9 files changed, 363 insertions, 237 deletions

diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 8af576c1d2f1..699d97b8de5e 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -33,6 +33,8 @@ nl80211_type_to_mac80211_type(enum nl80211_iftype type)
         case NL80211_IFTYPE_MESH_POINT:
                 return IEEE80211_IF_TYPE_MESH_POINT;
 #endif
+        case NL80211_IFTYPE_WDS:
+                return IEEE80211_IF_TYPE_WDS;
         default:
                 return IEEE80211_IF_TYPE_INVALID;
         }
@@ -718,12 +720,18 @@ static int ieee80211_del_station(struct wiphy *wiphy, struct net_device *dev,
         struct sta_info *sta;
 
         if (mac) {
+                rcu_read_lock();
+
                 /* XXX: get sta belonging to dev */
                 sta = sta_info_get(local, mac);
-                if (!sta)
+                if (!sta) {
+                        rcu_read_unlock();
                         return -ENOENT;
+                }
 
                 sta_info_unlink(&sta);
+                rcu_read_unlock();
+
                 sta_info_destroy(sta);
         } else
                 sta_info_flush(local, sdata);
@@ -740,17 +748,23 @@ static int ieee80211_change_station(struct wiphy *wiphy,
         struct sta_info *sta;
         struct ieee80211_sub_if_data *vlansdata;
 
+        rcu_read_lock();
+
         /* XXX: get sta belonging to dev */
         sta = sta_info_get(local, mac);
-        if (!sta)
+        if (!sta) {
+                rcu_read_unlock();
                 return -ENOENT;
+        }
 
         if (params->vlan && params->vlan != sta->sdata->dev) {
                 vlansdata = IEEE80211_DEV_TO_SUB_IF(params->vlan);
 
                 if (vlansdata->vif.type != IEEE80211_IF_TYPE_VLAN ||
-                    vlansdata->vif.type != IEEE80211_IF_TYPE_AP)
+                    vlansdata->vif.type != IEEE80211_IF_TYPE_AP) {
+                        rcu_read_unlock();
                         return -EINVAL;
+                }
 
                 sta->sdata = IEEE80211_DEV_TO_SUB_IF(params->vlan);
                 ieee80211_send_layer2_update(sta);
@@ -758,6 +772,8 @@ static int ieee80211_change_station(struct wiphy *wiphy,
 
         sta_apply_parameters(local, sta, params);
 
+        rcu_read_unlock();
+
         return 0;
 }
 
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index c642538e8282..8e53ce7ed444 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -102,7 +102,7 @@ struct ieee80211_sta_bss {
         u64 timestamp;
         int beacon_int;
 
-        int probe_resp;
+        bool probe_resp;
         unsigned long last_update;
 
         /* during assocation, we save an ERP value from a probe response so
@@ -600,8 +600,7 @@ struct ieee80211_local {
         /*
          * The lock only protects the list, hash, timer and counter
          * against manipulation, reads are done in RCU. Additionally,
-         * the lock protects each BSS's TIM bitmap, a few items in
-         * STA info structures and various key pointers.
+         * the lock protects each BSS's TIM bitmap.
          */
         spinlock_t sta_lock;
         unsigned long num_sta;
@@ -635,6 +634,13 @@ struct ieee80211_local {
 
         struct list_head interfaces;
 
+        /*
+         * Key lock, protects sdata's key_list and sta_info's
+         * key pointers (write access, they're RCU.)
+         */
+        spinlock_t key_lock;
+
+
         bool sta_sw_scanning;
         bool sta_hw_scanning;
         int scan_channel_idx;
diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index 711e36e54ff8..150d66dbda9d 100644
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -74,9 +74,12 @@ static void add_todo(struct ieee80211_key *key, u32 flag)
 
         spin_lock(&todo_lock);
         key->flags |= flag;
-        /* only add if not already added */
-        if (list_empty(&key->todo))
-                list_add(&key->todo, &todo_list);
+        /*
+         * Remove again if already on the list so that we move it to the end.
+         */
+        if (!list_empty(&key->todo))
+                list_del(&key->todo);
+        list_add_tail(&key->todo, &todo_list);
         schedule_work(&todo_work);
         spin_unlock(&todo_lock);
 }
@@ -210,9 +213,9 @@ void ieee80211_set_default_key(struct ieee80211_sub_if_data *sdata, int idx)
 {
         unsigned long flags;
 
-        spin_lock_irqsave(&sdata->local->sta_lock, flags);
+        spin_lock_irqsave(&sdata->local->key_lock, flags);
         __ieee80211_set_default_key(sdata, idx);
-        spin_unlock_irqrestore(&sdata->local->sta_lock, flags);
+        spin_unlock_irqrestore(&sdata->local->key_lock, flags);
 }
 
 
@@ -339,7 +342,7 @@ void ieee80211_key_link(struct ieee80211_key *key,
                 }
         }
 
