149 files changed, 8278 insertions, 3842 deletions

diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
index fe649081fbdc..a1f16303703a 100644
--- a/net/8021q/vlan.c
+++ b/net/8021q/vlan.c
@@ -225,12 +225,6 @@ int vlan_check_real_dev(struct net_device *real_dev, u16 vlan_id)
                 return -EOPNOTSUPP;
         }
 
-        /* The real device must be up and operating in order to
-         * assosciate a VLAN device with it.
-         */
-        if (!(real_dev->flags & IFF_UP))
-                return -ENETDOWN;
-
         if (__find_vlan_dev(real_dev, vlan_id) != NULL)
                 return -EEXIST;
 
@@ -468,6 +462,19 @@ static int vlan_device_event(struct notifier_block *unused, unsigned long event,
                 }
                 break;
 
+        case NETDEV_CHANGEMTU:
+                for (i = 0; i < VLAN_GROUP_ARRAY_LEN; i++) {
+                        vlandev = vlan_group_get_device(grp, i);
+                        if (!vlandev)
+                                continue;
+
+                        if (vlandev->mtu <= dev->mtu)
+                                continue;
+
+                        dev_set_mtu(vlandev, dev->mtu);
+                }
+                break;
+
         case NETDEV_FEAT_CHANGE:
                 /* Propagate device features to underlying device */
                 for (i = 0; i < VLAN_GROUP_ARRAY_LEN; i++) {
diff --git a/net/Kconfig b/net/Kconfig
index 7051b9710675..041c35edb763 100644
--- a/net/Kconfig
+++ b/net/Kconfig
@@ -23,6 +23,26 @@ menuconfig NET
 
 if NET
 
+config WANT_COMPAT_NETLINK_MESSAGES
+        bool
+        help
+          This option can be selected by other options that need compat
+          netlink messages.
+
+config COMPAT_NETLINK_MESSAGES
+        def_bool y
+        depends on COMPAT
+        depends on WIRELESS_EXT || WANT_COMPAT_NETLINK_MESSAGES
+        help
+          This option makes it possible to send different netlink messages
+          to tasks depending on whether the task is a compat task or not. To
+          achieve this, you need to set skb_shinfo(skb)->frag_list to the
+          compat skb before sending the skb, the netlink code will sort out
+          which message to actually pass to the task.
+
+          Newly written code should NEVER need this option but do
+          compat-independent messages instead!
+
 menu "Networking options"
 
 source "net/packet/Kconfig"
diff --git a/net/Makefile b/net/Makefile
index ba324aefda73..1542e7268a7b 100644
--- a/net/Makefile
+++ b/net/Makefile
@@ -24,7 +24,6 @@ obj-y				+= ipv6/
 endif
 obj-$(CONFIG_PACKET)            += packet/
 obj-$(CONFIG_NET_KEY)           += key/
-obj-$(CONFIG_NET_SCHED)         += sched/
 obj-$(CONFIG_BRIDGE)            += bridge/
 obj-$(CONFIG_NET_DSA)           += dsa/
 obj-$(CONFIG_IPX)               += ipx/
diff --git a/net/atm/br2684.c b/net/atm/br2684.c
index 2912665fc58c..848af113ba2a 100644
--- a/net/atm/br2684.c
+++ b/net/atm/br2684.c
@@ -238,7 +238,7 @@ static int br2684_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 /* netif_stop_queue(dev); */
                 dev_kfree_skb(skb);
                 read_unlock(&devs_lock);
-                return 0;
+                return NETDEV_TX_OK;
         }
         if (!br2684_xmit_vcc(skb, dev, brvcc)) {
                 /*
@@ -252,7 +252,7 @@ static int br2684_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 dev->stats.tx_fifo_errors++;
         }
         read_unlock(&devs_lock);
-        return 0;
+        return NETDEV_TX_OK;
 }
 
 /*
diff --git a/net/atm/clip.c b/net/atm/clip.c
index e65a3b1477f8..64910bb86089 100644
--- a/net/atm/clip.c
+++ b/net/atm/clip.c
@@ -373,7 +373,7 @@ static int clip_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 printk(KERN_ERR "clip_start_xmit: skb_dst(skb) == NULL\n");
                 dev_kfree_skb(skb);
                 dev->stats.tx_dropped++;
-                return 0;
+                return NETDEV_TX_OK;
         }
         if (!skb_dst(skb)->neighbour) {
 #if 0
@@ -387,7 +387,7 @@ static int clip_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 printk(KERN_ERR "clip_start_xmit: NO NEIGHBOUR !\n");
                 dev_kfree_skb(skb);
                 dev->stats.tx_dropped++;
-                return 0;
+                return NETDEV_TX_OK;
         }
         entry = NEIGH2ENTRY(skb_dst(skb)->neighbour);
         if (!entry->vccs) {
@@ -402,7 +402,7 @@ static int clip_start_xmit(struct sk_buff *skb, struct net_device *dev)
                         dev_kfree_skb(skb);
                         dev->stats.tx_dropped++;
                 }
-                return 0;
+                return NETDEV_TX_OK;
         }
         pr_debug("neigh %p, vccs %p\n", entry, entry->vccs);
         ATM_SKB(skb)->vcc = vcc = entry->vccs->vcc;
@@ -421,14 +421,14 @@ static int clip_start_xmit(struct sk_buff *skb, struct net_device *dev)
         old = xchg(&entry->vccs->xoff, 1);      /* assume XOFF ... */
         if (old) {
                 printk(KERN_WARNING "clip_start_xmit: XOFF->XOFF transition\n");
-                return 0;
+                return NETDEV_TX_OK;
         }
         dev->stats.tx_packets++;
         dev->stats.tx_bytes += skb->len;
         vcc->send(vcc, skb);
         if (atm_may_send(vcc, 0)) {
                 entry->vccs->xoff = 0;
-                return 0;
+                return NETDEV_TX_OK;
         }
         spin_lock_irqsave(&clip_priv->xoff_lock, flags);
         netif_stop_queue(dev);  /* XOFF -> throttle immediately */
@@ -440,7 +440,7 @@ static int clip_start_xmit(struct sk_buff *skb, struct net_device *dev)
            of the brief netif_stop_queue. If this isn't true or if it
            changes, use netif_wake_queue instead. */
         spin_unlock_irqrestore(&clip_priv->xoff_lock, flags);
-        return 0;
+        return NETDEV_TX_OK;
 }
 
 static int clip_mkip(struct atm_vcc *vcc, int timeout)
diff --git a/net/atm/lec.c b/net/atm/lec.c
index ff2e594dca9b..c463868c993b 100644
--- a/net/atm/lec.c
+++ b/net/atm/lec.c
@@ -289,7 +289,7 @@ static int lec_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 skb2 = skb_realloc_headroom(skb, LEC_HEADER_LEN);
                 kfree_skb(skb);
                 if (skb2 == NULL)
-                        return 0;
+                        return NETDEV_TX_OK;
                 skb = skb2;
         }
         skb_push(skb, 2);
@@ -307,7 +307,7 @@ static int lec_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 skb2 = skb_realloc_headroom(skb, LEC_HEADER_LEN);
                 kfree_skb(skb);
                 if (skb2 == NULL)
-                        return 0;
+                        return NETDEV_TX_OK;
                 skb = skb2;
         }
 #endif
@@ -345,7 +345,7 @@ static int lec_start_xmit(struct sk_buff *skb, struct net_device *dev)
                         dev_kfree_skb(skb);
                         if (skb2 == NULL) {
                                 dev->stats.tx_dropped++;
-                                return 0;
+                                return NETDEV_TX_OK;
                         }
                         skb = skb2;
                 }
@@ -416,7 +416,7 @@ out:
         if (entry)
                 lec_arp_put(entry);
         dev->trans_start = jiffies;
-        return 0;
+        return NETDEV_TX_OK;
 }
 
 /* The inverse routine to net_open(). */
diff --git a/net/atm/mpc.c b/net/atm/mpc.c
index e5bf11453a18..1ac4b94bf626 100644
--- a/net/atm/mpc.c
+++ b/net/atm/mpc.c
@@ -554,7 +554,7 @@ static int mpc_send_packet(struct sk_buff *skb, struct net_device *dev)
         while (i < mpc->number_of_mps_macs) {
                 if (!compare_ether_addr(eth->h_dest, (mpc->mps_macs + i*ETH_ALEN)))
                         if ( send_via_shortcut(skb, mpc) == 0 )           /* try shortcut */
-                                return 0;                                 /* success!     */
+                                return NETDEV_TX_OK;                      /* success!     */
                 i++;
         }
 
diff --git a/net/bluetooth/bnep/netdev.c b/net/bluetooth/bnep/netdev.c
index d7a0e9722def..9c42990126a0 100644
--- a/net/bluetooth/bnep/netdev.c
+++ b/net/bluetooth/bnep/netdev.c
@@ -175,14 +175,14 @@ static int bnep_net_xmit(struct sk_buff *skb, struct net_device *dev)
 #ifdef CONFIG_BT_BNEP_MC_FILTER
         if (bnep_net_mc_filter(skb, s)) {
                 kfree_skb(skb);
-                return 0;
+                return NETDEV_TX_OK;
         }
 #endif
 
 #ifdef CONFIG_BT_BNEP_PROTO_FILTER
         if (bnep_net_proto_filter(skb, s)) {
                 kfree_skb(skb);
-                return 0;
+                return NETDEV_TX_OK;
         }
 #endif
 
@@ -203,7 +203,7 @@ static int bnep_net_xmit(struct sk_buff *skb, struct net_device *dev)
                 netif_stop_queue(dev);
         }
 
-        return 0;
+        return NETDEV_TX_OK;
 }
 
 static const struct net_device_ops bnep_netdev_ops = {
diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index 18538d7460d7..15d43ba86b53 100644
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -39,7 +39,7 @@ int br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
         else
                 br_flood_deliver(br, skb);
 
-        return 0;
+        return NETDEV_TX_OK;
 }
 
 static int br_dev_open(struct net_device *dev)
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index d22f611e4004..4fde7425077d 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -905,46 +905,62 @@ static unsigned int ip_sabotage_in(unsigned int hook, struct sk_buff *skb,
  * For br_nf_post_routing, we need (prio = NF_BR_PRI_LAST), because
  * ip_refrag() can return NF_STOLEN. */
 static struct nf_hook_ops br_nf_ops[] __read_mostly = {
-        { .hook = br_nf_pre_routing,
-          .owner = THIS_MODULE,
-          .pf = PF_BRIDGE,
-          .hooknum = NF_BR_PRE_ROUTING,
-          .priority = NF_BR_PRI_BRNF, },
-        { .hook = br_nf_local_in,
-          .owner = THIS_MODULE,
-          .pf = PF_BRIDGE,
-          .hooknum = NF_BR_LOCAL_IN,
-          .priority = NF_BR_PRI_BRNF, },
-        { .hook = br_nf_forward_ip,
-          .owner = THIS_MODULE,
-          .pf = PF_BRIDGE,
-          .hooknum = NF_BR_FORWARD,
-          .priority = NF_BR_PRI_BRNF - 1, },
-        { .hook = br_nf_forward_arp,
-          .owner = THIS_MODULE,
-          .pf = PF_BRIDGE,
-          .hooknum = NF_BR_FORWARD,
-          .priority = NF_BR_PRI_BRNF, },
-        { .hook = br_nf_local_out,
-          .owner = THIS_MODULE,
-          .pf = PF_BRIDGE,
-          .hooknum = NF_BR_LOCAL_OUT,
-          .priority = NF_BR_PRI_FIRST, },
-        { .hook = br_nf_post_routing,
-          .owner = THIS_MODULE,
-          .pf = PF_BRIDGE,
-          .hooknum = NF_BR_POST_ROUTING,
-          .priority = NF_BR_PRI_LAST, },
-        { .hook = ip_sabotage_in,
-          .owner = THIS_MODULE,
-          .pf = PF_INET,
-          .hooknum = NF_INET_PRE_ROUTING,
-          .priority = NF_IP_PRI_FIRST, },
-        { .hook = ip_sabotage_in,
-          .owner = THIS_MODULE,
-          .pf = PF_INET6,
-          .hooknum = NF_INET_PRE_ROUTING,
-          .priority = NF_IP6_PRI_FIRST, },
+        {
+                .hook = br_nf_pre_routing,
+                .owner = THIS_MODULE,
+                .pf = PF_BRIDGE,
+                .hooknum = NF_BR_PRE_ROUTING,
+                .priority = NF_BR_PRI_BRNF,
+        },
+        {
+                .hook = br_nf_local_in,
+                .owner = THIS_MODULE,
+                .pf = PF_BRIDGE,
+                .hooknum = NF_BR_LOCAL_IN,
+                .priority = NF_BR_PRI_BRNF,
+        },
+        {
+                .hook = br_nf_forward_ip,
+                .owner = THIS_MODULE,
+                .pf = PF_BRIDGE,
+                .hooknum = NF_BR_FORWARD,
+                .priority = NF_BR_PRI_BRNF - 1,
+        },
+        {
+                .hook = br_nf_forward_arp,
+                .owner = THIS_MODULE,
+                .pf = PF_BRIDGE,
+                .hooknum = NF_BR_FORWARD,
+                .priority = NF_BR_PRI_BRNF,
+        },
+        {
+                .hook = br_nf_local_out,
+                .owner = THIS_MODULE,
+                .pf = PF_BRIDGE,
+                .hooknum = NF_BR_LOCAL_OUT,
+                .priority = NF_BR_PRI_FIRST,
+        },
+        {
+                .hook = br_nf_post_routing,
+                .owner = THIS_MODULE,
+                .pf = PF_BRIDGE,
+                .hooknum = NF_BR_POST_ROUTING,
+                .priority = NF_BR_PRI_LAST,
+        },
+        {
+                .hook = ip_sabotage_in,
+                .owner = THIS_MODULE,
+                .pf = PF_INET,
+                .hooknum = NF_INET_PRE_ROUTING,
+                .priority = NF_IP_PRI_FIRST,
+        },
+        {
+                .hook = ip_sabotage_in,
+                .owner = THIS_MODULE,
+                .pf = PF_INET6,
+                .hooknum = NF_INET_PRE_ROUTING,
+                .priority = NF_IP6_PRI_FIRST,
+        },
 };
 
 #ifdef CONFIG_SYSCTL
diff --git a/net/compat.c b/net/compat.c
index 8d739053afe4..12728b17a226 100644
--- a/net/compat.c
+++ b/net/compat.c
@@ -743,6 +743,18 @@ asmlinkage long compat_sys_recvmsg(int fd, struct compat_msghdr __user *msg, uns
         return sys_recvmsg(fd, (struct msghdr __user *)msg, flags | MSG_CMSG_COMPAT);
 }
 
+asmlinkage long compat_sys_recv(int fd, void __user *buf, size_t len, unsigned flags)
+{
+        return sys_recv(fd, buf, len, flags | MSG_CMSG_COMPAT);
+}
+
+asmlinkage long compat_sys_recvfrom(int fd, void __user *buf, size_t len,
+                                    unsigned flags, struct sockaddr __user *addr,
+                                    int __user *addrlen)
+{
+        return sys_recvfrom(fd, buf, len, flags | MSG_CMSG_COMPAT, addr, addrlen);
+}
+
 asmlinkage long compat_sys_socketcall(int call, u32 __user *args)
 {
         int ret;
@@ -788,10 +800,11 @@ asmlinkage long compat_sys_socketcall(int call, u32 __user *args)
                 ret = sys_sendto(a0, compat_ptr(a1), a[2], a[3], compat_ptr(a[4]), a[5]);
                 break;
         case SYS_RECV:
-                ret = sys_recv(a0, compat_ptr(a1), a[2], a[3]);
+                ret = compat_sys_recv(a0, compat_ptr(a1), a[2], a[3]);
                 break;
         case SYS_RECVFROM:
-                ret = sys_recvfrom(a0, compat_ptr(a1), a[2], a[3], compat_ptr(a[4]), compat_ptr(a[5]));
+                ret = compat_sys_recvfrom(a0, compat_ptr(a1), a[2], a[3],
+                                          compat_ptr(a[4]), compat_ptr(a[5]));
                 break;
         case SYS_SHUTDOWN:
                 ret = sys_shutdown(a0,a1);
diff --git a/net/core/dev.c b/net/core/dev.c
index 70c27e0c7c32..d6c657ee413d 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1704,7 +1704,7 @@ int dev_hard_start_xmit(struct sk_buff *skb, struct net_device *dev,
                         skb_dst_drop(skb);
 
                 rc = ops->ndo_start_xmit(skb, dev);
-                if (rc == 0)
+                if (rc == NETDEV_TX_OK)
                         txq_trans_update(txq);
                 /*
                  * TODO: if skb_orphan() was called by
@@ -1730,7 +1730,7 @@ gso:
                 skb->next = nskb->next;
                 nskb->next = NULL;
                 rc = ops->ndo_start_xmit(nskb, dev);
-                if (unlikely(rc)) {
+                if (unlikely(rc != NETDEV_TX_OK)) {
                         nskb->next = skb->next;
                         skb->next = nskb;
                         return rc;
@@ -1744,7 +1744,7 @@ gso:
 
 out_kfree_skb:
         kfree_skb(skb);
-        return 0;
+        return NETDEV_TX_OK;
 }
 
 static u32 skb_tx_hashrnd;
@@ -3923,6 +3923,7 @@ int __dev_addr_sync(struct dev_addr_list **to, int *to_count,
         }
         return err;
 }
+EXPORT_SYMBOL_GPL(__dev_addr_sync);
 
 void __dev_addr_unsync(struct dev_addr_list **to, int *to_count,
                        struct dev_addr_list **from, int *from_count)
@@ -3942,6 +3943,7 @@ void __dev_addr_unsync(struct dev_addr_list **to, int *to_count,
                 da = next;
         }
 }
+EXPORT_SYMBOL_GPL(__dev_addr_unsync);
 
 /**
  *      dev_unicast_sync - Synchronize device's unicast list to another device
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index d9d5160610d5..44e571111d3a 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -30,10 +30,17 @@ u32 ethtool_op_get_link(struct net_device *dev)
         return netif_carrier_ok(dev) ? 1 : 0;
 }
 
+u32 ethtool_op_get_rx_csum(struct net_device *dev)
+{
+        return (dev->features & NETIF_F_ALL_CSUM) != 0;
+}
+EXPORT_SYMBOL(ethtool_op_get_rx_csum);
+
 u32 ethtool_op_get_tx_csum(struct net_device *dev)
 {
         return (dev->features & NETIF_F_ALL_CSUM) != 0;
 }
+EXPORT_SYMBOL(ethtool_op_get_tx_csum);
 
 int ethtool_op_set_tx_csum(struct net_device *dev, u32 data)
 {
@@ -1004,7 +1011,9 @@ int dev_ethtool(struct net *net, struct ifreq *ifr)
                 break;
         case ETHTOOL_GRXCSUM:
                 rc = ethtool_get_value(dev, useraddr, ethcmd,
-                                       dev->ethtool_ops->get_rx_csum);
+                                       (dev->ethtool_ops->get_rx_csum ?
+                                        dev->ethtool_ops->get_rx_csum :
+                                        ethtool_op_get_rx_csum));
                 break;
         case ETHTOOL_SRXCSUM:
                 rc = ethtool_set_rx_csum(dev, useraddr);
@@ -1068,7 +1077,9 @@ int dev_ethtool(struct net *net, struct ifreq *ifr)
                 break;
         case ETHTOOL_GFLAGS:
                 rc = ethtool_get_value(dev, useraddr, ethcmd,
-                                       dev->ethtool_ops->get_flags);
+                                       (dev->ethtool_ops->get_flags ?
+                                        dev->ethtool_ops->get_flags :
+                                        ethtool_op_get_flags));
                 break;
         case ETHTOOL_SFLAGS:
                 rc = ethtool_set_value(dev, useraddr,
@@ -1116,7 +1127,6 @@ int dev_ethtool(struct net *net, struct ifreq *ifr)
 EXPORT_SYMBOL(ethtool_op_get_link);
 EXPORT_SYMBOL(ethtool_op_get_sg);
 EXPORT_SYMBOL(ethtool_op_get_tso);
-EXPORT_SYMBOL(ethtool_op_get_tx_csum);
 EXPORT_SYMBOL(ethtool_op_set_sg);
 EXPORT_SYMBOL(ethtool_op_set_tso);
 EXPORT_SYMBOL(ethtool_op_set_tx_csum);
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 163b4f5b0365..c6f9ad8e4c7a 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -1316,7 +1316,7 @@ void pneigh_enqueue(struct neigh_table *tbl, struct neigh_parms *p,
 }
 EXPORT_SYMBOL(pneigh_enqueue);
 
-static inline struct neigh_parms *lookup_neigh_params(struct neigh_table *tbl,
+static inline struct neigh_parms *lookup_neigh_parms(struct neigh_table *tbl,
                                                       struct net *net, int ifindex)
 {
         struct neigh_parms *p;
@@ -1337,7 +1337,7 @@ struct neigh_parms *neigh_parms_alloc(struct net_device *dev,
         struct net *net = dev_net(dev);
         const struct net_device_ops *ops = dev->netdev_ops;
 
-        ref = lookup_neigh_params(tbl, net, 0);
+        ref = lookup_neigh_parms(tbl, net, 0);
         if (!ref)
                 return NULL;
 
@@ -1906,7 +1906,7 @@ static int neightbl_set(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
                 if (tbp[NDTPA_IFINDEX])
                         ifindex = nla_get_u32(tbp[NDTPA_IFINDEX]);
 
-                p = lookup_neigh_params(tbl, net, ifindex);
+                p = lookup_neigh_parms(tbl, net, ifindex);
                 if (p == NULL) {
                         err = -ENOENT;
                         goto errout_tbl_lock;
diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
index b7292a2719dc..ddd2cd2b1775 100644
--- a/net/core/net_namespace.c
+++ b/net/core/net_namespace.c
@@ -6,6 +6,8 @@
 #include <linux/delay.h>
 #include <linux/sched.h>
 #include <linux/idr.h>
+#include <linux/rculist.h>
+#include <linux/nsproxy.h>
 #include <net/net_namespace.h>
 #include <net/netns/generic.h>
 
@@ -127,7 +129,7 @@ static struct net *net_create(void)
         rv = setup_net(net);
         if (rv == 0) {
                 rtnl_lock();
-                list_add_tail(&net->list, &net_namespace_list);
+                list_add_tail_rcu(&net->list, &net_namespace_list);
                 rtnl_unlock();
         }
         mutex_unlock(&net_mutex);
@@ -156,9 +158,16 @@ static void cleanup_net(struct work_struct *work)
 
         /* Don't let anyone else find us. */
         rtnl_lock();
-        list_del(&net->list);
+        list_del_rcu(&net->list);
         rtnl_unlock();
 
+        /*
+         * Another CPU might be rcu-iterating the list, wait for it.
+         * This needs to be before calling the exit() notifiers, so
+         * the rcu_barrier() below isn't sufficient alone.
+         */
+        synchronize_rcu();
+
         /* Run all of the network namespace exit methods */
         list_for_each_entry_reverse(ops, &pernet_list, list) {
                 if (ops->exit)
@@ -193,6 +202,26 @@ struct net *copy_net_ns(unsigned long flags, struct net *old_net)
 }
 #endif
 
+struct net *get_net_ns_by_pid(pid_t pid)
+{
+        struct task_struct *tsk;
+        struct net *net;
+
+        /* Lookup the network namespace */
+        net = ERR_PTR(-ESRCH);
+        rcu_read_lock();
+        tsk = find_task_by_vpid(pid);
+        if (tsk) {
+                struct nsproxy *nsproxy;
+                nsproxy = task_nsproxy(tsk);
+                if (nsproxy)
+                        net = get_net(nsproxy->net_ns);
+        }
+        rcu_read_unlock();
+        return net;
+}
+EXPORT_SYMBOL_GPL(get_net_ns_by_pid);
+
 static int __init net_ns_init(void)
 {
         struct net_generic *ng;
@@ -219,7 +248,7 @@ static int __init net_ns_init(void)
                 panic("Could not setup the initial network namespace");
 
         rtnl_lock();
-        list_add_tail(&init_net.list, &net_namespace_list);
+        list_add_tail_rcu(&init_net.list, &net_namespace_list);
         rtnl_unlock();
 
         mutex_unlock(&net_mutex);
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index df30feb2fc72..0ac309154b0d 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -9,6 +9,7 @@
  * Copyright (C) 2002  Red Hat, Inc.
  */
 
+#include <linux/moduleparam.h>
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
 #include <linux/string.h>
@@ -50,6 +51,9 @@ static atomic_t trapped;
 static void zap_completion_queue(void);
 static void arp_reply(struct sk_buff *skb);
 
+static unsigned int carrier_timeout = 4;
+module_param(carrier_timeout, uint, 0644);
+
 static void queue_process(struct work_struct *work)
 {
         struct netpoll_info *npinfo =
@@ -732,7 +736,7 @@ int netpoll_setup(struct netpoll *np)
                 }
 
                 atleast = jiffies + HZ/10;
-                atmost = jiffies + 4*HZ;
+                atmost = jiffies + carrier_timeout * HZ;
                 while (!netif_carrier_ok(ndev)) {
                         if (time_after(jiffies, atmost)) {
                                 printk(KERN_NOTICE
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index d78030f88bd0..b44775f9f2bf 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -35,7 +35,6 @@
 #include <linux/security.h>
 #include <linux/mutex.h>
 #include <linux/if_addr.h>
-#include <linux/nsproxy.h>
 
 #include <asm/uaccess.h>
 #include <asm/system.h>
@@ -52,6 +51,7 @@
 #include <net/pkt_sched.h>
 #include <net/fib_rules.h>
 #include <net/rtnetlink.h>
+#include <net/net_namespace.h>
 
 struct rtnl_link
 {
@@ -725,25 +725,6 @@ static const struct nla_policy ifla_info_policy[IFLA_INFO_MAX+1] = {
         [IFLA_INFO_DATA]        = { .type = NLA_NESTED },
 };
 
-static struct net *get_net_ns_by_pid(pid_t pid)
-{
-        struct task_struct *tsk;
-        struct net *net;
-
-        /* Lookup the network namespace */
-        net = ERR_PTR(-ESRCH);
-        rcu_read_lock();
-        tsk = find_task_by_vpid(pid);
-        if (tsk) {
-                struct nsproxy *nsproxy;
-                nsproxy = task_nsproxy(tsk);
-                if (nsproxy)
-                        net = get_net(nsproxy->net_ns);
-        }
-        rcu_read_unlock();
-        return net;
-}
-
 static int validate_linkmsg(struct net_device *dev, struct nlattr *tb[])
 {
         if (dev) {
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 9e0597d189b0..80a96166df39 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -559,9 +559,6 @@ static void __copy_skb_header(struct sk_buff *new, const struct sk_buff *old)
 #endif
 #endif
         new->vlan_tci           = old->vlan_tci;
-#if defined(CONFIG_MAC80211) || defined(CONFIG_MAC80211_MODULE)
-        new->do_not_encrypt     = old->do_not_encrypt;
-#endif
 
         skb_copy_secmark(new, old);
 }
diff --git a/net/decnet/dn_route.c b/net/decnet/dn_route.c
index 1d6ca8a98dc6..9383d3e5a1ab 100644
--- a/net/decnet/dn_route.c
+++ b/net/decnet/dn_route.c
@@ -774,7 +774,7 @@ static int dn_rt_bug(struct sk_buff *skb)
 
         kfree_skb(skb);
 
-        return NET_RX_BAD;
+        return NET_RX_DROP;
 }
 
 static int dn_rt_set_next_hop(struct dn_route *rt, struct dn_fib_res *res)
diff --git a/net/econet/af_econet.c b/net/econet/af_econet.c
index 2e1f836d4240..e114da7ca9b8 100644
--- a/net/econet/af_econet.c
+++ b/net/econet/af_econet.c
@@ -1072,7 +1072,7 @@ static int econet_rcv(struct sk_buff *skb, struct net_device *dev, struct packet
                 skb->protocol = htons(ETH_P_IP);
                 skb_pull(skb, sizeof(struct ec_framehdr));
                 netif_rx(skb);
-                return 0;
+                return NET_RX_SUCCESS;
         }
 
         sk = ec_listening_socket(hdr->port, hdr->src_stn, hdr->src_net);
@@ -1083,7 +1083,7 @@ static int econet_rcv(struct sk_buff *skb, struct net_device *dev, struct packet
                             hdr->port))
                 goto drop;
 
-        return 0;
+        return NET_RX_SUCCESS;
 
 drop:
         kfree_skb(skb);
diff --git a/net/ieee802154/af_ieee802154.c b/net/ieee802154/af_ieee802154.c
index 3bb6bdb1dac1..69c8d9207aa7 100644
--- a/net/ieee802154/af_ieee802154.c
+++ b/net/ieee802154/af_ieee802154.c
@@ -34,8 +34,8 @@
 #include <net/tcp_states.h>
 #include <net/route.h>
 
-#include <net/ieee802154/af_ieee802154.h>
-#include <net/ieee802154/netdevice.h>
+#include <net/af_ieee802154.h>
+#include <net/ieee802154_netdev.h>
 
 #include "af802154.h"
 
diff --git a/net/ieee802154/dgram.c b/net/ieee802154/dgram.c
index 14d39840dd62..53dd912d52b4 100644
--- a/net/ieee802154/dgram.c
+++ b/net/ieee802154/dgram.c
@@ -26,9 +26,9 @@
 #include <linux/if_arp.h>
 #include <linux/list.h>
 #include <net/sock.h>
-#include <net/ieee802154/af_ieee802154.h>
-#include <net/ieee802154/mac_def.h>
-#include <net/ieee802154/netdevice.h>
+#include <net/af_ieee802154.h>
+#include <net/ieee802154.h>
+#include <net/ieee802154_netdev.h>
 
 #include <asm/ioctls.h>
 
diff --git a/net/ieee802154/netlink.c b/net/ieee802154/netlink.c
index 27eda9fdf3c2..a615b9d13212 100644
--- a/net/ieee802154/netlink.c
+++ b/net/ieee802154/netlink.c
@@ -27,9 +27,9 @@
 #include <net/netlink.h>
 #include <net/genetlink.h>
 #include <linux/nl802154.h>
-#include <net/ieee802154/af_ieee802154.h>
-#include <net/ieee802154/nl802154.h>
-#include <net/ieee802154/netdevice.h>
+#include <net/af_ieee802154.h>
+#include <net/nl802154.h>
+#include <net/ieee802154_netdev.h>
 
 static unsigned int ieee802154_seq_num;
 
diff --git a/net/ieee802154/raw.c b/net/ieee802154/raw.c
index fca44d59f97e..ea8d1f15206e 100644
--- a/net/ieee802154/raw.c
+++ b/net/ieee802154/raw.c
@@ -26,7 +26,7 @@
 #include <linux/if_arp.h>
 #include <linux/list.h>
 #include <net/sock.h>
-#include <net/ieee802154/af_ieee802154.h>
+#include <net/af_ieee802154.h>
 
 #include "af802154.h"
 
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index 566ea6c4321d..197d024b2536 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -1187,6 +1187,7 @@ static struct sk_buff *inet_gso_segment(struct sk_buff *skb, int features)
         int proto;
         int ihl;
         int id;
+        unsigned int offset = 0;
 
         if (!(features & NETIF_F_V4_CSUM))
                 features &= ~NETIF_F_SG;
@@ -1229,7 +1230,14 @@ static struct sk_buff *inet_gso_segment(struct sk_buff *skb, int features)
         skb = segs;
         do {
                 iph = ip_hdr(skb);
-                iph->id = htons(id++);
+                if (proto == IPPROTO_UDP) {
+                        iph->id = htons(id);
+                        iph->frag_off = htons(offset >> 3);
+                        if (skb->next != NULL)
+                                iph->frag_off |= htons(IP_MF);
+                        offset += (skb->len - skb->mac_len - iph->ihl * 4);
+                } else
+                        iph->id = htons(id++);
                 iph->tot_len = htons(skb->len - skb->mac_len);
                 iph->check = 0;
                 iph->check = ip_fast_csum(skb_network_header(skb), iph->ihl);
@@ -1425,6 +1433,8 @@ static struct net_protocol tcp_protocol = {
 static struct net_protocol udp_protocol = {
         .handler =      udp_rcv,
         .err_handler =  udp_err,
+        .gso_send_check = udp4_ufo_send_check,
+        .gso_segment = udp4_ufo_fragment,
         .no_policy =    1,
         .netns_ok =     1,
 };
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 63c2fa7b68c4..d58b49115386 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -164,6 +164,14 @@ static struct tnode *inflate(struct trie *t, struct tnode *tn);
 static struct tnode *halve(struct trie *t, struct tnode *tn);
 /* tnodes to free after resize(); protected by RTNL */
 static struct tnode *tnode_free_head;
+static size_t tnode_free_size;
+
+/*
+ * synchronize_rcu after call_rcu for that many pages; it should be especially
+ * useful before resizing the root node with PREEMPT_NONE configs; the value was
+ * obtained experimentally, aiming to avoid visible slowdown.
+ */
+static const int sync_pages = 128;
 
 static struct kmem_cache *fn_alias_kmem __read_mostly;
 static struct kmem_cache *trie_leaf_kmem __read_mostly;
@@ -319,6 +327,8 @@ static const int inflate_threshold = 50;
 static const int halve_threshold_root = 15;
 static const int inflate_threshold_root = 25;
 
+static int inflate_threshold_root_fix;
+#define INFLATE_FIX_MAX 10      /* a comment in resize() */
 
 static void __alias_free_mem(struct rcu_head *head)
 {
@@ -393,6 +403,8 @@ static void tnode_free_safe(struct tnode *tn)
         BUG_ON(IS_LEAF(tn));
         tn->tnode_free = tnode_free_head;
         tnode_free_head = tn;
+        tnode_free_size += sizeof(struct tnode) +
+                           (sizeof(struct node *) << tn->bits);
 }
 
 static void tnode_free_flush(void)
@@ -404,6 +416,11 @@ static void tnode_free_flush(void)
                 tn->tnode_free = NULL;
                 tnode_free(tn);
         }
+
+        if (tnode_free_size >= PAGE_SIZE * sync_pages) {
+                tnode_free_size = 0;
+                synchronize_rcu();
+        }
 }
 
 static struct leaf *leaf_new(void)
@@ -602,7 +619,8 @@ static struct node *resize(struct trie *t, struct tnode *tn)
         /* Keep root node larger  */
 
         if (!tn->parent)
-                inflate_threshold_use = inflate_threshold_root;
+                inflate_threshold_use = inflate_threshold_root +
+                                        inflate_threshold_root_fix;
         else
                 inflate_threshold_use = inflate_threshold;
 
