72 files changed, 624 insertions, 318 deletions
diff --git a/net/9p/client.c b/net/9p/client.c
index 9e3b0e640da1..0505a03c374c 100644
--- a/net/9p/client.c
+++ b/net/9p/client.c
@@ -72,23 +72,22 @@ inline int p9_is_proto_dotu(struct p9_client *clnt)
 EXPORT_SYMBOL(p9_is_proto_dotu);
 /* Interpret mount option for protocol version */
-static int get_protocol_version(const substring_t *name)
+static int get_protocol_version(char *s)
 {
        int version = -EINVAL;
-        if (!strncmp("9p2000", name->from, name->to-name->from)) {
+        if (!strcmp(s, "9p2000")) {
                version = p9_proto_legacy;
                P9_DPRINTK(P9_DEBUG_9P, "Protocol version: Legacy\n");
-        } else if (!strncmp("9p2000.u", name->from, name->to-name->from)) {
+        } else if (!strcmp(s, "9p2000.u")) {
                version = p9_proto_2000u;
                P9_DPRINTK(P9_DEBUG_9P, "Protocol version: 9P2000.u\n");
-        } else if (!strncmp("9p2000.L", name->from, name->to-name->from)) {
+        } else if (!strcmp(s, "9p2000.L")) {
                version = p9_proto_2000L;
                P9_DPRINTK(P9_DEBUG_9P, "Protocol version: 9P2000.L\n");
-        } else {
+        } else
-                P9_DPRINTK(P9_DEBUG_ERROR, "Unknown protocol version %s. ",
+                printk(KERN_INFO "9p: Unknown protocol version %s.\n", s);
-                                                        name->from);
-        }
        return version;
 }
@@ -106,6 +105,7 @@ static int parse_opts(char *opts, struct p9_client *clnt)
        char *p;
        substring_t args[MAX_OPT_ARGS];
        int option;
+        char *s;
        int ret = 0;
        clnt->proto_version = p9_proto_2000u;
@@ -141,22 +141,41 @@ static int parse_opts(char *opts, struct p9_client *clnt)
                        clnt->msize = option;
                        break;
                case Opt_trans:
-                        clnt->trans_mod = v9fs_get_trans_by_name(&args[0]);
+                        s = match_strdup(&args[0]);
-                        if(clnt->trans_mod == NULL) {
+                        if (!s) {
+                                ret = -ENOMEM;
                                P9_DPRINTK(P9_DEBUG_ERROR,
-                                   "Could not find request transport: %s\n",
+                                        "problem allocating copy of trans arg\n");
-                                   (char *) &args[0]);
+                                goto free_and_return;
+                         }
+                        clnt->trans_mod = v9fs_get_trans_by_name(s);
+                        if (clnt->trans_mod == NULL) {
+                                printk(KERN_INFO
+                                        "9p: Could not find "
+                                        "request transport: %s\n", s);
                                ret = -EINVAL;
+                                kfree(s);
                                goto free_and_return;
                        }
+                        kfree(s);
                        break;
                case Opt_legacy:
                        clnt->proto_version = p9_proto_legacy;
                        break;
                case Opt_version:
-                        ret = get_protocol_version(&args[0]);
+                        s = match_strdup(&args[0]);
-                        if (ret == -EINVAL)
+                        if (!s) {
+                                ret = -ENOMEM;
+                                P9_DPRINTK(P9_DEBUG_ERROR,
+                                        "problem allocating copy of version arg\n");
                                goto free_and_return;
+                        }
+                        ret = get_protocol_version(s);
+                        if (ret == -EINVAL) {
+                                kfree(s);
+                                goto free_and_return;
+                        }
+                        kfree(s);
                        clnt->proto_version = ret;
                        break;
                default:
@@ -280,7 +299,8 @@ struct p9_req_t *p9_tag_lookup(struct p9_client *c, u16 tag)
         * buffer to read the data into */
        tag++;
-        BUG_ON(tag >= c->max_tag);
+        if(tag >= c->max_tag) 
+                return NULL;
        row = tag / P9_ROW_MAXTAG;
        col = tag % P9_ROW_MAXTAG;
@@ -749,7 +769,7 @@ static int p9_client_version(struct p9_client *c)
        err = p9pdu_readf(req->rc, c->proto_version, "ds", &msize, &version);
        if (err) {
                P9_DPRINTK(P9_DEBUG_9P, "version error %d\n", err);
-                p9pdu_dump(1, req->rc);
+                P9_DUMP_PKT(1, req->rc);
                goto error;
        }
@@ -821,8 +841,8 @@ struct p9_client *p9_client_create(const char *dev_name, char *options)
        if (err)
                goto destroy_fidpool;
-        if ((clnt->msize+P9_IOHDRSZ) > clnt->trans_mod->maxsize)
+        if (clnt->msize > clnt->trans_mod->maxsize)
-                clnt->msize = clnt->trans_mod->maxsize-P9_IOHDRSZ;
+                clnt->msize = clnt->trans_mod->maxsize;
        err = p9_client_version(clnt);
        if (err)
@@ -911,7 +931,7 @@ struct p9_fid *p9_client_attach(struct p9_client *clnt, struct p9_fid *afid,
        err = p9pdu_readf(req->rc, clnt->proto_version, "Q", &qid);
        if (err) {
-                p9pdu_dump(1, req->rc);
+                P9_DUMP_PKT(1, req->rc);
                p9_free_req(clnt, req);
                goto error;
        }
@@ -971,7 +991,7 @@ struct p9_fid *p9_client_walk(struct p9_fid *oldfid, uint16_t nwname,
        err = p9pdu_readf(req->rc, clnt->proto_version, "R", &nwqids, &wqids);
        if (err) {
-                p9pdu_dump(1, req->rc);
+                P9_DUMP_PKT(1, req->rc);
                p9_free_req(clnt, req);
                goto clunk_fid;
        }
@@ -1038,7 +1058,7 @@ int p9_client_open(struct p9_fid *fid, int mode)
        err = p9pdu_readf(req->rc, clnt->proto_version, "Qd", &qid, &iounit);
        if (err) {
-                p9pdu_dump(1, req->rc);
+                P9_DUMP_PKT(1, req->rc);
                goto free_and_error;
        }
@@ -1081,7 +1101,7 @@ int p9_client_create_dotl(struct p9_fid *ofid, char *name, u32 flags, u32 mode,
        err = p9pdu_readf(req->rc, clnt->proto_version, "Qd", qid, &iounit);
        if (err) {
-                p9pdu_dump(1, req->rc);
+                P9_DUMP_PKT(1, req->rc);
                goto free_and_error;
        }
@@ -1126,7 +1146,7 @@ int p9_client_fcreate(struct p9_fid *fid, char *name, u32 perm, int mode,
        err = p9pdu_readf(req->rc, clnt->proto_version, "Qd", &qid, &iounit);
        if (err) {
-                p9pdu_dump(1, req->rc);
+                P9_DUMP_PKT(1, req->rc);
                goto free_and_error;
        }
@@ -1165,7 +1185,7 @@ int p9_client_symlink(struct p9_fid *dfid, char *name, char *symtgt, gid_t gid,
        err = p9pdu_readf(req->rc, clnt->proto_version, "Q", qid);
        if (err) {
-                p9pdu_dump(1, req->rc);
+                P9_DUMP_PKT(1, req->rc);
                goto free_and_error;
        }
@@ -1249,9 +1269,11 @@ int p9_client_clunk(struct p9_fid *fid)
        P9_DPRINTK(P9_DEBUG_9P, "<<< RCLUNK fid %d\n", fid->fid);
        p9_free_req(clnt, req);
-        p9_fid_destroy(fid);
 error:
+        /*
+         * Fid is not valid even after a failed clunk
+         */
+        p9_fid_destroy(fid);
        return err;
 }
 EXPORT_SYMBOL(p9_client_clunk);
@@ -1281,6 +1303,29 @@ error:
 }
 EXPORT_SYMBOL(p9_client_remove);
+int p9_client_unlinkat(struct p9_fid *dfid, const char *name, int flags)
+{
+        int err = 0;
+        struct p9_req_t *req;
+        struct p9_client *clnt;
+        P9_DPRINTK(P9_DEBUG_9P, ">>> TUNLINKAT fid %d %s %d\n",
+                   dfid->fid, name, flags);
+        clnt = dfid->clnt;
+        req = p9_client_rpc(clnt, P9_TUNLINKAT, "dsd", dfid->fid, name, flags);
+        if (IS_ERR(req)) {
+                err = PTR_ERR(req);
+                goto error;
+        }
+        P9_DPRINTK(P9_DEBUG_9P, "<<< RUNLINKAT fid %d %s\n", dfid->fid, name);
+        p9_free_req(clnt, req);
+error:
+        return err;
+}
+EXPORT_SYMBOL(p9_client_unlinkat);
 int
 p9_client_read(struct p9_fid *fid, char *data, char __user *udata, u64 offset,
                                                                u32 count)
@@ -1318,11 +1363,12 @@ p9_client_read(struct p9_fid *fid, char *data, char __user *udata, u64 offset,
        err = p9pdu_readf(req->rc, clnt->proto_version, "D", &count, &dataptr);
        if (err) {
-                p9pdu_dump(1, req->rc);
+                P9_DUMP_PKT(1, req->rc);
                goto free_and_error;
        }
        P9_DPRINTK(P9_DEBUG_9P, "<<< RREAD count %d\n", count);
+        P9_DUMP_PKT(1, req->rc);
        if (!req->tc->pbuf_size) {
                if (data) {
@@ -1386,7 +1432,7 @@ p9_client_write(struct p9_fid *fid, char *data, const char __user *udata,
        err = p9pdu_readf(req->rc, clnt->proto_version, "d", &count);
        if (err) {
-                p9pdu_dump(1, req->rc);
+                P9_DUMP_PKT(1, req->rc);
                goto free_and_error;
        }
@@ -1426,7 +1472,7 @@ struct p9_wstat *p9_client_stat(struct p9_fid *fid)
        err = p9pdu_readf(req->rc, clnt->proto_version, "wS", &ignored, ret);
        if (err) {
-                p9pdu_dump(1, req->rc);
+                P9_DUMP_PKT(1, req->rc);
                p9_free_req(clnt, req);
                goto error;
        }
@@ -1477,7 +1523,7 @@ struct p9_stat_dotl *p9_client_getattr_dotl(struct p9_fid *fid,
        err = p9pdu_readf(req->rc, clnt->proto_version, "A", ret);
        if (err) {
-                p9pdu_dump(1, req->rc);
+                P9_DUMP_PKT(1, req->rc);
                p9_free_req(clnt, req);
                goto error;
        }
@@ -1625,7 +1671,7 @@ int p9_client_statfs(struct p9_fid *fid, struct p9_rstatfs *sb)
                &sb->bsize, &sb->blocks, &sb->bfree, &sb->bavail,
                &sb->files, &sb->ffree, &sb->fsid, &sb->namelen);
        if (err) {
-                p9pdu_dump(1, req->rc);
+                P9_DUMP_PKT(1, req->rc);
                p9_free_req(clnt, req);
                goto error;
        }
@@ -1643,7 +1689,8 @@ error:
 }
 EXPORT_SYMBOL(p9_client_statfs);
-int p9_client_rename(struct p9_fid *fid, struct p9_fid *newdirfid, char *name)
+int p9_client_rename(struct p9_fid *fid,
+                     struct p9_fid *newdirfid, const char *name)
 {
        int err;
        struct p9_req_t *req;
@@ -1670,6 +1717,36 @@ error:
 }
 EXPORT_SYMBOL(p9_client_rename);
+int p9_client_renameat(struct p9_fid *olddirfid, const char *old_name,
+                       struct p9_fid *newdirfid, const char *new_name)
+{
+        int err;
+        struct p9_req_t *req;
+        struct p9_client *clnt;
+        err = 0;
+        clnt = olddirfid->clnt;
+        P9_DPRINTK(P9_DEBUG_9P, ">>> TRENAMEAT olddirfid %d old name %s"
+                   " newdirfid %d new name %s\n", olddirfid->fid, old_name,
+                   newdirfid->fid, new_name);
+        req = p9_client_rpc(clnt, P9_TRENAMEAT, "dsds", olddirfid->fid,
+                            old_name, newdirfid->fid, new_name);
+        if (IS_ERR(req)) {
+                err = PTR_ERR(req);
+                goto error;
+        }
+        P9_DPRINTK(P9_DEBUG_9P, "<<< RRENAMEAT newdirfid %d new name %s\n",
+                   newdirfid->fid, new_name);
+        p9_free_req(clnt, req);
+error:
+        return err;
+}
+EXPORT_SYMBOL(p9_client_renameat);
 /*
 * An xattrwalk without @attr_name gives the fid for the lisxattr namespace
 */
@@ -1701,7 +1778,7 @@ struct p9_fid *p9_client_xattrwalk(struct p9_fid *file_fid,
        }