-        spin_lock_irqsave(&sdata->local->sta_lock, flags);
+        spin_lock_irqsave(&sdata->local->key_lock, flags);
 
         if (sta)
                 old_key = sta->key;
@@ -348,68 +351,81 @@ void ieee80211_key_link(struct ieee80211_key *key,
 
         __ieee80211_key_replace(sdata, sta, old_key, key);
 
-        spin_unlock_irqrestore(&sdata->local->sta_lock, flags);
+        spin_unlock_irqrestore(&sdata->local->key_lock, flags);
 
         /* free old key later */
         add_todo(old_key, KEY_FLAG_TODO_DELETE);
 
         add_todo(key, KEY_FLAG_TODO_ADD_DEBUGFS);
         if (netif_running(sdata->dev))
-                add_todo(key, KEY_FLAG_TODO_HWACCEL);
+                add_todo(key, KEY_FLAG_TODO_HWACCEL_ADD);
 }
 
-void ieee80211_key_free(struct ieee80211_key *key)
+static void __ieee80211_key_free(struct ieee80211_key *key)
 {
-        unsigned long flags;
-
-        if (!key)
-                return;
-
         /*
          * Replace key with nothingness if it was ever used.
          */
-        if (key->sdata) {
-                spin_lock_irqsave(&key->sdata->local->sta_lock, flags);
+        if (key->sdata)
                 __ieee80211_key_replace(key->sdata, key->sta,
                                         key, NULL);
-                spin_unlock_irqrestore(&key->sdata->local->sta_lock, flags);
-        }
 
         add_todo(key, KEY_FLAG_TODO_DELETE);
 }
 
-void ieee80211_enable_keys(struct ieee80211_sub_if_data *sdata)
+void ieee80211_key_free(struct ieee80211_key *key)
 {
-        struct ieee80211_key *key;
-
-        might_sleep();
+        unsigned long flags;
 
-        if (WARN_ON(!netif_running(sdata->dev)))
+        if (!key)
                 return;
 
-        ieee80211_key_lock();
+        spin_lock_irqsave(&key->sdata->local->key_lock, flags);
+        __ieee80211_key_free(key);
+        spin_unlock_irqrestore(&key->sdata->local->key_lock, flags);
+}
+
+/*
+ * To be safe against concurrent manipulations of the list (which shouldn't
+ * actually happen) we need to hold the spinlock. But under the spinlock we
+ * can't actually do much, so we defer processing to the todo list. Then run
+ * the todo list to be sure the operation and possibly previously pending
+ * operations are completed.
+ */
+static void ieee80211_todo_for_each_key(struct ieee80211_sub_if_data *sdata,
+                                        u32 todo_flags)
+{
+        struct ieee80211_key *key;
+        unsigned long flags;
 
+        might_sleep();
+
+        spin_lock_irqsave(&sdata->local->key_lock, flags);
         list_for_each_entry(key, &sdata->key_list, list)
-                ieee80211_key_enable_hw_accel(key);
+                add_todo(key, todo_flags);
+        spin_unlock_irqrestore(&sdata->local->key_lock, flags);
 
-        ieee80211_key_unlock();
+        ieee80211_key_todo();
 }
 
-void ieee80211_disable_keys(struct ieee80211_sub_if_data *sdata)
+void ieee80211_enable_keys(struct ieee80211_sub_if_data *sdata)
 {
-        struct ieee80211_key *key;
+        ASSERT_RTNL();
 
-        might_sleep();
+        if (WARN_ON(!netif_running(sdata->dev)))
+                return;
 
-        ieee80211_key_lock();
+        ieee80211_todo_for_each_key(sdata, KEY_FLAG_TODO_HWACCEL_ADD);
+}
 
-        list_for_each_entry(key, &sdata->key_list, list)
-                ieee80211_key_disable_hw_accel(key);
+void ieee80211_disable_keys(struct ieee80211_sub_if_data *sdata)
+{
+        ASSERT_RTNL();
 
-        ieee80211_key_unlock();
+        ieee80211_todo_for_each_key(sdata, KEY_FLAG_TODO_HWACCEL_REMOVE);
 }
 
