Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next into for-davem

64 files changed, 523 insertions, 250 deletions

diff --git a/drivers/net/wireless/adm8211.c b/drivers/net/wireless/adm8211.c
index 689a71c1af71..154a4965be4f 100644
--- a/drivers/net/wireless/adm8211.c
+++ b/drivers/net/wireless/adm8211.c
@@ -1661,7 +1661,9 @@ static void adm8211_tx_raw(struct ieee80211_hw *dev, struct sk_buff *skb,
 }
 
 /* Put adm8211_tx_hdr on skb and transmit */
-static void adm8211_tx(struct ieee80211_hw *dev, struct sk_buff *skb)
+static void adm8211_tx(struct ieee80211_hw *dev,
+                       struct ieee80211_tx_control *control,
+                       struct sk_buff *skb)
 {
         struct adm8211_tx_hdr *txhdr;
         size_t payload_len, hdrlen;
diff --git a/drivers/net/wireless/at76c50x-usb.c b/drivers/net/wireless/at76c50x-usb.c
index 88b8d64c90f1..e361afed99ff 100644
--- a/drivers/net/wireless/at76c50x-usb.c
+++ b/drivers/net/wireless/at76c50x-usb.c
@@ -1726,7 +1726,9 @@ static void at76_mac80211_tx_callback(struct urb *urb)
         ieee80211_wake_queues(priv->hw);
 }
 
-static void at76_mac80211_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
+static void at76_mac80211_tx(struct ieee80211_hw *hw,
+                             struct ieee80211_tx_control *control,
+                             struct sk_buff *skb)
 {
         struct at76_priv *priv = hw->priv;
         struct at76_tx_buffer *tx_buffer = priv->bulk_out_buffer;
diff --git a/drivers/net/wireless/ath/ath5k/mac80211-ops.c b/drivers/net/wireless/ath/ath5k/mac80211-ops.c
index 384e67af73bc..df61a09adb6d 100644
--- a/drivers/net/wireless/ath/ath5k/mac80211-ops.c
+++ b/drivers/net/wireless/ath/ath5k/mac80211-ops.c
@@ -55,7 +55,8 @@
 \********************/
 
 static void
-ath5k_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
+ath5k_tx(struct ieee80211_hw *hw, struct ieee80211_tx_control *control,
+         struct sk_buff *skb)
 {
         struct ath5k_hw *ah = hw->priv;
         u16 qnum = skb_get_queue_mapping(skb);
diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
index b09285c36c4a..7373e4b92c92 100644
--- a/drivers/net/wireless/ath/ath9k/ath9k.h
+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
@@ -280,6 +280,7 @@ struct ath_tx_control {
         struct ath_txq *txq;
         struct ath_node *an;
         u8 paprd;
+        struct ieee80211_sta *sta;
 };
 
 #define ATH_TX_ERROR        0x01
diff --git a/drivers/net/wireless/ath/ath9k/htc.h b/drivers/net/wireless/ath/ath9k/htc.h
index 936e920fb88e..b30596fcf73a 100644
--- a/drivers/net/wireless/ath/ath9k/htc.h
+++ b/drivers/net/wireless/ath/ath9k/htc.h
@@ -542,6 +542,7 @@ void ath9k_htc_stop_ani(struct ath9k_htc_priv *priv);
 
 int ath9k_tx_init(struct ath9k_htc_priv *priv);
 int ath9k_htc_tx_start(struct ath9k_htc_priv *priv,
+                       struct ieee80211_sta *sta,
                        struct sk_buff *skb, u8 slot, bool is_cab);
 void ath9k_tx_cleanup(struct ath9k_htc_priv *priv);
 bool ath9k_htc_txq_setup(struct ath9k_htc_priv *priv, int subtype);
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_beacon.c b/drivers/net/wireless/ath/ath9k/htc_drv_beacon.c
index 77d541feb910..f42d2eb6af99 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_beacon.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_beacon.c
@@ -326,7 +326,7 @@ static void ath9k_htc_send_buffered(struct ath9k_htc_priv *priv,
                         goto next;
                 }
 
-                ret = ath9k_htc_tx_start(priv, skb, tx_slot, true);
+                ret = ath9k_htc_tx_start(priv, NULL, skb, tx_slot, true);
                 if (ret != 0) {
                         ath9k_htc_tx_clear_slot(priv, tx_slot);
                         dev_kfree_skb_any(skb);
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_main.c b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
index c785129692ff..c32f6e3ffb18 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_main.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
@@ -856,7 +856,9 @@ set_timer:
 /* mac80211 Callbacks */
 /**********************/
 
-static void ath9k_htc_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
+static void ath9k_htc_tx(struct ieee80211_hw *hw,
+                         struct ieee80211_tx_control *control,
+                         struct sk_buff *skb)
 {
         struct ieee80211_hdr *hdr;
         struct ath9k_htc_priv *priv = hw->priv;
@@ -883,7 +885,7 @@ static void ath9k_htc_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
                 goto fail_tx;
         }
 
-        ret = ath9k_htc_tx_start(priv, skb, slot, false);
+        ret = ath9k_htc_tx_start(priv, control->sta, skb, slot, false);
         if (ret != 0) {
                 ath_dbg(common, XMIT, "Tx failed\n");
                 goto clear_slot;
@@ -1331,6 +1333,34 @@ static int ath9k_htc_sta_remove(struct ieee80211_hw *hw,
         return ret;
 }
 
+static void ath9k_htc_sta_rc_update(struct ieee80211_hw *hw,
+                                    struct ieee80211_vif *vif,
+                                    struct ieee80211_sta *sta, u32 changed)
+{
+        struct ath9k_htc_priv *priv = hw->priv;
+        struct ath_common *common = ath9k_hw_common(priv->ah);
+        struct ath9k_htc_target_rate trate;
+
+        mutex_lock(&priv->mutex);
+        ath9k_htc_ps_wakeup(priv);
+
+        if (changed & IEEE80211_RC_SUPP_RATES_CHANGED) {
+                memset(&trate, 0, sizeof(struct ath9k_htc_target_rate));
+                ath9k_htc_setup_rate(priv, sta, &trate);
+                if (!ath9k_htc_send_rate_cmd(priv, &trate))
+                        ath_dbg(common, CONFIG,
+                                "Supported rates for sta: %pM updated, rate caps: 0x%X\n",
+                                sta->addr, be32_to_cpu(trate.capflags));
+                else
+                        ath_dbg(common, CONFIG,
+                                "Unable to update supported rates for sta: %pM\n",
+                                sta->addr);
+        }
+
+        ath9k_htc_ps_restore(priv);
+        mutex_unlock(&priv->mutex);
+}
+
 static int ath9k_htc_conf_tx(struct ieee80211_hw *hw,
                              struct ieee80211_vif *vif, u16 queue,
                              const struct ieee80211_tx_queue_params *params)
@@ -1758,6 +1788,7 @@ struct ieee80211_ops ath9k_htc_ops = {
         .sta_add            = ath9k_htc_sta_add,
         .sta_remove         = ath9k_htc_sta_remove,
         .conf_tx            = ath9k_htc_conf_tx,
+        .sta_rc_update      = ath9k_htc_sta_rc_update,
         .bss_info_changed   = ath9k_htc_bss_info_changed,
         .set_key            = ath9k_htc_set_key,
         .get_tsf            = ath9k_htc_get_tsf,
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
index 47e61d0da33b..06cdcb772d78 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
@@ -333,12 +333,12 @@ static void ath9k_htc_tx_data(struct ath9k_htc_priv *priv,
 }
 
 int ath9k_htc_tx_start(struct ath9k_htc_priv *priv,
+                       struct ieee80211_sta *sta,
                        struct sk_buff *skb,
                        u8 slot, bool is_cab)
 {
         struct ieee80211_hdr *hdr;
         struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
-        struct ieee80211_sta *sta = tx_info->control.sta;
         struct ieee80211_vif *vif = tx_info->control.vif;
         struct ath9k_htc_sta *ista;
         struct ath9k_htc_vif *avp = NULL;
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index a22df749b8db..8a2b04d5922f 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -696,7 +696,9 @@ mutex_unlock:
         return r;
 }
 
-static void ath9k_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
+static void ath9k_tx(struct ieee80211_hw *hw,
+                     struct ieee80211_tx_control *control,
+                     struct sk_buff *skb)
 {
         struct ath_softc *sc = hw->priv;
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
@@ -756,6 +758,7 @@ static void ath9k_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
 
         memset(&txctl, 0, sizeof(struct ath_tx_control));
         txctl.txq = sc->tx.txq_map[skb_get_queue_mapping(skb)];
+        txctl.sta = control->sta;
 
         ath_dbg(common, XMIT, "transmitting packet, skb: %p\n", skb);
 
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index 2c9da6b2ecb1..ef91f6cc2d79 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -1773,11 +1773,12 @@ static void ath_tx_send_normal(struct ath_softc *sc, struct ath_txq *txq,
         TX_STAT_INC(txq->axq_qnum, queued);
 }
 
-static void setup_frame_info(struct ieee80211_hw *hw, struct sk_buff *skb,
+static void setup_frame_info(struct ieee80211_hw *hw,
+                             struct ieee80211_sta *sta,
+                             struct sk_buff *skb,
                              int framelen)
 {
         struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
-        struct ieee80211_sta *sta = tx_info->control.sta;
         struct ieee80211_key_conf *hw_key = tx_info->control.hw_key;
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
         const struct ieee80211_rate *rate;
@@ -1935,7 +1936,7 @@ int ath_tx_start(struct ieee80211_hw *hw, struct sk_buff *skb,
 {
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-        struct ieee80211_sta *sta = info->control.sta;
+        struct ieee80211_sta *sta = txctl->sta;
         struct ieee80211_vif *vif = info->control.vif;
         struct ath_softc *sc = hw->priv;
         struct ath_txq *txq = txctl->txq;
@@ -1979,7 +1980,7 @@ int ath_tx_start(struct ieee80211_hw *hw, struct sk_buff *skb,
             !ieee80211_is_data(hdr->frame_control))
                 info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT;
 
-        setup_frame_info(hw, skb, frmlen);
+        setup_frame_info(hw, sta, skb, frmlen);
 
         /*
          * At this point, the vif, hw_key and sta pointers in the tx control
diff --git a/drivers/net/wireless/ath/carl9170/carl9170.h b/drivers/net/wireless/ath/carl9170/carl9170.h
index 376be11161c0..2aa4a59c72c8 100644
--- a/drivers/net/wireless/ath/carl9170/carl9170.h
+++ b/drivers/net/wireless/ath/carl9170/carl9170.h
@@ -425,6 +425,7 @@ struct ar9170 {
         bool rx_has_plcp;
         struct sk_buff *rx_failover;
         int rx_failover_missing;
+        u32 ampdu_ref;
 
         /* FIFO for collecting outstanding BlockAckRequest */
         struct list_head bar_list[__AR9170_NUM_TXQ];
@@ -577,7 +578,9 @@ void carl9170_rx(struct ar9170 *ar, void *buf, unsigned int len);
 void carl9170_handle_command_response(struct ar9170 *ar, void *buf, u32 len);
 
 /* TX */
-void carl9170_op_tx(struct ieee80211_hw *hw, struct sk_buff *skb);
+void carl9170_op_tx(struct ieee80211_hw *hw,
+                    struct ieee80211_tx_control *control,
+                    struct sk_buff *skb);
 void carl9170_tx_janitor(struct work_struct *work);
 void carl9170_tx_process_status(struct ar9170 *ar,
                                 const struct carl9170_rsp *cmd);
diff --git a/drivers/net/wireless/ath/carl9170/rx.c b/drivers/net/wireless/ath/carl9170/rx.c
index b813f43061f5..a0b723078547 100644
--- a/drivers/net/wireless/ath/carl9170/rx.c
+++ b/drivers/net/wireless/ath/carl9170/rx.c
@@ -624,7 +624,8 @@ static void carl9170_ba_check(struct ar9170 *ar, void *data, unsigned int len)
 #undef TID_CHECK
 }
 
-static bool carl9170_ampdu_check(struct ar9170 *ar, u8 *buf, u8 ms)
+static bool carl9170_ampdu_check(struct ar9170 *ar, u8 *buf, u8 ms,
+                                 struct ieee80211_rx_status *rx_status)
 {
         __le16 fc;
 
@@ -637,6 +638,9 @@ static bool carl9170_ampdu_check(struct ar9170 *ar, u8 *buf, u8 ms)
                 return true;
         }
 
+        rx_status->flag |= RX_FLAG_AMPDU_DETAILS | RX_FLAG_AMPDU_LAST_KNOWN;
+        rx_status->ampdu_reference = ar->ampdu_ref;
+
         /*
          * "802.11n - 7.4a.3 A-MPDU contents" describes in which contexts
          * certain frame types can be part of an aMPDU.
@@ -685,12 +689,15 @@ static void carl9170_handle_mpdu(struct ar9170 *ar, u8 *buf, int len)
         if (unlikely(len < sizeof(*mac)))
                 goto drop;
 
+        memset(&status, 0, sizeof(status));
+
         mpdu_len = len - sizeof(*mac);
 
         mac = (void *)(buf + mpdu_len);
         mac_status = mac->status;
         switch (mac_status & AR9170_RX_STATUS_MPDU) {
         case AR9170_RX_STATUS_MPDU_FIRST:
+                ar->ampdu_ref++;
                 /* Aggregated MPDUs start with an PLCP header */
                 if (likely(mpdu_len >= sizeof(struct ar9170_rx_head))) {
                         head = (void *) buf;
@@ -721,12 +728,13 @@ static void carl9170_handle_mpdu(struct ar9170 *ar, u8 *buf, int len)
                 break;
 
         case AR9170_RX_STATUS_MPDU_LAST:
+                status.flag |= RX_FLAG_AMPDU_IS_LAST;
+
                 /*
                  * The last frame of an A-MPDU has an extra tail
                  * which does contain the phy status of the whole
                  * aggregate.
                  */
-
                 if (likely(mpdu_len >= sizeof(struct ar9170_rx_phystatus))) {
                         mpdu_len -= sizeof(struct ar9170_rx_phystatus);
                         phy = (void *)(buf + mpdu_len);
@@ -774,11 +782,10 @@ static void carl9170_handle_mpdu(struct ar9170 *ar, u8 *buf, int len)
         if (unlikely(mpdu_len < (2 + 2 + ETH_ALEN + FCS_LEN)))
                 goto drop;
 
