Merge tag 'master-2014-11-04' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next

John W. Linville says:

====================
pull request: wireless-next 2014-11-07

Please pull this batch of updates intended for the 3.19 stream!

For the mac80211 bits, Johannes says:

"This relatively large batch of changes is comprised of the following:
 * large mac80211-hwsim changes from Ben, Jukka and a bit myself
 * OCB/WAVE/11p support from Rostislav on behalf of the Czech Technical
   University in Prague and Volkswagen Group Research
 * minstrel VHT work from Karl
 * more CSA work from Luca
 * WMM admission control support in mac80211 (myself)
 * various smaller fixes, spelling corrections, and minor API additions"

For the Bluetooth bits, Johan says:

"Here's the first bluetooth-next pull request for 3.19. The vast majority
of patches are for ieee802154 from Alexander Aring with various fixes
and cleanups. There are also several LE/SMP fixes as well as improved
support for handling LE devices that have lost their pairing information
(the patches from Alfonso). Jukka provides a couple of stability fixes
for 6lowpan and Szymon conformance fixes for RFCOMM. For the HCI drivers
we have one new USB ID for an Acer controller as well as a reset
handling fix for H5."

For the Atheros bits, Kalle says:

"Major changes are:

o ethtool support (Ben)

o print dev string prefix with debug hex buffers dump (Michal)

o debugfs file to read calibration data from the firmware verification
  purposes (me)

o fix fw_stats debugfs file, now results are more reliable (Michal)

o firmware crash counters via debugfs (Ben&me)

o various tracing points to debug firmware (Rajkumar)

o make it possible to provide firmware calibration data via a file (me)

And we have quite a lot of smaller fixes and clean up."

For the iwlwifi bits, Emmanuel says:

"The big new thing here is netdetect which allows the
firmware to wake up the platform when a specific network
is detected. Along with that I have fixes for d3 operation.
The usual amount of rate scaling stuff - we now support STBC.
The other commit that stands out is Johannes's work on
devcoredump. He basically starts to use the standard
infrastructure he built."

Along with that are the usual sort of updates and such for ath9k,
brcmfmac, wil6210, and a handful of other bits here and there...

Please let me know if there are problems!
====================

Signed-off-by: David S. Miller <davem@davemloft.net>

83 files changed, 4065 insertions, 2176 deletions

diff --git a/net/6lowpan/iphc.c b/net/6lowpan/iphc.c
index 142eef55c9e2..73a7065f0c6b 100644
--- a/net/6lowpan/iphc.c
+++ b/net/6lowpan/iphc.c
@@ -171,37 +171,6 @@ static int uncompress_context_based_src_addr(struct sk_buff *skb,
         return 0;
 }
 
-static int skb_deliver(struct sk_buff *skb, struct ipv6hdr *hdr,
-                       struct net_device *dev, skb_delivery_cb deliver_skb)
-{
-        struct sk_buff *new;
-        int stat;
-
-        new = skb_copy_expand(skb, sizeof(struct ipv6hdr), skb_tailroom(skb),
-                              GFP_ATOMIC);
-        kfree_skb(skb);
-
-        if (!new)
-                return -ENOMEM;
-
-        skb_push(new, sizeof(struct ipv6hdr));
-        skb_reset_network_header(new);
-        skb_copy_to_linear_data(new, hdr, sizeof(struct ipv6hdr));
-
-        new->protocol = htons(ETH_P_IPV6);
-        new->pkt_type = PACKET_HOST;
-        new->dev = dev;
-
-        raw_dump_table(__func__, "raw skb data dump before receiving",
-                       new->data, new->len);
-
-        stat = deliver_skb(new, dev);
-
-        kfree_skb(new);
-
-        return stat;
-}
-
 /* Uncompress function for multicast destination address,
  * when M bit is set.
  */
@@ -332,10 +301,12 @@ err:
 /* TTL uncompression values */
 static const u8 lowpan_ttl_values[] = { 0, 1, 64, 255 };
 
-int lowpan_process_data(struct sk_buff *skb, struct net_device *dev,
-                        const u8 *saddr, const u8 saddr_type, const u8 saddr_len,
-                        const u8 *daddr, const u8 daddr_type, const u8 daddr_len,
-                        u8 iphc0, u8 iphc1, skb_delivery_cb deliver_skb)
+int
+lowpan_header_decompress(struct sk_buff *skb, struct net_device *dev,
+                         const u8 *saddr, const u8 saddr_type,
+                         const u8 saddr_len, const u8 *daddr,
+                         const u8 daddr_type, const u8 daddr_len,
+                         u8 iphc0, u8 iphc1)
 {
         struct ipv6hdr hdr = {};
         u8 tmp, num_context = 0;
@@ -460,7 +431,7 @@ int lowpan_process_data(struct sk_buff *skb, struct net_device *dev,
         /* UDP data uncompression */
         if (iphc0 & LOWPAN_IPHC_NH_C) {
                 struct udphdr uh;
-                struct sk_buff *new;
+                const int needed = sizeof(struct udphdr) + sizeof(hdr);
 
                 if (uncompress_udp_header(skb, &uh))
                         goto drop;
@@ -468,14 +439,11 @@ int lowpan_process_data(struct sk_buff *skb, struct net_device *dev,
                 /* replace the compressed UDP head by the uncompressed UDP
                  * header
                  */
-                new = skb_copy_expand(skb, sizeof(struct udphdr),
-                                      skb_tailroom(skb), GFP_ATOMIC);
-                kfree_skb(skb);
-
-                if (!new)
-                        return -ENOMEM;
-
-                skb = new;
+                err = skb_cow(skb, needed);
+                if (unlikely(err)) {
+                        kfree_skb(skb);
+                        return err;
+                }
 
                 skb_push(skb, sizeof(struct udphdr));
                 skb_reset_transport_header(skb);
@@ -485,6 +453,12 @@ int lowpan_process_data(struct sk_buff *skb, struct net_device *dev,
                                (u8 *)&uh, sizeof(uh));
 
                 hdr.nexthdr = UIP_PROTO_UDP;
+        } else {
+                err = skb_cow(skb, sizeof(hdr));
+                if (unlikely(err)) {
+                        kfree_skb(skb);
+                        return err;
+                }
         }
 
         hdr.payload_len = htons(skb->len);
@@ -497,15 +471,18 @@ int lowpan_process_data(struct sk_buff *skb, struct net_device *dev,
                 hdr.version, ntohs(hdr.payload_len), hdr.nexthdr,
                 hdr.hop_limit, &hdr.daddr);
 
-        raw_dump_table(__func__, "raw header dump", (u8 *)&hdr, sizeof(hdr));
+        skb_push(skb, sizeof(hdr));
+        skb_reset_network_header(skb);
+        skb_copy_to_linear_data(skb, &hdr, sizeof(hdr));
 
-        return skb_deliver(skb, &hdr, dev, deliver_skb);
+        raw_dump_table(__func__, "raw header dump", (u8 *)&hdr, sizeof(hdr));
 
+        return 0;
 drop:
         kfree_skb(skb);
         return -EINVAL;
 }
-EXPORT_SYMBOL_GPL(lowpan_process_data);
+EXPORT_SYMBOL_GPL(lowpan_header_decompress);
 
 static u8 lowpan_compress_addr_64(u8 **hc_ptr, u8 shift,
                                   const struct in6_addr *ipaddr,
diff --git a/net/bluetooth/6lowpan.c b/net/bluetooth/6lowpan.c
index c2e0d14433df..eef298d17452 100644
--- a/net/bluetooth/6lowpan.c
+++ b/net/bluetooth/6lowpan.c
@@ -53,7 +53,7 @@ struct skb_cb {
  * The list contains struct lowpan_dev elements.
  */
 static LIST_HEAD(bt_6lowpan_devices);
-static DEFINE_RWLOCK(devices_lock);
+static DEFINE_SPINLOCK(devices_lock);
 
 /* If psm is set to 0 (default value), then 6lowpan is disabled.
  * Other values are used to indicate a Protocol Service Multiplexer
@@ -67,6 +67,7 @@ static struct l2cap_chan *listen_chan;
 
 struct lowpan_peer {
         struct list_head list;
+        struct rcu_head rcu;
         struct l2cap_chan *chan;
 
         /* peer addresses in various formats */
@@ -86,6 +87,13 @@ struct lowpan_dev {
         struct delayed_work notify_peers;
 };
 
+static inline void peer_free(struct rcu_head *head)
+{
+        struct lowpan_peer *e = container_of(head, struct lowpan_peer, rcu);
+
+        kfree(e);
+}
+
 static inline struct lowpan_dev *lowpan_dev(const struct net_device *netdev)
 {
         return netdev_priv(netdev);
@@ -93,13 +101,14 @@ static inline struct lowpan_dev *lowpan_dev(const struct net_device *netdev)
 
 static inline void peer_add(struct lowpan_dev *dev, struct lowpan_peer *peer)
 {
-        list_add(&peer->list, &dev->peers);
+        list_add_rcu(&peer->list, &dev->peers);
         atomic_inc(&dev->peer_count);
 }
 
 static inline bool peer_del(struct lowpan_dev *dev, struct lowpan_peer *peer)
 {
-        list_del(&peer->list);
+        list_del_rcu(&peer->list);
+        call_rcu(&peer->rcu, peer_free);
 
         module_put(THIS_MODULE);
 
@@ -114,31 +123,37 @@ static inline bool peer_del(struct lowpan_dev *dev, struct lowpan_peer *peer)
 static inline struct lowpan_peer *peer_lookup_ba(struct lowpan_dev *dev,
                                                  bdaddr_t *ba, __u8 type)
 {
-        struct lowpan_peer *peer, *tmp;
+        struct lowpan_peer *peer;
 
         BT_DBG("peers %d addr %pMR type %d", atomic_read(&dev->peer_count),
                ba, type);
 
-        list_for_each_entry_safe(peer, tmp, &dev->peers, list) {
+        rcu_read_lock();
+
+        list_for_each_entry_rcu(peer, &dev->peers, list) {
                 BT_DBG("dst addr %pMR dst type %d",
                        &peer->chan->dst, peer->chan->dst_type);
 
                 if (bacmp(&peer->chan->dst, ba))
                         continue;
 
-                if (type == peer->chan->dst_type)
+                if (type == peer->chan->dst_type) {
+                        rcu_read_unlock();
                         return peer;
+                }
         }
 
+        rcu_read_unlock();
+
         return NULL;
 }
 
-static inline struct lowpan_peer *peer_lookup_chan(struct lowpan_dev *dev,
-                                                   struct l2cap_chan *chan)
+static inline struct lowpan_peer *__peer_lookup_chan(struct lowpan_dev *dev,
+                                                     struct l2cap_chan *chan)
 {
-        struct lowpan_peer *peer, *tmp;
+        struct lowpan_peer *peer;
 
-        list_for_each_entry_safe(peer, tmp, &dev->peers, list) {
+        list_for_each_entry_rcu(peer, &dev->peers, list) {
                 if (peer->chan == chan)
                         return peer;
         }
@@ -146,12 +161,12 @@ static inline struct lowpan_peer *peer_lookup_chan(struct lowpan_dev *dev,
         return NULL;
 }
 
-static inline struct lowpan_peer *peer_lookup_conn(struct lowpan_dev *dev,
-                                                   struct l2cap_conn *conn)
+static inline struct lowpan_peer *__peer_lookup_conn(struct lowpan_dev *dev,
+                                                     struct l2cap_conn *conn)
 {
-        struct lowpan_peer *peer, *tmp;
+        struct lowpan_peer *peer;
 
-        list_for_each_entry_safe(peer, tmp, &dev->peers, list) {
+        list_for_each_entry_rcu(peer, &dev->peers, list) {
                 if (peer->chan->conn == conn)
                         return peer;
         }
@@ -163,7 +178,7 @@ static inline struct lowpan_peer *peer_lookup_dst(struct lowpan_dev *dev,
                                                   struct in6_addr *daddr,
                                                   struct sk_buff *skb)
 {
-        struct lowpan_peer *peer, *tmp;
+        struct lowpan_peer *peer;
         struct in6_addr *nexthop;
         struct rt6_info *rt = (struct rt6_info *)skb_dst(skb);
         int count = atomic_read(&dev->peer_count);
@@ -174,9 +189,13 @@ static inline struct lowpan_peer *peer_lookup_dst(struct lowpan_dev *dev,
          * send the packet. If only one peer exists, then we can send the
          * packet right away.
          */
-        if (count == 1)
-                return list_first_entry(&dev->peers, struct lowpan_peer,
-                                        list);
+        if (count == 1) {
+                rcu_read_lock();
+                peer = list_first_or_null_rcu(&dev->peers, struct lowpan_peer,
+                                              list);
+                rcu_read_unlock();
+                return peer;
+        }
 
         if (!rt) {
                 nexthop = &lowpan_cb(skb)->gw;
@@ -195,53 +214,57 @@ static inline struct lowpan_peer *peer_lookup_dst(struct lowpan_dev *dev,
 
         BT_DBG("gw %pI6c", nexthop);
 
-        list_for_each_entry_safe(peer, tmp, &dev->peers, list) {
+        rcu_read_lock();
+
+        list_for_each_entry_rcu(peer, &dev->peers, list) {
                 BT_DBG("dst addr %pMR dst type %d ip %pI6c",
                        &peer->chan->dst, peer->chan->dst_type,
                        &peer->peer_addr);
 
-                if (!ipv6_addr_cmp(&peer->peer_addr, nexthop))
+                if (!ipv6_addr_cmp(&peer->peer_addr, nexthop)) {
+                        rcu_read_unlock();
                         return peer;
+                }
         }
 
+        rcu_read_unlock();
+
         return NULL;
 }
 
 static struct lowpan_peer *lookup_peer(struct l2cap_conn *conn)
 {
-        struct lowpan_dev *entry, *tmp;
+        struct lowpan_dev *entry;
         struct lowpan_peer *peer = NULL;
-        unsigned long flags;
 
-        read_lock_irqsave(&devices_lock, flags);
+        rcu_read_lock();
 
-        list_for_each_entry_safe(entry, tmp, &bt_6lowpan_devices, list) {
-                peer = peer_lookup_conn(entry, conn);
+        list_for_each_entry_rcu(entry, &bt_6lowpan_devices, list) {
+                peer = __peer_lookup_conn(entry, conn);
                 if (peer)
                         break;
         }
 
-        read_unlock_irqrestore(&devices_lock, flags);
+        rcu_read_unlock();
 
         return peer;
 }
 
 static struct lowpan_dev *lookup_dev(struct l2cap_conn *conn)
 {
-        struct lowpan_dev *entry, *tmp;
+        struct lowpan_dev *entry;
         struct lowpan_dev *dev = NULL;
-        unsigned long flags;
 
-        read_lock_irqsave(&devices_lock, flags);
+        rcu_read_lock();
 
-        list_for_each_entry_safe(entry, tmp, &bt_6lowpan_devices, list) {
+        list_for_each_entry_rcu(entry, &bt_6lowpan_devices, list) {
                 if (conn->hcon->hdev == entry->hdev) {
                         dev = entry;
                         break;
                 }
         }
 
-        read_unlock_irqrestore(&devices_lock, flags);
+        rcu_read_unlock();
 
         return dev;
 }
@@ -249,35 +272,27 @@ static struct lowpan_dev *lookup_dev(struct l2cap_conn *conn)
 static int give_skb_to_upper(struct sk_buff *skb, struct net_device *dev)
 {
         struct sk_buff *skb_cp;
-        int ret;
 
         skb_cp = skb_copy(skb, GFP_ATOMIC);
         if (!skb_cp)
-                return -ENOMEM;
-
-        ret = netif_rx(skb_cp);
-        if (ret < 0) {
-                BT_DBG("receive skb %d", ret);
                 return NET_RX_DROP;
-        }
 
-        return ret;
+        return netif_rx(skb_cp);
 }
 
-static int process_data(struct sk_buff *skb, struct net_device *netdev,
-                        struct l2cap_chan *chan)
+static int iphc_decompress(struct sk_buff *skb, struct net_device *netdev,
+                           struct l2cap_chan *chan)
 {
         const u8 *saddr, *daddr;
         u8 iphc0, iphc1;
         struct lowpan_dev *dev;
         struct lowpan_peer *peer;
-        unsigned long flags;
 
         dev = lowpan_dev(netdev);
 
-        read_lock_irqsave(&devices_lock, flags);
-        peer = peer_lookup_chan(dev, chan);
-        read_unlock_irqrestore(&devices_lock, flags);
+        rcu_read_lock();
+        peer = __peer_lookup_chan(dev, chan);
+        rcu_read_unlock();
         if (!peer)
                 goto drop;
 
@@ -294,10 +309,11 @@ static int process_data(struct sk_buff *skb, struct net_device *netdev,
         if (lowpan_fetch_skb_u8(skb, &iphc1))
                 goto drop;
 
-        return lowpan_process_data(skb, netdev,
-                                   saddr, IEEE802154_ADDR_LONG, EUI64_ADDR_LEN,
-                                   daddr, IEEE802154_ADDR_LONG, EUI64_ADDR_LEN,
-                                   iphc0, iphc1, give_skb_to_upper);
+        return lowpan_header_decompress(skb, netdev,
+                                        saddr, IEEE802154_ADDR_LONG,
+                                        EUI64_ADDR_LEN, daddr,
+                                        IEEE802154_ADDR_LONG, EUI64_ADDR_LEN,
+                                        iphc0, iphc1);
 
 drop:
         kfree_skb(skb);
@@ -316,6 +332,10 @@ static int recv_pkt(struct sk_buff *skb, struct net_device *dev,
         if (dev->type != ARPHRD_6LOWPAN)
                 goto drop;
 
+        skb = skb_share_check(skb, GFP_ATOMIC);
+        if (!skb)
+                goto drop;
+
         /* check that it's our buffer */
         if (skb->data[0] == LOWPAN_DISPATCH_IPV6) {
                 /* Copy the packet so that the IPv6 header is
@@ -340,8 +360,8 @@ static int recv_pkt(struct sk_buff *skb, struct net_device *dev,
                 dev->stats.rx_bytes += skb->len;
                 dev->stats.rx_packets++;
 
-                kfree_skb(local_skb);
-                kfree_skb(skb);
+                consume_skb(local_skb);
+                consume_skb(skb);
         } else {
                 switch (skb->data[0] & 0xe0) {
                 case LOWPAN_DISPATCH_IPHC:      /* ipv6 datagram */
@@ -349,14 +369,25 @@ static int recv_pkt(struct sk_buff *skb, struct net_device *dev,
                         if (!local_skb)
                                 goto drop;
 
-                        ret = process_data(local_skb, dev, chan);
-                        if (ret != NET_RX_SUCCESS)
+                        ret = iphc_decompress(local_skb, dev, chan);
+                        if (ret < 0)
                                 goto drop;
 
+                        local_skb->protocol = htons(ETH_P_IPV6);
+                        local_skb->pkt_type = PACKET_HOST;
+                        local_skb->dev = dev;
+
+                        if (give_skb_to_upper(local_skb, dev)
+                                        != NET_RX_SUCCESS) {
+                                kfree_skb(local_skb);
+                                goto drop;
+                        }
+
                         dev->stats.rx_bytes += skb->len;
                         dev->stats.rx_packets++;
 
-                        kfree_skb(skb);
+                        consume_skb(local_skb);
+                        consume_skb(skb);
                         break;
                 default:
                         break;
@@ -443,7 +474,6 @@ static int setup_header(struct sk_buff *skb, struct net_device *netdev,
         if (ipv6_addr_is_multicast(&ipv6_daddr)) {
                 lowpan_cb(skb)->chan = NULL;
         } else {
-                unsigned long flags;
                 u8 addr_type;
 
                 /* Get destination BT device from skb.
@@ -454,19 +484,14 @@ static int setup_header(struct sk_buff *skb, struct net_device *netdev,
                 BT_DBG("dest addr %pMR type %d IP %pI6c", &addr,
                        addr_type, &ipv6_daddr);
 
-                read_lock_irqsave(&devices_lock, flags);
                 peer = peer_lookup_ba(dev, &addr, addr_type);
-                read_unlock_irqrestore(&devices_lock, flags);
-
                 if (!peer) {
                         /* The packet might be sent to 6lowpan interface
                          * because of routing (either via default route
                          * or user set route) so get peer according to
                          * the destination address.
                          */
-                        read_lock_irqsave(&devices_lock, flags);
                         peer = peer_lookup_dst(dev, &ipv6_daddr, skb);
-                        read_unlock_irqrestore(&devices_lock, flags);
                         if (!peer) {
                                 BT_DBG("no such peer %pMR found", &addr);
                                 return -ENOENT;
@@ -549,14 +574,13 @@ static int send_pkt(struct l2cap_chan *chan, struct sk_buff *skb,
 static int send_mcast_pkt(struct sk_buff *skb, struct net_device *netdev)
 {
         struct sk_buff *local_skb;
-        struct lowpan_dev *entry, *tmp;
-        unsigned long flags;
+        struct lowpan_dev *entry;
         int err = 0;
 
-        read_lock_irqsave(&devices_lock, flags);
+        rcu_read_lock();
 
-        list_for_each_entry_safe(entry, tmp, &bt_6lowpan_devices, list) {
-                struct lowpan_peer *pentry, *ptmp;
+        list_for_each_entry_rcu(entry, &bt_6lowpan_devices, list) {
+                struct lowpan_peer *pentry;
                 struct lowpan_dev *dev;
 
                 if (entry->netdev != netdev)
@@ -564,7 +588,7 @@ static int send_mcast_pkt(struct sk_buff *skb, struct net_device *netdev)
 
                 dev = lowpan_dev(entry->netdev);
 
-                list_for_each_entry_safe(pentry, ptmp, &dev->peers, list) {
+                list_for_each_entry_rcu(pentry, &dev->peers, list) {
                         int ret;
 
                         local_skb = skb_clone(skb, GFP_ATOMIC);
@@ -581,7 +605,7 @@ static int send_mcast_pkt(struct sk_buff *skb, struct net_device *netdev)
                 }
         }
 
-        read_unlock_irqrestore(&devices_lock, flags);
+        rcu_read_unlock();
 
         return err;
 }
@@ -638,7 +662,26 @@ static netdev_tx_t bt_xmit(struct sk_buff *skb, struct net_device *netdev)
         return err < 0 ? NET_XMIT_DROP : err;
 }
 
+static struct lock_class_key bt_tx_busylock;
+static struct lock_class_key bt_netdev_xmit_lock_key;
+
+static void bt_set_lockdep_class_one(struct net_device *dev,
+                                     struct netdev_queue *txq,
+                                     void *_unused)
+{
+        lockdep_set_class(&txq->_xmit_lock, &bt_netdev_xmit_lock_key);
+}
+
+static int bt_dev_init(struct net_device *dev)
+{
+        netdev_for_each_tx_queue(dev, bt_set_lockdep_class_one, NULL);
+        dev->qdisc_tx_busylock = &bt_tx_busylock;
+
+        return 0;
+}
+
 static const struct net_device_ops netdev_ops = {
+        .ndo_init               = bt_dev_init,
         .ndo_start_xmit         = bt_xmit,
 };
 
@@ -783,7 +826,6 @@ static struct l2cap_chan *add_peer_chan(struct l2cap_chan *chan,
                                         struct lowpan_dev *dev)
 {
         struct lowpan_peer *peer;
-        unsigned long flags;
 
         peer = kzalloc(sizeof(*peer), GFP_ATOMIC);
         if (!peer)
@@ -806,10 +848,10 @@ static struct l2cap_chan *add_peer_chan(struct l2cap_chan *chan,
          */
         set_ip_addr_bits(chan->dst_type, (u8 *)&peer->peer_addr.s6_addr + 8);
 
-        write_lock_irqsave(&devices_lock, flags);
+        spin_lock(&devices_lock);
         INIT_LIST_HEAD(&peer->list);
         peer_add(dev, peer);
-        write_unlock_irqrestore(&devices_lock, flags);
+        spin_unlock(&devices_lock);
 
         /* Notifying peers about us needs to be done without locks held */
         INIT_DELAYED_WORK(&dev->notify_peers, do_notify_peers);
@@ -822,7 +864,6 @@ static int setup_netdev(struct l2cap_chan *chan, struct lowpan_dev **dev)
 {
         struct net_device *netdev;
         int err = 0;
-        unsigned long flags;
 
         netdev = alloc_netdev(sizeof(struct lowpan_dev), IFACE_NAME_TEMPLATE,
                               NET_NAME_UNKNOWN, netdev_setup);
@@ -852,10 +893,10 @@ static int setup_netdev(struct l2cap_chan *chan, struct lowpan_dev **dev)
         (*dev)->hdev = chan->conn->hcon->hdev;
         INIT_LIST_HEAD(&(*dev)->peers);
 
-        write_lock_irqsave(&devices_lock, flags);
+        spin_lock(&devices_lock);
         INIT_LIST_HEAD(&(*dev)->list);
-        list_add(&(*dev)->list, &bt_6lowpan_devices);
-        write_unlock_irqrestore(&devices_lock, flags);
+        list_add_rcu(&(*dev)->list, &bt_6lowpan_devices);
+        spin_unlock(&devices_lock);
 
         return 0;
 
@@ -909,11 +950,10 @@ static void delete_netdev(struct work_struct *work)
 
 static void chan_close_cb(struct l2cap_chan *chan)
 {
-        struct lowpan_dev *entry, *tmp;
+        struct lowpan_dev *entry;
         struct lowpan_dev *dev = NULL;
         struct lowpan_peer *peer;
         int err = -ENOENT;
-        unsigned long flags;
         bool last = false, removed = true;
 
         BT_DBG("chan %p conn %p", chan, chan->conn);
@@ -928,11 +968,11 @@ static void chan_close_cb(struct l2cap_chan *chan)
                 removed = false;
         }
 
-        write_lock_irqsave(&devices_lock, flags);
+        spin_lock(&devices_lock);
 
-        list_for_each_entry_safe(entry, tmp, &bt_6lowpan_devices, list) {
+        list_for_each_entry_rcu(entry, &bt_6lowpan_devices, list) {
                 dev = lowpan_dev(entry->netdev);
-                peer = peer_lookup_chan(dev, chan);
+                peer = __peer_lookup_chan(dev, chan);
                 if (peer) {
                         last = peer_del(dev, peer);
                         err = 0;
@@ -943,13 +983,12 @@ static void chan_close_cb(struct l2cap_chan *chan)
                                atomic_read(&chan->kref.refcount));
 
                         l2cap_chan_put(chan);
-                        kfree(peer);
                         break;
                 }
         }
 
         if (!err && last && dev && !atomic_read(&dev->peer_count)) {
-                write_unlock_irqrestore(&devices_lock, flags);
+                spin_unlock(&devices_lock);
 
                 cancel_delayed_work_sync(&dev->notify_peers);
 
@@ -960,7 +999,7 @@ static void chan_close_cb(struct l2cap_chan *chan)
                         schedule_work(&entry->delete_netdev);
                 }
         } else {
-                write_unlock_irqrestore(&devices_lock, flags);
+                spin_unlock(&devices_lock);
         }
 
         return;
@@ -1152,10 +1191,9 @@ static int get_l2cap_conn(char *buf, bdaddr_t *addr, u8 *addr_type,
 
 static void disconnect_all_peers(void)
 {
-        struct lowpan_dev *entry, *tmp_dev;
+        struct lowpan_dev *entry;
         struct lowpan_peer *peer, *tmp_peer, *new_peer;
         struct list_head peers;
-        unsigned long flags;
 
         INIT_LIST_HEAD(&peers);
 
@@ -1164,10 +1202,10 @@ static void disconnect_all_peers(void)
          * with the same list at the same time.
          */
 
-        read_lock_irqsave(&devices_lock, flags);
+        rcu_read_lock();
 
-        list_for_each_entry_safe(entry, tmp_dev, &bt_6lowpan_devices, list) {
-                list_for_each_entry_safe(peer, tmp_peer, &entry->peers, list) {
+        list_for_each_entry_rcu(entry, &bt_6lowpan_devices, list) {
+                list_for_each_entry_rcu(peer, &entry->peers, list) {
                         new_peer = kmalloc(sizeof(*new_peer), GFP_ATOMIC);
                         if (!new_peer)
                                 break;
@@ -1179,26 +1217,36 @@ static void disconnect_all_peers(void)
                 }
         }
 
-        read_unlock_irqrestore(&devices_lock, flags);
+        rcu_read_unlock();
 
+        spin_lock(&devices_lock);
         list_for_each_entry_safe(peer, tmp_peer, &peers, list) {
                 l2cap_chan_close(peer->chan, ENOENT);
-                kfree(peer);
+
+                list_del_rcu(&peer->list);
+                call_rcu(&peer->rcu, peer_free);
+
+                module_put(THIS_MODULE);
         }
+        spin_unlock(&devices_lock);
 }
 
-static int lowpan_psm_set(void *data, u64 val)
-{
+struct set_psm {
+        struct work_struct work;
         u16 psm;
+};
+
+static void do_psm_set(struct work_struct *work)
+{
+        struct set_psm *set_psm = container_of(work, struct set_psm, work);
 
-        psm = val;
-        if (psm == 0 || psm_6lowpan != psm)
+        if (set_psm->psm == 0 || psm_6lowpan != set_psm->psm)
                 /* Disconnect existing connections if 6lowpan is
                  * disabled (psm = 0), or if psm changes.
                  */
                 disconnect_all_peers();
 
-        psm_6lowpan = psm;
+        psm_6lowpan = set_psm->psm;
 
         if (listen_chan) {
                 l2cap_chan_close(listen_chan, 0);
@@ -1207,6 +1255,22 @@ static int lowpan_psm_set(void *data, u64 val)
 
         listen_chan = bt_6lowpan_listen();
 
+        kfree(set_psm);
+}
+
+static int lowpan_psm_set(void *data, u64 val)
+{
+        struct set_psm *set_psm;
+
+        set_psm = kzalloc(sizeof(*set_psm), GFP_KERNEL);
+        if (!set_psm)
+                return -ENOMEM;
+
+        set_psm->psm = val;
+        INIT_WORK(&set_psm->work, do_psm_set);
+
+        schedule_work(&set_psm->work);
+
         return 0;
 }
 
@@ -1288,19 +1352,18 @@ static ssize_t lowpan_control_write(struct file *fp,
 
 static int lowpan_control_show(struct seq_file *f, void *ptr)
 {
-        struct lowpan_dev *entry, *tmp_dev;
-        struct lowpan_peer *peer, *tmp_peer;
-        unsigned long flags;
+        struct lowpan_dev *entry;
+        struct lowpan_peer *peer;
 
-        read_lock_irqsave(&devices_lock, flags);
+        spin_lock(&devices_lock);
 
-        list_for_each_entry_safe(entry, tmp_dev, &bt_6lowpan_devices, list) {
-                list_for_each_entry_safe(peer, tmp_peer, &entry->peers, list)
+        list_for_each_entry(entry, &bt_6lowpan_devices, list) {
+                list_for_each_entry(peer, &entry->peers, list)
                         seq_printf(f, "%pMR (type %u)\n",
                                    &peer->chan->dst, peer->chan->dst_type);
         }
 
-        read_unlock_irqrestore(&devices_lock, flags);
+        spin_unlock(&devices_lock);
 
         return 0;
 }
@@ -1322,7 +1385,6 @@ static void disconnect_devices(void)
 {
         struct lowpan_dev *entry, *tmp, *new_dev;
         struct list_head devices;
-        unsigned long flags;
 
         INIT_LIST_HEAD(&devices);
 
@@ -1331,9 +1393,9 @@ static void disconnect_devices(void)
          * devices list.
          */
 
-        read_lock_irqsave(&devices_lock, flags);
+        rcu_read_lock();
 
-        list_for_each_entry_safe(entry, tmp, &bt_6lowpan_devices, list) {
+        list_for_each_entry_rcu(entry, &bt_6lowpan_devices, list) {
                 new_dev = kmalloc(sizeof(*new_dev), GFP_ATOMIC);
                 if (!new_dev)
                         break;
@@ -1341,10 +1403,10 @@ static void disconnect_devices(void)
                 new_dev->netdev = entry->netdev;
                 INIT_LIST_HEAD(&new_dev->list);
 
-                list_add(&new_dev->list, &devices);
+                list_add_rcu(&new_dev->list, &devices);
         }
 
-        read_unlock_irqrestore(&devices_lock, flags);
+        rcu_read_unlock();
 
         list_for_each_entry_safe(entry, tmp, &devices, list) {
                 ifdown(entry->netdev);
@@ -1359,17 +1421,15 @@ static int device_event(struct notifier_block *unused,
                         unsigned long event, void *ptr)
 {
         struct net_device *netdev = netdev_notifier_info_to_dev(ptr);
-        struct lowpan_dev *entry, *tmp;
-        unsigned long flags;
+        struct lowpan_dev *entry;
 
         if (netdev->type != ARPHRD_6LOWPAN)
                 return NOTIFY_DONE;
 
         switch (event) {
         case NETDEV_UNREGISTER:
-                write_lock_irqsave(&devices_lock, flags);
-                list_for_each_entry_safe(entry, tmp, &bt_6lowpan_devices,
-                                         list) {
+                spin_lock(&devices_lock);
+                list_for_each_entry(entry, &bt_6lowpan_devices, list) {
                         if (entry->netdev == netdev) {
                                 BT_DBG("Unregistered netdev %s %p",
                                        netdev->name, netdev);
@@ -1378,7 +1438,7 @@ static int device_event(struct notifier_block *unused,
                                 break;
                         }
                 }
-                write_unlock_irqrestore(&devices_lock, flags);
+                spin_unlock(&devices_lock);
                 break;
         }
 
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index b9517bd17190..96887ae8375b 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -141,10 +141,11 @@ int hci_disconnect(struct hci_conn *conn, __u8 reason)
          */
         if (conn->type == ACL_LINK && conn->role == HCI_ROLE_MASTER) {
                 struct hci_dev *hdev = conn->hdev;
-                struct hci_cp_read_clock_offset cp;
+                struct hci_cp_read_clock_offset clkoff_cp;
 
-                cp.handle = cpu_to_le16(conn->handle);
-                hci_send_cmd(hdev, HCI_OP_READ_CLOCK_OFFSET, sizeof(cp), &cp);
+                clkoff_cp.handle = cpu_to_le16(conn->handle);
+                hci_send_cmd(hdev, HCI_OP_READ_CLOCK_OFFSET, sizeof(clkoff_cp),
+                             &clkoff_cp);
         }
 
         conn->state = BT_DISCONN;
@@ -415,7 +416,7 @@ static void le_conn_timeout(struct work_struct *work)
          * happen with broken hardware or if low duty cycle was used
          * (which doesn't have a timeout of its own).
          */
-        if (test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
+        if (conn->role == HCI_ROLE_SLAVE) {
                 u8 enable = 0x00;
                 hci_send_cmd(hdev, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable),
                              &enable);
@@ -517,7 +518,7 @@ int hci_conn_del(struct hci_conn *conn)
                 /* Unacked frames */
                 hdev->acl_cnt += conn->sent;
         } else if (conn->type == LE_LINK) {
-                cancel_delayed_work_sync(&conn->le_conn_timeout);
+                cancel_delayed_work(&conn->le_conn_timeout);
 
                 if (hdev->le_pkts)
                         hdev->le_cnt += conn->sent;
@@ -544,6 +545,9 @@ int hci_conn_del(struct hci_conn *conn)
 
         hci_conn_del_sysfs(conn);
 
+        if (test_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags))
+                hci_conn_params_del(conn->hdev, &conn->dst, conn->dst_type);
+
         hci_dev_put(hdev);
 
         hci_conn_put(conn);
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index cb05d7f16a34..91995f8ab0a0 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -4477,7 +4477,7 @@ int hci_req_run(struct hci_request *req, hci_req_complete_t complete)
 
         BT_DBG("length %u", skb_queue_len(&req->cmd_q));
 
-        /* If an error occured during request building, remove all HCI
+        /* If an error occurred during request building, remove all HCI
          * commands queued on the HCI request queue.
          */
         if (req->err) {
@@ -4546,7 +4546,7 @@ int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen,
                 return -ENOMEM;
         }
 
-        /* Stand-alone HCI commands must be flaged as
+        /* Stand-alone HCI commands must be flagged as
          * single-command requests.
          */
         bt_cb(skb)->req.start = true;
@@ -4566,7 +4566,7 @@ void hci_req_add_ev(struct hci_request *req, u16 opcode, u32 plen,
 
         BT_DBG("%s opcode 0x%4.4x plen %d", hdev->name, opcode, plen);
 
-        /* If an error occured during request building, there is no point in
+        /* If an error occurred during request building, there is no point in
          * queueing the HCI command. We can simply return.
          */
         if (req->err)
@@ -4661,8 +4661,12 @@ static void hci_queue_acl(struct hci_chan *chan, struct sk_buff_head *queue,
 
                 skb_shinfo(skb)->frag_list = NULL;
 
-                /* Queue all fragments atomically */
-                spin_lock(&queue->lock);
+                /* Queue all fragments atomically. We need to use spin_lock_bh
+                 * here because of 6LoWPAN links, as there this function is
+                 * called from softirq and using normal spin lock could cause
+                 * deadlocks.
+                 */
+                spin_lock_bh(&queue->lock);
 
                 __skb_queue_tail(queue, skb);
 
@@ -4679,7 +4683,7 @@ static void hci_queue_acl(struct hci_chan *chan, struct sk_buff_head *queue,
                         __skb_queue_tail(queue, skb);
                 } while (list);
 
-                spin_unlock(&queue->lock);
+                spin_unlock_bh(&queue->lock);
         }
 }
 
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 8b0a2a6de419..aa152140c3e2 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -205,6 +205,8 @@ static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
         hdev->le_scan_type = LE_SCAN_PASSIVE;
 
         hdev->ssp_debug_mode = 0;
+
+        hci_bdaddr_list_clear(&hdev->le_white_list);
 }
 
 static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
@@ -1045,7 +1047,7 @@ static void hci_cc_le_set_adv_enable(struct hci_dev *hdev, struct sk_buff *skb)
 
         hci_dev_lock(hdev);
 
-        /* If we're doing connection initation as peripheral. Set a
+        /* If we're doing connection initiation as peripheral. Set a
          * timeout in case something goes wrong.
          */
         if (*sent) {
@@ -1577,8 +1579,7 @@ static void hci_check_pending_name(struct hci_dev *hdev, struct hci_conn *conn,
         struct inquiry_entry *e;
 
         if (conn && !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
-                mgmt_device_connected(hdev, bdaddr, ACL_LINK, 0x00, 0, name,
-                                      name_len, conn->dev_class);
+                mgmt_device_connected(hdev, conn, 0, name, name_len);
 
         if (discov->state == DISCOVERY_STOPPED)
                 return;
@@ -2536,9 +2537,7 @@ static void hci_remote_features_evt(struct hci_dev *hdev,
                 cp.pscan_rep_mode = 0x02;
                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
-                mgmt_device_connected(hdev, &conn->dst, conn->type,
-                                      conn->dst_type, 0, NULL, 0,
-                                      conn->dev_class);
+                mgmt_device_connected(hdev, conn, 0, NULL, 0);
 
         if (!hci_outgoing_auth_needed(hdev, conn)) {
                 conn->state = BT_CONNECTED;
@@ -3434,9 +3433,7 @@ static void hci_remote_ext_features_evt(struct hci_dev *hdev,
                 cp.pscan_rep_mode = 0x02;
                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
-                mgmt_device_connected(hdev, &conn->dst, conn->type,
-                                      conn->dst_type, 0, NULL, 0,
-                                      conn->dev_class);
+                mgmt_device_connected(hdev, conn, 0, NULL, 0);
 
         if (!hci_outgoing_auth_needed(hdev, conn)) {
                 conn->state = BT_CONNECTED;
@@ -4214,8 +4211,7 @@ static void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
         }
 
         if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
-                mgmt_device_connected(hdev, &conn->dst, conn->type,
-                                      conn->dst_type, 0, NULL, 0, NULL);
+                mgmt_device_connected(hdev, conn, 0, NULL, 0);
 
         conn->sec_level = BT_SECURITY_LOW;
         conn->handle = __le16_to_cpu(ev->handle);
@@ -4269,25 +4265,26 @@ static void hci_le_conn_update_complete_evt(struct hci_dev *hdev,
 }
 
 /* This function requires the caller holds hdev->lock */
-static void check_pending_le_conn(struct hci_dev *hdev, bdaddr_t *addr,
-                                  u8 addr_type, u8 adv_type)
+static struct hci_conn *check_pending_le_conn(struct hci_dev *hdev,
+                                              bdaddr_t *addr,
+                                              u8 addr_type, u8 adv_type)
 {
         struct hci_conn *conn;
         struct hci_conn_params *params;
 
         /* If the event is not connectable don't proceed further */
         if (adv_type != LE_ADV_IND && adv_type != LE_ADV_DIRECT_IND)
-                return;
+                return NULL;
 
         /* Ignore if the device is blocked */
         if (hci_bdaddr_list_lookup(&hdev->blacklist, addr, addr_type))
-                return;
+                return NULL;
 
         /* Most controller will fail if we try to create new connections
          * while we have an existing one in slave role.
          */
         if (hdev->conn_hash.le_num_slave > 0)
-                return;
+                return NULL;
 
         /* If we're not connectable only connect devices that we have in
          * our pend_le_conns list.
@@ -4295,7 +4292,7 @@ static void check_pending_le_conn(struct hci_dev *hdev, bdaddr_t *addr,
         params = hci_pend_le_action_lookup(&hdev->pend_le_conns,
                                            addr, addr_type);
         if (!params)
-                return;
+                return NULL;
 
         switch (params->auto_connect) {
         case HCI_AUTO_CONN_DIRECT:
@@ -4304,7 +4301,7 @@ static void check_pending_le_conn(struct hci_dev *hdev, bdaddr_t *addr,
                  * incoming connections from slave devices.
                  */
                 if (adv_type != LE_ADV_DIRECT_IND)
-                        return;
+                        return NULL;
                 break;
         case HCI_AUTO_CONN_ALWAYS:
                 /* Devices advertising with ADV_IND or ADV_DIRECT_IND
@@ -4315,7 +4312,7 @@ static void check_pending_le_conn(struct hci_dev *hdev, bdaddr_t *addr,
                  */
                 break;
         default:
-                return;
+                return NULL;
         }
 
         conn = hci_connect_le(hdev, addr, addr_type, BT_SECURITY_LOW,
@@ -4328,7 +4325,7 @@ static void check_pending_le_conn(struct hci_dev *hdev, bdaddr_t *addr,
                  * count consistent once the connection is established.
                  */
                 params->conn = hci_conn_get(conn);
-                return;
+                return conn;
         }
 
         switch (PTR_ERR(conn)) {
@@ -4341,7 +4338,10 @@ static void check_pending_le_conn(struct hci_dev *hdev, bdaddr_t *addr,
                 break;
         default:
                 BT_DBG("Failed to connect: err %ld", PTR_ERR(conn));
+                return NULL;
         }
+
+        return NULL;
 }
 
 static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr,
@@ -4349,6 +4349,7 @@ static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr,
 {
         struct discovery_state *d = &hdev->discovery;
         struct smp_irk *irk;
+        struct hci_conn *conn;
         bool match;
         u32 flags;
 
@@ -4360,7 +4361,14 @@ static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr,
         }
 
         /* Check if we have been requested to connect to this device */
-        check_pending_le_conn(hdev, bdaddr, bdaddr_type, type);
+        conn = check_pending_le_conn(hdev, bdaddr, bdaddr_type, type);
+        if (conn && type == LE_ADV_IND) {
+                /* Store report for later inclusion by
+                 * mgmt_device_connected
+                 */
+                memcpy(conn->le_adv_data, data, len);
+                conn->le_adv_data_len = len;
+        }
 
         /* Passive scanning shouldn't trigger any device found events,
          * except for devices marked as CONN_REPORT for which we do send
diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index 29e1ec7189bd..5e2cd2535978 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -987,7 +987,7 @@ static int hci_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
                         skb_queue_tail(&hdev->raw_q, skb);
                         queue_work(hdev->workqueue, &hdev->tx_work);
                 } else {
-                        /* Stand-alone HCI commands must be flaged as
+                        /* Stand-alone HCI commands must be flagged as
                          * single-command requests.
                          */
                         bt_cb(skb)->req.start = true;
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index b6f9777e057d..fc15174c612c 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -3873,9 +3873,7 @@ static int l2cap_connect_req(struct l2cap_conn *conn,
         hci_dev_lock(hdev);
         if (test_bit(HCI_MGMT, &hdev->dev_flags) &&
             !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &hcon->flags))
-                mgmt_device_connected(hdev, &hcon->dst, hcon->type,
-                                      hcon->dst_type, 0, NULL, 0,
-                                      hcon->dev_class);
+                mgmt_device_connected(hdev, hcon, 0, NULL, 0);
         hci_dev_unlock(hdev);
 
         l2cap_connect(conn, cmd, data, L2CAP_CONN_RSP, 0);
@@ -4084,7 +4082,7 @@ static inline int l2cap_config_req(struct l2cap_conn *conn,
                 chan->num_conf_req++;
         }
 
-        /* Got Conf Rsp PENDING from remote side and asume we sent
+        /* Got Conf Rsp PENDING from remote side and assume we sent
            Conf Rsp PENDING in the code above */
         if (test_bit(CONF_REM_CONF_PEND, &chan->conf_state) &&
             test_bit(CONF_LOC_CONF_PEND, &chan->conf_state)) {
@@ -5494,6 +5492,7 @@ static inline int l2cap_le_credits(struct l2cap_conn *conn,
         if (credits > max_credits) {
                 BT_ERR("LE credits overflow");
                 l2cap_send_disconn_req(chan, ECONNRESET);
+                l2cap_chan_unlock(chan);
 
                 /* Return 0 so that we don't trigger an unnecessary
                  * command reject packet.
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index efb71b022ab6..9c4daf715cf8 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -2725,10 +2725,40 @@ static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
         }
 
         if (cp->addr.type == BDADDR_BREDR) {
+                /* If disconnection is requested, then look up the
+                 * connection. If the remote device is connected, it
+                 * will be later used to terminate the link.
+                 *
+                 * Setting it to NULL explicitly will cause no
+                 * termination of the link.
+                 */
+                if (cp->disconnect)
+                        conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
+                                                       &cp->addr.bdaddr);
+                else
+                        conn = NULL;
+
                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
         } else {
                 u8 addr_type;
 
