135 files changed, 13549 insertions, 7308 deletions

diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
index b661f47bf10a..f0e335aa20df 100644
--- a/net/8021q/vlan.c
+++ b/net/8021q/vlan.c
@@ -394,6 +394,7 @@ static void vlan_transfer_features(struct net_device *dev,
 
         vlandev->features &= ~dev->vlan_features;
         vlandev->features |= dev->features & dev->vlan_features;
+        vlandev->gso_max_size = dev->gso_max_size;
 
         if (old_features != vlandev->features)
                 netdev_features_change(vlandev);
diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index 4bf014e51f8c..8883e9c8a223 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -48,7 +48,7 @@ static int vlan_dev_rebuild_header(struct sk_buff *skb)
 
         switch (veth->h_vlan_encapsulated_proto) {
 #ifdef CONFIG_INET
-        case __constant_htons(ETH_P_IP):
+        case htons(ETH_P_IP):
 
                 /* TODO:  Confirm this will work with VLAN headers... */
                 return arp_find(veth->h_dest, skb);
@@ -607,6 +607,7 @@ static int vlan_dev_init(struct net_device *dev)
                       (1<<__LINK_STATE_PRESENT);
 
         dev->features |= real_dev->features & real_dev->vlan_features;
+        dev->gso_max_size = real_dev->gso_max_size;
 
         /* ipv6 shared card related stuff */
         dev->dev_id = real_dev->dev_id;
diff --git a/net/Kconfig b/net/Kconfig
index 7612cc8c337c..9103a16a77be 100644
--- a/net/Kconfig
+++ b/net/Kconfig
@@ -232,18 +232,23 @@ source "net/can/Kconfig"
 source "net/irda/Kconfig"
 source "net/bluetooth/Kconfig"
 source "net/rxrpc/Kconfig"
+source "net/phonet/Kconfig"
 
 config FIB_RULES
         bool
 
-menu "Wireless"
+menuconfig WIRELESS
+        bool "Wireless"
         depends on !S390
+        default y
+
+if WIRELESS
 
 source "net/wireless/Kconfig"
 source "net/mac80211/Kconfig"
 source "net/ieee80211/Kconfig"
 
-endmenu
+endif # WIRELESS
 
 source "net/rfkill/Kconfig"
 source "net/9p/Kconfig"
diff --git a/net/Makefile b/net/Makefile
index 4f43e7f874f3..acaf819f24aa 100644
--- a/net/Makefile
+++ b/net/Makefile
@@ -42,6 +42,7 @@ obj-$(CONFIG_AF_RXRPC)		+= rxrpc/
 obj-$(CONFIG_ATM)               += atm/
 obj-$(CONFIG_DECNET)            += decnet/
 obj-$(CONFIG_ECONET)            += econet/
+obj-$(CONFIG_PHONET)            += phonet/
 ifneq ($(CONFIG_VLAN_8021Q),)
 obj-y                           += 8021q/
 endif
diff --git a/net/atm/br2684.c b/net/atm/br2684.c
index 8d9a6f158880..280de481edc7 100644
--- a/net/atm/br2684.c
+++ b/net/atm/br2684.c
@@ -375,11 +375,11 @@ static void br2684_push(struct atm_vcc *atmvcc, struct sk_buff *skb)
                         if (memcmp
                             (skb->data + 6, ethertype_ipv6,
                              sizeof(ethertype_ipv6)) == 0)
-                                skb->protocol = __constant_htons(ETH_P_IPV6);
+                                skb->protocol = htons(ETH_P_IPV6);
                         else if (memcmp
                                  (skb->data + 6, ethertype_ipv4,
                                   sizeof(ethertype_ipv4)) == 0)
-                                skb->protocol = __constant_htons(ETH_P_IP);
+                                skb->protocol = htons(ETH_P_IP);
                         else
                                 goto error;
                         skb_pull(skb, sizeof(llc_oui_ipv4));
@@ -404,9 +404,9 @@ static void br2684_push(struct atm_vcc *atmvcc, struct sk_buff *skb)
                         skb_reset_network_header(skb);
                         iph = ip_hdr(skb);
                         if (iph->version == 4)
-                                skb->protocol = __constant_htons(ETH_P_IP);
+                                skb->protocol = htons(ETH_P_IP);
                         else if (iph->version == 6)
-                                skb->protocol = __constant_htons(ETH_P_IPV6);
+                                skb->protocol = htons(ETH_P_IPV6);
                         else
                                 goto error;
                         skb->pkt_type = PACKET_HOST;
diff --git a/net/atm/lec.c b/net/atm/lec.c
index 5799fb52365a..8f701cde5945 100644
--- a/net/atm/lec.c
+++ b/net/atm/lec.c
@@ -1931,7 +1931,6 @@ static struct atm_vcc *lec_arp_resolve(struct lec_priv *priv,
                 switch (priv->lane_version) {
                 case 1:
                         return priv->mcast_vcc;
-                        break;
                 case 2: /* LANE2 wants arp for multicast addresses */
                         if (!compare_ether_addr(mac_to_find, bus_mac))
                                 return priv->mcast_vcc;
diff --git a/net/bridge/br.c b/net/bridge/br.c
index 573acdf6f9ff..4d2c1f1cb524 100644
--- a/net/bridge/br.c
+++ b/net/bridge/br.c
@@ -28,6 +28,10 @@ static const struct stp_proto br_stp_proto = {
         .rcv    = br_stp_rcv,
 };
 
+static struct pernet_operations br_net_ops = {
+        .exit   = br_net_exit,
+};
+
 static int __init br_init(void)
 {
         int err;
@@ -42,18 +46,22 @@ static int __init br_init(void)
         if (err)
                 goto err_out;
 
-        err = br_netfilter_init();
+        err = register_pernet_subsys(&br_net_ops);
         if (err)
                 goto err_out1;
 
-        err = register_netdevice_notifier(&br_device_notifier);
+        err = br_netfilter_init();
         if (err)
                 goto err_out2;
 
-        err = br_netlink_init();
+        err = register_netdevice_notifier(&br_device_notifier);
         if (err)
                 goto err_out3;
 
+        err = br_netlink_init();
+        if (err)
+                goto err_out4;
+
         brioctl_set(br_ioctl_deviceless_stub);
         br_handle_frame_hook = br_handle_frame;
 
@@ -61,10 +69,12 @@ static int __init br_init(void)
         br_fdb_put_hook = br_fdb_put;
 
         return 0;
-err_out3:
+err_out4:
         unregister_netdevice_notifier(&br_device_notifier);
-err_out2:
+err_out3:
         br_netfilter_fini();
+err_out2:
+        unregister_pernet_subsys(&br_net_ops);
 err_out1:
         br_fdb_fini();
 err_out:
@@ -80,7 +90,7 @@ static void __exit br_deinit(void)
         unregister_netdevice_notifier(&br_device_notifier);
         brioctl_set(NULL);
 
-        br_cleanup_bridges();
+        unregister_pernet_subsys(&br_net_ops);
 
         synchronize_net();
 
diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index 4f52c3d50ebe..22ba8632196f 100644
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -178,5 +178,6 @@ void br_dev_setup(struct net_device *dev)
         dev->priv_flags = IFF_EBRIDGE;
 
         dev->features = NETIF_F_SG | NETIF_F_FRAGLIST | NETIF_F_HIGHDMA |
-                        NETIF_F_GSO_MASK | NETIF_F_NO_CSUM | NETIF_F_LLTX;
+                        NETIF_F_GSO_MASK | NETIF_F_NO_CSUM | NETIF_F_LLTX |
+                        NETIF_F_NETNS_LOCAL;
 }
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index 63c18aacde8c..573e20f7dba4 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -168,7 +168,7 @@ static void del_br(struct net_bridge *br)
         unregister_netdevice(br->dev);
 }
 
-static struct net_device *new_bridge_dev(const char *name)
+static struct net_device *new_bridge_dev(struct net *net, const char *name)
 {
         struct net_bridge *br;
         struct net_device *dev;
@@ -178,6 +178,7 @@ static struct net_device *new_bridge_dev(const char *name)
 
         if (!dev)
                 return NULL;
+        dev_net_set(dev, net);
 
         br = netdev_priv(dev);
         br->dev = dev;
@@ -262,12 +263,12 @@ static struct net_bridge_port *new_nbp(struct net_bridge *br,
         return p;
 }
 
-int br_add_bridge(const char *name)
+int br_add_bridge(struct net *net, const char *name)
 {
         struct net_device *dev;
         int ret;
 
-        dev = new_bridge_dev(name);
+        dev = new_bridge_dev(net, name);
         if (!dev)
                 return -ENOMEM;
 
@@ -294,13 +295,13 @@ out_free:
         goto out;
 }
 
-int br_del_bridge(const char *name)
+int br_del_bridge(struct net *net, const char *name)
 {
         struct net_device *dev;
         int ret = 0;
 
         rtnl_lock();
-        dev = __dev_get_by_name(&init_net, name);
+        dev = __dev_get_by_name(net, name);
         if (dev == NULL)
                 ret =  -ENXIO;  /* Could not find device */
 
@@ -445,13 +446,13 @@ int br_del_if(struct net_bridge *br, struct net_device *dev)
         return 0;
 }
 
-void __exit br_cleanup_bridges(void)
+void br_net_exit(struct net *net)
 {
         struct net_device *dev;
 
         rtnl_lock();
 restart:
-        for_each_netdev(&init_net, dev) {
+        for_each_netdev(net, dev) {
                 if (dev->priv_flags & IFF_EBRIDGE) {
                         del_br(dev->priv);
                         goto restart;
diff --git a/net/bridge/br_ioctl.c b/net/bridge/br_ioctl.c
index 5bbf07362172..6a6433daaf27 100644
--- a/net/bridge/br_ioctl.c
+++ b/net/bridge/br_ioctl.c
@@ -21,12 +21,12 @@
 #include "br_private.h"
 
 /* called with RTNL */
-static int get_bridge_ifindices(int *indices, int num)
+static int get_bridge_ifindices(struct net *net, int *indices, int num)
 {
         struct net_device *dev;
         int i = 0;
 
-        for_each_netdev(&init_net, dev) {
+        for_each_netdev(net, dev) {
                 if (i >= num)
                         break;
                 if (dev->priv_flags & IFF_EBRIDGE)
@@ -89,7 +89,7 @@ static int add_del_if(struct net_bridge *br, int ifindex, int isadd)
         if (!capable(CAP_NET_ADMIN))
                 return -EPERM;
 
-        dev = dev_get_by_index(&init_net, ifindex);
+        dev = dev_get_by_index(dev_net(br->dev), ifindex);
         if (dev == NULL)
                 return -EINVAL;
 
@@ -315,7 +315,7 @@ static int old_dev_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
         return -EOPNOTSUPP;
 }
 
-static int old_deviceless(void __user *uarg)
+static int old_deviceless(struct net *net, void __user *uarg)
 {
         unsigned long args[3];
 
@@ -337,7 +337,7 @@ static int old_deviceless(void __user *uarg)
                 if (indices == NULL)
                         return -ENOMEM;
 
-                args[2] = get_bridge_ifindices(indices, args[2]);
+                args[2] = get_bridge_ifindices(net, indices, args[2]);
 
                 ret = copy_to_user((void __user *)args[1], indices, args[2]*sizeof(int))
                         ? -EFAULT : args[2];
@@ -360,9 +360,9 @@ static int old_deviceless(void __user *uarg)
                 buf[IFNAMSIZ-1] = 0;
 
                 if (args[0] == BRCTL_ADD_BRIDGE)
-                        return br_add_bridge(buf);
+                        return br_add_bridge(net, buf);
 
-                return br_del_bridge(buf);
+                return br_del_bridge(net, buf);
         }
         }
 
@@ -374,7 +374,7 @@ int br_ioctl_deviceless_stub(struct net *net, unsigned int cmd, void __user *uar
         switch (cmd) {
         case SIOCGIFBR:
         case SIOCSIFBR:
-                return old_deviceless(uarg);
+                return old_deviceless(net, uarg);
 
         case SIOCBRADDBR:
         case SIOCBRDELBR:
@@ -389,9 +389,9 @@ int br_ioctl_deviceless_stub(struct net *net, unsigned int cmd, void __user *uar
 
                 buf[IFNAMSIZ-1] = 0;
                 if (cmd == SIOCBRADDBR)
-                        return br_add_bridge(buf);
+                        return br_add_bridge(net, buf);
 
-                return br_del_bridge(buf);
+                return br_del_bridge(net, buf);
         }
         }
         return -EOPNOTSUPP;
diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
index f155e6ce8a21..ba7be195803c 100644
--- a/net/bridge/br_netlink.c
+++ b/net/bridge/br_netlink.c
@@ -82,6 +82,7 @@ nla_put_failure:
  */
 void br_ifinfo_notify(int event, struct net_bridge_port *port)
 {
+        struct net *net = dev_net(port->dev);
         struct sk_buff *skb;
         int err = -ENOBUFS;
 
@@ -97,10 +98,10 @@ void br_ifinfo_notify(int event, struct net_bridge_port *port)
                 kfree_skb(skb);
                 goto errout;
         }
-        err = rtnl_notify(skb, &init_net,0, RTNLGRP_LINK, NULL, GFP_ATOMIC);
+        err = rtnl_notify(skb, net, 0, RTNLGRP_LINK, NULL, GFP_ATOMIC);
 errout:
         if (err < 0)
-                rtnl_set_sk_err(&init_net, RTNLGRP_LINK, err);
+                rtnl_set_sk_err(net, RTNLGRP_LINK, err);
 }
 
 /*
@@ -112,11 +113,8 @@ static int br_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
         struct net_device *dev;
         int idx;
 
-        if (net != &init_net)
-                return 0;
-
         idx = 0;
-        for_each_netdev(&init_net, dev) {
+        for_each_netdev(net, dev) {
                 /* not a bridge port */
                 if (dev->br_port == NULL || idx < cb->args[0])
                         goto skip;
@@ -147,9 +145,6 @@ static int br_rtm_setlink(struct sk_buff *skb,  struct nlmsghdr *nlh, void *arg)
         struct net_bridge_port *p;
         u8 new_state;
 
-        if (net != &init_net)
-                return -EINVAL;
-
         if (nlmsg_len(nlh) < sizeof(*ifm))
                 return -EINVAL;
 
@@ -165,7 +160,7 @@ static int br_rtm_setlink(struct sk_buff *skb,  struct nlmsghdr *nlh, void *arg)
         if (new_state > BR_STATE_BLOCKING)
                 return -EINVAL;
 
-        dev = __dev_get_by_index(&init_net, ifm->ifi_index);
+        dev = __dev_get_by_index(net, ifm->ifi_index);
         if (!dev)
                 return -ENODEV;
 
diff --git a/net/bridge/br_notify.c b/net/bridge/br_notify.c
index 76340bdd052e..763a3ec292e5 100644
--- a/net/bridge/br_notify.c
+++ b/net/bridge/br_notify.c
@@ -35,9 +35,6 @@ static int br_device_event(struct notifier_block *unused, unsigned long event, v
         struct net_bridge_port *p = dev->br_port;
         struct net_bridge *br;
 
-        if (!net_eq(dev_net(dev), &init_net))
-                return NOTIFY_DONE;
-
         /* not a port of a bridge */
         if (p == NULL)
                 return NOTIFY_DONE;
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index c3dc18ddc043..b6c3b71974dc 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -178,9 +178,9 @@ extern void br_flood_forward(struct net_bridge *br, struct sk_buff *skb);
 
 /* br_if.c */
 extern void br_port_carrier_check(struct net_bridge_port *p);
-extern int br_add_bridge(const char *name);
-extern int br_del_bridge(const char *name);
-extern void br_cleanup_bridges(void);
+extern int br_add_bridge(struct net *net, const char *name);
+extern int br_del_bridge(struct net *net, const char *name);
+extern void br_net_exit(struct net *net);
 extern int br_add_if(struct net_bridge *br,
               struct net_device *dev);
 extern int br_del_if(struct net_bridge *br,
diff --git a/net/bridge/br_stp_bpdu.c b/net/bridge/br_stp_bpdu.c
index 8b200f96f722..81ae40b3f655 100644
--- a/net/bridge/br_stp_bpdu.c
+++ b/net/bridge/br_stp_bpdu.c
@@ -140,9 +140,6 @@ void br_stp_rcv(const struct stp_proto *proto, struct sk_buff *skb,
         struct net_bridge *br;
         const unsigned char *buf;
 
-        if (!net_eq(dev_net(dev), &init_net))
-                goto err;
-
         if (!p)
                 goto err;
 
diff --git a/net/core/Makefile b/net/core/Makefile
index b1332f6d0042..26a37cb31923 100644
--- a/net/core/Makefile
+++ b/net/core/Makefile
@@ -6,6 +6,7 @@ obj-y := sock.o request_sock.o skbuff.o iovec.o datagram.o stream.o scm.o \
          gen_stats.o gen_estimator.o net_namespace.o
 
 obj-$(CONFIG_SYSCTL) += sysctl_net_core.o
+obj-$(CONFIG_HAS_DMA) += skb_dma_map.o
 
 obj-y                += dev.o ethtool.o dev_mcast.o dst.o netevent.o \
                         neighbour.o rtnetlink.o utils.o link_watch.o filter.o
diff --git a/net/core/dev.c b/net/core/dev.c
index e8eb2b478344..7091040e32ac 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -891,7 +891,7 @@ int dev_alloc_name(struct net_device *dev, const char *name)
  *      Change name of a device, can pass format strings "eth%d".
  *      for wildcarding.
  */
-int dev_change_name(struct net_device *dev, char *newname)
+int dev_change_name(struct net_device *dev, const char *newname)
 {
         char oldname[IFNAMSIZ];
         int err = 0;
@@ -917,7 +917,6 @@ int dev_change_name(struct net_device *dev, char *newname)
                 err = dev_alloc_name(dev, newname);
                 if (err < 0)
                         return err;
-                strcpy(newname, dev->name);
         }
         else if (__dev_get_by_name(net, newname))
                 return -EEXIST;
@@ -955,6 +954,38 @@ rollback:
 }
 
 /**
+ *      dev_set_alias - change ifalias of a device
+ *      @dev: device
+ *      @alias: name up to IFALIASZ
+ *      @len: limit of bytes to copy from info
+ *
+ *      Set ifalias for a device,
+ */
+int dev_set_alias(struct net_device *dev, const char *alias, size_t len)
+{
+        ASSERT_RTNL();
+
+        if (len >= IFALIASZ)
+                return -EINVAL;
+
+        if (!len) {
+                if (dev->ifalias) {
+                        kfree(dev->ifalias);
+                        dev->ifalias = NULL;
+                }
+                return 0;
+        }
+
+        dev->ifalias = krealloc(dev->ifalias, len+1, GFP_KERNEL);
+        if (!dev->ifalias)
+                return -ENOMEM;
+
+        strlcpy(dev->ifalias, alias, len+1);
+        return len;
+}
+
+
+/**
  *      netdev_features_change - device changes features
  *      @dev: device to cause notification
  *
@@ -1676,14 +1707,14 @@ static u16 simple_tx_hash(struct net_device *dev, struct sk_buff *skb)
         }
 
         switch (skb->protocol) {
-        case __constant_htons(ETH_P_IP):
+        case htons(ETH_P_IP):
                 if (!(ip_hdr(skb)->frag_off & htons(IP_MF | IP_OFFSET)))
                         ip_proto = ip_hdr(skb)->protocol;
                 addr1 = ip_hdr(skb)->saddr;
                 addr2 = ip_hdr(skb)->daddr;
                 ihl = ip_hdr(skb)->ihl;
                 break;
-        case __constant_htons(ETH_P_IPV6):
+        case htons(ETH_P_IPV6):
                 ip_proto = ipv6_hdr(skb)->nexthdr;
                 addr1 = ipv6_hdr(skb)->saddr.s6_addr32[3];
                 addr2 = ipv6_hdr(skb)->daddr.s6_addr32[3];
@@ -3302,6 +3333,12 @@ static void dev_addr_discard(struct net_device *dev)
         netif_addr_unlock_bh(dev);
 }
 
+/**
+ *      dev_get_flags - get flags reported to userspace
+ *      @dev: device
+ *
+ *      Get the combination of flag bits exported through APIs to userspace.
+ */
 unsigned dev_get_flags(const struct net_device *dev)
 {
         unsigned flags;
@@ -3326,6 +3363,14 @@ unsigned dev_get_flags(const struct net_device *dev)
         return flags;
 }
 
+/**
+ *      dev_change_flags - change device settings
+ *      @dev: device
+ *      @flags: device state flags
+ *
+ *      Change settings on device based state flags. The flags are
+ *      in the userspace exported format.
+ */
 int dev_change_flags(struct net_device *dev, unsigned flags)
 {
         int ret, changes;
@@ -3395,6 +3440,13 @@ int dev_change_flags(struct net_device *dev, unsigned flags)
         return ret;
 }
 
+/**
+ *      dev_set_mtu - Change maximum transfer unit
+ *      @dev: device
+ *      @new_mtu: new transfer unit
+ *
+ *      Change the maximum transfer size of the network device.
+ */
 int dev_set_mtu(struct net_device *dev, int new_mtu)
 {
         int err;
@@ -3419,6 +3471,13 @@ int dev_set_mtu(struct net_device *dev, int new_mtu)
         return err;
 }
 
+/**
+ *      dev_set_mac_address - Change Media Access Control Address
+ *      @dev: device
+ *      @sa: new address
+ *
+ *      Change the hardware (MAC) address of the device
+ */
 int dev_set_mac_address(struct net_device *dev, struct sockaddr *sa)
 {
         int err;
@@ -4322,7 +4381,12 @@ void free_netdev(struct net_device *dev)
         put_device(&dev->dev);
 }
 
-/* Synchronize with packet receive processing. */
+/**
+ *      synchronize_net -  Synchronize with packet receive processing
+ *
+ *      Wait for packets currently being received to be done.
+ *      Does not block later packets from starting.
+ */
 void synchronize_net(void)
 {
         might_sleep();
@@ -4624,7 +4688,7 @@ netdev_dma_event(struct dma_client *client, struct dma_chan *chan,
 }
 
 /**
- * netdev_dma_regiser - register the networking subsystem as a DMA client
+ * netdev_dma_register - register the networking subsystem as a DMA client
  */
 static int __init netdev_dma_register(void)
 {
@@ -4670,6 +4734,12 @@ int netdev_compute_features(unsigned long all, unsigned long one)
                 one |= NETIF_F_GSO_SOFTWARE;
         one |= NETIF_F_GSO;
 
+        /*
+         * If even one device supports a GSO protocol with software fallback,
+         * enable it for all.
+         */
+        all |= one & NETIF_F_GSO_SOFTWARE;
+
         /* If even one device supports robust GSO, enable it for all. */
         if (one & NETIF_F_GSO_ROBUST)
                 all |= NETIF_F_GSO_ROBUST;
@@ -4719,10 +4789,18 @@ err_name:
         return -ENOMEM;
 }
 
-char *netdev_drivername(struct net_device *dev, char *buffer, int len)
+/**
+ *      netdev_drivername - network driver for the device
+ *      @dev: network device
+ *      @buffer: buffer for resulting name
+ *      @len: size of buffer
+ *
+ *      Determine network driver for device.
+ */
+char *netdev_drivername(const struct net_device *dev, char *buffer, int len)
 {
-        struct device_driver *driver;
-        struct device *parent;
+        const struct device_driver *driver;
+        const struct device *parent;
 
         if (len <= 0 || !buffer)
                 return buffer;
diff --git a/net/core/dst.c b/net/core/dst.c
index fe03266130b6..09c1530f4681 100644
--- a/net/core/dst.c
+++ b/net/core/dst.c
@@ -203,6 +203,7 @@ void __dst_free(struct dst_entry * dst)
         if (dst_garbage.timer_inc > DST_GC_INC) {
                 dst_garbage.timer_inc = DST_GC_INC;
                 dst_garbage.timer_expires = DST_GC_MIN;
+                cancel_delayed_work(&dst_gc_work);
                 schedule_delayed_work(&dst_gc_work, dst_garbage.timer_expires);
         }
         spin_unlock_bh(&dst_garbage.lock);
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 9d92e41826e7..1dc728b38589 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -927,8 +927,7 @@ int __neigh_event_send(struct neighbour *neigh, struct sk_buff *skb)
                         if (skb_queue_len(&neigh->arp_queue) >=
                             neigh->parms->queue_len) {
                                 struct sk_buff *buff;
-                                buff = neigh->arp_queue.next;
-                                __skb_unlink(buff, &neigh->arp_queue);
+                                buff = __skb_dequeue(&neigh->arp_queue);
                                 kfree_skb(buff);
                                 NEIGH_CACHE_STAT_INC(neigh->tbl, unres_discards);
                         }
@@ -1259,24 +1258,20 @@ static void neigh_proxy_process(unsigned long arg)
         struct neigh_table *tbl = (struct neigh_table *)arg;
         long sched_next = 0;
         unsigned long now = jiffies;
-        struct sk_buff *skb;
+        struct sk_buff *skb, *n;
 
         spin_lock(&tbl->proxy_queue.lock);
 
-        skb = tbl->proxy_queue.next;
-
-        while (skb != (struct sk_buff *)&tbl->proxy_queue) {
-                struct sk_buff *back = skb;
-                long tdif = NEIGH_CB(back)->sched_next - now;
+        skb_queue_walk_safe(&tbl->proxy_queue, skb, n) {
+                long tdif = NEIGH_CB(skb)->sched_next - now;
 
-                skb = skb->next;
                 if (tdif <= 0) {
-                        struct net_device *dev = back->dev;
-                        __skb_unlink(back, &tbl->proxy_queue);
+                        struct net_device *dev = skb->dev;
+                        __skb_unlink(skb, &tbl->proxy_queue);
                         if (tbl->proxy_redo && netif_running(dev))
-                                tbl->proxy_redo(back);
+                                tbl->proxy_redo(skb);
                         else
-                                kfree_skb(back);
+                                kfree_skb(skb);
 
                         dev_put(dev);
                 } else if (!sched_next || tdif < sched_next)
diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
index c1f4e0d428c0..92d6b9467314 100644
--- a/net/core/net-sysfs.c
+++ b/net/core/net-sysfs.c
@@ -209,9 +209,44 @@ static ssize_t store_tx_queue_len(struct device *dev,
         return netdev_store(dev, attr, buf, len, change_tx_queue_len);
 }
 
+static ssize_t store_ifalias(struct device *dev, struct device_attribute *attr,
+                             const char *buf, size_t len)
+{
+        struct net_device *netdev = to_net_dev(dev);
+        size_t count = len;
+        ssize_t ret;
+
+        if (!capable(CAP_NET_ADMIN))
+                return -EPERM;
+
+        /* ignore trailing newline */
+        if (len >  0 && buf[len - 1] == '\n')
+                --count;
+
+        rtnl_lock();
+        ret = dev_set_alias(netdev, buf, count);
+        rtnl_unlock();
+
+        return ret < 0 ? ret : len;
+}
+
+static ssize_t show_ifalias(struct device *dev,
+                            struct device_attribute *attr, char *buf)
+{
+        const struct net_device *netdev = to_net_dev(dev);
+        ssize_t ret = 0;
+
+        rtnl_lock();
+        if (netdev->ifalias)
+                ret = sprintf(buf, "%s\n", netdev->ifalias);
+        rtnl_unlock();
+        return ret;
+}
+
 static struct device_attribute net_class_attributes[] = {
         __ATTR(addr_len, S_IRUGO, show_addr_len, NULL),
         __ATTR(dev_id, S_IRUGO, show_dev_id, NULL),
+        __ATTR(ifalias, S_IRUGO | S_IWUSR, show_ifalias, store_ifalias),
         __ATTR(iflink, S_IRUGO, show_iflink, NULL),
         __ATTR(ifindex, S_IRUGO, show_ifindex, NULL),
         __ATTR(features, S_IRUGO, show_features, NULL),
@@ -418,6 +453,7 @@ static void netdev_release(struct device *d)
 
         BUG_ON(dev->reg_state != NETREG_RELEASED);
 
+        kfree(dev->ifalias);
         kfree((char *)dev - dev->padded);
 }
 
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 71edb8b36341..8862498fd4a6 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -586,6 +586,7 @@ static inline size_t if_nlmsg_size(const struct net_device *dev)
 {
         return NLMSG_ALIGN(sizeof(struct ifinfomsg))
                + nla_total_size(IFNAMSIZ) /* IFLA_IFNAME */
+               + nla_total_size(IFALIASZ) /* IFLA_IFALIAS */
                + nla_total_size(IFNAMSIZ) /* IFLA_QDISC */
                + nla_total_size(sizeof(struct rtnl_link_ifmap))
                + nla_total_size(sizeof(struct rtnl_link_stats))
@@ -640,6 +641,9 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb, struct net_device *dev,
         if (txq->qdisc_sleeping)
                 NLA_PUT_STRING(skb, IFLA_QDISC, txq->qdisc_sleeping->ops->id);
 
+        if (dev->ifalias)
+                NLA_PUT_STRING(skb, IFLA_IFALIAS, dev->ifalias);
+
         if (1) {
                 struct rtnl_link_ifmap map = {
                         .mem_start   = dev->mem_start,
@@ -713,6 +717,7 @@ const struct nla_policy ifla_policy[IFLA_MAX+1] = {
         [IFLA_LINKMODE]         = { .type = NLA_U8 },
         [IFLA_LINKINFO]         = { .type = NLA_NESTED },
         [IFLA_NET_NS_PID]       = { .type = NLA_U32 },
+        [IFLA_IFALIAS]          = { .type = NLA_STRING, .len = IFALIASZ-1 },
 };
 
 static const struct nla_policy ifla_info_policy[IFLA_INFO_MAX+1] = {
@@ -853,6 +858,14 @@ static int do_setlink(struct net_device *dev, struct ifinfomsg *ifm,
                 modified = 1;
         }
 
+        if (tb[IFLA_IFALIAS]) {
+                err = dev_set_alias(dev, nla_data(tb[IFLA_IFALIAS]),
+                                    nla_len(tb[IFLA_IFALIAS]));
+                if (err < 0)
+                        goto errout;
+                modified = 1;
+        }
+
         if (tb[IFLA_BROADCAST]) {
                 nla_memcpy(dev->broadcast, tb[IFLA_BROADCAST], dev->addr_len);
                 send_addr_notify = 1;
diff --git a/net/core/skb_dma_map.c b/net/core/skb_dma_map.c
new file mode 100644
index 000000000000..1f49afcd8e86
--- /dev/null
+++ b/net/core/skb_dma_map.c
@@ -0,0 +1,66 @@
+/* skb_dma_map.c: DMA mapping helpers for socket buffers.
+ *
+ * Copyright (C) David S. Miller <davem@davemloft.net>
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/dma-mapping.h>
+#include <linux/skbuff.h>
+
+int skb_dma_map(struct device *dev, struct sk_buff *skb,
+                enum dma_data_direction dir)
+{
+        struct skb_shared_info *sp = skb_shinfo(skb);
+        dma_addr_t map;
+        int i;
+
+        map = dma_map_single(dev, skb->data,
+                             skb_headlen(skb), dir);
+        if (dma_mapping_error(dev, map))
+                goto out_err;
+
+        sp->dma_maps[0] = map;
+        for (i = 0; i < sp->nr_frags; i++) {
+                skb_frag_t *fp = &sp->frags[i];
+
+                map = dma_map_page(dev, fp->page, fp->page_offset,
+                                   fp->size, dir);
+                if (dma_mapping_error(dev, map))
+                        goto unwind;
+                sp->dma_maps[i + 1] = map;
+        }
+        sp->num_dma_maps = i + 1;
+
+        return 0;
+
+unwind:
+        while (i-- >= 0) {
+                skb_frag_t *fp = &sp->frags[i];
+
+                dma_unmap_page(dev, sp->dma_maps[i + 1],
+                               fp->size, dir);
+        }
+        dma_unmap_single(dev, sp->dma_maps[0],
+                         skb_headlen(skb), dir);
+out_err:
+        return -ENOMEM;
+}
+EXPORT_SYMBOL(skb_dma_map);
+
+void skb_dma_unmap(struct device *dev, struct sk_buff *skb,
+                   enum dma_data_direction dir)
+{
+        struct skb_shared_info *sp = skb_shinfo(skb);
+        int i;
+
+        dma_unmap_single(dev, sp->dma_maps[0],
+                         skb_headlen(skb), dir);
+        for (i = 0; i < sp->nr_frags; i++) {
+                skb_frag_t *fp = &sp->frags[i];
+
+                dma_unmap_page(dev, sp->dma_maps[i + 1],
+                               fp->size, dir);
+        }
+}
+EXPORT_SYMBOL(skb_dma_unmap);
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index ca1ccdf1ef76..2c218a0808b4 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -363,8 +363,7 @@ static void kfree_skbmem(struct sk_buff *skb)
         }
 }
 
-/* Free everything but the sk_buff shell. */
-static void skb_release_all(struct sk_buff *skb)
+static void skb_release_head_state(struct sk_buff *skb)
 {
         dst_release(skb->dst);
 #ifdef CONFIG_XFRM
@@ -388,6 +387,12 @@ static void skb_release_all(struct sk_buff *skb)
         skb->tc_verd = 0;
 #endif
 #endif
+}
+
+/* Free everything but the sk_buff shell. */
+static void skb_release_all(struct sk_buff *skb)
+{
+        skb_release_head_state(skb);
         skb_release_data(skb);
 }
 
@@ -424,6 +429,38 @@ void kfree_skb(struct sk_buff *skb)
         __kfree_skb(skb);
 }
 
+int skb_recycle_check(struct sk_buff *skb, int skb_size)
+{
+        struct skb_shared_info *shinfo;
+
+        if (skb_is_nonlinear(skb) || skb->fclone != SKB_FCLONE_UNAVAILABLE)
+                return 0;
+
+        skb_size = SKB_DATA_ALIGN(skb_size + NET_SKB_PAD);
+        if (skb_end_pointer(skb) - skb->head < skb_size)
+                return 0;
+
+        if (skb_shared(skb) || skb_cloned(skb))
+                return 0;
+
+        skb_release_head_state(skb);
+        shinfo = skb_shinfo(skb);
+        atomic_set(&shinfo->dataref, 1);
+        shinfo->nr_frags = 0;
+        shinfo->gso_size = 0;
+        shinfo->gso_segs = 0;
+        shinfo->gso_type = 0;
+        shinfo->ip6_frag_id = 0;
+        shinfo->frag_list = NULL;
+
+        memset(skb, 0, offsetof(struct sk_buff, tail));
+        skb_reset_tail_pointer(skb);
+        skb->data = skb->head + NET_SKB_PAD;
+
+        return 1;
+}
+EXPORT_SYMBOL(skb_recycle_check);
+
 static void __copy_skb_header(struct sk_buff *new, const struct sk_buff *old)
 {
         new->tstamp             = old->tstamp;
diff --git a/net/core/sock.c b/net/core/sock.c
index 91f8bbc93526..2d358dd8a03e 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -154,7 +154,8 @@ static const char *af_family_key_strings[AF_MAX+1] = {
   "sk_lock-AF_PPPOX" , "sk_lock-AF_WANPIPE"  , "sk_lock-AF_LLC"      ,
   "sk_lock-27"       , "sk_lock-28"          , "sk_lock-AF_CAN"      ,
   "sk_lock-AF_TIPC"  , "sk_lock-AF_BLUETOOTH", "sk_lock-IUCV"        ,
-  "sk_lock-AF_RXRPC" , "sk_lock-AF_MAX"
+  "sk_lock-AF_RXRPC" , "sk_lock-AF_ISDN"     , "sk_lock-AF_PHONET"   ,
+  "sk_lock-AF_MAX"
 };
 static const char *af_family_slock_key_strings[AF_MAX+1] = {
   "slock-AF_UNSPEC", "slock-AF_UNIX"     , "slock-AF_INET"     ,
@@ -168,7 +169,8 @@ static const char *af_family_slock_key_strings[AF_MAX+1] = {
   "slock-AF_PPPOX" , "slock-AF_WANPIPE"  , "slock-AF_LLC"      ,
   "slock-27"       , "slock-28"          , "slock-AF_CAN"      ,
   "slock-AF_TIPC"  , "slock-AF_BLUETOOTH", "slock-AF_IUCV"     ,
-  "slock-AF_RXRPC" , "slock-AF_MAX"
+  "slock-AF_RXRPC" , "slock-AF_ISDN"     , "slock-AF_PHONET"   ,
+  "slock-AF_MAX"
 };
 static const char *af_family_clock_key_strings[AF_MAX+1] = {
   "clock-AF_UNSPEC", "clock-AF_UNIX"     , "clock-AF_INET"     ,
@@ -182,7 +184,8 @@ static const char *af_family_clock_key_strings[AF_MAX+1] = {
   "clock-AF_PPPOX" , "clock-AF_WANPIPE"  , "clock-AF_LLC"      ,
   "clock-27"       , "clock-28"          , "clock-AF_CAN"      ,
   "clock-AF_TIPC"  , "clock-AF_BLUETOOTH", "clock-AF_IUCV"     ,
-  "clock-AF_RXRPC" , "clock-AF_MAX"
+  "clock-AF_RXRPC" , "clock-AF_ISDN"     , "clock-AF_PHONET"   ,
+  "clock-AF_MAX"
 };
 #endif
 
diff --git a/net/dccp/ccids/ccid2.c b/net/dccp/ccids/ccid2.c
index 8e9580874216..9a430734530c 100644
--- a/net/dccp/ccids/ccid2.c
+++ b/net/dccp/ccids/ccid2.c
@@ -783,7 +783,7 @@ static struct ccid_operations ccid2 = {
 };
 
 #ifdef CONFIG_IP_DCCP_CCID2_DEBUG
-module_param(ccid2_debug, bool, 0444);
+module_param(ccid2_debug, bool, 0644);
 MODULE_PARM_DESC(ccid2_debug, "Enable debug messages");
 #endif
 
diff --git a/net/dccp/ccids/ccid3.c b/net/dccp/ccids/ccid3.c
index f6756e0c9e69..3b8bd7ca6761 100644
--- a/net/dccp/ccids/ccid3.c
+++ b/net/dccp/ccids/ccid3.c
@@ -963,7 +963,7 @@ static struct ccid_operations ccid3 = {
 };
 
 #ifdef CONFIG_IP_DCCP_CCID3_DEBUG
-module_param(ccid3_debug, bool, 0444);
+module_param(ccid3_debug, bool, 0644);
 MODULE_PARM_DESC(ccid3_debug, "Enable debug messages");
 #endif
 
diff --git a/net/dccp/ccids/lib/loss_interval.c b/net/dccp/ccids/lib/loss_interval.c
index bcd6ac415bb9..5b3ce0688c5c 100644
--- a/net/dccp/ccids/lib/loss_interval.c
+++ b/net/dccp/ccids/lib/loss_interval.c
@@ -67,7 +67,10 @@ static void tfrc_lh_calc_i_mean(struct tfrc_loss_hist *lh)
         u32 i_i, i_tot0 = 0, i_tot1 = 0, w_tot = 0;
         int i, k = tfrc_lh_length(lh) - 1; /* k is as in rfc3448bis, 5.4 */
 
-        for (i=0; i <= k; i++) {
+        if (k <= 0)
+                return;
+
+        for (i = 0; i <= k; i++) {
                 i_i = tfrc_lh_get_interval(lh, i);
 
                 if (i < k) {
@@ -78,7 +81,6 @@ static void tfrc_lh_calc_i_mean(struct tfrc_loss_hist *lh)
                         i_tot1 += i_i * tfrc_lh_weights[i-1];
         }
 
-        BUG_ON(w_tot == 0);
         lh->i_mean = max(i_tot0, i_tot1) / w_tot;
 }
 
diff --git a/net/dccp/ccids/lib/tfrc.c b/net/dccp/ccids/lib/tfrc.c
index 97ecec0a8e76..185916218e07 100644
--- a/net/dccp/ccids/lib/tfrc.c
+++ b/net/dccp/ccids/lib/tfrc.c
@@ -10,7 +10,7 @@
 
 #ifdef CONFIG_IP_DCCP_TFRC_DEBUG
 int tfrc_debug;
-module_param(tfrc_debug, bool, 0444);
+module_param(tfrc_debug, bool, 0644);
 MODULE_PARM_DESC(tfrc_debug, "Enable debug messages");
 #endif
 
diff --git a/net/dccp/input.c b/net/dccp/input.c
index 803933ab396d..779d0ed9ae94 100644
--- a/net/dccp/input.c
+++ b/net/dccp/input.c
@@ -370,7 +370,7 @@ int dccp_rcv_established(struct sock *sk, struct sk_buff *skb,
                 goto discard;
 
         if (dccp_parse_options(sk, NULL, skb))
-                goto discard;
+                return 1;
 
         if (DCCP_SKB_CB(skb)->dccpd_ack_seq != DCCP_PKT_WITHOUT_ACK_SEQ)
                 dccp_event_ack_recv(sk, skb);
@@ -610,7 +610,7 @@ int dccp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
                  * Step 8: Process options and mark acknowledgeable
                  */
                 if (dccp_parse_options(sk, NULL, skb))
-                        goto discard;
+                        return 1;
 
                 if (dcb->dccpd_ack_seq != DCCP_PKT_WITHOUT_ACK_SEQ)
                         dccp_event_ack_recv(sk, skb);
diff --git a/net/dccp/options.c b/net/dccp/options.c
index dc7c158a2f4b..0809b63cb055 100644
--- a/net/dccp/options.c
+++ b/net/dccp/options.c
@@ -81,11 +81,11 @@ int dccp_parse_options(struct sock *sk, struct dccp_request_sock *dreq,
                 /* Check if this isn't a single byte option */
                 if (opt > DCCPO_MAX_RESERVED) {
                         if (opt_ptr == opt_end)
-                                goto out_invalid_option;
+                                goto out_nonsensical_length;
 
                         len = *opt_ptr++;
-                        if (len < 3)
-                                goto out_invalid_option;
+                        if (len < 2)
+                                goto out_nonsensical_length;
                         /*
                          * Remove the type and len fields, leaving
                          * just the value size
@@ -95,7 +95,7 @@ int dccp_parse_options(struct sock *sk, struct dccp_request_sock *dreq,
                         opt_ptr += len;
 
                         if (opt_ptr > opt_end)
-                                goto out_invalid_option;
+                                goto out_nonsensical_length;
                 }
 
                 /*
@@ -283,12 +283,17 @@ ignore_option:
         if (mandatory)
                 goto out_invalid_option;
 
+out_nonsensical_length:
+        /* RFC 4340, 5.8: ignore option and all remaining option space */
         return 0;
 
 out_invalid_option:
         DCCP_INC_STATS_BH(DCCP_MIB_INVALIDOPT);
         DCCP_SKB_CB(skb)->dccpd_reset_code = DCCP_RESET_CODE_OPTION_ERROR;
         DCCP_WARN("DCCP(%p): invalid option %d, len=%d", sk, opt, len);
+        DCCP_SKB_CB(skb)->dccpd_reset_data[0] = opt;
+        DCCP_SKB_CB(skb)->dccpd_reset_data[1] = len > 0 ? value[0] : 0;
+        DCCP_SKB_CB(skb)->dccpd_reset_data[2] = len > 1 ? value[1] : 0;
         return -1;
 }
 
diff --git a/net/dccp/proto.c b/net/dccp/proto.c
index 1ca3b26eed0f..d0bd34819761 100644
--- a/net/dccp/proto.c
+++ b/net/dccp/proto.c
@@ -309,7 +309,9 @@ int dccp_disconnect(struct sock *sk, int flags)
                 sk->sk_err = ECONNRESET;
 
         dccp_clear_xmit_timers(sk);
+
         __skb_queue_purge(&sk->sk_receive_queue);
+        __skb_queue_purge(&sk->sk_write_queue);
         if (sk->sk_send_head != NULL) {
                 __kfree_skb(sk->sk_send_head);
                 sk->sk_send_head = NULL;
@@ -1028,7 +1030,7 @@ MODULE_PARM_DESC(thash_entries, "Number of ehash buckets");
 
 #ifdef CONFIG_IP_DCCP_DEBUG
 int dccp_debug;
-module_param(dccp_debug, bool, 0444);
+module_param(dccp_debug, bool, 0644);
 MODULE_PARM_DESC(dccp_debug, "Enable debug messages");
 
 EXPORT_SYMBOL_GPL(dccp_debug);
diff --git a/net/ethernet/eth.c b/net/ethernet/eth.c
index a80839b02e3f..647a9edee375 100644
--- a/net/ethernet/eth.c
+++ b/net/ethernet/eth.c
@@ -129,7 +129,7 @@ int eth_rebuild_header(struct sk_buff *skb)
 
         switch (eth->h_proto) {
 #ifdef CONFIG_INET
-        case __constant_htons(ETH_P_IP):
+        case htons(ETH_P_IP):
                 return arp_find(eth->h_dest, skb);
 #endif
         default:
diff --git a/net/ieee80211/ieee80211_module.c b/net/ieee80211/ieee80211_module.c
index 3bca97f55d47..949772a5a7dc 100644
--- a/net/ieee80211/ieee80211_module.c
+++ b/net/ieee80211/ieee80211_module.c
@@ -157,7 +157,7 @@ struct net_device *alloc_ieee80211(int sizeof_priv)
         err = ieee80211_networks_allocate(ieee);
         if (err) {
                 IEEE80211_ERROR("Unable to allocate beacon storage: %d\n", err);
-                goto failed;
+                goto failed_free_netdev;
         }
         ieee80211_networks_initialize(ieee);
 
@@ -193,9 +193,9 @@ struct net_device *alloc_ieee80211(int sizeof_priv)
 
         return dev;
 
-      failed:
-        if (dev)
-                free_netdev(dev);
+failed_free_netdev:
+        free_netdev(dev);
+failed:
         return NULL;
 }
 
diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
index c10036e7a463..89cb047ab314 100644
--- a/net/ipv4/inet_diag.c
+++ b/net/ipv4/inet_diag.c
@@ -782,11 +782,15 @@ skip_listen_ht:
                 struct sock *sk;
                 struct hlist_node *node;
 
+                num = 0;
+
+                if (hlist_empty(&head->chain) && hlist_empty(&head->twchain))
+                        continue;
+
                 if (i > s_i)
                         s_num = 0;
 
                 read_lock_bh(lock);
-                num = 0;
                 sk_for_each(sk, node, &head->chain) {
                         struct inet_sock *inet = inet_sk(sk);
 
diff --git a/net/ipv4/ipvs/Kconfig b/net/ipv4/ipvs/Kconfig
index 09d0c3f35669..de6004de80bc 100644
--- a/net/ipv4/ipvs/Kconfig
+++ b/net/ipv4/ipvs/Kconfig
@@ -24,6 +24,14 @@ menuconfig IP_VS
 
 if IP_VS
 
+config  IP_VS_IPV6
+        bool "IPv6 support for IPVS (DANGEROUS)"
+        depends on EXPERIMENTAL && (IPV6 = y || IP_VS = IPV6)
+        ---help---
+          Add IPv6 support to IPVS. This is incomplete and might be dangerous.
+
+          Say N if unsure.
+
 config  IP_VS_DEBUG
         bool "IP virtual server debugging"
         ---help---
@@ -33,7 +41,8 @@ config	IP_VS_DEBUG
 
 config  IP_VS_TAB_BITS
         int "IPVS connection table size (the Nth power of 2)"
-        default "12" 
+        range 8 20
+        default 12
         ---help---
           The IPVS connection hash table uses the chaining scheme to handle
           hash collisions. Using a big IPVS connection hash table will greatly
@@ -71,14 +80,20 @@ config	IP_VS_PROTO_UDP
           This option enables support for load balancing UDP transport
           protocol. Say Y if unsure.
 
+config  IP_VS_PROTO_AH_ESP
+        bool
+        depends on UNDEFINED
+
 config  IP_VS_PROTO_ESP
         bool "ESP load balancing support"
+        select IP_VS_PROTO_AH_ESP
         ---help---
           This option enables support for load balancing ESP (Encapsulation
           Security Payload) transport protocol. Say Y if unsure.
 
 config  IP_VS_PROTO_AH
         bool "AH load balancing support"
+        select IP_VS_PROTO_AH_ESP
         ---help---
           This option enables support for load balancing AH (Authentication
           Header) transport protocol. Say Y if unsure.
diff --git a/net/ipv4/ipvs/Makefile b/net/ipv4/ipvs/Makefile
index 30e85de9ffff..73a46fe1fe4c 100644
--- a/net/ipv4/ipvs/Makefile
+++ b/net/ipv4/ipvs/Makefile
@@ -6,8 +6,7 @@
 ip_vs_proto-objs-y :=
 ip_vs_proto-objs-$(CONFIG_IP_VS_PROTO_TCP) += ip_vs_proto_tcp.o
 ip_vs_proto-objs-$(CONFIG_IP_VS_PROTO_UDP) += ip_vs_proto_udp.o
-ip_vs_proto-objs-$(CONFIG_IP_VS_PROTO_ESP) += ip_vs_proto_esp.o
-ip_vs_proto-objs-$(CONFIG_IP_VS_PROTO_AH) += ip_vs_proto_ah.o
+ip_vs_proto-objs-$(CONFIG_IP_VS_PROTO_AH_ESP) += ip_vs_proto_ah_esp.o
 
 ip_vs-objs :=   ip_vs_conn.o ip_vs_core.o ip_vs_ctl.o ip_vs_sched.o        \
                 ip_vs_xmit.o ip_vs_app.o ip_vs_sync.o                      \
diff --git a/net/ipv4/ipvs/ip_vs_conn.c b/net/ipv4/ipvs/ip_vs_conn.c
index 44a6872dc245..9a24332fbed8 100644
--- a/net/ipv4/ipvs/ip_vs_conn.c
+++ b/net/ipv4/ipvs/ip_vs_conn.c
@@ -114,9 +114,18 @@ static inline void ct_write_unlock_bh(unsigned key)
 /*
  *      Returns hash value for IPVS connection entry
  */
-static unsigned int ip_vs_conn_hashkey(unsigned proto, __be32 addr, __be16 port)
+static unsigned int ip_vs_conn_hashkey(int af, unsigned proto,
+                                       const union nf_inet_addr *addr,
+                                       __be16 port)
 {
-        return jhash_3words((__force u32)addr, (__force u32)port, proto, ip_vs_conn_rnd)
+#ifdef CONFIG_IP_VS_IPV6
+        if (af == AF_INET6)
+                return jhash_3words(jhash(addr, 16, ip_vs_conn_rnd),
+                                    (__force u32)port, proto, ip_vs_conn_rnd)
+                        & IP_VS_CONN_TAB_MASK;
+#endif
+        return jhash_3words((__force u32)addr->ip, (__force u32)port, proto,
+                            ip_vs_conn_rnd)
                 & IP_VS_CONN_TAB_MASK;
 }
 
@@ -131,7 +140,7 @@ static inline int ip_vs_conn_hash(struct ip_vs_conn *cp)
         int ret;
 
         /* Hash by protocol, client address and port */
-        hash = ip_vs_conn_hashkey(cp->protocol, cp->caddr, cp->cport);
+        hash = ip_vs_conn_hashkey(cp->af, cp->protocol, &cp->caddr, cp->cport);
 
         ct_write_lock(hash);
 
@@ -162,7 +171,7 @@ static inline int ip_vs_conn_unhash(struct ip_vs_conn *cp)
         int ret;
 
         /* unhash it and decrease its reference counter */
-        hash = ip_vs_conn_hashkey(cp->protocol, cp->caddr, cp->cport);
+        hash = ip_vs_conn_hashkey(cp->af, cp->protocol, &cp->caddr, cp->cport);
 
         ct_write_lock(hash);
 
@@ -187,20 +196,23 @@ static inline int ip_vs_conn_unhash(struct ip_vs_conn *cp)
  *      d_addr, d_port: pkt dest address (load balancer)
  */
 static inline struct ip_vs_conn *__ip_vs_conn_in_get
-(int protocol, __be32 s_addr, __be16 s_port, __be32 d_addr, __be16 d_port)
+(int af, int protocol, const union nf_inet_addr *s_addr, __be16 s_port,
+ const union nf_inet_addr *d_addr, __be16 d_port)
 {
         unsigned hash;
         struct ip_vs_conn *cp;
 
-        hash = ip_vs_conn_hashkey(protocol, s_addr, s_port);
+        hash = ip_vs_conn_hashkey(af, protocol, s_addr, s_port);
 
         ct_read_lock(hash);
 
         list_for_each_entry(cp, &ip_vs_conn_tab[hash], c_list) {
-                if (s_addr==cp->caddr && s_port==cp->cport &&
-                    d_port==cp->vport && d_addr==cp->vaddr &&
+                if (cp->af == af &&
+                    ip_vs_addr_equal(af, s_addr, &cp->caddr) &&
+                    ip_vs_addr_equal(af, d_addr, &cp->vaddr) &&
+                    s_port == cp->cport && d_port == cp->vport &&
                     ((!s_port) ^ (!(cp->flags & IP_VS_CONN_F_NO_CPORT))) &&
-                    protocol==cp->protocol) {
+                    protocol == cp->protocol) {
                         /* HIT */
                         atomic_inc(&cp->refcnt);
                         ct_read_unlock(hash);
@@ -214,39 +226,44 @@ static inline struct ip_vs_conn *__ip_vs_conn_in_get
 }
 
 struct ip_vs_conn *ip_vs_conn_in_get
-(int protocol, __be32 s_addr, __be16 s_port, __be32 d_addr, __be16 d_port)
+(int af, int protocol, const union nf_inet_addr *s_addr, __be16 s_port,
+ const union nf_inet_addr *d_addr, __be16 d_port)
 {
         struct ip_vs_conn *cp;
 
-        cp = __ip_vs_conn_in_get(protocol, s_addr, s_port, d_addr, d_port);
+        cp = __ip_vs_conn_in_get(af, protocol, s_addr, s_port, d_addr, d_port);
         if (!cp && atomic_read(&ip_vs_conn_no_cport_cnt))
-                cp = __ip_vs_conn_in_get(protocol, s_addr, 0, d_addr, d_port);
+                cp = __ip_vs_conn_in_get(af, protocol, s_addr, 0, d_addr,
+                                         d_port);
 
-        IP_VS_DBG(9, "lookup/in %s %u.%u.%u.%u:%d->%u.%u.%u.%u:%d %s\n",
-                  ip_vs_proto_name(protocol),
-                  NIPQUAD(s_addr), ntohs(s_port),
-                  NIPQUAD(d_addr), ntohs(d_port),
-                  cp?"hit":"not hit");
+        IP_VS_DBG_BUF(9, "lookup/in %s %s:%d->%s:%d %s\n",
+                      ip_vs_proto_name(protocol),
+                      IP_VS_DBG_ADDR(af, s_addr), ntohs(s_port),
+                      IP_VS_DBG_ADDR(af, d_addr), ntohs(d_port),
+                      cp ? "hit" : "not hit");
 
         return cp;
 }
 
 /* Get reference to connection template */
 struct ip_vs_conn *ip_vs_ct_in_get
-(int protocol, __be32 s_addr, __be16 s_port, __be32 d_addr, __be16 d_port)
+(int af, int protocol, const union nf_inet_addr *s_addr, __be16 s_port,
+ const union nf_inet_addr *d_addr, __be16 d_port)
 {
         unsigned hash;
         struct ip_vs_conn *cp;
 
-        hash = ip_vs_conn_hashkey(protocol, s_addr, s_port);
+        hash = ip_vs_conn_hashkey(af, protocol, s_addr, s_port);
 
         ct_read_lock(hash);
 
         list_for_each_entry(cp, &ip_vs_conn_tab[hash], c_list) {
-                if (s_addr==cp->caddr && s_port==cp->cport &&
-                    d_port==cp->vport && d_addr==cp->vaddr &&
+                if (cp->af == af &&
+                    ip_vs_addr_equal(af, s_addr, &cp->caddr) &&
+                    ip_vs_addr_equal(af, d_addr, &cp->vaddr) &&
+                    s_port == cp->cport && d_port == cp->vport &&
                     cp->flags & IP_VS_CONN_F_TEMPLATE &&
-                    protocol==cp->protocol) {
+                    protocol == cp->protocol) {
                         /* HIT */
                         atomic_inc(&cp->refcnt);
                         goto out;
@@ -257,11 +274,11 @@ struct ip_vs_conn *ip_vs_ct_in_get
   out:
         ct_read_unlock(hash);
 
-        IP_VS_DBG(9, "template lookup/in %s %u.%u.%u.%u:%d->%u.%u.%u.%u:%d %s\n",
-                  ip_vs_proto_name(protocol),
-                  NIPQUAD(s_addr), ntohs(s_port),
-                  NIPQUAD(d_addr), ntohs(d_port),
-                  cp?"hit":"not hit");
+        IP_VS_DBG_BUF(9, "template lookup/in %s %s:%d->%s:%d %s\n",
+                      ip_vs_proto_name(protocol),
+                      IP_VS_DBG_ADDR(af, s_addr), ntohs(s_port),
+                      IP_VS_DBG_ADDR(af, d_addr), ntohs(d_port),
+                      cp ? "hit" : "not hit");
 
         return cp;
 }
@@ -273,7 +290,8 @@ struct ip_vs_conn *ip_vs_ct_in_get
  *      d_addr, d_port: pkt dest address (foreign host)
  */
 struct ip_vs_conn *ip_vs_conn_out_get
-(int protocol, __be32 s_addr, __be16 s_port, __be32 d_addr, __be16 d_port)
+(int af, int protocol, const union nf_inet_addr *s_addr, __be16 s_port,
+ const union nf_inet_addr *d_addr, __be16 d_port)
 {
         unsigned hash;
         struct ip_vs_conn *cp, *ret=NULL;
@@ -281,13 +299,15 @@ struct ip_vs_conn *ip_vs_conn_out_get
         /*
          *      Check for "full" addressed entries
          */
-        hash = ip_vs_conn_hashkey(protocol, d_addr, d_port);
+        hash = ip_vs_conn_hashkey(af, protocol, d_addr, d_port);
 
         ct_read_lock(hash);
 
         list_for_each_entry(cp, &ip_vs_conn_tab[hash], c_list) {
-                if (d_addr == cp->caddr && d_port == cp->cport &&
-                    s_port == cp->dport && s_addr == cp->daddr &&
+                if (cp->af == af &&
+                    ip_vs_addr_equal(af, d_addr, &cp->caddr) &&
+                    ip_vs_addr_equal(af, s_addr, &cp->daddr) &&
+                    d_port == cp->cport && s_port == cp->dport &&
                     protocol == cp->protocol) {
                         /* HIT */
                         atomic_inc(&cp->refcnt);
@@ -298,11 +318,11 @@ struct ip_vs_conn *ip_vs_conn_out_get
 
         ct_read_unlock(hash);
 
-        IP_VS_DBG(9, "lookup/out %s %u.%u.%u.%u:%d->%u.%u.%u.%u:%d %s\n",
-                  ip_vs_proto_name(protocol),
-                  NIPQUAD(s_addr), ntohs(s_port),
-                  NIPQUAD(d_addr), ntohs(d_port),
-                  ret?"hit":"not hit");
+        IP_VS_DBG_BUF(9, "lookup/out %s %s:%d->%s:%d %s\n",
+                      ip_vs_proto_name(protocol),
+                      IP_VS_DBG_ADDR(af, s_addr), ntohs(s_port),
+                      IP_VS_DBG_ADDR(af, d_addr), ntohs(d_port),
+                      ret ? "hit" : "not hit");
 
         return ret;
 }
@@ -369,6 +389,33 @@ static inline void ip_vs_bind_xmit(struct ip_vs_conn *cp)
         }
 }
 
+#ifdef CONFIG_IP_VS_IPV6
+static inline void ip_vs_bind_xmit_v6(struct ip_vs_conn *cp)
+{
+        switch (IP_VS_FWD_METHOD(cp)) {
+        case IP_VS_CONN_F_MASQ:
+                cp->packet_xmit = ip_vs_nat_xmit_v6;
+                break;
+
+        case IP_VS_CONN_F_TUNNEL:
+                cp->packet_xmit = ip_vs_tunnel_xmit_v6;
+                break;
+
+        case IP_VS_CONN_F_DROUTE:
+                cp->packet_xmit = ip_vs_dr_xmit_v6;
+                break;
+
+        case IP_VS_CONN_F_LOCALNODE:
+                cp->packet_xmit = ip_vs_null_xmit;
+                break;
+
+        case IP_VS_CONN_F_BYPASS:
+                cp->packet_xmit = ip_vs_bypass_xmit_v6;
+                break;
+        }
+}
+#endif
+
 
 static inline int ip_vs_dest_totalconns(struct ip_vs_dest *dest)
 {
@@ -402,16 +449,16 @@ ip_vs_bind_dest(struct ip_vs_conn *cp, struct ip_vs_dest *dest)
                 cp->flags |= atomic_read(&dest->conn_flags);
         cp->dest = dest;
 
-        IP_VS_DBG(7, "Bind-dest %s c:%u.%u.%u.%u:%d v:%u.%u.%u.%u:%d "
-                  "d:%u.%u.%u.%u:%d fwd:%c s:%u conn->flags:%X conn->refcnt:%d "
-                  "dest->refcnt:%d\n",
-                  ip_vs_proto_name(cp->protocol),
-                  NIPQUAD(cp->caddr), ntohs(cp->cport),
-                  NIPQUAD(cp->vaddr), ntohs(cp->vport),
-                  NIPQUAD(cp->daddr), ntohs(cp->dport),
-                  ip_vs_fwd_tag(cp), cp->state,
-                  cp->flags, atomic_read(&cp->refcnt),
-                  atomic_read(&dest->refcnt));
+        IP_VS_DBG_BUF(7, "Bind-dest %s c:%s:%d v:%s:%d "
+                      "d:%s:%d fwd:%c s:%u conn->flags:%X conn->refcnt:%d "
+                      "dest->refcnt:%d\n",
+                      ip_vs_proto_name(cp->protocol),
+                      IP_VS_DBG_ADDR(cp->af, &cp->caddr), ntohs(cp->cport),
+                      IP_VS_DBG_ADDR(cp->af, &cp->vaddr), ntohs(cp->vport),
+                      IP_VS_DBG_ADDR(cp->af, &cp->daddr), ntohs(cp->dport),
+                      ip_vs_fwd_tag(cp), cp->state,
+                      cp->flags, atomic_read(&cp->refcnt),
+                      atomic_read(&dest->refcnt));
 
         /* Update the connection counters */
         if (!(cp->flags & IP_VS_CONN_F_TEMPLATE)) {
@@ -444,8 +491,9 @@ struct ip_vs_dest *ip_vs_try_bind_dest(struct ip_vs_conn *cp)
         struct ip_vs_dest *dest;
 
         if ((cp) && (!cp->dest)) {
-                dest = ip_vs_find_dest(cp->daddr, cp->dport,
-                                       cp->vaddr, cp->vport, cp->protocol);
+                dest = ip_vs_find_dest(cp->af, &cp->daddr, cp->dport,
+                                       &cp->vaddr, cp->vport,
+                                       cp->protocol);
                 ip_vs_bind_dest(cp, dest);
                 return dest;
         } else
@@ -464,16 +512,16 @@ static inline void ip_vs_unbind_dest(struct ip_vs_conn *cp)
         if (!dest)
                 return;
 
-        IP_VS_DBG(7, "Unbind-dest %s c:%u.%u.%u.%u:%d v:%u.%u.%u.%u:%d "
-                  "d:%u.%u.%u.%u:%d fwd:%c s:%u conn->flags:%X conn->refcnt:%d "
-                  "dest->refcnt:%d\n",
-                  ip_vs_proto_name(cp->protocol),
-                  NIPQUAD(cp->caddr), ntohs(cp->cport),
-                  NIPQUAD(cp->vaddr), ntohs(cp->vport),
-                  NIPQUAD(cp->daddr), ntohs(cp->dport),
-                  ip_vs_fwd_tag(cp), cp->state,
-                  cp->flags, atomic_read(&cp->refcnt),
-                  atomic_read(&dest->refcnt));
+        IP_VS_DBG_BUF(7, "Unbind-dest %s c:%s:%d v:%s:%d "
+                      "d:%s:%d fwd:%c s:%u conn->flags:%X conn->refcnt:%d "
+                      "dest->refcnt:%d\n",
+                      ip_vs_proto_name(cp->protocol),
+                      IP_VS_DBG_ADDR(cp->af, &cp->caddr), ntohs(cp->cport),
+                      IP_VS_DBG_ADDR(cp->af, &cp->vaddr), ntohs(cp->vport),
+                      IP_VS_DBG_ADDR(cp->af, &cp->daddr), ntohs(cp->dport),
+                      ip_vs_fwd_tag(cp), cp->state,
+                      cp->flags, atomic_read(&cp->refcnt),
+                      atomic_read(&dest->refcnt));
 
         /* Update the connection counters */
         if (!(cp->flags & IP_VS_CONN_F_TEMPLATE)) {
@@ -526,13 +574,16 @@ int ip_vs_check_template(struct ip_vs_conn *ct)
             !(dest->flags & IP_VS_DEST_F_AVAILABLE) ||
             (sysctl_ip_vs_expire_quiescent_template &&
              (atomic_read(&dest->weight) == 0))) {
-                IP_VS_DBG(9, "check_template: dest not available for "
-                          "protocol %s s:%u.%u.%u.%u:%d v:%u.%u.%u.%u:%d "
-                          "-> d:%u.%u.%u.%u:%d\n",
-                          ip_vs_proto_name(ct->protocol),
-                          NIPQUAD(ct->caddr), ntohs(ct->cport),
-                          NIPQUAD(ct->vaddr), ntohs(ct->vport),
-                          NIPQUAD(ct->daddr), ntohs(ct->dport));
+                IP_VS_DBG_BUF(9, "check_template: dest not available for "
+                              "protocol %s s:%s:%d v:%s:%d "
+                              "-> d:%s:%d\n",
+                              ip_vs_proto_name(ct->protocol),
+                              IP_VS_DBG_ADDR(ct->af, &ct->caddr),
+                              ntohs(ct->cport),
+                              IP_VS_DBG_ADDR(ct->af, &ct->vaddr),
+                              ntohs(ct->vport),
+                              IP_VS_DBG_ADDR(ct->af, &ct->daddr),
+                              ntohs(ct->dport));
 
                 /*
                  * Invalidate the connection template
@@ -625,8 +676,9 @@ void ip_vs_conn_expire_now(struct ip_vs_conn *cp)
  *      Create a new connection entry and hash it into the ip_vs_conn_tab
  */
 struct ip_vs_conn *
-ip_vs_conn_new(int proto, __be32 caddr, __be16 cport, __be32 vaddr, __be16 vport,
-               __be32 daddr, __be16 dport, unsigned flags,
+ip_vs_conn_new(int af, int proto, const union nf_inet_addr *caddr, __be16 cport,
+               const union nf_inet_addr *vaddr, __be16 vport,
+               const union nf_inet_addr *daddr, __be16 dport, unsigned flags,
                struct ip_vs_dest *dest)
 {
         struct ip_vs_conn *cp;
@@ -640,12 +692,13 @@ ip_vs_conn_new(int proto, __be32 caddr, __be16 cport, __be32 vaddr, __be16 vport
 
         INIT_LIST_HEAD(&cp->c_list);
         setup_timer(&cp->timer, ip_vs_conn_expire, (unsigned long)cp);
+        cp->af             = af;
         cp->protocol       = proto;
-        cp->caddr          = caddr;
+        ip_vs_addr_copy(af, &cp->caddr, caddr);
         cp->cport          = cport;
-        cp->vaddr          = vaddr;
+        ip_vs_addr_copy(af, &cp->vaddr, vaddr);
         cp->vport          = vport;
-        cp->daddr          = daddr;
+        ip_vs_addr_copy(af, &cp->daddr, daddr);
         cp->dport          = dport;
         cp->flags          = flags;
         spin_lock_init(&cp->lock);
@@ -672,7 +725,12 @@ ip_vs_conn_new(int proto, __be32 caddr, __be16 cport, __be32 vaddr, __be16 vport
         cp->timeout = 3*HZ;
 
         /* Bind its packet transmitter */
-        ip_vs_bind_xmit(cp);
+#ifdef CONFIG_IP_VS_IPV6
+        if (af == AF_INET6)
+                ip_vs_bind_xmit_v6(cp);
+        else
+#endif
+                ip_vs_bind_xmit(cp);
 
         if (unlikely(pp && atomic_read(&pp->appcnt)))
                 ip_vs_bind_app(cp, pp);
@@ -760,12 +818,26 @@ static int ip_vs_conn_seq_show(struct seq_file *seq, void *v)
         else {
                 const struct ip_vs_conn *cp = v;
 
-                seq_printf(seq,
-                        "%-3s %08X %04X %08X %04X %08X %04X %-11s %7lu\n",
+#ifdef CONFIG_IP_VS_IPV6
+                if (cp->af == AF_INET6)
+                        seq_printf(seq,
+                                "%-3s " NIP6_FMT " %04X " NIP6_FMT
+                                " %04X " NIP6_FMT " %04X %-11s %7lu\n",
+                                ip_vs_proto_name(cp->protocol),
+                                NIP6(cp->caddr.in6), ntohs(cp->cport),
+                                NIP6(cp->vaddr.in6), ntohs(cp->vport),
+                                NIP6(cp->daddr.in6), ntohs(cp->dport),
+                                ip_vs_state_name(cp->protocol, cp->state),
+                                (cp->timer.expires-jiffies)/HZ);
+                else
+#endif
+                        seq_printf(seq,
+                                "%-3s %08X %04X %08X %04X"
+                                " %08X %04X %-11s %7lu\n",
                                 ip_vs_proto_name(cp->protocol),
-                                ntohl(cp->caddr), ntohs(cp->cport),
-                                ntohl(cp->vaddr), ntohs(cp->vport),
-                                ntohl(cp->daddr), ntohs(cp->dport),
+                                ntohl(cp->caddr.ip), ntohs(cp->cport),
+                                ntohl(cp->vaddr.ip), ntohs(cp->vport),
+                                ntohl(cp->daddr.ip), ntohs(cp->dport),
                                 ip_vs_state_name(cp->protocol, cp->state),
                                 (cp->timer.expires-jiffies)/HZ);
         }
@@ -809,12 +881,27 @@ static int ip_vs_conn_sync_seq_show(struct seq_file *seq, void *v)
         else {
                 const struct ip_vs_conn *cp = v;
 
-                seq_printf(seq,
-                        "%-3s %08X %04X %08X %04X %08X %04X %-11s %-6s %7lu\n",
+#ifdef CONFIG_IP_VS_IPV6
+                if (cp->af == AF_INET6)
+                        seq_printf(seq,
+                                "%-3s " NIP6_FMT " %04X " NIP6_FMT
+                                " %04X " NIP6_FMT " %04X %-11s %-6s %7lu\n",
+                                ip_vs_proto_name(cp->protocol),
+                                NIP6(cp->caddr.in6), ntohs(cp->cport),
+                                NIP6(cp->vaddr.in6), ntohs(cp->vport),
+                                NIP6(cp->daddr.in6), ntohs(cp->dport),
+                                ip_vs_state_name(cp->protocol, cp->state),
+                                ip_vs_origin_name(cp->flags),
+                                (cp->timer.expires-jiffies)/HZ);
+                else
+#endif
+                        seq_printf(seq,
+                                "%-3s %08X %04X %08X %04X "
+                                "%08X %04X %-11s %-6s %7lu\n",
                                 ip_vs_proto_name(cp->protocol),
-                                ntohl(cp->caddr), ntohs(cp->cport),
-                                ntohl(cp->vaddr), ntohs(cp->vport),
-                                ntohl(cp->daddr), ntohs(cp->dport),
+                                ntohl(cp->caddr.ip), ntohs(cp->cport),
+                                ntohl(cp->vaddr.ip), ntohs(cp->vport),
+                                ntohl(cp->daddr.ip), ntohs(cp->dport),
                                 ip_vs_state_name(cp->protocol, cp->state),
                                 ip_vs_origin_name(cp->flags),
                                 (cp->timer.expires-jiffies)/HZ);
diff --git a/net/ipv4/ipvs/ip_vs_core.c b/net/ipv4/ipvs/ip_vs_core.c
index a7879eafc3b5..958abf3e5f8c 100644
--- a/net/ipv4/ipvs/ip_vs_core.c
+++ b/net/ipv4/ipvs/ip_vs_core.c
@@ -39,6 +39,11 @@
 #include <linux/netfilter.h>
 #include <linux/netfilter_ipv4.h>
 
+#ifdef CONFIG_IP_VS_IPV6
+#include <net/ipv6.h>
+#include <linux/netfilter_ipv6.h>
+#endif
+
 #include <net/ip_vs.h>
 
 
@@ -60,6 +65,7 @@ EXPORT_SYMBOL(ip_vs_get_debug_level);
 
 /* ID used in ICMP lookups */
 #define icmp_id(icmph)          (((icmph)->un).echo.id)
+#define icmpv6_id(icmph)        (icmph->icmp6_dataun.u_echo.identifier)
 
 const char *ip_vs_proto_name(unsigned proto)
 {
@@ -74,6 +80,10 @@ const char *ip_vs_proto_name(unsigned proto)
                 return "TCP";
         case IPPROTO_ICMP:
                 return "ICMP";
+#ifdef CONFIG_IP_VS_IPV6
+        case IPPROTO_ICMPV6:
+                return "ICMPv6";
+#endif
         default:
                 sprintf(buf, "IP_%d", proto);
                 return buf;
@@ -92,18 +102,18 @@ ip_vs_in_stats(struct ip_vs_conn *cp, struct sk_buff *skb)
         struct ip_vs_dest *dest = cp->dest;
         if (dest && (dest->flags & IP_VS_DEST_F_AVAILABLE)) {
                 spin_lock(&dest->stats.lock);
-                dest->stats.inpkts++;
-                dest->stats.inbytes += skb->len;
+                dest->stats.ustats.inpkts++;
+                dest->stats.ustats.inbytes += skb->len;
                 spin_unlock(&dest->stats.lock);
 
                 spin_lock(&dest->svc->stats.lock);
-                dest->svc->stats.inpkts++;
-                dest->svc->stats.inbytes += skb->len;
+                dest->svc->stats.ustats.inpkts++;
+                dest->svc->stats.ustats.inbytes += skb->len;
                 spin_unlock(&dest->svc->stats.lock);
 
                 spin_lock(&ip_vs_stats.lock);
-                ip_vs_stats.inpkts++;
-                ip_vs_stats.inbytes += skb->len;
+                ip_vs_stats.ustats.inpkts++;
+                ip_vs_stats.ustats.inbytes += skb->len;
                 spin_unlock(&ip_vs_stats.lock);
         }
 }
@@ -115,18 +125,18 @@ ip_vs_out_stats(struct ip_vs_conn *cp, struct sk_buff *skb)
         struct ip_vs_dest *dest = cp->dest;
         if (dest && (dest->flags & IP_VS_DEST_F_AVAILABLE)) {
                 spin_lock(&dest->stats.lock);
-                dest->stats.outpkts++;
-                dest->stats.outbytes += skb->len;
+                dest->stats.ustats.outpkts++;
+                dest->stats.ustats.outbytes += skb->len;
                 spin_unlock(&dest->stats.lock);
 
                 spin_lock(&dest->svc->stats.lock);
-                dest->svc->stats.outpkts++;
-                dest->svc->stats.outbytes += skb->len;
+                dest->svc->stats.ustats.outpkts++;
+                dest->svc->stats.ustats.outbytes += skb->len;
                 spin_unlock(&dest->svc->stats.lock);
 
                 spin_lock(&ip_vs_stats.lock);
-                ip_vs_stats.outpkts++;
-                ip_vs_stats.outbytes += skb->len;
+                ip_vs_stats.ustats.outpkts++;
+                ip_vs_stats.ustats.outbytes += skb->len;
                 spin_unlock(&ip_vs_stats.lock);
         }
 }
@@ -136,15 +146,15 @@ static inline void
 ip_vs_conn_stats(struct ip_vs_conn *cp, struct ip_vs_service *svc)
 {
         spin_lock(&cp->dest->stats.lock);
-        cp->dest->stats.conns++;
+        cp->dest->stats.ustats.conns++;
         spin_unlock(&cp->dest->stats.lock);
 
         spin_lock(&svc->stats.lock);
-        svc->stats.conns++;
+        svc->stats.ustats.conns++;
         spin_unlock(&svc->stats.lock);
 
         spin_lock(&ip_vs_stats.lock);
-        ip_vs_stats.conns++;
+        ip_vs_stats.ustats.conns++;
         spin_unlock(&ip_vs_stats.lock);
 }
 
@@ -173,20 +183,28 @@ ip_vs_sched_persist(struct ip_vs_service *svc,
                     __be16 ports[2])
 {
         struct ip_vs_conn *cp = NULL;
-        struct iphdr *iph = ip_hdr(skb);
+        struct ip_vs_iphdr iph;
         struct ip_vs_dest *dest;
         struct ip_vs_conn *ct;
-        __be16  dport;   /* destination port to forward */
-        __be32  snet;    /* source network of the client, after masking */
+        __be16  dport;                  /* destination port to forward */
+        union nf_inet_addr snet;        /* source network of the client,
+                                           after masking */
+
+        ip_vs_fill_iphdr(svc->af, skb_network_header(skb), &iph);
 
         /* Mask saddr with the netmask to adjust template granularity */
-        snet = iph->saddr & svc->netmask;
+#ifdef CONFIG_IP_VS_IPV6
+        if (svc->af == AF_INET6)
+                ipv6_addr_prefix(&snet.in6, &iph.saddr.in6, svc->netmask);
+        else
+#endif
+                snet.ip = iph.saddr.ip & svc->netmask;
 
-        IP_VS_DBG(6, "p-schedule: src %u.%u.%u.%u:%u dest %u.%u.%u.%u:%u "
-                  "mnet %u.%u.%u.%u\n",
-                  NIPQUAD(iph->saddr), ntohs(ports[0]),
-                  NIPQUAD(iph->daddr), ntohs(ports[1]),
-                  NIPQUAD(snet));
+        IP_VS_DBG_BUF(6, "p-schedule: src %s:%u dest %s:%u "
+                      "mnet %s\n",
+                      IP_VS_DBG_ADDR(svc->af, &iph.saddr), ntohs(ports[0]),
+                      IP_VS_DBG_ADDR(svc->af, &iph.daddr), ntohs(ports[1]),
+                      IP_VS_DBG_ADDR(svc->af, &snet));
 
         /*
          * As far as we know, FTP is a very complicated network protocol, and
@@ -204,11 +222,11 @@ ip_vs_sched_persist(struct ip_vs_service *svc,
         if (ports[1] == svc->port) {
                 /* Check if a template already exists */
                 if (svc->port != FTPPORT)
-                        ct = ip_vs_ct_in_get(iph->protocol, snet, 0,
-                                               iph->daddr, ports[1]);
+                        ct = ip_vs_ct_in_get(svc->af, iph.protocol, &snet, 0,
+                                             &iph.daddr, ports[1]);
                 else
-                        ct = ip_vs_ct_in_get(iph->protocol, snet, 0,
-                                               iph->daddr, 0);
+                        ct = ip_vs_ct_in_get(svc->af, iph.protocol, &snet, 0,
+                                             &iph.daddr, 0);
 
                 if (!ct || !ip_vs_check_template(ct)) {
                         /*
@@ -228,18 +246,18 @@ ip_vs_sched_persist(struct ip_vs_service *svc,
                          * for ftp service.
                          */
                         if (svc->port != FTPPORT)
-                                ct = ip_vs_conn_new(iph->protocol,
-                                                    snet, 0,
-                                                    iph->daddr,
+                                ct = ip_vs_conn_new(svc->af, iph.protocol,
+                                                    &snet, 0,
+                                                    &iph.daddr,
                                                     ports[1],
-                                                    dest->addr, dest->port,
+                                                    &dest->addr, dest->port,
                                                     IP_VS_CONN_F_TEMPLATE,
                                                     dest);
                         else
-                                ct = ip_vs_conn_new(iph->protocol,
-                                                    snet, 0,
-                                                    iph->daddr, 0,
-                                                    dest->addr, 0,
+                                ct = ip_vs_conn_new(svc->af, iph.protocol,
+                                                    &snet, 0,
+                                                    &iph.daddr, 0,
+                                                    &dest->addr, 0,
                                                     IP_VS_CONN_F_TEMPLATE,
                                                     dest);
                         if (ct == NULL)
@@ -258,12 +276,16 @@ ip_vs_sched_persist(struct ip_vs_service *svc,
                  * fwmark template: <IPPROTO_IP,caddr,0,fwmark,0,daddr,0>
                  * port zero template: <protocol,caddr,0,vaddr,0,daddr,0>
                  */
-                if (svc->fwmark)
-                        ct = ip_vs_ct_in_get(IPPROTO_IP, snet, 0,
-                                               htonl(svc->fwmark), 0);
-                else
-                        ct = ip_vs_ct_in_get(iph->protocol, snet, 0,
-                                               iph->daddr, 0);
+                if (svc->fwmark) {
+                        union nf_inet_addr fwmark = {
+                                .all = { 0, 0, 0, htonl(svc->fwmark) }
+                        };
+
+                        ct = ip_vs_ct_in_get(svc->af, IPPROTO_IP, &snet, 0,
+                                             &fwmark, 0);
+                } else
+                        ct = ip_vs_ct_in_get(svc->af, iph.protocol, &snet, 0,
+                                             &iph.daddr, 0);
 
                 if (!ct || !ip_vs_check_template(ct)) {
                         /*
@@ -282,18 +304,22 @@ ip_vs_sched_persist(struct ip_vs_service *svc,
                         /*
                          * Create a template according to the service
                          */
-                        if (svc->fwmark)
-                                ct = ip_vs_conn_new(IPPROTO_IP,
-                                                    snet, 0,
-                                                    htonl(svc->fwmark), 0,
-                                                    dest->addr, 0,
+                        if (svc->fwmark) {
+                                union nf_inet_addr fwmark = {
+                                        .all = { 0, 0, 0, htonl(svc->fwmark) }
+                                };
+
+                                ct = ip_vs_conn_new(svc->af, IPPROTO_IP,
+                                                    &snet, 0,
+                                                    &fwmark, 0,
+                                                    &dest->addr, 0,
                                                     IP_VS_CONN_F_TEMPLATE,
                                                     dest);
-                        else
-                                ct = ip_vs_conn_new(iph->protocol,
-                                                    snet, 0,
-                                                    iph->daddr, 0,
-                                                    dest->addr, 0,
+                        } else
+                                ct = ip_vs_conn_new(svc->af, iph.protocol,
+                                                    &snet, 0,
+                                                    &iph.daddr, 0,
+                                                    &dest->addr, 0,
                                                     IP_VS_CONN_F_TEMPLATE,
                                                     dest);
                         if (ct == NULL)
@@ -310,10 +336,10 @@ ip_vs_sched_persist(struct ip_vs_service *svc,
         /*
          *    Create a new connection according to the template
          */
-        cp = ip_vs_conn_new(iph->protocol,
-                            iph->saddr, ports[0],
-                            iph->daddr, ports[1],
-                            dest->addr, dport,
+        cp = ip_vs_conn_new(svc->af, iph.protocol,
+                            &iph.saddr, ports[0],
+                            &iph.daddr, ports[1],
+                            &dest->addr, dport,
                             0,
                             dest);
         if (cp == NULL) {
@@ -342,12 +368,12 @@ struct ip_vs_conn *
 ip_vs_schedule(struct ip_vs_service *svc, const struct sk_buff *skb)
 {
         struct ip_vs_conn *cp = NULL;
-        struct iphdr *iph = ip_hdr(skb);
+        struct ip_vs_iphdr iph;
         struct ip_vs_dest *dest;
         __be16 _ports[2], *pptr;
 
-        pptr = skb_header_pointer(skb, iph->ihl*4,
-                                  sizeof(_ports), _ports);
+        ip_vs_fill_iphdr(svc->af, skb_network_header(skb), &iph);
+        pptr = skb_header_pointer(skb, iph.len, sizeof(_ports), _ports);
         if (pptr == NULL)
                 return NULL;
 
@@ -377,22 +403,22 @@ ip_vs_schedule(struct ip_vs_service *svc, const struct sk_buff *skb)
         /*
          *    Create a connection entry.
          */
-        cp = ip_vs_conn_new(iph->protocol,
-                            iph->saddr, pptr[0],
-                            iph->daddr, pptr[1],
-                            dest->addr, dest->port?dest->port:pptr[1],
+        cp = ip_vs_conn_new(svc->af, iph.protocol,
+                            &iph.saddr, pptr[0],
+                            &iph.daddr, pptr[1],
+                            &dest->addr, dest->port ? dest->port : pptr[1],
                             0,
                             dest);
         if (cp == NULL)
                 return NULL;
 
-        IP_VS_DBG(6, "Schedule fwd:%c c:%u.%u.%u.%u:%u v:%u.%u.%u.%u:%u "
-                  "d:%u.%u.%u.%u:%u conn->flags:%X conn->refcnt:%d\n",
-                  ip_vs_fwd_tag(cp),
-                  NIPQUAD(cp->caddr), ntohs(cp->cport),
-                  NIPQUAD(cp->vaddr), ntohs(cp->vport),
-                  NIPQUAD(cp->daddr), ntohs(cp->dport),
-                  cp->flags, atomic_read(&cp->refcnt));
+        IP_VS_DBG_BUF(6, "Schedule fwd:%c c:%s:%u v:%s:%u "
+                      "d:%s:%u conn->flags:%X conn->refcnt:%d\n",
+                      ip_vs_fwd_tag(cp),
+                      IP_VS_DBG_ADDR(svc->af, &cp->caddr), ntohs(cp->cport),
+                      IP_VS_DBG_ADDR(svc->af, &cp->vaddr), ntohs(cp->vport),
+                      IP_VS_DBG_ADDR(svc->af, &cp->daddr), ntohs(cp->dport),
+                      cp->flags, atomic_read(&cp->refcnt));
 
         ip_vs_conn_stats(cp, svc);
         return cp;
@@ -408,31 +434,39 @@ int ip_vs_leave(struct ip_vs_service *svc, struct sk_buff *skb,
                 struct ip_vs_protocol *pp)
 {
         __be16 _ports[2], *pptr;
-        struct iphdr *iph = ip_hdr(skb);
+        struct ip_vs_iphdr iph;
+        int unicast;
+        ip_vs_fill_iphdr(svc->af, skb_network_header(skb), &iph);
 
-        pptr = skb_header_pointer(skb, iph->ihl*4,
-                                  sizeof(_ports), _ports);
+        pptr = skb_header_pointer(skb, iph.len, sizeof(_ports), _ports);
         if (pptr == NULL) {
                 ip_vs_service_put(svc);
                 return NF_DROP;
         }
 
+#ifdef CONFIG_IP_VS_IPV6
+        if (svc->af == AF_INET6)
+                unicast = ipv6_addr_type(&iph.daddr.in6) & IPV6_ADDR_UNICAST;
+        else
+#endif
+                unicast = (inet_addr_type(&init_net, iph.daddr.ip) == RTN_UNICAST);
+
         /* if it is fwmark-based service, the cache_bypass sysctl is up
-           and the destination is RTN_UNICAST (and not local), then create
+           and the destination is a non-local unicast, then create
            a cache_bypass connection entry */
-        if (sysctl_ip_vs_cache_bypass && svc->fwmark
-            && (inet_addr_type(&init_net, iph->daddr) == RTN_UNICAST)) {
+        if (sysctl_ip_vs_cache_bypass && svc->fwmark && unicast) {
                 int ret, cs;
                 struct ip_vs_conn *cp;
+                union nf_inet_addr daddr =  { .all = { 0, 0, 0, 0 } };
 
                 ip_vs_service_put(svc);
 
                 /* create a new connection entry */
                 IP_VS_DBG(6, "ip_vs_leave: create a cache_bypass entry\n");
-                cp = ip_vs_conn_new(iph->protocol,
-                                    iph->saddr, pptr[0],
-                                    iph->daddr, pptr[1],
-                                    0, 0,
+                cp = ip_vs_conn_new(svc->af, iph.protocol,
+                                    &iph.saddr, pptr[0],
+                                    &iph.daddr, pptr[1],
+                                    &daddr, 0,
                                     IP_VS_CONN_F_BYPASS,
                                     NULL);
                 if (cp == NULL)
@@ -473,7 +507,14 @@ int ip_vs_leave(struct ip_vs_service *svc, struct sk_buff *skb,
          * created, the TCP RST packet cannot be sent, instead that
          * ICMP_PORT_UNREACH is sent here no matter it is TCP/UDP. --WZ
          */
-        icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
+#ifdef CONFIG_IP_VS_IPV6
+        if (svc->af == AF_INET6)
+                icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0,
+                            skb->dev);
+        else
+#endif
+                icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
+
         return NF_DROP;
 }
 
@@ -512,6 +553,14 @@ static inline int ip_vs_gather_frags(struct sk_buff *skb, u_int32_t user)
         return err;
 }
 
+#ifdef CONFIG_IP_VS_IPV6
+static inline int ip_vs_gather_frags_v6(struct sk_buff *skb, u_int32_t user)
+{
+        /* TODO IPv6: Find out what to do here for IPv6 */
+        return 0;
+}
+#endif
+
 /*
  * Packet has been made sufficiently writable in caller
  * - inout: 1=in->out, 0=out->in
@@ -526,14 +575,14 @@ void ip_vs_nat_icmp(struct sk_buff *skb, struct ip_vs_protocol *pp,
         struct iphdr *ciph       = (struct iphdr *)(icmph + 1);
 
         if (inout) {
-                iph->saddr = cp->vaddr;
+                iph->saddr = cp->vaddr.ip;
                 ip_send_check(iph);
-                ciph->daddr = cp->vaddr;
+                ciph->daddr = cp->vaddr.ip;
                 ip_send_check(ciph);
         } else {
-                iph->daddr = cp->daddr;
+                iph->daddr = cp->daddr.ip;
                 ip_send_check(iph);
-                ciph->saddr = cp->daddr;
+                ciph->saddr = cp->daddr.ip;
                 ip_send_check(ciph);
         }
 
@@ -560,21 +609,112 @@ void ip_vs_nat_icmp(struct sk_buff *skb, struct ip_vs_protocol *pp,
                         "Forwarding altered incoming ICMP");
 }
 
+#ifdef CONFIG_IP_VS_IPV6
+void ip_vs_nat_icmp_v6(struct sk_buff *skb, struct ip_vs_protocol *pp,
+                    struct ip_vs_conn *cp, int inout)
+{
+        struct ipv6hdr *iph      = ipv6_hdr(skb);
+        unsigned int icmp_offset = sizeof(struct ipv6hdr);
+        struct icmp6hdr *icmph   = (struct icmp6hdr *)(skb_network_header(skb) +
+                                                      icmp_offset);
+        struct ipv6hdr *ciph     = (struct ipv6hdr *)(icmph + 1);
+
+        if (inout) {
+                iph->saddr = cp->vaddr.in6;
+                ciph->daddr = cp->vaddr.in6;
+        } else {
+                iph->daddr = cp->daddr.in6;
+                ciph->saddr = cp->daddr.in6;
+        }
+
+        /* the TCP/UDP port */
+        if (IPPROTO_TCP == ciph->nexthdr || IPPROTO_UDP == ciph->nexthdr) {
+                __be16 *ports = (void *)ciph + sizeof(struct ipv6hdr);
+
+                if (inout)
+                        ports[1] = cp->vport;
+                else
+                        ports[0] = cp->dport;
+        }
+
+        /* And finally the ICMP checksum */
+        icmph->icmp6_cksum = 0;
+        /* TODO IPv6: is this correct for ICMPv6? */
+        ip_vs_checksum_complete(skb, icmp_offset);
+        skb->ip_summed = CHECKSUM_UNNECESSARY;
+
+        if (inout)
+                IP_VS_DBG_PKT(11, pp, skb, (void *)ciph - (void *)iph,
+                        "Forwarding altered outgoing ICMPv6");
+        else
+                IP_VS_DBG_PKT(11, pp, skb, (void *)ciph - (void *)iph,
+                        "Forwarding altered incoming ICMPv6");
+}
+#endif
+
+/* Handle relevant response ICMP messages - forward to the right
+ * destination host. Used for NAT and local client.
+ */
+static int handle_response_icmp(int af, struct sk_buff *skb,
+                                union nf_inet_addr *snet,
+                                __u8 protocol, struct ip_vs_conn *cp,
+                                struct ip_vs_protocol *pp,
+                                unsigned int offset, unsigned int ihl)
+{
+        unsigned int verdict = NF_DROP;
+
+        if (IP_VS_FWD_METHOD(cp) != 0) {
+                IP_VS_ERR("shouldn't reach here, because the box is on the "
+                          "half connection in the tun/dr module.\n");
+        }
+
+        /* Ensure the checksum is correct */
+        if (!skb_csum_unnecessary(skb) && ip_vs_checksum_complete(skb, ihl)) {
+                /* Failed checksum! */
+                IP_VS_DBG_BUF(1, "Forward ICMP: failed checksum from %s!\n",
+                              IP_VS_DBG_ADDR(af, snet));
+                goto out;
+        }
+
+        if (IPPROTO_TCP == protocol || IPPROTO_UDP == protocol)
+                offset += 2 * sizeof(__u16);
+        if (!skb_make_writable(skb, offset))
+                goto out;
+
+#ifdef CONFIG_IP_VS_IPV6
+        if (af == AF_INET6)
+                ip_vs_nat_icmp_v6(skb, pp, cp, 1);
+        else
+#endif
+                ip_vs_nat_icmp(skb, pp, cp, 1);
+
+        /* do the statistics and put it back */
+        ip_vs_out_stats(cp, skb);
+
+        skb->ipvs_property = 1;
+        verdict = NF_ACCEPT;
+
+out:
+        __ip_vs_conn_put(cp);
+
+        return verdict;
+}
+
 /*
  *      Handle ICMP messages in the inside-to-outside direction (outgoing).
- *      Find any that might be relevant, check against existing connections,
- *      forward to the right destination host if relevant.
+ *      Find any that might be relevant, check against existing connections.
  *      Currently handles error types - unreachable, quench, ttl exceeded.
- *      (Only used in VS/NAT)
  */
 static int ip_vs_out_icmp(struct sk_buff *skb, int *related)
 {
         struct iphdr *iph;
         struct icmphdr  _icmph, *ic;
         struct iphdr    _ciph, *cih;    /* The ip header contained within the ICMP */
+        struct ip_vs_iphdr ciph;
         struct ip_vs_conn *cp;
         struct ip_vs_protocol *pp;
-        unsigned int offset, ihl, verdict;
+        unsigned int offset, ihl;
+        union nf_inet_addr snet;
 
         *related = 1;
 
@@ -627,102 +767,231 @@ static int ip_vs_out_icmp(struct sk_buff *skb, int *related)
 
         offset += cih->ihl * 4;
 
+        ip_vs_fill_iphdr(AF_INET, cih, &ciph);
         /* The embedded headers contain source and dest in reverse order */
-        cp = pp->conn_out_get(skb, pp, cih, offset, 1);
+        cp = pp->conn_out_get(AF_INET, skb, pp, &ciph, offset, 1);
         if (!cp)
                 return NF_ACCEPT;
 
-        verdict = NF_DROP;
+        snet.ip = iph->saddr;
+        return handle_response_icmp(AF_INET, skb, &snet, cih->protocol, cp,
+                                    pp, offset, ihl);
+}
 
-        if (IP_VS_FWD_METHOD(cp) != 0) {
-                IP_VS_ERR("shouldn't reach here, because the box is on the "
-                          "half connection in the tun/dr module.\n");
+#ifdef CONFIG_IP_VS_IPV6
+static int ip_vs_out_icmp_v6(struct sk_buff *skb, int *related)
+{
+        struct ipv6hdr *iph;
+        struct icmp6hdr _icmph, *ic;
+        struct ipv6hdr  _ciph, *cih;    /* The ip header contained
+                                           within the ICMP */
+        struct ip_vs_iphdr ciph;
+        struct ip_vs_conn *cp;
+        struct ip_vs_protocol *pp;
+        unsigned int offset;
+        union nf_inet_addr snet;
+
+        *related = 1;
+
+        /* reassemble IP fragments */
+        if (ipv6_hdr(skb)->nexthdr == IPPROTO_FRAGMENT) {
+                if (ip_vs_gather_frags_v6(skb, IP_DEFRAG_VS_OUT))
+                        return NF_STOLEN;
         }
 
-        /* Ensure the checksum is correct */
-        if (!skb_csum_unnecessary(skb) && ip_vs_checksum_complete(skb, ihl)) {
-                /* Failed checksum! */
-                IP_VS_DBG(1, "Forward ICMP: failed checksum from %d.%d.%d.%d!\n",
-                          NIPQUAD(iph->saddr));
-                goto out;
+        iph = ipv6_hdr(skb);
+        offset = sizeof(struct ipv6hdr);
+        ic = skb_header_pointer(skb, offset, sizeof(_icmph), &_icmph);
+        if (ic == NULL)
+                return NF_DROP;
+
+        IP_VS_DBG(12, "Outgoing ICMPv6 (%d,%d) " NIP6_FMT "->" NIP6_FMT "\n",
+                  ic->icmp6_type, ntohs(icmpv6_id(ic)),
+                  NIP6(iph->saddr), NIP6(iph->daddr));
+
+        /*
+         * Work through seeing if this is for us.
+         * These checks are supposed to be in an order that means easy
+         * things are checked first to speed up processing.... however
+         * this means that some packets will manage to get a long way
+         * down this stack and then be rejected, but that's life.
+         */
+        if ((ic->icmp6_type != ICMPV6_DEST_UNREACH) &&
+            (ic->icmp6_type != ICMPV6_PKT_TOOBIG) &&
+            (ic->icmp6_type != ICMPV6_TIME_EXCEED)) {
+                *related = 0;
+                return NF_ACCEPT;
         }
 
-        if (IPPROTO_TCP == cih->protocol || IPPROTO_UDP == cih->protocol)
-                offset += 2 * sizeof(__u16);
-        if (!skb_make_writable(skb, offset))
-                goto out;
+        /* Now find the contained IP header */
+        offset += sizeof(_icmph);
+        cih = skb_header_pointer(skb, offset, sizeof(_ciph), &_ciph);
+        if (cih == NULL)
+                return NF_ACCEPT; /* The packet looks wrong, ignore */
 
-        ip_vs_nat_icmp(skb, pp, cp, 1);
+        pp = ip_vs_proto_get(cih->nexthdr);
+        if (!pp)
+                return NF_ACCEPT;
 
-        /* do the statistics and put it back */
-        ip_vs_out_stats(cp, skb);
+        /* Is the embedded protocol header present? */
+        /* TODO: we don't support fragmentation at the moment anyways */
+        if (unlikely(cih->nexthdr == IPPROTO_FRAGMENT && pp->dont_defrag))
+                return NF_ACCEPT;
 
-        skb->ipvs_property = 1;
-        verdict = NF_ACCEPT;
+        IP_VS_DBG_PKT(11, pp, skb, offset, "Checking outgoing ICMPv6 for");
 
-  out:
-        __ip_vs_conn_put(cp);
+        offset += sizeof(struct ipv6hdr);
 
-        return verdict;
+        ip_vs_fill_iphdr(AF_INET6, cih, &ciph);
+        /* The embedded headers contain source and dest in reverse order */
+        cp = pp->conn_out_get(AF_INET6, skb, pp, &ciph, offset, 1);
+        if (!cp)
+                return NF_ACCEPT;
+
+        ipv6_addr_copy(&snet.in6, &iph->saddr);
+        return handle_response_icmp(AF_INET6, skb, &snet, cih->nexthdr, cp,
+                                    pp, offset, sizeof(struct ipv6hdr));
 }
+#endif
 
-static inline int is_tcp_reset(const struct sk_buff *skb)
+static inline int is_tcp_reset(const struct sk_buff *skb, int nh_len)
 {
         struct tcphdr _tcph, *th;
 
-        th = skb_header_pointer(skb, ip_hdrlen(skb), sizeof(_tcph), &_tcph);
+        th = skb_header_pointer(skb, nh_len, sizeof(_tcph), &_tcph);
         if (th == NULL)
                 return 0;
         return th->rst;
 }
 
+/* Handle response packets: rewrite addresses and send away...
+ * Used for NAT and local client.
+ */
+static unsigned int
+handle_response(int af, struct sk_buff *skb, struct ip_vs_protocol *pp,
+                struct ip_vs_conn *cp, int ihl)
+{
+        IP_VS_DBG_PKT(11, pp, skb, 0, "Outgoing packet");
+
+        if (!skb_make_writable(skb, ihl))
+                goto drop;
+
+        /* mangle the packet */
+        if (pp->snat_handler && !pp->snat_handler(skb, pp, cp))
+                goto drop;
+
+#ifdef CONFIG_IP_VS_IPV6
+        if (af == AF_INET6)
+                ipv6_hdr(skb)->saddr = cp->vaddr.in6;
+        else
+#endif
+        {
+                ip_hdr(skb)->saddr = cp->vaddr.ip;
+                ip_send_check(ip_hdr(skb));
+        }
+
+        /* For policy routing, packets originating from this
+         * machine itself may be routed differently to packets
+         * passing through.  We want this packet to be routed as
+         * if it came from this machine itself.  So re-compute
+         * the routing information.
+         */
+#ifdef CONFIG_IP_VS_IPV6
+        if (af == AF_INET6) {
+                if (ip6_route_me_harder(skb) != 0)
+                        goto drop;
+        } else
+#endif
+                if (ip_route_me_harder(skb, RTN_LOCAL) != 0)
+                        goto drop;
+
+        IP_VS_DBG_PKT(10, pp, skb, 0, "After SNAT");
+
+        ip_vs_out_stats(cp, skb);
+        ip_vs_set_state(cp, IP_VS_DIR_OUTPUT, skb, pp);
+        ip_vs_conn_put(cp);
+
+        skb->ipvs_property = 1;
+
+        LeaveFunction(11);
+        return NF_ACCEPT;
+
+drop:
+        ip_vs_conn_put(cp);
+        kfree_skb(skb);
+        return NF_STOLEN;
+}
+
 /*
  *      It is hooked at the NF_INET_FORWARD chain, used only for VS/NAT.
- *      Check if outgoing packet belongs to the established ip_vs_conn,
- *      rewrite addresses of the packet and send it on its way...
+ *      Check if outgoing packet belongs to the established ip_vs_conn.
  */
 static unsigned int
 ip_vs_out(unsigned int hooknum, struct sk_buff *skb,
           const struct net_device *in, const struct net_device *out,
           int (*okfn)(struct sk_buff *))
 {
-        struct iphdr    *iph;
+        struct ip_vs_iphdr iph;
         struct ip_vs_protocol *pp;
         struct ip_vs_conn *cp;
-        int ihl;
+        int af;
 
         EnterFunction(11);
 
+        af = (skb->protocol == htons(ETH_P_IP)) ? AF_INET : AF_INET6;
+
         if (skb->ipvs_property)
                 return NF_ACCEPT;
 
-        iph = ip_hdr(skb);
-        if (unlikely(iph->protocol == IPPROTO_ICMP)) {
-                int related, verdict = ip_vs_out_icmp(skb, &related);
+        ip_vs_fill_iphdr(af, skb_network_header(skb), &iph);
+#ifdef CONFIG_IP_VS_IPV6
+        if (af == AF_INET6) {
+                if (unlikely(iph.protocol == IPPROTO_ICMPV6)) {
+                        int related, verdict = ip_vs_out_icmp_v6(skb, &related);
 
-                if (related)
-                        return verdict;
-                iph = ip_hdr(skb);
-        }
+                        if (related)
+                                return verdict;
+                        ip_vs_fill_iphdr(af, skb_network_header(skb), &iph);
+                }
+        } else
+#endif
+                if (unlikely(iph.protocol == IPPROTO_ICMP)) {
+                        int related, verdict = ip_vs_out_icmp(skb, &related);
 
-        pp = ip_vs_proto_get(iph->protocol);
+                        if (related)
+                                return verdict;
+                        ip_vs_fill_iphdr(af, skb_network_header(skb), &iph);
+                }
+
+        pp = ip_vs_proto_get(iph.protocol);
         if (unlikely(!pp))
                 return NF_ACCEPT;
 
         /* reassemble IP fragments */
-        if (unlikely(iph->frag_off & htons(IP_MF|IP_OFFSET) &&
-                     !pp->dont_defrag)) {
-                if (ip_vs_gather_frags(skb, IP_DEFRAG_VS_OUT))
-                        return NF_STOLEN;
-                iph = ip_hdr(skb);
-        }
+#ifdef CONFIG_IP_VS_IPV6
+        if (af == AF_INET6) {
+                if (unlikely(iph.protocol == IPPROTO_ICMPV6)) {
+                        int related, verdict = ip_vs_out_icmp_v6(skb, &related);
+
+                        if (related)
+                                return verdict;
 
-        ihl = iph->ihl << 2;
+                        ip_vs_fill_iphdr(af, skb_network_header(skb), &iph);
+                }
+        } else
+#endif
+                if (unlikely(ip_hdr(skb)->frag_off & htons(IP_MF|IP_OFFSET) &&
+                             !pp->dont_defrag)) {
+                        if (ip_vs_gather_frags(skb, IP_DEFRAG_VS_OUT))
+                                return NF_STOLEN;
+
+                        ip_vs_fill_iphdr(af, skb_network_header(skb), &iph);
+                }
 
         /*
          * Check if the packet belongs to an existing entry
          */
-        cp = pp->conn_out_get(skb, pp, iph, ihl, 0);
+        cp = pp->conn_out_get(af, skb, pp, &iph, iph.len, 0);
 
         if (unlikely(!cp)) {
                 if (sysctl_ip_vs_nat_icmp_send &&
@@ -730,21 +999,31 @@ ip_vs_out(unsigned int hooknum, struct sk_buff *skb,
                      pp->protocol == IPPROTO_UDP)) {
                         __be16 _ports[2], *pptr;
 
-                        pptr = skb_header_pointer(skb, ihl,
+                        pptr = skb_header_pointer(skb, iph.len,
                                                   sizeof(_ports), _ports);
                         if (pptr == NULL)
                                 return NF_ACCEPT;       /* Not for me */
-                        if (ip_vs_lookup_real_service(iph->protocol,
-                                                      iph->saddr, pptr[0])) {
+                        if (ip_vs_lookup_real_service(af, iph.protocol,
+                                                      &iph.saddr,
+                                                      pptr[0])) {
                                 /*
                                  * Notify the real server: there is no
                                  * existing entry if it is not RST
                                  * packet or not TCP packet.
                                  */
-                                if (iph->protocol != IPPROTO_TCP
-                                    || !is_tcp_reset(skb)) {
-                                        icmp_send(skb,ICMP_DEST_UNREACH,
-                                                  ICMP_PORT_UNREACH, 0);
+                                if (iph.protocol != IPPROTO_TCP
+                                    || !is_tcp_reset(skb, iph.len)) {
+#ifdef CONFIG_IP_VS_IPV6
+                                        if (af == AF_INET6)
+                                                icmpv6_send(skb,
+                                                            ICMPV6_DEST_UNREACH,
+                                                            ICMPV6_PORT_UNREACH,
+                                                            0, skb->dev);
+                                        else
+#endif
+                                                icmp_send(skb,
+                                                          ICMP_DEST_UNREACH,
+                                                          ICMP_PORT_UNREACH, 0);
                                         return NF_DROP;
                                 }
                         }
@@ -754,41 +1033,7 @@ ip_vs_out(unsigned int hooknum, struct sk_buff *skb,
                 return NF_ACCEPT;
         }
 
-        IP_VS_DBG_PKT(11, pp, skb, 0, "Outgoing packet");
-
-        if (!skb_make_writable(skb, ihl))
-                goto drop;
-
-        /* mangle the packet */
-        if (pp->snat_handler && !pp->snat_handler(skb, pp, cp))
-                goto drop;
-        ip_hdr(skb)->saddr = cp->vaddr;
-        ip_send_check(ip_hdr(skb));
-
-        /* For policy routing, packets originating from this
-         * machine itself may be routed differently to packets
-         * passing through.  We want this packet to be routed as
-         * if it came from this machine itself.  So re-compute
-         * the routing information.
-         */
-        if (ip_route_me_harder(skb, RTN_LOCAL) != 0)
-                goto drop;
-
-        IP_VS_DBG_PKT(10, pp, skb, 0, "After SNAT");
-
-        ip_vs_out_stats(cp, skb);
-        ip_vs_set_state(cp, IP_VS_DIR_OUTPUT, skb, pp);
-        ip_vs_conn_put(cp);
-
-        skb->ipvs_property = 1;
-
-        LeaveFunction(11);
-        return NF_ACCEPT;
-
-  drop:
-        ip_vs_conn_put(cp);
-        kfree_skb(skb);
-        return NF_STOLEN;
+        return handle_response(af, skb, pp, cp, iph.len);
 }
 
 
@@ -804,9 +1049,11 @@ ip_vs_in_icmp(struct sk_buff *skb, int *related, unsigned int hooknum)
         struct iphdr *iph;
         struct icmphdr  _icmph, *ic;
         struct iphdr    _ciph, *cih;    /* The ip header contained within the ICMP */
+        struct ip_vs_iphdr ciph;
         struct ip_vs_conn *cp;
         struct ip_vs_protocol *pp;
         unsigned int offset, ihl, verdict;
+        union nf_inet_addr snet;
 
         *related = 1;
 
@@ -860,10 +1107,20 @@ ip_vs_in_icmp(struct sk_buff *skb, int *related, unsigned int hooknum)
 
         offset += cih->ihl * 4;
 
+        ip_vs_fill_iphdr(AF_INET, cih, &ciph);
         /* The embedded headers contain source and dest in reverse order */
-        cp = pp->conn_in_get(skb, pp, cih, offset, 1);
-        if (!cp)
+        cp = pp->conn_in_get(AF_INET, skb, pp, &ciph, offset, 1);
+        if (!cp) {
+                /* The packet could also belong to a local client */
+                cp = pp->conn_out_get(AF_INET, skb, pp, &ciph, offset, 1);
+                if (cp) {
+                        snet.ip = iph->saddr;
+                        return handle_response_icmp(AF_INET, skb, &snet,
+                                                    cih->protocol, cp, pp,
+                                                    offset, ihl);
+                }
                 return NF_ACCEPT;
+        }
 
         verdict = NF_DROP;
 
@@ -888,6 +1145,105 @@ ip_vs_in_icmp(struct sk_buff *skb, int *related, unsigned int hooknum)
         return verdict;
 }
 
+#ifdef CONFIG_IP_VS_IPV6
+static int
+ip_vs_in_icmp_v6(struct sk_buff *skb, int *related, unsigned int hooknum)
+{
+        struct ipv6hdr *iph;
+        struct icmp6hdr _icmph, *ic;
+        struct ipv6hdr  _ciph, *cih;    /* The ip header contained
+                                           within the ICMP */
+        struct ip_vs_iphdr ciph;
+        struct ip_vs_conn *cp;
+        struct ip_vs_protocol *pp;
+        unsigned int offset, verdict;
+        union nf_inet_addr snet;
+
+        *related = 1;
+
+        /* reassemble IP fragments */
+        if (ipv6_hdr(skb)->nexthdr == IPPROTO_FRAGMENT) {
+                if (ip_vs_gather_frags_v6(skb, hooknum == NF_INET_LOCAL_IN ?
+                                               IP_DEFRAG_VS_IN :
+                                               IP_DEFRAG_VS_FWD))
+                        return NF_STOLEN;
+        }
+
+        iph = ipv6_hdr(skb);
+        offset = sizeof(struct ipv6hdr);
+        ic = skb_header_pointer(skb, offset, sizeof(_icmph), &_icmph);
+        if (ic == NULL)
+                return NF_DROP;
+
+        IP_VS_DBG(12, "Incoming ICMPv6 (%d,%d) " NIP6_FMT "->" NIP6_FMT "\n",
+                  ic->icmp6_type, ntohs(icmpv6_id(ic)),
+                  NIP6(iph->saddr), NIP6(iph->daddr));
+
+        /*
+         * Work through seeing if this is for us.
+         * These checks are supposed to be in an order that means easy
+         * things are checked first to speed up processing.... however
+         * this means that some packets will manage to get a long way
+         * down this stack and then be rejected, but that's life.
+         */
+        if ((ic->icmp6_type != ICMPV6_DEST_UNREACH) &&
+            (ic->icmp6_type != ICMPV6_PKT_TOOBIG) &&
+            (ic->icmp6_type != ICMPV6_TIME_EXCEED)) {
+                *related = 0;
+                return NF_ACCEPT;
+        }
+
+        /* Now find the contained IP header */
+        offset += sizeof(_icmph);
+        cih = skb_header_pointer(skb, offset, sizeof(_ciph), &_ciph);
+        if (cih == NULL)
+                return NF_ACCEPT; /* The packet looks wrong, ignore */
+
+        pp = ip_vs_proto_get(cih->nexthdr);
+        if (!pp)
+                return NF_ACCEPT;
+
+        /* Is the embedded protocol header present? */
+        /* TODO: we don't support fragmentation at the moment anyways */
+        if (unlikely(cih->nexthdr == IPPROTO_FRAGMENT && pp->dont_defrag))
+                return NF_ACCEPT;
+
+        IP_VS_DBG_PKT(11, pp, skb, offset, "Checking incoming ICMPv6 for");
+
+        offset += sizeof(struct ipv6hdr);
+
+        ip_vs_fill_iphdr(AF_INET6, cih, &ciph);
+        /* The embedded headers contain source and dest in reverse order */
+        cp = pp->conn_in_get(AF_INET6, skb, pp, &ciph, offset, 1);
+        if (!cp) {
+                /* The packet could also belong to a local client */
+                cp = pp->conn_out_get(AF_INET6, skb, pp, &ciph, offset, 1);
+                if (cp) {
+                        ipv6_addr_copy(&snet.in6, &iph->saddr);
+                        return handle_response_icmp(AF_INET6, skb, &snet,
+                                                    cih->nexthdr,
+                                                    cp, pp, offset,
+                                                    sizeof(struct ipv6hdr));
+                }
+                return NF_ACCEPT;
+        }
+
+        verdict = NF_DROP;
+
+        /* do the statistics and put it back */
+        ip_vs_in_stats(cp, skb);
+        if (IPPROTO_TCP == cih->nexthdr || IPPROTO_UDP == cih->nexthdr)
+                offset += 2 * sizeof(__u16);
+        verdict = ip_vs_icmp_xmit_v6(skb, cp, pp, offset);
+        /* do not touch skb anymore */
+
+        __ip_vs_conn_put(cp);
+
+        return verdict;
+}
+#endif
+
+
 /*
  *      Check if it's for virtual services, look it up,
  *      and send it on its way...
@@ -897,50 +1253,54 @@ ip_vs_in(unsigned int hooknum, struct sk_buff *skb,
          const struct net_device *in, const struct net_device *out,
          int (*okfn)(struct sk_buff *))
 {
-        struct iphdr    *iph;
+        struct ip_vs_iphdr iph;
         struct ip_vs_protocol *pp;
         struct ip_vs_conn *cp;
-        int ret, restart;
-        int ihl;
+        int ret, restart, af;
+
+        af = (skb->protocol == htons(ETH_P_IP)) ? AF_INET : AF_INET6;
+
+        ip_vs_fill_iphdr(af, skb_network_header(skb), &iph);
 
         /*
-         *      Big tappo: only PACKET_HOST (neither loopback nor mcasts)
-         *      ... don't know why 1st test DOES NOT include 2nd (?)
+         *      Big tappo: only PACKET_HOST, including loopback for local client
+         *      Don't handle local packets on IPv6 for now
          */
-        if (unlikely(skb->pkt_type != PACKET_HOST
-                     || skb->dev->flags & IFF_LOOPBACK || skb->sk)) {
-                IP_VS_DBG(12, "packet type=%d proto=%d daddr=%d.%d.%d.%d ignored\n",
-                          skb->pkt_type,
-                          ip_hdr(skb)->protocol,
-                          NIPQUAD(ip_hdr(skb)->daddr));
+        if (unlikely(skb->pkt_type != PACKET_HOST)) {
+                IP_VS_DBG_BUF(12, "packet type=%d proto=%d daddr=%s ignored\n",
+                              skb->pkt_type,
+                              iph.protocol,
+                              IP_VS_DBG_ADDR(af, &iph.daddr));
                 return NF_ACCEPT;
         }
 
-        iph = ip_hdr(skb);
-        if (unlikely(iph->protocol == IPPROTO_ICMP)) {
+        if (unlikely(iph.protocol == IPPROTO_ICMP)) {
                 int related, verdict = ip_vs_in_icmp(skb, &related, hooknum);
 
                 if (related)
                         return verdict;
-                iph = ip_hdr(skb);
+                ip_vs_fill_iphdr(af, skb_network_header(skb), &iph);
         }
 
         /* Protocol supported? */
-        pp = ip_vs_proto_get(iph->protocol);
+        pp = ip_vs_proto_get(iph.protocol);
         if (unlikely(!pp))
                 return NF_ACCEPT;
 
-        ihl = iph->ihl << 2;
-
         /*
          * Check if the packet belongs to an existing connection entry
          */
-        cp = pp->conn_in_get(skb, pp, iph, ihl, 0);
+        cp = pp->conn_in_get(af, skb, pp, &iph, iph.len, 0);
 
         if (unlikely(!cp)) {
                 int v;
 
-                if (!pp->conn_schedule(skb, pp, &v, &cp))
+                /* For local client packets, it could be a response */
+                cp = pp->conn_out_get(af, skb, pp, &iph, iph.len, 0);
+                if (cp)
+                        return handle_response(af, skb, pp, cp, iph.len);
+
+                if (!pp->conn_schedule(af, skb, pp, &v, &cp))
                         return v;
         }
 
@@ -984,7 +1344,8 @@ ip_vs_in(unsigned int hooknum, struct sk_buff *skb,
          * encorage the standby servers to update the connections timeout
          */
         atomic_inc(&cp->in_pkts);
-        if ((ip_vs_sync_state & IP_VS_STATE_MASTER) &&
+        if (af == AF_INET &&
+            (ip_vs_sync_state & IP_VS_STATE_MASTER) &&
             (((cp->protocol != IPPROTO_TCP ||
                cp->state == IP_VS_TCP_S_ESTABLISHED) &&
               (atomic_read(&cp->in_pkts) % sysctl_ip_vs_sync_threshold[1]
@@ -1023,6 +1384,21 @@ ip_vs_forward_icmp(unsigned int hooknum, struct sk_buff *skb,
         return ip_vs_in_icmp(skb, &r, hooknum);
 }
 
+#ifdef CONFIG_IP_VS_IPV6
+static unsigned int
+ip_vs_forward_icmp_v6(unsigned int hooknum, struct sk_buff *skb,
+                      const struct net_device *in, const struct net_device *out,
+                      int (*okfn)(struct sk_buff *))
+{
+        int r;
+
+        if (ipv6_hdr(skb)->nexthdr != IPPROTO_ICMPV6)
+                return NF_ACCEPT;
+
+        return ip_vs_in_icmp_v6(skb, &r, hooknum);
+}
+#endif
+
 
 static struct nf_hook_ops ip_vs_ops[] __read_mostly = {
         /* After packet filtering, forward packet through VS/DR, VS/TUN,
@@ -1060,6 +1436,43 @@ static struct nf_hook_ops ip_vs_ops[] __read_mostly = {
                 .hooknum        = NF_INET_POST_ROUTING,
                 .priority       = NF_IP_PRI_NAT_SRC-1,
         },
+#ifdef CONFIG_IP_VS_IPV6
+        /* After packet filtering, forward packet through VS/DR, VS/TUN,
+         * or VS/NAT(change destination), so that filtering rules can be
+         * applied to IPVS. */
+        {
+                .hook           = ip_vs_in,
+                .owner          = THIS_MODULE,
+                .pf             = PF_INET6,
+                .hooknum        = NF_INET_LOCAL_IN,
+                .priority       = 100,
+        },
+        /* After packet filtering, change source only for VS/NAT */
+        {
+                .hook           = ip_vs_out,
+                .owner          = THIS_MODULE,
+                .pf             = PF_INET6,
+                .hooknum        = NF_INET_FORWARD,
+                .priority       = 100,
+        },
+        /* After packet filtering (but before ip_vs_out_icmp), catch icmp
+         * destined for 0.0.0.0/0, which is for incoming IPVS connections */
+        {
+                .hook           = ip_vs_forward_icmp_v6,
+                .owner          = THIS_MODULE,
+                .pf             = PF_INET6,
+                .hooknum        = NF_INET_FORWARD,
+                .priority       = 99,
+        },
+        /* Before the netfilter connection tracking, exit from POST_ROUTING */
+        {
+                .hook           = ip_vs_post_routing,
+                .owner          = THIS_MODULE,
+                .pf             = PF_INET6,
+                .hooknum        = NF_INET_POST_ROUTING,
+                .priority       = NF_IP6_PRI_NAT_SRC-1,
+        },
+#endif
 };
 
 
@@ -1070,10 +1483,12 @@ static int __init ip_vs_init(void)
 {
         int ret;
 
+        ip_vs_estimator_init();
+
         ret = ip_vs_control_init();
         if (ret < 0) {
                 IP_VS_ERR("can't setup control.\n");
-                goto cleanup_nothing;
+                goto cleanup_estimator;
         }
 
         ip_vs_protocol_init();
@@ -1106,7 +1521,8 @@ static int __init ip_vs_init(void)
   cleanup_protocol:
         ip_vs_protocol_cleanup();
         ip_vs_control_cleanup();
-  cleanup_nothing:
+  cleanup_estimator:
+        ip_vs_estimator_cleanup();
         return ret;
 }
 
@@ -1117,6 +1533,7 @@ static void __exit ip_vs_cleanup(void)
         ip_vs_app_cleanup();
         ip_vs_protocol_cleanup();
         ip_vs_control_cleanup();
+        ip_vs_estimator_cleanup();
         IP_VS_INFO("ipvs unloaded.\n");
 }
 
diff --git a/net/ipv4/ipvs/ip_vs_ctl.c b/net/ipv4/ipvs/ip_vs_ctl.c
index 6379705a8dcb..771551d8fba9 100644
--- a/net/ipv4/ipvs/ip_vs_ctl.c
+++ b/net/ipv4/ipvs/ip_vs_ctl.c
@@ -35,8 +35,13 @@
 
 #include <net/net_namespace.h>
 #include <net/ip.h>
+#ifdef CONFIG_IP_VS_IPV6
+#include <net/ipv6.h>
+#include <net/ip6_route.h>
+#endif
 #include <net/route.h>
 #include <net/sock.h>
+#include <net/genetlink.h>
 
 #include <asm/uaccess.h>
 
@@ -90,6 +95,26 @@ int ip_vs_get_debug_level(void)
 }
 #endif
 
+#ifdef CONFIG_IP_VS_IPV6
+/* Taken from rt6_fill_node() in net/ipv6/route.c, is there a better way? */
+static int __ip_vs_addr_is_local_v6(const struct in6_addr *addr)
+{
+        struct rt6_info *rt;
+        struct flowi fl = {
+                .oif = 0,
+                .nl_u = {
+                        .ip6_u = {
+                                .daddr = *addr,
+                                .saddr = { .s6_addr32 = {0, 0, 0, 0} }, } },
+        };
+
+        rt = (struct rt6_info *)ip6_route_output(&init_net, NULL, &fl);
+        if (rt && rt->rt6i_dev && (rt->rt6i_dev->flags & IFF_LOOPBACK))
+                        return 1;
+
+        return 0;
+}
+#endif
 /*
  *      update_defense_level is called from keventd and from sysctl,
  *      so it needs to protect itself from softirqs
@@ -281,11 +306,19 @@ static atomic_t ip_vs_nullsvc_counter = ATOMIC_INIT(0);
  *      Returns hash value for virtual service
  */
 static __inline__ unsigned
-ip_vs_svc_hashkey(unsigned proto, __be32 addr, __be16 port)
+ip_vs_svc_hashkey(int af, unsigned proto, const union nf_inet_addr *addr,
+                  __be16 port)
 {
         register unsigned porth = ntohs(port);
+        __be32 addr_fold = addr->ip;
+
+#ifdef CONFIG_IP_VS_IPV6
+        if (af == AF_INET6)
+                addr_fold = addr->ip6[0]^addr->ip6[1]^
+                            addr->ip6[2]^addr->ip6[3];
+#endif
 
-        return (proto^ntohl(addr)^(porth>>IP_VS_SVC_TAB_BITS)^porth)
+        return (proto^ntohl(addr_fold)^(porth>>IP_VS_SVC_TAB_BITS)^porth)
                 & IP_VS_SVC_TAB_MASK;
 }
 
@@ -316,7 +349,8 @@ static int ip_vs_svc_hash(struct ip_vs_service *svc)
                 /*
                  *  Hash it by <protocol,addr,port> in ip_vs_svc_table
                  */
-                hash = ip_vs_svc_hashkey(svc->protocol, svc->addr, svc->port);
+                hash = ip_vs_svc_hashkey(svc->af, svc->protocol, &svc->addr,
+                                         svc->port);
                 list_add(&svc->s_list, &ip_vs_svc_table[hash]);
         } else {
                 /*
@@ -362,17 +396,19 @@ static int ip_vs_svc_unhash(struct ip_vs_service *svc)
 /*
  *      Get service by {proto,addr,port} in the service table.
  */
-static __inline__ struct ip_vs_service *
-__ip_vs_service_get(__u16 protocol, __be32 vaddr, __be16 vport)
+static inline struct ip_vs_service *
+__ip_vs_service_get(int af, __u16 protocol, const union nf_inet_addr *vaddr,
+                    __be16 vport)
 {
         unsigned hash;
         struct ip_vs_service *svc;
 
         /* Check for "full" addressed entries */
-        hash = ip_vs_svc_hashkey(protocol, vaddr, vport);
+        hash = ip_vs_svc_hashkey(af, protocol, vaddr, vport);
 
         list_for_each_entry(svc, &ip_vs_svc_table[hash], s_list){
-                if ((svc->addr == vaddr)
+                if ((svc->af == af)
+                    && ip_vs_addr_equal(af, &svc->addr, vaddr)
                     && (svc->port == vport)
                     && (svc->protocol == protocol)) {
                         /* HIT */
@@ -388,7 +424,8 @@ __ip_vs_service_get(__u16 protocol, __be32 vaddr, __be16 vport)
 /*
  *      Get service by {fwmark} in the service table.
  */
-static __inline__ struct ip_vs_service *__ip_vs_svc_fwm_get(__u32 fwmark)
+static inline struct ip_vs_service *
+__ip_vs_svc_fwm_get(int af, __u32 fwmark)
 {
         unsigned hash;
         struct ip_vs_service *svc;
@@ -397,7 +434,7 @@ static __inline__ struct ip_vs_service *__ip_vs_svc_fwm_get(__u32 fwmark)
         hash = ip_vs_svc_fwm_hashkey(fwmark);
 
         list_for_each_entry(svc, &ip_vs_svc_fwm_table[hash], f_list) {
-                if (svc->fwmark == fwmark) {
+                if (svc->fwmark == fwmark && svc->af == af) {
                         /* HIT */
                         atomic_inc(&svc->usecnt);
                         return svc;
@@ -408,7 +445,8 @@ static __inline__ struct ip_vs_service *__ip_vs_svc_fwm_get(__u32 fwmark)
 }
 
 struct ip_vs_service *
-ip_vs_service_get(__u32 fwmark, __u16 protocol, __be32 vaddr, __be16 vport)
+ip_vs_service_get(int af, __u32 fwmark, __u16 protocol,
+                  const union nf_inet_addr *vaddr, __be16 vport)
 {
         struct ip_vs_service *svc;
 
@@ -417,14 +455,14 @@ ip_vs_service_get(__u32 fwmark, __u16 protocol, __be32 vaddr, __be16 vport)
         /*
          *      Check the table hashed by fwmark first
          */
-        if (fwmark && (svc = __ip_vs_svc_fwm_get(fwmark)))
+        if (fwmark && (svc = __ip_vs_svc_fwm_get(af, fwmark)))
                 goto out;
 
         /*
          *      Check the table hashed by <protocol,addr,port>
          *      for "full" addressed entries
          */
-        svc = __ip_vs_service_get(protocol, vaddr, vport);
+        svc = __ip_vs_service_get(af, protocol, vaddr, vport);
 
         if (svc == NULL
             && protocol == IPPROTO_TCP
@@ -434,7 +472,7 @@ ip_vs_service_get(__u32 fwmark, __u16 protocol, __be32 vaddr, __be16 vport)
                  * Check if ftp service entry exists, the packet
                  * might belong to FTP data connections.
                  */
-                svc = __ip_vs_service_get(protocol, vaddr, FTPPORT);
+                svc = __ip_vs_service_get(af, protocol, vaddr, FTPPORT);
         }
 
         if (svc == NULL
@@ -442,16 +480,16 @@ ip_vs_service_get(__u32 fwmark, __u16 protocol, __be32 vaddr, __be16 vport)
                 /*
                  * Check if the catch-all port (port zero) exists
                  */
-                svc = __ip_vs_service_get(protocol, vaddr, 0);
+                svc = __ip_vs_service_get(af, protocol, vaddr, 0);
         }
 
   out:
         read_unlock(&__ip_vs_svc_lock);
 
-        IP_VS_DBG(9, "lookup service: fwm %u %s %u.%u.%u.%u:%u %s\n",
-                  fwmark, ip_vs_proto_name(protocol),
-                  NIPQUAD(vaddr), ntohs(vport),
-                  svc?"hit":"not hit");
+        IP_VS_DBG_BUF(9, "lookup service: fwm %u %s %s:%u %s\n",
+                      fwmark, ip_vs_proto_name(protocol),
+                      IP_VS_DBG_ADDR(af, vaddr), ntohs(vport),
+                      svc ? "hit" : "not hit");
 
         return svc;
 }
@@ -478,11 +516,20 @@ __ip_vs_unbind_svc(struct ip_vs_dest *dest)
 /*
  *      Returns hash value for real service
  */
-static __inline__ unsigned ip_vs_rs_hashkey(__be32 addr, __be16 port)
+static inline unsigned ip_vs_rs_hashkey(int af,
+                                            const union nf_inet_addr *addr,
+                                            __be16 port)
 {
         register unsigned porth = ntohs(port);
+        __be32 addr_fold = addr->ip;
+
+#ifdef CONFIG_IP_VS_IPV6
+        if (af == AF_INET6)
+                addr_fold = addr->ip6[0]^addr->ip6[1]^
+                            addr->ip6[2]^addr->ip6[3];
+#endif
 
-        return (ntohl(addr)^(porth>>IP_VS_RTAB_BITS)^porth)
+        return (ntohl(addr_fold)^(porth>>IP_VS_RTAB_BITS)^porth)
                 & IP_VS_RTAB_MASK;
 }
 
@@ -502,7 +549,8 @@ static int ip_vs_rs_hash(struct ip_vs_dest *dest)
          *      Hash by proto,addr,port,
          *      which are the parameters of the real service.
          */
-        hash = ip_vs_rs_hashkey(dest->addr, dest->port);
+        hash = ip_vs_rs_hashkey(dest->af, &dest->addr, dest->port);
+
         list_add(&dest->d_list, &ip_vs_rtable[hash]);
 
         return 1;
@@ -529,7 +577,9 @@ static int ip_vs_rs_unhash(struct ip_vs_dest *dest)
  *      Lookup real service by <proto,addr,port> in the real service table.
  */
 struct ip_vs_dest *
-ip_vs_lookup_real_service(__u16 protocol, __be32 daddr, __be16 dport)
+ip_vs_lookup_real_service(int af, __u16 protocol,
+                          const union nf_inet_addr *daddr,
+                          __be16 dport)
 {
         unsigned hash;
         struct ip_vs_dest *dest;
@@ -538,11 +588,12 @@ ip_vs_lookup_real_service(__u16 protocol, __be32 daddr, __be16 dport)
          *      Check for "full" addressed entries
          *      Return the first found entry
          */
-        hash = ip_vs_rs_hashkey(daddr, dport);
+        hash = ip_vs_rs_hashkey(af, daddr, dport);
 
         read_lock(&__ip_vs_rs_lock);
         list_for_each_entry(dest, &ip_vs_rtable[hash], d_list) {
-                if ((dest->addr == daddr)
+                if ((dest->af == af)
+                    && ip_vs_addr_equal(af, &dest->addr, daddr)
                     && (dest->port == dport)
                     && ((dest->protocol == protocol) ||
                         dest->vfwmark)) {
@@ -560,7 +611,8 @@ ip_vs_lookup_real_service(__u16 protocol, __be32 daddr, __be16 dport)
  *      Lookup destination by {addr,port} in the given service
  */
 static struct ip_vs_dest *
-ip_vs_lookup_dest(struct ip_vs_service *svc, __be32 daddr, __be16 dport)
+ip_vs_lookup_dest(struct ip_vs_service *svc, const union nf_inet_addr *daddr,
+                  __be16 dport)
 {
         struct ip_vs_dest *dest;
 
@@ -568,7 +620,9 @@ ip_vs_lookup_dest(struct ip_vs_service *svc, __be32 daddr, __be16 dport)
          * Find the destination for the given service
          */
         list_for_each_entry(dest, &svc->destinations, n_list) {
-                if ((dest->addr == daddr) && (dest->port == dport)) {
+                if ((dest->af == svc->af)
+                    && ip_vs_addr_equal(svc->af, &dest->addr, daddr)
+                    && (dest->port == dport)) {
                         /* HIT */
                         return dest;
                 }
@@ -587,13 +641,15 @@ ip_vs_lookup_dest(struct ip_vs_service *svc, __be32 daddr, __be16 dport)
  * ip_vs_lookup_real_service() looked promissing, but
  * seems not working as expected.
  */
-struct ip_vs_dest *ip_vs_find_dest(__be32 daddr, __be16 dport,
-                                    __be32 vaddr, __be16 vport, __u16 protocol)
+struct ip_vs_dest *ip_vs_find_dest(int af, const union nf_inet_addr *daddr,
+                                   __be16 dport,
+                                   const union nf_inet_addr *vaddr,
+                                   __be16 vport, __u16 protocol)
 {
         struct ip_vs_dest *dest;
         struct ip_vs_service *svc;
 
-        svc = ip_vs_service_get(0, protocol, vaddr, vport);
+        svc = ip_vs_service_get(af, 0, protocol, vaddr, vport);
         if (!svc)
                 return NULL;
         dest = ip_vs_lookup_dest(svc, daddr, dport);
@@ -614,7 +670,8 @@ struct ip_vs_dest *ip_vs_find_dest(__be32 daddr, __be16 dport,
  *  scheduling.
  */
 static struct ip_vs_dest *
-ip_vs_trash_get_dest(struct ip_vs_service *svc, __be32 daddr, __be16 dport)
+ip_vs_trash_get_dest(struct ip_vs_service *svc, const union nf_inet_addr *daddr,
+                     __be16 dport)
 {
         struct ip_vs_dest *dest, *nxt;
 
@@ -622,17 +679,19 @@ ip_vs_trash_get_dest(struct ip_vs_service *svc, __be32 daddr, __be16 dport)
          * Find the destination in trash
          */
         list_for_each_entry_safe(dest, nxt, &ip_vs_dest_trash, n_list) {
-                IP_VS_DBG(3, "Destination %u/%u.%u.%u.%u:%u still in trash, "
-                          "dest->refcnt=%d\n",
-                          dest->vfwmark,
-                          NIPQUAD(dest->addr), ntohs(dest->port),
-                          atomic_read(&dest->refcnt));
-                if (dest->addr == daddr &&
+                IP_VS_DBG_BUF(3, "Destination %u/%s:%u still in trash, "
+                              "dest->refcnt=%d\n",
+                              dest->vfwmark,
+                              IP_VS_DBG_ADDR(svc->af, &dest->addr),
+                              ntohs(dest->port),
+                              atomic_read(&dest->refcnt));
+                if (dest->af == svc->af &&
+                    ip_vs_addr_equal(svc->af, &dest->addr, daddr) &&
                     dest->port == dport &&
                     dest->vfwmark == svc->fwmark &&
                     dest->protocol == svc->protocol &&
                     (svc->fwmark ||
-                     (dest->vaddr == svc->addr &&
+                     (ip_vs_addr_equal(svc->af, &dest->vaddr, &svc->addr) &&
                       dest->vport == svc->port))) {
                         /* HIT */
                         return dest;
@@ -642,10 +701,11 @@ ip_vs_trash_get_dest(struct ip_vs_service *svc, __be32 daddr, __be16 dport)
                  * Try to purge the destination from trash if not referenced
                  */
                 if (atomic_read(&dest->refcnt) == 1) {
-                        IP_VS_DBG(3, "Removing destination %u/%u.%u.%u.%u:%u "
-                                  "from trash\n",
-                                  dest->vfwmark,
-                                  NIPQUAD(dest->addr), ntohs(dest->port));
+                        IP_VS_DBG_BUF(3, "Removing destination %u/%s:%u "
+                                      "from trash\n",
+                                      dest->vfwmark,
+                                      IP_VS_DBG_ADDR(svc->af, &dest->addr),
+                                      ntohs(dest->port));
                         list_del(&dest->n_list);
                         ip_vs_dst_reset(dest);
                         __ip_vs_unbind_svc(dest);
@@ -684,18 +744,7 @@ ip_vs_zero_stats(struct ip_vs_stats *stats)
 {
         spin_lock_bh(&stats->lock);
 
-        stats->conns = 0;
-        stats->inpkts = 0;
-        stats->outpkts = 0;
-        stats->inbytes = 0;
-        stats->outbytes = 0;
-
-        stats->cps = 0;
-        stats->inpps = 0;
-        stats->outpps = 0;
-        stats->inbps = 0;
-        stats->outbps = 0;
-
+        memset(&stats->ustats, 0, sizeof(stats->ustats));
         ip_vs_zero_estimator(stats);
 
         spin_unlock_bh(&stats->lock);
@@ -706,7 +755,7 @@ ip_vs_zero_stats(struct ip_vs_stats *stats)
  */
 static void
 __ip_vs_update_dest(struct ip_vs_service *svc,
-                    struct ip_vs_dest *dest, struct ip_vs_dest_user *udest)
+                    struct ip_vs_dest *dest, struct ip_vs_dest_user_kern *udest)
 {
         int conn_flags;
 
@@ -715,10 +764,18 @@ __ip_vs_update_dest(struct ip_vs_service *svc,
         conn_flags = udest->conn_flags | IP_VS_CONN_F_INACTIVE;
 
         /* check if local node and update the flags */
-        if (inet_addr_type(&init_net, udest->addr) == RTN_LOCAL) {
-                conn_flags = (conn_flags & ~IP_VS_CONN_F_FWD_MASK)
-                        | IP_VS_CONN_F_LOCALNODE;
-        }
+#ifdef CONFIG_IP_VS_IPV6
+        if (svc->af == AF_INET6) {
+                if (__ip_vs_addr_is_local_v6(&udest->addr.in6)) {
+                        conn_flags = (conn_flags & ~IP_VS_CONN_F_FWD_MASK)
+                                | IP_VS_CONN_F_LOCALNODE;
+                }
+        } else
+#endif
+                if (inet_addr_type(&init_net, udest->addr.ip) == RTN_LOCAL) {
+                        conn_flags = (conn_flags & ~IP_VS_CONN_F_FWD_MASK)
+                                | IP_VS_CONN_F_LOCALNODE;
+                }
 
         /* set the IP_VS_CONN_F_NOOUTPUT flag if not masquerading/NAT */
         if ((conn_flags & IP_VS_CONN_F_FWD_MASK) != 0) {
@@ -759,7 +816,7 @@ __ip_vs_update_dest(struct ip_vs_service *svc,
  *      Create a destination for the given service
  */
 static int
-ip_vs_new_dest(struct ip_vs_service *svc, struct ip_vs_dest_user *udest,
+ip_vs_new_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest,
                struct ip_vs_dest **dest_p)
 {
         struct ip_vs_dest *dest;
@@ -767,9 +824,20 @@ ip_vs_new_dest(struct ip_vs_service *svc, struct ip_vs_dest_user *udest,
 
         EnterFunction(2);
 
-        atype = inet_addr_type(&init_net, udest->addr);
-        if (atype != RTN_LOCAL && atype != RTN_UNICAST)
-                return -EINVAL;
+#ifdef CONFIG_IP_VS_IPV6
+        if (svc->af == AF_INET6) {
+                atype = ipv6_addr_type(&udest->addr.in6);
+                if ((!(atype & IPV6_ADDR_UNICAST) ||
+                        atype & IPV6_ADDR_LINKLOCAL) &&
+                        !__ip_vs_addr_is_local_v6(&udest->addr.in6))
+                        return -EINVAL;
+        } else
+#endif
+        {
+                atype = inet_addr_type(&init_net, udest->addr.ip);
+                if (atype != RTN_LOCAL && atype != RTN_UNICAST)
+                        return -EINVAL;
+        }
 
         dest = kzalloc(sizeof(struct ip_vs_dest), GFP_ATOMIC);
         if (dest == NULL) {
@@ -777,11 +845,12 @@ ip_vs_new_dest(struct ip_vs_service *svc, struct ip_vs_dest_user *udest,
                 return -ENOMEM;
         }
 
+        dest->af = svc->af;
         dest->protocol = svc->protocol;
         dest->vaddr = svc->addr;
         dest->vport = svc->port;
         dest->vfwmark = svc->fwmark;
-        dest->addr = udest->addr;
+        ip_vs_addr_copy(svc->af, &dest->addr, &udest->addr);
         dest->port = udest->port;
 
         atomic_set(&dest->activeconns, 0);
@@ -806,10 +875,10 @@ ip_vs_new_dest(struct ip_vs_service *svc, struct ip_vs_dest_user *udest,
  *      Add a destination into an existing service
  */
 static int
-ip_vs_add_dest(struct ip_vs_service *svc, struct ip_vs_dest_user *udest)
+ip_vs_add_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest)
 {
         struct ip_vs_dest *dest;
-        __be32 daddr = udest->addr;
+        union nf_inet_addr daddr;
         __be16 dport = udest->port;
         int ret;
 
@@ -826,10 +895,13 @@ ip_vs_add_dest(struct ip_vs_service *svc, struct ip_vs_dest_user *udest)
                 return -ERANGE;
         }
 
+        ip_vs_addr_copy(svc->af, &daddr, &udest->addr);
+
         /*
          * Check if the dest already exists in the list
          */
-        dest = ip_vs_lookup_dest(svc, daddr, dport);
+        dest = ip_vs_lookup_dest(svc, &daddr, dport);
+
         if (dest != NULL) {
                 IP_VS_DBG(1, "ip_vs_add_dest(): dest already exists\n");
                 return -EEXIST;
@@ -839,15 +911,17 @@ ip_vs_add_dest(struct ip_vs_service *svc, struct ip_vs_dest_user *udest)
          * Check if the dest already exists in the trash and
          * is from the same service
          */
-        dest = ip_vs_trash_get_dest(svc, daddr, dport);
+        dest = ip_vs_trash_get_dest(svc, &daddr, dport);
+
         if (dest != NULL) {
-                IP_VS_DBG(3, "Get destination %u.%u.%u.%u:%u from trash, "
-                          "dest->refcnt=%d, service %u/%u.%u.%u.%u:%u\n",
-                          NIPQUAD(daddr), ntohs(dport),
-                          atomic_read(&dest->refcnt),
-                          dest->vfwmark,
-                          NIPQUAD(dest->vaddr),
-                          ntohs(dest->vport));
+                IP_VS_DBG_BUF(3, "Get destination %s:%u from trash, "
+                              "dest->refcnt=%d, service %u/%s:%u\n",
+                              IP_VS_DBG_ADDR(svc->af, &daddr), ntohs(dport),
+                              atomic_read(&dest->refcnt),
+                              dest->vfwmark,
+                              IP_VS_DBG_ADDR(svc->af, &dest->vaddr),
+                              ntohs(dest->vport));
+
                 __ip_vs_update_dest(svc, dest, udest);
 
                 /*
@@ -868,7 +942,8 @@ ip_vs_add_dest(struct ip_vs_service *svc, struct ip_vs_dest_user *udest)
                 svc->num_dests++;
 
                 /* call the update_service function of its scheduler */
-                svc->scheduler->update_service(svc);
+                if (svc->scheduler->update_service)
+                        svc->scheduler->update_service(svc);
 
                 write_unlock_bh(&__ip_vs_svc_lock);
                 return 0;
@@ -898,7 +973,8 @@ ip_vs_add_dest(struct ip_vs_service *svc, struct ip_vs_dest_user *udest)
         svc->num_dests++;
 
         /* call the update_service function of its scheduler */
-        svc->scheduler->update_service(svc);
+        if (svc->scheduler->update_service)
+                svc->scheduler->update_service(svc);
 
         write_unlock_bh(&__ip_vs_svc_lock);
 
@@ -912,10 +988,10 @@ ip_vs_add_dest(struct ip_vs_service *svc, struct ip_vs_dest_user *udest)
  *      Edit a destination in the given service
  */
 static int
-ip_vs_edit_dest(struct ip_vs_service *svc, struct ip_vs_dest_user *udest)
+ip_vs_edit_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest)
 {
         struct ip_vs_dest *dest;
-        __be32 daddr = udest->addr;
+        union nf_inet_addr daddr;
         __be16 dport = udest->port;
 
         EnterFunction(2);
@@ -931,10 +1007,13 @@ ip_vs_edit_dest(struct ip_vs_service *svc, struct ip_vs_dest_user *udest)
                 return -ERANGE;
         }
 
+        ip_vs_addr_copy(svc->af, &daddr, &udest->addr);
+
         /*
          *  Lookup the destination list
          */
-        dest = ip_vs_lookup_dest(svc, daddr, dport);
+        dest = ip_vs_lookup_dest(svc, &daddr, dport);
+
         if (dest == NULL) {
                 IP_VS_DBG(1, "ip_vs_edit_dest(): dest doesn't exist\n");
                 return -ENOENT;
@@ -948,7 +1027,8 @@ ip_vs_edit_dest(struct ip_vs_service *svc, struct ip_vs_dest_user *udest)
         IP_VS_WAIT_WHILE(atomic_read(&svc->usecnt) > 1);
 
         /* call the update_service, because server weight may be changed */
-        svc->scheduler->update_service(svc);
+        if (svc->scheduler->update_service)
+                svc->scheduler->update_service(svc);
 
         write_unlock_bh(&__ip_vs_svc_lock);
 
@@ -987,10 +1067,11 @@ static void __ip_vs_del_dest(struct ip_vs_dest *dest)
                 atomic_dec(&dest->svc->refcnt);
                 kfree(dest);
         } else {
-                IP_VS_DBG(3, "Moving dest %u.%u.%u.%u:%u into trash, "
-                          "dest->refcnt=%d\n",
-                          NIPQUAD(dest->addr), ntohs(dest->port),
-                          atomic_read(&dest->refcnt));
+                IP_VS_DBG_BUF(3, "Moving dest %s:%u into trash, "
+                              "dest->refcnt=%d\n",
+                              IP_VS_DBG_ADDR(dest->af, &dest->addr),
+                              ntohs(dest->port),
+                              atomic_read(&dest->refcnt));
                 list_add(&dest->n_list, &ip_vs_dest_trash);
                 atomic_inc(&dest->refcnt);
         }
@@ -1011,12 +1092,12 @@ static void __ip_vs_unlink_dest(struct ip_vs_service *svc,
          */
         list_del(&dest->n_list);
         svc->num_dests--;
-        if (svcupd) {
-                /*
-                 *  Call the update_service function of its scheduler
-                 */
-                svc->scheduler->update_service(svc);
-        }
+
+        /*
+         *  Call the update_service function of its scheduler
+         */
+        if (svcupd && svc->scheduler->update_service)
+                        svc->scheduler->update_service(svc);
 }
 
 
@@ -1024,15 +1105,15 @@ static void __ip_vs_unlink_dest(struct ip_vs_service *svc,
  *      Delete a destination server in the given service
  */
 static int
-ip_vs_del_dest(struct ip_vs_service *svc,struct ip_vs_dest_user *udest)
+ip_vs_del_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest)
 {
         struct ip_vs_dest *dest;
-        __be32 daddr = udest->addr;
         __be16 dport = udest->port;
 
         EnterFunction(2);
 
-        dest = ip_vs_lookup_dest(svc, daddr, dport);
+        dest = ip_vs_lookup_dest(svc, &udest->addr, dport);
+
         if (dest == NULL) {
                 IP_VS_DBG(1, "ip_vs_del_dest(): destination not found!\n");
                 return -ENOENT;
@@ -1067,7 +1148,8 @@ ip_vs_del_dest(struct ip_vs_service *svc,struct ip_vs_dest_user *udest)
  *      Add a service into the service hash table
  */
 static int
-ip_vs_add_service(struct ip_vs_service_user *u, struct ip_vs_service **svc_p)
+ip_vs_add_service(struct ip_vs_service_user_kern *u,
+                  struct ip_vs_service **svc_p)
 {
         int ret = 0;
         struct ip_vs_scheduler *sched = NULL;
@@ -1085,6 +1167,19 @@ ip_vs_add_service(struct ip_vs_service_user *u, struct ip_vs_service **svc_p)
                 goto out_mod_dec;
         }
 
+#ifdef CONFIG_IP_VS_IPV6
+        if (u->af == AF_INET6) {
+                if (!sched->supports_ipv6) {
+                        ret = -EAFNOSUPPORT;
+                        goto out_err;
+                }
+                if ((u->netmask < 1) || (u->netmask > 128)) {
+                        ret = -EINVAL;
+                        goto out_err;
+                }
+        }
+#endif
+
         svc = kzalloc(sizeof(struct ip_vs_service), GFP_ATOMIC);
         if (svc == NULL) {
                 IP_VS_DBG(1, "ip_vs_add_service: kmalloc failed.\n");
@@ -1096,8 +1191,9 @@ ip_vs_add_service(struct ip_vs_service_user *u, struct ip_vs_service **svc_p)
         atomic_set(&svc->usecnt, 1);
         atomic_set(&svc->refcnt, 0);
 
+        svc->af = u->af;
         svc->protocol = u->protocol;
-        svc->addr = u->addr;
+        ip_vs_addr_copy(svc->af, &svc->addr, &u->addr);
         svc->port = u->port;
         svc->fwmark = u->fwmark;
         svc->flags = u->flags;
@@ -1121,7 +1217,10 @@ ip_vs_add_service(struct ip_vs_service_user *u, struct ip_vs_service **svc_p)
                 atomic_inc(&ip_vs_nullsvc_counter);
 
         ip_vs_new_estimator(&svc->stats);
-        ip_vs_num_services++;
+
+        /* Count only IPv4 services for old get/setsockopt interface */
+        if (svc->af == AF_INET)
+                ip_vs_num_services++;
 
         /* Hash the service into the service table */
         write_lock_bh(&__ip_vs_svc_lock);
@@ -1156,7 +1255,7 @@ ip_vs_add_service(struct ip_vs_service_user *u, struct ip_vs_service **svc_p)
  *      Edit a service and bind it with a new scheduler
  */
 static int
-ip_vs_edit_service(struct ip_vs_service *svc, struct ip_vs_service_user *u)
+ip_vs_edit_service(struct ip_vs_service *svc, struct ip_vs_service_user_kern *u)
 {
         struct ip_vs_scheduler *sched, *old_sched;
         int ret = 0;
@@ -1172,6 +1271,19 @@ ip_vs_edit_service(struct ip_vs_service *svc, struct ip_vs_service_user *u)
         }
         old_sched = sched;
 
+#ifdef CONFIG_IP_VS_IPV6
+        if (u->af == AF_INET6) {
+                if (!sched->supports_ipv6) {
+                        ret = -EAFNOSUPPORT;
+                        goto out;
+                }
+                if ((u->netmask < 1) || (u->netmask > 128)) {
+                        ret = -EINVAL;
+                        goto out;
+                }
+        }
+#endif
+
         write_lock_bh(&__ip_vs_svc_lock);
 
         /*
@@ -1193,7 +1305,7 @@ ip_vs_edit_service(struct ip_vs_service *svc, struct ip_vs_service_user *u)
                  */
                 if ((ret = ip_vs_unbind_scheduler(svc))) {
                         old_sched = sched;
-                        goto out;
+                        goto out_unlock;
                 }
 
                 /*
@@ -1212,12 +1324,13 @@ ip_vs_edit_service(struct ip_vs_service *svc, struct ip_vs_service_user *u)
                          */
                         ip_vs_bind_scheduler(svc, old_sched);
                         old_sched = sched;
-                        goto out;
+                        goto out_unlock;
                 }
         }
 
-  out:
+  out_unlock:
         write_unlock_bh(&__ip_vs_svc_lock);
+  out:
 
         if (old_sched)
                 ip_vs_scheduler_put(old_sched);
@@ -1236,7 +1349,10 @@ static void __ip_vs_del_service(struct ip_vs_service *svc)
         struct ip_vs_dest *dest, *nxt;
         struct ip_vs_scheduler *old_sched;
 
-        ip_vs_num_services--;
+        /* Count only IPv4 services for old get/setsockopt interface */
+        if (svc->af == AF_INET)
+                ip_vs_num_services--;
+
         ip_vs_kill_estimator(&svc->stats);
 
         /* Unbind scheduler */
@@ -1671,6 +1787,7 @@ static struct ip_vs_service *ip_vs_info_array(struct seq_file *seq, loff_t pos)
 }
 
 static void *ip_vs_info_seq_start(struct seq_file *seq, loff_t *pos)
+__acquires(__ip_vs_svc_lock)
 {
 
         read_lock_bh(&__ip_vs_svc_lock);
@@ -1724,6 +1841,7 @@ static void *ip_vs_info_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 }
 
 static void ip_vs_info_seq_stop(struct seq_file *seq, void *v)
+__releases(__ip_vs_svc_lock)
 {
         read_unlock_bh(&__ip_vs_svc_lock);
 }
@@ -1744,15 +1862,25 @@ static int ip_vs_info_seq_show(struct seq_file *seq, void *v)
                 const struct ip_vs_iter *iter = seq->private;
                 const struct ip_vs_dest *dest;
 
-                if (iter->table == ip_vs_svc_table)
-                        seq_printf(seq, "%s  %08X:%04X %s ",
-                                   ip_vs_proto_name(svc->protocol),
-                                   ntohl(svc->addr),
-                                   ntohs(svc->port),
-                                   svc->scheduler->name);
-                else
+                if (iter->table == ip_vs_svc_table) {
+#ifdef CONFIG_IP_VS_IPV6
+                        if (svc->af == AF_INET6)
+                                seq_printf(seq, "%s  [" NIP6_FMT "]:%04X %s ",
+                                           ip_vs_proto_name(svc->protocol),
+                                           NIP6(svc->addr.in6),
+                                           ntohs(svc->port),
+                                           svc->scheduler->name);
+                        else
+#endif
+                                seq_printf(seq, "%s  %08X:%04X %s ",
+                                           ip_vs_proto_name(svc->protocol),
+                                           ntohl(svc->addr.ip),
+                                           ntohs(svc->port),
+                                           svc->scheduler->name);
+                } else {
                         seq_printf(seq, "FWM  %08X %s ",
                                    svc->fwmark, svc->scheduler->name);
+                }
 
                 if (svc->flags & IP_VS_SVC_F_PERSISTENT)
                         seq_printf(seq, "persistent %d %08X\n",
@@ -1762,13 +1890,29 @@ static int ip_vs_info_seq_show(struct seq_file *seq, void *v)
                         seq_putc(seq, '\n');
 
                 list_for_each_entry(dest, &svc->destinations, n_list) {
-                        seq_printf(seq,
-                                   "  -> %08X:%04X      %-7s %-6d %-10d %-10d\n",
-                                   ntohl(dest->addr), ntohs(dest->port),
-                                   ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
-                                   atomic_read(&dest->weight),
-                                   atomic_read(&dest->activeconns),
-                                   atomic_read(&dest->inactconns));
+#ifdef CONFIG_IP_VS_IPV6
+                        if (dest->af == AF_INET6)
+                                seq_printf(seq,
+                                           "  -> [" NIP6_FMT "]:%04X"
+                                           "      %-7s %-6d %-10d %-10d\n",
+                                           NIP6(dest->addr.in6),
+                                           ntohs(dest->port),
+                                           ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
+                                           atomic_read(&dest->weight),
+                                           atomic_read(&dest->activeconns),
+                                           atomic_read(&dest->inactconns));
+                        else
+#endif
+                                seq_printf(seq,
+                                           "  -> %08X:%04X      "
+                                           "%-7s %-6d %-10d %-10d\n",
+                                           ntohl(dest->addr.ip),
+                                           ntohs(dest->port),
+                                           ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
+                                           atomic_read(&dest->weight),
+                                           atomic_read(&dest->activeconns),
+                                           atomic_read(&dest->inactconns));
+
                 }
         }
         return 0;
@@ -1812,20 +1956,20 @@ static int ip_vs_stats_show(struct seq_file *seq, void *v)
                    "   Conns  Packets  Packets            Bytes            Bytes\n");
 
         spin_lock_bh(&ip_vs_stats.lock);
-        seq_printf(seq, "%8X %8X %8X %16LX %16LX\n\n", ip_vs_stats.conns,
-                   ip_vs_stats.inpkts, ip_vs_stats.outpkts,
-                   (unsigned long long) ip_vs_stats.inbytes,
-                   (unsigned long long) ip_vs_stats.outbytes);
+        seq_printf(seq, "%8X %8X %8X %16LX %16LX\n\n", ip_vs_stats.ustats.conns,
+                   ip_vs_stats.ustats.inpkts, ip_vs_stats.ustats.outpkts,
+                   (unsigned long long) ip_vs_stats.ustats.inbytes,
+                   (unsigned long long) ip_vs_stats.ustats.outbytes);
 