@@ -626,15 +644,27 @@ static struct node *resize(struct trie *t, struct tnode *tn)
         }
 
         if (max_resize < 0) {
-                if (!tn->parent)
-                        pr_warning("Fix inflate_threshold_root."
-                                   " Now=%d size=%d bits\n",
-                                   inflate_threshold_root, tn->bits);
-                else
+                if (!tn->parent) {
+                        /*
+                         * It was observed that during large updates even
+                         * inflate_threshold_root = 35 might be needed to avoid
+                         * this warning; but it should be temporary, so let's
+                         * try to handle this automatically.
+                         */
+                        if (inflate_threshold_root_fix < INFLATE_FIX_MAX)
+                                inflate_threshold_root_fix++;
+                        else
+                                pr_warning("Fix inflate_threshold_root."
+                                           " Now=%d size=%d bits fix=%d\n",
+                                           inflate_threshold_root, tn->bits,
+                                           inflate_threshold_root_fix);
+                } else {
                         pr_warning("Fix inflate_threshold."
                                    " Now=%d size=%d bits\n",
                                    inflate_threshold, tn->bits);
-        }
+                }
+        } else if (max_resize > 3 && !tn->parent && inflate_threshold_root_fix)
+                inflate_threshold_root_fix--;
 
         check_tnode(tn);
 
@@ -1435,7 +1465,7 @@ static int fn_trie_lookup(struct fib_table *tb, const struct flowi *flp,
                         cindex = tkey_extract_bits(mask_pfx(key, current_prefix_length),
                                                    pos, bits);
 
-                n = tnode_get_child(pn, cindex);
+                n = tnode_get_child_rcu(pn, cindex);
 
                 if (n == NULL) {
 #ifdef CONFIG_IP_FIB_TRIE_STATS
@@ -1570,7 +1600,7 @@ backtrace:
                 if (chopped_off <= pn->bits) {
                         cindex &= ~(1 << (chopped_off-1));
                 } else {
-                        struct tnode *parent = node_parent((struct node *) pn);
+                        struct tnode *parent = node_parent_rcu((struct node *) pn);
                         if (!parent)
                                 goto failed;
 
@@ -1783,7 +1813,7 @@ static struct leaf *trie_firstleaf(struct trie *t)
 static struct leaf *trie_nextleaf(struct leaf *l)
 {
         struct node *c = (struct node *) l;
-        struct tnode *p = node_parent(c);
+        struct tnode *p = node_parent_rcu(c);
 
         if (!p)
                 return NULL;    /* trie with just one leaf */
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index cb4a0f4bd5e5..b902ef55be7f 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -821,7 +821,7 @@ static int ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
                         stats->tx_dropped++;
                         dev_kfree_skb(skb);
                         tunnel->recursion--;
-                        return 0;
+                        return NETDEV_TX_OK;
                 }
                 if (skb->sk)
                         skb_set_owner_w(new_skb, skb->sk);
@@ -889,7 +889,7 @@ static int ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
 
         IPTUNNEL_XMIT();
         tunnel->recursion--;
-        return 0;
+        return NETDEV_TX_OK;
 
 tx_error_icmp:
         dst_link_failure(skb);
@@ -898,7 +898,7 @@ tx_error:
         stats->tx_errors++;
         dev_kfree_skb(skb);
         tunnel->recursion--;
-        return 0;
+        return NETDEV_TX_OK;
 }
 
 static int ipgre_tunnel_bind_dev(struct net_device *dev)
diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c
index 93e2b787da20..98075b6d619c 100644
--- a/net/ipv4/ipip.c
+++ b/net/ipv4/ipip.c
@@ -486,7 +486,7 @@ static int ipip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
                         stats->tx_dropped++;
                         dev_kfree_skb(skb);
                         tunnel->recursion--;
-                        return 0;
+                        return NETDEV_TX_OK;
                 }
                 if (skb->sk)
                         skb_set_owner_w(new_skb, skb->sk);
@@ -524,7 +524,7 @@ static int ipip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
 
         IPTUNNEL_XMIT();
         tunnel->recursion--;
-        return 0;
+        return NETDEV_TX_OK;
 
 tx_error_icmp:
         dst_link_failure(skb);
@@ -532,7 +532,7 @@ tx_error:
         stats->tx_errors++;
         dev_kfree_skb(skb);
         tunnel->recursion--;
-        return 0;
+        return NETDEV_TX_OK;
 }
 
 static void ipip_tunnel_bind_dev(struct net_device *dev)
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index 9a8da5ed92b7..06c33fb6b321 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -212,7 +212,7 @@ static int reg_vif_xmit(struct sk_buff *skb, struct net_device *dev)
                           IGMPMSG_WHOLEPKT);
         read_unlock(&mrt_lock);
         kfree_skb(skb);
-        return 0;
+        return NETDEV_TX_OK;
 }
 
 static const struct net_device_ops reg_vif_netdev_ops = {
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 278f46f5011b..fafbe163e2b5 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -3442,7 +3442,7 @@ int __init ip_rt_init(void)
                 printk(KERN_ERR "Unable to create route proc files\n");
 #ifdef CONFIG_XFRM
         xfrm_init();
-        xfrm4_init();
+        xfrm4_init(ip_rt_max_size);
 #endif
         rtnl_register(PF_INET, RTM_GETROUTE, inet_rtm_getroute, NULL);
 
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index bd62712848fa..4e004424d400 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -59,6 +59,7 @@ int sysctl_tcp_base_mss __read_mostly = 512;
 /* By default, RFC2861 behavior.  */
 int sysctl_tcp_slow_start_after_idle __read_mostly = 1;
 
+/* Account for new data that has been sent to the network. */
 static void tcp_event_new_data_sent(struct sock *sk, struct sk_buff *skb)
 {
         struct tcp_sock *tp = tcp_sk(sk);
@@ -142,6 +143,7 @@ static void tcp_cwnd_restart(struct sock *sk, struct dst_entry *dst)
         tp->snd_cwnd_used = 0;
 }
 
+/* Congestion state accounting after a packet has been sent. */
 static void tcp_event_data_sent(struct tcp_sock *tp,
                                 struct sk_buff *skb, struct sock *sk)
 {
@@ -161,6 +163,7 @@ static void tcp_event_data_sent(struct tcp_sock *tp,
                 icsk->icsk_ack.pingpong = 1;
 }
 
+/* Account for an ACK we sent. */
 static inline void tcp_event_ack_sent(struct sock *sk, unsigned int pkts)
 {
         tcp_dec_quickack_mode(sk, pkts);
@@ -276,6 +279,7 @@ static u16 tcp_select_window(struct sock *sk)
         return new_win;
 }
 
+/* Packet ECN state for a SYN-ACK */
 static inline void TCP_ECN_send_synack(struct tcp_sock *tp, struct sk_buff *skb)
 {
         TCP_SKB_CB(skb)->flags &= ~TCPCB_FLAG_CWR;
@@ -283,6 +287,7 @@ static inline void TCP_ECN_send_synack(struct tcp_sock *tp, struct sk_buff *skb)
                 TCP_SKB_CB(skb)->flags &= ~TCPCB_FLAG_ECE;
 }
 
+/* Packet ECN state for a SYN.  */
 static inline void TCP_ECN_send_syn(struct sock *sk, struct sk_buff *skb)
 {
         struct tcp_sock *tp = tcp_sk(sk);
@@ -301,6 +306,9 @@ TCP_ECN_make_synack(struct request_sock *req, struct tcphdr *th)
                 th->ece = 1;
 }
 
+/* Set up ECN state for a packet on a ESTABLISHED socket that is about to
+ * be sent.
+ */
 static inline void TCP_ECN_send(struct sock *sk, struct sk_buff *skb,
                                 int tcp_header_len)
 {
@@ -362,7 +370,9 @@ struct tcp_out_options {
         __u32 tsval, tsecr;     /* need to include OPTION_TS */
 };
 
-/* Beware: Something in the Internet is very sensitive to the ordering of
+/* Write previously computed TCP options to the packet.
+ *
+ * Beware: Something in the Internet is very sensitive to the ordering of
  * TCP options, we learned this through the hard way, so be careful here.
  * Luckily we can at least blame others for their non-compliance but from
  * inter-operatibility perspective it seems that we're somewhat stuck with
@@ -445,6 +455,9 @@ static void tcp_options_write(__be32 *ptr, struct tcp_sock *tp,
         }
 }
 
+/* Compute TCP options for SYN packets. This is not the final
+ * network wire format yet.
+ */
 static unsigned tcp_syn_options(struct sock *sk, struct sk_buff *skb,
                                 struct tcp_out_options *opts,
                                 struct tcp_md5sig_key **md5) {
@@ -493,6 +506,7 @@ static unsigned tcp_syn_options(struct sock *sk, struct sk_buff *skb,
         return size;
 }
 
+/* Set up TCP options for SYN-ACKs. */
 static unsigned tcp_synack_options(struct sock *sk,
                                    struct request_sock *req,
                                    unsigned mss, struct sk_buff *skb,
@@ -541,6 +555,9 @@ static unsigned tcp_synack_options(struct sock *sk,
         return size;
 }
 
+/* Compute TCP options for ESTABLISHED sockets. This is not the
+ * final wire format yet.
+ */
 static unsigned tcp_established_options(struct sock *sk, struct sk_buff *skb,
                                         struct tcp_out_options *opts,
                                         struct tcp_md5sig_key **md5) {
@@ -705,7 +722,7 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it,
         return net_xmit_eval(err);
 }
 
-/* This routine just queue's the buffer
+/* This routine just queues the buffer for sending.
  *
  * NOTE: probe0 timer is not checked, do not forget tcp_push_pending_frames,
  * otherwise socket can stall.
@@ -722,6 +739,7 @@ static void tcp_queue_skb(struct sock *sk, struct sk_buff *skb)
         sk_mem_charge(sk, skb->truesize);
 }
 
+/* Initialize TSO segments for a packet. */
 static void tcp_set_skb_tso_segs(struct sock *sk, struct sk_buff *skb,
                                  unsigned int mss_now)
 {
@@ -909,6 +927,7 @@ static void __pskb_trim_head(struct sk_buff *skb, int len)
         skb->len = skb->data_len;
 }
 
+/* Remove acked data from a packet in the transmit queue. */
 int tcp_trim_head(struct sock *sk, struct sk_buff *skb, u32 len)
 {
         if (skb_cloned(skb) && pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
@@ -937,7 +956,7 @@ int tcp_trim_head(struct sock *sk, struct sk_buff *skb, u32 len)
         return 0;
 }
 
-/* Not accounting for SACKs here. */
+/* Calculate MSS. Not accounting for SACKs here.  */
 int tcp_mtu_to_mss(struct sock *sk, int pmtu)
 {
         struct tcp_sock *tp = tcp_sk(sk);
@@ -981,6 +1000,7 @@ int tcp_mss_to_mtu(struct sock *sk, int mss)
         return mtu;
 }
 
+/* MTU probing init per socket */
 void tcp_mtup_init(struct sock *sk)
 {
         struct tcp_sock *tp = tcp_sk(sk);
@@ -1143,7 +1163,8 @@ static inline unsigned int tcp_cwnd_test(struct tcp_sock *tp,
         return 0;
 }
 
-/* This must be invoked the first time we consider transmitting
+/* Intialize TSO state of a skb.
+ * This must be invoked the first time we consider transmitting
  * SKB onto the wire.
  */
 static int tcp_init_tso_segs(struct sock *sk, struct sk_buff *skb,
@@ -1158,6 +1179,7 @@ static int tcp_init_tso_segs(struct sock *sk, struct sk_buff *skb,
         return tso_segs;
 }
 
+/* Minshall's variant of the Nagle send check. */
 static inline int tcp_minshall_check(const struct tcp_sock *tp)
 {
         return after(tp->snd_sml, tp->snd_una) &&
@@ -1242,6 +1264,7 @@ static unsigned int tcp_snd_test(struct sock *sk, struct sk_buff *skb,
         return cwnd_quota;
 }
 
+/* Test if sending is allowed right now. */
 int tcp_may_send_now(struct sock *sk)
 {
         struct tcp_sock *tp = tcp_sk(sk);
@@ -1378,6 +1401,10 @@ send_now:
 }
 
 /* Create a new MTU probe if we are ready.
+ * MTU probe is regularly attempting to increase the path MTU by
+ * deliberately sending larger packets.  This discovers routing
+ * changes resulting in larger path MTUs.
+ *
  * Returns 0 if we should wait to probe (no cwnd available),
  *         1 if a probe was sent,
  *         -1 otherwise
@@ -1790,6 +1817,7 @@ static void tcp_collapse_retrans(struct sock *sk, struct sk_buff *skb)
         sk_wmem_free_skb(sk, next_skb);
 }
 
+/* Check if coalescing SKBs is legal. */
 static int tcp_can_collapse(struct sock *sk, struct sk_buff *skb)
 {
         if (tcp_skb_pcount(skb) > 1)
@@ -1808,6 +1836,9 @@ static int tcp_can_collapse(struct sock *sk, struct sk_buff *skb)
         return 1;
 }
 
+/* Collapse packets in the retransmit queue to make to create
+ * less packets on the wire. This is only done on retransmission.
+ */
 static void tcp_retrans_try_collapse(struct sock *sk, struct sk_buff *to,
                                      int space)
 {
@@ -1957,6 +1988,9 @@ int tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb)
         return err;
 }
 
+/* Check if we forward retransmits are possible in the current
+ * window/congestion state.
+ */
 static int tcp_can_forward_retransmit(struct sock *sk)
 {
         const struct inet_connection_sock *icsk = inet_csk(sk);
@@ -2145,7 +2179,8 @@ void tcp_send_active_reset(struct sock *sk, gfp_t priority)
         TCP_INC_STATS(sock_net(sk), TCP_MIB_OUTRSTS);
 }
 
-/* WARNING: This routine must only be called when we have already sent
+/* Send a crossed SYN-ACK during socket establishment.
+ * WARNING: This routine must only be called when we have already sent
  * a SYN packet that crossed the incoming SYN that caused this routine
  * to get called. If this assumption fails then the initial rcv_wnd
  * and rcv_wscale values will not be correct.
@@ -2180,9 +2215,7 @@ int tcp_send_synack(struct sock *sk)
         return tcp_transmit_skb(sk, skb, 1, GFP_ATOMIC);
 }
 
-/*
- * Prepare a SYN-ACK.
- */
+/* Prepare a SYN-ACK. */
 struct sk_buff *tcp_make_synack(struct sock *sk, struct dst_entry *dst,
                                 struct request_sock *req)
 {
@@ -2269,9 +2302,7 @@ struct sk_buff *tcp_make_synack(struct sock *sk, struct dst_entry *dst,
         return skb;
 }
 
-/*
- * Do all connect socket setups that can be done AF independent.
- */
+/* Do all connect socket setups that can be done AF independent. */
 static void tcp_connect_init(struct sock *sk)
 {
         struct dst_entry *dst = __sk_dst_get(sk);
@@ -2330,9 +2361,7 @@ static void tcp_connect_init(struct sock *sk)
         tcp_clear_retrans(tp);
 }
 
-/*
- * Build a SYN and send it off.
- */
+/* Build a SYN and send it off. */
 int tcp_connect(struct sock *sk)
 {
         struct tcp_sock *tp = tcp_sk(sk);
@@ -2493,6 +2522,7 @@ static int tcp_xmit_probe_skb(struct sock *sk, int urgent)
         return tcp_transmit_skb(sk, skb, 0, GFP_ATOMIC);
 }
 
+/* Initiate keepalive or window probe from timer. */
 int tcp_write_wakeup(struct sock *sk)
 {
         struct tcp_sock *tp = tcp_sk(sk);
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 80e3812837ad..29ebb0d27a1e 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -110,11 +110,12 @@ struct udp_table udp_table;
 EXPORT_SYMBOL(udp_table);
 
 int sysctl_udp_mem[3] __read_mostly;
-int sysctl_udp_rmem_min __read_mostly;
-int sysctl_udp_wmem_min __read_mostly;
-
 EXPORT_SYMBOL(sysctl_udp_mem);
+
+int sysctl_udp_rmem_min __read_mostly;
 EXPORT_SYMBOL(sysctl_udp_rmem_min);
+
+int sysctl_udp_wmem_min __read_mostly;
 EXPORT_SYMBOL(sysctl_udp_wmem_min);
 
 atomic_t udp_memory_allocated;
@@ -158,7 +159,7 @@ static int udp_lib_lport_inuse(struct net *net, __u16 num,
  */
 int udp_lib_get_port(struct sock *sk, unsigned short snum,
                        int (*saddr_comp)(const struct sock *sk1,
-                                         const struct sock *sk2 )    )
+                                         const struct sock *sk2))
 {
         struct udp_hslot *hslot;
         struct udp_table *udptable = sk->sk_prot->h.udp_table;
@@ -221,14 +222,15 @@ fail_unlock:
 fail:
         return error;
 }
+EXPORT_SYMBOL(udp_lib_get_port);
 
 static int ipv4_rcv_saddr_equal(const struct sock *sk1, const struct sock *sk2)
 {
         struct inet_sock *inet1 = inet_sk(sk1), *inet2 = inet_sk(sk2);
 
-        return  ( !ipv6_only_sock(sk2)  &&
-                  (!inet1->rcv_saddr || !inet2->rcv_saddr ||
-                   inet1->rcv_saddr == inet2->rcv_saddr      ));
+        return  (!ipv6_only_sock(sk2)  &&
+                 (!inet1->rcv_saddr || !inet2->rcv_saddr ||
+                   inet1->rcv_saddr == inet2->rcv_saddr));
 }
 
 int udp_v4_get_port(struct sock *sk, unsigned short snum)
@@ -383,8 +385,8 @@ found:
 void __udp4_lib_err(struct sk_buff *skb, u32 info, struct udp_table *udptable)
 {
         struct inet_sock *inet;
-        struct iphdr *iph = (struct iphdr*)skb->data;
-        struct udphdr *uh = (struct udphdr*)(skb->data+(iph->ihl<<2));
+        struct iphdr *iph = (struct iphdr *)skb->data;
+        struct udphdr *uh = (struct udphdr *)(skb->data+(iph->ihl<<2));
         const int type = icmp_hdr(skb)->type;
         const int code = icmp_hdr(skb)->code;
         struct sock *sk;
@@ -439,7 +441,7 @@ void __udp4_lib_err(struct sk_buff *skb, u32 info, struct udp_table *udptable)
                 if (!harderr || sk->sk_state != TCP_ESTABLISHED)
                         goto out;
         } else {
-                ip_icmp_error(sk, skb, err, uh->dest, info, (u8*)(uh+1));
+                ip_icmp_error(sk, skb, err, uh->dest, info, (u8 *)(uh+1));
         }
         sk->sk_err = err;
         sk->sk_error_report(sk);
@@ -474,7 +476,7 @@ EXPORT_SYMBOL(udp_flush_pending_frames);
  *              (checksum field must be zeroed out)
  */
 static void udp4_hwcsum_outgoing(struct sock *sk, struct sk_buff *skb,
-                                 __be32 src, __be32 dst, int len      )
+                                 __be32 src, __be32 dst, int len)
 {
         unsigned int offset;
         struct udphdr *uh = udp_hdr(skb);
@@ -545,7 +547,7 @@ static int udp_push_pending_frames(struct sock *sk)
 
         } else if (skb->ip_summed == CHECKSUM_PARTIAL) { /* UDP hardware csum */
 
-                udp4_hwcsum_outgoing(sk, skb, fl->fl4_src,fl->fl4_dst, up->len);
+                udp4_hwcsum_outgoing(sk, skb, fl->fl4_src, fl->fl4_dst, up->len);
                 goto send;
 
         } else                                           /*   `normal' UDP    */
@@ -553,7 +555,7 @@ static int udp_push_pending_frames(struct sock *sk)
 
         /* add protocol-dependent pseudo-header */
         uh->check = csum_tcpudp_magic(fl->fl4_src, fl->fl4_dst, up->len,
-                                      sk->sk_protocol, csum             );
+                                      sk->sk_protocol, csum);
         if (uh->check == 0)
                 uh->check = CSUM_MANGLED_0;
 
@@ -592,7 +594,7 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
          *      Check the flags.
          */
 
-        if (msg->msg_flags&MSG_OOB)     /* Mirror BSD error message compatibility */
+        if (msg->msg_flags & MSG_OOB) /* Mirror BSD error message compatibility */
                 return -EOPNOTSUPP;
 
         ipc.opt = NULL;
@@ -619,7 +621,7 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
          *      Get and verify the address.
          */
         if (msg->msg_name) {
-                struct sockaddr_in * usin = (struct sockaddr_in*)msg->msg_name;
+                struct sockaddr_in * usin = (struct sockaddr_in *)msg->msg_name;
                 if (msg->msg_namelen < sizeof(*usin))
                         return -EINVAL;
                 if (usin->sin_family != AF_INET) {
@@ -684,7 +686,7 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
         }
 
         if (connected)
-                rt = (struct rtable*)sk_dst_check(sk, 0);
+                rt = (struct rtable *)sk_dst_check(sk, 0);
 
         if (rt == NULL) {
                 struct flowi fl = { .oif = ipc.oif,
@@ -782,6 +784,7 @@ do_confirm:
         err = 0;
         goto out;
 }
+EXPORT_SYMBOL(udp_sendmsg);
 
 int udp_sendpage(struct sock *sk, struct page *page, int offset,
                  size_t size, int flags)
@@ -871,6 +874,7 @@ int udp_ioctl(struct sock *sk, int cmd, unsigned long arg)
 
         return 0;
 }
+EXPORT_SYMBOL(udp_ioctl);
 
 /*
  *      This should be easy, if there is something there we
@@ -892,7 +896,7 @@ int udp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
          *      Check any passed addresses
          */
         if (addr_len)
-                *addr_len=sizeof(*sin);
+                *addr_len = sizeof(*sin);
 
         if (flags & MSG_ERRQUEUE)
                 return ip_recv_error(sk, msg, len);
@@ -923,9 +927,11 @@ try_again:
 
         if (skb_csum_unnecessary(skb))
                 err = skb_copy_datagram_iovec(skb, sizeof(struct udphdr),
-                                              msg->msg_iov, copied       );
+                                              msg->msg_iov, copied);
         else {
-                err = skb_copy_and_csum_datagram_iovec(skb, sizeof(struct udphdr), msg->msg_iov);
+                err = skb_copy_and_csum_datagram_iovec(skb,
+                                                       sizeof(struct udphdr),
+                                                       msg->msg_iov);
 
                 if (err == -EINVAL)
                         goto csum_copy_err;
@@ -941,8 +947,7 @@ try_again:
         sock_recv_timestamp(msg, sk, skb);
 
         /* Copy the address. */
-        if (sin)
-        {
+        if (sin) {
                 sin->sin_family = AF_INET;
                 sin->sin_port = udp_hdr(skb)->source;
                 sin->sin_addr.s_addr = ip_hdr(skb)->saddr;
@@ -995,6 +1000,7 @@ int udp_disconnect(struct sock *sk, int flags)
         sk_dst_reset(sk);
         return 0;
 }
+EXPORT_SYMBOL(udp_disconnect);
 
 void udp_lib_unhash(struct sock *sk)
 {
@@ -1044,7 +1050,7 @@ drop:
  * Note that in the success and error cases, the skb is assumed to
  * have either been requeued or freed.
  */
-int udp_queue_rcv_skb(struct sock * sk, struct sk_buff *skb)
+int udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
 {
         struct udp_sock *up = udp_sk(sk);
         int rc;
@@ -1214,7 +1220,7 @@ static inline int udp4_csum_init(struct sk_buff *skb, struct udphdr *uh,
         if (uh->check == 0) {
                 skb->ip_summed = CHECKSUM_UNNECESSARY;
         } else if (skb->ip_summed == CHECKSUM_COMPLETE) {
-               if (!csum_tcpudp_magic(iph->saddr, iph->daddr, skb->len,
+                if (!csum_tcpudp_magic(iph->saddr, iph->daddr, skb->len,
                                       proto, skb->csum))
                         skb->ip_summed = CHECKSUM_UNNECESSARY;
         }
@@ -1355,7 +1361,7 @@ int udp_lib_setsockopt(struct sock *sk, int level, int optname,
         int err = 0;
         int is_udplite = IS_UDPLITE(sk);
 
-        if (optlen<sizeof(int))
+        if (optlen < sizeof(int))
                 return -EINVAL;
 
         if (get_user(val, (int __user *)optval))
@@ -1426,6 +1432,7 @@ int udp_lib_setsockopt(struct sock *sk, int level, int optname,
 
         return err;
 }
+EXPORT_SYMBOL(udp_lib_setsockopt);
 
 int udp_setsockopt(struct sock *sk, int level, int optname,
                    char __user *optval, int optlen)
@@ -1453,7 +1460,7 @@ int udp_lib_getsockopt(struct sock *sk, int level, int optname,
         struct udp_sock *up = udp_sk(sk);
         int val, len;
 
-        if (get_user(len,optlen))
+        if (get_user(len, optlen))
                 return -EFAULT;
 
         len = min_t(unsigned int, len, sizeof(int));
@@ -1486,10 +1493,11 @@ int udp_lib_getsockopt(struct sock *sk, int level, int optname,
 
         if (put_user(len, optlen))
                 return -EFAULT;
-        if (copy_to_user(optval, &val,len))
+        if (copy_to_user(optval, &val, len))
                 return -EFAULT;
         return 0;
 }
+EXPORT_SYMBOL(udp_lib_getsockopt);
 
 int udp_getsockopt(struct sock *sk, int level, int optname,
                    char __user *optval, int __user *optlen)
@@ -1528,9 +1536,9 @@ unsigned int udp_poll(struct file *file, struct socket *sock, poll_table *wait)
         int     is_lite = IS_UDPLITE(sk);
 
         /* Check for false positives due to checksum errors */
-        if ( (mask & POLLRDNORM) &&
-             !(file->f_flags & O_NONBLOCK) &&
-             !(sk->sk_shutdown & RCV_SHUTDOWN)){
+        if ((mask & POLLRDNORM) &&
+            !(file->f_flags & O_NONBLOCK) &&
+            !(sk->sk_shutdown & RCV_SHUTDOWN)) {
                 struct sk_buff_head *rcvq = &sk->sk_receive_queue;
                 struct sk_buff *skb;
 
@@ -1552,6 +1560,7 @@ unsigned int udp_poll(struct file *file, struct socket *sock, poll_table *wait)
         return mask;
 
 }
+EXPORT_SYMBOL(udp_poll);
 
 struct proto udp_prot = {
         .name              = "UDP",
@@ -1582,6 +1591,7 @@ struct proto udp_prot = {
         .compat_getsockopt = compat_udp_getsockopt,
 #endif
 };
+EXPORT_SYMBOL(udp_prot);
 
 /* ------------------------------------------------------------------------ */
 #ifdef CONFIG_PROC_FS
@@ -1703,11 +1713,13 @@ int udp_proc_register(struct net *net, struct udp_seq_afinfo *afinfo)
                 rc = -ENOMEM;
         return rc;
 }
+EXPORT_SYMBOL(udp_proc_register);
 
 void udp_proc_unregister(struct net *net, struct udp_seq_afinfo *afinfo)
 {
         proc_net_remove(net, afinfo->name);
 }
+EXPORT_SYMBOL(udp_proc_unregister);
 
 /* ------------------------------------------------------------------------ */
 static void udp4_format_sock(struct sock *sp, struct seq_file *f,
@@ -1741,7 +1753,7 @@ int udp4_seq_show(struct seq_file *seq, void *v)
                 int len;
 
                 udp4_format_sock(v, seq, state->bucket, &len);
-                seq_printf(seq, "%*s\n", 127 - len ,"");
+                seq_printf(seq, "%*s\n", 127 - len, "");
         }
         return 0;
 }
@@ -1816,16 +1828,64 @@ void __init udp_init(void)
         sysctl_udp_wmem_min = SK_MEM_QUANTUM;
 }
 
-EXPORT_SYMBOL(udp_disconnect);
-EXPORT_SYMBOL(udp_ioctl);
-EXPORT_SYMBOL(udp_prot);
-EXPORT_SYMBOL(udp_sendmsg);
-EXPORT_SYMBOL(udp_lib_getsockopt);
-EXPORT_SYMBOL(udp_lib_setsockopt);
-EXPORT_SYMBOL(udp_poll);
-EXPORT_SYMBOL(udp_lib_get_port);
+int udp4_ufo_send_check(struct sk_buff *skb)
+{
+        const struct iphdr *iph;
+        struct udphdr *uh;
+
+        if (!pskb_may_pull(skb, sizeof(*uh)))
+                return -EINVAL;
+
+        iph = ip_hdr(skb);
+        uh = udp_hdr(skb);
+
+        uh->check = ~csum_tcpudp_magic(iph->saddr, iph->daddr, skb->len,
+                                       IPPROTO_UDP, 0);
+        skb->csum_start = skb_transport_header(skb) - skb->head;
+        skb->csum_offset = offsetof(struct udphdr, check);
+        skb->ip_summed = CHECKSUM_PARTIAL;
+        return 0;
+}
+
+struct sk_buff *udp4_ufo_fragment(struct sk_buff *skb, int features)
+{
+        struct sk_buff *segs = ERR_PTR(-EINVAL);
+        unsigned int mss;
+        int offset;
+        __wsum csum;
+
+        mss = skb_shinfo(skb)->gso_size;
+        if (unlikely(skb->len <= mss))
+                goto out;
+
+        if (skb_gso_ok(skb, features | NETIF_F_GSO_ROBUST)) {
+                /* Packet is from an untrusted source, reset gso_segs. */
+                int type = skb_shinfo(skb)->gso_type;
+
+                if (unlikely(type & ~(SKB_GSO_UDP | SKB_GSO_DODGY) ||
+                             !(type & (SKB_GSO_UDP))))
+                        goto out;
+
+                skb_shinfo(skb)->gso_segs = DIV_ROUND_UP(skb->len, mss);
+
+                segs = NULL;
+                goto out;
+        }
+
+        /* Do software UFO. Complete and fill in the UDP checksum as HW cannot
+         * do checksum of UDP packets sent as multiple IP fragments.
+         */
+        offset = skb->csum_start - skb_headroom(skb);
+        csum = skb_checksum(skb, offset, skb->len - offset, 0);
+        offset += skb->csum_offset;
+        *(__sum16 *)(skb->data + offset) = csum_fold(csum);
+        skb->ip_summed = CHECKSUM_NONE;
+
+        /* Fragment the skb. IP headers of the fragments are updated in
+         * inet_gso_segment()
+         */
+        segs = skb_segment(skb, features);
+out:
+        return segs;
+}
 
-#ifdef CONFIG_PROC_FS
-EXPORT_SYMBOL(udp_proc_register);
-EXPORT_SYMBOL(udp_proc_unregister);
-#endif
diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
index 0071ee6f441f..1ba44742ebbf 100644
--- a/net/ipv4/xfrm4_policy.c
+++ b/net/ipv4/xfrm4_policy.c
@@ -264,6 +264,20 @@ static struct xfrm_policy_afinfo xfrm4_policy_afinfo = {
         .fill_dst =             xfrm4_fill_dst,
 };
 
+static struct ctl_table xfrm4_policy_table[] = {
+        {
+                .ctl_name       = CTL_UNNUMBERED,
+                .procname       = "xfrm4_gc_thresh",
+                .data           = &xfrm4_dst_ops.gc_thresh,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec,
+        },
+        { }
+};
+
+static struct ctl_table_header *sysctl_hdr;
+
 static void __init xfrm4_policy_init(void)
 {
         xfrm_policy_register_afinfo(&xfrm4_policy_afinfo);
@@ -271,12 +285,27 @@ static void __init xfrm4_policy_init(void)
 
 static void __exit xfrm4_policy_fini(void)
 {
+        if (sysctl_hdr)
+                unregister_net_sysctl_table(sysctl_hdr);
         xfrm_policy_unregister_afinfo(&xfrm4_policy_afinfo);
 }
 
-void __init xfrm4_init(void)
+void __init xfrm4_init(int rt_max_size)
 {
         xfrm4_state_init();
         xfrm4_policy_init();
+        /*
+         * Select a default value for the gc_thresh based on the main route
+         * table hash size.  It seems to me the worst case scenario is when
+         * we have ipsec operating in transport mode, in which we create a
+         * dst_entry per socket.  The xfrm gc algorithm starts trying to remove
+         * entries at gc_thresh, and prevents new allocations as 2*gc_thresh
+         * so lets set an initial xfrm gc_thresh value at the rt_max_size/2.
+         * That will let us store an ipsec connection per route table entry,
+         * and start cleaning when were 1/2 full
+         */
+        xfrm4_dst_ops.gc_thresh = rt_max_size/2;
+        sysctl_hdr = register_net_sysctl_table(&init_net, net_ipv4_ctl_path,
+                                                xfrm4_policy_table);
 }
 
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index caa0278d30a9..bf85d5f97032 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -772,6 +772,11 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb, int features)
         struct sk_buff *segs = ERR_PTR(-EINVAL);
         struct ipv6hdr *ipv6h;
         struct inet6_protocol *ops;
+        int proto;
+        struct frag_hdr *fptr;
+        unsigned int unfrag_ip6hlen;
+        u8 *prevhdr;
+        int offset = 0;
 
         if (!(features & NETIF_F_V6_CSUM))
                 features &= ~NETIF_F_SG;
@@ -791,10 +796,9 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb, int features)
         __skb_pull(skb, sizeof(*ipv6h));
         segs = ERR_PTR(-EPROTONOSUPPORT);
 
+        proto = ipv6_gso_pull_exthdrs(skb, ipv6h->nexthdr);
         rcu_read_lock();
-        ops = rcu_dereference(inet6_protos[
-                ipv6_gso_pull_exthdrs(skb, ipv6h->nexthdr)]);
-
+        ops = rcu_dereference(inet6_protos[proto]);
         if (likely(ops && ops->gso_segment)) {
                 skb_reset_transport_header(skb);
                 segs = ops->gso_segment(skb, features);
@@ -808,6 +812,16 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb, int features)
                 ipv6h = ipv6_hdr(skb);
                 ipv6h->payload_len = htons(skb->len - skb->mac_len -
                                            sizeof(*ipv6h));
+                if (proto == IPPROTO_UDP) {
+                        unfrag_ip6hlen = ip6_find_1stfragopt(skb, &prevhdr);
+                        fptr = (struct frag_hdr *)(skb_network_header(skb) +
+                                unfrag_ip6hlen);
+                        fptr->frag_off = htons(offset);
+                        if (skb->next != NULL)
+                                fptr->frag_off |= htons(IP6_MF);
+                        offset += (ntohs(ipv6h->payload_len) -
+                                   sizeof(struct frag_hdr));
+                }
         }
 
 out:
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 52ee1dced2ff..0e93ca56eb69 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -164,12 +164,6 @@ static __inline__ void rt6_release(struct rt6_info *rt)
                 dst_free(&rt->u.dst);
 }
 
-#ifdef CONFIG_IPV6_MULTIPLE_TABLES
-#define FIB_TABLE_HASHSZ 256
-#else
-#define FIB_TABLE_HASHSZ 1
-#endif
-
 static void fib6_link_table(struct net *net, struct fib6_table *tb)
 {
         unsigned int h;
@@ -180,7 +174,7 @@ static void fib6_link_table(struct net *net, struct fib6_table *tb)
          */
         rwlock_init(&tb->tb6_lock);
 