-static void __ieee80211_key_free(struct ieee80211_key *key)
+static void __ieee80211_key_destroy(struct ieee80211_key *key)
 {
         if (!key)
                 return;
@@ -440,7 +456,8 @@ static void __ieee80211_key_todo(void)
                 list_del_init(&key->todo);
                 todoflags = key->flags & (KEY_FLAG_TODO_ADD_DEBUGFS |
                                           KEY_FLAG_TODO_DEFKEY |
-                                          KEY_FLAG_TODO_HWACCEL |
+                                          KEY_FLAG_TODO_HWACCEL_ADD |
+                                          KEY_FLAG_TODO_HWACCEL_REMOVE |
                                           KEY_FLAG_TODO_DELETE);
                 key->flags &= ~todoflags;
                 spin_unlock(&todo_lock);
@@ -456,12 +473,16 @@ static void __ieee80211_key_todo(void)
                         ieee80211_debugfs_key_add_default(key->sdata);
                         work_done = true;
                 }
-                if (todoflags & KEY_FLAG_TODO_HWACCEL) {
+                if (todoflags & KEY_FLAG_TODO_HWACCEL_ADD) {
                         ieee80211_key_enable_hw_accel(key);
                         work_done = true;
                 }
+                if (todoflags & KEY_FLAG_TODO_HWACCEL_REMOVE) {
+                        ieee80211_key_disable_hw_accel(key);
+                        work_done = true;
+                }
                 if (todoflags & KEY_FLAG_TODO_DELETE) {
-                        __ieee80211_key_free(key);
+                        __ieee80211_key_destroy(key);
                         work_done = true;
                 }
 
@@ -482,14 +503,16 @@ void ieee80211_key_todo(void)
 void ieee80211_free_keys(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_key *key, *tmp;
-        LIST_HEAD(tmp_list);
+        unsigned long flags;
 
         ieee80211_key_lock();
 
         ieee80211_debugfs_key_remove_default(sdata);
 
+        spin_lock_irqsave(&sdata->local->key_lock, flags);
         list_for_each_entry_safe(key, tmp, &sdata->key_list, list)
-                ieee80211_key_free(key);
+                __ieee80211_key_free(key);
+        spin_unlock_irqrestore(&sdata->local->key_lock, flags);
 
         __ieee80211_key_todo();
 
diff --git a/net/mac80211/key.h b/net/mac80211/key.h
index 5d48518985b3..f52c3df1fe9a 100644
--- a/net/mac80211/key.h
+++ b/net/mac80211/key.h
@@ -54,16 +54,19 @@ struct sta_info;
  * @KEY_FLAG_TODO_DELETE: Key is marked for deletion and will, after an
  *      RCU grace period, no longer be reachable other than from the
  *      todo list.
- * @KEY_FLAG_TODO_HWACCEL: Key needs to be added to hardware acceleration.
+ * @KEY_FLAG_TODO_HWACCEL_ADD: Key needs to be added to hardware acceleration.
+ * @KEY_FLAG_TODO_HWACCEL_REMOVE: Key needs to be removed from hardware
+ *      acceleration.
  * @KEY_FLAG_TODO_DEFKEY: Key is default key and debugfs needs to be updated.
  * @KEY_FLAG_TODO_ADD_DEBUGFS: Key needs to be added to debugfs.
  */
 enum ieee80211_internal_key_flags {
         KEY_FLAG_UPLOADED_TO_HARDWARE   = BIT(0),
         KEY_FLAG_TODO_DELETE            = BIT(1),
-        KEY_FLAG_TODO_HWACCEL           = BIT(2),
-        KEY_FLAG_TODO_DEFKEY            = BIT(3),
-        KEY_FLAG_TODO_ADD_DEBUGFS       = BIT(4),
+        KEY_FLAG_TODO_HWACCEL_ADD       = BIT(2),
+        KEY_FLAG_TODO_HWACCEL_REMOVE    = BIT(3),
+        KEY_FLAG_TODO_DEFKEY            = BIT(4),
+        KEY_FLAG_TODO_ADD_DEBUGFS       = BIT(5),
 };
 
 struct ieee80211_key {
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index bfcbcf5353ad..e9a978979d38 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -1587,6 +1587,8 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
 
         INIT_LIST_HEAD(&local->interfaces);
 
+        spin_lock_init(&local->key_lock);
+
         INIT_DELAYED_WORK(&local->scan_work, ieee80211_sta_scan_work);
 
         sta_info_init(local);
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index bdaab1391d4e..6b75cb6c6300 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -350,14 +350,12 @@ static void ieee80211_sta_wmm_params(struct net_device *dev,
         }
 }
 
-
-static u32 ieee80211_handle_erp_ie(struct ieee80211_sub_if_data *sdata,
-                                   u8 erp_value)
+static u32 ieee80211_handle_protect_preamb(struct ieee80211_sub_if_data *sdata,
+                                           bool use_protection,
+                                           bool use_short_preamble)
 {
         struct ieee80211_bss_conf *bss_conf = &sdata->bss_conf;
         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
-        bool use_protection = (erp_value & WLAN_ERP_USE_PROTECTION) != 0;
-        bool use_short_preamble = (erp_value & WLAN_ERP_BARKER_PREAMBLE) == 0;
         DECLARE_MAC_BUF(mac);
         u32 changed = 0;
 
@@ -388,6 +386,32 @@ static u32 ieee80211_handle_erp_ie(struct ieee80211_sub_if_data *sdata,
         return changed;
 }
 
