Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next-2.6: (1429 commits)
  net: Allow dependancies of FDDI & Tokenring to be modular.
  igb: Fix build warning when DCA is disabled.
  net: Fix warning fallout from recent NAPI interface changes.
  gro: Fix potential use after free
  sfc: If AN is enabled, always read speed/duplex from the AN advertising bits
  sfc: When disabling the NIC, close the device rather than unregistering it
  sfc: SFT9001: Add cable diagnostics
  sfc: Add support for multiple PHY self-tests
  sfc: Merge top-level functions for self-tests
  sfc: Clean up PHY mode management in loopback self-test
  sfc: Fix unreliable link detection in some loopback modes
  sfc: Generate unique names for per-NIC workqueues
  802.3ad: use standard ethhdr instead of ad_header
  802.3ad: generalize out mac address initializer
  802.3ad: initialize ports LACPDU from const initializer
  802.3ad: remove typedef around ad_system
  802.3ad: turn ports is_individual into a bool
  802.3ad: turn ports is_enabled into a bool
  802.3ad: make ntt bool
  ixgbe: Fix set_ringparam in ixgbe to use the same memory pools.
  ...

Fixed trivial IPv4/6 address printing conflicts in fs/cifs/connect.c due
to the conversion to %pI (in this networking merge) and the addition of
doing IPv6 addresses (from the earlier merge of CIFS).

37 files changed, 1663 insertions, 1572 deletions

diff --git a/net/mac80211/Kconfig b/net/mac80211/Kconfig
index 7f710a27e91c..60c16162474c 100644
--- a/net/mac80211/Kconfig
+++ b/net/mac80211/Kconfig
@@ -16,20 +16,20 @@ menu "Rate control algorithm selection"
 
 config MAC80211_RC_PID
         bool "PID controller based rate control algorithm" if EMBEDDED
-        default y
         ---help---
           This option enables a TX rate control algorithm for
           mac80211 that uses a PID controller to select the TX
           rate.
 
 config MAC80211_RC_MINSTREL
-        bool "Minstrel"
+        bool "Minstrel" if EMBEDDED
+        default y
         ---help---
           This option enables the 'minstrel' TX rate control algorithm
 
 choice
         prompt "Default rate control algorithm"
-        default MAC80211_RC_DEFAULT_PID
+        default MAC80211_RC_DEFAULT_MINSTREL
         ---help---
           This option selects the default rate control algorithm
           mac80211 will use. Note that this default can still be
@@ -55,8 +55,8 @@ endchoice
 
 config MAC80211_RC_DEFAULT
         string
-        default "pid" if MAC80211_RC_DEFAULT_PID
         default "minstrel" if MAC80211_RC_DEFAULT_MINSTREL
+        default "pid" if MAC80211_RC_DEFAULT_PID
         default ""
 
 endmenu
diff --git a/net/mac80211/Makefile b/net/mac80211/Makefile
index 31cfd1f89a72..7d4971aa443f 100644
--- a/net/mac80211/Makefile
+++ b/net/mac80211/Makefile
@@ -46,3 +46,5 @@ rc80211_minstrel-$(CONFIG_MAC80211_DEBUGFS) += rc80211_minstrel_debugfs.o
 
 mac80211-$(CONFIG_MAC80211_RC_PID) += $(rc80211_pid-y)
 mac80211-$(CONFIG_MAC80211_RC_MINSTREL) += $(rc80211_minstrel-y)
+
+ccflags-y += -D__CHECK_ENDIAN__
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 855126a3039d..9d4e4d846ec1 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -17,13 +17,6 @@
 #include "rate.h"
 #include "mesh.h"
 
-struct ieee80211_hw *wiphy_to_hw(struct wiphy *wiphy)
-{
-        struct ieee80211_local *local = wiphy_priv(wiphy);
-        return &local->hw;
-}
-EXPORT_SYMBOL(wiphy_to_hw);
-
 static bool nl80211_type_check(enum nl80211_iftype type)
 {
         switch (type) {
@@ -33,6 +26,8 @@ static bool nl80211_type_check(enum nl80211_iftype type)
 #ifdef CONFIG_MAC80211_MESH
         case NL80211_IFTYPE_MESH_POINT:
 #endif
+        case NL80211_IFTYPE_AP:
+        case NL80211_IFTYPE_AP_VLAN:
         case NL80211_IFTYPE_WDS:
                 return true;
         default:
@@ -315,12 +310,35 @@ static void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
 
         sinfo->filled = STATION_INFO_INACTIVE_TIME |
                         STATION_INFO_RX_BYTES |
-                        STATION_INFO_TX_BYTES;
+                        STATION_INFO_TX_BYTES |
+                        STATION_INFO_TX_BITRATE;
 
         sinfo->inactive_time = jiffies_to_msecs(jiffies - sta->last_rx);
         sinfo->rx_bytes = sta->rx_bytes;
         sinfo->tx_bytes = sta->tx_bytes;
 
+        if (sta->local->hw.flags & IEEE80211_HW_SIGNAL_DBM) {
+                sinfo->filled |= STATION_INFO_SIGNAL;
+                sinfo->signal = (s8)sta->last_signal;
+        }
+
+        sinfo->txrate.flags = 0;
+        if (sta->last_tx_rate.flags & IEEE80211_TX_RC_MCS)
+                sinfo->txrate.flags |= RATE_INFO_FLAGS_MCS;
+        if (sta->last_tx_rate.flags & IEEE80211_TX_RC_40_MHZ_WIDTH)
+                sinfo->txrate.flags |= RATE_INFO_FLAGS_40_MHZ_WIDTH;
+        if (sta->last_tx_rate.flags & IEEE80211_TX_RC_SHORT_GI)
+                sinfo->txrate.flags |= RATE_INFO_FLAGS_SHORT_GI;
+
+        if (!(sta->last_tx_rate.flags & IEEE80211_TX_RC_MCS)) {
+                struct ieee80211_supported_band *sband;
+                sband = sta->local->hw.wiphy->bands[
+                                sta->local->hw.conf.channel->band];
+                sinfo->txrate.legacy =
+                        sband->bitrates[sta->last_tx_rate.idx].bitrate;
+        } else
+                sinfo->txrate.mcs = sta->last_tx_rate.idx;
+
         if (ieee80211_vif_is_mesh(&sdata->vif)) {
 #ifdef CONFIG_MAC80211_MESH
                 sinfo->filled |= STATION_INFO_LLID |
@@ -401,8 +419,10 @@ static int ieee80211_config_beacon(struct ieee80211_sub_if_data *sdata,
          */
         if (params->interval) {
                 sdata->local->hw.conf.beacon_int = params->interval;
-                if (ieee80211_hw_config(sdata->local))
-                        return -EINVAL;
+                err = ieee80211_hw_config(sdata->local,
+                                        IEEE80211_CONF_CHANGE_BEACON_INTERVAL);
+                if (err < 0)
+                        return err;
                 /*
                  * We updated some parameter so if below bails out
                  * it's not an error.
@@ -589,6 +609,8 @@ static void sta_apply_parameters(struct ieee80211_local *local,
         struct ieee80211_supported_band *sband;
         struct ieee80211_sub_if_data *sdata = sta->sdata;
 
+        sband = local->hw.wiphy->bands[local->oper_channel->band];
+
         /*
          * FIXME: updating the flags is racy when this function is
          *        called from ieee80211_change_station(), this will
@@ -629,7 +651,6 @@ static void sta_apply_parameters(struct ieee80211_local *local,
 
         if (params->supported_rates) {
                 rates = 0;
-                sband = local->hw.wiphy->bands[local->oper_channel->band];
 
                 for (i = 0; i < params->supported_rates_len; i++) {
                         int rate = (params->supported_rates[i] & 0x7f) * 5;
@@ -641,10 +662,10 @@ static void sta_apply_parameters(struct ieee80211_local *local,
                 sta->sta.supp_rates[local->oper_channel->band] = rates;
         }
 
-        if (params->ht_capa) {
-                ieee80211_ht_cap_ie_to_ht_info(params->ht_capa,
-                                               &sta->sta.ht_info);
-        }
+        if (params->ht_capa)
+                ieee80211_ht_cap_ie_to_sta_ht_cap(sband,
+                                                  params->ht_capa,
+                                                  &sta->sta.ht_cap);
 
         if (ieee80211_vif_is_mesh(&sdata->vif) && params->plink_action) {
                 switch (params->plink_action) {
@@ -665,6 +686,7 @@ static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev,
         struct sta_info *sta;
         struct ieee80211_sub_if_data *sdata;
         int err;
+        int layer2_update;
 
         /* Prevent a race with changing the rate control algorithm */
         if (!netif_running(dev))
@@ -695,17 +717,25 @@ static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev,
 
         rate_control_rate_init(sta);
 
+        layer2_update = sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
+                sdata->vif.type == NL80211_IFTYPE_AP;
+
         rcu_read_lock();
 
         err = sta_info_insert(sta);
         if (err) {
                 /* STA has been freed */
+                if (err == -EEXIST && layer2_update) {
+                        /* Need to update layer 2 devices on reassociation */
+                        sta = sta_info_get(local, mac);
+                        if (sta)
+                                ieee80211_send_layer2_update(sta);
+                }
                 rcu_read_unlock();
                 return err;
         }
 
-        if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
-            sdata->vif.type == NL80211_IFTYPE_AP)
+        if (layer2_update)
                 ieee80211_send_layer2_update(sta);
 
         rcu_read_unlock();
@@ -957,6 +987,72 @@ static int ieee80211_dump_mpath(struct wiphy *wiphy, struct net_device *dev,
         rcu_read_unlock();
         return 0;
 }
+
+static int ieee80211_get_mesh_params(struct wiphy *wiphy,
+                                struct net_device *dev,
+                                struct mesh_config *conf)
+{
+        struct ieee80211_sub_if_data *sdata;
+        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+
+        if (sdata->vif.type != NL80211_IFTYPE_MESH_POINT)
+                return -ENOTSUPP;
+        memcpy(conf, &(sdata->u.mesh.mshcfg), sizeof(struct mesh_config));
+        return 0;
+}
+
+static inline bool _chg_mesh_attr(enum nl80211_meshconf_params parm, u32 mask)
+{
+        return (mask >> (parm-1)) & 0x1;
+}
+
+static int ieee80211_set_mesh_params(struct wiphy *wiphy,
+                                struct net_device *dev,
+                                const struct mesh_config *nconf, u32 mask)
+{
+        struct mesh_config *conf;
+        struct ieee80211_sub_if_data *sdata;
+        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+
+        if (sdata->vif.type != NL80211_IFTYPE_MESH_POINT)
+                return -ENOTSUPP;
+
+        /* Set the config options which we are interested in setting */
+        conf = &(sdata->u.mesh.mshcfg);
+        if (_chg_mesh_attr(NL80211_MESHCONF_RETRY_TIMEOUT, mask))
+                conf->dot11MeshRetryTimeout = nconf->dot11MeshRetryTimeout;
+        if (_chg_mesh_attr(NL80211_MESHCONF_CONFIRM_TIMEOUT, mask))
+                conf->dot11MeshConfirmTimeout = nconf->dot11MeshConfirmTimeout;
+        if (_chg_mesh_attr(NL80211_MESHCONF_HOLDING_TIMEOUT, mask))
+                conf->dot11MeshHoldingTimeout = nconf->dot11MeshHoldingTimeout;
+        if (_chg_mesh_attr(NL80211_MESHCONF_MAX_PEER_LINKS, mask))
+                conf->dot11MeshMaxPeerLinks = nconf->dot11MeshMaxPeerLinks;
+        if (_chg_mesh_attr(NL80211_MESHCONF_MAX_RETRIES, mask))
+                conf->dot11MeshMaxRetries = nconf->dot11MeshMaxRetries;
+        if (_chg_mesh_attr(NL80211_MESHCONF_TTL, mask))
+                conf->dot11MeshTTL = nconf->dot11MeshTTL;
+        if (_chg_mesh_attr(NL80211_MESHCONF_AUTO_OPEN_PLINKS, mask))
+                conf->auto_open_plinks = nconf->auto_open_plinks;
+        if (_chg_mesh_attr(NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES, mask))
+                conf->dot11MeshHWMPmaxPREQretries =
+                        nconf->dot11MeshHWMPmaxPREQretries;
+        if (_chg_mesh_attr(NL80211_MESHCONF_PATH_REFRESH_TIME, mask))
+                conf->path_refresh_time = nconf->path_refresh_time;
+        if (_chg_mesh_attr(NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT, mask))
+                conf->min_discovery_timeout = nconf->min_discovery_timeout;
+        if (_chg_mesh_attr(NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT, mask))
+                conf->dot11MeshHWMPactivePathTimeout =
+                        nconf->dot11MeshHWMPactivePathTimeout;
+        if (_chg_mesh_attr(NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL, mask))
+                conf->dot11MeshHWMPpreqMinInterval =
+                        nconf->dot11MeshHWMPpreqMinInterval;
+        if (_chg_mesh_attr(NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
+                           mask))
+                conf->dot11MeshHWMPnetDiameterTraversalTime =
+                        nconf->dot11MeshHWMPnetDiameterTraversalTime;
+        return 0;
+}
+
 #endif
 
 static int ieee80211_change_bss(struct wiphy *wiphy,
@@ -972,25 +1068,79 @@ static int ieee80211_change_bss(struct wiphy *wiphy,
                 return -EINVAL;
 
         if (params->use_cts_prot >= 0) {
-                sdata->bss_conf.use_cts_prot = params->use_cts_prot;
+                sdata->vif.bss_conf.use_cts_prot = params->use_cts_prot;
                 changed |= BSS_CHANGED_ERP_CTS_PROT;
         }
         if (params->use_short_preamble >= 0) {
-                sdata->bss_conf.use_short_preamble =
+                sdata->vif.bss_conf.use_short_preamble =
                         params->use_short_preamble;
                 changed |= BSS_CHANGED_ERP_PREAMBLE;
         }
         if (params->use_short_slot_time >= 0) {
-                sdata->bss_conf.use_short_slot =
+                sdata->vif.bss_conf.use_short_slot =
                         params->use_short_slot_time;
                 changed |= BSS_CHANGED_ERP_SLOT;
         }
 
+        if (params->basic_rates) {
+                int i, j;
+                u32 rates = 0;
+                struct ieee80211_local *local = wiphy_priv(wiphy);
+                struct ieee80211_supported_band *sband =
+                        wiphy->bands[local->oper_channel->band];
+
+                for (i = 0; i < params->basic_rates_len; i++) {
+                        int rate = (params->basic_rates[i] & 0x7f) * 5;
+                        for (j = 0; j < sband->n_bitrates; j++) {
+                                if (sband->bitrates[j].bitrate == rate)
+                                        rates |= BIT(j);
+                        }
+                }
+                sdata->vif.bss_conf.basic_rates = rates;
+                changed |= BSS_CHANGED_BASIC_RATES;
+        }
+
         ieee80211_bss_info_change_notify(sdata, changed);
 
         return 0;
 }
 
+static int ieee80211_set_txq_params(struct wiphy *wiphy,
+                                    struct ieee80211_txq_params *params)
+{
+        struct ieee80211_local *local = wiphy_priv(wiphy);
+        struct ieee80211_tx_queue_params p;
+
+        if (!local->ops->conf_tx)
+                return -EOPNOTSUPP;
+
+        memset(&p, 0, sizeof(p));
+        p.aifs = params->aifs;
+        p.cw_max = params->cwmax;
+        p.cw_min = params->cwmin;
+        p.txop = params->txop;
+        if (local->ops->conf_tx(local_to_hw(local), params->queue, &p)) {
+                printk(KERN_DEBUG "%s: failed to set TX queue "
+                       "parameters for queue %d\n", local->mdev->name,
+                       params->queue);
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
+static int ieee80211_set_channel(struct wiphy *wiphy,
+                                 struct ieee80211_channel *chan,
+                                 enum nl80211_channel_type channel_type)
+{
+        struct ieee80211_local *local = wiphy_priv(wiphy);
+
+        local->oper_channel = chan;
+        local->oper_channel_type = channel_type;
+
+        return ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);
+}
+
 struct cfg80211_ops mac80211_config_ops = {
         .add_virtual_intf = ieee80211_add_iface,
         .del_virtual_intf = ieee80211_del_iface,
@@ -1013,6 +1163,10 @@ struct cfg80211_ops mac80211_config_ops = {
         .change_mpath = ieee80211_change_mpath,
         .get_mpath = ieee80211_get_mpath,
         .dump_mpath = ieee80211_dump_mpath,
+        .set_mesh_params = ieee80211_set_mesh_params,
+        .get_mesh_params = ieee80211_get_mesh_params,
 #endif
         .change_bss = ieee80211_change_bss,
+        .set_txq_params = ieee80211_set_txq_params,
+        .set_channel = ieee80211_set_channel,
 };
diff --git a/net/mac80211/debugfs.c b/net/mac80211/debugfs.c
index 24ce54463310..2697a2fe608f 100644
--- a/net/mac80211/debugfs.c
+++ b/net/mac80211/debugfs.c
@@ -47,18 +47,14 @@ static const struct file_operations name## _ops = {			\
 
 DEBUGFS_READONLY_FILE(frequency, 20, "%d",
                       local->hw.conf.channel->center_freq);
-DEBUGFS_READONLY_FILE(antenna_sel_tx, 20, "%d",
-                      local->hw.conf.antenna_sel_tx);
-DEBUGFS_READONLY_FILE(antenna_sel_rx, 20, "%d",
-                      local->hw.conf.antenna_sel_rx);
 DEBUGFS_READONLY_FILE(rts_threshold, 20, "%d",
                       local->rts_threshold);
 DEBUGFS_READONLY_FILE(fragmentation_threshold, 20, "%d",
                       local->fragmentation_threshold);
 DEBUGFS_READONLY_FILE(short_retry_limit, 20, "%d",
-                      local->short_retry_limit);
+                      local->hw.conf.short_frame_max_tx_count);
 DEBUGFS_READONLY_FILE(long_retry_limit, 20, "%d",
-                      local->long_retry_limit);
+                      local->hw.conf.long_frame_max_tx_count);
 DEBUGFS_READONLY_FILE(total_ps_buffered, 20, "%d",
                       local->total_ps_buffered);
 DEBUGFS_READONLY_FILE(wep_iv, 20, "%#06x",
@@ -202,8 +198,6 @@ void debugfs_hw_add(struct ieee80211_local *local)
         local->debugfs.keys = debugfs_create_dir("keys", phyd);
 
         DEBUGFS_ADD(frequency);
-        DEBUGFS_ADD(antenna_sel_tx);
-        DEBUGFS_ADD(antenna_sel_rx);
         DEBUGFS_ADD(rts_threshold);
         DEBUGFS_ADD(fragmentation_threshold);
         DEBUGFS_ADD(short_retry_limit);
@@ -258,8 +252,6 @@ void debugfs_hw_add(struct ieee80211_local *local)
 void debugfs_hw_del(struct ieee80211_local *local)
 {
         DEBUGFS_DEL(frequency);
-        DEBUGFS_DEL(antenna_sel_tx);
-        DEBUGFS_DEL(antenna_sel_rx);
         DEBUGFS_DEL(rts_threshold);
         DEBUGFS_DEL(fragmentation_threshold);
         DEBUGFS_DEL(short_retry_limit);
diff --git a/net/mac80211/debugfs_key.c b/net/mac80211/debugfs_key.c
index a3294d109322..6424ac565ae0 100644
--- a/net/mac80211/debugfs_key.c
+++ b/net/mac80211/debugfs_key.c
@@ -188,7 +188,6 @@ void ieee80211_debugfs_key_add(struct ieee80211_key *key)
   {
         static int keycount;
         char buf[50];
-        DECLARE_MAC_BUF(mac);
         struct sta_info *sta;
 
         if (!key->local->debugfs.keys)
@@ -206,8 +205,7 @@ void ieee80211_debugfs_key_add(struct ieee80211_key *key)
         rcu_read_lock();
         sta = rcu_dereference(key->sta);
         if (sta)
-                sprintf(buf, "../../stations/%s",
-                        print_mac(mac, sta->sta.addr));
+                sprintf(buf, "../../stations/%pM", sta->sta.addr);
         rcu_read_unlock();
 
         /* using sta as a boolean is fine outside RCU lock */
diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c
index 2ad504fc3414..c54219301724 100644
--- a/net/mac80211/debugfs_netdev.c
+++ b/net/mac80211/debugfs_netdev.c
@@ -41,29 +41,6 @@ static ssize_t ieee80211_if_read(
         return ret;
 }
 
-#ifdef CONFIG_MAC80211_MESH
-static ssize_t ieee80211_if_write(
-        struct ieee80211_sub_if_data *sdata,
-        char const __user *userbuf,
-        size_t count, loff_t *ppos,
-        int (*format)(struct ieee80211_sub_if_data *, char *))
-{
-        char buf[10];
-        int buf_size;
-
-        memset(buf, 0x00, sizeof(buf));
-        buf_size = min(count, (sizeof(buf)-1));
-        if (copy_from_user(buf, userbuf, buf_size))
-                return count;
-        read_lock(&dev_base_lock);
-        if (sdata->dev->reg_state == NETREG_REGISTERED)
-                (*format)(sdata, buf);
-        read_unlock(&dev_base_lock);
-
-        return count;
-}
-#endif
-
 #define IEEE80211_IF_FMT(name, field, format_string)                    \
 static ssize_t ieee80211_if_fmt_##name(                                 \
         const struct ieee80211_sub_if_data *sdata, char *buf,           \
@@ -71,19 +48,6 @@ static ssize_t ieee80211_if_fmt_##name(					\
 {                                                                       \
         return scnprintf(buf, buflen, format_string, sdata->field);     \
 }
-#define IEEE80211_IF_WFMT(name, field, type)                            \
-static int ieee80211_if_wfmt_##name(                                    \
-        struct ieee80211_sub_if_data *sdata, char *buf)                 \
-{                                                                       \
-        unsigned long tmp;                                              \
-        char *endp;                                                     \
-                                                                        \
-        tmp = simple_strtoul(buf, &endp, 0);                            \
-        if ((endp == buf) || ((type)tmp != tmp))                        \
-                return -EINVAL;                                         \
-        sdata->field = tmp;                                             \
-        return 0;                                                       \
-}
 #define IEEE80211_IF_FMT_DEC(name, field)                               \
                 IEEE80211_IF_FMT(name, field, "%d\n")
 #define IEEE80211_IF_FMT_HEX(name, field)                               \
@@ -104,8 +68,7 @@ static ssize_t ieee80211_if_fmt_##name(					\
         const struct ieee80211_sub_if_data *sdata, char *buf,           \
         int buflen)                                                     \
 {                                                                       \
-        DECLARE_MAC_BUF(mac);                                           \
-        return scnprintf(buf, buflen, "%s\n", print_mac(mac, sdata->field));\
+        return scnprintf(buf, buflen, "%pM\n", sdata->field);           \
 }
 
 #define __IEEE80211_IF_FILE(name)                                       \
@@ -126,34 +89,6 @@ static const struct file_operations name##_ops = {			\
                 IEEE80211_IF_FMT_##format(name, field)                  \
                 __IEEE80211_IF_FILE(name)
 
-#define __IEEE80211_IF_WFILE(name)                                      \
-static ssize_t ieee80211_if_read_##name(struct file *file,              \
-                                        char __user *userbuf,           \
-                                        size_t count, loff_t *ppos)     \
-{                                                                       \
-        return ieee80211_if_read(file->private_data,                    \
-                                 userbuf, count, ppos,                  \
-                                 ieee80211_if_fmt_##name);              \
-}                                                                       \
-static ssize_t ieee80211_if_write_##name(struct file *file,             \
-                                        const char __user *userbuf,     \
-                                        size_t count, loff_t *ppos)     \
-{                                                                       \
-        return ieee80211_if_write(file->private_data,                   \
-                                 userbuf, count, ppos,                  \
-                                 ieee80211_if_wfmt_##name);             \
-}                                                                       \
-static const struct file_operations name##_ops = {                      \
-        .read = ieee80211_if_read_##name,                               \
-        .write = ieee80211_if_write_##name,                             \
-        .open = mac80211_open_file_generic,                             \
-}
-
-#define IEEE80211_IF_WFILE(name, field, format, type)                   \
-                IEEE80211_IF_FMT_##format(name, field)                  \
-                IEEE80211_IF_WFMT(name, field, type)                    \
-                __IEEE80211_IF_WFILE(name)
-
 /* common attributes */
 IEEE80211_IF_FILE(drop_unencrypted, drop_unencrypted, DEC);
 IEEE80211_IF_FILE(force_unicast_rateidx, force_unicast_rateidx, DEC);
@@ -184,7 +119,7 @@ static ssize_t ieee80211_if_fmt_flags(
                  sdata->u.sta.flags & IEEE80211_STA_AUTHENTICATED ? "AUTH\n" : "",
                  sdata->u.sta.flags & IEEE80211_STA_ASSOCIATED ? "ASSOC\n" : "",
                  sdata->u.sta.flags & IEEE80211_STA_PROBEREQ_POLL ? "PROBEREQ POLL\n" : "",
-                 sdata->bss_conf.use_cts_prot ? "CTS prot\n" : "");
+                 sdata->vif.bss_conf.use_cts_prot ? "CTS prot\n" : "");
 }
 __IEEE80211_IF_FILE(flags);
 
@@ -212,30 +147,30 @@ IEEE80211_IF_FILE(dropped_frames_no_route,
 IEEE80211_IF_FILE(estab_plinks, u.mesh.mshstats.estab_plinks, ATOMIC);
 
 /* Mesh parameters */
-IEEE80211_IF_WFILE(dot11MeshMaxRetries,
-                u.mesh.mshcfg.dot11MeshMaxRetries, DEC, u8);
-IEEE80211_IF_WFILE(dot11MeshRetryTimeout,
-                u.mesh.mshcfg.dot11MeshRetryTimeout, DEC, u16);
-IEEE80211_IF_WFILE(dot11MeshConfirmTimeout,
-                u.mesh.mshcfg.dot11MeshConfirmTimeout, DEC, u16);
-IEEE80211_IF_WFILE(dot11MeshHoldingTimeout,
-                u.mesh.mshcfg.dot11MeshHoldingTimeout, DEC, u16);
-IEEE80211_IF_WFILE(dot11MeshTTL, u.mesh.mshcfg.dot11MeshTTL, DEC, u8);
-IEEE80211_IF_WFILE(auto_open_plinks, u.mesh.mshcfg.auto_open_plinks, DEC, u8);
-IEEE80211_IF_WFILE(dot11MeshMaxPeerLinks,
-                u.mesh.mshcfg.dot11MeshMaxPeerLinks, DEC, u16);
-IEEE80211_IF_WFILE(dot11MeshHWMPactivePathTimeout,
-                u.mesh.mshcfg.dot11MeshHWMPactivePathTimeout, DEC, u32);
-IEEE80211_IF_WFILE(dot11MeshHWMPpreqMinInterval,
-                u.mesh.mshcfg.dot11MeshHWMPpreqMinInterval, DEC, u16);
-IEEE80211_IF_WFILE(dot11MeshHWMPnetDiameterTraversalTime,
-                u.mesh.mshcfg.dot11MeshHWMPnetDiameterTraversalTime, DEC, u16);
-IEEE80211_IF_WFILE(dot11MeshHWMPmaxPREQretries,
-                u.mesh.mshcfg.dot11MeshHWMPmaxPREQretries, DEC, u8);
-IEEE80211_IF_WFILE(path_refresh_time,
-                u.mesh.mshcfg.path_refresh_time, DEC, u32);
-IEEE80211_IF_WFILE(min_discovery_timeout,
-                u.mesh.mshcfg.min_discovery_timeout, DEC, u16);
+IEEE80211_IF_FILE(dot11MeshMaxRetries,
+                u.mesh.mshcfg.dot11MeshMaxRetries, DEC);
+IEEE80211_IF_FILE(dot11MeshRetryTimeout,
+                u.mesh.mshcfg.dot11MeshRetryTimeout, DEC);
+IEEE80211_IF_FILE(dot11MeshConfirmTimeout,
+                u.mesh.mshcfg.dot11MeshConfirmTimeout, DEC);
+IEEE80211_IF_FILE(dot11MeshHoldingTimeout,
+                u.mesh.mshcfg.dot11MeshHoldingTimeout, DEC);
+IEEE80211_IF_FILE(dot11MeshTTL, u.mesh.mshcfg.dot11MeshTTL, DEC);
+IEEE80211_IF_FILE(auto_open_plinks, u.mesh.mshcfg.auto_open_plinks, DEC);
+IEEE80211_IF_FILE(dot11MeshMaxPeerLinks,
+                u.mesh.mshcfg.dot11MeshMaxPeerLinks, DEC);
+IEEE80211_IF_FILE(dot11MeshHWMPactivePathTimeout,
+                u.mesh.mshcfg.dot11MeshHWMPactivePathTimeout, DEC);
+IEEE80211_IF_FILE(dot11MeshHWMPpreqMinInterval,
+                u.mesh.mshcfg.dot11MeshHWMPpreqMinInterval, DEC);
+IEEE80211_IF_FILE(dot11MeshHWMPnetDiameterTraversalTime,
+                u.mesh.mshcfg.dot11MeshHWMPnetDiameterTraversalTime, DEC);
+IEEE80211_IF_FILE(dot11MeshHWMPmaxPREQretries,
+                u.mesh.mshcfg.dot11MeshHWMPmaxPREQretries, DEC);
+IEEE80211_IF_FILE(path_refresh_time,
+                u.mesh.mshcfg.path_refresh_time, DEC);
+IEEE80211_IF_FILE(min_discovery_timeout,
+                u.mesh.mshcfg.min_discovery_timeout, DEC);
 #endif
 
 
diff --git a/net/mac80211/debugfs_sta.c b/net/mac80211/debugfs_sta.c
index b85c4f27b361..a2fbe0131312 100644
--- a/net/mac80211/debugfs_sta.c
+++ b/net/mac80211/debugfs_sta.c
@@ -39,13 +39,6 @@ static const struct file_operations sta_ ##name## _ops = {		\
         .open = mac80211_open_file_generic,                             \
 }
 
-#define STA_OPS_WR(name)                                                \
-static const struct file_operations sta_ ##name## _ops = {              \
-        .read = sta_##name##_read,                                      \
-        .write = sta_##name##_write,                                    \
-        .open = mac80211_open_file_generic,                             \
-}
-
 #define STA_FILE(name, field, format)                                   \
                 STA_READ_##format(name, field)                          \
                 STA_OPS(name)
@@ -144,7 +137,7 @@ static ssize_t sta_agg_status_read(struct file *file, char __user *userbuf,
         p += scnprintf(p, sizeof(buf)+buf-p, "\n DTKN:");
         for (i = 0; i < STA_TID_NUM; i++)
                 p += scnprintf(p, sizeof(buf)+buf-p, "%5d",
-                        sta->ampdu_mlme.tid_state_rx[i]?
+                        sta->ampdu_mlme.tid_state_rx[i] ?
                         sta->ampdu_mlme.tid_rx[i]->dialog_token : 0);
 
         p += scnprintf(p, sizeof(buf)+buf-p, "\n TX  :");
@@ -155,84 +148,20 @@ static ssize_t sta_agg_status_read(struct file *file, char __user *userbuf,
         p += scnprintf(p, sizeof(buf)+buf-p, "\n DTKN:");
         for (i = 0; i < STA_TID_NUM; i++)
                 p += scnprintf(p, sizeof(buf)+buf-p, "%5d",
-                        sta->ampdu_mlme.tid_state_tx[i]?
+                        sta->ampdu_mlme.tid_state_tx[i] ?
                         sta->ampdu_mlme.tid_tx[i]->dialog_token : 0);
 
         p += scnprintf(p, sizeof(buf)+buf-p, "\n SSN :");
         for (i = 0; i < STA_TID_NUM; i++)
                 p += scnprintf(p, sizeof(buf)+buf-p, "%5d",
-                        sta->ampdu_mlme.tid_state_tx[i]?
+                        sta->ampdu_mlme.tid_state_tx[i] ?
                         sta->ampdu_mlme.tid_tx[i]->ssn : 0);
 
         p += scnprintf(p, sizeof(buf)+buf-p, "\n");
 
         return simple_read_from_buffer(userbuf, count, ppos, buf, p - buf);
 }
-
-static ssize_t sta_agg_status_write(struct file *file,
-                const char __user *user_buf, size_t count, loff_t *ppos)
-{
-        struct sta_info *sta = file->private_data;
-        struct ieee80211_local *local = sta->sdata->local;
-        struct ieee80211_hw *hw = &local->hw;
-        u8 *da = sta->sta.addr;
-        static int tid_static_tx[16] = {0, 0, 0, 0, 0, 0, 0, 0,
-                                        0, 0, 0, 0, 0, 0, 0, 0};
-        static int tid_static_rx[16] = {1, 1, 1, 1, 1, 1, 1, 1,
-                                        1, 1, 1, 1, 1, 1, 1, 1};
-        char *endp;
-        char buf[32];
-        int buf_size, rs;
-        unsigned int tid_num;
-        char state[4];
-
-        memset(buf, 0x00, sizeof(buf));
-        buf_size = min(count, (sizeof(buf)-1));
-        if (copy_from_user(buf, user_buf, buf_size))
-                return -EFAULT;
-
-        tid_num = simple_strtoul(buf, &endp, 0);
-        if (endp == buf)
-                return -EINVAL;
-
-        if ((tid_num >= 100) && (tid_num <= 115)) {
-                /* toggle Rx aggregation command */
-                tid_num = tid_num - 100;
-                if (tid_static_rx[tid_num] == 1) {
-                        strcpy(state, "off");
-                        ieee80211_sta_stop_rx_ba_session(sta->sdata, da, tid_num, 0,
-                                        WLAN_REASON_QSTA_REQUIRE_SETUP);
-                        sta->ampdu_mlme.tid_state_rx[tid_num] |=
-                                        HT_AGG_STATE_DEBUGFS_CTL;
-                        tid_static_rx[tid_num] = 0;
-                } else {
-                        strcpy(state, "on ");
-                        sta->ampdu_mlme.tid_state_rx[tid_num] &=
-                                        ~HT_AGG_STATE_DEBUGFS_CTL;
-                        tid_static_rx[tid_num] = 1;
-                }
-                printk(KERN_DEBUG "debugfs - try switching tid %u %s\n",
-                                tid_num, state);
-        } else if ((tid_num >= 0) && (tid_num <= 15)) {
-                /* toggle Tx aggregation command */
-                if (tid_static_tx[tid_num] == 0) {
-                        strcpy(state, "on ");
-                        rs =  ieee80211_start_tx_ba_session(hw, da, tid_num);
-                        if (rs == 0)
-                                tid_static_tx[tid_num] = 1;
-                } else {
-                        strcpy(state, "off");
-                        rs =  ieee80211_stop_tx_ba_session(hw, da, tid_num, 1);
-                        if (rs == 0)
-                                tid_static_tx[tid_num] = 0;
-                }
-                printk(KERN_DEBUG "debugfs - switching tid %u %s, return=%d\n",
-                                tid_num, state, rs);
-        }
-
-        return count;
-}
-STA_OPS_WR(agg_status);
+STA_OPS(agg_status);
 
