75 files changed, 3069 insertions, 1429 deletions
diff --git a/net/8021q/vlan_core.c b/net/8021q/vlan_core.c
index c67fe6f75653..7f7de1a04de6 100644
--- a/net/8021q/vlan_core.c
+++ b/net/8021q/vlan_core.c
@@ -114,9 +114,9 @@ int vlan_gro_receive(struct napi_struct *napi, struct vlan_group *grp,
 EXPORT_SYMBOL(vlan_gro_receive);
 int vlan_gro_frags(struct napi_struct *napi, struct vlan_group *grp,
-                   unsigned int vlan_tci, struct napi_gro_fraginfo *info)
+                   unsigned int vlan_tci)
 {
-        struct sk_buff *skb = napi_fraginfo_skb(napi, info);
+        struct sk_buff *skb = napi_frags_skb(napi);
        if (!skb)
                return NET_RX_DROP;
diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index b4b9068e55a7..25ba41e35338 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -671,13 +671,7 @@ static int vlan_ethtool_get_settings(struct net_device *dev,
                                     struct ethtool_cmd *cmd)
 {
        const struct vlan_dev_info *vlan = vlan_dev_info(dev);
-        struct net_device *real_dev = vlan->real_dev;
+        return dev_ethtool_get_settings(vlan->real_dev, cmd);
-        if (!real_dev->ethtool_ops ||
-            !real_dev->ethtool_ops->get_settings)
-                return -EOPNOTSUPP;
-        return real_dev->ethtool_ops->get_settings(real_dev, cmd);
 }
 static void vlan_ethtool_get_drvinfo(struct net_device *dev,
@@ -691,24 +685,13 @@ static void vlan_ethtool_get_drvinfo(struct net_device *dev,
 static u32 vlan_ethtool_get_rx_csum(struct net_device *dev)
 {
        const struct vlan_dev_info *vlan = vlan_dev_info(dev);
-        struct net_device *real_dev = vlan->real_dev;
+        return dev_ethtool_get_rx_csum(vlan->real_dev);
-        if (real_dev->ethtool_ops == NULL ||
-            real_dev->ethtool_ops->get_rx_csum == NULL)
-                return 0;
-        return real_dev->ethtool_ops->get_rx_csum(real_dev);
 }
 static u32 vlan_ethtool_get_flags(struct net_device *dev)
 {
        const struct vlan_dev_info *vlan = vlan_dev_info(dev);
-        struct net_device *real_dev = vlan->real_dev;
+        return dev_ethtool_get_flags(vlan->real_dev);
-        if (!(real_dev->features & NETIF_F_HW_VLAN_RX) ||
-            real_dev->ethtool_ops == NULL ||
-            real_dev->ethtool_ops->get_flags == NULL)
-                return 0;
-        return real_dev->ethtool_ops->get_flags(real_dev);
 }
 static const struct ethtool_ops vlan_ethtool_ops = {
diff --git a/net/core/datagram.c b/net/core/datagram.c
index b01a76abe1d2..22ea437c5023 100644
--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -351,17 +351,111 @@ fault:
 }
 /**
+ *      skb_copy_datagram_const_iovec - Copy a datagram to an iovec.
+ *      @skb: buffer to copy
+ *      @offset: offset in the buffer to start copying from
+ *      @to: io vector to copy to
+ *      @to_offset: offset in the io vector to start copying to
+ *      @len: amount of data to copy from buffer to iovec
+ *
+ *      Returns 0 or -EFAULT.
+ *      Note: the iovec is not modified during the copy.
+ */
+int skb_copy_datagram_const_iovec(const struct sk_buff *skb, int offset,
+                                  const struct iovec *to, int to_offset,
+                                  int len)
+{
+        int start = skb_headlen(skb);
+        int i, copy = start - offset;
+        /* Copy header. */
+        if (copy > 0) {
+                if (copy > len)
+                        copy = len;
+                if (memcpy_toiovecend(to, skb->data + offset, to_offset, copy))
+                        goto fault;
+                if ((len -= copy) == 0)
+                        return 0;
+                offset += copy;
+                to_offset += copy;
+        }
+        /* Copy paged appendix. Hmm... why does this look so complicated? */
+        for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
+                int end;
+                WARN_ON(start > offset + len);
+                end = start + skb_shinfo(skb)->frags[i].size;
+                if ((copy = end - offset) > 0) {
+                        int err;
+                        u8  *vaddr;
+                        skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
+                        struct page *page = frag->page;
+                        if (copy > len)
+                                copy = len;
+                        vaddr = kmap(page);
+                        err = memcpy_toiovecend(to, vaddr + frag->page_offset +
+                                                offset - start, to_offset, copy);
+                        kunmap(page);
+                        if (err)
+                                goto fault;
+                        if (!(len -= copy))
+                                return 0;
+                        offset += copy;
+                        to_offset += copy;
+                }
+                start = end;
+        }
+        if (skb_shinfo(skb)->frag_list) {
+                struct sk_buff *list = skb_shinfo(skb)->frag_list;
+                for (; list; list = list->next) {
+                        int end;
+                        WARN_ON(start > offset + len);
+                        end = start + list->len;
+                        if ((copy = end - offset) > 0) {
+                                if (copy > len)
+                                        copy = len;
+                                if (skb_copy_datagram_const_iovec(list,
+                                                            offset - start,
+                                                            to, to_offset,
+                                                            copy))
+                                        goto fault;
+                                if ((len -= copy) == 0)
+                                        return 0;
+                                offset += copy;
+                                to_offset += copy;
+                        }
+                        start = end;
+                }
+        }
+        if (!len)
+                return 0;
+fault:
+        return -EFAULT;
+}
+EXPORT_SYMBOL(skb_copy_datagram_const_iovec);
+/**
 *      skb_copy_datagram_from_iovec - Copy a datagram from an iovec.
 *      @skb: buffer to copy
 *      @offset: offset in the buffer to start copying to
 *      @from: io vector to copy to
+ *      @from_offset: offset in the io vector to start copying from
 *      @len: amount of data to copy to buffer from iovec
 *
 *      Returns 0 or -EFAULT.
- *      Note: the iovec is modified during the copy.
+ *      Note: the iovec is not modified during the copy.
 */
 int skb_copy_datagram_from_iovec(struct sk_buff *skb, int offset,
-                                 struct iovec *from, int len)
+                                 const struct iovec *from, int from_offset,
+                                 int len)
 {
        int start = skb_headlen(skb);
        int i, copy = start - offset;
@@ -370,11 +464,12 @@ int skb_copy_datagram_from_iovec(struct sk_buff *skb, int offset,
        if (copy > 0) {
                if (copy > len)
                        copy = len;
-                if (memcpy_fromiovec(skb->data + offset, from, copy))
+                if (memcpy_fromiovecend(skb->data + offset, from, 0, copy))
                        goto fault;
                if ((len -= copy) == 0)
                        return 0;
                offset += copy;
+                from_offset += copy;
        }
        /* Copy paged appendix. Hmm... why does this look so complicated? */
@@ -393,8 +488,9 @@ int skb_copy_datagram_from_iovec(struct sk_buff *skb, int offset,
                        if (copy > len)
                                copy = len;
                        vaddr = kmap(page);
-                        err = memcpy_fromiovec(vaddr + frag->page_offset +
+                        err = memcpy_fromiovecend(vaddr + frag->page_offset +
-                                               offset - start, from, copy);
+                                                  offset - start,
+                                                  from, from_offset, copy);
                        kunmap(page);
                        if (err)
                                goto fault;
@@ -402,6 +498,7 @@ int skb_copy_datagram_from_iovec(struct sk_buff *skb, int offset,
                        if (!(len -= copy))
                                return 0;
                        offset += copy;
+                        from_offset += copy;
                }
                start = end;
        }
@@ -420,11 +517,14 @@ int skb_copy_datagram_from_iovec(struct sk_buff *skb, int offset,
                                        copy = len;
                                if (skb_copy_datagram_from_iovec(list,
                                                                 offset - start,
-                                                                 from, copy))
+                                                                 from,
+                                                                 from_offset,
+                                                                 copy))
                                        goto fault;
                                if ((len -= copy) == 0)
                                        return 0;
                                offset += copy;
+                                from_offset += copy;
                        }
                        start = end;
                }
diff --git a/net/core/dev.c b/net/core/dev.c
index 308a7d0c277f..6785b067ad50 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2378,18 +2378,13 @@ void *skb_gro_header(struct sk_buff *skb, unsigned int hlen)
        unsigned int offset = skb_gro_offset(skb);
        hlen += offset;
-        if (hlen <= skb_headlen(skb))
+        if (unlikely(skb_headlen(skb) ||
-                return skb->data + offset;
+                     skb_shinfo(skb)->frags[0].size < hlen ||
-        if (unlikely(!skb_shinfo(skb)->nr_frags ||
-                     skb_shinfo(skb)->frags[0].size <=
-                     hlen - skb_headlen(skb) ||
                     PageHighMem(skb_shinfo(skb)->frags[0].page)))
                return pskb_may_pull(skb, hlen) ? skb->data + offset : NULL;
        return page_address(skb_shinfo(skb)->frags[0].page) +
-               skb_shinfo(skb)->frags[0].page_offset +
+               skb_shinfo(skb)->frags[0].page_offset + offset;
-               offset - skb_headlen(skb);
 }
 EXPORT_SYMBOL(skb_gro_header);
@@ -2525,16 +2520,10 @@ void napi_reuse_skb(struct napi_struct *napi, struct sk_buff *skb)
 }
 EXPORT_SYMBOL(napi_reuse_skb);
-struct sk_buff *napi_fraginfo_skb(struct napi_struct *napi,
+struct sk_buff *napi_get_frags(struct napi_struct *napi)
-                                  struct napi_gro_fraginfo *info)
 {
        struct net_device *dev = napi->dev;
        struct sk_buff *skb = napi->skb;
-        struct ethhdr *eth;
-        skb_frag_t *frag;
-        int i;
-        napi->skb = NULL;
        if (!skb) {
                skb = netdev_alloc_skb(dev, GRO_MAX_HEAD + NET_IP_ALIGN);
@@ -2542,47 +2531,14 @@ struct sk_buff *napi_fraginfo_skb(struct napi_struct *napi,
                        goto out;
                skb_reserve(skb, NET_IP_ALIGN);
-        }
-        BUG_ON(info->nr_frags > MAX_SKB_FRAGS);
-        frag = info->frags;
-        for (i = 0; i < info->nr_frags; i++) {
+                napi->skb = skb;
-                skb_fill_page_desc(skb, i, frag->page, frag->page_offset,
-                                   frag->size);
-                frag++;
-        }
-        skb_shinfo(skb)->nr_frags = info->nr_frags;
-        skb->data_len = info->len;
-        skb->len += info->len;
-        skb->truesize += info->len;
-        skb_reset_mac_header(skb);
-        skb_gro_reset_offset(skb);
-        eth = skb_gro_header(skb, sizeof(*eth));
-        if (!eth) {
-                napi_reuse_skb(napi, skb);
-                skb = NULL;
-                goto out;
        }
-        skb_gro_pull(skb, sizeof(*eth));
-        /*
-         * This works because the only protocols we care about don't require
-         * special handling.  We'll fix it up properly at the end.
-         */
-        skb->protocol = eth->h_proto;
-        skb->ip_summed = info->ip_summed;
-        skb->csum = info->csum;
 out:
        return skb;
 }
-EXPORT_SYMBOL(napi_fraginfo_skb);
+EXPORT_SYMBOL(napi_get_frags);
 int napi_frags_finish(struct napi_struct *napi, struct sk_buff *skb, int ret)
 {
@@ -2612,9 +2568,39 @@ int napi_frags_finish(struct napi_struct *napi, struct sk_buff *skb, int ret)
 }
 EXPORT_SYMBOL(napi_frags_finish);
-int napi_gro_frags(struct napi_struct *napi, struct napi_gro_fraginfo *info)
+struct sk_buff *napi_frags_skb(struct napi_struct *napi)
+{
+        struct sk_buff *skb = napi->skb;
+        struct ethhdr *eth;
+        napi->skb = NULL;
+        skb_reset_mac_header(skb);
+        skb_gro_reset_offset(skb);
+        eth = skb_gro_header(skb, sizeof(*eth));
+        if (!eth) {
+                napi_reuse_skb(napi, skb);
+                skb = NULL;
+                goto out;
+        }
+        skb_gro_pull(skb, sizeof(*eth));
+        /*
+         * This works because the only protocols we care about don't require
+         * special handling.  We'll fix it up properly at the end.
+         */
+        skb->protocol = eth->h_proto;
+out:
+        return skb;
+}
+EXPORT_SYMBOL(napi_frags_skb);
+int napi_gro_frags(struct napi_struct *napi)
 {
-        struct sk_buff *skb = napi_fraginfo_skb(napi, info);
+        struct sk_buff *skb = napi_frags_skb(napi);
        if (!skb)
                return NET_RX_DROP;
@@ -2718,7 +2704,7 @@ void netif_napi_del(struct napi_struct *napi)
        struct sk_buff *skb, *next;
        list_del_init(&napi->dev_list);
-        kfree_skb(napi->skb);
+        napi_free_frags(napi);
        for (skb = napi->gro_list; skb; skb = next) {
                next = skb->next;
diff --git a/net/core/drop_monitor.c b/net/core/drop_monitor.c
index 9fd0dc3cca99..2797b711a978 100644
--- a/net/core/drop_monitor.c
+++ b/net/core/drop_monitor.c
@@ -51,7 +51,7 @@ static struct genl_family net_drop_monitor_family = {
        .id             = GENL_ID_GENERATE,
        .hdrsize        = 0,
        .name           = "NET_DM",
-        .version        = 1,
+        .version        = 2,
        .maxattr        = NET_DM_CMD_MAX,
 };
@@ -65,13 +65,17 @@ static void reset_per_cpu_data(struct per_cpu_dm_data *data)
 {
        size_t al;
        struct net_dm_alert_msg *msg;
+        struct nlattr *nla;
        al = sizeof(struct net_dm_alert_msg);
        al += dm_hit_limit * sizeof(struct net_dm_drop_point);
+        al += sizeof(struct nlattr);
        data->skb = genlmsg_new(al, GFP_KERNEL);
        genlmsg_put(data->skb, 0, 0, &net_drop_monitor_family,
                        0, NET_DM_CMD_ALERT);
-        msg = __nla_reserve_nohdr(data->skb, sizeof(struct net_dm_alert_msg));
+        nla = nla_reserve(data->skb, NLA_UNSPEC, sizeof(struct net_dm_alert_msg));
+        msg = nla_data(nla);
        memset(msg, 0, al);
        atomic_set(&data->dm_hit_count, dm_hit_limit);
 }
@@ -115,6 +119,7 @@ static void trace_kfree_skb_hit(struct sk_buff *skb, void *location)
 {
        struct net_dm_alert_msg *msg;
        struct nlmsghdr *nlh;
+        struct nlattr *nla;
        int i;
        struct per_cpu_dm_data *data = &__get_cpu_var(dm_cpu_data);
@@ -127,7 +132,8 @@ static void trace_kfree_skb_hit(struct sk_buff *skb, void *location)
        }
        nlh = (struct nlmsghdr *)data->skb->data;
-        msg = genlmsg_data(nlmsg_data(nlh));
+        nla = genlmsg_data(nlmsg_data(nlh));
+        msg = nla_data(nla);
        for (i = 0; i < msg->entries; i++) {
                if (!memcmp(&location, msg->points[i].pc, sizeof(void *))) {
                        msg->points[i].count++;
@@ -139,6 +145,7 @@ static void trace_kfree_skb_hit(struct sk_buff *skb, void *location)
         * We need to create a new entry
         */
        __nla_reserve_nohdr(data->skb, sizeof(struct net_dm_drop_point));
+        nla->nla_len += NLA_ALIGN(sizeof(struct net_dm_drop_point));
        memcpy(msg->points[msg->entries].pc, &location, sizeof(void *));
        msg->points[msg->entries].count = 1;
        msg->entries++;
diff --git a/net/core/iovec.c b/net/core/iovec.c
index 4c9c0121c9da..40a76ce19d9f 100644
--- a/net/core/iovec.c
+++ b/net/core/iovec.c
@@ -98,6 +98,31 @@ int memcpy_toiovec(struct iovec *iov, unsigned char *kdata, int len)
 }
 /*
+ *      Copy kernel to iovec. Returns -EFAULT on error.
+ */
+int memcpy_toiovecend(const struct iovec *iov, unsigned char *kdata,
+                      int offset, int len)
+{
+        int copy;
+        for (; len > 0; ++iov) {
+                /* Skip over the finished iovecs */
+                if (unlikely(offset >= iov->iov_len)) {
+                        offset -= iov->iov_len;
+                        continue;
+                }
+                copy = min_t(unsigned int, iov->iov_len - offset, len);
+                offset = 0;
+                if (copy_to_user(iov->iov_base, kdata, copy))
+                        return -EFAULT;
+                kdata += copy;
+                len -= copy;
+        }
+        return 0;
+}
+/*
 *      Copy iovec to kernel. Returns -EFAULT on error.
 *
 *      Note: this modifies the original iovec.
@@ -122,10 +147,11 @@ int memcpy_fromiovec(unsigned char *kdata, struct iovec *iov, int len)
 }
 /*
- *      For use with ip_build_xmit
+ *      Copy iovec from kernel. Returns -EFAULT on error.
 */
-int memcpy_fromiovecend(unsigned char *kdata, struct iovec *iov, int offset,
-                        int len)
+int memcpy_fromiovecend(unsigned char *kdata, const struct iovec *iov,
+                        int offset, int len)
 {
        /* Skip over the finished iovecs */
        while (offset >= iov->iov_len) {
@@ -236,3 +262,4 @@ EXPORT_SYMBOL(csum_partial_copy_fromiovecend);
 EXPORT_SYMBOL(memcpy_fromiovec);
 EXPORT_SYMBOL(memcpy_fromiovecend);
 EXPORT_SYMBOL(memcpy_toiovec);
+EXPORT_SYMBOL(memcpy_toiovecend);
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index 7f03373b8c07..170689681aa2 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -1003,8 +1003,6 @@ void inet_register_protosw(struct inet_protosw *p)
 out:
        spin_unlock_bh(&inetsw_lock);
-        synchronize_net();
        return;
 out_permanent:
diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
index 588a7796e3e3..b0b273503e2a 100644
--- a/net/ipv4/inet_diag.c
+++ b/net/ipv4/inet_diag.c
@@ -198,8 +198,6 @@ static int inet_twsk_diag_fill(struct inet_timewait_sock *tw,
                tmo = 0;
        r->idiag_family       = tw->tw_family;
-        r->idiag_state        = tw->tw_state;
-        r->idiag_timer        = 0;
        r->idiag_retrans      = 0;
        r->id.idiag_if        = tw->tw_bound_dev_if;
        r->id.idiag_cookie[0] = (u32)(unsigned long)tw;
diff --git a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c
index 1a58a6fa1dc0..40f6206b2aa9 100644
--- a/net/ipv4/ip_input.c
+++ b/net/ipv4/ip_input.c
@@ -358,10 +358,12 @@ static int ip_rcv_finish(struct sk_buff *skb)
                goto drop;
        rt = skb->rtable;
-        if (rt->rt_type == RTN_MULTICAST)
+        if (rt->rt_type == RTN_MULTICAST) {
-                IP_INC_STATS_BH(dev_net(rt->u.dst.dev), IPSTATS_MIB_INMCASTPKTS);
+                IP_UPD_PO_STATS_BH(dev_net(rt->u.dst.dev), IPSTATS_MIB_INMCAST,
-        else if (rt->rt_type == RTN_BROADCAST)
+                                skb->len);
-                IP_INC_STATS_BH(dev_net(rt->u.dst.dev), IPSTATS_MIB_INBCASTPKTS);
+        } else if (rt->rt_type == RTN_BROADCAST)
+                IP_UPD_PO_STATS_BH(dev_net(rt->u.dst.dev), IPSTATS_MIB_INBCAST,
+                                skb->len);
        return dst_input(skb);
@@ -384,7 +386,8 @@ int ip_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt,
        if (skb->pkt_type == PACKET_OTHERHOST)
                goto drop;
-        IP_INC_STATS_BH(dev_net(dev), IPSTATS_MIB_INRECEIVES);
+        IP_UPD_PO_STATS_BH(dev_net(dev), IPSTATS_MIB_IN, skb->len);
        if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL) {
                IP_INC_STATS_BH(dev_net(dev), IPSTATS_MIB_INDISCARDS);
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 3e7e910c7c0f..ea19c37ccc0c 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -181,10 +181,10 @@ static inline int ip_finish_output2(struct sk_buff *skb)
        struct net_device *dev = dst->dev;
        unsigned int hh_len = LL_RESERVED_SPACE(dev);
-        if (rt->rt_type == RTN_MULTICAST)
+        if (rt->rt_type == RTN_MULTICAST) {
-                IP_INC_STATS(dev_net(dev), IPSTATS_MIB_OUTMCASTPKTS);
+                IP_UPD_PO_STATS(dev_net(dev), IPSTATS_MIB_OUTMCAST, skb->len);
-        else if (rt->rt_type == RTN_BROADCAST)
+        } else if (rt->rt_type == RTN_BROADCAST)
-                IP_INC_STATS(dev_net(dev), IPSTATS_MIB_OUTBCASTPKTS);
+                IP_UPD_PO_STATS(dev_net(dev), IPSTATS_MIB_OUTBCAST, skb->len);
        /* Be paranoid, rather than too clever. */
        if (unlikely(skb_headroom(skb) < hh_len && dev->header_ops)) {
@@ -244,7 +244,7 @@ int ip_mc_output(struct sk_buff *skb)
        /*
         *      If the indicated interface is up and running, send the packet.
         */
-        IP_INC_STATS(dev_net(dev), IPSTATS_MIB_OUTREQUESTS);
+        IP_UPD_PO_STATS(dev_net(dev), IPSTATS_MIB_OUT, skb->len);
        skb->dev = dev;
        skb->protocol = htons(ETH_P_IP);
@@ -298,7 +298,7 @@ int ip_output(struct sk_buff *skb)
 {
        struct net_device *dev = skb->dst->dev;
-        IP_INC_STATS(dev_net(dev), IPSTATS_MIB_OUTREQUESTS);
+        IP_UPD_PO_STATS(dev_net(dev), IPSTATS_MIB_OUT, skb->len);
        skb->dev = dev;
        skb->protocol = htons(ETH_P_IP);
diff --git a/net/ipv4/proc.c b/net/ipv4/proc.c
index cf0cdeeb1db0..f25542c48b7d 100644
--- a/net/ipv4/proc.c
+++ b/net/ipv4/proc.c
@@ -90,14 +90,14 @@ static const struct file_operations sockstat_seq_fops = {
 /* snmp items */
 static const struct snmp_mib snmp4_ipstats_list[] = {
-        SNMP_MIB_ITEM("InReceives", IPSTATS_MIB_INRECEIVES),
+        SNMP_MIB_ITEM("InReceives", IPSTATS_MIB_INPKTS),
        SNMP_MIB_ITEM("InHdrErrors", IPSTATS_MIB_INHDRERRORS),
        SNMP_MIB_ITEM("InAddrErrors", IPSTATS_MIB_INADDRERRORS),
        SNMP_MIB_ITEM("ForwDatagrams", IPSTATS_MIB_OUTFORWDATAGRAMS),
        SNMP_MIB_ITEM("InUnknownProtos", IPSTATS_MIB_INUNKNOWNPROTOS),
        SNMP_MIB_ITEM("InDiscards", IPSTATS_MIB_INDISCARDS),
        SNMP_MIB_ITEM("InDelivers", IPSTATS_MIB_INDELIVERS),
-        SNMP_MIB_ITEM("OutRequests", IPSTATS_MIB_OUTREQUESTS),
+        SNMP_MIB_ITEM("OutRequests", IPSTATS_MIB_OUTPKTS),
        SNMP_MIB_ITEM("OutDiscards", IPSTATS_MIB_OUTDISCARDS),
        SNMP_MIB_ITEM("OutNoRoutes", IPSTATS_MIB_OUTNOROUTES),
        SNMP_MIB_ITEM("ReasmTimeout", IPSTATS_MIB_REASMTIMEOUT),
@@ -118,6 +118,12 @@ static const struct snmp_mib snmp4_ipextstats_list[] = {
        SNMP_MIB_ITEM("OutMcastPkts", IPSTATS_MIB_OUTMCASTPKTS),
        SNMP_MIB_ITEM("InBcastPkts", IPSTATS_MIB_INBCASTPKTS),
        SNMP_MIB_ITEM("OutBcastPkts", IPSTATS_MIB_OUTBCASTPKTS),
+        SNMP_MIB_ITEM("InOctets", IPSTATS_MIB_INOCTETS),
+        SNMP_MIB_ITEM("OutOctets", IPSTATS_MIB_OUTOCTETS),
+        SNMP_MIB_ITEM("InMcastOctets", IPSTATS_MIB_INMCASTOCTETS),
+        SNMP_MIB_ITEM("OutMcastOctets", IPSTATS_MIB_OUTMCASTOCTETS),
+        SNMP_MIB_ITEM("InBcastOctets", IPSTATS_MIB_INBCASTOCTETS),
+        SNMP_MIB_ITEM("OutBcastOctets", IPSTATS_MIB_OUTBCASTOCTETS),
        SNMP_MIB_SENTINEL
 };
diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
index b35a950d2e06..cd2b97f1b6e1 100644
--- a/net/ipv4/syncookies.c
+++ b/net/ipv4/syncookies.c
@@ -161,13 +161,12 @@ static __u16 const msstab[] = {
 */
 __u32 cookie_v4_init_sequence(struct sock *sk, struct sk_buff *skb, __u16 *mssp)
 {
-        struct tcp_sock *tp = tcp_sk(sk);
        const struct iphdr *iph = ip_hdr(skb);
        const struct tcphdr *th = tcp_hdr(skb);
        int mssind;
        const __u16 mss = *mssp;
-        tp->last_synq_overflow = jiffies;
+        tcp_synq_overflow(sk);
        /* XXX sort msstab[] by probability?  Binary search? */
        for (mssind = 0; mss > msstab[mssind + 1]; mssind++)
@@ -268,7 +267,7 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
        if (!sysctl_tcp_syncookies || !th->ack)
                goto out;
-        if (time_after(jiffies, tp->last_synq_overflow + TCP_TIMEOUT_INIT) ||
+        if (tcp_synq_no_recent_overflow(sk) ||
            (mss = cookie_check(skb, cookie)) == 0) {
                NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_SYNCOOKIESFAILED);
                goto out;
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 5d427f86b414..bda74e8aed7e 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -2343,7 +2343,7 @@ void tcp4_proc_exit(void)
 struct sk_buff **tcp4_gro_receive(struct sk_buff **head, struct sk_buff *skb)
 {
-        struct iphdr *iph = ip_hdr(skb);
+        struct iphdr *iph = skb_gro_network_header(skb);
        switch (skb->ip_summed) {
        case CHECKSUM_COMPLETE:
diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
index 8f04bd9da274..bc1a920c34a1 100644
--- a/net/ipv6/ip6_input.c
+++ b/net/ipv6/ip6_input.c
@@ -70,7 +70,7 @@ int ipv6_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt
        idev = __in6_dev_get(skb->dev);
-        IP6_INC_STATS_BH(net, idev, IPSTATS_MIB_INRECEIVES);
+        IP6_UPD_PO_STATS_BH(net, idev, IPSTATS_MIB_IN, skb->len);
        if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL ||
            !idev || unlikely(idev->cnf.disable_ipv6)) {
@@ -242,8 +242,9 @@ int ip6_mc_input(struct sk_buff *skb)
        struct ipv6hdr *hdr;
        int deliver;
-        IP6_INC_STATS_BH(dev_net(skb->dst->dev),
+        IP6_UPD_PO_STATS_BH(dev_net(skb->dst->dev),
-                         ip6_dst_idev(skb->dst), IPSTATS_MIB_INMCASTPKTS);
+                         ip6_dst_idev(skb->dst), IPSTATS_MIB_INMCAST,
+                         skb->len);
        hdr = ipv6_hdr(skb);
        deliver = ipv6_chk_mcast_addr(skb->dev, &hdr->daddr, NULL);
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 9fb49c3b518a..735a2bf4b5f1 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -159,7 +159,8 @@ static int ip6_output2(struct sk_buff *skb)
                        }
                }
-                IP6_INC_STATS(dev_net(dev), idev, IPSTATS_MIB_OUTMCASTPKTS);
+                IP6_UPD_PO_STATS(dev_net(dev), idev, IPSTATS_MIB_OUTMCAST,
+                                skb->len);
        }
        return NF_HOOK(PF_INET6, NF_INET_POST_ROUTING, skb, NULL, skb->dev,
@@ -275,8 +276,8 @@ int ip6_xmit(struct sock *sk, struct sk_buff *skb, struct flowi *fl,
        mtu = dst_mtu(dst);
        if ((skb->len <= mtu) || skb->local_df || skb_is_gso(skb)) {
-                IP6_INC_STATS(net, ip6_dst_idev(skb->dst),
+                IP6_UPD_PO_STATS(net, ip6_dst_idev(skb->dst),
-                              IPSTATS_MIB_OUTREQUESTS);
+                              IPSTATS_MIB_OUT, skb->len);
                return NF_HOOK(PF_INET6, NF_INET_LOCAL_OUT, skb, NULL, dst->dev,
                                dst_output);
        }
@@ -1516,7 +1517,7 @@ int ip6_push_pending_frames(struct sock *sk)
        skb->mark = sk->sk_mark;
        skb->dst = dst_clone(&rt->u.dst);
-        IP6_INC_STATS(net, rt->rt6i_idev, IPSTATS_MIB_OUTREQUESTS);
+        IP6_UPD_PO_STATS(net, rt->rt6i_idev, IPSTATS_MIB_OUT, skb->len);
        if (proto == IPPROTO_ICMPV6) {
                struct inet6_dev *idev = ip6_dst_idev(skb->dst);
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index a51fb33e6864..4b48819a5b8d 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -1449,7 +1449,8 @@ static void mld_sendpack(struct sk_buff *skb)
        int err;
        struct flowi fl;
-        IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTREQUESTS);
+        IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUT, skb->len);
        payload_len = (skb->tail - skb->network_header) - sizeof(*pip6);
        mldlen = skb->tail - skb->transport_header;
        pip6->payload_len = htons(payload_len);
@@ -1473,13 +1474,15 @@ static void mld_sendpack(struct sk_buff *skb)
        if (err)
                goto err_out;
+        payload_len = skb->len;
        err = NF_HOOK(PF_INET6, NF_INET_LOCAL_OUT, skb, NULL, skb->dev,
                      dst_output);
 out:
        if (!err) {
                ICMP6MSGOUT_INC_STATS_BH(net, idev, ICMPV6_MLD2_REPORT);
                ICMP6_INC_STATS_BH(net, idev, ICMP6_MIB_OUTMSGS);
-                IP6_INC_STATS_BH(net, idev, IPSTATS_MIB_OUTMCASTPKTS);
+                IP6_UPD_PO_STATS_BH(net, idev, IPSTATS_MIB_OUTMCAST, payload_len);
        } else
                IP6_INC_STATS_BH(net, idev, IPSTATS_MIB_OUTDISCARDS);
@@ -1773,10 +1776,6 @@ static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type)
                     IPV6_TLV_PADN, 0 };
        struct flowi fl;
-        rcu_read_lock();
-        IP6_INC_STATS(net, __in6_dev_get(dev),
-                      IPSTATS_MIB_OUTREQUESTS);
-        rcu_read_unlock();
        if (type == ICMPV6_MGM_REDUCTION)
                snd_addr = &in6addr_linklocal_allrouters;
        else
@@ -1786,6 +1785,11 @@ static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type)
        payload_len = len + sizeof(ra);
        full_len = sizeof(struct ipv6hdr) + payload_len;
+        rcu_read_lock();
+        IP6_UPD_PO_STATS(net, __in6_dev_get(dev),
+                      IPSTATS_MIB_OUT, full_len);
+        rcu_read_unlock();
        skb = sock_alloc_send_skb(sk, LL_ALLOCATED_SPACE(dev) + full_len, 1, &err);
        if (skb == NULL) {
@@ -1838,13 +1842,14 @@ static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type)
        if (err)
                goto err_out;
        err = NF_HOOK(PF_INET6, NF_INET_LOCAL_OUT, skb, NULL, skb->dev,
                      dst_output);
 out:
        if (!err) {
                ICMP6MSGOUT_INC_STATS(net, idev, type);
                ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTMSGS);
-                IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTMCASTPKTS);
+                IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUTMCAST, full_len);
        } else
                IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTDISCARDS);
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 9f061d1adbc2..ab65cc51b00e 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -533,7 +533,7 @@ void ndisc_send_skb(struct sk_buff *skb,
        skb->dst = dst;
        idev = in6_dev_get(dst->dev);
-        IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTREQUESTS);
+        IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUT, skb->len);
        err = NF_HOOK(PF_INET6, NF_INET_LOCAL_OUT, skb, NULL, dst->dev,
                      dst_output);
@@ -1613,7 +1613,7 @@ void ndisc_send_redirect(struct sk_buff *skb, struct neighbour *neigh,
        buff->dst = dst;
        idev = in6_dev_get(dst->dev);
-        IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTREQUESTS);
+        IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUT, skb->len);
        err = NF_HOOK(PF_INET6, NF_INET_LOCAL_OUT, buff, NULL, dst->dev,
                      dst_output);
        if (!err) {
diff --git a/net/ipv6/proc.c b/net/ipv6/proc.c
index 97c17fdd6f75..590ddefb7ffc 100644
--- a/net/ipv6/proc.c
+++ b/net/ipv6/proc.c
@@ -61,7 +61,7 @@ static const struct file_operations sockstat6_seq_fops = {
 static struct snmp_mib snmp6_ipstats_list[] = {
 /* ipv6 mib according to RFC 2465 */
-        SNMP_MIB_ITEM("Ip6InReceives", IPSTATS_MIB_INRECEIVES),
+        SNMP_MIB_ITEM("Ip6InReceives", IPSTATS_MIB_INPKTS),
        SNMP_MIB_ITEM("Ip6InHdrErrors", IPSTATS_MIB_INHDRERRORS),
        SNMP_MIB_ITEM("Ip6InTooBigErrors", IPSTATS_MIB_INTOOBIGERRORS),
        SNMP_MIB_ITEM("Ip6InNoRoutes", IPSTATS_MIB_INNOROUTES),
@@ -71,7 +71,7 @@ static struct snmp_mib snmp6_ipstats_list[] = {
        SNMP_MIB_ITEM("Ip6InDiscards", IPSTATS_MIB_INDISCARDS),
        SNMP_MIB_ITEM("Ip6InDelivers", IPSTATS_MIB_INDELIVERS),
        SNMP_MIB_ITEM("Ip6OutForwDatagrams", IPSTATS_MIB_OUTFORWDATAGRAMS),
-        SNMP_MIB_ITEM("Ip6OutRequests", IPSTATS_MIB_OUTREQUESTS),
+        SNMP_MIB_ITEM("Ip6OutRequests", IPSTATS_MIB_OUTPKTS),
        SNMP_MIB_ITEM("Ip6OutDiscards", IPSTATS_MIB_OUTDISCARDS),
        SNMP_MIB_ITEM("Ip6OutNoRoutes", IPSTATS_MIB_OUTNOROUTES),
        SNMP_MIB_ITEM("Ip6ReasmTimeout", IPSTATS_MIB_REASMTIMEOUT),
@@ -83,6 +83,12 @@ static struct snmp_mib snmp6_ipstats_list[] = {
        SNMP_MIB_ITEM("Ip6FragCreates", IPSTATS_MIB_FRAGCREATES),
        SNMP_MIB_ITEM("Ip6InMcastPkts", IPSTATS_MIB_INMCASTPKTS),
        SNMP_MIB_ITEM("Ip6OutMcastPkts", IPSTATS_MIB_OUTMCASTPKTS),
+        SNMP_MIB_ITEM("Ip6InOctets", IPSTATS_MIB_INOCTETS),
+        SNMP_MIB_ITEM("Ip6OutOctets", IPSTATS_MIB_OUTOCTETS),
+        SNMP_MIB_ITEM("Ip6InMcastOctets", IPSTATS_MIB_INMCASTOCTETS),
+        SNMP_MIB_ITEM("Ip6OutMcastOctets", IPSTATS_MIB_OUTMCASTOCTETS),
+        SNMP_MIB_ITEM("Ip6InBcastOctets", IPSTATS_MIB_INBCASTOCTETS),
+        SNMP_MIB_ITEM("Ip6OutBcastOctets", IPSTATS_MIB_OUTBCASTOCTETS),
        SNMP_MIB_SENTINEL
 };
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 61f6827e5906..e99307fba0b1 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -638,7 +638,7 @@ static int rawv6_send_hdrinc(struct sock *sk, void *from, int length,
        if (err)
                goto error_fault;
-        IP6_INC_STATS(sock_net(sk), rt->rt6i_idev, IPSTATS_MIB_OUTREQUESTS);
+        IP6_UPD_PO_STATS(sock_net(sk), rt->rt6i_idev, IPSTATS_MIB_OUT, skb->len);
        err = NF_HOOK(PF_INET6, NF_INET_LOCAL_OUT, skb, NULL, rt->u.dst.dev,
                      dst_output);
        if (err > 0)
diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c
index 711175e0571f..8c2513982b61 100644
--- a/net/ipv6/syncookies.c
+++ b/net/ipv6/syncookies.c
@@ -131,7 +131,7 @@ __u32 cookie_v6_init_sequence(struct sock *sk, struct sk_buff *skb, __u16 *mssp)
        int mssind;
        const __u16 mss = *mssp;
-        tcp_sk(sk)->last_synq_overflow = jiffies;
+        tcp_synq_overflow(sk);
        for (mssind = 0; mss > msstab[mssind + 1]; mssind++)
                ;
@@ -175,7 +175,7 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
        if (!sysctl_tcp_syncookies || !th->ack)
                goto out;
-        if (time_after(jiffies, tp->last_synq_overflow + TCP_TIMEOUT_INIT) ||
+        if (tcp_synq_no_recent_overflow(sk) ||
                (mss = cookie_check(skb, cookie)) == 0) {
                NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_SYNCOOKIESFAILED);
                goto out;
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 4b5aa1854260..d9dd94b6bf66 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -943,7 +943,7 @@ static int tcp_v6_gso_send_check(struct sk_buff *skb)
 struct sk_buff **tcp6_gro_receive(struct sk_buff **head, struct sk_buff *skb)
 {
-        struct ipv6hdr *iph = ipv6_hdr(skb);
+        struct ipv6hdr *iph = skb_gro_network_header(skb);
        switch (skb->ip_summed) {
        case CHECKSUM_COMPLETE:
diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
index b51c9187c347..a9b3a6f9ea95 100644
--- a/net/iucv/af_iucv.c
+++ b/net/iucv/af_iucv.c
@@ -29,10 +29,7 @@
 #include <net/iucv/iucv.h>
 #include <net/iucv/af_iucv.h>
-#define CONFIG_IUCV_SOCK_DEBUG 1
+#define VERSION "1.1"
-#define IPRMDATA 0x80
-#define VERSION "1.0"
 static char iucv_userid[80];
@@ -44,6 +41,19 @@ static struct proto iucv_proto = {
        .obj_size       = sizeof(struct iucv_sock),
 };
+/* special AF_IUCV IPRM messages */
+static const u8 iprm_shutdown[8] =
+        {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01};
+#define TRGCLS_SIZE     (sizeof(((struct iucv_message *)0)->class))
+/* macros to set/get socket control buffer at correct offset */
+#define CB_TAG(skb)     ((skb)->cb)             /* iucv message tag */
+#define CB_TAG_LEN      (sizeof(((struct iucv_message *) 0)->tag))
+#define CB_TRGCLS(skb)  ((skb)->cb + CB_TAG_LEN) /* iucv msg target class */
+#define CB_TRGCLS_LEN   (TRGCLS_SIZE)
 static void iucv_sock_kill(struct sock *sk);
 static void iucv_sock_close(struct sock *sk);
@@ -54,6 +64,7 @@ static void iucv_callback_connack(struct iucv_path *, u8 ipuser[16]);
 static int iucv_callback_connreq(struct iucv_path *, u8 ipvmid[8],
                                 u8 ipuser[16]);
 static void iucv_callback_connrej(struct iucv_path *, u8 ipuser[16]);
+static void iucv_callback_shutdown(struct iucv_path *, u8 ipuser[16]);
 static struct iucv_sock_list iucv_sk_list = {
        .lock = __RW_LOCK_UNLOCKED(iucv_sk_list.lock),
@@ -65,7 +76,8 @@ static struct iucv_handler af_iucv_handler = {
        .path_complete    = iucv_callback_connack,
        .path_severed     = iucv_callback_connrej,
        .message_pending  = iucv_callback_rx,
-        .message_complete = iucv_callback_txdone
+        .message_complete = iucv_callback_txdone,
+        .path_quiesced    = iucv_callback_shutdown,
 };
 static inline void high_nmcpy(unsigned char *dst, char *src)
@@ -78,6 +90,37 @@ static inline void low_nmcpy(unsigned char *dst, char *src)
       memcpy(&dst[8], src, 8);
 }
+/**
+ * iucv_msg_length() - Returns the length of an iucv message.