        err = p9pdu_readf(req->rc, clnt->proto_version, "q", attr_size);
        if (err) {
-                p9pdu_dump(1, req->rc);
+                P9_DUMP_PKT(1, req->rc);
                p9_free_req(clnt, req);
                goto clunk_fid;
        }
@@ -1780,7 +1857,7 @@ int p9_client_readdir(struct p9_fid *fid, char *data, u32 count, u64 offset)
        err = p9pdu_readf(req->rc, clnt->proto_version, "D", &count, &dataptr);
        if (err) {
-                p9pdu_dump(1, req->rc);
+                P9_DUMP_PKT(1, req->rc);
                goto free_and_error;
        }
@@ -1817,7 +1894,7 @@ int p9_client_mknod_dotl(struct p9_fid *fid, char *name, int mode,
        err = p9pdu_readf(req->rc, clnt->proto_version, "Q", qid);
        if (err) {
-                p9pdu_dump(1, req->rc);
+                P9_DUMP_PKT(1, req->rc);
                goto error;
        }
        P9_DPRINTK(P9_DEBUG_9P, "<<< RMKNOD qid %x.%llx.%x\n", qid->type,
@@ -1848,7 +1925,7 @@ int p9_client_mkdir_dotl(struct p9_fid *fid, char *name, int mode,
        err = p9pdu_readf(req->rc, clnt->proto_version, "Q", qid);
        if (err) {
-                p9pdu_dump(1, req->rc);
+                P9_DUMP_PKT(1, req->rc);
                goto error;
        }
        P9_DPRINTK(P9_DEBUG_9P, "<<< RMKDIR qid %x.%llx.%x\n", qid->type,
@@ -1883,7 +1960,7 @@ int p9_client_lock_dotl(struct p9_fid *fid, struct p9_flock *flock, u8 *status)
        err = p9pdu_readf(req->rc, clnt->proto_version, "b", status);
        if (err) {
-                p9pdu_dump(1, req->rc);
+                P9_DUMP_PKT(1, req->rc);
                goto error;
        }
        P9_DPRINTK(P9_DEBUG_9P, "<<< RLOCK status %i\n", *status);
@@ -1916,7 +1993,7 @@ int p9_client_getlock_dotl(struct p9_fid *fid, struct p9_getlock *glock)
                        &glock->start, &glock->length, &glock->proc_id,
                        &glock->client_id);
        if (err) {
-                p9pdu_dump(1, req->rc);
+                P9_DUMP_PKT(1, req->rc);
                goto error;
        }
        P9_DPRINTK(P9_DEBUG_9P, "<<< RGETLOCK type %i start %lld length %lld "
@@ -1944,7 +2021,7 @@ int p9_client_readlink(struct p9_fid *fid, char **target)
        err = p9pdu_readf(req->rc, clnt->proto_version, "s", target);
        if (err) {
-                p9pdu_dump(1, req->rc);
+                P9_DUMP_PKT(1, req->rc);
                goto error;
        }
        P9_DPRINTK(P9_DEBUG_9P, "<<< RREADLINK target %s\n", *target);
diff --git a/net/9p/mod.c b/net/9p/mod.c
index 72c398275051..2664d1292291 100644
--- a/net/9p/mod.c
+++ b/net/9p/mod.c
@@ -80,14 +80,14 @@ EXPORT_SYMBOL(v9fs_unregister_trans);
 * @name: string identifying transport
 *
 */
-struct p9_trans_module *v9fs_get_trans_by_name(const substring_t *name)
+struct p9_trans_module *v9fs_get_trans_by_name(char *s)
 {
        struct p9_trans_module *t, *found = NULL;
        spin_lock(&v9fs_trans_lock);
        list_for_each_entry(t, &v9fs_trans_list, list)
-                if (strncmp(t->name, name->from, name->to-name->from) == 0 &&
+                if (strcmp(t->name, s) == 0 &&
                    try_module_get(t->owner)) {
                        found = t;
                        break;
diff --git a/net/9p/protocol.c b/net/9p/protocol.c
index a873277cb996..df58375ea6b3 100644
--- a/net/9p/protocol.c
+++ b/net/9p/protocol.c
@@ -44,30 +44,24 @@ p9pdu_writef(struct p9_fcall *pdu, int proto_version, const char *fmt, ...);
 void
 p9pdu_dump(int way, struct p9_fcall *pdu)
 {
-        int i, n;
+        int len = pdu->size;
-        u8 *data = pdu->sdata;
-        int datalen = pdu->size;
+        if ((p9_debug_level & P9_DEBUG_VPKT) != P9_DEBUG_VPKT) {
-        char buf[255];
+                if ((p9_debug_level & P9_DEBUG_PKT) == P9_DEBUG_PKT) {
-        int buflen = 255;
+                        if (len > 32)
+                                len = 32;
-        i = n = 0;
+                } else {
-        if (datalen > (buflen-16))
+                        /* shouldn't happen */
-                datalen = buflen-16;
+                        return;
-        while (i < datalen) {
+                }
-                n += scnprintf(buf + n, buflen - n, "%02x ", data[i]);
-                if (i%4 == 3)
-                        n += scnprintf(buf + n, buflen - n, " ");
-                if (i%32 == 31)
-                        n += scnprintf(buf + n, buflen - n, "\n");
-                i++;
        }
-        n += scnprintf(buf + n, buflen - n, "\n");
        if (way)
-                P9_DPRINTK(P9_DEBUG_PKT, "[[[(%d) %s\n", datalen, buf);
+                print_hex_dump_bytes("[9P] ", DUMP_PREFIX_OFFSET, pdu->sdata,
+                                                                        len);
        else
-                P9_DPRINTK(P9_DEBUG_PKT, "]]](%d) %s\n", datalen, buf);
+                print_hex_dump_bytes("]9P[ ", DUMP_PREFIX_OFFSET, pdu->sdata,
+                                                                        len);
 }
 #else
 void
@@ -610,7 +604,7 @@ int p9stat_read(char *buf, int len, struct p9_wstat *st, int proto_version)
        ret = p9pdu_readf(&fake_pdu, proto_version, "S", st);
        if (ret) {
                P9_DPRINTK(P9_DEBUG_9P, "<<< p9stat_read failed: %d\n", ret);
-                p9pdu_dump(1, &fake_pdu);
+                P9_DUMP_PKT(0, &fake_pdu);
        }
        return ret;
@@ -632,11 +626,7 @@ int p9pdu_finalize(struct p9_fcall *pdu)
        err = p9pdu_writef(pdu, 0, "d", size);
        pdu->size = size;
-#ifdef CONFIG_NET_9P_DEBUG
+        P9_DUMP_PKT(0, pdu);
-        if ((p9_debug_level & P9_DEBUG_PKT) == P9_DEBUG_PKT)
-                p9pdu_dump(0, pdu);
-#endif
        P9_DPRINTK(P9_DEBUG_9P, ">>> size=%d type: %d tag: %d\n", pdu->size,
                                                        pdu->id, pdu->tag);
@@ -669,7 +659,7 @@ int p9dirent_read(char *buf, int len, struct p9_dirent *dirent,
                        &dirent->d_off, &dirent->d_type, &nameptr);
        if (ret) {
                P9_DPRINTK(P9_DEBUG_9P, "<<< p9dirent_read failed: %d\n", ret);
-                p9pdu_dump(1, &fake_pdu);
+                P9_DUMP_PKT(1, &fake_pdu);
                goto out;
        }
diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
index 244e70742183..175b5135bdcf 100644
--- a/net/9p/trans_virtio.c
+++ b/net/9p/trans_virtio.c
@@ -367,7 +367,7 @@ req_retry_pinned:
                in += inp;
        } else {
                in = pack_sg_list(chan->sg, out, VIRTQUEUE_NUM, rdata,
-                                client->msize);
+                                req->rc->capacity);
        }
        err = virtqueue_add_buf(chan->vq, chan->sg, out, in, req->tc);
@@ -592,7 +592,7 @@ static struct p9_trans_module p9_virtio_trans = {
        .close = p9_virtio_close,
        .request = p9_virtio_request,
        .cancel = p9_virtio_cancel,
-        .maxsize = PAGE_SIZE*16,
+        .maxsize = PAGE_SIZE*VIRTQUEUE_NUM,
        .pref = P9_TRANS_PREF_PAYLOAD_SEP,
        .def = 0,
        .owner = THIS_MODULE,
diff --git a/net/atm/atm_misc.c b/net/atm/atm_misc.c
index fc63526d8695..f41f02656ff4 100644
--- a/net/atm/atm_misc.c
+++ b/net/atm/atm_misc.c
@@ -9,7 +9,7 @@
 #include <linux/sonet.h>
 #include <linux/bitops.h>
 #include <linux/errno.h>
-#include <asm/atomic.h>
+#include <linux/atomic.h>
 int atm_charge(struct atm_vcc *vcc, int truesize)
 {
diff --git a/net/atm/clip.c b/net/atm/clip.c
index 4bc8c67ecb14..852394072fa1 100644
--- a/net/atm/clip.c
+++ b/net/atm/clip.c
@@ -37,7 +37,7 @@
 #include <linux/uaccess.h>
 #include <asm/byteorder.h> /* for htons etc. */
 #include <asm/system.h> /* save/restore_flags */
-#include <asm/atomic.h>
+#include <linux/atomic.h>
 #include "common.h"
 #include "resources.h"
diff --git a/net/atm/common.c b/net/atm/common.c
index 22b963d06a10..14ff9fe39989 100644
--- a/net/atm/common.c
+++ b/net/atm/common.c
@@ -23,7 +23,7 @@
 #include <linux/uaccess.h>
 #include <linux/poll.h>
-#include <asm/atomic.h>
+#include <linux/atomic.h>
 #include "resources.h"          /* atm_find_dev */
 #include "common.h"             /* prototypes */
diff --git a/net/atm/lec.c b/net/atm/lec.c
index ba48daa68c1f..215c9fad7cdf 100644
--- a/net/atm/lec.c
+++ b/net/atm/lec.c
@@ -1335,7 +1335,7 @@ static void lane2_associate_ind(struct net_device *dev, const u8 *mac_addr,
 #include <linux/types.h>
 #include <linux/timer.h>
 #include <linux/param.h>
-#include <asm/atomic.h>
+#include <linux/atomic.h>
 #include <linux/inetdevice.h>
 #include <net/route.h>
diff --git a/net/atm/proc.c b/net/atm/proc.c
index be3afdefec58..0d020de8d233 100644
--- a/net/atm/proc.c
+++ b/net/atm/proc.c
@@ -27,7 +27,7 @@
 #include <net/atmclip.h>
 #include <linux/uaccess.h>
 #include <linux/param.h> /* for HZ */
-#include <asm/atomic.h>
+#include <linux/atomic.h>
 #include "resources.h"
 #include "common.h" /* atm_proc_init prototype */
 #include "signaling.h" /* to get sigd - ugly too */
diff --git a/net/bridge/br_fdb.c b/net/bridge/br_fdb.c
index e0dfbc151dd7..68def3b7fb49 100644
--- a/net/bridge/br_fdb.c
+++ b/net/bridge/br_fdb.c
@@ -21,7 +21,7 @@
 #include <linux/jhash.h>
 #include <linux/random.h>
 #include <linux/slab.h>
-#include <asm/atomic.h>
+#include <linux/atomic.h>
 #include <asm/unaligned.h>
 #include "br_private.h"
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index 1bacca4cb676..3176e2e13d9b 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -388,7 +388,7 @@ int br_add_if(struct net_bridge *br, struct net_device *dev)
        br_ifinfo_notify(RTM_NEWLINK, p);
        if (changed_addr)
-                call_netdevice_notifiers(NETDEV_CHANGEADDR, dev);
+                call_netdevice_notifiers(NETDEV_CHANGEADDR, br->dev);
        dev_set_mtu(br->dev, br_min_mtu(br));
diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
index 6814083a92f4..5b1ed1ba9aa7 100644
--- a/net/bridge/br_netlink.c
+++ b/net/bridge/br_netlink.c
@@ -188,6 +188,8 @@ static int br_rtm_setlink(struct sk_buff *skb,  struct nlmsghdr *nlh, void *arg)
        p->state = new_state;
        br_log_state(p);
+        br_ifinfo_notify(RTM_NEWLINK, p);
        return 0;
 }
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index 54578f274d85..78cc364997d9 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -124,6 +124,7 @@ struct net_bridge_port
        bridge_id                       designated_bridge;
        u32                             path_cost;
        u32                             designated_cost;
+        unsigned long                   designated_age;
        struct timer_list               forward_delay_timer;
        struct timer_list               hold_timer;
diff --git a/net/bridge/br_private_stp.h b/net/bridge/br_private_stp.h
index 642ef47a867e..05ed9bc7e426 100644
--- a/net/bridge/br_private_stp.h
+++ b/net/bridge/br_private_stp.h
@@ -56,7 +56,8 @@ extern void br_become_root_bridge(struct net_bridge *br);
 extern void br_config_bpdu_generation(struct net_bridge *);
 extern void br_configuration_update(struct net_bridge *);
 extern void br_port_state_selection(struct net_bridge *);
-extern void br_received_config_bpdu(struct net_bridge_port *p, struct br_config_bpdu *bpdu);
+extern void br_received_config_bpdu(struct net_bridge_port *p,
+                                    const struct br_config_bpdu *bpdu);
 extern void br_received_tcn_bpdu(struct net_bridge_port *p);
 extern void br_transmit_config(struct net_bridge_port *p);
 extern void br_transmit_tcn(struct net_bridge *br);
diff --git a/net/bridge/br_stp.c b/net/bridge/br_stp.c
index bb4383e84de9..ad0a3f7cf6cc 100644
--- a/net/bridge/br_stp.c
+++ b/net/bridge/br_stp.c
@@ -109,7 +109,6 @@ static void br_root_selection(struct net_bridge *br)
        list_for_each_entry(p, &br->port_list, list) {
