Merge branch 'linus' into x86/pebs

Conflicts:

	arch/x86/Kconfig.cpu
	arch/x86/kernel/cpu/intel.c
	arch/x86/kernel/setup_64.c

Signed-off-by: Ingo Molnar <mingo@elte.hu>

41 files changed, 3212 insertions, 3861 deletions

diff --git a/net/mac80211/Kconfig b/net/mac80211/Kconfig
index a24b459dd45a..80d693392b0f 100644
--- a/net/mac80211/Kconfig
+++ b/net/mac80211/Kconfig
@@ -7,7 +7,6 @@ config MAC80211
         select CRC32
         select WIRELESS_EXT
         select CFG80211
-        select NET_SCH_FIFO
         ---help---
           This option enables the hardware independent IEEE 802.11
           networking stack.
@@ -15,6 +14,14 @@ config MAC80211
 menu "Rate control algorithm selection"
         depends on MAC80211 != n
 
+config MAC80211_RC_PID
+        bool "PID controller based rate control algorithm" if EMBEDDED
+        default y
+        ---help---
+          This option enables a TX rate control algorithm for
+          mac80211 that uses a PID controller to select the TX
+          rate.
+
 choice
         prompt "Default rate control algorithm"
         default MAC80211_RC_DEFAULT_PID
@@ -26,40 +33,19 @@ choice
 
 config MAC80211_RC_DEFAULT_PID
         bool "PID controller based rate control algorithm"
-        select MAC80211_RC_PID
+        depends on MAC80211_RC_PID
         ---help---
           Select the PID controller based rate control as the
           default rate control algorithm. You should choose
           this unless you know what you are doing.
 
-config MAC80211_RC_DEFAULT_NONE
-        bool "No default algorithm"
-        depends on EMBEDDED
-        help
-          Selecting this option will select no default algorithm
-          and allow you to not build any. Do not choose this
-          option unless you know your driver comes with another
-          suitable algorithm.
 endchoice
 
-comment "Selecting 'y' for an algorithm will"
-comment "build the algorithm into mac80211."
-
 config MAC80211_RC_DEFAULT
         string
         default "pid" if MAC80211_RC_DEFAULT_PID
         default ""
 
-config MAC80211_RC_PID
-        tristate "PID controller based rate control algorithm"
-        ---help---
-          This option enables a TX rate control algorithm for
-          mac80211 that uses a PID controller to select the TX
-          rate.
-
-          Say Y or M unless you're sure you want to use a
-          different rate control algorithm.
-
 endmenu
 
 config MAC80211_MESH
@@ -89,10 +75,16 @@ config MAC80211_DEBUGFS
 
           Say N unless you know you need this.
 
+menuconfig MAC80211_DEBUG_MENU
+        bool "Select mac80211 debugging features"
+        depends on MAC80211
+        ---help---
+          This option collects various mac80211 debug settings.
+
 config MAC80211_DEBUG_PACKET_ALIGNMENT
         bool "Enable packet alignment debugging"
-        depends on MAC80211
-        help
+        depends on MAC80211_DEBUG_MENU
+        ---help---
           This option is recommended for driver authors and strongly
           discouraged for everybody else, it will trigger a warning
           when a driver hands mac80211 a buffer that is aligned in
@@ -101,33 +93,95 @@ config MAC80211_DEBUG_PACKET_ALIGNMENT
 
           Say N unless you're writing a mac80211 based driver.
 
-config MAC80211_DEBUG
-        bool "Enable debugging output"
-        depends on MAC80211
+config MAC80211_NOINLINE
+        bool "Do not inline TX/RX handlers"
+        depends on MAC80211_DEBUG_MENU
         ---help---
-          This option will enable debug tracing output for the
-          ieee80211 network stack.
+          This option affects code generation in mac80211, when
+          selected some functions are marked "noinline" to allow
+          easier debugging of problems in the transmit and receive
+          paths.
+
+          This option increases code size a bit and inserts a lot
+          of function calls in the code, but is otherwise safe to
+          enable.
 
-          If you are not trying to debug or develop the ieee80211
-          subsystem, you most likely want to say N here.
+          If unsure, say N unless you expect to be finding problems
+          in mac80211.
+
+config MAC80211_VERBOSE_DEBUG
+        bool "Verbose debugging output"
+        depends on MAC80211_DEBUG_MENU
+        ---help---
+          Selecting this option causes mac80211 to print out
+          many debugging messages. It should not be selected
+          on production systems as some of the messages are
+          remotely triggerable.
+
+          Do not select this option.
 
 config MAC80211_HT_DEBUG
-        bool "Enable HT debugging output"
-        depends on MAC80211_DEBUG
+        bool "Verbose HT debugging"
+        depends on MAC80211_DEBUG_MENU
         ---help---
           This option enables 802.11n High Throughput features
           debug tracing output.
 
-          If you are not trying to debug of develop the ieee80211
-          subsystem, you most likely want to say N here.
+          It should not be selected on production systems as some
+          of the messages are remotely triggerable.
 
-config MAC80211_VERBOSE_DEBUG
-        bool "Verbose debugging output"
-        depends on MAC80211_DEBUG
+          Do not select this option.
+
+config MAC80211_TKIP_DEBUG
+        bool "Verbose TKIP debugging"
+        depends on MAC80211_DEBUG_MENU
+        ---help---
+          Selecting this option causes mac80211 to print out
+          very verbose TKIP debugging messages. It should not
+          be selected on production systems as those messages
+          are remotely triggerable.
+
+          Do not select this option.
+
+config MAC80211_IBSS_DEBUG
+        bool "Verbose IBSS debugging"
+        depends on MAC80211_DEBUG_MENU
+        ---help---
+          Selecting this option causes mac80211 to print out
+          very verbose IBSS debugging messages. It should not
+          be selected on production systems as those messages
+          are remotely triggerable.
+
+          Do not select this option.
+
+config MAC80211_VERBOSE_PS_DEBUG
+        bool "Verbose powersave mode debugging"
+        depends on MAC80211_DEBUG_MENU
+        ---help---
+          Selecting this option causes mac80211 to print out very
+          verbose power save mode debugging messages (when mac80211
+          is an AP and has power saving stations.)
+          It should not be selected on production systems as those
+          messages are remotely triggerable.
+
+          Do not select this option.
+
+config MAC80211_VERBOSE_MPL_DEBUG
+        bool "Verbose mesh peer link debugging"
+        depends on MAC80211_DEBUG_MENU
+        depends on MAC80211_MESH
+        ---help---
+          Selecting this option causes mac80211 to print out very
+          verbose mesh peer link debugging messages (when mac80211
+          is taking part in a mesh network).
+          It should not be selected on production systems as those
+          messages are remotely triggerable.
+
+          Do not select this option.
 
 config MAC80211_LOWTX_FRAME_DUMP
         bool "Debug frame dumping"
-        depends on MAC80211_DEBUG
+        depends on MAC80211_DEBUG_MENU
         ---help---
           Selecting this option will cause the stack to
           print a message for each frame that is handed
@@ -138,30 +192,20 @@ config MAC80211_LOWTX_FRAME_DUMP
           If unsure, say N and insert the debugging code
           you require into the driver you are debugging.
 
-config TKIP_DEBUG
-        bool "TKIP debugging"
-        depends on MAC80211_DEBUG
-
 config MAC80211_DEBUG_COUNTERS
         bool "Extra statistics for TX/RX debugging"
-        depends on MAC80211_DEBUG
-
-config MAC80211_IBSS_DEBUG
-        bool "Support for IBSS testing"
-        depends on MAC80211_DEBUG
+        depends on MAC80211_DEBUG_MENU
+        depends on MAC80211_DEBUGFS
         ---help---
-          Say Y here if you intend to debug the IBSS code.
+          Selecting this option causes mac80211 to keep additional
+          and very verbose statistics about TX and RX handler use
+          and show them in debugfs.
 
-config MAC80211_VERBOSE_PS_DEBUG
-        bool "Verbose powersave mode debugging"
-        depends on MAC80211_DEBUG
-        ---help---
-          Say Y here to print out verbose powersave
-          mode debug messages.
+          If unsure, say N.
 
-config MAC80211_VERBOSE_MPL_DEBUG
-        bool "Verbose mesh peer link debugging"
-        depends on MAC80211_DEBUG && MAC80211_MESH
+config MAC80211_VERBOSE_SPECT_MGMT_DEBUG
+        bool "Verbose Spectrum Management (IEEE 802.11h)debugging"
+        depends on MAC80211_DEBUG_MENU
         ---help---
-          Say Y here to print out verbose mesh peer link
+          Say Y here to print out verbose Spectrum Management (IEEE 802.11h)
           debug messages.
diff --git a/net/mac80211/Makefile b/net/mac80211/Makefile
index 4e5847fd316c..a169b0201d61 100644
--- a/net/mac80211/Makefile
+++ b/net/mac80211/Makefile
@@ -1,13 +1,5 @@
 obj-$(CONFIG_MAC80211) += mac80211.o
 
-# objects for PID algorithm
-rc80211_pid-y := rc80211_pid_algo.o
-rc80211_pid-$(CONFIG_MAC80211_DEBUGFS) += rc80211_pid_debugfs.o
-
-# build helper for PID algorithm
-rc-pid-y := $(rc80211_pid-y)
-rc-pid-m := rc80211_pid.o
-
 # mac80211 objects
 mac80211-y := \
         main.o \
@@ -26,10 +18,10 @@ mac80211-y := \
         tx.o \
         key.o \
         util.o \
+        wme.o \
         event.o
 
 mac80211-$(CONFIG_MAC80211_LEDS) += led.o
-mac80211-$(CONFIG_NET_SCHED) += wme.o
 mac80211-$(CONFIG_MAC80211_DEBUGFS) += \
         debugfs.o \
         debugfs_sta.o \
@@ -42,10 +34,8 @@ mac80211-$(CONFIG_MAC80211_MESH) += \
         mesh_plink.o \
         mesh_hwmp.o
 
+# objects for PID algorithm
+rc80211_pid-y := rc80211_pid_algo.o
+rc80211_pid-$(CONFIG_MAC80211_DEBUGFS) += rc80211_pid_debugfs.o
 
-# Build rate control algorithm(s)
-CFLAGS_rc80211_pid_algo.o += -DRC80211_PID_COMPILE
-mac80211-$(CONFIG_MAC80211_RC_PID) += $(rc-pid-$(CONFIG_MAC80211_RC_PID))
-
-# Modular rate algorithms are assigned to mac80211-m - make separate modules
-obj-m += $(mac80211-m)
+mac80211-$(CONFIG_MAC80211_RC_PID) += $(rc80211_pid-y)
diff --git a/net/mac80211/aes_ccm.c b/net/mac80211/aes_ccm.c
index 59f1691f62c8..a87cb3ba2df6 100644
--- a/net/mac80211/aes_ccm.c
+++ b/net/mac80211/aes_ccm.c
@@ -16,31 +16,28 @@
 #include "key.h"
 #include "aes_ccm.h"
 
-
-static void ieee80211_aes_encrypt(struct crypto_cipher *tfm,
-                                  const u8 pt[16], u8 ct[16])
-{
-        crypto_cipher_encrypt_one(tfm, ct, pt);
-}
-
-
-static inline void aes_ccm_prepare(struct crypto_cipher *tfm, u8 *b_0, u8 *aad,
-                                   u8 *b, u8 *s_0, u8 *a)
+static void aes_ccm_prepare(struct crypto_cipher *tfm, u8 *scratch, u8 *a)
 {
         int i;
+        u8 *b_0, *aad, *b, *s_0;
 
-        ieee80211_aes_encrypt(tfm, b_0, b);
+        b_0 = scratch + 3 * AES_BLOCK_LEN;
+        aad = scratch + 4 * AES_BLOCK_LEN;
+        b = scratch;
+        s_0 = scratch + AES_BLOCK_LEN;
+
+        crypto_cipher_encrypt_one(tfm, b, b_0);
 
         /* Extra Authenticate-only data (always two AES blocks) */
         for (i = 0; i < AES_BLOCK_LEN; i++)
                 aad[i] ^= b[i];
-        ieee80211_aes_encrypt(tfm, aad, b);
+        crypto_cipher_encrypt_one(tfm, b, aad);
 
         aad += AES_BLOCK_LEN;
 
         for (i = 0; i < AES_BLOCK_LEN; i++)
                 aad[i] ^= b[i];
-        ieee80211_aes_encrypt(tfm, aad, a);
+        crypto_cipher_encrypt_one(tfm, a, aad);
 
         /* Mask out bits from auth-only-b_0 */
         b_0[0] &= 0x07;
@@ -48,24 +45,26 @@ static inline void aes_ccm_prepare(struct crypto_cipher *tfm, u8 *b_0, u8 *aad,
         /* S_0 is used to encrypt T (= MIC) */
         b_0[14] = 0;
         b_0[15] = 0;
-        ieee80211_aes_encrypt(tfm, b_0, s_0);
+        crypto_cipher_encrypt_one(tfm, s_0, b_0);
 }
 
 
 void ieee80211_aes_ccm_encrypt(struct crypto_cipher *tfm, u8 *scratch,
-                               u8 *b_0, u8 *aad, u8 *data, size_t data_len,
+                               u8 *data, size_t data_len,
                                u8 *cdata, u8 *mic)
 {
         int i, j, last_len, num_blocks;
-        u8 *pos, *cpos, *b, *s_0, *e;
+        u8 *pos, *cpos, *b, *s_0, *e, *b_0, *aad;
 
         b = scratch;
         s_0 = scratch + AES_BLOCK_LEN;
         e = scratch + 2 * AES_BLOCK_LEN;
+        b_0 = scratch + 3 * AES_BLOCK_LEN;
+        aad = scratch + 4 * AES_BLOCK_LEN;
 
         num_blocks = DIV_ROUND_UP(data_len, AES_BLOCK_LEN);
         last_len = data_len % AES_BLOCK_LEN;
-        aes_ccm_prepare(tfm, b_0, aad, b, s_0, b);
+        aes_ccm_prepare(tfm, scratch, b);
 
         /* Process payload blocks */
         pos = data;
@@ -77,11 +76,11 @@ void ieee80211_aes_ccm_encrypt(struct crypto_cipher *tfm, u8 *scratch,
                 /* Authentication followed by encryption */
                 for (i = 0; i < blen; i++)
                         b[i] ^= pos[i];
-                ieee80211_aes_encrypt(tfm, b, b);
+                crypto_cipher_encrypt_one(tfm, b, b);
 
                 b_0[14] = (j >> 8) & 0xff;
                 b_0[15] = j & 0xff;
-                ieee80211_aes_encrypt(tfm, b_0, e);
+                crypto_cipher_encrypt_one(tfm, e, b_0);
                 for (i = 0; i < blen; i++)
                         *cpos++ = *pos++ ^ e[i];
         }
@@ -92,19 +91,20 @@ void ieee80211_aes_ccm_encrypt(struct crypto_cipher *tfm, u8 *scratch,
 
 
 int ieee80211_aes_ccm_decrypt(struct crypto_cipher *tfm, u8 *scratch,
-                              u8 *b_0, u8 *aad, u8 *cdata, size_t data_len,
-                              u8 *mic, u8 *data)
+                              u8 *cdata, size_t data_len, u8 *mic, u8 *data)
 {
         int i, j, last_len, num_blocks;
-        u8 *pos, *cpos, *b, *s_0, *a;
+        u8 *pos, *cpos, *b, *s_0, *a, *b_0, *aad;
 
         b = scratch;
         s_0 = scratch + AES_BLOCK_LEN;
         a = scratch + 2 * AES_BLOCK_LEN;
+        b_0 = scratch + 3 * AES_BLOCK_LEN;
+        aad = scratch + 4 * AES_BLOCK_LEN;
 
         num_blocks = DIV_ROUND_UP(data_len, AES_BLOCK_LEN);
         last_len = data_len % AES_BLOCK_LEN;
-        aes_ccm_prepare(tfm, b_0, aad, b, s_0, a);
+        aes_ccm_prepare(tfm, scratch, a);
 
         /* Process payload blocks */
         cpos = cdata;
@@ -116,13 +116,12 @@ int ieee80211_aes_ccm_decrypt(struct crypto_cipher *tfm, u8 *scratch,
                 /* Decryption followed by authentication */
                 b_0[14] = (j >> 8) & 0xff;
                 b_0[15] = j & 0xff;
-                ieee80211_aes_encrypt(tfm, b_0, b);
+                crypto_cipher_encrypt_one(tfm, b, b_0);
                 for (i = 0; i < blen; i++) {
                         *pos = *cpos++ ^ b[i];
                         a[i] ^= *pos++;
                 }
-
-                ieee80211_aes_encrypt(tfm, a, a);
+                crypto_cipher_encrypt_one(tfm, a, a);
         }
 
         for (i = 0; i < CCMP_MIC_LEN; i++) {
@@ -134,7 +133,7 @@ int ieee80211_aes_ccm_decrypt(struct crypto_cipher *tfm, u8 *scratch,
 }
 
 
-struct crypto_cipher * ieee80211_aes_key_setup_encrypt(const u8 key[])
+struct crypto_cipher *ieee80211_aes_key_setup_encrypt(const u8 key[])
 {
         struct crypto_cipher *tfm;
 
diff --git a/net/mac80211/aes_ccm.h b/net/mac80211/aes_ccm.h
index 885f19030b29..6e7820ef3448 100644
--- a/net/mac80211/aes_ccm.h
+++ b/net/mac80211/aes_ccm.h
@@ -14,12 +14,12 @@
 
 #define AES_BLOCK_LEN 16
 
-struct crypto_cipher * ieee80211_aes_key_setup_encrypt(const u8 key[]);
+struct crypto_cipher *ieee80211_aes_key_setup_encrypt(const u8 key[]);
 void ieee80211_aes_ccm_encrypt(struct crypto_cipher *tfm, u8 *scratch,
-                               u8 *b_0, u8 *aad, u8 *data, size_t data_len,
+                               u8 *data, size_t data_len,
                                u8 *cdata, u8 *mic);
 int ieee80211_aes_ccm_decrypt(struct crypto_cipher *tfm, u8 *scratch,
-                              u8 *b_0, u8 *aad, u8 *cdata, size_t data_len,
+                              u8 *cdata, size_t data_len,
                               u8 *mic, u8 *data);
 void ieee80211_aes_key_free(struct crypto_cipher *tfm);
 
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index a9fce4afdf21..8e7ba0e62cf5 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -50,14 +50,11 @@ static int ieee80211_add_iface(struct wiphy *wiphy, char *name,
         struct ieee80211_sub_if_data *sdata;
         int err;
 
-        if (unlikely(local->reg_state != IEEE80211_DEV_REGISTERED))
-                return -ENODEV;
-
         itype = nl80211_type_to_mac80211_type(type);
         if (itype == IEEE80211_IF_TYPE_INVALID)
                 return -EINVAL;
 
-        err = ieee80211_if_add(local->mdev, name, &dev, itype, params);
+        err = ieee80211_if_add(local, name, &dev, itype, params);
         if (err || itype != IEEE80211_IF_TYPE_MNTR || !flags)
                 return err;
 
@@ -68,54 +65,41 @@ static int ieee80211_add_iface(struct wiphy *wiphy, char *name,
 
 static int ieee80211_del_iface(struct wiphy *wiphy, int ifindex)
 {
-        struct ieee80211_local *local = wiphy_priv(wiphy);
         struct net_device *dev;
-        char *name;
-
-        if (unlikely(local->reg_state != IEEE80211_DEV_REGISTERED))
-                return -ENODEV;
 
         /* we're under RTNL */
         dev = __dev_get_by_index(&init_net, ifindex);
         if (!dev)
-                return 0;
+                return -ENODEV;
 
-        name = dev->name;
+        ieee80211_if_remove(dev);
 
-        return ieee80211_if_remove(local->mdev, name, -1);
+        return 0;
 }
 
 static int ieee80211_change_iface(struct wiphy *wiphy, int ifindex,
                                   enum nl80211_iftype type, u32 *flags,
                                   struct vif_params *params)
 {
-        struct ieee80211_local *local = wiphy_priv(wiphy);
         struct net_device *dev;
         enum ieee80211_if_types itype;
         struct ieee80211_sub_if_data *sdata;
-
-        if (unlikely(local->reg_state != IEEE80211_DEV_REGISTERED))
-                return -ENODEV;
+        int ret;
 
         /* we're under RTNL */
         dev = __dev_get_by_index(&init_net, ifindex);
         if (!dev)
                 return -ENODEV;
 
-        if (netif_running(dev))
-                return -EBUSY;
-
         itype = nl80211_type_to_mac80211_type(type);
         if (itype == IEEE80211_IF_TYPE_INVALID)
                 return -EINVAL;
 
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
-        if (sdata->vif.type == IEEE80211_IF_TYPE_VLAN)
-                return -EOPNOTSUPP;
-
-        ieee80211_if_reinit(dev);
-        ieee80211_if_set_type(dev, itype);
+        ret = ieee80211_if_change_type(sdata, itype);
+        if (ret)
+                return ret;
 
         if (ieee80211_vif_is_mesh(&sdata->vif) && params->mesh_id_len)
                 ieee80211_if_sta_set_mesh_id(&sdata->u.sta,
@@ -256,8 +240,8 @@ static int ieee80211_get_key(struct wiphy *wiphy, struct net_device *dev,
         case ALG_TKIP:
                 params.cipher = WLAN_CIPHER_SUITE_TKIP;
 
-                iv32 = key->u.tkip.iv32;
-                iv16 = key->u.tkip.iv16;
+                iv32 = key->u.tkip.tx.iv32;
+                iv16 = key->u.tkip.tx.iv16;
 
                 if (key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE &&
                     sdata->local->ops->get_tkip_seq)
@@ -485,7 +469,7 @@ static int ieee80211_config_beacon(struct ieee80211_sub_if_data *sdata,
 
         kfree(old);
 
-        return ieee80211_if_config_beacon(sdata->dev);
+        return ieee80211_if_config(sdata, IEEE80211_IFCC_BEACON);
 }
 
 static int ieee80211_add_beacon(struct wiphy *wiphy, struct net_device *dev,
@@ -539,7 +523,7 @@ static int ieee80211_del_beacon(struct wiphy *wiphy, struct net_device *dev)
         synchronize_rcu();
         kfree(old);
 
-        return ieee80211_if_config_beacon(dev);
+        return ieee80211_if_config(sdata, IEEE80211_IFCC_BEACON);
 }
 
 /* Layer 2 Update frame (802.2 Type 1 LLC XID Update response) */
@@ -602,6 +586,7 @@ static void sta_apply_parameters(struct ieee80211_local *local,
          */
 
         if (params->station_flags & STATION_FLAG_CHANGED) {
+                spin_lock_bh(&sta->lock);
                 sta->flags &= ~WLAN_STA_AUTHORIZED;
                 if (params->station_flags & STATION_FLAG_AUTHORIZED)
                         sta->flags |= WLAN_STA_AUTHORIZED;
@@ -613,6 +598,7 @@ static void sta_apply_parameters(struct ieee80211_local *local,
                 sta->flags &= ~WLAN_STA_WME;
                 if (params->station_flags & STATION_FLAG_WME)
                         sta->flags |= WLAN_STA_WME;
+                spin_unlock_bh(&sta->lock);
         }
 
         /*
diff --git a/net/mac80211/debugfs.c b/net/mac80211/debugfs.c
index 1cccbfd781f6..ee509f1109e2 100644
--- a/net/mac80211/debugfs.c
+++ b/net/mac80211/debugfs.c
@@ -70,16 +70,6 @@ DEBUGFS_READONLY_FILE(rate_ctrl_alg, 100, "%s",
 
 /* statistics stuff */
 
-static inline int rtnl_lock_local(struct ieee80211_local *local)
-{
-        rtnl_lock();
-        if (unlikely(local->reg_state != IEEE80211_DEV_REGISTERED)) {
-                rtnl_unlock();
-                return -ENODEV;
-        }
-        return 0;
-}
-
 #define DEBUGFS_STATS_FILE(name, buflen, fmt, value...)                 \
         DEBUGFS_READONLY_FILE(stats_ ##name, buflen, fmt, ##value)
 
@@ -96,10 +86,7 @@ static ssize_t format_devstat_counter(struct ieee80211_local *local,
         if (!local->ops->get_stats)
                 return -EOPNOTSUPP;
 
-        res = rtnl_lock_local(local);
-        if (res)
-                return res;
-
+        rtnl_lock();
         res = local->ops->get_stats(local_to_hw(local), &stats);
         rtnl_unlock();
         if (!res)
@@ -197,45 +184,6 @@ DEBUGFS_STATS_FILE(rx_handlers_fragments, 20, "%u",
 DEBUGFS_STATS_FILE(tx_status_drop, 20, "%u",
                    local->tx_status_drop);
 
-static ssize_t stats_wme_rx_queue_read(struct file *file,
-                                       char __user *userbuf,
-                                       size_t count, loff_t *ppos)
-{
-        struct ieee80211_local *local = file->private_data;
-        char buf[NUM_RX_DATA_QUEUES*15], *p = buf;
-        int i;
-
-        for (i = 0; i < NUM_RX_DATA_QUEUES; i++)
-                p += scnprintf(p, sizeof(buf)+buf-p,
-                               "%u\n", local->wme_rx_queue[i]);
-
-        return simple_read_from_buffer(userbuf, count, ppos, buf, p-buf);
-}
-
-static const struct file_operations stats_wme_rx_queue_ops = {
-        .read = stats_wme_rx_queue_read,
-        .open = mac80211_open_file_generic,
-};
-
-static ssize_t stats_wme_tx_queue_read(struct file *file,
-                                       char __user *userbuf,
-                                       size_t count, loff_t *ppos)
-{
-        struct ieee80211_local *local = file->private_data;
-        char buf[NUM_TX_DATA_QUEUES*15], *p = buf;
-        int i;
-
-        for (i = 0; i < NUM_TX_DATA_QUEUES; i++)
-                p += scnprintf(p, sizeof(buf)+buf-p,
-                               "%u\n", local->wme_tx_queue[i]);
-
-        return simple_read_from_buffer(userbuf, count, ppos, buf, p-buf);
-}
-
-static const struct file_operations stats_wme_tx_queue_ops = {
-        .read = stats_wme_tx_queue_read,
-        .open = mac80211_open_file_generic,
-};
 #endif
 
 DEBUGFS_DEVSTATS_FILE(dot11ACKFailureCount);
@@ -303,8 +251,6 @@ void debugfs_hw_add(struct ieee80211_local *local)
         DEBUGFS_STATS_ADD(rx_expand_skb_head2);
         DEBUGFS_STATS_ADD(rx_handlers_fragments);
         DEBUGFS_STATS_ADD(tx_status_drop);
-        DEBUGFS_STATS_ADD(wme_tx_queue);
-        DEBUGFS_STATS_ADD(wme_rx_queue);
 #endif
         DEBUGFS_STATS_ADD(dot11ACKFailureCount);
         DEBUGFS_STATS_ADD(dot11RTSFailureCount);
@@ -356,8 +302,6 @@ void debugfs_hw_del(struct ieee80211_local *local)
         DEBUGFS_STATS_DEL(rx_expand_skb_head2);
         DEBUGFS_STATS_DEL(rx_handlers_fragments);
         DEBUGFS_STATS_DEL(tx_status_drop);
-        DEBUGFS_STATS_DEL(wme_tx_queue);
-        DEBUGFS_STATS_DEL(wme_rx_queue);
 #endif
         DEBUGFS_STATS_DEL(dot11ACKFailureCount);
         DEBUGFS_STATS_DEL(dot11RTSFailureCount);
diff --git a/net/mac80211/debugfs_key.c b/net/mac80211/debugfs_key.c
index 19efc3a6a932..7439b63df5d0 100644
--- a/net/mac80211/debugfs_key.c
+++ b/net/mac80211/debugfs_key.c
@@ -97,8 +97,8 @@ static ssize_t key_tx_spec_read(struct file *file, char __user *userbuf,
                 break;
         case ALG_TKIP:
                 len = scnprintf(buf, sizeof(buf), "%08x %04x\n",
-                                key->u.tkip.iv32,
-                                key->u.tkip.iv16);
+                                key->u.tkip.tx.iv32,
+                                key->u.tkip.tx.iv16);
                 break;
         case ALG_CCMP:
                 tpn = key->u.ccmp.tx_pn;
@@ -128,8 +128,8 @@ static ssize_t key_rx_spec_read(struct file *file, char __user *userbuf,
                 for (i = 0; i < NUM_RX_DATA_QUEUES; i++)
                         p += scnprintf(p, sizeof(buf)+buf-p,
                                        "%08x %04x\n",
-                                       key->u.tkip.iv32_rx[i],
-                                       key->u.tkip.iv16_rx[i]);
+                                       key->u.tkip.rx[i].iv32,
+                                       key->u.tkip.rx[i].iv16);
                 len = p - buf;
                 break;
         case ALG_CCMP:
diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c
index e3326d046944..475f89a8aee1 100644
--- a/net/mac80211/debugfs_netdev.c
+++ b/net/mac80211/debugfs_netdev.c
@@ -155,8 +155,9 @@ static const struct file_operations name##_ops = {			\
                 __IEEE80211_IF_WFILE(name)
 
 /* common attributes */
-IEEE80211_IF_FILE(channel_use, channel_use, DEC);
 IEEE80211_IF_FILE(drop_unencrypted, drop_unencrypted, DEC);
+IEEE80211_IF_FILE(force_unicast_rateidx, force_unicast_rateidx, DEC);
+IEEE80211_IF_FILE(max_ratectrl_rateidx, max_ratectrl_rateidx, DEC);
 
 /* STA/IBSS attributes */
 IEEE80211_IF_FILE(state, u.sta.state, DEC);
@@ -192,8 +193,6 @@ __IEEE80211_IF_FILE(flags);
 IEEE80211_IF_FILE(num_sta_ps, u.ap.num_sta_ps, ATOMIC);
 IEEE80211_IF_FILE(dtim_count, u.ap.dtim_count, DEC);
 IEEE80211_IF_FILE(num_beacons, u.ap.num_beacons, DEC);
-IEEE80211_IF_FILE(force_unicast_rateidx, u.ap.force_unicast_rateidx, DEC);
-IEEE80211_IF_FILE(max_ratectrl_rateidx, u.ap.max_ratectrl_rateidx, DEC);
 
 static ssize_t ieee80211_if_fmt_num_buffered_multicast(
         const struct ieee80211_sub_if_data *sdata, char *buf, int buflen)
@@ -248,8 +247,10 @@ IEEE80211_IF_WFILE(min_discovery_timeout,
 
 static void add_sta_files(struct ieee80211_sub_if_data *sdata)
 {
-        DEBUGFS_ADD(channel_use, sta);
         DEBUGFS_ADD(drop_unencrypted, sta);
+        DEBUGFS_ADD(force_unicast_rateidx, ap);
+        DEBUGFS_ADD(max_ratectrl_rateidx, ap);
+
         DEBUGFS_ADD(state, sta);
         DEBUGFS_ADD(bssid, sta);
         DEBUGFS_ADD(prev_bssid, sta);
@@ -269,27 +270,30 @@ static void add_sta_files(struct ieee80211_sub_if_data *sdata)
 
 static void add_ap_files(struct ieee80211_sub_if_data *sdata)
 {
-        DEBUGFS_ADD(channel_use, ap);
         DEBUGFS_ADD(drop_unencrypted, ap);
+        DEBUGFS_ADD(force_unicast_rateidx, ap);
+        DEBUGFS_ADD(max_ratectrl_rateidx, ap);
+
         DEBUGFS_ADD(num_sta_ps, ap);
         DEBUGFS_ADD(dtim_count, ap);
         DEBUGFS_ADD(num_beacons, ap);
-        DEBUGFS_ADD(force_unicast_rateidx, ap);
-        DEBUGFS_ADD(max_ratectrl_rateidx, ap);
         DEBUGFS_ADD(num_buffered_multicast, ap);
 }
 
 static void add_wds_files(struct ieee80211_sub_if_data *sdata)
 {
-        DEBUGFS_ADD(channel_use, wds);
         DEBUGFS_ADD(drop_unencrypted, wds);
+        DEBUGFS_ADD(force_unicast_rateidx, ap);
+        DEBUGFS_ADD(max_ratectrl_rateidx, ap);
+
         DEBUGFS_ADD(peer, wds);
 }
 
 static void add_vlan_files(struct ieee80211_sub_if_data *sdata)
 {
-        DEBUGFS_ADD(channel_use, vlan);
         DEBUGFS_ADD(drop_unencrypted, vlan);
+        DEBUGFS_ADD(force_unicast_rateidx, ap);
+        DEBUGFS_ADD(max_ratectrl_rateidx, ap);
 }
 
 static void add_monitor_files(struct ieee80211_sub_if_data *sdata)
@@ -376,8 +380,10 @@ static void add_files(struct ieee80211_sub_if_data *sdata)
 
 static void del_sta_files(struct ieee80211_sub_if_data *sdata)
 {
-        DEBUGFS_DEL(channel_use, sta);
         DEBUGFS_DEL(drop_unencrypted, sta);
+        DEBUGFS_DEL(force_unicast_rateidx, ap);
+        DEBUGFS_DEL(max_ratectrl_rateidx, ap);
+
         DEBUGFS_DEL(state, sta);
         DEBUGFS_DEL(bssid, sta);
         DEBUGFS_DEL(prev_bssid, sta);
@@ -397,27 +403,30 @@ static void del_sta_files(struct ieee80211_sub_if_data *sdata)
 
 static void del_ap_files(struct ieee80211_sub_if_data *sdata)
 {
-        DEBUGFS_DEL(channel_use, ap);
         DEBUGFS_DEL(drop_unencrypted, ap);
+        DEBUGFS_DEL(force_unicast_rateidx, ap);
+        DEBUGFS_DEL(max_ratectrl_rateidx, ap);
+
         DEBUGFS_DEL(num_sta_ps, ap);
         DEBUGFS_DEL(dtim_count, ap);
         DEBUGFS_DEL(num_beacons, ap);
-        DEBUGFS_DEL(force_unicast_rateidx, ap);
-        DEBUGFS_DEL(max_ratectrl_rateidx, ap);
         DEBUGFS_DEL(num_buffered_multicast, ap);
 }
 
 static void del_wds_files(struct ieee80211_sub_if_data *sdata)
 {
-        DEBUGFS_DEL(channel_use, wds);
         DEBUGFS_DEL(drop_unencrypted, wds);
+        DEBUGFS_DEL(force_unicast_rateidx, ap);
+        DEBUGFS_DEL(max_ratectrl_rateidx, ap);
+
         DEBUGFS_DEL(peer, wds);
 }
 
 static void del_vlan_files(struct ieee80211_sub_if_data *sdata)
 {
-        DEBUGFS_DEL(channel_use, vlan);
         DEBUGFS_DEL(drop_unencrypted, vlan);
+        DEBUGFS_DEL(force_unicast_rateidx, ap);
+        DEBUGFS_DEL(max_ratectrl_rateidx, ap);
 }
 
 static void del_monitor_files(struct ieee80211_sub_if_data *sdata)
@@ -467,12 +476,12 @@ static void del_mesh_config(struct ieee80211_sub_if_data *sdata)
 }
 #endif
 
-static void del_files(struct ieee80211_sub_if_data *sdata, int type)
+static void del_files(struct ieee80211_sub_if_data *sdata)
 {
         if (!sdata->debugfsdir)
                 return;
 
-        switch (type) {
+        switch (sdata->vif.type) {
         case IEEE80211_IF_TYPE_MESH_POINT:
 #ifdef CONFIG_MAC80211_MESH
                 del_mesh_stats(sdata);
@@ -512,29 +521,23 @@ void ieee80211_debugfs_add_netdev(struct ieee80211_sub_if_data *sdata)
         sprintf(buf, "netdev:%s", sdata->dev->name);
         sdata->debugfsdir = debugfs_create_dir(buf,
                 sdata->local->hw.wiphy->debugfsdir);
+        add_files(sdata);
 }
 
 void ieee80211_debugfs_remove_netdev(struct ieee80211_sub_if_data *sdata)
 {
-        del_files(sdata, sdata->vif.type);
+        del_files(sdata);
         debugfs_remove(sdata->debugfsdir);
         sdata->debugfsdir = NULL;
 }
 
-void ieee80211_debugfs_change_if_type(struct ieee80211_sub_if_data *sdata,
-                                      int oldtype)
-{
-        del_files(sdata, oldtype);
-        add_files(sdata);
-}
-
-static int netdev_notify(struct notifier_block * nb,
+static int netdev_notify(struct notifier_block *nb,
                          unsigned long state,
                          void *ndev)
 {
         struct net_device *dev = ndev;
         struct dentry *dir;
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_sub_if_data *sdata;
         char buf[10+IFNAMSIZ];
 
         if (state != NETDEV_CHANGENAME)
@@ -546,6 +549,8 @@ static int netdev_notify(struct notifier_block * nb,
         if (dev->ieee80211_ptr->wiphy->privid != mac80211_wiphy_privid)
                 return 0;
 
+        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+
         sprintf(buf, "netdev:%s", dev->name);
         dir = sdata->debugfsdir;
         if (!debugfs_rename(dir->d_parent, dir, dir->d_parent, buf))
diff --git a/net/mac80211/debugfs_netdev.h b/net/mac80211/debugfs_netdev.h
index a690071fde8a..7af731f0b731 100644
--- a/net/mac80211/debugfs_netdev.h
+++ b/net/mac80211/debugfs_netdev.h
@@ -6,8 +6,6 @@
 #ifdef CONFIG_MAC80211_DEBUGFS
 void ieee80211_debugfs_add_netdev(struct ieee80211_sub_if_data *sdata);
 void ieee80211_debugfs_remove_netdev(struct ieee80211_sub_if_data *sdata);
-void ieee80211_debugfs_change_if_type(struct ieee80211_sub_if_data *sdata,
-                                     int oldtype);
 void ieee80211_debugfs_netdev_init(void);
 void ieee80211_debugfs_netdev_exit(void);
 #else
@@ -17,9 +15,6 @@ static inline void ieee80211_debugfs_add_netdev(
 static inline void ieee80211_debugfs_remove_netdev(
         struct ieee80211_sub_if_data *sdata)
 {}
-static inline void ieee80211_debugfs_change_if_type(
-        struct ieee80211_sub_if_data *sdata, int oldtype)
-{}
 static inline void ieee80211_debugfs_netdev_init(void)
 {}
 
diff --git a/net/mac80211/debugfs_sta.c b/net/mac80211/debugfs_sta.c
index 6d47a1d31b37..79a062782d52 100644
--- a/net/mac80211/debugfs_sta.c
+++ b/net/mac80211/debugfs_sta.c
@@ -63,10 +63,9 @@ STA_FILE(tx_fragments, tx_fragments, LU);
 STA_FILE(tx_filtered, tx_filtered_count, LU);
 STA_FILE(tx_retry_failed, tx_retry_failed, LU);
 STA_FILE(tx_retry_count, tx_retry_count, LU);
-STA_FILE(last_rssi, last_rssi, D);
 STA_FILE(last_signal, last_signal, D);
+STA_FILE(last_qual, last_qual, D);
 STA_FILE(last_noise, last_noise, D);
-STA_FILE(channel_use, channel_use, D);
 STA_FILE(wep_weak_iv_count, wep_weak_iv_count, LU);
 
 static ssize_t sta_flags_read(struct file *file, char __user *userbuf,
@@ -74,14 +73,15 @@ static ssize_t sta_flags_read(struct file *file, char __user *userbuf,
 {
         char buf[100];
         struct sta_info *sta = file->private_data;
+        u32 staflags = get_sta_flags(sta);
         int res = scnprintf(buf, sizeof(buf), "%s%s%s%s%s%s%s",
-                sta->flags & WLAN_STA_AUTH ? "AUTH\n" : "",
-                sta->flags & WLAN_STA_ASSOC ? "ASSOC\n" : "",
-                sta->flags & WLAN_STA_PS ? "PS\n" : "",
-                sta->flags & WLAN_STA_AUTHORIZED ? "AUTHORIZED\n" : "",
-                sta->flags & WLAN_STA_SHORT_PREAMBLE ? "SHORT PREAMBLE\n" : "",
-                sta->flags & WLAN_STA_WME ? "WME\n" : "",
-                sta->flags & WLAN_STA_WDS ? "WDS\n" : "");
+                staflags & WLAN_STA_AUTH ? "AUTH\n" : "",
+                staflags & WLAN_STA_ASSOC ? "ASSOC\n" : "",
+                staflags & WLAN_STA_PS ? "PS\n" : "",
+                staflags & WLAN_STA_AUTHORIZED ? "AUTHORIZED\n" : "",
+                staflags & WLAN_STA_SHORT_PREAMBLE ? "SHORT PREAMBLE\n" : "",
+                staflags & WLAN_STA_WME ? "WME\n" : "",
+                staflags & WLAN_STA_WDS ? "WDS\n" : "");
         return simple_read_from_buffer(userbuf, count, ppos, buf, res);
 }
 STA_OPS(flags);
@@ -123,36 +123,6 @@ static ssize_t sta_last_seq_ctrl_read(struct file *file, char __user *userbuf,
 }
 STA_OPS(last_seq_ctrl);
 
-#ifdef CONFIG_MAC80211_DEBUG_COUNTERS
-static ssize_t sta_wme_rx_queue_read(struct file *file, char __user *userbuf,
-                                     size_t count, loff_t *ppos)
-{
-        char buf[15*NUM_RX_DATA_QUEUES], *p = buf;
-        int i;
-        struct sta_info *sta = file->private_data;
-        for (i = 0; i < NUM_RX_DATA_QUEUES; i++)
-                p += scnprintf(p, sizeof(buf)+buf-p, "%u ",
-                               sta->wme_rx_queue[i]);
-        p += scnprintf(p, sizeof(buf)+buf-p, "\n");
-        return simple_read_from_buffer(userbuf, count, ppos, buf, p - buf);
-}
-STA_OPS(wme_rx_queue);
-
-static ssize_t sta_wme_tx_queue_read(struct file *file, char __user *userbuf,
-                                     size_t count, loff_t *ppos)
-{
-        char buf[15*NUM_TX_DATA_QUEUES], *p = buf;
-        int i;
-        struct sta_info *sta = file->private_data;
-        for (i = 0; i < NUM_TX_DATA_QUEUES; i++)
-                p += scnprintf(p, sizeof(buf)+buf-p, "%u ",
-                               sta->wme_tx_queue[i]);
-        p += scnprintf(p, sizeof(buf)+buf-p, "\n");
-        return simple_read_from_buffer(userbuf, count, ppos, buf, p - buf);
-}
-STA_OPS(wme_tx_queue);
-#endif
-
 static ssize_t sta_agg_status_read(struct file *file, char __user *userbuf,
                                         size_t count, loff_t *ppos)
 {
@@ -293,10 +263,6 @@ void ieee80211_sta_debugfs_add(struct sta_info *sta)
         DEBUGFS_ADD(num_ps_buf_frames);
         DEBUGFS_ADD(inactive_ms);
         DEBUGFS_ADD(last_seq_ctrl);
-#ifdef CONFIG_MAC80211_DEBUG_COUNTERS
-        DEBUGFS_ADD(wme_rx_queue);
-        DEBUGFS_ADD(wme_tx_queue);
-#endif
         DEBUGFS_ADD(agg_status);
 }
 
@@ -306,10 +272,6 @@ void ieee80211_sta_debugfs_remove(struct sta_info *sta)
         DEBUGFS_DEL(num_ps_buf_frames);
         DEBUGFS_DEL(inactive_ms);
         DEBUGFS_DEL(last_seq_ctrl);
-#ifdef CONFIG_MAC80211_DEBUG_COUNTERS
-        DEBUGFS_DEL(wme_rx_queue);
-        DEBUGFS_DEL(wme_tx_queue);
-#endif
         DEBUGFS_DEL(agg_status);
 
         debugfs_remove(sta->debugfs.dir);
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 006486b26726..a4f9a832722a 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -2,6 +2,7 @@
  * Copyright 2002-2005, Instant802 Networks, Inc.
  * Copyright 2005, Devicescape Software, Inc.
  * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
+ * Copyright 2007-2008  Johannes Berg <johannes@sipsolutions.net>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
@@ -23,6 +24,8 @@
 #include <linux/spinlock.h>
 #include <linux/etherdevice.h>
 #include <net/wireless.h>
+#include <net/iw_handler.h>
+#include <net/mac80211.h>
 #include "key.h"
 #include "sta_info.h"
 
@@ -82,7 +85,7 @@ struct ieee80211_sta_bss {
         u16 capability; /* host byte order */
         enum ieee80211_band band;
         int freq;
-        int rssi, signal, noise;
+        int signal, noise, qual;
         u8 *wpa_ie;
         size_t wpa_ie_len;
         u8 *rsn_ie;
@@ -91,6 +94,8 @@ struct ieee80211_sta_bss {
         size_t wmm_ie_len;
         u8 *ht_ie;
         size_t ht_ie_len;
+        u8 *ht_add_ie;
+        size_t ht_add_ie_len;
 #ifdef CONFIG_MAC80211_MESH
         u8 *mesh_id;
         size_t mesh_id_len;
@@ -147,7 +152,6 @@ typedef unsigned __bitwise__ ieee80211_tx_result;
 #define IEEE80211_TX_UNICAST            BIT(1)
 #define IEEE80211_TX_PS_BUFFERED        BIT(2)
 #define IEEE80211_TX_PROBE_LAST_FRAG    BIT(3)
-#define IEEE80211_TX_INJECTED           BIT(4)
 
 struct ieee80211_tx_data {
         struct sk_buff *skb;
@@ -157,13 +161,12 @@ struct ieee80211_tx_data {
         struct sta_info *sta;
         struct ieee80211_key *key;
 
-        struct ieee80211_tx_control *control;
         struct ieee80211_channel *channel;
-        struct ieee80211_rate *rate;
+        s8 rate_idx;
         /* use this rate (if set) for last fragment; rate can
          * be set to lower rate for the first fragments, e.g.,
          * when using CTS protection with IEEE 802.11g. */
-        struct ieee80211_rate *last_frag_rate;
+        s8 last_frag_rate_idx;
 
         /* Extra fragments (in addition to the first fragment
          * in skb) */
@@ -202,32 +205,16 @@ struct ieee80211_rx_data {
         unsigned int flags;
         int sent_ps_buffered;
         int queue;
-        int load;
         u32 tkip_iv32;
         u16 tkip_iv16;
 };
 
-/* flags used in struct ieee80211_tx_packet_data.flags */
-#define IEEE80211_TXPD_REQ_TX_STATUS    BIT(0)
-#define IEEE80211_TXPD_DO_NOT_ENCRYPT   BIT(1)
-#define IEEE80211_TXPD_REQUEUE          BIT(2)
-#define IEEE80211_TXPD_EAPOL_FRAME      BIT(3)
-#define IEEE80211_TXPD_AMPDU            BIT(4)
-/* Stored in sk_buff->cb */
-struct ieee80211_tx_packet_data {
-        int ifindex;
-        unsigned long jiffies;
-        unsigned int flags;
-        u8 queue;
-};
-
 struct ieee80211_tx_stored_packet {
-        struct ieee80211_tx_control control;
         struct sk_buff *skb;
         struct sk_buff **extra_frag;
-        struct ieee80211_rate *last_frag_rate;
+        s8 last_frag_rate_idx;
         int num_extra_frag;
-        unsigned int last_frag_rate_ctrl_probe;
+        bool last_frag_rate_ctrl_probe;
 };
 
 struct beacon_data {
@@ -251,8 +238,6 @@ struct ieee80211_if_ap {
         struct sk_buff_head ps_bc_buf;
         atomic_t num_sta_ps; /* number of stations in PS mode */
         int dtim_count;
-        int force_unicast_rateidx; /* forced TX rateidx for unicast frames */
-        int max_ratectrl_rateidx; /* max TX rateidx for rate control */
         int num_beacons; /* number of TXed beacon frames for this BSS */
 };
 
@@ -262,7 +247,6 @@ struct ieee80211_if_wds {
 };
 
 struct ieee80211_if_vlan {
-        struct ieee80211_sub_if_data *ap;
         struct list_head list;
 };
 
@@ -436,8 +420,6 @@ struct ieee80211_sub_if_data {
          */
         u64 basic_rates;
 
-        u16 sequence;
-
         /* Fragment table for host-based reassembly */
         struct ieee80211_fragment_entry fragments[IEEE80211_FRAGMENT_MAX];
         unsigned int fragment_next;
@@ -446,16 +428,18 @@ struct ieee80211_sub_if_data {
         struct ieee80211_key *keys[NUM_DEFAULT_KEYS];
         struct ieee80211_key *default_key;
 
+        /* BSS configuration for this interface. */
+        struct ieee80211_bss_conf bss_conf;
+
         /*
-         * BSS configuration for this interface.
-         *
-         * FIXME: I feel bad putting this here when we already have a
-         *        bss pointer, but the bss pointer is just wrong when
-         *        you have multiple virtual STA mode interfaces...
-         *        This needs to be fixed.
+         * AP this belongs to: self in AP mode and
+         * corresponding AP in VLAN mode, NULL for
+         * all others (might be needed later in IBSS)
          */
-        struct ieee80211_bss_conf bss_conf;
-        struct ieee80211_if_ap *bss; /* BSS that this device belongs to */
+        struct ieee80211_if_ap *bss;
+
+        int force_unicast_rateidx; /* forced TX rateidx for unicast frames */
+        int max_ratectrl_rateidx; /* max TX rateidx for rate control */
 
         union {
                 struct ieee80211_if_ap ap;
@@ -464,14 +448,11 @@ struct ieee80211_sub_if_data {
                 struct ieee80211_if_sta sta;
                 u32 mntr_flags;
         } u;
-        int channel_use;
-        int channel_use_raw;
 
 #ifdef CONFIG_MAC80211_DEBUGFS
         struct dentry *debugfsdir;
         union {
                 struct {
-                        struct dentry *channel_use;
                         struct dentry *drop_unencrypted;
                         struct dentry *state;
                         struct dentry *bssid;
@@ -490,7 +471,6 @@ struct ieee80211_sub_if_data {
                         struct dentry *num_beacons_sta;
                 } sta;
                 struct {
-                        struct dentry *channel_use;
                         struct dentry *drop_unencrypted;
                         struct dentry *num_sta_ps;
                         struct dentry *dtim_count;
@@ -500,12 +480,10 @@ struct ieee80211_sub_if_data {
                         struct dentry *num_buffered_multicast;
                 } ap;
                 struct {
-                        struct dentry *channel_use;
                         struct dentry *drop_unencrypted;
                         struct dentry *peer;
                 } wds;
                 struct {
-                        struct dentry *channel_use;
                         struct dentry *drop_unencrypted;
                 } vlan;
                 struct {
@@ -553,8 +531,6 @@ struct ieee80211_sub_if_data *vif_to_sdata(struct ieee80211_vif *p)
         return container_of(p, struct ieee80211_sub_if_data, vif);
 }
 
-#define IEEE80211_DEV_TO_SUB_IF(dev) netdev_priv(dev)
-
 enum {
         IEEE80211_RX_MSG        = 1,
         IEEE80211_TX_STATUS_MSG = 2,
@@ -562,6 +538,9 @@ enum {
         IEEE80211_ADDBA_MSG     = 4,
 };
 
+/* maximum number of hardware queues we support. */
+#define QD_MAX_QUEUES (IEEE80211_MAX_AMPDU_QUEUES + IEEE80211_MAX_QUEUES)
+
 struct ieee80211_local {
         /* embed the driver visible part.
          * don't cast (use the static inlines below), but we keep
@@ -570,6 +549,8 @@ struct ieee80211_local {
 
         const struct ieee80211_ops *ops;
 
+        unsigned long queue_pool[BITS_TO_LONGS(QD_MAX_QUEUES)];
+
         struct net_device *mdev; /* wmaster# - "master" 802.11 device */
         int open_count;
         int monitors, cooked_mntrs;
@@ -581,12 +562,6 @@ struct ieee80211_local {
         bool tim_in_locked_section; /* see ieee80211_beacon_get() */
         int tx_headroom; /* required headroom for hardware/radiotap */
 
-        enum {
-                IEEE80211_DEV_UNINITIALIZED = 0,
-                IEEE80211_DEV_REGISTERED,
-                IEEE80211_DEV_UNREGISTERED,
-        } reg_state;
-
         /* Tasklet and skb queue to process calls from IRQ mode. All frames
          * added to skb_queue will be processed, but frames in
          * skb_queue_unreliable may be dropped if the total length of these
@@ -610,8 +585,8 @@ struct ieee80211_local {
         struct sta_info *sta_hash[STA_HASH_SIZE];
         struct timer_list sta_cleanup;
 
-        unsigned long state[NUM_TX_DATA_QUEUES_AMPDU];
-        struct ieee80211_tx_stored_packet pending_packet[NUM_TX_DATA_QUEUES_AMPDU];
+        unsigned long queues_pending[BITS_TO_LONGS(IEEE80211_MAX_QUEUES)];
+        struct ieee80211_tx_stored_packet pending_packet[IEEE80211_MAX_QUEUES];
         struct tasklet_struct tx_pending_tasklet;
 
         /* number of interfaces with corresponding IFF_ flags */
@@ -677,9 +652,6 @@ struct ieee80211_local {
              assoc_led_name[32], radio_led_name[32];
 #endif
 
-        u32 channel_use;
-        u32 channel_use_raw;
-
 #ifdef CONFIG_MAC80211_DEBUGFS
         struct work_struct sta_debugfs_add;
 #endif
@@ -705,8 +677,6 @@ struct ieee80211_local {
         unsigned int rx_expand_skb_head2;
         unsigned int rx_handlers_fragments;
         unsigned int tx_status_drop;
-        unsigned int wme_rx_queue[NUM_RX_DATA_QUEUES];
-        unsigned int wme_tx_queue[NUM_RX_DATA_QUEUES];
 #define I802_DEBUG_INC(c) (c)++
 #else /* CONFIG_MAC80211_DEBUG_COUNTERS */
 #define I802_DEBUG_INC(c) do { } while (0)
@@ -764,8 +734,6 @@ struct ieee80211_local {
                         struct dentry *rx_expand_skb_head2;
                         struct dentry *rx_handlers_fragments;
                         struct dentry *tx_status_drop;
-                        struct dentry *wme_tx_queue;
-                        struct dentry *wme_rx_queue;
 #endif
                         struct dentry *dot11ACKFailureCount;
                         struct dentry *dot11RTSFailureCount;
@@ -778,6 +746,16 @@ struct ieee80211_local {
 #endif
 };
 
+static inline struct ieee80211_sub_if_data *
+IEEE80211_DEV_TO_SUB_IF(struct net_device *dev)
+{
+        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+
+        BUG_ON(!local || local->mdev == dev);
+
+        return netdev_priv(dev);
+}
+
 /* this struct represents 802.11n's RA/TID combination */
 struct ieee80211_ra_tid {
         u8 ra[ETH_ALEN];
@@ -809,6 +787,10 @@ struct ieee802_11_elems {
         u8 *preq;
         u8 *prep;
         u8 *perr;
+        u8 *ch_switch_elem;
+        u8 *country_elem;
+        u8 *pwr_constr_elem;
+        u8 *quiet_elem;         /* first quite element */
 
         /* length of them, respectively */
         u8 ssid_len;
@@ -833,6 +815,11 @@ struct ieee802_11_elems {
         u8 preq_len;
         u8 prep_len;
         u8 perr_len;
+        u8 ch_switch_elem_len;
+        u8 country_elem_len;
+        u8 pwr_constr_elem_len;
+        u8 quiet_elem_len;
+        u8 num_of_quiet_elem;   /* can be more the one */
 };
 
 static inline struct ieee80211_local *hw_to_local(
@@ -847,11 +834,6 @@ static inline struct ieee80211_hw *local_to_hw(
         return &local->hw;
 }
 
-enum ieee80211_link_state_t {
-        IEEE80211_LINK_STATE_XOFF = 0,
-        IEEE80211_LINK_STATE_PENDING,
-};
-
 struct sta_attribute {
         struct attribute attr;
         ssize_t (*show)(const struct sta_info *, char *buf);
@@ -867,39 +849,16 @@ static inline int ieee80211_bssid_match(const u8 *raddr, const u8 *addr)
 
 /* ieee80211.c */
 int ieee80211_hw_config(struct ieee80211_local *local);
-int ieee80211_if_config(struct net_device *dev);
-int ieee80211_if_config_beacon(struct net_device *dev);
+int ieee80211_if_config(struct ieee80211_sub_if_data *sdata, u32 changed);
 void ieee80211_tx_set_protected(struct ieee80211_tx_data *tx);
-void ieee80211_if_setup(struct net_device *dev);
 u32 ieee80211_handle_ht(struct ieee80211_local *local, int enable_ht,
                         struct ieee80211_ht_info *req_ht_cap,
                         struct ieee80211_ht_bss_info *req_bss_cap);
 
 /* ieee80211_ioctl.c */
 extern const struct iw_handler_def ieee80211_iw_handler_def;
-
-
-/* Least common multiple of the used rates (in 100 kbps). This is used to
- * calculate rate_inv values for each rate so that only integers are needed. */
-#define CHAN_UTIL_RATE_LCM 95040
-/* 1 usec is 1/8 * (95040/10) = 1188 */
-#define CHAN_UTIL_PER_USEC 1188
-/* Amount of bits to shift the result right to scale the total utilization
- * to values that will not wrap around 32-bit integers. */
-#define CHAN_UTIL_SHIFT 9
-/* Theoretical maximum of channel utilization counter in 10 ms (stat_time=1):
- * (CHAN_UTIL_PER_USEC * 10000) >> CHAN_UTIL_SHIFT = 23203. So dividing the
- * raw value with about 23 should give utilization in 10th of a percentage
- * (1/1000). However, utilization is only estimated and not all intervals
- * between frames etc. are calculated. 18 seems to give numbers that are closer
- * to the real maximum. */
-#define CHAN_UTIL_PER_10MS 18
-#define CHAN_UTIL_HDR_LONG (202 * CHAN_UTIL_PER_USEC)
-#define CHAN_UTIL_HDR_SHORT (40 * CHAN_UTIL_PER_USEC)
-
-
-/* ieee80211_ioctl.c */
 int ieee80211_set_freq(struct net_device *dev, int freq);
+
 /* ieee80211_sta.c */
 void ieee80211_sta_timer(unsigned long data);
 void ieee80211_sta_work(struct work_struct *work);
@@ -912,21 +871,23 @@ int ieee80211_sta_set_bssid(struct net_device *dev, u8 *bssid);
 int ieee80211_sta_req_scan(struct net_device *dev, u8 *ssid, size_t ssid_len);
 void ieee80211_sta_req_auth(struct net_device *dev,
                             struct ieee80211_if_sta *ifsta);
-int ieee80211_sta_scan_results(struct net_device *dev, char *buf, size_t len);
+int ieee80211_sta_scan_results(struct net_device *dev,
+                               struct iw_request_info *info,
+                               char *buf, size_t len);
 ieee80211_rx_result ieee80211_sta_rx_scan(
         struct net_device *dev, struct sk_buff *skb,
         struct ieee80211_rx_status *rx_status);
-void ieee80211_rx_bss_list_init(struct net_device *dev);
-void ieee80211_rx_bss_list_deinit(struct net_device *dev);
+void ieee80211_rx_bss_list_init(struct ieee80211_local *local);
+void ieee80211_rx_bss_list_deinit(struct ieee80211_local *local);
 int ieee80211_sta_set_extra_ie(struct net_device *dev, char *ie, size_t len);
-struct sta_info * ieee80211_ibss_add_sta(struct net_device *dev,
-                                         struct sk_buff *skb, u8 *bssid,
-                                         u8 *addr);
+struct sta_info *ieee80211_ibss_add_sta(struct net_device *dev,
+                                        struct sk_buff *skb, u8 *bssid,
+                                        u8 *addr, u64 supp_rates);
 int ieee80211_sta_deauthenticate(struct net_device *dev, u16 reason);
 int ieee80211_sta_disassociate(struct net_device *dev, u16 reason);
 void ieee80211_bss_info_change_notify(struct ieee80211_sub_if_data *sdata,
                                       u32 changed);
-void ieee80211_reset_erp_info(struct net_device *dev);
+u32 ieee80211_reset_erp_info(struct net_device *dev);
 int ieee80211_ht_cap_ie_to_ht_info(struct ieee80211_ht_cap *ht_cap_ie,
                                    struct ieee80211_ht_info *ht_info);
 int ieee80211_ht_addt_info_ie_to_ht_bss_info(
@@ -937,10 +898,10 @@ void ieee80211_send_addba_request(struct net_device *dev, const u8 *da,
                                   u16 agg_size, u16 timeout);
 void ieee80211_send_delba(struct net_device *dev, const u8 *da, u16 tid,
                                 u16 initiator, u16 reason_code);
+void ieee80211_send_bar(struct net_device *dev, u8 *ra, u16 tid, u16 ssn);
 
 void ieee80211_sta_stop_rx_ba_session(struct net_device *dev, u8 *da,
                                 u16 tid, u16 initiator, u16 reason);
-void sta_rx_agg_session_timer_expired(unsigned long data);
 void sta_addba_resp_timer_expired(unsigned long data);
 void ieee80211_sta_tear_down_BA_sessions(struct net_device *dev, u8 *addr);
 u64 ieee80211_sta_get_rates(struct ieee80211_local *local,
@@ -958,17 +919,15 @@ static inline void ieee80211_start_mesh(struct net_device *dev)
 {}
 #endif
 
-/* ieee80211_iface.c */
-int ieee80211_if_add(struct net_device *dev, const char *name,
-                     struct net_device **new_dev, int type,
+/* interface handling */
+void ieee80211_if_setup(struct net_device *dev);
+int ieee80211_if_add(struct ieee80211_local *local, const char *name,
+                     struct net_device **new_dev, enum ieee80211_if_types type,
                      struct vif_params *params);
-void ieee80211_if_set_type(struct net_device *dev, int type);
-void ieee80211_if_reinit(struct net_device *dev);
-void __ieee80211_if_del(struct ieee80211_local *local,
-                        struct ieee80211_sub_if_data *sdata);
-int ieee80211_if_remove(struct net_device *dev, const char *name, int id);
-void ieee80211_if_free(struct net_device *dev);
-void ieee80211_if_sdata_init(struct ieee80211_sub_if_data *sdata);
+int ieee80211_if_change_type(struct ieee80211_sub_if_data *sdata,
+                             enum ieee80211_if_types type);
+void ieee80211_if_remove(struct net_device *dev);
+void ieee80211_remove_interfaces(struct ieee80211_local *local);
 
 /* tx handling */
 void ieee80211_clear_tx_pending(struct ieee80211_local *local);
@@ -988,4 +947,10 @@ int ieee80211_frame_duration(struct ieee80211_local *local, size_t len,
 void mac80211_ev_michael_mic_failure(struct net_device *dev, int keyidx,
                                      struct ieee80211_hdr *hdr);
 
+#ifdef CONFIG_MAC80211_NOINLINE
+#define debug_noinline noinline
+#else
+#define debug_noinline
+#endif
+
 #endif /* IEEE80211_I_H */
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 06e88a5a036d..610ed1d9893a 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -2,6 +2,7 @@
  * Copyright 2002-2005, Instant802 Networks, Inc.
  * Copyright 2005-2006, Devicescape Software, Inc.
  * Copyright (c) 2006 Jiri Benc <jbenc@suse.cz>
+ * Copyright 2008, Johannes Berg <johannes@sipsolutions.net>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
@@ -17,38 +18,164 @@
 #include "debugfs_netdev.h"
 #include "mesh.h"
 
-void ieee80211_if_sdata_init(struct ieee80211_sub_if_data *sdata)
+/*
+ * Called when the netdev is removed or, by the code below, before
+ * the interface type changes.
+ */
+static void ieee80211_teardown_sdata(struct net_device *dev)
 {
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_local *local = sdata->local;
+        struct beacon_data *beacon;
+        struct sk_buff *skb;
+        int flushed;
         int i;
 
-        /* Default values for sub-interface parameters */
-        sdata->drop_unencrypted = 0;
+        ieee80211_debugfs_remove_netdev(sdata);
+
+        /* free extra data */
+        ieee80211_free_keys(sdata);
+
         for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++)
-                skb_queue_head_init(&sdata->fragments[i].skb_list);
+                __skb_queue_purge(&sdata->fragments[i].skb_list);
+        sdata->fragment_next = 0;
 
-        INIT_LIST_HEAD(&sdata->key_list);
+        switch (sdata->vif.type) {
+        case IEEE80211_IF_TYPE_AP:
+                beacon = sdata->u.ap.beacon;
+                rcu_assign_pointer(sdata->u.ap.beacon, NULL);
+                synchronize_rcu();
+                kfree(beacon);
+
+                while ((skb = skb_dequeue(&sdata->u.ap.ps_bc_buf))) {
+                        local->total_ps_buffered--;
+                        dev_kfree_skb(skb);
+                }
+
+                break;
+        case IEEE80211_IF_TYPE_MESH_POINT:
+                /* Allow compiler to elide mesh_rmc_free call. */
+                if (ieee80211_vif_is_mesh(&sdata->vif))
+                        mesh_rmc_free(dev);
+                /* fall through */
+        case IEEE80211_IF_TYPE_STA:
+        case IEEE80211_IF_TYPE_IBSS:
+                kfree(sdata->u.sta.extra_ie);
+                kfree(sdata->u.sta.assocreq_ies);
+                kfree(sdata->u.sta.assocresp_ies);
+                kfree_skb(sdata->u.sta.probe_resp);
+                break;
+        case IEEE80211_IF_TYPE_WDS:
+        case IEEE80211_IF_TYPE_VLAN:
+        case IEEE80211_IF_TYPE_MNTR:
+                break;
+        case IEEE80211_IF_TYPE_INVALID:
+                BUG();
+                break;
+        }
+
+        flushed = sta_info_flush(local, sdata);
+        WARN_ON(flushed);
 }
 
-static void ieee80211_if_sdata_deinit(struct ieee80211_sub_if_data *sdata)
+/*
+ * Helper function to initialise an interface to a specific type.
+ */
+static void ieee80211_setup_sdata(struct ieee80211_sub_if_data *sdata,
+                                  enum ieee80211_if_types type)
 {
-        int i;
+        struct ieee80211_if_sta *ifsta;
 
-        for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++) {
-                __skb_queue_purge(&sdata->fragments[i].skb_list);
+        /* clear type-dependent union */
+        memset(&sdata->u, 0, sizeof(sdata->u));
+
+        /* and set some type-dependent values */
+        sdata->vif.type = type;
+
+        /* only monitor differs */
+        sdata->dev->type = ARPHRD_ETHER;
+
+        switch (type) {
+        case IEEE80211_IF_TYPE_AP:
+                skb_queue_head_init(&sdata->u.ap.ps_bc_buf);
+                INIT_LIST_HEAD(&sdata->u.ap.vlans);
+                break;
+        case IEEE80211_IF_TYPE_MESH_POINT:
+        case IEEE80211_IF_TYPE_STA:
+        case IEEE80211_IF_TYPE_IBSS:
+                ifsta = &sdata->u.sta;
+                INIT_WORK(&ifsta->work, ieee80211_sta_work);
+                setup_timer(&ifsta->timer, ieee80211_sta_timer,
+                            (unsigned long) sdata);
+                skb_queue_head_init(&ifsta->skb_queue);
+
+                ifsta->capab = WLAN_CAPABILITY_ESS;
+                ifsta->auth_algs = IEEE80211_AUTH_ALG_OPEN |
+                        IEEE80211_AUTH_ALG_SHARED_KEY;
+                ifsta->flags |= IEEE80211_STA_CREATE_IBSS |
+                        IEEE80211_STA_AUTO_BSSID_SEL |
+                        IEEE80211_STA_AUTO_CHANNEL_SEL;
+                if (ieee80211_num_regular_queues(&sdata->local->hw) >= 4)
+                        ifsta->flags |= IEEE80211_STA_WMM_ENABLED;
+
+                if (ieee80211_vif_is_mesh(&sdata->vif))
+                        ieee80211_mesh_init_sdata(sdata);
+                break;
+        case IEEE80211_IF_TYPE_MNTR:
+                sdata->dev->type = ARPHRD_IEEE80211_RADIOTAP;
+                sdata->dev->hard_start_xmit = ieee80211_monitor_start_xmit;
+                sdata->u.mntr_flags = MONITOR_FLAG_CONTROL |
+                                      MONITOR_FLAG_OTHER_BSS;
+                break;
+        case IEEE80211_IF_TYPE_WDS:
+        case IEEE80211_IF_TYPE_VLAN:
+                break;
+        case IEEE80211_IF_TYPE_INVALID:
+                BUG();
+                break;
         }
+
+        ieee80211_debugfs_add_netdev(sdata);
+}
+
+int ieee80211_if_change_type(struct ieee80211_sub_if_data *sdata,
+                             enum ieee80211_if_types type)
+{
+        ASSERT_RTNL();
+
+        if (type == sdata->vif.type)
+                return 0;
+
+        /*
+         * We could, here, on changes between IBSS/STA/MESH modes,
+         * invoke an MLME function instead that disassociates etc.
+         * and goes into the requested mode.
+         */
+
+        if (netif_running(sdata->dev))
+                return -EBUSY;
+
+        /* Purge and reset type-dependent state. */
+        ieee80211_teardown_sdata(sdata->dev);
+        ieee80211_setup_sdata(sdata, type);
+
+        /* reset some values that shouldn't be kept across type changes */
+        sdata->basic_rates = 0;
+        sdata->drop_unencrypted = 0;
+
+        return 0;
 }
 