+ * @msg:        Pointer to struct iucv_message, MUST NOT be NULL
+ *
+ * The function returns the length of the specified iucv message @msg of data
+ * stored in a buffer and of data stored in the parameter list (PRMDATA).
+ *
+ * For IUCV_IPRMDATA, AF_IUCV uses the following convention to transport socket
+ * data:
+ *      PRMDATA[0..6]   socket data (max 7 bytes);
+ *      PRMDATA[7]      socket data length value (len is 0xff - PRMDATA[7])
+ *
+ * The socket data length is computed by substracting the socket data length
+ * value from 0xFF.
+ * If the socket data len is greater 7, then PRMDATA can be used for special
+ * notifications (see iucv_sock_shutdown); and further,
+ * if the socket data len is > 7, the function returns 8.
+ *
+ * Use this function to allocate socket buffers to store iucv message data.
+ */
+static inline size_t iucv_msg_length(struct iucv_message *msg)
+{
+        size_t datalen;
+        if (msg->flags & IUCV_IPRMDATA) {
+                datalen = 0xff - msg->rmmsg[7];
+                return (datalen < 8) ? datalen : 8;
+        }
+        return msg->length;
+}
 /* Timers */
 static void iucv_sock_timeout(unsigned long arg)
 {
@@ -225,6 +268,8 @@ static struct sock *iucv_sock_alloc(struct socket *sock, int proto, gfp_t prio)
        spin_lock_init(&iucv_sk(sk)->message_q.lock);
        skb_queue_head_init(&iucv_sk(sk)->backlog_skb_q);
        iucv_sk(sk)->send_tag = 0;
+        iucv_sk(sk)->flags = 0;
+        iucv_sk(sk)->msglimit = IUCV_QUEUELEN_DEFAULT;
        iucv_sk(sk)->path = NULL;
        memset(&iucv_sk(sk)->src_user_id , 0, 32);
@@ -248,11 +293,22 @@ static int iucv_sock_create(struct net *net, struct socket *sock, int protocol)
 {
        struct sock *sk;
-        if (sock->type != SOCK_STREAM)
+        if (protocol && protocol != PF_IUCV)
-                return -ESOCKTNOSUPPORT;
+                return -EPROTONOSUPPORT;
        sock->state = SS_UNCONNECTED;
-        sock->ops = &iucv_sock_ops;
+        switch (sock->type) {
+        case SOCK_STREAM:
+                sock->ops = &iucv_sock_ops;
+                break;
+        case SOCK_SEQPACKET:
+                /* currently, proto ops can handle both sk types */
+                sock->ops = &iucv_sock_ops;
+                break;
+        default:
+                return -ESOCKTNOSUPPORT;
+        }
        sk = iucv_sock_alloc(sock, protocol, GFP_KERNEL);
        if (!sk)
@@ -463,11 +519,9 @@ static int iucv_sock_connect(struct socket *sock, struct sockaddr *addr,
        if (sk->sk_state != IUCV_OPEN && sk->sk_state != IUCV_BOUND)
                return -EBADFD;
-        if (sk->sk_type != SOCK_STREAM)
+        if (sk->sk_type != SOCK_STREAM && sk->sk_type != SOCK_SEQPACKET)
                return -EINVAL;
-        iucv = iucv_sk(sk);
        if (sk->sk_state == IUCV_OPEN) {
                err = iucv_sock_autobind(sk);
                if (unlikely(err))
@@ -486,8 +540,8 @@ static int iucv_sock_connect(struct socket *sock, struct sockaddr *addr,
        iucv = iucv_sk(sk);
        /* Create path. */
-        iucv->path = iucv_path_alloc(IUCV_QUEUELEN_DEFAULT,
+        iucv->path = iucv_path_alloc(iucv->msglimit,
-                                     IPRMDATA, GFP_KERNEL);
+                                     IUCV_IPRMDATA, GFP_KERNEL);
        if (!iucv->path) {
                err = -ENOMEM;
                goto done;
@@ -521,8 +575,7 @@ static int iucv_sock_connect(struct socket *sock, struct sockaddr *addr,
        }
        if (sk->sk_state == IUCV_DISCONN) {
-                release_sock(sk);
+                err = -ECONNREFUSED;
-                return -ECONNREFUSED;
        }
        if (err) {
@@ -545,7 +598,10 @@ static int iucv_sock_listen(struct socket *sock, int backlog)
        lock_sock(sk);
        err = -EINVAL;
-        if (sk->sk_state != IUCV_BOUND || sock->type != SOCK_STREAM)
+        if (sk->sk_state != IUCV_BOUND)
+                goto done;
+        if (sock->type != SOCK_STREAM && sock->type != SOCK_SEQPACKET)
                goto done;
        sk->sk_max_ack_backlog = backlog;
@@ -636,6 +692,30 @@ static int iucv_sock_getname(struct socket *sock, struct sockaddr *addr,
        return 0;
 }
+/**
+ * iucv_send_iprm() - Send socket data in parameter list of an iucv message.
+ * @path:       IUCV path
+ * @msg:        Pointer to a struct iucv_message
+ * @skb:        The socket data to send, skb->len MUST BE <= 7
+ *
+ * Send the socket data in the parameter list in the iucv message
+ * (IUCV_IPRMDATA). The socket data is stored at index 0 to 6 in the parameter
+ * list and the socket data len at index 7 (last byte).
+ * See also iucv_msg_length().
+ *
+ * Returns the error code from the iucv_message_send() call.
+ */
+static int iucv_send_iprm(struct iucv_path *path, struct iucv_message *msg,
+                          struct sk_buff *skb)
+{
+        u8 prmdata[8];
+        memcpy(prmdata, (void *) skb->data, skb->len);
+        prmdata[7] = 0xff - (u8) skb->len;
+        return iucv_message_send(path, msg, IUCV_IPRMDATA, 0,
+                                 (void *) prmdata, 8);
+}
 static int iucv_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
                             struct msghdr *msg, size_t len)
 {
@@ -643,6 +723,8 @@ static int iucv_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
        struct iucv_sock *iucv = iucv_sk(sk);
        struct sk_buff *skb;
        struct iucv_message txmsg;
+        struct cmsghdr *cmsg;
+        int cmsg_done;
        char user_id[9];
        char appl_id[9];
        int err;
@@ -654,6 +736,10 @@ static int iucv_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
        if (msg->msg_flags & MSG_OOB)
                return -EOPNOTSUPP;
+        /* SOCK_SEQPACKET: we do not support segmented records */
+        if (sk->sk_type == SOCK_SEQPACKET && !(msg->msg_flags & MSG_EOR))
+                return -EOPNOTSUPP;
        lock_sock(sk);
        if (sk->sk_shutdown & SEND_SHUTDOWN) {
@@ -662,6 +748,52 @@ static int iucv_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
        }
        if (sk->sk_state == IUCV_CONNECTED) {
+                /* initialize defaults */
+                cmsg_done   = 0;        /* check for duplicate headers */
+                txmsg.class = 0;
+                /* iterate over control messages */
+                for (cmsg = CMSG_FIRSTHDR(msg); cmsg;
+                     cmsg = CMSG_NXTHDR(msg, cmsg)) {
+                        if (!CMSG_OK(msg, cmsg)) {
+                                err = -EINVAL;
+                                goto out;
+                        }
+                        if (cmsg->cmsg_level != SOL_IUCV)
+                                continue;
+                        if (cmsg->cmsg_type & cmsg_done) {
+                                err = -EINVAL;
+                                goto out;
+                        }
+                        cmsg_done |= cmsg->cmsg_type;
+                        switch (cmsg->cmsg_type) {
+                        case SCM_IUCV_TRGCLS:
+                                if (cmsg->cmsg_len != CMSG_LEN(TRGCLS_SIZE)) {
+                                        err = -EINVAL;
+                                        goto out;
+                                }
+                                /* set iucv message target class */
+                                memcpy(&txmsg.class,
+                                        (void *) CMSG_DATA(cmsg), TRGCLS_SIZE);
+                                break;
+                        default:
+                                err = -EINVAL;
+                                goto out;
+                                break;
+                        }
+                }
+                /* allocate one skb for each iucv message:
+                 * this is fine for SOCK_SEQPACKET (unless we want to support
+                 * segmented records using the MSG_EOR flag), but
+                 * for SOCK_STREAM we might want to improve it in future */
                if (!(skb = sock_alloc_send_skb(sk, len,
                                                msg->msg_flags & MSG_DONTWAIT,
                                                &err)))
@@ -672,13 +804,33 @@ static int iucv_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
                        goto fail;
                }
-                txmsg.class = 0;
+                /* increment and save iucv message tag for msg_completion cbk */
-                memcpy(&txmsg.class, skb->data, skb->len >= 4 ? 4 : skb->len);
                txmsg.tag = iucv->send_tag++;
-                memcpy(skb->cb, &txmsg.tag, 4);
+                memcpy(CB_TAG(skb), &txmsg.tag, CB_TAG_LEN);
                skb_queue_tail(&iucv->send_skb_q, skb);
-                err = iucv_message_send(iucv->path, &txmsg, 0, 0,
-                                        (void *) skb->data, skb->len);
+                if (((iucv->path->flags & IUCV_IPRMDATA) & iucv->flags)
+                    && skb->len <= 7) {
+                        err = iucv_send_iprm(iucv->path, &txmsg, skb);
+                        /* on success: there is no message_complete callback
+                         * for an IPRMDATA msg; remove skb from send queue */
+                        if (err == 0) {
+                                skb_unlink(skb, &iucv->send_skb_q);
+                                kfree_skb(skb);
+                        }
+                        /* this error should never happen since the
+                         * IUCV_IPRMDATA path flag is set... sever path */
+                        if (err == 0x15) {
+                                iucv_path_sever(iucv->path, NULL);
+                                skb_unlink(skb, &iucv->send_skb_q);
+                                err = -EPIPE;
+                                goto fail;
+                        }
+                } else
+                        err = iucv_message_send(iucv->path, &txmsg, 0, 0,
+                                                (void *) skb->data, skb->len);
                if (err) {
                        if (err == 3) {
                                user_id[8] = 0;
@@ -725,6 +877,10 @@ static int iucv_fragment_skb(struct sock *sk, struct sk_buff *skb, int len)
                if (!nskb)
                        return -ENOMEM;
+                /* copy target class to control buffer of new skb */
+                memcpy(CB_TRGCLS(nskb), CB_TRGCLS(skb), CB_TRGCLS_LEN);
+                /* copy data fragment */
                memcpy(nskb->data, skb->data + copied, size);
                copied += size;
                dataleft -= size;
@@ -744,19 +900,33 @@ static void iucv_process_message(struct sock *sk, struct sk_buff *skb,
                                 struct iucv_message *msg)
 {
        int rc;
+        unsigned int len;
+        len = iucv_msg_length(msg);
-        if (msg->flags & IPRMDATA) {
+        /* store msg target class in the second 4 bytes of skb ctrl buffer */
-                skb->data = NULL;
+        /* Note: the first 4 bytes are reserved for msg tag */
-                skb->len = 0;
+        memcpy(CB_TRGCLS(skb), &msg->class, CB_TRGCLS_LEN);
+        /* check for special IPRM messages (e.g. iucv_sock_shutdown) */
+        if ((msg->flags & IUCV_IPRMDATA) && len > 7) {
+                if (memcmp(msg->rmmsg, iprm_shutdown, 8) == 0) {
+                        skb->data = NULL;
+                        skb->len = 0;
+                }
        } else {
-                rc = iucv_message_receive(path, msg, 0, skb->data,
+                rc = iucv_message_receive(path, msg, msg->flags & IUCV_IPRMDATA,
-                                          msg->length, NULL);
+                                          skb->data, len, NULL);
                if (rc) {
                        kfree_skb(skb);
                        return;
                }
-                if (skb->truesize >= sk->sk_rcvbuf / 4) {
+                /* we need to fragment iucv messages for SOCK_STREAM only;
-                        rc = iucv_fragment_skb(sk, skb, msg->length);
+                 * for SOCK_SEQPACKET, it is only relevant if we support
+                 * record segmentation using MSG_EOR (see also recvmsg()) */
+                if (sk->sk_type == SOCK_STREAM &&
+                    skb->truesize >= sk->sk_rcvbuf / 4) {
+                        rc = iucv_fragment_skb(sk, skb, len);
                        kfree_skb(skb);
                        skb = NULL;
                        if (rc) {
@@ -767,7 +937,7 @@ static void iucv_process_message(struct sock *sk, struct sk_buff *skb,
                } else {
                        skb_reset_transport_header(skb);
                        skb_reset_network_header(skb);
-                        skb->len = msg->length;
+                        skb->len = len;
                }
        }
@@ -782,7 +952,7 @@ static void iucv_process_message_q(struct sock *sk)
        struct sock_msg_q *p, *n;
        list_for_each_entry_safe(p, n, &iucv->message_q.list, list) {
-                skb = alloc_skb(p->msg.length, GFP_ATOMIC | GFP_DMA);
+                skb = alloc_skb(iucv_msg_length(&p->msg), GFP_ATOMIC | GFP_DMA);
                if (!skb)
                        break;
                iucv_process_message(sk, skb, p->path, &p->msg);
@@ -799,7 +969,7 @@ static int iucv_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
        int noblock = flags & MSG_DONTWAIT;
        struct sock *sk = sock->sk;
        struct iucv_sock *iucv = iucv_sk(sk);
-        int target, copied = 0;
+        unsigned int copied, rlen;
        struct sk_buff *skb, *rskb, *cskb;
        int err = 0;
@@ -812,8 +982,6 @@ static int iucv_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
        if (flags & (MSG_OOB))
                return -EOPNOTSUPP;
-        target = sock_rcvlowat(sk, flags & MSG_WAITALL, len);
        /* receive/dequeue next skb:
         * the function understands MSG_PEEK and, thus, does not dequeue skb */
        skb = skb_recv_datagram(sk, flags, noblock, &err);
@@ -823,25 +991,45 @@ static int iucv_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
                return err;
        }
-        copied = min_t(unsigned int, skb->len, len);
+        rlen   = skb->len;              /* real length of skb */
+        copied = min_t(unsigned int, rlen, len);
        cskb = skb;
        if (memcpy_toiovec(msg->msg_iov, cskb->data, copied)) {
-                skb_queue_head(&sk->sk_receive_queue, skb);
+                if (!(flags & MSG_PEEK))
-                if (copied == 0)
+                        skb_queue_head(&sk->sk_receive_queue, skb);
-                        return -EFAULT;
+                return -EFAULT;
-                goto done;
        }
-        len -= copied;
+        /* SOCK_SEQPACKET: set MSG_TRUNC if recv buf size is too small */
+        if (sk->sk_type == SOCK_SEQPACKET) {
+                if (copied < rlen)
+                        msg->msg_flags |= MSG_TRUNC;
+                /* each iucv message contains a complete record */
+                msg->msg_flags |= MSG_EOR;
+        }
+        /* create control message to store iucv msg target class:
+         * get the trgcls from the control buffer of the skb due to
+         * fragmentation of original iucv message. */
+        err = put_cmsg(msg, SOL_IUCV, SCM_IUCV_TRGCLS,
+                        CB_TRGCLS_LEN, CB_TRGCLS(skb));
+        if (err) {
+                if (!(flags & MSG_PEEK))
+                        skb_queue_head(&sk->sk_receive_queue, skb);
+                return err;
+        }
        /* Mark read part of skb as used */
        if (!(flags & MSG_PEEK)) {
-                skb_pull(skb, copied);
-                if (skb->len) {
+                /* SOCK_STREAM: re-queue skb if it contains unreceived data */
-                        skb_queue_head(&sk->sk_receive_queue, skb);
+                if (sk->sk_type == SOCK_STREAM) {
-                        goto done;
+                        skb_pull(skb, copied);
+                        if (skb->len) {
+                                skb_queue_head(&sk->sk_receive_queue, skb);
+                                goto done;
+                        }
                }
                kfree_skb(skb);
@@ -866,7 +1054,11 @@ static int iucv_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
        }
 done:
-        return err ? : copied;
+        /* SOCK_SEQPACKET: return real length if MSG_TRUNC is set */
+        if (sk->sk_type == SOCK_SEQPACKET && (flags & MSG_TRUNC))
+                copied = rlen;
+        return copied;
 }
 static inline unsigned int iucv_accept_poll(struct sock *parent)
@@ -928,7 +1120,6 @@ static int iucv_sock_shutdown(struct socket *sock, int how)
        struct iucv_sock *iucv = iucv_sk(sk);
        struct iucv_message txmsg;
        int err = 0;
-        u8 prmmsg[8] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01};
        how++;
@@ -953,7 +1144,7 @@ static int iucv_sock_shutdown(struct socket *sock, int how)
                txmsg.class = 0;
                txmsg.tag = 0;
                err = iucv_message_send(iucv->path, &txmsg, IUCV_IPRMDATA, 0,
-                                        (void *) prmmsg, 8);
+                                        (void *) iprm_shutdown, 8);
                if (err) {
                        switch (err) {
                        case 1:
@@ -1007,6 +1198,98 @@ static int iucv_sock_release(struct socket *sock)
        return err;
 }
+/* getsockopt and setsockopt */
+static int iucv_sock_setsockopt(struct socket *sock, int level, int optname,
+                                char __user *optval, int optlen)
+{
+        struct sock *sk = sock->sk;
+        struct iucv_sock *iucv = iucv_sk(sk);
+        int val;
+        int rc;
+        if (level != SOL_IUCV)
+                return -ENOPROTOOPT;
+        if (optlen < sizeof(int))
+                return -EINVAL;
+        if (get_user(val, (int __user *) optval))
+                return -EFAULT;
+        rc = 0;
+        lock_sock(sk);
+        switch (optname) {
+        case SO_IPRMDATA_MSG:
+                if (val)
+                        iucv->flags |= IUCV_IPRMDATA;
+                else
+                        iucv->flags &= ~IUCV_IPRMDATA;
+                break;
+        case SO_MSGLIMIT:
+                switch (sk->sk_state) {
+                case IUCV_OPEN:
+                case IUCV_BOUND:
+                        if (val < 1 || val > (u16)(~0))
+                                rc = -EINVAL;
+                        else
+                                iucv->msglimit = val;
+                        break;
+                default:
+                        rc = -EINVAL;
+                        break;
+                }
+                break;
+        default:
+                rc = -ENOPROTOOPT;
+                break;
+        }
+        release_sock(sk);
+        return rc;
+}
+static int iucv_sock_getsockopt(struct socket *sock, int level, int optname,
+                                char __user *optval, int __user *optlen)
+{
+        struct sock *sk = sock->sk;
+        struct iucv_sock *iucv = iucv_sk(sk);
+        int val, len;
+        if (level != SOL_IUCV)
+                return -ENOPROTOOPT;
+        if (get_user(len, optlen))
+                return -EFAULT;
+        if (len < 0)
+                return -EINVAL;
+        len = min_t(unsigned int, len, sizeof(int));
+        switch (optname) {
+        case SO_IPRMDATA_MSG:
+                val = (iucv->flags & IUCV_IPRMDATA) ? 1 : 0;
+                break;
+        case SO_MSGLIMIT:
+                lock_sock(sk);
+                val = (iucv->path != NULL) ? iucv->path->msglim /* connected */
+                                           : iucv->msglimit;    /* default */
+                release_sock(sk);
+                break;
+        default:
+                return -ENOPROTOOPT;
+        }
+        if (put_user(len, optlen))
+                return -EFAULT;
+        if (copy_to_user(optval, &val, len))
+                return -EFAULT;
+        return 0;
+}
 /* Callback wrappers - called from iucv base support */
 static int iucv_callback_connreq(struct iucv_path *path,
                                 u8 ipvmid[8], u8 ipuser[16])
@@ -1060,7 +1343,7 @@ static int iucv_callback_connreq(struct iucv_path *path,
        }
        /* Create the new socket */
-        nsk = iucv_sock_alloc(NULL, SOCK_STREAM, GFP_ATOMIC);
+        nsk = iucv_sock_alloc(NULL, sk->sk_type, GFP_ATOMIC);
        if (!nsk) {
                err = iucv_path_sever(path, user_data);
                iucv_path_free(path);
@@ -1083,7 +1366,9 @@ static int iucv_callback_connreq(struct iucv_path *path,
        memcpy(nuser_data + 8, niucv->src_name, 8);
        ASCEBC(nuser_data + 8, 8);
-        path->msglim = IUCV_QUEUELEN_DEFAULT;
+        /* set message limit for path based on msglimit of accepting socket */
+        niucv->msglimit = iucv->msglimit;
+        path->msglim = iucv->msglimit;
        err = iucv_path_accept(path, &af_iucv_handler, nuser_data, nsk);
        if (err) {
                err = iucv_path_sever(path, user_data);
@@ -1131,19 +1416,17 @@ static void iucv_callback_rx(struct iucv_path *path, struct iucv_message *msg)
                goto save_message;
        len = atomic_read(&sk->sk_rmem_alloc);
-        len += msg->length + sizeof(struct sk_buff);
+        len += iucv_msg_length(msg) + sizeof(struct sk_buff);
        if (len > sk->sk_rcvbuf)
                goto save_message;
-        skb = alloc_skb(msg->length, GFP_ATOMIC | GFP_DMA);
+        skb = alloc_skb(iucv_msg_length(msg), GFP_ATOMIC | GFP_DMA);
        if (!skb)
                goto save_message;
        iucv_process_message(sk, skb, path, msg);
        goto out_unlock;
-        return;
 save_message:
        save_msg = kzalloc(sizeof(struct sock_msg_q), GFP_ATOMIC | GFP_DMA);
        if (!save_msg)
@@ -1170,7 +1453,7 @@ static void iucv_callback_txdone(struct iucv_path *path,
                spin_lock_irqsave(&list->lock, flags);
                while (list_skb != (struct sk_buff *)list) {
-                        if (!memcmp(&msg->tag, list_skb->cb, 4)) {
+                        if (!memcmp(&msg->tag, CB_TAG(list_skb), CB_TAG_LEN)) {
                                this = list_skb;
                                break;
                        }
@@ -1206,6 +1489,21 @@ static void iucv_callback_connrej(struct iucv_path *path, u8 ipuser[16])
        sk->sk_state_change(sk);
 }
+/* called if the other communication side shuts down its RECV direction;
+ * in turn, the callback sets SEND_SHUTDOWN to disable sending of data.
+ */
+static void iucv_callback_shutdown(struct iucv_path *path, u8 ipuser[16])
+{
+        struct sock *sk = path->private;
+        bh_lock_sock(sk);
+        if (sk->sk_state != IUCV_CLOSED) {
+                sk->sk_shutdown |= SEND_SHUTDOWN;
+                sk->sk_state_change(sk);
+        }
+        bh_unlock_sock(sk);
+}
 static struct proto_ops iucv_sock_ops = {
        .family         = PF_IUCV,
        .owner          = THIS_MODULE,
@@ -1222,8 +1520,8 @@ static struct proto_ops iucv_sock_ops = {
        .mmap           = sock_no_mmap,
        .socketpair     = sock_no_socketpair,
        .shutdown       = iucv_sock_shutdown,
-        .setsockopt     = sock_no_setsockopt,
+        .setsockopt     = iucv_sock_setsockopt,
-        .getsockopt     = sock_no_getsockopt
+        .getsockopt     = iucv_sock_getsockopt,
 };
 static struct net_proto_family iucv_sock_family_ops = {
diff --git a/net/iucv/iucv.c b/net/iucv/iucv.c
index a35240f61ec3..61e8038a55ee 100644
--- a/net/iucv/iucv.c
+++ b/net/iucv/iucv.c
@@ -280,6 +280,7 @@ union iucv_param {
 * Anchor for per-cpu IUCV command parameter block.
 */
 static union iucv_param *iucv_param[NR_CPUS];
+static union iucv_param *iucv_param_irq[NR_CPUS];
 /**
 * iucv_call_b2f0
@@ -358,7 +359,7 @@ static void iucv_allow_cpu(void *data)
         *      0x10 - Flag to allow priority message completion interrupts
         *      0x08 - Flag to allow IUCV control interrupts
         */
-        parm = iucv_param[cpu];
+        parm = iucv_param_irq[cpu];
        memset(parm, 0, sizeof(union iucv_param));
        parm->set_mask.ipmask = 0xf8;
        iucv_call_b2f0(IUCV_SETMASK, parm);
@@ -379,7 +380,7 @@ static void iucv_block_cpu(void *data)
        union iucv_param *parm;
        /* Disable all iucv interrupts. */
-        parm = iucv_param[cpu];
+        parm = iucv_param_irq[cpu];
        memset(parm, 0, sizeof(union iucv_param));
        iucv_call_b2f0(IUCV_SETMASK, parm);
@@ -403,7 +404,7 @@ static void iucv_declare_cpu(void *data)
                return;
        /* Declare interrupt buffer. */
-        parm = iucv_param[cpu];
+        parm = iucv_param_irq[cpu];
        memset(parm, 0, sizeof(union iucv_param));
        parm->db.ipbfadr1 = virt_to_phys(iucv_irq_data[cpu]);
        rc = iucv_call_b2f0(IUCV_DECLARE_BUFFER, parm);
@@ -460,7 +461,7 @@ static void iucv_retrieve_cpu(void *data)
        iucv_block_cpu(NULL);
        /* Retrieve interrupt buffer. */
-        parm = iucv_param[cpu];
+        parm = iucv_param_irq[cpu];
        iucv_call_b2f0(IUCV_RETRIEVE_BUFFER, parm);
        /* Clear indication that an iucv buffer exists for this cpu. */
@@ -574,11 +575,22 @@ static int __cpuinit iucv_cpu_notify(struct notifier_block *self,
                        iucv_irq_data[cpu] = NULL;
                        return NOTIFY_BAD;
                }
+                iucv_param_irq[cpu] = kmalloc_node(sizeof(union iucv_param),
+                                        GFP_KERNEL|GFP_DMA, cpu_to_node(cpu));
+                if (!iucv_param_irq[cpu]) {
+                        kfree(iucv_param[cpu]);
+                        iucv_param[cpu] = NULL;
+                        kfree(iucv_irq_data[cpu]);
+                        iucv_irq_data[cpu] = NULL;
+                        return NOTIFY_BAD;
+                }
                break;
        case CPU_UP_CANCELED:
        case CPU_UP_CANCELED_FROZEN:
        case CPU_DEAD:
        case CPU_DEAD_FROZEN:
+                kfree(iucv_param_irq[cpu]);
+                iucv_param_irq[cpu] = NULL;
                kfree(iucv_param[cpu]);
                iucv_param[cpu] = NULL;
                kfree(iucv_irq_data[cpu]);
@@ -625,7 +637,7 @@ static int iucv_sever_pathid(u16 pathid, u8 userdata[16])
 {
        union iucv_param *parm;
-        parm = iucv_param[smp_processor_id()];
+        parm = iucv_param_irq[smp_processor_id()];
        memset(parm, 0, sizeof(union iucv_param));
        if (userdata)
                memcpy(parm->ctrl.ipuser, userdata, sizeof(parm->ctrl.ipuser));
@@ -918,10 +930,8 @@ int iucv_path_sever(struct iucv_path *path, u8 userdata[16])
        if (iucv_active_cpu != smp_processor_id())
                spin_lock_bh(&iucv_table_lock);
        rc = iucv_sever_pathid(path->pathid, userdata);
-        if (!rc) {
+        iucv_path_table[path->pathid] = NULL;
-                iucv_path_table[path->pathid] = NULL;
+        list_del_init(&path->list);
-                list_del_init(&path->list);
-        }
        if (iucv_active_cpu != smp_processor_id())
                spin_unlock_bh(&iucv_table_lock);
        preempt_enable();
@@ -1378,6 +1388,8 @@ static void iucv_path_complete(struct iucv_irq_data *data)
        struct iucv_path_complete *ipc = (void *) data;
        struct iucv_path *path = iucv_path_table[ipc->ippathid];
+        if (path)
+                path->flags = ipc->ipflags1;
        if (path && path->handler && path->handler->path_complete)
                path->handler->path_complete(path, ipc->ipuser);
 }
@@ -1413,7 +1425,7 @@ static void iucv_path_severed(struct iucv_irq_data *data)
        else {
                iucv_sever_pathid(path->pathid, NULL);
                iucv_path_table[path->pathid] = NULL;
-                list_del_init(&path->list);
+                list_del(&path->list);
                iucv_path_free(path);
        }
 }
@@ -1717,6 +1729,13 @@ static int __init iucv_init(void)
                        rc = -ENOMEM;
                        goto out_free;
                }
+                iucv_param_irq[cpu] = kmalloc_node(sizeof(union iucv_param),
+                                  GFP_KERNEL|GFP_DMA, cpu_to_node(cpu));
+                if (!iucv_param_irq[cpu]) {
+                        rc = -ENOMEM;
+                        goto out_free;
+                }
        }
        rc = register_hotcpu_notifier(&iucv_cpu_notifier);
        if (rc)
@@ -1734,6 +1753,8 @@ out_cpu:
        unregister_hotcpu_notifier(&iucv_cpu_notifier);
 out_free:
        for_each_possible_cpu(cpu) {
+                kfree(iucv_param_irq[cpu]);
+                iucv_param_irq[cpu] = NULL;
                kfree(iucv_param[cpu]);
                iucv_param[cpu] = NULL;
                kfree(iucv_irq_data[cpu]);
@@ -1764,6 +1785,8 @@ static void __exit iucv_exit(void)
        spin_unlock_irq(&iucv_queue_lock);
        unregister_hotcpu_notifier(&iucv_cpu_notifier);
        for_each_possible_cpu(cpu) {
+                kfree(iucv_param_irq[cpu]);
+                iucv_param_irq[cpu] = NULL;
                kfree(iucv_param[cpu]);
                iucv_param[cpu] = NULL;
                kfree(iucv_irq_data[cpu]);
diff --git a/net/mac80211/Kconfig b/net/mac80211/Kconfig
index ecc3faf9f11a..9cbf545e95a2 100644
--- a/net/mac80211/Kconfig
+++ b/net/mac80211/Kconfig
@@ -11,6 +11,22 @@ config MAC80211
          This option enables the hardware independent IEEE 802.11
          networking stack.
+config MAC80211_DEFAULT_PS
+        bool "enable powersave by default"
+        depends on MAC80211
+        default y
+        help
+          This option enables powersave mode by default.