+                conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
+                                               &cp->addr.bdaddr);
+                if (conn) {
+                        /* Defer clearing up the connection parameters
+                         * until closing to give a chance of keeping
+                         * them if a repairing happens.
+                         */
+                        set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
+
+                        /* If disconnection is not requested, then
+                         * clear the connection variable so that the
+                         * link is not terminated.
+                         */
+                        if (!cp->disconnect)
+                                conn = NULL;
+                }
+
                 if (cp->addr.type == BDADDR_LE_PUBLIC)
                         addr_type = ADDR_LE_DEV_PUBLIC;
                 else
@@ -2736,8 +2766,6 @@ static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
 
                 hci_remove_irk(hdev, &cp->addr.bdaddr, addr_type);
 
-                hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type);
-
                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr, addr_type);
         }
 
@@ -2747,17 +2775,9 @@ static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
                 goto unlock;
         }
 
-        if (cp->disconnect) {
-                if (cp->addr.type == BDADDR_BREDR)
-                        conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
-                                                       &cp->addr.bdaddr);
-                else
-                        conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
-                                                       &cp->addr.bdaddr);
-        } else {
-                conn = NULL;
-        }
-
+        /* If the connection variable is set, then termination of the
+         * link is requested.
+         */
         if (!conn) {
                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
                                    &rp, sizeof(rp));
@@ -3062,6 +3082,11 @@ static void pairing_complete(struct pending_cmd *cmd, u8 status)
         hci_conn_put(conn);
 
         mgmt_pending_remove(cmd);
+
+        /* The device is paired so there is no need to remove
+         * its connection parameters anymore.
+         */
+        clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
 }
 
 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
@@ -6171,26 +6196,36 @@ static inline u16 eir_append_data(u8 *eir, u16 eir_len, u8 type, u8 *data,
         return eir_len;
 }
 
-void mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
-                           u8 addr_type, u32 flags, u8 *name, u8 name_len,
-                           u8 *dev_class)
+void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
+                           u32 flags, u8 *name, u8 name_len)
 {
         char buf[512];
         struct mgmt_ev_device_connected *ev = (void *) buf;
         u16 eir_len = 0;
 
-        bacpy(&ev->addr.bdaddr, bdaddr);
-        ev->addr.type = link_to_bdaddr(link_type, addr_type);
+        bacpy(&ev->addr.bdaddr, &conn->dst);
+        ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
 
         ev->flags = __cpu_to_le32(flags);
 
-        if (name_len > 0)
-                eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
-                                          name, name_len);
+        /* We must ensure that the EIR Data fields are ordered and
+         * unique. Keep it simple for now and avoid the problem by not
+         * adding any BR/EDR data to the LE adv.
+         */
+        if (conn->le_adv_data_len > 0) {
+                memcpy(&ev->eir[eir_len],
+                       conn->le_adv_data, conn->le_adv_data_len);
+                eir_len = conn->le_adv_data_len;
+        } else {
+                if (name_len > 0)
+                        eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
+                                                  name, name_len);
 
-        if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
-                eir_len = eir_append_data(ev->eir, eir_len,
-                                          EIR_CLASS_OF_DEV, dev_class, 3);
+                if (memcmp(conn->dev_class, "\0\0\0", 3) != 0)
+                        eir_len = eir_append_data(ev->eir, eir_len,
+                                                  EIR_CLASS_OF_DEV,
+                                                  conn->dev_class, 3);
+        }
 
         ev->eir_len = cpu_to_le16(eir_len);
 
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index af73bc3acb40..bce9c3d39324 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -78,8 +78,8 @@ static struct rfcomm_session *rfcomm_session_del(struct rfcomm_session *s);
 #define __get_type(b)     ((b & 0xef))
 
 #define __test_ea(b)      ((b & 0x01))
-#define __test_cr(b)      ((b & 0x02))
-#define __test_pf(b)      ((b & 0x10))
+#define __test_cr(b)      (!!(b & 0x02))
+#define __test_pf(b)      (!!(b & 0x10))
 
 #define __addr(cr, dlci)       (((dlci & 0x3f) << 2) | (cr << 1) | 0x01)
 #define __ctrl(type, pf)       (((type & 0xef) | (pf << 4)))
@@ -904,7 +904,7 @@ static int rfcomm_send_nsc(struct rfcomm_session *s, int cr, u8 type)
         hdr->len  = __len8(sizeof(*mcc) + 1);
 
         mcc = (void *) ptr; ptr += sizeof(*mcc);
-        mcc->type = __mcc_type(cr, RFCOMM_NSC);
+        mcc->type = __mcc_type(0, RFCOMM_NSC);
         mcc->len  = __len8(1);
 
         /* Type that we didn't like */
diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index f09b6b65cf6b..3ebf65b50881 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -191,16 +191,13 @@ int smp_generate_rpa(struct hci_dev *hdev, u8 irk[16], bdaddr_t *rpa)
         return 0;
 }
 
-static int smp_c1(struct smp_chan *smp, u8 k[16], u8 r[16], u8 preq[7],
-                  u8 pres[7], u8 _iat, bdaddr_t *ia, u8 _rat, bdaddr_t *ra,
-                  u8 res[16])
+static int smp_c1(struct crypto_blkcipher *tfm_aes, u8 k[16], u8 r[16],
+                  u8 preq[7], u8 pres[7], u8 _iat, bdaddr_t *ia, u8 _rat,
+                  bdaddr_t *ra, u8 res[16])
 {
-        struct hci_dev *hdev = smp->conn->hcon->hdev;
         u8 p1[16], p2[16];
         int err;
 
-        BT_DBG("%s", hdev->name);
-
         memset(p1, 0, 16);
 
         /* p1 = pres || preq || _rat || _iat */
@@ -218,7 +215,7 @@ static int smp_c1(struct smp_chan *smp, u8 k[16], u8 r[16], u8 preq[7],
         u128_xor((u128 *) res, (u128 *) r, (u128 *) p1);
 
         /* res = e(k, res) */
-        err = smp_e(smp->tfm_aes, k, res);
+        err = smp_e(tfm_aes, k, res);
         if (err) {
                 BT_ERR("Encrypt data error");
                 return err;
@@ -228,26 +225,23 @@ static int smp_c1(struct smp_chan *smp, u8 k[16], u8 r[16], u8 preq[7],
         u128_xor((u128 *) res, (u128 *) res, (u128 *) p2);
 
         /* res = e(k, res) */
-        err = smp_e(smp->tfm_aes, k, res);
+        err = smp_e(tfm_aes, k, res);
         if (err)
                 BT_ERR("Encrypt data error");
 
         return err;
 }
 
-static int smp_s1(struct smp_chan *smp, u8 k[16], u8 r1[16], u8 r2[16],
-                  u8 _r[16])
+static int smp_s1(struct crypto_blkcipher *tfm_aes, u8 k[16], u8 r1[16],
+                  u8 r2[16], u8 _r[16])
 {
-        struct hci_dev *hdev = smp->conn->hcon->hdev;
         int err;
 
-        BT_DBG("%s", hdev->name);
-
         /* Just least significant octets from r1 and r2 are considered */
         memcpy(_r, r2, 8);
         memcpy(_r + 8, r1, 8);
 
-        err = smp_e(smp->tfm_aes, k, _r);
+        err = smp_e(tfm_aes, k, _r);
         if (err)
                 BT_ERR("Encrypt data error");
 
@@ -547,7 +541,7 @@ static u8 smp_confirm(struct smp_chan *smp)
 
         BT_DBG("conn %p", conn);
 
-        ret = smp_c1(smp, smp->tk, smp->prnd, smp->preq, smp->prsp,
+        ret = smp_c1(smp->tfm_aes, smp->tk, smp->prnd, smp->preq, smp->prsp,
                      conn->hcon->init_addr_type, &conn->hcon->init_addr,
                      conn->hcon->resp_addr_type, &conn->hcon->resp_addr,
                      cp.confirm_val);
@@ -578,7 +572,7 @@ static u8 smp_random(struct smp_chan *smp)
 
         BT_DBG("conn %p %s", conn, conn->hcon->out ? "master" : "slave");
 
-        ret = smp_c1(smp, smp->tk, smp->rrnd, smp->preq, smp->prsp,
+        ret = smp_c1(smp->tfm_aes, smp->tk, smp->rrnd, smp->preq, smp->prsp,
                      hcon->init_addr_type, &hcon->init_addr,
                      hcon->resp_addr_type, &hcon->resp_addr, confirm);
         if (ret)
@@ -594,7 +588,7 @@ static u8 smp_random(struct smp_chan *smp)
                 __le64 rand = 0;
                 __le16 ediv = 0;
 
-                smp_s1(smp, smp->tk, smp->rrnd, smp->prnd, stk);
+                smp_s1(smp->tfm_aes, smp->tk, smp->rrnd, smp->prnd, stk);
 
                 memset(stk + smp->enc_key_size, 0,
                        SMP_MAX_ENC_KEY_SIZE - smp->enc_key_size);
@@ -613,7 +607,7 @@ static u8 smp_random(struct smp_chan *smp)
                 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd),
                              smp->prnd);
 
-                smp_s1(smp, smp->tk, smp->prnd, smp->rrnd, stk);
+                smp_s1(smp->tfm_aes, smp->tk, smp->prnd, smp->rrnd, stk);
 
                 memset(stk + smp->enc_key_size, 0,
                        SMP_MAX_ENC_KEY_SIZE - smp->enc_key_size);
@@ -970,7 +964,7 @@ static u8 smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb)
         if (sec_level > conn->hcon->pending_sec_level)
                 conn->hcon->pending_sec_level = sec_level;
 
-        /* If we need MITM check that it can be acheived */
+        /* If we need MITM check that it can be achieved */
         if (conn->hcon->pending_sec_level >= BT_SECURITY_HIGH) {
                 u8 method;
 
@@ -1028,7 +1022,7 @@ static u8 smp_cmd_pairing_rsp(struct l2cap_conn *conn, struct sk_buff *skb)
 
         auth = rsp->auth_req & AUTH_REQ_MASK;
 
-        /* If we need MITM check that it can be acheived */
+        /* If we need MITM check that it can be achieved */
         if (conn->hcon->pending_sec_level >= BT_SECURITY_HIGH) {
                 u8 method;
 
diff --git a/net/ieee802154/6lowpan_rtnl.c b/net/ieee802154/6lowpan_rtnl.c
index 44136297b673..519a65452d90 100644
--- a/net/ieee802154/6lowpan_rtnl.c
+++ b/net/ieee802154/6lowpan_rtnl.c
@@ -49,8 +49,8 @@
 #include <linux/module.h>
 #include <linux/moduleparam.h>
 #include <linux/netdevice.h>
+#include <linux/ieee802154.h>
 #include <net/af_ieee802154.h>
-#include <net/ieee802154.h>
 #include <net/ieee802154_netdev.h>
 #include <net/6lowpan.h>
 #include <net/ipv6.h>
@@ -58,12 +58,13 @@
 #include "reassembly.h"
 
 static LIST_HEAD(lowpan_devices);
+static int lowpan_open_count;
 
 /* private device info */
 struct lowpan_dev_info {
         struct net_device       *real_dev; /* real WPAN device ptr */
         struct mutex            dev_list_mtx; /* mutex for list ops */
-        __be16                  fragment_tag;
+        u16                     fragment_tag;
 };
 
 struct lowpan_dev_record {
@@ -140,24 +141,33 @@ static int lowpan_give_skb_to_devices(struct sk_buff *skb,
         struct sk_buff *skb_cp;
         int stat = NET_RX_SUCCESS;
 
+        skb->protocol = htons(ETH_P_IPV6);
+        skb->pkt_type = PACKET_HOST;
+
         rcu_read_lock();
         list_for_each_entry_rcu(entry, &lowpan_devices, list)
                 if (lowpan_dev_info(entry->ldev)->real_dev == skb->dev) {
                         skb_cp = skb_copy(skb, GFP_ATOMIC);
                         if (!skb_cp) {
-                                stat = -ENOMEM;
-                                break;
+                                kfree_skb(skb);
+                                rcu_read_unlock();
+                                return NET_RX_DROP;
                         }
 
                         skb_cp->dev = entry->ldev;
                         stat = netif_rx(skb_cp);
+                        if (stat == NET_RX_DROP)
+                                break;
                 }
         rcu_read_unlock();
 
+        consume_skb(skb);
+
         return stat;
 }
 
-static int process_data(struct sk_buff *skb, const struct ieee802154_hdr *hdr)
+static int
+iphc_decompress(struct sk_buff *skb, const struct ieee802154_hdr *hdr)
 {
         u8 iphc0, iphc1;
         struct ieee802154_addr_sa sa, da;
@@ -187,10 +197,9 @@ static int process_data(struct sk_buff *skb, const struct ieee802154_hdr *hdr)
         else
                 dap = &da.hwaddr;
 
-        return lowpan_process_data(skb, skb->dev, sap, sa.addr_type,
-                                   IEEE802154_ADDR_LEN, dap, da.addr_type,
-                                   IEEE802154_ADDR_LEN, iphc0, iphc1,
-                                   lowpan_give_skb_to_devices);
+        return lowpan_header_decompress(skb, skb->dev, sap, sa.addr_type,
+                                        IEEE802154_ADDR_LEN, dap, da.addr_type,
+                                        IEEE802154_ADDR_LEN, iphc0, iphc1);
 
 drop:
         kfree_skb(skb);
@@ -233,7 +242,7 @@ lowpan_alloc_frag(struct sk_buff *skb, int size,
                                      &master_hdr->source, size);
                 if (rc < 0) {
                         kfree_skb(frag);
-                        return ERR_PTR(-rc);
+                        return ERR_PTR(rc);
                 }
         } else {
                 frag = ERR_PTR(-ENOMEM);
@@ -275,7 +284,8 @@ lowpan_xmit_fragmented(struct sk_buff *skb, struct net_device *dev,
 
         dgram_size = lowpan_uncompress_size(skb, &dgram_offset) -
                      skb->mac_len;
-        frag_tag = lowpan_dev_info(dev)->fragment_tag++;
+        frag_tag = htons(lowpan_dev_info(dev)->fragment_tag);
+        lowpan_dev_info(dev)->fragment_tag++;
 
         frag_hdr[0] = LOWPAN_DISPATCH_FRAG1 | ((dgram_size >> 8) & 0x07);
         frag_hdr[1] = dgram_size & 0xff;
@@ -294,7 +304,7 @@ lowpan_xmit_fragmented(struct sk_buff *skb, struct net_device *dev,
                                   frag_len + skb_network_header_len(skb));
         if (rc) {
                 pr_debug("%s unable to send FRAG1 packet (tag: %d)",
-                         __func__, frag_tag);
+                         __func__, ntohs(frag_tag));
                 goto err;
         }
 
@@ -315,7 +325,7 @@ lowpan_xmit_fragmented(struct sk_buff *skb, struct net_device *dev,
                                           frag_len);
                 if (rc) {
                         pr_debug("%s unable to send a FRAGN packet. (tag: %d, offset: %d)\n",
-                                 __func__, frag_tag, skb_offset);
+                                 __func__, ntohs(frag_tag), skb_offset);
                         goto err;
                 }
         } while (skb_unprocessed > frag_cap);
@@ -515,6 +525,9 @@ static int lowpan_rcv(struct sk_buff *skb, struct net_device *dev,
         if (!netif_running(dev))
                 goto drop_skb;
 
+        if (skb->pkt_type == PACKET_OTHERHOST)
+                goto drop_skb;
+
         if (dev->type != ARPHRD_IEEE802154)
                 goto drop_skb;
 
@@ -523,55 +536,67 @@ static int lowpan_rcv(struct sk_buff *skb, struct net_device *dev,
 
         /* check that it's our buffer */
         if (skb->data[0] == LOWPAN_DISPATCH_IPV6) {
-                skb->protocol = htons(ETH_P_IPV6);
-                skb->pkt_type = PACKET_HOST;
-
                 /* Pull off the 1-byte of 6lowpan header. */
                 skb_pull(skb, 1);
-
-                ret = lowpan_give_skb_to_devices(skb, NULL);
-                if (ret == NET_RX_DROP)
-                        goto drop;
+                return lowpan_give_skb_to_devices(skb, NULL);
         } else {
                 switch (skb->data[0] & 0xe0) {
                 case LOWPAN_DISPATCH_IPHC:      /* ipv6 datagram */
-                        ret = process_data(skb, &hdr);
-                        if (ret == NET_RX_DROP)
+                        ret = iphc_decompress(skb, &hdr);
+                        if (ret < 0)
                                 goto drop;
-                        break;
+
+                        return lowpan_give_skb_to_devices(skb, NULL);
                 case LOWPAN_DISPATCH_FRAG1:     /* first fragment header */
                         ret = lowpan_frag_rcv(skb, LOWPAN_DISPATCH_FRAG1);
                         if (ret == 1) {
-                                ret = process_data(skb, &hdr);
-                                if (ret == NET_RX_DROP)
+                                ret = iphc_decompress(skb, &hdr);
+                                if (ret < 0)
                                         goto drop;
+
+                                return lowpan_give_skb_to_devices(skb, NULL);
+                        } else if (ret == -1) {
+                                return NET_RX_DROP;
+                        } else {
+                                return NET_RX_SUCCESS;
                         }
-                        break;
                 case LOWPAN_DISPATCH_FRAGN:     /* next fragments headers */
                         ret = lowpan_frag_rcv(skb, LOWPAN_DISPATCH_FRAGN);
                         if (ret == 1) {
-                                ret = process_data(skb, &hdr);
-                                if (ret == NET_RX_DROP)
+                                ret = iphc_decompress(skb, &hdr);
+                                if (ret < 0)
                                         goto drop;
+
+                                return lowpan_give_skb_to_devices(skb, NULL);
+                        } else if (ret == -1) {
+                                return NET_RX_DROP;
+                        } else {
+                                return NET_RX_SUCCESS;
                         }
-                        break;
                 default:
                         break;
                 }
         }
 
-        return NET_RX_SUCCESS;
 drop_skb:
         kfree_skb(skb);
 drop:
         return NET_RX_DROP;
 }
 
+static struct packet_type lowpan_packet_type = {
+        .type = htons(ETH_P_IEEE802154),
+        .func = lowpan_rcv,
+};
+
 static int lowpan_newlink(struct net *src_net, struct net_device *dev,
                           struct nlattr *tb[], struct nlattr *data[])
 {
         struct net_device *real_dev;
         struct lowpan_dev_record *entry;
+        int ret;
+
+        ASSERT_RTNL();
 
         pr_debug("adding new link\n");
 
@@ -606,9 +631,14 @@ static int lowpan_newlink(struct net *src_net, struct net_device *dev,
         list_add_tail(&entry->list, &lowpan_devices);
         mutex_unlock(&lowpan_dev_info(dev)->dev_list_mtx);
 
-        register_netdevice(dev);
+        ret = register_netdevice(dev);
+        if (ret >= 0) {
+                if (!lowpan_open_count)
+                        dev_add_pack(&lowpan_packet_type);
+                lowpan_open_count++;
+        }
 
-        return 0;
+        return ret;
 }
 
 static void lowpan_dellink(struct net_device *dev, struct list_head *head)
@@ -619,6 +649,10 @@ static void lowpan_dellink(struct net_device *dev, struct list_head *head)
 
         ASSERT_RTNL();
 
+        lowpan_open_count--;
+        if (!lowpan_open_count)
+                dev_remove_pack(&lowpan_packet_type);
+
         mutex_lock(&lowpan_dev_info(dev)->dev_list_mtx);
         list_for_each_entry_safe(entry, tmp, &lowpan_devices, list) {
                 if (entry->ldev == dev) {
@@ -681,11 +715,6 @@ static struct notifier_block lowpan_dev_notifier = {
         .notifier_call = lowpan_device_event,
 };
 
-static struct packet_type lowpan_packet_type = {
-        .type = htons(ETH_P_IEEE802154),
-        .func = lowpan_rcv,
-};
-
 static int __init lowpan_init_module(void)
 {
         int err = 0;
@@ -698,8 +727,6 @@ static int __init lowpan_init_module(void)
         if (err < 0)
                 goto out_frag;
 
-        dev_add_pack(&lowpan_packet_type);
-
         err = register_netdevice_notifier(&lowpan_dev_notifier);
         if (err < 0)
                 goto out_pack;
@@ -707,7 +734,6 @@ static int __init lowpan_init_module(void)
         return 0;
 
 out_pack:
-        dev_remove_pack(&lowpan_packet_type);
         lowpan_netlink_fini();
 out_frag:
         lowpan_net_frag_exit();
@@ -719,8 +745,6 @@ static void __exit lowpan_cleanup_module(void)
 {
         lowpan_netlink_fini();
 
-        dev_remove_pack(&lowpan_packet_type);
-
         lowpan_net_frag_exit();
 
         unregister_netdevice_notifier(&lowpan_dev_notifier);
diff --git a/net/ieee802154/Makefile b/net/ieee802154/Makefile
index 3914b1ed4274..38354d4a70cb 100644
--- a/net/ieee802154/Makefile
+++ b/net/ieee802154/Makefile
@@ -2,8 +2,8 @@ obj-$(CONFIG_IEEE802154) += ieee802154.o af_802154.o
 obj-$(CONFIG_IEEE802154_6LOWPAN) += ieee802154_6lowpan.o
 
 ieee802154_6lowpan-y := 6lowpan_rtnl.o reassembly.o
-ieee802154-y := netlink.o nl-mac.o nl-phy.o nl_policy.o wpan-class.o \
-                header_ops.o
+ieee802154-y := netlink.o nl-mac.o nl-phy.o nl_policy.o core.o \
+                header_ops.o sysfs.o
 af_802154-y := af_ieee802154.o raw.o dgram.o
 
 ccflags-y += -D__CHECK_ENDIAN__
diff --git a/net/ieee802154/af802154.h b/net/ieee802154/af802154.h
index 8330a09bfc95..343b63e6f953 100644
--- a/net/ieee802154/af802154.h
+++ b/net/ieee802154/af802154.h
@@ -12,10 +12,6 @@
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
- * You should have received a copy of the GNU General Public License along
- * with this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
- *
  * Written by:
  * Sergey Lapin <slapin@ossfans.org>
  * Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
diff --git a/net/ieee802154/af_ieee802154.c b/net/ieee802154/af_ieee802154.c
index 29e0de63001b..26da1e179737 100644
--- a/net/ieee802154/af_ieee802154.c
+++ b/net/ieee802154/af_ieee802154.c
@@ -12,10 +12,6 @@
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
- * You should have received a copy of the GNU General Public License along
- * with this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
- *
  * Written by:
  * Sergey Lapin <slapin@ossfans.org>
  * Maxim Gorbachyov <maxim.gorbachev@siemens.com>
diff --git a/net/ieee802154/wpan-class.c b/net/ieee802154/core.c
index 4955e0fe5883..620abc2ba5fc 100644
--- a/net/ieee802154/wpan-class.c
+++ b/net/ieee802154/core.c
@@ -10,10 +10,6 @@
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
- * You should have received a copy of the GNU General Public License along
- * with this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
- *
  */
 
 #include <linux/slab.h>
@@ -21,75 +17,10 @@
 #include <linux/module.h>
 #include <linux/device.h>
 
-#include <net/wpan-phy.h>
+#include <net/cfg802154.h>
 
 #include "ieee802154.h"
-
-#define MASTER_SHOW_COMPLEX(name, format_string, args...)               \
-static ssize_t name ## _show(struct device *dev,                        \
-                            struct device_attribute *attr, char *buf)   \
-{                                                                       \
-        struct wpan_phy *phy = container_of(dev, struct wpan_phy, dev); \
-        int ret;                                                        \
-                                                                        \
-        mutex_lock(&phy->pib_lock);                                     \
-        ret = snprintf(buf, PAGE_SIZE, format_string "\n", args);       \
-        mutex_unlock(&phy->pib_lock);                                   \
-        return ret;                                                     \
-}                                                                       \
-static DEVICE_ATTR_RO(name);
-
-#define MASTER_SHOW(field, format_string)                               \
-        MASTER_SHOW_COMPLEX(field, format_string, phy->field)
-
-MASTER_SHOW(current_channel, "%d");
-MASTER_SHOW(current_page, "%d");
-MASTER_SHOW(transmit_power, "%d +- 1 dB");
-MASTER_SHOW(cca_mode, "%d");
-
-static ssize_t channels_supported_show(struct device *dev,
-                                       struct device_attribute *attr,
-                                       char *buf)
-{
-        struct wpan_phy *phy = container_of(dev, struct wpan_phy, dev);
-        int ret;
-        int i, len = 0;
-
-        mutex_lock(&phy->pib_lock);
-        for (i = 0; i < 32; i++) {
-                ret = snprintf(buf + len, PAGE_SIZE - len,
-                               "%#09x\n", phy->channels_supported[i]);
-                if (ret < 0)
-                        break;
-                len += ret;
-        }
-        mutex_unlock(&phy->pib_lock);
-        return len;
-}
-static DEVICE_ATTR_RO(channels_supported);
-
-static struct attribute *pmib_attrs[] = {
-        &dev_attr_current_channel.attr,
-        &dev_attr_current_page.attr,
-        &dev_attr_channels_supported.attr,
-        &dev_attr_transmit_power.attr,
-        &dev_attr_cca_mode.attr,
-        NULL,
-};
-ATTRIBUTE_GROUPS(pmib);
-
-static void wpan_phy_release(struct device *d)
-{
-        struct wpan_phy *phy = container_of(d, struct wpan_phy, dev);
-
-        kfree(phy);
-}
-
-static struct class wpan_phy_class = {
-        .name = "ieee802154",
-        .dev_release = wpan_phy_release,
-        .dev_groups = pmib_groups,
-};
+#include "sysfs.h"
 
 static DEFINE_MUTEX(wpan_phy_mutex);
 static int wpan_phy_idx;
@@ -201,7 +132,7 @@ static int __init wpan_phy_class_init(void)
 {
         int rc;
 
-        rc = class_register(&wpan_phy_class);
+        rc = wpan_phy_sysfs_init();
         if (rc)
                 goto err;
 
@@ -211,7 +142,7 @@ static int __init wpan_phy_class_init(void)
 
         return 0;
 err_nl:
-        class_unregister(&wpan_phy_class);
+        wpan_phy_sysfs_exit();
 err:
         return rc;
 }
@@ -220,7 +151,7 @@ subsys_initcall(wpan_phy_class_init);
 static void __exit wpan_phy_class_exit(void)
 {
         ieee802154_nl_exit();
-        class_unregister(&wpan_phy_class);
+        wpan_phy_sysfs_exit();
 }
 module_exit(wpan_phy_class_exit);
 
diff --git a/net/ieee802154/dgram.c b/net/ieee802154/dgram.c
index fc9193eabd41..b8555ec71387 100644
--- a/net/ieee802154/dgram.c
+++ b/net/ieee802154/dgram.c
@@ -12,10 +12,6 @@
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
- * You should have received a copy of the GNU General Public License along
- * with this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
- *
  * Written by:
  * Sergey Lapin <slapin@ossfans.org>
  * Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
@@ -27,9 +23,9 @@
 #include <linux/if_arp.h>
 #include <linux/list.h>
 #include <linux/slab.h>
+#include <linux/ieee802154.h>
 #include <net/sock.h>
 #include <net/af_ieee802154.h>
-#include <net/ieee802154.h>
 #include <net/ieee802154_netdev.h>
 
 #include <asm/ioctls.h>
diff --git a/net/ieee802154/header_ops.c b/net/ieee802154/header_ops.c
index c09294e39ca6..a051b6993177 100644
--- a/net/ieee802154/header_ops.c
+++ b/net/ieee802154/header_ops.c
@@ -14,8 +14,9 @@
  * Phoebe Buckheister <phoebe.buckheister@itwm.fraunhofer.de>
  */
 
+#include <linux/ieee802154.h>
+
 #include <net/mac802154.h>
-#include <net/ieee802154.h>
 #include <net/ieee802154_netdev.h>
 
 static int
diff --git a/net/ieee802154/ieee802154.h b/net/ieee802154/ieee802154.h
index 5d352f86979e..42ae63a345ab 100644
--- a/net/ieee802154/ieee802154.h
+++ b/net/ieee802154/ieee802154.h
@@ -10,10 +10,6 @@
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
- * You should have received a copy of the GNU General Public License along
- * with this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
- *
  */
 #ifndef IEEE_802154_LOCAL_H
 #define IEEE_802154_LOCAL_H
diff --git a/net/ieee802154/netlink.c b/net/ieee802154/netlink.c
index 9222966f5e6d..6c3c2595a201 100644
--- a/net/ieee802154/netlink.c
+++ b/net/ieee802154/netlink.c
@@ -12,10 +12,6 @@
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
- * You should have received a copy of the GNU General Public License along
- * with this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
- *
  * Written by:
  * Sergey Lapin <slapin@ossfans.org>
  * Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
diff --git a/net/ieee802154/nl-mac.c b/net/ieee802154/nl-mac.c
index c6bfe22bfa5e..abd0f31bdc66 100644
--- a/net/ieee802154/nl-mac.c
+++ b/net/ieee802154/nl-mac.c
@@ -12,10 +12,6 @@
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
- * You should have received a copy of the GNU General Public License along
- * with this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
- *
  * Written by:
  * Sergey Lapin <slapin@ossfans.org>
  * Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
@@ -26,6 +22,7 @@
 #include <linux/kernel.h>
 #include <linux/if_arp.h>
 #include <linux/netdevice.h>
+#include <linux/ieee802154.h>
 #include <net/netlink.h>
 #include <net/genetlink.h>
 #include <net/sock.h>
@@ -33,9 +30,8 @@
 #include <linux/export.h>
 #include <net/af_ieee802154.h>
 #include <net/nl802154.h>
-#include <net/ieee802154.h>
 #include <net/ieee802154_netdev.h>
-#include <net/wpan-phy.h>
+#include <net/cfg802154.h>
 
 #include "ieee802154.h"
 
@@ -668,20 +664,6 @@ int ieee802154_set_macparams(struct sk_buff *skb, struct genl_info *info)
 
         phy = ops->get_phy(dev);
 
-        if ((!phy->set_lbt && info->attrs[IEEE802154_ATTR_LBT_ENABLED]) ||
-            (!phy->set_cca_mode && info->attrs[IEEE802154_ATTR_CCA_MODE]) ||
-            (!phy->set_cca_ed_level &&
-             info->attrs[IEEE802154_ATTR_CCA_ED_LEVEL]) ||
-            (!phy->set_csma_params &&
-             (info->attrs[IEEE802154_ATTR_CSMA_RETRIES] ||
-              info->attrs[IEEE802154_ATTR_CSMA_MIN_BE] ||
-              info->attrs[IEEE802154_ATTR_CSMA_MAX_BE])) ||
-            (!phy->set_frame_retries &&
-             info->attrs[IEEE802154_ATTR_FRAME_RETRIES])) {
-                rc = -EOPNOTSUPP;
-                goto out_phy;
-        }
-
         ops->get_mac_params(dev, &params);
 
         if (info->attrs[IEEE802154_ATTR_TXPOWER])
@@ -712,10 +694,9 @@ int ieee802154_set_macparams(struct sk_buff *skb, struct genl_info *info)
 
         wpan_phy_put(phy);
         dev_put(dev);
-        return rc;
 
-out_phy:
-        wpan_phy_put(phy);
+        return 0;
+
 out:
         dev_put(dev);
         return rc;
diff --git a/net/ieee802154/nl-phy.c b/net/ieee802154/nl-phy.c
index 972baf83411a..0afe760ff512 100644
--- a/net/ieee802154/nl-phy.c
+++ b/net/ieee802154/nl-phy.c
@@ -12,10 +12,6 @@
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
- * You should have received a copy of the GNU General Public License along
- * with this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
- *
  * Written by:
  * Sergey Lapin <slapin@ossfans.org>
  * Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
@@ -27,7 +23,7 @@
 #include <linux/if_arp.h>
 #include <net/netlink.h>
 #include <net/genetlink.h>
-#include <net/wpan-phy.h>
+#include <net/cfg802154.h>
 #include <net/af_ieee802154.h>
 #include <net/ieee802154_netdev.h>
 #include <net/rtnetlink.h> /* for rtnl_{un,}lock */
diff --git a/net/ieee802154/nl_policy.c b/net/ieee802154/nl_policy.c
index 3a703ab88348..35c432668454 100644
--- a/net/ieee802154/nl_policy.c
+++ b/net/ieee802154/nl_policy.c
@@ -12,10 +12,6 @@
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
- * You should have received a copy of the GNU General Public License along
- * with this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
- *
  */
 
 #include <linux/kernel.h>
diff --git a/net/ieee802154/raw.c b/net/ieee802154/raw.c
index 73a4d53463de..21c38945ab8b 100644
--- a/net/ieee802154/raw.c
+++ b/net/ieee802154/raw.c
@@ -12,10 +12,6 @@
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
- * You should have received a copy of the GNU General Public License along
- * with this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
- *
  * Written by:
  * Sergey Lapin <slapin@ossfans.org>
  * Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
diff --git a/net/ieee802154/reassembly.c b/net/ieee802154/reassembly.c
index 7cfcd6885225..9d980ed3ffe2 100644
--- a/net/ieee802154/reassembly.c
+++ b/net/ieee802154/reassembly.c
@@ -33,7 +33,7 @@
 static const char lowpan_frags_cache_name[] = "lowpan-frags";
 
 struct lowpan_frag_info {
-        __be16 d_tag;
+        u16 d_tag;
         u16 d_size;
         u8 d_offset;
 };
@@ -48,7 +48,7 @@ static struct inet_frags lowpan_frags;
 static int lowpan_frag_reasm(struct lowpan_frag_queue *fq,
                              struct sk_buff *prev, struct net_device *dev);
 
-static unsigned int lowpan_hash_frag(__be16 tag, u16 d_size,
+static unsigned int lowpan_hash_frag(u16 tag, u16 d_size,
                                      const struct ieee802154_addr *saddr,
                                      const struct ieee802154_addr *daddr)
 {
@@ -330,11 +330,13 @@ static int lowpan_get_frag_info(struct sk_buff *skb, const u8 frag_type,
 {
         bool fail;
         u8 pattern = 0, low = 0;
+        __be16 d_tag = 0;
 
         fail = lowpan_fetch_skb(skb, &pattern, 1);
         fail |= lowpan_fetch_skb(skb, &low, 1);
         frag_info->d_size = (pattern & 7) << 8 | low;
-        fail |= lowpan_fetch_skb(skb, &frag_info->d_tag, 2);
+        fail |= lowpan_fetch_skb(skb, &d_tag, 2);
+        frag_info->d_tag = ntohs(d_tag);
 
         if (frag_type == LOWPAN_DISPATCH_FRAGN) {
                 fail |= lowpan_fetch_skb(skb, &frag_info->d_offset, 1);
diff --git a/net/ieee802154/reassembly.h b/net/ieee802154/reassembly.h
index 74e4a7c98191..836b16fa001f 100644
--- a/net/ieee802154/reassembly.h
+++ b/net/ieee802154/reassembly.h
@@ -4,7 +4,7 @@
 #include <net/inet_frag.h>
 
 struct lowpan_create_arg {
-        __be16 tag;
+        u16 tag;
         u16 d_size;
         const struct ieee802154_addr *src;
         const struct ieee802154_addr *dst;
@@ -15,7 +15,7 @@ struct lowpan_create_arg {
 struct lowpan_frag_queue {
         struct inet_frag_queue  q;
 
-        __be16                  tag;
+        u16                     tag;
         u16                     d_size;
         struct ieee802154_addr  saddr;
         struct ieee802154_addr  daddr;
diff --git a/net/ieee802154/sysfs.c b/net/ieee802154/sysfs.c
new file mode 100644
index 000000000000..eb9ca6f99122
--- /dev/null
+++ b/net/ieee802154/sysfs.c
@@ -0,0 +1,94 @@
+/* This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * Authors:
+ * Alexander Aring <aar@pengutronix.de>
+ *
+ * Based on: net/wireless/sysfs.c
+ */
+
+#include <linux/device.h>
+
+#include <net/cfg802154.h>
+
+#define MASTER_SHOW_COMPLEX(name, format_string, args...)               \
+static ssize_t name ## _show(struct device *dev,                        \
+                            struct device_attribute *attr, char *buf)   \
+{                                                                       \
+        struct wpan_phy *phy = container_of(dev, struct wpan_phy, dev); \
+        int ret;                                                        \
+                                                                        \
+        mutex_lock(&phy->pib_lock);                                     \
+        ret = snprintf(buf, PAGE_SIZE, format_string "\n", args);       \
+        mutex_unlock(&phy->pib_lock);                                   \
+        return ret;                                                     \
+}                                                                       \
+static DEVICE_ATTR_RO(name)
+
+#define MASTER_SHOW(field, format_string)                               \
+        MASTER_SHOW_COMPLEX(field, format_string, phy->field)
+
+MASTER_SHOW(current_channel, "%d");
+MASTER_SHOW(current_page, "%d");
+MASTER_SHOW(transmit_power, "%d +- 1 dB");
+MASTER_SHOW(cca_mode, "%d");
+
+static ssize_t channels_supported_show(struct device *dev,
+                                       struct device_attribute *attr,
+                                       char *buf)
+{
+        struct wpan_phy *phy = container_of(dev, struct wpan_phy, dev);
+        int ret;
+        int i, len = 0;
+
+        mutex_lock(&phy->pib_lock);
+        for (i = 0; i < 32; i++) {
+                ret = snprintf(buf + len, PAGE_SIZE - len,
+                               "%#09x\n", phy->channels_supported[i]);
+                if (ret < 0)
+                        break;
+                len += ret;
+        }
+        mutex_unlock(&phy->pib_lock);
+        return len;
+}
+static DEVICE_ATTR_RO(channels_supported);
+
+static void wpan_phy_release(struct device *d)
+{
+        struct wpan_phy *phy = container_of(d, struct wpan_phy, dev);
+
+        kfree(phy);
+}
+
+static struct attribute *pmib_attrs[] = {
+        &dev_attr_current_channel.attr,
+        &dev_attr_current_page.attr,
+        &dev_attr_channels_supported.attr,
+        &dev_attr_transmit_power.attr,
+        &dev_attr_cca_mode.attr,
+        NULL,
+};
+ATTRIBUTE_GROUPS(pmib);
+
+struct class wpan_phy_class = {
+        .name = "ieee802154",
+        .dev_release = wpan_phy_release,
+        .dev_groups = pmib_groups,
+};
+
+int wpan_phy_sysfs_init(void)
+{
+        return class_register(&wpan_phy_class);
+}
+
+void wpan_phy_sysfs_exit(void)
+{
+        class_unregister(&wpan_phy_class);
+}
diff --git a/net/ieee802154/sysfs.h b/net/ieee802154/sysfs.h
new file mode 100644
index 000000000000..aa42e39ecbec
--- /dev/null
+++ b/net/ieee802154/sysfs.h
@@ -0,0 +1,9 @@
+#ifndef __IEEE802154_SYSFS_H
+#define __IEEE802154_SYSFS_H
+
+int wpan_phy_sysfs_init(void);
+void wpan_phy_sysfs_exit(void);
+
+extern struct class wpan_phy_class;
+
+#endif /* __IEEE802154_SYSFS_H */
diff --git a/net/mac80211/Kconfig b/net/mac80211/Kconfig
index aeb6a483b3bc..75cc6801a431 100644
--- a/net/mac80211/Kconfig
+++ b/net/mac80211/Kconfig
@@ -33,6 +33,13 @@ config MAC80211_RC_MINSTREL_HT
         ---help---
           This option enables the 'minstrel_ht' TX rate control algorithm
 
+config MAC80211_RC_MINSTREL_VHT
+        bool "Minstrel 802.11ac support" if EXPERT
+        depends on MAC80211_RC_MINSTREL_HT
+        default n
+        ---help---
+          This option enables VHT in the 'minstrel_ht' TX rate control algorithm
+
 choice
         prompt "Default rate control algorithm"
         depends on MAC80211_HAS_RC
@@ -169,6 +176,17 @@ config MAC80211_HT_DEBUG
 
           Do not select this option.
 