-        h = tb->tb6_id & (FIB_TABLE_HASHSZ - 1);
+        h = tb->tb6_id & (FIB6_TABLE_HASHSZ - 1);
 
         /*
          * No protection necessary, this is the only list mutatation
@@ -231,7 +225,7 @@ struct fib6_table *fib6_get_table(struct net *net, u32 id)
 
         if (id == 0)
                 id = RT6_TABLE_MAIN;
-        h = id & (FIB_TABLE_HASHSZ - 1);
+        h = id & (FIB6_TABLE_HASHSZ - 1);
         rcu_read_lock();
         head = &net->ipv6.fib_table_hash[h];
         hlist_for_each_entry_rcu(tb, node, head, tb6_hlist) {
@@ -382,7 +376,7 @@ static int inet6_dump_fib(struct sk_buff *skb, struct netlink_callback *cb)
         arg.net = net;
         w->args = &arg;
 
-        for (h = s_h; h < FIB_TABLE_HASHSZ; h++, s_e = 0) {
+        for (h = s_h; h < FIB6_TABLE_HASHSZ; h++, s_e = 0) {
                 e = 0;
                 head = &net->ipv6.fib_table_hash[h];
                 hlist_for_each_entry(tb, node, head, tb6_hlist) {
@@ -1368,7 +1362,7 @@ void fib6_clean_all(struct net *net, int (*func)(struct rt6_info *, void *arg),
         unsigned int h;
 
         rcu_read_lock();
-        for (h = 0; h < FIB_TABLE_HASHSZ; h++) {
+        for (h = 0; h < FIB6_TABLE_HASHSZ; h++) {
                 head = &net->ipv6.fib_table_hash[h];
                 hlist_for_each_entry_rcu(table, node, head, tb6_hlist) {
                         write_lock_bh(&table->tb6_lock);
@@ -1483,7 +1477,7 @@ static int fib6_net_init(struct net *net)
         if (!net->ipv6.rt6_stats)
                 goto out_timer;
 
-        net->ipv6.fib_table_hash = kcalloc(FIB_TABLE_HASHSZ,
+        net->ipv6.fib_table_hash = kcalloc(FIB6_TABLE_HASHSZ,
                                            sizeof(*net->ipv6.fib_table_hash),
                                            GFP_KERNEL);
         if (!net->ipv6.fib_table_hash)
diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
index 6d6a4277c677..2d9cbaa67edb 100644
--- a/net/ipv6/ip6_input.c
+++ b/net/ipv6/ip6_input.c
@@ -63,7 +63,7 @@ int ipv6_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt
 
         if (skb->pkt_type == PACKET_OTHERHOST) {
                 kfree_skb(skb);
-                return 0;
+                return NET_RX_DROP;
         }
 
         rcu_read_lock();
@@ -133,7 +133,7 @@ int ipv6_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt
                 if (ipv6_parse_hopopts(skb) < 0) {
                         IP6_INC_STATS_BH(net, idev, IPSTATS_MIB_INHDRERRORS);
                         rcu_read_unlock();
-                        return 0;
+                        return NET_RX_DROP;
                 }
         }
 
@@ -149,7 +149,7 @@ err:
 drop:
         rcu_read_unlock();
         kfree_skb(skb);
-        return 0;
+        return NET_RX_DROP;
 }
 
 /*
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 87f8419a68fd..93beee944657 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -57,18 +57,6 @@
 
 static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *));
 
-static __inline__ void ipv6_select_ident(struct sk_buff *skb, struct frag_hdr *fhdr)
-{
-        static u32 ipv6_fragmentation_id = 1;
-        static DEFINE_SPINLOCK(ip6_id_lock);
-
-        spin_lock_bh(&ip6_id_lock);
-        fhdr->identification = htonl(ipv6_fragmentation_id);
-        if (++ipv6_fragmentation_id == 0)
-                ipv6_fragmentation_id = 1;
-        spin_unlock_bh(&ip6_id_lock);
-}
-
 int __ip6_local_out(struct sk_buff *skb)
 {
         int len;
@@ -706,7 +694,7 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
                 skb_reset_network_header(skb);
                 memcpy(skb_network_header(skb), tmp_hdr, hlen);
 
-                ipv6_select_ident(skb, fh);
+                ipv6_select_ident(fh);
                 fh->nexthdr = nexthdr;
                 fh->reserved = 0;
                 fh->frag_off = htons(IP6_MF);
@@ -844,7 +832,7 @@ slow_path:
                 fh->nexthdr = nexthdr;
                 fh->reserved = 0;
                 if (!frag_id) {
-                        ipv6_select_ident(skb, fh);
+                        ipv6_select_ident(fh);
                         frag_id = fh->identification;
                 } else
                         fh->identification = frag_id;
@@ -1087,11 +1075,13 @@ static inline int ip6_ufo_append_data(struct sock *sk,
         if (!err) {
                 struct frag_hdr fhdr;
 
-                /* specify the length of each IP datagram fragment*/
-                skb_shinfo(skb)->gso_size = mtu - fragheaderlen -
-                                            sizeof(struct frag_hdr);
+                /* Specify the length of each IPv6 datagram fragment.
+                 * It has to be a multiple of 8.
+                 */
+                skb_shinfo(skb)->gso_size = (mtu - fragheaderlen -
+                                             sizeof(struct frag_hdr)) & ~7;
                 skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
-                ipv6_select_ident(skb, &fhdr);
+                ipv6_select_ident(&fhdr);
                 skb_shinfo(skb)->ip6_frag_id = fhdr.identification;
                 __skb_queue_tail(&sk->sk_write_queue, skb);
 
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 51f410e7775a..a1d6045c4694 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -1063,14 +1063,14 @@ ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
                 goto tx_err;
 
         t->recursion--;
-        return 0;
+        return NETDEV_TX_OK;
 
 tx_err:
         stats->tx_errors++;
         stats->tx_dropped++;
         kfree_skb(skb);
         t->recursion--;
-        return 0;
+        return NETDEV_TX_OK;
 }
 
 static void ip6_tnl_set_cap(struct ip6_tnl *t)
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index c769f155c698..07ded5075b33 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -427,7 +427,7 @@ static int reg_vif_xmit(struct sk_buff *skb, struct net_device *dev)
                            MRT6MSG_WHOLEPKT);
         read_unlock(&mrt_lock);
         kfree_skb(skb);
-        return 0;
+        return NETDEV_TX_OK;
 }
 
 static const struct net_device_ops reg_vif_netdev_ops = {
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index 4b264ed40a8c..71c3dacec1ed 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -2107,7 +2107,6 @@ static int ip6_mc_add_src(struct inet6_dev *idev, struct in6_addr *pmca,
                 for (j=0; j<i; j++)
                         (void) ip6_mc_del1_src(pmc, sfmode, &psfsrc[i]);
         } else if (isexclude != (pmc->mca_sfcount[MCAST_EXCLUDE] != 0)) {
-                struct inet6_dev *idev = pmc->idev;
                 struct ip6_sf_list *psf;
 
                 /* filter mode change */
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 98b7327d0949..d335a306a4db 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -753,7 +753,7 @@ static int ipip6_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
                         stats->tx_dropped++;
                         dev_kfree_skb(skb);
                         tunnel->recursion--;
-                        return 0;
+                        return NETDEV_TX_OK;
                 }
                 if (skb->sk)
                         skb_set_owner_w(new_skb, skb->sk);
@@ -794,7 +794,7 @@ static int ipip6_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
 
         IPTUNNEL_XMIT();
         tunnel->recursion--;
-        return 0;
+        return NETDEV_TX_OK;
 
 tx_error_icmp:
         dst_link_failure(skb);
@@ -802,7 +802,7 @@ tx_error:
         stats->tx_errors++;
         dev_kfree_skb(skb);
         tunnel->recursion--;
-        return 0;
+        return NETDEV_TX_OK;
 }
 
 static void ipip6_tunnel_bind_dev(struct net_device *dev)
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 33b59bd92c4d..d79fa6724451 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -638,6 +638,47 @@ static void udp_v6_flush_pending_frames(struct sock *sk)
         }
 }
 
+/**
+ *      udp6_hwcsum_outgoing  -  handle outgoing HW checksumming
+ *      @sk:    socket we are sending on
+ *      @skb:   sk_buff containing the filled-in UDP header
+ *              (checksum field must be zeroed out)
+ */
+static void udp6_hwcsum_outgoing(struct sock *sk, struct sk_buff *skb,
+                                 const struct in6_addr *saddr,
+                                 const struct in6_addr *daddr, int len)
+{
+        unsigned int offset;
+        struct udphdr *uh = udp_hdr(skb);
+        __wsum csum = 0;
+
+        if (skb_queue_len(&sk->sk_write_queue) == 1) {
+                /* Only one fragment on the socket.  */
+                skb->csum_start = skb_transport_header(skb) - skb->head;
+                skb->csum_offset = offsetof(struct udphdr, check);
+                uh->check = ~csum_ipv6_magic(saddr, daddr, len, IPPROTO_UDP, 0);
+        } else {
+                /*
+                 * HW-checksum won't work as there are two or more
+                 * fragments on the socket so that all csums of sk_buffs
+                 * should be together
+                 */
+                offset = skb_transport_offset(skb);
+                skb->csum = skb_checksum(skb, offset, skb->len - offset, 0);
+
+                skb->ip_summed = CHECKSUM_NONE;
+
+                skb_queue_walk(&sk->sk_write_queue, skb) {
+                        csum = csum_add(csum, skb->csum);
+                }
+
+                uh->check = csum_ipv6_magic(saddr, daddr, len, IPPROTO_UDP,
+                                            csum);
+                if (uh->check == 0)
+                        uh->check = CSUM_MANGLED_0;
+        }
+}
+
 /*
  *      Sending
  */
@@ -668,7 +709,11 @@ static int udp_v6_push_pending_frames(struct sock *sk)
 
         if (is_udplite)
                 csum = udplite_csum_outgoing(sk, skb);
-         else
+        else if (skb->ip_summed == CHECKSUM_PARTIAL) { /* UDP hardware csum */
+                udp6_hwcsum_outgoing(sk, skb, &fl->fl6_src, &fl->fl6_dst,
+                                     up->len);
+                goto send;
+        } else
                 csum = udp_csum_outgoing(sk, skb);
 
         /* add protocol-dependent pseudo-header */
@@ -677,6 +722,7 @@ static int udp_v6_push_pending_frames(struct sock *sk)
         if (uh->check == 0)
                 uh->check = CSUM_MANGLED_0;
 
+send:
         err = ip6_push_pending_frames(sk);
 out:
         up->len = 0;
@@ -1032,9 +1078,102 @@ int compat_udpv6_getsockopt(struct sock *sk, int level, int optname,
 }
 #endif
 
+static int udp6_ufo_send_check(struct sk_buff *skb)
+{
+        struct ipv6hdr *ipv6h;
+        struct udphdr *uh;
+
+        if (!pskb_may_pull(skb, sizeof(*uh)))
+                return -EINVAL;
+
+        ipv6h = ipv6_hdr(skb);
+        uh = udp_hdr(skb);
+
+        uh->check = ~csum_ipv6_magic(&ipv6h->saddr, &ipv6h->daddr, skb->len,
+                                     IPPROTO_UDP, 0);
+        skb->csum_start = skb_transport_header(skb) - skb->head;
+        skb->csum_offset = offsetof(struct udphdr, check);
+        skb->ip_summed = CHECKSUM_PARTIAL;
+        return 0;
+}
+
+static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb, int features)
+{
+        struct sk_buff *segs = ERR_PTR(-EINVAL);
+        unsigned int mss;
+        unsigned int unfrag_ip6hlen, unfrag_len;
+        struct frag_hdr *fptr;
+        u8 *mac_start, *prevhdr;
+        u8 nexthdr;
+        u8 frag_hdr_sz = sizeof(struct frag_hdr);
+        int offset;
+        __wsum csum;
+
+        mss = skb_shinfo(skb)->gso_size;
+        if (unlikely(skb->len <= mss))
+                goto out;
+
+        if (skb_gso_ok(skb, features | NETIF_F_GSO_ROBUST)) {
+                /* Packet is from an untrusted source, reset gso_segs. */
+                int type = skb_shinfo(skb)->gso_type;
+
+                if (unlikely(type & ~(SKB_GSO_UDP | SKB_GSO_DODGY) ||
+                             !(type & (SKB_GSO_UDP))))
+                        goto out;
+
+                skb_shinfo(skb)->gso_segs = DIV_ROUND_UP(skb->len, mss);
+
+                segs = NULL;
+                goto out;
+        }
+
+        /* Do software UFO. Complete and fill in the UDP checksum as HW cannot
+         * do checksum of UDP packets sent as multiple IP fragments.
+         */
+        offset = skb->csum_start - skb_headroom(skb);
+        csum = skb_checksum(skb, offset, skb->len- offset, 0);
+        offset += skb->csum_offset;
+        *(__sum16 *)(skb->data + offset) = csum_fold(csum);
+        skb->ip_summed = CHECKSUM_NONE;
+
+        /* Check if there is enough headroom to insert fragment header. */
+        if ((skb_headroom(skb) < frag_hdr_sz) &&
+            pskb_expand_head(skb, frag_hdr_sz, 0, GFP_ATOMIC))
+                goto out;
+
+        /* Find the unfragmentable header and shift it left by frag_hdr_sz
+         * bytes to insert fragment header.
+         */
+        unfrag_ip6hlen = ip6_find_1stfragopt(skb, &prevhdr);
+        nexthdr = *prevhdr;
+        *prevhdr = NEXTHDR_FRAGMENT;
+        unfrag_len = skb_network_header(skb) - skb_mac_header(skb) +
+                     unfrag_ip6hlen;
+        mac_start = skb_mac_header(skb);
+        memmove(mac_start-frag_hdr_sz, mac_start, unfrag_len);
+
+        skb->mac_header -= frag_hdr_sz;
+        skb->network_header -= frag_hdr_sz;
+
+        fptr = (struct frag_hdr *)(skb_network_header(skb) + unfrag_ip6hlen);
+        fptr->nexthdr = nexthdr;
+        fptr->reserved = 0;
+        ipv6_select_ident(fptr);
+
+        /* Fragment the skb. ipv6 header and the remaining fields of the
+         * fragment header are updated in ipv6_gso_segment()
+         */
+        segs = skb_segment(skb, features);
+
+out:
+        return segs;
+}
+
 static struct inet6_protocol udpv6_protocol = {
         .handler        =       udpv6_rcv,
         .err_handler    =       udpv6_err,
+        .gso_send_check =       udp6_ufo_send_check,
+        .gso_segment    =       udp6_ufo_fragment,
         .flags          =       INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
 };
 
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 3a3c677bc0f2..611cffcf554f 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -306,9 +306,24 @@ static void xfrm6_policy_fini(void)
         xfrm_policy_unregister_afinfo(&xfrm6_policy_afinfo);
 }
 
+static struct ctl_table xfrm6_policy_table[] = {
+        {
+                .ctl_name       = CTL_UNNUMBERED,
+                .procname       = "xfrm6_gc_thresh",
+                .data           = &xfrm6_dst_ops.gc_thresh,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec,
+        },
+        { }
+};
+
+static struct ctl_table_header *sysctl_hdr;
+
 int __init xfrm6_init(void)
 {
         int ret;
+        unsigned int gc_thresh;
 
         ret = xfrm6_policy_init();
         if (ret)
@@ -317,6 +332,22 @@ int __init xfrm6_init(void)
         ret = xfrm6_state_init();
         if (ret)
                 goto out_policy;
+        /*
+         * We need a good default value for the xfrm6 gc threshold.
+         * In ipv4 we set it to the route hash table size * 8, which
+         * is half the size of the maximaum route cache for ipv4.  It
+         * would be good to do the same thing for v6, except the table is
+         * constructed differently here.  Here each table for a net namespace
+         * can have FIB_TABLE_HASHSZ entries, so lets go with the same
+         * computation that we used for ipv4 here.  Also, lets keep the initial
+         * gc_thresh to a minimum of 1024, since, the ipv6 route cache defaults
+         * to that as a minimum as well
+         */
+        gc_thresh = FIB6_TABLE_HASHSZ * 8;
+        xfrm6_dst_ops.gc_thresh = (gc_thresh < 1024) ? 1024 : gc_thresh;
+
+        sysctl_hdr = register_net_sysctl_table(&init_net, net_ipv6_ctl_path,
+                                                xfrm6_policy_table);
 out:
         return ret;
 out_policy:
@@ -326,6 +357,8 @@ out_policy:
 
 void xfrm6_fini(void)
 {
+        if (sysctl_hdr)
+                unregister_net_sysctl_table(sysctl_hdr);
         //xfrm6_input_fini();
         xfrm6_policy_fini();
         xfrm6_state_fini();
diff --git a/net/irda/irlan/irlan_eth.c b/net/irda/irlan/irlan_eth.c
index 724bcf951b80..64230cffcfee 100644
--- a/net/irda/irlan/irlan_eth.c
+++ b/net/irda/irlan/irlan_eth.c
@@ -177,7 +177,7 @@ static int irlan_eth_xmit(struct sk_buff *skb, struct net_device *dev)
 
                 /* Did the realloc succeed? */
                 if (new_skb == NULL)
-                        return 0;
+                        return NETDEV_TX_OK;
 
                 /* Use the new skb instead */
                 skb = new_skb;
@@ -209,7 +209,7 @@ static int irlan_eth_xmit(struct sk_buff *skb, struct net_device *dev)
                 self->stats.tx_bytes += skb->len;
         }
 
-        return 0;
+        return NETDEV_TX_OK;
 }
 
 /*
diff --git a/net/irda/irnetlink.c b/net/irda/irnetlink.c
index 8dd7ed7e7c1f..476b307bd801 100644
--- a/net/irda/irnetlink.c
+++ b/net/irda/irnetlink.c
@@ -115,7 +115,7 @@ static int irda_nl_get_mode(struct sk_buff *skb, struct genl_info *info)
 
         genlmsg_end(msg, hdr);
 
-        return genlmsg_unicast(msg, info->snd_pid);
+        return genlmsg_reply(msg, info);
 
  err_out:
         nlmsg_free(msg);
diff --git a/net/lapb/lapb_iface.c b/net/lapb/lapb_iface.c
index 2ba1bc4f3c3a..bda96d18fd98 100644
--- a/net/lapb/lapb_iface.c
+++ b/net/lapb/lapb_iface.c
@@ -407,7 +407,7 @@ int lapb_data_indication(struct lapb_cb *lapb, struct sk_buff *skb)
                 return lapb->callbacks.data_indication(lapb->dev, skb);
 
         kfree_skb(skb);
-        return NET_RX_CN_HIGH; /* For now; must be != NET_RX_DROP */
+        return NET_RX_SUCCESS; /* For now; must be != NET_RX_DROP */
 }
 
 int lapb_data_transmit(struct lapb_cb *lapb, struct sk_buff *skb)
diff --git a/net/mac80211/Kconfig b/net/mac80211/Kconfig
index 7836ee928983..19a4c66e143e 100644
--- a/net/mac80211/Kconfig
+++ b/net/mac80211/Kconfig
@@ -14,22 +14,6 @@ config MAC80211
 comment "CFG80211 needs to be enabled for MAC80211"
         depends on CFG80211=n
 
-config MAC80211_DEFAULT_PS
-        bool "enable powersave by default"
-        depends on MAC80211
-        default y
-        help
-          This option enables powersave mode by default.
-
-          If this causes your applications to misbehave you should fix your
-          applications instead -- they need to register their network
-          latency requirement, see Documentation/power/pm_qos_interface.txt.
-
-config MAC80211_DEFAULT_PS_VALUE
-        int
-        default 1 if MAC80211_DEFAULT_PS
-        default 0
-
 menu "Rate control algorithm selection"
         depends on MAC80211 != n
 
@@ -222,3 +206,15 @@ config MAC80211_DEBUG_COUNTERS
           and show them in debugfs.
 
           If unsure, say N.
+
+config MAC80211_DRIVER_API_TRACER
+        bool "Driver API tracer"
+        depends on MAC80211_DEBUG_MENU
+        depends on EVENT_TRACING
+        help
+          Say Y here to make mac80211 register with the ftrace
+          framework for the driver API -- you can see which
+          driver methods it is calling then by looking at the
+          trace.
+
+          If unsure, say N.
diff --git a/net/mac80211/Makefile b/net/mac80211/Makefile
index 0e3ab88bb706..91284a74ff91 100644
--- a/net/mac80211/Makefile
+++ b/net/mac80211/Makefile
@@ -41,6 +41,9 @@ mac80211-$(CONFIG_MAC80211_MESH) += \
 
 mac80211-$(CONFIG_PM) += pm.o
 
+mac80211-$(CONFIG_MAC80211_DRIVER_API_TRACER) += driver-trace.o
+CFLAGS_driver-trace.o := -I$(src)
+
 # objects for PID algorithm
 rc80211_pid-y := rc80211_pid_algo.o
 rc80211_pid-$(CONFIG_MAC80211_DEBUGFS) += rc80211_pid_debugfs.o
diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index 9e5762ad307d..1958c7c42cd9 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -383,9 +383,6 @@ static void ieee80211_agg_splice_packets(struct ieee80211_local *local,
 
         if (!skb_queue_empty(&sta->ampdu_mlme.tid_tx[tid]->pending)) {
                 spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
-                /* mark queue as pending, it is stopped already */
-                __set_bit(IEEE80211_QUEUE_STOP_REASON_PENDING,
-                          &local->queue_stop_reasons[queue]);
                 /* copy over remaining packets */
                 skb_queue_splice_tail_init(
                         &sta->ampdu_mlme.tid_tx[tid]->pending,
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 3f47276caeb8..52928ad90570 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -74,19 +74,14 @@ static int ieee80211_del_iface(struct wiphy *wiphy, int ifindex)
         return 0;
 }
 
-static int ieee80211_change_iface(struct wiphy *wiphy, int ifindex,
+static int ieee80211_change_iface(struct wiphy *wiphy,
+                                  struct net_device *dev,
                                   enum nl80211_iftype type, u32 *flags,
                                   struct vif_params *params)
 {
-        struct net_device *dev;
         struct ieee80211_sub_if_data *sdata;
         int ret;
 
-        /* we're under RTNL */
-        dev = __dev_get_by_index(&init_net, ifindex);
-        if (!dev)
-                return -ENODEV;
-
         if (!nl80211_type_check(type))
                 return -EINVAL;
 
@@ -1177,123 +1172,29 @@ static int ieee80211_scan(struct wiphy *wiphy,
 static int ieee80211_auth(struct wiphy *wiphy, struct net_device *dev,
                           struct cfg80211_auth_request *req)
 {
-        struct ieee80211_sub_if_data *sdata;
-
-        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-
-        switch (req->auth_type) {
-        case NL80211_AUTHTYPE_OPEN_SYSTEM:
-                sdata->u.mgd.auth_algs = IEEE80211_AUTH_ALG_OPEN;
-                break;
-        case NL80211_AUTHTYPE_SHARED_KEY:
-                sdata->u.mgd.auth_algs = IEEE80211_AUTH_ALG_SHARED_KEY;
-                break;
-        case NL80211_AUTHTYPE_FT:
-                sdata->u.mgd.auth_algs = IEEE80211_AUTH_ALG_FT;
-                break;
-        case NL80211_AUTHTYPE_NETWORK_EAP:
-                sdata->u.mgd.auth_algs = IEEE80211_AUTH_ALG_LEAP;
-                break;
-        default:
-                return -EOPNOTSUPP;
-        }
-
-        memcpy(sdata->u.mgd.bssid, req->peer_addr, ETH_ALEN);
-        sdata->u.mgd.flags &= ~IEEE80211_STA_AUTO_BSSID_SEL;
-        sdata->u.mgd.flags |= IEEE80211_STA_BSSID_SET;
-
-        /* TODO: req->chan */
-        sdata->u.mgd.flags |= IEEE80211_STA_AUTO_CHANNEL_SEL;
-
-        if (req->ssid) {
-                sdata->u.mgd.flags |= IEEE80211_STA_SSID_SET;
-                memcpy(sdata->u.mgd.ssid, req->ssid, req->ssid_len);
-                sdata->u.mgd.ssid_len = req->ssid_len;
-                sdata->u.mgd.flags &= ~IEEE80211_STA_AUTO_SSID_SEL;
-        }
-
-        kfree(sdata->u.mgd.sme_auth_ie);
-        sdata->u.mgd.sme_auth_ie = NULL;
-        sdata->u.mgd.sme_auth_ie_len = 0;
-        if (req->ie) {
-                sdata->u.mgd.sme_auth_ie = kmalloc(req->ie_len, GFP_KERNEL);
-                if (sdata->u.mgd.sme_auth_ie == NULL)
-                        return -ENOMEM;
-                memcpy(sdata->u.mgd.sme_auth_ie, req->ie, req->ie_len);
-                sdata->u.mgd.sme_auth_ie_len = req->ie_len;
-        }
-
-        sdata->u.mgd.flags |= IEEE80211_STA_EXT_SME;
-        sdata->u.mgd.state = IEEE80211_STA_MLME_DIRECT_PROBE;
-        ieee80211_sta_req_auth(sdata);
-        return 0;
+        return ieee80211_mgd_auth(IEEE80211_DEV_TO_SUB_IF(dev), req);
 }
 
 static int ieee80211_assoc(struct wiphy *wiphy, struct net_device *dev,
                            struct cfg80211_assoc_request *req)
 {
-        struct ieee80211_sub_if_data *sdata;
-        int ret;
-
-        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-
-        if (memcmp(sdata->u.mgd.bssid, req->peer_addr, ETH_ALEN) != 0 ||
-            !(sdata->u.mgd.flags & IEEE80211_STA_AUTHENTICATED))
-                return -ENOLINK; /* not authenticated */
-
-        sdata->u.mgd.flags &= ~IEEE80211_STA_AUTO_BSSID_SEL;
-        sdata->u.mgd.flags |= IEEE80211_STA_BSSID_SET;
-
-        /* TODO: req->chan */
-        sdata->u.mgd.flags |= IEEE80211_STA_AUTO_CHANNEL_SEL;
-
-        if (req->ssid) {
-                sdata->u.mgd.flags |= IEEE80211_STA_SSID_SET;
-                memcpy(sdata->u.mgd.ssid, req->ssid, req->ssid_len);
-                sdata->u.mgd.ssid_len = req->ssid_len;
-                sdata->u.mgd.flags &= ~IEEE80211_STA_AUTO_SSID_SEL;
-        } else
-                sdata->u.mgd.flags |= IEEE80211_STA_AUTO_SSID_SEL;
-
-        ret = ieee80211_sta_set_extra_ie(sdata, req->ie, req->ie_len);
-        if (ret && ret != -EALREADY)
-                return ret;
-
-        if (req->use_mfp) {
-                sdata->u.mgd.mfp = IEEE80211_MFP_REQUIRED;
-                sdata->u.mgd.flags |= IEEE80211_STA_MFP_ENABLED;
-        } else {
-                sdata->u.mgd.mfp = IEEE80211_MFP_DISABLED;
-                sdata->u.mgd.flags &= ~IEEE80211_STA_MFP_ENABLED;
-        }
-
-        if (req->control_port)
-                sdata->u.mgd.flags |= IEEE80211_STA_CONTROL_PORT;
-        else
-                sdata->u.mgd.flags &= ~IEEE80211_STA_CONTROL_PORT;
-
-        sdata->u.mgd.flags |= IEEE80211_STA_EXT_SME;
-        sdata->u.mgd.state = IEEE80211_STA_MLME_ASSOCIATE;
-        ieee80211_sta_req_auth(sdata);
-        return 0;
+        return ieee80211_mgd_assoc(IEEE80211_DEV_TO_SUB_IF(dev), req);
 }
 
 static int ieee80211_deauth(struct wiphy *wiphy, struct net_device *dev,
-                            struct cfg80211_deauth_request *req)
+                            struct cfg80211_deauth_request *req,
+                            void *cookie)
 {
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-
-        /* TODO: req->ie, req->peer_addr */
-        return ieee80211_sta_deauthenticate(sdata, req->reason_code);
+        return ieee80211_mgd_deauth(IEEE80211_DEV_TO_SUB_IF(dev),
+                                    req, cookie);
 }
 
 static int ieee80211_disassoc(struct wiphy *wiphy, struct net_device *dev,
-                              struct cfg80211_disassoc_request *req)
+                              struct cfg80211_disassoc_request *req,
+                              void *cookie)
 {
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-
-        /* TODO: req->ie, req->peer_addr */
-        return ieee80211_sta_disassociate(sdata, req->reason_code);
+        return ieee80211_mgd_disassoc(IEEE80211_DEV_TO_SUB_IF(dev),
+                                      req, cookie);
 }
 
 static int ieee80211_join_ibss(struct wiphy *wiphy, struct net_device *dev,
@@ -1374,6 +1275,16 @@ static int ieee80211_get_tx_power(struct wiphy *wiphy, int *dbm)
         return 0;
 }
 
+static int ieee80211_set_wds_peer(struct wiphy *wiphy, struct net_device *dev,
+                                  u8 *addr)
+{
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+
+        memcpy(&sdata->u.wds.remote_addr, addr, ETH_ALEN);
+
+        return 0;
+}
+
 static void ieee80211_rfkill_poll(struct wiphy *wiphy)
 {
         struct ieee80211_local *local = wiphy_priv(wiphy);
@@ -1381,6 +1292,85 @@ static void ieee80211_rfkill_poll(struct wiphy *wiphy)
         drv_rfkill_poll(local);
 }
 
+#ifdef CONFIG_NL80211_TESTMODE
+static int ieee80211_testmode_cmd(struct wiphy *wiphy, void *data, int len)
+{
+        struct ieee80211_local *local = wiphy_priv(wiphy);
+
+        if (!local->ops->testmode_cmd)
+                return -EOPNOTSUPP;
+
+        return local->ops->testmode_cmd(&local->hw, data, len);
+}
+#endif
+
+static int ieee80211_set_power_mgmt(struct wiphy *wiphy, struct net_device *dev,
+                                    bool enabled, int timeout)
+{
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+        struct ieee80211_conf *conf = &local->hw.conf;
+
+        if (!(local->hw.flags & IEEE80211_HW_SUPPORTS_PS))
+                return -EOPNOTSUPP;
+
+        if (enabled == sdata->u.mgd.powersave &&
+            timeout == conf->dynamic_ps_timeout)
+                return 0;
+
+        sdata->u.mgd.powersave = enabled;
+        conf->dynamic_ps_timeout = timeout;
+
+        if (local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_PS)
+                ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
+
+        ieee80211_recalc_ps(local, -1);
+
+        return 0;
+}
+
+static int ieee80211_set_bitrate_mask(struct wiphy *wiphy,
+                                      struct net_device *dev,
+                                      const u8 *addr,
+                                      const struct cfg80211_bitrate_mask *mask)
+{
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+        int i, err = -EINVAL;
+        u32 target_rate;
+        struct ieee80211_supported_band *sband;
+
+        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
+
+        /* target_rate = -1, rate->fixed = 0 means auto only, so use all rates
+         * target_rate = X, rate->fixed = 1 means only rate X
+         * target_rate = X, rate->fixed = 0 means all rates <= X */
+        sdata->max_ratectrl_rateidx = -1;
+        sdata->force_unicast_rateidx = -1;
+
+        if (mask->fixed)
+                target_rate = mask->fixed / 100;
+        else if (mask->maxrate)
+                target_rate = mask->maxrate / 100;
+        else
+                return 0;
+
+        for (i=0; i< sband->n_bitrates; i++) {
+                struct ieee80211_rate *brate = &sband->bitrates[i];
+                int this_rate = brate->bitrate;
+
+                if (target_rate == this_rate) {
+                        sdata->max_ratectrl_rateidx = i;
+                        if (mask->fixed)
+                                sdata->force_unicast_rateidx = i;
+                        err = 0;
+                        break;
+                }
+        }
+
+        return err;
+}
+
 struct cfg80211_ops mac80211_config_ops = {
         .add_virtual_intf = ieee80211_add_iface,
         .del_virtual_intf = ieee80211_del_iface,
@@ -1422,5 +1412,9 @@ struct cfg80211_ops mac80211_config_ops = {
         .set_wiphy_params = ieee80211_set_wiphy_params,
         .set_tx_power = ieee80211_set_tx_power,
         .get_tx_power = ieee80211_get_tx_power,
+        .set_wds_peer = ieee80211_set_wds_peer,
         .rfkill_poll = ieee80211_rfkill_poll,
+        CFG80211_TESTMODE_CMD(ieee80211_testmode_cmd)
+        .set_power_mgmt = ieee80211_set_power_mgmt,
+        .set_bitrate_mask = ieee80211_set_bitrate_mask,
 };
diff --git a/net/mac80211/debugfs.c b/net/mac80211/debugfs.c
index 6c439cd5ccea..96991b68f048 100644
--- a/net/mac80211/debugfs.c
+++ b/net/mac80211/debugfs.c
@@ -175,7 +175,7 @@ static ssize_t queues_read(struct file *file, char __user *user_buf,
         for (q = 0; q < local->hw.queues; q++)
                 res += sprintf(buf + res, "%02d: %#.8lx/%d\n", q,
                                 local->queue_stop_reasons[q],
-                                __netif_subqueue_stopped(local->mdev, q));
+                                skb_queue_len(&local->pending[q]));
         spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
 
         return simple_read_from_buffer(user_buf, count, ppos, buf, res);
diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c
index e3420329f4e6..e9ec6cae2d39 100644
--- a/net/mac80211/debugfs_netdev.c
+++ b/net/mac80211/debugfs_netdev.c
@@ -95,33 +95,9 @@ IEEE80211_IF_FILE(force_unicast_rateidx, force_unicast_rateidx, DEC);
 IEEE80211_IF_FILE(max_ratectrl_rateidx, max_ratectrl_rateidx, DEC);
 
 /* STA attributes */
-IEEE80211_IF_FILE(state, u.mgd.state, DEC);
 IEEE80211_IF_FILE(bssid, u.mgd.bssid, MAC);
-IEEE80211_IF_FILE(prev_bssid, u.mgd.prev_bssid, MAC);
-IEEE80211_IF_FILE(ssid_len, u.mgd.ssid_len, SIZE);
 IEEE80211_IF_FILE(aid, u.mgd.aid, DEC);
-IEEE80211_IF_FILE(ap_capab, u.mgd.ap_capab, HEX);
 IEEE80211_IF_FILE(capab, u.mgd.capab, HEX);
-IEEE80211_IF_FILE(extra_ie_len, u.mgd.extra_ie_len, SIZE);
-IEEE80211_IF_FILE(auth_tries, u.mgd.auth_tries, DEC);
-IEEE80211_IF_FILE(assoc_tries, u.mgd.assoc_tries, DEC);
-IEEE80211_IF_FILE(auth_algs, u.mgd.auth_algs, HEX);
-IEEE80211_IF_FILE(auth_alg, u.mgd.auth_alg, DEC);
-IEEE80211_IF_FILE(auth_transaction, u.mgd.auth_transaction, DEC);
-
-static ssize_t ieee80211_if_fmt_flags(
-        const struct ieee80211_sub_if_data *sdata, char *buf, int buflen)
-{
-        return scnprintf(buf, buflen, "%s%s%s%s%s%s%s\n",
-                 sdata->u.mgd.flags & IEEE80211_STA_SSID_SET ? "SSID\n" : "",
-                 sdata->u.mgd.flags & IEEE80211_STA_BSSID_SET ? "BSSID\n" : "",
-                 sdata->u.mgd.flags & IEEE80211_STA_PREV_BSSID_SET ? "prev BSSID\n" : "",
-                 sdata->u.mgd.flags & IEEE80211_STA_AUTHENTICATED ? "AUTH\n" : "",
-                 sdata->u.mgd.flags & IEEE80211_STA_ASSOCIATED ? "ASSOC\n" : "",
-                 sdata->u.mgd.flags & IEEE80211_STA_PROBEREQ_POLL ? "PROBEREQ POLL\n" : "",
-                 sdata->vif.bss_conf.use_cts_prot ? "CTS prot\n" : "");
-}
-__IEEE80211_IF_FILE(flags);
 
