The following changes since commit 0f36b018b2e314d45af86449f1a97facb1fbe300:
  Linus Torvalds:
        Merge master.kernel.org:/.../sfrench/cifs-2.6

are found in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6.git 
upstream-jgarzik

Denis Vlasenko:
      WEP fields are incorrectly shown to be INSIDE snap in the doc

John W. Linville:
      ieee80211: add prototypes to avoid build warning

[EMAIL PROTECTED]:
      orinoco_cs: tweak Vcc debugging messages

Zhu Yi:
      ieee80211: Fix problem with not decrypting broadcast packets
      ieee80211: Log if netif_rx() drops the packet
      ieee80211: Fix iwlist scan can only show about 20 APs
      ieee80211: Add LEAP authentication type
      ieee80211: Fix A band min and max channel definitions
      ieee80211: add flags for all geo channels
      ieee80211: Add spectrum management information
      ieee80211: kmalloc+memset -> kzalloc cleanups
      ieee80211: TIM information element parsing
      ieee80211: Add TKIP crypt->build_iv

 drivers/net/wireless/orinoco_cs.c    |    4 +-
 include/net/ieee80211.h              |   10 +++++-
 include/net/ieee80211_crypt.h        |    3 +-
 net/ieee80211/ieee80211_crypt.c      |   11 +++----
 net/ieee80211/ieee80211_crypt_ccmp.c |    8 ++++-
 net/ieee80211/ieee80211_crypt_tkip.c |   56 +++++++++++++++++-----------------
 net/ieee80211/ieee80211_crypt_wep.c  |    5 ++-
 net/ieee80211/ieee80211_geo.c        |   39 +++++++++++++++++++++++-
 net/ieee80211/ieee80211_rx.c         |   36 ++++++++++++++++++----
 net/ieee80211/ieee80211_tx.c         |   30 ++++++++++--------
 net/ieee80211/ieee80211_wx.c         |   43 ++++++++++++++++++++++++--
 11 files changed, 176 insertions(+), 69 deletions(-)

diff --git a/drivers/net/wireless/orinoco_cs.c 
b/drivers/net/wireless/orinoco_cs.c
index b664708..3c128b6 100644
--- a/drivers/net/wireless/orinoco_cs.c
+++ b/drivers/net/wireless/orinoco_cs.c
@@ -261,13 +261,13 @@ orinoco_cs_config(dev_link_t *link)
                /* Note that the CIS values need to be rescaled */
                if (cfg->vcc.present & (1 << CISTPL_POWER_VNOM)) {
                        if (conf.Vcc != cfg->vcc.param[CISTPL_POWER_VNOM] / 
10000) {
-                               DEBUG(2, "orinoco_cs_config: Vcc mismatch 
(conf.Vcc = %d, CIS = %d)\n",  conf.Vcc, cfg->vcc.param[CISTPL_POWER_VNOM] / 
10000);
+                               DEBUG(2, "orinoco_cs_config: Vcc mismatch 
(conf.Vcc = %d, cfg CIS = %d)\n",  conf.Vcc, cfg->vcc.param[CISTPL_POWER_VNOM] 
/ 10000);
                                if (!ignore_cis_vcc)
                                        goto next_entry;
                        }
                } else if (dflt.vcc.present & (1 << CISTPL_POWER_VNOM)) {
                        if (conf.Vcc != dflt.vcc.param[CISTPL_POWER_VNOM] / 
10000) {
-                               DEBUG(2, "orinoco_cs_config: Vcc mismatch 
(conf.Vcc = %d, CIS = %d)\n",  conf.Vcc, dflt.vcc.param[CISTPL_POWER_VNOM] / 
10000);
+                               DEBUG(2, "orinoco_cs_config: Vcc mismatch 
(conf.Vcc = %d, dflt CIS = %d)\n",  conf.Vcc, dflt.vcc.param[CISTPL_POWER_VNOM] 
/ 10000);
                                if(!ignore_cis_vcc)
                                        goto next_entry;
                        }
diff --git a/include/net/ieee80211.h b/include/net/ieee80211.h
index df05f46..5673ccf 100644
--- a/include/net/ieee80211.h
+++ b/include/net/ieee80211.h
@@ -220,6 +220,7 @@ struct ieee80211_snap_hdr {
 /* Authentication algorithms */
 #define WLAN_AUTH_OPEN 0
 #define WLAN_AUTH_SHARED_KEY 1
+#define WLAN_AUTH_LEAP 2
 