+config MAC80211_OCB_DEBUG
+        bool "Verbose OCB debugging"
+        depends on MAC80211_DEBUG_MENU
+        ---help---
+          Selecting this option causes mac80211 to print out
+          very verbose OCB debugging messages. It should not
+          be selected on production systems as those messages
+          are remotely triggerable.
+
+          Do not select this option.
+
 config MAC80211_IBSS_DEBUG
         bool "Verbose IBSS debugging"
         depends on MAC80211_DEBUG_MENU
diff --git a/net/mac80211/Makefile b/net/mac80211/Makefile
index 7273d2796dd1..e53671b1105e 100644
--- a/net/mac80211/Makefile
+++ b/net/mac80211/Makefile
@@ -27,7 +27,8 @@ mac80211-y := \
         event.o \
         chan.o \
         trace.o mlme.o \
-        tdls.o
+        tdls.o \
+        ocb.o
 
 mac80211-$(CONFIG_MAC80211_LEDS) += led.o
 mac80211-$(CONFIG_MAC80211_DEBUGFS) += \
diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index d6986f3aa5c4..9242c60048cf 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -149,11 +149,6 @@ void ieee80211_assign_tid_tx(struct sta_info *sta, int tid,
         rcu_assign_pointer(sta->ampdu_mlme.tid_tx[tid], tid_tx);
 }
 
-static inline int ieee80211_ac_from_tid(int tid)
-{
-        return ieee802_1d_to_ac[tid & 7];
-}
-
 /*
  * When multiple aggregation sessions on multiple stations
  * are being created/destroyed simultaneously, we need to
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 343da1e35025..06185940cbb6 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -20,6 +20,7 @@
 #include "cfg.h"
 #include "rate.h"
 #include "mesh.h"
+#include "wme.h"
 
 static struct wireless_dev *ieee80211_add_iface(struct wiphy *wiphy,
                                                 const char *name,
@@ -190,7 +191,7 @@ static int ieee80211_add_key(struct wiphy *wiphy, struct net_device *dev,
                  * receive the key. When wpa_supplicant has roamed
                  * using FT, it attempts to set the key before
                  * association has completed, this rejects that attempt
-                 * so it will set the key again after assocation.
+                 * so it will set the key again after association.
                  *
                  * TODO: accept the key if we have a station entry and
                  *       add it to the device after the station.
@@ -229,6 +230,7 @@ static int ieee80211_add_key(struct wiphy *wiphy, struct net_device *dev,
         case NUM_NL80211_IFTYPES:
         case NL80211_IFTYPE_P2P_CLIENT:
         case NL80211_IFTYPE_P2P_GO:
+        case NL80211_IFTYPE_OCB:
                 /* shouldn't happen */
                 WARN_ON_ONCE(1);
                 break;
@@ -1225,14 +1227,14 @@ static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev,
 }
 
 static int ieee80211_del_station(struct wiphy *wiphy, struct net_device *dev,
-                                 const u8 *mac)
+                                 struct station_del_parameters *params)
 {
         struct ieee80211_sub_if_data *sdata;
 
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
-        if (mac)
-                return sta_info_destroy_addr_bss(sdata, mac);
+        if (params->mac)
+                return sta_info_destroy_addr_bss(sdata, params->mac);
 
         sta_info_flush(sdata);
         return 0;
@@ -1516,6 +1518,57 @@ static int ieee80211_dump_mpath(struct wiphy *wiphy, struct net_device *dev,
         return 0;
 }
 
+static void mpp_set_pinfo(struct mesh_path *mpath, u8 *mpp,
+                          struct mpath_info *pinfo)
+{
+        memset(pinfo, 0, sizeof(*pinfo));
+        memcpy(mpp, mpath->mpp, ETH_ALEN);
+
+        pinfo->generation = mpp_paths_generation;
+}
+
+static int ieee80211_get_mpp(struct wiphy *wiphy, struct net_device *dev,
+                             u8 *dst, u8 *mpp, struct mpath_info *pinfo)
+
+{
+        struct ieee80211_sub_if_data *sdata;
+        struct mesh_path *mpath;
+
+        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+
+        rcu_read_lock();
+        mpath = mpp_path_lookup(sdata, dst);
+        if (!mpath) {
+                rcu_read_unlock();
+                return -ENOENT;
+        }
+        memcpy(dst, mpath->dst, ETH_ALEN);
+        mpp_set_pinfo(mpath, mpp, pinfo);
+        rcu_read_unlock();
+        return 0;
+}
+
+static int ieee80211_dump_mpp(struct wiphy *wiphy, struct net_device *dev,
+                              int idx, u8 *dst, u8 *mpp,
+                              struct mpath_info *pinfo)
+{
+        struct ieee80211_sub_if_data *sdata;
+        struct mesh_path *mpath;
+
+        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+
+        rcu_read_lock();
+        mpath = mpp_path_lookup_by_idx(sdata, idx);
+        if (!mpath) {
+                rcu_read_unlock();
+                return -ENOENT;
+        }
+        memcpy(dst, mpath->dst, ETH_ALEN);
+        mpp_set_pinfo(mpath, mpp, pinfo);
+        rcu_read_unlock();
+        return 0;
+}
+
 static int ieee80211_get_mesh_config(struct wiphy *wiphy,
                                 struct net_device *dev,
                                 struct mesh_config *conf)
@@ -1966,6 +2019,17 @@ static int ieee80211_leave_ibss(struct wiphy *wiphy, struct net_device *dev)
         return ieee80211_ibss_leave(IEEE80211_DEV_TO_SUB_IF(dev));
 }
 
+static int ieee80211_join_ocb(struct wiphy *wiphy, struct net_device *dev,
+                              struct ocb_setup *setup)
+{
+        return ieee80211_ocb_join(IEEE80211_DEV_TO_SUB_IF(dev), setup);
+}
+
+static int ieee80211_leave_ocb(struct wiphy *wiphy, struct net_device *dev)
+{
+        return ieee80211_ocb_leave(IEEE80211_DEV_TO_SUB_IF(dev));
+}
+
 static int ieee80211_set_mcast_rate(struct wiphy *wiphy, struct net_device *dev,
                                     int rate[IEEE80211_NUM_BANDS])
 {
@@ -2081,6 +2145,9 @@ static int ieee80211_get_tx_power(struct wiphy *wiphy,
         struct ieee80211_local *local = wiphy_priv(wiphy);
         struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);
 
+        if (local->ops->get_txpower)
+                return drv_get_txpower(local, sdata, dbm);
+
         if (!local->use_chanctx)
                 *dbm = local->hw.conf.power_level;
         else
@@ -2850,11 +2917,7 @@ static int __ieee80211_csa_finalize(struct ieee80211_sub_if_data *sdata)
                 if (sdata->reserved_ready)
                         return 0;
 
-                err = ieee80211_vif_use_reserved_context(sdata);
-                if (err)
-                        return err;
-
-                return 0;
+                return ieee80211_vif_use_reserved_context(sdata);
         }
 
         if (!cfg80211_chandef_identical(&sdata->vif.bss_conf.chandef,
@@ -2868,7 +2931,6 @@ static int __ieee80211_csa_finalize(struct ieee80211_sub_if_data *sdata)
                 return err;
 
         ieee80211_bss_info_change_notify(sdata, changed);
-        cfg80211_ch_switch_notify(sdata->dev, &sdata->csa_chandef);
 
         if (sdata->csa_block_tx) {
                 ieee80211_wake_vif_queues(local, sdata,
@@ -2876,6 +2938,12 @@ static int __ieee80211_csa_finalize(struct ieee80211_sub_if_data *sdata)
                 sdata->csa_block_tx = false;
         }
 
+        err = drv_post_channel_switch(sdata);
+        if (err)
+                return err;
+
+        cfg80211_ch_switch_notify(sdata->dev, &sdata->csa_chandef);
+
         return 0;
 }
 
@@ -3053,9 +3121,11 @@ __ieee80211_channel_switch(struct wiphy *wiphy, struct net_device *dev,
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         struct ieee80211_local *local = sdata->local;
+        struct ieee80211_channel_switch ch_switch;
         struct ieee80211_chanctx_conf *conf;
         struct ieee80211_chanctx *chanctx;
-        int err, changed = 0;
+        u32 changed = 0;
+        int err;
 
         sdata_assert_lock(sdata);
         lockdep_assert_held(&local->mtx);
@@ -3088,6 +3158,10 @@ __ieee80211_channel_switch(struct wiphy *wiphy, struct net_device *dev,
                 goto out;
         }
 
+        err = drv_pre_channel_switch(sdata, &ch_switch);
+        if (err)
+                goto out;
+
         err = ieee80211_vif_reserve_chanctx(sdata, &params->chandef,
                                             chanctx->mode,
                                             params->radar_required);
@@ -3101,6 +3175,12 @@ __ieee80211_channel_switch(struct wiphy *wiphy, struct net_device *dev,
                 goto out;
         }
 
+        ch_switch.timestamp = 0;
+        ch_switch.device_timestamp = 0;
+        ch_switch.block_tx = params->block_tx;
+        ch_switch.chandef = params->chandef;
+        ch_switch.count = params->count;
+
         err = ieee80211_set_csa_beacon(sdata, params, &changed);
         if (err) {
                 ieee80211_vif_unreserve_chanctx(sdata);
@@ -3521,6 +3601,76 @@ static int ieee80211_set_ap_chanwidth(struct wiphy *wiphy,
         return ret;
 }
 
+static int ieee80211_add_tx_ts(struct wiphy *wiphy, struct net_device *dev,
+                               u8 tsid, const u8 *peer, u8 up,
+                               u16 admitted_time)
+{
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+        int ac = ieee802_1d_to_ac[up];
+
+        if (sdata->vif.type != NL80211_IFTYPE_STATION)
+                return -EOPNOTSUPP;
+
+        if (!(sdata->wmm_acm & BIT(up)))
+                return -EINVAL;
+
+        if (ifmgd->tx_tspec[ac].admitted_time)
+                return -EBUSY;
+
+        if (admitted_time) {
+                ifmgd->tx_tspec[ac].admitted_time = 32 * admitted_time;
+                ifmgd->tx_tspec[ac].tsid = tsid;
+                ifmgd->tx_tspec[ac].up = up;
+        }
+
+        return 0;
+}
+
+static int ieee80211_del_tx_ts(struct wiphy *wiphy, struct net_device *dev,
+                               u8 tsid, const u8 *peer)
+{
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+        struct ieee80211_local *local = wiphy_priv(wiphy);
+        int ac;
+
+        for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
+                struct ieee80211_sta_tx_tspec *tx_tspec = &ifmgd->tx_tspec[ac];
+
+                /* skip unused entries */
+                if (!tx_tspec->admitted_time)
+                        continue;
+
+                if (tx_tspec->tsid != tsid)
+                        continue;
+
+                /* due to this new packets will be reassigned to non-ACM ACs */
+                tx_tspec->up = -1;
+
+                /* Make sure that all packets have been sent to avoid to
+                 * restore the QoS params on packets that are still on the
+                 * queues.
+                 */
+                synchronize_net();
+                ieee80211_flush_queues(local, sdata);
+
+                /* restore the normal QoS parameters
+                 * (unconditionally to avoid races)
+                 */
+                tx_tspec->action = TX_TSPEC_ACTION_STOP_DOWNGRADE;
+                tx_tspec->downgraded = false;
+                ieee80211_sta_handle_tspec_ac_params(sdata);
+
+                /* finally clear all the data */
+                memset(tx_tspec, 0, sizeof(*tx_tspec));
+
+                return 0;
+        }
+
+        return -ENOENT;
+}
+
 const struct cfg80211_ops mac80211_config_ops = {
         .add_virtual_intf = ieee80211_add_iface,
         .del_virtual_intf = ieee80211_del_iface,
@@ -3547,11 +3697,15 @@ const struct cfg80211_ops mac80211_config_ops = {
         .change_mpath = ieee80211_change_mpath,
         .get_mpath = ieee80211_get_mpath,
         .dump_mpath = ieee80211_dump_mpath,
+        .get_mpp = ieee80211_get_mpp,
+        .dump_mpp = ieee80211_dump_mpp,
         .update_mesh_config = ieee80211_update_mesh_config,
         .get_mesh_config = ieee80211_get_mesh_config,
         .join_mesh = ieee80211_join_mesh,
         .leave_mesh = ieee80211_leave_mesh,
 #endif
+        .join_ocb = ieee80211_join_ocb,
+        .leave_ocb = ieee80211_leave_ocb,
         .change_bss = ieee80211_change_bss,
         .set_txq_params = ieee80211_set_txq_params,
         .set_monitor_channel = ieee80211_set_monitor_channel,
@@ -3597,4 +3751,6 @@ const struct cfg80211_ops mac80211_config_ops = {
         .channel_switch = ieee80211_channel_switch,
         .set_qos_map = ieee80211_set_qos_map,
         .set_ap_chanwidth = ieee80211_set_ap_chanwidth,
+        .add_tx_ts = ieee80211_add_tx_ts,
+        .del_tx_ts = ieee80211_del_tx_ts,
 };
diff --git a/net/mac80211/chan.c b/net/mac80211/chan.c
index 4c74e8da64b9..c7c514220298 100644
--- a/net/mac80211/chan.c
+++ b/net/mac80211/chan.c
@@ -270,6 +270,7 @@ ieee80211_get_chanctx_max_required_bw(struct ieee80211_local *local,
                 case NL80211_IFTYPE_ADHOC:
                 case NL80211_IFTYPE_WDS:
                 case NL80211_IFTYPE_MESH_POINT:
+                case NL80211_IFTYPE_OCB:
                         width = vif->bss_conf.chandef.width;
                         break;
                 case NL80211_IFTYPE_UNSPECIFIED:
@@ -674,6 +675,7 @@ void ieee80211_recalc_smps_chanctx(struct ieee80211_local *local,
                 case NL80211_IFTYPE_ADHOC:
                 case NL80211_IFTYPE_WDS:
                 case NL80211_IFTYPE_MESH_POINT:
+                case NL80211_IFTYPE_OCB:
                         break;
                 default:
                         WARN_ON_ONCE(1);
@@ -909,6 +911,7 @@ ieee80211_vif_chanctx_reservation_complete(struct ieee80211_sub_if_data *sdata)
         case NL80211_IFTYPE_ADHOC:
         case NL80211_IFTYPE_AP:
         case NL80211_IFTYPE_MESH_POINT:
+        case NL80211_IFTYPE_OCB:
                 ieee80211_queue_work(&sdata->local->hw,
                                      &sdata->csa_finalize_work);
                 break;
@@ -1634,7 +1637,7 @@ int ieee80211_vif_change_bandwidth(struct ieee80211_sub_if_data *sdata,
                 }
                 break;
         case IEEE80211_CHANCTX_WILL_BE_REPLACED:
-                /* TODO: Perhaps the bandwith change could be treated as a
+                /* TODO: Perhaps the bandwidth change could be treated as a
                  * reservation itself? */
                 ret = -EBUSY;
                 goto out;
diff --git a/net/mac80211/debug.h b/net/mac80211/debug.h
index 493d68061f0c..1956b3115dd5 100644
--- a/net/mac80211/debug.h
+++ b/net/mac80211/debug.h
@@ -2,6 +2,12 @@
 #define __MAC80211_DEBUG_H
 #include <net/cfg80211.h>
 
+#ifdef CONFIG_MAC80211_OCB_DEBUG
+#define MAC80211_OCB_DEBUG 1
+#else
+#define MAC80211_OCB_DEBUG 0
+#endif
+
 #ifdef CONFIG_MAC80211_IBSS_DEBUG
 #define MAC80211_IBSS_DEBUG 1
 #else
@@ -131,6 +137,10 @@ do {									\
         _sdata_dbg(MAC80211_HT_DEBUG && net_ratelimit(),                \
                    sdata, fmt, ##__VA_ARGS__)
 
+#define ocb_dbg(sdata, fmt, ...)                                        \
+        _sdata_dbg(MAC80211_OCB_DEBUG,                                  \
+                   sdata, fmt, ##__VA_ARGS__)
+
 #define ibss_dbg(sdata, fmt, ...)                                       \
         _sdata_dbg(MAC80211_IBSS_DEBUG,                                 \
                    sdata, fmt, ##__VA_ARGS__)
diff --git a/net/mac80211/debugfs_key.c b/net/mac80211/debugfs_key.c
index 1521cabad3d6..5523b94c7c90 100644
--- a/net/mac80211/debugfs_key.c
+++ b/net/mac80211/debugfs_key.c
@@ -300,10 +300,8 @@ void ieee80211_debugfs_key_update_default(struct ieee80211_sub_if_data *sdata)
 
         lockdep_assert_held(&sdata->local->key_mtx);
 
-        if (sdata->debugfs.default_unicast_key) {
-                debugfs_remove(sdata->debugfs.default_unicast_key);
-                sdata->debugfs.default_unicast_key = NULL;
-        }
+        debugfs_remove(sdata->debugfs.default_unicast_key);
+        sdata->debugfs.default_unicast_key = NULL;
 
         if (sdata->default_unicast_key) {
                 key = key_mtx_dereference(sdata->local,
@@ -314,10 +312,8 @@ void ieee80211_debugfs_key_update_default(struct ieee80211_sub_if_data *sdata)
                                                sdata->vif.debugfs_dir, buf);
         }
 
-        if (sdata->debugfs.default_multicast_key) {
-                debugfs_remove(sdata->debugfs.default_multicast_key);
-                sdata->debugfs.default_multicast_key = NULL;
-        }
+        debugfs_remove(sdata->debugfs.default_multicast_key);
+        sdata->debugfs.default_multicast_key = NULL;
 
         if (sdata->default_multicast_key) {
                 key = key_mtx_dereference(sdata->local,
diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
index 196d48c68134..9759dd1f0734 100644
--- a/net/mac80211/driver-ops.h
+++ b/net/mac80211/driver-ops.h
@@ -214,7 +214,8 @@ static inline void drv_bss_info_changed(struct ieee80211_local *local,
                                     BSS_CHANGED_BEACON_ENABLED) &&
                          sdata->vif.type != NL80211_IFTYPE_AP &&
                          sdata->vif.type != NL80211_IFTYPE_ADHOC &&
-                         sdata->vif.type != NL80211_IFTYPE_MESH_POINT))
+                         sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
+                         sdata->vif.type != NL80211_IFTYPE_OCB))
                 return;
 
         if (WARN_ON_ONCE(sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE ||
@@ -631,6 +632,12 @@ static inline int drv_conf_tx(struct ieee80211_local *local,
         if (!check_sdata_in_driver(sdata))
                 return -EIO;
 
+        if (WARN_ONCE(params->cw_min == 0 ||
+                      params->cw_min > params->cw_max,
+                      "%s: invalid CW_min/CW_max: %d/%d\n",
+                      sdata->name, params->cw_min, params->cw_max))
+                return -EINVAL;
+
         trace_drv_conf_tx(local, sdata, ac, params);
         if (local->ops->conf_tx)
                 ret = local->ops->conf_tx(&local->hw, &sdata->vif,
@@ -764,12 +771,13 @@ static inline void drv_flush(struct ieee80211_local *local,
 }
 
 static inline void drv_channel_switch(struct ieee80211_local *local,
-                                     struct ieee80211_channel_switch *ch_switch)
+                                      struct ieee80211_sub_if_data *sdata,
+                                      struct ieee80211_channel_switch *ch_switch)
 {
         might_sleep();
 
-        trace_drv_channel_switch(local, ch_switch);
-        local->ops->channel_switch(&local->hw, ch_switch);
+        trace_drv_channel_switch(local, sdata, ch_switch);
+        local->ops->channel_switch(&local->hw, &sdata->vif, ch_switch);
         trace_drv_return_void(local);
 }
 
@@ -1144,13 +1152,15 @@ static inline void drv_stop_ap(struct ieee80211_local *local,
         trace_drv_return_void(local);
 }
 
-static inline void drv_restart_complete(struct ieee80211_local *local)
+static inline void
+drv_reconfig_complete(struct ieee80211_local *local,
+                      enum ieee80211_reconfig_type reconfig_type)
 {
         might_sleep();
 
-        trace_drv_restart_complete(local);
-        if (local->ops->restart_complete)
-                local->ops->restart_complete(&local->hw);
+        trace_drv_reconfig_complete(local, reconfig_type);
+        if (local->ops->reconfig_complete)
+                local->ops->reconfig_complete(&local->hw, reconfig_type);
         trace_drv_return_void(local);
 }
 
@@ -1196,6 +1206,40 @@ drv_channel_switch_beacon(struct ieee80211_sub_if_data *sdata,
         }
 }
 
+static inline int
+drv_pre_channel_switch(struct ieee80211_sub_if_data *sdata,
+                       struct ieee80211_channel_switch *ch_switch)
+{
+        struct ieee80211_local *local = sdata->local;
+        int ret = 0;
+
+        if (!check_sdata_in_driver(sdata))
+                return -EIO;
+
+        trace_drv_pre_channel_switch(local, sdata, ch_switch);
+        if (local->ops->pre_channel_switch)
+                ret = local->ops->pre_channel_switch(&local->hw, &sdata->vif,
+                                                     ch_switch);
+        trace_drv_return_int(local, ret);
+        return ret;
+}
+
+static inline int
+drv_post_channel_switch(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_local *local = sdata->local;
+        int ret = 0;
+
+        if (!check_sdata_in_driver(sdata))
+                return -EIO;
+
+        trace_drv_post_channel_switch(local, sdata);
+        if (local->ops->post_channel_switch)
+                ret = local->ops->post_channel_switch(&local->hw, &sdata->vif);
+        trace_drv_return_int(local, ret);
+        return ret;
+}
+
 static inline int drv_join_ibss(struct ieee80211_local *local,
                                 struct ieee80211_sub_if_data *sdata)
 {
@@ -1238,4 +1282,18 @@ static inline u32 drv_get_expected_throughput(struct ieee80211_local *local,
         return ret;
 }
 
+static inline int drv_get_txpower(struct ieee80211_local *local,
+                                  struct ieee80211_sub_if_data *sdata, int *dbm)
+{
+        int ret;
+
+        if (!local->ops->get_txpower)
+                return -EOPNOTSUPP;
+
+        ret = local->ops->get_txpower(&local->hw, &sdata->vif, dbm);
+        trace_drv_get_txpower(local, sdata, *dbm, ret);
+
+        return ret;
+}
+
 #endif /* __MAC80211_DRIVER_OPS */
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index c2aaec4dfcf0..a51c993ece73 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -131,7 +131,7 @@ enum ieee80211_bss_corrupt_data_flags {
  *
  * These are bss flags that are attached to a bss in the
  * @valid_data field of &struct ieee80211_bss.  They show which parts
- * of the data structure were recieved as a result of an un-corrupted
+ * of the data structure were received as a result of an un-corrupted
  * beacon/probe response.
  */
 enum ieee80211_bss_valid_data_flags {
@@ -399,6 +399,24 @@ struct ieee80211_mgd_assoc_data {
         u8 ie[];
 };
 
+struct ieee80211_sta_tx_tspec {
+        /* timestamp of the first packet in the time slice */
+        unsigned long time_slice_start;
+
+        u32 admitted_time; /* in usecs, unlike over the air */
+        u8 tsid;
+        s8 up; /* signed to be able to invalidate with -1 during teardown */
+
+        /* consumed TX time in microseconds in the time slice */
+        u32 consumed_tx_time;
+        enum {
+                TX_TSPEC_ACTION_NONE = 0,
+                TX_TSPEC_ACTION_DOWNGRADE,
+                TX_TSPEC_ACTION_STOP_DOWNGRADE,
+        } action;
+        bool downgraded;
+};
+
 struct ieee80211_if_managed {
         struct timer_list timer;
         struct timer_list conn_mon_timer;
@@ -434,6 +452,8 @@ struct ieee80211_if_managed {
 
         unsigned int flags;
 
+        bool csa_waiting_bcn;
+
         bool beacon_crc_valid;
         u32 beacon_crc;
 
@@ -507,6 +527,16 @@ struct ieee80211_if_managed {
 
         u8 tdls_peer[ETH_ALEN] __aligned(2);
         struct delayed_work tdls_peer_del_work;
+
+        /* WMM-AC TSPEC support */
+        struct ieee80211_sta_tx_tspec tx_tspec[IEEE80211_NUM_ACS];
+        /* Use a separate work struct so that we can do something here
+         * while the sdata->work is flushing the queues, for example.
+         * otherwise, in scenarios where we hardly get any traffic out
+         * on the BE queue, but there's a lot of VO traffic, we might
+         * get stuck in a downgraded situation and flush takes forever.
+         */
+        struct delayed_work tx_tspec_wk;
 };
 
 struct ieee80211_if_ibss {
@@ -547,6 +577,25 @@ struct ieee80211_if_ibss {
 };
 
 /**
+ * struct ieee80211_if_ocb - OCB mode state
+ *
+ * @housekeeping_timer: timer for periodic invocation of a housekeeping task
+ * @wrkq_flags: OCB deferred task action
+ * @incomplete_lock: delayed STA insertion lock
+ * @incomplete_stations: list of STAs waiting for delayed insertion
+ * @joined: indication if the interface is connected to an OCB network
+ */
+struct ieee80211_if_ocb {
+        struct timer_list housekeeping_timer;
+        unsigned long wrkq_flags;
+
+        spinlock_t incomplete_lock;
+        struct list_head incomplete_stations;
+
+        bool joined;
+};
+
+/**
  * struct ieee80211_mesh_sync_ops - Extensible synchronization framework interface
  *
  * these declarations define the interface, which enables
@@ -839,6 +888,7 @@ struct ieee80211_sub_if_data {
                 struct ieee80211_if_managed mgd;
                 struct ieee80211_if_ibss ibss;
                 struct ieee80211_if_mesh mesh;
+                struct ieee80211_if_ocb ocb;
                 u32 mntr_flags;
         } u;
 
@@ -1307,6 +1357,9 @@ struct ieee80211_local {
         /* virtual monitor interface */
         struct ieee80211_sub_if_data __rcu *monitor_sdata;
         struct cfg80211_chan_def monitor_chandef;
+
+        /* extended capabilities provided by mac80211 */
+        u8 ext_capa[8];
 };
 
 static inline struct ieee80211_sub_if_data *
@@ -1454,6 +1507,7 @@ void ieee80211_mgd_conn_tx_status(struct ieee80211_sub_if_data *sdata,
                                   __le16 fc, bool acked);
 void ieee80211_mgd_quiesce(struct ieee80211_sub_if_data *sdata);
 void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata);
+void ieee80211_sta_handle_tspec_ac_params(struct ieee80211_sub_if_data *sdata);
 
 /* IBSS code */
 void ieee80211_ibss_notify_scan_completed(struct ieee80211_local *local);
@@ -1471,6 +1525,15 @@ int ieee80211_ibss_csa_beacon(struct ieee80211_sub_if_data *sdata,
 int ieee80211_ibss_finish_csa(struct ieee80211_sub_if_data *sdata);
 void ieee80211_ibss_stop(struct ieee80211_sub_if_data *sdata);
 
+/* OCB code */
+void ieee80211_ocb_work(struct ieee80211_sub_if_data *sdata);
+void ieee80211_ocb_rx_no_sta(struct ieee80211_sub_if_data *sdata,
+                             const u8 *bssid, const u8 *addr, u32 supp_rates);
+void ieee80211_ocb_setup_sdata(struct ieee80211_sub_if_data *sdata);
+int ieee80211_ocb_join(struct ieee80211_sub_if_data *sdata,
+                       struct ocb_setup *setup);
+int ieee80211_ocb_leave(struct ieee80211_sub_if_data *sdata);
+
 /* mesh code */
 void ieee80211_mesh_work(struct ieee80211_sub_if_data *sdata);
 void ieee80211_mesh_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
@@ -1758,6 +1821,13 @@ static inline bool ieee80211_rx_reorder_ready(struct sk_buff_head *frames)
         return true;
 }
 
+extern const int ieee802_1d_to_ac[8];
+
+static inline int ieee80211_ac_from_tid(int tid)
+{
+        return ieee802_1d_to_ac[tid & 7];
+}
+
 void ieee80211_dynamic_ps_enable_work(struct work_struct *work);
 void ieee80211_dynamic_ps_disable_work(struct work_struct *work);
 void ieee80211_dynamic_ps_timer(unsigned long data);
@@ -1767,7 +1837,7 @@ void ieee80211_send_nullfunc(struct ieee80211_local *local,
 void ieee80211_sta_rx_notify(struct ieee80211_sub_if_data *sdata,
                              struct ieee80211_hdr *hdr);
 void ieee80211_sta_tx_notify(struct ieee80211_sub_if_data *sdata,
-                             struct ieee80211_hdr *hdr, bool ack);
+                             struct ieee80211_hdr *hdr, bool ack, u16 tx_time);
 
 void ieee80211_wake_queues_by_reason(struct ieee80211_hw *hw,
                                      unsigned long queues,
@@ -1833,8 +1903,10 @@ int __ieee80211_request_smps_ap(struct ieee80211_sub_if_data *sdata,
 void ieee80211_recalc_smps(struct ieee80211_sub_if_data *sdata);
 void ieee80211_recalc_min_chandef(struct ieee80211_sub_if_data *sdata);
 
-size_t ieee80211_ie_split(const u8 *ies, size_t ielen,
-                          const u8 *ids, int n_ids, size_t offset);
+size_t ieee80211_ie_split_ric(const u8 *ies, size_t ielen,
+                              const u8 *ids, int n_ids,
+                              const u8 *after_ric, int n_after_ric,
+                              size_t offset);
 size_t ieee80211_ie_split_vendor(const u8 *ies, size_t ielen, size_t offset);
 u8 *ieee80211_ie_build_ht_cap(u8 *pos, struct ieee80211_sta_ht_cap *ht_cap,
                               u16 cap);
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index af237223a8cd..6b631c049eba 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -259,6 +259,15 @@ static int ieee80211_check_concurrent_iface(struct ieee80211_sub_if_data *sdata,
         list_for_each_entry(nsdata, &local->interfaces, list) {
                 if (nsdata != sdata && ieee80211_sdata_running(nsdata)) {
                         /*
+                         * Only OCB and monitor mode may coexist
+                         */
+                        if ((sdata->vif.type == NL80211_IFTYPE_OCB &&
+                             nsdata->vif.type != NL80211_IFTYPE_MONITOR) ||
+                            (sdata->vif.type != NL80211_IFTYPE_MONITOR &&
+                             nsdata->vif.type == NL80211_IFTYPE_OCB))
+                                return -EBUSY;
+
+                        /*
                          * Allow only a single IBSS interface to be up at any
                          * time. This is restricted because beacon distribution
                          * cannot work properly if both are in the same IBSS.
@@ -521,6 +530,7 @@ int ieee80211_do_open(struct wireless_dev *wdev, bool coming_up)
         case NL80211_IFTYPE_MONITOR:
         case NL80211_IFTYPE_ADHOC:
         case NL80211_IFTYPE_P2P_DEVICE:
+        case NL80211_IFTYPE_OCB:
                 /* no special treatment */
                 break;
         case NL80211_IFTYPE_UNSPECIFIED:
@@ -631,6 +641,7 @@ int ieee80211_do_open(struct wireless_dev *wdev, bool coming_up)
                 case NL80211_IFTYPE_ADHOC:
                 case NL80211_IFTYPE_AP:
                 case NL80211_IFTYPE_MESH_POINT:
+                case NL80211_IFTYPE_OCB:
                         netif_carrier_off(dev);
                         break;
                 case NL80211_IFTYPE_WDS:
@@ -842,6 +853,8 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
         sdata_lock(sdata);
         mutex_lock(&local->mtx);
         sdata->vif.csa_active = false;
+        if (sdata->vif.type == NL80211_IFTYPE_STATION)
+                sdata->u.mgd.csa_waiting_bcn = false;
         if (sdata->csa_block_tx) {
                 ieee80211_wake_vif_queues(local, sdata,
                                           IEEE80211_QUEUE_STOP_REASON_CSA);
@@ -1279,6 +1292,9 @@ static void ieee80211_iface_work(struct work_struct *work)
                         break;
                 ieee80211_mesh_work(sdata);
                 break;
+        case NL80211_IFTYPE_OCB:
+                ieee80211_ocb_work(sdata);
+                break;
         default:
                 break;
         }
@@ -1298,6 +1314,9 @@ static void ieee80211_recalc_smps_work(struct work_struct *work)
 static void ieee80211_setup_sdata(struct ieee80211_sub_if_data *sdata,
                                   enum nl80211_iftype type)
 {
+        static const u8 bssid_wildcard[ETH_ALEN] = {0xff, 0xff, 0xff,
+                                                    0xff, 0xff, 0xff};
+
         /* clear type-dependent union */
         memset(&sdata->u, 0, sizeof(sdata->u));
 
@@ -1349,6 +1368,10 @@ static void ieee80211_setup_sdata(struct ieee80211_sub_if_data *sdata,
                 sdata->vif.bss_conf.bssid = sdata->u.mgd.bssid;
                 ieee80211_sta_setup_sdata(sdata);
                 break;
+        case NL80211_IFTYPE_OCB:
+                sdata->vif.bss_conf.bssid = bssid_wildcard;
+                ieee80211_ocb_setup_sdata(sdata);
+                break;
         case NL80211_IFTYPE_ADHOC:
                 sdata->vif.bss_conf.bssid = sdata->u.ibss.bssid;
                 ieee80211_ibss_setup_sdata(sdata);
@@ -1396,6 +1419,7 @@ static int ieee80211_runtime_change_iftype(struct ieee80211_sub_if_data *sdata,
         case NL80211_IFTYPE_AP:
         case NL80211_IFTYPE_STATION:
         case NL80211_IFTYPE_ADHOC:
+        case NL80211_IFTYPE_OCB:
                 /*
                  * Could maybe also all others here?
                  * Just not sure how that interacts
@@ -1411,6 +1435,7 @@ static int ieee80211_runtime_change_iftype(struct ieee80211_sub_if_data *sdata,
         case NL80211_IFTYPE_AP:
         case NL80211_IFTYPE_STATION:
         case NL80211_IFTYPE_ADHOC:
+        case NL80211_IFTYPE_OCB:
                 /*
                  * Could probably support everything
                  * but WDS here (WDS do_open can fail
@@ -1669,7 +1694,10 @@ int ieee80211_if_add(struct ieee80211_local *local, const char *name,
                 }
 
                 ieee80211_assign_perm_addr(local, ndev->perm_addr, type);
-                memcpy(ndev->dev_addr, ndev->perm_addr, ETH_ALEN);
+                if (params && is_valid_ether_addr(params->macaddr))
+                        memcpy(ndev->dev_addr, params->macaddr, ETH_ALEN);
+                else
+                        memcpy(ndev->dev_addr, ndev->perm_addr, ETH_ALEN);
                 SET_NETDEV_DEV(ndev, wiphy_dev(local->hw.wiphy));
 
                 /* don't use IEEE80211_DEV_TO_SUB_IF -- it checks too much */
diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index 4712150dc210..434a91ad12c8 100644
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -94,8 +94,17 @@ static int ieee80211_key_enable_hw_accel(struct ieee80211_key *key)
 
         might_sleep();
 
-        if (key->flags & KEY_FLAG_TAINTED)
+        if (key->flags & KEY_FLAG_TAINTED) {
+                /* If we get here, it's during resume and the key is
+                 * tainted so shouldn't be used/programmed any more.
+                 * However, its flags may still indicate that it was
+                 * programmed into the device (since we're in resume)
+                 * so clear that flag now to avoid trying to remove
+                 * it again later.
+                 */
+                key->flags &= ~KEY_FLAG_UPLOADED_TO_HARDWARE;
                 return -EINVAL;
+        }
 
         if (!key->local->ops->set_key)
                 goto out_unsupported;
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 0de7c93bf62b..282a4f36eb92 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -478,13 +478,9 @@ static const struct ieee80211_vht_cap mac80211_vht_capa_mod_mask = {
         },
 };
 
-static const u8 extended_capabilities[] = {
-        0, 0, 0, 0, 0, 0, 0,
-        WLAN_EXT_CAPA8_OPMODE_NOTIF,
-};
-
-struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
-                                        const struct ieee80211_ops *ops)
+struct ieee80211_hw *ieee80211_alloc_hw_nm(size_t priv_data_len,
+                                           const struct ieee80211_ops *ops,
+                                           const char *requested_name)
 {
         struct ieee80211_local *local;
         int priv_size, i;
@@ -524,7 +520,7 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
          */
         priv_size = ALIGN(sizeof(*local), NETDEV_ALIGN) + priv_data_len;
 
-        wiphy = wiphy_new(&mac80211_config_ops, priv_size);
+        wiphy = wiphy_new_nm(&mac80211_config_ops, priv_size, requested_name);
 
         if (!wiphy)
                 return NULL;
@@ -539,10 +535,6 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
                         WIPHY_FLAG_REPORTS_OBSS |
                         WIPHY_FLAG_OFFCHAN_TX;
 
-        wiphy->extended_capabilities = extended_capabilities;
-        wiphy->extended_capabilities_mask = extended_capabilities;
-        wiphy->extended_capabilities_len = ARRAY_SIZE(extended_capabilities);
-
         if (ops->remain_on_channel)
                 wiphy->flags |= WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL;
 
@@ -550,6 +542,7 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
                            NL80211_FEATURE_SAE |
                            NL80211_FEATURE_HT_IBSS |
                            NL80211_FEATURE_VIF_TXPOWER |
+                           NL80211_FEATURE_MAC_ON_CREATE |
                            NL80211_FEATURE_USERSPACE_MPM;
 
         if (!ops->hw_scan)
@@ -591,6 +584,13 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
         wiphy->ht_capa_mod_mask = &mac80211_ht_capa_mod_mask;
         wiphy->vht_capa_mod_mask = &mac80211_vht_capa_mod_mask;
 
+        local->ext_capa[7] = WLAN_EXT_CAPA8_OPMODE_NOTIF;
+
+        wiphy->extended_capabilities = local->ext_capa;
+        wiphy->extended_capabilities_mask = local->ext_capa;
+        wiphy->extended_capabilities_len =
+                ARRAY_SIZE(local->ext_capa);
+
         INIT_LIST_HEAD(&local->interfaces);
 
         __hw_addr_init(&local->mc_list);
@@ -651,7 +651,7 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
 
         return &local->hw;
 }
-EXPORT_SYMBOL(ieee80211_alloc_hw);
+EXPORT_SYMBOL(ieee80211_alloc_hw_nm);
 
 static int ieee80211_init_cipher_suites(struct ieee80211_local *local)
 {
@@ -787,13 +787,14 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
                 if (local->hw.wiphy->interface_modes & BIT(NL80211_IFTYPE_WDS))
                         return -EINVAL;
 
-                /* DFS currently not supported with channel context drivers */
+                /* DFS is not supported with multi-channel combinations yet */
                 for (i = 0; i < local->hw.wiphy->n_iface_combinations; i++) {
                         const struct ieee80211_iface_combination *comb;
 
                         comb = &local->hw.wiphy->iface_combinations[i];
 
-                        if (comb->radar_detect_widths)
+                        if (comb->radar_detect_widths &&
+                            comb->num_different_channels > 1)
                                 return -EINVAL;
                 }
         }
@@ -958,6 +959,10 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
         if (local->hw.wiphy->flags & WIPHY_FLAG_SUPPORTS_TDLS)
                 local->hw.wiphy->flags |= WIPHY_FLAG_TDLS_EXTERNAL_SETUP;
 
+        /* mac80211 supports eCSA, if the driver supports STA CSA at all */
+        if (local->hw.flags & IEEE80211_HW_CHANCTX_STA_CSA)
+                local->ext_capa[0] |= WLAN_EXT_CAPA1_EXT_CHANNEL_SWITCHING;
+
         local->hw.wiphy->max_num_csa_counters = IEEE80211_MAX_CSA_COUNTERS_NUM;
 
         result = wiphy_register(local->hw.wiphy);
@@ -1019,7 +1024,8 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
         }
 
         /* add one default STA interface if supported */
-        if (local->hw.wiphy->interface_modes & BIT(NL80211_IFTYPE_STATION)) {
+        if (local->hw.wiphy->interface_modes & BIT(NL80211_IFTYPE_STATION) &&
+            !(hw->flags & IEEE80211_HW_NO_AUTO_VIF)) {
                 result = ieee80211_if_add(local, "wlan%d", NULL,
                                           NL80211_IFTYPE_STATION, NULL);
                 if (result)
diff --git a/net/mac80211/mesh.h b/net/mac80211/mesh.h
index f39a19f9090f..50c8473cf9dc 100644
--- a/net/mac80211/mesh.h
+++ b/net/mac80211/mesh.h
@@ -270,6 +270,8 @@ int mpp_path_add(struct ieee80211_sub_if_data *sdata,
                  const u8 *dst, const u8 *mpp);
 struct mesh_path *
 mesh_path_lookup_by_idx(struct ieee80211_sub_if_data *sdata, int idx);
+struct mesh_path *
+mpp_path_lookup_by_idx(struct ieee80211_sub_if_data *sdata, int idx);
 void mesh_path_fix_nexthop(struct mesh_path *mpath, struct sta_info *next_hop);
 void mesh_path_expire(struct ieee80211_sub_if_data *sdata);
 void mesh_rx_path_sel_frame(struct ieee80211_sub_if_data *sdata,
@@ -317,6 +319,7 @@ void mesh_path_tx_root_frame(struct ieee80211_sub_if_data *sdata);
 
 bool mesh_action_is_path_sel(struct ieee80211_mgmt *mgmt);
 extern int mesh_paths_generation;
+extern int mpp_paths_generation;
 
 #ifdef CONFIG_MAC80211_MESH
 static inline
diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c
index a6699dceae7c..b890e225a8f1 100644
--- a/net/mac80211/mesh_pathtbl.c
+++ b/net/mac80211/mesh_pathtbl.c
@@ -44,6 +44,7 @@ static struct mesh_table __rcu *mesh_paths;
 static struct mesh_table __rcu *mpp_paths; /* Store paths for MPP&MAP */
 
 int mesh_paths_generation;
+int mpp_paths_generation;
 
 /* This lock will have the grow table function as writer and add / delete nodes
  * as readers. RCU provides sufficient protection only when reading the table
@@ -410,6 +411,33 @@ mesh_path_lookup_by_idx(struct ieee80211_sub_if_data *sdata, int idx)
 }
 
 /**
+ * mpp_path_lookup_by_idx - look up a path in the proxy path table by its index
+ * @idx: index
+ * @sdata: local subif, or NULL for all entries
+ *
+ * Returns: pointer to the proxy path structure, or NULL if not found.
+ *
+ * Locking: must be called within a read rcu section.
+ */
+struct mesh_path *
+mpp_path_lookup_by_idx(struct ieee80211_sub_if_data *sdata, int idx)
+{
+        struct mesh_table *tbl = rcu_dereference(mpp_paths);
+        struct mpath_node *node;
+        int i;
+        int j = 0;
+
+        for_each_mesh_entry(tbl, node, i) {
+                if (sdata && node->mpath->sdata != sdata)
+                        continue;
+                if (j++ == idx)
+                        return node->mpath;
+        }
+
+        return NULL;
+}
+
+/**
  * mesh_path_add_gate - add the given mpath to a mesh gate to our path table
  * @mpath: gate path to add to table
  */
@@ -691,6 +719,9 @@ int mpp_path_add(struct ieee80211_sub_if_data *sdata,
 
         spin_unlock(&tbl->hashwlock[hash_idx]);
         read_unlock_bh(&pathtbl_resize_lock);
+
+        mpp_paths_generation++;
+
         if (grow) {
                 set_bit(MESH_WORK_GROW_MPP_TABLE,  &ifmsh->wrkq_flags);
                 ieee80211_queue_work(&local->hw, &sdata->work);
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 2de88704278b..213a420704a6 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -775,11 +775,30 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
                         WLAN_EID_QOS_CAPA,
                         WLAN_EID_RRM_ENABLED_CAPABILITIES,
                         WLAN_EID_MOBILITY_DOMAIN,
+                        WLAN_EID_FAST_BSS_TRANSITION,   /* reassoc only */
+                        WLAN_EID_RIC_DATA,              /* reassoc only */
                         WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
                 };
-                noffset = ieee80211_ie_split(assoc_data->ie, assoc_data->ie_len,
-                                             before_ht, ARRAY_SIZE(before_ht),
-                                             offset);
+                static const u8 after_ric[] = {
+                        WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
+                        WLAN_EID_HT_CAPABILITY,
+                        WLAN_EID_BSS_COEX_2040,
+                        WLAN_EID_EXT_CAPABILITY,
+                        WLAN_EID_QOS_TRAFFIC_CAPA,
+                        WLAN_EID_TIM_BCAST_REQ,
+                        WLAN_EID_INTERWORKING,
+                        /* 60GHz doesn't happen right now */
+                        WLAN_EID_VHT_CAPABILITY,
+                        WLAN_EID_OPMODE_NOTIF,
+                };
+
+                noffset = ieee80211_ie_split_ric(assoc_data->ie,
+                                                 assoc_data->ie_len,
+                                                 before_ht,
+                                                 ARRAY_SIZE(before_ht),
+                                                 after_ric,
+                                                 ARRAY_SIZE(after_ric),
+                                                 offset);
                 pos = skb_put(skb, noffset - offset);
                 memcpy(pos, assoc_data->ie + offset, noffset - offset);
                 offset = noffset;
@@ -813,6 +832,8 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
                         WLAN_EID_TIM_BCAST_REQ,
                         WLAN_EID_INTERWORKING,
                 };
+
+                /* RIC already taken above, so no need to handle here anymore */
                 noffset = ieee80211_ie_split(assoc_data->ie, assoc_data->ie_len,
                                              before_vht, ARRAY_SIZE(before_vht),
                                              offset);
@@ -1001,14 +1022,7 @@ static void ieee80211_chswitch_work(struct work_struct *work)
         /* XXX: shouldn't really modify cfg80211-owned data! */
         ifmgd->associated->channel = sdata->csa_chandef.chan;
 
-        sdata->vif.csa_active = false;
-
-        /* XXX: wait for a beacon first? */
-        if (sdata->csa_block_tx) {
-                ieee80211_wake_vif_queues(local, sdata,
-                                          IEEE80211_QUEUE_STOP_REASON_CSA);
-                sdata->csa_block_tx = false;
-        }
+        ifmgd->csa_waiting_bcn = true;
 
         ieee80211_sta_reset_beacon_monitor(sdata);
         ieee80211_sta_reset_conn_monitor(sdata);
@@ -1019,6 +1033,35 @@ out:
         sdata_unlock(sdata);
 }
 
+static void ieee80211_chswitch_post_beacon(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+        int ret;
+
+        sdata_assert_lock(sdata);
+
+        WARN_ON(!sdata->vif.csa_active);
+
+        if (sdata->csa_block_tx) {
+                ieee80211_wake_vif_queues(local, sdata,
+                                          IEEE80211_QUEUE_STOP_REASON_CSA);
+                sdata->csa_block_tx = false;
+        }
+
+        sdata->vif.csa_active = false;
+        ifmgd->csa_waiting_bcn = false;
+
+        ret = drv_post_channel_switch(sdata);
+        if (ret) {
+                sdata_info(sdata,
+                           "driver post channel switch failed, disconnecting\n");
+                ieee80211_queue_work(&local->hw,
+                                     &ifmgd->csa_connection_drop_work);
+                return;
+        }
+}
+
 void ieee80211_chswitch_done(struct ieee80211_vif *vif, bool success)
 {
         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
@@ -1046,7 +1089,8 @@ static void ieee80211_chswitch_timer(unsigned long data)
 
 static void
 ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
-                                 u64 timestamp, struct ieee802_11_elems *elems,
+                                 u64 timestamp, u32 device_timestamp,
+                                 struct ieee802_11_elems *elems,
                                  bool beacon)
 {
         struct ieee80211_local *local = sdata->local;
@@ -1056,6 +1100,7 @@ ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_chanctx *chanctx;
         enum ieee80211_band current_band;
         struct ieee80211_csa_ie csa_ie;
+        struct ieee80211_channel_switch ch_switch;
         int res;
 
         sdata_assert_lock(sdata);
@@ -1110,21 +1155,31 @@ ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
 
         chanctx = container_of(conf, struct ieee80211_chanctx, conf);
 
-        if (local->use_chanctx) {
-                u32 num_chanctx = 0;
-                list_for_each_entry(chanctx, &local->chanctx_list, list)
-                       num_chanctx++;
+        if (local->use_chanctx &&
+            !(local->hw.flags & IEEE80211_HW_CHANCTX_STA_CSA)) {
+                sdata_info(sdata,
+                           "driver doesn't support chan-switch with channel contexts\n");
+                ieee80211_queue_work(&local->hw,
+                                     &ifmgd->csa_connection_drop_work);
+                mutex_unlock(&local->chanctx_mtx);
+                mutex_unlock(&local->mtx);
+                return;
+        }
 
-                if (num_chanctx > 1 ||
-                    !(local->hw.flags & IEEE80211_HW_CHANCTX_STA_CSA)) {
-                        sdata_info(sdata,
-                                   "not handling chan-switch with channel contexts\n");
-                        ieee80211_queue_work(&local->hw,
-                                             &ifmgd->csa_connection_drop_work);
-                        mutex_unlock(&local->chanctx_mtx);
-                        mutex_unlock(&local->mtx);
-                        return;
-                }
+        ch_switch.timestamp = timestamp;
+        ch_switch.device_timestamp = device_timestamp;
+        ch_switch.block_tx = csa_ie.mode;
+        ch_switch.chandef = csa_ie.chandef;
+        ch_switch.count = csa_ie.count;
+
+        if (drv_pre_channel_switch(sdata, &ch_switch)) {
+                sdata_info(sdata,
+                           "preparing for channel switch failed, disconnecting\n");
+                ieee80211_queue_work(&local->hw,
+                                     &ifmgd->csa_connection_drop_work);
+                mutex_unlock(&local->chanctx_mtx);
+                mutex_unlock(&local->mtx);
+                return;
         }
 
         res = ieee80211_vif_reserve_chanctx(sdata, &csa_ie.chandef,
@@ -1152,14 +1207,7 @@ ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
 
         if (local->ops->channel_switch) {
                 /* use driver's channel switch callback */
-                struct ieee80211_channel_switch ch_switch = {
-                        .timestamp = timestamp,
-                        .block_tx = csa_ie.mode,
-                        .chandef = csa_ie.chandef,
-                        .count = csa_ie.count,
-                };
-
-                drv_channel_switch(local, &ch_switch);
+                drv_channel_switch(local, sdata, &ch_switch);
                 return;
         }
 
@@ -1579,6 +1627,95 @@ void ieee80211_dfs_cac_timer_work(struct work_struct *work)
         mutex_unlock(&sdata->local->mtx);
 }
 