+          If this causes your applications to misbehave you should fix your
+          applications instead -- they need to register their network
+          latency requirement, see Documentation/power/pm_qos_interface.txt.
+config MAC80211_DEFAULT_PS_VALUE
+        int
+        default 1 if MAC80211_DEFAULT_PS
+        default 0
 menu "Rate control algorithm selection"
        depends on MAC80211 != n
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index e677b751d468..5e1c230744b5 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -1167,7 +1167,8 @@ static int ieee80211_scan(struct wiphy *wiphy,
        if (sdata->vif.type != NL80211_IFTYPE_STATION &&
            sdata->vif.type != NL80211_IFTYPE_ADHOC &&
-            sdata->vif.type != NL80211_IFTYPE_MESH_POINT)
+            sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
+            (sdata->vif.type != NL80211_IFTYPE_AP || sdata->u.ap.beacon))
                return -EOPNOTSUPP;
        return ieee80211_request_scan(sdata, req);
@@ -1267,25 +1268,62 @@ static int ieee80211_assoc(struct wiphy *wiphy, struct net_device *dev,
 static int ieee80211_deauth(struct wiphy *wiphy, struct net_device *dev,
                            struct cfg80211_deauth_request *req)
 {
-        struct ieee80211_sub_if_data *sdata;
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        /* TODO: req->ie */
+        /* TODO: req->ie, req->peer_addr */
        return ieee80211_sta_deauthenticate(sdata, req->reason_code);
 }
 static int ieee80211_disassoc(struct wiphy *wiphy, struct net_device *dev,
                              struct cfg80211_disassoc_request *req)
 {
-        struct ieee80211_sub_if_data *sdata;
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        /* TODO: req->ie */
+        /* TODO: req->ie, req->peer_addr */
        return ieee80211_sta_disassociate(sdata, req->reason_code);
 }
+static int ieee80211_join_ibss(struct wiphy *wiphy, struct net_device *dev,
+                               struct cfg80211_ibss_params *params)
+{
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        return ieee80211_ibss_join(sdata, params);
+}
+static int ieee80211_leave_ibss(struct wiphy *wiphy, struct net_device *dev)
+{
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        return ieee80211_ibss_leave(sdata);
+}
+static int ieee80211_set_wiphy_params(struct wiphy *wiphy, u32 changed)
+{
+        struct ieee80211_local *local = wiphy_priv(wiphy);
+        if (changed & WIPHY_PARAM_RTS_THRESHOLD) {
+                int err;
+                if (local->ops->set_rts_threshold) {
+                        err = local->ops->set_rts_threshold(
+                                local_to_hw(local), wiphy->rts_threshold);
+                        if (err)
+                                return err;
+                }
+        }
+        if (changed & WIPHY_PARAM_RETRY_SHORT)
+                local->hw.conf.short_frame_max_tx_count = wiphy->retry_short;
+        if (changed & WIPHY_PARAM_RETRY_LONG)
+                local->hw.conf.long_frame_max_tx_count = wiphy->retry_long;
+        if (changed &
+            (WIPHY_PARAM_RETRY_SHORT | WIPHY_PARAM_RETRY_LONG))
+                ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_RETRY_LIMITS);
+        return 0;
+}
 struct cfg80211_ops mac80211_config_ops = {
        .add_virtual_intf = ieee80211_add_iface,
        .del_virtual_intf = ieee80211_del_iface,
@@ -1322,4 +1360,7 @@ struct cfg80211_ops mac80211_config_ops = {
        .assoc = ieee80211_assoc,
        .deauth = ieee80211_deauth,
        .disassoc = ieee80211_disassoc,
+        .join_ibss = ieee80211_join_ibss,
+        .leave_ibss = ieee80211_leave_ibss,
+        .set_wiphy_params = ieee80211_set_wiphy_params,
 };
diff --git a/net/mac80211/debugfs.c b/net/mac80211/debugfs.c
index 210b9b6fecd2..5001328be46b 100644
--- a/net/mac80211/debugfs.c
+++ b/net/mac80211/debugfs.c
@@ -52,13 +52,13 @@ static const struct file_operations name## _ops = {			\
 DEBUGFS_READONLY_FILE(frequency, 20, "%d",
                      local->hw.conf.channel->center_freq);
 DEBUGFS_READONLY_FILE(rts_threshold, 20, "%d",
-                      local->rts_threshold);
+                      local->hw.wiphy->rts_threshold);
 DEBUGFS_READONLY_FILE(fragmentation_threshold, 20, "%d",
-                      local->fragmentation_threshold);
+                      local->hw.wiphy->frag_threshold);
 DEBUGFS_READONLY_FILE(short_retry_limit, 20, "%d",
-                      local->hw.conf.short_frame_max_tx_count);
+                      local->hw.wiphy->retry_short);
 DEBUGFS_READONLY_FILE(long_retry_limit, 20, "%d",
-                      local->hw.conf.long_frame_max_tx_count);
+                      local->hw.wiphy->retry_long);
 DEBUGFS_READONLY_FILE(total_ps_buffered, 20, "%d",
                      local->total_ps_buffered);
 DEBUGFS_READONLY_FILE(wep_iv, 20, "%#08x",
diff --git a/net/mac80211/event.c b/net/mac80211/event.c
index 0d95561c0ee0..f288d01a6344 100644
--- a/net/mac80211/event.c
+++ b/net/mac80211/event.c
@@ -12,12 +12,12 @@
 #include "ieee80211_i.h"
 /*
- * indicate a failed Michael MIC to userspace; the passed packet
+ * Indicate a failed Michael MIC to userspace. If the caller knows the TSC of
- * (in the variable hdr) must be long enough to extract the TKIP
+ * the frame that generated the MIC failure (i.e., if it was provided by the
- * fields like TSC
+ * driver or is still in the frame), it should provide that information.
 */
 void mac80211_ev_michael_mic_failure(struct ieee80211_sub_if_data *sdata, int keyidx,
-                                     struct ieee80211_hdr *hdr)
+                                     struct ieee80211_hdr *hdr, const u8 *tsc)
 {
        union iwreq_data wrqu;
        char *buf = kmalloc(128, GFP_ATOMIC);
@@ -34,8 +34,9 @@ void mac80211_ev_michael_mic_failure(struct ieee80211_sub_if_data *sdata, int ke
                kfree(buf);
        }
-        /*
+        cfg80211_michael_mic_failure(sdata->dev, hdr->addr2,
-         * TODO: re-add support for sending MIC failure indication
+                                     (hdr->addr1[0] & 0x01) ?
-         * with all info via nl80211
+                                     NL80211_KEYTYPE_GROUP :
-         */
+                                     NL80211_KEYTYPE_PAIRWISE,
+                                     keyidx, tsc);
 }
diff --git a/net/mac80211/ht.c b/net/mac80211/ht.c
index 4e3c72f20de7..0891bfb06996 100644
--- a/net/mac80211/ht.c
+++ b/net/mac80211/ht.c
@@ -14,7 +14,6 @@
 */
 #include <linux/ieee80211.h>
-#include <net/wireless.h>
 #include <net/mac80211.h>
 #include "ieee80211_i.h"
 #include "rate.h"
@@ -83,89 +82,6 @@ void ieee80211_ht_cap_ie_to_sta_ht_cap(struct ieee80211_supported_band *sband,
                ht_cap->mcs.rx_mask[32/8] |= 1;
 }
-/*
- * ieee80211_enable_ht should be called only after the operating band
- * has been determined as ht configuration depends on the hw's
- * HT abilities for a specific band.
- */
-u32 ieee80211_enable_ht(struct ieee80211_sub_if_data *sdata,
-                        struct ieee80211_ht_info *hti,
-                        u16 ap_ht_cap_flags)
-{
-        struct ieee80211_local *local = sdata->local;
-        struct ieee80211_supported_band *sband;
-        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
-        struct ieee80211_bss_ht_conf ht;
-        struct sta_info *sta;
-        u32 changed = 0;
-        bool enable_ht = true, ht_changed;
-        enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
-        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
-        memset(&ht, 0, sizeof(ht));
-        /* HT is not supported */
-        if (!sband->ht_cap.ht_supported)
-                enable_ht = false;
-        /* check that channel matches the right operating channel */
-        if (local->hw.conf.channel->center_freq !=
-            ieee80211_channel_to_frequency(hti->control_chan))
-                enable_ht = false;
-        if (enable_ht) {
-                channel_type = NL80211_CHAN_HT20;
-                if (!(ap_ht_cap_flags & IEEE80211_HT_CAP_40MHZ_INTOLERANT) &&
-                    (sband->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) &&
-                    (hti->ht_param & IEEE80211_HT_PARAM_CHAN_WIDTH_ANY)) {
-                        switch(hti->ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
-                        case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
-                                channel_type = NL80211_CHAN_HT40PLUS;
-                                break;
-                        case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
-                                channel_type = NL80211_CHAN_HT40MINUS;
-                                break;
-                        }
-                }
-        }
-        ht_changed = conf_is_ht(&local->hw.conf) != enable_ht ||
-                     channel_type != local->hw.conf.channel_type;
-        local->oper_channel_type = channel_type;
-        if (ht_changed) {
-                /* channel_type change automatically detected */
-                ieee80211_hw_config(local, 0);
-                rcu_read_lock();
-                sta = sta_info_get(local, ifmgd->bssid);
-                if (sta)
-                        rate_control_rate_update(local, sband, sta,
-                                                 IEEE80211_RC_HT_CHANGED);
-                rcu_read_unlock();
-        }
-        /* disable HT */
-        if (!enable_ht)
-                return 0;
-        ht.operation_mode = le16_to_cpu(hti->operation_mode);
-        /* if bss configuration changed store the new one */
-        if (memcmp(&sdata->vif.bss_conf.ht, &ht, sizeof(ht))) {
-                changed |= BSS_CHANGED_HT;
-                sdata->vif.bss_conf.ht = ht;
-        }
-        return changed;
-}
 void ieee80211_sta_tear_down_BA_sessions(struct sta_info *sta)
 {
        int i;
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index 3201e1f96365..6030e003180c 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -59,74 +59,59 @@ static void ieee80211_rx_mgmt_auth_ibss(struct ieee80211_sub_if_data *sdata,
                                    sdata->u.ibss.bssid, 0);
 }
-static int __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
+static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
-                                     const u8 *bssid, const int beacon_int,
+                                      const u8 *bssid, const int beacon_int,
-                                     const int freq,
+                                      struct ieee80211_channel *chan,
-                                     const size_t supp_rates_len,
+                                      const size_t supp_rates_len,
-                                     const u8 *supp_rates,
+                                      const u8 *supp_rates,
-                                     const u16 capability, u64 tsf)
+                                      const u16 capability, u64 tsf)
 {
        struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
        struct ieee80211_local *local = sdata->local;
-        int res = 0, rates, i, j;
+        int rates, i, j;
        struct sk_buff *skb;
        struct ieee80211_mgmt *mgmt;
        u8 *pos;
        struct ieee80211_supported_band *sband;
-        union iwreq_data wrqu;
        if (local->ops->reset_tsf) {
                /* Reset own TSF to allow time synchronization work. */
                local->ops->reset_tsf(local_to_hw(local));
        }
-        if ((ifibss->flags & IEEE80211_IBSS_PREV_BSSID_SET) &&
+        skb = ifibss->skb;
-           memcmp(ifibss->bssid, bssid, ETH_ALEN) == 0)
+        rcu_assign_pointer(ifibss->presp, NULL);
-                return res;
+        synchronize_rcu();
+        skb->data = skb->head;
+        skb->len = 0;
+        skb_reset_tail_pointer(skb);
+        skb_reserve(skb, sdata->local->hw.extra_tx_headroom);
-        skb = dev_alloc_skb(local->hw.extra_tx_headroom + 400);
+        if (memcmp(ifibss->bssid, bssid, ETH_ALEN))
-        if (!skb) {
+                sta_info_flush(sdata->local, sdata);
-                printk(KERN_DEBUG "%s: failed to allocate buffer for probe "
-                       "response\n", sdata->dev->name);
-                return -ENOMEM;
-        }
-        if (!(ifibss->flags & IEEE80211_IBSS_PREV_BSSID_SET)) {
-                /* Remove possible STA entries from other IBSS networks. */
-                sta_info_flush_delayed(sdata);
-        }
        memcpy(ifibss->bssid, bssid, ETH_ALEN);
-        res = ieee80211_if_config(sdata, IEEE80211_IFCC_BSSID);
-        if (res)
-                return res;
        local->hw.conf.beacon_int = beacon_int >= 10 ? beacon_int : 10;
-        sdata->drop_unencrypted = capability &
+        sdata->drop_unencrypted = capability & WLAN_CAPABILITY_PRIVACY ? 1 : 0;
-                WLAN_CAPABILITY_PRIVACY ? 1 : 0;
-        res = ieee80211_set_freq(sdata, freq);
-        if (res)
+        ieee80211_if_config(sdata, IEEE80211_IFCC_BSSID);
-                return res;
-        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
+        local->oper_channel = chan;
+        local->oper_channel_type = NL80211_CHAN_NO_HT;
+        ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);
+        sband = local->hw.wiphy->bands[chan->band];
        /* Build IBSS probe response */
+        mgmt = (void *) skb_put(skb, 24 + sizeof(mgmt->u.beacon));
-        skb_reserve(skb, local->hw.extra_tx_headroom);
-        mgmt = (struct ieee80211_mgmt *)
-                skb_put(skb, 24 + sizeof(mgmt->u.beacon));
        memset(mgmt, 0, 24 + sizeof(mgmt->u.beacon));
        mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
                                          IEEE80211_STYPE_PROBE_RESP);
        memset(mgmt->da, 0xff, ETH_ALEN);
        memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
        memcpy(mgmt->bssid, ifibss->bssid, ETH_ALEN);
-        mgmt->u.beacon.beacon_int =
+        mgmt->u.beacon.beacon_int = cpu_to_le16(local->hw.conf.beacon_int);
-                cpu_to_le16(local->hw.conf.beacon_int);
        mgmt->u.beacon.timestamp = cpu_to_le64(tsf);
        mgmt->u.beacon.capab_info = cpu_to_le16(capability);
@@ -147,7 +132,7 @@ static int __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
                pos = skb_put(skb, 2 + 1);
                *pos++ = WLAN_EID_DS_PARAMS;
                *pos++ = 1;
-                *pos++ = ieee80211_frequency_to_channel(freq);
+                *pos++ = ieee80211_frequency_to_channel(chan->center_freq);
        }
        pos = skb_put(skb, 2 + 2);
@@ -165,12 +150,15 @@ static int __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
                memcpy(pos, &supp_rates[8], rates);
        }
-        ifibss->probe_resp = skb;
+        if (ifibss->ie_len)
+                memcpy(skb_put(skb, ifibss->ie_len),
+                       ifibss->ie, ifibss->ie_len);
+        rcu_assign_pointer(ifibss->presp, skb);
        ieee80211_if_config(sdata, IEEE80211_IFCC_BEACON |
                                   IEEE80211_IFCC_BEACON_ENABLED);
        rates = 0;
        for (i = 0; i < supp_rates_len; i++) {
                int bitrate = (supp_rates[i] & 0x7f) * 5;
@@ -181,27 +169,24 @@ static int __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
        ieee80211_sta_def_wmm_params(sdata, supp_rates_len, supp_rates);
-        ifibss->flags |= IEEE80211_IBSS_PREV_BSSID_SET;
        ifibss->state = IEEE80211_IBSS_MLME_JOINED;
-        mod_timer(&ifibss->timer, jiffies + IEEE80211_IBSS_MERGE_INTERVAL);
+        mod_timer(&ifibss->timer,
+                  round_jiffies(jiffies + IEEE80211_IBSS_MERGE_INTERVAL));
-        memset(&wrqu, 0, sizeof(wrqu));
+        cfg80211_inform_bss_frame(local->hw.wiphy, local->hw.conf.channel,
-        memcpy(wrqu.ap_addr.sa_data, bssid, ETH_ALEN);
+                                  mgmt, skb->len, 0, GFP_KERNEL);
-        wireless_send_event(sdata->dev, SIOCGIWAP, &wrqu, NULL);
+        cfg80211_ibss_joined(sdata->dev, ifibss->bssid, GFP_KERNEL);
-        return res;
 }
-static int ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
+static void ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
-                                   struct ieee80211_bss *bss)
+                                    struct ieee80211_bss *bss)
 {
-        return __ieee80211_sta_join_ibss(sdata,
+        __ieee80211_sta_join_ibss(sdata, bss->cbss.bssid,
-                                         bss->cbss.bssid,
+                                  bss->cbss.beacon_interval,
-                                         bss->cbss.beacon_interval,
+                                  bss->cbss.channel,
-                                         bss->cbss.channel->center_freq,
+                                  bss->supp_rates_len, bss->supp_rates,
-                                         bss->supp_rates_len, bss->supp_rates,
+                                  bss->cbss.capability,
-                                         bss->cbss.capability,
+                                  bss->cbss.tsf);
-                                         bss->cbss.tsf);
 }
 static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
@@ -277,7 +262,7 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
                goto put_bss;
        /* we use a fixed BSSID */
-        if (sdata->u.ibss.flags & IEEE80211_IBSS_BSSID_SET)
+        if (sdata->u.ibss.bssid)
                goto put_bss;
        /* not an IBSS */
@@ -369,13 +354,14 @@ struct sta_info *ieee80211_ibss_add_sta(struct ieee80211_sub_if_data *sdata,
        struct sta_info *sta;
        int band = local->hw.conf.channel->band;
-        /* TODO: Could consider removing the least recently used entry and
+        /*
-         * allow new one to be added. */
+         * XXX: Consider removing the least recently used entry and
+         *      allow new one to be added.
+         */
        if (local->num_sta >= IEEE80211_IBSS_MAX_STA_ENTRIES) {
-                if (net_ratelimit()) {
+                if (net_ratelimit())
-                        printk(KERN_DEBUG "%s: No room for a new IBSS STA "
+                        printk(KERN_DEBUG "%s: No room for a new IBSS STA entry %pM\n",
-                               "entry %pM\n", sdata->dev->name, addr);
+                               sdata->dev->name, addr);
-                }
                return NULL;
        }
@@ -432,14 +418,15 @@ static void ieee80211_sta_merge_ibss(struct ieee80211_sub_if_data *sdata)
 {
        struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
-        mod_timer(&ifibss->timer, jiffies + IEEE80211_IBSS_MERGE_INTERVAL);
+        mod_timer(&ifibss->timer,
+                  round_jiffies(jiffies + IEEE80211_IBSS_MERGE_INTERVAL));
        ieee80211_sta_expire(sdata, IEEE80211_IBSS_INACTIVITY_LIMIT);
        if (ieee80211_sta_active_ibss(sdata))
                return;
-        if ((ifibss->flags & IEEE80211_IBSS_BSSID_SET) &&
+        if (ifibss->fixed_channel)
-            (!(ifibss->flags & IEEE80211_IBSS_AUTO_CHANNEL_SEL)))
                return;
        printk(KERN_DEBUG "%s: No active IBSS STAs - trying to scan for other "
@@ -455,7 +442,7 @@ static void ieee80211_sta_merge_ibss(struct ieee80211_sub_if_data *sdata)
        ieee80211_request_scan(sdata, &sdata->local->int_scan_req);
 }
-static int ieee80211_sta_create_ibss(struct ieee80211_sub_if_data *sdata)
+static void ieee80211_sta_create_ibss(struct ieee80211_sub_if_data *sdata)
 {
        struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
        struct ieee80211_local *local = sdata->local;
@@ -466,7 +453,7 @@ static int ieee80211_sta_create_ibss(struct ieee80211_sub_if_data *sdata)
        u16 capability;
        int i;
-        if (ifibss->flags & IEEE80211_IBSS_BSSID_SET) {
+        if (ifibss->fixed_bssid) {
                memcpy(bssid, ifibss->bssid, ETH_ALEN);
        } else {
                /* Generate random, not broadcast, locally administered BSSID. Mix in
@@ -482,7 +469,7 @@ static int ieee80211_sta_create_ibss(struct ieee80211_sub_if_data *sdata)
        printk(KERN_DEBUG "%s: Creating new IBSS network, BSSID %pM\n",
               sdata->dev->name, bssid);
-        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
+        sband = local->hw.wiphy->bands[ifibss->channel->band];
        if (local->hw.conf.beacon_int == 0)
                local->hw.conf.beacon_int = 100;
@@ -500,24 +487,20 @@ static int ieee80211_sta_create_ibss(struct ieee80211_sub_if_data *sdata)
                *pos++ = (u8) (rate / 5);
        }
-        return __ieee80211_sta_join_ibss(sdata,
+        __ieee80211_sta_join_ibss(sdata, bssid, local->hw.conf.beacon_int,
-                                         bssid, local->hw.conf.beacon_int,
+                                  ifibss->channel, sband->n_bitrates,
-                                         local->hw.conf.channel->center_freq,
+                                  supp_rates, capability, 0);
-                                         sband->n_bitrates, supp_rates,
-                                         capability, 0);
 }
-static int ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata)
+static void ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata)
 {
        struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
        struct ieee80211_local *local = sdata->local;
        struct ieee80211_bss *bss;
+        struct ieee80211_channel *chan = NULL;
        const u8 *bssid = NULL;
        int active_ibss;
-        if (ifibss->ssid_len == 0)
-                return -EINVAL;
        active_ibss = ieee80211_sta_active_ibss(sdata);
 #ifdef CONFIG_MAC80211_IBSS_DEBUG
        printk(KERN_DEBUG "%s: sta_find_ibss (active_ibss=%d)\n",
@@ -525,11 +508,15 @@ static int ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata)
 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
        if (active_ibss)
-                return 0;
+                return;
-        if (ifibss->flags & IEEE80211_IBSS_BSSID_SET)
+        if (ifibss->fixed_bssid)
+                bssid = ifibss->bssid;
+        if (ifibss->fixed_channel)
+                chan = ifibss->channel;
+        if (!is_zero_ether_addr(ifibss->bssid))
                bssid = ifibss->bssid;
-        bss = (void *)cfg80211_get_bss(local->hw.wiphy, NULL, bssid,
+        bss = (void *)cfg80211_get_bss(local->hw.wiphy, chan, bssid,
                                       ifibss->ssid, ifibss->ssid_len,
                                       WLAN_CAPABILITY_IBSS,
                                       WLAN_CAPABILITY_IBSS);
@@ -540,18 +527,14 @@ static int ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata)
                       "%pM\n", bss->cbss.bssid, ifibss->bssid);
 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
-        if (bss &&
+        if (bss && memcmp(ifibss->bssid, bss->cbss.bssid, ETH_ALEN)) {
-            (!(ifibss->flags & IEEE80211_IBSS_PREV_BSSID_SET) ||
-             memcmp(ifibss->bssid, bss->cbss.bssid, ETH_ALEN))) {
-                int ret;
                printk(KERN_DEBUG "%s: Selected IBSS BSSID %pM"
                       " based on configured SSID\n",
                       sdata->dev->name, bss->cbss.bssid);
-                ret = ieee80211_sta_join_ibss(sdata, bss);
+                ieee80211_sta_join_ibss(sdata, bss);
                ieee80211_rx_bss_put(local, bss);
-                return ret;
+                return;
        } else if (bss)
                ieee80211_rx_bss_put(local, bss);
@@ -562,29 +545,31 @@ static int ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata)
        /* Selected IBSS not found in current scan results - try to scan */
        if (ifibss->state == IEEE80211_IBSS_MLME_JOINED &&
            !ieee80211_sta_active_ibss(sdata)) {
-                mod_timer(&ifibss->timer, jiffies +
+                mod_timer(&ifibss->timer,
-                                          IEEE80211_IBSS_MERGE_INTERVAL);
+                          round_jiffies(jiffies + IEEE80211_IBSS_MERGE_INTERVAL));
-        } else if (time_after(jiffies, local->last_scan_completed +
+        } else if (time_after(jiffies, ifibss->last_scan_completed +
                                        IEEE80211_SCAN_INTERVAL)) {
                printk(KERN_DEBUG "%s: Trigger new scan to find an IBSS to "
                       "join\n", sdata->dev->name);
                /* XXX maybe racy? */
                if (local->scan_req)
-                        return -EBUSY;
+                        return;
                memcpy(local->int_scan_req.ssids[0].ssid,
                       ifibss->ssid, IEEE80211_MAX_SSID_LEN);
-                local->int_scan_req.ssids[0].ssid_len = ifibss->ssid_len;
+                local->int_scan_req.ssids[0].ssid_len =
-                return ieee80211_request_scan(sdata, &local->int_scan_req);
+                        ifibss->ssid_len;
+                ieee80211_request_scan(sdata, &local->int_scan_req);
        } else if (ifibss->state != IEEE80211_IBSS_MLME_JOINED) {
                int interval = IEEE80211_SCAN_INTERVAL;
                if (time_after(jiffies, ifibss->ibss_join_req +
                               IEEE80211_IBSS_JOIN_TIMEOUT)) {
-                        if (!(local->oper_channel->flags &
+                        if (!(local->oper_channel->flags & IEEE80211_CHAN_NO_IBSS)) {
-                                                IEEE80211_CHAN_NO_IBSS))
+                                ieee80211_sta_create_ibss(sdata);
-                                return ieee80211_sta_create_ibss(sdata);
+                                return;
+                        }
                        printk(KERN_DEBUG "%s: IBSS not allowed on"
                               " %d MHz\n", sdata->dev->name,
                               local->hw.conf.channel->center_freq);
@@ -595,11 +580,9 @@ static int ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata)
                }
                ifibss->state = IEEE80211_IBSS_MLME_SEARCH;
-                mod_timer(&ifibss->timer, jiffies + interval);
+                mod_timer(&ifibss->timer,
-                return 0;
+                          round_jiffies(jiffies + interval));
        }
-        return 0;
 }
 static void ieee80211_rx_mgmt_probe_req(struct ieee80211_sub_if_data *sdata,
@@ -614,7 +597,7 @@ static void ieee80211_rx_mgmt_probe_req(struct ieee80211_sub_if_data *sdata,
        u8 *pos, *end;
        if (ifibss->state != IEEE80211_IBSS_MLME_JOINED ||
-            len < 24 + 2 || !ifibss->probe_resp)
+            len < 24 + 2 || !ifibss->presp)
                return;
        if (local->ops->tx_last_beacon)
@@ -649,13 +632,13 @@ static void ieee80211_rx_mgmt_probe_req(struct ieee80211_sub_if_data *sdata,
        }
        if (pos[1] != 0 &&
            (pos[1] != ifibss->ssid_len ||
-             memcmp(pos + 2, ifibss->ssid, ifibss->ssid_len) != 0)) {
+             !memcmp(pos + 2, ifibss->ssid, ifibss->ssid_len))) {
                /* Ignore ProbeReq for foreign SSID */
                return;
        }
        /* Reply with ProbeResp */
-        skb = skb_copy(ifibss->probe_resp, GFP_KERNEL);
+        skb = skb_copy(ifibss->presp, GFP_KERNEL);
        if (!skb)
                return;
@@ -794,89 +777,21 @@ void ieee80211_ibss_setup_sdata(struct ieee80211_sub_if_data *sdata)
        setup_timer(&ifibss->timer, ieee80211_ibss_timer,
                    (unsigned long) sdata);
        skb_queue_head_init(&ifibss->skb_queue);
-        ifibss->flags |= IEEE80211_IBSS_AUTO_BSSID_SEL |
-                        IEEE80211_IBSS_AUTO_CHANNEL_SEL;
-}
-int ieee80211_ibss_commit(struct ieee80211_sub_if_data *sdata)
-{
-        struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
-        ifibss->flags &= ~IEEE80211_IBSS_PREV_BSSID_SET;
-        if (ifibss->ssid_len)
-                ifibss->flags |= IEEE80211_IBSS_SSID_SET;
-        else
-                ifibss->flags &= ~IEEE80211_IBSS_SSID_SET;
-        ifibss->ibss_join_req = jiffies;
-        ifibss->state = IEEE80211_IBSS_MLME_SEARCH;
-        set_bit(IEEE80211_IBSS_REQ_RUN, &ifibss->request);
-        return 0;
-}
-int ieee80211_ibss_set_ssid(struct ieee80211_sub_if_data *sdata, char *ssid, size_t len)
-{
-        struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
-        if (len > IEEE80211_MAX_SSID_LEN)
-                return -EINVAL;
-        if (ifibss->ssid_len != len || memcmp(ifibss->ssid, ssid, len) != 0) {
-                memset(ifibss->ssid, 0, sizeof(ifibss->ssid));
-                memcpy(ifibss->ssid, ssid, len);
-                ifibss->ssid_len = len;
-        }
-        return ieee80211_ibss_commit(sdata);
-}
-int ieee80211_ibss_get_ssid(struct ieee80211_sub_if_data *sdata, char *ssid, size_t *len)
-{
-        struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
-        memcpy(ssid, ifibss->ssid, ifibss->ssid_len);
-        *len = ifibss->ssid_len;
-        return 0;
-}
-int ieee80211_ibss_set_bssid(struct ieee80211_sub_if_data *sdata, u8 *bssid)
-{
-        struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
-        if (is_valid_ether_addr(bssid)) {
-                memcpy(ifibss->bssid, bssid, ETH_ALEN);
-                ifibss->flags |= IEEE80211_IBSS_BSSID_SET;
-        } else {
-                memset(ifibss->bssid, 0, ETH_ALEN);
-                ifibss->flags &= ~IEEE80211_IBSS_BSSID_SET;
-        }
-        if (netif_running(sdata->dev)) {
-                if (ieee80211_if_config(sdata, IEEE80211_IFCC_BSSID)) {
-                        printk(KERN_DEBUG "%s: Failed to config new BSSID to "
-                               "the low-level driver\n", sdata->dev->name);
-                }
-        }
-        return ieee80211_ibss_commit(sdata);
 }
 /* scan finished notification */
 void ieee80211_ibss_notify_scan_completed(struct ieee80211_local *local)
 {
-        struct ieee80211_sub_if_data *sdata = local->scan_sdata;
+        struct ieee80211_sub_if_data *sdata;
-        struct ieee80211_if_ibss *ifibss;
-        if (sdata && sdata->vif.type == NL80211_IFTYPE_ADHOC) {
+        mutex_lock(&local->iflist_mtx);
-                ifibss = &sdata->u.ibss;
+        list_for_each_entry(sdata, &local->interfaces, list) {
-                if ((!(ifibss->flags & IEEE80211_IBSS_PREV_BSSID_SET)) ||
+                if (sdata->vif.type != NL80211_IFTYPE_ADHOC)
-                    !ieee80211_sta_active_ibss(sdata))
+                        continue;
-                        ieee80211_sta_find_ibss(sdata);
+                sdata->u.ibss.last_scan_completed = jiffies;
+                ieee80211_sta_find_ibss(sdata);
        }
+        mutex_unlock(&local->iflist_mtx);
 }
 ieee80211_rx_result
@@ -906,3 +821,71 @@ ieee80211_ibss_rx_mgmt(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb,
        return RX_DROP_MONITOR;
 }
+int ieee80211_ibss_join(struct ieee80211_sub_if_data *sdata,
+                        struct cfg80211_ibss_params *params)
+{
+        struct sk_buff *skb;
+        memcpy(sdata->u.ibss.ssid, params->ssid, IEEE80211_MAX_SSID_LEN);
+        sdata->u.ibss.ssid_len = params->ssid_len;
+        if (params->bssid) {
+                memcpy(sdata->u.ibss.bssid, params->bssid, ETH_ALEN);
+                sdata->u.ibss.fixed_bssid = true;
+        } else
+                sdata->u.ibss.fixed_bssid = false;
+        sdata->u.ibss.channel = params->channel;
+        sdata->u.ibss.fixed_channel = params->channel_fixed;
+        if (params->ie) {
+                sdata->u.ibss.ie = kmemdup(params->ie, params->ie_len,
+                                           GFP_KERNEL);
+                if (sdata->u.ibss.ie)
+                        sdata->u.ibss.ie_len = params->ie_len;
+        }
+        skb = dev_alloc_skb(sdata->local->hw.extra_tx_headroom +
+                            36 /* bitrates */ +
+                            34 /* SSID */ +
+                            3  /* DS params */ +
+                            4  /* IBSS params */ +
+                            params->ie_len);
+        if (!skb)
+                return -ENOMEM;
+        sdata->u.ibss.skb = skb;
+        sdata->u.ibss.state = IEEE80211_IBSS_MLME_SEARCH;
+        sdata->u.ibss.ibss_join_req = jiffies;
+        set_bit(IEEE80211_IBSS_REQ_RUN, &sdata->u.ibss.request);
+        queue_work(sdata->local->hw.workqueue, &sdata->u.ibss.work);
+        return 0;
+}
+int ieee80211_ibss_leave(struct ieee80211_sub_if_data *sdata)
+{
+        struct sk_buff *skb;
+        del_timer_sync(&sdata->u.ibss.timer);
+        clear_bit(IEEE80211_IBSS_REQ_RUN, &sdata->u.ibss.request);
+        cancel_work_sync(&sdata->u.ibss.work);
+        clear_bit(IEEE80211_IBSS_REQ_RUN, &sdata->u.ibss.request);
+        sta_info_flush(sdata->local, sdata);
+        /* remove beacon */
+        kfree(sdata->u.ibss.ie);
+        skb = sdata->u.ibss.presp;
+        rcu_assign_pointer(sdata->u.ibss.presp, NULL);
+        ieee80211_if_config(sdata, IEEE80211_IFCC_BEACON_ENABLED);
+        synchronize_rcu();
+        kfree_skb(skb);
+        skb_queue_purge(&sdata->u.ibss.skb_queue);
+        memset(sdata->u.ibss.bssid, 0, ETH_ALEN);
+        return 0;
+}
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index e6ed78cb16b3..1579bc92c88d 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -24,7 +24,6 @@
 #include <linux/spinlock.h>
 #include <linux/etherdevice.h>
 #include <net/cfg80211.h>
-#include <net/wireless.h>
 #include <net/iw_handler.h>
 #include <net/mac80211.h>
 #include "key.h"
@@ -295,6 +294,8 @@ struct ieee80211_if_managed {
        int auth_tries; /* retries for auth req */
        int assoc_tries; /* retries for assoc req */
+        bool powersave; /* powersave requested for this iface */
        unsigned long request;
        unsigned long last_probe;
@@ -306,6 +307,8 @@ struct ieee80211_if_managed {
        int auth_alg; /* currently used IEEE 802.11 authentication algorithm */
        int auth_transaction;
+        u32 beacon_crc;
        enum {
                IEEE80211_MFP_DISABLED,
                IEEE80211_MFP_OPTIONAL,
@@ -319,14 +322,6 @@ struct ieee80211_if_managed {
        size_t sme_auth_ie_len;
 };
-enum ieee80211_ibss_flags {
-        IEEE80211_IBSS_AUTO_CHANNEL_SEL         = BIT(0),
-        IEEE80211_IBSS_AUTO_BSSID_SEL           = BIT(1),
-        IEEE80211_IBSS_BSSID_SET                = BIT(2),
-        IEEE80211_IBSS_PREV_BSSID_SET           = BIT(3),
-        IEEE80211_IBSS_SSID_SET                 = BIT(4),
-};
 enum ieee80211_ibss_request {
        IEEE80211_IBSS_REQ_RUN  = 0,
 };
@@ -337,17 +332,20 @@ struct ieee80211_if_ibss {
        struct sk_buff_head skb_queue;
-        u8 ssid[IEEE80211_MAX_SSID_LEN];
+        unsigned long request;
-        u8 ssid_len;
+        unsigned long last_scan_completed;
+        bool fixed_bssid;
-        u32 flags;
+        bool fixed_channel;
        u8 bssid[ETH_ALEN];
+        u8 ssid[IEEE80211_MAX_SSID_LEN];
-        unsigned long request;
+        u8 ssid_len, ie_len;
+        u8 *ie;
+        struct ieee80211_channel *channel;
        unsigned long ibss_join_req;
-        struct sk_buff *probe_resp; /* ProbeResp template for IBSS */
+        /* probe response/beacon for IBSS */
+        struct sk_buff *presp, *skb;
        enum {
                IEEE80211_IBSS_MLME_SEARCH,
@@ -626,8 +624,6 @@ struct ieee80211_local {
        spinlock_t sta_lock;
        unsigned long num_sta;
        struct list_head sta_list;
-        struct list_head sta_flush_list;
-        struct work_struct sta_flush_work;
        struct sta_info *sta_hash[STA_HASH_SIZE];
        struct timer_list sta_cleanup;
@@ -647,9 +643,6 @@ struct ieee80211_local {
        struct rate_control_ref *rate_ctrl;
-        int rts_threshold;
-        int fragmentation_threshold;
        struct crypto_blkcipher *wep_tx_tfm;
        struct crypto_blkcipher *wep_rx_tfm;
        u32 wep_iv;
@@ -671,10 +664,12 @@ struct ieee80211_local {
        struct cfg80211_scan_request int_scan_req;
        struct cfg80211_scan_request *scan_req;
        struct ieee80211_channel *scan_channel;
+        const u8 *orig_ies;
+        int orig_ies_len;
        int scan_channel_idx;
+        int scan_ies_len;
        enum { SCAN_SET_CHANNEL, SCAN_SEND_PROBE } scan_state;
-        unsigned long last_scan_completed;
        struct delayed_work scan_work;
        struct ieee80211_sub_if_data *scan_sdata;
        enum nl80211_channel_type oper_channel_type;
@@ -736,15 +731,22 @@ struct ieee80211_local {
        int wifi_wme_noack_test;
        unsigned int wmm_acm; /* bit field of ACM bits (BIT(802.1D tag)) */
-        bool powersave;
        bool pspolling;
+        /*
+         * PS can only be enabled when we have exactly one managed
+         * interface (and monitors) in PS, this then points there.