-        memset(&status, 0, sizeof(status));
         if (unlikely(carl9170_rx_mac_status(ar, head, mac, &status)))
                 goto drop;
 
-        if (!carl9170_ampdu_check(ar, buf, mac_status))
+        if (!carl9170_ampdu_check(ar, buf, mac_status, &status))
                 goto drop;
 
         if (phy)
diff --git a/drivers/net/wireless/ath/carl9170/tx.c b/drivers/net/wireless/ath/carl9170/tx.c
index 6a8681407a1d..84377cf580e0 100644
--- a/drivers/net/wireless/ath/carl9170/tx.c
+++ b/drivers/net/wireless/ath/carl9170/tx.c
@@ -867,14 +867,15 @@ static bool carl9170_tx_cts_check(struct ar9170 *ar,
         return false;
 }
 
-static int carl9170_tx_prepare(struct ar9170 *ar, struct sk_buff *skb)
+static int carl9170_tx_prepare(struct ar9170 *ar,
+                               struct ieee80211_sta *sta,
+                               struct sk_buff *skb)
 {
         struct ieee80211_hdr *hdr;
         struct _carl9170_tx_superframe *txc;
         struct carl9170_vif_info *cvif;
         struct ieee80211_tx_info *info;
         struct ieee80211_tx_rate *txrate;
-        struct ieee80211_sta *sta;
         struct carl9170_tx_info *arinfo;
         unsigned int hw_queue;
         int i;
@@ -910,8 +911,6 @@ static int carl9170_tx_prepare(struct ar9170 *ar, struct sk_buff *skb)
         else
                 cvif = NULL;
 
-        sta = info->control.sta;
-
         txc = (void *)skb_push(skb, sizeof(*txc));
         memset(txc, 0, sizeof(*txc));
 
@@ -1457,20 +1456,21 @@ err_unlock_rcu:
         return false;
 }
 
-void carl9170_op_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
+void carl9170_op_tx(struct ieee80211_hw *hw,
+                    struct ieee80211_tx_control *control,
+                    struct sk_buff *skb)
 {
         struct ar9170 *ar = hw->priv;
         struct ieee80211_tx_info *info;
-        struct ieee80211_sta *sta;
+        struct ieee80211_sta *sta = control->sta;
         bool run;
 
         if (unlikely(!IS_STARTED(ar)))
                 goto err_free;
 
         info = IEEE80211_SKB_CB(skb);
-        sta = info->control.sta;
 
-        if (unlikely(carl9170_tx_prepare(ar, skb)))
+        if (unlikely(carl9170_tx_prepare(ar, sta, skb)))
                 goto err_free;
 
         carl9170_tx_accounting(ar, skb);
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index d97a95b1addb..73730e94e0ac 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -3412,7 +3412,8 @@ static void b43_tx_work(struct work_struct *work)
 }
 
 static void b43_op_tx(struct ieee80211_hw *hw,
-                     struct sk_buff *skb)
+                      struct ieee80211_tx_control *control,
+                      struct sk_buff *skb)
 {
         struct b43_wl *wl = hw_to_b43_wl(hw);
 
diff --git a/drivers/net/wireless/b43legacy/main.c b/drivers/net/wireless/b43legacy/main.c
index 3ea1a85d38d1..291cdf654088 100644
--- a/drivers/net/wireless/b43legacy/main.c
+++ b/drivers/net/wireless/b43legacy/main.c
@@ -2492,6 +2492,7 @@ static void b43legacy_tx_work(struct work_struct *work)
 }
 
 static void b43legacy_op_tx(struct ieee80211_hw *hw,
+                            struct ieee80211_tx_control *control,
                             struct sk_buff *skb)
 {
         struct b43legacy_wl *wl = hw_to_b43legacy_wl(hw);
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
index 1c70defba6c3..513e172832e1 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
@@ -267,7 +267,9 @@ static void brcms_set_basic_rate(struct brcm_rateset *rs, u16 rate, bool is_br)
         }
 }
 
-static void brcms_ops_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
+static void brcms_ops_tx(struct ieee80211_hw *hw,
+                         struct ieee80211_tx_control *control,
+                         struct sk_buff *skb)
 {
         struct brcms_info *wl = hw->priv;
         struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
@@ -279,7 +281,7 @@ static void brcms_ops_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
                 goto done;
         }
         brcms_c_sendpkt_mac80211(wl->wlc, skb, hw);
-        tx_info->rate_driver_data[0] = tx_info->control.sta;
+        tx_info->rate_driver_data[0] = control->sta;
  done:
         spin_unlock_bh(&wl->lock);
 }
diff --git a/drivers/net/wireless/iwlegacy/3945-mac.c b/drivers/net/wireless/iwlegacy/3945-mac.c
index faec40467208..e252acb9c862 100644
--- a/drivers/net/wireless/iwlegacy/3945-mac.c
+++ b/drivers/net/wireless/iwlegacy/3945-mac.c
@@ -460,7 +460,9 @@ il3945_build_tx_cmd_basic(struct il_priv *il, struct il_device_cmd *cmd,
  * start C_TX command process
  */
 static int
-il3945_tx_skb(struct il_priv *il, struct sk_buff *skb)
+il3945_tx_skb(struct il_priv *il,
+              struct ieee80211_sta *sta,
+              struct sk_buff *skb)
 {
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
@@ -512,7 +514,7 @@ il3945_tx_skb(struct il_priv *il, struct sk_buff *skb)
         hdr_len = ieee80211_hdrlen(fc);
 
         /* Find idx into station table for destination station */
-        sta_id = il_sta_id_or_broadcast(il, info->control.sta);
+        sta_id = il_sta_id_or_broadcast(il, sta);
         if (sta_id == IL_INVALID_STATION) {
                 D_DROP("Dropping - INVALID STATION: %pM\n", hdr->addr1);
                 goto drop;
@@ -2859,7 +2861,9 @@ il3945_mac_stop(struct ieee80211_hw *hw)
 }
 
 static void
-il3945_mac_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
+il3945_mac_tx(struct ieee80211_hw *hw,
+               struct ieee80211_tx_control *control,
+               struct sk_buff *skb)
 {
         struct il_priv *il = hw->priv;
 
@@ -2868,7 +2872,7 @@ il3945_mac_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
         D_TX("dev->xmit(%d bytes) at rate 0x%02x\n", skb->len,
              ieee80211_get_tx_rate(hw, IEEE80211_SKB_CB(skb))->bitrate);
 
-        if (il3945_tx_skb(il, skb))
+        if (il3945_tx_skb(il, control->sta, skb))
                 dev_kfree_skb_any(skb);
 
         D_MAC80211("leave\n");
diff --git a/drivers/net/wireless/iwlegacy/4965-mac.c b/drivers/net/wireless/iwlegacy/4965-mac.c
index 34f61a0581a2..eac4dc8bc879 100644
--- a/drivers/net/wireless/iwlegacy/4965-mac.c
+++ b/drivers/net/wireless/iwlegacy/4965-mac.c
@@ -1526,8 +1526,11 @@ il4965_tx_cmd_build_basic(struct il_priv *il, struct sk_buff *skb,
 }
 
 static void
-il4965_tx_cmd_build_rate(struct il_priv *il, struct il_tx_cmd *tx_cmd,
-                         struct ieee80211_tx_info *info, __le16 fc)
+il4965_tx_cmd_build_rate(struct il_priv *il,
+                         struct il_tx_cmd *tx_cmd,
+                         struct ieee80211_tx_info *info,
+                         struct ieee80211_sta *sta,
+                         __le16 fc)
 {
         const u8 rts_retry_limit = 60;
         u32 rate_flags;
@@ -1561,9 +1564,7 @@ il4965_tx_cmd_build_rate(struct il_priv *il, struct il_tx_cmd *tx_cmd,
         rate_idx = info->control.rates[0].idx;
         if ((info->control.rates[0].flags & IEEE80211_TX_RC_MCS) || rate_idx < 0
             || rate_idx > RATE_COUNT_LEGACY)
-                rate_idx =
-                    rate_lowest_index(&il->bands[info->band],
-                                      info->control.sta);
+                rate_idx = rate_lowest_index(&il->bands[info->band], sta);
         /* For 5 GHZ band, remap mac80211 rate indices into driver indices */
         if (info->band == IEEE80211_BAND_5GHZ)
                 rate_idx += IL_FIRST_OFDM_RATE;
@@ -1630,11 +1631,12 @@ il4965_tx_cmd_build_hwcrypto(struct il_priv *il, struct ieee80211_tx_info *info,
  * start C_TX command process
  */
 int
-il4965_tx_skb(struct il_priv *il, struct sk_buff *skb)
+il4965_tx_skb(struct il_priv *il,
+              struct ieee80211_sta *sta,
+              struct sk_buff *skb)
 {
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-        struct ieee80211_sta *sta = info->control.sta;
         struct il_station_priv *sta_priv = NULL;
         struct il_tx_queue *txq;
         struct il_queue *q;
@@ -1680,7 +1682,7 @@ il4965_tx_skb(struct il_priv *il, struct sk_buff *skb)
                 sta_id = il->hw_params.bcast_id;
         else {
                 /* Find idx into station table for destination station */
-                sta_id = il_sta_id_or_broadcast(il, info->control.sta);
+                sta_id = il_sta_id_or_broadcast(il, sta);
 
                 if (sta_id == IL_INVALID_STATION) {
                         D_DROP("Dropping - INVALID STATION: %pM\n", hdr->addr1);
@@ -1786,7 +1788,7 @@ il4965_tx_skb(struct il_priv *il, struct sk_buff *skb)
         /* TODO need this for burst mode later on */
         il4965_tx_cmd_build_basic(il, skb, tx_cmd, info, hdr, sta_id);
 
-        il4965_tx_cmd_build_rate(il, tx_cmd, info, fc);
+        il4965_tx_cmd_build_rate(il, tx_cmd, info, sta, fc);
 
         il_update_stats(il, true, fc, len);
         /*
@@ -5828,7 +5830,9 @@ il4965_mac_stop(struct ieee80211_hw *hw)
 }
 
 void
-il4965_mac_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
+il4965_mac_tx(struct ieee80211_hw *hw,
+              struct ieee80211_tx_control *control,
+              struct sk_buff *skb)
 {
         struct il_priv *il = hw->priv;
 
@@ -5837,7 +5841,7 @@ il4965_mac_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
         D_TX("dev->xmit(%d bytes) at rate 0x%02x\n", skb->len,
              ieee80211_get_tx_rate(hw, IEEE80211_SKB_CB(skb))->bitrate);
 
-        if (il4965_tx_skb(il, skb))
+        if (il4965_tx_skb(il, control->sta, skb))
                 dev_kfree_skb_any(skb);
 
         D_MACDUMP("leave\n");
diff --git a/drivers/net/wireless/iwlegacy/4965.h b/drivers/net/wireless/iwlegacy/4965.h
index 1db677689cfe..2d092f328547 100644
--- a/drivers/net/wireless/iwlegacy/4965.h
+++ b/drivers/net/wireless/iwlegacy/4965.h
@@ -78,7 +78,9 @@ int il4965_hw_txq_attach_buf_to_tfd(struct il_priv *il, struct il_tx_queue *txq,
 int il4965_hw_tx_queue_init(struct il_priv *il, struct il_tx_queue *txq);
 void il4965_hwrate_to_tx_control(struct il_priv *il, u32 rate_n_flags,
                                  struct ieee80211_tx_info *info);
-int il4965_tx_skb(struct il_priv *il, struct sk_buff *skb);
+int il4965_tx_skb(struct il_priv *il,
+                  struct ieee80211_sta *sta,
+                  struct sk_buff *skb);
 int il4965_tx_agg_start(struct il_priv *il, struct ieee80211_vif *vif,
                         struct ieee80211_sta *sta, u16 tid, u16 * ssn);
 int il4965_tx_agg_stop(struct il_priv *il, struct ieee80211_vif *vif,
@@ -163,7 +165,9 @@ void il4965_eeprom_release_semaphore(struct il_priv *il);
 int il4965_eeprom_check_version(struct il_priv *il);
 
 /* mac80211 handlers (for 4965) */
-void il4965_mac_tx(struct ieee80211_hw *hw, struct sk_buff *skb);
+void il4965_mac_tx(struct ieee80211_hw *hw,
+                   struct ieee80211_tx_control *control,
+                   struct sk_buff *skb);
 int il4965_mac_start(struct ieee80211_hw *hw);
 void il4965_mac_stop(struct ieee80211_hw *hw);
 void il4965_configure_filter(struct ieee80211_hw *hw,
diff --git a/drivers/net/wireless/iwlwifi/dvm/agn.h b/drivers/net/wireless/iwlwifi/dvm/agn.h
index 9bb16bdf6d26..75e12f29d9eb 100644
--- a/drivers/net/wireless/iwlwifi/dvm/agn.h
+++ b/drivers/net/wireless/iwlwifi/dvm/agn.h
@@ -201,7 +201,9 @@ void iwl_chswitch_done(struct iwl_priv *priv, bool is_success);
 
 
 /* tx */
-int iwlagn_tx_skb(struct iwl_priv *priv, struct sk_buff *skb);
+int iwlagn_tx_skb(struct iwl_priv *priv,
+                  struct ieee80211_sta *sta,
+                  struct sk_buff *skb);
 int iwlagn_tx_agg_start(struct iwl_priv *priv, struct ieee80211_vif *vif,
                         struct ieee80211_sta *sta, u16 tid, u16 *ssn);
 int iwlagn_tx_agg_oper(struct iwl_priv *priv, struct ieee80211_vif *vif,
@@ -485,16 +487,13 @@ static inline void iwl_dvm_set_pmi(struct iwl_priv *priv, bool state)
 }
 