+static bool
+__ieee80211_sta_handle_tspec_ac_params(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+        bool ret;
+        int ac;
+
+        if (local->hw.queues < IEEE80211_NUM_ACS)
+                return false;
+
+        for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
+                struct ieee80211_sta_tx_tspec *tx_tspec = &ifmgd->tx_tspec[ac];
+                int non_acm_ac;
+                unsigned long now = jiffies;
+
+                if (tx_tspec->action == TX_TSPEC_ACTION_NONE &&
+                    tx_tspec->admitted_time &&
+                    time_after(now, tx_tspec->time_slice_start + HZ)) {
+                        tx_tspec->consumed_tx_time = 0;
+                        tx_tspec->time_slice_start = now;
+
+                        if (tx_tspec->downgraded)
+                                tx_tspec->action =
+                                        TX_TSPEC_ACTION_STOP_DOWNGRADE;
+                }
+
+                switch (tx_tspec->action) {
+                case TX_TSPEC_ACTION_STOP_DOWNGRADE:
+                        /* take the original parameters */
+                        if (drv_conf_tx(local, sdata, ac, &sdata->tx_conf[ac]))
+                                sdata_err(sdata,
+                                          "failed to set TX queue parameters for queue %d\n",
+                                          ac);
+                        tx_tspec->action = TX_TSPEC_ACTION_NONE;
+                        tx_tspec->downgraded = false;
+                        ret = true;
+                        break;
+                case TX_TSPEC_ACTION_DOWNGRADE:
+                        if (time_after(now, tx_tspec->time_slice_start + HZ)) {
+                                tx_tspec->action = TX_TSPEC_ACTION_NONE;
+                                ret = true;
+                                break;
+                        }
+                        /* downgrade next lower non-ACM AC */
+                        for (non_acm_ac = ac + 1;
+                             non_acm_ac < IEEE80211_NUM_ACS;
+                             non_acm_ac++)
+                                if (!(sdata->wmm_acm & BIT(7 - 2 * non_acm_ac)))
+                                        break;
+                        /* The loop will result in using BK even if it requires
+                         * admission control, such configuration makes no sense
+                         * and we have to transmit somehow - the AC selection
+                         * does the same thing.
+                         */
+                        if (drv_conf_tx(local, sdata, ac,
+                                        &sdata->tx_conf[non_acm_ac]))
+                                sdata_err(sdata,
+                                          "failed to set TX queue parameters for queue %d\n",
+                                          ac);
+                        tx_tspec->action = TX_TSPEC_ACTION_NONE;
+                        ret = true;
+                        schedule_delayed_work(&ifmgd->tx_tspec_wk,
+                                tx_tspec->time_slice_start + HZ - now + 1);
+                        break;
+                case TX_TSPEC_ACTION_NONE:
+                        /* nothing now */
+                        break;
+                }
+        }
+
+        return ret;
+}
+
+void ieee80211_sta_handle_tspec_ac_params(struct ieee80211_sub_if_data *sdata)
+{
+        if (__ieee80211_sta_handle_tspec_ac_params(sdata))
+                ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_QOS);
+}
+
+static void ieee80211_sta_handle_tspec_ac_params_wk(struct work_struct *work)
+{
+        struct ieee80211_sub_if_data *sdata;
+
+        sdata = container_of(work, struct ieee80211_sub_if_data,
+                             u.mgd.tx_tspec_wk.work);
+        ieee80211_sta_handle_tspec_ac_params(sdata);
+}
+
 /* MLME */
 static bool ieee80211_sta_wmm_params(struct ieee80211_local *local,
                                      struct ieee80211_sub_if_data *sdata,
@@ -1663,12 +1800,14 @@ static bool ieee80211_sta_wmm_params(struct ieee80211_local *local,
                 params.uapsd = uapsd;
 
                 mlme_dbg(sdata,
-                         "WMM queue=%d aci=%d acm=%d aifs=%d cWmin=%d cWmax=%d txop=%d uapsd=%d\n",
+                         "WMM queue=%d aci=%d acm=%d aifs=%d cWmin=%d cWmax=%d txop=%d uapsd=%d, downgraded=%d\n",
                          queue, aci, acm,
                          params.aifs, params.cw_min, params.cw_max,
-                         params.txop, params.uapsd);
+                         params.txop, params.uapsd,
+                         ifmgd->tx_tspec[queue].downgraded);
                 sdata->tx_conf[queue] = params;
-                if (drv_conf_tx(local, sdata, queue, &params))
+                if (!ifmgd->tx_tspec[queue].downgraded &&
+                    drv_conf_tx(local, sdata, queue, &params))
                         sdata_err(sdata,
                                   "failed to set TX queue parameters for queue %d\n",
                                   queue);
@@ -1923,6 +2062,7 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
         ieee80211_vif_release_channel(sdata);
 
         sdata->vif.csa_active = false;
+        ifmgd->csa_waiting_bcn = false;
         if (sdata->csa_block_tx) {
                 ieee80211_wake_vif_queues(local, sdata,
                                           IEEE80211_QUEUE_STOP_REASON_CSA);
@@ -1930,6 +2070,10 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
         }
         mutex_unlock(&local->mtx);
 
+        /* existing TX TSPEC sessions no longer exist */
+        memset(ifmgd->tx_tspec, 0, sizeof(ifmgd->tx_tspec));
+        cancel_delayed_work_sync(&ifmgd->tx_tspec_wk);
+
         sdata->encrypt_headroom = IEEE80211_ENCRYPT_HEADROOM;
 }
 
@@ -1982,9 +2126,46 @@ out:
         mutex_unlock(&local->mtx);
 }
 
+static void ieee80211_sta_tx_wmm_ac_notify(struct ieee80211_sub_if_data *sdata,
+                                           struct ieee80211_hdr *hdr,
+                                           u16 tx_time)
+{
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+        u16 tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK;
+        int ac = ieee80211_ac_from_tid(tid);
+        struct ieee80211_sta_tx_tspec *tx_tspec = &ifmgd->tx_tspec[ac];
+        unsigned long now = jiffies;
+
+        if (likely(!tx_tspec->admitted_time))
+                return;
+
+        if (time_after(now, tx_tspec->time_slice_start + HZ)) {
+                tx_tspec->consumed_tx_time = 0;
+                tx_tspec->time_slice_start = now;
+
+                if (tx_tspec->downgraded) {
+                        tx_tspec->action = TX_TSPEC_ACTION_STOP_DOWNGRADE;
+                        schedule_delayed_work(&ifmgd->tx_tspec_wk, 0);
+                }
+        }
+
+        if (tx_tspec->downgraded)
+                return;
+
+        tx_tspec->consumed_tx_time += tx_time;
+
+        if (tx_tspec->consumed_tx_time >= tx_tspec->admitted_time) {
+                tx_tspec->downgraded = true;
+                tx_tspec->action = TX_TSPEC_ACTION_DOWNGRADE;
+                schedule_delayed_work(&ifmgd->tx_tspec_wk, 0);
+        }
+}
+
 void ieee80211_sta_tx_notify(struct ieee80211_sub_if_data *sdata,
-                             struct ieee80211_hdr *hdr, bool ack)
+                             struct ieee80211_hdr *hdr, bool ack, u16 tx_time)
 {
+        ieee80211_sta_tx_wmm_ac_notify(sdata, hdr, tx_time);
+
         if (!ieee80211_is_data(hdr->frame_control))
             return;
 
@@ -2047,8 +2228,6 @@ static void ieee80211_mgd_probe_ap_send(struct ieee80211_sub_if_data *sdata)
 
         ifmgd->probe_timeout = jiffies + msecs_to_jiffies(probe_wait_ms);
         run_again(sdata, ifmgd->probe_timeout);
-        if (sdata->local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
-                ieee80211_flush_queues(sdata->local, sdata);
 }
 
 static void ieee80211_mgd_probe_ap(struct ieee80211_sub_if_data *sdata,
@@ -2171,6 +2350,7 @@ static void __ieee80211_disconnect(struct ieee80211_sub_if_data *sdata)
                                true, frame_buf);
         mutex_lock(&local->mtx);
         sdata->vif.csa_active = false;
+        ifmgd->csa_waiting_bcn = false;
         if (sdata->csa_block_tx) {
                 ieee80211_wake_vif_queues(local, sdata,
                                           IEEE80211_QUEUE_STOP_REASON_CSA);
@@ -3195,6 +3375,9 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
                 }
         }
 
+        if (ifmgd->csa_waiting_bcn)
+                ieee80211_chswitch_post_beacon(sdata);
+
         if (ncrc == ifmgd->beacon_crc && ifmgd->beacon_crc_valid)
                 return;
         ifmgd->beacon_crc = ncrc;
@@ -3203,6 +3386,7 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
         ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems);
 
         ieee80211_sta_process_chanswitch(sdata, rx_status->mactime,
+                                         rx_status->device_timestamp,
                                          &elems, true);
 
         if (!(ifmgd->flags & IEEE80211_STA_DISABLE_WMM) &&
@@ -3334,8 +3518,9 @@ void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
                                 break;
 
                         ieee80211_sta_process_chanswitch(sdata,
-                                                         rx_status->mactime,
-                                                         &elems, false);
+                                                 rx_status->mactime,
+                                                 rx_status->device_timestamp,
+                                                 &elems, false);
                 } else if (mgmt->u.action.category == WLAN_CATEGORY_PUBLIC) {
                         ies_len = skb->len -
                                   offsetof(struct ieee80211_mgmt,
@@ -3356,8 +3541,9 @@ void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
                                 &mgmt->u.action.u.ext_chan_switch.data;
 
                         ieee80211_sta_process_chanswitch(sdata,
-                                                         rx_status->mactime,
-                                                         &elems, false);
+                                                 rx_status->mactime,
+                                                 rx_status->device_timestamp,
+                                                 &elems, false);
                 }
                 break;
         }
@@ -3664,11 +3850,12 @@ static void ieee80211_sta_bcn_mon_timer(unsigned long data)
         struct ieee80211_sub_if_data *sdata =
                 (struct ieee80211_sub_if_data *) data;
         struct ieee80211_local *local = sdata->local;
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 
         if (local->quiescing)
                 return;
 
-        if (sdata->vif.csa_active)
+        if (sdata->vif.csa_active && !ifmgd->csa_waiting_bcn)
                 return;
 
         sdata->u.mgd.connection_loss = false;
@@ -3686,7 +3873,7 @@ static void ieee80211_sta_conn_mon_timer(unsigned long data)
         if (local->quiescing)
                 return;
 
-        if (sdata->vif.csa_active)
+        if (sdata->vif.csa_active && !ifmgd->csa_waiting_bcn)
                 return;
 
         ieee80211_queue_work(&local->hw, &ifmgd->monitor_work);
@@ -3798,6 +3985,8 @@ void ieee80211_sta_setup_sdata(struct ieee80211_sub_if_data *sdata)
                     (unsigned long) sdata);
         setup_timer(&ifmgd->chswitch_timer, ieee80211_chswitch_timer,
                     (unsigned long) sdata);
+        INIT_DELAYED_WORK(&ifmgd->tx_tspec_wk,
+                          ieee80211_sta_handle_tspec_ac_params_wk);
 
         ifmgd->flags = 0;
         ifmgd->powersave = sdata->wdev.ps;
diff --git a/net/mac80211/ocb.c b/net/mac80211/ocb.c
new file mode 100644
index 000000000000..358d5f9d8207
--- /dev/null
+++ b/net/mac80211/ocb.c
@@ -0,0 +1,250 @@
+/*
+ * OCB mode implementation
+ *
+ * Copyright: (c) 2014 Czech Technical University in Prague
+ *            (c) 2014 Volkswagen Group Research
+ * Author:    Rostislav Lisovy <rostislav.lisovy@fel.cvut.cz>
+ * Funded by: Volkswagen Group Research
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/delay.h>
+#include <linux/if_ether.h>
+#include <linux/skbuff.h>
+#include <linux/if_arp.h>
+#include <linux/etherdevice.h>
+#include <linux/rtnetlink.h>
+#include <net/mac80211.h>
+#include <asm/unaligned.h>
+
+#include "ieee80211_i.h"
+#include "driver-ops.h"
+#include "rate.h"
+
+#define IEEE80211_OCB_HOUSEKEEPING_INTERVAL             (60 * HZ)
+#define IEEE80211_OCB_PEER_INACTIVITY_LIMIT             (240 * HZ)
+#define IEEE80211_OCB_MAX_STA_ENTRIES                   128
+
+/**
+ * enum ocb_deferred_task_flags - mac80211 OCB deferred tasks
+ * @OCB_WORK_HOUSEKEEPING: run the periodic OCB housekeeping tasks
+ *
+ * These flags are used in @wrkq_flags field of &struct ieee80211_if_ocb
+ */
+enum ocb_deferred_task_flags {
+        OCB_WORK_HOUSEKEEPING,
+};
+
+void ieee80211_ocb_rx_no_sta(struct ieee80211_sub_if_data *sdata,
+                             const u8 *bssid, const u8 *addr,
+                             u32 supp_rates)
+{
+        struct ieee80211_if_ocb *ifocb = &sdata->u.ocb;
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_chanctx_conf *chanctx_conf;
+        struct ieee80211_supported_band *sband;
+        enum nl80211_bss_scan_width scan_width;
+        struct sta_info *sta;
+        int band;
+
+        /* XXX: Consider removing the least recently used entry and
+         *      allow new one to be added.
+         */
+        if (local->num_sta >= IEEE80211_OCB_MAX_STA_ENTRIES) {
+                net_info_ratelimited("%s: No room for a new OCB STA entry %pM\n",
+                                     sdata->name, addr);
+                return;
+        }
+
+        ocb_dbg(sdata, "Adding new OCB station %pM\n", addr);
+
+        rcu_read_lock();
+        chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
+        if (WARN_ON_ONCE(!chanctx_conf)) {
+                rcu_read_unlock();
+                return;
+        }
+        band = chanctx_conf->def.chan->band;
+        scan_width = cfg80211_chandef_to_scan_width(&chanctx_conf->def);
+        rcu_read_unlock();
+
+        sta = sta_info_alloc(sdata, addr, GFP_ATOMIC);
+        if (!sta)
+                return;
+
+        sta->last_rx = jiffies;
+
+        /* Add only mandatory rates for now */
+        sband = local->hw.wiphy->bands[band];
+        sta->sta.supp_rates[band] =
+                ieee80211_mandatory_rates(sband, scan_width);
+
+        spin_lock(&ifocb->incomplete_lock);
+        list_add(&sta->list, &ifocb->incomplete_stations);
+        spin_unlock(&ifocb->incomplete_lock);
+        ieee80211_queue_work(&local->hw, &sdata->work);
+}
+
+static struct sta_info *ieee80211_ocb_finish_sta(struct sta_info *sta)
+        __acquires(RCU)
+{
+        struct ieee80211_sub_if_data *sdata = sta->sdata;
+        u8 addr[ETH_ALEN];
+
+        memcpy(addr, sta->sta.addr, ETH_ALEN);
+
+        ocb_dbg(sdata, "Adding new IBSS station %pM (dev=%s)\n",
+                addr, sdata->name);
+
+        sta_info_move_state(sta, IEEE80211_STA_AUTH);
+        sta_info_move_state(sta, IEEE80211_STA_ASSOC);
+        sta_info_move_state(sta, IEEE80211_STA_AUTHORIZED);
+
+        rate_control_rate_init(sta);
+
+        /* If it fails, maybe we raced another insertion? */
+        if (sta_info_insert_rcu(sta))
+                return sta_info_get(sdata, addr);
+        return sta;
+}
+
+static void ieee80211_ocb_housekeeping(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_if_ocb *ifocb = &sdata->u.ocb;
+
+        ocb_dbg(sdata, "Running ocb housekeeping\n");
+
+        ieee80211_sta_expire(sdata, IEEE80211_OCB_PEER_INACTIVITY_LIMIT);
+
+        mod_timer(&ifocb->housekeeping_timer,
+                  round_jiffies(jiffies + IEEE80211_OCB_HOUSEKEEPING_INTERVAL));
+}
+
+void ieee80211_ocb_work(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_if_ocb *ifocb = &sdata->u.ocb;
+        struct sta_info *sta;
+
+        if (ifocb->joined != true)
+                return;
+
+        sdata_lock(sdata);
+
+        spin_lock_bh(&ifocb->incomplete_lock);
+        while (!list_empty(&ifocb->incomplete_stations)) {
+                sta = list_first_entry(&ifocb->incomplete_stations,
+                                       struct sta_info, list);
+                list_del(&sta->list);
+                spin_unlock_bh(&ifocb->incomplete_lock);
+
+                ieee80211_ocb_finish_sta(sta);
+                rcu_read_unlock();
+                spin_lock_bh(&ifocb->incomplete_lock);
+        }
+        spin_unlock_bh(&ifocb->incomplete_lock);
+
+        if (test_and_clear_bit(OCB_WORK_HOUSEKEEPING, &ifocb->wrkq_flags))
+                ieee80211_ocb_housekeeping(sdata);
+
+        sdata_unlock(sdata);
+}
+
+static void ieee80211_ocb_housekeeping_timer(unsigned long data)
+{
+        struct ieee80211_sub_if_data *sdata = (void *)data;
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_if_ocb *ifocb = &sdata->u.ocb;
+
+        set_bit(OCB_WORK_HOUSEKEEPING, &ifocb->wrkq_flags);
+
+        ieee80211_queue_work(&local->hw, &sdata->work);
+}
+
+void ieee80211_ocb_setup_sdata(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_if_ocb *ifocb = &sdata->u.ocb;
+
+        setup_timer(&ifocb->housekeeping_timer,
+                    ieee80211_ocb_housekeeping_timer,
+                    (unsigned long)sdata);
+        INIT_LIST_HEAD(&ifocb->incomplete_stations);
+        spin_lock_init(&ifocb->incomplete_lock);
+}
+
+int ieee80211_ocb_join(struct ieee80211_sub_if_data *sdata,
+                       struct ocb_setup *setup)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_if_ocb *ifocb = &sdata->u.ocb;
+        u32 changed = BSS_CHANGED_OCB;
+        int err;
+
+        if (ifocb->joined == true)
+                return -EINVAL;
+
+        sdata->flags |= IEEE80211_SDATA_OPERATING_GMODE;
+        sdata->smps_mode = IEEE80211_SMPS_OFF;
+        sdata->needed_rx_chains = sdata->local->rx_chains;
+
+        mutex_lock(&sdata->local->mtx);
+        err = ieee80211_vif_use_channel(sdata, &setup->chandef,
+                                        IEEE80211_CHANCTX_SHARED);
+        mutex_unlock(&sdata->local->mtx);
+        if (err)
+                return err;
+
+        ieee80211_bss_info_change_notify(sdata, changed);
+
+        ifocb->joined = true;
+
+        set_bit(OCB_WORK_HOUSEKEEPING, &ifocb->wrkq_flags);
+        ieee80211_queue_work(&local->hw, &sdata->work);
+
+        netif_carrier_on(sdata->dev);
+        return 0;
+}
+
+int ieee80211_ocb_leave(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_if_ocb *ifocb = &sdata->u.ocb;
+        struct ieee80211_local *local = sdata->local;
+        struct sta_info *sta;
+
+        ifocb->joined = false;
+        sta_info_flush(sdata);
+
+        spin_lock_bh(&ifocb->incomplete_lock);
+        while (!list_empty(&ifocb->incomplete_stations)) {
+                sta = list_first_entry(&ifocb->incomplete_stations,
+                                       struct sta_info, list);
+                list_del(&sta->list);
+                spin_unlock_bh(&ifocb->incomplete_lock);
+
+                sta_info_free(local, sta);
+                spin_lock_bh(&ifocb->incomplete_lock);
+        }
+        spin_unlock_bh(&ifocb->incomplete_lock);
+
+        netif_carrier_off(sdata->dev);
+        clear_bit(SDATA_STATE_OFFCHANNEL, &sdata->state);
+        ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_OCB);
+
+        mutex_lock(&sdata->local->mtx);
+        ieee80211_vif_release_channel(sdata);
+        mutex_unlock(&sdata->local->mtx);
+
+        skb_queue_purge(&sdata->skb_queue);
+
+        del_timer_sync(&sdata->u.ocb.housekeeping_timer);
+        /* If the timer fired while we waited for it, it will have
+         * requeued the work. Now the work will be running again
+         * but will not rearm the timer again because it checks
+         * whether we are connected to the network or not -- at this
+         * point we shouldn't be anymore.
+         */
+
+        return 0;
+}
diff --git a/net/mac80211/rc80211_minstrel.c b/net/mac80211/rc80211_minstrel.c
index 2baa7ed8789d..c2b91bf47f6d 100644
--- a/net/mac80211/rc80211_minstrel.c
+++ b/net/mac80211/rc80211_minstrel.c
@@ -191,7 +191,7 @@ minstrel_update_stats(struct minstrel_priv *mp, struct minstrel_sta_info *mi)
                  * (1) if any success probabilitiy >= 95%, out of those rates
                  * choose the maximum throughput rate as max_prob_rate
                  * (2) if all success probabilities < 95%, the rate with
-                 * highest success probability is choosen as max_prob_rate */
+                 * highest success probability is chosen as max_prob_rate */
                 if (mrs->probability >= MINSTREL_FRAC(95, 100)) {
                         if (mrs->cur_tp >= mi->r[tmp_prob_rate].stats.cur_tp)
                                 tmp_prob_rate = i;
diff --git a/net/mac80211/rc80211_minstrel_ht.c b/net/mac80211/rc80211_minstrel_ht.c
index df90ce2db00c..c50fd94d2aef 100644
--- a/net/mac80211/rc80211_minstrel_ht.c
+++ b/net/mac80211/rc80211_minstrel_ht.c
@@ -10,6 +10,7 @@
 #include <linux/skbuff.h>
 #include <linux/debugfs.h>
 #include <linux/random.h>
+#include <linux/moduleparam.h>
 #include <linux/ieee80211.h>
 #include <net/mac80211.h>
 #include "rate.h"
@@ -34,12 +35,17 @@
 /* Transmit duration for the raw data part of an average sized packet */
 #define MCS_DURATION(streams, sgi, bps) MCS_SYMBOL_TIME(sgi, MCS_NSYMS((streams) * (bps)))
 
+#define BW_20                   0
+#define BW_40                   1
+#define BW_80                   2
+
 /*
  * Define group sort order: HT40 -> SGI -> #streams
  */
 #define GROUP_IDX(_streams, _sgi, _ht40)        \
+        MINSTREL_HT_GROUP_0 +                   \
         MINSTREL_MAX_STREAMS * 2 * _ht40 +      \
-        MINSTREL_MAX_STREAMS * _sgi +           \
+        MINSTREL_MAX_STREAMS * _sgi +   \
         _streams - 1
 
 /* MCS rate information for an MCS group */
@@ -47,6 +53,7 @@
         [GROUP_IDX(_streams, _sgi, _ht40)] = {                          \
         .streams = _streams,                                            \
         .flags =                                                        \
+                IEEE80211_TX_RC_MCS |                                   \
                 (_sgi ? IEEE80211_TX_RC_SHORT_GI : 0) |                 \
                 (_ht40 ? IEEE80211_TX_RC_40_MHZ_WIDTH : 0),             \
         .duration = {                                                   \
@@ -61,6 +68,47 @@
         }                                                               \
 }
 
+#define VHT_GROUP_IDX(_streams, _sgi, _bw)                              \
+        (MINSTREL_VHT_GROUP_0 +                                         \
+         MINSTREL_MAX_STREAMS * 2 * (_bw) +                             \
+         MINSTREL_MAX_STREAMS * (_sgi) +                                \
+         (_streams) - 1)
+
+#define BW2VBPS(_bw, r3, r2, r1)                                        \
+        (_bw == BW_80 ? r3 : _bw == BW_40 ? r2 : r1)
+
+#define VHT_GROUP(_streams, _sgi, _bw)                                  \
+        [VHT_GROUP_IDX(_streams, _sgi, _bw)] = {                        \
+        .streams = _streams,                                            \
+        .flags =                                                        \
+                IEEE80211_TX_RC_VHT_MCS |                               \
+                (_sgi ? IEEE80211_TX_RC_SHORT_GI : 0) |                 \
+                (_bw == BW_80 ? IEEE80211_TX_RC_80_MHZ_WIDTH :          \
+                 _bw == BW_40 ? IEEE80211_TX_RC_40_MHZ_WIDTH : 0),      \
+        .duration = {                                                   \
+                MCS_DURATION(_streams, _sgi,                            \
+                             BW2VBPS(_bw,  117,  54,  26)),             \
+                MCS_DURATION(_streams, _sgi,                            \
+                             BW2VBPS(_bw,  234, 108,  52)),             \
+                MCS_DURATION(_streams, _sgi,                            \
+                             BW2VBPS(_bw,  351, 162,  78)),             \
+                MCS_DURATION(_streams, _sgi,                            \
+                             BW2VBPS(_bw,  468, 216, 104)),             \
+                MCS_DURATION(_streams, _sgi,                            \
+                             BW2VBPS(_bw,  702, 324, 156)),             \
+                MCS_DURATION(_streams, _sgi,                            \
+                             BW2VBPS(_bw,  936, 432, 208)),             \
+                MCS_DURATION(_streams, _sgi,                            \
+                             BW2VBPS(_bw, 1053, 486, 234)),             \
+                MCS_DURATION(_streams, _sgi,                            \
+                             BW2VBPS(_bw, 1170, 540, 260)),             \
+                MCS_DURATION(_streams, _sgi,                            \
+                             BW2VBPS(_bw, 1404, 648, 312)),             \
+                MCS_DURATION(_streams, _sgi,                            \
+                             BW2VBPS(_bw, 1560, 720, 346))              \
+        }                                                               \
+}
+
 #define CCK_DURATION(_bitrate, _short, _len)            \
         (1000 * (10 /* SIFS */ +                        \
          (_short ? 72 + 24 : 144 + 48) +                \
@@ -76,53 +124,96 @@
         CCK_ACK_DURATION(55, _short),                   \
         CCK_ACK_DURATION(110, _short)
 
-#define CCK_GROUP                                               \
-        [MINSTREL_MAX_STREAMS * MINSTREL_STREAM_GROUPS] = {     \
-                .streams = 0,                                   \
-                .duration = {                                   \
-                        CCK_DURATION_LIST(false),               \
-                        CCK_DURATION_LIST(true)                 \
-                }                                               \
+#define CCK_GROUP                                       \
+        [MINSTREL_CCK_GROUP] = {                        \
+                .streams = 0,                           \
+                .flags = 0,                             \
+                .duration = {                           \
+                        CCK_DURATION_LIST(false),       \
+                        CCK_DURATION_LIST(true)         \
+                }                                       \
         }
 
+#ifdef CONFIG_MAC80211_RC_MINSTREL_VHT
+static bool minstrel_vht_only = true;
+module_param(minstrel_vht_only, bool, 0644);
+MODULE_PARM_DESC(minstrel_vht_only,
+                 "Use only VHT rates when VHT is supported by sta.");
+#endif
+
 /*
  * To enable sufficiently targeted rate sampling, MCS rates are divided into
  * groups, based on the number of streams and flags (HT40, SGI) that they
  * use.
  *
  * Sortorder has to be fixed for GROUP_IDX macro to be applicable:
- * HT40 -> SGI -> #streams
+ * BW -> SGI -> #streams
  */
 const struct mcs_group minstrel_mcs_groups[] = {
-        MCS_GROUP(1, 0, 0),
-        MCS_GROUP(2, 0, 0),
+        MCS_GROUP(1, 0, BW_20),
+        MCS_GROUP(2, 0, BW_20),
 #if MINSTREL_MAX_STREAMS >= 3
-        MCS_GROUP(3, 0, 0),
+        MCS_GROUP(3, 0, BW_20),
 #endif
 
-        MCS_GROUP(1, 1, 0),
-        MCS_GROUP(2, 1, 0),
+        MCS_GROUP(1, 1, BW_20),
+        MCS_GROUP(2, 1, BW_20),
 #if MINSTREL_MAX_STREAMS >= 3
-        MCS_GROUP(3, 1, 0),
+        MCS_GROUP(3, 1, BW_20),
 #endif
 
-        MCS_GROUP(1, 0, 1),
-        MCS_GROUP(2, 0, 1),
+        MCS_GROUP(1, 0, BW_40),
+        MCS_GROUP(2, 0, BW_40),
 #if MINSTREL_MAX_STREAMS >= 3
-        MCS_GROUP(3, 0, 1),
+        MCS_GROUP(3, 0, BW_40),
 #endif
 
-        MCS_GROUP(1, 1, 1),
-        MCS_GROUP(2, 1, 1),
+        MCS_GROUP(1, 1, BW_40),
+        MCS_GROUP(2, 1, BW_40),
 #if MINSTREL_MAX_STREAMS >= 3
-        MCS_GROUP(3, 1, 1),
+        MCS_GROUP(3, 1, BW_40),
 #endif
 
-        /* must be last */
-        CCK_GROUP
-};
+        CCK_GROUP,
 
-#define MINSTREL_CCK_GROUP      (ARRAY_SIZE(minstrel_mcs_groups) - 1)
+#ifdef CONFIG_MAC80211_RC_MINSTREL_VHT
+        VHT_GROUP(1, 0, BW_20),
+        VHT_GROUP(2, 0, BW_20),
+#if MINSTREL_MAX_STREAMS >= 3
+        VHT_GROUP(3, 0, BW_20),
+#endif
+
+        VHT_GROUP(1, 1, BW_20),
+        VHT_GROUP(2, 1, BW_20),
+#if MINSTREL_MAX_STREAMS >= 3
+        VHT_GROUP(3, 1, BW_20),
+#endif
+
+        VHT_GROUP(1, 0, BW_40),
+        VHT_GROUP(2, 0, BW_40),
+#if MINSTREL_MAX_STREAMS >= 3
+        VHT_GROUP(3, 0, BW_40),
+#endif
+
+        VHT_GROUP(1, 1, BW_40),
+        VHT_GROUP(2, 1, BW_40),
+#if MINSTREL_MAX_STREAMS >= 3
+        VHT_GROUP(3, 1, BW_40),
+#endif
+
+        VHT_GROUP(1, 0, BW_80),
+        VHT_GROUP(2, 0, BW_80),
+#if MINSTREL_MAX_STREAMS >= 3
+        VHT_GROUP(3, 0, BW_80),
+#endif
+
+        VHT_GROUP(1, 1, BW_80),
+        VHT_GROUP(2, 1, BW_80),
+#if MINSTREL_MAX_STREAMS >= 3
+        VHT_GROUP(3, 1, BW_80),
+#endif
+#endif
+};
 
 static u8 sample_table[SAMPLE_COLUMNS][MCS_GROUP_RATES] __read_mostly;
 
@@ -130,16 +221,64 @@ static void
 minstrel_ht_update_rates(struct minstrel_priv *mp, struct minstrel_ht_sta *mi);
 
 /*
+ * Some VHT MCSes are invalid (when Ndbps / Nes is not an integer)
+ * e.g for MCS9@20MHzx1Nss: Ndbps=8x52*(5/6) Nes=1
+ *
+ * Returns the valid mcs map for struct minstrel_mcs_group_data.supported
+ */
+static u16
+minstrel_get_valid_vht_rates(int bw, int nss, __le16 mcs_map)
+{
+        u16 mask = 0;
+
+        if (bw == BW_20) {
+                if (nss != 3 && nss != 6)
+                        mask = BIT(9);
+        } else if (bw == BW_80) {
+                if (nss == 3 || nss == 7)
+                        mask = BIT(6);
+                else if (nss == 6)
+                        mask = BIT(9);
+        } else {
+                WARN_ON(bw != BW_40);
+        }
+
+        switch ((le16_to_cpu(mcs_map) >> (2 * (nss - 1))) & 3) {
+        case IEEE80211_VHT_MCS_SUPPORT_0_7:
+                mask |= 0x300;
+                break;
+        case IEEE80211_VHT_MCS_SUPPORT_0_8:
+                mask |= 0x200;
+                break;
+        case IEEE80211_VHT_MCS_SUPPORT_0_9:
+                break;
+        default:
+                mask = 0x3ff;
+        }
+
+        return 0x3ff & ~mask;
+}
+
+/*
  * Look up an MCS group index based on mac80211 rate information
  */
 static int
 minstrel_ht_get_group_idx(struct ieee80211_tx_rate *rate)
 {
-        return GROUP_IDX((rate->idx / MCS_GROUP_RATES) + 1,
+        return GROUP_IDX((rate->idx / 8) + 1,
                          !!(rate->flags & IEEE80211_TX_RC_SHORT_GI),
                          !!(rate->flags & IEEE80211_TX_RC_40_MHZ_WIDTH));
 }
 
+static int
+minstrel_vht_get_group_idx(struct ieee80211_tx_rate *rate)
+{
+        return VHT_GROUP_IDX(ieee80211_rate_get_vht_nss(rate),
+                             !!(rate->flags & IEEE80211_TX_RC_SHORT_GI),
+                             !!(rate->flags & IEEE80211_TX_RC_40_MHZ_WIDTH) +
+                             2*!!(rate->flags & IEEE80211_TX_RC_80_MHZ_WIDTH));
+}
+
 static struct minstrel_rate_stats *
 minstrel_ht_get_stats(struct minstrel_priv *mp, struct minstrel_ht_sta *mi,
                       struct ieee80211_tx_rate *rate)
@@ -149,6 +288,9 @@ minstrel_ht_get_stats(struct minstrel_priv *mp, struct minstrel_ht_sta *mi,
         if (rate->flags & IEEE80211_TX_RC_MCS) {
                 group = minstrel_ht_get_group_idx(rate);
                 idx = rate->idx % 8;
+        } else if (rate->flags & IEEE80211_TX_RC_VHT_MCS) {
+                group = minstrel_vht_get_group_idx(rate);
+                idx = ieee80211_rate_get_vht_mcs(rate);
         } else {
                 group = MINSTREL_CCK_GROUP;
 
@@ -240,8 +382,8 @@ minstrel_ht_calc_tp(struct minstrel_ht_sta *mi, int group, int rate)
  * MCS groups, CCK rates do not provide aggregation and are therefore at last.
  */
 static void
-minstrel_ht_sort_best_tp_rates(struct minstrel_ht_sta *mi, u8 index,
-                               u8 *tp_list)
+minstrel_ht_sort_best_tp_rates(struct minstrel_ht_sta *mi, u16 index,
+                               u16 *tp_list)
 {
         int cur_group, cur_idx, cur_thr, cur_prob;
         int tmp_group, tmp_idx, tmp_thr, tmp_prob;
@@ -278,7 +420,7 @@ minstrel_ht_sort_best_tp_rates(struct minstrel_ht_sta *mi, u8 index,
  * Find and set the topmost probability rate per sta and per group
  */
 static void
-minstrel_ht_set_best_prob_rate(struct minstrel_ht_sta *mi, u8 index)
+minstrel_ht_set_best_prob_rate(struct minstrel_ht_sta *mi, u16 index)
 {
         struct minstrel_mcs_group_data *mg;
         struct minstrel_rate_stats *mr;
@@ -321,8 +463,8 @@ minstrel_ht_set_best_prob_rate(struct minstrel_ht_sta *mi, u8 index)
  */
 static void
 minstrel_ht_assign_best_tp_rates(struct minstrel_ht_sta *mi,
-                                 u8 tmp_mcs_tp_rate[MAX_THR_RATES],
-                                 u8 tmp_cck_tp_rate[MAX_THR_RATES])
+                                 u16 tmp_mcs_tp_rate[MAX_THR_RATES],
+                                 u16 tmp_cck_tp_rate[MAX_THR_RATES])
 {
         unsigned int tmp_group, tmp_idx, tmp_cck_tp, tmp_mcs_tp;
         int i;
@@ -386,8 +528,8 @@ minstrel_ht_update_stats(struct minstrel_priv *mp, struct minstrel_ht_sta *mi)
         struct minstrel_mcs_group_data *mg;
         struct minstrel_rate_stats *mr;
         int group, i, j;
-        u8 tmp_mcs_tp_rate[MAX_THR_RATES], tmp_group_tp_rate[MAX_THR_RATES];
-        u8 tmp_cck_tp_rate[MAX_THR_RATES], index;
+        u16 tmp_mcs_tp_rate[MAX_THR_RATES], tmp_group_tp_rate[MAX_THR_RATES];
+        u16 tmp_cck_tp_rate[MAX_THR_RATES], index;
 
         if (mi->ampdu_packets > 0) {
                 mi->avg_ampdu_len = minstrel_ewma(mi->avg_ampdu_len,
@@ -485,7 +627,8 @@ minstrel_ht_txstat_valid(struct minstrel_priv *mp, struct ieee80211_tx_rate *rat
         if (!rate->count)
                 return false;
 
-        if (rate->flags & IEEE80211_TX_RC_MCS)
+        if (rate->flags & IEEE80211_TX_RC_MCS ||
+            rate->flags & IEEE80211_TX_RC_VHT_MCS)
                 return true;
 
         return rate->idx == mp->cck_rates[0] ||
@@ -517,7 +660,7 @@ minstrel_next_sample_idx(struct minstrel_ht_sta *mi)
 }
 
 static void
-minstrel_downgrade_rate(struct minstrel_ht_sta *mi, u8 *idx, bool primary)
+minstrel_downgrade_rate(struct minstrel_ht_sta *mi, u16 *idx, bool primary)
 {
         int group, orig_group;
 
@@ -714,7 +857,7 @@ minstrel_ht_set_rate(struct minstrel_priv *mp, struct minstrel_ht_sta *mi,
         const struct mcs_group *group = &minstrel_mcs_groups[index / MCS_GROUP_RATES];
         struct minstrel_rate_stats *mr;
         u8 idx;
-        u16 flags;
+        u16 flags = group->flags;
 
         mr = minstrel_get_ratestats(mi, index);
         if (!mr->retry_updated)
@@ -730,13 +873,13 @@ minstrel_ht_set_rate(struct minstrel_priv *mp, struct minstrel_ht_sta *mi,
                 ratetbl->rate[offset].count_rts = mr->retry_count_rtscts;
         }
 
-        if (index / MCS_GROUP_RATES == MINSTREL_CCK_GROUP) {
+        if (index / MCS_GROUP_RATES == MINSTREL_CCK_GROUP)
                 idx = mp->cck_rates[index % ARRAY_SIZE(mp->cck_rates)];
-                flags = 0;
-        } else {
+        else if (flags & IEEE80211_TX_RC_VHT_MCS)
+                idx = ((group->streams - 1) << 4) |
+                      ((index % MCS_GROUP_RATES) & 0xF);
+        else
                 idx = index % MCS_GROUP_RATES + (group->streams - 1) * 8;
-                flags = IEEE80211_TX_RC_MCS | group->flags;
-        }
 
         if (offset > 0) {
                 ratetbl->rate[offset].count = ratetbl->rate[offset].count_rts;
@@ -916,13 +1059,15 @@ minstrel_ht_get_rate(void *priv, struct ieee80211_sta *sta, void *priv_sta,
         if (sample_idx / MCS_GROUP_RATES == MINSTREL_CCK_GROUP) {
                 int idx = sample_idx % ARRAY_SIZE(mp->cck_rates);
                 rate->idx = mp->cck_rates[idx];
-                rate->flags = 0;
-                return;
+        } else if (sample_group->flags & IEEE80211_TX_RC_VHT_MCS) {
+                ieee80211_rate_set_vht(rate, sample_idx % MCS_GROUP_RATES,
+                                       sample_group->streams);
+        } else {
+                rate->idx = sample_idx % MCS_GROUP_RATES +
+                            (sample_group->streams - 1) * 8;
         }
 
-        rate->idx = sample_idx % MCS_GROUP_RATES +
-                    (sample_group->streams - 1) * 8;
-        rate->flags = IEEE80211_TX_RC_MCS | sample_group->flags;
+        rate->flags = sample_group->flags;
 }
 
 static void
@@ -962,6 +1107,8 @@ minstrel_ht_update_caps(void *priv, struct ieee80211_supported_band *sband,
         struct minstrel_ht_sta *mi = &msp->ht;
         struct ieee80211_mcs_info *mcs = &sta->ht_cap.mcs;
         u16 sta_cap = sta->ht_cap.cap;
+        struct ieee80211_sta_vht_cap *vht_cap = &sta->vht_cap;
+        int use_vht;
         int n_supported = 0;
         int ack_dur;
         int stbc;
@@ -971,8 +1118,14 @@ minstrel_ht_update_caps(void *priv, struct ieee80211_supported_band *sband,
         if (!sta->ht_cap.ht_supported)
                 goto use_legacy;
 
-        BUILD_BUG_ON(ARRAY_SIZE(minstrel_mcs_groups) !=
-                MINSTREL_MAX_STREAMS * MINSTREL_STREAM_GROUPS + 1);
+        BUILD_BUG_ON(ARRAY_SIZE(minstrel_mcs_groups) != MINSTREL_GROUPS_NB);
+
+#ifdef CONFIG_MAC80211_RC_MINSTREL_VHT
+        if (vht_cap->vht_supported)
+                use_vht = vht_cap->vht_mcs.tx_mcs_map != cpu_to_le16(~0);
+        else
+#endif
+        use_vht = 0;
 
         msp->is_ht = true;
         memset(mi, 0, sizeof(*mi));
@@ -997,22 +1150,28 @@ minstrel_ht_update_caps(void *priv, struct ieee80211_supported_band *sband,
         }
         mi->sample_tries = 4;
 
-        stbc = (sta_cap & IEEE80211_HT_CAP_RX_STBC) >>
-                IEEE80211_HT_CAP_RX_STBC_SHIFT;
-        mi->tx_flags |= stbc << IEEE80211_TX_CTL_STBC_SHIFT;
+        /* TODO tx_flags for vht - ATM the RC API is not fine-grained enough */
+        if (!use_vht) {
+                stbc = (sta_cap & IEEE80211_HT_CAP_RX_STBC) >>
+                        IEEE80211_HT_CAP_RX_STBC_SHIFT;
+                mi->tx_flags |= stbc << IEEE80211_TX_CTL_STBC_SHIFT;
 
-        if (sta_cap & IEEE80211_HT_CAP_LDPC_CODING)
-                mi->tx_flags |= IEEE80211_TX_CTL_LDPC;
+                if (sta_cap & IEEE80211_HT_CAP_LDPC_CODING)
+                        mi->tx_flags |= IEEE80211_TX_CTL_LDPC;
+        }
 
         for (i = 0; i < ARRAY_SIZE(mi->groups); i++) {
+                u32 gflags = minstrel_mcs_groups[i].flags;
+                int bw, nss;
+
                 mi->groups[i].supported = 0;
                 if (i == MINSTREL_CCK_GROUP) {
                         minstrel_ht_update_cck(mp, mi, sband, sta);
                         continue;
                 }
 
-                if (minstrel_mcs_groups[i].flags & IEEE80211_TX_RC_SHORT_GI) {
-                        if (minstrel_mcs_groups[i].flags & IEEE80211_TX_RC_40_MHZ_WIDTH) {
+                if (gflags & IEEE80211_TX_RC_SHORT_GI) {
+                        if (gflags & IEEE80211_TX_RC_40_MHZ_WIDTH) {
                                 if (!(sta_cap & IEEE80211_HT_CAP_SGI_40))
                                         continue;
                         } else {
@@ -1021,17 +1180,51 @@ minstrel_ht_update_caps(void *priv, struct ieee80211_supported_band *sband,
                         }
                 }
 
-                if (minstrel_mcs_groups[i].flags & IEEE80211_TX_RC_40_MHZ_WIDTH &&
+                if (gflags & IEEE80211_TX_RC_40_MHZ_WIDTH &&
                     sta->bandwidth < IEEE80211_STA_RX_BW_40)
                         continue;
 
+                nss = minstrel_mcs_groups[i].streams;
+
                 /* Mark MCS > 7 as unsupported if STA is in static SMPS mode */
-                if (sta->smps_mode == IEEE80211_SMPS_STATIC &&
-                    minstrel_mcs_groups[i].streams > 1)
+                if (sta->smps_mode == IEEE80211_SMPS_STATIC && nss > 1)
+                        continue;
+
+                /* HT rate */
+                if (gflags & IEEE80211_TX_RC_MCS) {
+#ifdef CONFIG_MAC80211_RC_MINSTREL_VHT
+                        if (use_vht && minstrel_vht_only)
+                                continue;
+#endif
+                        mi->groups[i].supported = mcs->rx_mask[nss - 1];
+                        if (mi->groups[i].supported)
+                                n_supported++;
                         continue;
+                }
+
+                /* VHT rate */
+                if (!vht_cap->vht_supported ||
+                    WARN_ON(!(gflags & IEEE80211_TX_RC_VHT_MCS)) ||
+                    WARN_ON(gflags & IEEE80211_TX_RC_160_MHZ_WIDTH))
+                        continue;
+
+                if (gflags & IEEE80211_TX_RC_80_MHZ_WIDTH) {
+                        if (sta->bandwidth < IEEE80211_STA_RX_BW_80 ||
+                            ((gflags & IEEE80211_TX_RC_SHORT_GI) &&
+                             !(vht_cap->cap & IEEE80211_VHT_CAP_SHORT_GI_80))) {
+                                continue;
+                        }
+                }
+
+                if (gflags & IEEE80211_TX_RC_40_MHZ_WIDTH)
+                        bw = BW_40;
+                else if (gflags & IEEE80211_TX_RC_80_MHZ_WIDTH)
+                        bw = BW_80;
+                else
+                        bw = BW_20;
 
-                mi->groups[i].supported =
-                        mcs->rx_mask[minstrel_mcs_groups[i].streams - 1];
+                mi->groups[i].supported = minstrel_get_valid_vht_rates(bw, nss,
+                                vht_cap->vht_mcs.tx_mcs_map);
 
                 if (mi->groups[i].supported)
                         n_supported++;
diff --git a/net/mac80211/rc80211_minstrel_ht.h b/net/mac80211/rc80211_minstrel_ht.h
index 01570e0e014b..f2217d6aa0c2 100644
--- a/net/mac80211/rc80211_minstrel_ht.h
+++ b/net/mac80211/rc80211_minstrel_ht.h
@@ -13,10 +13,32 @@
  * The number of streams can be changed to 2 to reduce code
  * size and memory footprint.
  */
-#define MINSTREL_MAX_STREAMS    3
-#define MINSTREL_STREAM_GROUPS  4
+#define MINSTREL_MAX_STREAMS            3
+#define MINSTREL_HT_STREAM_GROUPS       4 /* BW(=2) * SGI(=2) */
+#ifdef CONFIG_MAC80211_RC_MINSTREL_VHT
+#define MINSTREL_VHT_STREAM_GROUPS      6 /* BW(=3) * SGI(=2) */
+#else
+#define MINSTREL_VHT_STREAM_GROUPS      0
+#endif
 
-#define MCS_GROUP_RATES 8
+#define MINSTREL_HT_GROUPS_NB   (MINSTREL_MAX_STREAMS *         \
+                                 MINSTREL_HT_STREAM_GROUPS)
+#define MINSTREL_VHT_GROUPS_NB  (MINSTREL_MAX_STREAMS *         \
+                                 MINSTREL_VHT_STREAM_GROUPS)
+#define MINSTREL_CCK_GROUPS_NB  1
+#define MINSTREL_GROUPS_NB      (MINSTREL_HT_GROUPS_NB +        \
+                                 MINSTREL_VHT_GROUPS_NB +       \
+                                 MINSTREL_CCK_GROUPS_NB)
+
+#define MINSTREL_HT_GROUP_0     0
+#define MINSTREL_CCK_GROUP      (MINSTREL_HT_GROUP_0 + MINSTREL_HT_GROUPS_NB)
+#define MINSTREL_VHT_GROUP_0    (MINSTREL_CCK_GROUP + 1)
+
+#ifdef CONFIG_MAC80211_RC_MINSTREL_VHT
+#define MCS_GROUP_RATES         10
+#else
+#define MCS_GROUP_RATES         8
+#endif
 
 struct mcs_group {
         u32 flags;
@@ -31,11 +53,11 @@ struct minstrel_mcs_group_data {
         u8 column;
 
         /* bitfield of supported MCS rates of this group */
-        u8 supported;
+        u16 supported;
 
         /* sorted rate set within a MCS group*/
-        u8 max_group_tp_rate[MAX_THR_RATES];
-        u8 max_group_prob_rate;
+        u16 max_group_tp_rate[MAX_THR_RATES];
+        u16 max_group_prob_rate;
 
         /* MCS rate statistics */
         struct minstrel_rate_stats rates[MCS_GROUP_RATES];
@@ -52,8 +74,8 @@ struct minstrel_ht_sta {
         unsigned int avg_ampdu_len;
 
