Merge branch 'linus' into cpumask-for-linus

Conflicts:
	arch/x86/kernel/cpu/common.c

39 files changed, 5780 insertions, 3895 deletions

diff --git a/net/mac80211/Makefile b/net/mac80211/Makefile
index 7d4971aa443f..0e3ab88bb706 100644
--- a/net/mac80211/Makefile
+++ b/net/mac80211/Makefile
@@ -8,13 +8,15 @@ mac80211-y := \
         wep.o \
         wpa.o \
         scan.o \
-        ht.o \
+        ht.o agg-tx.o agg-rx.o \
+        ibss.o \
         mlme.o \
         iface.o \
         rate.o \
         michael.o \
         tkip.o \
         aes_ccm.o \
+        aes_cmac.o \
         cfg.o \
         rx.o \
         spectmgmt.o \
@@ -37,6 +39,8 @@ mac80211-$(CONFIG_MAC80211_MESH) += \
         mesh_plink.o \
         mesh_hwmp.o
 
+mac80211-$(CONFIG_PM) += pm.o
+
 # objects for PID algorithm
 rc80211_pid-y := rc80211_pid_algo.o
 rc80211_pid-$(CONFIG_MAC80211_DEBUGFS) += rc80211_pid_debugfs.o
diff --git a/net/mac80211/aes_cmac.c b/net/mac80211/aes_cmac.c
new file mode 100644
index 000000000000..3d097b3d7b62
--- /dev/null
+++ b/net/mac80211/aes_cmac.c
@@ -0,0 +1,135 @@
+/*
+ * AES-128-CMAC with TLen 16 for IEEE 802.11w BIP
+ * Copyright 2008, Jouni Malinen <j@w1.fi>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/kernel.h>
+#include <linux/types.h>
+#include <linux/crypto.h>
+#include <linux/err.h>
+
+#include <net/mac80211.h>
+#include "key.h"
+#include "aes_cmac.h"
+
+#define AES_BLOCK_SIZE 16
+#define AES_CMAC_KEY_LEN 16
+#define CMAC_TLEN 8 /* CMAC TLen = 64 bits (8 octets) */
+#define AAD_LEN 20
+
+
+static void gf_mulx(u8 *pad)
+{
+        int i, carry;
+
+        carry = pad[0] & 0x80;
+        for (i = 0; i < AES_BLOCK_SIZE - 1; i++)
+                pad[i] = (pad[i] << 1) | (pad[i + 1] >> 7);
+        pad[AES_BLOCK_SIZE - 1] <<= 1;
+        if (carry)
+                pad[AES_BLOCK_SIZE - 1] ^= 0x87;
+}
+
+
+static void aes_128_cmac_vector(struct crypto_cipher *tfm, u8 *scratch,
+                                size_t num_elem,
+                                const u8 *addr[], const size_t *len, u8 *mac)
+{
+        u8 *cbc, *pad;
+        const u8 *pos, *end;
+        size_t i, e, left, total_len;
+
+        cbc = scratch;
+        pad = scratch + AES_BLOCK_SIZE;
+
+        memset(cbc, 0, AES_BLOCK_SIZE);
+
+        total_len = 0;
+        for (e = 0; e < num_elem; e++)
+                total_len += len[e];
+        left = total_len;
+
+        e = 0;
+        pos = addr[0];
+        end = pos + len[0];
+
+        while (left >= AES_BLOCK_SIZE) {
+                for (i = 0; i < AES_BLOCK_SIZE; i++) {
+                        cbc[i] ^= *pos++;
+                        if (pos >= end) {
+                                e++;
+                                pos = addr[e];
+                                end = pos + len[e];
+                        }
+                }
+                if (left > AES_BLOCK_SIZE)
+                        crypto_cipher_encrypt_one(tfm, cbc, cbc);
+                left -= AES_BLOCK_SIZE;
+        }
+
+        memset(pad, 0, AES_BLOCK_SIZE);
+        crypto_cipher_encrypt_one(tfm, pad, pad);
+        gf_mulx(pad);
+
+        if (left || total_len == 0) {
+                for (i = 0; i < left; i++) {
+                        cbc[i] ^= *pos++;
+                        if (pos >= end) {
+                                e++;
+                                pos = addr[e];
+                                end = pos + len[e];
+                        }
+                }
+                cbc[left] ^= 0x80;
+                gf_mulx(pad);
+        }
+
+        for (i = 0; i < AES_BLOCK_SIZE; i++)
+                pad[i] ^= cbc[i];
+        crypto_cipher_encrypt_one(tfm, pad, pad);
+        memcpy(mac, pad, CMAC_TLEN);
+}
+
+
+void ieee80211_aes_cmac(struct crypto_cipher *tfm, u8 *scratch, const u8 *aad,
+                        const u8 *data, size_t data_len, u8 *mic)
+{
+        const u8 *addr[3];
+        size_t len[3];
+        u8 zero[CMAC_TLEN];
+
+        memset(zero, 0, CMAC_TLEN);
+        addr[0] = aad;
+        len[0] = AAD_LEN;
+        addr[1] = data;
+        len[1] = data_len - CMAC_TLEN;
+        addr[2] = zero;
+        len[2] = CMAC_TLEN;
+
+        aes_128_cmac_vector(tfm, scratch, 3, addr, len, mic);
+}
+
+
+struct crypto_cipher * ieee80211_aes_cmac_key_setup(const u8 key[])
+{
+        struct crypto_cipher *tfm;
+
+        tfm = crypto_alloc_cipher("aes", 0, CRYPTO_ALG_ASYNC);
+        if (IS_ERR(tfm))
+                return NULL;
+
+        crypto_cipher_setkey(tfm, key, AES_CMAC_KEY_LEN);
+
+        return tfm;
+}
+
+
+void ieee80211_aes_cmac_key_free(struct crypto_cipher *tfm)
+{
+        if (tfm)
+                crypto_free_cipher(tfm);
+}
diff --git a/net/mac80211/aes_cmac.h b/net/mac80211/aes_cmac.h
new file mode 100644
index 000000000000..0eb9a4831508
--- /dev/null
+++ b/net/mac80211/aes_cmac.h
@@ -0,0 +1,19 @@
+/*
+ * Copyright 2008, Jouni Malinen <j@w1.fi>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#ifndef AES_CMAC_H
+#define AES_CMAC_H
+
+#include <linux/crypto.h>
+
+struct crypto_cipher * ieee80211_aes_cmac_key_setup(const u8 key[]);
+void ieee80211_aes_cmac(struct crypto_cipher *tfm, u8 *scratch, const u8 *aad,
+                        const u8 *data, size_t data_len, u8 *mic);
+void ieee80211_aes_cmac_key_free(struct crypto_cipher *tfm);
+
+#endif /* AES_CMAC_H */
diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c
new file mode 100644
index 000000000000..07656d830bc4
--- /dev/null
+++ b/net/mac80211/agg-rx.c
@@ -0,0 +1,310 @@
+/*
+ * HT handling
+ *
+ * Copyright 2003, Jouni Malinen <jkmaline@cc.hut.fi>
+ * Copyright 2002-2005, Instant802 Networks, Inc.
+ * Copyright 2005-2006, Devicescape Software, Inc.
+ * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
+ * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
+ * Copyright 2007-2008, Intel Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/ieee80211.h>
+#include <net/mac80211.h>
+#include "ieee80211_i.h"
+
+void __ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid,
+                                    u16 initiator, u16 reason)
+{
+        struct ieee80211_local *local = sta->local;
+        struct ieee80211_hw *hw = &local->hw;
+        int i;
+
+        /* check if TID is in operational state */
+        spin_lock_bh(&sta->lock);
+        if (sta->ampdu_mlme.tid_state_rx[tid] != HT_AGG_STATE_OPERATIONAL) {
+                spin_unlock_bh(&sta->lock);
+                return;
+        }
+
+        sta->ampdu_mlme.tid_state_rx[tid] =
+                HT_AGG_STATE_REQ_STOP_BA_MSK |
+                (initiator << HT_AGG_STATE_INITIATOR_SHIFT);
+        spin_unlock_bh(&sta->lock);
+
+#ifdef CONFIG_MAC80211_HT_DEBUG
+        printk(KERN_DEBUG "Rx BA session stop requested for %pM tid %u\n",
+               sta->sta.addr, tid);
+#endif /* CONFIG_MAC80211_HT_DEBUG */
+
+        if (local->ops->ampdu_action(hw, IEEE80211_AMPDU_RX_STOP,
+                                     &sta->sta, tid, NULL))
+                printk(KERN_DEBUG "HW problem - can not stop rx "
+                                "aggregation for tid %d\n", tid);
+
+        /* shutdown timer has not expired */
+        if (initiator != WLAN_BACK_TIMER)
+                del_timer_sync(&sta->ampdu_mlme.tid_rx[tid]->session_timer);
+
+        /* check if this is a self generated aggregation halt */
+        if (initiator == WLAN_BACK_RECIPIENT || initiator == WLAN_BACK_TIMER)
+                ieee80211_send_delba(sta->sdata, sta->sta.addr,
+                                     tid, 0, reason);
+
+        /* free the reordering buffer */
+        for (i = 0; i < sta->ampdu_mlme.tid_rx[tid]->buf_size; i++) {
+                if (sta->ampdu_mlme.tid_rx[tid]->reorder_buf[i]) {
+                        /* release the reordered frames */
+                        dev_kfree_skb(sta->ampdu_mlme.tid_rx[tid]->reorder_buf[i]);
+                        sta->ampdu_mlme.tid_rx[tid]->stored_mpdu_num--;
+                        sta->ampdu_mlme.tid_rx[tid]->reorder_buf[i] = NULL;
+                }
+        }
+
+        spin_lock_bh(&sta->lock);
+        /* free resources */
+        kfree(sta->ampdu_mlme.tid_rx[tid]->reorder_buf);
+
+        if (!sta->ampdu_mlme.tid_rx[tid]->shutdown) {
+                kfree(sta->ampdu_mlme.tid_rx[tid]);
+                sta->ampdu_mlme.tid_rx[tid] = NULL;
+        }
+
+        sta->ampdu_mlme.tid_state_rx[tid] = HT_AGG_STATE_IDLE;
+        spin_unlock_bh(&sta->lock);
+}
+
+void ieee80211_sta_stop_rx_ba_session(struct ieee80211_sub_if_data *sdata, u8 *ra, u16 tid,
+                                        u16 initiator, u16 reason)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct sta_info *sta;
+
+        /* stop HW Rx aggregation. ampdu_action existence
+         * already verified in session init so we add the BUG_ON */
+        BUG_ON(!local->ops->ampdu_action);
+
+        rcu_read_lock();
+
+        sta = sta_info_get(local, ra);
+        if (!sta) {
+                rcu_read_unlock();
+                return;
+        }
+
+        __ieee80211_stop_rx_ba_session(sta, tid, initiator, reason);
+
+        rcu_read_unlock();
+}
+
+/*
+ * After accepting the AddBA Request we activated a timer,
+ * resetting it after each frame that arrives from the originator.
+ * if this timer expires ieee80211_sta_stop_rx_ba_session will be executed.
+ */
+static void sta_rx_agg_session_timer_expired(unsigned long data)
+{
+        /* not an elegant detour, but there is no choice as the timer passes
+         * only one argument, and various sta_info are needed here, so init
+         * flow in sta_info_create gives the TID as data, while the timer_to_id
+         * array gives the sta through container_of */
+        u8 *ptid = (u8 *)data;
+        u8 *timer_to_id = ptid - *ptid;
+        struct sta_info *sta = container_of(timer_to_id, struct sta_info,
+                                         timer_to_tid[0]);
+
+#ifdef CONFIG_MAC80211_HT_DEBUG
+        printk(KERN_DEBUG "rx session timer expired on tid %d\n", (u16)*ptid);
+#endif
+        ieee80211_sta_stop_rx_ba_session(sta->sdata, sta->sta.addr,
+                                         (u16)*ptid, WLAN_BACK_TIMER,
+                                         WLAN_REASON_QSTA_TIMEOUT);
+}
+
+static void ieee80211_send_addba_resp(struct ieee80211_sub_if_data *sdata, u8 *da, u16 tid,
+                                      u8 dialog_token, u16 status, u16 policy,
+                                      u16 buf_size, u16 timeout)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct sk_buff *skb;
+        struct ieee80211_mgmt *mgmt;
+        u16 capab;
+
+        skb = dev_alloc_skb(sizeof(*mgmt) + local->hw.extra_tx_headroom);
+
+        if (!skb) {
+                printk(KERN_DEBUG "%s: failed to allocate buffer "
+                       "for addba resp frame\n", sdata->dev->name);
+                return;
+        }
+
+        skb_reserve(skb, local->hw.extra_tx_headroom);
+        mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
+        memset(mgmt, 0, 24);
+        memcpy(mgmt->da, da, ETH_ALEN);
+        memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
+        if (sdata->vif.type == NL80211_IFTYPE_AP ||
+            sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
+                memcpy(mgmt->bssid, sdata->dev->dev_addr, ETH_ALEN);
+        else if (sdata->vif.type == NL80211_IFTYPE_STATION)
+                memcpy(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN);
+
+        mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
+                                          IEEE80211_STYPE_ACTION);
+
+        skb_put(skb, 1 + sizeof(mgmt->u.action.u.addba_resp));
+        mgmt->u.action.category = WLAN_CATEGORY_BACK;
+        mgmt->u.action.u.addba_resp.action_code = WLAN_ACTION_ADDBA_RESP;
+        mgmt->u.action.u.addba_resp.dialog_token = dialog_token;
+
+        capab = (u16)(policy << 1);     /* bit 1 aggregation policy */
+        capab |= (u16)(tid << 2);       /* bit 5:2 TID number */
+        capab |= (u16)(buf_size << 6);  /* bit 15:6 max size of aggregation */
+
+        mgmt->u.action.u.addba_resp.capab = cpu_to_le16(capab);
+        mgmt->u.action.u.addba_resp.timeout = cpu_to_le16(timeout);
+        mgmt->u.action.u.addba_resp.status = cpu_to_le16(status);
+
+        ieee80211_tx_skb(sdata, skb, 1);
+}
+
+void ieee80211_process_addba_request(struct ieee80211_local *local,
+                                     struct sta_info *sta,
+                                     struct ieee80211_mgmt *mgmt,
+                                     size_t len)
+{
+        struct ieee80211_hw *hw = &local->hw;
+        struct ieee80211_conf *conf = &hw->conf;
+        struct tid_ampdu_rx *tid_agg_rx;
+        u16 capab, tid, timeout, ba_policy, buf_size, start_seq_num, status;
+        u8 dialog_token;
+        int ret = -EOPNOTSUPP;
+
+        /* extract session parameters from addba request frame */
+        dialog_token = mgmt->u.action.u.addba_req.dialog_token;
+        timeout = le16_to_cpu(mgmt->u.action.u.addba_req.timeout);
+        start_seq_num =
+                le16_to_cpu(mgmt->u.action.u.addba_req.start_seq_num) >> 4;
+
+        capab = le16_to_cpu(mgmt->u.action.u.addba_req.capab);
+        ba_policy = (capab & IEEE80211_ADDBA_PARAM_POLICY_MASK) >> 1;
+        tid = (capab & IEEE80211_ADDBA_PARAM_TID_MASK) >> 2;
+        buf_size = (capab & IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK) >> 6;
+
+        status = WLAN_STATUS_REQUEST_DECLINED;
+
+        if (test_sta_flags(sta, WLAN_STA_SUSPEND)) {
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                printk(KERN_DEBUG "Suspend in progress. "
+                       "Denying ADDBA request\n");
+#endif
+                goto end_no_lock;
+        }
+
+        /* sanity check for incoming parameters:
+         * check if configuration can support the BA policy
+         * and if buffer size does not exceeds max value */
+        /* XXX: check own ht delayed BA capability?? */
+        if (((ba_policy != 1)
+                && (!(sta->sta.ht_cap.cap & IEEE80211_HT_CAP_DELAY_BA)))
+                || (buf_size > IEEE80211_MAX_AMPDU_BUF)) {
+                status = WLAN_STATUS_INVALID_QOS_PARAM;
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                if (net_ratelimit())
+                        printk(KERN_DEBUG "AddBA Req with bad params from "
+                                "%pM on tid %u. policy %d, buffer size %d\n",
+                                mgmt->sa, tid, ba_policy,
+                                buf_size);
+#endif /* CONFIG_MAC80211_HT_DEBUG */
+                goto end_no_lock;
+        }
+        /* determine default buffer size */
+        if (buf_size == 0) {
+                struct ieee80211_supported_band *sband;
+
+                sband = local->hw.wiphy->bands[conf->channel->band];
+                buf_size = IEEE80211_MIN_AMPDU_BUF;
+                buf_size = buf_size << sband->ht_cap.ampdu_factor;
+        }
+
+
+        /* examine state machine */
+        spin_lock_bh(&sta->lock);
+
+        if (sta->ampdu_mlme.tid_state_rx[tid] != HT_AGG_STATE_IDLE) {
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                if (net_ratelimit())
+                        printk(KERN_DEBUG "unexpected AddBA Req from "
+                                "%pM on tid %u\n",
+                                mgmt->sa, tid);
+#endif /* CONFIG_MAC80211_HT_DEBUG */
+                goto end;
+        }
+
+        /* prepare A-MPDU MLME for Rx aggregation */
+        sta->ampdu_mlme.tid_rx[tid] =
+                        kmalloc(sizeof(struct tid_ampdu_rx), GFP_ATOMIC);
+        if (!sta->ampdu_mlme.tid_rx[tid]) {
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                if (net_ratelimit())
+                        printk(KERN_ERR "allocate rx mlme to tid %d failed\n",
+                                        tid);
+#endif
+                goto end;
+        }
+        /* rx timer */
+        sta->ampdu_mlme.tid_rx[tid]->session_timer.function =
+                                sta_rx_agg_session_timer_expired;
+        sta->ampdu_mlme.tid_rx[tid]->session_timer.data =
+                                (unsigned long)&sta->timer_to_tid[tid];
+        init_timer(&sta->ampdu_mlme.tid_rx[tid]->session_timer);
+
+        tid_agg_rx = sta->ampdu_mlme.tid_rx[tid];
+
+        /* prepare reordering buffer */
+        tid_agg_rx->reorder_buf =
+                kcalloc(buf_size, sizeof(struct sk_buff *), GFP_ATOMIC);
+        if (!tid_agg_rx->reorder_buf) {
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                if (net_ratelimit())
+                        printk(KERN_ERR "can not allocate reordering buffer "
+                               "to tid %d\n", tid);
+#endif
+                kfree(sta->ampdu_mlme.tid_rx[tid]);
+                goto end;
+        }
+
+        if (local->ops->ampdu_action)
+                ret = local->ops->ampdu_action(hw, IEEE80211_AMPDU_RX_START,
+                                               &sta->sta, tid, &start_seq_num);
+#ifdef CONFIG_MAC80211_HT_DEBUG
+        printk(KERN_DEBUG "Rx A-MPDU request on tid %d result %d\n", tid, ret);
+#endif /* CONFIG_MAC80211_HT_DEBUG */
+
+        if (ret) {
+                kfree(tid_agg_rx->reorder_buf);
+                kfree(tid_agg_rx);
+                sta->ampdu_mlme.tid_rx[tid] = NULL;
+                goto end;
+        }
+
+        /* change state and send addba resp */
+        sta->ampdu_mlme.tid_state_rx[tid] = HT_AGG_STATE_OPERATIONAL;
+        tid_agg_rx->dialog_token = dialog_token;
+        tid_agg_rx->ssn = start_seq_num;
+        tid_agg_rx->head_seq_num = start_seq_num;
+        tid_agg_rx->buf_size = buf_size;
+        tid_agg_rx->timeout = timeout;
+        tid_agg_rx->stored_mpdu_num = 0;
+        status = WLAN_STATUS_SUCCESS;
+end:
+        spin_unlock_bh(&sta->lock);
+
+end_no_lock:
+        ieee80211_send_addba_resp(sta->sdata, sta->sta.addr, tid,
+                                  dialog_token, status, 1, buf_size, timeout);
+}
diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
new file mode 100644
index 000000000000..947aaaad35d2
--- /dev/null
+++ b/net/mac80211/agg-tx.c
@@ -0,0 +1,695 @@
+/*
+ * HT handling
+ *
+ * Copyright 2003, Jouni Malinen <jkmaline@cc.hut.fi>
+ * Copyright 2002-2005, Instant802 Networks, Inc.
+ * Copyright 2005-2006, Devicescape Software, Inc.
+ * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
+ * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
+ * Copyright 2007-2009, Intel Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/ieee80211.h>
+#include <net/mac80211.h>
+#include "ieee80211_i.h"
+#include "wme.h"
+
+/**
+ * DOC: TX aggregation
+ *
+ * Aggregation on the TX side requires setting the hardware flag
+ * %IEEE80211_HW_AMPDU_AGGREGATION as well as, if present, the @ampdu_queues
+ * hardware parameter to the number of hardware AMPDU queues. If there are no
+ * hardware queues then the driver will (currently) have to do all frame
+ * buffering.
+ *
+ * When TX aggregation is started by some subsystem (usually the rate control
+ * algorithm would be appropriate) by calling the
+ * ieee80211_start_tx_ba_session() function, the driver will be notified via
+ * its @ampdu_action function, with the %IEEE80211_AMPDU_TX_START action.
+ *
+ * In response to that, the driver is later required to call the
+ * ieee80211_start_tx_ba_cb() (or ieee80211_start_tx_ba_cb_irqsafe())
+ * function, which will start the aggregation session.
+ *
+ * Similarly, when the aggregation session is stopped by
+ * ieee80211_stop_tx_ba_session(), the driver's @ampdu_action function will
+ * be called with the action %IEEE80211_AMPDU_TX_STOP. In this case, the
+ * call must not fail, and the driver must later call ieee80211_stop_tx_ba_cb()
+ * (or ieee80211_stop_tx_ba_cb_irqsafe()).
+ */
+
+static void ieee80211_send_addba_request(struct ieee80211_sub_if_data *sdata,
+                                         const u8 *da, u16 tid,
+                                         u8 dialog_token, u16 start_seq_num,
+                                         u16 agg_size, u16 timeout)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct sk_buff *skb;
+        struct ieee80211_mgmt *mgmt;
+        u16 capab;
+
+        skb = dev_alloc_skb(sizeof(*mgmt) + local->hw.extra_tx_headroom);
+
+        if (!skb) {
+                printk(KERN_ERR "%s: failed to allocate buffer "
+                                "for addba request frame\n", sdata->dev->name);
+                return;
+        }
+        skb_reserve(skb, local->hw.extra_tx_headroom);
+        mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
+        memset(mgmt, 0, 24);
+        memcpy(mgmt->da, da, ETH_ALEN);
+        memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
+        if (sdata->vif.type == NL80211_IFTYPE_AP ||
+            sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
+                memcpy(mgmt->bssid, sdata->dev->dev_addr, ETH_ALEN);
+        else if (sdata->vif.type == NL80211_IFTYPE_STATION)
+                memcpy(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN);
+
+        mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
+                                          IEEE80211_STYPE_ACTION);
+
+        skb_put(skb, 1 + sizeof(mgmt->u.action.u.addba_req));
+
+        mgmt->u.action.category = WLAN_CATEGORY_BACK;
+        mgmt->u.action.u.addba_req.action_code = WLAN_ACTION_ADDBA_REQ;
+
+        mgmt->u.action.u.addba_req.dialog_token = dialog_token;
+        capab = (u16)(1 << 1);          /* bit 1 aggregation policy */
+        capab |= (u16)(tid << 2);       /* bit 5:2 TID number */
+        capab |= (u16)(agg_size << 6);  /* bit 15:6 max size of aggergation */
+
+        mgmt->u.action.u.addba_req.capab = cpu_to_le16(capab);
+
+        mgmt->u.action.u.addba_req.timeout = cpu_to_le16(timeout);
+        mgmt->u.action.u.addba_req.start_seq_num =
+                                        cpu_to_le16(start_seq_num << 4);
+
+        ieee80211_tx_skb(sdata, skb, 1);
+}
+
+void ieee80211_send_bar(struct ieee80211_sub_if_data *sdata, u8 *ra, u16 tid, u16 ssn)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct sk_buff *skb;
+        struct ieee80211_bar *bar;
+        u16 bar_control = 0;
+
+        skb = dev_alloc_skb(sizeof(*bar) + local->hw.extra_tx_headroom);
+        if (!skb) {
+                printk(KERN_ERR "%s: failed to allocate buffer for "
+                        "bar frame\n", sdata->dev->name);
+                return;
+        }
+        skb_reserve(skb, local->hw.extra_tx_headroom);
+        bar = (struct ieee80211_bar *)skb_put(skb, sizeof(*bar));
+        memset(bar, 0, sizeof(*bar));
+        bar->frame_control = cpu_to_le16(IEEE80211_FTYPE_CTL |
+                                         IEEE80211_STYPE_BACK_REQ);
+        memcpy(bar->ra, ra, ETH_ALEN);
+        memcpy(bar->ta, sdata->dev->dev_addr, ETH_ALEN);
+        bar_control |= (u16)IEEE80211_BAR_CTRL_ACK_POLICY_NORMAL;
+        bar_control |= (u16)IEEE80211_BAR_CTRL_CBMTID_COMPRESSED_BA;
+        bar_control |= (u16)(tid << 12);
+        bar->control = cpu_to_le16(bar_control);
+        bar->start_seq_num = cpu_to_le16(ssn);
+
+        ieee80211_tx_skb(sdata, skb, 0);
+}
+
+static int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
+                                           enum ieee80211_back_parties initiator)
+{
+        struct ieee80211_local *local = sta->local;
+        int ret;
+        u8 *state;
+
+        state = &sta->ampdu_mlme.tid_state_tx[tid];
+
+        *state = HT_AGG_STATE_REQ_STOP_BA_MSK |
+                (initiator << HT_AGG_STATE_INITIATOR_SHIFT);
+
+        ret = local->ops->ampdu_action(&local->hw, IEEE80211_AMPDU_TX_STOP,
+                                       &sta->sta, tid, NULL);
+
+        /* HW shall not deny going back to legacy */
+        if (WARN_ON(ret)) {
+                *state = HT_AGG_STATE_OPERATIONAL;
+                /*
+                 * We may have pending packets get stuck in this case...
+                 * Not bothering with a workaround for now.
+                 */
+        }
+
+        return ret;
+}
+
+/*
+ * After sending add Block Ack request we activated a timer until
+ * add Block Ack response will arrive from the recipient.
+ * If this timer expires sta_addba_resp_timer_expired will be executed.
+ */
+static void sta_addba_resp_timer_expired(unsigned long data)
+{
+        /* not an elegant detour, but there is no choice as the timer passes
+         * only one argument, and both sta_info and TID are needed, so init
+         * flow in sta_info_create gives the TID as data, while the timer_to_id
+         * array gives the sta through container_of */
+        u16 tid = *(u8 *)data;
+        struct sta_info *sta = container_of((void *)data,
+                struct sta_info, timer_to_tid[tid]);
+        u8 *state;
+
+        state = &sta->ampdu_mlme.tid_state_tx[tid];
+
+        /* check if the TID waits for addBA response */
+        spin_lock_bh(&sta->lock);
+        if (!(*state & HT_ADDBA_REQUESTED_MSK)) {
+                spin_unlock_bh(&sta->lock);
+                *state = HT_AGG_STATE_IDLE;
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                printk(KERN_DEBUG "timer expired on tid %d but we are not "
+                                "expecting addBA response there", tid);
+#endif
+                return;
+        }
+
+#ifdef CONFIG_MAC80211_HT_DEBUG
+        printk(KERN_DEBUG "addBA response timer expired on tid %d\n", tid);
+#endif
+
+        ___ieee80211_stop_tx_ba_session(sta, tid, WLAN_BACK_INITIATOR);
+        spin_unlock_bh(&sta->lock);
+}
+
+static inline int ieee80211_ac_from_tid(int tid)
+{
+        return ieee802_1d_to_ac[tid & 7];
+}
+
+int ieee80211_start_tx_ba_session(struct ieee80211_hw *hw, u8 *ra, u16 tid)
+{
+        struct ieee80211_local *local = hw_to_local(hw);
+        struct sta_info *sta;
+        struct ieee80211_sub_if_data *sdata;
+        u8 *state;
+        int ret = 0;
+        u16 start_seq_num;
+
+        if (WARN_ON(!local->ops->ampdu_action))
+                return -EINVAL;
+
+        if ((tid >= STA_TID_NUM) || !(hw->flags & IEEE80211_HW_AMPDU_AGGREGATION))
+                return -EINVAL;
+
+#ifdef CONFIG_MAC80211_HT_DEBUG
+        printk(KERN_DEBUG "Open BA session requested for %pM tid %u\n",
+               ra, tid);
+#endif /* CONFIG_MAC80211_HT_DEBUG */
+
+        rcu_read_lock();
+
+        sta = sta_info_get(local, ra);
+        if (!sta) {
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                printk(KERN_DEBUG "Could not find the station\n");
+#endif
+                ret = -ENOENT;
+                goto unlock;
+        }
+
+        /*
+         * The aggregation code is not prepared to handle
+         * anything but STA/AP due to the BSSID handling.
+         * IBSS could work in the code but isn't supported
+         * by drivers or the standard.
+         */
+        if (sta->sdata->vif.type != NL80211_IFTYPE_STATION &&
+            sta->sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
+            sta->sdata->vif.type != NL80211_IFTYPE_AP) {
+                ret = -EINVAL;
+                goto unlock;
+        }
+
+        if (test_sta_flags(sta, WLAN_STA_SUSPEND)) {
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                printk(KERN_DEBUG "Suspend in progress. "
+                       "Denying BA session request\n");
+#endif
+                ret = -EINVAL;
+                goto unlock;
+        }
+
+        spin_lock_bh(&sta->lock);
+        spin_lock(&local->ampdu_lock);
+
+        sdata = sta->sdata;
+
+        /* we have tried too many times, receiver does not want A-MPDU */
+        if (sta->ampdu_mlme.addba_req_num[tid] > HT_AGG_MAX_RETRIES) {
+                ret = -EBUSY;
+                goto err_unlock_sta;
+        }
+
+        state = &sta->ampdu_mlme.tid_state_tx[tid];
+        /* check if the TID is not in aggregation flow already */
+        if (*state != HT_AGG_STATE_IDLE) {
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                printk(KERN_DEBUG "BA request denied - session is not "
+                                 "idle on tid %u\n", tid);
+#endif /* CONFIG_MAC80211_HT_DEBUG */
+                ret = -EAGAIN;
+                goto err_unlock_sta;
+        }
+
+        /*
+         * While we're asking the driver about the aggregation,
+         * stop the AC queue so that we don't have to worry
+         * about frames that came in while we were doing that,
+         * which would require us to put them to the AC pending
+         * afterwards which just makes the code more complex.
+         */
+        ieee80211_stop_queue_by_reason(
+                &local->hw, ieee80211_ac_from_tid(tid),
+                IEEE80211_QUEUE_STOP_REASON_AGGREGATION);
+
+        /* prepare A-MPDU MLME for Tx aggregation */
+        sta->ampdu_mlme.tid_tx[tid] =
+                        kmalloc(sizeof(struct tid_ampdu_tx), GFP_ATOMIC);
+        if (!sta->ampdu_mlme.tid_tx[tid]) {
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                if (net_ratelimit())
+                        printk(KERN_ERR "allocate tx mlme to tid %d failed\n",
+                                        tid);
+#endif
+                ret = -ENOMEM;
+                goto err_wake_queue;
+        }
+
+        skb_queue_head_init(&sta->ampdu_mlme.tid_tx[tid]->pending);
+
+        /* Tx timer */
+        sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer.function =
+                        sta_addba_resp_timer_expired;
+        sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer.data =
+                        (unsigned long)&sta->timer_to_tid[tid];
+        init_timer(&sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer);
+
+        /* Ok, the Addba frame hasn't been sent yet, but if the driver calls the
+         * call back right away, it must see that the flow has begun */
+        *state |= HT_ADDBA_REQUESTED_MSK;
+
+        start_seq_num = sta->tid_seq[tid];
+
+        ret = local->ops->ampdu_action(hw, IEEE80211_AMPDU_TX_START,
+                                       &sta->sta, tid, &start_seq_num);
+
+        if (ret) {
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                printk(KERN_DEBUG "BA request denied - HW unavailable for"
+                                        " tid %d\n", tid);
+#endif /* CONFIG_MAC80211_HT_DEBUG */
+                *state = HT_AGG_STATE_IDLE;
+                goto err_free;
+        }
+
+        /* Driver vetoed or OKed, but we can take packets again now */
+        ieee80211_wake_queue_by_reason(
+                &local->hw, ieee80211_ac_from_tid(tid),
+                IEEE80211_QUEUE_STOP_REASON_AGGREGATION);
+
+        spin_unlock(&local->ampdu_lock);
+        spin_unlock_bh(&sta->lock);
+
+        /* send an addBA request */
+        sta->ampdu_mlme.dialog_token_allocator++;
+        sta->ampdu_mlme.tid_tx[tid]->dialog_token =
+                        sta->ampdu_mlme.dialog_token_allocator;
+        sta->ampdu_mlme.tid_tx[tid]->ssn = start_seq_num;
+
+        ieee80211_send_addba_request(sta->sdata, ra, tid,
+                         sta->ampdu_mlme.tid_tx[tid]->dialog_token,
+                         sta->ampdu_mlme.tid_tx[tid]->ssn,
+                         0x40, 5000);
+        /* activate the timer for the recipient's addBA response */
+        sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer.expires =
+                                jiffies + ADDBA_RESP_INTERVAL;
+        add_timer(&sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer);
+#ifdef CONFIG_MAC80211_HT_DEBUG
+        printk(KERN_DEBUG "activated addBA response timer on tid %d\n", tid);
+#endif
+        goto unlock;
+
+ err_free:
+        kfree(sta->ampdu_mlme.tid_tx[tid]);
+        sta->ampdu_mlme.tid_tx[tid] = NULL;
+ err_wake_queue:
+        ieee80211_wake_queue_by_reason(
+                &local->hw, ieee80211_ac_from_tid(tid),
+                IEEE80211_QUEUE_STOP_REASON_AGGREGATION);
+ err_unlock_sta:
+        spin_unlock(&local->ampdu_lock);
+        spin_unlock_bh(&sta->lock);
+ unlock:
+        rcu_read_unlock();
+        return ret;
+}
+EXPORT_SYMBOL(ieee80211_start_tx_ba_session);
+
+/*
+ * splice packets from the STA's pending to the local pending,
+ * requires a call to ieee80211_agg_splice_finish and holding
+ * local->ampdu_lock across both calls.
+ */
+static void ieee80211_agg_splice_packets(struct ieee80211_local *local,
+                                         struct sta_info *sta, u16 tid)
+{
+        unsigned long flags;
+        u16 queue = ieee80211_ac_from_tid(tid);
+
+        ieee80211_stop_queue_by_reason(
+                &local->hw, queue,
+                IEEE80211_QUEUE_STOP_REASON_AGGREGATION);
+
+        if (!skb_queue_empty(&sta->ampdu_mlme.tid_tx[tid]->pending)) {
+                spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
+                /* mark queue as pending, it is stopped already */
+                __set_bit(IEEE80211_QUEUE_STOP_REASON_PENDING,
+                          &local->queue_stop_reasons[queue]);
+                /* copy over remaining packets */
+                skb_queue_splice_tail_init(
+                        &sta->ampdu_mlme.tid_tx[tid]->pending,
+                        &local->pending[queue]);
+                spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
+        }
+}
+
+static void ieee80211_agg_splice_finish(struct ieee80211_local *local,
+                                        struct sta_info *sta, u16 tid)
+{
+        u16 queue = ieee80211_ac_from_tid(tid);
+
+        ieee80211_wake_queue_by_reason(
+                &local->hw, queue,
+                IEEE80211_QUEUE_STOP_REASON_AGGREGATION);
+}
+
+/* caller must hold sta->lock */
+static void ieee80211_agg_tx_operational(struct ieee80211_local *local,
+                                         struct sta_info *sta, u16 tid)
+{
+#ifdef CONFIG_MAC80211_HT_DEBUG
+        printk(KERN_DEBUG "Aggregation is on for tid %d \n", tid);
+#endif
+
+        spin_lock(&local->ampdu_lock);
+        ieee80211_agg_splice_packets(local, sta, tid);
+        /*
+         * NB: we rely on sta->lock being taken in the TX
+         * processing here when adding to the pending queue,
+         * otherwise we could only change the state of the
+         * session to OPERATIONAL _here_.
+         */
+        ieee80211_agg_splice_finish(local, sta, tid);
+        spin_unlock(&local->ampdu_lock);
+
+        local->ops->ampdu_action(&local->hw, IEEE80211_AMPDU_TX_OPERATIONAL,
+                                 &sta->sta, tid, NULL);
+}
+
+void ieee80211_start_tx_ba_cb(struct ieee80211_hw *hw, u8 *ra, u16 tid)
+{
+        struct ieee80211_local *local = hw_to_local(hw);
+        struct sta_info *sta;
+        u8 *state;
+
+        if (tid >= STA_TID_NUM) {
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                printk(KERN_DEBUG "Bad TID value: tid = %d (>= %d)\n",
+                                tid, STA_TID_NUM);
+#endif
+                return;
+        }
+
+        rcu_read_lock();
+        sta = sta_info_get(local, ra);
+        if (!sta) {
+                rcu_read_unlock();
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                printk(KERN_DEBUG "Could not find station: %pM\n", ra);
+#endif
+                return;
+        }
+
+        state = &sta->ampdu_mlme.tid_state_tx[tid];
+        spin_lock_bh(&sta->lock);
+
+        if (WARN_ON(!(*state & HT_ADDBA_REQUESTED_MSK))) {
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                printk(KERN_DEBUG "addBA was not requested yet, state is %d\n",
+                                *state);
+#endif
+                spin_unlock_bh(&sta->lock);
+                rcu_read_unlock();
+                return;
+        }
+
+        if (WARN_ON(*state & HT_ADDBA_DRV_READY_MSK))
+                goto out;
+
+        *state |= HT_ADDBA_DRV_READY_MSK;
+
+        if (*state == HT_AGG_STATE_OPERATIONAL)
+                ieee80211_agg_tx_operational(local, sta, tid);
+
+ out:
+        spin_unlock_bh(&sta->lock);
+        rcu_read_unlock();
+}
+EXPORT_SYMBOL(ieee80211_start_tx_ba_cb);
+
+void ieee80211_start_tx_ba_cb_irqsafe(struct ieee80211_hw *hw,
+                                      const u8 *ra, u16 tid)
+{
+        struct ieee80211_local *local = hw_to_local(hw);
+        struct ieee80211_ra_tid *ra_tid;
+        struct sk_buff *skb = dev_alloc_skb(0);
+
+        if (unlikely(!skb)) {
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                if (net_ratelimit())
+                        printk(KERN_WARNING "%s: Not enough memory, "
+                               "dropping start BA session", skb->dev->name);
+#endif
+                return;
+        }
+        ra_tid = (struct ieee80211_ra_tid *) &skb->cb;
+        memcpy(&ra_tid->ra, ra, ETH_ALEN);
+        ra_tid->tid = tid;
+
+        skb->pkt_type = IEEE80211_ADDBA_MSG;
+        skb_queue_tail(&local->skb_queue, skb);
+        tasklet_schedule(&local->tasklet);
+}
+EXPORT_SYMBOL(ieee80211_start_tx_ba_cb_irqsafe);
+
+int __ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
+                                   enum ieee80211_back_parties initiator)
+{
+        u8 *state;
+        int ret;
+
+        /* check if the TID is in aggregation */
+        state = &sta->ampdu_mlme.tid_state_tx[tid];
+        spin_lock_bh(&sta->lock);
+
+        if (*state != HT_AGG_STATE_OPERATIONAL) {
+                ret = -ENOENT;
+                goto unlock;
+        }
+
+#ifdef CONFIG_MAC80211_HT_DEBUG
+        printk(KERN_DEBUG "Tx BA session stop requested for %pM tid %u\n",
+               sta->sta.addr, tid);
+#endif /* CONFIG_MAC80211_HT_DEBUG */
+
+        ret = ___ieee80211_stop_tx_ba_session(sta, tid, initiator);
+
+ unlock:
+        spin_unlock_bh(&sta->lock);
+        return ret;
+}
+
+int ieee80211_stop_tx_ba_session(struct ieee80211_hw *hw,
+                                 u8 *ra, u16 tid,
+                                 enum ieee80211_back_parties initiator)
+{
+        struct ieee80211_local *local = hw_to_local(hw);
+        struct sta_info *sta;
+        int ret = 0;
+
+        if (WARN_ON(!local->ops->ampdu_action))
+                return -EINVAL;
+
+        if (tid >= STA_TID_NUM)
+                return -EINVAL;
+
+        rcu_read_lock();
+        sta = sta_info_get(local, ra);
+        if (!sta) {
+                rcu_read_unlock();
+                return -ENOENT;
+        }
+
+        ret = __ieee80211_stop_tx_ba_session(sta, tid, initiator);
+        rcu_read_unlock();
+        return ret;
+}
+EXPORT_SYMBOL(ieee80211_stop_tx_ba_session);
+
+void ieee80211_stop_tx_ba_cb(struct ieee80211_hw *hw, u8 *ra, u8 tid)
+{
+        struct ieee80211_local *local = hw_to_local(hw);
+        struct sta_info *sta;
+        u8 *state;
+
+        if (tid >= STA_TID_NUM) {
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                printk(KERN_DEBUG "Bad TID value: tid = %d (>= %d)\n",
+                                tid, STA_TID_NUM);
+#endif
+                return;
+        }
+
+#ifdef CONFIG_MAC80211_HT_DEBUG
+        printk(KERN_DEBUG "Stopping Tx BA session for %pM tid %d\n",
+               ra, tid);
+#endif /* CONFIG_MAC80211_HT_DEBUG */
+
+        rcu_read_lock();
+        sta = sta_info_get(local, ra);
+        if (!sta) {
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                printk(KERN_DEBUG "Could not find station: %pM\n", ra);
+#endif
+                rcu_read_unlock();
+                return;
+        }
+        state = &sta->ampdu_mlme.tid_state_tx[tid];
+
+        /* NOTE: no need to use sta->lock in this state check, as
+         * ieee80211_stop_tx_ba_session will let only one stop call to
+         * pass through per sta/tid
+         */
+        if ((*state & HT_AGG_STATE_REQ_STOP_BA_MSK) == 0) {
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                printk(KERN_DEBUG "unexpected callback to A-MPDU stop\n");
+#endif
+                rcu_read_unlock();
+                return;
+        }
+
+        if (*state & HT_AGG_STATE_INITIATOR_MSK)
+                ieee80211_send_delba(sta->sdata, ra, tid,
+                        WLAN_BACK_INITIATOR, WLAN_REASON_QSTA_NOT_USE);
+
+        spin_lock_bh(&sta->lock);
+        spin_lock(&local->ampdu_lock);
+
+        ieee80211_agg_splice_packets(local, sta, tid);
+
+        *state = HT_AGG_STATE_IDLE;
+        /* from now on packets are no longer put onto sta->pending */
+        sta->ampdu_mlme.addba_req_num[tid] = 0;
+        kfree(sta->ampdu_mlme.tid_tx[tid]);
+        sta->ampdu_mlme.tid_tx[tid] = NULL;
+
+        ieee80211_agg_splice_finish(local, sta, tid);
+
+        spin_unlock(&local->ampdu_lock);
+        spin_unlock_bh(&sta->lock);
+
+        rcu_read_unlock();
+}
+EXPORT_SYMBOL(ieee80211_stop_tx_ba_cb);
+
+void ieee80211_stop_tx_ba_cb_irqsafe(struct ieee80211_hw *hw,
+                                     const u8 *ra, u16 tid)
+{
+        struct ieee80211_local *local = hw_to_local(hw);
+        struct ieee80211_ra_tid *ra_tid;
+        struct sk_buff *skb = dev_alloc_skb(0);
+
+        if (unlikely(!skb)) {
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                if (net_ratelimit())
+                        printk(KERN_WARNING "%s: Not enough memory, "
+                               "dropping stop BA session", skb->dev->name);
+#endif
+                return;
+        }
+        ra_tid = (struct ieee80211_ra_tid *) &skb->cb;
+        memcpy(&ra_tid->ra, ra, ETH_ALEN);
+        ra_tid->tid = tid;
+
+        skb->pkt_type = IEEE80211_DELBA_MSG;
+        skb_queue_tail(&local->skb_queue, skb);
+        tasklet_schedule(&local->tasklet);
+}
+EXPORT_SYMBOL(ieee80211_stop_tx_ba_cb_irqsafe);
+
+
+void ieee80211_process_addba_resp(struct ieee80211_local *local,
+                                  struct sta_info *sta,
+                                  struct ieee80211_mgmt *mgmt,
+                                  size_t len)
+{
+        u16 capab, tid;
+        u8 *state;
+
+        capab = le16_to_cpu(mgmt->u.action.u.addba_resp.capab);
+        tid = (capab & IEEE80211_ADDBA_PARAM_TID_MASK) >> 2;
+
+        state = &sta->ampdu_mlme.tid_state_tx[tid];
+
+        spin_lock_bh(&sta->lock);
+
+        if (!(*state & HT_ADDBA_REQUESTED_MSK)) {
+                spin_unlock_bh(&sta->lock);
+                return;
+        }
+
+        if (mgmt->u.action.u.addba_resp.dialog_token !=
+                sta->ampdu_mlme.tid_tx[tid]->dialog_token) {
+                spin_unlock_bh(&sta->lock);
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                printk(KERN_DEBUG "wrong addBA response token, tid %d\n", tid);
+#endif /* CONFIG_MAC80211_HT_DEBUG */
+                return;
+        }
+
+        del_timer_sync(&sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer);
+#ifdef CONFIG_MAC80211_HT_DEBUG
+        printk(KERN_DEBUG "switched off addBA timer for tid %d \n", tid);
+#endif /* CONFIG_MAC80211_HT_DEBUG */
+        if (le16_to_cpu(mgmt->u.action.u.addba_resp.status)
+                        == WLAN_STATUS_SUCCESS) {
+                u8 curstate = *state;
+
+                *state |= HT_ADDBA_RECEIVED_MSK;
+
+                if (*state != curstate && *state == HT_AGG_STATE_OPERATIONAL)
+                        ieee80211_agg_tx_operational(local, sta, tid);
+
+                sta->ampdu_mlme.addba_req_num[tid] = 0;
+        } else {
+                sta->ampdu_mlme.addba_req_num[tid]++;
+                ___ieee80211_stop_tx_ba_session(sta, tid, WLAN_BACK_INITIATOR);
+        }
+        spin_unlock_bh(&sta->lock);
+}
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 9d4e4d846ec1..e677b751d468 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -133,6 +133,9 @@ static int ieee80211_add_key(struct wiphy *wiphy, struct net_device *dev,
         case WLAN_CIPHER_SUITE_CCMP:
                 alg = ALG_CCMP;
                 break;
+        case WLAN_CIPHER_SUITE_AES_CMAC:
+                alg = ALG_AES_CMAC;
+                break;
         default:
                 return -EINVAL;
         }
@@ -275,6 +278,17 @@ static int ieee80211_get_key(struct wiphy *wiphy, struct net_device *dev,
                 else
                         params.cipher = WLAN_CIPHER_SUITE_WEP104;
                 break;
+        case ALG_AES_CMAC:
+                params.cipher = WLAN_CIPHER_SUITE_AES_CMAC;
+                seq[0] = key->u.aes_cmac.tx_pn[5];
+                seq[1] = key->u.aes_cmac.tx_pn[4];
+                seq[2] = key->u.aes_cmac.tx_pn[3];
+                seq[3] = key->u.aes_cmac.tx_pn[2];
+                seq[4] = key->u.aes_cmac.tx_pn[1];
+                seq[5] = key->u.aes_cmac.tx_pn[0];
+                params.seq = seq;
+                params.seq_len = 6;
+                break;
         }
 
         params.key = key->conf.key;
@@ -304,6 +318,22 @@ static int ieee80211_config_default_key(struct wiphy *wiphy,
         return 0;
 }
 
+static int ieee80211_config_default_mgmt_key(struct wiphy *wiphy,
+                                             struct net_device *dev,
+                                             u8 key_idx)
+{
+        struct ieee80211_sub_if_data *sdata;
+
+        rcu_read_lock();
+
+        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        ieee80211_set_default_mgmt_key(sdata, key_idx);
+
+        rcu_read_unlock();
+
+        return 0;
+}
+
 static void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
 {
         struct ieee80211_sub_if_data *sdata = sta->sdata;
@@ -311,11 +341,15 @@ static void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
         sinfo->filled = STATION_INFO_INACTIVE_TIME |
                         STATION_INFO_RX_BYTES |
                         STATION_INFO_TX_BYTES |
+                        STATION_INFO_RX_PACKETS |
+                        STATION_INFO_TX_PACKETS |
                         STATION_INFO_TX_BITRATE;
 
         sinfo->inactive_time = jiffies_to_msecs(jiffies - sta->last_rx);
         sinfo->rx_bytes = sta->rx_bytes;
         sinfo->tx_bytes = sta->tx_bytes;
+        sinfo->rx_packets = sta->rx_packets;
+        sinfo->tx_packets = sta->tx_packets;
 
         if (sta->local->hw.flags & IEEE80211_HW_SIGNAL_DBM) {
                 sinfo->filled |= STATION_INFO_SIGNAL;
@@ -417,7 +451,8 @@ static int ieee80211_config_beacon(struct ieee80211_sub_if_data *sdata,
          * This is a kludge. beacon interval should really be part
          * of the beacon information.
          */
-        if (params->interval) {
+        if (params->interval && (sdata->local->hw.conf.beacon_int !=
+                                 params->interval)) {
                 sdata->local->hw.conf.beacon_int = params->interval;
                 err = ieee80211_hw_config(sdata->local,
                                         IEEE80211_CONF_CHANGE_BEACON_INTERVAL);
@@ -493,7 +528,8 @@ static int ieee80211_config_beacon(struct ieee80211_sub_if_data *sdata,
 
         kfree(old);
 
-        return ieee80211_if_config(sdata, IEEE80211_IFCC_BEACON);
+        return ieee80211_if_config(sdata, IEEE80211_IFCC_BEACON |
+                                          IEEE80211_IFCC_BEACON_ENABLED);
 }
 
 static int ieee80211_add_beacon(struct wiphy *wiphy, struct net_device *dev,
@@ -504,9 +540,6 @@ static int ieee80211_add_beacon(struct wiphy *wiphy, struct net_device *dev,
 
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
-        if (sdata->vif.type != NL80211_IFTYPE_AP)
-                return -EINVAL;
-
         old = sdata->u.ap.beacon;
 
         if (old)
@@ -523,9 +556,6 @@ static int ieee80211_set_beacon(struct wiphy *wiphy, struct net_device *dev,
 
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
-        if (sdata->vif.type != NL80211_IFTYPE_AP)
-                return -EINVAL;
-
         old = sdata->u.ap.beacon;
 
         if (!old)
@@ -541,9 +571,6 @@ static int ieee80211_del_beacon(struct wiphy *wiphy, struct net_device *dev)
 
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
-        if (sdata->vif.type != NL80211_IFTYPE_AP)
-                return -EINVAL;
-
         old = sdata->u.ap.beacon;
 
         if (!old)
@@ -553,7 +580,7 @@ static int ieee80211_del_beacon(struct wiphy *wiphy, struct net_device *dev)
         synchronize_rcu();
         kfree(old);
 
-        return ieee80211_if_config(sdata, IEEE80211_IFCC_BEACON);
+        return ieee80211_if_config(sdata, IEEE80211_IFCC_BEACON_ENABLED);
 }
 
 /* Layer 2 Update frame (802.2 Type 1 LLC XID Update response) */
@@ -630,6 +657,10 @@ static void sta_apply_parameters(struct ieee80211_local *local,
                 sta->flags &= ~WLAN_STA_WME;
                 if (params->station_flags & STATION_FLAG_WME)
                         sta->flags |= WLAN_STA_WME;
+
+                sta->flags &= ~WLAN_STA_MFP;
+                if (params->station_flags & STATION_FLAG_MFP)
+                        sta->flags |= WLAN_STA_MFP;
                 spin_unlock_bh(&sta->lock);
         }
 
@@ -688,10 +719,6 @@ static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev,
         int err;
         int layer2_update;
 
-        /* Prevent a race with changing the rate control algorithm */
-        if (!netif_running(dev))
-                return -ENETDOWN;
-
         if (params->vlan) {
                 sdata = IEEE80211_DEV_TO_SUB_IF(params->vlan);
 
@@ -820,14 +847,8 @@ static int ieee80211_add_mpath(struct wiphy *wiphy, struct net_device *dev,
         struct sta_info *sta;
         int err;
 
-        if (!netif_running(dev))
-                return -ENETDOWN;
-
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
-        if (sdata->vif.type != NL80211_IFTYPE_MESH_POINT)
-                return -ENOTSUPP;
-
         rcu_read_lock();
         sta = sta_info_get(local, next_hop);
         if (!sta) {
@@ -873,14 +894,8 @@ static int ieee80211_change_mpath(struct wiphy *wiphy,
         struct mesh_path *mpath;
         struct sta_info *sta;
 
-        if (!netif_running(dev))
-                return -ENETDOWN;
-
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
-        if (sdata->vif.type != NL80211_IFTYPE_MESH_POINT)
-                return -ENOTSUPP;
-
         rcu_read_lock();
 
         sta = sta_info_get(local, next_hop);
@@ -949,9 +964,6 @@ static int ieee80211_get_mpath(struct wiphy *wiphy, struct net_device *dev,
 
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
-        if (sdata->vif.type != NL80211_IFTYPE_MESH_POINT)
-                return -ENOTSUPP;
-
         rcu_read_lock();
         mpath = mesh_path_lookup(dst, sdata);
         if (!mpath) {
@@ -973,9 +985,6 @@ static int ieee80211_dump_mpath(struct wiphy *wiphy, struct net_device *dev,
 
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
-        if (sdata->vif.type != NL80211_IFTYPE_MESH_POINT)
-                return -ENOTSUPP;
-
         rcu_read_lock();
         mpath = mesh_path_lookup_by_idx(idx, sdata);
         if (!mpath) {
@@ -995,8 +1004,6 @@ static int ieee80211_get_mesh_params(struct wiphy *wiphy,
         struct ieee80211_sub_if_data *sdata;
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
-        if (sdata->vif.type != NL80211_IFTYPE_MESH_POINT)
-                return -ENOTSUPP;
         memcpy(conf, &(sdata->u.mesh.mshcfg), sizeof(struct mesh_config));
         return 0;
 }
@@ -1014,9 +1021,6 @@ static int ieee80211_set_mesh_params(struct wiphy *wiphy,
         struct ieee80211_sub_if_data *sdata;
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
-        if (sdata->vif.type != NL80211_IFTYPE_MESH_POINT)
-                return -ENOTSUPP;
-
         /* Set the config options which we are interested in setting */
         conf = &(sdata->u.mesh.mshcfg);
         if (_chg_mesh_attr(NL80211_MESHCONF_RETRY_TIMEOUT, mask))
@@ -1064,9 +1068,6 @@ static int ieee80211_change_bss(struct wiphy *wiphy,
 
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
-        if (sdata->vif.type != NL80211_IFTYPE_AP)
-                return -EINVAL;
-
         if (params->use_cts_prot >= 0) {
                 sdata->vif.bss_conf.use_cts_prot = params->use_cts_prot;
                 changed |= BSS_CHANGED_ERP_CTS_PROT;
@@ -1141,6 +1142,150 @@ static int ieee80211_set_channel(struct wiphy *wiphy,
         return ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);
 }
 
+#ifdef CONFIG_PM
+static int ieee80211_suspend(struct wiphy *wiphy)
+{
+        return __ieee80211_suspend(wiphy_priv(wiphy));
+}
+
+static int ieee80211_resume(struct wiphy *wiphy)
+{
+        return __ieee80211_resume(wiphy_priv(wiphy));
+}
+#else
+#define ieee80211_suspend NULL
+#define ieee80211_resume NULL
+#endif
+
+static int ieee80211_scan(struct wiphy *wiphy,
+                          struct net_device *dev,
+                          struct cfg80211_scan_request *req)
+{
+        struct ieee80211_sub_if_data *sdata;
+
+        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+
+        if (sdata->vif.type != NL80211_IFTYPE_STATION &&
+            sdata->vif.type != NL80211_IFTYPE_ADHOC &&
+            sdata->vif.type != NL80211_IFTYPE_MESH_POINT)
+                return -EOPNOTSUPP;
+
+        return ieee80211_request_scan(sdata, req);
+}
+
+static int ieee80211_auth(struct wiphy *wiphy, struct net_device *dev,
+                          struct cfg80211_auth_request *req)
+{
+        struct ieee80211_sub_if_data *sdata;
+
+        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+
+        switch (req->auth_type) {
+        case NL80211_AUTHTYPE_OPEN_SYSTEM:
+                sdata->u.mgd.auth_algs = IEEE80211_AUTH_ALG_OPEN;
+                break;
+        case NL80211_AUTHTYPE_SHARED_KEY:
+                sdata->u.mgd.auth_algs = IEEE80211_AUTH_ALG_SHARED_KEY;
+                break;
+        case NL80211_AUTHTYPE_FT:
+                sdata->u.mgd.auth_algs = IEEE80211_AUTH_ALG_FT;
+                break;
+        case NL80211_AUTHTYPE_NETWORK_EAP:
+                sdata->u.mgd.auth_algs = IEEE80211_AUTH_ALG_LEAP;
+                break;
+        default:
+                return -EOPNOTSUPP;
+        }
+
+        memcpy(sdata->u.mgd.bssid, req->peer_addr, ETH_ALEN);
+        sdata->u.mgd.flags &= ~IEEE80211_STA_AUTO_BSSID_SEL;
+        sdata->u.mgd.flags |= IEEE80211_STA_BSSID_SET;
+
+        /* TODO: req->chan */
+        sdata->u.mgd.flags |= IEEE80211_STA_AUTO_CHANNEL_SEL;
+
+        if (req->ssid) {
+                sdata->u.mgd.flags |= IEEE80211_STA_SSID_SET;
+                memcpy(sdata->u.mgd.ssid, req->ssid, req->ssid_len);
+                sdata->u.mgd.ssid_len = req->ssid_len;
+                sdata->u.mgd.flags &= ~IEEE80211_STA_AUTO_SSID_SEL;
+        }
+
+        kfree(sdata->u.mgd.sme_auth_ie);
+        sdata->u.mgd.sme_auth_ie = NULL;
+        sdata->u.mgd.sme_auth_ie_len = 0;
+        if (req->ie) {
+                sdata->u.mgd.sme_auth_ie = kmalloc(req->ie_len, GFP_KERNEL);
+                if (sdata->u.mgd.sme_auth_ie == NULL)
+                        return -ENOMEM;
+                memcpy(sdata->u.mgd.sme_auth_ie, req->ie, req->ie_len);
+                sdata->u.mgd.sme_auth_ie_len = req->ie_len;
+        }
+
+        sdata->u.mgd.flags |= IEEE80211_STA_EXT_SME;
+        sdata->u.mgd.state = IEEE80211_STA_MLME_DIRECT_PROBE;
+        ieee80211_sta_req_auth(sdata);
+        return 0;
+}
+
+static int ieee80211_assoc(struct wiphy *wiphy, struct net_device *dev,
+                           struct cfg80211_assoc_request *req)
+{
+        struct ieee80211_sub_if_data *sdata;
+        int ret;
+
+        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+
+        if (memcmp(sdata->u.mgd.bssid, req->peer_addr, ETH_ALEN) != 0 ||
+            !(sdata->u.mgd.flags & IEEE80211_STA_AUTHENTICATED))
+                return -ENOLINK; /* not authenticated */
+
+        sdata->u.mgd.flags &= ~IEEE80211_STA_AUTO_BSSID_SEL;
+        sdata->u.mgd.flags |= IEEE80211_STA_BSSID_SET;
+
+        /* TODO: req->chan */
+        sdata->u.mgd.flags |= IEEE80211_STA_AUTO_CHANNEL_SEL;
+
+        if (req->ssid) {
+                sdata->u.mgd.flags |= IEEE80211_STA_SSID_SET;
+                memcpy(sdata->u.mgd.ssid, req->ssid, req->ssid_len);
+                sdata->u.mgd.ssid_len = req->ssid_len;
+                sdata->u.mgd.flags &= ~IEEE80211_STA_AUTO_SSID_SEL;
+        } else
+                sdata->u.mgd.flags |= IEEE80211_STA_AUTO_SSID_SEL;
+
+        ret = ieee80211_sta_set_extra_ie(sdata, req->ie, req->ie_len);
+        if (ret)
+                return ret;
+
+        sdata->u.mgd.flags |= IEEE80211_STA_EXT_SME;
+        sdata->u.mgd.state = IEEE80211_STA_MLME_ASSOCIATE;
+        ieee80211_sta_req_auth(sdata);
+        return 0;
+}
+
+static int ieee80211_deauth(struct wiphy *wiphy, struct net_device *dev,
+                            struct cfg80211_deauth_request *req)
+{
+        struct ieee80211_sub_if_data *sdata;
+
+        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+
+        /* TODO: req->ie */
+        return ieee80211_sta_deauthenticate(sdata, req->reason_code);
+}
+
+static int ieee80211_disassoc(struct wiphy *wiphy, struct net_device *dev,
+                              struct cfg80211_disassoc_request *req)
+{
+        struct ieee80211_sub_if_data *sdata;
+
+        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+
+        /* TODO: req->ie */
+        return ieee80211_sta_disassociate(sdata, req->reason_code);
+}
+
 struct cfg80211_ops mac80211_config_ops = {
         .add_virtual_intf = ieee80211_add_iface,
         .del_virtual_intf = ieee80211_del_iface,
@@ -1149,6 +1294,7 @@ struct cfg80211_ops mac80211_config_ops = {
         .del_key = ieee80211_del_key,
         .get_key = ieee80211_get_key,
         .set_default_key = ieee80211_config_default_key,
+        .set_default_mgmt_key = ieee80211_config_default_mgmt_key,
         .add_beacon = ieee80211_add_beacon,
         .set_beacon = ieee80211_set_beacon,
         .del_beacon = ieee80211_del_beacon,
@@ -1169,4 +1315,11 @@ struct cfg80211_ops mac80211_config_ops = {
         .change_bss = ieee80211_change_bss,
         .set_txq_params = ieee80211_set_txq_params,
         .set_channel = ieee80211_set_channel,
+        .suspend = ieee80211_suspend,
+        .resume = ieee80211_resume,
+        .scan = ieee80211_scan,
+        .auth = ieee80211_auth,
+        .assoc = ieee80211_assoc,
+        .deauth = ieee80211_deauth,
+        .disassoc = ieee80211_disassoc,
 };
diff --git a/net/mac80211/debugfs.c b/net/mac80211/debugfs.c
index 2697a2fe608f..210b9b6fecd2 100644
--- a/net/mac80211/debugfs.c
+++ b/net/mac80211/debugfs.c
@@ -40,6 +40,10 @@ static const struct file_operations name## _ops = {			\
         local->debugfs.name = debugfs_create_file(#name, 0400, phyd,    \
                                                   local, &name## _ops);
 
+#define DEBUGFS_ADD_MODE(name, mode)                                    \
+        local->debugfs.name = debugfs_create_file(#name, mode, phyd,    \
+                                                  local, &name## _ops);
+
 #define DEBUGFS_DEL(name)                                               \
         debugfs_remove(local->debugfs.name);                            \
         local->debugfs.name = NULL;
@@ -57,11 +61,80 @@ DEBUGFS_READONLY_FILE(long_retry_limit, 20, "%d",
                       local->hw.conf.long_frame_max_tx_count);
 DEBUGFS_READONLY_FILE(total_ps_buffered, 20, "%d",
                       local->total_ps_buffered);
-DEBUGFS_READONLY_FILE(wep_iv, 20, "%#06x",
+DEBUGFS_READONLY_FILE(wep_iv, 20, "%#08x",
                       local->wep_iv & 0xffffff);
 DEBUGFS_READONLY_FILE(rate_ctrl_alg, 100, "%s",
                       local->rate_ctrl ? local->rate_ctrl->ops->name : "<unset>");
 
+static ssize_t tsf_read(struct file *file, char __user *user_buf,
+                             size_t count, loff_t *ppos)
+{
+        struct ieee80211_local *local = file->private_data;
+        u64 tsf = 0;
+        char buf[100];
+
+        if (local->ops->get_tsf)
+                tsf = local->ops->get_tsf(local_to_hw(local));
+
+        snprintf(buf, sizeof(buf), "0x%016llx\n", (unsigned long long) tsf);
+
+        return simple_read_from_buffer(user_buf, count, ppos, buf, 19);
+}
+
+static ssize_t tsf_write(struct file *file,
+                         const char __user *user_buf,
+                         size_t count, loff_t *ppos)
+{
+        struct ieee80211_local *local = file->private_data;
+        unsigned long long tsf;
+        char buf[100];
+        size_t len;
+
+        len = min(count, sizeof(buf) - 1);
+        if (copy_from_user(buf, user_buf, len))
+                return -EFAULT;
+        buf[len] = '\0';
+
+        if (strncmp(buf, "reset", 5) == 0) {
+                if (local->ops->reset_tsf) {
+                        local->ops->reset_tsf(local_to_hw(local));
+                        printk(KERN_INFO "%s: debugfs reset TSF\n", wiphy_name(local->hw.wiphy));
+                }
+        } else {
+                tsf = simple_strtoul(buf, NULL, 0);
+                if (local->ops->set_tsf) {
+                        local->ops->set_tsf(local_to_hw(local), tsf);
+                        printk(KERN_INFO "%s: debugfs set TSF to %#018llx\n", wiphy_name(local->hw.wiphy), tsf);
+                }
+        }
+
+        return count;
+}
+
+static const struct file_operations tsf_ops = {
+        .read = tsf_read,
+        .write = tsf_write,
+        .open = mac80211_open_file_generic
+};
+
+static ssize_t reset_write(struct file *file, const char __user *user_buf,
+                           size_t count, loff_t *ppos)
+{
+        struct ieee80211_local *local = file->private_data;
+
+        rtnl_lock();
+        __ieee80211_suspend(&local->hw);
+        __ieee80211_resume(&local->hw);
+        rtnl_unlock();
+
+        return count;
+}
+
+static const struct file_operations reset_ops = {
+        .write = reset_write,
+        .open = mac80211_open_file_generic,
+};
+
 /* statistics stuff */
 
 #define DEBUGFS_STATS_FILE(name, buflen, fmt, value...)                 \
@@ -136,8 +209,6 @@ DEBUGFS_STATS_FILE(multicast_received_frame_count, 20, "%u",
                    local->dot11MulticastReceivedFrameCount);
 DEBUGFS_STATS_FILE(transmitted_frame_count, 20, "%u",
                    local->dot11TransmittedFrameCount);
-DEBUGFS_STATS_FILE(wep_undecryptable_count, 20, "%u",
-                   local->dot11WEPUndecryptableCount);
 #ifdef CONFIG_MAC80211_DEBUG_COUNTERS
 DEBUGFS_STATS_FILE(tx_handlers_drop, 20, "%u",
                    local->tx_handlers_drop);
@@ -204,6 +275,8 @@ void debugfs_hw_add(struct ieee80211_local *local)
         DEBUGFS_ADD(long_retry_limit);
         DEBUGFS_ADD(total_ps_buffered);
         DEBUGFS_ADD(wep_iv);
+        DEBUGFS_ADD(tsf);
+        DEBUGFS_ADD_MODE(reset, 0200);
 
         statsd = debugfs_create_dir("statistics", phyd);
         local->debugfs.statistics = statsd;
@@ -221,7 +294,6 @@ void debugfs_hw_add(struct ieee80211_local *local)
         DEBUGFS_STATS_ADD(received_fragment_count);
         DEBUGFS_STATS_ADD(multicast_received_frame_count);
         DEBUGFS_STATS_ADD(transmitted_frame_count);
-        DEBUGFS_STATS_ADD(wep_undecryptable_count);
 #ifdef CONFIG_MAC80211_DEBUG_COUNTERS
         DEBUGFS_STATS_ADD(tx_handlers_drop);
         DEBUGFS_STATS_ADD(tx_handlers_queued);
@@ -258,6 +330,8 @@ void debugfs_hw_del(struct ieee80211_local *local)
         DEBUGFS_DEL(long_retry_limit);
         DEBUGFS_DEL(total_ps_buffered);
         DEBUGFS_DEL(wep_iv);
+        DEBUGFS_DEL(tsf);
+        DEBUGFS_DEL(reset);
 
         DEBUGFS_STATS_DEL(transmitted_fragment_count);
         DEBUGFS_STATS_DEL(multicast_transmitted_frame_count);
@@ -268,7 +342,6 @@ void debugfs_hw_del(struct ieee80211_local *local)
         DEBUGFS_STATS_DEL(received_fragment_count);
         DEBUGFS_STATS_DEL(multicast_received_frame_count);
         DEBUGFS_STATS_DEL(transmitted_frame_count);
-        DEBUGFS_STATS_DEL(wep_undecryptable_count);
         DEBUGFS_STATS_DEL(num_scans);
 #ifdef CONFIG_MAC80211_DEBUG_COUNTERS
         DEBUGFS_STATS_DEL(tx_handlers_drop);
diff --git a/net/mac80211/debugfs_key.c b/net/mac80211/debugfs_key.c
index 6424ac565ae0..99c752588b30 100644
--- a/net/mac80211/debugfs_key.c
+++ b/net/mac80211/debugfs_key.c
@@ -76,6 +76,9 @@ static ssize_t key_algorithm_read(struct file *file,
         case ALG_CCMP:
                 alg = "CCMP\n";
                 break;
+        case ALG_AES_CMAC:
+                alg = "AES-128-CMAC\n";
+                break;
         default:
                 return 0;
         }
@@ -105,6 +108,12 @@ static ssize_t key_tx_spec_read(struct file *file, char __user *userbuf,
                 len = scnprintf(buf, sizeof(buf), "%02x%02x%02x%02x%02x%02x\n",
                                 tpn[0], tpn[1], tpn[2], tpn[3], tpn[4], tpn[5]);
                 break;
+        case ALG_AES_CMAC:
+                tpn = key->u.aes_cmac.tx_pn;
+                len = scnprintf(buf, sizeof(buf), "%02x%02x%02x%02x%02x%02x\n",
+                                tpn[0], tpn[1], tpn[2], tpn[3], tpn[4],
+                                tpn[5]);
+                break;
         default:
                 return 0;
         }
@@ -142,6 +151,14 @@ static ssize_t key_rx_spec_read(struct file *file, char __user *userbuf,
                 }
                 len = p - buf;
                 break;
+        case ALG_AES_CMAC:
+                rpn = key->u.aes_cmac.rx_pn;
+                p += scnprintf(p, sizeof(buf)+buf-p,
+                               "%02x%02x%02x%02x%02x%02x\n",
+                               rpn[0], rpn[1], rpn[2],
+                               rpn[3], rpn[4], rpn[5]);
+                len = p - buf;
+                break;
         default:
                 return 0;
         }
@@ -156,13 +173,40 @@ static ssize_t key_replays_read(struct file *file, char __user *userbuf,
         char buf[20];
         int len;
 