-/* Must be called with rtnl lock held. */
-int ieee80211_if_add(struct net_device *dev, const char *name,
-                     struct net_device **new_dev, int type,
+int ieee80211_if_add(struct ieee80211_local *local, const char *name,
+                     struct net_device **new_dev, enum ieee80211_if_types type,
                      struct vif_params *params)
 {
         struct net_device *ndev;
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
         struct ieee80211_sub_if_data *sdata = NULL;
-        int ret;
+        int ret, i;
 
         ASSERT_RTNL();
+
         ndev = alloc_netdev(sizeof(*sdata) + local->hw.vif_data_size,
                             name, ieee80211_if_setup);
         if (!ndev)
@@ -68,26 +195,33 @@ int ieee80211_if_add(struct net_device *dev, const char *name,
                 goto fail;
 
         memcpy(ndev->dev_addr, local->hw.wiphy->perm_addr, ETH_ALEN);
-        ndev->base_addr = dev->base_addr;
-        ndev->irq = dev->irq;
-        ndev->mem_start = dev->mem_start;
-        ndev->mem_end = dev->mem_end;
         SET_NETDEV_DEV(ndev, wiphy_dev(local->hw.wiphy));
 
-        sdata = IEEE80211_DEV_TO_SUB_IF(ndev);
+        /* don't use IEEE80211_DEV_TO_SUB_IF because it checks too much */
+        sdata = netdev_priv(ndev);
         ndev->ieee80211_ptr = &sdata->wdev;
+
+        /* initialise type-independent data */
         sdata->wdev.wiphy = local->hw.wiphy;
-        sdata->vif.type = IEEE80211_IF_TYPE_AP;
-        sdata->dev = ndev;
         sdata->local = local;
-        ieee80211_if_sdata_init(sdata);
+        sdata->dev = ndev;
+
+        for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++)
+                skb_queue_head_init(&sdata->fragments[i].skb_list);
+
+        INIT_LIST_HEAD(&sdata->key_list);
+
+        sdata->force_unicast_rateidx = -1;
+        sdata->max_ratectrl_rateidx = -1;
+
+        /* setup type-dependent data */
+        ieee80211_setup_sdata(sdata, type);
 
         ret = register_netdevice(ndev);
         if (ret)
                 goto fail;
 
-        ieee80211_debugfs_add_netdev(sdata);
-        ieee80211_if_set_type(ndev, type);
+        ndev->uninit = ieee80211_teardown_sdata;
 
         if (ieee80211_vif_is_mesh(&sdata->vif) &&
             params && params->mesh_id_len)
@@ -95,11 +229,6 @@ int ieee80211_if_add(struct net_device *dev, const char *name,
                                              params->mesh_id_len,
                                              params->mesh_id);
 
-        /* we're under RTNL so all this is fine */
-        if (unlikely(local->reg_state == IEEE80211_DEV_UNREGISTERED)) {
-                __ieee80211_if_del(local, sdata);
-                return -ENODEV;
-        }
         list_add_tail_rcu(&sdata->list, &local->interfaces);
 
         if (new_dev)
@@ -107,217 +236,34 @@ int ieee80211_if_add(struct net_device *dev, const char *name,
 
         return 0;
 
-fail:
+ fail:
         free_netdev(ndev);
         return ret;
 }
 
-void ieee80211_if_set_type(struct net_device *dev, int type)
-{
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        int oldtype = sdata->vif.type;
-
-        /*
-         * We need to call this function on the master interface
-         * which already has a hard_start_xmit routine assigned
-         * which must not be changed.
-         */
-        if (dev != sdata->local->mdev)
-                dev->hard_start_xmit = ieee80211_subif_start_xmit;
-
-        /*
-         * Called even when register_netdevice fails, it would
-         * oops if assigned before initialising the rest.
-         */
-        dev->uninit = ieee80211_if_reinit;
-
-        /* most have no BSS pointer */
-        sdata->bss = NULL;
-        sdata->vif.type = type;
-
-        sdata->basic_rates = 0;
-
-        switch (type) {
-        case IEEE80211_IF_TYPE_WDS:
-                /* nothing special */
-                break;
-        case IEEE80211_IF_TYPE_VLAN:
-                sdata->u.vlan.ap = NULL;
-                break;
-        case IEEE80211_IF_TYPE_AP:
-                sdata->u.ap.force_unicast_rateidx = -1;
-                sdata->u.ap.max_ratectrl_rateidx = -1;
-                skb_queue_head_init(&sdata->u.ap.ps_bc_buf);
-                sdata->bss = &sdata->u.ap;
-                INIT_LIST_HEAD(&sdata->u.ap.vlans);
-                break;
-        case IEEE80211_IF_TYPE_MESH_POINT:
-        case IEEE80211_IF_TYPE_STA:
-        case IEEE80211_IF_TYPE_IBSS: {
-                struct ieee80211_sub_if_data *msdata;
-                struct ieee80211_if_sta *ifsta;
-
-                ifsta = &sdata->u.sta;
-                INIT_WORK(&ifsta->work, ieee80211_sta_work);
-                setup_timer(&ifsta->timer, ieee80211_sta_timer,
-                            (unsigned long) sdata);
-                skb_queue_head_init(&ifsta->skb_queue);
-
-                ifsta->capab = WLAN_CAPABILITY_ESS;
-                ifsta->auth_algs = IEEE80211_AUTH_ALG_OPEN |
-                        IEEE80211_AUTH_ALG_SHARED_KEY;
-                ifsta->flags |= IEEE80211_STA_CREATE_IBSS |
-                        IEEE80211_STA_WMM_ENABLED |
-                        IEEE80211_STA_AUTO_BSSID_SEL |
-                        IEEE80211_STA_AUTO_CHANNEL_SEL;
-
-                msdata = IEEE80211_DEV_TO_SUB_IF(sdata->local->mdev);
-                sdata->bss = &msdata->u.ap;
-
-                if (ieee80211_vif_is_mesh(&sdata->vif))
-                        ieee80211_mesh_init_sdata(sdata);
-                break;
-        }
-        case IEEE80211_IF_TYPE_MNTR:
-                dev->type = ARPHRD_IEEE80211_RADIOTAP;
-                dev->hard_start_xmit = ieee80211_monitor_start_xmit;
-                sdata->u.mntr_flags = MONITOR_FLAG_CONTROL |
-                                      MONITOR_FLAG_OTHER_BSS;
-                break;
-        default:
-                printk(KERN_WARNING "%s: %s: Unknown interface type 0x%x",
-                       dev->name, __func__, type);
-        }
-        ieee80211_debugfs_change_if_type(sdata, oldtype);
-}
-
-/* Must be called with rtnl lock held. */
-void ieee80211_if_reinit(struct net_device *dev)
+void ieee80211_if_remove(struct net_device *dev)
 {
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        struct sk_buff *skb;
-        int flushed;
 
         ASSERT_RTNL();
 
-        ieee80211_free_keys(sdata);
-
-        ieee80211_if_sdata_deinit(sdata);
-
-        /* Need to handle mesh specially to allow eliding the function call */
-        if (ieee80211_vif_is_mesh(&sdata->vif))
-                mesh_rmc_free(dev);
-
-        switch (sdata->vif.type) {
-        case IEEE80211_IF_TYPE_INVALID:
-                /* cannot happen */
-                WARN_ON(1);
-                break;
-        case IEEE80211_IF_TYPE_AP: {
-                /* Remove all virtual interfaces that use this BSS
-                 * as their sdata->bss */
-                struct ieee80211_sub_if_data *tsdata, *n;
-                struct beacon_data *beacon;
-
-                list_for_each_entry_safe(tsdata, n, &local->interfaces, list) {
-                        if (tsdata != sdata && tsdata->bss == &sdata->u.ap) {
-                                printk(KERN_DEBUG "%s: removing virtual "
-                                       "interface %s because its BSS interface"
-                                       " is being removed\n",
-                                       sdata->dev->name, tsdata->dev->name);
-                                list_del_rcu(&tsdata->list);
-                                /*
-                                 * We have lots of time and can afford
-                                 * to sync for each interface
-                                 */
-                                synchronize_rcu();
-                                __ieee80211_if_del(local, tsdata);
-                        }
-                }
-
-                beacon = sdata->u.ap.beacon;
-                rcu_assign_pointer(sdata->u.ap.beacon, NULL);
-                synchronize_rcu();
-                kfree(beacon);
-
-                while ((skb = skb_dequeue(&sdata->u.ap.ps_bc_buf))) {
-                        local->total_ps_buffered--;
-                        dev_kfree_skb(skb);
-                }
-
-                break;
-        }
-        case IEEE80211_IF_TYPE_WDS:
-                /* nothing to do */
-                break;
-        case IEEE80211_IF_TYPE_MESH_POINT:
-        case IEEE80211_IF_TYPE_STA:
-        case IEEE80211_IF_TYPE_IBSS:
-                kfree(sdata->u.sta.extra_ie);
-                sdata->u.sta.extra_ie = NULL;
-                kfree(sdata->u.sta.assocreq_ies);
-                sdata->u.sta.assocreq_ies = NULL;
-                kfree(sdata->u.sta.assocresp_ies);
-                sdata->u.sta.assocresp_ies = NULL;
-                if (sdata->u.sta.probe_resp) {
-                        dev_kfree_skb(sdata->u.sta.probe_resp);
-                        sdata->u.sta.probe_resp = NULL;
-                }
-
-                break;
-        case IEEE80211_IF_TYPE_MNTR:
-                dev->type = ARPHRD_ETHER;
-                break;
-        case IEEE80211_IF_TYPE_VLAN:
-                sdata->u.vlan.ap = NULL;
-                break;
-        }
-
-        flushed = sta_info_flush(local, sdata);
-        WARN_ON(flushed);
-
-        memset(&sdata->u, 0, sizeof(sdata->u));
-        ieee80211_if_sdata_init(sdata);
-}
-
-/* Must be called with rtnl lock held. */
-void __ieee80211_if_del(struct ieee80211_local *local,
-                        struct ieee80211_sub_if_data *sdata)
-{
-        struct net_device *dev = sdata->dev;
-
-        ieee80211_debugfs_remove_netdev(sdata);
+        list_del_rcu(&sdata->list);
+        synchronize_rcu();
         unregister_netdevice(dev);
-        /* Except master interface, the net_device will be freed by
-         * net_device->destructor (i. e. ieee80211_if_free). */
 }
 
-/* Must be called with rtnl lock held. */
-int ieee80211_if_remove(struct net_device *dev, const char *name, int id)
+/*
+ * Remove all interfaces, may only be called at hardware unregistration
+ * time because it doesn't do RCU-safe list removals.
+ */
+void ieee80211_remove_interfaces(struct ieee80211_local *local)
 {
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        struct ieee80211_sub_if_data *sdata, *n;
+        struct ieee80211_sub_if_data *sdata, *tmp;
 
         ASSERT_RTNL();
 
-        list_for_each_entry_safe(sdata, n, &local->interfaces, list) {
-                if ((sdata->vif.type == id || id == -1) &&
-                    strcmp(name, sdata->dev->name) == 0 &&
-                    sdata->dev != local->mdev) {
-                        list_del_rcu(&sdata->list);
-                        synchronize_rcu();
-                        __ieee80211_if_del(local, sdata);
-                        return 0;
-                }
+        list_for_each_entry_safe(sdata, tmp, &local->interfaces, list) {
+                list_del(&sdata->list);
+                unregister_netdevice(sdata->dev);
         }
-        return -ENODEV;
-}
-
-void ieee80211_if_free(struct net_device *dev)
-{
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-
-        ieee80211_if_sdata_deinit(sdata);
-        free_netdev(dev);
 }
diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index 150d66dbda9d..6597c779e35a 100644
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -321,8 +321,15 @@ void ieee80211_key_link(struct ieee80211_key *key,
                  * some hardware cannot handle TKIP with QoS, so
                  * we indicate whether QoS could be in use.
                  */
-                if (sta->flags & WLAN_STA_WME)
+                if (test_sta_flags(sta, WLAN_STA_WME))
                         key->conf.flags |= IEEE80211_KEY_FLAG_WMM_STA;
+
+                /*
+                 * This key is for a specific sta interface,
+                 * inform the driver that it should try to store
+                 * this key as pairwise key.
+                 */
+                key->conf.flags |= IEEE80211_KEY_FLAG_PAIRWISE;
         } else {
                 if (sdata->vif.type == IEEE80211_IF_TYPE_STA) {
                         struct sta_info *ap;
@@ -335,7 +342,7 @@ void ieee80211_key_link(struct ieee80211_key *key,
                         /* same here, the AP could be using QoS */
                         ap = sta_info_get(key->local, key->sdata->u.sta.bssid);
                         if (ap) {
-                                if (ap->flags & WLAN_STA_WME)
+                                if (test_sta_flags(ap, WLAN_STA_WME))
                                         key->conf.flags |=
                                                 IEEE80211_KEY_FLAG_WMM_STA;
                         }
@@ -380,6 +387,15 @@ void ieee80211_key_free(struct ieee80211_key *key)
         if (!key)
                 return;
 
+        if (!key->sdata) {
+                /* The key has not been linked yet, simply free it
+                 * and don't Oops */
+                if (key->conf.alg == ALG_CCMP)
+                        ieee80211_aes_key_free(key->u.ccmp.tfm);
+                kfree(key);
+                return;
+        }
+
         spin_lock_irqsave(&key->sdata->local->key_lock, flags);
         __ieee80211_key_free(key);
         spin_unlock_irqrestore(&key->sdata->local->key_lock, flags);
diff --git a/net/mac80211/key.h b/net/mac80211/key.h
index f52c3df1fe9a..425816e0996c 100644
--- a/net/mac80211/key.h
+++ b/net/mac80211/key.h
@@ -16,31 +16,18 @@
 #include <linux/rcupdate.h>
 #include <net/mac80211.h>
 
-/* ALG_TKIP
- * struct ieee80211_key::key is encoded as a 256-bit (32 byte) data block:
- * Temporal Encryption Key (128 bits)
- * Temporal Authenticator Tx MIC Key (64 bits)
- * Temporal Authenticator Rx MIC Key (64 bits)
- */
-
-#define WEP_IV_LEN 4
-#define WEP_ICV_LEN 4
-
-#define ALG_TKIP_KEY_LEN 32
-/* Starting offsets for each key */
-#define ALG_TKIP_TEMP_ENCR_KEY 0
-#define ALG_TKIP_TEMP_AUTH_TX_MIC_KEY 16
-#define ALG_TKIP_TEMP_AUTH_RX_MIC_KEY 24
-#define TKIP_IV_LEN 8
-#define TKIP_ICV_LEN 4
-
-#define ALG_CCMP_KEY_LEN 16
-#define CCMP_HDR_LEN 8
-#define CCMP_MIC_LEN 8
-#define CCMP_TK_LEN 16
-#define CCMP_PN_LEN 6
-
-#define NUM_RX_DATA_QUEUES 17
+#define WEP_IV_LEN              4
+#define WEP_ICV_LEN             4
+#define ALG_TKIP_KEY_LEN        32
+#define ALG_CCMP_KEY_LEN        16
+#define CCMP_HDR_LEN            8
+#define CCMP_MIC_LEN            8
+#define CCMP_TK_LEN             16
+#define CCMP_PN_LEN             6
+#define TKIP_IV_LEN             8
+#define TKIP_ICV_LEN            4
+
+#define NUM_RX_DATA_QUEUES      17
 
 struct ieee80211_local;
 struct ieee80211_sub_if_data;
@@ -69,6 +56,13 @@ enum ieee80211_internal_key_flags {
         KEY_FLAG_TODO_ADD_DEBUGFS       = BIT(5),
 };
 
+struct tkip_ctx {
+        u32 iv32;
+        u16 iv16;
+        u16 p1k[5];
+        int initialized;
+};
+
 struct ieee80211_key {
         struct ieee80211_local *local;
         struct ieee80211_sub_if_data *sdata;
@@ -85,16 +79,10 @@ struct ieee80211_key {
         union {
                 struct {
                         /* last used TSC */
-                        u32 iv32;
-                        u16 iv16;
-                        u16 p1k[5];
-                        int tx_initialized;
+                        struct tkip_ctx tx;
 
                         /* last received RSC */
-                        u32 iv32_rx[NUM_RX_DATA_QUEUES];
-                        u16 iv16_rx[NUM_RX_DATA_QUEUES];
-                        u16 p1k_rx[NUM_RX_DATA_QUEUES][5];
-                        int rx_initialized[NUM_RX_DATA_QUEUES];
+                        struct tkip_ctx rx[NUM_RX_DATA_QUEUES];
                 } tkip;
                 struct {
                         u8 tx_pn[6];
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 98c0b5e56ecc..f1a83d450ea0 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -35,8 +35,6 @@
 #include "debugfs.h"
 #include "debugfs_netdev.h"
 
-#define SUPP_MCS_SET_LEN 16
-
 /*
  * For seeing transmitted packets on monitor interfaces
  * we have a radiotap header too.
@@ -107,12 +105,18 @@ static int ieee80211_master_open(struct net_device *dev)
 
         /* we hold the RTNL here so can safely walk the list */
         list_for_each_entry(sdata, &local->interfaces, list) {
-                if (sdata->dev != dev && netif_running(sdata->dev)) {
+                if (netif_running(sdata->dev)) {
                         res = 0;
                         break;
                 }
         }
-        return res;
+
+        if (res)
+                return res;
+
+        netif_tx_start_all_queues(local->mdev);
+
+        return 0;
 }
 
 static int ieee80211_master_stop(struct net_device *dev)
@@ -122,7 +126,7 @@ static int ieee80211_master_stop(struct net_device *dev)
 
         /* we hold the RTNL here so can safely walk the list */
         list_for_each_entry(sdata, &local->interfaces, list)
-                if (sdata->dev != dev && netif_running(sdata->dev))
+                if (netif_running(sdata->dev))
                         dev_close(sdata->dev);
 
         return 0;
@@ -147,9 +151,7 @@ static int ieee80211_change_mtu(struct net_device *dev, int new_mtu)
         /* FIX: what would be proper limits for MTU?
          * This interface uses 802.3 frames. */
         if (new_mtu < 256 ||
-                new_mtu > IEEE80211_MAX_DATA_LEN - 24 - 6 - meshhdrlen) {
-                printk(KERN_WARNING "%s: invalid MTU %d\n",
-                       dev->name, new_mtu);
+            new_mtu > IEEE80211_MAX_DATA_LEN - 24 - 6 - meshhdrlen) {
                 return -EINVAL;
         }
 
@@ -180,10 +182,11 @@ static int ieee80211_open(struct net_device *dev)
 {
         struct ieee80211_sub_if_data *sdata, *nsdata;
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+        struct sta_info *sta;
         struct ieee80211_if_init_conf conf;
+        u32 changed = 0;
         int res;
         bool need_hw_reconfig = 0;
-        struct sta_info *sta;
 
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
@@ -191,7 +194,7 @@ static int ieee80211_open(struct net_device *dev)
         list_for_each_entry(nsdata, &local->interfaces, list) {
                 struct net_device *ndev = nsdata->dev;
 
-                if (ndev != dev && ndev != local->mdev && netif_running(ndev)) {
+                if (ndev != dev && netif_running(ndev)) {
                         /*
                          * Allow only a single IBSS interface to be up at any
                          * time. This is restricted because beacon distribution
@@ -207,30 +210,6 @@ static int ieee80211_open(struct net_device *dev)
                                 return -EBUSY;
 
                         /*
-                         * Disallow multiple IBSS/STA mode interfaces.
-                         *
-                         * This is a technical restriction, it is possible although
-                         * most likely not IEEE 802.11 compliant to have multiple
-                         * STAs with just a single hardware (the TSF timer will not
-                         * be adjusted properly.)
-                         *
-                         * However, because mac80211 uses the master device's BSS
-                         * information for each STA/IBSS interface, doing this will
-                         * currently corrupt that BSS information completely, unless,
-                         * a not very useful case, both STAs are associated to the
-                         * same BSS.
-                         *
-                         * To remove this restriction, the BSS information needs to
-                         * be embedded in the STA/IBSS mode sdata instead of using
-                         * the master device's BSS structure.
-                         */
-                        if ((sdata->vif.type == IEEE80211_IF_TYPE_STA ||
-                             sdata->vif.type == IEEE80211_IF_TYPE_IBSS) &&
-                            (nsdata->vif.type == IEEE80211_IF_TYPE_STA ||
-                             nsdata->vif.type == IEEE80211_IF_TYPE_IBSS))
-                                return -EBUSY;
-
-                        /*
                          * The remaining checks are only performed for interfaces
                          * with the same MAC address.
                          */
@@ -249,7 +228,7 @@ static int ieee80211_open(struct net_device *dev)
                          */
                         if (sdata->vif.type == IEEE80211_IF_TYPE_VLAN &&
                             nsdata->vif.type == IEEE80211_IF_TYPE_AP)
-                                sdata->u.vlan.ap = nsdata;
+                                sdata->bss = &nsdata->u.ap;
                 }
         }
 
@@ -259,10 +238,13 @@ static int ieee80211_open(struct net_device *dev)
                         return -ENOLINK;
                 break;
         case IEEE80211_IF_TYPE_VLAN:
-                if (!sdata->u.vlan.ap)
+                if (!sdata->bss)
                         return -ENOLINK;
+                list_add(&sdata->u.vlan.list, &sdata->bss->vlans);
                 break;
         case IEEE80211_IF_TYPE_AP:
+                sdata->bss = &sdata->u.ap;
+                break;
         case IEEE80211_IF_TYPE_STA:
         case IEEE80211_IF_TYPE_MNTR:
         case IEEE80211_IF_TYPE_IBSS:
@@ -280,14 +262,13 @@ static int ieee80211_open(struct net_device *dev)
                 if (local->ops->start)
                         res = local->ops->start(local_to_hw(local));
                 if (res)
-                        return res;
+                        goto err_del_bss;
                 need_hw_reconfig = 1;
                 ieee80211_led_radio(local, local->hw.conf.radio_enabled);
         }
 
         switch (sdata->vif.type) {
         case IEEE80211_IF_TYPE_VLAN:
-                list_add(&sdata->u.vlan.list, &sdata->u.vlan.ap->u.ap.vlans);
                 /* no need to tell driver */
                 break;
         case IEEE80211_IF_TYPE_MNTR:
@@ -310,9 +291,9 @@ static int ieee80211_open(struct net_device *dev)
                 if (sdata->u.mntr_flags & MONITOR_FLAG_OTHER_BSS)
                         local->fif_other_bss++;
 
-                netif_tx_lock_bh(local->mdev);
+                netif_addr_lock_bh(local->mdev);
                 ieee80211_configure_filter(local);
-                netif_tx_unlock_bh(local->mdev);
+                netif_addr_unlock_bh(local->mdev);
                 break;
         case IEEE80211_IF_TYPE_STA:
         case IEEE80211_IF_TYPE_IBSS:
@@ -326,8 +307,10 @@ static int ieee80211_open(struct net_device *dev)
                 if (res)
                         goto err_stop;
 
-                ieee80211_if_config(dev);
-                ieee80211_reset_erp_info(dev);
+                if (ieee80211_vif_is_mesh(&sdata->vif))
+                        ieee80211_start_mesh(sdata->dev);
+                changed |= ieee80211_reset_erp_info(dev);
+                ieee80211_bss_info_change_notify(sdata, changed);
                 ieee80211_enable_keys(sdata);
 
                 if (sdata->vif.type == IEEE80211_IF_TYPE_STA &&
@@ -346,6 +329,7 @@ static int ieee80211_open(struct net_device *dev)
                         goto err_del_interface;
                 }
 
+                /* no locking required since STA is not live yet */
                 sta->flags |= WLAN_STA_AUTHORIZED;
 
                 res = sta_info_insert(sta);
@@ -385,13 +369,13 @@ static int ieee80211_open(struct net_device *dev)
          * yet be effective. Trigger execution of ieee80211_sta_work
          * to fix this.
          */
-        if(sdata->vif.type == IEEE80211_IF_TYPE_STA ||
-           sdata->vif.type == IEEE80211_IF_TYPE_IBSS) {
+        if (sdata->vif.type == IEEE80211_IF_TYPE_STA ||
+            sdata->vif.type == IEEE80211_IF_TYPE_IBSS) {
                 struct ieee80211_if_sta *ifsta = &sdata->u.sta;
                 queue_work(local->hw.workqueue, &ifsta->work);
         }
 
-        netif_start_queue(dev);
+        netif_tx_start_all_queues(dev);
 
         return 0;
  err_del_interface:
@@ -399,6 +383,10 @@ static int ieee80211_open(struct net_device *dev)
  err_stop:
         if (!local->open_count && local->ops->stop)
                 local->ops->stop(local_to_hw(local));
+ err_del_bss:
+        sdata->bss = NULL;
+        if (sdata->vif.type == IEEE80211_IF_TYPE_VLAN)
+                list_del(&sdata->u.vlan.list);
         return res;
 }
 
@@ -412,7 +400,7 @@ static int ieee80211_stop(struct net_device *dev)
         /*
          * Stop TX on this interface first.
          */
-        netif_stop_queue(dev);
+        netif_tx_stop_all_queues(dev);
 
         /*
          * Now delete all active aggregation sessions.
@@ -481,7 +469,6 @@ static int ieee80211_stop(struct net_device *dev)
         switch (sdata->vif.type) {
         case IEEE80211_IF_TYPE_VLAN:
                 list_del(&sdata->u.vlan.list);
-                sdata->u.vlan.ap = NULL;
                 /* no need to tell driver */
                 break;
         case IEEE80211_IF_TYPE_MNTR:
@@ -503,9 +490,9 @@ static int ieee80211_stop(struct net_device *dev)
                 if (sdata->u.mntr_flags & MONITOR_FLAG_OTHER_BSS)
                         local->fif_other_bss--;
 
-                netif_tx_lock_bh(local->mdev);
+                netif_addr_lock_bh(local->mdev);
                 ieee80211_configure_filter(local);
-                netif_tx_unlock_bh(local->mdev);
+                netif_addr_unlock_bh(local->mdev);
                 break;
         case IEEE80211_IF_TYPE_MESH_POINT:
         case IEEE80211_IF_TYPE_STA:
@@ -530,8 +517,6 @@ static int ieee80211_stop(struct net_device *dev)
                                 local->sta_hw_scanning = 0;
                 }
 
-                flush_workqueue(local->hw.workqueue);
-
                 sdata->u.sta.flags &= ~IEEE80211_STA_PRIVACY_INVOKED;
                 kfree(sdata->u.sta.extra_ie);
                 sdata->u.sta.extra_ie = NULL;
@@ -546,6 +531,8 @@ static int ieee80211_stop(struct net_device *dev)
                 local->ops->remove_interface(local_to_hw(local), &conf);
         }
 
+        sdata->bss = NULL;
+
         if (local->open_count == 0) {
                 if (netif_running(local->mdev))
                         dev_close(local->mdev);
@@ -555,6 +542,8 @@ static int ieee80211_stop(struct net_device *dev)
 
                 ieee80211_led_radio(local, 0);
 
+                flush_workqueue(local->hw.workqueue);
+
                 tasklet_disable(&local->tx_pending_tasklet);
                 tasklet_disable(&local->tasklet);
         }
@@ -584,17 +573,19 @@ int ieee80211_start_tx_ba_session(struct ieee80211_hw *hw, u8 *ra, u16 tid)
 
         sta = sta_info_get(local, ra);
         if (!sta) {
+#ifdef CONFIG_MAC80211_HT_DEBUG
                 printk(KERN_DEBUG "Could not find the station\n");
-                rcu_read_unlock();
-                return -ENOENT;
+#endif
+                ret = -ENOENT;
+                goto exit;
         }
 
-        spin_lock_bh(&sta->ampdu_mlme.ampdu_tx);
+        spin_lock_bh(&sta->lock);
 
         /* we have tried too many times, receiver does not want A-MPDU */
         if (sta->ampdu_mlme.addba_req_num[tid] > HT_AGG_MAX_RETRIES) {
                 ret = -EBUSY;
-                goto start_ba_exit;
+                goto err_unlock_sta;
         }
 
         state = &sta->ampdu_mlme.tid_state_tx[tid];
@@ -605,18 +596,20 @@ int ieee80211_start_tx_ba_session(struct ieee80211_hw *hw, u8 *ra, u16 tid)
                                  "idle on tid %u\n", tid);
 #endif /* CONFIG_MAC80211_HT_DEBUG */
                 ret = -EAGAIN;
-                goto start_ba_exit;
+                goto err_unlock_sta;
         }
 
         /* prepare A-MPDU MLME for Tx aggregation */
         sta->ampdu_mlme.tid_tx[tid] =
                         kmalloc(sizeof(struct tid_ampdu_tx), GFP_ATOMIC);
         if (!sta->ampdu_mlme.tid_tx[tid]) {
+#ifdef CONFIG_MAC80211_HT_DEBUG
                 if (net_ratelimit())
                         printk(KERN_ERR "allocate tx mlme to tid %d failed\n",
                                         tid);
+#endif
                 ret = -ENOMEM;
-                goto start_ba_exit;
+                goto err_unlock_sta;
         }
         /* Tx timer */
         sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer.function =
@@ -625,10 +618,6 @@ int ieee80211_start_tx_ba_session(struct ieee80211_hw *hw, u8 *ra, u16 tid)
                         (unsigned long)&sta->timer_to_tid[tid];
         init_timer(&sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer);
 
-        /* ensure that TX flow won't interrupt us
-         * until the end of the call to requeue function */
-        spin_lock_bh(&local->mdev->queue_lock);
-
         /* create a new queue for this aggregation */
         ret = ieee80211_ht_agg_queue_add(local, sta, tid);
 
@@ -639,7 +628,7 @@ int ieee80211_start_tx_ba_session(struct ieee80211_hw *hw, u8 *ra, u16 tid)
                 printk(KERN_DEBUG "BA request denied - queue unavailable for"
                                         " tid %d\n", tid);
 #endif /* CONFIG_MAC80211_HT_DEBUG */
-                goto start_ba_err;
+                goto err_unlock_queue;
         }
         sdata = sta->sdata;
 
@@ -655,18 +644,18 @@ int ieee80211_start_tx_ba_session(struct ieee80211_hw *hw, u8 *ra, u16 tid)
                 /* No need to requeue the packets in the agg queue, since we
                  * held the tx lock: no packet could be enqueued to the newly
                  * allocated queue */
-                 ieee80211_ht_agg_queue_remove(local, sta, tid, 0);
+                ieee80211_ht_agg_queue_remove(local, sta, tid, 0);
 #ifdef CONFIG_MAC80211_HT_DEBUG
                 printk(KERN_DEBUG "BA request denied - HW unavailable for"
                                         " tid %d\n", tid);
 #endif /* CONFIG_MAC80211_HT_DEBUG */
                 *state = HT_AGG_STATE_IDLE;
-                goto start_ba_err;
+                goto err_unlock_queue;
         }
 
         /* Will put all the packets in the new SW queue */
         ieee80211_requeue(local, ieee802_1d_to_ac[tid]);
-        spin_unlock_bh(&local->mdev->queue_lock);
+        spin_unlock_bh(&sta->lock);
 
         /* send an addBA request */
         sta->ampdu_mlme.dialog_token_allocator++;
@@ -674,25 +663,27 @@ int ieee80211_start_tx_ba_session(struct ieee80211_hw *hw, u8 *ra, u16 tid)
                         sta->ampdu_mlme.dialog_token_allocator;
         sta->ampdu_mlme.tid_tx[tid]->ssn = start_seq_num;
 
+
         ieee80211_send_addba_request(sta->sdata->dev, ra, tid,
                          sta->ampdu_mlme.tid_tx[tid]->dialog_token,
                          sta->ampdu_mlme.tid_tx[tid]->ssn,
                          0x40, 5000);
-
         /* activate the timer for the recipient's addBA response */
         sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer.expires =
                                 jiffies + ADDBA_RESP_INTERVAL;
         add_timer(&sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer);
+#ifdef CONFIG_MAC80211_HT_DEBUG
         printk(KERN_DEBUG "activated addBA response timer on tid %d\n", tid);
-        goto start_ba_exit;
+#endif
+        goto exit;
 
-start_ba_err:
+err_unlock_queue:
         kfree(sta->ampdu_mlme.tid_tx[tid]);
         sta->ampdu_mlme.tid_tx[tid] = NULL;
-        spin_unlock_bh(&local->mdev->queue_lock);
         ret = -EBUSY;
-start_ba_exit:
-        spin_unlock_bh(&sta->ampdu_mlme.ampdu_tx);
+err_unlock_sta:
+        spin_unlock_bh(&sta->lock);
+exit:
         rcu_read_unlock();
         return ret;
 }
@@ -720,7 +711,7 @@ int ieee80211_stop_tx_ba_session(struct ieee80211_hw *hw,
 
         /* check if the TID is in aggregation */
         state = &sta->ampdu_mlme.tid_state_tx[tid];
-        spin_lock_bh(&sta->ampdu_mlme.ampdu_tx);
+        spin_lock_bh(&sta->lock);
 
         if (*state != HT_AGG_STATE_OPERATIONAL) {
                 ret = -ENOENT;
@@ -750,7 +741,7 @@ int ieee80211_stop_tx_ba_session(struct ieee80211_hw *hw,
         }
 
 stop_BA_exit:
-        spin_unlock_bh(&sta->ampdu_mlme.ampdu_tx);
+        spin_unlock_bh(&sta->lock);
         rcu_read_unlock();
         return ret;
 }
@@ -764,8 +755,10 @@ void ieee80211_start_tx_ba_cb(struct ieee80211_hw *hw, u8 *ra, u16 tid)
         DECLARE_MAC_BUF(mac);
 
         if (tid >= STA_TID_NUM) {
+#ifdef CONFIG_MAC80211_HT_DEBUG
                 printk(KERN_DEBUG "Bad TID value: tid = %d (>= %d)\n",
                                 tid, STA_TID_NUM);
+#endif
                 return;
         }
 
@@ -773,18 +766,22 @@ void ieee80211_start_tx_ba_cb(struct ieee80211_hw *hw, u8 *ra, u16 tid)
         sta = sta_info_get(local, ra);
         if (!sta) {
                 rcu_read_unlock();
+#ifdef CONFIG_MAC80211_HT_DEBUG
                 printk(KERN_DEBUG "Could not find station: %s\n",
                                 print_mac(mac, ra));
+#endif
                 return;
         }
 
         state = &sta->ampdu_mlme.tid_state_tx[tid];
-        spin_lock_bh(&sta->ampdu_mlme.ampdu_tx);
+        spin_lock_bh(&sta->lock);
 
         if (!(*state & HT_ADDBA_REQUESTED_MSK)) {
+#ifdef CONFIG_MAC80211_HT_DEBUG
                 printk(KERN_DEBUG "addBA was not requested yet, state is %d\n",
                                 *state);
-                spin_unlock_bh(&sta->ampdu_mlme.ampdu_tx);
+#endif
+                spin_unlock_bh(&sta->lock);
                 rcu_read_unlock();
                 return;
         }
@@ -794,10 +791,12 @@ void ieee80211_start_tx_ba_cb(struct ieee80211_hw *hw, u8 *ra, u16 tid)
         *state |= HT_ADDBA_DRV_READY_MSK;
 
         if (*state == HT_AGG_STATE_OPERATIONAL) {
+#ifdef CONFIG_MAC80211_HT_DEBUG
                 printk(KERN_DEBUG "Aggregation is on for tid %d \n", tid);
+#endif
                 ieee80211_wake_queue(hw, sta->tid_to_tx_q[tid]);
         }
-        spin_unlock_bh(&sta->ampdu_mlme.ampdu_tx);
+        spin_unlock_bh(&sta->lock);
         rcu_read_unlock();
 }
 EXPORT_SYMBOL(ieee80211_start_tx_ba_cb);
@@ -811,8 +810,10 @@ void ieee80211_stop_tx_ba_cb(struct ieee80211_hw *hw, u8 *ra, u8 tid)
         DECLARE_MAC_BUF(mac);
 
         if (tid >= STA_TID_NUM) {
+#ifdef CONFIG_MAC80211_HT_DEBUG
                 printk(KERN_DEBUG "Bad TID value: tid = %d (>= %d)\n",
                                 tid, STA_TID_NUM);
+#endif
                 return;
         }
 
@@ -824,17 +825,23 @@ void ieee80211_stop_tx_ba_cb(struct ieee80211_hw *hw, u8 *ra, u8 tid)
         rcu_read_lock();
         sta = sta_info_get(local, ra);
         if (!sta) {
+#ifdef CONFIG_MAC80211_HT_DEBUG
                 printk(KERN_DEBUG "Could not find station: %s\n",
                                 print_mac(mac, ra));
+#endif
                 rcu_read_unlock();
                 return;
         }
         state = &sta->ampdu_mlme.tid_state_tx[tid];
 
-        spin_lock_bh(&sta->ampdu_mlme.ampdu_tx);
+        /* NOTE: no need to use sta->lock in this state check, as
+         * ieee80211_stop_tx_ba_session will let only one stop call to
+         * pass through per sta/tid
+         */
         if ((*state & HT_AGG_STATE_REQ_STOP_BA_MSK) == 0) {
+#ifdef CONFIG_MAC80211_HT_DEBUG
                 printk(KERN_DEBUG "unexpected callback to A-MPDU stop\n");
-                spin_unlock_bh(&sta->ampdu_mlme.ampdu_tx);
+#endif
                 rcu_read_unlock();
                 return;
         }
@@ -845,23 +852,20 @@ void ieee80211_stop_tx_ba_cb(struct ieee80211_hw *hw, u8 *ra, u8 tid)
 
         agg_queue = sta->tid_to_tx_q[tid];
 
-        /* avoid ordering issues: we are the only one that can modify
-         * the content of the qdiscs */
-        spin_lock_bh(&local->mdev->queue_lock);
-        /* remove the queue for this aggregation */
         ieee80211_ht_agg_queue_remove(local, sta, tid, 1);
-        spin_unlock_bh(&local->mdev->queue_lock);
 
-        /* we just requeued the all the frames that were in the removed
-         * queue, and since we might miss a softirq we do netif_schedule.
-         * ieee80211_wake_queue is not used here as this queue is not
-         * necessarily stopped */
-        netif_schedule(local->mdev);
+        /* We just requeued the all the frames that were in the
+         * removed queue, and since we might miss a softirq we do
+         * netif_schedule_queue.  ieee80211_wake_queue is not used
+         * here as this queue is not necessarily stopped
+         */
+        netif_schedule_queue(netdev_get_tx_queue(local->mdev, agg_queue));
+        spin_lock_bh(&sta->lock);
         *state = HT_AGG_STATE_IDLE;
         sta->ampdu_mlme.addba_req_num[tid] = 0;
         kfree(sta->ampdu_mlme.tid_tx[tid]);
         sta->ampdu_mlme.tid_tx[tid] = NULL;
-        spin_unlock_bh(&sta->ampdu_mlme.ampdu_tx);
+        spin_unlock_bh(&sta->lock);
 
         rcu_read_unlock();
 }
@@ -875,9 +879,11 @@ void ieee80211_start_tx_ba_cb_irqsafe(struct ieee80211_hw *hw,
         struct sk_buff *skb = dev_alloc_skb(0);
 
         if (unlikely(!skb)) {
+#ifdef CONFIG_MAC80211_HT_DEBUG
                 if (net_ratelimit())
                         printk(KERN_WARNING "%s: Not enough memory, "
                                "dropping start BA session", skb->dev->name);
+#endif
                 return;
         }
         ra_tid = (struct ieee80211_ra_tid *) &skb->cb;
@@ -898,9 +904,11 @@ void ieee80211_stop_tx_ba_cb_irqsafe(struct ieee80211_hw *hw,
         struct sk_buff *skb = dev_alloc_skb(0);
 
         if (unlikely(!skb)) {
+#ifdef CONFIG_MAC80211_HT_DEBUG
                 if (net_ratelimit())
                         printk(KERN_WARNING "%s: Not enough memory, "
                                "dropping stop BA session", skb->dev->name);
+#endif
                 return;
         }
         ra_tid = (struct ieee80211_ra_tid *) &skb->cb;
@@ -951,7 +959,6 @@ static const struct header_ops ieee80211_header_ops = {
         .cache_update   = eth_header_cache_update,
 };
 
-/* Must not be called for mdev */
 void ieee80211_if_setup(struct net_device *dev)
 {
         ether_setup(dev);
@@ -961,67 +968,52 @@ void ieee80211_if_setup(struct net_device *dev)
         dev->change_mtu = ieee80211_change_mtu;
         dev->open = ieee80211_open;
         dev->stop = ieee80211_stop;
-        dev->destructor = ieee80211_if_free;
+        dev->destructor = free_netdev;
 }
 
 /* everything else */
 
-static int __ieee80211_if_config(struct net_device *dev,
-                                 struct sk_buff *beacon,
-                                 struct ieee80211_tx_control *control)
+int ieee80211_if_config(struct ieee80211_sub_if_data *sdata, u32 changed)
 {
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+        struct ieee80211_local *local = sdata->local;
         struct ieee80211_if_conf conf;
 
-        if (!local->ops->config_interface || !netif_running(dev))
+        if (WARN_ON(!netif_running(sdata->dev)))
+                return 0;
+
+        if (!local->ops->config_interface)
                 return 0;
 
         memset(&conf, 0, sizeof(conf));
-        conf.type = sdata->vif.type;
+        conf.changed = changed;
+
         if (sdata->vif.type == IEEE80211_IF_TYPE_STA ||
             sdata->vif.type == IEEE80211_IF_TYPE_IBSS) {
                 conf.bssid = sdata->u.sta.bssid;
                 conf.ssid = sdata->u.sta.ssid;
                 conf.ssid_len = sdata->u.sta.ssid_len;
-        } else if (ieee80211_vif_is_mesh(&sdata->vif)) {
-                conf.beacon = beacon;
-                conf.beacon_control = control;
-                ieee80211_start_mesh(dev);
         } else if (sdata->vif.type == IEEE80211_IF_TYPE_AP) {
+                conf.bssid = sdata->dev->dev_addr;
                 conf.ssid = sdata->u.ap.ssid;
                 conf.ssid_len = sdata->u.ap.ssid_len;
-                conf.beacon = beacon;
-                conf.beacon_control = control;
+        } else if (ieee80211_vif_is_mesh(&sdata->vif)) {
+                u8 zero[ETH_ALEN] = { 0 };
+                conf.bssid = zero;
+                conf.ssid = zero;
+                conf.ssid_len = 0;
+        } else {
+                WARN_ON(1);
+                return -EINVAL;
         }
-        return local->ops->config_interface(local_to_hw(local),
-                                            &sdata->vif, &conf);
-}
 
-int ieee80211_if_config(struct net_device *dev)
-{
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        if (sdata->vif.type == IEEE80211_IF_TYPE_MESH_POINT &&
-            (local->hw.flags & IEEE80211_HW_HOST_GEN_BEACON_TEMPLATE))
-                return ieee80211_if_config_beacon(dev);
-        return __ieee80211_if_config(dev, NULL, NULL);
-}
+        if (WARN_ON(!conf.bssid && (changed & IEEE80211_IFCC_BSSID)))
+                return -EINVAL;
 
-int ieee80211_if_config_beacon(struct net_device *dev)
-{
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        struct ieee80211_tx_control control;
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        struct sk_buff *skb;
+        if (WARN_ON(!conf.ssid && (changed & IEEE80211_IFCC_SSID)))
+                return -EINVAL;
 
-        if (!(local->hw.flags & IEEE80211_HW_HOST_GEN_BEACON_TEMPLATE))
-                return 0;
-        skb = ieee80211_beacon_get(local_to_hw(local), &sdata->vif,
-                                   &control);
-        if (!skb)
-                return -ENOMEM;
-        return __ieee80211_if_config(dev, skb, &control);
+        return local->ops->config_interface(local_to_hw(local),
+                                            &sdata->vif, &conf);
 }
 
 int ieee80211_hw_config(struct ieee80211_local *local)
@@ -1068,56 +1060,84 @@ u32 ieee80211_handle_ht(struct ieee80211_local *local, int enable_ht,
         struct ieee80211_supported_band *sband;
         struct ieee80211_ht_info ht_conf;
         struct ieee80211_ht_bss_info ht_bss_conf;
-        int i;
         u32 changed = 0;
+        int i;
+        u8 max_tx_streams = IEEE80211_HT_CAP_MAX_STREAMS;
+        u8 tx_mcs_set_cap;
 
         sband = local->hw.wiphy->bands[conf->channel->band];
 
+        memset(&ht_conf, 0, sizeof(struct ieee80211_ht_info));
+        memset(&ht_bss_conf, 0, sizeof(struct ieee80211_ht_bss_info));
+
         /* HT is not supported */
         if (!sband->ht_info.ht_supported) {
                 conf->flags &= ~IEEE80211_CONF_SUPPORT_HT_MODE;
-                return 0;
+                goto out;
         }
 
-        memset(&ht_conf, 0, sizeof(struct ieee80211_ht_info));
-        memset(&ht_bss_conf, 0, sizeof(struct ieee80211_ht_bss_info));
-
-        if (enable_ht) {
-                if (!(conf->flags & IEEE80211_CONF_SUPPORT_HT_MODE))
+        /* disable HT */
+        if (!enable_ht) {
+                if (conf->flags & IEEE80211_CONF_SUPPORT_HT_MODE)
                         changed |= BSS_CHANGED_HT;
+                conf->flags &= ~IEEE80211_CONF_SUPPORT_HT_MODE;
+                conf->ht_conf.ht_supported = 0;
+                goto out;
+        }
 
-                conf->flags |= IEEE80211_CONF_SUPPORT_HT_MODE;
-                ht_conf.ht_supported = 1;
 
-                ht_conf.cap = req_ht_cap->cap & sband->ht_info.cap;
-                ht_conf.cap &= ~(IEEE80211_HT_CAP_MIMO_PS);
-                ht_conf.cap |= sband->ht_info.cap & IEEE80211_HT_CAP_MIMO_PS;
+        if (!(conf->flags & IEEE80211_CONF_SUPPORT_HT_MODE))
+                changed |= BSS_CHANGED_HT;
 
-                for (i = 0; i < SUPP_MCS_SET_LEN; i++)
-                        ht_conf.supp_mcs_set[i] =
-                                        sband->ht_info.supp_mcs_set[i] &
-                                        req_ht_cap->supp_mcs_set[i];
+        conf->flags |= IEEE80211_CONF_SUPPORT_HT_MODE;
+        ht_conf.ht_supported = 1;
 
-                ht_bss_conf.primary_channel = req_bss_cap->primary_channel;
-                ht_bss_conf.bss_cap = req_bss_cap->bss_cap;
-                ht_bss_conf.bss_op_mode = req_bss_cap->bss_op_mode;
+        ht_conf.cap = req_ht_cap->cap & sband->ht_info.cap;
+        ht_conf.cap &= ~(IEEE80211_HT_CAP_MIMO_PS);
+        ht_conf.cap |= sband->ht_info.cap & IEEE80211_HT_CAP_MIMO_PS;
+        ht_bss_conf.primary_channel = req_bss_cap->primary_channel;
+        ht_bss_conf.bss_cap = req_bss_cap->bss_cap;
+        ht_bss_conf.bss_op_mode = req_bss_cap->bss_op_mode;
 
-                ht_conf.ampdu_factor = req_ht_cap->ampdu_factor;
-                ht_conf.ampdu_density = req_ht_cap->ampdu_density;
+        ht_conf.ampdu_factor = req_ht_cap->ampdu_factor;
+        ht_conf.ampdu_density = req_ht_cap->ampdu_density;
 
-                /* if bss configuration changed store the new one */
-                if (memcmp(&conf->ht_conf, &ht_conf, sizeof(ht_conf)) ||
-                    memcmp(&conf->ht_bss_conf, &ht_bss_conf, sizeof(ht_bss_conf))) {
-                        changed |= BSS_CHANGED_HT;
-                        memcpy(&conf->ht_conf, &ht_conf, sizeof(ht_conf));
-                        memcpy(&conf->ht_bss_conf, &ht_bss_conf, sizeof(ht_bss_conf));
-                }
-        } else {
-                if (conf->flags & IEEE80211_CONF_SUPPORT_HT_MODE)
-                        changed |= BSS_CHANGED_HT;
-                conf->flags &= ~IEEE80211_CONF_SUPPORT_HT_MODE;
-        }
+        /* Bits 96-100 */
+        tx_mcs_set_cap = sband->ht_info.supp_mcs_set[12];
+
+        /* configure suppoerted Tx MCS according to requested MCS
+         * (based in most cases on Rx capabilities of peer) and self
+         * Tx MCS capabilities (as defined by low level driver HW
+         * Tx capabilities) */
+        if (!(tx_mcs_set_cap & IEEE80211_HT_CAP_MCS_TX_DEFINED))
+                goto check_changed;
+
+        /* Counting from 0 therfore + 1 */
+        if (tx_mcs_set_cap & IEEE80211_HT_CAP_MCS_TX_RX_DIFF)
+                max_tx_streams = ((tx_mcs_set_cap &
+                                IEEE80211_HT_CAP_MCS_TX_STREAMS) >> 2) + 1;
 
+        for (i = 0; i < max_tx_streams; i++)
+                ht_conf.supp_mcs_set[i] =
+                        sband->ht_info.supp_mcs_set[i] &
+                                        req_ht_cap->supp_mcs_set[i];
+
+        if (tx_mcs_set_cap & IEEE80211_HT_CAP_MCS_TX_UEQM)
+                for (i = IEEE80211_SUPP_MCS_SET_UEQM;
+                     i < IEEE80211_SUPP_MCS_SET_LEN; i++)
+                        ht_conf.supp_mcs_set[i] =
+                                sband->ht_info.supp_mcs_set[i] &
+                                        req_ht_cap->supp_mcs_set[i];
+
+check_changed:
+        /* if bss configuration changed store the new one */
+        if (memcmp(&conf->ht_conf, &ht_conf, sizeof(ht_conf)) ||
+            memcmp(&conf->ht_bss_conf, &ht_bss_conf, sizeof(ht_bss_conf))) {
+                changed |= BSS_CHANGED_HT;
+                memcpy(&conf->ht_conf, &ht_conf, sizeof(ht_conf));
+                memcpy(&conf->ht_bss_conf, &ht_bss_conf, sizeof(ht_bss_conf));
+        }
+out:
         return changed;
 }
 
@@ -1136,50 +1156,30 @@ void ieee80211_bss_info_change_notify(struct ieee80211_sub_if_data *sdata,
                                              changed);
 }
 
-void ieee80211_reset_erp_info(struct net_device *dev)
+u32 ieee80211_reset_erp_info(struct net_device *dev)
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
         sdata->bss_conf.use_cts_prot = 0;
         sdata->bss_conf.use_short_preamble = 0;
-        ieee80211_bss_info_change_notify(sdata,
-                                         BSS_CHANGED_ERP_CTS_PROT |
-                                         BSS_CHANGED_ERP_PREAMBLE);
+        return BSS_CHANGED_ERP_CTS_PROT | BSS_CHANGED_ERP_PREAMBLE;
 }
 
 void ieee80211_tx_status_irqsafe(struct ieee80211_hw *hw,
-                                 struct sk_buff *skb,
-                                 struct ieee80211_tx_status *status)
+                                 struct sk_buff *skb)
 {
         struct ieee80211_local *local = hw_to_local(hw);
-        struct ieee80211_tx_status *saved;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         int tmp;
 
         skb->dev = local->mdev;
-        saved = kmalloc(sizeof(struct ieee80211_tx_status), GFP_ATOMIC);
-        if (unlikely(!saved)) {
-                if (net_ratelimit())
-                        printk(KERN_WARNING "%s: Not enough memory, "
-                               "dropping tx status", skb->dev->name);
-                /* should be dev_kfree_skb_irq, but due to this function being
-                 * named _irqsafe instead of just _irq we can't be sure that
-                 * people won't call it from non-irq contexts */
-                dev_kfree_skb_any(skb);
-                return;
-        }
-        memcpy(saved, status, sizeof(struct ieee80211_tx_status));
-        /* copy pointer to saved status into skb->cb for use by tasklet */
-        memcpy(skb->cb, &saved, sizeof(saved));
-
         skb->pkt_type = IEEE80211_TX_STATUS_MSG;
-        skb_queue_tail(status->control.flags & IEEE80211_TXCTL_REQ_TX_STATUS ?
+        skb_queue_tail(info->flags & IEEE80211_TX_CTL_REQ_TX_STATUS ?
                        &local->skb_queue : &local->skb_queue_unreliable, skb);
         tmp = skb_queue_len(&local->skb_queue) +
                 skb_queue_len(&local->skb_queue_unreliable);
         while (tmp > IEEE80211_IRQSAFE_QUEUE_LIMIT &&
                (skb = skb_dequeue(&local->skb_queue_unreliable))) {
-                memcpy(&saved, skb->cb, sizeof(saved));
-                kfree(saved);
                 dev_kfree_skb_irq(skb);
                 tmp--;
                 I802_DEBUG_INC(local->tx_status_drop);
@@ -1193,7 +1193,6 @@ static void ieee80211_tasklet_handler(unsigned long data)
         struct ieee80211_local *local = (struct ieee80211_local *) data;
         struct sk_buff *skb;
         struct ieee80211_rx_status rx_status;
-        struct ieee80211_tx_status *tx_status;
         struct ieee80211_ra_tid *ra_tid;
 
         while ((skb = skb_dequeue(&local->skb_queue)) ||
@@ -1208,12 +1207,8 @@ static void ieee80211_tasklet_handler(unsigned long data)
                         __ieee80211_rx(local_to_hw(local), skb, &rx_status);
                         break;
                 case IEEE80211_TX_STATUS_MSG:
-                        /* get pointer to saved status out of skb->cb */
-                        memcpy(&tx_status, skb->cb, sizeof(tx_status));
                         skb->pkt_type = 0;
-                        ieee80211_tx_status(local_to_hw(local),
-                                            skb, tx_status);
-                        kfree(tx_status);
+                        ieee80211_tx_status(local_to_hw(local), skb);
                         break;
                 case IEEE80211_DELBA_MSG:
                         ra_tid = (struct ieee80211_ra_tid *) &skb->cb;
@@ -1227,9 +1222,8 @@ static void ieee80211_tasklet_handler(unsigned long data)
                                                  ra_tid->ra, ra_tid->tid);
                         dev_kfree_skb(skb);
                         break ;
-                default: /* should never get here! */
-                        printk(KERN_ERR "%s: Unknown message type (%d)\n",
-                               wiphy_name(local->hw.wiphy), skb->pkt_type);
+                default:
+                        WARN_ON(1);
                         dev_kfree_skb(skb);
                         break;
                 }
@@ -1242,24 +1236,15 @@ static void ieee80211_tasklet_handler(unsigned long data)
  * Also, tx_packet_data in cb is restored from tx_control. */
 static void ieee80211_remove_tx_extra(struct ieee80211_local *local,
                                       struct ieee80211_key *key,
-                                      struct sk_buff *skb,
-                                      struct ieee80211_tx_control *control)
+                                      struct sk_buff *skb)
 {
         int hdrlen, iv_len, mic_len;
-        struct ieee80211_tx_packet_data *pkt_data;
-
-        pkt_data = (struct ieee80211_tx_packet_data *)skb->cb;
-        pkt_data->ifindex = vif_to_sdata(control->vif)->dev->ifindex;
-        pkt_data->flags = 0;
-        if (control->flags & IEEE80211_TXCTL_REQ_TX_STATUS)
-                pkt_data->flags |= IEEE80211_TXPD_REQ_TX_STATUS;
-        if (control->flags & IEEE80211_TXCTL_DO_NOT_ENCRYPT)
-                pkt_data->flags |= IEEE80211_TXPD_DO_NOT_ENCRYPT;
-        if (control->flags & IEEE80211_TXCTL_REQUEUE)
-                pkt_data->flags |= IEEE80211_TXPD_REQUEUE;
-        if (control->flags & IEEE80211_TXCTL_EAPOL_FRAME)
-                pkt_data->flags |= IEEE80211_TXPD_EAPOL_FRAME;
-        pkt_data->queue = control->queue;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+
+        info->flags &=  IEEE80211_TX_CTL_REQ_TX_STATUS |
+                        IEEE80211_TX_CTL_DO_NOT_ENCRYPT |
+                        IEEE80211_TX_CTL_REQUEUE |
+                        IEEE80211_TX_CTL_EAPOL_FRAME;
 
         hdrlen = ieee80211_get_hdrlen_from_skb(skb);
 
@@ -1306,9 +1291,10 @@ no_key:
 
 static void ieee80211_handle_filtered_frame(struct ieee80211_local *local,
                                             struct sta_info *sta,
-                                            struct sk_buff *skb,
-                                            struct ieee80211_tx_status *status)
+                                            struct sk_buff *skb)
 {
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+
         sta->tx_filtered_count++;
 
         /*
@@ -1316,7 +1302,7 @@ static void ieee80211_handle_filtered_frame(struct ieee80211_local *local,
          * packet. If the STA went to power save mode, this will happen
          * when it wakes up for the next time.
          */
-        sta->flags |= WLAN_STA_CLEAR_PS_FILT;
+        set_sta_flags(sta, WLAN_STA_CLEAR_PS_FILT);
 
         /*
          * This code races in the following way:
@@ -1348,84 +1334,89 @@ static void ieee80211_handle_filtered_frame(struct ieee80211_local *local,
          *      can be unknown, for example with different interrupt status
          *      bits.
          */
-        if (sta->flags & WLAN_STA_PS &&
+        if (test_sta_flags(sta, WLAN_STA_PS) &&
             skb_queue_len(&sta->tx_filtered) < STA_MAX_TX_BUFFER) {
-                ieee80211_remove_tx_extra(local, sta->key, skb,
-                                          &status->control);
+                ieee80211_remove_tx_extra(local, sta->key, skb);
                 skb_queue_tail(&sta->tx_filtered, skb);
                 return;
         }
 
-        if (!(sta->flags & WLAN_STA_PS) &&
-            !(status->control.flags & IEEE80211_TXCTL_REQUEUE)) {
+        if (!test_sta_flags(sta, WLAN_STA_PS) &&
+            !(info->flags & IEEE80211_TX_CTL_REQUEUE)) {
                 /* Software retry the packet once */
-                status->control.flags |= IEEE80211_TXCTL_REQUEUE;
-                ieee80211_remove_tx_extra(local, sta->key, skb,
-                                          &status->control);
+                info->flags |= IEEE80211_TX_CTL_REQUEUE;
+                ieee80211_remove_tx_extra(local, sta->key, skb);
                 dev_queue_xmit(skb);
                 return;
         }
 
+#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
         if (net_ratelimit())
                 printk(KERN_DEBUG "%s: dropped TX filtered frame, "
                        "queue_len=%d PS=%d @%lu\n",
                        wiphy_name(local->hw.wiphy),
                        skb_queue_len(&sta->tx_filtered),
-                       !!(sta->flags & WLAN_STA_PS), jiffies);
+                       !!test_sta_flags(sta, WLAN_STA_PS), jiffies);
+#endif
         dev_kfree_skb(skb);
 }
 
-void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb,
-                         struct ieee80211_tx_status *status)
+void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
 {
         struct sk_buff *skb2;
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
         struct ieee80211_local *local = hw_to_local(hw);
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         u16 frag, type;
+        __le16 fc;
         struct ieee80211_tx_status_rtap_hdr *rthdr;
         struct ieee80211_sub_if_data *sdata;
         struct net_device *prev_dev = NULL;
-
-        if (!status) {
-                printk(KERN_ERR
-                       "%s: ieee80211_tx_status called with NULL status\n",
-                       wiphy_name(local->hw.wiphy));
-                dev_kfree_skb(skb);
-                return;
-        }
+        struct sta_info *sta;
 
         rcu_read_lock();
 
-        if (status->excessive_retries) {
-                struct sta_info *sta;
+        if (info->status.excessive_retries) {
                 sta = sta_info_get(local, hdr->addr1);
                 if (sta) {
-                        if (sta->flags & WLAN_STA_PS) {
+                        if (test_sta_flags(sta, WLAN_STA_PS)) {
                                 /*
                                  * The STA is in power save mode, so assume
                                  * that this TX packet failed because of that.
                                  */
-                                status->excessive_retries = 0;
-                                status->flags |= IEEE80211_TX_STATUS_TX_FILTERED;
-                                ieee80211_handle_filtered_frame(local, sta,
-                                                                skb, status);
+                                ieee80211_handle_filtered_frame(local, sta, skb);
                                 rcu_read_unlock();
                                 return;
                         }
                 }
         }
 
-        if (status->flags & IEEE80211_TX_STATUS_TX_FILTERED) {
-                struct sta_info *sta;
+        fc = hdr->frame_control;
+
+        if ((info->flags & IEEE80211_TX_STAT_AMPDU_NO_BACK) &&
+            (ieee80211_is_data_qos(fc))) {
+                u16 tid, ssn;
+                u8 *qc;
+                sta = sta_info_get(local, hdr->addr1);
+                if (sta) {
+                        qc = ieee80211_get_qos_ctl(hdr);
+                        tid = qc[0] & 0xf;
+                        ssn = ((le16_to_cpu(hdr->seq_ctrl) + 0x10)
+                                                & IEEE80211_SCTL_SEQ);
+                        ieee80211_send_bar(sta->sdata->dev, hdr->addr1,
+                                           tid, ssn);
+                }
+        }
+
+        if (info->flags & IEEE80211_TX_STAT_TX_FILTERED) {
                 sta = sta_info_get(local, hdr->addr1);
                 if (sta) {
-                        ieee80211_handle_filtered_frame(local, sta, skb,
-                                                        status);
+                        ieee80211_handle_filtered_frame(local, sta, skb);
                         rcu_read_unlock();
                         return;
                 }
         } else
-                rate_control_tx_status(local->mdev, skb, status);
+                rate_control_tx_status(local->mdev, skb);
 
         rcu_read_unlock();
 
@@ -1439,14 +1430,14 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb,
         frag = le16_to_cpu(hdr->seq_ctrl) & IEEE80211_SCTL_FRAG;
         type = le16_to_cpu(hdr->frame_control) & IEEE80211_FCTL_FTYPE;
 
-        if (status->flags & IEEE80211_TX_STATUS_ACK) {
+        if (info->flags & IEEE80211_TX_STAT_ACK) {
                 if (frag == 0) {
                         local->dot11TransmittedFrameCount++;
                         if (is_multicast_ether_addr(hdr->addr1))
                                 local->dot11MulticastTransmittedFrameCount++;
-                        if (status->retry_count > 0)
+                        if (info->status.retry_count > 0)
                                 local->dot11RetryCount++;
-                        if (status->retry_count > 1)
+                        if (info->status.retry_count > 1)
                                 local->dot11MultipleRetryCount++;
                 }
 
@@ -1483,7 +1474,7 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb,
                 return;
         }
 
-        rthdr = (struct ieee80211_tx_status_rtap_hdr*)
+        rthdr = (struct ieee80211_tx_status_rtap_hdr *)
                                 skb_push(skb, sizeof(*rthdr));
 
         memset(rthdr, 0, sizeof(*rthdr));
@@ -1492,17 +1483,17 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb,
                 cpu_to_le32((1 << IEEE80211_RADIOTAP_TX_FLAGS) |
                             (1 << IEEE80211_RADIOTAP_DATA_RETRIES));
 
-        if (!(status->flags & IEEE80211_TX_STATUS_ACK) &&
+        if (!(info->flags & IEEE80211_TX_STAT_ACK) &&
             !is_multicast_ether_addr(hdr->addr1))
                 rthdr->tx_flags |= cpu_to_le16(IEEE80211_RADIOTAP_F_TX_FAIL);
 
-        if ((status->control.flags & IEEE80211_TXCTL_USE_RTS_CTS) &&
-            (status->control.flags & IEEE80211_TXCTL_USE_CTS_PROTECT))
+        if ((info->flags & IEEE80211_TX_CTL_USE_RTS_CTS) &&
+            (info->flags & IEEE80211_TX_CTL_USE_CTS_PROTECT))
                 rthdr->tx_flags |= cpu_to_le16(IEEE80211_RADIOTAP_F_TX_CTS);
-        else if (status->control.flags & IEEE80211_TXCTL_USE_RTS_CTS)
+        else if (info->flags & IEEE80211_TX_CTL_USE_RTS_CTS)
                 rthdr->tx_flags |= cpu_to_le16(IEEE80211_RADIOTAP_F_TX_RTS);
 
-        rthdr->data_retries = status->retry_count;
+        rthdr->data_retries = info->status.retry_count;
 
         /* XXX: is this sufficient for BPF? */
         skb_set_mac_header(skb, 0);
@@ -1628,7 +1619,7 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
         int result;
         enum ieee80211_band band;
         struct net_device *mdev;
-        struct ieee80211_sub_if_data *sdata;
+        struct wireless_dev *mwdev;
 
         /*
          * generic code guarantees at least one band,
@@ -1652,19 +1643,30 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
         if (result < 0)
                 return result;
 
-        /* for now, mdev needs sub_if_data :/ */
-        mdev = alloc_netdev(sizeof(struct ieee80211_sub_if_data),
-                            "wmaster%d", ether_setup);
+        /*
+         * We use the number of queues for feature tests (QoS, HT) internally
+         * so restrict them appropriately.
+         */
+        if (hw->queues > IEEE80211_MAX_QUEUES)
+                hw->queues = IEEE80211_MAX_QUEUES;
+        if (hw->ampdu_queues > IEEE80211_MAX_AMPDU_QUEUES)
+                hw->ampdu_queues = IEEE80211_MAX_AMPDU_QUEUES;
+        if (hw->queues < 4)
+                hw->ampdu_queues = 0;
+
+        mdev = alloc_netdev_mq(sizeof(struct wireless_dev),
+                               "wmaster%d", ether_setup,
+                               ieee80211_num_queues(hw));
         if (!mdev)
                 goto fail_mdev_alloc;
 
-        sdata = IEEE80211_DEV_TO_SUB_IF(mdev);
-        mdev->ieee80211_ptr = &sdata->wdev;
-        sdata->wdev.wiphy = local->hw.wiphy;
+        mwdev = netdev_priv(mdev);
+        mdev->ieee80211_ptr = mwdev;
+        mwdev->wiphy = local->hw.wiphy;
 
         local->mdev = mdev;
 
-        ieee80211_rx_bss_list_init(mdev);
+        ieee80211_rx_bss_list_init(local);
 
         mdev->hard_start_xmit = ieee80211_master_start_xmit;
         mdev->open = ieee80211_master_open;
@@ -1673,18 +1675,8 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
         mdev->header_ops = &ieee80211_header_ops;
         mdev->set_multicast_list = ieee80211_master_set_multicast_list;
 
-        sdata->vif.type = IEEE80211_IF_TYPE_AP;
-        sdata->dev = mdev;
-        sdata->local = local;
-        sdata->u.ap.force_unicast_rateidx = -1;
-        sdata->u.ap.max_ratectrl_rateidx = -1;
-        ieee80211_if_sdata_init(sdata);
-
-        /* no RCU needed since we're still during init phase */
-        list_add_tail(&sdata->list, &local->interfaces);
-
         name = wiphy_dev(local->hw.wiphy)->driver->name;
-        local->hw.workqueue = create_singlethread_workqueue(name);
+        local->hw.workqueue = create_freezeable_workqueue(name);
         if (!local->hw.workqueue) {
                 result = -ENOMEM;
                 goto fail_workqueue;
@@ -1700,15 +1692,16 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
 
         debugfs_hw_add(local);
 
-        local->hw.conf.beacon_int = 1000;
+        if (local->hw.conf.beacon_int < 10)
+                local->hw.conf.beacon_int = 100;
 
-        local->wstats_flags |= local->hw.max_rssi ?
-                               IW_QUAL_LEVEL_UPDATED : IW_QUAL_LEVEL_INVALID;
-        local->wstats_flags |= local->hw.max_signal ?
+        local->wstats_flags |= local->hw.flags & (IEEE80211_HW_SIGNAL_UNSPEC |
+                                                  IEEE80211_HW_SIGNAL_DB |
+                                                  IEEE80211_HW_SIGNAL_DBM) ?
                                IW_QUAL_QUAL_UPDATED : IW_QUAL_QUAL_INVALID;
-        local->wstats_flags |= local->hw.max_noise ?
+        local->wstats_flags |= local->hw.flags & IEEE80211_HW_NOISE_DBM ?
                                IW_QUAL_NOISE_UPDATED : IW_QUAL_NOISE_INVALID;
-        if (local->hw.max_rssi < 0 || local->hw.max_noise < 0)
+        if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
                 local->wstats_flags |= IW_QUAL_DBM;
 
         result = sta_info_start(local);
@@ -1727,9 +1720,6 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
         if (result < 0)
                 goto fail_dev;
 
-        ieee80211_debugfs_add_netdev(IEEE80211_DEV_TO_SUB_IF(local->mdev));
-        ieee80211_if_set_type(local->mdev, IEEE80211_IF_TYPE_AP);
-
         result = ieee80211_init_rate_ctrl_alg(local,
                                               hw->rate_control_algorithm);
         if (result < 0) {
@@ -1746,16 +1736,15 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
                 goto fail_wep;
         }
 
-        ieee80211_install_qdisc(local->mdev);
+        local->mdev->select_queue = ieee80211_select_queue;
 