+         */
+        struct ieee80211_sub_if_data *ps_sdata;
        struct work_struct dynamic_ps_enable_work;
        struct work_struct dynamic_ps_disable_work;
        struct timer_list dynamic_ps_timer;
+        struct notifier_block network_latency_notifier;
        int user_power_level; /* in dBm */
        int power_constr_level; /* in dBm */
+        struct work_struct restart_work;
 #ifdef CONFIG_MAC80211_DEBUGFS
        struct local_debugfsdentries {
                struct dentry *rcdir;
@@ -830,7 +832,7 @@ struct ieee802_11_elems {
        u8 *fh_params;
        u8 *ds_params;
        u8 *cf_params;
-        u8 *tim;
+        struct ieee80211_tim_ie *tim;
        u8 *ibss_params;
        u8 *challenge;
        u8 *wpa;
@@ -927,12 +929,11 @@ int ieee80211_sta_deauthenticate(struct ieee80211_sub_if_data *sdata, u16 reason
 int ieee80211_sta_disassociate(struct ieee80211_sub_if_data *sdata, u16 reason);
 void ieee80211_send_pspoll(struct ieee80211_local *local,
                           struct ieee80211_sub_if_data *sdata);
+void ieee80211_recalc_ps(struct ieee80211_local *local, s32 latency);
+int ieee80211_max_network_latency(struct notifier_block *nb,
+                                  unsigned long data, void *dummy);
 /* IBSS code */
-int ieee80211_ibss_commit(struct ieee80211_sub_if_data *sdata);
-int ieee80211_ibss_set_ssid(struct ieee80211_sub_if_data *sdata, char *ssid, size_t len);
-int ieee80211_ibss_get_ssid(struct ieee80211_sub_if_data *sdata, char *ssid, size_t *len);
-int ieee80211_ibss_set_bssid(struct ieee80211_sub_if_data *sdata, u8 *bssid);
 void ieee80211_ibss_notify_scan_completed(struct ieee80211_local *local);
 void ieee80211_ibss_setup_sdata(struct ieee80211_sub_if_data *sdata);
 ieee80211_rx_result
@@ -940,6 +941,9 @@ ieee80211_ibss_rx_mgmt(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb,
                       struct ieee80211_rx_status *rx_status);
 struct sta_info *ieee80211_ibss_add_sta(struct ieee80211_sub_if_data *sdata,
                                        u8 *bssid, u8 *addr, u32 supp_rates);
+int ieee80211_ibss_join(struct ieee80211_sub_if_data *sdata,
+                        struct cfg80211_ibss_params *params);
+int ieee80211_ibss_leave(struct ieee80211_sub_if_data *sdata);
 /* scan/BSS handling */
 void ieee80211_scan_work(struct work_struct *work);
@@ -995,9 +999,6 @@ int ieee80211_subif_start_xmit(struct sk_buff *skb, struct net_device *dev);
 void ieee80211_ht_cap_ie_to_sta_ht_cap(struct ieee80211_supported_band *sband,
                                       struct ieee80211_ht_cap *ht_cap_ie,
                                       struct ieee80211_sta_ht_cap *ht_cap);
-u32 ieee80211_enable_ht(struct ieee80211_sub_if_data *sdata,
-                        struct ieee80211_ht_info *hti,
-                        u16 ap_ht_cap_flags);
 void ieee80211_send_bar(struct ieee80211_sub_if_data *sdata, u8 *ra, u16 tid, u16 ssn);
 void ieee80211_send_delba(struct ieee80211_sub_if_data *sdata,
                          const u8 *da, u16 tid,
@@ -1036,15 +1037,22 @@ void ieee80211_handle_pwr_constr(struct ieee80211_sub_if_data *sdata,
                                 u16 capab_info, u8 *pwr_constr_elem,
                                 u8 pwr_constr_elem_len);
-/* Suspend/resume */
+/* Suspend/resume and hw reconfiguration */
+int ieee80211_reconfig(struct ieee80211_local *local);
 #ifdef CONFIG_PM
 int __ieee80211_suspend(struct ieee80211_hw *hw);
-int __ieee80211_resume(struct ieee80211_hw *hw);
+static inline int __ieee80211_resume(struct ieee80211_hw *hw)
+{
+        return ieee80211_reconfig(hw_to_local(hw));
+}
 #else
 static inline int __ieee80211_suspend(struct ieee80211_hw *hw)
 {
        return 0;
 }
 static inline int __ieee80211_resume(struct ieee80211_hw *hw)
 {
        return 0;
@@ -1060,12 +1068,15 @@ u8 *ieee80211_get_bssid(struct ieee80211_hdr *hdr, size_t len,
 int ieee80211_frame_duration(struct ieee80211_local *local, size_t len,
                             int rate, int erp, int short_preamble);
 void mac80211_ev_michael_mic_failure(struct ieee80211_sub_if_data *sdata, int keyidx,
-                                     struct ieee80211_hdr *hdr);
+                                     struct ieee80211_hdr *hdr, const u8 *tsc);
 void ieee80211_set_wmm_default(struct ieee80211_sub_if_data *sdata);
 void ieee80211_tx_skb(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb,
                      int encrypt);
 void ieee802_11_parse_elems(u8 *start, size_t len,
                            struct ieee802_11_elems *elems);
+u32 ieee802_11_parse_elems_crc(u8 *start, size_t len,
+                               struct ieee802_11_elems *elems,
+                               u64 filter, u32 crc);
 int ieee80211_set_freq(struct ieee80211_sub_if_data *sdata, int freq);
 u32 ieee80211_mandatory_rates(struct ieee80211_local *local,
                              enum ieee80211_band band);
@@ -1093,9 +1104,11 @@ void ieee80211_send_auth(struct ieee80211_sub_if_data *sdata,
                         u16 transaction, u16 auth_alg,
                         u8 *extra, size_t extra_len,
                         const u8 *bssid, int encrypt);
+int ieee80211_build_preq_ies(struct ieee80211_local *local, u8 *buffer,
+                             const u8 *ie, size_t ie_len);
 void ieee80211_send_probe_req(struct ieee80211_sub_if_data *sdata, u8 *dst,
-                              u8 *ssid, size_t ssid_len,
+                              const u8 *ssid, size_t ssid_len,
-                              u8 *ie, size_t ie_len);
+                              const u8 *ie, size_t ie_len);
 void ieee80211_sta_def_wmm_params(struct ieee80211_sub_if_data *sdata,
                                  const size_t supp_rates_len,
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 91e8e1bacaaa..52425975bbbe 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -235,11 +235,7 @@ static int ieee80211_open(struct net_device *dev)
                netif_addr_unlock_bh(local->mdev);
                break;
        case NL80211_IFTYPE_STATION:
-        case NL80211_IFTYPE_ADHOC:
+                sdata->u.mgd.flags &= ~IEEE80211_STA_PREV_BSSID_SET;
-                if (sdata->vif.type == NL80211_IFTYPE_STATION)
-                        sdata->u.mgd.flags &= ~IEEE80211_STA_PREV_BSSID_SET;
-                else
-                        sdata->u.ibss.flags &= ~IEEE80211_IBSS_PREV_BSSID_SET;
                /* fall through */
        default:
                conf.vif = &sdata->vif;
@@ -317,6 +313,8 @@ static int ieee80211_open(struct net_device *dev)
                ieee80211_set_wmm_default(sdata);
        }
+        ieee80211_recalc_ps(local, -1);
        /*
         * ieee80211_sta_work is disabled while network interface
         * is down. Therefore, some configuration changes may not
@@ -325,8 +323,6 @@ static int ieee80211_open(struct net_device *dev)
         */
        if (sdata->vif.type == NL80211_IFTYPE_STATION)
                queue_work(local->hw.workqueue, &sdata->u.mgd.work);
-        else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
-                queue_work(local->hw.workqueue, &sdata->u.ibss.work);
        netif_tx_start_all_queues(dev);
@@ -497,7 +493,6 @@ static int ieee80211_stop(struct net_device *dev)
                /* fall through */
        case NL80211_IFTYPE_ADHOC:
                if (sdata->vif.type == NL80211_IFTYPE_ADHOC) {
-                        memset(sdata->u.ibss.bssid, 0, ETH_ALEN);
                        del_timer_sync(&sdata->u.ibss.timer);
                        cancel_work_sync(&sdata->u.ibss.work);
                        synchronize_rcu();
@@ -572,6 +567,8 @@ static int ieee80211_stop(struct net_device *dev)
                hw_reconf_flags = 0;
        }
+        ieee80211_recalc_ps(local, -1);
        /* do after stop to avoid reconfiguring when we stop anyway */
        if (hw_reconf_flags)
                ieee80211_hw_config(local, hw_reconf_flags);
@@ -649,7 +646,8 @@ static void ieee80211_teardown_sdata(struct net_device *dev)
                        mesh_rmc_free(sdata);
                break;
        case NL80211_IFTYPE_ADHOC:
-                kfree_skb(sdata->u.ibss.probe_resp);
+                if (WARN_ON(sdata->u.ibss.presp))
+                        kfree_skb(sdata->u.ibss.presp);
                break;
        case NL80211_IFTYPE_STATION:
                kfree(sdata->u.mgd.extra_ie);
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 14134193cd17..5ca62ea15079 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -21,6 +21,7 @@
 #include <linux/wireless.h>
 #include <linux/rtnetlink.h>
 #include <linux/bitmap.h>
+#include <linux/pm_qos_params.h>
 #include <net/net_namespace.h>
 #include <net/cfg80211.h>
@@ -208,7 +209,7 @@ int ieee80211_if_config(struct ieee80211_sub_if_data *sdata, u32 changed)
                                        !!rcu_dereference(sdata->u.ap.beacon);
                                break;
                        case NL80211_IFTYPE_ADHOC:
-                                conf.enable_beacon = !!sdata->u.ibss.probe_resp;
+                                conf.enable_beacon = !!sdata->u.ibss.presp;
                                break;
                        case NL80211_IFTYPE_MESH_POINT:
                                conf.enable_beacon = true;
@@ -696,6 +697,28 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
 }
 EXPORT_SYMBOL(ieee80211_tx_status);
+static void ieee80211_restart_work(struct work_struct *work)
+{
+        struct ieee80211_local *local =
+                container_of(work, struct ieee80211_local, restart_work);
+        rtnl_lock();
+        ieee80211_reconfig(local);
+        rtnl_unlock();
+}
+void ieee80211_restart_hw(struct ieee80211_hw *hw)
+{
+        struct ieee80211_local *local = hw_to_local(hw);
+        /* use this reason, __ieee80211_resume will unblock it */
+        ieee80211_stop_queues_by_reason(hw,
+                IEEE80211_QUEUE_STOP_REASON_SUSPEND);
+        schedule_work(&local->restart_work);
+}
+EXPORT_SYMBOL(ieee80211_restart_hw);
 struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
                                        const struct ieee80211_ops *ops)
 {
@@ -728,12 +751,13 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
                return NULL;
        wiphy->privid = mac80211_wiphy_privid;
-        wiphy->max_scan_ssids = 4;
        /* Yes, putting cfg80211_bss into ieee80211_bss is a hack */
        wiphy->bss_priv_size = sizeof(struct ieee80211_bss) -
                               sizeof(struct cfg80211_bss);
        local = wiphy_priv(wiphy);
        local->hw.wiphy = wiphy;
        local->hw.priv = (char *)local +
@@ -752,10 +776,8 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
        /* set up some defaults */
        local->hw.queues = 1;
        local->hw.max_rates = 1;
-        local->rts_threshold = IEEE80211_MAX_RTS_THRESHOLD;
+        local->hw.conf.long_frame_max_tx_count = wiphy->retry_long;
-        local->fragmentation_threshold = IEEE80211_MAX_FRAG_THRESHOLD;
+        local->hw.conf.short_frame_max_tx_count = wiphy->retry_short;
-        local->hw.conf.long_frame_max_tx_count = 4;
-        local->hw.conf.short_frame_max_tx_count = 7;
        local->hw.conf.radio_enabled = true;
        local->user_power_level = -1;
@@ -768,6 +790,8 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
        INIT_DELAYED_WORK(&local->scan_work, ieee80211_scan_work);
+        INIT_WORK(&local->restart_work, ieee80211_restart_work);
        INIT_WORK(&local->dynamic_ps_enable_work,
                  ieee80211_dynamic_ps_enable_work);
        INIT_WORK(&local->dynamic_ps_disable_work,
@@ -821,7 +845,17 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
        enum ieee80211_band band;
        struct net_device *mdev;
        struct ieee80211_master_priv *mpriv;
-        int channels, i, j;
+        int channels, i, j, max_bitrates;
+        bool supp_ht;
+        static const u32 cipher_suites[] = {
+                WLAN_CIPHER_SUITE_WEP40,
+                WLAN_CIPHER_SUITE_WEP104,
+                WLAN_CIPHER_SUITE_TKIP,
+                WLAN_CIPHER_SUITE_CCMP,
+                /* keep last -- depends on hw flags! */
+                WLAN_CIPHER_SUITE_AES_CMAC
+        };
        /*
         * generic code guarantees at least one band,
@@ -829,18 +863,25 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
         * that hw.conf.channel is assigned
         */
        channels = 0;
+        max_bitrates = 0;
+        supp_ht = false;
        for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
                struct ieee80211_supported_band *sband;
                sband = local->hw.wiphy->bands[band];
-                if (sband && !local->oper_channel) {
+                if (!sband)
+                        continue;
+                if (!local->oper_channel) {
                        /* init channel we're on */
                        local->hw.conf.channel =
                        local->oper_channel =
                        local->scan_channel = &sband->channels[0];
                }
-                if (sband)
+                channels += sband->n_channels;
-                        channels += sband->n_channels;
+                if (max_bitrates < sband->n_bitrates)
+                        max_bitrates = sband->n_bitrates;
+                supp_ht = supp_ht || sband->ht_cap.ht_supported;
        }
        local->int_scan_req.n_channels = channels;
@@ -860,6 +901,37 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
        else if (local->hw.flags & IEEE80211_HW_SIGNAL_UNSPEC)
                local->hw.wiphy->signal_type = CFG80211_SIGNAL_TYPE_UNSPEC;
+        /*
+         * Calculate scan IE length -- we need this to alloc
+         * memory and to subtract from the driver limit. It
+         * includes the (extended) supported rates and HT
+         * information -- SSID is the driver's responsibility.
+         */
+        local->scan_ies_len = 4 + max_bitrates; /* (ext) supp rates */
+        if (supp_ht)
+                local->scan_ies_len += 2 + sizeof(struct ieee80211_ht_cap);
+        if (!local->ops->hw_scan) {
+                /* For hw_scan, driver needs to set these up. */
+                local->hw.wiphy->max_scan_ssids = 4;
+                local->hw.wiphy->max_scan_ie_len = IEEE80211_MAX_DATA_LEN;
+        }
+        /*
+         * If the driver supports any scan IEs, then assume the
+         * limit includes the IEs mac80211 will add, otherwise
+         * leave it at zero and let the driver sort it out; we
+         * still pass our IEs to the driver but userspace will
+         * not be allowed to in that case.
+         */
+        if (local->hw.wiphy->max_scan_ie_len)
+                local->hw.wiphy->max_scan_ie_len -= local->scan_ies_len;
+        local->hw.wiphy->cipher_suites = cipher_suites;
+        local->hw.wiphy->n_cipher_suites = ARRAY_SIZE(cipher_suites);
+        if (!(local->hw.flags & IEEE80211_HW_MFP_CAPABLE))
+                local->hw.wiphy->n_cipher_suites--;
        result = wiphy_register(local->hw.wiphy);
        if (result < 0)
                goto fail_wiphy_register;
@@ -965,25 +1037,38 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
                }
        }
+        local->network_latency_notifier.notifier_call =
+                ieee80211_max_network_latency;
+        result = pm_qos_add_notifier(PM_QOS_NETWORK_LATENCY,
+                                     &local->network_latency_notifier);
+        if (result) {
+                rtnl_lock();
+                goto fail_pm_qos;
+        }
        return 0;
-fail_rate:
+ fail_pm_qos:
+        ieee80211_led_exit(local);
+        ieee80211_remove_interfaces(local);
+ fail_rate:
        unregister_netdevice(local->mdev);
        local->mdev = NULL;
-fail_dev:
+ fail_dev:
        rtnl_unlock();
        ieee80211_wep_free(local);
-fail_wep:
+ fail_wep:
        sta_info_stop(local);
-fail_sta_info:
+ fail_sta_info:
        debugfs_hw_del(local);
        destroy_workqueue(local->hw.workqueue);
-fail_workqueue:
+ fail_workqueue:
        if (local->mdev)
                free_netdev(local->mdev);
-fail_mdev_alloc:
+ fail_mdev_alloc:
        wiphy_unregister(local->hw.wiphy);
-fail_wiphy_register:
+ fail_wiphy_register:
        kfree(local->int_scan_req.channels);
        return result;
 }
@@ -996,6 +1081,9 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw)
        tasklet_kill(&local->tx_pending_tasklet);
        tasklet_kill(&local->tasklet);
+        pm_qos_remove_notifier(PM_QOS_NETWORK_LATENCY,
+                               &local->network_latency_notifier);
        rtnl_lock();
        /*
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 132938b073dc..3610c11286bc 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -17,6 +17,8 @@
 #include <linux/if_arp.h>
 #include <linux/etherdevice.h>
 #include <linux/rtnetlink.h>
+#include <linux/pm_qos_params.h>
+#include <linux/crc32.h>
 #include <net/mac80211.h>
 #include <asm/unaligned.h>
@@ -80,6 +82,89 @@ static int ieee80211_compatible_rates(struct ieee80211_bss *bss,
        return count;
 }
+/*
+ * ieee80211_enable_ht should be called only after the operating band
+ * has been determined as ht configuration depends on the hw's
+ * HT abilities for a specific band.
+ */
+static u32 ieee80211_enable_ht(struct ieee80211_sub_if_data *sdata,
+                               struct ieee80211_ht_info *hti,
+                               u16 ap_ht_cap_flags)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_supported_band *sband;
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+        struct ieee80211_bss_ht_conf ht;
+        struct sta_info *sta;
+        u32 changed = 0;
+        bool enable_ht = true, ht_changed;
+        enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
+        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
+        memset(&ht, 0, sizeof(ht));
+        /* HT is not supported */
+        if (!sband->ht_cap.ht_supported)
+                enable_ht = false;
+        /* check that channel matches the right operating channel */
+        if (local->hw.conf.channel->center_freq !=
+            ieee80211_channel_to_frequency(hti->control_chan))
+                enable_ht = false;
+        if (enable_ht) {
+                channel_type = NL80211_CHAN_HT20;
+                if (!(ap_ht_cap_flags & IEEE80211_HT_CAP_40MHZ_INTOLERANT) &&
+                    (sband->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) &&
+                    (hti->ht_param & IEEE80211_HT_PARAM_CHAN_WIDTH_ANY)) {
+                        switch(hti->ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
+                        case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
+                                channel_type = NL80211_CHAN_HT40PLUS;
+                                break;
+                        case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
+                                channel_type = NL80211_CHAN_HT40MINUS;
+                                break;
+                        }
+                }
+        }
+        ht_changed = conf_is_ht(&local->hw.conf) != enable_ht ||
+                     channel_type != local->hw.conf.channel_type;
+        local->oper_channel_type = channel_type;
+        if (ht_changed) {
+                /* channel_type change automatically detected */
+                ieee80211_hw_config(local, 0);
+                rcu_read_lock();
+                sta = sta_info_get(local, ifmgd->bssid);
+                if (sta)
+                        rate_control_rate_update(local, sband, sta,
+                                                 IEEE80211_RC_HT_CHANGED);
+                rcu_read_unlock();
+        }
+        /* disable HT */
+        if (!enable_ht)
+                return 0;
+        ht.operation_mode = le16_to_cpu(hti->operation_mode);
+        /* if bss configuration changed store the new one */
+        if (memcmp(&sdata->vif.bss_conf.ht, &ht, sizeof(ht))) {
+                changed |= BSS_CHANGED_HT;
+                sdata->vif.bss_conf.ht = ht;
+        }
+        return changed;
+}
 /* frame sending functions */
 static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
@@ -325,6 +410,10 @@ static void ieee80211_send_deauth_disassoc(struct ieee80211_sub_if_data *sdata,
        /* u.deauth.reason_code == u.disassoc.reason_code */
        mgmt->u.deauth.reason_code = cpu_to_le16(reason);
+        if (stype == IEEE80211_STYPE_DEAUTH)
+                cfg80211_send_deauth(sdata->dev, (u8 *) mgmt, skb->len);
+        else
+                cfg80211_send_disassoc(sdata->dev, (u8 *) mgmt, skb->len);
        ieee80211_tx_skb(sdata, skb, ifmgd->flags & IEEE80211_STA_MFP_ENABLED);
 }
@@ -359,6 +448,166 @@ void ieee80211_send_pspoll(struct ieee80211_local *local,
        ieee80211_tx_skb(sdata, skb, 0);
 }
+void ieee80211_send_nullfunc(struct ieee80211_local *local,
+                             struct ieee80211_sub_if_data *sdata,
+                             int powersave)
+{
+        struct sk_buff *skb;
+        struct ieee80211_hdr *nullfunc;
+        __le16 fc;
+        if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
+                return;
+        skb = dev_alloc_skb(local->hw.extra_tx_headroom + 24);
+        if (!skb) {
+                printk(KERN_DEBUG "%s: failed to allocate buffer for nullfunc "
+                       "frame\n", sdata->dev->name);
+                return;
+        }
+        skb_reserve(skb, local->hw.extra_tx_headroom);
+        nullfunc = (struct ieee80211_hdr *) skb_put(skb, 24);
+        memset(nullfunc, 0, 24);
+        fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_NULLFUNC |
+                         IEEE80211_FCTL_TODS);
+        if (powersave)
+                fc |= cpu_to_le16(IEEE80211_FCTL_PM);
+        nullfunc->frame_control = fc;
+        memcpy(nullfunc->addr1, sdata->u.mgd.bssid, ETH_ALEN);
+        memcpy(nullfunc->addr2, sdata->dev->dev_addr, ETH_ALEN);
+        memcpy(nullfunc->addr3, sdata->u.mgd.bssid, ETH_ALEN);
+        ieee80211_tx_skb(sdata, skb, 0);
+}
+/* powersave */
+static void ieee80211_enable_ps(struct ieee80211_local *local,
+                                struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_conf *conf = &local->hw.conf;
+        if (conf->dynamic_ps_timeout > 0 &&
+            !(local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_PS)) {
+                mod_timer(&local->dynamic_ps_timer, jiffies +
+                          msecs_to_jiffies(conf->dynamic_ps_timeout));
+        } else {
+                if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK)
+                        ieee80211_send_nullfunc(local, sdata, 1);
+                conf->flags |= IEEE80211_CONF_PS;
+                ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
+        }
+}
+static void ieee80211_change_ps(struct ieee80211_local *local)
+{
+        struct ieee80211_conf *conf = &local->hw.conf;
+        if (local->ps_sdata) {
+                if (!(local->ps_sdata->u.mgd.flags & IEEE80211_STA_ASSOCIATED))
+                        return;
+                ieee80211_enable_ps(local, local->ps_sdata);
+        } else if (conf->flags & IEEE80211_CONF_PS) {
+                conf->flags &= ~IEEE80211_CONF_PS;
+                ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
+                del_timer_sync(&local->dynamic_ps_timer);
+                cancel_work_sync(&local->dynamic_ps_enable_work);
+        }
+}
+/* need to hold RTNL or interface lock */
+void ieee80211_recalc_ps(struct ieee80211_local *local, s32 latency)
+{
+        struct ieee80211_sub_if_data *sdata, *found = NULL;
+        int count = 0;
+        if (!(local->hw.flags & IEEE80211_HW_SUPPORTS_PS)) {
+                local->ps_sdata = NULL;
+                return;
+        }
+        list_for_each_entry(sdata, &local->interfaces, list) {
+                if (!netif_running(sdata->dev))
+                        continue;
+                if (sdata->vif.type != NL80211_IFTYPE_STATION)
+                        continue;
+                found = sdata;
+                count++;
+        }
+        if (count == 1 && found->u.mgd.powersave) {
+                s32 beaconint_us;
+                if (latency < 0)
+                        latency = pm_qos_requirement(PM_QOS_NETWORK_LATENCY);
+                beaconint_us = ieee80211_tu_to_usec(
+                                        found->vif.bss_conf.beacon_int);
+                if (beaconint_us > latency) {
+                        local->ps_sdata = NULL;
+                } else {
+                        u8 dtimper = found->vif.bss_conf.dtim_period;
+                        int maxslp = 1;
+                        if (dtimper > 1)
+                                maxslp = min_t(int, dtimper,
+                                                    latency / beaconint_us);
+                        local->hw.conf.max_sleep_interval = maxslp;
+                        local->ps_sdata = found;
+                }
+        } else {
+                local->ps_sdata = NULL;
+        }
+        ieee80211_change_ps(local);
+}
+void ieee80211_dynamic_ps_disable_work(struct work_struct *work)
+{
+        struct ieee80211_local *local =
+                container_of(work, struct ieee80211_local,
+                             dynamic_ps_disable_work);
+        if (local->hw.conf.flags & IEEE80211_CONF_PS) {
+                local->hw.conf.flags &= ~IEEE80211_CONF_PS;
+                ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
+        }
+        ieee80211_wake_queues_by_reason(&local->hw,
+                                        IEEE80211_QUEUE_STOP_REASON_PS);
+}
+void ieee80211_dynamic_ps_enable_work(struct work_struct *work)
+{
+        struct ieee80211_local *local =
+                container_of(work, struct ieee80211_local,
+                             dynamic_ps_enable_work);
+        struct ieee80211_sub_if_data *sdata = local->ps_sdata;
+        /* can only happen when PS was just disabled anyway */
+        if (!sdata)
+                return;
+        if (local->hw.conf.flags & IEEE80211_CONF_PS)
+                return;
+        if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK)
+                ieee80211_send_nullfunc(local, sdata, 1);
+        local->hw.conf.flags |= IEEE80211_CONF_PS;
+        ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
+}
+void ieee80211_dynamic_ps_timer(unsigned long data)
+{
+        struct ieee80211_local *local = (void *) data;
+        queue_work(local->hw.workqueue, &local->dynamic_ps_enable_work);
+}
 /* MLME */
 static void ieee80211_sta_wmm_params(struct ieee80211_local *local,
                                     struct ieee80211_if_managed *ifmgd,
@@ -435,30 +684,6 @@ static void ieee80211_sta_wmm_params(struct ieee80211_local *local,
        }
 }
-static bool ieee80211_check_tim(struct ieee802_11_elems *elems, u16 aid)
-{
-        u8 mask;
-        u8 index, indexn1, indexn2;
-        struct ieee80211_tim_ie *tim = (struct ieee80211_tim_ie *) elems->tim;
-        if (unlikely(!tim || elems->tim_len < 4))
-                return false;
-        aid &= 0x3fff;
-        index = aid / 8;
-        mask  = 1 << (aid & 7);
-        indexn1 = tim->bitmap_ctrl & 0xfe;
-        indexn2 = elems->tim_len + indexn1 - 4;
-        if (index < indexn1 || index > indexn2)
-                return false;
-        index -= indexn1;
-        return !!(tim->virtual_map[index] & mask);
-}
 static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,
                                           u16 capab, bool erp_valid, u8 erp)
 {
@@ -634,18 +859,11 @@ static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
        bss_info_changed |= BSS_CHANGED_BASIC_RATES;
        ieee80211_bss_info_change_notify(sdata, bss_info_changed);
-        if (local->powersave) {
+        /* will be same as sdata */
-                if (!(local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_PS) &&
+        if (local->ps_sdata) {
-                    local->hw.conf.dynamic_ps_timeout > 0) {
+                mutex_lock(&local->iflist_mtx);
-                        mod_timer(&local->dynamic_ps_timer, jiffies +
+                ieee80211_recalc_ps(local, -1);
-                                  msecs_to_jiffies(
+                mutex_unlock(&local->iflist_mtx);
-                                        local->hw.conf.dynamic_ps_timeout));
-                } else {
-                        if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK)
-                                ieee80211_send_nullfunc(local, sdata, 1);
-                        conf->flags |= IEEE80211_CONF_PS;
-                        ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
-                }
        }
        netif_tx_start_all_queues(sdata->dev);
@@ -714,7 +932,7 @@ static void ieee80211_authenticate(struct ieee80211_sub_if_data *sdata)
                       " timed out\n",
                       sdata->dev->name, ifmgd->bssid);
                ifmgd->state = IEEE80211_STA_MLME_DISABLED;
-                ieee80211_sta_send_apinfo(sdata);
+                cfg80211_send_auth_timeout(sdata->dev, ifmgd->bssid);
                ieee80211_rx_bss_remove(sdata, ifmgd->bssid,
                                sdata->local->hw.conf.channel->center_freq,
                                ifmgd->ssid, ifmgd->ssid_len);
@@ -897,7 +1115,7 @@ static void ieee80211_associate(struct ieee80211_sub_if_data *sdata)
                       " timed out\n",
                       sdata->dev->name, ifmgd->bssid);
                ifmgd->state = IEEE80211_STA_MLME_DISABLED;
-                ieee80211_sta_send_apinfo(sdata);
+                cfg80211_send_assoc_timeout(sdata->dev, ifmgd->bssid);
                ieee80211_rx_bss_remove(sdata, ifmgd->bssid,
                                sdata->local->hw.conf.channel->center_freq,
                                ifmgd->ssid, ifmgd->ssid_len);
@@ -1187,7 +1405,7 @@ static void ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata,
        ieee80211_set_disassoc(sdata, true, false, 0);
        ifmgd->flags &= ~IEEE80211_STA_AUTHENTICATED;
-        cfg80211_send_rx_deauth(sdata->dev, (u8 *) mgmt, len);
+        cfg80211_send_deauth(sdata->dev, (u8 *) mgmt, len);
 }
@@ -1218,7 +1436,7 @@ static void ieee80211_rx_mgmt_disassoc(struct ieee80211_sub_if_data *sdata,
        }
        ieee80211_set_disassoc(sdata, false, false, reason_code);
-        cfg80211_send_rx_disassoc(sdata->dev, (u8 *) mgmt, len);
+        cfg80211_send_disassoc(sdata->dev, (u8 *) mgmt, len);
 }
@@ -1287,6 +1505,11 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
                 * association next time. This works around some broken APs
                 * which do not correctly reject reassociation requests. */
                ifmgd->flags &= ~IEEE80211_STA_PREV_BSSID_SET;
+                cfg80211_send_rx_assoc(sdata->dev, (u8 *) mgmt, len);
+                if (ifmgd->flags & IEEE80211_STA_EXT_SME) {
+                        /* Wait for SME to decide what to do next */
+                        ifmgd->state = IEEE80211_STA_MLME_DISABLED;
+                }
                return;
        }
@@ -1518,46 +1741,74 @@ static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_sub_if_data *sdata,
                ifmgd->flags &= ~IEEE80211_STA_PROBEREQ_POLL;
 }
+/*
+ * This is the canonical list of information elements we care about,
+ * the filter code also gives us all changes to the Microsoft OUI
+ * (00:50:F2) vendor IE which is used for WMM which we need to track.
+ *
+ * We implement beacon filtering in software since that means we can
+ * avoid processing the frame here and in cfg80211, and userspace
+ * will not be able to tell whether the hardware supports it or not.
+ *
+ * XXX: This list needs to be dynamic -- userspace needs to be able to
+ *      add items it requires. It also needs to be able to tell us to
+ *      look out for other vendor IEs.
