7 files changed, 267 insertions, 196 deletions

diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 6d2ad2bf3ab5..928813ce08e2 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -674,6 +674,11 @@ static void sta_apply_parameters(struct ieee80211_local *local,
                 sta->supp_rates[local->oper_channel->band] = rates;
         }
 
+        if (params->ht_capa) {
+                ieee80211_ht_cap_ie_to_ht_info(params->ht_capa,
+                                               &sta->ht_info);
+        }
+
         if (ieee80211_vif_is_mesh(&sdata->vif) && params->plink_action) {
                 switch (params->plink_action) {
                 case PLINK_ACTION_OPEN:
@@ -1010,6 +1015,42 @@ static int ieee80211_dump_mpath(struct wiphy *wiphy, struct net_device *dev,
 }
 #endif
 
+static int ieee80211_change_bss(struct wiphy *wiphy,
+                                struct net_device *dev,
+                                struct bss_parameters *params)
+{
+        struct ieee80211_local *local = wiphy_priv(wiphy);
+        struct ieee80211_sub_if_data *sdata;
+        u32 changed = 0;
+
+        if (dev == local->mdev)
+                return -EOPNOTSUPP;
+
+        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+
+        if (sdata->vif.type != IEEE80211_IF_TYPE_AP)
+                return -EINVAL;
+
+        if (params->use_cts_prot >= 0) {
+                sdata->bss_conf.use_cts_prot = params->use_cts_prot;
+                changed |= BSS_CHANGED_ERP_CTS_PROT;
+        }
+        if (params->use_short_preamble >= 0) {
+                sdata->bss_conf.use_short_preamble =
+                        params->use_short_preamble;
+                changed |= BSS_CHANGED_ERP_PREAMBLE;
+        }
+        if (params->use_short_slot_time >= 0) {
+                sdata->bss_conf.use_short_slot =
+                        params->use_short_slot_time;
+                changed |= BSS_CHANGED_ERP_SLOT;
+        }
+
+        ieee80211_bss_info_change_notify(sdata, changed);
+
+        return 0;
+}
+
 struct cfg80211_ops mac80211_config_ops = {
         .add_virtual_intf = ieee80211_add_iface,
         .del_virtual_intf = ieee80211_del_iface,
@@ -1033,4 +1074,5 @@ struct cfg80211_ops mac80211_config_ops = {
         .get_mpath = ieee80211_get_mpath,
         .dump_mpath = ieee80211_dump_mpath,
 #endif
+        .change_bss = ieee80211_change_bss,
 };
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 8361054fb7cf..2bb546744b94 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -79,16 +79,11 @@ struct ieee80211_sta_bss {
         enum ieee80211_band band;
         int freq;
         int signal, noise, qual;
-        u8 *wpa_ie;
-        size_t wpa_ie_len;
-        u8 *rsn_ie;
-        size_t rsn_ie_len;
-        u8 *wmm_ie;
-        size_t wmm_ie_len;
-        u8 *ht_ie;
-        size_t ht_ie_len;
-        u8 *ht_add_ie;
-        size_t ht_add_ie_len;
+        u8 *ies; /* all information elements from the last Beacon or Probe
+                  * Response frames; note Beacon frame is not allowed to
+                  * override values from Probe Response */
+        size_t ies_len;
+        bool wmm_used;
 #ifdef CONFIG_MAC80211_MESH
         u8 *mesh_id;
         size_t mesh_id_len;
@@ -773,6 +768,9 @@ struct ieee80211_ra_tid {
 
 /* Parsed Information Elements */
 struct ieee802_11_elems {
+        u8 *ie_start;
+        size_t total_len;
+
         /* pointers to IEs */
         u8 *ssid;
         u8 *supp_rates;
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 398ca66bdfcb..638b75f36e23 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -598,7 +598,7 @@ int ieee80211_start_tx_ba_session(struct ieee80211_hw *hw, u8 *ra, u16 tid)
         struct ieee80211_local *local = hw_to_local(hw);
         struct sta_info *sta;
         struct ieee80211_sub_if_data *sdata;
-        u16 start_seq_num = 0;
+        u16 start_seq_num;
         u8 *state;
         int ret;
         DECLARE_MAC_BUF(mac);
@@ -678,6 +678,9 @@ int ieee80211_start_tx_ba_session(struct ieee80211_hw *hw, u8 *ra, u16 tid)
          * call back right away, it must see that the flow has begun */
         *state |= HT_ADDBA_REQUESTED_MSK;
 