         /* overall sorted rate set */
-        u8 max_tp_rate[MAX_THR_RATES];
-        u8 max_prob_rate;
+        u16 max_tp_rate[MAX_THR_RATES];
+        u16 max_prob_rate;
 
         /* time of last status update */
         unsigned long stats_update;
@@ -80,7 +102,7 @@ struct minstrel_ht_sta {
         u8 cck_supported_short;
 
         /* MCS rate group info and statistics */
-        struct minstrel_mcs_group_data groups[MINSTREL_MAX_STREAMS * MINSTREL_STREAM_GROUPS + 1];
+        struct minstrel_mcs_group_data groups[MINSTREL_GROUPS_NB];
 };
 
 struct minstrel_ht_sta_priv {
diff --git a/net/mac80211/rc80211_minstrel_ht_debugfs.c b/net/mac80211/rc80211_minstrel_ht_debugfs.c
index d537bec93754..20c676b8e5b6 100644
--- a/net/mac80211/rc80211_minstrel_ht_debugfs.c
+++ b/net/mac80211/rc80211_minstrel_ht_debugfs.c
@@ -18,19 +18,23 @@
 static char *
 minstrel_ht_stats_dump(struct minstrel_ht_sta *mi, int i, char *p)
 {
-        unsigned int max_mcs = MINSTREL_MAX_STREAMS * MINSTREL_STREAM_GROUPS;
         const struct mcs_group *mg;
         unsigned int j, tp, prob, eprob;
         char htmode = '2';
         char gimode = 'L';
+        u32 gflags;
 
         if (!mi->groups[i].supported)
                 return p;
 
         mg = &minstrel_mcs_groups[i];
-        if (mg->flags & IEEE80211_TX_RC_40_MHZ_WIDTH)
+        gflags = mg->flags;
+
+        if (gflags & IEEE80211_TX_RC_40_MHZ_WIDTH)
                 htmode = '4';
-        if (mg->flags & IEEE80211_TX_RC_SHORT_GI)
+        else if (gflags & IEEE80211_TX_RC_80_MHZ_WIDTH)
+                htmode = '8';
+        if (gflags & IEEE80211_TX_RC_SHORT_GI)
                 gimode = 'S';
 
         for (j = 0; j < MCS_GROUP_RATES; j++) {
@@ -41,10 +45,12 @@ minstrel_ht_stats_dump(struct minstrel_ht_sta *mi, int i, char *p)
                 if (!(mi->groups[i].supported & BIT(j)))
                         continue;
 
-                if (i == max_mcs)
-                        p += sprintf(p, "CCK/%cP   ", j < 4 ? 'L' : 'S');
+                if (gflags & IEEE80211_TX_RC_MCS)
+                        p += sprintf(p, " HT%c0/%cGI ", htmode, gimode);
+                else if (gflags & IEEE80211_TX_RC_VHT_MCS)
+                        p += sprintf(p, "VHT%c0/%cGI ", htmode, gimode);
                 else
-                        p += sprintf(p, "HT%c0/%cGI ", htmode, gimode);
+                        p += sprintf(p, " CCK/%cP   ", j < 4 ? 'L' : 'S');
 
                 *(p++) = (idx == mi->max_tp_rate[0]) ? 'A' : ' ';
                 *(p++) = (idx == mi->max_tp_rate[1]) ? 'B' : ' ';
@@ -52,11 +58,14 @@ minstrel_ht_stats_dump(struct minstrel_ht_sta *mi, int i, char *p)
                 *(p++) = (idx == mi->max_tp_rate[3]) ? 'D' : ' ';
                 *(p++) = (idx == mi->max_prob_rate) ? 'P' : ' ';
 
-                if (i == max_mcs) {
-                        int r = bitrates[j % 4];
-                        p += sprintf(p, " %2u.%1uM", r / 10, r % 10);
+                if (gflags & IEEE80211_TX_RC_MCS) {
+                        p += sprintf(p, " MCS%-2u ", (mg->streams - 1) * 8 + j);
+                } else if (gflags & IEEE80211_TX_RC_VHT_MCS) {
+                        p += sprintf(p, " MCS%-1u/%1u", j, mg->streams);
                 } else {
-                        p += sprintf(p, " MCS%-2u", (mg->streams - 1) * 8 + j);
+                        int r = bitrates[j % 4];
+
+                        p += sprintf(p, " %2u.%1uM ", r / 10, r % 10);
                 }
 
                 tp = mr->cur_tp / 10;
@@ -85,7 +94,6 @@ minstrel_ht_stats_open(struct inode *inode, struct file *file)
         struct minstrel_ht_sta *mi = &msp->ht;
         struct minstrel_debugfs_info *ms;
         unsigned int i;
-        unsigned int max_mcs = MINSTREL_MAX_STREAMS * MINSTREL_STREAM_GROUPS;
         char *p;
         int ret;
 
@@ -96,18 +104,19 @@ minstrel_ht_stats_open(struct inode *inode, struct file *file)
                 return ret;
         }
 
-        ms = kmalloc(8192, GFP_KERNEL);
+        ms = kmalloc(32768, GFP_KERNEL);
         if (!ms)
                 return -ENOMEM;
 
         file->private_data = ms;
         p = ms->buf;
-        p += sprintf(p, "type           rate     tpt eprob *prob "
+        p += sprintf(p, " type           rate      tpt eprob *prob "
                         "ret  *ok(*cum)        ok(      cum)\n");
 
-
-        p = minstrel_ht_stats_dump(mi, max_mcs, p);
-        for (i = 0; i < max_mcs; i++)
+        p = minstrel_ht_stats_dump(mi, MINSTREL_CCK_GROUP, p);
+        for (i = 0; i < MINSTREL_CCK_GROUP; i++)
+                p = minstrel_ht_stats_dump(mi, i, p);
+        for (i++; i < ARRAY_SIZE(mi->groups); i++)
                 p = minstrel_ht_stats_dump(mi, i, p);
 
         p += sprintf(p, "\nTotal packet count::    ideal %d      "
@@ -119,7 +128,7 @@ minstrel_ht_stats_open(struct inode *inode, struct file *file)
                 MINSTREL_TRUNC(mi->avg_ampdu_len * 10) % 10);
         ms->len = p - ms->buf;
 
-        WARN_ON(ms->len + sizeof(*ms) > 8192);
+        WARN_ON(ms->len + sizeof(*ms) > 32768);
 
         return nonseekable_open(inode, file);
 }
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index b04ca4049c95..bc63aa0c5401 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -1032,6 +1032,7 @@ ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
                       ieee80211_is_pspoll(hdr->frame_control)) &&
                      rx->sdata->vif.type != NL80211_IFTYPE_ADHOC &&
                      rx->sdata->vif.type != NL80211_IFTYPE_WDS &&
+                     rx->sdata->vif.type != NL80211_IFTYPE_OCB &&
                      (!rx->sta || !test_sta_flag(rx->sta, WLAN_STA_ASSOC)))) {
                 /*
                  * accept port control frames from the AP even when it's not
@@ -1272,6 +1273,12 @@ ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
                                 sta->last_rx_rate_vht_nss = status->vht_nss;
                         }
                 }
+        } else if (rx->sdata->vif.type == NL80211_IFTYPE_OCB) {
+                u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len,
+                                                NL80211_IFTYPE_OCB);
+                /* OCB uses wild-card BSSID */
+                if (is_broadcast_ether_addr(bssid))
+                        sta->last_rx = jiffies;
         } else if (!is_multicast_ether_addr(hdr->addr1)) {
                 /*
                  * Mesh beacons will update last_rx when if they are found to
@@ -2820,6 +2827,7 @@ ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
 
         if (!ieee80211_vif_is_mesh(&sdata->vif) &&
             sdata->vif.type != NL80211_IFTYPE_ADHOC &&
+            sdata->vif.type != NL80211_IFTYPE_OCB &&
             sdata->vif.type != NL80211_IFTYPE_STATION)
                 return RX_DROP_MONITOR;
 
@@ -3130,6 +3138,33 @@ static bool prepare_for_handlers(struct ieee80211_rx_data *rx,
                                                  BIT(rate_idx));
                 }
                 break;
+        case NL80211_IFTYPE_OCB:
+                if (!bssid)
+                        return false;
+                if (ieee80211_is_beacon(hdr->frame_control)) {
+                        return false;
+                } else if (!is_broadcast_ether_addr(bssid)) {
+                        ocb_dbg(sdata, "BSSID mismatch in OCB mode!\n");
+                        return false;
+                } else if (!multicast &&
+                           !ether_addr_equal(sdata->dev->dev_addr,
+                                             hdr->addr1)) {
+                        /* if we are in promisc mode we also accept
+                         * packets not destined for us
+                         */
+                        if (!(sdata->dev->flags & IFF_PROMISC))
+                                return false;
+                        rx->flags &= ~IEEE80211_RX_RA_MATCH;
+                } else if (!rx->sta) {
+                        int rate_idx;
+                        if (status->flag & RX_FLAG_HT)
+                                rate_idx = 0; /* TODO: HT rates */
+                        else
+                                rate_idx = status->rate_idx;
+                        ieee80211_ocb_rx_no_sta(sdata, bssid, hdr->addr2,
+                                                BIT(rate_idx));
+                }
+                break;
         case NL80211_IFTYPE_MESH_POINT:
                 if (!multicast &&
                     !ether_addr_equal(sdata->vif.addr, hdr->addr1)) {
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index de494df3bab8..adc25371b171 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -501,7 +501,7 @@ static int sta_info_insert_finish(struct sta_info *sta) __acquires(RCU)
         /* make the station visible */
         sta_info_hash_add(local, sta);
 
-        list_add_rcu(&sta->list, &local->sta_list);
+        list_add_tail_rcu(&sta->list, &local->sta_list);
 
         /* notify driver */
         err = sta_info_insert_drv_state(local, sdata, sta);
@@ -1531,7 +1531,7 @@ void ieee80211_sta_ps_deliver_uapsd(struct sta_info *sta)
                 break;
         case 0:
                 /* XXX: what is a good value? */
-                n_frames = 8;
+                n_frames = 128;
                 break;
         }
 
diff --git a/net/mac80211/status.c b/net/mac80211/status.c
index 89290e33dafe..9612d89fad56 100644
--- a/net/mac80211/status.c
+++ b/net/mac80211/status.c
@@ -704,7 +704,8 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
 
                 if ((sta->sdata->vif.type == NL80211_IFTYPE_STATION) &&
                     (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS))
-                        ieee80211_sta_tx_notify(sta->sdata, (void *) skb->data, acked);
+                        ieee80211_sta_tx_notify(sta->sdata, (void *) skb->data,
+                                                acked, info->status.tx_time);
 
                 if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS) {
                         if (info->flags & IEEE80211_TX_STAT_ACK) {
diff --git a/net/mac80211/tdls.c b/net/mac80211/tdls.c
index 4ea25dec0698..b4f368e2cb3b 100644
--- a/net/mac80211/tdls.c
+++ b/net/mac80211/tdls.c
@@ -562,8 +562,10 @@ ieee80211_tdls_prep_mgmt_packet(struct wiphy *wiphy, struct net_device *dev,
         /* infer the initiator if we can, to support old userspace */
         switch (action_code) {
         case WLAN_TDLS_SETUP_REQUEST:
-                if (sta)
+                if (sta) {
                         set_sta_flag(sta, WLAN_STA_TDLS_INITIATOR);
+                        sta->sta.tdls_initiator = false;
+                }
                 /* fall-through */
         case WLAN_TDLS_SETUP_CONFIRM:
         case WLAN_TDLS_DISCOVERY_REQUEST:
@@ -575,8 +577,10 @@ ieee80211_tdls_prep_mgmt_packet(struct wiphy *wiphy, struct net_device *dev,
                  * Make the last packet sent take effect for the initiator
                  * value.
                  */
-                if (sta)
+                if (sta) {
                         clear_sta_flag(sta, WLAN_STA_TDLS_INITIATOR);
+                        sta->sta.tdls_initiator = true;
+                }
                 /* fall-through */
         case WLAN_PUB_ACTION_TDLS_DISCOVER_RES:
                 initiator = false;
diff --git a/net/mac80211/trace.h b/net/mac80211/trace.h
index 38fae7ebe984..809a4983eb4a 100644
--- a/net/mac80211/trace.h
+++ b/net/mac80211/trace.h
@@ -987,29 +987,34 @@ TRACE_EVENT(drv_flush,
 
 TRACE_EVENT(drv_channel_switch,
         TP_PROTO(struct ieee80211_local *local,
+                 struct ieee80211_sub_if_data *sdata,
                  struct ieee80211_channel_switch *ch_switch),
 
-        TP_ARGS(local, ch_switch),
+        TP_ARGS(local, sdata, ch_switch),
 
         TP_STRUCT__entry(
                 LOCAL_ENTRY
+                VIF_ENTRY
                 CHANDEF_ENTRY
                 __field(u64, timestamp)
+                __field(u32, device_timestamp)
                 __field(bool, block_tx)
                 __field(u8, count)
         ),
 
         TP_fast_assign(
                 LOCAL_ASSIGN;
+                VIF_ASSIGN;
                 CHANDEF_ASSIGN(&ch_switch->chandef)
                 __entry->timestamp = ch_switch->timestamp;
+                __entry->device_timestamp = ch_switch->device_timestamp;
                 __entry->block_tx = ch_switch->block_tx;
                 __entry->count = ch_switch->count;
         ),
 
         TP_printk(
-                LOCAL_PR_FMT " new " CHANDEF_PR_FMT " count:%d",
-                LOCAL_PR_ARG, CHANDEF_PR_ARG, __entry->count
+                LOCAL_PR_FMT VIF_PR_FMT " new " CHANDEF_PR_FMT " count:%d",
+                LOCAL_PR_ARG, VIF_PR_ARG, CHANDEF_PR_ARG, __entry->count
         )
 );
 
@@ -1557,9 +1562,26 @@ DEFINE_EVENT(local_sdata_evt, drv_stop_ap,
         TP_ARGS(local, sdata)
 );
 
-DEFINE_EVENT(local_only_evt, drv_restart_complete,
-        TP_PROTO(struct ieee80211_local *local),
-        TP_ARGS(local)
+TRACE_EVENT(drv_reconfig_complete,
+        TP_PROTO(struct ieee80211_local *local,
+                 enum ieee80211_reconfig_type reconfig_type),
+        TP_ARGS(local, reconfig_type),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                __field(u8, reconfig_type)
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                __entry->reconfig_type = reconfig_type;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT  " reconfig_type:%d",
+                LOCAL_PR_ARG, __entry->reconfig_type
+        )
+
 );
 
 #if IS_ENABLED(CONFIG_IPV6)
@@ -2106,6 +2128,72 @@ TRACE_EVENT(drv_channel_switch_beacon,
         )
 );
 
+TRACE_EVENT(drv_pre_channel_switch,
+        TP_PROTO(struct ieee80211_local *local,
+                 struct ieee80211_sub_if_data *sdata,
+                 struct ieee80211_channel_switch *ch_switch),
+
+        TP_ARGS(local, sdata, ch_switch),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                VIF_ENTRY
+                CHANDEF_ENTRY
+                __field(u64, timestamp)
+                __field(bool, block_tx)
+                __field(u8, count)
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                VIF_ASSIGN;
+                CHANDEF_ASSIGN(&ch_switch->chandef)
+                __entry->timestamp = ch_switch->timestamp;
+                __entry->block_tx = ch_switch->block_tx;
+                __entry->count = ch_switch->count;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT VIF_PR_FMT " prepare channel switch to "
+                CHANDEF_PR_FMT  " count:%d block_tx:%d timestamp:%llu",
+                LOCAL_PR_ARG, VIF_PR_ARG, CHANDEF_PR_ARG, __entry->count,
+                __entry->block_tx, __entry->timestamp
+        )
+);
+
+DEFINE_EVENT(local_sdata_evt, drv_post_channel_switch,
+             TP_PROTO(struct ieee80211_local *local,
+                      struct ieee80211_sub_if_data *sdata),
+             TP_ARGS(local, sdata)
+);
+
+TRACE_EVENT(drv_get_txpower,
+        TP_PROTO(struct ieee80211_local *local,
+                 struct ieee80211_sub_if_data *sdata,
+                 int dbm, int ret),
+
+        TP_ARGS(local, sdata, dbm, ret),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                VIF_ENTRY
+                __field(int, dbm)
+                __field(int, ret)
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                VIF_ASSIGN;
+                __entry->dbm = dbm;
+                __entry->ret = ret;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT VIF_PR_FMT " dbm:%d ret:%d",
+                LOCAL_PR_ARG, VIF_PR_ARG, __entry->dbm, __entry->ret
+        )
+);
+
 
 #ifdef CONFIG_MAC80211_MESSAGE_TRACING
 #undef TRACE_SYSTEM
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 900632a250ec..3ffd91f295a6 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -296,6 +296,9 @@ ieee80211_tx_h_check_assoc(struct ieee80211_tx_data *tx)
                  */
                 return TX_DROP;
 
+        if (tx->sdata->vif.type == NL80211_IFTYPE_OCB)
+                return TX_CONTINUE;
+
         if (tx->sdata->vif.type == NL80211_IFTYPE_WDS)
                 return TX_CONTINUE;
 
@@ -2013,6 +2016,17 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
                         goto fail_rcu;
                 band = chanctx_conf->def.chan->band;
                 break;
+        case NL80211_IFTYPE_OCB:
+                /* DA SA BSSID */
+                memcpy(hdr.addr1, skb->data, ETH_ALEN);
+                memcpy(hdr.addr2, skb->data + ETH_ALEN, ETH_ALEN);
+                eth_broadcast_addr(hdr.addr3);
+                hdrlen = 24;
+                chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
+                if (!chanctx_conf)
+                        goto fail_rcu;
+                band = chanctx_conf->def.chan->band;
+                break;
         case NL80211_IFTYPE_ADHOC:
                 /* DA SA BSSID */
                 memcpy(hdr.addr1, skb->data, ETH_ALEN);
@@ -2057,6 +2071,7 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
          * EAPOL frames from the local station.
          */
         if (unlikely(!ieee80211_vif_is_mesh(&sdata->vif) &&
+                     (sdata->vif.type != NL80211_IFTYPE_OCB) &&
                      !multicast && !authorized &&
                      (cpu_to_be16(ethertype) != sdata->control_port_protocol ||
                       !ether_addr_equal(sdata->vif.addr, skb->data + ETH_ALEN)))) {
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 3c61060a4d2b..f9319a5dca64 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -693,6 +693,34 @@ void ieee80211_iterate_active_interfaces_rtnl(
 }
 EXPORT_SYMBOL_GPL(ieee80211_iterate_active_interfaces_rtnl);
 
+static void __iterate_stations(struct ieee80211_local *local,
+                               void (*iterator)(void *data,
+                                                struct ieee80211_sta *sta),
+                               void *data)
+{
+        struct sta_info *sta;
+
+        list_for_each_entry_rcu(sta, &local->sta_list, list) {
+                if (!sta->uploaded)
+                        continue;
+
+                iterator(data, &sta->sta);
+        }
+}
+
+void ieee80211_iterate_stations_atomic(struct ieee80211_hw *hw,
+                        void (*iterator)(void *data,
+                                         struct ieee80211_sta *sta),
+                        void *data)
+{
+        struct ieee80211_local *local = hw_to_local(hw);
+
+        rcu_read_lock();
+        __iterate_stations(local, iterator, data);
+        rcu_read_unlock();
+}
+EXPORT_SYMBOL_GPL(ieee80211_iterate_stations_atomic);
+
 struct ieee80211_vif *wdev_to_ieee80211_vif(struct wireless_dev *wdev)
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);
@@ -1073,6 +1101,7 @@ void ieee80211_set_wmm_default(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_chanctx_conf *chanctx_conf;
         int ac;
         bool use_11b, enable_qos;
+        bool is_ocb; /* Use another EDCA parameters if dot11OCBActivated=true */
         int aCWmin, aCWmax;
 
         if (!local->ops->conf_tx)
@@ -1097,6 +1126,8 @@ void ieee80211_set_wmm_default(struct ieee80211_sub_if_data *sdata,
          */
         enable_qos = (sdata->vif.type != NL80211_IFTYPE_STATION);
 
+        is_ocb = (sdata->vif.type == NL80211_IFTYPE_OCB);
+
         /* Set defaults according to 802.11-2007 Table 7-37 */
         aCWmax = 1023;
         if (use_11b)
@@ -1118,7 +1149,10 @@ void ieee80211_set_wmm_default(struct ieee80211_sub_if_data *sdata,
                                 qparam.cw_max = aCWmax;
                                 qparam.cw_min = aCWmin;
                                 qparam.txop = 0;
-                                qparam.aifs = 7;
+                                if (is_ocb)
+                                        qparam.aifs = 9;
+                                else
+                                        qparam.aifs = 7;
                                 break;
                         /* never happens but let's not leave undefined */
                         default:
@@ -1126,21 +1160,32 @@ void ieee80211_set_wmm_default(struct ieee80211_sub_if_data *sdata,
                                 qparam.cw_max = aCWmax;
                                 qparam.cw_min = aCWmin;
                                 qparam.txop = 0;
-                                qparam.aifs = 3;
+                                if (is_ocb)
+                                        qparam.aifs = 6;
+                                else
+                                        qparam.aifs = 3;
                                 break;
                         case IEEE80211_AC_VI:
                                 qparam.cw_max = aCWmin;
                                 qparam.cw_min = (aCWmin + 1) / 2 - 1;
-                                if (use_11b)
+                                if (is_ocb)
+                                        qparam.txop = 0;
+                                else if (use_11b)
                                         qparam.txop = 6016/32;
                                 else
                                         qparam.txop = 3008/32;
-                                qparam.aifs = 2;
+
+                                if (is_ocb)
+                                        qparam.aifs = 3;
+                                else
+                                        qparam.aifs = 2;
                                 break;
                         case IEEE80211_AC_VO:
                                 qparam.cw_max = (aCWmin + 1) / 2 - 1;
                                 qparam.cw_min = (aCWmin + 1) / 4 - 1;
-                                if (use_11b)
+                                if (is_ocb)
+                                        qparam.txop = 0;
+                                else if (use_11b)
                                         qparam.txop = 3264/32;
                                 else
                                         qparam.txop = 1504/32;
@@ -1813,6 +1858,10 @@ int ieee80211_reconfig(struct ieee80211_local *local)
                         ieee80211_bss_info_change_notify(sdata, changed);
                         sdata_unlock(sdata);
                         break;
+                case NL80211_IFTYPE_OCB:
+                        changed |= BSS_CHANGED_OCB;
+                        ieee80211_bss_info_change_notify(sdata, changed);
+                        break;
                 case NL80211_IFTYPE_ADHOC:
                         changed |= BSS_CHANGED_IBSS;
                         /* fall through */
@@ -1949,7 +1998,7 @@ int ieee80211_reconfig(struct ieee80211_local *local)
          * We may want to change that later, however.
          */
         if (!local->suspended || reconfig_due_to_wowlan)
-                drv_restart_complete(local);
+                drv_reconfig_complete(local, IEEE80211_RECONFIG_TYPE_RESTART);
 
         if (!local->suspended)
                 return 0;
@@ -1960,6 +2009,9 @@ int ieee80211_reconfig(struct ieee80211_local *local)
         mb();
         local->resuming = false;
 
+        if (!reconfig_due_to_wowlan)
+                drv_reconfig_complete(local, IEEE80211_RECONFIG_TYPE_SUSPEND);
+
         list_for_each_entry(sdata, &local->interfaces, list) {
                 if (!ieee80211_sdata_running(sdata))
                         continue;
@@ -2052,42 +2104,36 @@ static bool ieee80211_id_in_list(const u8 *ids, int n_ids, u8 id)
         return false;
 }
 
-/**
- * ieee80211_ie_split - split an IE buffer according to ordering
- *
- * @ies: the IE buffer
- * @ielen: the length of the IE buffer
- * @ids: an array with element IDs that are allowed before
- *      the split
- * @n_ids: the size of the element ID array
- * @offset: offset where to start splitting in the buffer
- *
- * This function splits an IE buffer by updating the @offset
- * variable to point to the location where the buffer should be
- * split.
- *
- * It assumes that the given IE buffer is well-formed, this
- * has to be guaranteed by the caller!
- *
- * It also assumes that the IEs in the buffer are ordered
- * correctly, if not the result of using this function will not
- * be ordered correctly either, i.e. it does no reordering.
- *
- * The function returns the offset where the next part of the
- * buffer starts, which may be @ielen if the entire (remainder)
- * of the buffer should be used.
- */
-size_t ieee80211_ie_split(const u8 *ies, size_t ielen,
-                          const u8 *ids, int n_ids, size_t offset)
+size_t ieee80211_ie_split_ric(const u8 *ies, size_t ielen,
+                              const u8 *ids, int n_ids,
+                              const u8 *after_ric, int n_after_ric,
+                              size_t offset)
 {
         size_t pos = offset;
 
-        while (pos < ielen && ieee80211_id_in_list(ids, n_ids, ies[pos]))
-                pos += 2 + ies[pos + 1];
+        while (pos < ielen && ieee80211_id_in_list(ids, n_ids, ies[pos])) {
+                if (ies[pos] == WLAN_EID_RIC_DATA && n_after_ric) {
+                        pos += 2 + ies[pos + 1];
+
+                        while (pos < ielen &&
+                               !ieee80211_id_in_list(after_ric, n_after_ric,
+                                                     ies[pos]))
+                                pos += 2 + ies[pos + 1];
+                } else {
+                        pos += 2 + ies[pos + 1];
+                }
+        }
 
         return pos;
 }
 
+size_t ieee80211_ie_split(const u8 *ies, size_t ielen,
+                          const u8 *ids, int n_ids, size_t offset)
+{
+        return ieee80211_ie_split_ric(ies, ielen, ids, n_ids, NULL, 0, offset);
+}
+EXPORT_SYMBOL(ieee80211_ie_split);
+
 size_t ieee80211_ie_split_vendor(const u8 *ies, size_t ielen, size_t offset)
 {
         size_t pos = offset;
@@ -2526,11 +2572,23 @@ void ieee80211_dfs_radar_detected_work(struct work_struct *work)
         struct ieee80211_local *local =
                 container_of(work, struct ieee80211_local, radar_detected_work);
         struct cfg80211_chan_def chandef = local->hw.conf.chandef;
+        struct ieee80211_chanctx *ctx;
+        int num_chanctx = 0;
+
+        mutex_lock(&local->chanctx_mtx);
+        list_for_each_entry(ctx, &local->chanctx_list, list) {
+                if (ctx->replace_state == IEEE80211_CHANCTX_REPLACES_OTHER)
+                        continue;
+
+                num_chanctx++;
+                chandef = ctx->conf.def;
+        }
+        mutex_unlock(&local->chanctx_mtx);
 
         ieee80211_dfs_cac_cancel(local);
 
-        if (local->use_chanctx)
-                /* currently not handled */
+        if (num_chanctx > 1)
+                /* XXX: multi-channel is not supported yet */
                 WARN_ON(1);
         else
                 cfg80211_radar_event(local->hw.wiphy, &chandef, GFP_KERNEL);
diff --git a/net/mac80211/wep.c b/net/mac80211/wep.c
index 9181fb6d6437..a4220e92f0cc 100644
--- a/net/mac80211/wep.c
+++ b/net/mac80211/wep.c
@@ -111,8 +111,6 @@ static u8 *ieee80211_wep_add_iv(struct ieee80211_local *local,
             (info->control.hw_key->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE))
                 return newhdr + hdrlen;
 
-        skb_set_network_header(skb, skb_network_offset(skb) +
-                                    IEEE80211_WEP_IV_LEN);
         ieee80211_wep_get_iv(local, keylen, keyidx, newhdr + hdrlen);
         return newhdr + hdrlen;
 }
diff --git a/net/mac80211/wme.c b/net/mac80211/wme.c
index 3b873989992c..fdf52db95b33 100644
--- a/net/mac80211/wme.c
+++ b/net/mac80211/wme.c
@@ -54,10 +54,18 @@ static int wme_downgrade_ac(struct sk_buff *skb)
 }
 
 static u16 ieee80211_downgrade_queue(struct ieee80211_sub_if_data *sdata,
-                                     struct sk_buff *skb)
+                                     struct sta_info *sta, struct sk_buff *skb)
 {
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+
         /* in case we are a client verify acm is not set for this ac */
-        while (unlikely(sdata->wmm_acm & BIT(skb->priority))) {
+        while (sdata->wmm_acm & BIT(skb->priority)) {
+                int ac = ieee802_1d_to_ac[skb->priority];
+
+                if (ifmgd->tx_tspec[ac].admitted_time &&
+                    skb->priority == ifmgd->tx_tspec[ac].up)
+                        return ac;
+
                 if (wme_downgrade_ac(skb)) {
                         /*
                          * This should not really happen. The AP has marked all
@@ -96,7 +104,7 @@ u16 ieee80211_select_queue_80211(struct ieee80211_sub_if_data *sdata,
         p = ieee80211_get_qos_ctl(hdr);
         skb->priority = *p & IEEE80211_QOS_CTL_TAG1D_MASK;
 
-        return ieee80211_downgrade_queue(sdata, skb);
+        return ieee80211_downgrade_queue(sdata, NULL, skb);
 }
 
 /* Indicate which queue to use. */
@@ -108,6 +116,7 @@ u16 ieee80211_select_queue(struct ieee80211_sub_if_data *sdata,
         const u8 *ra = NULL;
         bool qos = false;
         struct mac80211_qos_map *qos_map;
+        u16 ret;
 
         if (local->hw.queues < IEEE80211_NUM_ACS || skb->len < 6) {
                 skb->priority = 0; /* required for correct WPA/11i MIC */
@@ -139,6 +148,10 @@ u16 ieee80211_select_queue(struct ieee80211_sub_if_data *sdata,
         case NL80211_IFTYPE_ADHOC:
                 ra = skb->data;
                 break;
+        case NL80211_IFTYPE_OCB:
+                /* all stations are required to support WME */
+                qos = true;
+                break;
         default:
                 break;
         }
@@ -148,27 +161,29 @@ u16 ieee80211_select_queue(struct ieee80211_sub_if_data *sdata,
                 if (sta)
                         qos = sta->sta.wme;
         }
-        rcu_read_unlock();
 
         if (!qos) {
                 skb->priority = 0; /* required for correct WPA/11i MIC */
-                return IEEE80211_AC_BE;
+                ret = IEEE80211_AC_BE;
+                goto out;
         }
 
         if (skb->protocol == sdata->control_port_protocol) {
                 skb->priority = 7;
-                return ieee80211_downgrade_queue(sdata, skb);
+                goto downgrade;
         }
 
         /* use the data classifier to determine what 802.1d tag the
          * data frame has */
-        rcu_read_lock();
         qos_map = rcu_dereference(sdata->qos_map);
         skb->priority = cfg80211_classify8021d(skb, qos_map ?
                                                &qos_map->qos_map : NULL);
-        rcu_read_unlock();
 
-        return ieee80211_downgrade_queue(sdata, skb);
+ downgrade:
+        ret = ieee80211_downgrade_queue(sdata, sta, skb);
+ out:
+        rcu_read_unlock();
+        return ret;
 }
 
 /**
diff --git a/net/mac80211/wme.h b/net/mac80211/wme.h
index 7fea4bb8acbc..80151edc5195 100644
--- a/net/mac80211/wme.h
+++ b/net/mac80211/wme.h
@@ -13,8 +13,6 @@
 #include <linux/netdevice.h>
 #include "ieee80211_i.h"
 
-extern const int ieee802_1d_to_ac[8];
-
 u16 ieee80211_select_queue_80211(struct ieee80211_sub_if_data *sdata,
                                  struct sk_buff *skb,
                                  struct ieee80211_hdr *hdr);
diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c
index 983527a4c1ab..12398fde02e8 100644
--- a/net/mac80211/wpa.c
+++ b/net/mac80211/wpa.c
@@ -209,8 +209,6 @@ static int tkip_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
 
         pos = skb_push(skb, IEEE80211_TKIP_IV_LEN);
         memmove(pos, pos + IEEE80211_TKIP_IV_LEN, hdrlen);
-        skb_set_network_header(skb, skb_network_offset(skb) +
-                                    IEEE80211_TKIP_IV_LEN);
         pos += hdrlen;
 
         /* the HW only needs room for the IV, but not the actual IV */
@@ -434,8 +432,6 @@ static int ccmp_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
 
         pos = skb_push(skb, IEEE80211_CCMP_HDR_LEN);
         memmove(pos, pos + IEEE80211_CCMP_HDR_LEN, hdrlen);
-        skb_set_network_header(skb, skb_network_offset(skb) +
-                                    IEEE80211_CCMP_HDR_LEN);
 
         /* the HW only needs room for the IV, but not the actual IV */
         if (info->control.hw_key &&
@@ -575,7 +571,6 @@ ieee80211_crypto_cs_encrypt(struct ieee80211_tx_data *tx,
 
         pos = skb_push(skb, cs->hdr_len);
         memmove(pos, pos + cs->hdr_len, hdrlen);
-        skb_set_network_header(skb, skb_network_offset(skb) + cs->hdr_len);
 
         return TX_CONTINUE;
 }
diff --git a/net/mac802154/Kconfig b/net/mac802154/Kconfig
index 1818a99b3081..aa462b480a39 100644
--- a/net/mac802154/Kconfig
+++ b/net/mac802154/Kconfig
@@ -16,5 +16,5 @@ config MAC802154
           been tested yet!
 
           If you plan to use HardMAC IEEE 802.15.4 devices, you can
-          say N here. Alternatievly you can say M to compile it as
+          say N here. Alternatively you can say M to compile it as
           module.
diff --git a/net/mac802154/Makefile b/net/mac802154/Makefile
index 9723d6f3f3e5..2e497d0c829a 100644
--- a/net/mac802154/Makefile
+++ b/net/mac802154/Makefile
@@ -1,5 +1,5 @@
 obj-$(CONFIG_MAC802154) += mac802154.o
-mac802154-objs          := ieee802154_dev.o rx.o tx.o mac_cmd.o mib.o \
-                           monitor.o wpan.o llsec.o
+mac802154-objs          := main.o rx.o tx.o mac_cmd.o mib.o \
+                           iface.o llsec.o util.o
 
 ccflags-y += -D__CHECK_ENDIAN__
diff --git a/net/mac802154/driver-ops.h b/net/mac802154/driver-ops.h
new file mode 100644
index 000000000000..dfd29ffb8fee
--- /dev/null
+++ b/net/mac802154/driver-ops.h
@@ -0,0 +1,226 @@
+#ifndef __MAC802154_DRVIER_OPS
+#define __MAC802154_DRIVER_OPS
+
+#include <linux/types.h>
+#include <linux/rtnetlink.h>
+
+#include <net/mac802154.h>
+
+#include "ieee802154_i.h"
+
+static inline int
+drv_xmit_async(struct ieee802154_local *local, struct sk_buff *skb)
+{
+        return local->ops->xmit_async(&local->hw, skb);
+}
+
+static inline int
+drv_xmit_sync(struct ieee802154_local *local, struct sk_buff *skb)
+{
+        /* don't allow other operations while sync xmit */
+        ASSERT_RTNL();
+
+        might_sleep();
+
+        return local->ops->xmit_sync(&local->hw, skb);
+}
+
+static inline int drv_start(struct ieee802154_local *local)
+{
+        might_sleep();
+
+        local->started = true;
+        smp_mb();
+
+        return local->ops->start(&local->hw);
+}
+
+static inline void drv_stop(struct ieee802154_local *local)
+{
+        might_sleep();
+
+        local->ops->stop(&local->hw);
+
+        /* sync away all work on the tasklet before clearing started */
+        tasklet_disable(&local->tasklet);
+        tasklet_enable(&local->tasklet);
+
+        barrier();
+
+        local->started = false;
+}
+
+static inline int drv_set_channel(struct ieee802154_local *local,
+                                  const u8 page, const u8 channel)
+{
+        might_sleep();
+
+        return local->ops->set_channel(&local->hw, page, channel);
+}
+
+static inline int drv_set_tx_power(struct ieee802154_local *local,
+                                   const s8 dbm)
+{
+        might_sleep();
+
+        if (!local->ops->set_txpower) {
+                WARN_ON(1);
+                return -EOPNOTSUPP;
+        }
+
+        return local->ops->set_txpower(&local->hw, dbm);
+}
+
+static inline int drv_set_cca_mode(struct ieee802154_local *local,
+                                   const u8 cca_mode)
+{
+        might_sleep();
+
+        if (!local->ops->set_cca_mode) {
+                WARN_ON(1);
+                return -EOPNOTSUPP;
+        }
+
+        return local->ops->set_cca_mode(&local->hw, cca_mode);
+}
+
+static inline int drv_set_lbt_mode(struct ieee802154_local *local,
+                                   const bool mode)
+{
+        might_sleep();
+
+        if (!local->ops->set_lbt) {
+                WARN_ON(1);
+                return -EOPNOTSUPP;
+        }
+
+        return local->ops->set_lbt(&local->hw, mode);
+}
+
+static inline int drv_set_cca_ed_level(struct ieee802154_local *local,
+                                       const s32 ed_level)
+{
+        might_sleep();
+
+        if (!local->ops->set_cca_ed_level) {
+                WARN_ON(1);
+                return -EOPNOTSUPP;
+        }
+
+        return local->ops->set_cca_ed_level(&local->hw, ed_level);
+}
+
+static inline int drv_set_pan_id(struct ieee802154_local *local,
+                                 const __le16 pan_id)
+{
+        struct ieee802154_hw_addr_filt filt;
+
+        might_sleep();
+
+        if (!local->ops->set_hw_addr_filt) {
+                WARN_ON(1);
+                return -EOPNOTSUPP;
+        }
+
+        filt.pan_id = pan_id;
+
+        return local->ops->set_hw_addr_filt(&local->hw, &filt,
+                                            IEEE802154_AFILT_PANID_CHANGED);
+}
+
+static inline int drv_set_extended_addr(struct ieee802154_local *local,
+                                        const __le64 extended_addr)
+{
+        struct ieee802154_hw_addr_filt filt;
+
+        might_sleep();
+
+        if (!local->ops->set_hw_addr_filt) {
+                WARN_ON(1);
+                return -EOPNOTSUPP;
+        }
+
+        filt.ieee_addr = extended_addr;
+
+        return local->ops->set_hw_addr_filt(&local->hw, &filt,
+                                            IEEE802154_AFILT_IEEEADDR_CHANGED);
+}
+
+static inline int drv_set_short_addr(struct ieee802154_local *local,
+                                     const __le16 short_addr)
+{
+        struct ieee802154_hw_addr_filt filt;
+
+        might_sleep();
+
+        if (!local->ops->set_hw_addr_filt) {
+                WARN_ON(1);
+                return -EOPNOTSUPP;
+        }
+
+        filt.short_addr = short_addr;
+
+        return local->ops->set_hw_addr_filt(&local->hw, &filt,
+                                            IEEE802154_AFILT_SADDR_CHANGED);
+}
+
+static inline int drv_set_pan_coord(struct ieee802154_local *local,
+                                    const bool is_coord)
+{
+        struct ieee802154_hw_addr_filt filt;
+
+        might_sleep();
+
+        if (!local->ops->set_hw_addr_filt) {
+                WARN_ON(1);
+                return -EOPNOTSUPP;
+        }
+
+        filt.pan_coord = is_coord;
+
+        return local->ops->set_hw_addr_filt(&local->hw, &filt,
+                                            IEEE802154_AFILT_PANC_CHANGED);
+}
+
+static inline int drv_set_csma_params(struct ieee802154_local *local,
+                                      u8 min_be, u8 max_be,
+                                      u8 max_csma_backoffs)
+{
+        might_sleep();
+
+        if (!local->ops->set_csma_params) {
+                WARN_ON(1);
+                return -EOPNOTSUPP;
+        }
+
+        return local->ops->set_csma_params(&local->hw, min_be, max_be,
+                                           max_csma_backoffs);
+}
+
+static inline int drv_set_max_frame_retries(struct ieee802154_local *local,
+                                            s8 max_frame_retries)
+{
+        might_sleep();
+
+        if (!local->ops->set_frame_retries) {
+                WARN_ON(1);
+                return -EOPNOTSUPP;
+        }
+
+        return local->ops->set_frame_retries(&local->hw, max_frame_retries);
+}
+
+static inline int drv_set_promiscuous_mode(struct ieee802154_local *local,
+                                           const bool on)
+{
+        might_sleep();
+
+        if (!local->ops->set_promiscuous_mode) {
+                WARN_ON(1);
+                return -EOPNOTSUPP;
+        }
+
+        return local->ops->set_promiscuous_mode(&local->hw, on);
+}
+
+#endif /* __MAC802154_DRVIER_OPS */
diff --git a/net/mac802154/ieee802154_dev.c b/net/mac802154/ieee802154_dev.c
deleted file mode 100644
index b36b2b996578..000000000000
--- a/net/mac802154/ieee802154_dev.c
+++ /dev/null
@@ -1,415 +0,0 @@
-/*
- * Copyright (C) 2007-2012 Siemens AG
- *
- * Written by:
- * Alexander Smirnov <alex.bluesman.smirnov@gmail.com>
- *
- * Based on the code from 'linux-zigbee.sourceforge.net' project.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2
- * as published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
- */
-
-#include <linux/kernel.h>
-#include <linux/module.h>
-#include <linux/netdevice.h>
-
-#include <net/netlink.h>
-#include <linux/nl802154.h>
-#include <net/mac802154.h>
-#include <net/ieee802154_netdev.h>
-#include <net/route.h>
-#include <net/wpan-phy.h>
-
-#include "mac802154.h"
-
-int mac802154_slave_open(struct net_device *dev)
-{
-        struct mac802154_sub_if_data *priv = netdev_priv(dev);
-        struct mac802154_sub_if_data *subif;
-        struct mac802154_priv *ipriv = priv->hw;
-        int res = 0;
-
-        ASSERT_RTNL();
-
-        if (priv->type == IEEE802154_DEV_WPAN) {
-                mutex_lock(&priv->hw->slaves_mtx);
-                list_for_each_entry(subif, &priv->hw->slaves, list) {
-                        if (subif != priv && subif->type == priv->type &&
-                            subif->running) {
-                                mutex_unlock(&priv->hw->slaves_mtx);
-                                return -EBUSY;
-                        }
-                }
-                mutex_unlock(&priv->hw->slaves_mtx);
-        }
-
-        mutex_lock(&priv->hw->slaves_mtx);
-        priv->running = true;
-        mutex_unlock(&priv->hw->slaves_mtx);
-
-        if (ipriv->open_count++ == 0) {
-                res = ipriv->ops->start(&ipriv->hw);
-                WARN_ON(res);
-                if (res)
-                        goto err;
-        }
-
-        if (ipriv->ops->ieee_addr) {
-                __le64 addr = ieee802154_devaddr_from_raw(dev->dev_addr);
-
-                res = ipriv->ops->ieee_addr(&ipriv->hw, addr);
-                WARN_ON(res);
-                if (res)
-                        goto err;
-                mac802154_dev_set_ieee_addr(dev);
-        }
-
-        netif_start_queue(dev);
-        return 0;
-err:
-        priv->hw->open_count--;
-
-        return res;
-}
-
-int mac802154_slave_close(struct net_device *dev)
-{
-        struct mac802154_sub_if_data *priv = netdev_priv(dev);
-        struct mac802154_priv *ipriv = priv->hw;
-
-        ASSERT_RTNL();
-
-        netif_stop_queue(dev);
-
-        mutex_lock(&priv->hw->slaves_mtx);
-        priv->running = false;
-        mutex_unlock(&priv->hw->slaves_mtx);
-
-        if (!--ipriv->open_count)
-                ipriv->ops->stop(&ipriv->hw);
-
-        return 0;
-}
-
-static int
-mac802154_netdev_register(struct wpan_phy *phy, struct net_device *dev)
-{
-        struct mac802154_sub_if_data *priv;
-        struct mac802154_priv *ipriv;
-        int err;
-
-        ipriv = wpan_phy_priv(phy);
-
-        priv = netdev_priv(dev);
-        priv->dev = dev;
-        priv->hw = ipriv;
-
-        dev->needed_headroom = ipriv->hw.extra_tx_headroom;
-
-        SET_NETDEV_DEV(dev, &ipriv->phy->dev);
-
-        mutex_lock(&ipriv->slaves_mtx);
-        if (!ipriv->running) {
-                mutex_unlock(&ipriv->slaves_mtx);
-                return -ENODEV;
-        }
-        mutex_unlock(&ipriv->slaves_mtx);
-
-        err = register_netdev(dev);
-        if (err < 0)
-                return err;
-
-        rtnl_lock();
-        mutex_lock(&ipriv->slaves_mtx);
-        list_add_tail_rcu(&priv->list, &ipriv->slaves);
-        mutex_unlock(&ipriv->slaves_mtx);
-        rtnl_unlock();
-
-        return 0;
-}
-
-static void
-mac802154_del_iface(struct wpan_phy *phy, struct net_device *dev)
-{
-        struct mac802154_sub_if_data *sdata;
-
-        ASSERT_RTNL();
-
-        sdata = netdev_priv(dev);
-
-        BUG_ON(sdata->hw->phy != phy);
-
-        mutex_lock(&sdata->hw->slaves_mtx);
-        list_del_rcu(&sdata->list);
-        mutex_unlock(&sdata->hw->slaves_mtx);
-
-        synchronize_rcu();
-        unregister_netdevice(sdata->dev);
-}
-
-static struct net_device *
-mac802154_add_iface(struct wpan_phy *phy, const char *name, int type)
-{
-        struct net_device *dev;
-        int err = -ENOMEM;
-
-        switch (type) {
-        case IEEE802154_DEV_MONITOR:
-                dev = alloc_netdev(sizeof(struct mac802154_sub_if_data),
-                                   name, NET_NAME_UNKNOWN,
-                                   mac802154_monitor_setup);
-                break;
-        case IEEE802154_DEV_WPAN:
-                dev = alloc_netdev(sizeof(struct mac802154_sub_if_data),
-                                   name, NET_NAME_UNKNOWN,
-                                   mac802154_wpan_setup);
-                break;
-        default:
-                dev = NULL;
-                err = -EINVAL;
-                break;
-        }
-        if (!dev)
-                goto err;
-
-        err = mac802154_netdev_register(phy, dev);
-        if (err)
-                goto err_free;
-
-        dev_hold(dev); /* we return an incremented device refcount */
-        return dev;
-
-err_free:
-        free_netdev(dev);
-err:
-        return ERR_PTR(err);
-}
-
-static int mac802154_set_txpower(struct wpan_phy *phy, int db)
-{
-        struct mac802154_priv *priv = wpan_phy_priv(phy);
-
-        return priv->ops->set_txpower(&priv->hw, db);
-}
-
-static int mac802154_set_lbt(struct wpan_phy *phy, bool on)
-{
-        struct mac802154_priv *priv = wpan_phy_priv(phy);
-
-        return priv->ops->set_lbt(&priv->hw, on);
-}
-
-static int mac802154_set_cca_mode(struct wpan_phy *phy, u8 mode)
-{
-        struct mac802154_priv *priv = wpan_phy_priv(phy);
-
-        return priv->ops->set_cca_mode(&priv->hw, mode);
-}
-
-static int mac802154_set_cca_ed_level(struct wpan_phy *phy, s32 level)
-{
-        struct mac802154_priv *priv = wpan_phy_priv(phy);
-
-        return priv->ops->set_cca_ed_level(&priv->hw, level);
-}
-
-static int mac802154_set_csma_params(struct wpan_phy *phy, u8 min_be,
-                                     u8 max_be, u8 retries)
-{
-        struct mac802154_priv *priv = wpan_phy_priv(phy);
-
-        return priv->ops->set_csma_params(&priv->hw, min_be, max_be, retries);
-}
-
-static int mac802154_set_frame_retries(struct wpan_phy *phy, s8 retries)
-{
-        struct mac802154_priv *priv = wpan_phy_priv(phy);
-
-        return priv->ops->set_frame_retries(&priv->hw, retries);
-}
-
-struct ieee802154_dev *
-ieee802154_alloc_device(size_t priv_data_len, struct ieee802154_ops *ops)
-{
-        struct wpan_phy *phy;
-        struct mac802154_priv *priv;
-        size_t priv_size;
-
-        if (!ops || !ops->xmit || !ops->ed || !ops->start ||
-            !ops->stop || !ops->set_channel) {
-                pr_err("undefined IEEE802.15.4 device operations\n");
-                return NULL;
-        }
-
-        /* Ensure 32-byte alignment of our private data and hw private data.
-         * We use the wpan_phy priv data for both our mac802154_priv and for
-         * the driver's private data
-         *
-         * in memory it'll be like this:
-         *
-         * +-----------------------+
-         * | struct wpan_phy       |
-         * +-----------------------+
-         * | struct mac802154_priv |
-         * +-----------------------+
-         * | driver's private data |
-         * +-----------------------+
-         *
-         * Due to ieee802154 layer isn't aware of driver and MAC structures,
-         * so lets allign them here.
-         */
-
-        priv_size = ALIGN(sizeof(*priv), NETDEV_ALIGN) + priv_data_len;
-
-        phy = wpan_phy_alloc(priv_size);
-        if (!phy) {
-                pr_err("failure to allocate master IEEE802.15.4 device\n");
-                return NULL;
-        }
-
-        priv = wpan_phy_priv(phy);
-        priv->phy = phy;
-        priv->hw.phy = priv->phy;
-        priv->hw.priv = (char *)priv + ALIGN(sizeof(*priv), NETDEV_ALIGN);
-        priv->ops = ops;
-
-        INIT_LIST_HEAD(&priv->slaves);
-        mutex_init(&priv->slaves_mtx);
-
-        return &priv->hw;
-}
-EXPORT_SYMBOL(ieee802154_alloc_device);
-
-void ieee802154_free_device(struct ieee802154_dev *hw)
-{
-        struct mac802154_priv *priv = mac802154_to_priv(hw);
-
-        BUG_ON(!list_empty(&priv->slaves));
-
-        mutex_destroy(&priv->slaves_mtx);
-
-        wpan_phy_free(priv->phy);
-}
-EXPORT_SYMBOL(ieee802154_free_device);
-
-int ieee802154_register_device(struct ieee802154_dev *dev)
-{
-        struct mac802154_priv *priv = mac802154_to_priv(dev);
-        int rc = -ENOSYS;
-
-        if (dev->flags & IEEE802154_HW_TXPOWER) {
-                if (!priv->ops->set_txpower)
-                        goto out;
-
-                priv->phy->set_txpower = mac802154_set_txpower;
-        }
-
-        if (dev->flags & IEEE802154_HW_LBT) {
-                if (!priv->ops->set_lbt)
-                        goto out;
-
-                priv->phy->set_lbt = mac802154_set_lbt;
-        }
-
-        if (dev->flags & IEEE802154_HW_CCA_MODE) {
-                if (!priv->ops->set_cca_mode)
-                        goto out;
-
-                priv->phy->set_cca_mode = mac802154_set_cca_mode;
-        }
-
-        if (dev->flags & IEEE802154_HW_CCA_ED_LEVEL) {
-                if (!priv->ops->set_cca_ed_level)
-                        goto out;
-
-                priv->phy->set_cca_ed_level = mac802154_set_cca_ed_level;
-        }
-
-        if (dev->flags & IEEE802154_HW_CSMA_PARAMS) {
-                if (!priv->ops->set_csma_params)
-                        goto out;
-
-                priv->phy->set_csma_params = mac802154_set_csma_params;
-        }
-
-        if (dev->flags & IEEE802154_HW_FRAME_RETRIES) {
-                if (!priv->ops->set_frame_retries)
-                        goto out;
-
-                priv->phy->set_frame_retries = mac802154_set_frame_retries;
-        }
-
-        priv->dev_workqueue =
-                create_singlethread_workqueue(wpan_phy_name(priv->phy));
-        if (!priv->dev_workqueue) {
-                rc = -ENOMEM;
-                goto out;
-        }
-
-        wpan_phy_set_dev(priv->phy, priv->hw.parent);
-
-        priv->phy->add_iface = mac802154_add_iface;
-        priv->phy->del_iface = mac802154_del_iface;
-
-        rc = wpan_phy_register(priv->phy);
-        if (rc < 0)
-                goto out_wq;
-
-        rtnl_lock();
-
-        mutex_lock(&priv->slaves_mtx);
-        priv->running = MAC802154_DEVICE_RUN;
-        mutex_unlock(&priv->slaves_mtx);
-
-        rtnl_unlock();
-
-        return 0;
-
-out_wq:
-        destroy_workqueue(priv->dev_workqueue);
-out:
-        return rc;
-}
-EXPORT_SYMBOL(ieee802154_register_device);
-
-void ieee802154_unregister_device(struct ieee802154_dev *dev)
-{
-        struct mac802154_priv *priv = mac802154_to_priv(dev);
-        struct mac802154_sub_if_data *sdata, *next;
-
-        flush_workqueue(priv->dev_workqueue);
-        destroy_workqueue(priv->dev_workqueue);
-
-        rtnl_lock();
-
-        mutex_lock(&priv->slaves_mtx);
-        priv->running = MAC802154_DEVICE_STOPPED;
-        mutex_unlock(&priv->slaves_mtx);
-
-        list_for_each_entry_safe(sdata, next, &priv->slaves, list) {
-                mutex_lock(&sdata->hw->slaves_mtx);
-                list_del(&sdata->list);
-                mutex_unlock(&sdata->hw->slaves_mtx);
-
-                unregister_netdevice(sdata->dev);
-        }
-
-        rtnl_unlock();
-
-        wpan_phy_unregister(priv->phy);
-}
-EXPORT_SYMBOL(ieee802154_unregister_device);
-
-MODULE_DESCRIPTION("IEEE 802.15.4 implementation");
-MODULE_LICENSE("GPL v2");
diff --git a/net/mac802154/mac802154.h b/net/mac802154/ieee802154_i.h
index 762a6f849c6b..1086a9d96f8f 100644
--- a/net/mac802154/mac802154.h
+++ b/net/mac802154/ieee802154_i.h
@@ -10,18 +10,14 @@
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
- * You should have received a copy of the GNU General Public License along
- * with this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
- *
  * Written by:
  * Pavel Smolenskiy <pavel.smolenskiy@gmail.com>
  * Maxim Gorbachyov <maxim.gorbachev@siemens.com>
  * Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
  * Alexander Smirnov <alex.bluesman.smirnov@gmail.com>
  */
-#ifndef MAC802154_H
-#define MAC802154_H
+#ifndef __IEEE802154_I_H
+#define __IEEE802154_I_H
 