 /*                 01234567 01234567 01234567 0123456701234567 0123456701234567 */
         seq_puts(seq,
                    " Conns/s   Pkts/s   Pkts/s          Bytes/s          Bytes/s\n");
         seq_printf(seq,"%8X %8X %8X %16X %16X\n",
-                        ip_vs_stats.cps,
-                        ip_vs_stats.inpps,
-                        ip_vs_stats.outpps,
-                        ip_vs_stats.inbps,
-                        ip_vs_stats.outbps);
+                        ip_vs_stats.ustats.cps,
+                        ip_vs_stats.ustats.inpps,
+                        ip_vs_stats.ustats.outpps,
+                        ip_vs_stats.ustats.inbps,
+                        ip_vs_stats.ustats.outbps);
         spin_unlock_bh(&ip_vs_stats.lock);
 
         return 0;
@@ -1900,14 +2044,44 @@ static const unsigned char set_arglen[SET_CMDID(IP_VS_SO_SET_MAX)+1] = {
         [SET_CMDID(IP_VS_SO_SET_ZERO)]          = SERVICE_ARG_LEN,
 };
 
+static void ip_vs_copy_usvc_compat(struct ip_vs_service_user_kern *usvc,
+                                  struct ip_vs_service_user *usvc_compat)
+{
+        usvc->af                = AF_INET;
+        usvc->protocol          = usvc_compat->protocol;
+        usvc->addr.ip           = usvc_compat->addr;
+        usvc->port              = usvc_compat->port;
+        usvc->fwmark            = usvc_compat->fwmark;
+
+        /* Deep copy of sched_name is not needed here */
+        usvc->sched_name        = usvc_compat->sched_name;
+
+        usvc->flags             = usvc_compat->flags;
+        usvc->timeout           = usvc_compat->timeout;
+        usvc->netmask           = usvc_compat->netmask;
+}
+
+static void ip_vs_copy_udest_compat(struct ip_vs_dest_user_kern *udest,
+                                   struct ip_vs_dest_user *udest_compat)
+{
+        udest->addr.ip          = udest_compat->addr;
+        udest->port             = udest_compat->port;
+        udest->conn_flags       = udest_compat->conn_flags;
+        udest->weight           = udest_compat->weight;
+        udest->u_threshold      = udest_compat->u_threshold;
+        udest->l_threshold      = udest_compat->l_threshold;
+}
+
 static int
 do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
 {
         int ret;
         unsigned char arg[MAX_ARG_LEN];
-        struct ip_vs_service_user *usvc;
+        struct ip_vs_service_user *usvc_compat;
+        struct ip_vs_service_user_kern usvc;
         struct ip_vs_service *svc;
-        struct ip_vs_dest_user *udest;
+        struct ip_vs_dest_user *udest_compat;
+        struct ip_vs_dest_user_kern udest;
 
         if (!capable(CAP_NET_ADMIN))
                 return -EPERM;
@@ -1947,35 +2121,40 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
                 goto out_unlock;
         }
 
-        usvc = (struct ip_vs_service_user *)arg;
-        udest = (struct ip_vs_dest_user *)(usvc + 1);
+        usvc_compat = (struct ip_vs_service_user *)arg;
+        udest_compat = (struct ip_vs_dest_user *)(usvc_compat + 1);
+
+        /* We only use the new structs internally, so copy userspace compat
+         * structs to extended internal versions */
+        ip_vs_copy_usvc_compat(&usvc, usvc_compat);
+        ip_vs_copy_udest_compat(&udest, udest_compat);
 
         if (cmd == IP_VS_SO_SET_ZERO) {
                 /* if no service address is set, zero counters in all */
-                if (!usvc->fwmark && !usvc->addr && !usvc->port) {
+                if (!usvc.fwmark && !usvc.addr.ip && !usvc.port) {
                         ret = ip_vs_zero_all();
                         goto out_unlock;
                 }
         }
 
         /* Check for valid protocol: TCP or UDP, even for fwmark!=0 */
-        if (usvc->protocol!=IPPROTO_TCP && usvc->protocol!=IPPROTO_UDP) {
+        if (usvc.protocol != IPPROTO_TCP && usvc.protocol != IPPROTO_UDP) {
                 IP_VS_ERR("set_ctl: invalid protocol: %d %d.%d.%d.%d:%d %s\n",
-                          usvc->protocol, NIPQUAD(usvc->addr),
-                          ntohs(usvc->port), usvc->sched_name);
+                          usvc.protocol, NIPQUAD(usvc.addr.ip),
+                          ntohs(usvc.port), usvc.sched_name);
                 ret = -EFAULT;
                 goto out_unlock;
         }
 
         /* Lookup the exact service by <protocol, addr, port> or fwmark */
-        if (usvc->fwmark == 0)
-                svc = __ip_vs_service_get(usvc->protocol,
-                                          usvc->addr, usvc->port);
+        if (usvc.fwmark == 0)
+                svc = __ip_vs_service_get(usvc.af, usvc.protocol,
+                                          &usvc.addr, usvc.port);
         else
-                svc = __ip_vs_svc_fwm_get(usvc->fwmark);
+                svc = __ip_vs_svc_fwm_get(usvc.af, usvc.fwmark);
 
         if (cmd != IP_VS_SO_SET_ADD
-            && (svc == NULL || svc->protocol != usvc->protocol)) {
+            && (svc == NULL || svc->protocol != usvc.protocol)) {
                 ret = -ESRCH;
                 goto out_unlock;
         }
@@ -1985,10 +2164,10 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
                 if (svc != NULL)
                         ret = -EEXIST;
                 else
-                        ret = ip_vs_add_service(usvc, &svc);
+                        ret = ip_vs_add_service(&usvc, &svc);
                 break;
         case IP_VS_SO_SET_EDIT:
-                ret = ip_vs_edit_service(svc, usvc);
+                ret = ip_vs_edit_service(svc, &usvc);
                 break;
         case IP_VS_SO_SET_DEL:
                 ret = ip_vs_del_service(svc);
@@ -1999,13 +2178,13 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
                 ret = ip_vs_zero_service(svc);
                 break;
         case IP_VS_SO_SET_ADDDEST:
-                ret = ip_vs_add_dest(svc, udest);
+                ret = ip_vs_add_dest(svc, &udest);
                 break;
         case IP_VS_SO_SET_EDITDEST:
-                ret = ip_vs_edit_dest(svc, udest);
+                ret = ip_vs_edit_dest(svc, &udest);
                 break;
         case IP_VS_SO_SET_DELDEST:
-                ret = ip_vs_del_dest(svc, udest);
+                ret = ip_vs_del_dest(svc, &udest);
                 break;
         default:
                 ret = -EINVAL;
@@ -2028,7 +2207,7 @@ static void
 ip_vs_copy_stats(struct ip_vs_stats_user *dst, struct ip_vs_stats *src)
 {
         spin_lock_bh(&src->lock);
-        memcpy(dst, src, (char*)&src->lock - (char*)src);
+        memcpy(dst, &src->ustats, sizeof(*dst));
         spin_unlock_bh(&src->lock);
 }
 
@@ -2036,7 +2215,7 @@ static void
 ip_vs_copy_service(struct ip_vs_service_entry *dst, struct ip_vs_service *src)
 {
         dst->protocol = src->protocol;
-        dst->addr = src->addr;
+        dst->addr = src->addr.ip;
         dst->port = src->port;
         dst->fwmark = src->fwmark;
         strlcpy(dst->sched_name, src->scheduler->name, sizeof(dst->sched_name));
@@ -2058,6 +2237,10 @@ __ip_vs_get_service_entries(const struct ip_vs_get_services *get,
 
         for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
                 list_for_each_entry(svc, &ip_vs_svc_table[idx], s_list) {
+                        /* Only expose IPv4 entries to old interface */
+                        if (svc->af != AF_INET)
+                                continue;
+
                         if (count >= get->num_services)
                                 goto out;
                         memset(&entry, 0, sizeof(entry));
@@ -2073,6 +2256,10 @@ __ip_vs_get_service_entries(const struct ip_vs_get_services *get,
 
         for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
                 list_for_each_entry(svc, &ip_vs_svc_fwm_table[idx], f_list) {
+                        /* Only expose IPv4 entries to old interface */
+                        if (svc->af != AF_INET)
+                                continue;
+
                         if (count >= get->num_services)
                                 goto out;
                         memset(&entry, 0, sizeof(entry));
@@ -2094,13 +2281,15 @@ __ip_vs_get_dest_entries(const struct ip_vs_get_dests *get,
                          struct ip_vs_get_dests __user *uptr)
 {
         struct ip_vs_service *svc;
+        union nf_inet_addr addr = { .ip = get->addr };
         int ret = 0;
 
         if (get->fwmark)
-                svc = __ip_vs_svc_fwm_get(get->fwmark);
+                svc = __ip_vs_svc_fwm_get(AF_INET, get->fwmark);
         else
-                svc = __ip_vs_service_get(get->protocol,
-                                          get->addr, get->port);
+                svc = __ip_vs_service_get(AF_INET, get->protocol, &addr,
+                                          get->port);
+
         if (svc) {
                 int count = 0;
                 struct ip_vs_dest *dest;
@@ -2110,7 +2299,7 @@ __ip_vs_get_dest_entries(const struct ip_vs_get_dests *get,
                         if (count >= get->num_dests)
                                 break;
 
-                        entry.addr = dest->addr;
+                        entry.addr = dest->addr.ip;
                         entry.port = dest->port;
                         entry.conn_flags = atomic_read(&dest->conn_flags);
                         entry.weight = atomic_read(&dest->weight);
@@ -2235,13 +2424,15 @@ do_ip_vs_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
         {
                 struct ip_vs_service_entry *entry;
                 struct ip_vs_service *svc;
+                union nf_inet_addr addr;
 
                 entry = (struct ip_vs_service_entry *)arg;
+                addr.ip = entry->addr;
                 if (entry->fwmark)
-                        svc = __ip_vs_svc_fwm_get(entry->fwmark);
+                        svc = __ip_vs_svc_fwm_get(AF_INET, entry->fwmark);
                 else
-                        svc = __ip_vs_service_get(entry->protocol,
-                                                  entry->addr, entry->port);
+                        svc = __ip_vs_service_get(AF_INET, entry->protocol,
+                                                  &addr, entry->port);
                 if (svc) {
                         ip_vs_copy_service(entry, svc);
                         if (copy_to_user(user, entry, sizeof(*entry)) != 0)
@@ -2320,6 +2511,875 @@ static struct nf_sockopt_ops ip_vs_sockopts = {
         .owner          = THIS_MODULE,
 };
 
+/*
+ * Generic Netlink interface
+ */
+
+/* IPVS genetlink family */
+static struct genl_family ip_vs_genl_family = {
+        .id             = GENL_ID_GENERATE,
+        .hdrsize        = 0,
+        .name           = IPVS_GENL_NAME,
+        .version        = IPVS_GENL_VERSION,
+        .maxattr        = IPVS_CMD_MAX,
+};
+
+/* Policy used for first-level command attributes */
+static const struct nla_policy ip_vs_cmd_policy[IPVS_CMD_ATTR_MAX + 1] = {
+        [IPVS_CMD_ATTR_SERVICE]         = { .type = NLA_NESTED },
+        [IPVS_CMD_ATTR_DEST]            = { .type = NLA_NESTED },
+        [IPVS_CMD_ATTR_DAEMON]          = { .type = NLA_NESTED },
+        [IPVS_CMD_ATTR_TIMEOUT_TCP]     = { .type = NLA_U32 },
+        [IPVS_CMD_ATTR_TIMEOUT_TCP_FIN] = { .type = NLA_U32 },
+        [IPVS_CMD_ATTR_TIMEOUT_UDP]     = { .type = NLA_U32 },
+};
+
+/* Policy used for attributes in nested attribute IPVS_CMD_ATTR_DAEMON */
+static const struct nla_policy ip_vs_daemon_policy[IPVS_DAEMON_ATTR_MAX + 1] = {
+        [IPVS_DAEMON_ATTR_STATE]        = { .type = NLA_U32 },
+        [IPVS_DAEMON_ATTR_MCAST_IFN]    = { .type = NLA_NUL_STRING,
+                                            .len = IP_VS_IFNAME_MAXLEN },
+        [IPVS_DAEMON_ATTR_SYNC_ID]      = { .type = NLA_U32 },
+};
+
+/* Policy used for attributes in nested attribute IPVS_CMD_ATTR_SERVICE */
+static const struct nla_policy ip_vs_svc_policy[IPVS_SVC_ATTR_MAX + 1] = {
+        [IPVS_SVC_ATTR_AF]              = { .type = NLA_U16 },
+        [IPVS_SVC_ATTR_PROTOCOL]        = { .type = NLA_U16 },
+        [IPVS_SVC_ATTR_ADDR]            = { .type = NLA_BINARY,
+                                            .len = sizeof(union nf_inet_addr) },
+        [IPVS_SVC_ATTR_PORT]            = { .type = NLA_U16 },
+        [IPVS_SVC_ATTR_FWMARK]          = { .type = NLA_U32 },
+        [IPVS_SVC_ATTR_SCHED_NAME]      = { .type = NLA_NUL_STRING,
+                                            .len = IP_VS_SCHEDNAME_MAXLEN },
+        [IPVS_SVC_ATTR_FLAGS]           = { .type = NLA_BINARY,
+                                            .len = sizeof(struct ip_vs_flags) },
+        [IPVS_SVC_ATTR_TIMEOUT]         = { .type = NLA_U32 },
+        [IPVS_SVC_ATTR_NETMASK]         = { .type = NLA_U32 },
+        [IPVS_SVC_ATTR_STATS]           = { .type = NLA_NESTED },
+};
+
+/* Policy used for attributes in nested attribute IPVS_CMD_ATTR_DEST */
+static const struct nla_policy ip_vs_dest_policy[IPVS_DEST_ATTR_MAX + 1] = {
+        [IPVS_DEST_ATTR_ADDR]           = { .type = NLA_BINARY,
+                                            .len = sizeof(union nf_inet_addr) },
+        [IPVS_DEST_ATTR_PORT]           = { .type = NLA_U16 },
+        [IPVS_DEST_ATTR_FWD_METHOD]     = { .type = NLA_U32 },
+        [IPVS_DEST_ATTR_WEIGHT]         = { .type = NLA_U32 },
+        [IPVS_DEST_ATTR_U_THRESH]       = { .type = NLA_U32 },
+        [IPVS_DEST_ATTR_L_THRESH]       = { .type = NLA_U32 },
+        [IPVS_DEST_ATTR_ACTIVE_CONNS]   = { .type = NLA_U32 },
+        [IPVS_DEST_ATTR_INACT_CONNS]    = { .type = NLA_U32 },
+        [IPVS_DEST_ATTR_PERSIST_CONNS]  = { .type = NLA_U32 },
+        [IPVS_DEST_ATTR_STATS]          = { .type = NLA_NESTED },
+};
+
+static int ip_vs_genl_fill_stats(struct sk_buff *skb, int container_type,
+                                 struct ip_vs_stats *stats)
+{
+        struct nlattr *nl_stats = nla_nest_start(skb, container_type);
+        if (!nl_stats)
+                return -EMSGSIZE;
+
+        spin_lock_bh(&stats->lock);
+
+        NLA_PUT_U32(skb, IPVS_STATS_ATTR_CONNS, stats->ustats.conns);
+        NLA_PUT_U32(skb, IPVS_STATS_ATTR_INPKTS, stats->ustats.inpkts);
+        NLA_PUT_U32(skb, IPVS_STATS_ATTR_OUTPKTS, stats->ustats.outpkts);
+        NLA_PUT_U64(skb, IPVS_STATS_ATTR_INBYTES, stats->ustats.inbytes);
+        NLA_PUT_U64(skb, IPVS_STATS_ATTR_OUTBYTES, stats->ustats.outbytes);
+        NLA_PUT_U32(skb, IPVS_STATS_ATTR_CPS, stats->ustats.cps);
+        NLA_PUT_U32(skb, IPVS_STATS_ATTR_INPPS, stats->ustats.inpps);
+        NLA_PUT_U32(skb, IPVS_STATS_ATTR_OUTPPS, stats->ustats.outpps);
+        NLA_PUT_U32(skb, IPVS_STATS_ATTR_INBPS, stats->ustats.inbps);
+        NLA_PUT_U32(skb, IPVS_STATS_ATTR_OUTBPS, stats->ustats.outbps);
+
+        spin_unlock_bh(&stats->lock);
+
+        nla_nest_end(skb, nl_stats);
+
+        return 0;
+
+nla_put_failure:
+        spin_unlock_bh(&stats->lock);
+        nla_nest_cancel(skb, nl_stats);
+        return -EMSGSIZE;
+}
+
+static int ip_vs_genl_fill_service(struct sk_buff *skb,
+                                   struct ip_vs_service *svc)
+{
+        struct nlattr *nl_service;
+        struct ip_vs_flags flags = { .flags = svc->flags,
+                                     .mask = ~0 };
+
+        nl_service = nla_nest_start(skb, IPVS_CMD_ATTR_SERVICE);
+        if (!nl_service)
+                return -EMSGSIZE;
+
+        NLA_PUT_U16(skb, IPVS_SVC_ATTR_AF, svc->af);
+
+        if (svc->fwmark) {
+                NLA_PUT_U32(skb, IPVS_SVC_ATTR_FWMARK, svc->fwmark);
+        } else {
+                NLA_PUT_U16(skb, IPVS_SVC_ATTR_PROTOCOL, svc->protocol);
+                NLA_PUT(skb, IPVS_SVC_ATTR_ADDR, sizeof(svc->addr), &svc->addr);
+                NLA_PUT_U16(skb, IPVS_SVC_ATTR_PORT, svc->port);
+        }
+
+        NLA_PUT_STRING(skb, IPVS_SVC_ATTR_SCHED_NAME, svc->scheduler->name);
+        NLA_PUT(skb, IPVS_SVC_ATTR_FLAGS, sizeof(flags), &flags);
+        NLA_PUT_U32(skb, IPVS_SVC_ATTR_TIMEOUT, svc->timeout / HZ);
+        NLA_PUT_U32(skb, IPVS_SVC_ATTR_NETMASK, svc->netmask);
+
+        if (ip_vs_genl_fill_stats(skb, IPVS_SVC_ATTR_STATS, &svc->stats))
+                goto nla_put_failure;
+
+        nla_nest_end(skb, nl_service);
+
+        return 0;
+
+nla_put_failure:
+        nla_nest_cancel(skb, nl_service);
+        return -EMSGSIZE;
+}
+
+static int ip_vs_genl_dump_service(struct sk_buff *skb,
+                                   struct ip_vs_service *svc,
+                                   struct netlink_callback *cb)
+{
+        void *hdr;
+
+        hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).pid, cb->nlh->nlmsg_seq,
+                          &ip_vs_genl_family, NLM_F_MULTI,
+                          IPVS_CMD_NEW_SERVICE);
+        if (!hdr)
+                return -EMSGSIZE;
+
+        if (ip_vs_genl_fill_service(skb, svc) < 0)
+                goto nla_put_failure;
+
+        return genlmsg_end(skb, hdr);
+
+nla_put_failure:
+        genlmsg_cancel(skb, hdr);
+        return -EMSGSIZE;
+}
+
+static int ip_vs_genl_dump_services(struct sk_buff *skb,
+                                    struct netlink_callback *cb)
+{
+        int idx = 0, i;
+        int start = cb->args[0];
+        struct ip_vs_service *svc;
+
+        mutex_lock(&__ip_vs_mutex);
+        for (i = 0; i < IP_VS_SVC_TAB_SIZE; i++) {
+                list_for_each_entry(svc, &ip_vs_svc_table[i], s_list) {
+                        if (++idx <= start)
+                                continue;
+                        if (ip_vs_genl_dump_service(skb, svc, cb) < 0) {
+                                idx--;
+                                goto nla_put_failure;
+                        }
+                }
+        }
+
+        for (i = 0; i < IP_VS_SVC_TAB_SIZE; i++) {
+                list_for_each_entry(svc, &ip_vs_svc_fwm_table[i], f_list) {
+                        if (++idx <= start)
+                                continue;
+                        if (ip_vs_genl_dump_service(skb, svc, cb) < 0) {
+                                idx--;
+                                goto nla_put_failure;
+                        }
+                }
+        }
+
+nla_put_failure:
+        mutex_unlock(&__ip_vs_mutex);
+        cb->args[0] = idx;
+
+        return skb->len;
+}
+
+static int ip_vs_genl_parse_service(struct ip_vs_service_user_kern *usvc,
+                                    struct nlattr *nla, int full_entry)
+{
+        struct nlattr *attrs[IPVS_SVC_ATTR_MAX + 1];
+        struct nlattr *nla_af, *nla_port, *nla_fwmark, *nla_protocol, *nla_addr;
+
+        /* Parse mandatory identifying service fields first */
+        if (nla == NULL ||
+            nla_parse_nested(attrs, IPVS_SVC_ATTR_MAX, nla, ip_vs_svc_policy))
+                return -EINVAL;
+
+        nla_af          = attrs[IPVS_SVC_ATTR_AF];
+        nla_protocol    = attrs[IPVS_SVC_ATTR_PROTOCOL];
+        nla_addr        = attrs[IPVS_SVC_ATTR_ADDR];
+        nla_port        = attrs[IPVS_SVC_ATTR_PORT];
+        nla_fwmark      = attrs[IPVS_SVC_ATTR_FWMARK];
+
+        if (!(nla_af && (nla_fwmark || (nla_port && nla_protocol && nla_addr))))
+                return -EINVAL;
+
+        usvc->af = nla_get_u16(nla_af);
+#ifdef CONFIG_IP_VS_IPV6
+        if (usvc->af != AF_INET && usvc->af != AF_INET6)
+#else
+        if (usvc->af != AF_INET)
+#endif
+                return -EAFNOSUPPORT;
+
+        if (nla_fwmark) {
+                usvc->protocol = IPPROTO_TCP;
+                usvc->fwmark = nla_get_u32(nla_fwmark);
+        } else {
+                usvc->protocol = nla_get_u16(nla_protocol);
+                nla_memcpy(&usvc->addr, nla_addr, sizeof(usvc->addr));
+                usvc->port = nla_get_u16(nla_port);
+                usvc->fwmark = 0;
+        }
+
+        /* If a full entry was requested, check for the additional fields */
+        if (full_entry) {
+                struct nlattr *nla_sched, *nla_flags, *nla_timeout,
+                              *nla_netmask;
+                struct ip_vs_flags flags;
+                struct ip_vs_service *svc;
+
+                nla_sched = attrs[IPVS_SVC_ATTR_SCHED_NAME];
+                nla_flags = attrs[IPVS_SVC_ATTR_FLAGS];
+                nla_timeout = attrs[IPVS_SVC_ATTR_TIMEOUT];
+                nla_netmask = attrs[IPVS_SVC_ATTR_NETMASK];
+
+                if (!(nla_sched && nla_flags && nla_timeout && nla_netmask))
+                        return -EINVAL;
+
+                nla_memcpy(&flags, nla_flags, sizeof(flags));
+
+                /* prefill flags from service if it already exists */
+                if (usvc->fwmark)
+                        svc = __ip_vs_svc_fwm_get(usvc->af, usvc->fwmark);
+                else
+                        svc = __ip_vs_service_get(usvc->af, usvc->protocol,
+                                                  &usvc->addr, usvc->port);
+                if (svc) {
+                        usvc->flags = svc->flags;
+                        ip_vs_service_put(svc);
+                } else
+                        usvc->flags = 0;
+
+                /* set new flags from userland */
+                usvc->flags = (usvc->flags & ~flags.mask) |
+                              (flags.flags & flags.mask);
+                usvc->sched_name = nla_data(nla_sched);
+                usvc->timeout = nla_get_u32(nla_timeout);
+                usvc->netmask = nla_get_u32(nla_netmask);
+        }
+
+        return 0;
+}
+
+static struct ip_vs_service *ip_vs_genl_find_service(struct nlattr *nla)
+{
+        struct ip_vs_service_user_kern usvc;
+        int ret;
+
+        ret = ip_vs_genl_parse_service(&usvc, nla, 0);
+        if (ret)
+                return ERR_PTR(ret);
+
+        if (usvc.fwmark)
+                return __ip_vs_svc_fwm_get(usvc.af, usvc.fwmark);
+        else
+                return __ip_vs_service_get(usvc.af, usvc.protocol,
+                                           &usvc.addr, usvc.port);
+}
+
+static int ip_vs_genl_fill_dest(struct sk_buff *skb, struct ip_vs_dest *dest)
+{
+        struct nlattr *nl_dest;
+
+        nl_dest = nla_nest_start(skb, IPVS_CMD_ATTR_DEST);
+        if (!nl_dest)
+                return -EMSGSIZE;
+
+        NLA_PUT(skb, IPVS_DEST_ATTR_ADDR, sizeof(dest->addr), &dest->addr);
+        NLA_PUT_U16(skb, IPVS_DEST_ATTR_PORT, dest->port);
+
+        NLA_PUT_U32(skb, IPVS_DEST_ATTR_FWD_METHOD,
+                    atomic_read(&dest->conn_flags) & IP_VS_CONN_F_FWD_MASK);
+        NLA_PUT_U32(skb, IPVS_DEST_ATTR_WEIGHT, atomic_read(&dest->weight));
+        NLA_PUT_U32(skb, IPVS_DEST_ATTR_U_THRESH, dest->u_threshold);
+        NLA_PUT_U32(skb, IPVS_DEST_ATTR_L_THRESH, dest->l_threshold);
+        NLA_PUT_U32(skb, IPVS_DEST_ATTR_ACTIVE_CONNS,
+                    atomic_read(&dest->activeconns));
+        NLA_PUT_U32(skb, IPVS_DEST_ATTR_INACT_CONNS,
+                    atomic_read(&dest->inactconns));
+        NLA_PUT_U32(skb, IPVS_DEST_ATTR_PERSIST_CONNS,
+                    atomic_read(&dest->persistconns));
+
+        if (ip_vs_genl_fill_stats(skb, IPVS_DEST_ATTR_STATS, &dest->stats))
+                goto nla_put_failure;
+
+        nla_nest_end(skb, nl_dest);
+
+        return 0;
+
+nla_put_failure:
+        nla_nest_cancel(skb, nl_dest);
+        return -EMSGSIZE;
+}
+
+static int ip_vs_genl_dump_dest(struct sk_buff *skb, struct ip_vs_dest *dest,
+                                struct netlink_callback *cb)
+{
+        void *hdr;
+
+        hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).pid, cb->nlh->nlmsg_seq,
+                          &ip_vs_genl_family, NLM_F_MULTI,
+                          IPVS_CMD_NEW_DEST);
+        if (!hdr)
+                return -EMSGSIZE;
+
+        if (ip_vs_genl_fill_dest(skb, dest) < 0)
+                goto nla_put_failure;
+
+        return genlmsg_end(skb, hdr);
+
+nla_put_failure:
+        genlmsg_cancel(skb, hdr);
+        return -EMSGSIZE;
+}
+
+static int ip_vs_genl_dump_dests(struct sk_buff *skb,
+                                 struct netlink_callback *cb)
+{
+        int idx = 0;
+        int start = cb->args[0];
+        struct ip_vs_service *svc;
+        struct ip_vs_dest *dest;
+        struct nlattr *attrs[IPVS_CMD_ATTR_MAX + 1];
+
+        mutex_lock(&__ip_vs_mutex);
+
+        /* Try to find the service for which to dump destinations */
+        if (nlmsg_parse(cb->nlh, GENL_HDRLEN, attrs,
+                        IPVS_CMD_ATTR_MAX, ip_vs_cmd_policy))
+                goto out_err;
+
+        svc = ip_vs_genl_find_service(attrs[IPVS_CMD_ATTR_SERVICE]);
+        if (IS_ERR(svc) || svc == NULL)
+                goto out_err;
+
+        /* Dump the destinations */
+        list_for_each_entry(dest, &svc->destinations, n_list) {
+                if (++idx <= start)
+                        continue;
+                if (ip_vs_genl_dump_dest(skb, dest, cb) < 0) {
+                        idx--;
+                        goto nla_put_failure;
+                }
+        }
+
+nla_put_failure:
+        cb->args[0] = idx;
+        ip_vs_service_put(svc);
+
+out_err:
+        mutex_unlock(&__ip_vs_mutex);
+
+        return skb->len;
+}
+
+static int ip_vs_genl_parse_dest(struct ip_vs_dest_user_kern *udest,
+                                 struct nlattr *nla, int full_entry)
+{
+        struct nlattr *attrs[IPVS_DEST_ATTR_MAX + 1];
+        struct nlattr *nla_addr, *nla_port;
+
+        /* Parse mandatory identifying destination fields first */
+        if (nla == NULL ||
+            nla_parse_nested(attrs, IPVS_DEST_ATTR_MAX, nla, ip_vs_dest_policy))
+                return -EINVAL;
+
+        nla_addr        = attrs[IPVS_DEST_ATTR_ADDR];
+        nla_port        = attrs[IPVS_DEST_ATTR_PORT];
+
+        if (!(nla_addr && nla_port))
+                return -EINVAL;
+
+        nla_memcpy(&udest->addr, nla_addr, sizeof(udest->addr));
+        udest->port = nla_get_u16(nla_port);
+
+        /* If a full entry was requested, check for the additional fields */
+        if (full_entry) {
+                struct nlattr *nla_fwd, *nla_weight, *nla_u_thresh,
+                              *nla_l_thresh;
+
+                nla_fwd         = attrs[IPVS_DEST_ATTR_FWD_METHOD];
+                nla_weight      = attrs[IPVS_DEST_ATTR_WEIGHT];
+                nla_u_thresh    = attrs[IPVS_DEST_ATTR_U_THRESH];
+                nla_l_thresh    = attrs[IPVS_DEST_ATTR_L_THRESH];
+
+                if (!(nla_fwd && nla_weight && nla_u_thresh && nla_l_thresh))
+                        return -EINVAL;
+
+                udest->conn_flags = nla_get_u32(nla_fwd)
+                                    & IP_VS_CONN_F_FWD_MASK;
+                udest->weight = nla_get_u32(nla_weight);
+                udest->u_threshold = nla_get_u32(nla_u_thresh);
+                udest->l_threshold = nla_get_u32(nla_l_thresh);
+        }
+
+        return 0;
+}
+
+static int ip_vs_genl_fill_daemon(struct sk_buff *skb, __be32 state,
+                                  const char *mcast_ifn, __be32 syncid)
+{
+        struct nlattr *nl_daemon;
+
+        nl_daemon = nla_nest_start(skb, IPVS_CMD_ATTR_DAEMON);
+        if (!nl_daemon)
+                return -EMSGSIZE;
+
+        NLA_PUT_U32(skb, IPVS_DAEMON_ATTR_STATE, state);
+        NLA_PUT_STRING(skb, IPVS_DAEMON_ATTR_MCAST_IFN, mcast_ifn);
+        NLA_PUT_U32(skb, IPVS_DAEMON_ATTR_SYNC_ID, syncid);
+
+        nla_nest_end(skb, nl_daemon);
+
+        return 0;
+
+nla_put_failure:
+        nla_nest_cancel(skb, nl_daemon);
+        return -EMSGSIZE;
+}
+
+static int ip_vs_genl_dump_daemon(struct sk_buff *skb, __be32 state,
+                                  const char *mcast_ifn, __be32 syncid,
+                                  struct netlink_callback *cb)
+{
+        void *hdr;
+        hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).pid, cb->nlh->nlmsg_seq,
+                          &ip_vs_genl_family, NLM_F_MULTI,
+                          IPVS_CMD_NEW_DAEMON);
+        if (!hdr)
+                return -EMSGSIZE;
+
+        if (ip_vs_genl_fill_daemon(skb, state, mcast_ifn, syncid))
+                goto nla_put_failure;
+
+        return genlmsg_end(skb, hdr);
+
+nla_put_failure:
+        genlmsg_cancel(skb, hdr);
+        return -EMSGSIZE;
+}
+
+static int ip_vs_genl_dump_daemons(struct sk_buff *skb,
+                                   struct netlink_callback *cb)
+{
+        mutex_lock(&__ip_vs_mutex);
+        if ((ip_vs_sync_state & IP_VS_STATE_MASTER) && !cb->args[0]) {
+                if (ip_vs_genl_dump_daemon(skb, IP_VS_STATE_MASTER,
+                                           ip_vs_master_mcast_ifn,
+                                           ip_vs_master_syncid, cb) < 0)
+                        goto nla_put_failure;
+
+                cb->args[0] = 1;
+        }
+
+        if ((ip_vs_sync_state & IP_VS_STATE_BACKUP) && !cb->args[1]) {
+                if (ip_vs_genl_dump_daemon(skb, IP_VS_STATE_BACKUP,
+                                           ip_vs_backup_mcast_ifn,
+                                           ip_vs_backup_syncid, cb) < 0)
+                        goto nla_put_failure;
+
+                cb->args[1] = 1;
+        }
+
+nla_put_failure:
+        mutex_unlock(&__ip_vs_mutex);
+
+        return skb->len;
+}
+
+static int ip_vs_genl_new_daemon(struct nlattr **attrs)
+{
+        if (!(attrs[IPVS_DAEMON_ATTR_STATE] &&
+              attrs[IPVS_DAEMON_ATTR_MCAST_IFN] &&
+              attrs[IPVS_DAEMON_ATTR_SYNC_ID]))
+                return -EINVAL;
+
+        return start_sync_thread(nla_get_u32(attrs[IPVS_DAEMON_ATTR_STATE]),
+                                 nla_data(attrs[IPVS_DAEMON_ATTR_MCAST_IFN]),
+                                 nla_get_u32(attrs[IPVS_DAEMON_ATTR_SYNC_ID]));
+}
+
+static int ip_vs_genl_del_daemon(struct nlattr **attrs)
+{
+        if (!attrs[IPVS_DAEMON_ATTR_STATE])
+                return -EINVAL;
+
+        return stop_sync_thread(nla_get_u32(attrs[IPVS_DAEMON_ATTR_STATE]));
+}
+
+static int ip_vs_genl_set_config(struct nlattr **attrs)
+{
+        struct ip_vs_timeout_user t;
+
+        __ip_vs_get_timeouts(&t);
+
+        if (attrs[IPVS_CMD_ATTR_TIMEOUT_TCP])
+                t.tcp_timeout = nla_get_u32(attrs[IPVS_CMD_ATTR_TIMEOUT_TCP]);
+
+        if (attrs[IPVS_CMD_ATTR_TIMEOUT_TCP_FIN])
+                t.tcp_fin_timeout =
+                        nla_get_u32(attrs[IPVS_CMD_ATTR_TIMEOUT_TCP_FIN]);
+
+        if (attrs[IPVS_CMD_ATTR_TIMEOUT_UDP])
+                t.udp_timeout = nla_get_u32(attrs[IPVS_CMD_ATTR_TIMEOUT_UDP]);
+
+        return ip_vs_set_timeout(&t);
+}
+
+static int ip_vs_genl_set_cmd(struct sk_buff *skb, struct genl_info *info)
+{
+        struct ip_vs_service *svc = NULL;
+        struct ip_vs_service_user_kern usvc;
+        struct ip_vs_dest_user_kern udest;
+        int ret = 0, cmd;
+        int need_full_svc = 0, need_full_dest = 0;
+
+        cmd = info->genlhdr->cmd;
+
+        mutex_lock(&__ip_vs_mutex);
+
+        if (cmd == IPVS_CMD_FLUSH) {
+                ret = ip_vs_flush();
+                goto out;
+        } else if (cmd == IPVS_CMD_SET_CONFIG) {
+                ret = ip_vs_genl_set_config(info->attrs);
+                goto out;
+        } else if (cmd == IPVS_CMD_NEW_DAEMON ||
+                   cmd == IPVS_CMD_DEL_DAEMON) {
+
+                struct nlattr *daemon_attrs[IPVS_DAEMON_ATTR_MAX + 1];
+
+                if (!info->attrs[IPVS_CMD_ATTR_DAEMON] ||
+                    nla_parse_nested(daemon_attrs, IPVS_DAEMON_ATTR_MAX,
+                                     info->attrs[IPVS_CMD_ATTR_DAEMON],
+                                     ip_vs_daemon_policy)) {
+                        ret = -EINVAL;
+                        goto out;
+                }
+
+                if (cmd == IPVS_CMD_NEW_DAEMON)
+                        ret = ip_vs_genl_new_daemon(daemon_attrs);
+                else
+                        ret = ip_vs_genl_del_daemon(daemon_attrs);
+                goto out;
+        } else if (cmd == IPVS_CMD_ZERO &&
+                   !info->attrs[IPVS_CMD_ATTR_SERVICE]) {
+                ret = ip_vs_zero_all();
+                goto out;
+        }
+
+        /* All following commands require a service argument, so check if we
+         * received a valid one. We need a full service specification when
+         * adding / editing a service. Only identifying members otherwise. */
+        if (cmd == IPVS_CMD_NEW_SERVICE || cmd == IPVS_CMD_SET_SERVICE)
+                need_full_svc = 1;
+
+        ret = ip_vs_genl_parse_service(&usvc,
+                                       info->attrs[IPVS_CMD_ATTR_SERVICE],
+                                       need_full_svc);
+        if (ret)
+                goto out;
+
+        /* Lookup the exact service by <protocol, addr, port> or fwmark */
+        if (usvc.fwmark == 0)
+                svc = __ip_vs_service_get(usvc.af, usvc.protocol,
+                                          &usvc.addr, usvc.port);
+        else
+                svc = __ip_vs_svc_fwm_get(usvc.af, usvc.fwmark);
+
+        /* Unless we're adding a new service, the service must already exist */
+        if ((cmd != IPVS_CMD_NEW_SERVICE) && (svc == NULL)) {
+                ret = -ESRCH;
+                goto out;
+        }
+
+        /* Destination commands require a valid destination argument. For
+         * adding / editing a destination, we need a full destination
+         * specification. */
+        if (cmd == IPVS_CMD_NEW_DEST || cmd == IPVS_CMD_SET_DEST ||
+            cmd == IPVS_CMD_DEL_DEST) {
+                if (cmd != IPVS_CMD_DEL_DEST)
+                        need_full_dest = 1;
+
+                ret = ip_vs_genl_parse_dest(&udest,
+                                            info->attrs[IPVS_CMD_ATTR_DEST],
+                                            need_full_dest);
+                if (ret)
+                        goto out;
+        }
+
+        switch (cmd) {
+        case IPVS_CMD_NEW_SERVICE:
+                if (svc == NULL)
+                        ret = ip_vs_add_service(&usvc, &svc);
+                else
+                        ret = -EEXIST;
+                break;
+        case IPVS_CMD_SET_SERVICE:
+                ret = ip_vs_edit_service(svc, &usvc);
+                break;
+        case IPVS_CMD_DEL_SERVICE:
+                ret = ip_vs_del_service(svc);
+                break;
+        case IPVS_CMD_NEW_DEST:
+                ret = ip_vs_add_dest(svc, &udest);
+                break;
+        case IPVS_CMD_SET_DEST:
+                ret = ip_vs_edit_dest(svc, &udest);
+                break;
+        case IPVS_CMD_DEL_DEST:
+                ret = ip_vs_del_dest(svc, &udest);
+                break;
+        case IPVS_CMD_ZERO:
+                ret = ip_vs_zero_service(svc);
+                break;
+        default:
+                ret = -EINVAL;
+        }
+
+out:
+        if (svc)
+                ip_vs_service_put(svc);
+        mutex_unlock(&__ip_vs_mutex);
+
+        return ret;
+}
+
+static int ip_vs_genl_get_cmd(struct sk_buff *skb, struct genl_info *info)
+{
+        struct sk_buff *msg;
+        void *reply;
+        int ret, cmd, reply_cmd;
+
+        cmd = info->genlhdr->cmd;
+
+        if (cmd == IPVS_CMD_GET_SERVICE)
+                reply_cmd = IPVS_CMD_NEW_SERVICE;
+        else if (cmd == IPVS_CMD_GET_INFO)
+                reply_cmd = IPVS_CMD_SET_INFO;
+        else if (cmd == IPVS_CMD_GET_CONFIG)
+                reply_cmd = IPVS_CMD_SET_CONFIG;
+        else {
+                IP_VS_ERR("unknown Generic Netlink command\n");
+                return -EINVAL;
+        }
+
+        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
+        if (!msg)
+                return -ENOMEM;
+
+        mutex_lock(&__ip_vs_mutex);
+
+        reply = genlmsg_put_reply(msg, info, &ip_vs_genl_family, 0, reply_cmd);
+        if (reply == NULL)
+                goto nla_put_failure;
+
+        switch (cmd) {
+        case IPVS_CMD_GET_SERVICE:
+        {
+                struct ip_vs_service *svc;
+
+                svc = ip_vs_genl_find_service(info->attrs[IPVS_CMD_ATTR_SERVICE]);
+                if (IS_ERR(svc)) {
+                        ret = PTR_ERR(svc);
+                        goto out_err;
+                } else if (svc) {
+                        ret = ip_vs_genl_fill_service(msg, svc);
+                        ip_vs_service_put(svc);
+                        if (ret)
+                                goto nla_put_failure;
+                } else {
+                        ret = -ESRCH;
+                        goto out_err;
+                }
+
+                break;
+        }
+
+        case IPVS_CMD_GET_CONFIG:
+        {
+                struct ip_vs_timeout_user t;
+
+                __ip_vs_get_timeouts(&t);
+#ifdef CONFIG_IP_VS_PROTO_TCP
+                NLA_PUT_U32(msg, IPVS_CMD_ATTR_TIMEOUT_TCP, t.tcp_timeout);
+                NLA_PUT_U32(msg, IPVS_CMD_ATTR_TIMEOUT_TCP_FIN,
+                            t.tcp_fin_timeout);
+#endif
+#ifdef CONFIG_IP_VS_PROTO_UDP
+                NLA_PUT_U32(msg, IPVS_CMD_ATTR_TIMEOUT_UDP, t.udp_timeout);
+#endif
+
+                break;
+        }
+
+        case IPVS_CMD_GET_INFO:
+                NLA_PUT_U32(msg, IPVS_INFO_ATTR_VERSION, IP_VS_VERSION_CODE);
+                NLA_PUT_U32(msg, IPVS_INFO_ATTR_CONN_TAB_SIZE,
+                            IP_VS_CONN_TAB_SIZE);
+                break;
+        }
+
+        genlmsg_end(msg, reply);
+        ret = genlmsg_unicast(msg, info->snd_pid);
+        goto out;
+
+nla_put_failure:
+        IP_VS_ERR("not enough space in Netlink message\n");
+        ret = -EMSGSIZE;
+
+out_err:
+        nlmsg_free(msg);
+out:
+        mutex_unlock(&__ip_vs_mutex);
+
+        return ret;
+}
+
+
+static struct genl_ops ip_vs_genl_ops[] __read_mostly = {
+        {
+                .cmd    = IPVS_CMD_NEW_SERVICE,
+                .flags  = GENL_ADMIN_PERM,
+                .policy = ip_vs_cmd_policy,
+                .doit   = ip_vs_genl_set_cmd,
+        },
+        {
+                .cmd    = IPVS_CMD_SET_SERVICE,
+                .flags  = GENL_ADMIN_PERM,
+                .policy = ip_vs_cmd_policy,
+                .doit   = ip_vs_genl_set_cmd,
+        },
+        {
+                .cmd    = IPVS_CMD_DEL_SERVICE,
+                .flags  = GENL_ADMIN_PERM,
+                .policy = ip_vs_cmd_policy,
+                .doit   = ip_vs_genl_set_cmd,
+        },
+        {
+                .cmd    = IPVS_CMD_GET_SERVICE,
+                .flags  = GENL_ADMIN_PERM,
+                .doit   = ip_vs_genl_get_cmd,
+                .dumpit = ip_vs_genl_dump_services,
+                .policy = ip_vs_cmd_policy,
+        },
+        {
+                .cmd    = IPVS_CMD_NEW_DEST,
+                .flags  = GENL_ADMIN_PERM,
+                .policy = ip_vs_cmd_policy,
+                .doit   = ip_vs_genl_set_cmd,
+        },
+        {
+                .cmd    = IPVS_CMD_SET_DEST,
+                .flags  = GENL_ADMIN_PERM,
+                .policy = ip_vs_cmd_policy,
+                .doit   = ip_vs_genl_set_cmd,
+        },
+        {
+                .cmd    = IPVS_CMD_DEL_DEST,
+                .flags  = GENL_ADMIN_PERM,
+                .policy = ip_vs_cmd_policy,
+                .doit   = ip_vs_genl_set_cmd,
+        },
+        {
+                .cmd    = IPVS_CMD_GET_DEST,
+                .flags  = GENL_ADMIN_PERM,
+                .policy = ip_vs_cmd_policy,
+                .dumpit = ip_vs_genl_dump_dests,
+        },
+        {
+                .cmd    = IPVS_CMD_NEW_DAEMON,
+                .flags  = GENL_ADMIN_PERM,
+                .policy = ip_vs_cmd_policy,
+                .doit   = ip_vs_genl_set_cmd,
+        },
+        {
+                .cmd    = IPVS_CMD_DEL_DAEMON,
+                .flags  = GENL_ADMIN_PERM,
+                .policy = ip_vs_cmd_policy,
+                .doit   = ip_vs_genl_set_cmd,
+        },
+        {
+                .cmd    = IPVS_CMD_GET_DAEMON,
+                .flags  = GENL_ADMIN_PERM,
+                .dumpit = ip_vs_genl_dump_daemons,
+        },
+        {
+                .cmd    = IPVS_CMD_SET_CONFIG,
+                .flags  = GENL_ADMIN_PERM,
+                .policy = ip_vs_cmd_policy,
+                .doit   = ip_vs_genl_set_cmd,
+        },
+        {
+                .cmd    = IPVS_CMD_GET_CONFIG,
+                .flags  = GENL_ADMIN_PERM,
+                .doit   = ip_vs_genl_get_cmd,
+        },
+        {
+                .cmd    = IPVS_CMD_GET_INFO,
+                .flags  = GENL_ADMIN_PERM,
+                .doit   = ip_vs_genl_get_cmd,
+        },
+        {
+                .cmd    = IPVS_CMD_ZERO,
+                .flags  = GENL_ADMIN_PERM,
+                .policy = ip_vs_cmd_policy,
+                .doit   = ip_vs_genl_set_cmd,
+        },
+        {
+                .cmd    = IPVS_CMD_FLUSH,
+                .flags  = GENL_ADMIN_PERM,
+                .doit   = ip_vs_genl_set_cmd,
+        },
+};
+
+static int __init ip_vs_genl_register(void)
+{
+        int ret, i;
+
+        ret = genl_register_family(&ip_vs_genl_family);
+        if (ret)
+                return ret;
+
+        for (i = 0; i < ARRAY_SIZE(ip_vs_genl_ops); i++) {
+                ret = genl_register_ops(&ip_vs_genl_family, &ip_vs_genl_ops[i]);
+                if (ret)
+                        goto err_out;
+        }
+        return 0;
+
+err_out:
+        genl_unregister_family(&ip_vs_genl_family);
+        return ret;
+}
+
+static void ip_vs_genl_unregister(void)
+{
+        genl_unregister_family(&ip_vs_genl_family);
+}
+
+/* End of Generic Netlink interface definitions */
+
 
 int __init ip_vs_control_init(void)
 {
@@ -2334,6 +3394,13 @@ int __init ip_vs_control_init(void)
                 return ret;
         }
 
+        ret = ip_vs_genl_register();
+        if (ret) {
+                IP_VS_ERR("cannot register Generic Netlink interface.\n");
+                nf_unregister_sockopt(&ip_vs_sockopts);
+                return ret;
+        }
+
         proc_net_fops_create(&init_net, "ip_vs", 0, &ip_vs_info_fops);
         proc_net_fops_create(&init_net, "ip_vs_stats",0, &ip_vs_stats_fops);
 
@@ -2368,6 +3435,7 @@ void ip_vs_control_cleanup(void)
         unregister_sysctl_table(sysctl_header);
         proc_net_remove(&init_net, "ip_vs_stats");
         proc_net_remove(&init_net, "ip_vs");
+        ip_vs_genl_unregister();
         nf_unregister_sockopt(&ip_vs_sockopts);
         LeaveFunction(2);
 }
diff --git a/net/ipv4/ipvs/ip_vs_dh.c b/net/ipv4/ipvs/ip_vs_dh.c
index fa66824d264f..a16943fd72f1 100644
--- a/net/ipv4/ipvs/ip_vs_dh.c
+++ b/net/ipv4/ipvs/ip_vs_dh.c
@@ -218,7 +218,7 @@ ip_vs_dh_schedule(struct ip_vs_service *svc, const struct sk_buff *skb)
         IP_VS_DBG(6, "DH: destination IP address %u.%u.%u.%u "
                   "--> server %u.%u.%u.%u:%d\n",
                   NIPQUAD(iph->daddr),
-                  NIPQUAD(dest->addr),
+                  NIPQUAD(dest->addr.ip),
                   ntohs(dest->port));
 
         return dest;
@@ -234,6 +234,9 @@ static struct ip_vs_scheduler ip_vs_dh_scheduler =
         .refcnt =               ATOMIC_INIT(0),
         .module =               THIS_MODULE,
         .n_list =               LIST_HEAD_INIT(ip_vs_dh_scheduler.n_list),
+#ifdef CONFIG_IP_VS_IPV6
+        .supports_ipv6 =        0,
+#endif
         .init_service =         ip_vs_dh_init_svc,
         .done_service =         ip_vs_dh_done_svc,
         .update_service =       ip_vs_dh_update_svc,
diff --git a/net/ipv4/ipvs/ip_vs_est.c b/net/ipv4/ipvs/ip_vs_est.c
index 5a20f93bd7f9..2eb2860dabb5 100644
--- a/net/ipv4/ipvs/ip_vs_est.c
+++ b/net/ipv4/ipvs/ip_vs_est.c
@@ -65,37 +65,37 @@ static void estimation_timer(unsigned long arg)
                 s = container_of(e, struct ip_vs_stats, est);
 
                 spin_lock(&s->lock);
-                n_conns = s->conns;
-                n_inpkts = s->inpkts;
-                n_outpkts = s->outpkts;
-                n_inbytes = s->inbytes;
-                n_outbytes = s->outbytes;
+                n_conns = s->ustats.conns;
+                n_inpkts = s->ustats.inpkts;
+                n_outpkts = s->ustats.outpkts;
+                n_inbytes = s->ustats.inbytes;
+                n_outbytes = s->ustats.outbytes;
 
                 /* scaled by 2^10, but divided 2 seconds */
                 rate = (n_conns - e->last_conns)<<9;
                 e->last_conns = n_conns;
                 e->cps += ((long)rate - (long)e->cps)>>2;
-                s->cps = (e->cps+0x1FF)>>10;
+                s->ustats.cps = (e->cps+0x1FF)>>10;
 
                 rate = (n_inpkts - e->last_inpkts)<<9;
                 e->last_inpkts = n_inpkts;
                 e->inpps += ((long)rate - (long)e->inpps)>>2;
-                s->inpps = (e->inpps+0x1FF)>>10;
+                s->ustats.inpps = (e->inpps+0x1FF)>>10;
 
                 rate = (n_outpkts - e->last_outpkts)<<9;
                 e->last_outpkts = n_outpkts;
                 e->outpps += ((long)rate - (long)e->outpps)>>2;
-                s->outpps = (e->outpps+0x1FF)>>10;
+                s->ustats.outpps = (e->outpps+0x1FF)>>10;
 
                 rate = (n_inbytes - e->last_inbytes)<<4;
                 e->last_inbytes = n_inbytes;
                 e->inbps += ((long)rate - (long)e->inbps)>>2;
-                s->inbps = (e->inbps+0xF)>>5;
+                s->ustats.inbps = (e->inbps+0xF)>>5;
 
                 rate = (n_outbytes - e->last_outbytes)<<4;
                 e->last_outbytes = n_outbytes;
                 e->outbps += ((long)rate - (long)e->outbps)>>2;
-                s->outbps = (e->outbps+0xF)>>5;
+                s->ustats.outbps = (e->outbps+0xF)>>5;
                 spin_unlock(&s->lock);
         }
         spin_unlock(&est_lock);
@@ -108,24 +108,22 @@ void ip_vs_new_estimator(struct ip_vs_stats *stats)
 
         INIT_LIST_HEAD(&est->list);
 
-        est->last_conns = stats->conns;
-        est->cps = stats->cps<<10;
+        est->last_conns = stats->ustats.conns;
+        est->cps = stats->ustats.cps<<10;
 
-        est->last_inpkts = stats->inpkts;
-        est->inpps = stats->inpps<<10;
+        est->last_inpkts = stats->ustats.inpkts;
+        est->inpps = stats->ustats.inpps<<10;
 
-        est->last_outpkts = stats->outpkts;
-        est->outpps = stats->outpps<<10;
+        est->last_outpkts = stats->ustats.outpkts;
+        est->outpps = stats->ustats.outpps<<10;
 
-        est->last_inbytes = stats->inbytes;
-        est->inbps = stats->inbps<<5;
+        est->last_inbytes = stats->ustats.inbytes;
+        est->inbps = stats->ustats.inbps<<5;
 
-        est->last_outbytes = stats->outbytes;
-        est->outbps = stats->outbps<<5;
+        est->last_outbytes = stats->ustats.outbytes;
+        est->outbps = stats->ustats.outbps<<5;
 
         spin_lock_bh(&est_lock);
-        if (list_empty(&est_list))
-                mod_timer(&est_timer, jiffies + 2 * HZ);
         list_add(&est->list, &est_list);
         spin_unlock_bh(&est_lock);
 }
@@ -136,11 +134,6 @@ void ip_vs_kill_estimator(struct ip_vs_stats *stats)
 
         spin_lock_bh(&est_lock);
         list_del(&est->list);
-        while (list_empty(&est_list) && try_to_del_timer_sync(&est_timer) < 0) {
-                spin_unlock_bh(&est_lock);
-                cpu_relax();
-                spin_lock_bh(&est_lock);
-        }
         spin_unlock_bh(&est_lock);
 }
 
@@ -160,3 +153,14 @@ void ip_vs_zero_estimator(struct ip_vs_stats *stats)
         est->inbps = 0;
         est->outbps = 0;
 }
+
+int __init ip_vs_estimator_init(void)
+{
+        mod_timer(&est_timer, jiffies + 2 * HZ);
+        return 0;
+}
+
+void ip_vs_estimator_cleanup(void)
+{
+        del_timer_sync(&est_timer);
+}
diff --git a/net/ipv4/ipvs/ip_vs_ftp.c b/net/ipv4/ipvs/ip_vs_ftp.c
index c1c758e4f733..2e7dbd8b73a4 100644
--- a/net/ipv4/ipvs/ip_vs_ftp.c
+++ b/net/ipv4/ipvs/ip_vs_ftp.c
@@ -140,13 +140,21 @@ static int ip_vs_ftp_out(struct ip_vs_app *app, struct ip_vs_conn *cp,
         struct tcphdr *th;
         char *data, *data_limit;
         char *start, *end;
-        __be32 from;
+        union nf_inet_addr from;
         __be16 port;
         struct ip_vs_conn *n_cp;
         char buf[24];           /* xxx.xxx.xxx.xxx,ppp,ppp\000 */
         unsigned buf_len;
         int ret;
 
+#ifdef CONFIG_IP_VS_IPV6
+        /* This application helper doesn't work with IPv6 yet,
+         * so turn this into a no-op for IPv6 packets
+         */
+        if (cp->af == AF_INET6)
+                return 1;
+#endif
+
         *diff = 0;
 
         /* Only useful for established sessions */
@@ -166,24 +174,25 @@ static int ip_vs_ftp_out(struct ip_vs_app *app, struct ip_vs_conn *cp,
                 if (ip_vs_ftp_get_addrport(data, data_limit,
                                            SERVER_STRING,
                                            sizeof(SERVER_STRING)-1, ')',
-                                           &from, &port,
+                                           &from.ip, &port,
                                            &start, &end) != 1)
                         return 1;
 
                 IP_VS_DBG(7, "PASV response (%u.%u.%u.%u:%d) -> "
                           "%u.%u.%u.%u:%d detected\n",
-                          NIPQUAD(from), ntohs(port), NIPQUAD(cp->caddr), 0);
+                          NIPQUAD(from.ip), ntohs(port),
+                          NIPQUAD(cp->caddr.ip), 0);
 
                 /*
                  * Now update or create an connection entry for it
                  */
-                n_cp = ip_vs_conn_out_get(iph->protocol, from, port,
-                                          cp->caddr, 0);
+                n_cp = ip_vs_conn_out_get(AF_INET, iph->protocol, &from, port,
+                                          &cp->caddr, 0);
                 if (!n_cp) {
-                        n_cp = ip_vs_conn_new(IPPROTO_TCP,
-                                              cp->caddr, 0,
-                                              cp->vaddr, port,
-                                              from, port,
+                        n_cp = ip_vs_conn_new(AF_INET, IPPROTO_TCP,
+                                              &cp->caddr, 0,
+                                              &cp->vaddr, port,
+                                              &from, port,
                                               IP_VS_CONN_F_NO_CPORT,
                                               cp->dest);
                         if (!n_cp)
@@ -196,9 +205,9 @@ static int ip_vs_ftp_out(struct ip_vs_app *app, struct ip_vs_conn *cp,
                 /*
                  * Replace the old passive address with the new one
                  */
-                from = n_cp->vaddr;
+                from.ip = n_cp->vaddr.ip;
                 port = n_cp->vport;
-                sprintf(buf,"%d,%d,%d,%d,%d,%d", NIPQUAD(from),
+                sprintf(buf, "%d,%d,%d,%d,%d,%d", NIPQUAD(from.ip),
                         (ntohs(port)>>8)&255, ntohs(port)&255);
                 buf_len = strlen(buf);
 
@@ -243,10 +252,18 @@ static int ip_vs_ftp_in(struct ip_vs_app *app, struct ip_vs_conn *cp,
         struct tcphdr *th;
         char *data, *data_start, *data_limit;
         char *start, *end;
-        __be32 to;
+        union nf_inet_addr to;
         __be16 port;
         struct ip_vs_conn *n_cp;
 
+#ifdef CONFIG_IP_VS_IPV6
+        /* This application helper doesn't work with IPv6 yet,
+         * so turn this into a no-op for IPv6 packets
+         */
+        if (cp->af == AF_INET6)
+                return 1;
+#endif
+
         /* no diff required for incoming packets */
         *diff = 0;
 
@@ -291,12 +308,12 @@ static int ip_vs_ftp_in(struct ip_vs_app *app, struct ip_vs_conn *cp,
          */
         if (ip_vs_ftp_get_addrport(data_start, data_limit,
                                    CLIENT_STRING, sizeof(CLIENT_STRING)-1,
-                                   '\r', &to, &port,
+                                   '\r', &to.ip, &port,
                                    &start, &end) != 1)
                 return 1;
 
         IP_VS_DBG(7, "PORT %u.%u.%u.%u:%d detected\n",
-                  NIPQUAD(to), ntohs(port));
+                  NIPQUAD(to.ip), ntohs(port));
 
         /* Passive mode off */
         cp->app_data = NULL;
@@ -306,16 +323,16 @@ static int ip_vs_ftp_in(struct ip_vs_app *app, struct ip_vs_conn *cp,
          */
         IP_VS_DBG(7, "protocol %s %u.%u.%u.%u:%d %u.%u.%u.%u:%d\n",
                   ip_vs_proto_name(iph->protocol),
-                  NIPQUAD(to), ntohs(port), NIPQUAD(cp->vaddr), 0);
+                  NIPQUAD(to.ip), ntohs(port), NIPQUAD(cp->vaddr.ip), 0);
 
-        n_cp = ip_vs_conn_in_get(iph->protocol,
-                                 to, port,
-                                 cp->vaddr, htons(ntohs(cp->vport)-1));
+        n_cp = ip_vs_conn_in_get(AF_INET, iph->protocol,
+                                 &to, port,
+                                 &cp->vaddr, htons(ntohs(cp->vport)-1));
         if (!n_cp) {
-                n_cp = ip_vs_conn_new(IPPROTO_TCP,
-                                      to, port,
-                                      cp->vaddr, htons(ntohs(cp->vport)-1),
-                                      cp->daddr, htons(ntohs(cp->dport)-1),
+                n_cp = ip_vs_conn_new(AF_INET, IPPROTO_TCP,
+                                      &to, port,
+                                      &cp->vaddr, htons(ntohs(cp->vport)-1),
+                                      &cp->daddr, htons(ntohs(cp->dport)-1),
                                       0,
                                       cp->dest);
                 if (!n_cp)
diff --git a/net/ipv4/ipvs/ip_vs_lblc.c b/net/ipv4/ipvs/ip_vs_lblc.c
index 7a6a319f544a..6ecef3518cac 100644
--- a/net/ipv4/ipvs/ip_vs_lblc.c
+++ b/net/ipv4/ipvs/ip_vs_lblc.c
@@ -96,7 +96,6 @@ struct ip_vs_lblc_entry {
  *      IPVS lblc hash table
  */
 struct ip_vs_lblc_table {
-        rwlock_t                lock;           /* lock for this table */
         struct list_head        bucket[IP_VS_LBLC_TAB_SIZE];  /* hash bucket */
         atomic_t                entries;        /* number of entries */
         int                     max_size;       /* maximum size of entries */
@@ -123,31 +122,6 @@ static ctl_table vs_vars_table[] = {
 
 static struct ctl_table_header * sysctl_header;
 
-/*
- *      new/free a ip_vs_lblc_entry, which is a mapping of a destionation
- *      IP address to a server.
- */
-static inline struct ip_vs_lblc_entry *
-ip_vs_lblc_new(__be32 daddr, struct ip_vs_dest *dest)
-{
-        struct ip_vs_lblc_entry *en;
-
-        en = kmalloc(sizeof(struct ip_vs_lblc_entry), GFP_ATOMIC);
-        if (en == NULL) {
-                IP_VS_ERR("ip_vs_lblc_new(): no memory\n");
-                return NULL;
-        }
-
-        INIT_LIST_HEAD(&en->list);
-        en->addr = daddr;
-
-        atomic_inc(&dest->refcnt);
-        en->dest = dest;
-
-        return en;
-}
-
-
 static inline void ip_vs_lblc_free(struct ip_vs_lblc_entry *en)
 {
         list_del(&en->list);
@@ -173,55 +147,66 @@ static inline unsigned ip_vs_lblc_hashkey(__be32 addr)
  *      Hash an entry in the ip_vs_lblc_table.
  *      returns bool success.
  */
-static int
+static void
 ip_vs_lblc_hash(struct ip_vs_lblc_table *tbl, struct ip_vs_lblc_entry *en)
 {
-        unsigned hash;
-
-        if (!list_empty(&en->list)) {
-                IP_VS_ERR("ip_vs_lblc_hash(): request for already hashed, "
-                          "called from %p\n", __builtin_return_address(0));
-                return 0;
-        }
-
-        /*
-         *      Hash by destination IP address
-         */
-        hash = ip_vs_lblc_hashkey(en->addr);
+        unsigned hash = ip_vs_lblc_hashkey(en->addr);
 
-        write_lock(&tbl->lock);
         list_add(&en->list, &tbl->bucket[hash]);
         atomic_inc(&tbl->entries);
-        write_unlock(&tbl->lock);
-
-        return 1;
 }
 
 
 /*
- *  Get ip_vs_lblc_entry associated with supplied parameters.
+ *  Get ip_vs_lblc_entry associated with supplied parameters. Called under read
+ *  lock
  */
 static inline struct ip_vs_lblc_entry *
 ip_vs_lblc_get(struct ip_vs_lblc_table *tbl, __be32 addr)
 {
-        unsigned hash;
+        unsigned hash = ip_vs_lblc_hashkey(addr);
         struct ip_vs_lblc_entry *en;
 
-        hash = ip_vs_lblc_hashkey(addr);
+        list_for_each_entry(en, &tbl->bucket[hash], list)
+                if (en->addr == addr)
+                        return en;
 
-        read_lock(&tbl->lock);
+        return NULL;
+}
 
-        list_for_each_entry(en, &tbl->bucket[hash], list) {
-                if (en->addr == addr) {
-                        /* HIT */
-                        read_unlock(&tbl->lock);
-                        return en;
+
+/*
+ * Create or update an ip_vs_lblc_entry, which is a mapping of a destination IP
+ * address to a server. Called under write lock.
+ */
+static inline struct ip_vs_lblc_entry *
+ip_vs_lblc_new(struct ip_vs_lblc_table *tbl, __be32 daddr,
+               struct ip_vs_dest *dest)
+{
+        struct ip_vs_lblc_entry *en;
+
+        en = ip_vs_lblc_get(tbl, daddr);
+        if (!en) {
+                en = kmalloc(sizeof(*en), GFP_ATOMIC);
+                if (!en) {
+                        IP_VS_ERR("ip_vs_lblc_new(): no memory\n");
+                        return NULL;
                 }
-        }
 
-        read_unlock(&tbl->lock);
+                en->addr = daddr;
+                en->lastuse = jiffies;
 
-        return NULL;
+                atomic_inc(&dest->refcnt);
+                en->dest = dest;
+
+                ip_vs_lblc_hash(tbl, en);
+        } else if (en->dest != dest) {
+                atomic_dec(&en->dest->refcnt);
+                atomic_inc(&dest->refcnt);
+                en->dest = dest;
+        }
+
+        return en;
 }
 
 
@@ -230,30 +215,29 @@ ip_vs_lblc_get(struct ip_vs_lblc_table *tbl, __be32 addr)
  */
 static void ip_vs_lblc_flush(struct ip_vs_lblc_table *tbl)
 {
-        int i;
         struct ip_vs_lblc_entry *en, *nxt;
+        int i;
 
         for (i=0; i<IP_VS_LBLC_TAB_SIZE; i++) {
-                write_lock(&tbl->lock);
                 list_for_each_entry_safe(en, nxt, &tbl->bucket[i], list) {
                         ip_vs_lblc_free(en);
                         atomic_dec(&tbl->entries);
                 }
-                write_unlock(&tbl->lock);
         }
 }
 
 
-static inline void ip_vs_lblc_full_check(struct ip_vs_lblc_table *tbl)
+static inline void ip_vs_lblc_full_check(struct ip_vs_service *svc)
 {
+        struct ip_vs_lblc_table *tbl = svc->sched_data;
+        struct ip_vs_lblc_entry *en, *nxt;
         unsigned long now = jiffies;
         int i, j;
-        struct ip_vs_lblc_entry *en, *nxt;
 
         for (i=0, j=tbl->rover; i<IP_VS_LBLC_TAB_SIZE; i++) {
                 j = (j + 1) & IP_VS_LBLC_TAB_MASK;
 
-                write_lock(&tbl->lock);
+                write_lock(&svc->sched_lock);
                 list_for_each_entry_safe(en, nxt, &tbl->bucket[j], list) {
                         if (time_before(now,
                                         en->lastuse + sysctl_ip_vs_lblc_expiration))
@@ -262,7 +246,7 @@ static inline void ip_vs_lblc_full_check(struct ip_vs_lblc_table *tbl)
                         ip_vs_lblc_free(en);
                         atomic_dec(&tbl->entries);
                 }
-                write_unlock(&tbl->lock);
+                write_unlock(&svc->sched_lock);
         }
         tbl->rover = j;
 }
@@ -281,17 +265,16 @@ static inline void ip_vs_lblc_full_check(struct ip_vs_lblc_table *tbl)
  */
 static void ip_vs_lblc_check_expire(unsigned long data)
 {
-        struct ip_vs_lblc_table *tbl;
+        struct ip_vs_service *svc = (struct ip_vs_service *) data;
+        struct ip_vs_lblc_table *tbl = svc->sched_data;
         unsigned long now = jiffies;
         int goal;
         int i, j;
         struct ip_vs_lblc_entry *en, *nxt;
 
-        tbl = (struct ip_vs_lblc_table *)data;
-
         if ((tbl->counter % COUNT_FOR_FULL_EXPIRATION) == 0) {
                 /* do full expiration check */
-                ip_vs_lblc_full_check(tbl);
+                ip_vs_lblc_full_check(svc);
                 tbl->counter = 1;
                 goto out;
         }
@@ -308,7 +291,7 @@ static void ip_vs_lblc_check_expire(unsigned long data)
         for (i=0, j=tbl->rover; i<IP_VS_LBLC_TAB_SIZE; i++) {
                 j = (j + 1) & IP_VS_LBLC_TAB_MASK;
 
-                write_lock(&tbl->lock);
+                write_lock(&svc->sched_lock);
                 list_for_each_entry_safe(en, nxt, &tbl->bucket[j], list) {
                         if (time_before(now, en->lastuse + ENTRY_TIMEOUT))
                                 continue;
@@ -317,7 +300,7 @@ static void ip_vs_lblc_check_expire(unsigned long data)
                         atomic_dec(&tbl->entries);
                         goal--;
                 }
-                write_unlock(&tbl->lock);
+                write_unlock(&svc->sched_lock);
                 if (goal <= 0)
                         break;
         }
@@ -336,15 +319,14 @@ static int ip_vs_lblc_init_svc(struct ip_vs_service *svc)
         /*
          *    Allocate the ip_vs_lblc_table for this service
          */
-        tbl = kmalloc(sizeof(struct ip_vs_lblc_table), GFP_ATOMIC);
+        tbl = kmalloc(sizeof(*tbl), GFP_ATOMIC);
         if (tbl == NULL) {
                 IP_VS_ERR("ip_vs_lblc_init_svc(): no memory\n");
                 return -ENOMEM;
         }
         svc->sched_data = tbl;
         IP_VS_DBG(6, "LBLC hash table (memory=%Zdbytes) allocated for "
-                  "current service\n",
-                  sizeof(struct ip_vs_lblc_table));
+                  "current service\n", sizeof(*tbl));
 
         /*
          *    Initialize the hash buckets
@@ -352,7 +334,6 @@ static int ip_vs_lblc_init_svc(struct ip_vs_service *svc)
         for (i=0; i<IP_VS_LBLC_TAB_SIZE; i++) {
                 INIT_LIST_HEAD(&tbl->bucket[i]);
         }
-        rwlock_init(&tbl->lock);
         tbl->max_size = IP_VS_LBLC_TAB_SIZE*16;
         tbl->rover = 0;
         tbl->counter = 1;
@@ -361,9 +342,8 @@ static int ip_vs_lblc_init_svc(struct ip_vs_service *svc)
          *    Hook periodic timer for garbage collection
          */
         setup_timer(&tbl->periodic_timer, ip_vs_lblc_check_expire,
-                        (unsigned long)tbl);
-        tbl->periodic_timer.expires = jiffies+CHECK_EXPIRE_INTERVAL;
-        add_timer(&tbl->periodic_timer);
+                        (unsigned long)svc);
+        mod_timer(&tbl->periodic_timer, jiffies + CHECK_EXPIRE_INTERVAL);
 
         return 0;
 }
@@ -380,22 +360,16 @@ static int ip_vs_lblc_done_svc(struct ip_vs_service *svc)
         ip_vs_lblc_flush(tbl);
 
         /* release the table itself */
-        kfree(svc->sched_data);
+        kfree(tbl);
         IP_VS_DBG(6, "LBLC hash table (memory=%Zdbytes) released\n",
-                  sizeof(struct ip_vs_lblc_table));
+                  sizeof(*tbl));
 
         return 0;
 }
 
 
-static int ip_vs_lblc_update_svc(struct ip_vs_service *svc)
-{
-        return 0;
-}
-
-
 static inline struct ip_vs_dest *
-__ip_vs_wlc_schedule(struct ip_vs_service *svc, struct iphdr *iph)
+__ip_vs_lblc_schedule(struct ip_vs_service *svc, struct iphdr *iph)
 {
         struct ip_vs_dest *dest, *least;
         int loh, doh;
@@ -448,7 +422,7 @@ __ip_vs_wlc_schedule(struct ip_vs_service *svc, struct iphdr *iph)
 
         IP_VS_DBG(6, "LBLC: server %d.%d.%d.%d:%d "
                   "activeconns %d refcnt %d weight %d overhead %d\n",
-                  NIPQUAD(least->addr), ntohs(least->port),
+                  NIPQUAD(least->addr.ip), ntohs(least->port),
                   atomic_read(&least->activeconns),
                   atomic_read(&least->refcnt),
                   atomic_read(&least->weight), loh);
@@ -484,47 +458,55 @@ is_overloaded(struct ip_vs_dest *dest, struct ip_vs_service *svc)
 static struct ip_vs_dest *
 ip_vs_lblc_schedule(struct ip_vs_service *svc, const struct sk_buff *skb)
 {
-        struct ip_vs_dest *dest;
-        struct ip_vs_lblc_table *tbl;
-        struct ip_vs_lblc_entry *en;
+        struct ip_vs_lblc_table *tbl = svc->sched_data;
         struct iphdr *iph = ip_hdr(skb);
+        struct ip_vs_dest *dest = NULL;
+        struct ip_vs_lblc_entry *en;
 
         IP_VS_DBG(6, "ip_vs_lblc_schedule(): Scheduling...\n");
 
-        tbl = (struct ip_vs_lblc_table *)svc->sched_data;
+        /* First look in our cache */
+        read_lock(&svc->sched_lock);
         en = ip_vs_lblc_get(tbl, iph->daddr);
-        if (en == NULL) {
-                dest = __ip_vs_wlc_schedule(svc, iph);
-                if (dest == NULL) {
-                        IP_VS_DBG(1, "no destination available\n");
-                        return NULL;
-                }
-                en = ip_vs_lblc_new(iph->daddr, dest);
-                if (en == NULL) {
-                        return NULL;
-                }
-                ip_vs_lblc_hash(tbl, en);
-        } else {
-                dest = en->dest;
-                if (!(dest->flags & IP_VS_DEST_F_AVAILABLE)
-                    || atomic_read(&dest->weight) <= 0
-                    || is_overloaded(dest, svc)) {
-                        dest = __ip_vs_wlc_schedule(svc, iph);
-                        if (dest == NULL) {
-                                IP_VS_DBG(1, "no destination available\n");
-                                return NULL;
-                        }
-                        atomic_dec(&en->dest->refcnt);
-                        atomic_inc(&dest->refcnt);
-                        en->dest = dest;
-                }
+        if (en) {
+                /* We only hold a read lock, but this is atomic */
+                en->lastuse = jiffies;
+
+                /*
+                 * If the destination is not available, i.e. it's in the trash,
+                 * we must ignore it, as it may be removed from under our feet,
+                 * if someone drops our reference count. Our caller only makes
+                 * sure that destinations, that are not in the trash, are not
+                 * moved to the trash, while we are scheduling. But anyone can
+                 * free up entries from the trash at any time.
+                 */
+
+                if (en->dest->flags & IP_VS_DEST_F_AVAILABLE)
+                        dest = en->dest;
+        }
+        read_unlock(&svc->sched_lock);
+
+        /* If the destination has a weight and is not overloaded, use it */
+        if (dest && atomic_read(&dest->weight) > 0 && !is_overloaded(dest, svc))
+                goto out;
+
+        /* No cache entry or it is invalid, time to schedule */
+        dest = __ip_vs_lblc_schedule(svc, iph);
+        if (!dest) {
+                IP_VS_DBG(1, "no destination available\n");
+                return NULL;
         }
-        en->lastuse = jiffies;
 
+        /* If we fail to create a cache entry, we'll just use the valid dest */
+        write_lock(&svc->sched_lock);
+        ip_vs_lblc_new(tbl, iph->daddr, dest);
+        write_unlock(&svc->sched_lock);
+
+out:
         IP_VS_DBG(6, "LBLC: destination IP address %u.%u.%u.%u "
                   "--> server %u.%u.%u.%u:%d\n",
-                  NIPQUAD(en->addr),
-                  NIPQUAD(dest->addr),
+                  NIPQUAD(iph->daddr),
+                  NIPQUAD(dest->addr.ip),
                   ntohs(dest->port));
 
         return dest;
@@ -540,9 +522,11 @@ static struct ip_vs_scheduler ip_vs_lblc_scheduler =
         .refcnt =               ATOMIC_INIT(0),
         .module =               THIS_MODULE,
         .n_list =               LIST_HEAD_INIT(ip_vs_lblc_scheduler.n_list),
+#ifdef CONFIG_IP_VS_IPV6
+        .supports_ipv6 =        0,
+#endif
         .init_service =         ip_vs_lblc_init_svc,
         .done_service =         ip_vs_lblc_done_svc,
-        .update_service =       ip_vs_lblc_update_svc,
         .schedule =             ip_vs_lblc_schedule,
 };
 
diff --git a/net/ipv4/ipvs/ip_vs_lblcr.c b/net/ipv4/ipvs/ip_vs_lblcr.c
index c234e73968a6..1f75ea83bcf8 100644
--- a/net/ipv4/ipvs/ip_vs_lblcr.c
+++ b/net/ipv4/ipvs/ip_vs_lblcr.c
@@ -106,7 +106,7 @@ ip_vs_dest_set_insert(struct ip_vs_dest_set *set, struct ip_vs_dest *dest)
                         return NULL;
         }
 
-        e = kmalloc(sizeof(struct ip_vs_dest_list), GFP_ATOMIC);
+        e = kmalloc(sizeof(*e), GFP_ATOMIC);
         if (e == NULL) {
                 IP_VS_ERR("ip_vs_dest_set_insert(): no memory\n");
                 return NULL;
@@ -116,11 +116,9 @@ ip_vs_dest_set_insert(struct ip_vs_dest_set *set, struct ip_vs_dest *dest)
         e->dest = dest;
 
         /* link it to the list */
-        write_lock(&set->lock);
         e->next = set->list;
         set->list = e;
         atomic_inc(&set->size);
-        write_unlock(&set->lock);
 
         set->lastmod = jiffies;
         return e;
@@ -131,7 +129,6 @@ ip_vs_dest_set_erase(struct ip_vs_dest_set *set, struct ip_vs_dest *dest)
 {
         struct ip_vs_dest_list *e, **ep;
 
-        write_lock(&set->lock);
         for (ep=&set->list, e=*ep; e!=NULL; e=*ep) {
                 if (e->dest == dest) {
                         /* HIT */
@@ -144,7 +141,6 @@ ip_vs_dest_set_erase(struct ip_vs_dest_set *set, struct ip_vs_dest *dest)
                 }
                 ep = &e->next;
         }
-        write_unlock(&set->lock);
 }
 
 static void ip_vs_dest_set_eraseall(struct ip_vs_dest_set *set)
@@ -174,7 +170,6 @@ static inline struct ip_vs_dest *ip_vs_dest_set_min(struct ip_vs_dest_set *set)
         if (set == NULL)
                 return NULL;
 
-        read_lock(&set->lock);
         /* select the first destination server, whose weight > 0 */
         for (e=set->list; e!=NULL; e=e->next) {
                 least = e->dest;
@@ -188,7 +183,6 @@ static inline struct ip_vs_dest *ip_vs_dest_set_min(struct ip_vs_dest_set *set)
                         goto nextstage;
                 }
         }
-        read_unlock(&set->lock);
         return NULL;
 
         /* find the destination with the weighted least load */
@@ -207,11 +201,10 @@ static inline struct ip_vs_dest *ip_vs_dest_set_min(struct ip_vs_dest_set *set)
                         loh = doh;
                 }
         }
-        read_unlock(&set->lock);
 
         IP_VS_DBG(6, "ip_vs_dest_set_min: server %d.%d.%d.%d:%d "
                   "activeconns %d refcnt %d weight %d overhead %d\n",
-                  NIPQUAD(least->addr), ntohs(least->port),
+                  NIPQUAD(least->addr.ip), ntohs(least->port),
                   atomic_read(&least->activeconns),
                   atomic_read(&least->refcnt),
                   atomic_read(&least->weight), loh);
@@ -229,7 +222,6 @@ static inline struct ip_vs_dest *ip_vs_dest_set_max(struct ip_vs_dest_set *set)
         if (set == NULL)
                 return NULL;
 
-        read_lock(&set->lock);
         /* select the first destination server, whose weight > 0 */
         for (e=set->list; e!=NULL; e=e->next) {
                 most = e->dest;
@@ -239,7 +231,6 @@ static inline struct ip_vs_dest *ip_vs_dest_set_max(struct ip_vs_dest_set *set)
                         goto nextstage;
                 }
         }
-        read_unlock(&set->lock);
         return NULL;
 
         /* find the destination with the weighted most load */
@@ -256,11 +247,10 @@ static inline struct ip_vs_dest *ip_vs_dest_set_max(struct ip_vs_dest_set *set)
                         moh = doh;
                 }
         }
-        read_unlock(&set->lock);
 
         IP_VS_DBG(6, "ip_vs_dest_set_max: server %d.%d.%d.%d:%d "
                   "activeconns %d refcnt %d weight %d overhead %d\n",
-                  NIPQUAD(most->addr), ntohs(most->port),
+                  NIPQUAD(most->addr.ip), ntohs(most->port),
                   atomic_read(&most->activeconns),
                   atomic_read(&most->refcnt),
                   atomic_read(&most->weight), moh);
@@ -284,7 +274,6 @@ struct ip_vs_lblcr_entry {
  *      IPVS lblcr hash table
  */
 struct ip_vs_lblcr_table {
-        rwlock_t                lock;           /* lock for this table */
         struct list_head        bucket[IP_VS_LBLCR_TAB_SIZE];  /* hash bucket */
         atomic_t                entries;        /* number of entries */
         int                     max_size;       /* maximum size of entries */
@@ -311,32 +300,6 @@ static ctl_table vs_vars_table[] = {
 
 static struct ctl_table_header * sysctl_header;
 
-/*
- *      new/free a ip_vs_lblcr_entry, which is a mapping of a destination
- *      IP address to a server.
- */
-static inline struct ip_vs_lblcr_entry *ip_vs_lblcr_new(__be32 daddr)
-{
-        struct ip_vs_lblcr_entry *en;
-
-        en = kmalloc(sizeof(struct ip_vs_lblcr_entry), GFP_ATOMIC);
-        if (en == NULL) {
-                IP_VS_ERR("ip_vs_lblcr_new(): no memory\n");
-                return NULL;
-        }
-
-        INIT_LIST_HEAD(&en->list);
-        en->addr = daddr;
-
-        /* initilize its dest set */
-        atomic_set(&(en->set.size), 0);
-        en->set.list = NULL;
-        rwlock_init(&en->set.lock);
-
-        return en;
-}
-
-
 static inline void ip_vs_lblcr_free(struct ip_vs_lblcr_entry *en)
 {
         list_del(&en->list);
@@ -358,55 +321,68 @@ static inline unsigned ip_vs_lblcr_hashkey(__be32 addr)
  *      Hash an entry in the ip_vs_lblcr_table.
  *      returns bool success.
  */
-static int
+static void
 ip_vs_lblcr_hash(struct ip_vs_lblcr_table *tbl, struct ip_vs_lblcr_entry *en)
 {
-        unsigned hash;
+        unsigned hash = ip_vs_lblcr_hashkey(en->addr);
 
-        if (!list_empty(&en->list)) {
-                IP_VS_ERR("ip_vs_lblcr_hash(): request for already hashed, "
-                          "called from %p\n", __builtin_return_address(0));
-                return 0;
-        }
-
-        /*
-         *      Hash by destination IP address
-         */
-        hash = ip_vs_lblcr_hashkey(en->addr);
-
-        write_lock(&tbl->lock);
         list_add(&en->list, &tbl->bucket[hash]);
         atomic_inc(&tbl->entries);
-        write_unlock(&tbl->lock);
-
-        return 1;
 }
 
 
 /*
- *  Get ip_vs_lblcr_entry associated with supplied parameters.
+ *  Get ip_vs_lblcr_entry associated with supplied parameters. Called under
+ *  read lock.
  */
 static inline struct ip_vs_lblcr_entry *
 ip_vs_lblcr_get(struct ip_vs_lblcr_table *tbl, __be32 addr)
 {
-        unsigned hash;
+        unsigned hash = ip_vs_lblcr_hashkey(addr);
         struct ip_vs_lblcr_entry *en;
 
-        hash = ip_vs_lblcr_hashkey(addr);
+        list_for_each_entry(en, &tbl->bucket[hash], list)
+                if (en->addr == addr)
+                        return en;
 
-        read_lock(&tbl->lock);
+        return NULL;
+}
 
-        list_for_each_entry(en, &tbl->bucket[hash], list) {
-                if (en->addr == addr) {
-                        /* HIT */
-                        read_unlock(&tbl->lock);
-                        return en;
+
+/*
+ * Create or update an ip_vs_lblcr_entry, which is a mapping of a destination
+ * IP address to a server. Called under write lock.
+ */
+static inline struct ip_vs_lblcr_entry *
+ip_vs_lblcr_new(struct ip_vs_lblcr_table *tbl,  __be32 daddr,
+                struct ip_vs_dest *dest)
+{
+        struct ip_vs_lblcr_entry *en;
+
+        en = ip_vs_lblcr_get(tbl, daddr);
+        if (!en) {
+                en = kmalloc(sizeof(*en), GFP_ATOMIC);
+                if (!en) {
+                        IP_VS_ERR("ip_vs_lblcr_new(): no memory\n");
+                        return NULL;
                 }
+
+                en->addr = daddr;
+                en->lastuse = jiffies;
+
+                /* initilize its dest set */
+                atomic_set(&(en->set.size), 0);
+                en->set.list = NULL;
+                rwlock_init(&en->set.lock);
+
+                ip_vs_lblcr_hash(tbl, en);
         }
 
-        read_unlock(&tbl->lock);
+        write_lock(&en->set.lock);
+        ip_vs_dest_set_insert(&en->set, dest);
+        write_unlock(&en->set.lock);
 
-        return NULL;
+        return en;
 }
 
 
@@ -418,19 +394,18 @@ static void ip_vs_lblcr_flush(struct ip_vs_lblcr_table *tbl)
         int i;
         struct ip_vs_lblcr_entry *en, *nxt;
 
+        /* No locking required, only called during cleanup. */
         for (i=0; i<IP_VS_LBLCR_TAB_SIZE; i++) {
-                write_lock(&tbl->lock);
                 list_for_each_entry_safe(en, nxt, &tbl->bucket[i], list) {
                         ip_vs_lblcr_free(en);
-                        atomic_dec(&tbl->entries);
                 }
-                write_unlock(&tbl->lock);
         }
 }
 
 
-static inline void ip_vs_lblcr_full_check(struct ip_vs_lblcr_table *tbl)
+static inline void ip_vs_lblcr_full_check(struct ip_vs_service *svc)
 {
+        struct ip_vs_lblcr_table *tbl = svc->sched_data;
         unsigned long now = jiffies;
         int i, j;
         struct ip_vs_lblcr_entry *en, *nxt;
@@ -438,7 +413,7 @@ static inline void ip_vs_lblcr_full_check(struct ip_vs_lblcr_table *tbl)
         for (i=0, j=tbl->rover; i<IP_VS_LBLCR_TAB_SIZE; i++) {
                 j = (j + 1) & IP_VS_LBLCR_TAB_MASK;
 
-                write_lock(&tbl->lock);
+                write_lock(&svc->sched_lock);
                 list_for_each_entry_safe(en, nxt, &tbl->bucket[j], list) {
                         if (time_after(en->lastuse+sysctl_ip_vs_lblcr_expiration,
                                        now))
@@ -447,7 +422,7 @@ static inline void ip_vs_lblcr_full_check(struct ip_vs_lblcr_table *tbl)
                         ip_vs_lblcr_free(en);
                         atomic_dec(&tbl->entries);
                 }
-                write_unlock(&tbl->lock);
+                write_unlock(&svc->sched_lock);
         }
         tbl->rover = j;
 }
@@ -466,17 +441,16 @@ static inline void ip_vs_lblcr_full_check(struct ip_vs_lblcr_table *tbl)
  */
 static void ip_vs_lblcr_check_expire(unsigned long data)
 {
-        struct ip_vs_lblcr_table *tbl;
+        struct ip_vs_service *svc = (struct ip_vs_service *) data;
+        struct ip_vs_lblcr_table *tbl = svc->sched_data;
         unsigned long now = jiffies;
         int goal;
         int i, j;
         struct ip_vs_lblcr_entry *en, *nxt;
 
-        tbl = (struct ip_vs_lblcr_table *)data;
-
         if ((tbl->counter % COUNT_FOR_FULL_EXPIRATION) == 0) {
                 /* do full expiration check */
-                ip_vs_lblcr_full_check(tbl);
+                ip_vs_lblcr_full_check(svc);
                 tbl->counter = 1;
                 goto out;
         }
@@ -493,7 +467,7 @@ static void ip_vs_lblcr_check_expire(unsigned long data)
         for (i=0, j=tbl->rover; i<IP_VS_LBLCR_TAB_SIZE; i++) {
                 j = (j + 1) & IP_VS_LBLCR_TAB_MASK;
 
-                write_lock(&tbl->lock);
+                write_lock(&svc->sched_lock);
                 list_for_each_entry_safe(en, nxt, &tbl->bucket[j], list) {
                         if (time_before(now, en->lastuse+ENTRY_TIMEOUT))
                                 continue;
@@ -502,7 +476,7 @@ static void ip_vs_lblcr_check_expire(unsigned long data)
                         atomic_dec(&tbl->entries);
                         goal--;
                 }
-                write_unlock(&tbl->lock);
+                write_unlock(&svc->sched_lock);
                 if (goal <= 0)
                         break;
         }
@@ -520,15 +494,14 @@ static int ip_vs_lblcr_init_svc(struct ip_vs_service *svc)
         /*
          *    Allocate the ip_vs_lblcr_table for this service
          */
-        tbl = kmalloc(sizeof(struct ip_vs_lblcr_table), GFP_ATOMIC);
+        tbl = kmalloc(sizeof(*tbl), GFP_ATOMIC);
         if (tbl == NULL) {
                 IP_VS_ERR("ip_vs_lblcr_init_svc(): no memory\n");
                 return -ENOMEM;
         }
         svc->sched_data = tbl;
         IP_VS_DBG(6, "LBLCR hash table (memory=%Zdbytes) allocated for "
-                  "current service\n",
-                  sizeof(struct ip_vs_lblcr_table));
+                  "current service\n", sizeof(*tbl));
 
         /*
          *    Initialize the hash buckets
@@ -536,7 +509,6 @@ static int ip_vs_lblcr_init_svc(struct ip_vs_service *svc)
         for (i=0; i<IP_VS_LBLCR_TAB_SIZE; i++) {
                 INIT_LIST_HEAD(&tbl->bucket[i]);
         }
-        rwlock_init(&tbl->lock);
         tbl->max_size = IP_VS_LBLCR_TAB_SIZE*16;
         tbl->rover = 0;
         tbl->counter = 1;
@@ -545,9 +517,8 @@ static int ip_vs_lblcr_init_svc(struct ip_vs_service *svc)
          *    Hook periodic timer for garbage collection
          */
         setup_timer(&tbl->periodic_timer, ip_vs_lblcr_check_expire,
-                        (unsigned long)tbl);
-        tbl->periodic_timer.expires = jiffies+CHECK_EXPIRE_INTERVAL;
-        add_timer(&tbl->periodic_timer);
+                        (unsigned long)svc);
+        mod_timer(&tbl->periodic_timer, jiffies + CHECK_EXPIRE_INTERVAL);
 
         return 0;
 }
@@ -564,22 +535,16 @@ static int ip_vs_lblcr_done_svc(struct ip_vs_service *svc)
         ip_vs_lblcr_flush(tbl);
 
         /* release the table itself */
-        kfree(svc->sched_data);
+        kfree(tbl);
         IP_VS_DBG(6, "LBLCR hash table (memory=%Zdbytes) released\n",
-                  sizeof(struct ip_vs_lblcr_table));
+                  sizeof(*tbl));
 
         return 0;
 }
 
 
-static int ip_vs_lblcr_update_svc(struct ip_vs_service *svc)
-{
-        return 0;
-}
-
-
 static inline struct ip_vs_dest *
-__ip_vs_wlc_schedule(struct ip_vs_service *svc, struct iphdr *iph)
+__ip_vs_lblcr_schedule(struct ip_vs_service *svc, struct iphdr *iph)
 {
         struct ip_vs_dest *dest, *least;
         int loh, doh;
@@ -633,7 +598,7 @@ __ip_vs_wlc_schedule(struct ip_vs_service *svc, struct iphdr *iph)
 
         IP_VS_DBG(6, "LBLCR: server %d.%d.%d.%d:%d "
                   "activeconns %d refcnt %d weight %d overhead %d\n",
-                  NIPQUAD(least->addr), ntohs(least->port),
+                  NIPQUAD(least->addr.ip), ntohs(least->port),
                   atomic_read(&least->activeconns),
                   atomic_read(&least->refcnt),
                   atomic_read(&least->weight), loh);
@@ -669,51 +634,79 @@ is_overloaded(struct ip_vs_dest *dest, struct ip_vs_service *svc)
 static struct ip_vs_dest *
 ip_vs_lblcr_schedule(struct ip_vs_service *svc, const struct sk_buff *skb)
 {
-        struct ip_vs_dest *dest;
-        struct ip_vs_lblcr_table *tbl;
-        struct ip_vs_lblcr_entry *en;
+        struct ip_vs_lblcr_table *tbl = svc->sched_data;
         struct iphdr *iph = ip_hdr(skb);
+        struct ip_vs_dest *dest = NULL;
+        struct ip_vs_lblcr_entry *en;
 
         IP_VS_DBG(6, "ip_vs_lblcr_schedule(): Scheduling...\n");
 
-        tbl = (struct ip_vs_lblcr_table *)svc->sched_data;
+        /* First look in our cache */
+        read_lock(&svc->sched_lock);
         en = ip_vs_lblcr_get(tbl, iph->daddr);
-        if (en == NULL) {
-                dest = __ip_vs_wlc_schedule(svc, iph);
-                if (dest == NULL) {
-                        IP_VS_DBG(1, "no destination available\n");
-                        return NULL;
-                }
-                en = ip_vs_lblcr_new(iph->daddr);
-                if (en == NULL) {
-                        return NULL;
-                }
-                ip_vs_dest_set_insert(&en->set, dest);
-                ip_vs_lblcr_hash(tbl, en);
-        } else {
+        if (en) {
+                /* We only hold a read lock, but this is atomic */
+                en->lastuse = jiffies;
+
+                /* Get the least loaded destination */
+                read_lock(&en->set.lock);
                 dest = ip_vs_dest_set_min(&en->set);
-                if (!dest || is_overloaded(dest, svc)) {
-                        dest = __ip_vs_wlc_schedule(svc, iph);
-                        if (dest == NULL) {
-                                IP_VS_DBG(1, "no destination available\n");
-                                return NULL;
-                        }
-                        ip_vs_dest_set_insert(&en->set, dest);
-                }
+                read_unlock(&en->set.lock);
+
+                /* More than one destination + enough time passed by, cleanup */
                 if (atomic_read(&en->set.size) > 1 &&
-                    jiffies-en->set.lastmod > sysctl_ip_vs_lblcr_expiration) {
+                                time_after(jiffies, en->set.lastmod +
+                                sysctl_ip_vs_lblcr_expiration)) {
                         struct ip_vs_dest *m;
+
+                        write_lock(&en->set.lock);
                         m = ip_vs_dest_set_max(&en->set);
                         if (m)
                                 ip_vs_dest_set_erase(&en->set, m);
+                        write_unlock(&en->set.lock);
                 }
+
+                /* If the destination is not overloaded, use it */
+                if (dest && !is_overloaded(dest, svc)) {
+                        read_unlock(&svc->sched_lock);
+                        goto out;
+                }
+
+                /* The cache entry is invalid, time to schedule */
+                dest = __ip_vs_lblcr_schedule(svc, iph);
+                if (!dest) {
+                        IP_VS_DBG(1, "no destination available\n");
+                        read_unlock(&svc->sched_lock);
+                        return NULL;
+                }
+
+                /* Update our cache entry */
+                write_lock(&en->set.lock);
+                ip_vs_dest_set_insert(&en->set, dest);
+                write_unlock(&en->set.lock);
+        }
+        read_unlock(&svc->sched_lock);
+
+        if (dest)
+                goto out;
+
+        /* No cache entry, time to schedule */
+        dest = __ip_vs_lblcr_schedule(svc, iph);
+        if (!dest) {
+                IP_VS_DBG(1, "no destination available\n");
+                return NULL;
         }
-        en->lastuse = jiffies;
 
+        /* If we fail to create a cache entry, we'll just use the valid dest */
+        write_lock(&svc->sched_lock);
+        ip_vs_lblcr_new(tbl, iph->daddr, dest);
+        write_unlock(&svc->sched_lock);
+
+out:
         IP_VS_DBG(6, "LBLCR: destination IP address %u.%u.%u.%u "
                   "--> server %u.%u.%u.%u:%d\n",
-                  NIPQUAD(en->addr),
-                  NIPQUAD(dest->addr),
+                  NIPQUAD(iph->daddr),
+                  NIPQUAD(dest->addr.ip),
                   ntohs(dest->port));
 
         return dest;
@@ -729,9 +722,11 @@ static struct ip_vs_scheduler ip_vs_lblcr_scheduler =
         .refcnt =               ATOMIC_INIT(0),
         .module =               THIS_MODULE,
         .n_list =               LIST_HEAD_INIT(ip_vs_lblcr_scheduler.n_list),
+#ifdef CONFIG_IP_VS_IPV6
+        .supports_ipv6 =        0,
+#endif
         .init_service =         ip_vs_lblcr_init_svc,
         .done_service =         ip_vs_lblcr_done_svc,
-        .update_service =       ip_vs_lblcr_update_svc,
         .schedule =             ip_vs_lblcr_schedule,
 };
 
diff --git a/net/ipv4/ipvs/ip_vs_lc.c b/net/ipv4/ipvs/ip_vs_lc.c
index ebcdbf75ac65..b69f808ac461 100644
--- a/net/ipv4/ipvs/ip_vs_lc.c
+++ b/net/ipv4/ipvs/ip_vs_lc.c
@@ -20,24 +20,6 @@
 #include <net/ip_vs.h>
 
 
-static int ip_vs_lc_init_svc(struct ip_vs_service *svc)
-{
-        return 0;
-}
-
-
-static int ip_vs_lc_done_svc(struct ip_vs_service *svc)
-{
-        return 0;
-}
-
-
-static int ip_vs_lc_update_svc(struct ip_vs_service *svc)
-{
-        return 0;
-}
-
-
 static inline unsigned int
 ip_vs_lc_dest_overhead(struct ip_vs_dest *dest)
 {
@@ -85,10 +67,10 @@ ip_vs_lc_schedule(struct ip_vs_service *svc, const struct sk_buff *skb)
         }
 
         if (least)
-        IP_VS_DBG(6, "LC: server %u.%u.%u.%u:%u activeconns %d inactconns %d\n",
-                  NIPQUAD(least->addr), ntohs(least->port),
-                  atomic_read(&least->activeconns),
-                  atomic_read(&least->inactconns));
+        IP_VS_DBG_BUF(6, "LC: server %s:%u activeconns %d inactconns %d\n",
+                      IP_VS_DBG_ADDR(svc->af, &least->addr), ntohs(least->port),
+                      atomic_read(&least->activeconns),
+                      atomic_read(&least->inactconns));
 
         return least;
 }
@@ -99,9 +81,9 @@ static struct ip_vs_scheduler ip_vs_lc_scheduler = {
         .refcnt =               ATOMIC_INIT(0),
         .module =               THIS_MODULE,
         .n_list =               LIST_HEAD_INIT(ip_vs_lc_scheduler.n_list),
-        .init_service =         ip_vs_lc_init_svc,
-        .done_service =         ip_vs_lc_done_svc,
-        .update_service =       ip_vs_lc_update_svc,
+#ifdef CONFIG_IP_VS_IPV6
+        .supports_ipv6 =        1,
+#endif
         .schedule =             ip_vs_lc_schedule,
 };
 
diff --git a/net/ipv4/ipvs/ip_vs_nq.c b/net/ipv4/ipvs/ip_vs_nq.c
index 92f3a6770031..9a2d8033f08f 100644
--- a/net/ipv4/ipvs/ip_vs_nq.c
+++ b/net/ipv4/ipvs/ip_vs_nq.c
@@ -37,27 +37,6 @@
 #include <net/ip_vs.h>
 
 
-static int
-ip_vs_nq_init_svc(struct ip_vs_service *svc)
-{
-        return 0;
-}
-
-
-static int
-ip_vs_nq_done_svc(struct ip_vs_service *svc)
-{
-        return 0;
-}
-
-
-static int
-ip_vs_nq_update_svc(struct ip_vs_service *svc)
-{
-        return 0;
-}
-
-
 static inline unsigned int
 ip_vs_nq_dest_overhead(struct ip_vs_dest *dest)
 {
@@ -120,12 +99,12 @@ ip_vs_nq_schedule(struct ip_vs_service *svc, const struct sk_buff *skb)
                 return NULL;
 
   out:
-        IP_VS_DBG(6, "NQ: server %u.%u.%u.%u:%u "
-                  "activeconns %d refcnt %d weight %d overhead %d\n",
-                  NIPQUAD(least->addr), ntohs(least->port),
-                  atomic_read(&least->activeconns),
-                  atomic_read(&least->refcnt),
-                  atomic_read(&least->weight), loh);
+        IP_VS_DBG_BUF(6, "NQ: server %s:%u "
+                      "activeconns %d refcnt %d weight %d overhead %d\n",
+                      IP_VS_DBG_ADDR(svc->af, &least->addr), ntohs(least->port),
+                      atomic_read(&least->activeconns),
+                      atomic_read(&least->refcnt),
+                      atomic_read(&least->weight), loh);
 
         return least;
 }
@@ -137,9 +116,9 @@ static struct ip_vs_scheduler ip_vs_nq_scheduler =
         .refcnt =               ATOMIC_INIT(0),
         .module =               THIS_MODULE,
         .n_list =               LIST_HEAD_INIT(ip_vs_nq_scheduler.n_list),
-        .init_service =         ip_vs_nq_init_svc,
-        .done_service =         ip_vs_nq_done_svc,
-        .update_service =       ip_vs_nq_update_svc,
+#ifdef CONFIG_IP_VS_IPV6
+        .supports_ipv6 =        1,
+#endif
         .schedule =             ip_vs_nq_schedule,
 };
 
diff --git a/net/ipv4/ipvs/ip_vs_proto.c b/net/ipv4/ipvs/ip_vs_proto.c
index 6099a88fc200..0791f9e08feb 100644
--- a/net/ipv4/ipvs/ip_vs_proto.c
+++ b/net/ipv4/ipvs/ip_vs_proto.c
@@ -151,11 +151,11 @@ const char * ip_vs_state_name(__u16 proto, int state)
 }
 
 
-void
-ip_vs_tcpudp_debug_packet(struct ip_vs_protocol *pp,
-                          const struct sk_buff *skb,
-                          int offset,
-                          const char *msg)
+static void
+ip_vs_tcpudp_debug_packet_v4(struct ip_vs_protocol *pp,
+                             const struct sk_buff *skb,
+                             int offset,
+                             const char *msg)
 {
         char buf[128];
         struct iphdr _iph, *ih;
@@ -189,6 +189,61 @@ ip_vs_tcpudp_debug_packet(struct ip_vs_protocol *pp,
         printk(KERN_DEBUG "IPVS: %s: %s\n", msg, buf);
 }
 
+#ifdef CONFIG_IP_VS_IPV6
+static void
+ip_vs_tcpudp_debug_packet_v6(struct ip_vs_protocol *pp,
+                             const struct sk_buff *skb,
+                             int offset,
+                             const char *msg)
+{
+        char buf[192];
+        struct ipv6hdr _iph, *ih;
+
+        ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
+        if (ih == NULL)
+                sprintf(buf, "%s TRUNCATED", pp->name);
+        else if (ih->nexthdr == IPPROTO_FRAGMENT)
+                sprintf(buf, "%s " NIP6_FMT "->" NIP6_FMT " frag",
+                        pp->name, NIP6(ih->saddr),
+                        NIP6(ih->daddr));
+        else {
+                __be16 _ports[2], *pptr;
+
+                pptr = skb_header_pointer(skb, offset + sizeof(struct ipv6hdr),
+                                          sizeof(_ports), _ports);
+                if (pptr == NULL)
+                        sprintf(buf, "%s TRUNCATED " NIP6_FMT "->" NIP6_FMT,
+                                pp->name,
+                                NIP6(ih->saddr),
+                                NIP6(ih->daddr));
+                else
+                        sprintf(buf, "%s " NIP6_FMT ":%u->" NIP6_FMT ":%u",
+                                pp->name,
+                                NIP6(ih->saddr),
+                                ntohs(pptr[0]),
+                                NIP6(ih->daddr),
+                                ntohs(pptr[1]));
+        }
+
+        printk(KERN_DEBUG "IPVS: %s: %s\n", msg, buf);
+}
+#endif
+
+
+void
+ip_vs_tcpudp_debug_packet(struct ip_vs_protocol *pp,
+                          const struct sk_buff *skb,
+                          int offset,
+                          const char *msg)
+{
+#ifdef CONFIG_IP_VS_IPV6
+        if (skb->protocol == htons(ETH_P_IPV6))
+                ip_vs_tcpudp_debug_packet_v6(pp, skb, offset, msg);
+        else
+#endif
+                ip_vs_tcpudp_debug_packet_v4(pp, skb, offset, msg);
+}
+
 
 int __init ip_vs_protocol_init(void)
 {
diff --git a/net/ipv4/ipvs/ip_vs_proto_ah.c b/net/ipv4/ipvs/ip_vs_proto_ah.c
deleted file mode 100644
index 73e0ea87c1f5..000000000000
--- a/net/ipv4/ipvs/ip_vs_proto_ah.c
+++ /dev/null
@@ -1,178 +0,0 @@
-/*
- * ip_vs_proto_ah.c:    AH IPSec load balancing support for IPVS
- *
- * Authors:     Julian Anastasov <ja@ssi.bg>, February 2002
- *              Wensong Zhang <wensong@linuxvirtualserver.org>
- *
- *              This program is free software; you can redistribute it and/or
- *              modify it under the terms of the GNU General Public License
- *              version 2 as published by the Free Software Foundation;
- *
- */
-
-#include <linux/in.h>
-#include <linux/ip.h>
-#include <linux/module.h>
-#include <linux/kernel.h>
-#include <linux/netfilter.h>
-#include <linux/netfilter_ipv4.h>
-
-#include <net/ip_vs.h>
-
-
-/* TODO:
-
-struct isakmp_hdr {
-        __u8            icookie[8];
-        __u8            rcookie[8];
-        __u8            np;
-        __u8            version;
-        __u8            xchgtype;
-        __u8            flags;
-        __u32           msgid;
-        __u32           length;
-};
-
-*/
-
-#define PORT_ISAKMP     500
-
-
-static struct ip_vs_conn *
-ah_conn_in_get(const struct sk_buff *skb,
-               struct ip_vs_protocol *pp,
-               const struct iphdr *iph,
-               unsigned int proto_off,
-               int inverse)
-{
-        struct ip_vs_conn *cp;
-
-        if (likely(!inverse)) {
-                cp = ip_vs_conn_in_get(IPPROTO_UDP,
-                                       iph->saddr,
-                                       htons(PORT_ISAKMP),
-                                       iph->daddr,
-                                       htons(PORT_ISAKMP));
-        } else {
-                cp = ip_vs_conn_in_get(IPPROTO_UDP,
-                                       iph->daddr,
-                                       htons(PORT_ISAKMP),
-                                       iph->saddr,
-                                       htons(PORT_ISAKMP));
-        }
-
-        if (!cp) {
-                /*
-                 * We are not sure if the packet is from our
-                 * service, so our conn_schedule hook should return NF_ACCEPT
-                 */
-                IP_VS_DBG(12, "Unknown ISAKMP entry for outin packet "
-                          "%s%s %u.%u.%u.%u->%u.%u.%u.%u\n",
-                          inverse ? "ICMP+" : "",
-                          pp->name,
-                          NIPQUAD(iph->saddr),
-                          NIPQUAD(iph->daddr));
-        }
-
-        return cp;
-}
-
-
-static struct ip_vs_conn *
-ah_conn_out_get(const struct sk_buff *skb, struct ip_vs_protocol *pp,
-                const struct iphdr *iph, unsigned int proto_off, int inverse)
-{
-        struct ip_vs_conn *cp;
-
-        if (likely(!inverse)) {
-                cp = ip_vs_conn_out_get(IPPROTO_UDP,
-                                        iph->saddr,
-                                        htons(PORT_ISAKMP),
-                                        iph->daddr,
-                                        htons(PORT_ISAKMP));
-        } else {
-                cp = ip_vs_conn_out_get(IPPROTO_UDP,
-                                        iph->daddr,
-                                        htons(PORT_ISAKMP),
-                                        iph->saddr,
-                                        htons(PORT_ISAKMP));
-        }
-
-        if (!cp) {
-                IP_VS_DBG(12, "Unknown ISAKMP entry for inout packet "
-                          "%s%s %u.%u.%u.%u->%u.%u.%u.%u\n",
-                          inverse ? "ICMP+" : "",
-                          pp->name,
-                          NIPQUAD(iph->saddr),
-                          NIPQUAD(iph->daddr));
-        }
-
-        return cp;
-}
-
-
-static int
-ah_conn_schedule(struct sk_buff *skb,
-                 struct ip_vs_protocol *pp,
-                 int *verdict, struct ip_vs_conn **cpp)
-{
-        /*
-         * AH is only related traffic. Pass the packet to IP stack.
-         */
-        *verdict = NF_ACCEPT;
-        return 0;
-}
-
-
-static void
-ah_debug_packet(struct ip_vs_protocol *pp, const struct sk_buff *skb,
-                int offset, const char *msg)
-{
-        char buf[256];
-        struct iphdr _iph, *ih;
-
-        ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
-        if (ih == NULL)
-                sprintf(buf, "%s TRUNCATED", pp->name);
-        else
-                sprintf(buf, "%s %u.%u.%u.%u->%u.%u.%u.%u",
-                        pp->name, NIPQUAD(ih->saddr),
-                        NIPQUAD(ih->daddr));
-
-        printk(KERN_DEBUG "IPVS: %s: %s\n", msg, buf);
-}
-
-
-static void ah_init(struct ip_vs_protocol *pp)
-{
-        /* nothing to do now */
-}
-
-
-static void ah_exit(struct ip_vs_protocol *pp)
-{
-        /* nothing to do now */
-}
-
-
-struct ip_vs_protocol ip_vs_protocol_ah = {
-        .name =                 "AH",
-        .protocol =             IPPROTO_AH,
-        .num_states =           1,
-        .dont_defrag =          1,
-        .init =                 ah_init,
-        .exit =                 ah_exit,
-        .conn_schedule =        ah_conn_schedule,
-        .conn_in_get =          ah_conn_in_get,
-        .conn_out_get =         ah_conn_out_get,
-        .snat_handler =         NULL,
-        .dnat_handler =         NULL,
-        .csum_check =           NULL,
-        .state_transition =     NULL,
-        .register_app =         NULL,
-        .unregister_app =       NULL,
-        .app_conn_bind =        NULL,
-        .debug_packet =         ah_debug_packet,
-        .timeout_change =       NULL,           /* ISAKMP */
-        .set_state_timeout =    NULL,
-};
diff --git a/net/ipv4/ipvs/ip_vs_proto_ah_esp.c b/net/ipv4/ipvs/ip_vs_proto_ah_esp.c
new file mode 100644
index 000000000000..80ab0c8e5b4a
--- /dev/null
+++ b/net/ipv4/ipvs/ip_vs_proto_ah_esp.c
@@ -0,0 +1,235 @@
+/*
+ * ip_vs_proto_ah_esp.c:        AH/ESP IPSec load balancing support for IPVS
+ *
+ * Authors:     Julian Anastasov <ja@ssi.bg>, February 2002
+ *              Wensong Zhang <wensong@linuxvirtualserver.org>
+ *
+ *              This program is free software; you can redistribute it and/or
+ *              modify it under the terms of the GNU General Public License
+ *              version 2 as published by the Free Software Foundation;
+ *
+ */
+
+#include <linux/in.h>
+#include <linux/ip.h>
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/netfilter.h>
+#include <linux/netfilter_ipv4.h>
+
+#include <net/ip_vs.h>
+
+
+/* TODO:
+
+struct isakmp_hdr {
+        __u8            icookie[8];
+        __u8            rcookie[8];
+        __u8            np;
+        __u8            version;
+        __u8            xchgtype;
+        __u8            flags;
+        __u32           msgid;
+        __u32           length;
+};
+
+*/
+
+#define PORT_ISAKMP     500
+
+
+static struct ip_vs_conn *
+ah_esp_conn_in_get(int af, const struct sk_buff *skb, struct ip_vs_protocol *pp,
+                   const struct ip_vs_iphdr *iph, unsigned int proto_off,
+                   int inverse)
+{
+        struct ip_vs_conn *cp;
+
+        if (likely(!inverse)) {
+                cp = ip_vs_conn_in_get(af, IPPROTO_UDP,
+                                       &iph->saddr,
+                                       htons(PORT_ISAKMP),
+                                       &iph->daddr,
+                                       htons(PORT_ISAKMP));
+        } else {
+                cp = ip_vs_conn_in_get(af, IPPROTO_UDP,
+                                       &iph->daddr,
+                                       htons(PORT_ISAKMP),
+                                       &iph->saddr,
+                                       htons(PORT_ISAKMP));
+        }
+
+        if (!cp) {
+                /*
+                 * We are not sure if the packet is from our
+                 * service, so our conn_schedule hook should return NF_ACCEPT
+                 */
+                IP_VS_DBG_BUF(12, "Unknown ISAKMP entry for outin packet "
+                              "%s%s %s->%s\n",
+                              inverse ? "ICMP+" : "",
+                              pp->name,
+                              IP_VS_DBG_ADDR(af, &iph->saddr),
+                              IP_VS_DBG_ADDR(af, &iph->daddr));
+        }
+
+        return cp;
+}
+
+
+static struct ip_vs_conn *
+ah_esp_conn_out_get(int af, const struct sk_buff *skb,
+                    struct ip_vs_protocol *pp,
+                    const struct ip_vs_iphdr *iph,
+                    unsigned int proto_off,
+                    int inverse)
+{
+        struct ip_vs_conn *cp;
+
+        if (likely(!inverse)) {
+                cp = ip_vs_conn_out_get(af, IPPROTO_UDP,
+                                        &iph->saddr,
+                                        htons(PORT_ISAKMP),
+                                        &iph->daddr,
+                                        htons(PORT_ISAKMP));
+        } else {
+                cp = ip_vs_conn_out_get(af, IPPROTO_UDP,
+                                        &iph->daddr,
+                                        htons(PORT_ISAKMP),
+                                        &iph->saddr,
+                                        htons(PORT_ISAKMP));
+        }
+
+        if (!cp) {
+                IP_VS_DBG_BUF(12, "Unknown ISAKMP entry for inout packet "
+                              "%s%s %s->%s\n",
+                              inverse ? "ICMP+" : "",
+                              pp->name,
+                              IP_VS_DBG_ADDR(af, &iph->saddr),
+                              IP_VS_DBG_ADDR(af, &iph->daddr));
+        }
+
+        return cp;
+}
+
+
+static int
+ah_esp_conn_schedule(int af, struct sk_buff *skb, struct ip_vs_protocol *pp,
+                     int *verdict, struct ip_vs_conn **cpp)
+{
+        /*
+         * AH/ESP is only related traffic. Pass the packet to IP stack.
+         */
+        *verdict = NF_ACCEPT;
+        return 0;
+}
+
+
+static void
+ah_esp_debug_packet_v4(struct ip_vs_protocol *pp, const struct sk_buff *skb,
+                       int offset, const char *msg)
+{
+        char buf[256];
+        struct iphdr _iph, *ih;
+
+        ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
+        if (ih == NULL)
+                sprintf(buf, "%s TRUNCATED", pp->name);
+        else
+                sprintf(buf, "%s %u.%u.%u.%u->%u.%u.%u.%u",
+                        pp->name, NIPQUAD(ih->saddr),
+                        NIPQUAD(ih->daddr));
+
+        printk(KERN_DEBUG "IPVS: %s: %s\n", msg, buf);
+}
+
+#ifdef CONFIG_IP_VS_IPV6
+static void
+ah_esp_debug_packet_v6(struct ip_vs_protocol *pp, const struct sk_buff *skb,
+                       int offset, const char *msg)
+{
+        char buf[256];
+        struct ipv6hdr _iph, *ih;
+
+        ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
+        if (ih == NULL)
+                sprintf(buf, "%s TRUNCATED", pp->name);
+        else
+                sprintf(buf, "%s " NIP6_FMT "->" NIP6_FMT,
+                        pp->name, NIP6(ih->saddr),
+                        NIP6(ih->daddr));
+
+        printk(KERN_DEBUG "IPVS: %s: %s\n", msg, buf);
+}
+#endif
+
+static void
+ah_esp_debug_packet(struct ip_vs_protocol *pp, const struct sk_buff *skb,
+                    int offset, const char *msg)
+{
+#ifdef CONFIG_IP_VS_IPV6
+        if (skb->protocol == htons(ETH_P_IPV6))
+                ah_esp_debug_packet_v6(pp, skb, offset, msg);
+        else
+#endif
+                ah_esp_debug_packet_v4(pp, skb, offset, msg);
+}
+
+
+static void ah_esp_init(struct ip_vs_protocol *pp)
+{
+        /* nothing to do now */
+}
+
+
+static void ah_esp_exit(struct ip_vs_protocol *pp)
+{
+        /* nothing to do now */
+}
+
+
+#ifdef CONFIG_IP_VS_PROTO_AH
+struct ip_vs_protocol ip_vs_protocol_ah = {
+        .name =                 "AH",
+        .protocol =             IPPROTO_AH,
+        .num_states =           1,
+        .dont_defrag =          1,
+        .init =                 ah_esp_init,
+        .exit =                 ah_esp_exit,
+        .conn_schedule =        ah_esp_conn_schedule,
+        .conn_in_get =          ah_esp_conn_in_get,
+        .conn_out_get =         ah_esp_conn_out_get,
+        .snat_handler =         NULL,
+        .dnat_handler =         NULL,
+        .csum_check =           NULL,
+        .state_transition =     NULL,
+        .register_app =         NULL,
+        .unregister_app =       NULL,
+        .app_conn_bind =        NULL,
+        .debug_packet =         ah_esp_debug_packet,
+        .timeout_change =       NULL,           /* ISAKMP */
+        .set_state_timeout =    NULL,
+};
+#endif
+
+#ifdef CONFIG_IP_VS_PROTO_ESP
+struct ip_vs_protocol ip_vs_protocol_esp = {
+        .name =                 "ESP",
+        .protocol =             IPPROTO_ESP,
+        .num_states =           1,
+        .dont_defrag =          1,
+        .init =                 ah_esp_init,
+        .exit =                 ah_esp_exit,
+        .conn_schedule =        ah_esp_conn_schedule,
+        .conn_in_get =          ah_esp_conn_in_get,
+        .conn_out_get =         ah_esp_conn_out_get,
+        .snat_handler =         NULL,
+        .dnat_handler =         NULL,
+        .csum_check =           NULL,
+        .state_transition =     NULL,
+        .register_app =         NULL,
+        .unregister_app =       NULL,
+        .app_conn_bind =        NULL,
+        .debug_packet =         ah_esp_debug_packet,
+        .timeout_change =       NULL,           /* ISAKMP */
+};
+#endif
diff --git a/net/ipv4/ipvs/ip_vs_proto_esp.c b/net/ipv4/ipvs/ip_vs_proto_esp.c
deleted file mode 100644
index 21d70c8ffa54..000000000000
--- a/net/ipv4/ipvs/ip_vs_proto_esp.c
+++ /dev/null
@@ -1,176 +0,0 @@
-/*
- * ip_vs_proto_esp.c:   ESP IPSec load balancing support for IPVS
- *
- * Authors:     Julian Anastasov <ja@ssi.bg>, February 2002
- *              Wensong Zhang <wensong@linuxvirtualserver.org>
- *
- *              This program is free software; you can redistribute it and/or
- *              modify it under the terms of the GNU General Public License
- *              version 2 as published by the Free Software Foundation;
- *
- */
-
-#include <linux/in.h>
-#include <linux/ip.h>
-#include <linux/module.h>
-#include <linux/kernel.h>
-#include <linux/netfilter.h>
-#include <linux/netfilter_ipv4.h>
-
-#include <net/ip_vs.h>
-
-
-/* TODO:
-
-struct isakmp_hdr {
-        __u8            icookie[8];
-        __u8            rcookie[8];
-        __u8            np;
-        __u8            version;
-        __u8            xchgtype;
-        __u8            flags;
-        __u32           msgid;
-        __u32           length;
-};
-
-*/
-
-#define PORT_ISAKMP     500
-
-
-static struct ip_vs_conn *
-esp_conn_in_get(const struct sk_buff *skb,
-                struct ip_vs_protocol *pp,
-                const struct iphdr *iph,
-                unsigned int proto_off,
-                int inverse)
-{
-        struct ip_vs_conn *cp;
-
-        if (likely(!inverse)) {
-                cp = ip_vs_conn_in_get(IPPROTO_UDP,
-                                       iph->saddr,
-                                       htons(PORT_ISAKMP),
-                                       iph->daddr,
-                                       htons(PORT_ISAKMP));
-        } else {
-                cp = ip_vs_conn_in_get(IPPROTO_UDP,
-                                       iph->daddr,
-                                       htons(PORT_ISAKMP),
-                                       iph->saddr,
-                                       htons(PORT_ISAKMP));
-        }
-
-        if (!cp) {
-                /*
-                 * We are not sure if the packet is from our
-                 * service, so our conn_schedule hook should return NF_ACCEPT
-                 */
-                IP_VS_DBG(12, "Unknown ISAKMP entry for outin packet "
-                          "%s%s %u.%u.%u.%u->%u.%u.%u.%u\n",
-                          inverse ? "ICMP+" : "",
-                          pp->name,
-                          NIPQUAD(iph->saddr),
-                          NIPQUAD(iph->daddr));
-        }
-
-        return cp;
-}
-
-
-static struct ip_vs_conn *
-esp_conn_out_get(const struct sk_buff *skb, struct ip_vs_protocol *pp,
-                 const struct iphdr *iph, unsigned int proto_off, int inverse)
-{
-        struct ip_vs_conn *cp;
-
-        if (likely(!inverse)) {
-                cp = ip_vs_conn_out_get(IPPROTO_UDP,
-                                        iph->saddr,
-                                        htons(PORT_ISAKMP),
-                                        iph->daddr,
-                                        htons(PORT_ISAKMP));
-        } else {
-                cp = ip_vs_conn_out_get(IPPROTO_UDP,
-                                        iph->daddr,
-                                        htons(PORT_ISAKMP),
-                                        iph->saddr,
-                                        htons(PORT_ISAKMP));
-        }
-
-        if (!cp) {
-                IP_VS_DBG(12, "Unknown ISAKMP entry for inout packet "
-                          "%s%s %u.%u.%u.%u->%u.%u.%u.%u\n",
-                          inverse ? "ICMP+" : "",
-                          pp->name,
-                          NIPQUAD(iph->saddr),
-                          NIPQUAD(iph->daddr));
-        }
-
-        return cp;
-}
-
-
-static int
-esp_conn_schedule(struct sk_buff *skb, struct ip_vs_protocol *pp,
-                  int *verdict, struct ip_vs_conn **cpp)
-{
-        /*
-         * ESP is only related traffic. Pass the packet to IP stack.
-         */
-        *verdict = NF_ACCEPT;
-        return 0;
-}
-
-
-static void
-esp_debug_packet(struct ip_vs_protocol *pp, const struct sk_buff *skb,
-                 int offset, const char *msg)
-{
-        char buf[256];
-        struct iphdr _iph, *ih;
-
-        ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
-        if (ih == NULL)
-                sprintf(buf, "%s TRUNCATED", pp->name);
-        else
-                sprintf(buf, "%s %u.%u.%u.%u->%u.%u.%u.%u",
-                        pp->name, NIPQUAD(ih->saddr),
-                        NIPQUAD(ih->daddr));
-
-        printk(KERN_DEBUG "IPVS: %s: %s\n", msg, buf);
-}
-
-
-static void esp_init(struct ip_vs_protocol *pp)
-{
-        /* nothing to do now */
-}
-
-
-static void esp_exit(struct ip_vs_protocol *pp)
-{
-        /* nothing to do now */
-}
-
-
-struct ip_vs_protocol ip_vs_protocol_esp = {
-        .name =                 "ESP",
-        .protocol =             IPPROTO_ESP,
-        .num_states =           1,
-        .dont_defrag =          1,
-        .init =                 esp_init,
-        .exit =                 esp_exit,
-        .conn_schedule =        esp_conn_schedule,
-        .conn_in_get =          esp_conn_in_get,
-        .conn_out_get =         esp_conn_out_get,
-        .snat_handler =         NULL,
-        .dnat_handler =         NULL,
-        .csum_check =           NULL,
-        .state_transition =     NULL,
-        .register_app =         NULL,
-        .unregister_app =       NULL,
-        .app_conn_bind =        NULL,
-        .debug_packet =         esp_debug_packet,
-        .timeout_change =       NULL,           /* ISAKMP */
-};
diff --git a/net/ipv4/ipvs/ip_vs_proto_tcp.c b/net/ipv4/ipvs/ip_vs_proto_tcp.c
index d0ea467986a0..dd4566ea2bff 100644
--- a/net/ipv4/ipvs/ip_vs_proto_tcp.c
+++ b/net/ipv4/ipvs/ip_vs_proto_tcp.c
@@ -18,6 +18,7 @@
 #include <linux/tcp.h>                  /* for tcphdr */
 #include <net/ip.h>
 #include <net/tcp.h>                    /* for csum_tcpudp_magic */
+#include <net/ip6_checksum.h>
 #include <linux/netfilter.h>
 #include <linux/netfilter_ipv4.h>
 
@@ -25,8 +26,9 @@
 
 
 static struct ip_vs_conn *
-tcp_conn_in_get(const struct sk_buff *skb, struct ip_vs_protocol *pp,
-                const struct iphdr *iph, unsigned int proto_off, int inverse)
+tcp_conn_in_get(int af, const struct sk_buff *skb, struct ip_vs_protocol *pp,
+                const struct ip_vs_iphdr *iph, unsigned int proto_off,
+                int inverse)
 {
         __be16 _ports[2], *pptr;
 
@@ -35,19 +37,20 @@ tcp_conn_in_get(const struct sk_buff *skb, struct ip_vs_protocol *pp,
                 return NULL;
 
         if (likely(!inverse)) {
-                return ip_vs_conn_in_get(iph->protocol,
-                                         iph->saddr, pptr[0],
-                                         iph->daddr, pptr[1]);
+                return ip_vs_conn_in_get(af, iph->protocol,
+                                         &iph->saddr, pptr[0],
+                                         &iph->daddr, pptr[1]);
         } else {
-                return ip_vs_conn_in_get(iph->protocol,
-                                         iph->daddr, pptr[1],
-                                         iph->saddr, pptr[0]);
+                return ip_vs_conn_in_get(af, iph->protocol,
+                                         &iph->daddr, pptr[1],
+                                         &iph->saddr, pptr[0]);
         }
 }
 
 static struct ip_vs_conn *
-tcp_conn_out_get(const struct sk_buff *skb, struct ip_vs_protocol *pp,
-                 const struct iphdr *iph, unsigned int proto_off, int inverse)
+tcp_conn_out_get(int af, const struct sk_buff *skb, struct ip_vs_protocol *pp,
+                 const struct ip_vs_iphdr *iph, unsigned int proto_off,
+                 int inverse)
 {
         __be16 _ports[2], *pptr;
 
@@ -56,34 +59,36 @@ tcp_conn_out_get(const struct sk_buff *skb, struct ip_vs_protocol *pp,
                 return NULL;
 
         if (likely(!inverse)) {
-                return ip_vs_conn_out_get(iph->protocol,
-                                          iph->saddr, pptr[0],
-                                          iph->daddr, pptr[1]);
+                return ip_vs_conn_out_get(af, iph->protocol,
+                                          &iph->saddr, pptr[0],
+                                          &iph->daddr, pptr[1]);
         } else {
-                return ip_vs_conn_out_get(iph->protocol,
-                                          iph->daddr, pptr[1],
-                                          iph->saddr, pptr[0]);
+                return ip_vs_conn_out_get(af, iph->protocol,
+                                          &iph->daddr, pptr[1],
+                                          &iph->saddr, pptr[0]);
         }
 }
 
 
 static int
-tcp_conn_schedule(struct sk_buff *skb,
-                  struct ip_vs_protocol *pp,
+tcp_conn_schedule(int af, struct sk_buff *skb, struct ip_vs_protocol *pp,
                   int *verdict, struct ip_vs_conn **cpp)
 {
         struct ip_vs_service *svc;
         struct tcphdr _tcph, *th;
+        struct ip_vs_iphdr iph;
 
-        th = skb_header_pointer(skb, ip_hdrlen(skb), sizeof(_tcph), &_tcph);
+        ip_vs_fill_iphdr(af, skb_network_header(skb), &iph);
+
+        th = skb_header_pointer(skb, iph.len, sizeof(_tcph), &_tcph);
         if (th == NULL) {
                 *verdict = NF_DROP;
                 return 0;
         }
 
         if (th->syn &&
-            (svc = ip_vs_service_get(skb->mark, ip_hdr(skb)->protocol,
-                                     ip_hdr(skb)->daddr, th->dest))) {
+            (svc = ip_vs_service_get(af, skb->mark, iph.protocol, &iph.daddr,
+                                     th->dest))) {
                 if (ip_vs_todrop()) {
                         /*
                          * It seems that we are very loaded.
@@ -110,22 +115,62 @@ tcp_conn_schedule(struct sk_buff *skb,
 
 
 static inline void
-tcp_fast_csum_update(struct tcphdr *tcph, __be32 oldip, __be32 newip,
+tcp_fast_csum_update(int af, struct tcphdr *tcph,
+                     const union nf_inet_addr *oldip,
+                     const union nf_inet_addr *newip,
                      __be16 oldport, __be16 newport)
 {
+#ifdef CONFIG_IP_VS_IPV6
+        if (af == AF_INET6)
+                tcph->check =
+                        csum_fold(ip_vs_check_diff16(oldip->ip6, newip->ip6,
+                                         ip_vs_check_diff2(oldport, newport,
+                                                ~csum_unfold(tcph->check))));
+        else
+#endif
         tcph->check =
-                csum_fold(ip_vs_check_diff4(oldip, newip,
+                csum_fold(ip_vs_check_diff4(oldip->ip, newip->ip,
                                  ip_vs_check_diff2(oldport, newport,
                                                 ~csum_unfold(tcph->check))));
 }
 
 
+static inline void
+tcp_partial_csum_update(int af, struct tcphdr *tcph,
+                     const union nf_inet_addr *oldip,
+                     const union nf_inet_addr *newip,
+                     __be16 oldlen, __be16 newlen)
+{
+#ifdef CONFIG_IP_VS_IPV6
+        if (af == AF_INET6)
+                tcph->check =
+                        csum_fold(ip_vs_check_diff16(oldip->ip6, newip->ip6,
+                                         ip_vs_check_diff2(oldlen, newlen,
+                                                ~csum_unfold(tcph->check))));
+        else
+#endif
+        tcph->check =
+                csum_fold(ip_vs_check_diff4(oldip->ip, newip->ip,
+                                ip_vs_check_diff2(oldlen, newlen,
+                                                ~csum_unfold(tcph->check))));
+}
+
+
 static int
 tcp_snat_handler(struct sk_buff *skb,
                  struct ip_vs_protocol *pp, struct ip_vs_conn *cp)
 {
         struct tcphdr *tcph;
-        const unsigned int tcphoff = ip_hdrlen(skb);
+        unsigned int tcphoff;
+        int oldlen;
+
+#ifdef CONFIG_IP_VS_IPV6
+        if (cp->af == AF_INET6)
+                tcphoff = sizeof(struct ipv6hdr);
+        else
+#endif
+                tcphoff = ip_hdrlen(skb);
+        oldlen = skb->len - tcphoff;
 
         /* csum_check requires unshared skb */
         if (!skb_make_writable(skb, tcphoff+sizeof(*tcph)))
@@ -133,7 +178,7 @@ tcp_snat_handler(struct sk_buff *skb,
 
         if (unlikely(cp->app != NULL)) {
                 /* Some checks before mangling */
-                if (pp->csum_check && !pp->csum_check(skb, pp))
+                if (pp->csum_check && !pp->csum_check(cp->af, skb, pp))
                         return 0;
 
                 /* Call application helper if needed */
@@ -141,13 +186,17 @@ tcp_snat_handler(struct sk_buff *skb,
                         return 0;
         }
 
-        tcph = (void *)ip_hdr(skb) + tcphoff;
+        tcph = (void *)skb_network_header(skb) + tcphoff;
         tcph->source = cp->vport;
 
         /* Adjust TCP checksums */
-        if (!cp->app) {
+        if (skb->ip_summed == CHECKSUM_PARTIAL) {
+                tcp_partial_csum_update(cp->af, tcph, &cp->daddr, &cp->vaddr,
+                                        htonl(oldlen),
+                                        htonl(skb->len - tcphoff));
+        } else if (!cp->app) {
                 /* Only port and addr are changed, do fast csum update */
-                tcp_fast_csum_update(tcph, cp->daddr, cp->vaddr,
+                tcp_fast_csum_update(cp->af, tcph, &cp->daddr, &cp->vaddr,
                                      cp->dport, cp->vport);
                 if (skb->ip_summed == CHECKSUM_COMPLETE)
                         skb->ip_summed = CHECKSUM_NONE;
@@ -155,9 +204,20 @@ tcp_snat_handler(struct sk_buff *skb,
                 /* full checksum calculation */
                 tcph->check = 0;
                 skb->csum = skb_checksum(skb, tcphoff, skb->len - tcphoff, 0);
-                tcph->check = csum_tcpudp_magic(cp->vaddr, cp->caddr,
-                                                skb->len - tcphoff,
-                                                cp->protocol, skb->csum);
+#ifdef CONFIG_IP_VS_IPV6
+                if (cp->af == AF_INET6)
+                        tcph->check = csum_ipv6_magic(&cp->vaddr.in6,
+                                                      &cp->caddr.in6,
+                                                      skb->len - tcphoff,
+                                                      cp->protocol, skb->csum);
+                else
+#endif
+                        tcph->check = csum_tcpudp_magic(cp->vaddr.ip,
+                                                        cp->caddr.ip,
+                                                        skb->len - tcphoff,
+                                                        cp->protocol,
+                                                        skb->csum);
+
                 IP_VS_DBG(11, "O-pkt: %s O-csum=%d (+%zd)\n",
                           pp->name, tcph->check,
                           (char*)&(tcph->check) - (char*)tcph);
@@ -171,7 +231,16 @@ tcp_dnat_handler(struct sk_buff *skb,
                  struct ip_vs_protocol *pp, struct ip_vs_conn *cp)
 {
         struct tcphdr *tcph;
-        const unsigned int tcphoff = ip_hdrlen(skb);
+        unsigned int tcphoff;
+        int oldlen;
+
+#ifdef CONFIG_IP_VS_IPV6
+        if (cp->af == AF_INET6)
+                tcphoff = sizeof(struct ipv6hdr);
+        else
+#endif
+                tcphoff = ip_hdrlen(skb);
+        oldlen = skb->len - tcphoff;
 
         /* csum_check requires unshared skb */
         if (!skb_make_writable(skb, tcphoff+sizeof(*tcph)))
@@ -179,7 +248,7 @@ tcp_dnat_handler(struct sk_buff *skb,
 
         if (unlikely(cp->app != NULL)) {
                 /* Some checks before mangling */
-                if (pp->csum_check && !pp->csum_check(skb, pp))
+                if (pp->csum_check && !pp->csum_check(cp->af, skb, pp))
                         return 0;
 
                 /*
@@ -190,15 +259,19 @@ tcp_dnat_handler(struct sk_buff *skb,
                         return 0;
         }
 
-        tcph = (void *)ip_hdr(skb) + tcphoff;
+        tcph = (void *)skb_network_header(skb) + tcphoff;
         tcph->dest = cp->dport;
 
         /*
          *      Adjust TCP checksums
          */
-        if (!cp->app) {
+        if (skb->ip_summed == CHECKSUM_PARTIAL) {
+                tcp_partial_csum_update(cp->af, tcph, &cp->daddr, &cp->vaddr,
+                                        htonl(oldlen),
+                                        htonl(skb->len - tcphoff));
+        } else if (!cp->app) {
                 /* Only port and addr are changed, do fast csum update */
-                tcp_fast_csum_update(tcph, cp->vaddr, cp->daddr,
+                tcp_fast_csum_update(cp->af, tcph, &cp->vaddr, &cp->daddr,
                                      cp->vport, cp->dport);
                 if (skb->ip_summed == CHECKSUM_COMPLETE)
                         skb->ip_summed = CHECKSUM_NONE;
@@ -206,9 +279,19 @@ tcp_dnat_handler(struct sk_buff *skb,
                 /* full checksum calculation */
                 tcph->check = 0;
                 skb->csum = skb_checksum(skb, tcphoff, skb->len - tcphoff, 0);
-                tcph->check = csum_tcpudp_magic(cp->caddr, cp->daddr,
-                                                skb->len - tcphoff,
-                                                cp->protocol, skb->csum);
+#ifdef CONFIG_IP_VS_IPV6
+                if (cp->af == AF_INET6)
+                        tcph->check = csum_ipv6_magic(&cp->caddr.in6,
+                                                      &cp->daddr.in6,
+                                                      skb->len - tcphoff,
+                                                      cp->protocol, skb->csum);
+                else
+#endif
+                        tcph->check = csum_tcpudp_magic(cp->caddr.ip,
+                                                        cp->daddr.ip,
+                                                        skb->len - tcphoff,
+                                                        cp->protocol,
+                                                        skb->csum);
                 skb->ip_summed = CHECKSUM_UNNECESSARY;
         }
         return 1;
@@ -216,21 +299,43 @@ tcp_dnat_handler(struct sk_buff *skb,
 
 
 static int
-tcp_csum_check(struct sk_buff *skb, struct ip_vs_protocol *pp)
+tcp_csum_check(int af, struct sk_buff *skb, struct ip_vs_protocol *pp)
 {
-        const unsigned int tcphoff = ip_hdrlen(skb);
+        unsigned int tcphoff;
+
+#ifdef CONFIG_IP_VS_IPV6
+        if (af == AF_INET6)
+                tcphoff = sizeof(struct ipv6hdr);
+        else
+#endif
+                tcphoff = ip_hdrlen(skb);
 
         switch (skb->ip_summed) {
         case CHECKSUM_NONE:
                 skb->csum = skb_checksum(skb, tcphoff, skb->len - tcphoff, 0);
         case CHECKSUM_COMPLETE:
-                if (csum_tcpudp_magic(ip_hdr(skb)->saddr, ip_hdr(skb)->daddr,
-                                      skb->len - tcphoff,
-                                      ip_hdr(skb)->protocol, skb->csum)) {
-                        IP_VS_DBG_RL_PKT(0, pp, skb, 0,
-                                         "Failed checksum for");
-                        return 0;
-                }
+#ifdef CONFIG_IP_VS_IPV6
+                if (af == AF_INET6) {
+                        if (csum_ipv6_magic(&ipv6_hdr(skb)->saddr,
+                                            &ipv6_hdr(skb)->daddr,
+                                            skb->len - tcphoff,
+                                            ipv6_hdr(skb)->nexthdr,
+                                            skb->csum)) {
+                                IP_VS_DBG_RL_PKT(0, pp, skb, 0,
+                                                 "Failed checksum for");
+                                return 0;
+                        }
+                } else
+#endif
+                        if (csum_tcpudp_magic(ip_hdr(skb)->saddr,
+                                              ip_hdr(skb)->daddr,
+                                              skb->len - tcphoff,
+                                              ip_hdr(skb)->protocol,
+                                              skb->csum)) {
+                                IP_VS_DBG_RL_PKT(0, pp, skb, 0,
+                                                 "Failed checksum for");
+                                return 0;
+                        }
                 break;
         default:
                 /* No need to checksum. */
@@ -419,19 +524,23 @@ set_tcp_state(struct ip_vs_protocol *pp, struct ip_vs_conn *cp,
         if (new_state != cp->state) {
                 struct ip_vs_dest *dest = cp->dest;
 
-                IP_VS_DBG(8, "%s %s [%c%c%c%c] %u.%u.%u.%u:%d->"
-                          "%u.%u.%u.%u:%d state: %s->%s conn->refcnt:%d\n",
-                          pp->name,
-                          (state_off==TCP_DIR_OUTPUT)?"output ":"input ",
-                          th->syn? 'S' : '.',
-                          th->fin? 'F' : '.',
-                          th->ack? 'A' : '.',
-                          th->rst? 'R' : '.',
-                          NIPQUAD(cp->daddr), ntohs(cp->dport),
-                          NIPQUAD(cp->caddr), ntohs(cp->cport),
-                          tcp_state_name(cp->state),
-                          tcp_state_name(new_state),
-                          atomic_read(&cp->refcnt));
+                IP_VS_DBG_BUF(8, "%s %s [%c%c%c%c] %s:%d->"
+                              "%s:%d state: %s->%s conn->refcnt:%d\n",
+                              pp->name,
+                              ((state_off == TCP_DIR_OUTPUT) ?
+                               "output " : "input "),
+                              th->syn ? 'S' : '.',
+                              th->fin ? 'F' : '.',
+                              th->ack ? 'A' : '.',
+                              th->rst ? 'R' : '.',
+                              IP_VS_DBG_ADDR(cp->af, &cp->daddr),
+                              ntohs(cp->dport),
+                              IP_VS_DBG_ADDR(cp->af, &cp->caddr),
+                              ntohs(cp->cport),
+                              tcp_state_name(cp->state),
+                              tcp_state_name(new_state),
+                              atomic_read(&cp->refcnt));
+
                 if (dest) {
                         if (!(cp->flags & IP_VS_CONN_F_INACTIVE) &&
                             (new_state != IP_VS_TCP_S_ESTABLISHED)) {
@@ -461,7 +570,13 @@ tcp_state_transition(struct ip_vs_conn *cp, int direction,
 {
         struct tcphdr _tcph, *th;
 
-        th = skb_header_pointer(skb, ip_hdrlen(skb), sizeof(_tcph), &_tcph);
+#ifdef CONFIG_IP_VS_IPV6
+        int ihl = cp->af == AF_INET ? ip_hdrlen(skb) : sizeof(struct ipv6hdr);
+#else
+        int ihl = ip_hdrlen(skb);
+#endif
+
+        th = skb_header_pointer(skb, ihl, sizeof(_tcph), &_tcph);
         if (th == NULL)
                 return 0;
 
@@ -546,12 +661,15 @@ tcp_app_conn_bind(struct ip_vs_conn *cp)
                                 break;
                         spin_unlock(&tcp_app_lock);
 
-                        IP_VS_DBG(9, "%s: Binding conn %u.%u.%u.%u:%u->"
-                                  "%u.%u.%u.%u:%u to app %s on port %u\n",
-                                  __func__,
-                                  NIPQUAD(cp->caddr), ntohs(cp->cport),
-                                  NIPQUAD(cp->vaddr), ntohs(cp->vport),
-                                  inc->name, ntohs(inc->port));
+                        IP_VS_DBG_BUF(9, "%s: Binding conn %s:%u->"
+                                      "%s:%u to app %s on port %u\n",
+                                      __func__,
+                                      IP_VS_DBG_ADDR(cp->af, &cp->caddr),
+                                      ntohs(cp->cport),
+                                      IP_VS_DBG_ADDR(cp->af, &cp->vaddr),
+                                      ntohs(cp->vport),
+                                      inc->name, ntohs(inc->port));
+
                         cp->app = inc;
                         if (inc->init_conn)
                                 result = inc->init_conn(inc, cp);
diff --git a/net/ipv4/ipvs/ip_vs_proto_udp.c b/net/ipv4/ipvs/ip_vs_proto_udp.c
index c6be5d56823f..6eb6039d6343 100644
--- a/net/ipv4/ipvs/ip_vs_proto_udp.c
+++ b/net/ipv4/ipvs/ip_vs_proto_udp.c
@@ -22,10 +22,12 @@
 
 #include <net/ip_vs.h>
 #include <net/ip.h>
+#include <net/ip6_checksum.h>
 
 static struct ip_vs_conn *
-udp_conn_in_get(const struct sk_buff *skb, struct ip_vs_protocol *pp,
-                const struct iphdr *iph, unsigned int proto_off, int inverse)
+udp_conn_in_get(int af, const struct sk_buff *skb, struct ip_vs_protocol *pp,
+                const struct ip_vs_iphdr *iph, unsigned int proto_off,
+                int inverse)
 {
         struct ip_vs_conn *cp;
         __be16 _ports[2], *pptr;
@@ -35,13 +37,13 @@ udp_conn_in_get(const struct sk_buff *skb, struct ip_vs_protocol *pp,
                 return NULL;
 
         if (likely(!inverse)) {
-                cp = ip_vs_conn_in_get(iph->protocol,
-                                       iph->saddr, pptr[0],
-                                       iph->daddr, pptr[1]);
+                cp = ip_vs_conn_in_get(af, iph->protocol,
+                                       &iph->saddr, pptr[0],
+                                       &iph->daddr, pptr[1]);
         } else {
-                cp = ip_vs_conn_in_get(iph->protocol,
-                                       iph->daddr, pptr[1],
-                                       iph->saddr, pptr[0]);
+                cp = ip_vs_conn_in_get(af, iph->protocol,
+                                       &iph->daddr, pptr[1],
+                                       &iph->saddr, pptr[0]);
         }
 
         return cp;
@@ -49,25 +51,25 @@ udp_conn_in_get(const struct sk_buff *skb, struct ip_vs_protocol *pp,
 
 
 static struct ip_vs_conn *
-udp_conn_out_get(const struct sk_buff *skb, struct ip_vs_protocol *pp,
-                 const struct iphdr *iph, unsigned int proto_off, int inverse)
+udp_conn_out_get(int af, const struct sk_buff *skb, struct ip_vs_protocol *pp,
+                 const struct ip_vs_iphdr *iph, unsigned int proto_off,
+                 int inverse)
 {
         struct ip_vs_conn *cp;
         __be16 _ports[2], *pptr;
 
-        pptr = skb_header_pointer(skb, ip_hdrlen(skb),
-                                  sizeof(_ports), _ports);
+        pptr = skb_header_pointer(skb, proto_off, sizeof(_ports), _ports);
         if (pptr == NULL)
                 return NULL;
 
         if (likely(!inverse)) {
-                cp = ip_vs_conn_out_get(iph->protocol,
-                                        iph->saddr, pptr[0],
-                                        iph->daddr, pptr[1]);
+                cp = ip_vs_conn_out_get(af, iph->protocol,
+                                        &iph->saddr, pptr[0],
+                                        &iph->daddr, pptr[1]);
         } else {
-                cp = ip_vs_conn_out_get(iph->protocol,
-                                        iph->daddr, pptr[1],
-                                        iph->saddr, pptr[0]);
+                cp = ip_vs_conn_out_get(af, iph->protocol,
+                                        &iph->daddr, pptr[1],
+                                        &iph->saddr, pptr[0]);
         }
 
         return cp;
@@ -75,21 +77,24 @@ udp_conn_out_get(const struct sk_buff *skb, struct ip_vs_protocol *pp,
 
 
 static int
-udp_conn_schedule(struct sk_buff *skb, struct ip_vs_protocol *pp,
+udp_conn_schedule(int af, struct sk_buff *skb, struct ip_vs_protocol *pp,
                   int *verdict, struct ip_vs_conn **cpp)
 {
         struct ip_vs_service *svc;
         struct udphdr _udph, *uh;
+        struct ip_vs_iphdr iph;
+
+        ip_vs_fill_iphdr(af, skb_network_header(skb), &iph);
 
-        uh = skb_header_pointer(skb, ip_hdrlen(skb),
-                                sizeof(_udph), &_udph);
+        uh = skb_header_pointer(skb, iph.len, sizeof(_udph), &_udph);
         if (uh == NULL) {
                 *verdict = NF_DROP;
                 return 0;
         }
 
-        if ((svc = ip_vs_service_get(skb->mark, ip_hdr(skb)->protocol,
-                                     ip_hdr(skb)->daddr, uh->dest))) {
+        svc = ip_vs_service_get(af, skb->mark, iph.protocol,
+                                &iph.daddr, uh->dest);
+        if (svc) {
                 if (ip_vs_todrop()) {
                         /*
                          * It seems that we are very loaded.
@@ -116,23 +121,63 @@ udp_conn_schedule(struct sk_buff *skb, struct ip_vs_protocol *pp,
 
 
 static inline void
-udp_fast_csum_update(struct udphdr *uhdr, __be32 oldip, __be32 newip,
+udp_fast_csum_update(int af, struct udphdr *uhdr,
+                     const union nf_inet_addr *oldip,
+                     const union nf_inet_addr *newip,
                      __be16 oldport, __be16 newport)
 {
-        uhdr->check =
-                csum_fold(ip_vs_check_diff4(oldip, newip,
-                                 ip_vs_check_diff2(oldport, newport,
-                                        ~csum_unfold(uhdr->check))));
+#ifdef CONFIG_IP_VS_IPV6
+        if (af == AF_INET6)
+                uhdr->check =
+                        csum_fold(ip_vs_check_diff16(oldip->ip6, newip->ip6,
+                                         ip_vs_check_diff2(oldport, newport,
+                                                ~csum_unfold(uhdr->check))));
+        else
+#endif
+                uhdr->check =
+                        csum_fold(ip_vs_check_diff4(oldip->ip, newip->ip,
+                                         ip_vs_check_diff2(oldport, newport,
+                                                ~csum_unfold(uhdr->check))));
         if (!uhdr->check)
                 uhdr->check = CSUM_MANGLED_0;
 }
 
+static inline void
+udp_partial_csum_update(int af, struct udphdr *uhdr,
+                     const union nf_inet_addr *oldip,
+                     const union nf_inet_addr *newip,
+                     __be16 oldlen, __be16 newlen)
+{
+#ifdef CONFIG_IP_VS_IPV6
+        if (af == AF_INET6)
+                uhdr->check =
+                        csum_fold(ip_vs_check_diff16(oldip->ip6, newip->ip6,
+                                         ip_vs_check_diff2(oldlen, newlen,
+                                                ~csum_unfold(uhdr->check))));
+        else
+#endif
+        uhdr->check =
+                csum_fold(ip_vs_check_diff4(oldip->ip, newip->ip,
+                                ip_vs_check_diff2(oldlen, newlen,
+                                                ~csum_unfold(uhdr->check))));
+}
+
+
 static int
 udp_snat_handler(struct sk_buff *skb,
                  struct ip_vs_protocol *pp, struct ip_vs_conn *cp)
 {
         struct udphdr *udph;
-        const unsigned int udphoff = ip_hdrlen(skb);
+        unsigned int udphoff;
+        int oldlen;
+
+#ifdef CONFIG_IP_VS_IPV6
+        if (cp->af == AF_INET6)
+                udphoff = sizeof(struct ipv6hdr);
+        else
+#endif
+                udphoff = ip_hdrlen(skb);
+        oldlen = skb->len - udphoff;
 
         /* csum_check requires unshared skb */
         if (!skb_make_writable(skb, udphoff+sizeof(*udph)))
@@ -140,7 +185,7 @@ udp_snat_handler(struct sk_buff *skb,
 
         if (unlikely(cp->app != NULL)) {
                 /* Some checks before mangling */
-                if (pp->csum_check && !pp->csum_check(skb, pp))
+                if (pp->csum_check && !pp->csum_check(cp->af, skb, pp))
                         return 0;
 
                 /*
@@ -150,15 +195,19 @@ udp_snat_handler(struct sk_buff *skb,
                         return 0;
         }
 
-        udph = (void *)ip_hdr(skb) + udphoff;
+        udph = (void *)skb_network_header(skb) + udphoff;
         udph->source = cp->vport;
 
         /*
          *      Adjust UDP checksums
          */
-        if (!cp->app && (udph->check != 0)) {
+        if (skb->ip_summed == CHECKSUM_PARTIAL) {
+                udp_partial_csum_update(cp->af, udph, &cp->daddr, &cp->vaddr,
+                                        htonl(oldlen),
+                                        htonl(skb->len - udphoff));
+        } else if (!cp->app && (udph->check != 0)) {
                 /* Only port and addr are changed, do fast csum update */
-                udp_fast_csum_update(udph, cp->daddr, cp->vaddr,
+                udp_fast_csum_update(cp->af, udph, &cp->daddr, &cp->vaddr,
                                      cp->dport, cp->vport);
                 if (skb->ip_summed == CHECKSUM_COMPLETE)
                         skb->ip_summed = CHECKSUM_NONE;
@@ -166,9 +215,19 @@ udp_snat_handler(struct sk_buff *skb,
                 /* full checksum calculation */
                 udph->check = 0;
                 skb->csum = skb_checksum(skb, udphoff, skb->len - udphoff, 0);
-                udph->check = csum_tcpudp_magic(cp->vaddr, cp->caddr,
-                                                skb->len - udphoff,
-                                                cp->protocol, skb->csum);
+#ifdef CONFIG_IP_VS_IPV6
+                if (cp->af == AF_INET6)
+                        udph->check = csum_ipv6_magic(&cp->vaddr.in6,
+                                                      &cp->caddr.in6,
+                                                      skb->len - udphoff,
+                                                      cp->protocol, skb->csum);
+                else
+#endif
+                        udph->check = csum_tcpudp_magic(cp->vaddr.ip,
+                                                        cp->caddr.ip,
+                                                        skb->len - udphoff,
+                                                        cp->protocol,
+                                                        skb->csum);
                 if (udph->check == 0)
                         udph->check = CSUM_MANGLED_0;
                 IP_VS_DBG(11, "O-pkt: %s O-csum=%d (+%zd)\n",
@@ -184,7 +243,16 @@ udp_dnat_handler(struct sk_buff *skb,
                  struct ip_vs_protocol *pp, struct ip_vs_conn *cp)
 {
         struct udphdr *udph;
-        unsigned int udphoff = ip_hdrlen(skb);
+        unsigned int udphoff;
+        int oldlen;
+
+#ifdef CONFIG_IP_VS_IPV6
+        if (cp->af == AF_INET6)
+                udphoff = sizeof(struct ipv6hdr);
+        else
+#endif
+                udphoff = ip_hdrlen(skb);
+        oldlen = skb->len - udphoff;
 
         /* csum_check requires unshared skb */
         if (!skb_make_writable(skb, udphoff+sizeof(*udph)))
@@ -192,7 +260,7 @@ udp_dnat_handler(struct sk_buff *skb,
 
         if (unlikely(cp->app != NULL)) {
                 /* Some checks before mangling */
-                if (pp->csum_check && !pp->csum_check(skb, pp))
+                if (pp->csum_check && !pp->csum_check(cp->af, skb, pp))
                         return 0;
 
                 /*
@@ -203,15 +271,19 @@ udp_dnat_handler(struct sk_buff *skb,
                         return 0;
         }
 
-        udph = (void *)ip_hdr(skb) + udphoff;
+        udph = (void *)skb_network_header(skb) + udphoff;
         udph->dest = cp->dport;
 