 #define WLAN_AUTH_CHALLENGE_LEN 128
 
@@ -803,9 +804,9 @@ enum ieee80211_state {
 #define IEEE80211_24GHZ_MAX_CHANNEL 14
 #define IEEE80211_24GHZ_CHANNELS    14
 
-#define IEEE80211_52GHZ_MIN_CHANNEL 36
+#define IEEE80211_52GHZ_MIN_CHANNEL 34
 #define IEEE80211_52GHZ_MAX_CHANNEL 165
-#define IEEE80211_52GHZ_CHANNELS    32
+#define IEEE80211_52GHZ_CHANNELS    131
 
 enum {
        IEEE80211_CH_PASSIVE_ONLY = (1 << 0),
@@ -1105,6 +1106,11 @@ extern int ieee80211_is_valid_channel(st
 extern int ieee80211_channel_to_index(struct ieee80211_device *ieee,
                                      u8 channel);
 extern u8 ieee80211_freq_to_channel(struct ieee80211_device *ieee, u32 freq);
+extern u8 ieee80211_get_channel_flags(struct ieee80211_device *ieee,
+                                     u8 channel);
+extern const struct ieee80211_channel *ieee80211_get_channel(struct
+                                                            ieee80211_device
+                                                            *ieee, u8 channel);
 
 /* ieee80211_wx.c */
 extern int ieee80211_wx_get_scan(struct ieee80211_device *ieee,
diff --git a/include/net/ieee80211_crypt.h b/include/net/ieee80211_crypt.h
index cd82c3e..eb47641 100644
--- a/include/net/ieee80211_crypt.h
+++ b/include/net/ieee80211_crypt.h
@@ -47,7 +47,8 @@ struct ieee80211_crypto_ops {
        /* deinitialize crypto context and free allocated private data */
        void (*deinit) (void *priv);
 
-       int (*build_iv) (struct sk_buff * skb, int hdr_len, void *priv);
+       int (*build_iv) (struct sk_buff * skb, int hdr_len,
+                        u8 *key, int keylen, void *priv);
 
        /* encrypt/decrypt return < 0 on error or >= 0 on success. The return
         * value from decrypt_mpdu is passed as the keyidx value for
diff --git a/net/ieee80211/ieee80211_crypt.c b/net/ieee80211/ieee80211_crypt.c
index ecc9bb1..cb71d79 100644
--- a/net/ieee80211/ieee80211_crypt.c
+++ b/net/ieee80211/ieee80211_crypt.c
@@ -18,7 +18,6 @@
 #include <linux/string.h>
 #include <net/ieee80211.h>
 
-
 MODULE_AUTHOR("Jouni Malinen");
 MODULE_DESCRIPTION("HostAP crypto");
 MODULE_LICENSE("GPL");
@@ -33,11 +32,11 @@ static DEFINE_SPINLOCK(ieee80211_crypto_
 
 void ieee80211_crypt_deinit_entries(struct ieee80211_device *ieee, int force)
 {
-       struct ieee80211_crypt_data *entry, *next;
+       struct ieee80211_crypt_data *entry, *next;
        unsigned long flags;
 
        spin_lock_irqsave(&ieee->lock, flags);
-       list_for_each_entry_safe(entry, next, &ieee->crypt_deinit_list, list) {
+       list_for_each_entry_safe(entry, next, &ieee->crypt_deinit_list, list) {
                if (atomic_read(&entry->refcnt) != 0 && !force)
                        continue;
 