 #include <linux/mutex.h>
 #include <net/mac802154.h>
@@ -30,9 +26,9 @@
 #include "llsec.h"
 
 /* mac802154 device private data */
-struct mac802154_priv {
-        struct ieee802154_dev hw;
-        struct ieee802154_ops *ops;
+struct ieee802154_local {
+        struct ieee802154_hw hw;
+        const struct ieee802154_ops *ops;
 
         /* ieee802154 phy */
         struct wpan_phy *phy;
@@ -46,23 +42,27 @@ struct mac802154_priv {
          *
          * So atomic readers can use any of this protection methods.
          */
-        struct list_head        slaves;
-        struct mutex            slaves_mtx;
+        struct list_head        interfaces;
+        struct mutex            iflist_mtx;
 
         /* This one is used for scanning and other jobs not to be interfered
          * with serial driver.
          */
-        struct workqueue_struct *dev_workqueue;
+        struct workqueue_struct *workqueue;
 
-        /* SoftMAC device is registered and running. One can add subinterfaces.
-         * This flag should be modified under slaves_mtx and RTNL, so you can
-         * read them using any of protection methods.
-         */
-        bool running;
+        bool started;
+
+        struct tasklet_struct tasklet;
+        struct sk_buff_head skb_queue;
 };
 
-#define MAC802154_DEVICE_STOPPED        0x00
-#define MAC802154_DEVICE_RUN            0x01
+enum {
+        IEEE802154_RX_MSG        = 1,
+};
+
+enum ieee802154_sdata_state_bits {
+        SDATA_STATE_RUNNING,
+};
 
 /* Slave interface definition.
  *
@@ -70,23 +70,21 @@ struct mac802154_priv {
  * Each ieee802154 device/transceiver may have several slaves and able
  * to be associated with several networks at the same time.
  */
-struct mac802154_sub_if_data {
+struct ieee802154_sub_if_data {
         struct list_head list; /* the ieee802154_priv->slaves list */
 
-        struct mac802154_priv *hw;
+        struct ieee802154_local *local;
         struct net_device *dev;
 
         int type;
-        bool running;
+        unsigned long state;
 
         spinlock_t mib_lock;
 
         __le16 pan_id;
         __le16 short_addr;
         __le64 extended_addr;
-
-        u8 chan;
-        u8 page;
+        bool promisuous_mode;
 
         struct ieee802154_mac_params mac_params;
 
@@ -103,24 +101,36 @@ struct mac802154_sub_if_data {
         struct mac802154_llsec sec;
 };
 
-#define mac802154_to_priv(_hw)  container_of(_hw, struct mac802154_priv, hw)
-
 #define MAC802154_CHAN_NONE             0xff /* No channel is assigned */
 
+static inline struct ieee802154_local *
+hw_to_local(struct ieee802154_hw *hw)
+{
+        return container_of(hw, struct ieee802154_local, hw);
+}
+
+static inline struct ieee802154_sub_if_data *
+IEEE802154_DEV_TO_SUB_IF(const struct net_device *dev)
+{
+        return netdev_priv(dev);
+}
+
+static inline bool
+ieee802154_sdata_running(struct ieee802154_sub_if_data *sdata)
+{
+        return test_bit(SDATA_STATE_RUNNING, &sdata->state);
+}
+
 extern struct ieee802154_reduced_mlme_ops mac802154_mlme_reduced;
 extern struct ieee802154_mlme_ops mac802154_mlme_wpan;
 
-int mac802154_slave_open(struct net_device *dev);
-int mac802154_slave_close(struct net_device *dev);
-
-void mac802154_monitors_rx(struct mac802154_priv *priv, struct sk_buff *skb);
 void mac802154_monitor_setup(struct net_device *dev);
+netdev_tx_t
+ieee802154_monitor_start_xmit(struct sk_buff *skb, struct net_device *dev);
 
-void mac802154_wpans_rx(struct mac802154_priv *priv, struct sk_buff *skb);
 void mac802154_wpan_setup(struct net_device *dev);
-
-netdev_tx_t mac802154_tx(struct mac802154_priv *priv, struct sk_buff *skb,
-                         u8 page, u8 chan);
+netdev_tx_t
+ieee802154_subif_start_xmit(struct sk_buff *skb, struct net_device *dev);
 
 /* MIB callbacks */
 void mac802154_dev_set_short_addr(struct net_device *dev, __le16 val);
@@ -131,11 +141,6 @@ void mac802154_dev_set_pan_id(struct net_device *dev, __le16 val);
 void mac802154_dev_set_page_channel(struct net_device *dev, u8 page, u8 chan);
 u8 mac802154_dev_get_dsn(const struct net_device *dev);
 
-int mac802154_set_mac_params(struct net_device *dev,
-                             const struct ieee802154_mac_params *params);
-void mac802154_get_mac_params(struct net_device *dev,
-                              struct ieee802154_mac_params *params);
-
 int mac802154_get_params(struct net_device *dev,
                          struct ieee802154_llsec_params *params);
 int mac802154_set_params(struct net_device *dev,
@@ -169,4 +174,4 @@ void mac802154_get_table(struct net_device *dev,
                          struct ieee802154_llsec_table **t);
 void mac802154_unlock_table(struct net_device *dev);
 
-#endif /* MAC802154_H */
+#endif /* __IEEE802154_I_H */
diff --git a/net/mac802154/iface.c b/net/mac802154/iface.c
new file mode 100644
index 000000000000..f7a6f83301e2
--- /dev/null
+++ b/net/mac802154/iface.c
@@ -0,0 +1,466 @@
+/*
+ * Copyright 2007-2012 Siemens AG
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * Written by:
+ * Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
+ * Sergey Lapin <slapin@ossfans.org>
+ * Maxim Gorbachyov <maxim.gorbachev@siemens.com>
+ * Alexander Smirnov <alex.bluesman.smirnov@gmail.com>
+ */
+
+#include <linux/netdevice.h>
+#include <linux/module.h>
+#include <linux/if_arp.h>
+#include <linux/ieee802154.h>
+
+#include <net/rtnetlink.h>
+#include <linux/nl802154.h>
+#include <net/af_ieee802154.h>
+#include <net/mac802154.h>
+#include <net/ieee802154_netdev.h>
+#include <net/cfg802154.h>
+
+#include "ieee802154_i.h"
+#include "driver-ops.h"
+
+static int mac802154_wpan_update_llsec(struct net_device *dev)
+{
+        struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
+        struct ieee802154_mlme_ops *ops = ieee802154_mlme_ops(dev);
+        int rc = 0;
+
+        if (ops->llsec) {
+                struct ieee802154_llsec_params params;
+                int changed = 0;
+
+                params.pan_id = sdata->pan_id;
+                changed |= IEEE802154_LLSEC_PARAM_PAN_ID;
+
+                params.hwaddr = sdata->extended_addr;
+                changed |= IEEE802154_LLSEC_PARAM_HWADDR;
+
+                rc = ops->llsec->set_params(dev, &params, changed);
+        }
+
+        return rc;
+}
+
+static int
+mac802154_wpan_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
+{
+        struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
+        struct sockaddr_ieee802154 *sa =
+                (struct sockaddr_ieee802154 *)&ifr->ifr_addr;
+        int err = -ENOIOCTLCMD;
+
+        spin_lock_bh(&sdata->mib_lock);
+
+        switch (cmd) {
+        case SIOCGIFADDR:
+        {
+                u16 pan_id, short_addr;
+
+                pan_id = le16_to_cpu(sdata->pan_id);
+                short_addr = le16_to_cpu(sdata->short_addr);
+                if (pan_id == IEEE802154_PANID_BROADCAST ||
+                    short_addr == IEEE802154_ADDR_BROADCAST) {
+                        err = -EADDRNOTAVAIL;
+                        break;
+                }
+
+                sa->family = AF_IEEE802154;
+                sa->addr.addr_type = IEEE802154_ADDR_SHORT;
+                sa->addr.pan_id = pan_id;
+                sa->addr.short_addr = short_addr;
+
+                err = 0;
+                break;
+        }
+        case SIOCSIFADDR:
+                dev_warn(&dev->dev,
+                         "Using DEBUGing ioctl SIOCSIFADDR isn't recommended!\n");
+                if (sa->family != AF_IEEE802154 ||
+                    sa->addr.addr_type != IEEE802154_ADDR_SHORT ||
+                    sa->addr.pan_id == IEEE802154_PANID_BROADCAST ||
+                    sa->addr.short_addr == IEEE802154_ADDR_BROADCAST ||
+                    sa->addr.short_addr == IEEE802154_ADDR_UNDEF) {
+                        err = -EINVAL;
+                        break;
+                }
+
+                sdata->pan_id = cpu_to_le16(sa->addr.pan_id);
+                sdata->short_addr = cpu_to_le16(sa->addr.short_addr);
+
+                err = mac802154_wpan_update_llsec(dev);
+                break;
+        }
+
+        spin_unlock_bh(&sdata->mib_lock);
+        return err;
+}
+
+static int mac802154_wpan_mac_addr(struct net_device *dev, void *p)
+{
+        struct sockaddr *addr = p;
+
+        if (netif_running(dev))
+                return -EBUSY;
+
+        /* FIXME: validate addr */
+        memcpy(dev->dev_addr, addr->sa_data, dev->addr_len);
+        mac802154_dev_set_ieee_addr(dev);
+        return mac802154_wpan_update_llsec(dev);
+}
+
+int mac802154_set_mac_params(struct net_device *dev,
+                             const struct ieee802154_mac_params *params)
+{
+        struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
+
+        mutex_lock(&sdata->local->iflist_mtx);
+        sdata->mac_params = *params;
+        mutex_unlock(&sdata->local->iflist_mtx);
+
+        return 0;
+}
+
+void mac802154_get_mac_params(struct net_device *dev,
+                              struct ieee802154_mac_params *params)
+{
+        struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
+
+        mutex_lock(&sdata->local->iflist_mtx);
+        *params = sdata->mac_params;
+        mutex_unlock(&sdata->local->iflist_mtx);
+}
+
+static int mac802154_slave_open(struct net_device *dev)
+{
+        struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
+        struct ieee802154_sub_if_data *subif;
+        struct ieee802154_local *local = sdata->local;
+        int res = 0;
+
+        ASSERT_RTNL();
+
+        if (sdata->type == IEEE802154_DEV_WPAN) {
+                mutex_lock(&sdata->local->iflist_mtx);
+                list_for_each_entry(subif, &sdata->local->interfaces, list) {
+                        if (subif != sdata && subif->type == sdata->type &&
+                            ieee802154_sdata_running(subif)) {
+                                mutex_unlock(&sdata->local->iflist_mtx);
+                                return -EBUSY;
+                        }
+                }
+                mutex_unlock(&sdata->local->iflist_mtx);
+        }
+
+        set_bit(SDATA_STATE_RUNNING, &sdata->state);
+
+        if (!local->open_count) {
+                res = drv_start(local);
+                WARN_ON(res);
+                if (res)
+                        goto err;
+        }
+
+        local->open_count++;
+        netif_start_queue(dev);
+        return 0;
+err:
+        /* might already be clear but that doesn't matter */
+        clear_bit(SDATA_STATE_RUNNING, &sdata->state);
+
+        return res;
+}
+
+static int mac802154_wpan_open(struct net_device *dev)
+{
+        int rc;
+        struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
+        struct ieee802154_local *local = sdata->local;
+        struct wpan_phy *phy = sdata->local->phy;
+
+        rc = mac802154_slave_open(dev);
+        if (rc < 0)
+                return rc;
+
+        mutex_lock(&phy->pib_lock);
+
+        if (local->hw.flags & IEEE802154_HW_PROMISCUOUS) {
+                rc = drv_set_promiscuous_mode(local, sdata->promisuous_mode);
+                if (rc < 0)
+                        goto out;
+        }
+
+        if (local->hw.flags & IEEE802154_HW_TXPOWER) {
+                rc = drv_set_tx_power(local, sdata->mac_params.transmit_power);
+                if (rc < 0)
+                        goto out;
+        }
+
+        if (local->hw.flags & IEEE802154_HW_LBT) {
+                rc = drv_set_lbt_mode(local, sdata->mac_params.lbt);
+                if (rc < 0)
+                        goto out;
+        }
+
+        if (local->hw.flags & IEEE802154_HW_CCA_MODE) {
+                rc = drv_set_cca_mode(local, sdata->mac_params.cca_mode);
+                if (rc < 0)
+                        goto out;
+        }
+
+        if (local->hw.flags & IEEE802154_HW_CCA_ED_LEVEL) {
+                rc = drv_set_cca_ed_level(local,
+                                          sdata->mac_params.cca_ed_level);
+                if (rc < 0)
+                        goto out;
+        }
+
+        if (local->hw.flags & IEEE802154_HW_CSMA_PARAMS) {
+                rc = drv_set_csma_params(local, sdata->mac_params.min_be,
+                                         sdata->mac_params.max_be,
+                                         sdata->mac_params.csma_retries);
+                if (rc < 0)
+                        goto out;
+        }
+
+        if (local->hw.flags & IEEE802154_HW_FRAME_RETRIES) {
+                rc = drv_set_max_frame_retries(local,
+                                               sdata->mac_params.frame_retries);
+                if (rc < 0)
+                        goto out;
+        }
+
+        mutex_unlock(&phy->pib_lock);
+        return 0;
+
+out:
+        mutex_unlock(&phy->pib_lock);
+        return rc;
+}
+
+static int mac802154_slave_close(struct net_device *dev)
+{
+        struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
+        struct ieee802154_local *local = sdata->local;
+
+        ASSERT_RTNL();
+
+        netif_stop_queue(dev);
+        local->open_count--;
+
+        clear_bit(SDATA_STATE_RUNNING, &sdata->state);
+
+        if (!local->open_count)
+                drv_stop(local);
+
+        return 0;
+}
+
+static int mac802154_set_header_security(struct ieee802154_sub_if_data *sdata,
+                                         struct ieee802154_hdr *hdr,
+                                         const struct ieee802154_mac_cb *cb)
+{
+        struct ieee802154_llsec_params params;
+        u8 level;
+
+        mac802154_llsec_get_params(&sdata->sec, &params);
+
+        if (!params.enabled && cb->secen_override && cb->secen)
+                return -EINVAL;
+        if (!params.enabled ||
+            (cb->secen_override && !cb->secen) ||
+            !params.out_level)
+                return 0;
+        if (cb->seclevel_override && !cb->seclevel)
+                return -EINVAL;
+
+        level = cb->seclevel_override ? cb->seclevel : params.out_level;
+
+        hdr->fc.security_enabled = 1;
+        hdr->sec.level = level;
+        hdr->sec.key_id_mode = params.out_key.mode;
+        if (params.out_key.mode == IEEE802154_SCF_KEY_SHORT_INDEX)
+                hdr->sec.short_src = params.out_key.short_source;
+        else if (params.out_key.mode == IEEE802154_SCF_KEY_HW_INDEX)
+                hdr->sec.extended_src = params.out_key.extended_source;
+        hdr->sec.key_id = params.out_key.id;
+
+        return 0;
+}
+
+static int mac802154_header_create(struct sk_buff *skb,
+                                   struct net_device *dev,
+                                   unsigned short type,
+                                   const void *daddr,
+                                   const void *saddr,
+                                   unsigned len)
+{
+        struct ieee802154_hdr hdr;
+        struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
+        struct ieee802154_mac_cb *cb = mac_cb(skb);
+        int hlen;
+
+        if (!daddr)
+                return -EINVAL;
+
+        memset(&hdr.fc, 0, sizeof(hdr.fc));
+        hdr.fc.type = cb->type;
+        hdr.fc.security_enabled = cb->secen;
+        hdr.fc.ack_request = cb->ackreq;
+        hdr.seq = ieee802154_mlme_ops(dev)->get_dsn(dev);
+
+        if (mac802154_set_header_security(sdata, &hdr, cb) < 0)
+                return -EINVAL;
+
+        if (!saddr) {
+                spin_lock_bh(&sdata->mib_lock);
+
+                if (sdata->short_addr == cpu_to_le16(IEEE802154_ADDR_BROADCAST) ||
+                    sdata->short_addr == cpu_to_le16(IEEE802154_ADDR_UNDEF) ||
+                    sdata->pan_id == cpu_to_le16(IEEE802154_PANID_BROADCAST)) {
+                        hdr.source.mode = IEEE802154_ADDR_LONG;
+                        hdr.source.extended_addr = sdata->extended_addr;
+                } else {
+                        hdr.source.mode = IEEE802154_ADDR_SHORT;
+                        hdr.source.short_addr = sdata->short_addr;
+                }
+
+                hdr.source.pan_id = sdata->pan_id;
+
+                spin_unlock_bh(&sdata->mib_lock);
+        } else {
+                hdr.source = *(const struct ieee802154_addr *)saddr;
+        }
+
+        hdr.dest = *(const struct ieee802154_addr *)daddr;
+
+        hlen = ieee802154_hdr_push(skb, &hdr);
+        if (hlen < 0)
+                return -EINVAL;
+
+        skb_reset_mac_header(skb);
+        skb->mac_len = hlen;
+
+        if (len > ieee802154_max_payload(&hdr))
+                return -EMSGSIZE;
+
+        return hlen;
+}
+
+static int
+mac802154_header_parse(const struct sk_buff *skb, unsigned char *haddr)
+{
+        struct ieee802154_hdr hdr;
+        struct ieee802154_addr *addr = (struct ieee802154_addr *)haddr;
+
+        if (ieee802154_hdr_peek_addrs(skb, &hdr) < 0) {
+                pr_debug("malformed packet\n");
+                return 0;
+        }
+
+        *addr = hdr.source;
+        return sizeof(*addr);
+}
+
+static struct header_ops mac802154_header_ops = {
+        .create         = mac802154_header_create,
+        .parse          = mac802154_header_parse,
+};
+
+static const struct net_device_ops mac802154_wpan_ops = {
+        .ndo_open               = mac802154_wpan_open,
+        .ndo_stop               = mac802154_slave_close,
+        .ndo_start_xmit         = ieee802154_subif_start_xmit,
+        .ndo_do_ioctl           = mac802154_wpan_ioctl,
+        .ndo_set_mac_address    = mac802154_wpan_mac_addr,
+};
+
+static const struct net_device_ops mac802154_monitor_ops = {
+        .ndo_open               = mac802154_wpan_open,
+        .ndo_stop               = mac802154_slave_close,
+        .ndo_start_xmit         = ieee802154_monitor_start_xmit,
+};
+
+static void mac802154_wpan_free(struct net_device *dev)
+{
+        struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
+
+        mac802154_llsec_destroy(&sdata->sec);
+
+        free_netdev(dev);
+}
+
+void mac802154_wpan_setup(struct net_device *dev)
+{
+        struct ieee802154_sub_if_data *sdata;
+
+        dev->addr_len           = IEEE802154_ADDR_LEN;
+        memset(dev->broadcast, 0xff, IEEE802154_ADDR_LEN);
+
+        dev->hard_header_len    = MAC802154_FRAME_HARD_HEADER_LEN;
+        dev->header_ops         = &mac802154_header_ops;
+        dev->needed_tailroom    = 2 + 16; /* FCS + MIC */
+        dev->mtu                = IEEE802154_MTU;
+        dev->tx_queue_len       = 300;
+        dev->type               = ARPHRD_IEEE802154;
+        dev->flags              = IFF_NOARP | IFF_BROADCAST;
+
+        dev->destructor         = mac802154_wpan_free;
+        dev->netdev_ops         = &mac802154_wpan_ops;
+        dev->ml_priv            = &mac802154_mlme_wpan;
+
+        sdata = IEEE802154_DEV_TO_SUB_IF(dev);
+        sdata->type = IEEE802154_DEV_WPAN;
+
+        spin_lock_init(&sdata->mib_lock);
+        mutex_init(&sdata->sec_mtx);
+
+        get_random_bytes(&sdata->bsn, 1);
+        get_random_bytes(&sdata->dsn, 1);
+
+        /* defaults per 802.15.4-2011 */
+        sdata->mac_params.min_be = 3;
+        sdata->mac_params.max_be = 5;
+        sdata->mac_params.csma_retries = 4;
+        /* for compatibility, actual default is 3 */
+        sdata->mac_params.frame_retries = -1;
+
+        sdata->pan_id = cpu_to_le16(IEEE802154_PANID_BROADCAST);
+        sdata->short_addr = cpu_to_le16(IEEE802154_ADDR_BROADCAST);
+
+        sdata->promisuous_mode = false;
+
+        mac802154_llsec_init(&sdata->sec);
+}
+
+void mac802154_monitor_setup(struct net_device *dev)
+{
+        struct ieee802154_sub_if_data *sdata;
+
+        dev->needed_tailroom    = 2; /* room for FCS */
+        dev->mtu                = IEEE802154_MTU;
+        dev->tx_queue_len       = 10;
+        dev->type               = ARPHRD_IEEE802154_MONITOR;
+        dev->flags              = IFF_NOARP | IFF_BROADCAST;
+
+        dev->destructor         = free_netdev;
+        dev->netdev_ops         = &mac802154_monitor_ops;
+        dev->ml_priv            = &mac802154_mlme_reduced;
+
+        sdata = IEEE802154_DEV_TO_SUB_IF(dev);
+        sdata->type = IEEE802154_DEV_MONITOR;
+
+        sdata->promisuous_mode = true;
+}
diff --git a/net/mac802154/llsec.c b/net/mac802154/llsec.c
index 457058142098..fa0d5237c2e0 100644
--- a/net/mac802154/llsec.c
+++ b/net/mac802154/llsec.c
@@ -17,10 +17,10 @@
 #include <linux/err.h>
 #include <linux/bug.h>
 #include <linux/completion.h>
-#include <net/ieee802154.h>
+#include <linux/ieee802154.h>
 #include <crypto/algapi.h>
 
-#include "mac802154.h"
+#include "ieee802154_i.h"
 #include "llsec.h"
 
 static void llsec_key_put(struct mac802154_llsec_key *key);
diff --git a/net/mac802154/mac_cmd.c b/net/mac802154/mac_cmd.c
index bf809131eef7..fc261ab33347 100644
--- a/net/mac802154/mac_cmd.c
+++ b/net/mac802154/mac_cmd.c
@@ -12,10 +12,6 @@
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
- * You should have received a copy of the GNU General Public License along
- * with this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
- *
  * Written by:
  * Sergey Lapin <slapin@ossfans.org>
  * Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
@@ -24,14 +20,14 @@
 
 #include <linux/skbuff.h>
 #include <linux/if_arp.h>
+#include <linux/ieee802154.h>
 
-#include <net/ieee802154.h>
 #include <net/ieee802154_netdev.h>
-#include <net/wpan-phy.h>
+#include <net/cfg802154.h>
 #include <net/mac802154.h>
 #include <net/nl802154.h>
 
-#include "mac802154.h"
+#include "ieee802154_i.h"
 
 static int mac802154_mlme_start_req(struct net_device *dev,
                                     struct ieee802154_addr *addr,
@@ -79,11 +75,33 @@ static int mac802154_mlme_start_req(struct net_device *dev,
 
 static struct wpan_phy *mac802154_get_phy(const struct net_device *dev)
 {
-        struct mac802154_sub_if_data *priv = netdev_priv(dev);
+        struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
 
         BUG_ON(dev->type != ARPHRD_IEEE802154);
 
-        return to_phy(get_device(&priv->hw->phy->dev));
+        return to_phy(get_device(&sdata->local->phy->dev));
+}
+
+static int mac802154_set_mac_params(struct net_device *dev,
+                                    const struct ieee802154_mac_params *params)
+{
+        struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
+
+        mutex_lock(&sdata->local->iflist_mtx);
+        sdata->mac_params = *params;
+        mutex_unlock(&sdata->local->iflist_mtx);
+
+        return 0;
+}
+
+static void mac802154_get_mac_params(struct net_device *dev,
+                                     struct ieee802154_mac_params *params)
+{
+        struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
+
+        mutex_lock(&sdata->local->iflist_mtx);
+        *params = sdata->mac_params;
+        mutex_unlock(&sdata->local->iflist_mtx);
 }
 
 static struct ieee802154_llsec_ops mac802154_llsec_ops = {
diff --git a/net/mac802154/main.c b/net/mac802154/main.c
new file mode 100644
index 000000000000..86e533ed3775
--- /dev/null
+++ b/net/mac802154/main.c
@@ -0,0 +1,265 @@
+/*
+ * Copyright (C) 2007-2012 Siemens AG
+ *
+ * Written by:
+ * Alexander Smirnov <alex.bluesman.smirnov@gmail.com>
+ *
+ * Based on the code from 'linux-zigbee.sourceforge.net' project.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/netdevice.h>
+
+#include <net/netlink.h>
+#include <linux/nl802154.h>
+#include <net/mac802154.h>
+#include <net/ieee802154_netdev.h>
+#include <net/route.h>
+#include <net/cfg802154.h>
+
+#include "ieee802154_i.h"
+
+static int
+mac802154_netdev_register(struct wpan_phy *phy, struct net_device *dev)
+{
+        struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
+        struct ieee802154_local *local;
+        int err;
+
+        local = wpan_phy_priv(phy);
+
+        sdata->dev = dev;
+        sdata->local = local;
+
+        dev->needed_headroom = local->hw.extra_tx_headroom;
+
+        SET_NETDEV_DEV(dev, &local->phy->dev);
+
+        err = register_netdev(dev);
+        if (err < 0)
+                return err;
+
+        rtnl_lock();
+        mutex_lock(&local->iflist_mtx);
+        list_add_tail_rcu(&sdata->list, &local->interfaces);
+        mutex_unlock(&local->iflist_mtx);
+        rtnl_unlock();
+
+        return 0;
+}
+
+static void
+mac802154_del_iface(struct wpan_phy *phy, struct net_device *dev)
+{
+        struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
+
+        ASSERT_RTNL();
+
+        BUG_ON(sdata->local->phy != phy);
+
+        mutex_lock(&sdata->local->iflist_mtx);
+        list_del_rcu(&sdata->list);
+        mutex_unlock(&sdata->local->iflist_mtx);
+
+        synchronize_rcu();
+        unregister_netdevice(sdata->dev);
+}
+
+static struct net_device *
+mac802154_add_iface(struct wpan_phy *phy, const char *name, int type)
+{
+        struct net_device *dev;
+        int err = -ENOMEM;
+
+        switch (type) {
+        case IEEE802154_DEV_MONITOR:
+                dev = alloc_netdev(sizeof(struct ieee802154_sub_if_data),
+                                   name, NET_NAME_UNKNOWN,
+                                   mac802154_monitor_setup);
+                break;
+        case IEEE802154_DEV_WPAN:
+                dev = alloc_netdev(sizeof(struct ieee802154_sub_if_data),
+                                   name, NET_NAME_UNKNOWN,
+                                   mac802154_wpan_setup);
+                break;
+        default:
+                dev = NULL;
+                err = -EINVAL;
+                break;
+        }
+        if (!dev)
+                goto err;
+
+        err = mac802154_netdev_register(phy, dev);
+        if (err)
+                goto err_free;
+
+        dev_hold(dev); /* we return an incremented device refcount */
+        return dev;
+
+err_free:
+        free_netdev(dev);
+err:
+        return ERR_PTR(err);
+}
+
+static void ieee802154_tasklet_handler(unsigned long data)
+{
+        struct ieee802154_local *local = (struct ieee802154_local *)data;
+        struct sk_buff *skb;
+
+        while ((skb = skb_dequeue(&local->skb_queue))) {
+                switch (skb->pkt_type) {
+                case IEEE802154_RX_MSG:
+                        /* Clear skb->pkt_type in order to not confuse kernel
+                         * netstack.
+                         */
+                        skb->pkt_type = 0;
+                        ieee802154_rx(&local->hw, skb);
+                        break;
+                default:
+                        WARN(1, "mac802154: Packet is of unknown type %d\n",
+                             skb->pkt_type);
+                        kfree_skb(skb);
+                        break;
+                }
+        }
+}
+
+struct ieee802154_hw *
+ieee802154_alloc_hw(size_t priv_data_len, const struct ieee802154_ops *ops)
+{
+        struct wpan_phy *phy;
+        struct ieee802154_local *local;
+        size_t priv_size;
+
+        if (!ops || !(ops->xmit_async || ops->xmit_sync) || !ops->ed ||
+            !ops->start || !ops->stop || !ops->set_channel) {
+                pr_err("undefined IEEE802.15.4 device operations\n");
+                return NULL;
+        }
+
+        /* Ensure 32-byte alignment of our private data and hw private data.
+         * We use the wpan_phy priv data for both our ieee802154_local and for
+         * the driver's private data
+         *
+         * in memory it'll be like this:
+         *
+         * +-------------------------+
+         * | struct wpan_phy         |
+         * +-------------------------+
+         * | struct ieee802154_local |
+         * +-------------------------+
+         * | driver's private data   |
+         * +-------------------------+
+         *
+         * Due to ieee802154 layer isn't aware of driver and MAC structures,
+         * so lets align them here.
+         */
+
+        priv_size = ALIGN(sizeof(*local), NETDEV_ALIGN) + priv_data_len;
+
+        phy = wpan_phy_alloc(priv_size);
+        if (!phy) {
+                pr_err("failure to allocate master IEEE802.15.4 device\n");
+                return NULL;
+        }
+
+        local = wpan_phy_priv(phy);
+        local->phy = phy;
+        local->hw.phy = local->phy;
+        local->hw.priv = (char *)local + ALIGN(sizeof(*local), NETDEV_ALIGN);
+        local->ops = ops;
+
+        INIT_LIST_HEAD(&local->interfaces);
+        mutex_init(&local->iflist_mtx);
+
+        tasklet_init(&local->tasklet,
+                     ieee802154_tasklet_handler,
+                     (unsigned long)local);
+
+        skb_queue_head_init(&local->skb_queue);
+
+        return &local->hw;
+}
+EXPORT_SYMBOL(ieee802154_alloc_hw);
+
+void ieee802154_free_hw(struct ieee802154_hw *hw)
+{
+        struct ieee802154_local *local = hw_to_local(hw);
+
+        BUG_ON(!list_empty(&local->interfaces));
+
+        mutex_destroy(&local->iflist_mtx);
+
+        wpan_phy_free(local->phy);
+}
+EXPORT_SYMBOL(ieee802154_free_hw);
+
+int ieee802154_register_hw(struct ieee802154_hw *hw)
+{
+        struct ieee802154_local *local = hw_to_local(hw);
+        int rc = -ENOSYS;
+
+        local->workqueue =
+                create_singlethread_workqueue(wpan_phy_name(local->phy));
+        if (!local->workqueue) {
+                rc = -ENOMEM;
+                goto out;
+        }
+
+        wpan_phy_set_dev(local->phy, local->hw.parent);
+
+        local->phy->add_iface = mac802154_add_iface;
+        local->phy->del_iface = mac802154_del_iface;
+
+        rc = wpan_phy_register(local->phy);
+        if (rc < 0)
+                goto out_wq;
+
+        return 0;
+
+out_wq:
+        destroy_workqueue(local->workqueue);
+out:
+        return rc;
+}
+EXPORT_SYMBOL(ieee802154_register_hw);
+
+void ieee802154_unregister_hw(struct ieee802154_hw *hw)
+{
+        struct ieee802154_local *local = hw_to_local(hw);
+        struct ieee802154_sub_if_data *sdata, *next;
+
+        tasklet_kill(&local->tasklet);
+        flush_workqueue(local->workqueue);
+        destroy_workqueue(local->workqueue);
+
+        rtnl_lock();
+
+        list_for_each_entry_safe(sdata, next, &local->interfaces, list) {
+                mutex_lock(&sdata->local->iflist_mtx);
+                list_del(&sdata->list);
+                mutex_unlock(&sdata->local->iflist_mtx);
+
+                unregister_netdevice(sdata->dev);
+        }
+
+        rtnl_unlock();
+
+        wpan_phy_unregister(local->phy);
+}
+EXPORT_SYMBOL(ieee802154_unregister_hw);
+
+MODULE_DESCRIPTION("IEEE 802.15.4 implementation");
+MODULE_LICENSE("GPL v2");
diff --git a/net/mac802154/mib.c b/net/mac802154/mib.c
index 868a040fd422..0184fced2f62 100644
--- a/net/mac802154/mib.c
+++ b/net/mac802154/mib.c
@@ -10,10 +10,6 @@
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
- * You should have received a copy of the GNU General Public License along
- * with this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
- *
  * Written by:
  * Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
  * Sergey Lapin <slapin@ossfans.org>
@@ -25,14 +21,10 @@
 
 #include <net/mac802154.h>
 #include <net/ieee802154_netdev.h>
-#include <net/wpan-phy.h>
-
-#include "mac802154.h"
+#include <net/cfg802154.h>
 
-struct phy_chan_notify_work {
-        struct work_struct work;
-        struct net_device *dev;
-};
+#include "ieee802154_i.h"
+#include "driver-ops.h"
 
 struct hw_addr_filt_notify_work {
         struct work_struct work;
@@ -40,25 +32,24 @@ struct hw_addr_filt_notify_work {
         unsigned long changed;
 };
 
-static struct mac802154_priv *mac802154_slave_get_priv(struct net_device *dev)
+static struct ieee802154_local *mac802154_slave_get_priv(struct net_device *dev)
 {
-        struct mac802154_sub_if_data *priv = netdev_priv(dev);
+        struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
 
         BUG_ON(dev->type != ARPHRD_IEEE802154);
 
-        return priv->hw;
+        return sdata->local;
 }
 
 static void hw_addr_notify(struct work_struct *work)
 {
         struct hw_addr_filt_notify_work *nw = container_of(work,
                         struct hw_addr_filt_notify_work, work);
-        struct mac802154_priv *hw = mac802154_slave_get_priv(nw->dev);
+        struct ieee802154_local *local = mac802154_slave_get_priv(nw->dev);
         int res;
 
-        res = hw->ops->set_hw_addr_filt(&hw->hw,
-                                        &hw->hw.hw_filt,
-                                        nw->changed);
+        res = local->ops->set_hw_addr_filt(&local->hw, &local->hw.hw_filt,
+                                           nw->changed);
         if (res)
                 pr_debug("failed changed mask %lx\n", nw->changed);
 
@@ -67,7 +58,7 @@ static void hw_addr_notify(struct work_struct *work)
 
 static void set_hw_addr_filt(struct net_device *dev, unsigned long changed)
 {
-        struct mac802154_sub_if_data *priv = netdev_priv(dev);
+        struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
         struct hw_addr_filt_notify_work *work;
 
         work = kzalloc(sizeof(*work), GFP_ATOMIC);
@@ -77,141 +68,110 @@ static void set_hw_addr_filt(struct net_device *dev, unsigned long changed)
         INIT_WORK(&work->work, hw_addr_notify);
         work->dev = dev;
         work->changed = changed;
-        queue_work(priv->hw->dev_workqueue, &work->work);
+        queue_work(sdata->local->workqueue, &work->work);
 }
 
 void mac802154_dev_set_short_addr(struct net_device *dev, __le16 val)
 {
-        struct mac802154_sub_if_data *priv = netdev_priv(dev);
+        struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
 
         BUG_ON(dev->type != ARPHRD_IEEE802154);
 
-        spin_lock_bh(&priv->mib_lock);
-        priv->short_addr = val;
-        spin_unlock_bh(&priv->mib_lock);
+        spin_lock_bh(&sdata->mib_lock);
+        sdata->short_addr = val;
+        spin_unlock_bh(&sdata->mib_lock);
 
-        if ((priv->hw->ops->set_hw_addr_filt) &&
-            (priv->hw->hw.hw_filt.short_addr != priv->short_addr)) {
-                priv->hw->hw.hw_filt.short_addr = priv->short_addr;
-                set_hw_addr_filt(dev, IEEE802515_AFILT_SADDR_CHANGED);
+        if ((sdata->local->ops->set_hw_addr_filt) &&
+            (sdata->local->hw.hw_filt.short_addr != sdata->short_addr)) {
+                sdata->local->hw.hw_filt.short_addr = sdata->short_addr;
+                set_hw_addr_filt(dev, IEEE802154_AFILT_SADDR_CHANGED);
         }
 }
 
 __le16 mac802154_dev_get_short_addr(const struct net_device *dev)
 {
-        struct mac802154_sub_if_data *priv = netdev_priv(dev);
+        struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
         __le16 ret;
 
         BUG_ON(dev->type != ARPHRD_IEEE802154);
 
-        spin_lock_bh(&priv->mib_lock);
-        ret = priv->short_addr;
-        spin_unlock_bh(&priv->mib_lock);
+        spin_lock_bh(&sdata->mib_lock);
+        ret = sdata->short_addr;
+        spin_unlock_bh(&sdata->mib_lock);
 
         return ret;
 }
 
 void mac802154_dev_set_ieee_addr(struct net_device *dev)
 {
-        struct mac802154_sub_if_data *priv = netdev_priv(dev);
-        struct mac802154_priv *mac = priv->hw;
+        struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
+        struct ieee802154_local *local = sdata->local;
 
-        priv->extended_addr = ieee802154_devaddr_from_raw(dev->dev_addr);
+        sdata->extended_addr = ieee802154_devaddr_from_raw(dev->dev_addr);
 
-        if (mac->ops->set_hw_addr_filt &&
-            mac->hw.hw_filt.ieee_addr != priv->extended_addr) {
-                mac->hw.hw_filt.ieee_addr = priv->extended_addr;
-                set_hw_addr_filt(dev, IEEE802515_AFILT_IEEEADDR_CHANGED);
+        if (local->ops->set_hw_addr_filt &&
+            local->hw.hw_filt.ieee_addr != sdata->extended_addr) {
+                local->hw.hw_filt.ieee_addr = sdata->extended_addr;
+                set_hw_addr_filt(dev, IEEE802154_AFILT_IEEEADDR_CHANGED);
         }
 }
 
 __le16 mac802154_dev_get_pan_id(const struct net_device *dev)
 {
-        struct mac802154_sub_if_data *priv = netdev_priv(dev);
+        struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
         __le16 ret;
 
         BUG_ON(dev->type != ARPHRD_IEEE802154);
 
-        spin_lock_bh(&priv->mib_lock);
-        ret = priv->pan_id;
-        spin_unlock_bh(&priv->mib_lock);
+        spin_lock_bh(&sdata->mib_lock);
+        ret = sdata->pan_id;
+        spin_unlock_bh(&sdata->mib_lock);
 
         return ret;
 }
 
 void mac802154_dev_set_pan_id(struct net_device *dev, __le16 val)
 {
-        struct mac802154_sub_if_data *priv = netdev_priv(dev);
+        struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
 