         /*
          *      Adjust UDP checksums
          */
-        if (!cp->app && (udph->check != 0)) {
+        if (skb->ip_summed == CHECKSUM_PARTIAL) {
+                udp_partial_csum_update(cp->af, udph, &cp->daddr, &cp->vaddr,
+                                        htonl(oldlen),
+                                        htonl(skb->len - udphoff));
+        } else if (!cp->app && (udph->check != 0)) {
                 /* Only port and addr are changed, do fast csum update */
-                udp_fast_csum_update(udph, cp->vaddr, cp->daddr,
+                udp_fast_csum_update(cp->af, udph, &cp->vaddr, &cp->daddr,
                                      cp->vport, cp->dport);
                 if (skb->ip_summed == CHECKSUM_COMPLETE)
                         skb->ip_summed = CHECKSUM_NONE;
@@ -219,9 +291,19 @@ udp_dnat_handler(struct sk_buff *skb,
                 /* full checksum calculation */
                 udph->check = 0;
                 skb->csum = skb_checksum(skb, udphoff, skb->len - udphoff, 0);
-                udph->check = csum_tcpudp_magic(cp->caddr, cp->daddr,
-                                                skb->len - udphoff,
-                                                cp->protocol, skb->csum);
+#ifdef CONFIG_IP_VS_IPV6
+                if (cp->af == AF_INET6)
+                        udph->check = csum_ipv6_magic(&cp->caddr.in6,
+                                                      &cp->daddr.in6,
+                                                      skb->len - udphoff,
+                                                      cp->protocol, skb->csum);
+                else
+#endif
+                        udph->check = csum_tcpudp_magic(cp->caddr.ip,
+                                                        cp->daddr.ip,
+                                                        skb->len - udphoff,
+                                                        cp->protocol,
+                                                        skb->csum);
                 if (udph->check == 0)
                         udph->check = CSUM_MANGLED_0;
                 skb->ip_summed = CHECKSUM_UNNECESSARY;
@@ -231,10 +313,17 @@ udp_dnat_handler(struct sk_buff *skb,
 
 
 static int
-udp_csum_check(struct sk_buff *skb, struct ip_vs_protocol *pp)
+udp_csum_check(int af, struct sk_buff *skb, struct ip_vs_protocol *pp)
 {
         struct udphdr _udph, *uh;
-        const unsigned int udphoff = ip_hdrlen(skb);
+        unsigned int udphoff;
+
+#ifdef CONFIG_IP_VS_IPV6
+        if (af == AF_INET6)
+                udphoff = sizeof(struct ipv6hdr);
+        else
+#endif
+                udphoff = ip_hdrlen(skb);
 
         uh = skb_header_pointer(skb, udphoff, sizeof(_udph), &_udph);
         if (uh == NULL)
@@ -246,15 +335,28 @@ udp_csum_check(struct sk_buff *skb, struct ip_vs_protocol *pp)
                         skb->csum = skb_checksum(skb, udphoff,
                                                  skb->len - udphoff, 0);
                 case CHECKSUM_COMPLETE:
-                        if (csum_tcpudp_magic(ip_hdr(skb)->saddr,
-                                              ip_hdr(skb)->daddr,
-                                              skb->len - udphoff,
-                                              ip_hdr(skb)->protocol,
-                                              skb->csum)) {
-                                IP_VS_DBG_RL_PKT(0, pp, skb, 0,
-                                                 "Failed checksum for");
-                                return 0;
-                        }
+#ifdef CONFIG_IP_VS_IPV6
+                        if (af == AF_INET6) {
+                                if (csum_ipv6_magic(&ipv6_hdr(skb)->saddr,
+                                                    &ipv6_hdr(skb)->daddr,
+                                                    skb->len - udphoff,
+                                                    ipv6_hdr(skb)->nexthdr,
+                                                    skb->csum)) {
+                                        IP_VS_DBG_RL_PKT(0, pp, skb, 0,
+                                                         "Failed checksum for");
+                                        return 0;
+                                }
+                        } else
+#endif
+                                if (csum_tcpudp_magic(ip_hdr(skb)->saddr,
+                                                      ip_hdr(skb)->daddr,
+                                                      skb->len - udphoff,
+                                                      ip_hdr(skb)->protocol,
+                                                      skb->csum)) {
+                                        IP_VS_DBG_RL_PKT(0, pp, skb, 0,
+                                                         "Failed checksum for");
+                                        return 0;
+                                }
                         break;
                 default:
                         /* No need to checksum. */
@@ -340,12 +442,15 @@ static int udp_app_conn_bind(struct ip_vs_conn *cp)
                                 break;
                         spin_unlock(&udp_app_lock);
 
-                        IP_VS_DBG(9, "%s: Binding conn %u.%u.%u.%u:%u->"
-                                  "%u.%u.%u.%u:%u to app %s on port %u\n",
-                                  __func__,
-                                  NIPQUAD(cp->caddr), ntohs(cp->cport),
-                                  NIPQUAD(cp->vaddr), ntohs(cp->vport),
-                                  inc->name, ntohs(inc->port));
+                        IP_VS_DBG_BUF(9, "%s: Binding conn %s:%u->"
+                                      "%s:%u to app %s on port %u\n",
+                                      __func__,
+                                      IP_VS_DBG_ADDR(cp->af, &cp->caddr),
+                                      ntohs(cp->cport),
+                                      IP_VS_DBG_ADDR(cp->af, &cp->vaddr),
+                                      ntohs(cp->vport),
+                                      inc->name, ntohs(inc->port));
+
                         cp->app = inc;
                         if (inc->init_conn)
                                 result = inc->init_conn(inc, cp);
diff --git a/net/ipv4/ipvs/ip_vs_rr.c b/net/ipv4/ipvs/ip_vs_rr.c
index 358110d17e59..a22195f68ac4 100644
--- a/net/ipv4/ipvs/ip_vs_rr.c
+++ b/net/ipv4/ipvs/ip_vs_rr.c
@@ -32,12 +32,6 @@ static int ip_vs_rr_init_svc(struct ip_vs_service *svc)
 }
 
 
-static int ip_vs_rr_done_svc(struct ip_vs_service *svc)
-{
-        return 0;
-}
-
-
 static int ip_vs_rr_update_svc(struct ip_vs_service *svc)
 {
         svc->sched_data = &svc->destinations;
@@ -80,11 +74,11 @@ ip_vs_rr_schedule(struct ip_vs_service *svc, const struct sk_buff *skb)
   out:
         svc->sched_data = q;
         write_unlock(&svc->sched_lock);
-        IP_VS_DBG(6, "RR: server %u.%u.%u.%u:%u "
-                  "activeconns %d refcnt %d weight %d\n",
-                  NIPQUAD(dest->addr), ntohs(dest->port),
-                  atomic_read(&dest->activeconns),
-                  atomic_read(&dest->refcnt), atomic_read(&dest->weight));
+        IP_VS_DBG_BUF(6, "RR: server %s:%u "
+                      "activeconns %d refcnt %d weight %d\n",
+                      IP_VS_DBG_ADDR(svc->af, &dest->addr), ntohs(dest->port),
+                      atomic_read(&dest->activeconns),
+                      atomic_read(&dest->refcnt), atomic_read(&dest->weight));
 
         return dest;
 }
@@ -95,8 +89,10 @@ static struct ip_vs_scheduler ip_vs_rr_scheduler = {
         .refcnt =               ATOMIC_INIT(0),
         .module =               THIS_MODULE,
         .n_list =               LIST_HEAD_INIT(ip_vs_rr_scheduler.n_list),
+#ifdef CONFIG_IP_VS_IPV6
+        .supports_ipv6 =        1,
+#endif
         .init_service =         ip_vs_rr_init_svc,
-        .done_service =         ip_vs_rr_done_svc,
         .update_service =       ip_vs_rr_update_svc,
         .schedule =             ip_vs_rr_schedule,
 };
diff --git a/net/ipv4/ipvs/ip_vs_sed.c b/net/ipv4/ipvs/ip_vs_sed.c
index 77663d84cbd1..7d2f22f04b83 100644
--- a/net/ipv4/ipvs/ip_vs_sed.c
+++ b/net/ipv4/ipvs/ip_vs_sed.c
@@ -41,27 +41,6 @@
 #include <net/ip_vs.h>
 
 
-static int
-ip_vs_sed_init_svc(struct ip_vs_service *svc)
-{
-        return 0;
-}
-
-
-static int
-ip_vs_sed_done_svc(struct ip_vs_service *svc)
-{
-        return 0;
-}
-
-
-static int
-ip_vs_sed_update_svc(struct ip_vs_service *svc)
-{
-        return 0;
-}
-
-
 static inline unsigned int
 ip_vs_sed_dest_overhead(struct ip_vs_dest *dest)
 {
@@ -122,12 +101,12 @@ ip_vs_sed_schedule(struct ip_vs_service *svc, const struct sk_buff *skb)
                 }
         }
 
-        IP_VS_DBG(6, "SED: server %u.%u.%u.%u:%u "
-                  "activeconns %d refcnt %d weight %d overhead %d\n",
-                  NIPQUAD(least->addr), ntohs(least->port),
-                  atomic_read(&least->activeconns),
-                  atomic_read(&least->refcnt),
-                  atomic_read(&least->weight), loh);
+        IP_VS_DBG_BUF(6, "SED: server %s:%u "
+                      "activeconns %d refcnt %d weight %d overhead %d\n",
+                      IP_VS_DBG_ADDR(svc->af, &least->addr), ntohs(least->port),
+                      atomic_read(&least->activeconns),
+                      atomic_read(&least->refcnt),
+                      atomic_read(&least->weight), loh);
 
         return least;
 }
@@ -139,9 +118,9 @@ static struct ip_vs_scheduler ip_vs_sed_scheduler =
         .refcnt =               ATOMIC_INIT(0),
         .module =               THIS_MODULE,
         .n_list =               LIST_HEAD_INIT(ip_vs_sed_scheduler.n_list),
-        .init_service =         ip_vs_sed_init_svc,
-        .done_service =         ip_vs_sed_done_svc,
-        .update_service =       ip_vs_sed_update_svc,
+#ifdef CONFIG_IP_VS_IPV6
+        .supports_ipv6 =        1,
+#endif
         .schedule =             ip_vs_sed_schedule,
 };
 
diff --git a/net/ipv4/ipvs/ip_vs_sh.c b/net/ipv4/ipvs/ip_vs_sh.c
index 7b979e228056..1d96de27fefd 100644
--- a/net/ipv4/ipvs/ip_vs_sh.c
+++ b/net/ipv4/ipvs/ip_vs_sh.c
@@ -215,7 +215,7 @@ ip_vs_sh_schedule(struct ip_vs_service *svc, const struct sk_buff *skb)
         IP_VS_DBG(6, "SH: source IP address %u.%u.%u.%u "
                   "--> server %u.%u.%u.%u:%d\n",
                   NIPQUAD(iph->saddr),
-                  NIPQUAD(dest->addr),
+                  NIPQUAD(dest->addr.ip),
                   ntohs(dest->port));
 
         return dest;
@@ -231,6 +231,9 @@ static struct ip_vs_scheduler ip_vs_sh_scheduler =
         .refcnt =               ATOMIC_INIT(0),
         .module =               THIS_MODULE,
         .n_list  =              LIST_HEAD_INIT(ip_vs_sh_scheduler.n_list),
+#ifdef CONFIG_IP_VS_IPV6
+        .supports_ipv6 =        0,
+#endif
         .init_service =         ip_vs_sh_init_svc,
         .done_service =         ip_vs_sh_done_svc,
         .update_service =       ip_vs_sh_update_svc,
diff --git a/net/ipv4/ipvs/ip_vs_sync.c b/net/ipv4/ipvs/ip_vs_sync.c
index a652da2c3200..28237a5f62e2 100644
--- a/net/ipv4/ipvs/ip_vs_sync.c
+++ b/net/ipv4/ipvs/ip_vs_sync.c
@@ -256,9 +256,9 @@ void ip_vs_sync_conn(struct ip_vs_conn *cp)
         s->cport = cp->cport;
         s->vport = cp->vport;
         s->dport = cp->dport;
-        s->caddr = cp->caddr;
-        s->vaddr = cp->vaddr;
-        s->daddr = cp->daddr;
+        s->caddr = cp->caddr.ip;
+        s->vaddr = cp->vaddr.ip;
+        s->daddr = cp->daddr.ip;
         s->flags = htons(cp->flags & ~IP_VS_CONN_F_HASHED);
         s->state = htons(cp->state);
         if (cp->flags & IP_VS_CONN_F_SEQ_MASK) {
@@ -366,21 +366,28 @@ static void ip_vs_process_message(const char *buffer, const size_t buflen)
                 }
 
                 if (!(flags & IP_VS_CONN_F_TEMPLATE))
-                        cp = ip_vs_conn_in_get(s->protocol,
-                                               s->caddr, s->cport,
-                                               s->vaddr, s->vport);
+                        cp = ip_vs_conn_in_get(AF_INET, s->protocol,
+                                               (union nf_inet_addr *)&s->caddr,
+                                               s->cport,
+                                               (union nf_inet_addr *)&s->vaddr,
+                                               s->vport);
                 else
-                        cp = ip_vs_ct_in_get(s->protocol,
-                                               s->caddr, s->cport,
-                                               s->vaddr, s->vport);
+                        cp = ip_vs_ct_in_get(AF_INET, s->protocol,
+                                             (union nf_inet_addr *)&s->caddr,
+                                             s->cport,
+                                             (union nf_inet_addr *)&s->vaddr,
+                                             s->vport);
                 if (!cp) {
                         /*
                          * Find the appropriate destination for the connection.
                          * If it is not found the connection will remain unbound
                          * but still handled.
                          */
-                        dest = ip_vs_find_dest(s->daddr, s->dport,
-                                               s->vaddr, s->vport,
+                        dest = ip_vs_find_dest(AF_INET,
+                                               (union nf_inet_addr *)&s->daddr,
+                                               s->dport,
+                                               (union nf_inet_addr *)&s->vaddr,
+                                               s->vport,
                                                s->protocol);
                         /*  Set the approprite ativity flag */
                         if (s->protocol == IPPROTO_TCP) {
@@ -389,10 +396,13 @@ static void ip_vs_process_message(const char *buffer, const size_t buflen)
                                 else
                                         flags &= ~IP_VS_CONN_F_INACTIVE;
                         }
-                        cp = ip_vs_conn_new(s->protocol,
-                                            s->caddr, s->cport,
-                                            s->vaddr, s->vport,
-                                            s->daddr, s->dport,
+                        cp = ip_vs_conn_new(AF_INET, s->protocol,
+                                            (union nf_inet_addr *)&s->caddr,
+                                            s->cport,
+                                            (union nf_inet_addr *)&s->vaddr,
+                                            s->vport,
+                                            (union nf_inet_addr *)&s->daddr,
+                                            s->dport,
                                             flags, dest);
                         if (dest)
                                 atomic_dec(&dest->refcnt);
diff --git a/net/ipv4/ipvs/ip_vs_wlc.c b/net/ipv4/ipvs/ip_vs_wlc.c
index 9b0ef86bb1f7..8c596e712599 100644
--- a/net/ipv4/ipvs/ip_vs_wlc.c
+++ b/net/ipv4/ipvs/ip_vs_wlc.c
@@ -25,27 +25,6 @@
 #include <net/ip_vs.h>
 
 
-static int
-ip_vs_wlc_init_svc(struct ip_vs_service *svc)
-{
-        return 0;
-}
-
-
-static int
-ip_vs_wlc_done_svc(struct ip_vs_service *svc)
-{
-        return 0;
-}
-
-
-static int
-ip_vs_wlc_update_svc(struct ip_vs_service *svc)
-{
-        return 0;
-}
-
-
 static inline unsigned int
 ip_vs_wlc_dest_overhead(struct ip_vs_dest *dest)
 {
@@ -110,12 +89,12 @@ ip_vs_wlc_schedule(struct ip_vs_service *svc, const struct sk_buff *skb)
                 }
         }
 
-        IP_VS_DBG(6, "WLC: server %u.%u.%u.%u:%u "
-                  "activeconns %d refcnt %d weight %d overhead %d\n",
-                  NIPQUAD(least->addr), ntohs(least->port),
-                  atomic_read(&least->activeconns),
-                  atomic_read(&least->refcnt),
-                  atomic_read(&least->weight), loh);
+        IP_VS_DBG_BUF(6, "WLC: server %s:%u "
+                      "activeconns %d refcnt %d weight %d overhead %d\n",
+                      IP_VS_DBG_ADDR(svc->af, &least->addr), ntohs(least->port),
+                      atomic_read(&least->activeconns),
+                      atomic_read(&least->refcnt),
+                      atomic_read(&least->weight), loh);
 
         return least;
 }
@@ -127,9 +106,9 @@ static struct ip_vs_scheduler ip_vs_wlc_scheduler =
         .refcnt =               ATOMIC_INIT(0),
         .module =               THIS_MODULE,
         .n_list =               LIST_HEAD_INIT(ip_vs_wlc_scheduler.n_list),
-        .init_service =         ip_vs_wlc_init_svc,
-        .done_service =         ip_vs_wlc_done_svc,
-        .update_service =       ip_vs_wlc_update_svc,
+#ifdef CONFIG_IP_VS_IPV6
+        .supports_ipv6 =        1,
+#endif
         .schedule =             ip_vs_wlc_schedule,
 };
 
diff --git a/net/ipv4/ipvs/ip_vs_wrr.c b/net/ipv4/ipvs/ip_vs_wrr.c
index 0d86a79b87b5..7ea92fed50bf 100644
--- a/net/ipv4/ipvs/ip_vs_wrr.c
+++ b/net/ipv4/ipvs/ip_vs_wrr.c
@@ -195,12 +195,12 @@ ip_vs_wrr_schedule(struct ip_vs_service *svc, const struct sk_buff *skb)
                 }
         }
 
-        IP_VS_DBG(6, "WRR: server %u.%u.%u.%u:%u "
-                  "activeconns %d refcnt %d weight %d\n",
-                  NIPQUAD(dest->addr), ntohs(dest->port),
-                  atomic_read(&dest->activeconns),
-                  atomic_read(&dest->refcnt),
-                  atomic_read(&dest->weight));
+        IP_VS_DBG_BUF(6, "WRR: server %s:%u "
+                      "activeconns %d refcnt %d weight %d\n",
+                      IP_VS_DBG_ADDR(svc->af, &dest->addr), ntohs(dest->port),
+                      atomic_read(&dest->activeconns),
+                      atomic_read(&dest->refcnt),
+                      atomic_read(&dest->weight));
 
   out:
         write_unlock(&svc->sched_lock);
@@ -213,6 +213,9 @@ static struct ip_vs_scheduler ip_vs_wrr_scheduler = {
         .refcnt =               ATOMIC_INIT(0),
         .module =               THIS_MODULE,
         .n_list =               LIST_HEAD_INIT(ip_vs_wrr_scheduler.n_list),
+#ifdef CONFIG_IP_VS_IPV6
+        .supports_ipv6 =        1,
+#endif
         .init_service =         ip_vs_wrr_init_svc,
         .done_service =         ip_vs_wrr_done_svc,
         .update_service =       ip_vs_wrr_update_svc,
diff --git a/net/ipv4/ipvs/ip_vs_xmit.c b/net/ipv4/ipvs/ip_vs_xmit.c
index 9892d4aca42e..02ddc2b3ce2e 100644
--- a/net/ipv4/ipvs/ip_vs_xmit.c
+++ b/net/ipv4/ipvs/ip_vs_xmit.c
@@ -20,6 +20,9 @@
 #include <net/udp.h>
 #include <net/icmp.h>                   /* for icmp_send */
 #include <net/route.h>                  /* for ip_route_output */
+#include <net/ipv6.h>
+#include <net/ip6_route.h>
+#include <linux/icmpv6.h>
 #include <linux/netfilter.h>
 #include <linux/netfilter_ipv4.h>
 
@@ -47,7 +50,8 @@ __ip_vs_dst_check(struct ip_vs_dest *dest, u32 rtos, u32 cookie)
 
         if (!dst)
                 return NULL;
-        if ((dst->obsolete || rtos != dest->dst_rtos) &&
+        if ((dst->obsolete
+             || (dest->af == AF_INET && rtos != dest->dst_rtos)) &&
             dst->ops->check(dst, cookie) == NULL) {
                 dest->dst_cache = NULL;
                 dst_release(dst);
@@ -71,7 +75,7 @@ __ip_vs_get_out_rt(struct ip_vs_conn *cp, u32 rtos)
                                 .oif = 0,
                                 .nl_u = {
                                         .ip4_u = {
-                                                .daddr = dest->addr,
+                                                .daddr = dest->addr.ip,
                                                 .saddr = 0,
                                                 .tos = rtos, } },
                         };
@@ -80,12 +84,12 @@ __ip_vs_get_out_rt(struct ip_vs_conn *cp, u32 rtos)
                                 spin_unlock(&dest->dst_lock);
                                 IP_VS_DBG_RL("ip_route_output error, "
                                              "dest: %u.%u.%u.%u\n",
-                                             NIPQUAD(dest->addr));
+                                             NIPQUAD(dest->addr.ip));
                                 return NULL;
                         }
                         __ip_vs_dst_set(dest, rtos, dst_clone(&rt->u.dst));
                         IP_VS_DBG(10, "new dst %u.%u.%u.%u, refcnt=%d, rtos=%X\n",
-                                  NIPQUAD(dest->addr),
+                                  NIPQUAD(dest->addr.ip),
                                   atomic_read(&rt->u.dst.__refcnt), rtos);
                 }
                 spin_unlock(&dest->dst_lock);
@@ -94,14 +98,14 @@ __ip_vs_get_out_rt(struct ip_vs_conn *cp, u32 rtos)
                         .oif = 0,
                         .nl_u = {
                                 .ip4_u = {
-                                        .daddr = cp->daddr,
+                                        .daddr = cp->daddr.ip,
                                         .saddr = 0,
                                         .tos = rtos, } },
                 };
 
                 if (ip_route_output_key(&init_net, &rt, &fl)) {
                         IP_VS_DBG_RL("ip_route_output error, dest: "
-                                     "%u.%u.%u.%u\n", NIPQUAD(cp->daddr));
+                                     "%u.%u.%u.%u\n", NIPQUAD(cp->daddr.ip));
                         return NULL;
                 }
         }
@@ -109,6 +113,70 @@ __ip_vs_get_out_rt(struct ip_vs_conn *cp, u32 rtos)
         return rt;
 }
 
+#ifdef CONFIG_IP_VS_IPV6
+static struct rt6_info *
+__ip_vs_get_out_rt_v6(struct ip_vs_conn *cp)
+{
+        struct rt6_info *rt;                    /* Route to the other host */
+        struct ip_vs_dest *dest = cp->dest;
+
+        if (dest) {
+                spin_lock(&dest->dst_lock);
+                rt = (struct rt6_info *)__ip_vs_dst_check(dest, 0, 0);
+                if (!rt) {
+                        struct flowi fl = {
+                                .oif = 0,
+                                .nl_u = {
+                                        .ip6_u = {
+                                                .daddr = dest->addr.in6,
+                                                .saddr = {
+                                                        .s6_addr32 =
+                                                                { 0, 0, 0, 0 },
+                                                },
+                                        },
+                                },
+                        };
+
+                        rt = (struct rt6_info *)ip6_route_output(&init_net,
+                                                                 NULL, &fl);
+                        if (!rt) {
+                                spin_unlock(&dest->dst_lock);
+                                IP_VS_DBG_RL("ip6_route_output error, "
+                                             "dest: " NIP6_FMT "\n",
+                                             NIP6(dest->addr.in6));
+                                return NULL;
+                        }
+                        __ip_vs_dst_set(dest, 0, dst_clone(&rt->u.dst));
+                        IP_VS_DBG(10, "new dst " NIP6_FMT ", refcnt=%d\n",
+                                  NIP6(dest->addr.in6),
+                                  atomic_read(&rt->u.dst.__refcnt));
+                }
+                spin_unlock(&dest->dst_lock);
+        } else {
+                struct flowi fl = {
+                        .oif = 0,
+                        .nl_u = {
+                                .ip6_u = {
+                                        .daddr = cp->daddr.in6,
+                                        .saddr = {
+                                                .s6_addr32 = { 0, 0, 0, 0 },
+                                        },
+                                },
+                        },
+                };
+
+                rt = (struct rt6_info *)ip6_route_output(&init_net, NULL, &fl);
+                if (!rt) {
+                        IP_VS_DBG_RL("ip6_route_output error, dest: "
+                                     NIP6_FMT "\n", NIP6(cp->daddr.in6));
+                        return NULL;
+                }
+        }
+
+        return rt;
+}
+#endif
+
 
 /*
  *      Release dest->dst_cache before a dest is removed
@@ -123,11 +191,11 @@ ip_vs_dst_reset(struct ip_vs_dest *dest)
         dst_release(old_dst);
 }
 
-#define IP_VS_XMIT(skb, rt)                             \
+#define IP_VS_XMIT(pf, skb, rt)                         \
 do {                                                    \
         (skb)->ipvs_property = 1;                       \
         skb_forward_csum(skb);                          \
-        NF_HOOK(PF_INET, NF_INET_LOCAL_OUT, (skb), NULL,        \
+        NF_HOOK(pf, NF_INET_LOCAL_OUT, (skb), NULL,     \
                 (rt)->u.dst.dev, dst_output);           \
 } while (0)
 
@@ -200,7 +268,7 @@ ip_vs_bypass_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
         /* Another hack: avoid icmp_send in ip_fragment */
         skb->local_df = 1;
 
-        IP_VS_XMIT(skb, rt);
+        IP_VS_XMIT(PF_INET, skb, rt);
 
         LeaveFunction(10);
         return NF_STOLEN;
@@ -213,6 +281,70 @@ ip_vs_bypass_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
         return NF_STOLEN;
 }
 
+#ifdef CONFIG_IP_VS_IPV6
+int
+ip_vs_bypass_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
+                     struct ip_vs_protocol *pp)
+{
+        struct rt6_info *rt;                    /* Route to the other host */
+        struct ipv6hdr  *iph = ipv6_hdr(skb);
+        int    mtu;
+        struct flowi fl = {
+                .oif = 0,
+                .nl_u = {
+                        .ip6_u = {
+                                .daddr = iph->daddr,
+                                .saddr = { .s6_addr32 = {0, 0, 0, 0} }, } },
+        };
+
+        EnterFunction(10);
+
+        rt = (struct rt6_info *)ip6_route_output(&init_net, NULL, &fl);
+        if (!rt) {
+                IP_VS_DBG_RL("ip_vs_bypass_xmit_v6(): ip6_route_output error, "
+                             "dest: " NIP6_FMT "\n", NIP6(iph->daddr));
+                goto tx_error_icmp;
+        }
+
+        /* MTU checking */
+        mtu = dst_mtu(&rt->u.dst);
+        if (skb->len > mtu) {
+                dst_release(&rt->u.dst);
+                icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, skb->dev);
+                IP_VS_DBG_RL("ip_vs_bypass_xmit_v6(): frag needed\n");
+                goto tx_error;
+        }
+
+        /*
+         * Call ip_send_check because we are not sure it is called
+         * after ip_defrag. Is copy-on-write needed?
+         */
+        skb = skb_share_check(skb, GFP_ATOMIC);
+        if (unlikely(skb == NULL)) {
+                dst_release(&rt->u.dst);
+                return NF_STOLEN;
+        }
+
+        /* drop old route */
+        dst_release(skb->dst);
+        skb->dst = &rt->u.dst;
+
+        /* Another hack: avoid icmp_send in ip_fragment */
+        skb->local_df = 1;
+
+        IP_VS_XMIT(PF_INET6, skb, rt);
+
+        LeaveFunction(10);
+        return NF_STOLEN;
+
+ tx_error_icmp:
+        dst_link_failure(skb);
+ tx_error:
+        kfree_skb(skb);
+        LeaveFunction(10);
+        return NF_STOLEN;
+}
+#endif
 
 /*
  *      NAT transmitter (only for outside-to-inside nat forwarding)
@@ -264,7 +396,7 @@ ip_vs_nat_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
         /* mangle the packet */
         if (pp->dnat_handler && !pp->dnat_handler(skb, pp, cp))
                 goto tx_error;
-        ip_hdr(skb)->daddr = cp->daddr;
+        ip_hdr(skb)->daddr = cp->daddr.ip;
         ip_send_check(ip_hdr(skb));
 
         IP_VS_DBG_PKT(10, pp, skb, 0, "After DNAT");
@@ -276,7 +408,7 @@ ip_vs_nat_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
         /* Another hack: avoid icmp_send in ip_fragment */
         skb->local_df = 1;
 
-        IP_VS_XMIT(skb, rt);
+        IP_VS_XMIT(PF_INET, skb, rt);
 
         LeaveFunction(10);
         return NF_STOLEN;
@@ -292,6 +424,83 @@ ip_vs_nat_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
         goto tx_error;
 }
 
+#ifdef CONFIG_IP_VS_IPV6
+int
+ip_vs_nat_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
+                  struct ip_vs_protocol *pp)
+{
+        struct rt6_info *rt;            /* Route to the other host */
+        int mtu;
+
+        EnterFunction(10);
+
+        /* check if it is a connection of no-client-port */
+        if (unlikely(cp->flags & IP_VS_CONN_F_NO_CPORT)) {
+                __be16 _pt, *p;
+                p = skb_header_pointer(skb, sizeof(struct ipv6hdr),
+                                       sizeof(_pt), &_pt);
+                if (p == NULL)
+                        goto tx_error;
+                ip_vs_conn_fill_cport(cp, *p);
+                IP_VS_DBG(10, "filled cport=%d\n", ntohs(*p));
+        }
+
+        rt = __ip_vs_get_out_rt_v6(cp);
+        if (!rt)
+                goto tx_error_icmp;
+
+        /* MTU checking */
+        mtu = dst_mtu(&rt->u.dst);
+        if (skb->len > mtu) {
+                dst_release(&rt->u.dst);
+                icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, skb->dev);
+                IP_VS_DBG_RL_PKT(0, pp, skb, 0,
+                                 "ip_vs_nat_xmit_v6(): frag needed for");
+                goto tx_error;
+        }
+
+        /* copy-on-write the packet before mangling it */
+        if (!skb_make_writable(skb, sizeof(struct ipv6hdr)))
+                goto tx_error_put;
+
+        if (skb_cow(skb, rt->u.dst.dev->hard_header_len))
+                goto tx_error_put;
+
+        /* drop old route */
+        dst_release(skb->dst);
+        skb->dst = &rt->u.dst;
+
+        /* mangle the packet */
+        if (pp->dnat_handler && !pp->dnat_handler(skb, pp, cp))
+                goto tx_error;
+        ipv6_hdr(skb)->daddr = cp->daddr.in6;
+
+        IP_VS_DBG_PKT(10, pp, skb, 0, "After DNAT");
+
+        /* FIXME: when application helper enlarges the packet and the length
+           is larger than the MTU of outgoing device, there will be still
+           MTU problem. */
+
+        /* Another hack: avoid icmp_send in ip_fragment */
+        skb->local_df = 1;
+
+        IP_VS_XMIT(PF_INET6, skb, rt);
+
+        LeaveFunction(10);
+        return NF_STOLEN;
+
+tx_error_icmp:
+        dst_link_failure(skb);
+tx_error:
+        LeaveFunction(10);
+        kfree_skb(skb);
+        return NF_STOLEN;
+tx_error_put:
+        dst_release(&rt->u.dst);
+        goto tx_error;
+}
+#endif
+
 
 /*
  *   IP Tunneling transmitter
@@ -423,6 +632,112 @@ ip_vs_tunnel_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
         return NF_STOLEN;
 }
 
+#ifdef CONFIG_IP_VS_IPV6
+int
+ip_vs_tunnel_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
+                     struct ip_vs_protocol *pp)
+{
+        struct rt6_info *rt;            /* Route to the other host */
+        struct net_device *tdev;        /* Device to other host */
+        struct ipv6hdr  *old_iph = ipv6_hdr(skb);
+        sk_buff_data_t old_transport_header = skb->transport_header;
+        struct ipv6hdr  *iph;           /* Our new IP header */
+        unsigned int max_headroom;      /* The extra header space needed */
+        int    mtu;
+
+        EnterFunction(10);
+
+        if (skb->protocol != htons(ETH_P_IPV6)) {
+                IP_VS_DBG_RL("ip_vs_tunnel_xmit_v6(): protocol error, "
+                             "ETH_P_IPV6: %d, skb protocol: %d\n",
+                             htons(ETH_P_IPV6), skb->protocol);
+                goto tx_error;
+        }
+
+        rt = __ip_vs_get_out_rt_v6(cp);
+        if (!rt)
+                goto tx_error_icmp;
+
+        tdev = rt->u.dst.dev;
+
+        mtu = dst_mtu(&rt->u.dst) - sizeof(struct ipv6hdr);
+        /* TODO IPv6: do we need this check in IPv6? */
+        if (mtu < 1280) {
+                dst_release(&rt->u.dst);
+                IP_VS_DBG_RL("ip_vs_tunnel_xmit_v6(): mtu less than 1280\n");
+                goto tx_error;
+        }
+        if (skb->dst)
+                skb->dst->ops->update_pmtu(skb->dst, mtu);
+
+        if (mtu < ntohs(old_iph->payload_len) + sizeof(struct ipv6hdr)) {
+                icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, skb->dev);
+                dst_release(&rt->u.dst);
+                IP_VS_DBG_RL("ip_vs_tunnel_xmit_v6(): frag needed\n");
+                goto tx_error;
+        }
+
+        /*
+         * Okay, now see if we can stuff it in the buffer as-is.
+         */
+        max_headroom = LL_RESERVED_SPACE(tdev) + sizeof(struct ipv6hdr);
+
+        if (skb_headroom(skb) < max_headroom
+            || skb_cloned(skb) || skb_shared(skb)) {
+                struct sk_buff *new_skb =
+                        skb_realloc_headroom(skb, max_headroom);
+                if (!new_skb) {
+                        dst_release(&rt->u.dst);
+                        kfree_skb(skb);
+                        IP_VS_ERR_RL("ip_vs_tunnel_xmit_v6(): no memory\n");
+                        return NF_STOLEN;
+                }
+                kfree_skb(skb);
+                skb = new_skb;
+                old_iph = ipv6_hdr(skb);
+        }
+
+        skb->transport_header = old_transport_header;
+
+        skb_push(skb, sizeof(struct ipv6hdr));
+        skb_reset_network_header(skb);
+        memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
+
+        /* drop old route */
+        dst_release(skb->dst);
+        skb->dst = &rt->u.dst;
+
+        /*
+         *      Push down and install the IPIP header.
+         */
+        iph                     =       ipv6_hdr(skb);
+        iph->version            =       6;
+        iph->nexthdr            =       IPPROTO_IPV6;
+        iph->payload_len        =       old_iph->payload_len + sizeof(old_iph);
+        iph->priority           =       old_iph->priority;
+        memset(&iph->flow_lbl, 0, sizeof(iph->flow_lbl));
+        iph->daddr              =       rt->rt6i_dst.addr;
+        iph->saddr              =       cp->vaddr.in6; /* rt->rt6i_src.addr; */
+        iph->hop_limit          =       old_iph->hop_limit;
+
+        /* Another hack: avoid icmp_send in ip_fragment */
+        skb->local_df = 1;
+
+        ip6_local_out(skb);
+
+        LeaveFunction(10);
+
+        return NF_STOLEN;
+
+tx_error_icmp:
+        dst_link_failure(skb);
+tx_error:
+        kfree_skb(skb);
+        LeaveFunction(10);
+        return NF_STOLEN;
+}
+#endif
+
 
 /*
  *      Direct Routing transmitter
@@ -467,7 +782,7 @@ ip_vs_dr_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
         /* Another hack: avoid icmp_send in ip_fragment */
         skb->local_df = 1;
 
-        IP_VS_XMIT(skb, rt);
+        IP_VS_XMIT(PF_INET, skb, rt);
 
         LeaveFunction(10);
         return NF_STOLEN;
@@ -480,6 +795,60 @@ ip_vs_dr_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
         return NF_STOLEN;
 }
 
+#ifdef CONFIG_IP_VS_IPV6
+int
+ip_vs_dr_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
+                 struct ip_vs_protocol *pp)
+{
+        struct rt6_info *rt;                    /* Route to the other host */
+        int    mtu;
+
+        EnterFunction(10);
+
+        rt = __ip_vs_get_out_rt_v6(cp);
+        if (!rt)
+                goto tx_error_icmp;
+
+        /* MTU checking */
+        mtu = dst_mtu(&rt->u.dst);
+        if (skb->len > mtu) {
+                icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, skb->dev);
+                dst_release(&rt->u.dst);
+                IP_VS_DBG_RL("ip_vs_dr_xmit_v6(): frag needed\n");
+                goto tx_error;
+        }
+
+        /*
+         * Call ip_send_check because we are not sure it is called
+         * after ip_defrag. Is copy-on-write needed?
+         */
+        skb = skb_share_check(skb, GFP_ATOMIC);
+        if (unlikely(skb == NULL)) {
+                dst_release(&rt->u.dst);
+                return NF_STOLEN;
+        }
+
+        /* drop old route */
+        dst_release(skb->dst);
+        skb->dst = &rt->u.dst;
+
+        /* Another hack: avoid icmp_send in ip_fragment */
+        skb->local_df = 1;
+
+        IP_VS_XMIT(PF_INET6, skb, rt);
+
+        LeaveFunction(10);
+        return NF_STOLEN;
+
+tx_error_icmp:
+        dst_link_failure(skb);
+tx_error:
+        kfree_skb(skb);
+        LeaveFunction(10);
+        return NF_STOLEN;
+}
+#endif
+
 
 /*
  *      ICMP packet transmitter
@@ -540,7 +909,7 @@ ip_vs_icmp_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
         /* Another hack: avoid icmp_send in ip_fragment */
         skb->local_df = 1;
 
-        IP_VS_XMIT(skb, rt);
+        IP_VS_XMIT(PF_INET, skb, rt);
 
         rc = NF_STOLEN;
         goto out;
@@ -557,3 +926,79 @@ ip_vs_icmp_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
         ip_rt_put(rt);
         goto tx_error;
 }
+
+#ifdef CONFIG_IP_VS_IPV6
+int
+ip_vs_icmp_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
+                struct ip_vs_protocol *pp, int offset)
+{
+        struct rt6_info *rt;    /* Route to the other host */
+        int mtu;
+        int rc;
+
+        EnterFunction(10);
+
+        /* The ICMP packet for VS/TUN, VS/DR and LOCALNODE will be
+           forwarded directly here, because there is no need to
+           translate address/port back */
+        if (IP_VS_FWD_METHOD(cp) != IP_VS_CONN_F_MASQ) {
+                if (cp->packet_xmit)
+                        rc = cp->packet_xmit(skb, cp, pp);
+                else
+                        rc = NF_ACCEPT;
+                /* do not touch skb anymore */
+                atomic_inc(&cp->in_pkts);
+                goto out;
+        }
+
+        /*
+         * mangle and send the packet here (only for VS/NAT)
+         */
+
+        rt = __ip_vs_get_out_rt_v6(cp);
+        if (!rt)
+                goto tx_error_icmp;
+
+        /* MTU checking */
+        mtu = dst_mtu(&rt->u.dst);
+        if (skb->len > mtu) {
+                dst_release(&rt->u.dst);
+                icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, skb->dev);
+                IP_VS_DBG_RL("ip_vs_in_icmp(): frag needed\n");
+                goto tx_error;
+        }
+
+        /* copy-on-write the packet before mangling it */
+        if (!skb_make_writable(skb, offset))
+                goto tx_error_put;
+
+        if (skb_cow(skb, rt->u.dst.dev->hard_header_len))
+                goto tx_error_put;
+
+        /* drop the old route when skb is not shared */
+        dst_release(skb->dst);
+        skb->dst = &rt->u.dst;
+
+        ip_vs_nat_icmp_v6(skb, pp, cp, 0);
+
+        /* Another hack: avoid icmp_send in ip_fragment */
+        skb->local_df = 1;
+
+        IP_VS_XMIT(PF_INET6, skb, rt);
+
+        rc = NF_STOLEN;
+        goto out;
+
+tx_error_icmp:
+        dst_link_failure(skb);
+tx_error:
+        dev_kfree_skb(skb);
+        rc = NF_STOLEN;
+out:
+        LeaveFunction(10);
+        return rc;
+tx_error_put:
+        dst_release(&rt->u.dst);
+        goto tx_error;
+}
+#endif
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 6ee5354c9aa1..f62187bb6d08 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -282,6 +282,8 @@ static struct rtable *rt_cache_get_first(struct seq_file *seq)
         struct rtable *r = NULL;
 
         for (st->bucket = rt_hash_mask; st->bucket >= 0; --st->bucket) {
+                if (!rt_hash_table[st->bucket].chain)
+                        continue;
                 rcu_read_lock_bh();
                 r = rcu_dereference(rt_hash_table[st->bucket].chain);
                 while (r) {
@@ -299,11 +301,14 @@ static struct rtable *__rt_cache_get_next(struct seq_file *seq,
                                           struct rtable *r)
 {
         struct rt_cache_iter_state *st = seq->private;
+
         r = r->u.dst.rt_next;
         while (!r) {
                 rcu_read_unlock_bh();
-                if (--st->bucket < 0)
-                        break;
+                do {
+                        if (--st->bucket < 0)
+                                return NULL;
+                } while (!rt_hash_table[st->bucket].chain);
                 rcu_read_lock_bh();
                 r = rt_hash_table[st->bucket].chain;
         }
@@ -2840,7 +2845,9 @@ int ip_rt_dump(struct sk_buff *skb,  struct netlink_callback *cb)
         if (s_h < 0)
                 s_h = 0;
         s_idx = idx = cb->args[1];
-        for (h = s_h; h <= rt_hash_mask; h++) {
+        for (h = s_h; h <= rt_hash_mask; h++, s_idx = 0) {
+                if (!rt_hash_table[h].chain)
+                        continue;
                 rcu_read_lock_bh();
                 for (rt = rcu_dereference(rt_hash_table[h].chain), idx = 0; rt;
                      rt = rcu_dereference(rt->u.dst.rt_next), idx++) {
@@ -2859,7 +2866,6 @@ int ip_rt_dump(struct sk_buff *skb,  struct netlink_callback *cb)
                         dst_release(xchg(&skb->dst, NULL));
                 }
                 rcu_read_unlock_bh();
-                s_idx = 0;
         }
 
 done:
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 67ccce2a96bd..3b76bce769dd 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -979,6 +979,39 @@ static void tcp_update_reordering(struct sock *sk, const int metric,
         }
 }
 
+/* This must be called before lost_out is incremented */
+static void tcp_verify_retransmit_hint(struct tcp_sock *tp, struct sk_buff *skb)
+{
+        if ((tp->retransmit_skb_hint == NULL) ||
+            before(TCP_SKB_CB(skb)->seq,
+                   TCP_SKB_CB(tp->retransmit_skb_hint)->seq))
+                tp->retransmit_skb_hint = skb;
+
+        if (!tp->lost_out ||
+            after(TCP_SKB_CB(skb)->end_seq, tp->retransmit_high))
+                tp->retransmit_high = TCP_SKB_CB(skb)->end_seq;
+}
+
+static void tcp_skb_mark_lost(struct tcp_sock *tp, struct sk_buff *skb)
+{
+        if (!(TCP_SKB_CB(skb)->sacked & (TCPCB_LOST|TCPCB_SACKED_ACKED))) {
+                tcp_verify_retransmit_hint(tp, skb);
+
+                tp->lost_out += tcp_skb_pcount(skb);
+                TCP_SKB_CB(skb)->sacked |= TCPCB_LOST;
+        }
+}
+
+void tcp_skb_mark_lost_uncond_verify(struct tcp_sock *tp, struct sk_buff *skb)
+{
+        tcp_verify_retransmit_hint(tp, skb);
+
+        if (!(TCP_SKB_CB(skb)->sacked & (TCPCB_LOST|TCPCB_SACKED_ACKED))) {
+                tp->lost_out += tcp_skb_pcount(skb);
+                TCP_SKB_CB(skb)->sacked |= TCPCB_LOST;
+        }
+}
+
 /* This procedure tags the retransmission queue when SACKs arrive.
  *
  * We have three tag bits: SACKED(S), RETRANS(R) and LOST(L).
@@ -1155,13 +1188,7 @@ static void tcp_mark_lost_retrans(struct sock *sk)
                         TCP_SKB_CB(skb)->sacked &= ~TCPCB_SACKED_RETRANS;
                         tp->retrans_out -= tcp_skb_pcount(skb);
 
-                        /* clear lost hint */
-                        tp->retransmit_skb_hint = NULL;
-
-                        if (!(TCP_SKB_CB(skb)->sacked & (TCPCB_LOST|TCPCB_SACKED_ACKED))) {
-                                tp->lost_out += tcp_skb_pcount(skb);
-                                TCP_SKB_CB(skb)->sacked |= TCPCB_LOST;
-                        }
+                        tcp_skb_mark_lost_uncond_verify(tp, skb);
                         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPLOSTRETRANSMIT);
                 } else {
                         if (before(ack_seq, new_low_seq))
@@ -1271,9 +1298,6 @@ static int tcp_sacktag_one(struct sk_buff *skb, struct sock *sk,
                                         ~(TCPCB_LOST|TCPCB_SACKED_RETRANS);
                                 tp->lost_out -= tcp_skb_pcount(skb);
                                 tp->retrans_out -= tcp_skb_pcount(skb);
-
-                                /* clear lost hint */
-                                tp->retransmit_skb_hint = NULL;
                         }
                 } else {
                         if (!(sacked & TCPCB_RETRANS)) {
@@ -1292,9 +1316,6 @@ static int tcp_sacktag_one(struct sk_buff *skb, struct sock *sk,
                         if (sacked & TCPCB_LOST) {
                                 TCP_SKB_CB(skb)->sacked &= ~TCPCB_LOST;
                                 tp->lost_out -= tcp_skb_pcount(skb);
-
-                                /* clear lost hint */
-                                tp->retransmit_skb_hint = NULL;
                         }
                 }
 
@@ -1324,7 +1345,6 @@ static int tcp_sacktag_one(struct sk_buff *skb, struct sock *sk,
         if (dup_sack && (TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_RETRANS)) {
                 TCP_SKB_CB(skb)->sacked &= ~TCPCB_SACKED_RETRANS;
                 tp->retrans_out -= tcp_skb_pcount(skb);
-                tp->retransmit_skb_hint = NULL;
         }
 
         return flag;
@@ -1726,6 +1746,8 @@ int tcp_use_frto(struct sock *sk)
                 return 0;
 
         skb = tcp_write_queue_head(sk);
+        if (tcp_skb_is_last(sk, skb))
+                return 1;
         skb = tcp_write_queue_next(sk, skb);    /* Skips head */
         tcp_for_write_queue_from(skb, sk) {
                 if (skb == tcp_send_head(sk))
@@ -1867,6 +1889,7 @@ static void tcp_enter_frto_loss(struct sock *sk, int allowed_segments, int flag)
                 if (!(TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_ACKED)) {
                         TCP_SKB_CB(skb)->sacked |= TCPCB_LOST;
                         tp->lost_out += tcp_skb_pcount(skb);
+                        tp->retransmit_high = TCP_SKB_CB(skb)->end_seq;
                 }
         }
         tcp_verify_left_out(tp);
@@ -1883,7 +1906,7 @@ static void tcp_enter_frto_loss(struct sock *sk, int allowed_segments, int flag)
         tp->high_seq = tp->snd_nxt;
         TCP_ECN_queue_cwr(tp);
 
-        tcp_clear_retrans_hints_partial(tp);
+        tcp_clear_all_retrans_hints(tp);
 }
 
 static void tcp_clear_retrans_partial(struct tcp_sock *tp)
@@ -1934,12 +1957,11 @@ void tcp_enter_loss(struct sock *sk, int how)
                 /* Push undo marker, if it was plain RTO and nothing
                  * was retransmitted. */
                 tp->undo_marker = tp->snd_una;
-                tcp_clear_retrans_hints_partial(tp);
         } else {
                 tp->sacked_out = 0;
                 tp->fackets_out = 0;
-                tcp_clear_all_retrans_hints(tp);
         }
+        tcp_clear_all_retrans_hints(tp);
 
         tcp_for_write_queue(skb, sk) {
                 if (skb == tcp_send_head(sk))
@@ -1952,6 +1974,7 @@ void tcp_enter_loss(struct sock *sk, int how)
                         TCP_SKB_CB(skb)->sacked &= ~TCPCB_SACKED_ACKED;
                         TCP_SKB_CB(skb)->sacked |= TCPCB_LOST;
                         tp->lost_out += tcp_skb_pcount(skb);
+                        tp->retransmit_high = TCP_SKB_CB(skb)->end_seq;
                 }
         }
         tcp_verify_left_out(tp);
@@ -2157,19 +2180,6 @@ static int tcp_time_to_recover(struct sock *sk)
         return 0;
 }
 
-/* RFC: This is from the original, I doubt that this is necessary at all:
- * clear xmit_retrans hint if seq of this skb is beyond hint. How could we
- * retransmitted past LOST markings in the first place? I'm not fully sure
- * about undo and end of connection cases, which can cause R without L?
- */
-static void tcp_verify_retransmit_hint(struct tcp_sock *tp, struct sk_buff *skb)
-{
-        if ((tp->retransmit_skb_hint != NULL) &&
-            before(TCP_SKB_CB(skb)->seq,
-                   TCP_SKB_CB(tp->retransmit_skb_hint)->seq))
-                tp->retransmit_skb_hint = NULL;
-}
-
 /* Mark head of queue up as lost. With RFC3517 SACK, the packets is
  * is against sacked "cnt", otherwise it's against facked "cnt"
  */
@@ -2217,11 +2227,7 @@ static void tcp_mark_head_lost(struct sock *sk, int packets)
                         cnt = packets;
                 }
 
-                if (!(TCP_SKB_CB(skb)->sacked & (TCPCB_SACKED_ACKED|TCPCB_LOST))) {
-                        TCP_SKB_CB(skb)->sacked |= TCPCB_LOST;
-                        tp->lost_out += tcp_skb_pcount(skb);
-                        tcp_verify_retransmit_hint(tp, skb);
-                }
+                tcp_skb_mark_lost(tp, skb);
         }
         tcp_verify_left_out(tp);
 }
@@ -2263,11 +2269,7 @@ static void tcp_update_scoreboard(struct sock *sk, int fast_rexmit)
                         if (!tcp_skb_timedout(sk, skb))
                                 break;
 
-                        if (!(TCP_SKB_CB(skb)->sacked & (TCPCB_SACKED_ACKED|TCPCB_LOST))) {
-                                TCP_SKB_CB(skb)->sacked |= TCPCB_LOST;
-                                tp->lost_out += tcp_skb_pcount(skb);
-                                tcp_verify_retransmit_hint(tp, skb);
-                        }
+                        tcp_skb_mark_lost(tp, skb);
                 }
 
                 tp->scoreboard_skb_hint = skb;
@@ -2378,10 +2380,6 @@ static void tcp_undo_cwr(struct sock *sk, const int undo)
         }
         tcp_moderate_cwnd(tp);
         tp->snd_cwnd_stamp = tcp_time_stamp;
-
-        /* There is something screwy going on with the retrans hints after
-           an undo */
-        tcp_clear_all_retrans_hints(tp);
 }
 
 static inline int tcp_may_undo(struct tcp_sock *tp)
@@ -2848,6 +2846,7 @@ static int tcp_clean_rtx_queue(struct sock *sk, int prior_fackets)
         int flag = 0;
         u32 pkts_acked = 0;
         u32 reord = tp->packets_out;
+        u32 prior_sacked = tp->sacked_out;
         s32 seq_rtt = -1;
         s32 ca_seq_rtt = -1;
         ktime_t last_ackt = net_invalid_timestamp();
@@ -2929,7 +2928,11 @@ static int tcp_clean_rtx_queue(struct sock *sk, int prior_fackets)
 
                 tcp_unlink_write_queue(skb, sk);
                 sk_wmem_free_skb(sk, skb);
-                tcp_clear_all_retrans_hints(tp);
+                tp->scoreboard_skb_hint = NULL;
+                if (skb == tp->retransmit_skb_hint)
+                        tp->retransmit_skb_hint = NULL;
+                if (skb == tp->lost_skb_hint)
+                        tp->lost_skb_hint = NULL;
         }
 
         if (skb && (TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_ACKED))
@@ -2948,6 +2951,15 @@ static int tcp_clean_rtx_queue(struct sock *sk, int prior_fackets)
                         /* Non-retransmitted hole got filled? That's reordering */
                         if (reord < prior_fackets)
                                 tcp_update_reordering(sk, tp->fackets_out - reord, 0);
+
+                        /* No need to care for underflows here because
+                         * the lost_skb_hint gets NULLed if we're past it
+                         * (or something non-trivial happened)
+                         */
+                        if (tcp_is_fack(tp))
+                                tp->lost_cnt_hint -= pkts_acked;
+                        else
+                                tp->lost_cnt_hint -= prior_sacked - tp->sacked_out;
                 }
 
                 tp->fackets_out -= min(pkts_acked, tp->fackets_out);
@@ -3442,6 +3454,22 @@ void tcp_parse_options(struct sk_buff *skb, struct tcp_options_received *opt_rx,
         }
 }
 
+static int tcp_parse_aligned_timestamp(struct tcp_sock *tp, struct tcphdr *th)
+{
+        __be32 *ptr = (__be32 *)(th + 1);
+
+        if (*ptr == htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16)
+                          | (TCPOPT_TIMESTAMP << 8) | TCPOLEN_TIMESTAMP)) {
+                tp->rx_opt.saw_tstamp = 1;
+                ++ptr;
+                tp->rx_opt.rcv_tsval = ntohl(*ptr);
+                ++ptr;
+                tp->rx_opt.rcv_tsecr = ntohl(*ptr);
+                return 1;
+        }
+        return 0;
+}
+
 /* Fast parse options. This hopes to only see timestamps.
  * If it is wrong it falls back on tcp_parse_options().
  */
@@ -3453,16 +3481,8 @@ static int tcp_fast_parse_options(struct sk_buff *skb, struct tcphdr *th,
                 return 0;
         } else if (tp->rx_opt.tstamp_ok &&
                    th->doff == (sizeof(struct tcphdr)>>2)+(TCPOLEN_TSTAMP_ALIGNED>>2)) {
-                __be32 *ptr = (__be32 *)(th + 1);
-                if (*ptr == htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16)
-                                  | (TCPOPT_TIMESTAMP << 8) | TCPOLEN_TIMESTAMP)) {
-                        tp->rx_opt.saw_tstamp = 1;
-                        ++ptr;
-                        tp->rx_opt.rcv_tsval = ntohl(*ptr);
-                        ++ptr;
-                        tp->rx_opt.rcv_tsecr = ntohl(*ptr);
+                if (tcp_parse_aligned_timestamp(tp, th))
                         return 1;
-                }
         }
         tcp_parse_options(skb, &tp->rx_opt, 1);
         return 1;
@@ -4138,7 +4158,7 @@ drop:
                                 skb1 = skb1->prev;
                         }
                 }
-                __skb_insert(skb, skb1, skb1->next, &tp->out_of_order_queue);
+                __skb_queue_after(&tp->out_of_order_queue, skb1, skb);
 
                 /* And clean segments covered by new one as whole. */
                 while ((skb1 = skb->next) !=
@@ -4161,6 +4181,18 @@ add_sack:
         }
 }
 
+static struct sk_buff *tcp_collapse_one(struct sock *sk, struct sk_buff *skb,
+                                        struct sk_buff_head *list)
+{
+        struct sk_buff *next = skb->next;
+
+        __skb_unlink(skb, list);
+        __kfree_skb(skb);
+        NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPRCVCOLLAPSED);
+
+        return next;
+}
+
 /* Collapse contiguous sequence of skbs head..tail with
  * sequence numbers start..end.
  * Segments with FIN/SYN are not collapsed (only because this
@@ -4178,11 +4210,7 @@ tcp_collapse(struct sock *sk, struct sk_buff_head *list,
         for (skb = head; skb != tail;) {
                 /* No new bits? It is possible on ofo queue. */
                 if (!before(start, TCP_SKB_CB(skb)->end_seq)) {
-                        struct sk_buff *next = skb->next;
-                        __skb_unlink(skb, list);
-                        __kfree_skb(skb);
-                        NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPRCVCOLLAPSED);
-                        skb = next;
+                        skb = tcp_collapse_one(sk, skb, list);
                         continue;
                 }
 
@@ -4228,7 +4256,7 @@ tcp_collapse(struct sock *sk, struct sk_buff_head *list,
                 memcpy(nskb->head, skb->head, header);
                 memcpy(nskb->cb, skb->cb, sizeof(skb->cb));
                 TCP_SKB_CB(nskb)->seq = TCP_SKB_CB(nskb)->end_seq = start;
-                __skb_insert(nskb, skb->prev, skb, list);
+                __skb_queue_before(list, skb, nskb);
                 skb_set_owner_r(nskb, sk);
 
                 /* Copy data, releasing collapsed skbs. */
@@ -4246,11 +4274,7 @@ tcp_collapse(struct sock *sk, struct sk_buff_head *list,
                                 start += size;
                         }
                         if (!before(start, TCP_SKB_CB(skb)->end_seq)) {
-                                struct sk_buff *next = skb->next;
-                                __skb_unlink(skb, list);
-                                __kfree_skb(skb);
-                                NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPRCVCOLLAPSED);
-                                skb = next;
+                                skb = tcp_collapse_one(sk, skb, list);
                                 if (skb == tail ||
                                     tcp_hdr(skb)->syn ||
                                     tcp_hdr(skb)->fin)
@@ -4691,6 +4715,67 @@ out:
 }
 #endif /* CONFIG_NET_DMA */
 
+/* Does PAWS and seqno based validation of an incoming segment, flags will
+ * play significant role here.
+ */
+static int tcp_validate_incoming(struct sock *sk, struct sk_buff *skb,
+                              struct tcphdr *th, int syn_inerr)
+{
+        struct tcp_sock *tp = tcp_sk(sk);
+
+        /* RFC1323: H1. Apply PAWS check first. */
+        if (tcp_fast_parse_options(skb, th, tp) && tp->rx_opt.saw_tstamp &&
+            tcp_paws_discard(sk, skb)) {
+                if (!th->rst) {
+                        NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_PAWSESTABREJECTED);
+                        tcp_send_dupack(sk, skb);
+                        goto discard;
+                }
+                /* Reset is accepted even if it did not pass PAWS. */
+        }
+
+        /* Step 1: check sequence number */
+        if (!tcp_sequence(tp, TCP_SKB_CB(skb)->seq, TCP_SKB_CB(skb)->end_seq)) {
+                /* RFC793, page 37: "In all states except SYN-SENT, all reset
+                 * (RST) segments are validated by checking their SEQ-fields."
+                 * And page 69: "If an incoming segment is not acceptable,
+                 * an acknowledgment should be sent in reply (unless the RST
+                 * bit is set, if so drop the segment and return)".
+                 */
+                if (!th->rst)
+                        tcp_send_dupack(sk, skb);
+                goto discard;
+        }
+
+        /* Step 2: check RST bit */
+        if (th->rst) {
+                tcp_reset(sk);
+                goto discard;
+        }
+
+        /* ts_recent update must be made after we are sure that the packet
+         * is in window.
+         */
+        tcp_replace_ts_recent(tp, TCP_SKB_CB(skb)->seq);
+
+        /* step 3: check security and precedence [ignored] */
+
+        /* step 4: Check for a SYN in window. */
+        if (th->syn && !before(TCP_SKB_CB(skb)->seq, tp->rcv_nxt)) {
+                if (syn_inerr)
+                        TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_INERRS);
+                NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPABORTONSYN);
+                tcp_reset(sk);
+                return -1;
+        }
+
+        return 1;
+
+discard:
+        __kfree_skb(skb);
+        return 0;
+}
+
 /*
  *      TCP receive function for the ESTABLISHED state.
  *
@@ -4718,6 +4803,7 @@ int tcp_rcv_established(struct sock *sk, struct sk_buff *skb,
                         struct tcphdr *th, unsigned len)
 {
         struct tcp_sock *tp = tcp_sk(sk);
+        int res;
 
         /*
          *      Header prediction.
@@ -4756,19 +4842,10 @@ int tcp_rcv_established(struct sock *sk, struct sk_buff *skb,
 
                 /* Check timestamp */
                 if (tcp_header_len == sizeof(struct tcphdr) + TCPOLEN_TSTAMP_ALIGNED) {
-                        __be32 *ptr = (__be32 *)(th + 1);
-
                         /* No? Slow path! */
-                        if (*ptr != htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16)
-                                          | (TCPOPT_TIMESTAMP << 8) | TCPOLEN_TIMESTAMP))
+                        if (!tcp_parse_aligned_timestamp(tp, th))
                                 goto slow_path;
 
-                        tp->rx_opt.saw_tstamp = 1;
-                        ++ptr;
-                        tp->rx_opt.rcv_tsval = ntohl(*ptr);
-                        ++ptr;
-                        tp->rx_opt.rcv_tsecr = ntohl(*ptr);
-
                         /* If PAWS failed, check it more carefully in slow path */
                         if ((s32)(tp->rx_opt.rcv_tsval - tp->rx_opt.ts_recent) < 0)
                                 goto slow_path;
@@ -4899,51 +4976,12 @@ slow_path:
                 goto csum_error;
 
         /*
-         * RFC1323: H1. Apply PAWS check first.
-         */
-        if (tcp_fast_parse_options(skb, th, tp) && tp->rx_opt.saw_tstamp &&
-            tcp_paws_discard(sk, skb)) {
-                if (!th->rst) {
-                        NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_PAWSESTABREJECTED);
-                        tcp_send_dupack(sk, skb);
-                        goto discard;
-                }
-                /* Resets are accepted even if PAWS failed.
-
-                   ts_recent update must be made after we are sure
-                   that the packet is in window.
-                 */
-        }
-
-        /*
          *      Standard slow path.
          */
 
-        if (!tcp_sequence(tp, TCP_SKB_CB(skb)->seq, TCP_SKB_CB(skb)->end_seq)) {
-                /* RFC793, page 37: "In all states except SYN-SENT, all reset
-                 * (RST) segments are validated by checking their SEQ-fields."
-                 * And page 69: "If an incoming segment is not acceptable,
-                 * an acknowledgment should be sent in reply (unless the RST bit
-                 * is set, if so drop the segment and return)".
-                 */
-                if (!th->rst)
-                        tcp_send_dupack(sk, skb);
-                goto discard;
-        }
-
-        if (th->rst) {
-                tcp_reset(sk);
-                goto discard;
-        }
-
-        tcp_replace_ts_recent(tp, TCP_SKB_CB(skb)->seq);
-
-        if (th->syn && !before(TCP_SKB_CB(skb)->seq, tp->rcv_nxt)) {
-                TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_INERRS);
-                NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPABORTONSYN);
-                tcp_reset(sk);
-                return 1;
-        }
+        res = tcp_validate_incoming(sk, skb, th, 1);
+        if (res <= 0)
+                return -res;
 
 step5:
         if (th->ack)
@@ -5225,6 +5263,7 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
         struct tcp_sock *tp = tcp_sk(sk);
         struct inet_connection_sock *icsk = inet_csk(sk);
         int queued = 0;
+        int res;
 
         tp->rx_opt.saw_tstamp = 0;
 
@@ -5277,42 +5316,9 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
                 return 0;
         }
 
-        if (tcp_fast_parse_options(skb, th, tp) && tp->rx_opt.saw_tstamp &&
-            tcp_paws_discard(sk, skb)) {
-                if (!th->rst) {
-                        NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_PAWSESTABREJECTED);
-                        tcp_send_dupack(sk, skb);
-                        goto discard;
-                }
-                /* Reset is accepted even if it did not pass PAWS. */
-        }
-
-        /* step 1: check sequence number */
-        if (!tcp_sequence(tp, TCP_SKB_CB(skb)->seq, TCP_SKB_CB(skb)->end_seq)) {
-                if (!th->rst)
-                        tcp_send_dupack(sk, skb);
-                goto discard;
-        }
-
-        /* step 2: check RST bit */
-        if (th->rst) {
-                tcp_reset(sk);
-                goto discard;
-        }
-
-        tcp_replace_ts_recent(tp, TCP_SKB_CB(skb)->seq);
-
-        /* step 3: check security and precedence [ignored] */
-
-        /*      step 4:
-         *
-         *      Check for a SYN in window.
-         */
-        if (th->syn && !before(TCP_SKB_CB(skb)->seq, tp->rcv_nxt)) {
-                NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPABORTONSYN);
-                tcp_reset(sk);
-                return 1;
-        }
+        res = tcp_validate_incoming(sk, skb, th, 0);
+        if (res <= 0)
+                return -res;
 
         /* step 5: check the ACK field */
         if (th->ack) {
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 011478e46c40..d13688e3558d 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1364,6 +1364,10 @@ struct sock *tcp_v4_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
         tcp_mtup_init(newsk);
         tcp_sync_mss(newsk, dst_mtu(dst));
         newtp->advmss = dst_metric(dst, RTAX_ADVMSS);
+        if (tcp_sk(sk)->rx_opt.user_mss &&
+            tcp_sk(sk)->rx_opt.user_mss < newtp->advmss)
+                newtp->advmss = tcp_sk(sk)->rx_opt.user_mss;
+
         tcp_initialize_rcv_mss(newsk);
 
 #ifdef CONFIG_TCP_MD5SIG
@@ -1946,6 +1950,12 @@ static void *listening_get_idx(struct seq_file *seq, loff_t *pos)
         return rc;
 }
 
+static inline int empty_bucket(struct tcp_iter_state *st)
+{
+        return hlist_empty(&tcp_hashinfo.ehash[st->bucket].chain) &&
+                hlist_empty(&tcp_hashinfo.ehash[st->bucket].twchain);
+}
+
 static void *established_get_first(struct seq_file *seq)
 {
         struct tcp_iter_state* st = seq->private;
@@ -1958,6 +1968,10 @@ static void *established_get_first(struct seq_file *seq)
                 struct inet_timewait_sock *tw;
                 rwlock_t *lock = inet_ehash_lockp(&tcp_hashinfo, st->bucket);
 
+                /* Lockless fast path for the common case of empty buckets */
+                if (empty_bucket(st))
+                        continue;
+
                 read_lock_bh(lock);
                 sk_for_each(sk, node, &tcp_hashinfo.ehash[st->bucket].chain) {
                         if (sk->sk_family != st->family ||
@@ -2008,13 +2022,15 @@ get_tw:
                 read_unlock_bh(inet_ehash_lockp(&tcp_hashinfo, st->bucket));
                 st->state = TCP_SEQ_STATE_ESTABLISHED;
 
-                if (++st->bucket < tcp_hashinfo.ehash_size) {
-                        read_lock_bh(inet_ehash_lockp(&tcp_hashinfo, st->bucket));
-                        sk = sk_head(&tcp_hashinfo.ehash[st->bucket].chain);
-                } else {
-                        cur = NULL;
-                        goto out;
-                }
+                /* Look for next non empty bucket */
+                while (++st->bucket < tcp_hashinfo.ehash_size &&
+                                empty_bucket(st))
+                        ;
+                if (st->bucket >= tcp_hashinfo.ehash_size)
+                        return NULL;
+
+                read_lock_bh(inet_ehash_lockp(&tcp_hashinfo, st->bucket));
+                sk = sk_head(&tcp_hashinfo.ehash[st->bucket].chain);
         } else
                 sk = sk_next(sk);
 
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 8165f5aa8c71..a8499ef3234a 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -1824,6 +1824,8 @@ static void tcp_retrans_try_collapse(struct sock *sk, struct sk_buff *skb,
 
         /* changed transmit queue under us so clear hints */
         tcp_clear_retrans_hints_partial(tp);
+        if (next_skb == tp->retransmit_skb_hint)
+                tp->retransmit_skb_hint = skb;
 
         sk_wmem_free_skb(sk, next_skb);
 }
@@ -1838,7 +1840,7 @@ void tcp_simple_retransmit(struct sock *sk)
         struct tcp_sock *tp = tcp_sk(sk);
         struct sk_buff *skb;
         unsigned int mss = tcp_current_mss(sk, 0);
-        int lost = 0;
+        u32 prior_lost = tp->lost_out;
 
         tcp_for_write_queue(skb, sk) {
                 if (skb == tcp_send_head(sk))
@@ -1849,17 +1851,13 @@ void tcp_simple_retransmit(struct sock *sk)
                                 TCP_SKB_CB(skb)->sacked &= ~TCPCB_SACKED_RETRANS;
                                 tp->retrans_out -= tcp_skb_pcount(skb);
                         }
-                        if (!(TCP_SKB_CB(skb)->sacked & TCPCB_LOST)) {
-                                TCP_SKB_CB(skb)->sacked |= TCPCB_LOST;
-                                tp->lost_out += tcp_skb_pcount(skb);
-                                lost = 1;
-                        }
+                        tcp_skb_mark_lost_uncond_verify(tp, skb);
                 }
         }
 
-        tcp_clear_all_retrans_hints(tp);
+        tcp_clear_retrans_hints_partial(tp);
 
-        if (!lost)
+        if (prior_lost == tp->lost_out)
                 return;
 
         if (tcp_is_reno(tp))
@@ -1934,8 +1932,8 @@ int tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb)
         /* Collapse two adjacent packets if worthwhile and we can. */
         if (!(TCP_SKB_CB(skb)->flags & TCPCB_FLAG_SYN) &&
             (skb->len < (cur_mss >> 1)) &&
-            (tcp_write_queue_next(sk, skb) != tcp_send_head(sk)) &&
             (!tcp_skb_is_last(sk, skb)) &&
+            (tcp_write_queue_next(sk, skb) != tcp_send_head(sk)) &&
             (skb_shinfo(skb)->nr_frags == 0 &&
              skb_shinfo(tcp_write_queue_next(sk, skb))->nr_frags == 0) &&
             (tcp_skb_pcount(skb) == 1 &&
@@ -1996,86 +1994,18 @@ int tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb)
         return err;
 }
 
-/* This gets called after a retransmit timeout, and the initially
- * retransmitted data is acknowledged.  It tries to continue
- * resending the rest of the retransmit queue, until either
- * we've sent it all or the congestion window limit is reached.
- * If doing SACK, the first ACK which comes back for a timeout
- * based retransmit packet might feed us FACK information again.
- * If so, we use it to avoid unnecessarily retransmissions.
- */
-void tcp_xmit_retransmit_queue(struct sock *sk)
+static int tcp_can_forward_retransmit(struct sock *sk)
 {
         const struct inet_connection_sock *icsk = inet_csk(sk);
         struct tcp_sock *tp = tcp_sk(sk);
-        struct sk_buff *skb;
-        int packet_cnt;
-
-        if (tp->retransmit_skb_hint) {
-                skb = tp->retransmit_skb_hint;
-                packet_cnt = tp->retransmit_cnt_hint;
-        } else {
-                skb = tcp_write_queue_head(sk);
-                packet_cnt = 0;
-        }
-
-        /* First pass: retransmit lost packets. */
-        if (tp->lost_out) {
-                tcp_for_write_queue_from(skb, sk) {
-                        __u8 sacked = TCP_SKB_CB(skb)->sacked;
-
-                        if (skb == tcp_send_head(sk))
-                                break;
-                        /* we could do better than to assign each time */
-                        tp->retransmit_skb_hint = skb;
-                        tp->retransmit_cnt_hint = packet_cnt;
-
-                        /* Assume this retransmit will generate
-                         * only one packet for congestion window
-                         * calculation purposes.  This works because
-                         * tcp_retransmit_skb() will chop up the
-                         * packet to be MSS sized and all the
-                         * packet counting works out.
-                         */
-                        if (tcp_packets_in_flight(tp) >= tp->snd_cwnd)
-                                return;
-
-                        if (sacked & TCPCB_LOST) {
-                                if (!(sacked & (TCPCB_SACKED_ACKED|TCPCB_SACKED_RETRANS))) {
-                                        int mib_idx;
-
-                                        if (tcp_retransmit_skb(sk, skb)) {
-                                                tp->retransmit_skb_hint = NULL;
-                                                return;
-                                        }
-                                        if (icsk->icsk_ca_state != TCP_CA_Loss)
-                                                mib_idx = LINUX_MIB_TCPFASTRETRANS;
-                                        else
-                                                mib_idx = LINUX_MIB_TCPSLOWSTARTRETRANS;
-                                        NET_INC_STATS_BH(sock_net(sk), mib_idx);
-
-                                        if (skb == tcp_write_queue_head(sk))
-                                                inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS,
-                                                                          inet_csk(sk)->icsk_rto,
-                                                                          TCP_RTO_MAX);
-                                }
-
-                                packet_cnt += tcp_skb_pcount(skb);
-                                if (packet_cnt >= tp->lost_out)
-                                        break;
-                        }
-                }
-        }
-
-        /* OK, demanded retransmission is finished. */
 
         /* Forward retransmissions are possible only during Recovery. */
         if (icsk->icsk_ca_state != TCP_CA_Recovery)
-                return;
+                return 0;
 
         /* No forward retransmissions in Reno are possible. */
         if (tcp_is_reno(tp))
-                return;
+                return 0;
 
         /* Yeah, we have to make difficult choice between forward transmission
          * and retransmission... Both ways have their merits...
@@ -2086,43 +2016,104 @@ void tcp_xmit_retransmit_queue(struct sock *sk)
          */
 
         if (tcp_may_send_now(sk))
-                return;
+                return 0;
 
-        /* If nothing is SACKed, highest_sack in the loop won't be valid */
-        if (!tp->sacked_out)
-                return;
+        return 1;
+}
 
-        if (tp->forward_skb_hint)
-                skb = tp->forward_skb_hint;
-        else
+/* This gets called after a retransmit timeout, and the initially
+ * retransmitted data is acknowledged.  It tries to continue
+ * resending the rest of the retransmit queue, until either
+ * we've sent it all or the congestion window limit is reached.
+ * If doing SACK, the first ACK which comes back for a timeout
+ * based retransmit packet might feed us FACK information again.
+ * If so, we use it to avoid unnecessarily retransmissions.
+ */
+void tcp_xmit_retransmit_queue(struct sock *sk)
+{
+        const struct inet_connection_sock *icsk = inet_csk(sk);
+        struct tcp_sock *tp = tcp_sk(sk);
+        struct sk_buff *skb;
+        struct sk_buff *hole = NULL;
+        u32 last_lost;
+        int mib_idx;
+        int fwd_rexmitting = 0;
+
+        if (!tp->lost_out)
+                tp->retransmit_high = tp->snd_una;
+
+        if (tp->retransmit_skb_hint) {
+                skb = tp->retransmit_skb_hint;
+                last_lost = TCP_SKB_CB(skb)->end_seq;
+                if (after(last_lost, tp->retransmit_high))
+                        last_lost = tp->retransmit_high;
+        } else {
                 skb = tcp_write_queue_head(sk);
+                last_lost = tp->snd_una;
+        }
 
+        /* First pass: retransmit lost packets. */
         tcp_for_write_queue_from(skb, sk) {
-                if (skb == tcp_send_head(sk))
-                        break;
-                tp->forward_skb_hint = skb;
+                __u8 sacked = TCP_SKB_CB(skb)->sacked;
 
-                if (!before(TCP_SKB_CB(skb)->seq, tcp_highest_sack_seq(tp)))
+                if (skb == tcp_send_head(sk))
                         break;
+                /* we could do better than to assign each time */
+                if (hole == NULL)
+                        tp->retransmit_skb_hint = skb;
 
+                /* Assume this retransmit will generate
+                 * only one packet for congestion window
+                 * calculation purposes.  This works because
+                 * tcp_retransmit_skb() will chop up the
+                 * packet to be MSS sized and all the
+                 * packet counting works out.
+                 */
                 if (tcp_packets_in_flight(tp) >= tp->snd_cwnd)
-                        break;
+                        return;
+
+                if (fwd_rexmitting) {
+begin_fwd:
+                        if (!before(TCP_SKB_CB(skb)->seq, tcp_highest_sack_seq(tp)))
+                                break;
+                        mib_idx = LINUX_MIB_TCPFORWARDRETRANS;
+
+                } else if (!before(TCP_SKB_CB(skb)->seq, tp->retransmit_high)) {
+                        tp->retransmit_high = last_lost;
+                        if (!tcp_can_forward_retransmit(sk))
+                                break;
+                        /* Backtrack if necessary to non-L'ed skb */
+                        if (hole != NULL) {
+                                skb = hole;
+                                hole = NULL;
+                        }
+                        fwd_rexmitting = 1;
+                        goto begin_fwd;
 
-                if (TCP_SKB_CB(skb)->sacked & TCPCB_TAGBITS)
+                } else if (!(sacked & TCPCB_LOST)) {
+                        if (hole == NULL && !(sacked & TCPCB_SACKED_RETRANS))
+                                hole = skb;
                         continue;
 
-                /* Ok, retransmit it. */
-                if (tcp_retransmit_skb(sk, skb)) {
-                        tp->forward_skb_hint = NULL;
-                        break;
+                } else {
+                        last_lost = TCP_SKB_CB(skb)->end_seq;
+                        if (icsk->icsk_ca_state != TCP_CA_Loss)
+                                mib_idx = LINUX_MIB_TCPFASTRETRANS;
+                        else
+                                mib_idx = LINUX_MIB_TCPSLOWSTARTRETRANS;
                 }
 
+                if (sacked & (TCPCB_SACKED_ACKED|TCPCB_SACKED_RETRANS))
+                        continue;
+
+                if (tcp_retransmit_skb(sk, skb))
+                        return;
+                NET_INC_STATS_BH(sock_net(sk), mib_idx);
+
                 if (skb == tcp_write_queue_head(sk))
                         inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS,
                                                   inet_csk(sk)->icsk_rto,
                                                   TCP_RTO_MAX);
-
-                NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPFORWARDRETRANS);
         }
 }
 
@@ -2241,6 +2232,7 @@ struct sk_buff *tcp_make_synack(struct sock *sk, struct dst_entry *dst,
         struct sk_buff *skb;
         struct tcp_md5sig_key *md5;
         __u8 *md5_hash_location;
+        int mss;
 
         skb = sock_wmalloc(sk, MAX_TCP_HEADER + 15, 1, GFP_ATOMIC);
         if (skb == NULL)
@@ -2251,13 +2243,17 @@ struct sk_buff *tcp_make_synack(struct sock *sk, struct dst_entry *dst,
 
         skb->dst = dst_clone(dst);
 
+        mss = dst_metric(dst, RTAX_ADVMSS);
+        if (tp->rx_opt.user_mss && tp->rx_opt.user_mss < mss)
+                mss = tp->rx_opt.user_mss;
+
         if (req->rcv_wnd == 0) { /* ignored for retransmitted syns */
                 __u8 rcv_wscale;
                 /* Set this up on the first call only */
                 req->window_clamp = tp->window_clamp ? : dst_metric(dst, RTAX_WINDOW);
                 /* tcp_full_space because it is guaranteed to be the first packet */
                 tcp_select_initial_window(tcp_full_space(sk),
-                        dst_metric(dst, RTAX_ADVMSS) - (ireq->tstamp_ok ? TCPOLEN_TSTAMP_ALIGNED : 0),
+                        mss - (ireq->tstamp_ok ? TCPOLEN_TSTAMP_ALIGNED : 0),
                         &req->rcv_wnd,
                         &req->window_clamp,
                         ireq->wscale_ok,
@@ -2267,8 +2263,7 @@ struct sk_buff *tcp_make_synack(struct sock *sk, struct dst_entry *dst,
 
         memset(&opts, 0, sizeof(opts));
         TCP_SKB_CB(skb)->when = tcp_time_stamp;
-        tcp_header_size = tcp_synack_options(sk, req,
-                                             dst_metric(dst, RTAX_ADVMSS),
+        tcp_header_size = tcp_synack_options(sk, req, mss,
                                              skb, &opts, &md5) +
                           sizeof(struct tcphdr);
 
@@ -2342,6 +2337,9 @@ static void tcp_connect_init(struct sock *sk)
         if (!tp->window_clamp)
                 tp->window_clamp = dst_metric(dst, RTAX_WINDOW);
         tp->advmss = dst_metric(dst, RTAX_ADVMSS);
+        if (tp->rx_opt.user_mss && tp->rx_opt.user_mss < tp->advmss)
+                tp->advmss = tp->rx_opt.user_mss;
+
         tcp_initialize_rcv_mss(sk);
 
         tcp_select_initial_window(tcp_full_space(sk),
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 17c7b098cdb0..64ce3d33d9c6 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -1050,10 +1050,10 @@ ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
         }
 
         switch (skb->protocol) {
-        case __constant_htons(ETH_P_IP):
+        case htons(ETH_P_IP):
                 ret = ip4ip6_tnl_xmit(skb, dev);
                 break;
-        case __constant_htons(ETH_P_IPV6):
+        case htons(ETH_P_IPV6):
                 ret = ip6ip6_tnl_xmit(skb, dev);
                 break;
         default:
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index 52d06dd4b817..9967ac7a01a8 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -27,7 +27,6 @@
 #include <linux/ipv6.h>
 #include <linux/icmpv6.h>
 #include <linux/random.h>
-#include <linux/jhash.h>
 
 #include <net/sock.h>
 #include <net/snmp.h>
@@ -103,39 +102,12 @@ struct ctl_table nf_ct_ipv6_sysctl_table[] = {
 };
 #endif
 
-static unsigned int ip6qhashfn(__be32 id, const struct in6_addr *saddr,
-                               const struct in6_addr *daddr)
-{
-        u32 a, b, c;
-
-        a = (__force u32)saddr->s6_addr32[0];
-        b = (__force u32)saddr->s6_addr32[1];
-        c = (__force u32)saddr->s6_addr32[2];
-
-        a += JHASH_GOLDEN_RATIO;
-        b += JHASH_GOLDEN_RATIO;
-        c += nf_frags.rnd;
-        __jhash_mix(a, b, c);
-
-        a += (__force u32)saddr->s6_addr32[3];
-        b += (__force u32)daddr->s6_addr32[0];
-        c += (__force u32)daddr->s6_addr32[1];
-        __jhash_mix(a, b, c);
-
-        a += (__force u32)daddr->s6_addr32[2];
-        b += (__force u32)daddr->s6_addr32[3];
-        c += (__force u32)id;
-        __jhash_mix(a, b, c);
-
-        return c & (INETFRAGS_HASHSZ - 1);
-}
-
 static unsigned int nf_hashfn(struct inet_frag_queue *q)
 {
         const struct nf_ct_frag6_queue *nq;
 
         nq = container_of(q, struct nf_ct_frag6_queue, q);
-        return ip6qhashfn(nq->id, &nq->saddr, &nq->daddr);
+        return inet6_hash_frag(nq->id, &nq->saddr, &nq->daddr, nf_frags.rnd);
 }
 
 static void nf_skb_free(struct sk_buff *skb)
@@ -209,7 +181,7 @@ fq_find(__be32 id, struct in6_addr *src, struct in6_addr *dst)
         arg.dst = dst;
 
         read_lock_bh(&nf_frags.lock);
-        hash = ip6qhashfn(id, src, dst);
+        hash = inet6_hash_frag(id, src, dst, nf_frags.rnd);
 
         q = inet_frag_find(&nf_init_frags, &nf_frags, &arg, hash);
         local_bh_enable();
diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
index 89184b576e23..2eeadfa039cb 100644
--- a/net/ipv6/reassembly.c
+++ b/net/ipv6/reassembly.c
@@ -99,8 +99,8 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev,
  * callers should be careful not to use the hash value outside the ipfrag_lock
  * as doing so could race with ipfrag_hash_rnd being recalculated.
  */
-static unsigned int ip6qhashfn(__be32 id, struct in6_addr *saddr,
-                               struct in6_addr *daddr)
+unsigned int inet6_hash_frag(__be32 id, const struct in6_addr *saddr,
+                             const struct in6_addr *daddr, u32 rnd)
 {
         u32 a, b, c;
 
@@ -110,7 +110,7 @@ static unsigned int ip6qhashfn(__be32 id, struct in6_addr *saddr,
 
         a += JHASH_GOLDEN_RATIO;
         b += JHASH_GOLDEN_RATIO;
-        c += ip6_frags.rnd;
+        c += rnd;
         __jhash_mix(a, b, c);
 
         a += (__force u32)saddr->s6_addr32[3];
@@ -125,13 +125,14 @@ static unsigned int ip6qhashfn(__be32 id, struct in6_addr *saddr,
 
         return c & (INETFRAGS_HASHSZ - 1);
 }
+EXPORT_SYMBOL_GPL(inet6_hash_frag);
 
 static unsigned int ip6_hashfn(struct inet_frag_queue *q)
 {
         struct frag_queue *fq;
 
         fq = container_of(q, struct frag_queue, q);
-        return ip6qhashfn(fq->id, &fq->saddr, &fq->daddr);
+        return inet6_hash_frag(fq->id, &fq->saddr, &fq->daddr, ip6_frags.rnd);
 }
 
 int ip6_frag_match(struct inet_frag_queue *q, void *a)
@@ -247,7 +248,7 @@ fq_find(struct net *net, __be32 id, struct in6_addr *src, struct in6_addr *dst,
         arg.dst = dst;
 
         read_lock(&ip6_frags.lock);
-        hash = ip6qhashfn(id, src, dst);
+        hash = inet6_hash_frag(id, src, dst, ip6_frags.rnd);
 
         q = inet_frag_find(&net->ipv6.frags, &ip6_frags, &arg, hash);
         if (q == NULL)
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 63442a1e741c..f4385a6569c2 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1003,6 +1003,25 @@ int icmp6_dst_gc(void)
         return more;
 }
 
+static void icmp6_clean_all(int (*func)(struct rt6_info *rt, void *arg),
+                            void *arg)
+{
+        struct dst_entry *dst, **pprev;
+
+        spin_lock_bh(&icmp6_dst_lock);
+        pprev = &icmp6_dst_gc_list;
+        while ((dst = *pprev) != NULL) {
+                struct rt6_info *rt = (struct rt6_info *) dst;
+                if (func(rt, arg)) {
+                        *pprev = dst->next;
+                        dst_free(dst);
+                } else {
+                        pprev = &dst->next;
+                }
+        }
+        spin_unlock_bh(&icmp6_dst_lock);
+}
+
 static int ip6_dst_gc(struct dst_ops *ops)
 {
         unsigned long now = jiffies;
@@ -1930,6 +1949,7 @@ void rt6_ifdown(struct net *net, struct net_device *dev)
         };
 
         fib6_clean_all(net, fib6_ifdown, 0, &adn);
+        icmp6_clean_all(fib6_ifdown, &adn);
 }
 
 struct rt6_mtu_change_arg
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 10e22fd48222..df16b68644e7 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1286,7 +1286,7 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
                                           struct request_sock *req,
                                           struct dst_entry *dst)
 {
-        struct inet6_request_sock *treq = inet6_rsk(req);
+        struct inet6_request_sock *treq;
         struct ipv6_pinfo *newnp, *np = inet6_sk(sk);
         struct tcp6_sock *newtcp6sk;
         struct inet_sock *newinet;
@@ -1350,6 +1350,7 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
                 return newsk;
         }
 
+        treq = inet6_rsk(req);
         opt = np->opt;
 
         if (sk_acceptq_is_full(sk))
diff --git a/net/mac80211/Kconfig b/net/mac80211/Kconfig
index 80d693392b0f..8427518e4f20 100644
--- a/net/mac80211/Kconfig
+++ b/net/mac80211/Kconfig
@@ -179,19 +179,6 @@ config MAC80211_VERBOSE_MPL_DEBUG
 
           Do not select this option.
 
-config MAC80211_LOWTX_FRAME_DUMP
-        bool "Debug frame dumping"
-        depends on MAC80211_DEBUG_MENU
-        ---help---
-          Selecting this option will cause the stack to
-          print a message for each frame that is handed
-          to the lowlevel driver for transmission. This
-          message includes all MAC addresses and the
-          frame control field.
-
-          If unsure, say N and insert the debugging code
-          you require into the driver you are debugging.
-
 config MAC80211_DEBUG_COUNTERS
         bool "Extra statistics for TX/RX debugging"
         depends on MAC80211_DEBUG_MENU
diff --git a/net/mac80211/Makefile b/net/mac80211/Makefile
index a169b0201d61..2dc8f2bff27b 100644
--- a/net/mac80211/Makefile
+++ b/net/mac80211/Makefile
@@ -7,6 +7,8 @@ mac80211-y := \
         sta_info.o \
         wep.o \
         wpa.o \
+        scan.o \
+        ht.o \
         mlme.o \
         iface.o \
         rate.o \
@@ -15,6 +17,7 @@ mac80211-y := \
         aes_ccm.o \
         cfg.o \
         rx.o \
+        spectmgmt.o \
         tx.o \
         key.o \
         util.o \
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 297c257864c7..855126a3039d 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -17,26 +17,26 @@
 #include "rate.h"
 #include "mesh.h"
 
-static enum ieee80211_if_types
-nl80211_type_to_mac80211_type(enum nl80211_iftype type)
+struct ieee80211_hw *wiphy_to_hw(struct wiphy *wiphy)
+{
+        struct ieee80211_local *local = wiphy_priv(wiphy);
+        return &local->hw;
+}
+EXPORT_SYMBOL(wiphy_to_hw);
+
+static bool nl80211_type_check(enum nl80211_iftype type)
 {
         switch (type) {
-        case NL80211_IFTYPE_UNSPECIFIED:
-                return IEEE80211_IF_TYPE_STA;
         case NL80211_IFTYPE_ADHOC:
-                return IEEE80211_IF_TYPE_IBSS;
         case NL80211_IFTYPE_STATION:
-                return IEEE80211_IF_TYPE_STA;
         case NL80211_IFTYPE_MONITOR:
-                return IEEE80211_IF_TYPE_MNTR;
 #ifdef CONFIG_MAC80211_MESH
         case NL80211_IFTYPE_MESH_POINT:
-                return IEEE80211_IF_TYPE_MESH_POINT;
 #endif
         case NL80211_IFTYPE_WDS:
-                return IEEE80211_IF_TYPE_WDS;
+                return true;
         default:
-                return IEEE80211_IF_TYPE_INVALID;
+                return false;
         }
 }
 
@@ -45,17 +45,15 @@ static int ieee80211_add_iface(struct wiphy *wiphy, char *name,
                                struct vif_params *params)
 {
         struct ieee80211_local *local = wiphy_priv(wiphy);
-        enum ieee80211_if_types itype;
         struct net_device *dev;
         struct ieee80211_sub_if_data *sdata;
         int err;
 
-        itype = nl80211_type_to_mac80211_type(type);
-        if (itype == IEEE80211_IF_TYPE_INVALID)
+        if (!nl80211_type_check(type))
                 return -EINVAL;
 
-        err = ieee80211_if_add(local, name, &dev, itype, params);
-        if (err || itype != IEEE80211_IF_TYPE_MNTR || !flags)
+        err = ieee80211_if_add(local, name, &dev, type, params);
+        if (err || type != NL80211_IFTYPE_MONITOR || !flags)
                 return err;
 
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
@@ -66,13 +64,16 @@ static int ieee80211_add_iface(struct wiphy *wiphy, char *name,
 static int ieee80211_del_iface(struct wiphy *wiphy, int ifindex)
 {
         struct net_device *dev;
+        struct ieee80211_sub_if_data *sdata;
 
         /* we're under RTNL */
         dev = __dev_get_by_index(&init_net, ifindex);
         if (!dev)
                 return -ENODEV;
 
-        ieee80211_if_remove(dev);
+        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+
+        ieee80211_if_remove(sdata);
 
         return 0;
 }
@@ -81,9 +82,7 @@ static int ieee80211_change_iface(struct wiphy *wiphy, int ifindex,
                                   enum nl80211_iftype type, u32 *flags,
                                   struct vif_params *params)
 {
-        struct ieee80211_local *local = wiphy_priv(wiphy);
         struct net_device *dev;
-        enum ieee80211_if_types itype;
         struct ieee80211_sub_if_data *sdata;
         int ret;
 
@@ -92,25 +91,24 @@ static int ieee80211_change_iface(struct wiphy *wiphy, int ifindex,
         if (!dev)
                 return -ENODEV;
 
-        itype = nl80211_type_to_mac80211_type(type);
-        if (itype == IEEE80211_IF_TYPE_INVALID)
+        if (!nl80211_type_check(type))
                 return -EINVAL;
 
-        if (dev == local->mdev)
-                return -EOPNOTSUPP;
-
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
-        ret = ieee80211_if_change_type(sdata, itype);
+        ret = ieee80211_if_change_type(sdata, type);
         if (ret)
                 return ret;
 
+        if (netif_running(sdata->dev))
+                return -EBUSY;
+
         if (ieee80211_vif_is_mesh(&sdata->vif) && params->mesh_id_len)
-                ieee80211_if_sta_set_mesh_id(&sdata->u.sta,
-                                             params->mesh_id_len,
-                                             params->mesh_id);
+                ieee80211_sdata_set_mesh_id(sdata,
+                                            params->mesh_id_len,
+                                            params->mesh_id);
 
-        if (sdata->vif.type != IEEE80211_IF_TYPE_MNTR || !flags)
+        if (sdata->vif.type != NL80211_IFTYPE_MONITOR || !flags)
                 return 0;
 
         sdata->u.mntr_flags = *flags;
@@ -121,16 +119,12 @@ static int ieee80211_add_key(struct wiphy *wiphy, struct net_device *dev,
                              u8 key_idx, u8 *mac_addr,
                              struct key_params *params)
 {
-        struct ieee80211_local *local = wiphy_priv(wiphy);
         struct ieee80211_sub_if_data *sdata;
         struct sta_info *sta = NULL;
         enum ieee80211_key_alg alg;
         struct ieee80211_key *key;
         int err;
 
-        if (dev == local->mdev)
-                return -EOPNOTSUPP;
-
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
         switch (params->cipher) {
@@ -175,14 +169,10 @@ static int ieee80211_add_key(struct wiphy *wiphy, struct net_device *dev,
 static int ieee80211_del_key(struct wiphy *wiphy, struct net_device *dev,
                              u8 key_idx, u8 *mac_addr)
 {
-        struct ieee80211_local *local = wiphy_priv(wiphy);
         struct ieee80211_sub_if_data *sdata;
         struct sta_info *sta;
         int ret;
 
-        if (dev == local->mdev)
-                return -EOPNOTSUPP;
-
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
         rcu_read_lock();
@@ -223,7 +213,6 @@ static int ieee80211_get_key(struct wiphy *wiphy, struct net_device *dev,
                              void (*callback)(void *cookie,
                                               struct key_params *params))
 {
-        struct ieee80211_local *local = wiphy_priv(wiphy);
         struct ieee80211_sub_if_data *sdata;
         struct sta_info *sta = NULL;
         u8 seq[6] = {0};
@@ -233,9 +222,6 @@ static int ieee80211_get_key(struct wiphy *wiphy, struct net_device *dev,
         u16 iv16;
         int err = -ENOENT;
 
-        if (dev == local->mdev)
-                return -EOPNOTSUPP;
-
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
         rcu_read_lock();
@@ -311,12 +297,8 @@ static int ieee80211_config_default_key(struct wiphy *wiphy,
                                         struct net_device *dev,
                                         u8 key_idx)
 {
-        struct ieee80211_local *local = wiphy_priv(wiphy);
         struct ieee80211_sub_if_data *sdata;
 
-        if (dev == local->mdev)
-                return -EOPNOTSUPP;
-
         rcu_read_lock();
 
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
@@ -365,7 +347,7 @@ static int ieee80211_dump_station(struct wiphy *wiphy, struct net_device *dev,
         sta = sta_info_get_by_idx(local, idx, dev);
         if (sta) {
                 ret = 0;
-                memcpy(mac, sta->addr, ETH_ALEN);
+                memcpy(mac, sta->sta.addr, ETH_ALEN);
                 sta_set_sinfo(sta, sinfo);
         }
 
@@ -497,16 +479,12 @@ static int ieee80211_config_beacon(struct ieee80211_sub_if_data *sdata,
 static int ieee80211_add_beacon(struct wiphy *wiphy, struct net_device *dev,
                                 struct beacon_parameters *params)
 {
-        struct ieee80211_local *local = wiphy_priv(wiphy);
         struct ieee80211_sub_if_data *sdata;
         struct beacon_data *old;
 
-        if (dev == local->mdev)
-                return -EOPNOTSUPP;
-
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
-        if (sdata->vif.type != IEEE80211_IF_TYPE_AP)
+        if (sdata->vif.type != NL80211_IFTYPE_AP)
                 return -EINVAL;
 
         old = sdata->u.ap.beacon;
@@ -520,16 +498,12 @@ static int ieee80211_add_beacon(struct wiphy *wiphy, struct net_device *dev,
 static int ieee80211_set_beacon(struct wiphy *wiphy, struct net_device *dev,
                                 struct beacon_parameters *params)
 {
-        struct ieee80211_local *local = wiphy_priv(wiphy);
         struct ieee80211_sub_if_data *sdata;
         struct beacon_data *old;
 
-        if (dev == local->mdev)
-                return -EOPNOTSUPP;
-
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
-        if (sdata->vif.type != IEEE80211_IF_TYPE_AP)
+        if (sdata->vif.type != NL80211_IFTYPE_AP)
                 return -EINVAL;
 
         old = sdata->u.ap.beacon;
@@ -542,16 +516,12 @@ static int ieee80211_set_beacon(struct wiphy *wiphy, struct net_device *dev,
 
 static int ieee80211_del_beacon(struct wiphy *wiphy, struct net_device *dev)
 {
-        struct ieee80211_local *local = wiphy_priv(wiphy);
         struct ieee80211_sub_if_data *sdata;
         struct beacon_data *old;
 
-        if (dev == local->mdev)
-                return -EOPNOTSUPP;
-
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
-        if (sdata->vif.type != IEEE80211_IF_TYPE_AP)
+        if (sdata->vif.type != NL80211_IFTYPE_AP)
                 return -EINVAL;
 
         old = sdata->u.ap.beacon;
@@ -594,7 +564,7 @@ static void ieee80211_send_layer2_update(struct sta_info *sta)
          * Update response frame; IEEE Std 802.2-1998, 5.4.1.2.1 */
 
         memset(msg->da, 0xff, ETH_ALEN);
-        memcpy(msg->sa, sta->addr, ETH_ALEN);
+        memcpy(msg->sa, sta->sta.addr, ETH_ALEN);
         msg->len = htons(6);
         msg->dsap = 0;
         msg->ssap = 0x01;       /* NULL LSAP, CR Bit: Response */
@@ -649,9 +619,9 @@ static void sta_apply_parameters(struct ieee80211_local *local,
          */
 
         if (params->aid) {
-                sta->aid = params->aid;
-                if (sta->aid > IEEE80211_MAX_AID)
-                        sta->aid = 0; /* XXX: should this be an error? */
+                sta->sta.aid = params->aid;
+                if (sta->sta.aid > IEEE80211_MAX_AID)
+                        sta->sta.aid = 0; /* XXX: should this be an error? */
         }
 
         if (params->listen_interval >= 0)
@@ -668,7 +638,12 @@ static void sta_apply_parameters(struct ieee80211_local *local,
                                         rates |= BIT(j);
                         }
                 }
-                sta->supp_rates[local->oper_channel->band] = rates;
+                sta->sta.supp_rates[local->oper_channel->band] = rates;
+        }
+
+        if (params->ht_capa) {
+                ieee80211_ht_cap_ie_to_ht_info(params->ht_capa,
+                                               &sta->sta.ht_info);
         }
 
         if (ieee80211_vif_is_mesh(&sdata->vif) && params->plink_action) {
@@ -691,9 +666,6 @@ static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev,
         struct ieee80211_sub_if_data *sdata;
         int err;
 
-        if (dev == local->mdev || params->vlan == local->mdev)
-                return -EOPNOTSUPP;
-
         /* Prevent a race with changing the rate control algorithm */
         if (!netif_running(dev))
                 return -ENETDOWN;
@@ -701,8 +673,8 @@ static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev,
         if (params->vlan) {
                 sdata = IEEE80211_DEV_TO_SUB_IF(params->vlan);
 
-                if (sdata->vif.type != IEEE80211_IF_TYPE_VLAN &&
-                    sdata->vif.type != IEEE80211_IF_TYPE_AP)
+                if (sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
+                    sdata->vif.type != NL80211_IFTYPE_AP)
                         return -EINVAL;
         } else
                 sdata = IEEE80211_DEV_TO_SUB_IF(dev);
@@ -721,7 +693,7 @@ static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev,
 
         sta_apply_parameters(local, sta, params);
 
-        rate_control_rate_init(sta, local);
+        rate_control_rate_init(sta);
 
         rcu_read_lock();
 
@@ -732,8 +704,8 @@ static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev,
                 return err;
         }
 
-        if (sdata->vif.type == IEEE80211_IF_TYPE_VLAN ||
-            sdata->vif.type == IEEE80211_IF_TYPE_AP)
+        if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
+            sdata->vif.type == NL80211_IFTYPE_AP)
                 ieee80211_send_layer2_update(sta);
 
         rcu_read_unlock();
@@ -748,9 +720,6 @@ static int ieee80211_del_station(struct wiphy *wiphy, struct net_device *dev,
         struct ieee80211_sub_if_data *sdata;
         struct sta_info *sta;
 
-        if (dev == local->mdev)
-                return -EOPNOTSUPP;
-
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
         if (mac) {
@@ -782,9 +751,6 @@ static int ieee80211_change_station(struct wiphy *wiphy,
         struct sta_info *sta;
         struct ieee80211_sub_if_data *vlansdata;
 
-        if (dev == local->mdev || params->vlan == local->mdev)
-                return -EOPNOTSUPP;
-
         rcu_read_lock();
 
         /* XXX: get sta belonging to dev */
@@ -797,8 +763,8 @@ static int ieee80211_change_station(struct wiphy *wiphy,
         if (params->vlan && params->vlan != sta->sdata->dev) {
                 vlansdata = IEEE80211_DEV_TO_SUB_IF(params->vlan);
 
-                if (vlansdata->vif.type != IEEE80211_IF_TYPE_VLAN &&
-                    vlansdata->vif.type != IEEE80211_IF_TYPE_AP) {
+                if (vlansdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
+                    vlansdata->vif.type != NL80211_IFTYPE_AP) {
                         rcu_read_unlock();
                         return -EINVAL;
                 }
@@ -824,15 +790,12 @@ static int ieee80211_add_mpath(struct wiphy *wiphy, struct net_device *dev,
         struct sta_info *sta;
         int err;
 
-        if (dev == local->mdev)
-                return -EOPNOTSUPP;
-
         if (!netif_running(dev))
                 return -ENETDOWN;
 
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
-        if (sdata->vif.type != IEEE80211_IF_TYPE_MESH_POINT)
+        if (sdata->vif.type != NL80211_IFTYPE_MESH_POINT)
                 return -ENOTSUPP;
 
         rcu_read_lock();
@@ -842,13 +805,13 @@ static int ieee80211_add_mpath(struct wiphy *wiphy, struct net_device *dev,
                 return -ENOENT;
         }
 
-        err = mesh_path_add(dst, dev);
+        err = mesh_path_add(dst, sdata);
         if (err) {
                 rcu_read_unlock();
                 return err;
         }
 
-        mpath = mesh_path_lookup(dst, dev);
+        mpath = mesh_path_lookup(dst, sdata);
         if (!mpath) {
                 rcu_read_unlock();
                 return -ENXIO;
@@ -862,10 +825,12 @@ static int ieee80211_add_mpath(struct wiphy *wiphy, struct net_device *dev,
 static int ieee80211_del_mpath(struct wiphy *wiphy, struct net_device *dev,
                                  u8 *dst)
 {
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+
         if (dst)
-                return mesh_path_del(dst, dev);
+                return mesh_path_del(dst, sdata);
 
-        mesh_path_flush(dev);
+        mesh_path_flush(sdata);
         return 0;
 }
 
@@ -878,15 +843,12 @@ static int ieee80211_change_mpath(struct wiphy *wiphy,
         struct mesh_path *mpath;
         struct sta_info *sta;
 
-        if (dev == local->mdev)
-                return -EOPNOTSUPP;
-
         if (!netif_running(dev))
                 return -ENETDOWN;
 
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
-        if (sdata->vif.type != IEEE80211_IF_TYPE_MESH_POINT)
+        if (sdata->vif.type != NL80211_IFTYPE_MESH_POINT)
                 return -ENOTSUPP;
 
         rcu_read_lock();
@@ -897,7 +859,7 @@ static int ieee80211_change_mpath(struct wiphy *wiphy,
                 return -ENOENT;
         }
 
-        mpath = mesh_path_lookup(dst, dev);
+        mpath = mesh_path_lookup(dst, sdata);
         if (!mpath) {
                 rcu_read_unlock();
                 return -ENOENT;
@@ -913,7 +875,7 @@ static void mpath_set_pinfo(struct mesh_path *mpath, u8 *next_hop,
                             struct mpath_info *pinfo)
 {
         if (mpath->next_hop)
-                memcpy(next_hop, mpath->next_hop->addr, ETH_ALEN);
+                memcpy(next_hop, mpath->next_hop->sta.addr, ETH_ALEN);
         else
                 memset(next_hop, 0, ETH_ALEN);
 
@@ -952,20 +914,16 @@ static int ieee80211_get_mpath(struct wiphy *wiphy, struct net_device *dev,
                                u8 *dst, u8 *next_hop, struct mpath_info *pinfo)
 
 {
-        struct ieee80211_local *local = wiphy_priv(wiphy);
         struct ieee80211_sub_if_data *sdata;
         struct mesh_path *mpath;
 
-        if (dev == local->mdev)
-                return -EOPNOTSUPP;
-
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
-        if (sdata->vif.type != IEEE80211_IF_TYPE_MESH_POINT)
+        if (sdata->vif.type != NL80211_IFTYPE_MESH_POINT)
                 return -ENOTSUPP;
 
         rcu_read_lock();
-        mpath = mesh_path_lookup(dst, dev);
+        mpath = mesh_path_lookup(dst, sdata);
         if (!mpath) {
                 rcu_read_unlock();
                 return -ENOENT;
@@ -980,20 +938,16 @@ static int ieee80211_dump_mpath(struct wiphy *wiphy, struct net_device *dev,
                                  int idx, u8 *dst, u8 *next_hop,
                                  struct mpath_info *pinfo)
 {
-        struct ieee80211_local *local = wiphy_priv(wiphy);
         struct ieee80211_sub_if_data *sdata;
         struct mesh_path *mpath;
 
-        if (dev == local->mdev)
-                return -EOPNOTSUPP;
-
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
-        if (sdata->vif.type != IEEE80211_IF_TYPE_MESH_POINT)
+        if (sdata->vif.type != NL80211_IFTYPE_MESH_POINT)
                 return -ENOTSUPP;
 
         rcu_read_lock();
-        mpath = mesh_path_lookup_by_idx(idx, dev);
+        mpath = mesh_path_lookup_by_idx(idx, sdata);
         if (!mpath) {
                 rcu_read_unlock();
                 return -ENOENT;
@@ -1005,6 +959,38 @@ static int ieee80211_dump_mpath(struct wiphy *wiphy, struct net_device *dev,
 }
 #endif
 
+static int ieee80211_change_bss(struct wiphy *wiphy,
+                                struct net_device *dev,
+                                struct bss_parameters *params)
+{
+        struct ieee80211_sub_if_data *sdata;
+        u32 changed = 0;
+
+        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+
+        if (sdata->vif.type != NL80211_IFTYPE_AP)
+                return -EINVAL;
+
+        if (params->use_cts_prot >= 0) {
+                sdata->bss_conf.use_cts_prot = params->use_cts_prot;
+                changed |= BSS_CHANGED_ERP_CTS_PROT;
+        }
+        if (params->use_short_preamble >= 0) {
+                sdata->bss_conf.use_short_preamble =
+                        params->use_short_preamble;
+                changed |= BSS_CHANGED_ERP_PREAMBLE;
+        }
+        if (params->use_short_slot_time >= 0) {
+                sdata->bss_conf.use_short_slot =
+                        params->use_short_slot_time;
+                changed |= BSS_CHANGED_ERP_SLOT;
+        }
+
+        ieee80211_bss_info_change_notify(sdata, changed);
+
+        return 0;
+}
+
 struct cfg80211_ops mac80211_config_ops = {
         .add_virtual_intf = ieee80211_add_iface,
         .del_virtual_intf = ieee80211_del_iface,
@@ -1028,4 +1014,5 @@ struct cfg80211_ops mac80211_config_ops = {
         .get_mpath = ieee80211_get_mpath,
         .dump_mpath = ieee80211_dump_mpath,
 #endif
+        .change_bss = ieee80211_change_bss,
 };
diff --git a/net/mac80211/debugfs.c b/net/mac80211/debugfs.c
index ee509f1109e2..24ce54463310 100644
--- a/net/mac80211/debugfs.c
+++ b/net/mac80211/debugfs.c
@@ -51,8 +51,6 @@ DEBUGFS_READONLY_FILE(antenna_sel_tx, 20, "%d",
                       local->hw.conf.antenna_sel_tx);
 DEBUGFS_READONLY_FILE(antenna_sel_rx, 20, "%d",
                       local->hw.conf.antenna_sel_rx);
-DEBUGFS_READONLY_FILE(bridge_packets, 20, "%d",
-                      local->bridge_packets);
 DEBUGFS_READONLY_FILE(rts_threshold, 20, "%d",
                       local->rts_threshold);
 DEBUGFS_READONLY_FILE(fragmentation_threshold, 20, "%d",
@@ -206,7 +204,6 @@ void debugfs_hw_add(struct ieee80211_local *local)
         DEBUGFS_ADD(frequency);
         DEBUGFS_ADD(antenna_sel_tx);
         DEBUGFS_ADD(antenna_sel_rx);
-        DEBUGFS_ADD(bridge_packets);
         DEBUGFS_ADD(rts_threshold);
         DEBUGFS_ADD(fragmentation_threshold);
         DEBUGFS_ADD(short_retry_limit);
@@ -263,7 +260,6 @@ void debugfs_hw_del(struct ieee80211_local *local)
         DEBUGFS_DEL(frequency);
         DEBUGFS_DEL(antenna_sel_tx);
         DEBUGFS_DEL(antenna_sel_rx);
-        DEBUGFS_DEL(bridge_packets);
         DEBUGFS_DEL(rts_threshold);
         DEBUGFS_DEL(fragmentation_threshold);
         DEBUGFS_DEL(short_retry_limit);
diff --git a/net/mac80211/debugfs_key.c b/net/mac80211/debugfs_key.c
index cf82acec913a..a3294d109322 100644
--- a/net/mac80211/debugfs_key.c
+++ b/net/mac80211/debugfs_key.c
@@ -206,7 +206,8 @@ void ieee80211_debugfs_key_add(struct ieee80211_key *key)
         rcu_read_lock();
         sta = rcu_dereference(key->sta);
         if (sta)
-                sprintf(buf, "../../stations/%s", print_mac(mac, sta->addr));
+                sprintf(buf, "../../stations/%s",
+                        print_mac(mac, sta->sta.addr));
         rcu_read_unlock();
 
         /* using sta as a boolean is fine outside RCU lock */
diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c
index 8165df578c92..2a4515623776 100644
--- a/net/mac80211/debugfs_netdev.c
+++ b/net/mac80211/debugfs_netdev.c
@@ -173,7 +173,6 @@ IEEE80211_IF_FILE(assoc_tries, u.sta.assoc_tries, DEC);
 IEEE80211_IF_FILE(auth_algs, u.sta.auth_algs, HEX);
 IEEE80211_IF_FILE(auth_alg, u.sta.auth_alg, DEC);
 IEEE80211_IF_FILE(auth_transaction, u.sta.auth_transaction, DEC);
-IEEE80211_IF_FILE(num_beacons_sta, u.sta.num_beacons, DEC);
 
 static ssize_t ieee80211_if_fmt_flags(
         const struct ieee80211_sub_if_data *sdata, char *buf, int buflen)
@@ -192,7 +191,6 @@ __IEEE80211_IF_FILE(flags);
 /* AP attributes */
 IEEE80211_IF_FILE(num_sta_ps, u.ap.num_sta_ps, ATOMIC);
 IEEE80211_IF_FILE(dtim_count, u.ap.dtim_count, DEC);
-IEEE80211_IF_FILE(num_beacons, u.ap.num_beacons, DEC);
 
 static ssize_t ieee80211_if_fmt_num_buffered_multicast(
         const struct ieee80211_sub_if_data *sdata, char *buf, int buflen)
@@ -207,37 +205,37 @@ IEEE80211_IF_FILE(peer, u.wds.remote_addr, MAC);
 
 #ifdef CONFIG_MAC80211_MESH
 /* Mesh stats attributes */
-IEEE80211_IF_FILE(fwded_frames, u.sta.mshstats.fwded_frames, DEC);
-IEEE80211_IF_FILE(dropped_frames_ttl, u.sta.mshstats.dropped_frames_ttl, DEC);
+IEEE80211_IF_FILE(fwded_frames, u.mesh.mshstats.fwded_frames, DEC);
+IEEE80211_IF_FILE(dropped_frames_ttl, u.mesh.mshstats.dropped_frames_ttl, DEC);
 IEEE80211_IF_FILE(dropped_frames_no_route,
-                u.sta.mshstats.dropped_frames_no_route, DEC);
-IEEE80211_IF_FILE(estab_plinks, u.sta.mshstats.estab_plinks, ATOMIC);
+                u.mesh.mshstats.dropped_frames_no_route, DEC);
+IEEE80211_IF_FILE(estab_plinks, u.mesh.mshstats.estab_plinks, ATOMIC);
 
 /* Mesh parameters */
 IEEE80211_IF_WFILE(dot11MeshMaxRetries,
-                u.sta.mshcfg.dot11MeshMaxRetries, DEC, u8);
+                u.mesh.mshcfg.dot11MeshMaxRetries, DEC, u8);
 IEEE80211_IF_WFILE(dot11MeshRetryTimeout,
-                u.sta.mshcfg.dot11MeshRetryTimeout, DEC, u16);
+                u.mesh.mshcfg.dot11MeshRetryTimeout, DEC, u16);
 IEEE80211_IF_WFILE(dot11MeshConfirmTimeout,
-                u.sta.mshcfg.dot11MeshConfirmTimeout, DEC, u16);
+                u.mesh.mshcfg.dot11MeshConfirmTimeout, DEC, u16);
 IEEE80211_IF_WFILE(dot11MeshHoldingTimeout,
-                u.sta.mshcfg.dot11MeshHoldingTimeout, DEC, u16);
-IEEE80211_IF_WFILE(dot11MeshTTL, u.sta.mshcfg.dot11MeshTTL, DEC, u8);
-IEEE80211_IF_WFILE(auto_open_plinks, u.sta.mshcfg.auto_open_plinks, DEC, u8);
+                u.mesh.mshcfg.dot11MeshHoldingTimeout, DEC, u16);
+IEEE80211_IF_WFILE(dot11MeshTTL, u.mesh.mshcfg.dot11MeshTTL, DEC, u8);
+IEEE80211_IF_WFILE(auto_open_plinks, u.mesh.mshcfg.auto_open_plinks, DEC, u8);
 IEEE80211_IF_WFILE(dot11MeshMaxPeerLinks,
-                u.sta.mshcfg.dot11MeshMaxPeerLinks, DEC, u16);
+                u.mesh.mshcfg.dot11MeshMaxPeerLinks, DEC, u16);
 IEEE80211_IF_WFILE(dot11MeshHWMPactivePathTimeout,
-                u.sta.mshcfg.dot11MeshHWMPactivePathTimeout, DEC, u32);
+                u.mesh.mshcfg.dot11MeshHWMPactivePathTimeout, DEC, u32);
 IEEE80211_IF_WFILE(dot11MeshHWMPpreqMinInterval,
-                u.sta.mshcfg.dot11MeshHWMPpreqMinInterval, DEC, u16);
+                u.mesh.mshcfg.dot11MeshHWMPpreqMinInterval, DEC, u16);
 IEEE80211_IF_WFILE(dot11MeshHWMPnetDiameterTraversalTime,
-                u.sta.mshcfg.dot11MeshHWMPnetDiameterTraversalTime, DEC, u16);
+                u.mesh.mshcfg.dot11MeshHWMPnetDiameterTraversalTime, DEC, u16);
 IEEE80211_IF_WFILE(dot11MeshHWMPmaxPREQretries,
-                u.sta.mshcfg.dot11MeshHWMPmaxPREQretries, DEC, u8);
+                u.mesh.mshcfg.dot11MeshHWMPmaxPREQretries, DEC, u8);
 IEEE80211_IF_WFILE(path_refresh_time,
-                u.sta.mshcfg.path_refresh_time, DEC, u32);
+                u.mesh.mshcfg.path_refresh_time, DEC, u32);
 IEEE80211_IF_WFILE(min_discovery_timeout,
-                u.sta.mshcfg.min_discovery_timeout, DEC, u16);
+                u.mesh.mshcfg.min_discovery_timeout, DEC, u16);
 #endif
 
 
@@ -265,7 +263,6 @@ static void add_sta_files(struct ieee80211_sub_if_data *sdata)
         DEBUGFS_ADD(auth_alg, sta);
         DEBUGFS_ADD(auth_transaction, sta);
         DEBUGFS_ADD(flags, sta);
-        DEBUGFS_ADD(num_beacons_sta, sta);
 }
 
 static void add_ap_files(struct ieee80211_sub_if_data *sdata)
@@ -276,7 +273,6 @@ static void add_ap_files(struct ieee80211_sub_if_data *sdata)
 
         DEBUGFS_ADD(num_sta_ps, ap);
         DEBUGFS_ADD(dtim_count, ap);
-        DEBUGFS_ADD(num_beacons, ap);
         DEBUGFS_ADD(num_buffered_multicast, ap);
 }
 
@@ -345,26 +341,26 @@ static void add_files(struct ieee80211_sub_if_data *sdata)
                 return;
 
         switch (sdata->vif.type) {
-        case IEEE80211_IF_TYPE_MESH_POINT:
+        case NL80211_IFTYPE_MESH_POINT:
 #ifdef CONFIG_MAC80211_MESH
                 add_mesh_stats(sdata);
                 add_mesh_config(sdata);
 #endif
-                /* fall through */
-        case IEEE80211_IF_TYPE_STA:
-        case IEEE80211_IF_TYPE_IBSS:
+                break;
+        case NL80211_IFTYPE_STATION:
+        case NL80211_IFTYPE_ADHOC:
                 add_sta_files(sdata);
                 break;
-        case IEEE80211_IF_TYPE_AP:
+        case NL80211_IFTYPE_AP:
                 add_ap_files(sdata);
                 break;
-        case IEEE80211_IF_TYPE_WDS:
+        case NL80211_IFTYPE_WDS:
                 add_wds_files(sdata);
                 break;
-        case IEEE80211_IF_TYPE_MNTR:
+        case NL80211_IFTYPE_MONITOR:
                 add_monitor_files(sdata);
                 break;
-        case IEEE80211_IF_TYPE_VLAN:
+        case NL80211_IFTYPE_AP_VLAN:
                 add_vlan_files(sdata);
                 break;
         default:
@@ -398,7 +394,6 @@ static void del_sta_files(struct ieee80211_sub_if_data *sdata)
         DEBUGFS_DEL(auth_alg, sta);
         DEBUGFS_DEL(auth_transaction, sta);
         DEBUGFS_DEL(flags, sta);
-        DEBUGFS_DEL(num_beacons_sta, sta);
 }
 
 static void del_ap_files(struct ieee80211_sub_if_data *sdata)
@@ -409,7 +404,6 @@ static void del_ap_files(struct ieee80211_sub_if_data *sdata)
 
         DEBUGFS_DEL(num_sta_ps, ap);
         DEBUGFS_DEL(dtim_count, ap);
-        DEBUGFS_DEL(num_beacons, ap);
         DEBUGFS_DEL(num_buffered_multicast, ap);
 }
 
@@ -482,26 +476,26 @@ static void del_files(struct ieee80211_sub_if_data *sdata)
                 return;
 
         switch (sdata->vif.type) {
-        case IEEE80211_IF_TYPE_MESH_POINT:
+        case NL80211_IFTYPE_MESH_POINT:
 #ifdef CONFIG_MAC80211_MESH
                 del_mesh_stats(sdata);
                 del_mesh_config(sdata);
 #endif
-                /* fall through */
-        case IEEE80211_IF_TYPE_STA:
-        case IEEE80211_IF_TYPE_IBSS:
+                break;
+        case NL80211_IFTYPE_STATION:
+        case NL80211_IFTYPE_ADHOC:
                 del_sta_files(sdata);
                 break;
-        case IEEE80211_IF_TYPE_AP:
+        case NL80211_IFTYPE_AP:
                 del_ap_files(sdata);
                 break;
-        case IEEE80211_IF_TYPE_WDS:
+        case NL80211_IFTYPE_WDS:
                 del_wds_files(sdata);
                 break;
-        case IEEE80211_IF_TYPE_MNTR:
+        case NL80211_IFTYPE_MONITOR:
                 del_monitor_files(sdata);
                 break;
-        case IEEE80211_IF_TYPE_VLAN:
+        case NL80211_IFTYPE_AP_VLAN:
                 del_vlan_files(sdata);
                 break;
         default:
diff --git a/net/mac80211/debugfs_sta.c b/net/mac80211/debugfs_sta.c
index 79a062782d52..b9902e425f09 100644
--- a/net/mac80211/debugfs_sta.c
+++ b/net/mac80211/debugfs_sta.c
@@ -50,7 +50,7 @@ static const struct file_operations sta_ ##name## _ops = {		\
                 STA_READ_##format(name, field)                          \
                 STA_OPS(name)
 
-STA_FILE(aid, aid, D);
+STA_FILE(aid, sta.aid, D);
 STA_FILE(dev, sdata->dev->name, S);
 STA_FILE(rx_packets, rx_packets, LU);
 STA_FILE(tx_packets, tx_packets, LU);
@@ -173,10 +173,9 @@ static ssize_t sta_agg_status_write(struct file *file,
                 const char __user *user_buf, size_t count, loff_t *ppos)
 {
         struct sta_info *sta = file->private_data;
-        struct net_device *dev = sta->sdata->dev;
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+        struct ieee80211_local *local = sta->sdata->local;
         struct ieee80211_hw *hw = &local->hw;
-        u8 *da = sta->addr;
+        u8 *da = sta->sta.addr;
         static int tid_static_tx[16] = {0, 0, 0, 0, 0, 0, 0, 0,
                                         0, 0, 0, 0, 0, 0, 0, 0};
         static int tid_static_rx[16] = {1, 1, 1, 1, 1, 1, 1, 1,
@@ -201,7 +200,7 @@ static ssize_t sta_agg_status_write(struct file *file,
                 tid_num = tid_num - 100;
                 if (tid_static_rx[tid_num] == 1) {
                         strcpy(state, "off ");
-                        ieee80211_sta_stop_rx_ba_session(dev, da, tid_num, 0,
+                        ieee80211_sta_stop_rx_ba_session(sta->sdata, da, tid_num, 0,
                                         WLAN_REASON_QSTA_REQUIRE_SETUP);
                         sta->ampdu_mlme.tid_state_rx[tid_num] |=
                                         HT_AGG_STATE_DEBUGFS_CTL;
@@ -253,7 +252,7 @@ void ieee80211_sta_debugfs_add(struct sta_info *sta)
         if (!stations_dir)
                 return;
 
-        mac = print_mac(mbuf, sta->addr);
+        mac = print_mac(mbuf, sta->sta.addr);
 
         sta->debugfs.dir = debugfs_create_dir(mac, stations_dir);
         if (!sta->debugfs.dir)
diff --git a/net/mac80211/event.c b/net/mac80211/event.c
index 2280f40b4560..8de60de70bc9 100644
--- a/net/mac80211/event.c
+++ b/net/mac80211/event.c
@@ -8,7 +8,6 @@
  * mac80211 - events
  */
 
-#include <linux/netdevice.h>
 #include <net/iw_handler.h>
 #include "ieee80211_i.h"
 
@@ -17,7 +16,7 @@
  * (in the variable hdr) must be long enough to extract the TKIP
  * fields like TSC
  */
-void mac80211_ev_michael_mic_failure(struct net_device *dev, int keyidx,
+void mac80211_ev_michael_mic_failure(struct ieee80211_sub_if_data *sdata, int keyidx,
                                      struct ieee80211_hdr *hdr)
 {
         union iwreq_data wrqu;
@@ -32,7 +31,7 @@ void mac80211_ev_michael_mic_failure(struct net_device *dev, int keyidx,
                         print_mac(mac, hdr->addr2));
                 memset(&wrqu, 0, sizeof(wrqu));
                 wrqu.data.length = strlen(buf);
-                wireless_send_event(dev, IWEVCUSTOM, &wrqu, buf);
+                wireless_send_event(sdata->dev, IWEVCUSTOM, &wrqu, buf);
                 kfree(buf);
         }
 
diff --git a/net/mac80211/ht.c b/net/mac80211/ht.c
new file mode 100644
index 000000000000..dc7d9a3d70d5
--- /dev/null
+++ b/net/mac80211/ht.c
@@ -0,0 +1,992 @@
+/*
+ * HT handling
+ *
+ * Copyright 2003, Jouni Malinen <jkmaline@cc.hut.fi>
+ * Copyright 2002-2005, Instant802 Networks, Inc.
+ * Copyright 2005-2006, Devicescape Software, Inc.
+ * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
+ * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
+ * Copyright 2007-2008, Intel Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/ieee80211.h>
+#include <net/wireless.h>
+#include <net/mac80211.h>
+#include "ieee80211_i.h"
+#include "sta_info.h"
+#include "wme.h"
+
+int ieee80211_ht_cap_ie_to_ht_info(struct ieee80211_ht_cap *ht_cap_ie,
+                                   struct ieee80211_ht_info *ht_info)
+{
+
+        if (ht_info == NULL)
+                return -EINVAL;
+
+        memset(ht_info, 0, sizeof(*ht_info));
+
+        if (ht_cap_ie) {
+                u8 ampdu_info = ht_cap_ie->ampdu_params_info;
+
+                ht_info->ht_supported = 1;
+                ht_info->cap = le16_to_cpu(ht_cap_ie->cap_info);
+                ht_info->ampdu_factor =
+                        ampdu_info & IEEE80211_HT_CAP_AMPDU_FACTOR;
+                ht_info->ampdu_density =
+                        (ampdu_info & IEEE80211_HT_CAP_AMPDU_DENSITY) >> 2;
+                memcpy(ht_info->supp_mcs_set, ht_cap_ie->supp_mcs_set, 16);
+        } else
+                ht_info->ht_supported = 0;
+
+        return 0;
+}
+
+int ieee80211_ht_addt_info_ie_to_ht_bss_info(
+                        struct ieee80211_ht_addt_info *ht_add_info_ie,
+                        struct ieee80211_ht_bss_info *bss_info)
+{
+        if (bss_info == NULL)
+                return -EINVAL;
+
+        memset(bss_info, 0, sizeof(*bss_info));
+
+        if (ht_add_info_ie) {
+                u16 op_mode;
+                op_mode = le16_to_cpu(ht_add_info_ie->operation_mode);
+
+                bss_info->primary_channel = ht_add_info_ie->control_chan;
+                bss_info->bss_cap = ht_add_info_ie->ht_param;
+                bss_info->bss_op_mode = (u8)(op_mode & 0xff);
+        }
+
+        return 0;
+}
+
+static void ieee80211_send_addba_request(struct ieee80211_sub_if_data *sdata,
+                                         const u8 *da, u16 tid,
+                                         u8 dialog_token, u16 start_seq_num,
+                                         u16 agg_size, u16 timeout)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_if_sta *ifsta = &sdata->u.sta;
+        struct sk_buff *skb;
+        struct ieee80211_mgmt *mgmt;
+        u16 capab;
+
+        skb = dev_alloc_skb(sizeof(*mgmt) + local->hw.extra_tx_headroom);
+
+        if (!skb) {
+                printk(KERN_ERR "%s: failed to allocate buffer "
+                                "for addba request frame\n", sdata->dev->name);
+                return;
+        }
+        skb_reserve(skb, local->hw.extra_tx_headroom);
+        mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
+        memset(mgmt, 0, 24);
+        memcpy(mgmt->da, da, ETH_ALEN);
+        memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
+        if (sdata->vif.type == NL80211_IFTYPE_AP)
+                memcpy(mgmt->bssid, sdata->dev->dev_addr, ETH_ALEN);
+        else
+                memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
+
+        mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
+                                          IEEE80211_STYPE_ACTION);
+
+        skb_put(skb, 1 + sizeof(mgmt->u.action.u.addba_req));
+
+        mgmt->u.action.category = WLAN_CATEGORY_BACK;
+        mgmt->u.action.u.addba_req.action_code = WLAN_ACTION_ADDBA_REQ;
+
+        mgmt->u.action.u.addba_req.dialog_token = dialog_token;
+        capab = (u16)(1 << 1);          /* bit 1 aggregation policy */
+        capab |= (u16)(tid << 2);       /* bit 5:2 TID number */
+        capab |= (u16)(agg_size << 6);  /* bit 15:6 max size of aggergation */
+
+        mgmt->u.action.u.addba_req.capab = cpu_to_le16(capab);
+
+        mgmt->u.action.u.addba_req.timeout = cpu_to_le16(timeout);
+        mgmt->u.action.u.addba_req.start_seq_num =
+                                        cpu_to_le16(start_seq_num << 4);
+
+        ieee80211_tx_skb(sdata, skb, 0);
+}
+
+static void ieee80211_send_addba_resp(struct ieee80211_sub_if_data *sdata, u8 *da, u16 tid,
+                                      u8 dialog_token, u16 status, u16 policy,
+                                      u16 buf_size, u16 timeout)
+{
+        struct ieee80211_if_sta *ifsta = &sdata->u.sta;
+        struct ieee80211_local *local = sdata->local;
+        struct sk_buff *skb;
+        struct ieee80211_mgmt *mgmt;
+        u16 capab;
+
+        skb = dev_alloc_skb(sizeof(*mgmt) + local->hw.extra_tx_headroom);
+
+        if (!skb) {
+                printk(KERN_DEBUG "%s: failed to allocate buffer "
+                       "for addba resp frame\n", sdata->dev->name);
+                return;
+        }
+
+        skb_reserve(skb, local->hw.extra_tx_headroom);
+        mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
+        memset(mgmt, 0, 24);
+        memcpy(mgmt->da, da, ETH_ALEN);
+        memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
+        if (sdata->vif.type == NL80211_IFTYPE_AP)
+                memcpy(mgmt->bssid, sdata->dev->dev_addr, ETH_ALEN);
+        else
+                memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
+        mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
+                                          IEEE80211_STYPE_ACTION);
+
+        skb_put(skb, 1 + sizeof(mgmt->u.action.u.addba_resp));
+        mgmt->u.action.category = WLAN_CATEGORY_BACK;
+        mgmt->u.action.u.addba_resp.action_code = WLAN_ACTION_ADDBA_RESP;
+        mgmt->u.action.u.addba_resp.dialog_token = dialog_token;
+
+        capab = (u16)(policy << 1);     /* bit 1 aggregation policy */
+        capab |= (u16)(tid << 2);       /* bit 5:2 TID number */
+        capab |= (u16)(buf_size << 6);  /* bit 15:6 max size of aggregation */
+
+        mgmt->u.action.u.addba_resp.capab = cpu_to_le16(capab);
+        mgmt->u.action.u.addba_resp.timeout = cpu_to_le16(timeout);
+        mgmt->u.action.u.addba_resp.status = cpu_to_le16(status);
+
+        ieee80211_tx_skb(sdata, skb, 0);
+}
+
+static void ieee80211_send_delba(struct ieee80211_sub_if_data *sdata,
+                                 const u8 *da, u16 tid,
+                                 u16 initiator, u16 reason_code)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_if_sta *ifsta = &sdata->u.sta;
+        struct sk_buff *skb;
+        struct ieee80211_mgmt *mgmt;
+        u16 params;
+
+        skb = dev_alloc_skb(sizeof(*mgmt) + local->hw.extra_tx_headroom);
+
+        if (!skb) {
+                printk(KERN_ERR "%s: failed to allocate buffer "
+                                        "for delba frame\n", sdata->dev->name);
+                return;
+        }
+
+        skb_reserve(skb, local->hw.extra_tx_headroom);
+        mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
+        memset(mgmt, 0, 24);
+        memcpy(mgmt->da, da, ETH_ALEN);
+        memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
+        if (sdata->vif.type == NL80211_IFTYPE_AP)
+                memcpy(mgmt->bssid, sdata->dev->dev_addr, ETH_ALEN);
+        else
+                memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
+        mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
+                                          IEEE80211_STYPE_ACTION);
+
+        skb_put(skb, 1 + sizeof(mgmt->u.action.u.delba));
+
+        mgmt->u.action.category = WLAN_CATEGORY_BACK;
+        mgmt->u.action.u.delba.action_code = WLAN_ACTION_DELBA;
+        params = (u16)(initiator << 11);        /* bit 11 initiator */
+        params |= (u16)(tid << 12);             /* bit 15:12 TID number */
+
+        mgmt->u.action.u.delba.params = cpu_to_le16(params);
+        mgmt->u.action.u.delba.reason_code = cpu_to_le16(reason_code);
+
+        ieee80211_tx_skb(sdata, skb, 0);
+}
+
+void ieee80211_send_bar(struct ieee80211_sub_if_data *sdata, u8 *ra, u16 tid, u16 ssn)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct sk_buff *skb;
+        struct ieee80211_bar *bar;
+        u16 bar_control = 0;
+
+        skb = dev_alloc_skb(sizeof(*bar) + local->hw.extra_tx_headroom);
+        if (!skb) {
+                printk(KERN_ERR "%s: failed to allocate buffer for "
+                        "bar frame\n", sdata->dev->name);
+                return;
+        }
+        skb_reserve(skb, local->hw.extra_tx_headroom);
+        bar = (struct ieee80211_bar *)skb_put(skb, sizeof(*bar));
+        memset(bar, 0, sizeof(*bar));
+        bar->frame_control = cpu_to_le16(IEEE80211_FTYPE_CTL |
+                                         IEEE80211_STYPE_BACK_REQ);
+        memcpy(bar->ra, ra, ETH_ALEN);
+        memcpy(bar->ta, sdata->dev->dev_addr, ETH_ALEN);
+        bar_control |= (u16)IEEE80211_BAR_CTRL_ACK_POLICY_NORMAL;
+        bar_control |= (u16)IEEE80211_BAR_CTRL_CBMTID_COMPRESSED_BA;
+        bar_control |= (u16)(tid << 12);
+        bar->control = cpu_to_le16(bar_control);
+        bar->start_seq_num = cpu_to_le16(ssn);
+
+        ieee80211_tx_skb(sdata, skb, 0);
+}
+
+void ieee80211_sta_stop_rx_ba_session(struct ieee80211_sub_if_data *sdata, u8 *ra, u16 tid,
+                                        u16 initiator, u16 reason)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_hw *hw = &local->hw;
+        struct sta_info *sta;
+        int ret, i;
+        DECLARE_MAC_BUF(mac);
+
+        rcu_read_lock();
+
+        sta = sta_info_get(local, ra);
+        if (!sta) {
+                rcu_read_unlock();
+                return;
+        }
+
+        /* check if TID is in operational state */
+        spin_lock_bh(&sta->lock);
+        if (sta->ampdu_mlme.tid_state_rx[tid]
+                                != HT_AGG_STATE_OPERATIONAL) {
+                spin_unlock_bh(&sta->lock);
+                rcu_read_unlock();
+                return;
+        }
+        sta->ampdu_mlme.tid_state_rx[tid] =
+                HT_AGG_STATE_REQ_STOP_BA_MSK |
+                (initiator << HT_AGG_STATE_INITIATOR_SHIFT);
+        spin_unlock_bh(&sta->lock);
+
+        /* stop HW Rx aggregation. ampdu_action existence
+         * already verified in session init so we add the BUG_ON */
+        BUG_ON(!local->ops->ampdu_action);
+
+#ifdef CONFIG_MAC80211_HT_DEBUG
+        printk(KERN_DEBUG "Rx BA session stop requested for %s tid %u\n",
+                                print_mac(mac, ra), tid);
+#endif /* CONFIG_MAC80211_HT_DEBUG */
+
+        ret = local->ops->ampdu_action(hw, IEEE80211_AMPDU_RX_STOP,
+                                       &sta->sta, tid, NULL);
+        if (ret)
+                printk(KERN_DEBUG "HW problem - can not stop rx "
+                                "aggregation for tid %d\n", tid);
+
+        /* shutdown timer has not expired */
+        if (initiator != WLAN_BACK_TIMER)
+                del_timer_sync(&sta->ampdu_mlme.tid_rx[tid]->session_timer);
+
+        /* check if this is a self generated aggregation halt */
+        if (initiator == WLAN_BACK_RECIPIENT || initiator == WLAN_BACK_TIMER)
+                ieee80211_send_delba(sdata, ra, tid, 0, reason);
+
+        /* free the reordering buffer */
+        for (i = 0; i < sta->ampdu_mlme.tid_rx[tid]->buf_size; i++) {
+                if (sta->ampdu_mlme.tid_rx[tid]->reorder_buf[i]) {
+                        /* release the reordered frames */
+                        dev_kfree_skb(sta->ampdu_mlme.tid_rx[tid]->reorder_buf[i]);
+                        sta->ampdu_mlme.tid_rx[tid]->stored_mpdu_num--;
+                        sta->ampdu_mlme.tid_rx[tid]->reorder_buf[i] = NULL;
+                }
+        }
+        /* free resources */
+        kfree(sta->ampdu_mlme.tid_rx[tid]->reorder_buf);
+        kfree(sta->ampdu_mlme.tid_rx[tid]);
+        sta->ampdu_mlme.tid_rx[tid] = NULL;
+        sta->ampdu_mlme.tid_state_rx[tid] = HT_AGG_STATE_IDLE;
+
+        rcu_read_unlock();
+}
+
+
+/*
+ * After sending add Block Ack request we activated a timer until
+ * add Block Ack response will arrive from the recipient.
+ * If this timer expires sta_addba_resp_timer_expired will be executed.
+ */
+static void sta_addba_resp_timer_expired(unsigned long data)
+{
+        /* not an elegant detour, but there is no choice as the timer passes
+         * only one argument, and both sta_info and TID are needed, so init
+         * flow in sta_info_create gives the TID as data, while the timer_to_id
+         * array gives the sta through container_of */
+        u16 tid = *(u8 *)data;
+        struct sta_info *temp_sta = container_of((void *)data,
+                struct sta_info, timer_to_tid[tid]);
+
+        struct ieee80211_local *local = temp_sta->local;
+        struct ieee80211_hw *hw = &local->hw;
+        struct sta_info *sta;
+        u8 *state;
+
+        rcu_read_lock();
+
+        sta = sta_info_get(local, temp_sta->sta.addr);
+        if (!sta) {
+                rcu_read_unlock();
+                return;
+        }
+
+        state = &sta->ampdu_mlme.tid_state_tx[tid];
+        /* check if the TID waits for addBA response */
+        spin_lock_bh(&sta->lock);
+        if (!(*state & HT_ADDBA_REQUESTED_MSK)) {
+                spin_unlock_bh(&sta->lock);
+                *state = HT_AGG_STATE_IDLE;
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                printk(KERN_DEBUG "timer expired on tid %d but we are not "
+                                "expecting addBA response there", tid);
+#endif
+                goto timer_expired_exit;
+        }
+
+#ifdef CONFIG_MAC80211_HT_DEBUG
+        printk(KERN_DEBUG "addBA response timer expired on tid %d\n", tid);
+#endif
+
+        /* go through the state check in stop_BA_session */
+        *state = HT_AGG_STATE_OPERATIONAL;
+        spin_unlock_bh(&sta->lock);
+        ieee80211_stop_tx_ba_session(hw, temp_sta->sta.addr, tid,
+                                     WLAN_BACK_INITIATOR);
+
+timer_expired_exit:
+        rcu_read_unlock();
+}
+
+void ieee80211_sta_tear_down_BA_sessions(struct ieee80211_sub_if_data *sdata, u8 *addr)
+{
+        struct ieee80211_local *local = sdata->local;
+        int i;
+
+        for (i = 0; i <  STA_TID_NUM; i++) {
+                ieee80211_stop_tx_ba_session(&local->hw, addr, i,
+                                             WLAN_BACK_INITIATOR);
+                ieee80211_sta_stop_rx_ba_session(sdata, addr, i,
+                                                 WLAN_BACK_RECIPIENT,
+                                                 WLAN_REASON_QSTA_LEAVE_QBSS);
+        }
+}
+
+int ieee80211_start_tx_ba_session(struct ieee80211_hw *hw, u8 *ra, u16 tid)
+{
+        struct ieee80211_local *local = hw_to_local(hw);
+        struct sta_info *sta;
+        struct ieee80211_sub_if_data *sdata;
+        u16 start_seq_num;
+        u8 *state;
+        int ret;
+        DECLARE_MAC_BUF(mac);
+
+        if (tid >= STA_TID_NUM)
+                return -EINVAL;
+
+#ifdef CONFIG_MAC80211_HT_DEBUG
+        printk(KERN_DEBUG "Open BA session requested for %s tid %u\n",
+                                print_mac(mac, ra), tid);
+#endif /* CONFIG_MAC80211_HT_DEBUG */
+
+        rcu_read_lock();
+
+        sta = sta_info_get(local, ra);
+        if (!sta) {
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                printk(KERN_DEBUG "Could not find the station\n");
+#endif
+                ret = -ENOENT;
+                goto exit;
+        }
+
+        spin_lock_bh(&sta->lock);
+
+        /* we have tried too many times, receiver does not want A-MPDU */
+        if (sta->ampdu_mlme.addba_req_num[tid] > HT_AGG_MAX_RETRIES) {
+                ret = -EBUSY;
+                goto err_unlock_sta;
+        }
+
+        state = &sta->ampdu_mlme.tid_state_tx[tid];
+        /* check if the TID is not in aggregation flow already */
+        if (*state != HT_AGG_STATE_IDLE) {
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                printk(KERN_DEBUG "BA request denied - session is not "
+                                 "idle on tid %u\n", tid);
+#endif /* CONFIG_MAC80211_HT_DEBUG */
+                ret = -EAGAIN;
+                goto err_unlock_sta;
+        }
+
+        /* prepare A-MPDU MLME for Tx aggregation */
+        sta->ampdu_mlme.tid_tx[tid] =
+                        kmalloc(sizeof(struct tid_ampdu_tx), GFP_ATOMIC);
+        if (!sta->ampdu_mlme.tid_tx[tid]) {
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                if (net_ratelimit())
+                        printk(KERN_ERR "allocate tx mlme to tid %d failed\n",
+                                        tid);
+#endif
+                ret = -ENOMEM;
+                goto err_unlock_sta;
+        }
+        /* Tx timer */
+        sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer.function =
+                        sta_addba_resp_timer_expired;
+        sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer.data =
+                        (unsigned long)&sta->timer_to_tid[tid];
+        init_timer(&sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer);
+
+        /* create a new queue for this aggregation */
+        ret = ieee80211_ht_agg_queue_add(local, sta, tid);
+
+        /* case no queue is available to aggregation
+         * don't switch to aggregation */
+        if (ret) {
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                printk(KERN_DEBUG "BA request denied - queue unavailable for"
+                                        " tid %d\n", tid);
+#endif /* CONFIG_MAC80211_HT_DEBUG */
+                goto err_unlock_queue;
+        }
+        sdata = sta->sdata;
+
+        /* Ok, the Addba frame hasn't been sent yet, but if the driver calls the
+         * call back right away, it must see that the flow has begun */
+        *state |= HT_ADDBA_REQUESTED_MSK;
+
+        /* This is slightly racy because the queue isn't stopped */
+        start_seq_num = sta->tid_seq[tid];
+
+        if (local->ops->ampdu_action)
+                ret = local->ops->ampdu_action(hw, IEEE80211_AMPDU_TX_START,
+                                               &sta->sta, tid, &start_seq_num);
+
+        if (ret) {
+                /* No need to requeue the packets in the agg queue, since we
+                 * held the tx lock: no packet could be enqueued to the newly
+                 * allocated queue */
+                ieee80211_ht_agg_queue_remove(local, sta, tid, 0);
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                printk(KERN_DEBUG "BA request denied - HW unavailable for"
+                                        " tid %d\n", tid);
+#endif /* CONFIG_MAC80211_HT_DEBUG */
+                *state = HT_AGG_STATE_IDLE;
+                goto err_unlock_queue;
+        }
+
+        /* Will put all the packets in the new SW queue */
+        ieee80211_requeue(local, ieee802_1d_to_ac[tid]);
+        spin_unlock_bh(&sta->lock);
+
+        /* send an addBA request */
+        sta->ampdu_mlme.dialog_token_allocator++;
+        sta->ampdu_mlme.tid_tx[tid]->dialog_token =
+                        sta->ampdu_mlme.dialog_token_allocator;
+        sta->ampdu_mlme.tid_tx[tid]->ssn = start_seq_num;
+
+
+        ieee80211_send_addba_request(sta->sdata, ra, tid,
+                         sta->ampdu_mlme.tid_tx[tid]->dialog_token,
+                         sta->ampdu_mlme.tid_tx[tid]->ssn,
+                         0x40, 5000);
+        /* activate the timer for the recipient's addBA response */
+        sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer.expires =
+                                jiffies + ADDBA_RESP_INTERVAL;
+        add_timer(&sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer);
+#ifdef CONFIG_MAC80211_HT_DEBUG
+        printk(KERN_DEBUG "activated addBA response timer on tid %d\n", tid);
+#endif
+        goto exit;
+
+err_unlock_queue:
+        kfree(sta->ampdu_mlme.tid_tx[tid]);
+        sta->ampdu_mlme.tid_tx[tid] = NULL;
+        ret = -EBUSY;
+err_unlock_sta:
+        spin_unlock_bh(&sta->lock);
+exit:
+        rcu_read_unlock();
+        return ret;
+}
+EXPORT_SYMBOL(ieee80211_start_tx_ba_session);
+
+int ieee80211_stop_tx_ba_session(struct ieee80211_hw *hw,
+                                 u8 *ra, u16 tid,
+                                 enum ieee80211_back_parties initiator)
+{
+        struct ieee80211_local *local = hw_to_local(hw);
+        struct sta_info *sta;
+        u8 *state;
+        int ret = 0;
+        DECLARE_MAC_BUF(mac);
+
+        if (tid >= STA_TID_NUM)
+                return -EINVAL;
+
+        rcu_read_lock();
+        sta = sta_info_get(local, ra);
+        if (!sta) {
+                rcu_read_unlock();
+                return -ENOENT;
+        }
+
+        /* check if the TID is in aggregation */
+        state = &sta->ampdu_mlme.tid_state_tx[tid];
+        spin_lock_bh(&sta->lock);
+
+        if (*state != HT_AGG_STATE_OPERATIONAL) {
+                ret = -ENOENT;
+                goto stop_BA_exit;
+        }
+
+#ifdef CONFIG_MAC80211_HT_DEBUG
+        printk(KERN_DEBUG "Tx BA session stop requested for %s tid %u\n",
+                                print_mac(mac, ra), tid);
+#endif /* CONFIG_MAC80211_HT_DEBUG */
+
+        ieee80211_stop_queue(hw, sta->tid_to_tx_q[tid]);
+
+        *state = HT_AGG_STATE_REQ_STOP_BA_MSK |
+                (initiator << HT_AGG_STATE_INITIATOR_SHIFT);
+
+        if (local->ops->ampdu_action)
+                ret = local->ops->ampdu_action(hw, IEEE80211_AMPDU_TX_STOP,
+                                               &sta->sta, tid, NULL);
+
+        /* case HW denied going back to legacy */
+        if (ret) {
+                WARN_ON(ret != -EBUSY);
+                *state = HT_AGG_STATE_OPERATIONAL;
+                ieee80211_wake_queue(hw, sta->tid_to_tx_q[tid]);
+                goto stop_BA_exit;
+        }
+
+stop_BA_exit:
+        spin_unlock_bh(&sta->lock);
+        rcu_read_unlock();
+        return ret;
+}
+EXPORT_SYMBOL(ieee80211_stop_tx_ba_session);
+
+void ieee80211_start_tx_ba_cb(struct ieee80211_hw *hw, u8 *ra, u16 tid)
+{
+        struct ieee80211_local *local = hw_to_local(hw);
+        struct sta_info *sta;
+        u8 *state;
+        DECLARE_MAC_BUF(mac);
+
+        if (tid >= STA_TID_NUM) {
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                printk(KERN_DEBUG "Bad TID value: tid = %d (>= %d)\n",
+                                tid, STA_TID_NUM);
+#endif
+                return;
+        }
+
+        rcu_read_lock();
+        sta = sta_info_get(local, ra);
+        if (!sta) {
+                rcu_read_unlock();
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                printk(KERN_DEBUG "Could not find station: %s\n",
+                                print_mac(mac, ra));
+#endif
+                return;
+        }
+
+        state = &sta->ampdu_mlme.tid_state_tx[tid];
+        spin_lock_bh(&sta->lock);
+
+        if (!(*state & HT_ADDBA_REQUESTED_MSK)) {
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                printk(KERN_DEBUG "addBA was not requested yet, state is %d\n",
+                                *state);
+#endif
+                spin_unlock_bh(&sta->lock);
+                rcu_read_unlock();
+                return;
+        }
+
+        WARN_ON_ONCE(*state & HT_ADDBA_DRV_READY_MSK);
+
+        *state |= HT_ADDBA_DRV_READY_MSK;
+
+        if (*state == HT_AGG_STATE_OPERATIONAL) {
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                printk(KERN_DEBUG "Aggregation is on for tid %d \n", tid);
+#endif
+                ieee80211_wake_queue(hw, sta->tid_to_tx_q[tid]);
+        }
+        spin_unlock_bh(&sta->lock);
+        rcu_read_unlock();
+}
+EXPORT_SYMBOL(ieee80211_start_tx_ba_cb);
+
+void ieee80211_stop_tx_ba_cb(struct ieee80211_hw *hw, u8 *ra, u8 tid)
+{
+        struct ieee80211_local *local = hw_to_local(hw);
+        struct sta_info *sta;
+        u8 *state;
+        int agg_queue;
+        DECLARE_MAC_BUF(mac);
+
+        if (tid >= STA_TID_NUM) {
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                printk(KERN_DEBUG "Bad TID value: tid = %d (>= %d)\n",
+                                tid, STA_TID_NUM);
+#endif
+                return;
+        }
+
+#ifdef CONFIG_MAC80211_HT_DEBUG
+        printk(KERN_DEBUG "Stopping Tx BA session for %s tid %d\n",
+                                print_mac(mac, ra), tid);
+#endif /* CONFIG_MAC80211_HT_DEBUG */
+
+        rcu_read_lock();
+        sta = sta_info_get(local, ra);
+        if (!sta) {
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                printk(KERN_DEBUG "Could not find station: %s\n",
+                                print_mac(mac, ra));
+#endif
+                rcu_read_unlock();
+                return;
+        }
+        state = &sta->ampdu_mlme.tid_state_tx[tid];
+
+        /* NOTE: no need to use sta->lock in this state check, as
+         * ieee80211_stop_tx_ba_session will let only one stop call to
+         * pass through per sta/tid
+         */
+        if ((*state & HT_AGG_STATE_REQ_STOP_BA_MSK) == 0) {
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                printk(KERN_DEBUG "unexpected callback to A-MPDU stop\n");
+#endif
+                rcu_read_unlock();
+                return;
+        }
+
+        if (*state & HT_AGG_STATE_INITIATOR_MSK)
+                ieee80211_send_delba(sta->sdata, ra, tid,
+                        WLAN_BACK_INITIATOR, WLAN_REASON_QSTA_NOT_USE);
+
+        agg_queue = sta->tid_to_tx_q[tid];
+
+        ieee80211_ht_agg_queue_remove(local, sta, tid, 1);
+
+        /* We just requeued the all the frames that were in the
+         * removed queue, and since we might miss a softirq we do
+         * netif_schedule_queue.  ieee80211_wake_queue is not used
+         * here as this queue is not necessarily stopped
+         */
+        netif_schedule_queue(netdev_get_tx_queue(local->mdev, agg_queue));
+        spin_lock_bh(&sta->lock);
+        *state = HT_AGG_STATE_IDLE;
+        sta->ampdu_mlme.addba_req_num[tid] = 0;
+        kfree(sta->ampdu_mlme.tid_tx[tid]);
+        sta->ampdu_mlme.tid_tx[tid] = NULL;
+        spin_unlock_bh(&sta->lock);
+
+        rcu_read_unlock();
+}
+EXPORT_SYMBOL(ieee80211_stop_tx_ba_cb);
+
+void ieee80211_start_tx_ba_cb_irqsafe(struct ieee80211_hw *hw,
+                                      const u8 *ra, u16 tid)
+{
+        struct ieee80211_local *local = hw_to_local(hw);
+        struct ieee80211_ra_tid *ra_tid;
+        struct sk_buff *skb = dev_alloc_skb(0);
+
+        if (unlikely(!skb)) {
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                if (net_ratelimit())
+                        printk(KERN_WARNING "%s: Not enough memory, "
+                               "dropping start BA session", skb->dev->name);
+#endif
+                return;
+        }
+        ra_tid = (struct ieee80211_ra_tid *) &skb->cb;
+        memcpy(&ra_tid->ra, ra, ETH_ALEN);
+        ra_tid->tid = tid;
+
+        skb->pkt_type = IEEE80211_ADDBA_MSG;
+        skb_queue_tail(&local->skb_queue, skb);
+        tasklet_schedule(&local->tasklet);
+}
+EXPORT_SYMBOL(ieee80211_start_tx_ba_cb_irqsafe);
+
+void ieee80211_stop_tx_ba_cb_irqsafe(struct ieee80211_hw *hw,
+                                     const u8 *ra, u16 tid)
+{
+        struct ieee80211_local *local = hw_to_local(hw);
+        struct ieee80211_ra_tid *ra_tid;
+        struct sk_buff *skb = dev_alloc_skb(0);
+
+        if (unlikely(!skb)) {
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                if (net_ratelimit())
+                        printk(KERN_WARNING "%s: Not enough memory, "
+                               "dropping stop BA session", skb->dev->name);
+#endif
+                return;
+        }
+        ra_tid = (struct ieee80211_ra_tid *) &skb->cb;
+        memcpy(&ra_tid->ra, ra, ETH_ALEN);
+        ra_tid->tid = tid;
+
+        skb->pkt_type = IEEE80211_DELBA_MSG;
+        skb_queue_tail(&local->skb_queue, skb);
+        tasklet_schedule(&local->tasklet);
+}
+EXPORT_SYMBOL(ieee80211_stop_tx_ba_cb_irqsafe);
+
+/*
+ * After accepting the AddBA Request we activated a timer,
+ * resetting it after each frame that arrives from the originator.
+ * if this timer expires ieee80211_sta_stop_rx_ba_session will be executed.
+ */
+static void sta_rx_agg_session_timer_expired(unsigned long data)
+{
+        /* not an elegant detour, but there is no choice as the timer passes
+         * only one argument, and various sta_info are needed here, so init
+         * flow in sta_info_create gives the TID as data, while the timer_to_id
+         * array gives the sta through container_of */
+        u8 *ptid = (u8 *)data;
+        u8 *timer_to_id = ptid - *ptid;
+        struct sta_info *sta = container_of(timer_to_id, struct sta_info,
+                                         timer_to_tid[0]);
+
+#ifdef CONFIG_MAC80211_HT_DEBUG
+        printk(KERN_DEBUG "rx session timer expired on tid %d\n", (u16)*ptid);
+#endif
+        ieee80211_sta_stop_rx_ba_session(sta->sdata, sta->sta.addr,
+                                         (u16)*ptid, WLAN_BACK_TIMER,
+                                         WLAN_REASON_QSTA_TIMEOUT);
+}
+
+void ieee80211_process_addba_request(struct ieee80211_local *local,
+                                     struct sta_info *sta,
+                                     struct ieee80211_mgmt *mgmt,
+                                     size_t len)
+{
+        struct ieee80211_hw *hw = &local->hw;
+        struct ieee80211_conf *conf = &hw->conf;
+        struct tid_ampdu_rx *tid_agg_rx;
+        u16 capab, tid, timeout, ba_policy, buf_size, start_seq_num, status;
+        u8 dialog_token;
+        int ret = -EOPNOTSUPP;
+        DECLARE_MAC_BUF(mac);
+
+        /* extract session parameters from addba request frame */
+        dialog_token = mgmt->u.action.u.addba_req.dialog_token;
+        timeout = le16_to_cpu(mgmt->u.action.u.addba_req.timeout);
+        start_seq_num =
+                le16_to_cpu(mgmt->u.action.u.addba_req.start_seq_num) >> 4;
+
+        capab = le16_to_cpu(mgmt->u.action.u.addba_req.capab);
+        ba_policy = (capab & IEEE80211_ADDBA_PARAM_POLICY_MASK) >> 1;
+        tid = (capab & IEEE80211_ADDBA_PARAM_TID_MASK) >> 2;
+        buf_size = (capab & IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK) >> 6;
+
+        status = WLAN_STATUS_REQUEST_DECLINED;
+
+        /* sanity check for incoming parameters:
+         * check if configuration can support the BA policy
+         * and if buffer size does not exceeds max value */
+        if (((ba_policy != 1)
+                && (!(conf->ht_conf.cap & IEEE80211_HT_CAP_DELAY_BA)))
+                || (buf_size > IEEE80211_MAX_AMPDU_BUF)) {
+                status = WLAN_STATUS_INVALID_QOS_PARAM;
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                if (net_ratelimit())
+                        printk(KERN_DEBUG "AddBA Req with bad params from "
+                                "%s on tid %u. policy %d, buffer size %d\n",
+                                print_mac(mac, mgmt->sa), tid, ba_policy,
+                                buf_size);
+#endif /* CONFIG_MAC80211_HT_DEBUG */
+                goto end_no_lock;
+        }
+        /* determine default buffer size */
+        if (buf_size == 0) {
+                struct ieee80211_supported_band *sband;
+
+                sband = local->hw.wiphy->bands[conf->channel->band];
+                buf_size = IEEE80211_MIN_AMPDU_BUF;
+                buf_size = buf_size << sband->ht_info.ampdu_factor;
+        }
+
+
+        /* examine state machine */
+        spin_lock_bh(&sta->lock);
+
+        if (sta->ampdu_mlme.tid_state_rx[tid] != HT_AGG_STATE_IDLE) {
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                if (net_ratelimit())
+                        printk(KERN_DEBUG "unexpected AddBA Req from "
+                                "%s on tid %u\n",
+                                print_mac(mac, mgmt->sa), tid);
+#endif /* CONFIG_MAC80211_HT_DEBUG */
+                goto end;
+        }
+
+        /* prepare A-MPDU MLME for Rx aggregation */
+        sta->ampdu_mlme.tid_rx[tid] =
+                        kmalloc(sizeof(struct tid_ampdu_rx), GFP_ATOMIC);
+        if (!sta->ampdu_mlme.tid_rx[tid]) {
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                if (net_ratelimit())
+                        printk(KERN_ERR "allocate rx mlme to tid %d failed\n",
+                                        tid);
+#endif
+                goto end;
+        }
+        /* rx timer */
+        sta->ampdu_mlme.tid_rx[tid]->session_timer.function =
+                                sta_rx_agg_session_timer_expired;
+        sta->ampdu_mlme.tid_rx[tid]->session_timer.data =
+                                (unsigned long)&sta->timer_to_tid[tid];
+        init_timer(&sta->ampdu_mlme.tid_rx[tid]->session_timer);
+
+        tid_agg_rx = sta->ampdu_mlme.tid_rx[tid];
+
+        /* prepare reordering buffer */
+        tid_agg_rx->reorder_buf =
+                kmalloc(buf_size * sizeof(struct sk_buff *), GFP_ATOMIC);
+        if (!tid_agg_rx->reorder_buf) {
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                if (net_ratelimit())
+                        printk(KERN_ERR "can not allocate reordering buffer "
+                               "to tid %d\n", tid);
+#endif
+                kfree(sta->ampdu_mlme.tid_rx[tid]);
+                goto end;
+        }
+        memset(tid_agg_rx->reorder_buf, 0,
+                buf_size * sizeof(struct sk_buff *));
+
+        if (local->ops->ampdu_action)
+                ret = local->ops->ampdu_action(hw, IEEE80211_AMPDU_RX_START,
+                                               &sta->sta, tid, &start_seq_num);
+#ifdef CONFIG_MAC80211_HT_DEBUG
+        printk(KERN_DEBUG "Rx A-MPDU request on tid %d result %d\n", tid, ret);
+#endif /* CONFIG_MAC80211_HT_DEBUG */
+
+        if (ret) {
+                kfree(tid_agg_rx->reorder_buf);
+                kfree(tid_agg_rx);
+                sta->ampdu_mlme.tid_rx[tid] = NULL;
+                goto end;
+        }
+
+        /* change state and send addba resp */
+        sta->ampdu_mlme.tid_state_rx[tid] = HT_AGG_STATE_OPERATIONAL;
+        tid_agg_rx->dialog_token = dialog_token;
+        tid_agg_rx->ssn = start_seq_num;
+        tid_agg_rx->head_seq_num = start_seq_num;
+        tid_agg_rx->buf_size = buf_size;
+        tid_agg_rx->timeout = timeout;
+        tid_agg_rx->stored_mpdu_num = 0;
+        status = WLAN_STATUS_SUCCESS;
+end:
+        spin_unlock_bh(&sta->lock);
+
+end_no_lock:
+        ieee80211_send_addba_resp(sta->sdata, sta->sta.addr, tid,
+                                  dialog_token, status, 1, buf_size, timeout);
+}
+
+void ieee80211_process_addba_resp(struct ieee80211_local *local,
+                                  struct sta_info *sta,
+                                  struct ieee80211_mgmt *mgmt,
+                                  size_t len)
+{
+        struct ieee80211_hw *hw = &local->hw;
+        u16 capab;
+        u16 tid;
+        u8 *state;
+
+        capab = le16_to_cpu(mgmt->u.action.u.addba_resp.capab);
+        tid = (capab & IEEE80211_ADDBA_PARAM_TID_MASK) >> 2;
+
+        state = &sta->ampdu_mlme.tid_state_tx[tid];
+
+        spin_lock_bh(&sta->lock);
+
+        if (!(*state & HT_ADDBA_REQUESTED_MSK)) {
+                spin_unlock_bh(&sta->lock);
+                return;
+        }
+
+        if (mgmt->u.action.u.addba_resp.dialog_token !=
+                sta->ampdu_mlme.tid_tx[tid]->dialog_token) {
+                spin_unlock_bh(&sta->lock);
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                printk(KERN_DEBUG "wrong addBA response token, tid %d\n", tid);
+#endif /* CONFIG_MAC80211_HT_DEBUG */
+                return;
+        }
+
+        del_timer_sync(&sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer);
+#ifdef CONFIG_MAC80211_HT_DEBUG
+        printk(KERN_DEBUG "switched off addBA timer for tid %d \n", tid);
+#endif /* CONFIG_MAC80211_HT_DEBUG */
+        if (le16_to_cpu(mgmt->u.action.u.addba_resp.status)
+                        == WLAN_STATUS_SUCCESS) {
+                *state |= HT_ADDBA_RECEIVED_MSK;
+                sta->ampdu_mlme.addba_req_num[tid] = 0;
+
+                if (*state == HT_AGG_STATE_OPERATIONAL)
+                        ieee80211_wake_queue(hw, sta->tid_to_tx_q[tid]);
+
+                spin_unlock_bh(&sta->lock);
+        } else {
+                sta->ampdu_mlme.addba_req_num[tid]++;
+                /* this will allow the state check in stop_BA_session */
+                *state = HT_AGG_STATE_OPERATIONAL;
+                spin_unlock_bh(&sta->lock);
+                ieee80211_stop_tx_ba_session(hw, sta->sta.addr, tid,
+                                             WLAN_BACK_INITIATOR);
+        }
+}
+
+void ieee80211_process_delba(struct ieee80211_sub_if_data *sdata,
+                             struct sta_info *sta,
+                             struct ieee80211_mgmt *mgmt, size_t len)
+{
+        struct ieee80211_local *local = sdata->local;
+        u16 tid, params;
+        u16 initiator;
+        DECLARE_MAC_BUF(mac);
+
+        params = le16_to_cpu(mgmt->u.action.u.delba.params);
+        tid = (params & IEEE80211_DELBA_PARAM_TID_MASK) >> 12;
+        initiator = (params & IEEE80211_DELBA_PARAM_INITIATOR_MASK) >> 11;
+
+#ifdef CONFIG_MAC80211_HT_DEBUG
+        if (net_ratelimit())
+                printk(KERN_DEBUG "delba from %s (%s) tid %d reason code %d\n",
+                        print_mac(mac, mgmt->sa),
+                        initiator ? "initiator" : "recipient", tid,
+                        mgmt->u.action.u.delba.reason_code);
+#endif /* CONFIG_MAC80211_HT_DEBUG */
+
+        if (initiator == WLAN_BACK_INITIATOR)
+                ieee80211_sta_stop_rx_ba_session(sdata, sta->sta.addr, tid,
+                                                 WLAN_BACK_INITIATOR, 0);
+        else { /* WLAN_BACK_RECIPIENT */
+                spin_lock_bh(&sta->lock);
+                sta->ampdu_mlme.tid_state_tx[tid] =
+                                HT_AGG_STATE_OPERATIONAL;
+                spin_unlock_bh(&sta->lock);
+                ieee80211_stop_tx_ba_session(&local->hw, sta->sta.addr, tid,
+                                             WLAN_BACK_RECIPIENT);
+        }
+}
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 4498d8713652..8025b294588b 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -29,17 +29,6 @@
 #include "key.h"
 #include "sta_info.h"
 