-        if (key->conf.alg != ALG_CCMP)
+        switch (key->conf.alg) {
+        case ALG_CCMP:
+                len = scnprintf(buf, sizeof(buf), "%u\n", key->u.ccmp.replays);
+                break;
+        case ALG_AES_CMAC:
+                len = scnprintf(buf, sizeof(buf), "%u\n",
+                                key->u.aes_cmac.replays);
+                break;
+        default:
                 return 0;
-        len = scnprintf(buf, sizeof(buf), "%u\n", key->u.ccmp.replays);
+        }
         return simple_read_from_buffer(userbuf, count, ppos, buf, len);
 }
 KEY_OPS(replays);
 
+static ssize_t key_icverrors_read(struct file *file, char __user *userbuf,
+                                  size_t count, loff_t *ppos)
+{
+        struct ieee80211_key *key = file->private_data;
+        char buf[20];
+        int len;
+
+        switch (key->conf.alg) {
+        case ALG_AES_CMAC:
+                len = scnprintf(buf, sizeof(buf), "%u\n",
+                                key->u.aes_cmac.icverrors);
+                break;
+        default:
+                return 0;
+        }
+        return simple_read_from_buffer(userbuf, count, ppos, buf, len);
+}
+KEY_OPS(icverrors);
+
 static ssize_t key_key_read(struct file *file, char __user *userbuf,
                             size_t count, loff_t *ppos)
 {
@@ -222,6 +266,7 @@ void ieee80211_debugfs_key_add(struct ieee80211_key *key)
         DEBUGFS_ADD(tx_spec);
         DEBUGFS_ADD(rx_spec);
         DEBUGFS_ADD(replays);
+        DEBUGFS_ADD(icverrors);
         DEBUGFS_ADD(key);
         DEBUGFS_ADD(ifindex);
 };
@@ -243,6 +288,7 @@ void ieee80211_debugfs_key_remove(struct ieee80211_key *key)
         DEBUGFS_DEL(tx_spec);
         DEBUGFS_DEL(rx_spec);
         DEBUGFS_DEL(replays);
+        DEBUGFS_DEL(icverrors);
         DEBUGFS_DEL(key);
         DEBUGFS_DEL(ifindex);
 
@@ -280,6 +326,35 @@ void ieee80211_debugfs_key_remove_default(struct ieee80211_sub_if_data *sdata)
         sdata->common_debugfs.default_key = NULL;
 }
 
+void ieee80211_debugfs_key_add_mgmt_default(struct ieee80211_sub_if_data *sdata)
+{
+        char buf[50];
+        struct ieee80211_key *key;
+
+        if (!sdata->debugfsdir)
+                return;
+
+        /* this is running under the key lock */
+
+        key = sdata->default_mgmt_key;
+        if (key) {
+                sprintf(buf, "../keys/%d", key->debugfs.cnt);
+                sdata->common_debugfs.default_mgmt_key =
+                        debugfs_create_symlink("default_mgmt_key",
+                                               sdata->debugfsdir, buf);
+        } else
+                ieee80211_debugfs_key_remove_mgmt_default(sdata);
+}
+
+void ieee80211_debugfs_key_remove_mgmt_default(struct ieee80211_sub_if_data *sdata)
+{
+        if (!sdata)
+                return;
+
+        debugfs_remove(sdata->common_debugfs.default_mgmt_key);
+        sdata->common_debugfs.default_mgmt_key = NULL;
+}
+
 void ieee80211_debugfs_key_sta_del(struct ieee80211_key *key,
                                    struct sta_info *sta)
 {
diff --git a/net/mac80211/debugfs_key.h b/net/mac80211/debugfs_key.h
index b1a3754ee240..54717b4e1371 100644
--- a/net/mac80211/debugfs_key.h
+++ b/net/mac80211/debugfs_key.h
@@ -6,6 +6,10 @@ void ieee80211_debugfs_key_add(struct ieee80211_key *key);
 void ieee80211_debugfs_key_remove(struct ieee80211_key *key);
 void ieee80211_debugfs_key_add_default(struct ieee80211_sub_if_data *sdata);
 void ieee80211_debugfs_key_remove_default(struct ieee80211_sub_if_data *sdata);
+void ieee80211_debugfs_key_add_mgmt_default(
+        struct ieee80211_sub_if_data *sdata);
+void ieee80211_debugfs_key_remove_mgmt_default(
+        struct ieee80211_sub_if_data *sdata);
 void ieee80211_debugfs_key_sta_del(struct ieee80211_key *key,
                                    struct sta_info *sta);
 #else
@@ -19,6 +23,12 @@ static inline void ieee80211_debugfs_key_add_default(
 static inline void ieee80211_debugfs_key_remove_default(
         struct ieee80211_sub_if_data *sdata)
 {}
+static inline void ieee80211_debugfs_key_add_mgmt_default(
+        struct ieee80211_sub_if_data *sdata)
+{}
+static inline void ieee80211_debugfs_key_remove_mgmt_default(
+        struct ieee80211_sub_if_data *sdata)
+{}
 static inline void ieee80211_debugfs_key_sta_del(struct ieee80211_key *key,
                                                  struct sta_info *sta)
 {}
diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c
index c54219301724..e3420329f4e6 100644
--- a/net/mac80211/debugfs_netdev.c
+++ b/net/mac80211/debugfs_netdev.c
@@ -94,31 +94,31 @@ IEEE80211_IF_FILE(drop_unencrypted, drop_unencrypted, DEC);
 IEEE80211_IF_FILE(force_unicast_rateidx, force_unicast_rateidx, DEC);
 IEEE80211_IF_FILE(max_ratectrl_rateidx, max_ratectrl_rateidx, DEC);
 
-/* STA/IBSS attributes */
-IEEE80211_IF_FILE(state, u.sta.state, DEC);
-IEEE80211_IF_FILE(bssid, u.sta.bssid, MAC);
-IEEE80211_IF_FILE(prev_bssid, u.sta.prev_bssid, MAC);
-IEEE80211_IF_FILE(ssid_len, u.sta.ssid_len, SIZE);
-IEEE80211_IF_FILE(aid, u.sta.aid, DEC);
-IEEE80211_IF_FILE(ap_capab, u.sta.ap_capab, HEX);
-IEEE80211_IF_FILE(capab, u.sta.capab, HEX);
-IEEE80211_IF_FILE(extra_ie_len, u.sta.extra_ie_len, SIZE);
-IEEE80211_IF_FILE(auth_tries, u.sta.auth_tries, DEC);
-IEEE80211_IF_FILE(assoc_tries, u.sta.assoc_tries, DEC);
-IEEE80211_IF_FILE(auth_algs, u.sta.auth_algs, HEX);
-IEEE80211_IF_FILE(auth_alg, u.sta.auth_alg, DEC);
-IEEE80211_IF_FILE(auth_transaction, u.sta.auth_transaction, DEC);
+/* STA attributes */
+IEEE80211_IF_FILE(state, u.mgd.state, DEC);
+IEEE80211_IF_FILE(bssid, u.mgd.bssid, MAC);
+IEEE80211_IF_FILE(prev_bssid, u.mgd.prev_bssid, MAC);
+IEEE80211_IF_FILE(ssid_len, u.mgd.ssid_len, SIZE);
+IEEE80211_IF_FILE(aid, u.mgd.aid, DEC);
+IEEE80211_IF_FILE(ap_capab, u.mgd.ap_capab, HEX);
+IEEE80211_IF_FILE(capab, u.mgd.capab, HEX);
+IEEE80211_IF_FILE(extra_ie_len, u.mgd.extra_ie_len, SIZE);
+IEEE80211_IF_FILE(auth_tries, u.mgd.auth_tries, DEC);
+IEEE80211_IF_FILE(assoc_tries, u.mgd.assoc_tries, DEC);
+IEEE80211_IF_FILE(auth_algs, u.mgd.auth_algs, HEX);
+IEEE80211_IF_FILE(auth_alg, u.mgd.auth_alg, DEC);
+IEEE80211_IF_FILE(auth_transaction, u.mgd.auth_transaction, DEC);
 
 static ssize_t ieee80211_if_fmt_flags(
         const struct ieee80211_sub_if_data *sdata, char *buf, int buflen)
 {
         return scnprintf(buf, buflen, "%s%s%s%s%s%s%s\n",
-                 sdata->u.sta.flags & IEEE80211_STA_SSID_SET ? "SSID\n" : "",
-                 sdata->u.sta.flags & IEEE80211_STA_BSSID_SET ? "BSSID\n" : "",
-                 sdata->u.sta.flags & IEEE80211_STA_PREV_BSSID_SET ? "prev BSSID\n" : "",
-                 sdata->u.sta.flags & IEEE80211_STA_AUTHENTICATED ? "AUTH\n" : "",
-                 sdata->u.sta.flags & IEEE80211_STA_ASSOCIATED ? "ASSOC\n" : "",
-                 sdata->u.sta.flags & IEEE80211_STA_PROBEREQ_POLL ? "PROBEREQ POLL\n" : "",
+                 sdata->u.mgd.flags & IEEE80211_STA_SSID_SET ? "SSID\n" : "",
+                 sdata->u.mgd.flags & IEEE80211_STA_BSSID_SET ? "BSSID\n" : "",
+                 sdata->u.mgd.flags & IEEE80211_STA_PREV_BSSID_SET ? "prev BSSID\n" : "",
+                 sdata->u.mgd.flags & IEEE80211_STA_AUTHENTICATED ? "AUTH\n" : "",
+                 sdata->u.mgd.flags & IEEE80211_STA_ASSOCIATED ? "ASSOC\n" : "",
+                 sdata->u.mgd.flags & IEEE80211_STA_PROBEREQ_POLL ? "PROBEREQ POLL\n" : "",
                  sdata->vif.bss_conf.use_cts_prot ? "CTS prot\n" : "");
 }
 __IEEE80211_IF_FILE(flags);
@@ -283,9 +283,11 @@ static void add_files(struct ieee80211_sub_if_data *sdata)
 #endif
                 break;
         case NL80211_IFTYPE_STATION:
-        case NL80211_IFTYPE_ADHOC:
                 add_sta_files(sdata);
                 break;
+        case NL80211_IFTYPE_ADHOC:
+                /* XXX */
+                break;
         case NL80211_IFTYPE_AP:
                 add_ap_files(sdata);
                 break;
@@ -418,9 +420,11 @@ static void del_files(struct ieee80211_sub_if_data *sdata)
 #endif
                 break;
         case NL80211_IFTYPE_STATION:
-        case NL80211_IFTYPE_ADHOC:
                 del_sta_files(sdata);
                 break;
+        case NL80211_IFTYPE_ADHOC:
+                /* XXX */
+                break;
         case NL80211_IFTYPE_AP:
                 del_ap_files(sdata);
                 break;
diff --git a/net/mac80211/debugfs_sta.c b/net/mac80211/debugfs_sta.c
index a2fbe0131312..90230c718b5b 100644
--- a/net/mac80211/debugfs_sta.c
+++ b/net/mac80211/debugfs_sta.c
@@ -67,14 +67,15 @@ static ssize_t sta_flags_read(struct file *file, char __user *userbuf,
         char buf[100];
         struct sta_info *sta = file->private_data;
         u32 staflags = get_sta_flags(sta);
-        int res = scnprintf(buf, sizeof(buf), "%s%s%s%s%s%s%s",
+        int res = scnprintf(buf, sizeof(buf), "%s%s%s%s%s%s%s%s",
                 staflags & WLAN_STA_AUTH ? "AUTH\n" : "",
                 staflags & WLAN_STA_ASSOC ? "ASSOC\n" : "",
                 staflags & WLAN_STA_PS ? "PS\n" : "",
                 staflags & WLAN_STA_AUTHORIZED ? "AUTHORIZED\n" : "",
                 staflags & WLAN_STA_SHORT_PREAMBLE ? "SHORT PREAMBLE\n" : "",
                 staflags & WLAN_STA_WME ? "WME\n" : "",
-                staflags & WLAN_STA_WDS ? "WDS\n" : "");
+                staflags & WLAN_STA_WDS ? "WDS\n" : "",
+                staflags & WLAN_STA_MFP ? "MFP\n" : "");
         return simple_read_from_buffer(userbuf, count, ppos, buf, res);
 }
 STA_OPS(flags);
diff --git a/net/mac80211/ht.c b/net/mac80211/ht.c
index c5c0c5271096..4e3c72f20de7 100644
--- a/net/mac80211/ht.c
+++ b/net/mac80211/ht.c
@@ -17,8 +17,7 @@
 #include <net/wireless.h>
 #include <net/mac80211.h>
 #include "ieee80211_i.h"
-#include "sta_info.h"
-#include "wme.h"
+#include "rate.h"
 
 void ieee80211_ht_cap_ie_to_sta_ht_cap(struct ieee80211_supported_band *sband,
                                        struct ieee80211_ht_cap *ht_cap_ie,
@@ -95,7 +94,9 @@ u32 ieee80211_enable_ht(struct ieee80211_sub_if_data *sdata,
 {
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_supported_band *sband;
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_bss_ht_conf ht;
+        struct sta_info *sta;
         u32 changed = 0;
         bool enable_ht = true, ht_changed;
         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
@@ -130,14 +131,25 @@ u32 ieee80211_enable_ht(struct ieee80211_sub_if_data *sdata,
                 }
         }
 
-        ht_changed = local->hw.conf.ht.enabled != enable_ht ||
-                     channel_type != local->hw.conf.ht.channel_type;
+        ht_changed = conf_is_ht(&local->hw.conf) != enable_ht ||
+                     channel_type != local->hw.conf.channel_type;
 
         local->oper_channel_type = channel_type;
-        local->hw.conf.ht.enabled = enable_ht;
 
-        if (ht_changed)
-                ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_HT);
+        if (ht_changed) {
+                /* channel_type change automatically detected */
+                ieee80211_hw_config(local, 0);
+
+                rcu_read_lock();
+
+                sta = sta_info_get(local, ifmgd->bssid);
+                if (sta)
+                        rate_control_rate_update(local, sband, sta,
+                                                 IEEE80211_RC_HT_CHANGED);
+
+                rcu_read_unlock();
+
+        }
 
         /* disable HT */
         if (!enable_ht)
@@ -154,108 +166,22 @@ u32 ieee80211_enable_ht(struct ieee80211_sub_if_data *sdata,
         return changed;
 }
 
-static void ieee80211_send_addba_request(struct ieee80211_sub_if_data *sdata,
-                                         const u8 *da, u16 tid,
-                                         u8 dialog_token, u16 start_seq_num,
-                                         u16 agg_size, u16 timeout)
+void ieee80211_sta_tear_down_BA_sessions(struct sta_info *sta)
 {
-        struct ieee80211_local *local = sdata->local;
-        struct ieee80211_if_sta *ifsta = &sdata->u.sta;
-        struct sk_buff *skb;
-        struct ieee80211_mgmt *mgmt;
-        u16 capab;
-
-        skb = dev_alloc_skb(sizeof(*mgmt) + local->hw.extra_tx_headroom);
-
-        if (!skb) {
-                printk(KERN_ERR "%s: failed to allocate buffer "
-                                "for addba request frame\n", sdata->dev->name);
-                return;
-        }
-        skb_reserve(skb, local->hw.extra_tx_headroom);
-        mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
-        memset(mgmt, 0, 24);
-        memcpy(mgmt->da, da, ETH_ALEN);
-        memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
-        if (sdata->vif.type == NL80211_IFTYPE_AP)
-                memcpy(mgmt->bssid, sdata->dev->dev_addr, ETH_ALEN);
-        else
-                memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
-
-        mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
-                                          IEEE80211_STYPE_ACTION);
-
-        skb_put(skb, 1 + sizeof(mgmt->u.action.u.addba_req));
-
-        mgmt->u.action.category = WLAN_CATEGORY_BACK;
-        mgmt->u.action.u.addba_req.action_code = WLAN_ACTION_ADDBA_REQ;
-
-        mgmt->u.action.u.addba_req.dialog_token = dialog_token;
-        capab = (u16)(1 << 1);          /* bit 1 aggregation policy */
-        capab |= (u16)(tid << 2);       /* bit 5:2 TID number */
-        capab |= (u16)(agg_size << 6);  /* bit 15:6 max size of aggergation */
-
-        mgmt->u.action.u.addba_req.capab = cpu_to_le16(capab);
-
-        mgmt->u.action.u.addba_req.timeout = cpu_to_le16(timeout);
-        mgmt->u.action.u.addba_req.start_seq_num =
-                                        cpu_to_le16(start_seq_num << 4);
-
-        ieee80211_tx_skb(sdata, skb, 0);
-}
-
-static void ieee80211_send_addba_resp(struct ieee80211_sub_if_data *sdata, u8 *da, u16 tid,
-                                      u8 dialog_token, u16 status, u16 policy,
-                                      u16 buf_size, u16 timeout)
-{
-        struct ieee80211_if_sta *ifsta = &sdata->u.sta;
-        struct ieee80211_local *local = sdata->local;
-        struct sk_buff *skb;
-        struct ieee80211_mgmt *mgmt;
-        u16 capab;
-
-        skb = dev_alloc_skb(sizeof(*mgmt) + local->hw.extra_tx_headroom);
+        int i;
 
-        if (!skb) {
-                printk(KERN_DEBUG "%s: failed to allocate buffer "
-                       "for addba resp frame\n", sdata->dev->name);
-                return;
+        for (i = 0; i <  STA_TID_NUM; i++) {
+                __ieee80211_stop_tx_ba_session(sta, i, WLAN_BACK_INITIATOR);
+                __ieee80211_stop_rx_ba_session(sta, i, WLAN_BACK_RECIPIENT,
+                                               WLAN_REASON_QSTA_LEAVE_QBSS);
         }
-
-        skb_reserve(skb, local->hw.extra_tx_headroom);
-        mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
-        memset(mgmt, 0, 24);
-        memcpy(mgmt->da, da, ETH_ALEN);
-        memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
-        if (sdata->vif.type == NL80211_IFTYPE_AP)
-                memcpy(mgmt->bssid, sdata->dev->dev_addr, ETH_ALEN);
-        else
-                memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
-        mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
-                                          IEEE80211_STYPE_ACTION);
-
-        skb_put(skb, 1 + sizeof(mgmt->u.action.u.addba_resp));
-        mgmt->u.action.category = WLAN_CATEGORY_BACK;
-        mgmt->u.action.u.addba_resp.action_code = WLAN_ACTION_ADDBA_RESP;
-        mgmt->u.action.u.addba_resp.dialog_token = dialog_token;
-
-        capab = (u16)(policy << 1);     /* bit 1 aggregation policy */
-        capab |= (u16)(tid << 2);       /* bit 5:2 TID number */
-        capab |= (u16)(buf_size << 6);  /* bit 15:6 max size of aggregation */
-
-        mgmt->u.action.u.addba_resp.capab = cpu_to_le16(capab);
-        mgmt->u.action.u.addba_resp.timeout = cpu_to_le16(timeout);
-        mgmt->u.action.u.addba_resp.status = cpu_to_le16(status);
-
-        ieee80211_tx_skb(sdata, skb, 0);
 }
 
-static void ieee80211_send_delba(struct ieee80211_sub_if_data *sdata,
-                                 const u8 *da, u16 tid,
-                                 u16 initiator, u16 reason_code)
+void ieee80211_send_delba(struct ieee80211_sub_if_data *sdata,
+                          const u8 *da, u16 tid,
+                          u16 initiator, u16 reason_code)
 {
         struct ieee80211_local *local = sdata->local;
-        struct ieee80211_if_sta *ifsta = &sdata->u.sta;
         struct sk_buff *skb;
         struct ieee80211_mgmt *mgmt;
         u16 params;
@@ -273,10 +199,12 @@ static void ieee80211_send_delba(struct ieee80211_sub_if_data *sdata,
         memset(mgmt, 0, 24);
         memcpy(mgmt->da, da, ETH_ALEN);
         memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
-        if (sdata->vif.type == NL80211_IFTYPE_AP)
+        if (sdata->vif.type == NL80211_IFTYPE_AP ||
+            sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
                 memcpy(mgmt->bssid, sdata->dev->dev_addr, ETH_ALEN);
-        else
-                memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
+        else if (sdata->vif.type == NL80211_IFTYPE_STATION)
+                memcpy(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN);
+
         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
                                           IEEE80211_STYPE_ACTION);
 
@@ -290,770 +218,7 @@ static void ieee80211_send_delba(struct ieee80211_sub_if_data *sdata,
         mgmt->u.action.u.delba.params = cpu_to_le16(params);
         mgmt->u.action.u.delba.reason_code = cpu_to_le16(reason_code);
 
-        ieee80211_tx_skb(sdata, skb, 0);
-}
-
-void ieee80211_send_bar(struct ieee80211_sub_if_data *sdata, u8 *ra, u16 tid, u16 ssn)
-{
-        struct ieee80211_local *local = sdata->local;
-        struct sk_buff *skb;
-        struct ieee80211_bar *bar;
-        u16 bar_control = 0;
-
-        skb = dev_alloc_skb(sizeof(*bar) + local->hw.extra_tx_headroom);
-        if (!skb) {
-                printk(KERN_ERR "%s: failed to allocate buffer for "
-                        "bar frame\n", sdata->dev->name);
-                return;
-        }
-        skb_reserve(skb, local->hw.extra_tx_headroom);
-        bar = (struct ieee80211_bar *)skb_put(skb, sizeof(*bar));
-        memset(bar, 0, sizeof(*bar));
-        bar->frame_control = cpu_to_le16(IEEE80211_FTYPE_CTL |
-                                         IEEE80211_STYPE_BACK_REQ);
-        memcpy(bar->ra, ra, ETH_ALEN);
-        memcpy(bar->ta, sdata->dev->dev_addr, ETH_ALEN);
-        bar_control |= (u16)IEEE80211_BAR_CTRL_ACK_POLICY_NORMAL;
-        bar_control |= (u16)IEEE80211_BAR_CTRL_CBMTID_COMPRESSED_BA;
-        bar_control |= (u16)(tid << 12);
-        bar->control = cpu_to_le16(bar_control);
-        bar->start_seq_num = cpu_to_le16(ssn);
-
-        ieee80211_tx_skb(sdata, skb, 0);
-}
-
-void ieee80211_sta_stop_rx_ba_session(struct ieee80211_sub_if_data *sdata, u8 *ra, u16 tid,
-                                        u16 initiator, u16 reason)
-{
-        struct ieee80211_local *local = sdata->local;
-        struct ieee80211_hw *hw = &local->hw;
-        struct sta_info *sta;
-        int ret, i;
-
-        rcu_read_lock();
-
-        sta = sta_info_get(local, ra);
-        if (!sta) {
-                rcu_read_unlock();
-                return;
-        }
-
-        /* check if TID is in operational state */
-        spin_lock_bh(&sta->lock);
-        if (sta->ampdu_mlme.tid_state_rx[tid]
-                                != HT_AGG_STATE_OPERATIONAL) {
-                spin_unlock_bh(&sta->lock);
-                rcu_read_unlock();
-                return;
-        }
-        sta->ampdu_mlme.tid_state_rx[tid] =
-                HT_AGG_STATE_REQ_STOP_BA_MSK |
-                (initiator << HT_AGG_STATE_INITIATOR_SHIFT);
-        spin_unlock_bh(&sta->lock);
-
-        /* stop HW Rx aggregation. ampdu_action existence
-         * already verified in session init so we add the BUG_ON */
-        BUG_ON(!local->ops->ampdu_action);
-
-#ifdef CONFIG_MAC80211_HT_DEBUG
-        printk(KERN_DEBUG "Rx BA session stop requested for %pM tid %u\n",
-               ra, tid);
-#endif /* CONFIG_MAC80211_HT_DEBUG */
-
-        ret = local->ops->ampdu_action(hw, IEEE80211_AMPDU_RX_STOP,
-                                       &sta->sta, tid, NULL);
-        if (ret)
-                printk(KERN_DEBUG "HW problem - can not stop rx "
-                                "aggregation for tid %d\n", tid);
-
-        /* shutdown timer has not expired */
-        if (initiator != WLAN_BACK_TIMER)
-                del_timer_sync(&sta->ampdu_mlme.tid_rx[tid]->session_timer);
-
-        /* check if this is a self generated aggregation halt */
-        if (initiator == WLAN_BACK_RECIPIENT || initiator == WLAN_BACK_TIMER)
-                ieee80211_send_delba(sdata, ra, tid, 0, reason);
-
-        /* free the reordering buffer */
-        for (i = 0; i < sta->ampdu_mlme.tid_rx[tid]->buf_size; i++) {
-                if (sta->ampdu_mlme.tid_rx[tid]->reorder_buf[i]) {
-                        /* release the reordered frames */
-                        dev_kfree_skb(sta->ampdu_mlme.tid_rx[tid]->reorder_buf[i]);
-                        sta->ampdu_mlme.tid_rx[tid]->stored_mpdu_num--;
-                        sta->ampdu_mlme.tid_rx[tid]->reorder_buf[i] = NULL;
-                }
-        }
-        /* free resources */
-        kfree(sta->ampdu_mlme.tid_rx[tid]->reorder_buf);
-        kfree(sta->ampdu_mlme.tid_rx[tid]);
-        sta->ampdu_mlme.tid_rx[tid] = NULL;
-        sta->ampdu_mlme.tid_state_rx[tid] = HT_AGG_STATE_IDLE;
-
-        rcu_read_unlock();
-}
-
-
-/*
- * After sending add Block Ack request we activated a timer until
- * add Block Ack response will arrive from the recipient.
- * If this timer expires sta_addba_resp_timer_expired will be executed.
- */
-static void sta_addba_resp_timer_expired(unsigned long data)
-{
-        /* not an elegant detour, but there is no choice as the timer passes
-         * only one argument, and both sta_info and TID are needed, so init
-         * flow in sta_info_create gives the TID as data, while the timer_to_id
-         * array gives the sta through container_of */
-        u16 tid = *(u8 *)data;
-        struct sta_info *temp_sta = container_of((void *)data,
-                struct sta_info, timer_to_tid[tid]);
-
-        struct ieee80211_local *local = temp_sta->local;
-        struct ieee80211_hw *hw = &local->hw;
-        struct sta_info *sta;
-        u8 *state;
-
-        rcu_read_lock();
-
-        sta = sta_info_get(local, temp_sta->sta.addr);
-        if (!sta) {
-                rcu_read_unlock();
-                return;
-        }
-
-        state = &sta->ampdu_mlme.tid_state_tx[tid];
-        /* check if the TID waits for addBA response */
-        spin_lock_bh(&sta->lock);
-        if (!(*state & HT_ADDBA_REQUESTED_MSK)) {
-                spin_unlock_bh(&sta->lock);
-                *state = HT_AGG_STATE_IDLE;
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                printk(KERN_DEBUG "timer expired on tid %d but we are not "
-                                "expecting addBA response there", tid);
-#endif
-                goto timer_expired_exit;
-        }
-
-#ifdef CONFIG_MAC80211_HT_DEBUG
-        printk(KERN_DEBUG "addBA response timer expired on tid %d\n", tid);
-#endif
-
-        /* go through the state check in stop_BA_session */
-        *state = HT_AGG_STATE_OPERATIONAL;
-        spin_unlock_bh(&sta->lock);
-        ieee80211_stop_tx_ba_session(hw, temp_sta->sta.addr, tid,
-                                     WLAN_BACK_INITIATOR);
-
-timer_expired_exit:
-        rcu_read_unlock();
-}
-
-void ieee80211_sta_tear_down_BA_sessions(struct ieee80211_sub_if_data *sdata, u8 *addr)
-{
-        struct ieee80211_local *local = sdata->local;
-        int i;
-
-        for (i = 0; i <  STA_TID_NUM; i++) {
-                ieee80211_stop_tx_ba_session(&local->hw, addr, i,
-                                             WLAN_BACK_INITIATOR);
-                ieee80211_sta_stop_rx_ba_session(sdata, addr, i,
-                                                 WLAN_BACK_RECIPIENT,
-                                                 WLAN_REASON_QSTA_LEAVE_QBSS);
-        }
-}
-
-int ieee80211_start_tx_ba_session(struct ieee80211_hw *hw, u8 *ra, u16 tid)
-{
-        struct ieee80211_local *local = hw_to_local(hw);
-        struct sta_info *sta;
-        struct ieee80211_sub_if_data *sdata;
-        u16 start_seq_num;
-        u8 *state;
-        int ret = 0;
-
-        if ((tid >= STA_TID_NUM) || !(hw->flags & IEEE80211_HW_AMPDU_AGGREGATION))
-                return -EINVAL;
-
-#ifdef CONFIG_MAC80211_HT_DEBUG
-        printk(KERN_DEBUG "Open BA session requested for %pM tid %u\n",
-               ra, tid);
-#endif /* CONFIG_MAC80211_HT_DEBUG */
-
-        rcu_read_lock();
-
-        sta = sta_info_get(local, ra);
-        if (!sta) {
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                printk(KERN_DEBUG "Could not find the station\n");
-#endif
-                ret = -ENOENT;
-                goto exit;
-        }
-
-        spin_lock_bh(&sta->lock);
-
-        /* we have tried too many times, receiver does not want A-MPDU */
-        if (sta->ampdu_mlme.addba_req_num[tid] > HT_AGG_MAX_RETRIES) {
-                ret = -EBUSY;
-                goto err_unlock_sta;
-        }
-
-        state = &sta->ampdu_mlme.tid_state_tx[tid];
-        /* check if the TID is not in aggregation flow already */
-        if (*state != HT_AGG_STATE_IDLE) {
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                printk(KERN_DEBUG "BA request denied - session is not "
-                                 "idle on tid %u\n", tid);
-#endif /* CONFIG_MAC80211_HT_DEBUG */
-                ret = -EAGAIN;
-                goto err_unlock_sta;
-        }
-
-        /* prepare A-MPDU MLME for Tx aggregation */
-        sta->ampdu_mlme.tid_tx[tid] =
-                        kmalloc(sizeof(struct tid_ampdu_tx), GFP_ATOMIC);
-        if (!sta->ampdu_mlme.tid_tx[tid]) {
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                if (net_ratelimit())
-                        printk(KERN_ERR "allocate tx mlme to tid %d failed\n",
-                                        tid);
-#endif
-                ret = -ENOMEM;
-                goto err_unlock_sta;
-        }
-        /* Tx timer */
-        sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer.function =
-                        sta_addba_resp_timer_expired;
-        sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer.data =
-                        (unsigned long)&sta->timer_to_tid[tid];
-        init_timer(&sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer);
-
-        if (hw->ampdu_queues) {
-                /* create a new queue for this aggregation */
-                ret = ieee80211_ht_agg_queue_add(local, sta, tid);
-
-                /* case no queue is available to aggregation
-                 * don't switch to aggregation */
-                if (ret) {
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                        printk(KERN_DEBUG "BA request denied - "
-                               "queue unavailable for tid %d\n", tid);
-#endif /* CONFIG_MAC80211_HT_DEBUG */
-                        goto err_unlock_queue;
-                }
-        }
-        sdata = sta->sdata;
-
-        /* Ok, the Addba frame hasn't been sent yet, but if the driver calls the
-         * call back right away, it must see that the flow has begun */
-        *state |= HT_ADDBA_REQUESTED_MSK;
-
-        /* This is slightly racy because the queue isn't stopped */
-        start_seq_num = sta->tid_seq[tid];
-
-        if (local->ops->ampdu_action)
-                ret = local->ops->ampdu_action(hw, IEEE80211_AMPDU_TX_START,
-                                               &sta->sta, tid, &start_seq_num);
-
-        if (ret) {
-                /* No need to requeue the packets in the agg queue, since we
-                 * held the tx lock: no packet could be enqueued to the newly
-                 * allocated queue */
-                if (hw->ampdu_queues)
-                        ieee80211_ht_agg_queue_remove(local, sta, tid, 0);
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                printk(KERN_DEBUG "BA request denied - HW unavailable for"
-                                        " tid %d\n", tid);
-#endif /* CONFIG_MAC80211_HT_DEBUG */
-                *state = HT_AGG_STATE_IDLE;
-                goto err_unlock_queue;
-        }
-
-        /* Will put all the packets in the new SW queue */
-        if (hw->ampdu_queues)
-                ieee80211_requeue(local, ieee802_1d_to_ac[tid]);
-        spin_unlock_bh(&sta->lock);
-
-        /* send an addBA request */
-        sta->ampdu_mlme.dialog_token_allocator++;
-        sta->ampdu_mlme.tid_tx[tid]->dialog_token =
-                        sta->ampdu_mlme.dialog_token_allocator;
-        sta->ampdu_mlme.tid_tx[tid]->ssn = start_seq_num;
-
-
-        ieee80211_send_addba_request(sta->sdata, ra, tid,
-                         sta->ampdu_mlme.tid_tx[tid]->dialog_token,
-                         sta->ampdu_mlme.tid_tx[tid]->ssn,
-                         0x40, 5000);
-        /* activate the timer for the recipient's addBA response */
-        sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer.expires =
-                                jiffies + ADDBA_RESP_INTERVAL;
-        add_timer(&sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer);
-#ifdef CONFIG_MAC80211_HT_DEBUG
-        printk(KERN_DEBUG "activated addBA response timer on tid %d\n", tid);
-#endif
-        goto exit;
-
-err_unlock_queue:
-        kfree(sta->ampdu_mlme.tid_tx[tid]);
-        sta->ampdu_mlme.tid_tx[tid] = NULL;
-        ret = -EBUSY;
-err_unlock_sta:
-        spin_unlock_bh(&sta->lock);
-exit:
-        rcu_read_unlock();
-        return ret;
-}
-EXPORT_SYMBOL(ieee80211_start_tx_ba_session);
-
-int ieee80211_stop_tx_ba_session(struct ieee80211_hw *hw,
-                                 u8 *ra, u16 tid,
-                                 enum ieee80211_back_parties initiator)
-{
-        struct ieee80211_local *local = hw_to_local(hw);
-        struct sta_info *sta;
-        u8 *state;
-        int ret = 0;
-
-        if (tid >= STA_TID_NUM)
-                return -EINVAL;
-
-        rcu_read_lock();
-        sta = sta_info_get(local, ra);
-        if (!sta) {
-                rcu_read_unlock();
-                return -ENOENT;
-        }
-
-        /* check if the TID is in aggregation */
-        state = &sta->ampdu_mlme.tid_state_tx[tid];
-        spin_lock_bh(&sta->lock);
-
-        if (*state != HT_AGG_STATE_OPERATIONAL) {
-                ret = -ENOENT;
-                goto stop_BA_exit;
-        }
-
-#ifdef CONFIG_MAC80211_HT_DEBUG
-        printk(KERN_DEBUG "Tx BA session stop requested for %pM tid %u\n",
-               ra, tid);
-#endif /* CONFIG_MAC80211_HT_DEBUG */
-
-        if (hw->ampdu_queues)
-                ieee80211_stop_queue(hw, sta->tid_to_tx_q[tid]);
-
-        *state = HT_AGG_STATE_REQ_STOP_BA_MSK |
-                (initiator << HT_AGG_STATE_INITIATOR_SHIFT);
-
-        if (local->ops->ampdu_action)
-                ret = local->ops->ampdu_action(hw, IEEE80211_AMPDU_TX_STOP,
-                                               &sta->sta, tid, NULL);
-
-        /* case HW denied going back to legacy */
-        if (ret) {
-                WARN_ON(ret != -EBUSY);
-                *state = HT_AGG_STATE_OPERATIONAL;
-                if (hw->ampdu_queues)
-                        ieee80211_wake_queue(hw, sta->tid_to_tx_q[tid]);
-                goto stop_BA_exit;
-        }
-
-stop_BA_exit:
-        spin_unlock_bh(&sta->lock);
-        rcu_read_unlock();
-        return ret;
-}
-EXPORT_SYMBOL(ieee80211_stop_tx_ba_session);
-
-void ieee80211_start_tx_ba_cb(struct ieee80211_hw *hw, u8 *ra, u16 tid)
-{
-        struct ieee80211_local *local = hw_to_local(hw);
-        struct sta_info *sta;
-        u8 *state;
-
-        if (tid >= STA_TID_NUM) {
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                printk(KERN_DEBUG "Bad TID value: tid = %d (>= %d)\n",
-                                tid, STA_TID_NUM);
-#endif
-                return;
-        }
-
-        rcu_read_lock();
-        sta = sta_info_get(local, ra);
-        if (!sta) {
-                rcu_read_unlock();
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                printk(KERN_DEBUG "Could not find station: %pM\n", ra);
-#endif
-                return;
-        }
-
-        state = &sta->ampdu_mlme.tid_state_tx[tid];
-        spin_lock_bh(&sta->lock);
-
-        if (!(*state & HT_ADDBA_REQUESTED_MSK)) {
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                printk(KERN_DEBUG "addBA was not requested yet, state is %d\n",
-                                *state);
-#endif
-                spin_unlock_bh(&sta->lock);
-                rcu_read_unlock();
-                return;
-        }
-
-        WARN_ON_ONCE(*state & HT_ADDBA_DRV_READY_MSK);
-
-        *state |= HT_ADDBA_DRV_READY_MSK;
-
-        if (*state == HT_AGG_STATE_OPERATIONAL) {
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                printk(KERN_DEBUG "Aggregation is on for tid %d \n", tid);
-#endif
-                if (hw->ampdu_queues)
-                        ieee80211_wake_queue(hw, sta->tid_to_tx_q[tid]);
-        }
-        spin_unlock_bh(&sta->lock);
-        rcu_read_unlock();
-}
-EXPORT_SYMBOL(ieee80211_start_tx_ba_cb);
-
-void ieee80211_stop_tx_ba_cb(struct ieee80211_hw *hw, u8 *ra, u8 tid)
-{
-        struct ieee80211_local *local = hw_to_local(hw);
-        struct sta_info *sta;
-        u8 *state;
-        int agg_queue;
-
-        if (tid >= STA_TID_NUM) {
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                printk(KERN_DEBUG "Bad TID value: tid = %d (>= %d)\n",
-                                tid, STA_TID_NUM);
-#endif
-                return;
-        }
-
-#ifdef CONFIG_MAC80211_HT_DEBUG
-        printk(KERN_DEBUG "Stopping Tx BA session for %pM tid %d\n",
-               ra, tid);
-#endif /* CONFIG_MAC80211_HT_DEBUG */
-
-        rcu_read_lock();
-        sta = sta_info_get(local, ra);
-        if (!sta) {
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                printk(KERN_DEBUG "Could not find station: %pM\n", ra);
-#endif
-                rcu_read_unlock();
-                return;
-        }
-        state = &sta->ampdu_mlme.tid_state_tx[tid];
-
-        /* NOTE: no need to use sta->lock in this state check, as
-         * ieee80211_stop_tx_ba_session will let only one stop call to
-         * pass through per sta/tid
-         */
-        if ((*state & HT_AGG_STATE_REQ_STOP_BA_MSK) == 0) {
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                printk(KERN_DEBUG "unexpected callback to A-MPDU stop\n");
-#endif
-                rcu_read_unlock();
-                return;
-        }
-
-        if (*state & HT_AGG_STATE_INITIATOR_MSK)
-                ieee80211_send_delba(sta->sdata, ra, tid,
-                        WLAN_BACK_INITIATOR, WLAN_REASON_QSTA_NOT_USE);
-
-        if (hw->ampdu_queues) {
-                agg_queue = sta->tid_to_tx_q[tid];
-                ieee80211_ht_agg_queue_remove(local, sta, tid, 1);
-
-                /* We just requeued the all the frames that were in the
-                 * removed queue, and since we might miss a softirq we do
-                 * netif_schedule_queue.  ieee80211_wake_queue is not used
-                 * here as this queue is not necessarily stopped
-                 */
-                netif_schedule_queue(netdev_get_tx_queue(local->mdev,
-                                                         agg_queue));
-        }
-        spin_lock_bh(&sta->lock);
-        *state = HT_AGG_STATE_IDLE;
-        sta->ampdu_mlme.addba_req_num[tid] = 0;
-        kfree(sta->ampdu_mlme.tid_tx[tid]);
-        sta->ampdu_mlme.tid_tx[tid] = NULL;
-        spin_unlock_bh(&sta->lock);
-
-        rcu_read_unlock();
-}
-EXPORT_SYMBOL(ieee80211_stop_tx_ba_cb);
-
-void ieee80211_start_tx_ba_cb_irqsafe(struct ieee80211_hw *hw,
-                                      const u8 *ra, u16 tid)
-{
-        struct ieee80211_local *local = hw_to_local(hw);
-        struct ieee80211_ra_tid *ra_tid;
-        struct sk_buff *skb = dev_alloc_skb(0);
-
-        if (unlikely(!skb)) {
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                if (net_ratelimit())
-                        printk(KERN_WARNING "%s: Not enough memory, "
-                               "dropping start BA session", skb->dev->name);
-#endif
-                return;
-        }
-        ra_tid = (struct ieee80211_ra_tid *) &skb->cb;
-        memcpy(&ra_tid->ra, ra, ETH_ALEN);
-        ra_tid->tid = tid;
-
-        skb->pkt_type = IEEE80211_ADDBA_MSG;
-        skb_queue_tail(&local->skb_queue, skb);
-        tasklet_schedule(&local->tasklet);
-}
-EXPORT_SYMBOL(ieee80211_start_tx_ba_cb_irqsafe);
-
-void ieee80211_stop_tx_ba_cb_irqsafe(struct ieee80211_hw *hw,
-                                     const u8 *ra, u16 tid)
-{
-        struct ieee80211_local *local = hw_to_local(hw);
-        struct ieee80211_ra_tid *ra_tid;
-        struct sk_buff *skb = dev_alloc_skb(0);
-
-        if (unlikely(!skb)) {
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                if (net_ratelimit())
-                        printk(KERN_WARNING "%s: Not enough memory, "
-                               "dropping stop BA session", skb->dev->name);
-#endif
-                return;
-        }
-        ra_tid = (struct ieee80211_ra_tid *) &skb->cb;
-        memcpy(&ra_tid->ra, ra, ETH_ALEN);
-        ra_tid->tid = tid;
-
-        skb->pkt_type = IEEE80211_DELBA_MSG;
-        skb_queue_tail(&local->skb_queue, skb);
-        tasklet_schedule(&local->tasklet);
-}
-EXPORT_SYMBOL(ieee80211_stop_tx_ba_cb_irqsafe);
-
-/*
- * After accepting the AddBA Request we activated a timer,
- * resetting it after each frame that arrives from the originator.
- * if this timer expires ieee80211_sta_stop_rx_ba_session will be executed.
- */
-static void sta_rx_agg_session_timer_expired(unsigned long data)
-{
-        /* not an elegant detour, but there is no choice as the timer passes
-         * only one argument, and various sta_info are needed here, so init
-         * flow in sta_info_create gives the TID as data, while the timer_to_id
-         * array gives the sta through container_of */
-        u8 *ptid = (u8 *)data;
-        u8 *timer_to_id = ptid - *ptid;
-        struct sta_info *sta = container_of(timer_to_id, struct sta_info,
-                                         timer_to_tid[0]);
-
-#ifdef CONFIG_MAC80211_HT_DEBUG
-        printk(KERN_DEBUG "rx session timer expired on tid %d\n", (u16)*ptid);
-#endif
-        ieee80211_sta_stop_rx_ba_session(sta->sdata, sta->sta.addr,
-                                         (u16)*ptid, WLAN_BACK_TIMER,
-                                         WLAN_REASON_QSTA_TIMEOUT);
-}
-
-void ieee80211_process_addba_request(struct ieee80211_local *local,
-                                     struct sta_info *sta,
-                                     struct ieee80211_mgmt *mgmt,
-                                     size_t len)
-{
-        struct ieee80211_hw *hw = &local->hw;
-        struct ieee80211_conf *conf = &hw->conf;
-        struct tid_ampdu_rx *tid_agg_rx;
-        u16 capab, tid, timeout, ba_policy, buf_size, start_seq_num, status;
-        u8 dialog_token;
-        int ret = -EOPNOTSUPP;
-
-        /* extract session parameters from addba request frame */
-        dialog_token = mgmt->u.action.u.addba_req.dialog_token;
-        timeout = le16_to_cpu(mgmt->u.action.u.addba_req.timeout);
-        start_seq_num =
-                le16_to_cpu(mgmt->u.action.u.addba_req.start_seq_num) >> 4;
-
-        capab = le16_to_cpu(mgmt->u.action.u.addba_req.capab);
-        ba_policy = (capab & IEEE80211_ADDBA_PARAM_POLICY_MASK) >> 1;
-        tid = (capab & IEEE80211_ADDBA_PARAM_TID_MASK) >> 2;
-        buf_size = (capab & IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK) >> 6;
-
-        status = WLAN_STATUS_REQUEST_DECLINED;
-
-        /* sanity check for incoming parameters:
-         * check if configuration can support the BA policy
-         * and if buffer size does not exceeds max value */
-        /* XXX: check own ht delayed BA capability?? */
-        if (((ba_policy != 1)
-                && (!(sta->sta.ht_cap.cap & IEEE80211_HT_CAP_DELAY_BA)))
-                || (buf_size > IEEE80211_MAX_AMPDU_BUF)) {
-                status = WLAN_STATUS_INVALID_QOS_PARAM;
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                if (net_ratelimit())
-                        printk(KERN_DEBUG "AddBA Req with bad params from "
-                                "%pM on tid %u. policy %d, buffer size %d\n",
-                                mgmt->sa, tid, ba_policy,
-                                buf_size);
-#endif /* CONFIG_MAC80211_HT_DEBUG */
-                goto end_no_lock;
-        }
-        /* determine default buffer size */
-        if (buf_size == 0) {
-                struct ieee80211_supported_band *sband;
-
-                sband = local->hw.wiphy->bands[conf->channel->band];
-                buf_size = IEEE80211_MIN_AMPDU_BUF;
-                buf_size = buf_size << sband->ht_cap.ampdu_factor;
-        }
-
-
-        /* examine state machine */
-        spin_lock_bh(&sta->lock);
-
-        if (sta->ampdu_mlme.tid_state_rx[tid] != HT_AGG_STATE_IDLE) {
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                if (net_ratelimit())
-                        printk(KERN_DEBUG "unexpected AddBA Req from "
-                                "%pM on tid %u\n",
-                                mgmt->sa, tid);
-#endif /* CONFIG_MAC80211_HT_DEBUG */
-                goto end;
-        }
-
-        /* prepare A-MPDU MLME for Rx aggregation */
-        sta->ampdu_mlme.tid_rx[tid] =
-                        kmalloc(sizeof(struct tid_ampdu_rx), GFP_ATOMIC);
-        if (!sta->ampdu_mlme.tid_rx[tid]) {
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                if (net_ratelimit())
-                        printk(KERN_ERR "allocate rx mlme to tid %d failed\n",
-                                        tid);
-#endif
-                goto end;
-        }
-        /* rx timer */
-        sta->ampdu_mlme.tid_rx[tid]->session_timer.function =
-                                sta_rx_agg_session_timer_expired;
-        sta->ampdu_mlme.tid_rx[tid]->session_timer.data =
-                                (unsigned long)&sta->timer_to_tid[tid];
-        init_timer(&sta->ampdu_mlme.tid_rx[tid]->session_timer);
-
-        tid_agg_rx = sta->ampdu_mlme.tid_rx[tid];
-
-        /* prepare reordering buffer */
-        tid_agg_rx->reorder_buf =
-                kmalloc(buf_size * sizeof(struct sk_buff *), GFP_ATOMIC);
-        if (!tid_agg_rx->reorder_buf) {
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                if (net_ratelimit())
-                        printk(KERN_ERR "can not allocate reordering buffer "
-                               "to tid %d\n", tid);
-#endif
-                kfree(sta->ampdu_mlme.tid_rx[tid]);
-                goto end;
-        }
-        memset(tid_agg_rx->reorder_buf, 0,
-                buf_size * sizeof(struct sk_buff *));
-
-        if (local->ops->ampdu_action)
-                ret = local->ops->ampdu_action(hw, IEEE80211_AMPDU_RX_START,
-                                               &sta->sta, tid, &start_seq_num);
-#ifdef CONFIG_MAC80211_HT_DEBUG
-        printk(KERN_DEBUG "Rx A-MPDU request on tid %d result %d\n", tid, ret);
-#endif /* CONFIG_MAC80211_HT_DEBUG */
-
-        if (ret) {
-                kfree(tid_agg_rx->reorder_buf);
-                kfree(tid_agg_rx);
-                sta->ampdu_mlme.tid_rx[tid] = NULL;
-                goto end;
-        }
-
-        /* change state and send addba resp */
-        sta->ampdu_mlme.tid_state_rx[tid] = HT_AGG_STATE_OPERATIONAL;
-        tid_agg_rx->dialog_token = dialog_token;
-        tid_agg_rx->ssn = start_seq_num;
-        tid_agg_rx->head_seq_num = start_seq_num;
-        tid_agg_rx->buf_size = buf_size;
-        tid_agg_rx->timeout = timeout;
-        tid_agg_rx->stored_mpdu_num = 0;
-        status = WLAN_STATUS_SUCCESS;
-end:
-        spin_unlock_bh(&sta->lock);
-
-end_no_lock:
-        ieee80211_send_addba_resp(sta->sdata, sta->sta.addr, tid,
-                                  dialog_token, status, 1, buf_size, timeout);
-}
-
-void ieee80211_process_addba_resp(struct ieee80211_local *local,
-                                  struct sta_info *sta,
-                                  struct ieee80211_mgmt *mgmt,
-                                  size_t len)
-{
-        struct ieee80211_hw *hw = &local->hw;
-        u16 capab;
-        u16 tid, start_seq_num;
-        u8 *state;
-
-        capab = le16_to_cpu(mgmt->u.action.u.addba_resp.capab);
-        tid = (capab & IEEE80211_ADDBA_PARAM_TID_MASK) >> 2;
-
-        state = &sta->ampdu_mlme.tid_state_tx[tid];
-
-        spin_lock_bh(&sta->lock);
-
-        if (!(*state & HT_ADDBA_REQUESTED_MSK)) {
-                spin_unlock_bh(&sta->lock);
-                return;
-        }
-
-        if (mgmt->u.action.u.addba_resp.dialog_token !=
-                sta->ampdu_mlme.tid_tx[tid]->dialog_token) {
-                spin_unlock_bh(&sta->lock);
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                printk(KERN_DEBUG "wrong addBA response token, tid %d\n", tid);
-#endif /* CONFIG_MAC80211_HT_DEBUG */
-                return;
-        }
-
-        del_timer_sync(&sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer);
-#ifdef CONFIG_MAC80211_HT_DEBUG
-        printk(KERN_DEBUG "switched off addBA timer for tid %d \n", tid);
-#endif /* CONFIG_MAC80211_HT_DEBUG */
-        if (le16_to_cpu(mgmt->u.action.u.addba_resp.status)
-                        == WLAN_STATUS_SUCCESS) {
-                *state |= HT_ADDBA_RECEIVED_MSK;
-                sta->ampdu_mlme.addba_req_num[tid] = 0;
-
-                if (*state == HT_AGG_STATE_OPERATIONAL &&
-                    local->hw.ampdu_queues)
-                        ieee80211_wake_queue(hw, sta->tid_to_tx_q[tid]);
-
-                if (local->ops->ampdu_action) {
-                        (void)local->ops->ampdu_action(hw,
-                                               IEEE80211_AMPDU_TX_RESUME,
-                                               &sta->sta, tid, &start_seq_num);
-                }
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                printk(KERN_DEBUG "Resuming TX aggregation for tid %d\n", tid);
-#endif /* CONFIG_MAC80211_HT_DEBUG */
-                spin_unlock_bh(&sta->lock);
-        } else {
-                sta->ampdu_mlme.addba_req_num[tid]++;
-                /* this will allow the state check in stop_BA_session */
-                *state = HT_AGG_STATE_OPERATIONAL;
-                spin_unlock_bh(&sta->lock);
-                ieee80211_stop_tx_ba_session(hw, sta->sta.addr, tid,
-                                             WLAN_BACK_INITIATOR);
-        }
+        ieee80211_tx_skb(sdata, skb, 1);
 }
 
 void ieee80211_process_delba(struct ieee80211_sub_if_data *sdata,
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
new file mode 100644
index 000000000000..3201e1f96365
--- /dev/null
+++ b/net/mac80211/ibss.c
@@ -0,0 +1,908 @@
+/*
+ * IBSS mode implementation
+ * Copyright 2003-2008, Jouni Malinen <j@w1.fi>
+ * Copyright 2004, Instant802 Networks, Inc.
+ * Copyright 2005, Devicescape Software, Inc.
+ * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
+ * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
+ * Copyright 2009, Johannes Berg <johannes@sipsolutions.net>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/delay.h>
+#include <linux/if_ether.h>
+#include <linux/skbuff.h>
+#include <linux/if_arp.h>
+#include <linux/etherdevice.h>
+#include <linux/rtnetlink.h>
+#include <net/mac80211.h>
+#include <asm/unaligned.h>
+
+#include "ieee80211_i.h"
+#include "rate.h"
+
+#define IEEE80211_SCAN_INTERVAL (2 * HZ)
+#define IEEE80211_SCAN_INTERVAL_SLOW (15 * HZ)
+#define IEEE80211_IBSS_JOIN_TIMEOUT (7 * HZ)
+
+#define IEEE80211_IBSS_MERGE_INTERVAL (30 * HZ)
+#define IEEE80211_IBSS_MERGE_DELAY 0x400000
+#define IEEE80211_IBSS_INACTIVITY_LIMIT (60 * HZ)
+
+#define IEEE80211_IBSS_MAX_STA_ENTRIES 128
+
+
+static void ieee80211_rx_mgmt_auth_ibss(struct ieee80211_sub_if_data *sdata,
+                                        struct ieee80211_mgmt *mgmt,
+                                        size_t len)
+{
+        u16 auth_alg, auth_transaction, status_code;
+
+        if (len < 24 + 6)
+                return;
+
+        auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg);
+        auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction);
+        status_code = le16_to_cpu(mgmt->u.auth.status_code);
+
+        /*
+         * IEEE 802.11 standard does not require authentication in IBSS
+         * networks and most implementations do not seem to use it.
+         * However, try to reply to authentication attempts if someone
+         * has actually implemented this.
+         */
+        if (auth_alg == WLAN_AUTH_OPEN && auth_transaction == 1)
+                ieee80211_send_auth(sdata, 2, WLAN_AUTH_OPEN, NULL, 0,
+                                    sdata->u.ibss.bssid, 0);
+}
+
+static int __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
+                                     const u8 *bssid, const int beacon_int,
+                                     const int freq,
+                                     const size_t supp_rates_len,
+                                     const u8 *supp_rates,
+                                     const u16 capability, u64 tsf)
+{
+        struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
+        struct ieee80211_local *local = sdata->local;
+        int res = 0, rates, i, j;
+        struct sk_buff *skb;
+        struct ieee80211_mgmt *mgmt;
+        u8 *pos;
+        struct ieee80211_supported_band *sband;
+        union iwreq_data wrqu;
+
+        if (local->ops->reset_tsf) {
+                /* Reset own TSF to allow time synchronization work. */
+                local->ops->reset_tsf(local_to_hw(local));
+        }
+
+        if ((ifibss->flags & IEEE80211_IBSS_PREV_BSSID_SET) &&
+           memcmp(ifibss->bssid, bssid, ETH_ALEN) == 0)
+                return res;
+
+        skb = dev_alloc_skb(local->hw.extra_tx_headroom + 400);
+        if (!skb) {
+                printk(KERN_DEBUG "%s: failed to allocate buffer for probe "
+                       "response\n", sdata->dev->name);
+                return -ENOMEM;
+        }
+
+        if (!(ifibss->flags & IEEE80211_IBSS_PREV_BSSID_SET)) {
+                /* Remove possible STA entries from other IBSS networks. */
+                sta_info_flush_delayed(sdata);
+        }
+
+        memcpy(ifibss->bssid, bssid, ETH_ALEN);
+        res = ieee80211_if_config(sdata, IEEE80211_IFCC_BSSID);
+        if (res)
+                return res;
+
+        local->hw.conf.beacon_int = beacon_int >= 10 ? beacon_int : 10;
+
+        sdata->drop_unencrypted = capability &
+                WLAN_CAPABILITY_PRIVACY ? 1 : 0;
+
+        res = ieee80211_set_freq(sdata, freq);
+
+        if (res)
+                return res;
+
+        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
+
+        /* Build IBSS probe response */
+
+        skb_reserve(skb, local->hw.extra_tx_headroom);
+
+        mgmt = (struct ieee80211_mgmt *)
+                skb_put(skb, 24 + sizeof(mgmt->u.beacon));
+        memset(mgmt, 0, 24 + sizeof(mgmt->u.beacon));
+        mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
+                                          IEEE80211_STYPE_PROBE_RESP);
+        memset(mgmt->da, 0xff, ETH_ALEN);
+        memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
+        memcpy(mgmt->bssid, ifibss->bssid, ETH_ALEN);
+        mgmt->u.beacon.beacon_int =
+                cpu_to_le16(local->hw.conf.beacon_int);
+        mgmt->u.beacon.timestamp = cpu_to_le64(tsf);
+        mgmt->u.beacon.capab_info = cpu_to_le16(capability);
+
+        pos = skb_put(skb, 2 + ifibss->ssid_len);
+        *pos++ = WLAN_EID_SSID;
+        *pos++ = ifibss->ssid_len;
+        memcpy(pos, ifibss->ssid, ifibss->ssid_len);
+
+        rates = supp_rates_len;
+        if (rates > 8)
+                rates = 8;
+        pos = skb_put(skb, 2 + rates);
+        *pos++ = WLAN_EID_SUPP_RATES;
+        *pos++ = rates;
+        memcpy(pos, supp_rates, rates);
+
+        if (sband->band == IEEE80211_BAND_2GHZ) {
+                pos = skb_put(skb, 2 + 1);
+                *pos++ = WLAN_EID_DS_PARAMS;
+                *pos++ = 1;
+                *pos++ = ieee80211_frequency_to_channel(freq);
+        }
+
+        pos = skb_put(skb, 2 + 2);
+        *pos++ = WLAN_EID_IBSS_PARAMS;
+        *pos++ = 2;
+        /* FIX: set ATIM window based on scan results */
+        *pos++ = 0;
+        *pos++ = 0;
+
+        if (supp_rates_len > 8) {
+                rates = supp_rates_len - 8;
+                pos = skb_put(skb, 2 + rates);
+                *pos++ = WLAN_EID_EXT_SUPP_RATES;
+                *pos++ = rates;
+                memcpy(pos, &supp_rates[8], rates);
+        }
+
+        ifibss->probe_resp = skb;
+
+        ieee80211_if_config(sdata, IEEE80211_IFCC_BEACON |
+                                   IEEE80211_IFCC_BEACON_ENABLED);
+
+
+        rates = 0;
+        for (i = 0; i < supp_rates_len; i++) {
+                int bitrate = (supp_rates[i] & 0x7f) * 5;
+                for (j = 0; j < sband->n_bitrates; j++)
+                        if (sband->bitrates[j].bitrate == bitrate)
+                                rates |= BIT(j);
+        }
+
+        ieee80211_sta_def_wmm_params(sdata, supp_rates_len, supp_rates);
+
+        ifibss->flags |= IEEE80211_IBSS_PREV_BSSID_SET;
+        ifibss->state = IEEE80211_IBSS_MLME_JOINED;
+        mod_timer(&ifibss->timer, jiffies + IEEE80211_IBSS_MERGE_INTERVAL);
+
+        memset(&wrqu, 0, sizeof(wrqu));
+        memcpy(wrqu.ap_addr.sa_data, bssid, ETH_ALEN);
+        wireless_send_event(sdata->dev, SIOCGIWAP, &wrqu, NULL);
+
+        return res;
+}
+
+static int ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
+                                   struct ieee80211_bss *bss)
+{
+        return __ieee80211_sta_join_ibss(sdata,
+                                         bss->cbss.bssid,
+                                         bss->cbss.beacon_interval,
+                                         bss->cbss.channel->center_freq,
+                                         bss->supp_rates_len, bss->supp_rates,
+                                         bss->cbss.capability,
+                                         bss->cbss.tsf);
+}
+
+static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
+                                  struct ieee80211_mgmt *mgmt,
+                                  size_t len,
+                                  struct ieee80211_rx_status *rx_status,
+                                  struct ieee802_11_elems *elems,
+                                  bool beacon)
+{
+        struct ieee80211_local *local = sdata->local;
+        int freq;
+        struct ieee80211_bss *bss;
+        struct sta_info *sta;
+        struct ieee80211_channel *channel;
+        u64 beacon_timestamp, rx_timestamp;
+        u32 supp_rates = 0;
+        enum ieee80211_band band = rx_status->band;
+
+        if (elems->ds_params && elems->ds_params_len == 1)
+                freq = ieee80211_channel_to_frequency(elems->ds_params[0]);
+        else
+                freq = rx_status->freq;
+
+        channel = ieee80211_get_channel(local->hw.wiphy, freq);
+
+        if (!channel || channel->flags & IEEE80211_CHAN_DISABLED)
+                return;
+
+        if (sdata->vif.type == NL80211_IFTYPE_ADHOC && elems->supp_rates &&
+            memcmp(mgmt->bssid, sdata->u.ibss.bssid, ETH_ALEN) == 0) {
+                supp_rates = ieee80211_sta_get_rates(local, elems, band);
+
+                rcu_read_lock();
+
+                sta = sta_info_get(local, mgmt->sa);
+                if (sta) {
+                        u32 prev_rates;
+
+                        prev_rates = sta->sta.supp_rates[band];
+                        /* make sure mandatory rates are always added */
+                        sta->sta.supp_rates[band] = supp_rates |
+                                ieee80211_mandatory_rates(local, band);
+
+#ifdef CONFIG_MAC80211_IBSS_DEBUG
+                        if (sta->sta.supp_rates[band] != prev_rates)
+                                printk(KERN_DEBUG "%s: updated supp_rates set "
+                                    "for %pM based on beacon info (0x%llx | "
+                                    "0x%llx -> 0x%llx)\n",
+                                    sdata->dev->name,
+                                    sta->sta.addr,
+                                    (unsigned long long) prev_rates,
+                                    (unsigned long long) supp_rates,
+                                    (unsigned long long) sta->sta.supp_rates[band]);
+#endif
+                } else
+                        ieee80211_ibss_add_sta(sdata, mgmt->bssid, mgmt->sa, supp_rates);
+
+                rcu_read_unlock();
+        }
+
+        bss = ieee80211_bss_info_update(local, rx_status, mgmt, len, elems,
+                                        channel, beacon);
+        if (!bss)
+                return;
+
+        /* was just updated in ieee80211_bss_info_update */
+        beacon_timestamp = bss->cbss.tsf;
+
+        /* check if we need to merge IBSS */
+
+        /* merge only on beacons (???) */
+        if (!beacon)
+                goto put_bss;
+
+        /* we use a fixed BSSID */
+        if (sdata->u.ibss.flags & IEEE80211_IBSS_BSSID_SET)
+                goto put_bss;
+
+        /* not an IBSS */
+        if (!(bss->cbss.capability & WLAN_CAPABILITY_IBSS))
+                goto put_bss;
+
+        /* different channel */
+        if (bss->cbss.channel != local->oper_channel)
+                goto put_bss;
+
+        /* different SSID */
+        if (elems->ssid_len != sdata->u.ibss.ssid_len ||
+            memcmp(elems->ssid, sdata->u.ibss.ssid,
+                                sdata->u.ibss.ssid_len))
+                goto put_bss;
+
+        /* same BSSID */
+        if (memcmp(bss->cbss.bssid, sdata->u.ibss.bssid, ETH_ALEN) == 0)
+                goto put_bss;
+
+        if (rx_status->flag & RX_FLAG_TSFT) {
+                /*
+                 * For correct IBSS merging we need mactime; since mactime is
+                 * defined as the time the first data symbol of the frame hits
+                 * the PHY, and the timestamp of the beacon is defined as "the
+                 * time that the data symbol containing the first bit of the
+                 * timestamp is transmitted to the PHY plus the transmitting
+                 * STA's delays through its local PHY from the MAC-PHY
+                 * interface to its interface with the WM" (802.11 11.1.2)
+                 * - equals the time this bit arrives at the receiver - we have
+                 * to take into account the offset between the two.
+                 *
+                 * E.g. at 1 MBit that means mactime is 192 usec earlier
+                 * (=24 bytes * 8 usecs/byte) than the beacon timestamp.
+                 */
+                int rate;
+
+                if (rx_status->flag & RX_FLAG_HT)
+                        rate = 65; /* TODO: HT rates */
+                else
+                        rate = local->hw.wiphy->bands[band]->
+                                bitrates[rx_status->rate_idx].bitrate;
+
+                rx_timestamp = rx_status->mactime + (24 * 8 * 10 / rate);
+        } else if (local && local->ops && local->ops->get_tsf)
+                /* second best option: get current TSF */
+                rx_timestamp = local->ops->get_tsf(local_to_hw(local));
+        else
+                /* can't merge without knowing the TSF */
+                rx_timestamp = -1LLU;
+
+#ifdef CONFIG_MAC80211_IBSS_DEBUG
+        printk(KERN_DEBUG "RX beacon SA=%pM BSSID="
+               "%pM TSF=0x%llx BCN=0x%llx diff=%lld @%lu\n",
+               mgmt->sa, mgmt->bssid,
+               (unsigned long long)rx_timestamp,
+               (unsigned long long)beacon_timestamp,
+               (unsigned long long)(rx_timestamp - beacon_timestamp),
+               jiffies);
+#endif
+
+        /* give slow hardware some time to do the TSF sync */
+        if (rx_timestamp < IEEE80211_IBSS_MERGE_DELAY)
+                goto put_bss;
+
+        if (beacon_timestamp > rx_timestamp) {
+#ifdef CONFIG_MAC80211_IBSS_DEBUG
+                printk(KERN_DEBUG "%s: beacon TSF higher than "
+                       "local TSF - IBSS merge with BSSID %pM\n",
+                       sdata->dev->name, mgmt->bssid);
+#endif
+                ieee80211_sta_join_ibss(sdata, bss);
+                ieee80211_ibss_add_sta(sdata, mgmt->bssid, mgmt->sa, supp_rates);
+        }
+
+ put_bss:
+        ieee80211_rx_bss_put(local, bss);
+}
+
+/*
+ * Add a new IBSS station, will also be called by the RX code when,
+ * in IBSS mode, receiving a frame from a yet-unknown station, hence
+ * must be callable in atomic context.
+ */
+struct sta_info *ieee80211_ibss_add_sta(struct ieee80211_sub_if_data *sdata,
+                                        u8 *bssid,u8 *addr, u32 supp_rates)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct sta_info *sta;
+        int band = local->hw.conf.channel->band;
+
+        /* TODO: Could consider removing the least recently used entry and
+         * allow new one to be added. */
+        if (local->num_sta >= IEEE80211_IBSS_MAX_STA_ENTRIES) {
+                if (net_ratelimit()) {
+                        printk(KERN_DEBUG "%s: No room for a new IBSS STA "
+                               "entry %pM\n", sdata->dev->name, addr);
+                }
+                return NULL;
+        }
+
+        if (compare_ether_addr(bssid, sdata->u.ibss.bssid))
+                return NULL;
+
+#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
+        printk(KERN_DEBUG "%s: Adding new IBSS station %pM (dev=%s)\n",
+               wiphy_name(local->hw.wiphy), addr, sdata->dev->name);
+#endif
+
+        sta = sta_info_alloc(sdata, addr, GFP_ATOMIC);
+        if (!sta)
+                return NULL;
+
+        set_sta_flags(sta, WLAN_STA_AUTHORIZED);
+
+        /* make sure mandatory rates are always added */
+        sta->sta.supp_rates[band] = supp_rates |
+                        ieee80211_mandatory_rates(local, band);
+
+        rate_control_rate_init(sta);
+
+        if (sta_info_insert(sta))
+                return NULL;
+
+        return sta;
+}
+
+static int ieee80211_sta_active_ibss(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_local *local = sdata->local;
+        int active = 0;
+        struct sta_info *sta;
+
+        rcu_read_lock();
+
+        list_for_each_entry_rcu(sta, &local->sta_list, list) {
+                if (sta->sdata == sdata &&
+                    time_after(sta->last_rx + IEEE80211_IBSS_MERGE_INTERVAL,
+                               jiffies)) {
+                        active++;
+                        break;
+                }
+        }
+
+        rcu_read_unlock();
+
+        return active;
+}
+
+
+static void ieee80211_sta_merge_ibss(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
+
+        mod_timer(&ifibss->timer, jiffies + IEEE80211_IBSS_MERGE_INTERVAL);
+
+        ieee80211_sta_expire(sdata, IEEE80211_IBSS_INACTIVITY_LIMIT);
+        if (ieee80211_sta_active_ibss(sdata))
+                return;
+
+        if ((ifibss->flags & IEEE80211_IBSS_BSSID_SET) &&
+            (!(ifibss->flags & IEEE80211_IBSS_AUTO_CHANNEL_SEL)))
+                return;
+
+        printk(KERN_DEBUG "%s: No active IBSS STAs - trying to scan for other "
+               "IBSS networks with same SSID (merge)\n", sdata->dev->name);
+
+        /* XXX maybe racy? */
+        if (sdata->local->scan_req)
+                return;
+
+        memcpy(sdata->local->int_scan_req.ssids[0].ssid,
+               ifibss->ssid, IEEE80211_MAX_SSID_LEN);
+        sdata->local->int_scan_req.ssids[0].ssid_len = ifibss->ssid_len;
+        ieee80211_request_scan(sdata, &sdata->local->int_scan_req);
+}
+
+static int ieee80211_sta_create_ibss(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_supported_band *sband;
+        u8 *pos;
+        u8 bssid[ETH_ALEN];
+        u8 supp_rates[IEEE80211_MAX_SUPP_RATES];
+        u16 capability;
+        int i;
+
+        if (ifibss->flags & IEEE80211_IBSS_BSSID_SET) {
+                memcpy(bssid, ifibss->bssid, ETH_ALEN);
+        } else {
+                /* Generate random, not broadcast, locally administered BSSID. Mix in
+                 * own MAC address to make sure that devices that do not have proper
+                 * random number generator get different BSSID. */
+                get_random_bytes(bssid, ETH_ALEN);
+                for (i = 0; i < ETH_ALEN; i++)
+                        bssid[i] ^= sdata->dev->dev_addr[i];
+                bssid[0] &= ~0x01;
+                bssid[0] |= 0x02;
+        }
+
+        printk(KERN_DEBUG "%s: Creating new IBSS network, BSSID %pM\n",
+               sdata->dev->name, bssid);
+
+        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
+
+        if (local->hw.conf.beacon_int == 0)
+                local->hw.conf.beacon_int = 100;
+
+        capability = WLAN_CAPABILITY_IBSS;
+
+        if (sdata->default_key)
+                capability |= WLAN_CAPABILITY_PRIVACY;
+        else
+                sdata->drop_unencrypted = 0;
+
+        pos = supp_rates;
+        for (i = 0; i < sband->n_bitrates; i++) {
+                int rate = sband->bitrates[i].bitrate;
+                *pos++ = (u8) (rate / 5);
+        }
+
+        return __ieee80211_sta_join_ibss(sdata,
+                                         bssid, local->hw.conf.beacon_int,
+                                         local->hw.conf.channel->center_freq,
+                                         sband->n_bitrates, supp_rates,
+                                         capability, 0);
+}
+
+static int ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_bss *bss;
+        const u8 *bssid = NULL;
+        int active_ibss;
+
+        if (ifibss->ssid_len == 0)
+                return -EINVAL;
+
+        active_ibss = ieee80211_sta_active_ibss(sdata);
+#ifdef CONFIG_MAC80211_IBSS_DEBUG
+        printk(KERN_DEBUG "%s: sta_find_ibss (active_ibss=%d)\n",
+               sdata->dev->name, active_ibss);
+#endif /* CONFIG_MAC80211_IBSS_DEBUG */
+
+        if (active_ibss)
+                return 0;
+
+        if (ifibss->flags & IEEE80211_IBSS_BSSID_SET)
+                bssid = ifibss->bssid;
+        bss = (void *)cfg80211_get_bss(local->hw.wiphy, NULL, bssid,
+                                       ifibss->ssid, ifibss->ssid_len,
+                                       WLAN_CAPABILITY_IBSS,
+                                       WLAN_CAPABILITY_IBSS);
+
+#ifdef CONFIG_MAC80211_IBSS_DEBUG
+        if (bss)
+                printk(KERN_DEBUG "   sta_find_ibss: selected %pM current "
+                       "%pM\n", bss->cbss.bssid, ifibss->bssid);
+#endif /* CONFIG_MAC80211_IBSS_DEBUG */
+
+        if (bss &&
+            (!(ifibss->flags & IEEE80211_IBSS_PREV_BSSID_SET) ||
+             memcmp(ifibss->bssid, bss->cbss.bssid, ETH_ALEN))) {
+                int ret;
+
+                printk(KERN_DEBUG "%s: Selected IBSS BSSID %pM"
+                       " based on configured SSID\n",
+                       sdata->dev->name, bss->cbss.bssid);
+
+                ret = ieee80211_sta_join_ibss(sdata, bss);
+                ieee80211_rx_bss_put(local, bss);
+                return ret;
+        } else if (bss)
+                ieee80211_rx_bss_put(local, bss);
+
+#ifdef CONFIG_MAC80211_IBSS_DEBUG
+        printk(KERN_DEBUG "   did not try to join ibss\n");
+#endif /* CONFIG_MAC80211_IBSS_DEBUG */
+
+        /* Selected IBSS not found in current scan results - try to scan */
+        if (ifibss->state == IEEE80211_IBSS_MLME_JOINED &&
+            !ieee80211_sta_active_ibss(sdata)) {
+                mod_timer(&ifibss->timer, jiffies +
+                                          IEEE80211_IBSS_MERGE_INTERVAL);
+        } else if (time_after(jiffies, local->last_scan_completed +
+                                        IEEE80211_SCAN_INTERVAL)) {
+                printk(KERN_DEBUG "%s: Trigger new scan to find an IBSS to "
+                       "join\n", sdata->dev->name);
+
+                /* XXX maybe racy? */
+                if (local->scan_req)
+                        return -EBUSY;
+
+                memcpy(local->int_scan_req.ssids[0].ssid,
+                       ifibss->ssid, IEEE80211_MAX_SSID_LEN);
+                local->int_scan_req.ssids[0].ssid_len = ifibss->ssid_len;
+                return ieee80211_request_scan(sdata, &local->int_scan_req);
+        } else if (ifibss->state != IEEE80211_IBSS_MLME_JOINED) {
+                int interval = IEEE80211_SCAN_INTERVAL;
+
+                if (time_after(jiffies, ifibss->ibss_join_req +
+                               IEEE80211_IBSS_JOIN_TIMEOUT)) {
+                        if (!(local->oper_channel->flags &
+                                                IEEE80211_CHAN_NO_IBSS))
+                                return ieee80211_sta_create_ibss(sdata);
+                        printk(KERN_DEBUG "%s: IBSS not allowed on"
+                               " %d MHz\n", sdata->dev->name,
+                               local->hw.conf.channel->center_freq);
+
+                        /* No IBSS found - decrease scan interval and continue
+                         * scanning. */
+                        interval = IEEE80211_SCAN_INTERVAL_SLOW;
+                }
+
+                ifibss->state = IEEE80211_IBSS_MLME_SEARCH;
+                mod_timer(&ifibss->timer, jiffies + interval);
+                return 0;
+        }
+
+        return 0;
+}
+
+static void ieee80211_rx_mgmt_probe_req(struct ieee80211_sub_if_data *sdata,
+                                        struct ieee80211_mgmt *mgmt,
+                                        size_t len)
+{
+        struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
+        struct ieee80211_local *local = sdata->local;
+        int tx_last_beacon;
+        struct sk_buff *skb;
+        struct ieee80211_mgmt *resp;
+        u8 *pos, *end;
+
+        if (ifibss->state != IEEE80211_IBSS_MLME_JOINED ||
+            len < 24 + 2 || !ifibss->probe_resp)
+                return;
+
+        if (local->ops->tx_last_beacon)
+                tx_last_beacon = local->ops->tx_last_beacon(local_to_hw(local));
+        else
+                tx_last_beacon = 1;
+
+#ifdef CONFIG_MAC80211_IBSS_DEBUG
+        printk(KERN_DEBUG "%s: RX ProbeReq SA=%pM DA=%pM BSSID=%pM"
+               " (tx_last_beacon=%d)\n",
+               sdata->dev->name, mgmt->sa, mgmt->da,
+               mgmt->bssid, tx_last_beacon);
+#endif /* CONFIG_MAC80211_IBSS_DEBUG */
+
+        if (!tx_last_beacon)
+                return;
+
+        if (memcmp(mgmt->bssid, ifibss->bssid, ETH_ALEN) != 0 &&
+            memcmp(mgmt->bssid, "\xff\xff\xff\xff\xff\xff", ETH_ALEN) != 0)
+                return;
+
+        end = ((u8 *) mgmt) + len;
+        pos = mgmt->u.probe_req.variable;
+        if (pos[0] != WLAN_EID_SSID ||
+            pos + 2 + pos[1] > end) {
+#ifdef CONFIG_MAC80211_IBSS_DEBUG
+                printk(KERN_DEBUG "%s: Invalid SSID IE in ProbeReq "
+                       "from %pM\n",
+                       sdata->dev->name, mgmt->sa);
+#endif
+                return;
+        }
+        if (pos[1] != 0 &&
+            (pos[1] != ifibss->ssid_len ||
+             memcmp(pos + 2, ifibss->ssid, ifibss->ssid_len) != 0)) {
+                /* Ignore ProbeReq for foreign SSID */
+                return;
+        }
+
+        /* Reply with ProbeResp */
+        skb = skb_copy(ifibss->probe_resp, GFP_KERNEL);
+        if (!skb)
+                return;
+
+        resp = (struct ieee80211_mgmt *) skb->data;
+        memcpy(resp->da, mgmt->sa, ETH_ALEN);
+#ifdef CONFIG_MAC80211_IBSS_DEBUG
+        printk(KERN_DEBUG "%s: Sending ProbeResp to %pM\n",
+               sdata->dev->name, resp->da);
+#endif /* CONFIG_MAC80211_IBSS_DEBUG */
+        ieee80211_tx_skb(sdata, skb, 0);
+}
+
+static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_sub_if_data *sdata,
+                                         struct ieee80211_mgmt *mgmt,
+                                         size_t len,
+                                         struct ieee80211_rx_status *rx_status)
+{
+        size_t baselen;
+        struct ieee802_11_elems elems;
+
+        if (memcmp(mgmt->da, sdata->dev->dev_addr, ETH_ALEN))
+                return; /* ignore ProbeResp to foreign address */
+
+        baselen = (u8 *) mgmt->u.probe_resp.variable - (u8 *) mgmt;
+        if (baselen > len)
+                return;
+
+        ieee802_11_parse_elems(mgmt->u.probe_resp.variable, len - baselen,
+                                &elems);
+
+        ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems, false);
+}
+
+static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
+                                     struct ieee80211_mgmt *mgmt,
+                                     size_t len,
+                                     struct ieee80211_rx_status *rx_status)
+{
+        size_t baselen;
+        struct ieee802_11_elems elems;
+
+        /* Process beacon from the current BSS */
+        baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
+        if (baselen > len)
+                return;
+
+        ieee802_11_parse_elems(mgmt->u.beacon.variable, len - baselen, &elems);
+
+        ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems, true);
+}
+
+static void ieee80211_ibss_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
+                                          struct sk_buff *skb)
+{
+        struct ieee80211_rx_status *rx_status;
+        struct ieee80211_mgmt *mgmt;
+        u16 fc;
+
+        rx_status = (struct ieee80211_rx_status *) skb->cb;
+        mgmt = (struct ieee80211_mgmt *) skb->data;
+        fc = le16_to_cpu(mgmt->frame_control);
+
+        switch (fc & IEEE80211_FCTL_STYPE) {
+        case IEEE80211_STYPE_PROBE_REQ:
+                ieee80211_rx_mgmt_probe_req(sdata, mgmt, skb->len);
+                break;
+        case IEEE80211_STYPE_PROBE_RESP:
+                ieee80211_rx_mgmt_probe_resp(sdata, mgmt, skb->len,
+                                             rx_status);
+                break;
+        case IEEE80211_STYPE_BEACON:
+                ieee80211_rx_mgmt_beacon(sdata, mgmt, skb->len,
+                                         rx_status);
+                break;
+        case IEEE80211_STYPE_AUTH:
+                ieee80211_rx_mgmt_auth_ibss(sdata, mgmt, skb->len);
+                break;
+        }
+
+        kfree_skb(skb);
+}
+
+static void ieee80211_ibss_work(struct work_struct *work)
+{
+        struct ieee80211_sub_if_data *sdata =
+                container_of(work, struct ieee80211_sub_if_data, u.ibss.work);
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_if_ibss *ifibss;
+        struct sk_buff *skb;
+
+        if (!netif_running(sdata->dev))
+                return;
+
+        if (local->sw_scanning || local->hw_scanning)
+                return;
+
+        if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_ADHOC))
+                return;
+        ifibss = &sdata->u.ibss;
+
+        while ((skb = skb_dequeue(&ifibss->skb_queue)))
+                ieee80211_ibss_rx_queued_mgmt(sdata, skb);
+
+        if (!test_and_clear_bit(IEEE80211_IBSS_REQ_RUN, &ifibss->request))
+                return;
+
+        switch (ifibss->state) {
+        case IEEE80211_IBSS_MLME_SEARCH:
+                ieee80211_sta_find_ibss(sdata);
+                break;
+        case IEEE80211_IBSS_MLME_JOINED:
+                ieee80211_sta_merge_ibss(sdata);
+                break;
+        default:
+                WARN_ON(1);
+                break;
+        }
+}
+
+static void ieee80211_ibss_timer(unsigned long data)
+{
+        struct ieee80211_sub_if_data *sdata =
+                (struct ieee80211_sub_if_data *) data;
+        struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
+        struct ieee80211_local *local = sdata->local;
+
+        set_bit(IEEE80211_IBSS_REQ_RUN, &ifibss->request);
+        queue_work(local->hw.workqueue, &ifibss->work);
+}
+
+void ieee80211_ibss_setup_sdata(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
+
+        INIT_WORK(&ifibss->work, ieee80211_ibss_work);
+        setup_timer(&ifibss->timer, ieee80211_ibss_timer,
+                    (unsigned long) sdata);
+        skb_queue_head_init(&ifibss->skb_queue);
+
+        ifibss->flags |= IEEE80211_IBSS_AUTO_BSSID_SEL |
+                        IEEE80211_IBSS_AUTO_CHANNEL_SEL;
+}
+
+int ieee80211_ibss_commit(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
+
+        ifibss->flags &= ~IEEE80211_IBSS_PREV_BSSID_SET;
+
+        if (ifibss->ssid_len)
+                ifibss->flags |= IEEE80211_IBSS_SSID_SET;
+        else
+                ifibss->flags &= ~IEEE80211_IBSS_SSID_SET;
+
+        ifibss->ibss_join_req = jiffies;
+        ifibss->state = IEEE80211_IBSS_MLME_SEARCH;
+        set_bit(IEEE80211_IBSS_REQ_RUN, &ifibss->request);
+
+        return 0;
+}
+
+int ieee80211_ibss_set_ssid(struct ieee80211_sub_if_data *sdata, char *ssid, size_t len)
+{
+        struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
+
+        if (len > IEEE80211_MAX_SSID_LEN)
+                return -EINVAL;
+
+        if (ifibss->ssid_len != len || memcmp(ifibss->ssid, ssid, len) != 0) {
+                memset(ifibss->ssid, 0, sizeof(ifibss->ssid));
+                memcpy(ifibss->ssid, ssid, len);
+                ifibss->ssid_len = len;
+        }
+
+        return ieee80211_ibss_commit(sdata);
+}
+
+int ieee80211_ibss_get_ssid(struct ieee80211_sub_if_data *sdata, char *ssid, size_t *len)
+{
+        struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
+
+        memcpy(ssid, ifibss->ssid, ifibss->ssid_len);
+        *len = ifibss->ssid_len;
+
+        return 0;
+}
+
+int ieee80211_ibss_set_bssid(struct ieee80211_sub_if_data *sdata, u8 *bssid)
+{
+        struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
+
+        if (is_valid_ether_addr(bssid)) {
+                memcpy(ifibss->bssid, bssid, ETH_ALEN);
+                ifibss->flags |= IEEE80211_IBSS_BSSID_SET;
+        } else {
+                memset(ifibss->bssid, 0, ETH_ALEN);
+                ifibss->flags &= ~IEEE80211_IBSS_BSSID_SET;
+        }
+
+        if (netif_running(sdata->dev)) {
+                if (ieee80211_if_config(sdata, IEEE80211_IFCC_BSSID)) {
+                        printk(KERN_DEBUG "%s: Failed to config new BSSID to "
+                               "the low-level driver\n", sdata->dev->name);
+                }
+        }
+
+        return ieee80211_ibss_commit(sdata);
+}
+
+/* scan finished notification */
+void ieee80211_ibss_notify_scan_completed(struct ieee80211_local *local)
+{
+        struct ieee80211_sub_if_data *sdata = local->scan_sdata;
+        struct ieee80211_if_ibss *ifibss;
+
+        if (sdata && sdata->vif.type == NL80211_IFTYPE_ADHOC) {
+                ifibss = &sdata->u.ibss;
+                if ((!(ifibss->flags & IEEE80211_IBSS_PREV_BSSID_SET)) ||
+                    !ieee80211_sta_active_ibss(sdata))
+                        ieee80211_sta_find_ibss(sdata);
+        }
+}
+
+ieee80211_rx_result
+ieee80211_ibss_rx_mgmt(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb,
+                       struct ieee80211_rx_status *rx_status)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_mgmt *mgmt;
+        u16 fc;
+
+        if (skb->len < 24)
+                return RX_DROP_MONITOR;
+
+        mgmt = (struct ieee80211_mgmt *) skb->data;
+        fc = le16_to_cpu(mgmt->frame_control);
+
+        switch (fc & IEEE80211_FCTL_STYPE) {
+        case IEEE80211_STYPE_PROBE_RESP:
+        case IEEE80211_STYPE_BEACON:
+                memcpy(skb->cb, rx_status, sizeof(*rx_status));
+        case IEEE80211_STYPE_PROBE_REQ:
+        case IEEE80211_STYPE_AUTH:
+                skb_queue_tail(&sdata->u.ibss.skb_queue, skb);
+                queue_work(local->hw.workqueue, &sdata->u.ibss.work);
+                return RX_QUEUED;
+        }
+
+        return RX_DROP_MONITOR;
+}
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index f3eec989662b..e6ed78cb16b3 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -43,7 +43,7 @@ struct ieee80211_local;
 