+        /* This is slightly racy because the queue isn't stopped */
+        start_seq_num = sta->tid_seq[tid];
+
         if (local->ops->ampdu_action)
                 ret = local->ops->ampdu_action(hw, IEEE80211_AMPDU_TX_START,
                                                 ra, tid, &start_seq_num);
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 84999791a332..e088b440aafa 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -98,6 +98,8 @@ void ieee802_11_parse_elems(u8 *start, size_t len,
         u8 *pos = start;
 
         memset(elems, 0, sizeof(*elems));
+        elems->ie_start = start;
+        elems->total_len = len;
 
         while (left >= 2) {
                 u8 id, elen;
@@ -234,6 +236,27 @@ void ieee802_11_parse_elems(u8 *start, size_t len,
 }
 
 
+static u8 * ieee80211_bss_get_ie(struct ieee80211_sta_bss *bss, u8 ie)
+{
+        u8 *end, *pos;
+
+        pos = bss->ies;
+        if (pos == NULL)
+                return NULL;
+        end = pos + bss->ies_len;
+
+        while (pos + 1 < end) {
+                if (pos + 2 + pos[1] > end)
+                        break;
+                if (pos[0] == ie)
+                        return pos;
+                pos += 2 + pos[1];
+        }
+
+        return NULL;
+}
+
+
 static int ecw2cw(int ecw)
 {
         return (1 << ecw) - 1;
@@ -737,7 +760,7 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_local *local = sdata->local;
         struct sk_buff *skb;
         struct ieee80211_mgmt *mgmt;
-        u8 *pos, *ies;
+        u8 *pos, *ies, *ht_add_ie;
         int i, len, count, rates_len, supp_rates_len;
         u16 capab;
         struct ieee80211_sta_bss *bss;
@@ -772,7 +795,7 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata,
         if (bss) {
                 if (bss->capability & WLAN_CAPABILITY_PRIVACY)
                         capab |= WLAN_CAPABILITY_PRIVACY;
-                if (bss->wmm_ie)
+                if (bss->wmm_used)
                         wmm = 1;
 
                 /* get all rates supported by the device and the AP as
@@ -894,9 +917,10 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata,
 
         /* wmm support is a must to HT */
         if (wmm && (ifsta->flags & IEEE80211_STA_WMM_ENABLED) &&
-            sband->ht_info.ht_supported && bss->ht_add_ie) {
+            sband->ht_info.ht_supported &&
+            (ht_add_ie = ieee80211_bss_get_ie(bss, WLAN_EID_HT_EXTRA_INFO))) {
                 struct ieee80211_ht_addt_info *ht_add_info =
-                        (struct ieee80211_ht_addt_info *)bss->ht_add_ie;
+                        (struct ieee80211_ht_addt_info *)ht_add_ie;
                 u16 cap = sband->ht_info.cap;
                 __le16 tmp;
                 u32 flags = local->hw.conf.channel->flags;
@@ -2372,11 +2396,7 @@ ieee80211_rx_mesh_bss_add(struct ieee80211_local *local, u8 *mesh_id, int mesh_i
 
 static void ieee80211_rx_bss_free(struct ieee80211_sta_bss *bss)
 {
-        kfree(bss->wpa_ie);
-        kfree(bss->rsn_ie);
-        kfree(bss->wmm_ie);
-        kfree(bss->ht_ie);
-        kfree(bss->ht_add_ie);
+        kfree(bss->ies);
         kfree(bss_mesh_id(bss));
         kfree(bss_mesh_cfg(bss));
         kfree(bss);
@@ -2662,43 +2682,6 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
                 bss->has_erp_value = 1;
         }
 