-/* ieee80211.o internal definitions, etc. These are not included into
- * low-level drivers. */
-
-#ifndef ETH_P_PAE
-#define ETH_P_PAE 0x888E /* Port Access Entity (IEEE 802.1X) */
-#endif /* ETH_P_PAE */
-
-#define WLAN_FC_DATA_PRESENT(fc) (((fc) & 0x4c) == 0x08)
-
-#define IEEE80211_FC(type, subtype) cpu_to_le16(type | subtype)
-
 struct ieee80211_local;
 
 /* Maximum number of broadcast/multicast frames to buffer when some of the
@@ -61,6 +50,12 @@ struct ieee80211_local;
  * increased memory use (about 2 kB of RAM per entry). */
 #define IEEE80211_FRAGMENT_MAX 4
 
+/*
+ * Time after which we ignore scan results and no longer report/use
+ * them in any way.
+ */
+#define IEEE80211_SCAN_RESULT_EXPIRE (10 * HZ)
+
 struct ieee80211_fragment_entry {
         unsigned long first_frag_time;
         unsigned int seq;
@@ -73,9 +68,9 @@ struct ieee80211_fragment_entry {
 };
 
 
-struct ieee80211_sta_bss {
+struct ieee80211_bss {
         struct list_head list;
-        struct ieee80211_sta_bss *hnext;
+        struct ieee80211_bss *hnext;
         size_t ssid_len;
 
         atomic_t users;
@@ -87,16 +82,11 @@ struct ieee80211_sta_bss {
         enum ieee80211_band band;
         int freq;
         int signal, noise, qual;
-        u8 *wpa_ie;
-        size_t wpa_ie_len;
-        u8 *rsn_ie;
-        size_t rsn_ie_len;
-        u8 *wmm_ie;
-        size_t wmm_ie_len;
-        u8 *ht_ie;
-        size_t ht_ie_len;
-        u8 *ht_add_ie;
-        size_t ht_add_ie_len;
+        u8 *ies; /* all information elements from the last Beacon or Probe
+                  * Response frames; note Beacon frame is not allowed to
+                  * override values from Probe Response */
+        size_t ies_len;
+        bool wmm_used;
 #ifdef CONFIG_MAC80211_MESH
         u8 *mesh_id;
         size_t mesh_id_len;
@@ -108,7 +98,7 @@ struct ieee80211_sta_bss {
         u64 timestamp;
         int beacon_int;
 
-        bool probe_resp;
+        unsigned long last_probe_resp;
         unsigned long last_update;
 
         /* during assocation, we save an ERP value from a probe response so
@@ -119,7 +109,7 @@ struct ieee80211_sta_bss {
         u8 erp_value;
 };
 
-static inline u8 *bss_mesh_cfg(struct ieee80211_sta_bss *bss)
+static inline u8 *bss_mesh_cfg(struct ieee80211_bss *bss)
 {
 #ifdef CONFIG_MAC80211_MESH
         return bss->mesh_cfg;
@@ -127,7 +117,7 @@ static inline u8 *bss_mesh_cfg(struct ieee80211_sta_bss *bss)
         return NULL;
 }
 
-static inline u8 *bss_mesh_id(struct ieee80211_sta_bss *bss)
+static inline u8 *bss_mesh_id(struct ieee80211_bss *bss)
 {
 #ifdef CONFIG_MAC80211_MESH
         return bss->mesh_id;
@@ -135,7 +125,7 @@ static inline u8 *bss_mesh_id(struct ieee80211_sta_bss *bss)
         return NULL;
 }
 
-static inline u8 bss_mesh_id_len(struct ieee80211_sta_bss *bss)
+static inline u8 bss_mesh_id_len(struct ieee80211_bss *bss)
 {
 #ifdef CONFIG_MAC80211_MESH
         return bss->mesh_id_len;
@@ -174,7 +164,7 @@ struct ieee80211_tx_data {
         struct sk_buff **extra_frag;
         int num_extra_frag;
 
-        u16 fc, ethertype;
+        u16 ethertype;
         unsigned int flags;
 };
 
@@ -202,7 +192,7 @@ struct ieee80211_rx_data {
         struct ieee80211_rx_status *status;
         struct ieee80211_rate *rate;
 
-        u16 fc, ethertype;
+        u16 ethertype;
         unsigned int flags;
         int sent_ps_buffered;
         int queue;
@@ -239,7 +229,6 @@ struct ieee80211_if_ap {
         struct sk_buff_head ps_bc_buf;
         atomic_t num_sta_ps; /* number of stations in PS mode */
         int dtim_count;
-        int num_beacons; /* number of TXed beacon frames for this BSS */
 };
 
 struct ieee80211_if_wds {
@@ -300,48 +289,37 @@ struct mesh_config {
 #define IEEE80211_STA_AUTO_BSSID_SEL    BIT(11)
 #define IEEE80211_STA_AUTO_CHANNEL_SEL  BIT(12)
 #define IEEE80211_STA_PRIVACY_INVOKED   BIT(13)
+/* flags for MLME request */
+#define IEEE80211_STA_REQ_SCAN 0
+#define IEEE80211_STA_REQ_DIRECT_PROBE 1
+#define IEEE80211_STA_REQ_AUTH 2
+#define IEEE80211_STA_REQ_RUN  3
+
+/* STA/IBSS MLME states */
+enum ieee80211_sta_mlme_state {
+        IEEE80211_STA_MLME_DISABLED,
+        IEEE80211_STA_MLME_DIRECT_PROBE,
+        IEEE80211_STA_MLME_AUTHENTICATE,
+        IEEE80211_STA_MLME_ASSOCIATE,
+        IEEE80211_STA_MLME_ASSOCIATED,
+        IEEE80211_STA_MLME_IBSS_SEARCH,
+        IEEE80211_STA_MLME_IBSS_JOINED,
+};
+
+/* bitfield of allowed auth algs */
+#define IEEE80211_AUTH_ALG_OPEN BIT(0)
+#define IEEE80211_AUTH_ALG_SHARED_KEY BIT(1)
+#define IEEE80211_AUTH_ALG_LEAP BIT(2)
+
 struct ieee80211_if_sta {
         struct timer_list timer;
         struct work_struct work;
         u8 bssid[ETH_ALEN], prev_bssid[ETH_ALEN];
         u8 ssid[IEEE80211_MAX_SSID_LEN];
-        enum {
-                IEEE80211_DISABLED, IEEE80211_AUTHENTICATE,
-                IEEE80211_ASSOCIATE, IEEE80211_ASSOCIATED,
-                IEEE80211_IBSS_SEARCH, IEEE80211_IBSS_JOINED,
-                IEEE80211_MESH_UP
-        } state;
+        enum ieee80211_sta_mlme_state state;
         size_t ssid_len;
         u8 scan_ssid[IEEE80211_MAX_SSID_LEN];
         size_t scan_ssid_len;
-#ifdef CONFIG_MAC80211_MESH
-        struct timer_list mesh_path_timer;
-        u8 mesh_id[IEEE80211_MAX_MESH_ID_LEN];
-        size_t mesh_id_len;
-        /* Active Path Selection Protocol Identifier */
-        u8 mesh_pp_id[4];
-        /* Active Path Selection Metric Identifier */
-        u8 mesh_pm_id[4];
-        /* Congestion Control Mode Identifier */
-        u8 mesh_cc_id[4];
-        /* Local mesh Destination Sequence Number */
-        u32 dsn;
-        /* Last used PREQ ID */
-        u32 preq_id;
-        atomic_t mpaths;
-        /* Timestamp of last DSN update */
-        unsigned long last_dsn_update;
-        /* Timestamp of last DSN sent */
-        unsigned long last_preq;
-        struct mesh_rmc *rmc;
-        spinlock_t mesh_preq_queue_lock;
-        struct mesh_preq_queue preq_queue;
-        int preq_queue_len;
-        struct mesh_stats mshstats;
-        struct mesh_config mshcfg;
-        u32 mesh_seqnum;
-        bool accepting_plinks;
-#endif
         u16 aid;
         u16 ap_capab, capab;
         u8 *extra_ie; /* to be added to the end of AssocReq */
@@ -353,20 +331,17 @@ struct ieee80211_if_sta {
 
         struct sk_buff_head skb_queue;
 
-        int auth_tries, assoc_tries;
+        int assoc_scan_tries; /* number of scans done pre-association */
+        int direct_probe_tries; /* retries for direct probes */
+        int auth_tries; /* retries for auth req */
+        int assoc_tries; /* retries for assoc req */
 
         unsigned long request;
 
         unsigned long last_probe;
 
         unsigned int flags;
-#define IEEE80211_STA_REQ_SCAN 0
-#define IEEE80211_STA_REQ_AUTH 1
-#define IEEE80211_STA_REQ_RUN  2
 
-#define IEEE80211_AUTH_ALG_OPEN BIT(0)
-#define IEEE80211_AUTH_ALG_SHARED_KEY BIT(1)
-#define IEEE80211_AUTH_ALG_LEAP BIT(2)
         unsigned int auth_algs; /* bitfield of allowed auth algs */
         int auth_alg; /* currently used IEEE 802.11 authentication algorithm */
         int auth_transaction;
@@ -376,31 +351,70 @@ struct ieee80211_if_sta {
         u32 supp_rates_bits[IEEE80211_NUM_BANDS];
 
         int wmm_last_param_set;
-        int num_beacons; /* number of TXed beacon frames by this STA */
 };
 
-static inline void ieee80211_if_sta_set_mesh_id(struct ieee80211_if_sta *ifsta,
-                                                u8 mesh_id_len, u8 *mesh_id)
-{
-#ifdef CONFIG_MAC80211_MESH
-        ifsta->mesh_id_len = mesh_id_len;
-        memcpy(ifsta->mesh_id, mesh_id, mesh_id_len);
-#endif
-}
+struct ieee80211_if_mesh {
+        struct work_struct work;
+        struct timer_list housekeeping_timer;
+        struct timer_list mesh_path_timer;
+        struct sk_buff_head skb_queue;
+
+        bool housekeeping;
+
+        u8 mesh_id[IEEE80211_MAX_MESH_ID_LEN];
+        size_t mesh_id_len;
+        /* Active Path Selection Protocol Identifier */
+        u8 mesh_pp_id[4];
+        /* Active Path Selection Metric Identifier */
+        u8 mesh_pm_id[4];
+        /* Congestion Control Mode Identifier */
+        u8 mesh_cc_id[4];
+        /* Local mesh Destination Sequence Number */
+        u32 dsn;
+        /* Last used PREQ ID */
+        u32 preq_id;
+        atomic_t mpaths;
+        /* Timestamp of last DSN update */
+        unsigned long last_dsn_update;
+        /* Timestamp of last DSN sent */
+        unsigned long last_preq;
+        struct mesh_rmc *rmc;
+        spinlock_t mesh_preq_queue_lock;
+        struct mesh_preq_queue preq_queue;
+        int preq_queue_len;
+        struct mesh_stats mshstats;
+        struct mesh_config mshcfg;
+        u32 mesh_seqnum;
+        bool accepting_plinks;
+};
 
 #ifdef CONFIG_MAC80211_MESH
-#define IEEE80211_IFSTA_MESH_CTR_INC(sta, name) \
-        do { (sta)->mshstats.name++; } while (0)
+#define IEEE80211_IFSTA_MESH_CTR_INC(msh, name) \
+        do { (msh)->mshstats.name++; } while (0)
 #else
-#define IEEE80211_IFSTA_MESH_CTR_INC(sta, name) \
+#define IEEE80211_IFSTA_MESH_CTR_INC(msh, name) \
         do { } while (0)
 #endif
 
-/* flags used in struct ieee80211_sub_if_data.flags */
-#define IEEE80211_SDATA_ALLMULTI        BIT(0)
-#define IEEE80211_SDATA_PROMISC         BIT(1)
-#define IEEE80211_SDATA_USERSPACE_MLME  BIT(2)
-#define IEEE80211_SDATA_OPERATING_GMODE BIT(3)
+/**
+ * enum ieee80211_sub_if_data_flags - virtual interface flags
+ *
+ * @IEEE80211_SDATA_ALLMULTI: interface wants all multicast packets
+ * @IEEE80211_SDATA_PROMISC: interface is promisc
+ * @IEEE80211_SDATA_USERSPACE_MLME: userspace MLME is active
+ * @IEEE80211_SDATA_OPERATING_GMODE: operating in G-only mode
+ * @IEEE80211_SDATA_DONT_BRIDGE_PACKETS: bridge packets between
+ *      associated stations and deliver multicast frames both
+ *      back to wireless media and to the local net stack.
+ */
+enum ieee80211_sub_if_data_flags {
+        IEEE80211_SDATA_ALLMULTI                = BIT(0),
+        IEEE80211_SDATA_PROMISC                 = BIT(1),
+        IEEE80211_SDATA_USERSPACE_MLME          = BIT(2),
+        IEEE80211_SDATA_OPERATING_GMODE         = BIT(3),
+        IEEE80211_SDATA_DONT_BRIDGE_PACKETS     = BIT(4),
+};
+
 struct ieee80211_sub_if_data {
         struct list_head list;
 
@@ -416,11 +430,6 @@ struct ieee80211_sub_if_data {
 
         int drop_unencrypted;
 
-        /*
-         * basic rates of this AP or the AP we're associated to
-         */
-        u64 basic_rates;
-
         /* Fragment table for host-based reassembly */
         struct ieee80211_fragment_entry fragments[IEEE80211_FRAGMENT_MAX];
         unsigned int fragment_next;
@@ -447,6 +456,9 @@ struct ieee80211_sub_if_data {
                 struct ieee80211_if_wds wds;
                 struct ieee80211_if_vlan vlan;
                 struct ieee80211_if_sta sta;
+#ifdef CONFIG_MAC80211_MESH
+                struct ieee80211_if_mesh mesh;
+#endif
                 u32 mntr_flags;
         } u;
 
@@ -469,7 +481,6 @@ struct ieee80211_sub_if_data {
                         struct dentry *auth_alg;
                         struct dentry *auth_transaction;
                         struct dentry *flags;
-                        struct dentry *num_beacons_sta;
                         struct dentry *force_unicast_rateidx;
                         struct dentry *max_ratectrl_rateidx;
                 } sta;
@@ -477,7 +488,6 @@ struct ieee80211_sub_if_data {
                         struct dentry *drop_unencrypted;
                         struct dentry *num_sta_ps;
                         struct dentry *dtim_count;
-                        struct dentry *num_beacons;
                         struct dentry *force_unicast_rateidx;
                         struct dentry *max_ratectrl_rateidx;
                         struct dentry *num_buffered_multicast;
@@ -540,6 +550,19 @@ struct ieee80211_sub_if_data *vif_to_sdata(struct ieee80211_vif *p)
         return container_of(p, struct ieee80211_sub_if_data, vif);
 }
 
+static inline void
+ieee80211_sdata_set_mesh_id(struct ieee80211_sub_if_data *sdata,
+                            u8 mesh_id_len, u8 *mesh_id)
+{
+#ifdef CONFIG_MAC80211_MESH
+        struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
+        ifmsh->mesh_id_len = mesh_id_len;
+        memcpy(ifmsh->mesh_id, mesh_id, mesh_id_len);
+#else
+        WARN_ON(1);
+#endif
+}
+
 enum {
         IEEE80211_RX_MSG        = 1,
         IEEE80211_TX_STATUS_MSG = 2,
@@ -550,6 +573,10 @@ enum {
 /* maximum number of hardware queues we support. */
 #define QD_MAX_QUEUES (IEEE80211_MAX_AMPDU_QUEUES + IEEE80211_MAX_QUEUES)
 
+struct ieee80211_master_priv {
+        struct ieee80211_local *local;
+};
+
 struct ieee80211_local {
         /* embed the driver visible part.
          * don't cast (use the static inlines below), but we keep
@@ -613,10 +640,6 @@ struct ieee80211_local {
         struct crypto_blkcipher *wep_rx_tfm;
         u32 wep_iv;
 
-        int bridge_packets; /* bridge packets between associated stations and
-                             * deliver multicast frames both back to wireless
-                             * media and to the local net stack */
-
         struct list_head interfaces;
 
         /*
@@ -626,21 +649,21 @@ struct ieee80211_local {
         spinlock_t key_lock;
 
 
-        bool sta_sw_scanning;
-        bool sta_hw_scanning;
+        /* Scanning and BSS list */
+        bool sw_scanning, hw_scanning;
         int scan_channel_idx;
         enum ieee80211_band scan_band;
 
         enum { SCAN_SET_CHANNEL, SCAN_SEND_PROBE } scan_state;
         unsigned long last_scan_completed;
         struct delayed_work scan_work;
-        struct net_device *scan_dev;
+        struct ieee80211_sub_if_data *scan_sdata;
         struct ieee80211_channel *oper_channel, *scan_channel;
         u8 scan_ssid[IEEE80211_MAX_SSID_LEN];
         size_t scan_ssid_len;
-        struct list_head sta_bss_list;
-        struct ieee80211_sta_bss *sta_bss_hash[STA_HASH_SIZE];
-        spinlock_t sta_bss_lock;
+        struct list_head bss_list;
+        struct ieee80211_bss *bss_hash[STA_HASH_SIZE];
+        spinlock_t bss_lock;
 
         /* SNMP counters */
         /* dot11CountersTable */
@@ -701,10 +724,11 @@ struct ieee80211_local {
 
 #ifdef CONFIG_MAC80211_DEBUGFS
         struct local_debugfsdentries {
+                struct dentry *rcdir;
+                struct dentry *rcname;
                 struct dentry *frequency;
                 struct dentry *antenna_sel_tx;
                 struct dentry *antenna_sel_rx;
-                struct dentry *bridge_packets;
                 struct dentry *rts_threshold;
                 struct dentry *fragmentation_threshold;
                 struct dentry *short_retry_limit;
@@ -774,6 +798,9 @@ struct ieee80211_ra_tid {
 
 /* Parsed Information Elements */
 struct ieee802_11_elems {
+        u8 *ie_start;
+        size_t total_len;
+
         /* pointers to IEs */
         u8 *ssid;
         u8 *supp_rates;
@@ -857,86 +884,82 @@ static inline int ieee80211_bssid_match(const u8 *raddr, const u8 *addr)
 }
 
 
-/* ieee80211.c */
 int ieee80211_hw_config(struct ieee80211_local *local);
 int ieee80211_if_config(struct ieee80211_sub_if_data *sdata, u32 changed);
 void ieee80211_tx_set_protected(struct ieee80211_tx_data *tx);
 u32 ieee80211_handle_ht(struct ieee80211_local *local, int enable_ht,
                         struct ieee80211_ht_info *req_ht_cap,
                         struct ieee80211_ht_bss_info *req_bss_cap);
+void ieee80211_bss_info_change_notify(struct ieee80211_sub_if_data *sdata,
+                                      u32 changed);
+void ieee80211_configure_filter(struct ieee80211_local *local);
 
-/* ieee80211_ioctl.c */
+/* wireless extensions */
 extern const struct iw_handler_def ieee80211_iw_handler_def;
-int ieee80211_set_freq(struct net_device *dev, int freq);
 
-/* ieee80211_sta.c */
-void ieee80211_sta_timer(unsigned long data);
-void ieee80211_sta_work(struct work_struct *work);
-void ieee80211_sta_scan_work(struct work_struct *work);
-void ieee80211_sta_rx_mgmt(struct net_device *dev, struct sk_buff *skb,
+/* STA/IBSS code */
+void ieee80211_sta_setup_sdata(struct ieee80211_sub_if_data *sdata);
+void ieee80211_scan_work(struct work_struct *work);
+void ieee80211_sta_rx_mgmt(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb,
                            struct ieee80211_rx_status *rx_status);
-int ieee80211_sta_set_ssid(struct net_device *dev, char *ssid, size_t len);
-int ieee80211_sta_get_ssid(struct net_device *dev, char *ssid, size_t *len);
-int ieee80211_sta_set_bssid(struct net_device *dev, u8 *bssid);
-int ieee80211_sta_req_scan(struct net_device *dev, u8 *ssid, size_t ssid_len);
-void ieee80211_sta_req_auth(struct net_device *dev,
+int ieee80211_sta_set_ssid(struct ieee80211_sub_if_data *sdata, char *ssid, size_t len);
+int ieee80211_sta_get_ssid(struct ieee80211_sub_if_data *sdata, char *ssid, size_t *len);
+int ieee80211_sta_set_bssid(struct ieee80211_sub_if_data *sdata, u8 *bssid);
+void ieee80211_sta_req_auth(struct ieee80211_sub_if_data *sdata,
                             struct ieee80211_if_sta *ifsta);
-int ieee80211_sta_scan_results(struct net_device *dev,
-                               struct iw_request_info *info,
-                               char *buf, size_t len);
-ieee80211_rx_result ieee80211_sta_rx_scan(
-        struct net_device *dev, struct sk_buff *skb,
-        struct ieee80211_rx_status *rx_status);
-void ieee80211_rx_bss_list_init(struct ieee80211_local *local);
-void ieee80211_rx_bss_list_deinit(struct ieee80211_local *local);
-int ieee80211_sta_set_extra_ie(struct net_device *dev, char *ie, size_t len);
-struct sta_info *ieee80211_ibss_add_sta(struct net_device *dev,
+struct sta_info *ieee80211_ibss_add_sta(struct ieee80211_sub_if_data *sdata,
                                         struct sk_buff *skb, u8 *bssid,
                                         u8 *addr, u64 supp_rates);
-int ieee80211_sta_deauthenticate(struct net_device *dev, u16 reason);
-int ieee80211_sta_disassociate(struct net_device *dev, u16 reason);
-void ieee80211_bss_info_change_notify(struct ieee80211_sub_if_data *sdata,
-                                      u32 changed);
-u32 ieee80211_reset_erp_info(struct net_device *dev);
-int ieee80211_ht_cap_ie_to_ht_info(struct ieee80211_ht_cap *ht_cap_ie,
-                                   struct ieee80211_ht_info *ht_info);
-int ieee80211_ht_addt_info_ie_to_ht_bss_info(
-                        struct ieee80211_ht_addt_info *ht_add_info_ie,
-                        struct ieee80211_ht_bss_info *bss_info);
-void ieee80211_send_addba_request(struct net_device *dev, const u8 *da,
-                                  u16 tid, u8 dialog_token, u16 start_seq_num,
-                                  u16 agg_size, u16 timeout);
-void ieee80211_send_delba(struct net_device *dev, const u8 *da, u16 tid,
-                                u16 initiator, u16 reason_code);
-void ieee80211_send_bar(struct net_device *dev, u8 *ra, u16 tid, u16 ssn);
-
-void ieee80211_sta_stop_rx_ba_session(struct net_device *dev, u8 *da,
-                                u16 tid, u16 initiator, u16 reason);
-void sta_addba_resp_timer_expired(unsigned long data);
-void ieee80211_sta_tear_down_BA_sessions(struct net_device *dev, u8 *addr);
+int ieee80211_sta_deauthenticate(struct ieee80211_sub_if_data *sdata, u16 reason);
+int ieee80211_sta_disassociate(struct ieee80211_sub_if_data *sdata, u16 reason);
+u32 ieee80211_reset_erp_info(struct ieee80211_sub_if_data *sdata);
 u64 ieee80211_sta_get_rates(struct ieee80211_local *local,
                             struct ieee802_11_elems *elems,
                             enum ieee80211_band band);
-void ieee80211_sta_tx(struct net_device *dev, struct sk_buff *skb,
-                int encrypt);
-void ieee802_11_parse_elems(u8 *start, size_t len,
-                                   struct ieee802_11_elems *elems);
-
-#ifdef CONFIG_MAC80211_MESH
-void ieee80211_start_mesh(struct net_device *dev);
-#else
-static inline void ieee80211_start_mesh(struct net_device *dev)
-{}
-#endif
+void ieee80211_send_probe_req(struct ieee80211_sub_if_data *sdata, u8 *dst,
+                              u8 *ssid, size_t ssid_len);
+
+/* scan/BSS handling */
+int ieee80211_request_scan(struct ieee80211_sub_if_data *sdata,
+                           u8 *ssid, size_t ssid_len);
+int ieee80211_scan_results(struct ieee80211_local *local,
+                           struct iw_request_info *info,
+                           char *buf, size_t len);
+ieee80211_rx_result
+ieee80211_scan_rx(struct ieee80211_sub_if_data *sdata,
+                  struct sk_buff *skb,
+                  struct ieee80211_rx_status *rx_status);
+void ieee80211_rx_bss_list_init(struct ieee80211_local *local);
+void ieee80211_rx_bss_list_deinit(struct ieee80211_local *local);
+int ieee80211_sta_set_extra_ie(struct ieee80211_sub_if_data *sdata,
+                               char *ie, size_t len);
+
+void ieee80211_mlme_notify_scan_completed(struct ieee80211_local *local);
+int ieee80211_start_scan(struct ieee80211_sub_if_data *scan_sdata,
+                         u8 *ssid, size_t ssid_len);
+struct ieee80211_bss *
+ieee80211_bss_info_update(struct ieee80211_local *local,
+                          struct ieee80211_rx_status *rx_status,
+                          struct ieee80211_mgmt *mgmt,
+                          size_t len,
+                          struct ieee802_11_elems *elems,
+                          int freq, bool beacon);
+struct ieee80211_bss *
+ieee80211_rx_bss_add(struct ieee80211_local *local, u8 *bssid, int freq,
+                     u8 *ssid, u8 ssid_len);
+struct ieee80211_bss *
+ieee80211_rx_bss_get(struct ieee80211_local *local, u8 *bssid, int freq,
+                     u8 *ssid, u8 ssid_len);
+void ieee80211_rx_bss_put(struct ieee80211_local *local,
+                          struct ieee80211_bss *bss);
 
 /* interface handling */
-void ieee80211_if_setup(struct net_device *dev);
 int ieee80211_if_add(struct ieee80211_local *local, const char *name,
-                     struct net_device **new_dev, enum ieee80211_if_types type,
+                     struct net_device **new_dev, enum nl80211_iftype type,
                      struct vif_params *params);
 int ieee80211_if_change_type(struct ieee80211_sub_if_data *sdata,
-                             enum ieee80211_if_types type);
-void ieee80211_if_remove(struct net_device *dev);
+                             enum nl80211_iftype type);
+void ieee80211_if_remove(struct ieee80211_sub_if_data *sdata);
 void ieee80211_remove_interfaces(struct ieee80211_local *local);
 
 /* tx handling */
@@ -946,16 +969,52 @@ int ieee80211_master_start_xmit(struct sk_buff *skb, struct net_device *dev);
 int ieee80211_monitor_start_xmit(struct sk_buff *skb, struct net_device *dev);
 int ieee80211_subif_start_xmit(struct sk_buff *skb, struct net_device *dev);
 
+/* HT */
+int ieee80211_ht_cap_ie_to_ht_info(struct ieee80211_ht_cap *ht_cap_ie,
+                                   struct ieee80211_ht_info *ht_info);
+int ieee80211_ht_addt_info_ie_to_ht_bss_info(
+                        struct ieee80211_ht_addt_info *ht_add_info_ie,
+                        struct ieee80211_ht_bss_info *bss_info);
+void ieee80211_send_bar(struct ieee80211_sub_if_data *sdata, u8 *ra, u16 tid, u16 ssn);
+
+void ieee80211_sta_stop_rx_ba_session(struct ieee80211_sub_if_data *sdata, u8 *da,
+                                u16 tid, u16 initiator, u16 reason);
+void ieee80211_sta_tear_down_BA_sessions(struct ieee80211_sub_if_data *sdata, u8 *addr);
+void ieee80211_process_delba(struct ieee80211_sub_if_data *sdata,
+                             struct sta_info *sta,
+                             struct ieee80211_mgmt *mgmt, size_t len);
+void ieee80211_process_addba_resp(struct ieee80211_local *local,
+                                  struct sta_info *sta,
+                                  struct ieee80211_mgmt *mgmt,
+                                  size_t len);
+void ieee80211_process_addba_request(struct ieee80211_local *local,
+                                     struct sta_info *sta,
+                                     struct ieee80211_mgmt *mgmt,
+                                     size_t len);
+
+/* Spectrum management */
+void ieee80211_process_measurement_req(struct ieee80211_sub_if_data *sdata,
+                                       struct ieee80211_mgmt *mgmt,
+                                       size_t len);
+
 /* utility functions/constants */
 extern void *mac80211_wiphy_privid; /* for wiphy privid */
 extern const unsigned char rfc1042_header[6];
 extern const unsigned char bridge_tunnel_header[6];
 u8 *ieee80211_get_bssid(struct ieee80211_hdr *hdr, size_t len,
-                        enum ieee80211_if_types type);
+                        enum nl80211_iftype type);
 int ieee80211_frame_duration(struct ieee80211_local *local, size_t len,
                              int rate, int erp, int short_preamble);
-void mac80211_ev_michael_mic_failure(struct net_device *dev, int keyidx,
+void mac80211_ev_michael_mic_failure(struct ieee80211_sub_if_data *sdata, int keyidx,
                                      struct ieee80211_hdr *hdr);
+void ieee80211_set_wmm_default(struct ieee80211_sub_if_data *sdata);
+void ieee80211_tx_skb(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb,
+                      int encrypt);
+void ieee802_11_parse_elems(u8 *start, size_t len,
+                            struct ieee802_11_elems *elems);
+int ieee80211_set_freq(struct ieee80211_sub_if_data *sdata, int freq);
+u64 ieee80211_mandatory_rates(struct ieee80211_local *local,
+                              enum ieee80211_band band);
 
 #ifdef CONFIG_MAC80211_NOINLINE
 #define debug_noinline noinline
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 610ed1d9893a..8336fee68d3e 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -1,4 +1,6 @@
 /*
+ * Interface handling (except master interface)
+ *
  * Copyright 2002-2005, Instant802 Networks, Inc.
  * Copyright 2005-2006, Devicescape Software, Inc.
  * Copyright (c) 2006 Jiri Benc <jbenc@suse.cz>
@@ -17,7 +19,539 @@
 #include "sta_info.h"
 #include "debugfs_netdev.h"
 #include "mesh.h"
+#include "led.h"
+
+static int ieee80211_change_mtu(struct net_device *dev, int new_mtu)
+{
+        int meshhdrlen;
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+
+        meshhdrlen = (sdata->vif.type == NL80211_IFTYPE_MESH_POINT) ? 5 : 0;
+
+        /* FIX: what would be proper limits for MTU?
+         * This interface uses 802.3 frames. */
+        if (new_mtu < 256 ||
+            new_mtu > IEEE80211_MAX_DATA_LEN - 24 - 6 - meshhdrlen) {
+                return -EINVAL;
+        }
+
+#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
+        printk(KERN_DEBUG "%s: setting MTU %d\n", dev->name, new_mtu);
+#endif /* CONFIG_MAC80211_VERBOSE_DEBUG */
+        dev->mtu = new_mtu;
+        return 0;
+}
+
+static inline int identical_mac_addr_allowed(int type1, int type2)
+{
+        return type1 == NL80211_IFTYPE_MONITOR ||
+                type2 == NL80211_IFTYPE_MONITOR ||
+                (type1 == NL80211_IFTYPE_AP && type2 == NL80211_IFTYPE_WDS) ||
+                (type1 == NL80211_IFTYPE_WDS &&
+                        (type2 == NL80211_IFTYPE_WDS ||
+                         type2 == NL80211_IFTYPE_AP)) ||
+                (type1 == NL80211_IFTYPE_AP && type2 == NL80211_IFTYPE_AP_VLAN) ||
+                (type1 == NL80211_IFTYPE_AP_VLAN &&
+                        (type2 == NL80211_IFTYPE_AP ||
+                         type2 == NL80211_IFTYPE_AP_VLAN));
+}
+
+static int ieee80211_open(struct net_device *dev)
+{
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_sub_if_data *nsdata;
+        struct ieee80211_local *local = sdata->local;
+        struct sta_info *sta;
+        struct ieee80211_if_init_conf conf;
+        u32 changed = 0;
+        int res;
+        bool need_hw_reconfig = 0;
+        u8 null_addr[ETH_ALEN] = {0};
+
+        /* fail early if user set an invalid address */
+        if (compare_ether_addr(dev->dev_addr, null_addr) &&
+            !is_valid_ether_addr(dev->dev_addr))
+                return -EADDRNOTAVAIL;
+
+        /* we hold the RTNL here so can safely walk the list */
+        list_for_each_entry(nsdata, &local->interfaces, list) {
+                struct net_device *ndev = nsdata->dev;
+
+                if (ndev != dev && netif_running(ndev)) {
+                        /*
+                         * Allow only a single IBSS interface to be up at any
+                         * time. This is restricted because beacon distribution
+                         * cannot work properly if both are in the same IBSS.
+                         *
+                         * To remove this restriction we'd have to disallow them
+                         * from setting the same SSID on different IBSS interfaces
+                         * belonging to the same hardware. Then, however, we're
+                         * faced with having to adopt two different TSF timers...
+                         */
+                        if (sdata->vif.type == NL80211_IFTYPE_ADHOC &&
+                            nsdata->vif.type == NL80211_IFTYPE_ADHOC)
+                                return -EBUSY;
+
+                        /*
+                         * The remaining checks are only performed for interfaces
+                         * with the same MAC address.
+                         */
+                        if (compare_ether_addr(dev->dev_addr, ndev->dev_addr))
+                                continue;
+
+                        /*
+                         * check whether it may have the same address
+                         */
+                        if (!identical_mac_addr_allowed(sdata->vif.type,
+                                                        nsdata->vif.type))
+                                return -ENOTUNIQ;
+
+                        /*
+                         * can only add VLANs to enabled APs
+                         */
+                        if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
+                            nsdata->vif.type == NL80211_IFTYPE_AP)
+                                sdata->bss = &nsdata->u.ap;
+                }
+        }
+
+        switch (sdata->vif.type) {
+        case NL80211_IFTYPE_WDS:
+                if (!is_valid_ether_addr(sdata->u.wds.remote_addr))
+                        return -ENOLINK;
+                break;
+        case NL80211_IFTYPE_AP_VLAN:
+                if (!sdata->bss)
+                        return -ENOLINK;
+                list_add(&sdata->u.vlan.list, &sdata->bss->vlans);
+                break;
+        case NL80211_IFTYPE_AP:
+                sdata->bss = &sdata->u.ap;
+                break;
+        case NL80211_IFTYPE_MESH_POINT:
+                if (!ieee80211_vif_is_mesh(&sdata->vif))
+                        break;
+                /* mesh ifaces must set allmulti to forward mcast traffic */
+                atomic_inc(&local->iff_allmultis);
+                break;
+        case NL80211_IFTYPE_STATION:
+        case NL80211_IFTYPE_MONITOR:
+        case NL80211_IFTYPE_ADHOC:
+                /* no special treatment */
+                break;
+        case NL80211_IFTYPE_UNSPECIFIED:
+        case __NL80211_IFTYPE_AFTER_LAST:
+                /* cannot happen */
+                WARN_ON(1);
+                break;
+        }
+
+        if (local->open_count == 0) {
+                res = 0;
+                if (local->ops->start)
+                        res = local->ops->start(local_to_hw(local));
+                if (res)
+                        goto err_del_bss;
+                need_hw_reconfig = 1;
+                ieee80211_led_radio(local, local->hw.conf.radio_enabled);
+        }
+
+        /*
+         * Check all interfaces and copy the hopefully now-present
+         * MAC address to those that have the special null one.
+         */
+        list_for_each_entry(nsdata, &local->interfaces, list) {
+                struct net_device *ndev = nsdata->dev;
+
+                /*
+                 * No need to check netif_running since we do not allow
+                 * it to start up with this invalid address.
+                 */
+                if (compare_ether_addr(null_addr, ndev->dev_addr) == 0)
+                        memcpy(ndev->dev_addr,
+                               local->hw.wiphy->perm_addr,
+                               ETH_ALEN);
+        }
+
+        if (compare_ether_addr(null_addr, local->mdev->dev_addr) == 0)
+                memcpy(local->mdev->dev_addr, local->hw.wiphy->perm_addr,
+                       ETH_ALEN);
+
+        /*
+         * Validate the MAC address for this device.
+         */
+        if (!is_valid_ether_addr(dev->dev_addr)) {
+                if (!local->open_count && local->ops->stop)
+                        local->ops->stop(local_to_hw(local));
+                return -EADDRNOTAVAIL;
+        }
+
+        switch (sdata->vif.type) {
+        case NL80211_IFTYPE_AP_VLAN:
+                /* no need to tell driver */
+                break;
+        case NL80211_IFTYPE_MONITOR:
+                if (sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES) {
+                        local->cooked_mntrs++;
+                        break;
+                }
+
+                /* must be before the call to ieee80211_configure_filter */
+                local->monitors++;
+                if (local->monitors == 1)
+                        local->hw.conf.flags |= IEEE80211_CONF_RADIOTAP;
+
+                if (sdata->u.mntr_flags & MONITOR_FLAG_FCSFAIL)
+                        local->fif_fcsfail++;
+                if (sdata->u.mntr_flags & MONITOR_FLAG_PLCPFAIL)
+                        local->fif_plcpfail++;
+                if (sdata->u.mntr_flags & MONITOR_FLAG_CONTROL)
+                        local->fif_control++;
+                if (sdata->u.mntr_flags & MONITOR_FLAG_OTHER_BSS)
+                        local->fif_other_bss++;
+
+                netif_addr_lock_bh(local->mdev);
+                ieee80211_configure_filter(local);
+                netif_addr_unlock_bh(local->mdev);
+                break;
+        case NL80211_IFTYPE_STATION:
+        case NL80211_IFTYPE_ADHOC:
+                sdata->u.sta.flags &= ~IEEE80211_STA_PREV_BSSID_SET;
+                /* fall through */
+        default:
+                conf.vif = &sdata->vif;
+                conf.type = sdata->vif.type;
+                conf.mac_addr = dev->dev_addr;
+                res = local->ops->add_interface(local_to_hw(local), &conf);
+                if (res)
+                        goto err_stop;
+
+                if (ieee80211_vif_is_mesh(&sdata->vif))
+                        ieee80211_start_mesh(sdata);
+                changed |= ieee80211_reset_erp_info(sdata);
+                ieee80211_bss_info_change_notify(sdata, changed);
+                ieee80211_enable_keys(sdata);
+
+                if (sdata->vif.type == NL80211_IFTYPE_STATION &&
+                    !(sdata->flags & IEEE80211_SDATA_USERSPACE_MLME))
+                        netif_carrier_off(dev);
+                else
+                        netif_carrier_on(dev);
+        }
+
+        if (sdata->vif.type == NL80211_IFTYPE_WDS) {
+                /* Create STA entry for the WDS peer */
+                sta = sta_info_alloc(sdata, sdata->u.wds.remote_addr,
+                                     GFP_KERNEL);
+                if (!sta) {
+                        res = -ENOMEM;
+                        goto err_del_interface;
+                }
+
+                /* no locking required since STA is not live yet */
+                sta->flags |= WLAN_STA_AUTHORIZED;
+
+                res = sta_info_insert(sta);
+                if (res) {
+                        /* STA has been freed */
+                        goto err_del_interface;
+                }
+        }
+
+        if (local->open_count == 0) {
+                res = dev_open(local->mdev);
+                WARN_ON(res);
+                if (res)
+                        goto err_del_interface;
+                tasklet_enable(&local->tx_pending_tasklet);
+                tasklet_enable(&local->tasklet);
+        }
+
+        /*
+         * set_multicast_list will be invoked by the networking core
+         * which will check whether any increments here were done in
+         * error and sync them down to the hardware as filter flags.
+         */
+        if (sdata->flags & IEEE80211_SDATA_ALLMULTI)
+                atomic_inc(&local->iff_allmultis);
+
+        if (sdata->flags & IEEE80211_SDATA_PROMISC)
+                atomic_inc(&local->iff_promiscs);
+
+        local->open_count++;
+        if (need_hw_reconfig) {
+                ieee80211_hw_config(local);
+                /*
+                 * set default queue parameters so drivers don't
+                 * need to initialise the hardware if the hardware
+                 * doesn't start up with sane defaults
+                 */
+                ieee80211_set_wmm_default(sdata);
+        }
+
+        /*
+         * ieee80211_sta_work is disabled while network interface
+         * is down. Therefore, some configuration changes may not
+         * yet be effective. Trigger execution of ieee80211_sta_work
+         * to fix this.
+         */
+        if (sdata->vif.type == NL80211_IFTYPE_STATION ||
+            sdata->vif.type == NL80211_IFTYPE_ADHOC) {
+                struct ieee80211_if_sta *ifsta = &sdata->u.sta;
+                queue_work(local->hw.workqueue, &ifsta->work);
+        }
+
+        netif_tx_start_all_queues(dev);
+
+        return 0;
+ err_del_interface:
+        local->ops->remove_interface(local_to_hw(local), &conf);
+ err_stop:
+        if (!local->open_count && local->ops->stop)
+                local->ops->stop(local_to_hw(local));
+ err_del_bss:
+        sdata->bss = NULL;
+        if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
+                list_del(&sdata->u.vlan.list);
+        return res;
+}
+
+static int ieee80211_stop(struct net_device *dev)
+{
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_if_init_conf conf;
+        struct sta_info *sta;
+
+        /*
+         * Stop TX on this interface first.
+         */
+        netif_tx_stop_all_queues(dev);
+
+        /*
+         * Now delete all active aggregation sessions.
+         */
+        rcu_read_lock();
+
+        list_for_each_entry_rcu(sta, &local->sta_list, list) {
+                if (sta->sdata == sdata)
+                        ieee80211_sta_tear_down_BA_sessions(sdata,
+                                                            sta->sta.addr);
+        }
+
+        rcu_read_unlock();
+
+        /*
+         * Remove all stations associated with this interface.
+         *
+         * This must be done before calling ops->remove_interface()
+         * because otherwise we can later invoke ops->sta_notify()
+         * whenever the STAs are removed, and that invalidates driver
+         * assumptions about always getting a vif pointer that is valid
+         * (because if we remove a STA after ops->remove_interface()
+         * the driver will have removed the vif info already!)
+         *
+         * We could relax this and only unlink the stations from the
+         * hash table and list but keep them on a per-sdata list that
+         * will be inserted back again when the interface is brought
+         * up again, but I don't currently see a use case for that,
+         * except with WDS which gets a STA entry created when it is
+         * brought up.
+         */
+        sta_info_flush(local, sdata);
+
+        /*
+         * Don't count this interface for promisc/allmulti while it
+         * is down. dev_mc_unsync() will invoke set_multicast_list
+         * on the master interface which will sync these down to the
+         * hardware as filter flags.
+         */
+        if (sdata->flags & IEEE80211_SDATA_ALLMULTI)
+                atomic_dec(&local->iff_allmultis);
+
+        if (sdata->flags & IEEE80211_SDATA_PROMISC)
+                atomic_dec(&local->iff_promiscs);
+
+        dev_mc_unsync(local->mdev, dev);
+
+        /* APs need special treatment */
+        if (sdata->vif.type == NL80211_IFTYPE_AP) {
+                struct ieee80211_sub_if_data *vlan, *tmp;
+                struct beacon_data *old_beacon = sdata->u.ap.beacon;
+
+                /* remove beacon */
+                rcu_assign_pointer(sdata->u.ap.beacon, NULL);
+                synchronize_rcu();
+                kfree(old_beacon);
+
+                /* down all dependent devices, that is VLANs */
+                list_for_each_entry_safe(vlan, tmp, &sdata->u.ap.vlans,
+                                         u.vlan.list)
+                        dev_close(vlan->dev);
+                WARN_ON(!list_empty(&sdata->u.ap.vlans));
+        }
+
+        local->open_count--;
+
+        switch (sdata->vif.type) {
+        case NL80211_IFTYPE_AP_VLAN:
+                list_del(&sdata->u.vlan.list);
+                /* no need to tell driver */
+                break;
+        case NL80211_IFTYPE_MONITOR:
+                if (sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES) {
+                        local->cooked_mntrs--;
+                        break;
+                }
+
+                local->monitors--;
+                if (local->monitors == 0)
+                        local->hw.conf.flags &= ~IEEE80211_CONF_RADIOTAP;
+
+                if (sdata->u.mntr_flags & MONITOR_FLAG_FCSFAIL)
+                        local->fif_fcsfail--;
+                if (sdata->u.mntr_flags & MONITOR_FLAG_PLCPFAIL)
+                        local->fif_plcpfail--;
+                if (sdata->u.mntr_flags & MONITOR_FLAG_CONTROL)
+                        local->fif_control--;
+                if (sdata->u.mntr_flags & MONITOR_FLAG_OTHER_BSS)
+                        local->fif_other_bss--;
+
+                netif_addr_lock_bh(local->mdev);
+                ieee80211_configure_filter(local);
+                netif_addr_unlock_bh(local->mdev);
+                break;
+        case NL80211_IFTYPE_STATION:
+        case NL80211_IFTYPE_ADHOC:
+                sdata->u.sta.state = IEEE80211_STA_MLME_DISABLED;
+                memset(sdata->u.sta.bssid, 0, ETH_ALEN);
+                del_timer_sync(&sdata->u.sta.timer);
+                /*
+                 * If the timer fired while we waited for it, it will have
+                 * requeued the work. Now the work will be running again
+                 * but will not rearm the timer again because it checks
+                 * whether the interface is running, which, at this point,
+                 * it no longer is.
+                 */
+                cancel_work_sync(&sdata->u.sta.work);
+                /*
+                 * When we get here, the interface is marked down.
+                 * Call synchronize_rcu() to wait for the RX path
+                 * should it be using the interface and enqueuing
+                 * frames at this very time on another CPU.
+                 */
+                synchronize_rcu();
+                skb_queue_purge(&sdata->u.sta.skb_queue);
+
+                sdata->u.sta.flags &= ~IEEE80211_STA_PRIVACY_INVOKED;
+                kfree(sdata->u.sta.extra_ie);
+                sdata->u.sta.extra_ie = NULL;
+                sdata->u.sta.extra_ie_len = 0;
+                /* fall through */
+        case NL80211_IFTYPE_MESH_POINT:
+                if (ieee80211_vif_is_mesh(&sdata->vif)) {
+                        /* allmulti is always set on mesh ifaces */
+                        atomic_dec(&local->iff_allmultis);
+                        ieee80211_stop_mesh(sdata);
+                }
+                /* fall through */
+        default:
+                if (local->scan_sdata == sdata) {
+                        if (!local->ops->hw_scan)
+                                cancel_delayed_work_sync(&local->scan_work);
+                        /*
+                         * The software scan can no longer run now, so we can
+                         * clear out the scan_sdata reference. However, the
+                         * hardware scan may still be running. The complete
+                         * function must be prepared to handle a NULL value.
+                         */
+                        local->scan_sdata = NULL;
+                        /*
+                         * The memory barrier guarantees that another CPU
+                         * that is hardware-scanning will now see the fact
+                         * that this interface is gone.
+                         */
+                        smp_mb();
+                        /*
+                         * If software scanning, complete the scan but since
+                         * the scan_sdata is NULL already don't send out a
+                         * scan event to userspace -- the scan is incomplete.
+                         */
+                        if (local->sw_scanning)
+                                ieee80211_scan_completed(&local->hw);
+                }
+
+                conf.vif = &sdata->vif;
+                conf.type = sdata->vif.type;
+                conf.mac_addr = dev->dev_addr;
+                /* disable all keys for as long as this netdev is down */
+                ieee80211_disable_keys(sdata);
+                local->ops->remove_interface(local_to_hw(local), &conf);
+        }
+
+        sdata->bss = NULL;
+
+        if (local->open_count == 0) {
+                if (netif_running(local->mdev))
+                        dev_close(local->mdev);
+
+                if (local->ops->stop)
+                        local->ops->stop(local_to_hw(local));
+
+                ieee80211_led_radio(local, 0);
+
+                flush_workqueue(local->hw.workqueue);
+
+                tasklet_disable(&local->tx_pending_tasklet);
+                tasklet_disable(&local->tasklet);
+        }
+
+        return 0;
+}
+
+static void ieee80211_set_multicast_list(struct net_device *dev)
+{
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_local *local = sdata->local;
+        int allmulti, promisc, sdata_allmulti, sdata_promisc;
+
+        allmulti = !!(dev->flags & IFF_ALLMULTI);
+        promisc = !!(dev->flags & IFF_PROMISC);
+        sdata_allmulti = !!(sdata->flags & IEEE80211_SDATA_ALLMULTI);
+        sdata_promisc = !!(sdata->flags & IEEE80211_SDATA_PROMISC);
+
+        if (allmulti != sdata_allmulti) {
+                if (dev->flags & IFF_ALLMULTI)
+                        atomic_inc(&local->iff_allmultis);
+                else
+                        atomic_dec(&local->iff_allmultis);
+                sdata->flags ^= IEEE80211_SDATA_ALLMULTI;
+        }
+
+        if (promisc != sdata_promisc) {
+                if (dev->flags & IFF_PROMISC)
+                        atomic_inc(&local->iff_promiscs);
+                else
+                        atomic_dec(&local->iff_promiscs);
+                sdata->flags ^= IEEE80211_SDATA_PROMISC;
+        }
+
+        dev_mc_sync(local->mdev, dev);
+}
 
+static void ieee80211_if_setup(struct net_device *dev)
+{
+        ether_setup(dev);
+        dev->hard_start_xmit = ieee80211_subif_start_xmit;
+        dev->wireless_handlers = &ieee80211_iw_handler_def;
+        dev->set_multicast_list = ieee80211_set_multicast_list;
+        dev->change_mtu = ieee80211_change_mtu;
+        dev->open = ieee80211_open;
+        dev->stop = ieee80211_stop;
+        dev->destructor = free_netdev;
+        /* we will validate the address ourselves in ->open */
+        dev->validate_addr = NULL;
+}
 /*
  * Called when the netdev is removed or, by the code below, before
  * the interface type changes.
@@ -31,17 +565,17 @@ static void ieee80211_teardown_sdata(struct net_device *dev)
         int flushed;
         int i;
 
-        ieee80211_debugfs_remove_netdev(sdata);
-
         /* free extra data */
         ieee80211_free_keys(sdata);
 
+        ieee80211_debugfs_remove_netdev(sdata);
+
         for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++)
                 __skb_queue_purge(&sdata->fragments[i].skb_list);
         sdata->fragment_next = 0;
 
         switch (sdata->vif.type) {
-        case IEEE80211_IF_TYPE_AP:
+        case NL80211_IFTYPE_AP:
                 beacon = sdata->u.ap.beacon;
                 rcu_assign_pointer(sdata->u.ap.beacon, NULL);
                 synchronize_rcu();
@@ -53,23 +587,23 @@ static void ieee80211_teardown_sdata(struct net_device *dev)
                 }
 
                 break;
-        case IEEE80211_IF_TYPE_MESH_POINT:
-                /* Allow compiler to elide mesh_rmc_free call. */
+        case NL80211_IFTYPE_MESH_POINT:
                 if (ieee80211_vif_is_mesh(&sdata->vif))
-                        mesh_rmc_free(dev);
-                /* fall through */
-        case IEEE80211_IF_TYPE_STA:
-        case IEEE80211_IF_TYPE_IBSS:
+                        mesh_rmc_free(sdata);
+                break;
+        case NL80211_IFTYPE_STATION:
+        case NL80211_IFTYPE_ADHOC:
                 kfree(sdata->u.sta.extra_ie);
                 kfree(sdata->u.sta.assocreq_ies);
                 kfree(sdata->u.sta.assocresp_ies);
                 kfree_skb(sdata->u.sta.probe_resp);
                 break;
-        case IEEE80211_IF_TYPE_WDS:
-        case IEEE80211_IF_TYPE_VLAN:
-        case IEEE80211_IF_TYPE_MNTR:
+        case NL80211_IFTYPE_WDS:
+        case NL80211_IFTYPE_AP_VLAN:
+        case NL80211_IFTYPE_MONITOR:
                 break;
-        case IEEE80211_IF_TYPE_INVALID:
+        case NL80211_IFTYPE_UNSPECIFIED:
+        case __NL80211_IFTYPE_AFTER_LAST:
                 BUG();
                 break;
         }
@@ -82,55 +616,43 @@ static void ieee80211_teardown_sdata(struct net_device *dev)
  * Helper function to initialise an interface to a specific type.
  */
 static void ieee80211_setup_sdata(struct ieee80211_sub_if_data *sdata,
-                                  enum ieee80211_if_types type)
+                                  enum nl80211_iftype type)
 {
-        struct ieee80211_if_sta *ifsta;
-
         /* clear type-dependent union */
         memset(&sdata->u, 0, sizeof(sdata->u));
 
         /* and set some type-dependent values */
         sdata->vif.type = type;
+        sdata->dev->hard_start_xmit = ieee80211_subif_start_xmit;
+        sdata->wdev.iftype = type;
 
         /* only monitor differs */
         sdata->dev->type = ARPHRD_ETHER;
 
         switch (type) {
-        case IEEE80211_IF_TYPE_AP:
+        case NL80211_IFTYPE_AP:
                 skb_queue_head_init(&sdata->u.ap.ps_bc_buf);
                 INIT_LIST_HEAD(&sdata->u.ap.vlans);
                 break;
-        case IEEE80211_IF_TYPE_MESH_POINT:
-        case IEEE80211_IF_TYPE_STA:
-        case IEEE80211_IF_TYPE_IBSS:
-                ifsta = &sdata->u.sta;
-                INIT_WORK(&ifsta->work, ieee80211_sta_work);
-                setup_timer(&ifsta->timer, ieee80211_sta_timer,
-                            (unsigned long) sdata);
-                skb_queue_head_init(&ifsta->skb_queue);
-
-                ifsta->capab = WLAN_CAPABILITY_ESS;
-                ifsta->auth_algs = IEEE80211_AUTH_ALG_OPEN |
-                        IEEE80211_AUTH_ALG_SHARED_KEY;
-                ifsta->flags |= IEEE80211_STA_CREATE_IBSS |
-                        IEEE80211_STA_AUTO_BSSID_SEL |
-                        IEEE80211_STA_AUTO_CHANNEL_SEL;
-                if (ieee80211_num_regular_queues(&sdata->local->hw) >= 4)
-                        ifsta->flags |= IEEE80211_STA_WMM_ENABLED;
-
+        case NL80211_IFTYPE_STATION:
+        case NL80211_IFTYPE_ADHOC:
+                ieee80211_sta_setup_sdata(sdata);
+                break;
+        case NL80211_IFTYPE_MESH_POINT:
                 if (ieee80211_vif_is_mesh(&sdata->vif))
                         ieee80211_mesh_init_sdata(sdata);
                 break;
-        case IEEE80211_IF_TYPE_MNTR:
+        case NL80211_IFTYPE_MONITOR:
                 sdata->dev->type = ARPHRD_IEEE80211_RADIOTAP;
                 sdata->dev->hard_start_xmit = ieee80211_monitor_start_xmit;
                 sdata->u.mntr_flags = MONITOR_FLAG_CONTROL |
                                       MONITOR_FLAG_OTHER_BSS;
                 break;
-        case IEEE80211_IF_TYPE_WDS:
-        case IEEE80211_IF_TYPE_VLAN:
+        case NL80211_IFTYPE_WDS:
+        case NL80211_IFTYPE_AP_VLAN:
                 break;
-        case IEEE80211_IF_TYPE_INVALID:
+        case NL80211_IFTYPE_UNSPECIFIED:
+        case __NL80211_IFTYPE_AFTER_LAST:
                 BUG();
                 break;
         }
@@ -139,7 +661,7 @@ static void ieee80211_setup_sdata(struct ieee80211_sub_if_data *sdata,
 }
 
 int ieee80211_if_change_type(struct ieee80211_sub_if_data *sdata,
-                             enum ieee80211_if_types type)
+                             enum nl80211_iftype type)
 {
         ASSERT_RTNL();
 
@@ -160,14 +682,16 @@ int ieee80211_if_change_type(struct ieee80211_sub_if_data *sdata,
         ieee80211_setup_sdata(sdata, type);
 
         /* reset some values that shouldn't be kept across type changes */
-        sdata->basic_rates = 0;
+        sdata->bss_conf.basic_rates =
+                ieee80211_mandatory_rates(sdata->local,
+                        sdata->local->hw.conf.channel->band);
         sdata->drop_unencrypted = 0;
 
         return 0;
 }
 
 int ieee80211_if_add(struct ieee80211_local *local, const char *name,
-                     struct net_device **new_dev, enum ieee80211_if_types type,
+                     struct net_device **new_dev, enum nl80211_iftype type,
                      struct vif_params *params)
 {
         struct net_device *ndev;
@@ -225,9 +749,9 @@ int ieee80211_if_add(struct ieee80211_local *local, const char *name,
 
         if (ieee80211_vif_is_mesh(&sdata->vif) &&
             params && params->mesh_id_len)
-                ieee80211_if_sta_set_mesh_id(&sdata->u.sta,
-                                             params->mesh_id_len,
-                                             params->mesh_id);
+                ieee80211_sdata_set_mesh_id(sdata,
+                                            params->mesh_id_len,
+                                            params->mesh_id);
 
         list_add_tail_rcu(&sdata->list, &local->interfaces);
 
@@ -241,15 +765,13 @@ int ieee80211_if_add(struct ieee80211_local *local, const char *name,
         return ret;
 }
 
-void ieee80211_if_remove(struct net_device *dev)
+void ieee80211_if_remove(struct ieee80211_sub_if_data *sdata)
 {
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-
         ASSERT_RTNL();
 
         list_del_rcu(&sdata->list);
         synchronize_rcu();
-        unregister_netdevice(dev);
+        unregister_netdevice(sdata->dev);
 }
 
 /*
diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index 6597c779e35a..57afcd38cd9e 100644
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -118,12 +118,12 @@ static const u8 *get_mac_for_key(struct ieee80211_key *key)
          * address to indicate a transmit-only key.
          */
         if (key->conf.alg != ALG_WEP &&
-            (key->sdata->vif.type == IEEE80211_IF_TYPE_AP ||
-             key->sdata->vif.type == IEEE80211_IF_TYPE_VLAN))
+            (key->sdata->vif.type == NL80211_IFTYPE_AP ||
+             key->sdata->vif.type == NL80211_IFTYPE_AP_VLAN))
                 addr = zero_addr;
 
         if (key->sta)
-                addr = key->sta->addr;
+                addr = key->sta->sta.addr;
 
         return addr;
 }
@@ -331,7 +331,7 @@ void ieee80211_key_link(struct ieee80211_key *key,
                  */
                 key->conf.flags |= IEEE80211_KEY_FLAG_PAIRWISE;
         } else {
-                if (sdata->vif.type == IEEE80211_IF_TYPE_STA) {
+                if (sdata->vif.type == NL80211_IFTYPE_STATION) {
                         struct sta_info *ap;
 
                         /*
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index aa5a191598c9..d608c44047c0 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -45,16 +45,9 @@ struct ieee80211_tx_status_rtap_hdr {
         u8 data_retries;
 } __attribute__ ((packed));
 
-/* common interface routines */
-
-static int header_parse_80211(const struct sk_buff *skb, unsigned char *haddr)
-{
-        memcpy(haddr, skb_mac_header(skb) + 10, ETH_ALEN); /* addr2 */
-        return ETH_ALEN;
-}
 
 /* must be called under mdev tx lock */
-static void ieee80211_configure_filter(struct ieee80211_local *local)
+void ieee80211_configure_filter(struct ieee80211_local *local)
 {
         unsigned int changed_flags;
         unsigned int new_flags = 0;
@@ -97,9 +90,24 @@ static void ieee80211_configure_filter(struct ieee80211_local *local)
 
 /* master interface */
 
+static int header_parse_80211(const struct sk_buff *skb, unsigned char *haddr)
+{
+        memcpy(haddr, skb_mac_header(skb) + 10, ETH_ALEN); /* addr2 */
+        return ETH_ALEN;
+}
+
+static const struct header_ops ieee80211_header_ops = {
+        .create         = eth_header,
+        .parse          = header_parse_80211,
+        .rebuild        = eth_rebuild_header,
+        .cache          = eth_header_cache,
+        .cache_update   = eth_header_cache_update,
+};
+
 static int ieee80211_master_open(struct net_device *dev)
 {
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+        struct ieee80211_master_priv *mpriv = netdev_priv(dev);
+        struct ieee80211_local *local = mpriv->local;
         struct ieee80211_sub_if_data *sdata;
         int res = -EOPNOTSUPP;
 
@@ -121,7 +129,8 @@ static int ieee80211_master_open(struct net_device *dev)
 
 static int ieee80211_master_stop(struct net_device *dev)
 {
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+        struct ieee80211_master_priv *mpriv = netdev_priv(dev);
+        struct ieee80211_local *local = mpriv->local;
         struct ieee80211_sub_if_data *sdata;
 
         /* we hold the RTNL here so can safely walk the list */
@@ -134,849 +143,12 @@ static int ieee80211_master_stop(struct net_device *dev)
 
 static void ieee80211_master_set_multicast_list(struct net_device *dev)
 {
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+        struct ieee80211_master_priv *mpriv = netdev_priv(dev);
+        struct ieee80211_local *local = mpriv->local;
 
         ieee80211_configure_filter(local);
 }
 
-/* regular interfaces */
-
-static int ieee80211_change_mtu(struct net_device *dev, int new_mtu)
-{
-        int meshhdrlen;
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-
-        meshhdrlen = (sdata->vif.type == IEEE80211_IF_TYPE_MESH_POINT) ? 5 : 0;
-
-        /* FIX: what would be proper limits for MTU?
-         * This interface uses 802.3 frames. */
-        if (new_mtu < 256 ||
-            new_mtu > IEEE80211_MAX_DATA_LEN - 24 - 6 - meshhdrlen) {
-                return -EINVAL;
-        }
-
-#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
-        printk(KERN_DEBUG "%s: setting MTU %d\n", dev->name, new_mtu);
-#endif /* CONFIG_MAC80211_VERBOSE_DEBUG */
-        dev->mtu = new_mtu;
-        return 0;
-}
-
-static inline int identical_mac_addr_allowed(int type1, int type2)
-{
-        return (type1 == IEEE80211_IF_TYPE_MNTR ||
-                type2 == IEEE80211_IF_TYPE_MNTR ||
-                (type1 == IEEE80211_IF_TYPE_AP &&
-                 type2 == IEEE80211_IF_TYPE_WDS) ||
-                (type1 == IEEE80211_IF_TYPE_WDS &&
-                 (type2 == IEEE80211_IF_TYPE_WDS ||
-                  type2 == IEEE80211_IF_TYPE_AP)) ||
-                (type1 == IEEE80211_IF_TYPE_AP &&
-                 type2 == IEEE80211_IF_TYPE_VLAN) ||
-                (type1 == IEEE80211_IF_TYPE_VLAN &&
-                 (type2 == IEEE80211_IF_TYPE_AP ||
-                  type2 == IEEE80211_IF_TYPE_VLAN)));
-}
-
-static int ieee80211_open(struct net_device *dev)
-{
-        struct ieee80211_sub_if_data *sdata, *nsdata;
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        struct sta_info *sta;
-        struct ieee80211_if_init_conf conf;
-        u32 changed = 0;
-        int res;
-        bool need_hw_reconfig = 0;
-
-        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-
-        /* we hold the RTNL here so can safely walk the list */
-        list_for_each_entry(nsdata, &local->interfaces, list) {
-                struct net_device *ndev = nsdata->dev;
-
-                if (ndev != dev && netif_running(ndev)) {
-                        /*
-                         * Allow only a single IBSS interface to be up at any
-                         * time. This is restricted because beacon distribution
-                         * cannot work properly if both are in the same IBSS.
-                         *
-                         * To remove this restriction we'd have to disallow them
-                         * from setting the same SSID on different IBSS interfaces
-                         * belonging to the same hardware. Then, however, we're
-                         * faced with having to adopt two different TSF timers...
-                         */
-                        if (sdata->vif.type == IEEE80211_IF_TYPE_IBSS &&
-                            nsdata->vif.type == IEEE80211_IF_TYPE_IBSS)
-                                return -EBUSY;
-
-                        /*
-                         * The remaining checks are only performed for interfaces
-                         * with the same MAC address.
-                         */
-                        if (compare_ether_addr(dev->dev_addr, ndev->dev_addr))
-                                continue;
-
-                        /*
-                         * check whether it may have the same address
-                         */
-                        if (!identical_mac_addr_allowed(sdata->vif.type,
-                                                        nsdata->vif.type))
-                                return -ENOTUNIQ;
-
-                        /*
-                         * can only add VLANs to enabled APs
-                         */
-                        if (sdata->vif.type == IEEE80211_IF_TYPE_VLAN &&
-                            nsdata->vif.type == IEEE80211_IF_TYPE_AP)
-                                sdata->bss = &nsdata->u.ap;
-                }
-        }
-
-        switch (sdata->vif.type) {
-        case IEEE80211_IF_TYPE_WDS:
-                if (!is_valid_ether_addr(sdata->u.wds.remote_addr))
-                        return -ENOLINK;
-                break;
-        case IEEE80211_IF_TYPE_VLAN:
-                if (!sdata->bss)
-                        return -ENOLINK;
-                list_add(&sdata->u.vlan.list, &sdata->bss->vlans);
-                break;
-        case IEEE80211_IF_TYPE_AP:
-                sdata->bss = &sdata->u.ap;
-                break;
-        case IEEE80211_IF_TYPE_MESH_POINT:
-                /* mesh ifaces must set allmulti to forward mcast traffic */
-                atomic_inc(&local->iff_allmultis);
-                break;
-        case IEEE80211_IF_TYPE_STA:
-        case IEEE80211_IF_TYPE_MNTR:
-        case IEEE80211_IF_TYPE_IBSS:
-                /* no special treatment */
-                break;
-        case IEEE80211_IF_TYPE_INVALID:
-                /* cannot happen */
-                WARN_ON(1);
-                break;
-        }
-
-        if (local->open_count == 0) {
-                res = 0;
-                if (local->ops->start)
-                        res = local->ops->start(local_to_hw(local));
-                if (res)
-                        goto err_del_bss;
-                need_hw_reconfig = 1;
-                ieee80211_led_radio(local, local->hw.conf.radio_enabled);
-        }
-
-        switch (sdata->vif.type) {
-        case IEEE80211_IF_TYPE_VLAN:
-                /* no need to tell driver */
-                break;
-        case IEEE80211_IF_TYPE_MNTR:
-                if (sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES) {
-                        local->cooked_mntrs++;
-                        break;
-                }
-
-                /* must be before the call to ieee80211_configure_filter */
-                local->monitors++;
-                if (local->monitors == 1)
-                        local->hw.conf.flags |= IEEE80211_CONF_RADIOTAP;
-
-                if (sdata->u.mntr_flags & MONITOR_FLAG_FCSFAIL)
-                        local->fif_fcsfail++;
-                if (sdata->u.mntr_flags & MONITOR_FLAG_PLCPFAIL)
-                        local->fif_plcpfail++;
-                if (sdata->u.mntr_flags & MONITOR_FLAG_CONTROL)
-                        local->fif_control++;
-                if (sdata->u.mntr_flags & MONITOR_FLAG_OTHER_BSS)
-                        local->fif_other_bss++;
-
-                netif_addr_lock_bh(local->mdev);
-                ieee80211_configure_filter(local);
-                netif_addr_unlock_bh(local->mdev);
-                break;
-        case IEEE80211_IF_TYPE_STA:
-        case IEEE80211_IF_TYPE_IBSS:
-                sdata->u.sta.flags &= ~IEEE80211_STA_PREV_BSSID_SET;
-                /* fall through */
-        default:
-                conf.vif = &sdata->vif;
-                conf.type = sdata->vif.type;
-                conf.mac_addr = dev->dev_addr;
-                res = local->ops->add_interface(local_to_hw(local), &conf);
-                if (res)
-                        goto err_stop;
-
-                if (ieee80211_vif_is_mesh(&sdata->vif))
-                        ieee80211_start_mesh(sdata->dev);
-                changed |= ieee80211_reset_erp_info(dev);
-                ieee80211_bss_info_change_notify(sdata, changed);
-                ieee80211_enable_keys(sdata);
-
-                if (sdata->vif.type == IEEE80211_IF_TYPE_STA &&
-                    !(sdata->flags & IEEE80211_SDATA_USERSPACE_MLME))
-                        netif_carrier_off(dev);
-                else
-                        netif_carrier_on(dev);
-        }
-
-        if (sdata->vif.type == IEEE80211_IF_TYPE_WDS) {
-                /* Create STA entry for the WDS peer */
-                sta = sta_info_alloc(sdata, sdata->u.wds.remote_addr,
-                                     GFP_KERNEL);
-                if (!sta) {
-                        res = -ENOMEM;
-                        goto err_del_interface;
-                }
-
-                /* no locking required since STA is not live yet */
-                sta->flags |= WLAN_STA_AUTHORIZED;
-
-                res = sta_info_insert(sta);
-                if (res) {
-                        /* STA has been freed */
-                        goto err_del_interface;
-                }
-        }
-
-        if (local->open_count == 0) {
-                res = dev_open(local->mdev);
-                WARN_ON(res);
-                if (res)
-                        goto err_del_interface;
-                tasklet_enable(&local->tx_pending_tasklet);
-                tasklet_enable(&local->tasklet);
-        }
-
-        /*
-         * set_multicast_list will be invoked by the networking core
-         * which will check whether any increments here were done in
-         * error and sync them down to the hardware as filter flags.
-         */
-        if (sdata->flags & IEEE80211_SDATA_ALLMULTI)
-                atomic_inc(&local->iff_allmultis);
-
-        if (sdata->flags & IEEE80211_SDATA_PROMISC)
-                atomic_inc(&local->iff_promiscs);
-
-        local->open_count++;
-        if (need_hw_reconfig)
-                ieee80211_hw_config(local);
-
-        /*
-         * ieee80211_sta_work is disabled while network interface
-         * is down. Therefore, some configuration changes may not
-         * yet be effective. Trigger execution of ieee80211_sta_work
-         * to fix this.
-         */
-        if (sdata->vif.type == IEEE80211_IF_TYPE_STA ||
-            sdata->vif.type == IEEE80211_IF_TYPE_IBSS) {
-                struct ieee80211_if_sta *ifsta = &sdata->u.sta;
-                queue_work(local->hw.workqueue, &ifsta->work);
-        }
-
-        netif_tx_start_all_queues(dev);
-
-        return 0;
- err_del_interface:
-        local->ops->remove_interface(local_to_hw(local), &conf);
- err_stop:
-        if (!local->open_count && local->ops->stop)
-                local->ops->stop(local_to_hw(local));
- err_del_bss:
-        sdata->bss = NULL;
-        if (sdata->vif.type == IEEE80211_IF_TYPE_VLAN)
-                list_del(&sdata->u.vlan.list);
-        return res;
-}
-
-static int ieee80211_stop(struct net_device *dev)
-{
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        struct ieee80211_local *local = sdata->local;
-        struct ieee80211_if_init_conf conf;
-        struct sta_info *sta;
-
-        /*
-         * Stop TX on this interface first.
-         */
-        netif_tx_stop_all_queues(dev);
-
-        /*
-         * Now delete all active aggregation sessions.
-         */
-        rcu_read_lock();
-
-        list_for_each_entry_rcu(sta, &local->sta_list, list) {
-                if (sta->sdata == sdata)
-                        ieee80211_sta_tear_down_BA_sessions(dev, sta->addr);
-        }
-
-        rcu_read_unlock();
-
-        /*
-         * Remove all stations associated with this interface.
-         *
-         * This must be done before calling ops->remove_interface()
-         * because otherwise we can later invoke ops->sta_notify()
-         * whenever the STAs are removed, and that invalidates driver
-         * assumptions about always getting a vif pointer that is valid
-         * (because if we remove a STA after ops->remove_interface()
-         * the driver will have removed the vif info already!)
-         *
-         * We could relax this and only unlink the stations from the
-         * hash table and list but keep them on a per-sdata list that
-         * will be inserted back again when the interface is brought
-         * up again, but I don't currently see a use case for that,
-         * except with WDS which gets a STA entry created when it is
-         * brought up.
-         */
-        sta_info_flush(local, sdata);
-
-        /*
-         * Don't count this interface for promisc/allmulti while it
-         * is down. dev_mc_unsync() will invoke set_multicast_list
-         * on the master interface which will sync these down to the
-         * hardware as filter flags.
-         */
-        if (sdata->flags & IEEE80211_SDATA_ALLMULTI)
-                atomic_dec(&local->iff_allmultis);
-
-        if (sdata->flags & IEEE80211_SDATA_PROMISC)
-                atomic_dec(&local->iff_promiscs);
-
-        dev_mc_unsync(local->mdev, dev);
-
-        /* APs need special treatment */
-        if (sdata->vif.type == IEEE80211_IF_TYPE_AP) {
-                struct ieee80211_sub_if_data *vlan, *tmp;
-                struct beacon_data *old_beacon = sdata->u.ap.beacon;
-
-                /* remove beacon */
-                rcu_assign_pointer(sdata->u.ap.beacon, NULL);
-                synchronize_rcu();
-                kfree(old_beacon);
-
-                /* down all dependent devices, that is VLANs */
-                list_for_each_entry_safe(vlan, tmp, &sdata->u.ap.vlans,
-                                         u.vlan.list)
-                        dev_close(vlan->dev);
-                WARN_ON(!list_empty(&sdata->u.ap.vlans));
-        }
-
-        local->open_count--;
-
-        switch (sdata->vif.type) {
-        case IEEE80211_IF_TYPE_VLAN:
-                list_del(&sdata->u.vlan.list);
-                /* no need to tell driver */
-                break;
-        case IEEE80211_IF_TYPE_MNTR:
-                if (sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES) {
-                        local->cooked_mntrs--;
-                        break;
-                }
-
-                local->monitors--;
-                if (local->monitors == 0)
-                        local->hw.conf.flags &= ~IEEE80211_CONF_RADIOTAP;
-
-                if (sdata->u.mntr_flags & MONITOR_FLAG_FCSFAIL)
-                        local->fif_fcsfail--;
-                if (sdata->u.mntr_flags & MONITOR_FLAG_PLCPFAIL)
-                        local->fif_plcpfail--;
-                if (sdata->u.mntr_flags & MONITOR_FLAG_CONTROL)
-                        local->fif_control--;
-                if (sdata->u.mntr_flags & MONITOR_FLAG_OTHER_BSS)
-                        local->fif_other_bss--;
-
-                netif_addr_lock_bh(local->mdev);
-                ieee80211_configure_filter(local);
-                netif_addr_unlock_bh(local->mdev);
-                break;
-        case IEEE80211_IF_TYPE_MESH_POINT:
-                /* allmulti is always set on mesh ifaces */
-                atomic_dec(&local->iff_allmultis);
-                /* fall through */
-        case IEEE80211_IF_TYPE_STA:
-        case IEEE80211_IF_TYPE_IBSS:
-                sdata->u.sta.state = IEEE80211_DISABLED;
-                memset(sdata->u.sta.bssid, 0, ETH_ALEN);
-                del_timer_sync(&sdata->u.sta.timer);
-                /*
-                 * When we get here, the interface is marked down.
-                 * Call synchronize_rcu() to wait for the RX path
-                 * should it be using the interface and enqueuing
-                 * frames at this very time on another CPU.
-                 */
-                synchronize_rcu();
-                skb_queue_purge(&sdata->u.sta.skb_queue);
-
-                if (local->scan_dev == sdata->dev) {
-                        if (!local->ops->hw_scan) {
-                                local->sta_sw_scanning = 0;
-                                cancel_delayed_work(&local->scan_work);
-                        } else
-                                local->sta_hw_scanning = 0;
-                }
-
-                sdata->u.sta.flags &= ~IEEE80211_STA_PRIVACY_INVOKED;
-                kfree(sdata->u.sta.extra_ie);
-                sdata->u.sta.extra_ie = NULL;
-                sdata->u.sta.extra_ie_len = 0;
-                /* fall through */
-        default:
-                conf.vif = &sdata->vif;
-                conf.type = sdata->vif.type;
-                conf.mac_addr = dev->dev_addr;
-                /* disable all keys for as long as this netdev is down */
-                ieee80211_disable_keys(sdata);
-                local->ops->remove_interface(local_to_hw(local), &conf);
-        }
-
-        sdata->bss = NULL;
-
-        if (local->open_count == 0) {
-                if (netif_running(local->mdev))
-                        dev_close(local->mdev);
-
-                if (local->ops->stop)
-                        local->ops->stop(local_to_hw(local));
-
-                ieee80211_led_radio(local, 0);
-
-                flush_workqueue(local->hw.workqueue);
-
-                tasklet_disable(&local->tx_pending_tasklet);
-                tasklet_disable(&local->tasklet);
-        }
-
-        return 0;
-}
-
-int ieee80211_start_tx_ba_session(struct ieee80211_hw *hw, u8 *ra, u16 tid)
-{
-        struct ieee80211_local *local = hw_to_local(hw);
-        struct sta_info *sta;
-        struct ieee80211_sub_if_data *sdata;
-        u16 start_seq_num = 0;
-        u8 *state;
-        int ret;
-        DECLARE_MAC_BUF(mac);
-
-        if (tid >= STA_TID_NUM)
-                return -EINVAL;
-
-#ifdef CONFIG_MAC80211_HT_DEBUG
-        printk(KERN_DEBUG "Open BA session requested for %s tid %u\n",
-                                print_mac(mac, ra), tid);
-#endif /* CONFIG_MAC80211_HT_DEBUG */
-
-        rcu_read_lock();
-
-        sta = sta_info_get(local, ra);
-        if (!sta) {
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                printk(KERN_DEBUG "Could not find the station\n");
-#endif
-                ret = -ENOENT;
-                goto exit;
-        }
-
-        spin_lock_bh(&sta->lock);
-
-        /* we have tried too many times, receiver does not want A-MPDU */
-        if (sta->ampdu_mlme.addba_req_num[tid] > HT_AGG_MAX_RETRIES) {
-                ret = -EBUSY;
-                goto err_unlock_sta;
-        }
-
-        state = &sta->ampdu_mlme.tid_state_tx[tid];
-        /* check if the TID is not in aggregation flow already */
-        if (*state != HT_AGG_STATE_IDLE) {
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                printk(KERN_DEBUG "BA request denied - session is not "
-                                 "idle on tid %u\n", tid);
-#endif /* CONFIG_MAC80211_HT_DEBUG */
-                ret = -EAGAIN;
-                goto err_unlock_sta;
-        }
-
-        /* prepare A-MPDU MLME for Tx aggregation */
-        sta->ampdu_mlme.tid_tx[tid] =
-                        kmalloc(sizeof(struct tid_ampdu_tx), GFP_ATOMIC);
-        if (!sta->ampdu_mlme.tid_tx[tid]) {
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                if (net_ratelimit())
-                        printk(KERN_ERR "allocate tx mlme to tid %d failed\n",
-                                        tid);
-#endif
-                ret = -ENOMEM;
-                goto err_unlock_sta;
-        }
-        /* Tx timer */
-        sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer.function =
-                        sta_addba_resp_timer_expired;
-        sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer.data =
-                        (unsigned long)&sta->timer_to_tid[tid];
-        init_timer(&sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer);
-
-        /* create a new queue for this aggregation */
-        ret = ieee80211_ht_agg_queue_add(local, sta, tid);
-
-        /* case no queue is available to aggregation
-         * don't switch to aggregation */
-        if (ret) {
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                printk(KERN_DEBUG "BA request denied - queue unavailable for"
-                                        " tid %d\n", tid);
-#endif /* CONFIG_MAC80211_HT_DEBUG */
-                goto err_unlock_queue;
-        }
-        sdata = sta->sdata;
-
-        /* Ok, the Addba frame hasn't been sent yet, but if the driver calls the
-         * call back right away, it must see that the flow has begun */
-        *state |= HT_ADDBA_REQUESTED_MSK;
-
-        if (local->ops->ampdu_action)
-                ret = local->ops->ampdu_action(hw, IEEE80211_AMPDU_TX_START,
-                                                ra, tid, &start_seq_num);
-
-        if (ret) {
-                /* No need to requeue the packets in the agg queue, since we
-                 * held the tx lock: no packet could be enqueued to the newly
-                 * allocated queue */
-                ieee80211_ht_agg_queue_remove(local, sta, tid, 0);
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                printk(KERN_DEBUG "BA request denied - HW unavailable for"
-                                        " tid %d\n", tid);
-#endif /* CONFIG_MAC80211_HT_DEBUG */
-                *state = HT_AGG_STATE_IDLE;
-                goto err_unlock_queue;
-        }
-
-        /* Will put all the packets in the new SW queue */
-        ieee80211_requeue(local, ieee802_1d_to_ac[tid]);
-        spin_unlock_bh(&sta->lock);
-
-        /* send an addBA request */
-        sta->ampdu_mlme.dialog_token_allocator++;
-        sta->ampdu_mlme.tid_tx[tid]->dialog_token =
-                        sta->ampdu_mlme.dialog_token_allocator;
-        sta->ampdu_mlme.tid_tx[tid]->ssn = start_seq_num;
-
-
-        ieee80211_send_addba_request(sta->sdata->dev, ra, tid,
-                         sta->ampdu_mlme.tid_tx[tid]->dialog_token,
-                         sta->ampdu_mlme.tid_tx[tid]->ssn,
-                         0x40, 5000);
-        /* activate the timer for the recipient's addBA response */
-        sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer.expires =
-                                jiffies + ADDBA_RESP_INTERVAL;
-        add_timer(&sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer);
-#ifdef CONFIG_MAC80211_HT_DEBUG
-        printk(KERN_DEBUG "activated addBA response timer on tid %d\n", tid);
-#endif
-        goto exit;
-
-err_unlock_queue:
-        kfree(sta->ampdu_mlme.tid_tx[tid]);
-        sta->ampdu_mlme.tid_tx[tid] = NULL;
-        ret = -EBUSY;
-err_unlock_sta:
-        spin_unlock_bh(&sta->lock);
-exit:
-        rcu_read_unlock();
-        return ret;
-}
-EXPORT_SYMBOL(ieee80211_start_tx_ba_session);
-
-int ieee80211_stop_tx_ba_session(struct ieee80211_hw *hw,
-                                 u8 *ra, u16 tid,
-                                 enum ieee80211_back_parties initiator)
-{
-        struct ieee80211_local *local = hw_to_local(hw);
-        struct sta_info *sta;
-        u8 *state;
-        int ret = 0;
-        DECLARE_MAC_BUF(mac);
-
-        if (tid >= STA_TID_NUM)
-                return -EINVAL;
-
-        rcu_read_lock();
-        sta = sta_info_get(local, ra);
-        if (!sta) {
-                rcu_read_unlock();
-                return -ENOENT;
-        }
-
-        /* check if the TID is in aggregation */
-        state = &sta->ampdu_mlme.tid_state_tx[tid];
-        spin_lock_bh(&sta->lock);
-
-        if (*state != HT_AGG_STATE_OPERATIONAL) {
-                ret = -ENOENT;
-                goto stop_BA_exit;
-        }
-
-#ifdef CONFIG_MAC80211_HT_DEBUG
-        printk(KERN_DEBUG "Tx BA session stop requested for %s tid %u\n",
-                                print_mac(mac, ra), tid);
-#endif /* CONFIG_MAC80211_HT_DEBUG */
-
-        ieee80211_stop_queue(hw, sta->tid_to_tx_q[tid]);
-
-        *state = HT_AGG_STATE_REQ_STOP_BA_MSK |
-                (initiator << HT_AGG_STATE_INITIATOR_SHIFT);
-
-        if (local->ops->ampdu_action)
-                ret = local->ops->ampdu_action(hw, IEEE80211_AMPDU_TX_STOP,
-                                                ra, tid, NULL);
-
-        /* case HW denied going back to legacy */
-        if (ret) {
-                WARN_ON(ret != -EBUSY);
-                *state = HT_AGG_STATE_OPERATIONAL;
-                ieee80211_wake_queue(hw, sta->tid_to_tx_q[tid]);
-                goto stop_BA_exit;
-        }
-
-stop_BA_exit:
-        spin_unlock_bh(&sta->lock);
-        rcu_read_unlock();
-        return ret;
-}
-EXPORT_SYMBOL(ieee80211_stop_tx_ba_session);
-
-void ieee80211_start_tx_ba_cb(struct ieee80211_hw *hw, u8 *ra, u16 tid)
-{
-        struct ieee80211_local *local = hw_to_local(hw);
-        struct sta_info *sta;
-        u8 *state;
-        DECLARE_MAC_BUF(mac);
-
-        if (tid >= STA_TID_NUM) {
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                printk(KERN_DEBUG "Bad TID value: tid = %d (>= %d)\n",
-                                tid, STA_TID_NUM);
-#endif
-                return;
-        }
-
-        rcu_read_lock();
-        sta = sta_info_get(local, ra);
-        if (!sta) {
-                rcu_read_unlock();
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                printk(KERN_DEBUG "Could not find station: %s\n",
-                                print_mac(mac, ra));
-#endif
-                return;
-        }
-
-        state = &sta->ampdu_mlme.tid_state_tx[tid];
-        spin_lock_bh(&sta->lock);
-
-        if (!(*state & HT_ADDBA_REQUESTED_MSK)) {
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                printk(KERN_DEBUG "addBA was not requested yet, state is %d\n",
-                                *state);
-#endif
-                spin_unlock_bh(&sta->lock);
-                rcu_read_unlock();
-                return;
-        }
-
-        WARN_ON_ONCE(*state & HT_ADDBA_DRV_READY_MSK);
-
-        *state |= HT_ADDBA_DRV_READY_MSK;
-
-        if (*state == HT_AGG_STATE_OPERATIONAL) {
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                printk(KERN_DEBUG "Aggregation is on for tid %d \n", tid);
-#endif
-                ieee80211_wake_queue(hw, sta->tid_to_tx_q[tid]);
-        }
-        spin_unlock_bh(&sta->lock);
-        rcu_read_unlock();
-}
-EXPORT_SYMBOL(ieee80211_start_tx_ba_cb);
-
-void ieee80211_stop_tx_ba_cb(struct ieee80211_hw *hw, u8 *ra, u8 tid)
-{
-        struct ieee80211_local *local = hw_to_local(hw);
-        struct sta_info *sta;
-        u8 *state;
-        int agg_queue;
-        DECLARE_MAC_BUF(mac);
-
-        if (tid >= STA_TID_NUM) {
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                printk(KERN_DEBUG "Bad TID value: tid = %d (>= %d)\n",
-                                tid, STA_TID_NUM);
-#endif
-                return;
-        }
-
-#ifdef CONFIG_MAC80211_HT_DEBUG
-        printk(KERN_DEBUG "Stopping Tx BA session for %s tid %d\n",
-                                print_mac(mac, ra), tid);
-#endif /* CONFIG_MAC80211_HT_DEBUG */
-
-        rcu_read_lock();
-        sta = sta_info_get(local, ra);
-        if (!sta) {
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                printk(KERN_DEBUG "Could not find station: %s\n",
-                                print_mac(mac, ra));
-#endif
-                rcu_read_unlock();
-                return;
-        }
-        state = &sta->ampdu_mlme.tid_state_tx[tid];
-
-        /* NOTE: no need to use sta->lock in this state check, as
-         * ieee80211_stop_tx_ba_session will let only one stop call to
-         * pass through per sta/tid
-         */
-        if ((*state & HT_AGG_STATE_REQ_STOP_BA_MSK) == 0) {
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                printk(KERN_DEBUG "unexpected callback to A-MPDU stop\n");
-#endif
-                rcu_read_unlock();
-                return;
-        }
-
-        if (*state & HT_AGG_STATE_INITIATOR_MSK)
-                ieee80211_send_delba(sta->sdata->dev, ra, tid,
-                        WLAN_BACK_INITIATOR, WLAN_REASON_QSTA_NOT_USE);
-
-        agg_queue = sta->tid_to_tx_q[tid];
-
-        ieee80211_ht_agg_queue_remove(local, sta, tid, 1);
-
-        /* We just requeued the all the frames that were in the
-         * removed queue, and since we might miss a softirq we do
-         * netif_schedule_queue.  ieee80211_wake_queue is not used
-         * here as this queue is not necessarily stopped
-         */
-        netif_schedule_queue(netdev_get_tx_queue(local->mdev, agg_queue));
-        spin_lock_bh(&sta->lock);
-        *state = HT_AGG_STATE_IDLE;
-        sta->ampdu_mlme.addba_req_num[tid] = 0;
-        kfree(sta->ampdu_mlme.tid_tx[tid]);
-        sta->ampdu_mlme.tid_tx[tid] = NULL;
-        spin_unlock_bh(&sta->lock);
-
-        rcu_read_unlock();
-}
-EXPORT_SYMBOL(ieee80211_stop_tx_ba_cb);
-
-void ieee80211_start_tx_ba_cb_irqsafe(struct ieee80211_hw *hw,
-                                      const u8 *ra, u16 tid)
-{
-        struct ieee80211_local *local = hw_to_local(hw);
-        struct ieee80211_ra_tid *ra_tid;
-        struct sk_buff *skb = dev_alloc_skb(0);
-
-        if (unlikely(!skb)) {
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                if (net_ratelimit())
-                        printk(KERN_WARNING "%s: Not enough memory, "
-                               "dropping start BA session", skb->dev->name);
-#endif
-                return;
-        }
-        ra_tid = (struct ieee80211_ra_tid *) &skb->cb;
-        memcpy(&ra_tid->ra, ra, ETH_ALEN);
-        ra_tid->tid = tid;
-
-        skb->pkt_type = IEEE80211_ADDBA_MSG;
-        skb_queue_tail(&local->skb_queue, skb);
-        tasklet_schedule(&local->tasklet);
-}
-EXPORT_SYMBOL(ieee80211_start_tx_ba_cb_irqsafe);
-
-void ieee80211_stop_tx_ba_cb_irqsafe(struct ieee80211_hw *hw,
-                                     const u8 *ra, u16 tid)
-{
-        struct ieee80211_local *local = hw_to_local(hw);
-        struct ieee80211_ra_tid *ra_tid;
-        struct sk_buff *skb = dev_alloc_skb(0);
-
-        if (unlikely(!skb)) {
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                if (net_ratelimit())
-                        printk(KERN_WARNING "%s: Not enough memory, "
-                               "dropping stop BA session", skb->dev->name);
-#endif
-                return;
-        }
-        ra_tid = (struct ieee80211_ra_tid *) &skb->cb;
-        memcpy(&ra_tid->ra, ra, ETH_ALEN);
-        ra_tid->tid = tid;
-
-        skb->pkt_type = IEEE80211_DELBA_MSG;
-        skb_queue_tail(&local->skb_queue, skb);
-        tasklet_schedule(&local->tasklet);
-}
-EXPORT_SYMBOL(ieee80211_stop_tx_ba_cb_irqsafe);
-
-static void ieee80211_set_multicast_list(struct net_device *dev)
-{
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        int allmulti, promisc, sdata_allmulti, sdata_promisc;
-
-        allmulti = !!(dev->flags & IFF_ALLMULTI);
-        promisc = !!(dev->flags & IFF_PROMISC);
-        sdata_allmulti = !!(sdata->flags & IEEE80211_SDATA_ALLMULTI);
-        sdata_promisc = !!(sdata->flags & IEEE80211_SDATA_PROMISC);
-
-        if (allmulti != sdata_allmulti) {
-                if (dev->flags & IFF_ALLMULTI)
-                        atomic_inc(&local->iff_allmultis);
-                else
-                        atomic_dec(&local->iff_allmultis);
-                sdata->flags ^= IEEE80211_SDATA_ALLMULTI;
-        }
-
-        if (promisc != sdata_promisc) {
-                if (dev->flags & IFF_PROMISC)
-                        atomic_inc(&local->iff_promiscs);
-                else
-                        atomic_dec(&local->iff_promiscs);
-                sdata->flags ^= IEEE80211_SDATA_PROMISC;
-        }
-
-        dev_mc_sync(local->mdev, dev);
-}
-
-static const struct header_ops ieee80211_header_ops = {
-        .create         = eth_header,
-        .parse          = header_parse_80211,
-        .rebuild        = eth_rebuild_header,
-        .cache          = eth_header_cache,
-        .cache_update   = eth_header_cache_update,
-};
-
-void ieee80211_if_setup(struct net_device *dev)
-{
-        ether_setup(dev);
-        dev->hard_start_xmit = ieee80211_subif_start_xmit;
-        dev->wireless_handlers = &ieee80211_iw_handler_def;
-        dev->set_multicast_list = ieee80211_set_multicast_list;
-        dev->change_mtu = ieee80211_change_mtu;
-        dev->open = ieee80211_open;
-        dev->stop = ieee80211_stop;
-        dev->destructor = free_netdev;
-}
-
 /* everything else */
 
 int ieee80211_if_config(struct ieee80211_sub_if_data *sdata, u32 changed)
@@ -987,18 +159,21 @@ int ieee80211_if_config(struct ieee80211_sub_if_data *sdata, u32 changed)
         if (WARN_ON(!netif_running(sdata->dev)))
                 return 0;
 
+        if (WARN_ON(sdata->vif.type == NL80211_IFTYPE_AP_VLAN))
+                return -EINVAL;
+
         if (!local->ops->config_interface)
                 return 0;
 
         memset(&conf, 0, sizeof(conf));
         conf.changed = changed;
 
-        if (sdata->vif.type == IEEE80211_IF_TYPE_STA ||
-            sdata->vif.type == IEEE80211_IF_TYPE_IBSS) {
+        if (sdata->vif.type == NL80211_IFTYPE_STATION ||
+            sdata->vif.type == NL80211_IFTYPE_ADHOC) {
                 conf.bssid = sdata->u.sta.bssid;
                 conf.ssid = sdata->u.sta.ssid;
                 conf.ssid_len = sdata->u.sta.ssid_len;
-        } else if (sdata->vif.type == IEEE80211_IF_TYPE_AP) {
+        } else if (sdata->vif.type == NL80211_IFTYPE_AP) {
                 conf.bssid = sdata->dev->dev_addr;
                 conf.ssid = sdata->u.ap.ssid;
                 conf.ssid_len = sdata->u.ap.ssid_len;
@@ -1027,7 +202,7 @@ int ieee80211_hw_config(struct ieee80211_local *local)
         struct ieee80211_channel *chan;
         int ret = 0;
 
-        if (local->sta_sw_scanning)
+        if (local->sw_scanning)
                 chan = local->scan_channel;
         else
                 chan = local->oper_channel;
@@ -1099,8 +274,8 @@ u32 ieee80211_handle_ht(struct ieee80211_local *local, int enable_ht,
         ht_conf.ht_supported = 1;
 
         ht_conf.cap = req_ht_cap->cap & sband->ht_info.cap;
-        ht_conf.cap &= ~(IEEE80211_HT_CAP_MIMO_PS);
-        ht_conf.cap |= sband->ht_info.cap & IEEE80211_HT_CAP_MIMO_PS;
+        ht_conf.cap &= ~(IEEE80211_HT_CAP_SM_PS);
+        ht_conf.cap |= sband->ht_info.cap & IEEE80211_HT_CAP_SM_PS;
         ht_bss_conf.primary_channel = req_bss_cap->primary_channel;
         ht_bss_conf.bss_cap = req_bss_cap->bss_cap;
         ht_bss_conf.bss_op_mode = req_bss_cap->bss_op_mode;
@@ -1152,6 +327,9 @@ void ieee80211_bss_info_change_notify(struct ieee80211_sub_if_data *sdata,
 {
         struct ieee80211_local *local = sdata->local;
 
+        if (WARN_ON(sdata->vif.type == NL80211_IFTYPE_AP_VLAN))
+                return;
+
         if (!changed)
                 return;
 
@@ -1162,10 +340,8 @@ void ieee80211_bss_info_change_notify(struct ieee80211_sub_if_data *sdata,
                                              changed);
 }
 
-u32 ieee80211_reset_erp_info(struct net_device *dev)
+u32 ieee80211_reset_erp_info(struct ieee80211_sub_if_data *sdata)
 {
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-
         sdata->bss_conf.use_cts_prot = 0;
         sdata->bss_conf.use_short_preamble = 0;
         return BSS_CHANGED_ERP_CTS_PROT | BSS_CHANGED_ERP_PREAMBLE;
@@ -1244,9 +420,10 @@ static void ieee80211_remove_tx_extra(struct ieee80211_local *local,
                                       struct ieee80211_key *key,
                                       struct sk_buff *skb)
 {
-        int hdrlen, iv_len, mic_len;
+        unsigned int hdrlen, iv_len, mic_len;
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
 
-        hdrlen = ieee80211_get_hdrlen_from_skb(skb);
+        hdrlen = ieee80211_hdrlen(hdr->frame_control);
 
         if (!key)
                 goto no_key;
@@ -1268,24 +445,20 @@ static void ieee80211_remove_tx_extra(struct ieee80211_local *local,
                 goto no_key;
         }
 
-        if (skb->len >= mic_len &&
+        if (skb->len >= hdrlen + mic_len &&
             !(key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE))
                 skb_trim(skb, skb->len - mic_len);
-        if (skb->len >= iv_len && skb->len > hdrlen) {
+        if (skb->len >= hdrlen + iv_len) {
                 memmove(skb->data + iv_len, skb->data, hdrlen);
-                skb_pull(skb, iv_len);
+                hdr = (struct ieee80211_hdr *)skb_pull(skb, iv_len);
         }
 
 no_key:
-        {
-                struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
-                u16 fc = le16_to_cpu(hdr->frame_control);
-                if ((fc & 0x8C) == 0x88) /* QoS Control Field */ {
-                        fc &= ~IEEE80211_STYPE_QOS_DATA;
-                        hdr->frame_control = cpu_to_le16(fc);
-                        memmove(skb->data + 2, skb->data, hdrlen - 2);
-                        skb_pull(skb, 2);
-                }
+        if (ieee80211_is_data_qos(hdr->frame_control)) {
+                hdr->frame_control &= ~cpu_to_le16(IEEE80211_STYPE_QOS_DATA);
+                memmove(skb->data + IEEE80211_QOS_CTL_LEN, skb->data,
+                        hdrlen - IEEE80211_QOS_CTL_LEN);
+                skb_pull(skb, IEEE80211_QOS_CTL_LEN);
         }
 }
 
@@ -1369,6 +542,7 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         u16 frag, type;
         __le16 fc;
+        struct ieee80211_supported_band *sband;
         struct ieee80211_tx_status_rtap_hdr *rthdr;
         struct ieee80211_sub_if_data *sdata;
         struct net_device *prev_dev = NULL;
@@ -1376,47 +550,48 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
 
         rcu_read_lock();
 
-        if (info->status.excessive_retries) {
-                sta = sta_info_get(local, hdr->addr1);
-                if (sta) {
-                        if (test_sta_flags(sta, WLAN_STA_PS)) {
-                                /*
-                                 * The STA is in power save mode, so assume
-                                 * that this TX packet failed because of that.
-                                 */
-                                ieee80211_handle_filtered_frame(local, sta, skb);
-                                rcu_read_unlock();
-                                return;
-                        }
+        sta = sta_info_get(local, hdr->addr1);
+
+        if (sta) {
+                if (info->status.excessive_retries &&
+                    test_sta_flags(sta, WLAN_STA_PS)) {
+                        /*
+                         * The STA is in power save mode, so assume
+                         * that this TX packet failed because of that.
+                         */
+                        ieee80211_handle_filtered_frame(local, sta, skb);
+                        rcu_read_unlock();
+                        return;
                 }
-        }
 
-        fc = hdr->frame_control;
+                fc = hdr->frame_control;
+
+                if ((info->flags & IEEE80211_TX_STAT_AMPDU_NO_BACK) &&
+                    (ieee80211_is_data_qos(fc))) {
+                        u16 tid, ssn;
+                        u8 *qc;
 
-        if ((info->flags & IEEE80211_TX_STAT_AMPDU_NO_BACK) &&
-            (ieee80211_is_data_qos(fc))) {
-                u16 tid, ssn;
-                u8 *qc;
-                sta = sta_info_get(local, hdr->addr1);
-                if (sta) {
                         qc = ieee80211_get_qos_ctl(hdr);
                         tid = qc[0] & 0xf;
                         ssn = ((le16_to_cpu(hdr->seq_ctrl) + 0x10)
                                                 & IEEE80211_SCTL_SEQ);
-                        ieee80211_send_bar(sta->sdata->dev, hdr->addr1,
+                        ieee80211_send_bar(sta->sdata, hdr->addr1,
                                            tid, ssn);
                 }
-        }
 
-        if (info->flags & IEEE80211_TX_STAT_TX_FILTERED) {
-                sta = sta_info_get(local, hdr->addr1);
-                if (sta) {
+                if (info->flags & IEEE80211_TX_STAT_TX_FILTERED) {
                         ieee80211_handle_filtered_frame(local, sta, skb);
                         rcu_read_unlock();
                         return;
+                } else {
+                        if (info->status.excessive_retries)
+                                sta->tx_retry_failed++;
+                        sta->tx_retry_count += info->status.retry_count;
                 }
-        } else
-                rate_control_tx_status(local->mdev, skb);
+
+                sband = local->hw.wiphy->bands[info->band];
+                rate_control_tx_status(local, sband, sta, skb);
+        }
 
         rcu_read_unlock();
 
@@ -1504,7 +679,7 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
 
         rcu_read_lock();
         list_for_each_entry_rcu(sdata, &local->interfaces, list) {
-                if (sdata->vif.type == IEEE80211_IF_TYPE_MNTR) {
+                if (sdata->vif.type == NL80211_IFTYPE_MONITOR) {
                         if (!netif_running(sdata->dev))
                                 continue;
 
@@ -1580,8 +755,6 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
 
         local->hw.queues = 1; /* default */
 
-        local->bridge_packets = 1;
-
         local->rts_threshold = IEEE80211_MAX_RTS_THRESHOLD;
         local->fragmentation_threshold = IEEE80211_MAX_FRAG_THRESHOLD;
         local->short_retry_limit = 7;
@@ -1592,7 +765,7 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
 
         spin_lock_init(&local->key_lock);
 
-        INIT_DELAYED_WORK(&local->scan_work, ieee80211_sta_scan_work);
+        INIT_DELAYED_WORK(&local->scan_work, ieee80211_scan_work);
 
         sta_info_init(local);
 
@@ -1619,7 +792,7 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
         int result;
         enum ieee80211_band band;
         struct net_device *mdev;
-        struct wireless_dev *mwdev;
+        struct ieee80211_master_priv *mpriv;
 
         /*
          * generic code guarantees at least one band,
@@ -1639,6 +812,13 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
                 }
         }
 
+        /* if low-level driver supports AP, we also support VLAN */
+        if (local->hw.wiphy->interface_modes & BIT(NL80211_IFTYPE_AP))
+                local->hw.wiphy->interface_modes |= BIT(NL80211_IFTYPE_AP_VLAN);
+
+        /* mac80211 always supports monitor */
+        local->hw.wiphy->interface_modes |= BIT(NL80211_IFTYPE_MONITOR);
+
         result = wiphy_register(local->hw.wiphy);
         if (result < 0)
                 return result;
@@ -1654,16 +834,14 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
         if (hw->queues < 4)
                 hw->ampdu_queues = 0;
 
-        mdev = alloc_netdev_mq(sizeof(struct wireless_dev),
+        mdev = alloc_netdev_mq(sizeof(struct ieee80211_master_priv),
                                "wmaster%d", ether_setup,
                                ieee80211_num_queues(hw));
         if (!mdev)
                 goto fail_mdev_alloc;
 
-        mwdev = netdev_priv(mdev);
-        mdev->ieee80211_ptr = mwdev;
-        mwdev->wiphy = local->hw.wiphy;
-
+        mpriv = netdev_priv(mdev);
+        mpriv->local = local;
         local->mdev = mdev;
 
         ieee80211_rx_bss_list_init(local);
@@ -1745,7 +923,7 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
 
         /* add one default STA interface */
         result = ieee80211_if_add(local, "wlan%d", NULL,
-                                  IEEE80211_IF_TYPE_STA, NULL);
+                                  NL80211_IFTYPE_STATION, NULL);
         if (result)
                 printk(KERN_WARNING "%s: Failed to add default virtual iface\n",
                        wiphy_name(local->hw.wiphy));
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index 35f2f95f2fa7..8013277924f2 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -12,6 +12,9 @@
 #include "ieee80211_i.h"
 #include "mesh.h"
 
+#define IEEE80211_MESH_PEER_INACTIVITY_LIMIT (1800 * HZ)
+#define IEEE80211_MESH_HOUSEKEEPING_INTERVAL (60 * HZ)
+
 #define PP_OFFSET       1               /* Path Selection Protocol */
 #define PM_OFFSET       5               /* Path Selection Metric   */
 #define CC_OFFSET       9               /* Congestion Control Mode */
@@ -35,19 +38,28 @@ void ieee80211s_stop(void)
         kmem_cache_destroy(rm_cache);
 }
 
+static void ieee80211_mesh_housekeeping_timer(unsigned long data)
+{
+        struct ieee80211_sub_if_data *sdata = (void *) data;
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
+
+        ifmsh->housekeeping = true;
+        queue_work(local->hw.workqueue, &ifmsh->work);
+}
+
 /**
  * mesh_matches_local - check if the config of a mesh point matches ours
  *
  * @ie: information elements of a management frame from the mesh peer
- * @dev: local mesh interface
+ * @sdata: local mesh subif
  *
  * This function checks if the mesh configuration of a mesh point matches the
  * local mesh configuration, i.e. if both nodes belong to the same mesh network.
  */
-bool mesh_matches_local(struct ieee802_11_elems *ie, struct net_device *dev)
+bool mesh_matches_local(struct ieee802_11_elems *ie, struct ieee80211_sub_if_data *sdata)
 {
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        struct ieee80211_if_sta *sta = &sdata->u.sta;
+        struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
 
         /*
          * As support for each feature is added, check for matching
@@ -59,11 +71,11 @@ bool mesh_matches_local(struct ieee802_11_elems *ie, struct net_device *dev)
          *   - MDA enabled
          * - Power management control on fc
          */
-        if (sta->mesh_id_len == ie->mesh_id_len &&
-                memcmp(sta->mesh_id, ie->mesh_id, ie->mesh_id_len) == 0 &&
-                memcmp(sta->mesh_pp_id, ie->mesh_config + PP_OFFSET, 4) == 0 &&
-                memcmp(sta->mesh_pm_id, ie->mesh_config + PM_OFFSET, 4) == 0 &&
-                memcmp(sta->mesh_cc_id, ie->mesh_config + CC_OFFSET, 4) == 0)
+        if (ifmsh->mesh_id_len == ie->mesh_id_len &&
+                memcmp(ifmsh->mesh_id, ie->mesh_id, ie->mesh_id_len) == 0 &&
+                memcmp(ifmsh->mesh_pp_id, ie->mesh_config + PP_OFFSET, 4) == 0 &&
+                memcmp(ifmsh->mesh_pm_id, ie->mesh_config + PM_OFFSET, 4) == 0 &&
+                memcmp(ifmsh->mesh_cc_id, ie->mesh_config + CC_OFFSET, 4) == 0)
                 return true;
 
         return false;
@@ -73,10 +85,8 @@ bool mesh_matches_local(struct ieee802_11_elems *ie, struct net_device *dev)
  * mesh_peer_accepts_plinks - check if an mp is willing to establish peer links
  *
  * @ie: information elements of a management frame from the mesh peer
- * @dev: local mesh interface
  */
-bool mesh_peer_accepts_plinks(struct ieee802_11_elems *ie,
-                              struct net_device *dev)
+bool mesh_peer_accepts_plinks(struct ieee802_11_elems *ie)
 {
         return (*(ie->mesh_config + CAPAB_OFFSET) & ACCEPT_PLINKS) != 0;
 }
@@ -98,11 +108,11 @@ void mesh_accept_plinks_update(struct ieee80211_sub_if_data *sdata)
          */
         free_plinks = mesh_plink_availables(sdata);
 
-        if (free_plinks != sdata->u.sta.accepting_plinks)
-                ieee80211_sta_timer((unsigned long) sdata);
+        if (free_plinks != sdata->u.mesh.accepting_plinks)
+                ieee80211_mesh_housekeeping_timer((unsigned long) sdata);
 }
 
-void mesh_ids_set_default(struct ieee80211_if_sta *sta)
+void mesh_ids_set_default(struct ieee80211_if_mesh *sta)
 {
         u8 def_id[4] = {0x00, 0x0F, 0xAC, 0xff};
 
@@ -111,28 +121,26 @@ void mesh_ids_set_default(struct ieee80211_if_sta *sta)
         memcpy(sta->mesh_cc_id, def_id, 4);
 }
 
-int mesh_rmc_init(struct net_device *dev)
+int mesh_rmc_init(struct ieee80211_sub_if_data *sdata)
 {
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         int i;
 
-        sdata->u.sta.rmc = kmalloc(sizeof(struct mesh_rmc), GFP_KERNEL);
-        if (!sdata->u.sta.rmc)
+        sdata->u.mesh.rmc = kmalloc(sizeof(struct mesh_rmc), GFP_KERNEL);
+        if (!sdata->u.mesh.rmc)
                 return -ENOMEM;
-        sdata->u.sta.rmc->idx_mask = RMC_BUCKETS - 1;
+        sdata->u.mesh.rmc->idx_mask = RMC_BUCKETS - 1;
         for (i = 0; i < RMC_BUCKETS; i++)
-                INIT_LIST_HEAD(&sdata->u.sta.rmc->bucket[i].list);
+                INIT_LIST_HEAD(&sdata->u.mesh.rmc->bucket[i].list);
         return 0;
 }
 
-void mesh_rmc_free(struct net_device *dev)
+void mesh_rmc_free(struct ieee80211_sub_if_data *sdata)
 {
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        struct mesh_rmc *rmc = sdata->u.sta.rmc;
+        struct mesh_rmc *rmc = sdata->u.mesh.rmc;
         struct rmc_entry *p, *n;
         int i;
 
-        if (!sdata->u.sta.rmc)
+        if (!sdata->u.mesh.rmc)
                 return;
 
         for (i = 0; i < RMC_BUCKETS; i++)
@@ -142,7 +150,7 @@ void mesh_rmc_free(struct net_device *dev)
                 }
 
         kfree(rmc);
-        sdata->u.sta.rmc = NULL;
+        sdata->u.mesh.rmc = NULL;
 }
 
 /**
@@ -158,10 +166,9 @@ void mesh_rmc_free(struct net_device *dev)
  * it.
  */
 int mesh_rmc_check(u8 *sa, struct ieee80211s_hdr *mesh_hdr,
-                   struct net_device *dev)
+                   struct ieee80211_sub_if_data *sdata)
 {
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        struct mesh_rmc *rmc = sdata->u.sta.rmc;
+        struct mesh_rmc *rmc = sdata->u.mesh.rmc;
         u32 seqnum = 0;
         int entries = 0;
         u8 idx;
@@ -194,10 +201,9 @@ int mesh_rmc_check(u8 *sa, struct ieee80211s_hdr *mesh_hdr,
         return 0;
 }
 
-void mesh_mgmt_ies_add(struct sk_buff *skb, struct net_device *dev)
+void mesh_mgmt_ies_add(struct sk_buff *skb, struct ieee80211_sub_if_data *sdata)
 {
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_local *local = sdata->local;
         struct ieee80211_supported_band *sband;
         u8 *pos;
         int len, i, rate;
@@ -224,11 +230,11 @@ void mesh_mgmt_ies_add(struct sk_buff *skb, struct net_device *dev)
                 }
         }
 
-        pos = skb_put(skb, 2 + sdata->u.sta.mesh_id_len);
+        pos = skb_put(skb, 2 + sdata->u.mesh.mesh_id_len);
         *pos++ = WLAN_EID_MESH_ID;
-        *pos++ = sdata->u.sta.mesh_id_len;
-        if (sdata->u.sta.mesh_id_len)
-                memcpy(pos, sdata->u.sta.mesh_id, sdata->u.sta.mesh_id_len);
+        *pos++ = sdata->u.mesh.mesh_id_len;
+        if (sdata->u.mesh.mesh_id_len)
+                memcpy(pos, sdata->u.mesh.mesh_id, sdata->u.mesh.mesh_id_len);
 
         pos = skb_put(skb, 21);
         *pos++ = WLAN_EID_MESH_CONFIG;
@@ -237,15 +243,15 @@ void mesh_mgmt_ies_add(struct sk_buff *skb, struct net_device *dev)
         *pos++ = 1;
 
         /* Active path selection protocol ID */
-        memcpy(pos, sdata->u.sta.mesh_pp_id, 4);
+        memcpy(pos, sdata->u.mesh.mesh_pp_id, 4);
         pos += 4;
 
         /* Active path selection metric ID   */
-        memcpy(pos, sdata->u.sta.mesh_pm_id, 4);
+        memcpy(pos, sdata->u.mesh.mesh_pm_id, 4);
         pos += 4;
 
         /* Congestion control mode identifier */
-        memcpy(pos, sdata->u.sta.mesh_cc_id, 4);
+        memcpy(pos, sdata->u.mesh.mesh_cc_id, 4);
         pos += 4;
 
         /* Channel precedence:
@@ -255,17 +261,17 @@ void mesh_mgmt_ies_add(struct sk_buff *skb, struct net_device *dev)
         pos += 4;
 
         /* Mesh capability */
-        sdata->u.sta.accepting_plinks = mesh_plink_availables(sdata);
-        *pos++ = sdata->u.sta.accepting_plinks ? ACCEPT_PLINKS : 0x00;
+        sdata->u.mesh.accepting_plinks = mesh_plink_availables(sdata);
+        *pos++ = sdata->u.mesh.accepting_plinks ? ACCEPT_PLINKS : 0x00;
         *pos++ = 0x00;
 
         return;
 }
 
-u32 mesh_table_hash(u8 *addr, struct net_device *dev, struct mesh_table *tbl)
+u32 mesh_table_hash(u8 *addr, struct ieee80211_sub_if_data *sdata, struct mesh_table *tbl)
 {
         /* Use last four bytes of hw addr and interface index as hash index */
-        return jhash_2words(*(u32 *)(addr+2), dev->ifindex, tbl->hash_rnd)
+        return jhash_2words(*(u32 *)(addr+2), sdata->dev->ifindex, tbl->hash_rnd)
                 & tbl->hash_mask;
 }
 
@@ -344,10 +350,10 @@ static void ieee80211_mesh_path_timer(unsigned long data)
 {
         struct ieee80211_sub_if_data *sdata =
                 (struct ieee80211_sub_if_data *) data;
-        struct ieee80211_if_sta *ifsta = &sdata->u.sta;
-        struct ieee80211_local *local = wdev_priv(&sdata->wdev);
+        struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
+        struct ieee80211_local *local = sdata->local;
 
-        queue_work(local->hw.workqueue, &ifsta->work);
+        queue_work(local->hw.workqueue, &ifmsh->work);
 }
 
 struct mesh_table *mesh_table_grow(struct mesh_table *tbl)
@@ -399,50 +405,264 @@ int ieee80211_new_mesh_header(struct ieee80211s_hdr *meshhdr,
                 struct ieee80211_sub_if_data *sdata)
 {
         meshhdr->flags = 0;
-        meshhdr->ttl = sdata->u.sta.mshcfg.dot11MeshTTL;
-        put_unaligned(cpu_to_le32(sdata->u.sta.mesh_seqnum), &meshhdr->seqnum);
-        sdata->u.sta.mesh_seqnum++;
+        meshhdr->ttl = sdata->u.mesh.mshcfg.dot11MeshTTL;
+        put_unaligned(cpu_to_le32(sdata->u.mesh.mesh_seqnum), &meshhdr->seqnum);
+        sdata->u.mesh.mesh_seqnum++;
 
         return 6;
 }
 
+static void ieee80211_mesh_housekeeping(struct ieee80211_sub_if_data *sdata,
+                           struct ieee80211_if_mesh *ifmsh)
+{
+        bool free_plinks;
+
+#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
+        printk(KERN_DEBUG "%s: running mesh housekeeping\n",
+               sdata->dev->name);
+#endif
+
+        ieee80211_sta_expire(sdata, IEEE80211_MESH_PEER_INACTIVITY_LIMIT);
+        mesh_path_expire(sdata);
+
+        free_plinks = mesh_plink_availables(sdata);
+        if (free_plinks != sdata->u.mesh.accepting_plinks)
+                ieee80211_if_config(sdata, IEEE80211_IFCC_BEACON);
+
+        ifmsh->housekeeping = false;
+        mod_timer(&ifmsh->housekeeping_timer,
+                  round_jiffies(jiffies + IEEE80211_MESH_HOUSEKEEPING_INTERVAL));
+}
+
+
+void ieee80211_start_mesh(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
+        struct ieee80211_local *local = sdata->local;
+
+        ifmsh->housekeeping = true;
+        queue_work(local->hw.workqueue, &ifmsh->work);
+        ieee80211_if_config(sdata, IEEE80211_IFCC_BEACON);
+}
+
+void ieee80211_stop_mesh(struct ieee80211_sub_if_data *sdata)
+{
+        del_timer_sync(&sdata->u.mesh.housekeeping_timer);
+        /*
+         * If the timer fired while we waited for it, it will have
+         * requeued the work. Now the work will be running again
+         * but will not rearm the timer again because it checks
+         * whether the interface is running, which, at this point,
+         * it no longer is.
+         */
+        cancel_work_sync(&sdata->u.mesh.work);
+
+        /*
+         * When we get here, the interface is marked down.
+         * Call synchronize_rcu() to wait for the RX path
+         * should it be using the interface and enqueuing
+         * frames at this very time on another CPU.
+         */
+        synchronize_rcu();
+        skb_queue_purge(&sdata->u.mesh.skb_queue);
+}
+
+static void ieee80211_mesh_rx_bcn_presp(struct ieee80211_sub_if_data *sdata,
+                                        u16 stype,
+                                        struct ieee80211_mgmt *mgmt,
+                                        size_t len,
+                                        struct ieee80211_rx_status *rx_status)
+{
+        struct ieee80211_local *local= sdata->local;
+        struct ieee802_11_elems elems;
+        struct ieee80211_channel *channel;
+        u64 supp_rates = 0;
+        size_t baselen;
+        int freq;
+        enum ieee80211_band band = rx_status->band;
+
+        /* ignore ProbeResp to foreign address */
+        if (stype == IEEE80211_STYPE_PROBE_RESP &&
+            compare_ether_addr(mgmt->da, sdata->dev->dev_addr))
+                return;
+
+        baselen = (u8 *) mgmt->u.probe_resp.variable - (u8 *) mgmt;
+        if (baselen > len)
+                return;
+
+        ieee802_11_parse_elems(mgmt->u.probe_resp.variable, len - baselen,
+                               &elems);
+
+        if (elems.ds_params && elems.ds_params_len == 1)
+                freq = ieee80211_channel_to_frequency(elems.ds_params[0]);
+        else
+                freq = rx_status->freq;
+
+        channel = ieee80211_get_channel(local->hw.wiphy, freq);
+
+        if (!channel || channel->flags & IEEE80211_CHAN_DISABLED)
+                return;
+
+        if (elems.mesh_id && elems.mesh_config &&
+            mesh_matches_local(&elems, sdata)) {
+                supp_rates = ieee80211_sta_get_rates(local, &elems, band);
+
+                mesh_neighbour_update(mgmt->sa, supp_rates, sdata,
+                                      mesh_peer_accepts_plinks(&elems));
+        }
+}
+
+static void ieee80211_mesh_rx_mgmt_action(struct ieee80211_sub_if_data *sdata,
+                                          struct ieee80211_mgmt *mgmt,
+                                          size_t len,
+                                          struct ieee80211_rx_status *rx_status)
+{
+        switch (mgmt->u.action.category) {
+        case PLINK_CATEGORY:
+                mesh_rx_plink_frame(sdata, mgmt, len, rx_status);
+                break;
+        case MESH_PATH_SEL_CATEGORY:
+                mesh_rx_path_sel_frame(sdata, mgmt, len);
+                break;
+        }
+}
+
+static void ieee80211_mesh_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
+                                          struct sk_buff *skb)
+{
+        struct ieee80211_rx_status *rx_status;
+        struct ieee80211_if_mesh *ifmsh;
+        struct ieee80211_mgmt *mgmt;
+        u16 stype;
+
+        ifmsh = &sdata->u.mesh;
+
+        rx_status = (struct ieee80211_rx_status *) skb->cb;
+        mgmt = (struct ieee80211_mgmt *) skb->data;
+        stype = le16_to_cpu(mgmt->frame_control) & IEEE80211_FCTL_STYPE;
+
+        switch (stype) {
+        case IEEE80211_STYPE_PROBE_RESP:
+        case IEEE80211_STYPE_BEACON:
+                ieee80211_mesh_rx_bcn_presp(sdata, stype, mgmt, skb->len,
+                                            rx_status);
+                break;
+        case IEEE80211_STYPE_ACTION:
+                ieee80211_mesh_rx_mgmt_action(sdata, mgmt, skb->len, rx_status);
+                break;
+        }
+
+        kfree_skb(skb);
+}
+
+static void ieee80211_mesh_work(struct work_struct *work)
+{
+        struct ieee80211_sub_if_data *sdata =
+                container_of(work, struct ieee80211_sub_if_data, u.mesh.work);
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
+        struct sk_buff *skb;
+
+        if (!netif_running(sdata->dev))
+                return;
+
+        if (local->sw_scanning || local->hw_scanning)
+                return;
+
+        while ((skb = skb_dequeue(&ifmsh->skb_queue)))
+                ieee80211_mesh_rx_queued_mgmt(sdata, skb);
+
+        if (ifmsh->preq_queue_len &&
+            time_after(jiffies,
+                       ifmsh->last_preq + msecs_to_jiffies(ifmsh->mshcfg.dot11MeshHWMPpreqMinInterval)))
+                mesh_path_start_discovery(sdata);
+
+        if (ifmsh->housekeeping)
+                ieee80211_mesh_housekeeping(sdata, ifmsh);
+}
+
+void ieee80211_mesh_notify_scan_completed(struct ieee80211_local *local)
+{
+        struct ieee80211_sub_if_data *sdata;
+
+        rcu_read_lock();
+        list_for_each_entry_rcu(sdata, &local->interfaces, list)
+                if (ieee80211_vif_is_mesh(&sdata->vif))
+                        queue_work(local->hw.workqueue, &sdata->u.mesh.work);
+        rcu_read_unlock();
+}
+
 void ieee80211_mesh_init_sdata(struct ieee80211_sub_if_data *sdata)
 {
-        struct ieee80211_if_sta *ifsta = &sdata->u.sta;
-
-        ifsta->mshcfg.dot11MeshRetryTimeout = MESH_RET_T;
-        ifsta->mshcfg.dot11MeshConfirmTimeout = MESH_CONF_T;
-        ifsta->mshcfg.dot11MeshHoldingTimeout = MESH_HOLD_T;
-        ifsta->mshcfg.dot11MeshMaxRetries = MESH_MAX_RETR;
-        ifsta->mshcfg.dot11MeshTTL = MESH_TTL;
-        ifsta->mshcfg.auto_open_plinks = true;
-        ifsta->mshcfg.dot11MeshMaxPeerLinks =
+        struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
+
+        INIT_WORK(&ifmsh->work, ieee80211_mesh_work);
+        setup_timer(&ifmsh->housekeeping_timer,
+                    ieee80211_mesh_housekeeping_timer,
+                    (unsigned long) sdata);
+        skb_queue_head_init(&sdata->u.mesh.skb_queue);
+
+        ifmsh->mshcfg.dot11MeshRetryTimeout = MESH_RET_T;
+        ifmsh->mshcfg.dot11MeshConfirmTimeout = MESH_CONF_T;
+        ifmsh->mshcfg.dot11MeshHoldingTimeout = MESH_HOLD_T;
+        ifmsh->mshcfg.dot11MeshMaxRetries = MESH_MAX_RETR;
+        ifmsh->mshcfg.dot11MeshTTL = MESH_TTL;
+        ifmsh->mshcfg.auto_open_plinks = true;
+        ifmsh->mshcfg.dot11MeshMaxPeerLinks =
                 MESH_MAX_ESTAB_PLINKS;
-        ifsta->mshcfg.dot11MeshHWMPactivePathTimeout =
+        ifmsh->mshcfg.dot11MeshHWMPactivePathTimeout =
                 MESH_PATH_TIMEOUT;
-        ifsta->mshcfg.dot11MeshHWMPpreqMinInterval =
+        ifmsh->mshcfg.dot11MeshHWMPpreqMinInterval =
                 MESH_PREQ_MIN_INT;
-        ifsta->mshcfg.dot11MeshHWMPnetDiameterTraversalTime =
+        ifmsh->mshcfg.dot11MeshHWMPnetDiameterTraversalTime =
                 MESH_DIAM_TRAVERSAL_TIME;
-        ifsta->mshcfg.dot11MeshHWMPmaxPREQretries =
+        ifmsh->mshcfg.dot11MeshHWMPmaxPREQretries =
                 MESH_MAX_PREQ_RETRIES;
-        ifsta->mshcfg.path_refresh_time =
+        ifmsh->mshcfg.path_refresh_time =
                 MESH_PATH_REFRESH_TIME;
-        ifsta->mshcfg.min_discovery_timeout =
+        ifmsh->mshcfg.min_discovery_timeout =
                 MESH_MIN_DISCOVERY_TIMEOUT;
-        ifsta->accepting_plinks = true;
-        ifsta->preq_id = 0;
-        ifsta->dsn = 0;
-        atomic_set(&ifsta->mpaths, 0);
-        mesh_rmc_init(sdata->dev);
-        ifsta->last_preq = jiffies;
+        ifmsh->accepting_plinks = true;
+        ifmsh->preq_id = 0;
+        ifmsh->dsn = 0;
+        atomic_set(&ifmsh->mpaths, 0);
+        mesh_rmc_init(sdata);
+        ifmsh->last_preq = jiffies;
         /* Allocate all mesh structures when creating the first mesh interface. */
         if (!mesh_allocated)
                 ieee80211s_init();
-        mesh_ids_set_default(ifsta);
-        setup_timer(&ifsta->mesh_path_timer,
+        mesh_ids_set_default(ifmsh);
+        setup_timer(&ifmsh->mesh_path_timer,
                     ieee80211_mesh_path_timer,
                     (unsigned long) sdata);
-        INIT_LIST_HEAD(&ifsta->preq_queue.list);
-        spin_lock_init(&ifsta->mesh_preq_queue_lock);
+        INIT_LIST_HEAD(&ifmsh->preq_queue.list);
+        spin_lock_init(&ifmsh->mesh_preq_queue_lock);
+}
+
+ieee80211_rx_result
+ieee80211_mesh_rx_mgmt(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb,
+                       struct ieee80211_rx_status *rx_status)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
+        struct ieee80211_mgmt *mgmt;
+        u16 fc;
+
+        if (skb->len < 24)
+                return RX_DROP_MONITOR;
+
+        mgmt = (struct ieee80211_mgmt *) skb->data;
+        fc = le16_to_cpu(mgmt->frame_control);
+
+        switch (fc & IEEE80211_FCTL_STYPE) {
+        case IEEE80211_STYPE_PROBE_RESP:
+        case IEEE80211_STYPE_BEACON:
+        case IEEE80211_STYPE_ACTION:
+                memcpy(skb->cb, rx_status, sizeof(*rx_status));
+                skb_queue_tail(&ifmsh->skb_queue, skb);
+                queue_work(local->hw.workqueue, &ifmsh->work);
+                return RX_QUEUED;
+        }
+
+        return RX_CONTINUE;
 }
diff --git a/net/mac80211/mesh.h b/net/mac80211/mesh.h
index 7495fbb0d211..e10471c6ba42 100644
--- a/net/mac80211/mesh.h
+++ b/net/mac80211/mesh.h
@@ -47,7 +47,7 @@ enum mesh_path_flags {
  * struct mesh_path - mac80211 mesh path structure
  *
  * @dst: mesh path destination mac address
- * @dev: mesh path device
+ * @sdata: mesh subif
  * @next_hop: mesh neighbor to which frames for this destination will be
  *      forwarded
  * @timer: mesh path discovery timer
@@ -64,14 +64,15 @@ enum mesh_path_flags {
  * @state_lock: mesh pat state lock
  *
  *
- * The combination of dst and dev is unique in the mesh path table. Since the
+ * The combination of dst and sdata is unique in the mesh path table. Since the
  * next_hop STA is only protected by RCU as well, deleting the STA must also
  * remove/substitute the mesh_path structure and wait until that is no longer
  * reachable before destroying the STA completely.
  */
 struct mesh_path {
         u8 dst[ETH_ALEN];
-        struct net_device *dev;
+        u8 mpp[ETH_ALEN];       /* used for MPP or MAP */
+        struct ieee80211_sub_if_data *sdata;
         struct sta_info *next_hop;
         struct timer_list timer;
         struct sk_buff_head frame_queue;
@@ -203,67 +204,82 @@ int ieee80211_get_mesh_hdrlen(struct ieee80211s_hdr *meshhdr);
 int ieee80211_new_mesh_header(struct ieee80211s_hdr *meshhdr,
                 struct ieee80211_sub_if_data *sdata);
 int mesh_rmc_check(u8 *addr, struct ieee80211s_hdr *mesh_hdr,
-                struct net_device *dev);
-bool mesh_matches_local(struct ieee802_11_elems *ie, struct net_device *dev);
-void mesh_ids_set_default(struct ieee80211_if_sta *sta);
-void mesh_mgmt_ies_add(struct sk_buff *skb, struct net_device *dev);
-void mesh_rmc_free(struct net_device *dev);
-int mesh_rmc_init(struct net_device *dev);
+                struct ieee80211_sub_if_data *sdata);
+bool mesh_matches_local(struct ieee802_11_elems *ie,
+                struct ieee80211_sub_if_data *sdata);
+void mesh_ids_set_default(struct ieee80211_if_mesh *mesh);
+void mesh_mgmt_ies_add(struct sk_buff *skb,
+                struct ieee80211_sub_if_data *sdata);
+void mesh_rmc_free(struct ieee80211_sub_if_data *sdata);
+int mesh_rmc_init(struct ieee80211_sub_if_data *sdata);
 void ieee80211s_init(void);
 void ieee80211s_stop(void);
 void ieee80211_mesh_init_sdata(struct ieee80211_sub_if_data *sdata);
+ieee80211_rx_result
+ieee80211_mesh_rx_mgmt(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb,
+                       struct ieee80211_rx_status *rx_status);
+void ieee80211_start_mesh(struct ieee80211_sub_if_data *sdata);
+void ieee80211_stop_mesh(struct ieee80211_sub_if_data *sdata);
 
 /* Mesh paths */
-int mesh_nexthop_lookup(struct sk_buff *skb, struct net_device *dev);
-void mesh_path_start_discovery(struct net_device *dev);
-struct mesh_path *mesh_path_lookup(u8 *dst, struct net_device *dev);
-struct mesh_path *mesh_path_lookup_by_idx(int idx, struct net_device *dev);
+int mesh_nexthop_lookup(struct sk_buff *skb,
+                struct ieee80211_sub_if_data *sdata);
+void mesh_path_start_discovery(struct ieee80211_sub_if_data *sdata);
+struct mesh_path *mesh_path_lookup(u8 *dst,
+                struct ieee80211_sub_if_data *sdata);
+struct mesh_path *mpp_path_lookup(u8 *dst,
+                                  struct ieee80211_sub_if_data *sdata);
+int mpp_path_add(u8 *dst, u8 *mpp, struct ieee80211_sub_if_data *sdata);
+struct mesh_path *mesh_path_lookup_by_idx(int idx,
+                struct ieee80211_sub_if_data *sdata);
 void mesh_path_fix_nexthop(struct mesh_path *mpath, struct sta_info *next_hop);
-void mesh_path_expire(struct net_device *dev);
-void mesh_path_flush(struct net_device *dev);
-void mesh_rx_path_sel_frame(struct net_device *dev, struct ieee80211_mgmt *mgmt,
-                size_t len);
-int mesh_path_add(u8 *dst, struct net_device *dev);
+void mesh_path_expire(struct ieee80211_sub_if_data *sdata);
+void mesh_path_flush(struct ieee80211_sub_if_data *sdata);
+void mesh_rx_path_sel_frame(struct ieee80211_sub_if_data *sdata,
+                struct ieee80211_mgmt *mgmt, size_t len);
+int mesh_path_add(u8 *dst, struct ieee80211_sub_if_data *sdata);
 /* Mesh plinks */
-void mesh_neighbour_update(u8 *hw_addr, u64 rates, struct net_device *dev,
-                bool add);
-bool mesh_peer_accepts_plinks(struct ieee802_11_elems *ie,
-                              struct net_device *dev);
+void mesh_neighbour_update(u8 *hw_addr, u64 rates,
+                struct ieee80211_sub_if_data *sdata, bool add);
+bool mesh_peer_accepts_plinks(struct ieee802_11_elems *ie);
 void mesh_accept_plinks_update(struct ieee80211_sub_if_data *sdata);
 void mesh_plink_broken(struct sta_info *sta);
 void mesh_plink_deactivate(struct sta_info *sta);
 int mesh_plink_open(struct sta_info *sta);
 int mesh_plink_close(struct sta_info *sta);
 void mesh_plink_block(struct sta_info *sta);
-void mesh_rx_plink_frame(struct net_device *dev, struct ieee80211_mgmt *mgmt,
-                         size_t len, struct ieee80211_rx_status *rx_status);
+void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata,
+                         struct ieee80211_mgmt *mgmt, size_t len,
+                         struct ieee80211_rx_status *rx_status);
 
 /* Private interfaces */
 /* Mesh tables */
 struct mesh_table *mesh_table_alloc(int size_order);
 void mesh_table_free(struct mesh_table *tbl, bool free_leafs);
 struct mesh_table *mesh_table_grow(struct mesh_table *tbl);
-u32 mesh_table_hash(u8 *addr, struct net_device *dev, struct mesh_table *tbl);
+u32 mesh_table_hash(u8 *addr, struct ieee80211_sub_if_data *sdata,
+                struct mesh_table *tbl);
 /* Mesh paths */
 int mesh_path_error_tx(u8 *dest, __le32 dest_dsn, u8 *ra,
-                struct net_device *dev);
+                struct ieee80211_sub_if_data *sdata);
 void mesh_path_assign_nexthop(struct mesh_path *mpath, struct sta_info *sta);
 void mesh_path_flush_pending(struct mesh_path *mpath);
 void mesh_path_tx_pending(struct mesh_path *mpath);
 int mesh_pathtbl_init(void);
 void mesh_pathtbl_unregister(void);
-int mesh_path_del(u8 *addr, struct net_device *dev);
+int mesh_path_del(u8 *addr, struct ieee80211_sub_if_data *sdata);
 void mesh_path_timer(unsigned long data);
 void mesh_path_flush_by_nexthop(struct sta_info *sta);
-void mesh_path_discard_frame(struct sk_buff *skb, struct net_device *dev);
+void mesh_path_discard_frame(struct sk_buff *skb,
+                struct ieee80211_sub_if_data *sdata);
 
 #ifdef CONFIG_MAC80211_MESH
 extern int mesh_allocated;
 
 static inline int mesh_plink_free_count(struct ieee80211_sub_if_data *sdata)
 {
-        return sdata->u.sta.mshcfg.dot11MeshMaxPeerLinks -
-               atomic_read(&sdata->u.sta.mshstats.estab_plinks);
+        return sdata->u.mesh.mshcfg.dot11MeshMaxPeerLinks -
+               atomic_read(&sdata->u.mesh.mshstats.estab_plinks);
 }
 
 static inline bool mesh_plink_availables(struct ieee80211_sub_if_data *sdata)
@@ -281,8 +297,12 @@ static inline void mesh_path_activate(struct mesh_path *mpath)
         for (i = 0; i <= x->hash_mask; i++) \
                 hlist_for_each_entry_rcu(node, p, &x->hash_buckets[i], list)
 
+void ieee80211_mesh_notify_scan_completed(struct ieee80211_local *local);
+
 #else
 #define mesh_allocated  0
+static inline void
+ieee80211_mesh_notify_scan_completed(struct ieee80211_local *local) {}
 #endif
 
 #endif /* IEEE80211S_H */
diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
index 08aca446ca01..501c7831adb4 100644
--- a/net/mac80211/mesh_hwmp.c
+++ b/net/mac80211/mesh_hwmp.c
@@ -64,14 +64,14 @@ static inline u32 u32_field_get(u8 *preq_elem, int offset, bool ae)
 #define DSN_LT(x, y) ((long) (x) - (long) (y) < 0)
 
 #define net_traversal_jiffies(s) \
-        msecs_to_jiffies(s->u.sta.mshcfg.dot11MeshHWMPnetDiameterTraversalTime)
+        msecs_to_jiffies(s->u.mesh.mshcfg.dot11MeshHWMPnetDiameterTraversalTime)
 #define default_lifetime(s) \
-        MSEC_TO_TU(s->u.sta.mshcfg.dot11MeshHWMPactivePathTimeout)
+        MSEC_TO_TU(s->u.mesh.mshcfg.dot11MeshHWMPactivePathTimeout)
 #define min_preq_int_jiff(s) \
-        (msecs_to_jiffies(s->u.sta.mshcfg.dot11MeshHWMPpreqMinInterval))
-#define max_preq_retries(s) (s->u.sta.mshcfg.dot11MeshHWMPmaxPREQretries)
+        (msecs_to_jiffies(s->u.mesh.mshcfg.dot11MeshHWMPpreqMinInterval))
+#define max_preq_retries(s) (s->u.mesh.mshcfg.dot11MeshHWMPmaxPREQretries)
 #define disc_timeout_jiff(s) \
-        msecs_to_jiffies(sdata->u.sta.mshcfg.min_discovery_timeout)
+        msecs_to_jiffies(sdata->u.mesh.mshcfg.min_discovery_timeout)
 
 enum mpath_frame_type {
         MPATH_PREQ = 0,
@@ -82,9 +82,9 @@ enum mpath_frame_type {
 static int mesh_path_sel_frame_tx(enum mpath_frame_type action, u8 flags,
                 u8 *orig_addr, __le32 orig_dsn, u8 dst_flags, u8 *dst,
                 __le32 dst_dsn, u8 *da, u8 hop_count, u8 ttl, __le32 lifetime,
-                __le32 metric, __le32 preq_id, struct net_device *dev)
+                __le32 metric, __le32 preq_id, struct ieee80211_sub_if_data *sdata)
 {
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+        struct ieee80211_local *local = sdata->local;
         struct sk_buff *skb = dev_alloc_skb(local->hw.extra_tx_headroom + 400);
         struct ieee80211_mgmt *mgmt;
         u8 *pos;
@@ -99,11 +99,11 @@ static int mesh_path_sel_frame_tx(enum mpath_frame_type action, u8 flags,
         mgmt = (struct ieee80211_mgmt *)
                 skb_put(skb, 25 + sizeof(mgmt->u.action.u.mesh_action));
         memset(mgmt, 0, 25 + sizeof(mgmt->u.action.u.mesh_action));
-        mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
-                                           IEEE80211_STYPE_ACTION);
+        mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
+                                          IEEE80211_STYPE_ACTION);
 
         memcpy(mgmt->da, da, ETH_ALEN);
-        memcpy(mgmt->sa, dev->dev_addr, ETH_ALEN);
+        memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
         /* BSSID is left zeroed, wildcard value */
         mgmt->u.action.category = MESH_PATH_SEL_CATEGORY;
         mgmt->u.action.u.mesh_action.action_code = action;
@@ -149,7 +149,7 @@ static int mesh_path_sel_frame_tx(enum mpath_frame_type action, u8 flags,
         pos += ETH_ALEN;
         memcpy(pos, &dst_dsn, 4);
 
-        ieee80211_sta_tx(dev, skb, 0);
+        ieee80211_tx_skb(sdata, skb, 0);
         return 0;
 }
 
@@ -161,9 +161,9 @@ static int mesh_path_sel_frame_tx(enum mpath_frame_type action, u8 flags,
  * @ra: node this frame is addressed to
  */
 int mesh_path_error_tx(u8 *dst, __le32 dst_dsn, u8 *ra,
-                struct net_device *dev)
+                struct ieee80211_sub_if_data *sdata)
 {
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+        struct ieee80211_local *local = sdata->local;
         struct sk_buff *skb = dev_alloc_skb(local->hw.extra_tx_headroom + 400);
         struct ieee80211_mgmt *mgmt;
         u8 *pos;
@@ -178,11 +178,11 @@ int mesh_path_error_tx(u8 *dst, __le32 dst_dsn, u8 *ra,
         mgmt = (struct ieee80211_mgmt *)
                 skb_put(skb, 25 + sizeof(mgmt->u.action.u.mesh_action));
         memset(mgmt, 0, 25 + sizeof(mgmt->u.action.u.mesh_action));
-        mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
-                                           IEEE80211_STYPE_ACTION);
+        mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
+                                          IEEE80211_STYPE_ACTION);
 
         memcpy(mgmt->da, ra, ETH_ALEN);
-        memcpy(mgmt->sa, dev->dev_addr, ETH_ALEN);
+        memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
         /* BSSID is left zeroed, wildcard value */
         mgmt->u.action.category = MESH_PATH_SEL_CATEGORY;
         mgmt->u.action.u.mesh_action.action_code = MPATH_PERR;
@@ -198,7 +198,7 @@ int mesh_path_error_tx(u8 *dst, __le32 dst_dsn, u8 *ra,
         pos += ETH_ALEN;
         memcpy(pos, &dst_dsn, 4);
 
-        ieee80211_sta_tx(dev, skb, 0);
+        ieee80211_tx_skb(sdata, skb, 0);
         return 0;
 }
 
@@ -223,7 +223,7 @@ static u32 airtime_link_metric_get(struct ieee80211_local *local,
         /* bitrate is in units of 100 Kbps, while we need rate in units of
          * 1Mbps. This will be corrected on tx_time computation.
          */
-        rate = sband->bitrates[sta->txrate_idx].bitrate;
+        rate = sband->bitrates[sta->last_txrate_idx].bitrate;
         tx_time = (device_constant + 10 * test_frame_len / rate);
         estimated_retx = ((1 << (2 * ARITH_SHIFT)) / (s_unit - err));
         result = (tx_time * estimated_retx) >> (2 * ARITH_SHIFT) ;
@@ -233,7 +233,7 @@ static u32 airtime_link_metric_get(struct ieee80211_local *local,
 /**
  * hwmp_route_info_get - Update routing info to originator and transmitter
  *
- * @dev: local mesh interface
+ * @sdata: local mesh subif
  * @mgmt: mesh management frame
  * @hwmp_ie: hwmp information element (PREP or PREQ)
  *
@@ -246,11 +246,11 @@ static u32 airtime_link_metric_get(struct ieee80211_local *local,
  * Notes: this function is the only place (besides user-provided info) where
  * path routing information is updated.
  */
-static u32 hwmp_route_info_get(struct net_device *dev,
+static u32 hwmp_route_info_get(struct ieee80211_sub_if_data *sdata,
                             struct ieee80211_mgmt *mgmt,
                             u8 *hwmp_ie)
 {
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+        struct ieee80211_local *local = sdata->local;
         struct mesh_path *mpath;
         struct sta_info *sta;
         bool fresh_info;
@@ -301,14 +301,14 @@ static u32 hwmp_route_info_get(struct net_device *dev,
                 new_metric = MAX_METRIC;
         exp_time = TU_TO_EXP_TIME(orig_lifetime);
 
-        if (memcmp(orig_addr, dev->dev_addr, ETH_ALEN) == 0) {
+        if (memcmp(orig_addr, sdata->dev->dev_addr, ETH_ALEN) == 0) {
                 /* This MP is the originator, we are not interested in this
                  * frame, except for updating transmitter's path info.
                  */
                 process = false;
                 fresh_info = false;
         } else {
-                mpath = mesh_path_lookup(orig_addr, dev);
+                mpath = mesh_path_lookup(orig_addr, sdata);
                 if (mpath) {
                         spin_lock_bh(&mpath->state_lock);
                         if (mpath->flags & MESH_PATH_FIXED)
@@ -324,8 +324,8 @@ static u32 hwmp_route_info_get(struct net_device *dev,
                                 }
                         }
                 } else {
-                        mesh_path_add(orig_addr, dev);
-                        mpath = mesh_path_lookup(orig_addr, dev);
+                        mesh_path_add(orig_addr, sdata);
+                        mpath = mesh_path_lookup(orig_addr, sdata);
                         if (!mpath) {
                                 rcu_read_unlock();
                                 return 0;
@@ -357,7 +357,7 @@ static u32 hwmp_route_info_get(struct net_device *dev,
         else {
                 fresh_info = true;
 
-                mpath = mesh_path_lookup(ta, dev);
+                mpath = mesh_path_lookup(ta, sdata);
                 if (mpath) {
                         spin_lock_bh(&mpath->state_lock);
                         if ((mpath->flags & MESH_PATH_FIXED) ||
@@ -365,8 +365,8 @@ static u32 hwmp_route_info_get(struct net_device *dev,
                                         (last_hop_metric > mpath->metric)))
                                 fresh_info = false;
                 } else {
-                        mesh_path_add(ta, dev);
-                        mpath = mesh_path_lookup(ta, dev);
+                        mesh_path_add(ta, sdata);
+                        mpath = mesh_path_lookup(ta, sdata);
                         if (!mpath) {
                                 rcu_read_unlock();
                                 return 0;
@@ -392,11 +392,10 @@ static u32 hwmp_route_info_get(struct net_device *dev,
         return process ? new_metric : 0;
 }
 
-static void hwmp_preq_frame_process(struct net_device *dev,
+static void hwmp_preq_frame_process(struct ieee80211_sub_if_data *sdata,
                                     struct ieee80211_mgmt *mgmt,
                                     u8 *preq_elem, u32 metric) {
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        struct ieee80211_if_sta *ifsta = &sdata->u.sta;
+        struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
         struct mesh_path *mpath;
         u8 *dst_addr, *orig_addr;
         u8 dst_flags, ttl;
@@ -411,19 +410,19 @@ static void hwmp_preq_frame_process(struct net_device *dev,
         orig_dsn = PREQ_IE_ORIG_DSN(preq_elem);
         dst_flags = PREQ_IE_DST_F(preq_elem);
 
-        if (memcmp(dst_addr, dev->dev_addr, ETH_ALEN) == 0) {
+        if (memcmp(dst_addr, sdata->dev->dev_addr, ETH_ALEN) == 0) {
                 forward = false;
                 reply = true;
                 metric = 0;
-                if (time_after(jiffies, ifsta->last_dsn_update +
+                if (time_after(jiffies, ifmsh->last_dsn_update +
                                         net_traversal_jiffies(sdata)) ||
-                    time_before(jiffies, ifsta->last_dsn_update)) {
-                        dst_dsn = ++ifsta->dsn;
-                        ifsta->last_dsn_update = jiffies;
+                    time_before(jiffies, ifmsh->last_dsn_update)) {
+                        dst_dsn = ++ifmsh->dsn;
+                        ifmsh->last_dsn_update = jiffies;
                 }
         } else {
                 rcu_read_lock();
-                mpath = mesh_path_lookup(dst_addr, dev);
+                mpath = mesh_path_lookup(dst_addr, sdata);
                 if (mpath) {
                         if ((!(mpath->flags & MESH_PATH_DSN_VALID)) ||
                                         DSN_LT(mpath->dsn, dst_dsn)) {
@@ -445,15 +444,15 @@ static void hwmp_preq_frame_process(struct net_device *dev,
 
         if (reply) {
                 lifetime = PREQ_IE_LIFETIME(preq_elem);
-                ttl = ifsta->mshcfg.dot11MeshTTL;
+                ttl = ifmsh->mshcfg.dot11MeshTTL;
                 if (ttl != 0)
                         mesh_path_sel_frame_tx(MPATH_PREP, 0, dst_addr,
                                 cpu_to_le32(dst_dsn), 0, orig_addr,
                                 cpu_to_le32(orig_dsn), mgmt->sa, 0, ttl,
                                 cpu_to_le32(lifetime), cpu_to_le32(metric),
-                                0, dev);
+                                0, sdata);
                 else
-                        ifsta->mshstats.dropped_frames_ttl++;
+                        ifmsh->mshstats.dropped_frames_ttl++;
         }
 
         if (forward) {
@@ -463,7 +462,7 @@ static void hwmp_preq_frame_process(struct net_device *dev,
                 ttl = PREQ_IE_TTL(preq_elem);
                 lifetime = PREQ_IE_LIFETIME(preq_elem);
                 if (ttl <= 1) {
-                        ifsta->mshstats.dropped_frames_ttl++;
+                        ifmsh->mshstats.dropped_frames_ttl++;
                         return;
                 }
                 --ttl;
@@ -472,20 +471,19 @@ static void hwmp_preq_frame_process(struct net_device *dev,
                 hopcount = PREQ_IE_HOPCOUNT(preq_elem) + 1;
                 mesh_path_sel_frame_tx(MPATH_PREQ, flags, orig_addr,
                                 cpu_to_le32(orig_dsn), dst_flags, dst_addr,
-                                cpu_to_le32(dst_dsn), dev->broadcast,
+                                cpu_to_le32(dst_dsn), sdata->dev->broadcast,
                                 hopcount, ttl, cpu_to_le32(lifetime),
                                 cpu_to_le32(metric), cpu_to_le32(preq_id),
-                                dev);
-                ifsta->mshstats.fwded_frames++;
+                                sdata);
+                ifmsh->mshstats.fwded_frames++;
         }
 }
 