 #define DEBUGFS_ADD(name) \
         sta->debugfs.name = debugfs_create_file(#name, 0400, \
@@ -246,15 +175,14 @@ STA_OPS_WR(agg_status);
 void ieee80211_sta_debugfs_add(struct sta_info *sta)
 {
         struct dentry *stations_dir = sta->local->debugfs.stations;
-        DECLARE_MAC_BUF(mbuf);
-        u8 *mac;
+        u8 mac[3*ETH_ALEN];
 
         sta->debugfs.add_has_run = true;
 
         if (!stations_dir)
                 return;
 
-        mac = print_mac(mbuf, sta->sta.addr);
+        snprintf(mac, sizeof(mac), "%pM", sta->sta.addr);
 
         /*
          * This might fail due to a race condition:
diff --git a/net/mac80211/event.c b/net/mac80211/event.c
index 8de60de70bc9..0d95561c0ee0 100644
--- a/net/mac80211/event.c
+++ b/net/mac80211/event.c
@@ -21,14 +21,13 @@ void mac80211_ev_michael_mic_failure(struct ieee80211_sub_if_data *sdata, int ke
 {
         union iwreq_data wrqu;
         char *buf = kmalloc(128, GFP_ATOMIC);
-        DECLARE_MAC_BUF(mac);
 
         if (buf) {
                 /* TODO: needed parameters: count, key type, TSC */
                 sprintf(buf, "MLME-MICHAELMICFAILURE.indication("
-                        "keyid=%d %scast addr=%s)",
+                        "keyid=%d %scast addr=%pM)",
                         keyidx, hdr->addr1[0] & 0x01 ? "broad" : "uni",
-                        print_mac(mac, hdr->addr2));
+                        hdr->addr2);
                 memset(&wrqu, 0, sizeof(wrqu));
                 wrqu.data.length = strlen(buf);
                 wireless_send_event(sdata->dev, IWEVCUSTOM, &wrqu, buf);
diff --git a/net/mac80211/ht.c b/net/mac80211/ht.c
index dc7d9a3d70d5..5f510a13b9f0 100644
--- a/net/mac80211/ht.c
+++ b/net/mac80211/ht.c
@@ -20,50 +20,138 @@
 #include "sta_info.h"
 #include "wme.h"
 
-int ieee80211_ht_cap_ie_to_ht_info(struct ieee80211_ht_cap *ht_cap_ie,
-                                   struct ieee80211_ht_info *ht_info)
+void ieee80211_ht_cap_ie_to_sta_ht_cap(struct ieee80211_supported_band *sband,
+                                       struct ieee80211_ht_cap *ht_cap_ie,
+                                       struct ieee80211_sta_ht_cap *ht_cap)
 {
+        u8 ampdu_info, tx_mcs_set_cap;
+        int i, max_tx_streams;
 
-        if (ht_info == NULL)
-                return -EINVAL;
+        BUG_ON(!ht_cap);
+
+        memset(ht_cap, 0, sizeof(*ht_cap));
+
+        if (!ht_cap_ie)
+                return;
+
+        ht_cap->ht_supported = true;
 
-        memset(ht_info, 0, sizeof(*ht_info));
+        ht_cap->cap = le16_to_cpu(ht_cap_ie->cap_info) & sband->ht_cap.cap;
+        ht_cap->cap &= ~IEEE80211_HT_CAP_SM_PS;
+        ht_cap->cap |= sband->ht_cap.cap & IEEE80211_HT_CAP_SM_PS;
 
-        if (ht_cap_ie) {
-                u8 ampdu_info = ht_cap_ie->ampdu_params_info;
+        ampdu_info = ht_cap_ie->ampdu_params_info;
+        ht_cap->ampdu_factor =
+                ampdu_info & IEEE80211_HT_AMPDU_PARM_FACTOR;
+        ht_cap->ampdu_density =
+                (ampdu_info & IEEE80211_HT_AMPDU_PARM_DENSITY) >> 2;
 
-                ht_info->ht_supported = 1;
-                ht_info->cap = le16_to_cpu(ht_cap_ie->cap_info);
-                ht_info->ampdu_factor =
-                        ampdu_info & IEEE80211_HT_CAP_AMPDU_FACTOR;
-                ht_info->ampdu_density =
-                        (ampdu_info & IEEE80211_HT_CAP_AMPDU_DENSITY) >> 2;
-                memcpy(ht_info->supp_mcs_set, ht_cap_ie->supp_mcs_set, 16);
-        } else
-                ht_info->ht_supported = 0;
+        /* own MCS TX capabilities */
+        tx_mcs_set_cap = sband->ht_cap.mcs.tx_params;
 
-        return 0;
+        /* can we TX with MCS rates? */
+        if (!(tx_mcs_set_cap & IEEE80211_HT_MCS_TX_DEFINED))
+                return;
+
+        /* Counting from 0, therefore +1 */
+        if (tx_mcs_set_cap & IEEE80211_HT_MCS_TX_RX_DIFF)
+                max_tx_streams =
+                        ((tx_mcs_set_cap & IEEE80211_HT_MCS_TX_MAX_STREAMS_MASK)
+                                >> IEEE80211_HT_MCS_TX_MAX_STREAMS_SHIFT) + 1;
+        else
+                max_tx_streams = IEEE80211_HT_MCS_TX_MAX_STREAMS;
+
+        /*
+         * 802.11n D5.0 20.3.5 / 20.6 says:
+         * - indices 0 to 7 and 32 are single spatial stream
+         * - 8 to 31 are multiple spatial streams using equal modulation
+         *   [8..15 for two streams, 16..23 for three and 24..31 for four]
+         * - remainder are multiple spatial streams using unequal modulation
+         */
+        for (i = 0; i < max_tx_streams; i++)
+                ht_cap->mcs.rx_mask[i] =
+                        sband->ht_cap.mcs.rx_mask[i] & ht_cap_ie->mcs.rx_mask[i];
+
+        if (tx_mcs_set_cap & IEEE80211_HT_MCS_TX_UNEQUAL_MODULATION)
+                for (i = IEEE80211_HT_MCS_UNEQUAL_MODULATION_START_BYTE;
+                     i < IEEE80211_HT_MCS_MASK_LEN; i++)
+                        ht_cap->mcs.rx_mask[i] =
+                                sband->ht_cap.mcs.rx_mask[i] &
+                                        ht_cap_ie->mcs.rx_mask[i];
+
+        /* handle MCS rate 32 too */
+        if (sband->ht_cap.mcs.rx_mask[32/8] & ht_cap_ie->mcs.rx_mask[32/8] & 1)
+                ht_cap->mcs.rx_mask[32/8] |= 1;
 }
 
-int ieee80211_ht_addt_info_ie_to_ht_bss_info(
-                        struct ieee80211_ht_addt_info *ht_add_info_ie,
-                        struct ieee80211_ht_bss_info *bss_info)
+/*
+ * ieee80211_enable_ht should be called only after the operating band
+ * has been determined as ht configuration depends on the hw's
+ * HT abilities for a specific band.
+ */
+u32 ieee80211_enable_ht(struct ieee80211_sub_if_data *sdata,
+                        struct ieee80211_ht_info *hti,
+                        u16 ap_ht_cap_flags)
 {
-        if (bss_info == NULL)
-                return -EINVAL;
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_supported_band *sband;
+        struct ieee80211_bss_ht_conf ht;
+        u32 changed = 0;
+        bool enable_ht = true, ht_changed;
+        enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
+
+        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
+
+        memset(&ht, 0, sizeof(ht));
+
+        /* HT is not supported */
+        if (!sband->ht_cap.ht_supported)
+                enable_ht = false;
+
+        /* check that channel matches the right operating channel */
+        if (local->hw.conf.channel->center_freq !=
+            ieee80211_channel_to_frequency(hti->control_chan))
+                enable_ht = false;
+
+        if (enable_ht) {
+                channel_type = NL80211_CHAN_HT20;
+
+                if (!(ap_ht_cap_flags & IEEE80211_HT_CAP_40MHZ_INTOLERANT) &&
+                    (sband->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) &&
+                    (hti->ht_param & IEEE80211_HT_PARAM_CHAN_WIDTH_ANY)) {
+                        switch(hti->ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
+                        case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
+                                channel_type = NL80211_CHAN_HT40PLUS;
+                                break;
+                        case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
+                                channel_type = NL80211_CHAN_HT40MINUS;
+                                break;
+                        }
+                }
+        }
+
+        ht_changed = local->hw.conf.ht.enabled != enable_ht ||
+                     channel_type != local->hw.conf.ht.channel_type;
+
+        local->oper_channel_type = channel_type;
+        local->hw.conf.ht.enabled = enable_ht;
 
-        memset(bss_info, 0, sizeof(*bss_info));
+        if (ht_changed)
+                ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_HT);
 
-        if (ht_add_info_ie) {
-                u16 op_mode;
-                op_mode = le16_to_cpu(ht_add_info_ie->operation_mode);
+        /* disable HT */
+        if (!enable_ht)
+                return 0;
 
-                bss_info->primary_channel = ht_add_info_ie->control_chan;
-                bss_info->bss_cap = ht_add_info_ie->ht_param;
-                bss_info->bss_op_mode = (u8)(op_mode & 0xff);
+        ht.operation_mode = le16_to_cpu(hti->operation_mode);
+
+        /* if bss configuration changed store the new one */
+        if (memcmp(&sdata->vif.bss_conf.ht, &ht, sizeof(ht))) {
+                changed |= BSS_CHANGED_HT;
+                sdata->vif.bss_conf.ht = ht;
         }
 
-        return 0;
+        return changed;
 }
 
 static void ieee80211_send_addba_request(struct ieee80211_sub_if_data *sdata,
@@ -241,7 +329,6 @@ void ieee80211_sta_stop_rx_ba_session(struct ieee80211_sub_if_data *sdata, u8 *r
         struct ieee80211_hw *hw = &local->hw;
         struct sta_info *sta;
         int ret, i;
-        DECLARE_MAC_BUF(mac);
 
         rcu_read_lock();
 
@@ -269,8 +356,8 @@ void ieee80211_sta_stop_rx_ba_session(struct ieee80211_sub_if_data *sdata, u8 *r
         BUG_ON(!local->ops->ampdu_action);
 
 #ifdef CONFIG_MAC80211_HT_DEBUG
-        printk(KERN_DEBUG "Rx BA session stop requested for %s tid %u\n",
-                                print_mac(mac, ra), tid);
+        printk(KERN_DEBUG "Rx BA session stop requested for %pM tid %u\n",
+               ra, tid);
 #endif /* CONFIG_MAC80211_HT_DEBUG */
 
         ret = local->ops->ampdu_action(hw, IEEE80211_AMPDU_RX_STOP,
@@ -383,14 +470,13 @@ int ieee80211_start_tx_ba_session(struct ieee80211_hw *hw, u8 *ra, u16 tid)
         u16 start_seq_num;
         u8 *state;
         int ret;
-        DECLARE_MAC_BUF(mac);
 
-        if (tid >= STA_TID_NUM)
+        if ((tid >= STA_TID_NUM) || !(hw->flags & IEEE80211_HW_AMPDU_AGGREGATION))
                 return -EINVAL;
 
 #ifdef CONFIG_MAC80211_HT_DEBUG
-        printk(KERN_DEBUG "Open BA session requested for %s tid %u\n",
-                                print_mac(mac, ra), tid);
+        printk(KERN_DEBUG "Open BA session requested for %pM tid %u\n",
+               ra, tid);
 #endif /* CONFIG_MAC80211_HT_DEBUG */
 
         rcu_read_lock();
@@ -442,17 +528,19 @@ int ieee80211_start_tx_ba_session(struct ieee80211_hw *hw, u8 *ra, u16 tid)
                         (unsigned long)&sta->timer_to_tid[tid];
         init_timer(&sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer);
 
-        /* create a new queue for this aggregation */
-        ret = ieee80211_ht_agg_queue_add(local, sta, tid);
+        if (hw->ampdu_queues) {
+                /* create a new queue for this aggregation */
+                ret = ieee80211_ht_agg_queue_add(local, sta, tid);
 
-        /* case no queue is available to aggregation
-         * don't switch to aggregation */
-        if (ret) {
+                /* case no queue is available to aggregation
+                 * don't switch to aggregation */
+                if (ret) {
 #ifdef CONFIG_MAC80211_HT_DEBUG
-                printk(KERN_DEBUG "BA request denied - queue unavailable for"
-                                        " tid %d\n", tid);
+                        printk(KERN_DEBUG "BA request denied - "
+                               "queue unavailable for tid %d\n", tid);
 #endif /* CONFIG_MAC80211_HT_DEBUG */
-                goto err_unlock_queue;
+                        goto err_unlock_queue;
+                }
         }
         sdata = sta->sdata;
 
@@ -471,7 +559,8 @@ int ieee80211_start_tx_ba_session(struct ieee80211_hw *hw, u8 *ra, u16 tid)
                 /* No need to requeue the packets in the agg queue, since we
                  * held the tx lock: no packet could be enqueued to the newly
                  * allocated queue */
-                ieee80211_ht_agg_queue_remove(local, sta, tid, 0);
+                if (hw->ampdu_queues)
+                        ieee80211_ht_agg_queue_remove(local, sta, tid, 0);
 #ifdef CONFIG_MAC80211_HT_DEBUG
                 printk(KERN_DEBUG "BA request denied - HW unavailable for"
                                         " tid %d\n", tid);
@@ -481,7 +570,8 @@ int ieee80211_start_tx_ba_session(struct ieee80211_hw *hw, u8 *ra, u16 tid)
         }
 
         /* Will put all the packets in the new SW queue */
-        ieee80211_requeue(local, ieee802_1d_to_ac[tid]);
+        if (hw->ampdu_queues)
+                ieee80211_requeue(local, ieee802_1d_to_ac[tid]);
         spin_unlock_bh(&sta->lock);
 
         /* send an addBA request */
@@ -524,7 +614,6 @@ int ieee80211_stop_tx_ba_session(struct ieee80211_hw *hw,
         struct sta_info *sta;
         u8 *state;
         int ret = 0;
-        DECLARE_MAC_BUF(mac);
 
         if (tid >= STA_TID_NUM)
                 return -EINVAL;
@@ -546,11 +635,12 @@ int ieee80211_stop_tx_ba_session(struct ieee80211_hw *hw,
         }
 
 #ifdef CONFIG_MAC80211_HT_DEBUG
-        printk(KERN_DEBUG "Tx BA session stop requested for %s tid %u\n",
-                                print_mac(mac, ra), tid);
+        printk(KERN_DEBUG "Tx BA session stop requested for %pM tid %u\n",
+               ra, tid);
 #endif /* CONFIG_MAC80211_HT_DEBUG */
 
-        ieee80211_stop_queue(hw, sta->tid_to_tx_q[tid]);
+        if (hw->ampdu_queues)
+                ieee80211_stop_queue(hw, sta->tid_to_tx_q[tid]);
 
         *state = HT_AGG_STATE_REQ_STOP_BA_MSK |
                 (initiator << HT_AGG_STATE_INITIATOR_SHIFT);
@@ -563,7 +653,8 @@ int ieee80211_stop_tx_ba_session(struct ieee80211_hw *hw,
         if (ret) {
                 WARN_ON(ret != -EBUSY);
                 *state = HT_AGG_STATE_OPERATIONAL;
-                ieee80211_wake_queue(hw, sta->tid_to_tx_q[tid]);
+                if (hw->ampdu_queues)
+                        ieee80211_wake_queue(hw, sta->tid_to_tx_q[tid]);
                 goto stop_BA_exit;
         }
 
@@ -579,7 +670,6 @@ void ieee80211_start_tx_ba_cb(struct ieee80211_hw *hw, u8 *ra, u16 tid)
         struct ieee80211_local *local = hw_to_local(hw);
         struct sta_info *sta;
         u8 *state;
-        DECLARE_MAC_BUF(mac);
 
         if (tid >= STA_TID_NUM) {
 #ifdef CONFIG_MAC80211_HT_DEBUG
@@ -594,8 +684,7 @@ void ieee80211_start_tx_ba_cb(struct ieee80211_hw *hw, u8 *ra, u16 tid)
         if (!sta) {
                 rcu_read_unlock();
 #ifdef CONFIG_MAC80211_HT_DEBUG
-                printk(KERN_DEBUG "Could not find station: %s\n",
-                                print_mac(mac, ra));
+                printk(KERN_DEBUG "Could not find station: %pM\n", ra);
 #endif
                 return;
         }
@@ -621,7 +710,8 @@ void ieee80211_start_tx_ba_cb(struct ieee80211_hw *hw, u8 *ra, u16 tid)
 #ifdef CONFIG_MAC80211_HT_DEBUG
                 printk(KERN_DEBUG "Aggregation is on for tid %d \n", tid);
 #endif
-                ieee80211_wake_queue(hw, sta->tid_to_tx_q[tid]);
+                if (hw->ampdu_queues)
+                        ieee80211_wake_queue(hw, sta->tid_to_tx_q[tid]);
         }
         spin_unlock_bh(&sta->lock);
         rcu_read_unlock();
@@ -634,7 +724,6 @@ void ieee80211_stop_tx_ba_cb(struct ieee80211_hw *hw, u8 *ra, u8 tid)
         struct sta_info *sta;
         u8 *state;
         int agg_queue;
-        DECLARE_MAC_BUF(mac);
 
         if (tid >= STA_TID_NUM) {
 #ifdef CONFIG_MAC80211_HT_DEBUG
@@ -645,16 +734,15 @@ void ieee80211_stop_tx_ba_cb(struct ieee80211_hw *hw, u8 *ra, u8 tid)
         }
 
 #ifdef CONFIG_MAC80211_HT_DEBUG
-        printk(KERN_DEBUG "Stopping Tx BA session for %s tid %d\n",
-                                print_mac(mac, ra), tid);
+        printk(KERN_DEBUG "Stopping Tx BA session for %pM tid %d\n",
+               ra, tid);
 #endif /* CONFIG_MAC80211_HT_DEBUG */
 
         rcu_read_lock();
         sta = sta_info_get(local, ra);
         if (!sta) {
 #ifdef CONFIG_MAC80211_HT_DEBUG
-                printk(KERN_DEBUG "Could not find station: %s\n",
-                                print_mac(mac, ra));
+                printk(KERN_DEBUG "Could not find station: %pM\n", ra);
 #endif
                 rcu_read_unlock();
                 return;
@@ -677,16 +765,18 @@ void ieee80211_stop_tx_ba_cb(struct ieee80211_hw *hw, u8 *ra, u8 tid)
                 ieee80211_send_delba(sta->sdata, ra, tid,
                         WLAN_BACK_INITIATOR, WLAN_REASON_QSTA_NOT_USE);
 
-        agg_queue = sta->tid_to_tx_q[tid];
-
-        ieee80211_ht_agg_queue_remove(local, sta, tid, 1);
-
-        /* We just requeued the all the frames that were in the
-         * removed queue, and since we might miss a softirq we do
-         * netif_schedule_queue.  ieee80211_wake_queue is not used
-         * here as this queue is not necessarily stopped
-         */
-        netif_schedule_queue(netdev_get_tx_queue(local->mdev, agg_queue));
+        if (hw->ampdu_queues) {
+                agg_queue = sta->tid_to_tx_q[tid];
+                ieee80211_ht_agg_queue_remove(local, sta, tid, 1);
+
+                /* We just requeued the all the frames that were in the
+                 * removed queue, and since we might miss a softirq we do
+                 * netif_schedule_queue.  ieee80211_wake_queue is not used
+                 * here as this queue is not necessarily stopped
+                 */
+                netif_schedule_queue(netdev_get_tx_queue(local->mdev,
+                                                         agg_queue));
+        }
         spin_lock_bh(&sta->lock);
         *state = HT_AGG_STATE_IDLE;
         sta->ampdu_mlme.addba_req_num[tid] = 0;
@@ -783,7 +873,6 @@ void ieee80211_process_addba_request(struct ieee80211_local *local,
         u16 capab, tid, timeout, ba_policy, buf_size, start_seq_num, status;
         u8 dialog_token;
         int ret = -EOPNOTSUPP;
-        DECLARE_MAC_BUF(mac);
 
         /* extract session parameters from addba request frame */
         dialog_token = mgmt->u.action.u.addba_req.dialog_token;
@@ -801,15 +890,16 @@ void ieee80211_process_addba_request(struct ieee80211_local *local,
         /* sanity check for incoming parameters:
          * check if configuration can support the BA policy
          * and if buffer size does not exceeds max value */
+        /* XXX: check own ht delayed BA capability?? */
         if (((ba_policy != 1)
-                && (!(conf->ht_conf.cap & IEEE80211_HT_CAP_DELAY_BA)))
+                && (!(sta->sta.ht_cap.cap & IEEE80211_HT_CAP_DELAY_BA)))
                 || (buf_size > IEEE80211_MAX_AMPDU_BUF)) {
                 status = WLAN_STATUS_INVALID_QOS_PARAM;
 #ifdef CONFIG_MAC80211_HT_DEBUG
                 if (net_ratelimit())
                         printk(KERN_DEBUG "AddBA Req with bad params from "
-                                "%s on tid %u. policy %d, buffer size %d\n",
-                                print_mac(mac, mgmt->sa), tid, ba_policy,
+                                "%pM on tid %u. policy %d, buffer size %d\n",
+                                mgmt->sa, tid, ba_policy,
                                 buf_size);
 #endif /* CONFIG_MAC80211_HT_DEBUG */
                 goto end_no_lock;
@@ -820,7 +910,7 @@ void ieee80211_process_addba_request(struct ieee80211_local *local,
 
                 sband = local->hw.wiphy->bands[conf->channel->band];
                 buf_size = IEEE80211_MIN_AMPDU_BUF;
-                buf_size = buf_size << sband->ht_info.ampdu_factor;
+                buf_size = buf_size << sband->ht_cap.ampdu_factor;
         }
 
 
@@ -831,8 +921,8 @@ void ieee80211_process_addba_request(struct ieee80211_local *local,
 #ifdef CONFIG_MAC80211_HT_DEBUG
                 if (net_ratelimit())
                         printk(KERN_DEBUG "unexpected AddBA Req from "
-                                "%s on tid %u\n",
-                                print_mac(mac, mgmt->sa), tid);
+                                "%pM on tid %u\n",
+                                mgmt->sa, tid);
 #endif /* CONFIG_MAC80211_HT_DEBUG */
                 goto end;
         }
@@ -910,7 +1000,7 @@ void ieee80211_process_addba_resp(struct ieee80211_local *local,
 {
         struct ieee80211_hw *hw = &local->hw;
         u16 capab;
-        u16 tid;
+        u16 tid, start_seq_num;
         u8 *state;
 
         capab = le16_to_cpu(mgmt->u.action.u.addba_resp.capab);
@@ -943,9 +1033,18 @@ void ieee80211_process_addba_resp(struct ieee80211_local *local,
                 *state |= HT_ADDBA_RECEIVED_MSK;
                 sta->ampdu_mlme.addba_req_num[tid] = 0;
 
-                if (*state == HT_AGG_STATE_OPERATIONAL)
+                if (*state == HT_AGG_STATE_OPERATIONAL &&
+                    local->hw.ampdu_queues)
                         ieee80211_wake_queue(hw, sta->tid_to_tx_q[tid]);
 
+                if (local->ops->ampdu_action) {
+                        (void)local->ops->ampdu_action(hw,
+                                               IEEE80211_AMPDU_TX_RESUME,
+                                               &sta->sta, tid, &start_seq_num);
+                }
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                printk(KERN_DEBUG "Resuming TX aggregation for tid %d\n", tid);
+#endif /* CONFIG_MAC80211_HT_DEBUG */
                 spin_unlock_bh(&sta->lock);
         } else {
                 sta->ampdu_mlme.addba_req_num[tid]++;
@@ -964,7 +1063,6 @@ void ieee80211_process_delba(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_local *local = sdata->local;
         u16 tid, params;
         u16 initiator;
-        DECLARE_MAC_BUF(mac);
 
         params = le16_to_cpu(mgmt->u.action.u.delba.params);
         tid = (params & IEEE80211_DELBA_PARAM_TID_MASK) >> 12;
@@ -972,9 +1070,8 @@ void ieee80211_process_delba(struct ieee80211_sub_if_data *sdata,
 
 #ifdef CONFIG_MAC80211_HT_DEBUG
         if (net_ratelimit())
-                printk(KERN_DEBUG "delba from %s (%s) tid %d reason code %d\n",
-                        print_mac(mac, mgmt->sa),
-                        initiator ? "initiator" : "recipient", tid,
+                printk(KERN_DEBUG "delba from %pM (%s) tid %d reason code %d\n",
+                        mgmt->sa, initiator ? "initiator" : "recipient", tid,
                         mgmt->u.action.u.delba.reason_code);
 #endif /* CONFIG_MAC80211_HT_DEBUG */
 
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 156e42a003ae..f3eec989662b 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -23,6 +23,7 @@
 #include <linux/types.h>
 #include <linux/spinlock.h>
 #include <linux/etherdevice.h>
+#include <net/cfg80211.h>
 #include <net/wireless.h>
 #include <net/iw_handler.h>
 #include <net/mac80211.h>
@@ -142,7 +143,6 @@ typedef unsigned __bitwise__ ieee80211_tx_result;
 #define IEEE80211_TX_FRAGMENTED         BIT(0)
 #define IEEE80211_TX_UNICAST            BIT(1)
 #define IEEE80211_TX_PS_BUFFERED        BIT(2)
-#define IEEE80211_TX_PROBE_LAST_FRAG    BIT(3)
 
 struct ieee80211_tx_data {
         struct sk_buff *skb;
@@ -153,11 +153,6 @@ struct ieee80211_tx_data {
         struct ieee80211_key *key;
 
         struct ieee80211_channel *channel;
-        s8 rate_idx;
-        /* use this rate (if set) for last fragment; rate can
-         * be set to lower rate for the first fragments, e.g.,
-         * when using CTS protection with IEEE 802.11g. */
-        s8 last_frag_rate_idx;
 
         /* Extra fragments (in addition to the first fragment
          * in skb) */
@@ -192,7 +187,6 @@ struct ieee80211_rx_data {
         struct ieee80211_rx_status *status;
         struct ieee80211_rate *rate;
 
-        u16 ethertype;
         unsigned int flags;
         int sent_ps_buffered;
         int queue;
@@ -203,9 +197,7 @@ struct ieee80211_rx_data {
 struct ieee80211_tx_stored_packet {
         struct sk_buff *skb;
         struct sk_buff **extra_frag;
-        s8 last_frag_rate_idx;
         int num_extra_frag;
-        bool last_frag_rate_ctrl_probe;
 };
 
 struct beacon_data {
@@ -219,9 +211,6 @@ struct ieee80211_if_ap {
 
         struct list_head vlans;
 
-        u8 ssid[IEEE80211_MAX_SSID_LEN];
-        size_t ssid_len;
-
         /* yes, this looks ugly, but guarantees that we can later use
          * bitmap_empty :)
          * NB: don't touch this bitmap, use sta_info_{set,clear}_tim_bit */
@@ -255,26 +244,6 @@ struct mesh_preq_queue {
         u8 flags;
 };
 
-struct mesh_config {
-        /* Timeouts in ms */
-        /* Mesh plink management parameters */
-        u16 dot11MeshRetryTimeout;
-        u16 dot11MeshConfirmTimeout;
-        u16 dot11MeshHoldingTimeout;
-        u16 dot11MeshMaxPeerLinks;
-        u8  dot11MeshMaxRetries;
-        u8  dot11MeshTTL;
-        bool auto_open_plinks;
-        /* HWMP parameters */
-        u8  dot11MeshHWMPmaxPREQretries;
-        u32 path_refresh_time;
-        u16 min_discovery_timeout;
-        u32 dot11MeshHWMPactivePathTimeout;
-        u16 dot11MeshHWMPpreqMinInterval;
-        u16 dot11MeshHWMPnetDiameterTraversalTime;
-};
-
-
 /* flags used in struct ieee80211_if_sta.flags */
 #define IEEE80211_STA_SSID_SET          BIT(0)
 #define IEEE80211_STA_BSSID_SET         BIT(1)
@@ -438,8 +407,7 @@ struct ieee80211_sub_if_data {
         struct ieee80211_key *keys[NUM_DEFAULT_KEYS];
         struct ieee80211_key *default_key;
 
-        /* BSS configuration for this interface. */
-        struct ieee80211_bss_conf bss_conf;
+        u16 sequence_number;
 
         /*
          * AP this belongs to: self in AP mode and
@@ -570,6 +538,11 @@ enum {
         IEEE80211_ADDBA_MSG     = 4,
 };
 
+enum queue_stop_reason {
+        IEEE80211_QUEUE_STOP_REASON_DRIVER,
+        IEEE80211_QUEUE_STOP_REASON_PS,
+};
+
 /* maximum number of hardware queues we support. */
 #define QD_MAX_QUEUES (IEEE80211_MAX_AMPDU_QUEUES + IEEE80211_MAX_QUEUES)
 
@@ -586,7 +559,8 @@ struct ieee80211_local {
         const struct ieee80211_ops *ops;
 
         unsigned long queue_pool[BITS_TO_LONGS(QD_MAX_QUEUES)];
-
+        unsigned long queue_stop_reasons[IEEE80211_MAX_QUEUES];
+        spinlock_t queue_stop_reason_lock;
         struct net_device *mdev; /* wmaster# - "master" 802.11 device */
         int open_count;
         int monitors, cooked_mntrs;
@@ -633,8 +607,6 @@ struct ieee80211_local {
 
         int rts_threshold;
         int fragmentation_threshold;
-        int short_retry_limit; /* dot11ShortRetryLimit */
-        int long_retry_limit; /* dot11LongRetryLimit */
 
         struct crypto_blkcipher *wep_tx_tfm;
         struct crypto_blkcipher *wep_rx_tfm;
@@ -659,6 +631,7 @@ struct ieee80211_local {
         struct delayed_work scan_work;
         struct ieee80211_sub_if_data *scan_sdata;
         struct ieee80211_channel *oper_channel, *scan_channel;
+        enum nl80211_channel_type oper_channel_type;
         u8 scan_ssid[IEEE80211_MAX_SSID_LEN];
         size_t scan_ssid_len;
         struct list_head bss_list;
@@ -722,13 +695,17 @@ struct ieee80211_local {
         int wifi_wme_noack_test;
         unsigned int wmm_acm; /* bit field of ACM bits (BIT(802.1D tag)) */
 
+        bool powersave;
+        int dynamic_ps_timeout;
+        struct work_struct dynamic_ps_enable_work;
+        struct work_struct dynamic_ps_disable_work;
+        struct timer_list dynamic_ps_timer;
+
 #ifdef CONFIG_MAC80211_DEBUGFS
         struct local_debugfsdentries {
                 struct dentry *rcdir;
                 struct dentry *rcname;
                 struct dentry *frequency;
-                struct dentry *antenna_sel_tx;
-                struct dentry *antenna_sel_rx;
                 struct dentry *rts_threshold;
                 struct dentry *fragmentation_threshold;
                 struct dentry *short_retry_limit;
@@ -817,7 +794,7 @@ struct ieee802_11_elems {
         u8 *wmm_info;
         u8 *wmm_param;
         struct ieee80211_ht_cap *ht_cap_elem;
-        struct ieee80211_ht_addt_info *ht_info_elem;
+        struct ieee80211_ht_info *ht_info_elem;
         u8 *mesh_config;
         u8 *mesh_id;
         u8 *peer_link;
@@ -869,11 +846,6 @@ static inline struct ieee80211_hw *local_to_hw(
         return &local->hw;
 }
 
-struct sta_attribute {
-        struct attribute attr;
-        ssize_t (*show)(const struct sta_info *, char *buf);
-        ssize_t (*store)(struct sta_info *, const char *buf, size_t count);
-};
 
 static inline int ieee80211_bssid_match(const u8 *raddr, const u8 *addr)
 {
@@ -882,12 +854,9 @@ static inline int ieee80211_bssid_match(const u8 *raddr, const u8 *addr)
 }
 
 
-int ieee80211_hw_config(struct ieee80211_local *local);
+int ieee80211_hw_config(struct ieee80211_local *local, u32 changed);
 int ieee80211_if_config(struct ieee80211_sub_if_data *sdata, u32 changed);
 void ieee80211_tx_set_protected(struct ieee80211_tx_data *tx);
-u32 ieee80211_handle_ht(struct ieee80211_local *local, int enable_ht,
-                        struct ieee80211_ht_info *req_ht_cap,
-                        struct ieee80211_ht_bss_info *req_bss_cap);
 void ieee80211_bss_info_change_notify(struct ieee80211_sub_if_data *sdata,
                                       u32 changed);
 void ieee80211_configure_filter(struct ieee80211_local *local);
@@ -906,8 +875,7 @@ int ieee80211_sta_set_bssid(struct ieee80211_sub_if_data *sdata, u8 *bssid);
 void ieee80211_sta_req_auth(struct ieee80211_sub_if_data *sdata,
                             struct ieee80211_if_sta *ifsta);
 struct sta_info *ieee80211_ibss_add_sta(struct ieee80211_sub_if_data *sdata,
-                                        struct sk_buff *skb, u8 *bssid,
-                                        u8 *addr, u64 supp_rates);
+                                        u8 *bssid, u8 *addr, u64 supp_rates);
 int ieee80211_sta_deauthenticate(struct ieee80211_sub_if_data *sdata, u16 reason);
 int ieee80211_sta_disassociate(struct ieee80211_sub_if_data *sdata, u16 reason);
 u32 ieee80211_reset_erp_info(struct ieee80211_sub_if_data *sdata);
@@ -968,11 +936,12 @@ int ieee80211_monitor_start_xmit(struct sk_buff *skb, struct net_device *dev);
 int ieee80211_subif_start_xmit(struct sk_buff *skb, struct net_device *dev);
 
 /* HT */
-int ieee80211_ht_cap_ie_to_ht_info(struct ieee80211_ht_cap *ht_cap_ie,
-                                   struct ieee80211_ht_info *ht_info);
-int ieee80211_ht_addt_info_ie_to_ht_bss_info(
-                        struct ieee80211_ht_addt_info *ht_add_info_ie,
-                        struct ieee80211_ht_bss_info *bss_info);
+void ieee80211_ht_cap_ie_to_sta_ht_cap(struct ieee80211_supported_band *sband,
+                                       struct ieee80211_ht_cap *ht_cap_ie,
+                                       struct ieee80211_sta_ht_cap *ht_cap);
+u32 ieee80211_enable_ht(struct ieee80211_sub_if_data *sdata,
+                        struct ieee80211_ht_info *hti,
+                        u16 ap_ht_cap_flags);
 void ieee80211_send_bar(struct ieee80211_sub_if_data *sdata, u8 *ra, u16 tid, u16 ssn);
 
 void ieee80211_sta_stop_rx_ba_session(struct ieee80211_sub_if_data *sdata, u8 *da,
@@ -1014,6 +983,15 @@ int ieee80211_set_freq(struct ieee80211_sub_if_data *sdata, int freq);
 u64 ieee80211_mandatory_rates(struct ieee80211_local *local,
                               enum ieee80211_band band);
 