+static u32 ieee80211_handle_erp_ie(struct ieee80211_sub_if_data *sdata,
+                                   u8 erp_value)
+{
+        bool use_protection = (erp_value & WLAN_ERP_USE_PROTECTION) != 0;
+        bool use_short_preamble = (erp_value & WLAN_ERP_BARKER_PREAMBLE) == 0;
+
+        return ieee80211_handle_protect_preamb(sdata,
+                        use_protection, use_short_preamble);
+}
+
+static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,
+                                           struct ieee80211_sta_bss *bss)
+{
+        u32 changed = 0;
+
+        if (bss->has_erp_value)
+                changed |= ieee80211_handle_erp_ie(sdata, bss->erp_value);
+        else {
+                u16 capab = bss->capability;
+                changed |= ieee80211_handle_protect_preamb(sdata, false,
+                                (capab & WLAN_CAPABILITY_SHORT_PREAMBLE) != 0);
+        }
+
+        return changed;
+}
+
 int ieee80211_ht_cap_ie_to_ht_info(struct ieee80211_ht_cap *ht_cap_ie,
                                    struct ieee80211_ht_info *ht_info)
 {
@@ -511,9 +535,7 @@ static void ieee80211_set_associated(struct net_device *dev,
                         sdata->bss_conf.beacon_int = bss->beacon_int;
                         sdata->bss_conf.timestamp = bss->timestamp;
 
-                        if (bss->has_erp_value)
-                                changed |= ieee80211_handle_erp_ie(
-                                                sdata, bss->erp_value);
+                        changed |= ieee80211_handle_bss_capability(sdata, bss);
 
                         ieee80211_rx_bss_put(dev, bss);
                 }
@@ -2566,22 +2588,29 @@ static void ieee80211_rx_bss_info(struct net_device *dev,
 #endif
         }
 
-        bss->band = rx_status->band;
-
-        if (sdata->vif.type != IEEE80211_IF_TYPE_IBSS &&
-            bss->probe_resp && beacon) {
-                /* STA mode:
-                 * Do not allow beacon to override data from Probe Response. */
-                ieee80211_rx_bss_put(dev, bss);
-                return;
-        }
-
         /* save the ERP value so that it is available at association time */
         if (elems.erp_info && elems.erp_info_len >= 1) {
                 bss->erp_value = elems.erp_info[0];
                 bss->has_erp_value = 1;
         }
 
+        if (elems.ht_cap_elem &&
+             (!bss->ht_ie || bss->ht_ie_len != elems.ht_cap_elem_len ||
+             memcmp(bss->ht_ie, elems.ht_cap_elem, elems.ht_cap_elem_len))) {
+                kfree(bss->ht_ie);
+                bss->ht_ie = kmalloc(elems.ht_cap_elem_len + 2, GFP_ATOMIC);
+                if (bss->ht_ie) {
+                        memcpy(bss->ht_ie, elems.ht_cap_elem - 2,
+                                elems.ht_cap_elem_len + 2);
+                        bss->ht_ie_len = elems.ht_cap_elem_len + 2;
+                } else
+                        bss->ht_ie_len = 0;
+        } else if (!elems.ht_cap_elem && bss->ht_ie) {
+                kfree(bss->ht_ie);
+                bss->ht_ie = NULL;
+                bss->ht_ie_len = 0;
+        }
+
         bss->beacon_int = le16_to_cpu(mgmt->u.beacon.beacon_int);
         bss->capability = le16_to_cpu(mgmt->u.beacon.capab_info);
 
@@ -2603,6 +2632,26 @@ static void ieee80211_rx_bss_info(struct net_device *dev,
                 bss->supp_rates_len += clen;
         }
 
+        bss->band = rx_status->band;
+
+        bss->timestamp = beacon_timestamp;
+        bss->last_update = jiffies;
+        bss->rssi = rx_status->ssi;
+        bss->signal = rx_status->signal;
+        bss->noise = rx_status->noise;
+        if (!beacon && !bss->probe_resp)
+                bss->probe_resp = true;
+
+        /*
+         * In STA mode, the remaining parameters should not be overridden
+         * by beacons because they're not necessarily accurate there.
+         */
+        if (sdata->vif.type != IEEE80211_IF_TYPE_IBSS &&
+            bss->probe_resp && beacon) {
+                ieee80211_rx_bss_put(dev, bss);
+                return;
+        }
+
         if (elems.wpa &&
             (!bss->wpa_ie || bss->wpa_ie_len != elems.wpa_len ||
              memcmp(bss->wpa_ie, elems.wpa, elems.wpa_len))) {
@@ -2635,6 +2684,20 @@ static void ieee80211_rx_bss_info(struct net_device *dev,
                 bss->rsn_ie_len = 0;
         }
 
