Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/linville/wireless-next-2.6

Conflicts:

	drivers/net/ps3_gelic_wireless.c
	drivers/net/wireless/libertas/main.c

32 files changed, 971 insertions, 1089 deletions

diff --git a/net/mac80211/Kconfig b/net/mac80211/Kconfig
index a24b459dd45a..590e00b2766c 100644
--- a/net/mac80211/Kconfig
+++ b/net/mac80211/Kconfig
@@ -7,11 +7,23 @@ config MAC80211
         select CRC32
         select WIRELESS_EXT
         select CFG80211
-        select NET_SCH_FIFO
         ---help---
           This option enables the hardware independent IEEE 802.11
           networking stack.
 
+config MAC80211_QOS
+        def_bool y
+        depends on MAC80211
+        depends on NET_SCHED
+        depends on NETDEVICES_MULTIQUEUE
+
+comment "QoS/HT support disabled"
+        depends on MAC80211 && !MAC80211_QOS
+comment "QoS/HT support needs CONFIG_NET_SCHED"
+        depends on MAC80211 && !NET_SCHED
+comment "QoS/HT support needs CONFIG_NETDEVICES_MULTIQUEUE"
+        depends on MAC80211 && !NETDEVICES_MULTIQUEUE
+
 menu "Rate control algorithm selection"
         depends on MAC80211 != n
 
diff --git a/net/mac80211/Makefile b/net/mac80211/Makefile
index 4e5847fd316c..1d2a4e010e5c 100644
--- a/net/mac80211/Makefile
+++ b/net/mac80211/Makefile
@@ -29,7 +29,7 @@ mac80211-y := \
         event.o
 
 mac80211-$(CONFIG_MAC80211_LEDS) += led.o
-mac80211-$(CONFIG_NET_SCHED) += wme.o
+mac80211-$(CONFIG_MAC80211_QOS) += wme.o
 mac80211-$(CONFIG_MAC80211_DEBUGFS) += \
         debugfs.o \
         debugfs_sta.o \
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 3cef80dcd0e5..dbf0563c397d 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -256,8 +256,8 @@ static int ieee80211_get_key(struct wiphy *wiphy, struct net_device *dev,
         case ALG_TKIP:
                 params.cipher = WLAN_CIPHER_SUITE_TKIP;
 
-                iv32 = key->u.tkip.iv32;
-                iv16 = key->u.tkip.iv16;
+                iv32 = key->u.tkip.tx.iv32;
+                iv16 = key->u.tkip.tx.iv16;
 
                 if (key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE &&
                     sdata->local->ops->get_tkip_seq)
diff --git a/net/mac80211/debugfs_key.c b/net/mac80211/debugfs_key.c
index 19efc3a6a932..7439b63df5d0 100644
--- a/net/mac80211/debugfs_key.c
+++ b/net/mac80211/debugfs_key.c
@@ -97,8 +97,8 @@ static ssize_t key_tx_spec_read(struct file *file, char __user *userbuf,
                 break;
         case ALG_TKIP:
                 len = scnprintf(buf, sizeof(buf), "%08x %04x\n",
-                                key->u.tkip.iv32,
-                                key->u.tkip.iv16);
+                                key->u.tkip.tx.iv32,
+                                key->u.tkip.tx.iv16);
                 break;
         case ALG_CCMP:
                 tpn = key->u.ccmp.tx_pn;
@@ -128,8 +128,8 @@ static ssize_t key_rx_spec_read(struct file *file, char __user *userbuf,
                 for (i = 0; i < NUM_RX_DATA_QUEUES; i++)
                         p += scnprintf(p, sizeof(buf)+buf-p,
                                        "%08x %04x\n",
-                                       key->u.tkip.iv32_rx[i],
-                                       key->u.tkip.iv16_rx[i]);
+                                       key->u.tkip.rx[i].iv32,
+                                       key->u.tkip.rx[i].iv16);
                 len = p - buf;
                 break;
         case ALG_CCMP:
diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c
index 3ae5493d728b..b2089b2da48a 100644
--- a/net/mac80211/debugfs_netdev.c
+++ b/net/mac80211/debugfs_netdev.c
@@ -155,7 +155,6 @@ static const struct file_operations name##_ops = {			\
                 __IEEE80211_IF_WFILE(name)
 
 /* common attributes */
-IEEE80211_IF_FILE(channel_use, channel_use, DEC);
 IEEE80211_IF_FILE(drop_unencrypted, drop_unencrypted, DEC);
 
 /* STA/IBSS attributes */
@@ -248,7 +247,6 @@ IEEE80211_IF_WFILE(min_discovery_timeout,
 
 static void add_sta_files(struct ieee80211_sub_if_data *sdata)
 {
-        DEBUGFS_ADD(channel_use, sta);
         DEBUGFS_ADD(drop_unencrypted, sta);
         DEBUGFS_ADD(state, sta);
         DEBUGFS_ADD(bssid, sta);
@@ -269,7 +267,6 @@ static void add_sta_files(struct ieee80211_sub_if_data *sdata)
 
 static void add_ap_files(struct ieee80211_sub_if_data *sdata)
 {
-        DEBUGFS_ADD(channel_use, ap);
         DEBUGFS_ADD(drop_unencrypted, ap);
         DEBUGFS_ADD(num_sta_ps, ap);
         DEBUGFS_ADD(dtim_count, ap);
@@ -281,14 +278,12 @@ static void add_ap_files(struct ieee80211_sub_if_data *sdata)
 
 static void add_wds_files(struct ieee80211_sub_if_data *sdata)
 {
-        DEBUGFS_ADD(channel_use, wds);
         DEBUGFS_ADD(drop_unencrypted, wds);
         DEBUGFS_ADD(peer, wds);
 }
 
 static void add_vlan_files(struct ieee80211_sub_if_data *sdata)
 {
-        DEBUGFS_ADD(channel_use, vlan);
         DEBUGFS_ADD(drop_unencrypted, vlan);
 }
 
@@ -376,7 +371,6 @@ static void add_files(struct ieee80211_sub_if_data *sdata)
 
 static void del_sta_files(struct ieee80211_sub_if_data *sdata)
 {
-        DEBUGFS_DEL(channel_use, sta);
         DEBUGFS_DEL(drop_unencrypted, sta);
         DEBUGFS_DEL(state, sta);
         DEBUGFS_DEL(bssid, sta);
@@ -397,7 +391,6 @@ static void del_sta_files(struct ieee80211_sub_if_data *sdata)
 
 static void del_ap_files(struct ieee80211_sub_if_data *sdata)
 {
-        DEBUGFS_DEL(channel_use, ap);
         DEBUGFS_DEL(drop_unencrypted, ap);
         DEBUGFS_DEL(num_sta_ps, ap);
         DEBUGFS_DEL(dtim_count, ap);
@@ -409,14 +402,12 @@ static void del_ap_files(struct ieee80211_sub_if_data *sdata)
 
 static void del_wds_files(struct ieee80211_sub_if_data *sdata)
 {
-        DEBUGFS_DEL(channel_use, wds);
         DEBUGFS_DEL(drop_unencrypted, wds);
         DEBUGFS_DEL(peer, wds);
 }
 
 static void del_vlan_files(struct ieee80211_sub_if_data *sdata)
 {
-        DEBUGFS_DEL(channel_use, vlan);
         DEBUGFS_DEL(drop_unencrypted, vlan);
 }
 
diff --git a/net/mac80211/debugfs_sta.c b/net/mac80211/debugfs_sta.c
index a2cc0284c9d0..79a062782d52 100644
--- a/net/mac80211/debugfs_sta.c
+++ b/net/mac80211/debugfs_sta.c
@@ -66,7 +66,6 @@ STA_FILE(tx_retry_count, tx_retry_count, LU);
 STA_FILE(last_signal, last_signal, D);
 STA_FILE(last_qual, last_qual, D);
 STA_FILE(last_noise, last_noise, D);
-STA_FILE(channel_use, channel_use, D);
 STA_FILE(wep_weak_iv_count, wep_weak_iv_count, LU);
 
 static ssize_t sta_flags_read(struct file *file, char __user *userbuf,
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index ed0d9b35ae6f..432011cd3647 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -2,6 +2,7 @@
  * Copyright 2002-2005, Instant802 Networks, Inc.
  * Copyright 2005, Devicescape Software, Inc.
  * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
+ * Copyright 2007-2008  Johannes Berg <johannes@sipsolutions.net>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
@@ -91,6 +92,8 @@ struct ieee80211_sta_bss {
         size_t wmm_ie_len;
         u8 *ht_ie;
         size_t ht_ie_len;
+        u8 *ht_add_ie;
+        size_t ht_add_ie_len;
 #ifdef CONFIG_MAC80211_MESH
         u8 *mesh_id;
         size_t mesh_id_len;
@@ -147,7 +150,6 @@ typedef unsigned __bitwise__ ieee80211_tx_result;
 #define IEEE80211_TX_UNICAST            BIT(1)
 #define IEEE80211_TX_PS_BUFFERED        BIT(2)
 #define IEEE80211_TX_PROBE_LAST_FRAG    BIT(3)
-#define IEEE80211_TX_INJECTED           BIT(4)
 
 struct ieee80211_tx_data {
         struct sk_buff *skb;
@@ -157,13 +159,12 @@ struct ieee80211_tx_data {
         struct sta_info *sta;
         struct ieee80211_key *key;
 
-        struct ieee80211_tx_control *control;
         struct ieee80211_channel *channel;
-        struct ieee80211_rate *rate;
+        s8 rate_idx;
         /* use this rate (if set) for last fragment; rate can
          * be set to lower rate for the first fragments, e.g.,
          * when using CTS protection with IEEE 802.11g. */
-        struct ieee80211_rate *last_frag_rate;
+        s8 last_frag_rate_idx;
 
         /* Extra fragments (in addition to the first fragment
          * in skb) */
@@ -202,32 +203,16 @@ struct ieee80211_rx_data {
         unsigned int flags;
         int sent_ps_buffered;
         int queue;
-        int load;
         u32 tkip_iv32;
         u16 tkip_iv16;
 };
 
-/* flags used in struct ieee80211_tx_packet_data.flags */
-#define IEEE80211_TXPD_REQ_TX_STATUS    BIT(0)
-#define IEEE80211_TXPD_DO_NOT_ENCRYPT   BIT(1)
-#define IEEE80211_TXPD_REQUEUE          BIT(2)
-#define IEEE80211_TXPD_EAPOL_FRAME      BIT(3)
-#define IEEE80211_TXPD_AMPDU            BIT(4)
-/* Stored in sk_buff->cb */
-struct ieee80211_tx_packet_data {
-        int ifindex;
-        unsigned long jiffies;
-        unsigned int flags;
-        u8 queue;
-};
-
 struct ieee80211_tx_stored_packet {
-        struct ieee80211_tx_control control;
         struct sk_buff *skb;
         struct sk_buff **extra_frag;
-        struct ieee80211_rate *last_frag_rate;
+        s8 last_frag_rate_idx;
         int num_extra_frag;
-        unsigned int last_frag_rate_ctrl_probe;
+        bool last_frag_rate_ctrl_probe;
 };
 
 struct beacon_data {
@@ -464,14 +449,11 @@ struct ieee80211_sub_if_data {
                 struct ieee80211_if_sta sta;
                 u32 mntr_flags;
         } u;
-        int channel_use;
-        int channel_use_raw;
 
 #ifdef CONFIG_MAC80211_DEBUGFS
         struct dentry *debugfsdir;
         union {
                 struct {
-                        struct dentry *channel_use;
                         struct dentry *drop_unencrypted;
                         struct dentry *state;
                         struct dentry *bssid;
@@ -490,7 +472,6 @@ struct ieee80211_sub_if_data {
                         struct dentry *num_beacons_sta;
                 } sta;
                 struct {
-                        struct dentry *channel_use;
                         struct dentry *drop_unencrypted;
                         struct dentry *num_sta_ps;
                         struct dentry *dtim_count;
@@ -500,12 +481,10 @@ struct ieee80211_sub_if_data {
                         struct dentry *num_buffered_multicast;
                 } ap;
                 struct {
-                        struct dentry *channel_use;
                         struct dentry *drop_unencrypted;
                         struct dentry *peer;
                 } wds;
                 struct {
-                        struct dentry *channel_use;
                         struct dentry *drop_unencrypted;
                 } vlan;
                 struct {
@@ -610,8 +589,8 @@ struct ieee80211_local {
         struct sta_info *sta_hash[STA_HASH_SIZE];
         struct timer_list sta_cleanup;
 
-        unsigned long state[IEEE80211_MAX_QUEUES + IEEE80211_MAX_AMPDU_QUEUES];
-        struct ieee80211_tx_stored_packet pending_packet[IEEE80211_MAX_QUEUES + IEEE80211_MAX_AMPDU_QUEUES];
+        unsigned long queues_pending[BITS_TO_LONGS(IEEE80211_MAX_QUEUES)];
+        struct ieee80211_tx_stored_packet pending_packet[IEEE80211_MAX_QUEUES];
         struct tasklet_struct tx_pending_tasklet;
 
         /* number of interfaces with corresponding IFF_ flags */
@@ -677,9 +656,6 @@ struct ieee80211_local {
              assoc_led_name[32], radio_led_name[32];
 #endif
 
-        u32 channel_use;
-        u32 channel_use_raw;
-
 #ifdef CONFIG_MAC80211_DEBUGFS
         struct work_struct sta_debugfs_add;
 #endif
@@ -774,6 +750,15 @@ struct ieee80211_local {
 #endif
 };
 
+static inline int ieee80211_is_multiqueue(struct ieee80211_local *local)
+{
+#ifdef CONFIG_MAC80211_QOS
+        return netif_is_multiqueue(local->mdev);
+#else
+        return 0;
+#endif
+}
+
 /* this struct represents 802.11n's RA/TID combination */
 struct ieee80211_ra_tid {
         u8 ra[ETH_ALEN];
@@ -843,11 +828,6 @@ static inline struct ieee80211_hw *local_to_hw(
         return &local->hw;
 }
 
-enum ieee80211_link_state_t {
-        IEEE80211_LINK_STATE_XOFF = 0,
-        IEEE80211_LINK_STATE_PENDING,
-};
-
 struct sta_attribute {
         struct attribute attr;
         ssize_t (*show)(const struct sta_info *, char *buf);
@@ -873,28 +853,6 @@ u32 ieee80211_handle_ht(struct ieee80211_local *local, int enable_ht,
 
 /* ieee80211_ioctl.c */
 extern const struct iw_handler_def ieee80211_iw_handler_def;
-
-
-/* Least common multiple of the used rates (in 100 kbps). This is used to
- * calculate rate_inv values for each rate so that only integers are needed. */
-#define CHAN_UTIL_RATE_LCM 95040
-/* 1 usec is 1/8 * (95040/10) = 1188 */
-#define CHAN_UTIL_PER_USEC 1188
-/* Amount of bits to shift the result right to scale the total utilization
- * to values that will not wrap around 32-bit integers. */
-#define CHAN_UTIL_SHIFT 9
-/* Theoretical maximum of channel utilization counter in 10 ms (stat_time=1):
- * (CHAN_UTIL_PER_USEC * 10000) >> CHAN_UTIL_SHIFT = 23203. So dividing the
- * raw value with about 23 should give utilization in 10th of a percentage
- * (1/1000). However, utilization is only estimated and not all intervals
- * between frames etc. are calculated. 18 seems to give numbers that are closer
- * to the real maximum. */
-#define CHAN_UTIL_PER_10MS 18
-#define CHAN_UTIL_HDR_LONG (202 * CHAN_UTIL_PER_USEC)
-#define CHAN_UTIL_HDR_SHORT (40 * CHAN_UTIL_PER_USEC)
-
-
-/* ieee80211_ioctl.c */
 int ieee80211_set_freq(struct ieee80211_local *local, int freq);
 /* ieee80211_sta.c */
 void ieee80211_sta_timer(unsigned long data);
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 3c64e42eb12e..984472702381 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -168,7 +168,7 @@ void ieee80211_if_set_type(struct net_device *dev, int type)
                 ifsta->flags |= IEEE80211_STA_CREATE_IBSS |
                         IEEE80211_STA_AUTO_BSSID_SEL |
                         IEEE80211_STA_AUTO_CHANNEL_SEL;
-                if (sdata->local->hw.queues >= 4)
+                if (ieee80211_num_regular_queues(&sdata->local->hw) >= 4)
                         ifsta->flags |= IEEE80211_STA_WMM_ENABLED;
 
                 msdata = IEEE80211_DEV_TO_SUB_IF(sdata->local->mdev);
diff --git a/net/mac80211/key.h b/net/mac80211/key.h
index f52c3df1fe9a..a0f774aafa45 100644
--- a/net/mac80211/key.h
+++ b/net/mac80211/key.h
@@ -69,6 +69,13 @@ enum ieee80211_internal_key_flags {
         KEY_FLAG_TODO_ADD_DEBUGFS       = BIT(5),
 };
 
+struct tkip_ctx {
+        u32 iv32;
+        u16 iv16;
+        u16 p1k[5];
+        int initialized;
+};
+
 struct ieee80211_key {
         struct ieee80211_local *local;
         struct ieee80211_sub_if_data *sdata;
@@ -85,16 +92,10 @@ struct ieee80211_key {
         union {
                 struct {
                         /* last used TSC */
-                        u32 iv32;
-                        u16 iv16;
-                        u16 p1k[5];
-                        int tx_initialized;
+                        struct tkip_ctx tx;
 
                         /* last received RSC */
-                        u32 iv32_rx[NUM_RX_DATA_QUEUES];
-                        u16 iv16_rx[NUM_RX_DATA_QUEUES];
-                        u16 p1k_rx[NUM_RX_DATA_QUEUES][5];
-                        int rx_initialized[NUM_RX_DATA_QUEUES];
+                        struct tkip_ctx rx[NUM_RX_DATA_QUEUES];
                 } tkip;
                 struct {
                         u8 tx_pn[6];
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 36016363d225..f79f6b9938a6 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -35,8 +35,6 @@
 #include "debugfs.h"
 #include "debugfs_netdev.h"
 
-#define SUPP_MCS_SET_LEN 16
-
 /*
  * For seeing transmitted packets on monitor interfaces
  * we have a radiotap header too.
@@ -112,7 +110,13 @@ static int ieee80211_master_open(struct net_device *dev)
                         break;
                 }
         }
-        return res;
+
+        if (res)
+                return res;
+
+        netif_start_queue(local->mdev);
+
+        return 0;
 }
 
 static int ieee80211_master_stop(struct net_device *dev)
@@ -585,8 +589,8 @@ int ieee80211_start_tx_ba_session(struct ieee80211_hw *hw, u8 *ra, u16 tid)
         sta = sta_info_get(local, ra);
         if (!sta) {
                 printk(KERN_DEBUG "Could not find the station\n");
-                rcu_read_unlock();
-                return -ENOENT;
+                ret = -ENOENT;
+                goto exit;
         }
 
         spin_lock_bh(&sta->lock);
@@ -594,7 +598,7 @@ int ieee80211_start_tx_ba_session(struct ieee80211_hw *hw, u8 *ra, u16 tid)
         /* we have tried too many times, receiver does not want A-MPDU */
         if (sta->ampdu_mlme.addba_req_num[tid] > HT_AGG_MAX_RETRIES) {
                 ret = -EBUSY;
-                goto start_ba_exit;
+                goto err_unlock_sta;
         }
 
         state = &sta->ampdu_mlme.tid_state_tx[tid];
@@ -605,7 +609,7 @@ int ieee80211_start_tx_ba_session(struct ieee80211_hw *hw, u8 *ra, u16 tid)
                                  "idle on tid %u\n", tid);
 #endif /* CONFIG_MAC80211_HT_DEBUG */
                 ret = -EAGAIN;
-                goto start_ba_exit;
+                goto err_unlock_sta;
         }
 
         /* prepare A-MPDU MLME for Tx aggregation */
@@ -616,7 +620,7 @@ int ieee80211_start_tx_ba_session(struct ieee80211_hw *hw, u8 *ra, u16 tid)
                         printk(KERN_ERR "allocate tx mlme to tid %d failed\n",
                                         tid);
                 ret = -ENOMEM;
-                goto start_ba_exit;
+                goto err_unlock_sta;
         }
         /* Tx timer */
         sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer.function =
@@ -639,7 +643,7 @@ int ieee80211_start_tx_ba_session(struct ieee80211_hw *hw, u8 *ra, u16 tid)
                 printk(KERN_DEBUG "BA request denied - queue unavailable for"
                                         " tid %d\n", tid);
 #endif /* CONFIG_MAC80211_HT_DEBUG */
-                goto start_ba_err;
+                goto err_unlock_queue;
         }
         sdata = sta->sdata;
 
@@ -661,12 +665,13 @@ int ieee80211_start_tx_ba_session(struct ieee80211_hw *hw, u8 *ra, u16 tid)
                                         " tid %d\n", tid);
 #endif /* CONFIG_MAC80211_HT_DEBUG */
                 *state = HT_AGG_STATE_IDLE;
-                goto start_ba_err;
+                goto err_unlock_queue;
         }
 
         /* Will put all the packets in the new SW queue */
         ieee80211_requeue(local, ieee802_1d_to_ac[tid]);
         spin_unlock_bh(&local->mdev->queue_lock);
+        spin_unlock_bh(&sta->lock);
 
         /* send an addBA request */
         sta->ampdu_mlme.dialog_token_allocator++;
@@ -674,25 +679,26 @@ int ieee80211_start_tx_ba_session(struct ieee80211_hw *hw, u8 *ra, u16 tid)
                         sta->ampdu_mlme.dialog_token_allocator;
         sta->ampdu_mlme.tid_tx[tid]->ssn = start_seq_num;
 
+
         ieee80211_send_addba_request(sta->sdata->dev, ra, tid,
                          sta->ampdu_mlme.tid_tx[tid]->dialog_token,
                          sta->ampdu_mlme.tid_tx[tid]->ssn,
                          0x40, 5000);
-
         /* activate the timer for the recipient's addBA response */
         sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer.expires =
                                 jiffies + ADDBA_RESP_INTERVAL;
         add_timer(&sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer);
         printk(KERN_DEBUG "activated addBA response timer on tid %d\n", tid);
-        goto start_ba_exit;
+        goto exit;
 
-start_ba_err:
+err_unlock_queue:
         kfree(sta->ampdu_mlme.tid_tx[tid]);
         sta->ampdu_mlme.tid_tx[tid] = NULL;
         spin_unlock_bh(&local->mdev->queue_lock);
         ret = -EBUSY;
-start_ba_exit:
+err_unlock_sta:
         spin_unlock_bh(&sta->lock);
+exit:
         rcu_read_unlock();
         return ret;
 }
@@ -831,10 +837,11 @@ void ieee80211_stop_tx_ba_cb(struct ieee80211_hw *hw, u8 *ra, u8 tid)
         }
         state = &sta->ampdu_mlme.tid_state_tx[tid];
 