 
-static void hwmp_prep_frame_process(struct net_device *dev,
+static void hwmp_prep_frame_process(struct ieee80211_sub_if_data *sdata,
                                     struct ieee80211_mgmt *mgmt,
                                     u8 *prep_elem, u32 metric)
 {
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         struct mesh_path *mpath;
         u8 *dst_addr, *orig_addr;
         u8 ttl, hopcount, flags;
@@ -499,18 +497,18 @@ static void hwmp_prep_frame_process(struct net_device *dev,
          * replies
          */
         dst_addr = PREP_IE_DST_ADDR(prep_elem);
-        if (memcmp(dst_addr, dev->dev_addr, ETH_ALEN) == 0)
+        if (memcmp(dst_addr, sdata->dev->dev_addr, ETH_ALEN) == 0)
                 /* destination, no forwarding required */
                 return;
 
         ttl = PREP_IE_TTL(prep_elem);
         if (ttl <= 1) {
-                sdata->u.sta.mshstats.dropped_frames_ttl++;
+                sdata->u.mesh.mshstats.dropped_frames_ttl++;
                 return;
         }
 
         rcu_read_lock();
-        mpath = mesh_path_lookup(dst_addr, dev);
+        mpath = mesh_path_lookup(dst_addr, sdata);
         if (mpath)
                 spin_lock_bh(&mpath->state_lock);
         else
@@ -519,7 +517,7 @@ static void hwmp_prep_frame_process(struct net_device *dev,
                 spin_unlock_bh(&mpath->state_lock);
                 goto fail;
         }
-        memcpy(next_hop, mpath->next_hop->addr, ETH_ALEN);
+        memcpy(next_hop, mpath->next_hop->sta.addr, ETH_ALEN);
         spin_unlock_bh(&mpath->state_lock);
         --ttl;
         flags = PREP_IE_FLAGS(prep_elem);
@@ -531,20 +529,20 @@ static void hwmp_prep_frame_process(struct net_device *dev,
 
         mesh_path_sel_frame_tx(MPATH_PREP, flags, orig_addr,
                 cpu_to_le32(orig_dsn), 0, dst_addr,
-                cpu_to_le32(dst_dsn), mpath->next_hop->addr, hopcount, ttl,
+                cpu_to_le32(dst_dsn), mpath->next_hop->sta.addr, hopcount, ttl,
                 cpu_to_le32(lifetime), cpu_to_le32(metric),
-                0, dev);
+                0, sdata);
         rcu_read_unlock();
-        sdata->u.sta.mshstats.fwded_frames++;
+        sdata->u.mesh.mshstats.fwded_frames++;
         return;
 
 fail:
         rcu_read_unlock();
-        sdata->u.sta.mshstats.dropped_frames_no_route++;
+        sdata->u.mesh.mshstats.dropped_frames_no_route++;
         return;
 }
 
-static void hwmp_perr_frame_process(struct net_device *dev,
+static void hwmp_perr_frame_process(struct ieee80211_sub_if_data *sdata,
                              struct ieee80211_mgmt *mgmt, u8 *perr_elem)
 {
         struct mesh_path *mpath;
@@ -555,18 +553,18 @@ static void hwmp_perr_frame_process(struct net_device *dev,
         dst_addr = PERR_IE_DST_ADDR(perr_elem);
         dst_dsn = PERR_IE_DST_DSN(perr_elem);
         rcu_read_lock();
-        mpath = mesh_path_lookup(dst_addr, dev);
+        mpath = mesh_path_lookup(dst_addr, sdata);
         if (mpath) {
                 spin_lock_bh(&mpath->state_lock);
                 if (mpath->flags & MESH_PATH_ACTIVE &&
-                    memcmp(ta, mpath->next_hop->addr, ETH_ALEN) == 0 &&
+                    memcmp(ta, mpath->next_hop->sta.addr, ETH_ALEN) == 0 &&
                     (!(mpath->flags & MESH_PATH_DSN_VALID) ||
                     DSN_GT(dst_dsn, mpath->dsn))) {
                         mpath->flags &= ~MESH_PATH_ACTIVE;
                         mpath->dsn = dst_dsn;
                         spin_unlock_bh(&mpath->state_lock);
                         mesh_path_error_tx(dst_addr, cpu_to_le32(dst_dsn),
-                                           dev->broadcast, dev);
+                                           sdata->dev->broadcast, sdata);
                 } else
                         spin_unlock_bh(&mpath->state_lock);
         }
@@ -575,7 +573,7 @@ static void hwmp_perr_frame_process(struct net_device *dev,
 
 
 
-void mesh_rx_path_sel_frame(struct net_device *dev,
+void mesh_rx_path_sel_frame(struct ieee80211_sub_if_data *sdata,
                             struct ieee80211_mgmt *mgmt,
                             size_t len)
 {
@@ -583,6 +581,10 @@ void mesh_rx_path_sel_frame(struct net_device *dev,
         size_t baselen;
         u32 last_hop_metric;
 
+        /* need action_code */
+        if (len < IEEE80211_MIN_ACTION_SIZE + 1)
+                return;
+
         baselen = (u8 *) mgmt->u.action.u.mesh_action.variable - (u8 *) mgmt;
         ieee802_11_parse_elems(mgmt->u.action.u.mesh_action.variable,
                         len - baselen, &elems);
@@ -592,25 +594,25 @@ void mesh_rx_path_sel_frame(struct net_device *dev,
                 if (!elems.preq || elems.preq_len != 37)
                         /* Right now we support just 1 destination and no AE */
                         return;
-                last_hop_metric = hwmp_route_info_get(dev, mgmt, elems.preq);
+                last_hop_metric = hwmp_route_info_get(sdata, mgmt, elems.preq);
                 if (!last_hop_metric)
                         return;
-                hwmp_preq_frame_process(dev, mgmt, elems.preq, last_hop_metric);
+                hwmp_preq_frame_process(sdata, mgmt, elems.preq, last_hop_metric);
                 break;
         case MPATH_PREP:
                 if (!elems.prep || elems.prep_len != 31)
                         /* Right now we support no AE */
                         return;
-                last_hop_metric = hwmp_route_info_get(dev, mgmt, elems.prep);
+                last_hop_metric = hwmp_route_info_get(sdata, mgmt, elems.prep);
                 if (!last_hop_metric)
                         return;
-                hwmp_prep_frame_process(dev, mgmt, elems.prep, last_hop_metric);
+                hwmp_prep_frame_process(sdata, mgmt, elems.prep, last_hop_metric);
                 break;
         case MPATH_PERR:
                 if (!elems.perr || elems.perr_len != 12)
                         /* Right now we support only one destination per PERR */
                         return;
-                hwmp_perr_frame_process(dev, mgmt, elems.perr);
+                hwmp_perr_frame_process(sdata, mgmt, elems.perr);
         default:
                 return;
         }
@@ -628,9 +630,8 @@ void mesh_rx_path_sel_frame(struct net_device *dev,
  */
 static void mesh_queue_preq(struct mesh_path *mpath, u8 flags)
 {
-        struct ieee80211_sub_if_data *sdata =
-                IEEE80211_DEV_TO_SUB_IF(mpath->dev);
-        struct ieee80211_if_sta *ifsta = &sdata->u.sta;
+        struct ieee80211_sub_if_data *sdata = mpath->sdata;
+        struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
         struct mesh_preq_queue *preq_node;
 
         preq_node = kmalloc(sizeof(struct mesh_preq_queue), GFP_KERNEL);
@@ -639,9 +640,9 @@ static void mesh_queue_preq(struct mesh_path *mpath, u8 flags)
                 return;
         }
 
-        spin_lock(&ifsta->mesh_preq_queue_lock);
-        if (ifsta->preq_queue_len == MAX_PREQ_QUEUE_LEN) {
-                spin_unlock(&ifsta->mesh_preq_queue_lock);
+        spin_lock(&ifmsh->mesh_preq_queue_lock);
+        if (ifmsh->preq_queue_len == MAX_PREQ_QUEUE_LEN) {
+                spin_unlock(&ifmsh->mesh_preq_queue_lock);
                 kfree(preq_node);
                 if (printk_ratelimit())
                         printk(KERN_DEBUG "Mesh HWMP: PREQ node queue full\n");
@@ -651,55 +652,53 @@ static void mesh_queue_preq(struct mesh_path *mpath, u8 flags)
         memcpy(preq_node->dst, mpath->dst, ETH_ALEN);
         preq_node->flags = flags;
 
-        list_add_tail(&preq_node->list, &ifsta->preq_queue.list);
-        ++ifsta->preq_queue_len;
-        spin_unlock(&ifsta->mesh_preq_queue_lock);
+        list_add_tail(&preq_node->list, &ifmsh->preq_queue.list);
+        ++ifmsh->preq_queue_len;
+        spin_unlock(&ifmsh->mesh_preq_queue_lock);
 
-        if (time_after(jiffies, ifsta->last_preq + min_preq_int_jiff(sdata)))
-                queue_work(sdata->local->hw.workqueue, &ifsta->work);
+        if (time_after(jiffies, ifmsh->last_preq + min_preq_int_jiff(sdata)))
+                queue_work(sdata->local->hw.workqueue, &ifmsh->work);
 
-        else if (time_before(jiffies, ifsta->last_preq)) {
+        else if (time_before(jiffies, ifmsh->last_preq)) {
                 /* avoid long wait if did not send preqs for a long time
                  * and jiffies wrapped around
                  */
-                ifsta->last_preq = jiffies - min_preq_int_jiff(sdata) - 1;
-                queue_work(sdata->local->hw.workqueue, &ifsta->work);
+                ifmsh->last_preq = jiffies - min_preq_int_jiff(sdata) - 1;
+                queue_work(sdata->local->hw.workqueue, &ifmsh->work);
         } else
-                mod_timer(&ifsta->mesh_path_timer, ifsta->last_preq +
+                mod_timer(&ifmsh->mesh_path_timer, ifmsh->last_preq +
                                                 min_preq_int_jiff(sdata));
 }
 
 /**
  * mesh_path_start_discovery - launch a path discovery from the PREQ queue
  *
- * @dev: local mesh interface
+ * @sdata: local mesh subif
  */
-void mesh_path_start_discovery(struct net_device *dev)
+void mesh_path_start_discovery(struct ieee80211_sub_if_data *sdata)
 {
-        struct ieee80211_sub_if_data *sdata =
-                IEEE80211_DEV_TO_SUB_IF(dev);
-        struct ieee80211_if_sta *ifsta = &sdata->u.sta;
+        struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
         struct mesh_preq_queue *preq_node;
         struct mesh_path *mpath;
         u8 ttl, dst_flags;
         u32 lifetime;
 
-        spin_lock(&ifsta->mesh_preq_queue_lock);
-        if (!ifsta->preq_queue_len ||
-                time_before(jiffies, ifsta->last_preq +
+        spin_lock(&ifmsh->mesh_preq_queue_lock);
+        if (!ifmsh->preq_queue_len ||
+                time_before(jiffies, ifmsh->last_preq +
                                 min_preq_int_jiff(sdata))) {
-                spin_unlock(&ifsta->mesh_preq_queue_lock);
+                spin_unlock(&ifmsh->mesh_preq_queue_lock);
                 return;
         }
 
-        preq_node = list_first_entry(&ifsta->preq_queue.list,
+        preq_node = list_first_entry(&ifmsh->preq_queue.list,
                         struct mesh_preq_queue, list);
         list_del(&preq_node->list);
-        --ifsta->preq_queue_len;
-        spin_unlock(&ifsta->mesh_preq_queue_lock);
+        --ifmsh->preq_queue_len;
+        spin_unlock(&ifmsh->mesh_preq_queue_lock);
 
         rcu_read_lock();
-        mpath = mesh_path_lookup(preq_node->dst, dev);
+        mpath = mesh_path_lookup(preq_node->dst, sdata);
         if (!mpath)
                 goto enddiscovery;
 
@@ -721,18 +720,18 @@ void mesh_path_start_discovery(struct net_device *dev)
                 goto enddiscovery;
         }
 
-        ifsta->last_preq = jiffies;
+        ifmsh->last_preq = jiffies;
 
-        if (time_after(jiffies, ifsta->last_dsn_update +
+        if (time_after(jiffies, ifmsh->last_dsn_update +
                                 net_traversal_jiffies(sdata)) ||
-            time_before(jiffies, ifsta->last_dsn_update)) {
-                ++ifsta->dsn;
-                sdata->u.sta.last_dsn_update = jiffies;
+            time_before(jiffies, ifmsh->last_dsn_update)) {
+                ++ifmsh->dsn;
+                sdata->u.mesh.last_dsn_update = jiffies;
         }
         lifetime = default_lifetime(sdata);
-        ttl = sdata->u.sta.mshcfg.dot11MeshTTL;
+        ttl = sdata->u.mesh.mshcfg.dot11MeshTTL;
         if (ttl == 0) {
-                sdata->u.sta.mshstats.dropped_frames_ttl++;
+                sdata->u.mesh.mshstats.dropped_frames_ttl++;
                 spin_unlock_bh(&mpath->state_lock);
                 goto enddiscovery;
         }
@@ -743,11 +742,11 @@ void mesh_path_start_discovery(struct net_device *dev)
                 dst_flags = MP_F_RF;
 
         spin_unlock_bh(&mpath->state_lock);
-        mesh_path_sel_frame_tx(MPATH_PREQ, 0, dev->dev_addr,
-                        cpu_to_le32(ifsta->dsn), dst_flags, mpath->dst,
-                        cpu_to_le32(mpath->dsn), dev->broadcast, 0,
+        mesh_path_sel_frame_tx(MPATH_PREQ, 0, sdata->dev->dev_addr,
+                        cpu_to_le32(ifmsh->dsn), dst_flags, mpath->dst,
+                        cpu_to_le32(mpath->dsn), sdata->dev->broadcast, 0,
                         ttl, cpu_to_le32(lifetime), 0,
-                        cpu_to_le32(ifsta->preq_id++), dev);
+                        cpu_to_le32(ifmsh->preq_id++), sdata);
         mod_timer(&mpath->timer, jiffies + mpath->discovery_timeout);
 
 enddiscovery:
@@ -759,7 +758,7 @@ enddiscovery:
  * ieee80211s_lookup_nexthop - put the appropriate next hop on a mesh frame
  *
  * @skb: 802.11 frame to be sent
- * @dev: network device the frame will be sent through
+ * @sdata: network subif the frame will be sent through
  * @fwd_frame: true if this frame was originally from a different host
  *
  * Returns: 0 if the next hop was found. Nonzero otherwise. If no next hop is
@@ -767,9 +766,9 @@ enddiscovery:
  * sent when the path is resolved. This means the caller must not free the skb
  * in this case.
  */
-int mesh_nexthop_lookup(struct sk_buff *skb, struct net_device *dev)
+int mesh_nexthop_lookup(struct sk_buff *skb,
+                        struct ieee80211_sub_if_data *sdata)
 {
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         struct sk_buff *skb_to_free = NULL;
         struct mesh_path *mpath;
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
@@ -777,14 +776,14 @@ int mesh_nexthop_lookup(struct sk_buff *skb, struct net_device *dev)
         int err = 0;
 
         rcu_read_lock();
-        mpath = mesh_path_lookup(dst_addr, dev);
+        mpath = mesh_path_lookup(dst_addr, sdata);
 
         if (!mpath) {
-                mesh_path_add(dst_addr, dev);
-                mpath = mesh_path_lookup(dst_addr, dev);
+                mesh_path_add(dst_addr, sdata);
+                mpath = mesh_path_lookup(dst_addr, sdata);
                 if (!mpath) {
                         dev_kfree_skb(skb);
-                        sdata->u.sta.mshstats.dropped_frames_no_route++;
+                        sdata->u.mesh.mshstats.dropped_frames_no_route++;
                         err = -ENOSPC;
                         goto endlookup;
                 }
@@ -792,14 +791,15 @@ int mesh_nexthop_lookup(struct sk_buff *skb, struct net_device *dev)
 
         if (mpath->flags & MESH_PATH_ACTIVE) {
                 if (time_after(jiffies, mpath->exp_time -
-                        msecs_to_jiffies(sdata->u.sta.mshcfg.path_refresh_time))
-                                && !memcmp(dev->dev_addr, hdr->addr4, ETH_ALEN)
+                        msecs_to_jiffies(sdata->u.mesh.mshcfg.path_refresh_time))
+                                && !memcmp(sdata->dev->dev_addr, hdr->addr4,
+                                           ETH_ALEN)
                                 && !(mpath->flags & MESH_PATH_RESOLVING)
                                 && !(mpath->flags & MESH_PATH_FIXED)) {
                         mesh_queue_preq(mpath,
                                         PREQ_Q_F_START | PREQ_Q_F_REFRESH);
                 }
-                memcpy(hdr->addr1, mpath->next_hop->addr,
+                memcpy(hdr->addr1, mpath->next_hop->sta.addr,
                                 ETH_ALEN);
         } else {
                 if (!(mpath->flags & MESH_PATH_RESOLVING)) {
@@ -815,7 +815,7 @@ int mesh_nexthop_lookup(struct sk_buff *skb, struct net_device *dev)
 
                 skb_queue_tail(&mpath->frame_queue, skb);
                 if (skb_to_free)
-                        mesh_path_discard_frame(skb_to_free, dev);
+                        mesh_path_discard_frame(skb_to_free, sdata);
                 err = -ENOENT;
         }
 
@@ -835,7 +835,7 @@ void mesh_path_timer(unsigned long data)
         if (!mpath)
                 goto endmpathtimer;
         spin_lock_bh(&mpath->state_lock);
-        sdata = IEEE80211_DEV_TO_SUB_IF(mpath->dev);
+        sdata = mpath->sdata;
         if (mpath->flags & MESH_PATH_RESOLVED ||
                         (!(mpath->flags & MESH_PATH_RESOLVING)))
                 mpath->flags &= ~(MESH_PATH_RESOLVING | MESH_PATH_RESOLVED);
diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c
index 838ee60492ad..3c72557df45a 100644
--- a/net/mac80211/mesh_pathtbl.c
+++ b/net/mac80211/mesh_pathtbl.c
@@ -9,7 +9,6 @@
 
 #include <linux/etherdevice.h>
 #include <linux/list.h>
-#include <linux/netdevice.h>
 #include <linux/random.h>
 #include <linux/spinlock.h>
 #include <linux/string.h>
@@ -37,6 +36,7 @@ struct mpath_node {
 };
 
 static struct mesh_table *mesh_paths;
+static struct mesh_table *mpp_paths; /* Store paths for MPP&MAP */
 
 /* This lock will have the grow table function as writer and add / delete nodes
  * as readers. When reading the table (i.e. doing lookups) we are well protected
@@ -62,13 +62,13 @@ void mesh_path_assign_nexthop(struct mesh_path *mpath, struct sta_info *sta)
 /**
  * mesh_path_lookup - look up a path in the mesh path table
  * @dst: hardware address (ETH_ALEN length) of destination
- * @dev: local interface
+ * @sdata: local subif
  *
  * Returns: pointer to the mesh path structure, or NULL if not found
  *
  * Locking: must be called within a read rcu section.
  */
-struct mesh_path *mesh_path_lookup(u8 *dst, struct net_device *dev)
+struct mesh_path *mesh_path_lookup(u8 *dst, struct ieee80211_sub_if_data *sdata)
 {
         struct mesh_path *mpath;
         struct hlist_node *n;
@@ -78,10 +78,10 @@ struct mesh_path *mesh_path_lookup(u8 *dst, struct net_device *dev)
 
         tbl = rcu_dereference(mesh_paths);
 
-        bucket = &tbl->hash_buckets[mesh_table_hash(dst, dev, tbl)];
+        bucket = &tbl->hash_buckets[mesh_table_hash(dst, sdata, tbl)];
         hlist_for_each_entry_rcu(node, n, bucket, list) {
                 mpath = node->mpath;
-                if (mpath->dev == dev &&
+                if (mpath->sdata == sdata &&
                                 memcmp(dst, mpath->dst, ETH_ALEN) == 0) {
                         if (MPATH_EXPIRED(mpath)) {
                                 spin_lock_bh(&mpath->state_lock);
@@ -95,16 +95,44 @@ struct mesh_path *mesh_path_lookup(u8 *dst, struct net_device *dev)
         return NULL;
 }
 
+struct mesh_path *mpp_path_lookup(u8 *dst, struct ieee80211_sub_if_data *sdata)
+{
+        struct mesh_path *mpath;
+        struct hlist_node *n;
+        struct hlist_head *bucket;
+        struct mesh_table *tbl;
+        struct mpath_node *node;
+
+        tbl = rcu_dereference(mpp_paths);
+
+        bucket = &tbl->hash_buckets[mesh_table_hash(dst, sdata, tbl)];
+        hlist_for_each_entry_rcu(node, n, bucket, list) {
+                mpath = node->mpath;
+                if (mpath->sdata == sdata &&
+                    memcmp(dst, mpath->dst, ETH_ALEN) == 0) {
+                        if (MPATH_EXPIRED(mpath)) {
+                                spin_lock_bh(&mpath->state_lock);
+                                if (MPATH_EXPIRED(mpath))
+                                        mpath->flags &= ~MESH_PATH_ACTIVE;
+                                spin_unlock_bh(&mpath->state_lock);
+                        }
+                        return mpath;
+                }
+        }
+        return NULL;
+}
+
+
 /**
  * mesh_path_lookup_by_idx - look up a path in the mesh path table by its index
  * @idx: index
- * @dev: local interface, or NULL for all entries
+ * @sdata: local subif, or NULL for all entries
  *
  * Returns: pointer to the mesh path structure, or NULL if not found.
  *
  * Locking: must be called within a read rcu section.
  */
-struct mesh_path *mesh_path_lookup_by_idx(int idx, struct net_device *dev)
+struct mesh_path *mesh_path_lookup_by_idx(int idx, struct ieee80211_sub_if_data *sdata)
 {
         struct mpath_node *node;
         struct hlist_node *p;
@@ -112,7 +140,7 @@ struct mesh_path *mesh_path_lookup_by_idx(int idx, struct net_device *dev)
         int j = 0;
 
         for_each_mesh_entry(mesh_paths, p, node, i) {
-                if (dev && node->mpath->dev != dev)
+                if (sdata && node->mpath->sdata != sdata)
                         continue;
                 if (j++ == idx) {
                         if (MPATH_EXPIRED(node->mpath)) {
@@ -131,15 +159,14 @@ struct mesh_path *mesh_path_lookup_by_idx(int idx, struct net_device *dev)
 /**
  * mesh_path_add - allocate and add a new path to the mesh path table
  * @addr: destination address of the path (ETH_ALEN length)
- * @dev: local interface
+ * @sdata: local subif
  *
  * Returns: 0 on sucess
  *
  * State: the initial state of the new path is set to 0
  */
-int mesh_path_add(u8 *dst, struct net_device *dev)
+int mesh_path_add(u8 *dst, struct ieee80211_sub_if_data *sdata)
 {
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         struct mesh_path *mpath, *new_mpath;
         struct mpath_node *node, *new_node;
         struct hlist_head *bucket;
@@ -148,14 +175,14 @@ int mesh_path_add(u8 *dst, struct net_device *dev)
         int err = 0;
         u32 hash_idx;
 
-        if (memcmp(dst, dev->dev_addr, ETH_ALEN) == 0)
+        if (memcmp(dst, sdata->dev->dev_addr, ETH_ALEN) == 0)
                 /* never add ourselves as neighbours */
                 return -ENOTSUPP;
 
         if (is_multicast_ether_addr(dst))
                 return -ENOTSUPP;
 
-        if (atomic_add_unless(&sdata->u.sta.mpaths, 1, MESH_MAX_MPATHS) == 0)
+        if (atomic_add_unless(&sdata->u.mesh.mpaths, 1, MESH_MAX_MPATHS) == 0)
                 return -ENOSPC;
 
         err = -ENOMEM;
@@ -169,7 +196,7 @@ int mesh_path_add(u8 *dst, struct net_device *dev)
 
         read_lock(&pathtbl_resize_lock);
         memcpy(new_mpath->dst, dst, ETH_ALEN);
-        new_mpath->dev = dev;
+        new_mpath->sdata = sdata;
         new_mpath->flags = 0;
         skb_queue_head_init(&new_mpath->frame_queue);
         new_node->mpath = new_mpath;
@@ -179,7 +206,7 @@ int mesh_path_add(u8 *dst, struct net_device *dev)
         spin_lock_init(&new_mpath->state_lock);
         init_timer(&new_mpath->timer);
 
-        hash_idx = mesh_table_hash(dst, dev, mesh_paths);
+        hash_idx = mesh_table_hash(dst, sdata, mesh_paths);
         bucket = &mesh_paths->hash_buckets[hash_idx];
 
         spin_lock(&mesh_paths->hashwlock[hash_idx]);
@@ -187,7 +214,7 @@ int mesh_path_add(u8 *dst, struct net_device *dev)
         err = -EEXIST;
         hlist_for_each_entry(node, n, bucket, list) {
                 mpath = node->mpath;
-                if (mpath->dev == dev && memcmp(dst, mpath->dst, ETH_ALEN) == 0)
+                if (mpath->sdata == sdata && memcmp(dst, mpath->dst, ETH_ALEN) == 0)
                         goto err_exists;
         }
 
@@ -223,7 +250,92 @@ err_exists:
 err_node_alloc:
         kfree(new_mpath);
 err_path_alloc:
-        atomic_dec(&sdata->u.sta.mpaths);
+        atomic_dec(&sdata->u.mesh.mpaths);
+        return err;
+}
+
+
+int mpp_path_add(u8 *dst, u8 *mpp, struct ieee80211_sub_if_data *sdata)
+{
+        struct mesh_path *mpath, *new_mpath;
+        struct mpath_node *node, *new_node;
+        struct hlist_head *bucket;
+        struct hlist_node *n;
+        int grow = 0;
+        int err = 0;
+        u32 hash_idx;
+
+
+        if (memcmp(dst, sdata->dev->dev_addr, ETH_ALEN) == 0)
+                /* never add ourselves as neighbours */
+                return -ENOTSUPP;
+
+        if (is_multicast_ether_addr(dst))
+                return -ENOTSUPP;
+
+        err = -ENOMEM;
+        new_mpath = kzalloc(sizeof(struct mesh_path), GFP_KERNEL);
+        if (!new_mpath)
+                goto err_path_alloc;
+
+        new_node = kmalloc(sizeof(struct mpath_node), GFP_KERNEL);
+        if (!new_node)
+                goto err_node_alloc;
+
+        read_lock(&pathtbl_resize_lock);
+        memcpy(new_mpath->dst, dst, ETH_ALEN);
+        memcpy(new_mpath->mpp, mpp, ETH_ALEN);
+        new_mpath->sdata = sdata;
+        new_mpath->flags = 0;
+        skb_queue_head_init(&new_mpath->frame_queue);
+        new_node->mpath = new_mpath;
+        new_mpath->exp_time = jiffies;
+        spin_lock_init(&new_mpath->state_lock);
+
+        hash_idx = mesh_table_hash(dst, sdata, mpp_paths);
+        bucket = &mpp_paths->hash_buckets[hash_idx];
+
+        spin_lock(&mpp_paths->hashwlock[hash_idx]);
+
+        err = -EEXIST;
+        hlist_for_each_entry(node, n, bucket, list) {
+                mpath = node->mpath;
+                if (mpath->sdata == sdata && memcmp(dst, mpath->dst, ETH_ALEN) == 0)
+                        goto err_exists;
+        }
+
+        hlist_add_head_rcu(&new_node->list, bucket);
+        if (atomic_inc_return(&mpp_paths->entries) >=
+                mpp_paths->mean_chain_len * (mpp_paths->hash_mask + 1))
+                grow = 1;
+
+        spin_unlock(&mpp_paths->hashwlock[hash_idx]);
+        read_unlock(&pathtbl_resize_lock);
+        if (grow) {
+                struct mesh_table *oldtbl, *newtbl;
+
+                write_lock(&pathtbl_resize_lock);
+                oldtbl = mpp_paths;
+                newtbl = mesh_table_grow(mpp_paths);
+                if (!newtbl) {
+                        write_unlock(&pathtbl_resize_lock);
+                        return 0;
+                }
+                rcu_assign_pointer(mpp_paths, newtbl);
+                write_unlock(&pathtbl_resize_lock);
+
+                synchronize_rcu();
+                mesh_table_free(oldtbl, false);
+        }
+        return 0;
+
+err_exists:
+        spin_unlock(&mpp_paths->hashwlock[hash_idx]);
+        read_unlock(&pathtbl_resize_lock);
+        kfree(new_node);
+err_node_alloc:
+        kfree(new_mpath);
+err_path_alloc:
         return err;
 }
 
@@ -241,7 +353,7 @@ void mesh_plink_broken(struct sta_info *sta)
         struct mesh_path *mpath;
         struct mpath_node *node;
         struct hlist_node *p;
-        struct net_device *dev = sta->sdata->dev;
+        struct ieee80211_sub_if_data *sdata = sta->sdata;
         int i;
 
         rcu_read_lock();
@@ -256,7 +368,7 @@ void mesh_plink_broken(struct sta_info *sta)
                         spin_unlock_bh(&mpath->state_lock);
                         mesh_path_error_tx(mpath->dst,
                                         cpu_to_le32(mpath->dsn),
-                                        dev->broadcast, dev);
+                                        sdata->dev->broadcast, sdata);
                 } else
                 spin_unlock_bh(&mpath->state_lock);
         }
@@ -284,11 +396,11 @@ void mesh_path_flush_by_nexthop(struct sta_info *sta)
         for_each_mesh_entry(mesh_paths, p, node, i) {
                 mpath = node->mpath;
                 if (mpath->next_hop == sta)
-                        mesh_path_del(mpath->dst, mpath->dev);
+                        mesh_path_del(mpath->dst, mpath->sdata);
         }
 }
 
-void mesh_path_flush(struct net_device *dev)
+void mesh_path_flush(struct ieee80211_sub_if_data *sdata)
 {
         struct mesh_path *mpath;
         struct mpath_node *node;
@@ -297,19 +409,18 @@ void mesh_path_flush(struct net_device *dev)
 
         for_each_mesh_entry(mesh_paths, p, node, i) {
                 mpath = node->mpath;
-                if (mpath->dev == dev)
-                        mesh_path_del(mpath->dst, mpath->dev);
+                if (mpath->sdata == sdata)
+                        mesh_path_del(mpath->dst, mpath->sdata);
         }
 }
 
 static void mesh_path_node_reclaim(struct rcu_head *rp)
 {
         struct mpath_node *node = container_of(rp, struct mpath_node, rcu);
-        struct ieee80211_sub_if_data *sdata =
-                IEEE80211_DEV_TO_SUB_IF(node->mpath->dev);
+        struct ieee80211_sub_if_data *sdata = node->mpath->sdata;
 
         del_timer_sync(&node->mpath->timer);
-        atomic_dec(&sdata->u.sta.mpaths);
+        atomic_dec(&sdata->u.mesh.mpaths);
         kfree(node->mpath);
         kfree(node);
 }
@@ -318,11 +429,11 @@ static void mesh_path_node_reclaim(struct rcu_head *rp)
  * mesh_path_del - delete a mesh path from the table
  *
  * @addr: dst address (ETH_ALEN length)
- * @dev: local interface
+ * @sdata: local subif
  *
  * Returns: 0 if succesful
  */
-int mesh_path_del(u8 *addr, struct net_device *dev)
+int mesh_path_del(u8 *addr, struct ieee80211_sub_if_data *sdata)
 {
         struct mesh_path *mpath;
         struct mpath_node *node;
@@ -332,13 +443,13 @@ int mesh_path_del(u8 *addr, struct net_device *dev)
         int err = 0;
 
         read_lock(&pathtbl_resize_lock);
-        hash_idx = mesh_table_hash(addr, dev, mesh_paths);
+        hash_idx = mesh_table_hash(addr, sdata, mesh_paths);
         bucket = &mesh_paths->hash_buckets[hash_idx];
 
         spin_lock(&mesh_paths->hashwlock[hash_idx]);
         hlist_for_each_entry(node, n, bucket, list) {
                 mpath = node->mpath;
-                if (mpath->dev == dev &&
+                if (mpath->sdata == sdata &&
                                 memcmp(addr, mpath->dst, ETH_ALEN) == 0) {
                         spin_lock_bh(&mpath->state_lock);
                         mpath->flags |= MESH_PATH_RESOLVING;
@@ -378,33 +489,33 @@ void mesh_path_tx_pending(struct mesh_path *mpath)
  * mesh_path_discard_frame - discard a frame whose path could not be resolved
  *
  * @skb: frame to discard
- * @dev: network device the frame was to be sent through
+ * @sdata: network subif the frame was to be sent through
  *
  * If the frame was beign forwarded from another MP, a PERR frame will be sent
  * to the precursor.
  *
  * Locking: the function must me called within a rcu_read_lock region
  */
-void mesh_path_discard_frame(struct sk_buff *skb, struct net_device *dev)
+void mesh_path_discard_frame(struct sk_buff *skb,
+                             struct ieee80211_sub_if_data *sdata)
 {
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
         struct mesh_path *mpath;
         u32 dsn = 0;
 
-        if (memcmp(hdr->addr4, dev->dev_addr, ETH_ALEN) != 0) {
+        if (memcmp(hdr->addr4, sdata->dev->dev_addr, ETH_ALEN) != 0) {
                 u8 *ra, *da;
 
                 da = hdr->addr3;
                 ra = hdr->addr2;
-                mpath = mesh_path_lookup(da, dev);
+                mpath = mesh_path_lookup(da, sdata);
                 if (mpath)
                         dsn = ++mpath->dsn;
-                mesh_path_error_tx(skb->data, cpu_to_le32(dsn), ra, dev);
+                mesh_path_error_tx(skb->data, cpu_to_le32(dsn), ra, sdata);
         }
 
         kfree_skb(skb);
-        sdata->u.sta.mshstats.dropped_frames_no_route++;
+        sdata->u.mesh.mshstats.dropped_frames_no_route++;
 }
 
 /**
@@ -416,14 +527,11 @@ void mesh_path_discard_frame(struct sk_buff *skb, struct net_device *dev)
  */
 void mesh_path_flush_pending(struct mesh_path *mpath)
 {
-        struct ieee80211_sub_if_data *sdata;
         struct sk_buff *skb;
 
-        sdata = IEEE80211_DEV_TO_SUB_IF(mpath->dev);
-
         while ((skb = skb_dequeue(&mpath->frame_queue)) &&
                         (mpath->flags & MESH_PATH_ACTIVE))
-                mesh_path_discard_frame(skb, mpath->dev);
+                mesh_path_discard_frame(skb, mpath->sdata);
 }
 
 /**
@@ -472,7 +580,7 @@ static int mesh_path_node_copy(struct hlist_node *p, struct mesh_table *newtbl)
         node = hlist_entry(p, struct mpath_node, list);
         mpath = node->mpath;
         new_node->mpath = mpath;
-        hash_idx = mesh_table_hash(mpath->dst, mpath->dev, newtbl);
+        hash_idx = mesh_table_hash(mpath->dst, mpath->sdata, newtbl);
         hlist_add_head(&new_node->list,
                         &newtbl->hash_buckets[hash_idx]);
         return 0;
@@ -481,15 +589,25 @@ static int mesh_path_node_copy(struct hlist_node *p, struct mesh_table *newtbl)
 int mesh_pathtbl_init(void)
 {
         mesh_paths = mesh_table_alloc(INIT_PATHS_SIZE_ORDER);
+        if (!mesh_paths)
+                return -ENOMEM;
         mesh_paths->free_node = &mesh_path_node_free;
         mesh_paths->copy_node = &mesh_path_node_copy;
         mesh_paths->mean_chain_len = MEAN_CHAIN_LEN;
-        if (!mesh_paths)
+
+        mpp_paths = mesh_table_alloc(INIT_PATHS_SIZE_ORDER);
+        if (!mpp_paths) {
+                mesh_table_free(mesh_paths, true);
                 return -ENOMEM;
+        }
+        mpp_paths->free_node = &mesh_path_node_free;
+        mpp_paths->copy_node = &mesh_path_node_copy;
+        mpp_paths->mean_chain_len = MEAN_CHAIN_LEN;
+
         return 0;
 }
 
-void mesh_path_expire(struct net_device *dev)
+void mesh_path_expire(struct ieee80211_sub_if_data *sdata)
 {
         struct mesh_path *mpath;
         struct mpath_node *node;
@@ -498,7 +616,7 @@ void mesh_path_expire(struct net_device *dev)
 
         read_lock(&pathtbl_resize_lock);
         for_each_mesh_entry(mesh_paths, p, node, i) {
-                if (node->mpath->dev != dev)
+                if (node->mpath->sdata != sdata)
                         continue;
                 mpath = node->mpath;
                 spin_lock_bh(&mpath->state_lock);
@@ -507,7 +625,7 @@ void mesh_path_expire(struct net_device *dev)
                         time_after(jiffies,
                          mpath->exp_time + MESH_PATH_EXPIRE)) {
                         spin_unlock_bh(&mpath->state_lock);
-                        mesh_path_del(mpath->dst, mpath->dev);
+                        mesh_path_del(mpath->dst, mpath->sdata);
                 } else
                         spin_unlock_bh(&mpath->state_lock);
         }
@@ -517,4 +635,5 @@ void mesh_path_expire(struct net_device *dev)
 void mesh_pathtbl_unregister(void)
 {
         mesh_table_free(mesh_paths, true);
+        mesh_table_free(mpp_paths, true);
 }
diff --git a/net/mac80211/mesh_plink.c b/net/mac80211/mesh_plink.c
index 9efeb1f07025..faac101c0f85 100644
--- a/net/mac80211/mesh_plink.c
+++ b/net/mac80211/mesh_plink.c
@@ -36,11 +36,11 @@
 #define MESH_SECURITY_AUTHENTICATION_IMPOSSIBLE 9
 #define MESH_SECURITY_FAILED_VERIFICATION       10
 
-#define dot11MeshMaxRetries(s) (s->u.sta.mshcfg.dot11MeshMaxRetries)
-#define dot11MeshRetryTimeout(s) (s->u.sta.mshcfg.dot11MeshRetryTimeout)
-#define dot11MeshConfirmTimeout(s) (s->u.sta.mshcfg.dot11MeshConfirmTimeout)
-#define dot11MeshHoldingTimeout(s) (s->u.sta.mshcfg.dot11MeshHoldingTimeout)
-#define dot11MeshMaxPeerLinks(s) (s->u.sta.mshcfg.dot11MeshMaxPeerLinks)
+#define dot11MeshMaxRetries(s) (s->u.mesh.mshcfg.dot11MeshMaxRetries)
+#define dot11MeshRetryTimeout(s) (s->u.mesh.mshcfg.dot11MeshRetryTimeout)
+#define dot11MeshConfirmTimeout(s) (s->u.mesh.mshcfg.dot11MeshConfirmTimeout)
+#define dot11MeshHoldingTimeout(s) (s->u.mesh.mshcfg.dot11MeshHoldingTimeout)
+#define dot11MeshMaxPeerLinks(s) (s->u.mesh.mshcfg.dot11MeshMaxPeerLinks)
 
 enum plink_frame_type {
         PLINK_OPEN = 0,
@@ -63,14 +63,14 @@ enum plink_event {
 static inline
 void mesh_plink_inc_estab_count(struct ieee80211_sub_if_data *sdata)
 {
-        atomic_inc(&sdata->u.sta.mshstats.estab_plinks);
+        atomic_inc(&sdata->u.mesh.mshstats.estab_plinks);
         mesh_accept_plinks_update(sdata);
 }
 
 static inline
 void mesh_plink_dec_estab_count(struct ieee80211_sub_if_data *sdata)
 {
-        atomic_dec(&sdata->u.sta.mshstats.estab_plinks);
+        atomic_dec(&sdata->u.mesh.mshstats.estab_plinks);
         mesh_accept_plinks_update(sdata);
 }
 
@@ -106,7 +106,7 @@ static struct sta_info *mesh_plink_alloc(struct ieee80211_sub_if_data *sdata,
                 return NULL;
 
         sta->flags = WLAN_STA_AUTHORIZED;
-        sta->supp_rates[local->hw.conf.channel->band] = rates;
+        sta->sta.supp_rates[local->hw.conf.channel->band] = rates;
 
         return sta;
 }
@@ -144,10 +144,10 @@ void mesh_plink_deactivate(struct sta_info *sta)
         spin_unlock_bh(&sta->lock);
 }
 
-static int mesh_plink_frame_tx(struct net_device *dev,
+static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata,
                 enum plink_frame_type action, u8 *da, __le16 llid, __le16 plid,
                 __le16 reason) {
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+        struct ieee80211_local *local = sdata->local;
         struct sk_buff *skb = dev_alloc_skb(local->hw.extra_tx_headroom + 400);
         struct ieee80211_mgmt *mgmt;
         bool include_plid = false;
@@ -163,10 +163,10 @@ static int mesh_plink_frame_tx(struct net_device *dev,
         mgmt = (struct ieee80211_mgmt *)
                 skb_put(skb, 25 + sizeof(mgmt->u.action.u.plink_action));
         memset(mgmt, 0, 25 + sizeof(mgmt->u.action.u.plink_action));
-        mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
-                                           IEEE80211_STYPE_ACTION);
+        mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
+                                          IEEE80211_STYPE_ACTION);
         memcpy(mgmt->da, da, ETH_ALEN);
-        memcpy(mgmt->sa, dev->dev_addr, ETH_ALEN);
+        memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
         /* BSSID is left zeroed, wildcard value */
         mgmt->u.action.category = PLINK_CATEGORY;
         mgmt->u.action.u.plink_action.action_code = action;
@@ -180,7 +180,7 @@ static int mesh_plink_frame_tx(struct net_device *dev,
                         /* two-byte status code followed by two-byte AID */
                         memset(pos, 0, 4);
                 }
-                mesh_mgmt_ies_add(skb, dev);
+                mesh_mgmt_ies_add(skb, sdata);
         }
 
         /* Add Peer Link Management element */
@@ -217,15 +217,14 @@ static int mesh_plink_frame_tx(struct net_device *dev,
                 memcpy(pos, &reason, 2);
         }
 
-        ieee80211_sta_tx(dev, skb, 0);
+        ieee80211_tx_skb(sdata, skb, 0);
         return 0;
 }
 
-void mesh_neighbour_update(u8 *hw_addr, u64 rates, struct net_device *dev,
+void mesh_neighbour_update(u8 *hw_addr, u64 rates, struct ieee80211_sub_if_data *sdata,
                            bool peer_accepting_plinks)
 {
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+        struct ieee80211_local *local = sdata->local;
         struct sta_info *sta;
 
         rcu_read_lock();
@@ -244,10 +243,10 @@ void mesh_neighbour_update(u8 *hw_addr, u64 rates, struct net_device *dev,
         }
 
         sta->last_rx = jiffies;
-        sta->supp_rates[local->hw.conf.channel->band] = rates;
+        sta->sta.supp_rates[local->hw.conf.channel->band] = rates;
         if (peer_accepting_plinks && sta->plink_state == PLINK_LISTEN &&
-                        sdata->u.sta.accepting_plinks &&
-                        sdata->u.sta.mshcfg.auto_open_plinks)
+                        sdata->u.mesh.accepting_plinks &&
+                        sdata->u.mesh.mshcfg.auto_open_plinks)
                 mesh_plink_open(sta);
 
         rcu_read_unlock();
@@ -257,7 +256,6 @@ static void mesh_plink_timer(unsigned long data)
 {
         struct sta_info *sta;
         __le16 llid, plid, reason;
-        struct net_device *dev = NULL;
         struct ieee80211_sub_if_data *sdata;
 #ifdef CONFIG_MAC80211_VERBOSE_MPL_DEBUG
         DECLARE_MAC_BUF(mac);
@@ -277,12 +275,11 @@ static void mesh_plink_timer(unsigned long data)
                 return;
         }
         mpl_dbg("Mesh plink timer for %s fired on state %d\n",
-                        print_mac(mac, sta->addr), sta->plink_state);
+                        print_mac(mac, sta->sta.addr), sta->plink_state);
         reason = 0;
         llid = sta->llid;
         plid = sta->plid;
         sdata = sta->sdata;
-        dev = sdata->dev;
 
         switch (sta->plink_state) {
         case PLINK_OPN_RCVD:
@@ -291,7 +288,7 @@ static void mesh_plink_timer(unsigned long data)
                 if (sta->plink_retries < dot11MeshMaxRetries(sdata)) {
                         u32 rand;
                         mpl_dbg("Mesh plink for %s (retry, timeout): %d %d\n",
-                                        print_mac(mac, sta->addr),
+                                        print_mac(mac, sta->sta.addr),
                                         sta->plink_retries, sta->plink_timeout);
                         get_random_bytes(&rand, sizeof(u32));
                         sta->plink_timeout = sta->plink_timeout +
@@ -299,7 +296,7 @@ static void mesh_plink_timer(unsigned long data)
                         ++sta->plink_retries;
                         mod_plink_timer(sta, sta->plink_timeout);
                         spin_unlock_bh(&sta->lock);
-                        mesh_plink_frame_tx(dev, PLINK_OPEN, sta->addr, llid,
+                        mesh_plink_frame_tx(sdata, PLINK_OPEN, sta->sta.addr, llid,
                                             0, 0);
                         break;
                 }
@@ -312,7 +309,7 @@ static void mesh_plink_timer(unsigned long data)
                 sta->plink_state = PLINK_HOLDING;
                 mod_plink_timer(sta, dot11MeshHoldingTimeout(sdata));
                 spin_unlock_bh(&sta->lock);
-                mesh_plink_frame_tx(dev, PLINK_CLOSE, sta->addr, llid, plid,
+                mesh_plink_frame_tx(sdata, PLINK_CLOSE, sta->sta.addr, llid, plid,
                                     reason);
                 break;
         case PLINK_HOLDING:
@@ -355,10 +352,10 @@ int mesh_plink_open(struct sta_info *sta)
         mesh_plink_timer_set(sta, dot11MeshRetryTimeout(sdata));
         spin_unlock_bh(&sta->lock);
         mpl_dbg("Mesh plink: starting establishment with %s\n",
-                print_mac(mac, sta->addr));
+                print_mac(mac, sta->sta.addr));
 
-        return mesh_plink_frame_tx(sdata->dev, PLINK_OPEN,
-                                   sta->addr, llid, 0, 0);
+        return mesh_plink_frame_tx(sdata, PLINK_OPEN,
+                                   sta->sta.addr, llid, 0, 0);
 }
 
 void mesh_plink_block(struct sta_info *sta)
@@ -382,7 +379,7 @@ int mesh_plink_close(struct sta_info *sta)
 #endif
 
         mpl_dbg("Mesh plink: closing link with %s\n",
-                        print_mac(mac, sta->addr));
+                        print_mac(mac, sta->sta.addr));
         spin_lock_bh(&sta->lock);
         sta->reason = cpu_to_le16(MESH_LINK_CANCELLED);
         reason = sta->reason;
@@ -403,15 +400,14 @@ int mesh_plink_close(struct sta_info *sta)
         llid = sta->llid;
         plid = sta->plid;
         spin_unlock_bh(&sta->lock);
-        mesh_plink_frame_tx(sta->sdata->dev, PLINK_CLOSE, sta->addr, llid,
+        mesh_plink_frame_tx(sta->sdata, PLINK_CLOSE, sta->sta.addr, llid,
                             plid, reason);
         return 0;
 }
 
-void mesh_rx_plink_frame(struct net_device *dev, struct ieee80211_mgmt *mgmt,
+void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_mgmt *mgmt,
                          size_t len, struct ieee80211_rx_status *rx_status)
 {
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         struct ieee80211_local *local = sdata->local;
         struct ieee802_11_elems elems;
         struct sta_info *sta;
@@ -425,6 +421,10 @@ void mesh_rx_plink_frame(struct net_device *dev, struct ieee80211_mgmt *mgmt,
         DECLARE_MAC_BUF(mac);
 #endif
 
+        /* need action_code, aux */
+        if (len < IEEE80211_MIN_ACTION_SIZE + 3)
+                return;
+
         if (is_multicast_ether_addr(mgmt->da)) {
                 mpl_dbg("Mesh plink: ignore frame from multicast address");
                 return;
@@ -478,7 +478,7 @@ void mesh_rx_plink_frame(struct net_device *dev, struct ieee80211_mgmt *mgmt,
 
         /* Now we will figure out the appropriate event... */
         event = PLINK_UNDEFINED;
-        if (ftype != PLINK_CLOSE && (!mesh_matches_local(&elems, dev))) {
+        if (ftype != PLINK_CLOSE && (!mesh_matches_local(&elems, sdata))) {
                 switch (ftype) {
                 case PLINK_OPEN:
                         event = OPN_RJCT;
@@ -577,9 +577,9 @@ void mesh_rx_plink_frame(struct net_device *dev, struct ieee80211_mgmt *mgmt,
                         sta->llid = llid;
                         mesh_plink_timer_set(sta, dot11MeshRetryTimeout(sdata));
                         spin_unlock_bh(&sta->lock);
-                        mesh_plink_frame_tx(dev, PLINK_OPEN, sta->addr, llid,
+                        mesh_plink_frame_tx(sdata, PLINK_OPEN, sta->sta.addr, llid,
                                             0, 0);
-                        mesh_plink_frame_tx(dev, PLINK_CONFIRM, sta->addr,
+                        mesh_plink_frame_tx(sdata, PLINK_CONFIRM, sta->sta.addr,
                                             llid, plid, 0);
                         break;
                 default:
@@ -604,7 +604,7 @@ void mesh_rx_plink_frame(struct net_device *dev, struct ieee80211_mgmt *mgmt,
 
                         llid = sta->llid;
                         spin_unlock_bh(&sta->lock);
-                        mesh_plink_frame_tx(dev, PLINK_CLOSE, sta->addr, llid,
+                        mesh_plink_frame_tx(sdata, PLINK_CLOSE, sta->sta.addr, llid,
                                             plid, reason);
                         break;
                 case OPN_ACPT:
@@ -613,7 +613,7 @@ void mesh_rx_plink_frame(struct net_device *dev, struct ieee80211_mgmt *mgmt,
                         sta->plid = plid;
                         llid = sta->llid;
                         spin_unlock_bh(&sta->lock);
-                        mesh_plink_frame_tx(dev, PLINK_CONFIRM, sta->addr, llid,
+                        mesh_plink_frame_tx(sdata, PLINK_CONFIRM, sta->sta.addr, llid,
                                             plid, 0);
                         break;
                 case CNF_ACPT:
@@ -646,13 +646,13 @@ void mesh_rx_plink_frame(struct net_device *dev, struct ieee80211_mgmt *mgmt,
 
                         llid = sta->llid;
                         spin_unlock_bh(&sta->lock);
-                        mesh_plink_frame_tx(dev, PLINK_CLOSE, sta->addr, llid,
+                        mesh_plink_frame_tx(sdata, PLINK_CLOSE, sta->sta.addr, llid,
                                             plid, reason);
                         break;
                 case OPN_ACPT:
                         llid = sta->llid;
                         spin_unlock_bh(&sta->lock);
-                        mesh_plink_frame_tx(dev, PLINK_CONFIRM, sta->addr, llid,
+                        mesh_plink_frame_tx(sdata, PLINK_CONFIRM, sta->sta.addr, llid,
                                             plid, 0);
                         break;
                 case CNF_ACPT:
@@ -661,7 +661,7 @@ void mesh_rx_plink_frame(struct net_device *dev, struct ieee80211_mgmt *mgmt,
                         mesh_plink_inc_estab_count(sdata);
                         spin_unlock_bh(&sta->lock);
                         mpl_dbg("Mesh plink with %s ESTABLISHED\n",
-                                        print_mac(mac, sta->addr));
+                                        print_mac(mac, sta->sta.addr));
                         break;
                 default:
                         spin_unlock_bh(&sta->lock);
@@ -685,7 +685,7 @@ void mesh_rx_plink_frame(struct net_device *dev, struct ieee80211_mgmt *mgmt,
 
                         llid = sta->llid;
                         spin_unlock_bh(&sta->lock);
-                        mesh_plink_frame_tx(dev, PLINK_CLOSE, sta->addr, llid,
+                        mesh_plink_frame_tx(sdata, PLINK_CLOSE, sta->sta.addr, llid,
                                             plid, reason);
                         break;
                 case OPN_ACPT:
@@ -694,8 +694,8 @@ void mesh_rx_plink_frame(struct net_device *dev, struct ieee80211_mgmt *mgmt,
                         mesh_plink_inc_estab_count(sdata);
                         spin_unlock_bh(&sta->lock);
                         mpl_dbg("Mesh plink with %s ESTABLISHED\n",
-                                        print_mac(mac, sta->addr));
-                        mesh_plink_frame_tx(dev, PLINK_CONFIRM, sta->addr, llid,
+                                        print_mac(mac, sta->sta.addr));
+                        mesh_plink_frame_tx(sdata, PLINK_CONFIRM, sta->sta.addr, llid,
                                             plid, 0);
                         break;
                 default:
@@ -714,13 +714,13 @@ void mesh_rx_plink_frame(struct net_device *dev, struct ieee80211_mgmt *mgmt,
                         llid = sta->llid;
                         mod_plink_timer(sta, dot11MeshHoldingTimeout(sdata));
                         spin_unlock_bh(&sta->lock);
-                        mesh_plink_frame_tx(dev, PLINK_CLOSE, sta->addr, llid,
+                        mesh_plink_frame_tx(sdata, PLINK_CLOSE, sta->sta.addr, llid,
                                             plid, reason);
                         break;
                 case OPN_ACPT:
                         llid = sta->llid;
                         spin_unlock_bh(&sta->lock);
-                        mesh_plink_frame_tx(dev, PLINK_CONFIRM, sta->addr, llid,
+                        mesh_plink_frame_tx(sdata, PLINK_CONFIRM, sta->sta.addr, llid,
                                             plid, 0);
                         break;
                 default:
@@ -743,8 +743,8 @@ void mesh_rx_plink_frame(struct net_device *dev, struct ieee80211_mgmt *mgmt,
                         llid = sta->llid;
                         reason = sta->reason;
                         spin_unlock_bh(&sta->lock);
-                        mesh_plink_frame_tx(dev, PLINK_CLOSE, sta->addr, llid,
-                                            plid, reason);
+                        mesh_plink_frame_tx(sdata, PLINK_CLOSE, sta->sta.addr,
+                                            llid, plid, reason);
                         break;
                 default:
                         spin_unlock_bh(&sta->lock);
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 902cac1bd246..e859a0ab6162 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -11,11 +11,6 @@
  * published by the Free Software Foundation.
  */
 
-/* TODO:
- * order BSS list by RSSI(?) ("quality of AP")
- * scan result table filtering (by capability (privacy, IBSS/BSS, WPA/RSN IE,
- *    SSID)
- */
 #include <linux/delay.h>
 #include <linux/if_ether.h>
 #include <linux/skbuff.h>
@@ -26,607 +21,184 @@
 #include <linux/etherdevice.h>
 #include <linux/rtnetlink.h>
 #include <net/iw_handler.h>
-#include <asm/types.h>
-
 #include <net/mac80211.h>
+#include <asm/unaligned.h>
+
 #include "ieee80211_i.h"
 #include "rate.h"
 #include "led.h"
-#include "mesh.h"
 
+#define IEEE80211_ASSOC_SCANS_MAX_TRIES 2
 #define IEEE80211_AUTH_TIMEOUT (HZ / 5)
 #define IEEE80211_AUTH_MAX_TRIES 3
 #define IEEE80211_ASSOC_TIMEOUT (HZ / 5)
 #define IEEE80211_ASSOC_MAX_TRIES 3
 #define IEEE80211_MONITORING_INTERVAL (2 * HZ)
-#define IEEE80211_MESH_HOUSEKEEPING_INTERVAL (60 * HZ)
 #define IEEE80211_PROBE_INTERVAL (60 * HZ)
 #define IEEE80211_RETRY_AUTH_INTERVAL (1 * HZ)
 #define IEEE80211_SCAN_INTERVAL (2 * HZ)
 #define IEEE80211_SCAN_INTERVAL_SLOW (15 * HZ)
 #define IEEE80211_IBSS_JOIN_TIMEOUT (7 * HZ)
 
-#define IEEE80211_PROBE_DELAY (HZ / 33)
-#define IEEE80211_CHANNEL_TIME (HZ / 33)
-#define IEEE80211_PASSIVE_CHANNEL_TIME (HZ / 5)
-#define IEEE80211_SCAN_RESULT_EXPIRE (10 * HZ)
 #define IEEE80211_IBSS_MERGE_INTERVAL (30 * HZ)
 #define IEEE80211_IBSS_INACTIVITY_LIMIT (60 * HZ)
-#define IEEE80211_MESH_PEER_INACTIVITY_LIMIT (1800 * HZ)
 
 #define IEEE80211_IBSS_MAX_STA_ENTRIES 128
 
 
-#define ERP_INFO_USE_PROTECTION BIT(1)
-
-/* mgmt header + 1 byte action code */
-#define IEEE80211_MIN_ACTION_SIZE (24 + 1)
-
-#define IEEE80211_ADDBA_PARAM_POLICY_MASK 0x0002
-#define IEEE80211_ADDBA_PARAM_TID_MASK 0x003C
-#define IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK 0xFFA0
-#define IEEE80211_DELBA_PARAM_TID_MASK 0xF000
-#define IEEE80211_DELBA_PARAM_INITIATOR_MASK 0x0800
-
-/* next values represent the buffer size for A-MPDU frame.
- * According to IEEE802.11n spec size varies from 8K to 64K (in powers of 2) */
-#define IEEE80211_MIN_AMPDU_BUF 0x8
-#define IEEE80211_MAX_AMPDU_BUF 0x40
-
-static void ieee80211_send_probe_req(struct net_device *dev, u8 *dst,
-                                     u8 *ssid, size_t ssid_len);
-static struct ieee80211_sta_bss *
-ieee80211_rx_bss_get(struct net_device *dev, u8 *bssid, int freq,
-                     u8 *ssid, u8 ssid_len);
-static void ieee80211_rx_bss_put(struct ieee80211_local *local,
-                                 struct ieee80211_sta_bss *bss);
-static int ieee80211_sta_find_ibss(struct net_device *dev,
-                                   struct ieee80211_if_sta *ifsta);
-static int ieee80211_sta_wep_configured(struct net_device *dev);
-static int ieee80211_sta_start_scan(struct net_device *dev,
-                                    u8 *ssid, size_t ssid_len);
-static int ieee80211_sta_config_auth(struct net_device *dev,
-                                     struct ieee80211_if_sta *ifsta);
-static void sta_rx_agg_session_timer_expired(unsigned long data);
-
-
-void ieee802_11_parse_elems(u8 *start, size_t len,
-                            struct ieee802_11_elems *elems)
-{
-        size_t left = len;
-        u8 *pos = start;
-
-        memset(elems, 0, sizeof(*elems));
-
-        while (left >= 2) {
-                u8 id, elen;
-
-                id = *pos++;
-                elen = *pos++;
-                left -= 2;
-
-                if (elen > left)
-                        return;
-
-                switch (id) {
-                case WLAN_EID_SSID:
-                        elems->ssid = pos;
-                        elems->ssid_len = elen;
-                        break;
-                case WLAN_EID_SUPP_RATES:
-                        elems->supp_rates = pos;
-                        elems->supp_rates_len = elen;
-                        break;
-                case WLAN_EID_FH_PARAMS:
-                        elems->fh_params = pos;
-                        elems->fh_params_len = elen;
-                        break;
-                case WLAN_EID_DS_PARAMS:
-                        elems->ds_params = pos;
-                        elems->ds_params_len = elen;
-                        break;
-                case WLAN_EID_CF_PARAMS:
-                        elems->cf_params = pos;
-                        elems->cf_params_len = elen;
-                        break;
-                case WLAN_EID_TIM:
-                        elems->tim = pos;
-                        elems->tim_len = elen;
-                        break;
-                case WLAN_EID_IBSS_PARAMS:
-                        elems->ibss_params = pos;
-                        elems->ibss_params_len = elen;
-                        break;
-                case WLAN_EID_CHALLENGE:
-                        elems->challenge = pos;
-                        elems->challenge_len = elen;
-                        break;
-                case WLAN_EID_WPA:
-                        if (elen >= 4 && pos[0] == 0x00 && pos[1] == 0x50 &&
-                            pos[2] == 0xf2) {
-                                /* Microsoft OUI (00:50:F2) */
-                                if (pos[3] == 1) {
-                                        /* OUI Type 1 - WPA IE */
-                                        elems->wpa = pos;
-                                        elems->wpa_len = elen;
-                                } else if (elen >= 5 && pos[3] == 2) {
-                                        if (pos[4] == 0) {
-                                                elems->wmm_info = pos;
-                                                elems->wmm_info_len = elen;
-                                        } else if (pos[4] == 1) {
-                                                elems->wmm_param = pos;
-                                                elems->wmm_param_len = elen;
-                                        }
-                                }
-                        }
-                        break;
-                case WLAN_EID_RSN:
-                        elems->rsn = pos;
-                        elems->rsn_len = elen;
-                        break;
-                case WLAN_EID_ERP_INFO:
-                        elems->erp_info = pos;
-                        elems->erp_info_len = elen;
-                        break;
-                case WLAN_EID_EXT_SUPP_RATES:
-                        elems->ext_supp_rates = pos;
-                        elems->ext_supp_rates_len = elen;
-                        break;
-                case WLAN_EID_HT_CAPABILITY:
-                        elems->ht_cap_elem = pos;
-                        elems->ht_cap_elem_len = elen;
-                        break;
-                case WLAN_EID_HT_EXTRA_INFO:
-                        elems->ht_info_elem = pos;
-                        elems->ht_info_elem_len = elen;
-                        break;
-                case WLAN_EID_MESH_ID:
-                        elems->mesh_id = pos;
-                        elems->mesh_id_len = elen;
-                        break;
-                case WLAN_EID_MESH_CONFIG:
-                        elems->mesh_config = pos;
-                        elems->mesh_config_len = elen;
-                        break;
-                case WLAN_EID_PEER_LINK:
-                        elems->peer_link = pos;
-                        elems->peer_link_len = elen;
-                        break;
-                case WLAN_EID_PREQ:
-                        elems->preq = pos;
-                        elems->preq_len = elen;
-                        break;
-                case WLAN_EID_PREP:
-                        elems->prep = pos;
-                        elems->prep_len = elen;
-                        break;
-                case WLAN_EID_PERR:
-                        elems->perr = pos;
-                        elems->perr_len = elen;
-                        break;
-                case WLAN_EID_CHANNEL_SWITCH:
-                        elems->ch_switch_elem = pos;
-                        elems->ch_switch_elem_len = elen;
-                        break;
-                case WLAN_EID_QUIET:
-                        if (!elems->quiet_elem) {
-                                elems->quiet_elem = pos;
-                                elems->quiet_elem_len = elen;
-                        }
-                        elems->num_of_quiet_elem++;
-                        break;
-                case WLAN_EID_COUNTRY:
-                        elems->country_elem = pos;
-                        elems->country_elem_len = elen;
-                        break;
-                case WLAN_EID_PWR_CONSTRAINT:
-                        elems->pwr_constr_elem = pos;
-                        elems->pwr_constr_elem_len = elen;
-                        break;
-                default:
-                        break;
-                }
-
-                left -= elen;
-                pos += elen;
-        }
-}
-
-
+/* utils */
 static int ecw2cw(int ecw)
 {
         return (1 << ecw) - 1;
 }
 
-
-static void ieee80211_sta_def_wmm_params(struct net_device *dev,
-                                         struct ieee80211_sta_bss *bss,
-                                         int ibss)
+static u8 *ieee80211_bss_get_ie(struct ieee80211_bss *bss, u8 ie)
 {
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        struct ieee80211_local *local = sdata->local;
-        int i, have_higher_than_11mbit = 0;
-
+        u8 *end, *pos;
 
-        /* cf. IEEE 802.11 9.2.12 */
-        for (i = 0; i < bss->supp_rates_len; i++)
-                if ((bss->supp_rates[i] & 0x7f) * 5 > 110)
-                        have_higher_than_11mbit = 1;
-
-        if (local->hw.conf.channel->band == IEEE80211_BAND_2GHZ &&
-            have_higher_than_11mbit)
-                sdata->flags |= IEEE80211_SDATA_OPERATING_GMODE;
-        else
-                sdata->flags &= ~IEEE80211_SDATA_OPERATING_GMODE;
-
-
-        if (local->ops->conf_tx) {
-                struct ieee80211_tx_queue_params qparam;
-
-                memset(&qparam, 0, sizeof(qparam));
-
-                qparam.aifs = 2;
-
-                if (local->hw.conf.channel->band == IEEE80211_BAND_2GHZ &&
-                    !(sdata->flags & IEEE80211_SDATA_OPERATING_GMODE))
-                        qparam.cw_min = 31;
-                else
-                        qparam.cw_min = 15;
-
-                qparam.cw_max = 1023;
-                qparam.txop = 0;
-
-                for (i = 0; i < local_to_hw(local)->queues; i++)
-                        local->ops->conf_tx(local_to_hw(local), i, &qparam);
-        }
-}
-
-static void ieee80211_sta_wmm_params(struct net_device *dev,
-                                     struct ieee80211_if_sta *ifsta,
-                                     u8 *wmm_param, size_t wmm_param_len)
-{
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        struct ieee80211_tx_queue_params params;
-        size_t left;
-        int count;
-        u8 *pos;
-
-        if (!(ifsta->flags & IEEE80211_STA_WMM_ENABLED))
-                return;
-
-        if (!wmm_param)
-                return;
-
-        if (wmm_param_len < 8 || wmm_param[5] /* version */ != 1)
-                return;
-        count = wmm_param[6] & 0x0f;
-        if (count == ifsta->wmm_last_param_set)
-                return;
-        ifsta->wmm_last_param_set = count;
-
-        pos = wmm_param + 8;
-        left = wmm_param_len - 8;
-
-        memset(&params, 0, sizeof(params));
-
-        if (!local->ops->conf_tx)
-                return;
-
-        local->wmm_acm = 0;
-        for (; left >= 4; left -= 4, pos += 4) {
-                int aci = (pos[0] >> 5) & 0x03;
-                int acm = (pos[0] >> 4) & 0x01;
-                int queue;
+        pos = bss->ies;
+        if (pos == NULL)
+                return NULL;
+        end = pos + bss->ies_len;
 
-                switch (aci) {
-                case 1:
-                        queue = 3;
-                        if (acm)
-                                local->wmm_acm |= BIT(0) | BIT(3);
-                        break;
-                case 2:
-                        queue = 1;
-                        if (acm)
-                                local->wmm_acm |= BIT(4) | BIT(5);
-                        break;
-                case 3:
-                        queue = 0;
-                        if (acm)
-                                local->wmm_acm |= BIT(6) | BIT(7);
+        while (pos + 1 < end) {
+                if (pos + 2 + pos[1] > end)
                         break;
-                case 0:
-                default:
-                        queue = 2;
-                        if (acm)
-                                local->wmm_acm |= BIT(1) | BIT(2);
-                        break;
-                }
-
-                params.aifs = pos[0] & 0x0f;
-                params.cw_max = ecw2cw((pos[1] & 0xf0) >> 4);
-                params.cw_min = ecw2cw(pos[1] & 0x0f);
-                params.txop = get_unaligned_le16(pos + 2);
-#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
-                printk(KERN_DEBUG "%s: WMM queue=%d aci=%d acm=%d aifs=%d "
-                       "cWmin=%d cWmax=%d txop=%d\n",
-                       dev->name, queue, aci, acm, params.aifs, params.cw_min,
-                       params.cw_max, params.txop);
-#endif
-                /* TODO: handle ACM (block TX, fallback to next lowest allowed
-                 * AC for now) */
-                if (local->ops->conf_tx(local_to_hw(local), queue, &params)) {
-                        printk(KERN_DEBUG "%s: failed to set TX queue "
-                               "parameters for queue %d\n", dev->name, queue);
-                }
-        }
-}
-
-static u32 ieee80211_handle_protect_preamb(struct ieee80211_sub_if_data *sdata,
-                                           bool use_protection,
-                                           bool use_short_preamble)
-{
-        struct ieee80211_bss_conf *bss_conf = &sdata->bss_conf;
-#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
-        struct ieee80211_if_sta *ifsta = &sdata->u.sta;
-        DECLARE_MAC_BUF(mac);
-#endif
-        u32 changed = 0;
-
-        if (use_protection != bss_conf->use_cts_prot) {
-#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
-                if (net_ratelimit()) {
-                        printk(KERN_DEBUG "%s: CTS protection %s (BSSID="
-                               "%s)\n",
-                               sdata->dev->name,
-                               use_protection ? "enabled" : "disabled",
-                               print_mac(mac, ifsta->bssid));
-                }
-#endif
-                bss_conf->use_cts_prot = use_protection;
-                changed |= BSS_CHANGED_ERP_CTS_PROT;
+                if (pos[0] == ie)
+                        return pos;
+                pos += 2 + pos[1];
         }
 
-        if (use_short_preamble != bss_conf->use_short_preamble) {
-#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
-                if (net_ratelimit()) {
-                        printk(KERN_DEBUG "%s: switched to %s barker preamble"
-                               " (BSSID=%s)\n",
-                               sdata->dev->name,
-                               use_short_preamble ? "short" : "long",
-                               print_mac(mac, ifsta->bssid));
-                }
-#endif
-                bss_conf->use_short_preamble = use_short_preamble;
-                changed |= BSS_CHANGED_ERP_PREAMBLE;
-        }
-
-        return changed;
+        return NULL;
 }
 
-static u32 ieee80211_handle_erp_ie(struct ieee80211_sub_if_data *sdata,
-                                   u8 erp_value)
-{
-        bool use_protection = (erp_value & WLAN_ERP_USE_PROTECTION) != 0;
-        bool use_short_preamble = (erp_value & WLAN_ERP_BARKER_PREAMBLE) == 0;
-
-        return ieee80211_handle_protect_preamb(sdata,
-                        use_protection, use_short_preamble);
-}
-
-static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,
-                                           struct ieee80211_sta_bss *bss)
+static int ieee80211_compatible_rates(struct ieee80211_bss *bss,
+                                      struct ieee80211_supported_band *sband,
+                                      u64 *rates)
 {
-        u32 changed = 0;
+        int i, j, count;
+        *rates = 0;
+        count = 0;
+        for (i = 0; i < bss->supp_rates_len; i++) {
+                int rate = (bss->supp_rates[i] & 0x7F) * 5;
 
-        if (bss->has_erp_value)
-                changed |= ieee80211_handle_erp_ie(sdata, bss->erp_value);
-        else {
-                u16 capab = bss->capability;
-                changed |= ieee80211_handle_protect_preamb(sdata, false,
-                                (capab & WLAN_CAPABILITY_SHORT_PREAMBLE) != 0);
+                for (j = 0; j < sband->n_bitrates; j++)
+                        if (sband->bitrates[j].bitrate == rate) {
+                                *rates |= BIT(j);
+                                count++;
+                                break;
+                        }
         }
 
-        return changed;
-}
-
-int ieee80211_ht_cap_ie_to_ht_info(struct ieee80211_ht_cap *ht_cap_ie,
-                                   struct ieee80211_ht_info *ht_info)
-{
-
-        if (ht_info == NULL)
-                return -EINVAL;
-
-        memset(ht_info, 0, sizeof(*ht_info));
-
-        if (ht_cap_ie) {
-                u8 ampdu_info = ht_cap_ie->ampdu_params_info;
-
-                ht_info->ht_supported = 1;
-                ht_info->cap = le16_to_cpu(ht_cap_ie->cap_info);
-                ht_info->ampdu_factor =
-                        ampdu_info & IEEE80211_HT_CAP_AMPDU_FACTOR;
-                ht_info->ampdu_density =
-                        (ampdu_info & IEEE80211_HT_CAP_AMPDU_DENSITY) >> 2;
-                memcpy(ht_info->supp_mcs_set, ht_cap_ie->supp_mcs_set, 16);
-        } else
-                ht_info->ht_supported = 0;
-
-        return 0;
+        return count;
 }
 
-int ieee80211_ht_addt_info_ie_to_ht_bss_info(
-                        struct ieee80211_ht_addt_info *ht_add_info_ie,
-                        struct ieee80211_ht_bss_info *bss_info)
+/* also used by mesh code */
+u64 ieee80211_sta_get_rates(struct ieee80211_local *local,
+                            struct ieee802_11_elems *elems,
+                            enum ieee80211_band band)
 {
-        if (bss_info == NULL)
-                return -EINVAL;
-
-        memset(bss_info, 0, sizeof(*bss_info));
-
-        if (ht_add_info_ie) {
-                u16 op_mode;
-                op_mode = le16_to_cpu(ht_add_info_ie->operation_mode);
+        struct ieee80211_supported_band *sband;
+        struct ieee80211_rate *bitrates;
+        size_t num_rates;
+        u64 supp_rates;
+        int i, j;
+        sband = local->hw.wiphy->bands[band];
 
-                bss_info->primary_channel = ht_add_info_ie->control_chan;
-                bss_info->bss_cap = ht_add_info_ie->ht_param;
-                bss_info->bss_op_mode = (u8)(op_mode & 0xff);
+        if (!sband) {
+                WARN_ON(1);
+                sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
         }
 
-        return 0;
+        bitrates = sband->bitrates;
+        num_rates = sband->n_bitrates;
+        supp_rates = 0;
+        for (i = 0; i < elems->supp_rates_len +
+                     elems->ext_supp_rates_len; i++) {
+                u8 rate = 0;
+                int own_rate;
+                if (i < elems->supp_rates_len)
+                        rate = elems->supp_rates[i];
+                else if (elems->ext_supp_rates)
+                        rate = elems->ext_supp_rates
+                                [i - elems->supp_rates_len];
+                own_rate = 5 * (rate & 0x7f);
+                for (j = 0; j < num_rates; j++)
+                        if (bitrates[j].bitrate == own_rate)
+                                supp_rates |= BIT(j);
+        }
+        return supp_rates;
 }
 
-static void ieee80211_sta_send_associnfo(struct net_device *dev,
-                                         struct ieee80211_if_sta *ifsta)
+/* frame sending functions */
+
+/* also used by scanning code */
+void ieee80211_send_probe_req(struct ieee80211_sub_if_data *sdata, u8 *dst,
+                              u8 *ssid, size_t ssid_len)
 {
-        char *buf;
-        size_t len;
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_supported_band *sband;
+        struct sk_buff *skb;
+        struct ieee80211_mgmt *mgmt;
+        u8 *pos, *supp_rates, *esupp_rates = NULL;
         int i;
-        union iwreq_data wrqu;
-
-        if (!ifsta->assocreq_ies && !ifsta->assocresp_ies)
-                return;
 
-        buf = kmalloc(50 + 2 * (ifsta->assocreq_ies_len +
-                                ifsta->assocresp_ies_len), GFP_KERNEL);
-        if (!buf)
+        skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*mgmt) + 200);
+        if (!skb) {
+                printk(KERN_DEBUG "%s: failed to allocate buffer for probe "
+                       "request\n", sdata->dev->name);
                 return;
-
-        len = sprintf(buf, "ASSOCINFO(");
-        if (ifsta->assocreq_ies) {
-                len += sprintf(buf + len, "ReqIEs=");
-                for (i = 0; i < ifsta->assocreq_ies_len; i++) {
-                        len += sprintf(buf + len, "%02x",
-                                       ifsta->assocreq_ies[i]);
-                }
         }
-        if (ifsta->assocresp_ies) {
-                if (ifsta->assocreq_ies)
-                        len += sprintf(buf + len, " ");
-                len += sprintf(buf + len, "RespIEs=");
-                for (i = 0; i < ifsta->assocresp_ies_len; i++) {
-                        len += sprintf(buf + len, "%02x",
-                                       ifsta->assocresp_ies[i]);
-                }
-        }
-        len += sprintf(buf + len, ")");
+        skb_reserve(skb, local->hw.extra_tx_headroom);
 
-        if (len > IW_CUSTOM_MAX) {
-                len = sprintf(buf, "ASSOCRESPIE=");
-                for (i = 0; i < ifsta->assocresp_ies_len; i++) {
-                        len += sprintf(buf + len, "%02x",
-                                       ifsta->assocresp_ies[i]);
-                }
+        mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
+        memset(mgmt, 0, 24);
+        mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
+                                          IEEE80211_STYPE_PROBE_REQ);
+        memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
+        if (dst) {
+                memcpy(mgmt->da, dst, ETH_ALEN);
+                memcpy(mgmt->bssid, dst, ETH_ALEN);
+        } else {
+                memset(mgmt->da, 0xff, ETH_ALEN);
+                memset(mgmt->bssid, 0xff, ETH_ALEN);
         }
+        pos = skb_put(skb, 2 + ssid_len);
+        *pos++ = WLAN_EID_SSID;
+        *pos++ = ssid_len;
+        memcpy(pos, ssid, ssid_len);
 
-        memset(&wrqu, 0, sizeof(wrqu));
-        wrqu.data.length = len;
-        wireless_send_event(dev, IWEVCUSTOM, &wrqu, buf);
-
-        kfree(buf);
-}
-
-
-static void ieee80211_set_associated(struct net_device *dev,
-                                     struct ieee80211_if_sta *ifsta,
-                                     bool assoc)
-{
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        struct ieee80211_local *local = sdata->local;
-        struct ieee80211_conf *conf = &local_to_hw(local)->conf;
-        union iwreq_data wrqu;
-        u32 changed = BSS_CHANGED_ASSOC;
-
-        if (assoc) {
-                struct ieee80211_sta_bss *bss;
-
-                ifsta->flags |= IEEE80211_STA_ASSOCIATED;
-
-                if (sdata->vif.type != IEEE80211_IF_TYPE_STA)
-                        return;
-
-                bss = ieee80211_rx_bss_get(dev, ifsta->bssid,
-                                           conf->channel->center_freq,
-                                           ifsta->ssid, ifsta->ssid_len);
-                if (bss) {
-                        /* set timing information */
-                        sdata->bss_conf.beacon_int = bss->beacon_int;
-                        sdata->bss_conf.timestamp = bss->timestamp;
-                        sdata->bss_conf.dtim_period = bss->dtim_period;
-
-                        changed |= ieee80211_handle_bss_capability(sdata, bss);
-
-                        ieee80211_rx_bss_put(local, bss);
-                }
+        supp_rates = skb_put(skb, 2);
+        supp_rates[0] = WLAN_EID_SUPP_RATES;
+        supp_rates[1] = 0;
+        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
 
-                if (conf->flags & IEEE80211_CONF_SUPPORT_HT_MODE) {
-                        changed |= BSS_CHANGED_HT;
-                        sdata->bss_conf.assoc_ht = 1;
-                        sdata->bss_conf.ht_conf = &conf->ht_conf;
-                        sdata->bss_conf.ht_bss_conf = &conf->ht_bss_conf;
+        for (i = 0; i < sband->n_bitrates; i++) {
+                struct ieee80211_rate *rate = &sband->bitrates[i];
+                if (esupp_rates) {
+                        pos = skb_put(skb, 1);
+                        esupp_rates[1]++;
+                } else if (supp_rates[1] == 8) {
+                        esupp_rates = skb_put(skb, 3);
+                        esupp_rates[0] = WLAN_EID_EXT_SUPP_RATES;
+                        esupp_rates[1] = 1;
+                        pos = &esupp_rates[2];
+                } else {
+                        pos = skb_put(skb, 1);
+                        supp_rates[1]++;
                 }
-
-                ifsta->flags |= IEEE80211_STA_PREV_BSSID_SET;
-                memcpy(ifsta->prev_bssid, sdata->u.sta.bssid, ETH_ALEN);
-                memcpy(wrqu.ap_addr.sa_data, sdata->u.sta.bssid, ETH_ALEN);
-                ieee80211_sta_send_associnfo(dev, ifsta);
-        } else {
-                netif_carrier_off(dev);
-                ieee80211_sta_tear_down_BA_sessions(dev, ifsta->bssid);
-                ifsta->flags &= ~IEEE80211_STA_ASSOCIATED;
-                changed |= ieee80211_reset_erp_info(dev);
-
-                sdata->bss_conf.assoc_ht = 0;
-                sdata->bss_conf.ht_conf = NULL;
-                sdata->bss_conf.ht_bss_conf = NULL;
-
-                memset(wrqu.ap_addr.sa_data, 0, ETH_ALEN);
+                *pos = rate->bitrate / 5;
         }
-        ifsta->last_probe = jiffies;
-        ieee80211_led_assoc(local, assoc);
-
-        sdata->bss_conf.assoc = assoc;
-        ieee80211_bss_info_change_notify(sdata, changed);
 
-        if (assoc)
-                netif_carrier_on(dev);
-
-        wrqu.ap_addr.sa_family = ARPHRD_ETHER;
-        wireless_send_event(dev, SIOCGIWAP, &wrqu, NULL);
+        ieee80211_tx_skb(sdata, skb, 0);
 }
 
-static void ieee80211_set_disassoc(struct net_device *dev,
-                                   struct ieee80211_if_sta *ifsta, int deauth)
-{
-        if (deauth)
-                ifsta->auth_tries = 0;
-        ifsta->assoc_tries = 0;
-        ieee80211_set_associated(dev, ifsta, 0);
-}
-
-void ieee80211_sta_tx(struct net_device *dev, struct sk_buff *skb,
-                      int encrypt)
-{
-        struct ieee80211_sub_if_data *sdata;
-
-        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        skb->dev = sdata->local->mdev;
-        skb_set_mac_header(skb, 0);
-        skb_set_network_header(skb, 0);
-        skb_set_transport_header(skb, 0);
-
-        skb->iif = sdata->dev->ifindex;
-        skb->do_not_encrypt = !encrypt;
-
-        dev_queue_xmit(skb);
-}
-
-
-static void ieee80211_send_auth(struct net_device *dev,
+static void ieee80211_send_auth(struct ieee80211_sub_if_data *sdata,
                                 struct ieee80211_if_sta *ifsta,
                                 int transaction, u8 *extra, size_t extra_len,
                                 int encrypt)
 {
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+        struct ieee80211_local *local = sdata->local;
         struct sk_buff *skb;
         struct ieee80211_mgmt *mgmt;
 
@@ -634,19 +206,19 @@ static void ieee80211_send_auth(struct net_device *dev,
                             sizeof(*mgmt) + 6 + extra_len);
         if (!skb) {
                 printk(KERN_DEBUG "%s: failed to allocate buffer for auth "
-                       "frame\n", dev->name);
+                       "frame\n", sdata->dev->name);
                 return;
         }
         skb_reserve(skb, local->hw.extra_tx_headroom);
 
         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24 + 6);
         memset(mgmt, 0, 24 + 6);
-        mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
-                                           IEEE80211_STYPE_AUTH);
+        mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
+                                          IEEE80211_STYPE_AUTH);
         if (encrypt)
                 mgmt->frame_control |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
         memcpy(mgmt->da, ifsta->bssid, ETH_ALEN);
-        memcpy(mgmt->sa, dev->dev_addr, ETH_ALEN);
+        memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
         memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
         mgmt->u.auth.auth_alg = cpu_to_le16(ifsta->auth_alg);
         mgmt->u.auth.auth_transaction = cpu_to_le16(transaction);
@@ -655,64 +227,19 @@ static void ieee80211_send_auth(struct net_device *dev,
         if (extra)
                 memcpy(skb_put(skb, extra_len), extra, extra_len);
 
-        ieee80211_sta_tx(dev, skb, encrypt);
-}
-
-
-static void ieee80211_authenticate(struct net_device *dev,
-                                   struct ieee80211_if_sta *ifsta)
-{
-        DECLARE_MAC_BUF(mac);
-
-        ifsta->auth_tries++;
-        if (ifsta->auth_tries > IEEE80211_AUTH_MAX_TRIES) {
-                printk(KERN_DEBUG "%s: authentication with AP %s"
-                       " timed out\n",
-                       dev->name, print_mac(mac, ifsta->bssid));
-                ifsta->state = IEEE80211_DISABLED;
-                return;
-        }
-
-        ifsta->state = IEEE80211_AUTHENTICATE;
-        printk(KERN_DEBUG "%s: authenticate with AP %s\n",
-               dev->name, print_mac(mac, ifsta->bssid));
-
-        ieee80211_send_auth(dev, ifsta, 1, NULL, 0, 0);
-
-        mod_timer(&ifsta->timer, jiffies + IEEE80211_AUTH_TIMEOUT);
+        ieee80211_tx_skb(sdata, skb, encrypt);
 }
 
-static int ieee80211_compatible_rates(struct ieee80211_sta_bss *bss,
-                                      struct ieee80211_supported_band *sband,
-                                      u64 *rates)
-{
-        int i, j, count;
-        *rates = 0;
-        count = 0;
-        for (i = 0; i < bss->supp_rates_len; i++) {
-                int rate = (bss->supp_rates[i] & 0x7F) * 5;
-
-                for (j = 0; j < sband->n_bitrates; j++)
-                        if (sband->bitrates[j].bitrate == rate) {
-                                *rates |= BIT(j);
-                                count++;
-                                break;
-                        }
-        }
-
-        return count;
-}
-
-static void ieee80211_send_assoc(struct net_device *dev,
+static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata,
                                  struct ieee80211_if_sta *ifsta)
 {
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+        struct ieee80211_local *local = sdata->local;
         struct sk_buff *skb;
         struct ieee80211_mgmt *mgmt;
-        u8 *pos, *ies;
+        u8 *pos, *ies, *ht_add_ie;
         int i, len, count, rates_len, supp_rates_len;
         u16 capab;
-        struct ieee80211_sta_bss *bss;
+        struct ieee80211_bss *bss;
         int wmm = 0;
         struct ieee80211_supported_band *sband;
         u64 rates = 0;
@@ -722,7 +249,7 @@ static void ieee80211_send_assoc(struct net_device *dev,
                             ifsta->ssid_len);
         if (!skb) {
                 printk(KERN_DEBUG "%s: failed to allocate buffer for assoc "
-                       "frame\n", dev->name);
+                       "frame\n", sdata->dev->name);
                 return;
         }
         skb_reserve(skb, local->hw.extra_tx_headroom);
@@ -738,13 +265,13 @@ static void ieee80211_send_assoc(struct net_device *dev,
                         capab |= WLAN_CAPABILITY_SHORT_PREAMBLE;
         }
 
-        bss = ieee80211_rx_bss_get(dev, ifsta->bssid,
+        bss = ieee80211_rx_bss_get(local, ifsta->bssid,
                                    local->hw.conf.channel->center_freq,
                                    ifsta->ssid, ifsta->ssid_len);
         if (bss) {
                 if (bss->capability & WLAN_CAPABILITY_PRIVACY)
                         capab |= WLAN_CAPABILITY_PRIVACY;
-                if (bss->wmm_ie)
+                if (bss->wmm_used)
                         wmm = 1;
 
                 /* get all rates supported by the device and the AP as
@@ -766,13 +293,13 @@ static void ieee80211_send_assoc(struct net_device *dev,
         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
         memset(mgmt, 0, 24);
         memcpy(mgmt->da, ifsta->bssid, ETH_ALEN);
-        memcpy(mgmt->sa, dev->dev_addr, ETH_ALEN);
+        memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
         memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
 
         if (ifsta->flags & IEEE80211_STA_PREV_BSSID_SET) {
                 skb_put(skb, 10);
-                mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
-                                                   IEEE80211_STYPE_REASSOC_REQ);
+                mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
+                                                  IEEE80211_STYPE_REASSOC_REQ);
                 mgmt->u.reassoc_req.capab_info = cpu_to_le16(capab);
                 mgmt->u.reassoc_req.listen_interval =
                                 cpu_to_le16(local->hw.conf.listen_interval);
@@ -780,8 +307,8 @@ static void ieee80211_send_assoc(struct net_device *dev,
                        ETH_ALEN);
         } else {
                 skb_put(skb, 4);
-                mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
-                                                   IEEE80211_STYPE_ASSOC_REQ);
+                mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
+                                                  IEEE80211_STYPE_ASSOC_REQ);
                 mgmt->u.assoc_req.capab_info = cpu_to_le16(capab);
                 mgmt->u.reassoc_req.listen_interval =
                                 cpu_to_le16(local->hw.conf.listen_interval);
@@ -866,9 +393,10 @@ static void ieee80211_send_assoc(struct net_device *dev,
 
         /* wmm support is a must to HT */
         if (wmm && (ifsta->flags & IEEE80211_STA_WMM_ENABLED) &&
-            sband->ht_info.ht_supported && bss->ht_add_ie) {
+            sband->ht_info.ht_supported &&
+            (ht_add_ie = ieee80211_bss_get_ie(bss, WLAN_EID_HT_EXTRA_INFO))) {
                 struct ieee80211_ht_addt_info *ht_add_info =
-                        (struct ieee80211_ht_addt_info *)bss->ht_add_ie;
+                        (struct ieee80211_ht_addt_info *)ht_add_ie;
                 u16 cap = sband->ht_info.cap;
                 __le16 tmp;
                 u32 flags = local->hw.conf.channel->flags;
@@ -907,21 +435,22 @@ static void ieee80211_send_assoc(struct net_device *dev,
         if (ifsta->assocreq_ies)
                 memcpy(ifsta->assocreq_ies, ies, ifsta->assocreq_ies_len);
 
-        ieee80211_sta_tx(dev, skb, 0);
+        ieee80211_tx_skb(sdata, skb, 0);
 }
 
 
-static void ieee80211_send_deauth(struct net_device *dev,
-                                  struct ieee80211_if_sta *ifsta, u16 reason)
+static void ieee80211_send_deauth_disassoc(struct ieee80211_sub_if_data *sdata,
+                                           u16 stype, u16 reason)
 {
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_if_sta *ifsta = &sdata->u.sta;
         struct sk_buff *skb;
         struct ieee80211_mgmt *mgmt;
 
         skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*mgmt));
         if (!skb) {
-                printk(KERN_DEBUG "%s: failed to allocate buffer for deauth "
-                       "frame\n", dev->name);
+                printk(KERN_DEBUG "%s: failed to allocate buffer for "
+                       "deauth/disassoc frame\n", sdata->dev->name);
                 return;
         }
         skb_reserve(skb, local->hw.extra_tx_headroom);
@@ -929,940 +458,561 @@ static void ieee80211_send_deauth(struct net_device *dev,
         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
         memset(mgmt, 0, 24);
         memcpy(mgmt->da, ifsta->bssid, ETH_ALEN);
-        memcpy(mgmt->sa, dev->dev_addr, ETH_ALEN);
+        memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
         memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
-        mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
-                                           IEEE80211_STYPE_DEAUTH);
+        mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT | stype);
         skb_put(skb, 2);
+        /* u.deauth.reason_code == u.disassoc.reason_code */
         mgmt->u.deauth.reason_code = cpu_to_le16(reason);
 
-        ieee80211_sta_tx(dev, skb, 0);
+        ieee80211_tx_skb(sdata, skb, 0);
 }
 
-
-static void ieee80211_send_disassoc(struct net_device *dev,
-                                    struct ieee80211_if_sta *ifsta, u16 reason)
+/* MLME */
+static void ieee80211_sta_def_wmm_params(struct ieee80211_sub_if_data *sdata,
+                                         struct ieee80211_bss *bss)
 {
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        struct sk_buff *skb;
-        struct ieee80211_mgmt *mgmt;
+        struct ieee80211_local *local = sdata->local;
+        int i, have_higher_than_11mbit = 0;
 
-        skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*mgmt));
-        if (!skb) {
-                printk(KERN_DEBUG "%s: failed to allocate buffer for disassoc "
-                       "frame\n", dev->name);
-                return;
-        }
-        skb_reserve(skb, local->hw.extra_tx_headroom);
+        /* cf. IEEE 802.11 9.2.12 */
+        for (i = 0; i < bss->supp_rates_len; i++)
+                if ((bss->supp_rates[i] & 0x7f) * 5 > 110)
+                        have_higher_than_11mbit = 1;
 
-        mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
-        memset(mgmt, 0, 24);
-        memcpy(mgmt->da, ifsta->bssid, ETH_ALEN);
-        memcpy(mgmt->sa, dev->dev_addr, ETH_ALEN);
-        memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
-        mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
-                                           IEEE80211_STYPE_DISASSOC);
-        skb_put(skb, 2);
-        mgmt->u.disassoc.reason_code = cpu_to_le16(reason);
+        if (local->hw.conf.channel->band == IEEE80211_BAND_2GHZ &&
+            have_higher_than_11mbit)
+                sdata->flags |= IEEE80211_SDATA_OPERATING_GMODE;
+        else
+                sdata->flags &= ~IEEE80211_SDATA_OPERATING_GMODE;
 
-        ieee80211_sta_tx(dev, skb, 0);
+        ieee80211_set_wmm_default(sdata);
 }
 
-
-static int ieee80211_privacy_mismatch(struct net_device *dev,
-                                      struct ieee80211_if_sta *ifsta)
+static void ieee80211_sta_wmm_params(struct ieee80211_local *local,
+                                     struct ieee80211_if_sta *ifsta,
+                                     u8 *wmm_param, size_t wmm_param_len)
 {
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        struct ieee80211_sta_bss *bss;
-        int bss_privacy;
-        int wep_privacy;
-        int privacy_invoked;
-
-        if (!ifsta || (ifsta->flags & IEEE80211_STA_MIXED_CELL))
-                return 0;
-
-        bss = ieee80211_rx_bss_get(dev, ifsta->bssid,
-                                   local->hw.conf.channel->center_freq,
-                                   ifsta->ssid, ifsta->ssid_len);
-        if (!bss)
-                return 0;
-
-        bss_privacy = !!(bss->capability & WLAN_CAPABILITY_PRIVACY);
-        wep_privacy = !!ieee80211_sta_wep_configured(dev);
-        privacy_invoked = !!(ifsta->flags & IEEE80211_STA_PRIVACY_INVOKED);
+        struct ieee80211_tx_queue_params params;
+        size_t left;
+        int count;
+        u8 *pos;
 
-        ieee80211_rx_bss_put(local, bss);
+        if (!(ifsta->flags & IEEE80211_STA_WMM_ENABLED))
+                return;
 
-        if ((bss_privacy == wep_privacy) || (bss_privacy == privacy_invoked))
-                return 0;
+        if (!wmm_param)
+                return;
 
-        return 1;
-}
+        if (wmm_param_len < 8 || wmm_param[5] /* version */ != 1)
+                return;
+        count = wmm_param[6] & 0x0f;
+        if (count == ifsta->wmm_last_param_set)
+                return;
+        ifsta->wmm_last_param_set = count;
 
+        pos = wmm_param + 8;
+        left = wmm_param_len - 8;
 
-static void ieee80211_associate(struct net_device *dev,
-                                struct ieee80211_if_sta *ifsta)
-{
-        DECLARE_MAC_BUF(mac);
+        memset(&params, 0, sizeof(params));
 
-        ifsta->assoc_tries++;
-        if (ifsta->assoc_tries > IEEE80211_ASSOC_MAX_TRIES) {
-                printk(KERN_DEBUG "%s: association with AP %s"
-                       " timed out\n",
-                       dev->name, print_mac(mac, ifsta->bssid));
-                ifsta->state = IEEE80211_DISABLED;
+        if (!local->ops->conf_tx)
                 return;
-        }
 
-        ifsta->state = IEEE80211_ASSOCIATE;
-        printk(KERN_DEBUG "%s: associate with AP %s\n",
-               dev->name, print_mac(mac, ifsta->bssid));
-        if (ieee80211_privacy_mismatch(dev, ifsta)) {
-                printk(KERN_DEBUG "%s: mismatch in privacy configuration and "
-                       "mixed-cell disabled - abort association\n", dev->name);
-                ifsta->state = IEEE80211_DISABLED;
-                return;
-        }
+        local->wmm_acm = 0;
+        for (; left >= 4; left -= 4, pos += 4) {
+                int aci = (pos[0] >> 5) & 0x03;
+                int acm = (pos[0] >> 4) & 0x01;
+                int queue;
 
-        ieee80211_send_assoc(dev, ifsta);
+                switch (aci) {
+                case 1:
+                        queue = 3;
+                        if (acm)
+                                local->wmm_acm |= BIT(0) | BIT(3);
+                        break;
+                case 2:
+                        queue = 1;
+                        if (acm)
+                                local->wmm_acm |= BIT(4) | BIT(5);
+                        break;
+                case 3:
+                        queue = 0;
+                        if (acm)
+                                local->wmm_acm |= BIT(6) | BIT(7);
+                        break;
+                case 0:
+                default:
+                        queue = 2;
+                        if (acm)
+                                local->wmm_acm |= BIT(1) | BIT(2);
+                        break;
+                }
 
-        mod_timer(&ifsta->timer, jiffies + IEEE80211_ASSOC_TIMEOUT);
+                params.aifs = pos[0] & 0x0f;
+                params.cw_max = ecw2cw((pos[1] & 0xf0) >> 4);
+                params.cw_min = ecw2cw(pos[1] & 0x0f);
+                params.txop = get_unaligned_le16(pos + 2);
+#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
+                printk(KERN_DEBUG "%s: WMM queue=%d aci=%d acm=%d aifs=%d "
+                       "cWmin=%d cWmax=%d txop=%d\n",
+                       local->mdev->name, queue, aci, acm, params.aifs, params.cw_min,
+                       params.cw_max, params.txop);
+#endif
+                /* TODO: handle ACM (block TX, fallback to next lowest allowed
+                 * AC for now) */
+                if (local->ops->conf_tx(local_to_hw(local), queue, &params)) {
+                        printk(KERN_DEBUG "%s: failed to set TX queue "
+                               "parameters for queue %d\n", local->mdev->name, queue);
+                }
+        }
 }
 
-
-static void ieee80211_associated(struct net_device *dev,
-                                 struct ieee80211_if_sta *ifsta)
+static u32 ieee80211_handle_protect_preamb(struct ieee80211_sub_if_data *sdata,
+                                           bool use_protection,
+                                           bool use_short_preamble)
 {
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        struct sta_info *sta;
-        int disassoc;
+        struct ieee80211_bss_conf *bss_conf = &sdata->bss_conf;
+#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
+        struct ieee80211_if_sta *ifsta = &sdata->u.sta;
         DECLARE_MAC_BUF(mac);
+#endif
+        u32 changed = 0;
 
-        /* TODO: start monitoring current AP signal quality and number of
-         * missed beacons. Scan other channels every now and then and search
-         * for better APs. */
-        /* TODO: remove expired BSSes */
-
-        ifsta->state = IEEE80211_ASSOCIATED;
-
-        rcu_read_lock();
-
-        sta = sta_info_get(local, ifsta->bssid);
-        if (!sta) {
-                printk(KERN_DEBUG "%s: No STA entry for own AP %s\n",
-                       dev->name, print_mac(mac, ifsta->bssid));
-                disassoc = 1;
-        } else {
-                disassoc = 0;
-                if (time_after(jiffies,
-                               sta->last_rx + IEEE80211_MONITORING_INTERVAL)) {
-                        if (ifsta->flags & IEEE80211_STA_PROBEREQ_POLL) {
-                                printk(KERN_DEBUG "%s: No ProbeResp from "
-                                       "current AP %s - assume out of "
-                                       "range\n",
-                                       dev->name, print_mac(mac, ifsta->bssid));
-                                disassoc = 1;
-                                sta_info_unlink(&sta);
-                        } else
-                                ieee80211_send_probe_req(dev, ifsta->bssid,
-                                                         local->scan_ssid,
-                                                         local->scan_ssid_len);
-                        ifsta->flags ^= IEEE80211_STA_PROBEREQ_POLL;
-                } else {
-                        ifsta->flags &= ~IEEE80211_STA_PROBEREQ_POLL;
-                        if (time_after(jiffies, ifsta->last_probe +
-                                       IEEE80211_PROBE_INTERVAL)) {
-                                ifsta->last_probe = jiffies;
-                                ieee80211_send_probe_req(dev, ifsta->bssid,
-                                                         ifsta->ssid,
-                                                         ifsta->ssid_len);
-                        }
+        if (use_protection != bss_conf->use_cts_prot) {
+#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
+                if (net_ratelimit()) {
+                        printk(KERN_DEBUG "%s: CTS protection %s (BSSID="
+                               "%s)\n",
+                               sdata->dev->name,
+                               use_protection ? "enabled" : "disabled",
+                               print_mac(mac, ifsta->bssid));
                 }
+#endif
+                bss_conf->use_cts_prot = use_protection;
+                changed |= BSS_CHANGED_ERP_CTS_PROT;
         }
 
-        rcu_read_unlock();
-
-        if (disassoc && sta)
-                sta_info_destroy(sta);
-
-        if (disassoc) {
-                ifsta->state = IEEE80211_DISABLED;
-                ieee80211_set_associated(dev, ifsta, 0);
-        } else {
-                mod_timer(&ifsta->timer, jiffies +
-                                      IEEE80211_MONITORING_INTERVAL);
+        if (use_short_preamble != bss_conf->use_short_preamble) {
+#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
+                if (net_ratelimit()) {
+                        printk(KERN_DEBUG "%s: switched to %s barker preamble"
+                               " (BSSID=%s)\n",
+                               sdata->dev->name,
+                               use_short_preamble ? "short" : "long",
+                               print_mac(mac, ifsta->bssid));
+                }
+#endif
+                bss_conf->use_short_preamble = use_short_preamble;
+                changed |= BSS_CHANGED_ERP_PREAMBLE;
         }
-}
 
+        return changed;
+}
 
-static void ieee80211_send_probe_req(struct net_device *dev, u8 *dst,
-                                     u8 *ssid, size_t ssid_len)
+static u32 ieee80211_handle_erp_ie(struct ieee80211_sub_if_data *sdata,
+                                   u8 erp_value)
 {
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        struct ieee80211_supported_band *sband;
-        struct sk_buff *skb;
-        struct ieee80211_mgmt *mgmt;
-        u8 *pos, *supp_rates, *esupp_rates = NULL;
-        int i;
-
-        skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*mgmt) + 200);
-        if (!skb) {
-                printk(KERN_DEBUG "%s: failed to allocate buffer for probe "
-                       "request\n", dev->name);
-                return;
-        }
-        skb_reserve(skb, local->hw.extra_tx_headroom);
+        bool use_protection = (erp_value & WLAN_ERP_USE_PROTECTION) != 0;
+        bool use_short_preamble = (erp_value & WLAN_ERP_BARKER_PREAMBLE) == 0;
 
-        mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
-        memset(mgmt, 0, 24);
-        mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
-                                           IEEE80211_STYPE_PROBE_REQ);
-        memcpy(mgmt->sa, dev->dev_addr, ETH_ALEN);
-        if (dst) {
-                memcpy(mgmt->da, dst, ETH_ALEN);
-                memcpy(mgmt->bssid, dst, ETH_ALEN);
-        } else {
-                memset(mgmt->da, 0xff, ETH_ALEN);
-                memset(mgmt->bssid, 0xff, ETH_ALEN);
-        }
-        pos = skb_put(skb, 2 + ssid_len);
-        *pos++ = WLAN_EID_SSID;
-        *pos++ = ssid_len;
-        memcpy(pos, ssid, ssid_len);
+        return ieee80211_handle_protect_preamb(sdata,
+                        use_protection, use_short_preamble);
+}
 
-        supp_rates = skb_put(skb, 2);
-        supp_rates[0] = WLAN_EID_SUPP_RATES;
-        supp_rates[1] = 0;
-        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
+static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,
+                                           struct ieee80211_bss *bss)
+{
+        u32 changed = 0;
 
-        for (i = 0; i < sband->n_bitrates; i++) {
-                struct ieee80211_rate *rate = &sband->bitrates[i];
-                if (esupp_rates) {
-                        pos = skb_put(skb, 1);
-                        esupp_rates[1]++;
-                } else if (supp_rates[1] == 8) {
-                        esupp_rates = skb_put(skb, 3);
-                        esupp_rates[0] = WLAN_EID_EXT_SUPP_RATES;
-                        esupp_rates[1] = 1;
-                        pos = &esupp_rates[2];
-                } else {
-                        pos = skb_put(skb, 1);
-                        supp_rates[1]++;
-                }
-                *pos = rate->bitrate / 5;
+        if (bss->has_erp_value)
+                changed |= ieee80211_handle_erp_ie(sdata, bss->erp_value);
+        else {
+                u16 capab = bss->capability;
+                changed |= ieee80211_handle_protect_preamb(sdata, false,
+                                (capab & WLAN_CAPABILITY_SHORT_PREAMBLE) != 0);
         }
 
-        ieee80211_sta_tx(dev, skb, 0);
+        return changed;
 }
 
+static void ieee80211_sta_send_apinfo(struct ieee80211_sub_if_data *sdata,
+                                        struct ieee80211_if_sta *ifsta)
+{
+        union iwreq_data wrqu;
+        memset(&wrqu, 0, sizeof(wrqu));
+        if (ifsta->flags & IEEE80211_STA_ASSOCIATED)
+                memcpy(wrqu.ap_addr.sa_data, sdata->u.sta.bssid, ETH_ALEN);
+        wrqu.ap_addr.sa_family = ARPHRD_ETHER;
+        wireless_send_event(sdata->dev, SIOCGIWAP, &wrqu, NULL);
+}
 
-static int ieee80211_sta_wep_configured(struct net_device *dev)
+static void ieee80211_sta_send_associnfo(struct ieee80211_sub_if_data *sdata,
+                                         struct ieee80211_if_sta *ifsta)
 {
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        if (!sdata || !sdata->default_key ||
-            sdata->default_key->conf.alg != ALG_WEP)
-                return 0;
-        return 1;
+        union iwreq_data wrqu;
+
+        if (ifsta->assocreq_ies) {
+                memset(&wrqu, 0, sizeof(wrqu));
+                wrqu.data.length = ifsta->assocreq_ies_len;
+                wireless_send_event(sdata->dev, IWEVASSOCREQIE, &wrqu,
+                                    ifsta->assocreq_ies);
+        }
+        if (ifsta->assocresp_ies) {
+                memset(&wrqu, 0, sizeof(wrqu));
+                wrqu.data.length = ifsta->assocresp_ies_len;
+                wireless_send_event(sdata->dev, IWEVASSOCRESPIE, &wrqu,
+                                    ifsta->assocresp_ies);
+        }
 }
 
 
-static void ieee80211_auth_completed(struct net_device *dev,
+static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
                                      struct ieee80211_if_sta *ifsta)
 {
-        printk(KERN_DEBUG "%s: authenticated\n", dev->name);
-        ifsta->flags |= IEEE80211_STA_AUTHENTICATED;
-        ieee80211_associate(dev, ifsta);
-}
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_conf *conf = &local_to_hw(local)->conf;
+        u32 changed = BSS_CHANGED_ASSOC;
 
+        struct ieee80211_bss *bss;
 
-static void ieee80211_auth_challenge(struct net_device *dev,
-                                     struct ieee80211_if_sta *ifsta,
-                                     struct ieee80211_mgmt *mgmt,
-                                     size_t len)
-{
-        u8 *pos;
-        struct ieee802_11_elems elems;
+        ifsta->flags |= IEEE80211_STA_ASSOCIATED;
 
-        pos = mgmt->u.auth.variable;
-        ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems);
-        if (!elems.challenge)
+        if (sdata->vif.type != NL80211_IFTYPE_STATION)
                 return;
-        ieee80211_send_auth(dev, ifsta, 3, elems.challenge - 2,
-                            elems.challenge_len + 2, 1);
-}
 
-static void ieee80211_send_addba_resp(struct net_device *dev, u8 *da, u16 tid,
-                                        u8 dialog_token, u16 status, u16 policy,
-                                        u16 buf_size, u16 timeout)
-{
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        struct ieee80211_if_sta *ifsta = &sdata->u.sta;
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        struct sk_buff *skb;
-        struct ieee80211_mgmt *mgmt;
-        u16 capab;
+        bss = ieee80211_rx_bss_get(local, ifsta->bssid,
+                                   conf->channel->center_freq,
+                                   ifsta->ssid, ifsta->ssid_len);
+        if (bss) {
+                /* set timing information */
+                sdata->bss_conf.beacon_int = bss->beacon_int;
+                sdata->bss_conf.timestamp = bss->timestamp;
+                sdata->bss_conf.dtim_period = bss->dtim_period;
 
-        skb = dev_alloc_skb(sizeof(*mgmt) + local->hw.extra_tx_headroom);
+                changed |= ieee80211_handle_bss_capability(sdata, bss);
 
-        if (!skb) {
-                printk(KERN_DEBUG "%s: failed to allocate buffer "
-                       "for addba resp frame\n", dev->name);
-                return;
+                ieee80211_rx_bss_put(local, bss);
         }
 
-        skb_reserve(skb, local->hw.extra_tx_headroom);
-        mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
-        memset(mgmt, 0, 24);
-        memcpy(mgmt->da, da, ETH_ALEN);
-        memcpy(mgmt->sa, dev->dev_addr, ETH_ALEN);
-        if (sdata->vif.type == IEEE80211_IF_TYPE_AP)
-                memcpy(mgmt->bssid, dev->dev_addr, ETH_ALEN);
-        else
-                memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
-        mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
-                                           IEEE80211_STYPE_ACTION);
+        if (conf->flags & IEEE80211_CONF_SUPPORT_HT_MODE) {
+                changed |= BSS_CHANGED_HT;
+                sdata->bss_conf.assoc_ht = 1;
+                sdata->bss_conf.ht_conf = &conf->ht_conf;
+                sdata->bss_conf.ht_bss_conf = &conf->ht_bss_conf;
+        }
 
-        skb_put(skb, 1 + sizeof(mgmt->u.action.u.addba_resp));
-        mgmt->u.action.category = WLAN_CATEGORY_BACK;
-        mgmt->u.action.u.addba_resp.action_code = WLAN_ACTION_ADDBA_RESP;
-        mgmt->u.action.u.addba_resp.dialog_token = dialog_token;
+        ifsta->flags |= IEEE80211_STA_PREV_BSSID_SET;
+        memcpy(ifsta->prev_bssid, sdata->u.sta.bssid, ETH_ALEN);
+        ieee80211_sta_send_associnfo(sdata, ifsta);
 
-        capab = (u16)(policy << 1);     /* bit 1 aggregation policy */
-        capab |= (u16)(tid << 2);       /* bit 5:2 TID number */
-        capab |= (u16)(buf_size << 6);  /* bit 15:6 max size of aggregation */
+        ifsta->last_probe = jiffies;
+        ieee80211_led_assoc(local, 1);
 
-        mgmt->u.action.u.addba_resp.capab = cpu_to_le16(capab);
-        mgmt->u.action.u.addba_resp.timeout = cpu_to_le16(timeout);
-        mgmt->u.action.u.addba_resp.status = cpu_to_le16(status);
+        sdata->bss_conf.assoc = 1;
+        /*
+         * For now just always ask the driver to update the basic rateset
+         * when we have associated, we aren't checking whether it actually
+         * changed or not.
+         */
+        changed |= BSS_CHANGED_BASIC_RATES;
+        ieee80211_bss_info_change_notify(sdata, changed);
 
-        ieee80211_sta_tx(dev, skb, 0);
+        netif_tx_start_all_queues(sdata->dev);
+        netif_carrier_on(sdata->dev);
 
-        return;
+        ieee80211_sta_send_apinfo(sdata, ifsta);
 }
 
-void ieee80211_send_addba_request(struct net_device *dev, const u8 *da,
-                                u16 tid, u8 dialog_token, u16 start_seq_num,
-                                u16 agg_size, u16 timeout)
+static void ieee80211_direct_probe(struct ieee80211_sub_if_data *sdata,
+                                   struct ieee80211_if_sta *ifsta)
 {
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        struct ieee80211_if_sta *ifsta = &sdata->u.sta;
-        struct sk_buff *skb;
-        struct ieee80211_mgmt *mgmt;
-        u16 capab;
-
-        skb = dev_alloc_skb(sizeof(*mgmt) + local->hw.extra_tx_headroom);
+        DECLARE_MAC_BUF(mac);
 
-        if (!skb) {
-                printk(KERN_ERR "%s: failed to allocate buffer "
-                                "for addba request frame\n", dev->name);
+        ifsta->direct_probe_tries++;
+        if (ifsta->direct_probe_tries > IEEE80211_AUTH_MAX_TRIES) {
+                printk(KERN_DEBUG "%s: direct probe to AP %s timed out\n",
+                       sdata->dev->name, print_mac(mac, ifsta->bssid));
+                ifsta->state = IEEE80211_STA_MLME_DISABLED;
                 return;
         }
-        skb_reserve(skb, local->hw.extra_tx_headroom);
-        mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
-        memset(mgmt, 0, 24);
-        memcpy(mgmt->da, da, ETH_ALEN);
-        memcpy(mgmt->sa, dev->dev_addr, ETH_ALEN);
-        if (sdata->vif.type == IEEE80211_IF_TYPE_AP)
-                memcpy(mgmt->bssid, dev->dev_addr, ETH_ALEN);
-        else
-                memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
 
-        mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
-                                        IEEE80211_STYPE_ACTION);
+        printk(KERN_DEBUG "%s: direct probe to AP %s try %d\n",
+                        sdata->dev->name, print_mac(mac, ifsta->bssid),
+                        ifsta->direct_probe_tries);
 
-        skb_put(skb, 1 + sizeof(mgmt->u.action.u.addba_req));
+        ifsta->state = IEEE80211_STA_MLME_DIRECT_PROBE;
 
-        mgmt->u.action.category = WLAN_CATEGORY_BACK;
-        mgmt->u.action.u.addba_req.action_code = WLAN_ACTION_ADDBA_REQ;
+        set_bit(IEEE80211_STA_REQ_DIRECT_PROBE, &ifsta->request);
 
-        mgmt->u.action.u.addba_req.dialog_token = dialog_token;
-        capab = (u16)(1 << 1);          /* bit 1 aggregation policy */
-        capab |= (u16)(tid << 2);       /* bit 5:2 TID number */
-        capab |= (u16)(agg_size << 6);  /* bit 15:6 max size of aggergation */
-
-        mgmt->u.action.u.addba_req.capab = cpu_to_le16(capab);
-
-        mgmt->u.action.u.addba_req.timeout = cpu_to_le16(timeout);
-        mgmt->u.action.u.addba_req.start_seq_num =
-                                        cpu_to_le16(start_seq_num << 4);
+        /* Direct probe is sent to broadcast address as some APs
+         * will not answer to direct packet in unassociated state.
+         */
+        ieee80211_send_probe_req(sdata, NULL,
+                                 ifsta->ssid, ifsta->ssid_len);
 
-        ieee80211_sta_tx(dev, skb, 0);
+        mod_timer(&ifsta->timer, jiffies + IEEE80211_AUTH_TIMEOUT);
 }
 
-static void ieee80211_sta_process_addba_request(struct net_device *dev,
-                                                struct ieee80211_mgmt *mgmt,
-                                                size_t len)
+
+static void ieee80211_authenticate(struct ieee80211_sub_if_data *sdata,
+                                   struct ieee80211_if_sta *ifsta)
 {
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        struct ieee80211_hw *hw = &local->hw;
-        struct ieee80211_conf *conf = &hw->conf;
-        struct sta_info *sta;
-        struct tid_ampdu_rx *tid_agg_rx;
-        u16 capab, tid, timeout, ba_policy, buf_size, start_seq_num, status;
-        u8 dialog_token;
-        int ret = -EOPNOTSUPP;
         DECLARE_MAC_BUF(mac);
 
-        rcu_read_lock();
-
-        sta = sta_info_get(local, mgmt->sa);
-        if (!sta) {
-                rcu_read_unlock();
+        ifsta->auth_tries++;
+        if (ifsta->auth_tries > IEEE80211_AUTH_MAX_TRIES) {
+                printk(KERN_DEBUG "%s: authentication with AP %s"
+                       " timed out\n",
+                       sdata->dev->name, print_mac(mac, ifsta->bssid));
+                ifsta->state = IEEE80211_STA_MLME_DISABLED;
                 return;
         }
 
-        /* extract session parameters from addba request frame */
-        dialog_token = mgmt->u.action.u.addba_req.dialog_token;
-        timeout = le16_to_cpu(mgmt->u.action.u.addba_req.timeout);
-        start_seq_num =
-                le16_to_cpu(mgmt->u.action.u.addba_req.start_seq_num) >> 4;
-
-        capab = le16_to_cpu(mgmt->u.action.u.addba_req.capab);
-        ba_policy = (capab & IEEE80211_ADDBA_PARAM_POLICY_MASK) >> 1;
-        tid = (capab & IEEE80211_ADDBA_PARAM_TID_MASK) >> 2;
-        buf_size = (capab & IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK) >> 6;
-
-        status = WLAN_STATUS_REQUEST_DECLINED;
-
-        /* sanity check for incoming parameters:
-         * check if configuration can support the BA policy
-         * and if buffer size does not exceeds max value */
-        if (((ba_policy != 1)
-                && (!(conf->ht_conf.cap & IEEE80211_HT_CAP_DELAY_BA)))
-                || (buf_size > IEEE80211_MAX_AMPDU_BUF)) {
-                status = WLAN_STATUS_INVALID_QOS_PARAM;
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                if (net_ratelimit())
-                        printk(KERN_DEBUG "AddBA Req with bad params from "
-                                "%s on tid %u. policy %d, buffer size %d\n",
-                                print_mac(mac, mgmt->sa), tid, ba_policy,
-                                buf_size);
-#endif /* CONFIG_MAC80211_HT_DEBUG */
-                goto end_no_lock;
-        }
-        /* determine default buffer size */
-        if (buf_size == 0) {
-                struct ieee80211_supported_band *sband;
-
-                sband = local->hw.wiphy->bands[conf->channel->band];
-                buf_size = IEEE80211_MIN_AMPDU_BUF;
-                buf_size = buf_size << sband->ht_info.ampdu_factor;
-        }
-
-
-        /* examine state machine */
-        spin_lock_bh(&sta->lock);
+        ifsta->state = IEEE80211_STA_MLME_AUTHENTICATE;
+        printk(KERN_DEBUG "%s: authenticate with AP %s\n",
+               sdata->dev->name, print_mac(mac, ifsta->bssid));
 
-        if (sta->ampdu_mlme.tid_state_rx[tid] != HT_AGG_STATE_IDLE) {
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                if (net_ratelimit())
-                        printk(KERN_DEBUG "unexpected AddBA Req from "
-                                "%s on tid %u\n",
-                                print_mac(mac, mgmt->sa), tid);
-#endif /* CONFIG_MAC80211_HT_DEBUG */
-                goto end;
-        }
+        ieee80211_send_auth(sdata, ifsta, 1, NULL, 0, 0);
 
-        /* prepare A-MPDU MLME for Rx aggregation */
-        sta->ampdu_mlme.tid_rx[tid] =
-                        kmalloc(sizeof(struct tid_ampdu_rx), GFP_ATOMIC);
-        if (!sta->ampdu_mlme.tid_rx[tid]) {
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                if (net_ratelimit())
-                        printk(KERN_ERR "allocate rx mlme to tid %d failed\n",
-                                        tid);
-#endif
-                goto end;
-        }
-        /* rx timer */
-        sta->ampdu_mlme.tid_rx[tid]->session_timer.function =
-                                sta_rx_agg_session_timer_expired;
-        sta->ampdu_mlme.tid_rx[tid]->session_timer.data =
-                                (unsigned long)&sta->timer_to_tid[tid];
-        init_timer(&sta->ampdu_mlme.tid_rx[tid]->session_timer);
-
-        tid_agg_rx = sta->ampdu_mlme.tid_rx[tid];
-
-        /* prepare reordering buffer */
-        tid_agg_rx->reorder_buf =
-                kmalloc(buf_size * sizeof(struct sk_buff *), GFP_ATOMIC);
-        if (!tid_agg_rx->reorder_buf) {
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                if (net_ratelimit())
-                        printk(KERN_ERR "can not allocate reordering buffer "
-                               "to tid %d\n", tid);
-#endif
-                kfree(sta->ampdu_mlme.tid_rx[tid]);
-                goto end;
-        }
-        memset(tid_agg_rx->reorder_buf, 0,
-                buf_size * sizeof(struct sk_buff *));
-
-        if (local->ops->ampdu_action)
-                ret = local->ops->ampdu_action(hw, IEEE80211_AMPDU_RX_START,
-                                               sta->addr, tid, &start_seq_num);
-#ifdef CONFIG_MAC80211_HT_DEBUG
-        printk(KERN_DEBUG "Rx A-MPDU request on tid %d result %d\n", tid, ret);
-#endif /* CONFIG_MAC80211_HT_DEBUG */
-
-        if (ret) {
-                kfree(tid_agg_rx->reorder_buf);
-                kfree(tid_agg_rx);
-                sta->ampdu_mlme.tid_rx[tid] = NULL;
-                goto end;
-        }
-
-        /* change state and send addba resp */
-        sta->ampdu_mlme.tid_state_rx[tid] = HT_AGG_STATE_OPERATIONAL;
-        tid_agg_rx->dialog_token = dialog_token;
-        tid_agg_rx->ssn = start_seq_num;
-        tid_agg_rx->head_seq_num = start_seq_num;
-        tid_agg_rx->buf_size = buf_size;
-        tid_agg_rx->timeout = timeout;
-        tid_agg_rx->stored_mpdu_num = 0;
-        status = WLAN_STATUS_SUCCESS;
-end:
-        spin_unlock_bh(&sta->lock);
-
-end_no_lock:
-        ieee80211_send_addba_resp(sta->sdata->dev, sta->addr, tid,
-                                  dialog_token, status, 1, buf_size, timeout);
-        rcu_read_unlock();
+        mod_timer(&ifsta->timer, jiffies + IEEE80211_AUTH_TIMEOUT);
 }
 
-static void ieee80211_sta_process_addba_resp(struct net_device *dev,
-                                             struct ieee80211_mgmt *mgmt,
-                                             size_t len)
+static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
+                                   struct ieee80211_if_sta *ifsta, bool deauth,
+                                   bool self_disconnected, u16 reason)
 {
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        struct ieee80211_hw *hw = &local->hw;
+        struct ieee80211_local *local = sdata->local;
         struct sta_info *sta;
-        u16 capab;
-        u16 tid;
-        u8 *state;
+        u32 changed = BSS_CHANGED_ASSOC;
 
         rcu_read_lock();
 
-        sta = sta_info_get(local, mgmt->sa);
+        sta = sta_info_get(local, ifsta->bssid);
         if (!sta) {
                 rcu_read_unlock();
                 return;
         }
 
-        capab = le16_to_cpu(mgmt->u.action.u.addba_resp.capab);
-        tid = (capab & IEEE80211_ADDBA_PARAM_TID_MASK) >> 2;
+        if (deauth) {
+                ifsta->direct_probe_tries = 0;
+                ifsta->auth_tries = 0;
+        }
+        ifsta->assoc_scan_tries = 0;
+        ifsta->assoc_tries = 0;
 
-        state = &sta->ampdu_mlme.tid_state_tx[tid];
+        netif_tx_stop_all_queues(sdata->dev);
+        netif_carrier_off(sdata->dev);
 
-        spin_lock_bh(&sta->lock);
+        ieee80211_sta_tear_down_BA_sessions(sdata, sta->sta.addr);
 
-        if (!(*state & HT_ADDBA_REQUESTED_MSK)) {
-                spin_unlock_bh(&sta->lock);
-                goto addba_resp_exit;
+        if (self_disconnected) {
+                if (deauth)
+                        ieee80211_send_deauth_disassoc(sdata,
+                                IEEE80211_STYPE_DEAUTH, reason);
+                else
+                        ieee80211_send_deauth_disassoc(sdata,
+                                IEEE80211_STYPE_DISASSOC, reason);
         }
 
-        if (mgmt->u.action.u.addba_resp.dialog_token !=
-                sta->ampdu_mlme.tid_tx[tid]->dialog_token) {
-                spin_unlock_bh(&sta->lock);
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                printk(KERN_DEBUG "wrong addBA response token, tid %d\n", tid);
-#endif /* CONFIG_MAC80211_HT_DEBUG */
-                goto addba_resp_exit;
-        }
+        ifsta->flags &= ~IEEE80211_STA_ASSOCIATED;
+        changed |= ieee80211_reset_erp_info(sdata);
 
-        del_timer_sync(&sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer);
-#ifdef CONFIG_MAC80211_HT_DEBUG
-        printk(KERN_DEBUG "switched off addBA timer for tid %d \n", tid);
-#endif /* CONFIG_MAC80211_HT_DEBUG */
-        if (le16_to_cpu(mgmt->u.action.u.addba_resp.status)
-                        == WLAN_STATUS_SUCCESS) {
-                *state |= HT_ADDBA_RECEIVED_MSK;
-                sta->ampdu_mlme.addba_req_num[tid] = 0;
+        if (sdata->bss_conf.assoc_ht)
+                changed |= BSS_CHANGED_HT;
 
-                if (*state == HT_AGG_STATE_OPERATIONAL)
-                        ieee80211_wake_queue(hw, sta->tid_to_tx_q[tid]);
+        sdata->bss_conf.assoc_ht = 0;
+        sdata->bss_conf.ht_conf = NULL;
+        sdata->bss_conf.ht_bss_conf = NULL;
 
-                spin_unlock_bh(&sta->lock);
-        } else {
-                sta->ampdu_mlme.addba_req_num[tid]++;
-                /* this will allow the state check in stop_BA_session */
-                *state = HT_AGG_STATE_OPERATIONAL;
-                spin_unlock_bh(&sta->lock);
-                ieee80211_stop_tx_ba_session(hw, sta->addr, tid,
-                                             WLAN_BACK_INITIATOR);
-        }
+        ieee80211_led_assoc(local, 0);
+        sdata->bss_conf.assoc = 0;
+
+        ieee80211_sta_send_apinfo(sdata, ifsta);
+
+        if (self_disconnected)
+                ifsta->state = IEEE80211_STA_MLME_DISABLED;
+
+        sta_info_unlink(&sta);
 
-addba_resp_exit:
         rcu_read_unlock();
+
+        sta_info_destroy(sta);
 }
 
-void ieee80211_send_delba(struct net_device *dev, const u8 *da, u16 tid,
-                          u16 initiator, u16 reason_code)
+static int ieee80211_sta_wep_configured(struct ieee80211_sub_if_data *sdata)
 {
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        struct ieee80211_if_sta *ifsta = &sdata->u.sta;
-        struct sk_buff *skb;
-        struct ieee80211_mgmt *mgmt;
-        u16 params;
-
-        skb = dev_alloc_skb(sizeof(*mgmt) + local->hw.extra_tx_headroom);
-
-        if (!skb) {
-                printk(KERN_ERR "%s: failed to allocate buffer "
-                                        "for delba frame\n", dev->name);
-                return;
-        }
+        if (!sdata || !sdata->default_key ||
+            sdata->default_key->conf.alg != ALG_WEP)
+                return 0;
+        return 1;
+}
 
-        skb_reserve(skb, local->hw.extra_tx_headroom);
-        mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
-        memset(mgmt, 0, 24);
-        memcpy(mgmt->da, da, ETH_ALEN);
-        memcpy(mgmt->sa, dev->dev_addr, ETH_ALEN);
-        if (sdata->vif.type == IEEE80211_IF_TYPE_AP)
-                memcpy(mgmt->bssid, dev->dev_addr, ETH_ALEN);
-        else
-                memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
-        mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
-                                        IEEE80211_STYPE_ACTION);
+static int ieee80211_privacy_mismatch(struct ieee80211_sub_if_data *sdata,
+                                      struct ieee80211_if_sta *ifsta)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_bss *bss;
+        int bss_privacy;
+        int wep_privacy;
+        int privacy_invoked;
 
-        skb_put(skb, 1 + sizeof(mgmt->u.action.u.delba));
+        if (!ifsta || (ifsta->flags & IEEE80211_STA_MIXED_CELL))
+                return 0;
 
-        mgmt->u.action.category = WLAN_CATEGORY_BACK;
-        mgmt->u.action.u.delba.action_code = WLAN_ACTION_DELBA;
-        params = (u16)(initiator << 11);        /* bit 11 initiator */
-        params |= (u16)(tid << 12);             /* bit 15:12 TID number */
+        bss = ieee80211_rx_bss_get(local, ifsta->bssid,
+                                   local->hw.conf.channel->center_freq,
+                                   ifsta->ssid, ifsta->ssid_len);
+        if (!bss)
+                return 0;
 
-        mgmt->u.action.u.delba.params = cpu_to_le16(params);
-        mgmt->u.action.u.delba.reason_code = cpu_to_le16(reason_code);
+        bss_privacy = !!(bss->capability & WLAN_CAPABILITY_PRIVACY);
+        wep_privacy = !!ieee80211_sta_wep_configured(sdata);
+        privacy_invoked = !!(ifsta->flags & IEEE80211_STA_PRIVACY_INVOKED);
 
-        ieee80211_sta_tx(dev, skb, 0);
-}
+        ieee80211_rx_bss_put(local, bss);
 
-void ieee80211_send_bar(struct net_device *dev, u8 *ra, u16 tid, u16 ssn)
-{
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        struct sk_buff *skb;
-        struct ieee80211_bar *bar;
-        u16 bar_control = 0;
+        if ((bss_privacy == wep_privacy) || (bss_privacy == privacy_invoked))
+                return 0;
 
-        skb = dev_alloc_skb(sizeof(*bar) + local->hw.extra_tx_headroom);
-        if (!skb) {
-                printk(KERN_ERR "%s: failed to allocate buffer for "
-                        "bar frame\n", dev->name);
-                return;
-        }
-        skb_reserve(skb, local->hw.extra_tx_headroom);
-        bar = (struct ieee80211_bar *)skb_put(skb, sizeof(*bar));
-        memset(bar, 0, sizeof(*bar));
-        bar->frame_control = IEEE80211_FC(IEEE80211_FTYPE_CTL,
-                                        IEEE80211_STYPE_BACK_REQ);
-        memcpy(bar->ra, ra, ETH_ALEN);
-        memcpy(bar->ta, dev->dev_addr, ETH_ALEN);
-        bar_control |= (u16)IEEE80211_BAR_CTRL_ACK_POLICY_NORMAL;
-        bar_control |= (u16)IEEE80211_BAR_CTRL_CBMTID_COMPRESSED_BA;
-        bar_control |= (u16)(tid << 12);
-        bar->control = cpu_to_le16(bar_control);
-        bar->start_seq_num = cpu_to_le16(ssn);
-
-        ieee80211_sta_tx(dev, skb, 0);
+        return 1;
 }
 
-void ieee80211_sta_stop_rx_ba_session(struct net_device *dev, u8 *ra, u16 tid,
-                                        u16 initiator, u16 reason)
+static void ieee80211_associate(struct ieee80211_sub_if_data *sdata,
+                                struct ieee80211_if_sta *ifsta)
 {
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        struct ieee80211_hw *hw = &local->hw;
-        struct sta_info *sta;
-        int ret, i;
         DECLARE_MAC_BUF(mac);
 
-        rcu_read_lock();
-
-        sta = sta_info_get(local, ra);
-        if (!sta) {
-                rcu_read_unlock();
+        ifsta->assoc_tries++;
+        if (ifsta->assoc_tries > IEEE80211_ASSOC_MAX_TRIES) {
+                printk(KERN_DEBUG "%s: association with AP %s"
+                       " timed out\n",
+                       sdata->dev->name, print_mac(mac, ifsta->bssid));
+                ifsta->state = IEEE80211_STA_MLME_DISABLED;
                 return;
         }
 
-        /* check if TID is in operational state */
-        spin_lock_bh(&sta->lock);
-        if (sta->ampdu_mlme.tid_state_rx[tid]
-                                != HT_AGG_STATE_OPERATIONAL) {
-                spin_unlock_bh(&sta->lock);
-                rcu_read_unlock();
+        ifsta->state = IEEE80211_STA_MLME_ASSOCIATE;
+        printk(KERN_DEBUG "%s: associate with AP %s\n",
+               sdata->dev->name, print_mac(mac, ifsta->bssid));
+        if (ieee80211_privacy_mismatch(sdata, ifsta)) {
+                printk(KERN_DEBUG "%s: mismatch in privacy configuration and "
+                       "mixed-cell disabled - abort association\n", sdata->dev->name);
+                ifsta->state = IEEE80211_STA_MLME_DISABLED;
                 return;
         }
-        sta->ampdu_mlme.tid_state_rx[tid] =
-                HT_AGG_STATE_REQ_STOP_BA_MSK |
-                (initiator << HT_AGG_STATE_INITIATOR_SHIFT);
-        spin_unlock_bh(&sta->lock);
-
-        /* stop HW Rx aggregation. ampdu_action existence
-         * already verified in session init so we add the BUG_ON */
-        BUG_ON(!local->ops->ampdu_action);
-
-#ifdef CONFIG_MAC80211_HT_DEBUG
-        printk(KERN_DEBUG "Rx BA session stop requested for %s tid %u\n",
-                                print_mac(mac, ra), tid);
-#endif /* CONFIG_MAC80211_HT_DEBUG */
-
-        ret = local->ops->ampdu_action(hw, IEEE80211_AMPDU_RX_STOP,
-                                        ra, tid, NULL);
-        if (ret)
-                printk(KERN_DEBUG "HW problem - can not stop rx "
-                                "aggregation for tid %d\n", tid);
-
-        /* shutdown timer has not expired */
-        if (initiator != WLAN_BACK_TIMER)
-                del_timer_sync(&sta->ampdu_mlme.tid_rx[tid]->session_timer);
-
-        /* check if this is a self generated aggregation halt */
-        if (initiator == WLAN_BACK_RECIPIENT || initiator == WLAN_BACK_TIMER)
-                ieee80211_send_delba(dev, ra, tid, 0, reason);
-
-        /* free the reordering buffer */
-        for (i = 0; i < sta->ampdu_mlme.tid_rx[tid]->buf_size; i++) {
-                if (sta->ampdu_mlme.tid_rx[tid]->reorder_buf[i]) {
-                        /* release the reordered frames */
-                        dev_kfree_skb(sta->ampdu_mlme.tid_rx[tid]->reorder_buf[i]);
-                        sta->ampdu_mlme.tid_rx[tid]->stored_mpdu_num--;
-                        sta->ampdu_mlme.tid_rx[tid]->reorder_buf[i] = NULL;
-                }
-        }
-        /* free resources */
-        kfree(sta->ampdu_mlme.tid_rx[tid]->reorder_buf);
-        kfree(sta->ampdu_mlme.tid_rx[tid]);
-        sta->ampdu_mlme.tid_rx[tid] = NULL;
-        sta->ampdu_mlme.tid_state_rx[tid] = HT_AGG_STATE_IDLE;
 
-        rcu_read_unlock();
+        ieee80211_send_assoc(sdata, ifsta);
+
+        mod_timer(&ifsta->timer, jiffies + IEEE80211_ASSOC_TIMEOUT);
 }
 
 
-static void ieee80211_sta_process_delba(struct net_device *dev,
-                        struct ieee80211_mgmt *mgmt, size_t len)
+static void ieee80211_associated(struct ieee80211_sub_if_data *sdata,
+                                 struct ieee80211_if_sta *ifsta)
 {
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+        struct ieee80211_local *local = sdata->local;
         struct sta_info *sta;
-        u16 tid, params;
-        u16 initiator;
+        int disassoc;
         DECLARE_MAC_BUF(mac);
 
-        rcu_read_lock();
-
-        sta = sta_info_get(local, mgmt->sa);
-        if (!sta) {
-                rcu_read_unlock();
-                return;
-        }
-
-        params = le16_to_cpu(mgmt->u.action.u.delba.params);
-        tid = (params & IEEE80211_DELBA_PARAM_TID_MASK) >> 12;
-        initiator = (params & IEEE80211_DELBA_PARAM_INITIATOR_MASK) >> 11;
-
-#ifdef CONFIG_MAC80211_HT_DEBUG
-        if (net_ratelimit())
-                printk(KERN_DEBUG "delba from %s (%s) tid %d reason code %d\n",
-                        print_mac(mac, mgmt->sa),
-                        initiator ? "initiator" : "recipient", tid,
-                        mgmt->u.action.u.delba.reason_code);
-#endif /* CONFIG_MAC80211_HT_DEBUG */
-
-        if (initiator == WLAN_BACK_INITIATOR)
-                ieee80211_sta_stop_rx_ba_session(dev, sta->addr, tid,
-                                                 WLAN_BACK_INITIATOR, 0);
-        else { /* WLAN_BACK_RECIPIENT */
-                spin_lock_bh(&sta->lock);
-                sta->ampdu_mlme.tid_state_tx[tid] =
-                                HT_AGG_STATE_OPERATIONAL;
-                spin_unlock_bh(&sta->lock);
-                ieee80211_stop_tx_ba_session(&local->hw, sta->addr, tid,
-                                             WLAN_BACK_RECIPIENT);
-        }
-        rcu_read_unlock();
-}
+        /* TODO: start monitoring current AP signal quality and number of
+         * missed beacons. Scan other channels every now and then and search
+         * for better APs. */
+        /* TODO: remove expired BSSes */
 
-/*
- * After sending add Block Ack request we activated a timer until
- * add Block Ack response will arrive from the recipient.
- * If this timer expires sta_addba_resp_timer_expired will be executed.
- */
-void sta_addba_resp_timer_expired(unsigned long data)
-{
-        /* not an elegant detour, but there is no choice as the timer passes
-         * only one argument, and both sta_info and TID are needed, so init
-         * flow in sta_info_create gives the TID as data, while the timer_to_id
-         * array gives the sta through container_of */
-        u16 tid = *(u8 *)data;
-        struct sta_info *temp_sta = container_of((void *)data,
-                struct sta_info, timer_to_tid[tid]);
-
-        struct ieee80211_local *local = temp_sta->local;
-        struct ieee80211_hw *hw = &local->hw;
-        struct sta_info *sta;
-        u8 *state;
+        ifsta->state = IEEE80211_STA_MLME_ASSOCIATED;
 
         rcu_read_lock();
 
-        sta = sta_info_get(local, temp_sta->addr);
+        sta = sta_info_get(local, ifsta->bssid);
         if (!sta) {
-                rcu_read_unlock();
-                return;
-        }
-
-        state = &sta->ampdu_mlme.tid_state_tx[tid];
-        /* check if the TID waits for addBA response */
-        spin_lock_bh(&sta->lock);
-        if (!(*state & HT_ADDBA_REQUESTED_MSK)) {
-                spin_unlock_bh(&sta->lock);
-                *state = HT_AGG_STATE_IDLE;
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                printk(KERN_DEBUG "timer expired on tid %d but we are not "
-                                "expecting addBA response there", tid);
-#endif
-                goto timer_expired_exit;
+                printk(KERN_DEBUG "%s: No STA entry for own AP %s\n",
+                       sdata->dev->name, print_mac(mac, ifsta->bssid));
+                disassoc = 1;
+        } else {
+                disassoc = 0;
+                if (time_after(jiffies,
+                               sta->last_rx + IEEE80211_MONITORING_INTERVAL)) {
+                        if (ifsta->flags & IEEE80211_STA_PROBEREQ_POLL) {
+                                printk(KERN_DEBUG "%s: No ProbeResp from "
+                                       "current AP %s - assume out of "
+                                       "range\n",
+                                       sdata->dev->name, print_mac(mac, ifsta->bssid));
+                                disassoc = 1;
+                        } else
+                                ieee80211_send_probe_req(sdata, ifsta->bssid,
+                                                         ifsta->ssid,
+                                                         ifsta->ssid_len);
+                        ifsta->flags ^= IEEE80211_STA_PROBEREQ_POLL;
+                } else {
+                        ifsta->flags &= ~IEEE80211_STA_PROBEREQ_POLL;
+                        if (time_after(jiffies, ifsta->last_probe +
+                                       IEEE80211_PROBE_INTERVAL)) {
+                                ifsta->last_probe = jiffies;
+                                ieee80211_send_probe_req(sdata, ifsta->bssid,
+                                                         ifsta->ssid,
+                                                         ifsta->ssid_len);
+                        }
+                }
         }
 
-#ifdef CONFIG_MAC80211_HT_DEBUG
-        printk(KERN_DEBUG "addBA response timer expired on tid %d\n", tid);
-#endif
-
-        /* go through the state check in stop_BA_session */
-        *state = HT_AGG_STATE_OPERATIONAL;
-        spin_unlock_bh(&sta->lock);
-        ieee80211_stop_tx_ba_session(hw, temp_sta->addr, tid,
-                                     WLAN_BACK_INITIATOR);
-
-timer_expired_exit:
         rcu_read_unlock();
-}
 
-/*
- * After accepting the AddBA Request we activated a timer,
- * resetting it after each frame that arrives from the originator.
- * if this timer expires ieee80211_sta_stop_rx_ba_session will be executed.
- */
-static void sta_rx_agg_session_timer_expired(unsigned long data)
-{
-        /* not an elegant detour, but there is no choice as the timer passes
-         * only one argument, and various sta_info are needed here, so init
-         * flow in sta_info_create gives the TID as data, while the timer_to_id
-         * array gives the sta through container_of */
-        u8 *ptid = (u8 *)data;
-        u8 *timer_to_id = ptid - *ptid;
-        struct sta_info *sta = container_of(timer_to_id, struct sta_info,
-                                         timer_to_tid[0]);
-
-#ifdef CONFIG_MAC80211_HT_DEBUG
-        printk(KERN_DEBUG "rx session timer expired on tid %d\n", (u16)*ptid);
-#endif
-        ieee80211_sta_stop_rx_ba_session(sta->sdata->dev, sta->addr,
-                                         (u16)*ptid, WLAN_BACK_TIMER,
-                                         WLAN_REASON_QSTA_TIMEOUT);
+        if (disassoc)
+                ieee80211_set_disassoc(sdata, ifsta, true, true,
+                                        WLAN_REASON_PREV_AUTH_NOT_VALID);
+        else
+                mod_timer(&ifsta->timer, jiffies +
+                                      IEEE80211_MONITORING_INTERVAL);
 }
 
-void ieee80211_sta_tear_down_BA_sessions(struct net_device *dev, u8 *addr)
-{
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        int i;
 
-        for (i = 0; i <  STA_TID_NUM; i++) {
-                ieee80211_stop_tx_ba_session(&local->hw, addr, i,
-                                             WLAN_BACK_INITIATOR);
-                ieee80211_sta_stop_rx_ba_session(dev, addr, i,
-                                                 WLAN_BACK_RECIPIENT,
-                                                 WLAN_REASON_QSTA_LEAVE_QBSS);
-        }
+static void ieee80211_auth_completed(struct ieee80211_sub_if_data *sdata,
+                                     struct ieee80211_if_sta *ifsta)
+{
+        printk(KERN_DEBUG "%s: authenticated\n", sdata->dev->name);
+        ifsta->flags |= IEEE80211_STA_AUTHENTICATED;
+        ieee80211_associate(sdata, ifsta);
 }
 
-static void ieee80211_send_refuse_measurement_request(struct net_device *dev,
-                                        struct ieee80211_msrment_ie *request_ie,
-                                        const u8 *da, const u8 *bssid,
-                                        u8 dialog_token)
-{
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        struct sk_buff *skb;
-        struct ieee80211_mgmt *msr_report;
 
-        skb = dev_alloc_skb(sizeof(*msr_report) + local->hw.extra_tx_headroom +
-                                sizeof(struct ieee80211_msrment_ie));
+static void ieee80211_auth_challenge(struct ieee80211_sub_if_data *sdata,
+                                     struct ieee80211_if_sta *ifsta,
+                                     struct ieee80211_mgmt *mgmt,
+                                     size_t len)
+{
+        u8 *pos;
+        struct ieee802_11_elems elems;
 
-        if (!skb) {
-                printk(KERN_ERR "%s: failed to allocate buffer for "
-                                "measurement report frame\n", dev->name);
+        pos = mgmt->u.auth.variable;
+        ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems);
+        if (!elems.challenge)
                 return;
-        }
-
-        skb_reserve(skb, local->hw.extra_tx_headroom);
-        msr_report = (struct ieee80211_mgmt *)skb_put(skb, 24);
-        memset(msr_report, 0, 24);
-        memcpy(msr_report->da, da, ETH_ALEN);
-        memcpy(msr_report->sa, dev->dev_addr, ETH_ALEN);
-        memcpy(msr_report->bssid, bssid, ETH_ALEN);
-        msr_report->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
-                                                IEEE80211_STYPE_ACTION);
-
-        skb_put(skb, 1 + sizeof(msr_report->u.action.u.measurement));
-        msr_report->u.action.category = WLAN_CATEGORY_SPECTRUM_MGMT;
-        msr_report->u.action.u.measurement.action_code =
-                                WLAN_ACTION_SPCT_MSR_RPRT;
-        msr_report->u.action.u.measurement.dialog_token = dialog_token;
-
-        msr_report->u.action.u.measurement.element_id = WLAN_EID_MEASURE_REPORT;
-        msr_report->u.action.u.measurement.length =
-                        sizeof(struct ieee80211_msrment_ie);
-
-        memset(&msr_report->u.action.u.measurement.msr_elem, 0,
-                sizeof(struct ieee80211_msrment_ie));
-        msr_report->u.action.u.measurement.msr_elem.token = request_ie->token;
-        msr_report->u.action.u.measurement.msr_elem.mode |=
-                        IEEE80211_SPCT_MSR_RPRT_MODE_REFUSED;
-        msr_report->u.action.u.measurement.msr_elem.type = request_ie->type;
-
-        ieee80211_sta_tx(dev, skb, 0);
-}
-
-static void ieee80211_sta_process_measurement_req(struct net_device *dev,
-                                                struct ieee80211_mgmt *mgmt,
-                                                size_t len)
-{
-        /*
-         * Ignoring measurement request is spec violation.
-         * Mandatory measurements must be reported optional
-         * measurements might be refused or reported incapable
-         * For now just refuse
-         * TODO: Answer basic measurement as unmeasured
-         */
-        ieee80211_send_refuse_measurement_request(dev,
-                        &mgmt->u.action.u.measurement.msr_elem,
-                        mgmt->sa, mgmt->bssid,
-                        mgmt->u.action.u.measurement.dialog_token);
+        ieee80211_send_auth(sdata, ifsta, 3, elems.challenge - 2,
+                            elems.challenge_len + 2, 1);
 }
 
-
-static void ieee80211_rx_mgmt_auth(struct net_device *dev,
+static void ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
                                    struct ieee80211_if_sta *ifsta,
                                    struct ieee80211_mgmt *mgmt,
                                    size_t len)
 {
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         u16 auth_alg, auth_transaction, status_code;
         DECLARE_MAC_BUF(mac);
 
-        if (ifsta->state != IEEE80211_AUTHENTICATE &&
-            sdata->vif.type != IEEE80211_IF_TYPE_IBSS)
+        if (ifsta->state != IEEE80211_STA_MLME_AUTHENTICATE &&
+            sdata->vif.type != NL80211_IFTYPE_ADHOC)
                 return;
 
         if (len < 24 + 6)
                 return;
 
-        if (sdata->vif.type != IEEE80211_IF_TYPE_IBSS &&
+        if (sdata->vif.type != NL80211_IFTYPE_ADHOC &&
             memcmp(ifsta->bssid, mgmt->sa, ETH_ALEN) != 0)
                 return;
 
-        if (sdata->vif.type != IEEE80211_IF_TYPE_IBSS &&
+        if (sdata->vif.type != NL80211_IFTYPE_ADHOC &&
             memcmp(ifsta->bssid, mgmt->bssid, ETH_ALEN) != 0)
                 return;
 
@@ -1870,7 +1020,7 @@ static void ieee80211_rx_mgmt_auth(struct net_device *dev,
         auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction);
         status_code = le16_to_cpu(mgmt->u.auth.status_code);
 
-        if (sdata->vif.type == IEEE80211_IF_TYPE_IBSS) {
+        if (sdata->vif.type == NL80211_IFTYPE_ADHOC) {
                 /*
                  * IEEE 802.11 standard does not require authentication in IBSS
                  * networks and most implementations do not seem to use it.
@@ -1879,7 +1029,7 @@ static void ieee80211_rx_mgmt_auth(struct net_device *dev,
                  */
                 if (auth_alg != WLAN_AUTH_OPEN || auth_transaction != 1)
                         return;
-                ieee80211_send_auth(dev, ifsta, 2, NULL, 0, 0);
+                ieee80211_send_auth(sdata, ifsta, 2, NULL, 0, 0);
         }
 
         if (auth_alg != ifsta->auth_alg ||
@@ -1912,7 +1062,7 @@ static void ieee80211_rx_mgmt_auth(struct net_device *dev,
                                     algs[pos] == 0xff)
                                         continue;
                                 if (algs[pos] == WLAN_AUTH_SHARED_KEY &&
-                                    !ieee80211_sta_wep_configured(dev))
+                                    !ieee80211_sta_wep_configured(sdata))
                                         continue;
                                 ifsta->auth_alg = algs[pos];
                                 break;
@@ -1924,19 +1074,19 @@ static void ieee80211_rx_mgmt_auth(struct net_device *dev,
         switch (ifsta->auth_alg) {
         case WLAN_AUTH_OPEN:
         case WLAN_AUTH_LEAP:
-                ieee80211_auth_completed(dev, ifsta);
+                ieee80211_auth_completed(sdata, ifsta);
                 break;
         case WLAN_AUTH_SHARED_KEY:
                 if (ifsta->auth_transaction == 4)
-                        ieee80211_auth_completed(dev, ifsta);
+                        ieee80211_auth_completed(sdata, ifsta);
                 else
-                        ieee80211_auth_challenge(dev, ifsta, mgmt, len);
+                        ieee80211_auth_challenge(sdata, ifsta, mgmt, len);
                 break;
         }
 }
 
 
-static void ieee80211_rx_mgmt_deauth(struct net_device *dev,
+static void ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata,
                                      struct ieee80211_if_sta *ifsta,
                                      struct ieee80211_mgmt *mgmt,
                                      size_t len)
@@ -1953,22 +1103,22 @@ static void ieee80211_rx_mgmt_deauth(struct net_device *dev,
         reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
 
         if (ifsta->flags & IEEE80211_STA_AUTHENTICATED)
-                printk(KERN_DEBUG "%s: deauthenticated\n", dev->name);
+                printk(KERN_DEBUG "%s: deauthenticated\n", sdata->dev->name);
 
-        if (ifsta->state == IEEE80211_AUTHENTICATE ||
-            ifsta->state == IEEE80211_ASSOCIATE ||
-            ifsta->state == IEEE80211_ASSOCIATED) {
-                ifsta->state = IEEE80211_AUTHENTICATE;
+        if (ifsta->state == IEEE80211_STA_MLME_AUTHENTICATE ||
+            ifsta->state == IEEE80211_STA_MLME_ASSOCIATE ||
+            ifsta->state == IEEE80211_STA_MLME_ASSOCIATED) {
+                ifsta->state = IEEE80211_STA_MLME_DIRECT_PROBE;
                 mod_timer(&ifsta->timer, jiffies +
                                       IEEE80211_RETRY_AUTH_INTERVAL);
         }
 
-        ieee80211_set_disassoc(dev, ifsta, 1);
+        ieee80211_set_disassoc(sdata, ifsta, true, false, 0);
         ifsta->flags &= ~IEEE80211_STA_AUTHENTICATED;
 }
 
 
-static void ieee80211_rx_mgmt_disassoc(struct net_device *dev,
+static void ieee80211_rx_mgmt_disassoc(struct ieee80211_sub_if_data *sdata,
                                        struct ieee80211_if_sta *ifsta,
                                        struct ieee80211_mgmt *mgmt,
                                        size_t len)
@@ -1985,15 +1135,15 @@ static void ieee80211_rx_mgmt_disassoc(struct net_device *dev,
         reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);
 
         if (ifsta->flags & IEEE80211_STA_ASSOCIATED)
-                printk(KERN_DEBUG "%s: disassociated\n", dev->name);
+                printk(KERN_DEBUG "%s: disassociated\n", sdata->dev->name);
 
-        if (ifsta->state == IEEE80211_ASSOCIATED) {
-                ifsta->state = IEEE80211_ASSOCIATE;
+        if (ifsta->state == IEEE80211_STA_MLME_ASSOCIATED) {
+                ifsta->state = IEEE80211_STA_MLME_ASSOCIATE;
                 mod_timer(&ifsta->timer, jiffies +
                                       IEEE80211_RETRY_AUTH_INTERVAL);
         }
 
-        ieee80211_set_disassoc(dev, ifsta, 0);
+        ieee80211_set_disassoc(sdata, ifsta, false, false, 0);
 }
 
 
@@ -2004,7 +1154,6 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
                                          int reassoc)
 {
         struct ieee80211_local *local = sdata->local;
-        struct net_device *dev = sdata->dev;
         struct ieee80211_supported_band *sband;
         struct sta_info *sta;
         u64 rates, basic_rates;
@@ -2019,7 +1168,7 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
         /* AssocResp and ReassocResp have identical structure, so process both
          * of them in this function. */
 
-        if (ifsta->state != IEEE80211_ASSOCIATE)
+        if (ifsta->state != IEEE80211_STA_MLME_ASSOCIATE)
                 return;
 
         if (len < 24 + 6)
@@ -2034,12 +1183,12 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
 
         printk(KERN_DEBUG "%s: RX %sssocResp from %s (capab=0x%x "
                "status=%d aid=%d)\n",
-               dev->name, reassoc ? "Rea" : "A", print_mac(mac, mgmt->sa),
+               sdata->dev->name, reassoc ? "Rea" : "A", print_mac(mac, mgmt->sa),
                capab_info, status_code, (u16)(aid & ~(BIT(15) | BIT(14))));
 
         if (status_code != WLAN_STATUS_SUCCESS) {
                 printk(KERN_DEBUG "%s: AP denied association (code=%d)\n",
-                       dev->name, status_code);
+                       sdata->dev->name, status_code);
                 /* if this was a reassociation, ensure we try a "full"
                  * association next time. This works around some broken APs
                  * which do not correctly reject reassociation requests. */
@@ -2049,7 +1198,7 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
 
         if ((aid & (BIT(15) | BIT(14))) != (BIT(15) | BIT(14)))
                 printk(KERN_DEBUG "%s: invalid aid value %d; bits 15:14 not "
-                       "set\n", dev->name, aid);
+                       "set\n", sdata->dev->name, aid);
         aid &= ~(BIT(15) | BIT(14));
 
         pos = mgmt->u.assoc_resp.variable;
@@ -2057,11 +1206,11 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
 
         if (!elems.supp_rates) {
                 printk(KERN_DEBUG "%s: no SuppRates element in AssocResp\n",
-                       dev->name);
+                       sdata->dev->name);
                 return;
         }
 
-        printk(KERN_DEBUG "%s: associated\n", dev->name);
+        printk(KERN_DEBUG "%s: associated\n", sdata->dev->name);
         ifsta->aid = aid;
         ifsta->ap_capab = capab_info;
 
@@ -2076,17 +1225,17 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
         /* Add STA entry for the AP */
         sta = sta_info_get(local, ifsta->bssid);
         if (!sta) {
-                struct ieee80211_sta_bss *bss;
+                struct ieee80211_bss *bss;
                 int err;
 
                 sta = sta_info_alloc(sdata, ifsta->bssid, GFP_ATOMIC);
                 if (!sta) {
                         printk(KERN_DEBUG "%s: failed to alloc STA entry for"
-                               " the AP\n", dev->name);
+                               " the AP\n", sdata->dev->name);
                         rcu_read_unlock();
                         return;
                 }
-                bss = ieee80211_rx_bss_get(dev, ifsta->bssid,
+                bss = ieee80211_rx_bss_get(local, ifsta->bssid,
                                            local->hw.conf.channel->center_freq,
                                            ifsta->ssid, ifsta->ssid_len);
                 if (bss) {
@@ -2099,7 +1248,7 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
                 err = sta_info_insert(sta);
                 if (err) {
                         printk(KERN_DEBUG "%s: failed to insert STA entry for"
-                               " the AP (error %d)\n", dev->name, err);
+                               " the AP (error %d)\n", sdata->dev->name, err);
                         rcu_read_unlock();
                         return;
                 }
@@ -2152,8 +1301,8 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
                 }
         }
 
-        sta->supp_rates[local->hw.conf.channel->band] = rates;
-        sdata->basic_rates = basic_rates;
+        sta->sta.supp_rates[local->hw.conf.channel->band] = rates;
+        sdata->bss_conf.basic_rates = basic_rates;
 
         /* cf. IEEE 802.11 9.2.12 */
         if (local->hw.conf.channel->band == IEEE80211_BAND_2GHZ &&
@@ -2167,19 +1316,19 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
                 struct ieee80211_ht_bss_info bss_info;
                 ieee80211_ht_cap_ie_to_ht_info(
                                 (struct ieee80211_ht_cap *)
-                                elems.ht_cap_elem, &sta->ht_info);
+                                elems.ht_cap_elem, &sta->sta.ht_info);
                 ieee80211_ht_addt_info_ie_to_ht_bss_info(
                                 (struct ieee80211_ht_addt_info *)
                                 elems.ht_info_elem, &bss_info);
-                ieee80211_handle_ht(local, 1, &sta->ht_info, &bss_info);
+                ieee80211_handle_ht(local, 1, &sta->sta.ht_info, &bss_info);
         }
 
-        rate_control_rate_init(sta, local);
+        rate_control_rate_init(sta);
 
         if (elems.wmm_param) {
                 set_sta_flags(sta, WLAN_STA_WME);
                 rcu_read_unlock();
-                ieee80211_sta_wmm_params(dev, ifsta, elems.wmm_param,
+                ieee80211_sta_wmm_params(local, ifsta, elems.wmm_param,
                                          elems.wmm_param_len);
         } else
                 rcu_read_unlock();
@@ -2188,234 +1337,26 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
          * ieee80211_set_associated() will tell the driver */
         bss_conf->aid = aid;
         bss_conf->assoc_capability = capab_info;
-        ieee80211_set_associated(dev, ifsta, 1);
+        ieee80211_set_associated(sdata, ifsta);
 
-        ieee80211_associated(dev, ifsta);
+        ieee80211_associated(sdata, ifsta);
 }
 