 #ifdef CONFIG_IWLWIFI_DEBUGFS
-int iwl_dbgfs_register(struct iwl_priv *priv, const char *name);
-void iwl_dbgfs_unregister(struct iwl_priv *priv);
+int iwl_dbgfs_register(struct iwl_priv *priv, struct dentry *dbgfs_dir);
 #else
-static inline int iwl_dbgfs_register(struct iwl_priv *priv, const char *name)
+static inline int iwl_dbgfs_register(struct iwl_priv *priv,
+                                     struct dentry *dbgfs_dir)
 {
         return 0;
 }
-static inline void iwl_dbgfs_unregister(struct iwl_priv *priv)
-{
-}
 #endif /* CONFIG_IWLWIFI_DEBUGFS */
 
 #ifdef CONFIG_IWLWIFI_DEBUG
diff --git a/drivers/net/wireless/iwlwifi/dvm/debugfs.c b/drivers/net/wireless/iwlwifi/dvm/debugfs.c
index 46782f1102ac..ce826bc5f111 100644
--- a/drivers/net/wireless/iwlwifi/dvm/debugfs.c
+++ b/drivers/net/wireless/iwlwifi/dvm/debugfs.c
@@ -2349,24 +2349,19 @@ DEBUGFS_READ_WRITE_FILE_OPS(calib_disabled);
  * Create the debugfs files and directories
  *
  */
-int iwl_dbgfs_register(struct iwl_priv *priv, const char *name)
+int iwl_dbgfs_register(struct iwl_priv *priv, struct dentry *dbgfs_dir)
 {
-        struct dentry *phyd = priv->hw->wiphy->debugfsdir;
-        struct dentry *dir_drv, *dir_data, *dir_rf, *dir_debug;
+        struct dentry *dir_data, *dir_rf, *dir_debug;
 
-        dir_drv = debugfs_create_dir(name, phyd);
-        if (!dir_drv)
-                return -ENOMEM;
-
-        priv->debugfs_dir = dir_drv;
+        priv->debugfs_dir = dbgfs_dir;
 
-        dir_data = debugfs_create_dir("data", dir_drv);
+        dir_data = debugfs_create_dir("data", dbgfs_dir);
         if (!dir_data)
                 goto err;
-        dir_rf = debugfs_create_dir("rf", dir_drv);
+        dir_rf = debugfs_create_dir("rf", dbgfs_dir);
         if (!dir_rf)
                 goto err;
-        dir_debug = debugfs_create_dir("debug", dir_drv);
+        dir_debug = debugfs_create_dir("debug", dbgfs_dir);
         if (!dir_debug)
                 goto err;
 
@@ -2412,25 +2407,30 @@ int iwl_dbgfs_register(struct iwl_priv *priv, const char *name)
         /* Calibrations disabled/enabled status*/
         DEBUGFS_ADD_FILE(calib_disabled, dir_rf, S_IWUSR | S_IRUSR);
 
-        if (iwl_trans_dbgfs_register(priv->trans, dir_debug))
-                goto err;
+        /*
+         * Create a symlink with mac80211. This is not very robust, as it does
+         * not remove the symlink created. The implicit assumption is that
+         * when the opmode exits, mac80211 will also exit, and will remove
+         * this symlink as part of its cleanup.
+         */
+        if (priv->mac80211_registered) {
+                char buf[100];
+                struct dentry *mac80211_dir, *dev_dir, *root_dir;
+
+                dev_dir = dbgfs_dir->d_parent;
+                root_dir = dev_dir->d_parent;
+                mac80211_dir = priv->hw->wiphy->debugfsdir;
+
+                snprintf(buf, 100, "../../%s/%s", root_dir->d_name.name,
+                         dev_dir->d_name.name);
+
+                if (!debugfs_create_symlink("iwlwifi", mac80211_dir, buf))
+                        goto err;
+        }
+
         return 0;
 
 err:
-        IWL_ERR(priv, "Can't create the debugfs directory\n");
-        iwl_dbgfs_unregister(priv);
+        IWL_ERR(priv, "failed to create the dvm debugfs entries\n");
         return -ENOMEM;
 }
-
-/**
- * Remove the debugfs files and directories
- *
- */
-void iwl_dbgfs_unregister(struct iwl_priv *priv)
-{
-        if (!priv->debugfs_dir)
-                return;
-
-        debugfs_remove_recursive(priv->debugfs_dir);
-        priv->debugfs_dir = NULL;
-}
diff --git a/drivers/net/wireless/iwlwifi/dvm/mac80211.c b/drivers/net/wireless/iwlwifi/dvm/mac80211.c
index a5f7bce96325..ff8162d4c454 100644
--- a/drivers/net/wireless/iwlwifi/dvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/dvm/mac80211.c
@@ -195,7 +195,7 @@ int iwlagn_mac_setup_register(struct iwl_priv *priv,
                         ARRAY_SIZE(iwlagn_iface_combinations_dualmode);
         }
 
-        hw->wiphy->max_remain_on_channel_duration = 1000;
+        hw->wiphy->max_remain_on_channel_duration = 500;
 
         hw->wiphy->flags |= WIPHY_FLAG_CUSTOM_REGULATORY |
                             WIPHY_FLAG_DISABLE_BEACON_HINTS |
@@ -511,14 +511,16 @@ static void iwlagn_mac_set_wakeup(struct ieee80211_hw *hw, bool enabled)
 }
 #endif
 
-static void iwlagn_mac_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
+static void iwlagn_mac_tx(struct ieee80211_hw *hw,
+                          struct ieee80211_tx_control *control,
+                          struct sk_buff *skb)
 {
         struct iwl_priv *priv = IWL_MAC80211_GET_DVM(hw);
 
         IWL_DEBUG_TX(priv, "dev->xmit(%d bytes) at rate 0x%02x\n", skb->len,
                      ieee80211_get_tx_rate(hw, IEEE80211_SKB_CB(skb))->bitrate);
 
-        if (iwlagn_tx_skb(priv, skb))
+        if (iwlagn_tx_skb(priv, control->sta, skb))
                 dev_kfree_skb_any(skb);
 }
 
diff --git a/drivers/net/wireless/iwlwifi/dvm/main.c b/drivers/net/wireless/iwlwifi/dvm/main.c
index 84d3db5aa506..7ff3f1430678 100644
--- a/drivers/net/wireless/iwlwifi/dvm/main.c
+++ b/drivers/net/wireless/iwlwifi/dvm/main.c
@@ -862,7 +862,8 @@ void iwl_down(struct iwl_priv *priv)
          * No race since we hold the mutex here and a new one
          * can't come in at this time.
          */
-        ieee80211_remain_on_channel_expired(priv->hw);
+        if (priv->ucode_loaded && priv->cur_ucode != IWL_UCODE_INIT)
+                ieee80211_remain_on_channel_expired(priv->hw);
 
         exit_pending =
                 test_and_set_bit(STATUS_EXIT_PENDING, &priv->status);
@@ -994,7 +995,11 @@ static void iwl_bg_restart(struct work_struct *data)
                 iwlagn_prepare_restart(priv);
                 mutex_unlock(&priv->mutex);
                 iwl_cancel_deferred_work(priv);
-                ieee80211_restart_hw(priv->hw);
+                if (priv->mac80211_registered)
+                        ieee80211_restart_hw(priv->hw);
+                else
+                        IWL_ERR(priv,
+                                "Cannot request restart before registrating with mac80211");
         } else {
                 WARN_ON(1);
         }
@@ -1222,7 +1227,8 @@ static int iwl_eeprom_init_hw_params(struct iwl_priv *priv)
 
 static struct iwl_op_mode *iwl_op_mode_dvm_start(struct iwl_trans *trans,
                                                  const struct iwl_cfg *cfg,
-                                                 const struct iwl_fw *fw)
+                                                 const struct iwl_fw *fw,
+                                                 struct dentry *dbgfs_dir)
 {
         struct iwl_priv *priv;
         struct ieee80211_hw *hw;
@@ -1466,13 +1472,17 @@ static struct iwl_op_mode *iwl_op_mode_dvm_start(struct iwl_trans *trans,
         if (iwlagn_mac_setup_register(priv, &fw->ucode_capa))
                 goto out_destroy_workqueue;
 
-        if (iwl_dbgfs_register(priv, DRV_NAME))
-                IWL_ERR(priv,
-                        "failed to create debugfs files. Ignoring error\n");
+        if (iwl_dbgfs_register(priv, dbgfs_dir))
+                goto out_mac80211_unregister;
 
         return op_mode;
 
+out_mac80211_unregister:
+        iwlagn_mac_unregister(priv);
 out_destroy_workqueue:
+        iwl_tt_exit(priv);
+        iwl_testmode_free(priv);
+        iwl_cancel_deferred_work(priv);
         destroy_workqueue(priv->workqueue);
         priv->workqueue = NULL;
         iwl_uninit_drv(priv);
@@ -1493,8 +1503,6 @@ static void iwl_op_mode_dvm_stop(struct iwl_op_mode *op_mode)
 
         IWL_DEBUG_INFO(priv, "*** UNLOAD DRIVER ***\n");
 
-        iwl_dbgfs_unregister(priv);
-
         iwl_testmode_free(priv);
         iwlagn_mac_unregister(priv);
 
diff --git a/drivers/net/wireless/iwlwifi/dvm/sta.c b/drivers/net/wireless/iwlwifi/dvm/sta.c
index b29b798f7550..fe36a38f3505 100644
--- a/drivers/net/wireless/iwlwifi/dvm/sta.c
+++ b/drivers/net/wireless/iwlwifi/dvm/sta.c
@@ -150,7 +150,7 @@ int iwl_send_add_sta(struct iwl_priv *priv,
                        sta_id, sta->sta.addr, flags & CMD_ASYNC ?  "a" : "");
 
         if (!(flags & CMD_ASYNC)) {
-                cmd.flags |= CMD_WANT_SKB;
+                cmd.flags |= CMD_WANT_SKB | CMD_WANT_HCMD;
                 might_sleep();
         }
 
diff --git a/drivers/net/wireless/iwlwifi/dvm/tx.c b/drivers/net/wireless/iwlwifi/dvm/tx.c
index 5971a23aa47d..f5ca73a89870 100644
--- a/drivers/net/wireless/iwlwifi/dvm/tx.c
+++ b/drivers/net/wireless/iwlwifi/dvm/tx.c
@@ -127,6 +127,7 @@ static void iwlagn_tx_cmd_build_basic(struct iwl_priv *priv,
 static void iwlagn_tx_cmd_build_rate(struct iwl_priv *priv,
                                      struct iwl_tx_cmd *tx_cmd,
                                      struct ieee80211_tx_info *info,
+                                     struct ieee80211_sta *sta,
                                      __le16 fc)
 {
         u32 rate_flags;
@@ -187,8 +188,7 @@ static void iwlagn_tx_cmd_build_rate(struct iwl_priv *priv,
         if (info->control.rates[0].flags & IEEE80211_TX_RC_MCS ||
                         (rate_idx < 0) || (rate_idx > IWL_RATE_COUNT_LEGACY))
                 rate_idx = rate_lowest_index(
-                                &priv->eeprom_data->bands[info->band],
-                                info->control.sta);
+                                &priv->eeprom_data->bands[info->band], sta);
         /* For 5 GHZ band, remap mac80211 rate indices into driver indices */
         if (info->band == IEEE80211_BAND_5GHZ)
                 rate_idx += IWL_FIRST_OFDM_RATE;
@@ -291,7 +291,9 @@ static int iwl_sta_id_or_broadcast(struct iwl_rxon_context *context,
 /*
  * start REPLY_TX command process
  */
-int iwlagn_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
+int iwlagn_tx_skb(struct iwl_priv *priv,
+                  struct ieee80211_sta *sta,
+                  struct sk_buff *skb)
 {
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
@@ -345,7 +347,7 @@ int iwlagn_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
                 sta_id = ctx->bcast_sta_id;
         else {
                 /* Find index into station table for destination station */
-                sta_id = iwl_sta_id_or_broadcast(ctx, info->control.sta);
+                sta_id = iwl_sta_id_or_broadcast(ctx, sta);
                 if (sta_id == IWL_INVALID_STATION) {
                         IWL_DEBUG_DROP(priv, "Dropping - INVALID STATION: %pM\n",
                                        hdr->addr1);
@@ -355,8 +357,8 @@ int iwlagn_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
 
         IWL_DEBUG_TX(priv, "station Id %d\n", sta_id);
 
-        if (info->control.sta)
-                sta_priv = (void *)info->control.sta->drv_priv;
+        if (sta)
+                sta_priv = (void *)sta->drv_priv;
 
         if (sta_priv && sta_priv->asleep &&
             (info->flags & IEEE80211_TX_CTL_NO_PS_BUFFER)) {
@@ -397,7 +399,7 @@ int iwlagn_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
         /* TODO need this for burst mode later on */
         iwlagn_tx_cmd_build_basic(priv, skb, tx_cmd, info, hdr, sta_id);
 
-        iwlagn_tx_cmd_build_rate(priv, tx_cmd, info, fc);
+        iwlagn_tx_cmd_build_rate(priv, tx_cmd, info, sta, fc);
 
         memset(&info->status, 0, sizeof(info->status));
 
@@ -431,7 +433,7 @@ int iwlagn_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
                  * only. Check this here.
                  */
                 if (WARN_ONCE(tid_data->agg.state != IWL_AGG_ON &&
-                    tid_data->agg.state != IWL_AGG_OFF,
+                              tid_data->agg.state != IWL_AGG_OFF,
                     "Tx while agg.state = %d", tid_data->agg.state))
                         goto drop_unlock_sta;
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-drv.c b/drivers/net/wireless/iwlwifi/iwl-drv.c
index cc41cfaedfbd..48d6d44c16d0 100644
--- a/drivers/net/wireless/iwlwifi/iwl-drv.c
+++ b/drivers/net/wireless/iwlwifi/iwl-drv.c
@@ -101,6 +101,10 @@ MODULE_VERSION(DRV_VERSION);
 MODULE_AUTHOR(DRV_COPYRIGHT " " DRV_AUTHOR);
 MODULE_LICENSE("GPL");
 
+#ifdef CONFIG_IWLWIFI_DEBUGFS
+static struct dentry *iwl_dbgfs_root;
+#endif
+
 /**
  * struct iwl_drv - drv common data
  * @list: list of drv structures using this opmode
@@ -126,6 +130,12 @@ struct iwl_drv {
         char firmware_name[25];         /* name of firmware file to load */
 
         struct completion request_firmware_complete;
+
+#ifdef CONFIG_IWLWIFI_DEBUGFS
+        struct dentry *dbgfs_drv;
+        struct dentry *dbgfs_trans;
+        struct dentry *dbgfs_op_mode;
+#endif
 };
 