 /* AP attributes */
 IEEE80211_IF_FILE(num_sta_ps, u.ap.num_sta_ps, ATOMIC);
@@ -184,20 +160,9 @@ static void add_sta_files(struct ieee80211_sub_if_data *sdata)
         DEBUGFS_ADD(force_unicast_rateidx, sta);
         DEBUGFS_ADD(max_ratectrl_rateidx, sta);
 
-        DEBUGFS_ADD(state, sta);
         DEBUGFS_ADD(bssid, sta);
-        DEBUGFS_ADD(prev_bssid, sta);
-        DEBUGFS_ADD(ssid_len, sta);
         DEBUGFS_ADD(aid, sta);
-        DEBUGFS_ADD(ap_capab, sta);
         DEBUGFS_ADD(capab, sta);
-        DEBUGFS_ADD(extra_ie_len, sta);
-        DEBUGFS_ADD(auth_tries, sta);
-        DEBUGFS_ADD(assoc_tries, sta);
-        DEBUGFS_ADD(auth_algs, sta);
-        DEBUGFS_ADD(auth_alg, sta);
-        DEBUGFS_ADD(auth_transaction, sta);
-        DEBUGFS_ADD(flags, sta);
 }
 
 static void add_ap_files(struct ieee80211_sub_if_data *sdata)
@@ -317,20 +282,9 @@ static void del_sta_files(struct ieee80211_sub_if_data *sdata)
         DEBUGFS_DEL(force_unicast_rateidx, sta);
         DEBUGFS_DEL(max_ratectrl_rateidx, sta);
 
-        DEBUGFS_DEL(state, sta);
         DEBUGFS_DEL(bssid, sta);
-        DEBUGFS_DEL(prev_bssid, sta);
-        DEBUGFS_DEL(ssid_len, sta);
         DEBUGFS_DEL(aid, sta);
-        DEBUGFS_DEL(ap_capab, sta);
         DEBUGFS_DEL(capab, sta);
-        DEBUGFS_DEL(extra_ie_len, sta);
-        DEBUGFS_DEL(auth_tries, sta);
-        DEBUGFS_DEL(assoc_tries, sta);
-        DEBUGFS_DEL(auth_algs, sta);
-        DEBUGFS_DEL(auth_alg, sta);
-        DEBUGFS_DEL(auth_transaction, sta);
-        DEBUGFS_DEL(flags, sta);
 }
 
 static void del_ap_files(struct ieee80211_sub_if_data *sdata)
diff --git a/net/mac80211/debugfs_sta.c b/net/mac80211/debugfs_sta.c
index 90230c718b5b..33a2e892115b 100644
--- a/net/mac80211/debugfs_sta.c
+++ b/net/mac80211/debugfs_sta.c
@@ -120,45 +120,38 @@ STA_OPS(last_seq_ctrl);
 static ssize_t sta_agg_status_read(struct file *file, char __user *userbuf,
                                         size_t count, loff_t *ppos)
 {
-        char buf[768], *p = buf;
+        char buf[30 + STA_TID_NUM * 70], *p = buf;
         int i;
         struct sta_info *sta = file->private_data;
-        p += scnprintf(p, sizeof(buf)+buf-p, "Agg state for STA is:\n");
-        p += scnprintf(p, sizeof(buf)+buf-p, " STA next dialog_token is %d \n "
-                        "TIDs info is: \n TID :",
-                        (sta->ampdu_mlme.dialog_token_allocator + 1));
-        for (i = 0; i < STA_TID_NUM; i++)
-                p += scnprintf(p, sizeof(buf)+buf-p, "%5d", i);
-
-        p += scnprintf(p, sizeof(buf)+buf-p, "\n RX  :");
-        for (i = 0; i < STA_TID_NUM; i++)
-                p += scnprintf(p, sizeof(buf)+buf-p, "%5d",
-                        sta->ampdu_mlme.tid_state_rx[i]);
-
-        p += scnprintf(p, sizeof(buf)+buf-p, "\n DTKN:");
-        for (i = 0; i < STA_TID_NUM; i++)
-                p += scnprintf(p, sizeof(buf)+buf-p, "%5d",
-                        sta->ampdu_mlme.tid_state_rx[i] ?
-                        sta->ampdu_mlme.tid_rx[i]->dialog_token : 0);
-
-        p += scnprintf(p, sizeof(buf)+buf-p, "\n TX  :");
-        for (i = 0; i < STA_TID_NUM; i++)
-                p += scnprintf(p, sizeof(buf)+buf-p, "%5d",
-                        sta->ampdu_mlme.tid_state_tx[i]);
-
-        p += scnprintf(p, sizeof(buf)+buf-p, "\n DTKN:");
-        for (i = 0; i < STA_TID_NUM; i++)
-                p += scnprintf(p, sizeof(buf)+buf-p, "%5d",
-                        sta->ampdu_mlme.tid_state_tx[i] ?
-                        sta->ampdu_mlme.tid_tx[i]->dialog_token : 0);
-
-        p += scnprintf(p, sizeof(buf)+buf-p, "\n SSN :");
-        for (i = 0; i < STA_TID_NUM; i++)
-                p += scnprintf(p, sizeof(buf)+buf-p, "%5d",
-                        sta->ampdu_mlme.tid_state_tx[i] ?
-                        sta->ampdu_mlme.tid_tx[i]->ssn : 0);
 
-        p += scnprintf(p, sizeof(buf)+buf-p, "\n");
+        spin_lock_bh(&sta->lock);
+        p += scnprintf(p, sizeof(buf)+buf-p, "next dialog_token is %#02x\n",
+                        sta->ampdu_mlme.dialog_token_allocator + 1);
+        for (i = 0; i < STA_TID_NUM; i++) {
+                p += scnprintf(p, sizeof(buf)+buf-p, "TID %02d:", i);
+                p += scnprintf(p, sizeof(buf)+buf-p, " RX=%x",
+                                sta->ampdu_mlme.tid_state_rx[i]);
+                p += scnprintf(p, sizeof(buf)+buf-p, "/DTKN=%#.2x",
+                                sta->ampdu_mlme.tid_state_rx[i] ?
+                                sta->ampdu_mlme.tid_rx[i]->dialog_token : 0);
+                p += scnprintf(p, sizeof(buf)+buf-p, "/SSN=%#.3x",
+                                sta->ampdu_mlme.tid_state_rx[i] ?
+                                sta->ampdu_mlme.tid_rx[i]->ssn : 0);
+
+                p += scnprintf(p, sizeof(buf)+buf-p, " TX=%x",
+                                sta->ampdu_mlme.tid_state_tx[i]);
+                p += scnprintf(p, sizeof(buf)+buf-p, "/DTKN=%#.2x",
+                                sta->ampdu_mlme.tid_state_tx[i] ?
+                                sta->ampdu_mlme.tid_tx[i]->dialog_token : 0);
+                p += scnprintf(p, sizeof(buf)+buf-p, "/SSN=%#.3x",
+                                sta->ampdu_mlme.tid_state_tx[i] ?
+                                sta->ampdu_mlme.tid_tx[i]->ssn : 0);
+                p += scnprintf(p, sizeof(buf)+buf-p, "/pending=%03d",
+                                sta->ampdu_mlme.tid_state_tx[i] ?
+                                skb_queue_len(&sta->ampdu_mlme.tid_tx[i]->pending) : 0);
+                p += scnprintf(p, sizeof(buf)+buf-p, "\n");
+        }
+        spin_unlock_bh(&sta->lock);
 
         return simple_read_from_buffer(userbuf, count, ppos, buf, p - buf);
 }
@@ -203,6 +196,22 @@ void ieee80211_sta_debugfs_add(struct sta_info *sta)
         DEBUGFS_ADD(inactive_ms);
         DEBUGFS_ADD(last_seq_ctrl);
         DEBUGFS_ADD(agg_status);
+        DEBUGFS_ADD(dev);
+        DEBUGFS_ADD(rx_packets);
+        DEBUGFS_ADD(tx_packets);
+        DEBUGFS_ADD(rx_bytes);
+        DEBUGFS_ADD(tx_bytes);
+        DEBUGFS_ADD(rx_duplicates);
+        DEBUGFS_ADD(rx_fragments);
+        DEBUGFS_ADD(rx_dropped);
+        DEBUGFS_ADD(tx_fragments);
+        DEBUGFS_ADD(tx_filtered);
+        DEBUGFS_ADD(tx_retry_failed);
+        DEBUGFS_ADD(tx_retry_count);
+        DEBUGFS_ADD(last_signal);
+        DEBUGFS_ADD(last_qual);
+        DEBUGFS_ADD(last_noise);
+        DEBUGFS_ADD(wep_weak_iv_count);
 }
 
 void ieee80211_sta_debugfs_remove(struct sta_info *sta)
@@ -212,6 +221,23 @@ void ieee80211_sta_debugfs_remove(struct sta_info *sta)
         DEBUGFS_DEL(inactive_ms);
         DEBUGFS_DEL(last_seq_ctrl);
         DEBUGFS_DEL(agg_status);
+        DEBUGFS_DEL(aid);
+        DEBUGFS_DEL(dev);
+        DEBUGFS_DEL(rx_packets);
+        DEBUGFS_DEL(tx_packets);
+        DEBUGFS_DEL(rx_bytes);
+        DEBUGFS_DEL(tx_bytes);
+        DEBUGFS_DEL(rx_duplicates);
+        DEBUGFS_DEL(rx_fragments);
+        DEBUGFS_DEL(rx_dropped);
+        DEBUGFS_DEL(tx_fragments);
+        DEBUGFS_DEL(tx_filtered);
+        DEBUGFS_DEL(tx_retry_failed);
+        DEBUGFS_DEL(tx_retry_count);
+        DEBUGFS_DEL(last_signal);
+        DEBUGFS_DEL(last_qual);
+        DEBUGFS_DEL(last_noise);
+        DEBUGFS_DEL(wep_weak_iv_count);
 
         debugfs_remove(sta->debugfs.dir);
         sta->debugfs.dir = NULL;
diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
index b13446afd48f..4100c361a99d 100644
--- a/net/mac80211/driver-ops.h
+++ b/net/mac80211/driver-ops.h
@@ -3,6 +3,7 @@
 
 #include <net/mac80211.h>
 #include "ieee80211_i.h"
+#include "driver-trace.h"
 
 static inline int drv_tx(struct ieee80211_local *local, struct sk_buff *skb)
 {
@@ -11,29 +12,37 @@ static inline int drv_tx(struct ieee80211_local *local, struct sk_buff *skb)
 
 static inline int drv_start(struct ieee80211_local *local)
 {
-        return local->ops->start(&local->hw);
+        int ret = local->ops->start(&local->hw);
+        trace_drv_start(local, ret);
+        return ret;
 }
 
 static inline void drv_stop(struct ieee80211_local *local)
 {
         local->ops->stop(&local->hw);
+        trace_drv_stop(local);
 }
 
 static inline int drv_add_interface(struct ieee80211_local *local,
                                     struct ieee80211_if_init_conf *conf)
 {
-        return local->ops->add_interface(&local->hw, conf);
+        int ret = local->ops->add_interface(&local->hw, conf);
+        trace_drv_add_interface(local, conf->mac_addr, conf->vif, ret);
+        return ret;
 }
 
 static inline void drv_remove_interface(struct ieee80211_local *local,
                                         struct ieee80211_if_init_conf *conf)
 {
         local->ops->remove_interface(&local->hw, conf);
+        trace_drv_remove_interface(local, conf->mac_addr, conf->vif);
 }
 
 static inline int drv_config(struct ieee80211_local *local, u32 changed)
 {
-        return local->ops->config(&local->hw, changed);
+        int ret = local->ops->config(&local->hw, changed);
+        trace_drv_config(local, changed, ret);
+        return ret;
 }
 
 static inline void drv_bss_info_changed(struct ieee80211_local *local,
@@ -43,6 +52,7 @@ static inline void drv_bss_info_changed(struct ieee80211_local *local,
 {
         if (local->ops->bss_info_changed)
                 local->ops->bss_info_changed(&local->hw, vif, info, changed);
+        trace_drv_bss_info_changed(local, vif, info, changed);
 }
 
 static inline void drv_configure_filter(struct ieee80211_local *local,
@@ -53,14 +63,18 @@ static inline void drv_configure_filter(struct ieee80211_local *local,
 {
         local->ops->configure_filter(&local->hw, changed_flags, total_flags,
                                      mc_count, mc_list);
+        trace_drv_configure_filter(local, changed_flags, total_flags,
+                                            mc_count);
 }
 
 static inline int drv_set_tim(struct ieee80211_local *local,
                               struct ieee80211_sta *sta, bool set)
 {
+        int ret = 0;
         if (local->ops->set_tim)
-                return local->ops->set_tim(&local->hw, sta, set);
-        return 0;
+                ret = local->ops->set_tim(&local->hw, sta, set);
+        trace_drv_set_tim(local, sta, set, ret);
+        return ret;
 }
 
 static inline int drv_set_key(struct ieee80211_local *local,
@@ -68,7 +82,9 @@ static inline int drv_set_key(struct ieee80211_local *local,
                               struct ieee80211_sta *sta,
                               struct ieee80211_key_conf *key)
 {
-        return local->ops->set_key(&local->hw, cmd, vif, sta, key);
+        int ret = local->ops->set_key(&local->hw, cmd, vif, sta, key);
+        trace_drv_set_key(local, cmd, vif, sta, key, ret);
+        return ret;
 }
 
 static inline void drv_update_tkip_key(struct ieee80211_local *local,
@@ -79,32 +95,41 @@ static inline void drv_update_tkip_key(struct ieee80211_local *local,
         if (local->ops->update_tkip_key)
                 local->ops->update_tkip_key(&local->hw, conf, address,
                                             iv32, phase1key);
+        trace_drv_update_tkip_key(local, conf, address, iv32);
 }
 
 static inline int drv_hw_scan(struct ieee80211_local *local,
                               struct cfg80211_scan_request *req)
 {
-        return local->ops->hw_scan(&local->hw, req);
+        int ret = local->ops->hw_scan(&local->hw, req);
+        trace_drv_hw_scan(local, req, ret);
+        return ret;
 }
 
 static inline void drv_sw_scan_start(struct ieee80211_local *local)
 {
         if (local->ops->sw_scan_start)
                 local->ops->sw_scan_start(&local->hw);
+        trace_drv_sw_scan_start(local);
 }
 
 static inline void drv_sw_scan_complete(struct ieee80211_local *local)
 {
         if (local->ops->sw_scan_complete)
                 local->ops->sw_scan_complete(&local->hw);
+        trace_drv_sw_scan_complete(local);
 }
 
 static inline int drv_get_stats(struct ieee80211_local *local,
                                 struct ieee80211_low_level_stats *stats)
 {
-        if (!local->ops->get_stats)
-                return -EOPNOTSUPP;
-        return local->ops->get_stats(&local->hw, stats);
+        int ret = -EOPNOTSUPP;
+
+        if (local->ops->get_stats)
+                ret = local->ops->get_stats(&local->hw, stats);
+        trace_drv_get_stats(local, stats, ret);
+
+        return ret;
 }
 
 static inline void drv_get_tkip_seq(struct ieee80211_local *local,
@@ -112,14 +137,17 @@ static inline void drv_get_tkip_seq(struct ieee80211_local *local,
 {
         if (local->ops->get_tkip_seq)
                 local->ops->get_tkip_seq(&local->hw, hw_key_idx, iv32, iv16);
+        trace_drv_get_tkip_seq(local, hw_key_idx, iv32, iv16);
 }
 
 static inline int drv_set_rts_threshold(struct ieee80211_local *local,
                                         u32 value)
 {
+        int ret = 0;
         if (local->ops->set_rts_threshold)
-                return local->ops->set_rts_threshold(&local->hw, value);
-        return 0;
+                ret = local->ops->set_rts_threshold(&local->hw, value);
+        trace_drv_set_rts_threshold(local, value, ret);
+        return ret;
 }
 
 static inline void drv_sta_notify(struct ieee80211_local *local,
@@ -129,46 +157,57 @@ static inline void drv_sta_notify(struct ieee80211_local *local,
 {
         if (local->ops->sta_notify)
                 local->ops->sta_notify(&local->hw, vif, cmd, sta);
+        trace_drv_sta_notify(local, vif, cmd, sta);
 }
 
 static inline int drv_conf_tx(struct ieee80211_local *local, u16 queue,
                               const struct ieee80211_tx_queue_params *params)
 {
+        int ret = -EOPNOTSUPP;
         if (local->ops->conf_tx)
-                return local->ops->conf_tx(&local->hw, queue, params);
-        return -EOPNOTSUPP;
+                ret = local->ops->conf_tx(&local->hw, queue, params);
+        trace_drv_conf_tx(local, queue, params, ret);
+        return ret;
 }
 
 static inline int drv_get_tx_stats(struct ieee80211_local *local,
                                    struct ieee80211_tx_queue_stats *stats)
 {
-        return local->ops->get_tx_stats(&local->hw, stats);
+        int ret = local->ops->get_tx_stats(&local->hw, stats);
+        trace_drv_get_tx_stats(local, stats, ret);
+        return ret;
 }
 
 static inline u64 drv_get_tsf(struct ieee80211_local *local)
 {
+        u64 ret = -1ULL;
         if (local->ops->get_tsf)
-                return local->ops->get_tsf(&local->hw);
-        return -1ULL;
+                ret = local->ops->get_tsf(&local->hw);
+        trace_drv_get_tsf(local, ret);
+        return ret;
 }
 
 static inline void drv_set_tsf(struct ieee80211_local *local, u64 tsf)
 {
         if (local->ops->set_tsf)
                 local->ops->set_tsf(&local->hw, tsf);
+        trace_drv_set_tsf(local, tsf);
 }
 
 static inline void drv_reset_tsf(struct ieee80211_local *local)
 {
         if (local->ops->reset_tsf)
                 local->ops->reset_tsf(&local->hw);
+        trace_drv_reset_tsf(local);
 }
 
 static inline int drv_tx_last_beacon(struct ieee80211_local *local)
 {
+        int ret = 1;
         if (local->ops->tx_last_beacon)
-                return local->ops->tx_last_beacon(&local->hw);
-        return 1;
+                ret = local->ops->tx_last_beacon(&local->hw);
+        trace_drv_tx_last_beacon(local, ret);
+        return ret;
 }
 
 static inline int drv_ampdu_action(struct ieee80211_local *local,
@@ -176,10 +215,12 @@ static inline int drv_ampdu_action(struct ieee80211_local *local,
                                    struct ieee80211_sta *sta, u16 tid,
                                    u16 *ssn)
 {
+        int ret = -EOPNOTSUPP;
         if (local->ops->ampdu_action)
-                return local->ops->ampdu_action(&local->hw, action,
-                                                sta, tid, ssn);
-        return -EOPNOTSUPP;
+                ret = local->ops->ampdu_action(&local->hw, action,
+                                               sta, tid, ssn);
+        trace_drv_ampdu_action(local, action, sta, tid, ssn, ret);
+        return ret;
 }
 
 
diff --git a/net/mac80211/driver-trace.c b/net/mac80211/driver-trace.c
new file mode 100644
index 000000000000..6da6f79932fc
--- /dev/null
+++ b/net/mac80211/driver-trace.c
@@ -0,0 +1,6 @@
+/* bug in tracepoint.h, it should include this */
+#include <linux/module.h>
+
+#include "driver-ops.h"
+#define CREATE_TRACE_POINTS
+#include "driver-trace.h"
diff --git a/net/mac80211/driver-trace.h b/net/mac80211/driver-trace.h
new file mode 100644
index 000000000000..5a10da2d70fd
--- /dev/null
+++ b/net/mac80211/driver-trace.h
@@ -0,0 +1,648 @@
+#if !defined(__MAC80211_DRIVER_TRACE) || defined(TRACE_HEADER_MULTI_READ)
+#define __MAC80211_DRIVER_TRACE
+
+#include <linux/tracepoint.h>
+#include <net/mac80211.h>
+#include "ieee80211_i.h"
+
+#if !defined(CONFIG_MAC80211_DRIVER_API_TRACER) || defined(__CHECKER__)
+#undef TRACE_EVENT
+#define TRACE_EVENT(name, proto, ...) \
+static inline void trace_ ## name(proto) {}
+#endif
+
+#undef TRACE_SYSTEM
+#define TRACE_SYSTEM mac80211
+
+#define MAXNAME         32
+#define LOCAL_ENTRY     __array(char, wiphy_name, 32)
+#define LOCAL_ASSIGN    strlcpy(__entry->wiphy_name, wiphy_name(local->hw.wiphy), MAXNAME)
+#define LOCAL_PR_FMT    "%s"
+#define LOCAL_PR_ARG    __entry->wiphy_name
+
+#define STA_ENTRY       __array(char, sta_addr, ETH_ALEN)
+#define STA_ASSIGN      (sta ? memcpy(__entry->sta_addr, sta->addr, ETH_ALEN) : memset(__entry->sta_addr, 0, ETH_ALEN))
+#define STA_PR_FMT      " sta:%pM"
+#define STA_PR_ARG      __entry->sta_addr
+
+#define VIF_ENTRY       __field(enum nl80211_iftype, vif_type) __field(void *, vif)
+#define VIF_ASSIGN      __entry->vif_type = vif ? vif->type : 0; __entry->vif = vif
+#define VIF_PR_FMT      " vif:%p(%d)"
+#define VIF_PR_ARG      __entry->vif, __entry->vif_type
+
+TRACE_EVENT(drv_start,
+        TP_PROTO(struct ieee80211_local *local, int ret),
+
+        TP_ARGS(local, ret),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                __field(int, ret)
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                __entry->ret = ret;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT, LOCAL_PR_ARG
+        )
+);
+
+TRACE_EVENT(drv_stop,
+        TP_PROTO(struct ieee80211_local *local),
+
+        TP_ARGS(local),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT, LOCAL_PR_ARG
+        )
+);
+
+TRACE_EVENT(drv_add_interface,
+        TP_PROTO(struct ieee80211_local *local,
+                 const u8 *addr,
+                 struct ieee80211_vif *vif,
+                 int ret),
+
+        TP_ARGS(local, addr, vif, ret),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                VIF_ENTRY
+                __array(char, addr, 6)
+                __field(int, ret)
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                VIF_ASSIGN;
+                memcpy(__entry->addr, addr, 6);
+                __entry->ret = ret;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT  VIF_PR_FMT " addr:%pM ret:%d",
+                LOCAL_PR_ARG, VIF_PR_ARG, __entry->addr, __entry->ret
+        )
+);
+
+TRACE_EVENT(drv_remove_interface,
+        TP_PROTO(struct ieee80211_local *local,
+                 const u8 *addr, struct ieee80211_vif *vif),
+
+        TP_ARGS(local, addr, vif),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                VIF_ENTRY
+                __array(char, addr, 6)
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                VIF_ASSIGN;
+                memcpy(__entry->addr, addr, 6);
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT  VIF_PR_FMT " addr:%pM",
+                LOCAL_PR_ARG, VIF_PR_ARG, __entry->addr
+        )
+);
+
+TRACE_EVENT(drv_config,
+        TP_PROTO(struct ieee80211_local *local,
+                 u32 changed,
+                 int ret),
+
+        TP_ARGS(local, changed, ret),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                __field(u32, changed)
+                __field(int, ret)
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                __entry->changed = changed;
+                __entry->ret = ret;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT " ch:%#x ret:%d",
+                LOCAL_PR_ARG, __entry->changed, __entry->ret
+        )
+);
+
+TRACE_EVENT(drv_bss_info_changed,
+        TP_PROTO(struct ieee80211_local *local,
+                 struct ieee80211_vif *vif,
+                 struct ieee80211_bss_conf *info,
+                 u32 changed),
+
+        TP_ARGS(local, vif, info, changed),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                VIF_ENTRY
+                __field(bool, assoc)
+                __field(u16, aid)
+                __field(bool, cts)
+                __field(bool, shortpre)
+                __field(bool, shortslot)
+                __field(u8, dtimper)
+                __field(u16, bcnint)
+                __field(u16, assoc_cap)
+                __field(u64, timestamp)
+                __field(u32, basic_rates)
+                __field(u32, changed)
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                VIF_ASSIGN;
+                __entry->changed = changed;
+                __entry->aid = info->aid;
+                __entry->assoc = info->assoc;
+                __entry->shortpre = info->use_short_preamble;
+                __entry->cts = info->use_cts_prot;
+                __entry->shortslot = info->use_short_slot;
+                __entry->dtimper = info->dtim_period;
+                __entry->bcnint = info->beacon_int;
+                __entry->assoc_cap = info->assoc_capability;
+                __entry->timestamp = info->timestamp;
+                __entry->basic_rates = info->basic_rates;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT  VIF_PR_FMT " changed:%#x",
+                LOCAL_PR_ARG, VIF_PR_ARG, __entry->changed
+        )
+);
+
+TRACE_EVENT(drv_configure_filter,
+        TP_PROTO(struct ieee80211_local *local,
+                 unsigned int changed_flags,
+                 unsigned int *total_flags,
+                 int mc_count),
+
+        TP_ARGS(local, changed_flags, total_flags, mc_count),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                __field(unsigned int, changed)
+                __field(unsigned int, total)
+                __field(int, mc)
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                __entry->changed = changed_flags;
+                __entry->total = *total_flags;
+                __entry->mc = mc_count;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT " changed:%#x total:%#x mc:%d",
+                LOCAL_PR_ARG, __entry->changed, __entry->total, __entry->mc
+        )
+);
+
+TRACE_EVENT(drv_set_tim,
+        TP_PROTO(struct ieee80211_local *local,
+                 struct ieee80211_sta *sta, bool set, int ret),
+
+        TP_ARGS(local, sta, set, ret),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                STA_ENTRY
+                __field(bool, set)
+                __field(int, ret)
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                STA_ASSIGN;
+                __entry->set = set;
+                __entry->ret = ret;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT STA_PR_FMT " set:%d ret:%d",
+                LOCAL_PR_ARG, STA_PR_FMT, __entry->set, __entry->ret
+        )
+);
+
+TRACE_EVENT(drv_set_key,
+        TP_PROTO(struct ieee80211_local *local,
+                 enum set_key_cmd cmd, struct ieee80211_vif *vif,
+                 struct ieee80211_sta *sta,
+                 struct ieee80211_key_conf *key, int ret),
+
+        TP_ARGS(local, cmd, vif, sta, key, ret),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                VIF_ENTRY
+                STA_ENTRY
+                __field(enum ieee80211_key_alg, alg)
+                __field(u8, hw_key_idx)
+                __field(u8, flags)
+                __field(s8, keyidx)
+                __field(int, ret)
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                VIF_ASSIGN;
+                STA_ASSIGN;
+                __entry->alg = key->alg;
+                __entry->flags = key->flags;
+                __entry->keyidx = key->keyidx;
+                __entry->hw_key_idx = key->hw_key_idx;
+                __entry->ret = ret;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT  VIF_PR_FMT  STA_PR_FMT " ret:%d",
+                LOCAL_PR_ARG, VIF_PR_ARG, STA_PR_ARG, __entry->ret
+        )
+);
+
+TRACE_EVENT(drv_update_tkip_key,
+        TP_PROTO(struct ieee80211_local *local,
+                 struct ieee80211_key_conf *conf,
+                 const u8 *address, u32 iv32),
+
+        TP_ARGS(local, conf, address, iv32),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                __array(u8, addr, 6)
+                __field(u32, iv32)
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                memcpy(__entry->addr, address, 6);
+                __entry->iv32 = iv32;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT " addr:%pM iv32:%#x",
+                LOCAL_PR_ARG, __entry->addr, __entry->iv32
+        )
+);
+
+TRACE_EVENT(drv_hw_scan,
+        TP_PROTO(struct ieee80211_local *local,
+                 struct cfg80211_scan_request *req, int ret),
+
+        TP_ARGS(local, req, ret),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                __field(int, ret)
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                __entry->ret = ret;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT " ret:%d",
+                LOCAL_PR_ARG, __entry->ret
+        )
+);
+
+TRACE_EVENT(drv_sw_scan_start,
+        TP_PROTO(struct ieee80211_local *local),
+
+        TP_ARGS(local),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT, LOCAL_PR_ARG
+        )
+);
+
+TRACE_EVENT(drv_sw_scan_complete,
+        TP_PROTO(struct ieee80211_local *local),
+
+        TP_ARGS(local),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT, LOCAL_PR_ARG
+        )
+);
+
+TRACE_EVENT(drv_get_stats,
+        TP_PROTO(struct ieee80211_local *local,
+                 struct ieee80211_low_level_stats *stats,
+                 int ret),
+
+        TP_ARGS(local, stats, ret),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                __field(int, ret)
+                __field(unsigned int, ackfail)
+                __field(unsigned int, rtsfail)
+                __field(unsigned int, fcserr)
+                __field(unsigned int, rtssucc)
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                __entry->ret = ret;
+                __entry->ackfail = stats->dot11ACKFailureCount;
+                __entry->rtsfail = stats->dot11RTSFailureCount;
+                __entry->fcserr = stats->dot11FCSErrorCount;
+                __entry->rtssucc = stats->dot11RTSSuccessCount;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT " ret:%d",
+                LOCAL_PR_ARG, __entry->ret
+        )
+);
+
+TRACE_EVENT(drv_get_tkip_seq,
+        TP_PROTO(struct ieee80211_local *local,
+                 u8 hw_key_idx, u32 *iv32, u16 *iv16),
+
+        TP_ARGS(local, hw_key_idx, iv32, iv16),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                __field(u8, hw_key_idx)
+                __field(u32, iv32)
+                __field(u16, iv16)
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                __entry->hw_key_idx = hw_key_idx;
+                __entry->iv32 = *iv32;
+                __entry->iv16 = *iv16;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT, LOCAL_PR_ARG
+        )
+);
+
+TRACE_EVENT(drv_set_rts_threshold,
+        TP_PROTO(struct ieee80211_local *local, u32 value, int ret),
+
+        TP_ARGS(local, value, ret),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                __field(u32, value)
+                __field(int, ret)
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                __entry->ret = ret;
+                __entry->value = value;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT " value:%d ret:%d",
+                LOCAL_PR_ARG, __entry->value, __entry->ret
+        )
+);
+
+TRACE_EVENT(drv_sta_notify,
+        TP_PROTO(struct ieee80211_local *local,
+                 struct ieee80211_vif *vif,
+                 enum sta_notify_cmd cmd,
+                 struct ieee80211_sta *sta),
+
+        TP_ARGS(local, vif, cmd, sta),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                VIF_ENTRY
+                STA_ENTRY
+                __field(u32, cmd)
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                VIF_ASSIGN;
+                STA_ASSIGN;
+                __entry->cmd = cmd;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT  VIF_PR_FMT  STA_PR_FMT " cmd:%d",
+                LOCAL_PR_ARG, VIF_PR_ARG, STA_PR_ARG, __entry->cmd
+        )
+);
+
+TRACE_EVENT(drv_conf_tx,
+        TP_PROTO(struct ieee80211_local *local, u16 queue,
+                 const struct ieee80211_tx_queue_params *params,
+                 int ret),
+
+        TP_ARGS(local, queue, params, ret),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                __field(u16, queue)
+                __field(u16, txop)
+                __field(u16, cw_min)
+                __field(u16, cw_max)
+                __field(u8, aifs)
+                __field(int, ret)
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                __entry->queue = queue;
+                __entry->ret = ret;
+                __entry->txop = params->txop;
+                __entry->cw_max = params->cw_max;
+                __entry->cw_min = params->cw_min;
+                __entry->aifs = params->aifs;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT " queue:%d ret:%d",
+                LOCAL_PR_ARG, __entry->queue, __entry->ret
+        )
+);
+
+TRACE_EVENT(drv_get_tx_stats,
+        TP_PROTO(struct ieee80211_local *local,
+                 struct ieee80211_tx_queue_stats *stats,
+                 int ret),
+
+        TP_ARGS(local, stats, ret),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                __field(int, ret)
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                __entry->ret = ret;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT " ret:%d",
+                LOCAL_PR_ARG, __entry->ret
+        )
+);
+
+TRACE_EVENT(drv_get_tsf,
+        TP_PROTO(struct ieee80211_local *local, u64 ret),
+
+        TP_ARGS(local, ret),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                __field(u64, ret)
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                __entry->ret = ret;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT " ret:%llu",
+                LOCAL_PR_ARG, (unsigned long long)__entry->ret
+        )
+);
+
+TRACE_EVENT(drv_set_tsf,
+        TP_PROTO(struct ieee80211_local *local, u64 tsf),
+
+        TP_ARGS(local, tsf),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                __field(u64, tsf)
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                __entry->tsf = tsf;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT " tsf:%llu",
+                LOCAL_PR_ARG, (unsigned long long)__entry->tsf
+        )
+);
+
+TRACE_EVENT(drv_reset_tsf,
+        TP_PROTO(struct ieee80211_local *local),
+
+        TP_ARGS(local),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT, LOCAL_PR_ARG
+        )
+);
+
+TRACE_EVENT(drv_tx_last_beacon,
+        TP_PROTO(struct ieee80211_local *local, int ret),
+
+        TP_ARGS(local, ret),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                __field(int, ret)
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                __entry->ret = ret;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT " ret:%d",
+                LOCAL_PR_ARG, __entry->ret
+        )
+);
+
+TRACE_EVENT(drv_ampdu_action,
+        TP_PROTO(struct ieee80211_local *local,
+                 enum ieee80211_ampdu_mlme_action action,
+                 struct ieee80211_sta *sta, u16 tid,
+                 u16 *ssn, int ret),
+
+        TP_ARGS(local, action, sta, tid, ssn, ret),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                STA_ENTRY
+                __field(u32, action)
+                __field(u16, tid)
+                __field(u16, ssn)
+                __field(int, ret)
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                STA_ASSIGN;
+                __entry->ret = ret;
+                __entry->action = action;
+                __entry->tid = tid;
+                __entry->ssn = *ssn;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT  STA_PR_FMT " action:%d tid:%d ret:%d",
+                LOCAL_PR_ARG, STA_PR_ARG, __entry->action, __entry->tid, __entry->ret
+        )
+);
+#endif /* !__MAC80211_DRIVER_TRACE || TRACE_HEADER_MULTI_READ */
+
+#undef TRACE_INCLUDE_PATH
+#define TRACE_INCLUDE_PATH .
+#undef TRACE_INCLUDE_FILE
+#define TRACE_INCLUDE_FILE driver-trace
+#include <trace/define_trace.h>
diff --git a/net/mac80211/event.c b/net/mac80211/event.c
index f288d01a6344..01ae759518f6 100644
--- a/net/mac80211/event.c
+++ b/net/mac80211/event.c
@@ -7,8 +7,7 @@
  *
  * mac80211 - events
  */
-
-#include <net/iw_handler.h>
+#include <net/cfg80211.h>
 #include "ieee80211_i.h"
 