+void ieee80211_dynamic_ps_enable_work(struct work_struct *work);
+void ieee80211_dynamic_ps_disable_work(struct work_struct *work);
+void ieee80211_dynamic_ps_timer(unsigned long data);
+
+void ieee80211_wake_queues_by_reason(struct ieee80211_hw *hw,
+                                     enum queue_stop_reason reason);
+void ieee80211_stop_queues_by_reason(struct ieee80211_hw *hw,
+                                     enum queue_stop_reason reason);
+
 #ifdef CONFIG_MAC80211_NOINLINE
 #define debug_noinline noinline
 #else
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 8336fee68d3e..5abbc3f07dd6 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -65,7 +65,7 @@ static int ieee80211_open(struct net_device *dev)
         struct ieee80211_if_init_conf conf;
         u32 changed = 0;
         int res;
-        bool need_hw_reconfig = 0;
+        u32 hw_reconf_flags = 0;
         u8 null_addr[ETH_ALEN] = {0};
 
         /* fail early if user set an invalid address */
@@ -152,7 +152,8 @@ static int ieee80211_open(struct net_device *dev)
                         res = local->ops->start(local_to_hw(local));
                 if (res)
                         goto err_del_bss;
-                need_hw_reconfig = 1;
+                /* we're brought up, everything changes */
+                hw_reconf_flags = ~0;
                 ieee80211_led_radio(local, local->hw.conf.radio_enabled);
         }
 
@@ -198,8 +199,10 @@ static int ieee80211_open(struct net_device *dev)
 
                 /* must be before the call to ieee80211_configure_filter */
                 local->monitors++;
-                if (local->monitors == 1)
+                if (local->monitors == 1) {
                         local->hw.conf.flags |= IEEE80211_CONF_RADIOTAP;
+                        hw_reconf_flags |= IEEE80211_CONF_CHANGE_RADIOTAP;
+                }
 
                 if (sdata->u.mntr_flags & MONITOR_FLAG_FCSFAIL)
                         local->fif_fcsfail++;
@@ -226,8 +229,14 @@ static int ieee80211_open(struct net_device *dev)
                 if (res)
                         goto err_stop;
 
-                if (ieee80211_vif_is_mesh(&sdata->vif))
+                if (ieee80211_vif_is_mesh(&sdata->vif)) {
+                        local->fif_other_bss++;
+                        netif_addr_lock_bh(local->mdev);
+                        ieee80211_configure_filter(local);
+                        netif_addr_unlock_bh(local->mdev);
+
                         ieee80211_start_mesh(sdata);
+                }
                 changed |= ieee80211_reset_erp_info(sdata);
                 ieee80211_bss_info_change_notify(sdata, changed);
                 ieee80211_enable_keys(sdata);
@@ -279,8 +288,8 @@ static int ieee80211_open(struct net_device *dev)
                 atomic_inc(&local->iff_promiscs);
 
         local->open_count++;
-        if (need_hw_reconfig) {
-                ieee80211_hw_config(local);
+        if (hw_reconf_flags) {
+                ieee80211_hw_config(local, hw_reconf_flags);
                 /*
                  * set default queue parameters so drivers don't
                  * need to initialise the hardware if the hardware
@@ -322,6 +331,7 @@ static int ieee80211_stop(struct net_device *dev)
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_if_init_conf conf;
         struct sta_info *sta;
+        u32 hw_reconf_flags = 0;
 
         /*
          * Stop TX on this interface first.
@@ -405,8 +415,10 @@ static int ieee80211_stop(struct net_device *dev)
                 }
 
                 local->monitors--;
-                if (local->monitors == 0)
+                if (local->monitors == 0) {
                         local->hw.conf.flags &= ~IEEE80211_CONF_RADIOTAP;
+                        hw_reconf_flags |= IEEE80211_CONF_CHANGE_RADIOTAP;
+                }
 
                 if (sdata->u.mntr_flags & MONITOR_FLAG_FCSFAIL)
                         local->fif_fcsfail--;
@@ -423,7 +435,11 @@ static int ieee80211_stop(struct net_device *dev)
                 break;
         case NL80211_IFTYPE_STATION:
         case NL80211_IFTYPE_ADHOC:
-                sdata->u.sta.state = IEEE80211_STA_MLME_DISABLED;
+                /* Announce that we are leaving the network. */
+                if (sdata->u.sta.state != IEEE80211_STA_MLME_DISABLED)
+                        ieee80211_sta_deauthenticate(sdata,
+                                                WLAN_REASON_DEAUTH_LEAVING);
+
                 memset(sdata->u.sta.bssid, 0, ETH_ALEN);
                 del_timer_sync(&sdata->u.sta.timer);
                 /*
@@ -450,8 +466,15 @@ static int ieee80211_stop(struct net_device *dev)
                 /* fall through */
         case NL80211_IFTYPE_MESH_POINT:
                 if (ieee80211_vif_is_mesh(&sdata->vif)) {
-                        /* allmulti is always set on mesh ifaces */
+                        /* other_bss and allmulti are always set on mesh
+                         * ifaces */
+                        local->fif_other_bss--;
                         atomic_dec(&local->iff_allmultis);
+
+                        netif_addr_lock_bh(local->mdev);
+                        ieee80211_configure_filter(local);
+                        netif_addr_unlock_bh(local->mdev);
+
                         ieee80211_stop_mesh(sdata);
                 }
                 /* fall through */
@@ -504,8 +527,15 @@ static int ieee80211_stop(struct net_device *dev)
 
                 tasklet_disable(&local->tx_pending_tasklet);
                 tasklet_disable(&local->tasklet);
+
+                /* no reconfiguring after stop! */
+                hw_reconf_flags = 0;
         }
 
+        /* do after stop to avoid reconfiguring when we stop anyway */
+        if (hw_reconf_flags)
+                ieee80211_hw_config(local, hw_reconf_flags);
+
         return 0;
 }
 
@@ -668,6 +698,10 @@ int ieee80211_if_change_type(struct ieee80211_sub_if_data *sdata,
         if (type == sdata->vif.type)
                 return 0;
 
+        /* Setting ad-hoc mode on non-IBSS channel is not supported. */
+        if (sdata->local->oper_channel->flags & IEEE80211_CHAN_NO_IBSS)
+                return -EOPNOTSUPP;
+
         /*
          * We could, here, on changes between IBSS/STA/MESH modes,
          * invoke an MLME function instead that disassociates etc.
@@ -682,7 +716,7 @@ int ieee80211_if_change_type(struct ieee80211_sub_if_data *sdata,
         ieee80211_setup_sdata(sdata, type);
 
         /* reset some values that shouldn't be kept across type changes */
-        sdata->bss_conf.basic_rates =
+        sdata->vif.bss_conf.basic_rates =
                 ieee80211_mandatory_rates(sdata->local,
                         sdata->local->hw.conf.channel->band);
         sdata->drop_unencrypted = 0;
diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index a5b06fe71980..999f7aa42326 100644
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -132,7 +132,6 @@ static void ieee80211_key_enable_hw_accel(struct ieee80211_key *key)
 {
         const u8 *addr;
         int ret;
-        DECLARE_MAC_BUF(mac);
 
         assert_key_lock();
         might_sleep();
@@ -154,16 +153,15 @@ static void ieee80211_key_enable_hw_accel(struct ieee80211_key *key)
 
         if (ret && ret != -ENOSPC && ret != -EOPNOTSUPP)
                 printk(KERN_ERR "mac80211-%s: failed to set key "
-                       "(%d, %s) to hardware (%d)\n",
+                       "(%d, %pM) to hardware (%d)\n",
                        wiphy_name(key->local->hw.wiphy),
-                       key->conf.keyidx, print_mac(mac, addr), ret);
+                       key->conf.keyidx, addr, ret);
 }
 
 static void ieee80211_key_disable_hw_accel(struct ieee80211_key *key)
 {
         const u8 *addr;
         int ret;
-        DECLARE_MAC_BUF(mac);
 
         assert_key_lock();
         might_sleep();
@@ -186,9 +184,9 @@ static void ieee80211_key_disable_hw_accel(struct ieee80211_key *key)
 
         if (ret)
                 printk(KERN_ERR "mac80211-%s: failed to remove key "
-                       "(%d, %s) from hardware (%d)\n",
+                       "(%d, %pM) from hardware (%d)\n",
                        wiphy_name(key->local->hw.wiphy),
-                       key->conf.keyidx, print_mac(mac, addr), ret);
+                       key->conf.keyidx, addr, ret);
 
         spin_lock(&todo_lock);
         key->flags &= ~KEY_FLAG_UPLOADED_TO_HARDWARE;
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index ae62ad40ad63..24b14363d6e7 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -41,6 +41,8 @@
  */
 struct ieee80211_tx_status_rtap_hdr {
         struct ieee80211_radiotap_header hdr;
+        u8 rate;
+        u8 padding_for_rate;
         __le16 tx_flags;
         u8 data_retries;
 } __attribute__ ((packed));
@@ -169,19 +171,13 @@ int ieee80211_if_config(struct ieee80211_sub_if_data *sdata, u32 changed)
         conf.changed = changed;
 
         if (sdata->vif.type == NL80211_IFTYPE_STATION ||
-            sdata->vif.type == NL80211_IFTYPE_ADHOC) {
+            sdata->vif.type == NL80211_IFTYPE_ADHOC)
                 conf.bssid = sdata->u.sta.bssid;
-                conf.ssid = sdata->u.sta.ssid;
-                conf.ssid_len = sdata->u.sta.ssid_len;
-        } else if (sdata->vif.type == NL80211_IFTYPE_AP) {
+        else if (sdata->vif.type == NL80211_IFTYPE_AP)
                 conf.bssid = sdata->dev->dev_addr;
-                conf.ssid = sdata->u.ap.ssid;
-                conf.ssid_len = sdata->u.ap.ssid_len;
-        } else if (ieee80211_vif_is_mesh(&sdata->vif)) {
+        else if (ieee80211_vif_is_mesh(&sdata->vif)) {
                 u8 zero[ETH_ALEN] = { 0 };
                 conf.bssid = zero;
-                conf.ssid = zero;
-                conf.ssid_len = 0;
         } else {
                 WARN_ON(1);
                 return -EINVAL;
@@ -190,136 +186,73 @@ int ieee80211_if_config(struct ieee80211_sub_if_data *sdata, u32 changed)
         if (WARN_ON(!conf.bssid && (changed & IEEE80211_IFCC_BSSID)))
                 return -EINVAL;
 
-        if (WARN_ON(!conf.ssid && (changed & IEEE80211_IFCC_SSID)))
-                return -EINVAL;
-
         return local->ops->config_interface(local_to_hw(local),
                                             &sdata->vif, &conf);
 }
 
-int ieee80211_hw_config(struct ieee80211_local *local)
+int ieee80211_hw_config(struct ieee80211_local *local, u32 changed)
 {
         struct ieee80211_channel *chan;
         int ret = 0;
+        int power;
+        enum nl80211_channel_type channel_type;
+
+        might_sleep();
 
-        if (local->sw_scanning)
+        if (local->sw_scanning) {
                 chan = local->scan_channel;
-        else
+                channel_type = NL80211_CHAN_NO_HT;
+        } else {
                 chan = local->oper_channel;
+                channel_type = local->oper_channel_type;
+        }
 
-        local->hw.conf.channel = chan;
+        if (chan != local->hw.conf.channel ||
+            channel_type != local->hw.conf.ht.channel_type) {
+                local->hw.conf.channel = chan;
+                local->hw.conf.ht.channel_type = channel_type;
+                switch (channel_type) {
+                case NL80211_CHAN_NO_HT:
+                        local->hw.conf.ht.enabled = false;
+                        break;
+                case NL80211_CHAN_HT20:
+                case NL80211_CHAN_HT40MINUS:
+                case NL80211_CHAN_HT40PLUS:
+                        local->hw.conf.ht.enabled = true;
+                        break;
+                }
+                changed |= IEEE80211_CONF_CHANGE_CHANNEL;
+        }
 
         if (!local->hw.conf.power_level)
-                local->hw.conf.power_level = chan->max_power;
+                power = chan->max_power;
         else
-                local->hw.conf.power_level = min(chan->max_power,
-                                               local->hw.conf.power_level);
-
-        local->hw.conf.max_antenna_gain = chan->max_antenna_gain;
-
-#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
-        printk(KERN_DEBUG "%s: HW CONFIG: freq=%d\n",
-               wiphy_name(local->hw.wiphy), chan->center_freq);
-#endif
-
-        if (local->open_count)
-                ret = local->ops->config(local_to_hw(local), &local->hw.conf);
-
-        return ret;
-}
-
-/**
- * ieee80211_handle_ht should be used only after legacy configuration
- * has been determined namely band, as ht configuration depends upon
- * the hardware's HT abilities for a _specific_ band.
- */
-u32 ieee80211_handle_ht(struct ieee80211_local *local, int enable_ht,
-                           struct ieee80211_ht_info *req_ht_cap,
-                           struct ieee80211_ht_bss_info *req_bss_cap)
-{
-        struct ieee80211_conf *conf = &local->hw.conf;
-        struct ieee80211_supported_band *sband;
-        struct ieee80211_ht_info ht_conf;
-        struct ieee80211_ht_bss_info ht_bss_conf;
-        u32 changed = 0;
-        int i;
-        u8 max_tx_streams = IEEE80211_HT_CAP_MAX_STREAMS;
-        u8 tx_mcs_set_cap;
-
-        sband = local->hw.wiphy->bands[conf->channel->band];
-
-        memset(&ht_conf, 0, sizeof(struct ieee80211_ht_info));
-        memset(&ht_bss_conf, 0, sizeof(struct ieee80211_ht_bss_info));
-
-        /* HT is not supported */
-        if (!sband->ht_info.ht_supported) {
-                conf->flags &= ~IEEE80211_CONF_SUPPORT_HT_MODE;
-                goto out;
+                power = min(chan->max_power, local->hw.conf.power_level);
+        if (local->hw.conf.power_level != power) {
+                changed |= IEEE80211_CONF_CHANGE_POWER;
+                local->hw.conf.power_level = power;
         }
 
-        /* disable HT */
-        if (!enable_ht) {
-                if (conf->flags & IEEE80211_CONF_SUPPORT_HT_MODE)
-                        changed |= BSS_CHANGED_HT;
-                conf->flags &= ~IEEE80211_CONF_SUPPORT_HT_MODE;
-                conf->ht_conf.ht_supported = 0;
-                goto out;
+        if (changed && local->open_count) {
+                ret = local->ops->config(local_to_hw(local), changed);
+                /*
+                 * Goal:
+                 * HW reconfiguration should never fail, the driver has told
+                 * us what it can support so it should live up to that promise.
+                 *
+                 * Current status:
+                 * rfkill is not integrated with mac80211 and a
+                 * configuration command can thus fail if hardware rfkill
+                 * is enabled
+                 *
+                 * FIXME: integrate rfkill with mac80211 and then add this
+                 * WARN_ON() back
+                 *
+                 */
+                /* WARN_ON(ret); */
         }
 
-
-        if (!(conf->flags & IEEE80211_CONF_SUPPORT_HT_MODE))
-                changed |= BSS_CHANGED_HT;
-
-        conf->flags |= IEEE80211_CONF_SUPPORT_HT_MODE;
-        ht_conf.ht_supported = 1;
-
-        ht_conf.cap = req_ht_cap->cap & sband->ht_info.cap;
-        ht_conf.cap &= ~(IEEE80211_HT_CAP_SM_PS);
-        ht_conf.cap |= sband->ht_info.cap & IEEE80211_HT_CAP_SM_PS;
-        ht_bss_conf.primary_channel = req_bss_cap->primary_channel;
-        ht_bss_conf.bss_cap = req_bss_cap->bss_cap;
-        ht_bss_conf.bss_op_mode = req_bss_cap->bss_op_mode;
-
-        ht_conf.ampdu_factor = req_ht_cap->ampdu_factor;
-        ht_conf.ampdu_density = req_ht_cap->ampdu_density;
-
-        /* Bits 96-100 */
-        tx_mcs_set_cap = sband->ht_info.supp_mcs_set[12];
-
-        /* configure suppoerted Tx MCS according to requested MCS
-         * (based in most cases on Rx capabilities of peer) and self
-         * Tx MCS capabilities (as defined by low level driver HW
-         * Tx capabilities) */
-        if (!(tx_mcs_set_cap & IEEE80211_HT_CAP_MCS_TX_DEFINED))
-                goto check_changed;
-
-        /* Counting from 0 therfore + 1 */
-        if (tx_mcs_set_cap & IEEE80211_HT_CAP_MCS_TX_RX_DIFF)
-                max_tx_streams = ((tx_mcs_set_cap &
-                                IEEE80211_HT_CAP_MCS_TX_STREAMS) >> 2) + 1;
-
-        for (i = 0; i < max_tx_streams; i++)
-                ht_conf.supp_mcs_set[i] =
-                        sband->ht_info.supp_mcs_set[i] &
-                                        req_ht_cap->supp_mcs_set[i];
-
-        if (tx_mcs_set_cap & IEEE80211_HT_CAP_MCS_TX_UEQM)
-                for (i = IEEE80211_SUPP_MCS_SET_UEQM;
-                     i < IEEE80211_SUPP_MCS_SET_LEN; i++)
-                        ht_conf.supp_mcs_set[i] =
-                                sband->ht_info.supp_mcs_set[i] &
-                                        req_ht_cap->supp_mcs_set[i];
-
-check_changed:
-        /* if bss configuration changed store the new one */
-        if (memcmp(&conf->ht_conf, &ht_conf, sizeof(ht_conf)) ||
-            memcmp(&conf->ht_bss_conf, &ht_bss_conf, sizeof(ht_bss_conf))) {
-                changed |= BSS_CHANGED_HT;
-                memcpy(&conf->ht_conf, &ht_conf, sizeof(ht_conf));
-                memcpy(&conf->ht_bss_conf, &ht_bss_conf, sizeof(ht_bss_conf));
-        }
-out:
-        return changed;
+        return ret;
 }
 
 void ieee80211_bss_info_change_notify(struct ieee80211_sub_if_data *sdata,
@@ -336,15 +269,18 @@ void ieee80211_bss_info_change_notify(struct ieee80211_sub_if_data *sdata,
         if (local->ops->bss_info_changed)
                 local->ops->bss_info_changed(local_to_hw(local),
                                              &sdata->vif,
-                                             &sdata->bss_conf,
+                                             &sdata->vif.bss_conf,
                                              changed);
 }
 
 u32 ieee80211_reset_erp_info(struct ieee80211_sub_if_data *sdata)
 {
-        sdata->bss_conf.use_cts_prot = 0;
-        sdata->bss_conf.use_short_preamble = 0;
-        return BSS_CHANGED_ERP_CTS_PROT | BSS_CHANGED_ERP_PREAMBLE;
+        sdata->vif.bss_conf.use_cts_prot = false;
+        sdata->vif.bss_conf.use_short_preamble = false;
+        sdata->vif.bss_conf.use_short_slot = false;
+        return BSS_CHANGED_ERP_CTS_PROT |
+               BSS_CHANGED_ERP_PREAMBLE |
+               BSS_CHANGED_ERP_SLOT;
 }
 
 void ieee80211_tx_status_irqsafe(struct ieee80211_hw *hw,
@@ -405,7 +341,8 @@ static void ieee80211_tasklet_handler(unsigned long data)
                         dev_kfree_skb(skb);
                         break ;
                 default:
-                        WARN_ON(1);
+                        WARN(1, "mac80211: Packet is of unknown type %d\n",
+                             skb->pkt_type);
                         dev_kfree_skb(skb);
                         break;
                 }
@@ -466,8 +403,6 @@ static void ieee80211_handle_filtered_frame(struct ieee80211_local *local,
                                             struct sta_info *sta,
                                             struct sk_buff *skb)
 {
-        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-
         sta->tx_filtered_count++;
 
         /*
@@ -514,10 +449,9 @@ static void ieee80211_handle_filtered_frame(struct ieee80211_local *local,
                 return;
         }
 
-        if (!test_sta_flags(sta, WLAN_STA_PS) &&
-            !(info->flags & IEEE80211_TX_CTL_REQUEUE)) {
+        if (!test_sta_flags(sta, WLAN_STA_PS) && !skb->requeue) {
                 /* Software retry the packet once */
-                info->flags |= IEEE80211_TX_CTL_REQUEUE;
+                skb->requeue = 1;
                 ieee80211_remove_tx_extra(local, sta->key, skb);
                 dev_queue_xmit(skb);
                 return;
@@ -547,13 +481,28 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
         struct ieee80211_sub_if_data *sdata;
         struct net_device *prev_dev = NULL;
         struct sta_info *sta;
+        int retry_count = -1, i;
+
+        for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
+                /* the HW cannot have attempted that rate */
+                if (i >= hw->max_rates) {
+                        info->status.rates[i].idx = -1;
+                        info->status.rates[i].count = 0;
+                }
+
+                retry_count += info->status.rates[i].count;
+        }
+        if (retry_count < 0)
+                retry_count = 0;
 
         rcu_read_lock();
 
+        sband = local->hw.wiphy->bands[info->band];
+
         sta = sta_info_get(local, hdr->addr1);
 
         if (sta) {
-                if (info->status.excessive_retries &&
+                if (!(info->flags & IEEE80211_TX_STAT_ACK) &&
                     test_sta_flags(sta, WLAN_STA_PS)) {
                         /*
                          * The STA is in power save mode, so assume
@@ -584,12 +533,11 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
                         rcu_read_unlock();
                         return;
                 } else {
-                        if (info->status.excessive_retries)
+                        if (!(info->flags & IEEE80211_TX_STAT_ACK))
                                 sta->tx_retry_failed++;
-                        sta->tx_retry_count += info->status.retry_count;
+                        sta->tx_retry_count += retry_count;
                 }
 
-                sband = local->hw.wiphy->bands[info->band];
                 rate_control_tx_status(local, sband, sta, skb);
         }
 
@@ -610,9 +558,9 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
                         local->dot11TransmittedFrameCount++;
                         if (is_multicast_ether_addr(hdr->addr1))
                                 local->dot11MulticastTransmittedFrameCount++;
-                        if (info->status.retry_count > 0)
+                        if (retry_count > 0)
                                 local->dot11RetryCount++;
-                        if (info->status.retry_count > 1)
+                        if (retry_count > 1)
                                 local->dot11MultipleRetryCount++;
                 }
 
@@ -656,19 +604,30 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
         rthdr->hdr.it_len = cpu_to_le16(sizeof(*rthdr));
         rthdr->hdr.it_present =
                 cpu_to_le32((1 << IEEE80211_RADIOTAP_TX_FLAGS) |
-                            (1 << IEEE80211_RADIOTAP_DATA_RETRIES));
+                            (1 << IEEE80211_RADIOTAP_DATA_RETRIES) |
+                            (1 << IEEE80211_RADIOTAP_RATE));
 
         if (!(info->flags & IEEE80211_TX_STAT_ACK) &&
             !is_multicast_ether_addr(hdr->addr1))
                 rthdr->tx_flags |= cpu_to_le16(IEEE80211_RADIOTAP_F_TX_FAIL);
 
-        if ((info->flags & IEEE80211_TX_CTL_USE_RTS_CTS) &&
-            (info->flags & IEEE80211_TX_CTL_USE_CTS_PROTECT))
+        /*
+         * XXX: Once radiotap gets the bitmap reset thing the vendor
+         *      extensions proposal contains, we can actually report
+         *      the whole set of tries we did.
+         */
+        if ((info->status.rates[0].flags & IEEE80211_TX_RC_USE_RTS_CTS) ||
+            (info->status.rates[0].flags & IEEE80211_TX_RC_USE_CTS_PROTECT))
                 rthdr->tx_flags |= cpu_to_le16(IEEE80211_RADIOTAP_F_TX_CTS);
-        else if (info->flags & IEEE80211_TX_CTL_USE_RTS_CTS)
+        else if (info->status.rates[0].flags & IEEE80211_TX_RC_USE_RTS_CTS)
                 rthdr->tx_flags |= cpu_to_le16(IEEE80211_RADIOTAP_F_TX_RTS);
+        if (info->status.rates[0].idx >= 0 &&
+            !(info->status.rates[0].flags & IEEE80211_TX_RC_MCS))
+                rthdr->rate = sband->bitrates[
+                                info->status.rates[0].idx].bitrate / 5;
 
-        rthdr->data_retries = info->status.retry_count;
+        /* for now report the total retry_count */
+        rthdr->data_retries = retry_count;
 
         /* XXX: is this sufficient for BPF? */
         skb_set_mac_header(skb, 0);
@@ -753,20 +712,30 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
         BUG_ON(!ops->configure_filter);
         local->ops = ops;
 
-        local->hw.queues = 1; /* default */
-
+        /* set up some defaults */
+        local->hw.queues = 1;
+        local->hw.max_rates = 1;
         local->rts_threshold = IEEE80211_MAX_RTS_THRESHOLD;
         local->fragmentation_threshold = IEEE80211_MAX_FRAG_THRESHOLD;
-        local->short_retry_limit = 7;
-        local->long_retry_limit = 4;
-        local->hw.conf.radio_enabled = 1;
+        local->hw.conf.long_frame_max_tx_count = 4;
+        local->hw.conf.short_frame_max_tx_count = 7;
+        local->hw.conf.radio_enabled = true;
 
         INIT_LIST_HEAD(&local->interfaces);
 
         spin_lock_init(&local->key_lock);
 
+        spin_lock_init(&local->queue_stop_reason_lock);
+
         INIT_DELAYED_WORK(&local->scan_work, ieee80211_scan_work);
 
+        INIT_WORK(&local->dynamic_ps_enable_work,
+                  ieee80211_dynamic_ps_enable_work);
+        INIT_WORK(&local->dynamic_ps_disable_work,
+                  ieee80211_dynamic_ps_disable_work);
+        setup_timer(&local->dynamic_ps_timer,
+                    ieee80211_dynamic_ps_timer, (unsigned long) local);
+
         sta_info_init(local);
 
         tasklet_init(&local->tx_pending_tasklet, ieee80211_tx_pending,
@@ -788,7 +757,6 @@ EXPORT_SYMBOL(ieee80211_alloc_hw);
 int ieee80211_register_hw(struct ieee80211_hw *hw)
 {
         struct ieee80211_local *local = hw_to_local(hw);
-        const char *name;
         int result;
         enum ieee80211_band band;
         struct net_device *mdev;
@@ -853,8 +821,8 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
         mdev->header_ops = &ieee80211_header_ops;
         mdev->set_multicast_list = ieee80211_master_set_multicast_list;
 
-        name = wiphy_dev(local->hw.wiphy)->driver->name;
-        local->hw.workqueue = create_freezeable_workqueue(name);
+        local->hw.workqueue =
+                create_freezeable_workqueue(wiphy_name(local->hw.wiphy));
         if (!local->hw.workqueue) {
                 result = -ENOMEM;
                 goto fail_workqueue;
@@ -921,12 +889,14 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
 
         local->mdev->select_queue = ieee80211_select_queue;
 
-        /* add one default STA interface */
-        result = ieee80211_if_add(local, "wlan%d", NULL,
-                                  NL80211_IFTYPE_STATION, NULL);
-        if (result)
-                printk(KERN_WARNING "%s: Failed to add default virtual iface\n",
-                       wiphy_name(local->hw.wiphy));
+        /* add one default STA interface if supported */
+        if (local->hw.wiphy->interface_modes & BIT(NL80211_IFTYPE_STATION)) {
+                result = ieee80211_if_add(local, "wlan%d", NULL,
+                                          NL80211_IFTYPE_STATION, NULL);
+                if (result)
+                        printk(KERN_WARNING "%s: Failed to add default virtual iface\n",
+                               wiphy_name(local->hw.wiphy));
+        }
 
         rtnl_unlock();
 
@@ -1013,7 +983,7 @@ static int __init ieee80211_init(void)
 
         BUILD_BUG_ON(sizeof(struct ieee80211_tx_info) > sizeof(skb->cb));
         BUILD_BUG_ON(offsetof(struct ieee80211_tx_info, driver_data) +
-                     IEEE80211_TX_INFO_DRIVER_DATA_SIZE > sizeof(skb->cb));
+                     IEEE80211_TX_INFO_DRIVER_DATA_SIZE > sizeof(skb->cb));
 
         ret = rc80211_minstrel_init();
         if (ret)
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index 8013277924f2..82f568e94365 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -238,7 +238,7 @@ void mesh_mgmt_ies_add(struct sk_buff *skb, struct ieee80211_sub_if_data *sdata)
 
         pos = skb_put(skb, 21);
         *pos++ = WLAN_EID_MESH_CONFIG;
-        *pos++ = MESH_CFG_LEN;
+        *pos++ = IEEE80211_MESH_CONFIG_LEN;
         /* Version */
         *pos++ = 1;
 
@@ -473,7 +473,7 @@ static void ieee80211_mesh_rx_bcn_presp(struct ieee80211_sub_if_data *sdata,
                                         size_t len,
                                         struct ieee80211_rx_status *rx_status)
 {
-        struct ieee80211_local *local= sdata->local;
+        struct ieee80211_local *local = sdata->local;
         struct ieee802_11_elems elems;
         struct ieee80211_channel *channel;
         u64 supp_rates = 0;
diff --git a/net/mac80211/mesh.h b/net/mac80211/mesh.h
index e10471c6ba42..c197ab545e54 100644
--- a/net/mac80211/mesh.h
+++ b/net/mac80211/mesh.h
@@ -145,9 +145,6 @@ struct mesh_rmc {
 };
 
 
-/* Mesh IEs constants */
-#define MESH_CFG_LEN            19
-
 /*
  * MESH_CFG_COMP_LEN Includes:
  *      - Active path selection protocol ID.
@@ -157,7 +154,7 @@ struct mesh_rmc {
  * Does not include mesh capabilities, which may vary across nodes in the same
  * mesh
  */
-#define MESH_CFG_CMP_LEN        17
+#define MESH_CFG_CMP_LEN        (IEEE80211_MESH_CONFIG_LEN - 2)
 
 /* Default values, timeouts in ms */
 #define MESH_TTL                5
diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
index 501c7831adb4..71fe60961230 100644
--- a/net/mac80211/mesh_hwmp.c
+++ b/net/mac80211/mesh_hwmp.c
@@ -218,12 +218,16 @@ static u32 airtime_link_metric_get(struct ieee80211_local *local,
 
         if (sta->fail_avg >= 100)
                 return MAX_METRIC;
+
+        if (sta->last_tx_rate.flags & IEEE80211_TX_RC_MCS)
+                return MAX_METRIC;
+
         err = (sta->fail_avg << ARITH_SHIFT) / 100;
 
         /* bitrate is in units of 100 Kbps, while we need rate in units of
          * 1Mbps. This will be corrected on tx_time computation.
          */
-        rate = sband->bitrates[sta->last_txrate_idx].bitrate;
+        rate = sband->bitrates[sta->last_tx_rate.idx].bitrate;
         tx_time = (device_constant + 10 * test_frame_len / rate);
         estimated_retx = ((1 << (2 * ARITH_SHIFT)) / (s_unit - err));
         result = (tx_time * estimated_retx) >> (2 * ARITH_SHIFT) ;
@@ -759,7 +763,6 @@ enddiscovery:
  *
  * @skb: 802.11 frame to be sent
  * @sdata: network subif the frame will be sent through
- * @fwd_frame: true if this frame was originally from a different host
  *
  * Returns: 0 if the next hop was found. Nonzero otherwise. If no next hop is
  * found, the function will start a path discovery and queue the frame so it is
diff --git a/net/mac80211/mesh_plink.c b/net/mac80211/mesh_plink.c
index faac101c0f85..929ba542fd72 100644
--- a/net/mac80211/mesh_plink.c
+++ b/net/mac80211/mesh_plink.c
@@ -257,9 +257,6 @@ static void mesh_plink_timer(unsigned long data)
         struct sta_info *sta;
         __le16 llid, plid, reason;
         struct ieee80211_sub_if_data *sdata;
-#ifdef CONFIG_MAC80211_VERBOSE_MPL_DEBUG
-        DECLARE_MAC_BUF(mac);
-#endif
 
         /*
          * This STA is valid because sta_info_destroy() will
@@ -274,8 +271,8 @@ static void mesh_plink_timer(unsigned long data)
                 spin_unlock_bh(&sta->lock);
                 return;
         }
-        mpl_dbg("Mesh plink timer for %s fired on state %d\n",
-                        print_mac(mac, sta->sta.addr), sta->plink_state);
+        mpl_dbg("Mesh plink timer for %pM fired on state %d\n",
+                sta->sta.addr, sta->plink_state);
         reason = 0;
         llid = sta->llid;
         plid = sta->plid;
@@ -287,9 +284,9 @@ static void mesh_plink_timer(unsigned long data)
                 /* retry timer */
                 if (sta->plink_retries < dot11MeshMaxRetries(sdata)) {
                         u32 rand;
-                        mpl_dbg("Mesh plink for %s (retry, timeout): %d %d\n",
-                                        print_mac(mac, sta->sta.addr),
-                                        sta->plink_retries, sta->plink_timeout);
+                        mpl_dbg("Mesh plink for %pM (retry, timeout): %d %d\n",
+                                sta->sta.addr, sta->plink_retries,
+                                sta->plink_timeout);
                         get_random_bytes(&rand, sizeof(u32));
                         sta->plink_timeout = sta->plink_timeout +
                                              rand % sta->plink_timeout;
@@ -337,9 +334,6 @@ int mesh_plink_open(struct sta_info *sta)
 {
         __le16 llid;
         struct ieee80211_sub_if_data *sdata = sta->sdata;
-#ifdef CONFIG_MAC80211_VERBOSE_MPL_DEBUG
-        DECLARE_MAC_BUF(mac);
-#endif
 
         spin_lock_bh(&sta->lock);
         get_random_bytes(&llid, 2);
@@ -351,8 +345,8 @@ int mesh_plink_open(struct sta_info *sta)
         sta->plink_state = PLINK_OPN_SNT;
         mesh_plink_timer_set(sta, dot11MeshRetryTimeout(sdata));
         spin_unlock_bh(&sta->lock);
-        mpl_dbg("Mesh plink: starting establishment with %s\n",
-                print_mac(mac, sta->sta.addr));
+        mpl_dbg("Mesh plink: starting establishment with %pM\n",
+                sta->sta.addr);
 
         return mesh_plink_frame_tx(sdata, PLINK_OPEN,
                                    sta->sta.addr, llid, 0, 0);
@@ -360,10 +354,6 @@ int mesh_plink_open(struct sta_info *sta)
 
 void mesh_plink_block(struct sta_info *sta)
 {
-#ifdef CONFIG_MAC80211_VERBOSE_MPL_DEBUG
-        DECLARE_MAC_BUF(mac);
-#endif
-
         spin_lock_bh(&sta->lock);
         __mesh_plink_deactivate(sta);
         sta->plink_state = PLINK_BLOCKED;
@@ -374,12 +364,8 @@ int mesh_plink_close(struct sta_info *sta)
 {
         struct ieee80211_sub_if_data *sdata = sta->sdata;
         __le16 llid, plid, reason;
-#ifdef CONFIG_MAC80211_VERBOSE_MPL_DEBUG
-        DECLARE_MAC_BUF(mac);
-#endif
 
-        mpl_dbg("Mesh plink: closing link with %s\n",
-                        print_mac(mac, sta->sta.addr));
+        mpl_dbg("Mesh plink: closing link with %pM\n", sta->sta.addr);
         spin_lock_bh(&sta->lock);
         sta->reason = cpu_to_le16(MESH_LINK_CANCELLED);
         reason = sta->reason;
@@ -417,9 +403,6 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
         u8 ie_len;
         u8 *baseaddr;
         __le16 plid, llid, reason;
-#ifdef CONFIG_MAC80211_VERBOSE_MPL_DEBUG
-        DECLARE_MAC_BUF(mac);
-#endif
 