 /* Required encryption head and tailroom */
 #define IEEE80211_ENCRYPT_HEADROOM 8
-#define IEEE80211_ENCRYPT_TAILROOM 12
+#define IEEE80211_ENCRYPT_TAILROOM 18
 
 /* IEEE 802.11 (Ch. 9.5 Defragmentation) requires support for concurrent
  * reception of at least three fragmented frames. This limit can be increased
@@ -57,6 +57,8 @@ struct ieee80211_local;
  */
 #define IEEE80211_SCAN_RESULT_EXPIRE (10 * HZ)
 
+#define TU_TO_EXP_TIME(x)       (jiffies + usecs_to_jiffies((x) * 1024))
+
 struct ieee80211_fragment_entry {
         unsigned long first_frag_time;
         unsigned int seq;
@@ -70,43 +72,36 @@ struct ieee80211_fragment_entry {
 
 
 struct ieee80211_bss {
-        struct list_head list;
-        struct ieee80211_bss *hnext;
-        size_t ssid_len;
+        /* Yes, this is a hack */
+        struct cfg80211_bss cbss;
 
-        atomic_t users;
-
-        u8 bssid[ETH_ALEN];
+        /* don't want to look up all the time */
+        size_t ssid_len;
         u8 ssid[IEEE80211_MAX_SSID_LEN];
+
         u8 dtim_period;
-        u16 capability; /* host byte order */
-        enum ieee80211_band band;
-        int freq;
-        int signal, noise, qual;
-        u8 *ies; /* all information elements from the last Beacon or Probe
-                  * Response frames; note Beacon frame is not allowed to
-                  * override values from Probe Response */
-        size_t ies_len;
+
         bool wmm_used;
+
+        unsigned long last_probe_resp;
+
 #ifdef CONFIG_MAC80211_MESH
         u8 *mesh_id;
         size_t mesh_id_len;
         u8 *mesh_cfg;
 #endif
+
 #define IEEE80211_MAX_SUPP_RATES 32
         u8 supp_rates[IEEE80211_MAX_SUPP_RATES];
         size_t supp_rates_len;
-        u64 timestamp;
-        int beacon_int;
 
-        unsigned long last_probe_resp;
-        unsigned long last_update;
-
-        /* during assocation, we save an ERP value from a probe response so
+        /*
+         * During assocation, we save an ERP value from a probe response so
          * that we can feed ERP info to the driver when handling the
          * association completes. these fields probably won't be up-to-date
-         * otherwise, you probably don't want to use them. */
-        int has_erp_value;
+         * otherwise, you probably don't want to use them.
+         */
+        bool has_erp_value;
         u8 erp_value;
 };
 
@@ -154,11 +149,6 @@ struct ieee80211_tx_data {
 
         struct ieee80211_channel *channel;
 
-        /* Extra fragments (in addition to the first fragment
-         * in skb) */
-        struct sk_buff **extra_frag;
-        int num_extra_frag;
-
         u16 ethertype;
         unsigned int flags;
 };
@@ -194,12 +184,6 @@ struct ieee80211_rx_data {
         u16 tkip_iv16;
 };
 
-struct ieee80211_tx_stored_packet {
-        struct sk_buff *skb;
-        struct sk_buff **extra_frag;
-        int num_extra_frag;
-};
-
 struct beacon_data {
         u8 *head, *tail;
         int head_len, tail_len;
@@ -244,7 +228,7 @@ struct mesh_preq_queue {
         u8 flags;
 };
 
-/* flags used in struct ieee80211_if_sta.flags */
+/* flags used in struct ieee80211_if_managed.flags */
 #define IEEE80211_STA_SSID_SET          BIT(0)
 #define IEEE80211_STA_BSSID_SET         BIT(1)
 #define IEEE80211_STA_PREV_BSSID_SET    BIT(2)
@@ -252,43 +236,49 @@ struct mesh_preq_queue {
 #define IEEE80211_STA_ASSOCIATED        BIT(4)
 #define IEEE80211_STA_PROBEREQ_POLL     BIT(5)
 #define IEEE80211_STA_CREATE_IBSS       BIT(6)
-#define IEEE80211_STA_MIXED_CELL        BIT(7)
+/* hole at 7, please re-use */
 #define IEEE80211_STA_WMM_ENABLED       BIT(8)
+/* hole at 9, please re-use */
 #define IEEE80211_STA_AUTO_SSID_SEL     BIT(10)
 #define IEEE80211_STA_AUTO_BSSID_SEL    BIT(11)
 #define IEEE80211_STA_AUTO_CHANNEL_SEL  BIT(12)
 #define IEEE80211_STA_PRIVACY_INVOKED   BIT(13)
+#define IEEE80211_STA_TKIP_WEP_USED     BIT(14)
+#define IEEE80211_STA_CSA_RECEIVED      BIT(15)
+#define IEEE80211_STA_MFP_ENABLED       BIT(16)
+#define IEEE80211_STA_EXT_SME           BIT(17)
 /* flags for MLME request */
 #define IEEE80211_STA_REQ_SCAN 0
 #define IEEE80211_STA_REQ_DIRECT_PROBE 1
 #define IEEE80211_STA_REQ_AUTH 2
 #define IEEE80211_STA_REQ_RUN  3
 
-/* STA/IBSS MLME states */
-enum ieee80211_sta_mlme_state {
-        IEEE80211_STA_MLME_DISABLED,
-        IEEE80211_STA_MLME_DIRECT_PROBE,
-        IEEE80211_STA_MLME_AUTHENTICATE,
-        IEEE80211_STA_MLME_ASSOCIATE,
-        IEEE80211_STA_MLME_ASSOCIATED,
-        IEEE80211_STA_MLME_IBSS_SEARCH,
-        IEEE80211_STA_MLME_IBSS_JOINED,
-};
-
 /* bitfield of allowed auth algs */
 #define IEEE80211_AUTH_ALG_OPEN BIT(0)
 #define IEEE80211_AUTH_ALG_SHARED_KEY BIT(1)
 #define IEEE80211_AUTH_ALG_LEAP BIT(2)
+#define IEEE80211_AUTH_ALG_FT BIT(3)
 
-struct ieee80211_if_sta {
+struct ieee80211_if_managed {
         struct timer_list timer;
+        struct timer_list chswitch_timer;
         struct work_struct work;
+        struct work_struct chswitch_work;
+        struct work_struct beacon_loss_work;
+
         u8 bssid[ETH_ALEN], prev_bssid[ETH_ALEN];
+
         u8 ssid[IEEE80211_MAX_SSID_LEN];
-        enum ieee80211_sta_mlme_state state;
         size_t ssid_len;
-        u8 scan_ssid[IEEE80211_MAX_SSID_LEN];
-        size_t scan_ssid_len;
+
+        enum {
+                IEEE80211_STA_MLME_DISABLED,
+                IEEE80211_STA_MLME_DIRECT_PROBE,
+                IEEE80211_STA_MLME_AUTHENTICATE,
+                IEEE80211_STA_MLME_ASSOCIATE,
+                IEEE80211_STA_MLME_ASSOCIATED,
+        } state;
+
         u16 aid;
         u16 ap_capab, capab;
         u8 *extra_ie; /* to be added to the end of AssocReq */
@@ -308,6 +298,7 @@ struct ieee80211_if_sta {
         unsigned long request;
 
         unsigned long last_probe;
+        unsigned long last_beacon;
 
         unsigned int flags;
 
@@ -315,11 +306,53 @@ struct ieee80211_if_sta {
         int auth_alg; /* currently used IEEE 802.11 authentication algorithm */
         int auth_transaction;
 
+        enum {
+                IEEE80211_MFP_DISABLED,
+                IEEE80211_MFP_OPTIONAL,
+                IEEE80211_MFP_REQUIRED
+        } mfp; /* management frame protection */
+
+        int wmm_last_param_set;
+
+        /* Extra IE data for management frames */
+        u8 *sme_auth_ie;
+        size_t sme_auth_ie_len;
+};
+
+enum ieee80211_ibss_flags {
+        IEEE80211_IBSS_AUTO_CHANNEL_SEL         = BIT(0),
+        IEEE80211_IBSS_AUTO_BSSID_SEL           = BIT(1),
+        IEEE80211_IBSS_BSSID_SET                = BIT(2),
+        IEEE80211_IBSS_PREV_BSSID_SET           = BIT(3),
+        IEEE80211_IBSS_SSID_SET                 = BIT(4),
+};
+
+enum ieee80211_ibss_request {
+        IEEE80211_IBSS_REQ_RUN  = 0,
+};
+
+struct ieee80211_if_ibss {
+        struct timer_list timer;
+        struct work_struct work;
+
+        struct sk_buff_head skb_queue;
+
+        u8 ssid[IEEE80211_MAX_SSID_LEN];
+        u8 ssid_len;
+
+        u32 flags;
+
+        u8 bssid[ETH_ALEN];
+
+        unsigned long request;
+
         unsigned long ibss_join_req;
         struct sk_buff *probe_resp; /* ProbeResp template for IBSS */
-        u32 supp_rates_bits[IEEE80211_NUM_BANDS];
 
-        int wmm_last_param_set;
+        enum {
+                IEEE80211_IBSS_MLME_SEARCH,
+                IEEE80211_IBSS_MLME_JOINED,
+        } state;
 };
 
 struct ieee80211_if_mesh {
@@ -370,7 +403,6 @@ struct ieee80211_if_mesh {
  *
  * @IEEE80211_SDATA_ALLMULTI: interface wants all multicast packets
  * @IEEE80211_SDATA_PROMISC: interface is promisc
- * @IEEE80211_SDATA_USERSPACE_MLME: userspace MLME is active
  * @IEEE80211_SDATA_OPERATING_GMODE: operating in G-only mode
  * @IEEE80211_SDATA_DONT_BRIDGE_PACKETS: bridge packets between
  *      associated stations and deliver multicast frames both
@@ -379,9 +411,8 @@ struct ieee80211_if_mesh {
 enum ieee80211_sub_if_data_flags {
         IEEE80211_SDATA_ALLMULTI                = BIT(0),
         IEEE80211_SDATA_PROMISC                 = BIT(1),
-        IEEE80211_SDATA_USERSPACE_MLME          = BIT(2),
-        IEEE80211_SDATA_OPERATING_GMODE         = BIT(3),
-        IEEE80211_SDATA_DONT_BRIDGE_PACKETS     = BIT(4),
+        IEEE80211_SDATA_OPERATING_GMODE         = BIT(2),
+        IEEE80211_SDATA_DONT_BRIDGE_PACKETS     = BIT(3),
 };
 
 struct ieee80211_sub_if_data {
@@ -404,8 +435,10 @@ struct ieee80211_sub_if_data {
         unsigned int fragment_next;
 
 #define NUM_DEFAULT_KEYS 4
-        struct ieee80211_key *keys[NUM_DEFAULT_KEYS];
+#define NUM_DEFAULT_MGMT_KEYS 2
+        struct ieee80211_key *keys[NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS];
         struct ieee80211_key *default_key;
+        struct ieee80211_key *default_mgmt_key;
 
         u16 sequence_number;
 
@@ -423,7 +456,8 @@ struct ieee80211_sub_if_data {
                 struct ieee80211_if_ap ap;
                 struct ieee80211_if_wds wds;
                 struct ieee80211_if_vlan vlan;
-                struct ieee80211_if_sta sta;
+                struct ieee80211_if_managed mgd;
+                struct ieee80211_if_ibss ibss;
 #ifdef CONFIG_MAC80211_MESH
                 struct ieee80211_if_mesh mesh;
 #endif
@@ -477,6 +511,7 @@ struct ieee80211_sub_if_data {
         } debugfs;
         struct {
                 struct dentry *default_key;
+                struct dentry *default_mgmt_key;
         } common_debugfs;
 
 #ifdef CONFIG_MAC80211_MESH
@@ -541,11 +576,12 @@ enum {
 enum queue_stop_reason {
         IEEE80211_QUEUE_STOP_REASON_DRIVER,
         IEEE80211_QUEUE_STOP_REASON_PS,
+        IEEE80211_QUEUE_STOP_REASON_CSA,
+        IEEE80211_QUEUE_STOP_REASON_AGGREGATION,
+        IEEE80211_QUEUE_STOP_REASON_SUSPEND,
+        IEEE80211_QUEUE_STOP_REASON_PENDING,
 };
 
-/* maximum number of hardware queues we support. */
-#define QD_MAX_QUEUES (IEEE80211_MAX_AMPDU_QUEUES + IEEE80211_MAX_QUEUES)
-
 struct ieee80211_master_priv {
         struct ieee80211_local *local;
 };
@@ -558,9 +594,10 @@ struct ieee80211_local {
 
         const struct ieee80211_ops *ops;
 
-        unsigned long queue_pool[BITS_TO_LONGS(QD_MAX_QUEUES)];
         unsigned long queue_stop_reasons[IEEE80211_MAX_QUEUES];
+        /* also used to protect ampdu_ac_queue and amdpu_ac_stop_refcnt */
         spinlock_t queue_stop_reason_lock;
+
         struct net_device *mdev; /* wmaster# - "master" 802.11 device */
         int open_count;
         int monitors, cooked_mntrs;
@@ -568,7 +605,6 @@ struct ieee80211_local {
         int fif_fcsfail, fif_plcpfail, fif_control, fif_other_bss;
         unsigned int filter_flags; /* FIF_* */
         struct iw_statistics wstats;
-        u8 wstats_flags;
         bool tim_in_locked_section; /* see ieee80211_beacon_get() */
         int tx_headroom; /* required headroom for hardware/radiotap */
 
@@ -595,11 +631,17 @@ struct ieee80211_local {
         struct sta_info *sta_hash[STA_HASH_SIZE];
         struct timer_list sta_cleanup;
 
-        unsigned long queues_pending[BITS_TO_LONGS(IEEE80211_MAX_QUEUES)];
-        unsigned long queues_pending_run[BITS_TO_LONGS(IEEE80211_MAX_QUEUES)];
-        struct ieee80211_tx_stored_packet pending_packet[IEEE80211_MAX_QUEUES];
+        struct sk_buff_head pending[IEEE80211_MAX_QUEUES];
         struct tasklet_struct tx_pending_tasklet;
 
+        /*
+         * This lock is used to prevent concurrent A-MPDU
+         * session start/stop processing, this thus also
+         * synchronises the ->ampdu_action() callback to
+         * drivers and limits it to one at a time.
+         */
+        spinlock_t ampdu_lock;
+
         /* number of interfaces with corresponding IFF_ flags */
         atomic_t iff_allmultis, iff_promiscs;
 
@@ -612,7 +654,9 @@ struct ieee80211_local {
         struct crypto_blkcipher *wep_rx_tfm;
         u32 wep_iv;
 
+        /* see iface.c */
         struct list_head interfaces;
+        struct mutex iflist_mtx;
 
         /*
          * Key lock, protects sdata's key_list and sta_info's
@@ -623,20 +667,18 @@ struct ieee80211_local {
 
         /* Scanning and BSS list */
         bool sw_scanning, hw_scanning;
+        struct cfg80211_ssid scan_ssid;
+        struct cfg80211_scan_request int_scan_req;
+        struct cfg80211_scan_request *scan_req;
+        struct ieee80211_channel *scan_channel;
         int scan_channel_idx;
-        enum ieee80211_band scan_band;
 
         enum { SCAN_SET_CHANNEL, SCAN_SEND_PROBE } scan_state;
         unsigned long last_scan_completed;
         struct delayed_work scan_work;
         struct ieee80211_sub_if_data *scan_sdata;
-        struct ieee80211_channel *oper_channel, *scan_channel;
         enum nl80211_channel_type oper_channel_type;
-        u8 scan_ssid[IEEE80211_MAX_SSID_LEN];
-        size_t scan_ssid_len;
-        struct list_head bss_list;
-        struct ieee80211_bss *bss_hash[STA_HASH_SIZE];
-        spinlock_t bss_lock;
+        struct ieee80211_channel *oper_channel, *csa_channel;
 
         /* SNMP counters */
         /* dot11CountersTable */
@@ -649,7 +691,6 @@ struct ieee80211_local {
         u32 dot11ReceivedFragmentCount;
         u32 dot11MulticastReceivedFrameCount;
         u32 dot11TransmittedFrameCount;
-        u32 dot11WEPUndecryptableCount;
 
 #ifdef CONFIG_MAC80211_LEDS
         int tx_led_counter, rx_led_counter;
@@ -696,11 +737,14 @@ struct ieee80211_local {
         unsigned int wmm_acm; /* bit field of ACM bits (BIT(802.1D tag)) */
 
         bool powersave;
-        int dynamic_ps_timeout;
+        bool pspolling;
         struct work_struct dynamic_ps_enable_work;
         struct work_struct dynamic_ps_disable_work;
         struct timer_list dynamic_ps_timer;
 
+        int user_power_level; /* in dBm */
+        int power_constr_level; /* in dBm */
+
 #ifdef CONFIG_MAC80211_DEBUGFS
         struct local_debugfsdentries {
                 struct dentry *rcdir;
@@ -712,6 +756,8 @@ struct ieee80211_local {
                 struct dentry *long_retry_limit;
                 struct dentry *total_ps_buffered;
                 struct dentry *wep_iv;
+                struct dentry *tsf;
+                struct dentry *reset;
                 struct dentry *statistics;
                 struct local_debugfsdentries_statsdentries {
                         struct dentry *transmitted_fragment_count;
@@ -805,6 +851,7 @@ struct ieee802_11_elems {
         u8 *country_elem;
         u8 *pwr_constr_elem;
         u8 *quiet_elem;         /* first quite element */
+        u8 *timeout_int;
 
         /* length of them, respectively */
         u8 ssid_len;
@@ -832,6 +879,7 @@ struct ieee802_11_elems {
         u8 pwr_constr_elem_len;
         u8 quiet_elem_len;
         u8 num_of_quiet_elem;   /* can be more the one */
+        u8 timeout_int_len;
 };
 
 static inline struct ieee80211_local *hw_to_local(
@@ -860,34 +908,43 @@ void ieee80211_tx_set_protected(struct ieee80211_tx_data *tx);
 void ieee80211_bss_info_change_notify(struct ieee80211_sub_if_data *sdata,
                                       u32 changed);
 void ieee80211_configure_filter(struct ieee80211_local *local);
+u32 ieee80211_reset_erp_info(struct ieee80211_sub_if_data *sdata);
 
 /* wireless extensions */
 extern const struct iw_handler_def ieee80211_iw_handler_def;
 
-/* STA/IBSS code */
+/* STA code */
 void ieee80211_sta_setup_sdata(struct ieee80211_sub_if_data *sdata);
-void ieee80211_scan_work(struct work_struct *work);
-void ieee80211_sta_rx_mgmt(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb,
-                           struct ieee80211_rx_status *rx_status);
+ieee80211_rx_result ieee80211_sta_rx_mgmt(struct ieee80211_sub_if_data *sdata,
+                                          struct sk_buff *skb,
+                                          struct ieee80211_rx_status *rx_status);
+int ieee80211_sta_commit(struct ieee80211_sub_if_data *sdata);
 int ieee80211_sta_set_ssid(struct ieee80211_sub_if_data *sdata, char *ssid, size_t len);
 int ieee80211_sta_get_ssid(struct ieee80211_sub_if_data *sdata, char *ssid, size_t *len);
 int ieee80211_sta_set_bssid(struct ieee80211_sub_if_data *sdata, u8 *bssid);
-void ieee80211_sta_req_auth(struct ieee80211_sub_if_data *sdata,
-                            struct ieee80211_if_sta *ifsta);
-struct sta_info *ieee80211_ibss_add_sta(struct ieee80211_sub_if_data *sdata,
-                                        u8 *bssid, u8 *addr, u64 supp_rates);
+void ieee80211_sta_req_auth(struct ieee80211_sub_if_data *sdata);
 int ieee80211_sta_deauthenticate(struct ieee80211_sub_if_data *sdata, u16 reason);
 int ieee80211_sta_disassociate(struct ieee80211_sub_if_data *sdata, u16 reason);
-u32 ieee80211_reset_erp_info(struct ieee80211_sub_if_data *sdata);
-u64 ieee80211_sta_get_rates(struct ieee80211_local *local,
-                            struct ieee802_11_elems *elems,
-                            enum ieee80211_band band);
-void ieee80211_send_probe_req(struct ieee80211_sub_if_data *sdata, u8 *dst,
-                              u8 *ssid, size_t ssid_len);
+void ieee80211_send_pspoll(struct ieee80211_local *local,
+                           struct ieee80211_sub_if_data *sdata);
+
+/* IBSS code */
+int ieee80211_ibss_commit(struct ieee80211_sub_if_data *sdata);
+int ieee80211_ibss_set_ssid(struct ieee80211_sub_if_data *sdata, char *ssid, size_t len);
+int ieee80211_ibss_get_ssid(struct ieee80211_sub_if_data *sdata, char *ssid, size_t *len);
+int ieee80211_ibss_set_bssid(struct ieee80211_sub_if_data *sdata, u8 *bssid);
+void ieee80211_ibss_notify_scan_completed(struct ieee80211_local *local);
+void ieee80211_ibss_setup_sdata(struct ieee80211_sub_if_data *sdata);
+ieee80211_rx_result
+ieee80211_ibss_rx_mgmt(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb,
+                       struct ieee80211_rx_status *rx_status);
+struct sta_info *ieee80211_ibss_add_sta(struct ieee80211_sub_if_data *sdata,
+                                        u8 *bssid, u8 *addr, u32 supp_rates);
 
 /* scan/BSS handling */
+void ieee80211_scan_work(struct work_struct *work);
 int ieee80211_request_scan(struct ieee80211_sub_if_data *sdata,
-                           u8 *ssid, size_t ssid_len);
+                           struct cfg80211_scan_request *req);
 int ieee80211_scan_results(struct ieee80211_local *local,
                            struct iw_request_info *info,
                            char *buf, size_t len);
@@ -895,29 +952,28 @@ ieee80211_rx_result
 ieee80211_scan_rx(struct ieee80211_sub_if_data *sdata,
                   struct sk_buff *skb,
                   struct ieee80211_rx_status *rx_status);
-void ieee80211_rx_bss_list_init(struct ieee80211_local *local);
-void ieee80211_rx_bss_list_deinit(struct ieee80211_local *local);
 int ieee80211_sta_set_extra_ie(struct ieee80211_sub_if_data *sdata,
-                               char *ie, size_t len);
+                               const char *ie, size_t len);
 
 void ieee80211_mlme_notify_scan_completed(struct ieee80211_local *local);
+void ieee80211_scan_failed(struct ieee80211_local *local);
 int ieee80211_start_scan(struct ieee80211_sub_if_data *scan_sdata,
-                         u8 *ssid, size_t ssid_len);
+                         struct cfg80211_scan_request *req);
 struct ieee80211_bss *
 ieee80211_bss_info_update(struct ieee80211_local *local,
                           struct ieee80211_rx_status *rx_status,
                           struct ieee80211_mgmt *mgmt,
                           size_t len,
                           struct ieee802_11_elems *elems,
-                          int freq, bool beacon);
-struct ieee80211_bss *
-ieee80211_rx_bss_add(struct ieee80211_local *local, u8 *bssid, int freq,
-                     u8 *ssid, u8 ssid_len);
+                          struct ieee80211_channel *channel,
+                          bool beacon);
 struct ieee80211_bss *
 ieee80211_rx_bss_get(struct ieee80211_local *local, u8 *bssid, int freq,
                      u8 *ssid, u8 ssid_len);
 void ieee80211_rx_bss_put(struct ieee80211_local *local,
                           struct ieee80211_bss *bss);
+void ieee80211_rx_bss_remove(struct ieee80211_sub_if_data *sdata, u8 *bssid,
+                             int freq, u8 *ssid, u8 ssid_len);
 
 /* interface handling */
 int ieee80211_if_add(struct ieee80211_local *local, const char *name,
@@ -943,10 +999,15 @@ u32 ieee80211_enable_ht(struct ieee80211_sub_if_data *sdata,
                         struct ieee80211_ht_info *hti,
                         u16 ap_ht_cap_flags);
 void ieee80211_send_bar(struct ieee80211_sub_if_data *sdata, u8 *ra, u16 tid, u16 ssn);
+void ieee80211_send_delba(struct ieee80211_sub_if_data *sdata,
+                          const u8 *da, u16 tid,
+                          u16 initiator, u16 reason_code);
 
 void ieee80211_sta_stop_rx_ba_session(struct ieee80211_sub_if_data *sdata, u8 *da,
                                 u16 tid, u16 initiator, u16 reason);
-void ieee80211_sta_tear_down_BA_sessions(struct ieee80211_sub_if_data *sdata, u8 *addr);
+void __ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid,
+                                    u16 initiator, u16 reason);
+void ieee80211_sta_tear_down_BA_sessions(struct sta_info *sta);
 void ieee80211_process_delba(struct ieee80211_sub_if_data *sdata,
                              struct sta_info *sta,
                              struct ieee80211_mgmt *mgmt, size_t len);
@@ -959,10 +1020,36 @@ void ieee80211_process_addba_request(struct ieee80211_local *local,
                                      struct ieee80211_mgmt *mgmt,
                                      size_t len);
 
+int __ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
+                                   enum ieee80211_back_parties initiator);
+
 /* Spectrum management */
 void ieee80211_process_measurement_req(struct ieee80211_sub_if_data *sdata,
                                        struct ieee80211_mgmt *mgmt,
                                        size_t len);
+void ieee80211_chswitch_timer(unsigned long data);
+void ieee80211_chswitch_work(struct work_struct *work);
+void ieee80211_process_chanswitch(struct ieee80211_sub_if_data *sdata,
+                                  struct ieee80211_channel_sw_ie *sw_elem,
+                                  struct ieee80211_bss *bss);
+void ieee80211_handle_pwr_constr(struct ieee80211_sub_if_data *sdata,
+                                 u16 capab_info, u8 *pwr_constr_elem,
+                                 u8 pwr_constr_elem_len);
+
+/* Suspend/resume */
+#ifdef CONFIG_PM
+int __ieee80211_suspend(struct ieee80211_hw *hw);
+int __ieee80211_resume(struct ieee80211_hw *hw);
+#else
+static inline int __ieee80211_suspend(struct ieee80211_hw *hw)
+{
+        return 0;
+}
+static inline int __ieee80211_resume(struct ieee80211_hw *hw)
+{
+        return 0;
+}
+#endif
 
 /* utility functions/constants */
 extern void *mac80211_wiphy_privid; /* for wiphy privid */
@@ -980,17 +1067,42 @@ void ieee80211_tx_skb(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb,
 void ieee802_11_parse_elems(u8 *start, size_t len,
                             struct ieee802_11_elems *elems);
 int ieee80211_set_freq(struct ieee80211_sub_if_data *sdata, int freq);
-u64 ieee80211_mandatory_rates(struct ieee80211_local *local,
+u32 ieee80211_mandatory_rates(struct ieee80211_local *local,
                               enum ieee80211_band band);
 
 void ieee80211_dynamic_ps_enable_work(struct work_struct *work);
 void ieee80211_dynamic_ps_disable_work(struct work_struct *work);
 void ieee80211_dynamic_ps_timer(unsigned long data);
+void ieee80211_send_nullfunc(struct ieee80211_local *local,
+                             struct ieee80211_sub_if_data *sdata,
+                             int powersave);
+void ieee80211_sta_rx_notify(struct ieee80211_sub_if_data *sdata,
+                             struct ieee80211_hdr *hdr);
+void ieee80211_beacon_loss_work(struct work_struct *work);
 
 void ieee80211_wake_queues_by_reason(struct ieee80211_hw *hw,
                                      enum queue_stop_reason reason);
 void ieee80211_stop_queues_by_reason(struct ieee80211_hw *hw,
                                      enum queue_stop_reason reason);
+void ieee80211_wake_queue_by_reason(struct ieee80211_hw *hw, int queue,
+                                    enum queue_stop_reason reason);
+void ieee80211_stop_queue_by_reason(struct ieee80211_hw *hw, int queue,
+                                    enum queue_stop_reason reason);
+
+void ieee80211_send_auth(struct ieee80211_sub_if_data *sdata,
+                         u16 transaction, u16 auth_alg,
+                         u8 *extra, size_t extra_len,
+                         const u8 *bssid, int encrypt);
+void ieee80211_send_probe_req(struct ieee80211_sub_if_data *sdata, u8 *dst,
+                              u8 *ssid, size_t ssid_len,
+                              u8 *ie, size_t ie_len);
+
+void ieee80211_sta_def_wmm_params(struct ieee80211_sub_if_data *sdata,
+                                  const size_t supp_rates_len,
+                                  const u8 *supp_rates);
+u32 ieee80211_sta_get_rates(struct ieee80211_local *local,
+                            struct ieee802_11_elems *elems,
+                            enum ieee80211_band band);
 
 #ifdef CONFIG_MAC80211_NOINLINE
 #define debug_noinline noinline
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index b9074824862a..91e8e1bacaaa 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -21,6 +21,23 @@
 #include "mesh.h"
 #include "led.h"
 
+/**
+ * DOC: Interface list locking
+ *
+ * The interface list in each struct ieee80211_local is protected
+ * three-fold:
+ *
+ * (1) modifications may only be done under the RTNL
+ * (2) modifications and readers are protected against each other by
+ *     the iflist_mtx.
+ * (3) modifications are done in an RCU manner so atomic readers
+ *     can traverse the list in RCU-safe blocks.
+ *
+ * As a consequence, reads (traversals) of the list can be protected
+ * by either the RTNL, the iflist_mtx or RCU.
+ */
+
+
 static int ieee80211_change_mtu(struct net_device *dev, int new_mtu)
 {
         int meshhdrlen;
@@ -219,7 +236,10 @@ static int ieee80211_open(struct net_device *dev)
                 break;
         case NL80211_IFTYPE_STATION:
         case NL80211_IFTYPE_ADHOC:
-                sdata->u.sta.flags &= ~IEEE80211_STA_PREV_BSSID_SET;
+                if (sdata->vif.type == NL80211_IFTYPE_STATION)
+                        sdata->u.mgd.flags &= ~IEEE80211_STA_PREV_BSSID_SET;
+                else
+                        sdata->u.ibss.flags &= ~IEEE80211_IBSS_PREV_BSSID_SET;
                 /* fall through */
         default:
                 conf.vif = &sdata->vif;
@@ -241,8 +261,7 @@ static int ieee80211_open(struct net_device *dev)
                 ieee80211_bss_info_change_notify(sdata, changed);
                 ieee80211_enable_keys(sdata);
 
-                if (sdata->vif.type == NL80211_IFTYPE_STATION &&
-                    !(sdata->flags & IEEE80211_SDATA_USERSPACE_MLME))
+                if (sdata->vif.type == NL80211_IFTYPE_STATION)
                         netif_carrier_off(dev);
                 else
                         netif_carrier_on(dev);
@@ -304,11 +323,10 @@ static int ieee80211_open(struct net_device *dev)
          * yet be effective. Trigger execution of ieee80211_sta_work
          * to fix this.
          */
-        if (sdata->vif.type == NL80211_IFTYPE_STATION ||
-            sdata->vif.type == NL80211_IFTYPE_ADHOC) {
-                struct ieee80211_if_sta *ifsta = &sdata->u.sta;
-                queue_work(local->hw.workqueue, &ifsta->work);
-        }
+        if (sdata->vif.type == NL80211_IFTYPE_STATION)
+                queue_work(local->hw.workqueue, &sdata->u.mgd.work);
+        else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
+                queue_work(local->hw.workqueue, &sdata->u.ibss.work);
 
         netif_tx_start_all_queues(dev);
 
@@ -345,13 +363,24 @@ static int ieee80211_stop(struct net_device *dev)
 
         list_for_each_entry_rcu(sta, &local->sta_list, list) {
                 if (sta->sdata == sdata)
-                        ieee80211_sta_tear_down_BA_sessions(sdata,
-                                                            sta->sta.addr);
+                        ieee80211_sta_tear_down_BA_sessions(sta);
         }
 
         rcu_read_unlock();
 
         /*
+         * Announce that we are leaving the network, in case we are a
+         * station interface type. This must be done before removing
+         * all stations associated with sta_info_flush, otherwise STA
+         * information will be gone and no announce being done.
+         */
+        if (sdata->vif.type == NL80211_IFTYPE_STATION) {
+                if (sdata->u.mgd.state != IEEE80211_STA_MLME_DISABLED)
+                        ieee80211_sta_deauthenticate(sdata,
+                                WLAN_REASON_DEAUTH_LEAVING);
+        }
+
+        /*
          * Remove all stations associated with this interface.
          *
          * This must be done before calling ops->remove_interface()
@@ -383,6 +412,8 @@ static int ieee80211_stop(struct net_device *dev)
                 atomic_dec(&local->iff_promiscs);
 
         dev_mc_unsync(local->mdev, dev);
+        del_timer_sync(&local->dynamic_ps_timer);
+        cancel_work_sync(&local->dynamic_ps_enable_work);
 
         /* APs need special treatment */
         if (sdata->vif.type == NL80211_IFTYPE_AP) {
@@ -434,14 +465,9 @@ static int ieee80211_stop(struct net_device *dev)
                 netif_addr_unlock_bh(local->mdev);
                 break;
         case NL80211_IFTYPE_STATION:
-        case NL80211_IFTYPE_ADHOC:
-                /* Announce that we are leaving the network. */
-                if (sdata->u.sta.state != IEEE80211_STA_MLME_DISABLED)
-                        ieee80211_sta_deauthenticate(sdata,
-                                                WLAN_REASON_DEAUTH_LEAVING);
-
-                memset(sdata->u.sta.bssid, 0, ETH_ALEN);
-                del_timer_sync(&sdata->u.sta.timer);
+                memset(sdata->u.mgd.bssid, 0, ETH_ALEN);
+                del_timer_sync(&sdata->u.mgd.chswitch_timer);
+                del_timer_sync(&sdata->u.mgd.timer);
                 /*
                  * If the timer fired while we waited for it, it will have
                  * requeued the work. Now the work will be running again
@@ -449,7 +475,11 @@ static int ieee80211_stop(struct net_device *dev)
                  * whether the interface is running, which, at this point,
                  * it no longer is.
                  */
-                cancel_work_sync(&sdata->u.sta.work);
+                cancel_work_sync(&sdata->u.mgd.work);
+                cancel_work_sync(&sdata->u.mgd.chswitch_work);
+
+                cancel_work_sync(&sdata->u.mgd.beacon_loss_work);
+
                 /*
                  * When we get here, the interface is marked down.
                  * Call synchronize_rcu() to wait for the RX path
@@ -457,12 +487,22 @@ static int ieee80211_stop(struct net_device *dev)
                  * frames at this very time on another CPU.
                  */
                 synchronize_rcu();
-                skb_queue_purge(&sdata->u.sta.skb_queue);
+                skb_queue_purge(&sdata->u.mgd.skb_queue);
 
-                sdata->u.sta.flags &= ~IEEE80211_STA_PRIVACY_INVOKED;
-                kfree(sdata->u.sta.extra_ie);
-                sdata->u.sta.extra_ie = NULL;
-                sdata->u.sta.extra_ie_len = 0;
+                sdata->u.mgd.flags &= ~(IEEE80211_STA_PRIVACY_INVOKED |
+                                        IEEE80211_STA_TKIP_WEP_USED);
+                kfree(sdata->u.mgd.extra_ie);
+                sdata->u.mgd.extra_ie = NULL;
+                sdata->u.mgd.extra_ie_len = 0;
+                /* fall through */
+        case NL80211_IFTYPE_ADHOC:
+                if (sdata->vif.type == NL80211_IFTYPE_ADHOC) {
+                        memset(sdata->u.ibss.bssid, 0, ETH_ALEN);
+                        del_timer_sync(&sdata->u.ibss.timer);
+                        cancel_work_sync(&sdata->u.ibss.work);
+                        synchronize_rcu();
+                        skb_queue_purge(&sdata->u.ibss.skb_queue);
+                }
                 /* fall through */
         case NL80211_IFTYPE_MESH_POINT:
                 if (ieee80211_vif_is_mesh(&sdata->vif)) {
@@ -501,7 +541,7 @@ static int ieee80211_stop(struct net_device *dev)
                          * scan event to userspace -- the scan is incomplete.
                          */
                         if (local->sw_scanning)
-                                ieee80211_scan_completed(&local->hw);
+                                ieee80211_scan_completed(&local->hw, true);
                 }
 
                 conf.vif = &sdata->vif;
@@ -569,19 +609,6 @@ static void ieee80211_set_multicast_list(struct net_device *dev)
         dev_mc_sync(local->mdev, dev);
 }
 
-static void ieee80211_if_setup(struct net_device *dev)
-{
-        ether_setup(dev);
-        dev->hard_start_xmit = ieee80211_subif_start_xmit;
-        dev->wireless_handlers = &ieee80211_iw_handler_def;
-        dev->set_multicast_list = ieee80211_set_multicast_list;
-        dev->change_mtu = ieee80211_change_mtu;
-        dev->open = ieee80211_open;
-        dev->stop = ieee80211_stop;
-        dev->destructor = free_netdev;
-        /* we will validate the address ourselves in ->open */
-        dev->validate_addr = NULL;
-}
 /*
  * Called when the netdev is removed or, by the code below, before
  * the interface type changes.
@@ -621,12 +648,14 @@ static void ieee80211_teardown_sdata(struct net_device *dev)
                 if (ieee80211_vif_is_mesh(&sdata->vif))
                         mesh_rmc_free(sdata);
                 break;
-        case NL80211_IFTYPE_STATION:
         case NL80211_IFTYPE_ADHOC:
-                kfree(sdata->u.sta.extra_ie);
-                kfree(sdata->u.sta.assocreq_ies);
-                kfree(sdata->u.sta.assocresp_ies);
-                kfree_skb(sdata->u.sta.probe_resp);
+                kfree_skb(sdata->u.ibss.probe_resp);
+                break;
+        case NL80211_IFTYPE_STATION:
+                kfree(sdata->u.mgd.extra_ie);
+                kfree(sdata->u.mgd.assocreq_ies);
+                kfree(sdata->u.mgd.assocresp_ies);
+                kfree(sdata->u.mgd.sme_auth_ie);
                 break;
         case NL80211_IFTYPE_WDS:
         case NL80211_IFTYPE_AP_VLAN:
@@ -642,6 +671,34 @@ static void ieee80211_teardown_sdata(struct net_device *dev)
         WARN_ON(flushed);
 }
 
+static const struct net_device_ops ieee80211_dataif_ops = {
+        .ndo_open               = ieee80211_open,
+        .ndo_stop               = ieee80211_stop,
+        .ndo_uninit             = ieee80211_teardown_sdata,
+        .ndo_start_xmit         = ieee80211_subif_start_xmit,
+        .ndo_set_multicast_list = ieee80211_set_multicast_list,
+        .ndo_change_mtu         = ieee80211_change_mtu,
+        .ndo_set_mac_address    = eth_mac_addr,
+};
+
+static const struct net_device_ops ieee80211_monitorif_ops = {
+        .ndo_open               = ieee80211_open,
+        .ndo_stop               = ieee80211_stop,
+        .ndo_uninit             = ieee80211_teardown_sdata,
+        .ndo_start_xmit         = ieee80211_monitor_start_xmit,
+        .ndo_set_multicast_list = ieee80211_set_multicast_list,
+        .ndo_change_mtu         = ieee80211_change_mtu,
+        .ndo_set_mac_address    = eth_mac_addr,
+};
+
+static void ieee80211_if_setup(struct net_device *dev)
+{
+        ether_setup(dev);
+        dev->netdev_ops = &ieee80211_dataif_ops;
+        dev->wireless_handlers = &ieee80211_iw_handler_def;
+        dev->destructor = free_netdev;
+}
+
 /*
  * Helper function to initialise an interface to a specific type.
  */
@@ -653,7 +710,7 @@ static void ieee80211_setup_sdata(struct ieee80211_sub_if_data *sdata,
 
         /* and set some type-dependent values */
         sdata->vif.type = type;
-        sdata->dev->hard_start_xmit = ieee80211_subif_start_xmit;
+        sdata->dev->netdev_ops = &ieee80211_dataif_ops;
         sdata->wdev.iftype = type;
 
         /* only monitor differs */
@@ -665,16 +722,18 @@ static void ieee80211_setup_sdata(struct ieee80211_sub_if_data *sdata,
                 INIT_LIST_HEAD(&sdata->u.ap.vlans);
                 break;
         case NL80211_IFTYPE_STATION:
-        case NL80211_IFTYPE_ADHOC:
                 ieee80211_sta_setup_sdata(sdata);
                 break;
+        case NL80211_IFTYPE_ADHOC:
+                ieee80211_ibss_setup_sdata(sdata);
+                break;
         case NL80211_IFTYPE_MESH_POINT:
                 if (ieee80211_vif_is_mesh(&sdata->vif))
                         ieee80211_mesh_init_sdata(sdata);
                 break;
         case NL80211_IFTYPE_MONITOR:
                 sdata->dev->type = ARPHRD_IEEE80211_RADIOTAP;
-                sdata->dev->hard_start_xmit = ieee80211_monitor_start_xmit;
+                sdata->dev->netdev_ops = &ieee80211_monitorif_ops;
                 sdata->u.mntr_flags = MONITOR_FLAG_CONTROL |
                                       MONITOR_FLAG_OTHER_BSS;
                 break;
@@ -755,6 +814,7 @@ int ieee80211_if_add(struct ieee80211_local *local, const char *name,
 
         memcpy(ndev->dev_addr, local->hw.wiphy->perm_addr, ETH_ALEN);
         SET_NETDEV_DEV(ndev, wiphy_dev(local->hw.wiphy));
+        ndev->features |= NETIF_F_NETNS_LOCAL;
 
         /* don't use IEEE80211_DEV_TO_SUB_IF because it checks too much */
         sdata = netdev_priv(ndev);
@@ -780,15 +840,15 @@ int ieee80211_if_add(struct ieee80211_local *local, const char *name,
         if (ret)
                 goto fail;
 
-        ndev->uninit = ieee80211_teardown_sdata;
-
         if (ieee80211_vif_is_mesh(&sdata->vif) &&
             params && params->mesh_id_len)
                 ieee80211_sdata_set_mesh_id(sdata,
                                             params->mesh_id_len,
                                             params->mesh_id);
 
+        mutex_lock(&local->iflist_mtx);
         list_add_tail_rcu(&sdata->list, &local->interfaces);
+        mutex_unlock(&local->iflist_mtx);
 
         if (new_dev)
                 *new_dev = ndev;
@@ -804,7 +864,10 @@ void ieee80211_if_remove(struct ieee80211_sub_if_data *sdata)
 {
         ASSERT_RTNL();
 
+        mutex_lock(&sdata->local->iflist_mtx);
         list_del_rcu(&sdata->list);
+        mutex_unlock(&sdata->local->iflist_mtx);
+
         synchronize_rcu();
         unregister_netdevice(sdata->dev);
 }
@@ -820,7 +883,16 @@ void ieee80211_remove_interfaces(struct ieee80211_local *local)
         ASSERT_RTNL();
 
         list_for_each_entry_safe(sdata, tmp, &local->interfaces, list) {
+                /*
+                 * we cannot hold the iflist_mtx across unregister_netdevice,
+                 * but we only need to hold it for list modifications to lock
+                 * out readers since we're under the RTNL here as all other
+                 * writers.
+                 */
+                mutex_lock(&local->iflist_mtx);
                 list_del(&sdata->list);
+                mutex_unlock(&local->iflist_mtx);
+
                 unregister_netdevice(sdata->dev);
         }
 }
diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index 999f7aa42326..687acf23054d 100644
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -18,6 +18,7 @@
 #include "ieee80211_i.h"
 #include "debugfs_key.h"
 #include "aes_ccm.h"
+#include "aes_cmac.h"
 
 
 /**
@@ -47,7 +48,6 @@
  */
 
 static const u8 bcast_addr[ETH_ALEN] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
-static const u8 zero_addr[ETH_ALEN];
 
 /* key mutex: used to synchronise todo runners */
 static DEFINE_MUTEX(key_mutex);
@@ -108,29 +108,18 @@ static void assert_key_lock(void)
         WARN_ON(!mutex_is_locked(&key_mutex));
 }
 
-static const u8 *get_mac_for_key(struct ieee80211_key *key)
+static struct ieee80211_sta *get_sta_for_key(struct ieee80211_key *key)
 {
-        const u8 *addr = bcast_addr;
-
-        /*
-         * If we're an AP we won't ever receive frames with a non-WEP
-         * group key so we tell the driver that by using the zero MAC
-         * address to indicate a transmit-only key.
-         */
-        if (key->conf.alg != ALG_WEP &&
-            (key->sdata->vif.type == NL80211_IFTYPE_AP ||
-             key->sdata->vif.type == NL80211_IFTYPE_AP_VLAN))
-                addr = zero_addr;
-
         if (key->sta)
-                addr = key->sta->sta.addr;
+                return &key->sta->sta;
 
-        return addr;
+        return NULL;
 }
 
 static void ieee80211_key_enable_hw_accel(struct ieee80211_key *key)
 {
-        const u8 *addr;
+        struct ieee80211_sub_if_data *sdata;
+        struct ieee80211_sta *sta;
         int ret;
 
         assert_key_lock();
@@ -139,11 +128,16 @@ static void ieee80211_key_enable_hw_accel(struct ieee80211_key *key)
         if (!key->local->ops->set_key)
                 return;
 
-        addr = get_mac_for_key(key);
+        sta = get_sta_for_key(key);
+
+        sdata = key->sdata;
+        if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
+                sdata = container_of(sdata->bss,
+                                     struct ieee80211_sub_if_data,
+                                     u.ap);
 
         ret = key->local->ops->set_key(local_to_hw(key->local), SET_KEY,
-                                       key->sdata->dev->dev_addr, addr,
-                                       &key->conf);
+                                       &sdata->vif, sta, &key->conf);
 
         if (!ret) {
                 spin_lock(&todo_lock);
@@ -155,12 +149,13 @@ static void ieee80211_key_enable_hw_accel(struct ieee80211_key *key)
                 printk(KERN_ERR "mac80211-%s: failed to set key "
                        "(%d, %pM) to hardware (%d)\n",
                        wiphy_name(key->local->hw.wiphy),
-                       key->conf.keyidx, addr, ret);
+                       key->conf.keyidx, sta ? sta->addr : bcast_addr, ret);
 }
 
 static void ieee80211_key_disable_hw_accel(struct ieee80211_key *key)
 {
-        const u8 *addr;
+        struct ieee80211_sub_if_data *sdata;
+        struct ieee80211_sta *sta;
         int ret;
 
         assert_key_lock();
@@ -176,17 +171,22 @@ static void ieee80211_key_disable_hw_accel(struct ieee80211_key *key)
         }
         spin_unlock(&todo_lock);
 
-        addr = get_mac_for_key(key);
+        sta = get_sta_for_key(key);
+        sdata = key->sdata;
+
+        if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
+                sdata = container_of(sdata->bss,
+                                     struct ieee80211_sub_if_data,
+                                     u.ap);
 
         ret = key->local->ops->set_key(local_to_hw(key->local), DISABLE_KEY,
-                                       key->sdata->dev->dev_addr, addr,
-                                       &key->conf);
+                                       &sdata->vif, sta, &key->conf);
 
         if (ret)
                 printk(KERN_ERR "mac80211-%s: failed to remove key "
                        "(%d, %pM) from hardware (%d)\n",
                        wiphy_name(key->local->hw.wiphy),
-                       key->conf.keyidx, addr, ret);
+                       key->conf.keyidx, sta ? sta->addr : bcast_addr, ret);
 
         spin_lock(&todo_lock);
         key->flags &= ~KEY_FLAG_UPLOADED_TO_HARDWARE;
@@ -216,13 +216,38 @@ void ieee80211_set_default_key(struct ieee80211_sub_if_data *sdata, int idx)
         spin_unlock_irqrestore(&sdata->local->key_lock, flags);
 }
 
+static void
+__ieee80211_set_default_mgmt_key(struct ieee80211_sub_if_data *sdata, int idx)
+{
+        struct ieee80211_key *key = NULL;
+
+        if (idx >= NUM_DEFAULT_KEYS &&
+            idx < NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS)
+                key = sdata->keys[idx];
+
+        rcu_assign_pointer(sdata->default_mgmt_key, key);
+
+        if (key)
+                add_todo(key, KEY_FLAG_TODO_DEFMGMTKEY);
+}
+
+void ieee80211_set_default_mgmt_key(struct ieee80211_sub_if_data *sdata,
+                                    int idx)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&sdata->local->key_lock, flags);
+        __ieee80211_set_default_mgmt_key(sdata, idx);
+        spin_unlock_irqrestore(&sdata->local->key_lock, flags);
+}
+
 
 static void __ieee80211_key_replace(struct ieee80211_sub_if_data *sdata,
                                     struct sta_info *sta,
                                     struct ieee80211_key *old,
                                     struct ieee80211_key *new)
 {
-        int idx, defkey;
+        int idx, defkey, defmgmtkey;
 
         if (new)
                 list_add(&new->list, &sdata->key_list);
@@ -238,13 +263,19 @@ static void __ieee80211_key_replace(struct ieee80211_sub_if_data *sdata,
                         idx = new->conf.keyidx;
 
                 defkey = old && sdata->default_key == old;
+                defmgmtkey = old && sdata->default_mgmt_key == old;
 
                 if (defkey && !new)
                         __ieee80211_set_default_key(sdata, -1);
+                if (defmgmtkey && !new)
+                        __ieee80211_set_default_mgmt_key(sdata, -1);
 
                 rcu_assign_pointer(sdata->keys[idx], new);
                 if (defkey && new)
                         __ieee80211_set_default_key(sdata, new->conf.keyidx);
+                if (defmgmtkey && new)
+                        __ieee80211_set_default_mgmt_key(sdata,
+                                                         new->conf.keyidx);
         }
 
         if (old) {
@@ -263,7 +294,7 @@ struct ieee80211_key *ieee80211_key_alloc(enum ieee80211_key_alg alg,
 {
         struct ieee80211_key *key;
 
-        BUG_ON(idx < 0 || idx >= NUM_DEFAULT_KEYS);
+        BUG_ON(idx < 0 || idx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS);
 
         key = kzalloc(sizeof(struct ieee80211_key) + key_len, GFP_KERNEL);
         if (!key)
@@ -292,6 +323,10 @@ struct ieee80211_key *ieee80211_key_alloc(enum ieee80211_key_alg alg,
                 key->conf.iv_len = CCMP_HDR_LEN;
                 key->conf.icv_len = CCMP_MIC_LEN;
                 break;
+        case ALG_AES_CMAC:
+                key->conf.iv_len = 0;
+                key->conf.icv_len = sizeof(struct ieee80211_mmie);
+                break;
         }
         memcpy(key->conf.key, key_data, key_len);
         INIT_LIST_HEAD(&key->list);
@@ -309,6 +344,19 @@ struct ieee80211_key *ieee80211_key_alloc(enum ieee80211_key_alg alg,
                 }
         }
 
+        if (alg == ALG_AES_CMAC) {
+                /*
+                 * Initialize AES key state here as an optimization so that
+                 * it does not need to be initialized for every packet.
+                 */
+                key->u.aes_cmac.tfm =
+                        ieee80211_aes_cmac_key_setup(key_data);
+                if (!key->u.aes_cmac.tfm) {
+                        kfree(key);
+                        return NULL;
+                }
+        }
+
         return key;
 }
 
@@ -352,7 +400,7 @@ void ieee80211_key_link(struct ieee80211_key *key,
                          */
 
                         /* same here, the AP could be using QoS */
-                        ap = sta_info_get(key->local, key->sdata->u.sta.bssid);
+                        ap = sta_info_get(key->local, key->sdata->u.mgd.bssid);
                         if (ap) {
                                 if (test_sta_flags(ap, WLAN_STA_WME))
                                         key->conf.flags |=
@@ -462,6 +510,8 @@ static void __ieee80211_key_destroy(struct ieee80211_key *key)
 
         if (key->conf.alg == ALG_CCMP)
                 ieee80211_aes_key_free(key->u.ccmp.tfm);
+        if (key->conf.alg == ALG_AES_CMAC)
+                ieee80211_aes_cmac_key_free(key->u.aes_cmac.tfm);
         ieee80211_debugfs_key_remove(key);
 
         kfree(key);
@@ -484,6 +534,7 @@ static void __ieee80211_key_todo(void)
                 list_del_init(&key->todo);
                 todoflags = key->flags & (KEY_FLAG_TODO_ADD_DEBUGFS |
                                           KEY_FLAG_TODO_DEFKEY |
+                                          KEY_FLAG_TODO_DEFMGMTKEY |
                                           KEY_FLAG_TODO_HWACCEL_ADD |
                                           KEY_FLAG_TODO_HWACCEL_REMOVE |
                                           KEY_FLAG_TODO_DELETE);
@@ -501,6 +552,11 @@ static void __ieee80211_key_todo(void)
                         ieee80211_debugfs_key_add_default(key->sdata);
                         work_done = true;
                 }
+                if (todoflags & KEY_FLAG_TODO_DEFMGMTKEY) {
+                        ieee80211_debugfs_key_remove_mgmt_default(key->sdata);
+                        ieee80211_debugfs_key_add_mgmt_default(key->sdata);
+                        work_done = true;
+                }
                 if (todoflags & KEY_FLAG_TODO_HWACCEL_ADD) {
                         ieee80211_key_enable_hw_accel(key);
                         work_done = true;
@@ -536,6 +592,7 @@ void ieee80211_free_keys(struct ieee80211_sub_if_data *sdata)
         ieee80211_key_lock();
 
         ieee80211_debugfs_key_remove_default(sdata);
+        ieee80211_debugfs_key_remove_mgmt_default(sdata);
 
         spin_lock_irqsave(&sdata->local->key_lock, flags);
         list_for_each_entry_safe(key, tmp, &sdata->key_list, list)
diff --git a/net/mac80211/key.h b/net/mac80211/key.h
index 425816e0996c..215d3ef42a4f 100644
--- a/net/mac80211/key.h
+++ b/net/mac80211/key.h
@@ -46,6 +46,8 @@ struct sta_info;
  *      acceleration.
  * @KEY_FLAG_TODO_DEFKEY: Key is default key and debugfs needs to be updated.
  * @KEY_FLAG_TODO_ADD_DEBUGFS: Key needs to be added to debugfs.
+ * @KEY_FLAG_TODO_DEFMGMTKEY: Key is default management key and debugfs needs
+ *      to be updated.
  */
 enum ieee80211_internal_key_flags {
         KEY_FLAG_UPLOADED_TO_HARDWARE   = BIT(0),
@@ -54,6 +56,7 @@ enum ieee80211_internal_key_flags {
         KEY_FLAG_TODO_HWACCEL_REMOVE    = BIT(3),
         KEY_FLAG_TODO_DEFKEY            = BIT(4),
         KEY_FLAG_TODO_ADD_DEBUGFS       = BIT(5),
+        KEY_FLAG_TODO_DEFMGMTKEY        = BIT(6),
 };
 
 struct tkip_ctx {
@@ -96,6 +99,16 @@ struct ieee80211_key {
                         u8 tx_crypto_buf[6 * AES_BLOCK_LEN];
                         u8 rx_crypto_buf[6 * AES_BLOCK_LEN];
                 } ccmp;
+                struct {
+                        u8 tx_pn[6];
+                        u8 rx_pn[6];
+                        struct crypto_cipher *tfm;
+                        u32 replays; /* dot11RSNAStatsCMACReplays */
+                        u32 icverrors; /* dot11RSNAStatsCMACICVErrors */
+                        /* scratch buffers for virt_to_page() (crypto API) */
+                        u8 tx_crypto_buf[2 * AES_BLOCK_LEN];
+                        u8 rx_crypto_buf[2 * AES_BLOCK_LEN];
+                } aes_cmac;
         } u;
 