-        spin_lock_bh(&sta->lock);
+        /* NOTE: no need to use sta->lock in this state check, as
+         * ieee80211_stop_tx_ba_session will let only
+         * one stop call to pass through per sta/tid */
         if ((*state & HT_AGG_STATE_REQ_STOP_BA_MSK) == 0) {
                 printk(KERN_DEBUG "unexpected callback to A-MPDU stop\n");
-                spin_unlock_bh(&sta->lock);
                 rcu_read_unlock();
                 return;
         }
@@ -857,6 +864,7 @@ void ieee80211_stop_tx_ba_cb(struct ieee80211_hw *hw, u8 *ra, u8 tid)
          * ieee80211_wake_queue is not used here as this queue is not
          * necessarily stopped */
         netif_schedule(local->mdev);
+        spin_lock_bh(&sta->lock);
         *state = HT_AGG_STATE_IDLE;
         sta->ampdu_mlme.addba_req_num[tid] = 0;
         kfree(sta->ampdu_mlme.tid_tx[tid]);
@@ -967,8 +975,7 @@ void ieee80211_if_setup(struct net_device *dev)
 /* everything else */
 
 static int __ieee80211_if_config(struct net_device *dev,
-                                 struct sk_buff *beacon,
-                                 struct ieee80211_tx_control *control)
+                                 struct sk_buff *beacon)
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
@@ -986,13 +993,11 @@ static int __ieee80211_if_config(struct net_device *dev,
                 conf.ssid_len = sdata->u.sta.ssid_len;
         } else if (ieee80211_vif_is_mesh(&sdata->vif)) {
                 conf.beacon = beacon;
-                conf.beacon_control = control;
                 ieee80211_start_mesh(dev);
         } else if (sdata->vif.type == IEEE80211_IF_TYPE_AP) {
                 conf.ssid = sdata->u.ap.ssid;
                 conf.ssid_len = sdata->u.ap.ssid_len;
                 conf.beacon = beacon;
-                conf.beacon_control = control;
         }
         return local->ops->config_interface(local_to_hw(local),
                                             &sdata->vif, &conf);
@@ -1005,23 +1010,21 @@ int ieee80211_if_config(struct net_device *dev)
         if (sdata->vif.type == IEEE80211_IF_TYPE_MESH_POINT &&
             (local->hw.flags & IEEE80211_HW_HOST_GEN_BEACON_TEMPLATE))
                 return ieee80211_if_config_beacon(dev);
-        return __ieee80211_if_config(dev, NULL, NULL);
+        return __ieee80211_if_config(dev, NULL);
 }
 
 int ieee80211_if_config_beacon(struct net_device *dev)
 {
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        struct ieee80211_tx_control control;
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         struct sk_buff *skb;
 
         if (!(local->hw.flags & IEEE80211_HW_HOST_GEN_BEACON_TEMPLATE))
                 return 0;
-        skb = ieee80211_beacon_get(local_to_hw(local), &sdata->vif,
-                                   &control);
+        skb = ieee80211_beacon_get(local_to_hw(local), &sdata->vif);
         if (!skb)
                 return -ENOMEM;
-        return __ieee80211_if_config(dev, skb, &control);
+        return __ieee80211_if_config(dev, skb);
 }
 
 int ieee80211_hw_config(struct ieee80211_local *local)
@@ -1068,56 +1071,84 @@ u32 ieee80211_handle_ht(struct ieee80211_local *local, int enable_ht,
         struct ieee80211_supported_band *sband;
         struct ieee80211_ht_info ht_conf;
         struct ieee80211_ht_bss_info ht_bss_conf;
-        int i;
         u32 changed = 0;
+        int i;
+        u8 max_tx_streams = IEEE80211_HT_CAP_MAX_STREAMS;
+        u8 tx_mcs_set_cap;
 
         sband = local->hw.wiphy->bands[conf->channel->band];
 
+        memset(&ht_conf, 0, sizeof(struct ieee80211_ht_info));
+        memset(&ht_bss_conf, 0, sizeof(struct ieee80211_ht_bss_info));
+
         /* HT is not supported */
         if (!sband->ht_info.ht_supported) {
                 conf->flags &= ~IEEE80211_CONF_SUPPORT_HT_MODE;
-                return 0;
+                goto out;
         }
 
-        memset(&ht_conf, 0, sizeof(struct ieee80211_ht_info));
-        memset(&ht_bss_conf, 0, sizeof(struct ieee80211_ht_bss_info));
-
-        if (enable_ht) {
-                if (!(conf->flags & IEEE80211_CONF_SUPPORT_HT_MODE))
+        /* disable HT */
+        if (!enable_ht) {
+                if (conf->flags & IEEE80211_CONF_SUPPORT_HT_MODE)
                         changed |= BSS_CHANGED_HT;
+                conf->flags &= ~IEEE80211_CONF_SUPPORT_HT_MODE;
+                conf->ht_conf.ht_supported = 0;
+                goto out;
+        }
 
-                conf->flags |= IEEE80211_CONF_SUPPORT_HT_MODE;
-                ht_conf.ht_supported = 1;
 
-                ht_conf.cap = req_ht_cap->cap & sband->ht_info.cap;
-                ht_conf.cap &= ~(IEEE80211_HT_CAP_MIMO_PS);
-                ht_conf.cap |= sband->ht_info.cap & IEEE80211_HT_CAP_MIMO_PS;
+        if (!(conf->flags & IEEE80211_CONF_SUPPORT_HT_MODE))
+                changed |= BSS_CHANGED_HT;
 
-                for (i = 0; i < SUPP_MCS_SET_LEN; i++)
-                        ht_conf.supp_mcs_set[i] =
-                                        sband->ht_info.supp_mcs_set[i] &
-                                        req_ht_cap->supp_mcs_set[i];
+        conf->flags |= IEEE80211_CONF_SUPPORT_HT_MODE;
+        ht_conf.ht_supported = 1;
 
-                ht_bss_conf.primary_channel = req_bss_cap->primary_channel;
-                ht_bss_conf.bss_cap = req_bss_cap->bss_cap;
-                ht_bss_conf.bss_op_mode = req_bss_cap->bss_op_mode;
+        ht_conf.cap = req_ht_cap->cap & sband->ht_info.cap;
+        ht_conf.cap &= ~(IEEE80211_HT_CAP_MIMO_PS);
+        ht_conf.cap |= sband->ht_info.cap & IEEE80211_HT_CAP_MIMO_PS;
+        ht_bss_conf.primary_channel = req_bss_cap->primary_channel;
+        ht_bss_conf.bss_cap = req_bss_cap->bss_cap;
+        ht_bss_conf.bss_op_mode = req_bss_cap->bss_op_mode;
 
-                ht_conf.ampdu_factor = req_ht_cap->ampdu_factor;
-                ht_conf.ampdu_density = req_ht_cap->ampdu_density;
+        ht_conf.ampdu_factor = req_ht_cap->ampdu_factor;
+        ht_conf.ampdu_density = req_ht_cap->ampdu_density;
 
-                /* if bss configuration changed store the new one */
-                if (memcmp(&conf->ht_conf, &ht_conf, sizeof(ht_conf)) ||
-                    memcmp(&conf->ht_bss_conf, &ht_bss_conf, sizeof(ht_bss_conf))) {
-                        changed |= BSS_CHANGED_HT;
-                        memcpy(&conf->ht_conf, &ht_conf, sizeof(ht_conf));
-                        memcpy(&conf->ht_bss_conf, &ht_bss_conf, sizeof(ht_bss_conf));
-                }
-        } else {
-                if (conf->flags & IEEE80211_CONF_SUPPORT_HT_MODE)
-                        changed |= BSS_CHANGED_HT;
-                conf->flags &= ~IEEE80211_CONF_SUPPORT_HT_MODE;
-        }
+        /* Bits 96-100 */
+        tx_mcs_set_cap = sband->ht_info.supp_mcs_set[12];
+
+        /* configure suppoerted Tx MCS according to requested MCS
+         * (based in most cases on Rx capabilities of peer) and self
+         * Tx MCS capabilities (as defined by low level driver HW
+         * Tx capabilities) */
+        if (!(tx_mcs_set_cap & IEEE80211_HT_CAP_MCS_TX_DEFINED))
+                goto check_changed;
+
+        /* Counting from 0 therfore + 1 */
+        if (tx_mcs_set_cap & IEEE80211_HT_CAP_MCS_TX_RX_DIFF)
+                max_tx_streams = ((tx_mcs_set_cap &
+                                IEEE80211_HT_CAP_MCS_TX_STREAMS) >> 2) + 1;
+
+        for (i = 0; i < max_tx_streams; i++)
+                ht_conf.supp_mcs_set[i] =
+                        sband->ht_info.supp_mcs_set[i] &
+                                        req_ht_cap->supp_mcs_set[i];
+
+        if (tx_mcs_set_cap & IEEE80211_HT_CAP_MCS_TX_UEQM)
+                for (i = IEEE80211_SUPP_MCS_SET_UEQM;
+                     i < IEEE80211_SUPP_MCS_SET_LEN; i++)
+                        ht_conf.supp_mcs_set[i] =
+                                sband->ht_info.supp_mcs_set[i] &
+                                        req_ht_cap->supp_mcs_set[i];
 
+check_changed:
+        /* if bss configuration changed store the new one */
+        if (memcmp(&conf->ht_conf, &ht_conf, sizeof(ht_conf)) ||
+            memcmp(&conf->ht_bss_conf, &ht_bss_conf, sizeof(ht_bss_conf))) {
+                changed |= BSS_CHANGED_HT;
+                memcpy(&conf->ht_conf, &ht_conf, sizeof(ht_conf));
+                memcpy(&conf->ht_bss_conf, &ht_bss_conf, sizeof(ht_bss_conf));
+        }
+out:
         return changed;
 }
 
@@ -1148,38 +1179,20 @@ void ieee80211_reset_erp_info(struct net_device *dev)
 }
 
 void ieee80211_tx_status_irqsafe(struct ieee80211_hw *hw,
-                                 struct sk_buff *skb,
-                                 struct ieee80211_tx_status *status)
+                                 struct sk_buff *skb)
 {
         struct ieee80211_local *local = hw_to_local(hw);
-        struct ieee80211_tx_status *saved;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         int tmp;
 
         skb->dev = local->mdev;
-        saved = kmalloc(sizeof(struct ieee80211_tx_status), GFP_ATOMIC);
-        if (unlikely(!saved)) {
-                if (net_ratelimit())
-                        printk(KERN_WARNING "%s: Not enough memory, "
-                               "dropping tx status", skb->dev->name);
-                /* should be dev_kfree_skb_irq, but due to this function being
-                 * named _irqsafe instead of just _irq we can't be sure that
-                 * people won't call it from non-irq contexts */
-                dev_kfree_skb_any(skb);
-                return;
-        }
-        memcpy(saved, status, sizeof(struct ieee80211_tx_status));
-        /* copy pointer to saved status into skb->cb for use by tasklet */
-        memcpy(skb->cb, &saved, sizeof(saved));
-
         skb->pkt_type = IEEE80211_TX_STATUS_MSG;
-        skb_queue_tail(status->control.flags & IEEE80211_TXCTL_REQ_TX_STATUS ?
+        skb_queue_tail(info->flags & IEEE80211_TX_CTL_REQ_TX_STATUS ?
                        &local->skb_queue : &local->skb_queue_unreliable, skb);
         tmp = skb_queue_len(&local->skb_queue) +
                 skb_queue_len(&local->skb_queue_unreliable);
         while (tmp > IEEE80211_IRQSAFE_QUEUE_LIMIT &&
                (skb = skb_dequeue(&local->skb_queue_unreliable))) {
-                memcpy(&saved, skb->cb, sizeof(saved));
-                kfree(saved);
                 dev_kfree_skb_irq(skb);
                 tmp--;
                 I802_DEBUG_INC(local->tx_status_drop);
@@ -1193,7 +1206,6 @@ static void ieee80211_tasklet_handler(unsigned long data)
         struct ieee80211_local *local = (struct ieee80211_local *) data;
         struct sk_buff *skb;
         struct ieee80211_rx_status rx_status;
-        struct ieee80211_tx_status *tx_status;
         struct ieee80211_ra_tid *ra_tid;
 
         while ((skb = skb_dequeue(&local->skb_queue)) ||
@@ -1208,12 +1220,8 @@ static void ieee80211_tasklet_handler(unsigned long data)
                         __ieee80211_rx(local_to_hw(local), skb, &rx_status);
                         break;
                 case IEEE80211_TX_STATUS_MSG:
-                        /* get pointer to saved status out of skb->cb */
-                        memcpy(&tx_status, skb->cb, sizeof(tx_status));
                         skb->pkt_type = 0;
-                        ieee80211_tx_status(local_to_hw(local),
-                                            skb, tx_status);
-                        kfree(tx_status);
+                        ieee80211_tx_status(local_to_hw(local), skb);
                         break;
                 case IEEE80211_DELBA_MSG:
                         ra_tid = (struct ieee80211_ra_tid *) &skb->cb;
@@ -1242,24 +1250,15 @@ static void ieee80211_tasklet_handler(unsigned long data)
  * Also, tx_packet_data in cb is restored from tx_control. */
 static void ieee80211_remove_tx_extra(struct ieee80211_local *local,
                                       struct ieee80211_key *key,
-                                      struct sk_buff *skb,
-                                      struct ieee80211_tx_control *control)
+                                      struct sk_buff *skb)
 {
         int hdrlen, iv_len, mic_len;
-        struct ieee80211_tx_packet_data *pkt_data;
-
-        pkt_data = (struct ieee80211_tx_packet_data *)skb->cb;
-        pkt_data->ifindex = vif_to_sdata(control->vif)->dev->ifindex;
-        pkt_data->flags = 0;
-        if (control->flags & IEEE80211_TXCTL_REQ_TX_STATUS)
-                pkt_data->flags |= IEEE80211_TXPD_REQ_TX_STATUS;
-        if (control->flags & IEEE80211_TXCTL_DO_NOT_ENCRYPT)
-                pkt_data->flags |= IEEE80211_TXPD_DO_NOT_ENCRYPT;
-        if (control->flags & IEEE80211_TXCTL_REQUEUE)
-                pkt_data->flags |= IEEE80211_TXPD_REQUEUE;
-        if (control->flags & IEEE80211_TXCTL_EAPOL_FRAME)
-                pkt_data->flags |= IEEE80211_TXPD_EAPOL_FRAME;
-        pkt_data->queue = control->queue;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+
+        info->flags &=  IEEE80211_TX_CTL_REQ_TX_STATUS |
+                        IEEE80211_TX_CTL_DO_NOT_ENCRYPT |
+                        IEEE80211_TX_CTL_REQUEUE |
+                        IEEE80211_TX_CTL_EAPOL_FRAME;
 
         hdrlen = ieee80211_get_hdrlen_from_skb(skb);
 
@@ -1306,9 +1305,10 @@ no_key:
 
 static void ieee80211_handle_filtered_frame(struct ieee80211_local *local,
                                             struct sta_info *sta,
-                                            struct sk_buff *skb,
-                                            struct ieee80211_tx_status *status)
+                                            struct sk_buff *skb)
 {
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+
         sta->tx_filtered_count++;
 
         /*
@@ -1350,18 +1350,16 @@ static void ieee80211_handle_filtered_frame(struct ieee80211_local *local,
          */
         if (test_sta_flags(sta, WLAN_STA_PS) &&
             skb_queue_len(&sta->tx_filtered) < STA_MAX_TX_BUFFER) {
-                ieee80211_remove_tx_extra(local, sta->key, skb,
-                                          &status->control);
+                ieee80211_remove_tx_extra(local, sta->key, skb);
                 skb_queue_tail(&sta->tx_filtered, skb);
                 return;
         }
 
         if (!test_sta_flags(sta, WLAN_STA_PS) &&
-            !(status->control.flags & IEEE80211_TXCTL_REQUEUE)) {
+            !(info->flags & IEEE80211_TX_CTL_REQUEUE)) {
                 /* Software retry the packet once */
-                status->control.flags |= IEEE80211_TXCTL_REQUEUE;
-                ieee80211_remove_tx_extra(local, sta->key, skb,
-                                          &status->control);
+                info->flags |= IEEE80211_TX_CTL_REQUEUE;
+                ieee80211_remove_tx_extra(local, sta->key, skb);
                 dev_queue_xmit(skb);
                 return;
         }
@@ -1375,28 +1373,20 @@ static void ieee80211_handle_filtered_frame(struct ieee80211_local *local,
         dev_kfree_skb(skb);
 }
 
-void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb,
-                         struct ieee80211_tx_status *status)
+void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
 {
         struct sk_buff *skb2;
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
         struct ieee80211_local *local = hw_to_local(hw);
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         u16 frag, type;
         struct ieee80211_tx_status_rtap_hdr *rthdr;
         struct ieee80211_sub_if_data *sdata;
         struct net_device *prev_dev = NULL;
 
-        if (!status) {
-                printk(KERN_ERR
-                       "%s: ieee80211_tx_status called with NULL status\n",
-                       wiphy_name(local->hw.wiphy));
-                dev_kfree_skb(skb);
-                return;
-        }
-
         rcu_read_lock();
 
-        if (status->excessive_retries) {
+        if (info->status.excessive_retries) {
                 struct sta_info *sta;
                 sta = sta_info_get(local, hdr->addr1);
                 if (sta) {
@@ -1405,27 +1395,23 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb,
                                  * The STA is in power save mode, so assume
                                  * that this TX packet failed because of that.
                                  */
-                                status->excessive_retries = 0;
-                                status->flags |= IEEE80211_TX_STATUS_TX_FILTERED;
-                                ieee80211_handle_filtered_frame(local, sta,
-                                                                skb, status);
+                                ieee80211_handle_filtered_frame(local, sta, skb);
                                 rcu_read_unlock();
                                 return;
                         }
                 }
         }
 
-        if (status->flags & IEEE80211_TX_STATUS_TX_FILTERED) {
+        if (info->flags & IEEE80211_TX_STAT_TX_FILTERED) {
                 struct sta_info *sta;
                 sta = sta_info_get(local, hdr->addr1);
                 if (sta) {
-                        ieee80211_handle_filtered_frame(local, sta, skb,
-                                                        status);
+                        ieee80211_handle_filtered_frame(local, sta, skb);
                         rcu_read_unlock();
                         return;
                 }
         } else
-                rate_control_tx_status(local->mdev, skb, status);
+                rate_control_tx_status(local->mdev, skb);
 
         rcu_read_unlock();
 
@@ -1439,14 +1425,14 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb,
         frag = le16_to_cpu(hdr->seq_ctrl) & IEEE80211_SCTL_FRAG;
         type = le16_to_cpu(hdr->frame_control) & IEEE80211_FCTL_FTYPE;
 
-        if (status->flags & IEEE80211_TX_STATUS_ACK) {
+        if (info->flags & IEEE80211_TX_STAT_ACK) {
                 if (frag == 0) {
                         local->dot11TransmittedFrameCount++;
                         if (is_multicast_ether_addr(hdr->addr1))
                                 local->dot11MulticastTransmittedFrameCount++;
-                        if (status->retry_count > 0)
+                        if (info->status.retry_count > 0)
                                 local->dot11RetryCount++;
-                        if (status->retry_count > 1)
+                        if (info->status.retry_count > 1)
                                 local->dot11MultipleRetryCount++;
                 }
 
@@ -1492,17 +1478,17 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb,
                 cpu_to_le32((1 << IEEE80211_RADIOTAP_TX_FLAGS) |
                             (1 << IEEE80211_RADIOTAP_DATA_RETRIES));
 
-        if (!(status->flags & IEEE80211_TX_STATUS_ACK) &&
+        if (!(info->flags & IEEE80211_TX_STAT_ACK) &&
             !is_multicast_ether_addr(hdr->addr1))
                 rthdr->tx_flags |= cpu_to_le16(IEEE80211_RADIOTAP_F_TX_FAIL);
 
-        if ((status->control.flags & IEEE80211_TXCTL_USE_RTS_CTS) &&
-            (status->control.flags & IEEE80211_TXCTL_USE_CTS_PROTECT))
+        if ((info->flags & IEEE80211_TX_CTL_USE_RTS_CTS) &&
+            (info->flags & IEEE80211_TX_CTL_USE_CTS_PROTECT))
                 rthdr->tx_flags |= cpu_to_le16(IEEE80211_RADIOTAP_F_TX_CTS);
-        else if (status->control.flags & IEEE80211_TXCTL_USE_RTS_CTS)
+        else if (info->flags & IEEE80211_TX_CTL_USE_RTS_CTS)
                 rthdr->tx_flags |= cpu_to_le16(IEEE80211_RADIOTAP_F_TX_RTS);
 
-        rthdr->data_retries = status->retry_count;
+        rthdr->data_retries = info->status.retry_count;
 
         /* XXX: is this sufficient for BPF? */
         skb_set_mac_header(skb, 0);
@@ -1652,12 +1638,32 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
         if (result < 0)
                 return result;
 
+        /*
+         * We use the number of queues for feature tests (QoS, HT) internally
+         * so restrict them appropriately.
+         */
+#ifdef CONFIG_MAC80211_QOS
+        if (hw->queues > IEEE80211_MAX_QUEUES)
+                hw->queues = IEEE80211_MAX_QUEUES;
+        if (hw->ampdu_queues > IEEE80211_MAX_AMPDU_QUEUES)
+                hw->ampdu_queues = IEEE80211_MAX_AMPDU_QUEUES;
+        if (hw->queues < 4)
+                hw->ampdu_queues = 0;
+#else
+        hw->queues = 1;
+        hw->ampdu_queues = 0;
+#endif
+
         /* for now, mdev needs sub_if_data :/ */
-        mdev = alloc_netdev(sizeof(struct ieee80211_sub_if_data),
-                            "wmaster%d", ether_setup);
+        mdev = alloc_netdev_mq(sizeof(struct ieee80211_sub_if_data),
+                               "wmaster%d", ether_setup,
+                               ieee80211_num_queues(hw));
         if (!mdev)
                 goto fail_mdev_alloc;
 
+        if (ieee80211_num_queues(hw) > 1)
+                mdev->features |= NETIF_F_MULTI_QUEUE;
+
         sdata = IEEE80211_DEV_TO_SUB_IF(mdev);
         mdev->ieee80211_ptr = &sdata->wdev;
         sdata->wdev.wiphy = local->hw.wiphy;
@@ -1746,11 +1752,6 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
                 goto fail_wep;
         }
 