+        /*
+         * Cf.
+         * http://www.wipo.int/pctdb/en/wo.jsp?wo=2007047181&IA=WO2007047181&DISPLAY=DESC
+         *
+         * quoting:
+         *
+         * In particular, "Wi-Fi CERTIFIED for WMM - Support for Multimedia
+         * Applications with Quality of Service in Wi-Fi Networks," Wi- Fi
+         * Alliance (September 1, 2004) is incorporated by reference herein.
+         * The inclusion of the WMM Parameters in probe responses and
+         * association responses is mandatory for WMM enabled networks. The
+         * inclusion of the WMM Parameters in beacons, however, is optional.
+         */
+
         if (elems.wmm_param &&
             (!bss->wmm_ie || bss->wmm_ie_len != elems.wmm_param_len ||
              memcmp(bss->wmm_ie, elems.wmm_param, elems.wmm_param_len))) {
@@ -2651,30 +2714,6 @@ static void ieee80211_rx_bss_info(struct net_device *dev,
                 bss->wmm_ie = NULL;
                 bss->wmm_ie_len = 0;
         }
-        if (elems.ht_cap_elem &&
-            (!bss->ht_ie || bss->ht_ie_len != elems.ht_cap_elem_len ||
-             memcmp(bss->ht_ie, elems.ht_cap_elem, elems.ht_cap_elem_len))) {
-                kfree(bss->ht_ie);
-                bss->ht_ie = kmalloc(elems.ht_cap_elem_len + 2, GFP_ATOMIC);
-                if (bss->ht_ie) {
-                        memcpy(bss->ht_ie, elems.ht_cap_elem - 2,
-                               elems.ht_cap_elem_len + 2);
-                        bss->ht_ie_len = elems.ht_cap_elem_len + 2;
-                } else
-                        bss->ht_ie_len = 0;
-        } else if (!elems.ht_cap_elem && bss->ht_ie) {
-                kfree(bss->ht_ie);
-                bss->ht_ie = NULL;
-                bss->ht_ie_len = 0;
-        }
-
-        bss->timestamp = beacon_timestamp;
-        bss->last_update = jiffies;
-        bss->rssi = rx_status->ssi;
-        bss->signal = rx_status->signal;
-        bss->noise = rx_status->noise;
-        if (!beacon)
-                bss->probe_resp++;
 
         /* check if we need to merge IBSS */
         if (sdata->vif.type == IEEE80211_IF_TYPE_IBSS && beacon &&
@@ -2775,8 +2814,24 @@ static void ieee80211_rx_mgmt_beacon(struct net_device *dev,
 
         ieee802_11_parse_elems(mgmt->u.beacon.variable, len - baselen, &elems);
 
+        if (elems.wmm_param && (ifsta->flags & IEEE80211_STA_WMM_ENABLED)) {
+                ieee80211_sta_wmm_params(dev, ifsta, elems.wmm_param,
+                                         elems.wmm_param_len);
+        }
+
+        /* Do not send changes to driver if we are scanning. This removes
+         * requirement that driver's bss_info_changed function needs to be
+         * atomic. */
+        if (local->sta_sw_scanning || local->sta_hw_scanning)
+                return;
+
         if (elems.erp_info && elems.erp_info_len >= 1)
                 changed |= ieee80211_handle_erp_ie(sdata, elems.erp_info[0]);
+        else {
+                u16 capab = le16_to_cpu(mgmt->u.beacon.capab_info);
+                changed |= ieee80211_handle_protect_preamb(sdata, false,
+                                (capab & WLAN_CAPABILITY_SHORT_PREAMBLE) != 0);
+        }
 
         if (elems.ht_cap_elem && elems.ht_info_elem &&
             elems.wmm_param && conf->flags & IEEE80211_CONF_SUPPORT_HT_MODE) {
@@ -2789,11 +2844,6 @@ static void ieee80211_rx_mgmt_beacon(struct net_device *dev,
                                                &bss_info);
         }
 
-        if (elems.wmm_param && (ifsta->flags & IEEE80211_STA_WMM_ENABLED)) {
-                ieee80211_sta_wmm_params(dev, ifsta, elems.wmm_param,
-                                         elems.wmm_param_len);
-        }
-
         ieee80211_bss_info_change_notify(sdata, changed);
 }
 
diff --git a/net/mac80211/wext.c b/net/mac80211/wext.c
index 69aed16faff3..76e1de1dc735 100644
--- a/net/mac80211/wext.c
+++ b/net/mac80211/wext.c
@@ -236,6 +236,9 @@ static int ieee80211_ioctl_siwmode(struct net_device *dev,
         case IW_MODE_ADHOC:
                 type = IEEE80211_IF_TYPE_IBSS;
                 break;
+        case IW_MODE_REPEAT:
+                type = IEEE80211_IF_TYPE_WDS;
+                break;
         case IW_MODE_MONITOR:
                 type = IEEE80211_IF_TYPE_MNTR;
                 break;
@@ -980,6 +983,8 @@ static struct iw_statistics *ieee80211_get_wireless_stats(struct net_device *dev
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         struct sta_info *sta = NULL;
 