 /*
@@ -17,26 +16,12 @@
  * driver or is still in the frame), it should provide that information.
  */
 void mac80211_ev_michael_mic_failure(struct ieee80211_sub_if_data *sdata, int keyidx,
-                                     struct ieee80211_hdr *hdr, const u8 *tsc)
+                                     struct ieee80211_hdr *hdr, const u8 *tsc,
+                                     gfp_t gfp)
 {
-        union iwreq_data wrqu;
-        char *buf = kmalloc(128, GFP_ATOMIC);
-
-        if (buf) {
-                /* TODO: needed parameters: count, key type, TSC */
-                sprintf(buf, "MLME-MICHAELMICFAILURE.indication("
-                        "keyid=%d %scast addr=%pM)",
-                        keyidx, hdr->addr1[0] & 0x01 ? "broad" : "uni",
-                        hdr->addr2);
-                memset(&wrqu, 0, sizeof(wrqu));
-                wrqu.data.length = strlen(buf);
-                wireless_send_event(sdata->dev, IWEVCUSTOM, &wrqu, buf);
-                kfree(buf);
-        }
-
         cfg80211_michael_mic_failure(sdata->dev, hdr->addr2,
                                      (hdr->addr1[0] & 0x01) ?
                                      NL80211_KEYTYPE_GROUP :
                                      NL80211_KEYTYPE_PAIRWISE,
-                                     keyidx, tsc);
+                                     keyidx, tsc, gfp);
 }
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index 0b30277eb366..8e2220000e5c 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -57,7 +57,7 @@ static void ieee80211_rx_mgmt_auth_ibss(struct ieee80211_sub_if_data *sdata,
          */
         if (auth_alg == WLAN_AUTH_OPEN && auth_transaction == 1)
                 ieee80211_send_auth(sdata, 2, WLAN_AUTH_OPEN, NULL, 0,
-                                    sdata->u.ibss.bssid, 0);
+                                    sdata->u.ibss.bssid, NULL, 0, 0);
 }
 
 static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
@@ -494,7 +494,7 @@ static void ieee80211_sta_create_ibss(struct ieee80211_sub_if_data *sdata)
 
         capability = WLAN_CAPABILITY_IBSS;
 
-        if (sdata->default_key)
+        if (ifibss->privacy)
                 capability |= WLAN_CAPABILITY_PRIVACY;
         else
                 sdata->drop_unencrypted = 0;
@@ -524,9 +524,8 @@ static void ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata)
                 return;
 
         capability = WLAN_CAPABILITY_IBSS;
-        if (sdata->default_key)
+        if (ifibss->privacy)
                 capability |= WLAN_CAPABILITY_PRIVACY;
-
         if (ifibss->fixed_bssid)
                 bssid = ifibss->bssid;
         if (ifibss->fixed_channel)
@@ -705,7 +704,7 @@ static void ieee80211_ibss_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_mgmt *mgmt;
         u16 fc;
 
-        rx_status = (struct ieee80211_rx_status *) skb->cb;
+        rx_status = IEEE80211_SKB_RXCB(skb);
         mgmt = (struct ieee80211_mgmt *) skb->data;
         fc = le16_to_cpu(mgmt->frame_control);
 
@@ -836,8 +835,7 @@ void ieee80211_ibss_notify_scan_completed(struct ieee80211_local *local)
 }
 
 ieee80211_rx_result
-ieee80211_ibss_rx_mgmt(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb,
-                       struct ieee80211_rx_status *rx_status)
+ieee80211_ibss_rx_mgmt(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb)
 {
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_mgmt *mgmt;
@@ -852,7 +850,6 @@ ieee80211_ibss_rx_mgmt(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb,
         switch (fc & IEEE80211_FCTL_STYPE) {
         case IEEE80211_STYPE_PROBE_RESP:
         case IEEE80211_STYPE_BEACON:
-                memcpy(skb->cb, rx_status, sizeof(*rx_status));
         case IEEE80211_STYPE_PROBE_REQ:
         case IEEE80211_STYPE_AUTH:
                 skb_queue_tail(&sdata->u.ibss.skb_queue, skb);
@@ -874,6 +871,8 @@ int ieee80211_ibss_join(struct ieee80211_sub_if_data *sdata,
         } else
                 sdata->u.ibss.fixed_bssid = false;
 
+        sdata->u.ibss.privacy = params->privacy;
+
         sdata->vif.bss_conf.beacon_int = params->beacon_interval;
 
         sdata->u.ibss.channel = params->channel;
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 68eb5052179a..6a0177137dd5 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -227,86 +227,79 @@ struct mesh_preq_queue {
         u8 flags;
 };
 
+enum ieee80211_mgd_state {
+        IEEE80211_MGD_STATE_IDLE,
+        IEEE80211_MGD_STATE_PROBE,
+        IEEE80211_MGD_STATE_AUTH,
+        IEEE80211_MGD_STATE_ASSOC,
+};
+
+struct ieee80211_mgd_work {
+        struct list_head list;
+        struct ieee80211_bss *bss;
+        int ie_len;
+        u8 prev_bssid[ETH_ALEN];
+        u8 ssid[IEEE80211_MAX_SSID_LEN];
+        u8 ssid_len;
+        unsigned long timeout;
+        enum ieee80211_mgd_state state;
+        u16 auth_alg, auth_transaction;
+
+        int tries;
+
+        u8 key[WLAN_KEY_LEN_WEP104];
+        u8 key_len, key_idx;
+
+        /* must be last */
+        u8 ie[0]; /* for auth or assoc frame, not probe */
+};
+
 /* flags used in struct ieee80211_if_managed.flags */
-#define IEEE80211_STA_SSID_SET          BIT(0)
-#define IEEE80211_STA_BSSID_SET         BIT(1)
-#define IEEE80211_STA_PREV_BSSID_SET    BIT(2)
-#define IEEE80211_STA_AUTHENTICATED     BIT(3)
-#define IEEE80211_STA_ASSOCIATED        BIT(4)
-#define IEEE80211_STA_PROBEREQ_POLL     BIT(5)
-#define IEEE80211_STA_CREATE_IBSS       BIT(6)
-#define IEEE80211_STA_CONTROL_PORT      BIT(7)
-#define IEEE80211_STA_WMM_ENABLED       BIT(8)
-/* hole at 9, please re-use */
-#define IEEE80211_STA_AUTO_SSID_SEL     BIT(10)
-#define IEEE80211_STA_AUTO_BSSID_SEL    BIT(11)
-#define IEEE80211_STA_AUTO_CHANNEL_SEL  BIT(12)
-#define IEEE80211_STA_PRIVACY_INVOKED   BIT(13)
-#define IEEE80211_STA_TKIP_WEP_USED     BIT(14)
-#define IEEE80211_STA_CSA_RECEIVED      BIT(15)
-#define IEEE80211_STA_MFP_ENABLED       BIT(16)
-#define IEEE80211_STA_EXT_SME           BIT(17)
-/* flags for MLME request */
-#define IEEE80211_STA_REQ_SCAN 0
-#define IEEE80211_STA_REQ_AUTH 1
-#define IEEE80211_STA_REQ_RUN  2
+enum ieee80211_sta_flags {
+        IEEE80211_STA_BEACON_POLL       = BIT(0),
+        IEEE80211_STA_CONNECTION_POLL   = BIT(1),
+        IEEE80211_STA_CONTROL_PORT      = BIT(2),
+        IEEE80211_STA_WMM_ENABLED       = BIT(3),
+        IEEE80211_STA_DISABLE_11N       = BIT(4),
+        IEEE80211_STA_CSA_RECEIVED      = BIT(5),
+        IEEE80211_STA_MFP_ENABLED       = BIT(6),
+};
 
-/* bitfield of allowed auth algs */
-#define IEEE80211_AUTH_ALG_OPEN BIT(0)
-#define IEEE80211_AUTH_ALG_SHARED_KEY BIT(1)
-#define IEEE80211_AUTH_ALG_LEAP BIT(2)
-#define IEEE80211_AUTH_ALG_FT BIT(3)
+/* flags for MLME request */
+enum ieee80211_sta_request {
+        IEEE80211_STA_REQ_SCAN,
+};
 
 struct ieee80211_if_managed {
         struct timer_list timer;
+        struct timer_list conn_mon_timer;
+        struct timer_list bcn_mon_timer;
         struct timer_list chswitch_timer;
         struct work_struct work;
+        struct work_struct monitor_work;
         struct work_struct chswitch_work;
         struct work_struct beacon_loss_work;
 
-        u8 bssid[ETH_ALEN], prev_bssid[ETH_ALEN];
+        unsigned long probe_timeout;
 
-        u8 ssid[IEEE80211_MAX_SSID_LEN];
-        size_t ssid_len;
+        struct mutex mtx;
+        struct ieee80211_bss *associated;
+        struct list_head work_list;
 
-        enum {
-                IEEE80211_STA_MLME_DISABLED,
-                IEEE80211_STA_MLME_DIRECT_PROBE,
-                IEEE80211_STA_MLME_AUTHENTICATE,
-                IEEE80211_STA_MLME_ASSOCIATE,
-                IEEE80211_STA_MLME_ASSOCIATED,
-        } state;
+        u8 bssid[ETH_ALEN];
 
         u16 aid;
-        u16 ap_capab, capab;
-        u8 *extra_ie; /* to be added to the end of AssocReq */
-        size_t extra_ie_len;
-
-        /* The last AssocReq/Resp IEs */
-        u8 *assocreq_ies, *assocresp_ies;
-        size_t assocreq_ies_len, assocresp_ies_len;
+        u16 capab;
 
         struct sk_buff_head skb_queue;
 
-        int assoc_scan_tries; /* number of scans done pre-association */
-        int direct_probe_tries; /* retries for direct probes */
-        int auth_tries; /* retries for auth req */
-        int assoc_tries; /* retries for assoc req */
-
         unsigned long timers_running; /* used for quiesce/restart */
         bool powersave; /* powersave requested for this iface */
 
         unsigned long request;
 
-        unsigned long last_probe;
-        unsigned long last_beacon;
-
         unsigned int flags;
 
-        unsigned int auth_algs; /* bitfield of allowed auth algs */
-        int auth_alg; /* currently used IEEE 802.11 authentication algorithm */
-        int auth_transaction;
-
         u32 beacon_crc;
 
         enum {
@@ -316,10 +309,6 @@ struct ieee80211_if_managed {
         } mfp; /* management frame protection */
 
         int wmm_last_param_set;
-
-        /* Extra IE data for management frames */
-        u8 *sme_auth_ie;
-        size_t sme_auth_ie_len;
 };
 
 enum ieee80211_ibss_request {
@@ -339,6 +328,7 @@ struct ieee80211_if_ibss {
 
         bool fixed_bssid;
         bool fixed_channel;
+        bool privacy;
 
         u8 bssid[ETH_ALEN];
         u8 ssid[IEEE80211_MAX_SSID_LEN];
@@ -478,20 +468,9 @@ struct ieee80211_sub_if_data {
         union {
                 struct {
                         struct dentry *drop_unencrypted;
-                        struct dentry *state;
                         struct dentry *bssid;
-                        struct dentry *prev_bssid;
-                        struct dentry *ssid_len;
                         struct dentry *aid;
-                        struct dentry *ap_capab;
                         struct dentry *capab;
-                        struct dentry *extra_ie_len;
-                        struct dentry *auth_tries;
-                        struct dentry *assoc_tries;
-                        struct dentry *auth_algs;
-                        struct dentry *auth_alg;
-                        struct dentry *auth_transaction;
-                        struct dentry *flags;
                         struct dentry *force_unicast_rateidx;
                         struct dentry *max_ratectrl_rateidx;
                 } sta;
@@ -588,14 +567,9 @@ enum queue_stop_reason {
         IEEE80211_QUEUE_STOP_REASON_CSA,
         IEEE80211_QUEUE_STOP_REASON_AGGREGATION,
         IEEE80211_QUEUE_STOP_REASON_SUSPEND,
-        IEEE80211_QUEUE_STOP_REASON_PENDING,
         IEEE80211_QUEUE_STOP_REASON_SKB_ADD,
 };
 
-struct ieee80211_master_priv {
-        struct ieee80211_local *local;
-};
-
 struct ieee80211_local {
         /* embed the driver visible part.
          * don't cast (use the static inlines below), but we keep
@@ -608,13 +582,20 @@ struct ieee80211_local {
         /* also used to protect ampdu_ac_queue and amdpu_ac_stop_refcnt */
         spinlock_t queue_stop_reason_lock;
 
-        struct net_device *mdev; /* wmaster# - "master" 802.11 device */
         int open_count;
         int monitors, cooked_mntrs;
         /* number of interfaces with corresponding FIF_ flags */
         int fif_fcsfail, fif_plcpfail, fif_control, fif_other_bss;
         unsigned int filter_flags; /* FIF_* */
         struct iw_statistics wstats;
+
+        /* protects the aggregated multicast list and filter calls */
+        spinlock_t filter_lock;
+
+        /* aggregated multicast list */
+        struct dev_addr_list *mc_list;
+        int mc_count;
+
         bool tim_in_locked_section; /* see ieee80211_beacon_get() */
 
         /*
@@ -834,10 +815,6 @@ struct ieee80211_local {
 static inline struct ieee80211_sub_if_data *
 IEEE80211_DEV_TO_SUB_IF(struct net_device *dev)
 {
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-
-        BUG_ON(!local || local->mdev == dev);
-
         return netdev_priv(dev);
 }
 
@@ -942,16 +919,18 @@ extern const struct iw_handler_def ieee80211_iw_handler_def;
 
 /* STA code */
 void ieee80211_sta_setup_sdata(struct ieee80211_sub_if_data *sdata);
+int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata,
+                       struct cfg80211_auth_request *req);
+int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
+                        struct cfg80211_assoc_request *req);
+int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
+                         struct cfg80211_deauth_request *req,
+                         void *cookie);
+int ieee80211_mgd_disassoc(struct ieee80211_sub_if_data *sdata,
+                           struct cfg80211_disassoc_request *req,
+                           void *cookie);
 ieee80211_rx_result ieee80211_sta_rx_mgmt(struct ieee80211_sub_if_data *sdata,
-                                          struct sk_buff *skb,
-                                          struct ieee80211_rx_status *rx_status);
-int ieee80211_sta_commit(struct ieee80211_sub_if_data *sdata);
-int ieee80211_sta_set_ssid(struct ieee80211_sub_if_data *sdata, char *ssid, size_t len);
-int ieee80211_sta_get_ssid(struct ieee80211_sub_if_data *sdata, char *ssid, size_t *len);
-int ieee80211_sta_set_bssid(struct ieee80211_sub_if_data *sdata, u8 *bssid);
-void ieee80211_sta_req_auth(struct ieee80211_sub_if_data *sdata);
-int ieee80211_sta_deauthenticate(struct ieee80211_sub_if_data *sdata, u16 reason);
-int ieee80211_sta_disassociate(struct ieee80211_sub_if_data *sdata, u16 reason);
+                                          struct sk_buff *skb);
 void ieee80211_send_pspoll(struct ieee80211_local *local,
                            struct ieee80211_sub_if_data *sdata);
 void ieee80211_recalc_ps(struct ieee80211_local *local, s32 latency);
@@ -967,8 +946,7 @@ void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata);
 void ieee80211_ibss_notify_scan_completed(struct ieee80211_local *local);
 void ieee80211_ibss_setup_sdata(struct ieee80211_sub_if_data *sdata);
 ieee80211_rx_result
-ieee80211_ibss_rx_mgmt(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb,
-                       struct ieee80211_rx_status *rx_status);
+ieee80211_ibss_rx_mgmt(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb);
 struct sta_info *ieee80211_ibss_add_sta(struct ieee80211_sub_if_data *sdata,
                                         u8 *bssid, u8 *addr, u32 supp_rates);
 int ieee80211_ibss_join(struct ieee80211_sub_if_data *sdata,
@@ -983,16 +961,9 @@ int ieee80211_request_internal_scan(struct ieee80211_sub_if_data *sdata,
                                     const u8 *ssid, u8 ssid_len);
 int ieee80211_request_scan(struct ieee80211_sub_if_data *sdata,
                            struct cfg80211_scan_request *req);
-int ieee80211_scan_results(struct ieee80211_local *local,
-                           struct iw_request_info *info,
-                           char *buf, size_t len);
 void ieee80211_scan_cancel(struct ieee80211_local *local);
 ieee80211_rx_result
-ieee80211_scan_rx(struct ieee80211_sub_if_data *sdata,
-                  struct sk_buff *skb,
-                  struct ieee80211_rx_status *rx_status);
-int ieee80211_sta_set_extra_ie(struct ieee80211_sub_if_data *sdata,
-                               const char *ie, size_t len);
+ieee80211_scan_rx(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb);
 
 void ieee80211_mlme_notify_scan_completed(struct ieee80211_local *local);
 struct ieee80211_bss *
@@ -1008,8 +979,6 @@ ieee80211_rx_bss_get(struct ieee80211_local *local, u8 *bssid, int freq,
                      u8 *ssid, u8 ssid_len);
 void ieee80211_rx_bss_put(struct ieee80211_local *local,
                           struct ieee80211_bss *bss);
-void ieee80211_rx_bss_remove(struct ieee80211_sub_if_data *sdata, u8 *bssid,
-                             int freq, u8 *ssid, u8 ssid_len);
 
 /* interface handling */
 int ieee80211_if_add(struct ieee80211_local *local, const char *name,
@@ -1025,7 +994,6 @@ void ieee80211_recalc_idle(struct ieee80211_local *local);
 /* tx handling */
 void ieee80211_clear_tx_pending(struct ieee80211_local *local);
 void ieee80211_tx_pending(unsigned long data);
-int ieee80211_master_start_xmit(struct sk_buff *skb, struct net_device *dev);
 int ieee80211_monitor_start_xmit(struct sk_buff *skb, struct net_device *dev);
 int ieee80211_subif_start_xmit(struct sk_buff *skb, struct net_device *dev);
 
@@ -1092,7 +1060,8 @@ u8 *ieee80211_get_bssid(struct ieee80211_hdr *hdr, size_t len,
 int ieee80211_frame_duration(struct ieee80211_local *local, size_t len,
                              int rate, int erp, int short_preamble);
 void mac80211_ev_michael_mic_failure(struct ieee80211_sub_if_data *sdata, int keyidx,
-                                     struct ieee80211_hdr *hdr, const u8 *tsc);
+                                     struct ieee80211_hdr *hdr, const u8 *tsc,
+                                     gfp_t gfp);
 void ieee80211_set_wmm_default(struct ieee80211_sub_if_data *sdata);
 void ieee80211_tx_skb(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb,
                       int encrypt);
@@ -1129,8 +1098,8 @@ int ieee80211_add_pending_skbs(struct ieee80211_local *local,
 
 void ieee80211_send_auth(struct ieee80211_sub_if_data *sdata,
                          u16 transaction, u16 auth_alg,
-                         u8 *extra, size_t extra_len,
-                         const u8 *bssid, int encrypt);
+                         u8 *extra, size_t extra_len, const u8 *bssid,
+                         const u8 *key, u8 key_len, u8 key_idx);
 int ieee80211_build_preq_ies(struct ieee80211_local *local, u8 *buffer,
                              const u8 *ie, size_t ie_len);
 void ieee80211_send_probe_req(struct ieee80211_sub_if_data *sdata, u8 *dst,
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index b7c8a4484298..2f797a86ced5 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -190,10 +190,6 @@ static int ieee80211_open(struct net_device *dev)
                                ETH_ALEN);
         }
 
-        if (compare_ether_addr(null_addr, local->mdev->dev_addr) == 0)
-                memcpy(local->mdev->dev_addr, local->hw.wiphy->perm_addr,
-                       ETH_ALEN);
-
         /*
          * Validate the MAC address for this device.
          */
@@ -229,13 +225,10 @@ static int ieee80211_open(struct net_device *dev)
                 if (sdata->u.mntr_flags & MONITOR_FLAG_OTHER_BSS)
                         local->fif_other_bss++;
 
-                netif_addr_lock_bh(local->mdev);
+                spin_lock_bh(&local->filter_lock);
                 ieee80211_configure_filter(local);
-                netif_addr_unlock_bh(local->mdev);
+                spin_unlock_bh(&local->filter_lock);
                 break;
-        case NL80211_IFTYPE_STATION:
-                sdata->u.mgd.flags &= ~IEEE80211_STA_PREV_BSSID_SET;
-                /* fall through */
         default:
                 conf.vif = &sdata->vif;
                 conf.type = sdata->vif.type;
@@ -246,9 +239,9 @@ static int ieee80211_open(struct net_device *dev)
 
                 if (ieee80211_vif_is_mesh(&sdata->vif)) {
                         local->fif_other_bss++;
-                        netif_addr_lock_bh(local->mdev);
+                        spin_lock_bh(&local->filter_lock);
                         ieee80211_configure_filter(local);
-                        netif_addr_unlock_bh(local->mdev);
+                        spin_unlock_bh(&local->filter_lock);
 
                         ieee80211_start_mesh(sdata);
                 }
@@ -282,10 +275,6 @@ static int ieee80211_open(struct net_device *dev)
         }
 
         if (local->open_count == 0) {
-                res = dev_open(local->mdev);
-                WARN_ON(res);
-                if (res)
-                        goto err_del_interface;
                 tasklet_enable(&local->tx_pending_tasklet);
                 tasklet_enable(&local->tasklet);
         }
@@ -366,18 +355,6 @@ static int ieee80211_stop(struct net_device *dev)
         rcu_read_unlock();
 
         /*
-         * Announce that we are leaving the network, in case we are a
-         * station interface type. This must be done before removing
-         * all stations associated with sta_info_flush, otherwise STA
-         * information will be gone and no announce being done.
-         */
-        if (sdata->vif.type == NL80211_IFTYPE_STATION) {
-                if (sdata->u.mgd.state != IEEE80211_STA_MLME_DISABLED)
-                        ieee80211_sta_deauthenticate(sdata,
-                                WLAN_REASON_DEAUTH_LEAVING);
-        }
-
-        /*
          * Remove all stations associated with this interface.
          *
          * This must be done before calling ops->remove_interface()
@@ -408,7 +385,14 @@ static int ieee80211_stop(struct net_device *dev)
         if (sdata->flags & IEEE80211_SDATA_PROMISC)
                 atomic_dec(&local->iff_promiscs);
 
-        dev_mc_unsync(local->mdev, dev);
+        netif_addr_lock_bh(dev);
+        spin_lock_bh(&local->filter_lock);
+        __dev_addr_unsync(&local->mc_list, &local->mc_count,
+                          &dev->mc_list, &dev->mc_count);
+        ieee80211_configure_filter(local);
+        spin_unlock_bh(&local->filter_lock);
+        netif_addr_unlock_bh(dev);
+
         del_timer_sync(&local->dynamic_ps_timer);
         cancel_work_sync(&local->dynamic_ps_enable_work);
 
@@ -457,24 +441,25 @@ static int ieee80211_stop(struct net_device *dev)
                 if (sdata->u.mntr_flags & MONITOR_FLAG_OTHER_BSS)
                         local->fif_other_bss--;
 
-                netif_addr_lock_bh(local->mdev);
+                spin_lock_bh(&local->filter_lock);
                 ieee80211_configure_filter(local);
-                netif_addr_unlock_bh(local->mdev);
+                spin_unlock_bh(&local->filter_lock);
                 break;
         case NL80211_IFTYPE_STATION:
-                memset(sdata->u.mgd.bssid, 0, ETH_ALEN);
                 del_timer_sync(&sdata->u.mgd.chswitch_timer);
                 del_timer_sync(&sdata->u.mgd.timer);
+                del_timer_sync(&sdata->u.mgd.conn_mon_timer);
+                del_timer_sync(&sdata->u.mgd.bcn_mon_timer);
                 /*
-                 * If the timer fired while we waited for it, it will have
-                 * requeued the work. Now the work will be running again
+                 * If any of the timers fired while we waited for it, it will
+                 * have queued its work. Now the work will be running again
                  * but will not rearm the timer again because it checks
                  * whether the interface is running, which, at this point,
                  * it no longer is.
                  */
                 cancel_work_sync(&sdata->u.mgd.work);
                 cancel_work_sync(&sdata->u.mgd.chswitch_work);
-
+                cancel_work_sync(&sdata->u.mgd.monitor_work);
                 cancel_work_sync(&sdata->u.mgd.beacon_loss_work);
 
                 /*
@@ -485,12 +470,6 @@ static int ieee80211_stop(struct net_device *dev)
                  */
                 synchronize_rcu();
                 skb_queue_purge(&sdata->u.mgd.skb_queue);
-
-                sdata->u.mgd.flags &= ~(IEEE80211_STA_PRIVACY_INVOKED |
-                                        IEEE80211_STA_TKIP_WEP_USED);
-                kfree(sdata->u.mgd.extra_ie);
-                sdata->u.mgd.extra_ie = NULL;
-                sdata->u.mgd.extra_ie_len = 0;
                 /* fall through */
         case NL80211_IFTYPE_ADHOC:
                 if (sdata->vif.type == NL80211_IFTYPE_ADHOC) {
@@ -507,9 +486,9 @@ static int ieee80211_stop(struct net_device *dev)
                         local->fif_other_bss--;
                         atomic_dec(&local->iff_allmultis);
 
-                        netif_addr_lock_bh(local->mdev);
+                        spin_lock_bh(&local->filter_lock);
                         ieee80211_configure_filter(local);
-                        netif_addr_unlock_bh(local->mdev);
+                        spin_unlock_bh(&local->filter_lock);
 
                         ieee80211_stop_mesh(sdata);
                 }
@@ -555,9 +534,6 @@ static int ieee80211_stop(struct net_device *dev)
         ieee80211_recalc_ps(local, -1);
 
         if (local->open_count == 0) {
-                if (netif_running(local->mdev))
-                        dev_close(local->mdev);
-
                 drv_stop(local);
 
                 ieee80211_led_radio(local, false);
@@ -604,8 +580,11 @@ static void ieee80211_set_multicast_list(struct net_device *dev)
                         atomic_dec(&local->iff_promiscs);
                 sdata->flags ^= IEEE80211_SDATA_PROMISC;
         }
-
-        dev_mc_sync(local->mdev, dev);
+        spin_lock_bh(&local->filter_lock);
+        __dev_addr_sync(&local->mc_list, &local->mc_count,
+                        &dev->mc_list, &dev->mc_count);
+        ieee80211_configure_filter(local);
+        spin_unlock_bh(&local->filter_lock);
 }
 
 /*
@@ -652,11 +631,6 @@ static void ieee80211_teardown_sdata(struct net_device *dev)
                         kfree_skb(sdata->u.ibss.presp);
                 break;
         case NL80211_IFTYPE_STATION:
-                kfree(sdata->u.mgd.extra_ie);
-                kfree(sdata->u.mgd.assocreq_ies);
-                kfree(sdata->u.mgd.assocresp_ies);
-                kfree(sdata->u.mgd.sme_auth_ie);
-                break;
         case NL80211_IFTYPE_WDS:
         case NL80211_IFTYPE_AP_VLAN:
         case NL80211_IFTYPE_MONITOR:
@@ -939,7 +913,8 @@ u32 __ieee80211_recalc_idle(struct ieee80211_local *local)
                         continue;
                 /* do not count disabled managed interfaces */
                 if (sdata->vif.type == NL80211_IFTYPE_STATION &&
-                    sdata->u.mgd.state == IEEE80211_STA_MLME_DISABLED)
+                    !sdata->u.mgd.associated &&
+                    list_empty(&sdata->u.mgd.work_list))
                         continue;
                 /* do not count unused IBSS interfaces */
                 if (sdata->vif.type == NL80211_IFTYPE_ADHOC &&
diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index ce267565e180..659a42d529e3 100644
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -67,6 +67,8 @@ static DECLARE_WORK(todo_work, key_todo);
  *
  * @key: key to add to do item for
  * @flag: todo flag(s)
+ *
+ * Must be called with IRQs or softirqs disabled.
  */
 static void add_todo(struct ieee80211_key *key, u32 flag)
 {
@@ -140,9 +142,9 @@ static void ieee80211_key_enable_hw_accel(struct ieee80211_key *key)
         ret = drv_set_key(key->local, SET_KEY, &sdata->vif, sta, &key->conf);
 
         if (!ret) {
-                spin_lock(&todo_lock);
+                spin_lock_bh(&todo_lock);
                 key->flags |= KEY_FLAG_UPLOADED_TO_HARDWARE;
-                spin_unlock(&todo_lock);
+                spin_unlock_bh(&todo_lock);
         }
 
         if (ret && ret != -ENOSPC && ret != -EOPNOTSUPP)
@@ -164,12 +166,12 @@ static void ieee80211_key_disable_hw_accel(struct ieee80211_key *key)
         if (!key || !key->local->ops->set_key)
                 return;
 
-        spin_lock(&todo_lock);
+        spin_lock_bh(&todo_lock);
         if (!(key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE)) {
-                spin_unlock(&todo_lock);
+                spin_unlock_bh(&todo_lock);
                 return;
         }
-        spin_unlock(&todo_lock);
+        spin_unlock_bh(&todo_lock);
 
         sta = get_sta_for_key(key);
         sdata = key->sdata;
@@ -188,9 +190,9 @@ static void ieee80211_key_disable_hw_accel(struct ieee80211_key *key)
                        wiphy_name(key->local->hw.wiphy),
                        key->conf.keyidx, sta ? sta->addr : bcast_addr, ret);
 
-        spin_lock(&todo_lock);
+        spin_lock_bh(&todo_lock);
         key->flags &= ~KEY_FLAG_UPLOADED_TO_HARDWARE;
-        spin_unlock(&todo_lock);
+        spin_unlock_bh(&todo_lock);
 }
 
 static void __ieee80211_set_default_key(struct ieee80211_sub_if_data *sdata,
@@ -437,14 +439,14 @@ void ieee80211_key_link(struct ieee80211_key *key,
 
         __ieee80211_key_replace(sdata, sta, old_key, key);
 
-        spin_unlock_irqrestore(&sdata->local->key_lock, flags);
-
         /* free old key later */
         add_todo(old_key, KEY_FLAG_TODO_DELETE);
 
         add_todo(key, KEY_FLAG_TODO_ADD_DEBUGFS);
         if (netif_running(sdata->dev))
                 add_todo(key, KEY_FLAG_TODO_HWACCEL_ADD);
+
+        spin_unlock_irqrestore(&sdata->local->key_lock, flags);
 }
 
 static void __ieee80211_key_free(struct ieee80211_key *key)
@@ -547,7 +549,7 @@ static void __ieee80211_key_todo(void)
          */
         synchronize_rcu();
 
-        spin_lock(&todo_lock);
+        spin_lock_bh(&todo_lock);
         while (!list_empty(&todo_list)) {
                 key = list_first_entry(&todo_list, struct ieee80211_key, todo);
                 list_del_init(&key->todo);
@@ -558,7 +560,7 @@ static void __ieee80211_key_todo(void)
                                           KEY_FLAG_TODO_HWACCEL_REMOVE |
                                           KEY_FLAG_TODO_DELETE);
                 key->flags &= ~todoflags;
-                spin_unlock(&todo_lock);
+                spin_unlock_bh(&todo_lock);
 
                 work_done = false;
 
@@ -591,9 +593,9 @@ static void __ieee80211_key_todo(void)
 
                 WARN_ON(!work_done);
 
-                spin_lock(&todo_lock);
+                spin_lock_bh(&todo_lock);
         }
-        spin_unlock(&todo_lock);
+        spin_unlock_bh(&todo_lock);
 }
 
 void ieee80211_key_todo(void)
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 092a017b237e..3234f3751d22 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -83,75 +83,14 @@ void ieee80211_configure_filter(struct ieee80211_local *local)
         new_flags |= (1<<31);
 
         drv_configure_filter(local, changed_flags, &new_flags,
-                             local->mdev->mc_count,
-                             local->mdev->mc_list);
+                             local->mc_count,
+                             local->mc_list);
 
         WARN_ON(new_flags & (1<<31));
 
         local->filter_flags = new_flags & ~(1<<31);
 }
 
-/* master interface */
-
-static int header_parse_80211(const struct sk_buff *skb, unsigned char *haddr)
-{
-        memcpy(haddr, skb_mac_header(skb) + 10, ETH_ALEN); /* addr2 */
-        return ETH_ALEN;
-}
-
-static const struct header_ops ieee80211_header_ops = {
-        .create         = eth_header,
-        .parse          = header_parse_80211,
-        .rebuild        = eth_rebuild_header,
-        .cache          = eth_header_cache,
-        .cache_update   = eth_header_cache_update,
-};
-
-static int ieee80211_master_open(struct net_device *dev)
-{
-        struct ieee80211_master_priv *mpriv = netdev_priv(dev);
-        struct ieee80211_local *local = mpriv->local;
-        struct ieee80211_sub_if_data *sdata;
-        int res = -EOPNOTSUPP;
-
-        /* we hold the RTNL here so can safely walk the list */
-        list_for_each_entry(sdata, &local->interfaces, list) {
-                if (netif_running(sdata->dev)) {
-                        res = 0;
-                        break;
-                }
-        }
-
-        if (res)
-                return res;
-
-        netif_tx_start_all_queues(local->mdev);
-
-        return 0;
-}
-
-static int ieee80211_master_stop(struct net_device *dev)
-{
-        struct ieee80211_master_priv *mpriv = netdev_priv(dev);
-        struct ieee80211_local *local = mpriv->local;
-        struct ieee80211_sub_if_data *sdata;
-
-        /* we hold the RTNL here so can safely walk the list */
-        list_for_each_entry(sdata, &local->interfaces, list)
-                if (netif_running(sdata->dev))
-                        dev_close(sdata->dev);
-
-        return 0;
-}
-
-static void ieee80211_master_set_multicast_list(struct net_device *dev)
-{
-        struct ieee80211_master_priv *mpriv = netdev_priv(dev);
-        struct ieee80211_local *local = mpriv->local;
-
-        ieee80211_configure_filter(local);
-}
-
 int ieee80211_hw_config(struct ieee80211_local *local, u32 changed)
 {
         struct ieee80211_channel *chan, *scan_chan;
@@ -310,7 +249,6 @@ void ieee80211_tx_status_irqsafe(struct ieee80211_hw *hw,
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         int tmp;
 