         BUG_ON(dev->type != ARPHRD_IEEE802154);
 
-        spin_lock_bh(&priv->mib_lock);
-        priv->pan_id = val;
-        spin_unlock_bh(&priv->mib_lock);
+        spin_lock_bh(&sdata->mib_lock);
+        sdata->pan_id = val;
+        spin_unlock_bh(&sdata->mib_lock);
 
-        if ((priv->hw->ops->set_hw_addr_filt) &&
-            (priv->hw->hw.hw_filt.pan_id != priv->pan_id)) {
-                priv->hw->hw.hw_filt.pan_id = priv->pan_id;
-                set_hw_addr_filt(dev, IEEE802515_AFILT_PANID_CHANGED);
+        if ((sdata->local->ops->set_hw_addr_filt) &&
+            (sdata->local->hw.hw_filt.pan_id != sdata->pan_id)) {
+                sdata->local->hw.hw_filt.pan_id = sdata->pan_id;
+                set_hw_addr_filt(dev, IEEE802154_AFILT_PANID_CHANGED);
         }
 }
 
 u8 mac802154_dev_get_dsn(const struct net_device *dev)
 {
-        struct mac802154_sub_if_data *priv = netdev_priv(dev);
+        struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
 
         BUG_ON(dev->type != ARPHRD_IEEE802154);
 
-        return priv->dsn++;
-}
-
-static void phy_chan_notify(struct work_struct *work)
-{
-        struct phy_chan_notify_work *nw = container_of(work,
-                                          struct phy_chan_notify_work, work);
-        struct mac802154_priv *hw = mac802154_slave_get_priv(nw->dev);
-        struct mac802154_sub_if_data *priv = netdev_priv(nw->dev);
-        int res;
-
-        mutex_lock(&priv->hw->phy->pib_lock);
-        res = hw->ops->set_channel(&hw->hw, priv->page, priv->chan);
-        if (res) {
-                pr_debug("set_channel failed\n");
-        } else {
-                priv->hw->phy->current_channel = priv->chan;
-                priv->hw->phy->current_page = priv->page;
-        }
-        mutex_unlock(&priv->hw->phy->pib_lock);
-
-        kfree(nw);
+        return sdata->dsn++;
 }
 
 void mac802154_dev_set_page_channel(struct net_device *dev, u8 page, u8 chan)
 {
-        struct mac802154_sub_if_data *priv = netdev_priv(dev);
-        struct phy_chan_notify_work *work;
+        struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
+        struct ieee802154_local *local = sdata->local;
+        int res;
 
         BUG_ON(dev->type != ARPHRD_IEEE802154);
 
-        spin_lock_bh(&priv->mib_lock);
-        priv->page = page;
-        priv->chan = chan;
-        spin_unlock_bh(&priv->mib_lock);
-
-        mutex_lock(&priv->hw->phy->pib_lock);
-        if (priv->hw->phy->current_channel != priv->chan ||
-            priv->hw->phy->current_page != priv->page) {
-                mutex_unlock(&priv->hw->phy->pib_lock);
-
-                work = kzalloc(sizeof(*work), GFP_ATOMIC);
-                if (!work)
-                        return;
-
-                INIT_WORK(&work->work, phy_chan_notify);
-                work->dev = dev;
-                queue_work(priv->hw->dev_workqueue, &work->work);
+        res = drv_set_channel(local, page, chan);
+        if (res) {
+                pr_debug("set_channel failed\n");
         } else {
-                mutex_unlock(&priv->hw->phy->pib_lock);
+                mutex_lock(&local->phy->pib_lock);
+                local->phy->current_channel = chan;
+                local->phy->current_page = page;
+                mutex_unlock(&local->phy->pib_lock);
         }
 }
 
@@ -219,14 +179,14 @@ void mac802154_dev_set_page_channel(struct net_device *dev, u8 page, u8 chan)
 int mac802154_get_params(struct net_device *dev,
                          struct ieee802154_llsec_params *params)
 {
-        struct mac802154_sub_if_data *priv = netdev_priv(dev);
+        struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
         int res;
 
         BUG_ON(dev->type != ARPHRD_IEEE802154);
 
-        mutex_lock(&priv->sec_mtx);
-        res = mac802154_llsec_get_params(&priv->sec, params);
-        mutex_unlock(&priv->sec_mtx);
+        mutex_lock(&sdata->sec_mtx);
+        res = mac802154_llsec_get_params(&sdata->sec, params);
+        mutex_unlock(&sdata->sec_mtx);
 
         return res;
 }
@@ -235,14 +195,14 @@ int mac802154_set_params(struct net_device *dev,
                          const struct ieee802154_llsec_params *params,
                          int changed)
 {
-        struct mac802154_sub_if_data *priv = netdev_priv(dev);
+        struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
         int res;
 
         BUG_ON(dev->type != ARPHRD_IEEE802154);
 
-        mutex_lock(&priv->sec_mtx);
-        res = mac802154_llsec_set_params(&priv->sec, params, changed);
-        mutex_unlock(&priv->sec_mtx);
+        mutex_lock(&sdata->sec_mtx);
+        res = mac802154_llsec_set_params(&sdata->sec, params, changed);
+        mutex_unlock(&sdata->sec_mtx);
 
         return res;
 }
@@ -252,14 +212,14 @@ int mac802154_add_key(struct net_device *dev,
                       const struct ieee802154_llsec_key_id *id,
                       const struct ieee802154_llsec_key *key)
 {
-        struct mac802154_sub_if_data *priv = netdev_priv(dev);
+        struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
         int res;
 
         BUG_ON(dev->type != ARPHRD_IEEE802154);
 
-        mutex_lock(&priv->sec_mtx);
-        res = mac802154_llsec_key_add(&priv->sec, id, key);
-        mutex_unlock(&priv->sec_mtx);
+        mutex_lock(&sdata->sec_mtx);
+        res = mac802154_llsec_key_add(&sdata->sec, id, key);
+        mutex_unlock(&sdata->sec_mtx);
 
         return res;
 }
@@ -267,14 +227,14 @@ int mac802154_add_key(struct net_device *dev,
 int mac802154_del_key(struct net_device *dev,
                       const struct ieee802154_llsec_key_id *id)
 {
-        struct mac802154_sub_if_data *priv = netdev_priv(dev);
+        struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
         int res;
 
         BUG_ON(dev->type != ARPHRD_IEEE802154);
 
-        mutex_lock(&priv->sec_mtx);
-        res = mac802154_llsec_key_del(&priv->sec, id);
-        mutex_unlock(&priv->sec_mtx);
+        mutex_lock(&sdata->sec_mtx);
+        res = mac802154_llsec_key_del(&sdata->sec, id);
+        mutex_unlock(&sdata->sec_mtx);
 
         return res;
 }
@@ -283,28 +243,28 @@ int mac802154_del_key(struct net_device *dev,
 int mac802154_add_dev(struct net_device *dev,
                       const struct ieee802154_llsec_device *llsec_dev)
 {
-        struct mac802154_sub_if_data *priv = netdev_priv(dev);
+        struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
         int res;
 
         BUG_ON(dev->type != ARPHRD_IEEE802154);
 
-        mutex_lock(&priv->sec_mtx);
-        res = mac802154_llsec_dev_add(&priv->sec, llsec_dev);
-        mutex_unlock(&priv->sec_mtx);
+        mutex_lock(&sdata->sec_mtx);
+        res = mac802154_llsec_dev_add(&sdata->sec, llsec_dev);
+        mutex_unlock(&sdata->sec_mtx);
 
         return res;
 }
 
 int mac802154_del_dev(struct net_device *dev, __le64 dev_addr)
 {
-        struct mac802154_sub_if_data *priv = netdev_priv(dev);
+        struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
         int res;
 
         BUG_ON(dev->type != ARPHRD_IEEE802154);
 
-        mutex_lock(&priv->sec_mtx);
-        res = mac802154_llsec_dev_del(&priv->sec, dev_addr);
-        mutex_unlock(&priv->sec_mtx);
+        mutex_lock(&sdata->sec_mtx);
+        res = mac802154_llsec_dev_del(&sdata->sec, dev_addr);
+        mutex_unlock(&sdata->sec_mtx);
 
         return res;
 }
@@ -314,14 +274,14 @@ int mac802154_add_devkey(struct net_device *dev,
                          __le64 device_addr,
                          const struct ieee802154_llsec_device_key *key)
 {
-        struct mac802154_sub_if_data *priv = netdev_priv(dev);
+        struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
         int res;
 
         BUG_ON(dev->type != ARPHRD_IEEE802154);
 
-        mutex_lock(&priv->sec_mtx);
-        res = mac802154_llsec_devkey_add(&priv->sec, device_addr, key);
-        mutex_unlock(&priv->sec_mtx);
+        mutex_lock(&sdata->sec_mtx);
+        res = mac802154_llsec_devkey_add(&sdata->sec, device_addr, key);
+        mutex_unlock(&sdata->sec_mtx);
 
         return res;
 }
@@ -330,14 +290,14 @@ int mac802154_del_devkey(struct net_device *dev,
                          __le64 device_addr,
                          const struct ieee802154_llsec_device_key *key)
 {
-        struct mac802154_sub_if_data *priv = netdev_priv(dev);
+        struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
         int res;
 
         BUG_ON(dev->type != ARPHRD_IEEE802154);
 
-        mutex_lock(&priv->sec_mtx);
-        res = mac802154_llsec_devkey_del(&priv->sec, device_addr, key);
-        mutex_unlock(&priv->sec_mtx);
+        mutex_lock(&sdata->sec_mtx);
+        res = mac802154_llsec_devkey_del(&sdata->sec, device_addr, key);
+        mutex_unlock(&sdata->sec_mtx);
 
         return res;
 }
@@ -346,14 +306,14 @@ int mac802154_del_devkey(struct net_device *dev,
 int mac802154_add_seclevel(struct net_device *dev,
                            const struct ieee802154_llsec_seclevel *sl)
 {
-        struct mac802154_sub_if_data *priv = netdev_priv(dev);
+        struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
         int res;
 
         BUG_ON(dev->type != ARPHRD_IEEE802154);
 
-        mutex_lock(&priv->sec_mtx);
-        res = mac802154_llsec_seclevel_add(&priv->sec, sl);
-        mutex_unlock(&priv->sec_mtx);
+        mutex_lock(&sdata->sec_mtx);
+        res = mac802154_llsec_seclevel_add(&sdata->sec, sl);
+        mutex_unlock(&sdata->sec_mtx);
 
         return res;
 }
@@ -361,14 +321,14 @@ int mac802154_add_seclevel(struct net_device *dev,
 int mac802154_del_seclevel(struct net_device *dev,
                            const struct ieee802154_llsec_seclevel *sl)
 {
-        struct mac802154_sub_if_data *priv = netdev_priv(dev);
+        struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
         int res;
 
         BUG_ON(dev->type != ARPHRD_IEEE802154);
 
-        mutex_lock(&priv->sec_mtx);
-        res = mac802154_llsec_seclevel_del(&priv->sec, sl);
-        mutex_unlock(&priv->sec_mtx);
+        mutex_lock(&sdata->sec_mtx);
+        res = mac802154_llsec_seclevel_del(&sdata->sec, sl);
+        mutex_unlock(&sdata->sec_mtx);
 
         return res;
 }
@@ -376,28 +336,28 @@ int mac802154_del_seclevel(struct net_device *dev,
 
 void mac802154_lock_table(struct net_device *dev)
 {
-        struct mac802154_sub_if_data *priv = netdev_priv(dev);
+        struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
 
         BUG_ON(dev->type != ARPHRD_IEEE802154);
 
-        mutex_lock(&priv->sec_mtx);
+        mutex_lock(&sdata->sec_mtx);
 }
 
 void mac802154_get_table(struct net_device *dev,
                          struct ieee802154_llsec_table **t)
 {
-        struct mac802154_sub_if_data *priv = netdev_priv(dev);
+        struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
 
         BUG_ON(dev->type != ARPHRD_IEEE802154);
 
-        *t = &priv->sec.table;
+        *t = &sdata->sec.table;
 }
 
 void mac802154_unlock_table(struct net_device *dev)
 {
-        struct mac802154_sub_if_data *priv = netdev_priv(dev);
+        struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
 
         BUG_ON(dev->type != ARPHRD_IEEE802154);
 
-        mutex_unlock(&priv->sec_mtx);
+        mutex_unlock(&sdata->sec_mtx);
 }
diff --git a/net/mac802154/monitor.c b/net/mac802154/monitor.c
deleted file mode 100644
index a68230e2b25f..000000000000
--- a/net/mac802154/monitor.c
+++ /dev/null
@@ -1,117 +0,0 @@
-/*
- * Copyright 2007, 2008, 2009 Siemens AG
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2
- * as published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
- *
- * Written by:
- * Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
- * Sergey Lapin <slapin@ossfans.org>
- * Maxim Gorbachyov <maxim.gorbachev@siemens.com>
- * Alexander Smirnov <alex.bluesman.smirnov@gmail.com>
- */
-
-#include <linux/netdevice.h>
-#include <linux/skbuff.h>
-#include <linux/if_arp.h>
-#include <linux/crc-ccitt.h>
-
-#include <net/ieee802154.h>
-#include <net/mac802154.h>
-#include <net/netlink.h>
-#include <net/wpan-phy.h>
-#include <linux/nl802154.h>
-
-#include "mac802154.h"
-
-static netdev_tx_t mac802154_monitor_xmit(struct sk_buff *skb,
-                                          struct net_device *dev)
-{
-        struct mac802154_sub_if_data *priv;
-        u8 chan, page;
-
-        priv = netdev_priv(dev);
-
-        /* FIXME: locking */
-        chan = priv->hw->phy->current_channel;
-        page = priv->hw->phy->current_page;
-
-        if (chan == MAC802154_CHAN_NONE) /* not initialized */
-                return NETDEV_TX_OK;
-
-        if (WARN_ON(page >= WPAN_NUM_PAGES) ||
-            WARN_ON(chan >= WPAN_NUM_CHANNELS))
-                return NETDEV_TX_OK;
-
-        skb->skb_iif = dev->ifindex;
-        dev->stats.tx_packets++;
-        dev->stats.tx_bytes += skb->len;
-
-        return mac802154_tx(priv->hw, skb, page, chan);
-}
-
-
-void mac802154_monitors_rx(struct mac802154_priv *priv, struct sk_buff *skb)
-{
-        struct sk_buff *skb2;
-        struct mac802154_sub_if_data *sdata;
-        u16 crc = crc_ccitt(0, skb->data, skb->len);
-        u8 *data;
-
-        rcu_read_lock();
-        list_for_each_entry_rcu(sdata, &priv->slaves, list) {
-                if (sdata->type != IEEE802154_DEV_MONITOR ||
-                    !netif_running(sdata->dev))
-                        continue;
-
-                skb2 = skb_clone(skb, GFP_ATOMIC);
-                skb2->dev = sdata->dev;
-                skb2->pkt_type = PACKET_HOST;
-                data = skb_put(skb2, 2);
-                data[0] = crc & 0xff;
-                data[1] = crc >> 8;
-
-                netif_rx_ni(skb2);
-        }
-        rcu_read_unlock();
-}
-
-static const struct net_device_ops mac802154_monitor_ops = {
-        .ndo_open               = mac802154_slave_open,
-        .ndo_stop               = mac802154_slave_close,
-        .ndo_start_xmit         = mac802154_monitor_xmit,
-};
-
-void mac802154_monitor_setup(struct net_device *dev)
-{
-        struct mac802154_sub_if_data *priv;
-
-        dev->addr_len           = 0;
-        dev->hard_header_len    = 0;
-        dev->needed_tailroom    = 2; /* room for FCS */
-        dev->mtu                = IEEE802154_MTU;
-        dev->tx_queue_len       = 10;
-        dev->type               = ARPHRD_IEEE802154_MONITOR;
-        dev->flags              = IFF_NOARP | IFF_BROADCAST;
-        dev->watchdog_timeo     = 0;
-
-        dev->destructor         = free_netdev;
-        dev->netdev_ops         = &mac802154_monitor_ops;
-        dev->ml_priv            = &mac802154_mlme_reduced;
-
-        priv = netdev_priv(dev);
-        priv->type = IEEE802154_DEV_MONITOR;
-
-        priv->chan = MAC802154_CHAN_NONE; /* not initialized */
-        priv->page = 0;
-}
diff --git a/net/mac802154/rx.c b/net/mac802154/rx.c
index a14cf9ede171..95961cccc253 100644
--- a/net/mac802154/rx.c
+++ b/net/mac802154/rx.c
@@ -10,10 +10,6 @@
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
- * You should have received a copy of the GNU General Public License along
- * with this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
- *
  * Written by:
  * Pavel Smolenskiy <pavel.smolenskiy@gmail.com>
  * Maxim Gorbachyov <maxim.gorbachev@siemens.com>
@@ -23,92 +19,285 @@
 
 #include <linux/kernel.h>
 #include <linux/module.h>
-#include <linux/workqueue.h>
 #include <linux/netdevice.h>
 #include <linux/crc-ccitt.h>
+#include <asm/unaligned.h>
 
 #include <net/mac802154.h>
 #include <net/ieee802154_netdev.h>
+#include <net/rtnetlink.h>
+#include <linux/nl802154.h>
 
-#include "mac802154.h"
+#include "ieee802154_i.h"
 
-/* The IEEE 802.15.4 standard defines 4 MAC packet types:
- * - beacon frame
- * - MAC command frame
- * - acknowledgement frame
- * - data frame
- *
- * and only the data frame should be pushed to the upper layers, other types
- * are just internal MAC layer management information. So only data packets
- * are going to be sent to the networking queue, all other will be processed
- * right here by using the device workqueue.
- */
-struct rx_work {
-        struct sk_buff *skb;
-        struct work_struct work;
-        struct ieee802154_dev *dev;
-        u8 lqi;
-};
+static int ieee802154_deliver_skb(struct sk_buff *skb)
+{
+        skb->ip_summed = CHECKSUM_UNNECESSARY;
+        skb->protocol = htons(ETH_P_IEEE802154);
 
-static void
-mac802154_subif_rx(struct ieee802154_dev *hw, struct sk_buff *skb, u8 lqi)
+        return netif_receive_skb(skb);
+}
+
+static int
+ieee802154_subif_frame(struct ieee802154_sub_if_data *sdata,
+                       struct sk_buff *skb, const struct ieee802154_hdr *hdr)
 {
-        struct mac802154_priv *priv = mac802154_to_priv(hw);
+        __le16 span, sshort;
+        int rc;
 
-        mac_cb(skb)->lqi = lqi;
-        skb->protocol = htons(ETH_P_IEEE802154);
-        skb_reset_mac_header(skb);
+        pr_debug("getting packet via slave interface %s\n", sdata->dev->name);
 
-        if (!(priv->hw.flags & IEEE802154_HW_OMIT_CKSUM)) {
-                u16 crc;
+        spin_lock_bh(&sdata->mib_lock);
 
-                if (skb->len < 2) {
-                        pr_debug("got invalid frame\n");
-                        goto fail;
-                }
-                crc = crc_ccitt(0, skb->data, skb->len);
-                if (crc) {
-                        pr_debug("CRC mismatch\n");
-                        goto fail;
-                }
-                skb_trim(skb, skb->len - 2); /* CRC */
+        span = sdata->pan_id;
+        sshort = sdata->short_addr;
+
+        switch (mac_cb(skb)->dest.mode) {
+        case IEEE802154_ADDR_NONE:
+                if (mac_cb(skb)->dest.mode != IEEE802154_ADDR_NONE)
+                        /* FIXME: check if we are PAN coordinator */
+                        skb->pkt_type = PACKET_OTHERHOST;
+                else
+                        /* ACK comes with both addresses empty */
+                        skb->pkt_type = PACKET_HOST;
+                break;
+        case IEEE802154_ADDR_LONG:
+                if (mac_cb(skb)->dest.pan_id != span &&
+                    mac_cb(skb)->dest.pan_id != cpu_to_le16(IEEE802154_PANID_BROADCAST))
+                        skb->pkt_type = PACKET_OTHERHOST;
+                else if (mac_cb(skb)->dest.extended_addr == sdata->extended_addr)
+                        skb->pkt_type = PACKET_HOST;
+                else
+                        skb->pkt_type = PACKET_OTHERHOST;
+                break;
+        case IEEE802154_ADDR_SHORT:
+                if (mac_cb(skb)->dest.pan_id != span &&
+                    mac_cb(skb)->dest.pan_id != cpu_to_le16(IEEE802154_PANID_BROADCAST))
+                        skb->pkt_type = PACKET_OTHERHOST;
+                else if (mac_cb(skb)->dest.short_addr == sshort)
+                        skb->pkt_type = PACKET_HOST;
+                else if (mac_cb(skb)->dest.short_addr ==
+                          cpu_to_le16(IEEE802154_ADDR_BROADCAST))
+                        skb->pkt_type = PACKET_BROADCAST;
+                else
+                        skb->pkt_type = PACKET_OTHERHOST;
+                break;
+        default:
+                spin_unlock_bh(&sdata->mib_lock);
+                pr_debug("invalid dest mode\n");
+                kfree_skb(skb);
+                return NET_RX_DROP;
         }
 
-        mac802154_monitors_rx(priv, skb);
-        mac802154_wpans_rx(priv, skb);
+        spin_unlock_bh(&sdata->mib_lock);
 
-        return;
+        skb->dev = sdata->dev;
+
+        rc = mac802154_llsec_decrypt(&sdata->sec, skb);
+        if (rc) {
+                pr_debug("decryption failed: %i\n", rc);
+                goto fail;
+        }
+
+        sdata->dev->stats.rx_packets++;
+        sdata->dev->stats.rx_bytes += skb->len;
+
+        switch (mac_cb(skb)->type) {
+        case IEEE802154_FC_TYPE_DATA:
+                return ieee802154_deliver_skb(skb);
+        default:
+                pr_warn("ieee802154: bad frame received (type = %d)\n",
+                        mac_cb(skb)->type);
+                goto fail;
+        }
 
 fail:
         kfree_skb(skb);
+        return NET_RX_DROP;
 }
 
-static void mac802154_rx_worker(struct work_struct *work)
+static void
+ieee802154_print_addr(const char *name, const struct ieee802154_addr *addr)
 {
-        struct rx_work *rw = container_of(work, struct rx_work, work);
+        if (addr->mode == IEEE802154_ADDR_NONE)
+                pr_debug("%s not present\n", name);
+
+        pr_debug("%s PAN ID: %04x\n", name, le16_to_cpu(addr->pan_id));
+        if (addr->mode == IEEE802154_ADDR_SHORT) {
+                pr_debug("%s is short: %04x\n", name,
+                         le16_to_cpu(addr->short_addr));
+        } else {
+                u64 hw = swab64((__force u64)addr->extended_addr);
 
-        mac802154_subif_rx(rw->dev, rw->skb, rw->lqi);
-        kfree(rw);
+                pr_debug("%s is hardware: %8phC\n", name, &hw);
+        }
 }
 
-void
-ieee802154_rx_irqsafe(struct ieee802154_dev *dev, struct sk_buff *skb, u8 lqi)
+static int
+ieee802154_parse_frame_start(struct sk_buff *skb, struct ieee802154_hdr *hdr)
 {
-        struct mac802154_priv *priv = mac802154_to_priv(dev);
-        struct rx_work *work;
+        int hlen;
+        struct ieee802154_mac_cb *cb = mac_cb_init(skb);
 
-        if (!skb)
-                return;
+        skb_reset_mac_header(skb);
+
+        hlen = ieee802154_hdr_pull(skb, hdr);
+        if (hlen < 0)
+                return -EINVAL;
+
+        skb->mac_len = hlen;
+
+        pr_debug("fc: %04x dsn: %02x\n", le16_to_cpup((__le16 *)&hdr->fc),
+                 hdr->seq);
+
+        cb->type = hdr->fc.type;
+        cb->ackreq = hdr->fc.ack_request;
+        cb->secen = hdr->fc.security_enabled;
+
+        ieee802154_print_addr("destination", &hdr->dest);
+        ieee802154_print_addr("source", &hdr->source);
+
+        cb->source = hdr->source;
+        cb->dest = hdr->dest;
+
+        if (hdr->fc.security_enabled) {
+                u64 key;
+
+                pr_debug("seclevel %i\n", hdr->sec.level);
+
+                switch (hdr->sec.key_id_mode) {
+                case IEEE802154_SCF_KEY_IMPLICIT:
+                        pr_debug("implicit key\n");
+                        break;
+
+                case IEEE802154_SCF_KEY_INDEX:
+                        pr_debug("key %02x\n", hdr->sec.key_id);
+                        break;
+
+                case IEEE802154_SCF_KEY_SHORT_INDEX:
+                        pr_debug("key %04x:%04x %02x\n",
+                                 le32_to_cpu(hdr->sec.short_src) >> 16,
+                                 le32_to_cpu(hdr->sec.short_src) & 0xffff,
+                                 hdr->sec.key_id);
+                        break;
+
+                case IEEE802154_SCF_KEY_HW_INDEX:
+                        key = swab64((__force u64)hdr->sec.extended_src);
+                        pr_debug("key source %8phC %02x\n", &key,
+                                 hdr->sec.key_id);
+                        break;
+                }
+        }
+
+        return 0;
+}
+
+static void
+__ieee802154_rx_handle_packet(struct ieee802154_local *local,
+                              struct sk_buff *skb)
+{
+        int ret;
+        struct ieee802154_sub_if_data *sdata;
+        struct ieee802154_hdr hdr;
 
-        work = kzalloc(sizeof(*work), GFP_ATOMIC);
-        if (!work)
+        ret = ieee802154_parse_frame_start(skb, &hdr);
+        if (ret) {
+                pr_debug("got invalid frame\n");
+                kfree_skb(skb);
                 return;
+        }
+
+        list_for_each_entry_rcu(sdata, &local->interfaces, list) {
+                if (sdata->type != IEEE802154_DEV_WPAN ||
+                    !netif_running(sdata->dev))
+                        continue;
+
+                ieee802154_subif_frame(sdata, skb, &hdr);
+                skb = NULL;
+                break;
+        }
+
+        if (skb)
+                kfree_skb(skb);
+}
+
+static void
+ieee802154_monitors_rx(struct ieee802154_local *local, struct sk_buff *skb)
+{
+        struct sk_buff *skb2;
+        struct ieee802154_sub_if_data *sdata;
+
+        skb_reset_mac_header(skb);
+        skb->ip_summed = CHECKSUM_UNNECESSARY;
+        skb->pkt_type = PACKET_OTHERHOST;
+        skb->protocol = htons(ETH_P_IEEE802154);
+
+        list_for_each_entry_rcu(sdata, &local->interfaces, list) {
+                if (sdata->type != IEEE802154_DEV_MONITOR)
+                        continue;
+
+                if (!ieee802154_sdata_running(sdata))
+                        continue;
+
+                skb2 = skb_clone(skb, GFP_ATOMIC);
+                if (skb2) {
+                        skb2->dev = sdata->dev;
+                        ieee802154_deliver_skb(skb2);
+
+                        sdata->dev->stats.rx_packets++;
+                        sdata->dev->stats.rx_bytes += skb->len;
+                }
+        }
+}
+
+void ieee802154_rx(struct ieee802154_hw *hw, struct sk_buff *skb)
+{
+        struct ieee802154_local *local = hw_to_local(hw);
+        u16 crc;
 
-        INIT_WORK(&work->work, mac802154_rx_worker);
-        work->skb = skb;
-        work->dev = dev;
-        work->lqi = lqi;
+        WARN_ON_ONCE(softirq_count() == 0);
 
-        queue_work(priv->dev_workqueue, &work->work);
+        /* TODO: When a transceiver omits the checksum here, we
+         * add an own calculated one. This is currently an ugly
+         * solution because the monitor needs a crc here.
+         */
+        if (local->hw.flags & IEEE802154_HW_RX_OMIT_CKSUM) {
+                crc = crc_ccitt(0, skb->data, skb->len);
+                put_unaligned_le16(crc, skb_put(skb, 2));
+        }
+
+        rcu_read_lock();
+
+        ieee802154_monitors_rx(local, skb);
+
+        /* Check if transceiver doesn't validate the checksum.
+         * If not we validate the checksum here.
+         */
+        if (local->hw.flags & IEEE802154_HW_RX_DROP_BAD_CKSUM) {
+                crc = crc_ccitt(0, skb->data, skb->len);
+                if (crc) {
+                        rcu_read_unlock();
+                        kfree_skb(skb);
+                        return;
+                }
+        }
+        /* remove crc */
+        skb_trim(skb, skb->len - 2);
+
+        __ieee802154_rx_handle_packet(local, skb);
+
+        rcu_read_unlock();
+}
+EXPORT_SYMBOL(ieee802154_rx);
+
+void
+ieee802154_rx_irqsafe(struct ieee802154_hw *hw, struct sk_buff *skb, u8 lqi)
+{
+        struct ieee802154_local *local = hw_to_local(hw);
+
+        mac_cb(skb)->lqi = lqi;
+        skb->pkt_type = IEEE802154_RX_MSG;
+        skb_queue_tail(&local->skb_queue, skb);
+        tasklet_schedule(&local->tasklet);
 }
 EXPORT_SYMBOL(ieee802154_rx_irqsafe);
diff --git a/net/mac802154/tx.c b/net/mac802154/tx.c
index fdf4c0e67259..cc37b77f2632 100644
--- a/net/mac802154/tx.c
+++ b/net/mac802154/tx.c
@@ -10,10 +10,6 @@
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
- * You should have received a copy of the GNU General Public License along
- * with this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
- *
  * Written by:
  * Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
  * Sergey Lapin <slapin@ossfans.org>
@@ -24,106 +20,98 @@
 #include <linux/netdevice.h>
 #include <linux/if_arp.h>
 #include <linux/crc-ccitt.h>
+#include <asm/unaligned.h>
 
+#include <net/rtnetlink.h>
 #include <net/ieee802154_netdev.h>
 #include <net/mac802154.h>
-#include <net/wpan-phy.h>
+#include <net/cfg802154.h>
 
-#include "mac802154.h"
+#include "ieee802154_i.h"
+#include "driver-ops.h"
 
 /* IEEE 802.15.4 transceivers can sleep during the xmit session, so process
  * packets through the workqueue.
  */
-struct xmit_work {
+struct ieee802154_xmit_cb {
         struct sk_buff *skb;
         struct work_struct work;
-        struct mac802154_priv *priv;
-        u8 chan;
-        u8 page;
+        struct ieee802154_local *local;
 };
 
-static void mac802154_xmit_worker(struct work_struct *work)
+static struct ieee802154_xmit_cb ieee802154_xmit_cb;
+
+static void ieee802154_xmit_worker(struct work_struct *work)
 {
-        struct xmit_work *xw = container_of(work, struct xmit_work, work);
-        struct mac802154_sub_if_data *sdata;
+        struct ieee802154_xmit_cb *cb =
+                container_of(work, struct ieee802154_xmit_cb, work);
+        struct ieee802154_local *local = cb->local;
+        struct sk_buff *skb = cb->skb;
+        struct net_device *dev = skb->dev;
         int res;
 
-        mutex_lock(&xw->priv->phy->pib_lock);
-        if (xw->priv->phy->current_channel != xw->chan ||
-            xw->priv->phy->current_page != xw->page) {
-                res = xw->priv->ops->set_channel(&xw->priv->hw,
-                                                  xw->page,
-                                                  xw->chan);
-                if (res) {
-                        pr_debug("set_channel failed\n");
-                        goto out;
-                }
+        rtnl_lock();
 
-                xw->priv->phy->current_channel = xw->chan;
-                xw->priv->phy->current_page = xw->page;
-        }
+        /* check if ifdown occurred while schedule */
+        if (!netif_running(dev))
+                goto err_tx;
 
-        res = xw->priv->ops->xmit(&xw->priv->hw, xw->skb);
+        res = drv_xmit_sync(local, skb);
         if (res)
-                pr_debug("transmission failed\n");
+                goto err_tx;
 
-out:
-        mutex_unlock(&xw->priv->phy->pib_lock);
+        ieee802154_xmit_complete(&local->hw, skb);
 
-        /* Restart the netif queue on each sub_if_data object. */
-        rcu_read_lock();
-        list_for_each_entry_rcu(sdata, &xw->priv->slaves, list)
-                netif_wake_queue(sdata->dev);
-        rcu_read_unlock();
+        dev->stats.tx_packets++;
+        dev->stats.tx_bytes += skb->len;
 
-        dev_kfree_skb(xw->skb);
+        rtnl_unlock();
 
-        kfree(xw);
+        return;
+
+err_tx:
+        /* Restart the netif queue on each sub_if_data object. */
+        ieee802154_wake_queue(&local->hw);
+        rtnl_unlock();
+        kfree_skb(skb);
+        netdev_dbg(dev, "transmission failed\n");
 }
 
-netdev_tx_t mac802154_tx(struct mac802154_priv *priv, struct sk_buff *skb,
-                         u8 page, u8 chan)
+static netdev_tx_t
+ieee802154_tx(struct ieee802154_local *local, struct sk_buff *skb)
 {
-        struct xmit_work *work;
-        struct mac802154_sub_if_data *sdata;
-
-        if (!(priv->phy->channels_supported[page] & (1 << chan))) {
-                WARN_ON(1);
-                goto err_tx;
-        }
-
-        mac802154_monitors_rx(mac802154_to_priv(&priv->hw), skb);
+        struct net_device *dev = skb->dev;
+        int ret;
 
-        if (!(priv->hw.flags & IEEE802154_HW_OMIT_CKSUM)) {
+        if (!(local->hw.flags & IEEE802154_HW_TX_OMIT_CKSUM)) {
                 u16 crc = crc_ccitt(0, skb->data, skb->len);
-                u8 *data = skb_put(skb, 2);
 
-                data[0] = crc & 0xff;
-                data[1] = crc >> 8;
+                put_unaligned_le16(crc, skb_put(skb, 2));
         }
 
-        if (skb_cow_head(skb, priv->hw.extra_tx_headroom))
+        if (skb_cow_head(skb, local->hw.extra_tx_headroom))
                 goto err_tx;
 
-        work = kzalloc(sizeof(*work), GFP_ATOMIC);
-        if (!work) {
-                kfree_skb(skb);
-                return NETDEV_TX_BUSY;
-        }
-
         /* Stop the netif queue on each sub_if_data object. */
-        rcu_read_lock();
-        list_for_each_entry_rcu(sdata, &priv->slaves, list)
-                netif_stop_queue(sdata->dev);
-        rcu_read_unlock();
+        ieee802154_stop_queue(&local->hw);
+
+        /* async is priority, otherwise sync is fallback */
+        if (local->ops->xmit_async) {
+                ret = drv_xmit_async(local, skb);
+                if (ret) {
+                        ieee802154_wake_queue(&local->hw);
+                        goto err_tx;
+                }
 
-        INIT_WORK(&work->work, mac802154_xmit_worker);
-        work->skb = skb;
-        work->priv = priv;
-        work->page = page;
-        work->chan = chan;
+                dev->stats.tx_packets++;
+                dev->stats.tx_bytes += skb->len;
+        } else {
+                INIT_WORK(&ieee802154_xmit_cb.work, ieee802154_xmit_worker);
+                ieee802154_xmit_cb.skb = skb;
+                ieee802154_xmit_cb.local = local;
 
-        queue_work(priv->dev_workqueue, &work->work);
+                queue_work(local->workqueue, &ieee802154_xmit_cb.work);
+        }
 
         return NETDEV_TX_OK;
 