 #define DVM_OP_MODE     0
@@ -194,7 +204,8 @@ static int iwl_alloc_fw_desc(struct iwl_drv *drv, struct fw_desc *desc,
         return 0;
 }
 
-static void iwl_ucode_callback(const struct firmware *ucode_raw, void *context);
+static void iwl_req_fw_callback(const struct firmware *ucode_raw,
+                                void *context);
 
 #define UCODE_EXPERIMENTAL_INDEX        100
 #define UCODE_EXPERIMENTAL_TAG          "exp"
@@ -231,7 +242,7 @@ static int iwl_request_firmware(struct iwl_drv *drv, bool first)
 
         return request_firmware_nowait(THIS_MODULE, 1, drv->firmware_name,
                                        drv->trans->dev,
-                                       GFP_KERNEL, drv, iwl_ucode_callback);
+                                       GFP_KERNEL, drv, iwl_req_fw_callback);
 }
 
 struct fw_img_parsing {
@@ -759,13 +770,57 @@ static int validate_sec_sizes(struct iwl_drv *drv,
         return 0;
 }
 
+static struct iwl_op_mode *
+_iwl_op_mode_start(struct iwl_drv *drv, struct iwlwifi_opmode_table *op)
+{
+        const struct iwl_op_mode_ops *ops = op->ops;
+        struct dentry *dbgfs_dir = NULL;
+        struct iwl_op_mode *op_mode = NULL;
+
+#ifdef CONFIG_IWLWIFI_DEBUGFS
+        drv->dbgfs_op_mode = debugfs_create_dir(op->name,
+                                                drv->dbgfs_drv);
+        if (!drv->dbgfs_op_mode) {
+                IWL_ERR(drv,
+                        "failed to create opmode debugfs directory\n");
+                return op_mode;
+        }
+        dbgfs_dir = drv->dbgfs_op_mode;
+#endif
+
+        op_mode = ops->start(drv->trans, drv->cfg, &drv->fw, dbgfs_dir);
+
+#ifdef CONFIG_IWLWIFI_DEBUGFS
+        if (!op_mode) {
+                debugfs_remove_recursive(drv->dbgfs_op_mode);
+                drv->dbgfs_op_mode = NULL;
+        }
+#endif
+
+        return op_mode;
+}
+
+static void _iwl_op_mode_stop(struct iwl_drv *drv)
+{
+        /* op_mode can be NULL if its start failed */
+        if (drv->op_mode) {
+                iwl_op_mode_stop(drv->op_mode);
+                drv->op_mode = NULL;
+
+#ifdef CONFIG_IWLWIFI_DEBUGFS
+                debugfs_remove_recursive(drv->dbgfs_op_mode);
+                drv->dbgfs_op_mode = NULL;
+#endif
+        }
+}
+
 /**
- * iwl_ucode_callback - callback when firmware was loaded
+ * iwl_req_fw_callback - callback when firmware was loaded
  *
  * If loaded successfully, copies the firmware into buffers
  * for the card to fetch (via DMA).
  */
-static void iwl_ucode_callback(const struct firmware *ucode_raw, void *context)
+static void iwl_req_fw_callback(const struct firmware *ucode_raw, void *context)
 {
         struct iwl_drv *drv = context;
         struct iwl_fw *fw = &drv->fw;
@@ -908,8 +963,7 @@ static void iwl_ucode_callback(const struct firmware *ucode_raw, void *context)
         list_add_tail(&drv->list, &op->drv);
 
         if (op->ops) {
-                const struct iwl_op_mode_ops *ops = op->ops;
-                drv->op_mode = ops->start(drv->trans, drv->cfg, &drv->fw);
+                drv->op_mode = _iwl_op_mode_start(drv, op);
 
                 if (!drv->op_mode) {
                         mutex_unlock(&iwlwifi_opmode_table_mtx);
@@ -969,24 +1023,51 @@ struct iwl_drv *iwl_drv_start(struct iwl_trans *trans,
         init_completion(&drv->request_firmware_complete);
         INIT_LIST_HEAD(&drv->list);
 
+#ifdef CONFIG_IWLWIFI_DEBUGFS
+        /* Create the device debugfs entries. */
+        drv->dbgfs_drv = debugfs_create_dir(dev_name(trans->dev),
+                                            iwl_dbgfs_root);
+
+        if (!drv->dbgfs_drv) {
+                IWL_ERR(drv, "failed to create debugfs directory\n");
+                goto err_free_drv;
+        }
+
+        /* Create transport layer debugfs dir */
+        drv->trans->dbgfs_dir = debugfs_create_dir("trans", drv->dbgfs_drv);
+
+        if (!drv->trans->dbgfs_dir) {
+                IWL_ERR(drv, "failed to create transport debugfs directory\n");
+                goto err_free_dbgfs;
+        }
+#endif
+
         ret = iwl_request_firmware(drv, true);
 
         if (ret) {
                 IWL_ERR(trans, "Couldn't request the fw\n");
-                kfree(drv);
-                drv = NULL;
+                goto err_fw;
         }
 
         return drv;
+
+err_fw:
+#ifdef CONFIG_IWLWIFI_DEBUGFS
+err_free_dbgfs:
+        debugfs_remove_recursive(drv->dbgfs_drv);
+err_free_drv:
+#endif
+        kfree(drv);
+        drv = NULL;
+
+        return drv;
 }
 
 void iwl_drv_stop(struct iwl_drv *drv)
 {
         wait_for_completion(&drv->request_firmware_complete);
 
-        /* op_mode can be NULL if its start failed */
-        if (drv->op_mode)
-                iwl_op_mode_stop(drv->op_mode);
+        _iwl_op_mode_stop(drv);
 
         iwl_dealloc_ucode(drv);
 
@@ -1000,6 +1081,10 @@ void iwl_drv_stop(struct iwl_drv *drv)
                 list_del(&drv->list);
         mutex_unlock(&iwlwifi_opmode_table_mtx);
 
+#ifdef CONFIG_IWLWIFI_DEBUGFS
+        debugfs_remove_recursive(drv->dbgfs_drv);
+#endif
+
         kfree(drv);
 }
 
@@ -1022,15 +1107,18 @@ int iwl_opmode_register(const char *name, const struct iwl_op_mode_ops *ops)
 {
         int i;
         struct iwl_drv *drv;
+        struct iwlwifi_opmode_table *op;
 
         mutex_lock(&iwlwifi_opmode_table_mtx);
         for (i = 0; i < ARRAY_SIZE(iwlwifi_opmode_table); i++) {
-                if (strcmp(iwlwifi_opmode_table[i].name, name))
+                op = &iwlwifi_opmode_table[i];
+                if (strcmp(op->name, name))
                         continue;
-                iwlwifi_opmode_table[i].ops = ops;
-                list_for_each_entry(drv, &iwlwifi_opmode_table[i].drv, list)
-                        drv->op_mode = ops->start(drv->trans, drv->cfg,
-                                                  &drv->fw);
+                op->ops = ops;
+                /* TODO: need to handle exceptional case */
+                list_for_each_entry(drv, &op->drv, list)
+                        drv->op_mode = _iwl_op_mode_start(drv, op);
+
                 mutex_unlock(&iwlwifi_opmode_table_mtx);
                 return 0;
         }
@@ -1051,12 +1139,9 @@ void iwl_opmode_deregister(const char *name)
                 iwlwifi_opmode_table[i].ops = NULL;
 
                 /* call the stop routine for all devices */
-                list_for_each_entry(drv, &iwlwifi_opmode_table[i].drv, list) {
-                        if (drv->op_mode) {
-                                iwl_op_mode_stop(drv->op_mode);
-                                drv->op_mode = NULL;
-                        }
-                }
+                list_for_each_entry(drv, &iwlwifi_opmode_table[i].drv, list)
+                        _iwl_op_mode_stop(drv);
+
                 mutex_unlock(&iwlwifi_opmode_table_mtx);
                 return;
         }
@@ -1076,6 +1161,14 @@ static int __init iwl_drv_init(void)
         pr_info(DRV_DESCRIPTION ", " DRV_VERSION "\n");
         pr_info(DRV_COPYRIGHT "\n");
 
+#ifdef CONFIG_IWLWIFI_DEBUGFS
+        /* Create the root of iwlwifi debugfs subsystem. */
+        iwl_dbgfs_root = debugfs_create_dir(DRV_NAME, NULL);
+
+        if (!iwl_dbgfs_root)
+                return -EFAULT;
+#endif
+
         return iwl_pci_register_driver();
 }
 module_init(iwl_drv_init);
@@ -1083,6 +1176,10 @@ module_init(iwl_drv_init);
 static void __exit iwl_drv_exit(void)
 {
         iwl_pci_unregister_driver();
+
+#ifdef CONFIG_IWLWIFI_DEBUGFS
+        debugfs_remove_recursive(iwl_dbgfs_root);
+#endif
 }
 module_exit(iwl_drv_exit);
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-drv.h b/drivers/net/wireless/iwlwifi/iwl-drv.h
index 2cbf137b25bf..285de5f68c05 100644
--- a/drivers/net/wireless/iwlwifi/iwl-drv.h
+++ b/drivers/net/wireless/iwlwifi/iwl-drv.h
@@ -90,9 +90,9 @@
  * 4) The bus specific component configures the bus
  * 5) The bus specific component calls to the drv bus agnostic part
  *    (iwl_drv_start)
- * 6) iwl_drv_start fetches the fw ASYNC, iwl_ucode_callback
- * 7) iwl_ucode_callback parses the fw file
- * 8) iwl_ucode_callback starts the wifi implementation to matches the fw
+ * 6) iwl_drv_start fetches the fw ASYNC, iwl_req_fw_callback
+ * 7) iwl_req_fw_callback parses the fw file
+ * 8) iwl_req_fw_callback starts the wifi implementation to matches the fw
  */
 
 struct iwl_drv;
diff --git a/drivers/net/wireless/iwlwifi/iwl-op-mode.h b/drivers/net/wireless/iwlwifi/iwl-op-mode.h
index 64886f95664f..c8d9b9517468 100644
--- a/drivers/net/wireless/iwlwifi/iwl-op-mode.h
+++ b/drivers/net/wireless/iwlwifi/iwl-op-mode.h
@@ -134,7 +134,8 @@ struct iwl_cfg;
 struct iwl_op_mode_ops {
         struct iwl_op_mode *(*start)(struct iwl_trans *trans,
                                      const struct iwl_cfg *cfg,
-                                     const struct iwl_fw *fw);
+                                     const struct iwl_fw *fw,
+                                     struct dentry *dbgfs_dir);
         void (*stop)(struct iwl_op_mode *op_mode);
         int (*rx)(struct iwl_op_mode *op_mode, struct iwl_rx_cmd_buffer *rxb,
                   struct iwl_device_cmd *cmd);
diff --git a/drivers/net/wireless/iwlwifi/iwl-trans.h b/drivers/net/wireless/iwlwifi/iwl-trans.h
index 92576a3e84ef..ff1154232885 100644
--- a/drivers/net/wireless/iwlwifi/iwl-trans.h
+++ b/drivers/net/wireless/iwlwifi/iwl-trans.h
@@ -184,14 +184,20 @@ struct iwl_rx_packet {
  * @CMD_SYNC: The caller will be stalled until the fw responds to the command
  * @CMD_ASYNC: Return right away and don't want for the response
  * @CMD_WANT_SKB: valid only with CMD_SYNC. The caller needs the buffer of the
- *      response.
+ *      response. The caller needs to call iwl_free_resp when done.
+ * @CMD_WANT_HCMD: The caller needs to get the HCMD that was sent in the
+ *      response handler. Chunks flagged by %IWL_HCMD_DFL_NOCOPY won't be
+ *      copied. The pointer passed to the response handler is in the transport
+ *      ownership and don't need to be freed by the op_mode. This also means
+ *      that the pointer is invalidated after the op_mode's handler returns.
  * @CMD_ON_DEMAND: This command is sent by the test mode pipe.
  */
 enum CMD_MODE {
         CMD_SYNC = 0,
         CMD_ASYNC = BIT(0),
         CMD_WANT_SKB = BIT(1),
-        CMD_ON_DEMAND = BIT(2),
+        CMD_WANT_HCMD = BIT(2),
+        CMD_ON_DEMAND = BIT(3),
 };
 
 #define DEF_CMD_PAYLOAD_SIZE 320
@@ -460,6 +466,8 @@ struct iwl_trans {
         size_t dev_cmd_headroom;
         char dev_cmd_pool_name[50];
 
+        struct dentry *dbgfs_dir;
+
         /* pointer to trans specific struct */
         /*Ensure that this pointer will always be aligned to sizeof pointer */
         char trans_specific[0] __aligned(sizeof(void *));
diff --git a/drivers/net/wireless/iwlwifi/pcie/drv.c b/drivers/net/wireless/iwlwifi/pcie/drv.c
index f4c3500b68c6..89bfb43f4946 100644
--- a/drivers/net/wireless/iwlwifi/pcie/drv.c
+++ b/drivers/net/wireless/iwlwifi/pcie/drv.c
@@ -282,8 +282,14 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         if (!trans_pcie->drv)
                 goto out_free_trans;
 
+        /* register transport layer debugfs here */
+        if (iwl_trans_dbgfs_register(iwl_trans, iwl_trans->dbgfs_dir))
+                goto out_free_drv;
+
         return 0;
 