-        if (elems->ht_cap_elem &&
-             (!bss->ht_ie || bss->ht_ie_len != elems->ht_cap_elem_len ||
-             memcmp(bss->ht_ie, elems->ht_cap_elem, elems->ht_cap_elem_len))) {
-                kfree(bss->ht_ie);
-                bss->ht_ie = kmalloc(elems->ht_cap_elem_len + 2, GFP_ATOMIC);
-                if (bss->ht_ie) {
-                        memcpy(bss->ht_ie, elems->ht_cap_elem - 2,
-                                elems->ht_cap_elem_len + 2);
-                        bss->ht_ie_len = elems->ht_cap_elem_len + 2;
-                } else
-                        bss->ht_ie_len = 0;
-        } else if (!elems->ht_cap_elem && bss->ht_ie) {
-                kfree(bss->ht_ie);
-                bss->ht_ie = NULL;
-                bss->ht_ie_len = 0;
-        }
-
-        if (elems->ht_info_elem &&
-             (!bss->ht_add_ie ||
-             bss->ht_add_ie_len != elems->ht_info_elem_len ||
-             memcmp(bss->ht_add_ie, elems->ht_info_elem,
-                        elems->ht_info_elem_len))) {
-                kfree(bss->ht_add_ie);
-                bss->ht_add_ie =
-                        kmalloc(elems->ht_info_elem_len + 2, GFP_ATOMIC);
-                if (bss->ht_add_ie) {
-                        memcpy(bss->ht_add_ie, elems->ht_info_elem - 2,
-                                elems->ht_info_elem_len + 2);
-                        bss->ht_add_ie_len = elems->ht_info_elem_len + 2;
-                } else
-                        bss->ht_add_ie_len = 0;
-        } else if (!elems->ht_info_elem && bss->ht_add_ie) {
-                kfree(bss->ht_add_ie);
-                bss->ht_add_ie = NULL;
-                bss->ht_add_ie_len = 0;
-        }
-
         bss->beacon_int = le16_to_cpu(mgmt->u.beacon.beacon_int);
         bss->capability = le16_to_cpu(mgmt->u.beacon.capab_info);
 
@@ -2749,88 +2732,17 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
                 return;
         }
 
-        if (elems->wpa &&
-            (!bss->wpa_ie || bss->wpa_ie_len != elems->wpa_len ||
-             memcmp(bss->wpa_ie, elems->wpa, elems->wpa_len))) {
-                kfree(bss->wpa_ie);
-                bss->wpa_ie = kmalloc(elems->wpa_len + 2, GFP_ATOMIC);
-                if (bss->wpa_ie) {
-                        memcpy(bss->wpa_ie, elems->wpa - 2, elems->wpa_len + 2);
-                        bss->wpa_ie_len = elems->wpa_len + 2;
-                } else
-                        bss->wpa_ie_len = 0;
-        } else if (!elems->wpa && bss->wpa_ie) {
-                kfree(bss->wpa_ie);
-                bss->wpa_ie = NULL;
-                bss->wpa_ie_len = 0;
-        }
-
-        if (elems->rsn &&
-            (!bss->rsn_ie || bss->rsn_ie_len != elems->rsn_len ||
-             memcmp(bss->rsn_ie, elems->rsn, elems->rsn_len))) {
-                kfree(bss->rsn_ie);
-                bss->rsn_ie = kmalloc(elems->rsn_len + 2, GFP_ATOMIC);
-                if (bss->rsn_ie) {
-                        memcpy(bss->rsn_ie, elems->rsn - 2, elems->rsn_len + 2);
-                        bss->rsn_ie_len = elems->rsn_len + 2;
-                } else
-                        bss->rsn_ie_len = 0;
-        } else if (!elems->rsn && bss->rsn_ie) {
-                kfree(bss->rsn_ie);
-                bss->rsn_ie = NULL;
-                bss->rsn_ie_len = 0;
+        if (bss->ies == NULL || bss->ies_len < elems->total_len) {
+                kfree(bss->ies);
+                bss->ies = kmalloc(elems->total_len, GFP_ATOMIC);
         }
+        if (bss->ies) {
+                memcpy(bss->ies, elems->ie_start, elems->total_len);
+                bss->ies_len = elems->total_len;
+        } else
+                bss->ies_len = 0;
 