-        skb->dev = local->mdev;
         skb->pkt_type = IEEE80211_TX_STATUS_MSG;
         skb_queue_tail(info->flags & IEEE80211_TX_CTL_REQ_TX_STATUS ?
                        &local->skb_queue : &local->skb_queue_unreliable, skb);
@@ -330,19 +268,16 @@ static void ieee80211_tasklet_handler(unsigned long data)
 {
         struct ieee80211_local *local = (struct ieee80211_local *) data;
         struct sk_buff *skb;
-        struct ieee80211_rx_status rx_status;
         struct ieee80211_ra_tid *ra_tid;
 
         while ((skb = skb_dequeue(&local->skb_queue)) ||
                (skb = skb_dequeue(&local->skb_queue_unreliable))) {
                 switch (skb->pkt_type) {
                 case IEEE80211_RX_MSG:
-                        /* status is in skb->cb */
-                        memcpy(&rx_status, skb->cb, sizeof(rx_status));
                         /* Clear skb->pkt_type in order to not confuse kernel
                          * netstack. */
                         skb->pkt_type = 0;
-                        __ieee80211_rx(local_to_hw(local), skb, &rx_status);
+                        ieee80211_rx(local_to_hw(local), skb);
                         break;
                 case IEEE80211_TX_STATUS_MSG:
                         skb->pkt_type = 0;
@@ -719,7 +654,7 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
         mutex_init(&local->scan_mtx);
 
         spin_lock_init(&local->key_lock);
-
+        spin_lock_init(&local->filter_lock);
         spin_lock_init(&local->queue_stop_reason_lock);
 
         INIT_DELAYED_WORK(&local->scan_work, ieee80211_scan_work);
@@ -755,30 +690,11 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
 }
 EXPORT_SYMBOL(ieee80211_alloc_hw);
 
-static const struct net_device_ops ieee80211_master_ops = {
-        .ndo_start_xmit = ieee80211_master_start_xmit,
-        .ndo_open = ieee80211_master_open,
-        .ndo_stop = ieee80211_master_stop,
-        .ndo_set_multicast_list = ieee80211_master_set_multicast_list,
-        .ndo_select_queue = ieee80211_select_queue,
-};
-
-static void ieee80211_master_setup(struct net_device *mdev)
-{
-        mdev->type = ARPHRD_IEEE80211;
-        mdev->netdev_ops = &ieee80211_master_ops;
-        mdev->header_ops = &ieee80211_header_ops;
-        mdev->tx_queue_len = 1000;
-        mdev->addr_len = ETH_ALEN;
-}
-
 int ieee80211_register_hw(struct ieee80211_hw *hw)
 {
         struct ieee80211_local *local = hw_to_local(hw);
         int result;
         enum ieee80211_band band;
-        struct net_device *mdev;
-        struct ieee80211_master_priv *mpriv;
         int channels, i, j, max_bitrates;
         bool supp_ht;
         static const u32 cipher_suites[] = {
@@ -877,16 +793,6 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
         if (hw->queues > IEEE80211_MAX_QUEUES)
                 hw->queues = IEEE80211_MAX_QUEUES;
 
-        mdev = alloc_netdev_mq(sizeof(struct ieee80211_master_priv),
-                               "wmaster%d", ieee80211_master_setup,
-                               hw->queues);
-        if (!mdev)
-                goto fail_mdev_alloc;
-
-        mpriv = netdev_priv(mdev);
-        mpriv->local = local;
-        local->mdev = mdev;
-
         local->hw.workqueue =
                 create_singlethread_workqueue(wiphy_name(local->hw.wiphy));
         if (!local->hw.workqueue) {
@@ -921,17 +827,6 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
         }
 
         rtnl_lock();
-        result = dev_alloc_name(local->mdev, local->mdev->name);
-        if (result < 0)
-                goto fail_dev;
-
-        memcpy(local->mdev->dev_addr, local->hw.wiphy->perm_addr, ETH_ALEN);
-        SET_NETDEV_DEV(local->mdev, wiphy_dev(local->hw.wiphy));
-        local->mdev->features |= NETIF_F_NETNS_LOCAL;
-
-        result = register_netdevice(local->mdev);
-        if (result < 0)
-                goto fail_dev;
 
         result = ieee80211_init_rate_ctrl_alg(local,
                                               hw->rate_control_algorithm);
@@ -984,9 +879,6 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
         ieee80211_led_exit(local);
         ieee80211_remove_interfaces(local);
  fail_rate:
-        unregister_netdevice(local->mdev);
-        local->mdev = NULL;
- fail_dev:
         rtnl_unlock();
         ieee80211_wep_free(local);
  fail_wep:
@@ -995,9 +887,6 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
         debugfs_hw_del(local);
         destroy_workqueue(local->hw.workqueue);
  fail_workqueue:
-        if (local->mdev)
-                free_netdev(local->mdev);
- fail_mdev_alloc:
         wiphy_unregister(local->hw.wiphy);
  fail_wiphy_register:
         kfree(local->int_scan_req.channels);
@@ -1022,13 +911,8 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw)
          * because the driver cannot be handing us frames any
          * more and the tasklet is killed.
          */
-
-        /* First, we remove all virtual interfaces. */
         ieee80211_remove_interfaces(local);
 
-        /* then, finally, remove the master interface */
-        unregister_netdevice(local->mdev);
-
         rtnl_unlock();
 
         ieee80211_clear_tx_pending(local);
@@ -1047,7 +931,6 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw)
         wiphy_unregister(local->hw.wiphy);
         ieee80211_wep_free(local);
         ieee80211_led_exit(local);
-        free_netdev(local->mdev);
         kfree(local->int_scan_req.channels);
 }
 EXPORT_SYMBOL(ieee80211_unregister_hw);
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index 11cf45bce38a..8a97b1423088 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -568,7 +568,7 @@ static void ieee80211_mesh_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
 
         ifmsh = &sdata->u.mesh;
 
-        rx_status = (struct ieee80211_rx_status *) skb->cb;
+        rx_status = IEEE80211_SKB_RXCB(skb);
         mgmt = (struct ieee80211_mgmt *) skb->data;
         stype = le16_to_cpu(mgmt->frame_control) & IEEE80211_FCTL_STYPE;
 
@@ -671,8 +671,7 @@ void ieee80211_mesh_init_sdata(struct ieee80211_sub_if_data *sdata)
 }
 
 ieee80211_rx_result
-ieee80211_mesh_rx_mgmt(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb,
-                       struct ieee80211_rx_status *rx_status)
+ieee80211_mesh_rx_mgmt(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb)
 {
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
@@ -686,10 +685,12 @@ ieee80211_mesh_rx_mgmt(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb,
         fc = le16_to_cpu(mgmt->frame_control);
 
         switch (fc & IEEE80211_FCTL_STYPE) {
+        case IEEE80211_STYPE_ACTION:
+                if (skb->len < IEEE80211_MIN_ACTION_SIZE)
+                        return RX_DROP_MONITOR;
+                /* fall through */
         case IEEE80211_STYPE_PROBE_RESP:
         case IEEE80211_STYPE_BEACON:
-        case IEEE80211_STYPE_ACTION:
-                memcpy(skb->cb, rx_status, sizeof(*rx_status));
                 skb_queue_tail(&ifmsh->skb_queue, skb);
                 queue_work(local->hw.workqueue, &ifmsh->work);
                 return RX_QUEUED;
diff --git a/net/mac80211/mesh.h b/net/mac80211/mesh.h
index c7d72819cdd2..2a2ed182cb7e 100644
--- a/net/mac80211/mesh.h
+++ b/net/mac80211/mesh.h
@@ -208,8 +208,7 @@ void ieee80211s_init(void);
 void ieee80211s_stop(void);
 void ieee80211_mesh_init_sdata(struct ieee80211_sub_if_data *sdata);
 ieee80211_rx_result
-ieee80211_mesh_rx_mgmt(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb,
-                       struct ieee80211_rx_status *rx_status);
+ieee80211_mesh_rx_mgmt(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb);
 void ieee80211_start_mesh(struct ieee80211_sub_if_data *sdata);
 void ieee80211_stop_mesh(struct ieee80211_sub_if_data *sdata);
 
diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
index f49ef288e2e2..e93c37ef6a48 100644
--- a/net/mac80211/mesh_hwmp.c
+++ b/net/mac80211/mesh_hwmp.c
@@ -686,11 +686,11 @@ void mesh_path_start_discovery(struct ieee80211_sub_if_data *sdata)
         u8 ttl, dst_flags;
         u32 lifetime;
 
-        spin_lock(&ifmsh->mesh_preq_queue_lock);
+        spin_lock_bh(&ifmsh->mesh_preq_queue_lock);
         if (!ifmsh->preq_queue_len ||
                 time_before(jiffies, ifmsh->last_preq +
                                 min_preq_int_jiff(sdata))) {
-                spin_unlock(&ifmsh->mesh_preq_queue_lock);
+                spin_unlock_bh(&ifmsh->mesh_preq_queue_lock);
                 return;
         }
 
@@ -698,7 +698,7 @@ void mesh_path_start_discovery(struct ieee80211_sub_if_data *sdata)
                         struct mesh_preq_queue, list);
         list_del(&preq_node->list);
         --ifmsh->preq_queue_len;
-        spin_unlock(&ifmsh->mesh_preq_queue_lock);
+        spin_unlock_bh(&ifmsh->mesh_preq_queue_lock);
 
         rcu_read_lock();
         mpath = mesh_path_lookup(preq_node->dst, sdata);
@@ -784,7 +784,6 @@ int mesh_nexthop_lookup(struct sk_buff *skb,
                 mesh_path_add(dst_addr, sdata);
                 mpath = mesh_path_lookup(dst_addr, sdata);
                 if (!mpath) {
-                        dev_kfree_skb(skb);
                         sdata->u.mesh.mshstats.dropped_frames_no_route++;
                         err = -ENOSPC;
                         goto endlookup;
@@ -804,6 +803,7 @@ int mesh_nexthop_lookup(struct sk_buff *skb,
                 memcpy(hdr->addr1, mpath->next_hop->sta.addr,
                                 ETH_ALEN);
         } else {
+                struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
                 if (!(mpath->flags & MESH_PATH_RESOLVING)) {
                         /* Start discovery only if it is not running yet */
                         mesh_queue_preq(mpath, PREQ_Q_F_START);
@@ -815,6 +815,7 @@ int mesh_nexthop_lookup(struct sk_buff *skb,
                         skb_unlink(skb_to_free, &mpath->frame_queue);
                 }
 
+                info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
                 skb_queue_tail(&mpath->frame_queue, skb);
                 if (skb_to_free)
                         mesh_path_discard_frame(skb_to_free, sdata);
diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c
index 479597e88583..04b9e4d61b8e 100644
--- a/net/mac80211/mesh_pathtbl.c
+++ b/net/mac80211/mesh_pathtbl.c
@@ -55,7 +55,25 @@ static DEFINE_RWLOCK(pathtbl_resize_lock);
  */
 void mesh_path_assign_nexthop(struct mesh_path *mpath, struct sta_info *sta)
 {
+        struct sk_buff *skb;
+        struct ieee80211_hdr *hdr;
+        struct sk_buff_head tmpq;
+        unsigned long flags;
+
         rcu_assign_pointer(mpath->next_hop, sta);
+
+        __skb_queue_head_init(&tmpq);
+
+        spin_lock_irqsave(&mpath->frame_queue.lock, flags);
+
+        while ((skb = __skb_dequeue(&mpath->frame_queue)) != NULL) {
+                hdr = (struct ieee80211_hdr *) skb->data;
+                memcpy(hdr->addr1, sta->sta.addr, ETH_ALEN);
+                __skb_queue_tail(&tmpq, skb);
+        }
+
+        skb_queue_splice(&tmpq, &mpath->frame_queue);
+        spin_unlock_irqrestore(&mpath->frame_queue.lock, flags);
 }
 
 
@@ -481,11 +499,9 @@ enddel:
  */
 void mesh_path_tx_pending(struct mesh_path *mpath)
 {
-        struct sk_buff *skb;
-
-        while ((skb = skb_dequeue(&mpath->frame_queue)) &&
-                        (mpath->flags & MESH_PATH_ACTIVE))
-                dev_queue_xmit(skb);
+        if (mpath->flags & MESH_PATH_ACTIVE)
+                ieee80211_add_pending_skbs(mpath->sdata->local,
+                                &mpath->frame_queue);
 }
 
 /**
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 07e7e41816be..0b3551da8f43 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -27,43 +27,98 @@
 #include "rate.h"
 #include "led.h"
 
-#define IEEE80211_ASSOC_SCANS_MAX_TRIES 2
 #define IEEE80211_AUTH_TIMEOUT (HZ / 5)
 #define IEEE80211_AUTH_MAX_TRIES 3
 #define IEEE80211_ASSOC_TIMEOUT (HZ / 5)
 #define IEEE80211_ASSOC_MAX_TRIES 3
-#define IEEE80211_MONITORING_INTERVAL (2 * HZ)
-#define IEEE80211_PROBE_WAIT (HZ / 5)
-#define IEEE80211_PROBE_IDLE_TIME (60 * HZ)
-#define IEEE80211_RETRY_AUTH_INTERVAL (1 * HZ)
+
+/*
+ * beacon loss detection timeout
+ * XXX: should depend on beacon interval
+ */
+#define IEEE80211_BEACON_LOSS_TIME      (2 * HZ)
+/*
+ * Time the connection can be idle before we probe
+ * it to see if we can still talk to the AP.
+ */
+#define IEEE80211_CONNECTION_IDLE_TIME  (2 * HZ)
+/*
+ * Time we wait for a probe response after sending
+ * a probe request because of beacon loss or for
+ * checking the connection still works.
+ */
+#define IEEE80211_PROBE_WAIT            (HZ / 5)
 
 #define TMR_RUNNING_TIMER       0
 #define TMR_RUNNING_CHANSW      1
 
+/*
+ * All cfg80211 functions have to be called outside a locked
+ * section so that they can acquire a lock themselves... This
+ * is much simpler than queuing up things in cfg80211, but we
+ * do need some indirection for that here.
+ */
+enum rx_mgmt_action {
+        /* no action required */
+        RX_MGMT_NONE,
+
+        /* caller must call cfg80211_send_rx_auth() */
+        RX_MGMT_CFG80211_AUTH,
+
+        /* caller must call cfg80211_send_rx_assoc() */
+        RX_MGMT_CFG80211_ASSOC,
+
+        /* caller must call cfg80211_send_deauth() */
+        RX_MGMT_CFG80211_DEAUTH,
+
+        /* caller must call cfg80211_send_disassoc() */
+        RX_MGMT_CFG80211_DISASSOC,
+
+        /* caller must call cfg80211_auth_timeout() & free work */
+        RX_MGMT_CFG80211_AUTH_TO,
+
+        /* caller must call cfg80211_assoc_timeout() & free work */
+        RX_MGMT_CFG80211_ASSOC_TO,
+};
+
 /* utils */
-static int ecw2cw(int ecw)
+static inline void ASSERT_MGD_MTX(struct ieee80211_if_managed *ifmgd)
 {
-        return (1 << ecw) - 1;
+        WARN_ON(!mutex_is_locked(&ifmgd->mtx));
 }
 
-static u8 *ieee80211_bss_get_ie(struct ieee80211_bss *bss, u8 ie)
+/*
+ * We can have multiple work items (and connection probing)
+ * scheduling this timer, but we need to take care to only
+ * reschedule it when it should fire _earlier_ than it was
+ * asked for before, or if it's not pending right now. This
+ * function ensures that. Note that it then is required to
+ * run this function for all timeouts after the first one
+ * has happened -- the work that runs from this timer will
+ * do that.
+ */
+static void run_again(struct ieee80211_if_managed *ifmgd,
+                             unsigned long timeout)
 {
-        u8 *end, *pos;
+        ASSERT_MGD_MTX(ifmgd);
 
-        pos = bss->cbss.information_elements;
-        if (pos == NULL)
-                return NULL;
-        end = pos + bss->cbss.len_information_elements;
+        if (!timer_pending(&ifmgd->timer) ||
+            time_before(timeout, ifmgd->timer.expires))
+                mod_timer(&ifmgd->timer, timeout);
+}
 
-        while (pos + 1 < end) {
-                if (pos + 2 + pos[1] > end)
-                        break;
-                if (pos[0] == ie)
-                        return pos;
-                pos += 2 + pos[1];
-        }
+static void mod_beacon_timer(struct ieee80211_sub_if_data *sdata)
+{
+        if (sdata->local->hw.flags & IEEE80211_HW_BEACON_FILTER)
+                return;
+
+        mod_timer(&sdata->u.mgd.bcn_mon_timer,
+                  round_jiffies_up(jiffies + IEEE80211_BEACON_LOSS_TIME));
+}
 
-        return NULL;
+static int ecw2cw(int ecw)
+{
+        return (1 << ecw) - 1;
 }
 
 static int ieee80211_compatible_rates(struct ieee80211_bss *bss,
@@ -94,11 +149,10 @@ static int ieee80211_compatible_rates(struct ieee80211_bss *bss,
  */
 static u32 ieee80211_enable_ht(struct ieee80211_sub_if_data *sdata,
                                struct ieee80211_ht_info *hti,
-                               u16 ap_ht_cap_flags)
+                               const u8 *bssid, u16 ap_ht_cap_flags)
 {
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_supported_band *sband;
-        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct sta_info *sta;
         u32 changed = 0;
         u16 ht_opmode;
@@ -147,12 +201,10 @@ static u32 ieee80211_enable_ht(struct ieee80211_sub_if_data *sdata,
                 ieee80211_hw_config(local, 0);
 
                 rcu_read_lock();
-
-                sta = sta_info_get(local, ifmgd->bssid);
+                sta = sta_info_get(local, bssid);
                 if (sta)
                         rate_control_rate_update(local, sband, sta,
                                                  IEEE80211_RC_HT_CHANGED);
-
                 rcu_read_unlock();
         }
 
@@ -175,23 +227,24 @@ static u32 ieee80211_enable_ht(struct ieee80211_sub_if_data *sdata,
 
 /* frame sending functions */
 
-static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
+static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata,
+                                 struct ieee80211_mgd_work *wk)
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_local *local = sdata->local;
         struct sk_buff *skb;
         struct ieee80211_mgmt *mgmt;
-        u8 *pos, *ies, *ht_ie;
+        u8 *pos;
+        const u8 *ies, *ht_ie;
         int i, len, count, rates_len, supp_rates_len;
         u16 capab;
-        struct ieee80211_bss *bss;
         int wmm = 0;
         struct ieee80211_supported_band *sband;
         u32 rates = 0;
 
         skb = dev_alloc_skb(local->hw.extra_tx_headroom +
-                            sizeof(*mgmt) + 200 + ifmgd->extra_ie_len +
-                            ifmgd->ssid_len);
+                            sizeof(*mgmt) + 200 + wk->ie_len +
+                            wk->ssid_len);
         if (!skb) {
                 printk(KERN_DEBUG "%s: failed to allocate buffer for assoc "
                        "frame\n", sdata->dev->name);
@@ -210,45 +263,35 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
                         capab |= WLAN_CAPABILITY_SHORT_PREAMBLE;
         }
 
-        bss = ieee80211_rx_bss_get(local, ifmgd->bssid,
-                                   local->hw.conf.channel->center_freq,
-                                   ifmgd->ssid, ifmgd->ssid_len);
-        if (bss) {
-                if (bss->cbss.capability & WLAN_CAPABILITY_PRIVACY)
-                        capab |= WLAN_CAPABILITY_PRIVACY;
-                if (bss->wmm_used)
-                        wmm = 1;
+        if (wk->bss->cbss.capability & WLAN_CAPABILITY_PRIVACY)
+                capab |= WLAN_CAPABILITY_PRIVACY;
+        if (wk->bss->wmm_used)
+                wmm = 1;
 
-                /* get all rates supported by the device and the AP as
-                 * some APs don't like getting a superset of their rates
-                 * in the association request (e.g. D-Link DAP 1353 in
-                 * b-only mode) */
-                rates_len = ieee80211_compatible_rates(bss, sband, &rates);
+        /* get all rates supported by the device and the AP as
+         * some APs don't like getting a superset of their rates
+         * in the association request (e.g. D-Link DAP 1353 in
+         * b-only mode) */
+        rates_len = ieee80211_compatible_rates(wk->bss, sband, &rates);
 
-                if ((bss->cbss.capability & WLAN_CAPABILITY_SPECTRUM_MGMT) &&
-                    (local->hw.flags & IEEE80211_HW_SPECTRUM_MGMT))
-                        capab |= WLAN_CAPABILITY_SPECTRUM_MGMT;
-
-                ieee80211_rx_bss_put(local, bss);
-        } else {
-                rates = ~0;
-                rates_len = sband->n_bitrates;
-        }
+        if ((wk->bss->cbss.capability & WLAN_CAPABILITY_SPECTRUM_MGMT) &&
+            (local->hw.flags & IEEE80211_HW_SPECTRUM_MGMT))
+                capab |= WLAN_CAPABILITY_SPECTRUM_MGMT;
 
         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
         memset(mgmt, 0, 24);
-        memcpy(mgmt->da, ifmgd->bssid, ETH_ALEN);
+        memcpy(mgmt->da, wk->bss->cbss.bssid, ETH_ALEN);
         memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
-        memcpy(mgmt->bssid, ifmgd->bssid, ETH_ALEN);
+        memcpy(mgmt->bssid, wk->bss->cbss.bssid, ETH_ALEN);
 
-        if (ifmgd->flags & IEEE80211_STA_PREV_BSSID_SET) {
+        if (!is_zero_ether_addr(wk->prev_bssid)) {
                 skb_put(skb, 10);
                 mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
                                                   IEEE80211_STYPE_REASSOC_REQ);
                 mgmt->u.reassoc_req.capab_info = cpu_to_le16(capab);
                 mgmt->u.reassoc_req.listen_interval =
                                 cpu_to_le16(local->hw.conf.listen_interval);
-                memcpy(mgmt->u.reassoc_req.current_ap, ifmgd->prev_bssid,
+                memcpy(mgmt->u.reassoc_req.current_ap, wk->prev_bssid,
                        ETH_ALEN);
         } else {
                 skb_put(skb, 4);
@@ -260,10 +303,10 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
         }
 
         /* SSID */
-        ies = pos = skb_put(skb, 2 + ifmgd->ssid_len);
+        ies = pos = skb_put(skb, 2 + wk->ssid_len);
         *pos++ = WLAN_EID_SSID;
-        *pos++ = ifmgd->ssid_len;
-        memcpy(pos, ifmgd->ssid, ifmgd->ssid_len);
+        *pos++ = wk->ssid_len;
+        memcpy(pos, wk->ssid, wk->ssid_len);
 
         /* add all rates which were marked to be used above */
         supp_rates_len = rates_len;
@@ -318,9 +361,9 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
                 }
         }
 
-        if (ifmgd->extra_ie) {
-                pos = skb_put(skb, ifmgd->extra_ie_len);
-                memcpy(pos, ifmgd->extra_ie, ifmgd->extra_ie_len);
+        if (wk->ie_len && wk->ie) {
+                pos = skb_put(skb, wk->ie_len);
+                memcpy(pos, wk->ie, wk->ie_len);
         }
 
         if (wmm && (ifmgd->flags & IEEE80211_STA_WMM_ENABLED)) {
@@ -345,9 +388,9 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
          */
         if (wmm && (ifmgd->flags & IEEE80211_STA_WMM_ENABLED) &&
             sband->ht_cap.ht_supported &&
-            (ht_ie = ieee80211_bss_get_ie(bss, WLAN_EID_HT_INFORMATION)) &&
+            (ht_ie = ieee80211_bss_get_ie(&wk->bss->cbss, WLAN_EID_HT_INFORMATION)) &&
             ht_ie[1] >= sizeof(struct ieee80211_ht_info) &&
-            (!(ifmgd->flags & IEEE80211_STA_TKIP_WEP_USED))) {
+            (!(ifmgd->flags & IEEE80211_STA_DISABLE_11N))) {
                 struct ieee80211_ht_info *ht_info =
                         (struct ieee80211_ht_info *)(ht_ie + 2);
                 u16 cap = sband->ht_cap.cap;
@@ -382,18 +425,13 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
                 memcpy(pos, &sband->ht_cap.mcs, sizeof(sband->ht_cap.mcs));
         }
 
-        kfree(ifmgd->assocreq_ies);
-        ifmgd->assocreq_ies_len = (skb->data + skb->len) - ies;
-        ifmgd->assocreq_ies = kmalloc(ifmgd->assocreq_ies_len, GFP_KERNEL);
-        if (ifmgd->assocreq_ies)
-                memcpy(ifmgd->assocreq_ies, ies, ifmgd->assocreq_ies_len);
-
         ieee80211_tx_skb(sdata, skb, 0);
 }
 
 
 static void ieee80211_send_deauth_disassoc(struct ieee80211_sub_if_data *sdata,
-                                           u16 stype, u16 reason)
+                                           const u8 *bssid, u16 stype, u16 reason,
+                                           void *cookie)
 {
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
@@ -410,18 +448,18 @@ static void ieee80211_send_deauth_disassoc(struct ieee80211_sub_if_data *sdata,
 
         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
         memset(mgmt, 0, 24);
-        memcpy(mgmt->da, ifmgd->bssid, ETH_ALEN);
+        memcpy(mgmt->da, bssid, ETH_ALEN);
         memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
-        memcpy(mgmt->bssid, ifmgd->bssid, ETH_ALEN);
+        memcpy(mgmt->bssid, bssid, ETH_ALEN);
         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT | stype);
         skb_put(skb, 2);
         /* u.deauth.reason_code == u.disassoc.reason_code */
         mgmt->u.deauth.reason_code = cpu_to_le16(reason);
 
         if (stype == IEEE80211_STYPE_DEAUTH)
-                cfg80211_send_deauth(sdata->dev, (u8 *) mgmt, skb->len);
+                cfg80211_send_deauth(sdata->dev, (u8 *)mgmt, skb->len, cookie);
         else
-                cfg80211_send_disassoc(sdata->dev, (u8 *) mgmt, skb->len);
+                cfg80211_send_disassoc(sdata->dev, (u8 *)mgmt, skb->len, cookie);
         ieee80211_tx_skb(sdata, skb, ifmgd->flags & IEEE80211_STA_MFP_ENABLED);
 }
 
@@ -494,28 +532,26 @@ static void ieee80211_chswitch_work(struct work_struct *work)
 {
         struct ieee80211_sub_if_data *sdata =
                 container_of(work, struct ieee80211_sub_if_data, u.mgd.chswitch_work);
-        struct ieee80211_bss *bss;
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 
         if (!netif_running(sdata->dev))
                 return;
 
-        bss = ieee80211_rx_bss_get(sdata->local, ifmgd->bssid,
-                                   sdata->local->hw.conf.channel->center_freq,
-                                   ifmgd->ssid, ifmgd->ssid_len);
-        if (!bss)
-                goto exit;
+        mutex_lock(&ifmgd->mtx);
+        if (!ifmgd->associated)
+                goto out;
 
         sdata->local->oper_channel = sdata->local->csa_channel;
+        ieee80211_hw_config(sdata->local, IEEE80211_CONF_CHANGE_CHANNEL);
+
         /* XXX: shouldn't really modify cfg80211-owned data! */
-        if (!ieee80211_hw_config(sdata->local, IEEE80211_CONF_CHANGE_CHANNEL))
-                bss->cbss.channel = sdata->local->oper_channel;
+        ifmgd->associated->cbss.channel = sdata->local->oper_channel;
 
-        ieee80211_rx_bss_put(sdata->local, bss);
-exit:
-        ifmgd->flags &= ~IEEE80211_STA_CSA_RECEIVED;
         ieee80211_wake_queues_by_reason(&sdata->local->hw,
                                         IEEE80211_QUEUE_STOP_REASON_CSA);
+ out:
+        ifmgd->flags &= ~IEEE80211_STA_CSA_RECEIVED;
+        mutex_unlock(&ifmgd->mtx);
 }
 
 static void ieee80211_chswitch_timer(unsigned long data)
@@ -540,7 +576,9 @@ void ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         int new_freq = ieee80211_channel_to_frequency(sw_elem->new_ch_num);
 
-        if (ifmgd->state != IEEE80211_STA_MLME_ASSOCIATED)
+        ASSERT_MGD_MTX(ifmgd);
+
+        if (!ifmgd->associated)
                 return;
 
         if (sdata->local->sw_scanning || sdata->local->hw_scanning)
@@ -651,8 +689,9 @@ void ieee80211_recalc_ps(struct ieee80211_local *local, s32 latency)
         }
 
         if (count == 1 && found->u.mgd.powersave &&
-            (found->u.mgd.flags & IEEE80211_STA_ASSOCIATED) &&
-            !(found->u.mgd.flags & IEEE80211_STA_PROBEREQ_POLL)) {
+            found->u.mgd.associated && list_empty(&found->u.mgd.work_list) &&
+            !(found->u.mgd.flags & (IEEE80211_STA_BEACON_POLL |
+                                    IEEE80211_STA_CONNECTION_POLL))) {
                 s32 beaconint_us;
 
                 if (latency < 0)
@@ -806,9 +845,6 @@ static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,
                                            u16 capab, bool erp_valid, u8 erp)
 {
         struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
-#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
-        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
-#endif
         u32 changed = 0;
         bool use_protection;
         bool use_short_preamble;
@@ -825,42 +861,16 @@ static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,
         use_short_slot = !!(capab & WLAN_CAPABILITY_SHORT_SLOT_TIME);
 
         if (use_protection != bss_conf->use_cts_prot) {
-#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
-                if (net_ratelimit()) {
-                        printk(KERN_DEBUG "%s: CTS protection %s (BSSID=%pM)\n",
-                               sdata->dev->name,
-                               use_protection ? "enabled" : "disabled",
-                               ifmgd->bssid);
-                }
-#endif
                 bss_conf->use_cts_prot = use_protection;
                 changed |= BSS_CHANGED_ERP_CTS_PROT;
         }
 
         if (use_short_preamble != bss_conf->use_short_preamble) {
-#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
-                if (net_ratelimit()) {
-                        printk(KERN_DEBUG "%s: switched to %s barker preamble"
-                               " (BSSID=%pM)\n",
-                               sdata->dev->name,
-                               use_short_preamble ? "short" : "long",
-                               ifmgd->bssid);
-                }
-#endif
                 bss_conf->use_short_preamble = use_short_preamble;
                 changed |= BSS_CHANGED_ERP_PREAMBLE;
         }
 
         if (use_short_slot != bss_conf->use_short_slot) {
-#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
-                if (net_ratelimit()) {
-                        printk(KERN_DEBUG "%s: switched to %s slot time"
-                               " (BSSID=%pM)\n",
-                               sdata->dev->name,
-                               use_short_slot ? "short" : "long",
-                               ifmgd->bssid);
-                }
-#endif
                 bss_conf->use_short_slot = use_short_slot;
                 changed |= BSS_CHANGED_ERP_SLOT;
         }
@@ -868,105 +878,29 @@ static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,
         return changed;
 }
 
-static void ieee80211_sta_send_apinfo(struct ieee80211_sub_if_data *sdata)
-{
-        union iwreq_data wrqu;
-
-        memset(&wrqu, 0, sizeof(wrqu));
-        if (sdata->u.mgd.flags & IEEE80211_STA_ASSOCIATED)
-                memcpy(wrqu.ap_addr.sa_data, sdata->u.mgd.bssid, ETH_ALEN);
-        wrqu.ap_addr.sa_family = ARPHRD_ETHER;
-        wireless_send_event(sdata->dev, SIOCGIWAP, &wrqu, NULL);
-}
-
-static void ieee80211_sta_send_associnfo(struct ieee80211_sub_if_data *sdata)
-{
-        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
-        char *buf;
-        size_t len;
-        int i;
-        union iwreq_data wrqu;
-
-        if (!ifmgd->assocreq_ies && !ifmgd->assocresp_ies)
-                return;
-
-        buf = kmalloc(50 + 2 * (ifmgd->assocreq_ies_len +
-                                ifmgd->assocresp_ies_len), GFP_KERNEL);
-        if (!buf)
-                return;
-
-        len = sprintf(buf, "ASSOCINFO(");
-        if (ifmgd->assocreq_ies) {
-                len += sprintf(buf + len, "ReqIEs=");
-                for (i = 0; i < ifmgd->assocreq_ies_len; i++) {
-                        len += sprintf(buf + len, "%02x",
-                                       ifmgd->assocreq_ies[i]);
-                }
-        }
-        if (ifmgd->assocresp_ies) {
-                if (ifmgd->assocreq_ies)
-                        len += sprintf(buf + len, " ");
-                len += sprintf(buf + len, "RespIEs=");
-                for (i = 0; i < ifmgd->assocresp_ies_len; i++) {
-                        len += sprintf(buf + len, "%02x",
-                                       ifmgd->assocresp_ies[i]);
-                }
-        }
-        len += sprintf(buf + len, ")");
-
-        if (len > IW_CUSTOM_MAX) {
-                len = sprintf(buf, "ASSOCRESPIE=");
-                for (i = 0; i < ifmgd->assocresp_ies_len; i++) {
-                        len += sprintf(buf + len, "%02x",
-                                       ifmgd->assocresp_ies[i]);
-                }
-        }
-
-        if (len <= IW_CUSTOM_MAX) {
-                memset(&wrqu, 0, sizeof(wrqu));
-                wrqu.data.length = len;
-                wireless_send_event(sdata->dev, IWEVCUSTOM, &wrqu, buf);
-        }
-
-        kfree(buf);
-}
-
-
 static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
+                                     struct ieee80211_bss *bss,
                                      u32 bss_info_changed)
 {
-        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_local *local = sdata->local;
-        struct ieee80211_conf *conf = &local_to_hw(local)->conf;
-
-        struct ieee80211_bss *bss;
 
         bss_info_changed |= BSS_CHANGED_ASSOC;
-        ifmgd->flags |= IEEE80211_STA_ASSOCIATED;
-
-        bss = ieee80211_rx_bss_get(local, ifmgd->bssid,
-                                   conf->channel->center_freq,
-                                   ifmgd->ssid, ifmgd->ssid_len);
-        if (bss) {
-                /* set timing information */
-                sdata->vif.bss_conf.beacon_int = bss->cbss.beacon_interval;
-                sdata->vif.bss_conf.timestamp = bss->cbss.tsf;
-                sdata->vif.bss_conf.dtim_period = bss->dtim_period;
+        /* set timing information */
+        sdata->vif.bss_conf.beacon_int = bss->cbss.beacon_interval;
+        sdata->vif.bss_conf.timestamp = bss->cbss.tsf;
+        sdata->vif.bss_conf.dtim_period = bss->dtim_period;
 