+out_free_drv:
+        iwl_drv_stop(trans_pcie->drv);
 out_free_trans:
         iwl_trans_pcie_free(iwl_trans);
         pci_set_drvdata(pdev, NULL);
diff --git a/drivers/net/wireless/iwlwifi/pcie/internal.h b/drivers/net/wireless/iwlwifi/pcie/internal.h
index d9694c58208c..3ef8d5adc991 100644
--- a/drivers/net/wireless/iwlwifi/pcie/internal.h
+++ b/drivers/net/wireless/iwlwifi/pcie/internal.h
@@ -184,6 +184,7 @@ struct iwl_queue {
 
 struct iwl_pcie_tx_queue_entry {
         struct iwl_device_cmd *cmd;
+        struct iwl_device_cmd *copy_cmd;
         struct sk_buff *skb;
         struct iwl_cmd_meta meta;
 };
diff --git a/drivers/net/wireless/iwlwifi/pcie/rx.c b/drivers/net/wireless/iwlwifi/pcie/rx.c
index 39a6ca1f009c..d80604a2bb1a 100644
--- a/drivers/net/wireless/iwlwifi/pcie/rx.c
+++ b/drivers/net/wireless/iwlwifi/pcie/rx.c
@@ -421,13 +421,23 @@ static void iwl_rx_handle_rxbuf(struct iwl_trans *trans,
                 index = SEQ_TO_INDEX(sequence);
                 cmd_index = get_cmd_index(&txq->q, index);
 
-                if (reclaim)
-                        cmd = txq->entries[cmd_index].cmd;
-                else
+                if (reclaim) {
+                        struct iwl_pcie_tx_queue_entry *ent;
+                        ent = &txq->entries[cmd_index];
+                        cmd = ent->copy_cmd;
+                        WARN_ON_ONCE(!cmd && ent->meta.flags & CMD_WANT_HCMD);
+                } else {
                         cmd = NULL;
+                }
 
                 err = iwl_op_mode_rx(trans->op_mode, &rxcb, cmd);
 
+                if (reclaim) {
+                        /* The original command isn't needed any more */
+                        kfree(txq->entries[cmd_index].copy_cmd);
+                        txq->entries[cmd_index].copy_cmd = NULL;
+                }
+
                 /*
                  * After here, we should always check rxcb._page_stolen,
                  * if it is true then one of the handlers took the page.
diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c
index 939c2f78df58..38f51b04217e 100644
--- a/drivers/net/wireless/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
@@ -492,10 +492,11 @@ static void iwl_tx_queue_free(struct iwl_trans *trans, int txq_id)
         iwl_tx_queue_unmap(trans, txq_id);
 
         /* De-alloc array of command/tx buffers */
-
         if (txq_id == trans_pcie->cmd_queue)
-                for (i = 0; i < txq->q.n_window; i++)
+                for (i = 0; i < txq->q.n_window; i++) {
                         kfree(txq->entries[i].cmd);
+                        kfree(txq->entries[i].copy_cmd);
+                }
 
         /* De-alloc circular buffer of TFDs */
         if (txq->q.n_bd) {
@@ -896,6 +897,7 @@ static int iwl_set_hw_ready(struct iwl_trans *trans)
 static int iwl_prepare_card_hw(struct iwl_trans *trans)
 {
         int ret;
+        int t = 0;
 
         IWL_DEBUG_INFO(trans, "iwl_trans_prepare_card_hw enter\n");
 
@@ -908,17 +910,15 @@ static int iwl_prepare_card_hw(struct iwl_trans *trans)
         iwl_set_bit(trans, CSR_HW_IF_CONFIG_REG,
                     CSR_HW_IF_CONFIG_REG_PREPARE);
 
-        ret = iwl_poll_bit(trans, CSR_HW_IF_CONFIG_REG,
-                           ~CSR_HW_IF_CONFIG_REG_BIT_NIC_PREPARE_DONE,
-                           CSR_HW_IF_CONFIG_REG_BIT_NIC_PREPARE_DONE, 150000);
+        do {
+                ret = iwl_set_hw_ready(trans);
+                if (ret >= 0)
+                        return 0;
 
-        if (ret < 0)
-                return ret;
+                usleep_range(200, 1000);
+                t += 200;
+        } while (t < 150000);
 
-        /* HW should be ready by now, check again. */
-        ret = iwl_set_hw_ready(trans);
-        if (ret >= 0)
-                return 0;
         return ret;
 }
 
@@ -1769,7 +1769,7 @@ void iwl_dump_csr(struct iwl_trans *trans)
 #define DEBUGFS_ADD_FILE(name, parent, mode) do {                       \
         if (!debugfs_create_file(#name, mode, parent, trans,            \
                                  &iwl_dbgfs_##name##_ops))              \
-                return -ENOMEM;                                         \
+                goto err;                                               \
 } while (0)
 
 /* file operation */
@@ -2033,6 +2033,10 @@ static int iwl_trans_pcie_dbgfs_register(struct iwl_trans *trans,
         DEBUGFS_ADD_FILE(fh_reg, dir, S_IRUSR);
         DEBUGFS_ADD_FILE(fw_restart, dir, S_IWUSR);
         return 0;
+
+err:
+        IWL_ERR(trans, "failed to create the trans debugfs entry\n");
+        return -ENOMEM;
 }
 #else
 static int iwl_trans_pcie_dbgfs_register(struct iwl_trans *trans,
diff --git a/drivers/net/wireless/iwlwifi/pcie/tx.c b/drivers/net/wireless/iwlwifi/pcie/tx.c
index 6baf8deef519..392d2bc5e357 100644
--- a/drivers/net/wireless/iwlwifi/pcie/tx.c
+++ b/drivers/net/wireless/iwlwifi/pcie/tx.c
@@ -521,7 +521,7 @@ static int iwl_enqueue_hcmd(struct iwl_trans *trans, struct iwl_host_cmd *cmd)
         u16 copy_size, cmd_size;
         bool had_nocopy = false;
         int i;
-        u8 *cmd_dest;
+        u32 cmd_pos;
 #ifdef CONFIG_IWLWIFI_DEVICE_TRACING
         const void *trace_bufs[IWL_MAX_CMD_TFDS + 1] = {};
         int trace_lens[IWL_MAX_CMD_TFDS + 1] = {};
@@ -584,15 +584,31 @@ static int iwl_enqueue_hcmd(struct iwl_trans *trans, struct iwl_host_cmd *cmd)
                                          INDEX_TO_SEQ(q->write_ptr));
 
         /* and copy the data that needs to be copied */
-
-        cmd_dest = out_cmd->payload;
+        cmd_pos = offsetof(struct iwl_device_cmd, payload);
         for (i = 0; i < IWL_MAX_CMD_TFDS; i++) {
                 if (!cmd->len[i])
                         continue;
                 if (cmd->dataflags[i] & IWL_HCMD_DFL_NOCOPY)
                         break;
-                memcpy(cmd_dest, cmd->data[i], cmd->len[i]);
-                cmd_dest += cmd->len[i];
+                memcpy((u8 *)out_cmd + cmd_pos, cmd->data[i], cmd->len[i]);
+                cmd_pos += cmd->len[i];
+        }
+
+        WARN_ON_ONCE(txq->entries[idx].copy_cmd);
+
+        /*
+         * since out_cmd will be the source address of the FH, it will write
+         * the retry count there. So when the user needs to receivce the HCMD
+         * that corresponds to the response in the response handler, it needs
+         * to set CMD_WANT_HCMD.
+         */
+        if (cmd->flags & CMD_WANT_HCMD) {
+                txq->entries[idx].copy_cmd =
+                        kmemdup(out_cmd, cmd_pos, GFP_ATOMIC);
+                if (unlikely(!txq->entries[idx].copy_cmd)) {
+                        idx = -ENOMEM;
+                        goto out;
+                }
         }
 
         IWL_DEBUG_HC(trans,
diff --git a/drivers/net/wireless/libertas_tf/main.c b/drivers/net/wireless/libertas_tf/main.c
index a03457292c88..7001856241e6 100644
--- a/drivers/net/wireless/libertas_tf/main.c
+++ b/drivers/net/wireless/libertas_tf/main.c
@@ -227,7 +227,9 @@ static void lbtf_free_adapter(struct lbtf_private *priv)
         lbtf_deb_leave(LBTF_DEB_MAIN);
 }
 
-static void lbtf_op_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
+static void lbtf_op_tx(struct ieee80211_hw *hw,
+                       struct ieee80211_tx_control *control,
+                       struct sk_buff *skb)
 {
         struct lbtf_private *priv = hw->priv;
 
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index 00838395778c..72b0456e41bf 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -709,7 +709,9 @@ static bool mac80211_hwsim_tx_frame_no_nl(struct ieee80211_hw *hw,
         return ack;
 }
 
-static void mac80211_hwsim_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
+static void mac80211_hwsim_tx(struct ieee80211_hw *hw,
+                              struct ieee80211_tx_control *control,
+                              struct sk_buff *skb)
 {
         bool ack;
         struct ieee80211_tx_info *txi;
@@ -1727,6 +1729,7 @@ static const struct ieee80211_iface_limit hwsim_if_limits[] = {
 #endif
                                  BIT(NL80211_IFTYPE_AP) |
                                  BIT(NL80211_IFTYPE_P2P_GO) },
+        { .max = 1, .types = BIT(NL80211_IFTYPE_P2P_DEVICE) },
 };
 
 static const struct ieee80211_iface_combination hwsim_if_comb = {
@@ -1813,7 +1816,8 @@ static int __init init_mac80211_hwsim(void)
                         BIT(NL80211_IFTYPE_P2P_CLIENT) |
                         BIT(NL80211_IFTYPE_P2P_GO) |
                         BIT(NL80211_IFTYPE_ADHOC) |
-                        BIT(NL80211_IFTYPE_MESH_POINT);
+                        BIT(NL80211_IFTYPE_MESH_POINT) |
+                        BIT(NL80211_IFTYPE_P2P_DEVICE);
 
                 hw->flags = IEEE80211_HW_MFP_CAPABLE |
                             IEEE80211_HW_SIGNAL_DBM |
diff --git a/drivers/net/wireless/mwl8k.c b/drivers/net/wireless/mwl8k.c
index 224e03ade145..5099e5375cb3 100644
--- a/drivers/net/wireless/mwl8k.c
+++ b/drivers/net/wireless/mwl8k.c
@@ -1830,12 +1830,14 @@ static inline void mwl8k_tx_count_packet(struct ieee80211_sta *sta, u8 tid)
 }
 
 static void
-mwl8k_txq_xmit(struct ieee80211_hw *hw, int index, struct sk_buff *skb)
+mwl8k_txq_xmit(struct ieee80211_hw *hw,
+               int index,
+               struct ieee80211_sta *sta,
+               struct sk_buff *skb)
 {
         struct mwl8k_priv *priv = hw->priv;
         struct ieee80211_tx_info *tx_info;
         struct mwl8k_vif *mwl8k_vif;
-        struct ieee80211_sta *sta;
         struct ieee80211_hdr *wh;
         struct mwl8k_tx_queue *txq;
         struct mwl8k_tx_desc *tx;
@@ -1867,7 +1869,6 @@ mwl8k_txq_xmit(struct ieee80211_hw *hw, int index, struct sk_buff *skb)
         wh = &((struct mwl8k_dma_data *)skb->data)->wh;
 
         tx_info = IEEE80211_SKB_CB(skb);
-        sta = tx_info->control.sta;
         mwl8k_vif = MWL8K_VIF(tx_info->control.vif);
 
         if (tx_info->flags & IEEE80211_TX_CTL_ASSIGN_SEQ) {
@@ -2019,8 +2020,8 @@ mwl8k_txq_xmit(struct ieee80211_hw *hw, int index, struct sk_buff *skb)
         tx->pkt_phys_addr = cpu_to_le32(dma);
         tx->pkt_len = cpu_to_le16(skb->len);
         tx->rate_info = 0;
-        if (!priv->ap_fw && tx_info->control.sta != NULL)
-                tx->peer_id = MWL8K_STA(tx_info->control.sta)->peer_id;
+        if (!priv->ap_fw && sta != NULL)
+                tx->peer_id = MWL8K_STA(sta)->peer_id;
         else
                 tx->peer_id = 0;
 
@@ -4364,7 +4365,9 @@ static void mwl8k_rx_poll(unsigned long data)
 /*
  * Core driver operations.
  */
-static void mwl8k_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
+static void mwl8k_tx(struct ieee80211_hw *hw,
+                     struct ieee80211_tx_control *control,
+                     struct sk_buff *skb)
 {
         struct mwl8k_priv *priv = hw->priv;
         int index = skb_get_queue_mapping(skb);
@@ -4376,7 +4379,7 @@ static void mwl8k_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
                 return;
         }
 
-        mwl8k_txq_xmit(hw, index, skb);
+        mwl8k_txq_xmit(hw, index, control->sta, skb);
 }
 
 static int mwl8k_start(struct ieee80211_hw *hw)
diff --git a/drivers/net/wireless/p54/lmac.h b/drivers/net/wireless/p54/lmac.h
index 3d8d622bec55..de1d46bf97df 100644
--- a/drivers/net/wireless/p54/lmac.h
+++ b/drivers/net/wireless/p54/lmac.h
@@ -526,7 +526,9 @@ int p54_init_leds(struct p54_common *priv);
 void p54_unregister_leds(struct p54_common *priv);
 
 /* xmit functions */
-void p54_tx_80211(struct ieee80211_hw *dev, struct sk_buff *skb);
+void p54_tx_80211(struct ieee80211_hw *dev,
+                  struct ieee80211_tx_control *control,
+                  struct sk_buff *skb);
 int p54_tx_cancel(struct p54_common *priv, __le32 req_id);
 void p54_tx(struct p54_common *priv, struct sk_buff *skb);
 
diff --git a/drivers/net/wireless/p54/main.c b/drivers/net/wireless/p54/main.c
index 7cffea795ad2..5e91ad06dd5d 100644
--- a/drivers/net/wireless/p54/main.c
+++ b/drivers/net/wireless/p54/main.c
@@ -158,7 +158,7 @@ static int p54_beacon_update(struct p54_common *priv,
          * to cancel the old beacon template by hand, instead the firmware
          * will release the previous one through the feedback mechanism.
          */
-        p54_tx_80211(priv->hw, beacon);
+        p54_tx_80211(priv->hw, NULL, beacon);
         priv->tsf_high32 = 0;
         priv->tsf_low32 = 0;
 
diff --git a/drivers/net/wireless/p54/txrx.c b/drivers/net/wireless/p54/txrx.c
index f38786e02623..5861e13a6fd8 100644
--- a/drivers/net/wireless/p54/txrx.c
+++ b/drivers/net/wireless/p54/txrx.c
@@ -676,8 +676,9 @@ int p54_rx(struct ieee80211_hw *dev, struct sk_buff *skb)
 EXPORT_SYMBOL_GPL(p54_rx);
 
 static void p54_tx_80211_header(struct p54_common *priv, struct sk_buff *skb,
-                                struct ieee80211_tx_info *info, u8 *queue,
-                                u32 *extra_len, u16 *flags, u16 *aid,
+                                struct ieee80211_tx_info *info,
+                                struct ieee80211_sta *sta,
+                                u8 *queue, u32 *extra_len, u16 *flags, u16 *aid,
                                 bool *burst_possible)
 {
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
@@ -746,8 +747,8 @@ static void p54_tx_80211_header(struct p54_common *priv, struct sk_buff *skb,
                         }
                 }
 