@@ -141,9 +140,9 @@ int ieee80211_unregister_crypto_ops(stru
        spin_unlock_irqrestore(&ieee80211_crypto_lock, flags);
        return -EINVAL;
 
- found:
+      found:
        printk(KERN_DEBUG "ieee80211_crypt: unregistered algorithm "
-                         "'%s'\n", ops->name);
+              "'%s'\n", ops->name);
        list_del(&alg->list);
        spin_unlock_irqrestore(&ieee80211_crypto_lock, flags);
        kfree(alg);
@@ -163,7 +162,7 @@ struct ieee80211_crypto_ops *ieee80211_g
        spin_unlock_irqrestore(&ieee80211_crypto_lock, flags);
        return NULL;
 
- found:
+      found:
        spin_unlock_irqrestore(&ieee80211_crypto_lock, flags);
        return alg->ops;
 }
diff --git a/net/ieee80211/ieee80211_crypt_ccmp.c 
b/net/ieee80211/ieee80211_crypt_ccmp.c
index 4702217..097bcea 100644
--- a/net/ieee80211/ieee80211_crypt_ccmp.c
+++ b/net/ieee80211/ieee80211_crypt_ccmp.c
@@ -190,7 +190,8 @@ static void ccmp_init_blocks(struct cryp
        ieee80211_ccmp_aes_encrypt(tfm, b0, s0);
 }
 
-static int ieee80211_ccmp_hdr(struct sk_buff *skb, int hdr_len, void *priv)
+static int ieee80211_ccmp_hdr(struct sk_buff *skb, int hdr_len,
+                             u8 *aeskey, int keylen, void *priv)
 {
        struct ieee80211_ccmp_data *key = priv;
        int i;
@@ -199,6 +200,9 @@ static int ieee80211_ccmp_hdr(struct sk_
        if (skb_headroom(skb) < CCMP_HDR_LEN || skb->len < hdr_len)
                return -1;
 
+       if (aeskey != NULL && keylen >= CCMP_TK_LEN)
+               memcpy(aeskey, key->key, CCMP_TK_LEN);
+
        pos = skb_push(skb, CCMP_HDR_LEN);
        memmove(pos, pos + CCMP_HDR_LEN, hdr_len);
        pos += hdr_len;
@@ -238,7 +242,7 @@ static int ieee80211_ccmp_encrypt(struct
                return -1;
 
        data_len = skb->len - hdr_len;
-       len = ieee80211_ccmp_hdr(skb, hdr_len, priv);
+       len = ieee80211_ccmp_hdr(skb, hdr_len, NULL, 0, priv);
        if (len < 0)
                return -1;
 
diff --git a/net/ieee80211/ieee80211_crypt_tkip.c 
b/net/ieee80211/ieee80211_crypt_tkip.c
index e098832..93def94 100644
--- a/net/ieee80211/ieee80211_crypt_tkip.c
+++ b/net/ieee80211/ieee80211_crypt_tkip.c
@@ -80,10 +80,9 @@ static void *ieee80211_tkip_init(int key
 {
        struct ieee80211_tkip_data *priv;
 
-       priv = kmalloc(sizeof(*priv), GFP_ATOMIC);
+       priv = kzalloc(sizeof(*priv), GFP_ATOMIC);
        if (priv == NULL)
                goto fail;
-       memset(priv, 0, sizeof(*priv));
 
        priv->key_idx = key_idx;
 