         /* need action_code, aux */
         if (len < IEEE80211_MIN_ACTION_SIZE + 3)
@@ -557,10 +540,10 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                 }
         }
 
-        mpl_dbg("Mesh plink (peer, state, llid, plid, event): %s %d %d %d %d\n",
-                        print_mac(mac, mgmt->sa), sta->plink_state,
-                        le16_to_cpu(sta->llid), le16_to_cpu(sta->plid),
-                        event);
+        mpl_dbg("Mesh plink (peer, state, llid, plid, event): %pM %d %d %d %d\n",
+                mgmt->sa, sta->plink_state,
+                le16_to_cpu(sta->llid), le16_to_cpu(sta->plid),
+                event);
         reason = 0;
         switch (sta->plink_state) {
                 /* spin_unlock as soon as state is updated at each case */
@@ -660,8 +643,8 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                         sta->plink_state = PLINK_ESTAB;
                         mesh_plink_inc_estab_count(sdata);
                         spin_unlock_bh(&sta->lock);
-                        mpl_dbg("Mesh plink with %s ESTABLISHED\n",
-                                        print_mac(mac, sta->sta.addr));
+                        mpl_dbg("Mesh plink with %pM ESTABLISHED\n",
+                                sta->sta.addr);
                         break;
                 default:
                         spin_unlock_bh(&sta->lock);
@@ -693,8 +676,8 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                         sta->plink_state = PLINK_ESTAB;
                         mesh_plink_inc_estab_count(sdata);
                         spin_unlock_bh(&sta->lock);
-                        mpl_dbg("Mesh plink with %s ESTABLISHED\n",
-                                        print_mac(mac, sta->sta.addr));
+                        mpl_dbg("Mesh plink with %pM ESTABLISHED\n",
+                                sta->sta.addr);
                         mesh_plink_frame_tx(sdata, PLINK_CONFIRM, sta->sta.addr, llid,
                                             plid, 0);
                         break;
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 409bb7716236..5ba721b6a399 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -14,7 +14,6 @@
 #include <linux/delay.h>
 #include <linux/if_ether.h>
 #include <linux/skbuff.h>
-#include <linux/netdevice.h>
 #include <linux/if_arp.h>
 #include <linux/wireless.h>
 #include <linux/random.h>
@@ -236,7 +235,7 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_local *local = sdata->local;
         struct sk_buff *skb;
         struct ieee80211_mgmt *mgmt;
-        u8 *pos, *ies, *ht_add_ie;
+        u8 *pos, *ies, *ht_ie;
         int i, len, count, rates_len, supp_rates_len;
         u16 capab;
         struct ieee80211_bss *bss;
@@ -310,7 +309,7 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata,
                 mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
                                                   IEEE80211_STYPE_ASSOC_REQ);
                 mgmt->u.assoc_req.capab_info = cpu_to_le16(capab);
-                mgmt->u.reassoc_req.listen_interval =
+                mgmt->u.assoc_req.listen_interval =
                                 cpu_to_le16(local->hw.conf.listen_interval);
         }
 
@@ -393,24 +392,25 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata,
 
         /* wmm support is a must to HT */
         if (wmm && (ifsta->flags & IEEE80211_STA_WMM_ENABLED) &&
-            sband->ht_info.ht_supported &&
-            (ht_add_ie = ieee80211_bss_get_ie(bss, WLAN_EID_HT_EXTRA_INFO))) {
-                struct ieee80211_ht_addt_info *ht_add_info =
-                        (struct ieee80211_ht_addt_info *)ht_add_ie;
-                u16 cap = sband->ht_info.cap;
+            sband->ht_cap.ht_supported &&
+            (ht_ie = ieee80211_bss_get_ie(bss, WLAN_EID_HT_INFORMATION)) &&
+            ht_ie[1] >= sizeof(struct ieee80211_ht_info)) {
+                struct ieee80211_ht_info *ht_info =
+                        (struct ieee80211_ht_info *)(ht_ie + 2);
+                u16 cap = sband->ht_cap.cap;
                 __le16 tmp;
                 u32 flags = local->hw.conf.channel->flags;
 
-                switch (ht_add_info->ht_param & IEEE80211_HT_IE_CHA_SEC_OFFSET) {
-                case IEEE80211_HT_IE_CHA_SEC_ABOVE:
+                switch (ht_info->ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
+                case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
                         if (flags & IEEE80211_CHAN_NO_FAT_ABOVE) {
-                                cap &= ~IEEE80211_HT_CAP_SUP_WIDTH;
+                                cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
                                 cap &= ~IEEE80211_HT_CAP_SGI_40;
                         }
                         break;
-                case IEEE80211_HT_IE_CHA_SEC_BELOW:
+                case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
                         if (flags & IEEE80211_CHAN_NO_FAT_BELOW) {
-                                cap &= ~IEEE80211_HT_CAP_SUP_WIDTH;
+                                cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
                                 cap &= ~IEEE80211_HT_CAP_SGI_40;
                         }
                         break;
@@ -424,9 +424,9 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata,
                 memcpy(pos, &tmp, sizeof(u16));
                 pos += sizeof(u16);
                 /* TODO: needs a define here for << 2 */
-                *pos++ = sband->ht_info.ampdu_factor |
-                         (sband->ht_info.ampdu_density << 2);
-                memcpy(pos, sband->ht_info.supp_mcs_set, 16);
+                *pos++ = sband->ht_cap.ampdu_factor |
+                         (sband->ht_cap.ampdu_density << 2);
+                memcpy(pos, &sband->ht_cap.mcs, sizeof(sband->ht_cap.mcs));
         }
 
         kfree(ifsta->assocreq_ies);
@@ -568,25 +568,35 @@ static void ieee80211_sta_wmm_params(struct ieee80211_local *local,
         }
 }
 
-static u32 ieee80211_handle_protect_preamb(struct ieee80211_sub_if_data *sdata,
-                                           bool use_protection,
-                                           bool use_short_preamble)
+static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,
+                                           u16 capab, bool erp_valid, u8 erp)
 {
-        struct ieee80211_bss_conf *bss_conf = &sdata->bss_conf;
+        struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
-        DECLARE_MAC_BUF(mac);
 #endif
         u32 changed = 0;
+        bool use_protection;
+        bool use_short_preamble;
+        bool use_short_slot;
+
+        if (erp_valid) {
+                use_protection = (erp & WLAN_ERP_USE_PROTECTION) != 0;
+                use_short_preamble = (erp & WLAN_ERP_BARKER_PREAMBLE) == 0;
+        } else {
+                use_protection = false;
+                use_short_preamble = !!(capab & WLAN_CAPABILITY_SHORT_PREAMBLE);
+        }
+
+        use_short_slot = !!(capab & WLAN_CAPABILITY_SHORT_SLOT_TIME);
 
         if (use_protection != bss_conf->use_cts_prot) {
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
                 if (net_ratelimit()) {
-                        printk(KERN_DEBUG "%s: CTS protection %s (BSSID="
-                               "%s)\n",
+                        printk(KERN_DEBUG "%s: CTS protection %s (BSSID=%pM)\n",
                                sdata->dev->name,
                                use_protection ? "enabled" : "disabled",
-                               print_mac(mac, ifsta->bssid));
+                               ifsta->bssid);
                 }
 #endif
                 bss_conf->use_cts_prot = use_protection;
@@ -597,40 +607,28 @@ static u32 ieee80211_handle_protect_preamb(struct ieee80211_sub_if_data *sdata,
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
                 if (net_ratelimit()) {
                         printk(KERN_DEBUG "%s: switched to %s barker preamble"
-                               " (BSSID=%s)\n",
+                               " (BSSID=%pM)\n",
                                sdata->dev->name,
                                use_short_preamble ? "short" : "long",
-                               print_mac(mac, ifsta->bssid));
+                               ifsta->bssid);
                 }
 #endif
                 bss_conf->use_short_preamble = use_short_preamble;
                 changed |= BSS_CHANGED_ERP_PREAMBLE;
         }
 
-        return changed;
-}
-
-static u32 ieee80211_handle_erp_ie(struct ieee80211_sub_if_data *sdata,
-                                   u8 erp_value)
-{
-        bool use_protection = (erp_value & WLAN_ERP_USE_PROTECTION) != 0;
-        bool use_short_preamble = (erp_value & WLAN_ERP_BARKER_PREAMBLE) == 0;
-
-        return ieee80211_handle_protect_preamb(sdata,
-                        use_protection, use_short_preamble);
-}
-
-static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,
-                                           struct ieee80211_bss *bss)
-{
-        u32 changed = 0;
-
-        if (bss->has_erp_value)
-                changed |= ieee80211_handle_erp_ie(sdata, bss->erp_value);
-        else {
-                u16 capab = bss->capability;
-                changed |= ieee80211_handle_protect_preamb(sdata, false,
-                                (capab & WLAN_CAPABILITY_SHORT_PREAMBLE) != 0);
+        if (use_short_slot != bss_conf->use_short_slot) {
+#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
+                if (net_ratelimit()) {
+                        printk(KERN_DEBUG "%s: switched to %s slot"
+                               " (BSSID=%s)\n",
+                               sdata->dev->name,
+                               use_short_slot ? "short" : "long",
+                               ifsta->bssid);
+                }
+#endif
+                bss_conf->use_short_slot = use_short_slot;
+                changed |= BSS_CHANGED_ERP_SLOT;
         }
 
         return changed;
@@ -701,14 +699,15 @@ static void ieee80211_sta_send_associnfo(struct ieee80211_sub_if_data *sdata,
 
 
 static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
-                                     struct ieee80211_if_sta *ifsta)
+                                     struct ieee80211_if_sta *ifsta,
+                                     u32 bss_info_changed)
 {
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_conf *conf = &local_to_hw(local)->conf;
-        u32 changed = BSS_CHANGED_ASSOC;
 
         struct ieee80211_bss *bss;
 
+        bss_info_changed |= BSS_CHANGED_ASSOC;
         ifsta->flags |= IEEE80211_STA_ASSOCIATED;
 
         if (sdata->vif.type != NL80211_IFTYPE_STATION)
@@ -719,22 +718,16 @@ static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
                                    ifsta->ssid, ifsta->ssid_len);
         if (bss) {
                 /* set timing information */
-                sdata->bss_conf.beacon_int = bss->beacon_int;
-                sdata->bss_conf.timestamp = bss->timestamp;
-                sdata->bss_conf.dtim_period = bss->dtim_period;
+                sdata->vif.bss_conf.beacon_int = bss->beacon_int;
+                sdata->vif.bss_conf.timestamp = bss->timestamp;
+                sdata->vif.bss_conf.dtim_period = bss->dtim_period;
 
-                changed |= ieee80211_handle_bss_capability(sdata, bss);
+                bss_info_changed |= ieee80211_handle_bss_capability(sdata,
+                        bss->capability, bss->has_erp_value, bss->erp_value);
 
                 ieee80211_rx_bss_put(local, bss);
         }
 
-        if (conf->flags & IEEE80211_CONF_SUPPORT_HT_MODE) {
-                changed |= BSS_CHANGED_HT;
-                sdata->bss_conf.assoc_ht = 1;
-                sdata->bss_conf.ht_conf = &conf->ht_conf;
-                sdata->bss_conf.ht_bss_conf = &conf->ht_bss_conf;
-        }
-
         ifsta->flags |= IEEE80211_STA_PREV_BSSID_SET;
         memcpy(ifsta->prev_bssid, sdata->u.sta.bssid, ETH_ALEN);
         ieee80211_sta_send_associnfo(sdata, ifsta);
@@ -742,14 +735,25 @@ static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
         ifsta->last_probe = jiffies;
         ieee80211_led_assoc(local, 1);
 
-        sdata->bss_conf.assoc = 1;
+        sdata->vif.bss_conf.assoc = 1;
         /*
          * For now just always ask the driver to update the basic rateset
          * when we have associated, we aren't checking whether it actually
          * changed or not.
          */
-        changed |= BSS_CHANGED_BASIC_RATES;
-        ieee80211_bss_info_change_notify(sdata, changed);
+        bss_info_changed |= BSS_CHANGED_BASIC_RATES;
+        ieee80211_bss_info_change_notify(sdata, bss_info_changed);
+
+        if (local->powersave) {
+                if (local->dynamic_ps_timeout > 0)
+                        mod_timer(&local->dynamic_ps_timer, jiffies +
+                                  msecs_to_jiffies(local->dynamic_ps_timeout));
+                else {
+                        conf->flags |= IEEE80211_CONF_PS;
+                        ieee80211_hw_config(local,
+                                            IEEE80211_CONF_CHANGE_PS);
+                }
+        }
 
         netif_tx_start_all_queues(sdata->dev);
         netif_carrier_on(sdata->dev);
@@ -760,18 +764,17 @@ static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
 static void ieee80211_direct_probe(struct ieee80211_sub_if_data *sdata,
                                    struct ieee80211_if_sta *ifsta)
 {
-        DECLARE_MAC_BUF(mac);
-
         ifsta->direct_probe_tries++;
         if (ifsta->direct_probe_tries > IEEE80211_AUTH_MAX_TRIES) {
-                printk(KERN_DEBUG "%s: direct probe to AP %s timed out\n",
-                       sdata->dev->name, print_mac(mac, ifsta->bssid));
+                printk(KERN_DEBUG "%s: direct probe to AP %pM timed out\n",
+                       sdata->dev->name, ifsta->bssid);
                 ifsta->state = IEEE80211_STA_MLME_DISABLED;
+                ieee80211_sta_send_apinfo(sdata, ifsta);
                 return;
         }
 
-        printk(KERN_DEBUG "%s: direct probe to AP %s try %d\n",
-                        sdata->dev->name, print_mac(mac, ifsta->bssid),
+        printk(KERN_DEBUG "%s: direct probe to AP %pM try %d\n",
+                        sdata->dev->name, ifsta->bssid,
                         ifsta->direct_probe_tries);
 
         ifsta->state = IEEE80211_STA_MLME_DIRECT_PROBE;
@@ -791,33 +794,36 @@ static void ieee80211_direct_probe(struct ieee80211_sub_if_data *sdata,
 static void ieee80211_authenticate(struct ieee80211_sub_if_data *sdata,
                                    struct ieee80211_if_sta *ifsta)
 {
-        DECLARE_MAC_BUF(mac);
-
         ifsta->auth_tries++;
         if (ifsta->auth_tries > IEEE80211_AUTH_MAX_TRIES) {
-                printk(KERN_DEBUG "%s: authentication with AP %s"
+                printk(KERN_DEBUG "%s: authentication with AP %pM"
                        " timed out\n",
-                       sdata->dev->name, print_mac(mac, ifsta->bssid));
+                       sdata->dev->name, ifsta->bssid);
                 ifsta->state = IEEE80211_STA_MLME_DISABLED;
+                ieee80211_sta_send_apinfo(sdata, ifsta);
                 return;
         }
 
         ifsta->state = IEEE80211_STA_MLME_AUTHENTICATE;
-        printk(KERN_DEBUG "%s: authenticate with AP %s\n",
-               sdata->dev->name, print_mac(mac, ifsta->bssid));
+        printk(KERN_DEBUG "%s: authenticate with AP %pM\n",
+               sdata->dev->name, ifsta->bssid);
 
         ieee80211_send_auth(sdata, ifsta, 1, NULL, 0, 0);
 
         mod_timer(&ifsta->timer, jiffies + IEEE80211_AUTH_TIMEOUT);
 }
 
+/*
+ * The disassoc 'reason' argument can be either our own reason
+ * if self disconnected or a reason code from the AP.
+ */
 static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
                                    struct ieee80211_if_sta *ifsta, bool deauth,
                                    bool self_disconnected, u16 reason)
 {
         struct ieee80211_local *local = sdata->local;
         struct sta_info *sta;
-        u32 changed = BSS_CHANGED_ASSOC;
+        u32 changed = 0, config_changed = 0;
 
         rcu_read_lock();
 
@@ -851,21 +857,40 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
         ifsta->flags &= ~IEEE80211_STA_ASSOCIATED;
         changed |= ieee80211_reset_erp_info(sdata);
 
-        if (sdata->bss_conf.assoc_ht)
-                changed |= BSS_CHANGED_HT;
-
-        sdata->bss_conf.assoc_ht = 0;
-        sdata->bss_conf.ht_conf = NULL;
-        sdata->bss_conf.ht_bss_conf = NULL;
-
         ieee80211_led_assoc(local, 0);
-        sdata->bss_conf.assoc = 0;
+        changed |= BSS_CHANGED_ASSOC;
+        sdata->vif.bss_conf.assoc = false;
 
         ieee80211_sta_send_apinfo(sdata, ifsta);
 
-        if (self_disconnected)
+        if (self_disconnected || reason == WLAN_REASON_DISASSOC_STA_HAS_LEFT)
                 ifsta->state = IEEE80211_STA_MLME_DISABLED;
 
+        rcu_read_unlock();
+
+        local->hw.conf.ht.enabled = false;
+        local->oper_channel_type = NL80211_CHAN_NO_HT;
+        config_changed |= IEEE80211_CONF_CHANGE_HT;
+
+        del_timer_sync(&local->dynamic_ps_timer);
+        cancel_work_sync(&local->dynamic_ps_enable_work);
+
+        if (local->hw.conf.flags & IEEE80211_CONF_PS) {
+                local->hw.conf.flags &= ~IEEE80211_CONF_PS;
+                config_changed |= IEEE80211_CONF_CHANGE_PS;
+        }
+
+        ieee80211_hw_config(local, config_changed);
+        ieee80211_bss_info_change_notify(sdata, changed);
+
+        rcu_read_lock();
+
+        sta = sta_info_get(local, ifsta->bssid);
+        if (!sta) {
+                rcu_read_unlock();
+                return;
+        }
+
         sta_info_unlink(&sta);
 
         rcu_read_unlock();
@@ -914,20 +939,19 @@ static int ieee80211_privacy_mismatch(struct ieee80211_sub_if_data *sdata,
 static void ieee80211_associate(struct ieee80211_sub_if_data *sdata,
                                 struct ieee80211_if_sta *ifsta)
 {
-        DECLARE_MAC_BUF(mac);
-
         ifsta->assoc_tries++;
         if (ifsta->assoc_tries > IEEE80211_ASSOC_MAX_TRIES) {
-                printk(KERN_DEBUG "%s: association with AP %s"
+                printk(KERN_DEBUG "%s: association with AP %pM"
                        " timed out\n",
-                       sdata->dev->name, print_mac(mac, ifsta->bssid));
+                       sdata->dev->name, ifsta->bssid);
                 ifsta->state = IEEE80211_STA_MLME_DISABLED;
+                ieee80211_sta_send_apinfo(sdata, ifsta);
                 return;
         }
 
         ifsta->state = IEEE80211_STA_MLME_ASSOCIATE;
-        printk(KERN_DEBUG "%s: associate with AP %s\n",
-               sdata->dev->name, print_mac(mac, ifsta->bssid));
+        printk(KERN_DEBUG "%s: associate with AP %pM\n",
+               sdata->dev->name, ifsta->bssid);
         if (ieee80211_privacy_mismatch(sdata, ifsta)) {
                 printk(KERN_DEBUG "%s: mismatch in privacy configuration and "
                        "mixed-cell disabled - abort association\n", sdata->dev->name);
@@ -947,7 +971,6 @@ static void ieee80211_associated(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_local *local = sdata->local;
         struct sta_info *sta;
         int disassoc;
-        DECLARE_MAC_BUF(mac);
 
         /* TODO: start monitoring current AP signal quality and number of
          * missed beacons. Scan other channels every now and then and search
@@ -960,8 +983,8 @@ static void ieee80211_associated(struct ieee80211_sub_if_data *sdata,
 
         sta = sta_info_get(local, ifsta->bssid);
         if (!sta) {
-                printk(KERN_DEBUG "%s: No STA entry for own AP %s\n",
-                       sdata->dev->name, print_mac(mac, ifsta->bssid));
+                printk(KERN_DEBUG "%s: No STA entry for own AP %pM\n",
+                       sdata->dev->name, ifsta->bssid);
                 disassoc = 1;
         } else {
                 disassoc = 0;
@@ -969,9 +992,9 @@ static void ieee80211_associated(struct ieee80211_sub_if_data *sdata,
                                sta->last_rx + IEEE80211_MONITORING_INTERVAL)) {
                         if (ifsta->flags & IEEE80211_STA_PROBEREQ_POLL) {
                                 printk(KERN_DEBUG "%s: No ProbeResp from "
-                                       "current AP %s - assume out of "
+                                       "current AP %pM - assume out of "
                                        "range\n",
-                                       sdata->dev->name, print_mac(mac, ifsta->bssid));
+                                       sdata->dev->name, ifsta->bssid);
                                 disassoc = 1;
                         } else
                                 ieee80211_send_probe_req(sdata, ifsta->bssid,
@@ -1032,7 +1055,6 @@ static void ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
                                    size_t len)
 {
         u16 auth_alg, auth_transaction, status_code;
-        DECLARE_MAC_BUF(mac);
 
         if (ifsta->state != IEEE80211_STA_MLME_AUTHENTICATE &&
             sdata->vif.type != NL80211_IFTYPE_ADHOC)
@@ -1125,7 +1147,6 @@ static void ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata,
                                      size_t len)
 {
         u16 reason_code;
-        DECLARE_MAC_BUF(mac);
 
         if (len < 24 + 2)
                 return;
@@ -1136,7 +1157,8 @@ static void ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata,
         reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
 
         if (ifsta->flags & IEEE80211_STA_AUTHENTICATED)
-                printk(KERN_DEBUG "%s: deauthenticated\n", sdata->dev->name);
+                printk(KERN_DEBUG "%s: deauthenticated (Reason: %u)\n",
+                                sdata->dev->name, reason_code);
 
         if (ifsta->state == IEEE80211_STA_MLME_AUTHENTICATE ||
             ifsta->state == IEEE80211_STA_MLME_ASSOCIATE ||
@@ -1157,7 +1179,6 @@ static void ieee80211_rx_mgmt_disassoc(struct ieee80211_sub_if_data *sdata,
                                        size_t len)
 {
         u16 reason_code;
-        DECLARE_MAC_BUF(mac);
 
         if (len < 24 + 2)
                 return;
@@ -1168,7 +1189,8 @@ static void ieee80211_rx_mgmt_disassoc(struct ieee80211_sub_if_data *sdata,
         reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);
 
         if (ifsta->flags & IEEE80211_STA_ASSOCIATED)
-                printk(KERN_DEBUG "%s: disassociated\n", sdata->dev->name);
+                printk(KERN_DEBUG "%s: disassociated (Reason: %u)\n",
+                                sdata->dev->name, reason_code);
 
         if (ifsta->state == IEEE80211_STA_MLME_ASSOCIATED) {
                 ifsta->state = IEEE80211_STA_MLME_ASSOCIATE;
@@ -1176,7 +1198,7 @@ static void ieee80211_rx_mgmt_disassoc(struct ieee80211_sub_if_data *sdata,
                                       IEEE80211_RETRY_AUTH_INTERVAL);
         }
 
-        ieee80211_set_disassoc(sdata, ifsta, false, false, 0);
+        ieee80211_set_disassoc(sdata, ifsta, false, false, reason_code);
 }
 
 
@@ -1192,11 +1214,12 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
         u64 rates, basic_rates;
         u16 capab_info, status_code, aid;
         struct ieee802_11_elems elems;
-        struct ieee80211_bss_conf *bss_conf = &sdata->bss_conf;
+        struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
         u8 *pos;
+        u32 changed = 0;
         int i, j;
-        DECLARE_MAC_BUF(mac);
-        bool have_higher_than_11mbit = false;
+        bool have_higher_than_11mbit = false, newsta = false;
+        u16 ap_ht_cap_flags;
 
         /* AssocResp and ReassocResp have identical structure, so process both
          * of them in this function. */
@@ -1214,9 +1237,9 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
         status_code = le16_to_cpu(mgmt->u.assoc_resp.status_code);
         aid = le16_to_cpu(mgmt->u.assoc_resp.aid);
 
-        printk(KERN_DEBUG "%s: RX %sssocResp from %s (capab=0x%x "
+        printk(KERN_DEBUG "%s: RX %sssocResp from %pM (capab=0x%x "
                "status=%d aid=%d)\n",
-               sdata->dev->name, reassoc ? "Rea" : "A", print_mac(mac, mgmt->sa),
+               sdata->dev->name, reassoc ? "Rea" : "A", mgmt->sa,
                capab_info, status_code, (u16)(aid & ~(BIT(15) | BIT(14))));
 
         if (status_code != WLAN_STATUS_SUCCESS) {
@@ -1259,7 +1282,8 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
         sta = sta_info_get(local, ifsta->bssid);
         if (!sta) {
                 struct ieee80211_bss *bss;
-                int err;
+
+                newsta = true;
 
                 sta = sta_info_alloc(sdata, ifsta->bssid, GFP_ATOMIC);
                 if (!sta) {
@@ -1278,13 +1302,6 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
                         ieee80211_rx_bss_put(local, bss);
                 }
 
-                err = sta_info_insert(sta);
-                if (err) {
-                        printk(KERN_DEBUG "%s: failed to insert STA entry for"
-                               " the AP (error %d)\n", sdata->dev->name, err);
-                        rcu_read_unlock();
-                        return;
-                }
                 /* update new sta with its last rx activity */
                 sta->last_rx = jiffies;
         }
@@ -1308,34 +1325,40 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
 
         for (i = 0; i < elems.supp_rates_len; i++) {
                 int rate = (elems.supp_rates[i] & 0x7f) * 5;
+                bool is_basic = !!(elems.supp_rates[i] & 0x80);
 
                 if (rate > 110)
                         have_higher_than_11mbit = true;
 
                 for (j = 0; j < sband->n_bitrates; j++) {
-                        if (sband->bitrates[j].bitrate == rate)
+                        if (sband->bitrates[j].bitrate == rate) {
                                 rates |= BIT(j);
-                        if (elems.supp_rates[i] & 0x80)
-                                basic_rates |= BIT(j);
+                                if (is_basic)
+                                        basic_rates |= BIT(j);
+                                break;
+                        }
                 }
         }
 
         for (i = 0; i < elems.ext_supp_rates_len; i++) {
                 int rate = (elems.ext_supp_rates[i] & 0x7f) * 5;
+                bool is_basic = !!(elems.supp_rates[i] & 0x80);
 
                 if (rate > 110)
                         have_higher_than_11mbit = true;
 
                 for (j = 0; j < sband->n_bitrates; j++) {
-                        if (sband->bitrates[j].bitrate == rate)
+                        if (sband->bitrates[j].bitrate == rate) {
                                 rates |= BIT(j);
-                        if (elems.ext_supp_rates[i] & 0x80)
-                                basic_rates |= BIT(j);
+                                if (is_basic)
+                                        basic_rates |= BIT(j);
+                                break;
+                        }
                 }
         }
 
         sta->sta.supp_rates[local->hw.conf.channel->band] = rates;
-        sdata->bss_conf.basic_rates = basic_rates;
+        sdata->vif.bss_conf.basic_rates = basic_rates;
 
         /* cf. IEEE 802.11 9.2.12 */
         if (local->hw.conf.channel->band == IEEE80211_BAND_2GHZ &&
@@ -1344,31 +1367,43 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
         else
                 sdata->flags &= ~IEEE80211_SDATA_OPERATING_GMODE;
 
-        if (elems.ht_cap_elem && elems.ht_info_elem && elems.wmm_param &&
-            (ifsta->flags & IEEE80211_STA_WMM_ENABLED)) {
-                struct ieee80211_ht_bss_info bss_info;
-                ieee80211_ht_cap_ie_to_ht_info(
-                                elems.ht_cap_elem, &sta->sta.ht_info);
-                ieee80211_ht_addt_info_ie_to_ht_bss_info(
-                                elems.ht_info_elem, &bss_info);
-                ieee80211_handle_ht(local, 1, &sta->sta.ht_info, &bss_info);
-        }
+        if (elems.ht_cap_elem)
+                ieee80211_ht_cap_ie_to_sta_ht_cap(sband,
+                                elems.ht_cap_elem, &sta->sta.ht_cap);
+
+        ap_ht_cap_flags = sta->sta.ht_cap.cap;
 
         rate_control_rate_init(sta);
 
-        if (elems.wmm_param) {
+        if (elems.wmm_param)
                 set_sta_flags(sta, WLAN_STA_WME);
-                rcu_read_unlock();
+
+        if (newsta) {
+                int err = sta_info_insert(sta);
+                if (err) {
+                        printk(KERN_DEBUG "%s: failed to insert STA entry for"
+                               " the AP (error %d)\n", sdata->dev->name, err);
+                        rcu_read_unlock();
+                        return;
+                }
+        }
+
+        rcu_read_unlock();
+
+        if (elems.wmm_param)
                 ieee80211_sta_wmm_params(local, ifsta, elems.wmm_param,
                                          elems.wmm_param_len);
-        } else
-                rcu_read_unlock();
+
+        if (elems.ht_info_elem && elems.wmm_param &&
+            (ifsta->flags & IEEE80211_STA_WMM_ENABLED))
+                changed |= ieee80211_enable_ht(sdata, elems.ht_info_elem,
+                                               ap_ht_cap_flags);
 
         /* set AID and assoc capability,
          * ieee80211_set_associated() will tell the driver */
         bss_conf->aid = aid;
         bss_conf->assoc_capability = capab_info;
-        ieee80211_set_associated(sdata, ifsta);
+        ieee80211_set_associated(sdata, ifsta, changed);
 
         ieee80211_associated(sdata, ifsta);
 }
@@ -1386,6 +1421,13 @@ static int ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_supported_band *sband;
         union iwreq_data wrqu;
 
+        skb = dev_alloc_skb(local->hw.extra_tx_headroom + 400);
+        if (!skb) {
+                printk(KERN_DEBUG "%s: failed to allocate buffer for probe "
+                       "response\n", sdata->dev->name);
+                return -ENOMEM;
+        }
+
         sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
 
         /* Remove possible STA entries from other IBSS networks. */
@@ -1411,63 +1453,62 @@ static int ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
                 return res;
 
         /* Build IBSS probe response */
-        skb = dev_alloc_skb(local->hw.extra_tx_headroom + 400);
-        if (skb) {
-                skb_reserve(skb, local->hw.extra_tx_headroom);
 
-                mgmt = (struct ieee80211_mgmt *)
-                        skb_put(skb, 24 + sizeof(mgmt->u.beacon));
-                memset(mgmt, 0, 24 + sizeof(mgmt->u.beacon));
-                mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
-                                                  IEEE80211_STYPE_PROBE_RESP);
-                memset(mgmt->da, 0xff, ETH_ALEN);
-                memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
-                memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
-                mgmt->u.beacon.beacon_int =
-                        cpu_to_le16(local->hw.conf.beacon_int);
-                mgmt->u.beacon.timestamp = cpu_to_le64(bss->timestamp);
-                mgmt->u.beacon.capab_info = cpu_to_le16(bss->capability);
-
-                pos = skb_put(skb, 2 + ifsta->ssid_len);
-                *pos++ = WLAN_EID_SSID;
-                *pos++ = ifsta->ssid_len;
-                memcpy(pos, ifsta->ssid, ifsta->ssid_len);
-
-                rates = bss->supp_rates_len;
-                if (rates > 8)
-                        rates = 8;
-                pos = skb_put(skb, 2 + rates);
-                *pos++ = WLAN_EID_SUPP_RATES;
-                *pos++ = rates;
-                memcpy(pos, bss->supp_rates, rates);
+        skb_reserve(skb, local->hw.extra_tx_headroom);
 
-                if (bss->band == IEEE80211_BAND_2GHZ) {
-                        pos = skb_put(skb, 2 + 1);
-                        *pos++ = WLAN_EID_DS_PARAMS;
-                        *pos++ = 1;
-                        *pos++ = ieee80211_frequency_to_channel(bss->freq);
-                }
+        mgmt = (struct ieee80211_mgmt *)
+                skb_put(skb, 24 + sizeof(mgmt->u.beacon));
+        memset(mgmt, 0, 24 + sizeof(mgmt->u.beacon));
+        mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
+                                                IEEE80211_STYPE_PROBE_RESP);
+        memset(mgmt->da, 0xff, ETH_ALEN);
+        memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
+        memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
+        mgmt->u.beacon.beacon_int =
+                cpu_to_le16(local->hw.conf.beacon_int);
+        mgmt->u.beacon.timestamp = cpu_to_le64(bss->timestamp);
+        mgmt->u.beacon.capab_info = cpu_to_le16(bss->capability);
 
-                pos = skb_put(skb, 2 + 2);
-                *pos++ = WLAN_EID_IBSS_PARAMS;
-                *pos++ = 2;
-                /* FIX: set ATIM window based on scan results */
-                *pos++ = 0;
-                *pos++ = 0;
+        pos = skb_put(skb, 2 + ifsta->ssid_len);
+        *pos++ = WLAN_EID_SSID;
+        *pos++ = ifsta->ssid_len;
+        memcpy(pos, ifsta->ssid, ifsta->ssid_len);
 
-                if (bss->supp_rates_len > 8) {
-                        rates = bss->supp_rates_len - 8;
-                        pos = skb_put(skb, 2 + rates);
-                        *pos++ = WLAN_EID_EXT_SUPP_RATES;
-                        *pos++ = rates;
-                        memcpy(pos, &bss->supp_rates[8], rates);
-                }
+        rates = bss->supp_rates_len;
+        if (rates > 8)
+                rates = 8;
+        pos = skb_put(skb, 2 + rates);
+        *pos++ = WLAN_EID_SUPP_RATES;
+        *pos++ = rates;
+        memcpy(pos, bss->supp_rates, rates);
 
-                ifsta->probe_resp = skb;
+        if (bss->band == IEEE80211_BAND_2GHZ) {
+                pos = skb_put(skb, 2 + 1);
+                *pos++ = WLAN_EID_DS_PARAMS;
+                *pos++ = 1;
+                *pos++ = ieee80211_frequency_to_channel(bss->freq);
+        }
+
+        pos = skb_put(skb, 2 + 2);
+        *pos++ = WLAN_EID_IBSS_PARAMS;
+        *pos++ = 2;
+        /* FIX: set ATIM window based on scan results */
+        *pos++ = 0;
+        *pos++ = 0;
 
-                ieee80211_if_config(sdata, IEEE80211_IFCC_BEACON);
+        if (bss->supp_rates_len > 8) {
+                rates = bss->supp_rates_len - 8;
+                pos = skb_put(skb, 2 + rates);
+                *pos++ = WLAN_EID_EXT_SUPP_RATES;
+                *pos++ = rates;
+                memcpy(pos, &bss->supp_rates[8], rates);
         }
 