-        if (hw->queues > IEEE80211_MAX_QUEUES)
-                hw->queues = IEEE80211_MAX_QUEUES;
-        if (hw->ampdu_queues > IEEE80211_MAX_AMPDU_QUEUES)
-                hw->ampdu_queues = IEEE80211_MAX_AMPDU_QUEUES;
-
         ieee80211_install_qdisc(local->mdev);
 
         /* add one default STA interface */
@@ -1863,7 +1864,9 @@ static int __init ieee80211_init(void)
         struct sk_buff *skb;
         int ret;
 
-        BUILD_BUG_ON(sizeof(struct ieee80211_tx_packet_data) > sizeof(skb->cb));
+        BUILD_BUG_ON(sizeof(struct ieee80211_tx_info) > sizeof(skb->cb));
+        BUILD_BUG_ON(offsetof(struct ieee80211_tx_info, driver_data) +
+                     IEEE80211_TX_INFO_DRIVER_DATA_SIZE > sizeof(skb->cb));
 
         ret = rc80211_pid_init();
         if (ret)
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index 697ef67f96b6..b5933b271491 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -315,6 +315,13 @@ struct mesh_table *mesh_table_alloc(int size_order)
         return newtbl;
 }
 
+static void __mesh_table_free(struct mesh_table *tbl)
+{
+        kfree(tbl->hash_buckets);
+        kfree(tbl->hashwlock);
+        kfree(tbl);
+}
+
 void mesh_table_free(struct mesh_table *tbl, bool free_leafs)
 {
         struct hlist_head *mesh_hash;
@@ -330,9 +337,7 @@ void mesh_table_free(struct mesh_table *tbl, bool free_leafs)
                 }
                 spin_unlock(&tbl->hashwlock[i]);
         }
-        kfree(tbl->hash_buckets);
-        kfree(tbl->hashwlock);
-        kfree(tbl);
+        __mesh_table_free(tbl);
 }
 
 static void ieee80211_mesh_path_timer(unsigned long data)
@@ -349,21 +354,16 @@ struct mesh_table *mesh_table_grow(struct mesh_table *tbl)
 {
         struct mesh_table *newtbl;
         struct hlist_head *oldhash;
-        struct hlist_node *p;
-        int err = 0;
+        struct hlist_node *p, *q;
         int i;
 
         if (atomic_read(&tbl->entries)
-                        < tbl->mean_chain_len * (tbl->hash_mask + 1)) {
-                err = -EPERM;
+                        < tbl->mean_chain_len * (tbl->hash_mask + 1))
                 goto endgrow;
-        }
 
         newtbl = mesh_table_alloc(tbl->size_order + 1);
-        if (!newtbl) {
-                err = -ENOMEM;
+        if (!newtbl)
                 goto endgrow;
-        }
 
         newtbl->free_node = tbl->free_node;
         newtbl->mean_chain_len = tbl->mean_chain_len;
@@ -373,13 +373,19 @@ struct mesh_table *mesh_table_grow(struct mesh_table *tbl)
         oldhash = tbl->hash_buckets;
         for (i = 0; i <= tbl->hash_mask; i++)
                 hlist_for_each(p, &oldhash[i])
-                        tbl->copy_node(p, newtbl);
+                        if (tbl->copy_node(p, newtbl) < 0)
+                                goto errcopy;
 
+        return newtbl;
+
+errcopy:
+        for (i = 0; i <= newtbl->hash_mask; i++) {
+                hlist_for_each_safe(p, q, &newtbl->hash_buckets[i])
+                        tbl->free_node(p, 0);
+        }
+        __mesh_table_free(tbl);
 endgrow:
-        if (err)
-                return NULL;
-        else
-                return newtbl;
+        return NULL;
 }
 
 /**
diff --git a/net/mac80211/mesh.h b/net/mac80211/mesh.h
index 2e161f6d8288..669eafafe497 100644
--- a/net/mac80211/mesh.h
+++ b/net/mac80211/mesh.h
@@ -109,7 +109,7 @@ struct mesh_table {
         __u32 hash_rnd;                 /* Used for hash generation */
         atomic_t entries;               /* Up to MAX_MESH_NEIGHBOURS */
         void (*free_node) (struct hlist_node *p, bool free_leafs);
-        void (*copy_node) (struct hlist_node *p, struct mesh_table *newtbl);
+        int (*copy_node) (struct hlist_node *p, struct mesh_table *newtbl);
         int size_order;
         int mean_chain_len;
 };
diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c
index 99c2d360888e..947b13b40726 100644
--- a/net/mac80211/mesh_pathtbl.c
+++ b/net/mac80211/mesh_pathtbl.c
@@ -158,19 +158,14 @@ int mesh_path_add(u8 *dst, struct net_device *dev)
         if (atomic_add_unless(&sdata->u.sta.mpaths, 1, MESH_MAX_MPATHS) == 0)
                 return -ENOSPC;
 
+        err = -ENOMEM;
         new_mpath = kzalloc(sizeof(struct mesh_path), GFP_KERNEL);
-        if (!new_mpath) {
-                atomic_dec(&sdata->u.sta.mpaths);
-                err = -ENOMEM;
-                goto endadd2;
-        }
+        if (!new_mpath)
+                goto err_path_alloc;
+
         new_node = kmalloc(sizeof(struct mpath_node), GFP_KERNEL);
-        if (!new_node) {
-                kfree(new_mpath);
-                atomic_dec(&sdata->u.sta.mpaths);
-                err = -ENOMEM;
-                goto endadd2;
-        }
+        if (!new_node)
+                goto err_node_alloc;
 
         read_lock(&pathtbl_resize_lock);
         memcpy(new_mpath->dst, dst, ETH_ALEN);
@@ -189,16 +184,11 @@ int mesh_path_add(u8 *dst, struct net_device *dev)
 
         spin_lock(&mesh_paths->hashwlock[hash_idx]);
 
+        err = -EEXIST;
         hlist_for_each_entry(node, n, bucket, list) {
                 mpath = node->mpath;
-                if (mpath->dev == dev && memcmp(dst, mpath->dst, ETH_ALEN)
-                                == 0) {
-                        err = -EEXIST;
-                        atomic_dec(&sdata->u.sta.mpaths);
-                        kfree(new_node);
-                        kfree(new_mpath);
-                        goto endadd;
-                }
+                if (mpath->dev == dev && memcmp(dst, mpath->dst, ETH_ALEN) == 0)
+                        goto err_exists;
         }
 
         hlist_add_head_rcu(&new_node->list, bucket);
@@ -206,10 +196,9 @@ int mesh_path_add(u8 *dst, struct net_device *dev)
                 mesh_paths->mean_chain_len * (mesh_paths->hash_mask + 1))
                 grow = 1;
 
-endadd:
         spin_unlock(&mesh_paths->hashwlock[hash_idx]);
         read_unlock(&pathtbl_resize_lock);
-        if (!err && grow) {
+        if (grow) {
                 struct mesh_table *oldtbl, *newtbl;
 
                 write_lock(&pathtbl_resize_lock);
@@ -217,7 +206,7 @@ endadd:
                 newtbl = mesh_table_grow(mesh_paths);
                 if (!newtbl) {
                         write_unlock(&pathtbl_resize_lock);
-                        return -ENOMEM;
+                        return 0;
                 }
                 rcu_assign_pointer(mesh_paths, newtbl);
                 write_unlock(&pathtbl_resize_lock);
@@ -225,7 +214,16 @@ endadd:
                 synchronize_rcu();
                 mesh_table_free(oldtbl, false);
         }
-endadd2:
+        return 0;
+
+err_exists:
+        spin_unlock(&mesh_paths->hashwlock[hash_idx]);
+        read_unlock(&pathtbl_resize_lock);
+        kfree(new_node);
+err_node_alloc:
+        kfree(new_mpath);
+err_path_alloc:
+        atomic_dec(&sdata->u.sta.mpaths);
         return err;
 }
 
@@ -460,25 +458,28 @@ static void mesh_path_node_free(struct hlist_node *p, bool free_leafs)
         struct mpath_node *node = hlist_entry(p, struct mpath_node, list);
         mpath = node->mpath;
         hlist_del_rcu(p);
-        synchronize_rcu();
         if (free_leafs)
                 kfree(mpath);
         kfree(node);
 }
 
-static void mesh_path_node_copy(struct hlist_node *p, struct mesh_table *newtbl)
+static int mesh_path_node_copy(struct hlist_node *p, struct mesh_table *newtbl)
 {
         struct mesh_path *mpath;
         struct mpath_node *node, *new_node;
         u32 hash_idx;
 
+        new_node = kmalloc(sizeof(struct mpath_node), GFP_ATOMIC);
+        if (new_node == NULL)
+                return -ENOMEM;
+
         node = hlist_entry(p, struct mpath_node, list);
         mpath = node->mpath;
-        new_node = kmalloc(sizeof(struct mpath_node), GFP_KERNEL);
         new_node->mpath = mpath;
         hash_idx = mesh_table_hash(mpath->dst, mpath->dev, newtbl);
         hlist_add_head(&new_node->list,
                         &newtbl->hash_buckets[hash_idx]);
+        return 0;
 }
 
 int mesh_pathtbl_init(void)
diff --git a/net/mac80211/michael.c b/net/mac80211/michael.c
index 0f844f7895f1..1fcdf38cf60c 100644
--- a/net/mac80211/michael.c
+++ b/net/mac80211/michael.c
@@ -6,85 +6,58 @@
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  */
-
 #include <linux/types.h>
+#include <linux/bitops.h>
+#include <asm/unaligned.h>
 
 #include "michael.h"
 
-static inline u32 rotr(u32 val, int bits)
-{
-        return (val >> bits) | (val << (32 - bits));
-}
-
-
-static inline u32 rotl(u32 val, int bits)
-{
-        return (val << bits) | (val >> (32 - bits));
-}
-
-
-static inline u32 xswap(u32 val)
-{
-        return ((val & 0xff00ff00) >> 8) | ((val & 0x00ff00ff) << 8);
-}
-
-
-#define michael_block(l, r) \
-do { \
-        r ^= rotl(l, 17); \
-        l += r; \
-        r ^= xswap(l); \
-        l += r; \
-        r ^= rotl(l, 3); \
-        l += r; \
-        r ^= rotr(l, 2); \
-        l += r; \
-} while (0)
-
-
-static inline u32 michael_get32(u8 *data)
+static void michael_block(struct michael_mic_ctx *mctx, u32 val)
 {
-        return data[0] | (data[1] << 8) | (data[2] << 16) | (data[3] << 24);
+        mctx->l ^= val;
+        mctx->r ^= rol32(mctx->l, 17);
+        mctx->l += mctx->r;
+        mctx->r ^= ((mctx->l & 0xff00ff00) >> 8) |
+                   ((mctx->l & 0x00ff00ff) << 8);
+        mctx->l += mctx->r;
+        mctx->r ^= rol32(mctx->l, 3);
+        mctx->l += mctx->r;
+        mctx->r ^= ror32(mctx->l, 2);
+        mctx->l += mctx->r;
 }
 
-
-static inline void michael_put32(u32 val, u8 *data)
+static void michael_mic_hdr(struct michael_mic_ctx *mctx,
+                        const u8 *key, const u8 *da, const u8 *sa, u8 priority)
 {
-        data[0] = val & 0xff;
-        data[1] = (val >> 8) & 0xff;
-        data[2] = (val >> 16) & 0xff;
-        data[3] = (val >> 24) & 0xff;
+        mctx->l = get_unaligned_le32(key);
+        mctx->r = get_unaligned_le32(key + 4);
+
+        /*
+         * A pseudo header (DA, SA, Priority, 0, 0, 0) is used in Michael MIC
+         * calculation, but it is _not_ transmitted
+         */
+        michael_block(mctx, get_unaligned_le32(da));
+        michael_block(mctx, get_unaligned_le16(&da[4]) |
+                            (get_unaligned_le16(sa) << 16));
+        michael_block(mctx, get_unaligned_le32(&sa[2]));
+        michael_block(mctx, priority);
 }
 
-
-void michael_mic(u8 *key, u8 *da, u8 *sa, u8 priority,
-                 u8 *data, size_t data_len, u8 *mic)
+void michael_mic(const u8 *key, const u8 *da, const u8 *sa, u8 priority,
+                 const u8 *data, size_t data_len, u8 *mic)
 {
-        u32 l, r, val;
+        u32 val;
         size_t block, blocks, left;
+        struct michael_mic_ctx mctx;
 
-        l = michael_get32(key);
-        r = michael_get32(key + 4);
-
-        /* A pseudo header (DA, SA, Priority, 0, 0, 0) is used in Michael MIC
-         * calculation, but it is _not_ transmitted */
-        l ^= michael_get32(da);
-        michael_block(l, r);
-        l ^= da[4] | (da[5] << 8) | (sa[0] << 16) | (sa[1] << 24);
-        michael_block(l, r);
-        l ^= michael_get32(&sa[2]);
-        michael_block(l, r);
-        l ^= priority;
-        michael_block(l, r);
+        michael_mic_hdr(&mctx, key, da, sa, priority);
 
         /* Real data */
         blocks = data_len / 4;
         left = data_len % 4;
 
-        for (block = 0; block < blocks; block++) {
-                l ^= michael_get32(&data[block * 4]);
-                michael_block(l, r);
-        }
+        for (block = 0; block < blocks; block++)
+                michael_block(&mctx, get_unaligned_le32(&data[block * 4]));
 
         /* Partial block of 0..3 bytes and padding: 0x5a + 4..7 zeros to make
          * total length a multiple of 4. */
@@ -94,11 +67,10 @@ void michael_mic(u8 *key, u8 *da, u8 *sa, u8 priority,
                 left--;
                 val |= data[blocks * 4 + left];
         }
-        l ^= val;
-        michael_block(l, r);
-        /* last block is zero, so l ^ 0 = l */
-        michael_block(l, r);
 
-        michael_put32(l, mic);
-        michael_put32(r, mic + 4);
+        michael_block(&mctx, val);
+        michael_block(&mctx, 0);
+
+        put_unaligned_le32(mctx.l, mic);
+        put_unaligned_le32(mctx.r, mic + 4);
 }
diff --git a/net/mac80211/michael.h b/net/mac80211/michael.h
index 2e6aebabeea1..69b4501f13ba 100644
--- a/net/mac80211/michael.h
+++ b/net/mac80211/michael.h
@@ -14,7 +14,11 @@
 
 #define MICHAEL_MIC_LEN 8
 
-void michael_mic(u8 *key, u8 *da, u8 *sa, u8 priority,
-                 u8 *data, size_t data_len, u8 *mic);
+struct michael_mic_ctx {
+        u32 l, r;
+};
+
+void michael_mic(const u8 *key, const u8 *da, const u8 *sa, u8 priority,
+                 const u8 *data, size_t data_len, u8 *mic);
 
 #endif /* MICHAEL_H */
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 3f7f92a2f227..adbc1c804dd3 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -578,7 +578,7 @@ void ieee80211_sta_tx(struct net_device *dev, struct sk_buff *skb,
                       int encrypt)
 {
         struct ieee80211_sub_if_data *sdata;
-        struct ieee80211_tx_packet_data *pkt_data;
+        struct ieee80211_tx_info *info;
 
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         skb->dev = sdata->local->mdev;
@@ -586,11 +586,11 @@ void ieee80211_sta_tx(struct net_device *dev, struct sk_buff *skb,
         skb_set_network_header(skb, 0);
         skb_set_transport_header(skb, 0);
 
-        pkt_data = (struct ieee80211_tx_packet_data *) skb->cb;
-        memset(pkt_data, 0, sizeof(struct ieee80211_tx_packet_data));
-        pkt_data->ifindex = sdata->dev->ifindex;
+        info = IEEE80211_SKB_CB(skb);
+        memset(info, 0, sizeof(struct ieee80211_tx_info));
+        info->control.ifindex = sdata->dev->ifindex;
         if (!encrypt)
-                pkt_data->flags |= IEEE80211_TXPD_DO_NOT_ENCRYPT;
+                info->flags |= IEEE80211_TX_CTL_DO_NOT_ENCRYPT;
 
         dev_queue_xmit(skb);
 }
@@ -815,8 +815,29 @@ static void ieee80211_send_assoc(struct net_device *dev,
 
         /* wmm support is a must to HT */
         if (wmm && (ifsta->flags & IEEE80211_STA_WMM_ENABLED) &&
-            sband->ht_info.ht_supported) {
-                __le16 tmp = cpu_to_le16(sband->ht_info.cap);
+            sband->ht_info.ht_supported && bss->ht_add_ie) {
+                struct ieee80211_ht_addt_info *ht_add_info =
+                        (struct ieee80211_ht_addt_info *)bss->ht_add_ie;
+                u16 cap = sband->ht_info.cap;
+                __le16 tmp;
+                u32 flags = local->hw.conf.channel->flags;
+
+                switch (ht_add_info->ht_param & IEEE80211_HT_IE_CHA_SEC_OFFSET) {
+                case IEEE80211_HT_IE_CHA_SEC_ABOVE:
+                        if (flags & IEEE80211_CHAN_NO_FAT_ABOVE) {
+                                cap &= ~IEEE80211_HT_CAP_SUP_WIDTH;
+                                cap &= ~IEEE80211_HT_CAP_SGI_40;
+                        }
+                        break;
+                case IEEE80211_HT_IE_CHA_SEC_BELOW:
+                        if (flags & IEEE80211_CHAN_NO_FAT_BELOW) {
+                                cap &= ~IEEE80211_HT_CAP_SUP_WIDTH;
+                                cap &= ~IEEE80211_HT_CAP_SGI_40;
+                        }
+                        break;
+                }
+
+                tmp = cpu_to_le16(cap);
                 pos = skb_put(skb, sizeof(struct ieee80211_ht_cap)+2);
                 *pos++ = WLAN_EID_HT_CAPABILITY;
                 *pos++ = sizeof(struct ieee80211_ht_cap);
@@ -2271,6 +2292,7 @@ static void ieee80211_rx_bss_free(struct ieee80211_sta_bss *bss)
         kfree(bss->rsn_ie);
         kfree(bss->wmm_ie);
         kfree(bss->ht_ie);
+        kfree(bss->ht_add_ie);
         kfree(bss_mesh_id(bss));
         kfree(bss_mesh_cfg(bss));
         kfree(bss);
@@ -2321,7 +2343,7 @@ static int ieee80211_sta_join_ibss(struct net_device *dev,
         int res, rates, i, j;
         struct sk_buff *skb;
         struct ieee80211_mgmt *mgmt;
-        struct ieee80211_tx_control control;
+        struct ieee80211_tx_info *control;
         struct rate_selection ratesel;
         u8 *pos;
         struct ieee80211_sub_if_data *sdata;
@@ -2411,21 +2433,22 @@ static int ieee80211_sta_join_ibss(struct net_device *dev,
                         memcpy(pos, &bss->supp_rates[8], rates);
                 }
 
-                memset(&control, 0, sizeof(control));
+                control = IEEE80211_SKB_CB(skb);
+
                 rate_control_get_rate(dev, sband, skb, &ratesel);
-                if (!ratesel.rate) {
+                if (ratesel.rate_idx < 0) {
                         printk(KERN_DEBUG "%s: Failed to determine TX rate "
                                "for IBSS beacon\n", dev->name);
                         break;
                 }
-                control.vif = &sdata->vif;
-                control.tx_rate = ratesel.rate;
+                control->control.vif = &sdata->vif;
+                control->tx_rate_idx = ratesel.rate_idx;
                 if (sdata->bss_conf.use_short_preamble &&
-                    ratesel.rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
-                        control.flags |= IEEE80211_TXCTL_SHORT_PREAMBLE;
-                control.antenna_sel_tx = local->hw.conf.antenna_sel_tx;
-                control.flags |= IEEE80211_TXCTL_NO_ACK;
-                control.retry_limit = 1;
+                    sband->bitrates[ratesel.rate_idx].flags & IEEE80211_RATE_SHORT_PREAMBLE)
+                        control->flags |= IEEE80211_TX_CTL_SHORT_PREAMBLE;
+                control->antenna_sel_tx = local->hw.conf.antenna_sel_tx;
+                control->flags |= IEEE80211_TX_CTL_NO_ACK;
+                control->control.retry_limit = 1;
 
                 ifsta->probe_resp = skb_copy(skb, GFP_ATOMIC);
                 if (ifsta->probe_resp) {
@@ -2440,8 +2463,7 @@ static int ieee80211_sta_join_ibss(struct net_device *dev,
                 }
 
                 if (local->ops->beacon_update &&
-                    local->ops->beacon_update(local_to_hw(local),
-                                             skb, &control) == 0) {
+                    local->ops->beacon_update(local_to_hw(local), skb) == 0) {
                         printk(KERN_DEBUG "%s: Configured IBSS beacon "
                                "template\n", dev->name);
                         skb = NULL;
@@ -2647,6 +2669,26 @@ static void ieee80211_rx_bss_info(struct net_device *dev,
                 bss->ht_ie_len = 0;
         }
 
+        if (elems.ht_info_elem &&
+             (!bss->ht_add_ie ||
+             bss->ht_add_ie_len != elems.ht_info_elem_len ||
+             memcmp(bss->ht_add_ie, elems.ht_info_elem,
+                        elems.ht_info_elem_len))) {
+                kfree(bss->ht_add_ie);
+                bss->ht_add_ie =
+                        kmalloc(elems.ht_info_elem_len + 2, GFP_ATOMIC);
+                if (bss->ht_add_ie) {
+                        memcpy(bss->ht_add_ie, elems.ht_info_elem - 2,
+                                elems.ht_info_elem_len + 2);
+                        bss->ht_add_ie_len = elems.ht_info_elem_len + 2;
+                } else
+                        bss->ht_add_ie_len = 0;
+        } else if (!elems.ht_info_elem && bss->ht_add_ie) {
+                kfree(bss->ht_add_ie);
+                bss->ht_add_ie = NULL;
+                bss->ht_add_ie_len = 0;
+        }
+
         bss->beacon_int = le16_to_cpu(mgmt->u.beacon.beacon_int);
         bss->capability = le16_to_cpu(mgmt->u.beacon.capab_info);
 
@@ -4131,6 +4173,14 @@ ieee80211_sta_scan_result(struct net_device *dev,
                                                   bss->rsn_ie);
         }
 