+        rcu_read_lock();
+
         if (sdata->vif.type == IEEE80211_IF_TYPE_STA ||
             sdata->vif.type == IEEE80211_IF_TYPE_IBSS)
                 sta = sta_info_get(local, sdata->u.sta.bssid);
@@ -996,6 +1001,9 @@ static struct iw_statistics *ieee80211_get_wireless_stats(struct net_device *dev
                 wstats->qual.noise = sta->last_noise;
                 wstats->qual.updated = local->wstats_flags;
         }
+
+        rcu_read_unlock();
+
         return wstats;
 }
 
diff --git a/net/tipc/ref.c b/net/tipc/ref.c
index c38744c96ed1..89cbab24d08f 100644
--- a/net/tipc/ref.c
+++ b/net/tipc/ref.c
@@ -2,7 +2,7 @@
  * net/tipc/ref.c: TIPC object registry code
  *
  * Copyright (c) 1991-2006, Ericsson AB
- * Copyright (c) 2004-2005, Wind River Systems
+ * Copyright (c) 2004-2007, Wind River Systems
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -36,32 +36,60 @@
 
 #include "core.h"
 #include "ref.h"
-#include "port.h"
-#include "subscr.h"
-#include "name_distr.h"
-#include "name_table.h"
-#include "config.h"
-#include "discover.h"
-#include "bearer.h"
-#include "node.h"
-#include "bcast.h"
+
+/**
+ * struct reference - TIPC object reference entry
+ * @object: pointer to object associated with reference entry
+ * @lock: spinlock controlling access to object
+ * @ref: reference value for object (combines instance & array index info)
+ */
+
+struct reference {
+        void *object;
+        spinlock_t lock;
+        u32 ref;
+};
+
+/**
+ * struct tipc_ref_table - table of TIPC object reference entries
+ * @entries: pointer to array of reference entries
+ * @capacity: array index of first unusable entry
+ * @init_point: array index of first uninitialized entry
+ * @first_free: array index of first unused object reference entry
+ * @last_free: array index of last unused object reference entry
+ * @index_mask: bitmask for array index portion of reference values
+ * @start_mask: initial value for instance value portion of reference values
+ */
+
+struct ref_table {
+        struct reference *entries;
+        u32 capacity;
+        u32 init_point;
+        u32 first_free;
+        u32 last_free;
+        u32 index_mask;
+        u32 start_mask;
+};
 
 /*
  * Object reference table consists of 2**N entries.
  *
- * A used entry has object ptr != 0, reference == XXXX|own index
- *                                   (XXXX changes each time entry is acquired)
- * A free entry has object ptr == 0, reference == YYYY|next free index
- *                                   (YYYY is one more than last used XXXX)
+ * State        Object ptr      Reference
+ * -----        ----------      ---------
+ * In use        non-NULL       XXXX|own index
+ *                              (XXXX changes each time entry is acquired)
+ * Free            NULL         YYYY|next free index
+ *                              (YYYY is one more than last used XXXX)
+ * Uninitialized   NULL         0
  *
- * Free list is initially chained from entry (2**N)-1 to entry 1.
- * Entry 0 is not used to allow index 0 to indicate the end of the free list.
+ * Entry 0 is not used; this allows index 0 to denote the end of the free list.
  *
- * Note: Any accidental reference of the form XXXX|0--0 won't match entry 0
- * because entry 0's reference field has the form XXXX|1--1.
+ * Note that a reference value of 0 does not necessarily indicate that an
+ * entry is uninitialized, since the last entry in the free list could also
+ * have a reference value of 0 (although this is unlikely).
  */
 
-struct ref_table tipc_ref_table = { NULL };
+static struct ref_table tipc_ref_table = { NULL };
 
 static DEFINE_RWLOCK(ref_table_lock);
 
@@ -72,29 +100,29 @@ static DEFINE_RWLOCK(ref_table_lock);
 int tipc_ref_table_init(u32 requested_size, u32 start)
 {
         struct reference *table;
-        u32 sz = 1 << 4;
-        u32 index_mask;
-        int i;
+        u32 actual_size;
 
-        while (sz < requested_size) {
-                sz <<= 1;
-        }
-        table = vmalloc(sz * sizeof(*table));
+        /* account for unused entry, then round up size to a power of 2 */
+
+        requested_size++;
+        for (actual_size = 16; actual_size < requested_size; actual_size <<= 1)
+                /* do nothing */ ;
+
+        /* allocate table & mark all entries as uninitialized */
+
+        table = __vmalloc(actual_size * sizeof(struct reference),
+                          GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO, PAGE_KERNEL);
         if (table == NULL)
                 return -ENOMEM;
 