         /* number of times this key has been used */
@@ -114,6 +127,7 @@ struct ieee80211_key {
                 struct dentry *tx_spec;
                 struct dentry *rx_spec;
                 struct dentry *replays;
+                struct dentry *icverrors;
                 struct dentry *key;
                 struct dentry *ifindex;
                 int cnt;
@@ -140,6 +154,8 @@ void ieee80211_key_link(struct ieee80211_key *key,
                         struct sta_info *sta);
 void ieee80211_key_free(struct ieee80211_key *key);
 void ieee80211_set_default_key(struct ieee80211_sub_if_data *sdata, int idx);
+void ieee80211_set_default_mgmt_key(struct ieee80211_sub_if_data *sdata,
+                                    int idx);
 void ieee80211_free_keys(struct ieee80211_sub_if_data *sdata);
 void ieee80211_enable_keys(struct ieee80211_sub_if_data *sdata);
 void ieee80211_disable_keys(struct ieee80211_sub_if_data *sdata);
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 24b14363d6e7..a6f1d8a869bc 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -161,30 +161,67 @@ int ieee80211_if_config(struct ieee80211_sub_if_data *sdata, u32 changed)
         if (WARN_ON(!netif_running(sdata->dev)))
                 return 0;
 
-        if (WARN_ON(sdata->vif.type == NL80211_IFTYPE_AP_VLAN))
-                return -EINVAL;
-
-        if (!local->ops->config_interface)
-                return 0;
-
         memset(&conf, 0, sizeof(conf));
-        conf.changed = changed;
 
-        if (sdata->vif.type == NL80211_IFTYPE_STATION ||
-            sdata->vif.type == NL80211_IFTYPE_ADHOC)
-                conf.bssid = sdata->u.sta.bssid;
+        if (sdata->vif.type == NL80211_IFTYPE_STATION)
+                conf.bssid = sdata->u.mgd.bssid;
+        else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
+                conf.bssid = sdata->u.ibss.bssid;
         else if (sdata->vif.type == NL80211_IFTYPE_AP)
                 conf.bssid = sdata->dev->dev_addr;
         else if (ieee80211_vif_is_mesh(&sdata->vif)) {
-                u8 zero[ETH_ALEN] = { 0 };
+                static const u8 zero[ETH_ALEN] = { 0 };
                 conf.bssid = zero;
         } else {
                 WARN_ON(1);
                 return -EINVAL;
         }
 
-        if (WARN_ON(!conf.bssid && (changed & IEEE80211_IFCC_BSSID)))
-                return -EINVAL;
+        if (!local->ops->config_interface)
+                return 0;
+
+        switch (sdata->vif.type) {
+        case NL80211_IFTYPE_AP:
+        case NL80211_IFTYPE_ADHOC:
+        case NL80211_IFTYPE_MESH_POINT:
+                break;
+        default:
+                /* do not warn to simplify caller in scan.c */
+                changed &= ~IEEE80211_IFCC_BEACON_ENABLED;
+                if (WARN_ON(changed & IEEE80211_IFCC_BEACON))
+                        return -EINVAL;
+                changed &= ~IEEE80211_IFCC_BEACON;
+                break;
+        }
+
+        if (changed & IEEE80211_IFCC_BEACON_ENABLED) {
+                if (local->sw_scanning) {
+                        conf.enable_beacon = false;
+                } else {
+                        /*
+                         * Beacon should be enabled, but AP mode must
+                         * check whether there is a beacon configured.
+                         */
+                        switch (sdata->vif.type) {
+                        case NL80211_IFTYPE_AP:
+                                conf.enable_beacon =
+                                        !!rcu_dereference(sdata->u.ap.beacon);
+                                break;
+                        case NL80211_IFTYPE_ADHOC:
+                                conf.enable_beacon = !!sdata->u.ibss.probe_resp;
+                                break;
+                        case NL80211_IFTYPE_MESH_POINT:
+                                conf.enable_beacon = true;
+                                break;
+                        default:
+                                /* not reached */
+                                WARN_ON(1);
+                                break;
+                        }
+                }
+        }
+
+        conf.changed = changed;
 
         return local->ops->config_interface(local_to_hw(local),
                                             &sdata->vif, &conf);
@@ -208,26 +245,22 @@ int ieee80211_hw_config(struct ieee80211_local *local, u32 changed)
         }
 
         if (chan != local->hw.conf.channel ||
-            channel_type != local->hw.conf.ht.channel_type) {
+            channel_type != local->hw.conf.channel_type) {
                 local->hw.conf.channel = chan;
-                local->hw.conf.ht.channel_type = channel_type;
-                switch (channel_type) {
-                case NL80211_CHAN_NO_HT:
-                        local->hw.conf.ht.enabled = false;
-                        break;
-                case NL80211_CHAN_HT20:
-                case NL80211_CHAN_HT40MINUS:
-                case NL80211_CHAN_HT40PLUS:
-                        local->hw.conf.ht.enabled = true;
-                        break;
-                }
+                local->hw.conf.channel_type = channel_type;
                 changed |= IEEE80211_CONF_CHANGE_CHANNEL;
         }
 
-        if (!local->hw.conf.power_level)
+        if (local->sw_scanning)
                 power = chan->max_power;
         else
-                power = min(chan->max_power, local->hw.conf.power_level);
+                power = local->power_constr_level ?
+                        (chan->max_power - local->power_constr_level) :
+                        chan->max_power;
+
+        if (local->user_power_level)
+                power = min(power, local->user_power_level);
+
         if (local->hw.conf.power_level != power) {
                 changed |= IEEE80211_CONF_CHANGE_POWER;
                 local->hw.conf.power_level = power;
@@ -667,7 +700,7 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
                                         const struct ieee80211_ops *ops)
 {
         struct ieee80211_local *local;
-        int priv_size;
+        int priv_size, i;
         struct wiphy *wiphy;
 
         /* Ensure 32-byte alignment of our private data and hw private data.
@@ -695,6 +728,10 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
                 return NULL;
 
         wiphy->privid = mac80211_wiphy_privid;
+        wiphy->max_scan_ssids = 4;
+        /* Yes, putting cfg80211_bss into ieee80211_bss is a hack */
+        wiphy->bss_priv_size = sizeof(struct ieee80211_bss) -
+                               sizeof(struct cfg80211_bss);
 
         local = wiphy_priv(wiphy);
         local->hw.wiphy = wiphy;
@@ -722,6 +759,7 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
         local->hw.conf.radio_enabled = true;
 
         INIT_LIST_HEAD(&local->interfaces);
+        mutex_init(&local->iflist_mtx);
 
         spin_lock_init(&local->key_lock);
 
@@ -738,6 +776,8 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
 
         sta_info_init(local);
 
+        for (i = 0; i < IEEE80211_MAX_QUEUES; i++)
+                skb_queue_head_init(&local->pending[i]);
         tasklet_init(&local->tx_pending_tasklet, ieee80211_tx_pending,
                      (unsigned long)local);
         tasklet_disable(&local->tx_pending_tasklet);
@@ -750,10 +790,29 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
         skb_queue_head_init(&local->skb_queue);
         skb_queue_head_init(&local->skb_queue_unreliable);
 
+        spin_lock_init(&local->ampdu_lock);
+
         return local_to_hw(local);
 }
 EXPORT_SYMBOL(ieee80211_alloc_hw);
 
+static const struct net_device_ops ieee80211_master_ops = {
+        .ndo_start_xmit = ieee80211_master_start_xmit,
+        .ndo_open = ieee80211_master_open,
+        .ndo_stop = ieee80211_master_stop,
+        .ndo_set_multicast_list = ieee80211_master_set_multicast_list,
+        .ndo_select_queue = ieee80211_select_queue,
+};
+
+static void ieee80211_master_setup(struct net_device *mdev)
+{
+        mdev->type = ARPHRD_IEEE80211;
+        mdev->netdev_ops = &ieee80211_master_ops;
+        mdev->header_ops = &ieee80211_header_ops;
+        mdev->tx_queue_len = 1000;
+        mdev->addr_len = ETH_ALEN;
+}
+
 int ieee80211_register_hw(struct ieee80211_hw *hw)
 {
         struct ieee80211_local *local = hw_to_local(hw);
@@ -761,25 +820,33 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
         enum ieee80211_band band;
         struct net_device *mdev;
         struct ieee80211_master_priv *mpriv;
+        int channels, i, j;
 
         /*
          * generic code guarantees at least one band,
          * set this very early because much code assumes
          * that hw.conf.channel is assigned
          */
+        channels = 0;
         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
                 struct ieee80211_supported_band *sband;
 
                 sband = local->hw.wiphy->bands[band];
-                if (sband) {
+                if (sband && !local->oper_channel) {
                         /* init channel we're on */
                         local->hw.conf.channel =
                         local->oper_channel =
                         local->scan_channel = &sband->channels[0];
-                        break;
                 }
+                if (sband)
+                        channels += sband->n_channels;
         }
 
+        local->int_scan_req.n_channels = channels;
+        local->int_scan_req.channels = kzalloc(sizeof(void *) * channels, GFP_KERNEL);
+        if (!local->int_scan_req.channels)
+                return -ENOMEM;
+
         /* if low-level driver supports AP, we also support VLAN */
         if (local->hw.wiphy->interface_modes & BIT(NL80211_IFTYPE_AP))
                 local->hw.wiphy->interface_modes |= BIT(NL80211_IFTYPE_AP_VLAN);
@@ -787,9 +854,14 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
         /* mac80211 always supports monitor */
         local->hw.wiphy->interface_modes |= BIT(NL80211_IFTYPE_MONITOR);
 
+        if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
+                local->hw.wiphy->signal_type = CFG80211_SIGNAL_TYPE_MBM;
+        else if (local->hw.flags & IEEE80211_HW_SIGNAL_UNSPEC)
+                local->hw.wiphy->signal_type = CFG80211_SIGNAL_TYPE_UNSPEC;
+
         result = wiphy_register(local->hw.wiphy);
         if (result < 0)
-                return result;
+                goto fail_wiphy_register;
 
         /*
          * We use the number of queues for feature tests (QoS, HT) internally
@@ -797,14 +869,10 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
          */
         if (hw->queues > IEEE80211_MAX_QUEUES)
                 hw->queues = IEEE80211_MAX_QUEUES;
-        if (hw->ampdu_queues > IEEE80211_MAX_AMPDU_QUEUES)
-                hw->ampdu_queues = IEEE80211_MAX_AMPDU_QUEUES;
-        if (hw->queues < 4)
-                hw->ampdu_queues = 0;
 
         mdev = alloc_netdev_mq(sizeof(struct ieee80211_master_priv),
-                               "wmaster%d", ether_setup,
-                               ieee80211_num_queues(hw));
+                               "wmaster%d", ieee80211_master_setup,
+                               hw->queues);
         if (!mdev)
                 goto fail_mdev_alloc;
 
@@ -812,17 +880,8 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
         mpriv->local = local;
         local->mdev = mdev;
 
-        ieee80211_rx_bss_list_init(local);
-
-        mdev->hard_start_xmit = ieee80211_master_start_xmit;
-        mdev->open = ieee80211_master_open;
-        mdev->stop = ieee80211_master_stop;
-        mdev->type = ARPHRD_IEEE80211;
-        mdev->header_ops = &ieee80211_header_ops;
-        mdev->set_multicast_list = ieee80211_master_set_multicast_list;
-
         local->hw.workqueue =
-                create_freezeable_workqueue(wiphy_name(local->hw.wiphy));
+                create_singlethread_workqueue(wiphy_name(local->hw.wiphy));
         if (!local->hw.workqueue) {
                 result = -ENOMEM;
                 goto fail_workqueue;
@@ -846,15 +905,6 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
 
         local->hw.conf.listen_interval = local->hw.max_listen_interval;
 
-        local->wstats_flags |= local->hw.flags & (IEEE80211_HW_SIGNAL_UNSPEC |
-                                                  IEEE80211_HW_SIGNAL_DB |
-                                                  IEEE80211_HW_SIGNAL_DBM) ?
-                               IW_QUAL_QUAL_UPDATED : IW_QUAL_QUAL_INVALID;
-        local->wstats_flags |= local->hw.flags & IEEE80211_HW_NOISE_DBM ?
-                               IW_QUAL_NOISE_UPDATED : IW_QUAL_NOISE_INVALID;
-        if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
-                local->wstats_flags |= IW_QUAL_DBM;
-
         result = sta_info_start(local);
         if (result < 0)
                 goto fail_sta_info;
@@ -866,6 +916,7 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
 
         memcpy(local->mdev->dev_addr, local->hw.wiphy->perm_addr, ETH_ALEN);
         SET_NETDEV_DEV(local->mdev, wiphy_dev(local->hw.wiphy));
+        local->mdev->features |= NETIF_F_NETNS_LOCAL;
 
         result = register_netdevice(local->mdev);
         if (result < 0)
@@ -887,8 +938,6 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
                 goto fail_wep;
         }
 
-        local->mdev->select_queue = ieee80211_select_queue;
-
         /* add one default STA interface if supported */
         if (local->hw.wiphy->interface_modes & BIT(NL80211_IFTYPE_STATION)) {
                 result = ieee80211_if_add(local, "wlan%d", NULL,
@@ -902,6 +951,20 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
 
         ieee80211_led_init(local);
 
+        /* alloc internal scan request */
+        i = 0;
+        local->int_scan_req.ssids = &local->scan_ssid;
+        local->int_scan_req.n_ssids = 1;
+        for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
+                if (!hw->wiphy->bands[band])
+                        continue;
+                for (j = 0; j < hw->wiphy->bands[band]->n_channels; j++) {
+                        local->int_scan_req.channels[i] =
+                                &hw->wiphy->bands[band]->channels[j];
+                        i++;
+                }
+        }
+
         return 0;
 
 fail_wep:
@@ -920,6 +983,8 @@ fail_workqueue:
                 free_netdev(local->mdev);
 fail_mdev_alloc:
         wiphy_unregister(local->hw.wiphy);
+fail_wiphy_register:
+        kfree(local->int_scan_req.channels);
         return result;
 }
 EXPORT_SYMBOL(ieee80211_register_hw);
@@ -947,7 +1012,6 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw)
 
         rtnl_unlock();
 
-        ieee80211_rx_bss_list_deinit(local);
         ieee80211_clear_tx_pending(local);
         sta_info_stop(local);
         rate_control_deinitialize(local);
@@ -965,6 +1029,7 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw)
         ieee80211_wep_free(local);
         ieee80211_led_exit(local);
         free_netdev(local->mdev);
+        kfree(local->int_scan_req.channels);
 }
 EXPORT_SYMBOL(ieee80211_unregister_hw);
 
@@ -972,6 +1037,8 @@ void ieee80211_free_hw(struct ieee80211_hw *hw)
 {
         struct ieee80211_local *local = hw_to_local(hw);
 
+        mutex_destroy(&local->iflist_mtx);
+
         wiphy_free(local->hw.wiphy);
 }
 EXPORT_SYMBOL(ieee80211_free_hw);
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index 82f568e94365..9a3e5de0410a 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -275,16 +275,6 @@ u32 mesh_table_hash(u8 *addr, struct ieee80211_sub_if_data *sdata, struct mesh_t
                 & tbl->hash_mask;
 }
 
-u8 mesh_id_hash(u8 *mesh_id, int mesh_id_len)
-{
-        if (!mesh_id_len)
-                return 1;
-        else if (mesh_id_len == 1)
-                return (u8) mesh_id[0];
-        else
-                return (u8) (mesh_id[0] + 2 * mesh_id[1]);
-}
-
 struct mesh_table *mesh_table_alloc(int size_order)
 {
         int i;
@@ -442,7 +432,8 @@ void ieee80211_start_mesh(struct ieee80211_sub_if_data *sdata)
 
         ifmsh->housekeeping = true;
         queue_work(local->hw.workqueue, &ifmsh->work);
-        ieee80211_if_config(sdata, IEEE80211_IFCC_BEACON);
+        ieee80211_if_config(sdata, IEEE80211_IFCC_BEACON |
+                                   IEEE80211_IFCC_BEACON_ENABLED);
 }
 
 void ieee80211_stop_mesh(struct ieee80211_sub_if_data *sdata)
@@ -476,7 +467,7 @@ static void ieee80211_mesh_rx_bcn_presp(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_local *local = sdata->local;
         struct ieee802_11_elems elems;
         struct ieee80211_channel *channel;
-        u64 supp_rates = 0;
+        u32 supp_rates = 0;
         size_t baselen;
         int freq;
         enum ieee80211_band band = rx_status->band;
diff --git a/net/mac80211/mesh.h b/net/mac80211/mesh.h
index c197ab545e54..d891d7ddccd7 100644
--- a/net/mac80211/mesh.h
+++ b/net/mac80211/mesh.h
@@ -24,15 +24,15 @@
  *
  *
  *
- * @MESH_PATH_ACTIVE: the mesh path is can be used for forwarding
- * @MESH_PATH_RESOLVED: the discovery process is running for this mesh path
+ * @MESH_PATH_ACTIVE: the mesh path can be used for forwarding
+ * @MESH_PATH_RESOLVING: the discovery process is running for this mesh path
  * @MESH_PATH_DSN_VALID: the mesh path contains a valid destination sequence
  *      number
  * @MESH_PATH_FIXED: the mesh path has been manually set and should not be
  *      modified
  * @MESH_PATH_RESOLVED: the mesh path can has been resolved
  *
- * MESH_PATH_RESOLVED and MESH_PATH_DELETE are used by the mesh path timer to
+ * MESH_PATH_RESOLVED is used by the mesh path timer to
  * decide when to stop or cancel the mesh path discovery.
  */
 enum mesh_path_flags {
@@ -196,7 +196,6 @@ struct mesh_rmc {
 
 /* Public interfaces */
 /* Various */
-u8 mesh_id_hash(u8 *mesh_id, int mesh_id_len);
 int ieee80211_get_mesh_hdrlen(struct ieee80211s_hdr *meshhdr);
 int ieee80211_new_mesh_header(struct ieee80211s_hdr *meshhdr,
                 struct ieee80211_sub_if_data *sdata);
@@ -236,14 +235,13 @@ void mesh_rx_path_sel_frame(struct ieee80211_sub_if_data *sdata,
                 struct ieee80211_mgmt *mgmt, size_t len);
 int mesh_path_add(u8 *dst, struct ieee80211_sub_if_data *sdata);
 /* Mesh plinks */
-void mesh_neighbour_update(u8 *hw_addr, u64 rates,
+void mesh_neighbour_update(u8 *hw_addr, u32 rates,
                 struct ieee80211_sub_if_data *sdata, bool add);
 bool mesh_peer_accepts_plinks(struct ieee802_11_elems *ie);
 void mesh_accept_plinks_update(struct ieee80211_sub_if_data *sdata);
 void mesh_plink_broken(struct sta_info *sta);
 void mesh_plink_deactivate(struct sta_info *sta);
 int mesh_plink_open(struct sta_info *sta);
-int mesh_plink_close(struct sta_info *sta);
 void mesh_plink_block(struct sta_info *sta);
 void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata,
                          struct ieee80211_mgmt *mgmt, size_t len,
diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
index 71fe60961230..60b35accda91 100644
--- a/net/mac80211/mesh_hwmp.c
+++ b/net/mac80211/mesh_hwmp.c
@@ -58,7 +58,6 @@ static inline u32 u32_field_get(u8 *preq_elem, int offset, bool ae)
 #define PERR_IE_DST_ADDR(x)     (x + 2)
 #define PERR_IE_DST_DSN(x)      u32_field_get(x, 8, 0);
 
-#define TU_TO_EXP_TIME(x) (jiffies + msecs_to_jiffies(x * 1024 / 1000))
 #define MSEC_TO_TU(x) (x*1000/1024)
 #define DSN_GT(x, y) ((long) (y) - (long) (x) < 0)
 #define DSN_LT(x, y) ((long) (x) - (long) (y) < 0)
@@ -149,7 +148,7 @@ static int mesh_path_sel_frame_tx(enum mpath_frame_type action, u8 flags,
         pos += ETH_ALEN;
         memcpy(pos, &dst_dsn, 4);
 
-        ieee80211_tx_skb(sdata, skb, 0);
+        ieee80211_tx_skb(sdata, skb, 1);
         return 0;
 }
 
@@ -198,7 +197,7 @@ int mesh_path_error_tx(u8 *dst, __le32 dst_dsn, u8 *ra,
         pos += ETH_ALEN;
         memcpy(pos, &dst_dsn, 4);
 
-        ieee80211_tx_skb(sdata, skb, 0);
+        ieee80211_tx_skb(sdata, skb, 1);
         return 0;
 }
 
@@ -759,7 +758,7 @@ enddiscovery:
 }
 
 /**
- * ieee80211s_lookup_nexthop - put the appropriate next hop on a mesh frame
+ * mesh_nexthop_lookup - put the appropriate next hop on a mesh frame
  *
  * @skb: 802.11 frame to be sent
  * @sdata: network subif the frame will be sent through
diff --git a/net/mac80211/mesh_plink.c b/net/mac80211/mesh_plink.c
index 1159bdb4119c..a8bbdeca013a 100644
--- a/net/mac80211/mesh_plink.c
+++ b/net/mac80211/mesh_plink.c
@@ -93,7 +93,7 @@ static inline void mesh_plink_fsm_restart(struct sta_info *sta)
  *       on it in the lifecycle management section!
  */
 static struct sta_info *mesh_plink_alloc(struct ieee80211_sub_if_data *sdata,
-                                         u8 *hw_addr, u64 rates)
+                                         u8 *hw_addr, u32 rates)
 {
         struct ieee80211_local *local = sdata->local;
         struct sta_info *sta;
@@ -218,11 +218,11 @@ static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata,
                 memcpy(pos, &reason, 2);
         }
 
-        ieee80211_tx_skb(sdata, skb, 0);
+        ieee80211_tx_skb(sdata, skb, 1);
         return 0;
 }
 
-void mesh_neighbour_update(u8 *hw_addr, u64 rates, struct ieee80211_sub_if_data *sdata,
+void mesh_neighbour_update(u8 *hw_addr, u32 rates, struct ieee80211_sub_if_data *sdata,
                            bool peer_accepting_plinks)
 {
         struct ieee80211_local *local = sdata->local;
@@ -361,36 +361,6 @@ void mesh_plink_block(struct sta_info *sta)
         spin_unlock_bh(&sta->lock);
 }
 
-int mesh_plink_close(struct sta_info *sta)
-{
-        struct ieee80211_sub_if_data *sdata = sta->sdata;
-        __le16 llid, plid, reason;
-
-        mpl_dbg("Mesh plink: closing link with %pM\n", sta->sta.addr);
-        spin_lock_bh(&sta->lock);
-        sta->reason = cpu_to_le16(MESH_LINK_CANCELLED);
-        reason = sta->reason;
-
-        if (sta->plink_state == PLINK_LISTEN ||
-            sta->plink_state == PLINK_BLOCKED) {
-                mesh_plink_fsm_restart(sta);
-                spin_unlock_bh(&sta->lock);
-                return 0;
-        } else if (sta->plink_state == PLINK_ESTAB) {
-                __mesh_plink_deactivate(sta);
-                /* The timer should not be running */
-                mod_plink_timer(sta, dot11MeshHoldingTimeout(sdata));
-        } else if (!mod_plink_timer(sta, dot11MeshHoldingTimeout(sdata)))
-                sta->ignore_plink_timer = true;
-
-        sta->plink_state = PLINK_HOLDING;
-        llid = sta->llid;
-        plid = sta->plid;
-        spin_unlock_bh(&sta->lock);
-        mesh_plink_frame_tx(sta->sdata, PLINK_CLOSE, sta->sta.addr, llid,
-                            plid, reason);
-        return 0;
-}
 
 void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_mgmt *mgmt,
                          size_t len, struct ieee80211_rx_status *rx_status)
@@ -477,7 +447,7 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                 spin_lock_bh(&sta->lock);
         } else if (!sta) {
                 /* ftype == PLINK_OPEN */
-                u64 rates;
+                u32 rates;
                 if (!mesh_plink_free_count(sdata)) {
                         mpl_dbg("Mesh plink error: no more free plinks\n");
                         rcu_read_unlock();
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 2b890af01ba4..7ecda9d59d8a 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -1,6 +1,6 @@
 /*
  * BSS client mode implementation
- * Copyright 2003, Jouni Malinen <jkmaline@cc.hut.fi>
+ * Copyright 2003-2008, Jouni Malinen <j@w1.fi>
  * Copyright 2004, Instant802 Networks, Inc.
  * Copyright 2005, Devicescape Software, Inc.
  * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
@@ -15,11 +15,8 @@
 #include <linux/if_ether.h>
 #include <linux/skbuff.h>
 #include <linux/if_arp.h>
-#include <linux/wireless.h>
-#include <linux/random.h>
 #include <linux/etherdevice.h>
 #include <linux/rtnetlink.h>
-#include <net/iw_handler.h>
 #include <net/mac80211.h>
 #include <asm/unaligned.h>
 
@@ -33,17 +30,8 @@
 #define IEEE80211_ASSOC_TIMEOUT (HZ / 5)
 #define IEEE80211_ASSOC_MAX_TRIES 3
 #define IEEE80211_MONITORING_INTERVAL (2 * HZ)
-#define IEEE80211_PROBE_INTERVAL (60 * HZ)
+#define IEEE80211_PROBE_IDLE_TIME (60 * HZ)
 #define IEEE80211_RETRY_AUTH_INTERVAL (1 * HZ)
-#define IEEE80211_SCAN_INTERVAL (2 * HZ)
-#define IEEE80211_SCAN_INTERVAL_SLOW (15 * HZ)
-#define IEEE80211_IBSS_JOIN_TIMEOUT (7 * HZ)
-
-#define IEEE80211_IBSS_MERGE_INTERVAL (30 * HZ)
-#define IEEE80211_IBSS_INACTIVITY_LIMIT (60 * HZ)
-
-#define IEEE80211_IBSS_MAX_STA_ENTRIES 128
-
 
 /* utils */
 static int ecw2cw(int ecw)
@@ -55,10 +43,10 @@ static u8 *ieee80211_bss_get_ie(struct ieee80211_bss *bss, u8 ie)
 {
         u8 *end, *pos;
 
-        pos = bss->ies;
+        pos = bss->cbss.information_elements;
         if (pos == NULL)
                 return NULL;
-        end = pos + bss->ies_len;
+        end = pos + bss->cbss.len_information_elements;
 
         while (pos + 1 < end) {
                 if (pos + 2 + pos[1] > end)
@@ -73,7 +61,7 @@ static u8 *ieee80211_bss_get_ie(struct ieee80211_bss *bss, u8 ie)
 
 static int ieee80211_compatible_rates(struct ieee80211_bss *bss,
                                       struct ieee80211_supported_band *sband,
-                                      u64 *rates)
+                                      u32 *rates)
 {
         int i, j, count;
         *rates = 0;
@@ -92,146 +80,11 @@ static int ieee80211_compatible_rates(struct ieee80211_bss *bss,
         return count;
 }
 
-/* also used by mesh code */
-u64 ieee80211_sta_get_rates(struct ieee80211_local *local,
-                            struct ieee802_11_elems *elems,
-                            enum ieee80211_band band)
-{
-        struct ieee80211_supported_band *sband;
-        struct ieee80211_rate *bitrates;
-        size_t num_rates;
-        u64 supp_rates;
-        int i, j;
-        sband = local->hw.wiphy->bands[band];
-
-        if (!sband) {
-                WARN_ON(1);
-                sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
-        }
-
-        bitrates = sband->bitrates;
-        num_rates = sband->n_bitrates;
-        supp_rates = 0;
-        for (i = 0; i < elems->supp_rates_len +
-                     elems->ext_supp_rates_len; i++) {
-                u8 rate = 0;
-                int own_rate;
-                if (i < elems->supp_rates_len)
-                        rate = elems->supp_rates[i];
-                else if (elems->ext_supp_rates)
-                        rate = elems->ext_supp_rates
-                                [i - elems->supp_rates_len];
-                own_rate = 5 * (rate & 0x7f);
-                for (j = 0; j < num_rates; j++)
-                        if (bitrates[j].bitrate == own_rate)
-                                supp_rates |= BIT(j);
-        }
-        return supp_rates;
-}
-
 /* frame sending functions */
 
-/* also used by scanning code */
-void ieee80211_send_probe_req(struct ieee80211_sub_if_data *sdata, u8 *dst,
-                              u8 *ssid, size_t ssid_len)
-{
-        struct ieee80211_local *local = sdata->local;
-        struct ieee80211_supported_band *sband;
-        struct sk_buff *skb;
-        struct ieee80211_mgmt *mgmt;
-        u8 *pos, *supp_rates, *esupp_rates = NULL;
-        int i;
-
-        skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*mgmt) + 200);
-        if (!skb) {
-                printk(KERN_DEBUG "%s: failed to allocate buffer for probe "
-                       "request\n", sdata->dev->name);
-                return;
-        }
-        skb_reserve(skb, local->hw.extra_tx_headroom);
-
-        mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
-        memset(mgmt, 0, 24);
-        mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
-                                          IEEE80211_STYPE_PROBE_REQ);
-        memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
-        if (dst) {
-                memcpy(mgmt->da, dst, ETH_ALEN);
-                memcpy(mgmt->bssid, dst, ETH_ALEN);
-        } else {
-                memset(mgmt->da, 0xff, ETH_ALEN);
-                memset(mgmt->bssid, 0xff, ETH_ALEN);
-        }
-        pos = skb_put(skb, 2 + ssid_len);
-        *pos++ = WLAN_EID_SSID;
-        *pos++ = ssid_len;
-        memcpy(pos, ssid, ssid_len);
-
-        supp_rates = skb_put(skb, 2);
-        supp_rates[0] = WLAN_EID_SUPP_RATES;
-        supp_rates[1] = 0;
-        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
-
-        for (i = 0; i < sband->n_bitrates; i++) {
-                struct ieee80211_rate *rate = &sband->bitrates[i];
-                if (esupp_rates) {
-                        pos = skb_put(skb, 1);
-                        esupp_rates[1]++;
-                } else if (supp_rates[1] == 8) {
-                        esupp_rates = skb_put(skb, 3);
-                        esupp_rates[0] = WLAN_EID_EXT_SUPP_RATES;
-                        esupp_rates[1] = 1;
-                        pos = &esupp_rates[2];
-                } else {
-                        pos = skb_put(skb, 1);
-                        supp_rates[1]++;
-                }
-                *pos = rate->bitrate / 5;
-        }
-
-        ieee80211_tx_skb(sdata, skb, 0);
-}
-
-static void ieee80211_send_auth(struct ieee80211_sub_if_data *sdata,
-                                struct ieee80211_if_sta *ifsta,
-                                int transaction, u8 *extra, size_t extra_len,
-                                int encrypt)
-{
-        struct ieee80211_local *local = sdata->local;
-        struct sk_buff *skb;
-        struct ieee80211_mgmt *mgmt;
-
-        skb = dev_alloc_skb(local->hw.extra_tx_headroom +
-                            sizeof(*mgmt) + 6 + extra_len);
-        if (!skb) {
-                printk(KERN_DEBUG "%s: failed to allocate buffer for auth "
-                       "frame\n", sdata->dev->name);
-                return;
-        }
-        skb_reserve(skb, local->hw.extra_tx_headroom);
-
-        mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24 + 6);
-        memset(mgmt, 0, 24 + 6);
-        mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
-                                          IEEE80211_STYPE_AUTH);
-        if (encrypt)
-                mgmt->frame_control |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
-        memcpy(mgmt->da, ifsta->bssid, ETH_ALEN);
-        memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
-        memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
-        mgmt->u.auth.auth_alg = cpu_to_le16(ifsta->auth_alg);
-        mgmt->u.auth.auth_transaction = cpu_to_le16(transaction);
-        ifsta->auth_transaction = transaction + 1;
-        mgmt->u.auth.status_code = cpu_to_le16(0);
-        if (extra)
-                memcpy(skb_put(skb, extra_len), extra, extra_len);
-
-        ieee80211_tx_skb(sdata, skb, encrypt);
-}
-
-static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata,
-                                 struct ieee80211_if_sta *ifsta)
+static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
 {
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_local *local = sdata->local;
         struct sk_buff *skb;
         struct ieee80211_mgmt *mgmt;
@@ -241,11 +94,11 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_bss *bss;
         int wmm = 0;
         struct ieee80211_supported_band *sband;
-        u64 rates = 0;
+        u32 rates = 0;
 
         skb = dev_alloc_skb(local->hw.extra_tx_headroom +
-                            sizeof(*mgmt) + 200 + ifsta->extra_ie_len +
-                            ifsta->ssid_len);
+                            sizeof(*mgmt) + 200 + ifmgd->extra_ie_len +
+                            ifmgd->ssid_len);
         if (!skb) {
                 printk(KERN_DEBUG "%s: failed to allocate buffer for assoc "
                        "frame\n", sdata->dev->name);
@@ -255,7 +108,7 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata,
 
         sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
 
-        capab = ifsta->capab;
+        capab = ifmgd->capab;
 
         if (local->hw.conf.channel->band == IEEE80211_BAND_2GHZ) {
                 if (!(local->hw.flags & IEEE80211_HW_2GHZ_SHORT_SLOT_INCAPABLE))
@@ -264,11 +117,11 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata,
                         capab |= WLAN_CAPABILITY_SHORT_PREAMBLE;
         }
 
-        bss = ieee80211_rx_bss_get(local, ifsta->bssid,
+        bss = ieee80211_rx_bss_get(local, ifmgd->bssid,
                                    local->hw.conf.channel->center_freq,
-                                   ifsta->ssid, ifsta->ssid_len);
+                                   ifmgd->ssid, ifmgd->ssid_len);
         if (bss) {
-                if (bss->capability & WLAN_CAPABILITY_PRIVACY)
+                if (bss->cbss.capability & WLAN_CAPABILITY_PRIVACY)
                         capab |= WLAN_CAPABILITY_PRIVACY;
                 if (bss->wmm_used)
                         wmm = 1;
@@ -279,7 +132,7 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata,
                  * b-only mode) */
                 rates_len = ieee80211_compatible_rates(bss, sband, &rates);
 
-                if ((bss->capability & WLAN_CAPABILITY_SPECTRUM_MGMT) &&
+                if ((bss->cbss.capability & WLAN_CAPABILITY_SPECTRUM_MGMT) &&
                     (local->hw.flags & IEEE80211_HW_SPECTRUM_MGMT))
                         capab |= WLAN_CAPABILITY_SPECTRUM_MGMT;
 
@@ -291,18 +144,18 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata,
 
         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
         memset(mgmt, 0, 24);
-        memcpy(mgmt->da, ifsta->bssid, ETH_ALEN);
+        memcpy(mgmt->da, ifmgd->bssid, ETH_ALEN);
         memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
-        memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
+        memcpy(mgmt->bssid, ifmgd->bssid, ETH_ALEN);
 
-        if (ifsta->flags & IEEE80211_STA_PREV_BSSID_SET) {
+        if (ifmgd->flags & IEEE80211_STA_PREV_BSSID_SET) {
                 skb_put(skb, 10);
                 mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
                                                   IEEE80211_STYPE_REASSOC_REQ);
                 mgmt->u.reassoc_req.capab_info = cpu_to_le16(capab);
                 mgmt->u.reassoc_req.listen_interval =
                                 cpu_to_le16(local->hw.conf.listen_interval);
-                memcpy(mgmt->u.reassoc_req.current_ap, ifsta->prev_bssid,
+                memcpy(mgmt->u.reassoc_req.current_ap, ifmgd->prev_bssid,
                        ETH_ALEN);
         } else {
                 skb_put(skb, 4);
@@ -314,10 +167,10 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata,
         }
 
         /* SSID */
-        ies = pos = skb_put(skb, 2 + ifsta->ssid_len);
+        ies = pos = skb_put(skb, 2 + ifmgd->ssid_len);
         *pos++ = WLAN_EID_SSID;
-        *pos++ = ifsta->ssid_len;
-        memcpy(pos, ifsta->ssid, ifsta->ssid_len);
+        *pos++ = ifmgd->ssid_len;
+        memcpy(pos, ifmgd->ssid, ifmgd->ssid_len);
 
         /* add all rates which were marked to be used above */
         supp_rates_len = rates_len;
@@ -372,12 +225,12 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata,
                 }
         }
 
-        if (ifsta->extra_ie) {
-                pos = skb_put(skb, ifsta->extra_ie_len);
-                memcpy(pos, ifsta->extra_ie, ifsta->extra_ie_len);
+        if (ifmgd->extra_ie) {
+                pos = skb_put(skb, ifmgd->extra_ie_len);
+                memcpy(pos, ifmgd->extra_ie, ifmgd->extra_ie_len);
         }
 
-        if (wmm && (ifsta->flags & IEEE80211_STA_WMM_ENABLED)) {
+        if (wmm && (ifmgd->flags & IEEE80211_STA_WMM_ENABLED)) {
                 pos = skb_put(skb, 9);
                 *pos++ = WLAN_EID_VENDOR_SPECIFIC;
                 *pos++ = 7; /* len */
@@ -391,10 +244,17 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata,
         }
 
         /* wmm support is a must to HT */
-        if (wmm && (ifsta->flags & IEEE80211_STA_WMM_ENABLED) &&
+        /*
+         * IEEE802.11n does not allow TKIP/WEP as pairwise
+         * ciphers in HT mode. We still associate in non-ht
+         * mode (11a/b/g) if any one of these ciphers is
+         * configured as pairwise.
+         */
+        if (wmm && (ifmgd->flags & IEEE80211_STA_WMM_ENABLED) &&
             sband->ht_cap.ht_supported &&
             (ht_ie = ieee80211_bss_get_ie(bss, WLAN_EID_HT_INFORMATION)) &&
-            ht_ie[1] >= sizeof(struct ieee80211_ht_info)) {
+            ht_ie[1] >= sizeof(struct ieee80211_ht_info) &&
+            (!(ifmgd->flags & IEEE80211_STA_TKIP_WEP_USED))) {
                 struct ieee80211_ht_info *ht_info =
                         (struct ieee80211_ht_info *)(ht_ie + 2);
                 u16 cap = sband->ht_cap.cap;
@@ -429,11 +289,11 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata,
                 memcpy(pos, &sband->ht_cap.mcs, sizeof(sband->ht_cap.mcs));
         }
 
-        kfree(ifsta->assocreq_ies);
-        ifsta->assocreq_ies_len = (skb->data + skb->len) - ies;
-        ifsta->assocreq_ies = kmalloc(ifsta->assocreq_ies_len, GFP_KERNEL);
-        if (ifsta->assocreq_ies)
-                memcpy(ifsta->assocreq_ies, ies, ifsta->assocreq_ies_len);
+        kfree(ifmgd->assocreq_ies);
+        ifmgd->assocreq_ies_len = (skb->data + skb->len) - ies;
+        ifmgd->assocreq_ies = kmalloc(ifmgd->assocreq_ies_len, GFP_KERNEL);
+        if (ifmgd->assocreq_ies)
+                memcpy(ifmgd->assocreq_ies, ies, ifmgd->assocreq_ies_len);
 
         ieee80211_tx_skb(sdata, skb, 0);
 }
@@ -443,7 +303,7 @@ static void ieee80211_send_deauth_disassoc(struct ieee80211_sub_if_data *sdata,
                                            u16 stype, u16 reason)
 {
         struct ieee80211_local *local = sdata->local;
-        struct ieee80211_if_sta *ifsta = &sdata->u.sta;
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct sk_buff *skb;
         struct ieee80211_mgmt *mgmt;
 
@@ -457,40 +317,51 @@ static void ieee80211_send_deauth_disassoc(struct ieee80211_sub_if_data *sdata,
 
         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
         memset(mgmt, 0, 24);
-        memcpy(mgmt->da, ifsta->bssid, ETH_ALEN);
+        memcpy(mgmt->da, ifmgd->bssid, ETH_ALEN);
         memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
-        memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
+        memcpy(mgmt->bssid, ifmgd->bssid, ETH_ALEN);
         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT | stype);
         skb_put(skb, 2);
         /* u.deauth.reason_code == u.disassoc.reason_code */
         mgmt->u.deauth.reason_code = cpu_to_le16(reason);
 
-        ieee80211_tx_skb(sdata, skb, 0);
+        ieee80211_tx_skb(sdata, skb, ifmgd->flags & IEEE80211_STA_MFP_ENABLED);
 }
 
-/* MLME */
-static void ieee80211_sta_def_wmm_params(struct ieee80211_sub_if_data *sdata,
-                                         struct ieee80211_bss *bss)
+void ieee80211_send_pspoll(struct ieee80211_local *local,
+                           struct ieee80211_sub_if_data *sdata)
 {
-        struct ieee80211_local *local = sdata->local;
-        int i, have_higher_than_11mbit = 0;
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+        struct ieee80211_pspoll *pspoll;
+        struct sk_buff *skb;
+        u16 fc;
 
-        /* cf. IEEE 802.11 9.2.12 */
-        for (i = 0; i < bss->supp_rates_len; i++)
-                if ((bss->supp_rates[i] & 0x7f) * 5 > 110)
-                        have_higher_than_11mbit = 1;
+        skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*pspoll));
+        if (!skb) {
+                printk(KERN_DEBUG "%s: failed to allocate buffer for "
+                       "pspoll frame\n", sdata->dev->name);
+                return;
+        }
+        skb_reserve(skb, local->hw.extra_tx_headroom);
 
-        if (local->hw.conf.channel->band == IEEE80211_BAND_2GHZ &&
-            have_higher_than_11mbit)
-                sdata->flags |= IEEE80211_SDATA_OPERATING_GMODE;
-        else
-                sdata->flags &= ~IEEE80211_SDATA_OPERATING_GMODE;
+        pspoll = (struct ieee80211_pspoll *) skb_put(skb, sizeof(*pspoll));
+        memset(pspoll, 0, sizeof(*pspoll));
+        fc = IEEE80211_FTYPE_CTL | IEEE80211_STYPE_PSPOLL | IEEE80211_FCTL_PM;
+        pspoll->frame_control = cpu_to_le16(fc);
+        pspoll->aid = cpu_to_le16(ifmgd->aid);
+
+        /* aid in PS-Poll has its two MSBs each set to 1 */
+        pspoll->aid |= cpu_to_le16(1 << 15 | 1 << 14);
 
-        ieee80211_set_wmm_default(sdata);
+        memcpy(pspoll->bssid, ifmgd->bssid, ETH_ALEN);
+        memcpy(pspoll->ta, sdata->dev->dev_addr, ETH_ALEN);
+
+        ieee80211_tx_skb(sdata, skb, 0);
 }
 
+/* MLME */
 static void ieee80211_sta_wmm_params(struct ieee80211_local *local,
-                                     struct ieee80211_if_sta *ifsta,
+                                     struct ieee80211_if_managed *ifmgd,
                                      u8 *wmm_param, size_t wmm_param_len)
 {
         struct ieee80211_tx_queue_params params;
@@ -498,7 +369,7 @@ static void ieee80211_sta_wmm_params(struct ieee80211_local *local,
         int count;
         u8 *pos;
 
-        if (!(ifsta->flags & IEEE80211_STA_WMM_ENABLED))
+        if (!(ifmgd->flags & IEEE80211_STA_WMM_ENABLED))
                 return;
 
         if (!wmm_param)
@@ -507,18 +378,15 @@ static void ieee80211_sta_wmm_params(struct ieee80211_local *local,
         if (wmm_param_len < 8 || wmm_param[5] /* version */ != 1)
                 return;
         count = wmm_param[6] & 0x0f;
-        if (count == ifsta->wmm_last_param_set)
+        if (count == ifmgd->wmm_last_param_set)
                 return;
-        ifsta->wmm_last_param_set = count;
+        ifmgd->wmm_last_param_set = count;
 
         pos = wmm_param + 8;
         left = wmm_param_len - 8;
 
         memset(&params, 0, sizeof(params));
 
-        if (!local->ops->conf_tx)
-                return;
-
         local->wmm_acm = 0;
         for (; left >= 4; left -= 4, pos += 4) {
                 int aci = (pos[0] >> 5) & 0x03;
@@ -526,26 +394,26 @@ static void ieee80211_sta_wmm_params(struct ieee80211_local *local,
                 int queue;
 
                 switch (aci) {
-                case 1:
+                case 1: /* AC_BK */
                         queue = 3;
                         if (acm)
-                                local->wmm_acm |= BIT(0) | BIT(3);
+                                local->wmm_acm |= BIT(1) | BIT(2); /* BK/- */
                         break;
-                case 2:
+                case 2: /* AC_VI */
                         queue = 1;
                         if (acm)
-                                local->wmm_acm |= BIT(4) | BIT(5);
+                                local->wmm_acm |= BIT(4) | BIT(5); /* CL/VI */
                         break;
-                case 3:
+                case 3: /* AC_VO */
                         queue = 0;
                         if (acm)
-                                local->wmm_acm |= BIT(6) | BIT(7);
+                                local->wmm_acm |= BIT(6) | BIT(7); /* VO/NC */
                         break;
-                case 0:
+                case 0: /* AC_BE */
                 default:
                         queue = 2;
                         if (acm)
-                                local->wmm_acm |= BIT(1) | BIT(2);
+                                local->wmm_acm |= BIT(0) | BIT(3); /* BE/EE */
                         break;
                 }
 
@@ -559,21 +427,41 @@ static void ieee80211_sta_wmm_params(struct ieee80211_local *local,
                        local->mdev->name, queue, aci, acm, params.aifs, params.cw_min,
                        params.cw_max, params.txop);
 #endif
-                /* TODO: handle ACM (block TX, fallback to next lowest allowed
-                 * AC for now) */
-                if (local->ops->conf_tx(local_to_hw(local), queue, &params)) {
+                if (local->ops->conf_tx &&
+                    local->ops->conf_tx(local_to_hw(local), queue, &params)) {
                         printk(KERN_DEBUG "%s: failed to set TX queue "
                                "parameters for queue %d\n", local->mdev->name, queue);
                 }
         }
 }
 
+static bool ieee80211_check_tim(struct ieee802_11_elems *elems, u16 aid)
+{
+        u8 mask;
+        u8 index, indexn1, indexn2;
+        struct ieee80211_tim_ie *tim = (struct ieee80211_tim_ie *) elems->tim;
+
+        aid &= 0x3fff;
+        index = aid / 8;
+        mask  = 1 << (aid & 7);
+
+        indexn1 = tim->bitmap_ctrl & 0xfe;
+        indexn2 = elems->tim_len + indexn1 - 4;
+
+        if (index < indexn1 || index > indexn2)
+                return false;
+
+        index -= indexn1;
+
+        return !!(tim->virtual_map[index] & mask);
+}
+
 static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,
                                            u16 capab, bool erp_valid, u8 erp)
 {
         struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
-        struct ieee80211_if_sta *ifsta = &sdata->u.sta;
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 #endif
         u32 changed = 0;
         bool use_protection;
@@ -596,7 +484,7 @@ static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,
                         printk(KERN_DEBUG "%s: CTS protection %s (BSSID=%pM)\n",
                                sdata->dev->name,
                                use_protection ? "enabled" : "disabled",
-                               ifsta->bssid);
+                               ifmgd->bssid);
                 }
 #endif
                 bss_conf->use_cts_prot = use_protection;
@@ -610,7 +498,7 @@ static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,
                                " (BSSID=%pM)\n",
                                sdata->dev->name,
                                use_short_preamble ? "short" : "long",
-                               ifsta->bssid);
+                               ifmgd->bssid);
                 }
 #endif
                 bss_conf->use_short_preamble = use_short_preamble;
@@ -624,7 +512,7 @@ static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,
                                " (BSSID=%pM)\n",
                                sdata->dev->name,
                                use_short_slot ? "short" : "long",
-                               ifsta->bssid);
+                               ifmgd->bssid);
                 }
 #endif
                 bss_conf->use_short_slot = use_short_slot;
@@ -634,57 +522,57 @@ static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,
         return changed;
 }
 
-static void ieee80211_sta_send_apinfo(struct ieee80211_sub_if_data *sdata,
-                                        struct ieee80211_if_sta *ifsta)
+static void ieee80211_sta_send_apinfo(struct ieee80211_sub_if_data *sdata)
 {
         union iwreq_data wrqu;
+
         memset(&wrqu, 0, sizeof(wrqu));
-        if (ifsta->flags & IEEE80211_STA_ASSOCIATED)
-                memcpy(wrqu.ap_addr.sa_data, sdata->u.sta.bssid, ETH_ALEN);
+        if (sdata->u.mgd.flags & IEEE80211_STA_ASSOCIATED)
+                memcpy(wrqu.ap_addr.sa_data, sdata->u.mgd.bssid, ETH_ALEN);
         wrqu.ap_addr.sa_family = ARPHRD_ETHER;
         wireless_send_event(sdata->dev, SIOCGIWAP, &wrqu, NULL);
 }
 
-static void ieee80211_sta_send_associnfo(struct ieee80211_sub_if_data *sdata,
-                                         struct ieee80211_if_sta *ifsta)
+static void ieee80211_sta_send_associnfo(struct ieee80211_sub_if_data *sdata)
 {
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         char *buf;
         size_t len;
         int i;
         union iwreq_data wrqu;
 
-        if (!ifsta->assocreq_ies && !ifsta->assocresp_ies)
+        if (!ifmgd->assocreq_ies && !ifmgd->assocresp_ies)
                 return;
 
-        buf = kmalloc(50 + 2 * (ifsta->assocreq_ies_len +
-                                ifsta->assocresp_ies_len), GFP_KERNEL);
+        buf = kmalloc(50 + 2 * (ifmgd->assocreq_ies_len +
+                                ifmgd->assocresp_ies_len), GFP_KERNEL);
         if (!buf)
                 return;
 
         len = sprintf(buf, "ASSOCINFO(");
-        if (ifsta->assocreq_ies) {
+        if (ifmgd->assocreq_ies) {
                 len += sprintf(buf + len, "ReqIEs=");
-                for (i = 0; i < ifsta->assocreq_ies_len; i++) {
+                for (i = 0; i < ifmgd->assocreq_ies_len; i++) {
                         len += sprintf(buf + len, "%02x",
-                                       ifsta->assocreq_ies[i]);
+                                       ifmgd->assocreq_ies[i]);
                 }
         }
-        if (ifsta->assocresp_ies) {
-                if (ifsta->assocreq_ies)
+        if (ifmgd->assocresp_ies) {
+                if (ifmgd->assocreq_ies)
                         len += sprintf(buf + len, " ");
                 len += sprintf(buf + len, "RespIEs=");
-                for (i = 0; i < ifsta->assocresp_ies_len; i++) {
+                for (i = 0; i < ifmgd->assocresp_ies_len; i++) {
                         len += sprintf(buf + len, "%02x",
-                                       ifsta->assocresp_ies[i]);
+                                       ifmgd->assocresp_ies[i]);
                 }
         }
         len += sprintf(buf + len, ")");
 
         if (len > IW_CUSTOM_MAX) {
                 len = sprintf(buf, "ASSOCRESPIE=");
-                for (i = 0; i < ifsta->assocresp_ies_len; i++) {
+                for (i = 0; i < ifmgd->assocresp_ies_len; i++) {
                         len += sprintf(buf + len, "%02x",
-                                       ifsta->assocresp_ies[i]);
+                                       ifmgd->assocresp_ies[i]);
                 }
         }
 
@@ -699,40 +587,39 @@ static void ieee80211_sta_send_associnfo(struct ieee80211_sub_if_data *sdata,
 
 
 static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
-                                     struct ieee80211_if_sta *ifsta,
                                      u32 bss_info_changed)
 {
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_conf *conf = &local_to_hw(local)->conf;
 
         struct ieee80211_bss *bss;
 
         bss_info_changed |= BSS_CHANGED_ASSOC;
-        ifsta->flags |= IEEE80211_STA_ASSOCIATED;
-
-        if (sdata->vif.type != NL80211_IFTYPE_STATION)
-                return;
+        ifmgd->flags |= IEEE80211_STA_ASSOCIATED;
 
-        bss = ieee80211_rx_bss_get(local, ifsta->bssid,
+        bss = ieee80211_rx_bss_get(local, ifmgd->bssid,
                                    conf->channel->center_freq,
-                                   ifsta->ssid, ifsta->ssid_len);
+                                   ifmgd->ssid, ifmgd->ssid_len);
         if (bss) {
                 /* set timing information */
-                sdata->vif.bss_conf.beacon_int = bss->beacon_int;
-                sdata->vif.bss_conf.timestamp = bss->timestamp;
+                sdata->vif.bss_conf.beacon_int = bss->cbss.beacon_interval;
+                sdata->vif.bss_conf.timestamp = bss->cbss.tsf;
                 sdata->vif.bss_conf.dtim_period = bss->dtim_period;
 
                 bss_info_changed |= ieee80211_handle_bss_capability(sdata,
-                        bss->capability, bss->has_erp_value, bss->erp_value);
+                        bss->cbss.capability, bss->has_erp_value, bss->erp_value);
+
+                cfg80211_hold_bss(&bss->cbss);
 
                 ieee80211_rx_bss_put(local, bss);
         }
 
-        ifsta->flags |= IEEE80211_STA_PREV_BSSID_SET;
-        memcpy(ifsta->prev_bssid, sdata->u.sta.bssid, ETH_ALEN);
-        ieee80211_sta_send_associnfo(sdata, ifsta);
+        ifmgd->flags |= IEEE80211_STA_PREV_BSSID_SET;
+        memcpy(ifmgd->prev_bssid, sdata->u.mgd.bssid, ETH_ALEN);
+        ieee80211_sta_send_associnfo(sdata);
 
-        ifsta->last_probe = jiffies;
+        ifmgd->last_probe = jiffies;
         ieee80211_led_assoc(local, 1);
 
         sdata->vif.bss_conf.assoc = 1;
@@ -745,72 +632,115 @@ static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
         ieee80211_bss_info_change_notify(sdata, bss_info_changed);
 
         if (local->powersave) {
-                if (local->dynamic_ps_timeout > 0)
+                if (!(local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_PS) &&
+                    local->hw.conf.dynamic_ps_timeout > 0) {
                         mod_timer(&local->dynamic_ps_timer, jiffies +
-                                  msecs_to_jiffies(local->dynamic_ps_timeout));
-                else {
+                                  msecs_to_jiffies(
+                                        local->hw.conf.dynamic_ps_timeout));
+                } else {
+                        if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK)
+                                ieee80211_send_nullfunc(local, sdata, 1);
                         conf->flags |= IEEE80211_CONF_PS;
-                        ieee80211_hw_config(local,
-                                            IEEE80211_CONF_CHANGE_PS);
+                        ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
                 }
         }
 
         netif_tx_start_all_queues(sdata->dev);
         netif_carrier_on(sdata->dev);
 
-        ieee80211_sta_send_apinfo(sdata, ifsta);
+        ieee80211_sta_send_apinfo(sdata);
 }
 
-static void ieee80211_direct_probe(struct ieee80211_sub_if_data *sdata,
-                                   struct ieee80211_if_sta *ifsta)
+static void ieee80211_direct_probe(struct ieee80211_sub_if_data *sdata)
 {
-        ifsta->direct_probe_tries++;
-        if (ifsta->direct_probe_tries > IEEE80211_AUTH_MAX_TRIES) {
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+        struct ieee80211_local *local = sdata->local;
+
+        ifmgd->direct_probe_tries++;
+        if (ifmgd->direct_probe_tries > IEEE80211_AUTH_MAX_TRIES) {
                 printk(KERN_DEBUG "%s: direct probe to AP %pM timed out\n",
-                       sdata->dev->name, ifsta->bssid);
-                ifsta->state = IEEE80211_STA_MLME_DISABLED;
-                ieee80211_sta_send_apinfo(sdata, ifsta);
+                       sdata->dev->name, ifmgd->bssid);
+                ifmgd->state = IEEE80211_STA_MLME_DISABLED;
+                ieee80211_sta_send_apinfo(sdata);
+
+                /*
+                 * Most likely AP is not in the range so remove the
+                 * bss information associated to the AP
+                 */
+                ieee80211_rx_bss_remove(sdata, ifmgd->bssid,
+                                sdata->local->hw.conf.channel->center_freq,
+                                ifmgd->ssid, ifmgd->ssid_len);
+
+                /*
+                 * We might have a pending scan which had no chance to run yet
+                 * due to state == IEEE80211_STA_MLME_DIRECT_PROBE.
+                 * Hence, queue the STAs work again
+                 */
+                queue_work(local->hw.workqueue, &ifmgd->work);
                 return;
         }
 
         printk(KERN_DEBUG "%s: direct probe to AP %pM try %d\n",
-                        sdata->dev->name, ifsta->bssid,
-                        ifsta->direct_probe_tries);
+                        sdata->dev->name, ifmgd->bssid,
+                        ifmgd->direct_probe_tries);
 
-        ifsta->state = IEEE80211_STA_MLME_DIRECT_PROBE;
+        ifmgd->state = IEEE80211_STA_MLME_DIRECT_PROBE;
 
-        set_bit(IEEE80211_STA_REQ_DIRECT_PROBE, &ifsta->request);
+        set_bit(IEEE80211_STA_REQ_DIRECT_PROBE, &ifmgd->request);
 
         /* Direct probe is sent to broadcast address as some APs
          * will not answer to direct packet in unassociated state.
          */
         ieee80211_send_probe_req(sdata, NULL,
-                                 ifsta->ssid, ifsta->ssid_len);
+                                 ifmgd->ssid, ifmgd->ssid_len, NULL, 0);
 
-        mod_timer(&ifsta->timer, jiffies + IEEE80211_AUTH_TIMEOUT);
+        mod_timer(&ifmgd->timer, jiffies + IEEE80211_AUTH_TIMEOUT);
 }
 
 
-static void ieee80211_authenticate(struct ieee80211_sub_if_data *sdata,
-                                   struct ieee80211_if_sta *ifsta)
+static void ieee80211_authenticate(struct ieee80211_sub_if_data *sdata)
 {
-        ifsta->auth_tries++;
-        if (ifsta->auth_tries > IEEE80211_AUTH_MAX_TRIES) {
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+        struct ieee80211_local *local = sdata->local;
+        u8 *ies;
+        size_t ies_len;
+
+        ifmgd->auth_tries++;
+        if (ifmgd->auth_tries > IEEE80211_AUTH_MAX_TRIES) {
                 printk(KERN_DEBUG "%s: authentication with AP %pM"
                        " timed out\n",
-                       sdata->dev->name, ifsta->bssid);
-                ifsta->state = IEEE80211_STA_MLME_DISABLED;
-                ieee80211_sta_send_apinfo(sdata, ifsta);
+                       sdata->dev->name, ifmgd->bssid);
+                ifmgd->state = IEEE80211_STA_MLME_DISABLED;
+                ieee80211_sta_send_apinfo(sdata);
+                ieee80211_rx_bss_remove(sdata, ifmgd->bssid,
+                                sdata->local->hw.conf.channel->center_freq,
+                                ifmgd->ssid, ifmgd->ssid_len);
+
+                /*
+                 * We might have a pending scan which had no chance to run yet
+                 * due to state == IEEE80211_STA_MLME_AUTHENTICATE.
+                 * Hence, queue the STAs work again
+                 */
+                queue_work(local->hw.workqueue, &ifmgd->work);
                 return;
         }
 
-        ifsta->state = IEEE80211_STA_MLME_AUTHENTICATE;
+        ifmgd->state = IEEE80211_STA_MLME_AUTHENTICATE;
         printk(KERN_DEBUG "%s: authenticate with AP %pM\n",
-               sdata->dev->name, ifsta->bssid);
+               sdata->dev->name, ifmgd->bssid);
 
-        ieee80211_send_auth(sdata, ifsta, 1, NULL, 0, 0);
+        if (ifmgd->flags & IEEE80211_STA_EXT_SME) {
+                ies = ifmgd->sme_auth_ie;
+                ies_len = ifmgd->sme_auth_ie_len;
+        } else {
+                ies = NULL;
+                ies_len = 0;
+        }
+        ieee80211_send_auth(sdata, 1, ifmgd->auth_alg, ies, ies_len,
+                            ifmgd->bssid, 0);
+        ifmgd->auth_transaction = 2;
 
-        mod_timer(&ifsta->timer, jiffies + IEEE80211_AUTH_TIMEOUT);
+        mod_timer(&ifmgd->timer, jiffies + IEEE80211_AUTH_TIMEOUT);
 }
 
 /*
@@ -818,32 +748,44 @@ static void ieee80211_authenticate(struct ieee80211_sub_if_data *sdata,
  * if self disconnected or a reason code from the AP.
  */
 static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
-                                   struct ieee80211_if_sta *ifsta, bool deauth,
-                                   bool self_disconnected, u16 reason)
+                                   bool deauth, bool self_disconnected,
+                                   u16 reason)
 {
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_local *local = sdata->local;
+        struct ieee80211_conf *conf = &local_to_hw(local)->conf;
+        struct ieee80211_bss *bss;
         struct sta_info *sta;
         u32 changed = 0, config_changed = 0;
 
         rcu_read_lock();
 
-        sta = sta_info_get(local, ifsta->bssid);
+        sta = sta_info_get(local, ifmgd->bssid);
         if (!sta) {
                 rcu_read_unlock();
                 return;
         }
 
         if (deauth) {
-                ifsta->direct_probe_tries = 0;
-                ifsta->auth_tries = 0;
+                ifmgd->direct_probe_tries = 0;
+                ifmgd->auth_tries = 0;
         }
-        ifsta->assoc_scan_tries = 0;
-        ifsta->assoc_tries = 0;
+        ifmgd->assoc_scan_tries = 0;
+        ifmgd->assoc_tries = 0;
 
         netif_tx_stop_all_queues(sdata->dev);
         netif_carrier_off(sdata->dev);
 
-        ieee80211_sta_tear_down_BA_sessions(sdata, sta->sta.addr);
+        ieee80211_sta_tear_down_BA_sessions(sta);
+
+        bss = ieee80211_rx_bss_get(local, ifmgd->bssid,
+                                   conf->channel->center_freq,
+                                   ifmgd->ssid, ifmgd->ssid_len);
+
+        if (bss) {
+                cfg80211_unhold_bss(&bss->cbss);
+                ieee80211_rx_bss_put(local, bss);
+        }
 
         if (self_disconnected) {
                 if (deauth)
@@ -854,23 +796,28 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
                                 IEEE80211_STYPE_DISASSOC, reason);
         }
 
-        ifsta->flags &= ~IEEE80211_STA_ASSOCIATED;
+        ifmgd->flags &= ~IEEE80211_STA_ASSOCIATED;
         changed |= ieee80211_reset_erp_info(sdata);
 
         ieee80211_led_assoc(local, 0);
         changed |= BSS_CHANGED_ASSOC;
         sdata->vif.bss_conf.assoc = false;
 
-        ieee80211_sta_send_apinfo(sdata, ifsta);
+        ieee80211_sta_send_apinfo(sdata);
 
-        if (self_disconnected || reason == WLAN_REASON_DISASSOC_STA_HAS_LEFT)
-                ifsta->state = IEEE80211_STA_MLME_DISABLED;
+        if (self_disconnected || reason == WLAN_REASON_DISASSOC_STA_HAS_LEFT) {
+                ifmgd->state = IEEE80211_STA_MLME_DISABLED;
+                ieee80211_rx_bss_remove(sdata, ifmgd->bssid,
+                                sdata->local->hw.conf.channel->center_freq,
+                                ifmgd->ssid, ifmgd->ssid_len);
+        }
 
         rcu_read_unlock();
 
-        local->hw.conf.ht.enabled = false;
+        /* channel(_type) changes are handled by ieee80211_hw_config */
         local->oper_channel_type = NL80211_CHAN_NO_HT;
-        config_changed |= IEEE80211_CONF_CHANGE_HT;
+
+        local->power_constr_level = 0;
 
         del_timer_sync(&local->dynamic_ps_timer);
         cancel_work_sync(&local->dynamic_ps_enable_work);
@@ -885,7 +832,7 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
 
         rcu_read_lock();
 
-        sta = sta_info_get(local, ifsta->bssid);
+        sta = sta_info_get(local, ifmgd->bssid);
         if (!sta) {
                 rcu_read_unlock();
                 return;
@@ -906,27 +853,27 @@ static int ieee80211_sta_wep_configured(struct ieee80211_sub_if_data *sdata)
         return 1;
 }
 
-static int ieee80211_privacy_mismatch(struct ieee80211_sub_if_data *sdata,
-                                      struct ieee80211_if_sta *ifsta)
+static int ieee80211_privacy_mismatch(struct ieee80211_sub_if_data *sdata)
 {
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_bss *bss;
         int bss_privacy;
         int wep_privacy;
         int privacy_invoked;
 
-        if (!ifsta || (ifsta->flags & IEEE80211_STA_MIXED_CELL))
+        if (!ifmgd || (ifmgd->flags & IEEE80211_STA_EXT_SME))
                 return 0;
 
-        bss = ieee80211_rx_bss_get(local, ifsta->bssid,
+        bss = ieee80211_rx_bss_get(local, ifmgd->bssid,
                                    local->hw.conf.channel->center_freq,
-                                   ifsta->ssid, ifsta->ssid_len);
+                                   ifmgd->ssid, ifmgd->ssid_len);
         if (!bss)
                 return 0;
 
-        bss_privacy = !!(bss->capability & WLAN_CAPABILITY_PRIVACY);
+        bss_privacy = !!(bss->cbss.capability & WLAN_CAPABILITY_PRIVACY);
         wep_privacy = !!ieee80211_sta_wep_configured(sdata);
-        privacy_invoked = !!(ifsta->flags & IEEE80211_STA_PRIVACY_INVOKED);
+        privacy_invoked = !!(ifmgd->flags & IEEE80211_STA_PRIVACY_INVOKED);
 
         ieee80211_rx_bss_put(local, bss);
 
@@ -936,105 +883,173 @@ static int ieee80211_privacy_mismatch(struct ieee80211_sub_if_data *sdata,
         return 1;
 }
 
-static void ieee80211_associate(struct ieee80211_sub_if_data *sdata,
-                                struct ieee80211_if_sta *ifsta)
+static void ieee80211_associate(struct ieee80211_sub_if_data *sdata)
 {
-        ifsta->assoc_tries++;
-        if (ifsta->assoc_tries > IEEE80211_ASSOC_MAX_TRIES) {
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+        struct ieee80211_local *local = sdata->local;
+
+        ifmgd->assoc_tries++;
+        if (ifmgd->assoc_tries > IEEE80211_ASSOC_MAX_TRIES) {
                 printk(KERN_DEBUG "%s: association with AP %pM"
                        " timed out\n",
-                       sdata->dev->name, ifsta->bssid);
-                ifsta->state = IEEE80211_STA_MLME_DISABLED;
-                ieee80211_sta_send_apinfo(sdata, ifsta);
+                       sdata->dev->name, ifmgd->bssid);
+                ifmgd->state = IEEE80211_STA_MLME_DISABLED;
+                ieee80211_sta_send_apinfo(sdata);
+                ieee80211_rx_bss_remove(sdata, ifmgd->bssid,
+                                sdata->local->hw.conf.channel->center_freq,
+                                ifmgd->ssid, ifmgd->ssid_len);
+                /*
+                 * We might have a pending scan which had no chance to run yet
+                 * due to state == IEEE80211_STA_MLME_ASSOCIATE.
+                 * Hence, queue the STAs work again
+                 */
+                queue_work(local->hw.workqueue, &ifmgd->work);
                 return;
         }
 
-        ifsta->state = IEEE80211_STA_MLME_ASSOCIATE;
+        ifmgd->state = IEEE80211_STA_MLME_ASSOCIATE;
         printk(KERN_DEBUG "%s: associate with AP %pM\n",
-               sdata->dev->name, ifsta->bssid);
-        if (ieee80211_privacy_mismatch(sdata, ifsta)) {
+               sdata->dev->name, ifmgd->bssid);
+        if (ieee80211_privacy_mismatch(sdata)) {
                 printk(KERN_DEBUG "%s: mismatch in privacy configuration and "
                        "mixed-cell disabled - abort association\n", sdata->dev->name);
-                ifsta->state = IEEE80211_STA_MLME_DISABLED;
+                ifmgd->state = IEEE80211_STA_MLME_DISABLED;
                 return;
         }
 
-        ieee80211_send_assoc(sdata, ifsta);
+        ieee80211_send_assoc(sdata);
 
-        mod_timer(&ifsta->timer, jiffies + IEEE80211_ASSOC_TIMEOUT);
+        mod_timer(&ifmgd->timer, jiffies + IEEE80211_ASSOC_TIMEOUT);
 }
 