         /* add one default STA interface */
-        result = ieee80211_if_add(local->mdev, "wlan%d", NULL,
+        result = ieee80211_if_add(local, "wlan%d", NULL,
                                   IEEE80211_IF_TYPE_STA, NULL);
         if (result)
                 printk(KERN_WARNING "%s: Failed to add default virtual iface\n",
                        wiphy_name(local->hw.wiphy));
 
-        local->reg_state = IEEE80211_DEV_REGISTERED;
         rtnl_unlock();
 
         ieee80211_led_init(local);
@@ -1765,7 +1754,6 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
 fail_wep:
         rate_control_deinitialize(local);
 fail_rate:
-        ieee80211_debugfs_remove_netdev(IEEE80211_DEV_TO_SUB_IF(local->mdev));
         unregister_netdevice(local->mdev);
         local->mdev = NULL;
 fail_dev:
@@ -1775,10 +1763,8 @@ fail_sta_info:
         debugfs_hw_del(local);
         destroy_workqueue(local->hw.workqueue);
 fail_workqueue:
-        if (local->mdev != NULL) {
-                ieee80211_if_free(local->mdev);
-                local->mdev = NULL;
-        }
+        if (local->mdev)
+                free_netdev(local->mdev);
 fail_mdev_alloc:
         wiphy_unregister(local->hw.wiphy);
         return result;
@@ -1788,42 +1774,27 @@ EXPORT_SYMBOL(ieee80211_register_hw);
 void ieee80211_unregister_hw(struct ieee80211_hw *hw)
 {
         struct ieee80211_local *local = hw_to_local(hw);
-        struct ieee80211_sub_if_data *sdata, *tmp;
 
         tasklet_kill(&local->tx_pending_tasklet);
         tasklet_kill(&local->tasklet);
 
         rtnl_lock();
 
-        BUG_ON(local->reg_state != IEEE80211_DEV_REGISTERED);
-
-        local->reg_state = IEEE80211_DEV_UNREGISTERED;
-
         /*
          * At this point, interface list manipulations are fine
          * because the driver cannot be handing us frames any
          * more and the tasklet is killed.
          */
 
-        /*
-         * First, we remove all non-master interfaces. Do this because they
-         * may have bss pointer dependency on the master, and when we free
-         * the master these would be freed as well, breaking our list
-         * iteration completely.
-         */
-        list_for_each_entry_safe(sdata, tmp, &local->interfaces, list) {
-                if (sdata->dev == local->mdev)
-                        continue;
-                list_del(&sdata->list);
-                __ieee80211_if_del(local, sdata);
-        }
+        /* First, we remove all virtual interfaces. */
+        ieee80211_remove_interfaces(local);
 
         /* then, finally, remove the master interface */
-        __ieee80211_if_del(local, IEEE80211_DEV_TO_SUB_IF(local->mdev));
+        unregister_netdevice(local->mdev);
 
         rtnl_unlock();
 
-        ieee80211_rx_bss_list_deinit(local->mdev);
+        ieee80211_rx_bss_list_deinit(local);
         ieee80211_clear_tx_pending(local);
         sta_info_stop(local);
         rate_control_deinitialize(local);
@@ -1840,8 +1811,7 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw)
         wiphy_unregister(local->hw.wiphy);
         ieee80211_wep_free(local);
         ieee80211_led_exit(local);
-        ieee80211_if_free(local->mdev);
-        local->mdev = NULL;
+        free_netdev(local->mdev);
 }
 EXPORT_SYMBOL(ieee80211_unregister_hw);
 
@@ -1858,27 +1828,17 @@ static int __init ieee80211_init(void)
         struct sk_buff *skb;
         int ret;
 
-        BUILD_BUG_ON(sizeof(struct ieee80211_tx_packet_data) > sizeof(skb->cb));
+        BUILD_BUG_ON(sizeof(struct ieee80211_tx_info) > sizeof(skb->cb));
+        BUILD_BUG_ON(offsetof(struct ieee80211_tx_info, driver_data) +
+                     IEEE80211_TX_INFO_DRIVER_DATA_SIZE > sizeof(skb->cb));
 
         ret = rc80211_pid_init();
         if (ret)
-                goto out;
-
-        ret = ieee80211_wme_register();
-        if (ret) {
-                printk(KERN_DEBUG "ieee80211_init: failed to "
-                       "initialize WME (err=%d)\n", ret);
-                goto out_cleanup_pid;
-        }
+                return ret;
 
         ieee80211_debugfs_netdev_init();
 
         return 0;
-
- out_cleanup_pid:
-        rc80211_pid_exit();
- out:
-        return ret;
 }
 
 static void __exit ieee80211_exit(void)
@@ -1894,7 +1854,6 @@ static void __exit ieee80211_exit(void)
         if (mesh_allocated)
                 ieee80211s_stop();
 
-        ieee80211_wme_unregister();
         ieee80211_debugfs_netdev_exit();
 }
 
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index 697ef67f96b6..b5933b271491 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -315,6 +315,13 @@ struct mesh_table *mesh_table_alloc(int size_order)
         return newtbl;
 }
 
+static void __mesh_table_free(struct mesh_table *tbl)
+{
+        kfree(tbl->hash_buckets);
+        kfree(tbl->hashwlock);
+        kfree(tbl);
+}
+
 void mesh_table_free(struct mesh_table *tbl, bool free_leafs)
 {
         struct hlist_head *mesh_hash;
@@ -330,9 +337,7 @@ void mesh_table_free(struct mesh_table *tbl, bool free_leafs)
                 }
                 spin_unlock(&tbl->hashwlock[i]);
         }
-        kfree(tbl->hash_buckets);
-        kfree(tbl->hashwlock);
-        kfree(tbl);
+        __mesh_table_free(tbl);
 }
 
 static void ieee80211_mesh_path_timer(unsigned long data)
@@ -349,21 +354,16 @@ struct mesh_table *mesh_table_grow(struct mesh_table *tbl)
 {
         struct mesh_table *newtbl;
         struct hlist_head *oldhash;
-        struct hlist_node *p;
-        int err = 0;
+        struct hlist_node *p, *q;
         int i;
 
         if (atomic_read(&tbl->entries)
-                        < tbl->mean_chain_len * (tbl->hash_mask + 1)) {
-                err = -EPERM;
+                        < tbl->mean_chain_len * (tbl->hash_mask + 1))
                 goto endgrow;
-        }
 
         newtbl = mesh_table_alloc(tbl->size_order + 1);
-        if (!newtbl) {
-                err = -ENOMEM;
+        if (!newtbl)
                 goto endgrow;
-        }
 
         newtbl->free_node = tbl->free_node;
         newtbl->mean_chain_len = tbl->mean_chain_len;
@@ -373,13 +373,19 @@ struct mesh_table *mesh_table_grow(struct mesh_table *tbl)
         oldhash = tbl->hash_buckets;
         for (i = 0; i <= tbl->hash_mask; i++)
                 hlist_for_each(p, &oldhash[i])
-                        tbl->copy_node(p, newtbl);
+                        if (tbl->copy_node(p, newtbl) < 0)
+                                goto errcopy;
 
+        return newtbl;
+
+errcopy:
+        for (i = 0; i <= newtbl->hash_mask; i++) {
+                hlist_for_each_safe(p, q, &newtbl->hash_buckets[i])
+                        tbl->free_node(p, 0);
+        }
+        __mesh_table_free(tbl);
 endgrow:
-        if (err)
-                return NULL;
-        else
-                return newtbl;
+        return NULL;
 }
 
 /**
diff --git a/net/mac80211/mesh.h b/net/mac80211/mesh.h
index 2e161f6d8288..669eafafe497 100644
--- a/net/mac80211/mesh.h
+++ b/net/mac80211/mesh.h
@@ -109,7 +109,7 @@ struct mesh_table {
         __u32 hash_rnd;                 /* Used for hash generation */
         atomic_t entries;               /* Up to MAX_MESH_NEIGHBOURS */
         void (*free_node) (struct hlist_node *p, bool free_leafs);
-        void (*copy_node) (struct hlist_node *p, struct mesh_table *newtbl);
+        int (*copy_node) (struct hlist_node *p, struct mesh_table *newtbl);
         int size_order;
         int mean_chain_len;
 };
diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
index af0cd1e3e213..7fa149e230e6 100644
--- a/net/mac80211/mesh_hwmp.c
+++ b/net/mac80211/mesh_hwmp.c
@@ -26,7 +26,7 @@ static inline u32 u32_field_get(u8 *preq_elem, int offset, bool ae)
 {
         if (ae)
                 offset += 6;
-        return le32_to_cpu(get_unaligned((__le32 *) (preq_elem + offset)));
+        return get_unaligned_le32(preq_elem + offset);
 }
 
 /* HWMP IE processing macros */
diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c
index 99c2d360888e..5f88a2e6ee50 100644
--- a/net/mac80211/mesh_pathtbl.c
+++ b/net/mac80211/mesh_pathtbl.c
@@ -158,19 +158,14 @@ int mesh_path_add(u8 *dst, struct net_device *dev)
         if (atomic_add_unless(&sdata->u.sta.mpaths, 1, MESH_MAX_MPATHS) == 0)
                 return -ENOSPC;
 
+        err = -ENOMEM;
         new_mpath = kzalloc(sizeof(struct mesh_path), GFP_KERNEL);
-        if (!new_mpath) {
-                atomic_dec(&sdata->u.sta.mpaths);
-                err = -ENOMEM;
-                goto endadd2;
-        }
+        if (!new_mpath)
+                goto err_path_alloc;
+
         new_node = kmalloc(sizeof(struct mpath_node), GFP_KERNEL);
-        if (!new_node) {
-                kfree(new_mpath);
-                atomic_dec(&sdata->u.sta.mpaths);
-                err = -ENOMEM;
-                goto endadd2;
-        }
+        if (!new_node)
+                goto err_node_alloc;
 
         read_lock(&pathtbl_resize_lock);
         memcpy(new_mpath->dst, dst, ETH_ALEN);
@@ -189,16 +184,11 @@ int mesh_path_add(u8 *dst, struct net_device *dev)
 
         spin_lock(&mesh_paths->hashwlock[hash_idx]);
 
+        err = -EEXIST;
         hlist_for_each_entry(node, n, bucket, list) {
                 mpath = node->mpath;
-                if (mpath->dev == dev && memcmp(dst, mpath->dst, ETH_ALEN)
-                                == 0) {
-                        err = -EEXIST;
-                        atomic_dec(&sdata->u.sta.mpaths);
-                        kfree(new_node);
-                        kfree(new_mpath);
-                        goto endadd;
-                }
+                if (mpath->dev == dev && memcmp(dst, mpath->dst, ETH_ALEN) == 0)
+                        goto err_exists;
         }
 
         hlist_add_head_rcu(&new_node->list, bucket);
@@ -206,10 +196,9 @@ int mesh_path_add(u8 *dst, struct net_device *dev)
                 mesh_paths->mean_chain_len * (mesh_paths->hash_mask + 1))
                 grow = 1;
 
-endadd:
         spin_unlock(&mesh_paths->hashwlock[hash_idx]);
         read_unlock(&pathtbl_resize_lock);
-        if (!err && grow) {
+        if (grow) {
                 struct mesh_table *oldtbl, *newtbl;
 
                 write_lock(&pathtbl_resize_lock);
@@ -217,7 +206,7 @@ endadd:
                 newtbl = mesh_table_grow(mesh_paths);
                 if (!newtbl) {
                         write_unlock(&pathtbl_resize_lock);
-                        return -ENOMEM;
+                        return 0;
                 }
                 rcu_assign_pointer(mesh_paths, newtbl);
                 write_unlock(&pathtbl_resize_lock);
@@ -225,7 +214,16 @@ endadd:
                 synchronize_rcu();
                 mesh_table_free(oldtbl, false);
         }
-endadd2:
+        return 0;
+
+err_exists:
+        spin_unlock(&mesh_paths->hashwlock[hash_idx]);
+        read_unlock(&pathtbl_resize_lock);
+        kfree(new_node);
+err_node_alloc:
+        kfree(new_mpath);
+err_path_alloc:
+        atomic_dec(&sdata->u.sta.mpaths);
         return err;
 }
 
@@ -264,7 +262,6 @@ void mesh_plink_broken(struct sta_info *sta)
         }
         rcu_read_unlock();
 }
-EXPORT_SYMBOL(mesh_plink_broken);
 
 /**
  * mesh_path_flush_by_nexthop - Deletes mesh paths if their next hop matches
@@ -460,25 +457,28 @@ static void mesh_path_node_free(struct hlist_node *p, bool free_leafs)
         struct mpath_node *node = hlist_entry(p, struct mpath_node, list);
         mpath = node->mpath;
         hlist_del_rcu(p);
-        synchronize_rcu();
         if (free_leafs)
                 kfree(mpath);
         kfree(node);
 }
 
-static void mesh_path_node_copy(struct hlist_node *p, struct mesh_table *newtbl)
+static int mesh_path_node_copy(struct hlist_node *p, struct mesh_table *newtbl)
 {
         struct mesh_path *mpath;
         struct mpath_node *node, *new_node;
         u32 hash_idx;
 
+        new_node = kmalloc(sizeof(struct mpath_node), GFP_ATOMIC);
+        if (new_node == NULL)
+                return -ENOMEM;
+
         node = hlist_entry(p, struct mpath_node, list);
         mpath = node->mpath;
-        new_node = kmalloc(sizeof(struct mpath_node), GFP_KERNEL);
         new_node->mpath = mpath;
         hash_idx = mesh_table_hash(mpath->dst, mpath->dev, newtbl);
         hlist_add_head(&new_node->list,
                         &newtbl->hash_buckets[hash_idx]);
+        return 0;
 }
 
 int mesh_pathtbl_init(void)
diff --git a/net/mac80211/mesh_plink.c b/net/mac80211/mesh_plink.c
index 37f0c2b94ae7..9efeb1f07025 100644
--- a/net/mac80211/mesh_plink.c
+++ b/net/mac80211/mesh_plink.c
@@ -79,7 +79,7 @@ void mesh_plink_dec_estab_count(struct ieee80211_sub_if_data *sdata)
  *
  * @sta: mes peer link to restart
  *
- * Locking: this function must be called holding sta->plink_lock
+ * Locking: this function must be called holding sta->lock
  */
 static inline void mesh_plink_fsm_restart(struct sta_info *sta)
 {
@@ -105,7 +105,7 @@ static struct sta_info *mesh_plink_alloc(struct ieee80211_sub_if_data *sdata,
         if (!sta)
                 return NULL;
 
-        sta->flags |= WLAN_STA_AUTHORIZED;
+        sta->flags = WLAN_STA_AUTHORIZED;
         sta->supp_rates[local->hw.conf.channel->band] = rates;
 
         return sta;
@@ -118,7 +118,7 @@ static struct sta_info *mesh_plink_alloc(struct ieee80211_sub_if_data *sdata,
  *
  * All mesh paths with this peer as next hop will be flushed
  *
- * Locking: the caller must hold sta->plink_lock
+ * Locking: the caller must hold sta->lock
  */
 static void __mesh_plink_deactivate(struct sta_info *sta)
 {
@@ -139,9 +139,9 @@ static void __mesh_plink_deactivate(struct sta_info *sta)
  */
 void mesh_plink_deactivate(struct sta_info *sta)
 {
-        spin_lock_bh(&sta->plink_lock);
+        spin_lock_bh(&sta->lock);
         __mesh_plink_deactivate(sta);
-        spin_unlock_bh(&sta->plink_lock);
+        spin_unlock_bh(&sta->lock);
 }
 
 static int mesh_plink_frame_tx(struct net_device *dev,
@@ -270,10 +270,10 @@ static void mesh_plink_timer(unsigned long data)
          */
         sta = (struct sta_info *) data;
 
-        spin_lock_bh(&sta->plink_lock);
+        spin_lock_bh(&sta->lock);
         if (sta->ignore_plink_timer) {
                 sta->ignore_plink_timer = false;
-                spin_unlock_bh(&sta->plink_lock);
+                spin_unlock_bh(&sta->lock);
                 return;
         }
         mpl_dbg("Mesh plink timer for %s fired on state %d\n",
@@ -298,7 +298,7 @@ static void mesh_plink_timer(unsigned long data)
                                              rand % sta->plink_timeout;
                         ++sta->plink_retries;
                         mod_plink_timer(sta, sta->plink_timeout);
-                        spin_unlock_bh(&sta->plink_lock);
+                        spin_unlock_bh(&sta->lock);
                         mesh_plink_frame_tx(dev, PLINK_OPEN, sta->addr, llid,
                                             0, 0);
                         break;
@@ -311,7 +311,7 @@ static void mesh_plink_timer(unsigned long data)
                         reason = cpu_to_le16(MESH_CONFIRM_TIMEOUT);
                 sta->plink_state = PLINK_HOLDING;
                 mod_plink_timer(sta, dot11MeshHoldingTimeout(sdata));
-                spin_unlock_bh(&sta->plink_lock);
+                spin_unlock_bh(&sta->lock);
                 mesh_plink_frame_tx(dev, PLINK_CLOSE, sta->addr, llid, plid,
                                     reason);
                 break;
@@ -319,10 +319,10 @@ static void mesh_plink_timer(unsigned long data)
                 /* holding timer */
                 del_timer(&sta->plink_timer);
                 mesh_plink_fsm_restart(sta);
-                spin_unlock_bh(&sta->plink_lock);
+                spin_unlock_bh(&sta->lock);
                 break;
         default:
-                spin_unlock_bh(&sta->plink_lock);
+                spin_unlock_bh(&sta->lock);
                 break;
         }
 }
@@ -344,16 +344,16 @@ int mesh_plink_open(struct sta_info *sta)
         DECLARE_MAC_BUF(mac);
 #endif
 
-        spin_lock_bh(&sta->plink_lock);
+        spin_lock_bh(&sta->lock);
         get_random_bytes(&llid, 2);
         sta->llid = llid;
         if (sta->plink_state != PLINK_LISTEN) {
-                spin_unlock_bh(&sta->plink_lock);
+                spin_unlock_bh(&sta->lock);
                 return -EBUSY;
         }
         sta->plink_state = PLINK_OPN_SNT;
         mesh_plink_timer_set(sta, dot11MeshRetryTimeout(sdata));
-        spin_unlock_bh(&sta->plink_lock);
+        spin_unlock_bh(&sta->lock);
         mpl_dbg("Mesh plink: starting establishment with %s\n",
                 print_mac(mac, sta->addr));
 
@@ -367,10 +367,10 @@ void mesh_plink_block(struct sta_info *sta)
         DECLARE_MAC_BUF(mac);
 #endif
 
-        spin_lock_bh(&sta->plink_lock);
+        spin_lock_bh(&sta->lock);
         __mesh_plink_deactivate(sta);
         sta->plink_state = PLINK_BLOCKED;
-        spin_unlock_bh(&sta->plink_lock);
+        spin_unlock_bh(&sta->lock);
 }
 
 int mesh_plink_close(struct sta_info *sta)
@@ -383,14 +383,14 @@ int mesh_plink_close(struct sta_info *sta)
 
         mpl_dbg("Mesh plink: closing link with %s\n",
                         print_mac(mac, sta->addr));
-        spin_lock_bh(&sta->plink_lock);
+        spin_lock_bh(&sta->lock);
         sta->reason = cpu_to_le16(MESH_LINK_CANCELLED);
         reason = sta->reason;
 
         if (sta->plink_state == PLINK_LISTEN ||
             sta->plink_state == PLINK_BLOCKED) {
                 mesh_plink_fsm_restart(sta);
-                spin_unlock_bh(&sta->plink_lock);
+                spin_unlock_bh(&sta->lock);
                 return 0;
         } else if (sta->plink_state == PLINK_ESTAB) {
                 __mesh_plink_deactivate(sta);
@@ -402,7 +402,7 @@ int mesh_plink_close(struct sta_info *sta)
         sta->plink_state = PLINK_HOLDING;
         llid = sta->llid;
         plid = sta->plid;
-        spin_unlock_bh(&sta->plink_lock);
+        spin_unlock_bh(&sta->lock);
         mesh_plink_frame_tx(sta->sdata->dev, PLINK_CLOSE, sta->addr, llid,
                             plid, reason);
         return 0;
@@ -490,7 +490,7 @@ void mesh_rx_plink_frame(struct net_device *dev, struct ieee80211_mgmt *mgmt,
                         /* avoid warning */
                         break;
                 }
-                spin_lock_bh(&sta->plink_lock);
+                spin_lock_bh(&sta->lock);
         } else if (!sta) {
                 /* ftype == PLINK_OPEN */
                 u64 rates;
@@ -512,9 +512,9 @@ void mesh_rx_plink_frame(struct net_device *dev, struct ieee80211_mgmt *mgmt,
                         return;
                 }
                 event = OPN_ACPT;
-                spin_lock_bh(&sta->plink_lock);
+                spin_lock_bh(&sta->lock);
         } else {
-                spin_lock_bh(&sta->plink_lock);
+                spin_lock_bh(&sta->lock);
                 switch (ftype) {
                 case PLINK_OPEN:
                         if (!mesh_plink_free_count(sdata) ||
@@ -551,7 +551,7 @@ void mesh_rx_plink_frame(struct net_device *dev, struct ieee80211_mgmt *mgmt,
                         break;
                 default:
                         mpl_dbg("Mesh plink: unknown frame subtype\n");
-                        spin_unlock_bh(&sta->plink_lock);
+                        spin_unlock_bh(&sta->lock);
                         rcu_read_unlock();
                         return;
                 }
@@ -568,7 +568,7 @@ void mesh_rx_plink_frame(struct net_device *dev, struct ieee80211_mgmt *mgmt,
                 switch (event) {
                 case CLS_ACPT:
                         mesh_plink_fsm_restart(sta);
-                        spin_unlock_bh(&sta->plink_lock);
+                        spin_unlock_bh(&sta->lock);
                         break;
                 case OPN_ACPT:
                         sta->plink_state = PLINK_OPN_RCVD;
@@ -576,14 +576,14 @@ void mesh_rx_plink_frame(struct net_device *dev, struct ieee80211_mgmt *mgmt,
                         get_random_bytes(&llid, 2);
                         sta->llid = llid;
                         mesh_plink_timer_set(sta, dot11MeshRetryTimeout(sdata));
-                        spin_unlock_bh(&sta->plink_lock);
+                        spin_unlock_bh(&sta->lock);
                         mesh_plink_frame_tx(dev, PLINK_OPEN, sta->addr, llid,
                                             0, 0);
                         mesh_plink_frame_tx(dev, PLINK_CONFIRM, sta->addr,
                                             llid, plid, 0);
                         break;
                 default:
-                        spin_unlock_bh(&sta->plink_lock);
+                        spin_unlock_bh(&sta->lock);
                         break;
                 }
                 break;
@@ -603,7 +603,7 @@ void mesh_rx_plink_frame(struct net_device *dev, struct ieee80211_mgmt *mgmt,
                                 sta->ignore_plink_timer = true;
 
                         llid = sta->llid;
-                        spin_unlock_bh(&sta->plink_lock);
+                        spin_unlock_bh(&sta->lock);
                         mesh_plink_frame_tx(dev, PLINK_CLOSE, sta->addr, llid,
                                             plid, reason);
                         break;
@@ -612,7 +612,7 @@ void mesh_rx_plink_frame(struct net_device *dev, struct ieee80211_mgmt *mgmt,
                         sta->plink_state = PLINK_OPN_RCVD;
                         sta->plid = plid;
                         llid = sta->llid;
-                        spin_unlock_bh(&sta->plink_lock);
+                        spin_unlock_bh(&sta->lock);
                         mesh_plink_frame_tx(dev, PLINK_CONFIRM, sta->addr, llid,
                                             plid, 0);
                         break;
@@ -622,10 +622,10 @@ void mesh_rx_plink_frame(struct net_device *dev, struct ieee80211_mgmt *mgmt,
                                              dot11MeshConfirmTimeout(sdata)))
                                 sta->ignore_plink_timer = true;
 
-                        spin_unlock_bh(&sta->plink_lock);
+                        spin_unlock_bh(&sta->lock);
                         break;
                 default:
-                        spin_unlock_bh(&sta->plink_lock);
+                        spin_unlock_bh(&sta->lock);
                         break;
                 }
                 break;
@@ -645,13 +645,13 @@ void mesh_rx_plink_frame(struct net_device *dev, struct ieee80211_mgmt *mgmt,
                                 sta->ignore_plink_timer = true;
 
                         llid = sta->llid;
-                        spin_unlock_bh(&sta->plink_lock);
+                        spin_unlock_bh(&sta->lock);
                         mesh_plink_frame_tx(dev, PLINK_CLOSE, sta->addr, llid,
                                             plid, reason);
                         break;
                 case OPN_ACPT:
                         llid = sta->llid;
-                        spin_unlock_bh(&sta->plink_lock);
+                        spin_unlock_bh(&sta->lock);
                         mesh_plink_frame_tx(dev, PLINK_CONFIRM, sta->addr, llid,
                                             plid, 0);
                         break;
@@ -659,12 +659,12 @@ void mesh_rx_plink_frame(struct net_device *dev, struct ieee80211_mgmt *mgmt,
                         del_timer(&sta->plink_timer);
                         sta->plink_state = PLINK_ESTAB;
                         mesh_plink_inc_estab_count(sdata);
-                        spin_unlock_bh(&sta->plink_lock);
+                        spin_unlock_bh(&sta->lock);
                         mpl_dbg("Mesh plink with %s ESTABLISHED\n",
                                         print_mac(mac, sta->addr));
                         break;
                 default:
-                        spin_unlock_bh(&sta->plink_lock);
+                        spin_unlock_bh(&sta->lock);
                         break;
                 }
                 break;
@@ -684,7 +684,7 @@ void mesh_rx_plink_frame(struct net_device *dev, struct ieee80211_mgmt *mgmt,
                                 sta->ignore_plink_timer = true;
 
                         llid = sta->llid;
-                        spin_unlock_bh(&sta->plink_lock);
+                        spin_unlock_bh(&sta->lock);
                         mesh_plink_frame_tx(dev, PLINK_CLOSE, sta->addr, llid,
                                             plid, reason);
                         break;
@@ -692,14 +692,14 @@ void mesh_rx_plink_frame(struct net_device *dev, struct ieee80211_mgmt *mgmt,
                         del_timer(&sta->plink_timer);
                         sta->plink_state = PLINK_ESTAB;
                         mesh_plink_inc_estab_count(sdata);
-                        spin_unlock_bh(&sta->plink_lock);
+                        spin_unlock_bh(&sta->lock);
                         mpl_dbg("Mesh plink with %s ESTABLISHED\n",
                                         print_mac(mac, sta->addr));
                         mesh_plink_frame_tx(dev, PLINK_CONFIRM, sta->addr, llid,
                                             plid, 0);
                         break;
                 default:
-                        spin_unlock_bh(&sta->plink_lock);
+                        spin_unlock_bh(&sta->lock);
                         break;
                 }
                 break;
@@ -713,18 +713,18 @@ void mesh_rx_plink_frame(struct net_device *dev, struct ieee80211_mgmt *mgmt,
                         sta->plink_state = PLINK_HOLDING;
                         llid = sta->llid;
                         mod_plink_timer(sta, dot11MeshHoldingTimeout(sdata));
-                        spin_unlock_bh(&sta->plink_lock);
+                        spin_unlock_bh(&sta->lock);
                         mesh_plink_frame_tx(dev, PLINK_CLOSE, sta->addr, llid,
                                             plid, reason);
                         break;
                 case OPN_ACPT:
                         llid = sta->llid;
-                        spin_unlock_bh(&sta->plink_lock);
+                        spin_unlock_bh(&sta->lock);
                         mesh_plink_frame_tx(dev, PLINK_CONFIRM, sta->addr, llid,
                                             plid, 0);
                         break;
                 default:
-                        spin_unlock_bh(&sta->plink_lock);
+                        spin_unlock_bh(&sta->lock);
                         break;
                 }
                 break;
@@ -734,7 +734,7 @@ void mesh_rx_plink_frame(struct net_device *dev, struct ieee80211_mgmt *mgmt,
                         if (del_timer(&sta->plink_timer))
                                 sta->ignore_plink_timer = 1;
                         mesh_plink_fsm_restart(sta);
-                        spin_unlock_bh(&sta->plink_lock);
+                        spin_unlock_bh(&sta->lock);
                         break;
                 case OPN_ACPT:
                 case CNF_ACPT:
@@ -742,19 +742,19 @@ void mesh_rx_plink_frame(struct net_device *dev, struct ieee80211_mgmt *mgmt,
                 case CNF_RJCT:
                         llid = sta->llid;
                         reason = sta->reason;
-                        spin_unlock_bh(&sta->plink_lock);
+                        spin_unlock_bh(&sta->lock);
                         mesh_plink_frame_tx(dev, PLINK_CLOSE, sta->addr, llid,
                                             plid, reason);
                         break;
                 default:
-                        spin_unlock_bh(&sta->plink_lock);
+                        spin_unlock_bh(&sta->lock);
                 }
                 break;
         default:
                 /* should not get here, PLINK_BLOCKED is dealt with at the
                  * beggining of the function
                  */
-                spin_unlock_bh(&sta->plink_lock);
+                spin_unlock_bh(&sta->lock);
                 break;
         }
 
diff --git a/net/mac80211/michael.c b/net/mac80211/michael.c
index 0f844f7895f1..408649bd4702 100644
--- a/net/mac80211/michael.c
+++ b/net/mac80211/michael.c
@@ -6,85 +6,68 @@
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  */
-
 #include <linux/types.h>
+#include <linux/bitops.h>
+#include <linux/ieee80211.h>
+#include <asm/unaligned.h>
 
 #include "michael.h"
 
-static inline u32 rotr(u32 val, int bits)
-{
-        return (val >> bits) | (val << (32 - bits));
-}
-
-
-static inline u32 rotl(u32 val, int bits)
-{
-        return (val << bits) | (val >> (32 - bits));
-}
-
-
-static inline u32 xswap(u32 val)
-{
-        return ((val & 0xff00ff00) >> 8) | ((val & 0x00ff00ff) << 8);
-}
-
-
-#define michael_block(l, r) \
-do { \
-        r ^= rotl(l, 17); \
-        l += r; \
-        r ^= xswap(l); \
-        l += r; \
-        r ^= rotl(l, 3); \
-        l += r; \
-        r ^= rotr(l, 2); \
-        l += r; \
-} while (0)
-
-
-static inline u32 michael_get32(u8 *data)
+static void michael_block(struct michael_mic_ctx *mctx, u32 val)
 {
-        return data[0] | (data[1] << 8) | (data[2] << 16) | (data[3] << 24);
+        mctx->l ^= val;
+        mctx->r ^= rol32(mctx->l, 17);
+        mctx->l += mctx->r;
+        mctx->r ^= ((mctx->l & 0xff00ff00) >> 8) |
+                   ((mctx->l & 0x00ff00ff) << 8);
+        mctx->l += mctx->r;
+        mctx->r ^= rol32(mctx->l, 3);
+        mctx->l += mctx->r;
+        mctx->r ^= ror32(mctx->l, 2);
+        mctx->l += mctx->r;
 }
 
-
-static inline void michael_put32(u32 val, u8 *data)
+static void michael_mic_hdr(struct michael_mic_ctx *mctx, const u8 *key,
+                            struct ieee80211_hdr *hdr)
 {
-        data[0] = val & 0xff;
-        data[1] = (val >> 8) & 0xff;
-        data[2] = (val >> 16) & 0xff;
-        data[3] = (val >> 24) & 0xff;
+        u8 *da, *sa, tid;
+
+        da = ieee80211_get_DA(hdr);
+        sa = ieee80211_get_SA(hdr);
+        if (ieee80211_is_data_qos(hdr->frame_control))
+                tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK;
+        else
+                tid = 0;
+
+        mctx->l = get_unaligned_le32(key);
+        mctx->r = get_unaligned_le32(key + 4);
+
+        /*
+         * A pseudo header (DA, SA, Priority, 0, 0, 0) is used in Michael MIC
+         * calculation, but it is _not_ transmitted
+         */
+        michael_block(mctx, get_unaligned_le32(da));
+        michael_block(mctx, get_unaligned_le16(&da[4]) |
+                            (get_unaligned_le16(sa) << 16));
+        michael_block(mctx, get_unaligned_le32(&sa[2]));
+        michael_block(mctx, tid);
 }
 
-
-void michael_mic(u8 *key, u8 *da, u8 *sa, u8 priority,
-                 u8 *data, size_t data_len, u8 *mic)
+void michael_mic(const u8 *key, struct ieee80211_hdr *hdr,
+                 const u8 *data, size_t data_len, u8 *mic)
 {
-        u32 l, r, val;
+        u32 val;
         size_t block, blocks, left;
+        struct michael_mic_ctx mctx;
 
-        l = michael_get32(key);
-        r = michael_get32(key + 4);
-
-        /* A pseudo header (DA, SA, Priority, 0, 0, 0) is used in Michael MIC
-         * calculation, but it is _not_ transmitted */
-        l ^= michael_get32(da);
-        michael_block(l, r);
-        l ^= da[4] | (da[5] << 8) | (sa[0] << 16) | (sa[1] << 24);
-        michael_block(l, r);
-        l ^= michael_get32(&sa[2]);
-        michael_block(l, r);
-        l ^= priority;
-        michael_block(l, r);
+        michael_mic_hdr(&mctx, key, hdr);
 
         /* Real data */
         blocks = data_len / 4;
         left = data_len % 4;
 
-        for (block = 0; block < blocks; block++) {
-                l ^= michael_get32(&data[block * 4]);
-                michael_block(l, r);
-        }
+        for (block = 0; block < blocks; block++)
+                michael_block(&mctx, get_unaligned_le32(&data[block * 4]));
 
         /* Partial block of 0..3 bytes and padding: 0x5a + 4..7 zeros to make
          * total length a multiple of 4. */
@@ -94,11 +77,10 @@ void michael_mic(u8 *key, u8 *da, u8 *sa, u8 priority,
                 left--;
                 val |= data[blocks * 4 + left];
         }
-        l ^= val;
-        michael_block(l, r);
-        /* last block is zero, so l ^ 0 = l */
-        michael_block(l, r);
 
-        michael_put32(l, mic);
-        michael_put32(r, mic + 4);
+        michael_block(&mctx, val);
+        michael_block(&mctx, 0);
+
+        put_unaligned_le32(mctx.l, mic);
+        put_unaligned_le32(mctx.r, mic + 4);
 }
diff --git a/net/mac80211/michael.h b/net/mac80211/michael.h
index 2e6aebabeea1..3b848dad9587 100644
--- a/net/mac80211/michael.h
+++ b/net/mac80211/michael.h
@@ -14,7 +14,11 @@
 
 #define MICHAEL_MIC_LEN 8
 
-void michael_mic(u8 *key, u8 *da, u8 *sa, u8 priority,
-                 u8 *data, size_t data_len, u8 *mic);
+struct michael_mic_ctx {
+        u32 l, r;
+};
+
+void michael_mic(const u8 *key, struct ieee80211_hdr *hdr,
+                 const u8 *data, size_t data_len, u8 *mic);
 
 #endif /* MICHAEL_H */
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 4d2b582dd055..d7c371e36bf0 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -78,7 +78,7 @@ static void ieee80211_send_probe_req(struct net_device *dev, u8 *dst,
 static struct ieee80211_sta_bss *
 ieee80211_rx_bss_get(struct net_device *dev, u8 *bssid, int freq,
                      u8 *ssid, u8 ssid_len);
-static void ieee80211_rx_bss_put(struct net_device *dev,
+static void ieee80211_rx_bss_put(struct ieee80211_local *local,
                                  struct ieee80211_sta_bss *bss);
 static int ieee80211_sta_find_ibss(struct net_device *dev,
                                    struct ieee80211_if_sta *ifsta);
@@ -87,6 +87,7 @@ static int ieee80211_sta_start_scan(struct net_device *dev,
                                     u8 *ssid, size_t ssid_len);
 static int ieee80211_sta_config_auth(struct net_device *dev,
                                      struct ieee80211_if_sta *ifsta);
+static void sta_rx_agg_session_timer_expired(unsigned long data);
 
 
 void ieee802_11_parse_elems(u8 *start, size_t len,
@@ -203,6 +204,25 @@ void ieee802_11_parse_elems(u8 *start, size_t len,
                         elems->perr = pos;
                         elems->perr_len = elen;
                         break;
+                case WLAN_EID_CHANNEL_SWITCH:
+                        elems->ch_switch_elem = pos;
+                        elems->ch_switch_elem_len = elen;
+                        break;
+                case WLAN_EID_QUIET:
+                        if (!elems->quiet_elem) {
+                                elems->quiet_elem = pos;
+                                elems->quiet_elem_len = elen;
+                        }
+                        elems->num_of_quiet_elem++;
+                        break;
+                case WLAN_EID_COUNTRY:
+                        elems->country_elem = pos;
+                        elems->country_elem_len = elen;
+                        break;
+                case WLAN_EID_PWR_CONSTRAINT:
+                        elems->pwr_constr_elem = pos;
+                        elems->pwr_constr_elem_len = elen;
+                        break;
                 default:
                         break;
                 }
@@ -256,19 +276,8 @@ static void ieee80211_sta_def_wmm_params(struct net_device *dev,
                 qparam.cw_max = 1023;
                 qparam.txop = 0;
 
-                for (i = IEEE80211_TX_QUEUE_DATA0; i < NUM_TX_DATA_QUEUES; i++)
-                        local->ops->conf_tx(local_to_hw(local),
-                                           i + IEEE80211_TX_QUEUE_DATA0,
-                                           &qparam);
-
-                if (ibss) {
-                        /* IBSS uses different parameters for Beacon sending */
-                        qparam.cw_min++;
-                        qparam.cw_min *= 2;
-                        qparam.cw_min--;
-                        local->ops->conf_tx(local_to_hw(local),
-                                           IEEE80211_TX_QUEUE_BEACON, &qparam);
-                }
+                for (i = 0; i < local_to_hw(local)->queues; i++)
+                        local->ops->conf_tx(local_to_hw(local), i, &qparam);
         }
 }
 
@@ -282,6 +291,12 @@ static void ieee80211_sta_wmm_params(struct net_device *dev,
         int count;
         u8 *pos;
 
+        if (!(ifsta->flags & IEEE80211_STA_WMM_ENABLED))
+                return;
+
+        if (!wmm_param)
+                return;
+
         if (wmm_param_len < 8 || wmm_param[5] /* version */ != 1)
                 return;
         count = wmm_param[6] & 0x0f;
@@ -305,37 +320,33 @@ static void ieee80211_sta_wmm_params(struct net_device *dev,
 
                 switch (aci) {
                 case 1:
-                        queue = IEEE80211_TX_QUEUE_DATA3;
-                        if (acm) {
+                        queue = 3;
+                        if (acm)
                                 local->wmm_acm |= BIT(0) | BIT(3);
-                        }
                         break;
                 case 2:
-                        queue = IEEE80211_TX_QUEUE_DATA1;
-                        if (acm) {
+                        queue = 1;
+                        if (acm)
                                 local->wmm_acm |= BIT(4) | BIT(5);
-                        }
                         break;
                 case 3:
-                        queue = IEEE80211_TX_QUEUE_DATA0;
-                        if (acm) {
+                        queue = 0;
+                        if (acm)
                                 local->wmm_acm |= BIT(6) | BIT(7);
-                        }
                         break;
                 case 0:
                 default:
-                        queue = IEEE80211_TX_QUEUE_DATA2;
-                        if (acm) {
+                        queue = 2;
+                        if (acm)
                                 local->wmm_acm |= BIT(1) | BIT(2);
-                        }
                         break;
                 }
 
                 params.aifs = pos[0] & 0x0f;
                 params.cw_max = ecw2cw((pos[1] & 0xf0) >> 4);
                 params.cw_min = ecw2cw(pos[1] & 0x0f);
-                params.txop = pos[2] | (pos[3] << 8);
-#ifdef CONFIG_MAC80211_DEBUG
+                params.txop = get_unaligned_le16(pos + 2);
+#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
                 printk(KERN_DEBUG "%s: WMM queue=%d aci=%d acm=%d aifs=%d "
                        "cWmin=%d cWmax=%d txop=%d\n",
                        dev->name, queue, aci, acm, params.aifs, params.cw_min,
@@ -355,11 +366,14 @@ static u32 ieee80211_handle_protect_preamb(struct ieee80211_sub_if_data *sdata,
                                            bool use_short_preamble)
 {
         struct ieee80211_bss_conf *bss_conf = &sdata->bss_conf;
+#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
         DECLARE_MAC_BUF(mac);
+#endif
         u32 changed = 0;
 
         if (use_protection != bss_conf->use_cts_prot) {
+#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
                 if (net_ratelimit()) {
                         printk(KERN_DEBUG "%s: CTS protection %s (BSSID="
                                "%s)\n",
@@ -367,11 +381,13 @@ static u32 ieee80211_handle_protect_preamb(struct ieee80211_sub_if_data *sdata,
                                use_protection ? "enabled" : "disabled",
                                print_mac(mac, ifsta->bssid));
                 }
+#endif
                 bss_conf->use_cts_prot = use_protection;
                 changed |= BSS_CHANGED_ERP_CTS_PROT;
         }
 
         if (use_short_preamble != bss_conf->use_short_preamble) {
+#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
                 if (net_ratelimit()) {
                         printk(KERN_DEBUG "%s: switched to %s barker preamble"
                                " (BSSID=%s)\n",
@@ -379,6 +395,7 @@ static u32 ieee80211_handle_protect_preamb(struct ieee80211_sub_if_data *sdata,
                                use_short_preamble ? "short" : "long",
                                print_mac(mac, ifsta->bssid));
                 }
+#endif
                 bss_conf->use_short_preamble = use_short_preamble;
                 changed |= BSS_CHANGED_ERP_PREAMBLE;
         }
@@ -537,7 +554,7 @@ static void ieee80211_set_associated(struct net_device *dev,
 
                         changed |= ieee80211_handle_bss_capability(sdata, bss);
 
-                        ieee80211_rx_bss_put(dev, bss);
+                        ieee80211_rx_bss_put(local, bss);
                 }
 
                 if (conf->flags & IEEE80211_CONF_SUPPORT_HT_MODE) {
@@ -547,16 +564,15 @@ static void ieee80211_set_associated(struct net_device *dev,
                         sdata->bss_conf.ht_bss_conf = &conf->ht_bss_conf;
                 }
 
-                netif_carrier_on(dev);
                 ifsta->flags |= IEEE80211_STA_PREV_BSSID_SET;
                 memcpy(ifsta->prev_bssid, sdata->u.sta.bssid, ETH_ALEN);
                 memcpy(wrqu.ap_addr.sa_data, sdata->u.sta.bssid, ETH_ALEN);
                 ieee80211_sta_send_associnfo(dev, ifsta);
         } else {
+                netif_carrier_off(dev);
                 ieee80211_sta_tear_down_BA_sessions(dev, ifsta->bssid);
                 ifsta->flags &= ~IEEE80211_STA_ASSOCIATED;
-                netif_carrier_off(dev);
-                ieee80211_reset_erp_info(dev);
+                changed |= ieee80211_reset_erp_info(dev);
 
                 sdata->bss_conf.assoc_ht = 0;
                 sdata->bss_conf.ht_conf = NULL;
@@ -569,6 +585,10 @@ static void ieee80211_set_associated(struct net_device *dev,
 
         sdata->bss_conf.assoc = assoc;
         ieee80211_bss_info_change_notify(sdata, changed);
+
+        if (assoc)
+                netif_carrier_on(dev);
+
         wrqu.ap_addr.sa_family = ARPHRD_ETHER;
         wireless_send_event(dev, SIOCGIWAP, &wrqu, NULL);
 }
@@ -586,7 +606,7 @@ void ieee80211_sta_tx(struct net_device *dev, struct sk_buff *skb,
                       int encrypt)
 {
         struct ieee80211_sub_if_data *sdata;
-        struct ieee80211_tx_packet_data *pkt_data;
+        struct ieee80211_tx_info *info;
 
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         skb->dev = sdata->local->mdev;
@@ -594,11 +614,11 @@ void ieee80211_sta_tx(struct net_device *dev, struct sk_buff *skb,
         skb_set_network_header(skb, 0);
         skb_set_transport_header(skb, 0);
 
-        pkt_data = (struct ieee80211_tx_packet_data *) skb->cb;
-        memset(pkt_data, 0, sizeof(struct ieee80211_tx_packet_data));
-        pkt_data->ifindex = sdata->dev->ifindex;
+        info = IEEE80211_SKB_CB(skb);
+        memset(info, 0, sizeof(struct ieee80211_tx_info));
+        info->control.ifindex = sdata->dev->ifindex;
         if (!encrypt)
-                pkt_data->flags |= IEEE80211_TXPD_DO_NOT_ENCRYPT;
+                info->flags |= IEEE80211_TX_CTL_DO_NOT_ENCRYPT;
 
         dev_queue_xmit(skb);
 }
@@ -727,9 +747,8 @@ static void ieee80211_send_assoc(struct net_device *dev,
         if (bss) {
                 if (bss->capability & WLAN_CAPABILITY_PRIVACY)
                         capab |= WLAN_CAPABILITY_PRIVACY;
-                if (bss->wmm_ie) {
+                if (bss->wmm_ie)
                         wmm = 1;
-                }
 
                 /* get all rates supported by the device and the AP as
                  * some APs don't like getting a superset of their rates
@@ -737,7 +756,11 @@ static void ieee80211_send_assoc(struct net_device *dev,
                  * b-only mode) */
                 rates_len = ieee80211_compatible_rates(bss, sband, &rates);
 
-                ieee80211_rx_bss_put(dev, bss);
+                if ((bss->capability & WLAN_CAPABILITY_SPECTRUM_MGMT) &&
+                    (local->hw.flags & IEEE80211_HW_SPECTRUM_MGMT))
+                        capab |= WLAN_CAPABILITY_SPECTRUM_MGMT;
+
+                ieee80211_rx_bss_put(local, bss);
         } else {
                 rates = ~0;
                 rates_len = sband->n_bitrates;
@@ -804,6 +827,26 @@ static void ieee80211_send_assoc(struct net_device *dev,
                 }
         }
 
+        if (capab & WLAN_CAPABILITY_SPECTRUM_MGMT) {
+                /* 1. power capabilities */
+                pos = skb_put(skb, 4);
+                *pos++ = WLAN_EID_PWR_CAPABILITY;
+                *pos++ = 2;
+                *pos++ = 0; /* min tx power */
+                *pos++ = local->hw.conf.channel->max_power; /* max tx power */
+
+                /* 2. supported channels */
+                /* TODO: get this in reg domain format */
+                pos = skb_put(skb, 2 * sband->n_channels + 2);
+                *pos++ = WLAN_EID_SUPPORTED_CHANNELS;
+                *pos++ = 2 * sband->n_channels;
+                for (i = 0; i < sband->n_channels; i++) {
+                        *pos++ = ieee80211_frequency_to_channel(
+                                        sband->channels[i].center_freq);
+                        *pos++ = 1; /* one channel in the subband*/
+                }
+        }
+
         if (ifsta->extra_ie) {
                 pos = skb_put(skb, ifsta->extra_ie_len);
                 memcpy(pos, ifsta->extra_ie, ifsta->extra_ie_len);
@@ -821,9 +864,32 @@ static void ieee80211_send_assoc(struct net_device *dev,
                 *pos++ = 1; /* WME ver */
                 *pos++ = 0;
         }
+
         /* wmm support is a must to HT */
-        if (wmm && sband->ht_info.ht_supported) {
-                __le16 tmp = cpu_to_le16(sband->ht_info.cap);
+        if (wmm && (ifsta->flags & IEEE80211_STA_WMM_ENABLED) &&
+            sband->ht_info.ht_supported && bss->ht_add_ie) {
+                struct ieee80211_ht_addt_info *ht_add_info =
+                        (struct ieee80211_ht_addt_info *)bss->ht_add_ie;
+                u16 cap = sband->ht_info.cap;
+                __le16 tmp;
+                u32 flags = local->hw.conf.channel->flags;
+
+                switch (ht_add_info->ht_param & IEEE80211_HT_IE_CHA_SEC_OFFSET) {
+                case IEEE80211_HT_IE_CHA_SEC_ABOVE:
+                        if (flags & IEEE80211_CHAN_NO_FAT_ABOVE) {
+                                cap &= ~IEEE80211_HT_CAP_SUP_WIDTH;
+                                cap &= ~IEEE80211_HT_CAP_SGI_40;
+                        }
+                        break;
+                case IEEE80211_HT_IE_CHA_SEC_BELOW:
+                        if (flags & IEEE80211_CHAN_NO_FAT_BELOW) {
+                                cap &= ~IEEE80211_HT_CAP_SUP_WIDTH;
+                                cap &= ~IEEE80211_HT_CAP_SGI_40;
+                        }
+                        break;
+                }
+
+                tmp = cpu_to_le16(cap);
                 pos = skb_put(skb, sizeof(struct ieee80211_ht_cap)+2);
                 *pos++ = WLAN_EID_HT_CAPABILITY;
                 *pos++ = sizeof(struct ieee80211_ht_cap);
@@ -926,7 +992,7 @@ static int ieee80211_privacy_mismatch(struct net_device *dev,
         wep_privacy = !!ieee80211_sta_wep_configured(dev);
         privacy_invoked = !!(ifsta->flags & IEEE80211_STA_PRIVACY_INVOKED);
 
-        ieee80211_rx_bss_put(dev, bss);
+        ieee80211_rx_bss_put(local, bss);
 
         if ((bss_privacy == wep_privacy) || (bss_privacy == privacy_invoked))
                 return 0;
@@ -1118,14 +1184,10 @@ static void ieee80211_auth_challenge(struct net_device *dev,
         u8 *pos;
         struct ieee802_11_elems elems;
 
-        printk(KERN_DEBUG "%s: replying to auth challenge\n", dev->name);
         pos = mgmt->u.auth.variable;
         ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems);
-        if (!elems.challenge) {
-                printk(KERN_DEBUG "%s: no challenge IE in shared key auth "
-                       "frame\n", dev->name);
+        if (!elems.challenge)
                 return;
-        }
         ieee80211_send_auth(dev, ifsta, 3, elems.challenge - 2,
                             elems.challenge_len + 2, 1);
 }
@@ -1141,8 +1203,8 @@ static void ieee80211_send_addba_resp(struct net_device *dev, u8 *da, u16 tid,
         struct ieee80211_mgmt *mgmt;
         u16 capab;
 
-        skb = dev_alloc_skb(sizeof(*mgmt) + local->hw.extra_tx_headroom + 1 +
-                                        sizeof(mgmt->u.action.u.addba_resp));
+        skb = dev_alloc_skb(sizeof(*mgmt) + local->hw.extra_tx_headroom);
+
         if (!skb) {
                 printk(KERN_DEBUG "%s: failed to allocate buffer "
                        "for addba resp frame\n", dev->name);
@@ -1190,9 +1252,7 @@ void ieee80211_send_addba_request(struct net_device *dev, const u8 *da,
         struct ieee80211_mgmt *mgmt;
         u16 capab;
 
-        skb = dev_alloc_skb(sizeof(*mgmt) + local->hw.extra_tx_headroom + 1 +
-                                sizeof(mgmt->u.action.u.addba_req));
-
+        skb = dev_alloc_skb(sizeof(*mgmt) + local->hw.extra_tx_headroom);
 
         if (!skb) {
                 printk(KERN_ERR "%s: failed to allocate buffer "
@@ -1293,7 +1353,7 @@ static void ieee80211_sta_process_addba_request(struct net_device *dev,
 
 
         /* examine state machine */
-        spin_lock_bh(&sta->ampdu_mlme.ampdu_rx);
+        spin_lock_bh(&sta->lock);
 
         if (sta->ampdu_mlme.tid_state_rx[tid] != HT_AGG_STATE_IDLE) {
 #ifdef CONFIG_MAC80211_HT_DEBUG
@@ -1309,9 +1369,11 @@ static void ieee80211_sta_process_addba_request(struct net_device *dev,
         sta->ampdu_mlme.tid_rx[tid] =
                         kmalloc(sizeof(struct tid_ampdu_rx), GFP_ATOMIC);
         if (!sta->ampdu_mlme.tid_rx[tid]) {
+#ifdef CONFIG_MAC80211_HT_DEBUG
                 if (net_ratelimit())
                         printk(KERN_ERR "allocate rx mlme to tid %d failed\n",
                                         tid);
+#endif
                 goto end;
         }
         /* rx timer */
@@ -1327,9 +1389,11 @@ static void ieee80211_sta_process_addba_request(struct net_device *dev,
         tid_agg_rx->reorder_buf =
                 kmalloc(buf_size * sizeof(struct sk_buff *), GFP_ATOMIC);
         if (!tid_agg_rx->reorder_buf) {
+#ifdef CONFIG_MAC80211_HT_DEBUG
                 if (net_ratelimit())
                         printk(KERN_ERR "can not allocate reordering buffer "
                                "to tid %d\n", tid);
+#endif
                 kfree(sta->ampdu_mlme.tid_rx[tid]);
                 goto end;
         }
@@ -1360,7 +1424,7 @@ static void ieee80211_sta_process_addba_request(struct net_device *dev,
         tid_agg_rx->stored_mpdu_num = 0;
         status = WLAN_STATUS_SUCCESS;
 end:
-        spin_unlock_bh(&sta->ampdu_mlme.ampdu_rx);
+        spin_unlock_bh(&sta->lock);
 
 end_no_lock:
         ieee80211_send_addba_resp(sta->sdata->dev, sta->addr, tid,
@@ -1392,18 +1456,16 @@ static void ieee80211_sta_process_addba_resp(struct net_device *dev,
 
         state = &sta->ampdu_mlme.tid_state_tx[tid];
 
-        spin_lock_bh(&sta->ampdu_mlme.ampdu_tx);
+        spin_lock_bh(&sta->lock);
 
         if (!(*state & HT_ADDBA_REQUESTED_MSK)) {
-                spin_unlock_bh(&sta->ampdu_mlme.ampdu_tx);
-                printk(KERN_DEBUG "state not HT_ADDBA_REQUESTED_MSK:"
-                        "%d\n", *state);
+                spin_unlock_bh(&sta->lock);
                 goto addba_resp_exit;
         }
 
         if (mgmt->u.action.u.addba_resp.dialog_token !=
                 sta->ampdu_mlme.tid_tx[tid]->dialog_token) {
-                spin_unlock_bh(&sta->ampdu_mlme.ampdu_tx);
+                spin_unlock_bh(&sta->lock);
 #ifdef CONFIG_MAC80211_HT_DEBUG
                 printk(KERN_DEBUG "wrong addBA response token, tid %d\n", tid);
 #endif /* CONFIG_MAC80211_HT_DEBUG */
@@ -1416,26 +1478,18 @@ static void ieee80211_sta_process_addba_resp(struct net_device *dev,
 #endif /* CONFIG_MAC80211_HT_DEBUG */
         if (le16_to_cpu(mgmt->u.action.u.addba_resp.status)
                         == WLAN_STATUS_SUCCESS) {
-                if (*state & HT_ADDBA_RECEIVED_MSK)
-                        printk(KERN_DEBUG "double addBA response\n");
-
                 *state |= HT_ADDBA_RECEIVED_MSK;
                 sta->ampdu_mlme.addba_req_num[tid] = 0;
 
-                if (*state == HT_AGG_STATE_OPERATIONAL) {
-                        printk(KERN_DEBUG "Aggregation on for tid %d \n", tid);
+                if (*state == HT_AGG_STATE_OPERATIONAL)
                         ieee80211_wake_queue(hw, sta->tid_to_tx_q[tid]);
-                }
 
-                spin_unlock_bh(&sta->ampdu_mlme.ampdu_tx);
-                printk(KERN_DEBUG "recipient accepted agg: tid %d \n", tid);
+                spin_unlock_bh(&sta->lock);
         } else {
-                printk(KERN_DEBUG "recipient rejected agg: tid %d \n", tid);
-
                 sta->ampdu_mlme.addba_req_num[tid]++;
                 /* this will allow the state check in stop_BA_session */
                 *state = HT_AGG_STATE_OPERATIONAL;
-                spin_unlock_bh(&sta->ampdu_mlme.ampdu_tx);
+                spin_unlock_bh(&sta->lock);
                 ieee80211_stop_tx_ba_session(hw, sta->addr, tid,
                                              WLAN_BACK_INITIATOR);
         }
@@ -1454,8 +1508,7 @@ void ieee80211_send_delba(struct net_device *dev, const u8 *da, u16 tid,
         struct ieee80211_mgmt *mgmt;
         u16 params;
 
-        skb = dev_alloc_skb(sizeof(*mgmt) + local->hw.extra_tx_headroom + 1 +
-                                        sizeof(mgmt->u.action.u.delba));
+        skb = dev_alloc_skb(sizeof(*mgmt) + local->hw.extra_tx_headroom);
 
         if (!skb) {
                 printk(KERN_ERR "%s: failed to allocate buffer "
@@ -1488,6 +1541,35 @@ void ieee80211_send_delba(struct net_device *dev, const u8 *da, u16 tid,
         ieee80211_sta_tx(dev, skb, 0);
 }
 
+void ieee80211_send_bar(struct net_device *dev, u8 *ra, u16 tid, u16 ssn)
+{
+        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+        struct sk_buff *skb;
+        struct ieee80211_bar *bar;
+        u16 bar_control = 0;
+
+        skb = dev_alloc_skb(sizeof(*bar) + local->hw.extra_tx_headroom);
+        if (!skb) {
+                printk(KERN_ERR "%s: failed to allocate buffer for "
+                        "bar frame\n", dev->name);
+                return;
+        }
+        skb_reserve(skb, local->hw.extra_tx_headroom);
+        bar = (struct ieee80211_bar *)skb_put(skb, sizeof(*bar));
+        memset(bar, 0, sizeof(*bar));
+        bar->frame_control = IEEE80211_FC(IEEE80211_FTYPE_CTL,
+                                        IEEE80211_STYPE_BACK_REQ);
+        memcpy(bar->ra, ra, ETH_ALEN);
+        memcpy(bar->ta, dev->dev_addr, ETH_ALEN);
+        bar_control |= (u16)IEEE80211_BAR_CTRL_ACK_POLICY_NORMAL;
+        bar_control |= (u16)IEEE80211_BAR_CTRL_CBMTID_COMPRESSED_BA;
+        bar_control |= (u16)(tid << 12);
+        bar->control = cpu_to_le16(bar_control);
+        bar->start_seq_num = cpu_to_le16(ssn);
+
+        ieee80211_sta_tx(dev, skb, 0);
+}
+
 void ieee80211_sta_stop_rx_ba_session(struct net_device *dev, u8 *ra, u16 tid,
                                         u16 initiator, u16 reason)
 {
@@ -1506,17 +1588,17 @@ void ieee80211_sta_stop_rx_ba_session(struct net_device *dev, u8 *ra, u16 tid,
         }
 
         /* check if TID is in operational state */
-        spin_lock_bh(&sta->ampdu_mlme.ampdu_rx);
+        spin_lock_bh(&sta->lock);
         if (sta->ampdu_mlme.tid_state_rx[tid]
                                 != HT_AGG_STATE_OPERATIONAL) {
-                spin_unlock_bh(&sta->ampdu_mlme.ampdu_rx);
+                spin_unlock_bh(&sta->lock);
                 rcu_read_unlock();
                 return;
         }
         sta->ampdu_mlme.tid_state_rx[tid] =
                 HT_AGG_STATE_REQ_STOP_BA_MSK |
                 (initiator << HT_AGG_STATE_INITIATOR_SHIFT);
-        spin_unlock_bh(&sta->ampdu_mlme.ampdu_rx);
+        spin_unlock_bh(&sta->lock);
 
         /* stop HW Rx aggregation. ampdu_action existence
          * already verified in session init so we add the BUG_ON */
@@ -1531,7 +1613,7 @@ void ieee80211_sta_stop_rx_ba_session(struct net_device *dev, u8 *ra, u16 tid,
                                         ra, tid, NULL);
         if (ret)
                 printk(KERN_DEBUG "HW problem - can not stop rx "
-                                "aggergation for tid %d\n", tid);
+                                "aggregation for tid %d\n", tid);
 
         /* shutdown timer has not expired */
         if (initiator != WLAN_BACK_TIMER)
@@ -1593,10 +1675,10 @@ static void ieee80211_sta_process_delba(struct net_device *dev,
                 ieee80211_sta_stop_rx_ba_session(dev, sta->addr, tid,
                                                  WLAN_BACK_INITIATOR, 0);
         else { /* WLAN_BACK_RECIPIENT */
-                spin_lock_bh(&sta->ampdu_mlme.ampdu_tx);
+                spin_lock_bh(&sta->lock);
                 sta->ampdu_mlme.tid_state_tx[tid] =
                                 HT_AGG_STATE_OPERATIONAL;
-                spin_unlock_bh(&sta->ampdu_mlme.ampdu_tx);
+                spin_unlock_bh(&sta->lock);
                 ieee80211_stop_tx_ba_session(&local->hw, sta->addr, tid,
                                              WLAN_BACK_RECIPIENT);
         }
@@ -1633,20 +1715,24 @@ void sta_addba_resp_timer_expired(unsigned long data)
 
         state = &sta->ampdu_mlme.tid_state_tx[tid];
         /* check if the TID waits for addBA response */
-        spin_lock_bh(&sta->ampdu_mlme.ampdu_tx);
+        spin_lock_bh(&sta->lock);
         if (!(*state & HT_ADDBA_REQUESTED_MSK)) {
-                spin_unlock_bh(&sta->ampdu_mlme.ampdu_tx);
+                spin_unlock_bh(&sta->lock);
                 *state = HT_AGG_STATE_IDLE;
+#ifdef CONFIG_MAC80211_HT_DEBUG
                 printk(KERN_DEBUG "timer expired on tid %d but we are not "
                                 "expecting addBA response there", tid);
+#endif
                 goto timer_expired_exit;
         }
 
+#ifdef CONFIG_MAC80211_HT_DEBUG
         printk(KERN_DEBUG "addBA response timer expired on tid %d\n", tid);
+#endif
 
         /* go through the state check in stop_BA_session */
         *state = HT_AGG_STATE_OPERATIONAL;
-        spin_unlock_bh(&sta->ampdu_mlme.ampdu_tx);
+        spin_unlock_bh(&sta->lock);
         ieee80211_stop_tx_ba_session(hw, temp_sta->addr, tid,
                                      WLAN_BACK_INITIATOR);
 
@@ -1659,7 +1745,7 @@ timer_expired_exit:
  * resetting it after each frame that arrives from the originator.
  * if this timer expires ieee80211_sta_stop_rx_ba_session will be executed.
  */
-void sta_rx_agg_session_timer_expired(unsigned long data)
+static void sta_rx_agg_session_timer_expired(unsigned long data)
 {
         /* not an elegant detour, but there is no choice as the timer passes
          * only one argument, and various sta_info are needed here, so init
@@ -1670,7 +1756,9 @@ void sta_rx_agg_session_timer_expired(unsigned long data)
         struct sta_info *sta = container_of(timer_to_id, struct sta_info,
                                          timer_to_tid[0]);
 
+#ifdef CONFIG_MAC80211_HT_DEBUG
         printk(KERN_DEBUG "rx session timer expired on tid %d\n", (u16)*ptid);
+#endif
         ieee80211_sta_stop_rx_ba_session(sta->sdata->dev, sta->addr,
                                          (u16)*ptid, WLAN_BACK_TIMER,
                                          WLAN_REASON_QSTA_TIMEOUT);
@@ -1690,6 +1778,71 @@ void ieee80211_sta_tear_down_BA_sessions(struct net_device *dev, u8 *addr)
         }
 }
 
+static void ieee80211_send_refuse_measurement_request(struct net_device *dev,
+                                        struct ieee80211_msrment_ie *request_ie,
+                                        const u8 *da, const u8 *bssid,
+                                        u8 dialog_token)
+{
+        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+        struct sk_buff *skb;
+        struct ieee80211_mgmt *msr_report;
+
+        skb = dev_alloc_skb(sizeof(*msr_report) + local->hw.extra_tx_headroom +
+                                sizeof(struct ieee80211_msrment_ie));
+
+        if (!skb) {
+                printk(KERN_ERR "%s: failed to allocate buffer for "
+                                "measurement report frame\n", dev->name);
+                return;
+        }
+
+        skb_reserve(skb, local->hw.extra_tx_headroom);
+        msr_report = (struct ieee80211_mgmt *)skb_put(skb, 24);
+        memset(msr_report, 0, 24);
+        memcpy(msr_report->da, da, ETH_ALEN);
+        memcpy(msr_report->sa, dev->dev_addr, ETH_ALEN);
+        memcpy(msr_report->bssid, bssid, ETH_ALEN);
+        msr_report->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
+                                                IEEE80211_STYPE_ACTION);
+
+        skb_put(skb, 1 + sizeof(msr_report->u.action.u.measurement));
+        msr_report->u.action.category = WLAN_CATEGORY_SPECTRUM_MGMT;
+        msr_report->u.action.u.measurement.action_code =
+                                WLAN_ACTION_SPCT_MSR_RPRT;
+        msr_report->u.action.u.measurement.dialog_token = dialog_token;
+
+        msr_report->u.action.u.measurement.element_id = WLAN_EID_MEASURE_REPORT;
+        msr_report->u.action.u.measurement.length =
+                        sizeof(struct ieee80211_msrment_ie);
+
+        memset(&msr_report->u.action.u.measurement.msr_elem, 0,
+                sizeof(struct ieee80211_msrment_ie));
+        msr_report->u.action.u.measurement.msr_elem.token = request_ie->token;
+        msr_report->u.action.u.measurement.msr_elem.mode |=
+                        IEEE80211_SPCT_MSR_RPRT_MODE_REFUSED;
+        msr_report->u.action.u.measurement.msr_elem.type = request_ie->type;
+
+        ieee80211_sta_tx(dev, skb, 0);
+}
+
+static void ieee80211_sta_process_measurement_req(struct net_device *dev,
+                                                struct ieee80211_mgmt *mgmt,
+                                                size_t len)
+{
+        /*
+         * Ignoring measurement request is spec violation.
+         * Mandatory measurements must be reported optional
+         * measurements might be refused or reported incapable
+         * For now just refuse
+         * TODO: Answer basic measurement as unmeasured
+         */
+        ieee80211_send_refuse_measurement_request(dev,
+                        &mgmt->u.action.u.measurement.msr_elem,
+                        mgmt->sa, mgmt->bssid,
+                        mgmt->u.action.u.measurement.dialog_token);
+}
+
+
 static void ieee80211_rx_mgmt_auth(struct net_device *dev,
                                    struct ieee80211_if_sta *ifsta,
                                    struct ieee80211_mgmt *mgmt,
@@ -1700,73 +1853,41 @@ static void ieee80211_rx_mgmt_auth(struct net_device *dev,
         DECLARE_MAC_BUF(mac);
 
         if (ifsta->state != IEEE80211_AUTHENTICATE &&
-            sdata->vif.type != IEEE80211_IF_TYPE_IBSS) {
-                printk(KERN_DEBUG "%s: authentication frame received from "
-                       "%s, but not in authenticate state - ignored\n",
-                       dev->name, print_mac(mac, mgmt->sa));
+            sdata->vif.type != IEEE80211_IF_TYPE_IBSS)
                 return;
-        }
 
-        if (len < 24 + 6) {
-                printk(KERN_DEBUG "%s: too short (%zd) authentication frame "
-                       "received from %s - ignored\n",
-                       dev->name, len, print_mac(mac, mgmt->sa));
+        if (len < 24 + 6)
                 return;
-        }
 
         if (sdata->vif.type != IEEE80211_IF_TYPE_IBSS &&
-            memcmp(ifsta->bssid, mgmt->sa, ETH_ALEN) != 0) {
-                printk(KERN_DEBUG "%s: authentication frame received from "
-                       "unknown AP (SA=%s BSSID=%s) - "
-                       "ignored\n", dev->name, print_mac(mac, mgmt->sa),
-                       print_mac(mac, mgmt->bssid));
+            memcmp(ifsta->bssid, mgmt->sa, ETH_ALEN) != 0)
                 return;
-        }
 
         if (sdata->vif.type != IEEE80211_IF_TYPE_IBSS &&
-            memcmp(ifsta->bssid, mgmt->bssid, ETH_ALEN) != 0) {
-                printk(KERN_DEBUG "%s: authentication frame received from "
-                       "unknown BSSID (SA=%s BSSID=%s) - "
-                       "ignored\n", dev->name, print_mac(mac, mgmt->sa),
-                       print_mac(mac, mgmt->bssid));
+            memcmp(ifsta->bssid, mgmt->bssid, ETH_ALEN) != 0)
                 return;
-        }
 
         auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg);
         auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction);
         status_code = le16_to_cpu(mgmt->u.auth.status_code);
 