+        ifsta->probe_resp = skb;
+
+        ieee80211_if_config(sdata, IEEE80211_IFCC_BEACON);
+
+
         rates = 0;
         sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
         for (i = 0; i < bss->supp_rates_len; i++) {
@@ -1507,8 +1548,6 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
         u64 beacon_timestamp, rx_timestamp;
         u64 supp_rates = 0;
         enum ieee80211_band band = rx_status->band;
-        DECLARE_MAC_BUF(mac);
-        DECLARE_MAC_BUF(mac2);
 
         if (elems->ds_params && elems->ds_params_len == 1)
                 freq = ieee80211_channel_to_frequency(elems->ds_params[0]);
@@ -1538,17 +1577,16 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
 #ifdef CONFIG_MAC80211_IBSS_DEBUG
                         if (sta->sta.supp_rates[band] != prev_rates)
                                 printk(KERN_DEBUG "%s: updated supp_rates set "
-                                    "for %s based on beacon info (0x%llx | "
+                                    "for %pM based on beacon info (0x%llx | "
                                     "0x%llx -> 0x%llx)\n",
                                     sdata->dev->name,
-                                    print_mac(mac, sta->sta.addr),
+                                    sta->sta.addr,
                                     (unsigned long long) prev_rates,
                                     (unsigned long long) supp_rates,
                                     (unsigned long long) sta->sta.supp_rates[band]);
 #endif
                 } else {
-                        ieee80211_ibss_add_sta(sdata, NULL, mgmt->bssid,
-                                               mgmt->sa, supp_rates);
+                        ieee80211_ibss_add_sta(sdata, mgmt->bssid, mgmt->sa, supp_rates);
                 }
 
                 rcu_read_unlock();
@@ -1595,8 +1633,13 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
                          * e.g: at 1 MBit that means mactime is 192 usec earlier
                          * (=24 bytes * 8 usecs/byte) than the beacon timestamp.
                          */
-                        int rate = local->hw.wiphy->bands[band]->
+                        int rate;
+                        if (rx_status->flag & RX_FLAG_HT) {
+                                rate = 65; /* TODO: HT rates */
+                        } else {
+                                rate = local->hw.wiphy->bands[band]->
                                         bitrates[rx_status->rate_idx].bitrate;
+                        }
                         rx_timestamp = rx_status->mactime + (24 * 8 * 10 / rate);
                 } else if (local && local->ops && local->ops->get_tsf)
                         /* second best option: get current TSF */
@@ -1605,10 +1648,9 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
                         /* can't merge without knowing the TSF */
                         rx_timestamp = -1LLU;
 #ifdef CONFIG_MAC80211_IBSS_DEBUG
-                printk(KERN_DEBUG "RX beacon SA=%s BSSID="
-                       "%s TSF=0x%llx BCN=0x%llx diff=%lld @%lu\n",
-                       print_mac(mac, mgmt->sa),
-                       print_mac(mac2, mgmt->bssid),
+                printk(KERN_DEBUG "RX beacon SA=%pM BSSID="
+                       "%pM TSF=0x%llx BCN=0x%llx diff=%lld @%lu\n",
+                       mgmt->sa, mgmt->bssid,
                        (unsigned long long)rx_timestamp,
                        (unsigned long long)beacon_timestamp,
                        (unsigned long long)(rx_timestamp - beacon_timestamp),
@@ -1617,13 +1659,11 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
                 if (beacon_timestamp > rx_timestamp) {
 #ifdef CONFIG_MAC80211_IBSS_DEBUG
                         printk(KERN_DEBUG "%s: beacon TSF higher than "
-                               "local TSF - IBSS merge with BSSID %s\n",
-                               sdata->dev->name, print_mac(mac, mgmt->bssid));
+                               "local TSF - IBSS merge with BSSID %pM\n",
+                               sdata->dev->name, mgmt->bssid);
 #endif
                         ieee80211_sta_join_ibss(sdata, &sdata->u.sta, bss);
-                        ieee80211_ibss_add_sta(sdata, NULL,
-                                               mgmt->bssid, mgmt->sa,
-                                               supp_rates);
+                        ieee80211_ibss_add_sta(sdata, mgmt->bssid, mgmt->sa, supp_rates);
                 }
         }
 
@@ -1671,8 +1711,9 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
         size_t baselen;
         struct ieee802_11_elems elems;
         struct ieee80211_local *local = sdata->local;
-        struct ieee80211_conf *conf = &local->hw.conf;
         u32 changed = 0;
+        bool erp_valid;
+        u8 erp_value = 0;
 
         /* Process beacon from the current BSS */
         baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
@@ -1694,22 +1735,49 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
         ieee80211_sta_wmm_params(local, ifsta, elems.wmm_param,
                                  elems.wmm_param_len);
 
-        if (elems.erp_info && elems.erp_info_len >= 1)
-                changed |= ieee80211_handle_erp_ie(sdata, elems.erp_info[0]);
-        else {
-                u16 capab = le16_to_cpu(mgmt->u.beacon.capab_info);
-                changed |= ieee80211_handle_protect_preamb(sdata, false,
-                                (capab & WLAN_CAPABILITY_SHORT_PREAMBLE) != 0);
+
+        if (elems.erp_info && elems.erp_info_len >= 1) {
+                erp_valid = true;
+                erp_value = elems.erp_info[0];
+        } else {
+                erp_valid = false;
         }
+        changed |= ieee80211_handle_bss_capability(sdata,
+                        le16_to_cpu(mgmt->u.beacon.capab_info),
+                        erp_valid, erp_value);
+
+
+        if (elems.ht_cap_elem && elems.ht_info_elem && elems.wmm_param) {
+                struct sta_info *sta;
+                struct ieee80211_supported_band *sband;
+                u16 ap_ht_cap_flags;
+
+                rcu_read_lock();
 
-        if (elems.ht_cap_elem && elems.ht_info_elem &&
-            elems.wmm_param && conf->flags & IEEE80211_CONF_SUPPORT_HT_MODE) {
-                struct ieee80211_ht_bss_info bss_info;
+                sta = sta_info_get(local, ifsta->bssid);
+                if (!sta) {
+                        rcu_read_unlock();
+                        return;
+                }
+
+                sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
 
-                ieee80211_ht_addt_info_ie_to_ht_bss_info(
-                                elems.ht_info_elem, &bss_info);
-                changed |= ieee80211_handle_ht(local, 1, &conf->ht_conf,
-                                               &bss_info);
+                ieee80211_ht_cap_ie_to_sta_ht_cap(sband,
+                                elems.ht_cap_elem, &sta->sta.ht_cap);
+
+                ap_ht_cap_flags = sta->sta.ht_cap.cap;
+
+                rcu_read_unlock();
+
+                changed |= ieee80211_enable_ht(sdata, elems.ht_info_elem,
+                                               ap_ht_cap_flags);
+        }
+
+        if (elems.country_elem) {
+                /* Note we are only reviewing this on beacons
+                 * for the BSSID we are associated to */
+                regulatory_hint_11d(local->hw.wiphy,
+                        elems.country_elem, elems.country_elem_len);
         }
 
         ieee80211_bss_info_change_notify(sdata, changed);
@@ -1727,11 +1795,6 @@ static void ieee80211_rx_mgmt_probe_req(struct ieee80211_sub_if_data *sdata,
         struct sk_buff *skb;
         struct ieee80211_mgmt *resp;
         u8 *pos, *end;
-        DECLARE_MAC_BUF(mac);
-#ifdef CONFIG_MAC80211_IBSS_DEBUG
-        DECLARE_MAC_BUF(mac2);
-        DECLARE_MAC_BUF(mac3);
-#endif
 
         if (sdata->vif.type != NL80211_IFTYPE_ADHOC ||
             ifsta->state != IEEE80211_STA_MLME_IBSS_JOINED ||
@@ -1744,10 +1807,10 @@ static void ieee80211_rx_mgmt_probe_req(struct ieee80211_sub_if_data *sdata,
                 tx_last_beacon = 1;
 
 #ifdef CONFIG_MAC80211_IBSS_DEBUG
-        printk(KERN_DEBUG "%s: RX ProbeReq SA=%s DA=%s BSSID="
-               "%s (tx_last_beacon=%d)\n",
-               sdata->dev->name, print_mac(mac, mgmt->sa), print_mac(mac2, mgmt->da),
-               print_mac(mac3, mgmt->bssid), tx_last_beacon);
+        printk(KERN_DEBUG "%s: RX ProbeReq SA=%pM DA=%pM BSSID=%pM"
+               " (tx_last_beacon=%d)\n",
+               sdata->dev->name, mgmt->sa, mgmt->da,
+               mgmt->bssid, tx_last_beacon);
 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
 
         if (!tx_last_beacon)
@@ -1763,8 +1826,8 @@ static void ieee80211_rx_mgmt_probe_req(struct ieee80211_sub_if_data *sdata,
             pos + 2 + pos[1] > end) {
 #ifdef CONFIG_MAC80211_IBSS_DEBUG
                 printk(KERN_DEBUG "%s: Invalid SSID IE in ProbeReq "
-                       "from %s\n",
-                       sdata->dev->name, print_mac(mac, mgmt->sa));
+                       "from %pM\n",
+                       sdata->dev->name, mgmt->sa);
 #endif
                 return;
         }
@@ -1783,8 +1846,8 @@ static void ieee80211_rx_mgmt_probe_req(struct ieee80211_sub_if_data *sdata,
         resp = (struct ieee80211_mgmt *) skb->data;
         memcpy(resp->da, mgmt->sa, ETH_ALEN);
 #ifdef CONFIG_MAC80211_IBSS_DEBUG
-        printk(KERN_DEBUG "%s: Sending ProbeResp to %s\n",
-               sdata->dev->name, print_mac(mac, resp->da));
+        printk(KERN_DEBUG "%s: Sending ProbeResp to %pM\n",
+               sdata->dev->name, resp->da);
 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
         ieee80211_tx_skb(sdata, skb, 0);
 }
@@ -1972,7 +2035,7 @@ static int ieee80211_sta_match_ssid(struct ieee80211_if_sta *ifsta,
                 }
         }
 
-        if (hidden_ssid && ifsta->ssid_len == ssid_len)
+        if (hidden_ssid && (ifsta->ssid_len == ssid_len || ssid_len == 0))
                 return 1;
 
         if (ssid_len == 1 && ssid[0] == ' ')
@@ -1990,7 +2053,6 @@ static int ieee80211_sta_create_ibss(struct ieee80211_sub_if_data *sdata,
         u8 bssid[ETH_ALEN], *pos;
         int i;
         int ret;
-        DECLARE_MAC_BUF(mac);
 
 #if 0
         /* Easier testing, use fixed BSSID. */
@@ -2006,8 +2068,8 @@ static int ieee80211_sta_create_ibss(struct ieee80211_sub_if_data *sdata,
         bssid[0] |= 0x02;
 #endif
 
-        printk(KERN_DEBUG "%s: Creating new IBSS network, BSSID %s\n",
-               sdata->dev->name, print_mac(mac, bssid));
+        printk(KERN_DEBUG "%s: Creating new IBSS network, BSSID %pM\n",
+               sdata->dev->name, bssid);
 
         bss = ieee80211_rx_bss_add(local, bssid,
                                    local->hw.conf.channel->center_freq,
@@ -2050,8 +2112,6 @@ static int ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata,
         int found = 0;
         u8 bssid[ETH_ALEN];
         int active_ibss;
-        DECLARE_MAC_BUF(mac);
-        DECLARE_MAC_BUF(mac2);
 
         if (ifsta->ssid_len == 0)
                 return -EINVAL;
@@ -2068,8 +2128,7 @@ static int ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata,
                     || !(bss->capability & WLAN_CAPABILITY_IBSS))
                         continue;
 #ifdef CONFIG_MAC80211_IBSS_DEBUG
-                printk(KERN_DEBUG "   bssid=%s found\n",
-                       print_mac(mac, bss->bssid));
+                printk(KERN_DEBUG "   bssid=%pM found\n", bss->bssid);
 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
                 memcpy(bssid, bss->bssid, ETH_ALEN);
                 found = 1;
@@ -2080,9 +2139,8 @@ static int ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata,
 
 #ifdef CONFIG_MAC80211_IBSS_DEBUG
         if (found)
-                printk(KERN_DEBUG "   sta_find_ibss: selected %s current "
-                       "%s\n", print_mac(mac, bssid),
-                       print_mac(mac2, ifsta->bssid));
+                printk(KERN_DEBUG "   sta_find_ibss: selected %pM current "
+                       "%pM\n", bssid, ifsta->bssid);
 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
 
         if (found && memcmp(ifsta->bssid, bssid, ETH_ALEN) != 0) {
@@ -2099,9 +2157,9 @@ static int ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata,
                 if (!bss)
                         goto dont_join;
 
-                printk(KERN_DEBUG "%s: Selected IBSS BSSID %s"
+                printk(KERN_DEBUG "%s: Selected IBSS BSSID %pM"
                        " based on configured SSID\n",
-                       sdata->dev->name, print_mac(mac, bssid));
+                       sdata->dev->name, bssid);
                 ret = ieee80211_sta_join_ibss(sdata, ifsta, bss);
                 ieee80211_rx_bss_put(local, bss);
                 return ret;
@@ -2338,12 +2396,10 @@ void ieee80211_sta_setup_sdata(struct ieee80211_sub_if_data *sdata)
  * must be callable in atomic context.
  */
 struct sta_info *ieee80211_ibss_add_sta(struct ieee80211_sub_if_data *sdata,
-                                        struct sk_buff *skb, u8 *bssid,
-                                        u8 *addr, u64 supp_rates)
+                                        u8 *bssid,u8 *addr, u64 supp_rates)
 {
         struct ieee80211_local *local = sdata->local;
         struct sta_info *sta;
-        DECLARE_MAC_BUF(mac);
         int band = local->hw.conf.channel->band;
 
         /* TODO: Could consider removing the least recently used entry and
@@ -2351,7 +2407,7 @@ struct sta_info *ieee80211_ibss_add_sta(struct ieee80211_sub_if_data *sdata,
         if (local->num_sta >= IEEE80211_IBSS_MAX_STA_ENTRIES) {
                 if (net_ratelimit()) {
                         printk(KERN_DEBUG "%s: No room for a new IBSS STA "
-                               "entry %s\n", sdata->dev->name, print_mac(mac, addr));
+                               "entry %pM\n", sdata->dev->name, addr);
                 }
                 return NULL;
         }
@@ -2360,8 +2416,8 @@ struct sta_info *ieee80211_ibss_add_sta(struct ieee80211_sub_if_data *sdata,
                 return NULL;
 
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
-        printk(KERN_DEBUG "%s: Adding new IBSS station %s (dev=%s)\n",
-               wiphy_name(local->hw.wiphy), print_mac(mac, addr), sdata->dev->name);
+        printk(KERN_DEBUG "%s: Adding new IBSS station %pM (dev=%s)\n",
+               wiphy_name(local->hw.wiphy), addr, sdata->dev->name);
 #endif
 
         sta = sta_info_alloc(sdata, addr, GFP_ATOMIC);
@@ -2408,7 +2464,6 @@ void ieee80211_sta_req_auth(struct ieee80211_sub_if_data *sdata,
 int ieee80211_sta_set_ssid(struct ieee80211_sub_if_data *sdata, char *ssid, size_t len)
 {
         struct ieee80211_if_sta *ifsta;
-        int res;
 
         if (len > IEEE80211_MAX_SSID_LEN)
                 return -EINVAL;
@@ -2420,19 +2475,6 @@ int ieee80211_sta_set_ssid(struct ieee80211_sub_if_data *sdata, char *ssid, size
                 memcpy(ifsta->ssid, ssid, len);
                 ifsta->ssid_len = len;
                 ifsta->flags &= ~IEEE80211_STA_PREV_BSSID_SET;
-
-                res = 0;
-                /*
-                 * Hack! MLME code needs to be cleaned up to have different
-                 * entry points for configuration and internal selection change
-                 */
-                if (netif_running(sdata->dev))
-                        res = ieee80211_if_config(sdata, IEEE80211_IFCC_SSID);
-                if (res) {
-                        printk(KERN_DEBUG "%s: Failed to config new SSID to "
-                               "the low-level driver\n", sdata->dev->name);
-                        return res;
-                }
         }
 
         if (len)
@@ -2560,3 +2602,39 @@ void ieee80211_mlme_notify_scan_completed(struct ieee80211_local *local)
                 ieee80211_restart_sta_timer(sdata);
         rcu_read_unlock();
 }
+
+void ieee80211_dynamic_ps_disable_work(struct work_struct *work)
+{
+        struct ieee80211_local *local =
+                container_of(work, struct ieee80211_local,
+                             dynamic_ps_disable_work);
+
+        if (local->hw.conf.flags & IEEE80211_CONF_PS) {
+                local->hw.conf.flags &= ~IEEE80211_CONF_PS;
+                ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
+        }
+
+        ieee80211_wake_queues_by_reason(&local->hw,
+                                        IEEE80211_QUEUE_STOP_REASON_PS);
+}
+
+void ieee80211_dynamic_ps_enable_work(struct work_struct *work)
+{
+        struct ieee80211_local *local =
+                container_of(work, struct ieee80211_local,
+                             dynamic_ps_enable_work);
+
+        if (local->hw.conf.flags & IEEE80211_CONF_PS)
+                return;
+
+        local->hw.conf.flags |= IEEE80211_CONF_PS;
+
+        ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
+}
+
+void ieee80211_dynamic_ps_timer(unsigned long data)
+{
+        struct ieee80211_local *local = (void *) data;
+
+        queue_work(local->hw.workqueue, &local->dynamic_ps_enable_work);
+}
diff --git a/net/mac80211/rate.c b/net/mac80211/rate.c
index 5d786720d935..3fa7ab285066 100644
--- a/net/mac80211/rate.c
+++ b/net/mac80211/rate.c
@@ -199,48 +199,44 @@ static void rate_control_release(struct kref *kref)
 }
 
 void rate_control_get_rate(struct ieee80211_sub_if_data *sdata,
-                           struct ieee80211_supported_band *sband,
-                           struct sta_info *sta, struct sk_buff *skb,
-                           struct rate_selection *sel)
+                           struct sta_info *sta,
+                           struct ieee80211_tx_rate_control *txrc)
 {
         struct rate_control_ref *ref = sdata->local->rate_ctrl;
         void *priv_sta = NULL;
         struct ieee80211_sta *ista = NULL;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(txrc->skb);
         int i;
 
-        sel->rate_idx = -1;
-        sel->nonerp_idx = -1;
-        sel->probe_idx = -1;
-        sel->max_rate_idx = sdata->max_ratectrl_rateidx;
-
         if (sta) {
                 ista = &sta->sta;
                 priv_sta = sta->rate_ctrl_priv;
         }
 
+        for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
+                info->control.rates[i].idx = -1;
+                info->control.rates[i].flags = 0;
+                info->control.rates[i].count = 1;
+        }
+
         if (sta && sdata->force_unicast_rateidx > -1)
-                sel->rate_idx = sdata->force_unicast_rateidx;
+                info->control.rates[0].idx = sdata->force_unicast_rateidx;
         else
-                ref->ops->get_rate(ref->priv, sband, ista, priv_sta, skb, sel);
-
-        if (sdata->max_ratectrl_rateidx > -1 &&
-            sel->rate_idx > sdata->max_ratectrl_rateidx)
-                sel->rate_idx = sdata->max_ratectrl_rateidx;
-
-        BUG_ON(sel->rate_idx < 0);
-
-        /* Select a non-ERP backup rate. */
-        if (sel->nonerp_idx < 0) {
-                for (i = 0; i < sband->n_bitrates; i++) {
-                        struct ieee80211_rate *rate = &sband->bitrates[i];
-                        if (sband->bitrates[sel->rate_idx].bitrate < rate->bitrate)
-                                break;
-
-                        if (rate_supported(ista, sband->band, i) &&
-                            !(rate->flags & IEEE80211_RATE_ERP_G))
-                                sel->nonerp_idx = i;
-                }
+                ref->ops->get_rate(ref->priv, ista, priv_sta, txrc);
+
+        /*
+         * try to enforce the maximum rate the user wanted
+         */
+        if (sdata->max_ratectrl_rateidx > -1)
+                for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
+                        if (info->control.rates[i].flags & IEEE80211_TX_RC_MCS)
+                                continue;
+                        info->control.rates[i].idx =
+                                min_t(s8, info->control.rates[i].idx,
+                                      sdata->max_ratectrl_rateidx);
         }
+
+        BUG_ON(info->control.rates[0].idx < 0);
 }
 
 struct rate_control_ref *rate_control_get(struct rate_control_ref *ref)
diff --git a/net/mac80211/rate.h b/net/mac80211/rate.h
index d0092f847f82..928da625e281 100644
--- a/net/mac80211/rate.h
+++ b/net/mac80211/rate.h
@@ -31,9 +31,8 @@ struct rate_control_ref {
 struct rate_control_ref *rate_control_alloc(const char *name,
                                             struct ieee80211_local *local);
 void rate_control_get_rate(struct ieee80211_sub_if_data *sdata,
-                           struct ieee80211_supported_band *sband,
-                           struct sta_info *sta, struct sk_buff *skb,
-                           struct rate_selection *sel);
+                           struct sta_info *sta,
+                           struct ieee80211_tx_rate_control *txrc);
 struct rate_control_ref *rate_control_get(struct rate_control_ref *ref);
 void rate_control_put(struct rate_control_ref *ref);
 
@@ -64,12 +63,6 @@ static inline void rate_control_rate_init(struct sta_info *sta)
 }
 
 
-static inline void rate_control_clear(struct ieee80211_local *local)
-{
-        struct rate_control_ref *ref = local->rate_ctrl;
-        ref->ops->clear(ref->priv);
-}
-
 static inline void *rate_control_alloc_sta(struct rate_control_ref *ref,
                                            struct ieee80211_sta *sta,
                                            gfp_t gfp)
diff --git a/net/mac80211/rc80211_minstrel.c b/net/mac80211/rc80211_minstrel.c
index f6d69dab07a3..2b3b490a6073 100644
--- a/net/mac80211/rc80211_minstrel.c
+++ b/net/mac80211/rc80211_minstrel.c
@@ -126,7 +126,9 @@ minstrel_update_stats(struct minstrel_priv *mp, struct minstrel_sta_info *mi)
                         mr->adjusted_retry_count = mr->retry_count >> 1;
                         if (mr->adjusted_retry_count > 2)
                                 mr->adjusted_retry_count = 2;
+                        mr->sample_limit = 4;
                 } else {
+                        mr->sample_limit = -1;
                         mr->adjusted_retry_count = mr->retry_count;
                 }
                 if (!mr->adjusted_retry_count)
@@ -169,30 +171,20 @@ minstrel_tx_status(void *priv, struct ieee80211_supported_band *sband,
 {
         struct minstrel_sta_info *mi = priv_sta;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-        struct ieee80211_tx_altrate *ar = info->status.retries;
-        struct minstrel_priv *mp = priv;
-        int i, ndx, tries;
-        int success = 0;
-
-        if (!info->status.excessive_retries)
-                success = 1;
+        struct ieee80211_tx_rate *ar = info->status.rates;
+        int i, ndx;
+        int success;
 
-        if (!mp->has_mrr || (ar[0].rate_idx < 0)) {
-                ndx = rix_to_ndx(mi, info->tx_rate_idx);
-                tries = info->status.retry_count + 1;
-                mi->r[ndx].success += success;
-                mi->r[ndx].attempts += tries;
-                return;
-        }
+        success = !!(info->flags & IEEE80211_TX_STAT_ACK);
 
-        for (i = 0; i < 4; i++) {
-                if (ar[i].rate_idx < 0)
+        for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
+                if (ar[i].idx < 0)
                         break;
 
-                ndx = rix_to_ndx(mi, ar[i].rate_idx);
-                mi->r[ndx].attempts += ar[i].limit + 1;
+                ndx = rix_to_ndx(mi, ar[i].idx);
+                mi->r[ndx].attempts += ar[i].count;
 
-                if ((i != 3) && (ar[i + 1].rate_idx < 0))
+                if ((i != IEEE80211_TX_MAX_RATES - 1) && (ar[i + 1].idx < 0))
                         mi->r[ndx].success += success;
         }
 
@@ -210,9 +202,9 @@ minstrel_get_retry_count(struct minstrel_rate *mr,
 {
         unsigned int retry = mr->adjusted_retry_count;
 
-        if (info->flags & IEEE80211_TX_CTL_USE_RTS_CTS)
+        if (info->control.rates[0].flags & IEEE80211_TX_RC_USE_RTS_CTS)
                 retry = max(2U, min(mr->retry_count_rtscts, retry));
-        else if (info->flags & IEEE80211_TX_CTL_USE_CTS_PROTECT)
+        else if (info->control.rates[0].flags & IEEE80211_TX_RC_USE_CTS_PROTECT)
                 retry = max(2U, min(mr->retry_count_cts, retry));
         return retry;
 }
@@ -233,15 +225,16 @@ minstrel_get_next_sample(struct minstrel_sta_info *mi)
         return sample_ndx;
 }
 
-void
-minstrel_get_rate(void *priv, struct ieee80211_supported_band *sband,
-                  struct ieee80211_sta *sta, void *priv_sta,
-                  struct sk_buff *skb, struct rate_selection *sel)
+static void
+minstrel_get_rate(void *priv, struct ieee80211_sta *sta,
+                  void *priv_sta, struct ieee80211_tx_rate_control *txrc)
 {
+        struct sk_buff *skb = txrc->skb;
+        struct ieee80211_supported_band *sband = txrc->sband;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         struct minstrel_sta_info *mi = priv_sta;
         struct minstrel_priv *mp = priv;
-        struct ieee80211_tx_altrate *ar = info->control.retries;
+        struct ieee80211_tx_rate *ar = info->control.rates;
         unsigned int ndx, sample_ndx = 0;
         bool mrr;
         bool sample_slower = false;
@@ -251,16 +244,12 @@ minstrel_get_rate(void *priv, struct ieee80211_supported_band *sband,
         int sample_rate;
 
         if (!sta || !mi || use_low_rate(skb)) {
-                sel->rate_idx = rate_lowest_index(sband, sta);
+                ar[0].idx = rate_lowest_index(sband, sta);
+                ar[0].count = mp->max_retry;
                 return;
         }
 
-        mrr = mp->has_mrr;
-
-        /* mac80211 does not allow mrr for RTS/CTS */
-        if ((info->flags & IEEE80211_TX_CTL_USE_RTS_CTS) ||
-            (info->flags & IEEE80211_TX_CTL_USE_CTS_PROTECT))
-                mrr = false;
+        mrr = mp->has_mrr && !txrc->rts && !txrc->bss_conf->use_cts_prot;
 
         if (time_after(jiffies, mi->stats_update + (mp->update_interval *
                         HZ) / 1000))
@@ -278,7 +267,8 @@ minstrel_get_rate(void *priv, struct ieee80211_supported_band *sband,
                         (mi->sample_count + mi->sample_deferred / 2);
 
         /* delta > 0: sampling required */
-        if (delta > 0) {
+        if ((delta > 0) && (mrr || !mi->prev_sample)) {
+                struct minstrel_rate *msr;
                 if (mi->packet_count >= 10000) {
                         mi->sample_deferred = 0;
                         mi->sample_count = 0;
@@ -297,13 +287,20 @@ minstrel_get_rate(void *priv, struct ieee80211_supported_band *sband,
                 }
 
                 sample_ndx = minstrel_get_next_sample(mi);
+                msr = &mi->r[sample_ndx];
                 sample = true;
-                sample_slower = mrr && (mi->r[sample_ndx].perfect_tx_time >
+                sample_slower = mrr && (msr->perfect_tx_time >
                         mi->r[ndx].perfect_tx_time);
 
                 if (!sample_slower) {
-                        ndx = sample_ndx;
-                        mi->sample_count++;
+                        if (msr->sample_limit != 0) {
+                                ndx = sample_ndx;
+                                mi->sample_count++;
+                                if (msr->sample_limit > 0)
+                                        msr->sample_limit--;
+                        } else {
+                                sample = false;
+                        }
                 } else {
                         /* Only use IEEE80211_TX_CTL_RATE_CTRL_PROBE to mark
                          * packets that have the sampling rate deferred to the
@@ -315,13 +312,22 @@ minstrel_get_rate(void *priv, struct ieee80211_supported_band *sband,
                         mi->sample_deferred++;
                 }
         }
-        sel->rate_idx = mi->r[ndx].rix;
-        info->control.retry_limit = minstrel_get_retry_count(&mi->r[ndx], info);
+        mi->prev_sample = sample;
+
+        /* If we're not using MRR and the sampling rate already
+         * has a probability of >95%, we shouldn't be attempting
+         * to use it, as this only wastes precious airtime */
+        if (!mrr && sample && (mi->r[ndx].probability > 17100))
+                ndx = mi->max_tp_rate;
+
+        ar[0].idx = mi->r[ndx].rix;
+        ar[0].count = minstrel_get_retry_count(&mi->r[ndx], info);
 
         if (!mrr) {
-                ar[0].rate_idx = mi->lowest_rix;
-                ar[0].limit = mp->max_retry;
-                ar[1].rate_idx = -1;
+                if (!sample)
+                        ar[0].count = mp->max_retry;
+                ar[1].idx = mi->lowest_rix;
+                ar[1].count = mp->max_retry;
                 return;
         }
 
@@ -336,9 +342,9 @@ minstrel_get_rate(void *priv, struct ieee80211_supported_band *sband,
         }
         mrr_ndx[1] = mi->max_prob_rate;
         mrr_ndx[2] = 0;
-        for (i = 0; i < 3; i++) {
-                ar[i].rate_idx = mi->r[mrr_ndx[i]].rix;
-                ar[i].limit = mi->r[mrr_ndx[i]].adjusted_retry_count;
+        for (i = 1; i < 4; i++) {
+                ar[i].idx = mi->r[mrr_ndx[i - 1]].rix;
+                ar[i].count = mi->r[mrr_ndx[i - 1]].adjusted_retry_count;
         }
 }
 
@@ -415,6 +421,7 @@ minstrel_rate_init(void *priv, struct ieee80211_supported_band *sband,
 
                 /* calculate maximum number of retransmissions before
                  * fallback (based on maximum segment size) */
+                mr->sample_limit = -1;
                 mr->retry_count = 1;
                 mr->retry_count_cts = 1;
                 mr->retry_count_rtscts = 1;
@@ -500,11 +507,6 @@ minstrel_free_sta(void *priv, struct ieee80211_sta *sta, void *priv_sta)
         kfree(mi);
 }
 
-static void
-minstrel_clear(void *priv)
-{
-}
-
 static void *
 minstrel_alloc(struct ieee80211_hw *hw, struct dentry *debugfsdir)
 {
@@ -532,13 +534,13 @@ minstrel_alloc(struct ieee80211_hw *hw, struct dentry *debugfsdir)
         /* maximum time that the hw is allowed to stay in one MRR segment */
         mp->segment_size = 6000;
 
-        if (hw->max_altrate_tries > 0)
-                mp->max_retry = hw->max_altrate_tries;
+        if (hw->max_rate_tries > 0)
+                mp->max_retry = hw->max_rate_tries;
         else
                 /* safe default, does not necessarily have to match hw properties */
                 mp->max_retry = 7;
 
-        if (hw->max_altrates >= 3)
+        if (hw->max_rates >= 4)
                 mp->has_mrr = true;
 
         mp->hw = hw;
@@ -558,7 +560,6 @@ static struct rate_control_ops mac80211_minstrel = {
         .tx_status = minstrel_tx_status,
         .get_rate = minstrel_get_rate,
         .rate_init = minstrel_rate_init,
-        .clear = minstrel_clear,
         .alloc = minstrel_alloc,
         .free = minstrel_free,
         .alloc_sta = minstrel_alloc_sta,
diff --git a/net/mac80211/rc80211_minstrel.h b/net/mac80211/rc80211_minstrel.h
index 9a90a6aee043..869fe0ef951d 100644
--- a/net/mac80211/rc80211_minstrel.h
+++ b/net/mac80211/rc80211_minstrel.h
@@ -16,6 +16,7 @@ struct minstrel_rate {
         unsigned int perfect_tx_time;
         unsigned int ack_time;
 
+        int sample_limit;
         unsigned int retry_count;
         unsigned int retry_count_cts;
         unsigned int retry_count_rtscts;
@@ -57,6 +58,7 @@ struct minstrel_sta_info {
 
         int n_rates;
         struct minstrel_rate *r;
+        bool prev_sample;
 
         /* sampling table */
         u8 *sample_table;
diff --git a/net/mac80211/rc80211_pid.h b/net/mac80211/rc80211_pid.h
index 01d64d53f3b9..1a873f00691a 100644
--- a/net/mac80211/rc80211_pid.h
+++ b/net/mac80211/rc80211_pid.h
@@ -49,7 +49,7 @@
 
 /* Arithmetic right shift for positive and negative values for ISO C. */
 #define RC_PID_DO_ARITH_RIGHT_SHIFT(x, y) \
-        (x) < 0 ? -((-(x)) >> (y)) : (x) >> (y)
+        ((x) < 0 ? -((-(x)) >> (y)) : (x) >> (y))
 
 enum rc_pid_event_type {
         RC_PID_EVENT_TYPE_TX_STATUS,
@@ -61,6 +61,7 @@ enum rc_pid_event_type {
 union rc_pid_event_data {
         /* RC_PID_EVENT_TX_STATUS */
         struct {
+                u32 flags;
                 struct ieee80211_tx_info tx_status;
         };
         /* RC_PID_EVENT_TYPE_RATE_CHANGE */
diff --git a/net/mac80211/rc80211_pid_algo.c b/net/mac80211/rc80211_pid_algo.c
index 86eb374e3b87..b16801cde06f 100644
--- a/net/mac80211/rc80211_pid_algo.c
+++ b/net/mac80211/rc80211_pid_algo.c
@@ -241,7 +241,7 @@ static void rate_control_pid_tx_status(void *priv, struct ieee80211_supported_ba
 
         /* Ignore all frames that were sent with a different rate than the rate
          * we currently advise mac80211 to use. */
-        if (info->tx_rate_idx != spinfo->txrate_idx)
+        if (info->status.rates[0].idx != spinfo->txrate_idx)
                 return;
 
         spinfo->tx_num_xmit++;
@@ -253,10 +253,10 @@ static void rate_control_pid_tx_status(void *priv, struct ieee80211_supported_ba
         /* We count frames that totally failed to be transmitted as two bad
          * frames, those that made it out but had some retries as one good and
          * one bad frame. */
-        if (info->status.excessive_retries) {
+        if (!(info->flags & IEEE80211_TX_STAT_ACK)) {
                 spinfo->tx_num_failed += 2;
                 spinfo->tx_num_xmit++;
-        } else if (info->status.retry_count) {
+        } else if (info->status.rates[0].count > 1) {
                 spinfo->tx_num_failed++;
                 spinfo->tx_num_xmit++;
         }
@@ -270,23 +270,32 @@ static void rate_control_pid_tx_status(void *priv, struct ieee80211_supported_ba
 }
 
 static void
-rate_control_pid_get_rate(void *priv, struct ieee80211_supported_band *sband,
-                          struct ieee80211_sta *sta, void *priv_sta,
-                          struct sk_buff *skb,
-                          struct rate_selection *sel)
+rate_control_pid_get_rate(void *priv, struct ieee80211_sta *sta,
+                          void *priv_sta,
+                          struct ieee80211_tx_rate_control *txrc)
 {
+        struct sk_buff *skb = txrc->skb;
+        struct ieee80211_supported_band *sband = txrc->sband;
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         struct rc_pid_sta_info *spinfo = priv_sta;
         int rateidx;
         u16 fc;
 