+ */
+static const u64 care_about_ies =
+        (1ULL << WLAN_EID_COUNTRY) |
+        (1ULL << WLAN_EID_ERP_INFO) |
+        (1ULL << WLAN_EID_CHANNEL_SWITCH) |
+        (1ULL << WLAN_EID_PWR_CONSTRAINT) |
+        (1ULL << WLAN_EID_HT_CAPABILITY) |
+        (1ULL << WLAN_EID_HT_INFORMATION);
 static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
                                     struct ieee80211_mgmt *mgmt,
                                     size_t len,
                                     struct ieee80211_rx_status *rx_status)
 {
-        struct ieee80211_if_managed *ifmgd;
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
        size_t baselen;
        struct ieee802_11_elems elems;
        struct ieee80211_local *local = sdata->local;
        u32 changed = 0;
-        bool erp_valid, directed_tim;
+        bool erp_valid, directed_tim = false;
        u8 erp_value = 0;
+        u32 ncrc;
        /* Process beacon from the current BSS */
        baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
        if (baselen > len)
                return;
-        ieee802_11_parse_elems(mgmt->u.beacon.variable, len - baselen, &elems);
+        if (rx_status->freq != local->hw.conf.channel->center_freq)
-        ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems, true);
-        if (sdata->vif.type != NL80211_IFTYPE_STATION)
                return;
-        ifmgd = &sdata->u.mgd;
        if (!(ifmgd->flags & IEEE80211_STA_ASSOCIATED) ||
            memcmp(ifmgd->bssid, mgmt->bssid, ETH_ALEN) != 0)
                return;
-        if (rx_status->freq != local->hw.conf.channel->center_freq)
+        ncrc = crc32_be(0, (void *)&mgmt->u.beacon.beacon_int, 4);
+        ncrc = ieee802_11_parse_elems_crc(mgmt->u.beacon.variable,
+                                          len - baselen, &elems,
+                                          care_about_ies, ncrc);
+        if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK)
+                directed_tim = ieee80211_check_tim(elems.tim, elems.tim_len,
+                                                   ifmgd->aid);
+        ncrc = crc32_be(ncrc, (void *)&directed_tim, sizeof(directed_tim));
+        if (ncrc == ifmgd->beacon_crc)
                return;
+        ifmgd->beacon_crc = ncrc;
+        ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems, true);
        ieee80211_sta_wmm_params(local, ifmgd, elems.wmm_param,
                                 elems.wmm_param_len);
        if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK) {
-                directed_tim = ieee80211_check_tim(&elems, ifmgd->aid);
                if (directed_tim) {
                        if (local->hw.conf.dynamic_ps_timeout > 0) {
                                local->hw.conf.flags &= ~IEEE80211_CONF_PS;
@@ -1930,6 +2181,7 @@ static void ieee80211_restart_sta_timer(struct ieee80211_sub_if_data *sdata)
 void ieee80211_sta_setup_sdata(struct ieee80211_sub_if_data *sdata)
 {
        struct ieee80211_if_managed *ifmgd;
+        u32 hw_flags;
        ifmgd = &sdata->u.mgd;
        INIT_WORK(&ifmgd->work, ieee80211_sta_work);
@@ -1949,6 +2201,13 @@ void ieee80211_sta_setup_sdata(struct ieee80211_sub_if_data *sdata)
                IEEE80211_STA_AUTO_CHANNEL_SEL;
        if (sdata->local->hw.queues >= 4)
                ifmgd->flags |= IEEE80211_STA_WMM_ENABLED;
+        hw_flags = sdata->local->hw.flags;
+        if (hw_flags & IEEE80211_HW_SUPPORTS_PS) {
+                ifmgd->powersave = CONFIG_MAC80211_DEFAULT_PS_VALUE;
+                sdata->local->hw.conf.dynamic_ps_timeout = 500;
+        }
 }
 /* configuration hooks */
@@ -2068,9 +2327,6 @@ int ieee80211_sta_deauthenticate(struct ieee80211_sub_if_data *sdata, u16 reason
        printk(KERN_DEBUG "%s: deauthenticating by local choice (reason=%d)\n",
               sdata->dev->name, reason);
-        if (sdata->vif.type != NL80211_IFTYPE_STATION)
-                return -EINVAL;
        ieee80211_set_disassoc(sdata, true, true, reason);
        return 0;
 }
@@ -2082,9 +2338,6 @@ int ieee80211_sta_disassociate(struct ieee80211_sub_if_data *sdata, u16 reason)
        printk(KERN_DEBUG "%s: disassociating by local choice (reason=%d)\n",
               sdata->dev->name, reason);
-        if (sdata->vif.type != NL80211_IFTYPE_STATION)
-                return -EINVAL;
        if (!(ifmgd->flags & IEEE80211_STA_ASSOCIATED))
                return -ENOLINK;
@@ -2104,75 +2357,17 @@ void ieee80211_mlme_notify_scan_completed(struct ieee80211_local *local)
        rcu_read_unlock();
 }
-void ieee80211_dynamic_ps_disable_work(struct work_struct *work)
+int ieee80211_max_network_latency(struct notifier_block *nb,
+                                  unsigned long data, void *dummy)
 {
+        s32 latency_usec = (s32) data;
        struct ieee80211_local *local =
-                container_of(work, struct ieee80211_local,
+                container_of(nb, struct ieee80211_local,
-                             dynamic_ps_disable_work);
+                             network_latency_notifier);
-        if (local->hw.conf.flags & IEEE80211_CONF_PS) {
+        mutex_lock(&local->iflist_mtx);
-                local->hw.conf.flags &= ~IEEE80211_CONF_PS;
+        ieee80211_recalc_ps(local, latency_usec);
-                ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
+        mutex_unlock(&local->iflist_mtx);
-        }
-        ieee80211_wake_queues_by_reason(&local->hw,
-                                        IEEE80211_QUEUE_STOP_REASON_PS);
-}
-void ieee80211_dynamic_ps_enable_work(struct work_struct *work)
-{
-        struct ieee80211_local *local =
-                container_of(work, struct ieee80211_local,
-                             dynamic_ps_enable_work);
-        /* XXX: using scan_sdata is completely broken! */
-        struct ieee80211_sub_if_data *sdata = local->scan_sdata;
-        if (local->hw.conf.flags & IEEE80211_CONF_PS)
-                return;
-        if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK && sdata)
-                ieee80211_send_nullfunc(local, sdata, 1);
-        local->hw.conf.flags |= IEEE80211_CONF_PS;
-        ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
-}
-void ieee80211_dynamic_ps_timer(unsigned long data)
+        return 0;
-{
-        struct ieee80211_local *local = (void *) data;
-        queue_work(local->hw.workqueue, &local->dynamic_ps_enable_work);
-}
-void ieee80211_send_nullfunc(struct ieee80211_local *local,
-                             struct ieee80211_sub_if_data *sdata,
-                             int powersave)
-{
-        struct sk_buff *skb;
-        struct ieee80211_hdr *nullfunc;
-        __le16 fc;
-        if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
-                return;
-        skb = dev_alloc_skb(local->hw.extra_tx_headroom + 24);
-        if (!skb) {
-                printk(KERN_DEBUG "%s: failed to allocate buffer for nullfunc "
-                       "frame\n", sdata->dev->name);
-                return;
-        }
-        skb_reserve(skb, local->hw.extra_tx_headroom);
-        nullfunc = (struct ieee80211_hdr *) skb_put(skb, 24);
-        memset(nullfunc, 0, 24);
-        fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_NULLFUNC |
-                         IEEE80211_FCTL_TODS);
-        if (powersave)
-                fc |= cpu_to_le16(IEEE80211_FCTL_PM);
-        nullfunc->frame_control = fc;
-        memcpy(nullfunc->addr1, sdata->u.mgd.bssid, ETH_ALEN);
-        memcpy(nullfunc->addr2, sdata->dev->dev_addr, ETH_ALEN);
-        memcpy(nullfunc->addr3, sdata->u.mgd.bssid, ETH_ALEN);
-        ieee80211_tx_skb(sdata, skb, 0);
 }
diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c
index 81985d27cbda..b38986c9deef 100644
--- a/net/mac80211/pm.c
+++ b/net/mac80211/pm.c
@@ -72,119 +72,8 @@ int __ieee80211_suspend(struct ieee80211_hw *hw)
        return 0;
 }
-int __ieee80211_resume(struct ieee80211_hw *hw)
+/*
-{
+ * __ieee80211_resume() is a static inline which just calls
-        struct ieee80211_local *local = hw_to_local(hw);
+ * ieee80211_reconfig(), which is also needed for hardware
-        struct ieee80211_sub_if_data *sdata;
+ * hang/firmware failure/etc. recovery.
-        struct ieee80211_if_init_conf conf;
+ */
-        struct sta_info *sta;
-        unsigned long flags;
-        int res;
-        /* restart hardware */
-        if (local->open_count) {
-                res = local->ops->start(hw);
-                ieee80211_led_radio(local, hw->conf.radio_enabled);
-        }
-        /* add interfaces */
-        list_for_each_entry(sdata, &local->interfaces, list) {
-                if (sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
-                    sdata->vif.type != NL80211_IFTYPE_MONITOR &&
-                    netif_running(sdata->dev)) {
-                        conf.vif = &sdata->vif;
-                        conf.type = sdata->vif.type;
-                        conf.mac_addr = sdata->dev->dev_addr;
-                        res = local->ops->add_interface(hw, &conf);
-                }
-        }
-        /* add STAs back */
-        if (local->ops->sta_notify) {
-                spin_lock_irqsave(&local->sta_lock, flags);
-                list_for_each_entry(sta, &local->sta_list, list) {
-                        if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
-                                sdata = container_of(sdata->bss,
-                                             struct ieee80211_sub_if_data,
-                                             u.ap);
-                        local->ops->sta_notify(hw, &sdata->vif,
-                                STA_NOTIFY_ADD, &sta->sta);
-                }
-                spin_unlock_irqrestore(&local->sta_lock, flags);
-        }
-        /* Clear Suspend state so that ADDBA requests can be processed */
-        rcu_read_lock();
-        if (hw->flags & IEEE80211_HW_AMPDU_AGGREGATION) {
-                list_for_each_entry_rcu(sta, &local->sta_list, list) {
-                        clear_sta_flags(sta, WLAN_STA_SUSPEND);
-                }
-        }
-        rcu_read_unlock();
-        /* add back keys */
-        list_for_each_entry(sdata, &local->interfaces, list)
-                if (netif_running(sdata->dev))
-                        ieee80211_enable_keys(sdata);
-        /* setup RTS threshold */
-        if (local->ops->set_rts_threshold)
-                local->ops->set_rts_threshold(hw, local->rts_threshold);
-        /* reconfigure hardware */
-        ieee80211_hw_config(local, ~0);
-        netif_addr_lock_bh(local->mdev);
-        ieee80211_configure_filter(local);
-        netif_addr_unlock_bh(local->mdev);
-        /* Finally also reconfigure all the BSS information */
-        list_for_each_entry(sdata, &local->interfaces, list) {
-                u32 changed = ~0;
-                if (!netif_running(sdata->dev))
-                        continue;
-                switch (sdata->vif.type) {
-                case NL80211_IFTYPE_STATION:
-                        /* disable beacon change bits */
-                        changed &= ~IEEE80211_IFCC_BEACON;
-                        /* fall through */
-                case NL80211_IFTYPE_ADHOC:
-                case NL80211_IFTYPE_AP:
-                case NL80211_IFTYPE_MESH_POINT:
-                        /*
-                         * Driver's config_interface can fail if rfkill is
-                         * enabled. Accommodate this return code.
-                         * FIXME: When mac80211 has knowledge of rfkill
-                         * state the code below can change back to:
-                         *   WARN(ieee80211_if_config(sdata, changed));
-                         *   ieee80211_bss_info_change_notify(sdata, ~0);
-                         */
-                        if (ieee80211_if_config(sdata, changed))
-                                printk(KERN_DEBUG "%s: failed to configure interface during resume\n",
-                                       sdata->dev->name);
-                        else
-                                ieee80211_bss_info_change_notify(sdata, ~0);
-                        break;
-                case NL80211_IFTYPE_WDS:
-                        break;
-                case NL80211_IFTYPE_AP_VLAN:
-                case NL80211_IFTYPE_MONITOR:
-                        /* ignore virtual */
-                        break;
-                case NL80211_IFTYPE_UNSPECIFIED:
-                case __NL80211_IFTYPE_AFTER_LAST:
-                        WARN_ON(1);
-                        break;
-                }
-        }
-        ieee80211_wake_queues_by_reason(hw,
-                        IEEE80211_QUEUE_STOP_REASON_SUSPEND);
-        return 0;
-}
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 9776f73c51ad..a5afb79dab6e 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -1932,7 +1932,7 @@ static void ieee80211_rx_michael_mic_report(struct net_device *dev,
            !ieee80211_is_auth(hdr->frame_control))
                goto ignore;
-        mac80211_ev_michael_mic_failure(rx->sdata, keyidx, hdr);
+        mac80211_ev_michael_mic_failure(rx->sdata, keyidx, hdr, NULL);
 ignore:
        dev_kfree_skb(rx->skb);
        rx->skb = NULL;
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index 3bf9839f5916..f25b07feabf9 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -253,7 +253,7 @@ static void ieee80211_scan_ps_disable(struct ieee80211_sub_if_data *sdata)
 {
        struct ieee80211_local *local = sdata->local;
-        if (!local->powersave)
+        if (!local->ps_sdata)
                ieee80211_send_nullfunc(local, sdata, 0);
        else {
                /*
@@ -285,12 +285,16 @@ void ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted)
        if (WARN_ON(!local->scan_req))
                return;
+        if (local->hw_scanning) {
+                kfree(local->scan_req->ie);
+                local->scan_req->ie = local->orig_ies;
+                local->scan_req->ie_len = local->orig_ies_len;
+        }
        if (local->scan_req != &local->int_scan_req)
                cfg80211_scan_done(local->scan_req, aborted);
        local->scan_req = NULL;
-        local->last_scan_completed = jiffies;
        if (local->hw_scanning) {
                local->hw_scanning = false;
                /*
@@ -457,12 +461,28 @@ int ieee80211_start_scan(struct ieee80211_sub_if_data *scan_sdata,
        }
        if (local->ops->hw_scan) {
-                int rc;
+                u8 *ies;
+                int rc, ielen;
+                ies = kmalloc(2 + IEEE80211_MAX_SSID_LEN +
+                              local->scan_ies_len + req->ie_len, GFP_KERNEL);
+                if (!ies)
+                        return -ENOMEM;
+                ielen = ieee80211_build_preq_ies(local, ies,
+                                                 req->ie, req->ie_len);
+                local->orig_ies = req->ie;
+                local->orig_ies_len = req->ie_len;
+                req->ie = ies;
+                req->ie_len = ielen;
                local->hw_scanning = true;
                rc = local->ops->hw_scan(local_to_hw(local), req);
                if (rc) {
                        local->hw_scanning = false;
+                        kfree(ies);
+                        req->ie_len = local->orig_ies_len;
+                        req->ie = local->orig_ies;
                        return rc;
                }
                local->scan_sdata = scan_sdata;
diff --git a/net/mac80211/spectmgmt.c b/net/mac80211/spectmgmt.c
index 5f7a2624ed74..48bf78e7fa7a 100644
--- a/net/mac80211/spectmgmt.c
+++ b/net/mac80211/spectmgmt.c
@@ -15,7 +15,7 @@
 */
 #include <linux/ieee80211.h>
-#include <net/wireless.h>
+#include <net/cfg80211.h>
 #include <net/mac80211.h>
 #include "ieee80211_i.h"
 #include "sta_info.h"
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index c5f14e6bbde2..654a8e963ccb 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -686,41 +686,10 @@ static void sta_info_debugfs_add_work(struct work_struct *work)
 }
 #endif
-static void __ieee80211_run_pending_flush(struct ieee80211_local *local)
-{
-        struct sta_info *sta;
-        unsigned long flags;
-        ASSERT_RTNL();
-        spin_lock_irqsave(&local->sta_lock, flags);
-        while (!list_empty(&local->sta_flush_list)) {
-                sta = list_first_entry(&local->sta_flush_list,
-                                       struct sta_info, list);
-                list_del(&sta->list);
-                spin_unlock_irqrestore(&local->sta_lock, flags);
-                sta_info_destroy(sta);
-                spin_lock_irqsave(&local->sta_lock, flags);
-        }
-        spin_unlock_irqrestore(&local->sta_lock, flags);
-}
-static void ieee80211_sta_flush_work(struct work_struct *work)
-{
-        struct ieee80211_local *local =
-                container_of(work, struct ieee80211_local, sta_flush_work);
-        rtnl_lock();
-        __ieee80211_run_pending_flush(local);
-        rtnl_unlock();
-}
 void sta_info_init(struct ieee80211_local *local)
 {
        spin_lock_init(&local->sta_lock);
        INIT_LIST_HEAD(&local->sta_list);
-        INIT_LIST_HEAD(&local->sta_flush_list);
-        INIT_WORK(&local->sta_flush_work, ieee80211_sta_flush_work);
        setup_timer(&local->sta_cleanup, sta_info_cleanup,
                    (unsigned long)local);
@@ -741,7 +710,6 @@ int sta_info_start(struct ieee80211_local *local)
 void sta_info_stop(struct ieee80211_local *local)
 {
        del_timer(&local->sta_cleanup);
-        cancel_work_sync(&local->sta_flush_work);
 #ifdef CONFIG_MAC80211_DEBUGFS
        /*
         * Make sure the debugfs adding work isn't pending after this
@@ -752,10 +720,7 @@ void sta_info_stop(struct ieee80211_local *local)
        cancel_work_sync(&local->sta_debugfs_add);
 #endif
-        rtnl_lock();
        sta_info_flush(local, NULL);
-        __ieee80211_run_pending_flush(local);
-        rtnl_unlock();
 }
 /**
@@ -767,7 +732,7 @@ void sta_info_stop(struct ieee80211_local *local)
 * @sdata: matching rule for the net device (sta->dev) or %NULL to match all STAs
 */
 int sta_info_flush(struct ieee80211_local *local,
-                    struct ieee80211_sub_if_data *sdata)
+                   struct ieee80211_sub_if_data *sdata)
 {
        struct sta_info *sta, *tmp;
        LIST_HEAD(tmp_list);
@@ -775,7 +740,6 @@ int sta_info_flush(struct ieee80211_local *local,
        unsigned long flags;
        might_sleep();
-        ASSERT_RTNL();
        spin_lock_irqsave(&local->sta_lock, flags);
        list_for_each_entry_safe(sta, tmp, &local->sta_list, list) {
@@ -795,39 +759,6 @@ int sta_info_flush(struct ieee80211_local *local,
        return ret;
 }
-/**
- * sta_info_flush_delayed - flush matching STA entries from the STA table
- *
- * This function unlinks all stations for a given interface and queues
- * them for freeing. Note that the workqueue function scheduled here has
- * to run before any new keys can be added to the system to avoid set_key()
- * callback ordering issues.
- *
- * @sdata: the interface
- */
-void sta_info_flush_delayed(struct ieee80211_sub_if_data *sdata)
-{
-        struct ieee80211_local *local = sdata->local;
-        struct sta_info *sta, *tmp;
-        unsigned long flags;
-        bool work = false;
-        spin_lock_irqsave(&local->sta_lock, flags);
-        list_for_each_entry_safe(sta, tmp, &local->sta_list, list) {
-                if (sdata == sta->sdata) {
-                        __sta_info_unlink(&sta);
-                        if (sta) {
-                                list_add_tail(&sta->list,
-                                              &local->sta_flush_list);
-                                work = true;
-                        }
-                }
-        }
-        if (work)
-                schedule_work(&local->sta_flush_work);
-        spin_unlock_irqrestore(&local->sta_lock, flags);
-}
 void ieee80211_sta_expire(struct ieee80211_sub_if_data *sdata,
                          unsigned long exp_time)
 {
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index 5534d489f506..31a8990ce401 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -442,8 +442,7 @@ void sta_info_init(struct ieee80211_local *local);
 int sta_info_start(struct ieee80211_local *local);
 void sta_info_stop(struct ieee80211_local *local);
 int sta_info_flush(struct ieee80211_local *local,
-                    struct ieee80211_sub_if_data *sdata);
+                   struct ieee80211_sub_if_data *sdata);
-void sta_info_flush_delayed(struct ieee80211_sub_if_data *sdata);
 void ieee80211_sta_expire(struct ieee80211_sub_if_data *sdata,
                          unsigned long exp_time);
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 3fb04a86444d..1865622003c9 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -409,8 +409,24 @@ ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx)
                       sta->sta.addr);
        }
 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
-        clear_sta_flags(sta, WLAN_STA_PSPOLL);
+        if (test_and_clear_sta_flags(sta, WLAN_STA_PSPOLL)) {
+                /*
+                 * The sleeping station with pending data is now snoozing.
+                 * It queried us for its buffered frames and will go back
+                 * to deep sleep once it got everything.
+                 *
+                 * inform the driver, in case the hardware does powersave
+                 * frame filtering and keeps a station  blacklist on its own
+                 * (e.g: p54), so that frames can be delivered unimpeded.
+                 *
+                 * Note: It should be save to disable the filter now.
+                 * As, it is really unlikely that we still have any pending
+                 * frame for this station in the hw's buffers/fifos left,
+                 * that is not rejected with a unsuccessful tx_status yet.
+                 */
+                info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT;
+        }
        return TX_CONTINUE;
 }
@@ -429,7 +445,7 @@ ieee80211_tx_h_ps_buf(struct ieee80211_tx_data *tx)
 static ieee80211_tx_result debug_noinline
 ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx)
 {
-        struct ieee80211_key *key;
+        struct ieee80211_key *key = NULL;
        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
@@ -500,7 +516,7 @@ ieee80211_tx_h_rate_ctrl(struct ieee80211_tx_data *tx)
        sband = tx->local->hw.wiphy->bands[tx->channel->band];
        len = min_t(int, tx->skb->len + FCS_LEN,
-                         tx->local->fragmentation_threshold);
+                         tx->local->hw.wiphy->frag_threshold);
        /* set up the tx rate control struct we give the RC algo */
        txrc.hw = local_to_hw(tx->local);
@@ -511,8 +527,7 @@ ieee80211_tx_h_rate_ctrl(struct ieee80211_tx_data *tx)
        txrc.max_rate_idx = tx->sdata->max_ratectrl_rateidx;
        /* set up RTS protection if desired */
-        if (tx->local->rts_threshold < IEEE80211_MAX_RTS_THRESHOLD &&
+        if (len > tx->local->hw.wiphy->rts_threshold) {
-            len > tx->local->rts_threshold) {
                txrc.rts = rts = true;
        }
@@ -754,7 +769,7 @@ ieee80211_tx_h_fragment(struct ieee80211_tx_data *tx)
        struct sk_buff *skb = tx->skb;
        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
        struct ieee80211_hdr *hdr = (void *)skb->data;
-        int frag_threshold = tx->local->fragmentation_threshold;
+        int frag_threshold = tx->local->hw.wiphy->frag_threshold;
        int hdrlen;
        int fragnum;
@@ -1072,7 +1087,7 @@ __ieee80211_tx_prepare(struct ieee80211_tx_data *tx,
        if (tx->flags & IEEE80211_TX_FRAGMENTED) {
                if ((tx->flags & IEEE80211_TX_UNICAST) &&
-                    skb->len + FCS_LEN > local->fragmentation_threshold &&
+                    skb->len + FCS_LEN > local->hw.wiphy->frag_threshold &&
                    !(info->flags & IEEE80211_TX_CTL_AMPDU))
                        tx->flags |= IEEE80211_TX_FRAGMENTED;
                else
@@ -2086,18 +2101,18 @@ struct sk_buff *ieee80211_beacon_get(struct ieee80211_hw *hw,
        } else if (sdata->vif.type == NL80211_IFTYPE_ADHOC) {
                struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
                struct ieee80211_hdr *hdr;
+                struct sk_buff *presp = rcu_dereference(ifibss->presp);
-                if (!ifibss->probe_resp)
+                if (!presp)
                        goto out;
-                skb = skb_copy(ifibss->probe_resp, GFP_ATOMIC);
+                skb = skb_copy(presp, GFP_ATOMIC);
                if (!skb)
                        goto out;
                hdr = (struct ieee80211_hdr *) skb->data;
                hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
                                                 IEEE80211_STYPE_BEACON);
        } else if (ieee80211_vif_is_mesh(&sdata->vif)) {
                struct ieee80211_mgmt *mgmt;
                u8 *pos;
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index fdf432f14554..61876eb50b49 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -20,6 +20,7 @@
 #include <linux/if_arp.h>
 #include <linux/wireless.h>
 #include <linux/bitmap.h>
+#include <linux/crc32.h>
 #include <net/net_namespace.h>
 #include <net/cfg80211.h>
 #include <net/rtnetlink.h>
@@ -28,6 +29,7 @@
 #include "rate.h"
 #include "mesh.h"
 #include "wme.h"
+#include "led.h"
 /* privid for wiphys to determine whether they belong to us or not */
 void *mac80211_wiphy_privid = &mac80211_wiphy_privid;
@@ -536,8 +538,16 @@ EXPORT_SYMBOL_GPL(ieee80211_iterate_active_interfaces_atomic);
 void ieee802_11_parse_elems(u8 *start, size_t len,
                            struct ieee802_11_elems *elems)
 {
+        ieee802_11_parse_elems_crc(start, len, elems, 0, 0);
+}
+u32 ieee802_11_parse_elems_crc(u8 *start, size_t len,
+                               struct ieee802_11_elems *elems,
+                               u64 filter, u32 crc)
+{
        size_t left = len;
        u8 *pos = start;
+        bool calc_crc = filter != 0;
        memset(elems, 0, sizeof(*elems));
        elems->ie_start = start;
@@ -551,7 +561,10 @@ void ieee802_11_parse_elems(u8 *start, size_t len,
                left -= 2;
                if (elen > left)
-                        return;
+                        break;
+                if (calc_crc && id < 64 && (filter & BIT(id)))
+                        crc = crc32_be(crc, pos - 2, elen + 2);
                switch (id) {
                case WLAN_EID_SSID:
@@ -575,8 +588,10 @@ void ieee802_11_parse_elems(u8 *start, size_t len,
                        elems->cf_params_len = elen;
                        break;
                case WLAN_EID_TIM:
-                        elems->tim = pos;
+                        if (elen >= sizeof(struct ieee80211_tim_ie)) {
-                        elems->tim_len = elen;
+                                elems->tim = (void *)pos;
+                                elems->tim_len = elen;
+                        }
                        break;
                case WLAN_EID_IBSS_PARAMS:
                        elems->ibss_params = pos;
@@ -586,15 +601,20 @@ void ieee802_11_parse_elems(u8 *start, size_t len,
                        elems->challenge = pos;
                        elems->challenge_len = elen;
                        break;
-                case WLAN_EID_WPA:
+                case WLAN_EID_VENDOR_SPECIFIC:
                        if (elen >= 4 && pos[0] == 0x00 && pos[1] == 0x50 &&
                            pos[2] == 0xf2) {
                                /* Microsoft OUI (00:50:F2) */
+                                if (calc_crc)
+                                        crc = crc32_be(crc, pos - 2, elen + 2);
                                if (pos[3] == 1) {
                                        /* OUI Type 1 - WPA IE */
                                        elems->wpa = pos;
                                        elems->wpa_len = elen;
                                } else if (elen >= 5 && pos[3] == 2) {
+                                        /* OUI Type 2 - WMM IE */
                                        if (pos[4] == 0) {
                                                elems->wmm_info = pos;
                                                elems->wmm_info_len = elen;
@@ -679,6 +699,8 @@ void ieee802_11_parse_elems(u8 *start, size_t len,
                left -= elen;
                pos += elen;
        }
+        return crc;
 }
 void ieee80211_set_wmm_default(struct ieee80211_sub_if_data *sdata)
@@ -831,16 +853,73 @@ void ieee80211_send_auth(struct ieee80211_sub_if_data *sdata,
        ieee80211_tx_skb(sdata, skb, encrypt);
 }
+int ieee80211_build_preq_ies(struct ieee80211_local *local, u8 *buffer,
+                             const u8 *ie, size_t ie_len)
+{
+        struct ieee80211_supported_band *sband;
+        u8 *pos, *supp_rates_len, *esupp_rates_len = NULL;
+        int i;
+        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
+        pos = buffer;
+        *pos++ = WLAN_EID_SUPP_RATES;
+        supp_rates_len = pos;
+        *pos++ = 0;
+        for (i = 0; i < sband->n_bitrates; i++) {
+                struct ieee80211_rate *rate = &sband->bitrates[i];
+                if (esupp_rates_len) {
+                        *esupp_rates_len += 1;
+                } else if (*supp_rates_len == 8) {
+                        *pos++ = WLAN_EID_EXT_SUPP_RATES;
+                        esupp_rates_len = pos;
+                        *pos++ = 1;
+                } else
+                        *supp_rates_len += 1;
+                *pos++ = rate->bitrate / 5;
+        }
+        if (sband->ht_cap.ht_supported) {
+                __le16 tmp = cpu_to_le16(sband->ht_cap.cap);
+                *pos++ = WLAN_EID_HT_CAPABILITY;
+                *pos++ = sizeof(struct ieee80211_ht_cap);
+                memset(pos, 0, sizeof(struct ieee80211_ht_cap));
+                memcpy(pos, &tmp, sizeof(u16));
+                pos += sizeof(u16);
+                /* TODO: needs a define here for << 2 */
+                *pos++ = sband->ht_cap.ampdu_factor |
+                         (sband->ht_cap.ampdu_density << 2);
+                memcpy(pos, &sband->ht_cap.mcs, sizeof(sband->ht_cap.mcs));
+                pos += sizeof(sband->ht_cap.mcs);
+                pos += 2 + 4 + 1; /* ext info, BF cap, antsel */
+        }
+        /*
+         * If adding more here, adjust code in main.c
+         * that calculates local->scan_ies_len.
+         */
+        if (ie) {
+                memcpy(pos, ie, ie_len);
+                pos += ie_len;
+        }
+        return pos - buffer;
+}
 void ieee80211_send_probe_req(struct ieee80211_sub_if_data *sdata, u8 *dst,
-                              u8 *ssid, size_t ssid_len,
+                              const u8 *ssid, size_t ssid_len,
-                              u8 *ie, size_t ie_len)
+                              const u8 *ie, size_t ie_len)
 {
        struct ieee80211_local *local = sdata->local;
-        struct ieee80211_supported_band *sband;
        struct sk_buff *skb;
        struct ieee80211_mgmt *mgmt;
-        u8 *pos, *supp_rates, *esupp_rates = NULL;
+        u8 *pos;
-        int i;
        skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*mgmt) + 200 +
                            ie_len);
@@ -867,31 +946,9 @@ void ieee80211_send_probe_req(struct ieee80211_sub_if_data *sdata, u8 *dst,
        *pos++ = WLAN_EID_SSID;
        *pos++ = ssid_len;
        memcpy(pos, ssid, ssid_len);
+        pos += ssid_len;
-        supp_rates = skb_put(skb, 2);
+        skb_put(skb, ieee80211_build_preq_ies(local, pos, ie, ie_len));
-        supp_rates[0] = WLAN_EID_SUPP_RATES;
-        supp_rates[1] = 0;
-        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
-        for (i = 0; i < sband->n_bitrates; i++) {
-                struct ieee80211_rate *rate = &sband->bitrates[i];
-                if (esupp_rates) {
-                        pos = skb_put(skb, 1);
-                        esupp_rates[1]++;
-                } else if (supp_rates[1] == 8) {
-                        esupp_rates = skb_put(skb, 3);
-                        esupp_rates[0] = WLAN_EID_EXT_SUPP_RATES;
-                        esupp_rates[1] = 1;
-                        pos = &esupp_rates[2];
-                } else {
-                        pos = skb_put(skb, 1);
-                        supp_rates[1]++;
-                }
-                *pos = rate->bitrate / 5;
-        }
-        if (ie)
-                memcpy(skb_put(skb, ie_len), ie, ie_len);
        ieee80211_tx_skb(sdata, skb, 0);
 }
@@ -931,3 +988,120 @@ u32 ieee80211_sta_get_rates(struct ieee80211_local *local,
        }
        return supp_rates;
 }
+int ieee80211_reconfig(struct ieee80211_local *local)
+{
+        struct ieee80211_hw *hw = &local->hw;
+        struct ieee80211_sub_if_data *sdata;
+        struct ieee80211_if_init_conf conf;
+        struct sta_info *sta;
+        unsigned long flags;
+        int res;
+        /* restart hardware */
+        if (local->open_count) {
+                res = local->ops->start(hw);
+                ieee80211_led_radio(local, hw->conf.radio_enabled);
+        }
+        /* add interfaces */
+        list_for_each_entry(sdata, &local->interfaces, list) {
+                if (sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
+                    sdata->vif.type != NL80211_IFTYPE_MONITOR &&
+                    netif_running(sdata->dev)) {
+                        conf.vif = &sdata->vif;
+                        conf.type = sdata->vif.type;
+                        conf.mac_addr = sdata->dev->dev_addr;
+                        res = local->ops->add_interface(hw, &conf);
+                }
+        }
+        /* add STAs back */
+        if (local->ops->sta_notify) {
+                spin_lock_irqsave(&local->sta_lock, flags);
+                list_for_each_entry(sta, &local->sta_list, list) {
+                        if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
+                                sdata = container_of(sdata->bss,
+                                             struct ieee80211_sub_if_data,
+                                             u.ap);
+                        local->ops->sta_notify(hw, &sdata->vif,
+                                STA_NOTIFY_ADD, &sta->sta);
+                }
+                spin_unlock_irqrestore(&local->sta_lock, flags);
+        }
+        /* Clear Suspend state so that ADDBA requests can be processed */
+        rcu_read_lock();
+        if (hw->flags & IEEE80211_HW_AMPDU_AGGREGATION) {
+                list_for_each_entry_rcu(sta, &local->sta_list, list) {
+                        clear_sta_flags(sta, WLAN_STA_SUSPEND);
+                }
+        }
+        rcu_read_unlock();
+        /* setup RTS threshold */
+        if (local->ops->set_rts_threshold)
+                local->ops->set_rts_threshold(hw, hw->wiphy->rts_threshold);
+        /* reconfigure hardware */
+        ieee80211_hw_config(local, ~0);
+        netif_addr_lock_bh(local->mdev);
+        ieee80211_configure_filter(local);
+        netif_addr_unlock_bh(local->mdev);
+        /* Finally also reconfigure all the BSS information */
+        list_for_each_entry(sdata, &local->interfaces, list) {
+                u32 changed = ~0;
+                if (!netif_running(sdata->dev))
+                        continue;
+                switch (sdata->vif.type) {
+                case NL80211_IFTYPE_STATION:
+                        /* disable beacon change bits */
+                        changed &= ~IEEE80211_IFCC_BEACON;
+                        /* fall through */
+                case NL80211_IFTYPE_ADHOC:
+                case NL80211_IFTYPE_AP:
+                case NL80211_IFTYPE_MESH_POINT:
+                        /*
+                         * Driver's config_interface can fail if rfkill is
+                         * enabled. Accommodate this return code.