+void ieee80211_sta_rx_notify(struct ieee80211_sub_if_data *sdata,
+                             struct ieee80211_hdr *hdr)
+{
+        /*
+         * We can postpone the mgd.timer whenever receiving unicast frames
+         * from AP because we know that the connection is working both ways
+         * at that time. But multicast frames (and hence also beacons) must
+         * be ignored here, because we need to trigger the timer during
+         * data idle periods for sending the periodical probe request to
+         * the AP.
+         */
+        if (!is_multicast_ether_addr(hdr->addr1))
+                mod_timer(&sdata->u.mgd.timer,
+                          jiffies + IEEE80211_MONITORING_INTERVAL);
+}
 
-static void ieee80211_associated(struct ieee80211_sub_if_data *sdata,
-                                 struct ieee80211_if_sta *ifsta)
+void ieee80211_beacon_loss_work(struct work_struct *work)
 {
+        struct ieee80211_sub_if_data *sdata =
+                container_of(work, struct ieee80211_sub_if_data,
+                             u.mgd.beacon_loss_work);
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+
+        printk(KERN_DEBUG "%s: driver reports beacon loss from AP %pM "
+               "- sending probe request\n", sdata->dev->name,
+               sdata->u.mgd.bssid);
+
+        ifmgd->flags |= IEEE80211_STA_PROBEREQ_POLL;
+        ieee80211_send_probe_req(sdata, ifmgd->bssid, ifmgd->ssid,
+                                 ifmgd->ssid_len, NULL, 0);
+
+        mod_timer(&ifmgd->timer, jiffies + IEEE80211_MONITORING_INTERVAL);
+}
+
+void ieee80211_beacon_loss(struct ieee80211_vif *vif)
+{
+        struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
+
+        queue_work(sdata->local->hw.workqueue,
+                   &sdata->u.mgd.beacon_loss_work);
+}
+EXPORT_SYMBOL(ieee80211_beacon_loss);
+
+static void ieee80211_associated(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_local *local = sdata->local;
         struct sta_info *sta;
-        int disassoc;
+        bool disassoc = false;
 
         /* TODO: start monitoring current AP signal quality and number of
          * missed beacons. Scan other channels every now and then and search
          * for better APs. */
         /* TODO: remove expired BSSes */
 
-        ifsta->state = IEEE80211_STA_MLME_ASSOCIATED;
+        ifmgd->state = IEEE80211_STA_MLME_ASSOCIATED;
 
         rcu_read_lock();
 
-        sta = sta_info_get(local, ifsta->bssid);
+        sta = sta_info_get(local, ifmgd->bssid);
         if (!sta) {
                 printk(KERN_DEBUG "%s: No STA entry for own AP %pM\n",
-                       sdata->dev->name, ifsta->bssid);
-                disassoc = 1;
-        } else {
-                disassoc = 0;
-                if (time_after(jiffies,
-                               sta->last_rx + IEEE80211_MONITORING_INTERVAL)) {
-                        if (ifsta->flags & IEEE80211_STA_PROBEREQ_POLL) {
-                                printk(KERN_DEBUG "%s: No ProbeResp from "
-                                       "current AP %pM - assume out of "
-                                       "range\n",
-                                       sdata->dev->name, ifsta->bssid);
-                                disassoc = 1;
-                        } else
-                                ieee80211_send_probe_req(sdata, ifsta->bssid,
-                                                         ifsta->ssid,
-                                                         ifsta->ssid_len);
-                        ifsta->flags ^= IEEE80211_STA_PROBEREQ_POLL;
-                } else {
-                        ifsta->flags &= ~IEEE80211_STA_PROBEREQ_POLL;
-                        if (time_after(jiffies, ifsta->last_probe +
-                                       IEEE80211_PROBE_INTERVAL)) {
-                                ifsta->last_probe = jiffies;
-                                ieee80211_send_probe_req(sdata, ifsta->bssid,
-                                                         ifsta->ssid,
-                                                         ifsta->ssid_len);
-                        }
-                }
+                       sdata->dev->name, ifmgd->bssid);
+                disassoc = true;
+                goto unlock;
         }
 
+        if ((ifmgd->flags & IEEE80211_STA_PROBEREQ_POLL) &&
+            time_after(jiffies, sta->last_rx + IEEE80211_MONITORING_INTERVAL)) {
+                printk(KERN_DEBUG "%s: no probe response from AP %pM "
+                       "- disassociating\n",
+                       sdata->dev->name, ifmgd->bssid);
+                disassoc = true;
+                ifmgd->flags &= ~IEEE80211_STA_PROBEREQ_POLL;
+                goto unlock;
+        }
+
+        /*
+         * Beacon filtering is only enabled with power save and then the
+         * stack should not check for beacon loss.
+         */
+        if (!((local->hw.flags & IEEE80211_HW_BEACON_FILTER) &&
+              (local->hw.conf.flags & IEEE80211_CONF_PS)) &&
+            time_after(jiffies,
+                       ifmgd->last_beacon + IEEE80211_MONITORING_INTERVAL)) {
+                printk(KERN_DEBUG "%s: beacon loss from AP %pM "
+                       "- sending probe request\n",
+                       sdata->dev->name, ifmgd->bssid);
+                ifmgd->flags |= IEEE80211_STA_PROBEREQ_POLL;
+                ieee80211_send_probe_req(sdata, ifmgd->bssid, ifmgd->ssid,
+                                         ifmgd->ssid_len, NULL, 0);
+                goto unlock;
+
+        }
+
+        if (time_after(jiffies, sta->last_rx + IEEE80211_PROBE_IDLE_TIME)) {
+                ifmgd->flags |= IEEE80211_STA_PROBEREQ_POLL;
+                ieee80211_send_probe_req(sdata, ifmgd->bssid, ifmgd->ssid,
+                                         ifmgd->ssid_len, NULL, 0);
+        }
+
+ unlock:
         rcu_read_unlock();
 
         if (disassoc)
-                ieee80211_set_disassoc(sdata, ifsta, true, true,
+                ieee80211_set_disassoc(sdata, true, true,
                                         WLAN_REASON_PREV_AUTH_NOT_VALID);
         else
-                mod_timer(&ifsta->timer, jiffies +
+                mod_timer(&ifmgd->timer, jiffies +
                                       IEEE80211_MONITORING_INTERVAL);
 }
 
 
-static void ieee80211_auth_completed(struct ieee80211_sub_if_data *sdata,
-                                     struct ieee80211_if_sta *ifsta)
+static void ieee80211_auth_completed(struct ieee80211_sub_if_data *sdata)
 {
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+
         printk(KERN_DEBUG "%s: authenticated\n", sdata->dev->name);
-        ifsta->flags |= IEEE80211_STA_AUTHENTICATED;
-        ieee80211_associate(sdata, ifsta);
+        ifmgd->flags |= IEEE80211_STA_AUTHENTICATED;
+        if (ifmgd->flags & IEEE80211_STA_EXT_SME) {
+                /* Wait for SME to request association */
+                ifmgd->state = IEEE80211_STA_MLME_DISABLED;
+        } else
+                ieee80211_associate(sdata);
 }
 
 
 static void ieee80211_auth_challenge(struct ieee80211_sub_if_data *sdata,
-                                     struct ieee80211_if_sta *ifsta,
                                      struct ieee80211_mgmt *mgmt,
                                      size_t len)
 {
@@ -1045,50 +1060,37 @@ static void ieee80211_auth_challenge(struct ieee80211_sub_if_data *sdata,
         ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems);
         if (!elems.challenge)
                 return;
-        ieee80211_send_auth(sdata, ifsta, 3, elems.challenge - 2,
-                            elems.challenge_len + 2, 1);
+        ieee80211_send_auth(sdata, 3, sdata->u.mgd.auth_alg,
+                            elems.challenge - 2, elems.challenge_len + 2,
+                            sdata->u.mgd.bssid, 1);
+        sdata->u.mgd.auth_transaction = 4;
 }
 
 static void ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
-                                   struct ieee80211_if_sta *ifsta,
                                    struct ieee80211_mgmt *mgmt,
                                    size_t len)
 {
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         u16 auth_alg, auth_transaction, status_code;
 
-        if (ifsta->state != IEEE80211_STA_MLME_AUTHENTICATE &&
-            sdata->vif.type != NL80211_IFTYPE_ADHOC)
+        if (ifmgd->state != IEEE80211_STA_MLME_AUTHENTICATE)
                 return;
 
         if (len < 24 + 6)
                 return;
 
-        if (sdata->vif.type != NL80211_IFTYPE_ADHOC &&
-            memcmp(ifsta->bssid, mgmt->sa, ETH_ALEN) != 0)
+        if (memcmp(ifmgd->bssid, mgmt->sa, ETH_ALEN) != 0)
                 return;
 
-        if (sdata->vif.type != NL80211_IFTYPE_ADHOC &&
-            memcmp(ifsta->bssid, mgmt->bssid, ETH_ALEN) != 0)
+        if (memcmp(ifmgd->bssid, mgmt->bssid, ETH_ALEN) != 0)
                 return;
 
         auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg);
         auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction);
         status_code = le16_to_cpu(mgmt->u.auth.status_code);
 
-        if (sdata->vif.type == NL80211_IFTYPE_ADHOC) {
-                /*
-                 * IEEE 802.11 standard does not require authentication in IBSS
-                 * networks and most implementations do not seem to use it.
-                 * However, try to reply to authentication attempts if someone
-                 * has actually implemented this.
-                 */
-                if (auth_alg != WLAN_AUTH_OPEN || auth_transaction != 1)
-                        return;
-                ieee80211_send_auth(sdata, ifsta, 2, NULL, 0, 0);
-        }
-
-        if (auth_alg != ifsta->auth_alg ||
-            auth_transaction != ifsta->auth_transaction)
+        if (auth_alg != ifmgd->auth_alg ||
+            auth_transaction != ifmgd->auth_transaction)
                 return;
 
         if (status_code != WLAN_STATUS_SUCCESS) {
@@ -1097,15 +1099,15 @@ static void ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
                         const int num_algs = ARRAY_SIZE(algs);
                         int i, pos;
                         algs[0] = algs[1] = algs[2] = 0xff;
-                        if (ifsta->auth_algs & IEEE80211_AUTH_ALG_OPEN)
+                        if (ifmgd->auth_algs & IEEE80211_AUTH_ALG_OPEN)
                                 algs[0] = WLAN_AUTH_OPEN;
-                        if (ifsta->auth_algs & IEEE80211_AUTH_ALG_SHARED_KEY)
+                        if (ifmgd->auth_algs & IEEE80211_AUTH_ALG_SHARED_KEY)
                                 algs[1] = WLAN_AUTH_SHARED_KEY;
-                        if (ifsta->auth_algs & IEEE80211_AUTH_ALG_LEAP)
+                        if (ifmgd->auth_algs & IEEE80211_AUTH_ALG_LEAP)
                                 algs[2] = WLAN_AUTH_LEAP;
-                        if (ifsta->auth_alg == WLAN_AUTH_OPEN)
+                        if (ifmgd->auth_alg == WLAN_AUTH_OPEN)
                                 pos = 0;
-                        else if (ifsta->auth_alg == WLAN_AUTH_SHARED_KEY)
+                        else if (ifmgd->auth_alg == WLAN_AUTH_SHARED_KEY)
                                 pos = 1;
                         else
                                 pos = 2;
@@ -1113,105 +1115,112 @@ static void ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
                                 pos++;
                                 if (pos >= num_algs)
                                         pos = 0;
-                                if (algs[pos] == ifsta->auth_alg ||
+                                if (algs[pos] == ifmgd->auth_alg ||
                                     algs[pos] == 0xff)
                                         continue;
                                 if (algs[pos] == WLAN_AUTH_SHARED_KEY &&
                                     !ieee80211_sta_wep_configured(sdata))
                                         continue;
-                                ifsta->auth_alg = algs[pos];
+                                ifmgd->auth_alg = algs[pos];
                                 break;
                         }
                 }
                 return;
         }
 
-        switch (ifsta->auth_alg) {
+        switch (ifmgd->auth_alg) {
         case WLAN_AUTH_OPEN:
         case WLAN_AUTH_LEAP:
-                ieee80211_auth_completed(sdata, ifsta);
+        case WLAN_AUTH_FT:
+                ieee80211_auth_completed(sdata);
+                cfg80211_send_rx_auth(sdata->dev, (u8 *) mgmt, len);
                 break;
         case WLAN_AUTH_SHARED_KEY:
-                if (ifsta->auth_transaction == 4)
-                        ieee80211_auth_completed(sdata, ifsta);
-                else
-                        ieee80211_auth_challenge(sdata, ifsta, mgmt, len);
+                if (ifmgd->auth_transaction == 4) {
+                        ieee80211_auth_completed(sdata);
+                        cfg80211_send_rx_auth(sdata->dev, (u8 *) mgmt, len);
+                } else
+                        ieee80211_auth_challenge(sdata, mgmt, len);
                 break;
         }
 }
 
 
 static void ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata,
-                                     struct ieee80211_if_sta *ifsta,
                                      struct ieee80211_mgmt *mgmt,
                                      size_t len)
 {
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         u16 reason_code;
 
         if (len < 24 + 2)
                 return;
 
-        if (memcmp(ifsta->bssid, mgmt->sa, ETH_ALEN))
+        if (memcmp(ifmgd->bssid, mgmt->sa, ETH_ALEN))
                 return;
 
         reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
 
-        if (ifsta->flags & IEEE80211_STA_AUTHENTICATED)
+        if (ifmgd->flags & IEEE80211_STA_AUTHENTICATED)
                 printk(KERN_DEBUG "%s: deauthenticated (Reason: %u)\n",
                                 sdata->dev->name, reason_code);
 
-        if (ifsta->state == IEEE80211_STA_MLME_AUTHENTICATE ||
-            ifsta->state == IEEE80211_STA_MLME_ASSOCIATE ||
-            ifsta->state == IEEE80211_STA_MLME_ASSOCIATED) {
-                ifsta->state = IEEE80211_STA_MLME_DIRECT_PROBE;
-                mod_timer(&ifsta->timer, jiffies +
+        if (!(ifmgd->flags & IEEE80211_STA_EXT_SME) &&
+            (ifmgd->state == IEEE80211_STA_MLME_AUTHENTICATE ||
+             ifmgd->state == IEEE80211_STA_MLME_ASSOCIATE ||
+             ifmgd->state == IEEE80211_STA_MLME_ASSOCIATED)) {
+                ifmgd->state = IEEE80211_STA_MLME_DIRECT_PROBE;
+                mod_timer(&ifmgd->timer, jiffies +
                                       IEEE80211_RETRY_AUTH_INTERVAL);
         }
 
-        ieee80211_set_disassoc(sdata, ifsta, true, false, 0);
-        ifsta->flags &= ~IEEE80211_STA_AUTHENTICATED;
+        ieee80211_set_disassoc(sdata, true, false, 0);
+        ifmgd->flags &= ~IEEE80211_STA_AUTHENTICATED;
+        cfg80211_send_rx_deauth(sdata->dev, (u8 *) mgmt, len);
 }
 
 
 static void ieee80211_rx_mgmt_disassoc(struct ieee80211_sub_if_data *sdata,
-                                       struct ieee80211_if_sta *ifsta,
                                        struct ieee80211_mgmt *mgmt,
                                        size_t len)
 {
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         u16 reason_code;
 
         if (len < 24 + 2)
                 return;
 
-        if (memcmp(ifsta->bssid, mgmt->sa, ETH_ALEN))
+        if (memcmp(ifmgd->bssid, mgmt->sa, ETH_ALEN))
                 return;
 
         reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);
 
-        if (ifsta->flags & IEEE80211_STA_ASSOCIATED)
+        if (ifmgd->flags & IEEE80211_STA_ASSOCIATED)
                 printk(KERN_DEBUG "%s: disassociated (Reason: %u)\n",
                                 sdata->dev->name, reason_code);
 
-        if (ifsta->state == IEEE80211_STA_MLME_ASSOCIATED) {
-                ifsta->state = IEEE80211_STA_MLME_ASSOCIATE;
-                mod_timer(&ifsta->timer, jiffies +
+        if (!(ifmgd->flags & IEEE80211_STA_EXT_SME) &&
+            ifmgd->state == IEEE80211_STA_MLME_ASSOCIATED) {
+                ifmgd->state = IEEE80211_STA_MLME_ASSOCIATE;
+                mod_timer(&ifmgd->timer, jiffies +
                                       IEEE80211_RETRY_AUTH_INTERVAL);
         }
 
-        ieee80211_set_disassoc(sdata, ifsta, false, false, reason_code);
+        ieee80211_set_disassoc(sdata, false, false, reason_code);
+        cfg80211_send_rx_disassoc(sdata->dev, (u8 *) mgmt, len);
 }
 
 
 static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
-                                         struct ieee80211_if_sta *ifsta,
                                          struct ieee80211_mgmt *mgmt,
                                          size_t len,
                                          int reassoc)
 {
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_supported_band *sband;
         struct sta_info *sta;
-        u64 rates, basic_rates;
+        u32 rates, basic_rates;
         u16 capab_info, status_code, aid;
         struct ieee802_11_elems elems;
         struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
@@ -1224,13 +1233,13 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
         /* AssocResp and ReassocResp have identical structure, so process both
          * of them in this function. */
 
-        if (ifsta->state != IEEE80211_STA_MLME_ASSOCIATE)
+        if (ifmgd->state != IEEE80211_STA_MLME_ASSOCIATE)
                 return;
 
         if (len < 24 + 6)
                 return;
 
-        if (memcmp(ifsta->bssid, mgmt->sa, ETH_ALEN) != 0)
+        if (memcmp(ifmgd->bssid, mgmt->sa, ETH_ALEN) != 0)
                 return;
 
         capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
@@ -1242,13 +1251,31 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
                sdata->dev->name, reassoc ? "Rea" : "A", mgmt->sa,
                capab_info, status_code, (u16)(aid & ~(BIT(15) | BIT(14))));
 
+        pos = mgmt->u.assoc_resp.variable;
+        ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems);
+
+        if (status_code == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY &&
+            elems.timeout_int && elems.timeout_int_len == 5 &&
+            elems.timeout_int[0] == WLAN_TIMEOUT_ASSOC_COMEBACK) {
+                u32 tu, ms;
+                tu = get_unaligned_le32(elems.timeout_int + 1);
+                ms = tu * 1024 / 1000;
+                printk(KERN_DEBUG "%s: AP rejected association temporarily; "
+                       "comeback duration %u TU (%u ms)\n",
+                       sdata->dev->name, tu, ms);
+                if (ms > IEEE80211_ASSOC_TIMEOUT)
+                        mod_timer(&ifmgd->timer,
+                                  jiffies + msecs_to_jiffies(ms));
+                return;
+        }
+
         if (status_code != WLAN_STATUS_SUCCESS) {
                 printk(KERN_DEBUG "%s: AP denied association (code=%d)\n",
                        sdata->dev->name, status_code);
                 /* if this was a reassociation, ensure we try a "full"
                  * association next time. This works around some broken APs
                  * which do not correctly reject reassociation requests. */
-                ifsta->flags &= ~IEEE80211_STA_PREV_BSSID_SET;
+                ifmgd->flags &= ~IEEE80211_STA_PREV_BSSID_SET;
                 return;
         }
 
@@ -1257,9 +1284,6 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
                        "set\n", sdata->dev->name, aid);
         aid &= ~(BIT(15) | BIT(14));
 
-        pos = mgmt->u.assoc_resp.variable;
-        ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems);
-
         if (!elems.supp_rates) {
                 printk(KERN_DEBUG "%s: no SuppRates element in AssocResp\n",
                        sdata->dev->name);
@@ -1267,40 +1291,29 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
         }
 
         printk(KERN_DEBUG "%s: associated\n", sdata->dev->name);
-        ifsta->aid = aid;
-        ifsta->ap_capab = capab_info;
+        ifmgd->aid = aid;
+        ifmgd->ap_capab = capab_info;
 
-        kfree(ifsta->assocresp_ies);
-        ifsta->assocresp_ies_len = len - (pos - (u8 *) mgmt);
-        ifsta->assocresp_ies = kmalloc(ifsta->assocresp_ies_len, GFP_KERNEL);
-        if (ifsta->assocresp_ies)
-                memcpy(ifsta->assocresp_ies, pos, ifsta->assocresp_ies_len);
+        kfree(ifmgd->assocresp_ies);
+        ifmgd->assocresp_ies_len = len - (pos - (u8 *) mgmt);
+        ifmgd->assocresp_ies = kmalloc(ifmgd->assocresp_ies_len, GFP_KERNEL);
+        if (ifmgd->assocresp_ies)
+                memcpy(ifmgd->assocresp_ies, pos, ifmgd->assocresp_ies_len);
 
         rcu_read_lock();
 
         /* Add STA entry for the AP */
-        sta = sta_info_get(local, ifsta->bssid);
+        sta = sta_info_get(local, ifmgd->bssid);
         if (!sta) {
-                struct ieee80211_bss *bss;
-
                 newsta = true;
 
-                sta = sta_info_alloc(sdata, ifsta->bssid, GFP_ATOMIC);
+                sta = sta_info_alloc(sdata, ifmgd->bssid, GFP_ATOMIC);
                 if (!sta) {
                         printk(KERN_DEBUG "%s: failed to alloc STA entry for"
                                " the AP\n", sdata->dev->name);
                         rcu_read_unlock();
                         return;
                 }
-                bss = ieee80211_rx_bss_get(local, ifsta->bssid,
-                                           local->hw.conf.channel->center_freq,
-                                           ifsta->ssid, ifsta->ssid_len);
-                if (bss) {
-                        sta->last_signal = bss->signal;
-                        sta->last_qual = bss->qual;
-                        sta->last_noise = bss->noise;
-                        ieee80211_rx_bss_put(local, bss);
-                }
 
                 /* update new sta with its last rx activity */
                 sta->last_rx = jiffies;
@@ -1367,7 +1380,8 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
         else
                 sdata->flags &= ~IEEE80211_SDATA_OPERATING_GMODE;
 
-        if (elems.ht_cap_elem)
+        /* If TKIP/WEP is used, no need to parse AP's HT capabilities */
+        if (elems.ht_cap_elem && !(ifmgd->flags & IEEE80211_STA_TKIP_WEP_USED))
                 ieee80211_ht_cap_ie_to_sta_ht_cap(sband,
                                 elems.ht_cap_elem, &sta->sta.ht_cap);
 
@@ -1375,6 +1389,9 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
 
         rate_control_rate_init(sta);
 
+        if (ifmgd->flags & IEEE80211_STA_MFP_ENABLED)
+                set_sta_flags(sta, WLAN_STA_MFP);
+
         if (elems.wmm_param)
                 set_sta_flags(sta, WLAN_STA_WME);
 
@@ -1391,11 +1408,12 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
         rcu_read_unlock();
 
         if (elems.wmm_param)
-                ieee80211_sta_wmm_params(local, ifsta, elems.wmm_param,
+                ieee80211_sta_wmm_params(local, ifmgd, elems.wmm_param,
                                          elems.wmm_param_len);
 
         if (elems.ht_info_elem && elems.wmm_param &&
-            (ifsta->flags & IEEE80211_STA_WMM_ENABLED))
+            (ifmgd->flags & IEEE80211_STA_WMM_ENABLED) &&
+            !(ifmgd->flags & IEEE80211_STA_TKIP_WEP_USED))
                 changed |= ieee80211_enable_ht(sdata, elems.ht_info_elem,
                                                ap_ht_cap_flags);
 
@@ -1403,136 +1421,19 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
          * ieee80211_set_associated() will tell the driver */
         bss_conf->aid = aid;
         bss_conf->assoc_capability = capab_info;
-        ieee80211_set_associated(sdata, ifsta, changed);
-
-        ieee80211_associated(sdata, ifsta);
-}
-
-
-static int ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
-                                   struct ieee80211_if_sta *ifsta,
-                                   struct ieee80211_bss *bss)
-{
-        struct ieee80211_local *local = sdata->local;
-        int res, rates, i, j;
-        struct sk_buff *skb;
-        struct ieee80211_mgmt *mgmt;
-        u8 *pos;
-        struct ieee80211_supported_band *sband;
-        union iwreq_data wrqu;
-
-        skb = dev_alloc_skb(local->hw.extra_tx_headroom + 400);
-        if (!skb) {
-                printk(KERN_DEBUG "%s: failed to allocate buffer for probe "
-                       "response\n", sdata->dev->name);
-                return -ENOMEM;
-        }
-
-        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
-
-        /* Remove possible STA entries from other IBSS networks. */
-        sta_info_flush_delayed(sdata);
-
-        if (local->ops->reset_tsf) {
-                /* Reset own TSF to allow time synchronization work. */
-                local->ops->reset_tsf(local_to_hw(local));
-        }
-        memcpy(ifsta->bssid, bss->bssid, ETH_ALEN);
-        res = ieee80211_if_config(sdata, IEEE80211_IFCC_BSSID);
-        if (res)
-                return res;
-
-        local->hw.conf.beacon_int = bss->beacon_int >= 10 ? bss->beacon_int : 10;
-
-        sdata->drop_unencrypted = bss->capability &
-                WLAN_CAPABILITY_PRIVACY ? 1 : 0;
-
-        res = ieee80211_set_freq(sdata, bss->freq);
-
-        if (res)
-                return res;
-
-        /* Build IBSS probe response */
+        ieee80211_set_associated(sdata, changed);
 
-        skb_reserve(skb, local->hw.extra_tx_headroom);
-
-        mgmt = (struct ieee80211_mgmt *)
-                skb_put(skb, 24 + sizeof(mgmt->u.beacon));
-        memset(mgmt, 0, 24 + sizeof(mgmt->u.beacon));
-        mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
-                                                IEEE80211_STYPE_PROBE_RESP);
-        memset(mgmt->da, 0xff, ETH_ALEN);
-        memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
-        memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
-        mgmt->u.beacon.beacon_int =
-                cpu_to_le16(local->hw.conf.beacon_int);
-        mgmt->u.beacon.timestamp = cpu_to_le64(bss->timestamp);
-        mgmt->u.beacon.capab_info = cpu_to_le16(bss->capability);
-
-        pos = skb_put(skb, 2 + ifsta->ssid_len);
-        *pos++ = WLAN_EID_SSID;
-        *pos++ = ifsta->ssid_len;
-        memcpy(pos, ifsta->ssid, ifsta->ssid_len);
-
-        rates = bss->supp_rates_len;
-        if (rates > 8)
-                rates = 8;
-        pos = skb_put(skb, 2 + rates);
-        *pos++ = WLAN_EID_SUPP_RATES;
-        *pos++ = rates;
-        memcpy(pos, bss->supp_rates, rates);
-
-        if (bss->band == IEEE80211_BAND_2GHZ) {
-                pos = skb_put(skb, 2 + 1);
-                *pos++ = WLAN_EID_DS_PARAMS;
-                *pos++ = 1;
-                *pos++ = ieee80211_frequency_to_channel(bss->freq);
-        }
-
-        pos = skb_put(skb, 2 + 2);
-        *pos++ = WLAN_EID_IBSS_PARAMS;
-        *pos++ = 2;
-        /* FIX: set ATIM window based on scan results */
-        *pos++ = 0;
-        *pos++ = 0;
-
-        if (bss->supp_rates_len > 8) {
-                rates = bss->supp_rates_len - 8;
-                pos = skb_put(skb, 2 + rates);
-                *pos++ = WLAN_EID_EXT_SUPP_RATES;
-                *pos++ = rates;
-                memcpy(pos, &bss->supp_rates[8], rates);
-        }
-
-        ifsta->probe_resp = skb;
-
-        ieee80211_if_config(sdata, IEEE80211_IFCC_BEACON);
-
-
-        rates = 0;
-        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
-        for (i = 0; i < bss->supp_rates_len; i++) {
-                int bitrate = (bss->supp_rates[i] & 0x7f) * 5;
-                for (j = 0; j < sband->n_bitrates; j++)
-                        if (sband->bitrates[j].bitrate == bitrate)
-                                rates |= BIT(j);
-        }
-        ifsta->supp_rates_bits[local->hw.conf.channel->band] = rates;
-
-        ieee80211_sta_def_wmm_params(sdata, bss);
-
-        ifsta->state = IEEE80211_STA_MLME_IBSS_JOINED;
-        mod_timer(&ifsta->timer, jiffies + IEEE80211_IBSS_MERGE_INTERVAL);
-
-        ieee80211_led_assoc(local, true);
-
-        memset(&wrqu, 0, sizeof(wrqu));
-        memcpy(wrqu.ap_addr.sa_data, bss->bssid, ETH_ALEN);
-        wireless_send_event(sdata->dev, SIOCGIWAP, &wrqu, NULL);
+        /*
+         * initialise the time of last beacon to be the association time,
+         * otherwise beacon loss check will trigger immediately
+         */
+        ifmgd->last_beacon = jiffies;
 
-        return res;
+        ieee80211_associated(sdata);
+        cfg80211_send_rx_assoc(sdata->dev, (u8 *) mgmt, len);
 }
 
+
 static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
                                   struct ieee80211_mgmt *mgmt,
                                   size_t len,
@@ -1543,11 +1444,7 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_local *local = sdata->local;
         int freq;
         struct ieee80211_bss *bss;
-        struct sta_info *sta;
         struct ieee80211_channel *channel;
-        u64 beacon_timestamp, rx_timestamp;
-        u64 supp_rates = 0;
-        enum ieee80211_band band = rx_status->band;
 
         if (elems->ds_params && elems->ds_params_len == 1)
                 freq = ieee80211_channel_to_frequency(elems->ds_params[0]);
@@ -1559,112 +1456,16 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
         if (!channel || channel->flags & IEEE80211_CHAN_DISABLED)
                 return;
 
-        if (sdata->vif.type == NL80211_IFTYPE_ADHOC && elems->supp_rates &&
-            memcmp(mgmt->bssid, sdata->u.sta.bssid, ETH_ALEN) == 0) {
-                supp_rates = ieee80211_sta_get_rates(local, elems, band);
-
-                rcu_read_lock();
-
-                sta = sta_info_get(local, mgmt->sa);
-                if (sta) {
-                        u64 prev_rates;
-
-                        prev_rates = sta->sta.supp_rates[band];
-                        /* make sure mandatory rates are always added */
-                        sta->sta.supp_rates[band] = supp_rates |
-                                ieee80211_mandatory_rates(local, band);
-
-#ifdef CONFIG_MAC80211_IBSS_DEBUG
-                        if (sta->sta.supp_rates[band] != prev_rates)
-                                printk(KERN_DEBUG "%s: updated supp_rates set "
-                                    "for %pM based on beacon info (0x%llx | "
-                                    "0x%llx -> 0x%llx)\n",
-                                    sdata->dev->name,
-                                    sta->sta.addr,
-                                    (unsigned long long) prev_rates,
-                                    (unsigned long long) supp_rates,
-                                    (unsigned long long) sta->sta.supp_rates[band]);
-#endif
-                } else {
-                        ieee80211_ibss_add_sta(sdata, mgmt->bssid, mgmt->sa, supp_rates);
-                }
-
-                rcu_read_unlock();
-        }
-
         bss = ieee80211_bss_info_update(local, rx_status, mgmt, len, elems,
-                                        freq, beacon);
+                                        channel, beacon);
         if (!bss)
                 return;
 
-        /* was just updated in ieee80211_bss_info_update */
-        beacon_timestamp = bss->timestamp;
-
-        /*
-         * In STA mode, the remaining parameters should not be overridden
-         * by beacons because they're not necessarily accurate there.
-         */
-        if (sdata->vif.type != NL80211_IFTYPE_ADHOC &&
-            bss->last_probe_resp && beacon) {
-                ieee80211_rx_bss_put(local, bss);
-                return;
-        }
-
-        /* check if we need to merge IBSS */
-        if (sdata->vif.type == NL80211_IFTYPE_ADHOC && beacon &&
-            bss->capability & WLAN_CAPABILITY_IBSS &&
-            bss->freq == local->oper_channel->center_freq &&
-            elems->ssid_len == sdata->u.sta.ssid_len &&
-            memcmp(elems->ssid, sdata->u.sta.ssid,
-                                sdata->u.sta.ssid_len) == 0) {
-                if (rx_status->flag & RX_FLAG_TSFT) {
-                        /* in order for correct IBSS merging we need mactime
-                         *
-                         * since mactime is defined as the time the first data
-                         * symbol of the frame hits the PHY, and the timestamp
-                         * of the beacon is defined as "the time that the data
-                         * symbol containing the first bit of the timestamp is
-                         * transmitted to the PHY plus the transmitting STA’s
-                         * delays through its local PHY from the MAC-PHY
-                         * interface to its interface with the WM"
-                         * (802.11 11.1.2) - equals the time this bit arrives at
-                         * the receiver - we have to take into account the
-                         * offset between the two.
-                         * e.g: at 1 MBit that means mactime is 192 usec earlier
-                         * (=24 bytes * 8 usecs/byte) than the beacon timestamp.
-                         */
-                        int rate;
-                        if (rx_status->flag & RX_FLAG_HT) {
-                                rate = 65; /* TODO: HT rates */
-                        } else {
-                                rate = local->hw.wiphy->bands[band]->
-                                        bitrates[rx_status->rate_idx].bitrate;
-                        }
-                        rx_timestamp = rx_status->mactime + (24 * 8 * 10 / rate);
-                } else if (local && local->ops && local->ops->get_tsf)
-                        /* second best option: get current TSF */
-                        rx_timestamp = local->ops->get_tsf(local_to_hw(local));
-                else
-                        /* can't merge without knowing the TSF */
-                        rx_timestamp = -1LLU;
-#ifdef CONFIG_MAC80211_IBSS_DEBUG
-                printk(KERN_DEBUG "RX beacon SA=%pM BSSID="
-                       "%pM TSF=0x%llx BCN=0x%llx diff=%lld @%lu\n",
-                       mgmt->sa, mgmt->bssid,
-                       (unsigned long long)rx_timestamp,
-                       (unsigned long long)beacon_timestamp,
-                       (unsigned long long)(rx_timestamp - beacon_timestamp),
-                       jiffies);
-#endif /* CONFIG_MAC80211_IBSS_DEBUG */
-                if (beacon_timestamp > rx_timestamp) {
-#ifdef CONFIG_MAC80211_IBSS_DEBUG
-                        printk(KERN_DEBUG "%s: beacon TSF higher than "
-                               "local TSF - IBSS merge with BSSID %pM\n",
-                               sdata->dev->name, mgmt->bssid);
-#endif
-                        ieee80211_sta_join_ibss(sdata, &sdata->u.sta, bss);
-                        ieee80211_ibss_add_sta(sdata, mgmt->bssid, mgmt->sa, supp_rates);
-                }
+        if (elems->ch_switch_elem && (elems->ch_switch_elem_len == 3) &&
+            (memcmp(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN) == 0)) {
+                struct ieee80211_channel_sw_ie *sw_elem =
+                        (struct ieee80211_channel_sw_ie *)elems->ch_switch_elem;
+                ieee80211_process_chanswitch(sdata, sw_elem, bss);
         }
 
         ieee80211_rx_bss_put(local, bss);
@@ -1676,9 +1477,11 @@ static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_sub_if_data *sdata,
                                          size_t len,
                                          struct ieee80211_rx_status *rx_status)
 {
+        struct ieee80211_if_managed *ifmgd;
         size_t baselen;
         struct ieee802_11_elems elems;
-        struct ieee80211_if_sta *ifsta = &sdata->u.sta;
+
+        ifmgd = &sdata->u.mgd;
 
         if (memcmp(mgmt->da, sdata->dev->dev_addr, ETH_ALEN))
                 return; /* ignore ProbeResp to foreign address */
@@ -1694,25 +1497,27 @@ static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_sub_if_data *sdata,
 
         /* direct probe may be part of the association flow */
         if (test_and_clear_bit(IEEE80211_STA_REQ_DIRECT_PROBE,
-                                                        &ifsta->request)) {
+                               &ifmgd->request)) {
                 printk(KERN_DEBUG "%s direct probe responded\n",
                        sdata->dev->name);
-                ieee80211_authenticate(sdata, ifsta);
+                ieee80211_authenticate(sdata);
         }
-}
 
+        if (ifmgd->flags & IEEE80211_STA_PROBEREQ_POLL)
+                ifmgd->flags &= ~IEEE80211_STA_PROBEREQ_POLL;
+}
 
 static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
                                      struct ieee80211_mgmt *mgmt,
                                      size_t len,
                                      struct ieee80211_rx_status *rx_status)
 {
-        struct ieee80211_if_sta *ifsta;
+        struct ieee80211_if_managed *ifmgd;
         size_t baselen;
         struct ieee802_11_elems elems;
         struct ieee80211_local *local = sdata->local;
         u32 changed = 0;
-        bool erp_valid;
+        bool erp_valid, directed_tim;
         u8 erp_value = 0;
 
         /* Process beacon from the current BSS */
@@ -1726,15 +1531,43 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
 
         if (sdata->vif.type != NL80211_IFTYPE_STATION)
                 return;
-        ifsta = &sdata->u.sta;
 
-        if (!(ifsta->flags & IEEE80211_STA_ASSOCIATED) ||
-            memcmp(ifsta->bssid, mgmt->bssid, ETH_ALEN) != 0)
+        ifmgd = &sdata->u.mgd;
+
+        if (!(ifmgd->flags & IEEE80211_STA_ASSOCIATED) ||
+            memcmp(ifmgd->bssid, mgmt->bssid, ETH_ALEN) != 0)
+                return;
+
+        if (rx_status->freq != local->hw.conf.channel->center_freq)
                 return;
 
-        ieee80211_sta_wmm_params(local, ifsta, elems.wmm_param,
+        ieee80211_sta_wmm_params(local, ifmgd, elems.wmm_param,
                                  elems.wmm_param_len);
 
+        if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK) {
+                directed_tim = ieee80211_check_tim(&elems, ifmgd->aid);
+
+                if (directed_tim) {
+                        if (local->hw.conf.dynamic_ps_timeout > 0) {
+                                local->hw.conf.flags &= ~IEEE80211_CONF_PS;
+                                ieee80211_hw_config(local,
+                                                    IEEE80211_CONF_CHANGE_PS);
+                                ieee80211_send_nullfunc(local, sdata, 0);
+                        } else {
+                                local->pspolling = true;
+
+                                /*
+                                 * Here is assumed that the driver will be
+                                 * able to send ps-poll frame and receive a
+                                 * response even though power save mode is
+                                 * enabled, but some drivers might require
+                                 * to disable power save here. This needs
+                                 * to be investigated.
+                                 */
+                                ieee80211_send_pspoll(local, sdata);
+                        }
+                }
+        }
 
         if (elems.erp_info && elems.erp_info_len >= 1) {
                 erp_valid = true;
@@ -1747,14 +1580,15 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
                         erp_valid, erp_value);
 
 
-        if (elems.ht_cap_elem && elems.ht_info_elem && elems.wmm_param) {
+        if (elems.ht_cap_elem && elems.ht_info_elem && elems.wmm_param &&
+            !(ifmgd->flags & IEEE80211_STA_TKIP_WEP_USED)) {
                 struct sta_info *sta;
                 struct ieee80211_supported_band *sband;
                 u16 ap_ht_cap_flags;
 
                 rcu_read_lock();
 
-                sta = sta_info_get(local, ifsta->bssid);
+                sta = sta_info_get(local, ifmgd->bssid);
                 if (!sta) {
                         rcu_read_unlock();
                         return;
@@ -1778,92 +1612,28 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
                  * for the BSSID we are associated to */
                 regulatory_hint_11d(local->hw.wiphy,
                         elems.country_elem, elems.country_elem_len);
-        }
-
-        ieee80211_bss_info_change_notify(sdata, changed);
-}
-
-
-static void ieee80211_rx_mgmt_probe_req(struct ieee80211_sub_if_data *sdata,
-                                        struct ieee80211_if_sta *ifsta,
-                                        struct ieee80211_mgmt *mgmt,
-                                        size_t len,
-                                        struct ieee80211_rx_status *rx_status)
-{
-        struct ieee80211_local *local = sdata->local;
-        int tx_last_beacon;
-        struct sk_buff *skb;
-        struct ieee80211_mgmt *resp;
-        u8 *pos, *end;
 
-        if (sdata->vif.type != NL80211_IFTYPE_ADHOC ||
-            ifsta->state != IEEE80211_STA_MLME_IBSS_JOINED ||
-            len < 24 + 2 || !ifsta->probe_resp)
-                return;
-
-        if (local->ops->tx_last_beacon)
-                tx_last_beacon = local->ops->tx_last_beacon(local_to_hw(local));
-        else
-                tx_last_beacon = 1;
-
-#ifdef CONFIG_MAC80211_IBSS_DEBUG
-        printk(KERN_DEBUG "%s: RX ProbeReq SA=%pM DA=%pM BSSID=%pM"
-               " (tx_last_beacon=%d)\n",
-               sdata->dev->name, mgmt->sa, mgmt->da,
-               mgmt->bssid, tx_last_beacon);
-#endif /* CONFIG_MAC80211_IBSS_DEBUG */
-
-        if (!tx_last_beacon)
-                return;
-
-        if (memcmp(mgmt->bssid, ifsta->bssid, ETH_ALEN) != 0 &&
-            memcmp(mgmt->bssid, "\xff\xff\xff\xff\xff\xff", ETH_ALEN) != 0)
-                return;
-
-        end = ((u8 *) mgmt) + len;
-        pos = mgmt->u.probe_req.variable;
-        if (pos[0] != WLAN_EID_SSID ||
-            pos + 2 + pos[1] > end) {
-#ifdef CONFIG_MAC80211_IBSS_DEBUG
-                printk(KERN_DEBUG "%s: Invalid SSID IE in ProbeReq "
-                       "from %pM\n",
-                       sdata->dev->name, mgmt->sa);
-#endif
-                return;
+                /* TODO: IBSS also needs this */
+                if (elems.pwr_constr_elem)
+                        ieee80211_handle_pwr_constr(sdata,
+                                le16_to_cpu(mgmt->u.probe_resp.capab_info),
+                                elems.pwr_constr_elem,
+                                elems.pwr_constr_elem_len);
         }
-        if (pos[1] != 0 &&
-            (pos[1] != ifsta->ssid_len ||
-             memcmp(pos + 2, ifsta->ssid, ifsta->ssid_len) != 0)) {
-                /* Ignore ProbeReq for foreign SSID */
-                return;
-        }
-
-        /* Reply with ProbeResp */
-        skb = skb_copy(ifsta->probe_resp, GFP_KERNEL);
-        if (!skb)
-                return;
 
-        resp = (struct ieee80211_mgmt *) skb->data;
-        memcpy(resp->da, mgmt->sa, ETH_ALEN);
-#ifdef CONFIG_MAC80211_IBSS_DEBUG
-        printk(KERN_DEBUG "%s: Sending ProbeResp to %pM\n",
-               sdata->dev->name, resp->da);
-#endif /* CONFIG_MAC80211_IBSS_DEBUG */
-        ieee80211_tx_skb(sdata, skb, 0);
+        ieee80211_bss_info_change_notify(sdata, changed);
 }
 
-void ieee80211_sta_rx_mgmt(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb,
-                           struct ieee80211_rx_status *rx_status)
+ieee80211_rx_result ieee80211_sta_rx_mgmt(struct ieee80211_sub_if_data *sdata,
+                                          struct sk_buff *skb,
+                                          struct ieee80211_rx_status *rx_status)
 {
         struct ieee80211_local *local = sdata->local;
-        struct ieee80211_if_sta *ifsta;
         struct ieee80211_mgmt *mgmt;
         u16 fc;
 
         if (skb->len < 24)
-                goto fail;
-
-        ifsta = &sdata->u.sta;
+                return RX_DROP_MONITOR;
 
         mgmt = (struct ieee80211_mgmt *) skb->data;
         fc = le16_to_cpu(mgmt->frame_control);
@@ -1878,113 +1648,68 @@ void ieee80211_sta_rx_mgmt(struct ieee80211_sub_if_data *sdata, struct sk_buff *
         case IEEE80211_STYPE_REASSOC_RESP:
         case IEEE80211_STYPE_DEAUTH:
         case IEEE80211_STYPE_DISASSOC:
-                skb_queue_tail(&ifsta->skb_queue, skb);
-                queue_work(local->hw.workqueue, &ifsta->work);
-                return;
+                skb_queue_tail(&sdata->u.mgd.skb_queue, skb);
+                queue_work(local->hw.workqueue, &sdata->u.mgd.work);
+                return RX_QUEUED;
         }
 
- fail:
-        kfree_skb(skb);
+        return RX_DROP_MONITOR;
 }
 
 static void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
                                          struct sk_buff *skb)
 {
         struct ieee80211_rx_status *rx_status;
-        struct ieee80211_if_sta *ifsta;
         struct ieee80211_mgmt *mgmt;
         u16 fc;
 
-        ifsta = &sdata->u.sta;
-
         rx_status = (struct ieee80211_rx_status *) skb->cb;
         mgmt = (struct ieee80211_mgmt *) skb->data;
         fc = le16_to_cpu(mgmt->frame_control);
 
         switch (fc & IEEE80211_FCTL_STYPE) {
-        case IEEE80211_STYPE_PROBE_REQ:
-                ieee80211_rx_mgmt_probe_req(sdata, ifsta, mgmt, skb->len,
-                                            rx_status);
-                break;
         case IEEE80211_STYPE_PROBE_RESP:
-                ieee80211_rx_mgmt_probe_resp(sdata, mgmt, skb->len, rx_status);
+                ieee80211_rx_mgmt_probe_resp(sdata, mgmt, skb->len,
+                                             rx_status);
                 break;
         case IEEE80211_STYPE_BEACON:
-                ieee80211_rx_mgmt_beacon(sdata, mgmt, skb->len, rx_status);
+                ieee80211_rx_mgmt_beacon(sdata, mgmt, skb->len,
+                                         rx_status);
                 break;
         case IEEE80211_STYPE_AUTH:
-                ieee80211_rx_mgmt_auth(sdata, ifsta, mgmt, skb->len);
+                ieee80211_rx_mgmt_auth(sdata, mgmt, skb->len);
                 break;
         case IEEE80211_STYPE_ASSOC_RESP:
-                ieee80211_rx_mgmt_assoc_resp(sdata, ifsta, mgmt, skb->len, 0);
+                ieee80211_rx_mgmt_assoc_resp(sdata, mgmt, skb->len, 0);
                 break;
         case IEEE80211_STYPE_REASSOC_RESP:
-                ieee80211_rx_mgmt_assoc_resp(sdata, ifsta, mgmt, skb->len, 1);
+                ieee80211_rx_mgmt_assoc_resp(sdata, mgmt, skb->len, 1);
                 break;
         case IEEE80211_STYPE_DEAUTH:
-                ieee80211_rx_mgmt_deauth(sdata, ifsta, mgmt, skb->len);
+                ieee80211_rx_mgmt_deauth(sdata, mgmt, skb->len);
                 break;
         case IEEE80211_STYPE_DISASSOC:
-                ieee80211_rx_mgmt_disassoc(sdata, ifsta, mgmt, skb->len);
+                ieee80211_rx_mgmt_disassoc(sdata, mgmt, skb->len);
                 break;
         }
 
         kfree_skb(skb);
 }
 
-
-static int ieee80211_sta_active_ibss(struct ieee80211_sub_if_data *sdata)
-{
-        struct ieee80211_local *local = sdata->local;
-        int active = 0;
-        struct sta_info *sta;
-
-        rcu_read_lock();
-
-        list_for_each_entry_rcu(sta, &local->sta_list, list) {
-                if (sta->sdata == sdata &&
-                    time_after(sta->last_rx + IEEE80211_IBSS_MERGE_INTERVAL,
-                               jiffies)) {
-                        active++;
-                        break;
-                }
-        }
-
-        rcu_read_unlock();
-
-        return active;
-}
-
-
-static void ieee80211_sta_merge_ibss(struct ieee80211_sub_if_data *sdata,
-                                     struct ieee80211_if_sta *ifsta)
-{
-        mod_timer(&ifsta->timer, jiffies + IEEE80211_IBSS_MERGE_INTERVAL);
-
-        ieee80211_sta_expire(sdata, IEEE80211_IBSS_INACTIVITY_LIMIT);
-        if (ieee80211_sta_active_ibss(sdata))
-                return;
-
-        printk(KERN_DEBUG "%s: No active IBSS STAs - trying to scan for other "
-               "IBSS networks with same SSID (merge)\n", sdata->dev->name);
-        ieee80211_request_scan(sdata, ifsta->ssid, ifsta->ssid_len);
-}
-
-
 static void ieee80211_sta_timer(unsigned long data)
 {
         struct ieee80211_sub_if_data *sdata =
                 (struct ieee80211_sub_if_data *) data;
-        struct ieee80211_if_sta *ifsta = &sdata->u.sta;
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_local *local = sdata->local;
 
-        set_bit(IEEE80211_STA_REQ_RUN, &ifsta->request);
-        queue_work(local->hw.workqueue, &ifsta->work);
+        set_bit(IEEE80211_STA_REQ_RUN, &ifmgd->request);
+        queue_work(local->hw.workqueue, &ifmgd->work);
 }
 
-static void ieee80211_sta_reset_auth(struct ieee80211_sub_if_data *sdata,
-                                     struct ieee80211_if_sta *ifsta)
+static void ieee80211_sta_reset_auth(struct ieee80211_sub_if_data *sdata)
 {
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_local *local = sdata->local;
 
         if (local->ops->reset_tsf) {
@@ -1992,298 +1717,112 @@ static void ieee80211_sta_reset_auth(struct ieee80211_sub_if_data *sdata,
                 local->ops->reset_tsf(local_to_hw(local));
         }
 
-        ifsta->wmm_last_param_set = -1; /* allow any WMM update */
+        ifmgd->wmm_last_param_set = -1; /* allow any WMM update */
 
 
-        if (ifsta->auth_algs & IEEE80211_AUTH_ALG_OPEN)
-                ifsta->auth_alg = WLAN_AUTH_OPEN;
-        else if (ifsta->auth_algs & IEEE80211_AUTH_ALG_SHARED_KEY)
-                ifsta->auth_alg = WLAN_AUTH_SHARED_KEY;
-        else if (ifsta->auth_algs & IEEE80211_AUTH_ALG_LEAP)
-                ifsta->auth_alg = WLAN_AUTH_LEAP;
+        if (ifmgd->auth_algs & IEEE80211_AUTH_ALG_OPEN)
+                ifmgd->auth_alg = WLAN_AUTH_OPEN;
+        else if (ifmgd->auth_algs & IEEE80211_AUTH_ALG_SHARED_KEY)
+                ifmgd->auth_alg = WLAN_AUTH_SHARED_KEY;
+        else if (ifmgd->auth_algs & IEEE80211_AUTH_ALG_LEAP)
+                ifmgd->auth_alg = WLAN_AUTH_LEAP;
+        else if (ifmgd->auth_algs & IEEE80211_AUTH_ALG_FT)
+                ifmgd->auth_alg = WLAN_AUTH_FT;
         else
-                ifsta->auth_alg = WLAN_AUTH_OPEN;
-        ifsta->auth_transaction = -1;
-        ifsta->flags &= ~IEEE80211_STA_ASSOCIATED;
-        ifsta->assoc_scan_tries = 0;
-        ifsta->direct_probe_tries = 0;
-        ifsta->auth_tries = 0;
-        ifsta->assoc_tries = 0;
+                ifmgd->auth_alg = WLAN_AUTH_OPEN;
+        ifmgd->auth_transaction = -1;
+        ifmgd->flags &= ~IEEE80211_STA_ASSOCIATED;
+        ifmgd->assoc_scan_tries = 0;
+        ifmgd->direct_probe_tries = 0;
+        ifmgd->auth_tries = 0;
+        ifmgd->assoc_tries = 0;
         netif_tx_stop_all_queues(sdata->dev);
         netif_carrier_off(sdata->dev);
 }
 
-
-static int ieee80211_sta_match_ssid(struct ieee80211_if_sta *ifsta,
-                                    const char *ssid, int ssid_len)
-{
-        int tmp, hidden_ssid;
-
-        if (ssid_len == ifsta->ssid_len &&
-            !memcmp(ifsta->ssid, ssid, ssid_len))
-                return 1;
-
-        if (ifsta->flags & IEEE80211_STA_AUTO_BSSID_SEL)
-                return 0;
-
-        hidden_ssid = 1;
-        tmp = ssid_len;
-        while (tmp--) {
-                if (ssid[tmp] != '\0') {
-                        hidden_ssid = 0;
-                        break;
-                }
-        }
-
-        if (hidden_ssid && (ifsta->ssid_len == ssid_len || ssid_len == 0))
-                return 1;
-
-        if (ssid_len == 1 && ssid[0] == ' ')
-                return 1;
-
-        return 0;
-}
-
-static int ieee80211_sta_create_ibss(struct ieee80211_sub_if_data *sdata,
-                                     struct ieee80211_if_sta *ifsta)
+static int ieee80211_sta_config_auth(struct ieee80211_sub_if_data *sdata)
 {
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_bss *bss;
-        struct ieee80211_supported_band *sband;
-        u8 bssid[ETH_ALEN], *pos;
-        int i;
-        int ret;
-
-#if 0
-        /* Easier testing, use fixed BSSID. */
-        memset(bssid, 0xfe, ETH_ALEN);
-#else
-        /* Generate random, not broadcast, locally administered BSSID. Mix in
-         * own MAC address to make sure that devices that do not have proper
-         * random number generator get different BSSID. */
-        get_random_bytes(bssid, ETH_ALEN);
-        for (i = 0; i < ETH_ALEN; i++)
-                bssid[i] ^= sdata->dev->dev_addr[i];
-        bssid[0] &= ~0x01;
-        bssid[0] |= 0x02;
-#endif
-
-        printk(KERN_DEBUG "%s: Creating new IBSS network, BSSID %pM\n",
-               sdata->dev->name, bssid);
-
-        bss = ieee80211_rx_bss_add(local, bssid,
-                                   local->hw.conf.channel->center_freq,
-                                   sdata->u.sta.ssid, sdata->u.sta.ssid_len);
-        if (!bss)
-                return -ENOMEM;
-
-        bss->band = local->hw.conf.channel->band;
-        sband = local->hw.wiphy->bands[bss->band];
-
-        if (local->hw.conf.beacon_int == 0)
-                local->hw.conf.beacon_int = 100;
-        bss->beacon_int = local->hw.conf.beacon_int;
-        bss->last_update = jiffies;
-        bss->capability = WLAN_CAPABILITY_IBSS;
+        u8 *bssid = ifmgd->bssid, *ssid = ifmgd->ssid;
+        u8 ssid_len = ifmgd->ssid_len;
+        u16 capa_mask = WLAN_CAPABILITY_ESS;
+        u16 capa_val = WLAN_CAPABILITY_ESS;
+        struct ieee80211_channel *chan = local->oper_channel;
 
-        if (sdata->default_key)
-                bss->capability |= WLAN_CAPABILITY_PRIVACY;
-        else
-                sdata->drop_unencrypted = 0;
-
-        bss->supp_rates_len = sband->n_bitrates;
-        pos = bss->supp_rates;
-        for (i = 0; i < sband->n_bitrates; i++) {
-                int rate = sband->bitrates[i].bitrate;
-                *pos++ = (u8) (rate / 5);
+        if (!(ifmgd->flags & IEEE80211_STA_EXT_SME) &&
+            ifmgd->flags & (IEEE80211_STA_AUTO_SSID_SEL |
+                            IEEE80211_STA_AUTO_BSSID_SEL |
+                            IEEE80211_STA_AUTO_CHANNEL_SEL)) {
+                capa_mask |= WLAN_CAPABILITY_PRIVACY;
+                if (sdata->default_key)
+                        capa_val |= WLAN_CAPABILITY_PRIVACY;
         }
 
-        ret = ieee80211_sta_join_ibss(sdata, ifsta, bss);
-        ieee80211_rx_bss_put(local, bss);
-        return ret;
-}
+        if (ifmgd->flags & IEEE80211_STA_AUTO_CHANNEL_SEL)
+                chan = NULL;
 
+        if (ifmgd->flags & IEEE80211_STA_AUTO_BSSID_SEL)
+                bssid = NULL;
 
-static int ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata,
-                                   struct ieee80211_if_sta *ifsta)
-{
-        struct ieee80211_local *local = sdata->local;
-        struct ieee80211_bss *bss;
-        int found = 0;
-        u8 bssid[ETH_ALEN];
-        int active_ibss;
-
-        if (ifsta->ssid_len == 0)
-                return -EINVAL;
-
-        active_ibss = ieee80211_sta_active_ibss(sdata);
-#ifdef CONFIG_MAC80211_IBSS_DEBUG
-        printk(KERN_DEBUG "%s: sta_find_ibss (active_ibss=%d)\n",
-               sdata->dev->name, active_ibss);
-#endif /* CONFIG_MAC80211_IBSS_DEBUG */
-        spin_lock_bh(&local->bss_lock);
-        list_for_each_entry(bss, &local->bss_list, list) {
-                if (ifsta->ssid_len != bss->ssid_len ||
-                    memcmp(ifsta->ssid, bss->ssid, bss->ssid_len) != 0
-                    || !(bss->capability & WLAN_CAPABILITY_IBSS))
-                        continue;
-#ifdef CONFIG_MAC80211_IBSS_DEBUG
-                printk(KERN_DEBUG "   bssid=%pM found\n", bss->bssid);
-#endif /* CONFIG_MAC80211_IBSS_DEBUG */
-                memcpy(bssid, bss->bssid, ETH_ALEN);
-                found = 1;
-                if (active_ibss || memcmp(bssid, ifsta->bssid, ETH_ALEN) != 0)
-                        break;
+        if (ifmgd->flags & IEEE80211_STA_AUTO_SSID_SEL) {
+                ssid = NULL;
+                ssid_len = 0;
         }
-        spin_unlock_bh(&local->bss_lock);
 
-#ifdef CONFIG_MAC80211_IBSS_DEBUG
-        if (found)
-                printk(KERN_DEBUG "   sta_find_ibss: selected %pM current "
-                       "%pM\n", bssid, ifsta->bssid);
-#endif /* CONFIG_MAC80211_IBSS_DEBUG */
+        bss = (void *)cfg80211_get_bss(local->hw.wiphy, chan,
+                                       bssid, ssid, ssid_len,
+                                       capa_mask, capa_val);
 
-        if (found && memcmp(ifsta->bssid, bssid, ETH_ALEN) != 0) {
-                int ret;
-                int search_freq;
-
-                if (ifsta->flags & IEEE80211_STA_AUTO_CHANNEL_SEL)
-                        search_freq = bss->freq;
+        if (bss) {
+                ieee80211_set_freq(sdata, bss->cbss.channel->center_freq);
+                if (!(ifmgd->flags & IEEE80211_STA_SSID_SET))
+                        ieee80211_sta_set_ssid(sdata, bss->ssid,
+                                               bss->ssid_len);
+                ieee80211_sta_set_bssid(sdata, bss->cbss.bssid);
+                ieee80211_sta_def_wmm_params(sdata, bss->supp_rates_len,
+                                                    bss->supp_rates);
+                if (sdata->u.mgd.mfp == IEEE80211_MFP_REQUIRED)
+                        sdata->u.mgd.flags |= IEEE80211_STA_MFP_ENABLED;
                 else
-                        search_freq = local->hw.conf.channel->center_freq;
-
-                bss = ieee80211_rx_bss_get(local, bssid, search_freq,
-                                           ifsta->ssid, ifsta->ssid_len);
-                if (!bss)
-                        goto dont_join;
-
-                printk(KERN_DEBUG "%s: Selected IBSS BSSID %pM"
-                       " based on configured SSID\n",
-                       sdata->dev->name, bssid);
-                ret = ieee80211_sta_join_ibss(sdata, ifsta, bss);
-                ieee80211_rx_bss_put(local, bss);
-                return ret;
-        }
-
-dont_join:
-#ifdef CONFIG_MAC80211_IBSS_DEBUG
-        printk(KERN_DEBUG "   did not try to join ibss\n");
-#endif /* CONFIG_MAC80211_IBSS_DEBUG */
-
-        /* Selected IBSS not found in current scan results - try to scan */
-        if (ifsta->state == IEEE80211_STA_MLME_IBSS_JOINED &&
-            !ieee80211_sta_active_ibss(sdata)) {
-                mod_timer(&ifsta->timer, jiffies +
-                                      IEEE80211_IBSS_MERGE_INTERVAL);
-        } else if (time_after(jiffies, local->last_scan_completed +
-                              IEEE80211_SCAN_INTERVAL)) {
-                printk(KERN_DEBUG "%s: Trigger new scan to find an IBSS to "
-                       "join\n", sdata->dev->name);
-                return ieee80211_request_scan(sdata, ifsta->ssid,
-                                              ifsta->ssid_len);
-        } else if (ifsta->state != IEEE80211_STA_MLME_IBSS_JOINED) {
-                int interval = IEEE80211_SCAN_INTERVAL;
-
-                if (time_after(jiffies, ifsta->ibss_join_req +
-                               IEEE80211_IBSS_JOIN_TIMEOUT)) {
-                        if ((ifsta->flags & IEEE80211_STA_CREATE_IBSS) &&
-                            (!(local->oper_channel->flags &
-                                        IEEE80211_CHAN_NO_IBSS)))
-                                return ieee80211_sta_create_ibss(sdata, ifsta);
-                        if (ifsta->flags & IEEE80211_STA_CREATE_IBSS) {
-                                printk(KERN_DEBUG "%s: IBSS not allowed on"
-                                       " %d MHz\n", sdata->dev->name,
-                                       local->hw.conf.channel->center_freq);
-                        }
-
-                        /* No IBSS found - decrease scan interval and continue
-                         * scanning. */
-                        interval = IEEE80211_SCAN_INTERVAL_SLOW;
-                }
-
-                ifsta->state = IEEE80211_STA_MLME_IBSS_SEARCH;
-                mod_timer(&ifsta->timer, jiffies + interval);
-                return 0;
-        }
-
-        return 0;
-}
-
-
-static int ieee80211_sta_config_auth(struct ieee80211_sub_if_data *sdata,
-                                     struct ieee80211_if_sta *ifsta)
-{
-        struct ieee80211_local *local = sdata->local;
-        struct ieee80211_bss *bss, *selected = NULL;
-        int top_rssi = 0, freq;
-
-        spin_lock_bh(&local->bss_lock);
-        freq = local->oper_channel->center_freq;
-        list_for_each_entry(bss, &local->bss_list, list) {
-                if (!(bss->capability & WLAN_CAPABILITY_ESS))
-                        continue;
-
-                if ((ifsta->flags & (IEEE80211_STA_AUTO_SSID_SEL |
-                        IEEE80211_STA_AUTO_BSSID_SEL |
-                        IEEE80211_STA_AUTO_CHANNEL_SEL)) &&
-                    (!!(bss->capability & WLAN_CAPABILITY_PRIVACY) ^
-                     !!sdata->default_key))
-                        continue;
-
-                if (!(ifsta->flags & IEEE80211_STA_AUTO_CHANNEL_SEL) &&
-                    bss->freq != freq)
-                        continue;
-
-                if (!(ifsta->flags & IEEE80211_STA_AUTO_BSSID_SEL) &&
-                    memcmp(bss->bssid, ifsta->bssid, ETH_ALEN))
-                        continue;
-
-                if (!(ifsta->flags & IEEE80211_STA_AUTO_SSID_SEL) &&
-                    !ieee80211_sta_match_ssid(ifsta, bss->ssid, bss->ssid_len))
-                        continue;
-
-                if (!selected || top_rssi < bss->signal) {
-                        selected = bss;
-                        top_rssi = bss->signal;
-                }
-        }
-        if (selected)
-                atomic_inc(&selected->users);
-        spin_unlock_bh(&local->bss_lock);
-
-        if (selected) {
-                ieee80211_set_freq(sdata, selected->freq);
-                if (!(ifsta->flags & IEEE80211_STA_SSID_SET))
-                        ieee80211_sta_set_ssid(sdata, selected->ssid,
-                                               selected->ssid_len);
-                ieee80211_sta_set_bssid(sdata, selected->bssid);
-                ieee80211_sta_def_wmm_params(sdata, selected);
+                        sdata->u.mgd.flags &= ~IEEE80211_STA_MFP_ENABLED;
 
                 /* Send out direct probe if no probe resp was received or
                  * the one we have is outdated
                  */
-                if (!selected->last_probe_resp ||
-                    time_after(jiffies, selected->last_probe_resp
+                if (!bss->last_probe_resp ||
+                    time_after(jiffies, bss->last_probe_resp
                                         + IEEE80211_SCAN_RESULT_EXPIRE))
-                        ifsta->state = IEEE80211_STA_MLME_DIRECT_PROBE;
+                        ifmgd->state = IEEE80211_STA_MLME_DIRECT_PROBE;
                 else
-                        ifsta->state = IEEE80211_STA_MLME_AUTHENTICATE;
+                        ifmgd->state = IEEE80211_STA_MLME_AUTHENTICATE;
 
-                ieee80211_rx_bss_put(local, selected);
-                ieee80211_sta_reset_auth(sdata, ifsta);
+                ieee80211_rx_bss_put(local, bss);
+                ieee80211_sta_reset_auth(sdata);
                 return 0;
         } else {
-                if (ifsta->assoc_scan_tries < IEEE80211_ASSOC_SCANS_MAX_TRIES) {
-                        ifsta->assoc_scan_tries++;
-                        if (ifsta->flags & IEEE80211_STA_AUTO_SSID_SEL)
-                                ieee80211_start_scan(sdata, NULL, 0);
+                if (ifmgd->assoc_scan_tries < IEEE80211_ASSOC_SCANS_MAX_TRIES) {
+                        ifmgd->assoc_scan_tries++;
+                        /* XXX maybe racy? */
+                        if (local->scan_req)
+                                return -1;
+                        memcpy(local->int_scan_req.ssids[0].ssid,
+                               ifmgd->ssid, IEEE80211_MAX_SSID_LEN);
+                        if (ifmgd->flags & IEEE80211_STA_AUTO_SSID_SEL)
+                                local->int_scan_req.ssids[0].ssid_len = 0;
                         else
-                                ieee80211_start_scan(sdata, ifsta->ssid,
-                                                         ifsta->ssid_len);
-                        ifsta->state = IEEE80211_STA_MLME_AUTHENTICATE;
-                        set_bit(IEEE80211_STA_REQ_AUTH, &ifsta->request);
-                } else
-                        ifsta->state = IEEE80211_STA_MLME_DISABLED;
+                                local->int_scan_req.ssids[0].ssid_len = ifmgd->ssid_len;
+
+                        if (ieee80211_start_scan(sdata, &local->int_scan_req))
+                                ieee80211_scan_failed(local);
+
+                        ifmgd->state = IEEE80211_STA_MLME_AUTHENTICATE;
+                        set_bit(IEEE80211_STA_REQ_AUTH, &ifmgd->request);
+                } else {
+                        ifmgd->assoc_scan_tries = 0;
+                        ifmgd->state = IEEE80211_STA_MLME_DISABLED;
+                }
         }
         return -1;
 }
@@ -2292,9 +1831,9 @@ static int ieee80211_sta_config_auth(struct ieee80211_sub_if_data *sdata,
 static void ieee80211_sta_work(struct work_struct *work)
 {
         struct ieee80211_sub_if_data *sdata =
-                container_of(work, struct ieee80211_sub_if_data, u.sta.work);
+                container_of(work, struct ieee80211_sub_if_data, u.mgd.work);
         struct ieee80211_local *local = sdata->local;
-        struct ieee80211_if_sta *ifsta;
+        struct ieee80211_if_managed *ifmgd;
         struct sk_buff *skb;
 
         if (!netif_running(sdata->dev))
@@ -2303,61 +1842,60 @@ static void ieee80211_sta_work(struct work_struct *work)
         if (local->sw_scanning || local->hw_scanning)
                 return;
 
-        if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION &&
-                    sdata->vif.type != NL80211_IFTYPE_ADHOC))
+        if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
                 return;
-        ifsta = &sdata->u.sta;
+        ifmgd = &sdata->u.mgd;
 
-        while ((skb = skb_dequeue(&ifsta->skb_queue)))
+        while ((skb = skb_dequeue(&ifmgd->skb_queue)))
                 ieee80211_sta_rx_queued_mgmt(sdata, skb);
 
-        if (ifsta->state != IEEE80211_STA_MLME_DIRECT_PROBE &&
-            ifsta->state != IEEE80211_STA_MLME_AUTHENTICATE &&
-            ifsta->state != IEEE80211_STA_MLME_ASSOCIATE &&
-            test_and_clear_bit(IEEE80211_STA_REQ_SCAN, &ifsta->request)) {
-                ieee80211_start_scan(sdata, ifsta->scan_ssid,
-                                     ifsta->scan_ssid_len);
+        if (ifmgd->state != IEEE80211_STA_MLME_DIRECT_PROBE &&
+            ifmgd->state != IEEE80211_STA_MLME_AUTHENTICATE &&
+            ifmgd->state != IEEE80211_STA_MLME_ASSOCIATE &&
+            test_and_clear_bit(IEEE80211_STA_REQ_SCAN, &ifmgd->request)) {
+                /*
+                 * The call to ieee80211_start_scan can fail but ieee80211_request_scan
+                 * (which queued ieee80211_sta_work) did not return an error. Thus, call
+                 * ieee80211_scan_failed here if ieee80211_start_scan fails in order to
+                 * notify the scan requester.
+                 */
+                if (ieee80211_start_scan(sdata, local->scan_req))
+                        ieee80211_scan_failed(local);
                 return;
         }
 
-        if (test_and_clear_bit(IEEE80211_STA_REQ_AUTH, &ifsta->request)) {
-                if (ieee80211_sta_config_auth(sdata, ifsta))
+        if (test_and_clear_bit(IEEE80211_STA_REQ_AUTH, &ifmgd->request)) {
+                if (ieee80211_sta_config_auth(sdata))
                         return;
-                clear_bit(IEEE80211_STA_REQ_RUN, &ifsta->request);
-        } else if (!test_and_clear_bit(IEEE80211_STA_REQ_RUN, &ifsta->request))
+                clear_bit(IEEE80211_STA_REQ_RUN, &ifmgd->request);
+        } else if (!test_and_clear_bit(IEEE80211_STA_REQ_RUN, &ifmgd->request))
                 return;
 