-                if (info->control.sta)
-                        *aid = info->control.sta->aid;
+                if (sta)
+                        *aid = sta->aid;
                 break;
         }
 }
@@ -767,7 +768,9 @@ static u8 p54_convert_algo(u32 cipher)
         }
 }
 
-void p54_tx_80211(struct ieee80211_hw *dev, struct sk_buff *skb)
+void p54_tx_80211(struct ieee80211_hw *dev,
+                  struct ieee80211_tx_control *control,
+                  struct sk_buff *skb)
 {
         struct p54_common *priv = dev->priv;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
@@ -784,7 +787,7 @@ void p54_tx_80211(struct ieee80211_hw *dev, struct sk_buff *skb)
         u8 nrates = 0, nremaining = 8;
         bool burst_allowed = false;
 
-        p54_tx_80211_header(priv, skb, info, &queue, &extra_len,
+        p54_tx_80211_header(priv, skb, info, control->sta, &queue, &extra_len,
                             &hdr_flags, &aid, &burst_allowed);
 
         if (p54_tx_qos_accounting_alloc(priv, skb, queue)) {
diff --git a/drivers/net/wireless/rt2x00/rt2x00.h b/drivers/net/wireless/rt2x00/rt2x00.h
index 8afb546c2b2d..f991e8bedc70 100644
--- a/drivers/net/wireless/rt2x00/rt2x00.h
+++ b/drivers/net/wireless/rt2x00/rt2x00.h
@@ -1287,7 +1287,9 @@ void rt2x00lib_rxdone(struct queue_entry *entry, gfp_t gfp);
 /*
  * mac80211 handlers.
  */
-void rt2x00mac_tx(struct ieee80211_hw *hw, struct sk_buff *skb);
+void rt2x00mac_tx(struct ieee80211_hw *hw,
+                  struct ieee80211_tx_control *control,
+                  struct sk_buff *skb);
 int rt2x00mac_start(struct ieee80211_hw *hw);
 void rt2x00mac_stop(struct ieee80211_hw *hw);
 int rt2x00mac_add_interface(struct ieee80211_hw *hw,
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
index a6b88bd4a1a5..a59048ffa092 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -194,7 +194,7 @@ static void rt2x00lib_bc_buffer_iter(void *data, u8 *mac,
          */
         skb = ieee80211_get_buffered_bc(rt2x00dev->hw, vif);
         while (skb) {
-                rt2x00mac_tx(rt2x00dev->hw, skb);
+                rt2x00mac_tx(rt2x00dev->hw, NULL, skb);
                 skb = ieee80211_get_buffered_bc(rt2x00dev->hw, vif);
         }
 }
diff --git a/drivers/net/wireless/rt2x00/rt2x00mac.c b/drivers/net/wireless/rt2x00/rt2x00mac.c
index 4ff26c2159bf..c3d0f2f87b69 100644
--- a/drivers/net/wireless/rt2x00/rt2x00mac.c
+++ b/drivers/net/wireless/rt2x00/rt2x00mac.c
@@ -99,7 +99,9 @@ static int rt2x00mac_tx_rts_cts(struct rt2x00_dev *rt2x00dev,
         return retval;
 }
 
-void rt2x00mac_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
+void rt2x00mac_tx(struct ieee80211_hw *hw,
+                  struct ieee80211_tx_control *control,
+                  struct sk_buff *skb)
 {
         struct rt2x00_dev *rt2x00dev = hw->priv;
         struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c
index f7e74a0a7759..e488b944a034 100644
--- a/drivers/net/wireless/rt2x00/rt2x00queue.c
+++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
@@ -315,6 +315,7 @@ static void rt2x00queue_create_tx_descriptor_plcp(struct rt2x00_dev *rt2x00dev,
 static void rt2x00queue_create_tx_descriptor_ht(struct rt2x00_dev *rt2x00dev,
                                                 struct sk_buff *skb,
                                                 struct txentry_desc *txdesc,
+                                                struct ieee80211_sta *sta,
                                                 const struct rt2x00_rate *hwrate)
 {
         struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
@@ -322,11 +323,11 @@ static void rt2x00queue_create_tx_descriptor_ht(struct rt2x00_dev *rt2x00dev,
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
         struct rt2x00_sta *sta_priv = NULL;
 
-        if (tx_info->control.sta) {
+        if (sta) {
                 txdesc->u.ht.mpdu_density =
-                    tx_info->control.sta->ht_cap.ampdu_density;
+                    sta->ht_cap.ampdu_density;
 
-                sta_priv = sta_to_rt2x00_sta(tx_info->control.sta);
+                sta_priv = sta_to_rt2x00_sta(sta);
                 txdesc->u.ht.wcid = sta_priv->wcid;
         }
 
@@ -341,8 +342,8 @@ static void rt2x00queue_create_tx_descriptor_ht(struct rt2x00_dev *rt2x00dev,
                  * MIMO PS should be set to 1 for STA's using dynamic SM PS
                  * when using more then one tx stream (>MCS7).
                  */
-                if (tx_info->control.sta && txdesc->u.ht.mcs > 7 &&
-                    ((tx_info->control.sta->ht_cap.cap &
+                if (sta && txdesc->u.ht.mcs > 7 &&
+                    ((sta->ht_cap.cap &
                       IEEE80211_HT_CAP_SM_PS) >>
                      IEEE80211_HT_CAP_SM_PS_SHIFT) ==
                     WLAN_HT_CAP_SM_PS_DYNAMIC)
@@ -409,7 +410,8 @@ static void rt2x00queue_create_tx_descriptor_ht(struct rt2x00_dev *rt2x00dev,
 
 static void rt2x00queue_create_tx_descriptor(struct rt2x00_dev *rt2x00dev,
                                              struct sk_buff *skb,
-                                             struct txentry_desc *txdesc)
+                                             struct txentry_desc *txdesc,
+                                             struct ieee80211_sta *sta)
 {
         struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
@@ -503,7 +505,7 @@ static void rt2x00queue_create_tx_descriptor(struct rt2x00_dev *rt2x00dev,
 
         if (test_bit(REQUIRE_HT_TX_DESC, &rt2x00dev->cap_flags))
                 rt2x00queue_create_tx_descriptor_ht(rt2x00dev, skb, txdesc,
-                                                    hwrate);
+                                                   sta, hwrate);
         else
                 rt2x00queue_create_tx_descriptor_plcp(rt2x00dev, skb, txdesc,
                                                       hwrate);
@@ -595,7 +597,7 @@ int rt2x00queue_write_tx_frame(struct data_queue *queue, struct sk_buff *skb,
          * after that we are free to use the skb->cb array
          * for our information.
          */
-        rt2x00queue_create_tx_descriptor(queue->rt2x00dev, skb, &txdesc);
+        rt2x00queue_create_tx_descriptor(queue->rt2x00dev, skb, &txdesc, NULL);
 
         /*
          * All information is retrieved from the skb->cb array,
@@ -740,7 +742,7 @@ int rt2x00queue_update_beacon_locked(struct rt2x00_dev *rt2x00dev,
          * after that we are free to use the skb->cb array
          * for our information.
          */
-        rt2x00queue_create_tx_descriptor(rt2x00dev, intf->beacon->skb, &txdesc);
+        rt2x00queue_create_tx_descriptor(rt2x00dev, intf->beacon->skb, &txdesc, NULL);
 
         /*
          * Fill in skb descriptor
diff --git a/drivers/net/wireless/rtl818x/rtl8180/dev.c b/drivers/net/wireless/rtl818x/rtl8180/dev.c
index aceaf689f737..021d83e1b1d3 100644
--- a/drivers/net/wireless/rtl818x/rtl8180/dev.c
+++ b/drivers/net/wireless/rtl818x/rtl8180/dev.c
@@ -244,7 +244,9 @@ static irqreturn_t rtl8180_interrupt(int irq, void *dev_id)
         return IRQ_HANDLED;
 }
 
-static void rtl8180_tx(struct ieee80211_hw *dev, struct sk_buff *skb)
+static void rtl8180_tx(struct ieee80211_hw *dev,
+                       struct ieee80211_tx_control *control,
+                       struct sk_buff *skb)
 {
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
@@ -710,7 +712,7 @@ static void rtl8180_beacon_work(struct work_struct *work)
         /* TODO: use actual beacon queue */
         skb_set_queue_mapping(skb, 0);
 
-        rtl8180_tx(dev, skb);
+        rtl8180_tx(dev, NULL, skb);
 
 resched:
         /*
diff --git a/drivers/net/wireless/rtl818x/rtl8187/dev.c b/drivers/net/wireless/rtl818x/rtl8187/dev.c
index 533024095c43..7811b6315973 100644
--- a/drivers/net/wireless/rtl818x/rtl8187/dev.c
+++ b/drivers/net/wireless/rtl818x/rtl8187/dev.c
@@ -228,7 +228,9 @@ static void rtl8187_tx_cb(struct urb *urb)
         }
 }
 
-static void rtl8187_tx(struct ieee80211_hw *dev, struct sk_buff *skb)
+static void rtl8187_tx(struct ieee80211_hw *dev,
+                       struct ieee80211_tx_control *control,
+                       struct sk_buff *skb)
 {
         struct rtl8187_priv *priv = dev->priv;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
@@ -1076,7 +1078,7 @@ static void rtl8187_beacon_work(struct work_struct *work)
         /* TODO: use actual beacon queue */
         skb_set_queue_mapping(skb, 0);
 
-        rtl8187_tx(dev, skb);
+        rtl8187_tx(dev, NULL, skb);
 
 resched:
         /*
diff --git a/drivers/net/wireless/rtlwifi/base.c b/drivers/net/wireless/rtlwifi/base.c
index 942e56b77b60..59381fe8ed06 100644
--- a/drivers/net/wireless/rtlwifi/base.c
+++ b/drivers/net/wireless/rtlwifi/base.c
@@ -1341,9 +1341,8 @@ int rtl_send_smps_action(struct ieee80211_hw *hw,
                 rtlpriv->cfg->ops->update_rate_tbl(hw, sta, 0);
 
                 info->control.rates[0].idx = 0;
-                info->control.sta = sta;
                 info->band = hw->conf.channel->band;
-                rtlpriv->intf_ops->adapter_tx(hw, skb, &tcb_desc);
+                rtlpriv->intf_ops->adapter_tx(hw, sta, skb, &tcb_desc);
         }
 err_free:
         return 0;
diff --git a/drivers/net/wireless/rtlwifi/core.c b/drivers/net/wireless/rtlwifi/core.c
index a18ad2a98938..a7c0e52869ba 100644
--- a/drivers/net/wireless/rtlwifi/core.c
+++ b/drivers/net/wireless/rtlwifi/core.c
@@ -124,7 +124,9 @@ static void rtl_op_stop(struct ieee80211_hw *hw)
         mutex_unlock(&rtlpriv->locks.conf_mutex);
 }
 
-static void rtl_op_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
+static void rtl_op_tx(struct ieee80211_hw *hw,
+                      struct ieee80211_tx_control *control,
+                      struct sk_buff *skb)
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
         struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
@@ -138,8 +140,8 @@ static void rtl_op_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
         if (!test_bit(RTL_STATUS_INTERFACE_START, &rtlpriv->status))
                 goto err_free;
 
-        if (!rtlpriv->intf_ops->waitq_insert(hw, skb))
-                rtlpriv->intf_ops->adapter_tx(hw, skb, &tcb_desc);
+        if (!rtlpriv->intf_ops->waitq_insert(hw, control->sta, skb))
+                rtlpriv->intf_ops->adapter_tx(hw, control->sta, skb, &tcb_desc);
 
         return;
 
diff --git a/drivers/net/wireless/rtlwifi/pci.c b/drivers/net/wireless/rtlwifi/pci.c
index 80f75d3ba84a..aad9d44c0a51 100644
--- a/drivers/net/wireless/rtlwifi/pci.c
+++ b/drivers/net/wireless/rtlwifi/pci.c
@@ -504,7 +504,7 @@ static void _rtl_pci_tx_chk_waitq(struct ieee80211_hw *hw)
                                 _rtl_update_earlymode_info(hw, skb,
                                                            &tcb_desc, tid);
 
-                        rtlpriv->intf_ops->adapter_tx(hw, skb, &tcb_desc);
+                        rtlpriv->intf_ops->adapter_tx(hw, NULL, skb, &tcb_desc);
                 }
         }
 }
@@ -929,7 +929,7 @@ static void _rtl_pci_prepare_bcn_tasklet(struct ieee80211_hw *hw)
         info = IEEE80211_SKB_CB(pskb);
         pdesc = &ring->desc[0];
         rtlpriv->cfg->ops->fill_tx_desc(hw, hdr, (u8 *) pdesc,
-                info, pskb, BEACON_QUEUE, &tcb_desc);
+                info, NULL, pskb, BEACON_QUEUE, &tcb_desc);
 
         __skb_queue_tail(&ring->queue, pskb);
 
@@ -1305,11 +1305,10 @@ int rtl_pci_reset_trx_ring(struct ieee80211_hw *hw)
 }
 
 static bool rtl_pci_tx_chk_waitq_insert(struct ieee80211_hw *hw,
+                                        struct ieee80211_sta *sta,
                                         struct sk_buff *skb)
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
-        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-        struct ieee80211_sta *sta = info->control.sta;
         struct rtl_sta_info *sta_entry = NULL;
         u8 tid = rtl_get_tid(skb);
 
@@ -1337,13 +1336,14 @@ static bool rtl_pci_tx_chk_waitq_insert(struct ieee80211_hw *hw,
         return true;
 }
 