-        /*
-         * Cf.
-         * http://www.wipo.int/pctdb/en/wo.jsp?wo=2007047181&IA=WO2007047181&DISPLAY=DESC
-         *
-         * quoting:
-         *
-         * In particular, "Wi-Fi CERTIFIED for WMM - Support for Multimedia
-         * Applications with Quality of Service in Wi-Fi Networks," Wi- Fi
-         * Alliance (September 1, 2004) is incorporated by reference herein.
-         * The inclusion of the WMM Parameters in probe responses and
-         * association responses is mandatory for WMM enabled networks. The
-         * inclusion of the WMM Parameters in beacons, however, is optional.
-         */
-
-        if (elems->wmm_param &&
-            (!bss->wmm_ie || bss->wmm_ie_len != elems->wmm_param_len ||
-             memcmp(bss->wmm_ie, elems->wmm_param, elems->wmm_param_len))) {
-                kfree(bss->wmm_ie);
-                bss->wmm_ie = kmalloc(elems->wmm_param_len + 2, GFP_ATOMIC);
-                if (bss->wmm_ie) {
-                        memcpy(bss->wmm_ie, elems->wmm_param - 2,
-                               elems->wmm_param_len + 2);
-                        bss->wmm_ie_len = elems->wmm_param_len + 2;
-                } else
-                        bss->wmm_ie_len = 0;
-        } else if (elems->wmm_info &&
-                    (!bss->wmm_ie || bss->wmm_ie_len != elems->wmm_info_len ||
-                     memcmp(bss->wmm_ie, elems->wmm_info,
-                                                elems->wmm_info_len))) {
-                 /* As for certain AP's Fifth bit is not set in WMM IE in
-                  * beacon frames.So while parsing the beacon frame the
-                  * wmm_info structure is used instead of wmm_param.
-                  * wmm_info structure was never used to set bss->wmm_ie.
-                  * This code fixes this problem by copying the WME
-                  * information from wmm_info to bss->wmm_ie and enabling
-                  * n-band association.
-                  */
-                kfree(bss->wmm_ie);
-                bss->wmm_ie = kmalloc(elems->wmm_info_len + 2, GFP_ATOMIC);
-                if (bss->wmm_ie) {
-                        memcpy(bss->wmm_ie, elems->wmm_info - 2,
-                               elems->wmm_info_len + 2);
-                        bss->wmm_ie_len = elems->wmm_info_len + 2;
-                } else
-                        bss->wmm_ie_len = 0;
-        } else if (!elems->wmm_param && !elems->wmm_info && bss->wmm_ie) {
-                kfree(bss->wmm_ie);
-                bss->wmm_ie = NULL;
-                bss->wmm_ie_len = 0;
-        }
+        bss->wmm_used = elems->wmm_param || elems->wmm_info;
 
         /* check if we need to merge IBSS */
         if (sdata->vif.type == IEEE80211_IF_TYPE_IBSS && beacon &&
@@ -4146,6 +4058,48 @@ int ieee80211_sta_req_scan(struct ieee80211_sub_if_data *sdata, u8 *ssid, size_t
         return 0;
 }
 
+
+static void ieee80211_sta_add_scan_ies(struct iw_request_info *info,
+                                       struct ieee80211_sta_bss *bss,
+                                       char **current_ev, char *end_buf)
+{
+        u8 *pos, *end, *next;
+        struct iw_event iwe;
+
+        if (bss == NULL || bss->ies == NULL)
+                return;
+
+        /*
+         * If needed, fragment the IEs buffer (at IE boundaries) into short
+         * enough fragments to fit into IW_GENERIC_IE_MAX octet messages.
+         */
+        pos = bss->ies;
+        end = pos + bss->ies_len;
+
+        while (end - pos > IW_GENERIC_IE_MAX) {
+                next = pos + 2 + pos[1];
+                while (next + 2 + next[1] - pos < IW_GENERIC_IE_MAX)
+                        next = next + 2 + next[1];
+
+                memset(&iwe, 0, sizeof(iwe));
+                iwe.cmd = IWEVGENIE;
+                iwe.u.data.length = next - pos;
+                *current_ev = iwe_stream_add_point(info, *current_ev,
+                                                   end_buf, &iwe, pos);
+
+                pos = next;
+        }
+
+        if (end > pos) {
+                memset(&iwe, 0, sizeof(iwe));
+                iwe.cmd = IWEVGENIE;
+                iwe.u.data.length = end - pos;
+                *current_ev = iwe_stream_add_point(info, *current_ev,
+                                                   end_buf, &iwe, pos);
+        }
+}
+
+
 static char *
 ieee80211_sta_scan_result(struct ieee80211_local *local,
                           struct iw_request_info *info,
@@ -4225,29 +4179,7 @@ ieee80211_sta_scan_result(struct ieee80211_local *local,
         current_ev = iwe_stream_add_point(info, current_ev, end_buf,
                                           &iwe, "");
 