@@ -271,34 +270,33 @@ static void tkip_mixing_phase2(u8 * WEPS
 #endif
 }
 
-static u8 *ieee80211_tkip_hdr(struct sk_buff *skb, int hdr_len, void *priv)
+static int ieee80211_tkip_hdr(struct sk_buff *skb, int hdr_len,
+                             u8 * rc4key, int keylen, void *priv)
 {
        struct ieee80211_tkip_data *tkey = priv;
        int len;
-       u8 *rc4key, *pos, *icv;
+       u8 *pos;
        struct ieee80211_hdr_4addr *hdr;
-       u32 crc;
 
        hdr = (struct ieee80211_hdr_4addr *)skb->data;
 
        if (skb_headroom(skb) < 8 || skb->len < hdr_len)
-               return NULL;
+               return -1;
+
+       if (rc4key == NULL || keylen < 16)
+               return -1;
 
        if (!tkey->tx_phase1_done) {
                tkip_mixing_phase1(tkey->tx_ttak, tkey->key, hdr->addr2,
                                   tkey->tx_iv32);
                tkey->tx_phase1_done = 1;
        }
-       rc4key = kmalloc(16, GFP_ATOMIC);
-       if (!rc4key)
-               return NULL;
        tkip_mixing_phase2(rc4key, tkey->key, tkey->tx_ttak, tkey->tx_iv16);
 
        len = skb->len - hdr_len;
        pos = skb_push(skb, 8);
        memmove(pos, pos + 8, hdr_len);
        pos += hdr_len;
-       icv = skb_put(skb, 4);
 
        *pos++ = *rc4key;
        *pos++ = *(rc4key + 1);
@@ -309,28 +307,28 @@ static u8 *ieee80211_tkip_hdr(struct sk_
        *pos++ = (tkey->tx_iv32 >> 16) & 0xff;
        *pos++ = (tkey->tx_iv32 >> 24) & 0xff;
 
-       crc = ~crc32_le(~0, pos, len);
-       icv[0] = crc;
-       icv[1] = crc >> 8;
-       icv[2] = crc >> 16;
-       icv[3] = crc >> 24;
+       tkey->tx_iv16++;
+       if (tkey->tx_iv16 == 0) {
+               tkey->tx_phase1_done = 0;
+               tkey->tx_iv32++;
+       }
 
-       return rc4key;
+       return 8;
 }
 
 static int ieee80211_tkip_encrypt(struct sk_buff *skb, int hdr_len, void *priv)
 {
        struct ieee80211_tkip_data *tkey = priv;
        int len;
-       const u8 *rc4key;
-       u8 *pos;
+       u8 rc4key[16], *pos, *icv;
+       u32 crc;
        struct scatterlist sg;
 
        if (tkey->flags & IEEE80211_CRYPTO_TKIP_COUNTERMEASURES) {
                if (net_ratelimit()) {
                        struct ieee80211_hdr_4addr *hdr =
                            (struct ieee80211_hdr_4addr *)skb->data;
-                       printk(KERN_DEBUG "TKIP countermeasures: dropped "
+                       printk(KERN_DEBUG ": TKIP countermeasures: dropped "
                               "TX packet to " MAC_FMT "\n",
                               MAC_ARG(hdr->addr1));
                }
@@ -343,22 +341,23 @@ static int ieee80211_tkip_encrypt(struct
        len = skb->len - hdr_len;
        pos = skb->data + hdr_len;
 
-       rc4key = ieee80211_tkip_hdr(skb, hdr_len, priv);
-       if (!rc4key)
+       if ((ieee80211_tkip_hdr(skb, hdr_len, rc4key, 16, priv)) < 0)
                return -1;
 
+       icv = skb_put(skb, 4);
+
+       crc = ~crc32_le(~0, pos, len);
+       icv[0] = crc;
+       icv[1] = crc >> 8;
+       icv[2] = crc >> 16;
+       icv[3] = crc >> 24;
+
        crypto_cipher_setkey(tkey->tfm_arc4, rc4key, 16);
        sg.page = virt_to_page(pos);
        sg.offset = offset_in_page(pos);
        sg.length = len + 4;
        crypto_cipher_encrypt(tkey->tfm_arc4, &sg, &sg, len + 4);
 
-       tkey->tx_iv16++;
-       if (tkey->tx_iv16 == 0) {
-               tkey->tx_phase1_done = 0;
-               tkey->tx_iv32++;
-       }
-
        return 0;
 }
 