-static int rtl_pci_tx(struct ieee80211_hw *hw, struct sk_buff *skb,
-                struct rtl_tcb_desc *ptcb_desc)
+static int rtl_pci_tx(struct ieee80211_hw *hw,
+                      struct ieee80211_sta *sta,
+                      struct sk_buff *skb,
+                      struct rtl_tcb_desc *ptcb_desc)
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
         struct rtl_sta_info *sta_entry = NULL;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-        struct ieee80211_sta *sta = info->control.sta;
         struct rtl8192_tx_ring *ring;
         struct rtl_tx_desc *pdesc;
         u8 idx;
@@ -1418,7 +1418,7 @@ static int rtl_pci_tx(struct ieee80211_hw *hw, struct sk_buff *skb,
                 rtlpriv->cfg->ops->led_control(hw, LED_CTL_TX);
 
         rtlpriv->cfg->ops->fill_tx_desc(hw, hdr, (u8 *)pdesc,
-                        info, skb, hw_queue, ptcb_desc);
+                        info, sta, skb, hw_queue, ptcb_desc);
 
         __skb_queue_tail(&ring->queue, skb);
 
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/trx.c b/drivers/net/wireless/rtlwifi/rtl8192ce/trx.c
index 52166640f167..390d6d4fcaa0 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/trx.c
@@ -596,7 +596,9 @@ bool rtl92ce_rx_query_desc(struct ieee80211_hw *hw,
 
 void rtl92ce_tx_fill_desc(struct ieee80211_hw *hw,
                           struct ieee80211_hdr *hdr, u8 *pdesc_tx,
-                          struct ieee80211_tx_info *info, struct sk_buff *skb,
+                          struct ieee80211_tx_info *info,
+                          struct ieee80211_sta *sta,
+                          struct sk_buff *skb,
                           u8 hw_queue, struct rtl_tcb_desc *tcb_desc)
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
@@ -604,7 +606,6 @@ void rtl92ce_tx_fill_desc(struct ieee80211_hw *hw,
         struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
         struct rtl_ps_ctl *ppsc = rtl_psc(rtl_priv(hw));
         bool defaultadapter = true;
-        struct ieee80211_sta *sta;
         u8 *pdesc = pdesc_tx;
         u16 seq_number;
         __le16 fc = hdr->frame_control;
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/trx.h b/drivers/net/wireless/rtlwifi/rtl8192ce/trx.h
index c4adb9777365..a7cdd514cb2e 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/trx.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/trx.h
@@ -713,6 +713,7 @@ struct rx_desc_92c {
 void rtl92ce_tx_fill_desc(struct ieee80211_hw *hw,
                           struct ieee80211_hdr *hdr,
                           u8 *pdesc, struct ieee80211_tx_info *info,
+                          struct ieee80211_sta *sta,
                           struct sk_buff *skb, u8 hw_queue,
                           struct rtl_tcb_desc *ptcb_desc);
 bool rtl92ce_rx_query_desc(struct ieee80211_hw *hw,
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c b/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c
index 2e6eb356a93e..27863d773790 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c
@@ -496,7 +496,9 @@ static void _rtl_tx_desc_checksum(u8 *txdesc)
 
 void rtl92cu_tx_fill_desc(struct ieee80211_hw *hw,
                           struct ieee80211_hdr *hdr, u8 *pdesc_tx,
-                          struct ieee80211_tx_info *info, struct sk_buff *skb,
+                          struct ieee80211_tx_info *info,
+                          struct ieee80211_sta *sta,
+                          struct sk_buff *skb,
                           u8 queue_index,
                           struct rtl_tcb_desc *tcb_desc)
 {
@@ -504,7 +506,6 @@ void rtl92cu_tx_fill_desc(struct ieee80211_hw *hw,
         struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
         struct rtl_ps_ctl *ppsc = rtl_psc(rtl_priv(hw));
         bool defaultadapter = true;
-        struct ieee80211_sta *sta = info->control.sta = info->control.sta;
         u8 *qc = ieee80211_get_qos_ctl(hdr);
         u8 tid = qc[0] & IEEE80211_QOS_CTL_TID_MASK;
         u16 seq_number;
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/trx.h b/drivers/net/wireless/rtlwifi/rtl8192cu/trx.h
index 332b06e78b00..725c53accc58 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/trx.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/trx.h
@@ -420,7 +420,9 @@ struct sk_buff *rtl8192c_tx_aggregate_hdl(struct ieee80211_hw *,
                                            struct sk_buff_head *);
 void rtl92cu_tx_fill_desc(struct ieee80211_hw *hw,
                           struct ieee80211_hdr *hdr, u8 *pdesc_tx,
-                          struct ieee80211_tx_info *info, struct sk_buff *skb,
+                          struct ieee80211_tx_info *info,
+                          struct ieee80211_sta *sta,
+                          struct sk_buff *skb,
                           u8 queue_index,
                           struct rtl_tcb_desc *tcb_desc);
 void rtl92cu_fill_fake_txdesc(struct ieee80211_hw *hw, u8 * pDesc,
diff --git a/drivers/net/wireless/rtlwifi/rtl8192de/trx.c b/drivers/net/wireless/rtlwifi/rtl8192de/trx.c
index f80690d82c11..4686f340b9d6 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192de/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192de/trx.c
@@ -551,7 +551,9 @@ static void _rtl92de_insert_emcontent(struct rtl_tcb_desc *ptcb_desc,
 
 void rtl92de_tx_fill_desc(struct ieee80211_hw *hw,
                           struct ieee80211_hdr *hdr, u8 *pdesc_tx,
-                          struct ieee80211_tx_info *info, struct sk_buff *skb,
+                          struct ieee80211_tx_info *info,
+                          struct ieee80211_sta *sta,
+                          struct sk_buff *skb,
                           u8 hw_queue, struct rtl_tcb_desc *ptcb_desc)
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
@@ -559,7 +561,6 @@ void rtl92de_tx_fill_desc(struct ieee80211_hw *hw,
         struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
         struct rtl_hal *rtlhal = rtl_hal(rtlpriv);
         struct rtl_ps_ctl *ppsc = rtl_psc(rtl_priv(hw));
-        struct ieee80211_sta *sta = info->control.sta;
         u8 *pdesc = pdesc_tx;
         u16 seq_number;
         __le16 fc = hdr->frame_control;
diff --git a/drivers/net/wireless/rtlwifi/rtl8192de/trx.h b/drivers/net/wireless/rtlwifi/rtl8192de/trx.h
index 057a52431b00..c1b5dfb79d53 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192de/trx.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192de/trx.h
@@ -730,6 +730,7 @@ struct rx_desc_92d {
 void rtl92de_tx_fill_desc(struct ieee80211_hw *hw,
                           struct ieee80211_hdr *hdr,
                           u8 *pdesc, struct ieee80211_tx_info *info,
+                          struct ieee80211_sta *sta,
                           struct sk_buff *skb, u8 hw_queue,
                           struct rtl_tcb_desc *ptcb_desc);
 bool rtl92de_rx_query_desc(struct ieee80211_hw *hw,
diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/trx.c b/drivers/net/wireless/rtlwifi/rtl8192se/trx.c
index 36d1cb3aef8a..28c53fb12aeb 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192se/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192se/trx.c
@@ -591,14 +591,15 @@ bool rtl92se_rx_query_desc(struct ieee80211_hw *hw, struct rtl_stats *stats,
 
 void rtl92se_tx_fill_desc(struct ieee80211_hw *hw,
                 struct ieee80211_hdr *hdr, u8 *pdesc_tx,
-                struct ieee80211_tx_info *info, struct sk_buff *skb,
+                struct ieee80211_tx_info *info,
+                struct ieee80211_sta *sta,
+                struct sk_buff *skb,
                 u8 hw_queue, struct rtl_tcb_desc *ptcb_desc)
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
         struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
         struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
         struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
-        struct ieee80211_sta *sta = info->control.sta;
         u8 *pdesc = pdesc_tx;
         u16 seq_number;
         __le16 fc = hdr->frame_control;
diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/trx.h b/drivers/net/wireless/rtlwifi/rtl8192se/trx.h
index 011e7b0695f2..64dd66f287c1 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192se/trx.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192se/trx.h
@@ -31,6 +31,7 @@
 
 void rtl92se_tx_fill_desc(struct ieee80211_hw *hw, struct ieee80211_hdr *hdr,
                           u8 *pdesc, struct ieee80211_tx_info *info,
+                          struct ieee80211_sta *sta,
                           struct sk_buff *skb, u8 hw_queue,
                           struct rtl_tcb_desc *ptcb_desc);
 void rtl92se_tx_fill_cmddesc(struct ieee80211_hw *hw, u8 *pdesc, bool firstseg,
diff --git a/drivers/net/wireless/rtlwifi/usb.c b/drivers/net/wireless/rtlwifi/usb.c
index aa970fc18a21..914046903cfd 100644
--- a/drivers/net/wireless/rtlwifi/usb.c
+++ b/drivers/net/wireless/rtlwifi/usb.c
@@ -848,8 +848,10 @@ static void _rtl_usb_transmit(struct ieee80211_hw *hw, struct sk_buff *skb,
         _rtl_submit_tx_urb(hw, _urb);
 }
 
-static void _rtl_usb_tx_preprocess(struct ieee80211_hw *hw, struct sk_buff *skb,
-                            u16 hw_queue)
+static void _rtl_usb_tx_preprocess(struct ieee80211_hw *hw,
+                                   struct ieee80211_sta *sta,
+                                   struct sk_buff *skb,
+                                   u16 hw_queue)
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
         struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
@@ -891,7 +893,7 @@ static void _rtl_usb_tx_preprocess(struct ieee80211_hw *hw, struct sk_buff *skb,
                 seq_number += 1;
                 seq_number <<= 4;
         }
-        rtlpriv->cfg->ops->fill_tx_desc(hw, hdr, (u8 *)pdesc, info, skb,
+        rtlpriv->cfg->ops->fill_tx_desc(hw, hdr, (u8 *)pdesc, info, sta, skb,
                                         hw_queue, &tcb_desc);
         if (!ieee80211_has_morefrags(hdr->frame_control)) {
                 if (qc)
@@ -901,7 +903,9 @@ static void _rtl_usb_tx_preprocess(struct ieee80211_hw *hw, struct sk_buff *skb,
                 rtlpriv->cfg->ops->led_control(hw, LED_CTL_TX);
 }
 
-static int rtl_usb_tx(struct ieee80211_hw *hw, struct sk_buff *skb,
+static int rtl_usb_tx(struct ieee80211_hw *hw,
+                      struct ieee80211_sta *sta,
+                      struct sk_buff *skb,
                       struct rtl_tcb_desc *dummy)
 {
         struct rtl_usb *rtlusb = rtl_usbdev(rtl_usbpriv(hw));
@@ -913,7 +917,7 @@ static int rtl_usb_tx(struct ieee80211_hw *hw, struct sk_buff *skb,
         if (unlikely(is_hal_stop(rtlhal)))
                 goto err_free;
         hw_queue = rtlusb->usb_mq_to_hwq(fc, skb_get_queue_mapping(skb));
-        _rtl_usb_tx_preprocess(hw, skb, hw_queue);
+        _rtl_usb_tx_preprocess(hw, sta, skb, hw_queue);
         _rtl_usb_transmit(hw, skb, hw_queue);
         return NETDEV_TX_OK;
 
@@ -923,6 +927,7 @@ err_free:
 }
 
 static bool rtl_usb_tx_chk_waitq_insert(struct ieee80211_hw *hw,
+                                        struct ieee80211_sta *sta,
                                         struct sk_buff *skb)
 {
         return false;
diff --git a/drivers/net/wireless/rtlwifi/wifi.h b/drivers/net/wireless/rtlwifi/wifi.h
index cdaa21f29710..40153e7bf702 100644
--- a/drivers/net/wireless/rtlwifi/wifi.h
+++ b/drivers/net/wireless/rtlwifi/wifi.h
@@ -122,7 +122,7 @@ enum rt_eeprom_type {
         EEPROM_BOOT_EFUSE,
 };
 
-enum rtl_status {
+enum ttl_status {
         RTL_STATUS_INTERFACE_START = 0,
 };
 
@@ -1418,6 +1418,7 @@ struct rtl_hal_ops {
         void (*fill_tx_desc) (struct ieee80211_hw *hw,
                               struct ieee80211_hdr *hdr, u8 *pdesc_tx,
                               struct ieee80211_tx_info *info,
+                              struct ieee80211_sta *sta,
                               struct sk_buff *skb, u8 hw_queue,
                               struct rtl_tcb_desc *ptcb_desc);
         void (*fill_fake_txdesc) (struct ieee80211_hw *hw, u8 *pDesc,
@@ -1475,11 +1476,15 @@ struct rtl_intf_ops {
         int (*adapter_start) (struct ieee80211_hw *hw);
         void (*adapter_stop) (struct ieee80211_hw *hw);
 
-        int (*adapter_tx) (struct ieee80211_hw *hw, struct sk_buff *skb,
-                        struct rtl_tcb_desc *ptcb_desc);
+        int (*adapter_tx) (struct ieee80211_hw *hw,
+                           struct ieee80211_sta *sta,
+                           struct sk_buff *skb,
+                           struct rtl_tcb_desc *ptcb_desc);
         void (*flush)(struct ieee80211_hw *hw, bool drop);
         int (*reset_trx_ring) (struct ieee80211_hw *hw);
-        bool (*waitq_insert) (struct ieee80211_hw *hw, struct sk_buff *skb);
+        bool (*waitq_insert) (struct ieee80211_hw *hw,
+                              struct ieee80211_sta *sta,
+                              struct sk_buff *skb);
 
         /*pci */
         void (*disable_aspm) (struct ieee80211_hw *hw);
diff --git a/drivers/net/wireless/ti/wl1251/main.c b/drivers/net/wireless/ti/wl1251/main.c
index 3118c425bcf1..441cbccbd381 100644
--- a/drivers/net/wireless/ti/wl1251/main.c
+++ b/drivers/net/wireless/ti/wl1251/main.c
@@ -354,7 +354,9 @@ out:
         return ret;
 }
 