-        if (bss && bss->wpa_ie) {
-                memset(&iwe, 0, sizeof(iwe));
-                iwe.cmd = IWEVGENIE;
-                iwe.u.data.length = bss->wpa_ie_len;
-                current_ev = iwe_stream_add_point(info, current_ev, end_buf,
-                                                  &iwe, bss->wpa_ie);
-        }
-
-        if (bss && bss->rsn_ie) {
-                memset(&iwe, 0, sizeof(iwe));
-                iwe.cmd = IWEVGENIE;
-                iwe.u.data.length = bss->rsn_ie_len;
-                current_ev = iwe_stream_add_point(info, current_ev, end_buf,
-                                                  &iwe, bss->rsn_ie);
-        }
-
-        if (bss && bss->ht_ie) {
-                memset(&iwe, 0, sizeof(iwe));
-                iwe.cmd = IWEVGENIE;
-                iwe.u.data.length = bss->ht_ie_len;
-                current_ev = iwe_stream_add_point(info, current_ev, end_buf,
-                                                  &iwe, bss->ht_ie);
-        }
+        ieee80211_sta_add_scan_ies(info, bss, &current_ev, end_buf);
 
         if (bss && bss->supp_rates_len > 0) {
                 /* display all supported rates in readable format */
diff --git a/net/mac80211/wme.c b/net/mac80211/wme.c
index 4310e2f65661..7229e958879d 100644
--- a/net/mac80211/wme.c
+++ b/net/mac80211/wme.c
@@ -47,8 +47,6 @@ static unsigned int classify_1d(struct sk_buff *skb)
                 return 0;
         }
 
-        if (dscp & 0x1c)
-                return 0;
         return dscp >> 5;
 }
 
diff --git a/net/rfkill/rfkill.c b/net/rfkill/rfkill.c
index 47e0b2d232e3..d5735799ccd9 100644
--- a/net/rfkill/rfkill.c
+++ b/net/rfkill/rfkill.c
@@ -37,7 +37,7 @@ MODULE_DESCRIPTION("RF switch support");
 MODULE_LICENSE("GPL");
 
 static LIST_HEAD(rfkill_list);  /* list of registered rf switches */
-static DEFINE_MUTEX(rfkill_mutex);
+static DEFINE_MUTEX(rfkill_global_mutex);
 
 static unsigned int rfkill_default_state = RFKILL_STATE_UNBLOCKED;
 module_param_named(default_state, rfkill_default_state, uint, 0444);
@@ -76,6 +76,7 @@ static BLOCKING_NOTIFIER_HEAD(rfkill_notifier_list);
  */
 int register_rfkill_notifier(struct notifier_block *nb)
 {
+        BUG_ON(!nb);
         return blocking_notifier_chain_register(&rfkill_notifier_list, nb);
 }
 EXPORT_SYMBOL_GPL(register_rfkill_notifier);
@@ -91,6 +92,7 @@ EXPORT_SYMBOL_GPL(register_rfkill_notifier);
  */
 int unregister_rfkill_notifier(struct notifier_block *nb)
 {
+        BUG_ON(!nb);
         return blocking_notifier_chain_unregister(&rfkill_notifier_list, nb);
 }
 EXPORT_SYMBOL_GPL(unregister_rfkill_notifier);
@@ -202,6 +204,9 @@ static int rfkill_toggle_radio(struct rfkill *rfkill,
                  * RFKILL_STATE_HARD_BLOCKED */
                 break;
         default:
+                WARN(1, KERN_WARNING
+                        "rfkill: illegal state %d passed as parameter "
+                        "to rfkill_toggle_radio\n", state);
                 return -EINVAL;
         }
 
@@ -229,14 +234,18 @@ static int rfkill_toggle_radio(struct rfkill *rfkill,
  * unless a specific switch is claimed by userspace (in which case,
  * that switch is left alone) or suspended.
  *
- * Caller must have acquired rfkill_mutex.
+ * Caller must have acquired rfkill_global_mutex.
  */
 static void __rfkill_switch_all(const enum rfkill_type type,
                                 const enum rfkill_state state)
 {
         struct rfkill *rfkill;
 