-        write_lock_bh(&ref_table_lock);
-        index_mask = sz - 1;
-        for (i = sz - 1; i >= 0; i--) {
-                table[i].object = NULL;
-                spin_lock_init(&table[i].lock);
-                table[i].data.next_plus_upper = (start & ~index_mask) + i - 1;
-        }
         tipc_ref_table.entries = table;
-        tipc_ref_table.index_mask = index_mask;
-        tipc_ref_table.first_free = sz - 1;
-        tipc_ref_table.last_free = 1;
-        write_unlock_bh(&ref_table_lock);
+        tipc_ref_table.capacity = requested_size;
+        tipc_ref_table.init_point = 1;
+        tipc_ref_table.first_free = 0;
+        tipc_ref_table.last_free = 0;
+        tipc_ref_table.index_mask = actual_size - 1;
+        tipc_ref_table.start_mask = start & ~tipc_ref_table.index_mask;
+
         return TIPC_OK;
 }
 
@@ -125,7 +153,7 @@ u32 tipc_ref_acquire(void *object, spinlock_t **lock)
         u32 index;
         u32 index_mask;
         u32 next_plus_upper;
-        u32 reference = 0;
+        u32 ref;
 
         if (!object) {
                 err("Attempt to acquire reference to non-existent object\n");
@@ -136,6 +164,8 @@ u32 tipc_ref_acquire(void *object, spinlock_t **lock)
                 return 0;
         }
 
+        /* take a free entry, if available; otherwise initialize a new entry */
+
         write_lock_bh(&ref_table_lock);
         if (tipc_ref_table.first_free) {
                 index = tipc_ref_table.first_free;
@@ -143,17 +173,29 @@ u32 tipc_ref_acquire(void *object, spinlock_t **lock)
                 index_mask = tipc_ref_table.index_mask;
                 /* take lock in case a previous user of entry still holds it */
                 spin_lock_bh(&entry->lock);
-                next_plus_upper = entry->data.next_plus_upper;
+                next_plus_upper = entry->ref;
                 tipc_ref_table.first_free = next_plus_upper & index_mask;
-                reference = (next_plus_upper & ~index_mask) + index;
-                entry->data.reference = reference;
+                ref = (next_plus_upper & ~index_mask) + index;
+                entry->ref = ref;
                 entry->object = object;
-                if (lock != NULL)
-                        *lock = &entry->lock;
                 spin_unlock_bh(&entry->lock);
+                *lock = &entry->lock;
+        }
+        else if (tipc_ref_table.init_point < tipc_ref_table.capacity) {
+                index = tipc_ref_table.init_point++;
+                entry = &(tipc_ref_table.entries[index]);
+                spin_lock_init(&entry->lock);
+                ref = tipc_ref_table.start_mask + index;
+                entry->ref = ref;
+                entry->object = object;
+                *lock = &entry->lock;
+        }
+        else {
+                ref = 0;
         }
         write_unlock_bh(&ref_table_lock);
-        return reference;
+
+        return ref;
 }
 
 /**
@@ -169,42 +211,99 @@ void tipc_ref_discard(u32 ref)
         u32 index;
         u32 index_mask;
 
-        if (!ref) {
-                err("Attempt to discard reference 0\n");
-                return;
-        }
         if (!tipc_ref_table.entries) {
                 err("Reference table not found during discard attempt\n");
                 return;
         }
 
-        write_lock_bh(&ref_table_lock);
         index_mask = tipc_ref_table.index_mask;
         index = ref & index_mask;
         entry = &(tipc_ref_table.entries[index]);
 
+        write_lock_bh(&ref_table_lock);
+
         if (!entry->object) {
                 err("Attempt to discard reference to non-existent object\n");
                 goto exit;
         }
-        if (entry->data.reference != ref) {
+        if (entry->ref != ref) {
                 err("Attempt to discard non-existent reference\n");
                 goto exit;
         }
 
-        /* mark entry as unused */
+        /*
+         * mark entry as unused; increment instance part of entry's reference
+         * to invalidate any subsequent references
+         */
+
         entry->object = NULL;
+        entry->ref = (ref & ~index_mask) + (index_mask + 1);
+
+        /* append entry to free entry list */
+
         if (tipc_ref_table.first_free == 0)
                 tipc_ref_table.first_free = index;
         else
-                /* next_plus_upper is always XXXX|0--0 for last free entry */
-                tipc_ref_table.entries[tipc_ref_table.last_free].data.next_plus_upper
-                        |= index;
+                tipc_ref_table.entries[tipc_ref_table.last_free].ref |= index;
         tipc_ref_table.last_free = index;
 
-        /* increment upper bits of entry to invalidate subsequent references */
-        entry->data.next_plus_upper = (ref & ~index_mask) + (index_mask + 1);
 exit:
         write_unlock_bh(&ref_table_lock);
 }
 