                if (br_should_become_root_port(p, root_port))
                        root_port = p->port_no;
        }
        br->root_port = root_port;
@@ -145,7 +144,6 @@ void br_transmit_config(struct net_bridge_port *p)
        struct br_config_bpdu bpdu;
        struct net_bridge *br;
        if (timer_pending(&p->hold_timer)) {
                p->config_pending = 1;
                return;
@@ -164,8 +162,7 @@ void br_transmit_config(struct net_bridge_port *p)
        else {
                struct net_bridge_port *root
                        = br_get_port(br, br->root_port);
-                bpdu.message_age = br->max_age
+                bpdu.message_age = (jiffies - root->designated_age)
-                        - (root->message_age_timer.expires - jiffies)
                        + MESSAGE_AGE_INCR;
        }
        bpdu.max_age = br->max_age;
@@ -182,20 +179,21 @@ void br_transmit_config(struct net_bridge_port *p)
 }
 /* called under bridge lock */
-static inline void br_record_config_information(struct net_bridge_port *p,
+static void br_record_config_information(struct net_bridge_port *p,
-                                                const struct br_config_bpdu *bpdu)
+                                         const struct br_config_bpdu *bpdu)
 {
        p->designated_root = bpdu->root;
        p->designated_cost = bpdu->root_path_cost;
        p->designated_bridge = bpdu->bridge_id;
        p->designated_port = bpdu->port_id;
+        p->designated_age = jiffies + bpdu->message_age;
        mod_timer(&p->message_age_timer, jiffies
                  + (p->br->max_age - bpdu->message_age));
 }
 /* called under bridge lock */
-static inline void br_record_config_timeout_values(struct net_bridge *br,
+static void br_record_config_timeout_values(struct net_bridge *br,
                                            const struct br_config_bpdu *bpdu)
 {
        br->max_age = bpdu->max_age;
@@ -254,7 +252,8 @@ static void br_designated_port_selection(struct net_bridge *br)
 }
 /* called under bridge lock */
-static int br_supersedes_port_info(struct net_bridge_port *p, struct br_config_bpdu *bpdu)
+static int br_supersedes_port_info(const struct net_bridge_port *p,
+                                   const struct br_config_bpdu *bpdu)
 {
        int t;
@@ -285,7 +284,7 @@ static int br_supersedes_port_info(struct net_bridge_port *p, struct br_config_b
 }
 /* called under bridge lock */
-static inline void br_topology_change_acknowledged(struct net_bridge *br)
+static void br_topology_change_acknowledged(struct net_bridge *br)
 {
        br->topology_change_detected = 0;
        del_timer(&br->tcn_timer);
@@ -327,7 +326,7 @@ void br_config_bpdu_generation(struct net_bridge *br)
 }
 /* called under bridge lock */
-static inline void br_reply(struct net_bridge_port *p)
+static void br_reply(struct net_bridge_port *p)
 {
        br_transmit_config(p);
 }
@@ -363,6 +362,8 @@ static void br_make_blocking(struct net_bridge_port *p)
                p->state = BR_STATE_BLOCKING;
                br_log_state(p);
+                br_ifinfo_notify(RTM_NEWLINK, p);
                del_timer(&p->forward_delay_timer);
        }
 }
@@ -379,15 +380,14 @@ static void br_make_forwarding(struct net_bridge_port *p)
                p->state = BR_STATE_FORWARDING;
                br_topology_change_detection(br);
                del_timer(&p->forward_delay_timer);
-        }
+        } else if (br->stp_enabled == BR_KERNEL_STP)
-        else if (br->stp_enabled == BR_KERNEL_STP)
                p->state = BR_STATE_LISTENING;
        else
                p->state = BR_STATE_LEARNING;
        br_multicast_enable_port(p);
        br_log_state(p);
+        br_ifinfo_notify(RTM_NEWLINK, p);
        if (br->forward_delay != 0)
                mod_timer(&p->forward_delay_timer, jiffies + br->forward_delay);
@@ -431,14 +431,15 @@ void br_port_state_selection(struct net_bridge *br)
 }
 /* called under bridge lock */
-static inline void br_topology_change_acknowledge(struct net_bridge_port *p)
+static void br_topology_change_acknowledge(struct net_bridge_port *p)
 {
        p->topology_change_ack = 1;
        br_transmit_config(p);
 }
 /* called under bridge lock */
-void br_received_config_bpdu(struct net_bridge_port *p, struct br_config_bpdu *bpdu)
+void br_received_config_bpdu(struct net_bridge_port *p,
+                             const struct br_config_bpdu *bpdu)
 {
        struct net_bridge *br;
        int was_root;
diff --git a/net/bridge/br_stp_bpdu.c b/net/bridge/br_stp_bpdu.c
index 289646ec9b7b..e16aade51ae0 100644
--- a/net/bridge/br_stp_bpdu.c
+++ b/net/bridge/br_stp_bpdu.c
@@ -210,10 +210,19 @@ void br_stp_rcv(const struct stp_proto *proto, struct sk_buff *skb,
                bpdu.hello_time = br_get_ticks(buf+28);
                bpdu.forward_delay = br_get_ticks(buf+30);
-                br_received_config_bpdu(p, &bpdu);
+                if (bpdu.message_age > bpdu.max_age) {
-        }
+                        if (net_ratelimit())
+                                br_notice(p->br,
+                                          "port %u config from %pM"
+                                          " (message_age %ul > max_age %ul)\n",
+                                          p->port_no,
+                                          eth_hdr(skb)->h_source,
+                                          bpdu.message_age, bpdu.max_age);
+                        goto out;
+                }
-        else if (buf[0] == BPDU_TYPE_TCN) {
+                br_received_config_bpdu(p, &bpdu);
+        } else if (buf[0] == BPDU_TYPE_TCN) {
                br_received_tcn_bpdu(p);
        }
 out:
diff --git a/net/bridge/br_stp_if.c b/net/bridge/br_stp_if.c
index 6f615b8192f4..10eda3cd1d71 100644
--- a/net/bridge/br_stp_if.c
+++ b/net/bridge/br_stp_if.c
@@ -88,6 +88,7 @@ void br_stp_enable_port(struct net_bridge_port *p)
        br_init_port(p);
        br_port_state_selection(p->br);
        br_log_state(p);
+        br_ifinfo_notify(RTM_NEWLINK, p);
 }
 /* called under bridge lock */
@@ -104,6 +105,8 @@ void br_stp_disable_port(struct net_bridge_port *p)
        p->topology_change_ack = 0;
        p->config_pending = 0;
+        br_ifinfo_notify(RTM_NEWLINK, p);
        del_timer(&p->message_age_timer);
        del_timer(&p->forward_delay_timer);
        del_timer(&p->hold_timer);
diff --git a/net/bridge/br_stp_timer.c b/net/bridge/br_stp_timer.c
index 3e965140051e..58de2a0f9975 100644
--- a/net/bridge/br_stp_timer.c
+++ b/net/bridge/br_stp_timer.c
@@ -97,6 +97,7 @@ static void br_forward_delay_timer_expired(unsigned long arg)
                netif_carrier_on(br->dev);
        }
        br_log_state(p);
+        br_ifinfo_notify(RTM_NEWLINK, p);
        spin_unlock(&br->lock);
 }
diff --git a/net/bridge/netfilter/ebt_ulog.c b/net/bridge/netfilter/ebt_ulog.c
index 26377e96fa1c..bf2a333ca7c7 100644
--- a/net/bridge/netfilter/ebt_ulog.c
+++ b/net/bridge/netfilter/ebt_ulog.c
@@ -216,7 +216,6 @@ unlock:
 nlmsg_failure:
        pr_debug("error during NLMSG_PUT. This should "
                 "not happen, please report to author.\n");
-        goto unlock;
 alloc_failure:
        goto unlock;
 }
diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
index 78b55f49de7c..c340e2e0765b 100644
--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
@@ -486,13 +486,10 @@ static void prepare_write_message(struct ceph_connection *con)
        m = list_first_entry(&con->out_queue,
                       struct ceph_msg, list_head);
        con->out_msg = m;
-        if (test_bit(LOSSYTX, &con->state)) {
-                list_del_init(&m->list_head);
+        /* put message on sent list */
-        } else {
+        ceph_msg_get(m);
-                /* put message on sent list */
+        list_move_tail(&m->list_head, &con->out_sent);
-                ceph_msg_get(m);
-                list_move_tail(&m->list_head, &con->out_sent);
-        }
        /*
         * only assign outgoing seq # if we haven't sent this message
@@ -1399,6 +1396,7 @@ static void process_ack(struct ceph_connection *con)
                        break;
                dout("got ack for seq %llu type %d at %p\n", seq,
                     le16_to_cpu(m->hdr.type), m);
+                m->ack_stamp = jiffies;
                ceph_msg_remove(m);
        }
        prepare_read_tag(con);
diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
index 7330c2757c0c..ce310eee708d 100644
--- a/net/ceph/osd_client.c
+++ b/net/ceph/osd_client.c
@@ -1085,9 +1085,15 @@ static void handle_timeout(struct work_struct *work)
                req = list_entry(osdc->req_lru.next, struct ceph_osd_request,
                                 r_req_lru_item);
+                /* hasn't been long enough since we sent it? */
                if (time_before(jiffies, req->r_stamp + timeout))
                        break;
+                /* hasn't been long enough since it was acked? */
+                if (req->r_request->ack_stamp == 0 ||
+                    time_before(jiffies, req->r_request->ack_stamp + timeout))
+                        break;
                BUG_ON(req == last_req && req->r_stamp == last_stamp);
                last_req = req;
                last_stamp = req->r_stamp;
diff --git a/net/core/flow.c b/net/core/flow.c
index 990703b8863b..bf32c33cad3b 100644
--- a/net/core/flow.c
+++ b/net/core/flow.c
@@ -22,7 +22,7 @@
 #include <linux/cpumask.h>
 #include <linux/mutex.h>
 #include <net/flow.h>
-#include <asm/atomic.h>
+#include <linux/atomic.h>
 #include <linux/security.h>
 struct flow_cache_entry {
diff --git a/net/core/link_watch.c b/net/core/link_watch.c
index a7b342131869..357bd4ee4baa 100644
--- a/net/core/link_watch.c
+++ b/net/core/link_watch.c
@@ -126,7 +126,7 @@ static void linkwatch_schedule_work(int urgent)
                return;
        /* It's already running which is good enough. */
-        if (!cancel_delayed_work(&linkwatch_work))
+        if (!__cancel_delayed_work(&linkwatch_work))
                return;
        /* Otherwise we reschedule it again for immediate execution. */
diff --git a/net/decnet/dn_fib.c b/net/decnet/dn_fib.c
index 2bd8e53d7774..9e885f180b60 100644
--- a/net/decnet/dn_fib.c
+++ b/net/decnet/dn_fib.c
@@ -30,7 +30,7 @@
 #include <linux/netdevice.h>
 #include <linux/timer.h>
 #include <linux/spinlock.h>
-#include <asm/atomic.h>
+#include <linux/atomic.h>
 #include <asm/uaccess.h>
 #include <net/neighbour.h>
 #include <net/dst.h>
diff --git a/net/decnet/dn_neigh.c b/net/decnet/dn_neigh.c
index 0dc3fe61085b..7f0eb087dc11 100644
--- a/net/decnet/dn_neigh.c
+++ b/net/decnet/dn_neigh.c
@@ -38,7 +38,7 @@
 #include <linux/seq_file.h>
 #include <linux/rcupdate.h>
 #include <linux/jhash.h>
-#include <asm/atomic.h>
+#include <linux/atomic.h>
 #include <net/net_namespace.h>
 #include <net/neighbour.h>
 #include <net/dst.h>
diff --git a/net/decnet/dn_table.c b/net/decnet/dn_table.c
index cd0354e9bdb3..a9a62f225a6b 100644
--- a/net/decnet/dn_table.c
+++ b/net/decnet/dn_table.c
@@ -25,7 +25,7 @@
 #include <linux/netdevice.h>
 #include <linux/timer.h>
 #include <linux/spinlock.h>
-#include <asm/atomic.h>
+#include <linux/atomic.h>
 #include <asm/uaccess.h>
 #include <linux/route.h> /* RTF_xxx */
 #include <net/neighbour.h>
diff --git a/net/decnet/dn_timer.c b/net/decnet/dn_timer.c
index 09825711d58a..67f691bd4acf 100644
--- a/net/decnet/dn_timer.c
+++ b/net/decnet/dn_timer.c
@@ -22,7 +22,7 @@
 #include <linux/timer.h>
 #include <linux/spinlock.h>
 #include <net/sock.h>
-#include <asm/atomic.h>
+#include <linux/atomic.h>
 #include <net/flow.h>
 #include <net/dn.h>
diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
index 2b3c23c287cd..2c2a98e402e7 100644
--- a/net/ipv4/cipso_ipv4.c
+++ b/net/ipv4/cipso_ipv4.c