+        if (txrc->rts)
+                info->control.rates[0].count =
+                        txrc->hw->conf.long_frame_max_tx_count;
+        else
+                info->control.rates[0].count =
+                        txrc->hw->conf.short_frame_max_tx_count;
+
         /* Send management frames and broadcast/multicast data using lowest
          * rate. */
         fc = le16_to_cpu(hdr->frame_control);
         if (!sta || !spinfo ||
             (fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA ||
             is_multicast_ether_addr(hdr->addr1)) {
-                sel->rate_idx = rate_lowest_index(sband, sta);
+                info->control.rates[0].idx = rate_lowest_index(sband, sta);
                 return;
         }
 
@@ -295,7 +304,7 @@ rate_control_pid_get_rate(void *priv, struct ieee80211_supported_band *sband,
         if (rateidx >= sband->n_bitrates)
                 rateidx = sband->n_bitrates - 1;
 
-        sel->rate_idx = rateidx;
+        info->control.rates[0].idx = rateidx;
 
 #ifdef CONFIG_MAC80211_DEBUGFS
         rate_control_pid_event_tx_rate(&spinfo->events,
@@ -394,11 +403,11 @@ static void *rate_control_pid_alloc(struct ieee80211_hw *hw,
                                                  S_IRUSR | S_IWUSR, debugfsdir,
                                                  &pinfo->sampling_period);
         de->coeff_p = debugfs_create_u32("coeff_p", S_IRUSR | S_IWUSR,
-                                         debugfsdir, &pinfo->coeff_p);
+                                         debugfsdir, (u32 *)&pinfo->coeff_p);
         de->coeff_i = debugfs_create_u32("coeff_i", S_IRUSR | S_IWUSR,
-                                         debugfsdir, &pinfo->coeff_i);
+                                         debugfsdir, (u32 *)&pinfo->coeff_i);
         de->coeff_d = debugfs_create_u32("coeff_d", S_IRUSR | S_IWUSR,
-                                         debugfsdir, &pinfo->coeff_d);
+                                         debugfsdir, (u32 *)&pinfo->coeff_d);
         de->smoothing_shift = debugfs_create_u32("smoothing_shift",
                                                  S_IRUSR | S_IWUSR, debugfsdir,
                                                  &pinfo->smoothing_shift);
@@ -437,10 +446,6 @@ static void rate_control_pid_free(void *priv)
         kfree(pinfo);
 }
 
-static void rate_control_pid_clear(void *priv)
-{
-}
-
 static void *rate_control_pid_alloc_sta(void *priv, struct ieee80211_sta *sta,
                                         gfp_t gfp)
 {
@@ -471,7 +476,6 @@ static struct rate_control_ops mac80211_rcpid = {
         .tx_status = rate_control_pid_tx_status,
         .get_rate = rate_control_pid_get_rate,
         .rate_init = rate_control_pid_rate_init,
-        .clear = rate_control_pid_clear,
         .alloc = rate_control_pid_alloc,
         .free = rate_control_pid_free,
         .alloc_sta = rate_control_pid_alloc_sta,
diff --git a/net/mac80211/rc80211_pid_debugfs.c b/net/mac80211/rc80211_pid_debugfs.c
index 8121d3bc6835..a08a9b530347 100644
--- a/net/mac80211/rc80211_pid_debugfs.c
+++ b/net/mac80211/rc80211_pid_debugfs.c
@@ -43,6 +43,7 @@ void rate_control_pid_event_tx_status(struct rc_pid_event_buffer *buf,
 {
         union rc_pid_event_data evd;
 
+        evd.flags = stat->flags;
         memcpy(&evd.tx_status, stat, sizeof(struct ieee80211_tx_info));
         rate_control_pid_event(buf, RC_PID_EVENT_TYPE_TX_STATUS, &evd);
 }
@@ -167,8 +168,8 @@ static ssize_t rate_control_pid_events_read(struct file *file, char __user *buf,
         switch (ev->type) {
         case RC_PID_EVENT_TYPE_TX_STATUS:
                 p += snprintf(pb + p, length - p, "tx_status %u %u",
-                              ev->data.tx_status.status.excessive_retries,
-                              ev->data.tx_status.status.retry_count);
+                              !(ev->data.flags & IEEE80211_TX_STAT_ACK),
+                              ev->data.tx_status.status.rates[0].idx);
                 break;
         case RC_PID_EVENT_TYPE_RATE_CHANGE:
                 p += snprintf(pb + p, length - p, "rate_change %d %d",
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index cf6b121e1bbf..7175ae80c36a 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -26,10 +26,11 @@
 #include "tkip.h"
 #include "wme.h"
 
-u8 ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
-                                struct tid_ampdu_rx *tid_agg_rx,
-                                struct sk_buff *skb, u16 mpdu_seq_num,
-                                int bar_req);
+static u8 ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
+                                           struct tid_ampdu_rx *tid_agg_rx,
+                                           struct sk_buff *skb,
+                                           u16 mpdu_seq_num,
+                                           int bar_req);
 /*
  * monitor mode reception
  *
@@ -122,7 +123,6 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
         /* radiotap header, set always present flags */
         rthdr->it_present =
                 cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
-                            (1 << IEEE80211_RADIOTAP_RATE) |
                             (1 << IEEE80211_RADIOTAP_CHANNEL) |
                             (1 << IEEE80211_RADIOTAP_ANTENNA) |
                             (1 << IEEE80211_RADIOTAP_RX_FLAGS));
@@ -148,7 +148,19 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
         pos++;
 
         /* IEEE80211_RADIOTAP_RATE */
-        *pos = rate->bitrate / 5;
+        if (status->flag & RX_FLAG_HT) {
+                /*
+                 * TODO: add following information into radiotap header once
+                 * suitable fields are defined for it:
+                 * - MCS index (status->rate_idx)
+                 * - HT40 (status->flag & RX_FLAG_40MHZ)
+                 * - short-GI (status->flag & RX_FLAG_SHORT_GI)
+                 */
+                *pos = 0;
+        } else {
+                rthdr->it_present |= (1 << IEEE80211_RADIOTAP_RATE);
+                *pos = rate->bitrate / 5;
+        }
         pos++;
 
         /* IEEE80211_RADIOTAP_CHANNEL */
@@ -653,13 +665,16 @@ ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
 static void ap_sta_ps_start(struct sta_info *sta)
 {
         struct ieee80211_sub_if_data *sdata = sta->sdata;
-        DECLARE_MAC_BUF(mac);
+        struct ieee80211_local *local = sdata->local;
 
         atomic_inc(&sdata->bss->num_sta_ps);
         set_and_clear_sta_flags(sta, WLAN_STA_PS, WLAN_STA_PSPOLL);
+        if (local->ops->sta_notify)
+                local->ops->sta_notify(local_to_hw(local), &sdata->vif,
+                                        STA_NOTIFY_SLEEP, &sta->sta);
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
-        printk(KERN_DEBUG "%s: STA %s aid %d enters power save mode\n",
-               sdata->dev->name, print_mac(mac, sta->sta.addr), sta->sta.aid);
+        printk(KERN_DEBUG "%s: STA %pM aid %d enters power save mode\n",
+               sdata->dev->name, sta->sta.addr, sta->sta.aid);
 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
 }
 
@@ -669,38 +684,37 @@ static int ap_sta_ps_end(struct sta_info *sta)
         struct ieee80211_local *local = sdata->local;
         struct sk_buff *skb;
         int sent = 0;
-        struct ieee80211_tx_info *info;
-        DECLARE_MAC_BUF(mac);
 
         atomic_dec(&sdata->bss->num_sta_ps);
 
         clear_sta_flags(sta, WLAN_STA_PS | WLAN_STA_PSPOLL);
+        if (local->ops->sta_notify)
+                local->ops->sta_notify(local_to_hw(local), &sdata->vif,
+                                        STA_NOTIFY_AWAKE, &sta->sta);
 
         if (!skb_queue_empty(&sta->ps_tx_buf))
                 sta_info_clear_tim_bit(sta);
 
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
-        printk(KERN_DEBUG "%s: STA %s aid %d exits power save mode\n",
-               sdata->dev->name, print_mac(mac, sta->sta.addr), sta->sta.aid);
+        printk(KERN_DEBUG "%s: STA %pM aid %d exits power save mode\n",
+               sdata->dev->name, sta->sta.addr, sta->sta.aid);
 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
 
         /* Send all buffered frames to the station */
         while ((skb = skb_dequeue(&sta->tx_filtered)) != NULL) {
-                info = IEEE80211_SKB_CB(skb);
                 sent++;
-                info->flags |= IEEE80211_TX_CTL_REQUEUE;
+                skb->requeue = 1;
                 dev_queue_xmit(skb);
         }
         while ((skb = skb_dequeue(&sta->ps_tx_buf)) != NULL) {
-                info = IEEE80211_SKB_CB(skb);
                 local->total_ps_buffered--;
                 sent++;
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
-                printk(KERN_DEBUG "%s: STA %s aid %d send PS frame "
+                printk(KERN_DEBUG "%s: STA %pM aid %d send PS frame "
                        "since STA not sleeping anymore\n", sdata->dev->name,
-                       print_mac(mac, sta->sta.addr), sta->sta.aid);
+                       sta->sta.addr, sta->sta.aid);
 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
-                info->flags |= IEEE80211_TX_CTL_REQUEUE;
+                skb->requeue = 1;
                 dev_queue_xmit(skb);
         }
 
@@ -745,17 +759,29 @@ ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
         sta->last_qual = rx->status->qual;
         sta->last_noise = rx->status->noise;
 
+        /*
+         * Change STA power saving mode only at the end of a frame
+         * exchange sequence.
+         */
         if (!ieee80211_has_morefrags(hdr->frame_control) &&
             (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
              rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)) {
-                /* Change STA power saving mode only in the end of a frame
-                 * exchange sequence */
-                if (test_sta_flags(sta, WLAN_STA_PS) &&
-                    !ieee80211_has_pm(hdr->frame_control))
-                        rx->sent_ps_buffered += ap_sta_ps_end(sta);
-                else if (!test_sta_flags(sta, WLAN_STA_PS) &&
-                         ieee80211_has_pm(hdr->frame_control))
-                        ap_sta_ps_start(sta);
+                if (test_sta_flags(sta, WLAN_STA_PS)) {
+                        /*
+                         * Ignore doze->wake transitions that are
+                         * indicated by non-data frames, the standard
+                         * is unclear here, but for example going to
+                         * PS mode and then scanning would cause a
+                         * doze->wake transition for the probe request,
+                         * and that is clearly undesirable.
+                         */
+                        if (ieee80211_is_data(hdr->frame_control) &&
+                            !ieee80211_has_pm(hdr->frame_control))
+                                rx->sent_ps_buffered += ap_sta_ps_end(sta);
+                } else {
+                        if (ieee80211_has_pm(hdr->frame_control))
+                                ap_sta_ps_start(sta);
+                }
         }
 
         /* Drop data::nullfunc frames silently, since they are used only to
@@ -789,15 +815,12 @@ ieee80211_reassemble_add(struct ieee80211_sub_if_data *sdata,
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
                 struct ieee80211_hdr *hdr =
                         (struct ieee80211_hdr *) entry->skb_list.next->data;
-                DECLARE_MAC_BUF(mac);
-                DECLARE_MAC_BUF(mac2);
                 printk(KERN_DEBUG "%s: RX reassembly removed oldest "
                        "fragment entry (idx=%d age=%lu seq=%d last_frag=%d "
-                       "addr1=%s addr2=%s\n",
+                       "addr1=%pM addr2=%pM\n",
                        sdata->dev->name, idx,
                        jiffies - entry->first_frag_time, entry->seq,
-                       entry->last_frag, print_mac(mac, hdr->addr1),
-                       print_mac(mac2, hdr->addr2));
+                       entry->last_frag, hdr->addr1, hdr->addr2);
 #endif
                 __skb_queue_purge(&entry->skb_list);
         }
@@ -866,7 +889,6 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
         unsigned int frag, seq;
         struct ieee80211_fragment_entry *entry;
         struct sk_buff *skb;
-        DECLARE_MAC_BUF(mac);
 
         hdr = (struct ieee80211_hdr *)rx->skb->data;
         fc = hdr->frame_control;
@@ -970,7 +992,6 @@ ieee80211_rx_h_ps_poll(struct ieee80211_rx_data *rx)
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(rx->dev);
         struct sk_buff *skb;
         int no_pending_pkts;
-        DECLARE_MAC_BUF(mac);
         __le16 fc = ((struct ieee80211_hdr *)rx->skb->data)->frame_control;
 
         if (likely(!rx->sta || !ieee80211_is_pspoll(fc) ||
@@ -1001,8 +1022,8 @@ ieee80211_rx_h_ps_poll(struct ieee80211_rx_data *rx)
                 set_sta_flags(rx->sta, WLAN_STA_PSPOLL);
 
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
-                printk(KERN_DEBUG "STA %s aid %d: PS Poll (entries after %d)\n",
-                       print_mac(mac, rx->sta->sta.addr), rx->sta->sta.aid,
+                printk(KERN_DEBUG "STA %pM aid %d: PS Poll (entries after %d)\n",
+                       rx->sta->sta.addr, rx->sta->sta.aid,
                        skb_queue_len(&rx->sta->ps_tx_buf));
 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
 
@@ -1025,9 +1046,9 @@ ieee80211_rx_h_ps_poll(struct ieee80211_rx_data *rx)
                  *        Should we send it a null-func frame indicating we
                  *        have nothing buffered for it?
                  */
-                printk(KERN_DEBUG "%s: STA %s sent PS Poll even "
+                printk(KERN_DEBUG "%s: STA %pM sent PS Poll even "
                        "though there are no buffered frames for it\n",
-                       rx->dev->name, print_mac(mac, rx->sta->sta.addr));
+                       rx->dev->name, rx->sta->sta.addr);
 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
         }
 
@@ -1097,10 +1118,6 @@ ieee80211_data_to_8023(struct ieee80211_rx_data *rx)
         u8 src[ETH_ALEN] __aligned(2);
         struct sk_buff *skb = rx->skb;
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        DECLARE_MAC_BUF(mac);
-        DECLARE_MAC_BUF(mac2);
-        DECLARE_MAC_BUF(mac3);
-        DECLARE_MAC_BUF(mac4);
 
         if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
                 return -1;
@@ -1279,7 +1296,6 @@ ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
         int remaining, err;
         u8 dst[ETH_ALEN];
         u8 src[ETH_ALEN];
-        DECLARE_MAC_BUF(mac);
 
         if (unlikely(!ieee80211_is_data(fc)))
                 return RX_CONTINUE;
@@ -1552,14 +1568,6 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
         if (len < IEEE80211_MIN_ACTION_SIZE + 1)
                 return RX_DROP_MONITOR;
 
-        /*
-         * FIXME: revisit this, I'm sure we should handle most
-         *        of these frames in other modes as well!
-         */
-        if (sdata->vif.type != NL80211_IFTYPE_STATION &&
-            sdata->vif.type != NL80211_IFTYPE_ADHOC)
-                return RX_CONTINUE;
-
         switch (mgmt->u.action.category) {
         case WLAN_CATEGORY_BACK:
                 switch (mgmt->u.action.u.addba_req.action_code) {
@@ -1632,8 +1640,6 @@ static void ieee80211_rx_michael_mic_report(struct net_device *dev,
 {
         int keyidx;
         unsigned int hdrlen;
-        DECLARE_MAC_BUF(mac);
-        DECLARE_MAC_BUF(mac2);
 
         hdrlen = ieee80211_hdrlen(hdr->frame_control);
         if (rx->skb->len >= hdrlen + 4)
@@ -1854,10 +1860,15 @@ static int prepare_for_handlers(struct ieee80211_sub_if_data *sdata,
                         if (!(sdata->dev->flags & IFF_PROMISC))
                                 return 0;
                         rx->flags &= ~IEEE80211_RX_RA_MATCH;
-                } else if (!rx->sta)
-                        rx->sta = ieee80211_ibss_add_sta(sdata, rx->skb,
-                                                bssid, hdr->addr2,
-                                                BIT(rx->status->rate_idx));
+                } else if (!rx->sta) {
+                        int rate_idx;
+                        if (rx->status->flag & RX_FLAG_HT)
+                                rate_idx = 0; /* TODO: HT rates */
+                        else
+                                rate_idx = rx->status->rate_idx;
+                        rx->sta = ieee80211_ibss_add_sta(sdata, bssid, hdr->addr2,
+                                BIT(rate_idx));
+                }
                 break;
         case NL80211_IFTYPE_MESH_POINT:
                 if (!multicast &&
@@ -2002,17 +2013,17 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
 
 static inline int seq_less(u16 sq1, u16 sq2)
 {
-        return (((sq1 - sq2) & SEQ_MASK) > (SEQ_MODULO >> 1));
+        return ((sq1 - sq2) & SEQ_MASK) > (SEQ_MODULO >> 1);
 }
 
 static inline u16 seq_inc(u16 sq)
 {
-        return ((sq + 1) & SEQ_MASK);
+        return (sq + 1) & SEQ_MASK;
 }
 
 static inline u16 seq_sub(u16 sq1, u16 sq2)
 {
-        return ((sq1 - sq2) & SEQ_MASK);
+        return (sq1 - sq2) & SEQ_MASK;
 }
 
 
@@ -2020,10 +2031,11 @@ static inline u16 seq_sub(u16 sq1, u16 sq2)
  * As it function blongs to Rx path it must be called with
  * the proper rcu_read_lock protection for its flow.
  */
-u8 ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
-                                struct tid_ampdu_rx *tid_agg_rx,
-                                struct sk_buff *skb, u16 mpdu_seq_num,
-                                int bar_req)
+static u8 ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
+                                           struct tid_ampdu_rx *tid_agg_rx,
+                                           struct sk_buff *skb,
+                                           u16 mpdu_seq_num,
+                                           int bar_req)
 {
         struct ieee80211_local *local = hw_to_local(hw);
         struct ieee80211_rx_status status;
@@ -2062,7 +2074,13 @@ u8 ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
                                         tid_agg_rx->reorder_buf[index]->cb,
                                         sizeof(status));
                                 sband = local->hw.wiphy->bands[status.band];
-                                rate = &sband->bitrates[status.rate_idx];
+                                if (status.flag & RX_FLAG_HT) {
+                                        /* TODO: HT rates */
+                                        rate = sband->bitrates;
+                                } else {
+                                        rate = &sband->bitrates
+                                                [status.rate_idx];
+                                }
                                 __ieee80211_rx_handle_packet(hw,
                                         tid_agg_rx->reorder_buf[index],
                                         &status, rate);
@@ -2106,7 +2124,10 @@ u8 ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
                 memcpy(&status, tid_agg_rx->reorder_buf[index]->cb,
                         sizeof(status));
                 sband = local->hw.wiphy->bands[status.band];
-                rate = &sband->bitrates[status.rate_idx];
+                if (status.flag & RX_FLAG_HT)
+                        rate = sband->bitrates; /* TODO: HT rates */
+                else
+                        rate = &sband->bitrates[status.rate_idx];
                 __ieee80211_rx_handle_packet(hw, tid_agg_rx->reorder_buf[index],
                                              &status, rate);
                 tid_agg_rx->stored_mpdu_num--;
@@ -2194,15 +2215,26 @@ void __ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb,
         }
 
         sband = local->hw.wiphy->bands[status->band];
-
-        if (!sband ||
-            status->rate_idx < 0 ||
-            status->rate_idx >= sband->n_bitrates) {
+        if (!sband) {
                 WARN_ON(1);
                 return;
         }
 
-        rate = &sband->bitrates[status->rate_idx];
+        if (status->flag & RX_FLAG_HT) {
+                /* rate_idx is MCS index */
+                if (WARN_ON(status->rate_idx < 0 ||
+                            status->rate_idx >= 76))
+                        return;
+                /* HT rates are not in the table - use the highest legacy rate
+                 * for now since other parts of mac80211 may not yet be fully
+                 * MCS aware. */
+                rate = &sband->bitrates[sband->n_bitrates - 1];
+        } else {
+                if (WARN_ON(status->rate_idx < 0 ||
+                            status->rate_idx >= sband->n_bitrates))
+                        return;
+                rate = &sband->bitrates[status->rate_idx];
+        }
 
         /*
          * key references and virtual interfaces are protected using RCU
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index 416bb41099f3..f5c7c3371929 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -159,7 +159,7 @@ ieee80211_rx_mesh_bss_add(struct ieee80211_local *local, u8 *mesh_id, int mesh_i
 {
         struct ieee80211_bss *bss;
 
-        if (mesh_config_len != MESH_CFG_LEN)
+        if (mesh_config_len != IEEE80211_MESH_CONFIG_LEN)
                 return NULL;
 
         bss = kzalloc(sizeof(*bss), GFP_ATOMIC);
@@ -448,18 +448,17 @@ void ieee80211_scan_completed(struct ieee80211_hw *hw)
 
         if (local->hw_scanning) {
                 local->hw_scanning = false;
-                if (ieee80211_hw_config(local))
-                        printk(KERN_DEBUG "%s: failed to restore operational "
-                               "channel after scan\n", wiphy_name(local->hw.wiphy));
-
+                /*
+                 * Somebody might have requested channel change during scan
+                 * that we won't have acted upon, try now. ieee80211_hw_config
+                 * will set the flag based on actual changes.
+                 */
+                ieee80211_hw_config(local, 0);
                 goto done;
         }
 
         local->sw_scanning = false;
-        if (ieee80211_hw_config(local))
-                printk(KERN_DEBUG "%s: failed to restore operational "
-                       "channel after scan\n", wiphy_name(local->hw.wiphy));
-
+        ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);
 
         netif_tx_lock_bh(local->mdev);
         netif_addr_lock(local->mdev);
@@ -546,12 +545,9 @@ void ieee80211_scan_work(struct work_struct *work)
 
                 if (!skip) {
                         local->scan_channel = chan;
-                        if (ieee80211_hw_config(local)) {
-                                printk(KERN_DEBUG "%s: failed to set freq to "
-                                       "%d MHz for scan\n", wiphy_name(local->hw.wiphy),
-                                       chan->center_freq);
+                        if (ieee80211_hw_config(local,
+                                                IEEE80211_CONF_CHANGE_CHANNEL))
                                 skip = 1;
-                        }
                 }
 
                 /* advance state machine to next channel/band */
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index d254446b85b5..10c5539c20ab 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -137,14 +137,12 @@ struct sta_info *sta_info_get_by_idx(struct ieee80211_local *local, int idx,
 static void __sta_info_free(struct ieee80211_local *local,
                             struct sta_info *sta)
 {
-        DECLARE_MAC_BUF(mbuf);
-
         rate_control_free_sta(sta);
         rate_control_put(sta->rate_ctrl);
 
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
-        printk(KERN_DEBUG "%s: Destroyed STA %s\n",
-               wiphy_name(local->hw.wiphy), print_mac(mbuf, sta->sta.addr));
+        printk(KERN_DEBUG "%s: Destroyed STA %pM\n",
+               wiphy_name(local->hw.wiphy), sta->sta.addr);
 #endif /* CONFIG_MAC80211_VERBOSE_DEBUG */
 
         kfree(sta);
@@ -222,7 +220,6 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_local *local = sdata->local;
         struct sta_info *sta;
         int i;
-        DECLARE_MAC_BUF(mbuf);
 
         sta = kzalloc(sizeof(*sta) + local->hw.sta_data_size, gfp);
         if (!sta)
@@ -263,8 +260,8 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
         skb_queue_head_init(&sta->tx_filtered);
 
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
-        printk(KERN_DEBUG "%s: Allocated STA %s\n",
-               wiphy_name(local->hw.wiphy), print_mac(mbuf, sta->sta.addr));
+        printk(KERN_DEBUG "%s: Allocated STA %pM\n",
+               wiphy_name(local->hw.wiphy), sta->sta.addr);
 #endif /* CONFIG_MAC80211_VERBOSE_DEBUG */
 
 #ifdef CONFIG_MAC80211_MESH
@@ -281,7 +278,6 @@ int sta_info_insert(struct sta_info *sta)
         struct ieee80211_sub_if_data *sdata = sta->sdata;
         unsigned long flags;
         int err = 0;
-        DECLARE_MAC_BUF(mac);
 
         /*
          * Can't be a WARN_ON because it can be triggered through a race:
@@ -294,7 +290,7 @@ int sta_info_insert(struct sta_info *sta)
         }
 
         if (WARN_ON(compare_ether_addr(sta->sta.addr, sdata->dev->dev_addr) == 0 ||
-                    is_multicast_ether_addr(sta->sta.addr))) {
+                    is_multicast_ether_addr(sta->sta.addr))) {
                 err = -EINVAL;
                 goto out_free;
         }
@@ -322,8 +318,8 @@ int sta_info_insert(struct sta_info *sta)
         }
 
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
-        printk(KERN_DEBUG "%s: Inserted STA %s\n",
-               wiphy_name(local->hw.wiphy), print_mac(mac, sta->sta.addr));
+        printk(KERN_DEBUG "%s: Inserted STA %pM\n",
+               wiphy_name(local->hw.wiphy), sta->sta.addr);
 #endif /* CONFIG_MAC80211_VERBOSE_DEBUG */
 
         spin_unlock_irqrestore(&local->sta_lock, flags);
@@ -423,9 +419,6 @@ static void __sta_info_unlink(struct sta_info **sta)
 {
         struct ieee80211_local *local = (*sta)->local;
         struct ieee80211_sub_if_data *sdata = (*sta)->sdata;
-#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
-        DECLARE_MAC_BUF(mbuf);
-#endif
         /*
          * pull caller's reference if we're already gone.
          */
@@ -468,8 +461,8 @@ static void __sta_info_unlink(struct sta_info **sta)
         }
 
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
-        printk(KERN_DEBUG "%s: Removed STA %s\n",
-               wiphy_name(local->hw.wiphy), print_mac(mbuf, (*sta)->sta.addr));
+        printk(KERN_DEBUG "%s: Removed STA %pM\n",
+               wiphy_name(local->hw.wiphy), (*sta)->sta.addr);
 #endif /* CONFIG_MAC80211_VERBOSE_DEBUG */
 
         /*
@@ -544,7 +537,6 @@ static void sta_info_cleanup_expire_buffered(struct ieee80211_local *local,
         unsigned long flags;
         struct sk_buff *skb;
         struct ieee80211_sub_if_data *sdata;
-        DECLARE_MAC_BUF(mac);
 
         if (skb_queue_empty(&sta->ps_tx_buf))
                 return;
@@ -564,8 +556,8 @@ static void sta_info_cleanup_expire_buffered(struct ieee80211_local *local,
                 sdata = sta->sdata;
                 local->total_ps_buffered--;
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
-                printk(KERN_DEBUG "Buffered frame expired (STA "
-                       "%s)\n", print_mac(mac, sta->sta.addr));
+                printk(KERN_DEBUG "Buffered frame expired (STA %pM)\n",
+                       sta->sta.addr);
 #endif
                 dev_kfree_skb(skb);
 
@@ -809,15 +801,14 @@ void ieee80211_sta_expire(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_local *local = sdata->local;
         struct sta_info *sta, *tmp;
         LIST_HEAD(tmp_list);
-        DECLARE_MAC_BUF(mac);
         unsigned long flags;
 
         spin_lock_irqsave(&local->sta_lock, flags);
         list_for_each_entry_safe(sta, tmp, &local->sta_list, list)
                 if (time_after(jiffies, sta->last_rx + exp_time)) {
 #ifdef CONFIG_MAC80211_IBSS_DEBUG
-                        printk(KERN_DEBUG "%s: expiring inactive STA %s\n",
-                               sdata->dev->name, print_mac(mac, sta->sta.addr));
+                        printk(KERN_DEBUG "%s: expiring inactive STA %pM\n",
+                               sdata->dev->name, sta->sta.addr);
 #endif
                         __sta_info_unlink(&sta);
                         if (sta)
@@ -830,7 +821,7 @@ void ieee80211_sta_expire(struct ieee80211_sub_if_data *sdata,
 }
 
 struct ieee80211_sta *ieee80211_find_sta(struct ieee80211_hw *hw,
-                                         const u8 *addr)
+                                         const u8 *addr)
 {
         struct sta_info *sta = sta_info_get(hw_to_local(hw), addr);
 
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index 168a39a298bd..dc2606d0ae77 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -160,18 +160,17 @@ struct sta_ampdu_mlme {
  * @list: global linked list entry
  * @hnext: hash table linked list pointer
  * @local: pointer to the global information
- * @sdata: TBD
- * @key: TBD
- * @rate_ctrl: TBD
- * @rate_ctrl_priv: TBD
+ * @sdata: virtual interface this station belongs to
+ * @key: peer key negotiated with this station, if any
+ * @rate_ctrl: rate control algorithm reference
+ * @rate_ctrl_priv: rate control private per-STA pointer
+ * @last_tx_rate: rate used for last transmit, to report to userspace as
+ *      "the" transmit rate
  * @lock: used for locking all fields that require locking, see comments
  *      in the header file.
  * @flaglock: spinlock for flags accesses
- * @addr: MAC address of this STA
- * @aid: STA's unique AID (1..2007, 0 = not assigned yet),
- *      only used in AP (and IBSS?) mode
- * @listen_interval: TBD
- * @pin_status: TBD
+ * @listen_interval: listen interval of this station, when we're acting as AP
+ * @pin_status: used internally for pinning a STA struct into memory
  * @flags: STA flags, see &enum ieee80211_sta_info_flags
  * @ps_tx_buf: buffer of frames to transmit to this station
  *      when it leaves power saving state
@@ -180,8 +179,8 @@ struct sta_ampdu_mlme {
  *      power saving state
  * @rx_packets: Number of MSDUs received from this STA
  * @rx_bytes: Number of bytes received from this STA
- * @wep_weak_iv_count: TBD
- * @last_rx: TBD
+ * @wep_weak_iv_count: number of weak WEP IVs received from this station
+ * @last_rx: time (in jiffies) when last frame was received from this STA
  * @num_duplicates: number of duplicate frames received from this STA
  * @rx_fragments: number of received MPDUs
  * @rx_dropped: number of dropped MPDUs from this STA
@@ -189,26 +188,26 @@ struct sta_ampdu_mlme {
  * @last_qual: qual of last received frame from this STA
  * @last_noise: noise of last received frame from this STA
  * @last_seq_ctrl: last received seq/frag number from this STA (per RX queue)
- * @tx_filtered_count: TBD
- * @tx_retry_failed: TBD
- * @tx_retry_count: TBD
+ * @tx_filtered_count: number of frames the hardware filtered for this STA
+ * @tx_retry_failed: number of frames that failed retry
+ * @tx_retry_count: total number of retries for frames to this STA
  * @fail_avg: moving percentage of failed MSDUs
  * @tx_packets: number of RX/TX MSDUs
- * @tx_bytes: TBD
+ * @tx_bytes: number of bytes transmitted to this STA
  * @tx_fragments: number of transmitted MPDUs
- * @last_txrate_idx: Index of the last used transmit rate
- * @tid_seq: TBD
- * @ampdu_mlme: TBD
+ * @last_txrate: description of the last used transmit rate
+ * @tid_seq: per-TID sequence numbers for sending to this STA
+ * @ampdu_mlme: A-MPDU state machine state
  * @timer_to_tid: identity mapping to ID timers
  * @tid_to_tx_q: map tid to tx queue
  * @llid: Local link ID
  * @plid: Peer link ID
  * @reason: Cancel reason on PLINK_HOLDING state
  * @plink_retries: Retries in establishment
- * @ignore_plink_timer: TBD
- * @plink_state plink_state: TBD
- * @plink_timeout: TBD
- * @plink_timer: TBD
+ * @ignore_plink_timer: ignore the peer-link timer (used internally)
+ * @plink_state: peer link state
+ * @plink_timeout: timeout of peer link
+ * @plink_timer: peer link watch timer
  * @debugfs: debug filesystem info
  * @sta: station information we share with the driver
  */
@@ -267,7 +266,7 @@ struct sta_info {
         unsigned long tx_packets;
         unsigned long tx_bytes;
         unsigned long tx_fragments;
-        unsigned int last_txrate_idx;
+        struct ieee80211_tx_rate last_tx_rate;
         u16 tid_seq[IEEE80211_QOS_CTL_TID_MASK + 1];
 
         /*
diff --git a/net/mac80211/tkip.c b/net/mac80211/tkip.c
index 34b32bc8f609..38fa111d2dc6 100644
--- a/net/mac80211/tkip.c
+++ b/net/mac80211/tkip.c
@@ -263,10 +263,9 @@ int ieee80211_tkip_decrypt_data(struct crypto_blkcipher *tfm,
              (iv32 == key->u.tkip.rx[queue].iv32 &&
               iv16 <= key->u.tkip.rx[queue].iv16))) {
 #ifdef CONFIG_MAC80211_TKIP_DEBUG
-                DECLARE_MAC_BUF(mac);
                 printk(KERN_DEBUG "TKIP replay detected for RX frame from "
-                       "%s (RX IV (%04x,%02x) <= prev. IV (%04x,%02x)\n",
-                       print_mac(mac, ta),
+                       "%pM (RX IV (%04x,%02x) <= prev. IV (%04x,%02x)\n",
+                       ta,
                        iv32, iv16, key->u.tkip.rx[queue].iv32,
                        key->u.tkip.rx[queue].iv16);
 #endif
@@ -287,9 +286,8 @@ int ieee80211_tkip_decrypt_data(struct crypto_blkcipher *tfm,
                 {
                         int i;
                         u8 key_offset = NL80211_TKIP_DATA_OFFSET_ENCR_KEY;
-                        DECLARE_MAC_BUF(mac);
-                        printk(KERN_DEBUG "TKIP decrypt: Phase1 TA=%s"
-                               " TK=", print_mac(mac, ta));
+                        printk(KERN_DEBUG "TKIP decrypt: Phase1 TA=%pM"
+                               " TK=", ta);
                         for (i = 0; i < 16; i++)
                                 printk("%02x ",
                                        key->conf.key[key_offset + i]);
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 1460537faf33..a4af3a124cce 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -46,13 +46,20 @@ static __le16 ieee80211_duration(struct ieee80211_tx_data *tx, int group_addr,
         struct ieee80211_local *local = tx->local;
         struct ieee80211_supported_band *sband;
         struct ieee80211_hdr *hdr;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
+
+        /* assume HW handles this */
+        if (info->control.rates[0].flags & IEEE80211_TX_RC_MCS)
+                return 0;
+
+        /* uh huh? */
+        if (WARN_ON_ONCE(info->control.rates[0].idx < 0))
+                return 0;
 
         sband = local->hw.wiphy->bands[tx->channel->band];
-        txrate = &sband->bitrates[tx->rate_idx];
+        txrate = &sband->bitrates[info->control.rates[0].idx];
 
-        erp = 0;
-        if (tx->sdata->flags & IEEE80211_SDATA_OPERATING_GMODE)
-                erp = txrate->flags & IEEE80211_RATE_ERP_G;
+        erp = txrate->flags & IEEE80211_RATE_ERP_G;
 
         /*
          * data and mgmt (except PS Poll):
@@ -116,7 +123,7 @@ static __le16 ieee80211_duration(struct ieee80211_tx_data *tx, int group_addr,
                 if (r->bitrate > txrate->bitrate)
                         break;
 