-        if (unlikely(state >= RFKILL_STATE_MAX))
+        if (WARN((state >= RFKILL_STATE_MAX || type >= RFKILL_TYPE_MAX),
+                        KERN_WARNING
+                        "rfkill: illegal state %d or type %d "
+                        "passed as parameter to __rfkill_switch_all\n",
+                        state, type))
                 return;
 
         rfkill_global_states[type].current_state = state;
@@ -254,14 +263,14 @@ static void __rfkill_switch_all(const enum rfkill_type type,
  * @type: type of interfaces to be affected
  * @state: the new state
  *
- * Acquires rfkill_mutex and calls __rfkill_switch_all(@type, @state).
+ * Acquires rfkill_global_mutex and calls __rfkill_switch_all(@type, @state).
  * Please refer to __rfkill_switch_all() for details.
  */
 void rfkill_switch_all(enum rfkill_type type, enum rfkill_state state)
 {
-        mutex_lock(&rfkill_mutex);
+        mutex_lock(&rfkill_global_mutex);
         __rfkill_switch_all(type, state);
-        mutex_unlock(&rfkill_mutex);
+        mutex_unlock(&rfkill_global_mutex);
 }
 EXPORT_SYMBOL(rfkill_switch_all);
 
@@ -269,7 +278,7 @@ EXPORT_SYMBOL(rfkill_switch_all);
  * rfkill_epo - emergency power off all transmitters
  *
  * This kicks all non-suspended rfkill devices to RFKILL_STATE_SOFT_BLOCKED,
- * ignoring everything in its path but rfkill_mutex and rfkill->mutex.
+ * ignoring everything in its path but rfkill_global_mutex and rfkill->mutex.
  *
  * The global state before the EPO is saved and can be restored later
  * using rfkill_restore_states().
@@ -279,7 +288,8 @@ void rfkill_epo(void)
         struct rfkill *rfkill;
         int i;
 
-        mutex_lock(&rfkill_mutex);
+        mutex_lock(&rfkill_global_mutex);
+
         list_for_each_entry(rfkill, &rfkill_list, node) {
                 mutex_lock(&rfkill->mutex);
                 rfkill_toggle_radio(rfkill, RFKILL_STATE_SOFT_BLOCKED, 1);
@@ -291,7 +301,7 @@ void rfkill_epo(void)
                 rfkill_global_states[i].current_state =
                                 RFKILL_STATE_SOFT_BLOCKED;
         }
-        mutex_unlock(&rfkill_mutex);
+        mutex_unlock(&rfkill_global_mutex);
 }
 EXPORT_SYMBOL_GPL(rfkill_epo);
 
@@ -306,10 +316,11 @@ void rfkill_restore_states(void)
 {
         int i;
 
-        mutex_lock(&rfkill_mutex);
+        mutex_lock(&rfkill_global_mutex);
+
         for (i = 0; i < RFKILL_TYPE_MAX; i++)
                 __rfkill_switch_all(i, rfkill_global_states[i].default_state);
-        mutex_unlock(&rfkill_mutex);
+        mutex_unlock(&rfkill_global_mutex);
 }
 EXPORT_SYMBOL_GPL(rfkill_restore_states);
 
@@ -334,7 +345,11 @@ int rfkill_force_state(struct rfkill *rfkill, enum rfkill_state state)
 {
         enum rfkill_state oldstate;
 
-        if (unlikely(state >= RFKILL_STATE_MAX))
+        BUG_ON(!rfkill);
+        if (WARN((state >= RFKILL_STATE_MAX),
+                        KERN_WARNING
+                        "rfkill: illegal state %d passed as parameter "
+                        "to rfkill_force_state\n", state))
                 return -EINVAL;
 
         mutex_lock(&rfkill->mutex);
@@ -402,12 +417,16 @@ static ssize_t rfkill_state_store(struct device *dev,
                                   const char *buf, size_t count)
 {
         struct rfkill *rfkill = to_rfkill(dev);
-        unsigned int state = simple_strtoul(buf, NULL, 0);
+        unsigned long state;
         int error;
 
         if (!capable(CAP_NET_ADMIN))
                 return -EPERM;
 
+        error = strict_strtoul(buf, 0, &state);
+        if (error)
+                return error;
+
         /* RFKILL_STATE_HARD_BLOCKED is illegal here... */
         if (state != RFKILL_STATE_UNBLOCKED &&
             state != RFKILL_STATE_SOFT_BLOCKED)
@@ -427,7 +446,7 @@ static ssize_t rfkill_claim_show(struct device *dev,
 {
         struct rfkill *rfkill = to_rfkill(dev);
 