 
-/* Caller must hold local->sta_bss_lock */
-static void __ieee80211_rx_bss_hash_add(struct net_device *dev,
-                                        struct ieee80211_sta_bss *bss)
-{
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        u8 hash_idx;
-
-        if (bss_mesh_cfg(bss))
-                hash_idx = mesh_id_hash(bss_mesh_id(bss),
-                                        bss_mesh_id_len(bss));
-        else
-                hash_idx = STA_HASH(bss->bssid);
-
-        bss->hnext = local->sta_bss_hash[hash_idx];
-        local->sta_bss_hash[hash_idx] = bss;
-}
-
-
-/* Caller must hold local->sta_bss_lock */
-static void __ieee80211_rx_bss_hash_del(struct ieee80211_local *local,
-                                        struct ieee80211_sta_bss *bss)
-{
-        struct ieee80211_sta_bss *b, *prev = NULL;
-        b = local->sta_bss_hash[STA_HASH(bss->bssid)];
-        while (b) {
-                if (b == bss) {
-                        if (!prev)
-                                local->sta_bss_hash[STA_HASH(bss->bssid)] =
-                                        bss->hnext;
-                        else
-                                prev->hnext = bss->hnext;
-                        break;
-                }
-                prev = b;
-                b = b->hnext;
-        }
-}
-
-
-static struct ieee80211_sta_bss *
-ieee80211_rx_bss_add(struct net_device *dev, u8 *bssid, int freq,
-                     u8 *ssid, u8 ssid_len)
-{
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        struct ieee80211_sta_bss *bss;
-
-        bss = kzalloc(sizeof(*bss), GFP_ATOMIC);
-        if (!bss)
-                return NULL;
-        atomic_inc(&bss->users);
-        atomic_inc(&bss->users);
-        memcpy(bss->bssid, bssid, ETH_ALEN);
-        bss->freq = freq;
-        if (ssid && ssid_len <= IEEE80211_MAX_SSID_LEN) {
-                memcpy(bss->ssid, ssid, ssid_len);
-                bss->ssid_len = ssid_len;
-        }
-
-        spin_lock_bh(&local->sta_bss_lock);
-        /* TODO: order by RSSI? */
-        list_add_tail(&bss->list, &local->sta_bss_list);
-        __ieee80211_rx_bss_hash_add(dev, bss);
-        spin_unlock_bh(&local->sta_bss_lock);
-        return bss;
-}
-
-static struct ieee80211_sta_bss *
-ieee80211_rx_bss_get(struct net_device *dev, u8 *bssid, int freq,
-                     u8 *ssid, u8 ssid_len)
-{
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        struct ieee80211_sta_bss *bss;
-
-        spin_lock_bh(&local->sta_bss_lock);
-        bss = local->sta_bss_hash[STA_HASH(bssid)];
-        while (bss) {
-                if (!bss_mesh_cfg(bss) &&
-                    !memcmp(bss->bssid, bssid, ETH_ALEN) &&
-                    bss->freq == freq &&
-                    bss->ssid_len == ssid_len &&
-                    (ssid_len == 0 || !memcmp(bss->ssid, ssid, ssid_len))) {
-                        atomic_inc(&bss->users);
-                        break;
-                }
-                bss = bss->hnext;
-        }
-        spin_unlock_bh(&local->sta_bss_lock);
-        return bss;
-}
-
-#ifdef CONFIG_MAC80211_MESH
-static struct ieee80211_sta_bss *
-ieee80211_rx_mesh_bss_get(struct net_device *dev, u8 *mesh_id, int mesh_id_len,
-                          u8 *mesh_cfg, int freq)
-{
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        struct ieee80211_sta_bss *bss;
-
-        spin_lock_bh(&local->sta_bss_lock);
-        bss = local->sta_bss_hash[mesh_id_hash(mesh_id, mesh_id_len)];
-        while (bss) {
-                if (bss_mesh_cfg(bss) &&
-                    !memcmp(bss_mesh_cfg(bss), mesh_cfg, MESH_CFG_CMP_LEN) &&
-                    bss->freq == freq &&
-                    mesh_id_len == bss->mesh_id_len &&
-                    (mesh_id_len == 0 || !memcmp(bss->mesh_id, mesh_id,
-                                                 mesh_id_len))) {
-                        atomic_inc(&bss->users);
-                        break;
-                }
-                bss = bss->hnext;
-        }
-        spin_unlock_bh(&local->sta_bss_lock);
-        return bss;
-}
-
-static struct ieee80211_sta_bss *
-ieee80211_rx_mesh_bss_add(struct net_device *dev, u8 *mesh_id, int mesh_id_len,
-                          u8 *mesh_cfg, int mesh_config_len, int freq)
-{
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        struct ieee80211_sta_bss *bss;
-
-        if (mesh_config_len != MESH_CFG_LEN)
-                return NULL;
-
-        bss = kzalloc(sizeof(*bss), GFP_ATOMIC);
-        if (!bss)
-                return NULL;
-
-        bss->mesh_cfg = kmalloc(MESH_CFG_CMP_LEN, GFP_ATOMIC);
-        if (!bss->mesh_cfg) {
-                kfree(bss);
-                return NULL;
-        }
-
-        if (mesh_id_len && mesh_id_len <= IEEE80211_MAX_MESH_ID_LEN) {
-                bss->mesh_id = kmalloc(mesh_id_len, GFP_ATOMIC);
-                if (!bss->mesh_id) {
-                        kfree(bss->mesh_cfg);
-                        kfree(bss);
-                        return NULL;
-                }
-                memcpy(bss->mesh_id, mesh_id, mesh_id_len);
-        }
-
-        atomic_inc(&bss->users);
-        atomic_inc(&bss->users);
-        memcpy(bss->mesh_cfg, mesh_cfg, MESH_CFG_CMP_LEN);
-        bss->mesh_id_len = mesh_id_len;
-        bss->freq = freq;
-        spin_lock_bh(&local->sta_bss_lock);
-        /* TODO: order by RSSI? */
-        list_add_tail(&bss->list, &local->sta_bss_list);
-        __ieee80211_rx_bss_hash_add(dev, bss);
-        spin_unlock_bh(&local->sta_bss_lock);
-        return bss;
-}
-#endif
-
-static void ieee80211_rx_bss_free(struct ieee80211_sta_bss *bss)
-{
-        kfree(bss->wpa_ie);
-        kfree(bss->rsn_ie);
-        kfree(bss->wmm_ie);
-        kfree(bss->ht_ie);
-        kfree(bss->ht_add_ie);
-        kfree(bss_mesh_id(bss));
-        kfree(bss_mesh_cfg(bss));
-        kfree(bss);
-}
-
-
-static void ieee80211_rx_bss_put(struct ieee80211_local *local,
-                                 struct ieee80211_sta_bss *bss)
-{
-        local_bh_disable();
-        if (!atomic_dec_and_lock(&bss->users, &local->sta_bss_lock)) {
-                local_bh_enable();
-                return;
-        }
-
-        __ieee80211_rx_bss_hash_del(local, bss);
-        list_del(&bss->list);
-        spin_unlock_bh(&local->sta_bss_lock);
-        ieee80211_rx_bss_free(bss);
-}
-
-
-void ieee80211_rx_bss_list_init(struct ieee80211_local *local)
-{
-        spin_lock_init(&local->sta_bss_lock);
-        INIT_LIST_HEAD(&local->sta_bss_list);
-}
-
-
-void ieee80211_rx_bss_list_deinit(struct ieee80211_local *local)
-{
-        struct ieee80211_sta_bss *bss, *tmp;
-
-        list_for_each_entry_safe(bss, tmp, &local->sta_bss_list, list)
-                ieee80211_rx_bss_put(local, bss);
-}
-
-
-static int ieee80211_sta_join_ibss(struct net_device *dev,
+static int ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
                                    struct ieee80211_if_sta *ifsta,
-                                   struct ieee80211_sta_bss *bss)
+                                   struct ieee80211_bss *bss)
 {
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+        struct ieee80211_local *local = sdata->local;
         int res, rates, i, j;
         struct sk_buff *skb;
         struct ieee80211_mgmt *mgmt;
         u8 *pos;
-        struct ieee80211_sub_if_data *sdata;
         struct ieee80211_supported_band *sband;
         union iwreq_data wrqu;
 
         sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
 
-        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-
         /* Remove possible STA entries from other IBSS networks. */
         sta_info_flush_delayed(sdata);
 
@@ -2433,7 +1374,7 @@ static int ieee80211_sta_join_ibss(struct net_device *dev,
         sdata->drop_unencrypted = bss->capability &
                 WLAN_CAPABILITY_PRIVACY ? 1 : 0;
 
-        res = ieee80211_set_freq(dev, bss->freq);
+        res = ieee80211_set_freq(sdata, bss->freq);
 
         if (res)
                 return res;
@@ -2446,10 +1387,10 @@ static int ieee80211_sta_join_ibss(struct net_device *dev,
                 mgmt = (struct ieee80211_mgmt *)
                         skb_put(skb, 24 + sizeof(mgmt->u.beacon));
                 memset(mgmt, 0, 24 + sizeof(mgmt->u.beacon));
-                mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
-                                                   IEEE80211_STYPE_PROBE_RESP);
+                mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
+                                                  IEEE80211_STYPE_PROBE_RESP);
                 memset(mgmt->da, 0xff, ETH_ALEN);
-                memcpy(mgmt->sa, dev->dev_addr, ETH_ALEN);
+                memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
                 memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
                 mgmt->u.beacon.beacon_int =
                         cpu_to_le16(local->hw.conf.beacon_int);
@@ -2506,108 +1447,38 @@ static int ieee80211_sta_join_ibss(struct net_device *dev,
         }
         ifsta->supp_rates_bits[local->hw.conf.channel->band] = rates;
 
-        ieee80211_sta_def_wmm_params(dev, bss, 1);
+        ieee80211_sta_def_wmm_params(sdata, bss);
 
-        ifsta->state = IEEE80211_IBSS_JOINED;
+        ifsta->state = IEEE80211_STA_MLME_IBSS_JOINED;
         mod_timer(&ifsta->timer, jiffies + IEEE80211_IBSS_MERGE_INTERVAL);
 
+        ieee80211_led_assoc(local, true);
+
         memset(&wrqu, 0, sizeof(wrqu));
         memcpy(wrqu.ap_addr.sa_data, bss->bssid, ETH_ALEN);
-        wireless_send_event(dev, SIOCGIWAP, &wrqu, NULL);
+        wireless_send_event(sdata->dev, SIOCGIWAP, &wrqu, NULL);
 
         return res;
 }
 
-u64 ieee80211_sta_get_rates(struct ieee80211_local *local,
-                            struct ieee802_11_elems *elems,
-                            enum ieee80211_band band)
-{
-        struct ieee80211_supported_band *sband;
-        struct ieee80211_rate *bitrates;
-        size_t num_rates;
-        u64 supp_rates;
-        int i, j;
-        sband = local->hw.wiphy->bands[band];
-
-        if (!sband) {
-                WARN_ON(1);
-                sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
-        }
-
-        bitrates = sband->bitrates;
-        num_rates = sband->n_bitrates;
-        supp_rates = 0;
-        for (i = 0; i < elems->supp_rates_len +
-                     elems->ext_supp_rates_len; i++) {
-                u8 rate = 0;
-                int own_rate;
-                if (i < elems->supp_rates_len)
-                        rate = elems->supp_rates[i];
-                else if (elems->ext_supp_rates)
-                        rate = elems->ext_supp_rates
-                                [i - elems->supp_rates_len];
-                own_rate = 5 * (rate & 0x7f);
-                for (j = 0; j < num_rates; j++)
-                        if (bitrates[j].bitrate == own_rate)
-                                supp_rates |= BIT(j);
-        }
-        return supp_rates;
-}
-
-
-static void ieee80211_rx_bss_info(struct net_device *dev,
+static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
                                   struct ieee80211_mgmt *mgmt,
                                   size_t len,
                                   struct ieee80211_rx_status *rx_status,
                                   struct ieee802_11_elems *elems,
-                                  int beacon)
+                                  bool beacon)
 {
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        int freq, clen;
-        struct ieee80211_sta_bss *bss;
+        struct ieee80211_local *local = sdata->local;
+        int freq;
+        struct ieee80211_bss *bss;
         struct sta_info *sta;
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        u64 beacon_timestamp, rx_timestamp;
         struct ieee80211_channel *channel;
+        u64 beacon_timestamp, rx_timestamp;
+        u64 supp_rates = 0;
+        enum ieee80211_band band = rx_status->band;
         DECLARE_MAC_BUF(mac);
         DECLARE_MAC_BUF(mac2);
 
-        if (!beacon && memcmp(mgmt->da, dev->dev_addr, ETH_ALEN))
-                return; /* ignore ProbeResp to foreign address */
-
-        beacon_timestamp = le64_to_cpu(mgmt->u.beacon.timestamp);
-
-        if (ieee80211_vif_is_mesh(&sdata->vif) && elems->mesh_id &&
-            elems->mesh_config && mesh_matches_local(elems, dev)) {
-                u64 rates = ieee80211_sta_get_rates(local, elems,
-                                                rx_status->band);
-
-                mesh_neighbour_update(mgmt->sa, rates, dev,
-                                      mesh_peer_accepts_plinks(elems, dev));
-        }
-
-        rcu_read_lock();
-
-        if (sdata->vif.type == IEEE80211_IF_TYPE_IBSS && elems->supp_rates &&
-            memcmp(mgmt->bssid, sdata->u.sta.bssid, ETH_ALEN) == 0 &&
-            (sta = sta_info_get(local, mgmt->sa))) {
-                u64 prev_rates;
-                u64 supp_rates = ieee80211_sta_get_rates(local, elems,
-                                                        rx_status->band);
-
-                prev_rates = sta->supp_rates[rx_status->band];
-                sta->supp_rates[rx_status->band] &= supp_rates;
-                if (sta->supp_rates[rx_status->band] == 0) {
-                        /* No matching rates - this should not really happen.
-                         * Make sure that at least one rate is marked
-                         * supported to avoid issues with TX rate ctrl. */
-                        sta->supp_rates[rx_status->band] =
-                                sdata->u.sta.supp_rates_bits[rx_status->band];
-                }
-        }
-
-        rcu_read_unlock();
-
         if (elems->ds_params && elems->ds_params_len == 1)
                 freq = ieee80211_channel_to_frequency(elems->ds_params[0]);
         else
@@ -2618,215 +1489,60 @@ static void ieee80211_rx_bss_info(struct net_device *dev,
         if (!channel || channel->flags & IEEE80211_CHAN_DISABLED)
                 return;
 
-#ifdef CONFIG_MAC80211_MESH
-        if (elems->mesh_config)
-                bss = ieee80211_rx_mesh_bss_get(dev, elems->mesh_id,
-                                elems->mesh_id_len, elems->mesh_config, freq);
-        else
-#endif
-                bss = ieee80211_rx_bss_get(dev, mgmt->bssid, freq,
-                                           elems->ssid, elems->ssid_len);
-        if (!bss) {
-#ifdef CONFIG_MAC80211_MESH
-                if (elems->mesh_config)
-                        bss = ieee80211_rx_mesh_bss_add(dev, elems->mesh_id,
-                                elems->mesh_id_len, elems->mesh_config,
-                                elems->mesh_config_len, freq);
-                else
-#endif
-                        bss = ieee80211_rx_bss_add(dev, mgmt->bssid, freq,
-                                                  elems->ssid, elems->ssid_len);
-                if (!bss)
-                        return;
-        } else {
-#if 0
-                /* TODO: order by RSSI? */
-                spin_lock_bh(&local->sta_bss_lock);
-                list_move_tail(&bss->list, &local->sta_bss_list);
-                spin_unlock_bh(&local->sta_bss_lock);
-#endif
-        }
+        if (sdata->vif.type == NL80211_IFTYPE_ADHOC && elems->supp_rates &&
+            memcmp(mgmt->bssid, sdata->u.sta.bssid, ETH_ALEN) == 0) {
+                supp_rates = ieee80211_sta_get_rates(local, elems, band);
 
-        /* save the ERP value so that it is available at association time */
-        if (elems->erp_info && elems->erp_info_len >= 1) {
-                bss->erp_value = elems->erp_info[0];
-                bss->has_erp_value = 1;
-        }
-
-        if (elems->ht_cap_elem &&
-             (!bss->ht_ie || bss->ht_ie_len != elems->ht_cap_elem_len ||
-             memcmp(bss->ht_ie, elems->ht_cap_elem, elems->ht_cap_elem_len))) {
-                kfree(bss->ht_ie);
-                bss->ht_ie = kmalloc(elems->ht_cap_elem_len + 2, GFP_ATOMIC);
-                if (bss->ht_ie) {
-                        memcpy(bss->ht_ie, elems->ht_cap_elem - 2,
-                                elems->ht_cap_elem_len + 2);
-                        bss->ht_ie_len = elems->ht_cap_elem_len + 2;
-                } else
-                        bss->ht_ie_len = 0;
-        } else if (!elems->ht_cap_elem && bss->ht_ie) {
-                kfree(bss->ht_ie);
-                bss->ht_ie = NULL;
-                bss->ht_ie_len = 0;
-        }
+                rcu_read_lock();
 
-        if (elems->ht_info_elem &&
-             (!bss->ht_add_ie ||
-             bss->ht_add_ie_len != elems->ht_info_elem_len ||
-             memcmp(bss->ht_add_ie, elems->ht_info_elem,
-                        elems->ht_info_elem_len))) {
-                kfree(bss->ht_add_ie);
-                bss->ht_add_ie =
-                        kmalloc(elems->ht_info_elem_len + 2, GFP_ATOMIC);
-                if (bss->ht_add_ie) {
-                        memcpy(bss->ht_add_ie, elems->ht_info_elem - 2,
-                                elems->ht_info_elem_len + 2);
-                        bss->ht_add_ie_len = elems->ht_info_elem_len + 2;
-                } else
-                        bss->ht_add_ie_len = 0;
-        } else if (!elems->ht_info_elem && bss->ht_add_ie) {
-                kfree(bss->ht_add_ie);
-                bss->ht_add_ie = NULL;
-                bss->ht_add_ie_len = 0;
-        }
+                sta = sta_info_get(local, mgmt->sa);
+                if (sta) {
+                        u64 prev_rates;
 
-        bss->beacon_int = le16_to_cpu(mgmt->u.beacon.beacon_int);
-        bss->capability = le16_to_cpu(mgmt->u.beacon.capab_info);
+                        prev_rates = sta->sta.supp_rates[band];
+                        /* make sure mandatory rates are always added */
+                        sta->sta.supp_rates[band] = supp_rates |
+                                ieee80211_mandatory_rates(local, band);
 
-        if (elems->tim) {
-                struct ieee80211_tim_ie *tim_ie =
-                        (struct ieee80211_tim_ie *)elems->tim;
-                bss->dtim_period = tim_ie->dtim_period;
-        }
+#ifdef CONFIG_MAC80211_IBSS_DEBUG
+                        if (sta->sta.supp_rates[band] != prev_rates)
+                                printk(KERN_DEBUG "%s: updated supp_rates set "
+                                    "for %s based on beacon info (0x%llx | "
+                                    "0x%llx -> 0x%llx)\n",
+                                    sdata->dev->name,
+                                    print_mac(mac, sta->sta.addr),
+                                    (unsigned long long) prev_rates,
+                                    (unsigned long long) supp_rates,
+                                    (unsigned long long) sta->sta.supp_rates[band]);
+#endif
+                } else {
+                        ieee80211_ibss_add_sta(sdata, NULL, mgmt->bssid,
+                                               mgmt->sa, supp_rates);
+                }
 
-        /* set default value for buggy APs */
-        if (!elems->tim || bss->dtim_period == 0)
-                bss->dtim_period = 1;
-
-        bss->supp_rates_len = 0;
-        if (elems->supp_rates) {
-                clen = IEEE80211_MAX_SUPP_RATES - bss->supp_rates_len;
-                if (clen > elems->supp_rates_len)
-                        clen = elems->supp_rates_len;
-                memcpy(&bss->supp_rates[bss->supp_rates_len], elems->supp_rates,
-                       clen);
-                bss->supp_rates_len += clen;
-        }
-        if (elems->ext_supp_rates) {
-                clen = IEEE80211_MAX_SUPP_RATES - bss->supp_rates_len;
-                if (clen > elems->ext_supp_rates_len)
-                        clen = elems->ext_supp_rates_len;
-                memcpy(&bss->supp_rates[bss->supp_rates_len],
-                       elems->ext_supp_rates, clen);
-                bss->supp_rates_len += clen;
+                rcu_read_unlock();
         }
 
-        bss->band = rx_status->band;
+        bss = ieee80211_bss_info_update(local, rx_status, mgmt, len, elems,
+                                        freq, beacon);
+        if (!bss)
+                return;
 
-        bss->timestamp = beacon_timestamp;
-        bss->last_update = jiffies;
-        bss->signal = rx_status->signal;
-        bss->noise = rx_status->noise;
-        bss->qual = rx_status->qual;
-        if (!beacon && !bss->probe_resp)
-                bss->probe_resp = true;
+        /* was just updated in ieee80211_bss_info_update */
+        beacon_timestamp = bss->timestamp;
 
         /*
          * In STA mode, the remaining parameters should not be overridden
          * by beacons because they're not necessarily accurate there.
          */
-        if (sdata->vif.type != IEEE80211_IF_TYPE_IBSS &&
-            bss->probe_resp && beacon) {
+        if (sdata->vif.type != NL80211_IFTYPE_ADHOC &&
+            bss->last_probe_resp && beacon) {
                 ieee80211_rx_bss_put(local, bss);
                 return;
         }
 
-        if (elems->wpa &&
-            (!bss->wpa_ie || bss->wpa_ie_len != elems->wpa_len ||
-             memcmp(bss->wpa_ie, elems->wpa, elems->wpa_len))) {
-                kfree(bss->wpa_ie);
-                bss->wpa_ie = kmalloc(elems->wpa_len + 2, GFP_ATOMIC);
-                if (bss->wpa_ie) {
-                        memcpy(bss->wpa_ie, elems->wpa - 2, elems->wpa_len + 2);
-                        bss->wpa_ie_len = elems->wpa_len + 2;
-                } else
-                        bss->wpa_ie_len = 0;
-        } else if (!elems->wpa && bss->wpa_ie) {
-                kfree(bss->wpa_ie);
-                bss->wpa_ie = NULL;
-                bss->wpa_ie_len = 0;
-        }
-
-        if (elems->rsn &&
-            (!bss->rsn_ie || bss->rsn_ie_len != elems->rsn_len ||
-             memcmp(bss->rsn_ie, elems->rsn, elems->rsn_len))) {
-                kfree(bss->rsn_ie);
-                bss->rsn_ie = kmalloc(elems->rsn_len + 2, GFP_ATOMIC);
-                if (bss->rsn_ie) {
-                        memcpy(bss->rsn_ie, elems->rsn - 2, elems->rsn_len + 2);
-                        bss->rsn_ie_len = elems->rsn_len + 2;
-                } else
-                        bss->rsn_ie_len = 0;
-        } else if (!elems->rsn && bss->rsn_ie) {
-                kfree(bss->rsn_ie);
-                bss->rsn_ie = NULL;
-                bss->rsn_ie_len = 0;
-        }
-
-        /*
-         * Cf.
-         * http://www.wipo.int/pctdb/en/wo.jsp?wo=2007047181&IA=WO2007047181&DISPLAY=DESC
-         *
-         * quoting:
-         *
-         * In particular, "Wi-Fi CERTIFIED for WMM - Support for Multimedia
-         * Applications with Quality of Service in Wi-Fi Networks," Wi- Fi
-         * Alliance (September 1, 2004) is incorporated by reference herein.
-         * The inclusion of the WMM Parameters in probe responses and
-         * association responses is mandatory for WMM enabled networks. The
-         * inclusion of the WMM Parameters in beacons, however, is optional.
-         */
-
-        if (elems->wmm_param &&
-            (!bss->wmm_ie || bss->wmm_ie_len != elems->wmm_param_len ||
-             memcmp(bss->wmm_ie, elems->wmm_param, elems->wmm_param_len))) {
-                kfree(bss->wmm_ie);
-                bss->wmm_ie = kmalloc(elems->wmm_param_len + 2, GFP_ATOMIC);
-                if (bss->wmm_ie) {
-                        memcpy(bss->wmm_ie, elems->wmm_param - 2,
-                               elems->wmm_param_len + 2);
-                        bss->wmm_ie_len = elems->wmm_param_len + 2;
-                } else
-                        bss->wmm_ie_len = 0;
-        } else if (elems->wmm_info &&
-                    (!bss->wmm_ie || bss->wmm_ie_len != elems->wmm_info_len ||
-                     memcmp(bss->wmm_ie, elems->wmm_info,
-                                                elems->wmm_info_len))) {
-                 /* As for certain AP's Fifth bit is not set in WMM IE in
-                  * beacon frames.So while parsing the beacon frame the
-                  * wmm_info structure is used instead of wmm_param.
-                  * wmm_info structure was never used to set bss->wmm_ie.
-                  * This code fixes this problem by copying the WME
-                  * information from wmm_info to bss->wmm_ie and enabling
-                  * n-band association.
-                  */
-                kfree(bss->wmm_ie);
-                bss->wmm_ie = kmalloc(elems->wmm_info_len + 2, GFP_ATOMIC);
-                if (bss->wmm_ie) {
-                        memcpy(bss->wmm_ie, elems->wmm_info - 2,
-                               elems->wmm_info_len + 2);
-                        bss->wmm_ie_len = elems->wmm_info_len + 2;
-                } else
-                        bss->wmm_ie_len = 0;
-        } else if (!elems->wmm_param && !elems->wmm_info && bss->wmm_ie) {
-                kfree(bss->wmm_ie);
-                bss->wmm_ie = NULL;
-                bss->wmm_ie_len = 0;
-        }
-
         /* check if we need to merge IBSS */
-        if (sdata->vif.type == IEEE80211_IF_TYPE_IBSS && beacon &&
-            !local->sta_sw_scanning && !local->sta_hw_scanning &&
+        if (sdata->vif.type == NL80211_IFTYPE_ADHOC && beacon &&
             bss->capability & WLAN_CAPABILITY_IBSS &&
             bss->freq == local->oper_channel->center_freq &&
             elems->ssid_len == sdata->u.sta.ssid_len &&
@@ -2848,7 +1564,7 @@ static void ieee80211_rx_bss_info(struct net_device *dev,
                          * e.g: at 1 MBit that means mactime is 192 usec earlier
                          * (=24 bytes * 8 usecs/byte) than the beacon timestamp.
                          */
-                        int rate = local->hw.wiphy->bands[rx_status->band]->
+                        int rate = local->hw.wiphy->bands[band]->
                                         bitrates[rx_status->rate_idx].bitrate;
                         rx_timestamp = rx_status->mactime + (24 * 8 * 10 / rate);
                 } else if (local && local->ops && local->ops->get_tsf)
@@ -2871,12 +1587,12 @@ static void ieee80211_rx_bss_info(struct net_device *dev,
 #ifdef CONFIG_MAC80211_IBSS_DEBUG
                         printk(KERN_DEBUG "%s: beacon TSF higher than "
                                "local TSF - IBSS merge with BSSID %s\n",
-                               dev->name, print_mac(mac, mgmt->bssid));
+                               sdata->dev->name, print_mac(mac, mgmt->bssid));
 #endif
-                        ieee80211_sta_join_ibss(dev, &sdata->u.sta, bss);
-                        ieee80211_ibss_add_sta(dev, NULL,
+                        ieee80211_sta_join_ibss(sdata, &sdata->u.sta, bss);
+                        ieee80211_ibss_add_sta(sdata, NULL,
                                                mgmt->bssid, mgmt->sa,
-                                               BIT(rx_status->rate_idx));
+                                               supp_rates);
                 }
         }
 
@@ -2884,13 +1600,17 @@ static void ieee80211_rx_bss_info(struct net_device *dev,
 }
 
 
-static void ieee80211_rx_mgmt_probe_resp(struct net_device *dev,
+static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_sub_if_data *sdata,
                                          struct ieee80211_mgmt *mgmt,
                                          size_t len,
                                          struct ieee80211_rx_status *rx_status)
 {
         size_t baselen;
         struct ieee802_11_elems elems;
+        struct ieee80211_if_sta *ifsta = &sdata->u.sta;
+
+        if (memcmp(mgmt->da, sdata->dev->dev_addr, ETH_ALEN))
+                return; /* ignore ProbeResp to foreign address */
 
         baselen = (u8 *) mgmt->u.probe_resp.variable - (u8 *) mgmt;
         if (baselen > len)
@@ -2899,20 +1619,27 @@ static void ieee80211_rx_mgmt_probe_resp(struct net_device *dev,
         ieee802_11_parse_elems(mgmt->u.probe_resp.variable, len - baselen,
                                 &elems);
 
-        ieee80211_rx_bss_info(dev, mgmt, len, rx_status, &elems, 0);
+        ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems, false);
+
+        /* direct probe may be part of the association flow */
+        if (test_and_clear_bit(IEEE80211_STA_REQ_DIRECT_PROBE,
+                                                        &ifsta->request)) {
+                printk(KERN_DEBUG "%s direct probe responded\n",
+                       sdata->dev->name);
+                ieee80211_authenticate(sdata, ifsta);
+        }
 }
 
 
-static void ieee80211_rx_mgmt_beacon(struct net_device *dev,
+static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
                                      struct ieee80211_mgmt *mgmt,
                                      size_t len,
                                      struct ieee80211_rx_status *rx_status)
 {
-        struct ieee80211_sub_if_data *sdata;
         struct ieee80211_if_sta *ifsta;
         size_t baselen;
         struct ieee802_11_elems elems;
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+        struct ieee80211_local *local = sdata->local;
         struct ieee80211_conf *conf = &local->hw.conf;
         u32 changed = 0;
 
@@ -2923,10 +1650,9 @@ static void ieee80211_rx_mgmt_beacon(struct net_device *dev,
 
         ieee802_11_parse_elems(mgmt->u.beacon.variable, len - baselen, &elems);
 
-        ieee80211_rx_bss_info(dev, mgmt, len, rx_status, &elems, 1);
+        ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems, true);
 
-        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        if (sdata->vif.type != IEEE80211_IF_TYPE_STA)
+        if (sdata->vif.type != NL80211_IFTYPE_STATION)
                 return;
         ifsta = &sdata->u.sta;
 
@@ -2934,15 +1660,9 @@ static void ieee80211_rx_mgmt_beacon(struct net_device *dev,
             memcmp(ifsta->bssid, mgmt->bssid, ETH_ALEN) != 0)
                 return;
 
-        ieee80211_sta_wmm_params(dev, ifsta, elems.wmm_param,
+        ieee80211_sta_wmm_params(local, ifsta, elems.wmm_param,
                                  elems.wmm_param_len);
 
-        /* Do not send changes to driver if we are scanning. This removes
-         * requirement that driver's bss_info_changed function needs to be
-         * atomic. */
-        if (local->sta_sw_scanning || local->sta_hw_scanning)
-                return;
-
         if (elems.erp_info && elems.erp_info_len >= 1)
                 changed |= ieee80211_handle_erp_ie(sdata, elems.erp_info[0]);
         else {
@@ -2966,14 +1686,13 @@ static void ieee80211_rx_mgmt_beacon(struct net_device *dev,
 }
 
 
-static void ieee80211_rx_mgmt_probe_req(struct net_device *dev,
+static void ieee80211_rx_mgmt_probe_req(struct ieee80211_sub_if_data *sdata,
                                         struct ieee80211_if_sta *ifsta,
                                         struct ieee80211_mgmt *mgmt,
                                         size_t len,
                                         struct ieee80211_rx_status *rx_status)
 {
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_local *local = sdata->local;
         int tx_last_beacon;
         struct sk_buff *skb;
         struct ieee80211_mgmt *resp;
@@ -2984,8 +1703,8 @@ static void ieee80211_rx_mgmt_probe_req(struct net_device *dev,
         DECLARE_MAC_BUF(mac3);
 #endif
 
-        if (sdata->vif.type != IEEE80211_IF_TYPE_IBSS ||
-            ifsta->state != IEEE80211_IBSS_JOINED ||
+        if (sdata->vif.type != NL80211_IFTYPE_ADHOC ||
+            ifsta->state != IEEE80211_STA_MLME_IBSS_JOINED ||
             len < 24 + 2 || !ifsta->probe_resp)
                 return;
 
@@ -2997,7 +1716,7 @@ static void ieee80211_rx_mgmt_probe_req(struct net_device *dev,
 #ifdef CONFIG_MAC80211_IBSS_DEBUG
         printk(KERN_DEBUG "%s: RX ProbeReq SA=%s DA=%s BSSID="
                "%s (tx_last_beacon=%d)\n",
-               dev->name, print_mac(mac, mgmt->sa), print_mac(mac2, mgmt->da),
+               sdata->dev->name, print_mac(mac, mgmt->sa), print_mac(mac2, mgmt->da),
                print_mac(mac3, mgmt->bssid), tx_last_beacon);
 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
 
@@ -3015,7 +1734,7 @@ static void ieee80211_rx_mgmt_probe_req(struct net_device *dev,
 #ifdef CONFIG_MAC80211_IBSS_DEBUG
                 printk(KERN_DEBUG "%s: Invalid SSID IE in ProbeReq "
                        "from %s\n",
-                       dev->name, print_mac(mac, mgmt->sa));
+                       sdata->dev->name, print_mac(mac, mgmt->sa));
 #endif
                 return;
         }
@@ -3035,74 +1754,15 @@ static void ieee80211_rx_mgmt_probe_req(struct net_device *dev,
         memcpy(resp->da, mgmt->sa, ETH_ALEN);
 #ifdef CONFIG_MAC80211_IBSS_DEBUG
         printk(KERN_DEBUG "%s: Sending ProbeResp to %s\n",
-               dev->name, print_mac(mac, resp->da));
+               sdata->dev->name, print_mac(mac, resp->da));
 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
-        ieee80211_sta_tx(dev, skb, 0);
-}
-
-static void ieee80211_rx_mgmt_action(struct net_device *dev,
-                                     struct ieee80211_if_sta *ifsta,
-                                     struct ieee80211_mgmt *mgmt,
-                                     size_t len,
-                                     struct ieee80211_rx_status *rx_status)
-{
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-
-        if (len < IEEE80211_MIN_ACTION_SIZE)
-                return;
-
-        switch (mgmt->u.action.category) {
-        case WLAN_CATEGORY_SPECTRUM_MGMT:
-                if (local->hw.conf.channel->band != IEEE80211_BAND_5GHZ)
-                        break;
-                switch (mgmt->u.action.u.chan_switch.action_code) {
-                case WLAN_ACTION_SPCT_MSR_REQ:
-                        if (len < (IEEE80211_MIN_ACTION_SIZE +
-                                   sizeof(mgmt->u.action.u.measurement)))
-                                break;
-                        ieee80211_sta_process_measurement_req(dev, mgmt, len);
-                        break;
-                }
-                break;
-        case WLAN_CATEGORY_BACK:
-                switch (mgmt->u.action.u.addba_req.action_code) {
-                case WLAN_ACTION_ADDBA_REQ:
-                        if (len < (IEEE80211_MIN_ACTION_SIZE +
-                                   sizeof(mgmt->u.action.u.addba_req)))
-                                break;
-                        ieee80211_sta_process_addba_request(dev, mgmt, len);
-                        break;
-                case WLAN_ACTION_ADDBA_RESP:
-                        if (len < (IEEE80211_MIN_ACTION_SIZE +
-                                   sizeof(mgmt->u.action.u.addba_resp)))
-                                break;
-                        ieee80211_sta_process_addba_resp(dev, mgmt, len);
-                        break;
-                case WLAN_ACTION_DELBA:
-                        if (len < (IEEE80211_MIN_ACTION_SIZE +
-                                   sizeof(mgmt->u.action.u.delba)))
-                                break;
-                        ieee80211_sta_process_delba(dev, mgmt, len);
-                        break;
-                }
-                break;
-        case PLINK_CATEGORY:
-                if (ieee80211_vif_is_mesh(&sdata->vif))
-                        mesh_rx_plink_frame(dev, mgmt, len, rx_status);
-                break;
-        case MESH_PATH_SEL_CATEGORY:
-                if (ieee80211_vif_is_mesh(&sdata->vif))
-                        mesh_rx_path_sel_frame(dev, mgmt, len);
-                break;
-        }
+        ieee80211_tx_skb(sdata, skb, 0);
 }
 
-void ieee80211_sta_rx_mgmt(struct net_device *dev, struct sk_buff *skb,
+void ieee80211_sta_rx_mgmt(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb,
                            struct ieee80211_rx_status *rx_status)
 {
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        struct ieee80211_sub_if_data *sdata;
+        struct ieee80211_local *local = sdata->local;
         struct ieee80211_if_sta *ifsta;
         struct ieee80211_mgmt *mgmt;
         u16 fc;
@@ -3110,7 +1770,6 @@ void ieee80211_sta_rx_mgmt(struct net_device *dev, struct sk_buff *skb,
         if (skb->len < 24)
                 goto fail;
 
-        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         ifsta = &sdata->u.sta;
 
         mgmt = (struct ieee80211_mgmt *) skb->data;
@@ -3120,7 +1779,6 @@ void ieee80211_sta_rx_mgmt(struct net_device *dev, struct sk_buff *skb,
         case IEEE80211_STYPE_PROBE_REQ:
         case IEEE80211_STYPE_PROBE_RESP:
         case IEEE80211_STYPE_BEACON:
-        case IEEE80211_STYPE_ACTION:
                 memcpy(skb->cb, rx_status, sizeof(*rx_status));
         case IEEE80211_STYPE_AUTH:
         case IEEE80211_STYPE_ASSOC_RESP:
@@ -3136,17 +1794,14 @@ void ieee80211_sta_rx_mgmt(struct net_device *dev, struct sk_buff *skb,
         kfree_skb(skb);
 }
 
-
-static void ieee80211_sta_rx_queued_mgmt(struct net_device *dev,
+static void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
                                          struct sk_buff *skb)
 {
         struct ieee80211_rx_status *rx_status;
-        struct ieee80211_sub_if_data *sdata;
         struct ieee80211_if_sta *ifsta;
         struct ieee80211_mgmt *mgmt;
         u16 fc;
 
-        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         ifsta = &sdata->u.sta;
 
         rx_status = (struct ieee80211_rx_status *) skb->cb;
@@ -3155,17 +1810,17 @@ static void ieee80211_sta_rx_queued_mgmt(struct net_device *dev,
 
         switch (fc & IEEE80211_FCTL_STYPE) {
         case IEEE80211_STYPE_PROBE_REQ:
-                ieee80211_rx_mgmt_probe_req(dev, ifsta, mgmt, skb->len,
+                ieee80211_rx_mgmt_probe_req(sdata, ifsta, mgmt, skb->len,
                                             rx_status);
                 break;
         case IEEE80211_STYPE_PROBE_RESP:
-                ieee80211_rx_mgmt_probe_resp(dev, mgmt, skb->len, rx_status);
+                ieee80211_rx_mgmt_probe_resp(sdata, mgmt, skb->len, rx_status);
                 break;
         case IEEE80211_STYPE_BEACON:
-                ieee80211_rx_mgmt_beacon(dev, mgmt, skb->len, rx_status);
+                ieee80211_rx_mgmt_beacon(sdata, mgmt, skb->len, rx_status);
                 break;
         case IEEE80211_STYPE_AUTH:
-                ieee80211_rx_mgmt_auth(dev, ifsta, mgmt, skb->len);
+                ieee80211_rx_mgmt_auth(sdata, ifsta, mgmt, skb->len);
                 break;
         case IEEE80211_STYPE_ASSOC_RESP:
                 ieee80211_rx_mgmt_assoc_resp(sdata, ifsta, mgmt, skb->len, 0);
@@ -3174,13 +1829,10 @@ static void ieee80211_sta_rx_queued_mgmt(struct net_device *dev,
                 ieee80211_rx_mgmt_assoc_resp(sdata, ifsta, mgmt, skb->len, 1);
                 break;
         case IEEE80211_STYPE_DEAUTH:
-                ieee80211_rx_mgmt_deauth(dev, ifsta, mgmt, skb->len);
+                ieee80211_rx_mgmt_deauth(sdata, ifsta, mgmt, skb->len);
                 break;
         case IEEE80211_STYPE_DISASSOC:
-                ieee80211_rx_mgmt_disassoc(dev, ifsta, mgmt, skb->len);
-                break;
-        case IEEE80211_STYPE_ACTION:
-                ieee80211_rx_mgmt_action(dev, ifsta, mgmt, skb->len, rx_status);
+                ieee80211_rx_mgmt_disassoc(sdata, ifsta, mgmt, skb->len);
                 break;
         }
 
@@ -3188,47 +1840,11 @@ static void ieee80211_sta_rx_queued_mgmt(struct net_device *dev,
 }
 
 
-ieee80211_rx_result
-ieee80211_sta_rx_scan(struct net_device *dev, struct sk_buff *skb,
-                      struct ieee80211_rx_status *rx_status)
-{
-        struct ieee80211_mgmt *mgmt;
-        __le16 fc;
-
-        if (skb->len < 2)
-                return RX_DROP_UNUSABLE;
-
-        mgmt = (struct ieee80211_mgmt *) skb->data;
-        fc = mgmt->frame_control;
-
-        if (ieee80211_is_ctl(fc))
-                return RX_CONTINUE;
-
-        if (skb->len < 24)
-                return RX_DROP_MONITOR;
-
-        if (ieee80211_is_probe_resp(fc)) {
-                ieee80211_rx_mgmt_probe_resp(dev, mgmt, skb->len, rx_status);
-                dev_kfree_skb(skb);
-                return RX_QUEUED;
-        }
-
-        if (ieee80211_is_beacon(fc)) {
-                ieee80211_rx_mgmt_beacon(dev, mgmt, skb->len, rx_status);
-                dev_kfree_skb(skb);
-                return RX_QUEUED;
-        }
-
-        return RX_CONTINUE;
-}
-
-
-static int ieee80211_sta_active_ibss(struct net_device *dev)
+static int ieee80211_sta_active_ibss(struct ieee80211_sub_if_data *sdata)
 {
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+        struct ieee80211_local *local = sdata->local;
         int active = 0;
         struct sta_info *sta;
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
         rcu_read_lock();
 
@@ -3247,179 +1863,36 @@ static int ieee80211_sta_active_ibss(struct net_device *dev)
 }
 
 
-static void ieee80211_sta_expire(struct net_device *dev, unsigned long exp_time)
-{
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        struct sta_info *sta, *tmp;
-        LIST_HEAD(tmp_list);
-        DECLARE_MAC_BUF(mac);
-        unsigned long flags;
-
-        spin_lock_irqsave(&local->sta_lock, flags);
-        list_for_each_entry_safe(sta, tmp, &local->sta_list, list)
-                if (time_after(jiffies, sta->last_rx + exp_time)) {
-#ifdef CONFIG_MAC80211_IBSS_DEBUG
-                        printk(KERN_DEBUG "%s: expiring inactive STA %s\n",
-                               dev->name, print_mac(mac, sta->addr));
-#endif
-                        __sta_info_unlink(&sta);
-                        if (sta)
-                                list_add(&sta->list, &tmp_list);
-                }
-        spin_unlock_irqrestore(&local->sta_lock, flags);
-
-        list_for_each_entry_safe(sta, tmp, &tmp_list, list)
-                sta_info_destroy(sta);
-}
-
-
-static void ieee80211_sta_merge_ibss(struct net_device *dev,
+static void ieee80211_sta_merge_ibss(struct ieee80211_sub_if_data *sdata,
                                      struct ieee80211_if_sta *ifsta)
 {
         mod_timer(&ifsta->timer, jiffies + IEEE80211_IBSS_MERGE_INTERVAL);
 
-        ieee80211_sta_expire(dev, IEEE80211_IBSS_INACTIVITY_LIMIT);
-        if (ieee80211_sta_active_ibss(dev))
+        ieee80211_sta_expire(sdata, IEEE80211_IBSS_INACTIVITY_LIMIT);
+        if (ieee80211_sta_active_ibss(sdata))
                 return;
 
         printk(KERN_DEBUG "%s: No active IBSS STAs - trying to scan for other "
-               "IBSS networks with same SSID (merge)\n", dev->name);
-        ieee80211_sta_req_scan(dev, ifsta->ssid, ifsta->ssid_len);
+               "IBSS networks with same SSID (merge)\n", sdata->dev->name);
+        ieee80211_request_scan(sdata, ifsta->ssid, ifsta->ssid_len);
 }
 
 
-#ifdef CONFIG_MAC80211_MESH
-static void ieee80211_mesh_housekeeping(struct net_device *dev,
-                           struct ieee80211_if_sta *ifsta)
-{
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        bool free_plinks;
-
-        ieee80211_sta_expire(dev, IEEE80211_MESH_PEER_INACTIVITY_LIMIT);
-        mesh_path_expire(dev);
-
-        free_plinks = mesh_plink_availables(sdata);
-        if (free_plinks != sdata->u.sta.accepting_plinks)
-                ieee80211_if_config(sdata, IEEE80211_IFCC_BEACON);
-
-        mod_timer(&ifsta->timer, jiffies +
-                        IEEE80211_MESH_HOUSEKEEPING_INTERVAL);
-}
-
-
-void ieee80211_start_mesh(struct net_device *dev)
-{
-        struct ieee80211_if_sta *ifsta;
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        ifsta = &sdata->u.sta;
-        ifsta->state = IEEE80211_MESH_UP;
-        ieee80211_sta_timer((unsigned long)sdata);
-        ieee80211_if_config(sdata, IEEE80211_IFCC_BEACON);
-}
-#endif
-
-
-void ieee80211_sta_timer(unsigned long data)
+static void ieee80211_sta_timer(unsigned long data)
 {
         struct ieee80211_sub_if_data *sdata =
                 (struct ieee80211_sub_if_data *) data;
         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
-        struct ieee80211_local *local = wdev_priv(&sdata->wdev);
+        struct ieee80211_local *local = sdata->local;
 
         set_bit(IEEE80211_STA_REQ_RUN, &ifsta->request);
         queue_work(local->hw.workqueue, &ifsta->work);
 }
 
-void ieee80211_sta_work(struct work_struct *work)
-{
-        struct ieee80211_sub_if_data *sdata =
-                container_of(work, struct ieee80211_sub_if_data, u.sta.work);
-        struct net_device *dev = sdata->dev;
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        struct ieee80211_if_sta *ifsta;
-        struct sk_buff *skb;
-
-        if (!netif_running(dev))
-                return;
-
-        if (local->sta_sw_scanning || local->sta_hw_scanning)
-                return;
-
-        if (WARN_ON(sdata->vif.type != IEEE80211_IF_TYPE_STA &&
-                    sdata->vif.type != IEEE80211_IF_TYPE_IBSS &&
-                    sdata->vif.type != IEEE80211_IF_TYPE_MESH_POINT))
-                return;
-        ifsta = &sdata->u.sta;
-
-        while ((skb = skb_dequeue(&ifsta->skb_queue)))
-                ieee80211_sta_rx_queued_mgmt(dev, skb);
-
-#ifdef CONFIG_MAC80211_MESH
-        if (ifsta->preq_queue_len &&
-            time_after(jiffies,
-                       ifsta->last_preq + msecs_to_jiffies(ifsta->mshcfg.dot11MeshHWMPpreqMinInterval)))
-                mesh_path_start_discovery(dev);
-#endif
-
-        if (ifsta->state != IEEE80211_AUTHENTICATE &&
-            ifsta->state != IEEE80211_ASSOCIATE &&
-            test_and_clear_bit(IEEE80211_STA_REQ_SCAN, &ifsta->request)) {
-                if (ifsta->scan_ssid_len)
-                        ieee80211_sta_start_scan(dev, ifsta->scan_ssid, ifsta->scan_ssid_len);
-                else
-                        ieee80211_sta_start_scan(dev, NULL, 0);
-                return;
-        }
-
-        if (test_and_clear_bit(IEEE80211_STA_REQ_AUTH, &ifsta->request)) {
-                if (ieee80211_sta_config_auth(dev, ifsta))
-                        return;
-                clear_bit(IEEE80211_STA_REQ_RUN, &ifsta->request);
-        } else if (!test_and_clear_bit(IEEE80211_STA_REQ_RUN, &ifsta->request))
-                return;
-
-        switch (ifsta->state) {
-        case IEEE80211_DISABLED:
-                break;
-        case IEEE80211_AUTHENTICATE:
-                ieee80211_authenticate(dev, ifsta);
-                break;
-        case IEEE80211_ASSOCIATE:
-                ieee80211_associate(dev, ifsta);
-                break;
-        case IEEE80211_ASSOCIATED:
-                ieee80211_associated(dev, ifsta);
-                break;
-        case IEEE80211_IBSS_SEARCH:
-                ieee80211_sta_find_ibss(dev, ifsta);
-                break;
-        case IEEE80211_IBSS_JOINED:
-                ieee80211_sta_merge_ibss(dev, ifsta);
-                break;
-#ifdef CONFIG_MAC80211_MESH
-        case IEEE80211_MESH_UP:
-                ieee80211_mesh_housekeeping(dev, ifsta);
-                break;
-#endif
-        default:
-                WARN_ON(1);
-                break;
-        }
-
-        if (ieee80211_privacy_mismatch(dev, ifsta)) {
-                printk(KERN_DEBUG "%s: privacy configuration mismatch and "
-                       "mixed-cell disabled - disassociate\n", dev->name);
-
-                ieee80211_send_disassoc(dev, ifsta, WLAN_REASON_UNSPECIFIED);
-                ieee80211_set_disassoc(dev, ifsta, 0);
-        }
-}
-
-
-static void ieee80211_sta_reset_auth(struct net_device *dev,
+static void ieee80211_sta_reset_auth(struct ieee80211_sub_if_data *sdata,
                                      struct ieee80211_if_sta *ifsta)
 {
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+        struct ieee80211_local *local = sdata->local;
 
         if (local->ops->reset_tsf) {
                 /* Reset own TSF to allow time synchronization work. */
@@ -3439,29 +1912,15 @@ static void ieee80211_sta_reset_auth(struct net_device *dev,
                 ifsta->auth_alg = WLAN_AUTH_OPEN;
         ifsta->auth_transaction = -1;
         ifsta->flags &= ~IEEE80211_STA_ASSOCIATED;
-        ifsta->auth_tries = ifsta->assoc_tries = 0;
-        netif_carrier_off(dev);
+        ifsta->assoc_scan_tries = 0;
+        ifsta->direct_probe_tries = 0;
+        ifsta->auth_tries = 0;
+        ifsta->assoc_tries = 0;
+        netif_tx_stop_all_queues(sdata->dev);
+        netif_carrier_off(sdata->dev);
 }
 
 
-void ieee80211_sta_req_auth(struct net_device *dev,
-                            struct ieee80211_if_sta *ifsta)
-{
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-
-        if (sdata->vif.type != IEEE80211_IF_TYPE_STA)
-                return;
-
-        if ((ifsta->flags & (IEEE80211_STA_BSSID_SET |
-                                IEEE80211_STA_AUTO_BSSID_SEL)) &&
-            (ifsta->flags & (IEEE80211_STA_SSID_SET |
-                                IEEE80211_STA_AUTO_SSID_SEL))) {
-                set_bit(IEEE80211_STA_REQ_AUTH, &ifsta->request);
-                queue_work(local->hw.workqueue, &ifsta->work);
-        }
-}
-
 static int ieee80211_sta_match_ssid(struct ieee80211_if_sta *ifsta,
                                     const char *ssid, int ssid_len)
 {
@@ -3492,81 +1951,11 @@ static int ieee80211_sta_match_ssid(struct ieee80211_if_sta *ifsta,
         return 0;
 }
 
-static int ieee80211_sta_config_auth(struct net_device *dev,
+static int ieee80211_sta_create_ibss(struct ieee80211_sub_if_data *sdata,
                                      struct ieee80211_if_sta *ifsta)
 {
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        struct ieee80211_sta_bss *bss, *selected = NULL;
-        int top_rssi = 0, freq;
-
-        spin_lock_bh(&local->sta_bss_lock);
-        freq = local->oper_channel->center_freq;
-        list_for_each_entry(bss, &local->sta_bss_list, list) {
-                if (!(bss->capability & WLAN_CAPABILITY_ESS))
-                        continue;
-
-                if ((ifsta->flags & (IEEE80211_STA_AUTO_SSID_SEL |
-                        IEEE80211_STA_AUTO_BSSID_SEL |
-                        IEEE80211_STA_AUTO_CHANNEL_SEL)) &&
-                    (!!(bss->capability & WLAN_CAPABILITY_PRIVACY) ^
-                     !!sdata->default_key))
-                        continue;
-
-                if (!(ifsta->flags & IEEE80211_STA_AUTO_CHANNEL_SEL) &&
-                    bss->freq != freq)
-                        continue;
-
-                if (!(ifsta->flags & IEEE80211_STA_AUTO_BSSID_SEL) &&
-                    memcmp(bss->bssid, ifsta->bssid, ETH_ALEN))
-                        continue;
-
-                if (!(ifsta->flags & IEEE80211_STA_AUTO_SSID_SEL) &&
-                    !ieee80211_sta_match_ssid(ifsta, bss->ssid, bss->ssid_len))
-                        continue;
-
-                if (!selected || top_rssi < bss->signal) {
-                        selected = bss;
-                        top_rssi = bss->signal;
-                }
-        }
-        if (selected)
-                atomic_inc(&selected->users);
-        spin_unlock_bh(&local->sta_bss_lock);
-
-        if (selected) {
-                ieee80211_set_freq(dev, selected->freq);
-                if (!(ifsta->flags & IEEE80211_STA_SSID_SET))
-                        ieee80211_sta_set_ssid(dev, selected->ssid,
-                                               selected->ssid_len);
-                ieee80211_sta_set_bssid(dev, selected->bssid);
-                ieee80211_sta_def_wmm_params(dev, selected, 0);
-                ieee80211_rx_bss_put(local, selected);
-                ifsta->state = IEEE80211_AUTHENTICATE;
-                ieee80211_sta_reset_auth(dev, ifsta);
-                return 0;
-        } else {
-                if (ifsta->state != IEEE80211_AUTHENTICATE) {
-                        if (ifsta->flags & IEEE80211_STA_AUTO_SSID_SEL)
-                                ieee80211_sta_start_scan(dev, NULL, 0);
-                        else
-                                ieee80211_sta_start_scan(dev, ifsta->ssid,
-                                                         ifsta->ssid_len);
-                        ifsta->state = IEEE80211_AUTHENTICATE;
-                        set_bit(IEEE80211_STA_REQ_AUTH, &ifsta->request);
-                } else
-                        ifsta->state = IEEE80211_DISABLED;
-        }
-        return -1;
-}
-
-
-static int ieee80211_sta_create_ibss(struct net_device *dev,
-                                     struct ieee80211_if_sta *ifsta)
-{
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        struct ieee80211_sta_bss *bss;
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_bss *bss;
         struct ieee80211_supported_band *sband;
         u8 bssid[ETH_ALEN], *pos;
         int i;
@@ -3582,15 +1971,15 @@ static int ieee80211_sta_create_ibss(struct net_device *dev,
          * random number generator get different BSSID. */
         get_random_bytes(bssid, ETH_ALEN);
         for (i = 0; i < ETH_ALEN; i++)
-                bssid[i] ^= dev->dev_addr[i];
+                bssid[i] ^= sdata->dev->dev_addr[i];
         bssid[0] &= ~0x01;
         bssid[0] |= 0x02;
 #endif
 
         printk(KERN_DEBUG "%s: Creating new IBSS network, BSSID %s\n",
-               dev->name, print_mac(mac, bssid));
+               sdata->dev->name, print_mac(mac, bssid));
 
-        bss = ieee80211_rx_bss_add(dev, bssid,
+        bss = ieee80211_rx_bss_add(local, bssid,
                                    local->hw.conf.channel->center_freq,
                                    sdata->u.sta.ssid, sdata->u.sta.ssid_len);
         if (!bss)
@@ -3617,17 +2006,17 @@ static int ieee80211_sta_create_ibss(struct net_device *dev,
                 *pos++ = (u8) (rate / 5);
         }
 
-        ret = ieee80211_sta_join_ibss(dev, ifsta, bss);
+        ret = ieee80211_sta_join_ibss(sdata, ifsta, bss);
         ieee80211_rx_bss_put(local, bss);
         return ret;
 }
 
 
-static int ieee80211_sta_find_ibss(struct net_device *dev,
+static int ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata,
                                    struct ieee80211_if_sta *ifsta)
 {
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        struct ieee80211_sta_bss *bss;
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_bss *bss;
         int found = 0;
         u8 bssid[ETH_ALEN];
         int active_ibss;
@@ -3637,13 +2026,13 @@ static int ieee80211_sta_find_ibss(struct net_device *dev,
         if (ifsta->ssid_len == 0)
                 return -EINVAL;
 
-        active_ibss = ieee80211_sta_active_ibss(dev);
+        active_ibss = ieee80211_sta_active_ibss(sdata);
 #ifdef CONFIG_MAC80211_IBSS_DEBUG
         printk(KERN_DEBUG "%s: sta_find_ibss (active_ibss=%d)\n",
-               dev->name, active_ibss);
+               sdata->dev->name, active_ibss);
 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
-        spin_lock_bh(&local->sta_bss_lock);
-        list_for_each_entry(bss, &local->sta_bss_list, list) {
+        spin_lock_bh(&local->bss_lock);
+        list_for_each_entry(bss, &local->bss_list, list) {
                 if (ifsta->ssid_len != bss->ssid_len ||
                     memcmp(ifsta->ssid, bss->ssid, bss->ssid_len) != 0
                     || !(bss->capability & WLAN_CAPABILITY_IBSS))
@@ -3657,7 +2046,7 @@ static int ieee80211_sta_find_ibss(struct net_device *dev,
                 if (active_ibss || memcmp(bssid, ifsta->bssid, ETH_ALEN) != 0)
                         break;
         }
-        spin_unlock_bh(&local->sta_bss_lock);
+        spin_unlock_bh(&local->bss_lock);
 
 #ifdef CONFIG_MAC80211_IBSS_DEBUG
         if (found)
@@ -3675,15 +2064,15 @@ static int ieee80211_sta_find_ibss(struct net_device *dev,
                 else
                         search_freq = local->hw.conf.channel->center_freq;
 
-                bss = ieee80211_rx_bss_get(dev, bssid, search_freq,
+                bss = ieee80211_rx_bss_get(local, bssid, search_freq,
                                            ifsta->ssid, ifsta->ssid_len);
                 if (!bss)
                         goto dont_join;
 
                 printk(KERN_DEBUG "%s: Selected IBSS BSSID %s"
                        " based on configured SSID\n",
-                       dev->name, print_mac(mac, bssid));
-                ret = ieee80211_sta_join_ibss(dev, ifsta, bss);
+                       sdata->dev->name, print_mac(mac, bssid));
+                ret = ieee80211_sta_join_ibss(sdata, ifsta, bss);
                 ieee80211_rx_bss_put(local, bss);
                 return ret;
         }
@@ -3694,17 +2083,17 @@ dont_join:
 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
 
         /* Selected IBSS not found in current scan results - try to scan */
-        if (ifsta->state == IEEE80211_IBSS_JOINED &&
-            !ieee80211_sta_active_ibss(dev)) {
+        if (ifsta->state == IEEE80211_STA_MLME_IBSS_JOINED &&
+            !ieee80211_sta_active_ibss(sdata)) {
                 mod_timer(&ifsta->timer, jiffies +
                                       IEEE80211_IBSS_MERGE_INTERVAL);
         } else if (time_after(jiffies, local->last_scan_completed +
                               IEEE80211_SCAN_INTERVAL)) {
                 printk(KERN_DEBUG "%s: Trigger new scan to find an IBSS to "
-                       "join\n", dev->name);
-                return ieee80211_sta_req_scan(dev, ifsta->ssid,
+                       "join\n", sdata->dev->name);
+                return ieee80211_request_scan(sdata, ifsta->ssid,
                                               ifsta->ssid_len);
-        } else if (ifsta->state != IEEE80211_IBSS_JOINED) {
+        } else if (ifsta->state != IEEE80211_STA_MLME_IBSS_JOINED) {
                 int interval = IEEE80211_SCAN_INTERVAL;
 
                 if (time_after(jiffies, ifsta->ibss_join_req +
@@ -3712,10 +2101,10 @@ dont_join:
                         if ((ifsta->flags & IEEE80211_STA_CREATE_IBSS) &&
                             (!(local->oper_channel->flags &
                                         IEEE80211_CHAN_NO_IBSS)))
-                                return ieee80211_sta_create_ibss(dev, ifsta);
+                                return ieee80211_sta_create_ibss(sdata, ifsta);
                         if (ifsta->flags & IEEE80211_STA_CREATE_IBSS) {
                                 printk(KERN_DEBUG "%s: IBSS not allowed on"
-                                       " %d MHz\n", dev->name,
+                                       " %d MHz\n", sdata->dev->name,
                                        local->hw.conf.channel->center_freq);
                         }
 
@@ -3724,7 +2113,7 @@ dont_join:
                         interval = IEEE80211_SCAN_INTERVAL_SLOW;
                 }
 
-                ifsta->state = IEEE80211_IBSS_SEARCH;
+                ifsta->state = IEEE80211_STA_MLME_IBSS_SEARCH;
                 mod_timer(&ifsta->timer, jiffies + interval);
                 return 0;
         }
@@ -3733,620 +2122,344 @@ dont_join:
 }
 
 
-int ieee80211_sta_set_ssid(struct net_device *dev, char *ssid, size_t len)
+static int ieee80211_sta_config_auth(struct ieee80211_sub_if_data *sdata,
+                                     struct ieee80211_if_sta *ifsta)
 {
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        struct ieee80211_if_sta *ifsta;
-        int res;
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_bss *bss, *selected = NULL;
+        int top_rssi = 0, freq;
 
-        if (len > IEEE80211_MAX_SSID_LEN)
-                return -EINVAL;
+        spin_lock_bh(&local->bss_lock);
+        freq = local->oper_channel->center_freq;
+        list_for_each_entry(bss, &local->bss_list, list) {
+                if (!(bss->capability & WLAN_CAPABILITY_ESS))
+                        continue;
 
-        ifsta = &sdata->u.sta;
+                if ((ifsta->flags & (IEEE80211_STA_AUTO_SSID_SEL |
+                        IEEE80211_STA_AUTO_BSSID_SEL |
+                        IEEE80211_STA_AUTO_CHANNEL_SEL)) &&
+                    (!!(bss->capability & WLAN_CAPABILITY_PRIVACY) ^
+                     !!sdata->default_key))
+                        continue;
 
-        if (ifsta->ssid_len != len || memcmp(ifsta->ssid, ssid, len) != 0) {
-                memset(ifsta->ssid, 0, sizeof(ifsta->ssid));
-                memcpy(ifsta->ssid, ssid, len);
-                ifsta->ssid_len = len;
-                ifsta->flags &= ~IEEE80211_STA_PREV_BSSID_SET;
+                if (!(ifsta->flags & IEEE80211_STA_AUTO_CHANNEL_SEL) &&
+                    bss->freq != freq)
+                        continue;
 
-                res = 0;
-                /*
-                 * Hack! MLME code needs to be cleaned up to have different
-                 * entry points for configuration and internal selection change
-                 */
-                if (netif_running(sdata->dev))
-                        res = ieee80211_if_config(sdata, IEEE80211_IFCC_SSID);
-                if (res) {
-                        printk(KERN_DEBUG "%s: Failed to config new SSID to "
-                               "the low-level driver\n", dev->name);
-                        return res;
-                }
-        }
+                if (!(ifsta->flags & IEEE80211_STA_AUTO_BSSID_SEL) &&
+                    memcmp(bss->bssid, ifsta->bssid, ETH_ALEN))
+                        continue;
 
-        if (len)
-                ifsta->flags |= IEEE80211_STA_SSID_SET;
-        else
-                ifsta->flags &= ~IEEE80211_STA_SSID_SET;
+                if (!(ifsta->flags & IEEE80211_STA_AUTO_SSID_SEL) &&
+                    !ieee80211_sta_match_ssid(ifsta, bss->ssid, bss->ssid_len))
+                        continue;
 
-        if (sdata->vif.type == IEEE80211_IF_TYPE_IBSS &&
-            !(ifsta->flags & IEEE80211_STA_BSSID_SET)) {
-                ifsta->ibss_join_req = jiffies;
-                ifsta->state = IEEE80211_IBSS_SEARCH;
-                return ieee80211_sta_find_ibss(dev, ifsta);
+                if (!selected || top_rssi < bss->signal) {
+                        selected = bss;
+                        top_rssi = bss->signal;
+                }
         }
+        if (selected)
+                atomic_inc(&selected->users);
+        spin_unlock_bh(&local->bss_lock);
 
-        return 0;
-}
+        if (selected) {
+                ieee80211_set_freq(sdata, selected->freq);
+                if (!(ifsta->flags & IEEE80211_STA_SSID_SET))
+                        ieee80211_sta_set_ssid(sdata, selected->ssid,
+                                               selected->ssid_len);
+                ieee80211_sta_set_bssid(sdata, selected->bssid);
+                ieee80211_sta_def_wmm_params(sdata, selected);
 
+                /* Send out direct probe if no probe resp was received or
+                 * the one we have is outdated
+                 */
+                if (!selected->last_probe_resp ||
+                    time_after(jiffies, selected->last_probe_resp
+                                        + IEEE80211_SCAN_RESULT_EXPIRE))
+                        ifsta->state = IEEE80211_STA_MLME_DIRECT_PROBE;
+                else
+                        ifsta->state = IEEE80211_STA_MLME_AUTHENTICATE;
 
-int ieee80211_sta_get_ssid(struct net_device *dev, char *ssid, size_t *len)
-{
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        struct ieee80211_if_sta *ifsta = &sdata->u.sta;
-        memcpy(ssid, ifsta->ssid, ifsta->ssid_len);
-        *len = ifsta->ssid_len;
-        return 0;
+                ieee80211_rx_bss_put(local, selected);
+                ieee80211_sta_reset_auth(sdata, ifsta);
+                return 0;
+        } else {
+                if (ifsta->assoc_scan_tries < IEEE80211_ASSOC_SCANS_MAX_TRIES) {
+                        ifsta->assoc_scan_tries++;
+                        if (ifsta->flags & IEEE80211_STA_AUTO_SSID_SEL)
+                                ieee80211_start_scan(sdata, NULL, 0);
+                        else
+                                ieee80211_start_scan(sdata, ifsta->ssid,
+                                                         ifsta->ssid_len);
+                        ifsta->state = IEEE80211_STA_MLME_AUTHENTICATE;
+                        set_bit(IEEE80211_STA_REQ_AUTH, &ifsta->request);
+                } else
+                        ifsta->state = IEEE80211_STA_MLME_DISABLED;
+        }
+        return -1;
 }
 
 
-int ieee80211_sta_set_bssid(struct net_device *dev, u8 *bssid)
+static void ieee80211_sta_work(struct work_struct *work)
 {
-        struct ieee80211_sub_if_data *sdata;
+        struct ieee80211_sub_if_data *sdata =
+                container_of(work, struct ieee80211_sub_if_data, u.sta.work);
+        struct ieee80211_local *local = sdata->local;
         struct ieee80211_if_sta *ifsta;
-        int res;
-
-        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        ifsta = &sdata->u.sta;
+        struct sk_buff *skb;
 
-        if (memcmp(ifsta->bssid, bssid, ETH_ALEN) != 0) {
-                memcpy(ifsta->bssid, bssid, ETH_ALEN);
-                res = 0;
-                /*
-                 * Hack! See also ieee80211_sta_set_ssid.
-                 */
-                if (netif_running(sdata->dev))
-                        res = ieee80211_if_config(sdata, IEEE80211_IFCC_BSSID);
-                if (res) {
-                        printk(KERN_DEBUG "%s: Failed to config new BSSID to "
-                               "the low-level driver\n", dev->name);
-                        return res;
-                }
-        }
+        if (!netif_running(sdata->dev))
+                return;
 
-        if (is_valid_ether_addr(bssid))
-                ifsta->flags |= IEEE80211_STA_BSSID_SET;
-        else
-                ifsta->flags &= ~IEEE80211_STA_BSSID_SET;
+        if (local->sw_scanning || local->hw_scanning)
+                return;
 
-        return 0;
-}
+        if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION &&
+                    sdata->vif.type != NL80211_IFTYPE_ADHOC))
+                return;
+        ifsta = &sdata->u.sta;
 
+        while ((skb = skb_dequeue(&ifsta->skb_queue)))
+                ieee80211_sta_rx_queued_mgmt(sdata, skb);
 
-static void ieee80211_send_nullfunc(struct ieee80211_local *local,
-                                    struct ieee80211_sub_if_data *sdata,
-                                    int powersave)
-{
-        struct sk_buff *skb;
-        struct ieee80211_hdr *nullfunc;
-        __le16 fc;
+        if (ifsta->state != IEEE80211_STA_MLME_DIRECT_PROBE &&
+            ifsta->state != IEEE80211_STA_MLME_AUTHENTICATE &&
+            ifsta->state != IEEE80211_STA_MLME_ASSOCIATE &&
+            test_and_clear_bit(IEEE80211_STA_REQ_SCAN, &ifsta->request)) {
+                ieee80211_start_scan(sdata, ifsta->scan_ssid,
+                                     ifsta->scan_ssid_len);
+                return;
+        }
 
-        skb = dev_alloc_skb(local->hw.extra_tx_headroom + 24);
-        if (!skb) {
-                printk(KERN_DEBUG "%s: failed to allocate buffer for nullfunc "
-                       "frame\n", sdata->dev->name);
+        if (test_and_clear_bit(IEEE80211_STA_REQ_AUTH, &ifsta->request)) {
+                if (ieee80211_sta_config_auth(sdata, ifsta))
+                        return;
+                clear_bit(IEEE80211_STA_REQ_RUN, &ifsta->request);
+        } else if (!test_and_clear_bit(IEEE80211_STA_REQ_RUN, &ifsta->request))
                 return;
+
+        switch (ifsta->state) {
+        case IEEE80211_STA_MLME_DISABLED:
+                break;
+        case IEEE80211_STA_MLME_DIRECT_PROBE:
+                ieee80211_direct_probe(sdata, ifsta);
+                break;
+        case IEEE80211_STA_MLME_AUTHENTICATE:
+                ieee80211_authenticate(sdata, ifsta);
+                break;
+        case IEEE80211_STA_MLME_ASSOCIATE:
+                ieee80211_associate(sdata, ifsta);
+                break;
+        case IEEE80211_STA_MLME_ASSOCIATED:
+                ieee80211_associated(sdata, ifsta);
+                break;
+        case IEEE80211_STA_MLME_IBSS_SEARCH:
+                ieee80211_sta_find_ibss(sdata, ifsta);
+                break;
+        case IEEE80211_STA_MLME_IBSS_JOINED:
+                ieee80211_sta_merge_ibss(sdata, ifsta);
+                break;
+        default:
+                WARN_ON(1);
+                break;
         }
-        skb_reserve(skb, local->hw.extra_tx_headroom);
 
-        nullfunc = (struct ieee80211_hdr *) skb_put(skb, 24);
-        memset(nullfunc, 0, 24);
-        fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_NULLFUNC |
-                         IEEE80211_FCTL_TODS);
-        if (powersave)
-                fc |= cpu_to_le16(IEEE80211_FCTL_PM);
-        nullfunc->frame_control = fc;
-        memcpy(nullfunc->addr1, sdata->u.sta.bssid, ETH_ALEN);
-        memcpy(nullfunc->addr2, sdata->dev->dev_addr, ETH_ALEN);
-        memcpy(nullfunc->addr3, sdata->u.sta.bssid, ETH_ALEN);
-
-        ieee80211_sta_tx(sdata->dev, skb, 0);
-}
+        if (ieee80211_privacy_mismatch(sdata, ifsta)) {
+                printk(KERN_DEBUG "%s: privacy configuration mismatch and "
+                       "mixed-cell disabled - disassociate\n", sdata->dev->name);
 
+                ieee80211_set_disassoc(sdata, ifsta, false, true,
+                                        WLAN_REASON_UNSPECIFIED);
+        }
+}
 
 static void ieee80211_restart_sta_timer(struct ieee80211_sub_if_data *sdata)
 {
-        if (sdata->vif.type == IEEE80211_IF_TYPE_STA ||
-            ieee80211_vif_is_mesh(&sdata->vif))
-                ieee80211_sta_timer((unsigned long)sdata);
+        if (sdata->vif.type == NL80211_IFTYPE_STATION)
+                queue_work(sdata->local->hw.workqueue,
+                           &sdata->u.sta.work);
 }
 
-void ieee80211_scan_completed(struct ieee80211_hw *hw)
+/* interface setup */
+void ieee80211_sta_setup_sdata(struct ieee80211_sub_if_data *sdata)
 {
-        struct ieee80211_local *local = hw_to_local(hw);
-        struct net_device *dev = local->scan_dev;
-        struct ieee80211_sub_if_data *sdata;
-        union iwreq_data wrqu;
+        struct ieee80211_if_sta *ifsta;
 
-        local->last_scan_completed = jiffies;
-        memset(&wrqu, 0, sizeof(wrqu));
-        wireless_send_event(dev, SIOCGIWSCAN, &wrqu, NULL);
-
-        if (local->sta_hw_scanning) {
-                local->sta_hw_scanning = 0;
-                if (ieee80211_hw_config(local))
-                        printk(KERN_DEBUG "%s: failed to restore operational "
-                               "channel after scan\n", dev->name);
-                /* Restart STA timer for HW scan case */
-                rcu_read_lock();
-                list_for_each_entry_rcu(sdata, &local->interfaces, list)
-                        ieee80211_restart_sta_timer(sdata);
-                rcu_read_unlock();
+        ifsta = &sdata->u.sta;
+        INIT_WORK(&ifsta->work, ieee80211_sta_work);
+        setup_timer(&ifsta->timer, ieee80211_sta_timer,
+                    (unsigned long) sdata);
+        skb_queue_head_init(&ifsta->skb_queue);
+
+        ifsta->capab = WLAN_CAPABILITY_ESS;
+        ifsta->auth_algs = IEEE80211_AUTH_ALG_OPEN |
+                IEEE80211_AUTH_ALG_SHARED_KEY;
+        ifsta->flags |= IEEE80211_STA_CREATE_IBSS |
+                IEEE80211_STA_AUTO_BSSID_SEL |
+                IEEE80211_STA_AUTO_CHANNEL_SEL;
+        if (ieee80211_num_regular_queues(&sdata->local->hw) >= 4)
+                ifsta->flags |= IEEE80211_STA_WMM_ENABLED;
+}
+
+/*
+ * Add a new IBSS station, will also be called by the RX code when,
+ * in IBSS mode, receiving a frame from a yet-unknown station, hence
+ * must be callable in atomic context.
+ */
+struct sta_info *ieee80211_ibss_add_sta(struct ieee80211_sub_if_data *sdata,
+                                        struct sk_buff *skb, u8 *bssid,
+                                        u8 *addr, u64 supp_rates)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct sta_info *sta;
+        DECLARE_MAC_BUF(mac);
+        int band = local->hw.conf.channel->band;
 
-                goto done;
+        /* TODO: Could consider removing the least recently used entry and
+         * allow new one to be added. */
+        if (local->num_sta >= IEEE80211_IBSS_MAX_STA_ENTRIES) {
+                if (net_ratelimit()) {
+                        printk(KERN_DEBUG "%s: No room for a new IBSS STA "
+                               "entry %s\n", sdata->dev->name, print_mac(mac, addr));
+                }
+                return NULL;
         }
 
-        local->sta_sw_scanning = 0;
-        if (ieee80211_hw_config(local))
-                printk(KERN_DEBUG "%s: failed to restore operational "
-                       "channel after scan\n", dev->name);
+        if (compare_ether_addr(bssid, sdata->u.sta.bssid))
+                return NULL;
 
+#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
+        printk(KERN_DEBUG "%s: Adding new IBSS station %s (dev=%s)\n",
+               wiphy_name(local->hw.wiphy), print_mac(mac, addr), sdata->dev->name);
+#endif
 
-        netif_tx_lock_bh(local->mdev);
-        netif_addr_lock(local->mdev);
-        local->filter_flags &= ~FIF_BCN_PRBRESP_PROMISC;
-        local->ops->configure_filter(local_to_hw(local),
-                                     FIF_BCN_PRBRESP_PROMISC,
-                                     &local->filter_flags,
-                                     local->mdev->mc_count,
-                                     local->mdev->mc_list);
+        sta = sta_info_alloc(sdata, addr, GFP_ATOMIC);
+        if (!sta)
+                return NULL;
 
-        netif_addr_unlock(local->mdev);
-        netif_tx_unlock_bh(local->mdev);
+        set_sta_flags(sta, WLAN_STA_AUTHORIZED);
 
-        rcu_read_lock();
-        list_for_each_entry_rcu(sdata, &local->interfaces, list) {
-                /* Tell AP we're back */
-                if (sdata->vif.type == IEEE80211_IF_TYPE_STA &&
-                    sdata->u.sta.flags & IEEE80211_STA_ASSOCIATED)
-                        ieee80211_send_nullfunc(local, sdata, 0);
+        /* make sure mandatory rates are always added */
+        sta->sta.supp_rates[band] = supp_rates |
+                        ieee80211_mandatory_rates(local, band);
 
-                ieee80211_restart_sta_timer(sdata);
+        rate_control_rate_init(sta);
 
-                netif_wake_queue(sdata->dev);
-        }
-        rcu_read_unlock();
+        if (sta_info_insert(sta))
+                return NULL;
 
-done:
-        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        if (sdata->vif.type == IEEE80211_IF_TYPE_IBSS) {
-                struct ieee80211_if_sta *ifsta = &sdata->u.sta;
-                if (!(ifsta->flags & IEEE80211_STA_BSSID_SET) ||
-                    (!(ifsta->state == IEEE80211_IBSS_JOINED) &&
-                    !ieee80211_sta_active_ibss(dev)))
-                        ieee80211_sta_find_ibss(dev, ifsta);
-        }
+        return sta;
 }
-EXPORT_SYMBOL(ieee80211_scan_completed);
 
-void ieee80211_sta_scan_work(struct work_struct *work)
+/* configuration hooks */
+void ieee80211_sta_req_auth(struct ieee80211_sub_if_data *sdata,
+                            struct ieee80211_if_sta *ifsta)
 {
-        struct ieee80211_local *local =
-                container_of(work, struct ieee80211_local, scan_work.work);
-        struct net_device *dev = local->scan_dev;
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        struct ieee80211_supported_band *sband;
-        struct ieee80211_channel *chan;
-        int skip;
-        unsigned long next_delay = 0;
+        struct ieee80211_local *local = sdata->local;
 
-        if (!local->sta_sw_scanning)
+        if (sdata->vif.type != NL80211_IFTYPE_STATION)
                 return;
 
-        switch (local->scan_state) {
-        case SCAN_SET_CHANNEL:
-                /*
-                 * Get current scan band. scan_band may be IEEE80211_NUM_BANDS
-                 * after we successfully scanned the last channel of the last
-                 * band (and the last band is supported by the hw)
-                 */
-                if (local->scan_band < IEEE80211_NUM_BANDS)
-                        sband = local->hw.wiphy->bands[local->scan_band];
-                else
-                        sband = NULL;
-
-                /*
-                 * If we are at an unsupported band and have more bands
-                 * left to scan, advance to the next supported one.
-                 */
-                while (!sband && local->scan_band < IEEE80211_NUM_BANDS - 1) {
-                        local->scan_band++;
-                        sband = local->hw.wiphy->bands[local->scan_band];
-                        local->scan_channel_idx = 0;
-                }
-
-                /* if no more bands/channels left, complete scan */
-                if (!sband || local->scan_channel_idx >= sband->n_channels) {
-                        ieee80211_scan_completed(local_to_hw(local));
-                        return;
-                }
-                skip = 0;
-                chan = &sband->channels[local->scan_channel_idx];
-
-                if (chan->flags & IEEE80211_CHAN_DISABLED ||
-                    (sdata->vif.type == IEEE80211_IF_TYPE_IBSS &&
-                     chan->flags & IEEE80211_CHAN_NO_IBSS))
-                        skip = 1;
-
-                if (!skip) {
-                        local->scan_channel = chan;
-                        if (ieee80211_hw_config(local)) {
-                                printk(KERN_DEBUG "%s: failed to set freq to "
-                                       "%d MHz for scan\n", dev->name,
-                                       chan->center_freq);
-                                skip = 1;
-                        }
-                }
-
-                /* advance state machine to next channel/band */
-                local->scan_channel_idx++;
-                if (local->scan_channel_idx >= sband->n_channels) {
-                        /*
-                         * scan_band may end up == IEEE80211_NUM_BANDS, but
-                         * we'll catch that case above and complete the scan
-                         * if that is the case.
-                         */
-                        local->scan_band++;
-                        local->scan_channel_idx = 0;
-                }
-
-                if (skip)
-                        break;
+        if ((ifsta->flags & (IEEE80211_STA_BSSID_SET |
+                             IEEE80211_STA_AUTO_BSSID_SEL)) &&
+            (ifsta->flags & (IEEE80211_STA_SSID_SET |
+                             IEEE80211_STA_AUTO_SSID_SEL))) {
 
-                next_delay = IEEE80211_PROBE_DELAY +
-                             usecs_to_jiffies(local->hw.channel_change_time);
-                local->scan_state = SCAN_SEND_PROBE;
-                break;
-        case SCAN_SEND_PROBE:
-                next_delay = IEEE80211_PASSIVE_CHANNEL_TIME;
-                local->scan_state = SCAN_SET_CHANNEL;
+                if (ifsta->state == IEEE80211_STA_MLME_ASSOCIATED)
+                        ieee80211_set_disassoc(sdata, ifsta, true, true,
+                                               WLAN_REASON_DEAUTH_LEAVING);
 
-                if (local->scan_channel->flags & IEEE80211_CHAN_PASSIVE_SCAN)
-                        break;
-                ieee80211_send_probe_req(dev, NULL, local->scan_ssid,
-                                         local->scan_ssid_len);
-                next_delay = IEEE80211_CHANNEL_TIME;
-                break;
+                set_bit(IEEE80211_STA_REQ_AUTH, &ifsta->request);
+                queue_work(local->hw.workqueue, &ifsta->work);
         }
-
-        if (local->sta_sw_scanning)
-                queue_delayed_work(local->hw.workqueue, &local->scan_work,
-                                   next_delay);
 }
 
-
-static int ieee80211_sta_start_scan(struct net_device *dev,
-                                    u8 *ssid, size_t ssid_len)
+int ieee80211_sta_set_ssid(struct ieee80211_sub_if_data *sdata, char *ssid, size_t len)
 {
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        struct ieee80211_sub_if_data *sdata;
+        struct ieee80211_if_sta *ifsta;
+        int res;
 
-        if (ssid_len > IEEE80211_MAX_SSID_LEN)
+        if (len > IEEE80211_MAX_SSID_LEN)
                 return -EINVAL;
 
-        /* MLME-SCAN.request (page 118)  page 144 (11.1.3.1)
-         * BSSType: INFRASTRUCTURE, INDEPENDENT, ANY_BSS
-         * BSSID: MACAddress
-         * SSID
-         * ScanType: ACTIVE, PASSIVE
-         * ProbeDelay: delay (in microseconds) to be used prior to transmitting
-         *    a Probe frame during active scanning
-         * ChannelList
-         * MinChannelTime (>= ProbeDelay), in TU
-         * MaxChannelTime: (>= MinChannelTime), in TU
-         */
-
-         /* MLME-SCAN.confirm
-          * BSSDescriptionSet
-          * ResultCode: SUCCESS, INVALID_PARAMETERS
-         */
+        ifsta = &sdata->u.sta;
 
-        if (local->sta_sw_scanning || local->sta_hw_scanning) {
-                if (local->scan_dev == dev)
-                        return 0;
-                return -EBUSY;
-        }
+        if (ifsta->ssid_len != len || memcmp(ifsta->ssid, ssid, len) != 0) {
+                memset(ifsta->ssid, 0, sizeof(ifsta->ssid));
+                memcpy(ifsta->ssid, ssid, len);
+                ifsta->ssid_len = len;
+                ifsta->flags &= ~IEEE80211_STA_PREV_BSSID_SET;
 
-        if (local->ops->hw_scan) {
-                int rc = local->ops->hw_scan(local_to_hw(local),
-                                             ssid, ssid_len);
-                if (!rc) {
-                        local->sta_hw_scanning = 1;
-                        local->scan_dev = dev;
+                res = 0;
+                /*
+                 * Hack! MLME code needs to be cleaned up to have different
+                 * entry points for configuration and internal selection change
+                 */
+                if (netif_running(sdata->dev))
+                        res = ieee80211_if_config(sdata, IEEE80211_IFCC_SSID);
+                if (res) {
+                        printk(KERN_DEBUG "%s: Failed to config new SSID to "
+                               "the low-level driver\n", sdata->dev->name);
+                        return res;
                 }
-                return rc;
         }
 
-        local->sta_sw_scanning = 1;
+        if (len)
+                ifsta->flags |= IEEE80211_STA_SSID_SET;
+        else
+                ifsta->flags &= ~IEEE80211_STA_SSID_SET;
 
-        rcu_read_lock();
-        list_for_each_entry_rcu(sdata, &local->interfaces, list) {
-                netif_stop_queue(sdata->dev);
-                if (sdata->vif.type == IEEE80211_IF_TYPE_STA &&
-                    (sdata->u.sta.flags & IEEE80211_STA_ASSOCIATED))
-                        ieee80211_send_nullfunc(local, sdata, 1);
+        if (sdata->vif.type == NL80211_IFTYPE_ADHOC &&
+            !(ifsta->flags & IEEE80211_STA_BSSID_SET)) {
+                ifsta->ibss_join_req = jiffies;
+                ifsta->state = IEEE80211_STA_MLME_IBSS_SEARCH;
+                return ieee80211_sta_find_ibss(sdata, ifsta);
         }
-        rcu_read_unlock();
-
-        if (ssid) {
-                local->scan_ssid_len = ssid_len;
-                memcpy(local->scan_ssid, ssid, ssid_len);
-        } else
-                local->scan_ssid_len = 0;
-        local->scan_state = SCAN_SET_CHANNEL;
-        local->scan_channel_idx = 0;
-        local->scan_band = IEEE80211_BAND_2GHZ;
-        local->scan_dev = dev;
-
-        netif_addr_lock_bh(local->mdev);
-        local->filter_flags |= FIF_BCN_PRBRESP_PROMISC;
-        local->ops->configure_filter(local_to_hw(local),
-                                     FIF_BCN_PRBRESP_PROMISC,
-                                     &local->filter_flags,
-                                     local->mdev->mc_count,
-                                     local->mdev->mc_list);
-        netif_addr_unlock_bh(local->mdev);
-
-        /* TODO: start scan as soon as all nullfunc frames are ACKed */
-        queue_delayed_work(local->hw.workqueue, &local->scan_work,
-                           IEEE80211_CHANNEL_TIME);
 
         return 0;
 }
 
-
-int ieee80211_sta_req_scan(struct net_device *dev, u8 *ssid, size_t ssid_len)
+int ieee80211_sta_get_ssid(struct ieee80211_sub_if_data *sdata, char *ssid, size_t *len)
 {
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-
-        if (sdata->vif.type != IEEE80211_IF_TYPE_STA)
-                return ieee80211_sta_start_scan(dev, ssid, ssid_len);
-
-        if (local->sta_sw_scanning || local->sta_hw_scanning) {
-                if (local->scan_dev == dev)
-                        return 0;
-                return -EBUSY;
-        }
-
-        ifsta->scan_ssid_len = ssid_len;
-        if (ssid_len)
-                memcpy(ifsta->scan_ssid, ssid, ssid_len);
-        set_bit(IEEE80211_STA_REQ_SCAN, &ifsta->request);
-        queue_work(local->hw.workqueue, &ifsta->work);
+        memcpy(ssid, ifsta->ssid, ifsta->ssid_len);
+        *len = ifsta->ssid_len;
         return 0;
 }
 
-static char *
-ieee80211_sta_scan_result(struct net_device *dev,
-                          struct iw_request_info *info,
-                          struct ieee80211_sta_bss *bss,
-                          char *current_ev, char *end_buf)
+int ieee80211_sta_set_bssid(struct ieee80211_sub_if_data *sdata, u8 *bssid)
 {
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        struct iw_event iwe;
-
-        if (time_after(jiffies,
-                       bss->last_update + IEEE80211_SCAN_RESULT_EXPIRE))
-                return current_ev;
-
-        memset(&iwe, 0, sizeof(iwe));
-        iwe.cmd = SIOCGIWAP;
-        iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
-        memcpy(iwe.u.ap_addr.sa_data, bss->bssid, ETH_ALEN);
-        current_ev = iwe_stream_add_event(info, current_ev, end_buf, &iwe,
-                                          IW_EV_ADDR_LEN);
-
-        memset(&iwe, 0, sizeof(iwe));
-        iwe.cmd = SIOCGIWESSID;
-        if (bss_mesh_cfg(bss)) {
-                iwe.u.data.length = bss_mesh_id_len(bss);
-                iwe.u.data.flags = 1;
-                current_ev = iwe_stream_add_point(info, current_ev, end_buf,
-                                                  &iwe, bss_mesh_id(bss));
-        } else {
-                iwe.u.data.length = bss->ssid_len;
-                iwe.u.data.flags = 1;
-                current_ev = iwe_stream_add_point(info, current_ev, end_buf,
-                                                  &iwe, bss->ssid);
-        }
-
-        if (bss->capability & (WLAN_CAPABILITY_ESS | WLAN_CAPABILITY_IBSS)
-            || bss_mesh_cfg(bss)) {
-                memset(&iwe, 0, sizeof(iwe));
-                iwe.cmd = SIOCGIWMODE;
-                if (bss_mesh_cfg(bss))
-                        iwe.u.mode = IW_MODE_MESH;
-                else if (bss->capability & WLAN_CAPABILITY_ESS)
-                        iwe.u.mode = IW_MODE_MASTER;
-                else
-                        iwe.u.mode = IW_MODE_ADHOC;
-                current_ev = iwe_stream_add_event(info, current_ev, end_buf,
-                                                  &iwe, IW_EV_UINT_LEN);
-        }
-
-        memset(&iwe, 0, sizeof(iwe));
-        iwe.cmd = SIOCGIWFREQ;
-        iwe.u.freq.m = ieee80211_frequency_to_channel(bss->freq);
-        iwe.u.freq.e = 0;
-        current_ev = iwe_stream_add_event(info, current_ev, end_buf, &iwe,
-                                          IW_EV_FREQ_LEN);
-
-        memset(&iwe, 0, sizeof(iwe));
-        iwe.cmd = SIOCGIWFREQ;
-        iwe.u.freq.m = bss->freq;
-        iwe.u.freq.e = 6;
-        current_ev = iwe_stream_add_event(info, current_ev, end_buf, &iwe,
-                                          IW_EV_FREQ_LEN);
-        memset(&iwe, 0, sizeof(iwe));
-        iwe.cmd = IWEVQUAL;
-        iwe.u.qual.qual = bss->qual;
-        iwe.u.qual.level = bss->signal;
-        iwe.u.qual.noise = bss->noise;
-        iwe.u.qual.updated = local->wstats_flags;
-        current_ev = iwe_stream_add_event(info, current_ev, end_buf, &iwe,
-                                          IW_EV_QUAL_LEN);
-
-        memset(&iwe, 0, sizeof(iwe));
-        iwe.cmd = SIOCGIWENCODE;
-        if (bss->capability & WLAN_CAPABILITY_PRIVACY)
-                iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
-        else
-                iwe.u.data.flags = IW_ENCODE_DISABLED;
-        iwe.u.data.length = 0;
-        current_ev = iwe_stream_add_point(info, current_ev, end_buf,
-                                          &iwe, "");
-
-        if (bss && bss->wpa_ie) {
-                memset(&iwe, 0, sizeof(iwe));
-                iwe.cmd = IWEVGENIE;
-                iwe.u.data.length = bss->wpa_ie_len;
-                current_ev = iwe_stream_add_point(info, current_ev, end_buf,
-                                                  &iwe, bss->wpa_ie);
-        }
-
-        if (bss && bss->rsn_ie) {
-                memset(&iwe, 0, sizeof(iwe));
-                iwe.cmd = IWEVGENIE;
-                iwe.u.data.length = bss->rsn_ie_len;
-                current_ev = iwe_stream_add_point(info, current_ev, end_buf,
-                                                  &iwe, bss->rsn_ie);
-        }
-
-        if (bss && bss->ht_ie) {
-                memset(&iwe, 0, sizeof(iwe));
-                iwe.cmd = IWEVGENIE;
-                iwe.u.data.length = bss->ht_ie_len;
-                current_ev = iwe_stream_add_point(info, current_ev, end_buf,
-                                                  &iwe, bss->ht_ie);
-        }
-
-        if (bss && bss->supp_rates_len > 0) {
-                /* display all supported rates in readable format */
-                char *p = current_ev + iwe_stream_lcp_len(info);
-                int i;
-
-                memset(&iwe, 0, sizeof(iwe));
-                iwe.cmd = SIOCGIWRATE;
-                /* Those two flags are ignored... */
-                iwe.u.bitrate.fixed = iwe.u.bitrate.disabled = 0;
-
-                for (i = 0; i < bss->supp_rates_len; i++) {
-                        iwe.u.bitrate.value = ((bss->supp_rates[i] &
-                                                        0x7f) * 500000);
-                        p = iwe_stream_add_value(info, current_ev, p,
-                                        end_buf, &iwe, IW_EV_PARAM_LEN);
-                }
-                current_ev = p;
-        }
+        struct ieee80211_if_sta *ifsta;
+        int res;
 
-        if (bss) {
-                char *buf;
-                buf = kmalloc(30, GFP_ATOMIC);
-                if (buf) {
-                        memset(&iwe, 0, sizeof(iwe));
-                        iwe.cmd = IWEVCUSTOM;
-                        sprintf(buf, "tsf=%016llx", (unsigned long long)(bss->timestamp));
-                        iwe.u.data.length = strlen(buf);
-                        current_ev = iwe_stream_add_point(info, current_ev,
-                                                          end_buf,
-                                                          &iwe, buf);
-                        memset(&iwe, 0, sizeof(iwe));
-                        iwe.cmd = IWEVCUSTOM;
-                        sprintf(buf, " Last beacon: %dms ago",
-                                jiffies_to_msecs(jiffies - bss->last_update));
-                        iwe.u.data.length = strlen(buf);
-                        current_ev = iwe_stream_add_point(info, current_ev,
-                                                          end_buf, &iwe, buf);
-                        kfree(buf);
-                }
-        }
+        ifsta = &sdata->u.sta;
 
-        if (bss_mesh_cfg(bss)) {
-                char *buf;
-                u8 *cfg = bss_mesh_cfg(bss);
-                buf = kmalloc(50, GFP_ATOMIC);
-                if (buf) {
-                        memset(&iwe, 0, sizeof(iwe));
-                        iwe.cmd = IWEVCUSTOM;
-                        sprintf(buf, "Mesh network (version %d)", cfg[0]);
-                        iwe.u.data.length = strlen(buf);
-                        current_ev = iwe_stream_add_point(info, current_ev,
-                                                          end_buf,
-                                                          &iwe, buf);
-                        sprintf(buf, "Path Selection Protocol ID: "
-                                "0x%02X%02X%02X%02X", cfg[1], cfg[2], cfg[3],
-                                                        cfg[4]);
-                        iwe.u.data.length = strlen(buf);
-                        current_ev = iwe_stream_add_point(info, current_ev,
-                                                          end_buf,
-                                                          &iwe, buf);
-                        sprintf(buf, "Path Selection Metric ID: "
-                                "0x%02X%02X%02X%02X", cfg[5], cfg[6], cfg[7],
-                                                        cfg[8]);
-                        iwe.u.data.length = strlen(buf);
-                        current_ev = iwe_stream_add_point(info, current_ev,
-                                                          end_buf,
-                                                          &iwe, buf);
-                        sprintf(buf, "Congestion Control Mode ID: "
-                                "0x%02X%02X%02X%02X", cfg[9], cfg[10],
-                                                        cfg[11], cfg[12]);
-                        iwe.u.data.length = strlen(buf);
-                        current_ev = iwe_stream_add_point(info, current_ev,
-                                                          end_buf,
-                                                          &iwe, buf);
-                        sprintf(buf, "Channel Precedence: "
-                                "0x%02X%02X%02X%02X", cfg[13], cfg[14],
-                                                        cfg[15], cfg[16]);
-                        iwe.u.data.length = strlen(buf);
-                        current_ev = iwe_stream_add_point(info, current_ev,
-                                                          end_buf,
-                                                          &iwe, buf);
-                        kfree(buf);
+        if (memcmp(ifsta->bssid, bssid, ETH_ALEN) != 0) {
+                memcpy(ifsta->bssid, bssid, ETH_ALEN);
+                res = 0;
+                /*
+                 * Hack! See also ieee80211_sta_set_ssid.
+                 */
+                if (netif_running(sdata->dev))
+                        res = ieee80211_if_config(sdata, IEEE80211_IFCC_BSSID);
+                if (res) {
+                        printk(KERN_DEBUG "%s: Failed to config new BSSID to "
+                               "the low-level driver\n", sdata->dev->name);
+                        return res;
                 }
         }
 
-        return current_ev;
-}
-
+        if (is_valid_ether_addr(bssid))
+                ifsta->flags |= IEEE80211_STA_BSSID_SET;
+        else
+                ifsta->flags &= ~IEEE80211_STA_BSSID_SET;
 
-int ieee80211_sta_scan_results(struct net_device *dev,
-                               struct iw_request_info *info,
-                               char *buf, size_t len)
-{
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        char *current_ev = buf;
-        char *end_buf = buf + len;
-        struct ieee80211_sta_bss *bss;
-
-        spin_lock_bh(&local->sta_bss_lock);
-        list_for_each_entry(bss, &local->sta_bss_list, list) {
-                if (buf + len - current_ev <= IW_EV_ADDR_LEN) {
-                        spin_unlock_bh(&local->sta_bss_lock);
-                        return -E2BIG;
-                }
-                current_ev = ieee80211_sta_scan_result(dev, info, bss,
-                                                       current_ev, end_buf);
-        }
-        spin_unlock_bh(&local->sta_bss_lock);
-        return current_ev - buf;
+        return 0;
 }
 
-
-int ieee80211_sta_set_extra_ie(struct net_device *dev, char *ie, size_t len)
+int ieee80211_sta_set_extra_ie(struct ieee80211_sub_if_data *sdata, char *ie, size_t len)
 {
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
 
         kfree(ifsta->extra_ie);
@@ -4365,92 +2478,60 @@ int ieee80211_sta_set_extra_ie(struct net_device *dev, char *ie, size_t len)
         return 0;
 }
 
-
-struct sta_info *ieee80211_ibss_add_sta(struct net_device *dev,
-                                        struct sk_buff *skb, u8 *bssid,
-                                        u8 *addr, u64 supp_rates)
-{
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        struct sta_info *sta;
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        DECLARE_MAC_BUF(mac);
-        int band = local->hw.conf.channel->band;
-
-        /* TODO: Could consider removing the least recently used entry and
-         * allow new one to be added. */
-        if (local->num_sta >= IEEE80211_IBSS_MAX_STA_ENTRIES) {
-                if (net_ratelimit()) {
-                        printk(KERN_DEBUG "%s: No room for a new IBSS STA "
-                               "entry %s\n", dev->name, print_mac(mac, addr));
-                }
-                return NULL;
-        }
-
-        if (compare_ether_addr(bssid, sdata->u.sta.bssid))
-                return NULL;
-
-#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
-        printk(KERN_DEBUG "%s: Adding new IBSS station %s (dev=%s)\n",
-               wiphy_name(local->hw.wiphy), print_mac(mac, addr), dev->name);
-#endif
-
-        sta = sta_info_alloc(sdata, addr, GFP_ATOMIC);
-        if (!sta)
-                return NULL;
-
-        set_sta_flags(sta, WLAN_STA_AUTHORIZED);
-
-        if (supp_rates)
-                sta->supp_rates[band] = supp_rates;
-        else
-                sta->supp_rates[band] = sdata->u.sta.supp_rates_bits[band];
-
-        rate_control_rate_init(sta, local);
-
-        if (sta_info_insert(sta))
-                return NULL;
-
-        return sta;
-}
-
-
-int ieee80211_sta_deauthenticate(struct net_device *dev, u16 reason)
+int ieee80211_sta_deauthenticate(struct ieee80211_sub_if_data *sdata, u16 reason)
 {
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
 
         printk(KERN_DEBUG "%s: deauthenticating by local choice (reason=%d)\n",
-               dev->name, reason);
+               sdata->dev->name, reason);
 
-        if (sdata->vif.type != IEEE80211_IF_TYPE_STA &&
-            sdata->vif.type != IEEE80211_IF_TYPE_IBSS)
+        if (sdata->vif.type != NL80211_IFTYPE_STATION &&
+            sdata->vif.type != NL80211_IFTYPE_ADHOC)
                 return -EINVAL;
 
-        ieee80211_send_deauth(dev, ifsta, reason);
-        ieee80211_set_disassoc(dev, ifsta, 1);
+        ieee80211_set_disassoc(sdata, ifsta, true, true, reason);
         return 0;
 }
 
-
-int ieee80211_sta_disassociate(struct net_device *dev, u16 reason)
+int ieee80211_sta_disassociate(struct ieee80211_sub_if_data *sdata, u16 reason)
 {
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
 
         printk(KERN_DEBUG "%s: disassociating by local choice (reason=%d)\n",
-               dev->name, reason);
+               sdata->dev->name, reason);
 
-        if (sdata->vif.type != IEEE80211_IF_TYPE_STA)
+        if (sdata->vif.type != NL80211_IFTYPE_STATION)
                 return -EINVAL;
 
         if (!(ifsta->flags & IEEE80211_STA_ASSOCIATED))
                 return -1;
 
-        ieee80211_send_disassoc(dev, ifsta, reason);
-        ieee80211_set_disassoc(dev, ifsta, 0);
+        ieee80211_set_disassoc(sdata, ifsta, false, true, reason);
         return 0;
 }
 
+/* scan finished notification */
+void ieee80211_mlme_notify_scan_completed(struct ieee80211_local *local)
+{
+        struct ieee80211_sub_if_data *sdata = local->scan_sdata;
+        struct ieee80211_if_sta *ifsta;
+
+        if (sdata && sdata->vif.type == NL80211_IFTYPE_ADHOC) {
+                ifsta = &sdata->u.sta;
+                if (!(ifsta->flags & IEEE80211_STA_BSSID_SET) ||
+                    (!(ifsta->state == IEEE80211_STA_MLME_IBSS_JOINED) &&
+                    !ieee80211_sta_active_ibss(sdata)))
+                        ieee80211_sta_find_ibss(sdata, ifsta);
+        }
+
+        /* Restart STA timers */
+        rcu_read_lock();
+        list_for_each_entry_rcu(sdata, &local->interfaces, list)
+                ieee80211_restart_sta_timer(sdata);
+        rcu_read_unlock();
+}
+
+/* driver notification call */
 void ieee80211_notify_mac(struct ieee80211_hw *hw,
                           enum ieee80211_notification_types  notif_type)
 {
@@ -4461,10 +2542,10 @@ void ieee80211_notify_mac(struct ieee80211_hw *hw,
         case IEEE80211_NOTIFY_RE_ASSOC:
                 rcu_read_lock();
                 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
-                        if (sdata->vif.type != IEEE80211_IF_TYPE_STA)
+                        if (sdata->vif.type != NL80211_IFTYPE_STATION)
                                 continue;
 
-                        ieee80211_sta_req_auth(sdata->dev, &sdata->u.sta);
+                        ieee80211_sta_req_auth(sdata, &sdata->u.sta);
                 }
                 rcu_read_unlock();
                 break;
diff --git a/net/mac80211/rate.c b/net/mac80211/rate.c
index 0388c090dfe9..5d786720d935 100644
--- a/net/mac80211/rate.c
+++ b/net/mac80211/rate.c
@@ -12,6 +12,7 @@
 #include <linux/rtnetlink.h>
 #include "rate.h"
 #include "ieee80211_i.h"
+#include "debugfs.h"
 
 struct rate_control_alg {
         struct list_head list;
@@ -127,19 +128,46 @@ static void ieee80211_rate_control_ops_put(struct rate_control_ops *ops)
         module_put(ops->module);
 }
 
+#ifdef CONFIG_MAC80211_DEBUGFS
+static ssize_t rcname_read(struct file *file, char __user *userbuf,
+                           size_t count, loff_t *ppos)
+{
+        struct rate_control_ref *ref = file->private_data;
+        int len = strlen(ref->ops->name);
+
+        return simple_read_from_buffer(userbuf, count, ppos,
+                                       ref->ops->name, len);
+}
+
+static const struct file_operations rcname_ops = {
+        .read = rcname_read,
+        .open = mac80211_open_file_generic,
+};
+#endif
+
 struct rate_control_ref *rate_control_alloc(const char *name,
                                             struct ieee80211_local *local)
 {
+        struct dentry *debugfsdir = NULL;
         struct rate_control_ref *ref;
 
         ref = kmalloc(sizeof(struct rate_control_ref), GFP_KERNEL);
         if (!ref)
                 goto fail_ref;
         kref_init(&ref->kref);
+        ref->local = local;
         ref->ops = ieee80211_rate_control_ops_get(name);
         if (!ref->ops)
                 goto fail_ops;
-        ref->priv = ref->ops->alloc(local);
+
+#ifdef CONFIG_MAC80211_DEBUGFS
+        debugfsdir = debugfs_create_dir("rc", local->hw.wiphy->debugfsdir);
+        local->debugfs.rcdir = debugfsdir;
+        local->debugfs.rcname = debugfs_create_file("name", 0400, debugfsdir,
+                                                    ref, &rcname_ops);
+#endif
+
+        ref->priv = ref->ops->alloc(&local->hw, debugfsdir);
         if (!ref->priv)
                 goto fail_priv;
         return ref;
@@ -158,29 +186,46 @@ static void rate_control_release(struct kref *kref)
 
         ctrl_ref = container_of(kref, struct rate_control_ref, kref);
         ctrl_ref->ops->free(ctrl_ref->priv);
+
+#ifdef CONFIG_MAC80211_DEBUGFS
+        debugfs_remove(ctrl_ref->local->debugfs.rcname);
+        ctrl_ref->local->debugfs.rcname = NULL;
+        debugfs_remove(ctrl_ref->local->debugfs.rcdir);
+        ctrl_ref->local->debugfs.rcdir = NULL;
+#endif
+
         ieee80211_rate_control_ops_put(ctrl_ref->ops);
         kfree(ctrl_ref);
 }
 
-void rate_control_get_rate(struct net_device *dev,
+void rate_control_get_rate(struct ieee80211_sub_if_data *sdata,
                            struct ieee80211_supported_band *sband,
-                           struct sk_buff *skb,
+                           struct sta_info *sta, struct sk_buff *skb,
                            struct rate_selection *sel)
 {
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        struct rate_control_ref *ref = local->rate_ctrl;
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
-        struct sta_info *sta;
+        struct rate_control_ref *ref = sdata->local->rate_ctrl;
+        void *priv_sta = NULL;
+        struct ieee80211_sta *ista = NULL;
         int i;
 
-        rcu_read_lock();
-        sta = sta_info_get(local, hdr->addr1);
-
         sel->rate_idx = -1;
         sel->nonerp_idx = -1;
         sel->probe_idx = -1;
+        sel->max_rate_idx = sdata->max_ratectrl_rateidx;
+
+        if (sta) {
+                ista = &sta->sta;
+                priv_sta = sta->rate_ctrl_priv;
+        }
+
+        if (sta && sdata->force_unicast_rateidx > -1)
+                sel->rate_idx = sdata->force_unicast_rateidx;
+        else
+                ref->ops->get_rate(ref->priv, sband, ista, priv_sta, skb, sel);
 
-        ref->ops->get_rate(ref->priv, dev, sband, skb, sel);
+        if (sdata->max_ratectrl_rateidx > -1 &&
+            sel->rate_idx > sdata->max_ratectrl_rateidx)
+                sel->rate_idx = sdata->max_ratectrl_rateidx;
 
         BUG_ON(sel->rate_idx < 0);
 
@@ -191,13 +236,11 @@ void rate_control_get_rate(struct net_device *dev,
                         if (sband->bitrates[sel->rate_idx].bitrate < rate->bitrate)
                                 break;
 
-                        if (rate_supported(sta, sband->band, i) &&
+                        if (rate_supported(ista, sband->band, i) &&
                             !(rate->flags & IEEE80211_RATE_ERP_G))
                                 sel->nonerp_idx = i;
                 }
         }
-
-        rcu_read_unlock();
 }
 
 struct rate_control_ref *rate_control_get(struct rate_control_ref *ref)
diff --git a/net/mac80211/rate.h b/net/mac80211/rate.h
index ede7ab56f65b..eb94e584d24e 100644
--- a/net/mac80211/rate.h
+++ b/net/mac80211/rate.h
@@ -19,77 +19,48 @@
 #include "ieee80211_i.h"
 #include "sta_info.h"
 
-/**
- * struct rate_selection - rate selection for rate control algos
- * @rate: selected transmission rate index
- * @nonerp: Non-ERP rate to use instead if ERP cannot be used
- * @probe: rate for probing (or -1)
- *
- */
-struct rate_selection {
-        s8 rate_idx, nonerp_idx, probe_idx;
-};
-
-struct rate_control_ops {
-        struct module *module;
-        const char *name;
-        void (*tx_status)(void *priv, struct net_device *dev,
-                          struct sk_buff *skb);
-        void (*get_rate)(void *priv, struct net_device *dev,
-                         struct ieee80211_supported_band *band,
-                         struct sk_buff *skb,
-                         struct rate_selection *sel);
-        void (*rate_init)(void *priv, void *priv_sta,
-                          struct ieee80211_local *local, struct sta_info *sta);
-        void (*clear)(void *priv);
-
-        void *(*alloc)(struct ieee80211_local *local);
-        void (*free)(void *priv);
-        void *(*alloc_sta)(void *priv, gfp_t gfp);
-        void (*free_sta)(void *priv, void *priv_sta);
-
-        int (*add_attrs)(void *priv, struct kobject *kobj);
-        void (*remove_attrs)(void *priv, struct kobject *kobj);
-        void (*add_sta_debugfs)(void *priv, void *priv_sta,
-                                struct dentry *dir);
-        void (*remove_sta_debugfs)(void *priv, void *priv_sta);
-};
-
 struct rate_control_ref {
+        struct ieee80211_local *local;
         struct rate_control_ops *ops;
         void *priv;
         struct kref kref;
 };
 
-int ieee80211_rate_control_register(struct rate_control_ops *ops);
-void ieee80211_rate_control_unregister(struct rate_control_ops *ops);
-
 /* Get a reference to the rate control algorithm. If `name' is NULL, get the
  * first available algorithm. */
 struct rate_control_ref *rate_control_alloc(const char *name,
                                             struct ieee80211_local *local);
-void rate_control_get_rate(struct net_device *dev,
+void rate_control_get_rate(struct ieee80211_sub_if_data *sdata,
                            struct ieee80211_supported_band *sband,
-                           struct sk_buff *skb,
+                           struct sta_info *sta, struct sk_buff *skb,
                            struct rate_selection *sel);
 struct rate_control_ref *rate_control_get(struct rate_control_ref *ref);
 void rate_control_put(struct rate_control_ref *ref);
 
-static inline void rate_control_tx_status(struct net_device *dev,
+static inline void rate_control_tx_status(struct ieee80211_local *local,
+                                          struct ieee80211_supported_band *sband,
+                                          struct sta_info *sta,
                                           struct sk_buff *skb)
 {
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
         struct rate_control_ref *ref = local->rate_ctrl;
+        struct ieee80211_sta *ista = &sta->sta;
+        void *priv_sta = sta->rate_ctrl_priv;
 
-        ref->ops->tx_status(ref->priv, dev, skb);
+        ref->ops->tx_status(ref->priv, sband, ista, priv_sta, skb);
 }
 
 
-static inline void rate_control_rate_init(struct sta_info *sta,
-                                          struct ieee80211_local *local)
+static inline void rate_control_rate_init(struct sta_info *sta)
 {
+        struct ieee80211_local *local = sta->sdata->local;
         struct rate_control_ref *ref = sta->rate_ctrl;
-        ref->ops->rate_init(ref->priv, sta->rate_ctrl_priv, local, sta);
+        struct ieee80211_sta *ista = &sta->sta;
+        void *priv_sta = sta->rate_ctrl_priv;
+        struct ieee80211_supported_band *sband;
+
+        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
+
+        ref->ops->rate_init(ref->priv, sband, ista, priv_sta);
 }
 
 
@@ -100,15 +71,19 @@ static inline void rate_control_clear(struct ieee80211_local *local)
 }
 
 static inline void *rate_control_alloc_sta(struct rate_control_ref *ref,
+                                           struct ieee80211_sta *sta,
                                            gfp_t gfp)
 {
-        return ref->ops->alloc_sta(ref->priv, gfp);
+        return ref->ops->alloc_sta(ref->priv, sta, gfp);
 }
 
-static inline void rate_control_free_sta(struct rate_control_ref *ref,
-                                         void *priv)
+static inline void rate_control_free_sta(struct sta_info *sta)
 {
-        ref->ops->free_sta(ref->priv, priv);
+        struct rate_control_ref *ref = sta->rate_ctrl;
+        struct ieee80211_sta *ista = &sta->sta;
+        void *priv_sta = sta->rate_ctrl_priv;
+
+        ref->ops->free_sta(ref->priv, ista, priv_sta);
 }
 
 static inline void rate_control_add_sta_debugfs(struct sta_info *sta)
@@ -130,31 +105,6 @@ static inline void rate_control_remove_sta_debugfs(struct sta_info *sta)
 #endif
 }
 
-static inline int rate_supported(struct sta_info *sta,
-                                 enum ieee80211_band band,
-                                 int index)
-{
-        return (sta == NULL || sta->supp_rates[band] & BIT(index));
-}
-
-static inline s8
-rate_lowest_index(struct ieee80211_local *local,
-                  struct ieee80211_supported_band *sband,
-                  struct sta_info *sta)
-{
-        int i;
-
-        for (i = 0; i < sband->n_bitrates; i++)
-                if (rate_supported(sta, sband->band, i))
-                        return i;
-
-        /* warn when we cannot find a rate. */
-        WARN_ON(1);
-
-        return 0;
-}
-
-
 /* functions for rate control related to a device */
 int ieee80211_init_rate_ctrl_alg(struct ieee80211_local *local,
                                  const char *name);
diff --git a/net/mac80211/rc80211_pid.h b/net/mac80211/rc80211_pid.h
index 0a9135b974b5..01d64d53f3b9 100644
--- a/net/mac80211/rc80211_pid.h
+++ b/net/mac80211/rc80211_pid.h
@@ -124,7 +124,6 @@ struct rc_pid_events_file_info {
  * struct rc_pid_debugfs_entries - tunable parameters
  *
  * Algorithm parameters, tunable via debugfs.
- * @dir: the debugfs directory for a specific phy
  * @target: target percentage for failed frames
  * @sampling_period: error sampling interval in milliseconds
  * @coeff_p: absolute value of the proportional coefficient
@@ -143,7 +142,6 @@ struct rc_pid_events_file_info {
  *      ordering of rates)
  */
 struct rc_pid_debugfs_entries {
-        struct dentry *dir;
         struct dentry *target;
         struct dentry *sampling_period;
         struct dentry *coeff_p;
@@ -180,6 +178,8 @@ struct rc_pid_sta_info {
         u32 tx_num_failed;
         u32 tx_num_xmit;
 
+        int txrate_idx;
+
         /* Average failed frames percentage error (i.e. actual vs. target
          * percentage), scaled by RC_PID_SMOOTHING. This value is computed
          * using using an exponential weighted average technique:
diff --git a/net/mac80211/rc80211_pid_algo.c b/net/mac80211/rc80211_pid_algo.c
index a914ba73ccf5..86eb374e3b87 100644
--- a/net/mac80211/rc80211_pid_algo.c
+++ b/net/mac80211/rc80211_pid_algo.c
@@ -68,17 +68,14 @@
  * exhibited a worse failed frames behaviour and we'll choose the highest rate
  * whose failed frames behaviour is not worse than the one of the original rate
  * target. While at it, check that the new rate is valid. */
-static void rate_control_pid_adjust_rate(struct ieee80211_local *local,
-                                         struct sta_info *sta, int adj,
+static void rate_control_pid_adjust_rate(struct ieee80211_supported_band *sband,
+                                         struct ieee80211_sta *sta,
+                                         struct rc_pid_sta_info *spinfo, int adj,
                                          struct rc_pid_rateinfo *rinfo)
 {
-        struct ieee80211_sub_if_data *sdata;
-        struct ieee80211_supported_band *sband;
         int cur_sorted, new_sorted, probe, tmp, n_bitrates, band;
-        int cur = sta->txrate_idx;
+        int cur = spinfo->txrate_idx;
 
-        sdata = sta->sdata;
-        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
         band = sband->band;
         n_bitrates = sband->n_bitrates;
 
@@ -111,7 +108,7 @@ static void rate_control_pid_adjust_rate(struct ieee80211_local *local,
         /* Fit the rate found to the nearest supported rate. */
         do {
                 if (rate_supported(sta, band, rinfo[tmp].index)) {
-                        sta->txrate_idx = rinfo[tmp].index;
+                        spinfo->txrate_idx = rinfo[tmp].index;
                         break;
                 }
                 if (adj < 0)
@@ -121,9 +118,9 @@ static void rate_control_pid_adjust_rate(struct ieee80211_local *local,
         } while (tmp < n_bitrates && tmp >= 0);
 
 #ifdef CONFIG_MAC80211_DEBUGFS
-        rate_control_pid_event_rate_change(
-                &((struct rc_pid_sta_info *)sta->rate_ctrl_priv)->events,
-                sta->txrate_idx, sband->bitrates[sta->txrate_idx].bitrate);
+        rate_control_pid_event_rate_change(&spinfo->events,
+                spinfo->txrate_idx,
+                sband->bitrates[spinfo->txrate_idx].bitrate);
 #endif
 }
 
@@ -145,15 +142,11 @@ static void rate_control_pid_normalize(struct rc_pid_info *pinfo, int l)
 }
 
 static void rate_control_pid_sample(struct rc_pid_info *pinfo,
-                                    struct ieee80211_local *local,
-                                    struct sta_info *sta)
+                                    struct ieee80211_supported_band *sband,
+                                    struct ieee80211_sta *sta,
+                                    struct rc_pid_sta_info *spinfo)
 {
-#ifdef CONFIG_MAC80211_MESH
-        struct ieee80211_sub_if_data *sdata = sta->sdata;
-#endif
-        struct rc_pid_sta_info *spinfo = sta->rate_ctrl_priv;
         struct rc_pid_rateinfo *rinfo = pinfo->rinfo;
-        struct ieee80211_supported_band *sband;
         u32 pf;
         s32 err_avg;
         u32 err_prop;
@@ -162,9 +155,6 @@ static void rate_control_pid_sample(struct rc_pid_info *pinfo,
         int adj, i, j, tmp;
         unsigned long period;
 
-        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
-        spinfo = sta->rate_ctrl_priv;
-
         /* In case nothing happened during the previous control interval, turn
          * the sharpening factor on. */
         period = (HZ * pinfo->sampling_period + 500) / 1000;
@@ -180,14 +170,15 @@ static void rate_control_pid_sample(struct rc_pid_info *pinfo,
         if (unlikely(spinfo->tx_num_xmit == 0))
                 pf = spinfo->last_pf;
         else {
+                /* XXX: BAD HACK!!! */
+                struct sta_info *si = container_of(sta, struct sta_info, sta);
+
                 pf = spinfo->tx_num_failed * 100 / spinfo->tx_num_xmit;
-#ifdef CONFIG_MAC80211_MESH
-                if (pf == 100 &&
-                    sdata->vif.type == IEEE80211_IF_TYPE_MESH_POINT)
-                        mesh_plink_broken(sta);
-#endif
+
+                if (ieee80211_vif_is_mesh(&si->sdata->vif) && pf == 100)
+                        mesh_plink_broken(si);
                 pf <<= RC_PID_ARITH_SHIFT;
-                sta->fail_avg = ((pf + (spinfo->last_pf << 3)) / 9)
+                si->fail_avg = ((pf + (spinfo->last_pf << 3)) / 9)
                                         >> RC_PID_ARITH_SHIFT;
         }
 
@@ -195,16 +186,16 @@ static void rate_control_pid_sample(struct rc_pid_info *pinfo,
         spinfo->tx_num_failed = 0;
 
         /* If we just switched rate, update the rate behaviour info. */
-        if (pinfo->oldrate != sta->txrate_idx) {
+        if (pinfo->oldrate != spinfo->txrate_idx) {
 
                 i = rinfo[pinfo->oldrate].rev_index;
-                j = rinfo[sta->txrate_idx].rev_index;
+                j = rinfo[spinfo->txrate_idx].rev_index;
 
                 tmp = (pf - spinfo->last_pf);
                 tmp = RC_PID_DO_ARITH_RIGHT_SHIFT(tmp, RC_PID_ARITH_SHIFT);
 
                 rinfo[j].diff = rinfo[i].diff + tmp;
-                pinfo->oldrate = sta->txrate_idx;
+                pinfo->oldrate = spinfo->txrate_idx;
         }
         rate_control_pid_normalize(pinfo, sband->n_bitrates);
 
@@ -233,43 +224,26 @@ static void rate_control_pid_sample(struct rc_pid_info *pinfo,
 
         /* Change rate. */
         if (adj)
-                rate_control_pid_adjust_rate(local, sta, adj, rinfo);
+                rate_control_pid_adjust_rate(sband, sta, spinfo, adj, rinfo);
 }
 
-static void rate_control_pid_tx_status(void *priv, struct net_device *dev,
+static void rate_control_pid_tx_status(void *priv, struct ieee80211_supported_band *sband,
+                                       struct ieee80211_sta *sta, void *priv_sta,
                                        struct sk_buff *skb)
 {
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
-        struct ieee80211_sub_if_data *sdata;
         struct rc_pid_info *pinfo = priv;
-        struct sta_info *sta;
-        struct rc_pid_sta_info *spinfo;
+        struct rc_pid_sta_info *spinfo = priv_sta;
         unsigned long period;
-        struct ieee80211_supported_band *sband;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 
-        rcu_read_lock();
-
-        sta = sta_info_get(local, hdr->addr1);
-        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
-
-        if (!sta)
-                goto unlock;
-
-        /* Don't update the state if we're not controlling the rate. */
-        sdata = sta->sdata;
-        if (sdata->force_unicast_rateidx > -1) {
-                sta->txrate_idx = sdata->max_ratectrl_rateidx;
-                goto unlock;
-        }
+        if (!spinfo)
+                return;
 
         /* Ignore all frames that were sent with a different rate than the rate
          * we currently advise mac80211 to use. */
-        if (info->tx_rate_idx != sta->txrate_idx)
-                goto unlock;
+        if (info->tx_rate_idx != spinfo->txrate_idx)
+                return;
 
-        spinfo = sta->rate_ctrl_priv;
         spinfo->tx_num_xmit++;
 
 #ifdef CONFIG_MAC80211_DEBUGFS
@@ -287,93 +261,68 @@ static void rate_control_pid_tx_status(void *priv, struct net_device *dev,
                 spinfo->tx_num_xmit++;
         }
 
-        if (info->status.excessive_retries) {
-                sta->tx_retry_failed++;
-                sta->tx_num_consecutive_failures++;
-                sta->tx_num_mpdu_fail++;
-        } else {
-                sta->tx_num_consecutive_failures = 0;
-                sta->tx_num_mpdu_ok++;
-        }
-        sta->tx_retry_count += info->status.retry_count;
-        sta->tx_num_mpdu_fail += info->status.retry_count;
-
         /* Update PID controller state. */
         period = (HZ * pinfo->sampling_period + 500) / 1000;
         if (!period)
                 period = 1;
         if (time_after(jiffies, spinfo->last_sample + period))
-                rate_control_pid_sample(pinfo, local, sta);
-
- unlock:
-        rcu_read_unlock();
+                rate_control_pid_sample(pinfo, sband, sta, spinfo);
 }
 
-static void rate_control_pid_get_rate(void *priv, struct net_device *dev,
-                                      struct ieee80211_supported_band *sband,
-                                      struct sk_buff *skb,
-                                      struct rate_selection *sel)
+static void
+rate_control_pid_get_rate(void *priv, struct ieee80211_supported_band *sband,
+                          struct ieee80211_sta *sta, void *priv_sta,
+                          struct sk_buff *skb,
+                          struct rate_selection *sel)
 {
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
-        struct ieee80211_sub_if_data *sdata;
-        struct sta_info *sta;
+        struct rc_pid_sta_info *spinfo = priv_sta;
         int rateidx;
         u16 fc;
 
-        rcu_read_lock();
-
-        sta = sta_info_get(local, hdr->addr1);
-
         /* Send management frames and broadcast/multicast data using lowest
          * rate. */
         fc = le16_to_cpu(hdr->frame_control);
-        if ((fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA ||
-            is_multicast_ether_addr(hdr->addr1) || !sta) {
-                sel->rate_idx = rate_lowest_index(local, sband, sta);
-                rcu_read_unlock();
+        if (!sta || !spinfo ||
+            (fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA ||
+            is_multicast_ether_addr(hdr->addr1)) {
+                sel->rate_idx = rate_lowest_index(sband, sta);
                 return;
         }
 
-        /* If a forced rate is in effect, select it. */
-        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        if (sdata->force_unicast_rateidx > -1)
-                sta->txrate_idx = sdata->force_unicast_rateidx;
-
-        rateidx = sta->txrate_idx;
+        rateidx = spinfo->txrate_idx;
 
         if (rateidx >= sband->n_bitrates)
                 rateidx = sband->n_bitrates - 1;
 
-        sta->last_txrate_idx = rateidx;
-
-        rcu_read_unlock();
-
         sel->rate_idx = rateidx;
 
 #ifdef CONFIG_MAC80211_DEBUGFS
-        rate_control_pid_event_tx_rate(
-                &((struct rc_pid_sta_info *) sta->rate_ctrl_priv)->events,
+        rate_control_pid_event_tx_rate(&spinfo->events,
                 rateidx, sband->bitrates[rateidx].bitrate);
 #endif
 }
 
-static void rate_control_pid_rate_init(void *priv, void *priv_sta,
-                                          struct ieee80211_local *local,
-                                          struct sta_info *sta)
+static void
+rate_control_pid_rate_init(void *priv, struct ieee80211_supported_band *sband,
+                           struct ieee80211_sta *sta, void *priv_sta)
 {
+        struct rc_pid_sta_info *spinfo = priv_sta;
+        struct sta_info *si;
+
         /* TODO: This routine should consider using RSSI from previous packets
          * as we need to have IEEE 802.1X auth succeed immediately after assoc..
          * Until that method is implemented, we will use the lowest supported
          * rate as a workaround. */
-        struct ieee80211_supported_band *sband;
 
-        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
-        sta->txrate_idx = rate_lowest_index(local, sband, sta);
-        sta->fail_avg = 0;
+        spinfo->txrate_idx = rate_lowest_index(sband, sta);
+        /* HACK */
+        si = container_of(sta, struct sta_info, sta);
+        si->fail_avg = 0;
 }
 
-static void *rate_control_pid_alloc(struct ieee80211_local *local)
+static void *rate_control_pid_alloc(struct ieee80211_hw *hw,
+                                    struct dentry *debugfsdir)
 {
         struct rc_pid_info *pinfo;
         struct rc_pid_rateinfo *rinfo;
@@ -384,7 +333,7 @@ static void *rate_control_pid_alloc(struct ieee80211_local *local)
         struct rc_pid_debugfs_entries *de;
 #endif
 
-        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
+        sband = hw->wiphy->bands[hw->conf.channel->band];
 
         pinfo = kmalloc(sizeof(*pinfo), GFP_ATOMIC);
         if (!pinfo)
@@ -439,30 +388,28 @@ static void *rate_control_pid_alloc(struct ieee80211_local *local)
 
 #ifdef CONFIG_MAC80211_DEBUGFS
         de = &pinfo->dentries;
-        de->dir = debugfs_create_dir("rc80211_pid",
-                                     local->hw.wiphy->debugfsdir);
         de->target = debugfs_create_u32("target_pf", S_IRUSR | S_IWUSR,
-                                        de->dir, &pinfo->target);
+                                        debugfsdir, &pinfo->target);
         de->sampling_period = debugfs_create_u32("sampling_period",
-                                                 S_IRUSR | S_IWUSR, de->dir,
+                                                 S_IRUSR | S_IWUSR, debugfsdir,
                                                  &pinfo->sampling_period);
         de->coeff_p = debugfs_create_u32("coeff_p", S_IRUSR | S_IWUSR,
-                                         de->dir, &pinfo->coeff_p);
+                                         debugfsdir, &pinfo->coeff_p);
         de->coeff_i = debugfs_create_u32("coeff_i", S_IRUSR | S_IWUSR,
-                                         de->dir, &pinfo->coeff_i);
+                                         debugfsdir, &pinfo->coeff_i);
         de->coeff_d = debugfs_create_u32("coeff_d", S_IRUSR | S_IWUSR,
-                                         de->dir, &pinfo->coeff_d);
+                                         debugfsdir, &pinfo->coeff_d);
         de->smoothing_shift = debugfs_create_u32("smoothing_shift",
-                                                 S_IRUSR | S_IWUSR, de->dir,
+                                                 S_IRUSR | S_IWUSR, debugfsdir,
                                                  &pinfo->smoothing_shift);
         de->sharpen_factor = debugfs_create_u32("sharpen_factor",
-                                               S_IRUSR | S_IWUSR, de->dir,
+                                               S_IRUSR | S_IWUSR, debugfsdir,
                                                &pinfo->sharpen_factor);
         de->sharpen_duration = debugfs_create_u32("sharpen_duration",
-                                                  S_IRUSR | S_IWUSR, de->dir,
+                                                  S_IRUSR | S_IWUSR, debugfsdir,
                                                   &pinfo->sharpen_duration);
         de->norm_offset = debugfs_create_u32("norm_offset",
-                                             S_IRUSR | S_IWUSR, de->dir,
+                                             S_IRUSR | S_IWUSR, debugfsdir,
                                              &pinfo->norm_offset);
 #endif
 
@@ -484,7 +431,6 @@ static void rate_control_pid_free(void *priv)
         debugfs_remove(de->coeff_p);
         debugfs_remove(de->sampling_period);
         debugfs_remove(de->target);
-        debugfs_remove(de->dir);
 #endif
 
         kfree(pinfo->rinfo);
@@ -495,7 +441,8 @@ static void rate_control_pid_clear(void *priv)
 {
 }
 
-static void *rate_control_pid_alloc_sta(void *priv, gfp_t gfp)
+static void *rate_control_pid_alloc_sta(void *priv, struct ieee80211_sta *sta,
+                                        gfp_t gfp)
 {
         struct rc_pid_sta_info *spinfo;
 
@@ -513,10 +460,10 @@ static void *rate_control_pid_alloc_sta(void *priv, gfp_t gfp)
         return spinfo;
 }
 
-static void rate_control_pid_free_sta(void *priv, void *priv_sta)
+static void rate_control_pid_free_sta(void *priv, struct ieee80211_sta *sta,
+                                      void *priv_sta)
 {
-        struct rc_pid_sta_info *spinfo = priv_sta;
-        kfree(spinfo);
+        kfree(priv_sta);
 }
 
 static struct rate_control_ops mac80211_rcpid = {
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 6db854505193..77e7b014872b 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -143,6 +143,8 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
         /* IEEE80211_RADIOTAP_FLAGS */
         if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)
                 *pos |= IEEE80211_RADIOTAP_F_FCS;
+        if (status->flag & RX_FLAG_SHORTPRE)
+                *pos |= IEEE80211_RADIOTAP_F_SHORTPRE;
         pos++;
 
         /* IEEE80211_RADIOTAP_RATE */
@@ -155,8 +157,11 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
         if (status->band == IEEE80211_BAND_5GHZ)
                 *(__le16 *)pos = cpu_to_le16(IEEE80211_CHAN_OFDM |
                                              IEEE80211_CHAN_5GHZ);
+        else if (rate->flags & IEEE80211_RATE_ERP_G)
+                *(__le16 *)pos = cpu_to_le16(IEEE80211_CHAN_OFDM |
+                                             IEEE80211_CHAN_2GHZ);
         else
-                *(__le16 *)pos = cpu_to_le16(IEEE80211_CHAN_DYN |
+                *(__le16 *)pos = cpu_to_le16(IEEE80211_CHAN_CCK |
                                              IEEE80211_CHAN_2GHZ);
         pos += 2;
 
@@ -290,7 +295,7 @@ ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
                 if (!netif_running(sdata->dev))
                         continue;
 
-                if (sdata->vif.type != IEEE80211_IF_TYPE_MNTR)
+                if (sdata->vif.type != NL80211_IFTYPE_MONITOR)
                         continue;
 
                 if (sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES)
@@ -398,12 +403,12 @@ ieee80211_rx_h_passive_scan(struct ieee80211_rx_data *rx)
         struct ieee80211_local *local = rx->local;
         struct sk_buff *skb = rx->skb;
 
-        if (unlikely(local->sta_hw_scanning))
-                return ieee80211_sta_rx_scan(rx->dev, skb, rx->status);
+        if (unlikely(local->hw_scanning))
+                return ieee80211_scan_rx(rx->sdata, skb, rx->status);
 
-        if (unlikely(local->sta_sw_scanning)) {
+        if (unlikely(local->sw_scanning)) {
                 /* drop all the other packets during a software scan anyway */
-                if (ieee80211_sta_rx_scan(rx->dev, skb, rx->status)
+                if (ieee80211_scan_rx(rx->sdata, skb, rx->status)
                     != RX_QUEUED)
                         dev_kfree_skb(skb);
                 return RX_QUEUED;
@@ -461,7 +466,7 @@ ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
 
         if (ieee80211_is_data(hdr->frame_control) &&
             is_multicast_ether_addr(hdr->addr1) &&
-            mesh_rmc_check(hdr->addr4, msh_h_get(hdr, hdrlen), rx->dev))
+            mesh_rmc_check(hdr->addr4, msh_h_get(hdr, hdrlen), rx->sdata))
                 return RX_DROP_MONITOR;
 #undef msh_h_get
 
@@ -496,8 +501,8 @@ ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
         /* Drop disallowed frame classes based on STA auth/assoc state;
          * IEEE 802.11, Chap 5.5.
          *
-         * 80211.o does filtering only based on association state, i.e., it
-         * drops Class 3 frames from not associated stations. hostapd sends
+         * mac80211 filters only based on association state, i.e. it drops
+         * Class 3 frames from not associated stations. hostapd sends
          * deauth/disassoc frames when needed. In addition, hostapd is
          * responsible for filtering on both auth and assoc states.
          */
@@ -507,7 +512,7 @@ ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
 
         if (unlikely((ieee80211_is_data(hdr->frame_control) ||
                       ieee80211_is_pspoll(hdr->frame_control)) &&
-                     rx->sdata->vif.type != IEEE80211_IF_TYPE_IBSS &&
+                     rx->sdata->vif.type != NL80211_IFTYPE_ADHOC &&
                      (!rx->sta || !test_sta_flags(rx->sta, WLAN_STA_ASSOC)))) {
                 if ((!ieee80211_has_fromds(hdr->frame_control) &&
                      !ieee80211_has_tods(hdr->frame_control) &&
@@ -645,32 +650,28 @@ ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
         return result;
 }
 
-static void ap_sta_ps_start(struct net_device *dev, struct sta_info *sta)
+static void ap_sta_ps_start(struct sta_info *sta)
 {
-        struct ieee80211_sub_if_data *sdata;
+        struct ieee80211_sub_if_data *sdata = sta->sdata;
         DECLARE_MAC_BUF(mac);
 
-        sdata = sta->sdata;
-
         atomic_inc(&sdata->bss->num_sta_ps);
         set_and_clear_sta_flags(sta, WLAN_STA_PS, WLAN_STA_PSPOLL);
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
         printk(KERN_DEBUG "%s: STA %s aid %d enters power save mode\n",
-               dev->name, print_mac(mac, sta->addr), sta->aid);
+               sdata->dev->name, print_mac(mac, sta->sta.addr), sta->sta.aid);
 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
 }
 
-static int ap_sta_ps_end(struct net_device *dev, struct sta_info *sta)
+static int ap_sta_ps_end(struct sta_info *sta)
 {
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+        struct ieee80211_sub_if_data *sdata = sta->sdata;
+        struct ieee80211_local *local = sdata->local;
         struct sk_buff *skb;
         int sent = 0;
-        struct ieee80211_sub_if_data *sdata;
         struct ieee80211_tx_info *info;
         DECLARE_MAC_BUF(mac);
 
-        sdata = sta->sdata;
-
         atomic_dec(&sdata->bss->num_sta_ps);
 
         clear_sta_flags(sta, WLAN_STA_PS | WLAN_STA_PSPOLL);
@@ -680,7 +681,7 @@ static int ap_sta_ps_end(struct net_device *dev, struct sta_info *sta)
 
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
         printk(KERN_DEBUG "%s: STA %s aid %d exits power save mode\n",
-               dev->name, print_mac(mac, sta->addr), sta->aid);
+               sdata->dev->name, print_mac(mac, sta->sta.addr), sta->sta.aid);
 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
 
         /* Send all buffered frames to the station */
@@ -696,8 +697,8 @@ static int ap_sta_ps_end(struct net_device *dev, struct sta_info *sta)
                 sent++;
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
                 printk(KERN_DEBUG "%s: STA %s aid %d send PS frame "
-                       "since STA not sleeping anymore\n", dev->name,
-                       print_mac(mac, sta->addr), sta->aid);
+                       "since STA not sleeping anymore\n", sdata->dev->name,
+                       print_mac(mac, sta->sta.addr), sta->sta.aid);
 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
                 info->flags |= IEEE80211_TX_CTL_REQUEUE;
                 dev_queue_xmit(skb);
@@ -710,7 +711,6 @@ static ieee80211_rx_result debug_noinline
 ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
 {
         struct sta_info *sta = rx->sta;
-        struct net_device *dev = rx->dev;
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
 
         if (!sta)
@@ -719,14 +719,14 @@ ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
         /* Update last_rx only for IBSS packets which are for the current
          * BSSID to avoid keeping the current IBSS network alive in cases where
          * other STAs are using different BSSID. */
-        if (rx->sdata->vif.type == IEEE80211_IF_TYPE_IBSS) {
+        if (rx->sdata->vif.type == NL80211_IFTYPE_ADHOC) {
                 u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len,
-                                                IEEE80211_IF_TYPE_IBSS);
+                                                NL80211_IFTYPE_ADHOC);
                 if (compare_ether_addr(bssid, rx->sdata->u.sta.bssid) == 0)
                         sta->last_rx = jiffies;
         } else
         if (!is_multicast_ether_addr(hdr->addr1) ||
-            rx->sdata->vif.type == IEEE80211_IF_TYPE_STA) {
+            rx->sdata->vif.type == NL80211_IFTYPE_STATION) {
                 /* Update last_rx only for unicast frames in order to prevent
                  * the Probe Request frames (the only broadcast frames from a
                  * STA in infrastructure mode) from keeping a connection alive.
@@ -746,16 +746,16 @@ ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
         sta->last_noise = rx->status->noise;
 
         if (!ieee80211_has_morefrags(hdr->frame_control) &&
-            (rx->sdata->vif.type == IEEE80211_IF_TYPE_AP ||
-             rx->sdata->vif.type == IEEE80211_IF_TYPE_VLAN)) {
+            (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
+             rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)) {
                 /* Change STA power saving mode only in the end of a frame
                  * exchange sequence */
                 if (test_sta_flags(sta, WLAN_STA_PS) &&
                     !ieee80211_has_pm(hdr->frame_control))
-                        rx->sent_ps_buffered += ap_sta_ps_end(dev, sta);
+                        rx->sent_ps_buffered += ap_sta_ps_end(sta);
                 else if (!test_sta_flags(sta, WLAN_STA_PS) &&
                          ieee80211_has_pm(hdr->frame_control))
-                        ap_sta_ps_start(dev, sta);
+                        ap_sta_ps_start(sta);
         }
 
         /* Drop data::nullfunc frames silently, since they are used only to
@@ -816,7 +816,7 @@ ieee80211_reassemble_add(struct ieee80211_sub_if_data *sdata,
 
 static inline struct ieee80211_fragment_entry *
 ieee80211_reassemble_find(struct ieee80211_sub_if_data *sdata,
-                          u16 fc, unsigned int frag, unsigned int seq,
+                          unsigned int frag, unsigned int seq,
                           int rx_queue, struct ieee80211_hdr *hdr)
 {
         struct ieee80211_fragment_entry *entry;
@@ -825,7 +825,6 @@ ieee80211_reassemble_find(struct ieee80211_sub_if_data *sdata,
         idx = sdata->fragment_next;
         for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++) {
                 struct ieee80211_hdr *f_hdr;
-                u16 f_fc;
 
                 idx--;
                 if (idx < 0)
@@ -837,10 +836,13 @@ ieee80211_reassemble_find(struct ieee80211_sub_if_data *sdata,
                     entry->last_frag + 1 != frag)
                         continue;
 
-                f_hdr = (struct ieee80211_hdr *) entry->skb_list.next->data;
-                f_fc = le16_to_cpu(f_hdr->frame_control);
+                f_hdr = (struct ieee80211_hdr *)entry->skb_list.next->data;
 
-                if ((fc & IEEE80211_FCTL_FTYPE) != (f_fc & IEEE80211_FCTL_FTYPE) ||
+                /*
+                 * Check ftype and addresses are equal, else check next fragment
+                 */
+                if (((hdr->frame_control ^ f_hdr->frame_control) &
+                     cpu_to_le16(IEEE80211_FCTL_FTYPE)) ||
                     compare_ether_addr(hdr->addr1, f_hdr->addr1) != 0 ||
                     compare_ether_addr(hdr->addr2, f_hdr->addr2) != 0)
                         continue;
@@ -860,16 +862,18 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
 {
         struct ieee80211_hdr *hdr;
         u16 sc;
+        __le16 fc;
         unsigned int frag, seq;
         struct ieee80211_fragment_entry *entry;
         struct sk_buff *skb;
         DECLARE_MAC_BUF(mac);
 
-        hdr = (struct ieee80211_hdr *) rx->skb->data;
+        hdr = (struct ieee80211_hdr *)rx->skb->data;
+        fc = hdr->frame_control;
         sc = le16_to_cpu(hdr->seq_ctrl);
         frag = sc & IEEE80211_SCTL_FRAG;
 
-        if (likely((!(rx->fc & IEEE80211_FCTL_MOREFRAGS) && frag == 0) ||
+        if (likely((!ieee80211_has_morefrags(fc) && frag == 0) ||
                    (rx->skb)->len < 24 ||
                    is_multicast_ether_addr(hdr->addr1))) {
                 /* not fragmented */
@@ -884,7 +888,7 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
                 entry = ieee80211_reassemble_add(rx->sdata, frag, seq,
                                                  rx->queue, &(rx->skb));
                 if (rx->key && rx->key->conf.alg == ALG_CCMP &&
-                    (rx->fc & IEEE80211_FCTL_PROTECTED)) {
+                    ieee80211_has_protected(fc)) {
                         /* Store CCMP PN so that we can verify that the next
                          * fragment has a sequential PN value. */
                         entry->ccmp = 1;
@@ -898,8 +902,7 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
         /* This is a fragment for a frame that should already be pending in
          * fragment cache. Add this fragment to the end of the pending entry.
          */
-        entry = ieee80211_reassemble_find(rx->sdata, rx->fc, frag, seq,
-                                          rx->queue, hdr);
+        entry = ieee80211_reassemble_find(rx->sdata, frag, seq, rx->queue, hdr);
         if (!entry) {
                 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
                 return RX_DROP_MONITOR;
@@ -924,11 +927,11 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
                 memcpy(entry->last_pn, pn, CCMP_PN_LEN);
         }
 
-        skb_pull(rx->skb, ieee80211_get_hdrlen(rx->fc));
+        skb_pull(rx->skb, ieee80211_hdrlen(fc));
         __skb_queue_tail(&entry->skb_list, rx->skb);
         entry->last_frag = frag;
         entry->extra_len += rx->skb->len;
-        if (rx->fc & IEEE80211_FCTL_MOREFRAGS) {
+        if (ieee80211_has_morefrags(fc)) {
                 rx->skb = NULL;
                 return RX_QUEUED;
         }
@@ -968,15 +971,14 @@ ieee80211_rx_h_ps_poll(struct ieee80211_rx_data *rx)
         struct sk_buff *skb;
         int no_pending_pkts;
         DECLARE_MAC_BUF(mac);
+        __le16 fc = ((struct ieee80211_hdr *)rx->skb->data)->frame_control;
 
-        if (likely(!rx->sta ||
-                   (rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_CTL ||
-                   (rx->fc & IEEE80211_FCTL_STYPE) != IEEE80211_STYPE_PSPOLL ||
+        if (likely(!rx->sta || !ieee80211_is_pspoll(fc) ||
                    !(rx->flags & IEEE80211_RX_RA_MATCH)))
                 return RX_CONTINUE;
 
-        if ((sdata->vif.type != IEEE80211_IF_TYPE_AP) &&
-            (sdata->vif.type != IEEE80211_IF_TYPE_VLAN))
+        if ((sdata->vif.type != NL80211_IFTYPE_AP) &&
+            (sdata->vif.type != NL80211_IFTYPE_AP_VLAN))
                 return RX_DROP_UNUSABLE;
 
         skb = skb_dequeue(&rx->sta->tx_filtered);
@@ -1000,7 +1002,7 @@ ieee80211_rx_h_ps_poll(struct ieee80211_rx_data *rx)
 
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
                 printk(KERN_DEBUG "STA %s aid %d: PS Poll (entries after %d)\n",
-                       print_mac(mac, rx->sta->addr), rx->sta->aid,
+                       print_mac(mac, rx->sta->sta.addr), rx->sta->sta.aid,
                        skb_queue_len(&rx->sta->ps_tx_buf));
 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
 
@@ -1025,7 +1027,7 @@ ieee80211_rx_h_ps_poll(struct ieee80211_rx_data *rx)
                  */
                 printk(KERN_DEBUG "%s: STA %s sent PS Poll even "
                        "though there are no buffered frames for it\n",
-                       rx->dev->name, print_mac(mac, rx->sta->addr));
+                       rx->dev->name, print_mac(mac, rx->sta->sta.addr));
 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
         }
 
@@ -1050,7 +1052,6 @@ ieee80211_rx_h_remove_qos_control(struct ieee80211_rx_data *rx)
                 ieee80211_hdrlen(hdr->frame_control) - IEEE80211_QOS_CTL_LEN);
         hdr = (struct ieee80211_hdr *)skb_pull(rx->skb, IEEE80211_QOS_CTL_LEN);
         /* change frame type to non QOS */
-        rx->fc &= ~IEEE80211_STYPE_QOS_DATA;
         hdr->frame_control &= ~cpu_to_le16(IEEE80211_STYPE_QOS_DATA);
 
         return RX_CONTINUE;
@@ -1067,7 +1068,7 @@ ieee80211_802_1x_port_control(struct ieee80211_rx_data *rx)
 }
 
 static int
-ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx)
+ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc)
 {
         /*
          * Pass through unencrypted frames if the hardware has
@@ -1077,9 +1078,8 @@ ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx)
                 return 0;
 
         /* Drop unencrypted frames if key is set. */
-        if (unlikely(!(rx->fc & IEEE80211_FCTL_PROTECTED) &&
-                     (rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA &&
-                     (rx->fc & IEEE80211_FCTL_STYPE) != IEEE80211_STYPE_NULLFUNC &&
+        if (unlikely(!ieee80211_has_protected(fc) &&
+                     !ieee80211_is_nullfunc(fc) &&
                      (rx->key || rx->sdata->drop_unencrypted)))
                 return -EACCES;
 
@@ -1091,7 +1091,7 @@ ieee80211_data_to_8023(struct ieee80211_rx_data *rx)
 {
         struct net_device *dev = rx->dev;
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) rx->skb->data;
-        u16 fc, hdrlen, ethertype;
+        u16 hdrlen, ethertype;
         u8 *payload;
         u8 dst[ETH_ALEN];
         u8 src[ETH_ALEN] __aligned(2);
@@ -1102,16 +1102,10 @@ ieee80211_data_to_8023(struct ieee80211_rx_data *rx)
         DECLARE_MAC_BUF(mac3);
         DECLARE_MAC_BUF(mac4);
 
-        fc = rx->fc;
-
-        if (unlikely(!WLAN_FC_DATA_PRESENT(fc)))
+        if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
                 return -1;
 
-        hdrlen = ieee80211_get_hdrlen(fc);
-
-        if (ieee80211_vif_is_mesh(&sdata->vif))
-                hdrlen += ieee80211_get_mesh_hdrlen(
-                                (struct ieee80211s_hdr *) (skb->data + hdrlen));
+        hdrlen = ieee80211_hdrlen(hdr->frame_control);
 
         /* convert IEEE 802.11 header + possible LLC headers into Ethernet
          * header
@@ -1122,42 +1116,38 @@ ieee80211_data_to_8023(struct ieee80211_rx_data *rx)
          *   1     0   BSSID SA    DA    n/a
          *   1     1   RA    TA    DA    SA
          */
-
-        switch (fc & (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) {
-        case IEEE80211_FCTL_TODS:
-                /* BSSID SA DA */
-                memcpy(dst, hdr->addr3, ETH_ALEN);
-                memcpy(src, hdr->addr2, ETH_ALEN);
-
-                if (unlikely(sdata->vif.type != IEEE80211_IF_TYPE_AP &&
-                             sdata->vif.type != IEEE80211_IF_TYPE_VLAN))
+        memcpy(dst, ieee80211_get_DA(hdr), ETH_ALEN);
+        memcpy(src, ieee80211_get_SA(hdr), ETH_ALEN);
+
+        switch (hdr->frame_control &
+                cpu_to_le16(IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) {
+        case __constant_cpu_to_le16(IEEE80211_FCTL_TODS):
+                if (unlikely(sdata->vif.type != NL80211_IFTYPE_AP &&
+                             sdata->vif.type != NL80211_IFTYPE_AP_VLAN))
                         return -1;
                 break;
-        case (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS):
-                /* RA TA DA SA */
-                memcpy(dst, hdr->addr3, ETH_ALEN);
-                memcpy(src, hdr->addr4, ETH_ALEN);
-
-                 if (unlikely(sdata->vif.type != IEEE80211_IF_TYPE_WDS &&
-                             sdata->vif.type != IEEE80211_IF_TYPE_MESH_POINT))
+        case __constant_cpu_to_le16(IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS):
+                if (unlikely(sdata->vif.type != NL80211_IFTYPE_WDS &&
+                             sdata->vif.type != NL80211_IFTYPE_MESH_POINT))
                         return -1;
+                if (ieee80211_vif_is_mesh(&sdata->vif)) {
+                        struct ieee80211s_hdr *meshdr = (struct ieee80211s_hdr *)
+                                (skb->data + hdrlen);
+                        hdrlen += ieee80211_get_mesh_hdrlen(meshdr);
+                        if (meshdr->flags & MESH_FLAGS_AE_A5_A6) {
+                                memcpy(dst, meshdr->eaddr1, ETH_ALEN);
+                                memcpy(src, meshdr->eaddr2, ETH_ALEN);
+                        }
+                }
                 break;
-        case IEEE80211_FCTL_FROMDS:
-                /* DA BSSID SA */
-                memcpy(dst, hdr->addr1, ETH_ALEN);
-                memcpy(src, hdr->addr3, ETH_ALEN);
-
-                if (sdata->vif.type != IEEE80211_IF_TYPE_STA ||
+        case __constant_cpu_to_le16(IEEE80211_FCTL_FROMDS):
+                if (sdata->vif.type != NL80211_IFTYPE_STATION ||
                     (is_multicast_ether_addr(dst) &&
                      !compare_ether_addr(src, dev->dev_addr)))
                         return -1;
                 break;
-        case 0:
-                /* DA SA BSSID */
-                memcpy(dst, hdr->addr1, ETH_ALEN);
-                memcpy(src, hdr->addr2, ETH_ALEN);
-
-                if (sdata->vif.type != IEEE80211_IF_TYPE_IBSS)
+        case __constant_cpu_to_le16(0):
+                if (sdata->vif.type != NL80211_IFTYPE_ADHOC)
                         return -1;
                 break;
         }
@@ -1193,7 +1183,7 @@ ieee80211_data_to_8023(struct ieee80211_rx_data *rx)
 /*
  * requires that rx->skb is a frame with ethernet header
  */
-static bool ieee80211_frame_allowed(struct ieee80211_rx_data *rx)
+static bool ieee80211_frame_allowed(struct ieee80211_rx_data *rx, __le16 fc)
 {
         static const u8 pae_group_addr[ETH_ALEN] __aligned(2)
                 = { 0x01, 0x80, 0xC2, 0x00, 0x00, 0x03 };
@@ -1209,7 +1199,7 @@ static bool ieee80211_frame_allowed(struct ieee80211_rx_data *rx)
                 return true;
 
         if (ieee80211_802_1x_port_control(rx) ||
-            ieee80211_drop_unencrypted(rx))
+            ieee80211_drop_unencrypted(rx, fc))
                 return false;
 
         return true;
@@ -1231,8 +1221,9 @@ ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
         skb = rx->skb;
         xmit_skb = NULL;
 
-        if (local->bridge_packets && (sdata->vif.type == IEEE80211_IF_TYPE_AP ||
-                                      sdata->vif.type == IEEE80211_IF_TYPE_VLAN) &&
+        if ((sdata->vif.type == NL80211_IFTYPE_AP ||
+             sdata->vif.type == NL80211_IFTYPE_AP_VLAN) &&
+            !(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) &&
             (rx->flags & IEEE80211_RX_RA_MATCH)) {
                 if (is_multicast_ether_addr(ehdr->h_dest)) {
                         /*
@@ -1279,20 +1270,21 @@ ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
 {
         struct net_device *dev = rx->dev;
         struct ieee80211_local *local = rx->local;
-        u16 fc, ethertype;
+        u16 ethertype;
         u8 *payload;
         struct sk_buff *skb = rx->skb, *frame = NULL;
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+        __le16 fc = hdr->frame_control;
         const struct ethhdr *eth;
         int remaining, err;
         u8 dst[ETH_ALEN];
         u8 src[ETH_ALEN];
         DECLARE_MAC_BUF(mac);
 
-        fc = rx->fc;
-        if (unlikely((fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA))
+        if (unlikely(!ieee80211_is_data(fc)))
                 return RX_CONTINUE;
 
-        if (unlikely(!WLAN_FC_DATA_PRESENT(fc)))
+        if (unlikely(!ieee80211_is_data_present(fc)))
                 return RX_DROP_MONITOR;
 
         if (!(rx->flags & IEEE80211_RX_AMSDU))
@@ -1374,7 +1366,7 @@ ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
                         memcpy(skb_push(frame, ETH_ALEN), dst, ETH_ALEN);
                 }
 
-                if (!ieee80211_frame_allowed(rx)) {
+                if (!ieee80211_frame_allowed(rx, fc)) {
                         if (skb == frame) /* last frame */
                                 return RX_DROP_UNUSABLE;
                         dev_kfree_skb(frame);
@@ -1387,7 +1379,7 @@ ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
         return RX_QUEUED;
 }
 
-static ieee80211_rx_result debug_noinline
+static ieee80211_rx_result
 ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
 {
         struct ieee80211_hdr *hdr;
@@ -1406,6 +1398,25 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
                 /* illegal frame */
                 return RX_DROP_MONITOR;
 
+        if (mesh_hdr->flags & MESH_FLAGS_AE_A5_A6){
+                struct ieee80211_sub_if_data *sdata;
+                struct mesh_path *mppath;
+
+                sdata = IEEE80211_DEV_TO_SUB_IF(rx->dev);
+                rcu_read_lock();
+                mppath = mpp_path_lookup(mesh_hdr->eaddr2, sdata);
+                if (!mppath) {
+                        mpp_path_add(mesh_hdr->eaddr2, hdr->addr4, sdata);
+                } else {
+                        spin_lock_bh(&mppath->state_lock);
+                        mppath->exp_time = jiffies;
+                        if (compare_ether_addr(mppath->mpp, hdr->addr4) != 0)
+                                memcpy(mppath->mpp, hdr->addr4, ETH_ALEN);
+                        spin_unlock_bh(&mppath->state_lock);
+                }
+                rcu_read_unlock();
+        }
+
         if (compare_ether_addr(rx->dev->dev_addr, hdr->addr3) == 0)
                 return RX_CONTINUE;
 
@@ -1413,7 +1424,7 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
 
         if (rx->flags & IEEE80211_RX_RA_MATCH) {
                 if (!mesh_hdr->ttl)
-                        IEEE80211_IFSTA_MESH_CTR_INC(&rx->sdata->u.sta,
+                        IEEE80211_IFSTA_MESH_CTR_INC(&rx->sdata->u.mesh,
                                                      dropped_frames_ttl);
                 else {
                         struct ieee80211_hdr *fwd_hdr;
@@ -1448,21 +1459,21 @@ static ieee80211_rx_result debug_noinline
 ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
 {
         struct net_device *dev = rx->dev;
-        u16 fc;
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
+        __le16 fc = hdr->frame_control;
         int err;
 