+                         * FIXME: When mac80211 has knowledge of rfkill
+                         * state the code below can change back to:
+                         *   WARN(ieee80211_if_config(sdata, changed));
+                         *   ieee80211_bss_info_change_notify(sdata, ~0);
+                         */
+                        if (ieee80211_if_config(sdata, changed))
+                                printk(KERN_DEBUG "%s: failed to configure interface during resume\n",
+                                       sdata->dev->name);
+                        else
+                                ieee80211_bss_info_change_notify(sdata, ~0);
+                        break;
+                case NL80211_IFTYPE_WDS:
+                        break;
+                case NL80211_IFTYPE_AP_VLAN:
+                case NL80211_IFTYPE_MONITOR:
+                        /* ignore virtual */
+                        break;
+                case NL80211_IFTYPE_UNSPECIFIED:
+                case __NL80211_IFTYPE_AFTER_LAST:
+                        WARN_ON(1);
+                        break;
+                }
+        }
+        /* add back keys */
+        list_for_each_entry(sdata, &local->interfaces, list)
+                if (netif_running(sdata->dev))
+                        ieee80211_enable_keys(sdata);
+        ieee80211_wake_queues_by_reason(hw,
+                        IEEE80211_QUEUE_STOP_REASON_SUSPEND);
+        return 0;
+}
diff --git a/net/mac80211/wext.c b/net/mac80211/wext.c
index 959aa8379ccf..1a649da42c41 100644
--- a/net/mac80211/wext.c
+++ b/net/mac80211/wext.c
@@ -149,17 +149,14 @@ static int ieee80211_ioctl_siwfreq(struct net_device *dev,
        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
        if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
-                sdata->u.ibss.flags &= ~IEEE80211_IBSS_AUTO_CHANNEL_SEL;
+                return cfg80211_ibss_wext_siwfreq(dev, info, freq, extra);
        else if (sdata->vif.type == NL80211_IFTYPE_STATION)
                sdata->u.mgd.flags &= ~IEEE80211_STA_AUTO_CHANNEL_SEL;
        /* freq->e == 0: freq->m = channel; otherwise freq = m * 10^e */
        if (freq->e == 0) {
                if (freq->m < 0) {
-                        if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
+                        if (sdata->vif.type == NL80211_IFTYPE_STATION)
-                                sdata->u.ibss.flags |=
-                                        IEEE80211_IBSS_AUTO_CHANNEL_SEL;
-                        else if (sdata->vif.type == NL80211_IFTYPE_STATION)
                                sdata->u.mgd.flags |=
                                        IEEE80211_STA_AUTO_CHANNEL_SEL;
                        return 0;
@@ -183,6 +180,10 @@ static int ieee80211_ioctl_giwfreq(struct net_device *dev,
                                   struct iw_freq *freq, char *extra)
 {
        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
+                return cfg80211_ibss_wext_giwfreq(dev, info, freq, extra);
        freq->m = local->hw.conf.channel->center_freq;
        freq->e = 6;
@@ -195,15 +196,17 @@ static int ieee80211_ioctl_siwessid(struct net_device *dev,
                                    struct iw_request_info *info,
                                    struct iw_point *data, char *ssid)
 {
-        struct ieee80211_sub_if_data *sdata;
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
        size_t len = data->length;
        int ret;
+        if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
+                return cfg80211_ibss_wext_siwessid(dev, info, data, ssid);
        /* iwconfig uses nul termination in SSID.. */
        if (len > 0 && ssid[len - 1] == '\0')
                len--;
-        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
        if (sdata->vif.type == NL80211_IFTYPE_STATION) {
                if (data->flags)
                        sdata->u.mgd.flags &= ~IEEE80211_STA_AUTO_SSID_SEL;
@@ -217,8 +220,7 @@ static int ieee80211_ioctl_siwessid(struct net_device *dev,
                sdata->u.mgd.flags &= ~IEEE80211_STA_EXT_SME;
                ieee80211_sta_req_auth(sdata);
                return 0;
-        } else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
+        }
-                return ieee80211_ibss_set_ssid(sdata, ssid, len);
        return -EOPNOTSUPP;
 }
@@ -229,9 +231,13 @@ static int ieee80211_ioctl_giwessid(struct net_device *dev,
                                    struct iw_point *data, char *ssid)
 {
        size_t len;
        struct ieee80211_sub_if_data *sdata;
        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
+                return cfg80211_ibss_wext_giwessid(dev, info, data, ssid);
        if (sdata->vif.type == NL80211_IFTYPE_STATION) {
                int res = ieee80211_sta_get_ssid(sdata, ssid, &len);
                if (res == 0) {
@@ -240,14 +246,6 @@ static int ieee80211_ioctl_giwessid(struct net_device *dev,
                } else
                        data->flags = 0;
                return res;
-        } else if (sdata->vif.type == NL80211_IFTYPE_ADHOC) {
-                int res = ieee80211_ibss_get_ssid(sdata, ssid, &len);
-                if (res == 0) {
-                        data->length = len;
-                        data->flags = 1;
-                } else
-                        data->flags = 0;
-                return res;
        }
        return -EOPNOTSUPP;
@@ -258,9 +256,11 @@ static int ieee80211_ioctl_siwap(struct net_device *dev,
                                 struct iw_request_info *info,
                                 struct sockaddr *ap_addr, char *extra)
 {
-        struct ieee80211_sub_if_data *sdata;
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
+                return cfg80211_ibss_wext_siwap(dev, info, ap_addr, extra);
-        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
        if (sdata->vif.type == NL80211_IFTYPE_STATION) {
                int ret;
@@ -277,16 +277,6 @@ static int ieee80211_ioctl_siwap(struct net_device *dev,
                sdata->u.mgd.flags &= ~IEEE80211_STA_EXT_SME;
                ieee80211_sta_req_auth(sdata);
                return 0;
-        } else if (sdata->vif.type == NL80211_IFTYPE_ADHOC) {
-                if (is_zero_ether_addr((u8 *) &ap_addr->sa_data))
-                        sdata->u.ibss.flags |= IEEE80211_IBSS_AUTO_BSSID_SEL |
-                                               IEEE80211_IBSS_AUTO_CHANNEL_SEL;
-                else if (is_broadcast_ether_addr((u8 *) &ap_addr->sa_data))
-                        sdata->u.ibss.flags |= IEEE80211_IBSS_AUTO_BSSID_SEL;
-                else
-                        sdata->u.ibss.flags &= ~IEEE80211_IBSS_AUTO_BSSID_SEL;
-                return ieee80211_ibss_set_bssid(sdata, (u8 *) &ap_addr->sa_data);
        } else if (sdata->vif.type == NL80211_IFTYPE_WDS) {
                /*
                 * If it is necessary to update the WDS peer address
@@ -312,9 +302,11 @@ static int ieee80211_ioctl_giwap(struct net_device *dev,
                                 struct iw_request_info *info,
                                 struct sockaddr *ap_addr, char *extra)
 {
-        struct ieee80211_sub_if_data *sdata;
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
+                return cfg80211_ibss_wext_giwap(dev, info, ap_addr, extra);
-        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
        if (sdata->vif.type == NL80211_IFTYPE_STATION) {
                if (sdata->u.mgd.state == IEEE80211_STA_MLME_ASSOCIATED) {
                        ap_addr->sa_family = ARPHRD_ETHER;
@@ -322,13 +314,6 @@ static int ieee80211_ioctl_giwap(struct net_device *dev,
                } else
                        memset(&ap_addr->sa_data, 0, ETH_ALEN);
                return 0;
-        } else if (sdata->vif.type == NL80211_IFTYPE_ADHOC) {
-                if (sdata->u.ibss.state == IEEE80211_IBSS_MLME_JOINED) {
-                        ap_addr->sa_family = ARPHRD_ETHER;
-                        memcpy(&ap_addr->sa_data, sdata->u.ibss.bssid, ETH_ALEN);
-                } else
-                        memset(&ap_addr->sa_data, 0, ETH_ALEN);
-                return 0;
        } else if (sdata->vif.type == NL80211_IFTYPE_WDS) {
                ap_addr->sa_family = ARPHRD_ETHER;
                memcpy(&ap_addr->sa_data, sdata->u.wds.remote_addr, ETH_ALEN);
@@ -487,155 +472,6 @@ static int ieee80211_ioctl_giwtxpower(struct net_device *dev,
        return 0;
 }
-static int ieee80211_ioctl_siwrts(struct net_device *dev,
-                                  struct iw_request_info *info,
-                                  struct iw_param *rts, char *extra)
-{
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        if (rts->disabled)
-                local->rts_threshold = IEEE80211_MAX_RTS_THRESHOLD;
-        else if (!rts->fixed)
-                /* if the rts value is not fixed, then take default */
-                local->rts_threshold = IEEE80211_MAX_RTS_THRESHOLD;
-        else if (rts->value < 0 || rts->value > IEEE80211_MAX_RTS_THRESHOLD)
-                return -EINVAL;
-        else
-                local->rts_threshold = rts->value;
-        /* If the wlan card performs RTS/CTS in hardware/firmware,
-         * configure it here */
-        if (local->ops->set_rts_threshold)
-                local->ops->set_rts_threshold(local_to_hw(local),
-                                             local->rts_threshold);
-        return 0;
-}
-static int ieee80211_ioctl_giwrts(struct net_device *dev,
-                                  struct iw_request_info *info,
-                                  struct iw_param *rts, char *extra)
-{
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        rts->value = local->rts_threshold;
-        rts->disabled = (rts->value >= IEEE80211_MAX_RTS_THRESHOLD);
-        rts->fixed = 1;
-        return 0;
-}
-static int ieee80211_ioctl_siwfrag(struct net_device *dev,
-                                   struct iw_request_info *info,
-                                   struct iw_param *frag, char *extra)
-{
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        if (frag->disabled)
-                local->fragmentation_threshold = IEEE80211_MAX_FRAG_THRESHOLD;
-        else if (!frag->fixed)
-                local->fragmentation_threshold = IEEE80211_MAX_FRAG_THRESHOLD;
-        else if (frag->value < 256 ||
-                 frag->value > IEEE80211_MAX_FRAG_THRESHOLD)
-                return -EINVAL;
-        else {
-                /* Fragment length must be even, so strip LSB. */
-                local->fragmentation_threshold = frag->value & ~0x1;
-        }
-        return 0;
-}
-static int ieee80211_ioctl_giwfrag(struct net_device *dev,
-                                   struct iw_request_info *info,
-                                   struct iw_param *frag, char *extra)
-{
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        frag->value = local->fragmentation_threshold;
-        frag->disabled = (frag->value >= IEEE80211_MAX_FRAG_THRESHOLD);
-        frag->fixed = 1;
-        return 0;
-}
-static int ieee80211_ioctl_siwretry(struct net_device *dev,
-                                    struct iw_request_info *info,
-                                    struct iw_param *retry, char *extra)
-{
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        if (retry->disabled ||
-            (retry->flags & IW_RETRY_TYPE) != IW_RETRY_LIMIT)
-                return -EINVAL;
-        if (retry->flags & IW_RETRY_MAX) {
-                local->hw.conf.long_frame_max_tx_count = retry->value;
-        } else if (retry->flags & IW_RETRY_MIN) {
-                local->hw.conf.short_frame_max_tx_count = retry->value;
-        } else {
-                local->hw.conf.long_frame_max_tx_count = retry->value;
-                local->hw.conf.short_frame_max_tx_count = retry->value;
-        }
-        ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_RETRY_LIMITS);
-        return 0;
-}
-static int ieee80211_ioctl_giwretry(struct net_device *dev,
-                                    struct iw_request_info *info,
-                                    struct iw_param *retry, char *extra)
-{
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        retry->disabled = 0;
-        if (retry->flags == 0 || retry->flags & IW_RETRY_MIN) {
-                /* first return min value, iwconfig will ask max value
-                 * later if needed */
-                retry->flags |= IW_RETRY_LIMIT;
-                retry->value = local->hw.conf.short_frame_max_tx_count;
-                if (local->hw.conf.long_frame_max_tx_count !=
-                    local->hw.conf.short_frame_max_tx_count)
-                        retry->flags |= IW_RETRY_MIN;
-                return 0;
-        }
-        if (retry->flags & IW_RETRY_MAX) {
-                retry->flags = IW_RETRY_LIMIT | IW_RETRY_MAX;
-                retry->value = local->hw.conf.long_frame_max_tx_count;
-        }
-        return 0;
-}
-static int ieee80211_ioctl_siwmlme(struct net_device *dev,
-                                   struct iw_request_info *info,
-                                   struct iw_point *data, char *extra)
-{
-        struct ieee80211_sub_if_data *sdata;
-        struct iw_mlme *mlme = (struct iw_mlme *) extra;
-        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        if (!(sdata->vif.type == NL80211_IFTYPE_STATION))
-                return -EINVAL;
-        switch (mlme->cmd) {
-        case IW_MLME_DEAUTH:
-                /* TODO: mlme->addr.sa_data */
-                return ieee80211_sta_deauthenticate(sdata, mlme->reason_code);
-        case IW_MLME_DISASSOC:
-                /* TODO: mlme->addr.sa_data */
-                return ieee80211_sta_disassociate(sdata, mlme->reason_code);
-        default:
-                return -EOPNOTSUPP;
-        }
-}
 static int ieee80211_ioctl_siwencode(struct net_device *dev,
                                     struct iw_request_info *info,
                                     struct iw_point *erq, char *keybuf)
@@ -675,7 +511,7 @@ static int ieee80211_ioctl_siwencode(struct net_device *dev,
                !sdata->default_key,
                keybuf, erq->length);
-        if (!ret) {
+        if (!ret && sdata->vif.type == NL80211_IFTYPE_STATION) {
                if (remove)
                        sdata->u.mgd.flags &= ~IEEE80211_STA_TKIP_WEP_USED;
                else
@@ -747,7 +583,7 @@ static int ieee80211_ioctl_siwpower(struct net_device *dev,
        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
        struct ieee80211_conf *conf = &local->hw.conf;
-        int ret = 0, timeout = 0;
+        int timeout = 0;
        bool ps;
        if (!(local->hw.flags & IEEE80211_HW_SUPPORTS_PS))
@@ -779,42 +615,18 @@ static int ieee80211_ioctl_siwpower(struct net_device *dev,
                timeout = wrq->value / 1000;
 set:
-        if (ps == local->powersave && timeout == conf->dynamic_ps_timeout)
+        if (ps == sdata->u.mgd.powersave && timeout == conf->dynamic_ps_timeout)
-                return ret;
+                return 0;
-        local->powersave = ps;
+        sdata->u.mgd.powersave = ps;
        conf->dynamic_ps_timeout = timeout;
        if (local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_PS)
-                ret = ieee80211_hw_config(local,
+                ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
-                                          IEEE80211_CONF_CHANGE_DYNPS_TIMEOUT);
-        if (!(sdata->u.mgd.flags & IEEE80211_STA_ASSOCIATED))
+        ieee80211_recalc_ps(local, -1);
-                return ret;
-        if (conf->dynamic_ps_timeout > 0 &&
+        return 0;
-            !(local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_PS)) {
-                mod_timer(&local->dynamic_ps_timer, jiffies +
-                          msecs_to_jiffies(conf->dynamic_ps_timeout));
-        } else {
-                if (local->powersave) {
-                        if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK)
-                                ieee80211_send_nullfunc(local, sdata, 1);
-                        conf->flags |= IEEE80211_CONF_PS;
-                        ret = ieee80211_hw_config(local,
-                                        IEEE80211_CONF_CHANGE_PS);
-                } else {
-                        conf->flags &= ~IEEE80211_CONF_PS;
-                        ret = ieee80211_hw_config(local,
-                                        IEEE80211_CONF_CHANGE_PS);
-                        if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK)
-                                ieee80211_send_nullfunc(local, sdata, 0);
-                        del_timer_sync(&local->dynamic_ps_timer);
-                        cancel_work_sync(&local->dynamic_ps_enable_work);
-                }
-        }
-        return ret;
 }
 static int ieee80211_ioctl_giwpower(struct net_device *dev,
@@ -822,9 +634,9 @@ static int ieee80211_ioctl_giwpower(struct net_device *dev,
                                    union iwreq_data *wrqu,
                                    char *extra)
 {
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        wrqu->power.disabled = !local->powersave;
+        wrqu->power.disabled = !sdata->u.mgd.powersave;
        return 0;
 }
@@ -1099,7 +911,7 @@ static const iw_handler ieee80211_handler[] =
        (iw_handler) NULL,                              /* SIOCGIWTHRSPY */
        (iw_handler) ieee80211_ioctl_siwap,             /* SIOCSIWAP */
        (iw_handler) ieee80211_ioctl_giwap,             /* SIOCGIWAP */
-        (iw_handler) ieee80211_ioctl_siwmlme,           /* SIOCSIWMLME */
+        (iw_handler) cfg80211_wext_siwmlme,             /* SIOCSIWMLME */
        (iw_handler) NULL,                              /* SIOCGIWAPLIST */
        (iw_handler) cfg80211_wext_siwscan,             /* SIOCSIWSCAN */
        (iw_handler) cfg80211_wext_giwscan,             /* SIOCGIWSCAN */
@@ -1111,14 +923,14 @@ static const iw_handler ieee80211_handler[] =
        (iw_handler) NULL,                              /* -- hole -- */
        (iw_handler) ieee80211_ioctl_siwrate,           /* SIOCSIWRATE */
        (iw_handler) ieee80211_ioctl_giwrate,           /* SIOCGIWRATE */
-        (iw_handler) ieee80211_ioctl_siwrts,            /* SIOCSIWRTS */
+        (iw_handler) cfg80211_wext_siwrts,              /* SIOCSIWRTS */
-        (iw_handler) ieee80211_ioctl_giwrts,            /* SIOCGIWRTS */
+        (iw_handler) cfg80211_wext_giwrts,              /* SIOCGIWRTS */
-        (iw_handler) ieee80211_ioctl_siwfrag,           /* SIOCSIWFRAG */
+        (iw_handler) cfg80211_wext_siwfrag,             /* SIOCSIWFRAG */
-        (iw_handler) ieee80211_ioctl_giwfrag,           /* SIOCGIWFRAG */
+        (iw_handler) cfg80211_wext_giwfrag,             /* SIOCGIWFRAG */
        (iw_handler) ieee80211_ioctl_siwtxpower,        /* SIOCSIWTXPOW */
        (iw_handler) ieee80211_ioctl_giwtxpower,        /* SIOCGIWTXPOW */
-        (iw_handler) ieee80211_ioctl_siwretry,          /* SIOCSIWRETRY */
+        (iw_handler) cfg80211_wext_siwretry,            /* SIOCSIWRETRY */
-        (iw_handler) ieee80211_ioctl_giwretry,          /* SIOCGIWRETRY */
+        (iw_handler) cfg80211_wext_giwretry,            /* SIOCGIWRETRY */
        (iw_handler) ieee80211_ioctl_siwencode,         /* SIOCSIWENCODE */
        (iw_handler) ieee80211_ioctl_giwencode,         /* SIOCGIWENCODE */
        (iw_handler) ieee80211_ioctl_siwpower,          /* SIOCSIWPOWER */
diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c
index 4f8bfea278f2..dcfae8884b86 100644
--- a/net/mac80211/wpa.c
+++ b/net/mac80211/wpa.c
@@ -122,7 +122,7 @@ ieee80211_rx_h_michael_mic_verify(struct ieee80211_rx_data *rx)
                        return RX_DROP_UNUSABLE;
                mac80211_ev_michael_mic_failure(rx->sdata, rx->key->conf.keyidx,
-                                                (void *) skb->data);
+                                                (void *) skb->data, NULL);
                return RX_DROP_UNUSABLE;
        }
diff --git a/net/rds/af_rds.c b/net/rds/af_rds.c
index 20cf16fc572f..b11e7e527864 100644
--- a/net/rds/af_rds.c
+++ b/net/rds/af_rds.c
@@ -35,7 +35,6 @@
 #include <linux/kernel.h>
 #include <linux/in.h>
 #include <linux/poll.h>
-#include <linux/version.h>
 #include <net/sock.h>
 #include "rds.h"
diff --git a/net/rds/connection.c b/net/rds/connection.c
index 273f064930a8..d14445c48304 100644
--- a/net/rds/connection.c
+++ b/net/rds/connection.c
@@ -148,14 +148,12 @@ static struct rds_connection *__rds_conn_create(__be32 laddr, __be32 faddr,
        if (conn)
                goto out;
-        conn = kmem_cache_alloc(rds_conn_slab, gfp);
+        conn = kmem_cache_zalloc(rds_conn_slab, gfp);
        if (conn == NULL) {
                conn = ERR_PTR(-ENOMEM);
                goto out;
        }
-        memset(conn, 0, sizeof(*conn));
        INIT_HLIST_NODE(&conn->c_hash_node);
        conn->c_version = RDS_PROTOCOL_3_0;
        conn->c_laddr = laddr;
diff --git a/net/rds/ib.c b/net/rds/ib.c
index 4933b380985e..b9bcd32431e1 100644
--- a/net/rds/ib.c
+++ b/net/rds/ib.c
@@ -224,8 +224,8 @@ static int rds_ib_laddr_check(__be32 addr)
         * IB and iWARP capable NICs.
         */
        cm_id = rdma_create_id(NULL, NULL, RDMA_PS_TCP);
-        if (!cm_id)
+        if (IS_ERR(cm_id))
-                return -EADDRNOTAVAIL;
+                return PTR_ERR(cm_id);
        memset(&sin, 0, sizeof(sin));
        sin.sin_family = AF_INET;
diff --git a/net/rds/ib.h b/net/rds/ib.h
index 069206cae733..455ae73047fe 100644
--- a/net/rds/ib.h
+++ b/net/rds/ib.h
@@ -333,7 +333,7 @@ int rds_ib_xmit_rdma(struct rds_connection *conn, struct rds_rdma_op *op);
 void rds_ib_send_add_credits(struct rds_connection *conn, unsigned int credits);
 void rds_ib_advertise_credits(struct rds_connection *conn, unsigned int posted);
 int rds_ib_send_grab_credits(struct rds_ib_connection *ic, u32 wanted,
-                             u32 *adv_credits, int need_posted);
+                             u32 *adv_credits, int need_posted, int max_posted);
 /* ib_stats.c */
 DECLARE_PER_CPU(struct rds_ib_statistics, rds_ib_stats);
diff --git a/net/rds/ib_recv.c b/net/rds/ib_recv.c
index 36d931573ff4..5709bad28329 100644
--- a/net/rds/ib_recv.c
+++ b/net/rds/ib_recv.c
@@ -524,7 +524,7 @@ void rds_ib_attempt_ack(struct rds_ib_connection *ic)
        }
        /* Can we get a send credit? */
-        if (!rds_ib_send_grab_credits(ic, 1, &adv_credits, 0)) {
+        if (!rds_ib_send_grab_credits(ic, 1, &adv_credits, 0, RDS_MAX_ADV_CREDIT)) {
                rds_ib_stats_inc(s_ib_tx_throttle);
                clear_bit(IB_ACK_IN_FLIGHT, &ic->i_ack_flags);
                return;
diff --git a/net/rds/ib_ring.c b/net/rds/ib_ring.c
index 99a6ccae964c..ff97e8eda858 100644
--- a/net/rds/ib_ring.c
+++ b/net/rds/ib_ring.c
@@ -137,7 +137,7 @@ int rds_ib_ring_empty(struct rds_ib_work_ring *ring)
 int rds_ib_ring_low(struct rds_ib_work_ring *ring)
 {
-        return __rds_ib_ring_used(ring) <= (ring->w_nr >> 2);
+        return __rds_ib_ring_used(ring) <= (ring->w_nr >> 1);
 }
 /*
diff --git a/net/rds/ib_send.c b/net/rds/ib_send.c
index cb6c52cb1c4c..23bf830db2d5 100644
--- a/net/rds/ib_send.c
+++ b/net/rds/ib_send.c
@@ -311,7 +311,7 @@ void rds_ib_send_cq_comp_handler(struct ib_cq *cq, void *context)
 * and using atomic_cmpxchg when updating the two counters.
 */
 int rds_ib_send_grab_credits(struct rds_ib_connection *ic,
-                             u32 wanted, u32 *adv_credits, int need_posted)
+                             u32 wanted, u32 *adv_credits, int need_posted, int max_posted)
 {
        unsigned int avail, posted, got = 0, advertise;
        long oldval, newval;
@@ -351,7 +351,7 @@ try_again:
         * available.
         */
        if (posted && (got || need_posted)) {
-                advertise = min_t(unsigned int, posted, RDS_MAX_ADV_CREDIT);
+                advertise = min_t(unsigned int, posted, max_posted);
                newval -= IB_SET_POST_CREDITS(advertise);
        }
@@ -498,7 +498,7 @@ int rds_ib_xmit(struct rds_connection *conn, struct rds_message *rm,
        credit_alloc = work_alloc;
        if (ic->i_flowctl) {
-                credit_alloc = rds_ib_send_grab_credits(ic, work_alloc, &posted, 0);
+                credit_alloc = rds_ib_send_grab_credits(ic, work_alloc, &posted, 0, RDS_MAX_ADV_CREDIT);
                adv_credits += posted;
                if (credit_alloc < work_alloc) {
                        rds_ib_ring_unalloc(&ic->i_send_ring, work_alloc - credit_alloc);
@@ -506,7 +506,7 @@ int rds_ib_xmit(struct rds_connection *conn, struct rds_message *rm,
                        flow_controlled++;
                }
                if (work_alloc == 0) {
-                        rds_ib_ring_unalloc(&ic->i_send_ring, work_alloc);
+                        set_bit(RDS_LL_SEND_FULL, &conn->c_flags);
                        rds_ib_stats_inc(s_ib_tx_throttle);
                        ret = -ENOMEM;
                        goto out;
@@ -571,7 +571,7 @@ int rds_ib_xmit(struct rds_connection *conn, struct rds_message *rm,
                /*
                 * Update adv_credits since we reset the ACK_REQUIRED bit.
                 */
-                rds_ib_send_grab_credits(ic, 0, &posted, 1);
+                rds_ib_send_grab_credits(ic, 0, &posted, 1, RDS_MAX_ADV_CREDIT - adv_credits);
                adv_credits += posted;
                BUG_ON(adv_credits > 255);
        } else if (ic->i_rm != rm)
diff --git a/net/rds/info.c b/net/rds/info.c
index 1d885535214d..62aeef37aefe 100644
--- a/net/rds/info.c
+++ b/net/rds/info.c
@@ -188,10 +188,7 @@ int rds_info_getsockopt(struct socket *sock, int optname, char __user *optval,
                ret = -ENOMEM;
                goto out;
        }
-        down_read(&current->mm->mmap_sem);
+        ret = get_user_pages_fast(start, nr_pages, 1, pages);
-        ret = get_user_pages(current, current->mm, start, nr_pages, 1, 0,
-                             pages, NULL);
-        up_read(&current->mm->mmap_sem);
        if (ret != nr_pages) {
                if (ret > 0)
                        nr_pages = ret;
diff --git a/net/rds/iw.c b/net/rds/iw.c
index b732efb5b634..d16e1cbc8e83 100644
--- a/net/rds/iw.c
+++ b/net/rds/iw.c
@@ -233,8 +233,8 @@ static int rds_iw_laddr_check(__be32 addr)
         * IB and iWARP capable NICs.
         */
        cm_id = rdma_create_id(NULL, NULL, RDMA_PS_TCP);
-        if (!cm_id)
+        if (IS_ERR(cm_id))
-                return -EADDRNOTAVAIL;
+                return PTR_ERR(cm_id);
        memset(&sin, 0, sizeof(sin));
        sin.sin_family = AF_INET;
diff --git a/net/rds/iw.h b/net/rds/iw.h
index b4fb27252895..0715dde323e7 100644
--- a/net/rds/iw.h
+++ b/net/rds/iw.h
@@ -361,7 +361,7 @@ int rds_iw_xmit_rdma(struct rds_connection *conn, struct rds_rdma_op *op);
 void rds_iw_send_add_credits(struct rds_connection *conn, unsigned int credits);
 void rds_iw_advertise_credits(struct rds_connection *conn, unsigned int posted);
 int rds_iw_send_grab_credits(struct rds_iw_connection *ic, u32 wanted,
-                             u32 *adv_credits, int need_posted);
+                             u32 *adv_credits, int need_posted, int max_posted);
 /* ib_stats.c */
 DECLARE_PER_CPU(struct rds_iw_statistics, rds_iw_stats);
diff --git a/net/rds/iw_recv.c b/net/rds/iw_recv.c
index fde470fa50d5..8683f5f66c4b 100644
--- a/net/rds/iw_recv.c
+++ b/net/rds/iw_recv.c
@@ -524,7 +524,7 @@ void rds_iw_attempt_ack(struct rds_iw_connection *ic)
        }
        /* Can we get a send credit? */
-        if (!rds_iw_send_grab_credits(ic, 1, &adv_credits, 0)) {
+        if (!rds_iw_send_grab_credits(ic, 1, &adv_credits, 0, RDS_MAX_ADV_CREDIT)) {
                rds_iw_stats_inc(s_iw_tx_throttle);
                clear_bit(IB_ACK_IN_FLIGHT, &ic->i_ack_flags);
                return;
diff --git a/net/rds/iw_ring.c b/net/rds/iw_ring.c
index d422d4b5deef..da8e3b63f663 100644
--- a/net/rds/iw_ring.c
+++ b/net/rds/iw_ring.c
@@ -137,7 +137,7 @@ int rds_iw_ring_empty(struct rds_iw_work_ring *ring)
 int rds_iw_ring_low(struct rds_iw_work_ring *ring)
 {
-        return __rds_iw_ring_used(ring) <= (ring->w_nr >> 2);
+        return __rds_iw_ring_used(ring) <= (ring->w_nr >> 1);
 }
diff --git a/net/rds/iw_send.c b/net/rds/iw_send.c
index 22dd38ffd608..44a6a0551f28 100644
--- a/net/rds/iw_send.c
+++ b/net/rds/iw_send.c
@@ -347,7 +347,7 @@ void rds_iw_send_cq_comp_handler(struct ib_cq *cq, void *context)
 * and using atomic_cmpxchg when updating the two counters.
 */
 int rds_iw_send_grab_credits(struct rds_iw_connection *ic,
-                             u32 wanted, u32 *adv_credits, int need_posted)
+                             u32 wanted, u32 *adv_credits, int need_posted, int max_posted)
 {
        unsigned int avail, posted, got = 0, advertise;
        long oldval, newval;
@@ -387,7 +387,7 @@ try_again:
         * available.
         */
        if (posted && (got || need_posted)) {
-                advertise = min_t(unsigned int, posted, RDS_MAX_ADV_CREDIT);
+                advertise = min_t(unsigned int, posted, max_posted);
                newval -= IB_SET_POST_CREDITS(advertise);
        }
@@ -541,7 +541,7 @@ int rds_iw_xmit(struct rds_connection *conn, struct rds_message *rm,
        credit_alloc = work_alloc;
        if (ic->i_flowctl) {
-                credit_alloc = rds_iw_send_grab_credits(ic, work_alloc, &posted, 0);
+                credit_alloc = rds_iw_send_grab_credits(ic, work_alloc, &posted, 0, RDS_MAX_ADV_CREDIT);
                adv_credits += posted;
                if (credit_alloc < work_alloc) {
                        rds_iw_ring_unalloc(&ic->i_send_ring, work_alloc - credit_alloc);
@@ -549,7 +549,7 @@ int rds_iw_xmit(struct rds_connection *conn, struct rds_message *rm,
                        flow_controlled++;
                }
                if (work_alloc == 0) {
-                        rds_iw_ring_unalloc(&ic->i_send_ring, work_alloc);
+                        set_bit(RDS_LL_SEND_FULL, &conn->c_flags);
                        rds_iw_stats_inc(s_iw_tx_throttle);
                        ret = -ENOMEM;
                        goto out;
@@ -614,7 +614,7 @@ int rds_iw_xmit(struct rds_connection *conn, struct rds_message *rm,
                /*
                 * Update adv_credits since we reset the ACK_REQUIRED bit.
                 */
-                rds_iw_send_grab_credits(ic, 0, &posted, 1);
+                rds_iw_send_grab_credits(ic, 0, &posted, 1, RDS_MAX_ADV_CREDIT - adv_credits);
                adv_credits += posted;
                BUG_ON(adv_credits > 255);
        } else if (ic->i_rm != rm)
diff --git a/net/rds/rdma.c b/net/rds/rdma.c
index eaeeb91e1119..8dc83d2caa58 100644
--- a/net/rds/rdma.c
+++ b/net/rds/rdma.c
@@ -150,12 +150,9 @@ static int rds_pin_pages(unsigned long user_addr, unsigned int nr_pages,
 {
        int ret;
-        down_read(&current->mm->mmap_sem);
+        ret = get_user_pages_fast(user_addr, nr_pages, write, pages);
-        ret = get_user_pages(current, current->mm, user_addr,
-                             nr_pages, write, 0, pages, NULL);
-        up_read(&current->mm->mmap_sem);
-        if (0 <= ret && (unsigned) ret < nr_pages) {
+        if (ret >= 0 && ret < nr_pages) {
                while (ret--)
                        put_page(pages[ret]);
                ret = -EFAULT;
diff --git a/net/rds/rdma_transport.c b/net/rds/rdma_transport.c
index 7b19024f9706..7d0f901c93d5 100644
--- a/net/rds/rdma_transport.c
+++ b/net/rds/rdma_transport.c
@@ -34,7 +34,7 @@
 #include "rdma_transport.h"
-static struct rdma_cm_id *rds_iw_listen_id;
+static struct rdma_cm_id *rds_rdma_listen_id;
 int rds_rdma_cm_event_handler(struct rdma_cm_id *cm_id,
                              struct rdma_cm_event *event)
@@ -161,7 +161,7 @@ static int __init rds_rdma_listen_init(void)
        rdsdebug("cm %p listening on port %u\n", cm_id, RDS_PORT);
-        rds_iw_listen_id = cm_id;
+        rds_rdma_listen_id = cm_id;
        cm_id = NULL;
 out:
        if (cm_id)
@@ -171,10 +171,10 @@ out:
 static void rds_rdma_listen_stop(void)
 {
-        if (rds_iw_listen_id) {
+        if (rds_rdma_listen_id) {
-                rdsdebug("cm %p\n", rds_iw_listen_id);
+                rdsdebug("cm %p\n", rds_rdma_listen_id);
-                rdma_destroy_id(rds_iw_listen_id);
+                rdma_destroy_id(rds_rdma_listen_id);
-                rds_iw_listen_id = NULL;
+                rds_rdma_listen_id = NULL;
        }
 }
diff --git a/net/rds/rds.h b/net/rds/rds.h
index 619f0a30a4e5..1f82ec0d2066 100644
--- a/net/rds/rds.h
+++ b/net/rds/rds.h
@@ -132,7 +132,7 @@ struct rds_connection {
 #define RDS_FLAG_CONG_BITMAP    0x01
 #define RDS_FLAG_ACK_REQUIRED   0x02
 #define RDS_FLAG_RETRANSMITTED  0x04
-#define RDS_MAX_ADV_CREDIT      127
+#define RDS_MAX_ADV_CREDIT      255
 /*
 * Maximum space available for extension headers.
diff --git a/net/rds/send.c b/net/rds/send.c
index 104fe033203d..a4a7f428cd76 100644
--- a/net/rds/send.c
+++ b/net/rds/send.c
@@ -854,11 +854,6 @@ int rds_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
        rm->m_daddr = daddr;
-        /* Parse any control messages the user may have included. */
-        ret = rds_cmsg_send(rs, rm, msg, &allocated_mr);
-        if (ret)
-                goto out;
        /* rds_conn_create has a spinlock that runs with IRQ off.
         * Caching the conn in the socket helps a lot. */
        if (rs->rs_conn && rs->rs_conn->c_faddr == daddr)
@@ -874,6 +869,11 @@ int rds_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
                rs->rs_conn = conn;
        }
+        /* Parse any control messages the user may have included. */
+        ret = rds_cmsg_send(rs, rm, msg, &allocated_mr);
+        if (ret)
+                goto out;
        if ((rm->m_rdma_cookie || rm->m_rdma_op)
         && conn->c_trans->xmit_rdma == NULL) {
                if (printk_ratelimit())
diff --git a/net/rfkill/rfkill-input.c b/net/rfkill/rfkill-input.c
index 84efde97c5a7..60a34f3b5f65 100644
--- a/net/rfkill/rfkill-input.c
+++ b/net/rfkill/rfkill-input.c
@@ -47,12 +47,6 @@ enum rfkill_global_sched_op {
        RFKILL_GLOBAL_OP_UNBLOCK,
 };
-/*
- * Currently, the code marked with RFKILL_NEED_SWSET is inactive.
- * If handling of EV_SW SW_WLAN/WWAN/BLUETOOTH/etc is needed in the
- * future, when such events are added, that code will be necessary.