@@ -50,7 +50,7 @@
 #include <net/tcp.h>
 #include <net/netlabel.h>
 #include <net/cipso_ipv4.h>
-#include <asm/atomic.h>
+#include <linux/atomic.h>
 #include <asm/bug.h>
 #include <asm/unaligned.h>
diff --git a/net/ipv4/gre.c b/net/ipv4/gre.c
index 9dbe10875fbd..dbfc21de3479 100644
--- a/net/ipv4/gre.c
+++ b/net/ipv4/gre.c
@@ -15,6 +15,7 @@
 #include <linux/kmod.h>
 #include <linux/skbuff.h>
 #include <linux/in.h>
+#include <linux/ip.h>
 #include <linux/netdevice.h>
 #include <linux/spinlock.h>
 #include <net/protocol.h>
@@ -96,27 +97,17 @@ drop:
 static void gre_err(struct sk_buff *skb, u32 info)
 {
        const struct gre_protocol *proto;
-        u8 ver;
+        const struct iphdr *iph = (const struct iphdr *)skb->data;
+        u8 ver = skb->data[(iph->ihl<<2) + 1]&0x7f;
-        if (!pskb_may_pull(skb, 12))
-                goto drop;
-        ver = skb->data[1]&0x7f;
        if (ver >= GREPROTO_MAX)
-                goto drop;
+                return;
        rcu_read_lock();
        proto = rcu_dereference(gre_proto[ver]);
-        if (!proto || !proto->err_handler)
+        if (proto && proto->err_handler)
-                goto drop_unlock;
+                proto->err_handler(skb, info);
-        proto->err_handler(skb, info);
-        rcu_read_unlock();
-        return;
-drop_unlock:
        rcu_read_unlock();
-drop:
-        kfree_skb(skb);
 }
 static const struct net_protocol net_gre_protocol = {
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index aae2bd8cd924..58e879157976 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -1796,7 +1796,7 @@ static struct mr_table *ipmr_rt_fib_lookup(struct net *net, struct sk_buff *skb)
        struct flowi4 fl4 = {
                .daddr = iph->daddr,
                .saddr = iph->saddr,
-                .flowi4_tos = iph->tos,
+                .flowi4_tos = RT_TOS(iph->tos),
                .flowi4_oif = rt->rt_oif,
                .flowi4_iif = rt->rt_iif,
                .flowi4_mark = rt->rt_mark,
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index 08526786dc39..1457acb39cec 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -38,7 +38,7 @@
 */
 #include <linux/types.h>
-#include <asm/atomic.h>
+#include <linux/atomic.h>
 #include <asm/byteorder.h>
 #include <asm/current.h>
 #include <asm/uaccess.h>
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 33137307d52a..1730689f560e 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1740,7 +1740,7 @@ void ip_rt_get_source(u8 *addr, struct sk_buff *skb, struct rtable *rt)
                memset(&fl4, 0, sizeof(fl4));
                fl4.daddr = iph->daddr;
                fl4.saddr = iph->saddr;
-                fl4.flowi4_tos = iph->tos;
+                fl4.flowi4_tos = RT_TOS(iph->tos);
                fl4.flowi4_oif = rt->dst.dev->ifindex;
                fl4.flowi4_iif = skb->dev->ifindex;
                fl4.flowi4_mark = skb->mark;
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 36c2842a86b2..0bc98886c383 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -40,7 +40,7 @@
 #include <linux/slab.h>
 #include <asm/uaccess.h>
-#include <asm/atomic.h>
+#include <linux/atomic.h>
 #include <net/icmp.h>
 #include <net/ip.h>
diff --git a/net/iucv/iucv.c b/net/iucv/iucv.c
index 7f9124914b13..075a3808aa40 100644
--- a/net/iucv/iucv.c
+++ b/net/iucv/iucv.c
@@ -51,7 +51,7 @@
 #include <linux/cpu.h>
 #include <linux/reboot.h>
 #include <net/iucv/iucv.h>
-#include <asm/atomic.h>
+#include <linux/atomic.h>
 #include <asm/ebcdic.h>
 #include <asm/io.h>
 #include <asm/irq.h>
@@ -1988,12 +1988,13 @@ static int __init iucv_init(void)
                rc = -EPROTONOSUPPORT;
                goto out;
        }
+        ctl_set_bit(0, 1);
        rc = iucv_query_maxconn();
        if (rc)
-                goto out;
+                goto out_ctl;
        rc = register_external_interrupt(0x4000, iucv_external_interrupt);
        if (rc)
-                goto out;
+                goto out_ctl;
        iucv_root = root_device_register("iucv");
        if (IS_ERR(iucv_root)) {
                rc = PTR_ERR(iucv_root);
@@ -2055,6 +2056,8 @@ out_free:
        root_device_unregister(iucv_root);
 out_int:
        unregister_external_interrupt(0x4000, iucv_external_interrupt);
+out_ctl:
+        ctl_clear_bit(0, 1);
 out:
        return rc;
 }
diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index ed8a2335442f..ad4ac2601a56 100644
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -55,7 +55,7 @@
 #include <net/protocol.h>
 #include <asm/byteorder.h>
-#include <asm/atomic.h>
+#include <linux/atomic.h>
 #include "l2tp_core.h"
diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
index 39a21d0c61c4..f42cd0915966 100644
--- a/net/l2tp/l2tp_ppp.c
+++ b/net/l2tp/l2tp_ppp.c
@@ -97,7 +97,7 @@
 #include <net/xfrm.h>
 #include <asm/byteorder.h>
-#include <asm/atomic.h>
+#include <linux/atomic.h>
 #include "l2tp_core.h"
diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c
index ebadb9ac9a7e..fd1aaf2a4a6c 100644
--- a/net/mac80211/agg-rx.c
+++ b/net/mac80211/agg-rx.c
@@ -104,14 +104,22 @@ void ieee80211_stop_rx_ba_session(struct ieee80211_vif *vif, u16 ba_rx_bitmap,
                                  const u8 *addr)
 {
        struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
-        struct sta_info *sta = sta_info_get(sdata, addr);
+        struct sta_info *sta;
        int i;
+        rcu_read_lock();
+        sta = sta_info_get(sdata, addr);
+        if (!sta) {
+                rcu_read_unlock();
+                return;
+        }
        for (i = 0; i < STA_TID_NUM; i++)
                if (ba_rx_bitmap & BIT(i))
                        set_bit(i, sta->ampdu_mlme.tid_rx_stop_requested);
        ieee80211_queue_work(&sta->local->hw, &sta->ampdu_mlme.work);
+        rcu_read_unlock();
 }
 EXPORT_SYMBOL(ieee80211_stop_rx_ba_session);
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index bfc36e904764..3d1b091d9b2e 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -1255,6 +1255,10 @@ static int ieee80211_set_txq_params(struct wiphy *wiphy,
         */
        p.uapsd = false;
+        if (params->queue >= local->hw.queues)
+                return -EINVAL;
+        local->tx_conf[params->queue] = p;
        if (drv_conf_tx(local, params->queue, &p)) {
                wiphy_debug(local->hw.wiphy,
                            "failed to set TX queue parameters for queue %d\n",
diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
index b2d6bba44054..1425380983f7 100644
--- a/net/mac80211/driver-ops.h
+++ b/net/mac80211/driver-ops.h
@@ -130,6 +130,37 @@ static inline void drv_bss_info_changed(struct ieee80211_local *local,
        trace_drv_return_void(local);
 }
+static inline int drv_tx_sync(struct ieee80211_local *local,
+                              struct ieee80211_sub_if_data *sdata,
+                              const u8 *bssid,
+                              enum ieee80211_tx_sync_type type)
+{
+        int ret = 0;
+        might_sleep();
+        trace_drv_tx_sync(local, sdata, bssid, type);
+        if (local->ops->tx_sync)
+                ret = local->ops->tx_sync(&local->hw, &sdata->vif,
+                                          bssid, type);
+        trace_drv_return_int(local, ret);
+        return ret;
+}
+static inline void drv_finish_tx_sync(struct ieee80211_local *local,
+                                      struct ieee80211_sub_if_data *sdata,
+                                      const u8 *bssid,
+                                      enum ieee80211_tx_sync_type type)
+{
+        might_sleep();
+        trace_drv_finish_tx_sync(local, sdata, bssid, type);
+        if (local->ops->finish_tx_sync)
+                local->ops->finish_tx_sync(&local->hw, &sdata->vif,
+                                           bssid, type);
+        trace_drv_return_void(local);
+}
 static inline u64 drv_prepare_multicast(struct ieee80211_local *local,
                                        struct netdev_hw_addr_list *mc_list)
 {
diff --git a/net/mac80211/driver-trace.h b/net/mac80211/driver-trace.h
index 4470f6e8b845..f47b00dc7afd 100644
--- a/net/mac80211/driver-trace.h
+++ b/net/mac80211/driver-trace.h
@@ -319,6 +319,49 @@ TRACE_EVENT(drv_bss_info_changed,
        )
 );
+DECLARE_EVENT_CLASS(tx_sync_evt,
+        TP_PROTO(struct ieee80211_local *local,
+                 struct ieee80211_sub_if_data *sdata,
+                 const u8 *bssid,
+                 enum ieee80211_tx_sync_type type),
+        TP_ARGS(local, sdata, bssid, type),
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                VIF_ENTRY
+                __array(char, bssid, ETH_ALEN)
+                __field(u32, sync_type)
+        ),
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                VIF_ASSIGN;
+                memcpy(__entry->bssid, bssid, ETH_ALEN);
+                __entry->sync_type = type;
+        ),
+        TP_printk(
+                LOCAL_PR_FMT  VIF_PR_FMT " bssid:%pM type:%d",
+                LOCAL_PR_ARG, VIF_PR_ARG, __entry->bssid, __entry->sync_type
+        )
+);
+DEFINE_EVENT(tx_sync_evt, drv_tx_sync,
+        TP_PROTO(struct ieee80211_local *local,
+                 struct ieee80211_sub_if_data *sdata,
+                 const u8 *bssid,
+                 enum ieee80211_tx_sync_type type),
+        TP_ARGS(local, sdata, bssid, type)
+);
+DEFINE_EVENT(tx_sync_evt, drv_finish_tx_sync,
+        TP_PROTO(struct ieee80211_local *local,
+                 struct ieee80211_sub_if_data *sdata,
+                 const u8 *bssid,
+                 enum ieee80211_tx_sync_type type),
+        TP_ARGS(local, sdata, bssid, type)
+);
 TRACE_EVENT(drv_prepare_multicast,
        TP_PROTO(struct ieee80211_local *local, int mc_count),
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index dda0d1ab34f3..400c09bea639 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -323,6 +323,7 @@ struct ieee80211_work {
                        u8 key[WLAN_KEY_LEN_WEP104];
                        u8 key_len, key_idx;
                        bool privacy;
+                        bool synced;
                } probe_auth;
                struct {
                        struct cfg80211_bss *bss;
@@ -336,6 +337,7 @@ struct ieee80211_work {
                        u8 ssid_len;
                        u8 supp_rates_len;
                        bool wmm_used, use_11n, uapsd_used;
+                        bool synced;
                } assoc;
                struct {
                        u32 duration;
@@ -746,6 +748,7 @@ struct ieee80211_local {
        struct workqueue_struct *workqueue;
        unsigned long queue_stop_reasons[IEEE80211_MAX_QUEUES];
+        struct ieee80211_tx_queue_params tx_conf[IEEE80211_MAX_QUEUES];
        /* also used to protect ampdu_ac_queue and amdpu_ac_stop_refcnt */
        spinlock_t queue_stop_reason_lock;
@@ -1376,14 +1379,14 @@ int ieee80211_build_preq_ies(struct ieee80211_local *local, u8 *buffer,
                             enum ieee80211_band band, u32 rate_mask,
                             u8 channel);
 struct sk_buff *ieee80211_build_probe_req(struct ieee80211_sub_if_data *sdata,
-                                          u8 *dst,
+                                          u8 *dst, u32 ratemask,
                                          const u8 *ssid, size_t ssid_len,
                                          const u8 *ie, size_t ie_len,
                                          bool directed);
 void ieee80211_send_probe_req(struct ieee80211_sub_if_data *sdata, u8 *dst,
                              const u8 *ssid, size_t ssid_len,
                              const u8 *ie, size_t ie_len,
-                              bool directed);
+                              u32 ratemask, bool directed);