-        return sprintf(buf, "%d", rfkill->user_claim);
+        return sprintf(buf, "%d\n", rfkill->user_claim);
 }
 
 static ssize_t rfkill_claim_store(struct device *dev,
@@ -435,7 +454,8 @@ static ssize_t rfkill_claim_store(struct device *dev,
                                   const char *buf, size_t count)
 {
         struct rfkill *rfkill = to_rfkill(dev);
-        bool claim = !!simple_strtoul(buf, NULL, 0);
+        unsigned long claim_tmp;
+        bool claim;
         int error;
 
         if (!capable(CAP_NET_ADMIN))
@@ -444,11 +464,16 @@ static ssize_t rfkill_claim_store(struct device *dev,
         if (rfkill->user_claim_unsupported)
                 return -EOPNOTSUPP;
 
+        error = strict_strtoul(buf, 0, &claim_tmp);
+        if (error)
+                return error;
+        claim = !!claim_tmp;
+
         /*
          * Take the global lock to make sure the kernel is not in
          * the middle of rfkill_switch_all
          */
-        error = mutex_lock_interruptible(&rfkill_mutex);
+        error = mutex_lock_interruptible(&rfkill_global_mutex);
         if (error)
                 return error;
 
@@ -463,7 +488,7 @@ static ssize_t rfkill_claim_store(struct device *dev,
                 rfkill->user_claim = claim;
         }
 
-        mutex_unlock(&rfkill_mutex);
+        mutex_unlock(&rfkill_global_mutex);
 
         return error ? error : count;
 }
@@ -583,10 +608,10 @@ static int rfkill_check_duplicity(const struct rfkill *rfkill)
         memset(seen, 0, sizeof(seen));
 
         list_for_each_entry(p, &rfkill_list, node) {
-                if (p == rfkill) {
-                        WARN_ON(1);
+                if (WARN((p == rfkill), KERN_WARNING
+                                "rfkill: illegal attempt to register "
+                                "an already registered rfkill struct\n"))
                         return -EEXIST;
-                }
                 set_bit(p->type, seen);
         }
 
@@ -598,7 +623,7 @@ static int rfkill_add_switch(struct rfkill *rfkill)
 {
         int error;
 
-        mutex_lock(&rfkill_mutex);
+        mutex_lock(&rfkill_global_mutex);
 
         error = rfkill_check_duplicity(rfkill);
         if (error < 0)
@@ -619,16 +644,16 @@ static int rfkill_add_switch(struct rfkill *rfkill)
 
         error = 0;
 unlock_out:
-        mutex_unlock(&rfkill_mutex);
+        mutex_unlock(&rfkill_global_mutex);
 
         return error;
 }
 
 static void rfkill_remove_switch(struct rfkill *rfkill)
 {
-        mutex_lock(&rfkill_mutex);
+        mutex_lock(&rfkill_global_mutex);
         list_del_init(&rfkill->node);
-        mutex_unlock(&rfkill_mutex);
+        mutex_unlock(&rfkill_global_mutex);
 
         mutex_lock(&rfkill->mutex);
         rfkill_toggle_radio(rfkill, RFKILL_STATE_SOFT_BLOCKED, 1);
@@ -654,6 +679,12 @@ struct rfkill * __must_check rfkill_allocate(struct device *parent,
         struct rfkill *rfkill;
         struct device *dev;
 
+        if (WARN((type >= RFKILL_TYPE_MAX),
+                        KERN_WARNING
+                        "rfkill: illegal type %d passed as parameter "
+                        "to rfkill_allocate\n", type))
+                return NULL;
+
         rfkill = kzalloc(sizeof(struct rfkill), GFP_KERNEL);
         if (!rfkill)
                 return NULL;
@@ -726,11 +757,12 @@ int __must_check rfkill_register(struct rfkill *rfkill)
         struct device *dev = &rfkill->dev;
         int error;
 
-        if (!rfkill->toggle_radio)
-                return -EINVAL;
-        if (rfkill->type >= RFKILL_TYPE_MAX)
-                return -EINVAL;
-        if (rfkill->state >= RFKILL_STATE_MAX)
+        if (WARN((!rfkill || !rfkill->toggle_radio ||
+                        rfkill->type >= RFKILL_TYPE_MAX ||
+                        rfkill->state >= RFKILL_STATE_MAX),
+                        KERN_WARNING
+                        "rfkill: attempt to register a "
+                        "badly initialized rfkill struct\n"))
                 return -EINVAL;
 
         snprintf(dev->bus_id, sizeof(dev->bus_id),
@@ -765,6 +797,7 @@ EXPORT_SYMBOL(rfkill_register);
  */
 void rfkill_unregister(struct rfkill *rfkill)
 {
+        BUG_ON(!rfkill);
         device_del(&rfkill->dev);
         rfkill_remove_switch(rfkill);
         rfkill_led_trigger_unregister(rfkill);
@@ -801,12 +834,15 @@ int rfkill_set_default(enum rfkill_type type, enum rfkill_state state)
 {
         int error;
 