-        switch (ifsta->state) {
+        switch (ifmgd->state) {
         case IEEE80211_STA_MLME_DISABLED:
                 break;
         case IEEE80211_STA_MLME_DIRECT_PROBE:
-                ieee80211_direct_probe(sdata, ifsta);
+                ieee80211_direct_probe(sdata);
                 break;
         case IEEE80211_STA_MLME_AUTHENTICATE:
-                ieee80211_authenticate(sdata, ifsta);
+                ieee80211_authenticate(sdata);
                 break;
         case IEEE80211_STA_MLME_ASSOCIATE:
-                ieee80211_associate(sdata, ifsta);
+                ieee80211_associate(sdata);
                 break;
         case IEEE80211_STA_MLME_ASSOCIATED:
-                ieee80211_associated(sdata, ifsta);
-                break;
-        case IEEE80211_STA_MLME_IBSS_SEARCH:
-                ieee80211_sta_find_ibss(sdata, ifsta);
-                break;
-        case IEEE80211_STA_MLME_IBSS_JOINED:
-                ieee80211_sta_merge_ibss(sdata, ifsta);
+                ieee80211_associated(sdata);
                 break;
         default:
                 WARN_ON(1);
                 break;
         }
 
-        if (ieee80211_privacy_mismatch(sdata, ifsta)) {
+        if (ieee80211_privacy_mismatch(sdata)) {
                 printk(KERN_DEBUG "%s: privacy configuration mismatch and "
                        "mixed-cell disabled - disassociate\n", sdata->dev->name);
 
-                ieee80211_set_disassoc(sdata, ifsta, false, true,
+                ieee80211_set_disassoc(sdata, false, true,
                                         WLAN_REASON_UNSPECIFIED);
         }
 }
@@ -2366,208 +1904,161 @@ static void ieee80211_restart_sta_timer(struct ieee80211_sub_if_data *sdata)
 {
         if (sdata->vif.type == NL80211_IFTYPE_STATION)
                 queue_work(sdata->local->hw.workqueue,
-                           &sdata->u.sta.work);
+                           &sdata->u.mgd.work);
 }
 
 /* interface setup */
 void ieee80211_sta_setup_sdata(struct ieee80211_sub_if_data *sdata)
 {
-        struct ieee80211_if_sta *ifsta;
+        struct ieee80211_if_managed *ifmgd;
 
-        ifsta = &sdata->u.sta;
-        INIT_WORK(&ifsta->work, ieee80211_sta_work);
-        setup_timer(&ifsta->timer, ieee80211_sta_timer,
+        ifmgd = &sdata->u.mgd;
+        INIT_WORK(&ifmgd->work, ieee80211_sta_work);
+        INIT_WORK(&ifmgd->chswitch_work, ieee80211_chswitch_work);
+        INIT_WORK(&ifmgd->beacon_loss_work, ieee80211_beacon_loss_work);
+        setup_timer(&ifmgd->timer, ieee80211_sta_timer,
                     (unsigned long) sdata);
-        skb_queue_head_init(&ifsta->skb_queue);
+        setup_timer(&ifmgd->chswitch_timer, ieee80211_chswitch_timer,
+                    (unsigned long) sdata);
+        skb_queue_head_init(&ifmgd->skb_queue);
 
-        ifsta->capab = WLAN_CAPABILITY_ESS;
-        ifsta->auth_algs = IEEE80211_AUTH_ALG_OPEN |
+        ifmgd->capab = WLAN_CAPABILITY_ESS;
+        ifmgd->auth_algs = IEEE80211_AUTH_ALG_OPEN |
                 IEEE80211_AUTH_ALG_SHARED_KEY;
-        ifsta->flags |= IEEE80211_STA_CREATE_IBSS |
+        ifmgd->flags |= IEEE80211_STA_CREATE_IBSS |
                 IEEE80211_STA_AUTO_BSSID_SEL |
                 IEEE80211_STA_AUTO_CHANNEL_SEL;
-        if (ieee80211_num_regular_queues(&sdata->local->hw) >= 4)
-                ifsta->flags |= IEEE80211_STA_WMM_ENABLED;
-}
-
-/*
- * Add a new IBSS station, will also be called by the RX code when,
- * in IBSS mode, receiving a frame from a yet-unknown station, hence
- * must be callable in atomic context.
- */
-struct sta_info *ieee80211_ibss_add_sta(struct ieee80211_sub_if_data *sdata,
-                                        u8 *bssid,u8 *addr, u64 supp_rates)
-{
-        struct ieee80211_local *local = sdata->local;
-        struct sta_info *sta;
-        int band = local->hw.conf.channel->band;
-
-        /* TODO: Could consider removing the least recently used entry and
-         * allow new one to be added. */
-        if (local->num_sta >= IEEE80211_IBSS_MAX_STA_ENTRIES) {
-                if (net_ratelimit()) {
-                        printk(KERN_DEBUG "%s: No room for a new IBSS STA "
-                               "entry %pM\n", sdata->dev->name, addr);
-                }
-                return NULL;
-        }
-
-        if (compare_ether_addr(bssid, sdata->u.sta.bssid))
-                return NULL;
-
-#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
-        printk(KERN_DEBUG "%s: Adding new IBSS station %pM (dev=%s)\n",
-               wiphy_name(local->hw.wiphy), addr, sdata->dev->name);
-#endif
-
-        sta = sta_info_alloc(sdata, addr, GFP_ATOMIC);
-        if (!sta)
-                return NULL;
-
-        set_sta_flags(sta, WLAN_STA_AUTHORIZED);
-
-        /* make sure mandatory rates are always added */
-        sta->sta.supp_rates[band] = supp_rates |
-                        ieee80211_mandatory_rates(local, band);
-
-        rate_control_rate_init(sta);
-
-        if (sta_info_insert(sta))
-                return NULL;
-
-        return sta;
+        if (sdata->local->hw.queues >= 4)
+                ifmgd->flags |= IEEE80211_STA_WMM_ENABLED;
 }
 
 /* configuration hooks */
-void ieee80211_sta_req_auth(struct ieee80211_sub_if_data *sdata,
-                            struct ieee80211_if_sta *ifsta)
+void ieee80211_sta_req_auth(struct ieee80211_sub_if_data *sdata)
 {
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_local *local = sdata->local;
 
-        if (sdata->vif.type != NL80211_IFTYPE_STATION)
+        if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
                 return;
 
-        if ((ifsta->flags & (IEEE80211_STA_BSSID_SET |
+        if ((ifmgd->flags & (IEEE80211_STA_BSSID_SET |
                              IEEE80211_STA_AUTO_BSSID_SEL)) &&
-            (ifsta->flags & (IEEE80211_STA_SSID_SET |
+            (ifmgd->flags & (IEEE80211_STA_SSID_SET |
                              IEEE80211_STA_AUTO_SSID_SEL))) {
 
-                if (ifsta->state == IEEE80211_STA_MLME_ASSOCIATED)
-                        ieee80211_set_disassoc(sdata, ifsta, true, true,
+                if (ifmgd->state == IEEE80211_STA_MLME_ASSOCIATED)
+                        ieee80211_set_disassoc(sdata, true, true,
                                                WLAN_REASON_DEAUTH_LEAVING);
 
-                set_bit(IEEE80211_STA_REQ_AUTH, &ifsta->request);
-                queue_work(local->hw.workqueue, &ifsta->work);
+                if (!(ifmgd->flags & IEEE80211_STA_EXT_SME) ||
+                    ifmgd->state != IEEE80211_STA_MLME_ASSOCIATE)
+                        set_bit(IEEE80211_STA_REQ_AUTH, &ifmgd->request);
+                else if (ifmgd->flags & IEEE80211_STA_EXT_SME)
+                        set_bit(IEEE80211_STA_REQ_RUN, &ifmgd->request);
+                queue_work(local->hw.workqueue, &ifmgd->work);
         }
 }
 
+int ieee80211_sta_commit(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+
+        if (ifmgd->ssid_len)
+                ifmgd->flags |= IEEE80211_STA_SSID_SET;
+        else
+                ifmgd->flags &= ~IEEE80211_STA_SSID_SET;
+
+        return 0;
+}
+
 int ieee80211_sta_set_ssid(struct ieee80211_sub_if_data *sdata, char *ssid, size_t len)
 {
-        struct ieee80211_if_sta *ifsta;
+        struct ieee80211_if_managed *ifmgd;
 
         if (len > IEEE80211_MAX_SSID_LEN)
                 return -EINVAL;
 
-        ifsta = &sdata->u.sta;
-
-        if (ifsta->ssid_len != len || memcmp(ifsta->ssid, ssid, len) != 0) {
-                memset(ifsta->ssid, 0, sizeof(ifsta->ssid));
-                memcpy(ifsta->ssid, ssid, len);
-                ifsta->ssid_len = len;
-                ifsta->flags &= ~IEEE80211_STA_PREV_BSSID_SET;
-        }
-
-        if (len)
-                ifsta->flags |= IEEE80211_STA_SSID_SET;
-        else
-                ifsta->flags &= ~IEEE80211_STA_SSID_SET;
+        ifmgd = &sdata->u.mgd;
 
-        if (sdata->vif.type == NL80211_IFTYPE_ADHOC &&
-            !(ifsta->flags & IEEE80211_STA_BSSID_SET)) {
-                ifsta->ibss_join_req = jiffies;
-                ifsta->state = IEEE80211_STA_MLME_IBSS_SEARCH;
-                return ieee80211_sta_find_ibss(sdata, ifsta);
+        if (ifmgd->ssid_len != len || memcmp(ifmgd->ssid, ssid, len) != 0) {
+                /*
+                 * Do not use reassociation if SSID is changed (different ESS).
+                 */
+                ifmgd->flags &= ~IEEE80211_STA_PREV_BSSID_SET;
+                memset(ifmgd->ssid, 0, sizeof(ifmgd->ssid));
+                memcpy(ifmgd->ssid, ssid, len);
+                ifmgd->ssid_len = len;
         }
 
-        return 0;
+        return ieee80211_sta_commit(sdata);
 }
 
 int ieee80211_sta_get_ssid(struct ieee80211_sub_if_data *sdata, char *ssid, size_t *len)
 {
-        struct ieee80211_if_sta *ifsta = &sdata->u.sta;
-        memcpy(ssid, ifsta->ssid, ifsta->ssid_len);
-        *len = ifsta->ssid_len;
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+        memcpy(ssid, ifmgd->ssid, ifmgd->ssid_len);
+        *len = ifmgd->ssid_len;
         return 0;
 }
 
 int ieee80211_sta_set_bssid(struct ieee80211_sub_if_data *sdata, u8 *bssid)
 {
-        struct ieee80211_if_sta *ifsta;
-        int res;
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 
-        ifsta = &sdata->u.sta;
+        if (is_valid_ether_addr(bssid)) {
+                memcpy(ifmgd->bssid, bssid, ETH_ALEN);
+                ifmgd->flags |= IEEE80211_STA_BSSID_SET;
+        } else {
+                memset(ifmgd->bssid, 0, ETH_ALEN);
+                ifmgd->flags &= ~IEEE80211_STA_BSSID_SET;
+        }
 
-        if (memcmp(ifsta->bssid, bssid, ETH_ALEN) != 0) {
-                memcpy(ifsta->bssid, bssid, ETH_ALEN);
-                res = 0;
-                /*
-                 * Hack! See also ieee80211_sta_set_ssid.
-                 */
-                if (netif_running(sdata->dev))
-                        res = ieee80211_if_config(sdata, IEEE80211_IFCC_BSSID);
-                if (res) {
+        if (netif_running(sdata->dev)) {
+                if (ieee80211_if_config(sdata, IEEE80211_IFCC_BSSID)) {
                         printk(KERN_DEBUG "%s: Failed to config new BSSID to "
                                "the low-level driver\n", sdata->dev->name);
-                        return res;
                 }
         }
 
-        if (is_valid_ether_addr(bssid))
-                ifsta->flags |= IEEE80211_STA_BSSID_SET;
-        else
-                ifsta->flags &= ~IEEE80211_STA_BSSID_SET;
-
-        return 0;
+        return ieee80211_sta_commit(sdata);
 }
 
-int ieee80211_sta_set_extra_ie(struct ieee80211_sub_if_data *sdata, char *ie, size_t len)
+int ieee80211_sta_set_extra_ie(struct ieee80211_sub_if_data *sdata,
+                               const char *ie, size_t len)
 {
-        struct ieee80211_if_sta *ifsta = &sdata->u.sta;
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 
-        kfree(ifsta->extra_ie);
+        kfree(ifmgd->extra_ie);
         if (len == 0) {
-                ifsta->extra_ie = NULL;
-                ifsta->extra_ie_len = 0;
+                ifmgd->extra_ie = NULL;
+                ifmgd->extra_ie_len = 0;
                 return 0;
         }
-        ifsta->extra_ie = kmalloc(len, GFP_KERNEL);
-        if (!ifsta->extra_ie) {
-                ifsta->extra_ie_len = 0;
+        ifmgd->extra_ie = kmalloc(len, GFP_KERNEL);
+        if (!ifmgd->extra_ie) {
+                ifmgd->extra_ie_len = 0;
                 return -ENOMEM;
         }
-        memcpy(ifsta->extra_ie, ie, len);
-        ifsta->extra_ie_len = len;
+        memcpy(ifmgd->extra_ie, ie, len);
+        ifmgd->extra_ie_len = len;
         return 0;
 }
 
 int ieee80211_sta_deauthenticate(struct ieee80211_sub_if_data *sdata, u16 reason)
 {
-        struct ieee80211_if_sta *ifsta = &sdata->u.sta;
-
         printk(KERN_DEBUG "%s: deauthenticating by local choice (reason=%d)\n",
                sdata->dev->name, reason);
 
-        if (sdata->vif.type != NL80211_IFTYPE_STATION &&
-            sdata->vif.type != NL80211_IFTYPE_ADHOC)
+        if (sdata->vif.type != NL80211_IFTYPE_STATION)
                 return -EINVAL;
 
-        ieee80211_set_disassoc(sdata, ifsta, true, true, reason);
+        ieee80211_set_disassoc(sdata, true, true, reason);
         return 0;
 }
 
 int ieee80211_sta_disassociate(struct ieee80211_sub_if_data *sdata, u16 reason)
 {
-        struct ieee80211_if_sta *ifsta = &sdata->u.sta;
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 
         printk(KERN_DEBUG "%s: disassociating by local choice (reason=%d)\n",
                sdata->dev->name, reason);
@@ -2575,10 +2066,10 @@ int ieee80211_sta_disassociate(struct ieee80211_sub_if_data *sdata, u16 reason)
         if (sdata->vif.type != NL80211_IFTYPE_STATION)
                 return -EINVAL;
 
-        if (!(ifsta->flags & IEEE80211_STA_ASSOCIATED))
-                return -1;
+        if (!(ifmgd->flags & IEEE80211_STA_ASSOCIATED))
+                return -ENOLINK;
 
-        ieee80211_set_disassoc(sdata, ifsta, false, true, reason);
+        ieee80211_set_disassoc(sdata, false, true, reason);
         return 0;
 }
 
@@ -2586,15 +2077,6 @@ int ieee80211_sta_disassociate(struct ieee80211_sub_if_data *sdata, u16 reason)
 void ieee80211_mlme_notify_scan_completed(struct ieee80211_local *local)
 {
         struct ieee80211_sub_if_data *sdata = local->scan_sdata;
-        struct ieee80211_if_sta *ifsta;
-
-        if (sdata && sdata->vif.type == NL80211_IFTYPE_ADHOC) {
-                ifsta = &sdata->u.sta;
-                if (!(ifsta->flags & IEEE80211_STA_BSSID_SET) ||
-                    (!(ifsta->state == IEEE80211_STA_MLME_IBSS_JOINED) &&
-                    !ieee80211_sta_active_ibss(sdata)))
-                        ieee80211_sta_find_ibss(sdata, ifsta);
-        }
 
         /* Restart STA timers */
         rcu_read_lock();
@@ -2623,12 +2105,15 @@ void ieee80211_dynamic_ps_enable_work(struct work_struct *work)
         struct ieee80211_local *local =
                 container_of(work, struct ieee80211_local,
                              dynamic_ps_enable_work);
+        struct ieee80211_sub_if_data *sdata = local->scan_sdata;
 
         if (local->hw.conf.flags & IEEE80211_CONF_PS)
                 return;
 
-        local->hw.conf.flags |= IEEE80211_CONF_PS;
+        if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK)
+                ieee80211_send_nullfunc(local, sdata, 1);
 
+        local->hw.conf.flags |= IEEE80211_CONF_PS;
         ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
 }
 
@@ -2638,3 +2123,36 @@ void ieee80211_dynamic_ps_timer(unsigned long data)
 
         queue_work(local->hw.workqueue, &local->dynamic_ps_enable_work);
 }
+
+void ieee80211_send_nullfunc(struct ieee80211_local *local,
+                             struct ieee80211_sub_if_data *sdata,
+                             int powersave)
+{
+        struct sk_buff *skb;
+        struct ieee80211_hdr *nullfunc;
+        __le16 fc;
+
+        if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
+                return;
+
+        skb = dev_alloc_skb(local->hw.extra_tx_headroom + 24);
+        if (!skb) {
+                printk(KERN_DEBUG "%s: failed to allocate buffer for nullfunc "
+                       "frame\n", sdata->dev->name);
+                return;
+        }
+        skb_reserve(skb, local->hw.extra_tx_headroom);
+
+        nullfunc = (struct ieee80211_hdr *) skb_put(skb, 24);
+        memset(nullfunc, 0, 24);
+        fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_NULLFUNC |
+                         IEEE80211_FCTL_TODS);
+        if (powersave)
+                fc |= cpu_to_le16(IEEE80211_FCTL_PM);
+        nullfunc->frame_control = fc;
+        memcpy(nullfunc->addr1, sdata->u.mgd.bssid, ETH_ALEN);
+        memcpy(nullfunc->addr2, sdata->dev->dev_addr, ETH_ALEN);
+        memcpy(nullfunc->addr3, sdata->u.mgd.bssid, ETH_ALEN);
+
+        ieee80211_tx_skb(sdata, skb, 0);
+}
diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c
new file mode 100644
index 000000000000..027302326498
--- /dev/null
+++ b/net/mac80211/pm.c
@@ -0,0 +1,179 @@
+#include <net/mac80211.h>
+#include <net/rtnetlink.h>
+
+#include "ieee80211_i.h"
+#include "led.h"
+
+int __ieee80211_suspend(struct ieee80211_hw *hw)
+{
+        struct ieee80211_local *local = hw_to_local(hw);
+        struct ieee80211_sub_if_data *sdata;
+        struct ieee80211_if_init_conf conf;
+        struct sta_info *sta;
+        unsigned long flags;
+
+        ieee80211_stop_queues_by_reason(hw,
+                        IEEE80211_QUEUE_STOP_REASON_SUSPEND);
+
+        flush_workqueue(local->hw.workqueue);
+
+        /* disable keys */
+        list_for_each_entry(sdata, &local->interfaces, list)
+                ieee80211_disable_keys(sdata);
+
+        /* Tear down aggregation sessions */
+
+        rcu_read_lock();
+
+        if (hw->flags & IEEE80211_HW_AMPDU_AGGREGATION) {
+                list_for_each_entry_rcu(sta, &local->sta_list, list) {
+                        set_sta_flags(sta, WLAN_STA_SUSPEND);
+                        ieee80211_sta_tear_down_BA_sessions(sta);
+                }
+        }
+
+        rcu_read_unlock();
+
+        /* remove STAs */
+        if (local->ops->sta_notify) {
+                spin_lock_irqsave(&local->sta_lock, flags);
+                list_for_each_entry(sta, &local->sta_list, list) {
+                        if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
+                                sdata = container_of(sdata->bss,
+                                             struct ieee80211_sub_if_data,
+                                             u.ap);
+
+                        local->ops->sta_notify(hw, &sdata->vif,
+                                STA_NOTIFY_REMOVE, &sta->sta);
+                }
+                spin_unlock_irqrestore(&local->sta_lock, flags);
+        }
+
+        /* remove all interfaces */
+        list_for_each_entry(sdata, &local->interfaces, list) {
+                if (sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
+                    sdata->vif.type != NL80211_IFTYPE_MONITOR &&
+                    netif_running(sdata->dev)) {
+                        conf.vif = &sdata->vif;
+                        conf.type = sdata->vif.type;
+                        conf.mac_addr = sdata->dev->dev_addr;
+                        local->ops->remove_interface(hw, &conf);
+                }
+        }
+
+        /* flush again, in case driver queued work */
+        flush_workqueue(local->hw.workqueue);
+
+        /* stop hardware */
+        if (local->open_count) {
+                ieee80211_led_radio(local, false);
+                local->ops->stop(hw);
+        }
+        return 0;
+}
+
+int __ieee80211_resume(struct ieee80211_hw *hw)
+{
+        struct ieee80211_local *local = hw_to_local(hw);
+        struct ieee80211_sub_if_data *sdata;
+        struct ieee80211_if_init_conf conf;
+        struct sta_info *sta;
+        unsigned long flags;
+        int res;
+
+        /* restart hardware */
+        if (local->open_count) {
+                res = local->ops->start(hw);
+
+                ieee80211_led_radio(local, hw->conf.radio_enabled);
+        }
+
+        /* add interfaces */
+        list_for_each_entry(sdata, &local->interfaces, list) {
+                if (sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
+                    sdata->vif.type != NL80211_IFTYPE_MONITOR &&
+                    netif_running(sdata->dev)) {
+                        conf.vif = &sdata->vif;
+                        conf.type = sdata->vif.type;
+                        conf.mac_addr = sdata->dev->dev_addr;
+                        res = local->ops->add_interface(hw, &conf);
+                }
+        }
+
+        /* add STAs back */
+        if (local->ops->sta_notify) {
+                spin_lock_irqsave(&local->sta_lock, flags);
+                list_for_each_entry(sta, &local->sta_list, list) {
+                        if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
+                                sdata = container_of(sdata->bss,
+                                             struct ieee80211_sub_if_data,
+                                             u.ap);
+
+                        local->ops->sta_notify(hw, &sdata->vif,
+                                STA_NOTIFY_ADD, &sta->sta);
+                }
+                spin_unlock_irqrestore(&local->sta_lock, flags);
+        }
+
+        /* Clear Suspend state so that ADDBA requests can be processed */
+
+        rcu_read_lock();
+
+        if (hw->flags & IEEE80211_HW_AMPDU_AGGREGATION) {
+                list_for_each_entry_rcu(sta, &local->sta_list, list) {
+                        clear_sta_flags(sta, WLAN_STA_SUSPEND);
+                }
+        }
+
+        rcu_read_unlock();
+
+        /* add back keys */
+        list_for_each_entry(sdata, &local->interfaces, list)
+                if (netif_running(sdata->dev))
+                        ieee80211_enable_keys(sdata);
+
+        /* setup RTS threshold */
+        if (local->ops->set_rts_threshold)
+                local->ops->set_rts_threshold(hw, local->rts_threshold);
+
+        /* reconfigure hardware */
+        ieee80211_hw_config(local, ~0);
+
+        netif_addr_lock_bh(local->mdev);
+        ieee80211_configure_filter(local);
+        netif_addr_unlock_bh(local->mdev);
+
+        /* Finally also reconfigure all the BSS information */
+        list_for_each_entry(sdata, &local->interfaces, list) {
+                u32 changed = ~0;
+                if (!netif_running(sdata->dev))
+                        continue;
+                switch (sdata->vif.type) {
+                case NL80211_IFTYPE_STATION:
+                        /* disable beacon change bits */
+                        changed &= ~IEEE80211_IFCC_BEACON;
+                        /* fall through */
+                case NL80211_IFTYPE_ADHOC:
+                case NL80211_IFTYPE_AP:
+                case NL80211_IFTYPE_MESH_POINT:
+                        WARN_ON(ieee80211_if_config(sdata, changed));
+                        ieee80211_bss_info_change_notify(sdata, ~0);
+                        break;
+                case NL80211_IFTYPE_WDS:
+                        break;
+                case NL80211_IFTYPE_AP_VLAN:
+                case NL80211_IFTYPE_MONITOR:
+                        /* ignore virtual */
+                        break;
+                case NL80211_IFTYPE_UNSPECIFIED:
+                case __NL80211_IFTYPE_AFTER_LAST:
+                        WARN_ON(1);
+                        break;
+                }
+        }
+
+        ieee80211_wake_queues_by_reason(hw,
+                        IEEE80211_QUEUE_STOP_REASON_SUSPEND);
+
+        return 0;
+}
diff --git a/net/mac80211/rate.c b/net/mac80211/rate.c
index 3fa7ab285066..4641f00a1e5c 100644
--- a/net/mac80211/rate.c
+++ b/net/mac80211/rate.c
@@ -219,10 +219,12 @@ void rate_control_get_rate(struct ieee80211_sub_if_data *sdata,
                 info->control.rates[i].count = 1;
         }
 
-        if (sta && sdata->force_unicast_rateidx > -1)
+        if (sta && sdata->force_unicast_rateidx > -1) {
                 info->control.rates[0].idx = sdata->force_unicast_rateidx;
-        else
+        } else {
                 ref->ops->get_rate(ref->priv, ista, priv_sta, txrc);
+                info->flags |= IEEE80211_TX_INTFL_RCALGO;
+        }
 
         /*
          * try to enforce the maximum rate the user wanted
diff --git a/net/mac80211/rate.h b/net/mac80211/rate.h
index 928da625e281..2ab5ad9e71ce 100644
--- a/net/mac80211/rate.h
+++ b/net/mac80211/rate.h
@@ -44,8 +44,10 @@ static inline void rate_control_tx_status(struct ieee80211_local *local,
         struct rate_control_ref *ref = local->rate_ctrl;
         struct ieee80211_sta *ista = &sta->sta;
         void *priv_sta = sta->rate_ctrl_priv;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 
-        ref->ops->tx_status(ref->priv, sband, ista, priv_sta, skb);
+        if (likely(info->flags & IEEE80211_TX_INTFL_RCALGO))
+                ref->ops->tx_status(ref->priv, sband, ista, priv_sta, skb);
 }
 
 
@@ -62,6 +64,18 @@ static inline void rate_control_rate_init(struct sta_info *sta)
         ref->ops->rate_init(ref->priv, sband, ista, priv_sta);
 }
 
+static inline void rate_control_rate_update(struct ieee80211_local *local,
+                                    struct ieee80211_supported_band *sband,
+                                    struct sta_info *sta, u32 changed)
+{
+        struct rate_control_ref *ref = local->rate_ctrl;
+        struct ieee80211_sta *ista = &sta->sta;
+        void *priv_sta = sta->rate_ctrl_priv;
+
+        if (ref->ops->rate_update)
+                ref->ops->rate_update(ref->priv, sband, ista,
+                                      priv_sta, changed);
+}
 
 static inline void *rate_control_alloc_sta(struct rate_control_ref *ref,
                                            struct ieee80211_sta *sta,
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 7175ae80c36a..64ebe664effc 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -86,8 +86,7 @@ ieee80211_rx_radiotap_len(struct ieee80211_local *local,
 
         if (status->flag & RX_FLAG_TSFT)
                 len += 8;
-        if (local->hw.flags & IEEE80211_HW_SIGNAL_DB ||
-            local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
+        if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
                 len += 1;
         if (local->hw.flags & IEEE80211_HW_NOISE_DBM)
                 len += 1;
@@ -102,7 +101,7 @@ ieee80211_rx_radiotap_len(struct ieee80211_local *local,
         return len;
 }
 
-/**
+/*
  * ieee80211_add_rx_radiotap_header - add radiotap header
  *
  * add a radiotap header containing all the fields which the hardware provided.
@@ -143,6 +142,8 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
         /* IEEE80211_RADIOTAP_FLAGS */
         if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)
                 *pos |= IEEE80211_RADIOTAP_F_FCS;
+        if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
+                *pos |= IEEE80211_RADIOTAP_F_BADFCS;
         if (status->flag & RX_FLAG_SHORTPRE)
                 *pos |= IEEE80211_RADIOTAP_F_SHORTPRE;
         pos++;
@@ -158,7 +159,7 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
                  */
                 *pos = 0;
         } else {
-                rthdr->it_present |= (1 << IEEE80211_RADIOTAP_RATE);
+                rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_RATE);
                 *pos = rate->bitrate / 5;
         }
         pos++;
@@ -199,23 +200,14 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
         *pos = status->antenna;
         pos++;
 
-        /* IEEE80211_RADIOTAP_DB_ANTSIGNAL */
-        if (local->hw.flags & IEEE80211_HW_SIGNAL_DB) {
-                *pos = status->signal;
-                rthdr->it_present |=
-                        cpu_to_le32(1 << IEEE80211_RADIOTAP_DB_ANTSIGNAL);
-                pos++;
-        }
-
         /* IEEE80211_RADIOTAP_DB_ANTNOISE is not used */
 
         /* IEEE80211_RADIOTAP_RX_FLAGS */
         /* ensure 2 byte alignment for the 2 byte field as required */
         if ((pos - (unsigned char *)rthdr) & 1)
                 pos++;
-        /* FIXME: when radiotap gets a 'bad PLCP' flag use it here */
-        if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
-                *(__le16 *)pos |= cpu_to_le16(IEEE80211_RADIOTAP_F_RX_BADFCS);
+        if (status->flag & RX_FLAG_FAILED_PLCP_CRC)
+                *(__le16 *)pos |= cpu_to_le16(IEEE80211_RADIOTAP_F_RX_BADPLCP);
         pos += 2;
 }
 
@@ -371,39 +363,50 @@ static void ieee80211_parse_qos(struct ieee80211_rx_data *rx)
         rx->skb->priority = (tid > 7) ? 0 : tid;
 }
 
-static void ieee80211_verify_ip_alignment(struct ieee80211_rx_data *rx)
+/**
+ * DOC: Packet alignment
+ *
+ * Drivers always need to pass packets that are aligned to two-byte boundaries
+ * to the stack.
+ *
+ * Additionally, should, if possible, align the payload data in a way that
+ * guarantees that the contained IP header is aligned to a four-byte
+ * boundary. In the case of regular frames, this simply means aligning the
+ * payload to a four-byte boundary (because either the IP header is directly
+ * contained, or IV/RFC1042 headers that have a length divisible by four are
+ * in front of it).
+ *
+ * With A-MSDU frames, however, the payload data address must yield two modulo
+ * four because there are 14-byte 802.3 headers within the A-MSDU frames that
+ * push the IP header further back to a multiple of four again. Thankfully, the
+ * specs were sane enough this time around to require padding each A-MSDU
+ * subframe to a length that is a multiple of four.
+ *
+ * Padding like Atheros hardware adds which is inbetween the 802.11 header and
+ * the payload is not supported, the driver is required to move the 802.11
+ * header to be directly in front of the payload in that case.
+ */
+static void ieee80211_verify_alignment(struct ieee80211_rx_data *rx)
 {
-#ifdef CONFIG_MAC80211_DEBUG_PACKET_ALIGNMENT
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
         int hdrlen;
 
+#ifndef CONFIG_MAC80211_DEBUG_PACKET_ALIGNMENT
+        return;
+#endif
+
+        if (WARN_ONCE((unsigned long)rx->skb->data & 1,
+                      "unaligned packet at 0x%p\n", rx->skb->data))
+                return;
+
         if (!ieee80211_is_data_present(hdr->frame_control))
                 return;
 
-        /*
-         * Drivers are required to align the payload data in a way that
-         * guarantees that the contained IP header is aligned to a four-
-         * byte boundary. In the case of regular frames, this simply means
-         * aligning the payload to a four-byte boundary (because either
-         * the IP header is directly contained, or IV/RFC1042 headers that
-         * have a length divisible by four are in front of it.
-         *
-         * With A-MSDU frames, however, the payload data address must
-         * yield two modulo four because there are 14-byte 802.3 headers
-         * within the A-MSDU frames that push the IP header further back
-         * to a multiple of four again. Thankfully, the specs were sane
-         * enough this time around to require padding each A-MSDU subframe
-         * to a length that is a multiple of four.
-         *
-         * Padding like atheros hardware adds which is inbetween the 802.11
-         * header and the payload is not supported, the driver is required
-         * to move the 802.11 header further back in that case.
-         */
         hdrlen = ieee80211_hdrlen(hdr->frame_control);
         if (rx->flags & IEEE80211_RX_AMSDU)
                 hdrlen += ETH_HLEN;
-        WARN_ON_ONCE(((unsigned long)(rx->skb->data + hdrlen)) & 3);
-#endif
+        WARN_ONCE(((unsigned long)(rx->skb->data + hdrlen)) & 3,
+                  "unaligned IP payload at 0x%p\n", rx->skb->data + hdrlen);
 }
 
 
@@ -435,6 +438,52 @@ ieee80211_rx_h_passive_scan(struct ieee80211_rx_data *rx)
         return RX_CONTINUE;
 }
 
+
+static int ieee80211_is_unicast_robust_mgmt_frame(struct sk_buff *skb)
+{
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
+
+        if (skb->len < 24 || is_multicast_ether_addr(hdr->addr1))
+                return 0;
+
+        return ieee80211_is_robust_mgmt_frame(hdr);
+}
+
+
+static int ieee80211_is_multicast_robust_mgmt_frame(struct sk_buff *skb)
+{
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
+
+        if (skb->len < 24 || !is_multicast_ether_addr(hdr->addr1))
+                return 0;
+
+        return ieee80211_is_robust_mgmt_frame(hdr);
+}
+
+
+/* Get the BIP key index from MMIE; return -1 if this is not a BIP frame */
+static int ieee80211_get_mmie_keyidx(struct sk_buff *skb)
+{
+        struct ieee80211_mgmt *hdr = (struct ieee80211_mgmt *) skb->data;
+        struct ieee80211_mmie *mmie;
+
+        if (skb->len < 24 + sizeof(*mmie) ||
+            !is_multicast_ether_addr(hdr->da))
+                return -1;
+
+        if (!ieee80211_is_robust_mgmt_frame((struct ieee80211_hdr *) hdr))
+                return -1; /* not a robust management frame */
+
+        mmie = (struct ieee80211_mmie *)
+                (skb->data + skb->len - sizeof(*mmie));
+        if (mmie->element_id != WLAN_EID_MMIE ||
+            mmie->length != sizeof(*mmie) - 2)
+                return -1;
+
+        return le16_to_cpu(mmie->key_id);
+}
+
+
 static ieee80211_rx_result
 ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
 {
@@ -550,21 +599,23 @@ ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
         int hdrlen;
         ieee80211_rx_result result = RX_DROP_UNUSABLE;
         struct ieee80211_key *stakey = NULL;
+        int mmie_keyidx = -1;
 
         /*
          * Key selection 101
          *
-         * There are three types of keys:
+         * There are four types of keys:
          *  - GTK (group keys)
+         *  - IGTK (group keys for management frames)
          *  - PTK (pairwise keys)
          *  - STK (station-to-station pairwise keys)
          *
          * When selecting a key, we have to distinguish between multicast
          * (including broadcast) and unicast frames, the latter can only
-         * use PTKs and STKs while the former always use GTKs. Unless, of
-         * course, actual WEP keys ("pre-RSNA") are used, then unicast
-         * frames can also use key indizes like GTKs. Hence, if we don't
-         * have a PTK/STK we check the key index for a WEP key.
+         * use PTKs and STKs while the former always use GTKs and IGTKs.
+         * Unless, of course, actual WEP keys ("pre-RSNA") are used, then
+         * unicast frames can also use key indices like GTKs. Hence, if we
+         * don't have a PTK/STK we check the key index for a WEP key.
          *
          * Note that in a regular BSS, multicast frames are sent by the
          * AP only, associated stations unicast the frame to the AP first
@@ -577,8 +628,14 @@ ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
          * possible.
          */
 
-        if (!ieee80211_has_protected(hdr->frame_control))
-                return RX_CONTINUE;
+        if (!ieee80211_has_protected(hdr->frame_control)) {
+                if (!ieee80211_is_mgmt(hdr->frame_control) ||
+                    rx->sta == NULL || !test_sta_flags(rx->sta, WLAN_STA_MFP))
+                        return RX_CONTINUE;
+                mmie_keyidx = ieee80211_get_mmie_keyidx(rx->skb);
+                if (mmie_keyidx < 0)
+                        return RX_CONTINUE;
+        }
 
         /*
          * No point in finding a key and decrypting if the frame is neither
@@ -592,6 +649,16 @@ ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
 
         if (!is_multicast_ether_addr(hdr->addr1) && stakey) {
                 rx->key = stakey;
+        } else if (mmie_keyidx >= 0) {
+                /* Broadcast/multicast robust management frame / BIP */
+                if ((rx->status->flag & RX_FLAG_DECRYPTED) &&
+                    (rx->status->flag & RX_FLAG_IV_STRIPPED))
+                        return RX_CONTINUE;
+
+                if (mmie_keyidx < NUM_DEFAULT_KEYS ||
+                    mmie_keyidx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS)
+                        return RX_DROP_MONITOR; /* unexpected BIP keyidx */
+                rx->key = rcu_dereference(rx->sdata->keys[mmie_keyidx]);
         } else {
                 /*
                  * The device doesn't give us the IV so we won't be
@@ -654,6 +721,9 @@ ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
         case ALG_CCMP:
                 result = ieee80211_crypto_ccmp_decrypt(rx);
                 break;
+        case ALG_AES_CMAC:
+                result = ieee80211_crypto_aes_cmac_decrypt(rx);
+                break;
         }
 
         /* either the frame has been decrypted or will be dropped */
@@ -662,6 +732,39 @@ ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
         return result;
 }
 
+static ieee80211_rx_result debug_noinline
+ieee80211_rx_h_check_more_data(struct ieee80211_rx_data *rx)
+{
+        struct ieee80211_local *local;
+        struct ieee80211_hdr *hdr;
+        struct sk_buff *skb;
+
+        local = rx->local;
+        skb = rx->skb;
+        hdr = (struct ieee80211_hdr *) skb->data;
+
+        if (!local->pspolling)
+                return RX_CONTINUE;
+
+        if (!ieee80211_has_fromds(hdr->frame_control))
+                /* this is not from AP */
+                return RX_CONTINUE;
+
+        if (!ieee80211_is_data(hdr->frame_control))
+                return RX_CONTINUE;
+
+        if (!ieee80211_has_moredata(hdr->frame_control)) {
+                /* AP has no more frames buffered for us */
+                local->pspolling = false;
+                return RX_CONTINUE;
+        }
+
+        /* more data bit is set, let's request a new frame from the AP */
+        ieee80211_send_pspoll(local, rx->sdata);
+
+        return RX_CONTINUE;
+}
+
 static void ap_sta_ps_start(struct sta_info *sta)
 {
         struct ieee80211_sub_if_data *sdata = sta->sdata;
@@ -736,7 +839,7 @@ ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
         if (rx->sdata->vif.type == NL80211_IFTYPE_ADHOC) {
                 u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len,
                                                 NL80211_IFTYPE_ADHOC);
-                if (compare_ether_addr(bssid, rx->sdata->u.sta.bssid) == 0)
+                if (compare_ether_addr(bssid, rx->sdata->u.ibss.bssid) == 0)
                         sta->last_rx = jiffies;
         } else
         if (!is_multicast_ether_addr(hdr->addr1) ||
@@ -747,12 +850,19 @@ ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
                  * Mesh beacons will update last_rx when if they are found to
                  * match the current local configuration when processed.
                  */
-                sta->last_rx = jiffies;
+                if (rx->sdata->vif.type == NL80211_IFTYPE_STATION &&
+                    ieee80211_is_beacon(hdr->frame_control)) {
+                        rx->sdata->u.mgd.last_beacon = jiffies;
+                } else
+                        sta->last_rx = jiffies;
         }
 
         if (!(rx->flags & IEEE80211_RX_RA_MATCH))
                 return RX_CONTINUE;
 
+        if (rx->sdata->vif.type == NL80211_IFTYPE_STATION)
+                ieee80211_sta_rx_notify(rx->sdata, hdr);
+
         sta->rx_fragments++;
         sta->rx_bytes += rx->skb->len;
         sta->last_signal = rx->status->signal;
@@ -1101,6 +1211,15 @@ ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc)
         /* Drop unencrypted frames if key is set. */
         if (unlikely(!ieee80211_has_protected(fc) &&
                      !ieee80211_is_nullfunc(fc) &&
+                     (!ieee80211_is_mgmt(fc) ||
+                      (ieee80211_is_unicast_robust_mgmt_frame(rx->skb) &&
+                       rx->sta && test_sta_flags(rx->sta, WLAN_STA_MFP))) &&
+                     (rx->key || rx->sdata->drop_unencrypted)))
+                return -EACCES;
+        /* BIP does not use Protected field, so need to check MMIE */
+        if (unlikely(rx->sta && test_sta_flags(rx->sta, WLAN_STA_MFP) &&
+                     ieee80211_is_multicast_robust_mgmt_frame(rx->skb) &&
+                     ieee80211_get_mmie_keyidx(rx->skb) < 0 &&
                      (rx->key || rx->sdata->drop_unencrypted)))
                 return -EACCES;
 
@@ -1138,12 +1257,12 @@ ieee80211_data_to_8023(struct ieee80211_rx_data *rx)
 
         switch (hdr->frame_control &
                 cpu_to_le16(IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) {
-        case __constant_cpu_to_le16(IEEE80211_FCTL_TODS):
+        case cpu_to_le16(IEEE80211_FCTL_TODS):
                 if (unlikely(sdata->vif.type != NL80211_IFTYPE_AP &&
                              sdata->vif.type != NL80211_IFTYPE_AP_VLAN))
                         return -1;
                 break;
-        case __constant_cpu_to_le16(IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS):
+        case cpu_to_le16(IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS):
                 if (unlikely(sdata->vif.type != NL80211_IFTYPE_WDS &&
                              sdata->vif.type != NL80211_IFTYPE_MESH_POINT))
                         return -1;
@@ -1157,13 +1276,13 @@ ieee80211_data_to_8023(struct ieee80211_rx_data *rx)
                         }
                 }
                 break;
-        case __constant_cpu_to_le16(IEEE80211_FCTL_FROMDS):
+        case cpu_to_le16(IEEE80211_FCTL_FROMDS):
                 if (sdata->vif.type != NL80211_IFTYPE_STATION ||
                     (is_multicast_ether_addr(dst) &&
                      !compare_ether_addr(src, dev->dev_addr)))
                         return -1;
                 break;
-        case __constant_cpu_to_le16(0):
+        case cpu_to_le16(0):
                 if (sdata->vif.type != NL80211_IFTYPE_ADHOC)
                         return -1;
                 break;
@@ -1267,10 +1386,37 @@ ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
         }
 
         if (skb) {
-                /* deliver to local stack */
-                skb->protocol = eth_type_trans(skb, dev);
-                memset(skb->cb, 0, sizeof(skb->cb));
-                netif_rx(skb);
+                int align __maybe_unused;
+
+#if defined(CONFIG_MAC80211_DEBUG_PACKET_ALIGNMENT) || !defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS)
+                /*
+                 * 'align' will only take the values 0 or 2 here
+                 * since all frames are required to be aligned
+                 * to 2-byte boundaries when being passed to
+                 * mac80211. That also explains the __skb_push()
+                 * below.
+                 */
+                align = (unsigned long)skb->data & 4;
+                if (align) {
+                        if (WARN_ON(skb_headroom(skb) < 3)) {
+                                dev_kfree_skb(skb);
+                                skb = NULL;
+                        } else {
+                                u8 *data = skb->data;
+                                size_t len = skb->len;
+                                u8 *new = __skb_push(skb, align);
+                                memmove(new, data, len);
+                                __skb_trim(skb, len);
+                        }
+                }
+#endif
+
+                if (skb) {
+                        /* deliver to local stack */
+                        skb->protocol = eth_type_trans(skb, dev);
+                        memset(skb->cb, 0, sizeof(skb->cb));
+                        netif_rx(skb);
+                }
         }
 
         if (xmit_skb) {
@@ -1339,14 +1485,20 @@ ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
                 if (remaining <= subframe_len + padding)
                         frame = skb;
                 else {
-                        frame = dev_alloc_skb(local->hw.extra_tx_headroom +
-                                              subframe_len);
+                        /*
+                         * Allocate and reserve two bytes more for payload
+                         * alignment since sizeof(struct ethhdr) is 14.
+                         */
+                        frame = dev_alloc_skb(
+                                ALIGN(local->hw.extra_tx_headroom, 4) +
+                                subframe_len + 2);
 
                         if (frame == NULL)
                                 return RX_DROP_UNUSABLE;
 
-                        skb_reserve(frame, local->hw.extra_tx_headroom +
-                                    sizeof(struct ethhdr));
+                        skb_reserve(frame,
+                                    ALIGN(local->hw.extra_tx_headroom, 4) +
+                                    sizeof(struct ethhdr) + 2);
                         memcpy(skb_put(frame, ntohs(len)), skb->data,
                                 ntohs(len));
 
@@ -1529,11 +1681,9 @@ ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx)
                 start_seq_num = le16_to_cpu(bar->start_seq_num) >> 4;
 
                 /* reset session timer */
-                if (tid_agg_rx->timeout) {
-                        unsigned long expires =
-                                jiffies + (tid_agg_rx->timeout / 1000) * HZ;
-                        mod_timer(&tid_agg_rx->session_timer, expires);
-                }
+                if (tid_agg_rx->timeout)
+                        mod_timer(&tid_agg_rx->session_timer,
+                                  TU_TO_EXP_TIME(tid_agg_rx->timeout));
 
                 /* manage reordering buffer according to requested */
                 /* sequence number */
@@ -1547,12 +1697,64 @@ ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx)
         return RX_CONTINUE;
 }
 
+static void ieee80211_process_sa_query_req(struct ieee80211_sub_if_data *sdata,
+                                           struct ieee80211_mgmt *mgmt,
+                                           size_t len)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct sk_buff *skb;
+        struct ieee80211_mgmt *resp;
+
+        if (compare_ether_addr(mgmt->da, sdata->dev->dev_addr) != 0) {
+                /* Not to own unicast address */
+                return;
+        }
+
+        if (compare_ether_addr(mgmt->sa, sdata->u.mgd.bssid) != 0 ||
+            compare_ether_addr(mgmt->bssid, sdata->u.mgd.bssid) != 0) {
+                /* Not from the current AP. */
+                return;
+        }
+
+        if (sdata->u.mgd.state == IEEE80211_STA_MLME_ASSOCIATE) {
+                /* Association in progress; ignore SA Query */
+                return;
+        }
+
+        if (len < 24 + 1 + sizeof(resp->u.action.u.sa_query)) {
+                /* Too short SA Query request frame */
+                return;
+        }
+
+        skb = dev_alloc_skb(sizeof(*resp) + local->hw.extra_tx_headroom);
+        if (skb == NULL)
+                return;
+
+        skb_reserve(skb, local->hw.extra_tx_headroom);
+        resp = (struct ieee80211_mgmt *) skb_put(skb, 24);
+        memset(resp, 0, 24);
+        memcpy(resp->da, mgmt->sa, ETH_ALEN);
+        memcpy(resp->sa, sdata->dev->dev_addr, ETH_ALEN);
+        memcpy(resp->bssid, sdata->u.mgd.bssid, ETH_ALEN);
+        resp->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
+                                          IEEE80211_STYPE_ACTION);
+        skb_put(skb, 1 + sizeof(resp->u.action.u.sa_query));
+        resp->u.action.category = WLAN_CATEGORY_SA_QUERY;
+        resp->u.action.u.sa_query.action = WLAN_ACTION_SA_QUERY_RESPONSE;
+        memcpy(resp->u.action.u.sa_query.trans_id,
+               mgmt->u.action.u.sa_query.trans_id,
+               WLAN_SA_QUERY_TR_ID_LEN);
+
+        ieee80211_tx_skb(sdata, skb, 1);
+}
+
 static ieee80211_rx_result debug_noinline
 ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
 {
         struct ieee80211_local *local = rx->local;
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(rx->dev);
         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
+        struct ieee80211_bss *bss;
         int len = rx->skb->len;
 
         if (!ieee80211_is_action(mgmt->frame_control))
@@ -1564,12 +1766,26 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
         if (!(rx->flags & IEEE80211_RX_RA_MATCH))
                 return RX_DROP_MONITOR;
 
+        if (ieee80211_drop_unencrypted(rx, mgmt->frame_control))
+                return RX_DROP_MONITOR;
+
         /* all categories we currently handle have action_code */
         if (len < IEEE80211_MIN_ACTION_SIZE + 1)
                 return RX_DROP_MONITOR;
 
         switch (mgmt->u.action.category) {
         case WLAN_CATEGORY_BACK:
+                /*
+                 * The aggregation code is not prepared to handle
+                 * anything but STA/AP due to the BSSID handling;
+                 * IBSS could work in the code but isn't supported
+                 * by drivers or the standard.
+                 */
+                if (sdata->vif.type != NL80211_IFTYPE_STATION &&
+                    sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
+                    sdata->vif.type != NL80211_IFTYPE_AP)
+                        return RX_DROP_MONITOR;
+
                 switch (mgmt->u.action.u.addba_req.action_code) {
                 case WLAN_ACTION_ADDBA_REQ:
                         if (len < (IEEE80211_MIN_ACTION_SIZE +
@@ -1594,6 +1810,10 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
         case WLAN_CATEGORY_SPECTRUM_MGMT:
                 if (local->hw.conf.channel->band != IEEE80211_BAND_5GHZ)
                         return RX_DROP_MONITOR;
+
+                if (sdata->vif.type != NL80211_IFTYPE_STATION)
+                        return RX_DROP_MONITOR;
+
                 switch (mgmt->u.action.u.measurement.action_code) {
                 case WLAN_ACTION_SPCT_MSR_REQ:
                         if (len < (IEEE80211_MIN_ACTION_SIZE +
@@ -1601,6 +1821,43 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
                                 return RX_DROP_MONITOR;
                         ieee80211_process_measurement_req(sdata, mgmt, len);
                         break;
+                case WLAN_ACTION_SPCT_CHL_SWITCH:
+                        if (len < (IEEE80211_MIN_ACTION_SIZE +
+                                   sizeof(mgmt->u.action.u.chan_switch)))
+                                return RX_DROP_MONITOR;
+
+                        if (memcmp(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN))
+                                return RX_DROP_MONITOR;
+
+                        bss = ieee80211_rx_bss_get(local, sdata->u.mgd.bssid,
+                                           local->hw.conf.channel->center_freq,
+                                           sdata->u.mgd.ssid,
+                                           sdata->u.mgd.ssid_len);
+                        if (!bss)
+                                return RX_DROP_MONITOR;
+
+                        ieee80211_process_chanswitch(sdata,
+                                     &mgmt->u.action.u.chan_switch.sw_elem, bss);
+                        ieee80211_rx_bss_put(local, bss);
+                        break;
+                }
+                break;
+        case WLAN_CATEGORY_SA_QUERY:
+                if (len < (IEEE80211_MIN_ACTION_SIZE +
+                           sizeof(mgmt->u.action.u.sa_query)))
+                        return RX_DROP_MONITOR;
+                switch (mgmt->u.action.u.sa_query.action) {
+                case WLAN_ACTION_SA_QUERY_REQUEST:
+                        if (sdata->vif.type != NL80211_IFTYPE_STATION)
+                                return RX_DROP_MONITOR;
+                        ieee80211_process_sa_query_req(sdata, mgmt, len);
+                        break;
+                case WLAN_ACTION_SA_QUERY_RESPONSE:
+                        /*
+                         * SA Query response is currently only used in AP mode
+                         * and it is processed in user space.
+                         */
+                        return RX_CONTINUE;
                 }
                 break;
         default:
@@ -1616,22 +1873,24 @@ static ieee80211_rx_result debug_noinline
 ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(rx->dev);
+        struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
 
         if (!(rx->flags & IEEE80211_RX_RA_MATCH))
                 return RX_DROP_MONITOR;
 
+        if (ieee80211_drop_unencrypted(rx, mgmt->frame_control))
+                return RX_DROP_MONITOR;
+
         if (ieee80211_vif_is_mesh(&sdata->vif))
                 return ieee80211_mesh_rx_mgmt(sdata, rx->skb, rx->status);
 
-        if (sdata->vif.type != NL80211_IFTYPE_STATION &&
-            sdata->vif.type != NL80211_IFTYPE_ADHOC)
-                return RX_DROP_MONITOR;
+        if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
+                return ieee80211_ibss_rx_mgmt(sdata, rx->skb, rx->status);
 
-        if (sdata->flags & IEEE80211_SDATA_USERSPACE_MLME)
-                return RX_DROP_MONITOR;
+        if (sdata->vif.type == NL80211_IFTYPE_STATION)
+                return ieee80211_sta_rx_mgmt(sdata, rx->skb, rx->status);
 
-        ieee80211_sta_rx_mgmt(sdata, rx->skb, rx->status);
-        return RX_QUEUED;
+        return RX_DROP_MONITOR;
 }
 
 static void ieee80211_rx_michael_mic_report(struct net_device *dev,
@@ -1780,6 +2039,7 @@ static void ieee80211_invoke_rx_handlers(struct ieee80211_sub_if_data *sdata,
         CALL_RXH(ieee80211_rx_h_passive_scan)
         CALL_RXH(ieee80211_rx_h_check)
         CALL_RXH(ieee80211_rx_h_decrypt)
+        CALL_RXH(ieee80211_rx_h_check_more_data)
         CALL_RXH(ieee80211_rx_h_sta_process)
         CALL_RXH(ieee80211_rx_h_defragment)
         CALL_RXH(ieee80211_rx_h_ps_poll)
@@ -1823,16 +2083,17 @@ static void ieee80211_invoke_rx_handlers(struct ieee80211_sub_if_data *sdata,
 /* main receive path */
 
 static int prepare_for_handlers(struct ieee80211_sub_if_data *sdata,
-                                u8 *bssid, struct ieee80211_rx_data *rx,
+                                struct ieee80211_rx_data *rx,
                                 struct ieee80211_hdr *hdr)
 {
+        u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len, sdata->vif.type);
         int multicast = is_multicast_ether_addr(hdr->addr1);
 
         switch (sdata->vif.type) {
         case NL80211_IFTYPE_STATION:
                 if (!bssid)
                         return 0;
-                if (!ieee80211_bssid_match(bssid, sdata->u.sta.bssid)) {
+                if (!ieee80211_bssid_match(bssid, sdata->u.mgd.bssid)) {
                         if (!(rx->flags & IEEE80211_RX_IN_SCAN))
                                 return 0;
                         rx->flags &= ~IEEE80211_RX_RA_MATCH;
@@ -1850,7 +2111,7 @@ static int prepare_for_handlers(struct ieee80211_sub_if_data *sdata,
                 if (ieee80211_is_beacon(hdr->frame_control)) {
                         return 1;
                 }
-                else if (!ieee80211_bssid_match(bssid, sdata->u.sta.bssid)) {
+                else if (!ieee80211_bssid_match(bssid, sdata->u.ibss.bssid)) {
                         if (!(rx->flags & IEEE80211_RX_IN_SCAN))
                                 return 0;
                         rx->flags &= ~IEEE80211_RX_RA_MATCH;
@@ -1928,7 +2189,6 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
         int prepares;
         struct ieee80211_sub_if_data *prev = NULL;
         struct sk_buff *skb_new;
-        u8 *bssid;
 
         hdr = (struct ieee80211_hdr *)skb->data;
         memset(&rx, 0, sizeof(rx));
@@ -1956,7 +2216,7 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
                 rx.flags |= IEEE80211_RX_IN_SCAN;
 
         ieee80211_parse_qos(&rx);
-        ieee80211_verify_ip_alignment(&rx);
+        ieee80211_verify_alignment(&rx);
 
         skb = rx.skb;
 
@@ -1967,9 +2227,8 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
                 if (sdata->vif.type == NL80211_IFTYPE_MONITOR)
                         continue;
 
-                bssid = ieee80211_get_bssid(hdr, skb->len, sdata->vif.type);
                 rx.flags |= IEEE80211_RX_RA_MATCH;
-                prepares = prepare_for_handlers(sdata, bssid, &rx, hdr);
+                prepares = prepare_for_handlers(sdata, &rx, hdr);
 
                 if (!prepares)
                         continue;
@@ -2174,11 +2433,9 @@ static u8 ieee80211_rx_reorder_ampdu(struct ieee80211_local *local,
         /* new un-ordered ampdu frame - process it */
 
         /* reset session timer */
-        if (tid_agg_rx->timeout) {
-                unsigned long expires =
-                        jiffies + (tid_agg_rx->timeout / 1000) * HZ;
-                mod_timer(&tid_agg_rx->session_timer, expires);
-        }
+        if (tid_agg_rx->timeout)
+                mod_timer(&tid_agg_rx->session_timer,
+                          TU_TO_EXP_TIME(tid_agg_rx->timeout));
 
         /* if this mpdu is fragmented - terminate rx aggregation session */
         sc = le16_to_cpu(hdr->seq_ctrl);
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index f5c7c3371929..3bf9839f5916 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -12,14 +12,11 @@
  * published by the Free Software Foundation.
  */
 
-/* TODO:
- * order BSS list by RSSI(?) ("quality of AP")
- * scan result table filtering (by capability (privacy, IBSS/BSS, WPA/RSN IE,
- *    SSID)
- */
+/* TODO: figure out how to avoid that the "current BSS" expires */
 
 #include <linux/wireless.h>
 #include <linux/if_arp.h>
+#include <linux/rtnetlink.h>
 #include <net/mac80211.h>
 #include <net/iw_handler.h>
 
@@ -30,192 +27,29 @@
 #define IEEE80211_CHANNEL_TIME (HZ / 33)
 #define IEEE80211_PASSIVE_CHANNEL_TIME (HZ / 5)
 
-void ieee80211_rx_bss_list_init(struct ieee80211_local *local)
-{
-        spin_lock_init(&local->bss_lock);
-        INIT_LIST_HEAD(&local->bss_list);
-}
-
-void ieee80211_rx_bss_list_deinit(struct ieee80211_local *local)
-{
-        struct ieee80211_bss *bss, *tmp;
-
-        list_for_each_entry_safe(bss, tmp, &local->bss_list, list)
-                ieee80211_rx_bss_put(local, bss);
-}
-
 struct ieee80211_bss *
 ieee80211_rx_bss_get(struct ieee80211_local *local, u8 *bssid, int freq,
                      u8 *ssid, u8 ssid_len)
 {
-        struct ieee80211_bss *bss;
-
-        spin_lock_bh(&local->bss_lock);
-        bss = local->bss_hash[STA_HASH(bssid)];
-        while (bss) {
-                if (!bss_mesh_cfg(bss) &&
-                    !memcmp(bss->bssid, bssid, ETH_ALEN) &&
-                    bss->freq == freq &&
-                    bss->ssid_len == ssid_len &&
-                    (ssid_len == 0 || !memcmp(bss->ssid, ssid, ssid_len))) {
-                        atomic_inc(&bss->users);
-                        break;
-                }
-                bss = bss->hnext;
-        }
-        spin_unlock_bh(&local->bss_lock);
-        return bss;
-}
-
-/* Caller must hold local->bss_lock */
-static void __ieee80211_rx_bss_hash_add(struct ieee80211_local *local,
-                                        struct ieee80211_bss *bss)
-{
-        u8 hash_idx;
-
-        if (bss_mesh_cfg(bss))
-                hash_idx = mesh_id_hash(bss_mesh_id(bss),
-                                        bss_mesh_id_len(bss));
-        else
-                hash_idx = STA_HASH(bss->bssid);
-
-        bss->hnext = local->bss_hash[hash_idx];
-        local->bss_hash[hash_idx] = bss;
-}
-
-/* Caller must hold local->bss_lock */
-static void __ieee80211_rx_bss_hash_del(struct ieee80211_local *local,
-                                        struct ieee80211_bss *bss)
-{
-        struct ieee80211_bss *b, *prev = NULL;
-        b = local->bss_hash[STA_HASH(bss->bssid)];
-        while (b) {
-                if (b == bss) {
-                        if (!prev)
-                                local->bss_hash[STA_HASH(bss->bssid)] =
-                                        bss->hnext;
-                        else
-                                prev->hnext = bss->hnext;
-                        break;
-                }
-                prev = b;
-                b = b->hnext;
-        }
-}
-
-struct ieee80211_bss *
-ieee80211_rx_bss_add(struct ieee80211_local *local, u8 *bssid, int freq,
-                     u8 *ssid, u8 ssid_len)
-{
-        struct ieee80211_bss *bss;
-
-        bss = kzalloc(sizeof(*bss), GFP_ATOMIC);
-        if (!bss)
-                return NULL;
-        atomic_set(&bss->users, 2);
-        memcpy(bss->bssid, bssid, ETH_ALEN);
-        bss->freq = freq;
-        if (ssid && ssid_len <= IEEE80211_MAX_SSID_LEN) {
-                memcpy(bss->ssid, ssid, ssid_len);
-                bss->ssid_len = ssid_len;
-        }
-
-        spin_lock_bh(&local->bss_lock);
-        /* TODO: order by RSSI? */
-        list_add_tail(&bss->list, &local->bss_list);
-        __ieee80211_rx_bss_hash_add(local, bss);
-        spin_unlock_bh(&local->bss_lock);
-        return bss;
-}
-
-#ifdef CONFIG_MAC80211_MESH
-static struct ieee80211_bss *
-ieee80211_rx_mesh_bss_get(struct ieee80211_local *local, u8 *mesh_id, int mesh_id_len,
-                          u8 *mesh_cfg, int freq)
-{
-        struct ieee80211_bss *bss;
-
-        spin_lock_bh(&local->bss_lock);
-        bss = local->bss_hash[mesh_id_hash(mesh_id, mesh_id_len)];
-        while (bss) {
-                if (bss_mesh_cfg(bss) &&
-                    !memcmp(bss_mesh_cfg(bss), mesh_cfg, MESH_CFG_CMP_LEN) &&
-                    bss->freq == freq &&
-                    mesh_id_len == bss->mesh_id_len &&
-                    (mesh_id_len == 0 || !memcmp(bss->mesh_id, mesh_id,
-                                                 mesh_id_len))) {
-                        atomic_inc(&bss->users);
-                        break;
-                }
-                bss = bss->hnext;
-        }
-        spin_unlock_bh(&local->bss_lock);
-        return bss;
+        return (void *)cfg80211_get_bss(local->hw.wiphy,
+                                        ieee80211_get_channel(local->hw.wiphy,
+                                                              freq),
+                                        bssid, ssid, ssid_len,
+                                        0, 0);
 }
 
-static struct ieee80211_bss *
-ieee80211_rx_mesh_bss_add(struct ieee80211_local *local, u8 *mesh_id, int mesh_id_len,
-                          u8 *mesh_cfg, int mesh_config_len, int freq)
+static void ieee80211_rx_bss_free(struct cfg80211_bss *cbss)
 {
-        struct ieee80211_bss *bss;
-
-        if (mesh_config_len != IEEE80211_MESH_CONFIG_LEN)
-                return NULL;
-
-        bss = kzalloc(sizeof(*bss), GFP_ATOMIC);
-        if (!bss)
-                return NULL;
-
-        bss->mesh_cfg = kmalloc(MESH_CFG_CMP_LEN, GFP_ATOMIC);
-        if (!bss->mesh_cfg) {
-                kfree(bss);
-                return NULL;
-        }
-
-        if (mesh_id_len && mesh_id_len <= IEEE80211_MAX_MESH_ID_LEN) {
-                bss->mesh_id = kmalloc(mesh_id_len, GFP_ATOMIC);
-                if (!bss->mesh_id) {
-                        kfree(bss->mesh_cfg);
-                        kfree(bss);
-                        return NULL;
-                }
-                memcpy(bss->mesh_id, mesh_id, mesh_id_len);
-        }
-
-        atomic_set(&bss->users, 2);
-        memcpy(bss->mesh_cfg, mesh_cfg, MESH_CFG_CMP_LEN);
-        bss->mesh_id_len = mesh_id_len;
-        bss->freq = freq;
-        spin_lock_bh(&local->bss_lock);
-        /* TODO: order by RSSI? */
-        list_add_tail(&bss->list, &local->bss_list);
-        __ieee80211_rx_bss_hash_add(local, bss);
-        spin_unlock_bh(&local->bss_lock);
-        return bss;
-}
-#endif
+        struct ieee80211_bss *bss = (void *)cbss;
 
-static void ieee80211_rx_bss_free(struct ieee80211_bss *bss)
-{
-        kfree(bss->ies);
         kfree(bss_mesh_id(bss));
         kfree(bss_mesh_cfg(bss));
-        kfree(bss);
 }
 
 void ieee80211_rx_bss_put(struct ieee80211_local *local,
                           struct ieee80211_bss *bss)
 {
-        local_bh_disable();
-        if (!atomic_dec_and_lock(&bss->users, &local->bss_lock)) {
-                local_bh_enable();
-                return;
-        }
-
-        __ieee80211_rx_bss_hash_del(local, bss);
-        list_del(&bss->list);
-        spin_unlock_bh(&local->bss_lock);
-        ieee80211_rx_bss_free(bss);
+        cfg80211_put_bss((struct cfg80211_bss *)bss);
 }
 
 struct ieee80211_bss *
@@ -224,39 +58,25 @@ ieee80211_bss_info_update(struct ieee80211_local *local,
                           struct ieee80211_mgmt *mgmt,
                           size_t len,
                           struct ieee802_11_elems *elems,
-                          int freq, bool beacon)
+                          struct ieee80211_channel *channel,
+                          bool beacon)
 {
         struct ieee80211_bss *bss;
         int clen;
+        s32 signal = 0;
 
-#ifdef CONFIG_MAC80211_MESH
-        if (elems->mesh_config)
-                bss = ieee80211_rx_mesh_bss_get(local, elems->mesh_id,
-                                elems->mesh_id_len, elems->mesh_config, freq);
-        else
-#endif
-                bss = ieee80211_rx_bss_get(local, mgmt->bssid, freq,
-                                           elems->ssid, elems->ssid_len);
-        if (!bss) {
-#ifdef CONFIG_MAC80211_MESH
-                if (elems->mesh_config)
-                        bss = ieee80211_rx_mesh_bss_add(local, elems->mesh_id,
-                                elems->mesh_id_len, elems->mesh_config,
-                                elems->mesh_config_len, freq);
-                else
-#endif
-                        bss = ieee80211_rx_bss_add(local, mgmt->bssid, freq,
-                                                  elems->ssid, elems->ssid_len);
-                if (!bss)
-                        return NULL;
-        } else {
-#if 0
-                /* TODO: order by RSSI? */
-                spin_lock_bh(&local->bss_lock);
-                list_move_tail(&bss->list, &local->bss_list);
-                spin_unlock_bh(&local->bss_lock);
-#endif
-        }
+        if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
+                signal = rx_status->signal * 100;
+        else if (local->hw.flags & IEEE80211_HW_SIGNAL_UNSPEC)
+                signal = (rx_status->signal * 100) / local->hw.max_signal;
+
+        bss = (void *)cfg80211_inform_bss_frame(local->hw.wiphy, channel,
+                                                mgmt, len, signal, GFP_ATOMIC);
+
+        if (!bss)
+                return NULL;
+
+        bss->cbss.free_priv = ieee80211_rx_bss_free;
 
         /* save the ERP value so that it is available at association time */
         if (elems->erp_info && elems->erp_info_len >= 1) {
@@ -264,9 +84,6 @@ ieee80211_bss_info_update(struct ieee80211_local *local,
                 bss->has_erp_value = 1;
         }
 
-        bss->beacon_int = le16_to_cpu(mgmt->u.beacon.beacon_int);
-        bss->capability = le16_to_cpu(mgmt->u.beacon.capab_info);
-
         if (elems->tim) {
                 struct ieee80211_tim_ie *tim_ie =
                         (struct ieee80211_tim_ie *)elems->tim;
@@ -295,37 +112,27 @@ ieee80211_bss_info_update(struct ieee80211_local *local,
                 bss->supp_rates_len += clen;
         }
 
-        bss->band = rx_status->band;
-
-        bss->timestamp = le64_to_cpu(mgmt->u.beacon.timestamp);
-        bss->last_update = jiffies;
-        bss->signal = rx_status->signal;
-        bss->noise = rx_status->noise;
-        bss->qual = rx_status->qual;
         bss->wmm_used = elems->wmm_param || elems->wmm_info;
 
         if (!beacon)
                 bss->last_probe_resp = jiffies;
 
-        /*
-         * For probe responses, or if we don't have any information yet,
-         * use the IEs from the beacon.
-         */
-        if (!bss->ies || !beacon) {
-                if (bss->ies == NULL || bss->ies_len < elems->total_len) {
-                        kfree(bss->ies);
-                        bss->ies = kmalloc(elems->total_len, GFP_ATOMIC);
-                }
-                if (bss->ies) {
-                        memcpy(bss->ies, elems->ie_start, elems->total_len);
-                        bss->ies_len = elems->total_len;
-                } else
-                        bss->ies_len = 0;
-        }
-
         return bss;
 }
 
+void ieee80211_rx_bss_remove(struct ieee80211_sub_if_data *sdata, u8 *bssid,
+                             int freq, u8 *ssid, u8 ssid_len)
+{
+        struct ieee80211_bss *bss;
+        struct ieee80211_local *local = sdata->local;
+
+        bss = ieee80211_rx_bss_get(local, bssid, freq, ssid, ssid_len);
+        if (bss) {
+                cfg80211_unlink_bss(local->hw.wiphy, (void *)bss);
+                ieee80211_rx_bss_put(local, bss);
+        }
+}
+
 ieee80211_rx_result
 ieee80211_scan_rx(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb,
                   struct ieee80211_rx_status *rx_status)
@@ -387,7 +194,7 @@ ieee80211_scan_rx(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb,
 
         bss = ieee80211_bss_info_update(sdata->local, rx_status,
                                         mgmt, skb->len, &elems,
-                                        freq, beacon);
+                                        channel, beacon);
         if (bss)
                 ieee80211_rx_bss_put(sdata->local, bss);
 
@@ -395,56 +202,94 @@ ieee80211_scan_rx(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb,
         return RX_QUEUED;
 }
 