+        if (bss && bss->ht_ie) {
+                memset(&iwe, 0, sizeof(iwe));
+                iwe.cmd = IWEVGENIE;
+                iwe.u.data.length = bss->ht_ie_len;
+                current_ev = iwe_stream_add_point(current_ev, end_buf, &iwe,
+                                                  bss->ht_ie);
+        }
+
         if (bss && bss->supp_rates_len > 0) {
                 /* display all supported rates in readable format */
                 char *p = current_ev + IW_EV_LCP_LEN;
diff --git a/net/mac80211/rate.c b/net/mac80211/rate.c
index 841df93807fc..0388c090dfe9 100644
--- a/net/mac80211/rate.c
+++ b/net/mac80211/rate.c
@@ -176,20 +176,24 @@ void rate_control_get_rate(struct net_device *dev,
         rcu_read_lock();
         sta = sta_info_get(local, hdr->addr1);
 
-        memset(sel, 0, sizeof(struct rate_selection));
+        sel->rate_idx = -1;
+        sel->nonerp_idx = -1;
+        sel->probe_idx = -1;
 
         ref->ops->get_rate(ref->priv, dev, sband, skb, sel);
 
+        BUG_ON(sel->rate_idx < 0);
+
         /* Select a non-ERP backup rate. */
-        if (!sel->nonerp) {
+        if (sel->nonerp_idx < 0) {
                 for (i = 0; i < sband->n_bitrates; i++) {
                         struct ieee80211_rate *rate = &sband->bitrates[i];
-                        if (sel->rate->bitrate < rate->bitrate)
+                        if (sband->bitrates[sel->rate_idx].bitrate < rate->bitrate)
                                 break;
 
                         if (rate_supported(sta, sband->band, i) &&
                             !(rate->flags & IEEE80211_RATE_ERP_G))
-                                sel->nonerp = rate;
+                                sel->nonerp_idx = i;
                 }
         }
 
diff --git a/net/mac80211/rate.h b/net/mac80211/rate.h
index 5b45f33cb766..0ed9c8a2f56f 100644
--- a/net/mac80211/rate.h
+++ b/net/mac80211/rate.h
@@ -19,22 +19,22 @@
 #include "ieee80211_i.h"
 #include "sta_info.h"
 
-/* TODO: kdoc */
+/**
+ * struct rate_selection - rate selection for rate control algos
+ * @rate: selected transmission rate index
+ * @nonerp: Non-ERP rate to use instead if ERP cannot be used
+ * @probe: rate for probing (or -1)
+ *
+ */
 struct rate_selection {
-        /* Selected transmission rate */
-        struct ieee80211_rate *rate;
-        /* Non-ERP rate to use if mac80211 decides it cannot use an ERP rate */
-        struct ieee80211_rate *nonerp;
-        /* probe with this rate, or NULL for no probing */
-        struct ieee80211_rate *probe;
+        s8 rate_idx, nonerp_idx, probe_idx;
 };
 
 struct rate_control_ops {
         struct module *module;
         const char *name;
         void (*tx_status)(void *priv, struct net_device *dev,
-                          struct sk_buff *skb,
-                          struct ieee80211_tx_status *status);
+                          struct sk_buff *skb);
         void (*get_rate)(void *priv, struct net_device *dev,
                          struct ieee80211_supported_band *band,
                          struct sk_buff *skb,
@@ -76,13 +76,12 @@ struct rate_control_ref *rate_control_get(struct rate_control_ref *ref);
 void rate_control_put(struct rate_control_ref *ref);
 
 static inline void rate_control_tx_status(struct net_device *dev,
-                                          struct sk_buff *skb,
-                                          struct ieee80211_tx_status *status)
+                                          struct sk_buff *skb)
 {
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
         struct rate_control_ref *ref = local->rate_ctrl;
 
-        ref->ops->tx_status(ref->priv, dev, skb, status);
+        ref->ops->tx_status(ref->priv, dev, skb);
 }
 
 
@@ -138,7 +137,7 @@ static inline int rate_supported(struct sta_info *sta,
         return (sta == NULL || sta->supp_rates[band] & BIT(index));
 }
 
-static inline int
+static inline s8
 rate_lowest_index(struct ieee80211_local *local,
                   struct ieee80211_supported_band *sband,
                   struct sta_info *sta)
@@ -155,14 +154,6 @@ rate_lowest_index(struct ieee80211_local *local,
         return 0;
 }
 
-static inline struct ieee80211_rate *
-rate_lowest(struct ieee80211_local *local,
-            struct ieee80211_supported_band *sband,
-            struct sta_info *sta)
-{
-        return &sband->bitrates[rate_lowest_index(local, sband, sta)];
-}
-
 
 /* functions for rate control related to a device */
 int ieee80211_init_rate_ctrl_alg(struct ieee80211_local *local,
diff --git a/net/mac80211/rc80211_pid.h b/net/mac80211/rc80211_pid.h
index 04afc13ed825..2078803d3581 100644
--- a/net/mac80211/rc80211_pid.h
+++ b/net/mac80211/rc80211_pid.h
@@ -61,7 +61,7 @@ enum rc_pid_event_type {
 union rc_pid_event_data {
         /* RC_PID_EVENT_TX_STATUS */
         struct {
-                struct ieee80211_tx_status tx_status;
+                struct ieee80211_tx_info tx_status;
         };
         /* RC_PID_EVENT_TYPE_RATE_CHANGE */
         /* RC_PID_EVENT_TYPE_TX_RATE */
@@ -158,7 +158,7 @@ struct rc_pid_debugfs_entries {
 };
 
 void rate_control_pid_event_tx_status(struct rc_pid_event_buffer *buf,
-                                             struct ieee80211_tx_status *stat);
+                                      struct ieee80211_tx_info *stat);
 
 void rate_control_pid_event_rate_change(struct rc_pid_event_buffer *buf,
                                                int index, int rate);
diff --git a/net/mac80211/rc80211_pid_algo.c b/net/mac80211/rc80211_pid_algo.c
index a849b745bdb5..e8945413e4a2 100644
--- a/net/mac80211/rc80211_pid_algo.c
+++ b/net/mac80211/rc80211_pid_algo.c
@@ -237,8 +237,7 @@ static void rate_control_pid_sample(struct rc_pid_info *pinfo,
 }
 
 static void rate_control_pid_tx_status(void *priv, struct net_device *dev,
-                                       struct sk_buff *skb,
-                                       struct ieee80211_tx_status *status)
+                                       struct sk_buff *skb)
 {
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
@@ -248,6 +247,7 @@ static void rate_control_pid_tx_status(void *priv, struct net_device *dev,
         struct rc_pid_sta_info *spinfo;
         unsigned long period;
         struct ieee80211_supported_band *sband;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 
         rcu_read_lock();
 
@@ -266,28 +266,28 @@ static void rate_control_pid_tx_status(void *priv, struct net_device *dev,
 
         /* Ignore all frames that were sent with a different rate than the rate
          * we currently advise mac80211 to use. */
-        if (status->control.tx_rate != &sband->bitrates[sta->txrate_idx])
+        if (info->tx_rate_idx != sta->txrate_idx)
                 goto unlock;
 
         spinfo = sta->rate_ctrl_priv;
         spinfo->tx_num_xmit++;
 
 #ifdef CONFIG_MAC80211_DEBUGFS
-        rate_control_pid_event_tx_status(&spinfo->events, status);
+        rate_control_pid_event_tx_status(&spinfo->events, info);
 #endif
 
         /* We count frames that totally failed to be transmitted as two bad
          * frames, those that made it out but had some retries as one good and
          * one bad frame. */
-        if (status->excessive_retries) {
+        if (info->status.excessive_retries) {
                 spinfo->tx_num_failed += 2;
                 spinfo->tx_num_xmit++;
-        } else if (status->retry_count) {
+        } else if (info->status.retry_count) {
                 spinfo->tx_num_failed++;
                 spinfo->tx_num_xmit++;
         }
 
-        if (status->excessive_retries) {
+        if (info->status.excessive_retries) {
                 sta->tx_retry_failed++;
                 sta->tx_num_consecutive_failures++;
                 sta->tx_num_mpdu_fail++;
@@ -295,8 +295,8 @@ static void rate_control_pid_tx_status(void *priv, struct net_device *dev,
                 sta->tx_num_consecutive_failures = 0;
                 sta->tx_num_mpdu_ok++;
         }
-        sta->tx_retry_count += status->retry_count;
-        sta->tx_num_mpdu_fail += status->retry_count;
+        sta->tx_retry_count += info->status.retry_count;
+        sta->tx_num_mpdu_fail += info->status.retry_count;
 
         /* Update PID controller state. */
         period = (HZ * pinfo->sampling_period + 500) / 1000;
@@ -330,7 +330,7 @@ static void rate_control_pid_get_rate(void *priv, struct net_device *dev,
         fc = le16_to_cpu(hdr->frame_control);
         if ((fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA ||
             is_multicast_ether_addr(hdr->addr1) || !sta) {
-                sel->rate = rate_lowest(local, sband, sta);
+                sel->rate_idx = rate_lowest_index(local, sband, sta);
                 rcu_read_unlock();
                 return;
         }
@@ -349,7 +349,7 @@ static void rate_control_pid_get_rate(void *priv, struct net_device *dev,
 
         rcu_read_unlock();
 
-        sel->rate = &sband->bitrates[rateidx];
+        sel->rate_idx = rateidx;
 
 #ifdef CONFIG_MAC80211_DEBUGFS
         rate_control_pid_event_tx_rate(
diff --git a/net/mac80211/rc80211_pid_debugfs.c b/net/mac80211/rc80211_pid_debugfs.c
index ff5c380f3c13..8121d3bc6835 100644
--- a/net/mac80211/rc80211_pid_debugfs.c
+++ b/net/mac80211/rc80211_pid_debugfs.c
@@ -39,11 +39,11 @@ static void rate_control_pid_event(struct rc_pid_event_buffer *buf,
 }
 
 void rate_control_pid_event_tx_status(struct rc_pid_event_buffer *buf,
-                                             struct ieee80211_tx_status *stat)
+                                      struct ieee80211_tx_info *stat)
 {
         union rc_pid_event_data evd;
 
-        memcpy(&evd.tx_status, stat, sizeof(struct ieee80211_tx_status));
+        memcpy(&evd.tx_status, stat, sizeof(struct ieee80211_tx_info));
         rate_control_pid_event(buf, RC_PID_EVENT_TYPE_TX_STATUS, &evd);
 }
 
@@ -167,8 +167,8 @@ static ssize_t rate_control_pid_events_read(struct file *file, char __user *buf,
         switch (ev->type) {
         case RC_PID_EVENT_TYPE_TX_STATUS:
                 p += snprintf(pb + p, length - p, "tx_status %u %u",
-                              ev->data.tx_status.excessive_retries,
-                              ev->data.tx_status.retry_count);
+                              ev->data.tx_status.status.excessive_retries,
+                              ev->data.tx_status.status.retry_count);
                 break;
         case RC_PID_EVENT_TYPE_RATE_CHANGE:
                 p += snprintf(pb + p, length - p, "rate_change %d %d",
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index fa68305fd59e..9400a9766a77 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -387,51 +387,9 @@ static void ieee80211_verify_ip_alignment(struct ieee80211_rx_data *rx)
 }
 
 
-static u32 ieee80211_rx_load_stats(struct ieee80211_local *local,
-                                   struct sk_buff *skb,
-                                   struct ieee80211_rx_status *status,
-                                   struct ieee80211_rate *rate)
-{
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
-        u32 load = 0, hdrtime;
-
-        /* Estimate total channel use caused by this frame */
-
-        /* 1 bit at 1 Mbit/s takes 1 usec; in channel_use values,
-         * 1 usec = 1/8 * (1080 / 10) = 13.5 */
-
-        if (status->band == IEEE80211_BAND_5GHZ ||
-            (status->band == IEEE80211_BAND_5GHZ &&
-             rate->flags & IEEE80211_RATE_ERP_G))
-                hdrtime = CHAN_UTIL_HDR_SHORT;
-        else
-                hdrtime = CHAN_UTIL_HDR_LONG;
-
-        load = hdrtime;
-        if (!is_multicast_ether_addr(hdr->addr1))
-                load += hdrtime;
-
-        /* TODO: optimise again */
-        load += skb->len * CHAN_UTIL_RATE_LCM / rate->bitrate;
-
-        /* Divide channel_use by 8 to avoid wrapping around the counter */
-        load >>= CHAN_UTIL_SHIFT;
-
-        return load;
-}
-
 /* rx handlers */
 
 static ieee80211_rx_result
-ieee80211_rx_h_if_stats(struct ieee80211_rx_data *rx)
-{
-        if (rx->sta)
-                rx->sta->channel_use_raw += rx->load;
-        rx->sdata->channel_use_raw += rx->load;
-        return RX_CONTINUE;
-}
-
-static ieee80211_rx_result
 ieee80211_rx_h_passive_scan(struct ieee80211_rx_data *rx)
 {
         struct ieee80211_local *local = rx->local;
@@ -714,7 +672,7 @@ static int ap_sta_ps_end(struct net_device *dev, struct sta_info *sta)
         struct sk_buff *skb;
         int sent = 0;
         struct ieee80211_sub_if_data *sdata;
-        struct ieee80211_tx_packet_data *pkt_data;
+        struct ieee80211_tx_info *info;
         DECLARE_MAC_BUF(mac);
 
         sdata = sta->sdata;
@@ -734,13 +692,13 @@ static int ap_sta_ps_end(struct net_device *dev, struct sta_info *sta)
 
         /* Send all buffered frames to the station */
         while ((skb = skb_dequeue(&sta->tx_filtered)) != NULL) {
-                pkt_data = (struct ieee80211_tx_packet_data *) skb->cb;
+                info = IEEE80211_SKB_CB(skb);
                 sent++;
-                pkt_data->flags |= IEEE80211_TXPD_REQUEUE;
+                info->flags |= IEEE80211_TX_CTL_REQUEUE;
                 dev_queue_xmit(skb);
         }
         while ((skb = skb_dequeue(&sta->ps_tx_buf)) != NULL) {
-                pkt_data = (struct ieee80211_tx_packet_data *) skb->cb;
+                info = IEEE80211_SKB_CB(skb);
                 local->total_ps_buffered--;
                 sent++;
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
@@ -748,7 +706,7 @@ static int ap_sta_ps_end(struct net_device *dev, struct sta_info *sta)
                        "since STA not sleeping anymore\n", dev->name,
                        print_mac(mac, sta->addr), sta->aid);
 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
-                pkt_data->flags |= IEEE80211_TXPD_REQUEUE;
+                info->flags |= IEEE80211_TX_CTL_REQUEUE;
                 dev_queue_xmit(skb);
         }
 
@@ -1780,7 +1738,6 @@ static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx)
 typedef ieee80211_rx_result (*ieee80211_rx_handler)(struct ieee80211_rx_data *);
 static ieee80211_rx_handler ieee80211_rx_handlers[] =
 {
-        ieee80211_rx_h_if_stats,
         ieee80211_rx_h_passive_scan,
         ieee80211_rx_h_check,
         ieee80211_rx_h_decrypt,
@@ -1939,7 +1896,6 @@ static int prepare_for_handlers(struct ieee80211_sub_if_data *sdata,
 static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
                                          struct sk_buff *skb,
                                          struct ieee80211_rx_status *status,
-                                         u32 load,
                                          struct ieee80211_rate *rate)
 {
         struct ieee80211_local *local = hw_to_local(hw);
@@ -1958,7 +1914,6 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
         rx.local = local;
 
         rx.status = status;
-        rx.load = load;
         rx.rate = rate;
         rx.fc = le16_to_cpu(hdr->frame_control);
         type = rx.fc & IEEE80211_FCTL_FTYPE;
@@ -2067,7 +2022,6 @@ u8 ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
         struct ieee80211_rx_status status;
         u16 head_seq_num, buf_size;
         int index;
-        u32 pkt_load;
         struct ieee80211_supported_band *sband;
         struct ieee80211_rate *rate;
 
@@ -2102,12 +2056,9 @@ u8 ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
                                         sizeof(status));
                                 sband = local->hw.wiphy->bands[status.band];
                                 rate = &sband->bitrates[status.rate_idx];
-                                pkt_load = ieee80211_rx_load_stats(local,
-                                                tid_agg_rx->reorder_buf[index],
-                                                &status, rate);
                                 __ieee80211_rx_handle_packet(hw,
                                         tid_agg_rx->reorder_buf[index],
-                                        &status, pkt_load, rate);
+                                        &status, rate);
                                 tid_agg_rx->stored_mpdu_num--;
                                 tid_agg_rx->reorder_buf[index] = NULL;
                         }
@@ -2149,11 +2100,8 @@ u8 ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
                         sizeof(status));
                 sband = local->hw.wiphy->bands[status.band];
                 rate = &sband->bitrates[status.rate_idx];
-                pkt_load = ieee80211_rx_load_stats(local,
-                                        tid_agg_rx->reorder_buf[index],
-                                        &status, rate);
                 __ieee80211_rx_handle_packet(hw, tid_agg_rx->reorder_buf[index],
-                                             &status, pkt_load, rate);
+                                             &status, rate);
                 tid_agg_rx->stored_mpdu_num--;
                 tid_agg_rx->reorder_buf[index] = NULL;
                 tid_agg_rx->head_seq_num = seq_inc(tid_agg_rx->head_seq_num);
@@ -2232,7 +2180,6 @@ void __ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb,
                     struct ieee80211_rx_status *status)
 {
         struct ieee80211_local *local = hw_to_local(hw);
-        u32 pkt_load;
         struct ieee80211_rate *rate = NULL;
         struct ieee80211_supported_band *sband;
 
@@ -2272,11 +2219,8 @@ void __ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb,
                 return;
         }
 
-        pkt_load = ieee80211_rx_load_stats(local, skb, status, rate);
-        local->channel_use_raw += pkt_load;
-
         if (!ieee80211_rx_reorder_ampdu(local, skb))
-                __ieee80211_rx_handle_packet(hw, skb, status, pkt_load, rate);
+                __ieee80211_rx_handle_packet(hw, skb, status, rate);
 
         rcu_read_unlock();
 }
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index baf5e4746884..c24770cb02c5 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -255,7 +255,7 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
                  * sta_rx_agg_session_timer_expired for useage */
                 sta->timer_to_tid[i] = i;
                 /* tid to tx queue: initialize according to HW (0 is valid) */
-                sta->tid_to_tx_q[i] = local->hw.queues + local->hw.ampdu_queues;
+                sta->tid_to_tx_q[i] = ieee80211_num_queues(&local->hw);
                 /* rx */
                 sta->ampdu_mlme.tid_state_rx[i] = HT_AGG_STATE_IDLE;
                 sta->ampdu_mlme.tid_rx[i] = NULL;
@@ -511,20 +511,20 @@ static inline int sta_info_buffer_expired(struct ieee80211_local *local,
                                           struct sta_info *sta,
                                           struct sk_buff *skb)
 {
-        struct ieee80211_tx_packet_data *pkt_data;
+        struct ieee80211_tx_info *info;
         int timeout;
 
         if (!skb)
                 return 0;
 
-        pkt_data = (struct ieee80211_tx_packet_data *) skb->cb;
+        info = IEEE80211_SKB_CB(skb);
 
         /* Timeout: (2 * listen_interval * beacon_int * 1024 / 1000000) sec */
         timeout = (sta->listen_interval * local->hw.conf.beacon_int * 32 /
                    15625) * HZ;
         if (timeout < STA_TX_BUFFER_EXPIRE)
                 timeout = STA_TX_BUFFER_EXPIRE;
-        return time_after(jiffies, pkt_data->jiffies + timeout);
+        return time_after(jiffies, info->control.jiffies + timeout);
 }
 
 
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index e89cc1655547..95753f860acf 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -32,7 +32,7 @@
  * @WLAN_STA_WDS: Station is one of our WDS peers.
  * @WLAN_STA_PSPOLL: Station has just PS-polled us.
  * @WLAN_STA_CLEAR_PS_FILT: Clear PS filter in hardware (using the
- *      IEEE80211_TXCTL_CLEAR_PS_FILT control flag) when the next
+ *      IEEE80211_TX_CTL_CLEAR_PS_FILT control flag) when the next
  *      frame to this station is transmitted.
  */
 enum ieee80211_sta_info_flags {
@@ -245,10 +245,6 @@ struct sta_info {
         unsigned int wme_tx_queue[NUM_RX_DATA_QUEUES];
 #endif
 
-        /* Debug counters, no locking doesn't matter */
-        int channel_use;
-        int channel_use_raw;
-
         /*
          * Aggregation information, locked with lock.
          */
diff --git a/net/mac80211/tkip.c b/net/mac80211/tkip.c
index a7c3febc5a45..a00cf1ea7719 100644
--- a/net/mac80211/tkip.c
+++ b/net/mac80211/tkip.c
@@ -6,7 +6,6 @@
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  */
-
 #include <linux/kernel.h>
 #include <linux/bitops.h>
 #include <linux/types.h>
@@ -72,10 +71,12 @@ static u16 tkipS(u16 val)
  * TSC = TKIP sequence counter (48 bits, only 32 msb bits used)
  * P1K: 80 bits
  */
-static void tkip_mixing_phase1(const u8 *ta, const u8 *tk, u32 tsc_IV32,
-                               u16 *p1k)
+static void tkip_mixing_phase1(struct ieee80211_key *key, const u8 *ta,
+                               struct tkip_ctx *ctx, u32 tsc_IV32)
 {
         int i, j;
+        const u8 *tk = &key->conf.key[ALG_TKIP_TEMP_ENCR_KEY];
+        u16 *p1k = ctx->p1k;
 
         p1k[0] = tsc_IV32 & 0xFFFF;
         p1k[1] = tsc_IV32 >> 16;
@@ -91,12 +92,15 @@ static void tkip_mixing_phase1(const u8 *ta, const u8 *tk, u32 tsc_IV32,
                 p1k[3] += tkipS(p1k[2] ^ get_unaligned_le16(tk + 12 + j));
                 p1k[4] += tkipS(p1k[3] ^ get_unaligned_le16(tk + 0 + j)) + i;
         }
+        ctx->initialized = 1;
 }
 
-static void tkip_mixing_phase2(const u16 *p1k, const u8 *tk, u16 tsc_IV16,
-                               u8 *rc4key)
+static void tkip_mixing_phase2(struct ieee80211_key *key, struct tkip_ctx *ctx,
+                               u16 tsc_IV16, u8 *rc4key)
 {
         u16 ppk[6];
+        const u16 *p1k = ctx->p1k;
+        const u8 *tk = &key->conf.key[ALG_TKIP_TEMP_ENCR_KEY];
         int i;
 
         ppk[0] = p1k[0];
@@ -132,38 +136,25 @@ static void tkip_mixing_phase2(const u16 *p1k, const u8 *tk, u16 tsc_IV16,
 /* Add TKIP IV and Ext. IV at @pos. @iv0, @iv1, and @iv2 are the first octets
  * of the IV. Returns pointer to the octet following IVs (i.e., beginning of
  * the packet payload). */
-u8 * ieee80211_tkip_add_iv(u8 *pos, struct ieee80211_key *key,
+u8 *ieee80211_tkip_add_iv(u8 *pos, struct ieee80211_key *key,
                            u8 iv0, u8 iv1, u8 iv2)
 {
         *pos++ = iv0;
         *pos++ = iv1;
         *pos++ = iv2;
         *pos++ = (key->conf.keyidx << 6) | (1 << 5) /* Ext IV */;
-        put_unaligned_le32(key->u.tkip.iv32, pos);
+        put_unaligned_le32(key->u.tkip.tx.iv32, pos);
         return pos + 4;
 }
 