-        fc = rx->fc;
-        if (unlikely((fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA))
+        if (unlikely(!ieee80211_is_data(hdr->frame_control)))
                 return RX_CONTINUE;
 
-        if (unlikely(!WLAN_FC_DATA_PRESENT(fc)))
+        if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
                 return RX_DROP_MONITOR;
 
         err = ieee80211_data_to_8023(rx);
         if (unlikely(err))
                 return RX_DROP_UNUSABLE;
 
-        if (!ieee80211_frame_allowed(rx))
+        if (!ieee80211_frame_allowed(rx, fc))
                 return RX_DROP_MONITOR;
 
         rx->skb->dev = dev;
@@ -1520,22 +1531,97 @@ ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx)
 }
 
 static ieee80211_rx_result debug_noinline
+ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
+{
+        struct ieee80211_local *local = rx->local;
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(rx->dev);
+        struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
+        int len = rx->skb->len;
+
+        if (!ieee80211_is_action(mgmt->frame_control))
+                return RX_CONTINUE;
+
+        if (!rx->sta)
+                return RX_DROP_MONITOR;
+
+        if (!(rx->flags & IEEE80211_RX_RA_MATCH))
+                return RX_DROP_MONITOR;
+
+        /* all categories we currently handle have action_code */
+        if (len < IEEE80211_MIN_ACTION_SIZE + 1)
+                return RX_DROP_MONITOR;
+
+        /*
+         * FIXME: revisit this, I'm sure we should handle most
+         *        of these frames in other modes as well!
+         */
+        if (sdata->vif.type != NL80211_IFTYPE_STATION &&
+            sdata->vif.type != NL80211_IFTYPE_ADHOC)
+                return RX_CONTINUE;
+
+        switch (mgmt->u.action.category) {
+        case WLAN_CATEGORY_BACK:
+                switch (mgmt->u.action.u.addba_req.action_code) {
+                case WLAN_ACTION_ADDBA_REQ:
+                        if (len < (IEEE80211_MIN_ACTION_SIZE +
+                                   sizeof(mgmt->u.action.u.addba_req)))
+                                return RX_DROP_MONITOR;
+                        ieee80211_process_addba_request(local, rx->sta, mgmt, len);
+                        break;
+                case WLAN_ACTION_ADDBA_RESP:
+                        if (len < (IEEE80211_MIN_ACTION_SIZE +
+                                   sizeof(mgmt->u.action.u.addba_resp)))
+                                return RX_DROP_MONITOR;
+                        ieee80211_process_addba_resp(local, rx->sta, mgmt, len);
+                        break;
+                case WLAN_ACTION_DELBA:
+                        if (len < (IEEE80211_MIN_ACTION_SIZE +
+                                   sizeof(mgmt->u.action.u.delba)))
+                                return RX_DROP_MONITOR;
+                        ieee80211_process_delba(sdata, rx->sta, mgmt, len);
+                        break;
+                }
+                break;
+        case WLAN_CATEGORY_SPECTRUM_MGMT:
+                if (local->hw.conf.channel->band != IEEE80211_BAND_5GHZ)
+                        return RX_DROP_MONITOR;
+                switch (mgmt->u.action.u.measurement.action_code) {
+                case WLAN_ACTION_SPCT_MSR_REQ:
+                        if (len < (IEEE80211_MIN_ACTION_SIZE +
+                                   sizeof(mgmt->u.action.u.measurement)))
+                                return RX_DROP_MONITOR;
+                        ieee80211_process_measurement_req(sdata, mgmt, len);
+                        break;
+                }
+                break;
+        default:
+                return RX_CONTINUE;
+        }
+
+        rx->sta->rx_packets++;
+        dev_kfree_skb(rx->skb);
+        return RX_QUEUED;
+}
+
+static ieee80211_rx_result debug_noinline
 ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
 {
-        struct ieee80211_sub_if_data *sdata;
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(rx->dev);
 
         if (!(rx->flags & IEEE80211_RX_RA_MATCH))
                 return RX_DROP_MONITOR;
 
-        sdata = IEEE80211_DEV_TO_SUB_IF(rx->dev);
-        if ((sdata->vif.type == IEEE80211_IF_TYPE_STA ||
-             sdata->vif.type == IEEE80211_IF_TYPE_IBSS ||
-             sdata->vif.type == IEEE80211_IF_TYPE_MESH_POINT) &&
-            !(sdata->flags & IEEE80211_SDATA_USERSPACE_MLME))
-                ieee80211_sta_rx_mgmt(rx->dev, rx->skb, rx->status);
-        else
+        if (ieee80211_vif_is_mesh(&sdata->vif))
+                return ieee80211_mesh_rx_mgmt(sdata, rx->skb, rx->status);
+
+        if (sdata->vif.type != NL80211_IFTYPE_STATION &&
+            sdata->vif.type != NL80211_IFTYPE_ADHOC)
+                return RX_DROP_MONITOR;
+
+        if (sdata->flags & IEEE80211_SDATA_USERSPACE_MLME)
                 return RX_DROP_MONITOR;
 
+        ieee80211_sta_rx_mgmt(sdata, rx->skb, rx->status);
         return RX_QUEUED;
 }
 
@@ -1565,7 +1651,7 @@ static void ieee80211_rx_michael_mic_report(struct net_device *dev,
         if (!ieee80211_has_protected(hdr->frame_control))
                 goto ignore;
 
-        if (rx->sdata->vif.type == IEEE80211_IF_TYPE_AP && keyidx) {
+        if (rx->sdata->vif.type == NL80211_IFTYPE_AP && keyidx) {
                 /*
                  * APs with pairwise keys should never receive Michael MIC
                  * errors for non-zero keyidx because these are reserved for
@@ -1579,7 +1665,7 @@ static void ieee80211_rx_michael_mic_report(struct net_device *dev,
             !ieee80211_is_auth(hdr->frame_control))
                 goto ignore;
 
-        mac80211_ev_michael_mic_failure(rx->dev, keyidx, hdr);
+        mac80211_ev_michael_mic_failure(rx->sdata, keyidx, hdr);
  ignore:
         dev_kfree_skb(rx->skb);
         rx->skb = NULL;
@@ -1635,7 +1721,7 @@ static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx)
                 if (!netif_running(sdata->dev))
                         continue;
 
-                if (sdata->vif.type != IEEE80211_IF_TYPE_MNTR ||
+                if (sdata->vif.type != NL80211_IFTYPE_MONITOR ||
                     !(sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES))
                         continue;
 
@@ -1698,6 +1784,7 @@ static void ieee80211_invoke_rx_handlers(struct ieee80211_sub_if_data *sdata,
                 CALL_RXH(ieee80211_rx_h_mesh_fwding);
         CALL_RXH(ieee80211_rx_h_data)
         CALL_RXH(ieee80211_rx_h_ctrl)
+        CALL_RXH(ieee80211_rx_h_action)
         CALL_RXH(ieee80211_rx_h_mgmt)
 
 #undef CALL_RXH
@@ -1733,7 +1820,7 @@ static int prepare_for_handlers(struct ieee80211_sub_if_data *sdata,
         int multicast = is_multicast_ether_addr(hdr->addr1);
 
         switch (sdata->vif.type) {
-        case IEEE80211_IF_TYPE_STA:
+        case NL80211_IFTYPE_STATION:
                 if (!bssid)
                         return 0;
                 if (!ieee80211_bssid_match(bssid, sdata->u.sta.bssid)) {
@@ -1748,14 +1835,10 @@ static int prepare_for_handlers(struct ieee80211_sub_if_data *sdata,
                         rx->flags &= ~IEEE80211_RX_RA_MATCH;
                 }
                 break;
-        case IEEE80211_IF_TYPE_IBSS:
+        case NL80211_IFTYPE_ADHOC:
                 if (!bssid)
                         return 0;
                 if (ieee80211_is_beacon(hdr->frame_control)) {
-                        if (!rx->sta)
-                                rx->sta = ieee80211_ibss_add_sta(sdata->dev,
-                                                rx->skb, bssid, hdr->addr2,
-                                                BIT(rx->status->rate_idx));
                         return 1;
                 }
                 else if (!ieee80211_bssid_match(bssid, sdata->u.sta.bssid)) {
@@ -1769,11 +1852,11 @@ static int prepare_for_handlers(struct ieee80211_sub_if_data *sdata,
                                 return 0;
                         rx->flags &= ~IEEE80211_RX_RA_MATCH;
                 } else if (!rx->sta)
-                        rx->sta = ieee80211_ibss_add_sta(sdata->dev, rx->skb,
+                        rx->sta = ieee80211_ibss_add_sta(sdata, rx->skb,
                                                 bssid, hdr->addr2,
                                                 BIT(rx->status->rate_idx));
                 break;
-        case IEEE80211_IF_TYPE_MESH_POINT:
+        case NL80211_IFTYPE_MESH_POINT:
                 if (!multicast &&
                     compare_ether_addr(sdata->dev->dev_addr,
                                        hdr->addr1) != 0) {
@@ -1783,8 +1866,8 @@ static int prepare_for_handlers(struct ieee80211_sub_if_data *sdata,
                         rx->flags &= ~IEEE80211_RX_RA_MATCH;
                 }
                 break;
-        case IEEE80211_IF_TYPE_VLAN:
-        case IEEE80211_IF_TYPE_AP:
+        case NL80211_IFTYPE_AP_VLAN:
+        case NL80211_IFTYPE_AP:
                 if (!bssid) {
                         if (compare_ether_addr(sdata->dev->dev_addr,
                                                hdr->addr1))
@@ -1796,16 +1879,17 @@ static int prepare_for_handlers(struct ieee80211_sub_if_data *sdata,
                         rx->flags &= ~IEEE80211_RX_RA_MATCH;
                 }
                 break;
-        case IEEE80211_IF_TYPE_WDS:
+        case NL80211_IFTYPE_WDS:
                 if (bssid || !ieee80211_is_data(hdr->frame_control))
                         return 0;
                 if (compare_ether_addr(sdata->u.wds.remote_addr, hdr->addr2))
                         return 0;
                 break;
-        case IEEE80211_IF_TYPE_MNTR:
+        case NL80211_IFTYPE_MONITOR:
                 /* take everything */
                 break;
-        case IEEE80211_IF_TYPE_INVALID:
+        case NL80211_IFTYPE_UNSPECIFIED:
+        case __NL80211_IFTYPE_AFTER_LAST:
                 /* should never get here */
                 WARN_ON(1);
                 break;
@@ -1827,23 +1911,20 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
         struct ieee80211_sub_if_data *sdata;
         struct ieee80211_hdr *hdr;
         struct ieee80211_rx_data rx;
-        u16 type;
         int prepares;
         struct ieee80211_sub_if_data *prev = NULL;
         struct sk_buff *skb_new;
         u8 *bssid;
 
-        hdr = (struct ieee80211_hdr *) skb->data;
+        hdr = (struct ieee80211_hdr *)skb->data;
         memset(&rx, 0, sizeof(rx));
         rx.skb = skb;
         rx.local = local;
 
         rx.status = status;
         rx.rate = rate;
-        rx.fc = le16_to_cpu(hdr->frame_control);
-        type = rx.fc & IEEE80211_FCTL_FTYPE;
 
-        if (type == IEEE80211_FTYPE_DATA || type == IEEE80211_FTYPE_MGMT)
+        if (ieee80211_is_data(hdr->frame_control) || ieee80211_is_mgmt(hdr->frame_control))
                 local->dot11ReceivedFragmentCount++;
 
         rx.sta = sta_info_get(local, hdr->addr2);
@@ -1857,7 +1938,7 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
                 return;
         }
 
-        if (unlikely(local->sta_sw_scanning || local->sta_hw_scanning))
+        if (unlikely(local->sw_scanning || local->hw_scanning))
                 rx.flags |= IEEE80211_RX_IN_SCAN;
 
         ieee80211_parse_qos(&rx);
@@ -1869,7 +1950,7 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
                 if (!netif_running(sdata->dev))
                         continue;
 
-                if (sdata->vif.type == IEEE80211_IF_TYPE_MNTR)
+                if (sdata->vif.type == NL80211_IFTYPE_MONITOR)
                         continue;
 
                 bssid = ieee80211_get_bssid(hdr, skb->len, sdata->vif.type);
@@ -1904,14 +1985,12 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
                                        prev->dev->name);
                         continue;
                 }
-                rx.fc = le16_to_cpu(hdr->frame_control);
                 ieee80211_invoke_rx_handlers(prev, &rx, skb_new);
                 prev = sdata;
         }
-        if (prev) {
-                rx.fc = le16_to_cpu(hdr->frame_control);
+        if (prev)
                 ieee80211_invoke_rx_handlers(prev, &rx, skb);
-        } else
+        else
                 dev_kfree_skb(skb);
 }
 
@@ -2080,7 +2159,7 @@ static u8 ieee80211_rx_reorder_ampdu(struct ieee80211_local *local,
         /* if this mpdu is fragmented - terminate rx aggregation session */
         sc = le16_to_cpu(hdr->seq_ctrl);
         if (sc & IEEE80211_SCTL_FRAG) {
-                ieee80211_sta_stop_rx_ba_session(sta->sdata->dev, sta->addr,
+                ieee80211_sta_stop_rx_ba_session(sta->sdata, sta->sta.addr,
                         tid, 0, WLAN_REASON_QSTA_REQUIRE_SETUP);
                 ret = 1;
                 goto end_reorder;
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
new file mode 100644
index 000000000000..8e6685e7ae85
--- /dev/null
+++ b/net/mac80211/scan.c
@@ -0,0 +1,937 @@
+/*
+ * Scanning implementation
+ *
+ * Copyright 2003, Jouni Malinen <jkmaline@cc.hut.fi>
+ * Copyright 2004, Instant802 Networks, Inc.
+ * Copyright 2005, Devicescape Software, Inc.
+ * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
+ * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+/* TODO:
+ * order BSS list by RSSI(?) ("quality of AP")
+ * scan result table filtering (by capability (privacy, IBSS/BSS, WPA/RSN IE,
+ *    SSID)
+ */
+
+#include <linux/wireless.h>
+#include <linux/if_arp.h>
+#include <net/mac80211.h>
+#include <net/iw_handler.h>
+
+#include "ieee80211_i.h"
+#include "mesh.h"
+
+#define IEEE80211_PROBE_DELAY (HZ / 33)
+#define IEEE80211_CHANNEL_TIME (HZ / 33)
+#define IEEE80211_PASSIVE_CHANNEL_TIME (HZ / 5)
+
+void ieee80211_rx_bss_list_init(struct ieee80211_local *local)
+{
+        spin_lock_init(&local->bss_lock);
+        INIT_LIST_HEAD(&local->bss_list);
+}
+
+void ieee80211_rx_bss_list_deinit(struct ieee80211_local *local)
+{
+        struct ieee80211_bss *bss, *tmp;
+
+        list_for_each_entry_safe(bss, tmp, &local->bss_list, list)
+                ieee80211_rx_bss_put(local, bss);
+}
+
+struct ieee80211_bss *
+ieee80211_rx_bss_get(struct ieee80211_local *local, u8 *bssid, int freq,
+                     u8 *ssid, u8 ssid_len)
+{
+        struct ieee80211_bss *bss;
+
+        spin_lock_bh(&local->bss_lock);
+        bss = local->bss_hash[STA_HASH(bssid)];
+        while (bss) {
+                if (!bss_mesh_cfg(bss) &&
+                    !memcmp(bss->bssid, bssid, ETH_ALEN) &&
+                    bss->freq == freq &&
+                    bss->ssid_len == ssid_len &&
+                    (ssid_len == 0 || !memcmp(bss->ssid, ssid, ssid_len))) {
+                        atomic_inc(&bss->users);
+                        break;
+                }
+                bss = bss->hnext;
+        }
+        spin_unlock_bh(&local->bss_lock);
+        return bss;
+}
+
+/* Caller must hold local->bss_lock */
+static void __ieee80211_rx_bss_hash_add(struct ieee80211_local *local,
+                                        struct ieee80211_bss *bss)
+{
+        u8 hash_idx;
+
+        if (bss_mesh_cfg(bss))
+                hash_idx = mesh_id_hash(bss_mesh_id(bss),
+                                        bss_mesh_id_len(bss));
+        else
+                hash_idx = STA_HASH(bss->bssid);
+
+        bss->hnext = local->bss_hash[hash_idx];
+        local->bss_hash[hash_idx] = bss;
+}
+
+/* Caller must hold local->bss_lock */
+static void __ieee80211_rx_bss_hash_del(struct ieee80211_local *local,
+                                        struct ieee80211_bss *bss)
+{
+        struct ieee80211_bss *b, *prev = NULL;
+        b = local->bss_hash[STA_HASH(bss->bssid)];
+        while (b) {
+                if (b == bss) {
+                        if (!prev)
+                                local->bss_hash[STA_HASH(bss->bssid)] =
+                                        bss->hnext;
+                        else
+                                prev->hnext = bss->hnext;
+                        break;
+                }
+                prev = b;
+                b = b->hnext;
+        }
+}
+
+struct ieee80211_bss *
+ieee80211_rx_bss_add(struct ieee80211_local *local, u8 *bssid, int freq,
+                     u8 *ssid, u8 ssid_len)
+{
+        struct ieee80211_bss *bss;
+
+        bss = kzalloc(sizeof(*bss), GFP_ATOMIC);
+        if (!bss)
+                return NULL;
+        atomic_set(&bss->users, 2);
+        memcpy(bss->bssid, bssid, ETH_ALEN);
+        bss->freq = freq;
+        if (ssid && ssid_len <= IEEE80211_MAX_SSID_LEN) {
+                memcpy(bss->ssid, ssid, ssid_len);
+                bss->ssid_len = ssid_len;
+        }
+
+        spin_lock_bh(&local->bss_lock);
+        /* TODO: order by RSSI? */
+        list_add_tail(&bss->list, &local->bss_list);
+        __ieee80211_rx_bss_hash_add(local, bss);
+        spin_unlock_bh(&local->bss_lock);
+        return bss;
+}
+
+#ifdef CONFIG_MAC80211_MESH
+static struct ieee80211_bss *
+ieee80211_rx_mesh_bss_get(struct ieee80211_local *local, u8 *mesh_id, int mesh_id_len,
+                          u8 *mesh_cfg, int freq)
+{
+        struct ieee80211_bss *bss;
+
+        spin_lock_bh(&local->bss_lock);
+        bss = local->bss_hash[mesh_id_hash(mesh_id, mesh_id_len)];
+        while (bss) {
+                if (bss_mesh_cfg(bss) &&
+                    !memcmp(bss_mesh_cfg(bss), mesh_cfg, MESH_CFG_CMP_LEN) &&
+                    bss->freq == freq &&
+                    mesh_id_len == bss->mesh_id_len &&
+                    (mesh_id_len == 0 || !memcmp(bss->mesh_id, mesh_id,
+                                                 mesh_id_len))) {
+                        atomic_inc(&bss->users);
+                        break;
+                }
+                bss = bss->hnext;
+        }
+        spin_unlock_bh(&local->bss_lock);
+        return bss;
+}
+
+static struct ieee80211_bss *
+ieee80211_rx_mesh_bss_add(struct ieee80211_local *local, u8 *mesh_id, int mesh_id_len,
+                          u8 *mesh_cfg, int mesh_config_len, int freq)
+{
+        struct ieee80211_bss *bss;
+
+        if (mesh_config_len != MESH_CFG_LEN)
+                return NULL;
+
+        bss = kzalloc(sizeof(*bss), GFP_ATOMIC);
+        if (!bss)
+                return NULL;
+
+        bss->mesh_cfg = kmalloc(MESH_CFG_CMP_LEN, GFP_ATOMIC);
+        if (!bss->mesh_cfg) {
+                kfree(bss);
+                return NULL;
+        }
+
+        if (mesh_id_len && mesh_id_len <= IEEE80211_MAX_MESH_ID_LEN) {
+                bss->mesh_id = kmalloc(mesh_id_len, GFP_ATOMIC);
+                if (!bss->mesh_id) {
+                        kfree(bss->mesh_cfg);
+                        kfree(bss);
+                        return NULL;
+                }
+                memcpy(bss->mesh_id, mesh_id, mesh_id_len);
+        }
+
+        atomic_set(&bss->users, 2);
+        memcpy(bss->mesh_cfg, mesh_cfg, MESH_CFG_CMP_LEN);
+        bss->mesh_id_len = mesh_id_len;
+        bss->freq = freq;
+        spin_lock_bh(&local->bss_lock);
+        /* TODO: order by RSSI? */
+        list_add_tail(&bss->list, &local->bss_list);
+        __ieee80211_rx_bss_hash_add(local, bss);
+        spin_unlock_bh(&local->bss_lock);
+        return bss;
+}
+#endif
+
+static void ieee80211_rx_bss_free(struct ieee80211_bss *bss)
+{
+        kfree(bss->ies);
+        kfree(bss_mesh_id(bss));
+        kfree(bss_mesh_cfg(bss));
+        kfree(bss);
+}
+
+void ieee80211_rx_bss_put(struct ieee80211_local *local,
+                          struct ieee80211_bss *bss)
+{
+        local_bh_disable();
+        if (!atomic_dec_and_lock(&bss->users, &local->bss_lock)) {
+                local_bh_enable();
+                return;
+        }
+
+        __ieee80211_rx_bss_hash_del(local, bss);
+        list_del(&bss->list);
+        spin_unlock_bh(&local->bss_lock);
+        ieee80211_rx_bss_free(bss);
+}
+
+struct ieee80211_bss *
+ieee80211_bss_info_update(struct ieee80211_local *local,
+                          struct ieee80211_rx_status *rx_status,
+                          struct ieee80211_mgmt *mgmt,
+                          size_t len,
+                          struct ieee802_11_elems *elems,
+                          int freq, bool beacon)
+{
+        struct ieee80211_bss *bss;
+        int clen;
+
+#ifdef CONFIG_MAC80211_MESH
+        if (elems->mesh_config)
+                bss = ieee80211_rx_mesh_bss_get(local, elems->mesh_id,
+                                elems->mesh_id_len, elems->mesh_config, freq);
+        else
+#endif
+                bss = ieee80211_rx_bss_get(local, mgmt->bssid, freq,
+                                           elems->ssid, elems->ssid_len);
+        if (!bss) {
+#ifdef CONFIG_MAC80211_MESH
+                if (elems->mesh_config)
+                        bss = ieee80211_rx_mesh_bss_add(local, elems->mesh_id,
+                                elems->mesh_id_len, elems->mesh_config,
+                                elems->mesh_config_len, freq);
+                else
+#endif
+                        bss = ieee80211_rx_bss_add(local, mgmt->bssid, freq,
+                                                  elems->ssid, elems->ssid_len);
+                if (!bss)
+                        return NULL;
+        } else {
+#if 0
+                /* TODO: order by RSSI? */
+                spin_lock_bh(&local->bss_lock);
+                list_move_tail(&bss->list, &local->bss_list);
+                spin_unlock_bh(&local->bss_lock);
+#endif
+        }
+
+        /* save the ERP value so that it is available at association time */
+        if (elems->erp_info && elems->erp_info_len >= 1) {
+                bss->erp_value = elems->erp_info[0];
+                bss->has_erp_value = 1;
+        }
+
+        bss->beacon_int = le16_to_cpu(mgmt->u.beacon.beacon_int);
+        bss->capability = le16_to_cpu(mgmt->u.beacon.capab_info);
+
+        if (elems->tim) {
+                struct ieee80211_tim_ie *tim_ie =
+                        (struct ieee80211_tim_ie *)elems->tim;
+                bss->dtim_period = tim_ie->dtim_period;
+        }
+
+        /* set default value for buggy APs */
+        if (!elems->tim || bss->dtim_period == 0)
+                bss->dtim_period = 1;
+
+        bss->supp_rates_len = 0;
+        if (elems->supp_rates) {
+                clen = IEEE80211_MAX_SUPP_RATES - bss->supp_rates_len;
+                if (clen > elems->supp_rates_len)
+                        clen = elems->supp_rates_len;
+                memcpy(&bss->supp_rates[bss->supp_rates_len], elems->supp_rates,
+                       clen);
+                bss->supp_rates_len += clen;
+        }
+        if (elems->ext_supp_rates) {
+                clen = IEEE80211_MAX_SUPP_RATES - bss->supp_rates_len;
+                if (clen > elems->ext_supp_rates_len)
+                        clen = elems->ext_supp_rates_len;
+                memcpy(&bss->supp_rates[bss->supp_rates_len],
+                       elems->ext_supp_rates, clen);
+                bss->supp_rates_len += clen;
+        }
+
+        bss->band = rx_status->band;
+
+        bss->timestamp = le64_to_cpu(mgmt->u.beacon.timestamp);
+        bss->last_update = jiffies;
+        bss->signal = rx_status->signal;
+        bss->noise = rx_status->noise;
+        bss->qual = rx_status->qual;
+        bss->wmm_used = elems->wmm_param || elems->wmm_info;
+
+        if (!beacon)
+                bss->last_probe_resp = jiffies;
+
+        /*
+         * For probe responses, or if we don't have any information yet,
+         * use the IEs from the beacon.
+         */
+        if (!bss->ies || !beacon) {
+                if (bss->ies == NULL || bss->ies_len < elems->total_len) {
+                        kfree(bss->ies);
+                        bss->ies = kmalloc(elems->total_len, GFP_ATOMIC);
+                }
+                if (bss->ies) {
+                        memcpy(bss->ies, elems->ie_start, elems->total_len);
+                        bss->ies_len = elems->total_len;
+                } else
+                        bss->ies_len = 0;
+        }
+
+        return bss;
+}
+
+ieee80211_rx_result
+ieee80211_scan_rx(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb,
+                  struct ieee80211_rx_status *rx_status)
+{
+        struct ieee80211_mgmt *mgmt;
+        struct ieee80211_bss *bss;
+        u8 *elements;
+        struct ieee80211_channel *channel;
+        size_t baselen;
+        int freq;
+        __le16 fc;
+        bool presp, beacon = false;
+        struct ieee802_11_elems elems;
+
+        if (skb->len < 2)
+                return RX_DROP_UNUSABLE;
+
+        mgmt = (struct ieee80211_mgmt *) skb->data;
+        fc = mgmt->frame_control;
+
+        if (ieee80211_is_ctl(fc))
+                return RX_CONTINUE;
+
+        if (skb->len < 24)
+                return RX_DROP_MONITOR;
+
+        presp = ieee80211_is_probe_resp(fc);
+        if (presp) {
+                /* ignore ProbeResp to foreign address */
+                if (memcmp(mgmt->da, sdata->dev->dev_addr, ETH_ALEN))
+                        return RX_DROP_MONITOR;
+
+                presp = true;
+                elements = mgmt->u.probe_resp.variable;
+                baselen = offsetof(struct ieee80211_mgmt, u.probe_resp.variable);
+        } else {
+                beacon = ieee80211_is_beacon(fc);
+                baselen = offsetof(struct ieee80211_mgmt, u.beacon.variable);
+                elements = mgmt->u.beacon.variable;
+        }
+
+        if (!presp && !beacon)
+                return RX_CONTINUE;
+
+        if (baselen > skb->len)
+                return RX_DROP_MONITOR;
+
+        ieee802_11_parse_elems(elements, skb->len - baselen, &elems);
+
+        if (elems.ds_params && elems.ds_params_len == 1)
+                freq = ieee80211_channel_to_frequency(elems.ds_params[0]);
+        else
+                freq = rx_status->freq;
+
+        channel = ieee80211_get_channel(sdata->local->hw.wiphy, freq);
+
+        if (!channel || channel->flags & IEEE80211_CHAN_DISABLED)
+                return RX_DROP_MONITOR;
+
+        bss = ieee80211_bss_info_update(sdata->local, rx_status,
+                                        mgmt, skb->len, &elems,
+                                        freq, beacon);
+        ieee80211_rx_bss_put(sdata->local, bss);
+
+        dev_kfree_skb(skb);
+        return RX_QUEUED;
+}
+
+static void ieee80211_send_nullfunc(struct ieee80211_local *local,
+                                    struct ieee80211_sub_if_data *sdata,
+                                    int powersave)
+{
+        struct sk_buff *skb;
+        struct ieee80211_hdr *nullfunc;
+        __le16 fc;
+
+        skb = dev_alloc_skb(local->hw.extra_tx_headroom + 24);
+        if (!skb) {
+                printk(KERN_DEBUG "%s: failed to allocate buffer for nullfunc "
+                       "frame\n", sdata->dev->name);
+                return;
+        }
+        skb_reserve(skb, local->hw.extra_tx_headroom);
+
+        nullfunc = (struct ieee80211_hdr *) skb_put(skb, 24);
+        memset(nullfunc, 0, 24);
+        fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_NULLFUNC |
+                         IEEE80211_FCTL_TODS);
+        if (powersave)
+                fc |= cpu_to_le16(IEEE80211_FCTL_PM);
+        nullfunc->frame_control = fc;
+        memcpy(nullfunc->addr1, sdata->u.sta.bssid, ETH_ALEN);
+        memcpy(nullfunc->addr2, sdata->dev->dev_addr, ETH_ALEN);
+        memcpy(nullfunc->addr3, sdata->u.sta.bssid, ETH_ALEN);
+
+        ieee80211_tx_skb(sdata, skb, 0);
+}
+
+void ieee80211_scan_completed(struct ieee80211_hw *hw)
+{
+        struct ieee80211_local *local = hw_to_local(hw);
+        struct ieee80211_sub_if_data *sdata;
+        union iwreq_data wrqu;
+
+        if (WARN_ON(!local->hw_scanning && !local->sw_scanning))
+                return;
+
+        local->last_scan_completed = jiffies;
+        memset(&wrqu, 0, sizeof(wrqu));
+
+        /*
+         * local->scan_sdata could have been NULLed by the interface
+         * down code in case we were scanning on an interface that is
+         * being taken down.
+         */
+        sdata = local->scan_sdata;
+        if (sdata)
+                wireless_send_event(sdata->dev, SIOCGIWSCAN, &wrqu, NULL);
+
+        if (local->hw_scanning) {
+                local->hw_scanning = false;
+                if (ieee80211_hw_config(local))
+                        printk(KERN_DEBUG "%s: failed to restore operational "
+                               "channel after scan\n", wiphy_name(local->hw.wiphy));
+
+                goto done;
+        }
+
+        local->sw_scanning = false;
+        if (ieee80211_hw_config(local))
+                printk(KERN_DEBUG "%s: failed to restore operational "
+                       "channel after scan\n", wiphy_name(local->hw.wiphy));
+
+
+        netif_tx_lock_bh(local->mdev);
+        netif_addr_lock(local->mdev);
+        local->filter_flags &= ~FIF_BCN_PRBRESP_PROMISC;
+        local->ops->configure_filter(local_to_hw(local),
+                                     FIF_BCN_PRBRESP_PROMISC,
+                                     &local->filter_flags,
+                                     local->mdev->mc_count,
+                                     local->mdev->mc_list);
+
+        netif_addr_unlock(local->mdev);
+        netif_tx_unlock_bh(local->mdev);
+
+        rcu_read_lock();
+        list_for_each_entry_rcu(sdata, &local->interfaces, list) {
+                /* Tell AP we're back */
+                if (sdata->vif.type == NL80211_IFTYPE_STATION) {
+                        if (sdata->u.sta.flags & IEEE80211_STA_ASSOCIATED) {
+                                ieee80211_send_nullfunc(local, sdata, 0);
+                                netif_tx_wake_all_queues(sdata->dev);
+                        }
+                } else
+                        netif_tx_wake_all_queues(sdata->dev);
+        }
+        rcu_read_unlock();
+
+ done:
+        ieee80211_mlme_notify_scan_completed(local);
+        ieee80211_mesh_notify_scan_completed(local);
+}
+EXPORT_SYMBOL(ieee80211_scan_completed);
+
+
+void ieee80211_scan_work(struct work_struct *work)
+{
+        struct ieee80211_local *local =
+                container_of(work, struct ieee80211_local, scan_work.work);
+        struct ieee80211_sub_if_data *sdata = local->scan_sdata;
+        struct ieee80211_supported_band *sband;
+        struct ieee80211_channel *chan;
+        int skip;
+        unsigned long next_delay = 0;
+
+        /*
+         * Avoid re-scheduling when the sdata is going away.
+         */
+        if (!netif_running(sdata->dev))
+                return;
+
+        switch (local->scan_state) {
+        case SCAN_SET_CHANNEL:
+                /*
+                 * Get current scan band. scan_band may be IEEE80211_NUM_BANDS
+                 * after we successfully scanned the last channel of the last
+                 * band (and the last band is supported by the hw)
+                 */
+                if (local->scan_band < IEEE80211_NUM_BANDS)
+                        sband = local->hw.wiphy->bands[local->scan_band];
+                else
+                        sband = NULL;
+
+                /*
+                 * If we are at an unsupported band and have more bands
+                 * left to scan, advance to the next supported one.
+                 */
+                while (!sband && local->scan_band < IEEE80211_NUM_BANDS - 1) {
+                        local->scan_band++;
+                        sband = local->hw.wiphy->bands[local->scan_band];
+                        local->scan_channel_idx = 0;
+                }
+
+                /* if no more bands/channels left, complete scan */
+                if (!sband || local->scan_channel_idx >= sband->n_channels) {
+                        ieee80211_scan_completed(local_to_hw(local));
+                        return;
+                }
+                skip = 0;
+                chan = &sband->channels[local->scan_channel_idx];
+
+                if (chan->flags & IEEE80211_CHAN_DISABLED ||
+                    (sdata->vif.type == NL80211_IFTYPE_ADHOC &&
+                     chan->flags & IEEE80211_CHAN_NO_IBSS))
+                        skip = 1;
+
+                if (!skip) {
+                        local->scan_channel = chan;
+                        if (ieee80211_hw_config(local)) {
+                                printk(KERN_DEBUG "%s: failed to set freq to "
+                                       "%d MHz for scan\n", wiphy_name(local->hw.wiphy),
+                                       chan->center_freq);
+                                skip = 1;
+                        }
+                }
+
+                /* advance state machine to next channel/band */
+                local->scan_channel_idx++;
+                if (local->scan_channel_idx >= sband->n_channels) {
+                        /*
+                         * scan_band may end up == IEEE80211_NUM_BANDS, but
+                         * we'll catch that case above and complete the scan
+                         * if that is the case.
+                         */
+                        local->scan_band++;
+                        local->scan_channel_idx = 0;
+                }
+
+                if (skip)
+                        break;
+
+                next_delay = IEEE80211_PROBE_DELAY +
+                             usecs_to_jiffies(local->hw.channel_change_time);
+                local->scan_state = SCAN_SEND_PROBE;
+                break;
+        case SCAN_SEND_PROBE:
+                next_delay = IEEE80211_PASSIVE_CHANNEL_TIME;
+                local->scan_state = SCAN_SET_CHANNEL;
+
+                if (local->scan_channel->flags & IEEE80211_CHAN_PASSIVE_SCAN)
+                        break;
+                ieee80211_send_probe_req(sdata, NULL, local->scan_ssid,
+                                         local->scan_ssid_len);
+                next_delay = IEEE80211_CHANNEL_TIME;
+                break;
+        }
+
+        queue_delayed_work(local->hw.workqueue, &local->scan_work,
+                           next_delay);
+}
+
+
+int ieee80211_start_scan(struct ieee80211_sub_if_data *scan_sdata,
+                         u8 *ssid, size_t ssid_len)
+{
+        struct ieee80211_local *local = scan_sdata->local;
+        struct ieee80211_sub_if_data *sdata;
+
+        if (ssid_len > IEEE80211_MAX_SSID_LEN)
+                return -EINVAL;
+
+        /* MLME-SCAN.request (page 118)  page 144 (11.1.3.1)
+         * BSSType: INFRASTRUCTURE, INDEPENDENT, ANY_BSS
+         * BSSID: MACAddress
+         * SSID
+         * ScanType: ACTIVE, PASSIVE
+         * ProbeDelay: delay (in microseconds) to be used prior to transmitting
+         *    a Probe frame during active scanning
+         * ChannelList
+         * MinChannelTime (>= ProbeDelay), in TU
+         * MaxChannelTime: (>= MinChannelTime), in TU
+         */
+
+         /* MLME-SCAN.confirm
+          * BSSDescriptionSet
+          * ResultCode: SUCCESS, INVALID_PARAMETERS
+         */
+
+        if (local->sw_scanning || local->hw_scanning) {
+                if (local->scan_sdata == scan_sdata)
+                        return 0;
+                return -EBUSY;
+        }
+
+        if (local->ops->hw_scan) {
+                int rc;
+
+                local->hw_scanning = true;
+                rc = local->ops->hw_scan(local_to_hw(local), ssid, ssid_len);
+                if (rc) {
+                        local->hw_scanning = false;
+                        return rc;
+                }
+                local->scan_sdata = scan_sdata;
+                return 0;
+        }
+
+        local->sw_scanning = true;
+
+        rcu_read_lock();
+        list_for_each_entry_rcu(sdata, &local->interfaces, list) {
+                if (sdata->vif.type == NL80211_IFTYPE_STATION) {
+                        if (sdata->u.sta.flags & IEEE80211_STA_ASSOCIATED) {
+                                netif_tx_stop_all_queues(sdata->dev);
+                                ieee80211_send_nullfunc(local, sdata, 1);
+                        }
+                } else
+                        netif_tx_stop_all_queues(sdata->dev);
+        }
+        rcu_read_unlock();
+
+        if (ssid) {
+                local->scan_ssid_len = ssid_len;
+                memcpy(local->scan_ssid, ssid, ssid_len);
+        } else
+                local->scan_ssid_len = 0;
+        local->scan_state = SCAN_SET_CHANNEL;
+        local->scan_channel_idx = 0;
+        local->scan_band = IEEE80211_BAND_2GHZ;
+        local->scan_sdata = scan_sdata;
+
+        netif_addr_lock_bh(local->mdev);
+        local->filter_flags |= FIF_BCN_PRBRESP_PROMISC;
+        local->ops->configure_filter(local_to_hw(local),
+                                     FIF_BCN_PRBRESP_PROMISC,
+                                     &local->filter_flags,
+                                     local->mdev->mc_count,
+                                     local->mdev->mc_list);
+        netif_addr_unlock_bh(local->mdev);
+
+        /* TODO: start scan as soon as all nullfunc frames are ACKed */
+        queue_delayed_work(local->hw.workqueue, &local->scan_work,
+                           IEEE80211_CHANNEL_TIME);
+
+        return 0;
+}
+
+
+int ieee80211_request_scan(struct ieee80211_sub_if_data *sdata,
+                           u8 *ssid, size_t ssid_len)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_if_sta *ifsta;
+
+        if (sdata->vif.type != NL80211_IFTYPE_STATION)
+                return ieee80211_start_scan(sdata, ssid, ssid_len);
+
+        /*
+         * STA has a state machine that might need to defer scanning
+         * while it's trying to associate/authenticate, therefore we
+         * queue it up to the state machine in that case.
+         */
+
+        if (local->sw_scanning || local->hw_scanning) {
+                if (local->scan_sdata == sdata)
+                        return 0;
+                return -EBUSY;
+        }
+
+        ifsta = &sdata->u.sta;
+
+        ifsta->scan_ssid_len = ssid_len;
+        if (ssid_len)
+                memcpy(ifsta->scan_ssid, ssid, ssid_len);
+        set_bit(IEEE80211_STA_REQ_SCAN, &ifsta->request);
+        queue_work(local->hw.workqueue, &ifsta->work);
+
+        return 0;
+}
+
+
+static void ieee80211_scan_add_ies(struct iw_request_info *info,
+                                   struct ieee80211_bss *bss,
+                                   char **current_ev, char *end_buf)
+{
+        u8 *pos, *end, *next;
+        struct iw_event iwe;
+
+        if (bss == NULL || bss->ies == NULL)
+                return;
+
+        /*
+         * If needed, fragment the IEs buffer (at IE boundaries) into short
+         * enough fragments to fit into IW_GENERIC_IE_MAX octet messages.
+         */
+        pos = bss->ies;
+        end = pos + bss->ies_len;
+
+        while (end - pos > IW_GENERIC_IE_MAX) {
+                next = pos + 2 + pos[1];
+                while (next + 2 + next[1] - pos < IW_GENERIC_IE_MAX)
+                        next = next + 2 + next[1];
+
+                memset(&iwe, 0, sizeof(iwe));
+                iwe.cmd = IWEVGENIE;
+                iwe.u.data.length = next - pos;
+                *current_ev = iwe_stream_add_point(info, *current_ev,
+                                                   end_buf, &iwe, pos);
+
+                pos = next;
+        }
+
+        if (end > pos) {
+                memset(&iwe, 0, sizeof(iwe));
+                iwe.cmd = IWEVGENIE;
+                iwe.u.data.length = end - pos;
+                *current_ev = iwe_stream_add_point(info, *current_ev,
+                                                   end_buf, &iwe, pos);
+        }
+}
+
+
+static char *
+ieee80211_scan_result(struct ieee80211_local *local,
+                      struct iw_request_info *info,
+                      struct ieee80211_bss *bss,
+                      char *current_ev, char *end_buf)
+{
+        struct iw_event iwe;
+        char *buf;
+
+        if (time_after(jiffies,
+                       bss->last_update + IEEE80211_SCAN_RESULT_EXPIRE))
+                return current_ev;
+
+        memset(&iwe, 0, sizeof(iwe));
+        iwe.cmd = SIOCGIWAP;
+        iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
+        memcpy(iwe.u.ap_addr.sa_data, bss->bssid, ETH_ALEN);
+        current_ev = iwe_stream_add_event(info, current_ev, end_buf, &iwe,
+                                          IW_EV_ADDR_LEN);
+
+        memset(&iwe, 0, sizeof(iwe));
+        iwe.cmd = SIOCGIWESSID;
+        if (bss_mesh_cfg(bss)) {
+                iwe.u.data.length = bss_mesh_id_len(bss);
+                iwe.u.data.flags = 1;
+                current_ev = iwe_stream_add_point(info, current_ev, end_buf,
+                                                  &iwe, bss_mesh_id(bss));
+        } else {
+                iwe.u.data.length = bss->ssid_len;
+                iwe.u.data.flags = 1;
+                current_ev = iwe_stream_add_point(info, current_ev, end_buf,
+                                                  &iwe, bss->ssid);
+        }
+
+        if (bss->capability & (WLAN_CAPABILITY_ESS | WLAN_CAPABILITY_IBSS)
+            || bss_mesh_cfg(bss)) {
+                memset(&iwe, 0, sizeof(iwe));
+                iwe.cmd = SIOCGIWMODE;
+                if (bss_mesh_cfg(bss))
+                        iwe.u.mode = IW_MODE_MESH;
+                else if (bss->capability & WLAN_CAPABILITY_ESS)
+                        iwe.u.mode = IW_MODE_MASTER;
+                else
+                        iwe.u.mode = IW_MODE_ADHOC;
+                current_ev = iwe_stream_add_event(info, current_ev, end_buf,
+                                                  &iwe, IW_EV_UINT_LEN);
+        }
+
+        memset(&iwe, 0, sizeof(iwe));
+        iwe.cmd = SIOCGIWFREQ;
+        iwe.u.freq.m = ieee80211_frequency_to_channel(bss->freq);
+        iwe.u.freq.e = 0;
+        current_ev = iwe_stream_add_event(info, current_ev, end_buf, &iwe,
+                                          IW_EV_FREQ_LEN);
+
+        memset(&iwe, 0, sizeof(iwe));
+        iwe.cmd = SIOCGIWFREQ;
+        iwe.u.freq.m = bss->freq;
+        iwe.u.freq.e = 6;
+        current_ev = iwe_stream_add_event(info, current_ev, end_buf, &iwe,
+                                          IW_EV_FREQ_LEN);
+        memset(&iwe, 0, sizeof(iwe));
+        iwe.cmd = IWEVQUAL;
+        iwe.u.qual.qual = bss->qual;
+        iwe.u.qual.level = bss->signal;
+        iwe.u.qual.noise = bss->noise;
+        iwe.u.qual.updated = local->wstats_flags;
+        current_ev = iwe_stream_add_event(info, current_ev, end_buf, &iwe,
+                                          IW_EV_QUAL_LEN);
+
+        memset(&iwe, 0, sizeof(iwe));
+        iwe.cmd = SIOCGIWENCODE;
+        if (bss->capability & WLAN_CAPABILITY_PRIVACY)
+                iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
+        else
+                iwe.u.data.flags = IW_ENCODE_DISABLED;
+        iwe.u.data.length = 0;
+        current_ev = iwe_stream_add_point(info, current_ev, end_buf,
+                                          &iwe, "");
+
+        ieee80211_scan_add_ies(info, bss, &current_ev, end_buf);
+
+        if (bss->supp_rates_len > 0) {
+                /* display all supported rates in readable format */
+                char *p = current_ev + iwe_stream_lcp_len(info);
+                int i;
+
+                memset(&iwe, 0, sizeof(iwe));
+                iwe.cmd = SIOCGIWRATE;
+                /* Those two flags are ignored... */
+                iwe.u.bitrate.fixed = iwe.u.bitrate.disabled = 0;
+
+                for (i = 0; i < bss->supp_rates_len; i++) {
+                        iwe.u.bitrate.value = ((bss->supp_rates[i] &
+                                                        0x7f) * 500000);
+                        p = iwe_stream_add_value(info, current_ev, p,
+                                        end_buf, &iwe, IW_EV_PARAM_LEN);
+                }
+                current_ev = p;
+        }
+
+        buf = kmalloc(30, GFP_ATOMIC);
+        if (buf) {
+                memset(&iwe, 0, sizeof(iwe));
+                iwe.cmd = IWEVCUSTOM;
+                sprintf(buf, "tsf=%016llx", (unsigned long long)(bss->timestamp));
+                iwe.u.data.length = strlen(buf);
+                current_ev = iwe_stream_add_point(info, current_ev, end_buf,
+                                                  &iwe, buf);
+                memset(&iwe, 0, sizeof(iwe));
+                iwe.cmd = IWEVCUSTOM;
+                sprintf(buf, " Last beacon: %dms ago",
+                        jiffies_to_msecs(jiffies - bss->last_update));
+                iwe.u.data.length = strlen(buf);
+                current_ev = iwe_stream_add_point(info, current_ev,
+                                                  end_buf, &iwe, buf);
+                kfree(buf);
+        }
+
+        if (bss_mesh_cfg(bss)) {
+                u8 *cfg = bss_mesh_cfg(bss);
+                buf = kmalloc(50, GFP_ATOMIC);
+                if (buf) {
+                        memset(&iwe, 0, sizeof(iwe));
+                        iwe.cmd = IWEVCUSTOM;
+                        sprintf(buf, "Mesh network (version %d)", cfg[0]);
+                        iwe.u.data.length = strlen(buf);
+                        current_ev = iwe_stream_add_point(info, current_ev,
+                                                          end_buf,
+                                                          &iwe, buf);
+                        sprintf(buf, "Path Selection Protocol ID: "
+                                "0x%02X%02X%02X%02X", cfg[1], cfg[2], cfg[3],
+                                                        cfg[4]);
+                        iwe.u.data.length = strlen(buf);
+                        current_ev = iwe_stream_add_point(info, current_ev,
+                                                          end_buf,
+                                                          &iwe, buf);
+                        sprintf(buf, "Path Selection Metric ID: "
+                                "0x%02X%02X%02X%02X", cfg[5], cfg[6], cfg[7],
+                                                        cfg[8]);
+                        iwe.u.data.length = strlen(buf);
+                        current_ev = iwe_stream_add_point(info, current_ev,
+                                                          end_buf,
+                                                          &iwe, buf);
+                        sprintf(buf, "Congestion Control Mode ID: "
+                                "0x%02X%02X%02X%02X", cfg[9], cfg[10],
+                                                        cfg[11], cfg[12]);
+                        iwe.u.data.length = strlen(buf);
+                        current_ev = iwe_stream_add_point(info, current_ev,
+                                                          end_buf,
+                                                          &iwe, buf);
+                        sprintf(buf, "Channel Precedence: "
+                                "0x%02X%02X%02X%02X", cfg[13], cfg[14],
+                                                        cfg[15], cfg[16]);
+                        iwe.u.data.length = strlen(buf);
+                        current_ev = iwe_stream_add_point(info, current_ev,
+                                                          end_buf,
+                                                          &iwe, buf);
+                        kfree(buf);
+                }
+        }
+
+        return current_ev;
+}
+
+
+int ieee80211_scan_results(struct ieee80211_local *local,
+                           struct iw_request_info *info,
+                           char *buf, size_t len)
+{
+        char *current_ev = buf;
+        char *end_buf = buf + len;
+        struct ieee80211_bss *bss;
+
+        spin_lock_bh(&local->bss_lock);
+        list_for_each_entry(bss, &local->bss_list, list) {
+                if (buf + len - current_ev <= IW_EV_ADDR_LEN) {
+                        spin_unlock_bh(&local->bss_lock);
+                        return -E2BIG;
+                }
+                current_ev = ieee80211_scan_result(local, info, bss,
+                                                       current_ev, end_buf);
+        }
+        spin_unlock_bh(&local->bss_lock);
+        return current_ev - buf;
+}
diff --git a/net/mac80211/spectmgmt.c b/net/mac80211/spectmgmt.c
new file mode 100644
index 000000000000..f72bad636d8e
--- /dev/null
+++ b/net/mac80211/spectmgmt.c
@@ -0,0 +1,86 @@
+/*
+ * spectrum management
+ *
+ * Copyright 2003, Jouni Malinen <jkmaline@cc.hut.fi>
+ * Copyright 2002-2005, Instant802 Networks, Inc.
+ * Copyright 2005-2006, Devicescape Software, Inc.
+ * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
+ * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
+ * Copyright 2007-2008, Intel Corporation
+ * Copyright 2008, Johannes Berg <johannes@sipsolutions.net>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/ieee80211.h>
+#include <net/wireless.h>
+#include <net/mac80211.h>
+#include "ieee80211_i.h"
+#include "sta_info.h"
+#include "wme.h"
+
+static void ieee80211_send_refuse_measurement_request(struct ieee80211_sub_if_data *sdata,
+                                        struct ieee80211_msrment_ie *request_ie,
+                                        const u8 *da, const u8 *bssid,
+                                        u8 dialog_token)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct sk_buff *skb;
+        struct ieee80211_mgmt *msr_report;
+
+        skb = dev_alloc_skb(sizeof(*msr_report) + local->hw.extra_tx_headroom +
+                                sizeof(struct ieee80211_msrment_ie));
+
+        if (!skb) {
+                printk(KERN_ERR "%s: failed to allocate buffer for "
+                                "measurement report frame\n", sdata->dev->name);
+                return;
+        }
+
+        skb_reserve(skb, local->hw.extra_tx_headroom);
+        msr_report = (struct ieee80211_mgmt *)skb_put(skb, 24);
+        memset(msr_report, 0, 24);
+        memcpy(msr_report->da, da, ETH_ALEN);
+        memcpy(msr_report->sa, sdata->dev->dev_addr, ETH_ALEN);
+        memcpy(msr_report->bssid, bssid, ETH_ALEN);
+        msr_report->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
+                                                IEEE80211_STYPE_ACTION);
+
+        skb_put(skb, 1 + sizeof(msr_report->u.action.u.measurement));
+        msr_report->u.action.category = WLAN_CATEGORY_SPECTRUM_MGMT;
+        msr_report->u.action.u.measurement.action_code =
+                                WLAN_ACTION_SPCT_MSR_RPRT;
+        msr_report->u.action.u.measurement.dialog_token = dialog_token;
+
+        msr_report->u.action.u.measurement.element_id = WLAN_EID_MEASURE_REPORT;
+        msr_report->u.action.u.measurement.length =
+                        sizeof(struct ieee80211_msrment_ie);
+
+        memset(&msr_report->u.action.u.measurement.msr_elem, 0,
+                sizeof(struct ieee80211_msrment_ie));
+        msr_report->u.action.u.measurement.msr_elem.token = request_ie->token;
+        msr_report->u.action.u.measurement.msr_elem.mode |=
+                        IEEE80211_SPCT_MSR_RPRT_MODE_REFUSED;
+        msr_report->u.action.u.measurement.msr_elem.type = request_ie->type;
+
+        ieee80211_tx_skb(sdata, skb, 0);
+}
+
+void ieee80211_process_measurement_req(struct ieee80211_sub_if_data *sdata,
+                                       struct ieee80211_mgmt *mgmt,
+                                       size_t len)
+{
+        /*
+         * Ignoring measurement request is spec violation.
+         * Mandatory measurements must be reported optional
+         * measurements might be refused or reported incapable
+         * For now just refuse
+         * TODO: Answer basic measurement as unmeasured
+         */
+        ieee80211_send_refuse_measurement_request(sdata,
+                        &mgmt->u.action.u.measurement.msr_elem,
+                        mgmt->sa, mgmt->bssid,
+                        mgmt->u.action.u.measurement.dialog_token);
+}
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index f2ba653b9d69..9b72d15bc8dc 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -73,11 +73,11 @@ static int sta_info_hash_del(struct ieee80211_local *local,
 {
         struct sta_info *s;
 
-        s = local->sta_hash[STA_HASH(sta->addr)];
+        s = local->sta_hash[STA_HASH(sta->sta.addr)];
         if (!s)
                 return -ENOENT;
         if (s == sta) {
-                rcu_assign_pointer(local->sta_hash[STA_HASH(sta->addr)],
+                rcu_assign_pointer(local->sta_hash[STA_HASH(sta->sta.addr)],
                                    s->hnext);
                 return 0;
         }
@@ -93,26 +93,19 @@ static int sta_info_hash_del(struct ieee80211_local *local,
 }
 
 /* protected by RCU */
-static struct sta_info *__sta_info_find(struct ieee80211_local *local,
-                                        u8 *addr)
+struct sta_info *sta_info_get(struct ieee80211_local *local, const u8 *addr)
 {
         struct sta_info *sta;
 
         sta = rcu_dereference(local->sta_hash[STA_HASH(addr)]);
         while (sta) {
-                if (compare_ether_addr(sta->addr, addr) == 0)
+                if (compare_ether_addr(sta->sta.addr, addr) == 0)
                         break;
                 sta = rcu_dereference(sta->hnext);
         }
         return sta;
 }
 
-struct sta_info *sta_info_get(struct ieee80211_local *local, u8 *addr)
-{
-        return __sta_info_find(local, addr);
-}
-EXPORT_SYMBOL(sta_info_get);
-
 struct sta_info *sta_info_get_by_idx(struct ieee80211_local *local, int idx,
                                      struct net_device *dev)
 {
@@ -146,12 +139,12 @@ static void __sta_info_free(struct ieee80211_local *local,
 {
         DECLARE_MAC_BUF(mbuf);
 
-        rate_control_free_sta(sta->rate_ctrl, sta->rate_ctrl_priv);
+        rate_control_free_sta(sta);
         rate_control_put(sta->rate_ctrl);
 
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
         printk(KERN_DEBUG "%s: Destroyed STA %s\n",
-               wiphy_name(local->hw.wiphy), print_mac(mbuf, sta->addr));
+               wiphy_name(local->hw.wiphy), print_mac(mbuf, sta->sta.addr));
 #endif /* CONFIG_MAC80211_VERBOSE_DEBUG */
 
         kfree(sta);
@@ -219,8 +212,8 @@ void sta_info_destroy(struct sta_info *sta)
 static void sta_info_hash_add(struct ieee80211_local *local,
                               struct sta_info *sta)
 {
-        sta->hnext = local->sta_hash[STA_HASH(sta->addr)];
-        rcu_assign_pointer(local->sta_hash[STA_HASH(sta->addr)], sta);
+        sta->hnext = local->sta_hash[STA_HASH(sta->sta.addr)];
+        rcu_assign_pointer(local->sta_hash[STA_HASH(sta->sta.addr)], sta);
 }
 
 struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
@@ -231,20 +224,20 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
         int i;
         DECLARE_MAC_BUF(mbuf);
 
-        sta = kzalloc(sizeof(*sta), gfp);
+        sta = kzalloc(sizeof(*sta) + local->hw.sta_data_size, gfp);
         if (!sta)
                 return NULL;
 
         spin_lock_init(&sta->lock);
         spin_lock_init(&sta->flaglock);
 
-        memcpy(sta->addr, addr, ETH_ALEN);
+        memcpy(sta->sta.addr, addr, ETH_ALEN);
         sta->local = local;
         sta->sdata = sdata;
 
         sta->rate_ctrl = rate_control_get(local->rate_ctrl);
         sta->rate_ctrl_priv = rate_control_alloc_sta(sta->rate_ctrl,
-                                                     gfp);
+                                                     &sta->sta, gfp);
         if (!sta->rate_ctrl_priv) {
                 rate_control_put(sta->rate_ctrl);
                 kfree(sta);
@@ -271,7 +264,7 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
 
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
         printk(KERN_DEBUG "%s: Allocated STA %s\n",
-               wiphy_name(local->hw.wiphy), print_mac(mbuf, sta->addr));
+               wiphy_name(local->hw.wiphy), print_mac(mbuf, sta->sta.addr));
 #endif /* CONFIG_MAC80211_VERBOSE_DEBUG */
 
 #ifdef CONFIG_MAC80211_MESH
@@ -300,15 +293,15 @@ int sta_info_insert(struct sta_info *sta)
                 goto out_free;
         }
 
-        if (WARN_ON(compare_ether_addr(sta->addr, sdata->dev->dev_addr) == 0 ||
-                    is_multicast_ether_addr(sta->addr))) {
+        if (WARN_ON(compare_ether_addr(sta->sta.addr, sdata->dev->dev_addr) == 0 ||
+                    is_multicast_ether_addr(sta->sta.addr))) {
                 err = -EINVAL;
                 goto out_free;
         }
 
         spin_lock_irqsave(&local->sta_lock, flags);
         /* check if STA exists already */
-        if (__sta_info_find(local, sta->addr)) {
+        if (sta_info_get(local, sta->sta.addr)) {
                 spin_unlock_irqrestore(&local->sta_lock, flags);
                 err = -EEXIST;
                 goto out_free;
@@ -319,18 +312,18 @@ int sta_info_insert(struct sta_info *sta)
 
         /* notify driver */
         if (local->ops->sta_notify) {
-                if (sdata->vif.type == IEEE80211_IF_TYPE_VLAN)
+                if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
                         sdata = container_of(sdata->bss,
                                              struct ieee80211_sub_if_data,
                                              u.ap);
 
                 local->ops->sta_notify(local_to_hw(local), &sdata->vif,
-                                       STA_NOTIFY_ADD, sta->addr);
+                                       STA_NOTIFY_ADD, &sta->sta);
         }
 
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
         printk(KERN_DEBUG "%s: Inserted STA %s\n",
-               wiphy_name(local->hw.wiphy), print_mac(mac, sta->addr));
+               wiphy_name(local->hw.wiphy), print_mac(mac, sta->sta.addr));
 #endif /* CONFIG_MAC80211_VERBOSE_DEBUG */
 
         spin_unlock_irqrestore(&local->sta_lock, flags);
@@ -379,11 +372,12 @@ static void __sta_info_set_tim_bit(struct ieee80211_if_ap *bss,
 {
         BUG_ON(!bss);
 
-        __bss_tim_set(bss, sta->aid);
+        __bss_tim_set(bss, sta->sta.aid);
 
         if (sta->local->ops->set_tim) {
                 sta->local->tim_in_locked_section = true;
-                sta->local->ops->set_tim(local_to_hw(sta->local), sta->aid, 1);
+                sta->local->ops->set_tim(local_to_hw(sta->local),
+                                         &sta->sta, true);
                 sta->local->tim_in_locked_section = false;
         }
 }
@@ -404,11 +398,12 @@ static void __sta_info_clear_tim_bit(struct ieee80211_if_ap *bss,
 {
         BUG_ON(!bss);
 
-        __bss_tim_clear(bss, sta->aid);
+        __bss_tim_clear(bss, sta->sta.aid);
 
         if (sta->local->ops->set_tim) {
                 sta->local->tim_in_locked_section = true;
-                sta->local->ops->set_tim(local_to_hw(sta->local), sta->aid, 0);
+                sta->local->ops->set_tim(local_to_hw(sta->local),
+                                         &sta->sta, false);
                 sta->local->tim_in_locked_section = false;
         }
 }
@@ -424,7 +419,7 @@ void sta_info_clear_tim_bit(struct sta_info *sta)
         spin_unlock_irqrestore(&sta->local->sta_lock, flags);
 }
 
-void __sta_info_unlink(struct sta_info **sta)
+static void __sta_info_unlink(struct sta_info **sta)
 {
         struct ieee80211_local *local = (*sta)->local;
         struct ieee80211_sub_if_data *sdata = (*sta)->sdata;
@@ -456,13 +451,13 @@ void __sta_info_unlink(struct sta_info **sta)
         local->num_sta--;
 
         if (local->ops->sta_notify) {
-                if (sdata->vif.type == IEEE80211_IF_TYPE_VLAN)
+                if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
                         sdata = container_of(sdata->bss,
                                              struct ieee80211_sub_if_data,
                                              u.ap);
 
                 local->ops->sta_notify(local_to_hw(local), &sdata->vif,
-                                       STA_NOTIFY_REMOVE, (*sta)->addr);
+                                       STA_NOTIFY_REMOVE, &(*sta)->sta);
         }
 
         if (ieee80211_vif_is_mesh(&sdata->vif)) {
@@ -474,7 +469,7 @@ void __sta_info_unlink(struct sta_info **sta)
 
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
         printk(KERN_DEBUG "%s: Removed STA %s\n",
-               wiphy_name(local->hw.wiphy), print_mac(mbuf, (*sta)->addr));
+               wiphy_name(local->hw.wiphy), print_mac(mbuf, (*sta)->sta.addr));
 #endif /* CONFIG_MAC80211_VERBOSE_DEBUG */
 
         /*
@@ -570,7 +565,7 @@ static void sta_info_cleanup_expire_buffered(struct ieee80211_local *local,
                 local->total_ps_buffered--;
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
                 printk(KERN_DEBUG "Buffered frame expired (STA "
-                       "%s)\n", print_mac(mac, sta->addr));
+                       "%s)\n", print_mac(mac, sta->sta.addr));
 #endif
                 dev_kfree_skb(skb);
 
@@ -802,3 +797,40 @@ void sta_info_flush_delayed(struct ieee80211_sub_if_data *sdata)
                 schedule_work(&local->sta_flush_work);
         spin_unlock_irqrestore(&local->sta_lock, flags);
 }
+
+void ieee80211_sta_expire(struct ieee80211_sub_if_data *sdata,
+                          unsigned long exp_time)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct sta_info *sta, *tmp;
+        LIST_HEAD(tmp_list);
+        DECLARE_MAC_BUF(mac);
+        unsigned long flags;
+
+        spin_lock_irqsave(&local->sta_lock, flags);
+        list_for_each_entry_safe(sta, tmp, &local->sta_list, list)
+                if (time_after(jiffies, sta->last_rx + exp_time)) {
+#ifdef CONFIG_MAC80211_IBSS_DEBUG
+                        printk(KERN_DEBUG "%s: expiring inactive STA %s\n",
+                               sdata->dev->name, print_mac(mac, sta->sta.addr));
+#endif
+                        __sta_info_unlink(&sta);
+                        if (sta)
+                                list_add(&sta->list, &tmp_list);
+                }
+        spin_unlock_irqrestore(&local->sta_lock, flags);
+
+        list_for_each_entry_safe(sta, tmp, &tmp_list, list)
+                sta_info_destroy(sta);
+}
+
+struct ieee80211_sta *ieee80211_find_sta(struct ieee80211_hw *hw,
+                                         const u8 *addr)
+{
+        struct sta_info *sta = sta_info_get(hw_to_local(hw), addr);
+
+        if (!sta)
+                return NULL;
+        return &sta->sta;
+}
+EXPORT_SYMBOL(ieee80211_find_sta);
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index 109db787ccb7..a6b51862a89d 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -167,8 +167,6 @@ struct sta_ampdu_mlme {
  * @lock: used for locking all fields that require locking, see comments
  *      in the header file.
  * @flaglock: spinlock for flags accesses
- * @ht_info: HT capabilities of this STA
- * @supp_rates: Bitmap of supported rates (per band)
  * @addr: MAC address of this STA
  * @aid: STA's unique AID (1..2007, 0 = not assigned yet),
  *      only used in AP (and IBSS?) mode
@@ -191,20 +189,15 @@ struct sta_ampdu_mlme {
  * @last_qual: qual of last received frame from this STA
  * @last_noise: noise of last received frame from this STA
  * @last_seq_ctrl: last received seq/frag number from this STA (per RX queue)
- * @wme_rx_queue: TBD
  * @tx_filtered_count: TBD
  * @tx_retry_failed: TBD
  * @tx_retry_count: TBD
- * @tx_num_consecutive_failures: TBD
- * @tx_num_mpdu_ok: TBD
- * @tx_num_mpdu_fail: TBD
  * @fail_avg: moving percentage of failed MSDUs
  * @tx_packets: number of RX/TX MSDUs
  * @tx_bytes: TBD
  * @tx_fragments: number of transmitted MPDUs
- * @txrate_idx: TBD
- * @last_txrate_idx: TBD
- * @wme_tx_queue: TBD
+ * @last_txrate_idx: Index of the last used transmit rate
+ * @tid_seq: TBD
  * @ampdu_mlme: TBD
  * @timer_to_tid: identity mapping to ID timers
  * @tid_to_tx_q: map tid to tx queue
@@ -217,6 +210,7 @@ struct sta_ampdu_mlme {
  * @plink_timeout: TBD
  * @plink_timer: TBD
  * @debugfs: debug filesystem info
+ * @sta: station information we share with the driver
  */
 struct sta_info {
         /* General information, mostly static */
@@ -229,10 +223,7 @@ struct sta_info {
         void *rate_ctrl_priv;
         spinlock_t lock;
         spinlock_t flaglock;
-        struct ieee80211_ht_info ht_info;
-        u64 supp_rates[IEEE80211_NUM_BANDS];
-        u8 addr[ETH_ALEN];
-        u16 aid;
+
         u16 listen_interval;
 
         /*
@@ -265,17 +256,10 @@ struct sta_info {
         int last_qual;
         int last_noise;
         __le16 last_seq_ctrl[NUM_RX_DATA_QUEUES];
-#ifdef CONFIG_MAC80211_DEBUG_COUNTERS
-        unsigned int wme_rx_queue[NUM_RX_DATA_QUEUES];
-#endif
 
         /* Updated from TX status path only, no locking requirements */
         unsigned long tx_filtered_count;
         unsigned long tx_retry_failed, tx_retry_count;
-        /* TODO: update in generic code not rate control? */
-        u32 tx_num_consecutive_failures;
-        u32 tx_num_mpdu_ok;
-        u32 tx_num_mpdu_fail;
         /* moving percentage of failed MSDUs */
         unsigned int fail_avg;
 
@@ -283,12 +267,8 @@ struct sta_info {
         unsigned long tx_packets;
         unsigned long tx_bytes;
         unsigned long tx_fragments;
-        int txrate_idx;
-        int last_txrate_idx;
+        unsigned int last_txrate_idx;
         u16 tid_seq[IEEE80211_QOS_CTL_TID_MASK + 1];
-#ifdef CONFIG_MAC80211_DEBUG_COUNTERS
-        unsigned int wme_tx_queue[NUM_RX_DATA_QUEUES];
-#endif
 
         /*
          * Aggregation information, locked with lock.
@@ -319,13 +299,12 @@ struct sta_info {
                 struct dentry *num_ps_buf_frames;
                 struct dentry *inactive_ms;
                 struct dentry *last_seq_ctrl;
-#ifdef CONFIG_MAC80211_DEBUG_COUNTERS
-                struct dentry *wme_rx_queue;
-                struct dentry *wme_tx_queue;
-#endif
                 struct dentry *agg_status;
         } debugfs;
 #endif
+
+        /* keep last! */
+        struct ieee80211_sta sta;
 };
 
 static inline enum plink_state sta_plink_state(struct sta_info *sta)
@@ -425,7 +404,7 @@ static inline u32 get_sta_flags(struct sta_info *sta)
 /*
  * Get a STA info, must have be under RCU read lock.
  */
-struct sta_info *sta_info_get(struct ieee80211_local *local, u8 *addr);
+struct sta_info *sta_info_get(struct ieee80211_local *local, const u8 *addr);
 /*
  * Get STA info by index, BROKEN!
  */
@@ -451,7 +430,6 @@ int sta_info_insert(struct sta_info *sta);
  * has already unlinked it.
  */
 void sta_info_unlink(struct sta_info **sta);
-void __sta_info_unlink(struct sta_info **sta);
 
 void sta_info_destroy(struct sta_info *sta);
 void sta_info_set_tim_bit(struct sta_info *sta);
@@ -463,5 +441,7 @@ void sta_info_stop(struct ieee80211_local *local);
 int sta_info_flush(struct ieee80211_local *local,
                     struct ieee80211_sub_if_data *sdata);
 void sta_info_flush_delayed(struct ieee80211_sub_if_data *sdata);
+void ieee80211_sta_expire(struct ieee80211_sub_if_data *sdata,
+                          unsigned long exp_time);
 
 #endif /* STA_INFO_H */
diff --git a/net/mac80211/tkip.c b/net/mac80211/tkip.c
index 995f7af3d25e..34b32bc8f609 100644
--- a/net/mac80211/tkip.c
+++ b/net/mac80211/tkip.c
@@ -304,7 +304,7 @@ int ieee80211_tkip_decrypt_data(struct crypto_blkcipher *tfm,
                         key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) {
                         u8 bcast[ETH_ALEN] =
                                 {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
-                        u8 *sta_addr = key->sta->addr;
+                        u8 *sta_addr = key->sta->sta.addr;
 
                         if (is_multicast_ether_addr(ra))
                                 sta_addr = bcast;
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 4788f7b91f49..0cc2e23f082c 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -38,43 +38,6 @@
 
 /* misc utils */
 
-#ifdef CONFIG_MAC80211_LOWTX_FRAME_DUMP
-static void ieee80211_dump_frame(const char *ifname, const char *title,
-                                 const struct sk_buff *skb)
-{
-        const struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
-        unsigned int hdrlen;
-        DECLARE_MAC_BUF(mac);
-
-        printk(KERN_DEBUG "%s: %s (len=%d)", ifname, title, skb->len);
-        if (skb->len < 4) {
-                printk("\n");
-                return;
-        }
-
-        hdrlen = ieee80211_hdrlen(hdr->frame_control);
-        if (hdrlen > skb->len)
-                hdrlen = skb->len;
-        if (hdrlen >= 4)
-                printk(" FC=0x%04x DUR=0x%04x",
-                    le16_to_cpu(hdr->frame_control), le16_to_cpu(hdr->duration_id));
-        if (hdrlen >= 10)
-                printk(" A1=%s", print_mac(mac, hdr->addr1));
-        if (hdrlen >= 16)
-                printk(" A2=%s", print_mac(mac, hdr->addr2));
-        if (hdrlen >= 24)
-                printk(" A3=%s", print_mac(mac, hdr->addr3));
-        if (hdrlen >= 30)
-                printk(" A4=%s", print_mac(mac, hdr->addr4));
-        printk("\n");
-}
-#else /* CONFIG_MAC80211_LOWTX_FRAME_DUMP */
-static inline void ieee80211_dump_frame(const char *ifname, const char *title,
-                                        struct sk_buff *skb)
-{
-}
-#endif /* CONFIG_MAC80211_LOWTX_FRAME_DUMP */
-
 static __le16 ieee80211_duration(struct ieee80211_tx_data *tx, int group_addr,
                                  int next_frag_len)
 {
@@ -82,6 +45,7 @@ static __le16 ieee80211_duration(struct ieee80211_tx_data *tx, int group_addr,
         struct ieee80211_rate *txrate;
         struct ieee80211_local *local = tx->local;
         struct ieee80211_supported_band *sband;
+        struct ieee80211_hdr *hdr;
 
         sband = local->hw.wiphy->bands[tx->channel->band];
         txrate = &sband->bitrates[tx->rate_idx];
@@ -107,10 +71,10 @@ static __le16 ieee80211_duration(struct ieee80211_tx_data *tx, int group_addr,
          *   at the highest possible rate belonging to the PHY rates in the
          *   BSSBasicRateSet
          */
-
-        if ((tx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_CTL) {
+        hdr = (struct ieee80211_hdr *)tx->skb->data;
+        if (ieee80211_is_ctl(hdr->frame_control)) {
                 /* TODO: These control frames are not currently sent by
-                 * 80211.o, but should they be implemented, this function
+                 * mac80211, but should they be implemented, this function
                  * needs to be updated to support duration field calculation.
                  *
                  * RTS: time needed to transmit pending data/mgmt frame plus
@@ -152,7 +116,7 @@ static __le16 ieee80211_duration(struct ieee80211_tx_data *tx, int group_addr,
                 if (r->bitrate > txrate->bitrate)
                         break;
 
-                if (tx->sdata->basic_rates & BIT(i))
+                if (tx->sdata->bss_conf.basic_rates & BIT(i))
                         rate = r->bitrate;
 
                 switch (sband->band) {
@@ -201,11 +165,10 @@ static __le16 ieee80211_duration(struct ieee80211_tx_data *tx, int group_addr,
         return cpu_to_le16(dur);
 }
 
-static int inline is_ieee80211_device(struct net_device *dev,
-                                      struct net_device *master)
+static int inline is_ieee80211_device(struct ieee80211_local *local,
+                                      struct net_device *dev)
 {
-        return (wdev_priv(dev->ieee80211_ptr) ==
-                wdev_priv(master->ieee80211_ptr));
+        return local == wdev_priv(dev->ieee80211_ptr);
 }
 
 /* tx handlers */
@@ -213,21 +176,19 @@ static int inline is_ieee80211_device(struct net_device *dev,
 static ieee80211_tx_result debug_noinline
 ieee80211_tx_h_check_assoc(struct ieee80211_tx_data *tx)
 {
-#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
+
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
-#endif /* CONFIG_MAC80211_VERBOSE_DEBUG */
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
         u32 sta_flags;
 
         if (unlikely(info->flags & IEEE80211_TX_CTL_INJECTED))
                 return TX_CONTINUE;
 
-        if (unlikely(tx->local->sta_sw_scanning) &&
-            ((tx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_MGMT ||
-             (tx->fc & IEEE80211_FCTL_STYPE) != IEEE80211_STYPE_PROBE_REQ))
+        if (unlikely(tx->local->sw_scanning) &&
+            !ieee80211_is_probe_req(hdr->frame_control))
                 return TX_DROP;
 
-        if (tx->sdata->vif.type == IEEE80211_IF_TYPE_MESH_POINT)
+        if (tx->sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
                 return TX_CONTINUE;
 
         if (tx->flags & IEEE80211_TX_PS_BUFFERED)
@@ -237,8 +198,8 @@ ieee80211_tx_h_check_assoc(struct ieee80211_tx_data *tx)
 
         if (likely(tx->flags & IEEE80211_TX_UNICAST)) {
                 if (unlikely(!(sta_flags & WLAN_STA_ASSOC) &&
-                             tx->sdata->vif.type != IEEE80211_IF_TYPE_IBSS &&
-                             (tx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA)) {
+                             tx->sdata->vif.type != NL80211_IFTYPE_ADHOC &&
+                             ieee80211_is_data(hdr->frame_control))) {
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
                         DECLARE_MAC_BUF(mac);
                         printk(KERN_DEBUG "%s: dropped data frame to not "
@@ -249,9 +210,9 @@ ieee80211_tx_h_check_assoc(struct ieee80211_tx_data *tx)
                         return TX_DROP;
                 }
         } else {
-                if (unlikely((tx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA &&
+                if (unlikely(ieee80211_is_data(hdr->frame_control) &&
                              tx->local->num_sta == 0 &&
-                             tx->sdata->vif.type != IEEE80211_IF_TYPE_IBSS)) {
+                             tx->sdata->vif.type != NL80211_IFTYPE_ADHOC)) {
                         /*
                          * No associated STAs - no need to send multicast
                          * frames.
@@ -282,7 +243,7 @@ static void purge_old_ps_buffers(struct ieee80211_local *local)
 
         list_for_each_entry_rcu(sdata, &local->interfaces, list) {
                 struct ieee80211_if_ap *ap;
-                if (sdata->vif.type != IEEE80211_IF_TYPE_AP)
+                if (sdata->vif.type != NL80211_IFTYPE_AP)
                         continue;
                 ap = &sdata->u.ap;
                 skb = skb_dequeue(&ap->ps_bc_buf);
@@ -315,6 +276,7 @@ static ieee80211_tx_result
 ieee80211_tx_h_multicast_ps_buf(struct ieee80211_tx_data *tx)
 {
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
 
         /*
          * broadcast/multicast frame
@@ -329,7 +291,7 @@ ieee80211_tx_h_multicast_ps_buf(struct ieee80211_tx_data *tx)
                 return TX_CONTINUE;
 
         /* no buffering for ordered frames */
-        if (tx->fc & IEEE80211_FCTL_ORDER)
+        if (ieee80211_has_order(hdr->frame_control))
                 return TX_CONTINUE;
 
         /* no stations in PS mode */
@@ -367,12 +329,11 @@ ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx)
 {
         struct sta_info *sta = tx->sta;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
         u32 staflags;
         DECLARE_MAC_BUF(mac);
 
-        if (unlikely(!sta ||
-                     ((tx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_MGMT &&
-                      (tx->fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_PROBE_RESP)))
+        if (unlikely(!sta || ieee80211_is_probe_resp(hdr->frame_control)))
                 return TX_CONTINUE;
 
         staflags = get_sta_flags(sta);
@@ -382,7 +343,7 @@ ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx)
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
                 printk(KERN_DEBUG "STA %s aid %d: PS buffer (entries "
                        "before %d)\n",
-                       print_mac(mac, sta->addr), sta->aid,
+                       print_mac(mac, sta->sta.addr), sta->sta.aid,
                        skb_queue_len(&sta->ps_tx_buf));
 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
                 if (tx->local->total_ps_buffered >= TOTAL_MAX_TX_BUFFER)
@@ -393,7 +354,7 @@ ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx)
                         if (net_ratelimit()) {
                                 printk(KERN_DEBUG "%s: STA %s TX "
                                        "buffer full - dropping oldest frame\n",
-                                       tx->dev->name, print_mac(mac, sta->addr));
+                                       tx->dev->name, print_mac(mac, sta->sta.addr));
                         }
 #endif
                         dev_kfree_skb(old);
@@ -412,7 +373,7 @@ ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx)
         else if (unlikely(test_sta_flags(sta, WLAN_STA_PS))) {
                 printk(KERN_DEBUG "%s: STA %s in PS mode, but pspoll "
                        "set -> send frame\n", tx->dev->name,
-                       print_mac(mac, sta->addr));
+                       print_mac(mac, sta->sta.addr));
         }
 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
         clear_sta_flags(sta, WLAN_STA_PSPOLL);
@@ -437,7 +398,7 @@ ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx)
 {
         struct ieee80211_key *key;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
-        u16 fc = tx->fc;
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
 
         if (unlikely(tx->skb->do_not_encrypt))
                 tx->key = NULL;
@@ -454,22 +415,16 @@ ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx)
                 tx->key = NULL;
 
         if (tx->key) {
-                u16 ftype, stype;
-
                 tx->key->tx_rx_count++;
                 /* TODO: add threshold stuff again */
 
                 switch (tx->key->conf.alg) {
                 case ALG_WEP:
-                        ftype = fc & IEEE80211_FCTL_FTYPE;
-                        stype = fc & IEEE80211_FCTL_STYPE;
-
-                        if (ftype == IEEE80211_FTYPE_MGMT &&
-                            stype == IEEE80211_STYPE_AUTH)
+                        if (ieee80211_is_auth(hdr->frame_control))
                                 break;
                 case ALG_TKIP:
                 case ALG_CCMP:
-                        if (!WLAN_FC_DATA_PRESENT(fc))
+                        if (!ieee80211_is_data_present(hdr->frame_control))
                                 tx->key = NULL;
                         break;
                 }
@@ -491,7 +446,10 @@ ieee80211_tx_h_rate_ctrl(struct ieee80211_tx_data *tx)
         sband = tx->local->hw.wiphy->bands[tx->channel->band];
 
         if (likely(tx->rate_idx < 0)) {
-                rate_control_get_rate(tx->dev, sband, tx->skb, &rsel);
+                rate_control_get_rate(tx->sdata, sband, tx->sta,
+                                      tx->skb, &rsel);
+                if (tx->sta)
+                        tx->sta->last_txrate_idx = rsel.rate_idx;
                 tx->rate_idx = rsel.rate_idx;
                 if (unlikely(rsel.probe_idx >= 0)) {
                         info->flags |= IEEE80211_TX_CTL_RATE_CTRL_PROBE;
@@ -535,7 +493,7 @@ ieee80211_tx_h_misc(struct ieee80211_tx_data *tx)
         sband = tx->local->hw.wiphy->bands[tx->channel->band];
 
         if (tx->sta)
-                info->control.aid = tx->sta->aid;
+                info->control.sta = &tx->sta->sta;
 
         if (!info->control.retry_limit) {
                 if (!is_multicast_ether_addr(hdr->addr1)) {
@@ -601,7 +559,7 @@ ieee80211_tx_h_misc(struct ieee80211_tx_data *tx)
                 for (idx = 0; idx < sband->n_bitrates; idx++) {
                         if (sband->bitrates[idx].bitrate > rate->bitrate)
                                 continue;
-                        if (tx->sdata->basic_rates & BIT(idx) &&
+                        if (tx->sdata->bss_conf.basic_rates & BIT(idx) &&
                             (baserate < 0 ||
                              (sband->bitrates[baserate].bitrate
                               < sband->bitrates[idx].bitrate)))
@@ -615,7 +573,7 @@ ieee80211_tx_h_misc(struct ieee80211_tx_data *tx)
         }
 
         if (tx->sta)
-                info->control.aid = tx->sta->aid;
+                info->control.sta = &tx->sta->sta;
 
         return TX_CONTINUE;
 }
@@ -629,7 +587,14 @@ ieee80211_tx_h_sequence(struct ieee80211_tx_data *tx)
         u8 *qc;
         int tid;
 
-        /* only for injected frames */
+        /*
+         * Packet injection may want to control the sequence
+         * number, if we have no matching interface then we
+         * neither assign one ourselves nor ask the driver to.
+         */
+        if (unlikely(!info->control.vif))
+                return TX_CONTINUE;
+
         if (unlikely(ieee80211_is_ctl(hdr->frame_control)))
                 return TX_CONTINUE;
 
@@ -854,7 +819,6 @@ __ieee80211_parse_tx_radiotap(struct ieee80211_tx_data *tx,
         sband = tx->local->hw.wiphy->bands[tx->channel->band];
 
         skb->do_not_encrypt = 1;
-        info->flags |= IEEE80211_TX_CTL_INJECTED;
         tx->flags &= ~IEEE80211_TX_FRAGMENTED;
 
         /*
@@ -986,7 +950,7 @@ __ieee80211_tx_prepare(struct ieee80211_tx_data *tx,
 
         /* process and remove the injection radiotap header */
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        if (unlikely(sdata->vif.type == IEEE80211_IF_TYPE_MNTR)) {
+        if (unlikely(info->flags & IEEE80211_TX_CTL_INJECTED)) {
                 if (__ieee80211_parse_tx_radiotap(tx, skb) == TX_DROP)
                         return TX_DROP;
 
@@ -1000,7 +964,6 @@ __ieee80211_tx_prepare(struct ieee80211_tx_data *tx,
         hdr = (struct ieee80211_hdr *) skb->data;
 
         tx->sta = sta_info_get(local, hdr->addr1);
-        tx->fc = le16_to_cpu(hdr->frame_control);
 
         if (is_multicast_ether_addr(hdr->addr1)) {
                 tx->flags &= ~IEEE80211_TX_UNICAST;
@@ -1025,7 +988,7 @@ __ieee80211_tx_prepare(struct ieee80211_tx_data *tx,
         else if (test_and_clear_sta_flags(tx->sta, WLAN_STA_CLEAR_PS_FILT))
                 info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT;
 
-        hdrlen = ieee80211_get_hdrlen(tx->fc);
+        hdrlen = ieee80211_hdrlen(hdr->frame_control);
         if (skb->len > hdrlen + sizeof(rfc1042_header) + 2) {
                 u8 *pos = &skb->data[hdrlen + sizeof(rfc1042_header)];
                 tx->ethertype = (pos[0] << 8) | pos[1];
@@ -1038,14 +1001,14 @@ __ieee80211_tx_prepare(struct ieee80211_tx_data *tx,
 /*
  * NB: @tx is uninitialised when passed in here
  */
-static int ieee80211_tx_prepare(struct ieee80211_tx_data *tx,
-                                struct sk_buff *skb,
-                                struct net_device *mdev)
+static int ieee80211_tx_prepare(struct ieee80211_local *local,
+                                struct ieee80211_tx_data *tx,
+                                struct sk_buff *skb)
 {
         struct net_device *dev;
 
         dev = dev_get_by_index(&init_net, skb->iif);
-        if (unlikely(dev && !is_ieee80211_device(dev, mdev))) {
+        if (unlikely(dev && !is_ieee80211_device(local, dev))) {
                 dev_put(dev);
                 dev = NULL;
         }
@@ -1068,8 +1031,6 @@ static int __ieee80211_tx(struct ieee80211_local *local, struct sk_buff *skb,
                         return IEEE80211_TX_AGAIN;
                 info =  IEEE80211_SKB_CB(skb);
 
-                ieee80211_dump_frame(wiphy_name(local->hw.wiphy),
-                                     "TX to low-level driver", skb);
                 ret = local->ops->tx(local_to_hw(local), skb);
                 if (ret)
                         return IEEE80211_TX_AGAIN;
@@ -1099,9 +1060,6 @@ static int __ieee80211_tx(struct ieee80211_local *local, struct sk_buff *skb,
                                                 ~IEEE80211_TX_CTL_RATE_CTRL_PROBE;
                         }
 
-                        ieee80211_dump_frame(wiphy_name(local->hw.wiphy),
-                                             "TX to low-level driver",
-                                             tx->extra_frag[i]);
                         ret = local->ops->tx(local_to_hw(local),
                                             tx->extra_frag[i]);
                         if (ret)
@@ -1300,17 +1258,24 @@ static int ieee80211_skb_resize(struct ieee80211_local *local,
 int ieee80211_master_start_xmit(struct sk_buff *skb,
                                 struct net_device *dev)
 {
+        struct ieee80211_master_priv *mpriv = netdev_priv(dev);
+        struct ieee80211_local *local = mpriv->local;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
         struct net_device *odev = NULL;
         struct ieee80211_sub_if_data *osdata;
         int headroom;
         bool may_encrypt;
+        enum {
+                NOT_MONITOR,
+                FOUND_SDATA,
+                UNKNOWN_ADDRESS,
+        } monitor_iface = NOT_MONITOR;
         int ret;
 
         if (skb->iif)
                 odev = dev_get_by_index(&init_net, skb->iif);
-        if (unlikely(odev && !is_ieee80211_device(odev, dev))) {
+        if (unlikely(odev && !is_ieee80211_device(local, odev))) {
                 dev_put(odev);
                 odev = NULL;
         }
@@ -1335,12 +1300,56 @@ int ieee80211_master_start_xmit(struct sk_buff *skb,
                         if (is_multicast_ether_addr(hdr->addr3))
                                 memcpy(hdr->addr1, hdr->addr3, ETH_ALEN);
                         else
-                                if (mesh_nexthop_lookup(skb, odev))
+                                if (mesh_nexthop_lookup(skb, osdata))
                                         return  0;
                         if (memcmp(odev->dev_addr, hdr->addr4, ETH_ALEN) != 0)
-                                IEEE80211_IFSTA_MESH_CTR_INC(&osdata->u.sta,
+                                IEEE80211_IFSTA_MESH_CTR_INC(&osdata->u.mesh,
                                                              fwded_frames);
                 }
+        } else if (unlikely(osdata->vif.type == NL80211_IFTYPE_MONITOR)) {
+                struct ieee80211_sub_if_data *sdata;
+                struct ieee80211_local *local = osdata->local;
+                struct ieee80211_hdr *hdr;
+                int hdrlen;
+                u16 len_rthdr;
+
+                info->flags |= IEEE80211_TX_CTL_INJECTED;
+                monitor_iface = UNKNOWN_ADDRESS;
+
+                len_rthdr = ieee80211_get_radiotap_len(skb->data);
+                hdr = (struct ieee80211_hdr *)skb->data + len_rthdr;
+                hdrlen = ieee80211_hdrlen(hdr->frame_control);
+
+                /* check the header is complete in the frame */
+                if (likely(skb->len >= len_rthdr + hdrlen)) {
+                        /*
+                         * We process outgoing injected frames that have a
+                         * local address we handle as though they are our
+                         * own frames.
+                         * This code here isn't entirely correct, the local
+                         * MAC address is not necessarily enough to find
+                         * the interface to use; for that proper VLAN/WDS
+                         * support we will need a different mechanism.
+                         */
+
+                        rcu_read_lock();
+                        list_for_each_entry_rcu(sdata, &local->interfaces,
+                                                list) {
+                                if (!netif_running(sdata->dev))
+                                        continue;
+                                if (compare_ether_addr(sdata->dev->dev_addr,
+                                                       hdr->addr2)) {
+                                        dev_hold(sdata->dev);
+                                        dev_put(odev);
+                                        osdata = sdata;
+                                        odev = osdata->dev;
+                                        skb->iif = sdata->dev->ifindex;
+                                        monitor_iface = FOUND_SDATA;
+                                        break;
+                                }
+                        }
+                        rcu_read_unlock();
+                }
         }
 
         may_encrypt = !skb->do_not_encrypt;
@@ -1357,7 +1366,12 @@ int ieee80211_master_start_xmit(struct sk_buff *skb,
                 return 0;
         }
 
-        info->control.vif = &osdata->vif;
+        if (osdata->vif.type == NL80211_IFTYPE_AP_VLAN)
+                osdata = container_of(osdata->bss,
+                                      struct ieee80211_sub_if_data,
+                                      u.ap);
+        if (likely(monitor_iface != UNKNOWN_ADDRESS))
+                info->control.vif = &osdata->vif;
         ret = ieee80211_tx(odev, skb);
         dev_put(odev);
 
@@ -1437,8 +1451,8 @@ fail:
 int ieee80211_subif_start_xmit(struct sk_buff *skb,
                                struct net_device *dev)
 {
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        struct ieee80211_sub_if_data *sdata;
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_local *local = sdata->local;
         int ret = 1, head_need;
         u16 ethertype, hdrlen,  meshhdrlen = 0;
         __le16 fc;
@@ -1450,7 +1464,6 @@ int ieee80211_subif_start_xmit(struct sk_buff *skb,
         struct sta_info *sta;
         u32 sta_flags = 0;
 
-        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         if (unlikely(skb->len < ETH_HLEN)) {
                 ret = 0;
                 goto fail;
@@ -1465,8 +1478,8 @@ int ieee80211_subif_start_xmit(struct sk_buff *skb,
         fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_DATA);
 
         switch (sdata->vif.type) {
-        case IEEE80211_IF_TYPE_AP:
-        case IEEE80211_IF_TYPE_VLAN:
+        case NL80211_IFTYPE_AP:
+        case NL80211_IFTYPE_AP_VLAN:
                 fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS);
                 /* DA BSSID SA */
                 memcpy(hdr.addr1, skb->data, ETH_ALEN);
@@ -1474,7 +1487,7 @@ int ieee80211_subif_start_xmit(struct sk_buff *skb,
                 memcpy(hdr.addr3, skb->data + ETH_ALEN, ETH_ALEN);
                 hdrlen = 24;
                 break;
-        case IEEE80211_IF_TYPE_WDS:
+        case NL80211_IFTYPE_WDS:
                 fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
                 /* RA TA DA SA */
                 memcpy(hdr.addr1, sdata->u.wds.remote_addr, ETH_ALEN);
@@ -1484,24 +1497,56 @@ int ieee80211_subif_start_xmit(struct sk_buff *skb,
                 hdrlen = 30;
                 break;
 #ifdef CONFIG_MAC80211_MESH
-        case IEEE80211_IF_TYPE_MESH_POINT:
+        case NL80211_IFTYPE_MESH_POINT:
                 fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
-                /* RA TA DA SA */
-                memset(hdr.addr1, 0, ETH_ALEN);
-                memcpy(hdr.addr2, dev->dev_addr, ETH_ALEN);
-                memcpy(hdr.addr3, skb->data, ETH_ALEN);
-                memcpy(hdr.addr4, skb->data + ETH_ALEN, ETH_ALEN);
-                if (!sdata->u.sta.mshcfg.dot11MeshTTL) {
+                if (!sdata->u.mesh.mshcfg.dot11MeshTTL) {
                         /* Do not send frames with mesh_ttl == 0 */
-                        sdata->u.sta.mshstats.dropped_frames_ttl++;
+                        sdata->u.mesh.mshstats.dropped_frames_ttl++;
                         ret = 0;
                         goto fail;
                 }
-                meshhdrlen = ieee80211_new_mesh_header(&mesh_hdr, sdata);
+                memset(&mesh_hdr, 0, sizeof(mesh_hdr));
+
+                if (compare_ether_addr(dev->dev_addr,
+                                          skb->data + ETH_ALEN) == 0) {
+                        /* RA TA DA SA */
+                        memset(hdr.addr1, 0, ETH_ALEN);
+                        memcpy(hdr.addr2, dev->dev_addr, ETH_ALEN);
+                        memcpy(hdr.addr3, skb->data, ETH_ALEN);
+                        memcpy(hdr.addr4, skb->data + ETH_ALEN, ETH_ALEN);
+                        meshhdrlen = ieee80211_new_mesh_header(&mesh_hdr, sdata);
+                } else {
+                        /* packet from other interface */
+                        struct mesh_path *mppath;
+
+                        memset(hdr.addr1, 0, ETH_ALEN);
+                        memcpy(hdr.addr2, dev->dev_addr, ETH_ALEN);
+                        memcpy(hdr.addr4, dev->dev_addr, ETH_ALEN);
+
+                        if (is_multicast_ether_addr(skb->data))
+                                memcpy(hdr.addr3, skb->data, ETH_ALEN);
+                        else {
+                                rcu_read_lock();
+                                mppath = mpp_path_lookup(skb->data, sdata);
+                                if (mppath)
+                                        memcpy(hdr.addr3, mppath->mpp, ETH_ALEN);
+                                else
+                                        memset(hdr.addr3, 0xff, ETH_ALEN);
+                                rcu_read_unlock();
+                        }
+
+                        mesh_hdr.flags |= MESH_FLAGS_AE_A5_A6;
+                        mesh_hdr.ttl = sdata->u.mesh.mshcfg.dot11MeshTTL;
+                        put_unaligned(cpu_to_le32(sdata->u.mesh.mesh_seqnum), &mesh_hdr.seqnum);
+                        memcpy(mesh_hdr.eaddr1, skb->data, ETH_ALEN);
+                        memcpy(mesh_hdr.eaddr2, skb->data + ETH_ALEN, ETH_ALEN);
+                        sdata->u.mesh.mesh_seqnum++;
+                        meshhdrlen = 18;
+                }
                 hdrlen = 30;
                 break;
 #endif
-        case IEEE80211_IF_TYPE_STA:
+        case NL80211_IFTYPE_STATION:
                 fc |= cpu_to_le16(IEEE80211_FCTL_TODS);
                 /* BSSID SA DA */
                 memcpy(hdr.addr1, sdata->u.sta.bssid, ETH_ALEN);
@@ -1509,7 +1554,7 @@ int ieee80211_subif_start_xmit(struct sk_buff *skb,
                 memcpy(hdr.addr3, skb->data, ETH_ALEN);
                 hdrlen = 24;
                 break;
-        case IEEE80211_IF_TYPE_IBSS:
+        case NL80211_IFTYPE_ADHOC:
                 /* DA SA BSSID */
                 memcpy(hdr.addr1, skb->data, ETH_ALEN);
                 memcpy(hdr.addr2, skb->data + ETH_ALEN, ETH_ALEN);
@@ -1588,19 +1633,6 @@ int ieee80211_subif_start_xmit(struct sk_buff *skb,
         nh_pos -= skip_header_bytes;
         h_pos -= skip_header_bytes;
 
-        /* TODO: implement support for fragments so that there is no need to
-         * reallocate and copy payload; it might be enough to support one
-         * extra fragment that would be copied in the beginning of the frame
-         * data.. anyway, it would be nice to include this into skb structure
-         * somehow
-         *
-         * There are few options for this:
-         * use skb->cb as an extra space for 802.11 header
-         * allocate new buffer if not enough headroom
-         * make sure that there is enough headroom in every skb by increasing
-         * build in headroom in __dev_alloc_skb() (linux/skbuff.h) and
-         * alloc_skb() (net/core/skbuff.c)
-         */
         head_need = hdrlen + encaps_len + meshhdrlen - skb_headroom(skb);
 
         /*
@@ -1823,10 +1855,7 @@ struct sk_buff *ieee80211_beacon_get(struct ieee80211_hw *hw,
         struct rate_selection rsel;
         struct beacon_data *beacon;
         struct ieee80211_supported_band *sband;
-        struct ieee80211_mgmt *mgmt;
-        int *num_beacons;
         enum ieee80211_band band = local->hw.conf.channel->band;
-        u8 *pos;
 
         sband = local->hw.wiphy->bands[band];
 
@@ -1835,7 +1864,7 @@ struct sk_buff *ieee80211_beacon_get(struct ieee80211_hw *hw,
         sdata = vif_to_sdata(vif);
         bdev = sdata->dev;
 
-        if (sdata->vif.type == IEEE80211_IF_TYPE_AP) {
+        if (sdata->vif.type == NL80211_IFTYPE_AP) {
                 ap = &sdata->u.ap;
                 beacon = rcu_dereference(ap->beacon);
                 if (ap && beacon) {
@@ -1873,11 +1902,9 @@ struct sk_buff *ieee80211_beacon_get(struct ieee80211_hw *hw,
                         if (beacon->tail)
                                 memcpy(skb_put(skb, beacon->tail_len),
                                        beacon->tail, beacon->tail_len);
-
-                        num_beacons = &ap->num_beacons;
                 } else
                         goto out;
-        } else if (sdata->vif.type == IEEE80211_IF_TYPE_IBSS) {
+        } else if (sdata->vif.type == NL80211_IFTYPE_ADHOC) {
                 struct ieee80211_hdr *hdr;
                 ifsta = &sdata->u.sta;
 
@@ -1889,11 +1916,13 @@ struct sk_buff *ieee80211_beacon_get(struct ieee80211_hw *hw,
                         goto out;
 
                 hdr = (struct ieee80211_hdr *) skb->data;
-                hdr->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
-                                                  IEEE80211_STYPE_BEACON);
+                hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
+                                                 IEEE80211_STYPE_BEACON);
 
-                num_beacons = &ifsta->num_beacons;
         } else if (ieee80211_vif_is_mesh(&sdata->vif)) {
+                struct ieee80211_mgmt *mgmt;
+                u8 *pos;
+
                 /* headroom, head length, tail length and maximum TIM length */
                 skb = dev_alloc_skb(local->tx_headroom + 400);
                 if (!skb)
@@ -1916,9 +1945,7 @@ struct sk_buff *ieee80211_beacon_get(struct ieee80211_hw *hw,
                 *pos++ = WLAN_EID_SSID;
                 *pos++ = 0x0;
 
-                mesh_mgmt_ies_add(skb, sdata->dev);
-
-                num_beacons = &sdata->u.sta.num_beacons;
+                mesh_mgmt_ies_add(skb, sdata);
         } else {
                 WARN_ON(1);
                 goto out;
@@ -1929,7 +1956,7 @@ struct sk_buff *ieee80211_beacon_get(struct ieee80211_hw *hw,
         skb->do_not_encrypt = 1;
 
         info->band = band;
-        rate_control_get_rate(local->mdev, sband, skb, &rsel);
+        rate_control_get_rate(sdata, sband, NULL, skb, &rsel);
 
         if (unlikely(rsel.rate_idx < 0)) {
                 if (net_ratelimit()) {
@@ -1955,7 +1982,6 @@ struct sk_buff *ieee80211_beacon_get(struct ieee80211_hw *hw,
         info->antenna_sel_tx = local->hw.conf.antenna_sel_tx;
         info->control.retry_limit = 1;
 
-        (*num_beacons)++;
 out:
         rcu_read_unlock();
         return skb;
@@ -2017,7 +2043,7 @@ ieee80211_get_buffered_bc(struct ieee80211_hw *hw,
         rcu_read_lock();
         beacon = rcu_dereference(bss->beacon);
 
-        if (sdata->vif.type != IEEE80211_IF_TYPE_AP || !beacon || !beacon->head)
+        if (sdata->vif.type != NL80211_IFTYPE_AP || !beacon || !beacon->head)
                 goto out;
 
         if (bss->dtim_count != 0)
@@ -2039,7 +2065,7 @@ ieee80211_get_buffered_bc(struct ieee80211_hw *hw,
                                 cpu_to_le16(IEEE80211_FCTL_MOREDATA);
                 }
 
-                if (!ieee80211_tx_prepare(&tx, skb, local->mdev))
+                if (!ieee80211_tx_prepare(local, &tx, skb))
                         break;
                 dev_kfree_skb_any(skb);
         }
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 0d463c80c404..f32561ec224c 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -43,7 +43,7 @@ const unsigned char bridge_tunnel_header[] __aligned(2) =
 
 
 u8 *ieee80211_get_bssid(struct ieee80211_hdr *hdr, size_t len,
-                        enum ieee80211_if_types type)
+                        enum nl80211_iftype type)
 {
         __le16 fc = hdr->frame_control;
 
@@ -77,10 +77,10 @@ u8 *ieee80211_get_bssid(struct ieee80211_hdr *hdr, size_t len,
 
                 if (ieee80211_is_back_req(fc)) {
                         switch (type) {
-                        case IEEE80211_IF_TYPE_STA:
+                        case NL80211_IFTYPE_STATION:
                                 return hdr->addr2;
-                        case IEEE80211_IF_TYPE_AP:
-                        case IEEE80211_IF_TYPE_VLAN:
+                        case NL80211_IFTYPE_AP:
+                        case NL80211_IFTYPE_AP_VLAN:
                                 return hdr->addr1;
                         default:
                                 break; /* fall through to the return */
@@ -91,45 +91,6 @@ u8 *ieee80211_get_bssid(struct ieee80211_hdr *hdr, size_t len,
         return NULL;
 }
 
-int ieee80211_get_hdrlen(u16 fc)
-{
-        int hdrlen = 24;
-
-        switch (fc & IEEE80211_FCTL_FTYPE) {
-        case IEEE80211_FTYPE_DATA:
-                if ((fc & IEEE80211_FCTL_FROMDS) && (fc & IEEE80211_FCTL_TODS))
-                        hdrlen = 30; /* Addr4 */
-                /*
-                 * The QoS Control field is two bytes and its presence is
-                 * indicated by the IEEE80211_STYPE_QOS_DATA bit. Add 2 to
-                 * hdrlen if that bit is set.
-                 * This works by masking out the bit and shifting it to
-                 * bit position 1 so the result has the value 0 or 2.
-                 */
-                hdrlen += (fc & IEEE80211_STYPE_QOS_DATA)
-                                >> (ilog2(IEEE80211_STYPE_QOS_DATA)-1);
-                break;
-        case IEEE80211_FTYPE_CTL:
-                /*
-                 * ACK and CTS are 10 bytes, all others 16. To see how
-                 * to get this condition consider
-                 *   subtype mask:   0b0000000011110000 (0x00F0)
-                 *   ACK subtype:    0b0000000011010000 (0x00D0)
-                 *   CTS subtype:    0b0000000011000000 (0x00C0)
-                 *   bits that matter:         ^^^      (0x00E0)
-                 *   value of those: 0b0000000011000000 (0x00C0)
-                 */
-                if ((fc & 0xE0) == 0xC0)
-                        hdrlen = 10;
-                else
-                        hdrlen = 16;
-                break;
-        }
-
-        return hdrlen;
-}
-EXPORT_SYMBOL(ieee80211_get_hdrlen);
-
 unsigned int ieee80211_hdrlen(__le16 fc)
 {
         unsigned int hdrlen = 24;
@@ -270,16 +231,21 @@ __le16 ieee80211_generic_frame_duration(struct ieee80211_hw *hw,
                                         struct ieee80211_rate *rate)
 {
         struct ieee80211_local *local = hw_to_local(hw);
-        struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
+        struct ieee80211_sub_if_data *sdata;
         u16 dur;
         int erp;
+        bool short_preamble = false;
 
         erp = 0;
-        if (sdata->flags & IEEE80211_SDATA_OPERATING_GMODE)
-                erp = rate->flags & IEEE80211_RATE_ERP_G;
+        if (vif) {
+                sdata = vif_to_sdata(vif);
+                short_preamble = sdata->bss_conf.use_short_preamble;
+                if (sdata->flags & IEEE80211_SDATA_OPERATING_GMODE)
+                        erp = rate->flags & IEEE80211_RATE_ERP_G;
+        }
 
         dur = ieee80211_frame_duration(local, frame_len, rate->bitrate, erp,
-                                       sdata->bss_conf.use_short_preamble);
+                                       short_preamble);
 
         return cpu_to_le16(dur);
 }
@@ -291,7 +257,7 @@ __le16 ieee80211_rts_duration(struct ieee80211_hw *hw,
 {
         struct ieee80211_local *local = hw_to_local(hw);
         struct ieee80211_rate *rate;
-        struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
+        struct ieee80211_sub_if_data *sdata;
         bool short_preamble;
         int erp;
         u16 dur;
@@ -299,13 +265,17 @@ __le16 ieee80211_rts_duration(struct ieee80211_hw *hw,
 
         sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
 
-        short_preamble = sdata->bss_conf.use_short_preamble;
+        short_preamble = false;
 
         rate = &sband->bitrates[frame_txctl->control.rts_cts_rate_idx];
 
         erp = 0;
-        if (sdata->flags & IEEE80211_SDATA_OPERATING_GMODE)
-                erp = rate->flags & IEEE80211_RATE_ERP_G;
+        if (vif) {
+                sdata = vif_to_sdata(vif);
+                short_preamble = sdata->bss_conf.use_short_preamble;
+                if (sdata->flags & IEEE80211_SDATA_OPERATING_GMODE)
+                        erp = rate->flags & IEEE80211_RATE_ERP_G;
+        }
 
         /* CTS duration */
         dur = ieee80211_frame_duration(local, 10, rate->bitrate,
@@ -328,7 +298,7 @@ __le16 ieee80211_ctstoself_duration(struct ieee80211_hw *hw,
 {
         struct ieee80211_local *local = hw_to_local(hw);
         struct ieee80211_rate *rate;
-        struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
+        struct ieee80211_sub_if_data *sdata;
         bool short_preamble;
         int erp;
         u16 dur;
@@ -336,12 +306,16 @@ __le16 ieee80211_ctstoself_duration(struct ieee80211_hw *hw,
 
         sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
 
-        short_preamble = sdata->bss_conf.use_short_preamble;
+        short_preamble = false;
 
         rate = &sband->bitrates[frame_txctl->control.rts_cts_rate_idx];
         erp = 0;
-        if (sdata->flags & IEEE80211_SDATA_OPERATING_GMODE)
-                erp = rate->flags & IEEE80211_RATE_ERP_G;
+        if (vif) {
+                sdata = vif_to_sdata(vif);
+                short_preamble = sdata->bss_conf.use_short_preamble;
+                if (sdata->flags & IEEE80211_SDATA_OPERATING_GMODE)
+                        erp = rate->flags & IEEE80211_RATE_ERP_G;
+        }
 
         /* Data frame duration */
         dur = ieee80211_frame_duration(local, frame_len, rate->bitrate,
@@ -386,6 +360,13 @@ void ieee80211_stop_queues(struct ieee80211_hw *hw)
 }
 EXPORT_SYMBOL(ieee80211_stop_queues);
 
+int ieee80211_queue_stopped(struct ieee80211_hw *hw, int queue)
+{
+        struct ieee80211_local *local = hw_to_local(hw);
+        return __netif_subqueue_stopped(local->mdev, queue);
+}
+EXPORT_SYMBOL(ieee80211_queue_stopped);
+
 void ieee80211_wake_queues(struct ieee80211_hw *hw)
 {
         int i;
@@ -408,15 +389,16 @@ void ieee80211_iterate_active_interfaces(
 
         list_for_each_entry(sdata, &local->interfaces, list) {
                 switch (sdata->vif.type) {
-                case IEEE80211_IF_TYPE_INVALID:
-                case IEEE80211_IF_TYPE_MNTR:
-                case IEEE80211_IF_TYPE_VLAN:
+                case __NL80211_IFTYPE_AFTER_LAST:
+                case NL80211_IFTYPE_UNSPECIFIED:
+                case NL80211_IFTYPE_MONITOR:
+                case NL80211_IFTYPE_AP_VLAN:
                         continue;
-                case IEEE80211_IF_TYPE_AP:
-                case IEEE80211_IF_TYPE_STA:
-                case IEEE80211_IF_TYPE_IBSS:
-                case IEEE80211_IF_TYPE_WDS:
-                case IEEE80211_IF_TYPE_MESH_POINT:
+                case NL80211_IFTYPE_AP:
+                case NL80211_IFTYPE_STATION:
+                case NL80211_IFTYPE_ADHOC:
+                case NL80211_IFTYPE_WDS:
+                case NL80211_IFTYPE_MESH_POINT:
                         break;
                 }
                 if (netif_running(sdata->dev))
@@ -441,15 +423,16 @@ void ieee80211_iterate_active_interfaces_atomic(
 
         list_for_each_entry_rcu(sdata, &local->interfaces, list) {
                 switch (sdata->vif.type) {
-                case IEEE80211_IF_TYPE_INVALID:
-                case IEEE80211_IF_TYPE_MNTR:
-                case IEEE80211_IF_TYPE_VLAN:
+                case __NL80211_IFTYPE_AFTER_LAST:
+                case NL80211_IFTYPE_UNSPECIFIED:
+                case NL80211_IFTYPE_MONITOR:
+                case NL80211_IFTYPE_AP_VLAN:
                         continue;
-                case IEEE80211_IF_TYPE_AP:
-                case IEEE80211_IF_TYPE_STA:
-                case IEEE80211_IF_TYPE_IBSS:
-                case IEEE80211_IF_TYPE_WDS:
-                case IEEE80211_IF_TYPE_MESH_POINT:
+                case NL80211_IFTYPE_AP:
+                case NL80211_IFTYPE_STATION:
+                case NL80211_IFTYPE_ADHOC:
+                case NL80211_IFTYPE_WDS:
+                case NL80211_IFTYPE_MESH_POINT:
                         break;
                 }
                 if (netif_running(sdata->dev))
@@ -460,3 +443,243 @@ void ieee80211_iterate_active_interfaces_atomic(
         rcu_read_unlock();
 }
 EXPORT_SYMBOL_GPL(ieee80211_iterate_active_interfaces_atomic);
+
+void ieee802_11_parse_elems(u8 *start, size_t len,
+                            struct ieee802_11_elems *elems)
+{
+        size_t left = len;
+        u8 *pos = start;
+
+        memset(elems, 0, sizeof(*elems));
+        elems->ie_start = start;
+        elems->total_len = len;
+
+        while (left >= 2) {
+                u8 id, elen;
+
+                id = *pos++;
+                elen = *pos++;
+                left -= 2;
+
+                if (elen > left)
+                        return;
+
+                switch (id) {
+                case WLAN_EID_SSID:
+                        elems->ssid = pos;
+                        elems->ssid_len = elen;
+                        break;
+                case WLAN_EID_SUPP_RATES:
+                        elems->supp_rates = pos;
+                        elems->supp_rates_len = elen;
+                        break;
+                case WLAN_EID_FH_PARAMS:
+                        elems->fh_params = pos;
+                        elems->fh_params_len = elen;
+                        break;
+                case WLAN_EID_DS_PARAMS:
+                        elems->ds_params = pos;
+                        elems->ds_params_len = elen;
+                        break;
+                case WLAN_EID_CF_PARAMS:
+                        elems->cf_params = pos;
+                        elems->cf_params_len = elen;
+                        break;
+                case WLAN_EID_TIM:
+                        elems->tim = pos;
+                        elems->tim_len = elen;
+                        break;
+                case WLAN_EID_IBSS_PARAMS:
+                        elems->ibss_params = pos;
+                        elems->ibss_params_len = elen;
+                        break;
+                case WLAN_EID_CHALLENGE:
+                        elems->challenge = pos;
+                        elems->challenge_len = elen;
+                        break;
+                case WLAN_EID_WPA:
+                        if (elen >= 4 && pos[0] == 0x00 && pos[1] == 0x50 &&
+                            pos[2] == 0xf2) {
+                                /* Microsoft OUI (00:50:F2) */
+                                if (pos[3] == 1) {
+                                        /* OUI Type 1 - WPA IE */
+                                        elems->wpa = pos;
+                                        elems->wpa_len = elen;
+                                } else if (elen >= 5 && pos[3] == 2) {
+                                        if (pos[4] == 0) {
+                                                elems->wmm_info = pos;
+                                                elems->wmm_info_len = elen;
+                                        } else if (pos[4] == 1) {
+                                                elems->wmm_param = pos;
+                                                elems->wmm_param_len = elen;
+                                        }
+                                }
+                        }
+                        break;
+                case WLAN_EID_RSN:
+                        elems->rsn = pos;
+                        elems->rsn_len = elen;
+                        break;
+                case WLAN_EID_ERP_INFO:
+                        elems->erp_info = pos;
+                        elems->erp_info_len = elen;
+                        break;
+                case WLAN_EID_EXT_SUPP_RATES:
+                        elems->ext_supp_rates = pos;
+                        elems->ext_supp_rates_len = elen;
+                        break;
+                case WLAN_EID_HT_CAPABILITY:
+                        elems->ht_cap_elem = pos;
+                        elems->ht_cap_elem_len = elen;
+                        break;
+                case WLAN_EID_HT_EXTRA_INFO:
+                        elems->ht_info_elem = pos;
+                        elems->ht_info_elem_len = elen;
+                        break;
+                case WLAN_EID_MESH_ID:
+                        elems->mesh_id = pos;
+                        elems->mesh_id_len = elen;
+                        break;
+                case WLAN_EID_MESH_CONFIG:
+                        elems->mesh_config = pos;
+                        elems->mesh_config_len = elen;
+                        break;
+                case WLAN_EID_PEER_LINK:
+                        elems->peer_link = pos;
+                        elems->peer_link_len = elen;
+                        break;
+                case WLAN_EID_PREQ:
+                        elems->preq = pos;
+                        elems->preq_len = elen;
+                        break;
+                case WLAN_EID_PREP:
+                        elems->prep = pos;
+                        elems->prep_len = elen;
+                        break;
+                case WLAN_EID_PERR:
+                        elems->perr = pos;
+                        elems->perr_len = elen;
+                        break;
+                case WLAN_EID_CHANNEL_SWITCH:
+                        elems->ch_switch_elem = pos;
+                        elems->ch_switch_elem_len = elen;
+                        break;
+                case WLAN_EID_QUIET:
+                        if (!elems->quiet_elem) {
+                                elems->quiet_elem = pos;
+                                elems->quiet_elem_len = elen;
+                        }
+                        elems->num_of_quiet_elem++;
+                        break;
+                case WLAN_EID_COUNTRY:
+                        elems->country_elem = pos;
+                        elems->country_elem_len = elen;
+                        break;
+                case WLAN_EID_PWR_CONSTRAINT:
+                        elems->pwr_constr_elem = pos;
+                        elems->pwr_constr_elem_len = elen;
+                        break;
+                default:
+                        break;
+                }
+
+                left -= elen;
+                pos += elen;
+        }
+}
+
+void ieee80211_set_wmm_default(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_tx_queue_params qparam;
+        int i;
+
+        if (!local->ops->conf_tx)
+                return;
+
+        memset(&qparam, 0, sizeof(qparam));
+
+        qparam.aifs = 2;
+
+        if (local->hw.conf.channel->band == IEEE80211_BAND_2GHZ &&
+            !(sdata->flags & IEEE80211_SDATA_OPERATING_GMODE))
+                qparam.cw_min = 31;
+        else
+                qparam.cw_min = 15;
+
+        qparam.cw_max = 1023;
+        qparam.txop = 0;
+
+        for (i = 0; i < local_to_hw(local)->queues; i++)
+                local->ops->conf_tx(local_to_hw(local), i, &qparam);
+}
+
+void ieee80211_tx_skb(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb,
+                      int encrypt)
+{
+        skb->dev = sdata->local->mdev;
+        skb_set_mac_header(skb, 0);
+        skb_set_network_header(skb, 0);
+        skb_set_transport_header(skb, 0);
+
+        skb->iif = sdata->dev->ifindex;
+        skb->do_not_encrypt = !encrypt;
+
+        dev_queue_xmit(skb);
+}
+
+int ieee80211_set_freq(struct ieee80211_sub_if_data *sdata, int freqMHz)
+{
+        int ret = -EINVAL;
+        struct ieee80211_channel *chan;
+        struct ieee80211_local *local = sdata->local;
+
+        chan = ieee80211_get_channel(local->hw.wiphy, freqMHz);
+
+        if (chan && !(chan->flags & IEEE80211_CHAN_DISABLED)) {
+                if (sdata->vif.type == NL80211_IFTYPE_ADHOC &&
+                    chan->flags & IEEE80211_CHAN_NO_IBSS) {
+                        printk(KERN_DEBUG "%s: IBSS not allowed on frequency "
+                                "%d MHz\n", sdata->dev->name, chan->center_freq);
+                        return ret;
+                }
+                local->oper_channel = chan;
+
+                if (local->sw_scanning || local->hw_scanning)
+                        ret = 0;
+                else
+                        ret = ieee80211_hw_config(local);
+
+                rate_control_clear(local);
+        }
+
+        return ret;
+}
+
+u64 ieee80211_mandatory_rates(struct ieee80211_local *local,
+                              enum ieee80211_band band)
+{
+        struct ieee80211_supported_band *sband;
+        struct ieee80211_rate *bitrates;
+        u64 mandatory_rates;
+        enum ieee80211_rate_flags mandatory_flag;
+        int i;
+
+        sband = local->hw.wiphy->bands[band];
+        if (!sband) {
+                WARN_ON(1);
+                sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
+        }
+
+        if (band == IEEE80211_BAND_2GHZ)
+                mandatory_flag = IEEE80211_RATE_MANDATORY_B;
+        else
+                mandatory_flag = IEEE80211_RATE_MANDATORY_A;
+
+        bitrates = sband->bitrates;
+        mandatory_rates = 0;
+        for (i = 0; i < sband->n_bitrates; i++)
+                if (bitrates[i].flags & mandatory_flag)
+                        mandatory_rates |= BIT(i);
+        return mandatory_rates;
+}
diff --git a/net/mac80211/wep.c b/net/mac80211/wep.c
index 5c2bf0a3d4db..376c84987e4f 100644
--- a/net/mac80211/wep.c
+++ b/net/mac80211/wep.c
@@ -228,11 +228,10 @@ int ieee80211_wep_decrypt(struct ieee80211_local *local, struct sk_buff *skb,
                 return -1;
 
         hdrlen = ieee80211_hdrlen(hdr->frame_control);
-
-        if (skb->len < 8 + hdrlen)
+        if (skb->len < hdrlen + WEP_IV_LEN + WEP_ICV_LEN)
                 return -1;
 
-        len = skb->len - hdrlen - 8;
+        len = skb->len - hdrlen - WEP_IV_LEN - WEP_ICV_LEN;
 
         keyidx = skb->data[hdrlen + 3] >> 6;
 
@@ -292,9 +291,10 @@ u8 * ieee80211_wep_is_weak_iv(struct sk_buff *skb, struct ieee80211_key *key)
 ieee80211_rx_result
 ieee80211_crypto_wep_decrypt(struct ieee80211_rx_data *rx)
 {
-        if ((rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA &&
-            ((rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_MGMT ||
-             (rx->fc & IEEE80211_FCTL_STYPE) != IEEE80211_STYPE_AUTH))
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
+
+        if (!ieee80211_is_data(hdr->frame_control) &&
+            !ieee80211_is_auth(hdr->frame_control))
                 return RX_CONTINUE;
 
         if (!(rx->status->flag & RX_FLAG_DECRYPTED)) {
@@ -303,7 +303,7 @@ ieee80211_crypto_wep_decrypt(struct ieee80211_rx_data *rx)
         } else if (!(rx->status->flag & RX_FLAG_IV_STRIPPED)) {
                 ieee80211_wep_remove_iv(rx->local, rx->skb, rx->key);
                 /* remove ICV */
-                skb_trim(rx->skb, rx->skb->len - 4);
+                skb_trim(rx->skb, rx->skb->len - WEP_ICV_LEN);
         }
 
         return RX_CONTINUE;
diff --git a/net/mac80211/wext.c b/net/mac80211/wext.c
index 34fa8ed1e784..7e0d53abde24 100644
--- a/net/mac80211/wext.c
+++ b/net/mac80211/wext.c
@@ -27,22 +27,19 @@
 #include "aes_ccm.h"
 
 
-static int ieee80211_set_encryption(struct net_device *dev, u8 *sta_addr,
+static int ieee80211_set_encryption(struct ieee80211_sub_if_data *sdata, u8 *sta_addr,
                                     int idx, int alg, int remove,
                                     int set_tx_key, const u8 *_key,
                                     size_t key_len)
 {
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+        struct ieee80211_local *local = sdata->local;
         struct sta_info *sta;
         struct ieee80211_key *key;
-        struct ieee80211_sub_if_data *sdata;
         int err;
 
-        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-
         if (idx < 0 || idx >= NUM_DEFAULT_KEYS) {
                 printk(KERN_DEBUG "%s: set_encrypt - invalid idx=%d\n",
-                       dev->name, idx);
+                       sdata->dev->name, idx);
                 return -EINVAL;
         }
 
@@ -125,13 +122,13 @@ static int ieee80211_ioctl_siwgenie(struct net_device *dev,
         if (sdata->flags & IEEE80211_SDATA_USERSPACE_MLME)
                 return -EOPNOTSUPP;
 
-        if (sdata->vif.type == IEEE80211_IF_TYPE_STA ||
-            sdata->vif.type == IEEE80211_IF_TYPE_IBSS) {
-                int ret = ieee80211_sta_set_extra_ie(dev, extra, data->length);
+        if (sdata->vif.type == NL80211_IFTYPE_STATION ||
+            sdata->vif.type == NL80211_IFTYPE_ADHOC) {
+                int ret = ieee80211_sta_set_extra_ie(sdata, extra, data->length);
                 if (ret)
                         return ret;
                 sdata->u.sta.flags &= ~IEEE80211_STA_AUTO_BSSID_SEL;
-                ieee80211_sta_req_auth(dev, &sdata->u.sta);
+                ieee80211_sta_req_auth(sdata, &sdata->u.sta);
                 return 0;
         }
 
@@ -276,21 +273,21 @@ static int ieee80211_ioctl_siwmode(struct net_device *dev,
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         int type;
 
-        if (sdata->vif.type == IEEE80211_IF_TYPE_VLAN)
+        if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
                 return -EOPNOTSUPP;
 
         switch (*mode) {
         case IW_MODE_INFRA:
-                type = IEEE80211_IF_TYPE_STA;
+                type = NL80211_IFTYPE_STATION;
                 break;
         case IW_MODE_ADHOC:
-                type = IEEE80211_IF_TYPE_IBSS;
+                type = NL80211_IFTYPE_ADHOC;
                 break;
         case IW_MODE_REPEAT:
-                type = IEEE80211_IF_TYPE_WDS;
+                type = NL80211_IFTYPE_WDS;
                 break;
         case IW_MODE_MONITOR:
-                type = IEEE80211_IF_TYPE_MNTR;
+                type = NL80211_IFTYPE_MONITOR;
                 break;
         default:
                 return -EINVAL;
@@ -308,22 +305,22 @@ static int ieee80211_ioctl_giwmode(struct net_device *dev,
 
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         switch (sdata->vif.type) {
-        case IEEE80211_IF_TYPE_AP:
+        case NL80211_IFTYPE_AP:
                 *mode = IW_MODE_MASTER;
                 break;
-        case IEEE80211_IF_TYPE_STA:
+        case NL80211_IFTYPE_STATION:
                 *mode = IW_MODE_INFRA;
                 break;
-        case IEEE80211_IF_TYPE_IBSS:
+        case NL80211_IFTYPE_ADHOC:
                 *mode = IW_MODE_ADHOC;
                 break;
-        case IEEE80211_IF_TYPE_MNTR:
+        case NL80211_IFTYPE_MONITOR:
                 *mode = IW_MODE_MONITOR;
                 break;
-        case IEEE80211_IF_TYPE_WDS:
+        case NL80211_IFTYPE_WDS:
                 *mode = IW_MODE_REPEAT;
                 break;
-        case IEEE80211_IF_TYPE_VLAN:
+        case NL80211_IFTYPE_AP_VLAN:
                 *mode = IW_MODE_SECOND;         /* FIXME */
                 break;
         default:
@@ -333,60 +330,31 @@ static int ieee80211_ioctl_giwmode(struct net_device *dev,
         return 0;
 }
 
-int ieee80211_set_freq(struct net_device *dev, int freqMHz)
-{
-        int ret = -EINVAL;
-        struct ieee80211_channel *chan;
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-
-        chan = ieee80211_get_channel(local->hw.wiphy, freqMHz);
-
-        if (chan && !(chan->flags & IEEE80211_CHAN_DISABLED)) {
-                if (sdata->vif.type == IEEE80211_IF_TYPE_IBSS &&
-                    chan->flags & IEEE80211_CHAN_NO_IBSS) {
-                        printk(KERN_DEBUG "%s: IBSS not allowed on frequency "
-                                "%d MHz\n", dev->name, chan->center_freq);
-                        return ret;
-                }
-                local->oper_channel = chan;
-
-                if (local->sta_sw_scanning || local->sta_hw_scanning)
-                        ret = 0;
-                else
-                        ret = ieee80211_hw_config(local);
-
-                rate_control_clear(local);
-        }
-
-        return ret;
-}
-
 static int ieee80211_ioctl_siwfreq(struct net_device *dev,
                                    struct iw_request_info *info,
                                    struct iw_freq *freq, char *extra)
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
-        if (sdata->vif.type == IEEE80211_IF_TYPE_STA)
+        if (sdata->vif.type == NL80211_IFTYPE_STATION)
                 sdata->u.sta.flags &= ~IEEE80211_STA_AUTO_CHANNEL_SEL;
 
         /* freq->e == 0: freq->m = channel; otherwise freq = m * 10^e */
         if (freq->e == 0) {
                 if (freq->m < 0) {
-                        if (sdata->vif.type == IEEE80211_IF_TYPE_STA)
+                        if (sdata->vif.type == NL80211_IFTYPE_STATION)
                                 sdata->u.sta.flags |=
                                         IEEE80211_STA_AUTO_CHANNEL_SEL;
                         return 0;
                 } else
-                        return ieee80211_set_freq(dev,
+                        return ieee80211_set_freq(sdata,
                                 ieee80211_channel_to_frequency(freq->m));
         } else {
                 int i, div = 1000000;
                 for (i = 0; i < freq->e; i++)
                         div /= 10;
                 if (div > 0)
-                        return ieee80211_set_freq(dev, freq->m / div);
+                        return ieee80211_set_freq(sdata, freq->m / div);
                 else
                         return -EINVAL;
         }
@@ -418,8 +386,8 @@ static int ieee80211_ioctl_siwessid(struct net_device *dev,
                 len--;
 
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        if (sdata->vif.type == IEEE80211_IF_TYPE_STA ||
-            sdata->vif.type == IEEE80211_IF_TYPE_IBSS) {
+        if (sdata->vif.type == NL80211_IFTYPE_STATION ||
+            sdata->vif.type == NL80211_IFTYPE_ADHOC) {
                 int ret;
                 if (sdata->flags & IEEE80211_SDATA_USERSPACE_MLME) {
                         if (len > IEEE80211_MAX_SSID_LEN)
@@ -432,14 +400,14 @@ static int ieee80211_ioctl_siwessid(struct net_device *dev,
                         sdata->u.sta.flags &= ~IEEE80211_STA_AUTO_SSID_SEL;
                 else
                         sdata->u.sta.flags |= IEEE80211_STA_AUTO_SSID_SEL;
-                ret = ieee80211_sta_set_ssid(dev, ssid, len);
+                ret = ieee80211_sta_set_ssid(sdata, ssid, len);
                 if (ret)
                         return ret;
-                ieee80211_sta_req_auth(dev, &sdata->u.sta);
+                ieee80211_sta_req_auth(sdata, &sdata->u.sta);
                 return 0;
         }
 
-        if (sdata->vif.type == IEEE80211_IF_TYPE_AP) {
+        if (sdata->vif.type == NL80211_IFTYPE_AP) {
                 memcpy(sdata->u.ap.ssid, ssid, len);
                 memset(sdata->u.ap.ssid + len, 0,
                        IEEE80211_MAX_SSID_LEN - len);
@@ -458,9 +426,9 @@ static int ieee80211_ioctl_giwessid(struct net_device *dev,
 
         struct ieee80211_sub_if_data *sdata;
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        if (sdata->vif.type == IEEE80211_IF_TYPE_STA ||
-            sdata->vif.type == IEEE80211_IF_TYPE_IBSS) {
-                int res = ieee80211_sta_get_ssid(dev, ssid, &len);
+        if (sdata->vif.type == NL80211_IFTYPE_STATION ||
+            sdata->vif.type == NL80211_IFTYPE_ADHOC) {
+                int res = ieee80211_sta_get_ssid(sdata, ssid, &len);
                 if (res == 0) {
                         data->length = len;
                         data->flags = 1;
@@ -469,7 +437,7 @@ static int ieee80211_ioctl_giwessid(struct net_device *dev,
                 return res;
         }
 
-        if (sdata->vif.type == IEEE80211_IF_TYPE_AP) {
+        if (sdata->vif.type == NL80211_IFTYPE_AP) {
                 len = sdata->u.ap.ssid_len;
                 if (len > IW_ESSID_MAX_SIZE)
                         len = IW_ESSID_MAX_SIZE;
@@ -489,8 +457,8 @@ static int ieee80211_ioctl_siwap(struct net_device *dev,
         struct ieee80211_sub_if_data *sdata;
 
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        if (sdata->vif.type == IEEE80211_IF_TYPE_STA ||
-            sdata->vif.type == IEEE80211_IF_TYPE_IBSS) {
+        if (sdata->vif.type == NL80211_IFTYPE_STATION ||
+            sdata->vif.type == NL80211_IFTYPE_ADHOC) {
                 int ret;
                 if (sdata->flags & IEEE80211_SDATA_USERSPACE_MLME) {
                         memcpy(sdata->u.sta.bssid, (u8 *) &ap_addr->sa_data,
@@ -504,12 +472,12 @@ static int ieee80211_ioctl_siwap(struct net_device *dev,
                         sdata->u.sta.flags |= IEEE80211_STA_AUTO_BSSID_SEL;
                 else
                         sdata->u.sta.flags &= ~IEEE80211_STA_AUTO_BSSID_SEL;
-                ret = ieee80211_sta_set_bssid(dev, (u8 *) &ap_addr->sa_data);
+                ret = ieee80211_sta_set_bssid(sdata, (u8 *) &ap_addr->sa_data);
                 if (ret)
                         return ret;
-                ieee80211_sta_req_auth(dev, &sdata->u.sta);
+                ieee80211_sta_req_auth(sdata, &sdata->u.sta);
                 return 0;
-        } else if (sdata->vif.type == IEEE80211_IF_TYPE_WDS) {
+        } else if (sdata->vif.type == NL80211_IFTYPE_WDS) {
                 /*
                  * If it is necessary to update the WDS peer address
                  * while the interface is running, then we need to do
@@ -537,10 +505,10 @@ static int ieee80211_ioctl_giwap(struct net_device *dev,
         struct ieee80211_sub_if_data *sdata;
 
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        if (sdata->vif.type == IEEE80211_IF_TYPE_STA ||
-            sdata->vif.type == IEEE80211_IF_TYPE_IBSS) {
-                if (sdata->u.sta.state == IEEE80211_ASSOCIATED ||
-                    sdata->u.sta.state == IEEE80211_IBSS_JOINED) {
+        if (sdata->vif.type == NL80211_IFTYPE_STATION ||
+            sdata->vif.type == NL80211_IFTYPE_ADHOC) {
+                if (sdata->u.sta.state == IEEE80211_STA_MLME_ASSOCIATED ||
+                    sdata->u.sta.state == IEEE80211_STA_MLME_IBSS_JOINED) {
                         ap_addr->sa_family = ARPHRD_ETHER;
                         memcpy(&ap_addr->sa_data, sdata->u.sta.bssid, ETH_ALEN);
                         return 0;
@@ -548,7 +516,7 @@ static int ieee80211_ioctl_giwap(struct net_device *dev,
                         memset(&ap_addr->sa_data, 0, ETH_ALEN);
                         return 0;
                 }
-        } else if (sdata->vif.type == IEEE80211_IF_TYPE_WDS) {
+        } else if (sdata->vif.type == NL80211_IFTYPE_WDS) {
                 ap_addr->sa_family = ARPHRD_ETHER;
                 memcpy(&ap_addr->sa_data, sdata->u.wds.remote_addr, ETH_ALEN);
                 return 0;
@@ -570,10 +538,10 @@ static int ieee80211_ioctl_siwscan(struct net_device *dev,
         if (!netif_running(dev))
                 return -ENETDOWN;
 
-        if (sdata->vif.type != IEEE80211_IF_TYPE_STA &&
-            sdata->vif.type != IEEE80211_IF_TYPE_IBSS &&
-            sdata->vif.type != IEEE80211_IF_TYPE_MESH_POINT &&
-            sdata->vif.type != IEEE80211_IF_TYPE_AP)
+        if (sdata->vif.type != NL80211_IFTYPE_STATION &&
+            sdata->vif.type != NL80211_IFTYPE_ADHOC &&
+            sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
+            sdata->vif.type != NL80211_IFTYPE_AP)
                 return -EOPNOTSUPP;
 
         /* if SSID was specified explicitly then use that */
@@ -584,7 +552,7 @@ static int ieee80211_ioctl_siwscan(struct net_device *dev,
                 ssid_len = req->essid_len;
         }
 
-        return ieee80211_sta_req_scan(dev, ssid, ssid_len);
+        return ieee80211_request_scan(sdata, ssid, ssid_len);
 }
 
 
@@ -594,11 +562,14 @@ static int ieee80211_ioctl_giwscan(struct net_device *dev,
 {
         int res;
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+        struct ieee80211_sub_if_data *sdata;
+
+        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
-        if (local->sta_sw_scanning || local->sta_hw_scanning)
+        if (local->sw_scanning || local->hw_scanning)
                 return -EAGAIN;
 
-        res = ieee80211_sta_scan_results(dev, info, extra, data->length);
+        res = ieee80211_scan_results(local, info, extra, data->length);
         if (res >= 0) {
                 data->length = res;
                 return 0;
@@ -656,7 +627,7 @@ static int ieee80211_ioctl_giwrate(struct net_device *dev,
 
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
-        if (sdata->vif.type != IEEE80211_IF_TYPE_STA)
+        if (sdata->vif.type != NL80211_IFTYPE_STATION)
                 return -EOPNOTSUPP;
 
         sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
@@ -665,8 +636,8 @@ static int ieee80211_ioctl_giwrate(struct net_device *dev,
 
         sta = sta_info_get(local, sdata->u.sta.bssid);
 
-        if (sta && sta->txrate_idx < sband->n_bitrates)
-                rate->value = sband->bitrates[sta->txrate_idx].bitrate;
+        if (sta && sta->last_txrate_idx < sband->n_bitrates)
+                rate->value = sband->bitrates[sta->last_txrate_idx].bitrate;
         else
                 rate->value = 0;
 
@@ -887,17 +858,17 @@ static int ieee80211_ioctl_siwmlme(struct net_device *dev,
         struct iw_mlme *mlme = (struct iw_mlme *) extra;
 
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        if (sdata->vif.type != IEEE80211_IF_TYPE_STA &&
-            sdata->vif.type != IEEE80211_IF_TYPE_IBSS)
+        if (sdata->vif.type != NL80211_IFTYPE_STATION &&
+            sdata->vif.type != NL80211_IFTYPE_ADHOC)
                 return -EINVAL;
 
         switch (mlme->cmd) {
         case IW_MLME_DEAUTH:
                 /* TODO: mlme->addr.sa_data */
-                return ieee80211_sta_deauthenticate(dev, mlme->reason_code);
+                return ieee80211_sta_deauthenticate(sdata, mlme->reason_code);
         case IW_MLME_DISASSOC:
                 /* TODO: mlme->addr.sa_data */
-                return ieee80211_sta_disassociate(dev, mlme->reason_code);
+                return ieee80211_sta_disassociate(sdata, mlme->reason_code);
         default:
                 return -EOPNOTSUPP;
         }
@@ -938,7 +909,7 @@ static int ieee80211_ioctl_siwencode(struct net_device *dev,
         }
 
         return ieee80211_set_encryption(
-                dev, bcaddr,
+                sdata, bcaddr,
                 idx, alg, remove,
                 !sdata->default_key,
                 keybuf, erq->length);
@@ -983,7 +954,7 @@ static int ieee80211_ioctl_giwencode(struct net_device *dev,
         erq->length = sdata->keys[idx]->conf.keylen;
         erq->flags |= IW_ENCODE_ENABLED;
 
-        if (sdata->vif.type == IEEE80211_IF_TYPE_STA) {
+        if (sdata->vif.type == NL80211_IFTYPE_STATION) {
                 struct ieee80211_if_sta *ifsta = &sdata->u.sta;
                 switch (ifsta->auth_alg) {
                 case WLAN_AUTH_OPEN:
@@ -1057,7 +1028,7 @@ static int ieee80211_ioctl_siwauth(struct net_device *dev,
                 sdata->drop_unencrypted = !!data->value;
                 break;
         case IW_AUTH_PRIVACY_INVOKED:
-                if (sdata->vif.type != IEEE80211_IF_TYPE_STA)
+                if (sdata->vif.type != NL80211_IFTYPE_STATION)
                         ret = -EINVAL;
                 else {
                         sdata->u.sta.flags &= ~IEEE80211_STA_PRIVACY_INVOKED;
@@ -1072,8 +1043,8 @@ static int ieee80211_ioctl_siwauth(struct net_device *dev,
                 }
                 break;
         case IW_AUTH_80211_AUTH_ALG:
-                if (sdata->vif.type == IEEE80211_IF_TYPE_STA ||
-                    sdata->vif.type == IEEE80211_IF_TYPE_IBSS)
+                if (sdata->vif.type == NL80211_IFTYPE_STATION ||
+                    sdata->vif.type == NL80211_IFTYPE_ADHOC)
                         sdata->u.sta.auth_algs = data->value;
                 else
                         ret = -EOPNOTSUPP;
@@ -1095,8 +1066,8 @@ static struct iw_statistics *ieee80211_get_wireless_stats(struct net_device *dev
 
         rcu_read_lock();
 
-        if (sdata->vif.type == IEEE80211_IF_TYPE_STA ||
-            sdata->vif.type == IEEE80211_IF_TYPE_IBSS)
+        if (sdata->vif.type == NL80211_IFTYPE_STATION ||
+            sdata->vif.type == NL80211_IFTYPE_ADHOC)
                 sta = sta_info_get(local, sdata->u.sta.bssid);
         if (!sta) {
                 wstats->discard.fragment = 0;
@@ -1126,8 +1097,8 @@ static int ieee80211_ioctl_giwauth(struct net_device *dev,
 
         switch (data->flags & IW_AUTH_INDEX) {
         case IW_AUTH_80211_AUTH_ALG:
-                if (sdata->vif.type == IEEE80211_IF_TYPE_STA ||
-                    sdata->vif.type == IEEE80211_IF_TYPE_IBSS)
+                if (sdata->vif.type == NL80211_IFTYPE_STATION ||
+                    sdata->vif.type == NL80211_IFTYPE_ADHOC)
                         data->value = sdata->u.sta.auth_algs;
                 else
                         ret = -EOPNOTSUPP;
@@ -1184,7 +1155,7 @@ static int ieee80211_ioctl_siwencodeext(struct net_device *dev,
         } else
                 idx--;
 
-        return ieee80211_set_encryption(dev, ext->addr.sa_data, idx, alg,
+        return ieee80211_set_encryption(sdata, ext->addr.sa_data, idx, alg,
                                         remove,
                                         ext->ext_flags &
                                         IW_ENCODE_EXT_SET_TX_KEY,
diff --git a/net/mac80211/wme.c b/net/mac80211/wme.c
index 4310e2f65661..139b5f267b34 100644
--- a/net/mac80211/wme.c
+++ b/net/mac80211/wme.c
@@ -39,7 +39,7 @@ static unsigned int classify_1d(struct sk_buff *skb)
                 return skb->priority - 256;
 
         switch (skb->protocol) {
-        case __constant_htons(ETH_P_IP):
+        case htons(ETH_P_IP):
                 dscp = ip_hdr(skb)->tos & 0xfc;
                 break;
 
@@ -47,8 +47,6 @@ static unsigned int classify_1d(struct sk_buff *skb)
                 return 0;
         }
 
-        if (dscp & 0x1c)
-                return 0;
         return dscp >> 5;
 }
 
@@ -75,9 +73,8 @@ static int wme_downgrade_ac(struct sk_buff *skb)
 
 
 /* Indicate which queue to use.  */
-static u16 classify80211(struct sk_buff *skb, struct net_device *dev)
+static u16 classify80211(struct ieee80211_local *local, struct sk_buff *skb)
 {
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
 
         if (!ieee80211_is_data(hdr->frame_control)) {
@@ -115,14 +112,15 @@ static u16 classify80211(struct sk_buff *skb, struct net_device *dev)
 
 u16 ieee80211_select_queue(struct net_device *dev, struct sk_buff *skb)
 {
+        struct ieee80211_master_priv *mpriv = netdev_priv(dev);
+        struct ieee80211_local *local = mpriv->local;
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         struct sta_info *sta;
         u16 queue;
         u8 tid;
 
-        queue = classify80211(skb, dev);
+        queue = classify80211(local, skb);
         if (unlikely(queue >= local->hw.queues))
                 queue = local->hw.queues - 1;
 
@@ -212,7 +210,7 @@ int ieee80211_ht_agg_queue_add(struct ieee80211_local *local,
                                 DECLARE_MAC_BUF(mac);
                                 printk(KERN_DEBUG "allocated aggregation queue"
                                         " %d tid %d addr %s pool=0x%lX\n",
-                                        i, tid, print_mac(mac, sta->addr),
+                                        i, tid, print_mac(mac, sta->sta.addr),
                                         local->queue_pool[0]);
                         }
 #endif /* CONFIG_MAC80211_HT_DEBUG */
diff --git a/net/mac80211/wme.h b/net/mac80211/wme.h
index 04de28c071a6..bc62f28a4d3d 100644
--- a/net/mac80211/wme.h
+++ b/net/mac80211/wme.h
@@ -1,5 +1,4 @@
 /*
- * IEEE 802.11 driver (80211.o) - QoS datatypes
  * Copyright 2004, Instant802 Networks, Inc.
  * Copyright 2005, Devicescape Software, Inc.
  *
@@ -14,8 +13,6 @@
 #include <linux/netdevice.h>
 #include "ieee80211_i.h"
 
-#define QOS_CONTROL_LEN 2
-
 #define QOS_CONTROL_ACK_POLICY_NORMAL 0
 #define QOS_CONTROL_ACK_POLICY_NOACK 1
 
diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c
index 2f33df0dcccf..37ae9a959f63 100644
--- a/net/mac80211/wpa.c
+++ b/net/mac80211/wpa.c
@@ -127,7 +127,7 @@ ieee80211_rx_h_michael_mic_verify(struct ieee80211_rx_data *rx)
                 if (!(rx->flags & IEEE80211_RX_RA_MATCH))
                         return RX_DROP_UNUSABLE;
 