 void ieee80211_sta_def_wmm_params(struct ieee80211_sub_if_data *sdata,
                                  const size_t supp_rates_len,
diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index 739bee13e813..5150c6d11b57 100644
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -278,7 +278,7 @@ static void __ieee80211_key_replace(struct ieee80211_sub_if_data *sdata,
        bool defunikey, defmultikey, defmgmtkey;
        if (new)
-                list_add(&new->list, &sdata->key_list);
+                list_add_tail(&new->list, &sdata->key_list);
        if (sta && pairwise) {
                rcu_assign_pointer(sta->ptk, new);
diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
index 2b18053070c1..3460108810d5 100644
--- a/net/mac80211/mesh_hwmp.c
+++ b/net/mac80211/mesh_hwmp.c
@@ -57,29 +57,29 @@ static inline u32 u16_field_get(u8 *preq_elem, int offset, bool ae)
 #define PREQ_IE_TTL(x)          (*(x + 2))
 #define PREQ_IE_PREQ_ID(x)      u32_field_get(x, 3, 0)
 #define PREQ_IE_ORIG_ADDR(x)    (x + 7)
-#define PREQ_IE_ORIG_SN(x)      u32_field_get(x, 13, 0);
+#define PREQ_IE_ORIG_SN(x)      u32_field_get(x, 13, 0)
-#define PREQ_IE_LIFETIME(x)     u32_field_get(x, 17, AE_F_SET(x));
+#define PREQ_IE_LIFETIME(x)     u32_field_get(x, 17, AE_F_SET(x))
-#define PREQ_IE_METRIC(x)       u32_field_get(x, 21, AE_F_SET(x));
+#define PREQ_IE_METRIC(x)       u32_field_get(x, 21, AE_F_SET(x))
 #define PREQ_IE_TARGET_F(x)     (*(AE_F_SET(x) ? x + 32 : x + 26))
 #define PREQ_IE_TARGET_ADDR(x)  (AE_F_SET(x) ? x + 33 : x + 27)
-#define PREQ_IE_TARGET_SN(x)    u32_field_get(x, 33, AE_F_SET(x));
+#define PREQ_IE_TARGET_SN(x)    u32_field_get(x, 33, AE_F_SET(x))
 #define PREP_IE_FLAGS(x)        PREQ_IE_FLAGS(x)
 #define PREP_IE_HOPCOUNT(x)     PREQ_IE_HOPCOUNT(x)
 #define PREP_IE_TTL(x)          PREQ_IE_TTL(x)
 #define PREP_IE_ORIG_ADDR(x)    (x + 3)
-#define PREP_IE_ORIG_SN(x)      u32_field_get(x, 9, 0);
+#define PREP_IE_ORIG_SN(x)      u32_field_get(x, 9, 0)
-#define PREP_IE_LIFETIME(x)     u32_field_get(x, 13, AE_F_SET(x));
+#define PREP_IE_LIFETIME(x)     u32_field_get(x, 13, AE_F_SET(x))
-#define PREP_IE_METRIC(x)       u32_field_get(x, 17, AE_F_SET(x));
+#define PREP_IE_METRIC(x)       u32_field_get(x, 17, AE_F_SET(x))
 #define PREP_IE_TARGET_ADDR(x)  (AE_F_SET(x) ? x + 27 : x + 21)
-#define PREP_IE_TARGET_SN(x)    u32_field_get(x, 27, AE_F_SET(x));
+#define PREP_IE_TARGET_SN(x)    u32_field_get(x, 27, AE_F_SET(x))
 #define PERR_IE_TTL(x)          (*(x))
 #define PERR_IE_TARGET_FLAGS(x) (*(x + 2))
 #define PERR_IE_TARGET_ADDR(x)  (x + 3)
-#define PERR_IE_TARGET_SN(x)    u32_field_get(x, 9, 0);
+#define PERR_IE_TARGET_SN(x)    u32_field_get(x, 9, 0)
-#define PERR_IE_TARGET_RCODE(x) u16_field_get(x, 13, 0);
+#define PERR_IE_TARGET_RCODE(x) u16_field_get(x, 13, 0)
 #define MSEC_TO_TU(x) (x*1000/1024)
 #define SN_GT(x, y) ((long) (y) - (long) (x) < 0)
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index c99237cd4b98..d6470c7fd6ce 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -917,6 +917,7 @@ static void ieee80211_sta_wmm_params(struct ieee80211_local *local,
                            params.aifs, params.cw_min, params.cw_max,
                            params.txop, params.uapsd);
 #endif
+                local->tx_conf[queue] = params;
                if (drv_conf_tx(local, queue, &params))
                        wiphy_debug(local->hw.wiphy,
                                    "failed to set TX queue parameters for queue %d\n",
@@ -1219,7 +1220,7 @@ static void ieee80211_mgd_probe_ap_send(struct ieee80211_sub_if_data *sdata)
        } else {
                ssid = ieee80211_bss_get_ie(ifmgd->associated, WLAN_EID_SSID);
                ieee80211_send_probe_req(sdata, dst, ssid + 2, ssid[1], NULL, 0,
-                                         true);
+                                         (u32) -1, true);
        }
        ifmgd->probe_send_count++;
@@ -1304,7 +1305,8 @@ struct sk_buff *ieee80211_ap_probereq_get(struct ieee80211_hw *hw,
        ssid = ieee80211_bss_get_ie(ifmgd->associated, WLAN_EID_SSID);
        skb = ieee80211_build_probe_req(sdata, ifmgd->associated->bssid,
-                                        ssid + 2, ssid[1], NULL, 0, true);
+                                        (u32) -1, ssid + 2, ssid[1],
+                                        NULL, 0, true);
        return skb;
 }
@@ -2333,14 +2335,16 @@ static enum work_done_result
 ieee80211_probe_auth_done(struct ieee80211_work *wk,
                          struct sk_buff *skb)
 {
+        struct ieee80211_local *local = wk->sdata->local;
        if (!skb) {
                cfg80211_send_auth_timeout(wk->sdata->dev, wk->filter_ta);
-                return WORK_DONE_DESTROY;
+                goto destroy;
        }
        if (wk->type == IEEE80211_WORK_AUTH) {
                cfg80211_send_rx_auth(wk->sdata->dev, skb->data, skb->len);
-                return WORK_DONE_DESTROY;
+                goto destroy;
        }
        mutex_lock(&wk->sdata->u.mgd.mtx);
@@ -2350,6 +2354,12 @@ ieee80211_probe_auth_done(struct ieee80211_work *wk,
        wk->type = IEEE80211_WORK_AUTH;
        wk->probe_auth.tries = 0;
        return WORK_DONE_REQUEUE;
+ destroy:
+        if (wk->probe_auth.synced)
+                drv_finish_tx_sync(local, wk->sdata, wk->filter_ta,
+                                   IEEE80211_TX_SYNC_AUTH);
+        return WORK_DONE_DESTROY;
 }
 int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata,
@@ -2422,6 +2432,7 @@ int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata,
 static enum work_done_result ieee80211_assoc_done(struct ieee80211_work *wk,
                                                  struct sk_buff *skb)
 {
+        struct ieee80211_local *local = wk->sdata->local;
        struct ieee80211_mgmt *mgmt;
        struct ieee80211_rx_status *rx_status;
        struct ieee802_11_elems elems;
@@ -2429,7 +2440,7 @@ static enum work_done_result ieee80211_assoc_done(struct ieee80211_work *wk,
        if (!skb) {
                cfg80211_send_assoc_timeout(wk->sdata->dev, wk->filter_ta);
-                return WORK_DONE_DESTROY;
+                goto destroy;
        }
        if (wk->type == IEEE80211_WORK_ASSOC_BEACON_WAIT) {
@@ -2449,6 +2460,10 @@ static enum work_done_result ieee80211_assoc_done(struct ieee80211_work *wk,
        status = le16_to_cpu(mgmt->u.assoc_resp.status_code);
        if (status == WLAN_STATUS_SUCCESS) {
+                if (wk->assoc.synced)
+                        drv_finish_tx_sync(local, wk->sdata, wk->filter_ta,
+                                           IEEE80211_TX_SYNC_ASSOC);
                mutex_lock(&wk->sdata->u.mgd.mtx);
                if (!ieee80211_assoc_success(wk, mgmt, skb->len)) {
                        mutex_unlock(&wk->sdata->u.mgd.mtx);
@@ -2462,6 +2477,11 @@ static enum work_done_result ieee80211_assoc_done(struct ieee80211_work *wk,
        }
        cfg80211_send_rx_assoc(wk->sdata->dev, skb->data, skb->len);
+ destroy:
+        if (wk->assoc.synced)
+                drv_finish_tx_sync(local, wk->sdata, wk->filter_ta,
+                                   IEEE80211_TX_SYNC_ASSOC);
        return WORK_DONE_DESTROY;
 }
diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c
index f87e993e713b..6326d3439861 100644
--- a/net/mac80211/pm.c
+++ b/net/mac80211/pm.c
@@ -34,6 +34,9 @@ int __ieee80211_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
        struct ieee80211_sub_if_data *sdata;
        struct sta_info *sta;
+        if (!local->open_count)
+                goto suspend;
        ieee80211_scan_cancel(local);
        if (hw->flags & IEEE80211_HW_AMPDU_AGGREGATION) {
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index 08a45ac3d6f8..6f09eca01112 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -228,7 +228,6 @@ ieee80211_scan_rx(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb)
 static bool ieee80211_prep_hw_scan(struct ieee80211_local *local)
 {
        struct cfg80211_scan_request *req = local->scan_req;
-        struct ieee80211_sub_if_data *sdata = local->scan_sdata;
        enum ieee80211_band band;
        int i, ielen, n_chans;
@@ -253,7 +252,7 @@ static bool ieee80211_prep_hw_scan(struct ieee80211_local *local)
        ielen = ieee80211_build_preq_ies(local, (u8 *)local->hw_scan_req->ie,
                                         req->ie, req->ie_len, band,
-                                         sdata->rc_rateidx_mask[band], 0);
+                                         req->rates[band], 0);
        local->hw_scan_req->ie_len = ielen;
        return true;
@@ -653,6 +652,7 @@ static void ieee80211_scan_state_send_probe(struct ieee80211_local *local,
 {
        int i;
        struct ieee80211_sub_if_data *sdata = local->scan_sdata;
+        enum ieee80211_band band = local->hw.conf.channel->band;
        for (i = 0; i < local->scan_req->n_ssids; i++)
                ieee80211_send_probe_req(
@@ -660,7 +660,7 @@ static void ieee80211_scan_state_send_probe(struct ieee80211_local *local,
                        local->scan_req->ssids[i].ssid,
                        local->scan_req->ssids[i].ssid_len,
                        local->scan_req->ie, local->scan_req->ie_len,
-                        false);
+                        local->scan_req->rates[band], false);
        /*
         * After sending probe requests, wait for probe responses
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index b83870bf60fa..3db78b696c5c 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -97,7 +97,6 @@ struct sta_info *sta_info_get(struct ieee80211_sub_if_data *sdata,
        struct sta_info *sta;
        sta = rcu_dereference_check(local->sta_hash[STA_HASH(addr)],
-                                    rcu_read_lock_held() ||
                                    lockdep_is_held(&local->sta_lock) ||
                                    lockdep_is_held(&local->sta_mtx));
        while (sta) {
@@ -105,7 +104,6 @@ struct sta_info *sta_info_get(struct ieee80211_sub_if_data *sdata,
                    memcmp(sta->sta.addr, addr, ETH_ALEN) == 0)
                        break;
                sta = rcu_dereference_check(sta->hnext,
-                                            rcu_read_lock_held() ||
                                            lockdep_is_held(&local->sta_lock) ||
                                            lockdep_is_held(&local->sta_mtx));
        }
@@ -123,7 +121,6 @@ struct sta_info *sta_info_get_bss(struct ieee80211_sub_if_data *sdata,
        struct sta_info *sta;
        sta = rcu_dereference_check(local->sta_hash[STA_HASH(addr)],
-                                    rcu_read_lock_held() ||
                                    lockdep_is_held(&local->sta_lock) ||
                                    lockdep_is_held(&local->sta_mtx));
        while (sta) {
@@ -132,7 +129,6 @@ struct sta_info *sta_info_get_bss(struct ieee80211_sub_if_data *sdata,
                    memcmp(sta->sta.addr, addr, ETH_ALEN) == 0)
                        break;
                sta = rcu_dereference_check(sta->hnext,
-                                            rcu_read_lock_held() ||
                                            lockdep_is_held(&local->sta_lock) ||
                                            lockdep_is_held(&local->sta_mtx));
        }
diff --git a/net/mac80211/tkip.c b/net/mac80211/tkip.c
index cc79e697cdb2..f49d00a4c7fd 100644
--- a/net/mac80211/tkip.c
+++ b/net/mac80211/tkip.c
@@ -185,6 +185,17 @@ void ieee80211_get_tkip_p1k_iv(struct ieee80211_key_conf *keyconf,
 }
 EXPORT_SYMBOL(ieee80211_get_tkip_p1k_iv);
+void ieee80211_get_tkip_rx_p1k(struct ieee80211_key_conf *keyconf,
+                               const u8 *ta, u32 iv32, u16 *p1k)
+{