-void ieee80211_tkip_gen_phase1key(struct ieee80211_key *key, u8 *ta,
-                                  u16 *phase1key)
-{
-        tkip_mixing_phase1(ta, &key->conf.key[ALG_TKIP_TEMP_ENCR_KEY],
-                           key->u.tkip.iv32, phase1key);
-}
-
-void ieee80211_tkip_gen_rc4key(struct ieee80211_key *key, u8 *ta,
+static void ieee80211_tkip_gen_rc4key(struct ieee80211_key *key, u8 *ta,
                                u8 *rc4key)
 {
         /* Calculate per-packet key */
-        if (key->u.tkip.iv16 == 0 || !key->u.tkip.tx_initialized) {
-                /* IV16 wrapped around - perform TKIP phase 1 */
-                tkip_mixing_phase1(ta, &key->conf.key[ALG_TKIP_TEMP_ENCR_KEY],
-                                   key->u.tkip.iv32, key->u.tkip.p1k);
-                key->u.tkip.tx_initialized = 1;
-        }
+        if (key->u.tkip.tx.iv16 == 0 || !key->u.tkip.tx.initialized)
+                tkip_mixing_phase1(key, ta, &key->u.tkip.tx, key->u.tkip.tx.iv32);
 
-        tkip_mixing_phase2(key->u.tkip.p1k,
-                           &key->conf.key[ALG_TKIP_TEMP_ENCR_KEY],
-                           key->u.tkip.iv16, rc4key);
+        tkip_mixing_phase2(key, &key->u.tkip.tx, key->u.tkip.tx.iv16, rc4key);
 }
 
 void ieee80211_get_tkip_key(struct ieee80211_key_conf *keyconf,
@@ -187,9 +178,9 @@ void ieee80211_get_tkip_key(struct ieee80211_key_conf *keyconf,
         printk(KERN_DEBUG "TKIP encrypt: iv16 = 0x%04x, iv32 = 0x%08x\n",
                         iv16, iv32);
 
-        if (iv32 != key->u.tkip.iv32) {
+        if (iv32 != key->u.tkip.tx.iv32) {
                 printk(KERN_DEBUG "skb: iv32 = 0x%08x key: iv32 = 0x%08x\n",
-                        iv32, key->u.tkip.iv32);
+                        iv32, key->u.tkip.tx.iv32);
                 printk(KERN_DEBUG "Wrap around of iv16 in the middle of a "
                         "fragmented packet\n");
         }
@@ -198,20 +189,15 @@ void ieee80211_get_tkip_key(struct ieee80211_key_conf *keyconf,
         /* Update the p1k only when the iv16 in the packet wraps around, this
          * might occur after the wrap around of iv16 in the key in case of
          * fragmented packets. */
-        if (iv16 == 0 || !key->u.tkip.tx_initialized) {
-                /* IV16 wrapped around - perform TKIP phase 1 */
-                tkip_mixing_phase1(ta, &key->conf.key[ALG_TKIP_TEMP_ENCR_KEY],
-                        iv32, key->u.tkip.p1k);
-                key->u.tkip.tx_initialized = 1;
-        }
+        if (iv16 == 0 || !key->u.tkip.tx.initialized)
+                tkip_mixing_phase1(key, ta, &key->u.tkip.tx, iv32);
 
         if (type == IEEE80211_TKIP_P1_KEY) {
-                memcpy(outkey, key->u.tkip.p1k, sizeof(u16) * 5);
+                memcpy(outkey, key->u.tkip.tx.p1k, sizeof(u16) * 5);
                 return;
         }
 
-        tkip_mixing_phase2(key->u.tkip.p1k,
-                &key->conf.key[ALG_TKIP_TEMP_ENCR_KEY], iv16, outkey);
+        tkip_mixing_phase2(key, &key->u.tkip.tx, iv16, outkey);
 }
 EXPORT_SYMBOL(ieee80211_get_tkip_key);
 
@@ -271,33 +257,31 @@ int ieee80211_tkip_decrypt_data(struct crypto_blkcipher *tfm,
         if ((keyid >> 6) != key->conf.keyidx)
                 return TKIP_DECRYPT_INVALID_KEYIDX;
 
-        if (key->u.tkip.rx_initialized[queue] &&
-            (iv32 < key->u.tkip.iv32_rx[queue] ||
-             (iv32 == key->u.tkip.iv32_rx[queue] &&
-              iv16 <= key->u.tkip.iv16_rx[queue]))) {
+        if (key->u.tkip.rx[queue].initialized &&
+            (iv32 < key->u.tkip.rx[queue].iv32 ||
+             (iv32 == key->u.tkip.rx[queue].iv32 &&
+              iv16 <= key->u.tkip.rx[queue].iv16))) {
 #ifdef CONFIG_TKIP_DEBUG
                 DECLARE_MAC_BUF(mac);
                 printk(KERN_DEBUG "TKIP replay detected for RX frame from "
                        "%s (RX IV (%04x,%02x) <= prev. IV (%04x,%02x)\n",
                        print_mac(mac, ta),
-                       iv32, iv16, key->u.tkip.iv32_rx[queue],
-                       key->u.tkip.iv16_rx[queue]);
+                       iv32, iv16, key->u.tkip.rx[queue].iv32,
+                       key->u.tkip.rx[queue].iv16);
 #endif /* CONFIG_TKIP_DEBUG */
                 return TKIP_DECRYPT_REPLAY;
         }
 
         if (only_iv) {
                 res = TKIP_DECRYPT_OK;
-                key->u.tkip.rx_initialized[queue] = 1;
+                key->u.tkip.rx[queue].initialized = 1;
                 goto done;
         }
 
-        if (!key->u.tkip.rx_initialized[queue] ||
-            key->u.tkip.iv32_rx[queue] != iv32) {
-                key->u.tkip.rx_initialized[queue] = 1;
+        if (!key->u.tkip.rx[queue].initialized ||
+            key->u.tkip.rx[queue].iv32 != iv32) {
                 /* IV16 wrapped around - perform TKIP phase 1 */
-                tkip_mixing_phase1(ta, &key->conf.key[ALG_TKIP_TEMP_ENCR_KEY],
-                                   iv32, key->u.tkip.p1k_rx[queue]);
+                tkip_mixing_phase1(key, ta, &key->u.tkip.rx[queue], iv32);
 #ifdef CONFIG_TKIP_DEBUG
                 {
                         int i;
@@ -311,7 +295,7 @@ int ieee80211_tkip_decrypt_data(struct crypto_blkcipher *tfm,
                         printk("\n");
                         printk(KERN_DEBUG "TKIP decrypt: P1K=");
                         for (i = 0; i < 5; i++)
-                                printk("%04x ", key->u.tkip.p1k_rx[queue][i]);
+                                printk("%04x ", key->u.tkip.rx[queue].p1k[i]);
                         printk("\n");
                 }
 #endif /* CONFIG_TKIP_DEBUG */
@@ -326,13 +310,11 @@ int ieee80211_tkip_decrypt_data(struct crypto_blkcipher *tfm,
 
                         key->local->ops->update_tkip_key(
                                 local_to_hw(key->local), &key->conf,
-                                sta_addr, iv32, key->u.tkip.p1k_rx[queue]);
+                                sta_addr, iv32, key->u.tkip.rx[queue].p1k);
                 }
         }
 
-        tkip_mixing_phase2(key->u.tkip.p1k_rx[queue],
-                           &key->conf.key[ALG_TKIP_TEMP_ENCR_KEY],
-                           iv16, rc4key);
+        tkip_mixing_phase2(key, &key->u.tkip.rx[queue], iv16, rc4key);
 #ifdef CONFIG_TKIP_DEBUG
         {
                 int i;
diff --git a/net/mac80211/tkip.h b/net/mac80211/tkip.h
index 1fa0bb4dba3c..b890427fc959 100644
--- a/net/mac80211/tkip.h
+++ b/net/mac80211/tkip.h
@@ -15,10 +15,6 @@
 
 u8 *ieee80211_tkip_add_iv(u8 *pos, struct ieee80211_key *key,
                           u8 iv0, u8 iv1, u8 iv2);
-void ieee80211_tkip_gen_phase1key(struct ieee80211_key *key, u8 *ta,
-                                  u16 *phase1key);
-void ieee80211_tkip_gen_rc4key(struct ieee80211_key *key, u8 *ta,
-                               u8 *rc4key);
 void ieee80211_tkip_encrypt_data(struct crypto_blkcipher *tfm,
                                  struct ieee80211_key *key,
                                  u8 *pos, size_t payload_len, u8 *ta);
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index aecec2a72b08..1ad9e664f287 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -91,11 +91,12 @@ static u16 ieee80211_duration(struct ieee80211_tx_data *tx, int group_addr,
                               int next_frag_len)
 {
         int rate, mrate, erp, dur, i;
-        struct ieee80211_rate *txrate = tx->rate;
+        struct ieee80211_rate *txrate;
         struct ieee80211_local *local = tx->local;
         struct ieee80211_supported_band *sband;
 
-        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
+        sband = local->hw.wiphy->bands[tx->channel->band];
+        txrate = &sband->bitrates[tx->rate_idx];
 
         erp = 0;
         if (tx->sdata->flags & IEEE80211_SDATA_OPERATING_GMODE)
@@ -212,18 +213,6 @@ static u16 ieee80211_duration(struct ieee80211_tx_data *tx, int group_addr,
         return dur;
 }
 
-static inline int __ieee80211_queue_stopped(const struct ieee80211_local *local,
-                                            int queue)
-{
-        return test_bit(IEEE80211_LINK_STATE_XOFF, &local->state[queue]);
-}
-
-static inline int __ieee80211_queue_pending(const struct ieee80211_local *local,
-                                            int queue)
-{
-        return test_bit(IEEE80211_LINK_STATE_PENDING, &local->state[queue]);
-}
-
 static int inline is_ieee80211_device(struct net_device *dev,
                                       struct net_device *master)
 {
@@ -237,12 +226,12 @@ static ieee80211_tx_result
 ieee80211_tx_h_check_assoc(struct ieee80211_tx_data *tx)
 {
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
-        struct sk_buff *skb = tx->skb;
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
 #endif /* CONFIG_MAC80211_VERBOSE_DEBUG */
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
         u32 sta_flags;
 
-        if (unlikely(tx->flags & IEEE80211_TX_INJECTED))
+        if (unlikely(info->flags & IEEE80211_TX_CTL_INJECTED))
                 return TX_CONTINUE;
 
         if (unlikely(tx->local->sta_sw_scanning) &&
@@ -347,6 +336,8 @@ static void purge_old_ps_buffers(struct ieee80211_local *local)
 static ieee80211_tx_result
 ieee80211_tx_h_multicast_ps_buf(struct ieee80211_tx_data *tx)
 {
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
+
         /*
          * broadcast/multicast frame
          *
@@ -382,7 +373,7 @@ ieee80211_tx_h_multicast_ps_buf(struct ieee80211_tx_data *tx)
         }
 
         /* buffered in hardware */
-        tx->control->flags |= IEEE80211_TXCTL_SEND_AFTER_DTIM;
+        info->flags |= IEEE80211_TX_CTL_SEND_AFTER_DTIM;
 
         return TX_CONTINUE;
 }
@@ -391,6 +382,7 @@ static ieee80211_tx_result
 ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx)
 {
         struct sta_info *sta = tx->sta;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
         u32 staflags;
         DECLARE_MAC_BUF(mac);
 
@@ -403,7 +395,6 @@ ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx)
 
         if (unlikely((staflags & WLAN_STA_PS) &&
                      !(staflags & WLAN_STA_PSPOLL))) {
-                struct ieee80211_tx_packet_data *pkt_data;
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
                 printk(KERN_DEBUG "STA %s aid %d: PS buffer (entries "
                        "before %d)\n",
@@ -427,8 +418,7 @@ ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx)
                 if (skb_queue_empty(&sta->ps_tx_buf))
                         sta_info_set_tim_bit(sta);
 
-                pkt_data = (struct ieee80211_tx_packet_data *)tx->skb->cb;
-                pkt_data->jiffies = jiffies;
+                info->control.jiffies = jiffies;
                 skb_queue_tail(&sta->ps_tx_buf, tx->skb);
                 return TX_QUEUED;
         }
@@ -460,17 +450,18 @@ static ieee80211_tx_result
 ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx)
 {
         struct ieee80211_key *key;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
         u16 fc = tx->fc;
 
-        if (unlikely(tx->control->flags & IEEE80211_TXCTL_DO_NOT_ENCRYPT))
+        if (unlikely(info->flags & IEEE80211_TX_CTL_DO_NOT_ENCRYPT))
                 tx->key = NULL;
         else if (tx->sta && (key = rcu_dereference(tx->sta->key)))
                 tx->key = key;
         else if ((key = rcu_dereference(tx->sdata->default_key)))
                 tx->key = key;
         else if (tx->sdata->drop_unencrypted &&
-                 !(tx->control->flags & IEEE80211_TXCTL_EAPOL_FRAME) &&
-                 !(tx->flags & IEEE80211_TX_INJECTED)) {
+                 !(info->flags & IEEE80211_TX_CTL_EAPOL_FRAME) &&
+                 !(info->flags & IEEE80211_TX_CTL_INJECTED)) {
                 I802_DEBUG_INC(tx->local->tx_handlers_drop_unencrypted);
                 return TX_DROP;
         } else
@@ -499,7 +490,156 @@ ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx)
         }
 
         if (!tx->key || !(tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE))
-                tx->control->flags |= IEEE80211_TXCTL_DO_NOT_ENCRYPT;
+                info->flags |= IEEE80211_TX_CTL_DO_NOT_ENCRYPT;
+
+        return TX_CONTINUE;
+}
+
+static ieee80211_tx_result
+ieee80211_tx_h_rate_ctrl(struct ieee80211_tx_data *tx)
+{
+        struct rate_selection rsel;
+        struct ieee80211_supported_band *sband;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
+
+        sband = tx->local->hw.wiphy->bands[tx->channel->band];
+
+        if (likely(tx->rate_idx < 0)) {
+                rate_control_get_rate(tx->dev, sband, tx->skb, &rsel);
+                tx->rate_idx = rsel.rate_idx;
+                if (unlikely(rsel.probe_idx >= 0)) {
+                        info->flags |= IEEE80211_TX_CTL_RATE_CTRL_PROBE;
+                        tx->flags |= IEEE80211_TX_PROBE_LAST_FRAG;
+                        info->control.alt_retry_rate_idx = tx->rate_idx;
+                        tx->rate_idx = rsel.probe_idx;
+                } else
+                        info->control.alt_retry_rate_idx = -1;
+
+                if (unlikely(tx->rate_idx < 0))
+                        return TX_DROP;
+        } else
+                info->control.alt_retry_rate_idx = -1;
+
+        if (tx->sdata->bss_conf.use_cts_prot &&
+            (tx->flags & IEEE80211_TX_FRAGMENTED) && (rsel.nonerp_idx >= 0)) {
+                tx->last_frag_rate_idx = tx->rate_idx;
+                if (rsel.probe_idx >= 0)
+                        tx->flags &= ~IEEE80211_TX_PROBE_LAST_FRAG;
+                else
+                        tx->flags |= IEEE80211_TX_PROBE_LAST_FRAG;
+                tx->rate_idx = rsel.nonerp_idx;
+                info->tx_rate_idx = rsel.nonerp_idx;
+                info->flags &= ~IEEE80211_TX_CTL_RATE_CTRL_PROBE;
+        } else {
+                tx->last_frag_rate_idx = tx->rate_idx;
+                info->tx_rate_idx = tx->rate_idx;
+        }
+        info->tx_rate_idx = tx->rate_idx;
+
+        return TX_CONTINUE;
+}
+
+static ieee80211_tx_result
+ieee80211_tx_h_misc(struct ieee80211_tx_data *tx)
+{
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) tx->skb->data;
+        u16 fc = le16_to_cpu(hdr->frame_control);
+        u16 dur;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
+        struct ieee80211_supported_band *sband;
+
+        sband = tx->local->hw.wiphy->bands[tx->channel->band];
+
+        if (tx->sta)
+                info->control.aid = tx->sta->aid;
+
+        if (!info->control.retry_limit) {
+                if (!is_multicast_ether_addr(hdr->addr1)) {
+                        int len = min_t(int, tx->skb->len + FCS_LEN,
+                                        tx->local->fragmentation_threshold);
+                        if (len > tx->local->rts_threshold
+                            && tx->local->rts_threshold <
+                                                IEEE80211_MAX_RTS_THRESHOLD) {
+                                info->flags |= IEEE80211_TX_CTL_USE_RTS_CTS;
+                                info->flags |=
+                                        IEEE80211_TX_CTL_LONG_RETRY_LIMIT;
+                                info->control.retry_limit =
+                                        tx->local->long_retry_limit;
+                        } else {
+                                info->control.retry_limit =
+                                        tx->local->short_retry_limit;
+                        }
+                } else {
+                        info->control.retry_limit = 1;
+                }
+        }
+
+        if (tx->flags & IEEE80211_TX_FRAGMENTED) {
+                /* Do not use multiple retry rates when sending fragmented
+                 * frames.
+                 * TODO: The last fragment could still use multiple retry
+                 * rates. */
+                info->control.alt_retry_rate_idx = -1;
+        }
+
+        /* Use CTS protection for unicast frames sent using extended rates if
+         * there are associated non-ERP stations and RTS/CTS is not configured
+         * for the frame. */
+        if ((tx->sdata->flags & IEEE80211_SDATA_OPERATING_GMODE) &&
+            (sband->bitrates[tx->rate_idx].flags & IEEE80211_RATE_ERP_G) &&
+            (tx->flags & IEEE80211_TX_UNICAST) &&
+            tx->sdata->bss_conf.use_cts_prot &&
+            !(info->flags & IEEE80211_TX_CTL_USE_RTS_CTS))
+                info->flags |= IEEE80211_TX_CTL_USE_CTS_PROTECT;
+
+        /* Transmit data frames using short preambles if the driver supports
+         * short preambles at the selected rate and short preambles are
+         * available on the network at the current point in time. */
+        if (((fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA) &&
+            (sband->bitrates[tx->rate_idx].flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
+            tx->sdata->bss_conf.use_short_preamble &&
+            (!tx->sta || test_sta_flags(tx->sta, WLAN_STA_SHORT_PREAMBLE))) {
+                info->flags |= IEEE80211_TX_CTL_SHORT_PREAMBLE;
+        }
+
+        /* Setup duration field for the first fragment of the frame. Duration
+         * for remaining fragments will be updated when they are being sent
+         * to low-level driver in ieee80211_tx(). */
+        dur = ieee80211_duration(tx, is_multicast_ether_addr(hdr->addr1),
+                                 (tx->flags & IEEE80211_TX_FRAGMENTED) ?
+                                 tx->extra_frag[0]->len : 0);
+        hdr->duration_id = cpu_to_le16(dur);
+
+        if ((info->flags & IEEE80211_TX_CTL_USE_RTS_CTS) ||
+            (info->flags & IEEE80211_TX_CTL_USE_CTS_PROTECT)) {
+                struct ieee80211_rate *rate;
+                s8 baserate = -1;
+                int idx;
+
+                /* Do not use multiple retry rates when using RTS/CTS */
+                info->control.alt_retry_rate_idx = -1;
+
+                /* Use min(data rate, max base rate) as CTS/RTS rate */
+                rate = &sband->bitrates[tx->rate_idx];
+
+                for (idx = 0; idx < sband->n_bitrates; idx++) {
+                        if (sband->bitrates[idx].bitrate > rate->bitrate)
+                                continue;
+                        if (tx->sdata->basic_rates & BIT(idx) &&
+                            (baserate < 0 ||
+                             (sband->bitrates[baserate].bitrate
+                              < sband->bitrates[idx].bitrate)))
+                                baserate = idx;
+                }
+
+                if (baserate >= 0)
+                        info->control.rts_cts_rate_idx = baserate;
+                else
+                        info->control.rts_cts_rate_idx = 0;
+        }
+
+        if (tx->sta)
+                info->control.aid = tx->sta->aid;
 
         return TX_CONTINUE;
 }
@@ -518,6 +658,17 @@ ieee80211_tx_h_fragment(struct ieee80211_tx_data *tx)
         if (!(tx->flags & IEEE80211_TX_FRAGMENTED))
                 return TX_CONTINUE;
 