-        printk(KERN_DEBUG "%s: RX authentication from %s (alg=%d "
-               "transaction=%d status=%d)\n",
-               dev->name, print_mac(mac, mgmt->sa), auth_alg,
-               auth_transaction, status_code);
-
         if (sdata->vif.type == IEEE80211_IF_TYPE_IBSS) {
-                /* IEEE 802.11 standard does not require authentication in IBSS
+                /*
+                 * IEEE 802.11 standard does not require authentication in IBSS
                  * networks and most implementations do not seem to use it.
                  * However, try to reply to authentication attempts if someone
                  * has actually implemented this.
-                 * TODO: Could implement shared key authentication. */
-                if (auth_alg != WLAN_AUTH_OPEN || auth_transaction != 1) {
-                        printk(KERN_DEBUG "%s: unexpected IBSS authentication "
-                               "frame (alg=%d transaction=%d)\n",
-                               dev->name, auth_alg, auth_transaction);
+                 */
+                if (auth_alg != WLAN_AUTH_OPEN || auth_transaction != 1)
                         return;
-                }
                 ieee80211_send_auth(dev, ifsta, 2, NULL, 0, 0);
         }
 
         if (auth_alg != ifsta->auth_alg ||
-            auth_transaction != ifsta->auth_transaction) {
-                printk(KERN_DEBUG "%s: unexpected authentication frame "
-                       "(alg=%d transaction=%d)\n",
-                       dev->name, auth_alg, auth_transaction);
+            auth_transaction != ifsta->auth_transaction)
                 return;
-        }
 
         if (status_code != WLAN_STATUS_SUCCESS) {
-                printk(KERN_DEBUG "%s: AP denied authentication (auth_alg=%d "
-                       "code=%d)\n", dev->name, ifsta->auth_alg, status_code);
                 if (status_code == WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG) {
                         u8 algs[3];
                         const int num_algs = ARRAY_SIZE(algs);
@@ -1795,9 +1916,6 @@ static void ieee80211_rx_mgmt_auth(struct net_device *dev,
                                     !ieee80211_sta_wep_configured(dev))
                                         continue;
                                 ifsta->auth_alg = algs[pos];
-                                printk(KERN_DEBUG "%s: set auth_alg=%d for "
-                                       "next try\n",
-                                       dev->name, ifsta->auth_alg);
                                 break;
                         }
                 }
@@ -1827,30 +1945,16 @@ static void ieee80211_rx_mgmt_deauth(struct net_device *dev,
         u16 reason_code;
         DECLARE_MAC_BUF(mac);
 
-        if (len < 24 + 2) {
-                printk(KERN_DEBUG "%s: too short (%zd) deauthentication frame "
-                       "received from %s - ignored\n",
-                       dev->name, len, print_mac(mac, mgmt->sa));
+        if (len < 24 + 2)
                 return;
-        }
 
-        if (memcmp(ifsta->bssid, mgmt->sa, ETH_ALEN) != 0) {
-                printk(KERN_DEBUG "%s: deauthentication frame received from "
-                       "unknown AP (SA=%s BSSID=%s) - "
-                       "ignored\n", dev->name, print_mac(mac, mgmt->sa),
-                       print_mac(mac, mgmt->bssid));
+        if (memcmp(ifsta->bssid, mgmt->sa, ETH_ALEN))
                 return;
-        }
 
         reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
 
-        printk(KERN_DEBUG "%s: RX deauthentication from %s"
-               " (reason=%d)\n",
-               dev->name, print_mac(mac, mgmt->sa), reason_code);
-
-        if (ifsta->flags & IEEE80211_STA_AUTHENTICATED) {
+        if (ifsta->flags & IEEE80211_STA_AUTHENTICATED)
                 printk(KERN_DEBUG "%s: deauthenticated\n", dev->name);
-        }
 
         if (ifsta->state == IEEE80211_AUTHENTICATE ||
             ifsta->state == IEEE80211_ASSOCIATE ||
@@ -1873,27 +1977,14 @@ static void ieee80211_rx_mgmt_disassoc(struct net_device *dev,
         u16 reason_code;
         DECLARE_MAC_BUF(mac);
 
-        if (len < 24 + 2) {
-                printk(KERN_DEBUG "%s: too short (%zd) disassociation frame "
-                       "received from %s - ignored\n",
-                       dev->name, len, print_mac(mac, mgmt->sa));
+        if (len < 24 + 2)
                 return;
-        }
 
-        if (memcmp(ifsta->bssid, mgmt->sa, ETH_ALEN) != 0) {
-                printk(KERN_DEBUG "%s: disassociation frame received from "
-                       "unknown AP (SA=%s BSSID=%s) - "
-                       "ignored\n", dev->name, print_mac(mac, mgmt->sa),
-                       print_mac(mac, mgmt->bssid));
+        if (memcmp(ifsta->bssid, mgmt->sa, ETH_ALEN))
                 return;
-        }
 
         reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);
 
-        printk(KERN_DEBUG "%s: RX disassociation from %s"
-               " (reason=%d)\n",
-               dev->name, print_mac(mac, mgmt->sa), reason_code);
-
         if (ifsta->flags & IEEE80211_STA_ASSOCIATED)
                 printk(KERN_DEBUG "%s: disassociated\n", dev->name);
 
@@ -1929,27 +2020,14 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
         /* AssocResp and ReassocResp have identical structure, so process both
          * of them in this function. */
 
-        if (ifsta->state != IEEE80211_ASSOCIATE) {
-                printk(KERN_DEBUG "%s: association frame received from "
-                       "%s, but not in associate state - ignored\n",
-                       dev->name, print_mac(mac, mgmt->sa));
+        if (ifsta->state != IEEE80211_ASSOCIATE)
                 return;
-        }
 
-        if (len < 24 + 6) {
-                printk(KERN_DEBUG "%s: too short (%zd) association frame "
-                       "received from %s - ignored\n",
-                       dev->name, len, print_mac(mac, mgmt->sa));
+        if (len < 24 + 6)
                 return;
-        }
 
-        if (memcmp(ifsta->bssid, mgmt->sa, ETH_ALEN) != 0) {
-                printk(KERN_DEBUG "%s: association frame received from "
-                       "unknown AP (SA=%s BSSID=%s) - "
-                       "ignored\n", dev->name, print_mac(mac, mgmt->sa),
-                       print_mac(mac, mgmt->bssid));
+        if (memcmp(ifsta->bssid, mgmt->sa, ETH_ALEN) != 0)
                 return;
-        }
 
         capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
         status_code = le16_to_cpu(mgmt->u.assoc_resp.status_code);
@@ -2013,10 +2091,10 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
                                            local->hw.conf.channel->center_freq,
                                            ifsta->ssid, ifsta->ssid_len);
                 if (bss) {
-                        sta->last_rssi = bss->rssi;
                         sta->last_signal = bss->signal;
+                        sta->last_qual = bss->qual;
                         sta->last_noise = bss->noise;
-                        ieee80211_rx_bss_put(dev, bss);
+                        ieee80211_rx_bss_put(local, bss);
                 }
 
                 err = sta_info_insert(sta);
@@ -2038,8 +2116,8 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
          *        to between the sta_info_alloc() and sta_info_insert() above.
          */
 
-        sta->flags |= WLAN_STA_AUTH | WLAN_STA_ASSOC | WLAN_STA_ASSOC_AP |
-                      WLAN_STA_AUTHORIZED;
+        set_sta_flags(sta, WLAN_STA_AUTH | WLAN_STA_ASSOC | WLAN_STA_ASSOC_AP |
+                           WLAN_STA_AUTHORIZED);
 
         rates = 0;
         basic_rates = 0;
@@ -2083,7 +2161,8 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
         else
                 sdata->flags &= ~IEEE80211_SDATA_OPERATING_GMODE;
 
-        if (elems.ht_cap_elem && elems.ht_info_elem && elems.wmm_param) {
+        if (elems.ht_cap_elem && elems.ht_info_elem && elems.wmm_param &&
+            (ifsta->flags & IEEE80211_STA_WMM_ENABLED)) {
                 struct ieee80211_ht_bss_info bss_info;
                 ieee80211_ht_cap_ie_to_ht_info(
                                 (struct ieee80211_ht_cap *)
@@ -2096,8 +2175,8 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
 
         rate_control_rate_init(sta, local);
 
-        if (elems.wmm_param && (ifsta->flags & IEEE80211_STA_WMM_ENABLED)) {
-                sta->flags |= WLAN_STA_WME;
+        if (elems.wmm_param) {
+                set_sta_flags(sta, WLAN_STA_WME);
                 rcu_read_unlock();
                 ieee80211_sta_wmm_params(dev, ifsta, elems.wmm_param,
                                          elems.wmm_param_len);
@@ -2133,10 +2212,9 @@ static void __ieee80211_rx_bss_hash_add(struct net_device *dev,
 
 
 /* Caller must hold local->sta_bss_lock */
-static void __ieee80211_rx_bss_hash_del(struct net_device *dev,
+static void __ieee80211_rx_bss_hash_del(struct ieee80211_local *local,
                                         struct ieee80211_sta_bss *bss)
 {
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
         struct ieee80211_sta_bss *b, *prev = NULL;
         b = local->sta_bss_hash[STA_HASH(bss->bssid)];
         while (b) {
@@ -2281,45 +2359,42 @@ static void ieee80211_rx_bss_free(struct ieee80211_sta_bss *bss)
         kfree(bss->rsn_ie);
         kfree(bss->wmm_ie);
         kfree(bss->ht_ie);
+        kfree(bss->ht_add_ie);
         kfree(bss_mesh_id(bss));
         kfree(bss_mesh_cfg(bss));
         kfree(bss);
 }
 
 
-static void ieee80211_rx_bss_put(struct net_device *dev,
+static void ieee80211_rx_bss_put(struct ieee80211_local *local,
                                  struct ieee80211_sta_bss *bss)
 {
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-
         local_bh_disable();
         if (!atomic_dec_and_lock(&bss->users, &local->sta_bss_lock)) {
                 local_bh_enable();
                 return;
         }
 
-        __ieee80211_rx_bss_hash_del(dev, bss);
+        __ieee80211_rx_bss_hash_del(local, bss);
         list_del(&bss->list);
         spin_unlock_bh(&local->sta_bss_lock);
         ieee80211_rx_bss_free(bss);
 }
 
 
-void ieee80211_rx_bss_list_init(struct net_device *dev)
+void ieee80211_rx_bss_list_init(struct ieee80211_local *local)
 {
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
         spin_lock_init(&local->sta_bss_lock);
         INIT_LIST_HEAD(&local->sta_bss_list);
 }
 
 
-void ieee80211_rx_bss_list_deinit(struct net_device *dev)
+void ieee80211_rx_bss_list_deinit(struct ieee80211_local *local)
 {
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
         struct ieee80211_sta_bss *bss, *tmp;
 
         list_for_each_entry_safe(bss, tmp, &local->sta_bss_list, list)
-                ieee80211_rx_bss_put(dev, bss);
+                ieee80211_rx_bss_put(local, bss);
 }
 
 
@@ -2331,8 +2406,6 @@ static int ieee80211_sta_join_ibss(struct net_device *dev,
         int res, rates, i, j;
         struct sk_buff *skb;
         struct ieee80211_mgmt *mgmt;
-        struct ieee80211_tx_control control;
-        struct rate_selection ratesel;
         u8 *pos;
         struct ieee80211_sub_if_data *sdata;
         struct ieee80211_supported_band *sband;
@@ -2350,7 +2423,7 @@ static int ieee80211_sta_join_ibss(struct net_device *dev,
                 local->ops->reset_tsf(local_to_hw(local));
         }
         memcpy(ifsta->bssid, bss->bssid, ETH_ALEN);
-        res = ieee80211_if_config(dev);
+        res = ieee80211_if_config(sdata, IEEE80211_IFCC_BSSID);
         if (res)
                 return res;
 
@@ -2364,24 +2437,22 @@ static int ieee80211_sta_join_ibss(struct net_device *dev,
         if (res)
                 return res;
 
-        /* Set beacon template */
+        /* Build IBSS probe response */
         skb = dev_alloc_skb(local->hw.extra_tx_headroom + 400);
-        do {
-                if (!skb)
-                        break;
-
+        if (skb) {
                 skb_reserve(skb, local->hw.extra_tx_headroom);
 
                 mgmt = (struct ieee80211_mgmt *)
                         skb_put(skb, 24 + sizeof(mgmt->u.beacon));
                 memset(mgmt, 0, 24 + sizeof(mgmt->u.beacon));
                 mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
-                                                   IEEE80211_STYPE_BEACON);
+                                                   IEEE80211_STYPE_PROBE_RESP);
                 memset(mgmt->da, 0xff, ETH_ALEN);
                 memcpy(mgmt->sa, dev->dev_addr, ETH_ALEN);
                 memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
                 mgmt->u.beacon.beacon_int =
                         cpu_to_le16(local->hw.conf.beacon_int);
+                mgmt->u.beacon.timestamp = cpu_to_le64(bss->timestamp);
                 mgmt->u.beacon.capab_info = cpu_to_le16(bss->capability);
 
                 pos = skb_put(skb, 2 + ifsta->ssid_len);
@@ -2419,60 +2490,22 @@ static int ieee80211_sta_join_ibss(struct net_device *dev,
                         memcpy(pos, &bss->supp_rates[8], rates);
                 }
 
-                memset(&control, 0, sizeof(control));
-                rate_control_get_rate(dev, sband, skb, &ratesel);
-                if (!ratesel.rate) {
-                        printk(KERN_DEBUG "%s: Failed to determine TX rate "
-                               "for IBSS beacon\n", dev->name);
-                        break;
-                }
-                control.vif = &sdata->vif;
-                control.tx_rate = ratesel.rate;
-                if (sdata->bss_conf.use_short_preamble &&
-                    ratesel.rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
-                        control.flags |= IEEE80211_TXCTL_SHORT_PREAMBLE;
-                control.antenna_sel_tx = local->hw.conf.antenna_sel_tx;
-                control.flags |= IEEE80211_TXCTL_NO_ACK;
-                control.retry_limit = 1;
-
-                ifsta->probe_resp = skb_copy(skb, GFP_ATOMIC);
-                if (ifsta->probe_resp) {
-                        mgmt = (struct ieee80211_mgmt *)
-                                ifsta->probe_resp->data;
-                        mgmt->frame_control =
-                                IEEE80211_FC(IEEE80211_FTYPE_MGMT,
-                                             IEEE80211_STYPE_PROBE_RESP);
-                } else {
-                        printk(KERN_DEBUG "%s: Could not allocate ProbeResp "
-                               "template for IBSS\n", dev->name);
-                }
-
-                if (local->ops->beacon_update &&
-                    local->ops->beacon_update(local_to_hw(local),
-                                             skb, &control) == 0) {
-                        printk(KERN_DEBUG "%s: Configured IBSS beacon "
-                               "template\n", dev->name);
-                        skb = NULL;
-                }
-
-                rates = 0;
-                sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
-                for (i = 0; i < bss->supp_rates_len; i++) {
-                        int bitrate = (bss->supp_rates[i] & 0x7f) * 5;
-                        for (j = 0; j < sband->n_bitrates; j++)
-                                if (sband->bitrates[j].bitrate == bitrate)
-                                        rates |= BIT(j);
-                }
-                ifsta->supp_rates_bits[local->hw.conf.channel->band] = rates;
+                ifsta->probe_resp = skb;
 
-                ieee80211_sta_def_wmm_params(dev, bss, 1);
-        } while (0);
+                ieee80211_if_config(sdata, IEEE80211_IFCC_BEACON);
+        }
 
-        if (skb) {
-                printk(KERN_DEBUG "%s: Failed to configure IBSS beacon "
-                       "template\n", dev->name);
-                dev_kfree_skb(skb);
+        rates = 0;
+        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
+        for (i = 0; i < bss->supp_rates_len; i++) {
+                int bitrate = (bss->supp_rates[i] & 0x7f) * 5;
+                for (j = 0; j < sband->n_bitrates; j++)
+                        if (sband->bitrates[j].bitrate == bitrate)
+                                rates |= BIT(j);
         }
+        ifsta->supp_rates_bits[local->hw.conf.channel->band] = rates;
+
+        ieee80211_sta_def_wmm_params(dev, bss, 1);
 
         ifsta->state = IEEE80211_IBSS_JOINED;
         mod_timer(&ifsta->timer, jiffies + IEEE80211_IBSS_MERGE_INTERVAL);
@@ -2525,11 +2558,10 @@ static void ieee80211_rx_bss_info(struct net_device *dev,
                                   struct ieee80211_mgmt *mgmt,
                                   size_t len,
                                   struct ieee80211_rx_status *rx_status,
+                                  struct ieee802_11_elems *elems,
                                   int beacon)
 {
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        struct ieee802_11_elems elems;
-        size_t baselen;
         int freq, clen;
         struct ieee80211_sta_bss *bss;
         struct sta_info *sta;
@@ -2542,35 +2574,24 @@ static void ieee80211_rx_bss_info(struct net_device *dev,
         if (!beacon && memcmp(mgmt->da, dev->dev_addr, ETH_ALEN))
                 return; /* ignore ProbeResp to foreign address */
 
-#if 0
-        printk(KERN_DEBUG "%s: RX %s from %s to %s\n",
-               dev->name, beacon ? "Beacon" : "Probe Response",
-               print_mac(mac, mgmt->sa), print_mac(mac2, mgmt->da));
-#endif
-
-        baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
-        if (baselen > len)
-                return;
-
         beacon_timestamp = le64_to_cpu(mgmt->u.beacon.timestamp);
-        ieee802_11_parse_elems(mgmt->u.beacon.variable, len - baselen, &elems);
 
-        if (ieee80211_vif_is_mesh(&sdata->vif) && elems.mesh_id &&
-            elems.mesh_config && mesh_matches_local(&elems, dev)) {
-                u64 rates = ieee80211_sta_get_rates(local, &elems,
+        if (ieee80211_vif_is_mesh(&sdata->vif) && elems->mesh_id &&
+            elems->mesh_config && mesh_matches_local(elems, dev)) {
+                u64 rates = ieee80211_sta_get_rates(local, elems,
                                                 rx_status->band);
 
                 mesh_neighbour_update(mgmt->sa, rates, dev,
-                                      mesh_peer_accepts_plinks(&elems, dev));
+                                      mesh_peer_accepts_plinks(elems, dev));
         }
 
         rcu_read_lock();
 
-        if (sdata->vif.type == IEEE80211_IF_TYPE_IBSS && elems.supp_rates &&
+        if (sdata->vif.type == IEEE80211_IF_TYPE_IBSS && elems->supp_rates &&
             memcmp(mgmt->bssid, sdata->u.sta.bssid, ETH_ALEN) == 0 &&
             (sta = sta_info_get(local, mgmt->sa))) {
                 u64 prev_rates;
-                u64 supp_rates = ieee80211_sta_get_rates(local, &elems,
+                u64 supp_rates = ieee80211_sta_get_rates(local, elems,
                                                         rx_status->band);
 
                 prev_rates = sta->supp_rates[rx_status->band];
@@ -2582,21 +2603,12 @@ static void ieee80211_rx_bss_info(struct net_device *dev,
                         sta->supp_rates[rx_status->band] =
                                 sdata->u.sta.supp_rates_bits[rx_status->band];
                 }
-                if (sta->supp_rates[rx_status->band] != prev_rates) {
-                        printk(KERN_DEBUG "%s: updated supp_rates set for "
-                               "%s based on beacon info (0x%llx & 0x%llx -> "
-                               "0x%llx)\n",
-                               dev->name, print_mac(mac, sta->addr),
-                               (unsigned long long) prev_rates,
-                               (unsigned long long) supp_rates,
-                               (unsigned long long) sta->supp_rates[rx_status->band]);
-                }
         }
 
         rcu_read_unlock();
 
-        if (elems.ds_params && elems.ds_params_len == 1)
-                freq = ieee80211_channel_to_frequency(elems.ds_params[0]);
+        if (elems->ds_params && elems->ds_params_len == 1)
+                freq = ieee80211_channel_to_frequency(elems->ds_params[0]);
         else
                 freq = rx_status->freq;
 
@@ -2606,23 +2618,23 @@ static void ieee80211_rx_bss_info(struct net_device *dev,
                 return;
 
 #ifdef CONFIG_MAC80211_MESH
-        if (elems.mesh_config)
-                bss = ieee80211_rx_mesh_bss_get(dev, elems.mesh_id,
-                                elems.mesh_id_len, elems.mesh_config, freq);
+        if (elems->mesh_config)
+                bss = ieee80211_rx_mesh_bss_get(dev, elems->mesh_id,
+                                elems->mesh_id_len, elems->mesh_config, freq);
         else
 #endif
                 bss = ieee80211_rx_bss_get(dev, mgmt->bssid, freq,
-                                           elems.ssid, elems.ssid_len);
+                                           elems->ssid, elems->ssid_len);
         if (!bss) {
 #ifdef CONFIG_MAC80211_MESH
-                if (elems.mesh_config)
-                        bss = ieee80211_rx_mesh_bss_add(dev, elems.mesh_id,
-                                elems.mesh_id_len, elems.mesh_config,
-                                elems.mesh_config_len, freq);
+                if (elems->mesh_config)
+                        bss = ieee80211_rx_mesh_bss_add(dev, elems->mesh_id,
+                                elems->mesh_id_len, elems->mesh_config,
+                                elems->mesh_config_len, freq);
                 else
 #endif
                         bss = ieee80211_rx_bss_add(dev, mgmt->bssid, freq,
-                                                   elems.ssid, elems.ssid_len);
+                                                  elems->ssid, elems->ssid_len);
                 if (!bss)
                         return;
         } else {
@@ -2635,46 +2647,66 @@ static void ieee80211_rx_bss_info(struct net_device *dev,
         }
 
         /* save the ERP value so that it is available at association time */
-        if (elems.erp_info && elems.erp_info_len >= 1) {
-                bss->erp_value = elems.erp_info[0];
+        if (elems->erp_info && elems->erp_info_len >= 1) {
+                bss->erp_value = elems->erp_info[0];
                 bss->has_erp_value = 1;
         }
 
-        if (elems.ht_cap_elem &&
-             (!bss->ht_ie || bss->ht_ie_len != elems.ht_cap_elem_len ||
-             memcmp(bss->ht_ie, elems.ht_cap_elem, elems.ht_cap_elem_len))) {
+        if (elems->ht_cap_elem &&
+             (!bss->ht_ie || bss->ht_ie_len != elems->ht_cap_elem_len ||
+             memcmp(bss->ht_ie, elems->ht_cap_elem, elems->ht_cap_elem_len))) {
                 kfree(bss->ht_ie);
-                bss->ht_ie = kmalloc(elems.ht_cap_elem_len + 2, GFP_ATOMIC);
+                bss->ht_ie = kmalloc(elems->ht_cap_elem_len + 2, GFP_ATOMIC);
                 if (bss->ht_ie) {
-                        memcpy(bss->ht_ie, elems.ht_cap_elem - 2,
-                                elems.ht_cap_elem_len + 2);
-                        bss->ht_ie_len = elems.ht_cap_elem_len + 2;
+                        memcpy(bss->ht_ie, elems->ht_cap_elem - 2,
+                                elems->ht_cap_elem_len + 2);
+                        bss->ht_ie_len = elems->ht_cap_elem_len + 2;
                 } else
                         bss->ht_ie_len = 0;
-        } else if (!elems.ht_cap_elem && bss->ht_ie) {
+        } else if (!elems->ht_cap_elem && bss->ht_ie) {
                 kfree(bss->ht_ie);
                 bss->ht_ie = NULL;
                 bss->ht_ie_len = 0;
         }
 
+        if (elems->ht_info_elem &&
+             (!bss->ht_add_ie ||
+             bss->ht_add_ie_len != elems->ht_info_elem_len ||
+             memcmp(bss->ht_add_ie, elems->ht_info_elem,
+                        elems->ht_info_elem_len))) {
+                kfree(bss->ht_add_ie);
+                bss->ht_add_ie =
+                        kmalloc(elems->ht_info_elem_len + 2, GFP_ATOMIC);
+                if (bss->ht_add_ie) {
+                        memcpy(bss->ht_add_ie, elems->ht_info_elem - 2,
+                                elems->ht_info_elem_len + 2);
+                        bss->ht_add_ie_len = elems->ht_info_elem_len + 2;
+                } else
+                        bss->ht_add_ie_len = 0;
+        } else if (!elems->ht_info_elem && bss->ht_add_ie) {
+                kfree(bss->ht_add_ie);
+                bss->ht_add_ie = NULL;
+                bss->ht_add_ie_len = 0;
+        }
+
         bss->beacon_int = le16_to_cpu(mgmt->u.beacon.beacon_int);
         bss->capability = le16_to_cpu(mgmt->u.beacon.capab_info);
 
         bss->supp_rates_len = 0;
-        if (elems.supp_rates) {
+        if (elems->supp_rates) {
                 clen = IEEE80211_MAX_SUPP_RATES - bss->supp_rates_len;
-                if (clen > elems.supp_rates_len)
-                        clen = elems.supp_rates_len;
-                memcpy(&bss->supp_rates[bss->supp_rates_len], elems.supp_rates,
+                if (clen > elems->supp_rates_len)
+                        clen = elems->supp_rates_len;
+                memcpy(&bss->supp_rates[bss->supp_rates_len], elems->supp_rates,
                        clen);
                 bss->supp_rates_len += clen;
         }
-        if (elems.ext_supp_rates) {
+        if (elems->ext_supp_rates) {
                 clen = IEEE80211_MAX_SUPP_RATES - bss->supp_rates_len;
-                if (clen > elems.ext_supp_rates_len)
-                        clen = elems.ext_supp_rates_len;
+                if (clen > elems->ext_supp_rates_len)
+                        clen = elems->ext_supp_rates_len;
                 memcpy(&bss->supp_rates[bss->supp_rates_len],
-                       elems.ext_supp_rates, clen);
+                       elems->ext_supp_rates, clen);
                 bss->supp_rates_len += clen;
         }
 
@@ -2682,9 +2714,9 @@ static void ieee80211_rx_bss_info(struct net_device *dev,
 
         bss->timestamp = beacon_timestamp;
         bss->last_update = jiffies;
-        bss->rssi = rx_status->ssi;
         bss->signal = rx_status->signal;
         bss->noise = rx_status->noise;
+        bss->qual = rx_status->qual;
         if (!beacon && !bss->probe_resp)
                 bss->probe_resp = true;
 
@@ -2694,37 +2726,37 @@ static void ieee80211_rx_bss_info(struct net_device *dev,
          */
         if (sdata->vif.type != IEEE80211_IF_TYPE_IBSS &&
             bss->probe_resp && beacon) {
-                ieee80211_rx_bss_put(dev, bss);
+                ieee80211_rx_bss_put(local, bss);
                 return;
         }
 
-        if (elems.wpa &&
-            (!bss->wpa_ie || bss->wpa_ie_len != elems.wpa_len ||
-             memcmp(bss->wpa_ie, elems.wpa, elems.wpa_len))) {
+        if (elems->wpa &&
+            (!bss->wpa_ie || bss->wpa_ie_len != elems->wpa_len ||
+             memcmp(bss->wpa_ie, elems->wpa, elems->wpa_len))) {
                 kfree(bss->wpa_ie);
-                bss->wpa_ie = kmalloc(elems.wpa_len + 2, GFP_ATOMIC);
+                bss->wpa_ie = kmalloc(elems->wpa_len + 2, GFP_ATOMIC);
                 if (bss->wpa_ie) {
-                        memcpy(bss->wpa_ie, elems.wpa - 2, elems.wpa_len + 2);
-                        bss->wpa_ie_len = elems.wpa_len + 2;
+                        memcpy(bss->wpa_ie, elems->wpa - 2, elems->wpa_len + 2);
+                        bss->wpa_ie_len = elems->wpa_len + 2;
                 } else
                         bss->wpa_ie_len = 0;
-        } else if (!elems.wpa && bss->wpa_ie) {
+        } else if (!elems->wpa && bss->wpa_ie) {
                 kfree(bss->wpa_ie);
                 bss->wpa_ie = NULL;
                 bss->wpa_ie_len = 0;
         }
 
-        if (elems.rsn &&
-            (!bss->rsn_ie || bss->rsn_ie_len != elems.rsn_len ||
-             memcmp(bss->rsn_ie, elems.rsn, elems.rsn_len))) {
+        if (elems->rsn &&
+            (!bss->rsn_ie || bss->rsn_ie_len != elems->rsn_len ||
+             memcmp(bss->rsn_ie, elems->rsn, elems->rsn_len))) {
                 kfree(bss->rsn_ie);
-                bss->rsn_ie = kmalloc(elems.rsn_len + 2, GFP_ATOMIC);
+                bss->rsn_ie = kmalloc(elems->rsn_len + 2, GFP_ATOMIC);
                 if (bss->rsn_ie) {
-                        memcpy(bss->rsn_ie, elems.rsn - 2, elems.rsn_len + 2);
-                        bss->rsn_ie_len = elems.rsn_len + 2;
+                        memcpy(bss->rsn_ie, elems->rsn - 2, elems->rsn_len + 2);
+                        bss->rsn_ie_len = elems->rsn_len + 2;
                 } else
                         bss->rsn_ie_len = 0;
-        } else if (!elems.rsn && bss->rsn_ie) {
+        } else if (!elems->rsn && bss->rsn_ie) {
                 kfree(bss->rsn_ie);
                 bss->rsn_ie = NULL;
                 bss->rsn_ie_len = 0;
@@ -2744,20 +2776,21 @@ static void ieee80211_rx_bss_info(struct net_device *dev,
          * inclusion of the WMM Parameters in beacons, however, is optional.
          */
 
-        if (elems.wmm_param &&
-            (!bss->wmm_ie || bss->wmm_ie_len != elems.wmm_param_len ||
-             memcmp(bss->wmm_ie, elems.wmm_param, elems.wmm_param_len))) {
+        if (elems->wmm_param &&
+            (!bss->wmm_ie || bss->wmm_ie_len != elems->wmm_param_len ||
+             memcmp(bss->wmm_ie, elems->wmm_param, elems->wmm_param_len))) {
                 kfree(bss->wmm_ie);
-                bss->wmm_ie = kmalloc(elems.wmm_param_len + 2, GFP_ATOMIC);
+                bss->wmm_ie = kmalloc(elems->wmm_param_len + 2, GFP_ATOMIC);
                 if (bss->wmm_ie) {
-                        memcpy(bss->wmm_ie, elems.wmm_param - 2,
-                               elems.wmm_param_len + 2);
-                        bss->wmm_ie_len = elems.wmm_param_len + 2;
+                        memcpy(bss->wmm_ie, elems->wmm_param - 2,
+                               elems->wmm_param_len + 2);
+                        bss->wmm_ie_len = elems->wmm_param_len + 2;
                 } else
                         bss->wmm_ie_len = 0;
-        } else if (elems.wmm_info &&
-                    (!bss->wmm_ie || bss->wmm_ie_len != elems.wmm_info_len ||
-                     memcmp(bss->wmm_ie, elems.wmm_info, elems.wmm_info_len))) {
+        } else if (elems->wmm_info &&
+                    (!bss->wmm_ie || bss->wmm_ie_len != elems->wmm_info_len ||
+                     memcmp(bss->wmm_ie, elems->wmm_info,
+                                                elems->wmm_info_len))) {
                  /* As for certain AP's Fifth bit is not set in WMM IE in
                   * beacon frames.So while parsing the beacon frame the
                   * wmm_info structure is used instead of wmm_param.
@@ -2767,14 +2800,14 @@ static void ieee80211_rx_bss_info(struct net_device *dev,
                   * n-band association.
                   */
                 kfree(bss->wmm_ie);
-                bss->wmm_ie = kmalloc(elems.wmm_info_len + 2, GFP_ATOMIC);
+                bss->wmm_ie = kmalloc(elems->wmm_info_len + 2, GFP_ATOMIC);
                 if (bss->wmm_ie) {
-                        memcpy(bss->wmm_ie, elems.wmm_info - 2,
-                               elems.wmm_info_len + 2);
-                        bss->wmm_ie_len = elems.wmm_info_len + 2;
+                        memcpy(bss->wmm_ie, elems->wmm_info - 2,
+                               elems->wmm_info_len + 2);
+                        bss->wmm_ie_len = elems->wmm_info_len + 2;
                 } else
                         bss->wmm_ie_len = 0;
-        } else if (!elems.wmm_param && !elems.wmm_info && bss->wmm_ie) {
+        } else if (!elems->wmm_param && !elems->wmm_info && bss->wmm_ie) {
                 kfree(bss->wmm_ie);
                 bss->wmm_ie = NULL;
                 bss->wmm_ie_len = 0;
@@ -2785,8 +2818,9 @@ static void ieee80211_rx_bss_info(struct net_device *dev,
             !local->sta_sw_scanning && !local->sta_hw_scanning &&
             bss->capability & WLAN_CAPABILITY_IBSS &&
             bss->freq == local->oper_channel->center_freq &&
-            elems.ssid_len == sdata->u.sta.ssid_len &&
-            memcmp(elems.ssid, sdata->u.sta.ssid, sdata->u.sta.ssid_len) == 0) {
+            elems->ssid_len == sdata->u.sta.ssid_len &&
+            memcmp(elems->ssid, sdata->u.sta.ssid,
+                                sdata->u.sta.ssid_len) == 0) {
                 if (rx_status->flag & RX_FLAG_TSFT) {
                         /* in order for correct IBSS merging we need mactime
                          *
@@ -2824,18 +2858,18 @@ static void ieee80211_rx_bss_info(struct net_device *dev,
 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
                 if (beacon_timestamp > rx_timestamp) {
 #ifndef CONFIG_MAC80211_IBSS_DEBUG
-                        if (net_ratelimit())
+                        printk(KERN_DEBUG "%s: beacon TSF higher than "
+                               "local TSF - IBSS merge with BSSID %s\n",
+                               dev->name, print_mac(mac, mgmt->bssid));
 #endif
-                                printk(KERN_DEBUG "%s: beacon TSF higher than "
-                                       "local TSF - IBSS merge with BSSID %s\n",
-                                       dev->name, print_mac(mac, mgmt->bssid));
                         ieee80211_sta_join_ibss(dev, &sdata->u.sta, bss);
                         ieee80211_ibss_add_sta(dev, NULL,
-                                               mgmt->bssid, mgmt->sa);
+                                               mgmt->bssid, mgmt->sa,
+                                               BIT(rx_status->rate_idx));
                 }
         }
 
-        ieee80211_rx_bss_put(dev, bss);
+        ieee80211_rx_bss_put(local, bss);
 }
 
 
@@ -2844,7 +2878,17 @@ static void ieee80211_rx_mgmt_probe_resp(struct net_device *dev,
                                          size_t len,
                                          struct ieee80211_rx_status *rx_status)
 {
-        ieee80211_rx_bss_info(dev, mgmt, len, rx_status, 0);
+        size_t baselen;
+        struct ieee802_11_elems elems;
+
+        baselen = (u8 *) mgmt->u.probe_resp.variable - (u8 *) mgmt;
+        if (baselen > len)
+                return;
+
+        ieee802_11_parse_elems(mgmt->u.probe_resp.variable, len - baselen,
+                                &elems);
+
+        ieee80211_rx_bss_info(dev, mgmt, len, rx_status, &elems, 0);
 }
 
 
@@ -2861,7 +2905,14 @@ static void ieee80211_rx_mgmt_beacon(struct net_device *dev,
         struct ieee80211_conf *conf = &local->hw.conf;
         u32 changed = 0;
 
-        ieee80211_rx_bss_info(dev, mgmt, len, rx_status, 1);
+        /* Process beacon from the current BSS */
+        baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
+        if (baselen > len)
+                return;
+
+        ieee802_11_parse_elems(mgmt->u.beacon.variable, len - baselen, &elems);
+
+        ieee80211_rx_bss_info(dev, mgmt, len, rx_status, &elems, 1);
 
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         if (sdata->vif.type != IEEE80211_IF_TYPE_STA)
@@ -2872,17 +2923,8 @@ static void ieee80211_rx_mgmt_beacon(struct net_device *dev,
             memcmp(ifsta->bssid, mgmt->bssid, ETH_ALEN) != 0)
                 return;
 
-        /* Process beacon from the current BSS */
-        baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
-        if (baselen > len)
-                return;
-
-        ieee802_11_parse_elems(mgmt->u.beacon.variable, len - baselen, &elems);
-
-        if (elems.wmm_param && (ifsta->flags & IEEE80211_STA_WMM_ENABLED)) {
-                ieee80211_sta_wmm_params(dev, ifsta, elems.wmm_param,
-                                         elems.wmm_param_len);
-        }
+        ieee80211_sta_wmm_params(dev, ifsta, elems.wmm_param,
+                                 elems.wmm_param_len);
 
         /* Do not send changes to driver if we are scanning. This removes
          * requirement that driver's bss_info_changed function needs to be
@@ -2959,11 +3001,11 @@ static void ieee80211_rx_mgmt_probe_req(struct net_device *dev,
         pos = mgmt->u.probe_req.variable;
         if (pos[0] != WLAN_EID_SSID ||
             pos + 2 + pos[1] > end) {
-                if (net_ratelimit()) {
-                        printk(KERN_DEBUG "%s: Invalid SSID IE in ProbeReq "
-                               "from %s\n",
-                               dev->name, print_mac(mac, mgmt->sa));
-                }
+#ifdef CONFIG_MAC80211_IBSS_DEBUG
+                printk(KERN_DEBUG "%s: Invalid SSID IE in ProbeReq "
+                       "from %s\n",
+                       dev->name, print_mac(mac, mgmt->sa));
+#endif
                 return;
         }
         if (pos[1] != 0 &&
@@ -2994,11 +3036,24 @@ static void ieee80211_rx_mgmt_action(struct net_device *dev,
                                      struct ieee80211_rx_status *rx_status)
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
 
         if (len < IEEE80211_MIN_ACTION_SIZE)
                 return;
 
         switch (mgmt->u.action.category) {
+        case WLAN_CATEGORY_SPECTRUM_MGMT:
+                if (local->hw.conf.channel->band != IEEE80211_BAND_5GHZ)
+                        break;
+                switch (mgmt->u.action.u.chan_switch.action_code) {
+                case WLAN_ACTION_SPCT_MSR_REQ:
+                        if (len < (IEEE80211_MIN_ACTION_SIZE +
+                                   sizeof(mgmt->u.action.u.measurement)))
+                                break;
+                        ieee80211_sta_process_measurement_req(dev, mgmt, len);
+                        break;
+                }
+                break;
         case WLAN_CATEGORY_BACK:
                 switch (mgmt->u.action.u.addba_req.action_code) {
                 case WLAN_ACTION_ADDBA_REQ:
@@ -3019,11 +3074,6 @@ static void ieee80211_rx_mgmt_action(struct net_device *dev,
                                 break;
                         ieee80211_sta_process_delba(dev, mgmt, len);
                         break;
-                default:
-                        if (net_ratelimit())
-                           printk(KERN_DEBUG "%s: Rx unknown A-MPDU action\n",
-                                        dev->name);
-                        break;
                 }
                 break;
         case PLINK_CATEGORY:
@@ -3034,11 +3084,6 @@ static void ieee80211_rx_mgmt_action(struct net_device *dev,
                 if (ieee80211_vif_is_mesh(&sdata->vif))
                         mesh_rx_path_sel_frame(dev, mgmt, len);
                 break;
-        default:
-                if (net_ratelimit())
-                        printk(KERN_DEBUG "%s: Rx unknown action frame - "
-                        "category=%d\n", dev->name, mgmt->u.action.category);
-                break;
         }
 }
 
@@ -3074,11 +3119,6 @@ void ieee80211_sta_rx_mgmt(struct net_device *dev, struct sk_buff *skb,
                 skb_queue_tail(&ifsta->skb_queue, skb);
                 queue_work(local->hw.workqueue, &ifsta->work);
                 return;
-        default:
-                printk(KERN_DEBUG "%s: received unknown management frame - "
-                       "stype=%d\n", dev->name,
-                       (fc & IEEE80211_FCTL_STYPE) >> 4);
-                break;
         }
 
  fail:
@@ -3142,33 +3182,32 @@ ieee80211_sta_rx_scan(struct net_device *dev, struct sk_buff *skb,
                       struct ieee80211_rx_status *rx_status)
 {
         struct ieee80211_mgmt *mgmt;
-        u16 fc;
+        __le16 fc;
 
         if (skb->len < 2)
                 return RX_DROP_UNUSABLE;
 
         mgmt = (struct ieee80211_mgmt *) skb->data;
-        fc = le16_to_cpu(mgmt->frame_control);
+        fc = mgmt->frame_control;
 
-        if ((fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_CTL)
+        if (ieee80211_is_ctl(fc))
                 return RX_CONTINUE;
 
         if (skb->len < 24)
                 return RX_DROP_MONITOR;
 
-        if ((fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_MGMT) {
-                if ((fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_PROBE_RESP) {
-                        ieee80211_rx_mgmt_probe_resp(dev, mgmt,
-                                                     skb->len, rx_status);
-                        dev_kfree_skb(skb);
-                        return RX_QUEUED;
-                } else if ((fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_BEACON) {
-                        ieee80211_rx_mgmt_beacon(dev, mgmt, skb->len,
-                                                 rx_status);
-                        dev_kfree_skb(skb);
-                        return RX_QUEUED;
-                }
+        if (ieee80211_is_probe_resp(fc)) {
+                ieee80211_rx_mgmt_probe_resp(dev, mgmt, skb->len, rx_status);
+                dev_kfree_skb(skb);
+                return RX_QUEUED;
+        }
+
+        if (ieee80211_is_beacon(fc)) {
+                ieee80211_rx_mgmt_beacon(dev, mgmt, skb->len, rx_status);
+                dev_kfree_skb(skb);
+                return RX_QUEUED;
         }
+
         return RX_CONTINUE;
 }
 
@@ -3208,8 +3247,10 @@ static void ieee80211_sta_expire(struct net_device *dev, unsigned long exp_time)
         spin_lock_irqsave(&local->sta_lock, flags);
         list_for_each_entry_safe(sta, tmp, &local->sta_list, list)
                 if (time_after(jiffies, sta->last_rx + exp_time)) {
+#ifdef CONFIG_MAC80211_IBSS_DEBUG
                         printk(KERN_DEBUG "%s: expiring inactive STA %s\n",
                                dev->name, print_mac(mac, sta->addr));
+#endif
                         __sta_info_unlink(&sta);
                         if (sta)
                                 list_add(&sta->list, &tmp_list);
@@ -3248,7 +3289,7 @@ static void ieee80211_mesh_housekeeping(struct net_device *dev,
 
         free_plinks = mesh_plink_availables(sdata);
         if (free_plinks != sdata->u.sta.accepting_plinks)
-                ieee80211_if_config_beacon(dev);
+                ieee80211_if_config(sdata, IEEE80211_IFCC_BEACON);
 
         mod_timer(&ifsta->timer, jiffies +
                         IEEE80211_MESH_HOUSEKEEPING_INTERVAL);
@@ -3292,13 +3333,10 @@ void ieee80211_sta_work(struct work_struct *work)
         if (local->sta_sw_scanning || local->sta_hw_scanning)
                 return;
 
-        if (sdata->vif.type != IEEE80211_IF_TYPE_STA &&
-            sdata->vif.type != IEEE80211_IF_TYPE_IBSS &&
-            sdata->vif.type != IEEE80211_IF_TYPE_MESH_POINT) {
-                printk(KERN_DEBUG "%s: ieee80211_sta_work: non-STA interface "
-                       "(type=%d)\n", dev->name, sdata->vif.type);
+        if (WARN_ON(sdata->vif.type != IEEE80211_IF_TYPE_STA &&
+                    sdata->vif.type != IEEE80211_IF_TYPE_IBSS &&
+                    sdata->vif.type != IEEE80211_IF_TYPE_MESH_POINT))
                 return;
-        }
         ifsta = &sdata->u.sta;
 
         while ((skb = skb_dequeue(&ifsta->skb_queue)))
@@ -3352,8 +3390,7 @@ void ieee80211_sta_work(struct work_struct *work)
                 break;
 #endif
         default:
-                printk(KERN_DEBUG "ieee80211_sta_work: Unknown state %d\n",
-                       ifsta->state);
+                WARN_ON(1);
                 break;
         }
 
@@ -3388,8 +3425,6 @@ static void ieee80211_sta_reset_auth(struct net_device *dev,
                 ifsta->auth_alg = WLAN_AUTH_LEAP;
         else
                 ifsta->auth_alg = WLAN_AUTH_OPEN;
-        printk(KERN_DEBUG "%s: Initial auth_alg=%d\n", dev->name,
-               ifsta->auth_alg);
         ifsta->auth_transaction = -1;
         ifsta->flags &= ~IEEE80211_STA_ASSOCIATED;
         ifsta->auth_tries = ifsta->assoc_tries = 0;
@@ -3478,9 +3513,9 @@ static int ieee80211_sta_config_auth(struct net_device *dev,
                     !ieee80211_sta_match_ssid(ifsta, bss->ssid, bss->ssid_len))
                         continue;
 
-                if (!selected || top_rssi < bss->rssi) {
+                if (!selected || top_rssi < bss->signal) {
                         selected = bss;
-                        top_rssi = bss->rssi;
+                        top_rssi = bss->signal;
                 }
         }
         if (selected)
@@ -3494,7 +3529,7 @@ static int ieee80211_sta_config_auth(struct net_device *dev,
                                                selected->ssid_len);
                 ieee80211_sta_set_bssid(dev, selected->bssid);
                 ieee80211_sta_def_wmm_params(dev, selected, 0);
-                ieee80211_rx_bss_put(dev, selected);
+                ieee80211_rx_bss_put(local, selected);
                 ifsta->state = IEEE80211_AUTHENTICATE;
                 ieee80211_sta_reset_auth(dev, ifsta);
                 return 0;
@@ -3553,14 +3588,16 @@ static int ieee80211_sta_create_ibss(struct net_device *dev,
         sband = local->hw.wiphy->bands[bss->band];
 
         if (local->hw.conf.beacon_int == 0)
-                local->hw.conf.beacon_int = 10000;
+                local->hw.conf.beacon_int = 100;
         bss->beacon_int = local->hw.conf.beacon_int;
         bss->last_update = jiffies;
         bss->capability = WLAN_CAPABILITY_IBSS;
-        if (sdata->default_key) {
+
+        if (sdata->default_key)
                 bss->capability |= WLAN_CAPABILITY_PRIVACY;
-        } else
+        else
                 sdata->drop_unencrypted = 0;
+
         bss->supp_rates_len = sband->n_bitrates;
         pos = bss->supp_rates;
         for (i = 0; i < sband->n_bitrates; i++) {
@@ -3569,7 +3606,7 @@ static int ieee80211_sta_create_ibss(struct net_device *dev,
         }
 
         ret = ieee80211_sta_join_ibss(dev, ifsta, bss);
-        ieee80211_rx_bss_put(dev, bss);
+        ieee80211_rx_bss_put(local, bss);
         return ret;
 }
 
@@ -3611,8 +3648,10 @@ static int ieee80211_sta_find_ibss(struct net_device *dev,
         spin_unlock_bh(&local->sta_bss_lock);
 
 #ifdef CONFIG_MAC80211_IBSS_DEBUG
-        printk(KERN_DEBUG "   sta_find_ibss: selected %s current "
-               "%s\n", print_mac(mac, bssid), print_mac(mac2, ifsta->bssid));
+        if (found)
+                printk(KERN_DEBUG "   sta_find_ibss: selected %s current "
+                       "%s\n", print_mac(mac, bssid),
+                       print_mac(mac2, ifsta->bssid));
 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
         if (found && memcmp(ifsta->bssid, bssid, ETH_ALEN) != 0 &&
             (bss = ieee80211_rx_bss_get(dev, bssid,
@@ -3623,7 +3662,7 @@ static int ieee80211_sta_find_ibss(struct net_device *dev,
                        " based on configured SSID\n",
                        dev->name, print_mac(mac, bssid));
                 ret = ieee80211_sta_join_ibss(dev, ifsta, bss);
-                ieee80211_rx_bss_put(dev, bss);
+                ieee80211_rx_bss_put(local, bss);
                 return ret;
         }
 #ifdef CONFIG_MAC80211_IBSS_DEBUG
@@ -3674,28 +3713,45 @@ int ieee80211_sta_set_ssid(struct net_device *dev, char *ssid, size_t len)
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         struct ieee80211_if_sta *ifsta;
+        int res;
 
         if (len > IEEE80211_MAX_SSID_LEN)
                 return -EINVAL;
 
         ifsta = &sdata->u.sta;
 
-        if (ifsta->ssid_len != len || memcmp(ifsta->ssid, ssid, len) != 0)
+        if (ifsta->ssid_len != len || memcmp(ifsta->ssid, ssid, len) != 0) {
+                memset(ifsta->ssid, 0, sizeof(ifsta->ssid));
+                memcpy(ifsta->ssid, ssid, len);
+                ifsta->ssid_len = len;
                 ifsta->flags &= ~IEEE80211_STA_PREV_BSSID_SET;
-        memcpy(ifsta->ssid, ssid, len);
-        memset(ifsta->ssid + len, 0, IEEE80211_MAX_SSID_LEN - len);
-        ifsta->ssid_len = len;
+
+                res = 0;
+                /*
+                 * Hack! MLME code needs to be cleaned up to have different
+                 * entry points for configuration and internal selection change
+                 */
+                if (netif_running(sdata->dev))
+                        res = ieee80211_if_config(sdata, IEEE80211_IFCC_SSID);
+                if (res) {
+                        printk(KERN_DEBUG "%s: Failed to config new SSID to "
+                               "the low-level driver\n", dev->name);
+                        return res;
+                }
+        }
 
         if (len)
                 ifsta->flags |= IEEE80211_STA_SSID_SET;
         else
                 ifsta->flags &= ~IEEE80211_STA_SSID_SET;
+
         if (sdata->vif.type == IEEE80211_IF_TYPE_IBSS &&
             !(ifsta->flags & IEEE80211_STA_BSSID_SET)) {
                 ifsta->ibss_join_req = jiffies;
                 ifsta->state = IEEE80211_IBSS_SEARCH;
                 return ieee80211_sta_find_ibss(dev, ifsta);
         }
+
         return 0;
 }
 
@@ -3721,7 +3777,12 @@ int ieee80211_sta_set_bssid(struct net_device *dev, u8 *bssid)
 
         if (memcmp(ifsta->bssid, bssid, ETH_ALEN) != 0) {
                 memcpy(ifsta->bssid, bssid, ETH_ALEN);
-                res = ieee80211_if_config(dev);
+                res = 0;
+                /*
+                 * Hack! See also ieee80211_sta_set_ssid.
+                 */
+                if (netif_running(sdata->dev))
+                        res = ieee80211_if_config(sdata, IEEE80211_IFCC_BSSID);
                 if (res) {
                         printk(KERN_DEBUG "%s: Failed to config new BSSID to "
                                "the low-level driver\n", dev->name);
@@ -3744,7 +3805,7 @@ static void ieee80211_send_nullfunc(struct ieee80211_local *local,
 {
         struct sk_buff *skb;
         struct ieee80211_hdr *nullfunc;
-        u16 fc;
+        __le16 fc;
 
         skb = dev_alloc_skb(local->hw.extra_tx_headroom + 24);
         if (!skb) {
@@ -3756,11 +3817,11 @@ static void ieee80211_send_nullfunc(struct ieee80211_local *local,
 
         nullfunc = (struct ieee80211_hdr *) skb_put(skb, 24);
         memset(nullfunc, 0, 24);
-        fc = IEEE80211_FTYPE_DATA | IEEE80211_STYPE_NULLFUNC |
-             IEEE80211_FCTL_TODS;
+        fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_NULLFUNC |
+                         IEEE80211_FCTL_TODS);
         if (powersave)
-                fc |= IEEE80211_FCTL_PM;
-        nullfunc->frame_control = cpu_to_le16(fc);
+                fc |= cpu_to_le16(IEEE80211_FCTL_PM);
+        nullfunc->frame_control = fc;
         memcpy(nullfunc->addr1, sdata->u.sta.bssid, ETH_ALEN);
         memcpy(nullfunc->addr2, sdata->dev->dev_addr, ETH_ALEN);
         memcpy(nullfunc->addr3, sdata->u.sta.bssid, ETH_ALEN);
@@ -3808,6 +3869,7 @@ void ieee80211_scan_completed(struct ieee80211_hw *hw)
 
 
         netif_tx_lock_bh(local->mdev);
+        netif_addr_lock(local->mdev);
         local->filter_flags &= ~FIF_BCN_PRBRESP_PROMISC;
         local->ops->configure_filter(local_to_hw(local),
                                      FIF_BCN_PRBRESP_PROMISC,
@@ -3815,15 +3877,11 @@ void ieee80211_scan_completed(struct ieee80211_hw *hw)
                                      local->mdev->mc_count,
                                      local->mdev->mc_list);
 
+        netif_addr_unlock(local->mdev);
         netif_tx_unlock_bh(local->mdev);
 
         rcu_read_lock();
         list_for_each_entry_rcu(sdata, &local->interfaces, list) {
-
-                /* No need to wake the master device. */
-                if (sdata->dev == local->mdev)
-                        continue;
-
                 /* Tell AP we're back */
                 if (sdata->vif.type == IEEE80211_IF_TYPE_STA &&
                     sdata->u.sta.flags & IEEE80211_STA_ASSOCIATED)
@@ -3989,12 +4047,6 @@ static int ieee80211_sta_start_scan(struct net_device *dev,
 
         rcu_read_lock();
         list_for_each_entry_rcu(sdata, &local->interfaces, list) {
-
-                /* Don't stop the master interface, otherwise we can't transmit
-                 * probes! */
-                if (sdata->dev == local->mdev)
-                        continue;
-
                 netif_stop_queue(sdata->dev);
                 if (sdata->vif.type == IEEE80211_IF_TYPE_STA &&
                     (sdata->u.sta.flags & IEEE80211_STA_ASSOCIATED))
@@ -4012,14 +4064,14 @@ static int ieee80211_sta_start_scan(struct net_device *dev,
         local->scan_band = IEEE80211_BAND_2GHZ;
         local->scan_dev = dev;
 
-        netif_tx_lock_bh(local->mdev);
+        netif_addr_lock_bh(local->mdev);
         local->filter_flags |= FIF_BCN_PRBRESP_PROMISC;
         local->ops->configure_filter(local_to_hw(local),
                                      FIF_BCN_PRBRESP_PROMISC,
                                      &local->filter_flags,
                                      local->mdev->mc_count,
                                      local->mdev->mc_list);
-        netif_tx_unlock_bh(local->mdev);
+        netif_addr_unlock_bh(local->mdev);
 
         /* TODO: start scan as soon as all nullfunc frames are ACKed */
         queue_delayed_work(local->hw.workqueue, &local->scan_work,
@@ -4054,6 +4106,7 @@ int ieee80211_sta_req_scan(struct net_device *dev, u8 *ssid, size_t ssid_len)
 
 static char *
 ieee80211_sta_scan_result(struct net_device *dev,
+                          struct iw_request_info *info,
                           struct ieee80211_sta_bss *bss,
                           char *current_ev, char *end_buf)
 {
@@ -4068,7 +4121,7 @@ ieee80211_sta_scan_result(struct net_device *dev,
         iwe.cmd = SIOCGIWAP;
         iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
         memcpy(iwe.u.ap_addr.sa_data, bss->bssid, ETH_ALEN);
-        current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe,
+        current_ev = iwe_stream_add_event(info, current_ev, end_buf, &iwe,
                                           IW_EV_ADDR_LEN);
 
         memset(&iwe, 0, sizeof(iwe));
@@ -4076,13 +4129,13 @@ ieee80211_sta_scan_result(struct net_device *dev,
         if (bss_mesh_cfg(bss)) {
                 iwe.u.data.length = bss_mesh_id_len(bss);
                 iwe.u.data.flags = 1;
-                current_ev = iwe_stream_add_point(current_ev, end_buf, &iwe,
-                                                  bss_mesh_id(bss));
+                current_ev = iwe_stream_add_point(info, current_ev, end_buf,
+                                                  &iwe, bss_mesh_id(bss));
         } else {
                 iwe.u.data.length = bss->ssid_len;
                 iwe.u.data.flags = 1;
-                current_ev = iwe_stream_add_point(current_ev, end_buf, &iwe,
-                                                  bss->ssid);
+                current_ev = iwe_stream_add_point(info, current_ev, end_buf,
+                                                  &iwe, bss->ssid);
         }
 
         if (bss->capability & (WLAN_CAPABILITY_ESS | WLAN_CAPABILITY_IBSS)
@@ -4095,30 +4148,30 @@ ieee80211_sta_scan_result(struct net_device *dev,
                         iwe.u.mode = IW_MODE_MASTER;
                 else
                         iwe.u.mode = IW_MODE_ADHOC;
-                current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe,
-                                                  IW_EV_UINT_LEN);
+                current_ev = iwe_stream_add_event(info, current_ev, end_buf,
+                                                  &iwe, IW_EV_UINT_LEN);
         }
 
         memset(&iwe, 0, sizeof(iwe));
         iwe.cmd = SIOCGIWFREQ;
         iwe.u.freq.m = ieee80211_frequency_to_channel(bss->freq);
         iwe.u.freq.e = 0;
-        current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe,
+        current_ev = iwe_stream_add_event(info, current_ev, end_buf, &iwe,
                                           IW_EV_FREQ_LEN);
 
         memset(&iwe, 0, sizeof(iwe));
         iwe.cmd = SIOCGIWFREQ;
         iwe.u.freq.m = bss->freq;
         iwe.u.freq.e = 6;
-        current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe,
+        current_ev = iwe_stream_add_event(info, current_ev, end_buf, &iwe,
                                           IW_EV_FREQ_LEN);
         memset(&iwe, 0, sizeof(iwe));
         iwe.cmd = IWEVQUAL;
-        iwe.u.qual.qual = bss->signal;
-        iwe.u.qual.level = bss->rssi;
+        iwe.u.qual.qual = bss->qual;
+        iwe.u.qual.level = bss->signal;
         iwe.u.qual.noise = bss->noise;
         iwe.u.qual.updated = local->wstats_flags;
-        current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe,
+        current_ev = iwe_stream_add_event(info, current_ev, end_buf, &iwe,
                                           IW_EV_QUAL_LEN);
 
         memset(&iwe, 0, sizeof(iwe));
@@ -4128,27 +4181,36 @@ ieee80211_sta_scan_result(struct net_device *dev,
         else
                 iwe.u.data.flags = IW_ENCODE_DISABLED;
         iwe.u.data.length = 0;
-        current_ev = iwe_stream_add_point(current_ev, end_buf, &iwe, "");
+        current_ev = iwe_stream_add_point(info, current_ev, end_buf,
+                                          &iwe, "");
 
         if (bss && bss->wpa_ie) {
                 memset(&iwe, 0, sizeof(iwe));
                 iwe.cmd = IWEVGENIE;
                 iwe.u.data.length = bss->wpa_ie_len;
-                current_ev = iwe_stream_add_point(current_ev, end_buf, &iwe,
-                                                  bss->wpa_ie);
+                current_ev = iwe_stream_add_point(info, current_ev, end_buf,
+                                                  &iwe, bss->wpa_ie);
         }
 
         if (bss && bss->rsn_ie) {
                 memset(&iwe, 0, sizeof(iwe));
                 iwe.cmd = IWEVGENIE;
                 iwe.u.data.length = bss->rsn_ie_len;
-                current_ev = iwe_stream_add_point(current_ev, end_buf, &iwe,
-                                                  bss->rsn_ie);
+                current_ev = iwe_stream_add_point(info, current_ev, end_buf,
+                                                  &iwe, bss->rsn_ie);
+        }
+
+        if (bss && bss->ht_ie) {
+                memset(&iwe, 0, sizeof(iwe));
+                iwe.cmd = IWEVGENIE;
+                iwe.u.data.length = bss->ht_ie_len;
+                current_ev = iwe_stream_add_point(info, current_ev, end_buf,
+                                                  &iwe, bss->ht_ie);
         }
 
         if (bss && bss->supp_rates_len > 0) {
                 /* display all supported rates in readable format */
-                char *p = current_ev + IW_EV_LCP_LEN;
+                char *p = current_ev + iwe_stream_lcp_len(info);
                 int i;
 
                 memset(&iwe, 0, sizeof(iwe));
@@ -4159,7 +4221,7 @@ ieee80211_sta_scan_result(struct net_device *dev,
                 for (i = 0; i < bss->supp_rates_len; i++) {
                         iwe.u.bitrate.value = ((bss->supp_rates[i] &
                                                         0x7f) * 500000);
-                        p = iwe_stream_add_value(current_ev, p,
+                        p = iwe_stream_add_value(info, current_ev, p,
                                         end_buf, &iwe, IW_EV_PARAM_LEN);
                 }
                 current_ev = p;
@@ -4173,8 +4235,16 @@ ieee80211_sta_scan_result(struct net_device *dev,
                         iwe.cmd = IWEVCUSTOM;
                         sprintf(buf, "tsf=%016llx", (unsigned long long)(bss->timestamp));
                         iwe.u.data.length = strlen(buf);
-                        current_ev = iwe_stream_add_point(current_ev, end_buf,
+                        current_ev = iwe_stream_add_point(info, current_ev,
+                                                          end_buf,
                                                           &iwe, buf);
+                        memset(&iwe, 0, sizeof(iwe));
+                        iwe.cmd = IWEVCUSTOM;
+                        sprintf(buf, " Last beacon: %dms ago",
+                                jiffies_to_msecs(jiffies - bss->last_update));
+                        iwe.u.data.length = strlen(buf);
+                        current_ev = iwe_stream_add_point(info, current_ev,
+                                                          end_buf, &iwe, buf);
                         kfree(buf);
                 }
         }
@@ -4188,31 +4258,36 @@ ieee80211_sta_scan_result(struct net_device *dev,
                         iwe.cmd = IWEVCUSTOM;
                         sprintf(buf, "Mesh network (version %d)", cfg[0]);
                         iwe.u.data.length = strlen(buf);
-                        current_ev = iwe_stream_add_point(current_ev, end_buf,
+                        current_ev = iwe_stream_add_point(info, current_ev,
+                                                          end_buf,
                                                           &iwe, buf);
                         sprintf(buf, "Path Selection Protocol ID: "
                                 "0x%02X%02X%02X%02X", cfg[1], cfg[2], cfg[3],
                                                         cfg[4]);
                         iwe.u.data.length = strlen(buf);
-                        current_ev = iwe_stream_add_point(current_ev, end_buf,
+                        current_ev = iwe_stream_add_point(info, current_ev,
+                                                          end_buf,
                                                           &iwe, buf);
                         sprintf(buf, "Path Selection Metric ID: "
                                 "0x%02X%02X%02X%02X", cfg[5], cfg[6], cfg[7],
                                                         cfg[8]);
                         iwe.u.data.length = strlen(buf);
-                        current_ev = iwe_stream_add_point(current_ev, end_buf,
+                        current_ev = iwe_stream_add_point(info, current_ev,
+                                                          end_buf,
                                                           &iwe, buf);
                         sprintf(buf, "Congestion Control Mode ID: "
                                 "0x%02X%02X%02X%02X", cfg[9], cfg[10],
                                                         cfg[11], cfg[12]);
                         iwe.u.data.length = strlen(buf);
-                        current_ev = iwe_stream_add_point(current_ev, end_buf,
+                        current_ev = iwe_stream_add_point(info, current_ev,
+                                                          end_buf,
                                                           &iwe, buf);
                         sprintf(buf, "Channel Precedence: "
                                 "0x%02X%02X%02X%02X", cfg[13], cfg[14],
                                                         cfg[15], cfg[16]);
                         iwe.u.data.length = strlen(buf);
-                        current_ev = iwe_stream_add_point(current_ev, end_buf,
+                        current_ev = iwe_stream_add_point(info, current_ev,
+                                                          end_buf,
                                                           &iwe, buf);
                         kfree(buf);
                 }
@@ -4222,7 +4297,9 @@ ieee80211_sta_scan_result(struct net_device *dev,
 }
 
 
-int ieee80211_sta_scan_results(struct net_device *dev, char *buf, size_t len)
+int ieee80211_sta_scan_results(struct net_device *dev,
+                               struct iw_request_info *info,
+                               char *buf, size_t len)
 {
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
         char *current_ev = buf;
@@ -4235,8 +4312,8 @@ int ieee80211_sta_scan_results(struct net_device *dev, char *buf, size_t len)
                         spin_unlock_bh(&local->sta_bss_lock);
                         return -E2BIG;
                 }
-                current_ev = ieee80211_sta_scan_result(dev, bss, current_ev,
-                                                       end_buf);
+                current_ev = ieee80211_sta_scan_result(dev, info, bss,
+                                                       current_ev, end_buf);
         }
         spin_unlock_bh(&local->sta_bss_lock);
         return current_ev - buf;
@@ -4247,6 +4324,7 @@ int ieee80211_sta_set_extra_ie(struct net_device *dev, char *ie, size_t len)
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
+
         kfree(ifsta->extra_ie);
         if (len == 0) {
                 ifsta->extra_ie = NULL;
@@ -4264,14 +4342,15 @@ int ieee80211_sta_set_extra_ie(struct net_device *dev, char *ie, size_t len)
 }
 
 
-struct sta_info * ieee80211_ibss_add_sta(struct net_device *dev,
-                                         struct sk_buff *skb, u8 *bssid,
-                                         u8 *addr)
+struct sta_info *ieee80211_ibss_add_sta(struct net_device *dev,
+                                        struct sk_buff *skb, u8 *bssid,
+                                        u8 *addr, u64 supp_rates)
 {
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
         struct sta_info *sta;
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         DECLARE_MAC_BUF(mac);
+        int band = local->hw.conf.channel->band;
 
         /* TODO: Could consider removing the least recently used entry and
          * allow new one to be added. */
@@ -4283,17 +4362,24 @@ struct sta_info * ieee80211_ibss_add_sta(struct net_device *dev,
                 return NULL;
         }
 
+        if (compare_ether_addr(bssid, sdata->u.sta.bssid))
+                return NULL;
+
+#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
         printk(KERN_DEBUG "%s: Adding new IBSS station %s (dev=%s)\n",
                wiphy_name(local->hw.wiphy), print_mac(mac, addr), dev->name);
+#endif
 
         sta = sta_info_alloc(sdata, addr, GFP_ATOMIC);
         if (!sta)
                 return NULL;
 
-        sta->flags |= WLAN_STA_AUTHORIZED;
+        set_sta_flags(sta, WLAN_STA_AUTHORIZED);
 
-        sta->supp_rates[local->hw.conf.channel->band] =
-                sdata->u.sta.supp_rates_bits[local->hw.conf.channel->band];
+        if (supp_rates)
+                sta->supp_rates[band] = supp_rates;
+        else
+                sta->supp_rates[band] = sdata->u.sta.supp_rates_bits[band];
 
         rate_control_rate_init(sta, local);
 
@@ -4309,7 +4395,7 @@ int ieee80211_sta_deauthenticate(struct net_device *dev, u16 reason)
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
 
-        printk(KERN_DEBUG "%s: deauthenticate(reason=%d)\n",
+        printk(KERN_DEBUG "%s: deauthenticating by local choice (reason=%d)\n",
                dev->name, reason);
 
         if (sdata->vif.type != IEEE80211_IF_TYPE_STA &&
@@ -4327,7 +4413,7 @@ int ieee80211_sta_disassociate(struct net_device *dev, u16 reason)
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
 
-        printk(KERN_DEBUG "%s: disassociate(reason=%d)\n",
+        printk(KERN_DEBUG "%s: disassociating by local choice (reason=%d)\n",
                dev->name, reason);
 
         if (sdata->vif.type != IEEE80211_IF_TYPE_STA)
@@ -4351,12 +4437,10 @@ void ieee80211_notify_mac(struct ieee80211_hw *hw,
         case IEEE80211_NOTIFY_RE_ASSOC:
                 rcu_read_lock();
                 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
+                        if (sdata->vif.type != IEEE80211_IF_TYPE_STA)
+                                continue;
 
-                        if (sdata->vif.type == IEEE80211_IF_TYPE_STA) {
-                                ieee80211_sta_req_auth(sdata->dev,
-                                                       &sdata->u.sta);
-                        }
-
+                        ieee80211_sta_req_auth(sdata->dev, &sdata->u.sta);
                 }
                 rcu_read_unlock();
                 break;
diff --git a/net/mac80211/rate.c b/net/mac80211/rate.c
index 841df93807fc..0388c090dfe9 100644
--- a/net/mac80211/rate.c
+++ b/net/mac80211/rate.c
@@ -176,20 +176,24 @@ void rate_control_get_rate(struct net_device *dev,
         rcu_read_lock();
         sta = sta_info_get(local, hdr->addr1);
 
-        memset(sel, 0, sizeof(struct rate_selection));
+        sel->rate_idx = -1;
+        sel->nonerp_idx = -1;
+        sel->probe_idx = -1;
 
         ref->ops->get_rate(ref->priv, dev, sband, skb, sel);
 
+        BUG_ON(sel->rate_idx < 0);
+
         /* Select a non-ERP backup rate. */
-        if (!sel->nonerp) {
+        if (sel->nonerp_idx < 0) {
                 for (i = 0; i < sband->n_bitrates; i++) {
                         struct ieee80211_rate *rate = &sband->bitrates[i];
-                        if (sel->rate->bitrate < rate->bitrate)
+                        if (sband->bitrates[sel->rate_idx].bitrate < rate->bitrate)
                                 break;
 
                         if (rate_supported(sta, sband->band, i) &&
                             !(rate->flags & IEEE80211_RATE_ERP_G))
-                                sel->nonerp = rate;
+                                sel->nonerp_idx = i;
                 }
         }
 
diff --git a/net/mac80211/rate.h b/net/mac80211/rate.h
index 5b45f33cb766..ede7ab56f65b 100644
--- a/net/mac80211/rate.h
+++ b/net/mac80211/rate.h
@@ -19,22 +19,22 @@
 #include "ieee80211_i.h"
 #include "sta_info.h"
 