@@ -379,7 +378,7 @@ static int ieee80211_tkip_decrypt(struct
 
        if (tkey->flags & IEEE80211_CRYPTO_TKIP_COUNTERMEASURES) {
                if (net_ratelimit()) {
-                       printk(KERN_DEBUG "TKIP countermeasures: dropped "
+                       printk(KERN_DEBUG ": TKIP countermeasures: dropped "
                               "received packet from " MAC_FMT "\n",
                               MAC_ARG(hdr->addr2));
                }
@@ -695,6 +694,7 @@ static struct ieee80211_crypto_ops ieee8
        .name = "TKIP",
        .init = ieee80211_tkip_init,
        .deinit = ieee80211_tkip_deinit,
+       .build_iv = ieee80211_tkip_hdr,
        .encrypt_mpdu = ieee80211_tkip_encrypt,
        .decrypt_mpdu = ieee80211_tkip_decrypt,
        .encrypt_msdu = ieee80211_michael_mic_add,
diff --git a/net/ieee80211/ieee80211_crypt_wep.c 
b/net/ieee80211/ieee80211_crypt_wep.c
index f8dca31..649e581 100644
--- a/net/ieee80211/ieee80211_crypt_wep.c
+++ b/net/ieee80211/ieee80211_crypt_wep.c
@@ -76,7 +76,8 @@ static void prism2_wep_deinit(void *priv
 }
 
 /* Add WEP IV/key info to a frame that has at least 4 bytes of headroom */
-static int prism2_wep_build_iv(struct sk_buff *skb, int hdr_len, void *priv)
+static int prism2_wep_build_iv(struct sk_buff *skb, int hdr_len,
+                              u8 *key, int keylen, void *priv)
 {
        struct prism2_wep_data *wep = priv;
        u32 klen, len;
@@ -131,7 +132,7 @@ static int prism2_wep_encrypt(struct sk_
                return -1;
        
        /* add the IV to the frame */
-       if (prism2_wep_build_iv(skb, hdr_len, priv))
+       if (prism2_wep_build_iv(skb, hdr_len, NULL, 0, priv))
                return -1;
        
        /* Copy the IV into the first 3 bytes of the key */
diff --git a/net/ieee80211/ieee80211_geo.c b/net/ieee80211/ieee80211_geo.c
index 610cc5c..3027153 100644
--- a/net/ieee80211/ieee80211_geo.c
+++ b/net/ieee80211/ieee80211_geo.c
@@ -58,13 +58,15 @@ int ieee80211_is_valid_channel(struct ie
                         * this is a B only channel, we don't see it
                         * as valid. */
                        if ((ieee->geo.bg[i].channel == channel) &&
+                           !(ieee->geo.bg[i].flags & IEEE80211_CH_INVALID) &&
                            (!(ieee->mode & IEEE_G) ||
                             !(ieee->geo.bg[i].flags & IEEE80211_CH_B_ONLY)))
                                return IEEE80211_24GHZ_BAND;
 
        if (ieee->freq_band & IEEE80211_52GHZ_BAND)
                for (i = 0; i < ieee->geo.a_channels; i++)
-                       if (ieee->geo.a[i].channel == channel)
+                       if ((ieee->geo.a[i].channel == channel) &&
+                           !(ieee->geo.a[i].flags & IEEE80211_CH_INVALID))
                                return IEEE80211_52GHZ_BAND;
 
        return 0;
@@ -133,6 +135,41 @@ const struct ieee80211_geo *ieee80211_ge
        return &ieee->geo;
 }
 