+        /*
+         * Warn when submitting a fragmented A-MPDU frame and drop it.
+         * This is an error and needs to be fixed elsewhere, but when
+         * done needs to take care of monitor interfaces (injection)
+         * etc.
+         */
+        if (WARN_ON(tx->flags & IEEE80211_TX_CTL_AMPDU ||
+                    skb_get_queue_mapping(tx->skb) >=
+                        ieee80211_num_regular_queues(&tx->local->hw)))
+                return TX_DROP;
+
         first = tx->skb;
 
         hdrlen = ieee80211_get_hdrlen(tx->fc);
@@ -605,215 +756,22 @@ ieee80211_tx_h_encrypt(struct ieee80211_tx_data *tx)
 }
 
 static ieee80211_tx_result
-ieee80211_tx_h_rate_ctrl(struct ieee80211_tx_data *tx)
-{
-        struct rate_selection rsel;
-        struct ieee80211_supported_band *sband;
-
-        sband = tx->local->hw.wiphy->bands[tx->local->hw.conf.channel->band];
-
-        if (likely(!tx->rate)) {
-                rate_control_get_rate(tx->dev, sband, tx->skb, &rsel);
-                tx->rate = rsel.rate;
-                if (unlikely(rsel.probe)) {
-                        tx->control->flags |=
-                                IEEE80211_TXCTL_RATE_CTRL_PROBE;
-                        tx->flags |= IEEE80211_TX_PROBE_LAST_FRAG;
-                        tx->control->alt_retry_rate = tx->rate;
-                        tx->rate = rsel.probe;
-                } else
-                        tx->control->alt_retry_rate = NULL;
-
-                if (!tx->rate)
-                        return TX_DROP;
-        } else
-                tx->control->alt_retry_rate = NULL;
-
-        if (tx->sdata->bss_conf.use_cts_prot &&
-            (tx->flags & IEEE80211_TX_FRAGMENTED) && rsel.nonerp) {
-                tx->last_frag_rate = tx->rate;
-                if (rsel.probe)
-                        tx->flags &= ~IEEE80211_TX_PROBE_LAST_FRAG;
-                else
-                        tx->flags |= IEEE80211_TX_PROBE_LAST_FRAG;
-                tx->rate = rsel.nonerp;
-                tx->control->tx_rate = rsel.nonerp;
-                tx->control->flags &= ~IEEE80211_TXCTL_RATE_CTRL_PROBE;
-        } else {
-                tx->last_frag_rate = tx->rate;
-                tx->control->tx_rate = tx->rate;
-        }
-        tx->control->tx_rate = tx->rate;
-
-        return TX_CONTINUE;
-}
-
-static ieee80211_tx_result
-ieee80211_tx_h_misc(struct ieee80211_tx_data *tx)
-{
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) tx->skb->data;
-        u16 fc = le16_to_cpu(hdr->frame_control);
-        u16 dur;
-        struct ieee80211_tx_control *control = tx->control;
-
-        if (!control->retry_limit) {
-                if (!is_multicast_ether_addr(hdr->addr1)) {
-                        if (tx->skb->len + FCS_LEN > tx->local->rts_threshold
-                            && tx->local->rts_threshold <
-                                        IEEE80211_MAX_RTS_THRESHOLD) {
-                                control->flags |=
-                                        IEEE80211_TXCTL_USE_RTS_CTS;
-                                control->flags |=
-                                        IEEE80211_TXCTL_LONG_RETRY_LIMIT;
-                                control->retry_limit =
-                                        tx->local->long_retry_limit;
-                        } else {
-                                control->retry_limit =
-                                        tx->local->short_retry_limit;
-                        }
-                } else {
-                        control->retry_limit = 1;
-                }
-        }
-
-        if (tx->flags & IEEE80211_TX_FRAGMENTED) {
-                /* Do not use multiple retry rates when sending fragmented
-                 * frames.
-                 * TODO: The last fragment could still use multiple retry
-                 * rates. */
-                control->alt_retry_rate = NULL;
-        }
-
-        /* Use CTS protection for unicast frames sent using extended rates if
-         * there are associated non-ERP stations and RTS/CTS is not configured
-         * for the frame. */
-        if ((tx->sdata->flags & IEEE80211_SDATA_OPERATING_GMODE) &&
-            (tx->rate->flags & IEEE80211_RATE_ERP_G) &&
-            (tx->flags & IEEE80211_TX_UNICAST) &&
-            tx->sdata->bss_conf.use_cts_prot &&
-            !(control->flags & IEEE80211_TXCTL_USE_RTS_CTS))
-                control->flags |= IEEE80211_TXCTL_USE_CTS_PROTECT;
-
-        /* Transmit data frames using short preambles if the driver supports
-         * short preambles at the selected rate and short preambles are
-         * available on the network at the current point in time. */
-        if (((fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA) &&
-            (tx->rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
-            tx->sdata->bss_conf.use_short_preamble &&
-            (!tx->sta || test_sta_flags(tx->sta, WLAN_STA_SHORT_PREAMBLE))) {
-                tx->control->flags |= IEEE80211_TXCTL_SHORT_PREAMBLE;
-        }
-
-        /* Setup duration field for the first fragment of the frame. Duration
-         * for remaining fragments will be updated when they are being sent
-         * to low-level driver in ieee80211_tx(). */
-        dur = ieee80211_duration(tx, is_multicast_ether_addr(hdr->addr1),
-                                 (tx->flags & IEEE80211_TX_FRAGMENTED) ?
-                                 tx->extra_frag[0]->len : 0);
-        hdr->duration_id = cpu_to_le16(dur);
-
-        if ((control->flags & IEEE80211_TXCTL_USE_RTS_CTS) ||
-            (control->flags & IEEE80211_TXCTL_USE_CTS_PROTECT)) {
-                struct ieee80211_supported_band *sband;
-                struct ieee80211_rate *rate, *baserate;
-                int idx;
-
-                sband = tx->local->hw.wiphy->bands[
-                                tx->local->hw.conf.channel->band];
-
-                /* Do not use multiple retry rates when using RTS/CTS */
-                control->alt_retry_rate = NULL;
-
-                /* Use min(data rate, max base rate) as CTS/RTS rate */
-                rate = tx->rate;
-                baserate = NULL;
-
-                for (idx = 0; idx < sband->n_bitrates; idx++) {
-                        if (sband->bitrates[idx].bitrate > rate->bitrate)
-                                continue;
-                        if (tx->sdata->basic_rates & BIT(idx) &&
-                            (!baserate ||
-                             (baserate->bitrate < sband->bitrates[idx].bitrate)))
-                                baserate = &sband->bitrates[idx];
-                }
-
-                if (baserate)
-                        control->rts_cts_rate = baserate;
-                else
-                        control->rts_cts_rate = &sband->bitrates[0];
-        }
-
-        if (tx->sta) {
-                control->aid = tx->sta->aid;
-                tx->sta->tx_packets++;
-                tx->sta->tx_fragments++;
-                tx->sta->tx_bytes += tx->skb->len;
-                if (tx->extra_frag) {
-                        int i;
-                        tx->sta->tx_fragments += tx->num_extra_frag;
-                        for (i = 0; i < tx->num_extra_frag; i++) {
-                                tx->sta->tx_bytes +=
-                                        tx->extra_frag[i]->len;
-                        }
-                }
-        }
-
-        return TX_CONTINUE;
-}
-
-static ieee80211_tx_result
-ieee80211_tx_h_load_stats(struct ieee80211_tx_data *tx)
+ieee80211_tx_h_stats(struct ieee80211_tx_data *tx)
 {
-        struct ieee80211_local *local = tx->local;
-        struct sk_buff *skb = tx->skb;
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
-        u32 load = 0, hdrtime;
-        struct ieee80211_rate *rate = tx->rate;
-
-        /* TODO: this could be part of tx_status handling, so that the number
-         * of retries would be known; TX rate should in that case be stored
-         * somewhere with the packet */
-
-        /* Estimate total channel use caused by this frame */
-
-        /* 1 bit at 1 Mbit/s takes 1 usec; in channel_use values,
-         * 1 usec = 1/8 * (1080 / 10) = 13.5 */
-
-        if (tx->channel->band == IEEE80211_BAND_5GHZ ||
-            (tx->channel->band == IEEE80211_BAND_2GHZ &&
-             rate->flags & IEEE80211_RATE_ERP_G))
-                hdrtime = CHAN_UTIL_HDR_SHORT;
-        else
-                hdrtime = CHAN_UTIL_HDR_LONG;
-
-        load = hdrtime;
-        if (!is_multicast_ether_addr(hdr->addr1))
-                load += hdrtime;
-
-        if (tx->control->flags & IEEE80211_TXCTL_USE_RTS_CTS)
-                load += 2 * hdrtime;
-        else if (tx->control->flags & IEEE80211_TXCTL_USE_CTS_PROTECT)
-                load += hdrtime;
+        int i;
 
-        /* TODO: optimise again */
-        load += skb->len * CHAN_UTIL_RATE_LCM / rate->bitrate;
+        if (!tx->sta)
+                return TX_CONTINUE;
 
+        tx->sta->tx_packets++;
+        tx->sta->tx_fragments++;
+        tx->sta->tx_bytes += tx->skb->len;
         if (tx->extra_frag) {
-                int i;
-                for (i = 0; i < tx->num_extra_frag; i++) {
-                        load += 2 * hdrtime;
-                        load += tx->extra_frag[i]->len *
-                                tx->rate->bitrate;
-                }
+                tx->sta->tx_fragments += tx->num_extra_frag;
+                for (i = 0; i < tx->num_extra_frag; i++)
+                        tx->sta->tx_bytes += tx->extra_frag[i]->len;
         }
 
-        /* Divide channel_use by 8 to avoid wrapping around the counter */
-        load >>= CHAN_UTIL_SHIFT;
-        local->channel_use_raw += load;
-        if (tx->sta)
-                tx->sta->channel_use_raw += load;
-        tx->sdata->channel_use_raw += load;
-
         return TX_CONTINUE;
 }
 
@@ -826,11 +784,12 @@ static ieee80211_tx_handler ieee80211_tx_handlers[] =
         ieee80211_tx_h_ps_buf,
         ieee80211_tx_h_select_key,
         ieee80211_tx_h_michael_mic_add,
-        ieee80211_tx_h_fragment,
-        ieee80211_tx_h_encrypt,
         ieee80211_tx_h_rate_ctrl,
         ieee80211_tx_h_misc,
-        ieee80211_tx_h_load_stats,
+        ieee80211_tx_h_fragment,
+        /* handlers after fragment must be aware of tx info fragmentation! */
+        ieee80211_tx_h_encrypt,
+        ieee80211_tx_h_stats,
         NULL
 };
 
@@ -857,12 +816,12 @@ __ieee80211_parse_tx_radiotap(struct ieee80211_tx_data *tx,
                 (struct ieee80211_radiotap_header *) skb->data;
         struct ieee80211_supported_band *sband;
         int ret = ieee80211_radiotap_iterator_init(&iterator, rthdr, skb->len);
-        struct ieee80211_tx_control *control = tx->control;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 
-        sband = tx->local->hw.wiphy->bands[tx->local->hw.conf.channel->band];
+        sband = tx->local->hw.wiphy->bands[tx->channel->band];
 
-        control->flags |= IEEE80211_TXCTL_DO_NOT_ENCRYPT;
-        tx->flags |= IEEE80211_TX_INJECTED;
+        info->flags |= IEEE80211_TX_CTL_DO_NOT_ENCRYPT;
+        info->flags |= IEEE80211_TX_CTL_INJECTED;
         tx->flags &= ~IEEE80211_TX_FRAGMENTED;
 
         /*
@@ -899,7 +858,7 @@ __ieee80211_parse_tx_radiotap(struct ieee80211_tx_data *tx,
                                 r = &sband->bitrates[i];
 
                                 if (r->bitrate == target_rate) {
-                                        tx->rate = r;
+                                        tx->rate_idx = i;
                                         break;
                                 }
                         }
@@ -910,7 +869,7 @@ __ieee80211_parse_tx_radiotap(struct ieee80211_tx_data *tx,
                          * radiotap uses 0 for 1st ant, mac80211 is 1 for
                          * 1st ant
                          */
-                        control->antenna_sel_tx = (*iterator.this_arg) + 1;
+                        info->antenna_sel_tx = (*iterator.this_arg) + 1;
                         break;
 
 #if 0
@@ -934,8 +893,8 @@ __ieee80211_parse_tx_radiotap(struct ieee80211_tx_data *tx,
                                 skb_trim(skb, skb->len - FCS_LEN);
                         }
                         if (*iterator.this_arg & IEEE80211_RADIOTAP_F_WEP)
-                                control->flags &=
-                                        ~IEEE80211_TXCTL_DO_NOT_ENCRYPT;
+                                info->flags &=
+                                        ~IEEE80211_TX_CTL_DO_NOT_ENCRYPT;
                         if (*iterator.this_arg & IEEE80211_RADIOTAP_F_FRAG)
                                 tx->flags |= IEEE80211_TX_FRAGMENTED;
                         break;
@@ -970,12 +929,12 @@ __ieee80211_parse_tx_radiotap(struct ieee80211_tx_data *tx,
 static ieee80211_tx_result
 __ieee80211_tx_prepare(struct ieee80211_tx_data *tx,
                        struct sk_buff *skb,
-                       struct net_device *dev,
-                       struct ieee80211_tx_control *control)
+                       struct net_device *dev)
 {
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
         struct ieee80211_hdr *hdr;
         struct ieee80211_sub_if_data *sdata;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 
         int hdrlen;
 
@@ -984,7 +943,9 @@ __ieee80211_tx_prepare(struct ieee80211_tx_data *tx,
         tx->dev = dev; /* use original interface */
         tx->local = local;
         tx->sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        tx->control = control;
+        tx->channel = local->hw.conf.channel;
+        tx->rate_idx = -1;
+        tx->last_frag_rate_idx = -1;
         /*
          * Set this flag (used below to indicate "automatic fragmentation"),
          * it will be cleared/left by radiotap as desired.
@@ -1011,10 +972,10 @@ __ieee80211_tx_prepare(struct ieee80211_tx_data *tx,
 
         if (is_multicast_ether_addr(hdr->addr1)) {
                 tx->flags &= ~IEEE80211_TX_UNICAST;
-                control->flags |= IEEE80211_TXCTL_NO_ACK;
+                info->flags |= IEEE80211_TX_CTL_NO_ACK;
         } else {
                 tx->flags |= IEEE80211_TX_UNICAST;
-                control->flags &= ~IEEE80211_TXCTL_NO_ACK;
+                info->flags &= ~IEEE80211_TX_CTL_NO_ACK;
         }
 
         if (tx->flags & IEEE80211_TX_FRAGMENTED) {
@@ -1027,16 +988,16 @@ __ieee80211_tx_prepare(struct ieee80211_tx_data *tx,
         }
 
         if (!tx->sta)
-                control->flags |= IEEE80211_TXCTL_CLEAR_PS_FILT;
+                info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT;
         else if (test_and_clear_sta_flags(tx->sta, WLAN_STA_CLEAR_PS_FILT))
-                control->flags |= IEEE80211_TXCTL_CLEAR_PS_FILT;
+                info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT;
 
         hdrlen = ieee80211_get_hdrlen(tx->fc);
         if (skb->len > hdrlen + sizeof(rfc1042_header) + 2) {
                 u8 *pos = &skb->data[hdrlen + sizeof(rfc1042_header)];
                 tx->ethertype = (pos[0] << 8) | pos[1];
         }
-        control->flags |= IEEE80211_TXCTL_FIRST_FRAGMENT;
+        info->flags |= IEEE80211_TX_CTL_FIRST_FRAGMENT;
 
         return TX_CONTINUE;
 }
@@ -1046,14 +1007,12 @@ __ieee80211_tx_prepare(struct ieee80211_tx_data *tx,
  */
 static int ieee80211_tx_prepare(struct ieee80211_tx_data *tx,
                                 struct sk_buff *skb,
-                                struct net_device *mdev,
-                                struct ieee80211_tx_control *control)
+                                struct net_device *mdev)
 {
-        struct ieee80211_tx_packet_data *pkt_data;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         struct net_device *dev;
 
-        pkt_data = (struct ieee80211_tx_packet_data *)skb->cb;
-        dev = dev_get_by_index(&init_net, pkt_data->ifindex);
+        dev = dev_get_by_index(&init_net, info->control.ifindex);
         if (unlikely(dev && !is_ieee80211_device(dev, mdev))) {
                 dev_put(dev);
                 dev = NULL;
@@ -1061,7 +1020,7 @@ static int ieee80211_tx_prepare(struct ieee80211_tx_data *tx,
         if (unlikely(!dev))
                 return -ENODEV;
         /* initialises tx with control */
-        __ieee80211_tx_prepare(tx, skb, dev, control);
+        __ieee80211_tx_prepare(tx, skb, dev);
         dev_put(dev);
         return 0;
 }
@@ -1069,50 +1028,49 @@ static int ieee80211_tx_prepare(struct ieee80211_tx_data *tx,
 static int __ieee80211_tx(struct ieee80211_local *local, struct sk_buff *skb,
                           struct ieee80211_tx_data *tx)
 {
-        struct ieee80211_tx_control *control = tx->control;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         int ret, i;
 
-        if (!ieee80211_qdisc_installed(local->mdev) &&
-            __ieee80211_queue_stopped(local, 0)) {
-                netif_stop_queue(local->mdev);
+        if (netif_subqueue_stopped(local->mdev, skb))
                 return IEEE80211_TX_AGAIN;
-        }
+
         if (skb) {
                 ieee80211_dump_frame(wiphy_name(local->hw.wiphy),
                                      "TX to low-level driver", skb);
-                ret = local->ops->tx(local_to_hw(local), skb, control);
+                ret = local->ops->tx(local_to_hw(local), skb);
                 if (ret)
                         return IEEE80211_TX_AGAIN;
                 local->mdev->trans_start = jiffies;
                 ieee80211_led_tx(local, 1);
         }
         if (tx->extra_frag) {
-                control->flags &= ~(IEEE80211_TXCTL_USE_RTS_CTS |
-                                    IEEE80211_TXCTL_USE_CTS_PROTECT |
-                                    IEEE80211_TXCTL_CLEAR_PS_FILT |
-                                    IEEE80211_TXCTL_FIRST_FRAGMENT);
                 for (i = 0; i < tx->num_extra_frag; i++) {
                         if (!tx->extra_frag[i])
                                 continue;
-                        if (__ieee80211_queue_stopped(local, control->queue))
+                        info = IEEE80211_SKB_CB(tx->extra_frag[i]);
+                        info->flags &= ~(IEEE80211_TX_CTL_USE_RTS_CTS |
+                                         IEEE80211_TX_CTL_USE_CTS_PROTECT |
+                                         IEEE80211_TX_CTL_CLEAR_PS_FILT |
+                                         IEEE80211_TX_CTL_FIRST_FRAGMENT);
+                        if (netif_subqueue_stopped(local->mdev,
+                                                   tx->extra_frag[i]))
                                 return IEEE80211_TX_FRAG_AGAIN;
                         if (i == tx->num_extra_frag) {
-                                control->tx_rate = tx->last_frag_rate;
+                                info->tx_rate_idx = tx->last_frag_rate_idx;
 
                                 if (tx->flags & IEEE80211_TX_PROBE_LAST_FRAG)
-                                        control->flags |=
-                                                IEEE80211_TXCTL_RATE_CTRL_PROBE;
+                                        info->flags |=
+                                                IEEE80211_TX_CTL_RATE_CTRL_PROBE;
                                 else
-                                        control->flags &=
-                                                ~IEEE80211_TXCTL_RATE_CTRL_PROBE;
+                                        info->flags &=
+                                                ~IEEE80211_TX_CTL_RATE_CTRL_PROBE;
                         }
 
                         ieee80211_dump_frame(wiphy_name(local->hw.wiphy),
                                              "TX to low-level driver",
                                              tx->extra_frag[i]);
                         ret = local->ops->tx(local_to_hw(local),
-                                            tx->extra_frag[i],
-                                            control);
+                                            tx->extra_frag[i]);
                         if (ret)
                                 return IEEE80211_TX_FRAG_AGAIN;
                         local->mdev->trans_start = jiffies;
@@ -1125,17 +1083,20 @@ static int __ieee80211_tx(struct ieee80211_local *local, struct sk_buff *skb,
         return IEEE80211_TX_OK;
 }
 
-static int ieee80211_tx(struct net_device *dev, struct sk_buff *skb,
-                        struct ieee80211_tx_control *control)
+static int ieee80211_tx(struct net_device *dev, struct sk_buff *skb)
 {
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
         struct sta_info *sta;
         ieee80211_tx_handler *handler;
         struct ieee80211_tx_data tx;
         ieee80211_tx_result res = TX_DROP, res_prepare;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         int ret, i;
+        u16 queue;
 
-        WARN_ON(__ieee80211_queue_pending(local, control->queue));
+        queue = skb_get_queue_mapping(skb);
+
+        WARN_ON(test_bit(queue, local->queues_pending));
 
         if (unlikely(skb->len < 10)) {
                 dev_kfree_skb(skb);
@@ -1145,7 +1106,7 @@ static int ieee80211_tx(struct net_device *dev, struct sk_buff *skb,
         rcu_read_lock();
 
         /* initialises tx */
-        res_prepare = __ieee80211_tx_prepare(&tx, skb, dev, control);
+        res_prepare = __ieee80211_tx_prepare(&tx, skb, dev);
 
         if (res_prepare == TX_DROP) {
                 dev_kfree_skb(skb);
@@ -1155,6 +1116,7 @@ static int ieee80211_tx(struct net_device *dev, struct sk_buff *skb,
 
         sta = tx.sta;
         tx.channel = local->hw.conf.channel;
+        info->band = tx.channel->band;
 
         for (handler = ieee80211_tx_handlers; *handler != NULL;
              handler++) {
@@ -1163,7 +1125,8 @@ static int ieee80211_tx(struct net_device *dev, struct sk_buff *skb,
                         break;
         }
 
-        skb = tx.skb; /* handlers are allowed to change skb */
+        if (WARN_ON(tx.skb != skb))
+                goto drop;
 
         if (unlikely(res == TX_DROP)) {
                 I802_DEBUG_INC(local->tx_handlers_drop);
@@ -1187,7 +1150,7 @@ static int ieee80211_tx(struct net_device *dev, struct sk_buff *skb,
                                 next_len = tx.extra_frag[i + 1]->len;
                         } else {
                                 next_len = 0;
-                                tx.rate = tx.last_frag_rate;
+                                tx.rate_idx = tx.last_frag_rate_idx;
                         }
                         dur = ieee80211_duration(&tx, 0, next_len);
                         hdr->duration_id = cpu_to_le16(dur);
@@ -1197,34 +1160,41 @@ static int ieee80211_tx(struct net_device *dev, struct sk_buff *skb,
 retry:
         ret = __ieee80211_tx(local, skb, &tx);
         if (ret) {
-                struct ieee80211_tx_stored_packet *store =
-                        &local->pending_packet[control->queue];
+                struct ieee80211_tx_stored_packet *store;
+
+                /*
+                 * Since there are no fragmented frames on A-MPDU
+                 * queues, there's no reason for a driver to reject
+                 * a frame there, warn and drop it.
+                 */
+                if (WARN_ON(queue >= ieee80211_num_regular_queues(&local->hw)))
+                        goto drop;
+
+                store = &local->pending_packet[queue];
 
                 if (ret == IEEE80211_TX_FRAG_AGAIN)
                         skb = NULL;
-                set_bit(IEEE80211_LINK_STATE_PENDING,
-                        &local->state[control->queue]);
+                set_bit(queue, local->queues_pending);
                 smp_mb();
-                /* When the driver gets out of buffers during sending of
-                 * fragments and calls ieee80211_stop_queue, there is
-                 * a small window between IEEE80211_LINK_STATE_XOFF and
-                 * IEEE80211_LINK_STATE_PENDING flags are set. If a buffer
+                /*
+                 * When the driver gets out of buffers during sending of
+                 * fragments and calls ieee80211_stop_queue, the netif
+                 * subqueue is stopped. There is, however, a small window
+                 * in which the PENDING bit is not yet set. If a buffer
                  * gets available in that window (i.e. driver calls
                  * ieee80211_wake_queue), we would end up with ieee80211_tx
-                 * called with IEEE80211_LINK_STATE_PENDING. Prevent this by
+                 * called with the PENDING bit still set. Prevent this by
                  * continuing transmitting here when that situation is
-                 * possible to have happened. */
-                if (!__ieee80211_queue_stopped(local, control->queue)) {
-                        clear_bit(IEEE80211_LINK_STATE_PENDING,
-                                  &local->state[control->queue]);
+                 * possible to have happened.
+                 */
+                if (!__netif_subqueue_stopped(local->mdev, queue)) {
+                        clear_bit(queue, local->queues_pending);
                         goto retry;
                 }
-                memcpy(&store->control, control,
-                       sizeof(struct ieee80211_tx_control));
                 store->skb = skb;
                 store->extra_frag = tx.extra_frag;
                 store->num_extra_frag = tx.num_extra_frag;
-                store->last_frag_rate = tx.last_frag_rate;
+                store->last_frag_rate_idx = tx.last_frag_rate_idx;
                 store->last_frag_rate_ctrl_probe =
                         !!(tx.flags & IEEE80211_TX_PROBE_LAST_FRAG);
         }
@@ -1244,24 +1214,57 @@ retry:
 