-                bss_info_changed |= BSS_CHANGED_BEACON_INT;
-                bss_info_changed |= ieee80211_handle_bss_capability(sdata,
-                        bss->cbss.capability, bss->has_erp_value, bss->erp_value);
+        bss_info_changed |= BSS_CHANGED_BEACON_INT;
+        bss_info_changed |= ieee80211_handle_bss_capability(sdata,
+                bss->cbss.capability, bss->has_erp_value, bss->erp_value);
 
-                cfg80211_hold_bss(&bss->cbss);
+        sdata->u.mgd.associated = bss;
+        memcpy(sdata->u.mgd.bssid, bss->cbss.bssid, ETH_ALEN);
 
-                ieee80211_rx_bss_put(local, bss);
-        }
+        /* just to be sure */
+        sdata->u.mgd.flags &= ~(IEEE80211_STA_CONNECTION_POLL |
+                                IEEE80211_STA_BEACON_POLL);
 
-        ifmgd->flags |= IEEE80211_STA_PREV_BSSID_SET;
-        memcpy(ifmgd->prev_bssid, sdata->u.mgd.bssid, ETH_ALEN);
-        ieee80211_sta_send_associnfo(sdata);
-
-        ifmgd->last_probe = jiffies;
         ieee80211_led_assoc(local, 1);
 
         sdata->vif.bss_conf.assoc = 1;
@@ -991,167 +925,140 @@ static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
 
         netif_tx_start_all_queues(sdata->dev);
         netif_carrier_on(sdata->dev);
-
-        ieee80211_sta_send_apinfo(sdata);
 }
 
-static void ieee80211_direct_probe(struct ieee80211_sub_if_data *sdata)
+static enum rx_mgmt_action __must_check
+ieee80211_direct_probe(struct ieee80211_sub_if_data *sdata,
+                       struct ieee80211_mgd_work *wk)
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_local *local = sdata->local;
 
-        ifmgd->direct_probe_tries++;
-        if (ifmgd->direct_probe_tries > IEEE80211_AUTH_MAX_TRIES) {
+        wk->tries++;
+        if (wk->tries > IEEE80211_AUTH_MAX_TRIES) {
                 printk(KERN_DEBUG "%s: direct probe to AP %pM timed out\n",
-                       sdata->dev->name, ifmgd->bssid);
-                ifmgd->state = IEEE80211_STA_MLME_DISABLED;
-                ieee80211_recalc_idle(local);
-                cfg80211_send_auth_timeout(sdata->dev, ifmgd->bssid);
+                       sdata->dev->name, wk->bss->cbss.bssid);
 
                 /*
                  * Most likely AP is not in the range so remove the
-                 * bss information associated to the AP
+                 * bss struct for that AP.
                  */
-                ieee80211_rx_bss_remove(sdata, ifmgd->bssid,
-                                sdata->local->hw.conf.channel->center_freq,
-                                ifmgd->ssid, ifmgd->ssid_len);
+                cfg80211_unlink_bss(local->hw.wiphy, &wk->bss->cbss);
 
                 /*
                  * We might have a pending scan which had no chance to run yet
-                 * due to state == IEEE80211_STA_MLME_DIRECT_PROBE.
-                 * Hence, queue the STAs work again
+                 * due to work needing to be done. Hence, queue the STAs work
+                 * again for that.
                  */
                 queue_work(local->hw.workqueue, &ifmgd->work);
-                return;
+                return RX_MGMT_CFG80211_AUTH_TO;
         }
 
-        printk(KERN_DEBUG "%s: direct probe to AP %pM try %d\n",
-                        sdata->dev->name, ifmgd->bssid,
-                        ifmgd->direct_probe_tries);
+        printk(KERN_DEBUG "%s: direct probe to AP %pM (try %d)\n",
+                        sdata->dev->name, wk->bss->cbss.bssid,
+                        wk->tries);
 
-        ifmgd->state = IEEE80211_STA_MLME_DIRECT_PROBE;
-
-        /* Direct probe is sent to broadcast address as some APs
+        /*
+         * Direct probe is sent to broadcast address as some APs
          * will not answer to direct packet in unassociated state.
          */
-        ieee80211_send_probe_req(sdata, NULL,
-                                 ifmgd->ssid, ifmgd->ssid_len, NULL, 0);
+        ieee80211_send_probe_req(sdata, NULL, wk->ssid, wk->ssid_len, NULL, 0);
 
-        mod_timer(&ifmgd->timer, jiffies + IEEE80211_AUTH_TIMEOUT);
+        wk->timeout = jiffies + IEEE80211_AUTH_TIMEOUT;
+        run_again(ifmgd, wk->timeout);
+
+        return RX_MGMT_NONE;
 }
 
 
-static void ieee80211_authenticate(struct ieee80211_sub_if_data *sdata)
+static enum rx_mgmt_action __must_check
+ieee80211_authenticate(struct ieee80211_sub_if_data *sdata,
+                       struct ieee80211_mgd_work *wk)
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_local *local = sdata->local;
-        u8 *ies;
-        size_t ies_len;
 
-        ifmgd->auth_tries++;
-        if (ifmgd->auth_tries > IEEE80211_AUTH_MAX_TRIES) {
+        wk->tries++;
+        if (wk->tries > IEEE80211_AUTH_MAX_TRIES) {
                 printk(KERN_DEBUG "%s: authentication with AP %pM"
                        " timed out\n",
-                       sdata->dev->name, ifmgd->bssid);
-                ifmgd->state = IEEE80211_STA_MLME_DISABLED;
-                ieee80211_recalc_idle(local);
-                cfg80211_send_auth_timeout(sdata->dev, ifmgd->bssid);
-                ieee80211_rx_bss_remove(sdata, ifmgd->bssid,
-                                sdata->local->hw.conf.channel->center_freq,
-                                ifmgd->ssid, ifmgd->ssid_len);
+                       sdata->dev->name, wk->bss->cbss.bssid);
+
+                /*
+                 * Most likely AP is not in the range so remove the
+                 * bss struct for that AP.
+                 */
+                cfg80211_unlink_bss(local->hw.wiphy, &wk->bss->cbss);
 
                 /*
                  * We might have a pending scan which had no chance to run yet
-                 * due to state == IEEE80211_STA_MLME_AUTHENTICATE.
-                 * Hence, queue the STAs work again
+                 * due to work needing to be done. Hence, queue the STAs work
+                 * again for that.
                  */
                 queue_work(local->hw.workqueue, &ifmgd->work);
-                return;
+                return RX_MGMT_CFG80211_AUTH_TO;
         }
 
-        ifmgd->state = IEEE80211_STA_MLME_AUTHENTICATE;
-        printk(KERN_DEBUG "%s: authenticate with AP %pM\n",
-               sdata->dev->name, ifmgd->bssid);
+        printk(KERN_DEBUG "%s: authenticate with AP %pM (try %d)\n",
+               sdata->dev->name, wk->bss->cbss.bssid, wk->tries);
 
-        if (ifmgd->flags & IEEE80211_STA_EXT_SME) {
-                ies = ifmgd->sme_auth_ie;
-                ies_len = ifmgd->sme_auth_ie_len;
-        } else {
-                ies = NULL;
-                ies_len = 0;
-        }
-        ieee80211_send_auth(sdata, 1, ifmgd->auth_alg, ies, ies_len,
-                            ifmgd->bssid, 0);
-        ifmgd->auth_transaction = 2;
+        ieee80211_send_auth(sdata, 1, wk->auth_alg, wk->ie, wk->ie_len,
+                            wk->bss->cbss.bssid, NULL, 0, 0);
+        wk->auth_transaction = 2;
+
+        wk->timeout = jiffies + IEEE80211_AUTH_TIMEOUT;
+        run_again(ifmgd, wk->timeout);
 
-        mod_timer(&ifmgd->timer, jiffies + IEEE80211_AUTH_TIMEOUT);
+        return RX_MGMT_NONE;
 }
 
-/*
- * The disassoc 'reason' argument can be either our own reason
- * if self disconnected or a reason code from the AP.
- */
-static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
-                                   bool deauth, bool self_disconnected,
-                                   u16 reason)
+static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_local *local = sdata->local;
-        struct ieee80211_conf *conf = &local_to_hw(local)->conf;
-        struct ieee80211_bss *bss;
         struct sta_info *sta;
         u32 changed = 0, config_changed = 0;
+        u8 bssid[ETH_ALEN];
 
-        if (deauth) {
-                ifmgd->direct_probe_tries = 0;
-                ifmgd->auth_tries = 0;
-        }
-        ifmgd->assoc_scan_tries = 0;
-        ifmgd->assoc_tries = 0;
+        ASSERT_MGD_MTX(ifmgd);
+
+        if (WARN_ON(!ifmgd->associated))
+                return;
+
+        memcpy(bssid, ifmgd->associated->cbss.bssid, ETH_ALEN);
+
+        ifmgd->associated = NULL;
+        memset(ifmgd->bssid, 0, ETH_ALEN);
+
+        /*
+         * we need to commit the associated = NULL change because the
+         * scan code uses that to determine whether this iface should
+         * go to/wake up from powersave or not -- and could otherwise
+         * wake the queues erroneously.
+         */
+        smp_mb();
+
+        /*
+         * Thus, we can only afterwards stop the queues -- to account
+         * for the case where another CPU is finishing a scan at this
+         * time -- we don't want the scan code to enable queues.
+         */
 
         netif_tx_stop_all_queues(sdata->dev);
         netif_carrier_off(sdata->dev);
 
         rcu_read_lock();
-        sta = sta_info_get(local, ifmgd->bssid);
+        sta = sta_info_get(local, bssid);
         if (sta)
                 ieee80211_sta_tear_down_BA_sessions(sta);
         rcu_read_unlock();
 
-        bss = ieee80211_rx_bss_get(local, ifmgd->bssid,
-                                   conf->channel->center_freq,
-                                   ifmgd->ssid, ifmgd->ssid_len);
-
-        if (bss) {
-                cfg80211_unhold_bss(&bss->cbss);
-                ieee80211_rx_bss_put(local, bss);
-        }
-
-        if (self_disconnected) {
-                if (deauth)
-                        ieee80211_send_deauth_disassoc(sdata,
-                                IEEE80211_STYPE_DEAUTH, reason);
-                else
-                        ieee80211_send_deauth_disassoc(sdata,
-                                IEEE80211_STYPE_DISASSOC, reason);
-        }
-
-        ifmgd->flags &= ~IEEE80211_STA_ASSOCIATED;
         changed |= ieee80211_reset_erp_info(sdata);
 
         ieee80211_led_assoc(local, 0);
         changed |= BSS_CHANGED_ASSOC;
         sdata->vif.bss_conf.assoc = false;
 
-        ieee80211_sta_send_apinfo(sdata);
-
-        if (self_disconnected || reason == WLAN_REASON_DISASSOC_STA_HAS_LEFT) {
-                ifmgd->state = IEEE80211_STA_MLME_DISABLED;
-                ieee80211_rx_bss_remove(sdata, ifmgd->bssid,
-                                sdata->local->hw.conf.channel->center_freq,
-                                ifmgd->ssid, ifmgd->ssid_len);
-        }
-
         ieee80211_set_wmm_default(sdata);
 
         ieee80211_recalc_idle(local);
@@ -1180,7 +1087,7 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
 
         rcu_read_lock();
 
-        sta = sta_info_get(local, ifmgd->bssid);
+        sta = sta_info_get(local, bssid);
         if (!sta) {
                 rcu_read_unlock();
                 return;
@@ -1193,83 +1100,42 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
         sta_info_destroy(sta);
 }
 
-static int ieee80211_sta_wep_configured(struct ieee80211_sub_if_data *sdata)
-{
-        if (!sdata || !sdata->default_key ||
-            sdata->default_key->conf.alg != ALG_WEP)
-                return 0;
-        return 1;
-}
-
-static int ieee80211_privacy_mismatch(struct ieee80211_sub_if_data *sdata)
-{
-        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
-        struct ieee80211_local *local = sdata->local;
-        struct ieee80211_bss *bss;
-        int bss_privacy;
-        int wep_privacy;
-        int privacy_invoked;
-
-        if (!ifmgd || (ifmgd->flags & IEEE80211_STA_EXT_SME))
-                return 0;
-
-        bss = ieee80211_rx_bss_get(local, ifmgd->bssid,
-                                   local->hw.conf.channel->center_freq,
-                                   ifmgd->ssid, ifmgd->ssid_len);
-        if (!bss)
-                return 0;
-
-        bss_privacy = !!(bss->cbss.capability & WLAN_CAPABILITY_PRIVACY);
-        wep_privacy = !!ieee80211_sta_wep_configured(sdata);
-        privacy_invoked = !!(ifmgd->flags & IEEE80211_STA_PRIVACY_INVOKED);
-
-        ieee80211_rx_bss_put(local, bss);
-
-        if ((bss_privacy == wep_privacy) || (bss_privacy == privacy_invoked))
-                return 0;
-
-        return 1;
-}
-
-static void ieee80211_associate(struct ieee80211_sub_if_data *sdata)
+static enum rx_mgmt_action __must_check
+ieee80211_associate(struct ieee80211_sub_if_data *sdata,
+                    struct ieee80211_mgd_work *wk)
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_local *local = sdata->local;
 
-        ifmgd->assoc_tries++;
-        if (ifmgd->assoc_tries > IEEE80211_ASSOC_MAX_TRIES) {
+        wk->tries++;
+        if (wk->tries > IEEE80211_ASSOC_MAX_TRIES) {
                 printk(KERN_DEBUG "%s: association with AP %pM"
                        " timed out\n",
-                       sdata->dev->name, ifmgd->bssid);
-                ifmgd->state = IEEE80211_STA_MLME_DISABLED;
-                ieee80211_recalc_idle(local);
-                cfg80211_send_assoc_timeout(sdata->dev, ifmgd->bssid);
-                ieee80211_rx_bss_remove(sdata, ifmgd->bssid,
-                                sdata->local->hw.conf.channel->center_freq,
-                                ifmgd->ssid, ifmgd->ssid_len);
+                       sdata->dev->name, wk->bss->cbss.bssid);
+
+                /*
+                 * Most likely AP is not in the range so remove the
+                 * bss struct for that AP.
+                 */
+                cfg80211_unlink_bss(local->hw.wiphy, &wk->bss->cbss);
+
                 /*
                  * We might have a pending scan which had no chance to run yet
-                 * due to state == IEEE80211_STA_MLME_ASSOCIATE.
-                 * Hence, queue the STAs work again
+                 * due to work needing to be done. Hence, queue the STAs work
+                 * again for that.
                  */
                 queue_work(local->hw.workqueue, &ifmgd->work);
-                return;
+                return RX_MGMT_CFG80211_ASSOC_TO;
         }
 
-        ifmgd->state = IEEE80211_STA_MLME_ASSOCIATE;
-        printk(KERN_DEBUG "%s: associate with AP %pM\n",
-               sdata->dev->name, ifmgd->bssid);
-        if (ieee80211_privacy_mismatch(sdata)) {
-                printk(KERN_DEBUG "%s: mismatch in privacy configuration and "
-                       "mixed-cell disabled - abort association\n", sdata->dev->name);
-                ifmgd->state = IEEE80211_STA_MLME_DISABLED;
-                ieee80211_recalc_idle(local);
-                return;
-        }
+        printk(KERN_DEBUG "%s: associate with AP %pM (try %d)\n",
+               sdata->dev->name, wk->bss->cbss.bssid, wk->tries);
+        ieee80211_send_assoc(sdata, wk);
 
-        ieee80211_send_assoc(sdata);
+        wk->timeout = jiffies + IEEE80211_ASSOC_TIMEOUT;
+        run_again(ifmgd, wk->timeout);
 
-        mod_timer(&ifmgd->timer, jiffies + IEEE80211_ASSOC_TIMEOUT);
+        return RX_MGMT_NONE;
 }
 
 void ieee80211_sta_rx_notify(struct ieee80211_sub_if_data *sdata,
@@ -1280,50 +1146,83 @@ void ieee80211_sta_rx_notify(struct ieee80211_sub_if_data *sdata,
          * from AP because we know that the connection is working both ways
          * at that time. But multicast frames (and hence also beacons) must
          * be ignored here, because we need to trigger the timer during
-         * data idle periods for sending the periodical probe request to
-         * the AP.
+         * data idle periods for sending the periodic probe request to the
+         * AP we're connected to.
          */
-        if (!is_multicast_ether_addr(hdr->addr1))
-                mod_timer(&sdata->u.mgd.timer,
-                          jiffies + IEEE80211_MONITORING_INTERVAL);
+        if (is_multicast_ether_addr(hdr->addr1))
+                return;
+
+        mod_timer(&sdata->u.mgd.conn_mon_timer,
+                  round_jiffies_up(jiffies + IEEE80211_CONNECTION_IDLE_TIME));
 }
 
-void ieee80211_beacon_loss_work(struct work_struct *work)
+static void ieee80211_mgd_probe_ap(struct ieee80211_sub_if_data *sdata,
+                                   bool beacon)
 {
-        struct ieee80211_sub_if_data *sdata =
-                container_of(work, struct ieee80211_sub_if_data,
-                             u.mgd.beacon_loss_work);
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+        const u8 *ssid;
+        bool already = false;
 
-        /*
-         * The driver has already reported this event and we have
-         * already sent a probe request. Maybe the AP died and the
-         * driver keeps reporting until we disassociate... We have
-         * to ignore that because otherwise we would continually
-         * reset the timer and never check whether we received a
-         * probe response!
-         */
-        if (ifmgd->flags & IEEE80211_STA_PROBEREQ_POLL)
+        if (!netif_running(sdata->dev))
                 return;
 
+        mutex_lock(&ifmgd->mtx);
+
+        if (!ifmgd->associated)
+                goto out;
+
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
-        if (net_ratelimit()) {
-                printk(KERN_DEBUG "%s: driver reports beacon loss from AP %pM "
-                       "- sending probe request\n", sdata->dev->name,
-                       sdata->u.mgd.bssid);
-        }
+        if (beacon && net_ratelimit())
+                printk(KERN_DEBUG "%s: detected beacon loss from AP "
+                       "- sending probe request\n", sdata->dev->name);
 #endif
 
-        ifmgd->flags |= IEEE80211_STA_PROBEREQ_POLL;
+        /*
+         * The driver/our work has already reported this event or the
+         * connection monitoring has kicked in and we have already sent
+         * a probe request. Or maybe the AP died and the driver keeps
+         * reporting until we disassociate...
+         *
+         * In either case we have to ignore the current call to this
+         * function (except for setting the correct probe reason bit)
+         * because otherwise we would reset the timer every time and
+         * never check whether we received a probe response!
+         */
+        if (ifmgd->flags & (IEEE80211_STA_BEACON_POLL |
+                            IEEE80211_STA_CONNECTION_POLL))
+                already = true;
+
+        if (beacon)
+                ifmgd->flags |= IEEE80211_STA_BEACON_POLL;
+        else
+                ifmgd->flags |= IEEE80211_STA_CONNECTION_POLL;
+
+        if (already)
+                goto out;
+
+        ifmgd->probe_timeout = jiffies + IEEE80211_PROBE_WAIT;
 
         mutex_lock(&sdata->local->iflist_mtx);
         ieee80211_recalc_ps(sdata->local, -1);
         mutex_unlock(&sdata->local->iflist_mtx);
 
-        ieee80211_send_probe_req(sdata, ifmgd->bssid, ifmgd->ssid,
-                                 ifmgd->ssid_len, NULL, 0);
+        ssid = ieee80211_bss_get_ie(&ifmgd->associated->cbss, WLAN_EID_SSID);
+        ieee80211_send_probe_req(sdata, ifmgd->associated->cbss.bssid,
+                                 ssid + 2, ssid[1], NULL, 0);
+
+        run_again(ifmgd, ifmgd->probe_timeout);
 
-        mod_timer(&ifmgd->timer, jiffies + IEEE80211_PROBE_WAIT);
+ out:
+        mutex_unlock(&ifmgd->mtx);
+}
+
+void ieee80211_beacon_loss_work(struct work_struct *work)
+{
+        struct ieee80211_sub_if_data *sdata =
+                container_of(work, struct ieee80211_sub_if_data,
+                             u.mgd.beacon_loss_work);
+
+        ieee80211_mgd_probe_ap(sdata, true);
 }
 
 void ieee80211_beacon_loss(struct ieee80211_vif *vif)
@@ -1335,105 +1234,16 @@ void ieee80211_beacon_loss(struct ieee80211_vif *vif)
 }
 EXPORT_SYMBOL(ieee80211_beacon_loss);
 
-static void ieee80211_associated(struct ieee80211_sub_if_data *sdata)
-{
-        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
-        struct ieee80211_local *local = sdata->local;
-        struct sta_info *sta;
-        unsigned long last_rx;
-        bool disassoc = false;
-
-        /* TODO: start monitoring current AP signal quality and number of
-         * missed beacons. Scan other channels every now and then and search
-         * for better APs. */
-        /* TODO: remove expired BSSes */
-
-        ifmgd->state = IEEE80211_STA_MLME_ASSOCIATED;
-
-        rcu_read_lock();
-
-        sta = sta_info_get(local, ifmgd->bssid);
-        if (!sta) {
-                printk(KERN_DEBUG "%s: No STA entry for own AP %pM\n",
-                       sdata->dev->name, ifmgd->bssid);
-                disassoc = true;
-                rcu_read_unlock();
-                goto out;
-        }
-
-        last_rx = sta->last_rx;
-        rcu_read_unlock();
-
-        if ((ifmgd->flags & IEEE80211_STA_PROBEREQ_POLL) &&
-            time_after(jiffies, last_rx + IEEE80211_PROBE_WAIT)) {
-                printk(KERN_DEBUG "%s: no probe response from AP %pM "
-                       "- disassociating\n",
-                       sdata->dev->name, ifmgd->bssid);
-                disassoc = true;
-                ifmgd->flags &= ~IEEE80211_STA_PROBEREQ_POLL;
-                goto out;
-        }
-
-        /*
-         * Beacon filtering is only enabled with power save and then the
-         * stack should not check for beacon loss.
-         */
-        if (!((local->hw.flags & IEEE80211_HW_BEACON_FILTER) &&
-              (local->hw.conf.flags & IEEE80211_CONF_PS)) &&
-            time_after(jiffies,
-                       ifmgd->last_beacon + IEEE80211_MONITORING_INTERVAL)) {
-#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
-                if (net_ratelimit()) {
-                        printk(KERN_DEBUG "%s: beacon loss from AP %pM "
-                               "- sending probe request\n",
-                               sdata->dev->name, ifmgd->bssid);
-                }
-#endif
-                ifmgd->flags |= IEEE80211_STA_PROBEREQ_POLL;
-                mutex_lock(&local->iflist_mtx);
-                ieee80211_recalc_ps(local, -1);
-                mutex_unlock(&local->iflist_mtx);
-                ieee80211_send_probe_req(sdata, ifmgd->bssid, ifmgd->ssid,
-                                         ifmgd->ssid_len, NULL, 0);
-                mod_timer(&ifmgd->timer, jiffies + IEEE80211_PROBE_WAIT);
-                goto out;
-        }
-
-        if (time_after(jiffies, last_rx + IEEE80211_PROBE_IDLE_TIME)) {
-                ifmgd->flags |= IEEE80211_STA_PROBEREQ_POLL;
-                mutex_lock(&local->iflist_mtx);
-                ieee80211_recalc_ps(local, -1);
-                mutex_unlock(&local->iflist_mtx);
-                ieee80211_send_probe_req(sdata, ifmgd->bssid, ifmgd->ssid,
-                                         ifmgd->ssid_len, NULL, 0);
-        }
-
- out:
-        if (!disassoc)
-                mod_timer(&ifmgd->timer,
-                          jiffies + IEEE80211_MONITORING_INTERVAL);
-        else
-                ieee80211_set_disassoc(sdata, true, true,
-                                        WLAN_REASON_PREV_AUTH_NOT_VALID);
-}
-
-
-static void ieee80211_auth_completed(struct ieee80211_sub_if_data *sdata)
+static void ieee80211_auth_completed(struct ieee80211_sub_if_data *sdata,
+                                     struct ieee80211_mgd_work *wk)
 {
-        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
-
+        wk->state = IEEE80211_MGD_STATE_IDLE;
         printk(KERN_DEBUG "%s: authenticated\n", sdata->dev->name);
-        ifmgd->flags |= IEEE80211_STA_AUTHENTICATED;
-        if (ifmgd->flags & IEEE80211_STA_EXT_SME) {
-                /* Wait for SME to request association */
-                ifmgd->state = IEEE80211_STA_MLME_DISABLED;
-                ieee80211_recalc_idle(sdata->local);
-        } else
-                ieee80211_associate(sdata);
 }
 
 
 static void ieee80211_auth_challenge(struct ieee80211_sub_if_data *sdata,
+                                     struct ieee80211_mgd_work *wk,
                                      struct ieee80211_mgmt *mgmt,
                                      size_t len)
 {
@@ -1444,161 +1254,133 @@ static void ieee80211_auth_challenge(struct ieee80211_sub_if_data *sdata,
         ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems);
         if (!elems.challenge)
                 return;
-        ieee80211_send_auth(sdata, 3, sdata->u.mgd.auth_alg,
+        ieee80211_send_auth(sdata, 3, wk->auth_alg,
                             elems.challenge - 2, elems.challenge_len + 2,
-                            sdata->u.mgd.bssid, 1);
-        sdata->u.mgd.auth_transaction = 4;
+                            wk->bss->cbss.bssid,
+                            wk->key, wk->key_len, wk->key_idx);
+        wk->auth_transaction = 4;
 }
 
-static void ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
-                                   struct ieee80211_mgmt *mgmt,
-                                   size_t len)
+static enum rx_mgmt_action __must_check
+ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
+                       struct ieee80211_mgd_work *wk,
+                       struct ieee80211_mgmt *mgmt, size_t len)
 {
-        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         u16 auth_alg, auth_transaction, status_code;
 
-        if (ifmgd->state != IEEE80211_STA_MLME_AUTHENTICATE)
-                return;
+        if (wk->state != IEEE80211_MGD_STATE_AUTH)
+                return RX_MGMT_NONE;
 
         if (len < 24 + 6)
-                return;
+                return RX_MGMT_NONE;
 
-        if (memcmp(ifmgd->bssid, mgmt->sa, ETH_ALEN) != 0)
-                return;
+        if (memcmp(wk->bss->cbss.bssid, mgmt->sa, ETH_ALEN) != 0)
+                return RX_MGMT_NONE;
 
-        if (memcmp(ifmgd->bssid, mgmt->bssid, ETH_ALEN) != 0)
-                return;
+        if (memcmp(wk->bss->cbss.bssid, mgmt->bssid, ETH_ALEN) != 0)
+                return RX_MGMT_NONE;
 
         auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg);
         auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction);
         status_code = le16_to_cpu(mgmt->u.auth.status_code);
 
-        if (auth_alg != ifmgd->auth_alg ||
-            auth_transaction != ifmgd->auth_transaction)
-                return;
+        if (auth_alg != wk->auth_alg ||
+            auth_transaction != wk->auth_transaction)
+                return RX_MGMT_NONE;
 
         if (status_code != WLAN_STATUS_SUCCESS) {
-                if (status_code == WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG) {
-                        u8 algs[3];
-                        const int num_algs = ARRAY_SIZE(algs);
-                        int i, pos;
-                        algs[0] = algs[1] = algs[2] = 0xff;
-                        if (ifmgd->auth_algs & IEEE80211_AUTH_ALG_OPEN)
-                                algs[0] = WLAN_AUTH_OPEN;
-                        if (ifmgd->auth_algs & IEEE80211_AUTH_ALG_SHARED_KEY)
-                                algs[1] = WLAN_AUTH_SHARED_KEY;
-                        if (ifmgd->auth_algs & IEEE80211_AUTH_ALG_LEAP)
-                                algs[2] = WLAN_AUTH_LEAP;
-                        if (ifmgd->auth_alg == WLAN_AUTH_OPEN)
-                                pos = 0;
-                        else if (ifmgd->auth_alg == WLAN_AUTH_SHARED_KEY)
-                                pos = 1;
-                        else
-                                pos = 2;
-                        for (i = 0; i < num_algs; i++) {
-                                pos++;
-                                if (pos >= num_algs)
-                                        pos = 0;
-                                if (algs[pos] == ifmgd->auth_alg ||
-                                    algs[pos] == 0xff)
-                                        continue;
-                                if (algs[pos] == WLAN_AUTH_SHARED_KEY &&
-                                    !ieee80211_sta_wep_configured(sdata))
-                                        continue;
-                                ifmgd->auth_alg = algs[pos];
-                                break;
-                        }
-                }
-                return;
+                list_del(&wk->list);
+                kfree(wk);
+                return RX_MGMT_CFG80211_AUTH;
         }
 
-        switch (ifmgd->auth_alg) {
+        switch (wk->auth_alg) {
         case WLAN_AUTH_OPEN:
         case WLAN_AUTH_LEAP:
         case WLAN_AUTH_FT:
-                ieee80211_auth_completed(sdata);
-                cfg80211_send_rx_auth(sdata->dev, (u8 *) mgmt, len);
-                break;
+                ieee80211_auth_completed(sdata, wk);
+                return RX_MGMT_CFG80211_AUTH;
         case WLAN_AUTH_SHARED_KEY:
-                if (ifmgd->auth_transaction == 4) {
-                        ieee80211_auth_completed(sdata);
-                        cfg80211_send_rx_auth(sdata->dev, (u8 *) mgmt, len);
+                if (wk->auth_transaction == 4) {
+                        ieee80211_auth_completed(sdata, wk);
+                        return RX_MGMT_CFG80211_AUTH;
                 } else
-                        ieee80211_auth_challenge(sdata, mgmt, len);
+                        ieee80211_auth_challenge(sdata, wk, mgmt, len);
                 break;
         }
+
+        return RX_MGMT_NONE;
 }
 
 
-static void ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata,
-                                     struct ieee80211_mgmt *mgmt,
-                                     size_t len)
+static enum rx_mgmt_action __must_check
+ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata,
+                         struct ieee80211_mgd_work *wk,
+                         struct ieee80211_mgmt *mgmt, size_t len)
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+        const u8 *bssid = NULL;
         u16 reason_code;
 
         if (len < 24 + 2)
-                return;
+                return RX_MGMT_NONE;
 
-        if (memcmp(ifmgd->bssid, mgmt->sa, ETH_ALEN))
-                return;
+        ASSERT_MGD_MTX(ifmgd);
+
+        if (wk)
+                bssid = wk->bss->cbss.bssid;
+        else
+                bssid = ifmgd->associated->cbss.bssid;
 
         reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
 
-        if (ifmgd->flags & IEEE80211_STA_AUTHENTICATED)
-                printk(KERN_DEBUG "%s: deauthenticated (Reason: %u)\n",
-                                sdata->dev->name, reason_code);
+        printk(KERN_DEBUG "%s: deauthenticated from %pM (Reason: %u)\n",
+                        sdata->dev->name, bssid, reason_code);
 
-        if (!(ifmgd->flags & IEEE80211_STA_EXT_SME) &&
-            (ifmgd->state == IEEE80211_STA_MLME_AUTHENTICATE ||
-             ifmgd->state == IEEE80211_STA_MLME_ASSOCIATE ||
-             ifmgd->state == IEEE80211_STA_MLME_ASSOCIATED)) {
-                ifmgd->state = IEEE80211_STA_MLME_DIRECT_PROBE;
-                mod_timer(&ifmgd->timer, jiffies +
-                                      IEEE80211_RETRY_AUTH_INTERVAL);
+        if (!wk) {
+                ieee80211_set_disassoc(sdata);
+        } else {
+                list_del(&wk->list);
+                kfree(wk);
         }
 
-        ieee80211_set_disassoc(sdata, true, false, 0);
-        ifmgd->flags &= ~IEEE80211_STA_AUTHENTICATED;
-        cfg80211_send_deauth(sdata->dev, (u8 *) mgmt, len);
+        return RX_MGMT_CFG80211_DEAUTH;
 }
 
 
-static void ieee80211_rx_mgmt_disassoc(struct ieee80211_sub_if_data *sdata,
-                                       struct ieee80211_mgmt *mgmt,
-                                       size_t len)
+static enum rx_mgmt_action __must_check
+ieee80211_rx_mgmt_disassoc(struct ieee80211_sub_if_data *sdata,
+                           struct ieee80211_mgmt *mgmt, size_t len)
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         u16 reason_code;
 
         if (len < 24 + 2)
-                return;
+                return RX_MGMT_NONE;
 
-        if (memcmp(ifmgd->bssid, mgmt->sa, ETH_ALEN))
-                return;
+        ASSERT_MGD_MTX(ifmgd);
 
-        reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);
+        if (WARN_ON(!ifmgd->associated))
+                return RX_MGMT_NONE;
 
-        if (ifmgd->flags & IEEE80211_STA_ASSOCIATED)
-                printk(KERN_DEBUG "%s: disassociated (Reason: %u)\n",
-                                sdata->dev->name, reason_code);
+        if (WARN_ON(memcmp(ifmgd->associated->cbss.bssid, mgmt->sa, ETH_ALEN)))
+                return RX_MGMT_NONE;
 
-        if (!(ifmgd->flags & IEEE80211_STA_EXT_SME) &&
-            ifmgd->state == IEEE80211_STA_MLME_ASSOCIATED) {
-                ifmgd->state = IEEE80211_STA_MLME_ASSOCIATE;
-                mod_timer(&ifmgd->timer, jiffies +
-                                      IEEE80211_RETRY_AUTH_INTERVAL);
-        }
+        reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);
 
-        ieee80211_set_disassoc(sdata, false, false, reason_code);
-        cfg80211_send_disassoc(sdata->dev, (u8 *) mgmt, len);
+        printk(KERN_DEBUG "%s: disassociated (Reason: %u)\n",
+                        sdata->dev->name, reason_code);
+
+        ieee80211_set_disassoc(sdata);
+        return RX_MGMT_CFG80211_DISASSOC;
 }
 
 
-static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
-                                         struct ieee80211_mgmt *mgmt,
-                                         size_t len,
-                                         int reassoc)
+static enum rx_mgmt_action __must_check
+ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
+                             struct ieee80211_mgd_work *wk,
+                             struct ieee80211_mgmt *mgmt, size_t len,
+                             bool reassoc)
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_local *local = sdata->local;
@@ -1614,17 +1396,16 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
         bool have_higher_than_11mbit = false, newsta = false;
         u16 ap_ht_cap_flags;
 
-        /* AssocResp and ReassocResp have identical structure, so process both
-         * of them in this function. */
-
-        if (ifmgd->state != IEEE80211_STA_MLME_ASSOCIATE)
-                return;
+        /*
+         * AssocResp and ReassocResp have identical structure, so process both
+         * of them in this function.
+         */
 
         if (len < 24 + 6)
-                return;
+                return RX_MGMT_NONE;
 
