOCGIWMODE;
+                if (ismesh)
+                        iwe.u.mode = IW_MODE_MESH;
+                else if (bss->pub.capability & WLAN_CAPABILITY_ESS)
+                        iwe.u.mode = IW_MODE_MASTER;
+                else
+                        iwe.u.mode = IW_MODE_ADHOC;
+                current_ev = iwe_stream_add_event(info, current_ev, end_buf,
+                                                  &iwe, IW_EV_UINT_LEN);
+        }
+
+        buf = kmalloc(30, GFP_ATOMIC);
+        if (buf) {
+                memset(&iwe, 0, sizeof(iwe));
+                iwe.cmd = IWEVCUSTOM;
+                sprintf(buf, "tsf=%016llx", (unsigned long long)(bss->pub.tsf));
+                iwe.u.data.length = strlen(buf);
+                current_ev = iwe_stream_add_point(info, current_ev, end_buf,
+                                                  &iwe, buf);
+                memset(&iwe, 0, sizeof(iwe));
+                iwe.cmd = IWEVCUSTOM;
+                sprintf(buf, " Last beacon: %dms ago",
+                        jiffies_to_msecs(jiffies - bss->ts));
+                iwe.u.data.length = strlen(buf);
+                current_ev = iwe_stream_add_point(info, current_ev,
+                                                  end_buf, &iwe, buf);
+                kfree(buf);
+        }
+
+        ieee80211_scan_add_ies(info, &bss->pub, &current_ev, end_buf);
+
+        return current_ev;
+}
+
+
+static int ieee80211_scan_results(struct cfg80211_registered_device *dev,
+                                  struct iw_request_info *info,
+                                  char *buf, size_t len)
+{
+        char *current_ev = buf;
+        char *end_buf = buf + len;
+        struct cfg80211_internal_bss *bss;
+
+        spin_lock_bh(&dev->bss_lock);
+        cfg80211_bss_expire(dev);
+
+        list_for_each_entry(bss, &dev->bss_list, list) {
+                if (buf + len - current_ev <= IW_EV_ADDR_LEN) {
+                        spin_unlock_bh(&dev->bss_lock);
+                        return -E2BIG;
+                }
+                current_ev = ieee80211_bss(info, bss,
+                                                   current_ev, end_buf);
+        }
+        spin_unlock_bh(&dev->bss_lock);
+        return current_ev - buf;
+}
+
+
+int cfg80211_wext_giwscan(struct net_device *dev,
+                          struct iw_request_info *info,
+                          struct iw_point *data, char *extra)
+{
+        struct cfg80211_registered_device *rdev;
+        int res;
+
+        if (!netif_running(dev))
+                return -ENETDOWN;
+
+        rdev = cfg80211_get_dev_from_ifindex(dev->ifindex);
+
+        if (IS_ERR(rdev))
+                return PTR_ERR(rdev);
+
+        if (rdev->scan_req) {
+                res = -EAGAIN;
+                goto out;
+        }
+
+        res = ieee80211_scan_results(rdev, info, extra, data->length);
+        data->length = 0;
+        if (res >= 0) {
+                data->length = res;
+                res = 0;
+        }
+
+ out:
+        cfg80211_put_dev(rdev);
+        return res;
+}
+EXPORT_SYMBOL(cfg80211_wext_giwscan);
+#endif
diff --git a/net/wireless/sysfs.c b/net/wireless/sysfs.c
index 79a382877641..26a72b0797a0 100644
--- a/net/wireless/sysfs.c
+++ b/net/wireless/sysfs.c
@@ -55,6 +55,34 @@ static int wiphy_uevent(struct device *dev, struct kobj_uevent_env *env)
 }
 #endif
 
+static int wiphy_suspend(struct device *dev, pm_message_t state)
+{
+        struct cfg80211_registered_device *rdev = dev_to_rdev(dev);
+        int ret = 0;
+
+        if (rdev->ops->suspend) {
+                rtnl_lock();
+                ret = rdev->ops->suspend(&rdev->wiphy);
+                rtnl_unlock();
+        }
+
+        return ret;
+}
+
+static int wiphy_resume(struct device *dev)
+{
+        struct cfg80211_registered_device *rdev = dev_to_rdev(dev);
+        int ret = 0;
+
+        if (rdev->ops->resume) {
+                rtnl_lock();
+                ret = rdev->ops->resume(&rdev->wiphy);
+                rtnl_unlock();
+        }
+
+        return ret;
+}
+
 struct class ieee80211_class = {
         .name = "ieee80211",
         .owner = THIS_MODULE,
@@ -63,6 +91,8 @@ struct class ieee80211_class = {
 #ifdef CONFIG_HOTPLUG
         .dev_uevent = wiphy_uevent,
 #endif
+        .suspend = wiphy_suspend,
+        .resume = wiphy_resume,
 };
 
 int wiphy_sysfs_init(void)
diff --git a/net/wireless/util.c b/net/wireless/util.c
index e76cc28b0345..487cdd9bcffc 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -9,7 +9,7 @@
 
 struct ieee80211_rate *
 ieee80211_get_response_rate(struct ieee80211_supported_band *sband,
-                            u64 basic_rates, int bitrate)
+                            u32 basic_rates, int bitrate)
 {
         struct ieee80211_rate *result = &sband->bitrates[0];
         int i;
diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
index 9fc5b023d111..8f76f4009c24 100644
--- a/net/x25/af_x25.c
+++ b/net/x25/af_x25.c
@@ -1609,7 +1609,7 @@ static const struct proto_ops SOCKOPS_WRAPPED(x25_proto_ops) = {
 SOCKOPS_WRAP(x25_proto, AF_X25);
 
 static struct packet_type x25_packet_type = {
-        .type = __constant_htons(ETH_P_X25),
+        .type = cpu_to_be16(ETH_P_X25),
         .func = x25_lapb_receive_frame,
 };