+u8 ieee80211_get_channel_flags(struct ieee80211_device * ieee, u8 channel)
+{
+       int index = ieee80211_channel_to_index(ieee, channel);
+
+       if (index == -1)
+               return IEEE80211_CH_INVALID;
+
+       if (channel <= IEEE80211_24GHZ_CHANNELS)
+               return ieee->geo.bg[index].flags;
+
+       return ieee->geo.a[index].flags;
+}
+
+static const struct ieee80211_channel bad_channel = {
+       .channel = 0,
+       .flags = IEEE80211_CH_INVALID,
+       .max_power = 0,
+};
+
+const struct ieee80211_channel *ieee80211_get_channel(struct ieee80211_device
+                                                     *ieee, u8 channel)
+{
+       int index = ieee80211_channel_to_index(ieee, channel);
+
+       if (index == -1)
+               return &bad_channel;
+
+       if (channel <= IEEE80211_24GHZ_CHANNELS)
+               return &ieee->geo.bg[index];
+
+       return &ieee->geo.a[index];
+}
+
+EXPORT_SYMBOL(ieee80211_get_channel);
+EXPORT_SYMBOL(ieee80211_get_channel_flags);
 EXPORT_SYMBOL(ieee80211_is_valid_channel);
 EXPORT_SYMBOL(ieee80211_freq_to_channel);
 EXPORT_SYMBOL(ieee80211_channel_to_index);
diff --git a/net/ieee80211/ieee80211_rx.c b/net/ieee80211/ieee80211_rx.c
index 7a12180..de402b7 100644
--- a/net/ieee80211/ieee80211_rx.c
+++ b/net/ieee80211/ieee80211_rx.c
@@ -350,6 +350,7 @@ int ieee80211_rx(struct ieee80211_device
        u8 src[ETH_ALEN];
        struct ieee80211_crypt_data *crypt = NULL;
        int keyidx = 0;
+       int can_be_decrypted = 0;
 
        hdr = (struct ieee80211_hdr_4addr *)skb->data;
        stats = &ieee->stats;
@@ -410,12 +411,23 @@ int ieee80211_rx(struct ieee80211_device
                return 1;
        }
 
-       if (is_multicast_ether_addr(hdr->addr1)
-           ? ieee->host_mc_decrypt : ieee->host_decrypt) {
+       can_be_decrypted = (is_multicast_ether_addr(hdr->addr1) ||
+                           is_broadcast_ether_addr(hdr->addr2)) ?
+           ieee->host_mc_decrypt : ieee->host_decrypt;
+
+       if (can_be_decrypted) {
                int idx = 0;
-               if (skb->len >= hdrlen + 3)
+               if (skb->len >= hdrlen + 3) {
+                       /* Top two-bits of byte 3 are the key index */
                        idx = skb->data[hdrlen + 3] >> 6;
+               }
+
+               /* ieee->crypt[] is WEP_KEY (4) in length.  Given that idx
+                * is only allowed 2-bits of storage, no value of idx can
+                * be provided via above code that would result in idx
+                * being out of range */
                crypt = ieee->crypt[idx];
+
 #ifdef NOT_YET
                sta = NULL;
 
@@ -553,7 +565,7 @@ int ieee80211_rx(struct ieee80211_device
 
        /* skb: hdr + (possibly fragmented, possibly encrypted) payload */
 
-       if (ieee->host_decrypt && (fc & IEEE80211_FCTL_PROTECTED) &&
+       if ((fc & IEEE80211_FCTL_PROTECTED) && can_be_decrypted &&
            (keyidx = ieee80211_rx_frame_decrypt(ieee, skb, crypt)) < 0)
                goto rx_dropped;
 
@@ -617,7 +629,7 @@ int ieee80211_rx(struct ieee80211_device
 
        /* skb: hdr + (possible reassembled) full MSDU payload; possibly still
         * encrypted/authenticated */
-       if (ieee->host_decrypt && (fc & IEEE80211_FCTL_PROTECTED) &&
+       if ((fc & IEEE80211_FCTL_PROTECTED) && can_be_decrypted &&
            ieee80211_rx_frame_decrypt_msdu(ieee, skb, keyidx, crypt))
                goto rx_dropped;
 
