struct sk_buff *ieee80211_build_probe_req(struct ieee80211_sub_if_data *sdata,
                                          u8 *dst,
                                          const u8 *ssid, size_t ssid_len,
-                                         const u8 *ie, size_t ie_len);
+                                         const u8 *ie, size_t ie_len,
+                                         bool directed);
 void ieee80211_send_probe_req(struct ieee80211_sub_if_data *sdata, u8 *dst,
                              const u8 *ssid, size_t ssid_len,
-                             const u8 *ie, size_t ie_len);
+                             const u8 *ie, size_t ie_len,
+                             bool directed);
 
 void ieee80211_sta_def_wmm_params(struct ieee80211_sub_if_data *sdata,
                                  const size_t supp_rates_len,
 
                ieee80211_send_nullfunc(sdata->local, sdata, 0);
        } else {
                ssid = ieee80211_bss_get_ie(ifmgd->associated, WLAN_EID_SSID);
-               ieee80211_send_probe_req(sdata, dst, ssid + 2, ssid[1], NULL, 0);
+               ieee80211_send_probe_req(sdata, dst, ssid + 2, ssid[1], NULL, 0,
+                                        true);
        }
 
        ifmgd->probe_send_count++;
 
        ssid = ieee80211_bss_get_ie(ifmgd->associated, WLAN_EID_SSID);
        skb = ieee80211_build_probe_req(sdata, ifmgd->associated->bssid,
-                                       ssid + 2, ssid[1], NULL, 0);
+                                       ssid + 2, ssid[1], NULL, 0, true);
 
        return skb;
 }
 
                        sdata, NULL,
                        local->scan_req->ssids[i].ssid,
                        local->scan_req->ssids[i].ssid_len,
-                       local->scan_req->ie, local->scan_req->ie_len);
+                       local->scan_req->ie, local->scan_req->ie_len,
+                       false);
 
        /*
         * After sending probe requests, wait for probe responses
 
 struct sk_buff *ieee80211_build_probe_req(struct ieee80211_sub_if_data *sdata,
                                          u8 *dst,
                                          const u8 *ssid, size_t ssid_len,
-                                         const u8 *ie, size_t ie_len)
+                                         const u8 *ie, size_t ie_len,
+                                         bool directed)
 {
        struct ieee80211_local *local = sdata->local;
        struct sk_buff *skb;
                return NULL;
        }
 
-       chan = ieee80211_frequency_to_channel(
-               local->hw.conf.channel->center_freq);
+       /*
+        * Do not send DS Channel parameter for directed probe requests
+        * in order to maximize the chance that we get a response.  Some
+        * badly-behaved APs don't respond when this parameter is included.
+        */
+       if (directed)
+               chan = 0;
+       else
+               chan = ieee80211_frequency_to_channel(
+                       local->hw.conf.channel->center_freq);
 
        buf_len = ieee80211_build_preq_ies(local, buf, ie, ie_len,
                                           local->hw.conf.channel->band,
 
 void ieee80211_send_probe_req(struct ieee80211_sub_if_data *sdata, u8 *dst,
                              const u8 *ssid, size_t ssid_len,
-                             const u8 *ie, size_t ie_len)
+                             const u8 *ie, size_t ie_len,
+                             bool directed)
 {
        struct sk_buff *skb;
 
-       skb = ieee80211_build_probe_req(sdata, dst, ssid, ssid_len, ie, ie_len);
+       skb = ieee80211_build_probe_req(sdata, dst, ssid, ssid_len, ie, ie_len,
+                                       directed);
        if (skb)
                ieee80211_tx_skb(sdata, skb);
 }
 
         * will not answer to direct packet in unassociated state.
         */
        ieee80211_send_probe_req(sdata, NULL, wk->probe_auth.ssid,
-                                wk->probe_auth.ssid_len, NULL, 0);
+                                wk->probe_auth.ssid_len, NULL, 0, true);
 
        wk->timeout = jiffies + IEEE80211_AUTH_TIMEOUT;
        run_again(local, wk->timeout);