-        if (type >= RFKILL_TYPE_MAX ||
-            (state != RFKILL_STATE_SOFT_BLOCKED &&
-             state != RFKILL_STATE_UNBLOCKED))
+        if (WARN((type >= RFKILL_TYPE_MAX ||
+                        (state != RFKILL_STATE_SOFT_BLOCKED &&
+                         state != RFKILL_STATE_UNBLOCKED)),
+                        KERN_WARNING
+                        "rfkill: illegal state %d or type %d passed as "
+                        "parameter to rfkill_set_default\n", state, type))
                 return -EINVAL;
 
-        mutex_lock(&rfkill_mutex);
+        mutex_lock(&rfkill_global_mutex);
 
         if (!test_and_set_bit(type, rfkill_states_lockdflt)) {
                 rfkill_global_states[type].default_state = state;
@@ -814,7 +850,7 @@ int rfkill_set_default(enum rfkill_type type, enum rfkill_state state)
         } else
                 error = -EPERM;
 
-        mutex_unlock(&rfkill_mutex);
+        mutex_unlock(&rfkill_global_mutex);
         return error;
 }
 EXPORT_SYMBOL_GPL(rfkill_set_default);
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 59eb2cf42e5f..4d6c02afd6f5 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -87,6 +87,13 @@ static struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] __read_mostly = {
         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
                                 .len = IEEE80211_MAX_MESH_ID_LEN },
         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
+
+        [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
+        [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
+        [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
+
+        [NL80211_ATTR_HT_CAPABILITY] = { .type = NLA_BINARY,
+                                         .len = NL80211_HT_CAPABILITY_LEN },
 };
 
 /* message building helper */
@@ -1125,6 +1132,10 @@ static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
                 params.listen_interval =
                     nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
 
+        if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
+                params.ht_capa =
+                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
+
         if (parse_station_flags(info->attrs[NL80211_ATTR_STA_FLAGS],
                                 &params.station_flags))
                 return -EINVAL;
@@ -1188,6 +1199,9 @@ static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
         params.listen_interval =
                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
         params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
+        if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
+                params.ht_capa =
+                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
 
         if (parse_station_flags(info->attrs[NL80211_ATTR_STA_FLAGS],
                                 &params.station_flags))
@@ -1525,6 +1539,48 @@ static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
         return err;
 }
 
+static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
+{
+        struct cfg80211_registered_device *drv;
+        int err;
+        struct net_device *dev;
+        struct bss_parameters params;
+
+        memset(&params, 0, sizeof(params));
+        /* default to not changing parameters */
+        params.use_cts_prot = -1;
+        params.use_short_preamble = -1;
+        params.use_short_slot_time = -1;
+
+        if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
+                params.use_cts_prot =
+                    nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
+        if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
+                params.use_short_preamble =
+                    nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
+        if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
+                params.use_short_slot_time =
+                    nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
+
+        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
+        if (err)
+                return err;
+
+        if (!drv->ops->change_bss) {
+                err = -EOPNOTSUPP;
+                goto out;
+        }
+
+        rtnl_lock();
+        err = drv->ops->change_bss(&drv->wiphy, dev, &params);
+        rtnl_unlock();
+
+ out:
+        cfg80211_put_dev(drv);
+        dev_put(dev);
+        return err;
+}
+
 static struct genl_ops nl80211_ops[] = {
         {
                 .cmd = NL80211_CMD_GET_WIPHY,
@@ -1656,6 +1712,12 @@ static struct genl_ops nl80211_ops[] = {
                 .policy = nl80211_policy,
                 .flags = GENL_ADMIN_PERM,
         },
+        {
+                .cmd = NL80211_CMD_SET_BSS,
+                .doit = nl80211_set_bss,
+                .policy = nl80211_policy,
+                .flags = GENL_ADMIN_PERM,
+        },
 };
 
 /* multicast groups */