-/* TODO: kdoc */
+/**
+ * struct rate_selection - rate selection for rate control algos
+ * @rate: selected transmission rate index
+ * @nonerp: Non-ERP rate to use instead if ERP cannot be used
+ * @probe: rate for probing (or -1)
+ *
+ */
 struct rate_selection {
-        /* Selected transmission rate */
-        struct ieee80211_rate *rate;
-        /* Non-ERP rate to use if mac80211 decides it cannot use an ERP rate */
-        struct ieee80211_rate *nonerp;
-        /* probe with this rate, or NULL for no probing */
-        struct ieee80211_rate *probe;
+        s8 rate_idx, nonerp_idx, probe_idx;
 };
 
 struct rate_control_ops {
         struct module *module;
         const char *name;
         void (*tx_status)(void *priv, struct net_device *dev,
-                          struct sk_buff *skb,
-                          struct ieee80211_tx_status *status);
+                          struct sk_buff *skb);
         void (*get_rate)(void *priv, struct net_device *dev,
                          struct ieee80211_supported_band *band,
                          struct sk_buff *skb,
@@ -76,13 +76,12 @@ struct rate_control_ref *rate_control_get(struct rate_control_ref *ref);
 void rate_control_put(struct rate_control_ref *ref);
 
 static inline void rate_control_tx_status(struct net_device *dev,
-                                          struct sk_buff *skb,
-                                          struct ieee80211_tx_status *status)
+                                          struct sk_buff *skb)
 {
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
         struct rate_control_ref *ref = local->rate_ctrl;
 
-        ref->ops->tx_status(ref->priv, dev, skb, status);
+        ref->ops->tx_status(ref->priv, dev, skb);
 }
 
 
@@ -138,7 +137,7 @@ static inline int rate_supported(struct sta_info *sta,
         return (sta == NULL || sta->supp_rates[band] & BIT(index));
 }
 
-static inline int
+static inline s8
 rate_lowest_index(struct ieee80211_local *local,
                   struct ieee80211_supported_band *sband,
                   struct sta_info *sta)
@@ -155,14 +154,6 @@ rate_lowest_index(struct ieee80211_local *local,
         return 0;
 }
 
-static inline struct ieee80211_rate *
-rate_lowest(struct ieee80211_local *local,
-            struct ieee80211_supported_band *sband,
-            struct sta_info *sta)
-{
-        return &sband->bitrates[rate_lowest_index(local, sband, sta)];
-}
-
 
 /* functions for rate control related to a device */
 int ieee80211_init_rate_ctrl_alg(struct ieee80211_local *local,
@@ -171,9 +162,7 @@ void rate_control_deinitialize(struct ieee80211_local *local);
 
 
 /* Rate control algorithms */
-#if defined(RC80211_PID_COMPILE) || \
-        (defined(CONFIG_MAC80211_RC_PID) && \
-         !defined(CONFIG_MAC80211_RC_PID_MODULE))
+#ifdef CONFIG_MAC80211_RC_PID
 extern int rc80211_pid_init(void);
 extern void rc80211_pid_exit(void);
 #else
diff --git a/net/mac80211/rc80211_pid.h b/net/mac80211/rc80211_pid.h
index 04afc13ed825..0a9135b974b5 100644
--- a/net/mac80211/rc80211_pid.h
+++ b/net/mac80211/rc80211_pid.h
@@ -61,7 +61,7 @@ enum rc_pid_event_type {
 union rc_pid_event_data {
         /* RC_PID_EVENT_TX_STATUS */
         struct {
-                struct ieee80211_tx_status tx_status;
+                struct ieee80211_tx_info tx_status;
         };
         /* RC_PID_EVENT_TYPE_RATE_CHANGE */
         /* RC_PID_EVENT_TYPE_TX_RATE */
@@ -141,7 +141,6 @@ struct rc_pid_events_file_info {
  *      rate behaviour values (lower means we should trust more what we learnt
  *      about behaviour of rates, higher means we should trust more the natural
  *      ordering of rates)
- * @fast_start: if Y, push high rates right after initialization
  */
 struct rc_pid_debugfs_entries {
         struct dentry *dir;
@@ -154,11 +153,10 @@ struct rc_pid_debugfs_entries {
         struct dentry *sharpen_factor;
         struct dentry *sharpen_duration;
         struct dentry *norm_offset;
-        struct dentry *fast_start;
 };
 
 void rate_control_pid_event_tx_status(struct rc_pid_event_buffer *buf,
-                                             struct ieee80211_tx_status *stat);
+                                      struct ieee80211_tx_info *stat);
 
 void rate_control_pid_event_rate_change(struct rc_pid_event_buffer *buf,
                                                int index, int rate);
@@ -267,9 +265,6 @@ struct rc_pid_info {
         /* Normalization offset. */
         unsigned int norm_offset;
 
-        /* Fast starst parameter. */
-        unsigned int fast_start;
-
         /* Rates information. */
         struct rc_pid_rateinfo *rinfo;
 
diff --git a/net/mac80211/rc80211_pid_algo.c b/net/mac80211/rc80211_pid_algo.c
index a849b745bdb5..a914ba73ccf5 100644
--- a/net/mac80211/rc80211_pid_algo.c
+++ b/net/mac80211/rc80211_pid_algo.c
@@ -237,8 +237,7 @@ static void rate_control_pid_sample(struct rc_pid_info *pinfo,
 }
 
 static void rate_control_pid_tx_status(void *priv, struct net_device *dev,
-                                       struct sk_buff *skb,
-                                       struct ieee80211_tx_status *status)
+                                       struct sk_buff *skb)
 {
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
@@ -248,6 +247,7 @@ static void rate_control_pid_tx_status(void *priv, struct net_device *dev,
         struct rc_pid_sta_info *spinfo;
         unsigned long period;
         struct ieee80211_supported_band *sband;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 
         rcu_read_lock();
 
@@ -259,35 +259,35 @@ static void rate_control_pid_tx_status(void *priv, struct net_device *dev,
 
         /* Don't update the state if we're not controlling the rate. */
         sdata = sta->sdata;
-        if (sdata->bss && sdata->bss->force_unicast_rateidx > -1) {
-                sta->txrate_idx = sdata->bss->max_ratectrl_rateidx;
+        if (sdata->force_unicast_rateidx > -1) {
+                sta->txrate_idx = sdata->max_ratectrl_rateidx;
                 goto unlock;
         }
 
         /* Ignore all frames that were sent with a different rate than the rate
          * we currently advise mac80211 to use. */
-        if (status->control.tx_rate != &sband->bitrates[sta->txrate_idx])
+        if (info->tx_rate_idx != sta->txrate_idx)
                 goto unlock;
 
         spinfo = sta->rate_ctrl_priv;
         spinfo->tx_num_xmit++;
 
 #ifdef CONFIG_MAC80211_DEBUGFS
-        rate_control_pid_event_tx_status(&spinfo->events, status);
+        rate_control_pid_event_tx_status(&spinfo->events, info);
 #endif
 
         /* We count frames that totally failed to be transmitted as two bad
          * frames, those that made it out but had some retries as one good and
          * one bad frame. */
-        if (status->excessive_retries) {
+        if (info->status.excessive_retries) {
                 spinfo->tx_num_failed += 2;
                 spinfo->tx_num_xmit++;
-        } else if (status->retry_count) {
+        } else if (info->status.retry_count) {
                 spinfo->tx_num_failed++;
                 spinfo->tx_num_xmit++;
         }
 
-        if (status->excessive_retries) {
+        if (info->status.excessive_retries) {
                 sta->tx_retry_failed++;
                 sta->tx_num_consecutive_failures++;
                 sta->tx_num_mpdu_fail++;
@@ -295,8 +295,8 @@ static void rate_control_pid_tx_status(void *priv, struct net_device *dev,
                 sta->tx_num_consecutive_failures = 0;
                 sta->tx_num_mpdu_ok++;
         }
-        sta->tx_retry_count += status->retry_count;
-        sta->tx_num_mpdu_fail += status->retry_count;
+        sta->tx_retry_count += info->status.retry_count;
+        sta->tx_num_mpdu_fail += info->status.retry_count;
 
         /* Update PID controller state. */
         period = (HZ * pinfo->sampling_period + 500) / 1000;
@@ -330,15 +330,15 @@ static void rate_control_pid_get_rate(void *priv, struct net_device *dev,
         fc = le16_to_cpu(hdr->frame_control);
         if ((fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA ||
             is_multicast_ether_addr(hdr->addr1) || !sta) {
-                sel->rate = rate_lowest(local, sband, sta);
+                sel->rate_idx = rate_lowest_index(local, sband, sta);
                 rcu_read_unlock();
                 return;
         }
 
         /* If a forced rate is in effect, select it. */
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        if (sdata->bss && sdata->bss->force_unicast_rateidx > -1)
-                sta->txrate_idx = sdata->bss->force_unicast_rateidx;
+        if (sdata->force_unicast_rateidx > -1)
+                sta->txrate_idx = sdata->force_unicast_rateidx;
 
         rateidx = sta->txrate_idx;
 
@@ -349,7 +349,7 @@ static void rate_control_pid_get_rate(void *priv, struct net_device *dev,
 
         rcu_read_unlock();
 
-        sel->rate = &sband->bitrates[rateidx];
+        sel->rate_idx = rateidx;
 
 #ifdef CONFIG_MAC80211_DEBUGFS
         rate_control_pid_event_tx_rate(
@@ -398,13 +398,25 @@ static void *rate_control_pid_alloc(struct ieee80211_local *local)
                 return NULL;
         }
 
+        pinfo->target = RC_PID_TARGET_PF;
+        pinfo->sampling_period = RC_PID_INTERVAL;
+        pinfo->coeff_p = RC_PID_COEFF_P;
+        pinfo->coeff_i = RC_PID_COEFF_I;
+        pinfo->coeff_d = RC_PID_COEFF_D;
+        pinfo->smoothing_shift = RC_PID_SMOOTHING_SHIFT;
+        pinfo->sharpen_factor = RC_PID_SHARPENING_FACTOR;
+        pinfo->sharpen_duration = RC_PID_SHARPENING_DURATION;
+        pinfo->norm_offset = RC_PID_NORM_OFFSET;
+        pinfo->rinfo = rinfo;
+        pinfo->oldrate = 0;
+
         /* Sort the rates. This is optimized for the most common case (i.e.
          * almost-sorted CCK+OFDM rates). Kind of bubble-sort with reversed
          * mapping too. */
         for (i = 0; i < sband->n_bitrates; i++) {
                 rinfo[i].index = i;
                 rinfo[i].rev_index = i;
-                if (pinfo->fast_start)
+                if (RC_PID_FAST_START)
                         rinfo[i].diff = 0;
                 else
                         rinfo[i].diff = i * pinfo->norm_offset;
@@ -425,19 +437,6 @@ static void *rate_control_pid_alloc(struct ieee80211_local *local)
                         break;
         }
 
-        pinfo->target = RC_PID_TARGET_PF;
-        pinfo->sampling_period = RC_PID_INTERVAL;
-        pinfo->coeff_p = RC_PID_COEFF_P;
-        pinfo->coeff_i = RC_PID_COEFF_I;
-        pinfo->coeff_d = RC_PID_COEFF_D;
-        pinfo->smoothing_shift = RC_PID_SMOOTHING_SHIFT;
-        pinfo->sharpen_factor = RC_PID_SHARPENING_FACTOR;
-        pinfo->sharpen_duration = RC_PID_SHARPENING_DURATION;
-        pinfo->norm_offset = RC_PID_NORM_OFFSET;
-        pinfo->fast_start = RC_PID_FAST_START;
-        pinfo->rinfo = rinfo;
-        pinfo->oldrate = 0;
-
 #ifdef CONFIG_MAC80211_DEBUGFS
         de = &pinfo->dentries;
         de->dir = debugfs_create_dir("rc80211_pid",
@@ -465,9 +464,6 @@ static void *rate_control_pid_alloc(struct ieee80211_local *local)
         de->norm_offset = debugfs_create_u32("norm_offset",
                                              S_IRUSR | S_IWUSR, de->dir,
                                              &pinfo->norm_offset);
-        de->fast_start = debugfs_create_bool("fast_start",
-                                             S_IRUSR | S_IWUSR, de->dir,
-                                             &pinfo->fast_start);
 #endif
 
         return pinfo;
@@ -479,7 +475,6 @@ static void rate_control_pid_free(void *priv)
 #ifdef CONFIG_MAC80211_DEBUGFS
         struct rc_pid_debugfs_entries *de = &pinfo->dentries;
 
-        debugfs_remove(de->fast_start);
         debugfs_remove(de->norm_offset);
         debugfs_remove(de->sharpen_duration);
         debugfs_remove(de->sharpen_factor);
@@ -540,11 +535,6 @@ static struct rate_control_ops mac80211_rcpid = {
 #endif
 };
 
-MODULE_DESCRIPTION("PID controller based rate control algorithm");
-MODULE_AUTHOR("Stefano Brivio");
-MODULE_AUTHOR("Mattias Nissler");
-MODULE_LICENSE("GPL");
-
 int __init rc80211_pid_init(void)
 {
         return ieee80211_rate_control_register(&mac80211_rcpid);
@@ -554,8 +544,3 @@ void rc80211_pid_exit(void)
 {
         ieee80211_rate_control_unregister(&mac80211_rcpid);
 }
-
-#ifdef CONFIG_MAC80211_RC_PID_MODULE
-module_init(rc80211_pid_init);
-module_exit(rc80211_pid_exit);
-#endif
diff --git a/net/mac80211/rc80211_pid_debugfs.c b/net/mac80211/rc80211_pid_debugfs.c
index ff5c380f3c13..8121d3bc6835 100644
--- a/net/mac80211/rc80211_pid_debugfs.c
+++ b/net/mac80211/rc80211_pid_debugfs.c
@@ -39,11 +39,11 @@ static void rate_control_pid_event(struct rc_pid_event_buffer *buf,
 }
 
 void rate_control_pid_event_tx_status(struct rc_pid_event_buffer *buf,
-                                             struct ieee80211_tx_status *stat)
+                                      struct ieee80211_tx_info *stat)
 {
         union rc_pid_event_data evd;
 
-        memcpy(&evd.tx_status, stat, sizeof(struct ieee80211_tx_status));
+        memcpy(&evd.tx_status, stat, sizeof(struct ieee80211_tx_info));
         rate_control_pid_event(buf, RC_PID_EVENT_TYPE_TX_STATUS, &evd);
 }
 
@@ -167,8 +167,8 @@ static ssize_t rate_control_pid_events_read(struct file *file, char __user *buf,
         switch (ev->type) {
         case RC_PID_EVENT_TYPE_TX_STATUS:
                 p += snprintf(pb + p, length - p, "tx_status %u %u",
-                              ev->data.tx_status.excessive_retries,
-                              ev->data.tx_status.retry_count);
+                              ev->data.tx_status.status.excessive_retries,
+                              ev->data.tx_status.status.retry_count);
                 break;
         case RC_PID_EVENT_TYPE_RATE_CHANGE:
                 p += snprintf(pb + p, length - p, "rate_change %d %d",
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 0941e5d6a522..6d9ae67c27ca 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -61,22 +61,147 @@ static inline int should_drop_frame(struct ieee80211_rx_status *status,
                                     int present_fcs_len,
                                     int radiotap_len)
 {
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
 
         if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
                 return 1;
         if (unlikely(skb->len < 16 + present_fcs_len + radiotap_len))
                 return 1;
-        if (((hdr->frame_control & cpu_to_le16(IEEE80211_FCTL_FTYPE)) ==
-                        cpu_to_le16(IEEE80211_FTYPE_CTL)) &&
-            ((hdr->frame_control & cpu_to_le16(IEEE80211_FCTL_STYPE)) !=
-                        cpu_to_le16(IEEE80211_STYPE_PSPOLL)) &&
-            ((hdr->frame_control & cpu_to_le16(IEEE80211_FCTL_STYPE)) !=
-                        cpu_to_le16(IEEE80211_STYPE_BACK_REQ)))
+        if (ieee80211_is_ctl(hdr->frame_control) &&
+            !ieee80211_is_pspoll(hdr->frame_control) &&
+            !ieee80211_is_back_req(hdr->frame_control))
                 return 1;
         return 0;
 }
 
+static int
+ieee80211_rx_radiotap_len(struct ieee80211_local *local,
+                          struct ieee80211_rx_status *status)
+{
+        int len;
+
+        /* always present fields */
+        len = sizeof(struct ieee80211_radiotap_header) + 9;
+
+        if (status->flag & RX_FLAG_TSFT)
+                len += 8;
+        if (local->hw.flags & IEEE80211_HW_SIGNAL_DB ||
+            local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
+                len += 1;
+        if (local->hw.flags & IEEE80211_HW_NOISE_DBM)
+                len += 1;
+
+        if (len & 1) /* padding for RX_FLAGS if necessary */
+                len++;
+
+        /* make sure radiotap starts at a naturally aligned address */
+        if (len % 8)
+                len = roundup(len, 8);
+
+        return len;
+}
+
+/**
+ * ieee80211_add_rx_radiotap_header - add radiotap header
+ *
+ * add a radiotap header containing all the fields which the hardware provided.
+ */
+static void
+ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
+                                 struct sk_buff *skb,
+                                 struct ieee80211_rx_status *status,
+                                 struct ieee80211_rate *rate,
+                                 int rtap_len)
+{
+        struct ieee80211_radiotap_header *rthdr;
+        unsigned char *pos;
+
+        rthdr = (struct ieee80211_radiotap_header *)skb_push(skb, rtap_len);
+        memset(rthdr, 0, rtap_len);
+
+        /* radiotap header, set always present flags */
+        rthdr->it_present =
+                cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
+                            (1 << IEEE80211_RADIOTAP_RATE) |
+                            (1 << IEEE80211_RADIOTAP_CHANNEL) |
+                            (1 << IEEE80211_RADIOTAP_ANTENNA) |
+                            (1 << IEEE80211_RADIOTAP_RX_FLAGS));
+        rthdr->it_len = cpu_to_le16(rtap_len);
+
+        pos = (unsigned char *)(rthdr+1);
+
+        /* the order of the following fields is important */
+
+        /* IEEE80211_RADIOTAP_TSFT */
+        if (status->flag & RX_FLAG_TSFT) {
+                *(__le64 *)pos = cpu_to_le64(status->mactime);
+                rthdr->it_present |=
+                        cpu_to_le32(1 << IEEE80211_RADIOTAP_TSFT);
+                pos += 8;
+        }
+
+        /* IEEE80211_RADIOTAP_FLAGS */
+        if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)
+                *pos |= IEEE80211_RADIOTAP_F_FCS;
+        pos++;
+
+        /* IEEE80211_RADIOTAP_RATE */
+        *pos = rate->bitrate / 5;
+        pos++;
+
+        /* IEEE80211_RADIOTAP_CHANNEL */
+        *(__le16 *)pos = cpu_to_le16(status->freq);
+        pos += 2;
+        if (status->band == IEEE80211_BAND_5GHZ)
+                *(__le16 *)pos = cpu_to_le16(IEEE80211_CHAN_OFDM |
+                                             IEEE80211_CHAN_5GHZ);
+        else
+                *(__le16 *)pos = cpu_to_le16(IEEE80211_CHAN_DYN |
+                                             IEEE80211_CHAN_2GHZ);
+        pos += 2;
+
+        /* IEEE80211_RADIOTAP_DBM_ANTSIGNAL */
+        if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM) {
+                *pos = status->signal;
+                rthdr->it_present |=
+                        cpu_to_le32(1 << IEEE80211_RADIOTAP_DBM_ANTSIGNAL);
+                pos++;
+        }
+
+        /* IEEE80211_RADIOTAP_DBM_ANTNOISE */
+        if (local->hw.flags & IEEE80211_HW_NOISE_DBM) {
+                *pos = status->noise;
+                rthdr->it_present |=
+                        cpu_to_le32(1 << IEEE80211_RADIOTAP_DBM_ANTNOISE);
+                pos++;
+        }
+
+        /* IEEE80211_RADIOTAP_LOCK_QUALITY is missing */
+
+        /* IEEE80211_RADIOTAP_ANTENNA */
+        *pos = status->antenna;
+        pos++;
+
+        /* IEEE80211_RADIOTAP_DB_ANTSIGNAL */
+        if (local->hw.flags & IEEE80211_HW_SIGNAL_DB) {
+                *pos = status->signal;
+                rthdr->it_present |=
+                        cpu_to_le32(1 << IEEE80211_RADIOTAP_DB_ANTSIGNAL);
+                pos++;
+        }
+
+        /* IEEE80211_RADIOTAP_DB_ANTNOISE is not used */
+
+        /* IEEE80211_RADIOTAP_RX_FLAGS */
+        /* ensure 2 byte alignment for the 2 byte field as required */
+        if ((pos - (unsigned char *)rthdr) & 1)
+                pos++;
+        /* FIXME: when radiotap gets a 'bad PLCP' flag use it here */
+        if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
+                *(__le16 *)pos |= cpu_to_le16(IEEE80211_RADIOTAP_F_RX_BADFCS);
+        pos += 2;
+}
+
 /*
  * This function copies a received frame to all monitor interfaces and
  * returns a cleaned-up SKB that no longer includes the FCS nor the
@@ -89,17 +214,6 @@ ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
 {
         struct ieee80211_sub_if_data *sdata;
         int needed_headroom = 0;
-        struct ieee80211_radiotap_header *rthdr;
-        __le64 *rttsft = NULL;
-        struct ieee80211_rtap_fixed_data {
-                u8 flags;
-                u8 rate;
-                __le16 chan_freq;
-                __le16 chan_flags;
-                u8 antsignal;
-                u8 padding_for_rxflags;
-                __le16 rx_flags;
-        } __attribute__ ((packed)) *rtfixed;
         struct sk_buff *skb, *skb2;
         struct net_device *prev_dev = NULL;
         int present_fcs_len = 0;
@@ -116,8 +230,8 @@ ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
         if (status->flag & RX_FLAG_RADIOTAP)
                 rtap_len = ieee80211_get_radiotap_len(origskb->data);
         else
-                /* room for radiotap header, always present fields and TSFT */
-                needed_headroom = sizeof(*rthdr) + sizeof(*rtfixed) + 8;
+                /* room for the radiotap header based on driver features */
+                needed_headroom = ieee80211_rx_radiotap_len(local, status);
 
         if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)
                 present_fcs_len = FCS_LEN;
@@ -163,55 +277,9 @@ ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
         }
 
         /* if necessary, prepend radiotap information */
-        if (!(status->flag & RX_FLAG_RADIOTAP)) {
-                rtfixed = (void *) skb_push(skb, sizeof(*rtfixed));
-                rtap_len = sizeof(*rthdr) + sizeof(*rtfixed);
-                if (status->flag & RX_FLAG_TSFT) {
-                        rttsft = (void *) skb_push(skb, sizeof(*rttsft));
-                        rtap_len += 8;
-                }
-                rthdr = (void *) skb_push(skb, sizeof(*rthdr));
-                memset(rthdr, 0, sizeof(*rthdr));
-                memset(rtfixed, 0, sizeof(*rtfixed));
-                rthdr->it_present =
-                        cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
-                                    (1 << IEEE80211_RADIOTAP_RATE) |
-                                    (1 << IEEE80211_RADIOTAP_CHANNEL) |
-                                    (1 << IEEE80211_RADIOTAP_DB_ANTSIGNAL) |
-                                    (1 << IEEE80211_RADIOTAP_RX_FLAGS));
-                rtfixed->flags = 0;
-                if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)
-                        rtfixed->flags |= IEEE80211_RADIOTAP_F_FCS;
-
-                if (rttsft) {
-                        *rttsft = cpu_to_le64(status->mactime);
-                        rthdr->it_present |=
-                                cpu_to_le32(1 << IEEE80211_RADIOTAP_TSFT);
-                }
-
-                /* FIXME: when radiotap gets a 'bad PLCP' flag use it here */
-                rtfixed->rx_flags = 0;
-                if (status->flag &
-                    (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
-                        rtfixed->rx_flags |=
-                                cpu_to_le16(IEEE80211_RADIOTAP_F_RX_BADFCS);
-
-                rtfixed->rate = rate->bitrate / 5;
-
-                rtfixed->chan_freq = cpu_to_le16(status->freq);
-
-                if (status->band == IEEE80211_BAND_5GHZ)
-                        rtfixed->chan_flags =
-                                cpu_to_le16(IEEE80211_CHAN_OFDM |
-                                            IEEE80211_CHAN_5GHZ);
-                else
-                        rtfixed->chan_flags =
-                                cpu_to_le16(IEEE80211_CHAN_DYN |
-                                            IEEE80211_CHAN_2GHZ);
-
-                rtfixed->antsignal = status->ssi;
-                rthdr->it_len = cpu_to_le16(rtap_len);
-        }
+        if (!(status->flag & RX_FLAG_RADIOTAP))
+                ieee80211_add_rx_radiotap_header(local, skb, status, rate,
+                                                 needed_headroom);
 
         skb_reset_mac_header(skb);
         skb->ip_summed = CHECKSUM_UNNECESSARY;
@@ -253,33 +321,33 @@ ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
 
 static void ieee80211_parse_qos(struct ieee80211_rx_data *rx)
 {
-        u8 *data = rx->skb->data;
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
         int tid;
 
         /* does the frame have a qos control field? */
-        if (WLAN_FC_IS_QOS_DATA(rx->fc)) {
-                u8 *qc = data + ieee80211_get_hdrlen(rx->fc) - QOS_CONTROL_LEN;
+        if (ieee80211_is_data_qos(hdr->frame_control)) {
+                u8 *qc = ieee80211_get_qos_ctl(hdr);
                 /* frame has qos control */
-                tid = qc[0] & QOS_CONTROL_TID_MASK;
-                if (qc[0] & IEEE80211_QOS_CONTROL_A_MSDU_PRESENT)
+                tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
+                if (*qc & IEEE80211_QOS_CONTROL_A_MSDU_PRESENT)
                         rx->flags |= IEEE80211_RX_AMSDU;
                 else
                         rx->flags &= ~IEEE80211_RX_AMSDU;
         } else {
-                if (unlikely((rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_MGMT)) {
-                        /* Separate TID for management frames */
-                        tid = NUM_RX_DATA_QUEUES - 1;
-                } else {
-                        /* no qos control present */
-                        tid = 0; /* 802.1d - Best Effort */
-                }
+                /*
+                 * IEEE 802.11-2007, 7.1.3.4.1 ("Sequence Number field"):
+                 *
+                 *      Sequence numbers for management frames, QoS data
+                 *      frames with a broadcast/multicast address in the
+                 *      Address 1 field, and all non-QoS data frames sent
+                 *      by QoS STAs are assigned using an additional single
+                 *      modulo-4096 counter, [...]
+                 *
+                 * We also use that counter for non-QoS STAs.
+                 */
+                tid = NUM_RX_DATA_QUEUES - 1;
         }
 
-        I802_DEBUG_INC(rx->local->wme_rx_queue[tid]);
-        /* only a debug counter, sta might not be assigned properly yet */
-        if (rx->sta)
-                I802_DEBUG_INC(rx->sta->wme_rx_queue[tid]);
-
         rx->queue = tid;
         /* Set skb->priority to 1d tag if highest order bit of TID is not set.
          * For now, set skb->priority to 0 for other cases. */
@@ -289,9 +357,10 @@ static void ieee80211_parse_qos(struct ieee80211_rx_data *rx)
 static void ieee80211_verify_ip_alignment(struct ieee80211_rx_data *rx)
 {
 #ifdef CONFIG_MAC80211_DEBUG_PACKET_ALIGNMENT
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
         int hdrlen;
 
-        if (!WLAN_FC_DATA_PRESENT(rx->fc))
+        if (!ieee80211_is_data_present(hdr->frame_control))
                 return;
 
         /*
@@ -313,7 +382,7 @@ static void ieee80211_verify_ip_alignment(struct ieee80211_rx_data *rx)
          * header and the payload is not supported, the driver is required
          * to move the 802.11 header further back in that case.
          */
-        hdrlen = ieee80211_get_hdrlen(rx->fc);
+        hdrlen = ieee80211_hdrlen(hdr->frame_control);
         if (rx->flags & IEEE80211_RX_AMSDU)
                 hdrlen += ETH_HLEN;
         WARN_ON_ONCE(((unsigned long)(rx->skb->data + hdrlen)) & 3);
@@ -321,51 +390,9 @@ static void ieee80211_verify_ip_alignment(struct ieee80211_rx_data *rx)
 }
 
 
-static u32 ieee80211_rx_load_stats(struct ieee80211_local *local,
-                                   struct sk_buff *skb,
-                                   struct ieee80211_rx_status *status,
-                                   struct ieee80211_rate *rate)
-{
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
-        u32 load = 0, hdrtime;
-
-        /* Estimate total channel use caused by this frame */
-
-        /* 1 bit at 1 Mbit/s takes 1 usec; in channel_use values,
-         * 1 usec = 1/8 * (1080 / 10) = 13.5 */
-
-        if (status->band == IEEE80211_BAND_5GHZ ||
-            (status->band == IEEE80211_BAND_5GHZ &&
-             rate->flags & IEEE80211_RATE_ERP_G))
-                hdrtime = CHAN_UTIL_HDR_SHORT;
-        else
-                hdrtime = CHAN_UTIL_HDR_LONG;
-
-        load = hdrtime;
-        if (!is_multicast_ether_addr(hdr->addr1))
-                load += hdrtime;
-
-        /* TODO: optimise again */
-        load += skb->len * CHAN_UTIL_RATE_LCM / rate->bitrate;
-
-        /* Divide channel_use by 8 to avoid wrapping around the counter */
-        load >>= CHAN_UTIL_SHIFT;
-
-        return load;
-}
-
 /* rx handlers */
 
-static ieee80211_rx_result
-ieee80211_rx_h_if_stats(struct ieee80211_rx_data *rx)
-{
-        if (rx->sta)
-                rx->sta->channel_use_raw += rx->load;
-        rx->sdata->channel_use_raw += rx->load;
-        return RX_CONTINUE;
-}
-
-static ieee80211_rx_result
+static ieee80211_rx_result debug_noinline
 ieee80211_rx_h_passive_scan(struct ieee80211_rx_data *rx)
 {
         struct ieee80211_local *local = rx->local;
@@ -394,14 +421,11 @@ ieee80211_rx_h_passive_scan(struct ieee80211_rx_data *rx)
 static ieee80211_rx_result
 ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
 {
-        int hdrlen = ieee80211_get_hdrlen(rx->fc);
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) rx->skb->data;
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
+        unsigned int hdrlen = ieee80211_hdrlen(hdr->frame_control);
 
-#define msh_h_get(h, l) ((struct ieee80211s_hdr *) ((u8 *)h + l))
-
-        if ((rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA) {
-                if (!((rx->fc & IEEE80211_FCTL_FROMDS) &&
-                      (rx->fc & IEEE80211_FCTL_TODS)))
+        if (ieee80211_is_data(hdr->frame_control)) {
+                if (!ieee80211_has_a4(hdr->frame_control))
                         return RX_DROP_MONITOR;
                 if (memcmp(hdr->addr4, rx->dev->dev_addr, ETH_ALEN) == 0)
                         return RX_DROP_MONITOR;
@@ -414,27 +438,30 @@ ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
         if (!rx->sta || sta_plink_state(rx->sta) != PLINK_ESTAB) {
                 struct ieee80211_mgmt *mgmt;
 
-                if ((rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_MGMT)
+                if (!ieee80211_is_mgmt(hdr->frame_control))
                         return RX_DROP_MONITOR;
 
-                switch (rx->fc & IEEE80211_FCTL_STYPE) {
-                case IEEE80211_STYPE_ACTION:
+                if (ieee80211_is_action(hdr->frame_control)) {
                         mgmt = (struct ieee80211_mgmt *)hdr;
                         if (mgmt->u.action.category != PLINK_CATEGORY)
                                 return RX_DROP_MONITOR;
-                        /* fall through on else */
-                case IEEE80211_STYPE_PROBE_REQ:
-                case IEEE80211_STYPE_PROBE_RESP:
-                case IEEE80211_STYPE_BEACON:
                         return RX_CONTINUE;
-                        break;
-                default:
-                        return RX_DROP_MONITOR;
                 }
 
-         } else if ((rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA &&
-                    is_multicast_ether_addr(hdr->addr1) &&
-                    mesh_rmc_check(hdr->addr4, msh_h_get(hdr, hdrlen), rx->dev))
+                if (ieee80211_is_probe_req(hdr->frame_control) ||
+                    ieee80211_is_probe_resp(hdr->frame_control) ||
+                    ieee80211_is_beacon(hdr->frame_control))
+                        return RX_CONTINUE;
+
+                return RX_DROP_MONITOR;
+
+        }
+
+#define msh_h_get(h, l) ((struct ieee80211s_hdr *) ((u8 *)h + l))
+
+        if (ieee80211_is_data(hdr->frame_control) &&
+            is_multicast_ether_addr(hdr->addr1) &&
+            mesh_rmc_check(hdr->addr4, msh_h_get(hdr, hdrlen), rx->dev))
                 return RX_DROP_MONITOR;
 #undef msh_h_get
 
@@ -442,16 +469,14 @@ ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
 }
 
 
-static ieee80211_rx_result
+static ieee80211_rx_result debug_noinline
 ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
 {
-        struct ieee80211_hdr *hdr;
-
-        hdr = (struct ieee80211_hdr *) rx->skb->data;
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
 
         /* Drop duplicate 802.11 retransmissions (IEEE 802.11 Chap. 9.2.9) */
         if (rx->sta && !is_multicast_ether_addr(hdr->addr1)) {
-                if (unlikely(rx->fc & IEEE80211_FCTL_RETRY &&
+                if (unlikely(ieee80211_has_retry(hdr->frame_control) &&
                              rx->sta->last_seq_ctrl[rx->queue] ==
                              hdr->seq_ctrl)) {
                         if (rx->flags & IEEE80211_RX_RA_MATCH) {
@@ -480,15 +505,14 @@ ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
         if (ieee80211_vif_is_mesh(&rx->sdata->vif))
                 return ieee80211_rx_mesh_check(rx);
 
-        if (unlikely(((rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA ||
-                      ((rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_CTL &&
-                       (rx->fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_PSPOLL)) &&
+        if (unlikely((ieee80211_is_data(hdr->frame_control) ||
+                      ieee80211_is_pspoll(hdr->frame_control)) &&
                      rx->sdata->vif.type != IEEE80211_IF_TYPE_IBSS &&
-                     (!rx->sta || !(rx->sta->flags & WLAN_STA_ASSOC)))) {
-                if ((!(rx->fc & IEEE80211_FCTL_FROMDS) &&
-                     !(rx->fc & IEEE80211_FCTL_TODS) &&
-                     (rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA)
-                    || !(rx->flags & IEEE80211_RX_RA_MATCH)) {
+                     (!rx->sta || !test_sta_flags(rx->sta, WLAN_STA_ASSOC)))) {
+                if ((!ieee80211_has_fromds(hdr->frame_control) &&
+                     !ieee80211_has_tods(hdr->frame_control) &&
+                     ieee80211_is_data(hdr->frame_control)) ||
+                    !(rx->flags & IEEE80211_RX_RA_MATCH)) {
                         /* Drop IBSS frames and frames for other hosts
                          * silently. */
                         return RX_DROP_MONITOR;
@@ -501,10 +525,10 @@ ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
 }
 
 
-static ieee80211_rx_result
+static ieee80211_rx_result debug_noinline
 ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
 {
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) rx->skb->data;
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
         int keyidx;
         int hdrlen;
         ieee80211_rx_result result = RX_DROP_UNUSABLE;
@@ -536,7 +560,7 @@ ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
          * possible.
          */
 
-        if (!(rx->fc & IEEE80211_FCTL_PROTECTED))
+        if (!ieee80211_has_protected(hdr->frame_control))
                 return RX_CONTINUE;
 
         /*
@@ -565,7 +589,7 @@ ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
                     (rx->status->flag & RX_FLAG_IV_STRIPPED))
                         return RX_CONTINUE;
 
-                hdrlen = ieee80211_get_hdrlen(rx->fc);
+                hdrlen = ieee80211_hdrlen(hdr->frame_control);
 
                 if (rx->skb->len < 8 + hdrlen)
                         return RX_DROP_UNUSABLE; /* TODO: count this? */
@@ -592,17 +616,12 @@ ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
                 rx->key->tx_rx_count++;
                 /* TODO: add threshold stuff again */
         } else {
-#ifdef CONFIG_MAC80211_DEBUG
-                if (net_ratelimit())
-                        printk(KERN_DEBUG "%s: RX protected frame,"
-                               " but have no key\n", rx->dev->name);
-#endif /* CONFIG_MAC80211_DEBUG */
                 return RX_DROP_MONITOR;
         }
 
         /* Check for weak IVs if possible */
         if (rx->sta && rx->key->conf.alg == ALG_WEP &&
-            ((rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA) &&
+            ieee80211_is_data(hdr->frame_control) &&
             (!(rx->status->flag & RX_FLAG_IV_STRIPPED) ||
              !(rx->status->flag & RX_FLAG_DECRYPTED)) &&
             ieee80211_wep_is_weak_iv(rx->skb, rx->key))
@@ -633,10 +652,8 @@ static void ap_sta_ps_start(struct net_device *dev, struct sta_info *sta)
 
         sdata = sta->sdata;
 
-        if (sdata->bss)
-                atomic_inc(&sdata->bss->num_sta_ps);
-        sta->flags |= WLAN_STA_PS;
-        sta->flags &= ~WLAN_STA_PSPOLL;
+        atomic_inc(&sdata->bss->num_sta_ps);
+        set_and_clear_sta_flags(sta, WLAN_STA_PS, WLAN_STA_PSPOLL);
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
         printk(KERN_DEBUG "%s: STA %s aid %d enters power save mode\n",
                dev->name, print_mac(mac, sta->addr), sta->aid);
@@ -649,15 +666,14 @@ static int ap_sta_ps_end(struct net_device *dev, struct sta_info *sta)
         struct sk_buff *skb;
         int sent = 0;
         struct ieee80211_sub_if_data *sdata;
-        struct ieee80211_tx_packet_data *pkt_data;
+        struct ieee80211_tx_info *info;
         DECLARE_MAC_BUF(mac);
 
         sdata = sta->sdata;
 
-        if (sdata->bss)
-                atomic_dec(&sdata->bss->num_sta_ps);
+        atomic_dec(&sdata->bss->num_sta_ps);
 
-        sta->flags &= ~(WLAN_STA_PS | WLAN_STA_PSPOLL);
+        clear_sta_flags(sta, WLAN_STA_PS | WLAN_STA_PSPOLL);
 
         if (!skb_queue_empty(&sta->ps_tx_buf))
                 sta_info_clear_tim_bit(sta);
@@ -669,13 +685,13 @@ static int ap_sta_ps_end(struct net_device *dev, struct sta_info *sta)
 
         /* Send all buffered frames to the station */
         while ((skb = skb_dequeue(&sta->tx_filtered)) != NULL) {
-                pkt_data = (struct ieee80211_tx_packet_data *) skb->cb;
+                info = IEEE80211_SKB_CB(skb);
                 sent++;
-                pkt_data->flags |= IEEE80211_TXPD_REQUEUE;
+                info->flags |= IEEE80211_TX_CTL_REQUEUE;
                 dev_queue_xmit(skb);
         }
         while ((skb = skb_dequeue(&sta->ps_tx_buf)) != NULL) {
-                pkt_data = (struct ieee80211_tx_packet_data *) skb->cb;
+                info = IEEE80211_SKB_CB(skb);
                 local->total_ps_buffered--;
                 sent++;
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
@@ -683,19 +699,19 @@ static int ap_sta_ps_end(struct net_device *dev, struct sta_info *sta)
                        "since STA not sleeping anymore\n", dev->name,
                        print_mac(mac, sta->addr), sta->aid);
 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
-                pkt_data->flags |= IEEE80211_TXPD_REQUEUE;
+                info->flags |= IEEE80211_TX_CTL_REQUEUE;
                 dev_queue_xmit(skb);
         }
 
         return sent;
 }
 
-static ieee80211_rx_result
+static ieee80211_rx_result debug_noinline
 ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
 {
         struct sta_info *sta = rx->sta;
         struct net_device *dev = rx->dev;
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) rx->skb->data;
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
 
         if (!sta)
                 return RX_CONTINUE;
@@ -725,24 +741,26 @@ ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
 
         sta->rx_fragments++;
         sta->rx_bytes += rx->skb->len;
-        sta->last_rssi = rx->status->ssi;
         sta->last_signal = rx->status->signal;
+        sta->last_qual = rx->status->qual;
         sta->last_noise = rx->status->noise;
 
-        if (!(rx->fc & IEEE80211_FCTL_MOREFRAGS)) {
+        if (!ieee80211_has_morefrags(hdr->frame_control) &&
+            (rx->sdata->vif.type == IEEE80211_IF_TYPE_AP ||
+             rx->sdata->vif.type == IEEE80211_IF_TYPE_VLAN)) {
                 /* Change STA power saving mode only in the end of a frame
                  * exchange sequence */
-                if ((sta->flags & WLAN_STA_PS) && !(rx->fc & IEEE80211_FCTL_PM))
+                if (test_sta_flags(sta, WLAN_STA_PS) &&
+                    !ieee80211_has_pm(hdr->frame_control))
                         rx->sent_ps_buffered += ap_sta_ps_end(dev, sta);
-                else if (!(sta->flags & WLAN_STA_PS) &&
-                         (rx->fc & IEEE80211_FCTL_PM))
+                else if (!test_sta_flags(sta, WLAN_STA_PS) &&
+                         ieee80211_has_pm(hdr->frame_control))
                         ap_sta_ps_start(dev, sta);
         }
 
         /* Drop data::nullfunc frames silently, since they are used only to
          * control station power saving mode. */
-        if ((rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA &&
-            (rx->fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_NULLFUNC) {
+        if (ieee80211_is_nullfunc(hdr->frame_control)) {
                 I802_DEBUG_INC(rx->local->rx_handlers_drop_nullfunc);
                 /* Update counter and free packet here to avoid counting this
                  * as a dropped packed. */
@@ -768,7 +786,7 @@ ieee80211_reassemble_add(struct ieee80211_sub_if_data *sdata,
                 sdata->fragment_next = 0;
 
         if (!skb_queue_empty(&entry->skb_list)) {
-#ifdef CONFIG_MAC80211_DEBUG
+#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
                 struct ieee80211_hdr *hdr =
                         (struct ieee80211_hdr *) entry->skb_list.next->data;
                 DECLARE_MAC_BUF(mac);
@@ -780,7 +798,7 @@ ieee80211_reassemble_add(struct ieee80211_sub_if_data *sdata,
                        jiffies - entry->first_frag_time, entry->seq,
                        entry->last_frag, print_mac(mac, hdr->addr1),
                        print_mac(mac2, hdr->addr2));
-#endif /* CONFIG_MAC80211_DEBUG */
+#endif
                 __skb_queue_purge(&entry->skb_list);
         }
 
@@ -837,7 +855,7 @@ ieee80211_reassemble_find(struct ieee80211_sub_if_data *sdata,
         return NULL;
 }
 
-static ieee80211_rx_result
+static ieee80211_rx_result debug_noinline
 ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
 {
         struct ieee80211_hdr *hdr;
@@ -901,18 +919,8 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
                                 break;
                 }
                 rpn = rx->key->u.ccmp.rx_pn[rx->queue];
-                if (memcmp(pn, rpn, CCMP_PN_LEN) != 0) {
-                        if (net_ratelimit())
-                                printk(KERN_DEBUG "%s: defrag: CCMP PN not "
-                                       "sequential A2=%s"
-                                       " PN=%02x%02x%02x%02x%02x%02x "
-                                       "(expected %02x%02x%02x%02x%02x%02x)\n",
-                                       rx->dev->name, print_mac(mac, hdr->addr2),
-                                       rpn[0], rpn[1], rpn[2], rpn[3], rpn[4],
-                                       rpn[5], pn[0], pn[1], pn[2], pn[3],
-                                       pn[4], pn[5]);
+                if (memcmp(pn, rpn, CCMP_PN_LEN))
                         return RX_DROP_UNUSABLE;
-                }
                 memcpy(entry->last_pn, pn, CCMP_PN_LEN);
         }
 
@@ -953,7 +961,7 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
         return RX_CONTINUE;
 }
 
-static ieee80211_rx_result
+static ieee80211_rx_result debug_noinline
 ieee80211_rx_h_ps_poll(struct ieee80211_rx_data *rx)
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(rx->dev);
@@ -988,7 +996,7 @@ ieee80211_rx_h_ps_poll(struct ieee80211_rx_data *rx)
                  * Tell TX path to send one frame even though the STA may
                  * still remain is PS mode after this frame exchange.
                  */
-                rx->sta->flags |= WLAN_STA_PSPOLL;
+                set_sta_flags(rx->sta, WLAN_STA_PSPOLL);
 
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
                 printk(KERN_DEBUG "STA %s aid %d: PS Poll (entries after %d)\n",
@@ -1016,7 +1024,7 @@ ieee80211_rx_h_ps_poll(struct ieee80211_rx_data *rx)
                  *        have nothing buffered for it?
                  */
                 printk(KERN_DEBUG "%s: STA %s sent PS Poll even "
-                       "though there is no buffered frames for it\n",
+                       "though there are no buffered frames for it\n",
                        rx->dev->name, print_mac(mac, rx->sta->addr));
 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
         }
@@ -1028,22 +1036,22 @@ ieee80211_rx_h_ps_poll(struct ieee80211_rx_data *rx)
         return RX_QUEUED;
 }
 
-static ieee80211_rx_result
+static ieee80211_rx_result debug_noinline
 ieee80211_rx_h_remove_qos_control(struct ieee80211_rx_data *rx)
 {
-        u16 fc = rx->fc;
         u8 *data = rx->skb->data;
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) data;
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)data;
 
-        if (!WLAN_FC_IS_QOS_DATA(fc))
+        if (!ieee80211_is_data_qos(hdr->frame_control))
                 return RX_CONTINUE;
 
         /* remove the qos control field, update frame type and meta-data */
-        memmove(data + 2, data, ieee80211_get_hdrlen(fc) - 2);
-        hdr = (struct ieee80211_hdr *) skb_pull(rx->skb, 2);
+        memmove(data + IEEE80211_QOS_CTL_LEN, data,
+                ieee80211_hdrlen(hdr->frame_control) - IEEE80211_QOS_CTL_LEN);
+        hdr = (struct ieee80211_hdr *)skb_pull(rx->skb, IEEE80211_QOS_CTL_LEN);
         /* change frame type to non QOS */
-        rx->fc = fc &= ~IEEE80211_STYPE_QOS_DATA;
-        hdr->frame_control = cpu_to_le16(fc);
+        rx->fc &= ~IEEE80211_STYPE_QOS_DATA;
+        hdr->frame_control &= ~cpu_to_le16(IEEE80211_STYPE_QOS_DATA);
 
         return RX_CONTINUE;
 }
@@ -1051,14 +1059,9 @@ ieee80211_rx_h_remove_qos_control(struct ieee80211_rx_data *rx)
 static int
 ieee80211_802_1x_port_control(struct ieee80211_rx_data *rx)
 {
-        if (unlikely(!rx->sta || !(rx->sta->flags & WLAN_STA_AUTHORIZED))) {
-#ifdef CONFIG_MAC80211_DEBUG
-                if (net_ratelimit())
-                        printk(KERN_DEBUG "%s: dropped frame "
-                               "(unauthorized port)\n", rx->dev->name);
-#endif /* CONFIG_MAC80211_DEBUG */
+        if (unlikely(!rx->sta ||
+            !test_sta_flags(rx->sta, WLAN_STA_AUTHORIZED)))
                 return -EACCES;
-        }
 
         return 0;
 }
@@ -1138,16 +1141,8 @@ ieee80211_data_to_8023(struct ieee80211_rx_data *rx)
                 memcpy(src, hdr->addr2, ETH_ALEN);
 
                 if (unlikely(sdata->vif.type != IEEE80211_IF_TYPE_AP &&
-                             sdata->vif.type != IEEE80211_IF_TYPE_VLAN)) {
-                        if (net_ratelimit())
-                                printk(KERN_DEBUG "%s: dropped ToDS frame "
-                                       "(BSSID=%s SA=%s DA=%s)\n",
-                                       dev->name,
-                                       print_mac(mac, hdr->addr1),
-                                       print_mac(mac2, hdr->addr2),
-                                       print_mac(mac3, hdr->addr3));
+                             sdata->vif.type != IEEE80211_IF_TYPE_VLAN))
                         return -1;
-                }
                 break;
         case (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS):
                 /* RA TA DA SA */
@@ -1155,17 +1150,8 @@ ieee80211_data_to_8023(struct ieee80211_rx_data *rx)
                 memcpy(src, hdr->addr4, ETH_ALEN);
 
                  if (unlikely(sdata->vif.type != IEEE80211_IF_TYPE_WDS &&
-                             sdata->vif.type != IEEE80211_IF_TYPE_MESH_POINT)) {
-                         if (net_ratelimit())
-                                 printk(KERN_DEBUG "%s: dropped FromDS&ToDS "
-                                       "frame (RA=%s TA=%s DA=%s SA=%s)\n",
-                                       rx->dev->name,
-                                       print_mac(mac, hdr->addr1),
-                                       print_mac(mac2, hdr->addr2),
-                                       print_mac(mac3, hdr->addr3),
-                                       print_mac(mac4, hdr->addr4));
+                             sdata->vif.type != IEEE80211_IF_TYPE_MESH_POINT))
                         return -1;
-                }
                 break;
         case IEEE80211_FCTL_FROMDS:
                 /* DA BSSID SA */
@@ -1182,27 +1168,13 @@ ieee80211_data_to_8023(struct ieee80211_rx_data *rx)
                 memcpy(dst, hdr->addr1, ETH_ALEN);
                 memcpy(src, hdr->addr2, ETH_ALEN);
 
-                if (sdata->vif.type != IEEE80211_IF_TYPE_IBSS) {
-                        if (net_ratelimit()) {
-                                printk(KERN_DEBUG "%s: dropped IBSS frame "
-                                       "(DA=%s SA=%s BSSID=%s)\n",
-                                       dev->name,
-                                       print_mac(mac, hdr->addr1),
-                                       print_mac(mac2, hdr->addr2),
-                                       print_mac(mac3, hdr->addr3));
-                        }
+                if (sdata->vif.type != IEEE80211_IF_TYPE_IBSS)
                         return -1;
-                }
                 break;
         }
 
-        if (unlikely(skb->len - hdrlen < 8)) {
-                if (net_ratelimit()) {
-                        printk(KERN_DEBUG "%s: RX too short data frame "
-                               "payload\n", dev->name);
-                }
+        if (unlikely(skb->len - hdrlen < 8))
                 return -1;
-        }
 
         payload = skb->data + hdrlen;
         ethertype = (payload[6] << 8) | payload[7];
@@ -1345,7 +1317,7 @@ ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
         }
 }
 
-static ieee80211_rx_result
+static ieee80211_rx_result debug_noinline
 ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
 {
         struct net_device *dev = rx->dev;
@@ -1394,10 +1366,8 @@ ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
 
                 padding = ((4 - subframe_len) & 0x3);
                 /* the last MSDU has no padding */
-                if (subframe_len > remaining) {
-                        printk(KERN_DEBUG "%s: wrong buffer size\n", dev->name);
+                if (subframe_len > remaining)
                         return RX_DROP_UNUSABLE;
-                }
 
                 skb_pull(skb, sizeof(struct ethhdr));
                 /* if last subframe reuse skb */
@@ -1418,8 +1388,6 @@ ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
                         eth = (struct ethhdr *) skb_pull(skb, ntohs(len) +
                                                         padding);
                         if (!eth) {
-                                printk(KERN_DEBUG "%s: wrong buffer size\n",
-                                       dev->name);
                                 dev_kfree_skb(frame);
                                 return RX_DROP_UNUSABLE;
                         }
@@ -1462,7 +1430,7 @@ ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
         return RX_QUEUED;
 }
 
-static ieee80211_rx_result
+static ieee80211_rx_result debug_noinline
 ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
 {
         struct net_device *dev = rx->dev;
@@ -1493,21 +1461,21 @@ ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
         return RX_QUEUED;
 }
 
-static ieee80211_rx_result
+static ieee80211_rx_result debug_noinline
 ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx)
 {
         struct ieee80211_local *local = rx->local;
         struct ieee80211_hw *hw = &local->hw;
         struct sk_buff *skb = rx->skb;
-        struct ieee80211_bar *bar = (struct ieee80211_bar *) skb->data;
+        struct ieee80211_bar *bar = (struct ieee80211_bar *)skb->data;
         struct tid_ampdu_rx *tid_agg_rx;
         u16 start_seq_num;
         u16 tid;
 
-        if (likely((rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_CTL))
+        if (likely(!ieee80211_is_ctl(bar->frame_control)))
                 return RX_CONTINUE;
 
-        if ((rx->fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_BACK_REQ) {
+        if (ieee80211_is_back_req(bar->frame_control)) {
                 if (!rx->sta)
                         return RX_CONTINUE;
                 tid = le16_to_cpu(bar->control) >> 12;
@@ -1537,7 +1505,7 @@ ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx)
         return RX_CONTINUE;
 }
 
-static ieee80211_rx_result
+static ieee80211_rx_result debug_noinline
 ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
 {
         struct ieee80211_sub_if_data *sdata;
@@ -1561,41 +1529,27 @@ static void ieee80211_rx_michael_mic_report(struct net_device *dev,
                                             struct ieee80211_hdr *hdr,
                                             struct ieee80211_rx_data *rx)
 {
-        int keyidx, hdrlen;
+        int keyidx;
+        unsigned int hdrlen;
         DECLARE_MAC_BUF(mac);
         DECLARE_MAC_BUF(mac2);
 
-        hdrlen = ieee80211_get_hdrlen_from_skb(rx->skb);
+        hdrlen = ieee80211_hdrlen(hdr->frame_control);
         if (rx->skb->len >= hdrlen + 4)
                 keyidx = rx->skb->data[hdrlen + 3] >> 6;
         else
                 keyidx = -1;
 
-        if (net_ratelimit())
-                printk(KERN_DEBUG "%s: TKIP hwaccel reported Michael MIC "
-                       "failure from %s to %s keyidx=%d\n",
-                       dev->name, print_mac(mac, hdr->addr2),
-                       print_mac(mac2, hdr->addr1), keyidx);
-
         if (!rx->sta) {
                 /*
                  * Some hardware seem to generate incorrect Michael MIC
                  * reports; ignore them to avoid triggering countermeasures.
                  */
-                if (net_ratelimit())
-                        printk(KERN_DEBUG "%s: ignored spurious Michael MIC "
-                               "error for unknown address %s\n",
-                               dev->name, print_mac(mac, hdr->addr2));
                 goto ignore;
         }
 
-        if (!(rx->fc & IEEE80211_FCTL_PROTECTED)) {
-                if (net_ratelimit())
-                        printk(KERN_DEBUG "%s: ignored spurious Michael MIC "
-                               "error for a frame with no PROTECTED flag (src "
-                               "%s)\n", dev->name, print_mac(mac, hdr->addr2));
+        if (!ieee80211_has_protected(hdr->frame_control))
                 goto ignore;
-        }
 
         if (rx->sdata->vif.type == IEEE80211_IF_TYPE_AP && keyidx) {
                 /*
@@ -1604,24 +1558,12 @@ static void ieee80211_rx_michael_mic_report(struct net_device *dev,
                  * group keys and only the AP is sending real multicast
                  * frames in the BSS.
                  */
-                if (net_ratelimit())
-                        printk(KERN_DEBUG "%s: ignored Michael MIC error for "
-                               "a frame with non-zero keyidx (%d)"
-                               " (src %s)\n", dev->name, keyidx,
-                               print_mac(mac, hdr->addr2));
                 goto ignore;
         }
 
-        if ((rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA &&
-            ((rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_MGMT ||
-             (rx->fc & IEEE80211_FCTL_STYPE) != IEEE80211_STYPE_AUTH)) {
-                if (net_ratelimit())
-                        printk(KERN_DEBUG "%s: ignored spurious Michael MIC "
-                               "error for a frame that cannot be encrypted "
-                               "(fc=0x%04x) (src %s)\n",
-                               dev->name, rx->fc, print_mac(mac, hdr->addr2));
+        if (!ieee80211_is_data(hdr->frame_control) &&
+            !ieee80211_is_auth(hdr->frame_control))
                 goto ignore;
-        }
 
         mac80211_ev_michael_mic_failure(rx->dev, keyidx, hdr);
  ignore:
@@ -1710,67 +1652,57 @@ static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx)
         dev_kfree_skb(skb);
 }
 
-typedef ieee80211_rx_result (*ieee80211_rx_handler)(struct ieee80211_rx_data *);
-static ieee80211_rx_handler ieee80211_rx_handlers[] =
-{
-        ieee80211_rx_h_if_stats,
-        ieee80211_rx_h_passive_scan,
-        ieee80211_rx_h_check,
-        ieee80211_rx_h_decrypt,
-        ieee80211_rx_h_sta_process,
-        ieee80211_rx_h_defragment,
-        ieee80211_rx_h_ps_poll,
-        ieee80211_rx_h_michael_mic_verify,
-        /* this must be after decryption - so header is counted in MPDU mic
-         * must be before pae and data, so QOS_DATA format frames
-         * are not passed to user space by these functions
-         */
-        ieee80211_rx_h_remove_qos_control,
-        ieee80211_rx_h_amsdu,
-        ieee80211_rx_h_data,
-        ieee80211_rx_h_ctrl,
-        ieee80211_rx_h_mgmt,
-        NULL
-};
 
 static void ieee80211_invoke_rx_handlers(struct ieee80211_sub_if_data *sdata,
                                          struct ieee80211_rx_data *rx,
                                          struct sk_buff *skb)
 {
-        ieee80211_rx_handler *handler;
         ieee80211_rx_result res = RX_DROP_MONITOR;
 
         rx->skb = skb;
         rx->sdata = sdata;
         rx->dev = sdata->dev;
 
-        for (handler = ieee80211_rx_handlers; *handler != NULL; handler++) {
-                res = (*handler)(rx);
-
-                switch (res) {
-                case RX_CONTINUE:
-                        continue;
-                case RX_DROP_UNUSABLE:
-                case RX_DROP_MONITOR:
-                        I802_DEBUG_INC(sdata->local->rx_handlers_drop);
-                        if (rx->sta)
-                                rx->sta->rx_dropped++;
-                        break;
-                case RX_QUEUED:
-                        I802_DEBUG_INC(sdata->local->rx_handlers_queued);
-                        break;
-                }
-                break;
-        }
-
+#define CALL_RXH(rxh)           \
+        res = rxh(rx);          \
+        if (res != RX_CONTINUE) \
+                goto rxh_done;
+
+        CALL_RXH(ieee80211_rx_h_passive_scan)
+        CALL_RXH(ieee80211_rx_h_check)
+        CALL_RXH(ieee80211_rx_h_decrypt)
+        CALL_RXH(ieee80211_rx_h_sta_process)
+        CALL_RXH(ieee80211_rx_h_defragment)
+        CALL_RXH(ieee80211_rx_h_ps_poll)
+        CALL_RXH(ieee80211_rx_h_michael_mic_verify)
+        /* must be after MMIC verify so header is counted in MPDU mic */
+        CALL_RXH(ieee80211_rx_h_remove_qos_control)
+        CALL_RXH(ieee80211_rx_h_amsdu)
+        CALL_RXH(ieee80211_rx_h_data)
+        CALL_RXH(ieee80211_rx_h_ctrl)
+        CALL_RXH(ieee80211_rx_h_mgmt)
+
+#undef CALL_RXH
+
+ rxh_done:
         switch (res) {
-        case RX_CONTINUE:
         case RX_DROP_MONITOR:
+                I802_DEBUG_INC(sdata->local->rx_handlers_drop);
+                if (rx->sta)
+                        rx->sta->rx_dropped++;
+                /* fall through */
+        case RX_CONTINUE:
                 ieee80211_rx_cooked_monitor(rx);
                 break;
         case RX_DROP_UNUSABLE:
+                I802_DEBUG_INC(sdata->local->rx_handlers_drop);
+                if (rx->sta)
+                        rx->sta->rx_dropped++;
                 dev_kfree_skb(rx->skb);
                 break;
+        case RX_QUEUED:
+                I802_DEBUG_INC(sdata->local->rx_handlers_queued);
+                break;
         }
 }
 
@@ -1801,9 +1733,13 @@ static int prepare_for_handlers(struct ieee80211_sub_if_data *sdata,
         case IEEE80211_IF_TYPE_IBSS:
                 if (!bssid)
                         return 0;
-                if ((rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_MGMT &&
-                    (rx->fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_BEACON)
+                if (ieee80211_is_beacon(hdr->frame_control)) {
+                        if (!rx->sta)
+                                rx->sta = ieee80211_ibss_add_sta(sdata->dev,
+                                                rx->skb, bssid, hdr->addr2,
+                                                BIT(rx->status->rate_idx));
                         return 1;
+                }
                 else if (!ieee80211_bssid_match(bssid, sdata->u.sta.bssid)) {
                         if (!(rx->flags & IEEE80211_RX_IN_SCAN))
                                 return 0;
@@ -1816,7 +1752,8 @@ static int prepare_for_handlers(struct ieee80211_sub_if_data *sdata,
                         rx->flags &= ~IEEE80211_RX_RA_MATCH;
                 } else if (!rx->sta)
                         rx->sta = ieee80211_ibss_add_sta(sdata->dev, rx->skb,
-                                                         bssid, hdr->addr2);
+                                                bssid, hdr->addr2,
+                                                BIT(rx->status->rate_idx));
                 break;
         case IEEE80211_IF_TYPE_MESH_POINT:
                 if (!multicast &&
@@ -1840,15 +1777,9 @@ static int prepare_for_handlers(struct ieee80211_sub_if_data *sdata,
                                 return 0;
                         rx->flags &= ~IEEE80211_RX_RA_MATCH;
                 }
-                if (sdata->dev == sdata->local->mdev &&
-                    !(rx->flags & IEEE80211_RX_IN_SCAN))
-                        /* do not receive anything via
-                         * master device when not scanning */
-                        return 0;
                 break;
         case IEEE80211_IF_TYPE_WDS:
-                if (bssid ||
-                    (rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA)
+                if (bssid || !ieee80211_is_data(hdr->frame_control))
                         return 0;
                 if (compare_ether_addr(sdata->u.wds.remote_addr, hdr->addr2))
                         return 0;
@@ -1872,7 +1803,6 @@ static int prepare_for_handlers(struct ieee80211_sub_if_data *sdata,
 static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
                                          struct sk_buff *skb,
                                          struct ieee80211_rx_status *status,
-                                         u32 load,
                                          struct ieee80211_rate *rate)
 {
         struct ieee80211_local *local = hw_to_local(hw);
@@ -1891,7 +1821,6 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
         rx.local = local;
 
         rx.status = status;
-        rx.load = load;
         rx.rate = rate;
         rx.fc = le16_to_cpu(hdr->frame_control);
         type = rx.fc & IEEE80211_FCTL_FTYPE;
@@ -2000,7 +1929,6 @@ u8 ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
         struct ieee80211_rx_status status;
         u16 head_seq_num, buf_size;
         int index;
-        u32 pkt_load;
         struct ieee80211_supported_band *sband;
         struct ieee80211_rate *rate;
 
@@ -2035,12 +1963,9 @@ u8 ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
                                         sizeof(status));
                                 sband = local->hw.wiphy->bands[status.band];
                                 rate = &sband->bitrates[status.rate_idx];
-                                pkt_load = ieee80211_rx_load_stats(local,
-                                                tid_agg_rx->reorder_buf[index],
-                                                &status, rate);
                                 __ieee80211_rx_handle_packet(hw,
                                         tid_agg_rx->reorder_buf[index],
-                                        &status, pkt_load, rate);
+                                        &status, rate);
                                 tid_agg_rx->stored_mpdu_num--;
                                 tid_agg_rx->reorder_buf[index] = NULL;
                         }
@@ -2082,11 +2007,8 @@ u8 ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
                         sizeof(status));
                 sband = local->hw.wiphy->bands[status.band];
                 rate = &sband->bitrates[status.rate_idx];
-                pkt_load = ieee80211_rx_load_stats(local,
-                                        tid_agg_rx->reorder_buf[index],
-                                        &status, rate);
                 __ieee80211_rx_handle_packet(hw, tid_agg_rx->reorder_buf[index],
-                                             &status, pkt_load, rate);
+                                             &status, rate);
                 tid_agg_rx->stored_mpdu_num--;
                 tid_agg_rx->reorder_buf[index] = NULL;
                 tid_agg_rx->head_seq_num = seq_inc(tid_agg_rx->head_seq_num);
@@ -2103,32 +2025,29 @@ static u8 ieee80211_rx_reorder_ampdu(struct ieee80211_local *local,
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
         struct sta_info *sta;
         struct tid_ampdu_rx *tid_agg_rx;
-        u16 fc, sc;
+        u16 sc;
         u16 mpdu_seq_num;
-        u8 ret = 0, *qc;
+        u8 ret = 0;
         int tid;
 
         sta = sta_info_get(local, hdr->addr2);
         if (!sta)
                 return ret;
 
-        fc = le16_to_cpu(hdr->frame_control);
-
         /* filter the QoS data rx stream according to
          * STA/TID and check if this STA/TID is on aggregation */
-        if (!WLAN_FC_IS_QOS_DATA(fc))
+        if (!ieee80211_is_data_qos(hdr->frame_control))
                 goto end_reorder;
 
-        qc = skb->data + ieee80211_get_hdrlen(fc) - QOS_CONTROL_LEN;
-        tid = qc[0] & QOS_CONTROL_TID_MASK;
+        tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK;
 
         if (sta->ampdu_mlme.tid_state_rx[tid] != HT_AGG_STATE_OPERATIONAL)
                 goto end_reorder;
 
         tid_agg_rx = sta->ampdu_mlme.tid_rx[tid];
 
-        /* null data frames are excluded */
-        if (unlikely(fc & IEEE80211_STYPE_NULLFUNC))
+        /* qos null data frames are excluded */
+        if (unlikely(hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_NULLFUNC)))
                 goto end_reorder;
 
         /* new un-ordered ampdu frame - process it */
@@ -2165,7 +2084,6 @@ void __ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb,
                     struct ieee80211_rx_status *status)
 {
         struct ieee80211_local *local = hw_to_local(hw);
-        u32 pkt_load;
         struct ieee80211_rate *rate = NULL;
         struct ieee80211_supported_band *sband;
 
@@ -2205,11 +2123,8 @@ void __ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb,
                 return;
         }
 
-        pkt_load = ieee80211_rx_load_stats(local, skb, status, rate);
-        local->channel_use_raw += pkt_load;
-
         if (!ieee80211_rx_reorder_ampdu(local, skb))
-                __ieee80211_rx_handle_packet(hw, skb, status, pkt_load, rate);
+                __ieee80211_rx_handle_packet(hw, skb, status, rate);
 
         rcu_read_unlock();
 }
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index 7d4fe4a52929..f2ba653b9d69 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -135,6 +135,7 @@ struct sta_info *sta_info_get_by_idx(struct ieee80211_local *local, int idx,
 /**
  * __sta_info_free - internal STA free helper
  *
+ * @local: pointer to the global information
  * @sta: STA info to free
  *
  * This function must undo everything done by sta_info_alloc()
@@ -202,14 +203,12 @@ void sta_info_destroy(struct sta_info *sta)
                 dev_kfree_skb_any(skb);
 
         for (i = 0; i <  STA_TID_NUM; i++) {
-                spin_lock_bh(&sta->ampdu_mlme.ampdu_rx);
+                spin_lock_bh(&sta->lock);
                 if (sta->ampdu_mlme.tid_rx[i])
                   del_timer_sync(&sta->ampdu_mlme.tid_rx[i]->session_timer);
-                spin_unlock_bh(&sta->ampdu_mlme.ampdu_rx);
-                spin_lock_bh(&sta->ampdu_mlme.ampdu_tx);
                 if (sta->ampdu_mlme.tid_tx[i])
                   del_timer_sync(&sta->ampdu_mlme.tid_tx[i]->addba_resp_timer);
-                spin_unlock_bh(&sta->ampdu_mlme.ampdu_tx);
+                spin_unlock_bh(&sta->lock);
         }
 
         __sta_info_free(local, sta);
@@ -236,6 +235,9 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
         if (!sta)
                 return NULL;
 
+        spin_lock_init(&sta->lock);
+        spin_lock_init(&sta->flaglock);
+
         memcpy(sta->addr, addr, ETH_ALEN);
         sta->local = local;
         sta->sdata = sdata;
@@ -249,15 +251,13 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
                 return NULL;
         }
 
-        spin_lock_init(&sta->ampdu_mlme.ampdu_rx);
-        spin_lock_init(&sta->ampdu_mlme.ampdu_tx);
         for (i = 0; i < STA_TID_NUM; i++) {
                 /* timer_to_tid must be initialized with identity mapping to
                  * enable session_timer's data differentiation. refer to
                  * sta_rx_agg_session_timer_expired for useage */
                 sta->timer_to_tid[i] = i;
                 /* tid to tx queue: initialize according to HW (0 is valid) */
-                sta->tid_to_tx_q[i] = local->hw.queues;
+                sta->tid_to_tx_q[i] = ieee80211_num_queues(&local->hw);
                 /* rx */
                 sta->ampdu_mlme.tid_state_rx[i] = HT_AGG_STATE_IDLE;
                 sta->ampdu_mlme.tid_rx[i] = NULL;
@@ -276,7 +276,6 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
 