-static void ieee80211_send_nullfunc(struct ieee80211_local *local,
-                                    struct ieee80211_sub_if_data *sdata,
-                                    int powersave)
+void ieee80211_scan_failed(struct ieee80211_local *local)
 {
-        struct sk_buff *skb;
-        struct ieee80211_hdr *nullfunc;
-        __le16 fc;
-
-        skb = dev_alloc_skb(local->hw.extra_tx_headroom + 24);
-        if (!skb) {
-                printk(KERN_DEBUG "%s: failed to allocate buffer for nullfunc "
-                       "frame\n", sdata->dev->name);
+        if (WARN_ON(!local->scan_req))
                 return;
+
+        /* notify cfg80211 about the failed scan */
+        if (local->scan_req != &local->int_scan_req)
+                cfg80211_scan_done(local->scan_req, true);
+
+        local->scan_req = NULL;
+}
+
+/*
+ * inform AP that we will go to sleep so that it will buffer the frames
+ * while we scan
+ */
+static void ieee80211_scan_ps_enable(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_local *local = sdata->local;
+        bool ps = false;
+
+        /* FIXME: what to do when local->pspolling is true? */
+
+        del_timer_sync(&local->dynamic_ps_timer);
+        cancel_work_sync(&local->dynamic_ps_enable_work);
+
+        if (local->hw.conf.flags & IEEE80211_CONF_PS) {
+                ps = true;
+                local->hw.conf.flags &= ~IEEE80211_CONF_PS;
+                ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
+        }
+
+        if (!ps || !(local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK))
+                /*
+                 * If power save was enabled, no need to send a nullfunc
+                 * frame because AP knows that we are sleeping. But if the
+                 * hardware is creating the nullfunc frame for power save
+                 * status (ie. IEEE80211_HW_PS_NULLFUNC_STACK is not
+                 * enabled) and power save was enabled, the firmware just
+                 * sent a null frame with power save disabled. So we need
+                 * to send a new nullfunc frame to inform the AP that we
+                 * are again sleeping.
+                 */
+                ieee80211_send_nullfunc(local, sdata, 1);
+}
+
+/* inform AP that we are awake again, unless power save is enabled */
+static void ieee80211_scan_ps_disable(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_local *local = sdata->local;
+
+        if (!local->powersave)
+                ieee80211_send_nullfunc(local, sdata, 0);
+        else {
+                /*
+                 * In !IEEE80211_HW_PS_NULLFUNC_STACK case the hardware
+                 * will send a nullfunc frame with the powersave bit set
+                 * even though the AP already knows that we are sleeping.
+                 * This could be avoided by sending a null frame with power
+                 * save bit disabled before enabling the power save, but
+                 * this doesn't gain anything.
+                 *
+                 * When IEEE80211_HW_PS_NULLFUNC_STACK is enabled, no need
+                 * to send a nullfunc frame because AP already knows that
+                 * we are sleeping, let's just enable power save mode in
+                 * hardware.
+                 */
+                local->hw.conf.flags |= IEEE80211_CONF_PS;
+                ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
         }
-        skb_reserve(skb, local->hw.extra_tx_headroom);
-
-        nullfunc = (struct ieee80211_hdr *) skb_put(skb, 24);
-        memset(nullfunc, 0, 24);
-        fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_NULLFUNC |
-                         IEEE80211_FCTL_TODS);
-        if (powersave)
-                fc |= cpu_to_le16(IEEE80211_FCTL_PM);
-        nullfunc->frame_control = fc;
-        memcpy(nullfunc->addr1, sdata->u.sta.bssid, ETH_ALEN);
-        memcpy(nullfunc->addr2, sdata->dev->dev_addr, ETH_ALEN);
-        memcpy(nullfunc->addr3, sdata->u.sta.bssid, ETH_ALEN);
-
-        ieee80211_tx_skb(sdata, skb, 0);
 }
 
-void ieee80211_scan_completed(struct ieee80211_hw *hw)
+void ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted)
 {
         struct ieee80211_local *local = hw_to_local(hw);
         struct ieee80211_sub_if_data *sdata;
-        union iwreq_data wrqu;
 
         if (WARN_ON(!local->hw_scanning && !local->sw_scanning))
                 return;
 
-        local->last_scan_completed = jiffies;
-        memset(&wrqu, 0, sizeof(wrqu));
+        if (WARN_ON(!local->scan_req))
+                return;
 
-        /*
-         * local->scan_sdata could have been NULLed by the interface
-         * down code in case we were scanning on an interface that is
-         * being taken down.
-         */
-        sdata = local->scan_sdata;
-        if (sdata)
-                wireless_send_event(sdata->dev, SIOCGIWSCAN, &wrqu, NULL);
+        if (local->scan_req != &local->int_scan_req)
+                cfg80211_scan_done(local->scan_req, aborted);
+        local->scan_req = NULL;
+
+        local->last_scan_completed = jiffies;
 
         if (local->hw_scanning) {
                 local->hw_scanning = false;
@@ -472,34 +317,46 @@ void ieee80211_scan_completed(struct ieee80211_hw *hw)
         netif_addr_unlock(local->mdev);
         netif_tx_unlock_bh(local->mdev);
 
-        rcu_read_lock();
-        list_for_each_entry_rcu(sdata, &local->interfaces, list) {
+        if (local->ops->sw_scan_complete)
+                local->ops->sw_scan_complete(local_to_hw(local));
+
+        mutex_lock(&local->iflist_mtx);
+        list_for_each_entry(sdata, &local->interfaces, list) {
+                if (!netif_running(sdata->dev))
+                        continue;
+
                 /* Tell AP we're back */
                 if (sdata->vif.type == NL80211_IFTYPE_STATION) {
-                        if (sdata->u.sta.flags & IEEE80211_STA_ASSOCIATED) {
-                                ieee80211_send_nullfunc(local, sdata, 0);
+                        if (sdata->u.mgd.flags & IEEE80211_STA_ASSOCIATED) {
+                                ieee80211_scan_ps_disable(sdata);
                                 netif_tx_wake_all_queues(sdata->dev);
                         }
                 } else
                         netif_tx_wake_all_queues(sdata->dev);
+
+                /* re-enable beaconing */
+                if (sdata->vif.type == NL80211_IFTYPE_AP ||
+                    sdata->vif.type == NL80211_IFTYPE_ADHOC ||
+                    sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
+                        ieee80211_if_config(sdata,
+                                            IEEE80211_IFCC_BEACON_ENABLED);
         }
-        rcu_read_unlock();
+        mutex_unlock(&local->iflist_mtx);
 
  done:
         ieee80211_mlme_notify_scan_completed(local);
+        ieee80211_ibss_notify_scan_completed(local);
         ieee80211_mesh_notify_scan_completed(local);
 }
 EXPORT_SYMBOL(ieee80211_scan_completed);
 
-
 void ieee80211_scan_work(struct work_struct *work)
 {
         struct ieee80211_local *local =
                 container_of(work, struct ieee80211_local, scan_work.work);
         struct ieee80211_sub_if_data *sdata = local->scan_sdata;
-        struct ieee80211_supported_band *sband;
         struct ieee80211_channel *chan;
-        int skip;
+        int skip, i;
         unsigned long next_delay = 0;
 
         /*
@@ -510,33 +367,13 @@ void ieee80211_scan_work(struct work_struct *work)
 
         switch (local->scan_state) {
         case SCAN_SET_CHANNEL:
-                /*
-                 * Get current scan band. scan_band may be IEEE80211_NUM_BANDS
-                 * after we successfully scanned the last channel of the last
-                 * band (and the last band is supported by the hw)
-                 */
-                if (local->scan_band < IEEE80211_NUM_BANDS)
-                        sband = local->hw.wiphy->bands[local->scan_band];
-                else
-                        sband = NULL;
-
-                /*
-                 * If we are at an unsupported band and have more bands
-                 * left to scan, advance to the next supported one.
-                 */
-                while (!sband && local->scan_band < IEEE80211_NUM_BANDS - 1) {
-                        local->scan_band++;
-                        sband = local->hw.wiphy->bands[local->scan_band];
-                        local->scan_channel_idx = 0;
-                }
-
                 /* if no more bands/channels left, complete scan */
-                if (!sband || local->scan_channel_idx >= sband->n_channels) {
-                        ieee80211_scan_completed(local_to_hw(local));
+                if (local->scan_channel_idx >= local->scan_req->n_channels) {
+                        ieee80211_scan_completed(local_to_hw(local), false);
                         return;
                 }
                 skip = 0;
-                chan = &sband->channels[local->scan_channel_idx];
+                chan = local->scan_req->channels[local->scan_channel_idx];
 
                 if (chan->flags & IEEE80211_CHAN_DISABLED ||
                     (sdata->vif.type == NL80211_IFTYPE_ADHOC &&
@@ -552,15 +389,6 @@ void ieee80211_scan_work(struct work_struct *work)
 
                 /* advance state machine to next channel/band */
                 local->scan_channel_idx++;
-                if (local->scan_channel_idx >= sband->n_channels) {
-                        /*
-                         * scan_band may end up == IEEE80211_NUM_BANDS, but
-                         * we'll catch that case above and complete the scan
-                         * if that is the case.
-                         */
-                        local->scan_band++;
-                        local->scan_channel_idx = 0;
-                }
 
                 if (skip)
                         break;
@@ -573,10 +401,15 @@ void ieee80211_scan_work(struct work_struct *work)
                 next_delay = IEEE80211_PASSIVE_CHANNEL_TIME;
                 local->scan_state = SCAN_SET_CHANNEL;
 
-                if (local->scan_channel->flags & IEEE80211_CHAN_PASSIVE_SCAN)
+                if (local->scan_channel->flags & IEEE80211_CHAN_PASSIVE_SCAN ||
+                    !local->scan_req->n_ssids)
                         break;
-                ieee80211_send_probe_req(sdata, NULL, local->scan_ssid,
-                                         local->scan_ssid_len);
+                for (i = 0; i < local->scan_req->n_ssids; i++)
+                        ieee80211_send_probe_req(
+                                sdata, NULL,
+                                local->scan_req->ssids[i].ssid,
+                                local->scan_req->ssids[i].ssid_len,
+                                local->scan_req->ie, local->scan_req->ie_len);
                 next_delay = IEEE80211_CHANNEL_TIME;
                 break;
         }
@@ -587,14 +420,19 @@ void ieee80211_scan_work(struct work_struct *work)
 
 
 int ieee80211_start_scan(struct ieee80211_sub_if_data *scan_sdata,
-                         u8 *ssid, size_t ssid_len)
+                         struct cfg80211_scan_request *req)
 {
         struct ieee80211_local *local = scan_sdata->local;
         struct ieee80211_sub_if_data *sdata;
 
-        if (ssid_len > IEEE80211_MAX_SSID_LEN)
+        if (!req)
                 return -EINVAL;
 
+        if (local->scan_req && local->scan_req != req)
+                return -EBUSY;
+
+        local->scan_req = req;
+
         /* MLME-SCAN.request (page 118)  page 144 (11.1.3.1)
          * BSSType: INFRASTRUCTURE, INDEPENDENT, ANY_BSS
          * BSSID: MACAddress
@@ -622,7 +460,7 @@ int ieee80211_start_scan(struct ieee80211_sub_if_data *scan_sdata,
                 int rc;
 
                 local->hw_scanning = true;
-                rc = local->ops->hw_scan(local_to_hw(local), ssid, ssid_len);
+                rc = local->ops->hw_scan(local_to_hw(local), req);
                 if (rc) {
                         local->hw_scanning = false;
                         return rc;
@@ -631,29 +469,49 @@ int ieee80211_start_scan(struct ieee80211_sub_if_data *scan_sdata,
                 return 0;
         }
 
+        /*
+         * Hardware/driver doesn't support hw_scan, so use software
+         * scanning instead. First send a nullfunc frame with power save
+         * bit on so that AP will buffer the frames for us while we are not
+         * listening, then send probe requests to each channel and wait for
+         * the responses. After all channels are scanned, tune back to the
+         * original channel and send a nullfunc frame with power save bit
+         * off to trigger the AP to send us all the buffered frames.
+         *
+         * Note that while local->sw_scanning is true everything else but
+         * nullfunc frames and probe requests will be dropped in
+         * ieee80211_tx_h_check_assoc().
+         */
         local->sw_scanning = true;
+        if (local->ops->sw_scan_start)
+                local->ops->sw_scan_start(local_to_hw(local));
+
+        mutex_lock(&local->iflist_mtx);
+        list_for_each_entry(sdata, &local->interfaces, list) {
+                if (!netif_running(sdata->dev))
+                        continue;
+
+                /* disable beaconing */
+                if (sdata->vif.type == NL80211_IFTYPE_AP ||
+                    sdata->vif.type == NL80211_IFTYPE_ADHOC ||
+                    sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
+                        ieee80211_if_config(sdata,
+                                            IEEE80211_IFCC_BEACON_ENABLED);
 
-        rcu_read_lock();
-        list_for_each_entry_rcu(sdata, &local->interfaces, list) {
                 if (sdata->vif.type == NL80211_IFTYPE_STATION) {
-                        if (sdata->u.sta.flags & IEEE80211_STA_ASSOCIATED) {
+                        if (sdata->u.mgd.flags & IEEE80211_STA_ASSOCIATED) {
                                 netif_tx_stop_all_queues(sdata->dev);
-                                ieee80211_send_nullfunc(local, sdata, 1);
+                                ieee80211_scan_ps_enable(sdata);
                         }
                 } else
                         netif_tx_stop_all_queues(sdata->dev);
         }
-        rcu_read_unlock();
+        mutex_unlock(&local->iflist_mtx);
 
-        if (ssid) {
-                local->scan_ssid_len = ssid_len;
-                memcpy(local->scan_ssid, ssid, ssid_len);
-        } else
-                local->scan_ssid_len = 0;
         local->scan_state = SCAN_SET_CHANNEL;
         local->scan_channel_idx = 0;
-        local->scan_band = IEEE80211_BAND_2GHZ;
         local->scan_sdata = scan_sdata;
+        local->scan_req = req;
 
         netif_addr_lock_bh(local->mdev);
         local->filter_flags |= FIF_BCN_PRBRESP_PROMISC;
@@ -673,13 +531,21 @@ int ieee80211_start_scan(struct ieee80211_sub_if_data *scan_sdata,
 
 
 int ieee80211_request_scan(struct ieee80211_sub_if_data *sdata,
-                           u8 *ssid, size_t ssid_len)
+                           struct cfg80211_scan_request *req)
 {
         struct ieee80211_local *local = sdata->local;
-        struct ieee80211_if_sta *ifsta;
+        struct ieee80211_if_managed *ifmgd;
+
+        if (!req)
+                return -EINVAL;
+
+        if (local->scan_req && local->scan_req != req)
+                return -EBUSY;
+
+        local->scan_req = req;
 
         if (sdata->vif.type != NL80211_IFTYPE_STATION)
-                return ieee80211_start_scan(sdata, ssid, ssid_len);
+                return ieee80211_start_scan(sdata, req);
 
         /*
          * STA has a state machine that might need to defer scanning
@@ -693,242 +559,9 @@ int ieee80211_request_scan(struct ieee80211_sub_if_data *sdata,
                 return -EBUSY;
         }
 
-        ifsta = &sdata->u.sta;
-
-        ifsta->scan_ssid_len = ssid_len;
-        if (ssid_len)
-                memcpy(ifsta->scan_ssid, ssid, ssid_len);
-        set_bit(IEEE80211_STA_REQ_SCAN, &ifsta->request);
-        queue_work(local->hw.workqueue, &ifsta->work);
+        ifmgd = &sdata->u.mgd;
+        set_bit(IEEE80211_STA_REQ_SCAN, &ifmgd->request);
+        queue_work(local->hw.workqueue, &ifmgd->work);
 
         return 0;
 }
-
-
-static void ieee80211_scan_add_ies(struct iw_request_info *info,
-                                   struct ieee80211_bss *bss,
-                                   char **current_ev, char *end_buf)
-{
-        u8 *pos, *end, *next;
-        struct iw_event iwe;
-
-        if (bss == NULL || bss->ies == NULL)
-                return;
-
-        /*
-         * If needed, fragment the IEs buffer (at IE boundaries) into short
-         * enough fragments to fit into IW_GENERIC_IE_MAX octet messages.
-         */
-        pos = bss->ies;
-        end = pos + bss->ies_len;
-
-        while (end - pos > IW_GENERIC_IE_MAX) {
-                next = pos + 2 + pos[1];
-                while (next + 2 + next[1] - pos < IW_GENERIC_IE_MAX)
-                        next = next + 2 + next[1];
-
-                memset(&iwe, 0, sizeof(iwe));
-                iwe.cmd = IWEVGENIE;
-                iwe.u.data.length = next - pos;
-                *current_ev = iwe_stream_add_point(info, *current_ev,
-                                                   end_buf, &iwe, pos);
-
-                pos = next;
-        }
-
-        if (end > pos) {
-                memset(&iwe, 0, sizeof(iwe));
-                iwe.cmd = IWEVGENIE;
-                iwe.u.data.length = end - pos;
-                *current_ev = iwe_stream_add_point(info, *current_ev,
-                                                   end_buf, &iwe, pos);
-        }
-}
-
-
-static char *
-ieee80211_scan_result(struct ieee80211_local *local,
-                      struct iw_request_info *info,
-                      struct ieee80211_bss *bss,
-                      char *current_ev, char *end_buf)
-{
-        struct iw_event iwe;
-        char *buf;
-
-        if (time_after(jiffies,
-                       bss->last_update + IEEE80211_SCAN_RESULT_EXPIRE))
-                return current_ev;
-
-        memset(&iwe, 0, sizeof(iwe));
-        iwe.cmd = SIOCGIWAP;
-        iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
-        memcpy(iwe.u.ap_addr.sa_data, bss->bssid, ETH_ALEN);
-        current_ev = iwe_stream_add_event(info, current_ev, end_buf, &iwe,
-                                          IW_EV_ADDR_LEN);
-
-        memset(&iwe, 0, sizeof(iwe));
-        iwe.cmd = SIOCGIWESSID;
-        if (bss_mesh_cfg(bss)) {
-                iwe.u.data.length = bss_mesh_id_len(bss);
-                iwe.u.data.flags = 1;
-                current_ev = iwe_stream_add_point(info, current_ev, end_buf,
-                                                  &iwe, bss_mesh_id(bss));
-        } else {
-                iwe.u.data.length = bss->ssid_len;
-                iwe.u.data.flags = 1;
-                current_ev = iwe_stream_add_point(info, current_ev, end_buf,
-                                                  &iwe, bss->ssid);
-        }
-
-        if (bss->capability & (WLAN_CAPABILITY_ESS | WLAN_CAPABILITY_IBSS)
-            || bss_mesh_cfg(bss)) {
-                memset(&iwe, 0, sizeof(iwe));
-                iwe.cmd = SIOCGIWMODE;
-                if (bss_mesh_cfg(bss))
-                        iwe.u.mode = IW_MODE_MESH;
-                else if (bss->capability & WLAN_CAPABILITY_ESS)
-                        iwe.u.mode = IW_MODE_MASTER;
-                else
-                        iwe.u.mode = IW_MODE_ADHOC;
-                current_ev = iwe_stream_add_event(info, current_ev, end_buf,
-                                                  &iwe, IW_EV_UINT_LEN);
-        }
-
-        memset(&iwe, 0, sizeof(iwe));
-        iwe.cmd = SIOCGIWFREQ;
-        iwe.u.freq.m = ieee80211_frequency_to_channel(bss->freq);
-        iwe.u.freq.e = 0;
-        current_ev = iwe_stream_add_event(info, current_ev, end_buf, &iwe,
-                                          IW_EV_FREQ_LEN);
-
-        memset(&iwe, 0, sizeof(iwe));
-        iwe.cmd = SIOCGIWFREQ;
-        iwe.u.freq.m = bss->freq;
-        iwe.u.freq.e = 6;
-        current_ev = iwe_stream_add_event(info, current_ev, end_buf, &iwe,
-                                          IW_EV_FREQ_LEN);
-        memset(&iwe, 0, sizeof(iwe));
-        iwe.cmd = IWEVQUAL;
-        iwe.u.qual.qual = bss->qual;
-        iwe.u.qual.level = bss->signal;
-        iwe.u.qual.noise = bss->noise;
-        iwe.u.qual.updated = local->wstats_flags;
-        current_ev = iwe_stream_add_event(info, current_ev, end_buf, &iwe,
-                                          IW_EV_QUAL_LEN);
-
-        memset(&iwe, 0, sizeof(iwe));
-        iwe.cmd = SIOCGIWENCODE;
-        if (bss->capability & WLAN_CAPABILITY_PRIVACY)
-                iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
-        else
-                iwe.u.data.flags = IW_ENCODE_DISABLED;
-        iwe.u.data.length = 0;
-        current_ev = iwe_stream_add_point(info, current_ev, end_buf,
-                                          &iwe, "");
-
-        ieee80211_scan_add_ies(info, bss, &current_ev, end_buf);
-
-        if (bss->supp_rates_len > 0) {
-                /* display all supported rates in readable format */
-                char *p = current_ev + iwe_stream_lcp_len(info);
-                int i;
-
-                memset(&iwe, 0, sizeof(iwe));
-                iwe.cmd = SIOCGIWRATE;
-                /* Those two flags are ignored... */
-                iwe.u.bitrate.fixed = iwe.u.bitrate.disabled = 0;
-
-                for (i = 0; i < bss->supp_rates_len; i++) {
-                        iwe.u.bitrate.value = ((bss->supp_rates[i] &
-                                                        0x7f) * 500000);
-                        p = iwe_stream_add_value(info, current_ev, p,
-                                        end_buf, &iwe, IW_EV_PARAM_LEN);
-                }
-                current_ev = p;
-        }
-
-        buf = kmalloc(30, GFP_ATOMIC);
-        if (buf) {
-                memset(&iwe, 0, sizeof(iwe));
-                iwe.cmd = IWEVCUSTOM;
-                sprintf(buf, "tsf=%016llx", (unsigned long long)(bss->timestamp));
-                iwe.u.data.length = strlen(buf);
-                current_ev = iwe_stream_add_point(info, current_ev, end_buf,
-                                                  &iwe, buf);
-                memset(&iwe, 0, sizeof(iwe));
-                iwe.cmd = IWEVCUSTOM;
-                sprintf(buf, " Last beacon: %dms ago",
-                        jiffies_to_msecs(jiffies - bss->last_update));
-                iwe.u.data.length = strlen(buf);
-                current_ev = iwe_stream_add_point(info, current_ev,
-                                                  end_buf, &iwe, buf);
-                kfree(buf);
-        }
-
-        if (bss_mesh_cfg(bss)) {
-                u8 *cfg = bss_mesh_cfg(bss);
-                buf = kmalloc(50, GFP_ATOMIC);
-                if (buf) {
-                        memset(&iwe, 0, sizeof(iwe));
-                        iwe.cmd = IWEVCUSTOM;
-                        sprintf(buf, "Mesh network (version %d)", cfg[0]);
-                        iwe.u.data.length = strlen(buf);
-                        current_ev = iwe_stream_add_point(info, current_ev,
-                                                          end_buf,
-                                                          &iwe, buf);
-                        sprintf(buf, "Path Selection Protocol ID: "
-                                "0x%02X%02X%02X%02X", cfg[1], cfg[2], cfg[3],
-                                                        cfg[4]);
-                        iwe.u.data.length = strlen(buf);
-                        current_ev = iwe_stream_add_point(info, current_ev,
-                                                          end_buf,
-                                                          &iwe, buf);
-                        sprintf(buf, "Path Selection Metric ID: "
-                                "0x%02X%02X%02X%02X", cfg[5], cfg[6], cfg[7],
-                                                        cfg[8]);
-                        iwe.u.data.length = strlen(buf);
-                        current_ev = iwe_stream_add_point(info, current_ev,
-                                                          end_buf,
-                                                          &iwe, buf);
-                        sprintf(buf, "Congestion Control Mode ID: "
-                                "0x%02X%02X%02X%02X", cfg[9], cfg[10],
-                                                        cfg[11], cfg[12]);
-                        iwe.u.data.length = strlen(buf);
-                        current_ev = iwe_stream_add_point(info, current_ev,
-                                                          end_buf,
-                                                          &iwe, buf);
-                        sprintf(buf, "Channel Precedence: "
-                                "0x%02X%02X%02X%02X", cfg[13], cfg[14],
-                                                        cfg[15], cfg[16]);
-                        iwe.u.data.length = strlen(buf);
-                        current_ev = iwe_stream_add_point(info, current_ev,
-                                                          end_buf,
-                                                          &iwe, buf);
-                        kfree(buf);
-                }
-        }
-
-        return current_ev;
-}
-
-
-int ieee80211_scan_results(struct ieee80211_local *local,
-                           struct iw_request_info *info,
-                           char *buf, size_t len)
-{
-        char *current_ev = buf;
-        char *end_buf = buf + len;
-        struct ieee80211_bss *bss;
-
-        spin_lock_bh(&local->bss_lock);
-        list_for_each_entry(bss, &local->bss_list, list) {
-                if (buf + len - current_ev <= IW_EV_ADDR_LEN) {
-                        spin_unlock_bh(&local->bss_lock);
-                        return -E2BIG;
-                }
-                current_ev = ieee80211_scan_result(local, info, bss,
-                                                       current_ev, end_buf);
-        }
-        spin_unlock_bh(&local->bss_lock);
-        return current_ev - buf;
-}
diff --git a/net/mac80211/spectmgmt.c b/net/mac80211/spectmgmt.c
index f72bad636d8e..5f7a2624ed74 100644
--- a/net/mac80211/spectmgmt.c
+++ b/net/mac80211/spectmgmt.c
@@ -65,7 +65,7 @@ static void ieee80211_send_refuse_measurement_request(struct ieee80211_sub_if_da
                         IEEE80211_SPCT_MSR_RPRT_MODE_REFUSED;
         msr_report->u.action.u.measurement.msr_elem.type = request_ie->type;
 
-        ieee80211_tx_skb(sdata, skb, 0);
+        ieee80211_tx_skb(sdata, skb, 1);
 }
 
 void ieee80211_process_measurement_req(struct ieee80211_sub_if_data *sdata,
@@ -84,3 +84,104 @@ void ieee80211_process_measurement_req(struct ieee80211_sub_if_data *sdata,
                         mgmt->sa, mgmt->bssid,
                         mgmt->u.action.u.measurement.dialog_token);
 }
+
+void ieee80211_chswitch_work(struct work_struct *work)
+{
+        struct ieee80211_sub_if_data *sdata =
+                container_of(work, struct ieee80211_sub_if_data, u.mgd.chswitch_work);
+        struct ieee80211_bss *bss;
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+
+        if (!netif_running(sdata->dev))
+                return;
+
+        bss = ieee80211_rx_bss_get(sdata->local, ifmgd->bssid,
+                                   sdata->local->hw.conf.channel->center_freq,
+                                   ifmgd->ssid, ifmgd->ssid_len);
+        if (!bss)
+                goto exit;
+
+        sdata->local->oper_channel = sdata->local->csa_channel;
+        /* XXX: shouldn't really modify cfg80211-owned data! */
+        if (!ieee80211_hw_config(sdata->local, IEEE80211_CONF_CHANGE_CHANNEL))
+                bss->cbss.channel = sdata->local->oper_channel;
+
+        ieee80211_rx_bss_put(sdata->local, bss);
+exit:
+        ifmgd->flags &= ~IEEE80211_STA_CSA_RECEIVED;
+        ieee80211_wake_queues_by_reason(&sdata->local->hw,
+                                        IEEE80211_QUEUE_STOP_REASON_CSA);
+}
+
+void ieee80211_chswitch_timer(unsigned long data)
+{
+        struct ieee80211_sub_if_data *sdata =
+                (struct ieee80211_sub_if_data *) data;
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+
+        queue_work(sdata->local->hw.workqueue, &ifmgd->chswitch_work);
+}
+
+void ieee80211_process_chanswitch(struct ieee80211_sub_if_data *sdata,
+                                  struct ieee80211_channel_sw_ie *sw_elem,
+                                  struct ieee80211_bss *bss)
+{
+        struct ieee80211_channel *new_ch;
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+        int new_freq = ieee80211_channel_to_frequency(sw_elem->new_ch_num);
+
+        /* FIXME: Handle ADHOC later */
+        if (sdata->vif.type != NL80211_IFTYPE_STATION)
+                return;
+
+        if (ifmgd->state != IEEE80211_STA_MLME_ASSOCIATED)
+                return;
+
+        if (sdata->local->sw_scanning || sdata->local->hw_scanning)
+                return;
+
+        /* Disregard subsequent beacons if we are already running a timer
+           processing a CSA */
+
+        if (ifmgd->flags & IEEE80211_STA_CSA_RECEIVED)
+                return;
+
+        new_ch = ieee80211_get_channel(sdata->local->hw.wiphy, new_freq);
+        if (!new_ch || new_ch->flags & IEEE80211_CHAN_DISABLED)
+                return;
+
+        sdata->local->csa_channel = new_ch;
+
+        if (sw_elem->count <= 1) {
+                queue_work(sdata->local->hw.workqueue, &ifmgd->chswitch_work);
+        } else {
+                ieee80211_stop_queues_by_reason(&sdata->local->hw,
+                                                IEEE80211_QUEUE_STOP_REASON_CSA);
+                ifmgd->flags |= IEEE80211_STA_CSA_RECEIVED;
+                mod_timer(&ifmgd->chswitch_timer,
+                          jiffies +
+                          msecs_to_jiffies(sw_elem->count *
+                                           bss->cbss.beacon_interval));
+        }
+}
+
+void ieee80211_handle_pwr_constr(struct ieee80211_sub_if_data *sdata,
+                                 u16 capab_info, u8 *pwr_constr_elem,
+                                 u8 pwr_constr_elem_len)
+{
+        struct ieee80211_conf *conf = &sdata->local->hw.conf;
+
+        if (!(capab_info & WLAN_CAPABILITY_SPECTRUM_MGMT))
+                return;
+
+        /* Power constraint IE length should be 1 octet */
+        if (pwr_constr_elem_len != 1)
+                return;
+
+        if ((*pwr_constr_elem <= conf->channel->max_power) &&
+            (*pwr_constr_elem != sdata->local->power_constr_level)) {
+                sdata->local->power_constr_level = *pwr_constr_elem;
+                ieee80211_hw_config(sdata->local, 0);
+        }
+}
+
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index 10c5539c20ab..c5f14e6bbde2 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -194,12 +194,47 @@ void sta_info_destroy(struct sta_info *sta)
                 dev_kfree_skb_any(skb);
 
         for (i = 0; i <  STA_TID_NUM; i++) {
+                struct tid_ampdu_rx *tid_rx;
+                struct tid_ampdu_tx *tid_tx;
+
                 spin_lock_bh(&sta->lock);
-                if (sta->ampdu_mlme.tid_rx[i])
-                  del_timer_sync(&sta->ampdu_mlme.tid_rx[i]->session_timer);
-                if (sta->ampdu_mlme.tid_tx[i])
-                  del_timer_sync(&sta->ampdu_mlme.tid_tx[i]->addba_resp_timer);
+                tid_rx = sta->ampdu_mlme.tid_rx[i];
+                /* Make sure timer won't free the tid_rx struct, see below */
+                if (tid_rx)
+                        tid_rx->shutdown = true;
+
                 spin_unlock_bh(&sta->lock);
+
+                /*
+                 * Outside spinlock - shutdown is true now so that the timer
+                 * won't free tid_rx, we have to do that now. Can't let the
+                 * timer do it because we have to sync the timer outside the
+                 * lock that it takes itself.
+                 */
+                if (tid_rx) {
+                        del_timer_sync(&tid_rx->session_timer);
+                        kfree(tid_rx);
+                }
+
+                /*
+                 * No need to do such complications for TX agg sessions, the
+                 * path leading to freeing the tid_tx struct goes via a call
+                 * from the driver, and thus needs to look up the sta struct
+                 * again, which cannot be found when we get here. Hence, we
+                 * just need to delete the timer and free the aggregation
+                 * info; we won't be telling the peer about it then but that
+                 * doesn't matter if we're not talking to it again anyway.
+                 */
+                tid_tx = sta->ampdu_mlme.tid_tx[i];
+                if (tid_tx) {
+                        del_timer_sync(&tid_tx->addba_resp_timer);
+                        /*
+                         * STA removed while aggregation session being
+                         * started? Bit odd, but purge frames anyway.
+                         */
+                        skb_queue_purge(&tid_tx->pending);
+                        kfree(tid_tx);
+                }
         }
 
         __sta_info_free(local, sta);
@@ -246,8 +281,6 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
                  * enable session_timer's data differentiation. refer to
                  * sta_rx_agg_session_timer_expired for useage */
                 sta->timer_to_tid[i] = i;
-                /* tid to tx queue: initialize according to HW (0 is valid) */
-                sta->tid_to_tx_q[i] = ieee80211_num_queues(&local->hw);
                 /* rx */
                 sta->ampdu_mlme.tid_state_rx[i] = HT_AGG_STATE_IDLE;
                 sta->ampdu_mlme.tid_rx[i] = NULL;
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index e49a5b99cf10..5534d489f506 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -34,6 +34,9 @@
  * @WLAN_STA_CLEAR_PS_FILT: Clear PS filter in hardware (using the
  *      IEEE80211_TX_CTL_CLEAR_PS_FILT control flag) when the next
  *      frame to this station is transmitted.
+ * @WLAN_STA_MFP: Management frame protection is used with this STA.
+ * @WLAN_STA_SUSPEND: Set/cleared during a suspend/resume cycle.
+ *      Used to deny ADDBA requests (both TX and RX).
  */
 enum ieee80211_sta_info_flags {
         WLAN_STA_AUTH           = 1<<0,
@@ -46,6 +49,8 @@ enum ieee80211_sta_info_flags {
         WLAN_STA_WDS            = 1<<7,
         WLAN_STA_PSPOLL         = 1<<8,
         WLAN_STA_CLEAR_PS_FILT  = 1<<9,
+        WLAN_STA_MFP            = 1<<10,
+        WLAN_STA_SUSPEND        = 1<<11
 };
 
 #define STA_TID_NUM 16
@@ -63,17 +68,18 @@ enum ieee80211_sta_info_flags {
 #define HT_AGG_STATE_OPERATIONAL        (HT_ADDBA_REQUESTED_MSK |       \
                                          HT_ADDBA_DRV_READY_MSK |       \
                                          HT_ADDBA_RECEIVED_MSK)
-#define HT_AGG_STATE_DEBUGFS_CTL        BIT(7)
 
 /**
  * struct tid_ampdu_tx - TID aggregation information (Tx).
  *
  * @addba_resp_timer: timer for peer's response to addba request
+ * @pending: pending frames queue -- use sta's spinlock to protect
  * @ssn: Starting Sequence Number expected to be aggregated.
  * @dialog_token: dialog token for aggregation session
  */
 struct tid_ampdu_tx {
         struct timer_list addba_resp_timer;
+        struct sk_buff_head pending;
         u16 ssn;
         u8 dialog_token;
 };
@@ -87,8 +93,9 @@ struct tid_ampdu_tx {
  * @stored_mpdu_num: number of MPDUs in reordering buffer
  * @ssn: Starting Sequence Number expected to be aggregated.
  * @buf_size: buffer size for incoming A-MPDUs
- * @timeout: reset timer value.
+ * @timeout: reset timer value (in TUs).
  * @dialog_token: dialog token for aggregation session
+ * @shutdown: this session is being shut down due to STA removal
  */
 struct tid_ampdu_rx {
         struct sk_buff **reorder_buf;
@@ -99,6 +106,7 @@ struct tid_ampdu_rx {
         u16 buf_size;
         u16 timeout;
         u8 dialog_token;
+        bool shutdown;
 };
 
 /**
@@ -198,7 +206,6 @@ struct sta_ampdu_mlme {
  * @tid_seq: per-TID sequence numbers for sending to this STA
  * @ampdu_mlme: A-MPDU state machine state
  * @timer_to_tid: identity mapping to ID timers
- * @tid_to_tx_q: map tid to tx queue
  * @llid: Local link ID
  * @plid: Peer link ID
  * @reason: Cancel reason on PLINK_HOLDING state
@@ -273,7 +280,6 @@ struct sta_info {
          */
         struct sta_ampdu_mlme ampdu_mlme;
         u8 timer_to_tid[STA_TID_NUM];
-        u8 tid_to_tx_q[STA_TID_NUM];
 
 #ifdef CONFIG_MAC80211_MESH
         /*
@@ -382,8 +388,6 @@ static inline u32 get_sta_flags(struct sta_info *sta)
 }
 
 
-/* Maximum number of concurrently registered stations */
-#define MAX_STA_COUNT 2007
 
 #define STA_HASH_SIZE 256
 #define STA_HASH(sta) (sta[5])
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 94de5033f0b6..3fb04a86444d 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -34,7 +34,7 @@
 
 #define IEEE80211_TX_OK         0
 #define IEEE80211_TX_AGAIN      1
-#define IEEE80211_TX_FRAG_AGAIN 2
+#define IEEE80211_TX_PENDING    2
 
 /* misc utils */
 
@@ -192,7 +192,19 @@ ieee80211_tx_h_check_assoc(struct ieee80211_tx_data *tx)
                 return TX_CONTINUE;
 
         if (unlikely(tx->local->sw_scanning) &&
-            !ieee80211_is_probe_req(hdr->frame_control))
+            !ieee80211_is_probe_req(hdr->frame_control) &&
+            !ieee80211_is_nullfunc(hdr->frame_control))
+                /*
+                 * When software scanning only nullfunc frames (to notify
+                 * the sleep state to the AP) and probe requests (for the
+                 * active scan) are allowed, all other frames should not be
+                 * sent and we should not get here, but if we do
+                 * nonetheless, drop them to avoid sending them
+                 * off-channel. See the link below and
+                 * ieee80211_start_scan() for more.
+                 *
+                 * http://article.gmane.org/gmane.linux.kernel.wireless.general/30089
+                 */
                 return TX_DROP;
 
         if (tx->sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
@@ -330,6 +342,22 @@ ieee80211_tx_h_multicast_ps_buf(struct ieee80211_tx_data *tx)
         return TX_CONTINUE;
 }
 
+static int ieee80211_use_mfp(__le16 fc, struct sta_info *sta,
+                             struct sk_buff *skb)
+{
+        if (!ieee80211_is_mgmt(fc))
+                return 0;
+
+        if (sta == NULL || !test_sta_flags(sta, WLAN_STA_MFP))
+                return 0;
+
+        if (!ieee80211_is_robust_mgmt_frame((struct ieee80211_hdr *)
+                                            skb->data))
+                return 0;
+
+        return 1;
+}
+
 static ieee80211_tx_result
 ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx)
 {
@@ -409,11 +437,17 @@ ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx)
                 tx->key = NULL;
         else if (tx->sta && (key = rcu_dereference(tx->sta->key)))
                 tx->key = key;
+        else if (ieee80211_is_mgmt(hdr->frame_control) &&
+                 (key = rcu_dereference(tx->sdata->default_mgmt_key)))
+                tx->key = key;
         else if ((key = rcu_dereference(tx->sdata->default_key)))
                 tx->key = key;
         else if (tx->sdata->drop_unencrypted &&
                  (tx->skb->protocol != cpu_to_be16(ETH_P_PAE)) &&
-                 !(info->flags & IEEE80211_TX_CTL_INJECTED)) {
+                 !(info->flags & IEEE80211_TX_CTL_INJECTED) &&
+                 (!ieee80211_is_robust_mgmt_frame(hdr) ||
+                  (ieee80211_is_action(hdr->frame_control) &&
+                   tx->sta && test_sta_flags(tx->sta, WLAN_STA_MFP)))) {
                 I802_DEBUG_INC(tx->local->tx_handlers_drop_unencrypted);
                 return TX_DROP;
         } else
@@ -428,10 +462,19 @@ ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx)
                         if (ieee80211_is_auth(hdr->frame_control))
                                 break;
                 case ALG_TKIP:
-                case ALG_CCMP:
                         if (!ieee80211_is_data_present(hdr->frame_control))
                                 tx->key = NULL;
                         break;
+                case ALG_CCMP:
+                        if (!ieee80211_is_data_present(hdr->frame_control) &&
+                            !ieee80211_use_mfp(hdr->frame_control, tx->sta,
+                                               tx->skb))
+                                tx->key = NULL;
+                        break;
+                case ALG_AES_CMAC:
+                        if (!ieee80211_is_mgmt(hdr->frame_control))
+                                tx->key = NULL;
+                        break;
                 }
         }
 
@@ -658,17 +701,62 @@ ieee80211_tx_h_sequence(struct ieee80211_tx_data *tx)
         return TX_CONTINUE;
 }
 
+static int ieee80211_fragment(struct ieee80211_local *local,
+                              struct sk_buff *skb, int hdrlen,
+                              int frag_threshold)
+{
+        struct sk_buff *tail = skb, *tmp;
+        int per_fragm = frag_threshold - hdrlen - FCS_LEN;
+        int pos = hdrlen + per_fragm;
+        int rem = skb->len - hdrlen - per_fragm;
+
+        if (WARN_ON(rem < 0))
+                return -EINVAL;
+
+        while (rem) {
+                int fraglen = per_fragm;
+
+                if (fraglen > rem)
+                        fraglen = rem;
+                rem -= fraglen;
+                tmp = dev_alloc_skb(local->tx_headroom +
+                                    frag_threshold +
+                                    IEEE80211_ENCRYPT_HEADROOM +
+                                    IEEE80211_ENCRYPT_TAILROOM);
+                if (!tmp)
+                        return -ENOMEM;
+                tail->next = tmp;
+                tail = tmp;
+                skb_reserve(tmp, local->tx_headroom +
+                                 IEEE80211_ENCRYPT_HEADROOM);
+                /* copy control information */
+                memcpy(tmp->cb, skb->cb, sizeof(tmp->cb));
+                skb_copy_queue_mapping(tmp, skb);
+                tmp->priority = skb->priority;
+                tmp->do_not_encrypt = skb->do_not_encrypt;
+                tmp->dev = skb->dev;
+                tmp->iif = skb->iif;
+
+                /* copy header and data */
+                memcpy(skb_put(tmp, hdrlen), skb->data, hdrlen);
+                memcpy(skb_put(tmp, fraglen), skb->data + pos, fraglen);
+
+                pos += fraglen;
+        }
+
+        skb->len = hdrlen + per_fragm;
+        return 0;
+}
+
 static ieee80211_tx_result debug_noinline
 ieee80211_tx_h_fragment(struct ieee80211_tx_data *tx)
 {
-        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
-        size_t hdrlen, per_fragm, num_fragm, payload_len, left;
-        struct sk_buff **frags, *first, *frag;
-        int i;
-        u16 seq;
-        u8 *pos;
+        struct sk_buff *skb = tx->skb;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+        struct ieee80211_hdr *hdr = (void *)skb->data;
         int frag_threshold = tx->local->fragmentation_threshold;
+        int hdrlen;
+        int fragnum;
 
         if (!(tx->flags & IEEE80211_TX_FRAGMENTED))
                 return TX_CONTINUE;
@@ -681,58 +769,35 @@ ieee80211_tx_h_fragment(struct ieee80211_tx_data *tx)
         if (WARN_ON(info->flags & IEEE80211_TX_CTL_AMPDU))
                 return TX_DROP;
 
-        first = tx->skb;
-
         hdrlen = ieee80211_hdrlen(hdr->frame_control);
-        payload_len = first->len - hdrlen;
-        per_fragm = frag_threshold - hdrlen - FCS_LEN;
-        num_fragm = DIV_ROUND_UP(payload_len, per_fragm);
-
-        frags = kzalloc(num_fragm * sizeof(struct sk_buff *), GFP_ATOMIC);
-        if (!frags)
-                goto fail;
-
-        hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_MOREFRAGS);
-        seq = le16_to_cpu(hdr->seq_ctrl) & IEEE80211_SCTL_SEQ;
-        pos = first->data + hdrlen + per_fragm;
-        left = payload_len - per_fragm;
-        for (i = 0; i < num_fragm - 1; i++) {
-                struct ieee80211_hdr *fhdr;
-                size_t copylen;
-
-                if (left <= 0)
-                        goto fail;
 
-                /* reserve enough extra head and tail room for possible
-                 * encryption */
-                frag = frags[i] =
-                        dev_alloc_skb(tx->local->tx_headroom +
-                                      frag_threshold +
-                                      IEEE80211_ENCRYPT_HEADROOM +
-                                      IEEE80211_ENCRYPT_TAILROOM);
-                if (!frag)
-                        goto fail;
-
-                /* Make sure that all fragments use the same priority so
-                 * that they end up using the same TX queue */
-                frag->priority = first->priority;
+        /* internal error, why is TX_FRAGMENTED set? */
+        if (WARN_ON(skb->len <= frag_threshold))
+                return TX_DROP;
 
-                skb_reserve(frag, tx->local->tx_headroom +
-                                  IEEE80211_ENCRYPT_HEADROOM);
+        /*
+         * Now fragment the frame. This will allocate all the fragments and
+         * chain them (using skb as the first fragment) to skb->next.
+         * During transmission, we will remove the successfully transmitted
+         * fragments from this list. When the low-level driver rejects one
+         * of the fragments then we will simply pretend to accept the skb
+         * but store it away as pending.
+         */
+        if (ieee80211_fragment(tx->local, skb, hdrlen, frag_threshold))
+                return TX_DROP;
 
-                /* copy TX information */
-                info = IEEE80211_SKB_CB(frag);
-                memcpy(info, first->cb, sizeof(frag->cb));
+        /* update duration/seq/flags of fragments */
+        fragnum = 0;
+        do {
+                int next_len;
+                const __le16 morefrags = cpu_to_le16(IEEE80211_FCTL_MOREFRAGS);
 
-                /* copy/fill in 802.11 header */
-                fhdr = (struct ieee80211_hdr *) skb_put(frag, hdrlen);
-                memcpy(fhdr, first->data, hdrlen);
-                fhdr->seq_ctrl = cpu_to_le16(seq | ((i + 1) & IEEE80211_SCTL_FRAG));
+                hdr = (void *)skb->data;
+                info = IEEE80211_SKB_CB(skb);
 
-                if (i == num_fragm - 2) {
-                        /* clear MOREFRAGS bit for the last fragment */
-                        fhdr->frame_control &= cpu_to_le16(~IEEE80211_FCTL_MOREFRAGS);
-                } else {
+                if (skb->next) {
+                        hdr->frame_control |= morefrags;
+                        next_len = skb->next->len;
                         /*
                          * No multi-rate retries for fragmented frames, that
                          * would completely throw off the NAV at other STAs.
@@ -743,35 +808,16 @@ ieee80211_tx_h_fragment(struct ieee80211_tx_data *tx)
                         info->control.rates[4].idx = -1;
                         BUILD_BUG_ON(IEEE80211_TX_MAX_RATES != 5);
                         info->flags &= ~IEEE80211_TX_CTL_RATE_CTRL_PROBE;
+                } else {
+                        hdr->frame_control &= ~morefrags;
+                        next_len = 0;
                 }
-
-                /* copy data */
-                copylen = left > per_fragm ? per_fragm : left;
-                memcpy(skb_put(frag, copylen), pos, copylen);
-
-                skb_copy_queue_mapping(frag, first);
-
-                frag->do_not_encrypt = first->do_not_encrypt;
-
-                pos += copylen;
-                left -= copylen;
-        }
-        skb_trim(first, hdrlen + per_fragm);
-
-        tx->num_extra_frag = num_fragm - 1;
-        tx->extra_frag = frags;
+                hdr->duration_id = ieee80211_duration(tx, 0, next_len);
+                hdr->seq_ctrl |= cpu_to_le16(fragnum & IEEE80211_SCTL_FRAG);
+                fragnum++;
+        } while ((skb = skb->next));
 
         return TX_CONTINUE;
-
- fail:
-        if (frags) {
-                for (i = 0; i < num_fragm - 1; i++)
-                        if (frags[i])
-                                dev_kfree_skb(frags[i]);
-                kfree(frags);
-        }
-        I802_DEBUG_INC(tx->local->tx_handlers_drop_fragment);
-        return TX_DROP;
 }
 
 static ieee80211_tx_result debug_noinline
@@ -787,6 +833,8 @@ ieee80211_tx_h_encrypt(struct ieee80211_tx_data *tx)
                 return ieee80211_crypto_tkip_encrypt(tx);
         case ALG_CCMP:
                 return ieee80211_crypto_ccmp_encrypt(tx);
+        case ALG_AES_CMAC:
+                return ieee80211_crypto_aes_cmac_encrypt(tx);
         }
 
         /* not reached */
@@ -797,27 +845,19 @@ ieee80211_tx_h_encrypt(struct ieee80211_tx_data *tx)
 static ieee80211_tx_result debug_noinline
 ieee80211_tx_h_calculate_duration(struct ieee80211_tx_data *tx)
 {
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
-        int next_len, i;
-        int group_addr = is_multicast_ether_addr(hdr->addr1);
-
-        if (!(tx->flags & IEEE80211_TX_FRAGMENTED)) {
-                hdr->duration_id = ieee80211_duration(tx, group_addr, 0);
-                return TX_CONTINUE;
-        }
-
-        hdr->duration_id = ieee80211_duration(tx, group_addr,
-                                              tx->extra_frag[0]->len);
+        struct sk_buff *skb = tx->skb;
+        struct ieee80211_hdr *hdr;
+        int next_len;
+        bool group_addr;
 
-        for (i = 0; i < tx->num_extra_frag; i++) {
-                if (i + 1 < tx->num_extra_frag)
-                        next_len = tx->extra_frag[i + 1]->len;
-                else
-                        next_len = 0;
+        do {
+                hdr = (void *) skb->data;
+                next_len = skb->next ? skb->next->len : 0;
+                group_addr = is_multicast_ether_addr(hdr->addr1);
 
-                hdr = (struct ieee80211_hdr *)tx->extra_frag[i]->data;
-                hdr->duration_id = ieee80211_duration(tx, 0, next_len);
-        }
+                hdr->duration_id =
+                        ieee80211_duration(tx, group_addr, next_len);
+        } while ((skb = skb->next));
 
         return TX_CONTINUE;
 }
@@ -825,24 +865,20 @@ ieee80211_tx_h_calculate_duration(struct ieee80211_tx_data *tx)
 static ieee80211_tx_result debug_noinline
 ieee80211_tx_h_stats(struct ieee80211_tx_data *tx)
 {
-        int i;
+        struct sk_buff *skb = tx->skb;
 
         if (!tx->sta)
                 return TX_CONTINUE;
 
         tx->sta->tx_packets++;
-        tx->sta->tx_fragments++;
-        tx->sta->tx_bytes += tx->skb->len;
-        if (tx->extra_frag) {
-                tx->sta->tx_fragments += tx->num_extra_frag;
-                for (i = 0; i < tx->num_extra_frag; i++)
-                        tx->sta->tx_bytes += tx->extra_frag[i]->len;
-        }
+        do {
+                tx->sta->tx_fragments++;
+                tx->sta->tx_bytes += skb->len;
+        } while ((skb = skb->next));
 
         return TX_CONTINUE;
 }
 
-
 /* actual transmit path */
 
 /*
@@ -948,9 +984,9 @@ __ieee80211_tx_prepare(struct ieee80211_tx_data *tx,
         struct ieee80211_hdr *hdr;
         struct ieee80211_sub_if_data *sdata;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-
         int hdrlen, tid;
         u8 *qc, *state;
+        bool queued = false;
 
         memset(tx, 0, sizeof(*tx));
         tx->skb = skb;
@@ -977,17 +1013,53 @@ __ieee80211_tx_prepare(struct ieee80211_tx_data *tx,
                  */
         }
 
+        /*
+         * If this flag is set to true anywhere, and we get here,
+         * we are doing the needed processing, so remove the flag
+         * now.
+         */
+        info->flags &= ~IEEE80211_TX_INTFL_NEED_TXPROCESSING;
+
         hdr = (struct ieee80211_hdr *) skb->data;
 
         tx->sta = sta_info_get(local, hdr->addr1);
 
-        if (tx->sta && ieee80211_is_data_qos(hdr->frame_control)) {
+        if (tx->sta && ieee80211_is_data_qos(hdr->frame_control) &&
+            (local->hw.flags & IEEE80211_HW_AMPDU_AGGREGATION)) {
+                unsigned long flags;
+                struct tid_ampdu_tx *tid_tx;
+
                 qc = ieee80211_get_qos_ctl(hdr);
                 tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
 
+                spin_lock_irqsave(&tx->sta->lock, flags);
+                /*
+                 * XXX: This spinlock could be fairly expensive, but see the
+                 *      comment in agg-tx.c:ieee80211_agg_tx_operational().
+                 *      One way to solve this would be to do something RCU-like
+                 *      for managing the tid_tx struct and using atomic bitops
+                 *      for the actual state -- by introducing an actual
+                 *      'operational' bit that would be possible. It would
+                 *      require changing ieee80211_agg_tx_operational() to
+                 *      set that bit, and changing the way tid_tx is managed
+                 *      everywhere, including races between that bit and
+                 *      tid_tx going away (tid_tx being added can be easily
+                 *      committed to memory before the 'operational' bit).
+                 */
+                tid_tx = tx->sta->ampdu_mlme.tid_tx[tid];
                 state = &tx->sta->ampdu_mlme.tid_state_tx[tid];
-                if (*state == HT_AGG_STATE_OPERATIONAL)
+                if (*state == HT_AGG_STATE_OPERATIONAL) {
                         info->flags |= IEEE80211_TX_CTL_AMPDU;
+                } else if (*state != HT_AGG_STATE_IDLE) {
+                        /* in progress */
+                        queued = true;
+                        info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
+                        __skb_queue_tail(&tid_tx->pending, skb);
+                }
+                spin_unlock_irqrestore(&tx->sta->lock, flags);
+
+                if (unlikely(queued))
+                        return TX_QUEUED;
         }
 
         if (is_multicast_ether_addr(hdr->addr1)) {
@@ -1038,51 +1110,55 @@ static int ieee80211_tx_prepare(struct ieee80211_local *local,
         }
         if (unlikely(!dev))
                 return -ENODEV;
-        /* initialises tx with control */
+        /*
+         * initialises tx with control
+         *
+         * return value is safe to ignore here because this function
+         * can only be invoked for multicast frames
+         *
+         * XXX: clean up
+         */
         __ieee80211_tx_prepare(tx, skb, dev);
         dev_put(dev);
         return 0;
 }
 
-static int __ieee80211_tx(struct ieee80211_local *local, struct sk_buff *skb,
-                          struct ieee80211_tx_data *tx)
+static int __ieee80211_tx(struct ieee80211_local *local,
+                          struct sk_buff **skbp,
+                          struct sta_info *sta)
 {
+        struct sk_buff *skb = *skbp, *next;
         struct ieee80211_tx_info *info;
-        int ret, i;
+        int ret, len;
+        bool fragm = false;
 
-        if (skb) {
-                if (netif_subqueue_stopped(local->mdev, skb))
-                        return IEEE80211_TX_AGAIN;
-                info =  IEEE80211_SKB_CB(skb);
+        local->mdev->trans_start = jiffies;
 
-                ret = local->ops->tx(local_to_hw(local), skb);
-                if (ret)
-                        return IEEE80211_TX_AGAIN;
-                local->mdev->trans_start = jiffies;
-                ieee80211_led_tx(local, 1);
-        }
-        if (tx->extra_frag) {
-                for (i = 0; i < tx->num_extra_frag; i++) {
-                        if (!tx->extra_frag[i])
-                                continue;
-                        info = IEEE80211_SKB_CB(tx->extra_frag[i]);
+        while (skb) {
+                if (ieee80211_queue_stopped(&local->hw,
+                                            skb_get_queue_mapping(skb)))
+                        return IEEE80211_TX_PENDING;
+
+                info = IEEE80211_SKB_CB(skb);
+
+                if (fragm)
                         info->flags &= ~(IEEE80211_TX_CTL_CLEAR_PS_FILT |
                                          IEEE80211_TX_CTL_FIRST_FRAGMENT);
-                        if (netif_subqueue_stopped(local->mdev,
-                                                   tx->extra_frag[i]))
-                                return IEEE80211_TX_FRAG_AGAIN;
-
-                        ret = local->ops->tx(local_to_hw(local),
-                                            tx->extra_frag[i]);
-                        if (ret)
-                                return IEEE80211_TX_FRAG_AGAIN;
-                        local->mdev->trans_start = jiffies;
-                        ieee80211_led_tx(local, 1);
-                        tx->extra_frag[i] = NULL;
+
+                next = skb->next;
+                len = skb->len;
+                ret = local->ops->tx(local_to_hw(local), skb);
+                if (WARN_ON(ret != NETDEV_TX_OK && skb->len != len)) {
+                        dev_kfree_skb(skb);
+                        ret = NETDEV_TX_OK;
                 }
-                kfree(tx->extra_frag);
-                tx->extra_frag = NULL;
+                if (ret != NETDEV_TX_OK)
+                        return IEEE80211_TX_AGAIN;
+                *skbp = skb = next;
+                ieee80211_led_tx(local, 1);
+                fragm = true;
         }
+
         return IEEE80211_TX_OK;
 }
 
@@ -1094,7 +1170,6 @@ static int invoke_tx_handlers(struct ieee80211_tx_data *tx)
 {
         struct sk_buff *skb = tx->skb;
         ieee80211_tx_result res = TX_DROP;
-        int i;
 
 #define CALL_TXH(txh)           \
         res = txh(tx);          \
@@ -1118,11 +1193,13 @@ static int invoke_tx_handlers(struct ieee80211_tx_data *tx)
  txh_done:
         if (unlikely(res == TX_DROP)) {
                 I802_DEBUG_INC(tx->local->tx_handlers_drop);
-                dev_kfree_skb(skb);
-                for (i = 0; i < tx->num_extra_frag; i++)
-                        if (tx->extra_frag[i])
-                                dev_kfree_skb(tx->extra_frag[i]);
-                kfree(tx->extra_frag);
+                while (skb) {
+                        struct sk_buff *next;
+
+                        next = skb->next;
+                        dev_kfree_skb(skb);
+                        skb = next;
+                }
                 return -1;
         } else if (unlikely(res == TX_QUEUED)) {
                 I802_DEBUG_INC(tx->local->tx_handlers_queued);
@@ -1132,23 +1209,26 @@ static int invoke_tx_handlers(struct ieee80211_tx_data *tx)
         return 0;
 }
 
-static int ieee80211_tx(struct net_device *dev, struct sk_buff *skb)
+static void ieee80211_tx(struct net_device *dev, struct sk_buff *skb,
+                         bool txpending)
 {
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
         struct sta_info *sta;
         struct ieee80211_tx_data tx;
         ieee80211_tx_result res_prepare;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-        int ret, i;
+        struct sk_buff *next;
+        unsigned long flags;
+        int ret, retries;
         u16 queue;
 
         queue = skb_get_queue_mapping(skb);
 
-        WARN_ON(test_bit(queue, local->queues_pending));
+        WARN_ON(!txpending && !skb_queue_empty(&local->pending[queue]));
 
         if (unlikely(skb->len < 10)) {
                 dev_kfree_skb(skb);
-                return 0;
+                return;
         }
 
         rcu_read_lock();
@@ -1156,10 +1236,13 @@ static int ieee80211_tx(struct net_device *dev, struct sk_buff *skb)
         /* initialises tx */
         res_prepare = __ieee80211_tx_prepare(&tx, skb, dev);
 
-        if (res_prepare == TX_DROP) {
+        if (unlikely(res_prepare == TX_DROP)) {
                 dev_kfree_skb(skb);
                 rcu_read_unlock();
-                return 0;
+                return;
+        } else if (unlikely(res_prepare == TX_QUEUED)) {
+                rcu_read_unlock();
+                return;
         }
 
         sta = tx.sta;
@@ -1169,11 +1252,13 @@ static int ieee80211_tx(struct net_device *dev, struct sk_buff *skb)
         if (invoke_tx_handlers(&tx))
                 goto out;
 
-retry:
-        ret = __ieee80211_tx(local, skb, &tx);
-        if (ret) {
-                struct ieee80211_tx_stored_packet *store;
-
+        retries = 0;
+ retry:
+        ret = __ieee80211_tx(local, &tx.skb, tx.sta);
+        switch (ret) {
+        case IEEE80211_TX_OK:
+                break;
+        case IEEE80211_TX_AGAIN:
                 /*
                  * Since there are no fragmented frames on A-MPDU
                  * queues, there's no reason for a driver to reject
@@ -1181,46 +1266,57 @@ retry:
                  */
                 if (WARN_ON(info->flags & IEEE80211_TX_CTL_AMPDU))
                         goto drop;
+                /* fall through */
+        case IEEE80211_TX_PENDING:
+                skb = tx.skb;
+
+                spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
+
+                if (__netif_subqueue_stopped(local->mdev, queue)) {
+                        do {
+                                next = skb->next;
+                                skb->next = NULL;
+                                if (unlikely(txpending))
+                                        skb_queue_head(&local->pending[queue],
+                                                       skb);
+                                else
+                                        skb_queue_tail(&local->pending[queue],
+                                                       skb);
+                        } while ((skb = next));
 
-                store = &local->pending_packet[queue];
+                        /*
+                         * Make sure nobody will enable the queue on us
+                         * (without going through the tasklet) nor disable the
+                         * netdev queue underneath the pending handling code.
+                         */
+                        __set_bit(IEEE80211_QUEUE_STOP_REASON_PENDING,
+                                  &local->queue_stop_reasons[queue]);
 
-                if (ret == IEEE80211_TX_FRAG_AGAIN)
-                        skb = NULL;
+                        spin_unlock_irqrestore(&local->queue_stop_reason_lock,
+                                               flags);
+                } else {
+                        spin_unlock_irqrestore(&local->queue_stop_reason_lock,
+                                               flags);
 
-                set_bit(queue, local->queues_pending);
-                smp_mb();
-                /*
-                 * When the driver gets out of buffers during sending of
-                 * fragments and calls ieee80211_stop_queue, the netif
-                 * subqueue is stopped. There is, however, a small window
-                 * in which the PENDING bit is not yet set. If a buffer
-                 * gets available in that window (i.e. driver calls
-                 * ieee80211_wake_queue), we would end up with ieee80211_tx
-                 * called with the PENDING bit still set. Prevent this by
-                 * continuing transmitting here when that situation is
-                 * possible to have happened.
-                 */
-                if (!__netif_subqueue_stopped(local->mdev, queue)) {
-                        clear_bit(queue, local->queues_pending);
+                        retries++;
+                        if (WARN(retries > 10, "tx refused but queue active"))
+                                goto drop;
                         goto retry;
                 }
-                store->skb = skb;
-                store->extra_frag = tx.extra_frag;
-                store->num_extra_frag = tx.num_extra_frag;
         }
  out:
         rcu_read_unlock();
-        return 0;
+        return;
 
  drop:
-        if (skb)
-                dev_kfree_skb(skb);
-        for (i = 0; i < tx.num_extra_frag; i++)
-                if (tx.extra_frag[i])
-                        dev_kfree_skb(tx.extra_frag[i]);
-        kfree(tx.extra_frag);
         rcu_read_unlock();
-        return 0;
+
+        skb = tx.skb;
+        while (skb) {
+                next = skb->next;
+                dev_kfree_skb(skb);
+                skb = next;
+        }
 }
 
 /* device xmit handlers */
@@ -1279,7 +1375,6 @@ int ieee80211_master_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 FOUND_SDATA,
                 UNKNOWN_ADDRESS,
         } monitor_iface = NOT_MONITOR;
-        int ret;
 
         if (skb->iif)
                 odev = dev_get_by_index(&init_net, skb->iif);
@@ -1293,7 +1388,20 @@ int ieee80211_master_start_xmit(struct sk_buff *skb, struct net_device *dev)
                        "originating device\n", dev->name);
 #endif
                 dev_kfree_skb(skb);
-                return 0;
+                return NETDEV_TX_OK;
+        }
+
+        if ((local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK) &&
+            local->hw.conf.dynamic_ps_timeout > 0) {
+                if (local->hw.conf.flags & IEEE80211_CONF_PS) {
+                        ieee80211_stop_queues_by_reason(&local->hw,
+                                        IEEE80211_QUEUE_STOP_REASON_PS);
+                        queue_work(local->hw.workqueue,
+                                        &local->dynamic_ps_disable_work);
+                }
+
+                mod_timer(&local->dynamic_ps_timer, jiffies +
+                        msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout));
         }
 
         memset(info, 0, sizeof(*info));
@@ -1309,7 +1417,7 @@ int ieee80211_master_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 else
                         if (mesh_nexthop_lookup(skb, osdata)) {
                                 dev_put(odev);
-                                return 0;
+                                return NETDEV_TX_OK;
                         }
                 if (memcmp(odev->dev_addr, hdr->addr4, ETH_ALEN) != 0)
                         IEEE80211_IFSTA_MESH_CTR_INC(&osdata->u.mesh,
@@ -1371,7 +1479,7 @@ int ieee80211_master_start_xmit(struct sk_buff *skb, struct net_device *dev)
         if (ieee80211_skb_resize(osdata->local, skb, headroom, may_encrypt)) {
                 dev_kfree_skb(skb);
                 dev_put(odev);
-                return 0;
+                return NETDEV_TX_OK;
         }
 
         if (osdata->vif.type == NL80211_IFTYPE_AP_VLAN)
@@ -1380,20 +1488,42 @@ int ieee80211_master_start_xmit(struct sk_buff *skb, struct net_device *dev)
                                       u.ap);
         if (likely(monitor_iface != UNKNOWN_ADDRESS))
                 info->control.vif = &osdata->vif;
-        ret = ieee80211_tx(odev, skb);
+
+        ieee80211_tx(odev, skb, false);
         dev_put(odev);
 
-        return ret;
+        return NETDEV_TX_OK;
 }
 
 int ieee80211_monitor_start_xmit(struct sk_buff *skb,
                                  struct net_device *dev)
 {
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+        struct ieee80211_channel *chan = local->hw.conf.channel;
         struct ieee80211_radiotap_header *prthdr =
                 (struct ieee80211_radiotap_header *)skb->data;
         u16 len_rthdr;
 
+        /*
+         * Frame injection is not allowed if beaconing is not allowed
+         * or if we need radar detection. Beaconing is usually not allowed when
+         * the mode or operation (Adhoc, AP, Mesh) does not support DFS.
+         * Passive scan is also used in world regulatory domains where
+         * your country is not known and as such it should be treated as
+         * NO TX unless the channel is explicitly allowed in which case
+         * your current regulatory domain would not have the passive scan
+         * flag.
+         *
+         * Since AP mode uses monitor interfaces to inject/TX management
+         * frames we can make AP mode the exception to this rule once it
+         * supports radar detection as its implementation can deal with
+         * radar detection by itself. We can do that later by adding a
+         * monitor flag interfaces used for AP support.
+         */
+        if ((chan->flags & (IEEE80211_CHAN_NO_IBSS | IEEE80211_CHAN_RADAR |
+             IEEE80211_CHAN_PASSIVE_SCAN)))
+                goto fail;
+
         /* check for not even having the fixed radiotap header part */
         if (unlikely(skb->len < sizeof(struct ieee80211_radiotap_header)))
                 goto fail; /* too short to be possibly valid */
@@ -1477,19 +1607,6 @@ int ieee80211_subif_start_xmit(struct sk_buff *skb,
                 goto fail;
         }
 
-        if (!(local->hw.flags & IEEE80211_HW_NO_STACK_DYNAMIC_PS) &&
-            local->dynamic_ps_timeout > 0) {
-                if (local->hw.conf.flags & IEEE80211_CONF_PS) {
-                        ieee80211_stop_queues_by_reason(&local->hw,
-                                                        IEEE80211_QUEUE_STOP_REASON_PS);
-                        queue_work(local->hw.workqueue,
-                                   &local->dynamic_ps_disable_work);
-                }
-
-                mod_timer(&local->dynamic_ps_timer, jiffies +
-                          msecs_to_jiffies(local->dynamic_ps_timeout));
-        }
-
         nh_pos = skb_network_header(skb) - skb->data;
         h_pos = skb_transport_header(skb) - skb->data;
 
@@ -1570,7 +1687,7 @@ int ieee80211_subif_start_xmit(struct sk_buff *skb,
         case NL80211_IFTYPE_STATION:
                 fc |= cpu_to_le16(IEEE80211_FCTL_TODS);
                 /* BSSID SA DA */
-                memcpy(hdr.addr1, sdata->u.sta.bssid, ETH_ALEN);
+                memcpy(hdr.addr1, sdata->u.mgd.bssid, ETH_ALEN);
                 memcpy(hdr.addr2, skb->data + ETH_ALEN, ETH_ALEN);
                 memcpy(hdr.addr3, skb->data, ETH_ALEN);
                 hdrlen = 24;
@@ -1579,7 +1696,7 @@ int ieee80211_subif_start_xmit(struct sk_buff *skb,
                 /* DA SA BSSID */
                 memcpy(hdr.addr1, skb->data, ETH_ALEN);
                 memcpy(hdr.addr2, skb->data + ETH_ALEN, ETH_ALEN);
-                memcpy(hdr.addr3, sdata->u.sta.bssid, ETH_ALEN);
+                memcpy(hdr.addr3, sdata->u.ibss.bssid, ETH_ALEN);
                 hdrlen = 24;
                 break;
         default:
@@ -1601,8 +1718,7 @@ int ieee80211_subif_start_xmit(struct sk_buff *skb,
         }
 
         /* receiver and we are QoS enabled, use a QoS type frame */
-        if (sta_flags & WLAN_STA_WME &&
-            ieee80211_num_regular_queues(&local->hw) >= 4) {
+        if ((sta_flags & WLAN_STA_WME) && local->hw.queues >= 4) {
                 fc |= cpu_to_le16(IEEE80211_STYPE_QOS_DATA);
                 hdrlen += 2;
         }
@@ -1734,19 +1850,58 @@ int ieee80211_subif_start_xmit(struct sk_buff *skb,
  */
 void ieee80211_clear_tx_pending(struct ieee80211_local *local)
 {
-        int i, j;
-        struct ieee80211_tx_stored_packet *store;
+        int i;
 
-        for (i = 0; i < ieee80211_num_regular_queues(&local->hw); i++) {
-                if (!test_bit(i, local->queues_pending))
-                        continue;
-                store = &local->pending_packet[i];
-                kfree_skb(store->skb);
-                for (j = 0; j < store->num_extra_frag; j++)
-                        kfree_skb(store->extra_frag[j]);
-                kfree(store->extra_frag);
-                clear_bit(i, local->queues_pending);
+        for (i = 0; i < local->hw.queues; i++)
+                skb_queue_purge(&local->pending[i]);
+}
+
+static bool ieee80211_tx_pending_skb(struct ieee80211_local *local,
+                                     struct sk_buff *skb)
+{
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+        struct ieee80211_sub_if_data *sdata;
+        struct sta_info *sta;
+        struct ieee80211_hdr *hdr;
+        struct net_device *dev;
+        int ret;
+        bool result = true;
+
+        /* does interface still exist? */
+        dev = dev_get_by_index(&init_net, skb->iif);
+        if (!dev) {
+                dev_kfree_skb(skb);
+                return true;
+        }
+
+        /* validate info->control.vif against skb->iif */
+        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
+                sdata = container_of(sdata->bss,
+                                     struct ieee80211_sub_if_data,
+                                     u.ap);
+
+        if (unlikely(info->control.vif && info->control.vif != &sdata->vif)) {
+                dev_kfree_skb(skb);
+                result = true;
+                goto out;
         }
+
+        if (info->flags & IEEE80211_TX_INTFL_NEED_TXPROCESSING) {
+                ieee80211_tx(dev, skb, true);
+        } else {
+                hdr = (struct ieee80211_hdr *)skb->data;
+                sta = sta_info_get(local, hdr->addr1);
+
+                ret = __ieee80211_tx(local, &skb, sta);
+                if (ret != IEEE80211_TX_OK)
+                        result = false;
+        }
+
+ out:
+        dev_put(dev);
+
+        return result;
 }
 