-                if (tx->sdata->bss_conf.basic_rates & BIT(i))
+                if (tx->sdata->vif.bss_conf.basic_rates & BIT(i))
                         rate = r->bitrate;
 
                 switch (sband->band) {
@@ -150,7 +157,7 @@ static __le16 ieee80211_duration(struct ieee80211_tx_data *tx, int group_addr,
          * to closest integer */
 
         dur = ieee80211_frame_duration(local, 10, rate, erp,
-                                tx->sdata->bss_conf.use_short_preamble);
+                                tx->sdata->vif.bss_conf.use_short_preamble);
 
         if (next_frag_len) {
                 /* Frame is fragmented: duration increases with time needed to
@@ -159,7 +166,7 @@ static __le16 ieee80211_duration(struct ieee80211_tx_data *tx, int group_addr,
                 /* next fragment */
                 dur += ieee80211_frame_duration(local, next_frag_len,
                                 txrate->bitrate, erp,
-                                tx->sdata->bss_conf.use_short_preamble);
+                                tx->sdata->vif.bss_conf.use_short_preamble);
         }
 
         return cpu_to_le16(dur);
@@ -201,10 +208,9 @@ ieee80211_tx_h_check_assoc(struct ieee80211_tx_data *tx)
                              tx->sdata->vif.type != NL80211_IFTYPE_ADHOC &&
                              ieee80211_is_data(hdr->frame_control))) {
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
-                        DECLARE_MAC_BUF(mac);
                         printk(KERN_DEBUG "%s: dropped data frame to not "
-                               "associated station %s\n",
-                               tx->dev->name, print_mac(mac, hdr->addr1));
+                               "associated station %pM\n",
+                               tx->dev->name, hdr->addr1);
 #endif /* CONFIG_MAC80211_VERBOSE_DEBUG */
                         I802_DEBUG_INC(tx->local->tx_handlers_drop_not_assoc);
                         return TX_DROP;
@@ -331,7 +337,6 @@ ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx)
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
         u32 staflags;
-        DECLARE_MAC_BUF(mac);
 
         if (unlikely(!sta || ieee80211_is_probe_resp(hdr->frame_control)))
                 return TX_CONTINUE;
@@ -341,9 +346,9 @@ ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx)
         if (unlikely((staflags & WLAN_STA_PS) &&
                      !(staflags & WLAN_STA_PSPOLL))) {
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
-                printk(KERN_DEBUG "STA %s aid %d: PS buffer (entries "
+                printk(KERN_DEBUG "STA %pM aid %d: PS buffer (entries "
                        "before %d)\n",
-                       print_mac(mac, sta->sta.addr), sta->sta.aid,
+                       sta->sta.addr, sta->sta.aid,
                        skb_queue_len(&sta->ps_tx_buf));
 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
                 if (tx->local->total_ps_buffered >= TOTAL_MAX_TX_BUFFER)
@@ -352,9 +357,9 @@ ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx)
                         struct sk_buff *old = skb_dequeue(&sta->ps_tx_buf);
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
                         if (net_ratelimit()) {
-                                printk(KERN_DEBUG "%s: STA %s TX "
+                                printk(KERN_DEBUG "%s: STA %pM TX "
                                        "buffer full - dropping oldest frame\n",
-                                       tx->dev->name, print_mac(mac, sta->sta.addr));
+                                       tx->dev->name, sta->sta.addr);
                         }
 #endif
                         dev_kfree_skb(old);
@@ -371,9 +376,9 @@ ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx)
         }
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
         else if (unlikely(test_sta_flags(sta, WLAN_STA_PS))) {
-                printk(KERN_DEBUG "%s: STA %s in PS mode, but pspoll "
+                printk(KERN_DEBUG "%s: STA %pM in PS mode, but pspoll "
                        "set -> send frame\n", tx->dev->name,
-                       print_mac(mac, sta->sta.addr));
+                       sta->sta.addr);
         }
 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
         clear_sta_flags(sta, WLAN_STA_PSPOLL);
@@ -439,140 +444,154 @@ ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx)
 static ieee80211_tx_result debug_noinline
 ieee80211_tx_h_rate_ctrl(struct ieee80211_tx_data *tx)
 {
-        struct rate_selection rsel;
-        struct ieee80211_supported_band *sband;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
+        struct ieee80211_hdr *hdr = (void *)tx->skb->data;
+        struct ieee80211_supported_band *sband;
+        struct ieee80211_rate *rate;
+        int i, len;
+        bool inval = false, rts = false, short_preamble = false;
+        struct ieee80211_tx_rate_control txrc;
 
-        sband = tx->local->hw.wiphy->bands[tx->channel->band];
+        memset(&txrc, 0, sizeof(txrc));
 
-        if (likely(tx->rate_idx < 0)) {
-                rate_control_get_rate(tx->sdata, sband, tx->sta,
-                                      tx->skb, &rsel);
-                if (tx->sta)
-                        tx->sta->last_txrate_idx = rsel.rate_idx;
-                tx->rate_idx = rsel.rate_idx;
-                if (unlikely(rsel.probe_idx >= 0)) {
-                        info->flags |= IEEE80211_TX_CTL_RATE_CTRL_PROBE;
-                        tx->flags |= IEEE80211_TX_PROBE_LAST_FRAG;
-                        info->control.retries[0].rate_idx = tx->rate_idx;
-                        info->control.retries[0].limit = tx->local->hw.max_altrate_tries;
-                        tx->rate_idx = rsel.probe_idx;
-                } else if (info->control.retries[0].limit == 0)
-                        info->control.retries[0].rate_idx = -1;
-
-                if (unlikely(tx->rate_idx < 0))
-                        return TX_DROP;
-        } else
-                info->control.retries[0].rate_idx = -1;
+        sband = tx->local->hw.wiphy->bands[tx->channel->band];
 
-        if (tx->sdata->bss_conf.use_cts_prot &&
-            (tx->flags & IEEE80211_TX_FRAGMENTED) && (rsel.nonerp_idx >= 0)) {
-                tx->last_frag_rate_idx = tx->rate_idx;
-                if (rsel.probe_idx >= 0)
-                        tx->flags &= ~IEEE80211_TX_PROBE_LAST_FRAG;
-                else
-                        tx->flags |= IEEE80211_TX_PROBE_LAST_FRAG;
-                tx->rate_idx = rsel.nonerp_idx;
-                info->tx_rate_idx = rsel.nonerp_idx;
-                info->flags &= ~IEEE80211_TX_CTL_RATE_CTRL_PROBE;
-        } else {
-                tx->last_frag_rate_idx = tx->rate_idx;
-                info->tx_rate_idx = tx->rate_idx;
+        len = min_t(int, tx->skb->len + FCS_LEN,
+                         tx->local->fragmentation_threshold);
+
+        /* set up the tx rate control struct we give the RC algo */
+        txrc.hw = local_to_hw(tx->local);
+        txrc.sband = sband;
+        txrc.bss_conf = &tx->sdata->vif.bss_conf;
+        txrc.skb = tx->skb;
+        txrc.reported_rate.idx = -1;
+        txrc.max_rate_idx = tx->sdata->max_ratectrl_rateidx;
+
+        /* set up RTS protection if desired */
+        if (tx->local->rts_threshold < IEEE80211_MAX_RTS_THRESHOLD &&
+            len > tx->local->rts_threshold) {
+                txrc.rts = rts = true;
         }
-        info->tx_rate_idx = tx->rate_idx;
 
-        return TX_CONTINUE;
-}
+        /*
+         * Use short preamble if the BSS can handle it, but not for
+         * management frames unless we know the receiver can handle
+         * that -- the management frame might be to a station that
+         * just wants a probe response.
+         */
+        if (tx->sdata->vif.bss_conf.use_short_preamble &&
+            (ieee80211_is_data(hdr->frame_control) ||
+             (tx->sta && test_sta_flags(tx->sta, WLAN_STA_SHORT_PREAMBLE))))
+                txrc.short_preamble = short_preamble = true;
 
-static ieee80211_tx_result debug_noinline
-ieee80211_tx_h_misc(struct ieee80211_tx_data *tx)
-{
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
-        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
-        struct ieee80211_supported_band *sband;
 
-        sband = tx->local->hw.wiphy->bands[tx->channel->band];
+        rate_control_get_rate(tx->sdata, tx->sta, &txrc);
+
+        if (unlikely(info->control.rates[0].idx < 0))
+                return TX_DROP;
+
+        if (txrc.reported_rate.idx < 0)
+                txrc.reported_rate = info->control.rates[0];
 
         if (tx->sta)
-                info->control.sta = &tx->sta->sta;
+                tx->sta->last_tx_rate = txrc.reported_rate;
 
-        if (!info->control.retry_limit) {
-                if (!is_multicast_ether_addr(hdr->addr1)) {
-                        int len = min_t(int, tx->skb->len + FCS_LEN,
-                                        tx->local->fragmentation_threshold);
-                        if (len > tx->local->rts_threshold
-                            && tx->local->rts_threshold <
-                                                IEEE80211_MAX_RTS_THRESHOLD) {
-                                info->flags |= IEEE80211_TX_CTL_USE_RTS_CTS;
-                                info->flags |=
-                                        IEEE80211_TX_CTL_LONG_RETRY_LIMIT;
-                                info->control.retry_limit =
-                                        tx->local->long_retry_limit;
-                        } else {
-                                info->control.retry_limit =
-                                        tx->local->short_retry_limit;
-                        }
-                } else {
-                        info->control.retry_limit = 1;
-                }
-        }
+        if (unlikely(!info->control.rates[0].count))
+                info->control.rates[0].count = 1;
 
-        if (tx->flags & IEEE80211_TX_FRAGMENTED) {
-                /* Do not use multiple retry rates when sending fragmented
-                 * frames.
-                 * TODO: The last fragment could still use multiple retry
-                 * rates. */
-                info->control.retries[0].rate_idx = -1;
+        if (is_multicast_ether_addr(hdr->addr1)) {
+                /*
+                 * XXX: verify the rate is in the basic rateset
+                 */
+                return TX_CONTINUE;
         }
 
-        /* Use CTS protection for unicast frames sent using extended rates if
-         * there are associated non-ERP stations and RTS/CTS is not configured
-         * for the frame. */
-        if ((tx->sdata->flags & IEEE80211_SDATA_OPERATING_GMODE) &&
-            (sband->bitrates[tx->rate_idx].flags & IEEE80211_RATE_ERP_G) &&
-            (tx->flags & IEEE80211_TX_UNICAST) &&
-            tx->sdata->bss_conf.use_cts_prot &&
-            !(info->flags & IEEE80211_TX_CTL_USE_RTS_CTS))
-                info->flags |= IEEE80211_TX_CTL_USE_CTS_PROTECT;
-
-        /* Transmit data frames using short preambles if the driver supports
-         * short preambles at the selected rate and short preambles are
-         * available on the network at the current point in time. */
-        if (ieee80211_is_data(hdr->frame_control) &&
-            (sband->bitrates[tx->rate_idx].flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
-            tx->sdata->bss_conf.use_short_preamble &&
-            (!tx->sta || test_sta_flags(tx->sta, WLAN_STA_SHORT_PREAMBLE))) {
-                info->flags |= IEEE80211_TX_CTL_SHORT_PREAMBLE;
+        /*
+         * set up the RTS/CTS rate as the fastest basic rate
+         * that is not faster than the data rate
+         *
+         * XXX: Should this check all retry rates?
+         */
+        if (!(info->control.rates[0].flags & IEEE80211_TX_RC_MCS)) {
+                s8 baserate = 0;
+
+                rate = &sband->bitrates[info->control.rates[0].idx];
+
+                for (i = 0; i < sband->n_bitrates; i++) {
+                        /* must be a basic rate */
+                        if (!(tx->sdata->vif.bss_conf.basic_rates & BIT(i)))
+                                continue;
+                        /* must not be faster than the data rate */
+                        if (sband->bitrates[i].bitrate > rate->bitrate)
+                                continue;
+                        /* maximum */
+                        if (sband->bitrates[baserate].bitrate <
+                             sband->bitrates[i].bitrate)
+                                baserate = i;
+                }
+
+                info->control.rts_cts_rate_idx = baserate;
         }
 
-        if ((info->flags & IEEE80211_TX_CTL_USE_RTS_CTS) ||
-            (info->flags & IEEE80211_TX_CTL_USE_CTS_PROTECT)) {
-                struct ieee80211_rate *rate;
-                s8 baserate = -1;
-                int idx;
+        for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
+                /*
+                 * make sure there's no valid rate following
+                 * an invalid one, just in case drivers don't
+                 * take the API seriously to stop at -1.
+                 */
+                if (inval) {
+                        info->control.rates[i].idx = -1;
+                        continue;
+                }
+                if (info->control.rates[i].idx < 0) {
+                        inval = true;
+                        continue;
+                }
 
-                /* Do not use multiple retry rates when using RTS/CTS */
-                info->control.retries[0].rate_idx = -1;
+                /*
+                 * For now assume MCS is already set up correctly, this
+                 * needs to be fixed.
+                 */
+                if (info->control.rates[i].flags & IEEE80211_TX_RC_MCS) {
+                        WARN_ON(info->control.rates[i].idx > 76);
+                        continue;
+                }
 
-                /* Use min(data rate, max base rate) as CTS/RTS rate */
-                rate = &sband->bitrates[tx->rate_idx];
+                /* set up RTS protection if desired */
+                if (rts)
+                        info->control.rates[i].flags |=
+                                IEEE80211_TX_RC_USE_RTS_CTS;
 
-                for (idx = 0; idx < sband->n_bitrates; idx++) {
-                        if (sband->bitrates[idx].bitrate > rate->bitrate)
-                                continue;
-                        if (tx->sdata->bss_conf.basic_rates & BIT(idx) &&
-                            (baserate < 0 ||
-                             (sband->bitrates[baserate].bitrate
-                              < sband->bitrates[idx].bitrate)))
-                                baserate = idx;
+                /* RC is busted */
+                if (WARN_ON_ONCE(info->control.rates[i].idx >=
+                                 sband->n_bitrates)) {
+                        info->control.rates[i].idx = -1;
+                        continue;
                 }
 
-                if (baserate >= 0)
-                        info->control.rts_cts_rate_idx = baserate;
-                else
-                        info->control.rts_cts_rate_idx = 0;
+                rate = &sband->bitrates[info->control.rates[i].idx];
+
+                /* set up short preamble */
+                if (short_preamble &&
+                    rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
+                        info->control.rates[i].flags |=
+                                IEEE80211_TX_RC_USE_SHORT_PREAMBLE;
+
+                /* set up G protection */
+                if (!rts && tx->sdata->vif.bss_conf.use_cts_prot &&
+                    rate->flags & IEEE80211_RATE_ERP_G)
+                        info->control.rates[i].flags |=
+                                IEEE80211_TX_RC_USE_CTS_PROTECT;
         }
 
+        return TX_CONTINUE;
+}
+
+static ieee80211_tx_result debug_noinline
+ieee80211_tx_h_misc(struct ieee80211_tx_data *tx)
+{
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
+
         if (tx->sta)
                 info->control.sta = &tx->sta->sta;
 
@@ -602,8 +621,18 @@ ieee80211_tx_h_sequence(struct ieee80211_tx_data *tx)
         if (ieee80211_hdrlen(hdr->frame_control) < 24)
                 return TX_CONTINUE;
 
+        /*
+         * Anything but QoS data that has a sequence number field
+         * (is long enough) gets a sequence number from the global
+         * counter.
+         */
         if (!ieee80211_is_data_qos(hdr->frame_control)) {
+                /* driver should assign sequence number */
                 info->flags |= IEEE80211_TX_CTL_ASSIGN_SEQ;
+                /* for pure STA mode without beacons, we can do it */
+                hdr->seq_ctrl = cpu_to_le16(tx->sdata->sequence_number);
+                tx->sdata->sequence_number += 0x10;
+                tx->sdata->sequence_number &= IEEE80211_SCTL_SEQ;
                 return TX_CONTINUE;
         }
 
@@ -632,6 +661,7 @@ ieee80211_tx_h_sequence(struct ieee80211_tx_data *tx)
 static ieee80211_tx_result debug_noinline
 ieee80211_tx_h_fragment(struct ieee80211_tx_data *tx)
 {
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
         size_t hdrlen, per_fragm, num_fragm, payload_len, left;
         struct sk_buff **frags, *first, *frag;
@@ -648,9 +678,7 @@ ieee80211_tx_h_fragment(struct ieee80211_tx_data *tx)
          * This scenario is handled in __ieee80211_tx_prepare but extra
          * caution taken here as fragmented ampdu may cause Tx stop.
          */
-        if (WARN_ON(tx->flags & IEEE80211_TX_CTL_AMPDU ||
-                    skb_get_queue_mapping(tx->skb) >=
-                        ieee80211_num_regular_queues(&tx->local->hw)))
+        if (WARN_ON(info->flags & IEEE80211_TX_CTL_AMPDU))
                 return TX_DROP;
 
         first = tx->skb;
@@ -684,20 +712,45 @@ ieee80211_tx_h_fragment(struct ieee80211_tx_data *tx)
                                       IEEE80211_ENCRYPT_TAILROOM);
                 if (!frag)
                         goto fail;
+
                 /* Make sure that all fragments use the same priority so
                  * that they end up using the same TX queue */
                 frag->priority = first->priority;
+
                 skb_reserve(frag, tx->local->tx_headroom +
                                   IEEE80211_ENCRYPT_HEADROOM);
+
+                /* copy TX information */
+                info = IEEE80211_SKB_CB(frag);
+                memcpy(info, first->cb, sizeof(frag->cb));
+
+                /* copy/fill in 802.11 header */
                 fhdr = (struct ieee80211_hdr *) skb_put(frag, hdrlen);
                 memcpy(fhdr, first->data, hdrlen);
-                if (i == num_fragm - 2)
-                        fhdr->frame_control &= cpu_to_le16(~IEEE80211_FCTL_MOREFRAGS);
                 fhdr->seq_ctrl = cpu_to_le16(seq | ((i + 1) & IEEE80211_SCTL_FRAG));
+
+                if (i == num_fragm - 2) {
+                        /* clear MOREFRAGS bit for the last fragment */
+                        fhdr->frame_control &= cpu_to_le16(~IEEE80211_FCTL_MOREFRAGS);
+                } else {
+                        /*
+                         * No multi-rate retries for fragmented frames, that
+                         * would completely throw off the NAV at other STAs.
+                         */
+                        info->control.rates[1].idx = -1;
+                        info->control.rates[2].idx = -1;
+                        info->control.rates[3].idx = -1;
+                        info->control.rates[4].idx = -1;
+                        BUILD_BUG_ON(IEEE80211_TX_MAX_RATES != 5);
+                        info->flags &= ~IEEE80211_TX_CTL_RATE_CTRL_PROBE;
+                }
+
+                /* copy data */
                 copylen = left > per_fragm ? per_fragm : left;
                 memcpy(skb_put(frag, copylen), pos, copylen);
-                memcpy(frag->cb, first->cb, sizeof(frag->cb));
+
                 skb_copy_queue_mapping(frag, first);
+
                 frag->do_not_encrypt = first->do_not_encrypt;
 
                 pos += copylen;
@@ -757,12 +810,10 @@ ieee80211_tx_h_calculate_duration(struct ieee80211_tx_data *tx)
                                               tx->extra_frag[0]->len);
 
         for (i = 0; i < tx->num_extra_frag; i++) {
-                if (i + 1 < tx->num_extra_frag) {
+                if (i + 1 < tx->num_extra_frag)
                         next_len = tx->extra_frag[i + 1]->len;
-                } else {
+                else
                         next_len = 0;
-                        tx->rate_idx = tx->last_frag_rate_idx;
-                }
 
                 hdr = (struct ieee80211_hdr *)tx->extra_frag[i]->data;
                 hdr->duration_id = ieee80211_duration(tx, 0, next_len);
@@ -815,7 +866,6 @@ __ieee80211_parse_tx_radiotap(struct ieee80211_tx_data *tx,
                 (struct ieee80211_radiotap_header *) skb->data;
         struct ieee80211_supported_band *sband;
         int ret = ieee80211_radiotap_iterator_init(&iterator, rthdr, skb->len);
-        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 
         sband = tx->local->hw.wiphy->bands[tx->channel->band];
 
@@ -829,8 +879,6 @@ __ieee80211_parse_tx_radiotap(struct ieee80211_tx_data *tx,
          */
 
         while (!ret) {
-                int i, target_rate;
-
                 ret = ieee80211_radiotap_iterator_next(&iterator);
 
                 if (ret)
@@ -844,38 +892,6 @@ __ieee80211_parse_tx_radiotap(struct ieee80211_tx_data *tx,
                  * get_unaligned((type *)iterator.this_arg) to dereference
                  * iterator.this_arg for type "type" safely on all arches.
                 */
-                case IEEE80211_RADIOTAP_RATE:
-                        /*
-                         * radiotap rate u8 is in 500kbps units eg, 0x02=1Mbps
-                         * ieee80211 rate int is in 100kbps units eg, 0x0a=1Mbps
-                         */
-                        target_rate = (*iterator.this_arg) * 5;
-                        for (i = 0; i < sband->n_bitrates; i++) {
-                                struct ieee80211_rate *r;
-
-                                r = &sband->bitrates[i];
-
-                                if (r->bitrate == target_rate) {
-                                        tx->rate_idx = i;
-                                        break;
-                                }
-                        }
-                        break;
-
-                case IEEE80211_RADIOTAP_ANTENNA:
-                        /*
-                         * radiotap uses 0 for 1st ant, mac80211 is 1 for
-                         * 1st ant
-                         */
-                        info->antenna_sel_tx = (*iterator.this_arg) + 1;
-                        break;
-
-#if 0
-                case IEEE80211_RADIOTAP_DBM_TX_POWER:
-                        control->power_level = *iterator.this_arg;
-                        break;
-#endif
-
                 case IEEE80211_RADIOTAP_FLAGS:
                         if (*iterator.this_arg & IEEE80211_RADIOTAP_F_FCS) {
                                 /*
@@ -933,7 +949,8 @@ __ieee80211_tx_prepare(struct ieee80211_tx_data *tx,
         struct ieee80211_sub_if_data *sdata;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 
-        int hdrlen;
+        int hdrlen, tid;
+        u8 *qc, *state;
 
         memset(tx, 0, sizeof(*tx));
         tx->skb = skb;
@@ -941,8 +958,6 @@ __ieee80211_tx_prepare(struct ieee80211_tx_data *tx,
         tx->local = local;
         tx->sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         tx->channel = local->hw.conf.channel;
-        tx->rate_idx = -1;
-        tx->last_frag_rate_idx = -1;
         /*
          * Set this flag (used below to indicate "automatic fragmentation"),
          * it will be cleared/left by radiotap as desired.
@@ -966,6 +981,15 @@ __ieee80211_tx_prepare(struct ieee80211_tx_data *tx,
 
         tx->sta = sta_info_get(local, hdr->addr1);
 
+        if (tx->sta && ieee80211_is_data_qos(hdr->frame_control)) {
+                qc = ieee80211_get_qos_ctl(hdr);
+                tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
+
+                state = &tx->sta->ampdu_mlme.tid_state_tx[tid];
+                if (*state == HT_AGG_STATE_OPERATIONAL)
+                        info->flags |= IEEE80211_TX_CTL_AMPDU;
+        }
+
         if (is_multicast_ether_addr(hdr->addr1)) {
                 tx->flags &= ~IEEE80211_TX_UNICAST;
                 info->flags |= IEEE80211_TX_CTL_NO_ACK;
@@ -977,7 +1001,6 @@ __ieee80211_tx_prepare(struct ieee80211_tx_data *tx,
         if (tx->flags & IEEE80211_TX_FRAGMENTED) {
                 if ((tx->flags & IEEE80211_TX_UNICAST) &&
                     skb->len + FCS_LEN > local->fragmentation_threshold &&
-                    !local->ops->set_frag_threshold &&
                     !(info->flags & IEEE80211_TX_CTL_AMPDU))
                         tx->flags |= IEEE80211_TX_FRAGMENTED;
                 else
@@ -1043,23 +1066,11 @@ static int __ieee80211_tx(struct ieee80211_local *local, struct sk_buff *skb,
                         if (!tx->extra_frag[i])
                                 continue;
                         info = IEEE80211_SKB_CB(tx->extra_frag[i]);
-                        info->flags &= ~(IEEE80211_TX_CTL_USE_RTS_CTS |
-                                         IEEE80211_TX_CTL_USE_CTS_PROTECT |
-                                         IEEE80211_TX_CTL_CLEAR_PS_FILT |
+                        info->flags &= ~(IEEE80211_TX_CTL_CLEAR_PS_FILT |
                                          IEEE80211_TX_CTL_FIRST_FRAGMENT);
                         if (netif_subqueue_stopped(local->mdev,
                                                    tx->extra_frag[i]))
                                 return IEEE80211_TX_FRAG_AGAIN;
-                        if (i == tx->num_extra_frag) {
-                                info->tx_rate_idx = tx->last_frag_rate_idx;
-
-                                if (tx->flags & IEEE80211_TX_PROBE_LAST_FRAG)
-                                        info->flags |=
-                                                IEEE80211_TX_CTL_RATE_CTRL_PROBE;
-                                else
-                                        info->flags &=
-                                                ~IEEE80211_TX_CTL_RATE_CTRL_PROBE;
-                        }
 
                         ret = local->ops->tx(local_to_hw(local),
                                             tx->extra_frag[i]);
@@ -1168,7 +1179,7 @@ retry:
                  * queues, there's no reason for a driver to reject
                  * a frame there, warn and drop it.
                  */
-                if (WARN_ON(queue >= ieee80211_num_regular_queues(&local->hw)))
+                if (WARN_ON(info->flags & IEEE80211_TX_CTL_AMPDU))
                         goto drop;
 
                 store = &local->pending_packet[queue];
@@ -1196,9 +1207,6 @@ retry:
                 store->skb = skb;
                 store->extra_frag = tx.extra_frag;
                 store->num_extra_frag = tx.num_extra_frag;
-                store->last_frag_rate_idx = tx.last_frag_rate_idx;
-                store->last_frag_rate_ctrl_probe =
-                        !!(tx.flags & IEEE80211_TX_PROBE_LAST_FRAG);
         }
  out:
         rcu_read_unlock();
@@ -1465,6 +1473,19 @@ int ieee80211_subif_start_xmit(struct sk_buff *skb,
                 goto fail;
         }
 
+        if (!(local->hw.flags & IEEE80211_HW_NO_STACK_DYNAMIC_PS) &&
+            local->dynamic_ps_timeout > 0) {
+                if (local->hw.conf.flags & IEEE80211_CONF_PS) {
+                        ieee80211_stop_queues_by_reason(&local->hw,
+                                                        IEEE80211_QUEUE_STOP_REASON_PS);
+                        queue_work(local->hw.workqueue,
+                                   &local->dynamic_ps_disable_work);
+                }
+
+                mod_timer(&local->dynamic_ps_timer, jiffies +
+                          msecs_to_jiffies(local->dynamic_ps_timeout));
+        }
+
         nh_pos = skb_network_header(skb) - skb->data;
         h_pos = skb_transport_header(skb) - skb->data;
 
@@ -1593,12 +1614,10 @@ int ieee80211_subif_start_xmit(struct sk_buff *skb,
                        compare_ether_addr(dev->dev_addr,
                                           skb->data + ETH_ALEN) == 0))) {
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
-                DECLARE_MAC_BUF(mac);
-
                 if (net_ratelimit())
-                        printk(KERN_DEBUG "%s: dropped frame to %s"
+                        printk(KERN_DEBUG "%s: dropped frame to %pM"
                                " (unauthorized port)\n", dev->name,
-                               print_mac(mac, hdr.addr1));
+                               hdr.addr1);
 #endif
 
                 I802_DEBUG_INC(local->tx_handlers_drop_unauth_port);
@@ -1757,10 +1776,7 @@ void ieee80211_tx_pending(unsigned long data)
                 store = &local->pending_packet[i];
                 tx.extra_frag = store->extra_frag;
                 tx.num_extra_frag = store->num_extra_frag;
-                tx.last_frag_rate_idx = store->last_frag_rate_idx;
                 tx.flags = 0;
-                if (store->last_frag_rate_ctrl_probe)
-                        tx.flags |= IEEE80211_TX_PROBE_LAST_FRAG;
                 ret = __ieee80211_tx(local, store->skb, &tx);
                 if (ret) {
                         if (ret == IEEE80211_TX_FRAG_AGAIN)
@@ -1775,8 +1791,7 @@ void ieee80211_tx_pending(unsigned long data)
 
 /* functions for drivers to get certain frames */
 
-static void ieee80211_beacon_add_tim(struct ieee80211_local *local,
-                                     struct ieee80211_if_ap *bss,
+static void ieee80211_beacon_add_tim(struct ieee80211_if_ap *bss,
                                      struct sk_buff *skb,
                                      struct beacon_data *beacon)
 {
@@ -1844,11 +1859,9 @@ struct sk_buff *ieee80211_beacon_get(struct ieee80211_hw *hw,
         struct ieee80211_local *local = hw_to_local(hw);
         struct sk_buff *skb = NULL;
         struct ieee80211_tx_info *info;
-        struct net_device *bdev;
         struct ieee80211_sub_if_data *sdata = NULL;
         struct ieee80211_if_ap *ap = NULL;
         struct ieee80211_if_sta *ifsta = NULL;
-        struct rate_selection rsel;
         struct beacon_data *beacon;
         struct ieee80211_supported_band *sband;
         enum ieee80211_band band = local->hw.conf.channel->band;
@@ -1858,7 +1871,6 @@ struct sk_buff *ieee80211_beacon_get(struct ieee80211_hw *hw,
         rcu_read_lock();
 
         sdata = vif_to_sdata(vif);
-        bdev = sdata->dev;
 
         if (sdata->vif.type == NL80211_IFTYPE_AP) {
                 ap = &sdata->u.ap;
@@ -1886,12 +1898,12 @@ struct sk_buff *ieee80211_beacon_get(struct ieee80211_hw *hw,
                          * of the tim bitmap in mac80211 and the driver.
                          */
                         if (local->tim_in_locked_section) {
-                                ieee80211_beacon_add_tim(local, ap, skb, beacon);
+                                ieee80211_beacon_add_tim(ap, skb, beacon);
                         } else {
                                 unsigned long flags;
 
                                 spin_lock_irqsave(&local->sta_lock, flags);
-                                ieee80211_beacon_add_tim(local, ap, skb, beacon);
+                                ieee80211_beacon_add_tim(ap, skb, beacon);
                                 spin_unlock_irqrestore(&local->sta_lock, flags);
                         }
 
@@ -1952,33 +1964,23 @@ struct sk_buff *ieee80211_beacon_get(struct ieee80211_hw *hw,
         skb->do_not_encrypt = 1;
 
         info->band = band;
-        rate_control_get_rate(sdata, sband, NULL, skb, &rsel);
-
-        if (unlikely(rsel.rate_idx < 0)) {
-                if (net_ratelimit()) {
-                        printk(KERN_DEBUG "%s: ieee80211_beacon_get: "
-                               "no rate found\n",
-                               wiphy_name(local->hw.wiphy));
-                }
-                dev_kfree_skb_any(skb);
-                skb = NULL;
-                goto out;
-        }
+        /*
+         * XXX: For now, always use the lowest rate
+         */
+        info->control.rates[0].idx = 0;
+        info->control.rates[0].count = 1;
+        info->control.rates[1].idx = -1;
+        info->control.rates[2].idx = -1;
+        info->control.rates[3].idx = -1;
+        info->control.rates[4].idx = -1;
+        BUILD_BUG_ON(IEEE80211_TX_MAX_RATES != 5);
 
         info->control.vif = vif;
-        info->tx_rate_idx = rsel.rate_idx;
 
         info->flags |= IEEE80211_TX_CTL_NO_ACK;
         info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT;
         info->flags |= IEEE80211_TX_CTL_ASSIGN_SEQ;
-        if (sdata->bss_conf.use_short_preamble &&
-            sband->bitrates[rsel.rate_idx].flags & IEEE80211_RATE_SHORT_PREAMBLE)
-                info->flags |= IEEE80211_TX_CTL_SHORT_PREAMBLE;
-
-        info->antenna_sel_tx = local->hw.conf.antenna_sel_tx;
-        info->control.retry_limit = 1;
-
-out:
+ out:
         rcu_read_unlock();
         return skb;
 }
@@ -2023,14 +2025,12 @@ ieee80211_get_buffered_bc(struct ieee80211_hw *hw,
         struct sk_buff *skb = NULL;
         struct sta_info *sta;
         struct ieee80211_tx_data tx;
-        struct net_device *bdev;
         struct ieee80211_sub_if_data *sdata;
         struct ieee80211_if_ap *bss = NULL;
         struct beacon_data *beacon;
         struct ieee80211_tx_info *info;
 
         sdata = vif_to_sdata(vif);
-        bdev = sdata->dev;
         bss = &sdata->u.ap;
 
         if (!bss)
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index cee4884b9d06..fb89e1d0aa03 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -239,7 +239,7 @@ __le16 ieee80211_generic_frame_duration(struct ieee80211_hw *hw,
         erp = 0;
         if (vif) {
                 sdata = vif_to_sdata(vif);
-                short_preamble = sdata->bss_conf.use_short_preamble;
+                short_preamble = sdata->vif.bss_conf.use_short_preamble;
                 if (sdata->flags & IEEE80211_SDATA_OPERATING_GMODE)
                         erp = rate->flags & IEEE80211_RATE_ERP_G;
         }
@@ -272,7 +272,7 @@ __le16 ieee80211_rts_duration(struct ieee80211_hw *hw,
         erp = 0;
         if (vif) {
                 sdata = vif_to_sdata(vif);
-                short_preamble = sdata->bss_conf.use_short_preamble;
+                short_preamble = sdata->vif.bss_conf.use_short_preamble;
                 if (sdata->flags & IEEE80211_SDATA_OPERATING_GMODE)
                         erp = rate->flags & IEEE80211_RATE_ERP_G;
         }
@@ -312,7 +312,7 @@ __le16 ieee80211_ctstoself_duration(struct ieee80211_hw *hw,
         erp = 0;
         if (vif) {
                 sdata = vif_to_sdata(vif);
-                short_preamble = sdata->bss_conf.use_short_preamble;
+                short_preamble = sdata->vif.bss_conf.use_short_preamble;
                 if (sdata->flags & IEEE80211_SDATA_OPERATING_GMODE)
                         erp = rate->flags & IEEE80211_RATE_ERP_G;
         }
@@ -330,10 +330,20 @@ __le16 ieee80211_ctstoself_duration(struct ieee80211_hw *hw,
 }
 EXPORT_SYMBOL(ieee80211_ctstoself_duration);
 
-void ieee80211_wake_queue(struct ieee80211_hw *hw, int queue)
+static void __ieee80211_wake_queue(struct ieee80211_hw *hw, int queue,
+                                   enum queue_stop_reason reason)
 {
         struct ieee80211_local *local = hw_to_local(hw);
 