- */
 struct rfkill_task {
        struct delayed_work dwork;
@@ -65,14 +59,6 @@ struct rfkill_task {
        /* pending regular switch operations (1=pending) */
        unsigned long sw_pending[BITS_TO_LONGS(RFKILL_TYPE_MAX)];
-#ifdef RFKILL_NEED_SWSET
-        /* set operation pending (1=pending) */
-        unsigned long sw_setpending[BITS_TO_LONGS(RFKILL_TYPE_MAX)];
-        /* desired state for pending set operation (1=unblock) */
-        unsigned long sw_newstate[BITS_TO_LONGS(RFKILL_TYPE_MAX)];
-#endif
        /* should the state be complemented (1=yes) */
        unsigned long sw_togglestate[BITS_TO_LONGS(RFKILL_TYPE_MAX)];
@@ -111,24 +97,6 @@ static void __rfkill_handle_global_op(enum rfkill_global_sched_op op)
        }
 }
-#ifdef RFKILL_NEED_SWSET
-static void __rfkill_handle_normal_op(const enum rfkill_type type,
-                        const bool sp, const bool s, const bool c)
-{
-        enum rfkill_state state;
-        if (sp)
-                state = (s) ? RFKILL_STATE_UNBLOCKED :
-                              RFKILL_STATE_SOFT_BLOCKED;
-        else
-                state = rfkill_get_global_state(type);
-        if (c)
-                state = rfkill_state_complement(state);
-        rfkill_switch_all(type, state);
-}
-#else
 static void __rfkill_handle_normal_op(const enum rfkill_type type,
                        const bool c)
 {
@@ -140,7 +108,6 @@ static void __rfkill_handle_normal_op(const enum rfkill_type type,
        rfkill_switch_all(type, state);
 }
-#endif
 static void rfkill_task_handler(struct work_struct *work)
 {
@@ -171,21 +138,11 @@ static void rfkill_task_handler(struct work_struct *work)
                                                i < RFKILL_TYPE_MAX) {
                                if (test_and_clear_bit(i, task->sw_pending)) {
                                        bool c;
-#ifdef RFKILL_NEED_SWSET
-                                        bool sp, s;
-                                        sp = test_and_clear_bit(i,
-                                                        task->sw_setpending);
-                                        s = test_bit(i, task->sw_newstate);
-#endif
                                        c = test_and_clear_bit(i,
                                                        task->sw_togglestate);
                                        spin_unlock_irq(&task->lock);
-#ifdef RFKILL_NEED_SWSET
-                                        __rfkill_handle_normal_op(i, sp, s, c);
-#else
                                        __rfkill_handle_normal_op(i, c);
-#endif
                                        spin_lock_irq(&task->lock);
                                }
@@ -238,32 +195,6 @@ static void rfkill_schedule_global_op(enum rfkill_global_sched_op op)
        spin_unlock_irqrestore(&rfkill_task.lock, flags);
 }
-#ifdef RFKILL_NEED_SWSET
-/* Use this if you need to add EV_SW SW_WLAN/WWAN/BLUETOOTH/etc handling */
-static void rfkill_schedule_set(enum rfkill_type type,
-                                enum rfkill_state desired_state)
-{
-        unsigned long flags;
-        if (rfkill_is_epo_lock_active())
-                return;
-        spin_lock_irqsave(&rfkill_task.lock, flags);
-        if (!rfkill_task.global_op_pending) {
-                set_bit(type, rfkill_task.sw_pending);
-                set_bit(type, rfkill_task.sw_setpending);
-                clear_bit(type, rfkill_task.sw_togglestate);
-                if (desired_state)
-                        set_bit(type,  rfkill_task.sw_newstate);
-                else
-                        clear_bit(type, rfkill_task.sw_newstate);
-                rfkill_schedule_ratelimited();
-        }
-        spin_unlock_irqrestore(&rfkill_task.lock, flags);
-}
-#endif
 static void rfkill_schedule_toggle(enum rfkill_type type)
 {
        unsigned long flags;
diff --git a/net/rfkill/rfkill.c b/net/rfkill/rfkill.c
index 3eaa39403c13..e2d4510623f2 100644
--- a/net/rfkill/rfkill.c
+++ b/net/rfkill/rfkill.c
@@ -96,6 +96,7 @@ static void update_rfkill_state(struct rfkill *rfkill)
                }
                mutex_unlock(&rfkill->mutex);
        }
+        rfkill_led_trigger(rfkill, rfkill->state);
 }
 /**
@@ -136,8 +137,9 @@ static int rfkill_toggle_radio(struct rfkill *rfkill,
        oldstate = rfkill->state;
        if (rfkill->get_state && !force &&
-            !rfkill->get_state(rfkill->data, &newstate))
+            !rfkill->get_state(rfkill->data, &newstate)) {
                rfkill->state = newstate;
+        }
        switch (state) {
        case RFKILL_STATE_HARD_BLOCKED:
@@ -172,6 +174,7 @@ static int rfkill_toggle_radio(struct rfkill *rfkill,
        if (force || rfkill->state != oldstate)
                rfkill_uevent(rfkill);
+        rfkill_led_trigger(rfkill, rfkill->state);
        return retval;
 }
@@ -200,10 +203,11 @@ static void __rfkill_switch_all(const enum rfkill_type type,
        rfkill_global_states[type].current_state = state;
        list_for_each_entry(rfkill, &rfkill_list, node) {
-                if ((!rfkill->user_claim) && (rfkill->type == type)) {
+                if (rfkill->type == type) {
                        mutex_lock(&rfkill->mutex);
                        rfkill_toggle_radio(rfkill, state, 0);
                        mutex_unlock(&rfkill->mutex);
+                        rfkill_led_trigger(rfkill, rfkill->state);
                }
        }
 }
@@ -256,6 +260,7 @@ void rfkill_epo(void)
                                RFKILL_STATE_SOFT_BLOCKED;
        }
        mutex_unlock(&rfkill_global_mutex);
+        rfkill_led_trigger(rfkill, rfkill->state);
 }
 EXPORT_SYMBOL_GPL(rfkill_epo);
@@ -358,6 +363,7 @@ int rfkill_force_state(struct rfkill *rfkill, enum rfkill_state state)
                rfkill_uevent(rfkill);
        mutex_unlock(&rfkill->mutex);
+        rfkill_led_trigger(rfkill, rfkill->state);
        return 0;
 }
@@ -447,53 +453,14 @@ static ssize_t rfkill_claim_show(struct device *dev,
                                 struct device_attribute *attr,
                                 char *buf)
 {
-        struct rfkill *rfkill = to_rfkill(dev);
+        return sprintf(buf, "%d\n", 0);
-        return sprintf(buf, "%d\n", rfkill->user_claim);
 }
 static ssize_t rfkill_claim_store(struct device *dev,
                                  struct device_attribute *attr,
                                  const char *buf, size_t count)
 {
-        struct rfkill *rfkill = to_rfkill(dev);
+        return -EOPNOTSUPP;
-        unsigned long claim_tmp;
-        bool claim;
-        int error;
-        if (!capable(CAP_NET_ADMIN))
-                return -EPERM;
-        if (rfkill->user_claim_unsupported)
-                return -EOPNOTSUPP;
-        error = strict_strtoul(buf, 0, &claim_tmp);
-        if (error)
-                return error;
-        claim = !!claim_tmp;
-        /*
-         * Take the global lock to make sure the kernel is not in
-         * the middle of rfkill_switch_all
-         */
-        error = mutex_lock_killable(&rfkill_global_mutex);
-        if (error)
-                return error;
-        if (rfkill->user_claim != claim) {
-                if (!claim && !rfkill_epo_lock_active) {
-                        mutex_lock(&rfkill->mutex);
-                        rfkill_toggle_radio(rfkill,
-                                        rfkill_global_states[rfkill->type].current_state,
-                                        0);
-                        mutex_unlock(&rfkill->mutex);
-                }
-                rfkill->user_claim = claim;
-        }
-        mutex_unlock(&rfkill_global_mutex);
-        return error ? error : count;
 }
 static struct device_attribute rfkill_dev_attrs[] = {
@@ -559,6 +526,7 @@ static int rfkill_resume(struct device *dev)
                                1);
                mutex_unlock(&rfkill->mutex);
+                rfkill_led_trigger(rfkill, rfkill->state);
        }
        return 0;
diff --git a/net/sctp/output.c b/net/sctp/output.c
index 7d08f522ec84..f0c91df59d4e 100644
--- a/net/sctp/output.c
+++ b/net/sctp/output.c
@@ -412,6 +412,7 @@ int sctp_packet_transmit(struct sctp_packet *packet)
        /* Build the SCTP header.  */
        sh = (struct sctphdr *)skb_push(nskb, sizeof(struct sctphdr));
+        skb_reset_transport_header(nskb);
        sh->source = htons(packet->source_port);
        sh->dest   = htons(packet->destination_port);
@@ -527,15 +528,25 @@ int sctp_packet_transmit(struct sctp_packet *packet)
         * Note: Adler-32 is no longer applicable, as has been replaced
         * by CRC32-C as described in <draft-ietf-tsvwg-sctpcsum-02.txt>.
         */
-        if (!sctp_checksum_disable && !(dst->dev->features & NETIF_F_NO_CSUM)) {
+        if (!sctp_checksum_disable &&
+            !(dst->dev->features & (NETIF_F_NO_CSUM | NETIF_F_SCTP_CSUM))) {
                __u32 crc32 = sctp_start_cksum((__u8 *)sh, cksum_buf_len);
                /* 3) Put the resultant value into the checksum field in the
                 *    common header, and leave the rest of the bits unchanged.
                 */
                sh->checksum = sctp_end_cksum(crc32);
-        } else
+        } else {
-                nskb->ip_summed = CHECKSUM_UNNECESSARY;
+                if (dst->dev->features & NETIF_F_SCTP_CSUM) {
+                        /* no need to seed psuedo checksum for SCTP */
+                        nskb->ip_summed = CHECKSUM_PARTIAL;
+                        nskb->csum_start = (skb_transport_header(nskb) -
+                                            nskb->head);
+                        nskb->csum_offset = offsetof(struct sctphdr, checksum);
+                } else {
+                        nskb->ip_summed = CHECKSUM_UNNECESSARY;
+                }
+        }
        /* IP layer ECN support
         * From RFC 2481
diff --git a/net/wimax/op-rfkill.c b/net/wimax/op-rfkill.c
index 2b75aee04217..a3616e2ccb8a 100644
--- a/net/wimax/op-rfkill.c
+++ b/net/wimax/op-rfkill.c
@@ -113,7 +113,7 @@ void wimax_report_rfkill_hw(struct wimax_dev *wimax_dev,
        if (state != wimax_dev->rf_hw) {
                wimax_dev->rf_hw = state;
                rfkill_state = state == WIMAX_RF_ON ?
-                        RFKILL_STATE_OFF : RFKILL_STATE_ON;
+                        RFKILL_STATE_UNBLOCKED : RFKILL_STATE_SOFT_BLOCKED;
                if (wimax_dev->rf_hw == WIMAX_RF_ON
                    && wimax_dev->rf_sw == WIMAX_RF_ON)
                        wimax_state = WIMAX_ST_READY;
@@ -259,10 +259,10 @@ int wimax_rfkill_toggle_radio(void *data, enum rfkill_state state)
        d_fnstart(3, dev, "(wimax_dev %p state %u)\n", wimax_dev, state);
        switch (state) {
-        case RFKILL_STATE_ON:
+        case RFKILL_STATE_SOFT_BLOCKED:
                rf_state = WIMAX_RF_OFF;
                break;
-        case RFKILL_STATE_OFF:
+        case RFKILL_STATE_UNBLOCKED:
                rf_state = WIMAX_RF_ON;
                break;
        default:
@@ -361,10 +361,9 @@ int wimax_rfkill_add(struct wimax_dev *wimax_dev)
        wimax_dev->rfkill = rfkill;
        rfkill->name = wimax_dev->name;
-        rfkill->state = RFKILL_STATE_OFF;
+        rfkill->state = RFKILL_STATE_UNBLOCKED;
        rfkill->data = wimax_dev;
        rfkill->toggle_radio = wimax_rfkill_toggle_radio;
-        rfkill->user_claim_unsupported = 1;
        /* Initialize the input device for the hw key */
        input_dev = input_allocate_device();
diff --git a/net/wireless/Makefile b/net/wireless/Makefile
index 6d1e7b27b752..14ea01c4a103 100644
--- a/net/wireless/Makefile
+++ b/net/wireless/Makefile
@@ -5,7 +5,7 @@ obj-$(CONFIG_LIB80211_CRYPT_WEP) += lib80211_crypt_wep.o
 obj-$(CONFIG_LIB80211_CRYPT_CCMP) += lib80211_crypt_ccmp.o
 obj-$(CONFIG_LIB80211_CRYPT_TKIP) += lib80211_crypt_tkip.o
-cfg80211-y += core.o sysfs.o radiotap.o util.o reg.o scan.o nl80211.o mlme.o
+cfg80211-y += core.o sysfs.o radiotap.o util.o reg.o scan.o nl80211.o mlme.o ibss.o
 cfg80211-$(CONFIG_WIRELESS_EXT) += wext-compat.o
 ccflags-y += -D__CHECK_ENDIAN__
diff --git a/net/wireless/core.c b/net/wireless/core.c
index d1f556535f6d..2006a4ee60eb 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -14,7 +14,6 @@
 #include <linux/device.h>
 #include <net/genetlink.h>
 #include <net/cfg80211.h>
-#include <net/wireless.h>
 #include "nl80211.h"
 #include "core.h"
 #include "sysfs.h"
@@ -274,6 +273,16 @@ struct wiphy *wiphy_new(struct cfg80211_ops *ops, int sizeof_priv)
        drv->wiphy.dev.class = &ieee80211_class;
        drv->wiphy.dev.platform_data = drv;
+        /*
+         * Initialize wiphy parameters to IEEE 802.11 MIB default values.
+         * Fragmentation and RTS threshold are disabled by default with the
+         * special -1 value.
+         */
+        drv->wiphy.retry_short = 7;
+        drv->wiphy.retry_long = 4;
+        drv->wiphy.frag_threshold = (u32) -1;
+        drv->wiphy.rts_threshold = (u32) -1;
        return &drv->wiphy;
 }
 EXPORT_SYMBOL(wiphy_new);
@@ -450,6 +459,22 @@ static int cfg80211_netdev_notifier_call(struct notifier_block * nb,
                dev->ieee80211_ptr->netdev = dev;
                mutex_unlock(&rdev->devlist_mtx);
                break;
+        case NETDEV_GOING_DOWN:
+                if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
+                        break;
+                if (!dev->ieee80211_ptr->ssid_len)
+                        break;
+                cfg80211_leave_ibss(rdev, dev, true);
+                break;
+        case NETDEV_UP:
+#ifdef CONFIG_WIRELESS_EXT
+                if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
+                        break;
+                if (!dev->ieee80211_ptr->wext.ssid_len)
+                        break;
+                cfg80211_join_ibss(rdev, dev, &dev->ieee80211_ptr->wext);
+                break;
+#endif
        case NETDEV_UNREGISTER:
                mutex_lock(&rdev->devlist_mtx);
                if (!list_empty(&dev->ieee80211_ptr->list)) {
diff --git a/net/wireless/core.h b/net/wireless/core.h
index 0a592e4295f0..3e49d3399311 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -10,9 +10,7 @@
 #include <linux/netdevice.h>
 #include <linux/kref.h>
 #include <linux/rbtree.h>
-#include <linux/mutex.h>
 #include <net/genetlink.h>
-#include <net/wireless.h>
 #include <net/cfg80211.h>
 #include "reg.h"
@@ -74,10 +72,7 @@ bool wiphy_idx_valid(int wiphy_idx)
 extern struct mutex cfg80211_mutex;
 extern struct list_head cfg80211_drv_list;
-static inline void assert_cfg80211_lock(void)
+#define assert_cfg80211_lock() WARN_ON(!mutex_is_locked(&cfg80211_mutex))
-{
-        WARN_ON(!mutex_is_locked(&cfg80211_mutex));
-}
 /*
 * You can use this to mark a wiphy_idx as not having an associated wiphy.
@@ -148,4 +143,12 @@ void cfg80211_bss_expire(struct cfg80211_registered_device *dev);
 void cfg80211_bss_age(struct cfg80211_registered_device *dev,
                      unsigned long age_secs);
+/* IBSS */
+int cfg80211_join_ibss(struct cfg80211_registered_device *rdev,
+                       struct net_device *dev,
+                       struct cfg80211_ibss_params *params);
+void cfg80211_clear_ibss(struct net_device *dev, bool nowext);
+int cfg80211_leave_ibss(struct cfg80211_registered_device *rdev,
+                        struct net_device *dev, bool nowext);
 #endif /* __NET_WIRELESS_CORE_H */
diff --git a/net/wireless/ibss.c b/net/wireless/ibss.c
new file mode 100644
index 000000000000..3c38afaed28a
--- /dev/null
+++ b/net/wireless/ibss.c
@@ -0,0 +1,369 @@
+/*
+ * Some IBSS support code for cfg80211.
+ *
+ * Copyright 2009       Johannes Berg <johannes@sipsolutions.net>
+ */
+#include <linux/etherdevice.h>
+#include <linux/if_arp.h>
+#include <net/cfg80211.h>
+#include "nl80211.h"
+void cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid, gfp_t gfp)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_bss *bss;
+#ifdef CONFIG_WIRELESS_EXT
+        union iwreq_data wrqu;
+#endif
+        if (WARN_ON(wdev->iftype != NL80211_IFTYPE_ADHOC))
+                return;
+        if (WARN_ON(!wdev->ssid_len))
+                return;
+        if (memcmp(bssid, wdev->bssid, ETH_ALEN) == 0)
+                return;
+        bss = cfg80211_get_bss(wdev->wiphy, NULL, bssid,
+                               wdev->ssid, wdev->ssid_len,
+                               WLAN_CAPABILITY_IBSS, WLAN_CAPABILITY_IBSS);
+        if (WARN_ON(!bss))
+                return;
+        if (wdev->current_bss) {
+                cfg80211_unhold_bss(wdev->current_bss);
+                cfg80211_put_bss(wdev->current_bss);
+        }
+        cfg80211_hold_bss(bss);
+        wdev->current_bss = bss;
+        memcpy(wdev->bssid, bssid, ETH_ALEN);
+        nl80211_send_ibss_bssid(wiphy_to_dev(wdev->wiphy), dev, bssid, gfp);
+#ifdef CONFIG_WIRELESS_EXT
+        memset(&wrqu, 0, sizeof(wrqu));
+        memcpy(wrqu.ap_addr.sa_data, bssid, ETH_ALEN);
+        wireless_send_event(dev, SIOCGIWAP, &wrqu, NULL);
+#endif
+}
+EXPORT_SYMBOL(cfg80211_ibss_joined);
+int cfg80211_join_ibss(struct cfg80211_registered_device *rdev,
+                       struct net_device *dev,
+                       struct cfg80211_ibss_params *params)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        int err;
+        if (wdev->ssid_len)
+                return -EALREADY;
+#ifdef CONFIG_WIRELESS_EXT
+        wdev->wext.channel = params->channel;
+#endif
+        err = rdev->ops->join_ibss(&rdev->wiphy, dev, params);
+        if (err)
+                return err;
+        memcpy(wdev->ssid, params->ssid, params->ssid_len);
+        wdev->ssid_len = params->ssid_len;
+        return 0;
+}
+void cfg80211_clear_ibss(struct net_device *dev, bool nowext)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        if (wdev->current_bss) {
+                cfg80211_unhold_bss(wdev->current_bss);
+                cfg80211_put_bss(wdev->current_bss);
+        }
+        wdev->current_bss = NULL;
+        wdev->ssid_len = 0;
+        memset(wdev->bssid, 0, ETH_ALEN);
+#ifdef CONFIG_WIRELESS_EXT
+        if (!nowext)
+                wdev->wext.ssid_len = 0;
+#endif
+}
+int cfg80211_leave_ibss(struct cfg80211_registered_device *rdev,
+                        struct net_device *dev, bool nowext)
+{
+        int err;
+        err = rdev->ops->leave_ibss(&rdev->wiphy, dev);
+        if (err)
+                return err;
+        cfg80211_clear_ibss(dev, nowext);
+        return 0;
+}
+#ifdef CONFIG_WIRELESS_EXT
+static int cfg80211_ibss_wext_join(struct cfg80211_registered_device *rdev,
+                                   struct wireless_dev *wdev)
+{
+        enum ieee80211_band band;
+        int i;
+        if (!wdev->wext.beacon_interval)
+                wdev->wext.beacon_interval = 100;
+        /* try to find an IBSS channel if none requested ... */
+        if (!wdev->wext.channel) {
+                for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
+                        struct ieee80211_supported_band *sband;
+                        struct ieee80211_channel *chan;
+                        sband = rdev->wiphy.bands[band];
+                        if (!sband)
+                                continue;
+                        for (i = 0; i < sband->n_channels; i++) {
+                                chan = &sband->channels[i];
+                                if (chan->flags & IEEE80211_CHAN_NO_IBSS)
+                                        continue;
+                                if (chan->flags & IEEE80211_CHAN_DISABLED)
+                                        continue;
+                                wdev->wext.channel = chan;
+                                break;
+                        }
+                        if (wdev->wext.channel)
+                                break;
+                }
+                if (!wdev->wext.channel)
+                        return -EINVAL;
+        }
+        /* don't join -- SSID is not there */
+        if (!wdev->wext.ssid_len)
+                return 0;
+        if (!netif_running(wdev->netdev))
+                return 0;
+        return cfg80211_join_ibss(wiphy_to_dev(wdev->wiphy),
+                                  wdev->netdev, &wdev->wext);
+}
+int cfg80211_ibss_wext_siwfreq(struct net_device *dev,
+                               struct iw_request_info *info,
+                               struct iw_freq *freq, char *extra)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct ieee80211_channel *chan;
+        int err;
+        /* call only for ibss! */
+        if (WARN_ON(wdev->iftype != NL80211_IFTYPE_ADHOC))
+                return -EINVAL;
+        if (!wiphy_to_dev(wdev->wiphy)->ops->join_ibss)
+                return -EOPNOTSUPP;
+        chan = cfg80211_wext_freq(wdev->wiphy, freq);
+        if (chan && IS_ERR(chan))
+                return PTR_ERR(chan);
+        if (chan &&
+            (chan->flags & IEEE80211_CHAN_NO_IBSS ||
+             chan->flags & IEEE80211_CHAN_DISABLED))
+                return -EINVAL;
+        if (wdev->wext.channel == chan)
+                return 0;
+        if (wdev->ssid_len) {
+                err = cfg80211_leave_ibss(wiphy_to_dev(wdev->wiphy),
+                                          dev, true);
+                if (err)
+                        return err;
+        }
+        if (chan) {
+                wdev->wext.channel = chan;
+                wdev->wext.channel_fixed = true;
+        } else {
+                /* cfg80211_ibss_wext_join will pick one if needed */
+                wdev->wext.channel_fixed = false;
+        }
+        return cfg80211_ibss_wext_join(wiphy_to_dev(wdev->wiphy), wdev);
+}
+/* temporary symbol - mark GPL - in the future the handler won't be */
+EXPORT_SYMBOL_GPL(cfg80211_ibss_wext_siwfreq);
+int cfg80211_ibss_wext_giwfreq(struct net_device *dev,
+                               struct iw_request_info *info,
+                               struct iw_freq *freq, char *extra)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct ieee80211_channel *chan = NULL;
+        /* call only for ibss! */
+        if (WARN_ON(wdev->iftype != NL80211_IFTYPE_ADHOC))
+                return -EINVAL;
+        if (wdev->current_bss)
+                chan = wdev->current_bss->channel;
+        else if (wdev->wext.channel)
+                chan = wdev->wext.channel;
+        if (chan) {
+                freq->m = chan->center_freq;
+                freq->e = 6;
+                return 0;
+        }
+        /* no channel if not joining */
+        return -EINVAL;
+}
+/* temporary symbol - mark GPL - in the future the handler won't be */
+EXPORT_SYMBOL_GPL(cfg80211_ibss_wext_giwfreq);
+int cfg80211_ibss_wext_siwessid(struct net_device *dev,
+                                struct iw_request_info *info,
+                                struct iw_point *data, char *ssid)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        size_t len = data->length;
+        int err;
+        /* call only for ibss! */
+        if (WARN_ON(wdev->iftype != NL80211_IFTYPE_ADHOC))
+                return -EINVAL;
+        if (!wiphy_to_dev(wdev->wiphy)->ops->join_ibss)
+                return -EOPNOTSUPP;
+        if (wdev->ssid_len) {
+                err = cfg80211_leave_ibss(wiphy_to_dev(wdev->wiphy),
+                                          dev, true);
+                if (err)
+                        return err;
+        }
+        /* iwconfig uses nul termination in SSID.. */
+        if (len > 0 && ssid[len - 1] == '\0')
+                len--;
+        wdev->wext.ssid = wdev->ssid;
+        memcpy(wdev->wext.ssid, ssid, len);
+        wdev->wext.ssid_len = len;
+        return cfg80211_ibss_wext_join(wiphy_to_dev(wdev->wiphy), wdev);
+}
+/* temporary symbol - mark GPL - in the future the handler won't be */
+EXPORT_SYMBOL_GPL(cfg80211_ibss_wext_siwessid);
+int cfg80211_ibss_wext_giwessid(struct net_device *dev,
+                                struct iw_request_info *info,
+                                struct iw_point *data, char *ssid)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        /* call only for ibss! */
+        if (WARN_ON(wdev->iftype != NL80211_IFTYPE_ADHOC))
+                return -EINVAL;
+        data->flags = 0;
+        if (wdev->ssid_len) {
+                data->flags = 1;
+                data->length = wdev->ssid_len;
+                memcpy(ssid, wdev->ssid, data->length);
+        } else if (wdev->wext.ssid && wdev->wext.ssid_len) {
+                data->flags = 1;
+                data->length = wdev->wext.ssid_len;
+                memcpy(ssid, wdev->wext.ssid, data->length);
+        }
+        return 0;
+}
+/* temporary symbol - mark GPL - in the future the handler won't be */
+EXPORT_SYMBOL_GPL(cfg80211_ibss_wext_giwessid);
+int cfg80211_ibss_wext_siwap(struct net_device *dev,
+                             struct iw_request_info *info,
+                             struct sockaddr *ap_addr, char *extra)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        u8 *bssid = ap_addr->sa_data;
+        int err;
+        /* call only for ibss! */
+        if (WARN_ON(wdev->iftype != NL80211_IFTYPE_ADHOC))
+                return -EINVAL;
+        if (!wiphy_to_dev(wdev->wiphy)->ops->join_ibss)
+                return -EOPNOTSUPP;
+        if (ap_addr->sa_family != ARPHRD_ETHER)
+                return -EINVAL;
+        /* automatic mode */
+        if (is_zero_ether_addr(bssid) || is_broadcast_ether_addr(bssid))
+                bssid = NULL;
+        /* both automatic */
+        if (!bssid && !wdev->wext.bssid)
+                return 0;
+        /* fixed already - and no change */
+        if (wdev->wext.bssid && bssid &&
+            compare_ether_addr(bssid, wdev->wext.bssid) == 0)
+                return 0;
+        if (wdev->ssid_len) {
+                err = cfg80211_leave_ibss(wiphy_to_dev(wdev->wiphy),
+                                          dev, true);
+                if (err)
+                        return err;
+        }
+        if (bssid) {
+                memcpy(wdev->wext_bssid, bssid, ETH_ALEN);
+                wdev->wext.bssid = wdev->wext_bssid;
+        } else
+                wdev->wext.bssid = NULL;
+        return cfg80211_ibss_wext_join(wiphy_to_dev(wdev->wiphy), wdev);
+}
+/* temporary symbol - mark GPL - in the future the handler won't be */
+EXPORT_SYMBOL_GPL(cfg80211_ibss_wext_siwap);
+int cfg80211_ibss_wext_giwap(struct net_device *dev,
+                             struct iw_request_info *info,
+                             struct sockaddr *ap_addr, char *extra)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        /* call only for ibss! */
+        if (WARN_ON(wdev->iftype != NL80211_IFTYPE_ADHOC))
+                return -EINVAL;
+        ap_addr->sa_family = ARPHRD_ETHER;
+        if (wdev->wext.bssid) {
+                memcpy(ap_addr->sa_data, wdev->wext.bssid, ETH_ALEN);
+                return 0;
+        }
+        memcpy(ap_addr->sa_data, wdev->bssid, ETH_ALEN);
+        return 0;
+}
+/* temporary symbol - mark GPL - in the future the handler won't be */
+EXPORT_SYMBOL_GPL(cfg80211_ibss_wext_giwap);
+#endif
diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c
index bec5721b6f99..42184361a109 100644
--- a/net/wireless/mlme.c
+++ b/net/wireless/mlme.c
@@ -28,19 +28,55 @@ void cfg80211_send_rx_assoc(struct net_device *dev, const u8 *buf, size_t len)
 }
 EXPORT_SYMBOL(cfg80211_send_rx_assoc);
-void cfg80211_send_rx_deauth(struct net_device *dev, const u8 *buf, size_t len)
+void cfg80211_send_deauth(struct net_device *dev, const u8 *buf, size_t len)
 {
        struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
-        nl80211_send_rx_deauth(rdev, dev, buf, len);
+        nl80211_send_deauth(rdev, dev, buf, len);
 }
-EXPORT_SYMBOL(cfg80211_send_rx_deauth);
+EXPORT_SYMBOL(cfg80211_send_deauth);
-void cfg80211_send_rx_disassoc(struct net_device *dev, const u8 *buf,
+void cfg80211_send_disassoc(struct net_device *dev, const u8 *buf, size_t len)
-                               size_t len)
 {
        struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
-        nl80211_send_rx_disassoc(rdev, dev, buf, len);
+        nl80211_send_disassoc(rdev, dev, buf, len);
 }
-EXPORT_SYMBOL(cfg80211_send_rx_disassoc);
+EXPORT_SYMBOL(cfg80211_send_disassoc);
+static void cfg80211_wext_disconnected(struct net_device *dev)
+{
+#ifdef CONFIG_WIRELESS_EXT
+        union iwreq_data wrqu;
+        memset(&wrqu, 0, sizeof(wrqu));
+        wireless_send_event(dev, SIOCGIWAP, &wrqu, NULL);
+#endif
+}
+void cfg80211_send_auth_timeout(struct net_device *dev, const u8 *addr)
+{
+        struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+        nl80211_send_auth_timeout(rdev, dev, addr);
+        cfg80211_wext_disconnected(dev);
+}
+EXPORT_SYMBOL(cfg80211_send_auth_timeout);
+void cfg80211_send_assoc_timeout(struct net_device *dev, const u8 *addr)
+{
+        struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+        nl80211_send_assoc_timeout(rdev, dev, addr);
+        cfg80211_wext_disconnected(dev);
+}
+EXPORT_SYMBOL(cfg80211_send_assoc_timeout);
+void cfg80211_michael_mic_failure(struct net_device *dev, const u8 *addr,
+                                  enum nl80211_key_type key_type, int key_id,
+                                  const u8 *tsc)
+{
+        struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+        nl80211_michael_mic_failure(rdev, dev, addr, key_type, key_id, tsc);
+}
+EXPORT_SYMBOL(cfg80211_michael_mic_failure);
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 2456e4ee445e..b1fc98225fd1 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -61,6 +61,10 @@ static struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] __read_mostly = {
        [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
        [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
        [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
+        [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
+        [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
+        [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
+        [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
        [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
        [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
@@ -116,8 +120,40 @@ static struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] __read_mostly = {
                                .len = IEEE80211_MAX_SSID_LEN },
        [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
        [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
+        [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
+        [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 };
+/* IE validation */
+static bool is_valid_ie_attr(const struct nlattr *attr)
+{
+        const u8 *pos;
+        int len;
+        if (!attr)
+                return true;
+        pos = nla_data(attr);
+        len = nla_len(attr);
+        while (len) {
+                u8 elemlen;
+                if (len < 2)
+                        return false;
+                len -= 2;
+                elemlen = pos[1];
+                if (elemlen > len)
+                        return false;
+                len -= elemlen;
+                pos += 2 + elemlen;
+        }
+        return true;
+}
 /* message building helper */
 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 pid, u32 seq,
                                   int flags, u8 cmd)
@@ -126,6 +162,30 @@ static inline void *nl80211hdr_put(struct sk_buff *skb, u32 pid, u32 seq,
        return genlmsg_put(skb, pid, seq, &nl80211_fam, flags, cmd);
 }
+static int nl80211_msg_put_channel(struct sk_buff *msg,
+                                   struct ieee80211_channel *chan)
+{
+        NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_FREQ,
+                    chan->center_freq);
+        if (chan->flags & IEEE80211_CHAN_DISABLED)
+                NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_DISABLED);
+        if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN)
+                NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN);
+        if (chan->flags & IEEE80211_CHAN_NO_IBSS)
+                NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_NO_IBSS);
+        if (chan->flags & IEEE80211_CHAN_RADAR)
+                NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_RADAR);
+        NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
+                    DBM_TO_MBM(chan->max_power));
+        return 0;
+ nla_put_failure:
+        return -ENOBUFS;
+}
 /* netlink command implementations */
 static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
@@ -149,8 +209,24 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx);
        NLA_PUT_STRING(msg, NL80211_ATTR_WIPHY_NAME, wiphy_name(&dev->wiphy));
+        NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
+                   dev->wiphy.retry_short);
+        NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
+                   dev->wiphy.retry_long);
+        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
+                    dev->wiphy.frag_threshold);
+        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
+                    dev->wiphy.rts_threshold);
        NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
                   dev->wiphy.max_scan_ssids);
+        NLA_PUT_U16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
+                    dev->wiphy.max_scan_ie_len);
+        NLA_PUT(msg, NL80211_ATTR_CIPHER_SUITES,
+                sizeof(u32) * dev->wiphy.n_cipher_suites,
+                dev->wiphy.cipher_suites);
        nl_modes = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_IFTYPES);
        if (!nl_modes)
@@ -202,20 +278,9 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
                                goto nla_put_failure;
                        chan = &dev->wiphy.bands[band]->channels[i];
-                        NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_FREQ,
-                                    chan->center_freq);
-                        if (chan->flags & IEEE80211_CHAN_DISABLED)
-                                NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_DISABLED);
-                        if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN)
-                                NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN);
-                        if (chan->flags & IEEE80211_CHAN_NO_IBSS)
-                                NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_NO_IBSS);
-                        if (chan->flags & IEEE80211_CHAN_RADAR)
-                                NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_RADAR);
-                        NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
+                        if (nl80211_msg_put_channel(msg, chan))
-                                    DBM_TO_MBM(chan->max_power));
+                                goto nla_put_failure;
                        nla_nest_end(msg, nl_freq);
                }
@@ -273,6 +338,7 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
        CMD(assoc, ASSOCIATE);
        CMD(deauth, DEAUTHENTICATE);
        CMD(disassoc, DISASSOCIATE);
+        CMD(join_ibss, JOIN_IBSS);
 #undef CMD
        nla_nest_end(msg, nl_cmds);
@@ -365,6 +431,9 @@ static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
        struct cfg80211_registered_device *rdev;
        int result = 0, rem_txq_params = 0;
        struct nlattr *nl_txq_params;
+        u32 changed;
+        u8 retry_short = 0, retry_long = 0;
+        u32 frag_threshold = 0, rts_threshold = 0;
        rtnl_lock();
@@ -479,6 +548,84 @@ static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
                        goto bad_res;
        }
+        changed = 0;
+        if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
+                retry_short = nla_get_u8(
+                        info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
+                if (retry_short == 0) {
+                        result = -EINVAL;
+                        goto bad_res;
+                }
+                changed |= WIPHY_PARAM_RETRY_SHORT;
+        }
+        if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
+                retry_long = nla_get_u8(
+                        info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
+                if (retry_long == 0) {
+                        result = -EINVAL;
+                        goto bad_res;
+                }
+                changed |= WIPHY_PARAM_RETRY_LONG;
+        }
+        if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
+                frag_threshold = nla_get_u32(
+                        info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
+                if (frag_threshold < 256) {
+                        result = -EINVAL;
+                        goto bad_res;
+                }
+                if (frag_threshold != (u32) -1) {
+                        /*
+                         * Fragments (apart from the last one) are required to
+                         * have even length. Make the fragmentation code
+                         * simpler by stripping LSB should someone try to use
+                         * odd threshold value.