 /*
@@ -1757,40 +1912,53 @@ void ieee80211_tx_pending(unsigned long data)
 {
         struct ieee80211_local *local = (struct ieee80211_local *)data;
         struct net_device *dev = local->mdev;
-        struct ieee80211_tx_stored_packet *store;
-        struct ieee80211_tx_data tx;
-        int i, ret;
+        unsigned long flags;
+        int i;
+        bool next;
 
+        rcu_read_lock();
         netif_tx_lock_bh(dev);
-        for (i = 0; i < ieee80211_num_regular_queues(&local->hw); i++) {
-                /* Check that this queue is ok */
-                if (__netif_subqueue_stopped(local->mdev, i) &&
-                    !test_bit(i, local->queues_pending_run))
-                        continue;
 
-                if (!test_bit(i, local->queues_pending)) {
-                        clear_bit(i, local->queues_pending_run);
-                        ieee80211_wake_queue(&local->hw, i);
+        for (i = 0; i < local->hw.queues; i++) {
+                /*
+                 * If queue is stopped by something other than due to pending
+                 * frames, or we have no pending frames, proceed to next queue.
+                 */
+                spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
+                next = false;
+                if (local->queue_stop_reasons[i] !=
+                        BIT(IEEE80211_QUEUE_STOP_REASON_PENDING) ||
+                    skb_queue_empty(&local->pending[i]))
+                        next = true;
+                spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
+
+                if (next)
                         continue;
-                }
 
-                clear_bit(i, local->queues_pending_run);
+                /*
+                 * start the queue now to allow processing our packets,
+                 * we're under the tx lock here anyway so nothing will
+                 * happen as a result of this
+                 */
                 netif_start_subqueue(local->mdev, i);
 
-                store = &local->pending_packet[i];
-                tx.extra_frag = store->extra_frag;
-                tx.num_extra_frag = store->num_extra_frag;
-                tx.flags = 0;
-                ret = __ieee80211_tx(local, store->skb, &tx);
-                if (ret) {
-                        if (ret == IEEE80211_TX_FRAG_AGAIN)
-                                store->skb = NULL;
-                } else {
-                        clear_bit(i, local->queues_pending);
-                        ieee80211_wake_queue(&local->hw, i);
+                while (!skb_queue_empty(&local->pending[i])) {
+                        struct sk_buff *skb = skb_dequeue(&local->pending[i]);
+
+                        if (!ieee80211_tx_pending_skb(local, skb)) {
+                                skb_queue_head(&local->pending[i], skb);
+                                break;
+                        }
                 }
+
+                /* Start regular packet processing again. */
+                if (skb_queue_empty(&local->pending[i]))
+                        ieee80211_wake_queue_by_reason(&local->hw, i,
+                                        IEEE80211_QUEUE_STOP_REASON_PENDING);
         }
+
         netif_tx_unlock_bh(dev);
+        rcu_read_unlock();
 }
 
 /* functions for drivers to get certain frames */
@@ -1865,7 +2033,6 @@ struct sk_buff *ieee80211_beacon_get(struct ieee80211_hw *hw,
         struct ieee80211_tx_info *info;
         struct ieee80211_sub_if_data *sdata = NULL;
         struct ieee80211_if_ap *ap = NULL;
-        struct ieee80211_if_sta *ifsta = NULL;
         struct beacon_data *beacon;
         struct ieee80211_supported_band *sband;
         enum ieee80211_band band = local->hw.conf.channel->band;
@@ -1917,13 +2084,13 @@ struct sk_buff *ieee80211_beacon_get(struct ieee80211_hw *hw,
                 } else
                         goto out;
         } else if (sdata->vif.type == NL80211_IFTYPE_ADHOC) {
+                struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
                 struct ieee80211_hdr *hdr;
-                ifsta = &sdata->u.sta;
 
-                if (!ifsta->probe_resp)
+                if (!ifibss->probe_resp)
                         goto out;
 
-                skb = skb_copy(ifsta->probe_resp, GFP_ATOMIC);
+                skb = skb_copy(ifibss->probe_resp, GFP_ATOMIC);
                 if (!skb)
                         goto out;
 
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index fb89e1d0aa03..fdf432f14554 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -41,6 +41,15 @@ const unsigned char rfc1042_header[] __aligned(2) =
 const unsigned char bridge_tunnel_header[] __aligned(2) =
         { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0xf8 };
 
+struct ieee80211_hw *wiphy_to_ieee80211_hw(struct wiphy *wiphy)
+{
+        struct ieee80211_local *local;
+        BUG_ON(!wiphy);
+
+        local = wiphy_priv(wiphy);
+        return &local->hw;
+}
+EXPORT_SYMBOL(wiphy_to_ieee80211_hw);
 
 u8 *ieee80211_get_bssid(struct ieee80211_hdr *hdr, size_t len,
                         enum nl80211_iftype type)
@@ -157,18 +166,13 @@ int ieee80211_get_mesh_hdrlen(struct ieee80211s_hdr *meshhdr)
 
 void ieee80211_tx_set_protected(struct ieee80211_tx_data *tx)
 {
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) tx->skb->data;
+        struct sk_buff *skb = tx->skb;
+        struct ieee80211_hdr *hdr;
 
-        hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
-        if (tx->extra_frag) {
-                struct ieee80211_hdr *fhdr;
-                int i;
-                for (i = 0; i < tx->num_extra_frag; i++) {
-                        fhdr = (struct ieee80211_hdr *)
-                                tx->extra_frag[i]->data;
-                        fhdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
-                }
-        }
+        do {
+                hdr = (struct ieee80211_hdr *) skb->data;
+                hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
+        } while ((skb = skb->next));
 }
 
 int ieee80211_frame_duration(struct ieee80211_local *local, size_t len,
@@ -335,21 +339,21 @@ static void __ieee80211_wake_queue(struct ieee80211_hw *hw, int queue,
 {
         struct ieee80211_local *local = hw_to_local(hw);
 
-        /* we don't need to track ampdu queues */
-        if (queue < ieee80211_num_regular_queues(hw)) {
-                __clear_bit(reason, &local->queue_stop_reasons[queue]);
+        if (WARN_ON(queue >= hw->queues))
+                return;
 
-                if (local->queue_stop_reasons[queue] != 0)
-                        /* someone still has this queue stopped */
-                        return;
-        }
+        __clear_bit(reason, &local->queue_stop_reasons[queue]);
 
-        if (test_bit(queue, local->queues_pending)) {
-                set_bit(queue, local->queues_pending_run);
+        if (!skb_queue_empty(&local->pending[queue]) &&
+            local->queue_stop_reasons[queue] ==
+                                BIT(IEEE80211_QUEUE_STOP_REASON_PENDING))
                 tasklet_schedule(&local->tx_pending_tasklet);
-        } else {
-                netif_wake_subqueue(local->mdev, queue);
-        }
+
+        if (local->queue_stop_reasons[queue] != 0)
+                /* someone still has this queue stopped */
+                return;
+
+        netif_wake_subqueue(local->mdev, queue);
 }
 
 void ieee80211_wake_queue_by_reason(struct ieee80211_hw *hw, int queue,
@@ -375,11 +379,18 @@ static void __ieee80211_stop_queue(struct ieee80211_hw *hw, int queue,
 {
         struct ieee80211_local *local = hw_to_local(hw);
 
-        /* we don't need to track ampdu queues */
-        if (queue < ieee80211_num_regular_queues(hw))
-                __set_bit(reason, &local->queue_stop_reasons[queue]);
+        if (WARN_ON(queue >= hw->queues))
+                return;
+
+        /*
+         * Only stop if it was previously running, this is necessary
+         * for correct pending packets handling because there we may
+         * start (but not wake) the queue and rely on that.
+         */
+        if (!local->queue_stop_reasons[queue])
+                netif_stop_subqueue(local->mdev, queue);
 
-        netif_stop_subqueue(local->mdev, queue);
+        __set_bit(reason, &local->queue_stop_reasons[queue]);
 }
 
 void ieee80211_stop_queue_by_reason(struct ieee80211_hw *hw, int queue,
@@ -409,7 +420,7 @@ void ieee80211_stop_queues_by_reason(struct ieee80211_hw *hw,
 
         spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
 
-        for (i = 0; i < ieee80211_num_queues(hw); i++)
+        for (i = 0; i < hw->queues; i++)
                 __ieee80211_stop_queue(hw, i, reason);
 
         spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
@@ -425,6 +436,10 @@ EXPORT_SYMBOL(ieee80211_stop_queues);
 int ieee80211_queue_stopped(struct ieee80211_hw *hw, int queue)
 {
         struct ieee80211_local *local = hw_to_local(hw);
+
+        if (WARN_ON(queue >= hw->queues))
+                return true;
+
         return __netif_subqueue_stopped(local->mdev, queue);
 }
 EXPORT_SYMBOL(ieee80211_queue_stopped);
@@ -438,7 +453,7 @@ void ieee80211_wake_queues_by_reason(struct ieee80211_hw *hw,
 
         spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
 
-        for (i = 0; i < hw->queues + hw->ampdu_queues; i++)
+        for (i = 0; i < hw->queues; i++)
                 __ieee80211_wake_queue(hw, i, reason);
 
         spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
@@ -459,7 +474,7 @@ void ieee80211_iterate_active_interfaces(
         struct ieee80211_local *local = hw_to_local(hw);
         struct ieee80211_sub_if_data *sdata;
 
-        rtnl_lock();
+        mutex_lock(&local->iflist_mtx);
 
         list_for_each_entry(sdata, &local->interfaces, list) {
                 switch (sdata->vif.type) {
@@ -480,7 +495,7 @@ void ieee80211_iterate_active_interfaces(
                                  &sdata->vif);
         }
 
-        rtnl_unlock();
+        mutex_unlock(&local->iflist_mtx);
 }
 EXPORT_SYMBOL_GPL(ieee80211_iterate_active_interfaces);
 
@@ -653,6 +668,10 @@ void ieee802_11_parse_elems(u8 *start, size_t len,
                         elems->pwr_constr_elem = pos;
                         elems->pwr_constr_elem_len = elen;
                         break;
+                case WLAN_EID_TIMEOUT_INTERVAL:
+                        elems->timeout_int = pos;
+                        elems->timeout_int_len = elen;
+                        break;
                 default:
                         break;
                 }
@@ -688,6 +707,27 @@ void ieee80211_set_wmm_default(struct ieee80211_sub_if_data *sdata)
                 local->ops->conf_tx(local_to_hw(local), i, &qparam);
 }
 
+void ieee80211_sta_def_wmm_params(struct ieee80211_sub_if_data *sdata,
+                                  const size_t supp_rates_len,
+                                  const u8 *supp_rates)
+{
+        struct ieee80211_local *local = sdata->local;
+        int i, have_higher_than_11mbit = 0;
+
+        /* cf. IEEE 802.11 9.2.12 */
+        for (i = 0; i < supp_rates_len; i++)
+                if ((supp_rates[i] & 0x7f) * 5 > 110)
+                        have_higher_than_11mbit = 1;
+
+        if (local->hw.conf.channel->band == IEEE80211_BAND_2GHZ &&
+            have_higher_than_11mbit)
+                sdata->flags |= IEEE80211_SDATA_OPERATING_GMODE;
+        else
+                sdata->flags &= ~IEEE80211_SDATA_OPERATING_GMODE;
+
+        ieee80211_set_wmm_default(sdata);
+}
+
 void ieee80211_tx_skb(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb,
                       int encrypt)
 {
@@ -727,12 +767,12 @@ int ieee80211_set_freq(struct ieee80211_sub_if_data *sdata, int freqMHz)
         return ret;
 }
 
-u64 ieee80211_mandatory_rates(struct ieee80211_local *local,
+u32 ieee80211_mandatory_rates(struct ieee80211_local *local,
                               enum ieee80211_band band)
 {
         struct ieee80211_supported_band *sband;
         struct ieee80211_rate *bitrates;
-        u64 mandatory_rates;
+        u32 mandatory_rates;
         enum ieee80211_rate_flags mandatory_flag;
         int i;
 
@@ -754,3 +794,140 @@ u64 ieee80211_mandatory_rates(struct ieee80211_local *local,
                         mandatory_rates |= BIT(i);
         return mandatory_rates;
 }
+
+void ieee80211_send_auth(struct ieee80211_sub_if_data *sdata,
+                         u16 transaction, u16 auth_alg,
+                         u8 *extra, size_t extra_len,
+                         const u8 *bssid, int encrypt)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct sk_buff *skb;
+        struct ieee80211_mgmt *mgmt;
+
+        skb = dev_alloc_skb(local->hw.extra_tx_headroom +
+                            sizeof(*mgmt) + 6 + extra_len);
+        if (!skb) {
+                printk(KERN_DEBUG "%s: failed to allocate buffer for auth "
+                       "frame\n", sdata->dev->name);
+                return;
+        }
+        skb_reserve(skb, local->hw.extra_tx_headroom);
+
+        mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24 + 6);
+        memset(mgmt, 0, 24 + 6);
+        mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
+                                          IEEE80211_STYPE_AUTH);
+        if (encrypt)
+                mgmt->frame_control |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
+        memcpy(mgmt->da, bssid, ETH_ALEN);
+        memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
+        memcpy(mgmt->bssid, bssid, ETH_ALEN);
+        mgmt->u.auth.auth_alg = cpu_to_le16(auth_alg);
+        mgmt->u.auth.auth_transaction = cpu_to_le16(transaction);
+        mgmt->u.auth.status_code = cpu_to_le16(0);
+        if (extra)
+                memcpy(skb_put(skb, extra_len), extra, extra_len);
+
+        ieee80211_tx_skb(sdata, skb, encrypt);
+}
+
+void ieee80211_send_probe_req(struct ieee80211_sub_if_data *sdata, u8 *dst,
+                              u8 *ssid, size_t ssid_len,
+                              u8 *ie, size_t ie_len)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_supported_band *sband;
+        struct sk_buff *skb;
+        struct ieee80211_mgmt *mgmt;
+        u8 *pos, *supp_rates, *esupp_rates = NULL;
+        int i;
+
+        skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*mgmt) + 200 +
+                            ie_len);
+        if (!skb) {
+                printk(KERN_DEBUG "%s: failed to allocate buffer for probe "
+                       "request\n", sdata->dev->name);
+                return;
+        }
+        skb_reserve(skb, local->hw.extra_tx_headroom);
+
+        mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
+        memset(mgmt, 0, 24);
+        mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
+                                          IEEE80211_STYPE_PROBE_REQ);
+        memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
+        if (dst) {
+                memcpy(mgmt->da, dst, ETH_ALEN);
+                memcpy(mgmt->bssid, dst, ETH_ALEN);
+        } else {
+                memset(mgmt->da, 0xff, ETH_ALEN);
+                memset(mgmt->bssid, 0xff, ETH_ALEN);
+        }
+        pos = skb_put(skb, 2 + ssid_len);
+        *pos++ = WLAN_EID_SSID;
+        *pos++ = ssid_len;
+        memcpy(pos, ssid, ssid_len);
+
+        supp_rates = skb_put(skb, 2);
+        supp_rates[0] = WLAN_EID_SUPP_RATES;
+        supp_rates[1] = 0;
+        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
+
+        for (i = 0; i < sband->n_bitrates; i++) {
+                struct ieee80211_rate *rate = &sband->bitrates[i];
+                if (esupp_rates) {
+                        pos = skb_put(skb, 1);
+                        esupp_rates[1]++;
+                } else if (supp_rates[1] == 8) {
+                        esupp_rates = skb_put(skb, 3);
+                        esupp_rates[0] = WLAN_EID_EXT_SUPP_RATES;
+                        esupp_rates[1] = 1;
+                        pos = &esupp_rates[2];
+                } else {
+                        pos = skb_put(skb, 1);
+                        supp_rates[1]++;
+                }
+                *pos = rate->bitrate / 5;
+        }
+
+        if (ie)
+                memcpy(skb_put(skb, ie_len), ie, ie_len);
+
+        ieee80211_tx_skb(sdata, skb, 0);
+}
+
+u32 ieee80211_sta_get_rates(struct ieee80211_local *local,
+                            struct ieee802_11_elems *elems,
+                            enum ieee80211_band band)
+{
+        struct ieee80211_supported_band *sband;
+        struct ieee80211_rate *bitrates;
+        size_t num_rates;
+        u32 supp_rates;
+        int i, j;
+        sband = local->hw.wiphy->bands[band];
+
+        if (!sband) {
+                WARN_ON(1);
+                sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
+        }
+
+        bitrates = sband->bitrates;
+        num_rates = sband->n_bitrates;
+        supp_rates = 0;
+        for (i = 0; i < elems->supp_rates_len +
+                     elems->ext_supp_rates_len; i++) {
+                u8 rate = 0;
+                int own_rate;
+                if (i < elems->supp_rates_len)
+                        rate = elems->supp_rates[i];
+                else if (elems->ext_supp_rates)
+                        rate = elems->ext_supp_rates
+                                [i - elems->supp_rates_len];
+                own_rate = 5 * (rate & 0x7f);
+                for (j = 0; j < num_rates; j++)
+                        if (bitrates[j].bitrate == own_rate)
+                                supp_rates |= BIT(j);
+        }
+        return supp_rates;
+}
diff --git a/net/mac80211/wep.c b/net/mac80211/wep.c
index 7043ddc75498..ef73105b3061 100644
--- a/net/mac80211/wep.c
+++ b/net/mac80211/wep.c
@@ -329,24 +329,17 @@ static int wep_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
 ieee80211_tx_result
 ieee80211_crypto_wep_encrypt(struct ieee80211_tx_data *tx)
 {
-        int i;
+        struct sk_buff *skb;
 
         ieee80211_tx_set_protected(tx);
 
-        if (wep_encrypt_skb(tx, tx->skb) < 0) {
-                I802_DEBUG_INC(tx->local->tx_handlers_drop_wep);
-                return TX_DROP;
-        }
-
-        if (tx->extra_frag) {
-                for (i = 0; i < tx->num_extra_frag; i++) {
-                        if (wep_encrypt_skb(tx, tx->extra_frag[i])) {
-                                I802_DEBUG_INC(tx->local->
-                                               tx_handlers_drop_wep);
-                                return TX_DROP;
-                        }
+        skb = tx->skb;
+        do {
+                if (wep_encrypt_skb(tx, skb) < 0) {
+                        I802_DEBUG_INC(tx->local->tx_handlers_drop_wep);
+                        return TX_DROP;
                 }
-        }
+        } while ((skb = skb->next));
 
         return TX_CONTINUE;
 }
diff --git a/net/mac80211/wext.c b/net/mac80211/wext.c
index 7162d5816f39..deb4ecec122a 100644
--- a/net/mac80211/wext.c
+++ b/net/mac80211/wext.c
@@ -37,7 +37,14 @@ static int ieee80211_set_encryption(struct ieee80211_sub_if_data *sdata, u8 *sta
         struct ieee80211_key *key;
         int err;
 
-        if (idx < 0 || idx >= NUM_DEFAULT_KEYS) {
+        if (alg == ALG_AES_CMAC) {
+                if (idx < NUM_DEFAULT_KEYS ||
+                    idx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS) {
+                        printk(KERN_DEBUG "%s: set_encrypt - invalid idx=%d "
+                               "(BIP)\n", sdata->dev->name, idx);
+                        return -EINVAL;
+                }
+        } else if (idx < 0 || idx >= NUM_DEFAULT_KEYS) {
                 printk(KERN_DEBUG "%s: set_encrypt - invalid idx=%d\n",
                        sdata->dev->name, idx);
                 return -EINVAL;
@@ -103,6 +110,9 @@ static int ieee80211_set_encryption(struct ieee80211_sub_if_data *sdata, u8 *sta
 
                 if (set_tx_key || (!sta && !sdata->default_key && key))
                         ieee80211_set_default_key(sdata, idx);
+                if (alg == ALG_AES_CMAC &&
+                    (set_tx_key || (!sta && !sdata->default_mgmt_key && key)))
+                        ieee80211_set_default_mgmt_key(sdata, idx);
         }
 
  out_unlock:
@@ -119,125 +129,38 @@ static int ieee80211_ioctl_siwgenie(struct net_device *dev,
 
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
-        if (sdata->flags & IEEE80211_SDATA_USERSPACE_MLME)
-                return -EOPNOTSUPP;
-
-        if (sdata->vif.type == NL80211_IFTYPE_STATION ||
-            sdata->vif.type == NL80211_IFTYPE_ADHOC) {
+        if (sdata->vif.type == NL80211_IFTYPE_STATION) {
                 int ret = ieee80211_sta_set_extra_ie(sdata, extra, data->length);
                 if (ret)
                         return ret;
-                sdata->u.sta.flags &= ~IEEE80211_STA_AUTO_BSSID_SEL;
-                ieee80211_sta_req_auth(sdata, &sdata->u.sta);
+                sdata->u.mgd.flags &= ~IEEE80211_STA_AUTO_BSSID_SEL;
+                sdata->u.mgd.flags &= ~IEEE80211_STA_EXT_SME;
+                ieee80211_sta_req_auth(sdata);
                 return 0;
         }
 
         return -EOPNOTSUPP;
 }
 
-static int ieee80211_ioctl_giwrange(struct net_device *dev,
-                                 struct iw_request_info *info,
-                                 struct iw_point *data, char *extra)
-{
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        struct iw_range *range = (struct iw_range *) extra;
-        enum ieee80211_band band;
-        int c = 0;
-
-        data->length = sizeof(struct iw_range);
-        memset(range, 0, sizeof(struct iw_range));
-
-        range->we_version_compiled = WIRELESS_EXT;
-        range->we_version_source = 21;
-        range->retry_capa = IW_RETRY_LIMIT;
-        range->retry_flags = IW_RETRY_LIMIT;
-        range->min_retry = 0;
-        range->max_retry = 255;
-        range->min_rts = 0;
-        range->max_rts = 2347;
-        range->min_frag = 256;
-        range->max_frag = 2346;
-
-        range->encoding_size[0] = 5;
-        range->encoding_size[1] = 13;
-        range->num_encoding_sizes = 2;
-        range->max_encoding_tokens = NUM_DEFAULT_KEYS;
-
-        if (local->hw.flags & IEEE80211_HW_SIGNAL_UNSPEC ||
-            local->hw.flags & IEEE80211_HW_SIGNAL_DB)
-                range->max_qual.level = local->hw.max_signal;
-        else if  (local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
-                range->max_qual.level = -110;
-        else
-                range->max_qual.level = 0;
-
-        if (local->hw.flags & IEEE80211_HW_NOISE_DBM)
-                range->max_qual.noise = -110;
-        else
-                range->max_qual.noise = 0;
-
-        range->max_qual.qual = 100;
-        range->max_qual.updated = local->wstats_flags;
-
-        range->avg_qual.qual = 50;
-        /* not always true but better than nothing */
-        range->avg_qual.level = range->max_qual.level / 2;
-        range->avg_qual.noise = range->max_qual.noise / 2;
-        range->avg_qual.updated = local->wstats_flags;
-
-        range->enc_capa = IW_ENC_CAPA_WPA | IW_ENC_CAPA_WPA2 |
-                          IW_ENC_CAPA_CIPHER_TKIP | IW_ENC_CAPA_CIPHER_CCMP;
-
-
-        for (band = 0; band < IEEE80211_NUM_BANDS; band ++) {
-                int i;
-                struct ieee80211_supported_band *sband;
-
-                sband = local->hw.wiphy->bands[band];
-
-                if (!sband)
-                        continue;
-
-                for (i = 0; i < sband->n_channels && c < IW_MAX_FREQUENCIES; i++) {
-                        struct ieee80211_channel *chan = &sband->channels[i];
-
-                        if (!(chan->flags & IEEE80211_CHAN_DISABLED)) {
-                                range->freq[c].i =
-                                        ieee80211_frequency_to_channel(
-                                                chan->center_freq);
-                                range->freq[c].m = chan->center_freq;
-                                range->freq[c].e = 6;
-                                c++;
-                        }
-                }
-        }
-        range->num_channels = c;
-        range->num_frequency = c;
-
-        IW_EVENT_CAPA_SET_KERNEL(range->event_capa);
-        IW_EVENT_CAPA_SET(range->event_capa, SIOCGIWAP);
-        IW_EVENT_CAPA_SET(range->event_capa, SIOCGIWSCAN);
-
-        range->scan_capa |= IW_SCAN_CAPA_ESSID;
-
-        return 0;
-}
-
-
 static int ieee80211_ioctl_siwfreq(struct net_device *dev,
                                    struct iw_request_info *info,
                                    struct iw_freq *freq, char *extra)
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
-        if (sdata->vif.type == NL80211_IFTYPE_STATION)
-                sdata->u.sta.flags &= ~IEEE80211_STA_AUTO_CHANNEL_SEL;
+        if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
+                sdata->u.ibss.flags &= ~IEEE80211_IBSS_AUTO_CHANNEL_SEL;
+        else if (sdata->vif.type == NL80211_IFTYPE_STATION)
+                sdata->u.mgd.flags &= ~IEEE80211_STA_AUTO_CHANNEL_SEL;
 
         /* freq->e == 0: freq->m = channel; otherwise freq = m * 10^e */
         if (freq->e == 0) {
                 if (freq->m < 0) {
-                        if (sdata->vif.type == NL80211_IFTYPE_STATION)
-                                sdata->u.sta.flags |=
+                        if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
+                                sdata->u.ibss.flags |=
+                                        IEEE80211_IBSS_AUTO_CHANNEL_SEL;
+                        else if (sdata->vif.type == NL80211_IFTYPE_STATION)
+                                sdata->u.mgd.flags |=
                                         IEEE80211_STA_AUTO_CHANNEL_SEL;
                         return 0;
                 } else
@@ -274,32 +197,28 @@ static int ieee80211_ioctl_siwessid(struct net_device *dev,
 {
         struct ieee80211_sub_if_data *sdata;
         size_t len = data->length;
+        int ret;
 
         /* iwconfig uses nul termination in SSID.. */
         if (len > 0 && ssid[len - 1] == '\0')
                 len--;
 
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        if (sdata->vif.type == NL80211_IFTYPE_STATION ||
-            sdata->vif.type == NL80211_IFTYPE_ADHOC) {
-                int ret;
-                if (sdata->flags & IEEE80211_SDATA_USERSPACE_MLME) {
-                        if (len > IEEE80211_MAX_SSID_LEN)
-                                return -EINVAL;
-                        memcpy(sdata->u.sta.ssid, ssid, len);
-                        sdata->u.sta.ssid_len = len;
-                        return 0;
-                }
+        if (sdata->vif.type == NL80211_IFTYPE_STATION) {
                 if (data->flags)
-                        sdata->u.sta.flags &= ~IEEE80211_STA_AUTO_SSID_SEL;
+                        sdata->u.mgd.flags &= ~IEEE80211_STA_AUTO_SSID_SEL;
                 else
-                        sdata->u.sta.flags |= IEEE80211_STA_AUTO_SSID_SEL;
+                        sdata->u.mgd.flags |= IEEE80211_STA_AUTO_SSID_SEL;
+
                 ret = ieee80211_sta_set_ssid(sdata, ssid, len);
                 if (ret)
                         return ret;
-                ieee80211_sta_req_auth(sdata, &sdata->u.sta);
+
+                sdata->u.mgd.flags &= ~IEEE80211_STA_EXT_SME;
+                ieee80211_sta_req_auth(sdata);
                 return 0;
-        }
+        } else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
+                return ieee80211_ibss_set_ssid(sdata, ssid, len);
 
         return -EOPNOTSUPP;
 }
@@ -313,8 +232,7 @@ static int ieee80211_ioctl_giwessid(struct net_device *dev,
 
         struct ieee80211_sub_if_data *sdata;
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        if (sdata->vif.type == NL80211_IFTYPE_STATION ||
-            sdata->vif.type == NL80211_IFTYPE_ADHOC) {
+        if (sdata->vif.type == NL80211_IFTYPE_STATION) {
                 int res = ieee80211_sta_get_ssid(sdata, ssid, &len);
                 if (res == 0) {
                         data->length = len;
@@ -322,6 +240,14 @@ static int ieee80211_ioctl_giwessid(struct net_device *dev,
                 } else
                         data->flags = 0;
                 return res;
+        } else if (sdata->vif.type == NL80211_IFTYPE_ADHOC) {
+                int res = ieee80211_ibss_get_ssid(sdata, ssid, &len);
+                if (res == 0) {
+                        data->length = len;
+                        data->flags = 1;
+                } else
+                        data->flags = 0;
+                return res;
         }
 
         return -EOPNOTSUPP;
@@ -335,26 +261,32 @@ static int ieee80211_ioctl_siwap(struct net_device *dev,
         struct ieee80211_sub_if_data *sdata;
 
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        if (sdata->vif.type == NL80211_IFTYPE_STATION ||
-            sdata->vif.type == NL80211_IFTYPE_ADHOC) {
+        if (sdata->vif.type == NL80211_IFTYPE_STATION) {
                 int ret;
-                if (sdata->flags & IEEE80211_SDATA_USERSPACE_MLME) {
-                        memcpy(sdata->u.sta.bssid, (u8 *) &ap_addr->sa_data,
-                               ETH_ALEN);
-                        return 0;
-                }
+
                 if (is_zero_ether_addr((u8 *) &ap_addr->sa_data))
-                        sdata->u.sta.flags |= IEEE80211_STA_AUTO_BSSID_SEL |
+                        sdata->u.mgd.flags |= IEEE80211_STA_AUTO_BSSID_SEL |
                                 IEEE80211_STA_AUTO_CHANNEL_SEL;
                 else if (is_broadcast_ether_addr((u8 *) &ap_addr->sa_data))
-                        sdata->u.sta.flags |= IEEE80211_STA_AUTO_BSSID_SEL;
+                        sdata->u.mgd.flags |= IEEE80211_STA_AUTO_BSSID_SEL;
                 else
-                        sdata->u.sta.flags &= ~IEEE80211_STA_AUTO_BSSID_SEL;
+                        sdata->u.mgd.flags &= ~IEEE80211_STA_AUTO_BSSID_SEL;
                 ret = ieee80211_sta_set_bssid(sdata, (u8 *) &ap_addr->sa_data);
                 if (ret)
                         return ret;
-                ieee80211_sta_req_auth(sdata, &sdata->u.sta);
+                sdata->u.mgd.flags &= ~IEEE80211_STA_EXT_SME;
+                ieee80211_sta_req_auth(sdata);
                 return 0;
+        } else if (sdata->vif.type == NL80211_IFTYPE_ADHOC) {
+                if (is_zero_ether_addr((u8 *) &ap_addr->sa_data))
+                        sdata->u.ibss.flags |= IEEE80211_IBSS_AUTO_BSSID_SEL |
+                                               IEEE80211_IBSS_AUTO_CHANNEL_SEL;
+                else if (is_broadcast_ether_addr((u8 *) &ap_addr->sa_data))
+                        sdata->u.ibss.flags |= IEEE80211_IBSS_AUTO_BSSID_SEL;
+                else
+                        sdata->u.ibss.flags &= ~IEEE80211_IBSS_AUTO_BSSID_SEL;
+
+                return ieee80211_ibss_set_bssid(sdata, (u8 *) &ap_addr->sa_data);
         } else if (sdata->vif.type == NL80211_IFTYPE_WDS) {
                 /*
                  * If it is necessary to update the WDS peer address
@@ -383,17 +315,20 @@ static int ieee80211_ioctl_giwap(struct net_device *dev,
         struct ieee80211_sub_if_data *sdata;
 
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        if (sdata->vif.type == NL80211_IFTYPE_STATION ||
-            sdata->vif.type == NL80211_IFTYPE_ADHOC) {
-                if (sdata->u.sta.state == IEEE80211_STA_MLME_ASSOCIATED ||
-                    sdata->u.sta.state == IEEE80211_STA_MLME_IBSS_JOINED) {
+        if (sdata->vif.type == NL80211_IFTYPE_STATION) {
+                if (sdata->u.mgd.state == IEEE80211_STA_MLME_ASSOCIATED) {
                         ap_addr->sa_family = ARPHRD_ETHER;
-                        memcpy(&ap_addr->sa_data, sdata->u.sta.bssid, ETH_ALEN);
-                        return 0;
-                } else {
+                        memcpy(&ap_addr->sa_data, sdata->u.mgd.bssid, ETH_ALEN);
+                } else
                         memset(&ap_addr->sa_data, 0, ETH_ALEN);
-                        return 0;
-                }
+                return 0;
+        } else if (sdata->vif.type == NL80211_IFTYPE_ADHOC) {
+                if (sdata->u.ibss.state == IEEE80211_IBSS_MLME_JOINED) {
+                        ap_addr->sa_family = ARPHRD_ETHER;
+                        memcpy(&ap_addr->sa_data, sdata->u.ibss.bssid, ETH_ALEN);
+                } else
+                        memset(&ap_addr->sa_data, 0, ETH_ALEN);
+                return 0;
         } else if (sdata->vif.type == NL80211_IFTYPE_WDS) {
                 ap_addr->sa_family = ARPHRD_ETHER;
                 memcpy(&ap_addr->sa_data, sdata->u.wds.remote_addr, ETH_ALEN);
@@ -404,58 +339,6 @@ static int ieee80211_ioctl_giwap(struct net_device *dev,
 }
 
 
-static int ieee80211_ioctl_siwscan(struct net_device *dev,
-                                   struct iw_request_info *info,
-                                   union iwreq_data *wrqu, char *extra)
-{
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        struct iw_scan_req *req = NULL;
-        u8 *ssid = NULL;
-        size_t ssid_len = 0;
-
-        if (!netif_running(dev))
-                return -ENETDOWN;
-
-        if (sdata->vif.type != NL80211_IFTYPE_STATION &&
-            sdata->vif.type != NL80211_IFTYPE_ADHOC &&
-            sdata->vif.type != NL80211_IFTYPE_MESH_POINT)
-                return -EOPNOTSUPP;
-
-        /* if SSID was specified explicitly then use that */
-        if (wrqu->data.length == sizeof(struct iw_scan_req) &&
-            wrqu->data.flags & IW_SCAN_THIS_ESSID) {
-                req = (struct iw_scan_req *)extra;
-                ssid = req->essid;
-                ssid_len = req->essid_len;
-        }
-
-        return ieee80211_request_scan(sdata, ssid, ssid_len);
-}
-
-
-static int ieee80211_ioctl_giwscan(struct net_device *dev,
-                                   struct iw_request_info *info,
-                                   struct iw_point *data, char *extra)
-{
-        int res;
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        struct ieee80211_sub_if_data *sdata;
-
-        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-
-        if (local->sw_scanning || local->hw_scanning)
-                return -EAGAIN;
-
-        res = ieee80211_scan_results(local, info, extra, data->length);
-        if (res >= 0) {
-                data->length = res;
-                return 0;
-        }
-        data->length = 0;
-        return res;
-}
-
-
 static int ieee80211_ioctl_siwrate(struct net_device *dev,
                                   struct iw_request_info *info,
                                   struct iw_param *rate, char *extra)
@@ -511,7 +394,7 @@ static int ieee80211_ioctl_giwrate(struct net_device *dev,
 
         rcu_read_lock();
 
-        sta = sta_info_get(local, sdata->u.sta.bssid);
+        sta = sta_info_get(local, sdata->u.mgd.bssid);
 
         if (sta && !(sta->last_tx_rate.flags & IEEE80211_TX_RC_MCS))
                 rate->value = sband->bitrates[sta->last_tx_rate.idx].bitrate;
@@ -549,10 +432,9 @@ static int ieee80211_ioctl_siwtxpower(struct net_device *dev,
         else /* Automatic power level setting */
                 new_power_level = chan->max_power;
 
-        if (local->hw.conf.power_level != new_power_level) {
-                local->hw.conf.power_level = new_power_level;
+        local->user_power_level = new_power_level;
+        if (local->hw.conf.power_level != new_power_level)
                 reconf_flags |= IEEE80211_CONF_CHANGE_POWER;
-        }
 
         if (local->hw.conf.radio_enabled != !(data->txpower.disabled)) {
                 local->hw.conf.radio_enabled = !(data->txpower.disabled);
@@ -713,8 +595,7 @@ static int ieee80211_ioctl_siwmlme(struct net_device *dev,
         struct iw_mlme *mlme = (struct iw_mlme *) extra;
 
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        if (sdata->vif.type != NL80211_IFTYPE_STATION &&
-            sdata->vif.type != NL80211_IFTYPE_ADHOC)
+        if (!(sdata->vif.type == NL80211_IFTYPE_STATION))
                 return -EINVAL;
 
         switch (mlme->cmd) {
@@ -737,7 +618,7 @@ static int ieee80211_ioctl_siwencode(struct net_device *dev,
         struct ieee80211_sub_if_data *sdata;
         int idx, i, alg = ALG_WEP;
         u8 bcaddr[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
-        int remove = 0;
+        int remove = 0, ret;
 
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
@@ -763,11 +644,20 @@ static int ieee80211_ioctl_siwencode(struct net_device *dev,
                 return 0;
         }
 
-        return ieee80211_set_encryption(
+        ret = ieee80211_set_encryption(
                 sdata, bcaddr,
                 idx, alg, remove,
                 !sdata->default_key,
                 keybuf, erq->length);
+
+        if (!ret) {
+                if (remove)
+                        sdata->u.mgd.flags &= ~IEEE80211_STA_TKIP_WEP_USED;
+                else
+                        sdata->u.mgd.flags |= IEEE80211_STA_TKIP_WEP_USED;
+        }
+
+        return ret;
 }
 
 
@@ -810,8 +700,7 @@ static int ieee80211_ioctl_giwencode(struct net_device *dev,
         erq->flags |= IW_ENCODE_ENABLED;
 
         if (sdata->vif.type == NL80211_IFTYPE_STATION) {
-                struct ieee80211_if_sta *ifsta = &sdata->u.sta;
-                switch (ifsta->auth_alg) {
+                switch (sdata->u.mgd.auth_alg) {
                 case WLAN_AUTH_OPEN:
                 case WLAN_AUTH_LEAP:
                         erq->flags |= IW_ENCODE_OPEN;
@@ -836,6 +725,9 @@ static int ieee80211_ioctl_siwpower(struct net_device *dev,
         int ret = 0, timeout = 0;
         bool ps;
 
+        if (!(local->hw.flags & IEEE80211_HW_SUPPORTS_PS))
+                return -EOPNOTSUPP;
+
         if (sdata->vif.type != NL80211_IFTYPE_STATION)
                 return -EINVAL;
 
@@ -852,31 +744,49 @@ static int ieee80211_ioctl_siwpower(struct net_device *dev,
                 ps = true;
                 break;
         default:                /* Otherwise we ignore */
-                break;
+                return -EINVAL;
         }
 
+        if (wrq->flags & ~(IW_POWER_MODE | IW_POWER_TIMEOUT))
+                return -EINVAL;
+
         if (wrq->flags & IW_POWER_TIMEOUT)
                 timeout = wrq->value / 1000;
 
-set:
-        if (ps == local->powersave && timeout == local->dynamic_ps_timeout)
+ set:
+        if (ps == local->powersave && timeout == conf->dynamic_ps_timeout)
                 return ret;
 
         local->powersave = ps;
-        local->dynamic_ps_timeout = timeout;
+        conf->dynamic_ps_timeout = timeout;
 
-        if (sdata->u.sta.flags & IEEE80211_STA_ASSOCIATED) {
-                if (!(local->hw.flags & IEEE80211_HW_NO_STACK_DYNAMIC_PS) &&
-                    local->dynamic_ps_timeout > 0)
-                        mod_timer(&local->dynamic_ps_timer, jiffies +
-                                  msecs_to_jiffies(local->dynamic_ps_timeout));
-                else {
-                        if (local->powersave)
-                                conf->flags |= IEEE80211_CONF_PS;
-                        else
-                                conf->flags &= ~IEEE80211_CONF_PS;
+        if (local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_PS)
+                ret = ieee80211_hw_config(local,
+                                          IEEE80211_CONF_CHANGE_DYNPS_TIMEOUT);
+
+        if (!(sdata->u.mgd.flags & IEEE80211_STA_ASSOCIATED))
+                return ret;
+
+        if (conf->dynamic_ps_timeout > 0 &&
+            !(local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_PS)) {
+                mod_timer(&local->dynamic_ps_timer, jiffies +
+                          msecs_to_jiffies(conf->dynamic_ps_timeout));
+        } else {
+                if (local->powersave) {
+                        if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK)
+                                ieee80211_send_nullfunc(local, sdata, 1);
+                        conf->flags |= IEEE80211_CONF_PS;
+                        ret = ieee80211_hw_config(local,
+                                        IEEE80211_CONF_CHANGE_PS);
+                } else {
+                        conf->flags &= ~IEEE80211_CONF_PS;
+                        ret = ieee80211_hw_config(local,
+                                        IEEE80211_CONF_CHANGE_PS);
+                        if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK)
+                                ieee80211_send_nullfunc(local, sdata, 0);
+                        del_timer_sync(&local->dynamic_ps_timer);
+                        cancel_work_sync(&local->dynamic_ps_enable_work);
                 }
-                ret = ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
         }
 
         return ret;
@@ -903,11 +813,22 @@ static int ieee80211_ioctl_siwauth(struct net_device *dev,
 
         switch (data->flags & IW_AUTH_INDEX) {
         case IW_AUTH_WPA_VERSION:
-        case IW_AUTH_CIPHER_PAIRWISE:
         case IW_AUTH_CIPHER_GROUP:
         case IW_AUTH_WPA_ENABLED:
         case IW_AUTH_RX_UNENCRYPTED_EAPOL:
         case IW_AUTH_KEY_MGMT:
+        case IW_AUTH_CIPHER_GROUP_MGMT:
+                break;
+        case IW_AUTH_CIPHER_PAIRWISE:
+                if (sdata->vif.type == NL80211_IFTYPE_STATION) {
+                        if (data->value & (IW_AUTH_CIPHER_WEP40 |
+                            IW_AUTH_CIPHER_WEP104 | IW_AUTH_CIPHER_TKIP))
+                                sdata->u.mgd.flags |=
+                                        IEEE80211_STA_TKIP_WEP_USED;
+                        else
+                                sdata->u.mgd.flags &=
+                                        ~IEEE80211_STA_TKIP_WEP_USED;
+                }
                 break;
         case IW_AUTH_DROP_UNENCRYPTED:
                 sdata->drop_unencrypted = !!data->value;
@@ -916,24 +837,45 @@ static int ieee80211_ioctl_siwauth(struct net_device *dev,
                 if (sdata->vif.type != NL80211_IFTYPE_STATION)
                         ret = -EINVAL;
                 else {
-                        sdata->u.sta.flags &= ~IEEE80211_STA_PRIVACY_INVOKED;
+                        sdata->u.mgd.flags &= ~IEEE80211_STA_PRIVACY_INVOKED;
                         /*
                          * Privacy invoked by wpa_supplicant, store the
                          * value and allow associating to a protected
                          * network without having a key up front.
                          */
                         if (data->value)
-                                sdata->u.sta.flags |=
+                                sdata->u.mgd.flags |=
                                         IEEE80211_STA_PRIVACY_INVOKED;
                 }
                 break;
         case IW_AUTH_80211_AUTH_ALG:
-                if (sdata->vif.type == NL80211_IFTYPE_STATION ||
-                    sdata->vif.type == NL80211_IFTYPE_ADHOC)
-                        sdata->u.sta.auth_algs = data->value;
+                if (sdata->vif.type == NL80211_IFTYPE_STATION)
+                        sdata->u.mgd.auth_algs = data->value;
                 else
                         ret = -EOPNOTSUPP;
                 break;
+        case IW_AUTH_MFP:
+                if (!(sdata->local->hw.flags & IEEE80211_HW_MFP_CAPABLE)) {
+                        ret = -EOPNOTSUPP;
+                        break;
+                }
+                if (sdata->vif.type == NL80211_IFTYPE_STATION) {
+                        switch (data->value) {
+                        case IW_AUTH_MFP_DISABLED:
+                                sdata->u.mgd.mfp = IEEE80211_MFP_DISABLED;
+                                break;
+                        case IW_AUTH_MFP_OPTIONAL:
+                                sdata->u.mgd.mfp = IEEE80211_MFP_OPTIONAL;
+                                break;
+                        case IW_AUTH_MFP_REQUIRED:
+                                sdata->u.mgd.mfp = IEEE80211_MFP_REQUIRED;
+                                break;
+                        default:
+                                ret = -EINVAL;
+                        }
+                } else
+                        ret = -EOPNOTSUPP;
+                break;
         default:
                 ret = -EOPNOTSUPP;
                 break;
@@ -951,9 +893,9 @@ static struct iw_statistics *ieee80211_get_wireless_stats(struct net_device *dev
 
         rcu_read_lock();
 
-        if (sdata->vif.type == NL80211_IFTYPE_STATION ||
-            sdata->vif.type == NL80211_IFTYPE_ADHOC)
-                sta = sta_info_get(local, sdata->u.sta.bssid);
+        if (sdata->vif.type == NL80211_IFTYPE_STATION)
+                sta = sta_info_get(local, sdata->u.mgd.bssid);
+
         if (!sta) {
                 wstats->discard.fragment = 0;
                 wstats->discard.misc = 0;
@@ -962,10 +904,45 @@ static struct iw_statistics *ieee80211_get_wireless_stats(struct net_device *dev
                 wstats->qual.noise = 0;
                 wstats->qual.updated = IW_QUAL_ALL_INVALID;
         } else {
-                wstats->qual.level = sta->last_signal;
-                wstats->qual.qual = sta->last_qual;
-                wstats->qual.noise = sta->last_noise;
-                wstats->qual.updated = local->wstats_flags;
+                wstats->qual.updated = 0;
+                /*
+                 * mirror what cfg80211 does for iwrange/scan results,
+                 * otherwise userspace gets confused.
+                 */
+                if (local->hw.flags & (IEEE80211_HW_SIGNAL_UNSPEC |
+                                       IEEE80211_HW_SIGNAL_DBM)) {
+                        wstats->qual.updated |= IW_QUAL_LEVEL_UPDATED;
+                        wstats->qual.updated |= IW_QUAL_QUAL_UPDATED;
+                } else {
+                        wstats->qual.updated |= IW_QUAL_LEVEL_INVALID;
+                        wstats->qual.updated |= IW_QUAL_QUAL_INVALID;
+                }
+
+                if (local->hw.flags & IEEE80211_HW_SIGNAL_UNSPEC) {
+                        wstats->qual.level = sta->last_signal;
+                        wstats->qual.qual = sta->last_signal;
+                } else if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM) {
+                        int sig = sta->last_signal;
+
+                        wstats->qual.updated |= IW_QUAL_DBM;
+                        wstats->qual.level = sig;
+                        if (sig < -110)
+                                sig = -110;
+                        else if (sig > -40)
+                                sig = -40;
+                        wstats->qual.qual = sig + 110;
+                }
+
+                if (local->hw.flags & IEEE80211_HW_NOISE_DBM) {
+                        /*
+                         * This assumes that if driver reports noise, it also
+                         * reports signal in dBm.
+                         */
+                        wstats->qual.noise = sta->last_noise;
+                        wstats->qual.updated |= IW_QUAL_NOISE_UPDATED;
+                } else {
+                        wstats->qual.updated |= IW_QUAL_NOISE_INVALID;
+                }
         }
 
         rcu_read_unlock();
@@ -982,9 +959,8 @@ static int ieee80211_ioctl_giwauth(struct net_device *dev,
 
         switch (data->flags & IW_AUTH_INDEX) {
         case IW_AUTH_80211_AUTH_ALG:
-                if (sdata->vif.type == NL80211_IFTYPE_STATION ||
-                    sdata->vif.type == NL80211_IFTYPE_ADHOC)
-                        data->value = sdata->u.sta.auth_algs;
+                if (sdata->vif.type == NL80211_IFTYPE_STATION)
+                        data->value = sdata->u.mgd.auth_algs;
                 else
                         ret = -EOPNOTSUPP;
                 break;
@@ -1017,6 +993,9 @@ static int ieee80211_ioctl_siwencodeext(struct net_device *dev,
         case IW_ENCODE_ALG_CCMP:
                 alg = ALG_CCMP;
                 break;
+        case IW_ENCODE_ALG_AES_CMAC:
+                alg = ALG_AES_CMAC;
+                break;
         default:
                 return -EOPNOTSUPP;
         }
@@ -1025,20 +1004,41 @@ static int ieee80211_ioctl_siwencodeext(struct net_device *dev,
                 remove = 1;
 
         idx = erq->flags & IW_ENCODE_INDEX;
-        if (idx < 1 || idx > 4) {
-                idx = -1;
-                if (!sdata->default_key)
-                        idx = 0;
-                else for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
-                        if (sdata->default_key == sdata->keys[i]) {
-                                idx = i;
-                                break;
+        if (alg == ALG_AES_CMAC) {
+                if (idx < NUM_DEFAULT_KEYS + 1 ||
+                    idx > NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS) {
+                        idx = -1;
+                        if (!sdata->default_mgmt_key)
+                                idx = 0;
+                        else for (i = NUM_DEFAULT_KEYS;
+                                  i < NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS;
+                                  i++) {
+                                if (sdata->default_mgmt_key == sdata->keys[i])
+                                {
+                                        idx = i;
+                                        break;
+                                }
                         }
-                }
-                if (idx < 0)
-                        return -EINVAL;
-        } else
-                idx--;
+                        if (idx < 0)
+                                return -EINVAL;
+                } else
+                        idx--;
+        } else {
+                if (idx < 1 || idx > 4) {
+                        idx = -1;
+                        if (!sdata->default_key)
+                                idx = 0;
+                        else for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
+                                if (sdata->default_key == sdata->keys[i]) {
+                                        idx = i;
+                                        break;
+                                }
+                        }
+                        if (idx < 0)
+                                return -EINVAL;
+                } else
+                        idx--;
+        }
 
         return ieee80211_set_encryption(sdata, ext->addr.sa_data, idx, alg,
                                         remove,
@@ -1063,7 +1063,7 @@ static const iw_handler ieee80211_handler[] =
         (iw_handler) NULL,                              /* SIOCSIWSENS */
         (iw_handler) NULL,                              /* SIOCGIWSENS */
         (iw_handler) NULL /* not used */,               /* SIOCSIWRANGE */
-        (iw_handler) ieee80211_ioctl_giwrange,          /* SIOCGIWRANGE */
+        (iw_handler) cfg80211_wext_giwrange,            /* SIOCGIWRANGE */
         (iw_handler) NULL /* not used */,               /* SIOCSIWPRIV */
         (iw_handler) NULL /* kernel code */,            /* SIOCGIWPRIV */
         (iw_handler) NULL /* not used */,               /* SIOCSIWSTATS */
@@ -1076,8 +1076,8 @@ static const iw_handler ieee80211_handler[] =
         (iw_handler) ieee80211_ioctl_giwap,             /* SIOCGIWAP */
         (iw_handler) ieee80211_ioctl_siwmlme,           /* SIOCSIWMLME */
         (iw_handler) NULL,                              /* SIOCGIWAPLIST */
-        (iw_handler) ieee80211_ioctl_siwscan,           /* SIOCSIWSCAN */
-        (iw_handler) ieee80211_ioctl_giwscan,           /* SIOCGIWSCAN */
+        (iw_handler) cfg80211_wext_siwscan,             /* SIOCSIWSCAN */
+        (iw_handler) cfg80211_wext_giwscan,             /* SIOCGIWSCAN */
         (iw_handler) ieee80211_ioctl_siwessid,          /* SIOCSIWESSID */
         (iw_handler) ieee80211_ioctl_giwessid,          /* SIOCGIWESSID */
         (iw_handler) NULL,                              /* SIOCSIWNICKN */
diff --git a/net/mac80211/wme.c b/net/mac80211/wme.c
index ac71b38f7cb5..0b8ad1f4ecdd 100644
--- a/net/mac80211/wme.c
+++ b/net/mac80211/wme.c
@@ -99,10 +99,13 @@ static u16 classify80211(struct ieee80211_local *local, struct sk_buff *skb)
         /* in case we are a client verify acm is not set for this ac */
         while (unlikely(local->wmm_acm & BIT(skb->priority))) {
                 if (wme_downgrade_ac(skb)) {
-                        /* The old code would drop the packet in this
-                         * case.
+                        /*
+                         * This should not really happen. The AP has marked all
+                         * lower ACs to require admission control which is not
+                         * a reasonable configuration. Allow the frame to be
+                         * transmitted using AC_BK as a workaround.
                          */
-                        return 0;
+                        break;
                 }
         }
 
@@ -114,9 +117,7 @@ u16 ieee80211_select_queue(struct net_device *dev, struct sk_buff *skb)
 {
         struct ieee80211_master_priv *mpriv = netdev_priv(dev);
         struct ieee80211_local *local = mpriv->local;
-        struct ieee80211_hw *hw = &local->hw;
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
-        struct sta_info *sta;
         u16 queue;
         u8 tid;
 
@@ -124,29 +125,11 @@ u16 ieee80211_select_queue(struct net_device *dev, struct sk_buff *skb)
         if (unlikely(queue >= local->hw.queues))
                 queue = local->hw.queues - 1;
 
-        if (skb->requeue) {
-                if (!hw->ampdu_queues)
-                        return queue;
-
-                rcu_read_lock();
-                sta = sta_info_get(local, hdr->addr1);
-                tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
-                if (sta) {
-                        int ampdu_queue = sta->tid_to_tx_q[tid];
-
-                        if ((ampdu_queue < ieee80211_num_queues(hw)) &&
-                            test_bit(ampdu_queue, local->queue_pool))
-                                queue = ampdu_queue;
-                }
-                rcu_read_unlock();
-
-                return queue;
-        }
-
-        /* Now we know the 1d priority, fill in the QoS header if
-         * there is one.
+        /*
+         * Now we know the 1d priority, fill in the QoS header if
+         * there is one (and we haven't done this before).
          */
-        if (ieee80211_is_data_qos(hdr->frame_control)) {
+        if (!skb->requeue && ieee80211_is_data_qos(hdr->frame_control)) {
                 u8 *p = ieee80211_get_qos_ctl(hdr);
                 u8 ack_policy = 0;
                 tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
@@ -156,140 +139,7 @@ u16 ieee80211_select_queue(struct net_device *dev, struct sk_buff *skb)
                 /* qos header is 2 bytes, second reserved */
                 *p++ = ack_policy | tid;
                 *p = 0;
-
-                if (!hw->ampdu_queues)
-                        return queue;
-
-                rcu_read_lock();
-
-                sta = sta_info_get(local, hdr->addr1);
-                if (sta) {
-                        int ampdu_queue = sta->tid_to_tx_q[tid];
-
-                        if ((ampdu_queue < ieee80211_num_queues(hw)) &&
-                            test_bit(ampdu_queue, local->queue_pool))
-                                queue = ampdu_queue;
-                }
-
-                rcu_read_unlock();
         }
 
         return queue;
 }
-
-int ieee80211_ht_agg_queue_add(struct ieee80211_local *local,
-                               struct sta_info *sta, u16 tid)
-{
-        int i;
-
-        /* XXX: currently broken due to cb/requeue use */
-        return -EPERM;
-
-        /* prepare the filter and save it for the SW queue
-         * matching the received HW queue */
-
-        if (!local->hw.ampdu_queues)
-                return -EPERM;
-
-        /* try to get a Qdisc from the pool */
-        for (i = local->hw.queues; i < ieee80211_num_queues(&local->hw); i++)
-                if (!test_and_set_bit(i, local->queue_pool)) {
-                        ieee80211_stop_queue(local_to_hw(local), i);
-                        sta->tid_to_tx_q[tid] = i;
-
-                        /* IF there are already pending packets
-                         * on this tid first we need to drain them
-                         * on the previous queue
-                         * since HT is strict in order */
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                        if (net_ratelimit())
-                                printk(KERN_DEBUG "allocated aggregation queue"
-                                        " %d tid %d addr %pM pool=0x%lX\n",
-                                        i, tid, sta->sta.addr,
-                                        local->queue_pool[0]);
-#endif /* CONFIG_MAC80211_HT_DEBUG */
-                        return 0;
-                }
-
-        return -EAGAIN;
-}
-
-/**
- * the caller needs to hold netdev_get_tx_queue(local->mdev, X)->lock
- */
-void ieee80211_ht_agg_queue_remove(struct ieee80211_local *local,
-                                   struct sta_info *sta, u16 tid,
-                                   u8 requeue)
-{
-        int agg_queue = sta->tid_to_tx_q[tid];
-        struct ieee80211_hw *hw = &local->hw;
-
-        /* return the qdisc to the pool */
-        clear_bit(agg_queue, local->queue_pool);
-        sta->tid_to_tx_q[tid] = ieee80211_num_queues(hw);
-
-        if (requeue) {
-                ieee80211_requeue(local, agg_queue);
-        } else {
-                struct netdev_queue *txq;
-                spinlock_t *root_lock;
-                struct Qdisc *q;
-
-                txq = netdev_get_tx_queue(local->mdev, agg_queue);
-                q = rcu_dereference(txq->qdisc);
-                root_lock = qdisc_lock(q);
-
-                spin_lock_bh(root_lock);
-                qdisc_reset(q);
-                spin_unlock_bh(root_lock);
-        }
-}
-
-void ieee80211_requeue(struct ieee80211_local *local, int queue)
-{
-        struct netdev_queue *txq = netdev_get_tx_queue(local->mdev, queue);
-        struct sk_buff_head list;
-        spinlock_t *root_lock;
-        struct Qdisc *qdisc;
-        u32 len;
-
-        rcu_read_lock_bh();
-
-        qdisc = rcu_dereference(txq->qdisc);
-        if (!qdisc || !qdisc->dequeue)
-                goto out_unlock;
-
-        skb_queue_head_init(&list);
-
-        root_lock = qdisc_root_lock(qdisc);
-        spin_lock(root_lock);
-        for (len = qdisc->q.qlen; len > 0; len--) {
-                struct sk_buff *skb = qdisc->dequeue(qdisc);
-
-                if (skb)
-                        __skb_queue_tail(&list, skb);
-        }
-        spin_unlock(root_lock);
-
-        for (len = list.qlen; len > 0; len--) {
-                struct sk_buff *skb = __skb_dequeue(&list);
-                u16 new_queue;
-
-                BUG_ON(!skb);
-                new_queue = ieee80211_select_queue(local->mdev, skb);
-                skb_set_queue_mapping(skb, new_queue);
-
-                txq = netdev_get_tx_queue(local->mdev, new_queue);
-
-
-                qdisc = rcu_dereference(txq->qdisc);
-                root_lock = qdisc_root_lock(qdisc);
-
-                spin_lock(root_lock);
-                qdisc_enqueue_root(skb, qdisc);
-                spin_unlock(root_lock);
-        }
-
-out_unlock:
-        rcu_read_unlock_bh();
-}
diff --git a/net/mac80211/wme.h b/net/mac80211/wme.h
index bc62f28a4d3d..7520d2e014dc 100644
--- a/net/mac80211/wme.h
+++ b/net/mac80211/wme.h
@@ -21,11 +21,5 @@
 extern const int ieee802_1d_to_ac[8];
 
 u16 ieee80211_select_queue(struct net_device *dev, struct sk_buff *skb);
-int ieee80211_ht_agg_queue_add(struct ieee80211_local *local,
-                               struct sta_info *sta, u16 tid);
-void ieee80211_ht_agg_queue_remove(struct ieee80211_local *local,
-                                   struct sta_info *sta, u16 tid,
-                                   u8 requeue);
-void ieee80211_requeue(struct ieee80211_local *local, int queue);
 
 #endif /* _WME_H */
diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c
index 7aa63caf8d50..4f8bfea278f2 100644
--- a/net/mac80211/wpa.c
+++ b/net/mac80211/wpa.c
@@ -1,5 +1,6 @@
 /*
  * Copyright 2002-2004, Instant802 Networks, Inc.
+ * Copyright 2008, Jouni Malinen <j@w1.fi>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
@@ -19,6 +20,7 @@
 #include "michael.h"
 #include "tkip.h"
 #include "aes_ccm.h"
+#include "aes_cmac.h"
 #include "wpa.h"
 
 ieee80211_tx_result
@@ -194,19 +196,13 @@ ieee80211_tx_result
 ieee80211_crypto_tkip_encrypt(struct ieee80211_tx_data *tx)
 {
         struct sk_buff *skb = tx->skb;
-        int i;
 
         ieee80211_tx_set_protected(tx);
 
-        if (tkip_encrypt_skb(tx, skb) < 0)
-                return TX_DROP;
-
-        if (tx->extra_frag) {
-                for (i = 0; i < tx->num_extra_frag; i++) {
-                        if (tkip_encrypt_skb(tx, tx->extra_frag[i]))
-                                return TX_DROP;
-                }
-        }
+        do {
+                if (tkip_encrypt_skb(tx, skb) < 0)
+                        return TX_DROP;
+        } while ((skb = skb->next));
 
         return TX_CONTINUE;
 }
@@ -266,7 +262,7 @@ static void ccmp_special_blocks(struct sk_buff *skb, u8 *pn, u8 *scratch,
                                 int encrypted)
 {
         __le16 mask_fc;
-        int a4_included;
+        int a4_included, mgmt;
         u8 qos_tid;
         u8 *b_0, *aad;
         u16 data_len, len_a;
@@ -277,12 +273,15 @@ static void ccmp_special_blocks(struct sk_buff *skb, u8 *pn, u8 *scratch,
         aad = scratch + 4 * AES_BLOCK_LEN;
 
         /*
-         * Mask FC: zero subtype b4 b5 b6
+         * Mask FC: zero subtype b4 b5 b6 (if not mgmt)
          * Retry, PwrMgt, MoreData; set Protected
          */
+        mgmt = ieee80211_is_mgmt(hdr->frame_control);
         mask_fc = hdr->frame_control;
-        mask_fc &= ~cpu_to_le16(0x0070 | IEEE80211_FCTL_RETRY |
+        mask_fc &= ~cpu_to_le16(IEEE80211_FCTL_RETRY |
                                 IEEE80211_FCTL_PM | IEEE80211_FCTL_MOREDATA);
+        if (!mgmt)
+                mask_fc &= ~cpu_to_le16(0x0070);
         mask_fc |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
 
         hdrlen = ieee80211_hdrlen(hdr->frame_control);
@@ -300,8 +299,10 @@ static void ccmp_special_blocks(struct sk_buff *skb, u8 *pn, u8 *scratch,
 
         /* First block, b_0 */
         b_0[0] = 0x59; /* flags: Adata: 1, M: 011, L: 001 */
-        /* Nonce: QoS Priority | A2 | PN */
-        b_0[1] = qos_tid;
+        /* Nonce: Nonce Flags | A2 | PN
+         * Nonce Flags: Priority (b0..b3) | Management (b4) | Reserved (b5..b7)
+         */
+        b_0[1] = qos_tid | (mgmt << 4);
         memcpy(&b_0[2], hdr->addr2, ETH_ALEN);
         memcpy(&b_0[8], pn, CCMP_PN_LEN);
         /* l(m) */
@@ -360,9 +361,14 @@ static int ccmp_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
         int hdrlen, len, tail;
         u8 *pos, *pn;
         int i;
+        bool skip_hw;
+
+        skip_hw = (tx->key->conf.flags & IEEE80211_KEY_FLAG_SW_MGMT) &&
+                ieee80211_is_mgmt(hdr->frame_control);
 
         if ((tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) &&
-            !(tx->key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV)) {
+            !(tx->key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV) &&
+            !skip_hw) {
                 /* hwaccel - with no need for preallocated room for CCMP
                  * header or MIC fields */
                 info->control.hw_key = &tx->key->conf;
@@ -397,7 +403,7 @@ static int ccmp_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
 
         ccmp_pn2hdr(pos, pn, key->conf.keyidx);
 
-        if (key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) {
+        if ((key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) && !skip_hw) {
                 /* hwaccel - with preallocated room for CCMP header */
                 info->control.hw_key = &tx->key->conf;
                 return 0;
@@ -416,19 +422,13 @@ ieee80211_tx_result
 ieee80211_crypto_ccmp_encrypt(struct ieee80211_tx_data *tx)
 {
         struct sk_buff *skb = tx->skb;
-        int i;
 
         ieee80211_tx_set_protected(tx);
 
-        if (ccmp_encrypt_skb(tx, skb) < 0)
-                return TX_DROP;
-
-        if (tx->extra_frag) {
-                for (i = 0; i < tx->num_extra_frag; i++) {
-                        if (ccmp_encrypt_skb(tx, tx->extra_frag[i]))
-                                return TX_DROP;
-                }
-        }
+        do {
+                if (ccmp_encrypt_skb(tx, skb) < 0)
+                        return TX_DROP;
+        } while ((skb = skb->next));
 
         return TX_CONTINUE;
 }
@@ -446,7 +446,8 @@ ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx)
 
         hdrlen = ieee80211_hdrlen(hdr->frame_control);
 
-        if (!ieee80211_is_data(hdr->frame_control))
+        if (!ieee80211_is_data(hdr->frame_control) &&
+            !ieee80211_is_robust_mgmt_frame(hdr))
                 return RX_CONTINUE;
 
         data_len = skb->len - hdrlen - CCMP_HDR_LEN - CCMP_MIC_LEN;
@@ -485,3 +486,126 @@ ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx)
 
         return RX_CONTINUE;
 }
+
+
+static void bip_aad(struct sk_buff *skb, u8 *aad)
+{
+        /* BIP AAD: FC(masked) || A1 || A2 || A3 */
+
+        /* FC type/subtype */
+        aad[0] = skb->data[0];
+        /* Mask FC Retry, PwrMgt, MoreData flags to zero */
+        aad[1] = skb->data[1] & ~(BIT(4) | BIT(5) | BIT(6));
+        /* A1 || A2 || A3 */
+        memcpy(aad + 2, skb->data + 4, 3 * ETH_ALEN);
+}
+
+
+static inline void bip_ipn_swap(u8 *d, const u8 *s)
+{
+        *d++ = s[5];
+        *d++ = s[4];
+        *d++ = s[3];
+        *d++ = s[2];
+        *d++ = s[1];
+        *d = s[0];
+}
+
+
+ieee80211_tx_result
+ieee80211_crypto_aes_cmac_encrypt(struct ieee80211_tx_data *tx)
+{
+        struct sk_buff *skb = tx->skb;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+        struct ieee80211_key *key = tx->key;
+        struct ieee80211_mmie *mmie;
+        u8 *pn, aad[20];
+        int i;
+
+        if (tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) {
+                /* hwaccel */
+                info->control.hw_key = &tx->key->conf;
+                return 0;
+        }
+
+        if (WARN_ON(skb_tailroom(skb) < sizeof(*mmie)))
+                return TX_DROP;
+
+        mmie = (struct ieee80211_mmie *) skb_put(skb, sizeof(*mmie));
+        mmie->element_id = WLAN_EID_MMIE;
+        mmie->length = sizeof(*mmie) - 2;
+        mmie->key_id = cpu_to_le16(key->conf.keyidx);
+
+        /* PN = PN + 1 */
+        pn = key->u.aes_cmac.tx_pn;
+
+        for (i = sizeof(key->u.aes_cmac.tx_pn) - 1; i >= 0; i--) {
+                pn[i]++;
+                if (pn[i])
+                        break;
+        }
+        bip_ipn_swap(mmie->sequence_number, pn);
+
+        bip_aad(skb, aad);
+
+        /*
+         * MIC = AES-128-CMAC(IGTK, AAD || Management Frame Body || MMIE, 64)
+         */
+        ieee80211_aes_cmac(key->u.aes_cmac.tfm, key->u.aes_cmac.tx_crypto_buf,
+                           aad, skb->data + 24, skb->len - 24, mmie->mic);
+
+        return TX_CONTINUE;
+}
+
+
+ieee80211_rx_result
+ieee80211_crypto_aes_cmac_decrypt(struct ieee80211_rx_data *rx)
+{
+        struct sk_buff *skb = rx->skb;
+        struct ieee80211_key *key = rx->key;
+        struct ieee80211_mmie *mmie;
+        u8 aad[20], mic[8], ipn[6];
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
+
+        if (!ieee80211_is_mgmt(hdr->frame_control))
+                return RX_CONTINUE;
+
+        if ((rx->status->flag & RX_FLAG_DECRYPTED) &&
+            (rx->status->flag & RX_FLAG_IV_STRIPPED))
+                return RX_CONTINUE;
+
+        if (skb->len < 24 + sizeof(*mmie))
+                return RX_DROP_UNUSABLE;
+
+        mmie = (struct ieee80211_mmie *)
+                (skb->data + skb->len - sizeof(*mmie));
+        if (mmie->element_id != WLAN_EID_MMIE ||
+            mmie->length != sizeof(*mmie) - 2)
+                return RX_DROP_UNUSABLE; /* Invalid MMIE */
+
+        bip_ipn_swap(ipn, mmie->sequence_number);
+
+        if (memcmp(ipn, key->u.aes_cmac.rx_pn, 6) <= 0) {
+                key->u.aes_cmac.replays++;
+                return RX_DROP_UNUSABLE;
+        }
+
+        if (!(rx->status->flag & RX_FLAG_DECRYPTED)) {
+                /* hardware didn't decrypt/verify MIC */
+                bip_aad(skb, aad);
+                ieee80211_aes_cmac(key->u.aes_cmac.tfm,
+                                   key->u.aes_cmac.rx_crypto_buf, aad,
+                                   skb->data + 24, skb->len - 24, mic);
+                if (memcmp(mic, mmie->mic, sizeof(mmie->mic)) != 0) {
+                        key->u.aes_cmac.icverrors++;
+                        return RX_DROP_UNUSABLE;
+                }
+        }
+
+        memcpy(key->u.aes_cmac.rx_pn, ipn, 6);
+
+        /* Remove MMIE */
+        skb_trim(skb, skb->len - sizeof(*mmie));
+
+        return RX_CONTINUE;
+}
diff --git a/net/mac80211/wpa.h b/net/mac80211/wpa.h
index d42d221d8a1d..baba0608313e 100644
--- a/net/mac80211/wpa.h
+++ b/net/mac80211/wpa.h
@@ -28,4 +28,9 @@ ieee80211_crypto_ccmp_encrypt(struct ieee80211_tx_data *tx);
 ieee80211_rx_result
 ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx);
 
+ieee80211_tx_result
+ieee80211_crypto_aes_cmac_encrypt(struct ieee80211_tx_data *tx);
+ieee80211_rx_result
+ieee80211_crypto_aes_cmac_decrypt(struct ieee80211_rx_data *rx);
+
 #endif /* WPA_H */