 #ifdef CONFIG_MAC80211_MESH
         sta->plink_state = PLINK_LISTEN;
-        spin_lock_init(&sta->plink_lock);
         init_timer(&sta->plink_timer);
 #endif
 
@@ -321,7 +320,9 @@ int sta_info_insert(struct sta_info *sta)
         /* notify driver */
         if (local->ops->sta_notify) {
                 if (sdata->vif.type == IEEE80211_IF_TYPE_VLAN)
-                        sdata = sdata->u.vlan.ap;
+                        sdata = container_of(sdata->bss,
+                                             struct ieee80211_sub_if_data,
+                                             u.ap);
 
                 local->ops->sta_notify(local_to_hw(local), &sdata->vif,
                                        STA_NOTIFY_ADD, sta->addr);
@@ -376,8 +377,10 @@ static inline void __bss_tim_clear(struct ieee80211_if_ap *bss, u16 aid)
 static void __sta_info_set_tim_bit(struct ieee80211_if_ap *bss,
                                    struct sta_info *sta)
 {
-        if (bss)
-                __bss_tim_set(bss, sta->aid);
+        BUG_ON(!bss);
+
+        __bss_tim_set(bss, sta->aid);
+
         if (sta->local->ops->set_tim) {
                 sta->local->tim_in_locked_section = true;
                 sta->local->ops->set_tim(local_to_hw(sta->local), sta->aid, 1);
@@ -389,6 +392,8 @@ void sta_info_set_tim_bit(struct sta_info *sta)
 {
         unsigned long flags;
 
+        BUG_ON(!sta->sdata->bss);
+
         spin_lock_irqsave(&sta->local->sta_lock, flags);
         __sta_info_set_tim_bit(sta->sdata->bss, sta);
         spin_unlock_irqrestore(&sta->local->sta_lock, flags);
@@ -397,8 +402,10 @@ void sta_info_set_tim_bit(struct sta_info *sta)
 static void __sta_info_clear_tim_bit(struct ieee80211_if_ap *bss,
                                      struct sta_info *sta)
 {
-        if (bss)
-                __bss_tim_clear(bss, sta->aid);
+        BUG_ON(!bss);
+
+        __bss_tim_clear(bss, sta->aid);
+
         if (sta->local->ops->set_tim) {
                 sta->local->tim_in_locked_section = true;
                 sta->local->ops->set_tim(local_to_hw(sta->local), sta->aid, 0);
@@ -410,6 +417,8 @@ void sta_info_clear_tim_bit(struct sta_info *sta)
 {
         unsigned long flags;
 
+        BUG_ON(!sta->sdata->bss);
+
         spin_lock_irqsave(&sta->local->sta_lock, flags);
         __sta_info_clear_tim_bit(sta->sdata->bss, sta);
         spin_unlock_irqrestore(&sta->local->sta_lock, flags);
@@ -437,10 +446,10 @@ void __sta_info_unlink(struct sta_info **sta)
 
         list_del(&(*sta)->list);
 
-        if ((*sta)->flags & WLAN_STA_PS) {
-                (*sta)->flags &= ~WLAN_STA_PS;
-                if (sdata->bss)
-                        atomic_dec(&sdata->bss->num_sta_ps);
+        if (test_and_clear_sta_flags(*sta, WLAN_STA_PS)) {
+                BUG_ON(!sdata->bss);
+
+                atomic_dec(&sdata->bss->num_sta_ps);
                 __sta_info_clear_tim_bit(sdata->bss, *sta);
         }
 
@@ -448,7 +457,9 @@ void __sta_info_unlink(struct sta_info **sta)
 
         if (local->ops->sta_notify) {
                 if (sdata->vif.type == IEEE80211_IF_TYPE_VLAN)
-                        sdata = sdata->u.vlan.ap;
+                        sdata = container_of(sdata->bss,
+                                             struct ieee80211_sub_if_data,
+                                             u.ap);
 
                 local->ops->sta_notify(local_to_hw(local), &sdata->vif,
                                        STA_NOTIFY_REMOVE, (*sta)->addr);
@@ -515,20 +526,20 @@ static inline int sta_info_buffer_expired(struct ieee80211_local *local,
                                           struct sta_info *sta,
                                           struct sk_buff *skb)
 {
-        struct ieee80211_tx_packet_data *pkt_data;
+        struct ieee80211_tx_info *info;
         int timeout;
 
         if (!skb)
                 return 0;
 
-        pkt_data = (struct ieee80211_tx_packet_data *) skb->cb;
+        info = IEEE80211_SKB_CB(skb);
 
         /* Timeout: (2 * listen_interval * beacon_int * 1024 / 1000000) sec */
         timeout = (sta->listen_interval * local->hw.conf.beacon_int * 32 /
                    15625) * HZ;
         if (timeout < STA_TX_BUFFER_EXPIRE)
                 timeout = STA_TX_BUFFER_EXPIRE;
-        return time_after(jiffies, pkt_data->jiffies + timeout);
+        return time_after(jiffies, info->control.jiffies + timeout);
 }
 
 
@@ -557,8 +568,10 @@ static void sta_info_cleanup_expire_buffered(struct ieee80211_local *local,
 
                 sdata = sta->sdata;
                 local->total_ps_buffered--;
+#ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
                 printk(KERN_DEBUG "Buffered frame expired (STA "
                        "%s)\n", print_mac(mac, sta->addr));
+#endif
                 dev_kfree_skb(skb);
 
                 if (skb_queue_empty(&sta->ps_tx_buf))
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index f8c95bc9659c..109db787ccb7 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -32,7 +32,7 @@
  * @WLAN_STA_WDS: Station is one of our WDS peers.
  * @WLAN_STA_PSPOLL: Station has just PS-polled us.
  * @WLAN_STA_CLEAR_PS_FILT: Clear PS filter in hardware (using the
- *      IEEE80211_TXCTL_CLEAR_PS_FILT control flag) when the next
+ *      IEEE80211_TX_CTL_CLEAR_PS_FILT control flag) when the next
  *      frame to this station is transmitted.
  */
 enum ieee80211_sta_info_flags {
@@ -129,23 +129,19 @@ enum plink_state {
  *
  * @tid_state_rx: TID's state in Rx session state machine.
  * @tid_rx: aggregation info for Rx per TID
- * @ampdu_rx: for locking sections in aggregation Rx flow
  * @tid_state_tx: TID's state in Tx session state machine.
  * @tid_tx: aggregation info for Tx per TID
  * @addba_req_num: number of times addBA request has been sent.
- * @ampdu_tx: for locking sectionsi in aggregation Tx flow
  * @dialog_token_allocator: dialog token enumerator for each new session;
  */
 struct sta_ampdu_mlme {
         /* rx */
         u8 tid_state_rx[STA_TID_NUM];
         struct tid_ampdu_rx *tid_rx[STA_TID_NUM];
-        spinlock_t ampdu_rx;
         /* tx */
         u8 tid_state_tx[STA_TID_NUM];
         struct tid_ampdu_tx *tid_tx[STA_TID_NUM];
         u8 addba_req_num[STA_TID_NUM];
-        spinlock_t ampdu_tx;
         u8 dialog_token_allocator;
 };
 
@@ -164,9 +160,20 @@ struct sta_ampdu_mlme {
  * @list: global linked list entry
  * @hnext: hash table linked list pointer
  * @local: pointer to the global information
+ * @sdata: TBD
+ * @key: TBD
+ * @rate_ctrl: TBD
+ * @rate_ctrl_priv: TBD
+ * @lock: used for locking all fields that require locking, see comments
+ *      in the header file.
+ * @flaglock: spinlock for flags accesses
+ * @ht_info: HT capabilities of this STA
+ * @supp_rates: Bitmap of supported rates (per band)
  * @addr: MAC address of this STA
  * @aid: STA's unique AID (1..2007, 0 = not assigned yet),
  *      only used in AP (and IBSS?) mode
+ * @listen_interval: TBD
+ * @pin_status: TBD
  * @flags: STA flags, see &enum ieee80211_sta_info_flags
  * @ps_tx_buf: buffer of frames to transmit to this station
  *      when it leaves power saving state
@@ -175,8 +182,41 @@ struct sta_ampdu_mlme {
  *      power saving state
  * @rx_packets: Number of MSDUs received from this STA
  * @rx_bytes: Number of bytes received from this STA
- * @supp_rates: Bitmap of supported rates (per band)
- * @ht_info: HT capabilities of this STA
+ * @wep_weak_iv_count: TBD
+ * @last_rx: TBD
+ * @num_duplicates: number of duplicate frames received from this STA
+ * @rx_fragments: number of received MPDUs
+ * @rx_dropped: number of dropped MPDUs from this STA
+ * @last_signal: signal of last received frame from this STA
+ * @last_qual: qual of last received frame from this STA
+ * @last_noise: noise of last received frame from this STA
+ * @last_seq_ctrl: last received seq/frag number from this STA (per RX queue)
+ * @wme_rx_queue: TBD
+ * @tx_filtered_count: TBD
+ * @tx_retry_failed: TBD
+ * @tx_retry_count: TBD
+ * @tx_num_consecutive_failures: TBD
+ * @tx_num_mpdu_ok: TBD
+ * @tx_num_mpdu_fail: TBD
+ * @fail_avg: moving percentage of failed MSDUs
+ * @tx_packets: number of RX/TX MSDUs
+ * @tx_bytes: TBD
+ * @tx_fragments: number of transmitted MPDUs
+ * @txrate_idx: TBD
+ * @last_txrate_idx: TBD
+ * @wme_tx_queue: TBD
+ * @ampdu_mlme: TBD
+ * @timer_to_tid: identity mapping to ID timers
+ * @tid_to_tx_q: map tid to tx queue
+ * @llid: Local link ID
+ * @plid: Peer link ID
+ * @reason: Cancel reason on PLINK_HOLDING state
+ * @plink_retries: Retries in establishment
+ * @ignore_plink_timer: TBD
+ * @plink_state plink_state: TBD
+ * @plink_timeout: TBD
+ * @plink_timer: TBD
+ * @debugfs: debug filesystem info
  */
 struct sta_info {
         /* General information, mostly static */
@@ -187,6 +227,8 @@ struct sta_info {
         struct ieee80211_key *key;
         struct rate_control_ref *rate_ctrl;
         void *rate_ctrl_priv;
+        spinlock_t lock;
+        spinlock_t flaglock;
         struct ieee80211_ht_info ht_info;
         u64 supp_rates[IEEE80211_NUM_BANDS];
         u8 addr[ETH_ALEN];
@@ -199,7 +241,10 @@ struct sta_info {
          */
         u8 pin_status;
 
-        /* frequently updated information, needs locking? */
+        /*
+         * frequently updated, locked with own spinlock (flaglock),
+         * use the accessors defined below
+         */
         u32 flags;
 
         /*
@@ -213,14 +258,12 @@ struct sta_info {
         unsigned long rx_packets, rx_bytes;
         unsigned long wep_weak_iv_count;
         unsigned long last_rx;
-        unsigned long num_duplicates; /* number of duplicate frames received
-                                       * from this STA */
-        unsigned long rx_fragments; /* number of received MPDUs */
-        unsigned long rx_dropped; /* number of dropped MPDUs from this STA */
-        int last_rssi; /* RSSI of last received frame from this STA */
-        int last_signal; /* signal of last received frame from this STA */
-        int last_noise; /* noise of last received frame from this STA */
-        /* last received seq/frag number from this STA (per RX queue) */
+        unsigned long num_duplicates;
+        unsigned long rx_fragments;
+        unsigned long rx_dropped;
+        int last_signal;
+        int last_qual;
+        int last_noise;
         __le16 last_seq_ctrl[NUM_RX_DATA_QUEUES];
 #ifdef CONFIG_MAC80211_DEBUG_COUNTERS
         unsigned int wme_rx_queue[NUM_RX_DATA_QUEUES];
@@ -237,42 +280,36 @@ struct sta_info {
         unsigned int fail_avg;
 
         /* Updated from TX path only, no locking requirements */
-        unsigned long tx_packets; /* number of RX/TX MSDUs */
+        unsigned long tx_packets;
         unsigned long tx_bytes;
-        unsigned long tx_fragments; /* number of transmitted MPDUs */
+        unsigned long tx_fragments;
         int txrate_idx;
         int last_txrate_idx;
+        u16 tid_seq[IEEE80211_QOS_CTL_TID_MASK + 1];
 #ifdef CONFIG_MAC80211_DEBUG_COUNTERS
         unsigned int wme_tx_queue[NUM_RX_DATA_QUEUES];
 #endif
 
-        /* Debug counters, no locking doesn't matter */
-        int channel_use;
-        int channel_use_raw;
-
         /*
-         * Aggregation information, comes with own locking.
+         * Aggregation information, locked with lock.
          */
         struct sta_ampdu_mlme ampdu_mlme;
-        u8 timer_to_tid[STA_TID_NUM];   /* identity mapping to ID timers */
-        u8 tid_to_tx_q[STA_TID_NUM];    /* map tid to tx queue */
+        u8 timer_to_tid[STA_TID_NUM];
+        u8 tid_to_tx_q[STA_TID_NUM];
 
 #ifdef CONFIG_MAC80211_MESH
         /*
          * Mesh peer link attributes
          * TODO: move to a sub-structure that is referenced with pointer?
          */
-        __le16 llid;            /* Local link ID */
-        __le16 plid;            /* Peer link ID */
-        __le16 reason;          /* Cancel reason on PLINK_HOLDING state */
-        u8 plink_retries;       /* Retries in establishment */
+        __le16 llid;
+        __le16 plid;
+        __le16 reason;
+        u8 plink_retries;
         bool ignore_plink_timer;
         enum plink_state plink_state;
         u32 plink_timeout;
         struct timer_list plink_timer;
-        spinlock_t plink_lock;  /* For peer_state reads / updates and other
-                                   updates in the structure. Ensures robust
-                                   transitions for the peerlink FSM */
 #endif
 
 #ifdef CONFIG_MAC80211_DEBUGFS
@@ -299,6 +336,73 @@ static inline enum plink_state sta_plink_state(struct sta_info *sta)
         return PLINK_LISTEN;
 }
 
+static inline void set_sta_flags(struct sta_info *sta, const u32 flags)
+{
+        unsigned long irqfl;
+
+        spin_lock_irqsave(&sta->flaglock, irqfl);
+        sta->flags |= flags;
+        spin_unlock_irqrestore(&sta->flaglock, irqfl);
+}
+
+static inline void clear_sta_flags(struct sta_info *sta, const u32 flags)
+{
+        unsigned long irqfl;
+
+        spin_lock_irqsave(&sta->flaglock, irqfl);
+        sta->flags &= ~flags;
+        spin_unlock_irqrestore(&sta->flaglock, irqfl);
+}
+
+static inline void set_and_clear_sta_flags(struct sta_info *sta,
+                                           const u32 set, const u32 clear)
+{
+        unsigned long irqfl;
+
+        spin_lock_irqsave(&sta->flaglock, irqfl);
+        sta->flags |= set;
+        sta->flags &= ~clear;
+        spin_unlock_irqrestore(&sta->flaglock, irqfl);
+}
+
+static inline u32 test_sta_flags(struct sta_info *sta, const u32 flags)
+{
+        u32 ret;
+        unsigned long irqfl;
+
+        spin_lock_irqsave(&sta->flaglock, irqfl);
+        ret = sta->flags & flags;
+        spin_unlock_irqrestore(&sta->flaglock, irqfl);
+
+        return ret;
+}
+
+static inline u32 test_and_clear_sta_flags(struct sta_info *sta,
+                                           const u32 flags)
+{
+        u32 ret;
+        unsigned long irqfl;
+
+        spin_lock_irqsave(&sta->flaglock, irqfl);
+        ret = sta->flags & flags;
+        sta->flags &= ~flags;
+        spin_unlock_irqrestore(&sta->flaglock, irqfl);
+
+        return ret;
+}
+
+static inline u32 get_sta_flags(struct sta_info *sta)
+{
+        u32 ret;
+        unsigned long irqfl;
+
+        spin_lock_irqsave(&sta->flaglock, irqfl);
+        ret = sta->flags;
+        spin_unlock_irqrestore(&sta->flaglock, irqfl);
+
+        return ret;
+}
+
 
 /* Maximum number of concurrently registered stations */
 #define MAX_STA_COUNT 2007
diff --git a/net/mac80211/tkip.c b/net/mac80211/tkip.c
index 09093da24af6..995f7af3d25e 100644
--- a/net/mac80211/tkip.c
+++ b/net/mac80211/tkip.c
@@ -6,25 +6,23 @@
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  */
-
 #include <linux/kernel.h>
+#include <linux/bitops.h>
 #include <linux/types.h>
 #include <linux/netdevice.h>
+#include <asm/unaligned.h>
 
 #include <net/mac80211.h>
 #include "key.h"
 #include "tkip.h"
 #include "wep.h"
 
-
-/* TKIP key mixing functions */
-
-
 #define PHASE1_LOOP_COUNT 8
 
-
-/* 2-byte by 2-byte subset of the full AES S-box table; second part of this
- * table is identical to first part but byte-swapped */
+/*
+ * 2-byte by 2-byte subset of the full AES S-box table; second part of this
+ * table is identical to first part but byte-swapped
+ */
 static const u16 tkip_sbox[256] =
 {
         0xC6A5, 0xF884, 0xEE99, 0xF68D, 0xFF0D, 0xD6BD, 0xDEB1, 0x9154,
@@ -61,84 +59,54 @@ static const u16 tkip_sbox[256] =
         0x82C3, 0x29B0, 0x5A77, 0x1E11, 0x7BCB, 0xA8FC, 0x6DD6, 0x2C3A,
 };
 
-
-static inline u16 Mk16(u8 x, u8 y)
+static u16 tkipS(u16 val)
 {
-        return ((u16) x << 8) | (u16) y;
+        return tkip_sbox[val & 0xff] ^ swab16(tkip_sbox[val >> 8]);
 }
 
-
-static inline u8 Hi8(u16 v)
-{
-        return v >> 8;
-}
-
-
-static inline u8 Lo8(u16 v)
-{
-        return v & 0xff;
-}
-
-
-static inline u16 Hi16(u32 v)
-{
-        return v >> 16;
-}
-
-
-static inline u16 Lo16(u32 v)
-{
-        return v & 0xffff;
-}
-
-
-static inline u16 RotR1(u16 v)
-{
-        return (v >> 1) | ((v & 0x0001) << 15);
-}
-
-
-static inline u16 tkip_S(u16 val)
+static u8 *write_tkip_iv(u8 *pos, u16 iv16)
 {
-        u16 a = tkip_sbox[Hi8(val)];
-
-        return tkip_sbox[Lo8(val)] ^ Hi8(a) ^ (Lo8(a) << 8);
+        *pos++ = iv16 >> 8;
+        *pos++ = ((iv16 >> 8) | 0x20) & 0x7f;
+        *pos++ = iv16 & 0xFF;
+        return pos;
 }
 
-
-
-/* P1K := Phase1(TA, TK, TSC)
+/*
+ * P1K := Phase1(TA, TK, TSC)
  * TA = transmitter address (48 bits)
  * TK = dot11DefaultKeyValue or dot11KeyMappingValue (128 bits)
  * TSC = TKIP sequence counter (48 bits, only 32 msb bits used)
  * P1K: 80 bits
  */
-static void tkip_mixing_phase1(const u8 *ta, const u8 *tk, u32 tsc_IV32,
-                               u16 *p1k)
+static void tkip_mixing_phase1(const u8 *tk, struct tkip_ctx *ctx,
+                               const u8 *ta, u32 tsc_IV32)
 {
         int i, j;
+        u16 *p1k = ctx->p1k;
 
-        p1k[0] = Lo16(tsc_IV32);
-        p1k[1] = Hi16(tsc_IV32);
-        p1k[2] = Mk16(ta[1], ta[0]);
-        p1k[3] = Mk16(ta[3], ta[2]);
-        p1k[4] = Mk16(ta[5], ta[4]);
+        p1k[0] = tsc_IV32 & 0xFFFF;
+        p1k[1] = tsc_IV32 >> 16;
+        p1k[2] = get_unaligned_le16(ta + 0);
+        p1k[3] = get_unaligned_le16(ta + 2);
+        p1k[4] = get_unaligned_le16(ta + 4);
 
         for (i = 0; i < PHASE1_LOOP_COUNT; i++) {
                 j = 2 * (i & 1);
-                p1k[0] += tkip_S(p1k[4] ^ Mk16(tk[ 1 + j], tk[ 0 + j]));
-                p1k[1] += tkip_S(p1k[0] ^ Mk16(tk[ 5 + j], tk[ 4 + j]));
-                p1k[2] += tkip_S(p1k[1] ^ Mk16(tk[ 9 + j], tk[ 8 + j]));
-                p1k[3] += tkip_S(p1k[2] ^ Mk16(tk[13 + j], tk[12 + j]));
-                p1k[4] += tkip_S(p1k[3] ^ Mk16(tk[ 1 + j], tk[ 0 + j])) + i;
+                p1k[0] += tkipS(p1k[4] ^ get_unaligned_le16(tk + 0 + j));
+                p1k[1] += tkipS(p1k[0] ^ get_unaligned_le16(tk + 4 + j));
+                p1k[2] += tkipS(p1k[1] ^ get_unaligned_le16(tk + 8 + j));
+                p1k[3] += tkipS(p1k[2] ^ get_unaligned_le16(tk + 12 + j));
+                p1k[4] += tkipS(p1k[3] ^ get_unaligned_le16(tk + 0 + j)) + i;
         }
+        ctx->initialized = 1;
 }
 
-
-static void tkip_mixing_phase2(const u16 *p1k, const u8 *tk, u16 tsc_IV16,
-                               u8 *rc4key)
+static void tkip_mixing_phase2(const u8 *tk, struct tkip_ctx *ctx,
+                               u16 tsc_IV16, u8 *rc4key)
 {
         u16 ppk[6];
+        const u16 *p1k = ctx->p1k;
         int i;
 
         ppk[0] = p1k[0];
@@ -148,70 +116,35 @@ static void tkip_mixing_phase2(const u16 *p1k, const u8 *tk, u16 tsc_IV16,
         ppk[4] = p1k[4];
         ppk[5] = p1k[4] + tsc_IV16;
 
-        ppk[0] += tkip_S(ppk[5] ^ Mk16(tk[ 1], tk[ 0]));
-        ppk[1] += tkip_S(ppk[0] ^ Mk16(tk[ 3], tk[ 2]));
-        ppk[2] += tkip_S(ppk[1] ^ Mk16(tk[ 5], tk[ 4]));
-        ppk[3] += tkip_S(ppk[2] ^ Mk16(tk[ 7], tk[ 6]));
-        ppk[4] += tkip_S(ppk[3] ^ Mk16(tk[ 9], tk[ 8]));
-        ppk[5] += tkip_S(ppk[4] ^ Mk16(tk[11], tk[10]));
-        ppk[0] +=  RotR1(ppk[5] ^ Mk16(tk[13], tk[12]));
-        ppk[1] +=  RotR1(ppk[0] ^ Mk16(tk[15], tk[14]));
-        ppk[2] +=  RotR1(ppk[1]);
-        ppk[3] +=  RotR1(ppk[2]);
-        ppk[4] +=  RotR1(ppk[3]);
-        ppk[5] +=  RotR1(ppk[4]);
-
-        rc4key[0] = Hi8(tsc_IV16);
-        rc4key[1] = (Hi8(tsc_IV16) | 0x20) & 0x7f;
-        rc4key[2] = Lo8(tsc_IV16);
-        rc4key[3] = Lo8((ppk[5] ^ Mk16(tk[1], tk[0])) >> 1);
-
-        for (i = 0; i < 6; i++) {
-                rc4key[4 + 2 * i] = Lo8(ppk[i]);
-                rc4key[5 + 2 * i] = Hi8(ppk[i]);
-        }
+        ppk[0] += tkipS(ppk[5] ^ get_unaligned_le16(tk + 0));
+        ppk[1] += tkipS(ppk[0] ^ get_unaligned_le16(tk + 2));
+        ppk[2] += tkipS(ppk[1] ^ get_unaligned_le16(tk + 4));
+        ppk[3] += tkipS(ppk[2] ^ get_unaligned_le16(tk + 6));
+        ppk[4] += tkipS(ppk[3] ^ get_unaligned_le16(tk + 8));
+        ppk[5] += tkipS(ppk[4] ^ get_unaligned_le16(tk + 10));
+        ppk[0] += ror16(ppk[5] ^ get_unaligned_le16(tk + 12), 1);
+        ppk[1] += ror16(ppk[0] ^ get_unaligned_le16(tk + 14), 1);
+        ppk[2] += ror16(ppk[1], 1);
+        ppk[3] += ror16(ppk[2], 1);
+        ppk[4] += ror16(ppk[3], 1);
+        ppk[5] += ror16(ppk[4], 1);
+
+        rc4key = write_tkip_iv(rc4key, tsc_IV16);
+        *rc4key++ = ((ppk[5] ^ get_unaligned_le16(tk)) >> 1) & 0xFF;
+
+        for (i = 0; i < 6; i++)
+                put_unaligned_le16(ppk[i], rc4key + 2 * i);
 }
 
-
 /* Add TKIP IV and Ext. IV at @pos. @iv0, @iv1, and @iv2 are the first octets
  * of the IV. Returns pointer to the octet following IVs (i.e., beginning of
  * the packet payload). */
-u8 * ieee80211_tkip_add_iv(u8 *pos, struct ieee80211_key *key,
-                           u8 iv0, u8 iv1, u8 iv2)
+u8 *ieee80211_tkip_add_iv(u8 *pos, struct ieee80211_key *key, u16 iv16)
 {
-        *pos++ = iv0;
-        *pos++ = iv1;
-        *pos++ = iv2;
+        pos = write_tkip_iv(pos, iv16);
         *pos++ = (key->conf.keyidx << 6) | (1 << 5) /* Ext IV */;
-        *pos++ = key->u.tkip.iv32 & 0xff;
-        *pos++ = (key->u.tkip.iv32 >> 8) & 0xff;
-        *pos++ = (key->u.tkip.iv32 >> 16) & 0xff;
-        *pos++ = (key->u.tkip.iv32 >> 24) & 0xff;
-        return pos;
-}
-
-
-void ieee80211_tkip_gen_phase1key(struct ieee80211_key *key, u8 *ta,
-                                  u16 *phase1key)
-{
-        tkip_mixing_phase1(ta, &key->conf.key[ALG_TKIP_TEMP_ENCR_KEY],
-                           key->u.tkip.iv32, phase1key);
-}
-
-void ieee80211_tkip_gen_rc4key(struct ieee80211_key *key, u8 *ta,
-                               u8 *rc4key)
-{
-        /* Calculate per-packet key */
-        if (key->u.tkip.iv16 == 0 || !key->u.tkip.tx_initialized) {
-                /* IV16 wrapped around - perform TKIP phase 1 */
-                tkip_mixing_phase1(ta, &key->conf.key[ALG_TKIP_TEMP_ENCR_KEY],
-                                   key->u.tkip.iv32, key->u.tkip.p1k);
-                key->u.tkip.tx_initialized = 1;
-        }
-
-        tkip_mixing_phase2(key->u.tkip.p1k,
-                           &key->conf.key[ALG_TKIP_TEMP_ENCR_KEY],
-                           key->u.tkip.iv16, rc4key);
+        put_unaligned_le32(key->u.tkip.tx.iv32, pos);
+        return pos + 4;
 }
 
 void ieee80211_get_tkip_key(struct ieee80211_key_conf *keyconf,
@@ -220,48 +153,44 @@ void ieee80211_get_tkip_key(struct ieee80211_key_conf *keyconf,
 {
         struct ieee80211_key *key = (struct ieee80211_key *)
                         container_of(keyconf, struct ieee80211_key, conf);
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
-        u8 *data = (u8 *) hdr;
-        u16 fc = le16_to_cpu(hdr->frame_control);
-        int hdr_len = ieee80211_get_hdrlen(fc);
-        u8 *ta = hdr->addr2;
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+        u8 *data;
+        const u8 *tk;
+        struct tkip_ctx *ctx;
         u16 iv16;
         u32 iv32;
 
-        iv16 = data[hdr_len] << 8;
-        iv16 += data[hdr_len + 2];
-        iv32 = data[hdr_len + 4] | (data[hdr_len + 5] << 8) |
-               (data[hdr_len + 6] << 16) | (data[hdr_len + 7] << 24);
+        data = (u8 *)hdr + ieee80211_hdrlen(hdr->frame_control);
+        iv16 = data[2] | (data[0] << 8);
+        iv32 = get_unaligned_le32(&data[4]);
+
+        tk = &key->conf.key[NL80211_TKIP_DATA_OFFSET_ENCR_KEY];
+        ctx = &key->u.tkip.tx;
 
-#ifdef CONFIG_TKIP_DEBUG
+#ifdef CONFIG_MAC80211_TKIP_DEBUG
         printk(KERN_DEBUG "TKIP encrypt: iv16 = 0x%04x, iv32 = 0x%08x\n",
                         iv16, iv32);
 
-        if (iv32 != key->u.tkip.iv32) {
+        if (iv32 != ctx->iv32) {
                 printk(KERN_DEBUG "skb: iv32 = 0x%08x key: iv32 = 0x%08x\n",
-                        iv32, key->u.tkip.iv32);
+                        iv32, ctx->iv32);
                 printk(KERN_DEBUG "Wrap around of iv16 in the middle of a "
                         "fragmented packet\n");
         }
-#endif /* CONFIG_TKIP_DEBUG */
+#endif
 
         /* Update the p1k only when the iv16 in the packet wraps around, this
          * might occur after the wrap around of iv16 in the key in case of
          * fragmented packets. */
-        if (iv16 == 0 || !key->u.tkip.tx_initialized) {
-                /* IV16 wrapped around - perform TKIP phase 1 */
-                tkip_mixing_phase1(ta, &key->conf.key[ALG_TKIP_TEMP_ENCR_KEY],
-                        iv32, key->u.tkip.p1k);
-                key->u.tkip.tx_initialized = 1;
-        }
+        if (iv16 == 0 || !ctx->initialized)
+                tkip_mixing_phase1(tk, ctx, hdr->addr2, iv32);
 
         if (type == IEEE80211_TKIP_P1_KEY) {
-                memcpy(outkey, key->u.tkip.p1k, sizeof(u16) * 5);
+                memcpy(outkey, ctx->p1k, sizeof(u16) * 5);
                 return;
         }
 
-        tkip_mixing_phase2(key->u.tkip.p1k,
-                &key->conf.key[ALG_TKIP_TEMP_ENCR_KEY], iv16, outkey);
+        tkip_mixing_phase2(tk, ctx, iv16, outkey);
 }
 EXPORT_SYMBOL(ieee80211_get_tkip_key);
 
@@ -275,13 +204,19 @@ void ieee80211_tkip_encrypt_data(struct crypto_blkcipher *tfm,
                                  u8 *pos, size_t payload_len, u8 *ta)
 {
         u8 rc4key[16];
+        struct tkip_ctx *ctx = &key->u.tkip.tx;
+        const u8 *tk = &key->conf.key[NL80211_TKIP_DATA_OFFSET_ENCR_KEY];
+
+        /* Calculate per-packet key */
+        if (ctx->iv16 == 0 || !ctx->initialized)
+                tkip_mixing_phase1(tk, ctx, ta, ctx->iv32);
+
+        tkip_mixing_phase2(tk, ctx, ctx->iv16, rc4key);
 
-        ieee80211_tkip_gen_rc4key(key, ta, rc4key);
-        pos = ieee80211_tkip_add_iv(pos, key, rc4key[0], rc4key[1], rc4key[2]);
+        pos = ieee80211_tkip_add_iv(pos, key, key->u.tkip.tx.iv16);
         ieee80211_wep_encrypt_data(tfm, rc4key, 16, pos, payload_len);
 }
 
-
 /* Decrypt packet payload with TKIP using @key. @pos is a pointer to the
  * beginning of the buffer containing IEEE 802.11 header payload, i.e.,
  * including IV, Ext. IV, real data, Michael MIC, ICV. @payload_len is the
@@ -296,15 +231,16 @@ int ieee80211_tkip_decrypt_data(struct crypto_blkcipher *tfm,
         u32 iv16;
         u8 rc4key[16], keyid, *pos = payload;
         int res;
+        const u8 *tk = &key->conf.key[NL80211_TKIP_DATA_OFFSET_ENCR_KEY];
 
         if (payload_len < 12)
                 return -1;
 
         iv16 = (pos[0] << 8) | pos[2];
         keyid = pos[3];
-        iv32 = pos[4] | (pos[5] << 8) | (pos[6] << 16) | (pos[7] << 24);
+        iv32 = get_unaligned_le32(pos + 4);
         pos += 8;
-#ifdef CONFIG_TKIP_DEBUG
+#ifdef CONFIG_MAC80211_TKIP_DEBUG
         {
                 int i;
                 printk(KERN_DEBUG "TKIP decrypt: data(len=%zd)", payload_len);
@@ -314,7 +250,7 @@ int ieee80211_tkip_decrypt_data(struct crypto_blkcipher *tfm,
                 printk(KERN_DEBUG "TKIP decrypt: iv16=%04x iv32=%08x\n",
                        iv16, iv32);
         }
-#endif /* CONFIG_TKIP_DEBUG */
+#endif
 
         if (!(keyid & (1 << 5)))
                 return TKIP_DECRYPT_NO_EXT_IV;
@@ -322,50 +258,48 @@ int ieee80211_tkip_decrypt_data(struct crypto_blkcipher *tfm,
         if ((keyid >> 6) != key->conf.keyidx)
                 return TKIP_DECRYPT_INVALID_KEYIDX;
 
-        if (key->u.tkip.rx_initialized[queue] &&
-            (iv32 < key->u.tkip.iv32_rx[queue] ||
-             (iv32 == key->u.tkip.iv32_rx[queue] &&
-              iv16 <= key->u.tkip.iv16_rx[queue]))) {
-#ifdef CONFIG_TKIP_DEBUG
+        if (key->u.tkip.rx[queue].initialized &&
+            (iv32 < key->u.tkip.rx[queue].iv32 ||
+             (iv32 == key->u.tkip.rx[queue].iv32 &&
+              iv16 <= key->u.tkip.rx[queue].iv16))) {
+#ifdef CONFIG_MAC80211_TKIP_DEBUG
                 DECLARE_MAC_BUF(mac);
                 printk(KERN_DEBUG "TKIP replay detected for RX frame from "
                        "%s (RX IV (%04x,%02x) <= prev. IV (%04x,%02x)\n",
                        print_mac(mac, ta),
-                       iv32, iv16, key->u.tkip.iv32_rx[queue],
-                       key->u.tkip.iv16_rx[queue]);
-#endif /* CONFIG_TKIP_DEBUG */
+                       iv32, iv16, key->u.tkip.rx[queue].iv32,
+                       key->u.tkip.rx[queue].iv16);
+#endif
                 return TKIP_DECRYPT_REPLAY;
         }
 
         if (only_iv) {
                 res = TKIP_DECRYPT_OK;
-                key->u.tkip.rx_initialized[queue] = 1;
+                key->u.tkip.rx[queue].initialized = 1;
                 goto done;
         }
 
-        if (!key->u.tkip.rx_initialized[queue] ||
-            key->u.tkip.iv32_rx[queue] != iv32) {
-                key->u.tkip.rx_initialized[queue] = 1;
+        if (!key->u.tkip.rx[queue].initialized ||
+            key->u.tkip.rx[queue].iv32 != iv32) {
                 /* IV16 wrapped around - perform TKIP phase 1 */
-                tkip_mixing_phase1(ta, &key->conf.key[ALG_TKIP_TEMP_ENCR_KEY],
-                                   iv32, key->u.tkip.p1k_rx[queue]);
-#ifdef CONFIG_TKIP_DEBUG
+                tkip_mixing_phase1(tk, &key->u.tkip.rx[queue], ta, iv32);
+#ifdef CONFIG_MAC80211_TKIP_DEBUG
                 {
                         int i;
+                        u8 key_offset = NL80211_TKIP_DATA_OFFSET_ENCR_KEY;
                         DECLARE_MAC_BUF(mac);
                         printk(KERN_DEBUG "TKIP decrypt: Phase1 TA=%s"
                                " TK=", print_mac(mac, ta));
                         for (i = 0; i < 16; i++)
                                 printk("%02x ",
-                                       key->conf.key[
-                                                ALG_TKIP_TEMP_ENCR_KEY + i]);
+                                       key->conf.key[key_offset + i]);
                         printk("\n");
                         printk(KERN_DEBUG "TKIP decrypt: P1K=");
                         for (i = 0; i < 5; i++)
-                                printk("%04x ", key->u.tkip.p1k_rx[queue][i]);
+                                printk("%04x ", key->u.tkip.rx[queue].p1k[i]);
                         printk("\n");
                 }
-#endif /* CONFIG_TKIP_DEBUG */
+#endif
                 if (key->local->ops->update_tkip_key &&
                         key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) {
                         u8 bcast[ETH_ALEN] =
@@ -377,14 +311,12 @@ int ieee80211_tkip_decrypt_data(struct crypto_blkcipher *tfm,
 
                         key->local->ops->update_tkip_key(
                                 local_to_hw(key->local), &key->conf,
-                                sta_addr, iv32, key->u.tkip.p1k_rx[queue]);
+                                sta_addr, iv32, key->u.tkip.rx[queue].p1k);
                 }
         }
 
-        tkip_mixing_phase2(key->u.tkip.p1k_rx[queue],
-                           &key->conf.key[ALG_TKIP_TEMP_ENCR_KEY],
-                           iv16, rc4key);
-#ifdef CONFIG_TKIP_DEBUG
+        tkip_mixing_phase2(tk, &key->u.tkip.rx[queue], iv16, rc4key);
+#ifdef CONFIG_MAC80211_TKIP_DEBUG
         {
                 int i;
                 printk(KERN_DEBUG "TKIP decrypt: Phase2 rc4key=");
@@ -392,7 +324,7 @@ int ieee80211_tkip_decrypt_data(struct crypto_blkcipher *tfm,
                         printk("%02x ", rc4key[i]);
                 printk("\n");
         }
-#endif /* CONFIG_TKIP_DEBUG */
+#endif
 
         res = ieee80211_wep_decrypt_data(tfm, rc4key, 16, pos, payload_len - 12);
  done:
@@ -409,5 +341,3 @@ int ieee80211_tkip_decrypt_data(struct crypto_blkcipher *tfm,
 
         return res;
 }
-
-
diff --git a/net/mac80211/tkip.h b/net/mac80211/tkip.h
index b7c2ee763d9d..d4714383f5fc 100644
--- a/net/mac80211/tkip.h
+++ b/net/mac80211/tkip.h
@@ -13,12 +13,8 @@
 #include <linux/crypto.h>
 #include "key.h"
 
-u8 * ieee80211_tkip_add_iv(u8 *pos, struct ieee80211_key *key,
-                           u8 iv0, u8 iv1, u8 iv2);
-void ieee80211_tkip_gen_phase1key(struct ieee80211_key *key, u8 *ta,
-                                  u16 *phase1key);
-void ieee80211_tkip_gen_rc4key(struct ieee80211_key *key, u8 *ta,
-                               u8 *rc4key);
+u8 *ieee80211_tkip_add_iv(u8 *pos, struct ieee80211_key *key, u16 iv16);
+
 void ieee80211_tkip_encrypt_data(struct crypto_blkcipher *tfm,
                                  struct ieee80211_key *key,
                                  u8 *pos, size_t payload_len, u8 *ta);
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index c80d5899f279..0fbadd8b983c 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -38,23 +38,12 @@
 
 /* misc utils */
 
-static inline void ieee80211_include_sequence(struct ieee80211_sub_if_data *sdata,
-                                              struct ieee80211_hdr *hdr)
-{
-        /* Set the sequence number for this frame. */
-        hdr->seq_ctrl = cpu_to_le16(sdata->sequence);
-
-        /* Increase the sequence number. */
-        sdata->sequence = (sdata->sequence + 0x10) & IEEE80211_SCTL_SEQ;
-}
-
 #ifdef CONFIG_MAC80211_LOWTX_FRAME_DUMP
 static void ieee80211_dump_frame(const char *ifname, const char *title,
                                  const struct sk_buff *skb)
 {
-        const struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
-        u16 fc;
-        int hdrlen;
+        const struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+        unsigned int hdrlen;
         DECLARE_MAC_BUF(mac);
 
         printk(KERN_DEBUG "%s: %s (len=%d)", ifname, title, skb->len);
@@ -63,13 +52,12 @@ static void ieee80211_dump_frame(const char *ifname, const char *title,
                 return;
         }
 
-        fc = le16_to_cpu(hdr->frame_control);
-        hdrlen = ieee80211_get_hdrlen(fc);
+        hdrlen = ieee80211_hdrlen(hdr->frame_control);
         if (hdrlen > skb->len)
                 hdrlen = skb->len;
         if (hdrlen >= 4)
                 printk(" FC=0x%04x DUR=0x%04x",
-                       fc, le16_to_cpu(hdr->duration_id));
+                    le16_to_cpu(hdr->frame_control), le16_to_cpu(hdr->duration_id));
         if (hdrlen >= 10)
                 printk(" A1=%s", print_mac(mac, hdr->addr1));
         if (hdrlen >= 16)
@@ -87,15 +75,16 @@ static inline void ieee80211_dump_frame(const char *ifname, const char *title,
 }
 #endif /* CONFIG_MAC80211_LOWTX_FRAME_DUMP */
 
-static u16 ieee80211_duration(struct ieee80211_tx_data *tx, int group_addr,
-                              int next_frag_len)
+static __le16 ieee80211_duration(struct ieee80211_tx_data *tx, int group_addr,
+                                 int next_frag_len)
 {
         int rate, mrate, erp, dur, i;
-        struct ieee80211_rate *txrate = tx->rate;
+        struct ieee80211_rate *txrate;
         struct ieee80211_local *local = tx->local;
         struct ieee80211_supported_band *sband;
 
-        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
+        sband = local->hw.wiphy->bands[tx->channel->band];
+        txrate = &sband->bitrates[tx->rate_idx];
 
         erp = 0;
         if (tx->sdata->flags & IEEE80211_SDATA_OPERATING_GMODE)
@@ -139,7 +128,7 @@ static u16 ieee80211_duration(struct ieee80211_tx_data *tx, int group_addr,
 
         /* data/mgmt */
         if (0 /* FIX: data/mgmt during CFP */)
-                return 32768;
+                return cpu_to_le16(32768);
 
         if (group_addr) /* Group address as the destination - no ACK */
                 return 0;
@@ -209,19 +198,7 @@ static u16 ieee80211_duration(struct ieee80211_tx_data *tx, int group_addr,
                                 tx->sdata->bss_conf.use_short_preamble);
         }
 
-        return dur;
-}
-
-static inline int __ieee80211_queue_stopped(const struct ieee80211_local *local,
-                                            int queue)
-{
-        return test_bit(IEEE80211_LINK_STATE_XOFF, &local->state[queue]);
-}
-
-static inline int __ieee80211_queue_pending(const struct ieee80211_local *local,
-                                            int queue)
-{
-        return test_bit(IEEE80211_LINK_STATE_PENDING, &local->state[queue]);
+        return cpu_to_le16(dur);
 }
 
 static int inline is_ieee80211_device(struct net_device *dev,
@@ -233,16 +210,16 @@ static int inline is_ieee80211_device(struct net_device *dev,
 
 /* tx handlers */
 
-static ieee80211_tx_result
+static ieee80211_tx_result debug_noinline
 ieee80211_tx_h_check_assoc(struct ieee80211_tx_data *tx)
 {
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
-        struct sk_buff *skb = tx->skb;
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
 #endif /* CONFIG_MAC80211_VERBOSE_DEBUG */
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
         u32 sta_flags;
 
-        if (unlikely(tx->flags & IEEE80211_TX_INJECTED))
+        if (unlikely(info->flags & IEEE80211_TX_CTL_INJECTED))
                 return TX_CONTINUE;
 
         if (unlikely(tx->local->sta_sw_scanning) &&
@@ -256,7 +233,7 @@ ieee80211_tx_h_check_assoc(struct ieee80211_tx_data *tx)
         if (tx->flags & IEEE80211_TX_PS_BUFFERED)
                 return TX_CONTINUE;
 
-        sta_flags = tx->sta ? tx->sta->flags : 0;
+        sta_flags = tx->sta ? get_sta_flags(tx->sta) : 0;
 
         if (likely(tx->flags & IEEE80211_TX_UNICAST)) {
                 if (unlikely(!(sta_flags & WLAN_STA_ASSOC) &&
@@ -287,17 +264,6 @@ ieee80211_tx_h_check_assoc(struct ieee80211_tx_data *tx)
         return TX_CONTINUE;
 }
 
-static ieee80211_tx_result
-ieee80211_tx_h_sequence(struct ieee80211_tx_data *tx)
-{
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
-
-        if (ieee80211_get_hdrlen(le16_to_cpu(hdr->frame_control)) >= 24)
-                ieee80211_include_sequence(tx->sdata, hdr);
-
-        return TX_CONTINUE;
-}
-
 /* This function is called whenever the AP is about to exceed the maximum limit
  * of buffered frames for power saving STAs. This situation should not really
  * happen often during normal operation, so dropping the oldest buffered packet
@@ -316,8 +282,7 @@ static void purge_old_ps_buffers(struct ieee80211_local *local)
 
         list_for_each_entry_rcu(sdata, &local->interfaces, list) {
                 struct ieee80211_if_ap *ap;
-                if (sdata->dev == local->mdev ||
-                    sdata->vif.type != IEEE80211_IF_TYPE_AP)
+                if (sdata->vif.type != IEEE80211_IF_TYPE_AP)
                         continue;
                 ap = &sdata->u.ap;
                 skb = skb_dequeue(&ap->ps_bc_buf);
@@ -340,13 +305,17 @@ static void purge_old_ps_buffers(struct ieee80211_local *local)
         rcu_read_unlock();
 
         local->total_ps_buffered = total;
+#ifdef MAC80211_VERBOSE_PS_DEBUG
         printk(KERN_DEBUG "%s: PS buffers full - purged %d frames\n",
                wiphy_name(local->hw.wiphy), purged);
+#endif
 }
 
 static ieee80211_tx_result
 ieee80211_tx_h_multicast_ps_buf(struct ieee80211_tx_data *tx)
 {
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
+
         /*
          * broadcast/multicast frame
          *
@@ -355,8 +324,12 @@ ieee80211_tx_h_multicast_ps_buf(struct ieee80211_tx_data *tx)
          * This is done either by the hardware or us.
          */
 
-        /* not AP/IBSS or ordered frame */
-        if (!tx->sdata->bss || (tx->fc & IEEE80211_FCTL_ORDER))
+        /* powersaving STAs only in AP/VLAN mode */
+        if (!tx->sdata->bss)
+                return TX_CONTINUE;
+
+        /* no buffering for ordered frames */
+        if (tx->fc & IEEE80211_FCTL_ORDER)
                 return TX_CONTINUE;
 
         /* no stations in PS mode */
@@ -369,11 +342,13 @@ ieee80211_tx_h_multicast_ps_buf(struct ieee80211_tx_data *tx)
                         purge_old_ps_buffers(tx->local);
                 if (skb_queue_len(&tx->sdata->bss->ps_bc_buf) >=
                     AP_MAX_BC_BUFFER) {
+#ifdef MAC80211_VERBOSE_PS_DEBUG
                         if (net_ratelimit()) {
                                 printk(KERN_DEBUG "%s: BC TX buffer full - "
                                        "dropping the oldest frame\n",
                                        tx->dev->name);
                         }
+#endif
                         dev_kfree_skb(skb_dequeue(&tx->sdata->bss->ps_bc_buf));
                 } else
                         tx->local->total_ps_buffered++;
@@ -382,7 +357,7 @@ ieee80211_tx_h_multicast_ps_buf(struct ieee80211_tx_data *tx)
         }
 
         /* buffered in hardware */
-        tx->control->flags |= IEEE80211_TXCTL_SEND_AFTER_DTIM;
+        info->flags |= IEEE80211_TX_CTL_SEND_AFTER_DTIM;
 
         return TX_CONTINUE;
 }
@@ -391,6 +366,8 @@ static ieee80211_tx_result
 ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx)
 {
         struct sta_info *sta = tx->sta;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
+        u32 staflags;
         DECLARE_MAC_BUF(mac);
 
         if (unlikely(!sta ||
@@ -398,9 +375,10 @@ ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx)
                       (tx->fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_PROBE_RESP)))
                 return TX_CONTINUE;
 
-        if (unlikely((sta->flags & WLAN_STA_PS) &&
-                     !(sta->flags & WLAN_STA_PSPOLL))) {
-                struct ieee80211_tx_packet_data *pkt_data;
+        staflags = get_sta_flags(sta);
+
+        if (unlikely((staflags & WLAN_STA_PS) &&
+                     !(staflags & WLAN_STA_PSPOLL))) {
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
                 printk(KERN_DEBUG "STA %s aid %d: PS buffer (entries "
                        "before %d)\n",
@@ -411,11 +389,13 @@ ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx)
                         purge_old_ps_buffers(tx->local);
                 if (skb_queue_len(&sta->ps_tx_buf) >= STA_MAX_TX_BUFFER) {
                         struct sk_buff *old = skb_dequeue(&sta->ps_tx_buf);
+#ifdef MAC80211_VERBOSE_PS_DEBUG
                         if (net_ratelimit()) {
                                 printk(KERN_DEBUG "%s: STA %s TX "
                                        "buffer full - dropping oldest frame\n",
                                        tx->dev->name, print_mac(mac, sta->addr));
                         }
+#endif
                         dev_kfree_skb(old);
                 } else
                         tx->local->total_ps_buffered++;
@@ -424,24 +404,23 @@ ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx)
                 if (skb_queue_empty(&sta->ps_tx_buf))
                         sta_info_set_tim_bit(sta);
 
-                pkt_data = (struct ieee80211_tx_packet_data *)tx->skb->cb;
-                pkt_data->jiffies = jiffies;
+                info->control.jiffies = jiffies;
                 skb_queue_tail(&sta->ps_tx_buf, tx->skb);
                 return TX_QUEUED;
         }
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
-        else if (unlikely(sta->flags & WLAN_STA_PS)) {
+        else if (unlikely(test_sta_flags(sta, WLAN_STA_PS))) {
                 printk(KERN_DEBUG "%s: STA %s in PS mode, but pspoll "
                        "set -> send frame\n", tx->dev->name,
                        print_mac(mac, sta->addr));
         }
 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
-        sta->flags &= ~WLAN_STA_PSPOLL;
+        clear_sta_flags(sta, WLAN_STA_PSPOLL);
 
         return TX_CONTINUE;
 }
 
-static ieee80211_tx_result
+static ieee80211_tx_result debug_noinline
 ieee80211_tx_h_ps_buf(struct ieee80211_tx_data *tx)
 {
         if (unlikely(tx->flags & IEEE80211_TX_PS_BUFFERED))
@@ -453,21 +432,22 @@ ieee80211_tx_h_ps_buf(struct ieee80211_tx_data *tx)
                 return ieee80211_tx_h_multicast_ps_buf(tx);
 }
 
-static ieee80211_tx_result
+static ieee80211_tx_result debug_noinline
 ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx)
 {
         struct ieee80211_key *key;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
         u16 fc = tx->fc;
 
-        if (unlikely(tx->control->flags & IEEE80211_TXCTL_DO_NOT_ENCRYPT))
+        if (unlikely(info->flags & IEEE80211_TX_CTL_DO_NOT_ENCRYPT))
                 tx->key = NULL;
         else if (tx->sta && (key = rcu_dereference(tx->sta->key)))
                 tx->key = key;
         else if ((key = rcu_dereference(tx->sdata->default_key)))
                 tx->key = key;
         else if (tx->sdata->drop_unencrypted &&
-                 !(tx->control->flags & IEEE80211_TXCTL_EAPOL_FRAME) &&
-                 !(tx->flags & IEEE80211_TX_INJECTED)) {
+                 !(info->flags & IEEE80211_TX_CTL_EAPOL_FRAME) &&
+                 !(info->flags & IEEE80211_TX_CTL_INJECTED)) {
                 I802_DEBUG_INC(tx->local->tx_handlers_drop_unencrypted);
                 return TX_DROP;
         } else
@@ -496,15 +476,197 @@ ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx)
         }
 
         if (!tx->key || !(tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE))
-                tx->control->flags |= IEEE80211_TXCTL_DO_NOT_ENCRYPT;
+                info->flags |= IEEE80211_TX_CTL_DO_NOT_ENCRYPT;
 
         return TX_CONTINUE;
 }
 
-static ieee80211_tx_result
+static ieee80211_tx_result debug_noinline
+ieee80211_tx_h_rate_ctrl(struct ieee80211_tx_data *tx)
+{
+        struct rate_selection rsel;
+        struct ieee80211_supported_band *sband;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
+
+        sband = tx->local->hw.wiphy->bands[tx->channel->band];
+
+        if (likely(tx->rate_idx < 0)) {
+                rate_control_get_rate(tx->dev, sband, tx->skb, &rsel);
+                tx->rate_idx = rsel.rate_idx;
+                if (unlikely(rsel.probe_idx >= 0)) {
+                        info->flags |= IEEE80211_TX_CTL_RATE_CTRL_PROBE;
+                        tx->flags |= IEEE80211_TX_PROBE_LAST_FRAG;
+                        info->control.alt_retry_rate_idx = tx->rate_idx;
+                        tx->rate_idx = rsel.probe_idx;
+                } else
+                        info->control.alt_retry_rate_idx = -1;
+
+                if (unlikely(tx->rate_idx < 0))
+                        return TX_DROP;
+        } else
+                info->control.alt_retry_rate_idx = -1;
+
+        if (tx->sdata->bss_conf.use_cts_prot &&
+            (tx->flags & IEEE80211_TX_FRAGMENTED) && (rsel.nonerp_idx >= 0)) {
+                tx->last_frag_rate_idx = tx->rate_idx;
+                if (rsel.probe_idx >= 0)
+                        tx->flags &= ~IEEE80211_TX_PROBE_LAST_FRAG;
+                else
+                        tx->flags |= IEEE80211_TX_PROBE_LAST_FRAG;
+                tx->rate_idx = rsel.nonerp_idx;
+                info->tx_rate_idx = rsel.nonerp_idx;
+                info->flags &= ~IEEE80211_TX_CTL_RATE_CTRL_PROBE;
+        } else {
+                tx->last_frag_rate_idx = tx->rate_idx;
+                info->tx_rate_idx = tx->rate_idx;
+        }
+        info->tx_rate_idx = tx->rate_idx;
+
+        return TX_CONTINUE;
+}
+
+static ieee80211_tx_result debug_noinline
+ieee80211_tx_h_misc(struct ieee80211_tx_data *tx)
+{
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
+        struct ieee80211_supported_band *sband;
+
+        sband = tx->local->hw.wiphy->bands[tx->channel->band];
+
+        if (tx->sta)
+                info->control.aid = tx->sta->aid;
+
+        if (!info->control.retry_limit) {
+                if (!is_multicast_ether_addr(hdr->addr1)) {
+                        int len = min_t(int, tx->skb->len + FCS_LEN,
+                                        tx->local->fragmentation_threshold);
+                        if (len > tx->local->rts_threshold
+                            && tx->local->rts_threshold <
+                                                IEEE80211_MAX_RTS_THRESHOLD) {
+                                info->flags |= IEEE80211_TX_CTL_USE_RTS_CTS;
+                                info->flags |=
+                                        IEEE80211_TX_CTL_LONG_RETRY_LIMIT;
+                                info->control.retry_limit =
+                                        tx->local->long_retry_limit;
+                        } else {
+                                info->control.retry_limit =
+                                        tx->local->short_retry_limit;
+                        }
+                } else {
+                        info->control.retry_limit = 1;
+                }
+        }
+
+        if (tx->flags & IEEE80211_TX_FRAGMENTED) {
+                /* Do not use multiple retry rates when sending fragmented
+                 * frames.
+                 * TODO: The last fragment could still use multiple retry
+                 * rates. */
+                info->control.alt_retry_rate_idx = -1;
+        }
+
+        /* Use CTS protection for unicast frames sent using extended rates if
+         * there are associated non-ERP stations and RTS/CTS is not configured
+         * for the frame. */
+        if ((tx->sdata->flags & IEEE80211_SDATA_OPERATING_GMODE) &&
+            (sband->bitrates[tx->rate_idx].flags & IEEE80211_RATE_ERP_G) &&
+            (tx->flags & IEEE80211_TX_UNICAST) &&
+            tx->sdata->bss_conf.use_cts_prot &&
+            !(info->flags & IEEE80211_TX_CTL_USE_RTS_CTS))
+                info->flags |= IEEE80211_TX_CTL_USE_CTS_PROTECT;
+
+        /* Transmit data frames using short preambles if the driver supports
+         * short preambles at the selected rate and short preambles are
+         * available on the network at the current point in time. */
+        if (ieee80211_is_data(hdr->frame_control) &&
+            (sband->bitrates[tx->rate_idx].flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
+            tx->sdata->bss_conf.use_short_preamble &&
+            (!tx->sta || test_sta_flags(tx->sta, WLAN_STA_SHORT_PREAMBLE))) {
+                info->flags |= IEEE80211_TX_CTL_SHORT_PREAMBLE;
+        }
+
+        if ((info->flags & IEEE80211_TX_CTL_USE_RTS_CTS) ||
+            (info->flags & IEEE80211_TX_CTL_USE_CTS_PROTECT)) {
+                struct ieee80211_rate *rate;
+                s8 baserate = -1;
+                int idx;
+
+                /* Do not use multiple retry rates when using RTS/CTS */
+                info->control.alt_retry_rate_idx = -1;
+
+                /* Use min(data rate, max base rate) as CTS/RTS rate */
+                rate = &sband->bitrates[tx->rate_idx];
+
+                for (idx = 0; idx < sband->n_bitrates; idx++) {
+                        if (sband->bitrates[idx].bitrate > rate->bitrate)
+                                continue;
+                        if (tx->sdata->basic_rates & BIT(idx) &&
+                            (baserate < 0 ||
+                             (sband->bitrates[baserate].bitrate
+                              < sband->bitrates[idx].bitrate)))
+                                baserate = idx;
+                }
+
+                if (baserate >= 0)
+                        info->control.rts_cts_rate_idx = baserate;
+                else
+                        info->control.rts_cts_rate_idx = 0;
+        }
+
+        if (tx->sta)
+                info->control.aid = tx->sta->aid;
+
+        return TX_CONTINUE;
+}
+
+static ieee80211_tx_result debug_noinline
+ieee80211_tx_h_sequence(struct ieee80211_tx_data *tx)
+{
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
+        u16 *seq;
+        u8 *qc;
+        int tid;
+
+        /* only for injected frames */
+        if (unlikely(ieee80211_is_ctl(hdr->frame_control)))
+                return TX_CONTINUE;
+
+        if (ieee80211_hdrlen(hdr->frame_control) < 24)
+                return TX_CONTINUE;
+
+        if (!ieee80211_is_data_qos(hdr->frame_control)) {
+                info->flags |= IEEE80211_TX_CTL_ASSIGN_SEQ;
+                return TX_CONTINUE;
+        }
+
+        /*
+         * This should be true for injected/management frames only, for
+         * management frames we have set the IEEE80211_TX_CTL_ASSIGN_SEQ
+         * above since they are not QoS-data frames.
+         */
+        if (!tx->sta)
+                return TX_CONTINUE;
+
+        /* include per-STA, per-TID sequence counter */
+
+        qc = ieee80211_get_qos_ctl(hdr);
+        tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
+        seq = &tx->sta->tid_seq[tid];
+
+        hdr->seq_ctrl = cpu_to_le16(*seq);
+
+        /* Increase the sequence number. */
+        *seq = (*seq + 0x10) & IEEE80211_SCTL_SEQ;
+
+        return TX_CONTINUE;
+}
+
+static ieee80211_tx_result debug_noinline
 ieee80211_tx_h_fragment(struct ieee80211_tx_data *tx)
 {
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) tx->skb->data;
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
         size_t hdrlen, per_fragm, num_fragm, payload_len, left;
         struct sk_buff **frags, *first, *frag;
         int i;
@@ -515,9 +677,19 @@ ieee80211_tx_h_fragment(struct ieee80211_tx_data *tx)
         if (!(tx->flags & IEEE80211_TX_FRAGMENTED))
                 return TX_CONTINUE;
 
+        /*
+         * Warn when submitting a fragmented A-MPDU frame and drop it.
+         * This scenario is handled in __ieee80211_tx_prepare but extra
+         * caution taken here as fragmented ampdu may cause Tx stop.
+         */
+        if (WARN_ON(tx->flags & IEEE80211_TX_CTL_AMPDU ||
+                    skb_get_queue_mapping(tx->skb) >=
+                        ieee80211_num_regular_queues(&tx->local->hw)))
+                return TX_DROP;
+
         first = tx->skb;
 
-        hdrlen = ieee80211_get_hdrlen(tx->fc);
+        hdrlen = ieee80211_hdrlen(hdr->frame_control);
         payload_len = first->len - hdrlen;
         per_fragm = frag_threshold - hdrlen - FCS_LEN;
         num_fragm = DIV_ROUND_UP(payload_len, per_fragm);
@@ -558,6 +730,8 @@ ieee80211_tx_h_fragment(struct ieee80211_tx_data *tx)
                 fhdr->seq_ctrl = cpu_to_le16(seq | ((i + 1) & IEEE80211_SCTL_FRAG));
                 copylen = left > per_fragm ? per_fragm : left;
                 memcpy(skb_put(frag, copylen), pos, copylen);
+                memcpy(frag->cb, first->cb, sizeof(frag->cb));
+                skb_copy_queue_mapping(frag, first);
 
                 pos += copylen;
                 left -= copylen;
@@ -570,7 +744,6 @@ ieee80211_tx_h_fragment(struct ieee80211_tx_data *tx)
         return TX_CONTINUE;
 
  fail:
-        printk(KERN_DEBUG "%s: failed to fragment frame\n", tx->dev->name);
         if (frags) {
                 for (i = 0; i < num_fragm - 1; i++)
                         if (frags[i])
@@ -581,7 +754,7 @@ ieee80211_tx_h_fragment(struct ieee80211_tx_data *tx)
         return TX_DROP;
 }
 
-static ieee80211_tx_result
+static ieee80211_tx_result debug_noinline
 ieee80211_tx_h_encrypt(struct ieee80211_tx_data *tx)
 {
         if (!tx->key)
@@ -601,236 +774,57 @@ ieee80211_tx_h_encrypt(struct ieee80211_tx_data *tx)
         return TX_DROP;
 }
 
-static ieee80211_tx_result
-ieee80211_tx_h_rate_ctrl(struct ieee80211_tx_data *tx)
+static ieee80211_tx_result debug_noinline
+ieee80211_tx_h_calculate_duration(struct ieee80211_tx_data *tx)
 {
-        struct rate_selection rsel;
-        struct ieee80211_supported_band *sband;
-
-        sband = tx->local->hw.wiphy->bands[tx->local->hw.conf.channel->band];
-
-        if (likely(!tx->rate)) {
-                rate_control_get_rate(tx->dev, sband, tx->skb, &rsel);
-                tx->rate = rsel.rate;
-                if (unlikely(rsel.probe)) {
-                        tx->control->flags |=
-                                IEEE80211_TXCTL_RATE_CTRL_PROBE;
-                        tx->flags |= IEEE80211_TX_PROBE_LAST_FRAG;
-                        tx->control->alt_retry_rate = tx->rate;
-                        tx->rate = rsel.probe;
-                } else
-                        tx->control->alt_retry_rate = NULL;
-
-                if (!tx->rate)
-                        return TX_DROP;
-        } else
-                tx->control->alt_retry_rate = NULL;
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
+        int next_len, i;
+        int group_addr = is_multicast_ether_addr(hdr->addr1);
 
-        if (tx->sdata->bss_conf.use_cts_prot &&
-            (tx->flags & IEEE80211_TX_FRAGMENTED) && rsel.nonerp) {
-                tx->last_frag_rate = tx->rate;
-                if (rsel.probe)
-                        tx->flags &= ~IEEE80211_TX_PROBE_LAST_FRAG;
-                else
-                        tx->flags |= IEEE80211_TX_PROBE_LAST_FRAG;
-                tx->rate = rsel.nonerp;
-                tx->control->tx_rate = rsel.nonerp;
-                tx->control->flags &= ~IEEE80211_TXCTL_RATE_CTRL_PROBE;
-        } else {
-                tx->last_frag_rate = tx->rate;
-                tx->control->tx_rate = tx->rate;
+        if (!(tx->flags & IEEE80211_TX_FRAGMENTED)) {
+                hdr->duration_id = ieee80211_duration(tx, group_addr, 0);
+                return TX_CONTINUE;
         }
-        tx->control->tx_rate = tx->rate;
-
-        return TX_CONTINUE;
-}
 
-static ieee80211_tx_result
-ieee80211_tx_h_misc(struct ieee80211_tx_data *tx)
-{
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) tx->skb->data;
-        u16 fc = le16_to_cpu(hdr->frame_control);
-        u16 dur;
-        struct ieee80211_tx_control *control = tx->control;
+        hdr->duration_id = ieee80211_duration(tx, group_addr,
+                                              tx->extra_frag[0]->len);
 
-        if (!control->retry_limit) {
-                if (!is_multicast_ether_addr(hdr->addr1)) {
-                        if (tx->skb->len + FCS_LEN > tx->local->rts_threshold
-                            && tx->local->rts_threshold <
-                                        IEEE80211_MAX_RTS_THRESHOLD) {
-                                control->flags |=
-                                        IEEE80211_TXCTL_USE_RTS_CTS;
-                                control->flags |=
-                                        IEEE80211_TXCTL_LONG_RETRY_LIMIT;
-                                control->retry_limit =
-                                        tx->local->long_retry_limit;
-                        } else {
-                                control->retry_limit =
-                                        tx->local->short_retry_limit;
-                        }
+        for (i = 0; i < tx->num_extra_frag; i++) {
+                if (i + 1 < tx->num_extra_frag) {
+                        next_len = tx->extra_frag[i + 1]->len;
                 } else {
-                        control->retry_limit = 1;
-                }
-        }
-
-        if (tx->flags & IEEE80211_TX_FRAGMENTED) {
-                /* Do not use multiple retry rates when sending fragmented
-                 * frames.
-                 * TODO: The last fragment could still use multiple retry
-                 * rates. */
-                control->alt_retry_rate = NULL;
-        }
-
-        /* Use CTS protection for unicast frames sent using extended rates if
-         * there are associated non-ERP stations and RTS/CTS is not configured
-         * for the frame. */
-        if ((tx->sdata->flags & IEEE80211_SDATA_OPERATING_GMODE) &&
-            (tx->rate->flags & IEEE80211_RATE_ERP_G) &&
-            (tx->flags & IEEE80211_TX_UNICAST) &&
-            tx->sdata->bss_conf.use_cts_prot &&
-            !(control->flags & IEEE80211_TXCTL_USE_RTS_CTS))
-                control->flags |= IEEE80211_TXCTL_USE_CTS_PROTECT;
-
-        /* Transmit data frames using short preambles if the driver supports
-         * short preambles at the selected rate and short preambles are
-         * available on the network at the current point in time. */
-        if (((fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA) &&
-            (tx->rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
-            tx->sdata->bss_conf.use_short_preamble &&
-            (!tx->sta || (tx->sta->flags & WLAN_STA_SHORT_PREAMBLE))) {
-                tx->control->flags |= IEEE80211_TXCTL_SHORT_PREAMBLE;
-        }
-
-        /* Setup duration field for the first fragment of the frame. Duration
-         * for remaining fragments will be updated when they are being sent
-         * to low-level driver in ieee80211_tx(). */
-        dur = ieee80211_duration(tx, is_multicast_ether_addr(hdr->addr1),
-                                 (tx->flags & IEEE80211_TX_FRAGMENTED) ?
-                                 tx->extra_frag[0]->len : 0);
-        hdr->duration_id = cpu_to_le16(dur);
-
-        if ((control->flags & IEEE80211_TXCTL_USE_RTS_CTS) ||
-            (control->flags & IEEE80211_TXCTL_USE_CTS_PROTECT)) {
-                struct ieee80211_supported_band *sband;
-                struct ieee80211_rate *rate, *baserate;
-                int idx;
-
-                sband = tx->local->hw.wiphy->bands[
-                                tx->local->hw.conf.channel->band];
-
-                /* Do not use multiple retry rates when using RTS/CTS */
-                control->alt_retry_rate = NULL;
-
-                /* Use min(data rate, max base rate) as CTS/RTS rate */
-                rate = tx->rate;
-                baserate = NULL;
-
-                for (idx = 0; idx < sband->n_bitrates; idx++) {
-                        if (sband->bitrates[idx].bitrate > rate->bitrate)
-                                continue;
-                        if (tx->sdata->basic_rates & BIT(idx) &&
-                            (!baserate ||
-                             (baserate->bitrate < sband->bitrates[idx].bitrate)))
-                                baserate = &sband->bitrates[idx];
+                        next_len = 0;
+                        tx->rate_idx = tx->last_frag_rate_idx;
                 }
 