 /* device xmit handlers */
 
+static int ieee80211_skb_resize(struct ieee80211_local *local,
+                                struct sk_buff *skb,
+                                int head_need, bool may_encrypt)
+{
+        int tail_need = 0;
+
+        /*
+         * This could be optimised, devices that do full hardware
+         * crypto (including TKIP MMIC) need no tailroom... But we
+         * have no drivers for such devices currently.
+         */
+        if (may_encrypt) {
+                tail_need = IEEE80211_ENCRYPT_TAILROOM;
+                tail_need -= skb_tailroom(skb);
+                tail_need = max_t(int, tail_need, 0);
+        }
+
+        if (head_need || tail_need) {
+                /* Sorry. Can't account for this any more */
+                skb_orphan(skb);
+        }
+
+        if (skb_header_cloned(skb))
+                I802_DEBUG_INC(local->tx_expand_skb_head_cloned);
+        else
+                I802_DEBUG_INC(local->tx_expand_skb_head);
+
+        if (pskb_expand_head(skb, head_need, tail_need, GFP_ATOMIC)) {
+                printk(KERN_DEBUG "%s: failed to reallocate TX buffer\n",
+                       wiphy_name(local->hw.wiphy));
+                return -ENOMEM;
+        }
+
+        /* update truesize too */
+        skb->truesize += head_need + tail_need;
+
+        return 0;
+}
+
 int ieee80211_master_start_xmit(struct sk_buff *skb,
                                 struct net_device *dev)
 {
-        struct ieee80211_tx_control control;
-        struct ieee80211_tx_packet_data *pkt_data;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         struct net_device *odev = NULL;
         struct ieee80211_sub_if_data *osdata;
         int headroom;
+        bool may_encrypt;
         int ret;
 
-        /*
-         * copy control out of the skb so other people can use skb->cb
-         */
-        pkt_data = (struct ieee80211_tx_packet_data *)skb->cb;
-        memset(&control, 0, sizeof(struct ieee80211_tx_control));
-
-        if (pkt_data->ifindex)
-                odev = dev_get_by_index(&init_net, pkt_data->ifindex);
+        if (info->control.ifindex)
+                odev = dev_get_by_index(&init_net, info->control.ifindex);
         if (unlikely(odev && !is_ieee80211_device(odev, dev))) {
                 dev_put(odev);
                 odev = NULL;
@@ -1274,32 +1277,25 @@ int ieee80211_master_start_xmit(struct sk_buff *skb,
                 dev_kfree_skb(skb);
                 return 0;
         }
+
         osdata = IEEE80211_DEV_TO_SUB_IF(odev);
 
-        headroom = osdata->local->tx_headroom + IEEE80211_ENCRYPT_HEADROOM;
-        if (skb_headroom(skb) < headroom) {
-                if (pskb_expand_head(skb, headroom, 0, GFP_ATOMIC)) {
-                        dev_kfree_skb(skb);
-                        dev_put(odev);
-                        return 0;
-                }
+        may_encrypt = !(info->flags & IEEE80211_TX_CTL_DO_NOT_ENCRYPT);
+
+        headroom = osdata->local->tx_headroom;
+        if (may_encrypt)
+                headroom += IEEE80211_ENCRYPT_HEADROOM;
+        headroom -= skb_headroom(skb);
+        headroom = max_t(int, 0, headroom);
+
+        if (ieee80211_skb_resize(osdata->local, skb, headroom, may_encrypt)) {
+                dev_kfree_skb(skb);
+                dev_put(odev);
+                return 0;
         }
 
-        control.vif = &osdata->vif;
-        control.type = osdata->vif.type;
-        if (pkt_data->flags & IEEE80211_TXPD_REQ_TX_STATUS)
-                control.flags |= IEEE80211_TXCTL_REQ_TX_STATUS;
-        if (pkt_data->flags & IEEE80211_TXPD_DO_NOT_ENCRYPT)
-                control.flags |= IEEE80211_TXCTL_DO_NOT_ENCRYPT;
-        if (pkt_data->flags & IEEE80211_TXPD_REQUEUE)
-                control.flags |= IEEE80211_TXCTL_REQUEUE;
-        if (pkt_data->flags & IEEE80211_TXPD_EAPOL_FRAME)
-                control.flags |= IEEE80211_TXCTL_EAPOL_FRAME;
-        if (pkt_data->flags & IEEE80211_TXPD_AMPDU)
-                control.flags |= IEEE80211_TXCTL_AMPDU;
-        control.queue = pkt_data->queue;
-
-        ret = ieee80211_tx(odev, skb, &control);
+        info->control.vif = &osdata->vif;
+        ret = ieee80211_tx(odev, skb);
         dev_put(odev);
 
         return ret;
@@ -1309,7 +1305,7 @@ int ieee80211_monitor_start_xmit(struct sk_buff *skb,
                                  struct net_device *dev)
 {
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        struct ieee80211_tx_packet_data *pkt_data;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         struct ieee80211_radiotap_header *prthdr =
                 (struct ieee80211_radiotap_header *)skb->data;
         u16 len_rthdr;
@@ -1331,14 +1327,12 @@ int ieee80211_monitor_start_xmit(struct sk_buff *skb,
 
         skb->dev = local->mdev;
 
-        pkt_data = (struct ieee80211_tx_packet_data *)skb->cb;
-        memset(pkt_data, 0, sizeof(*pkt_data));
         /* needed because we set skb device to master */
-        pkt_data->ifindex = dev->ifindex;
+        info->control.ifindex = dev->ifindex;
 
-        pkt_data->flags |= IEEE80211_TXPD_DO_NOT_ENCRYPT;
+        info->flags |= IEEE80211_TX_CTL_DO_NOT_ENCRYPT;
         /* Interfaces should always request a status report */
-        pkt_data->flags |= IEEE80211_TXPD_REQ_TX_STATUS;
+        info->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
 
         /*
          * fix up the pointers accounting for the radiotap
@@ -1382,7 +1376,7 @@ int ieee80211_subif_start_xmit(struct sk_buff *skb,
                                struct net_device *dev)
 {
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        struct ieee80211_tx_packet_data *pkt_data;
+        struct ieee80211_tx_info *info;
         struct ieee80211_sub_if_data *sdata;
         int ret = 1, head_need;
         u16 ethertype, hdrlen,  meshhdrlen = 0, fc;
@@ -1494,7 +1488,8 @@ int ieee80211_subif_start_xmit(struct sk_buff *skb,
         }
 
         /* receiver and we are QoS enabled, use a QoS type frame */
-        if (sta_flags & WLAN_STA_WME && local->hw.queues >= 4) {
+        if (sta_flags & WLAN_STA_WME &&
+            ieee80211_num_regular_queues(&local->hw) >= 4) {
                 fc |= IEEE80211_STYPE_QOS_DATA;
                 hdrlen += 2;
         }
@@ -1558,32 +1553,26 @@ int ieee80211_subif_start_xmit(struct sk_buff *skb,
          * build in headroom in __dev_alloc_skb() (linux/skbuff.h) and
          * alloc_skb() (net/core/skbuff.c)
          */
-        head_need = hdrlen + encaps_len + meshhdrlen + local->tx_headroom;
-        head_need -= skb_headroom(skb);
+        head_need = hdrlen + encaps_len + meshhdrlen - skb_headroom(skb);
 
-        /* We are going to modify skb data, so make a copy of it if happens to
-         * be cloned. This could happen, e.g., with Linux bridge code passing
-         * us broadcast frames. */
+        /*
+         * So we need to modify the skb header and hence need a copy of
+         * that. The head_need variable above doesn't, so far, include
+         * the needed header space that we don't need right away. If we
+         * can, then we don't reallocate right now but only after the
+         * frame arrives at the master device (if it does...)
+         *
+         * If we cannot, however, then we will reallocate to include all
+         * the ever needed space. Also, if we need to reallocate it anyway,
+         * make it big enough for everything we may ever need.
+         */
 
         if (head_need > 0 || skb_header_cloned(skb)) {
-#if 0
-                printk(KERN_DEBUG "%s: need to reallocate buffer for %d bytes "
-                       "of headroom\n", dev->name, head_need);
-#endif
-
-                if (skb_header_cloned(skb))
-                        I802_DEBUG_INC(local->tx_expand_skb_head_cloned);
-                else
-                        I802_DEBUG_INC(local->tx_expand_skb_head);
-                /* Since we have to reallocate the buffer, make sure that there
-                 * is enough room for possible WEP IV/ICV and TKIP (8 bytes
-                 * before payload and 12 after). */
-                if (pskb_expand_head(skb, (head_need > 0 ? head_need + 8 : 8),
-                                     12, GFP_ATOMIC)) {
-                        printk(KERN_DEBUG "%s: failed to reallocate TX buffer"
-                               "\n", dev->name);
+                head_need += IEEE80211_ENCRYPT_HEADROOM;
+                head_need += local->tx_headroom;
+                head_need = max_t(int, 0, head_need);
+                if (ieee80211_skb_resize(local, skb, head_need, true))
                         goto fail;
-                }
         }
 
         if (encaps_data) {
@@ -1614,14 +1603,14 @@ int ieee80211_subif_start_xmit(struct sk_buff *skb,
         nh_pos += hdrlen;
         h_pos += hdrlen;
 
-        pkt_data = (struct ieee80211_tx_packet_data *)skb->cb;
-        memset(pkt_data, 0, sizeof(struct ieee80211_tx_packet_data));
-        pkt_data->ifindex = dev->ifindex;
+        info = IEEE80211_SKB_CB(skb);
+        memset(info, 0, sizeof(*info));
+        info->control.ifindex = dev->ifindex;
         if (ethertype == ETH_P_PAE)
-                pkt_data->flags |= IEEE80211_TXPD_EAPOL_FRAME;
+                info->flags |= IEEE80211_TX_CTL_EAPOL_FRAME;
 
         /* Interfaces should always request a status report */
-        pkt_data->flags |= IEEE80211_TXPD_REQ_TX_STATUS;
+        info->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
 
         skb->dev = local->mdev;
         dev->stats.tx_packets++;
@@ -1646,46 +1635,55 @@ int ieee80211_subif_start_xmit(struct sk_buff *skb,
         return ret;
 }
 
-/* helper functions for pending packets for when queues are stopped */
 
+/*
+ * ieee80211_clear_tx_pending may not be called in a context where
+ * it is possible that it packets could come in again.
+ */
 void ieee80211_clear_tx_pending(struct ieee80211_local *local)
 {
         int i, j;
         struct ieee80211_tx_stored_packet *store;
 
-        for (i = 0; i < local->hw.queues; i++) {
-                if (!__ieee80211_queue_pending(local, i))
+        for (i = 0; i < ieee80211_num_regular_queues(&local->hw); i++) {
+                if (!test_bit(i, local->queues_pending))
                         continue;
                 store = &local->pending_packet[i];
                 kfree_skb(store->skb);
                 for (j = 0; j < store->num_extra_frag; j++)
                         kfree_skb(store->extra_frag[j]);
                 kfree(store->extra_frag);
-                clear_bit(IEEE80211_LINK_STATE_PENDING, &local->state[i]);
+                clear_bit(i, local->queues_pending);
         }
 }
 
+/*
+ * Transmit all pending packets. Called from tasklet, locks master device
+ * TX lock so that no new packets can come in.
+ */
 void ieee80211_tx_pending(unsigned long data)
 {
         struct ieee80211_local *local = (struct ieee80211_local *)data;
         struct net_device *dev = local->mdev;
         struct ieee80211_tx_stored_packet *store;
         struct ieee80211_tx_data tx;
-        int i, ret, reschedule = 0;
+        int i, ret;
 
         netif_tx_lock_bh(dev);
-        for (i = 0; i < local->hw.queues; i++) {
-                if (__ieee80211_queue_stopped(local, i))
+        for (i = 0; i < ieee80211_num_regular_queues(&local->hw); i++) {
+                /* Check that this queue is ok */
+                if (__netif_subqueue_stopped(local->mdev, i))
                         continue;
-                if (!__ieee80211_queue_pending(local, i)) {
-                        reschedule = 1;
+
+                if (!test_bit(i, local->queues_pending)) {
+                        ieee80211_wake_queue(&local->hw, i);
                         continue;
                 }
+
                 store = &local->pending_packet[i];
-                tx.control = &store->control;
                 tx.extra_frag = store->extra_frag;
                 tx.num_extra_frag = store->num_extra_frag;
-                tx.last_frag_rate = store->last_frag_rate;
+                tx.last_frag_rate_idx = store->last_frag_rate_idx;
                 tx.flags = 0;
                 if (store->last_frag_rate_ctrl_probe)
                         tx.flags |= IEEE80211_TX_PROBE_LAST_FRAG;
@@ -1694,19 +1692,11 @@ void ieee80211_tx_pending(unsigned long data)
                         if (ret == IEEE80211_TX_FRAG_AGAIN)
                                 store->skb = NULL;
                 } else {
-                        clear_bit(IEEE80211_LINK_STATE_PENDING,
-                                  &local->state[i]);
-                        reschedule = 1;
+                        clear_bit(i, local->queues_pending);
+                        ieee80211_wake_queue(&local->hw, i);
                 }
         }
         netif_tx_unlock_bh(dev);
-        if (reschedule) {
-                if (!ieee80211_qdisc_installed(dev)) {
-                        if (!__ieee80211_queue_stopped(local, 0))
-                                netif_wake_queue(dev);
-                } else
-                        netif_schedule(dev);
-        }
 }
 
 /* functions for drivers to get certain frames */
@@ -1775,11 +1765,11 @@ static void ieee80211_beacon_add_tim(struct ieee80211_local *local,
 }
 
 struct sk_buff *ieee80211_beacon_get(struct ieee80211_hw *hw,
-                                     struct ieee80211_vif *vif,
-                                     struct ieee80211_tx_control *control)
+                                     struct ieee80211_vif *vif)
 {
         struct ieee80211_local *local = hw_to_local(hw);
         struct sk_buff *skb;
+        struct ieee80211_tx_info *info;
         struct net_device *bdev;
         struct ieee80211_sub_if_data *sdata = NULL;
         struct ieee80211_if_ap *ap = NULL;
@@ -1789,9 +1779,10 @@ struct sk_buff *ieee80211_beacon_get(struct ieee80211_hw *hw,
         struct ieee80211_mgmt *mgmt;
         int *num_beacons;
         bool err = true;
+        enum ieee80211_band band = local->hw.conf.channel->band;
         u8 *pos;
 
-        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
+        sband = local->hw.wiphy->bands[band];
 
         rcu_read_lock();
 
@@ -1884,30 +1875,32 @@ struct sk_buff *ieee80211_beacon_get(struct ieee80211_hw *hw,
                 goto out;
         }
 
-        if (control) {
-                rate_control_get_rate(local->mdev, sband, skb, &rsel);
-                if (!rsel.rate) {
-                        if (net_ratelimit()) {
-                                printk(KERN_DEBUG "%s: ieee80211_beacon_get: "
-                                       "no rate found\n",
-                                       wiphy_name(local->hw.wiphy));
-                        }
-                        dev_kfree_skb(skb);
-                        skb = NULL;
-                        goto out;
-                }
+        info = IEEE80211_SKB_CB(skb);
 
-                control->vif = vif;
-                control->tx_rate = rsel.rate;
-                if (sdata->bss_conf.use_short_preamble &&
-                    rsel.rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
-                        control->flags |= IEEE80211_TXCTL_SHORT_PREAMBLE;
-                control->antenna_sel_tx = local->hw.conf.antenna_sel_tx;
-                control->flags |= IEEE80211_TXCTL_NO_ACK;
-                control->flags |= IEEE80211_TXCTL_DO_NOT_ENCRYPT;
-                control->retry_limit = 1;
-                control->flags |= IEEE80211_TXCTL_CLEAR_PS_FILT;
+        info->band = band;
+        rate_control_get_rate(local->mdev, sband, skb, &rsel);
+
+        if (unlikely(rsel.rate_idx < 0)) {
+                if (net_ratelimit()) {
+                        printk(KERN_DEBUG "%s: ieee80211_beacon_get: "
+                               "no rate found\n",
+                               wiphy_name(local->hw.wiphy));
+                }
+                dev_kfree_skb(skb);
+                skb = NULL;
+                goto out;
         }
+
+        info->control.vif = vif;
+        info->tx_rate_idx = rsel.rate_idx;
+        if (sdata->bss_conf.use_short_preamble &&
+            sband->bitrates[rsel.rate_idx].flags & IEEE80211_RATE_SHORT_PREAMBLE)
+                info->flags |= IEEE80211_TX_CTL_SHORT_PREAMBLE;
+        info->antenna_sel_tx = local->hw.conf.antenna_sel_tx;
+        info->flags |= IEEE80211_TX_CTL_NO_ACK;
+        info->flags |= IEEE80211_TX_CTL_DO_NOT_ENCRYPT;
+        info->control.retry_limit = 1;
+        info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT;
         (*num_beacons)++;
 out:
         rcu_read_unlock();
@@ -1917,7 +1910,7 @@ EXPORT_SYMBOL(ieee80211_beacon_get);
 
 void ieee80211_rts_get(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                        const void *frame, size_t frame_len,
-                       const struct ieee80211_tx_control *frame_txctl,
+                       const struct ieee80211_tx_info *frame_txctl,
                        struct ieee80211_rts *rts)
 {
         const struct ieee80211_hdr *hdr = frame;
@@ -1934,7 +1927,7 @@ EXPORT_SYMBOL(ieee80211_rts_get);
 
 void ieee80211_ctstoself_get(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                              const void *frame, size_t frame_len,
-                             const struct ieee80211_tx_control *frame_txctl,
+                             const struct ieee80211_tx_info *frame_txctl,
                              struct ieee80211_cts *cts)
 {
         const struct ieee80211_hdr *hdr = frame;
@@ -1950,11 +1943,10 @@ EXPORT_SYMBOL(ieee80211_ctstoself_get);
 
 struct sk_buff *
 ieee80211_get_buffered_bc(struct ieee80211_hw *hw,
-                          struct ieee80211_vif *vif,
-                          struct ieee80211_tx_control *control)
+                          struct ieee80211_vif *vif)
 {
         struct ieee80211_local *local = hw_to_local(hw);
-        struct sk_buff *skb;
+        struct sk_buff *skb = NULL;
         struct sta_info *sta;
         ieee80211_tx_handler *handler;
         struct ieee80211_tx_data tx;
@@ -1963,10 +1955,11 @@ ieee80211_get_buffered_bc(struct ieee80211_hw *hw,
         struct ieee80211_sub_if_data *sdata;
         struct ieee80211_if_ap *bss = NULL;
         struct beacon_data *beacon;
+        struct ieee80211_tx_info *info;
 
         sdata = vif_to_sdata(vif);
         bdev = sdata->dev;
-
+        bss = &sdata->u.ap;
 
         if (!bss)
                 return NULL;
@@ -1974,19 +1967,16 @@ ieee80211_get_buffered_bc(struct ieee80211_hw *hw,
         rcu_read_lock();
         beacon = rcu_dereference(bss->beacon);
 
-        if (sdata->vif.type != IEEE80211_IF_TYPE_AP || !beacon ||
-            !beacon->head) {
-                rcu_read_unlock();
-                return NULL;
-        }
+        if (sdata->vif.type != IEEE80211_IF_TYPE_AP || !beacon || !beacon->head)
+                goto out;
 
         if (bss->dtim_count != 0)
-                return NULL; /* send buffered bc/mc only after DTIM beacon */
-        memset(control, 0, sizeof(*control));
+                goto out; /* send buffered bc/mc only after DTIM beacon */
+
         while (1) {
                 skb = skb_dequeue(&bss->ps_bc_buf);
                 if (!skb)
-                        return NULL;
+                        goto out;
                 local->total_ps_buffered--;
 
                 if (!skb_queue_empty(&bss->ps_bc_buf) && skb->len >= 2) {
@@ -1999,20 +1989,26 @@ ieee80211_get_buffered_bc(struct ieee80211_hw *hw,
                                 cpu_to_le16(IEEE80211_FCTL_MOREDATA);
                 }
 
-                if (!ieee80211_tx_prepare(&tx, skb, local->mdev, control))
+                if (!ieee80211_tx_prepare(&tx, skb, local->mdev))
                         break;
                 dev_kfree_skb_any(skb);
         }
+
+        info = IEEE80211_SKB_CB(skb);
+
         sta = tx.sta;
         tx.flags |= IEEE80211_TX_PS_BUFFERED;
         tx.channel = local->hw.conf.channel;
+        info->band = tx.channel->band;
 
         for (handler = ieee80211_tx_handlers; *handler != NULL; handler++) {
                 res = (*handler)(&tx);
                 if (res == TX_DROP || res == TX_QUEUED)
                         break;
         }
-        skb = tx.skb; /* handlers are allowed to change skb */
+
+        if (WARN_ON(tx.skb != skb))
+                res = TX_DROP;
 
         if (res == TX_DROP) {
                 I802_DEBUG_INC(local->tx_handlers_drop);
@@ -2023,6 +2019,7 @@ ieee80211_get_buffered_bc(struct ieee80211_hw *hw,
                 skb = NULL;
         }
 
+out:
         rcu_read_unlock();
 
         return skb;
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 131e9e6c8a32..5a77e2c01f49 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -258,7 +258,7 @@ EXPORT_SYMBOL(ieee80211_generic_frame_duration);
 
 __le16 ieee80211_rts_duration(struct ieee80211_hw *hw,
                               struct ieee80211_vif *vif, size_t frame_len,
-                              const struct ieee80211_tx_control *frame_txctl)
+                              const struct ieee80211_tx_info *frame_txctl)
 {
         struct ieee80211_local *local = hw_to_local(hw);
         struct ieee80211_rate *rate;
@@ -266,10 +266,13 @@ __le16 ieee80211_rts_duration(struct ieee80211_hw *hw,
         bool short_preamble;
         int erp;
         u16 dur;
+        struct ieee80211_supported_band *sband;
+
+        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
 
         short_preamble = sdata->bss_conf.use_short_preamble;
 