+        const u8 *tk = &keyconf->key[NL80211_TKIP_DATA_OFFSET_ENCR_KEY];
+        struct tkip_ctx ctx;
+        tkip_mixing_phase1(tk, &ctx, ta, iv32);
+        memcpy(p1k, ctx.p1k, sizeof(ctx.p1k));
+}
+EXPORT_SYMBOL(ieee80211_get_tkip_rx_p1k);
 void ieee80211_get_tkip_p2k(struct ieee80211_key_conf *keyconf,
                            struct sk_buff *skb, u8 *p2k)
 {
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 5bfb80cba634..ddeb1b998383 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -799,6 +799,7 @@ void ieee80211_set_wmm_default(struct ieee80211_sub_if_data *sdata)
                qparam.uapsd = false;
+                local->tx_conf[queue] = qparam;
                drv_conf_tx(local, queue, &qparam);
        }
@@ -1016,7 +1017,7 @@ int ieee80211_build_preq_ies(struct ieee80211_local *local, u8 *buffer,
 }
 struct sk_buff *ieee80211_build_probe_req(struct ieee80211_sub_if_data *sdata,
-                                          u8 *dst,
+                                          u8 *dst, u32 ratemask,
                                          const u8 *ssid, size_t ssid_len,
                                          const u8 *ie, size_t ie_len,
                                          bool directed)
@@ -1049,9 +1050,7 @@ struct sk_buff *ieee80211_build_probe_req(struct ieee80211_sub_if_data *sdata,
        buf_len = ieee80211_build_preq_ies(local, buf, ie, ie_len,
                                           local->hw.conf.channel->band,
-                                           sdata->rc_rateidx_mask
+                                           ratemask, chan);
-                                           [local->hw.conf.channel->band],
-                                           chan);
        skb = ieee80211_probereq_get(&local->hw, &sdata->vif,
                                     ssid, ssid_len,
@@ -1072,12 +1071,12 @@ struct sk_buff *ieee80211_build_probe_req(struct ieee80211_sub_if_data *sdata,
 void ieee80211_send_probe_req(struct ieee80211_sub_if_data *sdata, u8 *dst,
                              const u8 *ssid, size_t ssid_len,
                              const u8 *ie, size_t ie_len,
-                              bool directed)
+                              u32 ratemask, bool directed)
 {
        struct sk_buff *skb;
-        skb = ieee80211_build_probe_req(sdata, dst, ssid, ssid_len, ie, ie_len,
+        skb = ieee80211_build_probe_req(sdata, dst, ratemask, ssid, ssid_len,
-                                        directed);
+                                        ie, ie_len, directed);
        if (skb)
                ieee80211_tx_skb(sdata, skb);
 }
@@ -1134,7 +1133,7 @@ int ieee80211_reconfig(struct ieee80211_local *local)
        struct ieee80211_hw *hw = &local->hw;
        struct ieee80211_sub_if_data *sdata;
        struct sta_info *sta;
-        int res;
+        int res, i;
 #ifdef CONFIG_PM
        if (local->suspended)
@@ -1157,27 +1156,37 @@ int ieee80211_reconfig(struct ieee80211_local *local)
        }
 #endif
-        /* restart hardware */
+        /* setup fragmentation threshold */
-        if (local->open_count) {
+        drv_set_frag_threshold(local, hw->wiphy->frag_threshold);
-                /*
-                 * Upon resume hardware can sometimes be goofy due to
+        /* setup RTS threshold */
-                 * various platform / driver / bus issues, so restarting
+        drv_set_rts_threshold(local, hw->wiphy->rts_threshold);
-                 * the device may at times not work immediately. Propagate
-                 * the error.
+        /* reset coverage class */
-                 */
+        drv_set_coverage_class(local, hw->wiphy->coverage_class);
-                res = drv_start(local);
-                if (res) {
+        /* everything else happens only if HW was up & running */
-                        WARN(local->suspended, "Hardware became unavailable "
+        if (!local->open_count)
-                             "upon resume. This could be a software issue "
+                goto wake_up;
-                             "prior to suspend or a hardware issue.\n");
-                        return res;
-                }
-                ieee80211_led_radio(local, true);
+        /*
-                ieee80211_mod_tpt_led_trig(local,
+         * Upon resume hardware can sometimes be goofy due to
-                                           IEEE80211_TPT_LEDTRIG_FL_RADIO, 0);
+         * various platform / driver / bus issues, so restarting
+         * the device may at times not work immediately. Propagate
+         * the error.
+         */
+        res = drv_start(local);
+        if (res) {
+                WARN(local->suspended, "Hardware became unavailable "
+                     "upon resume. This could be a software issue "
+                     "prior to suspend or a hardware issue.\n");
+                return res;
        }
+        ieee80211_led_radio(local, true);
+        ieee80211_mod_tpt_led_trig(local,
+                                   IEEE80211_TPT_LEDTRIG_FL_RADIO, 0);
        /* add interfaces */
        list_for_each_entry(sdata, &local->interfaces, list) {
                if (sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
@@ -1201,11 +1210,9 @@ int ieee80211_reconfig(struct ieee80211_local *local)
        }
        mutex_unlock(&local->sta_mtx);
-        /* setup fragmentation threshold */
+        /* reconfigure tx conf */
-        drv_set_frag_threshold(local, hw->wiphy->frag_threshold);
+        for (i = 0; i < hw->queues; i++)
+                drv_conf_tx(local, i, &local->tx_conf[i]);
-        /* setup RTS threshold */
-        drv_set_rts_threshold(local, hw->wiphy->rts_threshold);
        /* reconfigure hardware */
        ieee80211_hw_config(local, ~0);
@@ -1287,9 +1294,7 @@ int ieee80211_reconfig(struct ieee80211_local *local)
                if (ieee80211_sdata_running(sdata))
                        ieee80211_enable_keys(sdata);
-#ifdef CONFIG_PM
 wake_up:
-#endif
        ieee80211_wake_queues_by_reason(hw,
                        IEEE80211_QUEUE_STOP_REASON_SUSPEND);
diff --git a/net/mac80211/work.c b/net/mac80211/work.c
index edf8583280c9..380b9a7462b6 100644
--- a/net/mac80211/work.c
+++ b/net/mac80211/work.c
@@ -25,6 +25,7 @@
 #include "ieee80211_i.h"
 #include "rate.h"
+#include "driver-ops.h"
 #define IEEE80211_AUTH_TIMEOUT (HZ / 5)
 #define IEEE80211_AUTH_MAX_TRIES 3
@@ -427,6 +428,14 @@ ieee80211_direct_probe(struct ieee80211_work *wk)
        struct ieee80211_sub_if_data *sdata = wk->sdata;
        struct ieee80211_local *local = sdata->local;
+        if (!wk->probe_auth.synced) {
+                int ret = drv_tx_sync(local, sdata, wk->filter_ta,
+                                      IEEE80211_TX_SYNC_AUTH);
+                if (ret)
+                        return WORK_ACT_TIMEOUT;
+        }
+        wk->probe_auth.synced = true;
        wk->probe_auth.tries++;
        if (wk->probe_auth.tries > IEEE80211_AUTH_MAX_TRIES) {
                printk(KERN_DEBUG "%s: direct probe to %pM timed out\n",
@@ -450,7 +459,8 @@ ieee80211_direct_probe(struct ieee80211_work *wk)
         * will not answer to direct packet in unassociated state.
         */
        ieee80211_send_probe_req(sdata, NULL, wk->probe_auth.ssid,
-                                 wk->probe_auth.ssid_len, NULL, 0, true);
+                                 wk->probe_auth.ssid_len, NULL, 0,
+                                 (u32) -1, true);
        wk->timeout = jiffies + IEEE80211_AUTH_TIMEOUT;
        run_again(local, wk->timeout);
@@ -465,6 +475,14 @@ ieee80211_authenticate(struct ieee80211_work *wk)
        struct ieee80211_sub_if_data *sdata = wk->sdata;
        struct ieee80211_local *local = sdata->local;
+        if (!wk->probe_auth.synced) {
+                int ret = drv_tx_sync(local, sdata, wk->filter_ta,
+                                      IEEE80211_TX_SYNC_AUTH);
+                if (ret)
+                        return WORK_ACT_TIMEOUT;
+        }
+        wk->probe_auth.synced = true;
        wk->probe_auth.tries++;
        if (wk->probe_auth.tries > IEEE80211_AUTH_MAX_TRIES) {
                printk(KERN_DEBUG "%s: authentication with %pM"
@@ -498,6 +516,14 @@ ieee80211_associate(struct ieee80211_work *wk)
        struct ieee80211_sub_if_data *sdata = wk->sdata;
        struct ieee80211_local *local = sdata->local;
+        if (!wk->assoc.synced) {
+                int ret = drv_tx_sync(local, sdata, wk->filter_ta,
+                                      IEEE80211_TX_SYNC_ASSOC);
+                if (ret)
+                        return WORK_ACT_TIMEOUT;
+        }
+        wk->assoc.synced = true;
        wk->assoc.tries++;
        if (wk->assoc.tries > IEEE80211_ASSOC_MAX_TRIES) {
                printk(KERN_DEBUG "%s: association with %pM"
diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
index 2e7ccbb43ddb..2d8158acf6fa 100644
--- a/net/netfilter/nfnetlink_log.c
+++ b/net/netfilter/nfnetlink_log.c
@@ -33,7 +33,7 @@
 #include <net/netfilter/nf_log.h>
 #include <net/netfilter/nfnetlink_log.h>
-#include <asm/atomic.h>
+#include <linux/atomic.h>
 #ifdef CONFIG_BRIDGE_NETFILTER
 #include "../bridge/br_private.h"
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index 49132bddd73e..00bd475eab4b 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -31,7 +31,7 @@
 #include <net/sock.h>
 #include <net/netfilter/nf_queue.h>
-#include <asm/atomic.h>
+#include <linux/atomic.h>
 #ifdef CONFIG_BRIDGE_NETFILTER
 #include "../bridge/br_private.h"
diff --git a/net/netlabel/netlabel_cipso_v4.c b/net/netlabel/netlabel_cipso_v4.c
index bae5756b1626..dd53a36d89af 100644
--- a/net/netlabel/netlabel_cipso_v4.c
+++ b/net/netlabel/netlabel_cipso_v4.c
@@ -39,7 +39,7 @@
 #include <net/genetlink.h>
 #include <net/netlabel.h>
 #include <net/cipso_ipv4.h>
-#include <asm/atomic.h>
+#include <linux/atomic.h>
 #include "netlabel_user.h"
 #include "netlabel_cipso_v4.h"
diff --git a/net/netlabel/netlabel_domainhash.c b/net/netlabel/netlabel_domainhash.c
index de0d8e4cbfb6..2aa975e5452d 100644
--- a/net/netlabel/netlabel_domainhash.c
+++ b/net/netlabel/netlabel_domainhash.c
@@ -55,8 +55,7 @@ struct netlbl_domhsh_tbl {
 * should be okay */
 static DEFINE_SPINLOCK(netlbl_domhsh_lock);
 #define netlbl_domhsh_rcu_deref(p) \
-        rcu_dereference_check(p, rcu_read_lock_held() || \
+        rcu_dereference_check(p, lockdep_is_held(&netlbl_domhsh_lock))
-                                 lockdep_is_held(&netlbl_domhsh_lock))
 static struct netlbl_domhsh_tbl *netlbl_domhsh = NULL;
 static struct netlbl_dom_map *netlbl_domhsh_def = NULL;
diff --git a/net/netlabel/netlabel_kapi.c b/net/netlabel/netlabel_kapi.c
index 1b83e0009d8d..b528dd928d3c 100644
--- a/net/netlabel/netlabel_kapi.c
+++ b/net/netlabel/netlabel_kapi.c
@@ -39,7 +39,7 @@
 #include <net/netlabel.h>
 #include <net/cipso_ipv4.h>
 #include <asm/bug.h>
-#include <asm/atomic.h>
+#include <linux/atomic.h>
 #include "netlabel_domainhash.h"
 #include "netlabel_unlabeled.h"
diff --git a/net/netlabel/netlabel_mgmt.c b/net/netlabel/netlabel_mgmt.c
index 4f251b19fbcc..dff8a0809245 100644
--- a/net/netlabel/netlabel_mgmt.c
+++ b/net/netlabel/netlabel_mgmt.c
@@ -42,7 +42,7 @@
 #include <net/ipv6.h>
 #include <net/netlabel.h>
 #include <net/cipso_ipv4.h>
-#include <asm/atomic.h>
+#include <linux/atomic.h>
 #include "netlabel_domainhash.h"
 #include "netlabel_user.h"
diff --git a/net/netlabel/netlabel_mgmt.h b/net/netlabel/netlabel_mgmt.h
index 0a25838bcf45..8db37f4c10f7 100644
--- a/net/netlabel/netlabel_mgmt.h
+++ b/net/netlabel/netlabel_mgmt.h
@@ -32,7 +32,7 @@
 #define _NETLABEL_MGMT_H
 #include <net/netlabel.h>
-#include <asm/atomic.h>
+#include <linux/atomic.h>
 /*
 * The following NetLabel payloads are supported by the management interface.