-                if (baserate)
-                        control->rts_cts_rate = baserate;
-                else
-                        control->rts_cts_rate = &sband->bitrates[0];
-        }
-
-        if (tx->sta) {
-                control->aid = tx->sta->aid;
-                tx->sta->tx_packets++;
-                tx->sta->tx_fragments++;
-                tx->sta->tx_bytes += tx->skb->len;
-                if (tx->extra_frag) {
-                        int i;
-                        tx->sta->tx_fragments += tx->num_extra_frag;
-                        for (i = 0; i < tx->num_extra_frag; i++) {
-                                tx->sta->tx_bytes +=
-                                        tx->extra_frag[i]->len;
-                        }
-                }
+                hdr = (struct ieee80211_hdr *)tx->extra_frag[i]->data;
+                hdr->duration_id = ieee80211_duration(tx, 0, next_len);
         }
 
         return TX_CONTINUE;
 }
 
-static ieee80211_tx_result
-ieee80211_tx_h_load_stats(struct ieee80211_tx_data *tx)
+static ieee80211_tx_result debug_noinline
+ieee80211_tx_h_stats(struct ieee80211_tx_data *tx)
 {
-        struct ieee80211_local *local = tx->local;
-        struct sk_buff *skb = tx->skb;
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
-        u32 load = 0, hdrtime;
-        struct ieee80211_rate *rate = tx->rate;
-
-        /* TODO: this could be part of tx_status handling, so that the number
-         * of retries would be known; TX rate should in that case be stored
-         * somewhere with the packet */
-
-        /* Estimate total channel use caused by this frame */
-
-        /* 1 bit at 1 Mbit/s takes 1 usec; in channel_use values,
-         * 1 usec = 1/8 * (1080 / 10) = 13.5 */
-
-        if (tx->channel->band == IEEE80211_BAND_5GHZ ||
-            (tx->channel->band == IEEE80211_BAND_2GHZ &&
-             rate->flags & IEEE80211_RATE_ERP_G))
-                hdrtime = CHAN_UTIL_HDR_SHORT;
-        else
-                hdrtime = CHAN_UTIL_HDR_LONG;
-
-        load = hdrtime;
-        if (!is_multicast_ether_addr(hdr->addr1))
-                load += hdrtime;
-
-        if (tx->control->flags & IEEE80211_TXCTL_USE_RTS_CTS)
-                load += 2 * hdrtime;
-        else if (tx->control->flags & IEEE80211_TXCTL_USE_CTS_PROTECT)
-                load += hdrtime;
+        int i;
 
-        /* TODO: optimise again */
-        load += skb->len * CHAN_UTIL_RATE_LCM / rate->bitrate;
+        if (!tx->sta)
+                return TX_CONTINUE;
 
+        tx->sta->tx_packets++;
+        tx->sta->tx_fragments++;
+        tx->sta->tx_bytes += tx->skb->len;
         if (tx->extra_frag) {
-                int i;
-                for (i = 0; i < tx->num_extra_frag; i++) {
-                        load += 2 * hdrtime;
-                        load += tx->extra_frag[i]->len *
-                                tx->rate->bitrate;
-                }
+                tx->sta->tx_fragments += tx->num_extra_frag;
+                for (i = 0; i < tx->num_extra_frag; i++)
+                        tx->sta->tx_bytes += tx->extra_frag[i]->len;
         }
 
-        /* Divide channel_use by 8 to avoid wrapping around the counter */
-        load >>= CHAN_UTIL_SHIFT;
-        local->channel_use_raw += load;
-        if (tx->sta)
-                tx->sta->channel_use_raw += load;
-        tx->sdata->channel_use_raw += load;
-
         return TX_CONTINUE;
 }
 
 
-typedef ieee80211_tx_result (*ieee80211_tx_handler)(struct ieee80211_tx_data *);
-static ieee80211_tx_handler ieee80211_tx_handlers[] =
-{
-        ieee80211_tx_h_check_assoc,
-        ieee80211_tx_h_sequence,
-        ieee80211_tx_h_ps_buf,
-        ieee80211_tx_h_select_key,
-        ieee80211_tx_h_michael_mic_add,
-        ieee80211_tx_h_fragment,
-        ieee80211_tx_h_encrypt,
-        ieee80211_tx_h_rate_ctrl,
-        ieee80211_tx_h_misc,
-        ieee80211_tx_h_load_stats,
-        NULL
-};
-
 /* actual transmit path */
 
 /*
@@ -854,12 +848,12 @@ __ieee80211_parse_tx_radiotap(struct ieee80211_tx_data *tx,
                 (struct ieee80211_radiotap_header *) skb->data;
         struct ieee80211_supported_band *sband;
         int ret = ieee80211_radiotap_iterator_init(&iterator, rthdr, skb->len);
-        struct ieee80211_tx_control *control = tx->control;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 
-        sband = tx->local->hw.wiphy->bands[tx->local->hw.conf.channel->band];
+        sband = tx->local->hw.wiphy->bands[tx->channel->band];
 
-        control->flags |= IEEE80211_TXCTL_DO_NOT_ENCRYPT;
-        tx->flags |= IEEE80211_TX_INJECTED;
+        info->flags |= IEEE80211_TX_CTL_DO_NOT_ENCRYPT;
+        info->flags |= IEEE80211_TX_CTL_INJECTED;
         tx->flags &= ~IEEE80211_TX_FRAGMENTED;
 
         /*
@@ -896,7 +890,7 @@ __ieee80211_parse_tx_radiotap(struct ieee80211_tx_data *tx,
                                 r = &sband->bitrates[i];
 
                                 if (r->bitrate == target_rate) {
-                                        tx->rate = r;
+                                        tx->rate_idx = i;
                                         break;
                                 }
                         }
@@ -907,7 +901,7 @@ __ieee80211_parse_tx_radiotap(struct ieee80211_tx_data *tx,
                          * radiotap uses 0 for 1st ant, mac80211 is 1 for
                          * 1st ant
                          */
-                        control->antenna_sel_tx = (*iterator.this_arg) + 1;
+                        info->antenna_sel_tx = (*iterator.this_arg) + 1;
                         break;
 
 #if 0
@@ -931,8 +925,8 @@ __ieee80211_parse_tx_radiotap(struct ieee80211_tx_data *tx,
                                 skb_trim(skb, skb->len - FCS_LEN);
                         }
                         if (*iterator.this_arg & IEEE80211_RADIOTAP_F_WEP)
-                                control->flags &=
-                                        ~IEEE80211_TXCTL_DO_NOT_ENCRYPT;
+                                info->flags &=
+                                        ~IEEE80211_TX_CTL_DO_NOT_ENCRYPT;
                         if (*iterator.this_arg & IEEE80211_RADIOTAP_F_FRAG)
                                 tx->flags |= IEEE80211_TX_FRAGMENTED;
                         break;
@@ -967,12 +961,12 @@ __ieee80211_parse_tx_radiotap(struct ieee80211_tx_data *tx,
 static ieee80211_tx_result
 __ieee80211_tx_prepare(struct ieee80211_tx_data *tx,
                        struct sk_buff *skb,
-                       struct net_device *dev,
-                       struct ieee80211_tx_control *control)
+                       struct net_device *dev)
 {
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
         struct ieee80211_hdr *hdr;
         struct ieee80211_sub_if_data *sdata;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 
         int hdrlen;
 
@@ -981,7 +975,9 @@ __ieee80211_tx_prepare(struct ieee80211_tx_data *tx,
         tx->dev = dev; /* use original interface */
         tx->local = local;
         tx->sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        tx->control = control;
+        tx->channel = local->hw.conf.channel;
+        tx->rate_idx = -1;
+        tx->last_frag_rate_idx = -1;
         /*
          * Set this flag (used below to indicate "automatic fragmentation"),
          * it will be cleared/left by radiotap as desired.
@@ -1008,34 +1004,33 @@ __ieee80211_tx_prepare(struct ieee80211_tx_data *tx,
 
         if (is_multicast_ether_addr(hdr->addr1)) {
                 tx->flags &= ~IEEE80211_TX_UNICAST;
-                control->flags |= IEEE80211_TXCTL_NO_ACK;
+                info->flags |= IEEE80211_TX_CTL_NO_ACK;
         } else {
                 tx->flags |= IEEE80211_TX_UNICAST;
-                control->flags &= ~IEEE80211_TXCTL_NO_ACK;
+                info->flags &= ~IEEE80211_TX_CTL_NO_ACK;
         }
 
         if (tx->flags & IEEE80211_TX_FRAGMENTED) {
                 if ((tx->flags & IEEE80211_TX_UNICAST) &&
                     skb->len + FCS_LEN > local->fragmentation_threshold &&
-                    !local->ops->set_frag_threshold)
+                    !local->ops->set_frag_threshold &&
+                    !(info->flags & IEEE80211_TX_CTL_AMPDU))
                         tx->flags |= IEEE80211_TX_FRAGMENTED;
                 else
                         tx->flags &= ~IEEE80211_TX_FRAGMENTED;
         }
 
         if (!tx->sta)
-                control->flags |= IEEE80211_TXCTL_CLEAR_PS_FILT;
-        else if (tx->sta->flags & WLAN_STA_CLEAR_PS_FILT) {
-                control->flags |= IEEE80211_TXCTL_CLEAR_PS_FILT;
-                tx->sta->flags &= ~WLAN_STA_CLEAR_PS_FILT;
-        }
+                info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT;
+        else if (test_and_clear_sta_flags(tx->sta, WLAN_STA_CLEAR_PS_FILT))
+                info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT;
 
         hdrlen = ieee80211_get_hdrlen(tx->fc);
         if (skb->len > hdrlen + sizeof(rfc1042_header) + 2) {
                 u8 *pos = &skb->data[hdrlen + sizeof(rfc1042_header)];
                 tx->ethertype = (pos[0] << 8) | pos[1];
         }
-        control->flags |= IEEE80211_TXCTL_FIRST_FRAGMENT;
+        info->flags |= IEEE80211_TX_CTL_FIRST_FRAGMENT;
 
         return TX_CONTINUE;
 }
@@ -1045,14 +1040,12 @@ __ieee80211_tx_prepare(struct ieee80211_tx_data *tx,
  */
 static int ieee80211_tx_prepare(struct ieee80211_tx_data *tx,
                                 struct sk_buff *skb,
-                                struct net_device *mdev,
-                                struct ieee80211_tx_control *control)
+                                struct net_device *mdev)
 {
-        struct ieee80211_tx_packet_data *pkt_data;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         struct net_device *dev;
 
-        pkt_data = (struct ieee80211_tx_packet_data *)skb->cb;
-        dev = dev_get_by_index(&init_net, pkt_data->ifindex);
+        dev = dev_get_by_index(&init_net, info->control.ifindex);
         if (unlikely(dev && !is_ieee80211_device(dev, mdev))) {
                 dev_put(dev);
                 dev = NULL;
@@ -1060,7 +1053,7 @@ static int ieee80211_tx_prepare(struct ieee80211_tx_data *tx,
         if (unlikely(!dev))
                 return -ENODEV;
         /* initialises tx with control */
-        __ieee80211_tx_prepare(tx, skb, dev, control);
+        __ieee80211_tx_prepare(tx, skb, dev);
         dev_put(dev);
         return 0;
 }
@@ -1068,50 +1061,49 @@ static int ieee80211_tx_prepare(struct ieee80211_tx_data *tx,
 static int __ieee80211_tx(struct ieee80211_local *local, struct sk_buff *skb,
                           struct ieee80211_tx_data *tx)
 {
-        struct ieee80211_tx_control *control = tx->control;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         int ret, i;
 
-        if (!ieee80211_qdisc_installed(local->mdev) &&
-            __ieee80211_queue_stopped(local, 0)) {
-                netif_stop_queue(local->mdev);
+        if (netif_subqueue_stopped(local->mdev, skb))
                 return IEEE80211_TX_AGAIN;
-        }
+
         if (skb) {
                 ieee80211_dump_frame(wiphy_name(local->hw.wiphy),
                                      "TX to low-level driver", skb);
-                ret = local->ops->tx(local_to_hw(local), skb, control);
+                ret = local->ops->tx(local_to_hw(local), skb);
                 if (ret)
                         return IEEE80211_TX_AGAIN;
                 local->mdev->trans_start = jiffies;
                 ieee80211_led_tx(local, 1);
         }
         if (tx->extra_frag) {
-                control->flags &= ~(IEEE80211_TXCTL_USE_RTS_CTS |
-                                    IEEE80211_TXCTL_USE_CTS_PROTECT |
-                                    IEEE80211_TXCTL_CLEAR_PS_FILT |
-                                    IEEE80211_TXCTL_FIRST_FRAGMENT);
                 for (i = 0; i < tx->num_extra_frag; i++) {
                         if (!tx->extra_frag[i])
                                 continue;
-                        if (__ieee80211_queue_stopped(local, control->queue))
+                        info = IEEE80211_SKB_CB(tx->extra_frag[i]);
+                        info->flags &= ~(IEEE80211_TX_CTL_USE_RTS_CTS |
+                                         IEEE80211_TX_CTL_USE_CTS_PROTECT |
+                                         IEEE80211_TX_CTL_CLEAR_PS_FILT |
+                                         IEEE80211_TX_CTL_FIRST_FRAGMENT);
+                        if (netif_subqueue_stopped(local->mdev,
+                                                   tx->extra_frag[i]))
                                 return IEEE80211_TX_FRAG_AGAIN;
                         if (i == tx->num_extra_frag) {
-                                control->tx_rate = tx->last_frag_rate;
+                                info->tx_rate_idx = tx->last_frag_rate_idx;
 
                                 if (tx->flags & IEEE80211_TX_PROBE_LAST_FRAG)
-                                        control->flags |=
-                                                IEEE80211_TXCTL_RATE_CTRL_PROBE;
+                                        info->flags |=
+                                                IEEE80211_TX_CTL_RATE_CTRL_PROBE;
                                 else
-                                        control->flags &=
-                                                ~IEEE80211_TXCTL_RATE_CTRL_PROBE;
+                                        info->flags &=
+                                                ~IEEE80211_TX_CTL_RATE_CTRL_PROBE;
                         }
 
                         ieee80211_dump_frame(wiphy_name(local->hw.wiphy),
                                              "TX to low-level driver",
                                              tx->extra_frag[i]);
                         ret = local->ops->tx(local_to_hw(local),
-                                            tx->extra_frag[i],
-                                            control);
+                                            tx->extra_frag[i]);
                         if (ret)
                                 return IEEE80211_TX_FRAG_AGAIN;
                         local->mdev->trans_start = jiffies;
@@ -1124,17 +1116,65 @@ static int __ieee80211_tx(struct ieee80211_local *local, struct sk_buff *skb,
         return IEEE80211_TX_OK;
 }
 
-static int ieee80211_tx(struct net_device *dev, struct sk_buff *skb,
-                        struct ieee80211_tx_control *control)
+/*
+ * Invoke TX handlers, return 0 on success and non-zero if the
+ * frame was dropped or queued.
+ */
+static int invoke_tx_handlers(struct ieee80211_tx_data *tx)
+{
+        struct sk_buff *skb = tx->skb;
+        ieee80211_tx_result res = TX_DROP;
+        int i;
+
+#define CALL_TXH(txh)           \
+        res = txh(tx);          \
+        if (res != TX_CONTINUE) \
+                goto txh_done;
+
+        CALL_TXH(ieee80211_tx_h_check_assoc)
+        CALL_TXH(ieee80211_tx_h_ps_buf)
+        CALL_TXH(ieee80211_tx_h_select_key)
+        CALL_TXH(ieee80211_tx_h_michael_mic_add)
+        CALL_TXH(ieee80211_tx_h_rate_ctrl)
+        CALL_TXH(ieee80211_tx_h_misc)
+        CALL_TXH(ieee80211_tx_h_sequence)
+        CALL_TXH(ieee80211_tx_h_fragment)
+        /* handlers after fragment must be aware of tx info fragmentation! */
+        CALL_TXH(ieee80211_tx_h_encrypt)
+        CALL_TXH(ieee80211_tx_h_calculate_duration)
+        CALL_TXH(ieee80211_tx_h_stats)
+#undef CALL_TXH
+
+ txh_done:
+        if (unlikely(res == TX_DROP)) {
+                I802_DEBUG_INC(tx->local->tx_handlers_drop);
+                dev_kfree_skb(skb);
+                for (i = 0; i < tx->num_extra_frag; i++)
+                        if (tx->extra_frag[i])
+                                dev_kfree_skb(tx->extra_frag[i]);
+                kfree(tx->extra_frag);
+                return -1;
+        } else if (unlikely(res == TX_QUEUED)) {
+                I802_DEBUG_INC(tx->local->tx_handlers_queued);
+                return -1;
+        }
+
+        return 0;
+}
+
+static int ieee80211_tx(struct net_device *dev, struct sk_buff *skb)
 {
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
         struct sta_info *sta;
-        ieee80211_tx_handler *handler;
         struct ieee80211_tx_data tx;
-        ieee80211_tx_result res = TX_DROP, res_prepare;
-        int ret, i, retries = 0;
+        ieee80211_tx_result res_prepare;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+        int ret, i;
+        u16 queue;
+
+        queue = skb_get_queue_mapping(skb);
 
-        WARN_ON(__ieee80211_queue_pending(local, control->queue));
+        WARN_ON(test_bit(queue, local->queues_pending));
 
         if (unlikely(skb->len < 10)) {
                 dev_kfree_skb(skb);
@@ -1144,7 +1184,7 @@ static int ieee80211_tx(struct net_device *dev, struct sk_buff *skb,
         rcu_read_lock();
 
         /* initialises tx */
-        res_prepare = __ieee80211_tx_prepare(&tx, skb, dev, control);
+        res_prepare = __ieee80211_tx_prepare(&tx, skb, dev);
 
         if (res_prepare == TX_DROP) {
                 dev_kfree_skb(skb);
@@ -1154,86 +1194,53 @@ static int ieee80211_tx(struct net_device *dev, struct sk_buff *skb,
 
         sta = tx.sta;
         tx.channel = local->hw.conf.channel;
+        info->band = tx.channel->band;
 
-        for (handler = ieee80211_tx_handlers; *handler != NULL;
-             handler++) {
-                res = (*handler)(&tx);
-                if (res != TX_CONTINUE)
-                        break;
-        }
-
-        skb = tx.skb; /* handlers are allowed to change skb */
-
-        if (unlikely(res == TX_DROP)) {
-                I802_DEBUG_INC(local->tx_handlers_drop);
-                goto drop;
-        }
-
-        if (unlikely(res == TX_QUEUED)) {
-                I802_DEBUG_INC(local->tx_handlers_queued);
-                rcu_read_unlock();
-                return 0;
-        }
-
-        if (tx.extra_frag) {
-                for (i = 0; i < tx.num_extra_frag; i++) {
-                        int next_len, dur;
-                        struct ieee80211_hdr *hdr =
-                                (struct ieee80211_hdr *)
-                                tx.extra_frag[i]->data;
-
-                        if (i + 1 < tx.num_extra_frag) {
-                                next_len = tx.extra_frag[i + 1]->len;
-                        } else {
-                                next_len = 0;
-                                tx.rate = tx.last_frag_rate;
-                        }
-                        dur = ieee80211_duration(&tx, 0, next_len);
-                        hdr->duration_id = cpu_to_le16(dur);
-                }
-        }
+        if (invoke_tx_handlers(&tx))
+                goto out;
 
 retry:
         ret = __ieee80211_tx(local, skb, &tx);
         if (ret) {
-                struct ieee80211_tx_stored_packet *store =
-                        &local->pending_packet[control->queue];
+                struct ieee80211_tx_stored_packet *store;
+
+                /*
+                 * Since there are no fragmented frames on A-MPDU
+                 * queues, there's no reason for a driver to reject
+                 * a frame there, warn and drop it.
+                 */
+                if (WARN_ON(queue >= ieee80211_num_regular_queues(&local->hw)))
+                        goto drop;
+
+                store = &local->pending_packet[queue];
 
                 if (ret == IEEE80211_TX_FRAG_AGAIN)
                         skb = NULL;
-                set_bit(IEEE80211_LINK_STATE_PENDING,
-                        &local->state[control->queue]);
+                set_bit(queue, local->queues_pending);
                 smp_mb();
-                /* When the driver gets out of buffers during sending of
-                 * fragments and calls ieee80211_stop_queue, there is
-                 * a small window between IEEE80211_LINK_STATE_XOFF and
-                 * IEEE80211_LINK_STATE_PENDING flags are set. If a buffer
+                /*
+                 * When the driver gets out of buffers during sending of
+                 * fragments and calls ieee80211_stop_queue, the netif
+                 * subqueue is stopped. There is, however, a small window
+                 * in which the PENDING bit is not yet set. If a buffer
                  * gets available in that window (i.e. driver calls
                  * ieee80211_wake_queue), we would end up with ieee80211_tx
-                 * called with IEEE80211_LINK_STATE_PENDING. Prevent this by
+                 * called with the PENDING bit still set. Prevent this by
                  * continuing transmitting here when that situation is
-                 * possible to have happened. */
-                if (!__ieee80211_queue_stopped(local, control->queue)) {
-                        clear_bit(IEEE80211_LINK_STATE_PENDING,
-                                  &local->state[control->queue]);
-                        retries++;
-                        /*
-                         * Driver bug, it's rejecting packets but
-                         * not stopping queues.
-                         */
-                        if (WARN_ON_ONCE(retries > 5))
-                                goto drop;
+                 * possible to have happened.
+                 */
+                if (!__netif_subqueue_stopped(local->mdev, queue)) {
+                        clear_bit(queue, local->queues_pending);
                         goto retry;
                 }
-                memcpy(&store->control, control,
-                       sizeof(struct ieee80211_tx_control));
                 store->skb = skb;
                 store->extra_frag = tx.extra_frag;
                 store->num_extra_frag = tx.num_extra_frag;
-                store->last_frag_rate = tx.last_frag_rate;
+                store->last_frag_rate_idx = tx.last_frag_rate_idx;
                 store->last_frag_rate_ctrl_probe =
                         !!(tx.flags & IEEE80211_TX_PROBE_LAST_FRAG);
         }
+ out:
         rcu_read_unlock();
         return 0;
 
@@ -1250,24 +1257,57 @@ retry:
 
 /* device xmit handlers */
 
+static int ieee80211_skb_resize(struct ieee80211_local *local,
+                                struct sk_buff *skb,
+                                int head_need, bool may_encrypt)
+{
+        int tail_need = 0;
+
+        /*
+         * This could be optimised, devices that do full hardware
+         * crypto (including TKIP MMIC) need no tailroom... But we
+         * have no drivers for such devices currently.
+         */
+        if (may_encrypt) {
+                tail_need = IEEE80211_ENCRYPT_TAILROOM;
+                tail_need -= skb_tailroom(skb);
+                tail_need = max_t(int, tail_need, 0);
+        }
+
+        if (head_need || tail_need) {
+                /* Sorry. Can't account for this any more */
+                skb_orphan(skb);
+        }
+
+        if (skb_header_cloned(skb))
+                I802_DEBUG_INC(local->tx_expand_skb_head_cloned);
+        else
+                I802_DEBUG_INC(local->tx_expand_skb_head);
+
+        if (pskb_expand_head(skb, head_need, tail_need, GFP_ATOMIC)) {
+                printk(KERN_DEBUG "%s: failed to reallocate TX buffer\n",
+                       wiphy_name(local->hw.wiphy));
+                return -ENOMEM;
+        }
+
+        /* update truesize too */
+        skb->truesize += head_need + tail_need;
+
+        return 0;
+}
+
 int ieee80211_master_start_xmit(struct sk_buff *skb,
                                 struct net_device *dev)
 {
-        struct ieee80211_tx_control control;
-        struct ieee80211_tx_packet_data *pkt_data;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         struct net_device *odev = NULL;
         struct ieee80211_sub_if_data *osdata;
         int headroom;
+        bool may_encrypt;
         int ret;
 
-        /*
-         * copy control out of the skb so other people can use skb->cb
-         */
-        pkt_data = (struct ieee80211_tx_packet_data *)skb->cb;
-        memset(&control, 0, sizeof(struct ieee80211_tx_control));
-
-        if (pkt_data->ifindex)
-                odev = dev_get_by_index(&init_net, pkt_data->ifindex);
+        if (info->control.ifindex)
+                odev = dev_get_by_index(&init_net, info->control.ifindex);
         if (unlikely(odev && !is_ieee80211_device(odev, dev))) {
                 dev_put(odev);
                 odev = NULL;
@@ -1280,32 +1320,25 @@ int ieee80211_master_start_xmit(struct sk_buff *skb,
                 dev_kfree_skb(skb);
                 return 0;
         }
+
         osdata = IEEE80211_DEV_TO_SUB_IF(odev);
 
-        headroom = osdata->local->tx_headroom + IEEE80211_ENCRYPT_HEADROOM;
-        if (skb_headroom(skb) < headroom) {
-                if (pskb_expand_head(skb, headroom, 0, GFP_ATOMIC)) {
-                        dev_kfree_skb(skb);
-                        dev_put(odev);
-                        return 0;
-                }
+        may_encrypt = !(info->flags & IEEE80211_TX_CTL_DO_NOT_ENCRYPT);
+
+        headroom = osdata->local->tx_headroom;
+        if (may_encrypt)
+                headroom += IEEE80211_ENCRYPT_HEADROOM;
+        headroom -= skb_headroom(skb);
+        headroom = max_t(int, 0, headroom);
+
+        if (ieee80211_skb_resize(osdata->local, skb, headroom, may_encrypt)) {
+                dev_kfree_skb(skb);
+                dev_put(odev);
+                return 0;
         }
 
-        control.vif = &osdata->vif;
-        control.type = osdata->vif.type;
-        if (pkt_data->flags & IEEE80211_TXPD_REQ_TX_STATUS)
-                control.flags |= IEEE80211_TXCTL_REQ_TX_STATUS;
-        if (pkt_data->flags & IEEE80211_TXPD_DO_NOT_ENCRYPT)
-                control.flags |= IEEE80211_TXCTL_DO_NOT_ENCRYPT;
-        if (pkt_data->flags & IEEE80211_TXPD_REQUEUE)
-                control.flags |= IEEE80211_TXCTL_REQUEUE;
-        if (pkt_data->flags & IEEE80211_TXPD_EAPOL_FRAME)
-                control.flags |= IEEE80211_TXCTL_EAPOL_FRAME;
-        if (pkt_data->flags & IEEE80211_TXPD_AMPDU)
-                control.flags |= IEEE80211_TXCTL_AMPDU;
-        control.queue = pkt_data->queue;
-
-        ret = ieee80211_tx(odev, skb, &control);
+        info->control.vif = &osdata->vif;
+        ret = ieee80211_tx(odev, skb);
         dev_put(odev);
 
         return ret;
@@ -1315,7 +1348,7 @@ int ieee80211_monitor_start_xmit(struct sk_buff *skb,
                                  struct net_device *dev)
 {
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        struct ieee80211_tx_packet_data *pkt_data;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         struct ieee80211_radiotap_header *prthdr =
                 (struct ieee80211_radiotap_header *)skb->data;
         u16 len_rthdr;
@@ -1337,12 +1370,12 @@ int ieee80211_monitor_start_xmit(struct sk_buff *skb,
 
         skb->dev = local->mdev;
 
-        pkt_data = (struct ieee80211_tx_packet_data *)skb->cb;
-        memset(pkt_data, 0, sizeof(*pkt_data));
         /* needed because we set skb device to master */
-        pkt_data->ifindex = dev->ifindex;
+        info->control.ifindex = dev->ifindex;
 
-        pkt_data->flags |= IEEE80211_TXPD_DO_NOT_ENCRYPT;
+        info->flags |= IEEE80211_TX_CTL_DO_NOT_ENCRYPT;
+        /* Interfaces should always request a status report */
+        info->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
 
         /*
          * fix up the pointers accounting for the radiotap
@@ -1386,10 +1419,11 @@ int ieee80211_subif_start_xmit(struct sk_buff *skb,
                                struct net_device *dev)
 {
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        struct ieee80211_tx_packet_data *pkt_data;
+        struct ieee80211_tx_info *info;
         struct ieee80211_sub_if_data *sdata;
         int ret = 1, head_need;
-        u16 ethertype, hdrlen,  meshhdrlen = 0, fc;
+        u16 ethertype, hdrlen,  meshhdrlen = 0;
+        __le16 fc;
         struct ieee80211_hdr hdr;
         struct ieee80211s_hdr mesh_hdr;
         const u8 *encaps_data;
@@ -1400,8 +1434,6 @@ int ieee80211_subif_start_xmit(struct sk_buff *skb,
 
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         if (unlikely(skb->len < ETH_HLEN)) {
-                printk(KERN_DEBUG "%s: short skb (len=%d)\n",
-                       dev->name, skb->len);
                 ret = 0;
                 goto fail;
         }
@@ -1412,12 +1444,12 @@ int ieee80211_subif_start_xmit(struct sk_buff *skb,
         /* convert Ethernet header to proper 802.11 header (based on
          * operation mode) */
         ethertype = (skb->data[12] << 8) | skb->data[13];
-        fc = IEEE80211_FTYPE_DATA | IEEE80211_STYPE_DATA;
+        fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_DATA);
 
         switch (sdata->vif.type) {
         case IEEE80211_IF_TYPE_AP:
         case IEEE80211_IF_TYPE_VLAN:
-                fc |= IEEE80211_FCTL_FROMDS;
+                fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS);
                 /* DA BSSID SA */
                 memcpy(hdr.addr1, skb->data, ETH_ALEN);
                 memcpy(hdr.addr2, dev->dev_addr, ETH_ALEN);
@@ -1425,7 +1457,7 @@ int ieee80211_subif_start_xmit(struct sk_buff *skb,
                 hdrlen = 24;
                 break;
         case IEEE80211_IF_TYPE_WDS:
-                fc |= IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS;
+                fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
                 /* RA TA DA SA */
                 memcpy(hdr.addr1, sdata->u.wds.remote_addr, ETH_ALEN);
                 memcpy(hdr.addr2, dev->dev_addr, ETH_ALEN);
@@ -1435,7 +1467,7 @@ int ieee80211_subif_start_xmit(struct sk_buff *skb,
                 break;
 #ifdef CONFIG_MAC80211_MESH
         case IEEE80211_IF_TYPE_MESH_POINT:
-                fc |= IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS;
+                fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
                 /* RA TA DA SA */
                 if (is_multicast_ether_addr(skb->data))
                         memcpy(hdr.addr1, skb->data, ETH_ALEN);
@@ -1465,7 +1497,7 @@ int ieee80211_subif_start_xmit(struct sk_buff *skb,
                 break;
 #endif
         case IEEE80211_IF_TYPE_STA:
-                fc |= IEEE80211_FCTL_TODS;
+                fc |= cpu_to_le16(IEEE80211_FCTL_TODS);
                 /* BSSID SA DA */
                 memcpy(hdr.addr1, sdata->u.sta.bssid, ETH_ALEN);
                 memcpy(hdr.addr2, skb->data + ETH_ALEN, ETH_ALEN);
@@ -1493,13 +1525,14 @@ int ieee80211_subif_start_xmit(struct sk_buff *skb,
                 rcu_read_lock();
                 sta = sta_info_get(local, hdr.addr1);
                 if (sta)
-                        sta_flags = sta->flags;
+                        sta_flags = get_sta_flags(sta);
                 rcu_read_unlock();
         }
 
-        /* receiver is QoS enabled, use a QoS type frame */
-        if (sta_flags & WLAN_STA_WME) {
-                fc |= IEEE80211_STYPE_QOS_DATA;
+        /* receiver and we are QoS enabled, use a QoS type frame */
+        if (sta_flags & WLAN_STA_WME &&
+            ieee80211_num_regular_queues(&local->hw) >= 4) {
+                fc |= cpu_to_le16(IEEE80211_STYPE_QOS_DATA);
                 hdrlen += 2;
         }
 
@@ -1527,7 +1560,7 @@ int ieee80211_subif_start_xmit(struct sk_buff *skb,
                 goto fail;
         }
 
-        hdr.frame_control = cpu_to_le16(fc);
+        hdr.frame_control = fc;
         hdr.duration_id = 0;
         hdr.seq_ctrl = 0;
 
@@ -1562,32 +1595,26 @@ int ieee80211_subif_start_xmit(struct sk_buff *skb,
          * build in headroom in __dev_alloc_skb() (linux/skbuff.h) and
          * alloc_skb() (net/core/skbuff.c)
          */
-        head_need = hdrlen + encaps_len + meshhdrlen + local->tx_headroom;
-        head_need -= skb_headroom(skb);
+        head_need = hdrlen + encaps_len + meshhdrlen - skb_headroom(skb);
 
-        /* We are going to modify skb data, so make a copy of it if happens to
-         * be cloned. This could happen, e.g., with Linux bridge code passing
-         * us broadcast frames. */
+        /*
+         * So we need to modify the skb header and hence need a copy of
+         * that. The head_need variable above doesn't, so far, include
+         * the needed header space that we don't need right away. If we
+         * can, then we don't reallocate right now but only after the
+         * frame arrives at the master device (if it does...)
+         *
+         * If we cannot, however, then we will reallocate to include all
+         * the ever needed space. Also, if we need to reallocate it anyway,
+         * make it big enough for everything we may ever need.
+         */
 
         if (head_need > 0 || skb_cloned(skb)) {
-#if 0
-                printk(KERN_DEBUG "%s: need to reallocate buffer for %d bytes "
-                       "of headroom\n", dev->name, head_need);
-#endif
-
-                if (skb_cloned(skb))
-                        I802_DEBUG_INC(local->tx_expand_skb_head_cloned);
-                else
-                        I802_DEBUG_INC(local->tx_expand_skb_head);
-                /* Since we have to reallocate the buffer, make sure that there
-                 * is enough room for possible WEP IV/ICV and TKIP (8 bytes
-                 * before payload and 12 after). */
-                if (pskb_expand_head(skb, (head_need > 0 ? head_need + 8 : 8),
-                                     12, GFP_ATOMIC)) {
-                        printk(KERN_DEBUG "%s: failed to reallocate TX buffer"
-                               "\n", dev->name);
+                head_need += IEEE80211_ENCRYPT_HEADROOM;
+                head_need += local->tx_headroom;
+                head_need = max_t(int, 0, head_need);
+                if (ieee80211_skb_resize(local, skb, head_need, true))
                         goto fail;
-                }
         }
 
         if (encaps_data) {
@@ -1602,7 +1629,7 @@ int ieee80211_subif_start_xmit(struct sk_buff *skb,
                 h_pos += meshhdrlen;
         }
 
-        if (fc & IEEE80211_STYPE_QOS_DATA) {
+        if (ieee80211_is_data_qos(fc)) {
                 __le16 *qos_control;
 
                 qos_control = (__le16*) skb_push(skb, 2);
@@ -1618,11 +1645,14 @@ int ieee80211_subif_start_xmit(struct sk_buff *skb,
         nh_pos += hdrlen;
         h_pos += hdrlen;
 
-        pkt_data = (struct ieee80211_tx_packet_data *)skb->cb;
-        memset(pkt_data, 0, sizeof(struct ieee80211_tx_packet_data));
-        pkt_data->ifindex = dev->ifindex;
+        info = IEEE80211_SKB_CB(skb);
+        memset(info, 0, sizeof(*info));
+        info->control.ifindex = dev->ifindex;
         if (ethertype == ETH_P_PAE)
-                pkt_data->flags |= IEEE80211_TXPD_EAPOL_FRAME;
+                info->flags |= IEEE80211_TX_CTL_EAPOL_FRAME;
+
+        /* Interfaces should always request a status report */
+        info->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
 
         skb->dev = local->mdev;
         dev->stats.tx_packets++;
@@ -1647,46 +1677,55 @@ int ieee80211_subif_start_xmit(struct sk_buff *skb,
         return ret;
 }
 
-/* helper functions for pending packets for when queues are stopped */
 
+/*
+ * ieee80211_clear_tx_pending may not be called in a context where
+ * it is possible that it packets could come in again.
+ */
 void ieee80211_clear_tx_pending(struct ieee80211_local *local)
 {
         int i, j;
         struct ieee80211_tx_stored_packet *store;
 
-        for (i = 0; i < local->hw.queues; i++) {
-                if (!__ieee80211_queue_pending(local, i))
+        for (i = 0; i < ieee80211_num_regular_queues(&local->hw); i++) {
+                if (!test_bit(i, local->queues_pending))
                         continue;
                 store = &local->pending_packet[i];
                 kfree_skb(store->skb);
                 for (j = 0; j < store->num_extra_frag; j++)
                         kfree_skb(store->extra_frag[j]);
                 kfree(store->extra_frag);
-                clear_bit(IEEE80211_LINK_STATE_PENDING, &local->state[i]);
+                clear_bit(i, local->queues_pending);
         }
 }
 
+/*
+ * Transmit all pending packets. Called from tasklet, locks master device
+ * TX lock so that no new packets can come in.
+ */
 void ieee80211_tx_pending(unsigned long data)
 {
         struct ieee80211_local *local = (struct ieee80211_local *)data;
         struct net_device *dev = local->mdev;
         struct ieee80211_tx_stored_packet *store;
         struct ieee80211_tx_data tx;
-        int i, ret, reschedule = 0;
+        int i, ret;
 
         netif_tx_lock_bh(dev);
-        for (i = 0; i < local->hw.queues; i++) {
-                if (__ieee80211_queue_stopped(local, i))
+        for (i = 0; i < ieee80211_num_regular_queues(&local->hw); i++) {
+                /* Check that this queue is ok */
+                if (__netif_subqueue_stopped(local->mdev, i))
                         continue;
-                if (!__ieee80211_queue_pending(local, i)) {
-                        reschedule = 1;
+
+                if (!test_bit(i, local->queues_pending)) {
+                        ieee80211_wake_queue(&local->hw, i);
                         continue;
                 }
+
                 store = &local->pending_packet[i];
-                tx.control = &store->control;
                 tx.extra_frag = store->extra_frag;
                 tx.num_extra_frag = store->num_extra_frag;
-                tx.last_frag_rate = store->last_frag_rate;
+                tx.last_frag_rate_idx = store->last_frag_rate_idx;
                 tx.flags = 0;
                 if (store->last_frag_rate_ctrl_probe)
                         tx.flags |= IEEE80211_TX_PROBE_LAST_FRAG;
@@ -1695,19 +1734,11 @@ void ieee80211_tx_pending(unsigned long data)
                         if (ret == IEEE80211_TX_FRAG_AGAIN)
                                 store->skb = NULL;
                 } else {
-                        clear_bit(IEEE80211_LINK_STATE_PENDING,
-                                  &local->state[i]);
-                        reschedule = 1;
+                        clear_bit(i, local->queues_pending);
+                        ieee80211_wake_queue(&local->hw, i);
                 }
         }
         netif_tx_unlock_bh(dev);
-        if (reschedule) {
-                if (!ieee80211_qdisc_installed(dev)) {
-                        if (!__ieee80211_queue_stopped(local, 0))
-                                netif_wake_queue(dev);
-                } else
-                        netif_schedule(dev);
-        }
 }
 
 /* functions for drivers to get certain frames */
@@ -1776,23 +1807,24 @@ static void ieee80211_beacon_add_tim(struct ieee80211_local *local,
 }
 
 struct sk_buff *ieee80211_beacon_get(struct ieee80211_hw *hw,
-                                     struct ieee80211_vif *vif,
-                                     struct ieee80211_tx_control *control)
+                                     struct ieee80211_vif *vif)
 {
         struct ieee80211_local *local = hw_to_local(hw);
-        struct sk_buff *skb;
+        struct sk_buff *skb = NULL;
+        struct ieee80211_tx_info *info;
         struct net_device *bdev;
         struct ieee80211_sub_if_data *sdata = NULL;
         struct ieee80211_if_ap *ap = NULL;
+        struct ieee80211_if_sta *ifsta = NULL;
         struct rate_selection rsel;
         struct beacon_data *beacon;
         struct ieee80211_supported_band *sband;
         struct ieee80211_mgmt *mgmt;
         int *num_beacons;
-        bool err = true;
+        enum ieee80211_band band = local->hw.conf.channel->band;
         u8 *pos;
 
-        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
+        sband = local->hw.wiphy->bands[band];
 
         rcu_read_lock();
 
@@ -1817,9 +1849,6 @@ struct sk_buff *ieee80211_beacon_get(struct ieee80211_hw *hw,
                         memcpy(skb_put(skb, beacon->head_len), beacon->head,
                                beacon->head_len);
 
-                        ieee80211_include_sequence(sdata,
-                                        (struct ieee80211_hdr *)skb->data);
-
                         /*
                          * Not very nice, but we want to allow the driver to call
                          * ieee80211_beacon_get() as a response to the set_tim()
@@ -1842,9 +1871,24 @@ struct sk_buff *ieee80211_beacon_get(struct ieee80211_hw *hw,
                                        beacon->tail, beacon->tail_len);
 
                         num_beacons = &ap->num_beacons;
+                } else
+                        goto out;
+        } else if (sdata->vif.type == IEEE80211_IF_TYPE_IBSS) {
+                struct ieee80211_hdr *hdr;
+                ifsta = &sdata->u.sta;
 
-                        err = false;
-                }
+                if (!ifsta->probe_resp)
+                        goto out;
+
+                skb = skb_copy(ifsta->probe_resp, GFP_ATOMIC);
+                if (!skb)
+                        goto out;
+
+                hdr = (struct ieee80211_hdr *) skb->data;
+                hdr->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
+                                                  IEEE80211_STYPE_BEACON);
+
+                num_beacons = &ifsta->num_beacons;
         } else if (ieee80211_vif_is_mesh(&sdata->vif)) {
                 /* headroom, head length, tail length and maximum TIM length */
                 skb = dev_alloc_skb(local->tx_headroom + 400);
@@ -1855,8 +1899,8 @@ struct sk_buff *ieee80211_beacon_get(struct ieee80211_hw *hw,
                 mgmt = (struct ieee80211_mgmt *)
                         skb_put(skb, 24 + sizeof(mgmt->u.beacon));
                 memset(mgmt, 0, 24 + sizeof(mgmt->u.beacon));
-                mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
-                                                   IEEE80211_STYPE_BEACON);
+                mgmt->frame_control =
+                    cpu_to_le16(IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_BEACON);
                 memset(mgmt->da, 0xff, ETH_ALEN);
                 memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
                 /* BSSID is left zeroed, wildcard value */
@@ -1871,44 +1915,41 @@ struct sk_buff *ieee80211_beacon_get(struct ieee80211_hw *hw,
                 mesh_mgmt_ies_add(skb, sdata->dev);
 
                 num_beacons = &sdata->u.sta.num_beacons;
-
-                err = false;
+        } else {
+                WARN_ON(1);
+                goto out;
         }
 
-        if (err) {
-#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
-                if (net_ratelimit())
-                        printk(KERN_DEBUG "no beacon data avail for %s\n",
-                               bdev->name);
-#endif /* CONFIG_MAC80211_VERBOSE_DEBUG */
+        info = IEEE80211_SKB_CB(skb);
+
+        info->band = band;
+        rate_control_get_rate(local->mdev, sband, skb, &rsel);
+
+        if (unlikely(rsel.rate_idx < 0)) {
+                if (net_ratelimit()) {
+                        printk(KERN_DEBUG "%s: ieee80211_beacon_get: "
+                               "no rate found\n",
+                               wiphy_name(local->hw.wiphy));
+                }
+                dev_kfree_skb(skb);
                 skb = NULL;
                 goto out;
         }
 
-        if (control) {
-                rate_control_get_rate(local->mdev, sband, skb, &rsel);
-                if (!rsel.rate) {
-                        if (net_ratelimit()) {
-                                printk(KERN_DEBUG "%s: ieee80211_beacon_get: "
-                                       "no rate found\n",
-                                       wiphy_name(local->hw.wiphy));
-                        }
-                        dev_kfree_skb(skb);
-                        skb = NULL;
-                        goto out;
-                }
+        info->control.vif = vif;
+        info->tx_rate_idx = rsel.rate_idx;
+
+        info->flags |= IEEE80211_TX_CTL_NO_ACK;
+        info->flags |= IEEE80211_TX_CTL_DO_NOT_ENCRYPT;
+        info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT;
+        info->flags |= IEEE80211_TX_CTL_ASSIGN_SEQ;
+        if (sdata->bss_conf.use_short_preamble &&
+            sband->bitrates[rsel.rate_idx].flags & IEEE80211_RATE_SHORT_PREAMBLE)
+                info->flags |= IEEE80211_TX_CTL_SHORT_PREAMBLE;
+
+        info->antenna_sel_tx = local->hw.conf.antenna_sel_tx;
+        info->control.retry_limit = 1;
 
-                control->vif = vif;
-                control->tx_rate = rsel.rate;
-                if (sdata->bss_conf.use_short_preamble &&
-                    rsel.rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
-                        control->flags |= IEEE80211_TXCTL_SHORT_PREAMBLE;
-                control->antenna_sel_tx = local->hw.conf.antenna_sel_tx;
-                control->flags |= IEEE80211_TXCTL_NO_ACK;
-                control->flags |= IEEE80211_TXCTL_DO_NOT_ENCRYPT;
-                control->retry_limit = 1;
-                control->flags |= IEEE80211_TXCTL_CLEAR_PS_FILT;
-        }
         (*num_beacons)++;
 out:
         rcu_read_unlock();
@@ -1918,14 +1959,13 @@ EXPORT_SYMBOL(ieee80211_beacon_get);
 
 void ieee80211_rts_get(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                        const void *frame, size_t frame_len,
-                       const struct ieee80211_tx_control *frame_txctl,
+                       const struct ieee80211_tx_info *frame_txctl,
                        struct ieee80211_rts *rts)
 {
         const struct ieee80211_hdr *hdr = frame;
-        u16 fctl;
 
-        fctl = IEEE80211_FTYPE_CTL | IEEE80211_STYPE_RTS;
-        rts->frame_control = cpu_to_le16(fctl);
+        rts->frame_control =
+            cpu_to_le16(IEEE80211_FTYPE_CTL | IEEE80211_STYPE_RTS);
         rts->duration = ieee80211_rts_duration(hw, vif, frame_len,
                                                frame_txctl);
         memcpy(rts->ra, hdr->addr1, sizeof(rts->ra));
@@ -1935,14 +1975,13 @@ EXPORT_SYMBOL(ieee80211_rts_get);
 
 void ieee80211_ctstoself_get(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                              const void *frame, size_t frame_len,
-                             const struct ieee80211_tx_control *frame_txctl,
+                             const struct ieee80211_tx_info *frame_txctl,
                              struct ieee80211_cts *cts)
 {
         const struct ieee80211_hdr *hdr = frame;
-        u16 fctl;
 
-        fctl = IEEE80211_FTYPE_CTL | IEEE80211_STYPE_CTS;
-        cts->frame_control = cpu_to_le16(fctl);
+        cts->frame_control =
+            cpu_to_le16(IEEE80211_FTYPE_CTL | IEEE80211_STYPE_CTS);
         cts->duration = ieee80211_ctstoself_duration(hw, vif,
                                                      frame_len, frame_txctl);
         memcpy(cts->ra, hdr->addr1, sizeof(cts->ra));
@@ -1951,23 +1990,21 @@ EXPORT_SYMBOL(ieee80211_ctstoself_get);
 
 struct sk_buff *
 ieee80211_get_buffered_bc(struct ieee80211_hw *hw,
-                          struct ieee80211_vif *vif,
-                          struct ieee80211_tx_control *control)
+                          struct ieee80211_vif *vif)
 {
         struct ieee80211_local *local = hw_to_local(hw);
-        struct sk_buff *skb;
+        struct sk_buff *skb = NULL;
         struct sta_info *sta;
-        ieee80211_tx_handler *handler;
         struct ieee80211_tx_data tx;
-        ieee80211_tx_result res = TX_DROP;
         struct net_device *bdev;
         struct ieee80211_sub_if_data *sdata;
         struct ieee80211_if_ap *bss = NULL;
         struct beacon_data *beacon;
+        struct ieee80211_tx_info *info;
 
         sdata = vif_to_sdata(vif);
         bdev = sdata->dev;
-
+        bss = &sdata->u.ap;
 
         if (!bss)
                 return NULL;
@@ -1975,19 +2012,16 @@ ieee80211_get_buffered_bc(struct ieee80211_hw *hw,
         rcu_read_lock();
         beacon = rcu_dereference(bss->beacon);
 
-        if (sdata->vif.type != IEEE80211_IF_TYPE_AP || !beacon ||
-            !beacon->head) {
-                rcu_read_unlock();
-                return NULL;
-        }
+        if (sdata->vif.type != IEEE80211_IF_TYPE_AP || !beacon || !beacon->head)
+                goto out;
 
         if (bss->dtim_count != 0)
-                return NULL; /* send buffered bc/mc only after DTIM beacon */
-        memset(control, 0, sizeof(*control));
+                goto out; /* send buffered bc/mc only after DTIM beacon */
+
         while (1) {
                 skb = skb_dequeue(&bss->ps_bc_buf);
                 if (!skb)
-                        return NULL;
+                        goto out;
                 local->total_ps_buffered--;
 
                 if (!skb_queue_empty(&bss->ps_bc_buf) && skb->len >= 2) {
@@ -2000,30 +2034,21 @@ ieee80211_get_buffered_bc(struct ieee80211_hw *hw,
                                 cpu_to_le16(IEEE80211_FCTL_MOREDATA);
                 }
 
-                if (!ieee80211_tx_prepare(&tx, skb, local->mdev, control))
+                if (!ieee80211_tx_prepare(&tx, skb, local->mdev))
                         break;
                 dev_kfree_skb_any(skb);
         }
+
+        info = IEEE80211_SKB_CB(skb);
+
         sta = tx.sta;
         tx.flags |= IEEE80211_TX_PS_BUFFERED;
         tx.channel = local->hw.conf.channel;
+        info->band = tx.channel->band;
 
-        for (handler = ieee80211_tx_handlers; *handler != NULL; handler++) {
-                res = (*handler)(&tx);
-                if (res == TX_DROP || res == TX_QUEUED)
-                        break;
-        }
-        skb = tx.skb; /* handlers are allowed to change skb */
-
-        if (res == TX_DROP) {
-                I802_DEBUG_INC(local->tx_handlers_drop);
-                dev_kfree_skb(skb);
-                skb = NULL;
-        } else if (res == TX_QUEUED) {
-                I802_DEBUG_INC(local->tx_handlers_queued);
+        if (invoke_tx_handlers(&tx))
                 skb = NULL;
-        }
-
+ out:
         rcu_read_unlock();
 
         return skb;
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 4e97b266f907..19f85e1b3695 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -45,38 +45,37 @@ const unsigned char bridge_tunnel_header[] __aligned(2) =
 u8 *ieee80211_get_bssid(struct ieee80211_hdr *hdr, size_t len,
                         enum ieee80211_if_types type)
 {
-        u16 fc;
+        __le16 fc = hdr->frame_control;
 
          /* drop ACK/CTS frames and incorrect hdr len (ctrl) */
         if (len < 16)
                 return NULL;
 
-        fc = le16_to_cpu(hdr->frame_control);
-
-        switch (fc & IEEE80211_FCTL_FTYPE) {
-        case IEEE80211_FTYPE_DATA:
+        if (ieee80211_is_data(fc)) {
                 if (len < 24) /* drop incorrect hdr len (data) */
                         return NULL;
-                switch (fc & (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) {
-                case IEEE80211_FCTL_TODS:
-                        return hdr->addr1;
-                case (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS):
+
+                if (ieee80211_has_a4(fc))
                         return NULL;
-                case IEEE80211_FCTL_FROMDS:
+                if (ieee80211_has_tods(fc))
+                        return hdr->addr1;
+                if (ieee80211_has_fromds(fc))
                         return hdr->addr2;
-                case 0:
-                        return hdr->addr3;
-                }
-                break;
-        case IEEE80211_FTYPE_MGMT:
+
+                return hdr->addr3;
+        }
+
+        if (ieee80211_is_mgmt(fc)) {
                 if (len < 24) /* drop incorrect hdr len (mgmt) */
                         return NULL;
                 return hdr->addr3;
-        case IEEE80211_FTYPE_CTL:
-                if ((fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_PSPOLL)
+        }
+
+        if (ieee80211_is_ctl(fc)) {
+                if(ieee80211_is_pspoll(fc))
                         return hdr->addr1;
-                else if ((fc & IEEE80211_FCTL_STYPE) ==
-                                                IEEE80211_STYPE_BACK_REQ) {
+
+                if (ieee80211_is_back_req(fc)) {
                         switch (type) {
                         case IEEE80211_IF_TYPE_STA:
                                 return hdr->addr2;
@@ -84,11 +83,9 @@ u8 *ieee80211_get_bssid(struct ieee80211_hdr *hdr, size_t len,
                         case IEEE80211_IF_TYPE_VLAN:
                                 return hdr->addr1;
                         default:
-                                return NULL;
+                                break; /* fall through to the return */
                         }
                 }
-                else
-                        return NULL;
         }
 
         return NULL;
@@ -133,14 +130,46 @@ int ieee80211_get_hdrlen(u16 fc)
 }
 EXPORT_SYMBOL(ieee80211_get_hdrlen);
 
-int ieee80211_get_hdrlen_from_skb(const struct sk_buff *skb)
+unsigned int ieee80211_hdrlen(__le16 fc)
 {
-        const struct ieee80211_hdr *hdr = (const struct ieee80211_hdr *) skb->data;
-        int hdrlen;
+        unsigned int hdrlen = 24;
+
+        if (ieee80211_is_data(fc)) {
+                if (ieee80211_has_a4(fc))
+                        hdrlen = 30;
+                if (ieee80211_is_data_qos(fc))
+                        hdrlen += IEEE80211_QOS_CTL_LEN;
+                goto out;
+        }
+
+        if (ieee80211_is_ctl(fc)) {
+                /*
+                 * ACK and CTS are 10 bytes, all others 16. To see how
+                 * to get this condition consider
+                 *   subtype mask:   0b0000000011110000 (0x00F0)
+                 *   ACK subtype:    0b0000000011010000 (0x00D0)
+                 *   CTS subtype:    0b0000000011000000 (0x00C0)
+                 *   bits that matter:         ^^^      (0x00E0)
+                 *   value of those: 0b0000000011000000 (0x00C0)
+                 */
+                if ((fc & cpu_to_le16(0x00E0)) == cpu_to_le16(0x00C0))
+                        hdrlen = 10;
+                else
+                        hdrlen = 16;
+        }
+out:
+        return hdrlen;
+}
+EXPORT_SYMBOL(ieee80211_hdrlen);
+
+unsigned int ieee80211_get_hdrlen_from_skb(const struct sk_buff *skb)
+{
+        const struct ieee80211_hdr *hdr = (const struct ieee80211_hdr *)skb->data;
+        unsigned int hdrlen;
 
         if (unlikely(skb->len < 10))
                 return 0;
-        hdrlen = ieee80211_get_hdrlen(le16_to_cpu(hdr->frame_control));
+        hdrlen = ieee80211_hdrlen(hdr->frame_control);
         if (unlikely(hdrlen > skb->len))
                 return 0;
         return hdrlen;
@@ -258,7 +287,7 @@ EXPORT_SYMBOL(ieee80211_generic_frame_duration);
 
 __le16 ieee80211_rts_duration(struct ieee80211_hw *hw,
                               struct ieee80211_vif *vif, size_t frame_len,
-                              const struct ieee80211_tx_control *frame_txctl)
+                              const struct ieee80211_tx_info *frame_txctl)
 {
         struct ieee80211_local *local = hw_to_local(hw);
         struct ieee80211_rate *rate;
@@ -266,10 +295,13 @@ __le16 ieee80211_rts_duration(struct ieee80211_hw *hw,
         bool short_preamble;
         int erp;
         u16 dur;
+        struct ieee80211_supported_band *sband;
+
+        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
 
         short_preamble = sdata->bss_conf.use_short_preamble;
 
-        rate = frame_txctl->rts_cts_rate;
+        rate = &sband->bitrates[frame_txctl->control.rts_cts_rate_idx];
 
         erp = 0;
         if (sdata->flags & IEEE80211_SDATA_OPERATING_GMODE)
@@ -292,7 +324,7 @@ EXPORT_SYMBOL(ieee80211_rts_duration);
 __le16 ieee80211_ctstoself_duration(struct ieee80211_hw *hw,
                                     struct ieee80211_vif *vif,
                                     size_t frame_len,
-                                    const struct ieee80211_tx_control *frame_txctl)
+                                    const struct ieee80211_tx_info *frame_txctl)
 {
         struct ieee80211_local *local = hw_to_local(hw);
         struct ieee80211_rate *rate;
@@ -300,10 +332,13 @@ __le16 ieee80211_ctstoself_duration(struct ieee80211_hw *hw,
         bool short_preamble;
         int erp;
         u16 dur;
+        struct ieee80211_supported_band *sband;
+
+        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
 
         short_preamble = sdata->bss_conf.use_short_preamble;
 
-        rate = frame_txctl->rts_cts_rate;
+        rate = &sband->bitrates[frame_txctl->control.rts_cts_rate_idx];
         erp = 0;
         if (sdata->flags & IEEE80211_SDATA_OPERATING_GMODE)
                 erp = rate->flags & IEEE80211_RATE_ERP_G;
@@ -311,7 +346,7 @@ __le16 ieee80211_ctstoself_duration(struct ieee80211_hw *hw,
         /* Data frame duration */
         dur = ieee80211_frame_duration(local, frame_len, rate->bitrate,
                                        erp, short_preamble);
-        if (!(frame_txctl->flags & IEEE80211_TXCTL_NO_ACK)) {
+        if (!(frame_txctl->flags & IEEE80211_TX_CTL_NO_ACK)) {
                 /* ACK duration */
                 dur += ieee80211_frame_duration(local, 10, rate->bitrate,
                                                 erp, short_preamble);
@@ -325,17 +360,10 @@ void ieee80211_wake_queue(struct ieee80211_hw *hw, int queue)
 {
         struct ieee80211_local *local = hw_to_local(hw);
 
-        if (test_and_clear_bit(IEEE80211_LINK_STATE_XOFF,
-                               &local->state[queue])) {
-                if (test_bit(IEEE80211_LINK_STATE_PENDING,
-                             &local->state[queue]))
-                        tasklet_schedule(&local->tx_pending_tasklet);
-                else
-                        if (!ieee80211_qdisc_installed(local->mdev)) {
-                                if (queue == 0)
-                                        netif_wake_queue(local->mdev);
-                        } else
-                                __netif_schedule(local->mdev);
+        if (test_bit(queue, local->queues_pending)) {
+                tasklet_schedule(&local->tx_pending_tasklet);
+        } else {
+                netif_wake_subqueue(local->mdev, queue);
         }
 }
 EXPORT_SYMBOL(ieee80211_wake_queue);
@@ -344,29 +372,15 @@ void ieee80211_stop_queue(struct ieee80211_hw *hw, int queue)
 {
         struct ieee80211_local *local = hw_to_local(hw);
 
-        if (!ieee80211_qdisc_installed(local->mdev) && queue == 0)
-                netif_stop_queue(local->mdev);
-        set_bit(IEEE80211_LINK_STATE_XOFF, &local->state[queue]);
+        netif_stop_subqueue(local->mdev, queue);
 }
 EXPORT_SYMBOL(ieee80211_stop_queue);
 
-void ieee80211_start_queues(struct ieee80211_hw *hw)
-{
-        struct ieee80211_local *local = hw_to_local(hw);
-        int i;
-
-        for (i = 0; i < local->hw.queues; i++)
-                clear_bit(IEEE80211_LINK_STATE_XOFF, &local->state[i]);
-        if (!ieee80211_qdisc_installed(local->mdev))
-                netif_start_queue(local->mdev);
-}
-EXPORT_SYMBOL(ieee80211_start_queues);
-
 void ieee80211_stop_queues(struct ieee80211_hw *hw)
 {
         int i;
 
-        for (i = 0; i < hw->queues; i++)
+        for (i = 0; i < ieee80211_num_queues(hw); i++)
                 ieee80211_stop_queue(hw, i);
 }
 EXPORT_SYMBOL(ieee80211_stop_queues);
@@ -375,7 +389,7 @@ void ieee80211_wake_queues(struct ieee80211_hw *hw)
 {
         int i;
 
-        for (i = 0; i < hw->queues; i++)
+        for (i = 0; i < hw->queues + hw->ampdu_queues; i++)
                 ieee80211_wake_queue(hw, i);
 }
 EXPORT_SYMBOL(ieee80211_wake_queues);
@@ -404,8 +418,6 @@ void ieee80211_iterate_active_interfaces(
                 case IEEE80211_IF_TYPE_MESH_POINT:
                         break;
                 }
-                if (sdata->dev == local->mdev)
-                        continue;
                 if (netif_running(sdata->dev))
                         iterator(data, sdata->dev->dev_addr,
                                  &sdata->vif);
@@ -439,8 +451,6 @@ void ieee80211_iterate_active_interfaces_atomic(
                 case IEEE80211_IF_TYPE_MESH_POINT:
                         break;
                 }
-                if (sdata->dev == local->mdev)
-                        continue;
                 if (netif_running(sdata->dev))
                         iterator(data, sdata->dev->dev_addr,
                                  &sdata->vif);
diff --git a/net/mac80211/wep.c b/net/mac80211/wep.c
index affcecd78c10..872d2fcd1a5b 100644
--- a/net/mac80211/wep.c
+++ b/net/mac80211/wep.c
@@ -84,24 +84,17 @@ static u8 *ieee80211_wep_add_iv(struct ieee80211_local *local,
                                 struct sk_buff *skb,
                                 struct ieee80211_key *key)
 {
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
-        u16 fc;
-        int hdrlen;
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+        unsigned int hdrlen;
         u8 *newhdr;
 
-        fc = le16_to_cpu(hdr->frame_control);
-        fc |= IEEE80211_FCTL_PROTECTED;
-        hdr->frame_control = cpu_to_le16(fc);
+        hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
 
-        if ((skb_headroom(skb) < WEP_IV_LEN ||
-             skb_tailroom(skb) < WEP_ICV_LEN)) {
-                I802_DEBUG_INC(local->tx_expand_skb_head);
-                if (unlikely(pskb_expand_head(skb, WEP_IV_LEN, WEP_ICV_LEN,
-                                              GFP_ATOMIC)))
-                        return NULL;
-        }
+        if (WARN_ON(skb_tailroom(skb) < WEP_ICV_LEN ||
+                    skb_headroom(skb) < WEP_IV_LEN))
+                return NULL;
 
-        hdrlen = ieee80211_get_hdrlen(fc);
+        hdrlen = ieee80211_hdrlen(hdr->frame_control);
         newhdr = skb_push(skb, WEP_IV_LEN);
         memmove(newhdr, newhdr + WEP_IV_LEN, hdrlen);
         ieee80211_wep_get_iv(local, key, newhdr + hdrlen);
@@ -113,12 +106,10 @@ static void ieee80211_wep_remove_iv(struct ieee80211_local *local,
                                     struct sk_buff *skb,
                                     struct ieee80211_key *key)
 {
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
-        u16 fc;
-        int hdrlen;
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+        unsigned int hdrlen;
 
-        fc = le16_to_cpu(hdr->frame_control);
-        hdrlen = ieee80211_get_hdrlen(fc);
+        hdrlen = ieee80211_hdrlen(hdr->frame_control);
         memmove(skb->data + WEP_IV_LEN, skb->data, hdrlen);
         skb_pull(skb, WEP_IV_LEN);
 }
@@ -228,17 +219,15 @@ int ieee80211_wep_decrypt(struct ieee80211_local *local, struct sk_buff *skb,
         u32 klen;
         u8 *rc4key;
         u8 keyidx;
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
-        u16 fc;
-        int hdrlen;
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+        unsigned int hdrlen;
         size_t len;
         int ret = 0;
 
-        fc = le16_to_cpu(hdr->frame_control);
-        if (!(fc & IEEE80211_FCTL_PROTECTED))
+        if (!ieee80211_has_protected(hdr->frame_control))
                 return -1;
 
-        hdrlen = ieee80211_get_hdrlen(fc);
+        hdrlen = ieee80211_hdrlen(hdr->frame_control);
 
         if (skb->len < 8 + hdrlen)
                 return -1;
@@ -264,11 +253,8 @@ int ieee80211_wep_decrypt(struct ieee80211_local *local, struct sk_buff *skb,
 
         if (ieee80211_wep_decrypt_data(local->wep_rx_tfm, rc4key, klen,
                                        skb->data + hdrlen + WEP_IV_LEN,
-                                       len)) {
-                if (net_ratelimit())
-                        printk(KERN_DEBUG "WEP decrypt failed (ICV)\n");
+                                       len))
                 ret = -1;
-        }
 
         kfree(rc4key);
 
@@ -285,17 +271,15 @@ int ieee80211_wep_decrypt(struct ieee80211_local *local, struct sk_buff *skb,
 
 u8 * ieee80211_wep_is_weak_iv(struct sk_buff *skb, struct ieee80211_key *key)
 {
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
-        u16 fc;
-        int hdrlen;
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+        unsigned int hdrlen;
         u8 *ivpos;
         u32 iv;
 
-        fc = le16_to_cpu(hdr->frame_control);
-        if (!(fc & IEEE80211_FCTL_PROTECTED))
+        if (!ieee80211_has_protected(hdr->frame_control))
                 return NULL;
 
-        hdrlen = ieee80211_get_hdrlen(fc);
+        hdrlen = ieee80211_hdrlen(hdr->frame_control);
         ivpos = skb->data + hdrlen;
         iv = (ivpos[0] << 16) | (ivpos[1] << 8) | ivpos[2];
 
@@ -314,14 +298,8 @@ ieee80211_crypto_wep_decrypt(struct ieee80211_rx_data *rx)
                 return RX_CONTINUE;
 
         if (!(rx->status->flag & RX_FLAG_DECRYPTED)) {
-                if (ieee80211_wep_decrypt(rx->local, rx->skb, rx->key)) {
-#ifdef CONFIG_MAC80211_DEBUG
-                        if (net_ratelimit())
-                                printk(KERN_DEBUG "%s: RX WEP frame, decrypt "
-                                       "failed\n", rx->dev->name);
-#endif /* CONFIG_MAC80211_DEBUG */
+                if (ieee80211_wep_decrypt(rx->local, rx->skb, rx->key))
                         return RX_DROP_UNUSABLE;
-                }
         } else if (!(rx->status->flag & RX_FLAG_IV_STRIPPED)) {
                 ieee80211_wep_remove_iv(rx->local, rx->skb, rx->key);
                 /* remove ICV */
@@ -333,11 +311,16 @@ ieee80211_crypto_wep_decrypt(struct ieee80211_rx_data *rx)
 
 static int wep_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
 {
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+
+        info->control.iv_len = WEP_IV_LEN;
+        info->control.icv_len = WEP_ICV_LEN;
+
         if (!(tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE)) {
                 if (ieee80211_wep_encrypt(tx->local, skb, tx->key))
                         return -1;
         } else {
-                tx->control->key_idx = tx->key->conf.hw_key_idx;
+                info->control.hw_key = &tx->key->conf;
                 if (tx->key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV) {
                         if (!ieee80211_wep_add_iv(tx->local, skb, tx->key))
                                 return -1;
@@ -349,8 +332,6 @@ static int wep_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
 ieee80211_tx_result
 ieee80211_crypto_wep_encrypt(struct ieee80211_tx_data *tx)
 {
-        tx->control->iv_len = WEP_IV_LEN;
-        tx->control->icv_len = WEP_ICV_LEN;
         ieee80211_tx_set_protected(tx);
 
         if (wep_encrypt_skb(tx, tx->skb) < 0) {
diff --git a/net/mac80211/wep.h b/net/mac80211/wep.h
index 363779c50658..e587172115b8 100644
--- a/net/mac80211/wep.h
+++ b/net/mac80211/wep.h
@@ -26,7 +26,7 @@ int ieee80211_wep_encrypt(struct ieee80211_local *local, struct sk_buff *skb,
                           struct ieee80211_key *key);
 int ieee80211_wep_decrypt(struct ieee80211_local *local, struct sk_buff *skb,
                           struct ieee80211_key *key);
-u8 * ieee80211_wep_is_weak_iv(struct sk_buff *skb, struct ieee80211_key *key);
+u8 *ieee80211_wep_is_weak_iv(struct sk_buff *skb, struct ieee80211_key *key);
 
 ieee80211_rx_result
 ieee80211_crypto_wep_decrypt(struct ieee80211_rx_data *rx);
diff --git a/net/mac80211/wext.c b/net/mac80211/wext.c
index 6106cb79060c..34fa8ed1e784 100644
--- a/net/mac80211/wext.c
+++ b/net/mac80211/wext.c
@@ -95,6 +95,13 @@ static int ieee80211_set_encryption(struct net_device *dev, u8 *sta_addr,
                         }
                 }
 