-        rate = frame_txctl->rts_cts_rate;
+        rate = &sband->bitrates[frame_txctl->control.rts_cts_rate_idx];
 
         erp = 0;
         if (sdata->flags & IEEE80211_SDATA_OPERATING_GMODE)
@@ -292,7 +295,7 @@ EXPORT_SYMBOL(ieee80211_rts_duration);
 __le16 ieee80211_ctstoself_duration(struct ieee80211_hw *hw,
                                     struct ieee80211_vif *vif,
                                     size_t frame_len,
-                                    const struct ieee80211_tx_control *frame_txctl)
+                                    const struct ieee80211_tx_info *frame_txctl)
 {
         struct ieee80211_local *local = hw_to_local(hw);
         struct ieee80211_rate *rate;
@@ -300,10 +303,13 @@ __le16 ieee80211_ctstoself_duration(struct ieee80211_hw *hw,
         bool short_preamble;
         int erp;
         u16 dur;
+        struct ieee80211_supported_band *sband;
+
+        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
 
         short_preamble = sdata->bss_conf.use_short_preamble;
 
-        rate = frame_txctl->rts_cts_rate;
+        rate = &sband->bitrates[frame_txctl->control.rts_cts_rate_idx];
         erp = 0;
         if (sdata->flags & IEEE80211_SDATA_OPERATING_GMODE)
                 erp = rate->flags & IEEE80211_RATE_ERP_G;
@@ -311,7 +317,7 @@ __le16 ieee80211_ctstoself_duration(struct ieee80211_hw *hw,
         /* Data frame duration */
         dur = ieee80211_frame_duration(local, frame_len, rate->bitrate,
                                        erp, short_preamble);
-        if (!(frame_txctl->flags & IEEE80211_TXCTL_NO_ACK)) {
+        if (!(frame_txctl->flags & IEEE80211_TX_CTL_NO_ACK)) {
                 /* ACK duration */
                 dur += ieee80211_frame_duration(local, 10, rate->bitrate,
                                                 erp, short_preamble);
@@ -325,17 +331,15 @@ void ieee80211_wake_queue(struct ieee80211_hw *hw, int queue)
 {
         struct ieee80211_local *local = hw_to_local(hw);
 
-        if (test_and_clear_bit(IEEE80211_LINK_STATE_XOFF,
-                               &local->state[queue])) {
-                if (test_bit(IEEE80211_LINK_STATE_PENDING,
-                             &local->state[queue]))
-                        tasklet_schedule(&local->tx_pending_tasklet);
-                else
-                        if (!ieee80211_qdisc_installed(local->mdev)) {
-                                if (queue == 0)
-                                        netif_wake_queue(local->mdev);
-                        } else
-                                __netif_schedule(local->mdev);
+        if (test_bit(queue, local->queues_pending)) {
+                tasklet_schedule(&local->tx_pending_tasklet);
+        } else {
+                if (ieee80211_is_multiqueue(local)) {
+                        netif_wake_subqueue(local->mdev, queue);
+                } else {
+                        WARN_ON(queue != 0);
+                        netif_wake_queue(local->mdev);
+                }
         }
 }
 EXPORT_SYMBOL(ieee80211_wake_queue);
@@ -344,29 +348,20 @@ void ieee80211_stop_queue(struct ieee80211_hw *hw, int queue)
 {
         struct ieee80211_local *local = hw_to_local(hw);
 
-        if (!ieee80211_qdisc_installed(local->mdev) && queue == 0)
+        if (ieee80211_is_multiqueue(local)) {
+                netif_stop_subqueue(local->mdev, queue);
+        } else {
+                WARN_ON(queue != 0);
                 netif_stop_queue(local->mdev);
-        set_bit(IEEE80211_LINK_STATE_XOFF, &local->state[queue]);
+        }
 }
 EXPORT_SYMBOL(ieee80211_stop_queue);
 
-void ieee80211_start_queues(struct ieee80211_hw *hw)
-{
-        struct ieee80211_local *local = hw_to_local(hw);
-        int i;
-
-        for (i = 0; i < local->hw.queues; i++)
-                clear_bit(IEEE80211_LINK_STATE_XOFF, &local->state[i]);
-        if (!ieee80211_qdisc_installed(local->mdev))
-                netif_start_queue(local->mdev);
-}
-EXPORT_SYMBOL(ieee80211_start_queues);
-
 void ieee80211_stop_queues(struct ieee80211_hw *hw)
 {
         int i;
 
-        for (i = 0; i < hw->queues; i++)
+        for (i = 0; i < ieee80211_num_queues(hw); i++)
                 ieee80211_stop_queue(hw, i);
 }
 EXPORT_SYMBOL(ieee80211_stop_queues);
@@ -375,7 +370,7 @@ void ieee80211_wake_queues(struct ieee80211_hw *hw)
 {
         int i;
 
-        for (i = 0; i < hw->queues; i++)
+        for (i = 0; i < hw->queues + hw->ampdu_queues; i++)
                 ieee80211_wake_queue(hw, i);
 }
 EXPORT_SYMBOL(ieee80211_wake_queues);
diff --git a/net/mac80211/wep.c b/net/mac80211/wep.c
index 3cbae42ec504..e7b6344c900a 100644
--- a/net/mac80211/wep.c
+++ b/net/mac80211/wep.c
@@ -93,13 +93,9 @@ static u8 *ieee80211_wep_add_iv(struct ieee80211_local *local,
         fc |= IEEE80211_FCTL_PROTECTED;
         hdr->frame_control = cpu_to_le16(fc);
 
-        if ((skb_headroom(skb) < WEP_IV_LEN ||
-             skb_tailroom(skb) < WEP_ICV_LEN)) {
-                I802_DEBUG_INC(local->tx_expand_skb_head);
-                if (unlikely(pskb_expand_head(skb, WEP_IV_LEN, WEP_ICV_LEN,
-                                              GFP_ATOMIC)))
-                        return NULL;
-        }
+        if (WARN_ON(skb_tailroom(skb) < WEP_ICV_LEN ||
+                    skb_headroom(skb) < WEP_IV_LEN))
+                return NULL;
 
         hdrlen = ieee80211_get_hdrlen(fc);
         newhdr = skb_push(skb, WEP_IV_LEN);
@@ -333,11 +329,16 @@ ieee80211_crypto_wep_decrypt(struct ieee80211_rx_data *rx)
 
 static int wep_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
 {
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+
+        info->control.iv_len = WEP_IV_LEN;
+        info->control.icv_len = WEP_ICV_LEN;
+
         if (!(tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE)) {
                 if (ieee80211_wep_encrypt(tx->local, skb, tx->key))
                         return -1;
         } else {
-                tx->control->hw_key = &tx->key->conf;
+                info->control.hw_key = &tx->key->conf;
                 if (tx->key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV) {
                         if (!ieee80211_wep_add_iv(tx->local, skb, tx->key))
                                 return -1;
@@ -349,8 +350,6 @@ static int wep_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
 ieee80211_tx_result
 ieee80211_crypto_wep_encrypt(struct ieee80211_tx_data *tx)
 {
-        tx->control->iv_len = WEP_IV_LEN;
-        tx->control->icv_len = WEP_ICV_LEN;
         ieee80211_tx_set_protected(tx);
 
         if (wep_encrypt_skb(tx, tx->skb) < 0) {
diff --git a/net/mac80211/wme.c b/net/mac80211/wme.c
index c87baf4ce979..14a9ff10a1e9 100644
--- a/net/mac80211/wme.c
+++ b/net/mac80211/wme.c
@@ -149,8 +149,7 @@ static int wme_qdiscop_enqueue(struct sk_buff *skb, struct Qdisc* qd)
         struct ieee80211_local *local = wdev_priv(qd->dev->ieee80211_ptr);
         struct ieee80211_hw *hw = &local->hw;
         struct ieee80211_sched_data *q = qdisc_priv(qd);
-        struct ieee80211_tx_packet_data *pkt_data =
-                (struct ieee80211_tx_packet_data *) skb->cb;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
         unsigned short fc = le16_to_cpu(hdr->frame_control);
         struct Qdisc *qdisc;
@@ -158,8 +157,8 @@ static int wme_qdiscop_enqueue(struct sk_buff *skb, struct Qdisc* qd)
         int err, queue;
         u8 tid;
 
-        if (pkt_data->flags & IEEE80211_TXPD_REQUEUE) {
-                queue = pkt_data->queue;
+        if (info->flags & IEEE80211_TX_CTL_REQUEUE) {
+                queue = skb_get_queue_mapping(skb);
                 rcu_read_lock();
                 sta = sta_info_get(local, hdr->addr1);
                 tid = skb->priority & QOS_CONTROL_TAG1D_MASK;
@@ -168,9 +167,9 @@ static int wme_qdiscop_enqueue(struct sk_buff *skb, struct Qdisc* qd)
                         if ((ampdu_queue < QD_NUM(hw)) &&
                             test_bit(ampdu_queue, q->qdisc_pool)) {
                                 queue = ampdu_queue;
-                                pkt_data->flags |= IEEE80211_TXPD_AMPDU;
+                                info->flags |= IEEE80211_TX_CTL_AMPDU;
                         } else {
-                                pkt_data->flags &= ~IEEE80211_TXPD_AMPDU;
+                                info->flags &= ~IEEE80211_TX_CTL_AMPDU;
                         }
                 }
                 rcu_read_unlock();
@@ -206,9 +205,9 @@ static int wme_qdiscop_enqueue(struct sk_buff *skb, struct Qdisc* qd)
                         if ((ampdu_queue < QD_NUM(hw)) &&
                             test_bit(ampdu_queue, q->qdisc_pool)) {
                                 queue = ampdu_queue;
-                                pkt_data->flags |= IEEE80211_TXPD_AMPDU;
+                                info->flags |= IEEE80211_TX_CTL_AMPDU;
                         } else {
-                                pkt_data->flags &= ~IEEE80211_TXPD_AMPDU;
+                                info->flags &= ~IEEE80211_TX_CTL_AMPDU;
                         }
                 }
 
@@ -220,7 +219,7 @@ static int wme_qdiscop_enqueue(struct sk_buff *skb, struct Qdisc* qd)
                         err = NET_XMIT_DROP;
         } else {
                 tid = skb->priority & QOS_CONTROL_TAG1D_MASK;
-                pkt_data->queue = (unsigned int) queue;
+                skb_set_queue_mapping(skb, queue);
                 qdisc = q->queues[queue];
                 err = qdisc->enqueue(skb, qdisc);
                 if (err == NET_XMIT_SUCCESS) {
@@ -241,13 +240,11 @@ static int wme_qdiscop_enqueue(struct sk_buff *skb, struct Qdisc* qd)
 static int wme_qdiscop_requeue(struct sk_buff *skb, struct Qdisc* qd)
 {
         struct ieee80211_sched_data *q = qdisc_priv(qd);
-        struct ieee80211_tx_packet_data *pkt_data =
-                (struct ieee80211_tx_packet_data *) skb->cb;
         struct Qdisc *qdisc;
         int err;
 
         /* we recorded which queue to use earlier! */
-        qdisc = q->queues[pkt_data->queue];
+        qdisc = q->queues[skb_get_queue_mapping(skb)];
 
         if ((err = qdisc->ops->requeue(skb, qdisc)) == 0) {
                 qd->q.qlen++;
@@ -271,11 +268,8 @@ static struct sk_buff *wme_qdiscop_dequeue(struct Qdisc* qd)
         /* check all the h/w queues in numeric/priority order */
         for (queue = 0; queue < QD_NUM(hw); queue++) {
                 /* see if there is room in this hardware queue */
-                if ((test_bit(IEEE80211_LINK_STATE_XOFF,
-                                &local->state[queue])) ||
-                    (test_bit(IEEE80211_LINK_STATE_PENDING,
-                                &local->state[queue])) ||
-                         (!test_bit(queue, q->qdisc_pool)))
+                if (__netif_subqueue_stopped(local->mdev, queue) ||
+                    !test_bit(queue, q->qdisc_pool))
                         continue;
 
                 /* there is space - try and get a frame */
diff --git a/net/mac80211/wme.h b/net/mac80211/wme.h
index fcc6b05508cc..bbdb53344817 100644
--- a/net/mac80211/wme.h
+++ b/net/mac80211/wme.h
@@ -31,7 +31,7 @@ static inline int WLAN_FC_IS_QOS_DATA(u16 fc)
         return (fc & 0x8C) == 0x88;
 }
 
-#ifdef CONFIG_NET_SCHED
+#ifdef CONFIG_MAC80211_QOS
 void ieee80211_install_qdisc(struct net_device *dev);
 int ieee80211_qdisc_installed(struct net_device *dev);
 int ieee80211_ht_agg_queue_add(struct ieee80211_local *local,
diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c
index 42f3654e1c5e..9f6fd20374e1 100644
--- a/net/mac80211/wpa.c
+++ b/net/mac80211/wpa.c
@@ -79,6 +79,7 @@ ieee80211_tx_h_michael_mic_add(struct ieee80211_tx_data *tx)
         struct sk_buff *skb = tx->skb;
         int authenticator;
         int wpa_test = 0;
+        int tail;
 
         fc = tx->fc;
 
@@ -98,16 +99,13 @@ ieee80211_tx_h_michael_mic_add(struct ieee80211_tx_data *tx)
                 return TX_CONTINUE;
         }
 
-        if (skb_tailroom(skb) < MICHAEL_MIC_LEN) {
-                I802_DEBUG_INC(tx->local->tx_expand_skb_head);
-                if (unlikely(pskb_expand_head(skb, TKIP_IV_LEN,
-                                              MICHAEL_MIC_LEN + TKIP_ICV_LEN,
-                                              GFP_ATOMIC))) {
-                        printk(KERN_DEBUG "%s: failed to allocate more memory "
-                               "for Michael MIC\n", tx->dev->name);
-                        return TX_DROP;
-                }
-        }
+        tail = MICHAEL_MIC_LEN;
+        if (!(tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE))
+                tail += TKIP_ICV_LEN;
+
+        if (WARN_ON(skb_tailroom(skb) < tail ||
+                    skb_headroom(skb) < TKIP_IV_LEN))
+                return TX_DROP;
 
 #if 0
         authenticator = fc & IEEE80211_FCTL_FROMDS; /* FIX */
@@ -176,59 +174,65 @@ ieee80211_rx_h_michael_mic_verify(struct ieee80211_rx_data *rx)
         skb_trim(skb, skb->len - MICHAEL_MIC_LEN);
 
         /* update IV in key information to be able to detect replays */
-        rx->key->u.tkip.iv32_rx[rx->queue] = rx->tkip_iv32;
-        rx->key->u.tkip.iv16_rx[rx->queue] = rx->tkip_iv16;
+        rx->key->u.tkip.rx[rx->queue].iv32 = rx->tkip_iv32;
+        rx->key->u.tkip.rx[rx->queue].iv16 = rx->tkip_iv16;
 
         return RX_CONTINUE;
 }
 
 
-static int tkip_encrypt_skb(struct ieee80211_tx_data *tx,
-                            struct sk_buff *skb, int test)
+static int tkip_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
 {
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
         struct ieee80211_key *key = tx->key;
-        int hdrlen, len, tailneed;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+        int hdrlen, len, tail;
         u16 fc;
         u8 *pos;
 
+        info->control.icv_len = TKIP_ICV_LEN;
+        info->control.iv_len = TKIP_IV_LEN;
+
+        if ((tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) &&
+            !(tx->key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV)) {
+                /* hwaccel - with no need for preallocated room for IV/ICV */
+                info->control.hw_key = &tx->key->conf;
+                return 0;
+        }
+
         fc = le16_to_cpu(hdr->frame_control);
         hdrlen = ieee80211_get_hdrlen(fc);
         len = skb->len - hdrlen;
 
         if (tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE)
-                tailneed = 0;
+                tail = 0;
         else
-                tailneed = TKIP_ICV_LEN;
-
-        if ((skb_headroom(skb) < TKIP_IV_LEN ||
-             skb_tailroom(skb) < tailneed)) {
-                I802_DEBUG_INC(tx->local->tx_expand_skb_head);
-                if (unlikely(pskb_expand_head(skb, TKIP_IV_LEN, tailneed,
-                                              GFP_ATOMIC)))
-                        return -1;
-        }
+                tail = TKIP_ICV_LEN;
+
+        if (WARN_ON(skb_tailroom(skb) < tail ||
+                    skb_headroom(skb) < TKIP_IV_LEN))
+                return -1;
 
         pos = skb_push(skb, TKIP_IV_LEN);
         memmove(pos, pos + TKIP_IV_LEN, hdrlen);
         pos += hdrlen;
 
         /* Increase IV for the frame */
-        key->u.tkip.iv16++;
-        if (key->u.tkip.iv16 == 0)
-                key->u.tkip.iv32++;
+        key->u.tkip.tx.iv16++;
+        if (key->u.tkip.tx.iv16 == 0)
+                key->u.tkip.tx.iv32++;
 
         if (tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) {
                 hdr = (struct ieee80211_hdr *)skb->data;
 
                 /* hwaccel - with preallocated room for IV */
                 ieee80211_tkip_add_iv(pos, key,
-                                      (u8) (key->u.tkip.iv16 >> 8),
-                                      (u8) (((key->u.tkip.iv16 >> 8) | 0x20) &
+                                      (u8) (key->u.tkip.tx.iv16 >> 8),
+                                      (u8) (((key->u.tkip.tx.iv16 >> 8) | 0x20) &
                                             0x7f),
-                                      (u8) key->u.tkip.iv16);
+                                      (u8) key->u.tkip.tx.iv16);
 
-                tx->control->hw_key = &tx->key->conf;
+                info->control.hw_key = &tx->key->conf;
                 return 0;
         }
 
@@ -246,28 +250,16 @@ ieee80211_tx_result
 ieee80211_crypto_tkip_encrypt(struct ieee80211_tx_data *tx)
 {
         struct sk_buff *skb = tx->skb;
-        int wpa_test = 0, test = 0;
 
-        tx->control->icv_len = TKIP_ICV_LEN;
-        tx->control->iv_len = TKIP_IV_LEN;
         ieee80211_tx_set_protected(tx);
 
-        if ((tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) &&
-            !(tx->key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV) &&
-            !wpa_test) {
-                /* hwaccel - with no need for preallocated room for IV/ICV */
-                tx->control->hw_key = &tx->key->conf;
-                return TX_CONTINUE;
-        }
-
-        if (tkip_encrypt_skb(tx, skb, test) < 0)
+        if (tkip_encrypt_skb(tx, skb) < 0)
                 return TX_DROP;
 
         if (tx->extra_frag) {
                 int i;
                 for (i = 0; i < tx->num_extra_frag; i++) {
-                        if (tkip_encrypt_skb(tx, tx->extra_frag[i], test)
-                            < 0)
+                        if (tkip_encrypt_skb(tx, tx->extra_frag[i]) < 0)
                                 return TX_DROP;
                 }
         }
@@ -429,16 +421,27 @@ static inline int ccmp_hdr2pn(u8 *pn, u8 *hdr)
 }
 
 
-static int ccmp_encrypt_skb(struct ieee80211_tx_data *tx,
-                            struct sk_buff *skb, int test)
+static int ccmp_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
 {
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
         struct ieee80211_key *key = tx->key;
-        int hdrlen, len, tailneed;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+        int hdrlen, len, tail;
         u16 fc;
         u8 *pos, *pn, *b_0, *aad, *scratch;
         int i;
 
+        info->control.icv_len = CCMP_MIC_LEN;
+        info->control.iv_len = CCMP_HDR_LEN;
+
+        if ((tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) &&
+            !(tx->key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV)) {
+                /* hwaccel - with no need for preallocated room for CCMP "
+                 * header or MIC fields */
+                info->control.hw_key = &tx->key->conf;
+                return 0;
+        }
+
         scratch = key->u.ccmp.tx_crypto_buf;
         b_0 = scratch + 3 * AES_BLOCK_LEN;
         aad = scratch + 4 * AES_BLOCK_LEN;
@@ -448,17 +451,13 @@ static int ccmp_encrypt_skb(struct ieee80211_tx_data *tx,
         len = skb->len - hdrlen;
 
         if (key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE)
-                tailneed = 0;
+                tail = 0;
         else
-                tailneed = CCMP_MIC_LEN;
-
-        if ((skb_headroom(skb) < CCMP_HDR_LEN ||
-             skb_tailroom(skb) < tailneed)) {
-                I802_DEBUG_INC(tx->local->tx_expand_skb_head);
-                if (unlikely(pskb_expand_head(skb, CCMP_HDR_LEN, tailneed,
-                                              GFP_ATOMIC)))
-                        return -1;
-        }
+                tail = CCMP_MIC_LEN;
+
+        if (WARN_ON(skb_tailroom(skb) < tail ||
+                    skb_headroom(skb) < CCMP_HDR_LEN))
+                return -1;
 
         pos = skb_push(skb, CCMP_HDR_LEN);
         memmove(pos, pos + CCMP_HDR_LEN, hdrlen);
@@ -478,7 +477,7 @@ static int ccmp_encrypt_skb(struct ieee80211_tx_data *tx,
 
         if (key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) {
                 /* hwaccel - with preallocated room for CCMP header */
-                tx->control->hw_key = &tx->key->conf;
+                info->control.hw_key = &tx->key->conf;
                 return 0;
         }
 
@@ -495,28 +494,16 @@ ieee80211_tx_result
 ieee80211_crypto_ccmp_encrypt(struct ieee80211_tx_data *tx)
 {
         struct sk_buff *skb = tx->skb;
-        int test = 0;
 
-        tx->control->icv_len = CCMP_MIC_LEN;
-        tx->control->iv_len = CCMP_HDR_LEN;
         ieee80211_tx_set_protected(tx);
 
-        if ((tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) &&
-            !(tx->key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV)) {
-                /* hwaccel - with no need for preallocated room for CCMP "
-                 * header or MIC fields */
-                tx->control->hw_key = &tx->key->conf;
-                return TX_CONTINUE;
-        }
-
-        if (ccmp_encrypt_skb(tx, skb, test) < 0)
+        if (ccmp_encrypt_skb(tx, skb) < 0)
                 return TX_DROP;
 
         if (tx->extra_frag) {
                 int i;
                 for (i = 0; i < tx->num_extra_frag; i++) {
-                        if (ccmp_encrypt_skb(tx, tx->extra_frag[i], test)
-                            < 0)
+                        if (ccmp_encrypt_skb(tx, tx->extra_frag[i]) < 0)
                                 return TX_DROP;
                 }
         }