-static void wl1251_op_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
+static void wl1251_op_tx(struct ieee80211_hw *hw,
+                         struct ieee80211_tx_control *control,
+                         struct sk_buff *skb)
 {
         struct wl1251 *wl = hw->priv;
         unsigned long flags;
diff --git a/drivers/net/wireless/ti/wlcore/main.c b/drivers/net/wireless/ti/wlcore/main.c
index 72548609f711..ff830cf50c70 100644
--- a/drivers/net/wireless/ti/wlcore/main.c
+++ b/drivers/net/wireless/ti/wlcore/main.c
@@ -1181,7 +1181,9 @@ out:
         return ret;
 }
 
-static void wl1271_op_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
+static void wl1271_op_tx(struct ieee80211_hw *hw,
+                         struct ieee80211_tx_control *control,
+                         struct sk_buff *skb)
 {
         struct wl1271 *wl = hw->priv;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
@@ -1197,7 +1199,7 @@ static void wl1271_op_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
         mapping = skb_get_queue_mapping(skb);
         q = wl1271_tx_get_queue(mapping);
 
-        hlid = wl12xx_tx_get_hlid(wl, wlvif, skb);
+        hlid = wl12xx_tx_get_hlid(wl, wlvif, skb, control->sta);
 
         spin_lock_irqsave(&wl->wl_lock, flags);
 
diff --git a/drivers/net/wireless/ti/wlcore/tx.c b/drivers/net/wireless/ti/wlcore/tx.c
index f0081f746482..1a2f31c289c5 100644
--- a/drivers/net/wireless/ti/wlcore/tx.c
+++ b/drivers/net/wireless/ti/wlcore/tx.c
@@ -130,16 +130,13 @@ bool wl12xx_is_dummy_packet(struct wl1271 *wl, struct sk_buff *skb)
 }
 EXPORT_SYMBOL(wl12xx_is_dummy_packet);
 
-u8 wl12xx_tx_get_hlid_ap(struct wl1271 *wl, struct wl12xx_vif *wlvif,
-                         struct sk_buff *skb)
+static u8 wl12xx_tx_get_hlid_ap(struct wl1271 *wl, struct wl12xx_vif *wlvif,
+                                struct sk_buff *skb, struct ieee80211_sta *sta)
 {
-        struct ieee80211_tx_info *control = IEEE80211_SKB_CB(skb);
-
-        if (control->control.sta) {
+        if (sta) {
                 struct wl1271_station *wl_sta;
 
-                wl_sta = (struct wl1271_station *)
-                                control->control.sta->drv_priv;
+                wl_sta = (struct wl1271_station *)sta->drv_priv;
                 return wl_sta->hlid;
         } else {
                 struct ieee80211_hdr *hdr;
@@ -156,7 +153,7 @@ u8 wl12xx_tx_get_hlid_ap(struct wl1271 *wl, struct wl12xx_vif *wlvif,
 }
 
 u8 wl12xx_tx_get_hlid(struct wl1271 *wl, struct wl12xx_vif *wlvif,
-                      struct sk_buff *skb)
+                      struct sk_buff *skb, struct ieee80211_sta *sta)
 {
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
 
@@ -164,7 +161,7 @@ u8 wl12xx_tx_get_hlid(struct wl1271 *wl, struct wl12xx_vif *wlvif,
                 return wl->system_hlid;
 
         if (wlvif->bss_type == BSS_TYPE_AP_BSS)
-                return wl12xx_tx_get_hlid_ap(wl, wlvif, skb);
+                return wl12xx_tx_get_hlid_ap(wl, wlvif, skb, sta);
 
         if ((test_bit(WLVIF_FLAG_STA_ASSOCIATED, &wlvif->flags) ||
              test_bit(WLVIF_FLAG_IBSS_JOINED, &wlvif->flags)) &&
@@ -344,13 +341,12 @@ static void wl1271_tx_fill_hdr(struct wl1271 *wl, struct wl12xx_vif *wlvif,
 
 /* caller must hold wl->mutex */
 static int wl1271_prepare_tx_frame(struct wl1271 *wl, struct wl12xx_vif *wlvif,
-                                   struct sk_buff *skb, u32 buf_offset)
+                                   struct sk_buff *skb, u32 buf_offset, u8 hlid)
 {
         struct ieee80211_tx_info *info;
         u32 extra = 0;
         int ret = 0;
         u32 total_len;
-        u8 hlid;
         bool is_dummy;
         bool is_gem = false;
 
@@ -359,9 +355,13 @@ static int wl1271_prepare_tx_frame(struct wl1271 *wl, struct wl12xx_vif *wlvif,
                 return -EINVAL;
         }
 
+        if (hlid == WL12XX_INVALID_LINK_ID) {
+                wl1271_error("invalid hlid. dropping skb 0x%p", skb);
+                return -EINVAL;
+        }
+
         info = IEEE80211_SKB_CB(skb);
 
-        /* TODO: handle dummy packets on multi-vifs */
         is_dummy = wl12xx_is_dummy_packet(wl, skb);
 
         if ((wl->quirks & WLCORE_QUIRK_TKIP_HEADER_SPACE) &&
@@ -386,11 +386,6 @@ static int wl1271_prepare_tx_frame(struct wl1271 *wl, struct wl12xx_vif *wlvif,
 
                 is_gem = (cipher == WL1271_CIPHER_SUITE_GEM);
         }
-        hlid = wl12xx_tx_get_hlid(wl, wlvif, skb);
-        if (hlid == WL12XX_INVALID_LINK_ID) {
-                wl1271_error("invalid hlid. dropping skb 0x%p", skb);
-                return -EINVAL;
-        }
 
         ret = wl1271_tx_allocate(wl, wlvif, skb, extra, buf_offset, hlid,
                                  is_gem);
@@ -517,7 +512,8 @@ static struct sk_buff *wl12xx_lnk_skb_dequeue(struct wl1271 *wl,
 }
 
 static struct sk_buff *wl12xx_vif_skb_dequeue(struct wl1271 *wl,
-                                              struct wl12xx_vif *wlvif)
+                                              struct wl12xx_vif *wlvif,
+                                              u8 *hlid)
 {
         struct sk_buff *skb = NULL;
         int i, h, start_hlid;
@@ -544,10 +540,11 @@ static struct sk_buff *wl12xx_vif_skb_dequeue(struct wl1271 *wl,
         if (!skb)
                 wlvif->last_tx_hlid = 0;
 
+        *hlid = wlvif->last_tx_hlid;
         return skb;
 }
 
-static struct sk_buff *wl1271_skb_dequeue(struct wl1271 *wl)
+static struct sk_buff *wl1271_skb_dequeue(struct wl1271 *wl, u8 *hlid)
 {
         unsigned long flags;
         struct wl12xx_vif *wlvif = wl->last_wlvif;
@@ -556,7 +553,7 @@ static struct sk_buff *wl1271_skb_dequeue(struct wl1271 *wl)
         /* continue from last wlvif (round robin) */
         if (wlvif) {
                 wl12xx_for_each_wlvif_continue(wl, wlvif) {
-                        skb = wl12xx_vif_skb_dequeue(wl, wlvif);
+                        skb = wl12xx_vif_skb_dequeue(wl, wlvif, hlid);
                         if (skb) {
                                 wl->last_wlvif = wlvif;
                                 break;
@@ -565,13 +562,15 @@ static struct sk_buff *wl1271_skb_dequeue(struct wl1271 *wl)
         }
 
         /* dequeue from the system HLID before the restarting wlvif list */
-        if (!skb)
+        if (!skb) {
                 skb = wl12xx_lnk_skb_dequeue(wl, &wl->links[wl->system_hlid]);
+                *hlid = wl->system_hlid;
+        }
 
         /* do a new pass over the wlvif list */
         if (!skb) {
                 wl12xx_for_each_wlvif(wl, wlvif) {
-                        skb = wl12xx_vif_skb_dequeue(wl, wlvif);
+                        skb = wl12xx_vif_skb_dequeue(wl, wlvif, hlid);
                         if (skb) {
                                 wl->last_wlvif = wlvif;
                                 break;
@@ -591,6 +590,7 @@ static struct sk_buff *wl1271_skb_dequeue(struct wl1271 *wl)
                 int q;
 
                 skb = wl->dummy_packet;
+                *hlid = wl->system_hlid;
                 q = wl1271_tx_get_queue(skb_get_queue_mapping(skb));
                 spin_lock_irqsave(&wl->wl_lock, flags);
                 WARN_ON_ONCE(wl->tx_queue_count[q] <= 0);
@@ -602,7 +602,7 @@ static struct sk_buff *wl1271_skb_dequeue(struct wl1271 *wl)
 }
 
 static void wl1271_skb_queue_head(struct wl1271 *wl, struct wl12xx_vif *wlvif,
-                                  struct sk_buff *skb)
+                                  struct sk_buff *skb, u8 hlid)
 {
         unsigned long flags;
         int q = wl1271_tx_get_queue(skb_get_queue_mapping(skb));
@@ -610,7 +610,6 @@ static void wl1271_skb_queue_head(struct wl1271 *wl, struct wl12xx_vif *wlvif,
         if (wl12xx_is_dummy_packet(wl, skb)) {
                 set_bit(WL1271_FLAG_DUMMY_PACKET_PENDING, &wl->flags);
         } else {
-                u8 hlid = wl12xx_tx_get_hlid(wl, wlvif, skb);
                 skb_queue_head(&wl->links[hlid].tx_queue[q], skb);
 
                 /* make sure we dequeue the same packet next time */
@@ -686,26 +685,30 @@ int wlcore_tx_work_locked(struct wl1271 *wl)
         unsigned long active_hlids[BITS_TO_LONGS(WL12XX_MAX_LINKS)] = {0};
         int ret = 0;
         int bus_ret = 0;
+        u8 hlid;
 
         if (unlikely(wl->state == WL1271_STATE_OFF))
                 return 0;
 
-        while ((skb = wl1271_skb_dequeue(wl))) {
+        while ((skb = wl1271_skb_dequeue(wl, &hlid))) {
                 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
                 bool has_data = false;
 
                 wlvif = NULL;
                 if (!wl12xx_is_dummy_packet(wl, skb) && info->control.vif)
                         wlvif = wl12xx_vif_to_data(info->control.vif);
+                else
+                        hlid = wl->system_hlid;
 
                 has_data = wlvif && wl1271_tx_is_data_present(skb);
-                ret = wl1271_prepare_tx_frame(wl, wlvif, skb, buf_offset);
+                ret = wl1271_prepare_tx_frame(wl, wlvif, skb, buf_offset,
+                                              hlid);
                 if (ret == -EAGAIN) {
                         /*
                          * Aggregation buffer is full.
                          * Flush buffer and try again.
                          */
-                        wl1271_skb_queue_head(wl, wlvif, skb);
+                        wl1271_skb_queue_head(wl, wlvif, skb, hlid);
 
                         buf_offset = wlcore_hw_pre_pkt_send(wl, buf_offset,
                                                             last_len);
@@ -722,7 +725,7 @@ int wlcore_tx_work_locked(struct wl1271 *wl)
                          * Firmware buffer is full.
                          * Queue back last skb, and stop aggregating.
                          */
-                        wl1271_skb_queue_head(wl, wlvif, skb);
+                        wl1271_skb_queue_head(wl, wlvif, skb, hlid);
                         /* No work left, avoid scheduling redundant tx work */
                         set_bit(WL1271_FLAG_FW_TX_BUSY, &wl->flags);
                         goto out_ack;
@@ -732,7 +735,7 @@ int wlcore_tx_work_locked(struct wl1271 *wl)
                                  * fw still expects dummy packet,
                                  * so re-enqueue it
                                  */
-                                wl1271_skb_queue_head(wl, wlvif, skb);
+                                wl1271_skb_queue_head(wl, wlvif, skb, hlid);
                         else
                                 ieee80211_free_txskb(wl->hw, skb);
                         goto out_ack;
diff --git a/drivers/net/wireless/ti/wlcore/tx.h b/drivers/net/wireless/ti/wlcore/tx.h
index 1e939b016155..349520d8b724 100644
--- a/drivers/net/wireless/ti/wlcore/tx.h
+++ b/drivers/net/wireless/ti/wlcore/tx.h
@@ -243,10 +243,8 @@ u8 wlcore_rate_to_idx(struct wl1271 *wl, u8 rate, enum ieee80211_band band);
 u32 wl1271_tx_enabled_rates_get(struct wl1271 *wl, u32 rate_set,
                                 enum ieee80211_band rate_band);
 u32 wl1271_tx_min_rate_get(struct wl1271 *wl, u32 rate_set);
-u8 wl12xx_tx_get_hlid_ap(struct wl1271 *wl, struct wl12xx_vif *wlvif,
-                         struct sk_buff *skb);
 u8 wl12xx_tx_get_hlid(struct wl1271 *wl, struct wl12xx_vif *wlvif,
-                      struct sk_buff *skb);
+                      struct sk_buff *skb, struct ieee80211_sta *sta);
 void wl1271_tx_reset_link_queues(struct wl1271 *wl, u8 hlid);
 void wl1271_handle_tx_low_watermark(struct wl1271 *wl);
 bool wl12xx_is_dummy_packet(struct wl1271 *wl, struct sk_buff *skb);
diff --git a/drivers/net/wireless/zd1211rw/zd_mac.c b/drivers/net/wireless/zd1211rw/zd_mac.c
index c9e2660e1263..459880104758 100644
--- a/drivers/net/wireless/zd1211rw/zd_mac.c
+++ b/drivers/net/wireless/zd1211rw/zd_mac.c
@@ -937,7 +937,9 @@ static int fill_ctrlset(struct zd_mac *mac,
  * control block of the skbuff will be initialized. If necessary the incoming
  * mac80211 queues will be stopped.
  */
-static void zd_op_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
+static void zd_op_tx(struct ieee80211_hw *hw,
+                     struct ieee80211_tx_control *control,
+                     struct sk_buff *skb)
 {
         struct zd_mac *mac = zd_hw_mac(hw);
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
@@ -1176,7 +1178,7 @@ static void zd_beacon_done(struct zd_mac *mac)
                 skb = ieee80211_get_buffered_bc(mac->hw, mac->vif);
                 if (!skb)
                         break;
-                zd_op_tx(mac->hw, skb);
+                zd_op_tx(mac->hw, NULL, skb);
         }
 
         /*