@@ -131,3 +119,31 @@ err_tx:
         kfree_skb(skb);
         return NETDEV_TX_OK;
 }
+
+netdev_tx_t
+ieee802154_monitor_start_xmit(struct sk_buff *skb, struct net_device *dev)
+{
+        struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
+
+        skb->skb_iif = dev->ifindex;
+
+        return ieee802154_tx(sdata->local, skb);
+}
+
+netdev_tx_t
+ieee802154_subif_start_xmit(struct sk_buff *skb, struct net_device *dev)
+{
+        struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
+        int rc;
+
+        rc = mac802154_llsec_encrypt(&sdata->sec, skb);
+        if (rc) {
+                netdev_warn(dev, "encryption failed: %i\n", rc);
+                kfree_skb(skb);
+                return NETDEV_TX_OK;
+        }
+
+        skb->skb_iif = dev->ifindex;
+
+        return ieee802154_tx(sdata->local, skb);
+}
diff --git a/net/mac802154/util.c b/net/mac802154/util.c
new file mode 100644
index 000000000000..117e4eff4ca8
--- /dev/null
+++ b/net/mac802154/util.c
@@ -0,0 +1,55 @@
+/* This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * Authors:
+ * Alexander Aring <aar@pengutronix.de>
+ *
+ * Based on: net/mac80211/util.c
+ */
+
+#include "ieee802154_i.h"
+
+void ieee802154_wake_queue(struct ieee802154_hw *hw)
+{
+        struct ieee802154_local *local = hw_to_local(hw);
+        struct ieee802154_sub_if_data *sdata;
+
+        rcu_read_lock();
+        list_for_each_entry_rcu(sdata, &local->interfaces, list) {
+                if (!sdata->dev)
+                        continue;
+
+                netif_wake_queue(sdata->dev);
+        }
+        rcu_read_unlock();
+}
+EXPORT_SYMBOL(ieee802154_wake_queue);
+
+void ieee802154_stop_queue(struct ieee802154_hw *hw)
+{
+        struct ieee802154_local *local = hw_to_local(hw);
+        struct ieee802154_sub_if_data *sdata;
+
+        rcu_read_lock();
+        list_for_each_entry_rcu(sdata, &local->interfaces, list) {
+                if (!sdata->dev)
+                        continue;
+
+                netif_stop_queue(sdata->dev);
+        }
+        rcu_read_unlock();
+}
+EXPORT_SYMBOL(ieee802154_stop_queue);
+
+void ieee802154_xmit_complete(struct ieee802154_hw *hw, struct sk_buff *skb)
+{
+        ieee802154_wake_queue(hw);
+        consume_skb(skb);
+}
+EXPORT_SYMBOL(ieee802154_xmit_complete);
diff --git a/net/mac802154/wpan.c b/net/mac802154/wpan.c
deleted file mode 100644
index 4ab86a57dca5..000000000000
--- a/net/mac802154/wpan.c
+++ /dev/null
@@ -1,599 +0,0 @@
-/*
- * Copyright 2007-2012 Siemens AG
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2
- * as published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
- *
- * Written by:
- * Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
- * Sergey Lapin <slapin@ossfans.org>
- * Maxim Gorbachyov <maxim.gorbachev@siemens.com>
- * Alexander Smirnov <alex.bluesman.smirnov@gmail.com>
- */
-
-#include <linux/netdevice.h>
-#include <linux/module.h>
-#include <linux/if_arp.h>
-
-#include <net/rtnetlink.h>
-#include <linux/nl802154.h>
-#include <net/af_ieee802154.h>
-#include <net/mac802154.h>
-#include <net/ieee802154_netdev.h>
-#include <net/ieee802154.h>
-#include <net/wpan-phy.h>
-
-#include "mac802154.h"
-
-static int mac802154_wpan_update_llsec(struct net_device *dev)
-{
-        struct mac802154_sub_if_data *priv = netdev_priv(dev);
-        struct ieee802154_mlme_ops *ops = ieee802154_mlme_ops(dev);
-        int rc = 0;
-
-        if (ops->llsec) {
-                struct ieee802154_llsec_params params;
-                int changed = 0;
-
-                params.pan_id = priv->pan_id;
-                changed |= IEEE802154_LLSEC_PARAM_PAN_ID;
-
-                params.hwaddr = priv->extended_addr;
-                changed |= IEEE802154_LLSEC_PARAM_HWADDR;
-
-                rc = ops->llsec->set_params(dev, &params, changed);
-        }
-
-        return rc;
-}
-
-static int
-mac802154_wpan_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
-{
-        struct mac802154_sub_if_data *priv = netdev_priv(dev);
-        struct sockaddr_ieee802154 *sa =
-                (struct sockaddr_ieee802154 *)&ifr->ifr_addr;
-        int err = -ENOIOCTLCMD;
-
-        spin_lock_bh(&priv->mib_lock);
-
-        switch (cmd) {
-        case SIOCGIFADDR:
-        {
-                u16 pan_id, short_addr;
-
-                pan_id = le16_to_cpu(priv->pan_id);
-                short_addr = le16_to_cpu(priv->short_addr);
-                if (pan_id == IEEE802154_PANID_BROADCAST ||
-                    short_addr == IEEE802154_ADDR_BROADCAST) {
-                        err = -EADDRNOTAVAIL;
-                        break;
-                }
-
-                sa->family = AF_IEEE802154;
-                sa->addr.addr_type = IEEE802154_ADDR_SHORT;
-                sa->addr.pan_id = pan_id;
-                sa->addr.short_addr = short_addr;
-
-                err = 0;
-                break;
-        }
-        case SIOCSIFADDR:
-                dev_warn(&dev->dev,
-                         "Using DEBUGing ioctl SIOCSIFADDR isn't recommended!\n");
-                if (sa->family != AF_IEEE802154 ||
-                    sa->addr.addr_type != IEEE802154_ADDR_SHORT ||
-                    sa->addr.pan_id == IEEE802154_PANID_BROADCAST ||
-                    sa->addr.short_addr == IEEE802154_ADDR_BROADCAST ||
-                    sa->addr.short_addr == IEEE802154_ADDR_UNDEF) {
-                        err = -EINVAL;
-                        break;
-                }
-
-                priv->pan_id = cpu_to_le16(sa->addr.pan_id);
-                priv->short_addr = cpu_to_le16(sa->addr.short_addr);
-
-                err = mac802154_wpan_update_llsec(dev);
-                break;
-        }
-
-        spin_unlock_bh(&priv->mib_lock);
-        return err;
-}
-
-static int mac802154_wpan_mac_addr(struct net_device *dev, void *p)
-{
-        struct sockaddr *addr = p;
-
-        if (netif_running(dev))
-                return -EBUSY;
-
-        /* FIXME: validate addr */
-        memcpy(dev->dev_addr, addr->sa_data, dev->addr_len);
-        mac802154_dev_set_ieee_addr(dev);
-        return mac802154_wpan_update_llsec(dev);
-}
-
-int mac802154_set_mac_params(struct net_device *dev,
-                             const struct ieee802154_mac_params *params)
-{
-        struct mac802154_sub_if_data *priv = netdev_priv(dev);
-
-        mutex_lock(&priv->hw->slaves_mtx);
-        priv->mac_params = *params;
-        mutex_unlock(&priv->hw->slaves_mtx);
-
-        return 0;
-}
-
-void mac802154_get_mac_params(struct net_device *dev,
-                              struct ieee802154_mac_params *params)
-{
-        struct mac802154_sub_if_data *priv = netdev_priv(dev);
-
-        mutex_lock(&priv->hw->slaves_mtx);
-        *params = priv->mac_params;
-        mutex_unlock(&priv->hw->slaves_mtx);
-}
-
-static int mac802154_wpan_open(struct net_device *dev)
-{
-        int rc;
-        struct mac802154_sub_if_data *priv = netdev_priv(dev);
-        struct wpan_phy *phy = priv->hw->phy;
-
-        rc = mac802154_slave_open(dev);
-        if (rc < 0)
-                return rc;
-
-        mutex_lock(&phy->pib_lock);
-
-        if (phy->set_txpower) {
-                rc = phy->set_txpower(phy, priv->mac_params.transmit_power);
-                if (rc < 0)
-                        goto out;
-        }
-
-        if (phy->set_lbt) {
-                rc = phy->set_lbt(phy, priv->mac_params.lbt);
-                if (rc < 0)
-                        goto out;
-        }
-
-        if (phy->set_cca_mode) {
-                rc = phy->set_cca_mode(phy, priv->mac_params.cca_mode);
-                if (rc < 0)
-                        goto out;
-        }
-
-        if (phy->set_cca_ed_level) {
-                rc = phy->set_cca_ed_level(phy, priv->mac_params.cca_ed_level);
-                if (rc < 0)
-                        goto out;
-        }
-
-        if (phy->set_csma_params) {
-                rc = phy->set_csma_params(phy, priv->mac_params.min_be,
-                                          priv->mac_params.max_be,
-                                          priv->mac_params.csma_retries);
-                if (rc < 0)
-                        goto out;
-        }
-
-        if (phy->set_frame_retries) {
-                rc = phy->set_frame_retries(phy,
-                                            priv->mac_params.frame_retries);
-                if (rc < 0)
-                        goto out;
-        }
-
-        mutex_unlock(&phy->pib_lock);
-        return 0;
-
-out:
-        mutex_unlock(&phy->pib_lock);
-        return rc;
-}
-
-static int mac802154_set_header_security(struct mac802154_sub_if_data *priv,
-                                         struct ieee802154_hdr *hdr,
-                                         const struct ieee802154_mac_cb *cb)
-{
-        struct ieee802154_llsec_params params;
-        u8 level;
-
-        mac802154_llsec_get_params(&priv->sec, &params);
-
-        if (!params.enabled && cb->secen_override && cb->secen)
-                return -EINVAL;
-        if (!params.enabled ||
-            (cb->secen_override && !cb->secen) ||
-            !params.out_level)
-                return 0;
-        if (cb->seclevel_override && !cb->seclevel)
-                return -EINVAL;
-
-        level = cb->seclevel_override ? cb->seclevel : params.out_level;
-
-        hdr->fc.security_enabled = 1;
-        hdr->sec.level = level;
-        hdr->sec.key_id_mode = params.out_key.mode;
-        if (params.out_key.mode == IEEE802154_SCF_KEY_SHORT_INDEX)
-                hdr->sec.short_src = params.out_key.short_source;
-        else if (params.out_key.mode == IEEE802154_SCF_KEY_HW_INDEX)
-                hdr->sec.extended_src = params.out_key.extended_source;
-        hdr->sec.key_id = params.out_key.id;
-
-        return 0;
-}
-
-static int mac802154_header_create(struct sk_buff *skb,
-                                   struct net_device *dev,
-                                   unsigned short type,
-                                   const void *daddr,
-                                   const void *saddr,
-                                   unsigned len)
-{
-        struct ieee802154_hdr hdr;
-        struct mac802154_sub_if_data *priv = netdev_priv(dev);
-        struct ieee802154_mac_cb *cb = mac_cb(skb);
-        int hlen;
-
-        if (!daddr)
-                return -EINVAL;
-
-        memset(&hdr.fc, 0, sizeof(hdr.fc));
-        hdr.fc.type = cb->type;
-        hdr.fc.security_enabled = cb->secen;
-        hdr.fc.ack_request = cb->ackreq;
-        hdr.seq = ieee802154_mlme_ops(dev)->get_dsn(dev);
-
-        if (mac802154_set_header_security(priv, &hdr, cb) < 0)
-                return -EINVAL;
-
-        if (!saddr) {
-                spin_lock_bh(&priv->mib_lock);
-
-                if (priv->short_addr == cpu_to_le16(IEEE802154_ADDR_BROADCAST) ||
-                    priv->short_addr == cpu_to_le16(IEEE802154_ADDR_UNDEF) ||
-                    priv->pan_id == cpu_to_le16(IEEE802154_PANID_BROADCAST)) {
-                        hdr.source.mode = IEEE802154_ADDR_LONG;
-                        hdr.source.extended_addr = priv->extended_addr;
-                } else {
-                        hdr.source.mode = IEEE802154_ADDR_SHORT;
-                        hdr.source.short_addr = priv->short_addr;
-                }
-
-                hdr.source.pan_id = priv->pan_id;
-
-                spin_unlock_bh(&priv->mib_lock);
-        } else {
-                hdr.source = *(const struct ieee802154_addr *)saddr;
-        }
-
-        hdr.dest = *(const struct ieee802154_addr *)daddr;
-
-        hlen = ieee802154_hdr_push(skb, &hdr);
-        if (hlen < 0)
-                return -EINVAL;
-
-        skb_reset_mac_header(skb);
-        skb->mac_len = hlen;
-
-        if (len > ieee802154_max_payload(&hdr))
-                return -EMSGSIZE;
-
-        return hlen;
-}
-
-static int
-mac802154_header_parse(const struct sk_buff *skb, unsigned char *haddr)
-{
-        struct ieee802154_hdr hdr;
-        struct ieee802154_addr *addr = (struct ieee802154_addr *)haddr;
-
-        if (ieee802154_hdr_peek_addrs(skb, &hdr) < 0) {
-                pr_debug("malformed packet\n");
-                return 0;
-        }
-
-        *addr = hdr.source;
-        return sizeof(*addr);
-}
-
-static netdev_tx_t
-mac802154_wpan_xmit(struct sk_buff *skb, struct net_device *dev)
-{
-        struct mac802154_sub_if_data *priv;
-        u8 chan, page;
-        int rc;
-
-        priv = netdev_priv(dev);
-
-        spin_lock_bh(&priv->mib_lock);
-        chan = priv->chan;
-        page = priv->page;
-        spin_unlock_bh(&priv->mib_lock);
-
-        if (chan == MAC802154_CHAN_NONE ||
-            page >= WPAN_NUM_PAGES ||
-            chan >= WPAN_NUM_CHANNELS) {
-                kfree_skb(skb);
-                return NETDEV_TX_OK;
-        }
-
-        rc = mac802154_llsec_encrypt(&priv->sec, skb);
-        if (rc) {
-                pr_warn("encryption failed: %i\n", rc);
-                kfree_skb(skb);
-                return NETDEV_TX_OK;
-        }
-
-        skb->skb_iif = dev->ifindex;
-        dev->stats.tx_packets++;
-        dev->stats.tx_bytes += skb->len;
-
-        return mac802154_tx(priv->hw, skb, page, chan);
-}
-
-static struct header_ops mac802154_header_ops = {
-        .create         = mac802154_header_create,
-        .parse          = mac802154_header_parse,
-};
-
-static const struct net_device_ops mac802154_wpan_ops = {
-        .ndo_open               = mac802154_wpan_open,
-        .ndo_stop               = mac802154_slave_close,
-        .ndo_start_xmit         = mac802154_wpan_xmit,
-        .ndo_do_ioctl           = mac802154_wpan_ioctl,
-        .ndo_set_mac_address    = mac802154_wpan_mac_addr,
-};
-
-static void mac802154_wpan_free(struct net_device *dev)
-{
-        struct mac802154_sub_if_data *priv = netdev_priv(dev);
-
-        mac802154_llsec_destroy(&priv->sec);
-
-        free_netdev(dev);
-}
-
-void mac802154_wpan_setup(struct net_device *dev)
-{
-        struct mac802154_sub_if_data *priv;
-
-        dev->addr_len           = IEEE802154_ADDR_LEN;
-        memset(dev->broadcast, 0xff, IEEE802154_ADDR_LEN);
-
-        dev->hard_header_len    = MAC802154_FRAME_HARD_HEADER_LEN;
-        dev->header_ops         = &mac802154_header_ops;
-        dev->needed_tailroom    = 2 + 16; /* FCS + MIC */
-        dev->mtu                = IEEE802154_MTU;
-        dev->tx_queue_len       = 300;
-        dev->type               = ARPHRD_IEEE802154;
-        dev->flags              = IFF_NOARP | IFF_BROADCAST;
-        dev->watchdog_timeo     = 0;
-
-        dev->destructor         = mac802154_wpan_free;
-        dev->netdev_ops         = &mac802154_wpan_ops;
-        dev->ml_priv            = &mac802154_mlme_wpan;
-
-        priv = netdev_priv(dev);
-        priv->type = IEEE802154_DEV_WPAN;
-
-        priv->chan = MAC802154_CHAN_NONE;
-        priv->page = 0;
-
-        spin_lock_init(&priv->mib_lock);
-        mutex_init(&priv->sec_mtx);
-
-        get_random_bytes(&priv->bsn, 1);
-        get_random_bytes(&priv->dsn, 1);
-
-        /* defaults per 802.15.4-2011 */
-        priv->mac_params.min_be = 3;
-        priv->mac_params.max_be = 5;
-        priv->mac_params.csma_retries = 4;
-        priv->mac_params.frame_retries = -1; /* for compatibility, actual default is 3 */
-
-        priv->pan_id = cpu_to_le16(IEEE802154_PANID_BROADCAST);
-        priv->short_addr = cpu_to_le16(IEEE802154_ADDR_BROADCAST);
-
-        mac802154_llsec_init(&priv->sec);
-}
-
-static int mac802154_process_data(struct net_device *dev, struct sk_buff *skb)
-{
-        return netif_rx_ni(skb);
-}
-
-static int
-mac802154_subif_frame(struct mac802154_sub_if_data *sdata, struct sk_buff *skb,
-                      const struct ieee802154_hdr *hdr)
-{
-        __le16 span, sshort;
-        int rc;
-
-        pr_debug("getting packet via slave interface %s\n", sdata->dev->name);
-
-        spin_lock_bh(&sdata->mib_lock);
-
-        span = sdata->pan_id;
-        sshort = sdata->short_addr;
-
-        switch (mac_cb(skb)->dest.mode) {
-        case IEEE802154_ADDR_NONE:
-                if (mac_cb(skb)->dest.mode != IEEE802154_ADDR_NONE)
-                        /* FIXME: check if we are PAN coordinator */
-                        skb->pkt_type = PACKET_OTHERHOST;
-                else
-                        /* ACK comes with both addresses empty */
-                        skb->pkt_type = PACKET_HOST;
-                break;
-        case IEEE802154_ADDR_LONG:
-                if (mac_cb(skb)->dest.pan_id != span &&
-                    mac_cb(skb)->dest.pan_id != cpu_to_le16(IEEE802154_PANID_BROADCAST))
-                        skb->pkt_type = PACKET_OTHERHOST;
-                else if (mac_cb(skb)->dest.extended_addr == sdata->extended_addr)
-                        skb->pkt_type = PACKET_HOST;
-                else
-                        skb->pkt_type = PACKET_OTHERHOST;
-                break;
-        case IEEE802154_ADDR_SHORT:
-                if (mac_cb(skb)->dest.pan_id != span &&
-                    mac_cb(skb)->dest.pan_id != cpu_to_le16(IEEE802154_PANID_BROADCAST))
-                        skb->pkt_type = PACKET_OTHERHOST;
-                else if (mac_cb(skb)->dest.short_addr == sshort)
-                        skb->pkt_type = PACKET_HOST;
-                else if (mac_cb(skb)->dest.short_addr ==
-                          cpu_to_le16(IEEE802154_ADDR_BROADCAST))
-                        skb->pkt_type = PACKET_BROADCAST;
-                else
-                        skb->pkt_type = PACKET_OTHERHOST;
-                break;
-        default:
-                spin_unlock_bh(&sdata->mib_lock);
-                pr_debug("invalid dest mode\n");
-                kfree_skb(skb);
-                return NET_RX_DROP;
-        }
-
-        spin_unlock_bh(&sdata->mib_lock);
-
-        skb->dev = sdata->dev;
-
-        rc = mac802154_llsec_decrypt(&sdata->sec, skb);
-        if (rc) {
-                pr_debug("decryption failed: %i\n", rc);
-                goto fail;
-        }
-
-        sdata->dev->stats.rx_packets++;
-        sdata->dev->stats.rx_bytes += skb->len;
-
-        switch (mac_cb(skb)->type) {
-        case IEEE802154_FC_TYPE_DATA:
-                return mac802154_process_data(sdata->dev, skb);
-        default:
-                pr_warn("ieee802154: bad frame received (type = %d)\n",
-                        mac_cb(skb)->type);
-                goto fail;
-        }
-
-fail:
-        kfree_skb(skb);
-        return NET_RX_DROP;
-}
-
-static void mac802154_print_addr(const char *name,
-                                 const struct ieee802154_addr *addr)
-{
-        if (addr->mode == IEEE802154_ADDR_NONE)
-                pr_debug("%s not present\n", name);
-
-        pr_debug("%s PAN ID: %04x\n", name, le16_to_cpu(addr->pan_id));
-        if (addr->mode == IEEE802154_ADDR_SHORT) {
-                pr_debug("%s is short: %04x\n", name,
-                         le16_to_cpu(addr->short_addr));
-        } else {
-                u64 hw = swab64((__force u64) addr->extended_addr);
-
-                pr_debug("%s is hardware: %8phC\n", name, &hw);
-        }
-}
-
-static int mac802154_parse_frame_start(struct sk_buff *skb,
-                                       struct ieee802154_hdr *hdr)
-{
-        int hlen;
-        struct ieee802154_mac_cb *cb = mac_cb_init(skb);
-
-        hlen = ieee802154_hdr_pull(skb, hdr);
-        if (hlen < 0)
-                return -EINVAL;
-
-        skb->mac_len = hlen;
-
-        pr_debug("fc: %04x dsn: %02x\n", le16_to_cpup((__le16 *)&hdr->fc),
-                 hdr->seq);
-
-        cb->type = hdr->fc.type;
-        cb->ackreq = hdr->fc.ack_request;
-        cb->secen = hdr->fc.security_enabled;
-
-        mac802154_print_addr("destination", &hdr->dest);
-        mac802154_print_addr("source", &hdr->source);
-
-        cb->source = hdr->source;
-        cb->dest = hdr->dest;
-
-        if (hdr->fc.security_enabled) {
-                u64 key;
-
-                pr_debug("seclevel %i\n", hdr->sec.level);
-
-                switch (hdr->sec.key_id_mode) {
-                case IEEE802154_SCF_KEY_IMPLICIT:
-                        pr_debug("implicit key\n");
-                        break;
-
-                case IEEE802154_SCF_KEY_INDEX:
-                        pr_debug("key %02x\n", hdr->sec.key_id);
-                        break;
-
-                case IEEE802154_SCF_KEY_SHORT_INDEX:
-                        pr_debug("key %04x:%04x %02x\n",
-                                 le32_to_cpu(hdr->sec.short_src) >> 16,
-                                 le32_to_cpu(hdr->sec.short_src) & 0xffff,
-                                 hdr->sec.key_id);
-                        break;
-
-                case IEEE802154_SCF_KEY_HW_INDEX:
-                        key = swab64((__force u64) hdr->sec.extended_src);
-                        pr_debug("key source %8phC %02x\n", &key,
-                                 hdr->sec.key_id);
-                        break;
-                }
-        }
-
-        return 0;
-}
-
-void mac802154_wpans_rx(struct mac802154_priv *priv, struct sk_buff *skb)
-{
-        int ret;
-        struct mac802154_sub_if_data *sdata;
-        struct ieee802154_hdr hdr;
-
-        ret = mac802154_parse_frame_start(skb, &hdr);
-        if (ret) {
-                pr_debug("got invalid frame\n");
-                kfree_skb(skb);
-                return;
-        }
-
-        rcu_read_lock();
-        list_for_each_entry_rcu(sdata, &priv->slaves, list) {
-                if (sdata->type != IEEE802154_DEV_WPAN ||
-                    !netif_running(sdata->dev))
-                        continue;
-
-                mac802154_subif_frame(sdata, skb, &hdr);
-                skb = NULL;
-                break;
-        }
-        rcu_read_unlock();
-
-        if (skb)
-                kfree_skb(skb);
-}
diff --git a/net/wireless/Makefile b/net/wireless/Makefile
index a761670af31d..4c9e39f04ef8 100644
--- a/net/wireless/Makefile
+++ b/net/wireless/Makefile
@@ -10,7 +10,7 @@ obj-$(CONFIG_WEXT_SPY) += wext-spy.o
 obj-$(CONFIG_WEXT_PRIV) += wext-priv.o
 
 cfg80211-y += core.o sysfs.o radiotap.o util.o reg.o scan.o nl80211.o
-cfg80211-y += mlme.o ibss.o sme.o chan.o ethtool.o mesh.o ap.o trace.o
+cfg80211-y += mlme.o ibss.o sme.o chan.o ethtool.o mesh.o ap.o trace.o ocb.o
 cfg80211-$(CONFIG_CFG80211_DEBUGFS) += debugfs.o
 cfg80211-$(CONFIG_CFG80211_WEXT) += wext-compat.o wext-sme.o
 cfg80211-$(CONFIG_CFG80211_INTERNAL_REGDB) += regdb.o
diff --git a/net/wireless/chan.c b/net/wireless/chan.c
index 72d81e2154d5..85506f1d0789 100644
--- a/net/wireless/chan.c
+++ b/net/wireless/chan.c
@@ -115,7 +115,7 @@ bool cfg80211_chandef_valid(const struct cfg80211_chan_def *chandef)
 EXPORT_SYMBOL(cfg80211_chandef_valid);
 
 static void chandef_primary_freqs(const struct cfg80211_chan_def *c,
-                                  int *pri40, int *pri80)
+                                  u32 *pri40, u32 *pri80)
 {
         int tmp;
 
@@ -366,6 +366,7 @@ int cfg80211_chandef_dfs_required(struct wiphy *wiphy,
 
                 break;
         case NL80211_IFTYPE_STATION:
+        case NL80211_IFTYPE_OCB:
         case NL80211_IFTYPE_P2P_CLIENT:
         case NL80211_IFTYPE_MONITOR:
         case NL80211_IFTYPE_AP_VLAN:
@@ -892,6 +893,13 @@ cfg80211_get_chan_state(struct wireless_dev *wdev,
                                 *radar_detect |= BIT(wdev->chandef.width);
                 }
                 return;
+        case NL80211_IFTYPE_OCB:
+                if (wdev->chandef.chan) {
+                        *chan = wdev->chandef.chan;
+                        *chanmode = CHAN_MODE_SHARED;
+                        return;
+                }
+                break;
         case NL80211_IFTYPE_MONITOR:
         case NL80211_IFTYPE_AP_VLAN:
         case NL80211_IFTYPE_WDS:
diff --git a/net/wireless/core.c b/net/wireless/core.c
index f52a4cd7017c..a4d27927aba2 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -86,11 +86,11 @@ struct wiphy *wiphy_idx_to_wiphy(int wiphy_idx)
         return &rdev->wiphy;
 }
 
-int cfg80211_dev_rename(struct cfg80211_registered_device *rdev,
-                        char *newname)
+static int cfg80211_dev_check_name(struct cfg80211_registered_device *rdev,
+                                   const char *newname)
 {
         struct cfg80211_registered_device *rdev2;
-        int wiphy_idx, taken = -1, result, digits;
+        int wiphy_idx, taken = -1, digits;
 
         ASSERT_RTNL();
 
@@ -109,15 +109,28 @@ int cfg80211_dev_rename(struct cfg80211_registered_device *rdev,
                         return -EINVAL;
         }
 
+        /* Ensure another device does not already have this name. */
+        list_for_each_entry(rdev2, &cfg80211_rdev_list, list)
+                if (strcmp(newname, wiphy_name(&rdev2->wiphy)) == 0)
+                        return -EINVAL;
+
+        return 0;
+}
+
+int cfg80211_dev_rename(struct cfg80211_registered_device *rdev,
+                        char *newname)
+{
+        int result;
+
+        ASSERT_RTNL();
 
         /* Ignore nop renames */
-        if (strcmp(newname, dev_name(&rdev->wiphy.dev)) == 0)
+        if (strcmp(newname, wiphy_name(&rdev->wiphy)) == 0)
                 return 0;
 
-        /* Ensure another device does not already have this name. */
-        list_for_each_entry(rdev2, &cfg80211_rdev_list, list)
-                if (strcmp(newname, dev_name(&rdev2->wiphy.dev)) == 0)
-                        return -EINVAL;
+        result = cfg80211_dev_check_name(rdev, newname);
+        if (result < 0)
+                return result;
 
         result = device_rename(&rdev->wiphy.dev, newname);
         if (result)
@@ -309,7 +322,8 @@ static void cfg80211_destroy_iface_wk(struct work_struct *work)
 
 /* exported functions */
 
-struct wiphy *wiphy_new(const struct cfg80211_ops *ops, int sizeof_priv)
+struct wiphy *wiphy_new_nm(const struct cfg80211_ops *ops, int sizeof_priv,
+                           const char *requested_name)
 {
         static atomic_t wiphy_counter = ATOMIC_INIT(0);
 
@@ -346,7 +360,31 @@ struct wiphy *wiphy_new(const struct cfg80211_ops *ops, int sizeof_priv)
         rdev->wiphy_idx--;
 
         /* give it a proper name */
-        dev_set_name(&rdev->wiphy.dev, PHY_NAME "%d", rdev->wiphy_idx);
+        if (requested_name && requested_name[0]) {
+                int rv;
+
+                rtnl_lock();
+                rv = cfg80211_dev_check_name(rdev, requested_name);
+
+                if (rv < 0) {
+                        rtnl_unlock();
+                        goto use_default_name;
+                }
+
+                rv = dev_set_name(&rdev->wiphy.dev, "%s", requested_name);
+                rtnl_unlock();
+                if (rv)
+                        goto use_default_name;
+        } else {
+use_default_name:
+                /* NOTE:  This is *probably* safe w/out holding rtnl because of
+                 * the restrictions on phy names.  Probably this call could
+                 * fail if some other part of the kernel (re)named a device
+                 * phyX.  But, might should add some locking and check return
+                 * value, and use a different name if this one exists?
+                 */
+                dev_set_name(&rdev->wiphy.dev, PHY_NAME "%d", rdev->wiphy_idx);
+        }
 
         INIT_LIST_HEAD(&rdev->wdev_list);
         INIT_LIST_HEAD(&rdev->beacon_registrations);
@@ -406,7 +444,7 @@ struct wiphy *wiphy_new(const struct cfg80211_ops *ops, int sizeof_priv)
 
         return &rdev->wiphy;
 }
-EXPORT_SYMBOL(wiphy_new);
+EXPORT_SYMBOL(wiphy_new_nm);
 
 static int wiphy_verify_combinations(struct wiphy *wiphy)
 {
@@ -831,7 +869,22 @@ void __cfg80211_leave(struct cfg80211_registered_device *rdev,
         case NL80211_IFTYPE_P2P_GO:
                 __cfg80211_stop_ap(rdev, dev, true);
                 break;
-        default:
+        case NL80211_IFTYPE_OCB:
+                __cfg80211_leave_ocb(rdev, dev);
+                break;
+        case NL80211_IFTYPE_WDS:
+                /* must be handled by mac80211/driver, has no APIs */
+                break;
+        case NL80211_IFTYPE_P2P_DEVICE:
+                /* cannot happen, has no netdev */
+                break;
+        case NL80211_IFTYPE_AP_VLAN:
+        case NL80211_IFTYPE_MONITOR:
+                /* nothing to do */
+                break;
+        case NL80211_IFTYPE_UNSPECIFIED:
+        case NUM_NL80211_IFTYPES:
+                /* invalid */
                 break;
         }
 }
diff --git a/net/wireless/core.h b/net/wireless/core.h
index 7e3a3cef7df9..61ee664cf2bd 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -290,6 +290,18 @@ int cfg80211_set_mesh_channel(struct cfg80211_registered_device *rdev,
                               struct wireless_dev *wdev,
                               struct cfg80211_chan_def *chandef);
 
+/* OCB */
+int __cfg80211_join_ocb(struct cfg80211_registered_device *rdev,
+                        struct net_device *dev,
+                        struct ocb_setup *setup);
+int cfg80211_join_ocb(struct cfg80211_registered_device *rdev,
+                      struct net_device *dev,
+                      struct ocb_setup *setup);
+int __cfg80211_leave_ocb(struct cfg80211_registered_device *rdev,
+                         struct net_device *dev);
+int cfg80211_leave_ocb(struct cfg80211_registered_device *rdev,
+                       struct net_device *dev);
+
 /* AP */
 int __cfg80211_stop_ap(struct cfg80211_registered_device *rdev,
                        struct net_device *dev, bool notify);
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 5839c85075f1..1a31736914e5 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -884,7 +884,12 @@ static int nl80211_key_allowed(struct wireless_dev *wdev)
                 if (!wdev->current_bss)
                         return -ENOLINK;
                 break;
-        default:
+        case NL80211_IFTYPE_UNSPECIFIED:
+        case NL80211_IFTYPE_OCB:
+        case NL80211_IFTYPE_MONITOR:
+        case NL80211_IFTYPE_P2P_DEVICE:
+        case NL80211_IFTYPE_WDS:
+        case NUM_NL80211_IFTYPES:
                 return -EINVAL;
         }
 
@@ -1514,8 +1519,8 @@ static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev,
                         if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
                                 CMD(channel_switch, CHANNEL_SWITCH);
                         CMD(set_qos_map, SET_QOS_MAP);
-                        if (rdev->wiphy.flags &
-                                        WIPHY_FLAG_SUPPORTS_WMM_ADMISSION)
+                        if (rdev->wiphy.features &
+                                        NL80211_FEATURE_SUPPORTS_WMM_ADMISSION)
                                 CMD(add_tx_ts, ADD_TX_TS);
                 }
                 /* add into the if now */
@@ -2605,7 +2610,9 @@ static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
             !(rdev->wiphy.interface_modes & (1 << type)))
                 return -EOPNOTSUPP;
 
-        if (type == NL80211_IFTYPE_P2P_DEVICE && info->attrs[NL80211_ATTR_MAC]) {
+        if ((type == NL80211_IFTYPE_P2P_DEVICE ||
+             rdev->wiphy.features & NL80211_FEATURE_MAC_ON_CREATE) &&
+            info->attrs[NL80211_ATTR_MAC]) {
                 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
                            ETH_ALEN);
                 if (!is_valid_ether_addr(params.macaddr))
@@ -4398,10 +4405,12 @@ static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
 {
         struct cfg80211_registered_device *rdev = info->user_ptr[0];
         struct net_device *dev = info->user_ptr[1];
-        u8 *mac_addr = NULL;
+        struct station_del_parameters params;
+
+        memset(&params, 0, sizeof(params));
 
         if (info->attrs[NL80211_ATTR_MAC])
-                mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
+                params.mac = nla_data(info->attrs[NL80211_ATTR_MAC]);
 
         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
@@ -4412,7 +4421,28 @@ static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
         if (!rdev->ops->del_station)
                 return -EOPNOTSUPP;
 
-        return rdev_del_station(rdev, dev, mac_addr);
+        if (info->attrs[NL80211_ATTR_MGMT_SUBTYPE]) {
+                params.subtype =
+                        nla_get_u8(info->attrs[NL80211_ATTR_MGMT_SUBTYPE]);
+                if (params.subtype != IEEE80211_STYPE_DISASSOC >> 4 &&
+                    params.subtype != IEEE80211_STYPE_DEAUTH >> 4)
+                        return -EINVAL;
+        } else {
+                /* Default to Deauthentication frame */
+                params.subtype = IEEE80211_STYPE_DEAUTH >> 4;
+        }
+
+        if (info->attrs[NL80211_ATTR_REASON_CODE]) {
+                params.reason_code =
+                        nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
+                if (params.reason_code == 0)
+                        return -EINVAL; /* 0 is reserved */
+        } else {
+                /* Default to reason code 2 */
+                params.reason_code = WLAN_REASON_PREV_AUTH_NOT_VALID;
+        }
+
+        return rdev_del_station(rdev, dev, &params);
 }
 
 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
@@ -4624,6 +4654,96 @@ static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
         return rdev_del_mpath(rdev, dev, dst);
 }
 
+static int nl80211_get_mpp(struct sk_buff *skb, struct genl_info *info)
+{
+        struct cfg80211_registered_device *rdev = info->user_ptr[0];
+        int err;
+        struct net_device *dev = info->user_ptr[1];
+        struct mpath_info pinfo;
+        struct sk_buff *msg;
+        u8 *dst = NULL;
+        u8 mpp[ETH_ALEN];
+
+        memset(&pinfo, 0, sizeof(pinfo));
+
+        if (!info->attrs[NL80211_ATTR_MAC])
+                return -EINVAL;
+
+        dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
+
+        if (!rdev->ops->get_mpp)
+                return -EOPNOTSUPP;
+
+        if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
+                return -EOPNOTSUPP;
+
+        err = rdev_get_mpp(rdev, dev, dst, mpp, &pinfo);
+        if (err)
+                return err;
+
+        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
+        if (!msg)
+                return -ENOMEM;
+
+        if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
+                               dev, dst, mpp, &pinfo) < 0) {
+                nlmsg_free(msg);
+                return -ENOBUFS;
+        }
+
+        return genlmsg_reply(msg, info);
+}
+
+static int nl80211_dump_mpp(struct sk_buff *skb,
+                            struct netlink_callback *cb)
+{
+        struct mpath_info pinfo;
+        struct cfg80211_registered_device *rdev;
+        struct wireless_dev *wdev;
+        u8 dst[ETH_ALEN];
+        u8 mpp[ETH_ALEN];
+        int path_idx = cb->args[2];
+        int err;
+
+        err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
+        if (err)
+                return err;
+
+        if (!rdev->ops->dump_mpp) {
+                err = -EOPNOTSUPP;
+                goto out_err;
+        }
+
+        if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
+                err = -EOPNOTSUPP;
+                goto out_err;
+        }
+
+        while (1) {
+                err = rdev_dump_mpp(rdev, wdev->netdev, path_idx, dst,
+                                    mpp, &pinfo);
+                if (err == -ENOENT)
+                        break;
+                if (err)
+                        goto out_err;
+
+                if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
+                                       cb->nlh->nlmsg_seq, NLM_F_MULTI,
+                                       wdev->netdev, dst, mpp,
+                                       &pinfo) < 0)
+                        goto out;
+
+                path_idx++;
+        }
+
+ out:
+        cb->args[2] = path_idx;
+        err = skb->len;
+ out_err:
+        nl80211_finish_wdev_dump(rdev);
+        return err;
+}
+
 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
 {
         struct cfg80211_registered_device *rdev = info->user_ptr[0];
@@ -5923,7 +6043,6 @@ static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
          * function is called under RTNL lock, so this should not be a problem.
          */
         static struct nlattr *csa_attrs[NL80211_ATTR_MAX+1];
-        u8 radar_detect_width = 0;
         int err;
         bool need_new_beacon = false;
         int len, i;
@@ -6059,10 +6178,8 @@ skip_beacons:
         if (err < 0)
                 return err;
 
-        if (err > 0) {
-                radar_detect_width = BIT(params.chandef.width);
+        if (err > 0)
                 params.radar_required = true;
-        }
 
         if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX])
                 params.block_tx = true;
@@ -8159,6 +8276,28 @@ static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
         return -EINVAL;
 }
 
+static int nl80211_join_ocb(struct sk_buff *skb, struct genl_info *info)
+{
+        struct cfg80211_registered_device *rdev = info->user_ptr[0];
+        struct net_device *dev = info->user_ptr[1];
+        struct ocb_setup setup = {};
+        int err;
+
+        err = nl80211_parse_chandef(rdev, info, &setup.chandef);
+        if (err)
+                return err;
+
+        return cfg80211_join_ocb(rdev, dev, &setup);
+}
+
+static int nl80211_leave_ocb(struct sk_buff *skb, struct genl_info *info)
+{
+        struct cfg80211_registered_device *rdev = info->user_ptr[0];
+        struct net_device *dev = info->user_ptr[1];
+
+        return cfg80211_leave_ocb(rdev, dev);
+}
+
 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
 {
         struct cfg80211_registered_device *rdev = info->user_ptr[0];
@@ -9444,7 +9583,7 @@ static int nl80211_add_tx_ts(struct sk_buff *skb, struct genl_info *info)
         u16 admitted_time = 0;
         int err;
 
-        if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_WMM_ADMISSION))
+        if (!(rdev->wiphy.features & NL80211_FEATURE_SUPPORTS_WMM_ADMISSION))
                 return -EOPNOTSUPP;
 
         if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC] ||
@@ -9460,12 +9599,10 @@ static int nl80211_add_tx_ts(struct sk_buff *skb, struct genl_info *info)
                 return -EINVAL;
 
         /* WMM uses TIDs 0-7 even for TSPEC */
-        if (tsid < IEEE80211_FIRST_TSPEC_TSID) {
-                if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_WMM_ADMISSION))
-                        return -EINVAL;
-        } else {
+        if (tsid >= IEEE80211_FIRST_TSPEC_TSID) {
                 /* TODO: handle 802.11 TSPEC/admission control
-                 * need more attributes for that (e.g. BA session requirement)
+                 * need more attributes for that (e.g. BA session requirement);
+                 * change the WMM adminssion test above to allow both then
                  */
                 return -EINVAL;
         }
@@ -9782,6 +9919,15 @@ static const struct genl_ops nl80211_ops[] = {
                                   NL80211_FLAG_NEED_RTNL,
         },
         {
+                .cmd = NL80211_CMD_GET_MPP,
+                .doit = nl80211_get_mpp,
+                .dumpit = nl80211_dump_mpp,
+                .policy = nl80211_policy,
+                .flags = GENL_ADMIN_PERM,
+                .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
+                                  NL80211_FLAG_NEED_RTNL,
+        },
+        {
                 .cmd = NL80211_CMD_SET_MPATH,
                 .doit = nl80211_set_mpath,
                 .policy = nl80211_policy,
@@ -10095,6 +10241,22 @@ static const struct genl_ops nl80211_ops[] = {
                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
                                   NL80211_FLAG_NEED_RTNL,
         },
+        {
+                .cmd = NL80211_CMD_JOIN_OCB,
+                .doit = nl80211_join_ocb,
+                .policy = nl80211_policy,
+                .flags = GENL_ADMIN_PERM,
+                .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
+                                  NL80211_FLAG_NEED_RTNL,
+        },
+        {
+                .cmd = NL80211_CMD_LEAVE_OCB,
+                .doit = nl80211_leave_ocb,
+                .policy = nl80211_policy,
+                .flags = GENL_ADMIN_PERM,
+                .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
+                                  NL80211_FLAG_NEED_RTNL,
+        },
 #ifdef CONFIG_PM
         {
                 .cmd = NL80211_CMD_GET_WOWLAN,
diff --git a/net/wireless/ocb.c b/net/wireless/ocb.c
new file mode 100644
index 000000000000..c00d4a792319
--- /dev/null
+++ b/net/wireless/ocb.c
@@ -0,0 +1,88 @@
+/*
+ * OCB mode implementation
+ *
+ * Copyright: (c) 2014 Czech Technical University in Prague
+ *            (c) 2014 Volkswagen Group Research
+ * Author:    Rostislav Lisovy <rostislav.lisovy@fel.cvut.cz>
+ * Funded by: Volkswagen Group Research
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/ieee80211.h>
+#include <net/cfg80211.h>
+#include "nl80211.h"
+#include "core.h"
+#include "rdev-ops.h"
+
+int __cfg80211_join_ocb(struct cfg80211_registered_device *rdev,
+                        struct net_device *dev,
+                        struct ocb_setup *setup)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        int err;
+
+        ASSERT_WDEV_LOCK(wdev);
+
+        if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_OCB)
+                return -EOPNOTSUPP;
+
+        if (WARN_ON(!setup->chandef.chan))
+                return -EINVAL;
+
+        err = rdev_join_ocb(rdev, dev, setup);
+        if (!err)
+                wdev->chandef = setup->chandef;
+
+        return err;
+}
+
+int cfg80211_join_ocb(struct cfg80211_registered_device *rdev,
+                      struct net_device *dev,
+                      struct ocb_setup *setup)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        int err;
+
+        wdev_lock(wdev);
+        err = __cfg80211_join_ocb(rdev, dev, setup);
+        wdev_unlock(wdev);
+
+        return err;
+}
+
+int __cfg80211_leave_ocb(struct cfg80211_registered_device *rdev,
+                         struct net_device *dev)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        int err;
+
+        ASSERT_WDEV_LOCK(wdev);
+
+        if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_OCB)
+                return -EOPNOTSUPP;
+
+        if (!rdev->ops->leave_ocb)
+                return -EOPNOTSUPP;
+
+        err = rdev_leave_ocb(rdev, dev);
+        if (!err)
+                memset(&wdev->chandef, 0, sizeof(wdev->chandef));
+
+        return err;
+}
+
+int cfg80211_leave_ocb(struct cfg80211_registered_device *rdev,
+                       struct net_device *dev)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        int err;
+
+        wdev_lock(wdev);
+        err = __cfg80211_leave_ocb(rdev, dev);
+        wdev_unlock(wdev);
+
+        return err;
+}
diff --git a/net/wireless/rdev-ops.h b/net/wireless/rdev-ops.h
index f6d457d6a558..1b3864cd50ca 100644
--- a/net/wireless/rdev-ops.h
+++ b/net/wireless/rdev-ops.h
@@ -178,11 +178,12 @@ static inline int rdev_add_station(struct cfg80211_registered_device *rdev,
 }
 
 static inline int rdev_del_station(struct cfg80211_registered_device *rdev,
-                                   struct net_device *dev, u8 *mac)
+                                   struct net_device *dev,
+                                   struct station_del_parameters *params)
 {
         int ret;
-        trace_rdev_del_station(&rdev->wiphy, dev, mac);
-        ret = rdev->ops->del_station(&rdev->wiphy, dev, mac);
+        trace_rdev_del_station(&rdev->wiphy, dev, params);
+        ret = rdev->ops->del_station(&rdev->wiphy, dev, params);
         trace_rdev_return_int(&rdev->wiphy, ret);
         return ret;
 }
@@ -263,6 +264,18 @@ static inline int rdev_get_mpath(struct cfg80211_registered_device *rdev,
 
 }
 
+static inline int rdev_get_mpp(struct cfg80211_registered_device *rdev,
+                               struct net_device *dev, u8 *dst, u8 *mpp,
+                               struct mpath_info *pinfo)
+{
+        int ret;
+
+        trace_rdev_get_mpp(&rdev->wiphy, dev, dst, mpp);
+        ret = rdev->ops->get_mpp(&rdev->wiphy, dev, dst, mpp, pinfo);
+        trace_rdev_return_int_mpath_info(&rdev->wiphy, ret, pinfo);
+        return ret;
+}
+
 static inline int rdev_dump_mpath(struct cfg80211_registered_device *rdev,
                                   struct net_device *dev, int idx, u8 *dst,
                                   u8 *next_hop, struct mpath_info *pinfo)
@@ -271,7 +284,20 @@ static inline int rdev_dump_mpath(struct cfg80211_registered_device *rdev,
         int ret;
         trace_rdev_dump_mpath(&rdev->wiphy, dev, idx, dst, next_hop);
         ret = rdev->ops->dump_mpath(&rdev->wiphy, dev, idx, dst, next_hop,
-                                     pinfo);
+                                    pinfo);
+        trace_rdev_return_int_mpath_info(&rdev->wiphy, ret, pinfo);
+        return ret;
+}
+
+static inline int rdev_dump_mpp(struct cfg80211_registered_device *rdev,
+                                struct net_device *dev, int idx, u8 *dst,
+                                u8 *mpp, struct mpath_info *pinfo)
+
+{
+        int ret;
+
+        trace_rdev_dump_mpp(&rdev->wiphy, dev, idx, dst, mpp);
+        ret = rdev->ops->dump_mpp(&rdev->wiphy, dev, idx, dst, mpp, pinfo);
         trace_rdev_return_int_mpath_info(&rdev->wiphy, ret, pinfo);
         return ret;
 }
@@ -322,6 +348,27 @@ static inline int rdev_leave_mesh(struct cfg80211_registered_device *rdev,
         return ret;
 }
 
+static inline int rdev_join_ocb(struct cfg80211_registered_device *rdev,
+                                struct net_device *dev,
+                                struct ocb_setup *setup)
+{
+        int ret;
+        trace_rdev_join_ocb(&rdev->wiphy, dev, setup);
+        ret = rdev->ops->join_ocb(&rdev->wiphy, dev, setup);
+        trace_rdev_return_int(&rdev->wiphy, ret);
+        return ret;
+}
+
+static inline int rdev_leave_ocb(struct cfg80211_registered_device *rdev,
+                                 struct net_device *dev)
+{
+        int ret;
+        trace_rdev_leave_ocb(&rdev->wiphy, dev);
+        ret = rdev->ops->leave_ocb(&rdev->wiphy, dev);
+        trace_rdev_return_int(&rdev->wiphy, ret);
+        return ret;
+}
+
 static inline int rdev_change_bss(struct cfg80211_registered_device *rdev,
                                   struct net_device *dev,
                                   struct bss_parameters *params)
diff --git a/net/wireless/sme.c b/net/wireless/sme.c
index dc1668ff543b..0ab3711c79a0 100644
--- a/net/wireless/sme.c
+++ b/net/wireless/sme.c
@@ -80,9 +80,18 @@ static int cfg80211_conn_scan(struct wireless_dev *wdev)
         if (!request)
                 return -ENOMEM;
 
-        if (wdev->conn->params.channel)
+        if (wdev->conn->params.channel) {
+                enum ieee80211_band band = wdev->conn->params.channel->band;
+                struct ieee80211_supported_band *sband =
+                        wdev->wiphy->bands[band];
+
+                if (!sband) {
+                        kfree(request);
+                        return -EINVAL;
+                }
                 request->channels[0] = wdev->conn->params.channel;
-        else {
+                request->rates[band] = (1 << sband->n_bitrates) - 1;
+        } else {
                 int i = 0, j;
                 enum ieee80211_band band;
                 struct ieee80211_supported_band *bands;
diff --git a/net/wireless/trace.h b/net/wireless/trace.h
index 625a6e6d1168..277a85df910e 100644
--- a/net/wireless/trace.h
+++ b/net/wireless/trace.h
@@ -600,6 +600,11 @@ DEFINE_EVENT(wiphy_netdev_evt, rdev_leave_ibss,
         TP_ARGS(wiphy, netdev)
 );
 
+DEFINE_EVENT(wiphy_netdev_evt, rdev_leave_ocb,
+        TP_PROTO(struct wiphy *wiphy, struct net_device *netdev),
+        TP_ARGS(wiphy, netdev)
+);
+
 DEFINE_EVENT(wiphy_netdev_evt, rdev_flush_pmksa,
         TP_PROTO(struct wiphy *wiphy, struct net_device *netdev),
         TP_ARGS(wiphy, netdev)
@@ -680,9 +685,34 @@ DECLARE_EVENT_CLASS(wiphy_netdev_mac_evt,
                   WIPHY_PR_ARG, NETDEV_PR_ARG, MAC_PR_ARG(sta_mac))
 );
 
-DEFINE_EVENT(wiphy_netdev_mac_evt, rdev_del_station,
-        TP_PROTO(struct wiphy *wiphy, struct net_device *netdev, const u8 *mac),
-        TP_ARGS(wiphy, netdev, mac)
+DECLARE_EVENT_CLASS(station_del,
+        TP_PROTO(struct wiphy *wiphy, struct net_device *netdev,
+                 struct station_del_parameters *params),
+        TP_ARGS(wiphy, netdev, params),
+        TP_STRUCT__entry(
+                WIPHY_ENTRY
+                NETDEV_ENTRY
+                MAC_ENTRY(sta_mac)
+                __field(u8, subtype)
+                __field(u16, reason_code)
+        ),
+        TP_fast_assign(
+                WIPHY_ASSIGN;
+                NETDEV_ASSIGN;
+                MAC_ASSIGN(sta_mac, params->mac);
+                __entry->subtype = params->subtype;
+                __entry->reason_code = params->reason_code;
+        ),
+        TP_printk(WIPHY_PR_FMT ", " NETDEV_PR_FMT ", station mac: " MAC_PR_FMT
+                  ", subtype: %u, reason_code: %u",
+                  WIPHY_PR_ARG, NETDEV_PR_ARG, MAC_PR_ARG(sta_mac),
+                  __entry->subtype, __entry->reason_code)
+);
+
+DEFINE_EVENT(station_del, rdev_del_station,
+        TP_PROTO(struct wiphy *wiphy, struct net_device *netdev,
+                 struct station_del_parameters *params),
+        TP_ARGS(wiphy, netdev, params)
 );
 
 DEFINE_EVENT(wiphy_netdev_mac_evt, rdev_get_station,
@@ -801,6 +831,51 @@ TRACE_EVENT(rdev_dump_mpath,
                   MAC_PR_ARG(next_hop))
 );
 
+TRACE_EVENT(rdev_get_mpp,
+        TP_PROTO(struct wiphy *wiphy, struct net_device *netdev,
+                 u8 *dst, u8 *mpp),
+        TP_ARGS(wiphy, netdev, dst, mpp),
+        TP_STRUCT__entry(
+                WIPHY_ENTRY
+                NETDEV_ENTRY
+                MAC_ENTRY(dst)
+                MAC_ENTRY(mpp)
+        ),
+        TP_fast_assign(
+                WIPHY_ASSIGN;
+                NETDEV_ASSIGN;
+                MAC_ASSIGN(dst, dst);
+                MAC_ASSIGN(mpp, mpp);
+        ),
+        TP_printk(WIPHY_PR_FMT ", " NETDEV_PR_FMT ", destination: " MAC_PR_FMT
+                  ", mpp: " MAC_PR_FMT, WIPHY_PR_ARG, NETDEV_PR_ARG,
+                  MAC_PR_ARG(dst), MAC_PR_ARG(mpp))
+);
+
+TRACE_EVENT(rdev_dump_mpp,
+        TP_PROTO(struct wiphy *wiphy, struct net_device *netdev, int idx,
+                 u8 *dst, u8 *mpp),
+        TP_ARGS(wiphy, netdev, idx, mpp, dst),
+        TP_STRUCT__entry(
+                WIPHY_ENTRY
+                NETDEV_ENTRY
+                MAC_ENTRY(dst)
+                MAC_ENTRY(mpp)
+                __field(int, idx)
+        ),
+        TP_fast_assign(
+                WIPHY_ASSIGN;
+                NETDEV_ASSIGN;
+                MAC_ASSIGN(dst, dst);
+                MAC_ASSIGN(mpp, mpp);
+                __entry->idx = idx;
+        ),
+        TP_printk(WIPHY_PR_FMT ", " NETDEV_PR_FMT ", index: %d, destination: "
+                  MAC_PR_FMT ", mpp: " MAC_PR_FMT,
+                  WIPHY_PR_ARG, NETDEV_PR_ARG, __entry->idx, MAC_PR_ARG(dst),
+                  MAC_PR_ARG(mpp))
+);
+
 TRACE_EVENT(rdev_return_int_mpath_info,
         TP_PROTO(struct wiphy *wiphy, int ret, struct mpath_info *pinfo),
         TP_ARGS(wiphy, ret, pinfo),
@@ -1246,6 +1321,22 @@ TRACE_EVENT(rdev_join_ibss,
                   WIPHY_PR_ARG, NETDEV_PR_ARG, MAC_PR_ARG(bssid), __entry->ssid)
 );
 
+TRACE_EVENT(rdev_join_ocb,
+        TP_PROTO(struct wiphy *wiphy, struct net_device *netdev,
+                 const struct ocb_setup *setup),
+        TP_ARGS(wiphy, netdev, setup),
+        TP_STRUCT__entry(
+                WIPHY_ENTRY
+                NETDEV_ENTRY
+        ),
+        TP_fast_assign(
+                WIPHY_ASSIGN;
+                NETDEV_ASSIGN;
+        ),
+        TP_printk(WIPHY_PR_FMT ", " NETDEV_PR_FMT,
+                  WIPHY_PR_ARG, NETDEV_PR_ARG)
+);
+
 TRACE_EVENT(rdev_set_wiphy_params,
         TP_PROTO(struct wiphy *wiphy, u32 changed),
         TP_ARGS(wiphy, changed),
diff --git a/net/wireless/util.c b/net/wireless/util.c
index 5e233a577d0f..d0ac795445b7 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -442,7 +442,8 @@ int ieee80211_data_to_8023(struct sk_buff *skb, const u8 *addr,
                 break;
         case cpu_to_le16(0):
                 if (iftype != NL80211_IFTYPE_ADHOC &&
-                    iftype != NL80211_IFTYPE_STATION)
+                    iftype != NL80211_IFTYPE_STATION &&
+                    iftype != NL80211_IFTYPE_OCB)
                                 return -1;
                 break;
         }
@@ -519,6 +520,7 @@ int ieee80211_data_from_8023(struct sk_buff *skb, const u8 *addr,
                 memcpy(hdr.addr3, skb->data, ETH_ALEN);
                 hdrlen = 24;
                 break;
+        case NL80211_IFTYPE_OCB:
         case NL80211_IFTYPE_ADHOC:
                 /* DA SA BSSID */
                 memcpy(hdr.addr1, skb->data, ETH_ALEN);
@@ -937,6 +939,7 @@ int cfg80211_change_iface(struct cfg80211_registered_device *rdev,
                         if (dev->ieee80211_ptr->use_4addr)
                                 break;
                         /* fall through */
+                case NL80211_IFTYPE_OCB:
                 case NL80211_IFTYPE_P2P_CLIENT:
                 case NL80211_IFTYPE_ADHOC:
                         dev->priv_flags |= IFF_DONT_BRIDGE;