+/**
+ * tipc_ref_lock - lock referenced object and return pointer to it
+ */
+
+void *tipc_ref_lock(u32 ref)
+{
+        if (likely(tipc_ref_table.entries)) {
+                struct reference *entry;
+
+                entry = &tipc_ref_table.entries[ref &
+                                                tipc_ref_table.index_mask];
+                if (likely(entry->ref != 0)) {
+                        spin_lock_bh(&entry->lock);
+                        if (likely((entry->ref == ref) && (entry->object)))
+                                return entry->object;
+                        spin_unlock_bh(&entry->lock);
+                }
+        }
+        return NULL;
+}
+
+/**
+ * tipc_ref_unlock - unlock referenced object
+ */
+
+void tipc_ref_unlock(u32 ref)
+{
+        if (likely(tipc_ref_table.entries)) {
+                struct reference *entry;
+
+                entry = &tipc_ref_table.entries[ref &
+                                                tipc_ref_table.index_mask];
+                if (likely((entry->ref == ref) && (entry->object)))
+                        spin_unlock_bh(&entry->lock);
+                else
+                        err("Attempt to unlock non-existent reference\n");
+        }
+}
+
+/**
+ * tipc_ref_deref - return pointer referenced object (without locking it)
+ */
+
+void *tipc_ref_deref(u32 ref)
+{
+        if (likely(tipc_ref_table.entries)) {
+                struct reference *entry;
+
+                entry = &tipc_ref_table.entries[ref &
+                                                tipc_ref_table.index_mask];
+                if (likely(entry->ref == ref))
+                        return entry->object;
+        }
+        return NULL;
+}
+
diff --git a/net/tipc/ref.h b/net/tipc/ref.h
index 38f3a7f4a78d..7e3798ea93b9 100644
--- a/net/tipc/ref.h
+++ b/net/tipc/ref.h
@@ -2,7 +2,7 @@
  * net/tipc/ref.h: Include file for TIPC object registry code
  *
  * Copyright (c) 1991-2006, Ericsson AB
- * Copyright (c) 2005, Wind River Systems
+ * Copyright (c) 2005-2006, Wind River Systems
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -37,95 +37,14 @@
 #ifndef _TIPC_REF_H
 #define _TIPC_REF_H
 
-/**
- * struct reference - TIPC object reference entry
- * @object: pointer to object associated with reference entry
- * @lock: spinlock controlling access to object
- * @data: reference value associated with object (or link to next unused entry)
- */
-
-struct reference {
-        void *object;
-        spinlock_t lock;
-        union {
-                u32 next_plus_upper;
-                u32 reference;
-        } data;
-};
-
-/**
- * struct tipc_ref_table - table of TIPC object reference entries
- * @entries: pointer to array of reference entries
- * @index_mask: bitmask for array index portion of reference values
- * @first_free: array index of first unused object reference entry
- * @last_free: array index of last unused object reference entry
- */
-
-struct ref_table {
-        struct reference *entries;
-        u32 index_mask;
-        u32 first_free;
-        u32 last_free;
-};
-
-extern struct ref_table tipc_ref_table;
-
 int tipc_ref_table_init(u32 requested_size, u32 start);
 void tipc_ref_table_stop(void);
 
 u32 tipc_ref_acquire(void *object, spinlock_t **lock);
 void tipc_ref_discard(u32 ref);
 
-
-/**
- * tipc_ref_lock - lock referenced object and return pointer to it
- */
-
-static inline void *tipc_ref_lock(u32 ref)
-{
-        if (likely(tipc_ref_table.entries)) {
-                struct reference *r =
-                        &tipc_ref_table.entries[ref & tipc_ref_table.index_mask];
-
-                spin_lock_bh(&r->lock);
-                if (likely(r->data.reference == ref))
-                        return r->object;
-                spin_unlock_bh(&r->lock);
-        }
-        return NULL;
-}
-
-/**
- * tipc_ref_unlock - unlock referenced object
- */
-
-static inline void tipc_ref_unlock(u32 ref)
-{
-        if (likely(tipc_ref_table.entries)) {
-                struct reference *r =
-                        &tipc_ref_table.entries[ref & tipc_ref_table.index_mask];
-
-                if (likely(r->data.reference == ref))
-                        spin_unlock_bh(&r->lock);
-                else
-                        err("tipc_ref_unlock() invoked using obsolete reference\n");
-        }
-}
-
-/**
- * tipc_ref_deref - return pointer referenced object (without locking it)
- */
-
-static inline void *tipc_ref_deref(u32 ref)
-{
-        if (likely(tipc_ref_table.entries)) {
-                struct reference *r =
-                        &tipc_ref_table.entries[ref & tipc_ref_table.index_mask];
-
-                if (likely(r->data.reference == ref))
-                        return r->object;
-        }
-        return NULL;
-}
+void *tipc_ref_lock(u32 ref);
+void tipc_ref_unlock(u32 ref);
+void *tipc_ref_deref(u32 ref);
 
 #endif