+                         */
+                        frag_threshold &= ~0x1;
+                }
+                changed |= WIPHY_PARAM_FRAG_THRESHOLD;
+        }
+        if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
+                rts_threshold = nla_get_u32(
+                        info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
+                changed |= WIPHY_PARAM_RTS_THRESHOLD;
+        }
+        if (changed) {
+                u8 old_retry_short, old_retry_long;
+                u32 old_frag_threshold, old_rts_threshold;
+                if (!rdev->ops->set_wiphy_params) {
+                        result = -EOPNOTSUPP;
+                        goto bad_res;
+                }
+                old_retry_short = rdev->wiphy.retry_short;
+                old_retry_long = rdev->wiphy.retry_long;
+                old_frag_threshold = rdev->wiphy.frag_threshold;
+                old_rts_threshold = rdev->wiphy.rts_threshold;
+                if (changed & WIPHY_PARAM_RETRY_SHORT)
+                        rdev->wiphy.retry_short = retry_short;
+                if (changed & WIPHY_PARAM_RETRY_LONG)
+                        rdev->wiphy.retry_long = retry_long;
+                if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
+                        rdev->wiphy.frag_threshold = frag_threshold;
+                if (changed & WIPHY_PARAM_RTS_THRESHOLD)
+                        rdev->wiphy.rts_threshold = rts_threshold;
+                result = rdev->ops->set_wiphy_params(&rdev->wiphy, changed);
+                if (result) {
+                        rdev->wiphy.retry_short = old_retry_short;
+                        rdev->wiphy.retry_long = old_retry_long;
+                        rdev->wiphy.frag_threshold = old_frag_threshold;
+                        rdev->wiphy.rts_threshold = old_rts_threshold;
+                }
+        }
 bad_res:
        mutex_unlock(&rdev->mtx);
@@ -489,6 +636,7 @@ static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
 static int nl80211_send_iface(struct sk_buff *msg, u32 pid, u32 seq, int flags,
+                              struct cfg80211_registered_device *rdev,
                              struct net_device *dev)
 {
        void *hdr;
@@ -498,6 +646,7 @@ static int nl80211_send_iface(struct sk_buff *msg, u32 pid, u32 seq, int flags,
                return -1;
        NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
+        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
        NLA_PUT_STRING(msg, NL80211_ATTR_IFNAME, dev->name);
        NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, dev->ieee80211_ptr->iftype);
        return genlmsg_end(msg, hdr);
@@ -532,7 +681,7 @@ static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *
                        }
                        if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).pid,
                                               cb->nlh->nlmsg_seq, NLM_F_MULTI,
-                                               wdev->netdev) < 0) {
+                                               dev, wdev->netdev) < 0) {
                                mutex_unlock(&dev->devlist_mtx);
                                goto out;
                        }
@@ -566,7 +715,8 @@ static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
        if (!msg)
                goto out_err;
-        if (nl80211_send_iface(msg, info->snd_pid, info->snd_seq, 0, netdev) < 0)
+        if (nl80211_send_iface(msg, info->snd_pid, info->snd_seq, 0,
+                               dev, netdev) < 0)
                goto out_free;
        dev_put(netdev);
@@ -616,7 +766,7 @@ static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
        struct cfg80211_registered_device *drv;
        struct vif_params params;
        int err, ifindex;
-        enum nl80211_iftype type;
+        enum nl80211_iftype otype, ntype;
        struct net_device *dev;
        u32 _flags, *flags = NULL;
        bool change = false;
@@ -630,30 +780,27 @@ static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
                goto unlock_rtnl;
        ifindex = dev->ifindex;
-        type = dev->ieee80211_ptr->iftype;
+        otype = ntype = dev->ieee80211_ptr->iftype;
        dev_put(dev);
        if (info->attrs[NL80211_ATTR_IFTYPE]) {
-                enum nl80211_iftype ntype;
                ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
-                if (type != ntype)
+                if (otype != ntype)
                        change = true;
-                type = ntype;
+                if (ntype > NL80211_IFTYPE_MAX) {
-                if (type > NL80211_IFTYPE_MAX) {
                        err = -EINVAL;
                        goto unlock;
                }
        }
        if (!drv->ops->change_virtual_intf ||
-            !(drv->wiphy.interface_modes & (1 << type))) {
+            !(drv->wiphy.interface_modes & (1 << ntype))) {
                err = -EOPNOTSUPP;
                goto unlock;
        }
        if (info->attrs[NL80211_ATTR_MESH_ID]) {
-                if (type != NL80211_IFTYPE_MESH_POINT) {
+                if (ntype != NL80211_IFTYPE_MESH_POINT) {
                        err = -EINVAL;
                        goto unlock;
                }
@@ -663,7 +810,7 @@ static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
        }
        if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
-                if (type != NL80211_IFTYPE_MONITOR) {
+                if (ntype != NL80211_IFTYPE_MONITOR) {
                        err = -EINVAL;
                        goto unlock;
                }
@@ -678,12 +825,17 @@ static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
        if (change)
                err = drv->ops->change_virtual_intf(&drv->wiphy, ifindex,
-                                                    type, flags, &params);
+                                                    ntype, flags, &params);
        else
                err = 0;
        dev = __dev_get_by_index(&init_net, ifindex);
-        WARN_ON(!dev || (!err && dev->ieee80211_ptr->iftype != type));
+        WARN_ON(!dev || (!err && dev->ieee80211_ptr->iftype != ntype));
+        if (dev && !err && (ntype != otype)) {
+                if (otype == NL80211_IFTYPE_ADHOC)
+                        cfg80211_clear_ibss(dev, false);
+        }
 unlock:
        cfg80211_put_dev(drv);
@@ -934,7 +1086,7 @@ static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
 {
        struct cfg80211_registered_device *drv;
-        int err;
+        int err, i;
        struct net_device *dev;
        struct key_params params;
        u8 key_idx = 0;
@@ -1003,6 +1155,14 @@ static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
        if (err)
                goto unlock_rtnl;
+        for (i = 0; i < drv->wiphy.n_cipher_suites; i++)
+                if (params.cipher == drv->wiphy.cipher_suites[i])
+                        break;
+        if (i == drv->wiphy.n_cipher_suites) {
+                err = -EINVAL;
+                goto out;
+        }
        if (!drv->ops->add_key) {
                err = -EOPNOTSUPP;
                goto out;
@@ -1069,6 +1229,9 @@ static int nl80211_addset_beacon(struct sk_buff *skb, struct genl_info *info)
        struct beacon_parameters params;
        int haveinfo = 0;
+        if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_BEACON_TAIL]))
+                return -EINVAL;
        rtnl_lock();
        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
@@ -2442,6 +2605,9 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
        enum ieee80211_band band;
        size_t ie_len;
+        if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
+                return -EINVAL;
        rtnl_lock();
        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
@@ -2492,6 +2658,11 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
        else
                ie_len = 0;
+        if (ie_len > wiphy->max_scan_ie_len) {
+                err = -EINVAL;
+                goto out;
+        }
        request = kzalloc(sizeof(*request)
                        + sizeof(*ssid) * n_ssids
                        + sizeof(channel) * n_channels
@@ -2554,7 +2725,8 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
        if (info->attrs[NL80211_ATTR_IE]) {
                request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
-                memcpy(request->ie, nla_data(info->attrs[NL80211_ATTR_IE]),
+                memcpy((void *)request->ie,
+                       nla_data(info->attrs[NL80211_ATTR_IE]),
                       request->ie_len);
        }
@@ -2710,6 +2882,15 @@ static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
        struct wiphy *wiphy;
        int err;
+        if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
+                return -EINVAL;
+        if (!info->attrs[NL80211_ATTR_MAC])
+                return -EINVAL;
+        if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
+                return -EINVAL;
        rtnl_lock();
        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
@@ -2731,11 +2912,6 @@ static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
                goto out;
        }
-        if (!info->attrs[NL80211_ATTR_MAC]) {
-                err = -EINVAL;
-                goto out;
-        }
        wiphy = &drv->wiphy;
        memset(&req, 0, sizeof(req));
@@ -2761,13 +2937,10 @@ static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
                req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
        }
-        if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
+        req.auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
-                req.auth_type =
+        if (!nl80211_valid_auth_type(req.auth_type)) {
-                        nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
+                err = -EINVAL;
-                if (!nl80211_valid_auth_type(req.auth_type)) {
+                goto out;
-                        err = -EINVAL;
-                        goto out;
-                }
        }
        err = drv->ops->auth(&drv->wiphy, dev, &req);
@@ -2788,6 +2961,13 @@ static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
        struct wiphy *wiphy;
        int err;
+        if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
+                return -EINVAL;
+        if (!info->attrs[NL80211_ATTR_MAC] ||
+            !info->attrs[NL80211_ATTR_SSID])
+                return -EINVAL;
        rtnl_lock();
        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
@@ -2809,12 +2989,6 @@ static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
                goto out;
        }
-        if (!info->attrs[NL80211_ATTR_MAC] ||
-            !info->attrs[NL80211_ATTR_SSID]) {
-                err = -EINVAL;
-                goto out;
-        }
        wiphy = &drv->wiphy;
        memset(&req, 0, sizeof(req));
@@ -2856,6 +3030,15 @@ static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
        struct wiphy *wiphy;
        int err;
+        if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
+                return -EINVAL;
+        if (!info->attrs[NL80211_ATTR_MAC])
+                return -EINVAL;
+        if (!info->attrs[NL80211_ATTR_REASON_CODE])
+                return -EINVAL;
        rtnl_lock();
        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
@@ -2877,24 +3060,16 @@ static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
                goto out;
        }
-        if (!info->attrs[NL80211_ATTR_MAC]) {
-                err = -EINVAL;
-                goto out;
-        }
        wiphy = &drv->wiphy;
        memset(&req, 0, sizeof(req));
        req.peer_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
-        if (info->attrs[NL80211_ATTR_REASON_CODE]) {
+        req.reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
-                req.reason_code =
+        if (req.reason_code == 0) {
-                        nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
+                /* Reason Code 0 is reserved */
-                if (req.reason_code == 0) {
+                err = -EINVAL;
-                        /* Reason Code 0 is reserved */
+                goto out;
-                        err = -EINVAL;
-                        goto out;
-                }
        }
        if (info->attrs[NL80211_ATTR_IE]) {
@@ -2920,6 +3095,15 @@ static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
        struct wiphy *wiphy;
        int err;
+        if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
+                return -EINVAL;
+        if (!info->attrs[NL80211_ATTR_MAC])
+                return -EINVAL;
+        if (!info->attrs[NL80211_ATTR_REASON_CODE])
+                return -EINVAL;
        rtnl_lock();
        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
@@ -2941,24 +3125,16 @@ static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
                goto out;
        }
-        if (!info->attrs[NL80211_ATTR_MAC]) {
-                err = -EINVAL;
-                goto out;
-        }
        wiphy = &drv->wiphy;
        memset(&req, 0, sizeof(req));
        req.peer_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
-        if (info->attrs[NL80211_ATTR_REASON_CODE]) {
+        req.reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
-                req.reason_code =
+        if (req.reason_code == 0) {
-                        nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
+                /* Reason Code 0 is reserved */
-                if (req.reason_code == 0) {
+                err = -EINVAL;
-                        /* Reason Code 0 is reserved */
+                goto out;
-                        err = -EINVAL;
-                        goto out;
-                }
        }
        if (info->attrs[NL80211_ATTR_IE]) {
@@ -2976,6 +3152,124 @@ unlock_rtnl:
        return err;
 }
+static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
+{
+        struct cfg80211_registered_device *drv;
+        struct net_device *dev;
+        struct cfg80211_ibss_params ibss;
+        struct wiphy *wiphy;
+        int err;
+        memset(&ibss, 0, sizeof(ibss));
+        if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
+                return -EINVAL;
+        if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
+            !info->attrs[NL80211_ATTR_SSID] ||
+            !nla_len(info->attrs[NL80211_ATTR_SSID]))
+                return -EINVAL;
+        ibss.beacon_interval = 100;
+        if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
+                ibss.beacon_interval =
+                        nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
+                if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
+                        return -EINVAL;
+        }
+        rtnl_lock();
+        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
+        if (err)
+                goto unlock_rtnl;
+        if (!drv->ops->join_ibss) {
+                err = -EOPNOTSUPP;
+                goto out;
+        }
+        if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) {
+                err = -EOPNOTSUPP;
+                goto out;
+        }
+        if (!netif_running(dev)) {
+                err = -ENETDOWN;
+                goto out;
+        }
+        wiphy = &drv->wiphy;
+        if (info->attrs[NL80211_ATTR_MAC])
+                ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
+        ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
+        ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
+        if (info->attrs[NL80211_ATTR_IE]) {
+                ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
+                ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
+        }
+        ibss.channel = ieee80211_get_channel(wiphy,
+                nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
+        if (!ibss.channel ||
+            ibss.channel->flags & IEEE80211_CHAN_NO_IBSS ||
+            ibss.channel->flags & IEEE80211_CHAN_DISABLED) {
+                err = -EINVAL;
+                goto out;
+        }
+        ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
+        err = cfg80211_join_ibss(drv, dev, &ibss);
+out:
+        cfg80211_put_dev(drv);
+        dev_put(dev);
+unlock_rtnl:
+        rtnl_unlock();
+        return err;
+}
+static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
+{
+        struct cfg80211_registered_device *drv;
+        struct net_device *dev;
+        int err;
+        rtnl_lock();
+        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
+        if (err)
+                goto unlock_rtnl;
+        if (!drv->ops->leave_ibss) {
+                err = -EOPNOTSUPP;
+                goto out;
+        }
+        if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) {
+                err = -EOPNOTSUPP;
+                goto out;
+        }
+        if (!netif_running(dev)) {
+                err = -ENETDOWN;
+                goto out;
+        }
+        err = cfg80211_leave_ibss(drv, dev, false);
+out:
+        cfg80211_put_dev(drv);
+        dev_put(dev);
+unlock_rtnl:
+        rtnl_unlock();
+        return err;
+}
 static struct genl_ops nl80211_ops[] = {
        {
                .cmd = NL80211_CMD_GET_WIPHY,
@@ -3177,6 +3471,18 @@ static struct genl_ops nl80211_ops[] = {
                .policy = nl80211_policy,
                .flags = GENL_ADMIN_PERM,
        },
+        {
+                .cmd = NL80211_CMD_JOIN_IBSS,
+                .doit = nl80211_join_ibss,
+                .policy = nl80211_policy,
+                .flags = GENL_ADMIN_PERM,
+        },
+        {
+                .cmd = NL80211_CMD_LEAVE_IBSS,
+                .doit = nl80211_leave_ibss,
+                .policy = nl80211_policy,
+                .flags = GENL_ADMIN_PERM,
+        },
 };
 static struct genl_multicast_group nl80211_mlme_mcgrp = {
        .name = "mlme",
@@ -3375,22 +3681,197 @@ void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
        nl80211_send_mlme_event(rdev, netdev, buf, len, NL80211_CMD_ASSOCIATE);
 }
-void nl80211_send_rx_deauth(struct cfg80211_registered_device *rdev,
+void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
-                            struct net_device *netdev, const u8 *buf,
+                         struct net_device *netdev, const u8 *buf, size_t len)
-                            size_t len)
 {
        nl80211_send_mlme_event(rdev, netdev, buf, len,
                                NL80211_CMD_DEAUTHENTICATE);
 }
-void nl80211_send_rx_disassoc(struct cfg80211_registered_device *rdev,
+void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
-                              struct net_device *netdev, const u8 *buf,
+                           struct net_device *netdev, const u8 *buf,
-                              size_t len)
+                           size_t len)
 {
        nl80211_send_mlme_event(rdev, netdev, buf, len,
                                NL80211_CMD_DISASSOCIATE);
 }
+void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
+                               struct net_device *netdev, int cmd,
+                               const u8 *addr)
+{
+        struct sk_buff *msg;
+        void *hdr;
+        msg = nlmsg_new(NLMSG_GOODSIZE, GFP_ATOMIC);
+        if (!msg)
+                return;
+        hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
+        if (!hdr) {
+                nlmsg_free(msg);
+                return;
+        }
+        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
+        NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
+        NLA_PUT_FLAG(msg, NL80211_ATTR_TIMED_OUT);
+        NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
+        if (genlmsg_end(msg, hdr) < 0) {
+                nlmsg_free(msg);
+                return;
+        }
+        genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, GFP_ATOMIC);
+        return;
+ nla_put_failure:
+        genlmsg_cancel(msg, hdr);
+        nlmsg_free(msg);
+}
+void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
+                               struct net_device *netdev, const u8 *addr)
+{
+        nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
+                                  addr);
+}
+void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
+                                struct net_device *netdev, const u8 *addr)
+{
+        nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE, addr);
+}
+void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
+                             struct net_device *netdev, const u8 *bssid,
+                             gfp_t gfp)
+{
+        struct sk_buff *msg;
+        void *hdr;
+        msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
+        if (!msg)
+                return;
+        hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
+        if (!hdr) {
+                nlmsg_free(msg);
+                return;
+        }
+        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
+        NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
+        NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
+        if (genlmsg_end(msg, hdr) < 0) {
+                nlmsg_free(msg);
+                return;
+        }
+        genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
+        return;
+ nla_put_failure:
+        genlmsg_cancel(msg, hdr);
+        nlmsg_free(msg);
+}
+void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
+                                 struct net_device *netdev, const u8 *addr,
+                                 enum nl80211_key_type key_type, int key_id,
+                                 const u8 *tsc)
+{
+        struct sk_buff *msg;
+        void *hdr;
+        msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
+        if (!msg)
+                return;
+        hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
+        if (!hdr) {
+                nlmsg_free(msg);
+                return;
+        }
+        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
+        NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
+        if (addr)
+                NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
+        NLA_PUT_U32(msg, NL80211_ATTR_KEY_TYPE, key_type);
+        NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_id);
+        if (tsc)
+                NLA_PUT(msg, NL80211_ATTR_KEY_SEQ, 6, tsc);
+        if (genlmsg_end(msg, hdr) < 0) {
+                nlmsg_free(msg);
+                return;
+        }
+        genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, GFP_KERNEL);
+        return;
+ nla_put_failure:
+        genlmsg_cancel(msg, hdr);
+        nlmsg_free(msg);
+}
+void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
+                                    struct ieee80211_channel *channel_before,
+                                    struct ieee80211_channel *channel_after)
+{
+        struct sk_buff *msg;
+        void *hdr;
+        struct nlattr *nl_freq;
+        msg = nlmsg_new(NLMSG_GOODSIZE, GFP_ATOMIC);
+        if (!msg)
+                return;
+        hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
+        if (!hdr) {
+                nlmsg_free(msg);
+                return;
+        }
+        /*
+         * Since we are applying the beacon hint to a wiphy we know its
+         * wiphy_idx is valid
+         */
+        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy));
+        /* Before */
+        nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
+        if (!nl_freq)
+                goto nla_put_failure;
+        if (nl80211_msg_put_channel(msg, channel_before))
+                goto nla_put_failure;
+        nla_nest_end(msg, nl_freq);
+        /* After */
+        nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
+        if (!nl_freq)
+                goto nla_put_failure;
+        if (nl80211_msg_put_channel(msg, channel_after))
+                goto nla_put_failure;
+        nla_nest_end(msg, nl_freq);
+        if (genlmsg_end(msg, hdr) < 0) {
+                nlmsg_free(msg);
+                return;
+        }
+        genlmsg_multicast(msg, 0, nl80211_regulatory_mcgrp.id, GFP_ATOMIC);
+        return;
+nla_put_failure:
+        genlmsg_cancel(msg, hdr);
+        nlmsg_free(msg);
+}
 /* initialisation/exit functions */
 int nl80211_init(void)
diff --git a/net/wireless/nl80211.h b/net/wireless/nl80211.h
index b77af4ab80be..5c12ad13499b 100644
--- a/net/wireless/nl80211.h
+++ b/net/wireless/nl80211.h
@@ -17,11 +17,31 @@ extern void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
 extern void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
                                  struct net_device *netdev,
                                  const u8 *buf, size_t len);
-extern void nl80211_send_rx_deauth(struct cfg80211_registered_device *rdev,
+extern void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
-                                   struct net_device *netdev,
+                                struct net_device *netdev,
-                                   const u8 *buf, size_t len);
+                                const u8 *buf, size_t len);
-extern void nl80211_send_rx_disassoc(struct cfg80211_registered_device *rdev,
+extern void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
-                                     struct net_device *netdev,
+                                  struct net_device *netdev,
-                                     const u8 *buf, size_t len);
+                                  const u8 *buf, size_t len);
+extern void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
+                                      struct net_device *netdev,
+                                      const u8 *addr);
+extern void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
+                                       struct net_device *netdev,
+                                       const u8 *addr);
+extern void
+nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
+                            struct net_device *netdev, const u8 *addr,
+                            enum nl80211_key_type key_type,
+                            int key_id, const u8 *tsc);
+extern void
+nl80211_send_beacon_hint_event(struct wiphy *wiphy,
+                               struct ieee80211_channel *channel_before,
+                               struct ieee80211_channel *channel_after);
+void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
+                             struct net_device *netdev, const u8 *bssid,
+                             gfp_t gfp);
 #endif /* __NET_WIRELESS_NL80211_H */
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 6c1993d99902..f38cc39fa79e 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -37,7 +37,6 @@
 #include <linux/random.h>
 #include <linux/nl80211.h>
 #include <linux/platform_device.h>
-#include <net/wireless.h>
 #include <net/cfg80211.h>
 #include "core.h"
 #include "reg.h"
@@ -1049,18 +1048,10 @@ static void handle_reg_beacon(struct wiphy *wiphy,
                              unsigned int chan_idx,
                              struct reg_beacon *reg_beacon)
 {
-#ifdef CONFIG_CFG80211_REG_DEBUG
-#define REG_DEBUG_BEACON_FLAG(desc) \
-        printk(KERN_DEBUG "cfg80211: Enabling " desc " on " \
-                "frequency: %d MHz (Ch %d) on %s\n", \
-                reg_beacon->chan.center_freq, \
-                ieee80211_frequency_to_channel(reg_beacon->chan.center_freq), \
-                wiphy_name(wiphy));
-#else
-#define REG_DEBUG_BEACON_FLAG(desc) do {} while (0)
-#endif
        struct ieee80211_supported_band *sband;
        struct ieee80211_channel *chan;
+        bool channel_changed = false;
+        struct ieee80211_channel chan_before;
        assert_cfg80211_lock();
@@ -1070,18 +1061,28 @@ static void handle_reg_beacon(struct wiphy *wiphy,
        if (likely(chan->center_freq != reg_beacon->chan.center_freq))
                return;
-        if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN) {
+        if (chan->beacon_found)
+                return;
+        chan->beacon_found = true;
+        chan_before.center_freq = chan->center_freq;
+        chan_before.flags = chan->flags;
+        if ((chan->flags & IEEE80211_CHAN_PASSIVE_SCAN) &&
+            !(chan->orig_flags & IEEE80211_CHAN_PASSIVE_SCAN)) {
                chan->flags &= ~IEEE80211_CHAN_PASSIVE_SCAN;
-                REG_DEBUG_BEACON_FLAG("active scanning");
+                channel_changed = true;
        }
-        if (chan->flags & IEEE80211_CHAN_NO_IBSS) {
+        if ((chan->flags & IEEE80211_CHAN_NO_IBSS) &&
+            !(chan->orig_flags & IEEE80211_CHAN_NO_IBSS)) {
                chan->flags &= ~IEEE80211_CHAN_NO_IBSS;
-                REG_DEBUG_BEACON_FLAG("beaconing");
+                channel_changed = true;
        }
-        chan->beacon_found = true;
+        if (channel_changed)
-#undef REG_DEBUG_BEACON_FLAG
+                nl80211_send_beacon_hint_event(wiphy, &chan_before, chan);
 }
 /*
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index 2ae65b39b529..723aeb3d9462 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -414,6 +414,55 @@ cfg80211_bss_update(struct cfg80211_registered_device *dev,
        return found;
 }
+struct cfg80211_bss*
+cfg80211_inform_bss(struct wiphy *wiphy,
+                    struct ieee80211_channel *channel,
+                    const u8 *bssid,
+                    u64 timestamp, u16 capability, u16 beacon_interval,
+                    const u8 *ie, size_t ielen,
+                    s32 signal, gfp_t gfp)
+{
+        struct cfg80211_internal_bss *res;
+        size_t privsz;
+        if (WARN_ON(!wiphy))
+                return NULL;
+        privsz = wiphy->bss_priv_size;
+        if (WARN_ON(wiphy->signal_type == NL80211_BSS_SIGNAL_UNSPEC &&
+                        (signal < 0 || signal > 100)))
+                return NULL;
+        res = kzalloc(sizeof(*res) + privsz + ielen, gfp);
+        if (!res)
+                return NULL;
+        memcpy(res->pub.bssid, bssid, ETH_ALEN);
+        res->pub.channel = channel;
+        res->pub.signal = signal;
+        res->pub.tsf = timestamp;
+        res->pub.beacon_interval = beacon_interval;
+        res->pub.capability = capability;
+        /* point to after the private area */
+        res->pub.information_elements = (u8 *)res + sizeof(*res) + privsz;
+        memcpy(res->pub.information_elements, ie, ielen);
+        res->pub.len_information_elements = ielen;
+        kref_init(&res->ref);
+        res = cfg80211_bss_update(wiphy_to_dev(wiphy), res, 0);
+        if (!res)
+                return NULL;
+        if (res->pub.capability & WLAN_CAPABILITY_ESS)
+                regulatory_hint_found_beacon(wiphy, channel, gfp);
+        /* cfg80211_bss_update gives us a referenced result */
+        return &res->pub;
+}
+EXPORT_SYMBOL(cfg80211_inform_bss);
 struct cfg80211_bss *
 cfg80211_inform_bss_frame(struct wiphy *wiphy,
                          struct ieee80211_channel *channel,
@@ -604,7 +653,7 @@ int cfg80211_wext_siwscan(struct net_device *dev,
        cfg80211_put_dev(rdev);
        return err;
 }
-EXPORT_SYMBOL(cfg80211_wext_siwscan);
+EXPORT_SYMBOL_GPL(cfg80211_wext_siwscan);
 static void ieee80211_scan_add_ies(struct iw_request_info *info,
                                   struct cfg80211_bss *bss,
@@ -913,5 +962,5 @@ int cfg80211_wext_giwscan(struct net_device *dev,
        cfg80211_put_dev(rdev);
        return res;
 }
-EXPORT_SYMBOL(cfg80211_wext_giwscan);
+EXPORT_SYMBOL_GPL(cfg80211_wext_giwscan);
 #endif
diff --git a/net/wireless/util.c b/net/wireless/util.c
index 487cdd9bcffc..5f7e997195c7 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -1,10 +1,10 @@
 /*
 * Wireless utility functions
 *
- * Copyright 2007       Johannes Berg <johannes@sipsolutions.net>
+ * Copyright 2007-2009  Johannes Berg <johannes@sipsolutions.net>
 */
-#include <net/wireless.h>
+#include <linux/bitops.h>
-#include <asm/bitops.h>
+#include <net/cfg80211.h>
 #include "core.h"
 struct ieee80211_rate *
diff --git a/net/wireless/wext-compat.c b/net/wireless/wext-compat.c
index 0fd1db6e95bb..5ef82f2ca88f 100644
--- a/net/wireless/wext-compat.c
+++ b/net/wireless/wext-compat.c
@@ -10,8 +10,8 @@
 #include <linux/wireless.h>
 #include <linux/nl80211.h>
+#include <linux/if_arp.h>
 #include <net/iw_handler.h>
-#include <net/wireless.h>
 #include <net/cfg80211.h>
 #include "core.h"
@@ -57,7 +57,7 @@ int cfg80211_wext_giwname(struct net_device *dev,
        return 0;
 }
-EXPORT_SYMBOL(cfg80211_wext_giwname);
+EXPORT_SYMBOL_GPL(cfg80211_wext_giwname);
 int cfg80211_wext_siwmode(struct net_device *dev, struct iw_request_info *info,
                          u32 *mode, char *extra)
@@ -108,7 +108,7 @@ int cfg80211_wext_siwmode(struct net_device *dev, struct iw_request_info *info,
        return ret;
 }
-EXPORT_SYMBOL(cfg80211_wext_siwmode);
+EXPORT_SYMBOL_GPL(cfg80211_wext_siwmode);
 int cfg80211_wext_giwmode(struct net_device *dev, struct iw_request_info *info,
                          u32 *mode, char *extra)
@@ -143,7 +143,7 @@ int cfg80211_wext_giwmode(struct net_device *dev, struct iw_request_info *info,
        }
        return 0;
 }
-EXPORT_SYMBOL(cfg80211_wext_giwmode);
+EXPORT_SYMBOL_GPL(cfg80211_wext_giwmode);
 int cfg80211_wext_giwrange(struct net_device *dev,
@@ -206,7 +206,6 @@ int cfg80211_wext_giwrange(struct net_device *dev,
        range->enc_capa = IW_ENC_CAPA_WPA | IW_ENC_CAPA_WPA2 |
                          IW_ENC_CAPA_CIPHER_TKIP | IW_ENC_CAPA_CIPHER_CCMP;
        for (band = 0; band < IEEE80211_NUM_BANDS; band ++) {
                int i;
                struct ieee80211_supported_band *sband;
@@ -240,4 +239,229 @@ int cfg80211_wext_giwrange(struct net_device *dev,
        return 0;
 }
-EXPORT_SYMBOL(cfg80211_wext_giwrange);
+EXPORT_SYMBOL_GPL(cfg80211_wext_giwrange);
+int cfg80211_wext_siwmlme(struct net_device *dev,
+                          struct iw_request_info *info,
+                          struct iw_point *data, char *extra)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct iw_mlme *mlme = (struct iw_mlme *)extra;
+        struct cfg80211_registered_device *rdev;
+        union {
+                struct cfg80211_disassoc_request disassoc;
+                struct cfg80211_deauth_request deauth;
+        } cmd;
+        if (!wdev)
+                return -EOPNOTSUPP;
+        rdev = wiphy_to_dev(wdev->wiphy);
+        if (wdev->iftype != NL80211_IFTYPE_STATION)
+                return -EINVAL;
+        if (mlme->addr.sa_family != ARPHRD_ETHER)
+                return -EINVAL;
+        memset(&cmd, 0, sizeof(cmd));
+        switch (mlme->cmd) {
+        case IW_MLME_DEAUTH:
+                if (!rdev->ops->deauth)
+                        return -EOPNOTSUPP;
+                cmd.deauth.peer_addr = mlme->addr.sa_data;
+                cmd.deauth.reason_code = mlme->reason_code;
+                return rdev->ops->deauth(wdev->wiphy, dev, &cmd.deauth);
+        case IW_MLME_DISASSOC:
+                if (!rdev->ops->disassoc)
+                        return -EOPNOTSUPP;
+                cmd.disassoc.peer_addr = mlme->addr.sa_data;
+                cmd.disassoc.reason_code = mlme->reason_code;
+                return rdev->ops->disassoc(wdev->wiphy, dev, &cmd.disassoc);
+        default:
+                return -EOPNOTSUPP;
+        }
+}
+EXPORT_SYMBOL_GPL(cfg80211_wext_siwmlme);
+/**
+ * cfg80211_wext_freq - get wext frequency for non-"auto"
+ * @wiphy: the wiphy
+ * @freq: the wext freq encoding
+ *
+ * Returns a channel, %NULL for auto, or an ERR_PTR for errors!
+ */
+struct ieee80211_channel *cfg80211_wext_freq(struct wiphy *wiphy,
+                                             struct iw_freq *freq)
+{
+        if (freq->e == 0) {
+                if (freq->m < 0)
+                        return NULL;
+                else
+                        return ieee80211_get_channel(wiphy,
+                                ieee80211_channel_to_frequency(freq->m));
+        } else {
+                int i, div = 1000000;
+                for (i = 0; i < freq->e; i++)
+                        div /= 10;
+                if (div > 0)
+                        return ieee80211_get_channel(wiphy, freq->m / div);
+                else
+                        return ERR_PTR(-EINVAL);
+        }
+}
+EXPORT_SYMBOL_GPL(cfg80211_wext_freq);
+int cfg80211_wext_siwrts(struct net_device *dev,
+                         struct iw_request_info *info,
+                         struct iw_param *rts, char *extra)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        u32 orts = wdev->wiphy->rts_threshold;
+        int err;
+        if (rts->disabled || !rts->fixed)
+                wdev->wiphy->rts_threshold = (u32) -1;
+        else if (rts->value < 0)
+                return -EINVAL;
+        else
+                wdev->wiphy->rts_threshold = rts->value;
+        err = rdev->ops->set_wiphy_params(wdev->wiphy,
+                                          WIPHY_PARAM_RTS_THRESHOLD);
+        if (err)
+                wdev->wiphy->rts_threshold = orts;
+        return err;
+}
+EXPORT_SYMBOL_GPL(cfg80211_wext_siwrts);
+int cfg80211_wext_giwrts(struct net_device *dev,
+                         struct iw_request_info *info,
+                         struct iw_param *rts, char *extra)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        rts->value = wdev->wiphy->rts_threshold;
+        rts->disabled = rts->value == (u32) -1;
+        rts->fixed = 1;
+        return 0;
+}
+EXPORT_SYMBOL_GPL(cfg80211_wext_giwrts);
+int cfg80211_wext_siwfrag(struct net_device *dev,
+                          struct iw_request_info *info,
+                          struct iw_param *frag, char *extra)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        u32 ofrag = wdev->wiphy->frag_threshold;
+        int err;
+        if (frag->disabled || !frag->fixed)
+                wdev->wiphy->frag_threshold = (u32) -1;
+        else if (frag->value < 256)
+                return -EINVAL;
+        else {
+                /* Fragment length must be even, so strip LSB. */
+                wdev->wiphy->frag_threshold = frag->value & ~0x1;
+        }
+        err = rdev->ops->set_wiphy_params(wdev->wiphy,
+                                          WIPHY_PARAM_FRAG_THRESHOLD);
+        if (err)
+                wdev->wiphy->frag_threshold = ofrag;
+        return err;
+}
+EXPORT_SYMBOL_GPL(cfg80211_wext_siwfrag);
+int cfg80211_wext_giwfrag(struct net_device *dev,
+                          struct iw_request_info *info,
+                          struct iw_param *frag, char *extra)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        frag->value = wdev->wiphy->frag_threshold;
+        frag->disabled = frag->value == (u32) -1;
+        frag->fixed = 1;
+        return 0;
+}
+EXPORT_SYMBOL_GPL(cfg80211_wext_giwfrag);
+int cfg80211_wext_siwretry(struct net_device *dev,
+                           struct iw_request_info *info,
+                           struct iw_param *retry, char *extra)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        u32 changed = 0;
+        u8 olong = wdev->wiphy->retry_long;
+        u8 oshort = wdev->wiphy->retry_short;
+        int err;
+        if (retry->disabled ||
+            (retry->flags & IW_RETRY_TYPE) != IW_RETRY_LIMIT)
+                return -EINVAL;
+        if (retry->flags & IW_RETRY_LONG) {
+                wdev->wiphy->retry_long = retry->value;
+                changed |= WIPHY_PARAM_RETRY_LONG;
+        } else if (retry->flags & IW_RETRY_SHORT) {
+                wdev->wiphy->retry_short = retry->value;
+                changed |= WIPHY_PARAM_RETRY_SHORT;
+        } else {
+                wdev->wiphy->retry_short = retry->value;
+                wdev->wiphy->retry_long = retry->value;
+                changed |= WIPHY_PARAM_RETRY_LONG;
+                changed |= WIPHY_PARAM_RETRY_SHORT;
+        }
+        if (!changed)
+                return 0;
+        err = rdev->ops->set_wiphy_params(wdev->wiphy, changed);
+        if (err) {
+                wdev->wiphy->retry_short = oshort;
+                wdev->wiphy->retry_long = olong;
+        }
+        return err;
+}
+EXPORT_SYMBOL_GPL(cfg80211_wext_siwretry);
+int cfg80211_wext_giwretry(struct net_device *dev,
+                           struct iw_request_info *info,
+                           struct iw_param *retry, char *extra)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        retry->disabled = 0;
+        if (retry->flags == 0 || (retry->flags & IW_RETRY_SHORT)) {
+                /*
+                 * First return short value, iwconfig will ask long value
+                 * later if needed
+                 */
+                retry->flags |= IW_RETRY_LIMIT;
+                retry->value = wdev->wiphy->retry_short;
+                if (wdev->wiphy->retry_long != wdev->wiphy->retry_short)
+                        retry->flags |= IW_RETRY_LONG;
+                return 0;
+        }
+        if (retry->flags & IW_RETRY_LONG) {
+                retry->flags = IW_RETRY_LIMIT | IW_RETRY_LONG;
+                retry->value = wdev->wiphy->retry_long;
+        }
+        return 0;
+}
+EXPORT_SYMBOL_GPL(cfg80211_wext_giwretry);