diff --git a/net/netlabel/netlabel_unlabeled.c b/net/netlabel/netlabel_unlabeled.c
index 8efd061a0ae9..f1ecf848e3ac 100644
--- a/net/netlabel/netlabel_unlabeled.c
+++ b/net/netlabel/netlabel_unlabeled.c
@@ -52,7 +52,7 @@
 #include <net/net_namespace.h>
 #include <net/netlabel.h>
 #include <asm/bug.h>
-#include <asm/atomic.h>
+#include <linux/atomic.h>
 #include "netlabel_user.h"
 #include "netlabel_addrlist.h"
@@ -116,8 +116,7 @@ struct netlbl_unlhsh_walk_arg {
 * hash table should be okay */
 static DEFINE_SPINLOCK(netlbl_unlhsh_lock);
 #define netlbl_unlhsh_rcu_deref(p) \
-        rcu_dereference_check(p, rcu_read_lock_held() || \
+        rcu_dereference_check(p, lockdep_is_held(&netlbl_unlhsh_lock))
-                                 lockdep_is_held(&netlbl_unlhsh_lock))
 static struct netlbl_unlhsh_tbl *netlbl_unlhsh = NULL;
 static struct netlbl_unlhsh_iface *netlbl_unlhsh_def = NULL;
diff --git a/net/rds/page.c b/net/rds/page.c
index d8acdebe3c7c..b82d63e77b03 100644
--- a/net/rds/page.c
+++ b/net/rds/page.c
@@ -32,6 +32,7 @@
 */
 #include <linux/highmem.h>
 #include <linux/gfp.h>
+#include <linux/cpu.h>
 #include "rds.h"
diff --git a/net/socket.c b/net/socket.c
index 02dc82db3d23..26ed35c7751e 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -467,7 +467,7 @@ static struct socket *sock_alloc(void)
        struct inode *inode;
        struct socket *sock;
-        inode = new_inode(sock_mnt->mnt_sb);
+        inode = new_inode_pseudo(sock_mnt->mnt_sb);
        if (!inode)
                return NULL;
diff --git a/net/sunrpc/auth_gss/gss_krb5_mech.c b/net/sunrpc/auth_gss/gss_krb5_mech.c
index c3b75333b821..8c67890de427 100644
--- a/net/sunrpc/auth_gss/gss_krb5_mech.c
+++ b/net/sunrpc/auth_gss/gss_krb5_mech.c
@@ -744,6 +744,13 @@ static struct pf_desc gss_kerberos_pfs[] = {
        },
 };
+MODULE_ALIAS("rpc-auth-gss-krb5");
+MODULE_ALIAS("rpc-auth-gss-krb5i");
+MODULE_ALIAS("rpc-auth-gss-krb5p");
+MODULE_ALIAS("rpc-auth-gss-390003");
+MODULE_ALIAS("rpc-auth-gss-390004");
+MODULE_ALIAS("rpc-auth-gss-390005");
 static struct gss_api_mech gss_kerberos_mech = {
        .gm_name        = "krb5",
        .gm_owner       = THIS_MODULE,
diff --git a/net/sunrpc/auth_gss/gss_mech_switch.c b/net/sunrpc/auth_gss/gss_mech_switch.c
index e3c36a274412..ca8cad8251c7 100644
--- a/net/sunrpc/auth_gss/gss_mech_switch.c
+++ b/net/sunrpc/auth_gss/gss_mech_switch.c
@@ -141,7 +141,7 @@ gss_mech_get(struct gss_api_mech *gm)
 EXPORT_SYMBOL_GPL(gss_mech_get);
 struct gss_api_mech *
-gss_mech_get_by_name(const char *name)
+_gss_mech_get_by_name(const char *name)
 {
        struct gss_api_mech     *pos, *gm = NULL;
@@ -158,6 +158,17 @@ gss_mech_get_by_name(const char *name)
 }
+struct gss_api_mech * gss_mech_get_by_name(const char *name)
+{
+        struct gss_api_mech *gm = NULL;
+        gm = _gss_mech_get_by_name(name);
+        if (!gm) {
+                request_module("rpc-auth-gss-%s", name);
+                gm = _gss_mech_get_by_name(name);
+        }
+        return gm;
+}
 EXPORT_SYMBOL_GPL(gss_mech_get_by_name);
 struct gss_api_mech *
@@ -194,10 +205,9 @@ mech_supports_pseudoflavor(struct gss_api_mech *gm, u32 pseudoflavor)
        return 0;
 }
-struct gss_api_mech *
+struct gss_api_mech *_gss_mech_get_by_pseudoflavor(u32 pseudoflavor)
-gss_mech_get_by_pseudoflavor(u32 pseudoflavor)
 {
-        struct gss_api_mech *pos, *gm = NULL;
+        struct gss_api_mech *gm = NULL, *pos;
        spin_lock(&registered_mechs_lock);
        list_for_each_entry(pos, &registered_mechs, gm_list) {
@@ -213,6 +223,20 @@ gss_mech_get_by_pseudoflavor(u32 pseudoflavor)
        return gm;
 }
+struct gss_api_mech *
+gss_mech_get_by_pseudoflavor(u32 pseudoflavor)
+{
+        struct gss_api_mech *gm;
+        gm = _gss_mech_get_by_pseudoflavor(pseudoflavor);
+        if (!gm) {
+                request_module("rpc-auth-gss-%u", pseudoflavor);
+                gm = _gss_mech_get_by_pseudoflavor(pseudoflavor);
+        }
+        return gm;
+}
 EXPORT_SYMBOL_GPL(gss_mech_get_by_pseudoflavor);
 int gss_mech_list_pseudoflavors(rpc_authflavor_t *array_ptr)
diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
index ab86b7927f84..bd31208bbb61 100644
--- a/net/sunrpc/svc_xprt.c
+++ b/net/sunrpc/svc_xprt.c
@@ -902,12 +902,13 @@ void svc_delete_xprt(struct svc_xprt *xprt)
        if (!test_and_set_bit(XPT_DETACHED, &xprt->xpt_flags))
                list_del_init(&xprt->xpt_list);
        /*
-         * We used to delete the transport from whichever list
+         * The only time we're called while xpt_ready is still on a list
-         * it's sk_xprt.xpt_ready node was on, but we don't actually
+         * is while the list itself is about to be destroyed (in
-         * need to.  This is because the only time we're called
+         * svc_destroy).  BUT svc_xprt_enqueue could still be attempting
-         * while still attached to a queue, the queue itself
+         * to add new entries to the sp_sockets list, so we can't leave
-         * is about to be destroyed (in svc_destroy).
+         * a freed xprt on it.