-                mac80211_ev_michael_mic_failure(rx->dev, rx->key->conf.keyidx,
+                mac80211_ev_michael_mic_failure(rx->sdata, rx->key->conf.keyidx,
                                                 (void *) skb->data);
                 return RX_DROP_UNUSABLE;
         }
@@ -256,7 +256,7 @@ ieee80211_crypto_tkip_decrypt(struct ieee80211_rx_data *rx)
 
         res = ieee80211_tkip_decrypt_data(rx->local->wep_rx_tfm,
                                           key, skb->data + hdrlen,
-                                          skb->len - hdrlen, rx->sta->addr,
+                                          skb->len - hdrlen, rx->sta->sta.addr,
                                           hdr->addr1, hwaccel, rx->queue,
                                           &rx->tkip_iv32,
                                           &rx->tkip_iv16);
diff --git a/net/netfilter/xt_time.c b/net/netfilter/xt_time.c
index 9f328593287e..307a2c3c2df4 100644
--- a/net/netfilter/xt_time.c
+++ b/net/netfilter/xt_time.c
@@ -136,17 +136,19 @@ static void localtime_3(struct xtm *r, time_t time)
          * from w repeatedly while counting.)
          */
         if (is_leap(year)) {
+                /* use days_since_leapyear[] in a leap year */
                 for (i = ARRAY_SIZE(days_since_leapyear) - 1;
-                    i > 0 && days_since_year[i] > w; --i)
+                    i > 0 && days_since_leapyear[i] > w; --i)
                         /* just loop */;
+                r->monthday = w - days_since_leapyear[i] + 1;
         } else {
                 for (i = ARRAY_SIZE(days_since_year) - 1;
                     i > 0 && days_since_year[i] > w; --i)
                         /* just loop */;
+                r->monthday = w - days_since_year[i] + 1;
         }
 
         r->month    = i + 1;
-        r->monthday = w - days_since_year[i] + 1;
         return;
 }
 
diff --git a/net/phonet/Kconfig b/net/phonet/Kconfig
new file mode 100644
index 000000000000..51a5669573f2
--- /dev/null
+++ b/net/phonet/Kconfig
@@ -0,0 +1,16 @@
+#
+# Phonet protocol
+#
+
+config PHONET
+        tristate "Phonet protocols family"
+        help
+          The Phone Network protocol (PhoNet) is a packet-oriented
+          communication protocol developped by Nokia for use with its modems.
+
+          This is required for Maemo to use cellular data connectivity (if
+          supported). It can also be used to control Nokia phones
+          from a Linux computer, although AT commands may be easier to use.
+
+          To compile this driver as a module, choose M here: the module
+          will be called phonet. If unsure, say N.
diff --git a/net/phonet/Makefile b/net/phonet/Makefile
new file mode 100644
index 000000000000..ae9c3ed5be83
--- /dev/null
+++ b/net/phonet/Makefile
@@ -0,0 +1,9 @@
+obj-$(CONFIG_PHONET) += phonet.o
+
+phonet-objs := \
+        pn_dev.o \
+        pn_netlink.o \
+        socket.o \
+        datagram.o \
+        sysctl.o \
+        af_phonet.o
diff --git a/net/phonet/af_phonet.c b/net/phonet/af_phonet.c
new file mode 100644
index 000000000000..1d8df6b7e3df
--- /dev/null
+++ b/net/phonet/af_phonet.c
@@ -0,0 +1,468 @@
+/*
+ * File: af_phonet.c
+ *
+ * Phonet protocols family
+ *
+ * Copyright (C) 2008 Nokia Corporation.
+ *
+ * Contact: Remi Denis-Courmont <remi.denis-courmont@nokia.com>
+ * Original author: Sakari Ailus <sakari.ailus@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <asm/unaligned.h>
+#include <net/sock.h>
+
+#include <linux/if_phonet.h>
+#include <linux/phonet.h>
+#include <net/phonet/phonet.h>
+#include <net/phonet/pn_dev.h>
+
+static struct net_proto_family phonet_proto_family;
+static struct phonet_protocol *phonet_proto_get(int protocol);
+static inline void phonet_proto_put(struct phonet_protocol *pp);
+
+/* protocol family functions */
+
+static int pn_socket_create(struct net *net, struct socket *sock, int protocol)
+{
+        struct sock *sk;
+        struct pn_sock *pn;
+        struct phonet_protocol *pnp;
+        int err;
+
+        if (net != &init_net)
+                return -EAFNOSUPPORT;
+
+        if (!capable(CAP_SYS_ADMIN))
+                return -EPERM;
+
+        if (protocol == 0) {
+                /* Default protocol selection */
+                switch (sock->type) {
+                case SOCK_DGRAM:
+                        protocol = PN_PROTO_PHONET;
+                        break;
+                default:
+                        return -EPROTONOSUPPORT;
+                }
+        }
+
+        pnp = phonet_proto_get(protocol);
+        if (pnp == NULL)
+                return -EPROTONOSUPPORT;
+        if (sock->type != pnp->sock_type) {
+                err = -EPROTONOSUPPORT;
+                goto out;
+        }
+
+        sk = sk_alloc(net, PF_PHONET, GFP_KERNEL, pnp->prot);
+        if (sk == NULL) {
+                err = -ENOMEM;
+                goto out;
+        }
+
+        sock_init_data(sock, sk);
+        sock->state = SS_UNCONNECTED;
+        sock->ops = pnp->ops;
+        sk->sk_backlog_rcv = sk->sk_prot->backlog_rcv;
+        sk->sk_protocol = protocol;
+        pn = pn_sk(sk);
+        pn->sobject = 0;
+        pn->resource = 0;
+        sk->sk_prot->init(sk);
+        err = 0;
+
+out:
+        phonet_proto_put(pnp);
+        return err;
+}
+
+static struct net_proto_family phonet_proto_family = {
+        .family = AF_PHONET,
+        .create = pn_socket_create,
+        .owner = THIS_MODULE,
+};
+
+/* Phonet device header operations */
+static int pn_header_create(struct sk_buff *skb, struct net_device *dev,
+                                unsigned short type, const void *daddr,
+                                const void *saddr, unsigned len)
+{
+        u8 *media = skb_push(skb, 1);
+
+        if (type != ETH_P_PHONET)
+                return -1;
+
+        if (!saddr)
+                saddr = dev->dev_addr;
+        *media = *(const u8 *)saddr;
+        return 1;
+}
+
+static int pn_header_parse(const struct sk_buff *skb, unsigned char *haddr)
+{
+        const u8 *media = skb_mac_header(skb);
+        *haddr = *media;
+        return 1;
+}
+
+struct header_ops phonet_header_ops = {
+        .create = pn_header_create,
+        .parse = pn_header_parse,
+};
+EXPORT_SYMBOL(phonet_header_ops);
+
+/*
+ * Prepends an ISI header and sends a datagram.
+ */
+static int pn_send(struct sk_buff *skb, struct net_device *dev,
+                        u16 dst, u16 src, u8 res, u8 irq)
+{
+        struct phonethdr *ph;
+        int err;
+
+        if (skb->len + 2 > 0xffff) {
+                /* Phonet length field would overflow */
+                err = -EMSGSIZE;
+                goto drop;
+        }
+
+        skb_reset_transport_header(skb);
+        WARN_ON(skb_headroom(skb) & 1); /* HW assumes word alignment */
+        skb_push(skb, sizeof(struct phonethdr));
+        skb_reset_network_header(skb);
+        ph = pn_hdr(skb);
+        ph->pn_rdev = pn_dev(dst);
+        ph->pn_sdev = pn_dev(src);
+        ph->pn_res = res;
+        ph->pn_length = __cpu_to_be16(skb->len + 2 - sizeof(*ph));
+        ph->pn_robj = pn_obj(dst);
+        ph->pn_sobj = pn_obj(src);
+
+        skb->protocol = htons(ETH_P_PHONET);
+        skb->priority = 0;
+        skb->dev = dev;
+
+        if (pn_addr(src) == pn_addr(dst)) {
+                skb_reset_mac_header(skb);
+                skb->pkt_type = PACKET_LOOPBACK;
+                skb_orphan(skb);
+                if (irq)
+                        netif_rx(skb);
+                else
+                        netif_rx_ni(skb);
+                err = 0;
+        } else {
+                err = dev_hard_header(skb, dev, ntohs(skb->protocol),
+                                        NULL, NULL, skb->len);
+                if (err < 0) {
+                        err = -EHOSTUNREACH;
+                        goto drop;
+                }
+                err = dev_queue_xmit(skb);
+        }
+
+        return err;
+drop:
+        kfree_skb(skb);
+        return err;
+}
+
+static int pn_raw_send(const void *data, int len, struct net_device *dev,
+                        u16 dst, u16 src, u8 res)
+{
+        struct sk_buff *skb = alloc_skb(MAX_PHONET_HEADER + len, GFP_ATOMIC);
+        if (skb == NULL)
+                return -ENOMEM;
+
+        skb_reserve(skb, MAX_PHONET_HEADER);
+        __skb_put(skb, len);
+        skb_copy_to_linear_data(skb, data, len);
+        return pn_send(skb, dev, dst, src, res, 1);
+}
+
+/*
+ * Create a Phonet header for the skb and send it out. Returns
+ * non-zero error code if failed. The skb is freed then.
+ */
+int pn_skb_send(struct sock *sk, struct sk_buff *skb,
+                const struct sockaddr_pn *target)
+{
+        struct net_device *dev;
+        struct pn_sock *pn = pn_sk(sk);
+        int err;
+        u16 src;
+        u8 daddr = pn_sockaddr_get_addr(target), saddr = PN_NO_ADDR;
+
+        err = -EHOSTUNREACH;
+        if (sk->sk_bound_dev_if)
+                dev = dev_get_by_index(sock_net(sk), sk->sk_bound_dev_if);
+        else
+                dev = phonet_device_get(sock_net(sk));
+        if (!dev || !(dev->flags & IFF_UP))
+                goto drop;
+
+        saddr = phonet_address_get(dev, daddr);
+        if (saddr == PN_NO_ADDR)
+                goto drop;
+
+        src = pn->sobject;
+        if (!pn_addr(src))
+                src = pn_object(saddr, pn_obj(src));
+
+        err = pn_send(skb, dev, pn_sockaddr_get_object(target),
+                        src, pn_sockaddr_get_resource(target), 0);
+        dev_put(dev);
+        return err;
+
+drop:
+        kfree_skb(skb);
+        if (dev)
+                dev_put(dev);
+        return err;
+}
+EXPORT_SYMBOL(pn_skb_send);
+
+/* Do not send an error message in response to an error message */
+static inline int can_respond(struct sk_buff *skb)
+{
+        const struct phonethdr *ph;
+        const struct phonetmsg *pm;
+        u8 submsg_id;
+
+        if (!pskb_may_pull(skb, 3))
+                return 0;
+
+        ph = pn_hdr(skb);
+        if (phonet_address_get(skb->dev, ph->pn_rdev) != ph->pn_rdev)
+                return 0; /* we are not the destination */
+        if (ph->pn_res == PN_PREFIX && !pskb_may_pull(skb, 5))
+                return 0;
+
+        ph = pn_hdr(skb); /* re-acquires the pointer */
+        pm = pn_msg(skb);
+        if (pm->pn_msg_id != PN_COMMON_MESSAGE)
+                return 1;
+        submsg_id = (ph->pn_res == PN_PREFIX)
+                ? pm->pn_e_submsg_id : pm->pn_submsg_id;
+        if (submsg_id != PN_COMM_ISA_ENTITY_NOT_REACHABLE_RESP &&
+                pm->pn_e_submsg_id != PN_COMM_SERVICE_NOT_IDENTIFIED_RESP)
+                return 1;
+        return 0;
+}
+
+static int send_obj_unreachable(struct sk_buff *rskb)
+{
+        const struct phonethdr *oph = pn_hdr(rskb);
+        const struct phonetmsg *opm = pn_msg(rskb);
+        struct phonetmsg resp;
+
+        memset(&resp, 0, sizeof(resp));
+        resp.pn_trans_id = opm->pn_trans_id;
+        resp.pn_msg_id = PN_COMMON_MESSAGE;
+        if (oph->pn_res == PN_PREFIX) {
+                resp.pn_e_res_id = opm->pn_e_res_id;
+                resp.pn_e_submsg_id = PN_COMM_ISA_ENTITY_NOT_REACHABLE_RESP;
+                resp.pn_e_orig_msg_id = opm->pn_msg_id;
+                resp.pn_e_status = 0;
+        } else {
+                resp.pn_submsg_id = PN_COMM_ISA_ENTITY_NOT_REACHABLE_RESP;
+                resp.pn_orig_msg_id = opm->pn_msg_id;
+                resp.pn_status = 0;
+        }
+        return pn_raw_send(&resp, sizeof(resp), rskb->dev,
+                                pn_object(oph->pn_sdev, oph->pn_sobj),
+                                pn_object(oph->pn_rdev, oph->pn_robj),
+                                oph->pn_res);
+}
+
+static int send_reset_indications(struct sk_buff *rskb)
+{
+        struct phonethdr *oph = pn_hdr(rskb);
+        static const u8 data[4] = {
+                0x00 /* trans ID */, 0x10 /* subscribe msg */,
+                0x00 /* subscription count */, 0x00 /* dummy */
+        };
+
+        return pn_raw_send(data, sizeof(data), rskb->dev,
+                                pn_object(oph->pn_sdev, 0x00),
+                                pn_object(oph->pn_rdev, oph->pn_robj), 0x10);
+}
+
+
+/* packet type functions */
+
+/*
+ * Stuff received packets to associated sockets.
+ * On error, returns non-zero and releases the skb.
+ */
+static int phonet_rcv(struct sk_buff *skb, struct net_device *dev,
+                        struct packet_type *pkttype,
+                        struct net_device *orig_dev)
+{
+        struct phonethdr *ph;
+        struct sock *sk;
+        struct sockaddr_pn sa;
+        u16 len;
+
+        if (dev_net(dev) != &init_net)
+                goto out;
+
+        /* check we have at least a full Phonet header */
+        if (!pskb_pull(skb, sizeof(struct phonethdr)))
+                goto out;
+
+        /* check that the advertised length is correct */
+        ph = pn_hdr(skb);
+        len = get_unaligned_be16(&ph->pn_length);
+        if (len < 2)
+                goto out;
+        len -= 2;
+        if ((len > skb->len) || pskb_trim(skb, len))
+                goto out;
+        skb_reset_transport_header(skb);
+
+        pn_skb_get_dst_sockaddr(skb, &sa);
+        if (pn_sockaddr_get_addr(&sa) == 0)
+                goto out; /* currently, we cannot be device 0 */
+
+        sk = pn_find_sock_by_sa(&sa);
+        if (sk == NULL) {
+                if (can_respond(skb)) {
+                        send_obj_unreachable(skb);
+                        send_reset_indications(skb);
+                }
+                goto out;
+        }
+
+        /* Push data to the socket (or other sockets connected to it). */
+        return sk_receive_skb(sk, skb, 0);
+
+out:
+        kfree_skb(skb);
+        return NET_RX_DROP;
+}
+
+static struct packet_type phonet_packet_type = {
+        .type = __constant_htons(ETH_P_PHONET),
+        .dev = NULL,
+        .func = phonet_rcv,
+};
+
+/* Transport protocol registration */
+static struct phonet_protocol *proto_tab[PHONET_NPROTO] __read_mostly;
+static DEFINE_SPINLOCK(proto_tab_lock);
+
+int __init_or_module phonet_proto_register(int protocol,
+                                                struct phonet_protocol *pp)
+{
+        int err = 0;
+
+        if (protocol >= PHONET_NPROTO)
+                return -EINVAL;
+
+        err = proto_register(pp->prot, 1);
+        if (err)
+                return err;
+
+        spin_lock(&proto_tab_lock);
+        if (proto_tab[protocol])
+                err = -EBUSY;
+        else
+                proto_tab[protocol] = pp;
+        spin_unlock(&proto_tab_lock);
+
+        return err;
+}
+EXPORT_SYMBOL(phonet_proto_register);
+
+void phonet_proto_unregister(int protocol, struct phonet_protocol *pp)
+{
+        spin_lock(&proto_tab_lock);
+        BUG_ON(proto_tab[protocol] != pp);
+        proto_tab[protocol] = NULL;
+        spin_unlock(&proto_tab_lock);
+        proto_unregister(pp->prot);
+}
+EXPORT_SYMBOL(phonet_proto_unregister);
+
+static struct phonet_protocol *phonet_proto_get(int protocol)
+{
+        struct phonet_protocol *pp;
+
+        if (protocol >= PHONET_NPROTO)
+                return NULL;
+
+        spin_lock(&proto_tab_lock);
+        pp = proto_tab[protocol];
+        if (pp && !try_module_get(pp->prot->owner))
+                pp = NULL;
+        spin_unlock(&proto_tab_lock);
+
+        return pp;
+}
+
+static inline void phonet_proto_put(struct phonet_protocol *pp)
+{
+        module_put(pp->prot->owner);
+}
+
+/* Module registration */
+static int __init phonet_init(void)
+{
+        int err;
+
+        err = sock_register(&phonet_proto_family);
+        if (err) {
+                printk(KERN_ALERT
+                        "phonet protocol family initialization failed\n");
+                return err;
+        }
+
+        phonet_device_init();
+        dev_add_pack(&phonet_packet_type);
+        phonet_netlink_register();
+        phonet_sysctl_init();
+
+        err = isi_register();
+        if (err)
+                goto err;
+        return 0;
+
+err:
+        phonet_sysctl_exit();
+        sock_unregister(AF_PHONET);
+        dev_remove_pack(&phonet_packet_type);
+        phonet_device_exit();
+        return err;
+}
+
+static void __exit phonet_exit(void)
+{
+        isi_unregister();
+        phonet_sysctl_exit();
+        sock_unregister(AF_PHONET);
+        dev_remove_pack(&phonet_packet_type);
+        phonet_device_exit();
+}
+
+module_init(phonet_init);
+module_exit(phonet_exit);
+MODULE_DESCRIPTION("Phonet protocol stack for Linux");
+MODULE_LICENSE("GPL");
diff --git a/net/phonet/datagram.c b/net/phonet/datagram.c
new file mode 100644
index 000000000000..e087862ed7e4
--- /dev/null
+++ b/net/phonet/datagram.c
@@ -0,0 +1,197 @@
+/*
+ * File: datagram.c
+ *
+ * Datagram (ISI) Phonet sockets
+ *
+ * Copyright (C) 2008 Nokia Corporation.
+ *
+ * Contact: Remi Denis-Courmont <remi.denis-courmont@nokia.com>
+ * Original author: Sakari Ailus <sakari.ailus@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ */
+
+#include <linux/kernel.h>
+#include <linux/socket.h>
+#include <asm/ioctls.h>
+#include <net/sock.h>
+
+#include <linux/phonet.h>
+#include <net/phonet/phonet.h>
+
+static int pn_backlog_rcv(struct sock *sk, struct sk_buff *skb);
+
+/* associated socket ceases to exist */
+static void pn_sock_close(struct sock *sk, long timeout)
+{
+        sk_common_release(sk);
+}
+
+static int pn_ioctl(struct sock *sk, int cmd, unsigned long arg)
+{
+        struct sk_buff *skb;
+        int answ;
+
+        switch (cmd) {
+        case SIOCINQ:
+                lock_sock(sk);
+                skb = skb_peek(&sk->sk_receive_queue);
+                answ = skb ? skb->len : 0;
+                release_sock(sk);
+                return put_user(answ, (int __user *)arg);
+        }
+
+        return -ENOIOCTLCMD;
+}
+
+/* Destroy socket. All references are gone. */
+static void pn_destruct(struct sock *sk)
+{
+        skb_queue_purge(&sk->sk_receive_queue);
+}
+
+static int pn_init(struct sock *sk)
+{
+        sk->sk_destruct = pn_destruct;
+        return 0;
+}
+
+static int pn_sendmsg(struct kiocb *iocb, struct sock *sk,
+                        struct msghdr *msg, size_t len)
+{
+        struct sockaddr_pn *target;
+        struct sk_buff *skb;
+        int err;
+
+        if (msg->msg_flags & MSG_OOB)
+                return -EOPNOTSUPP;
+
+        if (msg->msg_name == NULL)
+                return -EDESTADDRREQ;
+
+        if (msg->msg_namelen < sizeof(struct sockaddr_pn))
+                return -EINVAL;
+
+        target = (struct sockaddr_pn *)msg->msg_name;
+        if (target->spn_family != AF_PHONET)
+                return -EAFNOSUPPORT;
+
+        skb = sock_alloc_send_skb(sk, MAX_PHONET_HEADER + len,
+                                        msg->msg_flags & MSG_DONTWAIT, &err);
+        if (skb == NULL)
+                return err;
+        skb_reserve(skb, MAX_PHONET_HEADER);
+
+        err = memcpy_fromiovec((void *)skb_put(skb, len), msg->msg_iov, len);
+        if (err < 0) {
+                kfree_skb(skb);
+                return err;
+        }
+
+        /*
+         * Fill in the Phonet header and
+         * finally pass the packet forwards.
+         */
+        err = pn_skb_send(sk, skb, target);
+
+        /* If ok, return len. */
+        return (err >= 0) ? len : err;
+}
+
+static int pn_recvmsg(struct kiocb *iocb, struct sock *sk,
+                        struct msghdr *msg, size_t len, int noblock,
+                        int flags, int *addr_len)
+{
+        struct sk_buff *skb = NULL;
+        struct sockaddr_pn sa;
+        int rval = -EOPNOTSUPP;
+        int copylen;
+
+        if (flags & MSG_OOB)
+                goto out_nofree;
+
+        if (addr_len)
+                *addr_len = sizeof(sa);
+
+        skb = skb_recv_datagram(sk, flags, noblock, &rval);
+        if (skb == NULL)
+                goto out_nofree;
+
+        pn_skb_get_src_sockaddr(skb, &sa);
+
+        copylen = skb->len;
+        if (len < copylen) {
+                msg->msg_flags |= MSG_TRUNC;
+                copylen = len;
+        }
+
+        rval = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copylen);
+        if (rval) {
+                rval = -EFAULT;
+                goto out;
+        }
+
+        rval = (flags & MSG_TRUNC) ? skb->len : copylen;
+
+        if (msg->msg_name != NULL)
+                memcpy(msg->msg_name, &sa, sizeof(struct sockaddr_pn));
+
+out:
+        skb_free_datagram(sk, skb);
+
+out_nofree:
+        return rval;
+}
+
+/* Queue an skb for a sock. */
+static int pn_backlog_rcv(struct sock *sk, struct sk_buff *skb)
+{
+        int err = sock_queue_rcv_skb(sk, skb);
+        if (err < 0)
+                kfree_skb(skb);
+        return err ? NET_RX_DROP : NET_RX_SUCCESS;
+}
+
+/* Module registration */
+static struct proto pn_proto = {
+        .close          = pn_sock_close,
+        .ioctl          = pn_ioctl,
+        .init           = pn_init,
+        .sendmsg        = pn_sendmsg,
+        .recvmsg        = pn_recvmsg,
+        .backlog_rcv    = pn_backlog_rcv,
+        .hash           = pn_sock_hash,
+        .unhash         = pn_sock_unhash,
+        .get_port       = pn_sock_get_port,
+        .obj_size       = sizeof(struct pn_sock),
+        .owner          = THIS_MODULE,
+        .name           = "PHONET",
+};
+
+static struct phonet_protocol pn_dgram_proto = {
+        .ops            = &phonet_dgram_ops,
+        .prot           = &pn_proto,
+        .sock_type      = SOCK_DGRAM,
+};
+
+int __init isi_register(void)
+{
+        return phonet_proto_register(PN_PROTO_PHONET, &pn_dgram_proto);
+}
+
+void __exit isi_unregister(void)
+{
+        phonet_proto_unregister(PN_PROTO_PHONET, &pn_dgram_proto);
+}
diff --git a/net/phonet/pn_dev.c b/net/phonet/pn_dev.c
new file mode 100644
index 000000000000..53be9fc82aaa
--- /dev/null
+++ b/net/phonet/pn_dev.c
@@ -0,0 +1,208 @@
+/*
+ * File: pn_dev.c
+ *
+ * Phonet network device
+ *
+ * Copyright (C) 2008 Nokia Corporation.
+ *
+ * Contact: Remi Denis-Courmont <remi.denis-courmont@nokia.com>
+ * Original author: Sakari Ailus <sakari.ailus@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ */
+
+#include <linux/kernel.h>
+#include <linux/net.h>
+#include <linux/netdevice.h>
+#include <linux/phonet.h>
+#include <net/sock.h>
+#include <net/phonet/pn_dev.h>
+
+/* when accessing, remember to lock with spin_lock(&pndevs.lock); */
+struct phonet_device_list pndevs = {
+        .list = LIST_HEAD_INIT(pndevs.list),
+        .lock = __SPIN_LOCK_UNLOCKED(pndevs.lock),
+};
+
+/* Allocate new Phonet device. */
+static struct phonet_device *__phonet_device_alloc(struct net_device *dev)
+{
+        struct phonet_device *pnd = kmalloc(sizeof(*pnd), GFP_ATOMIC);
+        if (pnd == NULL)
+                return NULL;
+        pnd->netdev = dev;
+        bitmap_zero(pnd->addrs, 64);
+
+        list_add(&pnd->list, &pndevs.list);
+        return pnd;
+}
+
+static struct phonet_device *__phonet_get(struct net_device *dev)
+{
+        struct phonet_device *pnd;
+
+        list_for_each_entry(pnd, &pndevs.list, list) {
+                if (pnd->netdev == dev)
+                        return pnd;
+        }
+        return NULL;
+}
+
+static void __phonet_device_free(struct phonet_device *pnd)
+{
+        list_del(&pnd->list);
+        kfree(pnd);
+}
+
+struct net_device *phonet_device_get(struct net *net)
+{
+        struct phonet_device *pnd;
+        struct net_device *dev;
+
+        spin_lock_bh(&pndevs.lock);
+        list_for_each_entry(pnd, &pndevs.list, list) {
+                dev = pnd->netdev;
+                BUG_ON(!dev);
+
+                if (dev_net(dev) == net &&
+                        (dev->reg_state == NETREG_REGISTERED) &&
+                        ((pnd->netdev->flags & IFF_UP)) == IFF_UP)
+                        break;
+                dev = NULL;
+        }
+        if (dev)
+                dev_hold(dev);
+        spin_unlock_bh(&pndevs.lock);
+        return dev;
+}
+
+int phonet_address_add(struct net_device *dev, u8 addr)
+{
+        struct phonet_device *pnd;
+        int err = 0;
+
+        spin_lock_bh(&pndevs.lock);
+        /* Find or create Phonet-specific device data */
+        pnd = __phonet_get(dev);
+        if (pnd == NULL)
+                pnd = __phonet_device_alloc(dev);
+        if (unlikely(pnd == NULL))
+                err = -ENOMEM;
+        else if (test_and_set_bit(addr >> 2, pnd->addrs))
+                err = -EEXIST;
+        spin_unlock_bh(&pndevs.lock);
+        return err;
+}
+
+int phonet_address_del(struct net_device *dev, u8 addr)
+{
+        struct phonet_device *pnd;
+        int err = 0;
+
+        spin_lock_bh(&pndevs.lock);
+        pnd = __phonet_get(dev);
+        if (!pnd || !test_and_clear_bit(addr >> 2, pnd->addrs))
+                err = -EADDRNOTAVAIL;
+        if (bitmap_empty(pnd->addrs, 64))
+                __phonet_device_free(pnd);
+        spin_unlock_bh(&pndevs.lock);
+        return err;
+}
+
+/* Gets a source address toward a destination, through a interface. */
+u8 phonet_address_get(struct net_device *dev, u8 addr)
+{
+        struct phonet_device *pnd;
+
+        spin_lock_bh(&pndevs.lock);
+        pnd = __phonet_get(dev);
+        if (pnd) {
+                BUG_ON(bitmap_empty(pnd->addrs, 64));
+
+                /* Use same source address as destination, if possible */
+                if (!test_bit(addr >> 2, pnd->addrs))
+                        addr = find_first_bit(pnd->addrs, 64) << 2;
+        } else
+                addr = PN_NO_ADDR;
+        spin_unlock_bh(&pndevs.lock);
+        return addr;
+}
+
+int phonet_address_lookup(u8 addr)
+{
+        struct phonet_device *pnd;
+
+        spin_lock_bh(&pndevs.lock);
+        list_for_each_entry(pnd, &pndevs.list, list) {
+                /* Don't allow unregistering devices! */
+                if ((pnd->netdev->reg_state != NETREG_REGISTERED) ||
+                                ((pnd->netdev->flags & IFF_UP)) != IFF_UP)
+                        continue;
+
+                if (test_bit(addr >> 2, pnd->addrs)) {
+                        spin_unlock_bh(&pndevs.lock);
+                        return 0;
+                }
+        }
+        spin_unlock_bh(&pndevs.lock);
+        return -EADDRNOTAVAIL;
+}
+
+/* notify Phonet of device events */
+static int phonet_device_notify(struct notifier_block *me, unsigned long what,
+                                void *arg)
+{
+        struct net_device *dev = arg;
+
+        if (what == NETDEV_UNREGISTER) {
+                struct phonet_device *pnd;
+
+                /* Destroy phonet-specific device data */
+                spin_lock_bh(&pndevs.lock);
+                pnd = __phonet_get(dev);
+                if (pnd)
+                        __phonet_device_free(pnd);
+                spin_unlock_bh(&pndevs.lock);
+        }
+        return 0;
+
+}
+
+static struct notifier_block phonet_device_notifier = {
+        .notifier_call = phonet_device_notify,
+        .priority = 0,
+};
+
+/* Initialize Phonet devices list */
+void phonet_device_init(void)
+{
+        register_netdevice_notifier(&phonet_device_notifier);
+}
+
+void phonet_device_exit(void)
+{
+        struct phonet_device *pnd, *n;
+
+        rtnl_unregister_all(PF_PHONET);
+        rtnl_lock();
+        spin_lock_bh(&pndevs.lock);
+
+        list_for_each_entry_safe(pnd, n, &pndevs.list, list)
+                __phonet_device_free(pnd);
+
+        spin_unlock_bh(&pndevs.lock);
+        rtnl_unlock();
+        unregister_netdevice_notifier(&phonet_device_notifier);
+}
diff --git a/net/phonet/pn_netlink.c b/net/phonet/pn_netlink.c
new file mode 100644
index 000000000000..b1770d66bc8d
--- /dev/null
+++ b/net/phonet/pn_netlink.c
@@ -0,0 +1,165 @@
+/*
+ * File: pn_netlink.c
+ *
+ * Phonet netlink interface
+ *
+ * Copyright (C) 2008 Nokia Corporation.
+ *
+ * Contact: Remi Denis-Courmont <remi.denis-courmont@nokia.com>
+ * Original author: Sakari Ailus <sakari.ailus@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ */
+
+#include <linux/kernel.h>
+#include <linux/netlink.h>
+#include <linux/phonet.h>
+#include <net/sock.h>
+#include <net/phonet/pn_dev.h>
+
+static int fill_addr(struct sk_buff *skb, struct net_device *dev, u8 addr,
+                     u32 pid, u32 seq, int event);
+
+static void rtmsg_notify(int event, struct net_device *dev, u8 addr)
+{
+        struct sk_buff *skb;
+        int err = -ENOBUFS;
+
+        skb = nlmsg_new(NLMSG_ALIGN(sizeof(struct ifaddrmsg)) +
+                        nla_total_size(1), GFP_KERNEL);
+        if (skb == NULL)
+                goto errout;
+        err = fill_addr(skb, dev, addr, 0, 0, event);
+        if (err < 0) {
+                WARN_ON(err == -EMSGSIZE);
+                kfree_skb(skb);
+                goto errout;
+        }
+        err = rtnl_notify(skb, dev_net(dev), 0,
+                          RTNLGRP_PHONET_IFADDR, NULL, GFP_KERNEL);
+errout:
+        if (err < 0)
+                rtnl_set_sk_err(dev_net(dev), RTNLGRP_PHONET_IFADDR, err);
+}
+
+static const struct nla_policy ifa_phonet_policy[IFA_MAX+1] = {
+        [IFA_LOCAL] = { .type = NLA_U8 },
+};
+
+static int addr_doit(struct sk_buff *skb, struct nlmsghdr *nlh, void *attr)
+{
+        struct net *net = sock_net(skb->sk);
+        struct nlattr *tb[IFA_MAX+1];
+        struct net_device *dev;
+        struct ifaddrmsg *ifm;
+        int err;
+        u8 pnaddr;
+
+        if (!capable(CAP_SYS_ADMIN))
+                return -EPERM;
+
+        ASSERT_RTNL();
+
+        err = nlmsg_parse(nlh, sizeof(*ifm), tb, IFA_MAX, ifa_phonet_policy);
+        if (err < 0)
+                return err;
+
+        ifm = nlmsg_data(nlh);
+        if (tb[IFA_LOCAL] == NULL)
+                return -EINVAL;
+        pnaddr = nla_get_u8(tb[IFA_LOCAL]);
+        if (pnaddr & 3)
+                /* Phonet addresses only have 6 high-order bits */
+                return -EINVAL;
+
+        dev = __dev_get_by_index(net, ifm->ifa_index);
+        if (dev == NULL)
+                return -ENODEV;
+
+        if (nlh->nlmsg_type == RTM_NEWADDR)
+                err = phonet_address_add(dev, pnaddr);
+        else
+                err = phonet_address_del(dev, pnaddr);
+        if (!err)
+                rtmsg_notify(nlh->nlmsg_type, dev, pnaddr);
+        return err;
+}
+
+static int fill_addr(struct sk_buff *skb, struct net_device *dev, u8 addr,
+                        u32 pid, u32 seq, int event)
+{
+        struct ifaddrmsg *ifm;
+        struct nlmsghdr *nlh;
+
+        nlh = nlmsg_put(skb, pid, seq, event, sizeof(*ifm), 0);
+        if (nlh == NULL)
+                return -EMSGSIZE;
+
+        ifm = nlmsg_data(nlh);
+        ifm->ifa_family = AF_PHONET;
+        ifm->ifa_prefixlen = 0;
+        ifm->ifa_flags = IFA_F_PERMANENT;
+        ifm->ifa_scope = RT_SCOPE_LINK;
+        ifm->ifa_index = dev->ifindex;
+        NLA_PUT_U8(skb, IFA_LOCAL, addr);
+        return nlmsg_end(skb, nlh);
+
+nla_put_failure:
+        nlmsg_cancel(skb, nlh);
+        return -EMSGSIZE;
+}
+
+static int getaddr_dumpit(struct sk_buff *skb, struct netlink_callback *cb)
+{
+        struct phonet_device *pnd;
+        int dev_idx = 0, dev_start_idx = cb->args[0];
+        int addr_idx = 0, addr_start_idx = cb->args[1];
+
+        spin_lock_bh(&pndevs.lock);
+        list_for_each_entry(pnd, &pndevs.list, list) {
+                u8 addr;
+
+                if (dev_idx > dev_start_idx)
+                        addr_start_idx = 0;
+                if (dev_idx++ < dev_start_idx)
+                        continue;
+
+                addr_idx = 0;
+                for (addr = find_first_bit(pnd->addrs, 64); addr < 64;
+                        addr = find_next_bit(pnd->addrs, 64, 1+addr)) {
+                        if (addr_idx++ < addr_start_idx)
+                                continue;
+
+                        if (fill_addr(skb, pnd->netdev, addr << 2,
+                                         NETLINK_CB(cb->skb).pid,
+                                        cb->nlh->nlmsg_seq, RTM_NEWADDR))
+                                goto out;
+                }
+        }
+
+out:
+        spin_unlock_bh(&pndevs.lock);
+        cb->args[0] = dev_idx;
+        cb->args[1] = addr_idx;
+
+        return skb->len;
+}
+
+void __init phonet_netlink_register(void)
+{
+        rtnl_register(PF_PHONET, RTM_NEWADDR, addr_doit, NULL);
+        rtnl_register(PF_PHONET, RTM_DELADDR, addr_doit, NULL);
+        rtnl_register(PF_PHONET, RTM_GETADDR, NULL, getaddr_dumpit);
+}
diff --git a/net/phonet/socket.c b/net/phonet/socket.c
new file mode 100644
index 000000000000..dfd4061646db
--- /dev/null
+++ b/net/phonet/socket.c
@@ -0,0 +1,312 @@
+/*
+ * File: socket.c
+ *
+ * Phonet sockets
+ *
+ * Copyright (C) 2008 Nokia Corporation.
+ *
+ * Contact: Remi Denis-Courmont <remi.denis-courmont@nokia.com>
+ * Original author: Sakari Ailus <sakari.ailus@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ */
+
+#include <linux/kernel.h>
+#include <linux/net.h>
+#include <net/sock.h>
+#include <net/tcp_states.h>
+
+#include <linux/phonet.h>
+#include <net/phonet/phonet.h>
+#include <net/phonet/pn_dev.h>
+
+static int pn_socket_release(struct socket *sock)
+{
+        struct sock *sk = sock->sk;
+
+        if (sk) {
+                sock->sk = NULL;
+                sk->sk_prot->close(sk, 0);
+        }
+        return 0;
+}
+
+static struct  {
+        struct hlist_head hlist;
+        spinlock_t lock;
+} pnsocks = {
+        .hlist = HLIST_HEAD_INIT,
+        .lock = __SPIN_LOCK_UNLOCKED(pnsocks.lock),
+};
+
+/*
+ * Find address based on socket address, match only certain fields.
+ * Also grab sock if it was found. Remember to sock_put it later.
+ */
+struct sock *pn_find_sock_by_sa(const struct sockaddr_pn *spn)
+{
+        struct hlist_node *node;
+        struct sock *sknode;
+        struct sock *rval = NULL;
+        u16 obj = pn_sockaddr_get_object(spn);
+        u8 res = spn->spn_resource;
+
+        spin_lock_bh(&pnsocks.lock);
+
+        sk_for_each(sknode, node, &pnsocks.hlist) {
+                struct pn_sock *pn = pn_sk(sknode);
+                BUG_ON(!pn->sobject); /* unbound socket */
+
+                if (pn_port(obj)) {
+                        /* Look up socket by port */
+                        if (pn_port(pn->sobject) != pn_port(obj))
+                                continue;
+                } else {
+                        /* If port is zero, look up by resource */
+                        if (pn->resource != res)
+                                continue;
+                }
+                if (pn_addr(pn->sobject)
+                 && pn_addr(pn->sobject) != pn_addr(obj))
+                        continue;
+
+                rval = sknode;
+                sock_hold(sknode);
+                break;
+        }
+
+        spin_unlock_bh(&pnsocks.lock);
+
+        return rval;
+
+}
+
+void pn_sock_hash(struct sock *sk)
+{
+        spin_lock_bh(&pnsocks.lock);
+        sk_add_node(sk, &pnsocks.hlist);
+        spin_unlock_bh(&pnsocks.lock);
+}
+EXPORT_SYMBOL(pn_sock_hash);
+
+void pn_sock_unhash(struct sock *sk)
+{
+        spin_lock_bh(&pnsocks.lock);
+        sk_del_node_init(sk);
+        spin_unlock_bh(&pnsocks.lock);
+}
+EXPORT_SYMBOL(pn_sock_unhash);
+
+static int pn_socket_bind(struct socket *sock, struct sockaddr *addr, int len)
+{
+        struct sock *sk = sock->sk;
+        struct pn_sock *pn = pn_sk(sk);
+        struct sockaddr_pn *spn = (struct sockaddr_pn *)addr;
+        int err;
+        u16 handle;
+        u8 saddr;
+
+        if (sk->sk_prot->bind)
+                return sk->sk_prot->bind(sk, addr, len);
+
+        if (len < sizeof(struct sockaddr_pn))
+                return -EINVAL;
+        if (spn->spn_family != AF_PHONET)
+                return -EAFNOSUPPORT;
+
+        handle = pn_sockaddr_get_object((struct sockaddr_pn *)addr);
+        saddr = pn_addr(handle);
+        if (saddr && phonet_address_lookup(saddr))
+                return -EADDRNOTAVAIL;
+
+        lock_sock(sk);
+        if (sk->sk_state != TCP_CLOSE || pn_port(pn->sobject)) {
+                err = -EINVAL; /* attempt to rebind */
+                goto out;
+        }
+        err = sk->sk_prot->get_port(sk, pn_port(handle));
+        if (err)
+                goto out;
+
+        /* get_port() sets the port, bind() sets the address if applicable */
+        pn->sobject = pn_object(saddr, pn_port(pn->sobject));
+        pn->resource = spn->spn_resource;
+
+        /* Enable RX on the socket */
+        sk->sk_prot->hash(sk);
+out:
+        release_sock(sk);
+        return err;
+}
+
+static int pn_socket_autobind(struct socket *sock)
+{
+        struct sockaddr_pn sa;
+        int err;
+
+        memset(&sa, 0, sizeof(sa));
+        sa.spn_family = AF_PHONET;
+        err = pn_socket_bind(sock, (struct sockaddr *)&sa,
+                                sizeof(struct sockaddr_pn));
+        if (err != -EINVAL)
+                return err;
+        BUG_ON(!pn_port(pn_sk(sock->sk)->sobject));
+        return 0; /* socket was already bound */
+}
+
+static int pn_socket_getname(struct socket *sock, struct sockaddr *addr,
+                                int *sockaddr_len, int peer)
+{
+        struct sock *sk = sock->sk;
+        struct pn_sock *pn = pn_sk(sk);
+
+        memset(addr, 0, sizeof(struct sockaddr_pn));
+        addr->sa_family = AF_PHONET;
+        if (!peer) /* Race with bind() here is userland's problem. */
+                pn_sockaddr_set_object((struct sockaddr_pn *)addr,
+                                        pn->sobject);
+
+        *sockaddr_len = sizeof(struct sockaddr_pn);
+        return 0;
+}
+
+static int pn_socket_ioctl(struct socket *sock, unsigned int cmd,
+                                unsigned long arg)
+{
+        struct sock *sk = sock->sk;
+        struct pn_sock *pn = pn_sk(sk);
+
+        if (cmd == SIOCPNGETOBJECT) {
+                struct net_device *dev;
+                u16 handle;
+                u8 saddr;
+
+                if (get_user(handle, (__u16 __user *)arg))
+                        return -EFAULT;
+
+                lock_sock(sk);
+                if (sk->sk_bound_dev_if)
+                        dev = dev_get_by_index(sock_net(sk),
+                                                sk->sk_bound_dev_if);
+                else
+                        dev = phonet_device_get(sock_net(sk));
+                if (dev && (dev->flags & IFF_UP))
+                        saddr = phonet_address_get(dev, pn_addr(handle));
+                else
+                        saddr = PN_NO_ADDR;
+                release_sock(sk);
+
+                if (dev)
+                        dev_put(dev);
+                if (saddr == PN_NO_ADDR)
+                        return -EHOSTUNREACH;
+
+                handle = pn_object(saddr, pn_port(pn->sobject));
+                return put_user(handle, (__u16 __user *)arg);
+        }
+
+        return sk->sk_prot->ioctl(sk, cmd, arg);
+}
+
+static int pn_socket_sendmsg(struct kiocb *iocb, struct socket *sock,
+                                struct msghdr *m, size_t total_len)
+{
+        struct sock *sk = sock->sk;
+
+        if (pn_socket_autobind(sock))
+                return -EAGAIN;
+
+        return sk->sk_prot->sendmsg(iocb, sk, m, total_len);
+}
+
+const struct proto_ops phonet_dgram_ops = {
+        .family         = AF_PHONET,
+        .owner          = THIS_MODULE,
+        .release        = pn_socket_release,
+        .bind           = pn_socket_bind,
+        .connect        = sock_no_connect,
+        .socketpair     = sock_no_socketpair,
+        .accept         = sock_no_accept,
+        .getname        = pn_socket_getname,
+        .poll           = datagram_poll,
+        .ioctl          = pn_socket_ioctl,
+        .listen         = sock_no_listen,
+        .shutdown       = sock_no_shutdown,
+        .setsockopt     = sock_no_setsockopt,
+        .getsockopt     = sock_no_getsockopt,
+#ifdef CONFIG_COMPAT
+        .compat_setsockopt = sock_no_setsockopt,
+        .compat_getsockopt = sock_no_getsockopt,
+#endif
+        .sendmsg        = pn_socket_sendmsg,
+        .recvmsg        = sock_common_recvmsg,
+        .mmap           = sock_no_mmap,
+        .sendpage       = sock_no_sendpage,
+};
+
+static DEFINE_MUTEX(port_mutex);
+
+/* allocate port for a socket */
+int pn_sock_get_port(struct sock *sk, unsigned short sport)
+{
+        static int port_cur;
+        struct pn_sock *pn = pn_sk(sk);
+        struct sockaddr_pn try_sa;
+        struct sock *tmpsk;
+
+        memset(&try_sa, 0, sizeof(struct sockaddr_pn));
+        try_sa.spn_family = AF_PHONET;
+
+        mutex_lock(&port_mutex);
+
+        if (!sport) {
+                /* search free port */
+                int port, pmin, pmax;
+
+                phonet_get_local_port_range(&pmin, &pmax);
+                for (port = pmin; port <= pmax; port++) {
+                        port_cur++;
+                        if (port_cur < pmin || port_cur > pmax)
+                                port_cur = pmin;
+
+                        pn_sockaddr_set_port(&try_sa, port_cur);
+                        tmpsk = pn_find_sock_by_sa(&try_sa);
+                        if (tmpsk == NULL) {
+                                sport = port_cur;
+                                goto found;
+                        } else
+                                sock_put(tmpsk);
+                }
+        } else {
+                /* try to find specific port */
+                pn_sockaddr_set_port(&try_sa, sport);
+                tmpsk = pn_find_sock_by_sa(&try_sa);
+                if (tmpsk == NULL)
+                        /* No sock there! We can use that port... */
+                        goto found;
+                else
+                        sock_put(tmpsk);
+        }
+        mutex_unlock(&port_mutex);
+
+        /* the port must be in use already */
+        return -EADDRINUSE;
+
+found:
+        mutex_unlock(&port_mutex);
+        pn->sobject = pn_object(pn_addr(pn->sobject), sport);
+        return 0;
+}
+EXPORT_SYMBOL(pn_sock_get_port);
diff --git a/net/phonet/sysctl.c b/net/phonet/sysctl.c
new file mode 100644
index 000000000000..600a4309b8c8
--- /dev/null
+++ b/net/phonet/sysctl.c
@@ -0,0 +1,113 @@
+/*
+ * File: sysctl.c
+ *
+ * Phonet /proc/sys/net/phonet interface implementation
+ *
+ * Copyright (C) 2008 Nokia Corporation.
+ *
+ * Contact: Remi Denis-Courmont <remi.denis-courmont@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ */
+
+#include <linux/seqlock.h>
+#include <linux/sysctl.h>
+#include <linux/errno.h>
+#include <linux/init.h>
+
+#define DYNAMIC_PORT_MIN        0x40
+#define DYNAMIC_PORT_MAX        0x7f
+
+static DEFINE_SEQLOCK(local_port_range_lock);
+static int local_port_range_min[2] = {0, 0};
+static int local_port_range_max[2] = {1023, 1023};
+static int local_port_range[2] = {DYNAMIC_PORT_MIN, DYNAMIC_PORT_MAX};
+static struct ctl_table_header *phonet_table_hrd;
+
+static void set_local_port_range(int range[2])
+{
+        write_seqlock(&local_port_range_lock);
+        local_port_range[0] = range[0];
+        local_port_range[1] = range[1];
+        write_sequnlock(&local_port_range_lock);
+}
+
+void phonet_get_local_port_range(int *min, int *max)
+{
+        unsigned seq;
+        do {
+                seq = read_seqbegin(&local_port_range_lock);
+                if (min)
+                        *min = local_port_range[0];
+                if (max)
+                        *max = local_port_range[1];
+        } while (read_seqretry(&local_port_range_lock, seq));
+}
+
+static int proc_local_port_range(ctl_table *table, int write, struct file *filp,
+                                void __user *buffer,
+                                size_t *lenp, loff_t *ppos)
+{
+        int ret;
+        int range[2] = {local_port_range[0], local_port_range[1]};
+        ctl_table tmp = {
+                .data = &range,
+                .maxlen = sizeof(range),
+                .mode = table->mode,
+                .extra1 = &local_port_range_min,
+                .extra2 = &local_port_range_max,
+        };
+
+        ret = proc_dointvec_minmax(&tmp, write, filp, buffer, lenp, ppos);
+
+        if (write && ret == 0) {
+                if (range[1] < range[0])
+                        ret = -EINVAL;
+                else
+                        set_local_port_range(range);
+        }
+
+        return ret;
+}
+
+static struct ctl_table phonet_table[] = {
+        {
+                .ctl_name       = CTL_UNNUMBERED,
+                .procname       = "local_port_range",
+                .data           = &local_port_range,
+                .maxlen         = sizeof(local_port_range),
+                .mode           = 0644,
+                .proc_handler   = &proc_local_port_range,
+                .strategy       = NULL,
+        },
+        { .ctl_name = 0 }
+};
+
+struct ctl_path phonet_ctl_path[] = {
+        { .procname = "net", .ctl_name = CTL_NET, },
+        { .procname = "phonet", .ctl_name = CTL_UNNUMBERED, },
+        { },
+};
+
+int __init phonet_sysctl_init(void)
+{
+        phonet_table_hrd = register_sysctl_paths(phonet_ctl_path, phonet_table);
+        return phonet_table_hrd == NULL ? -ENOMEM : 0;
+}
+
+void phonet_sysctl_exit(void)
+{
+        unregister_sysctl_table(phonet_table_hrd);
+}
diff --git a/net/rfkill/rfkill-input.h b/net/rfkill/rfkill-input.h
index f63d05045685..bbfa646157c6 100644
--- a/net/rfkill/rfkill-input.h
+++ b/net/rfkill/rfkill-input.h
@@ -13,5 +13,6 @@
 
 void rfkill_switch_all(enum rfkill_type type, enum rfkill_state state);
 void rfkill_epo(void);
+void rfkill_restore_states(void);
 
 #endif /* __RFKILL_INPUT_H */
diff --git a/net/rfkill/rfkill.c b/net/rfkill/rfkill.c
index 74aecc098bad..ea0dc04b3c77 100644
--- a/net/rfkill/rfkill.c
+++ b/net/rfkill/rfkill.c
@@ -37,14 +37,20 @@ MODULE_DESCRIPTION("RF switch support");
 MODULE_LICENSE("GPL");
 
 static LIST_HEAD(rfkill_list);  /* list of registered rf switches */
-static DEFINE_MUTEX(rfkill_mutex);
+static DEFINE_MUTEX(rfkill_global_mutex);
 
 static unsigned int rfkill_default_state = RFKILL_STATE_UNBLOCKED;
 module_param_named(default_state, rfkill_default_state, uint, 0444);
 MODULE_PARM_DESC(default_state,
                  "Default initial state for all radio types, 0 = radio off");
 
-static enum rfkill_state rfkill_states[RFKILL_TYPE_MAX];
+struct rfkill_gsw_state {
+        enum rfkill_state current_state;
+        enum rfkill_state default_state;
+};
+
+static struct rfkill_gsw_state rfkill_global_states[RFKILL_TYPE_MAX];
+static unsigned long rfkill_states_lockdflt[BITS_TO_LONGS(RFKILL_TYPE_MAX)];
 
 static BLOCKING_NOTIFIER_HEAD(rfkill_notifier_list);
 
@@ -70,6 +76,7 @@ static BLOCKING_NOTIFIER_HEAD(rfkill_notifier_list);
  */
 int register_rfkill_notifier(struct notifier_block *nb)
 {
+        BUG_ON(!nb);
         return blocking_notifier_chain_register(&rfkill_notifier_list, nb);
 }
 EXPORT_SYMBOL_GPL(register_rfkill_notifier);
@@ -85,6 +92,7 @@ EXPORT_SYMBOL_GPL(register_rfkill_notifier);
  */
 int unregister_rfkill_notifier(struct notifier_block *nb)
 {
+        BUG_ON(!nb);
         return blocking_notifier_chain_unregister(&rfkill_notifier_list, nb);
 }
 EXPORT_SYMBOL_GPL(unregister_rfkill_notifier);
@@ -195,6 +203,11 @@ static int rfkill_toggle_radio(struct rfkill *rfkill,
                  * BLOCK even a transmitter that is already in state
                  * RFKILL_STATE_HARD_BLOCKED */
                 break;
+        default:
+                WARN(1, KERN_WARNING
+                        "rfkill: illegal state %d passed as parameter "
+                        "to rfkill_toggle_radio\n", state);
+                return -EINVAL;
         }
 
         if (force || state != rfkill->state) {
@@ -213,22 +226,29 @@ static int rfkill_toggle_radio(struct rfkill *rfkill,
 }
 
 /**
- * rfkill_switch_all - Toggle state of all switches of given type
+ * __rfkill_switch_all - Toggle state of all switches of given type
  * @type: type of interfaces to be affected
  * @state: the new state
  *
  * This function toggles the state of all switches of given type,
  * unless a specific switch is claimed by userspace (in which case,
  * that switch is left alone) or suspended.
+ *
+ * Caller must have acquired rfkill_global_mutex.
  */
-void rfkill_switch_all(enum rfkill_type type, enum rfkill_state state)
+static void __rfkill_switch_all(const enum rfkill_type type,
+                                const enum rfkill_state state)
 {
         struct rfkill *rfkill;
 
-        mutex_lock(&rfkill_mutex);
-
-        rfkill_states[type] = state;
+        if (WARN((state >= RFKILL_STATE_MAX || type >= RFKILL_TYPE_MAX),
+                        KERN_WARNING
+                        "rfkill: illegal state %d or type %d "
+                        "passed as parameter to __rfkill_switch_all\n",
+                        state, type))
+                return;
 
+        rfkill_global_states[type].current_state = state;
         list_for_each_entry(rfkill, &rfkill_list, node) {
                 if ((!rfkill->user_claim) && (rfkill->type == type)) {
                         mutex_lock(&rfkill->mutex);
@@ -236,8 +256,21 @@ void rfkill_switch_all(enum rfkill_type type, enum rfkill_state state)
                         mutex_unlock(&rfkill->mutex);
                 }
         }
+}
 
-        mutex_unlock(&rfkill_mutex);
+/**
+ * rfkill_switch_all - Toggle state of all switches of given type
+ * @type: type of interfaces to be affected
+ * @state: the new state
+ *
+ * Acquires rfkill_global_mutex and calls __rfkill_switch_all(@type, @state).
+ * Please refer to __rfkill_switch_all() for details.
+ */
+void rfkill_switch_all(enum rfkill_type type, enum rfkill_state state)
+{
+        mutex_lock(&rfkill_global_mutex);
+        __rfkill_switch_all(type, state);
+        mutex_unlock(&rfkill_global_mutex);
 }
 EXPORT_SYMBOL(rfkill_switch_all);
 
@@ -245,23 +278,53 @@ EXPORT_SYMBOL(rfkill_switch_all);
  * rfkill_epo - emergency power off all transmitters
  *
  * This kicks all non-suspended rfkill devices to RFKILL_STATE_SOFT_BLOCKED,
- * ignoring everything in its path but rfkill_mutex and rfkill->mutex.
+ * ignoring everything in its path but rfkill_global_mutex and rfkill->mutex.
+ *
+ * The global state before the EPO is saved and can be restored later
+ * using rfkill_restore_states().
  */
 void rfkill_epo(void)
 {
         struct rfkill *rfkill;
+        int i;
+
+        mutex_lock(&rfkill_global_mutex);
 
-        mutex_lock(&rfkill_mutex);
         list_for_each_entry(rfkill, &rfkill_list, node) {
                 mutex_lock(&rfkill->mutex);
                 rfkill_toggle_radio(rfkill, RFKILL_STATE_SOFT_BLOCKED, 1);
                 mutex_unlock(&rfkill->mutex);
         }
-        mutex_unlock(&rfkill_mutex);
+        for (i = 0; i < RFKILL_TYPE_MAX; i++) {
+                rfkill_global_states[i].default_state =
+                                rfkill_global_states[i].current_state;
+                rfkill_global_states[i].current_state =
+                                RFKILL_STATE_SOFT_BLOCKED;
+        }
+        mutex_unlock(&rfkill_global_mutex);
 }
 EXPORT_SYMBOL_GPL(rfkill_epo);
 
 /**
+ * rfkill_restore_states - restore global states
+ *
+ * Restore (and sync switches to) the global state from the
+ * states in rfkill_default_states.  This can undo the effects of
+ * a call to rfkill_epo().
+ */
+void rfkill_restore_states(void)
+{
+        int i;
+
+        mutex_lock(&rfkill_global_mutex);
+
+        for (i = 0; i < RFKILL_TYPE_MAX; i++)
+                __rfkill_switch_all(i, rfkill_global_states[i].default_state);
+        mutex_unlock(&rfkill_global_mutex);
+}
+EXPORT_SYMBOL_GPL(rfkill_restore_states);
+
+/**
  * rfkill_force_state - Force the internal rfkill radio state
  * @rfkill: pointer to the rfkill class to modify.
  * @state: the current radio state the class should be forced to.
@@ -282,9 +345,11 @@ int rfkill_force_state(struct rfkill *rfkill, enum rfkill_state state)
 {
         enum rfkill_state oldstate;
 
-        if (state != RFKILL_STATE_SOFT_BLOCKED &&
-            state != RFKILL_STATE_UNBLOCKED &&
-            state != RFKILL_STATE_HARD_BLOCKED)
+        BUG_ON(!rfkill);
+        if (WARN((state >= RFKILL_STATE_MAX),
+                        KERN_WARNING
+                        "rfkill: illegal state %d passed as parameter "
+                        "to rfkill_force_state\n", state))
                 return -EINVAL;
 
         mutex_lock(&rfkill->mutex);
@@ -352,12 +417,16 @@ static ssize_t rfkill_state_store(struct device *dev,
                                   const char *buf, size_t count)
 {
         struct rfkill *rfkill = to_rfkill(dev);
-        unsigned int state = simple_strtoul(buf, NULL, 0);
+        unsigned long state;
         int error;
 
         if (!capable(CAP_NET_ADMIN))
                 return -EPERM;
 
+        error = strict_strtoul(buf, 0, &state);
+        if (error)
+                return error;
+
         /* RFKILL_STATE_HARD_BLOCKED is illegal here... */
         if (state != RFKILL_STATE_UNBLOCKED &&
             state != RFKILL_STATE_SOFT_BLOCKED)
@@ -385,7 +454,8 @@ static ssize_t rfkill_claim_store(struct device *dev,
                                   const char *buf, size_t count)
 {
         struct rfkill *rfkill = to_rfkill(dev);
-        bool claim = !!simple_strtoul(buf, NULL, 0);
+        unsigned long claim_tmp;
+        bool claim;
         int error;
 
         if (!capable(CAP_NET_ADMIN))
@@ -394,11 +464,16 @@ static ssize_t rfkill_claim_store(struct device *dev,
         if (rfkill->user_claim_unsupported)
                 return -EOPNOTSUPP;
 
+        error = strict_strtoul(buf, 0, &claim_tmp);
+        if (error)
+                return error;
+        claim = !!claim_tmp;
+
         /*
          * Take the global lock to make sure the kernel is not in
          * the middle of rfkill_switch_all
          */
-        error = mutex_lock_interruptible(&rfkill_mutex);
+        error = mutex_lock_interruptible(&rfkill_global_mutex);
         if (error)
                 return error;
 
@@ -406,14 +481,14 @@ static ssize_t rfkill_claim_store(struct device *dev,
                 if (!claim) {
                         mutex_lock(&rfkill->mutex);
                         rfkill_toggle_radio(rfkill,
-                                            rfkill_states[rfkill->type],
-                                            0);
+                                        rfkill_global_states[rfkill->type].current_state,
+                                        0);
                         mutex_unlock(&rfkill->mutex);
                 }
                 rfkill->user_claim = claim;
         }
 
-        mutex_unlock(&rfkill_mutex);
+        mutex_unlock(&rfkill_global_mutex);
 
         return error ? error : count;
 }
@@ -437,21 +512,9 @@ static void rfkill_release(struct device *dev)
 #ifdef CONFIG_PM
 static int rfkill_suspend(struct device *dev, pm_message_t state)
 {
-        struct rfkill *rfkill = to_rfkill(dev);
-
-        if (dev->power.power_state.event != state.event) {
-                if (state.event & PM_EVENT_SLEEP) {
-                        /* Stop transmitter, keep state, no notifies */
-                        update_rfkill_state(rfkill);
-
-                        mutex_lock(&rfkill->mutex);
-                        rfkill->toggle_radio(rfkill->data,
-                                                RFKILL_STATE_SOFT_BLOCKED);
-                        mutex_unlock(&rfkill->mutex);
-                }
-
+        /* mark class device as suspended */
+        if (dev->power.power_state.event != state.event)
                 dev->power.power_state = state;
-        }
 
         return 0;
 }
@@ -525,24 +588,60 @@ static struct class rfkill_class = {
         .dev_uevent     = rfkill_dev_uevent,
 };
 
+static int rfkill_check_duplicity(const struct rfkill *rfkill)
+{
+        struct rfkill *p;
+        unsigned long seen[BITS_TO_LONGS(RFKILL_TYPE_MAX)];
+
+        memset(seen, 0, sizeof(seen));
+
+        list_for_each_entry(p, &rfkill_list, node) {
+                if (WARN((p == rfkill), KERN_WARNING
+                                "rfkill: illegal attempt to register "
+                                "an already registered rfkill struct\n"))
+                        return -EEXIST;
+                set_bit(p->type, seen);
+        }
+
+        /* 0: first switch of its kind */
+        return test_bit(rfkill->type, seen);
+}
+
 static int rfkill_add_switch(struct rfkill *rfkill)
 {
-        mutex_lock(&rfkill_mutex);
+        int error;
+
+        mutex_lock(&rfkill_global_mutex);
+
+        error = rfkill_check_duplicity(rfkill);
+        if (error < 0)
+                goto unlock_out;
 
-        rfkill_toggle_radio(rfkill, rfkill_states[rfkill->type], 0);
+        if (!error) {
+                /* lock default after first use */
+                set_bit(rfkill->type, rfkill_states_lockdflt);
+                rfkill_global_states[rfkill->type].current_state =
+                        rfkill_global_states[rfkill->type].default_state;
+        }
+
+        rfkill_toggle_radio(rfkill,
+                            rfkill_global_states[rfkill->type].current_state,
+                            0);
 
         list_add_tail(&rfkill->node, &rfkill_list);
 
-        mutex_unlock(&rfkill_mutex);
+        error = 0;
+unlock_out:
+        mutex_unlock(&rfkill_global_mutex);
 
-        return 0;
+        return error;
 }
 
 static void rfkill_remove_switch(struct rfkill *rfkill)
 {
-        mutex_lock(&rfkill_mutex);
+        mutex_lock(&rfkill_global_mutex);
         list_del_init(&rfkill->node);
-        mutex_unlock(&rfkill_mutex);
+        mutex_unlock(&rfkill_global_mutex);
 
         mutex_lock(&rfkill->mutex);
         rfkill_toggle_radio(rfkill, RFKILL_STATE_SOFT_BLOCKED, 1);
@@ -562,11 +661,18 @@ static void rfkill_remove_switch(struct rfkill *rfkill)
  * NOTE: If registration fails the structure shoudl be freed by calling
  * rfkill_free() otherwise rfkill_unregister() should be used.
  */
-struct rfkill *rfkill_allocate(struct device *parent, enum rfkill_type type)
+struct rfkill * __must_check rfkill_allocate(struct device *parent,
+                                             enum rfkill_type type)
 {
         struct rfkill *rfkill;
         struct device *dev;
 
+        if (WARN((type >= RFKILL_TYPE_MAX),
+                        KERN_WARNING
+                        "rfkill: illegal type %d passed as parameter "
+                        "to rfkill_allocate\n", type))
+                return NULL;
+
         rfkill = kzalloc(sizeof(struct rfkill), GFP_KERNEL);
         if (!rfkill)
                 return NULL;
@@ -633,15 +739,18 @@ static void rfkill_led_trigger_unregister(struct rfkill *rfkill)
  * structure needs to be registered. Immediately from registration the
  * switch driver should be able to service calls to toggle_radio.
  */
-int rfkill_register(struct rfkill *rfkill)
+int __must_check rfkill_register(struct rfkill *rfkill)
 {
         static atomic_t rfkill_no = ATOMIC_INIT(0);
         struct device *dev = &rfkill->dev;
         int error;
 
-        if (!rfkill->toggle_radio)
-                return -EINVAL;
-        if (rfkill->type >= RFKILL_TYPE_MAX)
+        if (WARN((!rfkill || !rfkill->toggle_radio ||
+                        rfkill->type >= RFKILL_TYPE_MAX ||
+                        rfkill->state >= RFKILL_STATE_MAX),
+                        KERN_WARNING
+                        "rfkill: attempt to register a "
+                        "badly initialized rfkill struct\n"))
                 return -EINVAL;
 
         snprintf(dev->bus_id, sizeof(dev->bus_id),
@@ -676,6 +785,7 @@ EXPORT_SYMBOL(rfkill_register);
  */
 void rfkill_unregister(struct rfkill *rfkill)
 {
+        BUG_ON(!rfkill);
         device_del(&rfkill->dev);
         rfkill_remove_switch(rfkill);
         rfkill_led_trigger_unregister(rfkill);
@@ -683,6 +793,56 @@ void rfkill_unregister(struct rfkill *rfkill)
 }
 EXPORT_SYMBOL(rfkill_unregister);
 
+/**
+ * rfkill_set_default - set initial value for a switch type
+ * @type - the type of switch to set the default state of
+ * @state - the new default state for that group of switches
+ *
+ * Sets the initial state rfkill should use for a given type.
+ * The following initial states are allowed: RFKILL_STATE_SOFT_BLOCKED
+ * and RFKILL_STATE_UNBLOCKED.
+ *
+ * This function is meant to be used by platform drivers for platforms
+ * that can save switch state across power down/reboot.
+ *
+ * The default state for each switch type can be changed exactly once.
+ * After a switch of that type is registered, the default state cannot
+ * be changed anymore.  This guards against multiple drivers it the
+ * same platform trying to set the initial switch default state, which
+ * is not allowed.
+ *
+ * Returns -EPERM if the state has already been set once or is in use,
+ * so drivers likely want to either ignore or at most printk(KERN_NOTICE)
+ * if this function returns -EPERM.
+ *
+ * Returns 0 if the new default state was set, or an error if it
+ * could not be set.
+ */
+int rfkill_set_default(enum rfkill_type type, enum rfkill_state state)
+{
+        int error;
+
+        if (WARN((type >= RFKILL_TYPE_MAX ||
+                        (state != RFKILL_STATE_SOFT_BLOCKED &&
+                         state != RFKILL_STATE_UNBLOCKED)),
+                        KERN_WARNING
+                        "rfkill: illegal state %d or type %d passed as "
+                        "parameter to rfkill_set_default\n", state, type))
+                return -EINVAL;
+
+        mutex_lock(&rfkill_global_mutex);
+
+        if (!test_and_set_bit(type, rfkill_states_lockdflt)) {
+                rfkill_global_states[type].default_state = state;
+                error = 0;
+        } else
+                error = -EPERM;
+
+        mutex_unlock(&rfkill_global_mutex);
+        return error;
+}
+EXPORT_SYMBOL_GPL(rfkill_set_default);
+
 /*
  * Rfkill module initialization/deinitialization.
  */
@@ -696,8 +856,8 @@ static int __init rfkill_init(void)
             rfkill_default_state != RFKILL_STATE_UNBLOCKED)
                 return -EINVAL;
 
-        for (i = 0; i < ARRAY_SIZE(rfkill_states); i++)
-                rfkill_states[i] = rfkill_default_state;
+        for (i = 0; i < RFKILL_TYPE_MAX; i++)
+                rfkill_global_states[i].default_state = rfkill_default_state;
 
         error = class_register(&rfkill_class);
         if (error) {
diff --git a/net/sched/Kconfig b/net/sched/Kconfig
index 9437b27ff84d..6767e54155db 100644
--- a/net/sched/Kconfig
+++ b/net/sched/Kconfig
@@ -106,6 +106,15 @@ config NET_SCH_PRIO
           To compile this code as a module, choose M here: the
           module will be called sch_prio.
 
+config NET_SCH_MULTIQ
+        tristate "Hardware Multiqueue-aware Multi Band Queuing (MULTIQ)"
+        ---help---
+          Say Y here if you want to use an n-band queue packet scheduler
+          to support devices that have multiple hardware transmit queues.
+
+          To compile this code as a module, choose M here: the
+          module will be called sch_multiq.
+
 config NET_SCH_RED
         tristate "Random Early Detection (RED)"
         ---help---
@@ -476,6 +485,17 @@ config NET_ACT_SIMP
           To compile this code as a module, choose M here: the
           module will be called simple.
 
+config NET_ACT_SKBEDIT
+        tristate "SKB Editing"
+        depends on NET_CLS_ACT
+        ---help---
+          Say Y here to change skb priority or queue_mapping settings.
+
+          If unsure, say N.
+
+          To compile this code as a module, choose M here: the
+          module will be called skbedit.
+
 config NET_CLS_IND
         bool "Incoming device classification"
         depends on NET_CLS_U32 || NET_CLS_FW
diff --git a/net/sched/Makefile b/net/sched/Makefile
index 1d2b0f7df848..e60c9925b269 100644
--- a/net/sched/Makefile
+++ b/net/sched/Makefile
@@ -14,6 +14,7 @@ obj-$(CONFIG_NET_ACT_IPT)	+= act_ipt.o
 obj-$(CONFIG_NET_ACT_NAT)       += act_nat.o
 obj-$(CONFIG_NET_ACT_PEDIT)     += act_pedit.o
 obj-$(CONFIG_NET_ACT_SIMP)      += act_simple.o
+obj-$(CONFIG_NET_ACT_SKBEDIT)   += act_skbedit.o
 obj-$(CONFIG_NET_SCH_FIFO)      += sch_fifo.o
 obj-$(CONFIG_NET_SCH_CBQ)       += sch_cbq.o
 obj-$(CONFIG_NET_SCH_HTB)       += sch_htb.o
@@ -26,6 +27,7 @@ obj-$(CONFIG_NET_SCH_SFQ)	+= sch_sfq.o
 obj-$(CONFIG_NET_SCH_TBF)       += sch_tbf.o
 obj-$(CONFIG_NET_SCH_TEQL)      += sch_teql.o
 obj-$(CONFIG_NET_SCH_PRIO)      += sch_prio.o
+obj-$(CONFIG_NET_SCH_MULTIQ)    += sch_multiq.o
 obj-$(CONFIG_NET_SCH_ATM)       += sch_atm.o
 obj-$(CONFIG_NET_SCH_NETEM)     += sch_netem.o
 obj-$(CONFIG_NET_CLS_U32)       += cls_u32.o
diff --git a/net/sched/act_skbedit.c b/net/sched/act_skbedit.c
new file mode 100644
index 000000000000..fe9777e77f35
--- /dev/null
+++ b/net/sched/act_skbedit.c
@@ -0,0 +1,203 @@
+/*
+ * Copyright (c) 2008, Intel Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc., 59 Temple
+ * Place - Suite 330, Boston, MA 02111-1307 USA.
+ *
+ * Author: Alexander Duyck <alexander.h.duyck@intel.com>
+ */
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/skbuff.h>
+#include <linux/rtnetlink.h>
+#include <net/netlink.h>
+#include <net/pkt_sched.h>
+
+#include <linux/tc_act/tc_skbedit.h>
+#include <net/tc_act/tc_skbedit.h>
+
+#define SKBEDIT_TAB_MASK     15
+static struct tcf_common *tcf_skbedit_ht[SKBEDIT_TAB_MASK + 1];
+static u32 skbedit_idx_gen;
+static DEFINE_RWLOCK(skbedit_lock);
+
+static struct tcf_hashinfo skbedit_hash_info = {
+        .htab   =       tcf_skbedit_ht,
+        .hmask  =       SKBEDIT_TAB_MASK,
+        .lock   =       &skbedit_lock,
+};
+
+static int tcf_skbedit(struct sk_buff *skb, struct tc_action *a,
+                       struct tcf_result *res)
+{
+        struct tcf_skbedit *d = a->priv;
+
+        spin_lock(&d->tcf_lock);
+        d->tcf_tm.lastuse = jiffies;
+        d->tcf_bstats.bytes += qdisc_pkt_len(skb);
+        d->tcf_bstats.packets++;
+
+        if (d->flags & SKBEDIT_F_PRIORITY)
+                skb->priority = d->priority;
+        if (d->flags & SKBEDIT_F_QUEUE_MAPPING &&
+            skb->dev->real_num_tx_queues > d->queue_mapping)
+                skb_set_queue_mapping(skb, d->queue_mapping);
+
+        spin_unlock(&d->tcf_lock);
+        return d->tcf_action;
+}
+
+static const struct nla_policy skbedit_policy[TCA_SKBEDIT_MAX + 1] = {
+        [TCA_SKBEDIT_PARMS]             = { .len = sizeof(struct tc_skbedit) },
+        [TCA_SKBEDIT_PRIORITY]          = { .len = sizeof(u32) },
+        [TCA_SKBEDIT_QUEUE_MAPPING]     = { .len = sizeof(u16) },
+};
+
+static int tcf_skbedit_init(struct nlattr *nla, struct nlattr *est,
+                         struct tc_action *a, int ovr, int bind)
+{
+        struct nlattr *tb[TCA_SKBEDIT_MAX + 1];
+        struct tc_skbedit *parm;
+        struct tcf_skbedit *d;
+        struct tcf_common *pc;
+        u32 flags = 0, *priority = NULL;
+        u16 *queue_mapping = NULL;
+        int ret = 0, err;
+
+        if (nla == NULL)
+                return -EINVAL;
+
+        err = nla_parse_nested(tb, TCA_SKBEDIT_MAX, nla, skbedit_policy);
+        if (err < 0)
+                return err;
+
+        if (tb[TCA_SKBEDIT_PARMS] == NULL)
+                return -EINVAL;
+
+        if (tb[TCA_SKBEDIT_PRIORITY] != NULL) {
+                flags |= SKBEDIT_F_PRIORITY;
+                priority = nla_data(tb[TCA_SKBEDIT_PRIORITY]);
+        }
+
+        if (tb[TCA_SKBEDIT_QUEUE_MAPPING] != NULL) {
+                flags |= SKBEDIT_F_QUEUE_MAPPING;
+                queue_mapping = nla_data(tb[TCA_SKBEDIT_QUEUE_MAPPING]);
+        }
+        if (!flags)
+                return -EINVAL;
+
+        parm = nla_data(tb[TCA_SKBEDIT_PARMS]);
+
+        pc = tcf_hash_check(parm->index, a, bind, &skbedit_hash_info);
+        if (!pc) {
+                pc = tcf_hash_create(parm->index, est, a, sizeof(*d), bind,
+                                     &skbedit_idx_gen, &skbedit_hash_info);
+                if (unlikely(!pc))
+                        return -ENOMEM;
+
+                d = to_skbedit(pc);
+                ret = ACT_P_CREATED;
+        } else {
+                d = to_skbedit(pc);
+                if (!ovr) {
+                        tcf_hash_release(pc, bind, &skbedit_hash_info);
+                        return -EEXIST;
+                }
+        }
+
+        spin_lock_bh(&d->tcf_lock);
+
+        d->flags = flags;
+        if (flags & SKBEDIT_F_PRIORITY)
+                d->priority = *priority;
+        if (flags & SKBEDIT_F_QUEUE_MAPPING)
+                d->queue_mapping = *queue_mapping;
+        d->tcf_action = parm->action;
+
+        spin_unlock_bh(&d->tcf_lock);
+
+        if (ret == ACT_P_CREATED)
+                tcf_hash_insert(pc, &skbedit_hash_info);
+        return ret;
+}
+
+static inline int tcf_skbedit_cleanup(struct tc_action *a, int bind)
+{
+        struct tcf_skbedit *d = a->priv;
+
+        if (d)
+                return tcf_hash_release(&d->common, bind, &skbedit_hash_info);
+        return 0;
+}
+
+static inline int tcf_skbedit_dump(struct sk_buff *skb, struct tc_action *a,
+                                int bind, int ref)
+{
+        unsigned char *b = skb_tail_pointer(skb);
+        struct tcf_skbedit *d = a->priv;
+        struct tc_skbedit opt;
+        struct tcf_t t;
+
+        opt.index = d->tcf_index;
+        opt.refcnt = d->tcf_refcnt - ref;
+        opt.bindcnt = d->tcf_bindcnt - bind;
+        opt.action = d->tcf_action;
+        NLA_PUT(skb, TCA_SKBEDIT_PARMS, sizeof(opt), &opt);
+        if (d->flags & SKBEDIT_F_PRIORITY)
+                NLA_PUT(skb, TCA_SKBEDIT_PRIORITY, sizeof(d->priority),
+                        &d->priority);
+        if (d->flags & SKBEDIT_F_QUEUE_MAPPING)
+                NLA_PUT(skb, TCA_SKBEDIT_QUEUE_MAPPING,
+                        sizeof(d->queue_mapping), &d->queue_mapping);
+        t.install = jiffies_to_clock_t(jiffies - d->tcf_tm.install);
+        t.lastuse = jiffies_to_clock_t(jiffies - d->tcf_tm.lastuse);
+        t.expires = jiffies_to_clock_t(d->tcf_tm.expires);
+        NLA_PUT(skb, TCA_SKBEDIT_TM, sizeof(t), &t);
+        return skb->len;
+
+nla_put_failure:
+        nlmsg_trim(skb, b);
+        return -1;
+}
+
+static struct tc_action_ops act_skbedit_ops = {
+        .kind           =       "skbedit",
+        .hinfo          =       &skbedit_hash_info,
+        .type           =       TCA_ACT_SKBEDIT,
+        .capab          =       TCA_CAP_NONE,
+        .owner          =       THIS_MODULE,
+        .act            =       tcf_skbedit,
+        .dump           =       tcf_skbedit_dump,
+        .cleanup        =       tcf_skbedit_cleanup,
+        .init           =       tcf_skbedit_init,
+        .walk           =       tcf_generic_walker,
+};
+
+MODULE_AUTHOR("Alexander Duyck, <alexander.h.duyck@intel.com>");
+MODULE_DESCRIPTION("SKB Editing");
+MODULE_LICENSE("GPL");
+
+static int __init skbedit_init_module(void)
+{
+        return tcf_register_action(&act_skbedit_ops);
+}
+
+static void __exit skbedit_cleanup_module(void)
+{
+        tcf_unregister_action(&act_skbedit_ops);
+}
+
+module_init(skbedit_init_module);
+module_exit(skbedit_cleanup_module);
diff --git a/net/sched/cls_flow.c b/net/sched/cls_flow.c
index 8f63a1a94014..0ebaff637e31 100644
--- a/net/sched/cls_flow.c
+++ b/net/sched/cls_flow.c
@@ -67,9 +67,9 @@ static inline u32 addr_fold(void *addr)
 static u32 flow_get_src(const struct sk_buff *skb)
 {
         switch (skb->protocol) {
-        case __constant_htons(ETH_P_IP):
+        case htons(ETH_P_IP):
                 return ntohl(ip_hdr(skb)->saddr);
-        case __constant_htons(ETH_P_IPV6):
+        case htons(ETH_P_IPV6):
                 return ntohl(ipv6_hdr(skb)->saddr.s6_addr32[3]);
         default:
                 return addr_fold(skb->sk);
@@ -79,9 +79,9 @@ static u32 flow_get_src(const struct sk_buff *skb)
 static u32 flow_get_dst(const struct sk_buff *skb)
 {
         switch (skb->protocol) {
-        case __constant_htons(ETH_P_IP):
+        case htons(ETH_P_IP):
                 return ntohl(ip_hdr(skb)->daddr);
-        case __constant_htons(ETH_P_IPV6):
+        case htons(ETH_P_IPV6):
                 return ntohl(ipv6_hdr(skb)->daddr.s6_addr32[3]);
         default:
                 return addr_fold(skb->dst) ^ (__force u16)skb->protocol;
@@ -91,9 +91,9 @@ static u32 flow_get_dst(const struct sk_buff *skb)
 static u32 flow_get_proto(const struct sk_buff *skb)
 {
         switch (skb->protocol) {
-        case __constant_htons(ETH_P_IP):
+        case htons(ETH_P_IP):
                 return ip_hdr(skb)->protocol;
-        case __constant_htons(ETH_P_IPV6):
+        case htons(ETH_P_IPV6):
                 return ipv6_hdr(skb)->nexthdr;
         default:
                 return 0;
@@ -120,7 +120,7 @@ static u32 flow_get_proto_src(const struct sk_buff *skb)
         u32 res = 0;
 
         switch (skb->protocol) {
-        case __constant_htons(ETH_P_IP): {
+        case htons(ETH_P_IP): {
                 struct iphdr *iph = ip_hdr(skb);
 
                 if (!(iph->frag_off&htons(IP_MF|IP_OFFSET)) &&
@@ -128,7 +128,7 @@ static u32 flow_get_proto_src(const struct sk_buff *skb)
                         res = ntohs(*(__be16 *)((void *)iph + iph->ihl * 4));
                 break;
         }
-        case __constant_htons(ETH_P_IPV6): {
+        case htons(ETH_P_IPV6): {
                 struct ipv6hdr *iph = ipv6_hdr(skb);
 
                 if (has_ports(iph->nexthdr))
@@ -147,7 +147,7 @@ static u32 flow_get_proto_dst(const struct sk_buff *skb)
         u32 res = 0;
 
         switch (skb->protocol) {
-        case __constant_htons(ETH_P_IP): {
+        case htons(ETH_P_IP): {
                 struct iphdr *iph = ip_hdr(skb);
 
                 if (!(iph->frag_off&htons(IP_MF|IP_OFFSET)) &&
@@ -155,7 +155,7 @@ static u32 flow_get_proto_dst(const struct sk_buff *skb)
                         res = ntohs(*(__be16 *)((void *)iph + iph->ihl * 4 + 2));
                 break;
         }
-        case __constant_htons(ETH_P_IPV6): {
+        case htons(ETH_P_IPV6): {
                 struct ipv6hdr *iph = ipv6_hdr(skb);
 
                 if (has_ports(iph->nexthdr))
@@ -213,9 +213,9 @@ static u32 flow_get_nfct(const struct sk_buff *skb)
 static u32 flow_get_nfct_src(const struct sk_buff *skb)
 {
         switch (skb->protocol) {
-        case __constant_htons(ETH_P_IP):
+        case htons(ETH_P_IP):
                 return ntohl(CTTUPLE(skb, src.u3.ip));
-        case __constant_htons(ETH_P_IPV6):
+        case htons(ETH_P_IPV6):
                 return ntohl(CTTUPLE(skb, src.u3.ip6[3]));
         }
 fallback:
@@ -225,9 +225,9 @@ fallback:
 static u32 flow_get_nfct_dst(const struct sk_buff *skb)
 {
         switch (skb->protocol) {
-        case __constant_htons(ETH_P_IP):
+        case htons(ETH_P_IP):
                 return ntohl(CTTUPLE(skb, dst.u3.ip));
-        case __constant_htons(ETH_P_IPV6):
+        case htons(ETH_P_IPV6):
                 return ntohl(CTTUPLE(skb, dst.u3.ip6[3]));
         }
 fallback:
diff --git a/net/sched/em_cmp.c b/net/sched/em_cmp.c
index cc49c932641d..bc450397487a 100644
--- a/net/sched/em_cmp.c
+++ b/net/sched/em_cmp.c
@@ -14,6 +14,7 @@
 #include <linux/kernel.h>
 #include <linux/skbuff.h>
 #include <linux/tc_ematch/tc_em_cmp.h>
+#include <asm/unaligned.h>
 #include <net/pkt_cls.h>
 
 static inline int cmp_needs_transformation(struct tcf_em_cmp *cmp)
@@ -37,8 +38,7 @@ static int em_cmp_match(struct sk_buff *skb, struct tcf_ematch *em,
                         break;
 
                 case TCF_EM_ALIGN_U16:
-                        val = *ptr << 8;
-                        val |= *(ptr+1);
+                        val = get_unaligned_be16(ptr);
 
                         if (cmp_needs_transformation(cmp))
                                 val = be16_to_cpu(val);
@@ -47,10 +47,7 @@ static int em_cmp_match(struct sk_buff *skb, struct tcf_ematch *em,
                 case TCF_EM_ALIGN_U32:
                         /* Worth checking boundries? The branching seems
                          * to get worse. Visit again. */
-                        val = *ptr << 24;
-                        val |= *(ptr+1) << 16;
-                        val |= *(ptr+2) << 8;
-                        val |= *(ptr+3);
+                        val = get_unaligned_be32(ptr);
 
                         if (cmp_needs_transformation(cmp))
                                 val = be32_to_cpu(val);
diff --git a/net/sched/sch_dsmark.c b/net/sched/sch_dsmark.c
index edd1298f85f6..ba43aab3a851 100644
--- a/net/sched/sch_dsmark.c
+++ b/net/sched/sch_dsmark.c
@@ -202,7 +202,7 @@ static int dsmark_enqueue(struct sk_buff *skb, struct Qdisc *sch)
 
         if (p->set_tc_index) {
                 switch (skb->protocol) {
-                case __constant_htons(ETH_P_IP):
+                case htons(ETH_P_IP):
                         if (skb_cow_head(skb, sizeof(struct iphdr)))
                                 goto drop;
 
@@ -210,7 +210,7 @@ static int dsmark_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                                 & ~INET_ECN_MASK;
                         break;
 
-                case __constant_htons(ETH_P_IPV6):
+                case htons(ETH_P_IPV6):
                         if (skb_cow_head(skb, sizeof(struct ipv6hdr)))
                                 goto drop;
 
@@ -289,11 +289,11 @@ static struct sk_buff *dsmark_dequeue(struct Qdisc *sch)
         pr_debug("index %d->%d\n", skb->tc_index, index);
 
         switch (skb->protocol) {
-        case __constant_htons(ETH_P_IP):
+        case htons(ETH_P_IP):
                 ipv4_change_dsfield(ip_hdr(skb), p->mask[index],
                                     p->value[index]);
                         break;
-        case __constant_htons(ETH_P_IPV6):
+        case htons(ETH_P_IPV6):
                 ipv6_change_dsfield(ipv6_hdr(skb), p->mask[index],
                                     p->value[index]);
                         break;
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index ec0a0839ce51..5e7e0bd38fe8 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -44,10 +44,7 @@ static inline int qdisc_qlen(struct Qdisc *q)
 
 static inline int dev_requeue_skb(struct sk_buff *skb, struct Qdisc *q)
 {
-        if (unlikely(skb->next))
-                q->gso_skb = skb;
-        else
-                q->ops->requeue(skb, q);
+        __skb_queue_head(&q->requeue, skb);
 
         __netif_schedule(q);
         return 0;
@@ -55,12 +52,21 @@ static inline int dev_requeue_skb(struct sk_buff *skb, struct Qdisc *q)
 
 static inline struct sk_buff *dequeue_skb(struct Qdisc *q)
 {
-        struct sk_buff *skb;
+        struct sk_buff *skb = skb_peek(&q->requeue);
+
+        if (unlikely(skb)) {
+                struct net_device *dev = qdisc_dev(q);
+                struct netdev_queue *txq;
 
-        if ((skb = q->gso_skb))
-                q->gso_skb = NULL;
-        else
+                /* check the reason of requeuing without tx lock first */
+                txq = netdev_get_tx_queue(dev, skb_get_queue_mapping(skb));
+                if (!netif_tx_queue_stopped(txq) && !netif_tx_queue_frozen(txq))
+                        __skb_unlink(skb, &q->requeue);
+                else
+                        skb = NULL;
+        } else {
                 skb = q->dequeue(q);
+        }
 
         return skb;
 }
@@ -327,6 +333,7 @@ struct Qdisc noop_qdisc = {
         .flags          =       TCQ_F_BUILTIN,
         .ops            =       &noop_qdisc_ops,
         .list           =       LIST_HEAD_INIT(noop_qdisc.list),
+        .requeue.lock   =       __SPIN_LOCK_UNLOCKED(noop_qdisc.q.lock),
         .q.lock         =       __SPIN_LOCK_UNLOCKED(noop_qdisc.q.lock),
         .dev_queue      =       &noop_netdev_queue,
 };
@@ -352,6 +359,7 @@ static struct Qdisc noqueue_qdisc = {
         .flags          =       TCQ_F_BUILTIN,
         .ops            =       &noqueue_qdisc_ops,
         .list           =       LIST_HEAD_INIT(noqueue_qdisc.list),
+        .requeue.lock   =       __SPIN_LOCK_UNLOCKED(noqueue_qdisc.q.lock),
         .q.lock         =       __SPIN_LOCK_UNLOCKED(noqueue_qdisc.q.lock),
         .dev_queue      =       &noqueue_netdev_queue,
 };
@@ -472,6 +480,7 @@ struct Qdisc *qdisc_alloc(struct netdev_queue *dev_queue,
         sch->padded = (char *) sch - (char *) p;
 
         INIT_LIST_HEAD(&sch->list);
+        skb_queue_head_init(&sch->requeue);
         skb_queue_head_init(&sch->q);
         sch->ops = ops;
         sch->enqueue = ops->enqueue;
@@ -539,7 +548,7 @@ void qdisc_destroy(struct Qdisc *qdisc)
         module_put(ops->owner);
         dev_put(qdisc_dev(qdisc));
 
-        kfree_skb(qdisc->gso_skb);
+        __skb_queue_purge(&qdisc->requeue);
 
         kfree((char *) qdisc - qdisc->padded);
 }
diff --git a/net/sched/sch_multiq.c b/net/sched/sch_multiq.c
new file mode 100644
index 000000000000..915f3149dde2
--- /dev/null
+++ b/net/sched/sch_multiq.c
@@ -0,0 +1,477 @@
+/*
+ * Copyright (c) 2008, Intel Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc., 59 Temple
+ * Place - Suite 330, Boston, MA 02111-1307 USA.
+ *
+ * Author: Alexander Duyck <alexander.h.duyck@intel.com>
+ */
+
+#include <linux/module.h>
+#include <linux/types.h>
+#include <linux/kernel.h>
+#include <linux/string.h>
+#include <linux/errno.h>
+#include <linux/skbuff.h>
+#include <net/netlink.h>
+#include <net/pkt_sched.h>
+
+
+struct multiq_sched_data {
+        u16 bands;
+        u16 max_bands;
+        u16 curband;
+        struct tcf_proto *filter_list;
+        struct Qdisc **queues;
+};
+
+
+static struct Qdisc *
+multiq_classify(struct sk_buff *skb, struct Qdisc *sch, int *qerr)
+{
+        struct multiq_sched_data *q = qdisc_priv(sch);
+        u32 band;
+        struct tcf_result res;
+        int err;
+
+        *qerr = NET_XMIT_SUCCESS | __NET_XMIT_BYPASS;
+        err = tc_classify(skb, q->filter_list, &res);
+#ifdef CONFIG_NET_CLS_ACT
+        switch (err) {
+        case TC_ACT_STOLEN:
+        case TC_ACT_QUEUED:
+                *qerr = NET_XMIT_SUCCESS | __NET_XMIT_STOLEN;
+        case TC_ACT_SHOT:
+                return NULL;
+        }
+#endif
+        band = skb_get_queue_mapping(skb);
+
+        if (band >= q->bands)
+                return q->queues[0];
+
+        return q->queues[band];
+}
+
+static int
+multiq_enqueue(struct sk_buff *skb, struct Qdisc *sch)
+{
+        struct Qdisc *qdisc;
+        int ret;
+
+        qdisc = multiq_classify(skb, sch, &ret);
+#ifdef CONFIG_NET_CLS_ACT
+        if (qdisc == NULL) {
+
+                if (ret & __NET_XMIT_BYPASS)
+                        sch->qstats.drops++;
+                kfree_skb(skb);
+                return ret;
+        }
+#endif
+
+        ret = qdisc_enqueue(skb, qdisc);
+        if (ret == NET_XMIT_SUCCESS) {
+                sch->bstats.bytes += qdisc_pkt_len(skb);
+                sch->bstats.packets++;
+                sch->q.qlen++;
+                return NET_XMIT_SUCCESS;
+        }
+        if (net_xmit_drop_count(ret))
+                sch->qstats.drops++;
+        return ret;
+}
+
+
+static int
+multiq_requeue(struct sk_buff *skb, struct Qdisc *sch)
+{
+        struct Qdisc *qdisc;
+        struct multiq_sched_data *q = qdisc_priv(sch);
+        int ret;
+
+        qdisc = multiq_classify(skb, sch, &ret);
+#ifdef CONFIG_NET_CLS_ACT
+        if (qdisc == NULL) {
+                if (ret & __NET_XMIT_BYPASS)
+                        sch->qstats.drops++;
+                kfree_skb(skb);
+                return ret;
+        }
+#endif
+
+        ret = qdisc->ops->requeue(skb, qdisc);
+        if (ret == NET_XMIT_SUCCESS) {
+                sch->q.qlen++;
+                sch->qstats.requeues++;
+                if (q->curband)
+                        q->curband--;
+                else
+                        q->curband = q->bands - 1;
+                return NET_XMIT_SUCCESS;
+        }
+        if (net_xmit_drop_count(ret))
+                sch->qstats.drops++;
+        return ret;
+}
+
+
+static struct sk_buff *multiq_dequeue(struct Qdisc *sch)
+{
+        struct multiq_sched_data *q = qdisc_priv(sch);
+        struct Qdisc *qdisc;
+        struct sk_buff *skb;
+        int band;
+
+        for (band = 0; band < q->bands; band++) {
+                /* cycle through bands to ensure fairness */
+                q->curband++;
+                if (q->curband >= q->bands)
+                        q->curband = 0;
+
+                /* Check that target subqueue is available before
+                 * pulling an skb to avoid excessive requeues
+                 */
+                if (!__netif_subqueue_stopped(qdisc_dev(sch), q->curband)) {
+                        qdisc = q->queues[q->curband];
+                        skb = qdisc->dequeue(qdisc);
+                        if (skb) {
+                                sch->q.qlen--;
+                                return skb;
+                        }
+                }
+        }
+        return NULL;
+
+}
+
+static unsigned int multiq_drop(struct Qdisc *sch)
+{
+        struct multiq_sched_data *q = qdisc_priv(sch);
+        int band;
+        unsigned int len;
+        struct Qdisc *qdisc;
+
+        for (band = q->bands-1; band >= 0; band--) {
+                qdisc = q->queues[band];
+                if (qdisc->ops->drop) {
+                        len = qdisc->ops->drop(qdisc);
+                        if (len != 0) {
+                                sch->q.qlen--;
+                                return len;
+                        }
+                }
+        }
+        return 0;
+}
+
+
+static void
+multiq_reset(struct Qdisc *sch)
+{
+        u16 band;
+        struct multiq_sched_data *q = qdisc_priv(sch);
+
+        for (band = 0; band < q->bands; band++)
+                qdisc_reset(q->queues[band]);
+        sch->q.qlen = 0;
+        q->curband = 0;
+}
+
+static void
+multiq_destroy(struct Qdisc *sch)
+{
+        int band;
+        struct multiq_sched_data *q = qdisc_priv(sch);
+
+        tcf_destroy_chain(&q->filter_list);
+        for (band = 0; band < q->bands; band++)
+                qdisc_destroy(q->queues[band]);
+
+        kfree(q->queues);
+}
+
+static int multiq_tune(struct Qdisc *sch, struct nlattr *opt)
+{
+        struct multiq_sched_data *q = qdisc_priv(sch);
+        struct tc_multiq_qopt *qopt;
+        int i;
+
+        if (!netif_is_multiqueue(qdisc_dev(sch)))
+                return -EINVAL;
+        if (nla_len(opt) < sizeof(*qopt))
+                return -EINVAL;
+
+        qopt = nla_data(opt);
+
+        qopt->bands = qdisc_dev(sch)->real_num_tx_queues;
+
+        sch_tree_lock(sch);
+        q->bands = qopt->bands;
+        for (i = q->bands; i < q->max_bands; i++) {
+                if (q->queues[i] != &noop_qdisc) {
+                        struct Qdisc *child = xchg(&q->queues[i], &noop_qdisc);
+                        qdisc_tree_decrease_qlen(child, child->q.qlen);
+                        qdisc_destroy(child);
+                }
+        }
+
+        sch_tree_unlock(sch);
+
+        for (i = 0; i < q->bands; i++) {
+                if (q->queues[i] == &noop_qdisc) {
+                        struct Qdisc *child;
+                        child = qdisc_create_dflt(qdisc_dev(sch),
+                                                  sch->dev_queue,
+                                                  &pfifo_qdisc_ops,
+                                                  TC_H_MAKE(sch->handle,
+                                                            i + 1));
+                        if (child) {
+                                sch_tree_lock(sch);
+                                child = xchg(&q->queues[i], child);
+
+                                if (child != &noop_qdisc) {
+                                        qdisc_tree_decrease_qlen(child,
+                                                                 child->q.qlen);
+                                        qdisc_destroy(child);
+                                }
+                                sch_tree_unlock(sch);
+                        }
+                }
+        }
+        return 0;
+}
+
+static int multiq_init(struct Qdisc *sch, struct nlattr *opt)
+{
+        struct multiq_sched_data *q = qdisc_priv(sch);
+        int i, err;
+
+        q->queues = NULL;
+
+        if (opt == NULL)
+                return -EINVAL;
+
+        q->max_bands = qdisc_dev(sch)->num_tx_queues;
+
+        q->queues = kcalloc(q->max_bands, sizeof(struct Qdisc *), GFP_KERNEL);
+        if (!q->queues)
+                return -ENOBUFS;
+        for (i = 0; i < q->max_bands; i++)
+                q->queues[i] = &noop_qdisc;
+
+        err = multiq_tune(sch,opt);
+
+        if (err)
+                kfree(q->queues);
+
+        return err;
+}
+
+static int multiq_dump(struct Qdisc *sch, struct sk_buff *skb)
+{
+        struct multiq_sched_data *q = qdisc_priv(sch);
+        unsigned char *b = skb_tail_pointer(skb);
+        struct tc_multiq_qopt opt;
+
+        opt.bands = q->bands;
+        opt.max_bands = q->max_bands;
+
+        NLA_PUT(skb, TCA_OPTIONS, sizeof(opt), &opt);
+
+        return skb->len;
+
+nla_put_failure:
+        nlmsg_trim(skb, b);
+        return -1;
+}
+
+static int multiq_graft(struct Qdisc *sch, unsigned long arg, struct Qdisc *new,
+                      struct Qdisc **old)
+{
+        struct multiq_sched_data *q = qdisc_priv(sch);
+        unsigned long band = arg - 1;
+
+        if (band >= q->bands)
+                return -EINVAL;
+
+        if (new == NULL)
+                new = &noop_qdisc;
+
+        sch_tree_lock(sch);
+        *old = q->queues[band];
+        q->queues[band] = new;
+        qdisc_tree_decrease_qlen(*old, (*old)->q.qlen);
+        qdisc_reset(*old);
+        sch_tree_unlock(sch);
+
+        return 0;
+}
+
+static struct Qdisc *
+multiq_leaf(struct Qdisc *sch, unsigned long arg)
+{
+        struct multiq_sched_data *q = qdisc_priv(sch);
+        unsigned long band = arg - 1;
+
+        if (band >= q->bands)
+                return NULL;
+
+        return q->queues[band];
+}
+
+static unsigned long multiq_get(struct Qdisc *sch, u32 classid)
+{
+        struct multiq_sched_data *q = qdisc_priv(sch);
+        unsigned long band = TC_H_MIN(classid);
+
+        if (band - 1 >= q->bands)
+                return 0;
+        return band;
+}
+
+static unsigned long multiq_bind(struct Qdisc *sch, unsigned long parent,
+                                 u32 classid)
+{
+        return multiq_get(sch, classid);
+}
+
+
+static void multiq_put(struct Qdisc *q, unsigned long cl)
+{
+        return;
+}
+
+static int multiq_change(struct Qdisc *sch, u32 handle, u32 parent,
+                         struct nlattr **tca, unsigned long *arg)
+{
+        unsigned long cl = *arg;
+        struct multiq_sched_data *q = qdisc_priv(sch);
+
+        if (cl - 1 > q->bands)
+                return -ENOENT;
+        return 0;
+}
+
+static int multiq_delete(struct Qdisc *sch, unsigned long cl)
+{
+        struct multiq_sched_data *q = qdisc_priv(sch);
+        if (cl - 1 > q->bands)
+                return -ENOENT;
+        return 0;
+}
+
+
+static int multiq_dump_class(struct Qdisc *sch, unsigned long cl,
+                             struct sk_buff *skb, struct tcmsg *tcm)
+{
+        struct multiq_sched_data *q = qdisc_priv(sch);
+
+        if (cl - 1 > q->bands)
+                return -ENOENT;
+        tcm->tcm_handle |= TC_H_MIN(cl);
+        if (q->queues[cl-1])
+                tcm->tcm_info = q->queues[cl-1]->handle;
+        return 0;
+}
+
+static int multiq_dump_class_stats(struct Qdisc *sch, unsigned long cl,
+                                 struct gnet_dump *d)
+{
+        struct multiq_sched_data *q = qdisc_priv(sch);
+        struct Qdisc *cl_q;
+
+        cl_q = q->queues[cl - 1];
+        if (gnet_stats_copy_basic(d, &cl_q->bstats) < 0 ||
+            gnet_stats_copy_queue(d, &cl_q->qstats) < 0)
+                return -1;
+
+        return 0;
+}
+
+static void multiq_walk(struct Qdisc *sch, struct qdisc_walker *arg)
+{
+        struct multiq_sched_data *q = qdisc_priv(sch);
+        int band;
+
+        if (arg->stop)
+                return;
+
+        for (band = 0; band < q->bands; band++) {
+                if (arg->count < arg->skip) {
+                        arg->count++;
+                        continue;
+                }
+                if (arg->fn(sch, band+1, arg) < 0) {
+                        arg->stop = 1;
+                        break;
+                }
+                arg->count++;
+        }
+}
+
+static struct tcf_proto **multiq_find_tcf(struct Qdisc *sch, unsigned long cl)
+{
+        struct multiq_sched_data *q = qdisc_priv(sch);
+
+        if (cl)
+                return NULL;
+        return &q->filter_list;
+}
+
+static const struct Qdisc_class_ops multiq_class_ops = {
+        .graft          =       multiq_graft,
+        .leaf           =       multiq_leaf,
+        .get            =       multiq_get,
+        .put            =       multiq_put,
+        .change         =       multiq_change,
+        .delete         =       multiq_delete,
+        .walk           =       multiq_walk,
+        .tcf_chain      =       multiq_find_tcf,
+        .bind_tcf       =       multiq_bind,
+        .unbind_tcf     =       multiq_put,
+        .dump           =       multiq_dump_class,
+        .dump_stats     =       multiq_dump_class_stats,
+};
+
+static struct Qdisc_ops multiq_qdisc_ops __read_mostly = {
+        .next           =       NULL,
+        .cl_ops         =       &multiq_class_ops,
+        .id             =       "multiq",
+        .priv_size      =       sizeof(struct multiq_sched_data),
+        .enqueue        =       multiq_enqueue,
+        .dequeue        =       multiq_dequeue,
+        .requeue        =       multiq_requeue,
+        .drop           =       multiq_drop,
+        .init           =       multiq_init,
+        .reset          =       multiq_reset,
+        .destroy        =       multiq_destroy,
+        .change         =       multiq_tune,
+        .dump           =       multiq_dump,
+        .owner          =       THIS_MODULE,
+};
+
+static int __init multiq_module_init(void)
+{
+        return register_qdisc(&multiq_qdisc_ops);
+}
+
+static void __exit multiq_module_exit(void)
+{
+        unregister_qdisc(&multiq_qdisc_ops);
+}
+
+module_init(multiq_module_init)
+module_exit(multiq_module_exit)
+
+MODULE_LICENSE("GPL");
diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index 3781e55046d0..a11959908d9a 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -388,6 +388,20 @@ static const struct nla_policy netem_policy[TCA_NETEM_MAX + 1] = {
         [TCA_NETEM_CORRUPT]     = { .len = sizeof(struct tc_netem_corrupt) },
 };
 
+static int parse_attr(struct nlattr *tb[], int maxtype, struct nlattr *nla,
+                      const struct nla_policy *policy, int len)
+{
+        int nested_len = nla_len(nla) - NLA_ALIGN(len);
+
+        if (nested_len < 0)
+                return -EINVAL;
+        if (nested_len >= nla_attr_size(0))
+                return nla_parse(tb, maxtype, nla_data(nla) + NLA_ALIGN(len),
+                                 nested_len, policy);
+        memset(tb, 0, sizeof(struct nlattr *) * (maxtype + 1));
+        return 0;
+}
+
 /* Parse netlink message to set options */
 static int netem_change(struct Qdisc *sch, struct nlattr *opt)
 {
@@ -399,8 +413,8 @@ static int netem_change(struct Qdisc *sch, struct nlattr *opt)
         if (opt == NULL)
                 return -EINVAL;
 
-        ret = nla_parse_nested_compat(tb, TCA_NETEM_MAX, opt, netem_policy,
-                                      qopt, sizeof(*qopt));
+        qopt = nla_data(opt);
+        ret = parse_attr(tb, TCA_NETEM_MAX, opt, netem_policy, sizeof(*qopt));
         if (ret < 0)
                 return ret;
 
diff --git a/net/sched/sch_prio.c b/net/sched/sch_prio.c
index a6697c686c7f..504a78cdb718 100644
--- a/net/sched/sch_prio.c
+++ b/net/sched/sch_prio.c
@@ -254,16 +254,12 @@ static int prio_dump(struct Qdisc *sch, struct sk_buff *skb)
 {
         struct prio_sched_data *q = qdisc_priv(sch);
         unsigned char *b = skb_tail_pointer(skb);
-        struct nlattr *nest;
         struct tc_prio_qopt opt;
 
         opt.bands = q->bands;
         memcpy(&opt.priomap, q->prio2band, TC_PRIO_MAX+1);
 
-        nest = nla_nest_compat_start(skb, TCA_OPTIONS, sizeof(opt), &opt);
-        if (nest == NULL)
-                goto nla_put_failure;
-        nla_nest_compat_end(skb, nest);
+        NLA_PUT(skb, TCA_OPTIONS, sizeof(opt), &opt);
 
         return skb->len;
 
diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c
index 6e041d10dbdb..fe1508ef0d3d 100644
--- a/net/sched/sch_sfq.c
+++ b/net/sched/sch_sfq.c
@@ -119,7 +119,7 @@ static unsigned sfq_hash(struct sfq_sched_data *q, struct sk_buff *skb)
         u32 h, h2;
 
         switch (skb->protocol) {
-        case __constant_htons(ETH_P_IP):
+        case htons(ETH_P_IP):
         {
                 const struct iphdr *iph = ip_hdr(skb);
                 h = iph->daddr;
@@ -134,7 +134,7 @@ static unsigned sfq_hash(struct sfq_sched_data *q, struct sk_buff *skb)
                         h2 ^= *(((u32*)iph) + iph->ihl);
                 break;
         }
-        case __constant_htons(ETH_P_IPV6):
+        case htons(ETH_P_IPV6):
         {
                 struct ipv6hdr *iph = ipv6_hdr(skb);
                 h = iph->daddr.s6_addr32[3];
diff --git a/net/sctp/ulpqueue.c b/net/sctp/ulpqueue.c
index 5061a26c5028..7b23803343cc 100644
--- a/net/sctp/ulpqueue.c
+++ b/net/sctp/ulpqueue.c
@@ -317,7 +317,7 @@ static void sctp_ulpq_store_reasm(struct sctp_ulpq *ulpq,
         }
 
         /* Insert before pos. */
-        __skb_insert(sctp_event2skb(event), pos->prev, pos, &ulpq->reasm);
+        __skb_queue_before(&ulpq->reasm, pos, sctp_event2skb(event));
 
 }
 
@@ -825,8 +825,7 @@ static void sctp_ulpq_store_ordered(struct sctp_ulpq *ulpq,
 
 
         /* Insert before pos. */
-        __skb_insert(sctp_event2skb(event), pos->prev, pos, &ulpq->lobby);
-
+        __skb_queue_before(&ulpq->lobby, pos, sctp_event2skb(event));
 }
 
 static struct sctp_ulpevent *sctp_ulpq_order(struct sctp_ulpq *ulpq,
diff --git a/net/sunrpc/xprtrdma/rpc_rdma.c b/net/sunrpc/xprtrdma/rpc_rdma.c
index e55427f73dfe..5c1954d28d09 100644
--- a/net/sunrpc/xprtrdma/rpc_rdma.c
+++ b/net/sunrpc/xprtrdma/rpc_rdma.c
@@ -769,7 +769,7 @@ repost:
         /* check for expected message types */
         /* The order of some of these tests is important. */
         switch (headerp->rm_type) {
-        case __constant_htonl(RDMA_MSG):
+        case htonl(RDMA_MSG):
                 /* never expect read chunks */
                 /* never expect reply chunks (two ways to check) */
                 /* never expect write chunks without having offered RDMA */
@@ -802,7 +802,7 @@ repost:
                 rpcrdma_inline_fixup(rqst, (char *)iptr, rep->rr_len);
                 break;
 
-        case __constant_htonl(RDMA_NOMSG):
+        case htonl(RDMA_NOMSG):
                 /* never expect read or write chunks, always reply chunks */
                 if (headerp->rm_body.rm_chunks[0] != xdr_zero ||
                     headerp->rm_body.rm_chunks[1] != xdr_zero ||
diff --git a/net/wireless/Kconfig b/net/wireless/Kconfig
index 833b024f8f66..b97bd9fe6b79 100644
--- a/net/wireless/Kconfig
+++ b/net/wireless/Kconfig
@@ -14,6 +14,38 @@ config NL80211
 
           If unsure, say Y.
 
+config WIRELESS_OLD_REGULATORY
+        bool "Old wireless static regulatory defintions"
+        default n
+        ---help---
+          This option enables the old static regulatory information
+          and uses it within the new framework. This is available
+          temporarily as an option to help prevent immediate issues
+          due to the switch to the new regulatory framework which
+          does require a new userspace application which has the
+          database of regulatory information (CRDA) and another for
+          setting regulatory domains (iw).
+
+          For more information see:
+
+          http://wireless.kernel.org/en/developers/Regulatory/CRDA
+          http://wireless.kernel.org/en/users/Documentation/iw
+
+          It is important to note though that if you *do* have CRDA present
+          and if this option is enabled CRDA *will* be called to update the
+          regulatory domain (for US and JP only). Support for letting the user
+          set the regulatory domain through iw is also supported. This option
+          mainly exists to leave around for a kernel release some old static
+          regulatory domains that were defined and to keep around the old
+          ieee80211_regdom module parameter. This is being phased out and you
+          should stop using them ASAP.
+
+          Say N unless you cannot install a new userspace application
+          or have one currently depending on the ieee80211_regdom module
+          parameter and cannot port it to use the new userspace interfaces.
+
+          This is scheduled for removal for 2.6.29.
+
 config WIRELESS_EXT
         bool "Wireless extensions"
         default n
diff --git a/net/wireless/core.c b/net/wireless/core.c
index f1da0b93bc56..5cadbeb76a14 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -1,7 +1,7 @@
 /*
  * This is the linux wireless configuration interface.
  *
- * Copyright 2006, 2007         Johannes Berg <johannes@sipsolutions.net>
+ * Copyright 2006-2008          Johannes Berg <johannes@sipsolutions.net>
  */
 
 #include <linux/if.h>
@@ -13,12 +13,14 @@
 #include <linux/debugfs.h>
 #include <linux/notifier.h>
 #include <linux/device.h>
+#include <linux/list.h>
 #include <net/genetlink.h>
 #include <net/cfg80211.h>
 #include <net/wireless.h>
 #include "nl80211.h"
 #include "core.h"
 #include "sysfs.h"
+#include "reg.h"
 
 /* name for sysfs, %d is appended */
 #define PHY_NAME "phy"
@@ -32,7 +34,6 @@ MODULE_DESCRIPTION("wireless configuration support");
  * often because we need to do it for each command */
 LIST_HEAD(cfg80211_drv_list);
 DEFINE_MUTEX(cfg80211_drv_mutex);
-static int wiphy_counter;
 
 /* for debugfs */
 static struct dentry *ieee80211_debugfs_dir;
@@ -204,6 +205,8 @@ out_unlock:
 
 struct wiphy *wiphy_new(struct cfg80211_ops *ops, int sizeof_priv)
 {
+        static int wiphy_counter;
+
         struct cfg80211_registered_device *drv;
         int alloc_size;
 
@@ -220,21 +223,18 @@ struct wiphy *wiphy_new(struct cfg80211_ops *ops, int sizeof_priv)
 
         mutex_lock(&cfg80211_drv_mutex);
 
-        drv->idx = wiphy_counter;
-
-        /* now increase counter for the next device unless
-         * it has wrapped previously */
-        if (wiphy_counter >= 0)
-                wiphy_counter++;
-
-        mutex_unlock(&cfg80211_drv_mutex);
+        drv->idx = wiphy_counter++;
 
         if (unlikely(drv->idx < 0)) {
+                wiphy_counter--;
+                mutex_unlock(&cfg80211_drv_mutex);
                 /* ugh, wrapped! */
                 kfree(drv);
                 return NULL;
         }
 
+        mutex_unlock(&cfg80211_drv_mutex);
+
         /* give it a proper name */
         snprintf(drv->wiphy.dev.bus_id, BUS_ID_SIZE,
                  PHY_NAME "%d", drv->idx);
@@ -259,6 +259,13 @@ int wiphy_register(struct wiphy *wiphy)
         struct ieee80211_supported_band *sband;
         bool have_band = false;
         int i;
+        u16 ifmodes = wiphy->interface_modes;
+
+        /* sanity check ifmodes */
+        WARN_ON(!ifmodes);
+        ifmodes &= ((1 << __NL80211_IFTYPE_AFTER_LAST) - 1) & ~1;
+        if (WARN_ON(ifmodes != wiphy->interface_modes))
+                wiphy->interface_modes = ifmodes;
 
         /* sanity check supported bands/channels */
         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
@@ -295,7 +302,9 @@ int wiphy_register(struct wiphy *wiphy)
         ieee80211_set_bitrate_flags(wiphy);
 
         /* set up regulatory info */
-        wiphy_update_regulatory(wiphy);
+        mutex_lock(&cfg80211_reg_mutex);
+        wiphy_update_regulatory(wiphy, REGDOM_SET_BY_CORE);
+        mutex_unlock(&cfg80211_reg_mutex);
 
         mutex_lock(&cfg80211_drv_mutex);
 
@@ -373,6 +382,8 @@ static int cfg80211_netdev_notifier_call(struct notifier_block * nb,
 
         rdev = wiphy_to_dev(dev->ieee80211_ptr->wiphy);
 
+        WARN_ON(dev->ieee80211_ptr->iftype == NL80211_IFTYPE_UNSPECIFIED);
+
         switch (state) {
         case NETDEV_REGISTER:
                 mutex_lock(&rdev->devlist_mtx);
@@ -404,7 +415,9 @@ static struct notifier_block cfg80211_netdev_notifier = {
 
 static int cfg80211_init(void)
 {
-        int err = wiphy_sysfs_init();
+        int err;
+
+        err = wiphy_sysfs_init();
         if (err)
                 goto out_fail_sysfs;
 
@@ -418,8 +431,14 @@ static int cfg80211_init(void)
 
         ieee80211_debugfs_dir = debugfs_create_dir("ieee80211", NULL);
 
+        err = regulatory_init();
+        if (err)
+                goto out_fail_reg;
+
         return 0;
 
+out_fail_reg:
+        debugfs_remove(ieee80211_debugfs_dir);
 out_fail_nl80211:
         unregister_netdevice_notifier(&cfg80211_netdev_notifier);
 out_fail_notifier:
@@ -427,6 +446,7 @@ out_fail_notifier:
 out_fail_sysfs:
         return err;
 }
+
 subsys_initcall(cfg80211_init);
 
 static void cfg80211_exit(void)
@@ -435,5 +455,6 @@ static void cfg80211_exit(void)
         nl80211_exit();
         unregister_netdevice_notifier(&cfg80211_netdev_notifier);
         wiphy_sysfs_exit();
+        regulatory_exit();
 }
 module_exit(cfg80211_exit);
diff --git a/net/wireless/core.h b/net/wireless/core.h
index 7a02c356d63d..771cc5cc7658 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -79,6 +79,6 @@ extern int cfg80211_dev_rename(struct cfg80211_registered_device *drv,
                                char *newname);
 
 void ieee80211_set_bitrate_flags(struct wiphy *wiphy);
-void wiphy_update_regulatory(struct wiphy *wiphy);
+void wiphy_update_regulatory(struct wiphy *wiphy, enum reg_set_by setby);
 
 #endif /* __NET_WIRELESS_CORE_H */
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 59eb2cf42e5f..572793c8c7ab 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -18,6 +18,7 @@
 #include <net/cfg80211.h>
 #include "core.h"
 #include "nl80211.h"
+#include "reg.h"
 
 /* the netlink family */
 static struct genl_family nl80211_fam = {
@@ -87,6 +88,16 @@ static struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] __read_mostly = {
         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
                                 .len = IEEE80211_MAX_MESH_ID_LEN },
         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
+
+        [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
+        [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
+
+        [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
+        [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
+        [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
+
+        [NL80211_ATTR_HT_CAPABILITY] = { .type = NLA_BINARY,
+                                         .len = NL80211_HT_CAPABILITY_LEN },
 };
 
 /* message building helper */
@@ -106,10 +117,12 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
         struct nlattr *nl_bands, *nl_band;
         struct nlattr *nl_freqs, *nl_freq;
         struct nlattr *nl_rates, *nl_rate;
+        struct nlattr *nl_modes;
         enum ieee80211_band band;
         struct ieee80211_channel *chan;
         struct ieee80211_rate *rate;
         int i;
+        u16 ifmodes = dev->wiphy.interface_modes;
 
         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_WIPHY);
         if (!hdr)
@@ -118,6 +131,20 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, dev->idx);
         NLA_PUT_STRING(msg, NL80211_ATTR_WIPHY_NAME, wiphy_name(&dev->wiphy));
 
+        nl_modes = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_IFTYPES);
+        if (!nl_modes)
+                goto nla_put_failure;
+
+        i = 0;
+        while (ifmodes) {
+                if (ifmodes & 1)
+                        NLA_PUT_FLAG(msg, i);
+                ifmodes >>= 1;
+                i++;
+        }
+
+        nla_nest_end(msg, nl_modes);
+
         nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
         if (!nl_bands)
                 goto nla_put_failure;
@@ -272,7 +299,7 @@ static int nl80211_send_iface(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 
         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
         NLA_PUT_STRING(msg, NL80211_ATTR_IFNAME, dev->name);
-        /* TODO: interface type */
+        NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, dev->ieee80211_ptr->iftype);
         return genlmsg_end(msg, hdr);
 
  nla_put_failure:
@@ -391,40 +418,56 @@ static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
         int err, ifindex;
         enum nl80211_iftype type;
         struct net_device *dev;
-        u32 flags;
+        u32 _flags, *flags = NULL;
 
         memset(&params, 0, sizeof(params));
 
-        if (info->attrs[NL80211_ATTR_IFTYPE]) {
-                type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
-                if (type > NL80211_IFTYPE_MAX)
-                        return -EINVAL;
-        } else
-                return -EINVAL;
-
         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
         if (err)
                 return err;
         ifindex = dev->ifindex;
+        type = dev->ieee80211_ptr->iftype;
         dev_put(dev);
 
-        if (!drv->ops->change_virtual_intf) {
+        err = -EINVAL;
+        if (info->attrs[NL80211_ATTR_IFTYPE]) {
+                type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
+                if (type > NL80211_IFTYPE_MAX)
+                        goto unlock;
+        }
+
+        if (!drv->ops->change_virtual_intf ||
+            !(drv->wiphy.interface_modes & (1 << type))) {
                 err = -EOPNOTSUPP;
                 goto unlock;
         }
 
-        if (type == NL80211_IFTYPE_MESH_POINT &&
-            info->attrs[NL80211_ATTR_MESH_ID]) {
+        if (info->attrs[NL80211_ATTR_MESH_ID]) {
+                if (type != NL80211_IFTYPE_MESH_POINT) {
+                        err = -EINVAL;
+                        goto unlock;
+                }
                 params.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
                 params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
         }
 
+        if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
+                if (type != NL80211_IFTYPE_MONITOR) {
+                        err = -EINVAL;
+                        goto unlock;
+                }
+                err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
+                                          &_flags);
+                if (!err)
+                        flags = &_flags;
+        }
         rtnl_lock();
-        err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
-                                  info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
-                                  &flags);
         err = drv->ops->change_virtual_intf(&drv->wiphy, ifindex,
-                                            type, err ? NULL : &flags, &params);
+                                            type, flags, &params);
+
+        dev = __dev_get_by_index(&init_net, ifindex);
+        WARN_ON(!dev || (!err && dev->ieee80211_ptr->iftype != type));
+
         rtnl_unlock();
 
  unlock:
@@ -455,7 +498,8 @@ static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
         if (IS_ERR(drv))
                 return PTR_ERR(drv);
 
-        if (!drv->ops->add_virtual_intf) {
+        if (!drv->ops->add_virtual_intf ||
+            !(drv->wiphy.interface_modes & (1 << type))) {
                 err = -EOPNOTSUPP;
                 goto unlock;
         }
@@ -1125,6 +1169,10 @@ static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
                 params.listen_interval =
                     nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
 
+        if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
+                params.ht_capa =
+                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
+
         if (parse_station_flags(info->attrs[NL80211_ATTR_STA_FLAGS],
                                 &params.station_flags))
                 return -EINVAL;
@@ -1188,6 +1236,9 @@ static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
         params.listen_interval =
                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
         params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
+        if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
+                params.ht_capa =
+                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
 
         if (parse_station_flags(info->attrs[NL80211_ATTR_STA_FLAGS],
                                 &params.station_flags))
@@ -1525,6 +1576,183 @@ static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
         return err;
 }
 
+static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
+{
+        struct cfg80211_registered_device *drv;
+        int err;
+        struct net_device *dev;
+        struct bss_parameters params;
+
+        memset(&params, 0, sizeof(params));
+        /* default to not changing parameters */
+        params.use_cts_prot = -1;
+        params.use_short_preamble = -1;
+        params.use_short_slot_time = -1;
+
+        if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
+                params.use_cts_prot =
+                    nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
+        if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
+                params.use_short_preamble =
+                    nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
+        if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
+                params.use_short_slot_time =
+                    nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
+
+        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
+        if (err)
+                return err;
+
+        if (!drv->ops->change_bss) {
+                err = -EOPNOTSUPP;
+                goto out;
+        }
+
+        rtnl_lock();
+        err = drv->ops->change_bss(&drv->wiphy, dev, &params);
+        rtnl_unlock();
+
+ out:
+        cfg80211_put_dev(drv);
+        dev_put(dev);
+        return err;
+}
+
+static const struct nla_policy
+        reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
+        [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
+        [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
+        [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
+        [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
+        [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
+        [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
+};
+
+static int parse_reg_rule(struct nlattr *tb[],
+        struct ieee80211_reg_rule *reg_rule)
+{
+        struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
+        struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
+
+        if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
+                return -EINVAL;
+        if (!tb[NL80211_ATTR_FREQ_RANGE_START])
+                return -EINVAL;
+        if (!tb[NL80211_ATTR_FREQ_RANGE_END])
+                return -EINVAL;
+        if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
+                return -EINVAL;
+        if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
+                return -EINVAL;
+
+        reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
+
+        freq_range->start_freq_khz =
+                nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
+        freq_range->end_freq_khz =
+                nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
+        freq_range->max_bandwidth_khz =
+                nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
+
+        power_rule->max_eirp =
+                nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
+
+        if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
+                power_rule->max_antenna_gain =
+                        nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
+
+        return 0;
+}
+
+static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
+{
+        int r;
+        char *data = NULL;
+
+        if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
+                return -EINVAL;
+
+        data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
+
+#ifdef CONFIG_WIRELESS_OLD_REGULATORY
+        /* We ignore world regdom requests with the old regdom setup */
+        if (is_world_regdom(data))
+                return -EINVAL;
+#endif
+        mutex_lock(&cfg80211_drv_mutex);
+        r = __regulatory_hint(NULL, REGDOM_SET_BY_USER, data, NULL);
+        mutex_unlock(&cfg80211_drv_mutex);
+        return r;
+}
+
+static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
+{
+        struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
+        struct nlattr *nl_reg_rule;
+        char *alpha2 = NULL;
+        int rem_reg_rules = 0, r = 0;
+        u32 num_rules = 0, rule_idx = 0, size_of_regd;
+        struct ieee80211_regdomain *rd = NULL;
+
+        if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
+                return -EINVAL;
+
+        if (!info->attrs[NL80211_ATTR_REG_RULES])
+                return -EINVAL;
+
+        alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
+
+        nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
+                        rem_reg_rules) {
+                num_rules++;
+                if (num_rules > NL80211_MAX_SUPP_REG_RULES)
+                        goto bad_reg;
+        }
+
+        if (!reg_is_valid_request(alpha2))
+                return -EINVAL;
+
+        size_of_regd = sizeof(struct ieee80211_regdomain) +
+                (num_rules * sizeof(struct ieee80211_reg_rule));
+
+        rd = kzalloc(size_of_regd, GFP_KERNEL);
+        if (!rd)
+                return -ENOMEM;
+
+        rd->n_reg_rules = num_rules;
+        rd->alpha2[0] = alpha2[0];
+        rd->alpha2[1] = alpha2[1];
+
+        nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
+                        rem_reg_rules) {
+                nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
+                        nla_data(nl_reg_rule), nla_len(nl_reg_rule),
+                        reg_rule_policy);
+                r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
+                if (r)
+                        goto bad_reg;
+
+                rule_idx++;
+
+                if (rule_idx > NL80211_MAX_SUPP_REG_RULES)
+                        goto bad_reg;
+        }
+
+        BUG_ON(rule_idx != num_rules);
+
+        mutex_lock(&cfg80211_drv_mutex);
+        r = set_regdom(rd);
+        mutex_unlock(&cfg80211_drv_mutex);
+        if (r)
+                goto bad_reg;
+
+        return r;
+
+bad_reg:
+        kfree(rd);
+        return -EINVAL;
+}
+
 static struct genl_ops nl80211_ops[] = {
         {
                 .cmd = NL80211_CMD_GET_WIPHY,
@@ -1656,6 +1884,24 @@ static struct genl_ops nl80211_ops[] = {
                 .policy = nl80211_policy,
                 .flags = GENL_ADMIN_PERM,
         },
+        {
+                .cmd = NL80211_CMD_SET_BSS,
+                .doit = nl80211_set_bss,
+                .policy = nl80211_policy,
+                .flags = GENL_ADMIN_PERM,
+        },
+        {
+                .cmd = NL80211_CMD_SET_REG,
+                .doit = nl80211_set_reg,
+                .policy = nl80211_policy,
+                .flags = GENL_ADMIN_PERM,
+        },
+        {
+                .cmd = NL80211_CMD_REQ_SET_REG,
+                .doit = nl80211_req_set_reg,
+                .policy = nl80211_policy,
+                .flags = GENL_ADMIN_PERM,
+        },
 };
 
 /* multicast groups */
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 855bff4b3250..626dbb688499 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -2,179 +2,871 @@
  * Copyright 2002-2005, Instant802 Networks, Inc.
  * Copyright 2005-2006, Devicescape Software, Inc.
  * Copyright 2007       Johannes Berg <johannes@sipsolutions.net>
+ * Copyright 2008       Luis R. Rodriguez <lrodriguz@atheros.com>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  */
 
-/*
- * This regulatory domain control implementation is highly incomplete, it
- * only exists for the purpose of not regressing mac80211.
- *
- * For now, drivers can restrict the set of allowed channels by either
- * not registering those channels or setting the IEEE80211_CHAN_DISABLED
- * flag; that flag will only be *set* by this code, never *cleared.
+/**
+ * DOC: Wireless regulatory infrastructure
  *
  * The usual implementation is for a driver to read a device EEPROM to
  * determine which regulatory domain it should be operating under, then
  * looking up the allowable channels in a driver-local table and finally
  * registering those channels in the wiphy structure.
  *
- * Alternatively, drivers that trust the regulatory domain control here
- * will register a complete set of capabilities and the control code
- * will restrict the set by setting the IEEE80211_CHAN_* flags.
+ * Another set of compliance enforcement is for drivers to use their
+ * own compliance limits which can be stored on the EEPROM. The host
+ * driver or firmware may ensure these are used.
+ *
+ * In addition to all this we provide an extra layer of regulatory
+ * conformance. For drivers which do not have any regulatory
+ * information CRDA provides the complete regulatory solution.
+ * For others it provides a community effort on further restrictions
+ * to enhance compliance.
+ *
+ * Note: When number of rules --> infinity we will not be able to
+ * index on alpha2 any more, instead we'll probably have to
+ * rely on some SHA1 checksum of the regdomain for example.
+ *
  */
 #include <linux/kernel.h>
+#include <linux/list.h>
+#include <linux/random.h>
+#include <linux/nl80211.h>
+#include <linux/platform_device.h>
 #include <net/wireless.h>
+#include <net/cfg80211.h>
 #include "core.h"
+#include "reg.h"
 
-static char *ieee80211_regdom = "US";
-module_param(ieee80211_regdom, charp, 0444);
-MODULE_PARM_DESC(ieee80211_regdom, "IEEE 802.11 regulatory domain code");
-
-struct ieee80211_channel_range {
-        short start_freq;
-        short end_freq;
-        int max_power;
-        int max_antenna_gain;
-        u32 flags;
+/* wiphy is set if this request's initiator is REGDOM_SET_BY_DRIVER */
+struct regulatory_request {
+        struct list_head list;
+        struct wiphy *wiphy;
+        int granted;
+        enum reg_set_by initiator;
+        char alpha2[2];
 };
 
-struct ieee80211_regdomain {
-        const char *code;
-        const struct ieee80211_channel_range *ranges;
-        int n_ranges;
+static LIST_HEAD(regulatory_requests);
+DEFINE_MUTEX(cfg80211_reg_mutex);
+
+/* To trigger userspace events */
+static struct platform_device *reg_pdev;
+
+/* Keep the ordering from large to small */
+static u32 supported_bandwidths[] = {
+        MHZ_TO_KHZ(40),
+        MHZ_TO_KHZ(20),
 };
 
-#define RANGE_PWR(_start, _end, _pwr, _ag, _flags)      \
-        { _start, _end, _pwr, _ag, _flags }
+static struct list_head regulatory_requests;
 
+/* Central wireless core regulatory domains, we only need two,
+ * the current one and a world regulatory domain in case we have no
+ * information to give us an alpha2 */
+static const struct ieee80211_regdomain *cfg80211_regdomain;
 
-/*
- * Ideally, in the future, these definitions will be loaded from a
- * userspace table via some daemon.
- */
-static const struct ieee80211_channel_range ieee80211_US_channels[] = {
-        /* IEEE 802.11b/g, channels 1..11 */
-        RANGE_PWR(2412, 2462, 27, 6, 0),
-        /* IEEE 802.11a, channel 36*/
-        RANGE_PWR(5180, 5180, 23, 6, 0),
-        /* IEEE 802.11a, channel 40*/
-        RANGE_PWR(5200, 5200, 23, 6, 0),
-        /* IEEE 802.11a, channel 44*/
-        RANGE_PWR(5220, 5220, 23, 6, 0),
-        /* IEEE 802.11a, channels 48..64 */
-        RANGE_PWR(5240, 5320, 23, 6, 0),
-        /* IEEE 802.11a, channels 149..165, outdoor */
-        RANGE_PWR(5745, 5825, 30, 6, 0),
+/* We keep a static world regulatory domain in case of the absence of CRDA */
+static const struct ieee80211_regdomain world_regdom = {
+        .n_reg_rules = 1,
+        .alpha2 =  "00",
+        .reg_rules = {
+                REG_RULE(2412-10, 2462+10, 40, 6, 20,
+                        NL80211_RRF_PASSIVE_SCAN |
+                        NL80211_RRF_NO_IBSS),
+        }
 };
 
-static const struct ieee80211_channel_range ieee80211_JP_channels[] = {
-        /* IEEE 802.11b/g, channels 1..14 */
-        RANGE_PWR(2412, 2484, 20, 6, 0),
-        /* IEEE 802.11a, channels 34..48 */
-        RANGE_PWR(5170, 5240, 20, 6, IEEE80211_CHAN_PASSIVE_SCAN),
-        /* IEEE 802.11a, channels 52..64 */
-        RANGE_PWR(5260, 5320, 20, 6, IEEE80211_CHAN_NO_IBSS |
-                                     IEEE80211_CHAN_RADAR),
-};
+static const struct ieee80211_regdomain *cfg80211_world_regdom =
+        &world_regdom;
+
+#ifdef CONFIG_WIRELESS_OLD_REGULATORY
+static char *ieee80211_regdom = "US";
+module_param(ieee80211_regdom, charp, 0444);
+MODULE_PARM_DESC(ieee80211_regdom, "IEEE 802.11 regulatory domain code");
+
+/* We assume 40 MHz bandwidth for the old regulatory work.
+ * We make emphasis we are using the exact same frequencies
+ * as before */
 
-static const struct ieee80211_channel_range ieee80211_EU_channels[] = {
-        /* IEEE 802.11b/g, channels 1..13 */
-        RANGE_PWR(2412, 2472, 20, 6, 0),
-        /* IEEE 802.11a, channel 36*/
-        RANGE_PWR(5180, 5180, 23, 6, IEEE80211_CHAN_PASSIVE_SCAN),
-        /* IEEE 802.11a, channel 40*/
-        RANGE_PWR(5200, 5200, 23, 6, IEEE80211_CHAN_PASSIVE_SCAN),
-        /* IEEE 802.11a, channel 44*/
-        RANGE_PWR(5220, 5220, 23, 6, IEEE80211_CHAN_PASSIVE_SCAN),
-        /* IEEE 802.11a, channels 48..64 */
-        RANGE_PWR(5240, 5320, 23, 6, IEEE80211_CHAN_NO_IBSS |
-                                     IEEE80211_CHAN_RADAR),
-        /* IEEE 802.11a, channels 100..140 */
-        RANGE_PWR(5500, 5700, 30, 6, IEEE80211_CHAN_NO_IBSS |
-                                     IEEE80211_CHAN_RADAR),
+static const struct ieee80211_regdomain us_regdom = {
+        .n_reg_rules = 6,
+        .alpha2 =  "US",
+        .reg_rules = {
+                /* IEEE 802.11b/g, channels 1..11 */
+                REG_RULE(2412-10, 2462+10, 40, 6, 27, 0),
+                /* IEEE 802.11a, channel 36 */
+                REG_RULE(5180-10, 5180+10, 40, 6, 23, 0),
+                /* IEEE 802.11a, channel 40 */
+                REG_RULE(5200-10, 5200+10, 40, 6, 23, 0),
+                /* IEEE 802.11a, channel 44 */
+                REG_RULE(5220-10, 5220+10, 40, 6, 23, 0),
+                /* IEEE 802.11a, channels 48..64 */
+                REG_RULE(5240-10, 5320+10, 40, 6, 23, 0),
+                /* IEEE 802.11a, channels 149..165, outdoor */
+                REG_RULE(5745-10, 5825+10, 40, 6, 30, 0),
+        }
 };
 
-#define REGDOM(_code)                                                   \
-        {                                                               \
-                .code = __stringify(_code),                             \
-                .ranges = ieee80211_ ##_code## _channels,               \
-                .n_ranges = ARRAY_SIZE(ieee80211_ ##_code## _channels), \
+static const struct ieee80211_regdomain jp_regdom = {
+        .n_reg_rules = 3,
+        .alpha2 =  "JP",
+        .reg_rules = {
+                /* IEEE 802.11b/g, channels 1..14 */
+                REG_RULE(2412-10, 2484+10, 40, 6, 20, 0),
+                /* IEEE 802.11a, channels 34..48 */
+                REG_RULE(5170-10, 5240+10, 40, 6, 20,
+                        NL80211_RRF_PASSIVE_SCAN),
+                /* IEEE 802.11a, channels 52..64 */
+                REG_RULE(5260-10, 5320+10, 40, 6, 20,
+                        NL80211_RRF_NO_IBSS |
+                        NL80211_RRF_DFS),
         }
+};
 
-static const struct ieee80211_regdomain ieee80211_regdoms[] = {
-        REGDOM(US),
-        REGDOM(JP),
-        REGDOM(EU),
+static const struct ieee80211_regdomain eu_regdom = {
+        .n_reg_rules = 6,
+        /* This alpha2 is bogus, we leave it here just for stupid
+         * backward compatibility */
+        .alpha2 =  "EU",
+        .reg_rules = {
+                /* IEEE 802.11b/g, channels 1..13 */
+                REG_RULE(2412-10, 2472+10, 40, 6, 20, 0),
+                /* IEEE 802.11a, channel 36 */
+                REG_RULE(5180-10, 5180+10, 40, 6, 23,
+                        NL80211_RRF_PASSIVE_SCAN),
+                /* IEEE 802.11a, channel 40 */
+                REG_RULE(5200-10, 5200+10, 40, 6, 23,
+                        NL80211_RRF_PASSIVE_SCAN),
+                /* IEEE 802.11a, channel 44 */
+                REG_RULE(5220-10, 5220+10, 40, 6, 23,
+                        NL80211_RRF_PASSIVE_SCAN),
+                /* IEEE 802.11a, channels 48..64 */
+                REG_RULE(5240-10, 5320+10, 40, 6, 20,
+                        NL80211_RRF_NO_IBSS |
+                        NL80211_RRF_DFS),
+                /* IEEE 802.11a, channels 100..140 */
+                REG_RULE(5500-10, 5700+10, 40, 6, 30,
+                        NL80211_RRF_NO_IBSS |
+                        NL80211_RRF_DFS),
+        }
 };
 
+static const struct ieee80211_regdomain *static_regdom(char *alpha2)
+{
+        if (alpha2[0] == 'U' && alpha2[1] == 'S')
+                return &us_regdom;
+        if (alpha2[0] == 'J' && alpha2[1] == 'P')
+                return &jp_regdom;
+        if (alpha2[0] == 'E' && alpha2[1] == 'U')
+                return &eu_regdom;
+        /* Default, as per the old rules */
+        return &us_regdom;
+}
+
+static bool is_old_static_regdom(const struct ieee80211_regdomain *rd)
+{
+        if (rd == &us_regdom || rd == &jp_regdom || rd == &eu_regdom)
+                return true;
+        return false;
+}
+#else
+static inline bool is_old_static_regdom(const struct ieee80211_regdomain *rd)
+{
+        return false;
+}
+#endif
 
-static const struct ieee80211_regdomain *get_regdom(void)
+static void reset_regdomains(void)
 {
-        static const struct ieee80211_channel_range
-        ieee80211_world_channels[] = {
-                /* IEEE 802.11b/g, channels 1..11 */
-                RANGE_PWR(2412, 2462, 27, 6, 0),
+        /* avoid freeing static information or freeing something twice */
+        if (cfg80211_regdomain == cfg80211_world_regdom)
+                cfg80211_regdomain = NULL;
+        if (cfg80211_world_regdom == &world_regdom)
+                cfg80211_world_regdom = NULL;
+        if (cfg80211_regdomain == &world_regdom)
+                cfg80211_regdomain = NULL;
+        if (is_old_static_regdom(cfg80211_regdomain))
+                cfg80211_regdomain = NULL;
+
+        kfree(cfg80211_regdomain);
+        kfree(cfg80211_world_regdom);
+
+        cfg80211_world_regdom = &world_regdom;
+        cfg80211_regdomain = NULL;
+}
+
+/* Dynamic world regulatory domain requested by the wireless
+ * core upon initialization */
+static void update_world_regdomain(const struct ieee80211_regdomain *rd)
+{
+        BUG_ON(list_empty(&regulatory_requests));
+
+        reset_regdomains();
+
+        cfg80211_world_regdom = rd;
+        cfg80211_regdomain = rd;
+}
+
+bool is_world_regdom(const char *alpha2)
+{
+        if (!alpha2)
+                return false;
+        if (alpha2[0] == '0' && alpha2[1] == '0')
+                return true;
+        return false;
+}
+
+static bool is_alpha2_set(const char *alpha2)
+{
+        if (!alpha2)
+                return false;
+        if (alpha2[0] != 0 && alpha2[1] != 0)
+                return true;
+        return false;
+}
+
+static bool is_alpha_upper(char letter)
+{
+        /* ASCII A - Z */
+        if (letter >= 65 && letter <= 90)
+                return true;
+        return false;
+}
+
+static bool is_unknown_alpha2(const char *alpha2)
+{
+        if (!alpha2)
+                return false;
+        /* Special case where regulatory domain was built by driver
+         * but a specific alpha2 cannot be determined */
+        if (alpha2[0] == '9' && alpha2[1] == '9')
+                return true;
+        return false;
+}
+
+static bool is_an_alpha2(const char *alpha2)
+{
+        if (!alpha2)
+                return false;
+        if (is_alpha_upper(alpha2[0]) && is_alpha_upper(alpha2[1]))
+                return true;
+        return false;
+}
+
+static bool alpha2_equal(const char *alpha2_x, const char *alpha2_y)
+{
+        if (!alpha2_x || !alpha2_y)
+                return false;
+        if (alpha2_x[0] == alpha2_y[0] &&
+                alpha2_x[1] == alpha2_y[1])
+                return true;
+        return false;
+}
+
+static bool regdom_changed(const char *alpha2)
+{
+        if (!cfg80211_regdomain)
+                return true;
+        if (alpha2_equal(cfg80211_regdomain->alpha2, alpha2))
+                return false;
+        return true;
+}
+
+/* This lets us keep regulatory code which is updated on a regulatory
+ * basis in userspace. */
+static int call_crda(const char *alpha2)
+{
+        char country_env[9 + 2] = "COUNTRY=";
+        char *envp[] = {
+                country_env,
+                NULL
         };
-        static const struct ieee80211_regdomain regdom_world = REGDOM(world);
-        int i;
 
-        for (i = 0; i < ARRAY_SIZE(ieee80211_regdoms); i++)
-                if (strcmp(ieee80211_regdom, ieee80211_regdoms[i].code) == 0)
-                        return &ieee80211_regdoms[i];
+        if (!is_world_regdom((char *) alpha2))
+                printk(KERN_INFO "cfg80211: Calling CRDA for country: %c%c\n",
+                        alpha2[0], alpha2[1]);
+        else
+                printk(KERN_INFO "cfg80211: Calling CRDA to update world "
+                        "regulatory domain\n");
+
+        country_env[8] = alpha2[0];
+        country_env[9] = alpha2[1];
 
-        return &regdom_world;
+        return kobject_uevent_env(&reg_pdev->dev.kobj, KOBJ_CHANGE, envp);
 }
 
+/* This has the logic which determines when a new request
+ * should be ignored. */
+static int ignore_request(struct wiphy *wiphy, enum reg_set_by set_by,
+        char *alpha2, struct ieee80211_regdomain *rd)
+{
+        struct regulatory_request *last_request = NULL;
+
+        /* All initial requests are respected */
+        if (list_empty(&regulatory_requests))
+                return 0;
+
+        last_request = list_first_entry(&regulatory_requests,
+                struct regulatory_request, list);
 
-static void handle_channel(struct ieee80211_channel *chan,
-                           const struct ieee80211_regdomain *rd)
+        switch (set_by) {
+        case REGDOM_SET_BY_INIT:
+                return -EINVAL;
+        case REGDOM_SET_BY_CORE:
+                /* Always respect new wireless core hints, should only
+                 * come in for updating the world regulatory domain at init
+                 * anyway */
+                return 0;
+        case REGDOM_SET_BY_COUNTRY_IE:
+                if (last_request->initiator == set_by) {
+                        if (last_request->wiphy != wiphy) {
+                                /* Two cards with two APs claiming different
+                                 * different Country IE alpha2s!
+                                 * You're special!! */
+                                if (!alpha2_equal(last_request->alpha2,
+                                                cfg80211_regdomain->alpha2)) {
+                                        /* XXX: Deal with conflict, consider
+                                         * building a new one out of the
+                                         * intersection */
+                                        WARN_ON(1);
+                                        return -EOPNOTSUPP;
+                                }
+                                return -EALREADY;
+                        }
+                        /* Two consecutive Country IE hints on the same wiphy */
+                        if (!alpha2_equal(cfg80211_regdomain->alpha2, alpha2))
+                                return 0;
+                        return -EALREADY;
+                }
+                if (WARN_ON(!is_alpha2_set(alpha2) || !is_an_alpha2(alpha2)),
+                                "Invalid Country IE regulatory hint passed "
+                                "to the wireless core\n")
+                        return -EINVAL;
+                /* We ignore Country IE hints for now, as we haven't yet
+                 * added the dot11MultiDomainCapabilityEnabled flag
+                 * for wiphys */
+                return 1;
+        case REGDOM_SET_BY_DRIVER:
+                BUG_ON(!wiphy);
+                if (last_request->initiator == set_by) {
+                        /* Two separate drivers hinting different things,
+                         * this is possible if you have two devices present
+                         * on a system with different EEPROM regulatory
+                         * readings. XXX: Do intersection, we support only
+                         * the first regulatory hint for now */
+                        if (last_request->wiphy != wiphy)
+                                return -EALREADY;
+                        if (rd)
+                                return -EALREADY;
+                        /* Driver should not be trying to hint different
+                         * regulatory domains! */
+                        BUG_ON(!alpha2_equal(alpha2,
+                                        cfg80211_regdomain->alpha2));
+                        return -EALREADY;
+                }
+                if (last_request->initiator == REGDOM_SET_BY_CORE)
+                        return 0;
+                /* XXX: Handle intersection, and add the
+                 * dot11MultiDomainCapabilityEnabled flag to wiphy. For now
+                 * we assume the driver has this set to false, following the
+                 * 802.11d dot11MultiDomainCapabilityEnabled documentation */
+                if (last_request->initiator == REGDOM_SET_BY_COUNTRY_IE)
+                        return 0;
+                return 0;
+        case REGDOM_SET_BY_USER:
+                if (last_request->initiator == set_by ||
+                                last_request->initiator == REGDOM_SET_BY_CORE)
+                        return 0;
+                /* Drivers can use their wiphy's reg_notifier()
+                 * to override any information */
+                if (last_request->initiator == REGDOM_SET_BY_DRIVER)
+                        return 0;
+                /* XXX: Handle intersection */
+                if (last_request->initiator == REGDOM_SET_BY_COUNTRY_IE)
+                        return -EOPNOTSUPP;
+                return 0;
+        default:
+                return -EINVAL;
+        }
+}
+
+static bool __reg_is_valid_request(const char *alpha2,
+        struct regulatory_request **request)
+{
+        struct regulatory_request *req;
+        if (list_empty(&regulatory_requests))
+                return false;
+        list_for_each_entry(req, &regulatory_requests, list) {
+                if (alpha2_equal(req->alpha2, alpha2)) {
+                        *request = req;
+                        return true;
+                }
+        }
+        return false;
+}
+
+/* Used by nl80211 before kmalloc'ing our regulatory domain */
+bool reg_is_valid_request(const char *alpha2)
+{
+        struct regulatory_request *request = NULL;
+        return  __reg_is_valid_request(alpha2, &request);
+}
+
+/* Sanity check on a regulatory rule */
+static bool is_valid_reg_rule(const struct ieee80211_reg_rule *rule)
+{
+        const struct ieee80211_freq_range *freq_range = &rule->freq_range;
+        u32 freq_diff;
+
+        if (freq_range->start_freq_khz == 0 || freq_range->end_freq_khz == 0)
+                return false;
+
+        if (freq_range->start_freq_khz > freq_range->end_freq_khz)
+                return false;
+
+        freq_diff = freq_range->end_freq_khz - freq_range->start_freq_khz;
+
+        if (freq_range->max_bandwidth_khz > freq_diff)
+                return false;
+
+        return true;
+}
+
+static bool is_valid_rd(const struct ieee80211_regdomain *rd)
+{
+        const struct ieee80211_reg_rule *reg_rule = NULL;
+        unsigned int i;
+
+        if (!rd->n_reg_rules)
+                return false;
+
+        for (i = 0; i < rd->n_reg_rules; i++) {
+                reg_rule = &rd->reg_rules[i];
+                if (!is_valid_reg_rule(reg_rule))
+                        return false;
+        }
+
+        return true;
+}
+
+/* Returns value in KHz */
+static u32 freq_max_bandwidth(const struct ieee80211_freq_range *freq_range,
+        u32 freq)
+{
+        unsigned int i;
+        for (i = 0; i < ARRAY_SIZE(supported_bandwidths); i++) {
+                u32 start_freq_khz = freq - supported_bandwidths[i]/2;
+                u32 end_freq_khz = freq + supported_bandwidths[i]/2;
+                if (start_freq_khz >= freq_range->start_freq_khz &&
+                        end_freq_khz <= freq_range->end_freq_khz)
+                        return supported_bandwidths[i];
+        }
+        return 0;
+}
+
+/* XXX: add support for the rest of enum nl80211_reg_rule_flags, we may
+ * want to just have the channel structure use these */
+static u32 map_regdom_flags(u32 rd_flags)
+{
+        u32 channel_flags = 0;
+        if (rd_flags & NL80211_RRF_PASSIVE_SCAN)
+                channel_flags |= IEEE80211_CHAN_PASSIVE_SCAN;
+        if (rd_flags & NL80211_RRF_NO_IBSS)
+                channel_flags |= IEEE80211_CHAN_NO_IBSS;
+        if (rd_flags & NL80211_RRF_DFS)
+                channel_flags |= IEEE80211_CHAN_RADAR;
+        return channel_flags;
+}
+
+/**
+ * freq_reg_info - get regulatory information for the given frequency
+ * @center_freq: Frequency in KHz for which we want regulatory information for
+ * @bandwidth: the bandwidth requirement you have in KHz, if you do not have one
+ *      you can set this to 0. If this frequency is allowed we then set
+ *      this value to the maximum allowed bandwidth.
+ * @reg_rule: the regulatory rule which we have for this frequency
+ *
+ * Use this function to get the regulatory rule for a specific frequency.
+ */
+static int freq_reg_info(u32 center_freq, u32 *bandwidth,
+                         const struct ieee80211_reg_rule **reg_rule)
 {
         int i;
-        u32 flags = chan->orig_flags;
-        const struct ieee80211_channel_range *rg = NULL;
+        u32 max_bandwidth = 0;
 
-        for (i = 0; i < rd->n_ranges; i++) {
-                if (rd->ranges[i].start_freq <= chan->center_freq &&
-                    chan->center_freq <= rd->ranges[i].end_freq) {
-                        rg = &rd->ranges[i];
+        if (!cfg80211_regdomain)
+                return -EINVAL;
+
+        for (i = 0; i < cfg80211_regdomain->n_reg_rules; i++) {
+                const struct ieee80211_reg_rule *rr;
+                const struct ieee80211_freq_range *fr = NULL;
+                const struct ieee80211_power_rule *pr = NULL;
+
+                rr = &cfg80211_regdomain->reg_rules[i];
+                fr = &rr->freq_range;
+                pr = &rr->power_rule;
+                max_bandwidth = freq_max_bandwidth(fr, center_freq);
+                if (max_bandwidth && *bandwidth <= max_bandwidth) {
+                        *reg_rule = rr;
+                        *bandwidth = max_bandwidth;
                         break;
                 }
         }
 
-        if (!rg) {
-                /* not found */
+        return !max_bandwidth;
+}
+
+static void handle_channel(struct ieee80211_channel *chan)
+{
+        int r;
+        u32 flags = chan->orig_flags;
+        u32 max_bandwidth = 0;
+        const struct ieee80211_reg_rule *reg_rule = NULL;
+        const struct ieee80211_power_rule *power_rule = NULL;
+
+        r = freq_reg_info(MHZ_TO_KHZ(chan->center_freq),
+                &max_bandwidth, &reg_rule);
+
+        if (r) {
                 flags |= IEEE80211_CHAN_DISABLED;
                 chan->flags = flags;
                 return;
         }
 
-        chan->flags = flags;
+        power_rule = &reg_rule->power_rule;
+
+        chan->flags = flags | map_regdom_flags(reg_rule->flags);
         chan->max_antenna_gain = min(chan->orig_mag,
-                                         rg->max_antenna_gain);
+                (int) MBI_TO_DBI(power_rule->max_antenna_gain));
+        chan->max_bandwidth = KHZ_TO_MHZ(max_bandwidth);
         if (chan->orig_mpwr)
-                chan->max_power = min(chan->orig_mpwr, rg->max_power);
+                chan->max_power = min(chan->orig_mpwr,
+                        (int) MBM_TO_DBM(power_rule->max_eirp));
         else
-                chan->max_power = rg->max_power;
+                chan->max_power = (int) MBM_TO_DBM(power_rule->max_eirp);
 }
 
-static void handle_band(struct ieee80211_supported_band *sband,
-                        const struct ieee80211_regdomain *rd)
+static void handle_band(struct ieee80211_supported_band *sband)
 {
         int i;
 
         for (i = 0; i < sband->n_channels; i++)
-                handle_channel(&sband->channels[i], rd);
+                handle_channel(&sband->channels[i]);
 }
 
-void wiphy_update_regulatory(struct wiphy *wiphy)
+static void update_all_wiphy_regulatory(enum reg_set_by setby)
 {
-        enum ieee80211_band band;
-        const struct ieee80211_regdomain *rd = get_regdom();
+        struct cfg80211_registered_device *drv;
+
+        list_for_each_entry(drv, &cfg80211_drv_list, list)
+                wiphy_update_regulatory(&drv->wiphy, setby);
+}
 
-        for (band = 0; band < IEEE80211_NUM_BANDS; band++)
+void wiphy_update_regulatory(struct wiphy *wiphy, enum reg_set_by setby)
+{
+        enum ieee80211_band band;
+        for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
                 if (wiphy->bands[band])
-                        handle_band(wiphy->bands[band], rd);
+                        handle_band(wiphy->bands[band]);
+                if (wiphy->reg_notifier)
+                        wiphy->reg_notifier(wiphy, setby);
+        }
+}
+
+/* Caller must hold &cfg80211_drv_mutex */
+int __regulatory_hint(struct wiphy *wiphy, enum reg_set_by set_by,
+                      const char *alpha2, struct ieee80211_regdomain *rd)
+{
+        struct regulatory_request *request;
+        char *rd_alpha2;
+        int r = 0;
+
+        r = ignore_request(wiphy, set_by, (char *) alpha2, rd);
+        if (r)
+                return r;
+
+        if (rd)
+                rd_alpha2 = rd->alpha2;
+        else
+                rd_alpha2 = (char *) alpha2;
+
+        switch (set_by) {
+        case REGDOM_SET_BY_CORE:
+        case REGDOM_SET_BY_COUNTRY_IE:
+        case REGDOM_SET_BY_DRIVER:
+        case REGDOM_SET_BY_USER:
+                request = kzalloc(sizeof(struct regulatory_request),
+                        GFP_KERNEL);
+                if (!request)
+                        return -ENOMEM;
+
+                request->alpha2[0] = rd_alpha2[0];
+                request->alpha2[1] = rd_alpha2[1];
+                request->initiator = set_by;
+                request->wiphy = wiphy;
+
+                list_add_tail(&request->list, &regulatory_requests);
+                if (rd)
+                        break;
+                r = call_crda(alpha2);
+#ifndef CONFIG_WIRELESS_OLD_REGULATORY
+                if (r)
+                        printk(KERN_ERR "cfg80211: Failed calling CRDA\n");
+#endif
+                break;
+        default:
+                r = -ENOTSUPP;
+                break;
+        }
+
+        return r;
+}
+
+/* If rd is not NULL and if this call fails the caller must free it */
+int regulatory_hint(struct wiphy *wiphy, const char *alpha2,
+        struct ieee80211_regdomain *rd)
+{
+        int r;
+        BUG_ON(!rd && !alpha2);
+
+        mutex_lock(&cfg80211_drv_mutex);
+
+        r = __regulatory_hint(wiphy, REGDOM_SET_BY_DRIVER, alpha2, rd);
+        if (r || !rd)
+                goto unlock_and_exit;
+
+        /* If the driver passed a regulatory domain we skipped asking
+         * userspace for one so we can now go ahead and set it */
+        r = set_regdom(rd);
+
+unlock_and_exit:
+        mutex_unlock(&cfg80211_drv_mutex);
+        return r;
+}
+EXPORT_SYMBOL(regulatory_hint);
+
+
+static void print_rd_rules(const struct ieee80211_regdomain *rd)
+{
+        unsigned int i;
+        const struct ieee80211_reg_rule *reg_rule = NULL;
+        const struct ieee80211_freq_range *freq_range = NULL;
+        const struct ieee80211_power_rule *power_rule = NULL;
+
+        printk(KERN_INFO "\t(start_freq - end_freq @ bandwidth), "
+                "(max_antenna_gain, max_eirp)\n");
+
+        for (i = 0; i < rd->n_reg_rules; i++) {
+                reg_rule = &rd->reg_rules[i];
+                freq_range = &reg_rule->freq_range;
+                power_rule = &reg_rule->power_rule;
+
+                /* There may not be documentation for max antenna gain
+                 * in certain regions */
+                if (power_rule->max_antenna_gain)
+                        printk(KERN_INFO "\t(%d KHz - %d KHz @ %d KHz), "
+                                "(%d mBi, %d mBm)\n",
+                                freq_range->start_freq_khz,
+                                freq_range->end_freq_khz,
+                                freq_range->max_bandwidth_khz,
+                                power_rule->max_antenna_gain,
+                                power_rule->max_eirp);
+                else
+                        printk(KERN_INFO "\t(%d KHz - %d KHz @ %d KHz), "
+                                "(N/A, %d mBm)\n",
+                                freq_range->start_freq_khz,
+                                freq_range->end_freq_khz,
+                                freq_range->max_bandwidth_khz,
+                                power_rule->max_eirp);
+        }
+}
+
+static void print_regdomain(const struct ieee80211_regdomain *rd)
+{
+
+        if (is_world_regdom(rd->alpha2))
+                printk(KERN_INFO "cfg80211: World regulatory "
+                        "domain updated:\n");
+        else {
+                if (is_unknown_alpha2(rd->alpha2))
+                        printk(KERN_INFO "cfg80211: Regulatory domain "
+                                "changed to driver built-in settings "
+                                "(unknown country)\n");
+                else
+                        printk(KERN_INFO "cfg80211: Regulatory domain "
+                                "changed to country: %c%c\n",
+                                rd->alpha2[0], rd->alpha2[1]);
+        }
+        print_rd_rules(rd);
+}
+
+void print_regdomain_info(const struct ieee80211_regdomain *rd)
+{
+        printk(KERN_INFO "cfg80211: Regulatory domain: %c%c\n",
+                rd->alpha2[0], rd->alpha2[1]);
+        print_rd_rules(rd);
+}
+
+static int __set_regdom(const struct ieee80211_regdomain *rd)
+{
+        struct regulatory_request *request = NULL;
+
+        /* Some basic sanity checks first */
+
+        if (is_world_regdom(rd->alpha2)) {
+                if (WARN_ON(!__reg_is_valid_request(rd->alpha2, &request)))
+                        return -EINVAL;
+                update_world_regdomain(rd);
+                return 0;
+        }
+
+        if (!is_alpha2_set(rd->alpha2) && !is_an_alpha2(rd->alpha2) &&
+                        !is_unknown_alpha2(rd->alpha2))
+                return -EINVAL;
+
+        if (list_empty(&regulatory_requests))
+                return -EINVAL;
+
+        /* allow overriding the static definitions if CRDA is present */
+        if (!is_old_static_regdom(cfg80211_regdomain) &&
+            !regdom_changed(rd->alpha2))
+                return -EINVAL;
+
+        /* Now lets set the regulatory domain, update all driver channels
+         * and finally inform them of what we have done, in case they want
+         * to review or adjust their own settings based on their own
+         * internal EEPROM data */
+
+        if (WARN_ON(!__reg_is_valid_request(rd->alpha2, &request)))
+                return -EINVAL;
+
+        reset_regdomains();
+
+        /* Country IE parsing coming soon */
+        switch (request->initiator) {
+        case REGDOM_SET_BY_CORE:
+        case REGDOM_SET_BY_DRIVER:
+        case REGDOM_SET_BY_USER:
+                if (!is_valid_rd(rd)) {
+                        printk(KERN_ERR "cfg80211: Invalid "
+                                "regulatory domain detected:\n");
+                        print_regdomain_info(rd);
+                        return -EINVAL;
+                }
+                break;
+        case REGDOM_SET_BY_COUNTRY_IE: /* Not yet */
+                WARN_ON(1);
+        default:
+                return -EOPNOTSUPP;
+        }
+
+        /* Tada! */
+        cfg80211_regdomain = rd;
+        request->granted = 1;
+
+        return 0;
+}
+
+
+/* Use this call to set the current regulatory domain. Conflicts with
+ * multiple drivers can be ironed out later. Caller must've already
+ * kmalloc'd the rd structure. If this calls fails you should kfree()
+ * the passed rd. Caller must hold cfg80211_drv_mutex */
+int set_regdom(const struct ieee80211_regdomain *rd)
+{
+        struct regulatory_request *this_request = NULL, *prev_request = NULL;
+        int r;
+
+        if (!list_empty(&regulatory_requests))
+                prev_request = list_first_entry(&regulatory_requests,
+                        struct regulatory_request, list);
+
+        /* Note that this doesn't update the wiphys, this is done below */
+        r = __set_regdom(rd);
+        if (r)
+                return r;
+
+        BUG_ON((!__reg_is_valid_request(rd->alpha2, &this_request)));
+
+        /* The initial standard core update of the world regulatory domain, no
+         * need to keep that request info around if it didn't fail. */
+        if (is_world_regdom(rd->alpha2) &&
+                        this_request->initiator == REGDOM_SET_BY_CORE &&
+                        this_request->granted) {
+                list_del(&this_request->list);
+                kfree(this_request);
+                this_request = NULL;
+        }
+
+        /* Remove old requests, we only leave behind the last one */
+        if (prev_request) {
+                list_del(&prev_request->list);
+                kfree(prev_request);
+                prev_request = NULL;
+        }
+
+        /* This would make this whole thing pointless */
+        BUG_ON(rd != cfg80211_regdomain);
+
+        /* update all wiphys now with the new established regulatory domain */
+        update_all_wiphy_regulatory(this_request->initiator);
+
+        print_regdomain(rd);
+
+        return r;
+}
+
+int regulatory_init(void)
+{
+        int err;
+
+        reg_pdev = platform_device_register_simple("regulatory", 0, NULL, 0);
+        if (IS_ERR(reg_pdev))
+                return PTR_ERR(reg_pdev);
+
+#ifdef CONFIG_WIRELESS_OLD_REGULATORY
+        cfg80211_regdomain = static_regdom(ieee80211_regdom);
+
+        printk(KERN_INFO "cfg80211: Using static regulatory domain info\n");
+        print_regdomain_info(cfg80211_regdomain);
+        /* The old code still requests for a new regdomain and if
+         * you have CRDA you get it updated, otherwise you get
+         * stuck with the static values. We ignore "EU" code as
+         * that is not a valid ISO / IEC 3166 alpha2 */
+        if (ieee80211_regdom[0] != 'E' && ieee80211_regdom[1] != 'U')
+                err = __regulatory_hint(NULL, REGDOM_SET_BY_CORE,
+                                        ieee80211_regdom, NULL);
+#else
+        cfg80211_regdomain = cfg80211_world_regdom;
+
+        err = __regulatory_hint(NULL, REGDOM_SET_BY_CORE, "00", NULL);
+        if (err)
+                printk(KERN_ERR "cfg80211: calling CRDA failed - "
+                       "unable to update world regulatory domain, "
+                       "using static definition\n");
+#endif
+
+        return 0;
+}
+
+void regulatory_exit(void)
+{
+        struct regulatory_request *req, *req_tmp;
+
+        mutex_lock(&cfg80211_drv_mutex);
+
+        reset_regdomains();
+
+        list_for_each_entry_safe(req, req_tmp, &regulatory_requests, list) {
+                list_del(&req->list);
+                kfree(req);
+        }
+        platform_device_unregister(reg_pdev);
+
+        mutex_unlock(&cfg80211_drv_mutex);
 }
diff --git a/net/wireless/reg.h b/net/wireless/reg.h
new file mode 100644
index 000000000000..a33362872f3c
--- /dev/null
+++ b/net/wireless/reg.h
@@ -0,0 +1,13 @@
+#ifndef __NET_WIRELESS_REG_H
+#define __NET_WIRELESS_REG_H
+
+extern struct mutex cfg80211_reg_mutex;
+bool is_world_regdom(const char *alpha2);
+bool reg_is_valid_request(const char *alpha2);
+
+int regulatory_init(void);
+void regulatory_exit(void);
+
+int set_regdom(const struct ieee80211_regdomain *rd);
+
+#endif  /* __NET_WIRELESS_REG_H */
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index b7754b1b73a4..ef9ccbc38752 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -34,7 +34,7 @@
 
 #include "xfrm_hash.h"
 
-int sysctl_xfrm_larval_drop __read_mostly;
+int sysctl_xfrm_larval_drop __read_mostly = 1;
 
 #ifdef CONFIG_XFRM_STATISTICS
 DEFINE_SNMP_STAT(struct linux_xfrm_mib, xfrm_statistics) __read_mostly;
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index 0a8f09c3144c..053970e8765d 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -59,6 +59,14 @@ static unsigned int xfrm_state_hashmax __read_mostly = 1 * 1024 * 1024;
 static unsigned int xfrm_state_num;
 static unsigned int xfrm_state_genid;
 
+/* Counter indicating ongoing walk, protected by xfrm_state_lock. */
+static unsigned long xfrm_state_walk_ongoing;
+/* Counter indicating walk completion, protected by xfrm_cfg_mutex. */
+static unsigned long xfrm_state_walk_completed;
+
+/* List of outstanding state walks used to set the completed counter.  */
+static LIST_HEAD(xfrm_state_walks);
+
 static struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned int family);
 static void xfrm_state_put_afinfo(struct xfrm_state_afinfo *afinfo);
 
@@ -191,7 +199,8 @@ static DEFINE_RWLOCK(xfrm_state_afinfo_lock);
 static struct xfrm_state_afinfo *xfrm_state_afinfo[NPROTO];
 
 static struct work_struct xfrm_state_gc_work;
-static HLIST_HEAD(xfrm_state_gc_list);
+static LIST_HEAD(xfrm_state_gc_leftovers);
+static LIST_HEAD(xfrm_state_gc_list);
 static DEFINE_SPINLOCK(xfrm_state_gc_lock);
 
 int __xfrm_state_delete(struct xfrm_state *x);
@@ -403,17 +412,23 @@ static void xfrm_state_gc_destroy(struct xfrm_state *x)
 
 static void xfrm_state_gc_task(struct work_struct *data)
 {
-        struct xfrm_state *x;
-        struct hlist_node *entry, *tmp;
-        struct hlist_head gc_list;
+        struct xfrm_state *x, *tmp;
+        unsigned long completed;
 
+        mutex_lock(&xfrm_cfg_mutex);
         spin_lock_bh(&xfrm_state_gc_lock);
-        gc_list.first = xfrm_state_gc_list.first;
-        INIT_HLIST_HEAD(&xfrm_state_gc_list);
+        list_splice_tail_init(&xfrm_state_gc_list, &xfrm_state_gc_leftovers);
         spin_unlock_bh(&xfrm_state_gc_lock);
 
-        hlist_for_each_entry_safe(x, entry, tmp, &gc_list, bydst)
+        completed = xfrm_state_walk_completed;
+        mutex_unlock(&xfrm_cfg_mutex);
+
+        list_for_each_entry_safe(x, tmp, &xfrm_state_gc_leftovers, gclist) {
+                if ((long)(x->lastused - completed) > 0)
+                        break;
+                list_del(&x->gclist);
                 xfrm_state_gc_destroy(x);
+        }
 
         wake_up(&km_waitq);
 }
@@ -540,12 +555,8 @@ void __xfrm_state_destroy(struct xfrm_state *x)
 {
         WARN_ON(x->km.state != XFRM_STATE_DEAD);
 
-        spin_lock_bh(&xfrm_state_lock);
-        list_del(&x->all);
-        spin_unlock_bh(&xfrm_state_lock);
-
         spin_lock_bh(&xfrm_state_gc_lock);
-        hlist_add_head(&x->bydst, &xfrm_state_gc_list);
+        list_add_tail(&x->gclist, &xfrm_state_gc_list);
         spin_unlock_bh(&xfrm_state_gc_lock);
         schedule_work(&xfrm_state_gc_work);
 }
@@ -558,6 +569,8 @@ int __xfrm_state_delete(struct xfrm_state *x)
         if (x->km.state != XFRM_STATE_DEAD) {
                 x->km.state = XFRM_STATE_DEAD;
                 spin_lock(&xfrm_state_lock);
+                x->lastused = xfrm_state_walk_ongoing;
+                list_del_rcu(&x->all);
                 hlist_del(&x->bydst);
                 hlist_del(&x->bysrc);
                 if (x->id.spi)
@@ -1594,6 +1607,41 @@ out:
 }
 EXPORT_SYMBOL(xfrm_state_walk);
 
+void xfrm_state_walk_init(struct xfrm_state_walk *walk, u8 proto)
+{
+        walk->proto = proto;
+        walk->state = NULL;
+        walk->count = 0;
+        list_add_tail(&walk->list, &xfrm_state_walks);
+        walk->genid = ++xfrm_state_walk_ongoing;
+}
+EXPORT_SYMBOL(xfrm_state_walk_init);
+
+void xfrm_state_walk_done(struct xfrm_state_walk *walk)
+{
+        struct list_head *prev;
+
+        if (walk->state != NULL) {
+                xfrm_state_put(walk->state);
+                walk->state = NULL;
+        }
+
+        prev = walk->list.prev;
+        list_del(&walk->list);
+
+        if (prev != &xfrm_state_walks) {
+                list_entry(prev, struct xfrm_state_walk, list)->genid =
+                        walk->genid;
+                return;
+        }
+
+        xfrm_state_walk_completed = walk->genid;
+
+        if (!list_empty(&xfrm_state_gc_leftovers))
+                schedule_work(&xfrm_state_gc_work);
+}
+EXPORT_SYMBOL(xfrm_state_walk_done);
+
 
 void xfrm_replay_notify(struct xfrm_state *x, int event)
 {