@@ -742,7 +754,14 @@ int ieee80211_rx(struct ieee80211_device
                memset(skb->cb, 0, sizeof(skb->cb));
                skb->dev = dev;
                skb->ip_summed = CHECKSUM_NONE; /* 802.11 crc not sufficient */
-               netif_rx(skb);
+               if (netif_rx(skb) == NET_RX_DROP) {
+                       /* netif_rx always succeeds, but it might drop
+                        * the packet.  If it drops the packet, we log that
+                        * in our stats. */
+                       IEEE80211_DEBUG_DROP
+                           ("RX: netif_rx dropped the packet\n");
+                       stats->rx_dropped++;
+               }
        }
 
       rx_exit:
@@ -1028,7 +1047,9 @@ static int ieee80211_parse_info_param(st
                        break;
 
                case MFIE_TYPE_TIM:
-                       IEEE80211_DEBUG_MGMT("MFIE_TYPE_TIM: ignored\n");
+                       network->tim.tim_count = info_element->data[0];
+                       network->tim.tim_period = info_element->data[1];
+                       IEEE80211_DEBUG_MGMT("MFIE_TYPE_TIM: partially 
ignored\n");
                        break;
 
                case MFIE_TYPE_ERP_INFO:
@@ -1257,6 +1278,7 @@ static void update_network(struct ieee80
        dst->listen_interval = src->listen_interval;
        dst->atim_window = src->atim_window;
        dst->erp_value = src->erp_value;
+       dst->tim = src->tim;
 
        memcpy(dst->wpa_ie, src->wpa_ie, src->wpa_ie_len);
        dst->wpa_ie_len = src->wpa_ie_len;
diff --git a/net/ieee80211/ieee80211_tx.c b/net/ieee80211/ieee80211_tx.c
index 8fdd943..8b4332f 100644
--- a/net/ieee80211/ieee80211_tx.c
+++ b/net/ieee80211/ieee80211_tx.c
@@ -56,7 +56,18 @@ Desc. | ctrl | dura |  DA/RA  |   TA    
       `--------------------------------------------------|         |------'
 Total: 28 non-data bytes                                 `----.----'
                                                               |
-       .- 'Frame data' expands to <---------------------------'
+       .- 'Frame data' expands, if WEP enabled, to <----------'
+       |
+       V
+      ,-----------------------.
+Bytes |  4  |   0-2296  |  4  |
+      |-----|-----------|-----|
+Desc. | IV  | Encrypted | ICV |
+      |     | Packet    |     |
+      `-----|           |-----'
+            `-----.-----'
+                  |
+       .- 'Encrypted Packet' expands to
        |
        V
       ,---------------------------------------------------.
@@ -65,18 +76,7 @@ Bytes |  1   |  1   |    1    |    3    
 Desc. | SNAP | SNAP | Control |Eth Tunnel| Type | IP      |
       | DSAP | SSAP |         |          |      | Packet  |
       | 0xAA | 0xAA |0x03 (UI)|0x00-00-F8|      |         |
-      `-----------------------------------------|         |
-Total: 8 non-data bytes                         `----.----'
-                                                     |
-       .- 'IP Packet' expands, if WEP enabled, to <--'
-       |
-       V
-      ,-----------------------.
-Bytes |  4  |   0-2296  |  4  |
-      |-----|-----------|-----|
-Desc. | IV  | Encrypted | ICV |
-      |     | IP Packet |     |
-      `-----------------------'
+      `----------------------------------------------------
 Total: 8 non-data bytes
 
 802.3 Ethernet Data Frame
@@ -470,7 +470,9 @@ int ieee80211_xmit(struct sk_buff *skb, 
                        atomic_inc(&crypt->refcnt);
                        if (crypt->ops->build_iv)
                                crypt->ops->build_iv(skb_frag, hdr_len,
-                                                    crypt->priv);
+                                     ieee->sec.keys[ieee->sec.active_key],
+                                     ieee->sec.key_sizes[ieee->sec.active_key],
+                                     crypt->priv);
                        atomic_dec(&crypt->refcnt);
                }
 