+        /* we don't need to track ampdu queues */
+        if (queue < ieee80211_num_regular_queues(hw)) {
+                __clear_bit(reason, &local->queue_stop_reasons[queue]);
+
+                if (local->queue_stop_reasons[queue] != 0)
+                        /* someone still has this queue stopped */
+                        return;
+        }
+
         if (test_bit(queue, local->queues_pending)) {
                 set_bit(queue, local->queues_pending_run);
                 tasklet_schedule(&local->tx_pending_tasklet);
@@ -341,22 +351,74 @@ void ieee80211_wake_queue(struct ieee80211_hw *hw, int queue)
                 netif_wake_subqueue(local->mdev, queue);
         }
 }
+
+void ieee80211_wake_queue_by_reason(struct ieee80211_hw *hw, int queue,
+                                    enum queue_stop_reason reason)
+{
+        struct ieee80211_local *local = hw_to_local(hw);
+        unsigned long flags;
+
+        spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
+        __ieee80211_wake_queue(hw, queue, reason);
+        spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
+}
+
+void ieee80211_wake_queue(struct ieee80211_hw *hw, int queue)
+{
+        ieee80211_wake_queue_by_reason(hw, queue,
+                                       IEEE80211_QUEUE_STOP_REASON_DRIVER);
+}
 EXPORT_SYMBOL(ieee80211_wake_queue);
 
-void ieee80211_stop_queue(struct ieee80211_hw *hw, int queue)
+static void __ieee80211_stop_queue(struct ieee80211_hw *hw, int queue,
+                                   enum queue_stop_reason reason)
 {
         struct ieee80211_local *local = hw_to_local(hw);
 
+        /* we don't need to track ampdu queues */
+        if (queue < ieee80211_num_regular_queues(hw))
+                __set_bit(reason, &local->queue_stop_reasons[queue]);
+
         netif_stop_subqueue(local->mdev, queue);
 }
+
+void ieee80211_stop_queue_by_reason(struct ieee80211_hw *hw, int queue,
+                                    enum queue_stop_reason reason)
+{
+        struct ieee80211_local *local = hw_to_local(hw);
+        unsigned long flags;
+
+        spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
+        __ieee80211_stop_queue(hw, queue, reason);
+        spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
+}
+
+void ieee80211_stop_queue(struct ieee80211_hw *hw, int queue)
+{
+        ieee80211_stop_queue_by_reason(hw, queue,
+                                       IEEE80211_QUEUE_STOP_REASON_DRIVER);
+}
 EXPORT_SYMBOL(ieee80211_stop_queue);
 
-void ieee80211_stop_queues(struct ieee80211_hw *hw)
+void ieee80211_stop_queues_by_reason(struct ieee80211_hw *hw,
+                                    enum queue_stop_reason reason)
 {
+        struct ieee80211_local *local = hw_to_local(hw);
+        unsigned long flags;
         int i;
 
+        spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
+
         for (i = 0; i < ieee80211_num_queues(hw); i++)
-                ieee80211_stop_queue(hw, i);
+                __ieee80211_stop_queue(hw, i, reason);
+
+        spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
+}
+
+void ieee80211_stop_queues(struct ieee80211_hw *hw)
+{
+        ieee80211_stop_queues_by_reason(hw,
+                                        IEEE80211_QUEUE_STOP_REASON_DRIVER);
 }
 EXPORT_SYMBOL(ieee80211_stop_queues);
 
@@ -367,12 +429,24 @@ int ieee80211_queue_stopped(struct ieee80211_hw *hw, int queue)
 }
 EXPORT_SYMBOL(ieee80211_queue_stopped);
 
-void ieee80211_wake_queues(struct ieee80211_hw *hw)
+void ieee80211_wake_queues_by_reason(struct ieee80211_hw *hw,
+                                     enum queue_stop_reason reason)
 {
+        struct ieee80211_local *local = hw_to_local(hw);
+        unsigned long flags;
         int i;
 
+        spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
+
         for (i = 0; i < hw->queues + hw->ampdu_queues; i++)
-                ieee80211_wake_queue(hw, i);
+                __ieee80211_wake_queue(hw, i, reason);
+
+        spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
+}
+
+void ieee80211_wake_queues(struct ieee80211_hw *hw)
+{
+        ieee80211_wake_queues_by_reason(hw, IEEE80211_QUEUE_STOP_REASON_DRIVER);
 }
 EXPORT_SYMBOL(ieee80211_wake_queues);
 
@@ -532,8 +606,8 @@ void ieee802_11_parse_elems(u8 *start, size_t len,
                         if (elen >= sizeof(struct ieee80211_ht_cap))
                                 elems->ht_cap_elem = (void *)pos;
                         break;
-                case WLAN_EID_HT_EXTRA_INFO:
-                        if (elen >= sizeof(struct ieee80211_ht_addt_info))
+                case WLAN_EID_HT_INFORMATION:
+                        if (elen >= sizeof(struct ieee80211_ht_info))
                                 elems->ht_info_elem = (void *)pos;
                         break;
                 case WLAN_EID_MESH_ID:
@@ -638,19 +712,16 @@ int ieee80211_set_freq(struct ieee80211_sub_if_data *sdata, int freqMHz)
 
         if (chan && !(chan->flags & IEEE80211_CHAN_DISABLED)) {
                 if (sdata->vif.type == NL80211_IFTYPE_ADHOC &&
-                    chan->flags & IEEE80211_CHAN_NO_IBSS) {
-                        printk(KERN_DEBUG "%s: IBSS not allowed on frequency "
-                                "%d MHz\n", sdata->dev->name, chan->center_freq);
+                    chan->flags & IEEE80211_CHAN_NO_IBSS)
                         return ret;
-                }
                 local->oper_channel = chan;
+                local->oper_channel_type = NL80211_CHAN_NO_HT;
 
                 if (local->sw_scanning || local->hw_scanning)
                         ret = 0;
                 else
-                        ret = ieee80211_hw_config(local);
-
-                rate_control_clear(local);
+                        ret = ieee80211_hw_config(
+                                local, IEEE80211_CONF_CHANGE_CHANNEL);
         }
 
         return ret;
diff --git a/net/mac80211/wep.c b/net/mac80211/wep.c
index f0e2d3ecb5c4..7043ddc75498 100644
--- a/net/mac80211/wep.c
+++ b/net/mac80211/wep.c
@@ -17,6 +17,7 @@
 #include <linux/err.h>
 #include <linux/mm.h>
 #include <linux/scatterlist.h>
+#include <asm/unaligned.h>
 
 #include <net/mac80211.h>
 #include "ieee80211_i.h"
@@ -49,17 +50,19 @@ void ieee80211_wep_free(struct ieee80211_local *local)
         crypto_free_blkcipher(local->wep_rx_tfm);
 }
 
-static inline int ieee80211_wep_weak_iv(u32 iv, int keylen)
+static inline bool ieee80211_wep_weak_iv(u32 iv, int keylen)
 {
-        /* Fluhrer, Mantin, and Shamir have reported weaknesses in the
+        /*
+         * Fluhrer, Mantin, and Shamir have reported weaknesses in the
          * key scheduling algorithm of RC4. At least IVs (KeyByte + 3,
-         * 0xff, N) can be used to speedup attacks, so avoid using them. */
+         * 0xff, N) can be used to speedup attacks, so avoid using them.
+         */
         if ((iv & 0xff00) == 0xff00) {
                 u8 B = (iv >> 16) & 0xff;
                 if (B >= 3 && B < 3 + keylen)
-                        return 1;
+                        return true;
         }
-        return 0;
+        return false;
 }
 
 
@@ -123,10 +126,10 @@ void ieee80211_wep_encrypt_data(struct crypto_blkcipher *tfm, u8 *rc4key,
 {
         struct blkcipher_desc desc = { .tfm = tfm };
         struct scatterlist sg;
-        __le32 *icv;
+        __le32 icv;
 
-        icv = (__le32 *)(data + data_len);
-        *icv = cpu_to_le32(~crc32_le(~0, data, data_len));
+        icv = cpu_to_le32(~crc32_le(~0, data, data_len));
+        put_unaligned(icv, (__le32 *)(data + data_len));
 
         crypto_blkcipher_setkey(tfm, rc4key, klen);
         sg_init_one(&sg, data, data_len + WEP_ICV_LEN);
@@ -268,7 +271,7 @@ int ieee80211_wep_decrypt(struct ieee80211_local *local, struct sk_buff *skb,
 }
 
 
-u8 * ieee80211_wep_is_weak_iv(struct sk_buff *skb, struct ieee80211_key *key)
+bool ieee80211_wep_is_weak_iv(struct sk_buff *skb, struct ieee80211_key *key)
 {
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
         unsigned int hdrlen;
@@ -276,16 +279,13 @@ u8 * ieee80211_wep_is_weak_iv(struct sk_buff *skb, struct ieee80211_key *key)
         u32 iv;
 
         if (!ieee80211_has_protected(hdr->frame_control))
-                return NULL;
+                return false;
 
         hdrlen = ieee80211_hdrlen(hdr->frame_control);
         ivpos = skb->data + hdrlen;
         iv = (ivpos[0] << 16) | (ivpos[1] << 8) | ivpos[2];
 
-        if (ieee80211_wep_weak_iv(iv, key->conf.keylen))
-                return ivpos;
-
-        return NULL;
+        return ieee80211_wep_weak_iv(iv, key->conf.keylen);
 }
 
 ieee80211_rx_result
@@ -329,6 +329,8 @@ static int wep_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
 ieee80211_tx_result
 ieee80211_crypto_wep_encrypt(struct ieee80211_tx_data *tx)
 {
+        int i;
+
         ieee80211_tx_set_protected(tx);
 
         if (wep_encrypt_skb(tx, tx->skb) < 0) {
@@ -337,9 +339,8 @@ ieee80211_crypto_wep_encrypt(struct ieee80211_tx_data *tx)
         }
 
         if (tx->extra_frag) {
-                int i;
                 for (i = 0; i < tx->num_extra_frag; i++) {
-                        if (wep_encrypt_skb(tx, tx->extra_frag[i]) < 0) {
+                        if (wep_encrypt_skb(tx, tx->extra_frag[i])) {
                                 I802_DEBUG_INC(tx->local->
                                                tx_handlers_drop_wep);
                                 return TX_DROP;
diff --git a/net/mac80211/wep.h b/net/mac80211/wep.h
index e587172115b8..d3f0db48314e 100644
--- a/net/mac80211/wep.h
+++ b/net/mac80211/wep.h
@@ -26,7 +26,7 @@ int ieee80211_wep_encrypt(struct ieee80211_local *local, struct sk_buff *skb,
                           struct ieee80211_key *key);
 int ieee80211_wep_decrypt(struct ieee80211_local *local, struct sk_buff *skb,
                           struct ieee80211_key *key);
-u8 *ieee80211_wep_is_weak_iv(struct sk_buff *skb, struct ieee80211_key *key);
+bool ieee80211_wep_is_weak_iv(struct sk_buff *skb, struct ieee80211_key *key);
 
 ieee80211_rx_result
 ieee80211_crypto_wep_decrypt(struct ieee80211_rx_data *rx);
diff --git a/net/mac80211/wext.c b/net/mac80211/wext.c
index ab4ddba874be..7162d5816f39 100644
--- a/net/mac80211/wext.c
+++ b/net/mac80211/wext.c
@@ -135,48 +135,6 @@ static int ieee80211_ioctl_siwgenie(struct net_device *dev,
         return -EOPNOTSUPP;
 }
 
-static int ieee80211_ioctl_giwname(struct net_device *dev,
-                                   struct iw_request_info *info,
-                                   char *name, char *extra)
-{
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        struct ieee80211_supported_band *sband;
-        u8 is_ht = 0, is_a = 0, is_b = 0, is_g = 0;
-
-
-        sband = local->hw.wiphy->bands[IEEE80211_BAND_5GHZ];
-        if (sband) {
-                is_a = 1;
-                is_ht |= sband->ht_info.ht_supported;
-        }
-
-        sband = local->hw.wiphy->bands[IEEE80211_BAND_2GHZ];
-        if (sband) {
-                int i;
-                /* Check for mandatory rates */
-                for (i = 0; i < sband->n_bitrates; i++) {
-                        if (sband->bitrates[i].bitrate == 10)
-                                is_b = 1;
-                        if (sband->bitrates[i].bitrate == 60)
-                                is_g = 1;
-                }
-                is_ht |= sband->ht_info.ht_supported;
-        }
-
-        strcpy(name, "IEEE 802.11");
-        if (is_a)
-                strcat(name, "a");
-        if (is_b)
-                strcat(name, "b");
-        if (is_g)
-                strcat(name, "g");
-        if (is_ht)
-                strcat(name, "n");
-
-        return 0;
-}
-
-
 static int ieee80211_ioctl_giwrange(struct net_device *dev,
                                  struct iw_request_info *info,
                                  struct iw_point *data, char *extra)
@@ -266,78 +224,6 @@ static int ieee80211_ioctl_giwrange(struct net_device *dev,
 }
 
 
-static int ieee80211_ioctl_siwmode(struct net_device *dev,
-                                   struct iw_request_info *info,
-                                   __u32 *mode, char *extra)
-{
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        struct ieee80211_local *local = sdata->local;
-        int type;
-
-        if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
-                return -EOPNOTSUPP;
-
-        switch (*mode) {
-        case IW_MODE_INFRA:
-                type = NL80211_IFTYPE_STATION;
-                break;
-        case IW_MODE_ADHOC:
-                /* Setting ad-hoc mode on non ibss channel is not
-                 * supported.
-                 */
-                if (local->oper_channel &&
-                    (local->oper_channel->flags & IEEE80211_CHAN_NO_IBSS))
-                        return -EOPNOTSUPP;
-
-                type = NL80211_IFTYPE_ADHOC;
-                break;
-        case IW_MODE_REPEAT:
-                type = NL80211_IFTYPE_WDS;
-                break;
-        case IW_MODE_MONITOR:
-                type = NL80211_IFTYPE_MONITOR;
-                break;
-        default:
-                return -EINVAL;
-        }
-
-        return ieee80211_if_change_type(sdata, type);
-}
-
-
-static int ieee80211_ioctl_giwmode(struct net_device *dev,
-                                   struct iw_request_info *info,
-                                   __u32 *mode, char *extra)
-{
-        struct ieee80211_sub_if_data *sdata;
-
-        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        switch (sdata->vif.type) {
-        case NL80211_IFTYPE_AP:
-                *mode = IW_MODE_MASTER;
-                break;
-        case NL80211_IFTYPE_STATION:
-                *mode = IW_MODE_INFRA;
-                break;
-        case NL80211_IFTYPE_ADHOC:
-                *mode = IW_MODE_ADHOC;
-                break;
-        case NL80211_IFTYPE_MONITOR:
-                *mode = IW_MODE_MONITOR;
-                break;
-        case NL80211_IFTYPE_WDS:
-                *mode = IW_MODE_REPEAT;
-                break;
-        case NL80211_IFTYPE_AP_VLAN:
-                *mode = IW_MODE_SECOND;         /* FIXME */
-                break;
-        default:
-                *mode = IW_MODE_AUTO;
-                break;
-        }
-        return 0;
-}
-
 static int ieee80211_ioctl_siwfreq(struct net_device *dev,
                                    struct iw_request_info *info,
                                    struct iw_freq *freq, char *extra)
@@ -415,13 +301,6 @@ static int ieee80211_ioctl_siwessid(struct net_device *dev,
                 return 0;
         }
 
-        if (sdata->vif.type == NL80211_IFTYPE_AP) {
-                memcpy(sdata->u.ap.ssid, ssid, len);
-                memset(sdata->u.ap.ssid + len, 0,
-                       IEEE80211_MAX_SSID_LEN - len);
-                sdata->u.ap.ssid_len = len;
-                return ieee80211_if_config(sdata, IEEE80211_IFCC_SSID);
-        }
         return -EOPNOTSUPP;
 }
 
@@ -445,15 +324,6 @@ static int ieee80211_ioctl_giwessid(struct net_device *dev,
                 return res;
         }
 
-        if (sdata->vif.type == NL80211_IFTYPE_AP) {
-                len = sdata->u.ap.ssid_len;
-                if (len > IW_ESSID_MAX_SIZE)
-                        len = IW_ESSID_MAX_SIZE;
-                memcpy(ssid, sdata->u.ap.ssid, len);
-                data->length = len;
-                data->flags = 1;
-                return 0;
-        }
         return -EOPNOTSUPP;
 }
 
@@ -548,8 +418,7 @@ static int ieee80211_ioctl_siwscan(struct net_device *dev,
 
         if (sdata->vif.type != NL80211_IFTYPE_STATION &&
             sdata->vif.type != NL80211_IFTYPE_ADHOC &&
-            sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
-            sdata->vif.type != NL80211_IFTYPE_AP)
+            sdata->vif.type != NL80211_IFTYPE_MESH_POINT)
                 return -EOPNOTSUPP;
 
         /* if SSID was specified explicitly then use that */
@@ -644,8 +513,8 @@ static int ieee80211_ioctl_giwrate(struct net_device *dev,
 
         sta = sta_info_get(local, sdata->u.sta.bssid);
 
-        if (sta && sta->last_txrate_idx < sband->n_bitrates)
-                rate->value = sband->bitrates[sta->last_txrate_idx].bitrate;
+        if (sta && !(sta->last_tx_rate.flags & IEEE80211_TX_RC_MCS))
+                rate->value = sband->bitrates[sta->last_tx_rate.idx].bitrate;
         else
                 rate->value = 0;
 
@@ -664,45 +533,35 @@ static int ieee80211_ioctl_siwtxpower(struct net_device *dev,
                                       union iwreq_data *data, char *extra)
 {
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        bool need_reconfig = 0;
+        struct ieee80211_channel* chan = local->hw.conf.channel;
+        u32 reconf_flags = 0;
         int new_power_level;
 
         if ((data->txpower.flags & IW_TXPOW_TYPE) != IW_TXPOW_DBM)
                 return -EINVAL;
         if (data->txpower.flags & IW_TXPOW_RANGE)
                 return -EINVAL;
+        if (!chan)
+                return -EINVAL;
 
-        if (data->txpower.fixed) {
-                new_power_level = data->txpower.value;
-        } else {
-                /*
-                 * Automatic power level. Use maximum power for the current
-                 * channel. Should be part of rate control.
-                 */
-                struct ieee80211_channel* chan = local->hw.conf.channel;
-                if (!chan)
-                        return -EINVAL;
-
+        if (data->txpower.fixed)
+                new_power_level = min(data->txpower.value, chan->max_power);
+        else /* Automatic power level setting */
                 new_power_level = chan->max_power;
-        }
 
         if (local->hw.conf.power_level != new_power_level) {
                 local->hw.conf.power_level = new_power_level;
-                need_reconfig = 1;
+                reconf_flags |= IEEE80211_CONF_CHANGE_POWER;
         }
 
         if (local->hw.conf.radio_enabled != !(data->txpower.disabled)) {
                 local->hw.conf.radio_enabled = !(data->txpower.disabled);
-                need_reconfig = 1;
+                reconf_flags |= IEEE80211_CONF_CHANGE_RADIO_ENABLED;
                 ieee80211_led_radio(local, local->hw.conf.radio_enabled);
         }
 
-        if (need_reconfig) {
-                ieee80211_hw_config(local);
-                /* The return value of hw_config is not of big interest here,
-                 * as it doesn't say that it failed because of _this_ config
-                 * change or something else. Ignore it. */
-        }
+        if (reconf_flags)
+                ieee80211_hw_config(local, reconf_flags);
 
         return 0;
 }
@@ -779,14 +638,6 @@ static int ieee80211_ioctl_siwfrag(struct net_device *dev,
                 local->fragmentation_threshold = frag->value & ~0x1;
         }
 
-        /* If the wlan card performs fragmentation in hardware/firmware,
-         * configure it here */
-
-        if (local->ops->set_frag_threshold)
-                return local->ops->set_frag_threshold(
-                        local_to_hw(local),
-                        local->fragmentation_threshold);
-
         return 0;
 }
 
@@ -814,21 +665,16 @@ static int ieee80211_ioctl_siwretry(struct net_device *dev,
             (retry->flags & IW_RETRY_TYPE) != IW_RETRY_LIMIT)
                 return -EINVAL;
 
-        if (retry->flags & IW_RETRY_MAX)
-                local->long_retry_limit = retry->value;
-        else if (retry->flags & IW_RETRY_MIN)
-                local->short_retry_limit = retry->value;
-        else {
-                local->long_retry_limit = retry->value;
-                local->short_retry_limit = retry->value;
+        if (retry->flags & IW_RETRY_MAX) {
+                local->hw.conf.long_frame_max_tx_count = retry->value;
+        } else if (retry->flags & IW_RETRY_MIN) {
+                local->hw.conf.short_frame_max_tx_count = retry->value;
+        } else {
+                local->hw.conf.long_frame_max_tx_count = retry->value;
+                local->hw.conf.short_frame_max_tx_count = retry->value;
         }
 
-        if (local->ops->set_retry_limit) {
-                return local->ops->set_retry_limit(
-                        local_to_hw(local),
-                        local->short_retry_limit,
-                        local->long_retry_limit);
-        }
+        ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_RETRY_LIMITS);
 
         return 0;
 }
@@ -845,14 +691,15 @@ static int ieee80211_ioctl_giwretry(struct net_device *dev,
                 /* first return min value, iwconfig will ask max value
                  * later if needed */
                 retry->flags |= IW_RETRY_LIMIT;
-                retry->value = local->short_retry_limit;
-                if (local->long_retry_limit != local->short_retry_limit)
+                retry->value = local->hw.conf.short_frame_max_tx_count;
+                if (local->hw.conf.long_frame_max_tx_count !=
+                    local->hw.conf.short_frame_max_tx_count)
                         retry->flags |= IW_RETRY_MIN;
                 return 0;
         }
         if (retry->flags & IW_RETRY_MAX) {
                 retry->flags = IW_RETRY_LIMIT | IW_RETRY_MAX;
-                retry->value = local->long_retry_limit;
+                retry->value = local->hw.conf.long_frame_max_tx_count;
         }
 
         return 0;
@@ -983,25 +830,56 @@ static int ieee80211_ioctl_siwpower(struct net_device *dev,
                                     struct iw_param *wrq,
                                     char *extra)
 {
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
         struct ieee80211_conf *conf = &local->hw.conf;
+        int ret = 0, timeout = 0;
+        bool ps;
+
+        if (sdata->vif.type != NL80211_IFTYPE_STATION)
+                return -EINVAL;
 
         if (wrq->disabled) {
-                conf->flags &= ~IEEE80211_CONF_PS;
-                return ieee80211_hw_config(local);
+                ps = false;
+                timeout = 0;
+                goto set;
         }
 
         switch (wrq->flags & IW_POWER_MODE) {
         case IW_POWER_ON:       /* If not specified */
         case IW_POWER_MODE:     /* If set all mask */
         case IW_POWER_ALL_R:    /* If explicitely state all */
-                conf->flags |= IEEE80211_CONF_PS;
+                ps = true;
                 break;
-        default:                /* Otherwise we don't support it */
-                return -EINVAL;
+        default:                /* Otherwise we ignore */
+                break;
+        }
+
+        if (wrq->flags & IW_POWER_TIMEOUT)
+                timeout = wrq->value / 1000;
+
+set:
+        if (ps == local->powersave && timeout == local->dynamic_ps_timeout)
+                return ret;
+
+        local->powersave = ps;
+        local->dynamic_ps_timeout = timeout;
+
+        if (sdata->u.sta.flags & IEEE80211_STA_ASSOCIATED) {
+                if (!(local->hw.flags & IEEE80211_HW_NO_STACK_DYNAMIC_PS) &&
+                    local->dynamic_ps_timeout > 0)
+                        mod_timer(&local->dynamic_ps_timer, jiffies +
+                                  msecs_to_jiffies(local->dynamic_ps_timeout));
+                else {
+                        if (local->powersave)
+                                conf->flags |= IEEE80211_CONF_PS;
+                        else
+                                conf->flags &= ~IEEE80211_CONF_PS;
+                }
+                ret = ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
         }
 
-        return ieee80211_hw_config(local);
+        return ret;
 }
 
 static int ieee80211_ioctl_giwpower(struct net_device *dev,
@@ -1010,9 +888,8 @@ static int ieee80211_ioctl_giwpower(struct net_device *dev,
                                     char *extra)
 {
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        struct ieee80211_conf *conf = &local->hw.conf;
 
-        wrqu->power.disabled = !(conf->flags & IEEE80211_CONF_PS);
+        wrqu->power.disabled = !local->powersave;
 
         return 0;
 }
@@ -1176,13 +1053,13 @@ static int ieee80211_ioctl_siwencodeext(struct net_device *dev,
 static const iw_handler ieee80211_handler[] =
 {
         (iw_handler) NULL,                              /* SIOCSIWCOMMIT */
-        (iw_handler) ieee80211_ioctl_giwname,           /* SIOCGIWNAME */
+        (iw_handler) cfg80211_wext_giwname,             /* SIOCGIWNAME */
         (iw_handler) NULL,                              /* SIOCSIWNWID */
         (iw_handler) NULL,                              /* SIOCGIWNWID */
         (iw_handler) ieee80211_ioctl_siwfreq,           /* SIOCSIWFREQ */
         (iw_handler) ieee80211_ioctl_giwfreq,           /* SIOCGIWFREQ */
-        (iw_handler) ieee80211_ioctl_siwmode,           /* SIOCSIWMODE */
-        (iw_handler) ieee80211_ioctl_giwmode,           /* SIOCGIWMODE */
+        (iw_handler) cfg80211_wext_siwmode,             /* SIOCSIWMODE */
+        (iw_handler) cfg80211_wext_giwmode,             /* SIOCGIWMODE */
         (iw_handler) NULL,                              /* SIOCSIWSENS */
         (iw_handler) NULL,                              /* SIOCGIWSENS */
         (iw_handler) NULL /* not used */,               /* SIOCSIWRANGE */
diff --git a/net/mac80211/wme.c b/net/mac80211/wme.c
index 139b5f267b34..ac71b38f7cb5 100644
--- a/net/mac80211/wme.c
+++ b/net/mac80211/wme.c
@@ -114,8 +114,8 @@ u16 ieee80211_select_queue(struct net_device *dev, struct sk_buff *skb)
 {
         struct ieee80211_master_priv *mpriv = netdev_priv(dev);
         struct ieee80211_local *local = mpriv->local;
+        struct ieee80211_hw *hw = &local->hw;
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
-        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         struct sta_info *sta;
         u16 queue;
         u8 tid;
@@ -124,21 +124,19 @@ u16 ieee80211_select_queue(struct net_device *dev, struct sk_buff *skb)
         if (unlikely(queue >= local->hw.queues))
                 queue = local->hw.queues - 1;
 
-        if (info->flags & IEEE80211_TX_CTL_REQUEUE) {
+        if (skb->requeue) {
+                if (!hw->ampdu_queues)
+                        return queue;
+
                 rcu_read_lock();
                 sta = sta_info_get(local, hdr->addr1);
                 tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
                 if (sta) {
-                        struct ieee80211_hw *hw = &local->hw;
                         int ampdu_queue = sta->tid_to_tx_q[tid];
 
                         if ((ampdu_queue < ieee80211_num_queues(hw)) &&
-                            test_bit(ampdu_queue, local->queue_pool)) {
+                            test_bit(ampdu_queue, local->queue_pool))
                                 queue = ampdu_queue;
-                                info->flags |= IEEE80211_TX_CTL_AMPDU;
-                        } else {
-                                info->flags &= ~IEEE80211_TX_CTL_AMPDU;
-                        }
                 }
                 rcu_read_unlock();
 
@@ -159,20 +157,18 @@ u16 ieee80211_select_queue(struct net_device *dev, struct sk_buff *skb)
                 *p++ = ack_policy | tid;
                 *p = 0;
 
+                if (!hw->ampdu_queues)
+                        return queue;
+
                 rcu_read_lock();
 
                 sta = sta_info_get(local, hdr->addr1);
                 if (sta) {
                         int ampdu_queue = sta->tid_to_tx_q[tid];
-                        struct ieee80211_hw *hw = &local->hw;
 
                         if ((ampdu_queue < ieee80211_num_queues(hw)) &&
-                            test_bit(ampdu_queue, local->queue_pool)) {
+                            test_bit(ampdu_queue, local->queue_pool))
                                 queue = ampdu_queue;
-                                info->flags |= IEEE80211_TX_CTL_AMPDU;
-                        } else {
-                                info->flags &= ~IEEE80211_TX_CTL_AMPDU;
-                        }
                 }
 
                 rcu_read_unlock();
@@ -206,13 +202,11 @@ int ieee80211_ht_agg_queue_add(struct ieee80211_local *local,
                          * on the previous queue
                          * since HT is strict in order */
 #ifdef CONFIG_MAC80211_HT_DEBUG
-                        if (net_ratelimit()) {
-                                DECLARE_MAC_BUF(mac);
+                        if (net_ratelimit())
                                 printk(KERN_DEBUG "allocated aggregation queue"
-                                        " %d tid %d addr %s pool=0x%lX\n",
-                                        i, tid, print_mac(mac, sta->sta.addr),
+                                        " %d tid %d addr %pM pool=0x%lX\n",
+                                        i, tid, sta->sta.addr,
                                         local->queue_pool[0]);
-                        }
 #endif /* CONFIG_MAC80211_HT_DEBUG */
                         return 0;
                 }
diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c
index 6db649480e8f..7aa63caf8d50 100644
--- a/net/mac80211/wpa.c
+++ b/net/mac80211/wpa.c
@@ -49,8 +49,7 @@ ieee80211_tx_h_michael_mic_add(struct ieee80211_tx_data *tx)
             !(tx->flags & IEEE80211_TX_FRAGMENTED) &&
             !(tx->key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC) &&
             !wpa_test) {
-                /* hwaccel - with no need for preallocated room for Michael MIC
-                 */
+                /* hwaccel - with no need for preallocated room for MMIC */
                 return TX_CONTINUE;
         }
 
@@ -67,8 +66,6 @@ ieee80211_tx_h_michael_mic_add(struct ieee80211_tx_data *tx)
 #else
         authenticator = 1;
 #endif
-        /* At this point we know we're using ALG_TKIP. To get the MIC key
-         * we now will rely on the offset from the ieee80211_key_conf::key */
         key_offset = authenticator ?
                 NL80211_TKIP_DATA_OFFSET_TX_MIC_KEY :
                 NL80211_TKIP_DATA_OFFSET_RX_MIC_KEY;
@@ -90,11 +87,8 @@ ieee80211_rx_h_michael_mic_verify(struct ieee80211_rx_data *rx)
         u8 mic[MICHAEL_MIC_LEN];
         struct sk_buff *skb = rx->skb;
         int authenticator = 1, wpa_test = 0;
-        DECLARE_MAC_BUF(mac);
 
-        /*
-         * No way to verify the MIC if the hardware stripped it
-         */
+        /* No way to verify the MIC if the hardware stripped it */
         if (rx->status->flag & RX_FLAG_MMIC_STRIPPED)
                 return RX_CONTINUE;
 
@@ -116,8 +110,6 @@ ieee80211_rx_h_michael_mic_verify(struct ieee80211_rx_data *rx)
 #else
         authenticator = 1;
 #endif
-        /* At this point we know we're using ALG_TKIP. To get the MIC key
-         * we now will rely on the offset from the ieee80211_key_conf::key */
         key_offset = authenticator ?
                 NL80211_TKIP_DATA_OFFSET_RX_MIC_KEY :
                 NL80211_TKIP_DATA_OFFSET_TX_MIC_KEY;
@@ -202,6 +194,7 @@ ieee80211_tx_result
 ieee80211_crypto_tkip_encrypt(struct ieee80211_tx_data *tx)
 {
         struct sk_buff *skb = tx->skb;
+        int i;
 
         ieee80211_tx_set_protected(tx);
 
@@ -209,9 +202,8 @@ ieee80211_crypto_tkip_encrypt(struct ieee80211_tx_data *tx)
                 return TX_DROP;
 
         if (tx->extra_frag) {
-                int i;
                 for (i = 0; i < tx->num_extra_frag; i++) {
-                        if (tkip_encrypt_skb(tx, tx->extra_frag[i]) < 0)
+                        if (tkip_encrypt_skb(tx, tx->extra_frag[i]))
                                 return TX_DROP;
                 }
         }
@@ -227,7 +219,6 @@ ieee80211_crypto_tkip_decrypt(struct ieee80211_rx_data *rx)
         int hdrlen, res, hwaccel = 0, wpa_test = 0;
         struct ieee80211_key *key = rx->key;
         struct sk_buff *skb = rx->skb;
-        DECLARE_MAC_BUF(mac);
 
         hdrlen = ieee80211_hdrlen(hdr->frame_control);
 
@@ -350,7 +341,7 @@ static inline void ccmp_pn2hdr(u8 *hdr, u8 *pn, int key_id)
 }
 
 
-static inline int ccmp_hdr2pn(u8 *pn, u8 *hdr)
+static inline void ccmp_hdr2pn(u8 *pn, u8 *hdr)
 {
         pn[0] = hdr[7];
         pn[1] = hdr[6];
@@ -358,7 +349,6 @@ static inline int ccmp_hdr2pn(u8 *pn, u8 *hdr)
         pn[3] = hdr[4];
         pn[4] = hdr[1];
         pn[5] = hdr[0];
-        return (hdr[3] >> 6) & 0x03;
 }
 
 
@@ -373,7 +363,7 @@ static int ccmp_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
 
         if ((tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) &&
             !(tx->key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV)) {
-                /* hwaccel - with no need for preallocated room for CCMP "
+                /* hwaccel - with no need for preallocated room for CCMP
                  * header or MIC fields */
                 info->control.hw_key = &tx->key->conf;
                 return 0;
@@ -426,6 +416,7 @@ ieee80211_tx_result
 ieee80211_crypto_ccmp_encrypt(struct ieee80211_tx_data *tx)
 {
         struct sk_buff *skb = tx->skb;
+        int i;
 
         ieee80211_tx_set_protected(tx);
 
@@ -433,9 +424,8 @@ ieee80211_crypto_ccmp_encrypt(struct ieee80211_tx_data *tx)
                 return TX_DROP;
 
         if (tx->extra_frag) {
-                int i;
                 for (i = 0; i < tx->num_extra_frag; i++) {
-                        if (ccmp_encrypt_skb(tx, tx->extra_frag[i]) < 0)
+                        if (ccmp_encrypt_skb(tx, tx->extra_frag[i]))
                                 return TX_DROP;
                 }
         }
@@ -453,7 +443,6 @@ ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx)
         struct sk_buff *skb = rx->skb;
         u8 pn[CCMP_PN_LEN];
         int data_len;
-        DECLARE_MAC_BUF(mac);
 
         hdrlen = ieee80211_hdrlen(hdr->frame_control);
 
@@ -468,7 +457,7 @@ ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx)
             (rx->status->flag & RX_FLAG_IV_STRIPPED))
                 return RX_CONTINUE;
 
-        (void) ccmp_hdr2pn(pn, skb->data + hdrlen);
+        ccmp_hdr2pn(pn, skb->data + hdrlen);
 
         if (memcmp(pn, key->u.ccmp.rx_pn[rx->queue], CCMP_PN_LEN) <= 0) {
                 key->u.ccmp.replays++;
@@ -483,9 +472,8 @@ ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx)
                             key->u.ccmp.tfm, key->u.ccmp.rx_crypto_buf,
                             skb->data + hdrlen + CCMP_HDR_LEN, data_len,
                             skb->data + skb->len - CCMP_MIC_LEN,
-                            skb->data + hdrlen + CCMP_HDR_LEN)) {
+                            skb->data + hdrlen + CCMP_HDR_LEN))
                         return RX_DROP_UNUSABLE;
-                }
         }
 
         memcpy(key->u.ccmp.rx_pn[rx->queue], pn, CCMP_PN_LEN);