+                if (alg == ALG_WEP &&
+                        key_len != LEN_WEP40 && key_len != LEN_WEP104) {
+                        ieee80211_key_free(key);
+                        err = -EINVAL;
+                        goto out_unlock;
+                }
+
                 ieee80211_key_link(key, sdata, sta);
 
                 if (set_tx_key || (!sta && !sdata->default_key && key))
@@ -135,7 +142,39 @@ static int ieee80211_ioctl_giwname(struct net_device *dev,
                                    struct iw_request_info *info,
                                    char *name, char *extra)
 {
+        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+        struct ieee80211_supported_band *sband;
+        u8 is_ht = 0, is_a = 0, is_b = 0, is_g = 0;
+
+
+        sband = local->hw.wiphy->bands[IEEE80211_BAND_5GHZ];
+        if (sband) {
+                is_a = 1;
+                is_ht |= sband->ht_info.ht_supported;
+        }
+
+        sband = local->hw.wiphy->bands[IEEE80211_BAND_2GHZ];
+        if (sband) {
+                int i;
+                /* Check for mandatory rates */
+                for (i = 0; i < sband->n_bitrates; i++) {
+                        if (sband->bitrates[i].bitrate == 10)
+                                is_b = 1;
+                        if (sband->bitrates[i].bitrate == 60)
+                                is_g = 1;
+                }
+                is_ht |= sband->ht_info.ht_supported;
+        }
+
         strcpy(name, "IEEE 802.11");
+        if (is_a)
+                strcat(name, "a");
+        if (is_b)
+                strcat(name, "b");
+        if (is_g)
+                strcat(name, "g");
+        if (is_ht)
+                strcat(name, "n");
 
         return 0;
 }
@@ -169,14 +208,26 @@ static int ieee80211_ioctl_giwrange(struct net_device *dev,
         range->num_encoding_sizes = 2;
         range->max_encoding_tokens = NUM_DEFAULT_KEYS;
 
-        range->max_qual.qual = local->hw.max_signal;
-        range->max_qual.level = local->hw.max_rssi;
-        range->max_qual.noise = local->hw.max_noise;
+        if (local->hw.flags & IEEE80211_HW_SIGNAL_UNSPEC ||
+            local->hw.flags & IEEE80211_HW_SIGNAL_DB)
+                range->max_qual.level = local->hw.max_signal;
+        else if  (local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
+                range->max_qual.level = -110;
+        else
+                range->max_qual.level = 0;
+
+        if (local->hw.flags & IEEE80211_HW_NOISE_DBM)
+                range->max_qual.noise = -110;
+        else
+                range->max_qual.noise = 0;
+
+        range->max_qual.qual = 100;
         range->max_qual.updated = local->wstats_flags;
 
-        range->avg_qual.qual = local->hw.max_signal/2;
-        range->avg_qual.level = 0;
-        range->avg_qual.noise = 0;
+        range->avg_qual.qual = 50;
+        /* not always true but better than nothing */
+        range->avg_qual.level = range->max_qual.level / 2;
+        range->avg_qual.noise = range->max_qual.noise / 2;
         range->avg_qual.updated = local->wstats_flags;
 
         range->enc_capa = IW_ENC_CAPA_WPA | IW_ENC_CAPA_WPA2 |
@@ -245,15 +296,7 @@ static int ieee80211_ioctl_siwmode(struct net_device *dev,
                 return -EINVAL;
         }
 
-        if (type == sdata->vif.type)
-                return 0;
-        if (netif_running(dev))
-                return -EBUSY;
-
-        ieee80211_if_reinit(dev);
-        ieee80211_if_set_type(dev, type);
-
-        return 0;
+        return ieee80211_if_change_type(sdata, type);
 }
 
 
@@ -401,7 +444,7 @@ static int ieee80211_ioctl_siwessid(struct net_device *dev,
                 memset(sdata->u.ap.ssid + len, 0,
                        IEEE80211_MAX_SSID_LEN - len);
                 sdata->u.ap.ssid_len = len;
-                return ieee80211_if_config(dev);
+                return ieee80211_if_config(sdata, IEEE80211_IFCC_SSID);
         }
         return -EOPNOTSUPP;
 }
@@ -555,7 +598,7 @@ static int ieee80211_ioctl_giwscan(struct net_device *dev,
         if (local->sta_sw_scanning || local->sta_hw_scanning)
                 return -EAGAIN;
 
-        res = ieee80211_sta_scan_results(dev, extra, data->length);
+        res = ieee80211_sta_scan_results(dev, info, extra, data->length);
         if (res >= 0) {
                 data->length = res;
                 return 0;
@@ -576,16 +619,14 @@ static int ieee80211_ioctl_siwrate(struct net_device *dev,
         struct ieee80211_supported_band *sband;
 
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        if (!sdata->bss)
-                return -ENODEV;
 
         sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
 
         /* target_rate = -1, rate->fixed = 0 means auto only, so use all rates
          * target_rate = X, rate->fixed = 1 means only rate X
          * target_rate = X, rate->fixed = 0 means all rates <= X */
-        sdata->bss->max_ratectrl_rateidx = -1;
-        sdata->bss->force_unicast_rateidx = -1;
+        sdata->max_ratectrl_rateidx = -1;
+        sdata->force_unicast_rateidx = -1;
         if (rate->value < 0)
                 return 0;
 
@@ -594,9 +635,9 @@ static int ieee80211_ioctl_siwrate(struct net_device *dev,
                 int this_rate = brate->bitrate;
 
                 if (target_rate == this_rate) {
-                        sdata->bss->max_ratectrl_rateidx = i;
+                        sdata->max_ratectrl_rateidx = i;
                         if (rate->fixed)
-                                sdata->bss->force_unicast_rateidx = i;
+                                sdata->force_unicast_rateidx = i;
                         err = 0;
                         break;
                 }
@@ -709,6 +750,9 @@ static int ieee80211_ioctl_siwrts(struct net_device *dev,
 
         if (rts->disabled)
                 local->rts_threshold = IEEE80211_MAX_RTS_THRESHOLD;
+        else if (!rts->fixed)
+                /* if the rts value is not fixed, then take default */
+                local->rts_threshold = IEEE80211_MAX_RTS_THRESHOLD;
         else if (rts->value < 0 || rts->value > IEEE80211_MAX_RTS_THRESHOLD)
                 return -EINVAL;
         else
@@ -746,6 +790,8 @@ static int ieee80211_ioctl_siwfrag(struct net_device *dev,
 
         if (frag->disabled)
                 local->fragmentation_threshold = IEEE80211_MAX_FRAG_THRESHOLD;
+        else if (!frag->fixed)
+                local->fragmentation_threshold = IEEE80211_MAX_FRAG_THRESHOLD;
         else if (frag->value < 256 ||
                  frag->value > IEEE80211_MAX_FRAG_THRESHOLD)
                 return -EINVAL;
@@ -937,6 +983,58 @@ static int ieee80211_ioctl_giwencode(struct net_device *dev,
         erq->length = sdata->keys[idx]->conf.keylen;
         erq->flags |= IW_ENCODE_ENABLED;
 
+        if (sdata->vif.type == IEEE80211_IF_TYPE_STA) {
+                struct ieee80211_if_sta *ifsta = &sdata->u.sta;
+                switch (ifsta->auth_alg) {
+                case WLAN_AUTH_OPEN:
+                case WLAN_AUTH_LEAP:
+                        erq->flags |= IW_ENCODE_OPEN;
+                        break;
+                case WLAN_AUTH_SHARED_KEY:
+                        erq->flags |= IW_ENCODE_RESTRICTED;
+                        break;
+                }
+        }
+
+        return 0;
+}
+
+static int ieee80211_ioctl_siwpower(struct net_device *dev,
+                                    struct iw_request_info *info,
+                                    struct iw_param *wrq,
+                                    char *extra)
+{
+        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+        struct ieee80211_conf *conf = &local->hw.conf;
+
+        if (wrq->disabled) {
+                conf->flags &= ~IEEE80211_CONF_PS;
+                return ieee80211_hw_config(local);
+        }
+
+        switch (wrq->flags & IW_POWER_MODE) {
+        case IW_POWER_ON:       /* If not specified */
+        case IW_POWER_MODE:     /* If set all mask */
+        case IW_POWER_ALL_R:    /* If explicitely state all */
+                conf->flags |= IEEE80211_CONF_PS;
+                break;
+        default:                /* Otherwise we don't support it */
+                return -EINVAL;
+        }
+
+        return ieee80211_hw_config(local);
+}
+
+static int ieee80211_ioctl_giwpower(struct net_device *dev,
+                                    struct iw_request_info *info,
+                                    union iwreq_data *wrqu,
+                                    char *extra)
+{
+        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+        struct ieee80211_conf *conf = &local->hw.conf;
+
+        wrqu->power.disabled = !(conf->flags & IEEE80211_CONF_PS);
+
         return 0;
 }
 
@@ -1008,8 +1106,8 @@ static struct iw_statistics *ieee80211_get_wireless_stats(struct net_device *dev
                 wstats->qual.noise = 0;
                 wstats->qual.updated = IW_QUAL_ALL_INVALID;
         } else {
-                wstats->qual.level = sta->last_rssi;
-                wstats->qual.qual = sta->last_signal;
+                wstats->qual.level = sta->last_signal;
+                wstats->qual.qual = sta->last_qual;
                 wstats->qual.noise = sta->last_noise;
                 wstats->qual.updated = local->wstats_flags;
         }
@@ -1142,8 +1240,8 @@ static const iw_handler ieee80211_handler[] =
         (iw_handler) ieee80211_ioctl_giwretry,          /* SIOCGIWRETRY */
         (iw_handler) ieee80211_ioctl_siwencode,         /* SIOCSIWENCODE */
         (iw_handler) ieee80211_ioctl_giwencode,         /* SIOCGIWENCODE */
-        (iw_handler) NULL,                              /* SIOCSIWPOWER */
-        (iw_handler) NULL,                              /* SIOCGIWPOWER */
+        (iw_handler) ieee80211_ioctl_siwpower,          /* SIOCSIWPOWER */
+        (iw_handler) ieee80211_ioctl_giwpower,          /* SIOCGIWPOWER */
         (iw_handler) NULL,                              /* -- hole -- */
         (iw_handler) NULL,                              /* -- hole -- */
         (iw_handler) ieee80211_ioctl_siwgenie,          /* SIOCSIWGENIE */
diff --git a/net/mac80211/wme.c b/net/mac80211/wme.c
index 635b996c8c35..07edda0b8a5c 100644
--- a/net/mac80211/wme.c
+++ b/net/mac80211/wme.c
@@ -18,61 +18,42 @@
 #include "ieee80211_i.h"
 #include "wme.h"
 
-/* maximum number of hardware queues we support. */
-#define TC_80211_MAX_QUEUES 16
-
+/* Default mapping in classifier to work with default
+ * queue setup.
+ */
 const int ieee802_1d_to_ac[8] = { 2, 3, 3, 2, 1, 1, 0, 0 };
 
-struct ieee80211_sched_data
-{
-        unsigned long qdisc_pool[BITS_TO_LONGS(TC_80211_MAX_QUEUES)];
-        struct tcf_proto *filter_list;
-        struct Qdisc *queues[TC_80211_MAX_QUEUES];
-        struct sk_buff_head requeued[TC_80211_MAX_QUEUES];
-};
-
 static const char llc_ip_hdr[8] = {0xAA, 0xAA, 0x3, 0, 0, 0, 0x08, 0};
 
-/* given a data frame determine the 802.1p/1d tag to use */
-static inline unsigned classify_1d(struct sk_buff *skb, struct Qdisc *qd)
+/* Given a data frame determine the 802.1p/1d tag to use.  */
+static unsigned int classify_1d(struct sk_buff *skb)
 {
-        struct iphdr *ip;
-        int dscp;
-        int offset;
-
-        struct ieee80211_sched_data *q = qdisc_priv(qd);
-        struct tcf_result res = { -1, 0 };
-
-        /* if there is a user set filter list, call out to that */
-        if (q->filter_list) {
-                tc_classify(skb, q->filter_list, &res);
-                if (res.class != -1)
-                        return res.class;
-        }
+        unsigned int dscp;
 
         /* skb->priority values from 256->263 are magic values to
-         * directly indicate a specific 802.1d priority.
-         * This is used to allow 802.1d priority to be passed directly in
-         * from VLAN tags, etc. */
+         * directly indicate a specific 802.1d priority.  This is used
+         * to allow 802.1d priority to be passed directly in from VLAN
+         * tags, etc.
+         */
         if (skb->priority >= 256 && skb->priority <= 263)
                 return skb->priority - 256;
 
-        /* check there is a valid IP header present */
-        offset = ieee80211_get_hdrlen_from_skb(skb);
-        if (skb->len < offset + sizeof(llc_ip_hdr) + sizeof(*ip) ||
-            memcmp(skb->data + offset, llc_ip_hdr, sizeof(llc_ip_hdr)))
-                return 0;
+        switch (skb->protocol) {
+        case __constant_htons(ETH_P_IP):
+                dscp = ip_hdr(skb)->tos & 0xfc;
+                break;
 
-        ip = (struct iphdr *) (skb->data + offset + sizeof(llc_ip_hdr));
+        default:
+                return 0;
+        }
 
-        dscp = ip->tos & 0xfc;
         if (dscp & 0x1c)
                 return 0;
         return dscp >> 5;
 }
 
 
-static inline int wme_downgrade_ac(struct sk_buff *skb)
+static int wme_downgrade_ac(struct sk_buff *skb)
 {
         switch (skb->priority) {
         case 6:
@@ -93,43 +74,38 @@ static inline int wme_downgrade_ac(struct sk_buff *skb)
 }
 
 
-/* positive return value indicates which queue to use
- * negative return value indicates to drop the frame */
-static inline int classify80211(struct sk_buff *skb, struct Qdisc *qd)
+/* Indicate which queue to use.  */
+static u16 classify80211(struct sk_buff *skb, struct net_device *dev)
 {
-        struct ieee80211_local *local = wdev_priv(qd->dev->ieee80211_ptr);
+        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
-        unsigned short fc = le16_to_cpu(hdr->frame_control);
-        int qos;
 
-        /* see if frame is data or non data frame */
-        if (unlikely((fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA)) {
+        if (!ieee80211_is_data(hdr->frame_control)) {
                 /* management frames go on AC_VO queue, but are sent
                 * without QoS control fields */
-                return IEEE80211_TX_QUEUE_DATA0;
+                return 0;
         }
 
         if (0 /* injected */) {
                 /* use AC from radiotap */
         }
 
-        /* is this a QoS frame? */
-        qos = fc & IEEE80211_STYPE_QOS_DATA;
-
-        if (!qos) {
+        if (!ieee80211_is_data_qos(hdr->frame_control)) {
                 skb->priority = 0; /* required for correct WPA/11i MIC */
                 return ieee802_1d_to_ac[skb->priority];
         }
 
         /* use the data classifier to determine what 802.1d tag the
          * data frame has */
-        skb->priority = classify_1d(skb, qd);
+        skb->priority = classify_1d(skb);
 
         /* in case we are a client verify acm is not set for this ac */
         while (unlikely(local->wmm_acm & BIT(skb->priority))) {
                 if (wme_downgrade_ac(skb)) {
-                        /* No AC with lower priority has acm=0, drop packet. */
-                        return -1;
+                        /* The old code would drop the packet in this
+                         * case.
+                         */
+                        return 0;
                 }
         }
 
@@ -137,55 +113,52 @@ static inline int classify80211(struct sk_buff *skb, struct Qdisc *qd)
         return ieee802_1d_to_ac[skb->priority];
 }
 
-
-static int wme_qdiscop_enqueue(struct sk_buff *skb, struct Qdisc* qd)
+u16 ieee80211_select_queue(struct net_device *dev, struct sk_buff *skb)
 {
-        struct ieee80211_local *local = wdev_priv(qd->dev->ieee80211_ptr);
-        struct ieee80211_sched_data *q = qdisc_priv(qd);
-        struct ieee80211_tx_packet_data *pkt_data =
-                (struct ieee80211_tx_packet_data *) skb->cb;
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
-        unsigned short fc = le16_to_cpu(hdr->frame_control);
-        struct Qdisc *qdisc;
-        int err, queue;
+        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         struct sta_info *sta;
+        u16 queue;
         u8 tid;
 
-        if (pkt_data->flags & IEEE80211_TXPD_REQUEUE) {
-                queue = pkt_data->queue;
+        queue = classify80211(skb, dev);
+        if (unlikely(queue >= local->hw.queues))
+                queue = local->hw.queues - 1;
+
+        if (info->flags & IEEE80211_TX_CTL_REQUEUE) {
                 rcu_read_lock();
                 sta = sta_info_get(local, hdr->addr1);
-                tid = skb->priority & QOS_CONTROL_TAG1D_MASK;
+                tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
                 if (sta) {
+                        struct ieee80211_hw *hw = &local->hw;
                         int ampdu_queue = sta->tid_to_tx_q[tid];
-                        if ((ampdu_queue < local->hw.queues) &&
-                            test_bit(ampdu_queue, q->qdisc_pool)) {
+
+                        if ((ampdu_queue < ieee80211_num_queues(hw)) &&
+                            test_bit(ampdu_queue, local->queue_pool)) {
                                 queue = ampdu_queue;
-                                pkt_data->flags |= IEEE80211_TXPD_AMPDU;
+                                info->flags |= IEEE80211_TX_CTL_AMPDU;
                         } else {
-                                pkt_data->flags &= ~IEEE80211_TXPD_AMPDU;
+                                info->flags &= ~IEEE80211_TX_CTL_AMPDU;
                         }
                 }
                 rcu_read_unlock();
-                skb_queue_tail(&q->requeued[queue], skb);
-                qd->q.qlen++;
-                return 0;
-        }
 
-        queue = classify80211(skb, qd);
+                return queue;
+        }
 
-        /* now we know the 1d priority, fill in the QoS header if there is one
+        /* Now we know the 1d priority, fill in the QoS header if
+         * there is one.
          */
-        if (WLAN_FC_IS_QOS_DATA(fc)) {
-                u8 *p = skb->data + ieee80211_get_hdrlen(fc) - 2;
+        if (ieee80211_is_data_qos(hdr->frame_control)) {
+                u8 *p = ieee80211_get_qos_ctl(hdr);
                 u8 ack_policy = 0;
-                tid = skb->priority & QOS_CONTROL_TAG1D_MASK;
+                tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
                 if (local->wifi_wme_noack_test)
                         ack_policy |= QOS_CONTROL_ACK_POLICY_NOACK <<
                                         QOS_CONTROL_ACK_POLICY_SHIFT;
                 /* qos header is 2 bytes, second reserved */
-                *p = ack_policy | tid;
-                p++;
+                *p++ = ack_policy | tid;
                 *p = 0;
 
                 rcu_read_lock();
@@ -193,476 +166,37 @@ static int wme_qdiscop_enqueue(struct sk_buff *skb, struct Qdisc* qd)
                 sta = sta_info_get(local, hdr->addr1);
                 if (sta) {
                         int ampdu_queue = sta->tid_to_tx_q[tid];
-                        if ((ampdu_queue < local->hw.queues) &&
-                                test_bit(ampdu_queue, q->qdisc_pool)) {
+                        struct ieee80211_hw *hw = &local->hw;
+
+                        if ((ampdu_queue < ieee80211_num_queues(hw)) &&
+                            test_bit(ampdu_queue, local->queue_pool)) {
                                 queue = ampdu_queue;
-                                pkt_data->flags |= IEEE80211_TXPD_AMPDU;
+                                info->flags |= IEEE80211_TX_CTL_AMPDU;
                         } else {
-                                pkt_data->flags &= ~IEEE80211_TXPD_AMPDU;
+                                info->flags &= ~IEEE80211_TX_CTL_AMPDU;
                         }
                 }
 
                 rcu_read_unlock();
         }
 
-        if (unlikely(queue >= local->hw.queues)) {
-#if 0
-                if (net_ratelimit()) {
-                        printk(KERN_DEBUG "%s - queue=%d (hw does not "
-                               "support) -> %d\n",
-                               __func__, queue, local->hw.queues - 1);
-                }
-#endif
-                queue = local->hw.queues - 1;
-        }
-
-        if (unlikely(queue < 0)) {
-                        kfree_skb(skb);
-                        err = NET_XMIT_DROP;
-        } else {
-                tid = skb->priority & QOS_CONTROL_TAG1D_MASK;
-                pkt_data->queue = (unsigned int) queue;
-                qdisc = q->queues[queue];
-                err = qdisc->enqueue(skb, qdisc);
-                if (err == NET_XMIT_SUCCESS) {
-                        qd->q.qlen++;
-                        qd->bstats.bytes += skb->len;
-                        qd->bstats.packets++;
-                        return NET_XMIT_SUCCESS;
-                }
-        }
-        qd->qstats.drops++;
-        return err;
-}
-
-
-/* TODO: clean up the cases where master_hard_start_xmit
- * returns non 0 - it shouldn't ever do that. Once done we
- * can remove this function */
-static int wme_qdiscop_requeue(struct sk_buff *skb, struct Qdisc* qd)
-{
-        struct ieee80211_sched_data *q = qdisc_priv(qd);
-        struct ieee80211_tx_packet_data *pkt_data =
-                (struct ieee80211_tx_packet_data *) skb->cb;
-        struct Qdisc *qdisc;
-        int err;
-
-        /* we recorded which queue to use earlier! */
-        qdisc = q->queues[pkt_data->queue];
-
-        if ((err = qdisc->ops->requeue(skb, qdisc)) == 0) {
-                qd->q.qlen++;
-                return 0;
-        }
-        qd->qstats.drops++;
-        return err;
-}
-
-
-static struct sk_buff *wme_qdiscop_dequeue(struct Qdisc* qd)
-{
-        struct ieee80211_sched_data *q = qdisc_priv(qd);
-        struct net_device *dev = qd->dev;
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        struct ieee80211_hw *hw = &local->hw;
-        struct sk_buff *skb;
-        struct Qdisc *qdisc;
-        int queue;
-
-        /* check all the h/w queues in numeric/priority order */
-        for (queue = 0; queue < hw->queues; queue++) {
-                /* see if there is room in this hardware queue */
-                if ((test_bit(IEEE80211_LINK_STATE_XOFF,
-                                &local->state[queue])) ||
-                    (test_bit(IEEE80211_LINK_STATE_PENDING,
-                                &local->state[queue])) ||
-                         (!test_bit(queue, q->qdisc_pool)))
-                        continue;
-
-                /* there is space - try and get a frame */
-                skb = skb_dequeue(&q->requeued[queue]);
-                if (skb) {
-                        qd->q.qlen--;
-                        return skb;
-                }
-
-                qdisc = q->queues[queue];
-                skb = qdisc->dequeue(qdisc);
-                if (skb) {
-                        qd->q.qlen--;
-                        return skb;
-                }
-        }
-        /* returning a NULL here when all the h/w queues are full means we
-         * never need to call netif_stop_queue in the driver */
-        return NULL;
-}
-
-
-static void wme_qdiscop_reset(struct Qdisc* qd)
-{
-        struct ieee80211_sched_data *q = qdisc_priv(qd);
-        struct ieee80211_local *local = wdev_priv(qd->dev->ieee80211_ptr);
-        struct ieee80211_hw *hw = &local->hw;
-        int queue;
-
-        /* QUESTION: should we have some hardware flush functionality here? */
-
-        for (queue = 0; queue < hw->queues; queue++) {
-                skb_queue_purge(&q->requeued[queue]);
-                qdisc_reset(q->queues[queue]);
-        }
-        qd->q.qlen = 0;
-}
-
-
-static void wme_qdiscop_destroy(struct Qdisc* qd)
-{
-        struct ieee80211_sched_data *q = qdisc_priv(qd);
-        struct ieee80211_local *local = wdev_priv(qd->dev->ieee80211_ptr);
-        struct ieee80211_hw *hw = &local->hw;
-        int queue;
-
-        tcf_destroy_chain(q->filter_list);
-        q->filter_list = NULL;
-
-        for (queue=0; queue < hw->queues; queue++) {
-                skb_queue_purge(&q->requeued[queue]);
-                qdisc_destroy(q->queues[queue]);
-                q->queues[queue] = &noop_qdisc;
-        }
-}
-
-
-/* called whenever parameters are updated on existing qdisc */
-static int wme_qdiscop_tune(struct Qdisc *qd, struct nlattr *opt)
-{
-/*      struct ieee80211_sched_data *q = qdisc_priv(qd);
-*/
-        /* check our options block is the right size */
-        /* copy any options to our local structure */
-/*      Ignore options block for now - always use static mapping
-        struct tc_ieee80211_qopt *qopt = nla_data(opt);
-
-        if (opt->nla_len < nla_attr_size(sizeof(*qopt)))
-                return -EINVAL;
-        memcpy(q->tag2queue, qopt->tag2queue, sizeof(qopt->tag2queue));
-*/
-        return 0;
-}
-
-
-/* called during initial creation of qdisc on device */
-static int wme_qdiscop_init(struct Qdisc *qd, struct nlattr *opt)
-{
-        struct ieee80211_sched_data *q = qdisc_priv(qd);
-        struct net_device *dev = qd->dev;
-        struct ieee80211_local *local;
-        int queues;
-        int err = 0, i;
-
-        /* check that device is a mac80211 device */
-        if (!dev->ieee80211_ptr ||
-            dev->ieee80211_ptr->wiphy->privid != mac80211_wiphy_privid)
-                return -EINVAL;
-
-        /* check this device is an ieee80211 master type device */
-        if (dev->type != ARPHRD_IEEE80211)
-                return -EINVAL;
-
-        /* check that there is no qdisc currently attached to device
-         * this ensures that we will be the root qdisc. (I can't find a better
-         * way to test this explicitly) */
-        if (dev->qdisc_sleeping != &noop_qdisc)
-                return -EINVAL;
-
-        if (qd->flags & TCQ_F_INGRESS)
-                return -EINVAL;
-
-        local = wdev_priv(dev->ieee80211_ptr);
-        queues = local->hw.queues;
-
-        /* if options were passed in, set them */
-        if (opt) {
-                err = wme_qdiscop_tune(qd, opt);
-        }
-
-        /* create child queues */
-        for (i = 0; i < queues; i++) {
-                skb_queue_head_init(&q->requeued[i]);
-                q->queues[i] = qdisc_create_dflt(qd->dev, &pfifo_qdisc_ops,
-                                                 qd->handle);
-                if (!q->queues[i]) {
-                        q->queues[i] = &noop_qdisc;
-                        printk(KERN_ERR "%s child qdisc %i creation failed\n",
-                               dev->name, i);
-                }
-        }
-
-        /* reserve all legacy QoS queues */
-        for (i = 0; i < min(IEEE80211_TX_QUEUE_DATA4, queues); i++)
-                set_bit(i, q->qdisc_pool);
-
-        return err;
-}
-
-static int wme_qdiscop_dump(struct Qdisc *qd, struct sk_buff *skb)
-{
-/*      struct ieee80211_sched_data *q = qdisc_priv(qd);
-        unsigned char *p = skb->tail;
-        struct tc_ieee80211_qopt opt;
-
-        memcpy(&opt.tag2queue, q->tag2queue, TC_80211_MAX_TAG + 1);
-        NLA_PUT(skb, TCA_OPTIONS, sizeof(opt), &opt);
-*/      return skb->len;
-/*
-nla_put_failure:
-        skb_trim(skb, p - skb->data);*/
-        return -1;
-}
-
-
-static int wme_classop_graft(struct Qdisc *qd, unsigned long arg,
-                             struct Qdisc *new, struct Qdisc **old)
-{
-        struct ieee80211_sched_data *q = qdisc_priv(qd);
-        struct ieee80211_local *local = wdev_priv(qd->dev->ieee80211_ptr);
-        struct ieee80211_hw *hw = &local->hw;
-        unsigned long queue = arg - 1;
-
-        if (queue >= hw->queues)
-                return -EINVAL;
-
-        if (!new)
-                new = &noop_qdisc;
-
-        sch_tree_lock(qd);
-        *old = q->queues[queue];
-        q->queues[queue] = new;
-        qdisc_reset(*old);
-        sch_tree_unlock(qd);
-
-        return 0;
-}
-
-
-static struct Qdisc *
-wme_classop_leaf(struct Qdisc *qd, unsigned long arg)
-{
-        struct ieee80211_sched_data *q = qdisc_priv(qd);
-        struct ieee80211_local *local = wdev_priv(qd->dev->ieee80211_ptr);
-        struct ieee80211_hw *hw = &local->hw;
-        unsigned long queue = arg - 1;
-
-        if (queue >= hw->queues)
-                return NULL;
-
-        return q->queues[queue];
-}
-
-
-static unsigned long wme_classop_get(struct Qdisc *qd, u32 classid)
-{
-        struct ieee80211_local *local = wdev_priv(qd->dev->ieee80211_ptr);
-        struct ieee80211_hw *hw = &local->hw;
-        unsigned long queue = TC_H_MIN(classid);
-
-        if (queue - 1 >= hw->queues)
-                return 0;
-
         return queue;
 }
 
-
-static unsigned long wme_classop_bind(struct Qdisc *qd, unsigned long parent,
-                                      u32 classid)
-{
-        return wme_classop_get(qd, classid);
-}
-
-
-static void wme_classop_put(struct Qdisc *q, unsigned long cl)
-{
-}
-
-
-static int wme_classop_change(struct Qdisc *qd, u32 handle, u32 parent,
-                              struct nlattr **tca, unsigned long *arg)
-{
-        unsigned long cl = *arg;
-        struct ieee80211_local *local = wdev_priv(qd->dev->ieee80211_ptr);
-        struct ieee80211_hw *hw = &local->hw;
-
-        if (cl - 1 > hw->queues)
-                return -ENOENT;
-
-        /* TODO: put code to program hardware queue parameters here,
-         * to allow programming from tc command line */
-
-        return 0;
-}
-
-
-/* we don't support deleting hardware queues
- * when we add WMM-SA support - TSPECs may be deleted here */
-static int wme_classop_delete(struct Qdisc *qd, unsigned long cl)
-{
-        struct ieee80211_local *local = wdev_priv(qd->dev->ieee80211_ptr);
-        struct ieee80211_hw *hw = &local->hw;
-
-        if (cl - 1 > hw->queues)
-                return -ENOENT;
-        return 0;
-}
-
-
-static int wme_classop_dump_class(struct Qdisc *qd, unsigned long cl,
-                                  struct sk_buff *skb, struct tcmsg *tcm)
-{
-        struct ieee80211_sched_data *q = qdisc_priv(qd);
-        struct ieee80211_local *local = wdev_priv(qd->dev->ieee80211_ptr);
-        struct ieee80211_hw *hw = &local->hw;
-
-        if (cl - 1 > hw->queues)
-                return -ENOENT;
-        tcm->tcm_handle = TC_H_MIN(cl);
-        tcm->tcm_parent = qd->handle;
-        tcm->tcm_info = q->queues[cl-1]->handle; /* do we need this? */
-        return 0;
-}
-
-
-static void wme_classop_walk(struct Qdisc *qd, struct qdisc_walker *arg)
-{
-        struct ieee80211_local *local = wdev_priv(qd->dev->ieee80211_ptr);
-        struct ieee80211_hw *hw = &local->hw;
-        int queue;
-
-        if (arg->stop)
-                return;
-
-        for (queue = 0; queue < hw->queues; queue++) {
-                if (arg->count < arg->skip) {
-                        arg->count++;
-                        continue;
-                }
-                /* we should return classids for our internal queues here
-                 * as well as the external ones */
-                if (arg->fn(qd, queue+1, arg) < 0) {
-                        arg->stop = 1;
-                        break;
-                }
-                arg->count++;
-        }
-}
-
-
-static struct tcf_proto ** wme_classop_find_tcf(struct Qdisc *qd,
-                                                unsigned long cl)
-{
-        struct ieee80211_sched_data *q = qdisc_priv(qd);
-
-        if (cl)
-                return NULL;
-
-        return &q->filter_list;
-}
-
-
-/* this qdisc is classful (i.e. has classes, some of which may have leaf qdiscs attached)
- * - these are the operations on the classes */
-static const struct Qdisc_class_ops class_ops =
-{
-        .graft = wme_classop_graft,
-        .leaf = wme_classop_leaf,
-
-        .get = wme_classop_get,
-        .put = wme_classop_put,
-        .change = wme_classop_change,
-        .delete = wme_classop_delete,
-        .walk = wme_classop_walk,
-
-        .tcf_chain = wme_classop_find_tcf,
-        .bind_tcf = wme_classop_bind,
-        .unbind_tcf = wme_classop_put,
-
-        .dump = wme_classop_dump_class,
-};
-
-
-/* queueing discipline operations */
-static struct Qdisc_ops wme_qdisc_ops __read_mostly =
-{
-        .next = NULL,
-        .cl_ops = &class_ops,
-        .id = "ieee80211",
-        .priv_size = sizeof(struct ieee80211_sched_data),
-
-        .enqueue = wme_qdiscop_enqueue,
-        .dequeue = wme_qdiscop_dequeue,
-        .requeue = wme_qdiscop_requeue,
-        .drop = NULL, /* drop not needed since we are always the root qdisc */
-
-        .init = wme_qdiscop_init,
-        .reset = wme_qdiscop_reset,
-        .destroy = wme_qdiscop_destroy,
-        .change = wme_qdiscop_tune,
-
-        .dump = wme_qdiscop_dump,
-};
-
-
-void ieee80211_install_qdisc(struct net_device *dev)
-{
-        struct Qdisc *qdisc;
-
-        qdisc = qdisc_create_dflt(dev, &wme_qdisc_ops, TC_H_ROOT);
-        if (!qdisc) {
-                printk(KERN_ERR "%s: qdisc installation failed\n", dev->name);
-                return;
-        }
-
-        /* same handle as would be allocated by qdisc_alloc_handle() */
-        qdisc->handle = 0x80010000;
-
-        qdisc_lock_tree(dev);
-        list_add_tail(&qdisc->list, &dev->qdisc_list);
-        dev->qdisc_sleeping = qdisc;
-        qdisc_unlock_tree(dev);
-}
-
-
-int ieee80211_qdisc_installed(struct net_device *dev)
-{
-        return dev->qdisc_sleeping->ops == &wme_qdisc_ops;
-}
-
-
-int ieee80211_wme_register(void)
-{
-        return register_qdisc(&wme_qdisc_ops);
-}
-
-
-void ieee80211_wme_unregister(void)
-{
-        unregister_qdisc(&wme_qdisc_ops);
-}
-
 int ieee80211_ht_agg_queue_add(struct ieee80211_local *local,
-                        struct sta_info *sta, u16 tid)
+                               struct sta_info *sta, u16 tid)
 {
         int i;
-        struct ieee80211_sched_data *q =
-                        qdisc_priv(local->mdev->qdisc_sleeping);
-        DECLARE_MAC_BUF(mac);
 
         /* prepare the filter and save it for the SW queue
-         * matching the recieved HW queue */
+         * matching the received HW queue */
+
+        if (!local->hw.ampdu_queues)
+                return -EPERM;
 
         /* try to get a Qdisc from the pool */
-        for (i = IEEE80211_TX_QUEUE_BEACON; i < local->hw.queues; i++)
-                if (!test_and_set_bit(i, q->qdisc_pool)) {
+        for (i = local->hw.queues; i < ieee80211_num_queues(&local->hw); i++)
+                if (!test_and_set_bit(i, local->queue_pool)) {
                         ieee80211_stop_queue(local_to_hw(local), i);
                         sta->tid_to_tx_q[tid] = i;
 
@@ -671,11 +205,13 @@ int ieee80211_ht_agg_queue_add(struct ieee80211_local *local,
                          * on the previous queue
                          * since HT is strict in order */
 #ifdef CONFIG_MAC80211_HT_DEBUG
-                        if (net_ratelimit())
+                        if (net_ratelimit()) {
+                                DECLARE_MAC_BUF(mac);
                                 printk(KERN_DEBUG "allocated aggregation queue"
                                         " %d tid %d addr %s pool=0x%lX\n",
                                         i, tid, print_mac(mac, sta->addr),
-                                        q->qdisc_pool[0]);
+                                        local->queue_pool[0]);
+                        }
 #endif /* CONFIG_MAC80211_HT_DEBUG */
                         return 0;
                 }
@@ -684,44 +220,79 @@ int ieee80211_ht_agg_queue_add(struct ieee80211_local *local,
 }
 
 /**
- * the caller needs to hold local->mdev->queue_lock
+ * the caller needs to hold netdev_get_tx_queue(local->mdev, X)->lock
  */
 void ieee80211_ht_agg_queue_remove(struct ieee80211_local *local,
                                    struct sta_info *sta, u16 tid,
                                    u8 requeue)
 {
-        struct ieee80211_sched_data *q =
-                qdisc_priv(local->mdev->qdisc_sleeping);
         int agg_queue = sta->tid_to_tx_q[tid];
+        struct ieee80211_hw *hw = &local->hw;
 
         /* return the qdisc to the pool */
-        clear_bit(agg_queue, q->qdisc_pool);
-        sta->tid_to_tx_q[tid] = local->hw.queues;
+        clear_bit(agg_queue, local->queue_pool);
+        sta->tid_to_tx_q[tid] = ieee80211_num_queues(hw);
 
-        if (requeue)
+        if (requeue) {
                 ieee80211_requeue(local, agg_queue);
-        else
-                q->queues[agg_queue]->ops->reset(q->queues[agg_queue]);
+        } else {
+                struct netdev_queue *txq;
+                spinlock_t *root_lock;
+
+                txq = netdev_get_tx_queue(local->mdev, agg_queue);
+                root_lock = qdisc_root_lock(txq->qdisc);
+
+                spin_lock_bh(root_lock);
+                qdisc_reset(txq->qdisc);
+                spin_unlock_bh(root_lock);
+        }
 }
 
 void ieee80211_requeue(struct ieee80211_local *local, int queue)
 {
-        struct Qdisc *root_qd = local->mdev->qdisc_sleeping;
-        struct ieee80211_sched_data *q = qdisc_priv(root_qd);
-        struct Qdisc *qdisc = q->queues[queue];
-        struct sk_buff *skb = NULL;
+        struct netdev_queue *txq = netdev_get_tx_queue(local->mdev, queue);
+        struct sk_buff_head list;
+        spinlock_t *root_lock;
+        struct Qdisc *qdisc;
         u32 len;
 
+        rcu_read_lock_bh();
+
+        qdisc = rcu_dereference(txq->qdisc);
         if (!qdisc || !qdisc->dequeue)
-                return;
+                goto out_unlock;
+
+        skb_queue_head_init(&list);
 
-        printk(KERN_DEBUG "requeue: qlen = %d\n", qdisc->q.qlen);
+        root_lock = qdisc_root_lock(qdisc);
+        spin_lock(root_lock);
         for (len = qdisc->q.qlen; len > 0; len--) {
-                skb = qdisc->dequeue(qdisc);
-                root_qd->q.qlen--;
-                /* packet will be classified again and */
-                /* skb->packet_data->queue will be overridden if needed */
+                struct sk_buff *skb = qdisc->dequeue(qdisc);
+
                 if (skb)
-                        wme_qdiscop_enqueue(skb, root_qd);
+                        __skb_queue_tail(&list, skb);
+        }
+        spin_unlock(root_lock);
+
+        for (len = list.qlen; len > 0; len--) {
+                struct sk_buff *skb = __skb_dequeue(&list);
+                u16 new_queue;
+
+                BUG_ON(!skb);
+                new_queue = ieee80211_select_queue(local->mdev, skb);
+                skb_set_queue_mapping(skb, new_queue);
+
+                txq = netdev_get_tx_queue(local->mdev, new_queue);
+
+
+                qdisc = rcu_dereference(txq->qdisc);
+                root_lock = qdisc_root_lock(qdisc);
+
+                spin_lock(root_lock);
+                qdisc_enqueue_root(skb, qdisc);
+                spin_unlock(root_lock);
         }
+
+out_unlock:
+        rcu_read_unlock_bh();
 }
diff --git a/net/mac80211/wme.h b/net/mac80211/wme.h
index fcc6b05508cc..04de28c071a6 100644
--- a/net/mac80211/wme.h
+++ b/net/mac80211/wme.h
@@ -19,57 +19,16 @@
 #define QOS_CONTROL_ACK_POLICY_NORMAL 0
 #define QOS_CONTROL_ACK_POLICY_NOACK 1
 
-#define QOS_CONTROL_TID_MASK 0x0f
 #define QOS_CONTROL_ACK_POLICY_SHIFT 5
 
-#define QOS_CONTROL_TAG1D_MASK 0x07
-
 extern const int ieee802_1d_to_ac[8];
 
-static inline int WLAN_FC_IS_QOS_DATA(u16 fc)
-{
-        return (fc & 0x8C) == 0x88;
-}
-
-#ifdef CONFIG_NET_SCHED
-void ieee80211_install_qdisc(struct net_device *dev);
-int ieee80211_qdisc_installed(struct net_device *dev);
+u16 ieee80211_select_queue(struct net_device *dev, struct sk_buff *skb);
 int ieee80211_ht_agg_queue_add(struct ieee80211_local *local,
                                struct sta_info *sta, u16 tid);
 void ieee80211_ht_agg_queue_remove(struct ieee80211_local *local,
                                    struct sta_info *sta, u16 tid,
                                    u8 requeue);
 void ieee80211_requeue(struct ieee80211_local *local, int queue);
-int ieee80211_wme_register(void);
-void ieee80211_wme_unregister(void);
-#else
-static inline void ieee80211_install_qdisc(struct net_device *dev)
-{
-}
-static inline int ieee80211_qdisc_installed(struct net_device *dev)
-{
-        return 0;
-}
-static inline int ieee80211_ht_agg_queue_add(struct ieee80211_local *local,
-                                             struct sta_info *sta, u16 tid)
-{
-        return -EAGAIN;
-}
-static inline void ieee80211_ht_agg_queue_remove(struct ieee80211_local *local,
-                                                 struct sta_info *sta, u16 tid,
-                                                 u8 requeue)
-{
-}
-static inline void ieee80211_requeue(struct ieee80211_local *local, int queue)
-{
-}
-static inline int ieee80211_wme_register(void)
-{
-        return 0;
-}
-static inline void ieee80211_wme_unregister(void)
-{
-}
-#endif /* CONFIG_NET_SCHED */
 
 #endif /* _WME_H */
diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c
index 45709ada8fee..2f33df0dcccf 100644
--- a/net/mac80211/wpa.c
+++ b/net/mac80211/wpa.c
@@ -11,6 +11,8 @@
 #include <linux/slab.h>
 #include <linux/skbuff.h>
 #include <linux/compiler.h>
+#include <linux/ieee80211.h>
+#include <asm/unaligned.h>
 #include <net/mac80211.h>
 
 #include "ieee80211_i.h"
@@ -19,76 +21,30 @@
 #include "aes_ccm.h"
 #include "wpa.h"
 
-static int ieee80211_get_hdr_info(const struct sk_buff *skb, u8 **sa, u8 **da,
-                                  u8 *qos_tid, u8 **data, size_t *data_len)
-{
-        struct ieee80211_hdr *hdr;
-        size_t hdrlen;
-        u16 fc;
-        int a4_included;
-        u8 *pos;
-
-        hdr = (struct ieee80211_hdr *) skb->data;
-        fc = le16_to_cpu(hdr->frame_control);
-
-        hdrlen = 24;
-        if ((fc & (IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS)) ==
-            (IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS)) {
-                hdrlen += ETH_ALEN;
-                *sa = hdr->addr4;
-                *da = hdr->addr3;
-        } else if (fc & IEEE80211_FCTL_FROMDS) {
-                *sa = hdr->addr3;
-                *da = hdr->addr1;
-        } else if (fc & IEEE80211_FCTL_TODS) {
-                *sa = hdr->addr2;
-                *da = hdr->addr3;
-        } else {
-                *sa = hdr->addr2;
-                *da = hdr->addr1;
-        }
-
-        if (fc & 0x80)
-                hdrlen += 2;
-
-        *data = skb->data + hdrlen;
-        *data_len = skb->len - hdrlen;
-
-        a4_included = (fc & (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) ==
-                (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS);
-        if ((fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA &&
-            fc & IEEE80211_STYPE_QOS_DATA) {
-                pos = (u8 *) &hdr->addr4;
-                if (a4_included)
-                        pos += 6;
-                *qos_tid = pos[0] & 0x0f;
-                *qos_tid |= 0x80; /* qos_included flag */
-        } else
-                *qos_tid = 0;
-
-        return skb->len < hdrlen ? -1 : 0;
-}
-
-
 ieee80211_tx_result
 ieee80211_tx_h_michael_mic_add(struct ieee80211_tx_data *tx)
 {
-        u8 *data, *sa, *da, *key, *mic, qos_tid;
+        u8 *data, *key, *mic, key_offset;
         size_t data_len;
-        u16 fc;
+        unsigned int hdrlen;
+        struct ieee80211_hdr *hdr;
         struct sk_buff *skb = tx->skb;
         int authenticator;
         int wpa_test = 0;
+        int tail;
 
-        fc = tx->fc;
-
+        hdr = (struct ieee80211_hdr *)skb->data;
         if (!tx->key || tx->key->conf.alg != ALG_TKIP || skb->len < 24 ||
-            !WLAN_FC_DATA_PRESENT(fc))
+            !ieee80211_is_data_present(hdr->frame_control))
                 return TX_CONTINUE;
 
-        if (ieee80211_get_hdr_info(skb, &sa, &da, &qos_tid, &data, &data_len))
+        hdrlen = ieee80211_hdrlen(hdr->frame_control);
+        if (skb->len < hdrlen)
                 return TX_DROP;
 
+        data = skb->data + hdrlen;
+        data_len = skb->len - hdrlen;
+
         if ((tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) &&
             !(tx->flags & IEEE80211_TX_FRAGMENTED) &&
             !(tx->key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC) &&
@@ -98,26 +54,27 @@ ieee80211_tx_h_michael_mic_add(struct ieee80211_tx_data *tx)
                 return TX_CONTINUE;
         }
 
-        if (skb_tailroom(skb) < MICHAEL_MIC_LEN) {
-                I802_DEBUG_INC(tx->local->tx_expand_skb_head);
-                if (unlikely(pskb_expand_head(skb, TKIP_IV_LEN,
-                                              MICHAEL_MIC_LEN + TKIP_ICV_LEN,
-                                              GFP_ATOMIC))) {
-                        printk(KERN_DEBUG "%s: failed to allocate more memory "
-                               "for Michael MIC\n", tx->dev->name);
-                        return TX_DROP;
-                }
-        }
+        tail = MICHAEL_MIC_LEN;
+        if (!(tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE))
+                tail += TKIP_ICV_LEN;
+
+        if (WARN_ON(skb_tailroom(skb) < tail ||
+                    skb_headroom(skb) < TKIP_IV_LEN))
+                return TX_DROP;
 
 #if 0
         authenticator = fc & IEEE80211_FCTL_FROMDS; /* FIX */
 #else
         authenticator = 1;
 #endif
-        key = &tx->key->conf.key[authenticator ? ALG_TKIP_TEMP_AUTH_TX_MIC_KEY :
-                                 ALG_TKIP_TEMP_AUTH_RX_MIC_KEY];
+        /* At this point we know we're using ALG_TKIP. To get the MIC key
+         * we now will rely on the offset from the ieee80211_key_conf::key */
+        key_offset = authenticator ?
+                NL80211_TKIP_DATA_OFFSET_TX_MIC_KEY :
+                NL80211_TKIP_DATA_OFFSET_RX_MIC_KEY;
+        key = &tx->key->conf.key[key_offset];
         mic = skb_put(skb, MICHAEL_MIC_LEN);
-        michael_mic(key, da, sa, qos_tid & 0x0f, data, data_len, mic);
+        michael_mic(key, hdr, data, data_len, mic);
 
         return TX_CONTINUE;
 }
@@ -126,47 +83,50 @@ ieee80211_tx_h_michael_mic_add(struct ieee80211_tx_data *tx)
 ieee80211_rx_result
 ieee80211_rx_h_michael_mic_verify(struct ieee80211_rx_data *rx)
 {
-        u8 *data, *sa, *da, *key = NULL, qos_tid;
+        u8 *data, *key = NULL, key_offset;
         size_t data_len;
-        u16 fc;
+        unsigned int hdrlen;
+        struct ieee80211_hdr *hdr;
         u8 mic[MICHAEL_MIC_LEN];
         struct sk_buff *skb = rx->skb;
         int authenticator = 1, wpa_test = 0;
         DECLARE_MAC_BUF(mac);
 
-        fc = rx->fc;
-
         /*
          * No way to verify the MIC if the hardware stripped it
          */
         if (rx->status->flag & RX_FLAG_MMIC_STRIPPED)
                 return RX_CONTINUE;
 
+        hdr = (struct ieee80211_hdr *)skb->data;
         if (!rx->key || rx->key->conf.alg != ALG_TKIP ||
-            !(rx->fc & IEEE80211_FCTL_PROTECTED) || !WLAN_FC_DATA_PRESENT(fc))
+            !ieee80211_has_protected(hdr->frame_control) ||
+            !ieee80211_is_data_present(hdr->frame_control))
                 return RX_CONTINUE;
 
-        if (ieee80211_get_hdr_info(skb, &sa, &da, &qos_tid, &data, &data_len)
-            || data_len < MICHAEL_MIC_LEN)
+        hdrlen = ieee80211_hdrlen(hdr->frame_control);
+        if (skb->len < hdrlen + MICHAEL_MIC_LEN)
                 return RX_DROP_UNUSABLE;
 
-        data_len -= MICHAEL_MIC_LEN;
+        data = skb->data + hdrlen;
+        data_len = skb->len - hdrlen - MICHAEL_MIC_LEN;
 
 #if 0
         authenticator = fc & IEEE80211_FCTL_TODS; /* FIX */
 #else
         authenticator = 1;
 #endif
-        key = &rx->key->conf.key[authenticator ? ALG_TKIP_TEMP_AUTH_RX_MIC_KEY :
-                                 ALG_TKIP_TEMP_AUTH_TX_MIC_KEY];
-        michael_mic(key, da, sa, qos_tid & 0x0f, data, data_len, mic);
+        /* At this point we know we're using ALG_TKIP. To get the MIC key
+         * we now will rely on the offset from the ieee80211_key_conf::key */
+        key_offset = authenticator ?
+                NL80211_TKIP_DATA_OFFSET_RX_MIC_KEY :
+                NL80211_TKIP_DATA_OFFSET_TX_MIC_KEY;
+        key = &rx->key->conf.key[key_offset];
+        michael_mic(key, hdr, data, data_len, mic);
         if (memcmp(mic, data + data_len, MICHAEL_MIC_LEN) != 0 || wpa_test) {
                 if (!(rx->flags & IEEE80211_RX_RA_MATCH))
                         return RX_DROP_UNUSABLE;
 
-                printk(KERN_DEBUG "%s: invalid Michael MIC in data frame from "
-                       "%s\n", rx->dev->name, print_mac(mac, sa));
-
                 mac80211_ev_michael_mic_failure(rx->dev, rx->key->conf.keyidx,
                                                 (void *) skb->data);
                 return RX_DROP_UNUSABLE;
@@ -176,59 +136,58 @@ ieee80211_rx_h_michael_mic_verify(struct ieee80211_rx_data *rx)
         skb_trim(skb, skb->len - MICHAEL_MIC_LEN);
 
         /* update IV in key information to be able to detect replays */
-        rx->key->u.tkip.iv32_rx[rx->queue] = rx->tkip_iv32;
-        rx->key->u.tkip.iv16_rx[rx->queue] = rx->tkip_iv16;
+        rx->key->u.tkip.rx[rx->queue].iv32 = rx->tkip_iv32;
+        rx->key->u.tkip.rx[rx->queue].iv16 = rx->tkip_iv16;
 
         return RX_CONTINUE;
 }
 
 
-static int tkip_encrypt_skb(struct ieee80211_tx_data *tx,
-                            struct sk_buff *skb, int test)
+static int tkip_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
 {
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
         struct ieee80211_key *key = tx->key;
-        int hdrlen, len, tailneed;
-        u16 fc;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+        unsigned int hdrlen;
+        int len, tail;
         u8 *pos;
 
-        fc = le16_to_cpu(hdr->frame_control);
-        hdrlen = ieee80211_get_hdrlen(fc);
+        info->control.icv_len = TKIP_ICV_LEN;
+        info->control.iv_len = TKIP_IV_LEN;
+
+        if ((tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) &&
+            !(tx->key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV)) {
+                /* hwaccel - with no need for preallocated room for IV/ICV */
+                info->control.hw_key = &tx->key->conf;
+                return 0;
+        }
+
+        hdrlen = ieee80211_hdrlen(hdr->frame_control);
         len = skb->len - hdrlen;
 
         if (tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE)
-                tailneed = 0;
+                tail = 0;
         else
-                tailneed = TKIP_ICV_LEN;
-
-        if ((skb_headroom(skb) < TKIP_IV_LEN ||
-             skb_tailroom(skb) < tailneed)) {
-                I802_DEBUG_INC(tx->local->tx_expand_skb_head);
-                if (unlikely(pskb_expand_head(skb, TKIP_IV_LEN, tailneed,
-                                              GFP_ATOMIC)))
-                        return -1;
-        }
+                tail = TKIP_ICV_LEN;
+
+        if (WARN_ON(skb_tailroom(skb) < tail ||
+                    skb_headroom(skb) < TKIP_IV_LEN))
+                return -1;
 
         pos = skb_push(skb, TKIP_IV_LEN);
         memmove(pos, pos + TKIP_IV_LEN, hdrlen);
         pos += hdrlen;
 
         /* Increase IV for the frame */
-        key->u.tkip.iv16++;
-        if (key->u.tkip.iv16 == 0)
-                key->u.tkip.iv32++;
+        key->u.tkip.tx.iv16++;
+        if (key->u.tkip.tx.iv16 == 0)
+                key->u.tkip.tx.iv32++;
 
         if (tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) {
-                hdr = (struct ieee80211_hdr *)skb->data;
-
                 /* hwaccel - with preallocated room for IV */
-                ieee80211_tkip_add_iv(pos, key,
-                                      (u8) (key->u.tkip.iv16 >> 8),
-                                      (u8) (((key->u.tkip.iv16 >> 8) | 0x20) &
-                                            0x7f),
-                                      (u8) key->u.tkip.iv16);
+                ieee80211_tkip_add_iv(pos, key, key->u.tkip.tx.iv16);
 
-                tx->control->key_idx = tx->key->conf.hw_key_idx;
+                info->control.hw_key = &tx->key->conf;
                 return 0;
         }
 
@@ -246,28 +205,16 @@ ieee80211_tx_result
 ieee80211_crypto_tkip_encrypt(struct ieee80211_tx_data *tx)
 {
         struct sk_buff *skb = tx->skb;
-        int wpa_test = 0, test = 0;
 
-        tx->control->icv_len = TKIP_ICV_LEN;
-        tx->control->iv_len = TKIP_IV_LEN;
         ieee80211_tx_set_protected(tx);
 
-        if ((tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) &&
-            !(tx->key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV) &&
-            !wpa_test) {
-                /* hwaccel - with no need for preallocated room for IV/ICV */
-                tx->control->key_idx = tx->key->conf.hw_key_idx;
-                return TX_CONTINUE;
-        }
-
-        if (tkip_encrypt_skb(tx, skb, test) < 0)
+        if (tkip_encrypt_skb(tx, skb) < 0)
                 return TX_DROP;
 
         if (tx->extra_frag) {
                 int i;
                 for (i = 0; i < tx->num_extra_frag; i++) {
-                        if (tkip_encrypt_skb(tx, tx->extra_frag[i], test)
-                            < 0)
+                        if (tkip_encrypt_skb(tx, tx->extra_frag[i]) < 0)
                                 return TX_DROP;
                 }
         }
@@ -280,16 +227,14 @@ ieee80211_rx_result
 ieee80211_crypto_tkip_decrypt(struct ieee80211_rx_data *rx)
 {
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) rx->skb->data;
-        u16 fc;
         int hdrlen, res, hwaccel = 0, wpa_test = 0;
         struct ieee80211_key *key = rx->key;
         struct sk_buff *skb = rx->skb;
         DECLARE_MAC_BUF(mac);
 
-        fc = le16_to_cpu(hdr->frame_control);
-        hdrlen = ieee80211_get_hdrlen(fc);
+        hdrlen = ieee80211_hdrlen(hdr->frame_control);
 
-        if ((rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA)
+        if (!ieee80211_is_data(hdr->frame_control))
                 return RX_CONTINUE;
 
         if (!rx->sta || skb->len - hdrlen < 12)
@@ -315,15 +260,8 @@ ieee80211_crypto_tkip_decrypt(struct ieee80211_rx_data *rx)
                                           hdr->addr1, hwaccel, rx->queue,
                                           &rx->tkip_iv32,
                                           &rx->tkip_iv16);
-        if (res != TKIP_DECRYPT_OK || wpa_test) {
-#ifdef CONFIG_MAC80211_DEBUG
-                if (net_ratelimit())
-                        printk(KERN_DEBUG "%s: TKIP decrypt failed for RX "
-                               "frame from %s (res=%d)\n", rx->dev->name,
-                               print_mac(mac, rx->sta->addr), res);
-#endif /* CONFIG_MAC80211_DEBUG */
+        if (res != TKIP_DECRYPT_OK || wpa_test)
                 return RX_DROP_UNUSABLE;
-        }
 
         /* Trim ICV */
         skb_trim(skb, skb->len - TKIP_ICV_LEN);
@@ -336,70 +274,68 @@ ieee80211_crypto_tkip_decrypt(struct ieee80211_rx_data *rx)
 }
 
 
-static void ccmp_special_blocks(struct sk_buff *skb, u8 *pn, u8 *b_0, u8 *aad,
+static void ccmp_special_blocks(struct sk_buff *skb, u8 *pn, u8 *scratch,
                                 int encrypted)
 {
-        u16 fc;
-        int a4_included, qos_included;
-        u8 qos_tid, *fc_pos, *data, *sa, *da;
-        int len_a;
-        size_t data_len;
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
+        __le16 mask_fc;
+        int a4_included;
+        u8 qos_tid;
+        u8 *b_0, *aad;
+        u16 data_len, len_a;
+        unsigned int hdrlen;
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
 
-        fc_pos = (u8 *) &hdr->frame_control;
-        fc = fc_pos[0] ^ (fc_pos[1] << 8);
-        a4_included = (fc & (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) ==
-                (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS);
-
-        ieee80211_get_hdr_info(skb, &sa, &da, &qos_tid, &data, &data_len);
-        data_len -= CCMP_HDR_LEN + (encrypted ? CCMP_MIC_LEN : 0);
-        if (qos_tid & 0x80) {
-                qos_included = 1;
-                qos_tid &= 0x0f;
-        } else
-                qos_included = 0;
-        /* First block, b_0 */
+        b_0 = scratch + 3 * AES_BLOCK_LEN;
+        aad = scratch + 4 * AES_BLOCK_LEN;
+
+        /*
+         * Mask FC: zero subtype b4 b5 b6
+         * Retry, PwrMgt, MoreData; set Protected
+         */
+        mask_fc = hdr->frame_control;
+        mask_fc &= ~cpu_to_le16(0x0070 | IEEE80211_FCTL_RETRY |
+                                IEEE80211_FCTL_PM | IEEE80211_FCTL_MOREDATA);
+        mask_fc |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
+
+        hdrlen = ieee80211_hdrlen(hdr->frame_control);
+        len_a = hdrlen - 2;
+        a4_included = ieee80211_has_a4(hdr->frame_control);
+
+        if (ieee80211_is_data_qos(hdr->frame_control))
+                qos_tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK;
+        else
+                qos_tid = 0;
+
+        data_len = skb->len - hdrlen - CCMP_HDR_LEN;
+        if (encrypted)
+                data_len -= CCMP_MIC_LEN;
 
+        /* First block, b_0 */
         b_0[0] = 0x59; /* flags: Adata: 1, M: 011, L: 001 */
         /* Nonce: QoS Priority | A2 | PN */
         b_0[1] = qos_tid;
-        memcpy(&b_0[2], hdr->addr2, 6);
+        memcpy(&b_0[2], hdr->addr2, ETH_ALEN);
         memcpy(&b_0[8], pn, CCMP_PN_LEN);
         /* l(m) */
-        b_0[14] = (data_len >> 8) & 0xff;
-        b_0[15] = data_len & 0xff;
-
+        put_unaligned_be16(data_len, &b_0[14]);
 
         /* AAD (extra authenticate-only data) / masked 802.11 header
          * FC | A1 | A2 | A3 | SC | [A4] | [QC] */
-
-        len_a = a4_included ? 28 : 22;
-        if (qos_included)
-                len_a += 2;
-
-        aad[0] = 0; /* (len_a >> 8) & 0xff; */
-        aad[1] = len_a & 0xff;
-        /* Mask FC: zero subtype b4 b5 b6 */
-        aad[2] = fc_pos[0] & ~(BIT(4) | BIT(5) | BIT(6));
-        /* Retry, PwrMgt, MoreData; set Protected */
-        aad[3] = (fc_pos[1] & ~(BIT(3) | BIT(4) | BIT(5))) | BIT(6);
-        memcpy(&aad[4], &hdr->addr1, 18);
+        put_unaligned_be16(len_a, &aad[0]);
+        put_unaligned(mask_fc, (__le16 *)&aad[2]);
+        memcpy(&aad[4], &hdr->addr1, 3 * ETH_ALEN);
 
         /* Mask Seq#, leave Frag# */
         aad[22] = *((u8 *) &hdr->seq_ctrl) & 0x0f;
         aad[23] = 0;
+
         if (a4_included) {
-                memcpy(&aad[24], hdr->addr4, 6);
-                aad[30] = 0;
+                memcpy(&aad[24], hdr->addr4, ETH_ALEN);
+                aad[30] = qos_tid;
                 aad[31] = 0;
-        } else
-                memset(&aad[24], 0, 8);
-        if (qos_included) {
-                u8 *dpos = &aad[a4_included ? 30 : 24];
-
-                /* Mask QoS Control field */
-                dpos[0] = qos_tid;
-                dpos[1] = 0;
+        } else {
+                memset(&aad[24], 0, ETH_ALEN + IEEE80211_QOS_CTL_LEN);
+                aad[24] = qos_tid;
         }
 }
 
@@ -429,36 +365,37 @@ static inline int ccmp_hdr2pn(u8 *pn, u8 *hdr)
 }
 
 
-static int ccmp_encrypt_skb(struct ieee80211_tx_data *tx,
-                            struct sk_buff *skb, int test)
+static int ccmp_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
 {
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
         struct ieee80211_key *key = tx->key;
-        int hdrlen, len, tailneed;
-        u16 fc;
-        u8 *pos, *pn, *b_0, *aad, *scratch;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+        int hdrlen, len, tail;
+        u8 *pos, *pn;
         int i;
 
-        scratch = key->u.ccmp.tx_crypto_buf;
-        b_0 = scratch + 3 * AES_BLOCK_LEN;
-        aad = scratch + 4 * AES_BLOCK_LEN;
+        info->control.icv_len = CCMP_MIC_LEN;
+        info->control.iv_len = CCMP_HDR_LEN;
 
-        fc = le16_to_cpu(hdr->frame_control);
-        hdrlen = ieee80211_get_hdrlen(fc);
+        if ((tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) &&
+            !(tx->key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV)) {
+                /* hwaccel - with no need for preallocated room for CCMP "
+                 * header or MIC fields */
+                info->control.hw_key = &tx->key->conf;
+                return 0;
+        }
+
+        hdrlen = ieee80211_hdrlen(hdr->frame_control);
         len = skb->len - hdrlen;
 
         if (key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE)
-                tailneed = 0;
+                tail = 0;
         else
-                tailneed = CCMP_MIC_LEN;
-
-        if ((skb_headroom(skb) < CCMP_HDR_LEN ||
-             skb_tailroom(skb) < tailneed)) {
-                I802_DEBUG_INC(tx->local->tx_expand_skb_head);
-                if (unlikely(pskb_expand_head(skb, CCMP_HDR_LEN, tailneed,
-                                              GFP_ATOMIC)))
-                        return -1;
-        }
+                tail = CCMP_MIC_LEN;
+
+        if (WARN_ON(skb_tailroom(skb) < tail ||
+                    skb_headroom(skb) < CCMP_HDR_LEN))
+                return -1;
 
         pos = skb_push(skb, CCMP_HDR_LEN);
         memmove(pos, pos + CCMP_HDR_LEN, hdrlen);
@@ -478,13 +415,13 @@ static int ccmp_encrypt_skb(struct ieee80211_tx_data *tx,
 
         if (key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) {
                 /* hwaccel - with preallocated room for CCMP header */
-                tx->control->key_idx = key->conf.hw_key_idx;
+                info->control.hw_key = &tx->key->conf;
                 return 0;
         }
 
         pos += CCMP_HDR_LEN;
-        ccmp_special_blocks(skb, pn, b_0, aad, 0);
-        ieee80211_aes_ccm_encrypt(key->u.ccmp.tfm, scratch, b_0, aad, pos, len,
+        ccmp_special_blocks(skb, pn, key->u.ccmp.tx_crypto_buf, 0);
+        ieee80211_aes_ccm_encrypt(key->u.ccmp.tfm, key->u.ccmp.tx_crypto_buf, pos, len,
                                   pos, skb_put(skb, CCMP_MIC_LEN));
 
         return 0;
@@ -495,28 +432,16 @@ ieee80211_tx_result
 ieee80211_crypto_ccmp_encrypt(struct ieee80211_tx_data *tx)
 {
         struct sk_buff *skb = tx->skb;
-        int test = 0;
 
-        tx->control->icv_len = CCMP_MIC_LEN;
-        tx->control->iv_len = CCMP_HDR_LEN;
         ieee80211_tx_set_protected(tx);
 
-        if ((tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) &&
-            !(tx->key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV)) {
-                /* hwaccel - with no need for preallocated room for CCMP "
-                 * header or MIC fields */
-                tx->control->key_idx = tx->key->conf.hw_key_idx;
-                return TX_CONTINUE;
-        }
-
-        if (ccmp_encrypt_skb(tx, skb, test) < 0)
+        if (ccmp_encrypt_skb(tx, skb) < 0)
                 return TX_DROP;
 
         if (tx->extra_frag) {
                 int i;
                 for (i = 0; i < tx->num_extra_frag; i++) {
-                        if (ccmp_encrypt_skb(tx, tx->extra_frag[i], test)
-                            < 0)
+                        if (ccmp_encrypt_skb(tx, tx->extra_frag[i]) < 0)
                                 return TX_DROP;
                 }
         }
@@ -528,8 +453,7 @@ ieee80211_crypto_ccmp_encrypt(struct ieee80211_tx_data *tx)
 ieee80211_rx_result
 ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx)
 {
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) rx->skb->data;
-        u16 fc;
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
         int hdrlen;
         struct ieee80211_key *key = rx->key;
         struct sk_buff *skb = rx->skb;
@@ -537,10 +461,9 @@ ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx)
         int data_len;
         DECLARE_MAC_BUF(mac);
 
-        fc = le16_to_cpu(hdr->frame_control);
-        hdrlen = ieee80211_get_hdrlen(fc);
+        hdrlen = ieee80211_hdrlen(hdr->frame_control);
 
-        if ((rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA)
+        if (!ieee80211_is_data(hdr->frame_control))
                 return RX_CONTINUE;
 
         data_len = skb->len - hdrlen - CCMP_HDR_LEN - CCMP_MIC_LEN;
@@ -554,41 +477,19 @@ ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx)
         (void) ccmp_hdr2pn(pn, skb->data + hdrlen);
 
         if (memcmp(pn, key->u.ccmp.rx_pn[rx->queue], CCMP_PN_LEN) <= 0) {
-#ifdef CONFIG_MAC80211_DEBUG
-                u8 *ppn = key->u.ccmp.rx_pn[rx->queue];
-
-                printk(KERN_DEBUG "%s: CCMP replay detected for RX frame from "
-                       "%s (RX PN %02x%02x%02x%02x%02x%02x <= prev. PN "
-                       "%02x%02x%02x%02x%02x%02x)\n", rx->dev->name,
-                       print_mac(mac, rx->sta->addr),
-                       pn[0], pn[1], pn[2], pn[3], pn[4], pn[5],
-                       ppn[0], ppn[1], ppn[2], ppn[3], ppn[4], ppn[5]);
-#endif /* CONFIG_MAC80211_DEBUG */
                 key->u.ccmp.replays++;
                 return RX_DROP_UNUSABLE;
         }
 
         if (!(rx->status->flag & RX_FLAG_DECRYPTED)) {
                 /* hardware didn't decrypt/verify MIC */
-                u8 *scratch, *b_0, *aad;
-
-                scratch = key->u.ccmp.rx_crypto_buf;
-                b_0 = scratch + 3 * AES_BLOCK_LEN;
-                aad = scratch + 4 * AES_BLOCK_LEN;
-
-                ccmp_special_blocks(skb, pn, b_0, aad, 1);
+                ccmp_special_blocks(skb, pn, key->u.ccmp.rx_crypto_buf, 1);
 
                 if (ieee80211_aes_ccm_decrypt(
-                            key->u.ccmp.tfm, scratch, b_0, aad,
+                            key->u.ccmp.tfm, key->u.ccmp.rx_crypto_buf,
                             skb->data + hdrlen + CCMP_HDR_LEN, data_len,
                             skb->data + skb->len - CCMP_MIC_LEN,
                             skb->data + hdrlen + CCMP_HDR_LEN)) {
-#ifdef CONFIG_MAC80211_DEBUG
-                        if (net_ratelimit())
-                                printk(KERN_DEBUG "%s: CCMP decrypt failed "
-                                       "for RX frame from %s\n", rx->dev->name,
-                                       print_mac(mac, rx->sta->addr));
-#endif /* CONFIG_MAC80211_DEBUG */
                         return RX_DROP_UNUSABLE;
                 }
         }