diff --git a/net/ieee80211/ieee80211_wx.c b/net/ieee80211/ieee80211_wx.c
index 23e1630..9496918 100644
--- a/net/ieee80211/ieee80211_wx.c
+++ b/net/ieee80211/ieee80211_wx.c
@@ -149,9 +149,7 @@ static char *ipw2100_translate_scan(stru
                iwe.u.qual.updated |= IW_QUAL_QUAL_INVALID |
                    IW_QUAL_LEVEL_INVALID;
                iwe.u.qual.qual = 0;
-               iwe.u.qual.level = 0;
        } else {
-               iwe.u.qual.level = network->stats.rssi;
                if (ieee->perfect_rssi == ieee->worst_rssi)
                        iwe.u.qual.qual = 100;
                else
@@ -179,6 +177,13 @@ static char *ipw2100_translate_scan(stru
                iwe.u.qual.noise = network->stats.noise;
        }
 
+       if (!(network->stats.mask & IEEE80211_STATMASK_SIGNAL)) {
+               iwe.u.qual.updated |= IW_QUAL_LEVEL_INVALID;
+               iwe.u.qual.level = 0;
+       } else {
+               iwe.u.qual.level = network->stats.signal;
+       }
+
        start = iwe_stream_add_event(start, stop, &iwe, IW_EV_QUAL_LEN);
 
        iwe.cmd = IWEVCUSTOM;
@@ -229,18 +234,43 @@ static char *ipw2100_translate_scan(stru
        if (iwe.u.data.length)
                start = iwe_stream_add_point(start, stop, &iwe, custom);
 
+       /* Add spectrum management information */
+       iwe.cmd = -1;
+       p = custom;
+       p += snprintf(p, MAX_CUSTOM_LEN - (p - custom), " Channel flags: ");
+
+       if (ieee80211_get_channel_flags(ieee, network->channel) &
+           IEEE80211_CH_INVALID) {
+               iwe.cmd = IWEVCUSTOM;
+               p += snprintf(p, MAX_CUSTOM_LEN - (p - custom), "INVALID ");
+       }
+
+       if (ieee80211_get_channel_flags(ieee, network->channel) &
+           IEEE80211_CH_RADAR_DETECT) {
+               iwe.cmd = IWEVCUSTOM;
+               p += snprintf(p, MAX_CUSTOM_LEN - (p - custom), "DFS ");
+       }
+
+       if (iwe.cmd == IWEVCUSTOM) {
+               iwe.u.data.length = p - custom;
+               start = iwe_stream_add_point(start, stop, &iwe, custom);
+       }
+
        return start;
 }
 
+#define SCAN_ITEM_SIZE 128
+
 int ieee80211_wx_get_scan(struct ieee80211_device *ieee,
                          struct iw_request_info *info,
                          union iwreq_data *wrqu, char *extra)
 {
        struct ieee80211_network *network;
        unsigned long flags;
+       int err = 0;
 
        char *ev = extra;
-       char *stop = ev + IW_SCAN_MAX_DATA;
+       char *stop = ev + wrqu->data.length;
        int i = 0;
 
        IEEE80211_DEBUG_WX("Getting scan\n");
@@ -249,6 +279,11 @@ int ieee80211_wx_get_scan(struct ieee802
 
        list_for_each_entry(network, &ieee->network_list, list) {
                i++;
+               if (stop - ev < SCAN_ITEM_SIZE) {
+                       err = -E2BIG;
+                       break;
+               }
+
                if (ieee->scan_age == 0 ||
                    time_after(network->last_scanned + ieee->scan_age, jiffies))
                        ev = ipw2100_translate_scan(ieee, ev, stop, network);
@@ -270,7 +305,7 @@ int ieee80211_wx_get_scan(struct ieee802
 
        IEEE80211_DEBUG_WX("exit: %d networks returned.\n", i);
 
-       return 0;
+       return err;
 }
 
 int ieee80211_wx_set_encode(struct ieee80211_device *ieee,
-- 
John W. Linville
[EMAIL PROTECTED]
-
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Reply via email to