         */
+        list_del_init(&xprt->xpt_ready);
        if (test_bit(XPT_TEMP, &xprt->xpt_flags))
                serv->sv_tmpcnt--;
        spin_unlock_bh(&serv->sv_lock);
diff --git a/net/sunrpc/svcauth_unix.c b/net/sunrpc/svcauth_unix.c
index c8e10216c113..ce136323da8b 100644
--- a/net/sunrpc/svcauth_unix.c
+++ b/net/sunrpc/svcauth_unix.c
@@ -30,12 +30,10 @@
 struct unix_domain {
        struct auth_domain      h;
-#ifdef CONFIG_NFSD_DEPRECATED
-        int     addr_changes;
-#endif /* CONFIG_NFSD_DEPRECATED */
        /* other stuff later */
 };
+extern struct auth_ops svcauth_null;
 extern struct auth_ops svcauth_unix;
 static void svcauth_unix_domain_release(struct auth_domain *dom)
@@ -74,9 +72,6 @@ struct auth_domain *unix_domain_find(char *name)
                        return NULL;
                }
                new->h.flavour = &svcauth_unix;
-#ifdef CONFIG_NFSD_DEPRECATED
-                new->addr_changes = 0;
-#endif /* CONFIG_NFSD_DEPRECATED */
                rv = auth_domain_lookup(name, &new->h);
        }
 }
@@ -95,9 +90,6 @@ struct ip_map {
        char                    m_class[8]; /* e.g. "nfsd" */
        struct in6_addr         m_addr;
        struct unix_domain      *m_client;
-#ifdef CONFIG_NFSD_DEPRECATED
-        int                     m_add_change;
-#endif /* CONFIG_NFSD_DEPRECATED */
 };
 static void ip_map_put(struct kref *kref)
@@ -151,9 +143,6 @@ static void update(struct cache_head *cnew, struct cache_head *citem)
        kref_get(&item->m_client->h.ref);
        new->m_client = item->m_client;
-#ifdef CONFIG_NFSD_DEPRECATED
-        new->m_add_change = item->m_add_change;
-#endif /* CONFIG_NFSD_DEPRECATED */
 }
 static struct cache_head *ip_map_alloc(void)
 {
@@ -338,16 +327,6 @@ static int __ip_map_update(struct cache_detail *cd, struct ip_map *ipm,
        ip.h.flags = 0;
        if (!udom)
                set_bit(CACHE_NEGATIVE, &ip.h.flags);
-#ifdef CONFIG_NFSD_DEPRECATED
-        else {
-                ip.m_add_change = udom->addr_changes;
-                /* if this is from the legacy set_client system call,
-                 * we need m_add_change to be one higher
-                 */
-                if (expiry == NEVER)
-                        ip.m_add_change++;
-        }
-#endif /* CONFIG_NFSD_DEPRECATED */
        ip.h.expiry_time = expiry;
        ch = sunrpc_cache_update(cd, &ip.h, &ipm->h,
                                 hash_str(ipm->m_class, IP_HASHBITS) ^
@@ -367,62 +346,6 @@ static inline int ip_map_update(struct net *net, struct ip_map *ipm,
        return __ip_map_update(sn->ip_map_cache, ipm, udom, expiry);
 }
-#ifdef CONFIG_NFSD_DEPRECATED
-int auth_unix_add_addr(struct net *net, struct in6_addr *addr, struct auth_domain *dom)
-{
-        struct unix_domain *udom;
-        struct ip_map *ipmp;
-        if (dom->flavour != &svcauth_unix)
-                return -EINVAL;
-        udom = container_of(dom, struct unix_domain, h);
-        ipmp = ip_map_lookup(net, "nfsd", addr);
-        if (ipmp)
-                return ip_map_update(net, ipmp, udom, NEVER);
-        else
-                return -ENOMEM;
-}
-EXPORT_SYMBOL_GPL(auth_unix_add_addr);
-int auth_unix_forget_old(struct auth_domain *dom)
-{
-        struct unix_domain *udom;
-        if (dom->flavour != &svcauth_unix)
-                return -EINVAL;
-        udom = container_of(dom, struct unix_domain, h);
-        udom->addr_changes++;
-        return 0;
-}
-EXPORT_SYMBOL_GPL(auth_unix_forget_old);
-struct auth_domain *auth_unix_lookup(struct net *net, struct in6_addr *addr)
-{
-        struct ip_map *ipm;
-        struct auth_domain *rv;
-        struct sunrpc_net *sn;
-        sn = net_generic(net, sunrpc_net_id);
-        ipm = ip_map_lookup(net, "nfsd", addr);
-        if (!ipm)
-                return NULL;
-        if (cache_check(sn->ip_map_cache, &ipm->h, NULL))
-                return NULL;
-        if ((ipm->m_client->addr_changes - ipm->m_add_change) >0) {
-                sunrpc_invalidate(&ipm->h, sn->ip_map_cache);
-                rv = NULL;
-        } else {
-                rv = &ipm->m_client->h;
-                kref_get(&rv->ref);
-        }
-        cache_put(&ipm->h, sn->ip_map_cache);
-        return rv;
-}
-EXPORT_SYMBOL_GPL(auth_unix_lookup);
-#endif /* CONFIG_NFSD_DEPRECATED */
 void svcauth_unix_purge(void)
 {
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index af04f779ce9f..f2cb5b881dea 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -51,6 +51,8 @@
 #include <linux/sunrpc/stats.h>
 #include <linux/sunrpc/xprt.h>
+#include "sunrpc.h"
 #define RPCDBG_FACILITY RPCDBG_SVCXPRT
diff --git a/net/sunrpc/xprtrdma/xprt_rdma.h b/net/sunrpc/xprtrdma/xprt_rdma.h
index cae761a8536c..ddf05288d9f1 100644
--- a/net/sunrpc/xprtrdma/xprt_rdma.h
+++ b/net/sunrpc/xprtrdma/xprt_rdma.h
@@ -42,7 +42,7 @@
 #include <linux/wait.h>                 /* wait_queue_head_t, etc */
 #include <linux/spinlock.h>             /* spinlock_t, etc */
-#include <asm/atomic.h>                 /* atomic_t, etc */
+#include <linux/atomic.h>                       /* atomic_t, etc */
 #include <rdma/rdma_cm.h>               /* RDMA connection api */
 #include <rdma/ib_verbs.h>              /* RDMA verbs api */
diff --git a/net/tipc/core.h b/net/tipc/core.h
index d234a98a460a..2761af36d141 100644
--- a/net/tipc/core.h
+++ b/net/tipc/core.h
@@ -47,7 +47,7 @@
 #include <linux/string.h>
 #include <asm/uaccess.h>
 #include <linux/interrupt.h>
-#include <asm/atomic.h>
+#include <linux/atomic.h>
 #include <asm/hardirq.h>
 #include <linux/netdevice.h>
 #include <linux/in.h>
diff --git a/net/wireless/core.c b/net/wireless/core.c
index 880dbe2e6f94..645437cfc464 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -488,6 +488,10 @@ int wiphy_register(struct wiphy *wiphy)
        int i;
        u16 ifmodes = wiphy->interface_modes;
+        if (WARN_ON((wiphy->wowlan.flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
+                    !(wiphy->wowlan.flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY)))
+                return -EINVAL;
        if (WARN_ON(wiphy->addresses && !wiphy->n_addresses))
                return -EINVAL;
@@ -918,7 +922,8 @@ static int cfg80211_netdev_notifier_call(struct notifier_block * nb,
                 * Configure power management to the driver here so that its
                 * correctly set also after interface type changes etc.
                 */
-                if (wdev->iftype == NL80211_IFTYPE_STATION &&
+                if ((wdev->iftype == NL80211_IFTYPE_STATION ||
+                     wdev->iftype == NL80211_IFTYPE_P2P_CLIENT) &&
                    rdev->ops->set_power_mgmt)
                        if (rdev->ops->set_power_mgmt(wdev->wiphy, dev,
                                                      wdev->ps,
diff --git a/net/wireless/core.h b/net/wireless/core.h
index a570ff9214ec..8672e028022f 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -447,6 +447,10 @@ int cfg80211_set_freq(struct cfg80211_registered_device *rdev,
 u16 cfg80211_calculate_bitrate(struct rate_info *rate);
+int ieee80211_get_ratemask(struct ieee80211_supported_band *sband,
+                           const u8 *rates, unsigned int n_rates,
+                           u32 *mask);
 int cfg80211_validate_beacon_int(struct cfg80211_registered_device *rdev,
                                 u32 beacon_int);
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 6a82c898f831..28d2aa109bee 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -177,6 +177,7 @@ static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
        [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 },
        [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
        [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
+        [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
 };
 /* policy for the key attributes */
@@ -205,6 +206,10 @@ nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
        [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
        [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
        [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
+        [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
+        [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
+        [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
+        [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
 };
 /* policy for GTK rekey offload attributes */
@@ -692,8 +697,12 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
                    dev->wiphy.coverage_class);
        NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
                   dev->wiphy.max_scan_ssids);
+        NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
+                   dev->wiphy.max_sched_scan_ssids);
        NLA_PUT_U16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
                    dev->wiphy.max_scan_ie_len);
+        NLA_PUT_U16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
+                    dev->wiphy.max_sched_scan_ie_len);
        if (dev->wiphy.flags & WIPHY_FLAG_IBSS_RSN)
                NLA_PUT_FLAG(msg, NL80211_ATTR_SUPPORT_IBSS_RSN);
@@ -929,6 +938,16 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
                        NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_DISCONNECT);
                if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_MAGIC_PKT)
                        NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT);
+                if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY)
+                        NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED);
+                if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE)
+                        NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE);
+                if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ)
+                        NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST);
+                if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_4WAY_HANDSHAKE)
+                        NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE);
+                if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_RFKILL_RELEASE)
+                        NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE);
                if (dev->wiphy.wowlan.n_patterns) {
                        struct nl80211_wowlan_pattern_support pat = {
                                .max_patterns = dev->wiphy.wowlan.n_patterns,
@@ -3306,7 +3325,6 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
        struct nlattr *attr;
        struct wiphy *wiphy;
        int err, tmp, n_ssids = 0, n_channels, i;
-        enum ieee80211_band band;
        size_t ie_len;
        if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
@@ -3326,6 +3344,7 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
                if (!n_channels)
                        return -EINVAL;
        } else {
+                enum ieee80211_band band;
                n_channels = 0;
                for (band = 0; band < IEEE80211_NUM_BANDS; band++)
@@ -3386,6 +3405,8 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
                        i++;
                }
        } else {
+                enum ieee80211_band band;
                /* all channels */
                for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
                        int j;
@@ -3432,6 +3453,30 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
                       request->ie_len);
        }
+        for (i = 0; i < IEEE80211_NUM_BANDS; i++)
+                if (wiphy->bands[i])
+                        request->rates[i] =
+                                (1 << wiphy->bands[i]->n_bitrates) - 1;
+        if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
+                nla_for_each_nested(attr,
+                                    info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
+                                    tmp) {
+                        enum ieee80211_band band = nla_type(attr);
+                        if (band < 0 || band > IEEE80211_NUM_BANDS) {
+                                err = -EINVAL;
+                                goto out_free;
+                        }
+                        err = ieee80211_get_ratemask(wiphy->bands[band],
+                                                     nla_data(attr),
+                                                     nla_len(attr),
+                                                     &request->rates[band]);
+                        if (err)
+                                goto out_free;
+                }
+        }
        request->dev = dev;
        request->wiphy = &rdev->wiphy;
@@ -3497,7 +3542,7 @@ static int nl80211_start_sched_scan(struct sk_buff *skb,
                                    tmp)
                        n_ssids++;
-        if (n_ssids > wiphy->max_scan_ssids)
+        if (n_ssids > wiphy->max_sched_scan_ssids)
                return -EINVAL;
        if (info->attrs[NL80211_ATTR_IE])
@@ -3505,7 +3550,7 @@ static int nl80211_start_sched_scan(struct sk_buff *skb,
        else
                ie_len = 0;
-        if (ie_len > wiphy->max_scan_ie_len)
+        if (ie_len > wiphy->max_sched_scan_ie_len)
                return -EINVAL;
        mutex_lock(&rdev->sched_scan_mtx);
@@ -4318,25 +4363,12 @@ static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
                        nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
                struct ieee80211_supported_band *sband =
                        wiphy->bands[ibss.channel->band];
-                int i, j;
+                int err;
-                if (n_rates == 0)
+                err = ieee80211_get_ratemask(sband, rates, n_rates,
-                        return -EINVAL;
+                                             &ibss.basic_rates);
+                if (err)
-                for (i = 0; i < n_rates; i++) {
+                        return err;
-                        int rate = (rates[i] & 0x7f) * 5;
-                        bool found = false;
-                        for (j = 0; j < sband->n_bitrates; j++) {
-                                if (sband->bitrates[j].bitrate == rate) {
-                                        found = true;
-                                        ibss.basic_rates |= BIT(j);
-                                        break;
-                                }
-                        }
-                        if (!found)
-                                return -EINVAL;
-                }
        }
        if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
@@ -5272,6 +5304,14 @@ static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
                        NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_DISCONNECT);
                if (rdev->wowlan->magic_pkt)
                        NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT);
+                if (rdev->wowlan->gtk_rekey_failure)
+                        NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE);
+                if (rdev->wowlan->eap_identity_req)
+                        NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST);
+                if (rdev->wowlan->four_way_handshake)
+                        NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE);
+                if (rdev->wowlan->rfkill_release)
+                        NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE);
                if (rdev->wowlan->n_patterns) {
                        struct nlattr *nl_pats, *nl_pat;
                        int i, pat_len;
@@ -5348,6 +5388,33 @@ static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
                new_triggers.magic_pkt = true;
        }
+        if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
+                return -EINVAL;
+        if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
+                if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
+                        return -EINVAL;
+                new_triggers.gtk_rekey_failure = true;
+        }
+        if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
+                if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
+                        return -EINVAL;
+                new_triggers.eap_identity_req = true;
+        }
+        if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
+                if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
+                        return -EINVAL;
+                new_triggers.four_way_handshake = true;
+        }
+        if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
+                if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
+                        return -EINVAL;
+                new_triggers.rfkill_release = true;
+        }
        if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
                struct nlattr *pat;
                int n_patterns = 0;
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index 1c4672e35144..2936cb809152 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -862,6 +862,10 @@ int cfg80211_wext_siwscan(struct net_device *dev,
                        creq->n_ssids = 0;
        }
+        for (i = 0; i < IEEE80211_NUM_BANDS; i++)
+                if (wiphy->bands[i])
+                        creq->rates[i] = (1 << wiphy->bands[i]->n_bitrates) - 1;
        rdev->scan_req = creq;
        err = rdev->ops->scan(wiphy, dev, creq);
        if (err) {
diff --git a/net/wireless/util.c b/net/wireless/util.c
index 4d7b83fbc32f..be75a3a0424e 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -1006,3 +1006,41 @@ int cfg80211_can_change_interface(struct cfg80211_registered_device *rdev,
        return -EBUSY;
 }
+int ieee80211_get_ratemask(struct ieee80211_supported_band *sband,
+                           const u8 *rates, unsigned int n_rates,
+                           u32 *mask)
+{
+        int i, j;
+        if (!sband)
+                return -EINVAL;
+        if (n_rates == 0 || n_rates > NL80211_MAX_SUPP_RATES)
+                return -EINVAL;
+        *mask = 0;
+        for (i = 0; i < n_rates; i++) {
+                int rate = (rates[i] & 0x7f) * 5;
+                bool found = false;
+                for (j = 0; j < sband->n_bitrates; j++) {
+                        if (sband->bitrates[j].bitrate == rate) {
+                                found = true;
+                                *mask |= BIT(j);
+                                break;
+                        }
+                }
+                if (!found)
+                        return -EINVAL;
+        }
+        /*
+         * mask must have at least one bit set here since we
+         * didn't accept a 0-length rates array nor allowed
+         * entries in the array that didn't exist
+         */
+        return 0;
+}