-        if (memcmp(ifmgd->bssid, mgmt->sa, ETH_ALEN) != 0)
-                return;
+        if (memcmp(wk->bss->cbss.bssid, mgmt->sa, ETH_ALEN) != 0)
+                return RX_MGMT_NONE;
 
         capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
         status_code = le16_to_cpu(mgmt->u.assoc_resp.status_code);
@@ -1647,26 +1428,18 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
                 printk(KERN_DEBUG "%s: AP rejected association temporarily; "
                        "comeback duration %u TU (%u ms)\n",
                        sdata->dev->name, tu, ms);
+                wk->timeout = jiffies + msecs_to_jiffies(ms);
                 if (ms > IEEE80211_ASSOC_TIMEOUT)
-                        mod_timer(&ifmgd->timer,
-                                  jiffies + msecs_to_jiffies(ms));
-                return;
+                        run_again(ifmgd, jiffies + msecs_to_jiffies(ms));
+                return RX_MGMT_NONE;
         }
 
         if (status_code != WLAN_STATUS_SUCCESS) {
                 printk(KERN_DEBUG "%s: AP denied association (code=%d)\n",
                        sdata->dev->name, status_code);
-                /* if this was a reassociation, ensure we try a "full"
-                 * association next time. This works around some broken APs
-                 * which do not correctly reject reassociation requests. */
-                ifmgd->flags &= ~IEEE80211_STA_PREV_BSSID_SET;
-                cfg80211_send_rx_assoc(sdata->dev, (u8 *) mgmt, len);
-                if (ifmgd->flags & IEEE80211_STA_EXT_SME) {
-                        /* Wait for SME to decide what to do next */
-                        ifmgd->state = IEEE80211_STA_MLME_DISABLED;
-                        ieee80211_recalc_idle(local);
-                }
-                return;
+                list_del(&wk->list);
+                kfree(wk);
+                return RX_MGMT_CFG80211_ASSOC;
         }
 
         if ((aid & (BIT(15) | BIT(14))) != (BIT(15) | BIT(14)))
@@ -1677,51 +1450,35 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
         if (!elems.supp_rates) {
                 printk(KERN_DEBUG "%s: no SuppRates element in AssocResp\n",
                        sdata->dev->name);
-                return;
+                return RX_MGMT_NONE;
         }
 
         printk(KERN_DEBUG "%s: associated\n", sdata->dev->name);
         ifmgd->aid = aid;
-        ifmgd->ap_capab = capab_info;
-
-        kfree(ifmgd->assocresp_ies);
-        ifmgd->assocresp_ies_len = len - (pos - (u8 *) mgmt);
-        ifmgd->assocresp_ies = kmalloc(ifmgd->assocresp_ies_len, GFP_KERNEL);
-        if (ifmgd->assocresp_ies)
-                memcpy(ifmgd->assocresp_ies, pos, ifmgd->assocresp_ies_len);
 
         rcu_read_lock();
 
         /* Add STA entry for the AP */
-        sta = sta_info_get(local, ifmgd->bssid);
+        sta = sta_info_get(local, wk->bss->cbss.bssid);
         if (!sta) {
                 newsta = true;
 
-                sta = sta_info_alloc(sdata, ifmgd->bssid, GFP_ATOMIC);
+                rcu_read_unlock();
+
+                sta = sta_info_alloc(sdata, wk->bss->cbss.bssid, GFP_KERNEL);
                 if (!sta) {
                         printk(KERN_DEBUG "%s: failed to alloc STA entry for"
                                " the AP\n", sdata->dev->name);
-                        rcu_read_unlock();
-                        return;
+                        return RX_MGMT_NONE;
                 }
 
-                /* update new sta with its last rx activity */
-                sta->last_rx = jiffies;
-        }
-
-        /*
-         * FIXME: Do we really need to update the sta_info's information here?
-         *        We already know about the AP (we found it in our list) so it
-         *        should already be filled with the right info, no?
-         *        As is stands, all this is racy because typically we assume
-         *        the information that is filled in here (except flags) doesn't
-         *        change while a STA structure is alive. As such, it should move
-         *        to between the sta_info_alloc() and sta_info_insert() above.
-         */
+                set_sta_flags(sta, WLAN_STA_AUTH | WLAN_STA_ASSOC |
+                                   WLAN_STA_ASSOC_AP);
+                if (!(ifmgd->flags & IEEE80211_STA_CONTROL_PORT))
+                        set_sta_flags(sta, WLAN_STA_AUTHORIZED);
 
-        set_sta_flags(sta, WLAN_STA_AUTH | WLAN_STA_ASSOC | WLAN_STA_ASSOC_AP);
-        if (!(ifmgd->flags & IEEE80211_STA_CONTROL_PORT))
-                set_sta_flags(sta, WLAN_STA_AUTHORIZED);
+                rcu_read_lock();
+        }
 
         rates = 0;
         basic_rates = 0;
@@ -1771,8 +1528,7 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
         else
                 sdata->flags &= ~IEEE80211_SDATA_OPERATING_GMODE;
 
-        /* If TKIP/WEP is used, no need to parse AP's HT capabilities */
-        if (elems.ht_cap_elem && !(ifmgd->flags & IEEE80211_STA_TKIP_WEP_USED))
+        if (elems.ht_cap_elem && !(ifmgd->flags & IEEE80211_STA_DISABLE_11N))
                 ieee80211_ht_cap_ie_to_sta_ht_cap(sband,
                                 elems.ht_cap_elem, &sta->sta.ht_cap);
 
@@ -1792,7 +1548,7 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
                         printk(KERN_DEBUG "%s: failed to insert STA entry for"
                                " the AP (error %d)\n", sdata->dev->name, err);
                         rcu_read_unlock();
-                        return;
+                        return RX_MGMT_NONE;
                 }
         }
 
@@ -1806,24 +1562,27 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
 
         if (elems.ht_info_elem && elems.wmm_param &&
             (ifmgd->flags & IEEE80211_STA_WMM_ENABLED) &&
-            !(ifmgd->flags & IEEE80211_STA_TKIP_WEP_USED))
+            !(ifmgd->flags & IEEE80211_STA_DISABLE_11N))
                 changed |= ieee80211_enable_ht(sdata, elems.ht_info_elem,
+                                               wk->bss->cbss.bssid,
                                                ap_ht_cap_flags);
 
         /* set AID and assoc capability,
          * ieee80211_set_associated() will tell the driver */
         bss_conf->aid = aid;
         bss_conf->assoc_capability = capab_info;
-        ieee80211_set_associated(sdata, changed);
+        ieee80211_set_associated(sdata, wk->bss, changed);
 
         /*
-         * initialise the time of last beacon to be the association time,
-         * otherwise beacon loss check will trigger immediately
+         * Start timer to probe the connection to the AP now.
+         * Also start the timer that will detect beacon loss.
          */
-        ifmgd->last_beacon = jiffies;
+        ieee80211_sta_rx_notify(sdata, (struct ieee80211_hdr *)mgmt);
+        mod_beacon_timer(sdata);
 
-        ieee80211_associated(sdata);
-        cfg80211_send_rx_assoc(sdata->dev, (u8 *) mgmt, len);
+        list_del(&wk->list);
+        kfree(wk);
+        return RX_MGMT_CFG80211_ASSOC;
 }
 
 
@@ -1851,23 +1610,25 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
 
         bss = ieee80211_bss_info_update(local, rx_status, mgmt, len, elems,
                                         channel, beacon);
-        if (!bss)
+        if (bss)
+                ieee80211_rx_bss_put(local, bss);
+
+        if (!sdata->u.mgd.associated)
                 return;
 
         if (elems->ch_switch_elem && (elems->ch_switch_elem_len == 3) &&
-            (memcmp(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN) == 0)) {
+            (memcmp(mgmt->bssid, sdata->u.mgd.associated->cbss.bssid,
+                                                        ETH_ALEN) == 0)) {
                 struct ieee80211_channel_sw_ie *sw_elem =
                         (struct ieee80211_channel_sw_ie *)elems->ch_switch_elem;
                 ieee80211_sta_process_chanswitch(sdata, sw_elem, bss);
         }
-
-        ieee80211_rx_bss_put(local, bss);
 }
 
 
 static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_sub_if_data *sdata,
-                                         struct ieee80211_mgmt *mgmt,
-                                         size_t len,
+                                         struct ieee80211_mgd_work *wk,
+                                         struct ieee80211_mgmt *mgmt, size_t len,
                                          struct ieee80211_rx_status *rx_status)
 {
         struct ieee80211_if_managed *ifmgd;
@@ -1876,6 +1637,8 @@ static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_sub_if_data *sdata,
 
         ifmgd = &sdata->u.mgd;
 
+        ASSERT_MGD_MTX(ifmgd);
+
         if (memcmp(mgmt->da, sdata->dev->dev_addr, ETH_ALEN))
                 return; /* ignore ProbeResp to foreign address */
 
@@ -1889,17 +1652,32 @@ static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_sub_if_data *sdata,
         ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems, false);
 
         /* direct probe may be part of the association flow */
-        if (ifmgd->state == IEEE80211_STA_MLME_DIRECT_PROBE) {
+        if (wk && wk->state == IEEE80211_MGD_STATE_PROBE) {
                 printk(KERN_DEBUG "%s direct probe responded\n",
                        sdata->dev->name);
-                ieee80211_authenticate(sdata);
+                wk->tries = 0;
+                wk->state = IEEE80211_MGD_STATE_AUTH;
+                WARN_ON(ieee80211_authenticate(sdata, wk) != RX_MGMT_NONE);
         }
 
-        if (ifmgd->flags & IEEE80211_STA_PROBEREQ_POLL) {
-                ifmgd->flags &= ~IEEE80211_STA_PROBEREQ_POLL;
+        if (ifmgd->associated &&
+            memcmp(mgmt->bssid, ifmgd->associated->cbss.bssid, ETH_ALEN) == 0 &&
+            ifmgd->flags & (IEEE80211_STA_BEACON_POLL |
+                            IEEE80211_STA_CONNECTION_POLL)) {
+                ifmgd->flags &= ~(IEEE80211_STA_CONNECTION_POLL |
+                                  IEEE80211_STA_BEACON_POLL);
                 mutex_lock(&sdata->local->iflist_mtx);
                 ieee80211_recalc_ps(sdata->local, -1);
                 mutex_unlock(&sdata->local->iflist_mtx);
+                /*
+                 * We've received a probe response, but are not sure whether
+                 * we have or will be receiving any beacons or data, so let's
+                 * schedule the timers again, just in case.
+                 */
+                mod_beacon_timer(sdata);
+                mod_timer(&ifmgd->conn_mon_timer,
+                          round_jiffies_up(jiffies +
+                                           IEEE80211_CONNECTION_IDLE_TIME));
         }
 }
 
@@ -1937,6 +1715,9 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
         bool erp_valid, directed_tim = false;
         u8 erp_value = 0;
         u32 ncrc;
+        u8 *bssid;
+
+        ASSERT_MGD_MTX(ifmgd);
 
         /* Process beacon from the current BSS */
         baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
@@ -1946,23 +1727,41 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
         if (rx_status->freq != local->hw.conf.channel->center_freq)
                 return;
 
-        if (!(ifmgd->flags & IEEE80211_STA_ASSOCIATED) ||
-            memcmp(ifmgd->bssid, mgmt->bssid, ETH_ALEN) != 0)
+        /*
+         * We might have received a number of frames, among them a
+         * disassoc frame and a beacon...
+         */
+        if (!ifmgd->associated)
                 return;
 
-        if (ifmgd->flags & IEEE80211_STA_PROBEREQ_POLL) {
+        bssid = ifmgd->associated->cbss.bssid;
+
+        /*
+         * And in theory even frames from a different AP we were just
+         * associated to a split-second ago!
+         */
+        if (memcmp(bssid, mgmt->bssid, ETH_ALEN) != 0)
+                return;
+
+        if (ifmgd->flags & IEEE80211_STA_BEACON_POLL) {
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
                 if (net_ratelimit()) {
                         printk(KERN_DEBUG "%s: cancelling probereq poll due "
                                "to a received beacon\n", sdata->dev->name);
                 }
 #endif
-                ifmgd->flags &= ~IEEE80211_STA_PROBEREQ_POLL;
+                ifmgd->flags &= ~IEEE80211_STA_BEACON_POLL;
                 mutex_lock(&local->iflist_mtx);
                 ieee80211_recalc_ps(local, -1);
                 mutex_unlock(&local->iflist_mtx);
         }
 
+        /*
+         * Push the beacon loss detection into the future since
+         * we are processing a beacon from the AP just now.
+         */
+        mod_beacon_timer(sdata);
+
         ncrc = crc32_be(0, (void *)&mgmt->u.beacon.beacon_int, 4);
         ncrc = ieee802_11_parse_elems_crc(mgmt->u.beacon.variable,
                                           len - baselen, &elems,
@@ -2019,15 +1818,15 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
 
 
         if (elems.ht_cap_elem && elems.ht_info_elem && elems.wmm_param &&
-            !(ifmgd->flags & IEEE80211_STA_TKIP_WEP_USED)) {
+            !(ifmgd->flags & IEEE80211_STA_DISABLE_11N)) {
                 struct sta_info *sta;
                 struct ieee80211_supported_band *sband;
                 u16 ap_ht_cap_flags;
 
                 rcu_read_lock();
 
-                sta = sta_info_get(local, ifmgd->bssid);
-                if (!sta) {
+                sta = sta_info_get(local, bssid);
+                if (WARN_ON(!sta)) {
                         rcu_read_unlock();
                         return;
                 }
@@ -2042,7 +1841,7 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
                 rcu_read_unlock();
 
                 changed |= ieee80211_enable_ht(sdata, elems.ht_info_elem,
-                                               ap_ht_cap_flags);
+                                               bssid, ap_ht_cap_flags);
         }
 
         if (elems.country_elem) {
@@ -2063,8 +1862,7 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
 }
 
 ieee80211_rx_result ieee80211_sta_rx_mgmt(struct ieee80211_sub_if_data *sdata,
-                                          struct sk_buff *skb,
-                                          struct ieee80211_rx_status *rx_status)
+                                          struct sk_buff *skb)
 {
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_mgmt *mgmt;
@@ -2080,12 +1878,12 @@ ieee80211_rx_result ieee80211_sta_rx_mgmt(struct ieee80211_sub_if_data *sdata,
         case IEEE80211_STYPE_PROBE_REQ:
         case IEEE80211_STYPE_PROBE_RESP:
         case IEEE80211_STYPE_BEACON:
-                memcpy(skb->cb, rx_status, sizeof(*rx_status));
         case IEEE80211_STYPE_AUTH:
         case IEEE80211_STYPE_ASSOC_RESP:
         case IEEE80211_STYPE_REASSOC_RESP:
         case IEEE80211_STYPE_DEAUTH:
         case IEEE80211_STYPE_DISASSOC:
+        case IEEE80211_STYPE_ACTION:
                 skb_queue_tail(&sdata->u.mgd.skb_queue, skb);
                 queue_work(local->hw.workqueue, &sdata->u.mgd.work);
                 return RX_QUEUED;
@@ -2097,40 +1895,116 @@ ieee80211_rx_result ieee80211_sta_rx_mgmt(struct ieee80211_sub_if_data *sdata,
 static void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
                                          struct sk_buff *skb)
 {
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_rx_status *rx_status;
         struct ieee80211_mgmt *mgmt;
+        struct ieee80211_mgd_work *wk;
+        enum rx_mgmt_action rma = RX_MGMT_NONE;
         u16 fc;
 
         rx_status = (struct ieee80211_rx_status *) skb->cb;
         mgmt = (struct ieee80211_mgmt *) skb->data;
         fc = le16_to_cpu(mgmt->frame_control);
 
-        switch (fc & IEEE80211_FCTL_STYPE) {
-        case IEEE80211_STYPE_PROBE_RESP:
-                ieee80211_rx_mgmt_probe_resp(sdata, mgmt, skb->len,
-                                             rx_status);
-                break;
-        case IEEE80211_STYPE_BEACON:
-                ieee80211_rx_mgmt_beacon(sdata, mgmt, skb->len,
-                                         rx_status);
-                break;
-        case IEEE80211_STYPE_AUTH:
-                ieee80211_rx_mgmt_auth(sdata, mgmt, skb->len);
-                break;
-        case IEEE80211_STYPE_ASSOC_RESP:
-                ieee80211_rx_mgmt_assoc_resp(sdata, mgmt, skb->len, 0);
+        mutex_lock(&ifmgd->mtx);
+
+        if (ifmgd->associated &&
+            memcmp(ifmgd->associated->cbss.bssid, mgmt->bssid,
+                                                        ETH_ALEN) == 0) {
+                switch (fc & IEEE80211_FCTL_STYPE) {
+                case IEEE80211_STYPE_BEACON:
+                        ieee80211_rx_mgmt_beacon(sdata, mgmt, skb->len,
+                                                 rx_status);
+                        break;
+                case IEEE80211_STYPE_PROBE_RESP:
+                        ieee80211_rx_mgmt_probe_resp(sdata, NULL, mgmt,
+                                                     skb->len, rx_status);
+                        break;
+                case IEEE80211_STYPE_DEAUTH:
+                        rma = ieee80211_rx_mgmt_deauth(sdata, NULL,
+                                                       mgmt, skb->len);
+                        break;
+                case IEEE80211_STYPE_DISASSOC:
+                        rma = ieee80211_rx_mgmt_disassoc(sdata, mgmt, skb->len);
+                        break;
+                case IEEE80211_STYPE_ACTION:
+                        /* XXX: differentiate, can only happen for CSA now! */
+                        ieee80211_sta_process_chanswitch(sdata,
+                                        &mgmt->u.action.u.chan_switch.sw_elem,
+                                        ifmgd->associated);
+                        break;
+                }
+                mutex_unlock(&ifmgd->mtx);
+
+                switch (rma) {
+                case RX_MGMT_NONE:
+                        /* no action */
+                        break;
+                case RX_MGMT_CFG80211_DEAUTH:
+                        cfg80211_send_deauth(sdata->dev, (u8 *)mgmt, skb->len,
+                                             NULL);
+                        break;
+                case RX_MGMT_CFG80211_DISASSOC:
+                        cfg80211_send_disassoc(sdata->dev, (u8 *)mgmt, skb->len,
+                                               NULL);
+                        break;
+                default:
+                        WARN(1, "unexpected: %d", rma);
+                }
+                goto out;
+        }
+
+        list_for_each_entry(wk, &ifmgd->work_list, list) {
+                if (memcmp(wk->bss->cbss.bssid, mgmt->bssid, ETH_ALEN) != 0)
+                        continue;
+
+                switch (fc & IEEE80211_FCTL_STYPE) {
+                case IEEE80211_STYPE_PROBE_RESP:
+                        ieee80211_rx_mgmt_probe_resp(sdata, wk, mgmt, skb->len,
+                                                     rx_status);
+                        break;
+                case IEEE80211_STYPE_AUTH:
+                        rma = ieee80211_rx_mgmt_auth(sdata, wk, mgmt, skb->len);
+                        break;
+                case IEEE80211_STYPE_ASSOC_RESP:
+                        rma = ieee80211_rx_mgmt_assoc_resp(sdata, wk, mgmt,
+                                                           skb->len, false);
+                        break;
+                case IEEE80211_STYPE_REASSOC_RESP:
+                        rma = ieee80211_rx_mgmt_assoc_resp(sdata, wk, mgmt,
+                                                           skb->len, true);
+                        break;
+                case IEEE80211_STYPE_DEAUTH:
+                        rma = ieee80211_rx_mgmt_deauth(sdata, wk, mgmt,
+                                                       skb->len);
+                        break;
+                }
+                /*
+                 * We've processed this frame for that work, so it can't
+                 * belong to another work struct.
+                 * NB: this is also required for correctness because the
+                 * called functions can free 'wk', and for 'rma'!
+                 */
                 break;
-        case IEEE80211_STYPE_REASSOC_RESP:
-                ieee80211_rx_mgmt_assoc_resp(sdata, mgmt, skb->len, 1);
+        }
+
+        mutex_unlock(&ifmgd->mtx);
+
+        switch (rma) {
+        case RX_MGMT_NONE:
+                /* no action */
                 break;
-        case IEEE80211_STYPE_DEAUTH:
-                ieee80211_rx_mgmt_deauth(sdata, mgmt, skb->len);
+        case RX_MGMT_CFG80211_AUTH:
+                cfg80211_send_rx_auth(sdata->dev, (u8 *) mgmt, skb->len);
                 break;
-        case IEEE80211_STYPE_DISASSOC:
-                ieee80211_rx_mgmt_disassoc(sdata, mgmt, skb->len);
+        case RX_MGMT_CFG80211_ASSOC:
+                cfg80211_send_rx_assoc(sdata->dev, (u8 *) mgmt, skb->len);
                 break;
+        default:
+                WARN(1, "unexpected: %d", rma);
         }
 
+ out:
         kfree_skb(skb);
 }
 
@@ -2146,125 +2020,9 @@ static void ieee80211_sta_timer(unsigned long data)
                 return;
         }
 
-        set_bit(IEEE80211_STA_REQ_RUN, &ifmgd->request);
         queue_work(local->hw.workqueue, &ifmgd->work);
 }
 
-static void ieee80211_sta_reset_auth(struct ieee80211_sub_if_data *sdata)
-{
-        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
-        struct ieee80211_local *local = sdata->local;
-
-        /* Reset own TSF to allow time synchronization work. */
-        drv_reset_tsf(local);
-
-        ifmgd->wmm_last_param_set = -1; /* allow any WMM update */
-
-
-        if (ifmgd->auth_algs & IEEE80211_AUTH_ALG_OPEN)
-                ifmgd->auth_alg = WLAN_AUTH_OPEN;
-        else if (ifmgd->auth_algs & IEEE80211_AUTH_ALG_SHARED_KEY)
-                ifmgd->auth_alg = WLAN_AUTH_SHARED_KEY;
-        else if (ifmgd->auth_algs & IEEE80211_AUTH_ALG_LEAP)
-                ifmgd->auth_alg = WLAN_AUTH_LEAP;
-        else if (ifmgd->auth_algs & IEEE80211_AUTH_ALG_FT)
-                ifmgd->auth_alg = WLAN_AUTH_FT;
-        else
-                ifmgd->auth_alg = WLAN_AUTH_OPEN;
-        ifmgd->auth_transaction = -1;
-        ifmgd->flags &= ~IEEE80211_STA_ASSOCIATED;
-        ifmgd->assoc_scan_tries = 0;
-        ifmgd->direct_probe_tries = 0;
-        ifmgd->auth_tries = 0;
-        ifmgd->assoc_tries = 0;
-        netif_tx_stop_all_queues(sdata->dev);
-        netif_carrier_off(sdata->dev);
-}
-
-static int ieee80211_sta_config_auth(struct ieee80211_sub_if_data *sdata)
-{
-        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
-        struct ieee80211_local *local = sdata->local;
-        struct ieee80211_bss *bss;
-        u8 *bssid = ifmgd->bssid, *ssid = ifmgd->ssid;
-        u8 ssid_len = ifmgd->ssid_len;
-        u16 capa_mask = WLAN_CAPABILITY_ESS;
-        u16 capa_val = WLAN_CAPABILITY_ESS;
-        struct ieee80211_channel *chan = local->oper_channel;
-
-        if (!(ifmgd->flags & IEEE80211_STA_EXT_SME) &&
-            ifmgd->flags & (IEEE80211_STA_AUTO_SSID_SEL |
-                            IEEE80211_STA_AUTO_BSSID_SEL |
-                            IEEE80211_STA_AUTO_CHANNEL_SEL)) {
-                capa_mask |= WLAN_CAPABILITY_PRIVACY;
-                if (sdata->default_key)
-                        capa_val |= WLAN_CAPABILITY_PRIVACY;
-        }
-
-        if (ifmgd->flags & IEEE80211_STA_AUTO_CHANNEL_SEL)
-                chan = NULL;
-
-        if (ifmgd->flags & IEEE80211_STA_AUTO_BSSID_SEL)
-                bssid = NULL;
-
-        if (ifmgd->flags & IEEE80211_STA_AUTO_SSID_SEL) {
-                ssid = NULL;
-                ssid_len = 0;
-        }
-
-        bss = (void *)cfg80211_get_bss(local->hw.wiphy, chan,
-                                       bssid, ssid, ssid_len,
-                                       capa_mask, capa_val);
-
-        if (bss) {
-                local->oper_channel = bss->cbss.channel;
-                local->oper_channel_type = NL80211_CHAN_NO_HT;
-                ieee80211_hw_config(local, 0);
-
-                if (!(ifmgd->flags & IEEE80211_STA_SSID_SET))
-                        ieee80211_sta_set_ssid(sdata, bss->ssid,
-                                               bss->ssid_len);
-                ieee80211_sta_set_bssid(sdata, bss->cbss.bssid);
-                ieee80211_sta_def_wmm_params(sdata, bss->supp_rates_len,
-                                                    bss->supp_rates);
-                if (sdata->u.mgd.mfp == IEEE80211_MFP_REQUIRED)
-                        sdata->u.mgd.flags |= IEEE80211_STA_MFP_ENABLED;
-                else
-                        sdata->u.mgd.flags &= ~IEEE80211_STA_MFP_ENABLED;
-
-                /* Send out direct probe if no probe resp was received or
-                 * the one we have is outdated
-                 */
-                if (!bss->last_probe_resp ||
-                    time_after(jiffies, bss->last_probe_resp
-                                        + IEEE80211_SCAN_RESULT_EXPIRE))
-                        ifmgd->state = IEEE80211_STA_MLME_DIRECT_PROBE;
-                else
-                        ifmgd->state = IEEE80211_STA_MLME_AUTHENTICATE;
-
-                ieee80211_rx_bss_put(local, bss);
-                ieee80211_sta_reset_auth(sdata);
-                return 0;
-        } else {
-                if (ifmgd->assoc_scan_tries < IEEE80211_ASSOC_SCANS_MAX_TRIES) {
-
-                        ifmgd->assoc_scan_tries++;
-
-                        ieee80211_request_internal_scan(sdata, ifmgd->ssid,
-                                                        ssid_len);
-
-                        ifmgd->state = IEEE80211_STA_MLME_AUTHENTICATE;
-                        set_bit(IEEE80211_STA_REQ_AUTH, &ifmgd->request);
-                } else {
-                        ifmgd->assoc_scan_tries = 0;
-                        ifmgd->state = IEEE80211_STA_MLME_DISABLED;
-                        ieee80211_recalc_idle(local);
-                }
-        }
-        return -1;
-}
-
-
 static void ieee80211_sta_work(struct work_struct *work)
 {
         struct ieee80211_sub_if_data *sdata =
@@ -2272,6 +2030,10 @@ static void ieee80211_sta_work(struct work_struct *work)
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_if_managed *ifmgd;
         struct sk_buff *skb;
+        struct ieee80211_mgd_work *wk, *tmp;
+        LIST_HEAD(free_work);
+        enum rx_mgmt_action rma;
+        bool anybusy = false;
 
         if (!netif_running(sdata->dev))
                 return;
@@ -2294,66 +2056,179 @@ static void ieee80211_sta_work(struct work_struct *work)
 
         ifmgd = &sdata->u.mgd;
 
+        /* first process frames to avoid timing out while a frame is pending */
         while ((skb = skb_dequeue(&ifmgd->skb_queue)))
                 ieee80211_sta_rx_queued_mgmt(sdata, skb);
 
-        if (ifmgd->state != IEEE80211_STA_MLME_DIRECT_PROBE &&
-            ifmgd->state != IEEE80211_STA_MLME_AUTHENTICATE &&
-            ifmgd->state != IEEE80211_STA_MLME_ASSOCIATE &&
-            test_and_clear_bit(IEEE80211_STA_REQ_SCAN, &ifmgd->request)) {
-                queue_delayed_work(local->hw.workqueue, &local->scan_work,
-                                   round_jiffies_relative(0));
-                return;
+        /* then process the rest of the work */
+        mutex_lock(&ifmgd->mtx);
+
+        if (ifmgd->flags & (IEEE80211_STA_BEACON_POLL |
+                            IEEE80211_STA_CONNECTION_POLL) &&
+            ifmgd->associated) {
+                if (time_is_after_jiffies(ifmgd->probe_timeout))
+                        run_again(ifmgd, ifmgd->probe_timeout);
+                else {
+                        u8 bssid[ETH_ALEN];
+                        /*
+                         * We actually lost the connection ... or did we?
+                         * Let's make sure!
+                         */
+                        ifmgd->flags &= ~(IEEE80211_STA_CONNECTION_POLL |
+                                          IEEE80211_STA_BEACON_POLL);
+                        memcpy(bssid, ifmgd->associated->cbss.bssid, ETH_ALEN);
+                        printk(KERN_DEBUG "No probe response from AP %pM"
+                                " after %dms, disconnecting.\n",
+                                bssid, (1000 * IEEE80211_PROBE_WAIT)/HZ);
+                        ieee80211_set_disassoc(sdata);
+                        mutex_unlock(&ifmgd->mtx);
+                        /*
+                         * must be outside lock due to cfg80211,
+                         * but that's not a problem.
+                         */
+                        ieee80211_send_deauth_disassoc(sdata, bssid,
+                                        IEEE80211_STYPE_DEAUTH,
+                                        WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
+                                        NULL);
+                        mutex_lock(&ifmgd->mtx);
+                }
         }
 
-        if (test_and_clear_bit(IEEE80211_STA_REQ_AUTH, &ifmgd->request)) {
-                if (ieee80211_sta_config_auth(sdata))
-                        return;
-                clear_bit(IEEE80211_STA_REQ_RUN, &ifmgd->request);
-        } else if (!test_and_clear_bit(IEEE80211_STA_REQ_RUN, &ifmgd->request))
-                return;
+        list_for_each_entry(wk, &ifmgd->work_list, list) {
+                if (wk->state != IEEE80211_MGD_STATE_IDLE) {
+                        anybusy = true;
+                        break;
+                }
+        }
 
         ieee80211_recalc_idle(local);
 
-        switch (ifmgd->state) {
-        case IEEE80211_STA_MLME_DISABLED:
-                break;
-        case IEEE80211_STA_MLME_DIRECT_PROBE:
-                ieee80211_direct_probe(sdata);
-                break;
-        case IEEE80211_STA_MLME_AUTHENTICATE:
-                ieee80211_authenticate(sdata);
-                break;
-        case IEEE80211_STA_MLME_ASSOCIATE:
-                ieee80211_associate(sdata);
-                break;
-        case IEEE80211_STA_MLME_ASSOCIATED:
-                ieee80211_associated(sdata);
-                break;
-        default:
-                WARN_ON(1);
-                break;
+        if (!anybusy) {
+                mutex_unlock(&ifmgd->mtx);
+
+                if (test_and_clear_bit(IEEE80211_STA_REQ_SCAN, &ifmgd->request))
+                        queue_delayed_work(local->hw.workqueue,
+                                           &local->scan_work,
+                                           round_jiffies_relative(0));
+                return;
         }
 
-        if (ieee80211_privacy_mismatch(sdata)) {
-                printk(KERN_DEBUG "%s: privacy configuration mismatch and "
-                       "mixed-cell disabled - disassociate\n", sdata->dev->name);
+        list_for_each_entry_safe(wk, tmp, &ifmgd->work_list, list) {
+                if (time_is_after_jiffies(wk->timeout)) {
+                        /*
+                         * This work item isn't supposed to be worked on
+                         * right now, but take care to adjust the timer
+                         * properly.
+                         */
+                        run_again(ifmgd, wk->timeout);
+                        continue;
+                }
+
+                switch (wk->state) {
+                default:
+                        WARN_ON(1);
+                        /* fall through */
+                case IEEE80211_MGD_STATE_IDLE:
+                        /* nothing */
+                        rma = RX_MGMT_NONE;
+                        break;
+                case IEEE80211_MGD_STATE_PROBE:
+                        rma = ieee80211_direct_probe(sdata, wk);
+                        break;
+                case IEEE80211_MGD_STATE_AUTH:
+                        rma = ieee80211_authenticate(sdata, wk);
+                        break;
+                case IEEE80211_MGD_STATE_ASSOC:
+                        rma = ieee80211_associate(sdata, wk);
+                        break;
+                }
+
+                switch (rma) {
+                case RX_MGMT_NONE:
+                        /* no action required */
+                        break;
+                case RX_MGMT_CFG80211_AUTH_TO:
+                case RX_MGMT_CFG80211_ASSOC_TO:
+                        list_del(&wk->list);
+                        list_add(&wk->list, &free_work);
+                        wk->tries = rma; /* small abuse but only local */
+                        break;
+                default:
+                        WARN(1, "unexpected: %d", rma);
+                }
+        }
+
+        mutex_unlock(&ifmgd->mtx);
+
+        list_for_each_entry_safe(wk, tmp, &free_work, list) {
+                switch (wk->tries) {
+                case RX_MGMT_CFG80211_AUTH_TO:
+                        cfg80211_send_auth_timeout(sdata->dev,
+                                                   wk->bss->cbss.bssid);
+                        break;
+                case RX_MGMT_CFG80211_ASSOC_TO:
+                        cfg80211_send_assoc_timeout(sdata->dev,
+                                                    wk->bss->cbss.bssid);
+                        break;
+                default:
+                        WARN(1, "unexpected: %d", wk->tries);
+                }
 
-                ieee80211_set_disassoc(sdata, false, true,
-                                        WLAN_REASON_UNSPECIFIED);
+                list_del(&wk->list);
+                kfree(wk);
         }
+
+        ieee80211_recalc_idle(local);
+}
+
+static void ieee80211_sta_bcn_mon_timer(unsigned long data)
+{
+        struct ieee80211_sub_if_data *sdata =
+                (struct ieee80211_sub_if_data *) data;
+        struct ieee80211_local *local = sdata->local;
+
+        if (local->quiescing)
+                return;
+
+        queue_work(sdata->local->hw.workqueue,
+                   &sdata->u.mgd.beacon_loss_work);
+}
+
+static void ieee80211_sta_conn_mon_timer(unsigned long data)
+{
+        struct ieee80211_sub_if_data *sdata =
+                (struct ieee80211_sub_if_data *) data;
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+        struct ieee80211_local *local = sdata->local;
+
+        if (local->quiescing)
+                return;
+
+        queue_work(local->hw.workqueue, &ifmgd->monitor_work);
+}
+
+static void ieee80211_sta_monitor_work(struct work_struct *work)
+{
+        struct ieee80211_sub_if_data *sdata =
+                container_of(work, struct ieee80211_sub_if_data,
+                             u.mgd.monitor_work);
+
+        if (sdata->local->sw_scanning || sdata->local->hw_scanning)
+                return;
+
+        ieee80211_mgd_probe_ap(sdata, false);
 }
 
 static void ieee80211_restart_sta_timer(struct ieee80211_sub_if_data *sdata)
 {
         if (sdata->vif.type == NL80211_IFTYPE_STATION) {
-                /*
-                 * Need to update last_beacon to avoid beacon loss
-                 * test to trigger.
-                 */
-                sdata->u.mgd.last_beacon = jiffies;
-
+                sdata->u.mgd.flags &= ~(IEEE80211_STA_BEACON_POLL |
+                                        IEEE80211_STA_CONNECTION_POLL);
 
+                /* let's probe the connection once */
+                queue_work(sdata->local->hw.workqueue,
+                           &sdata->u.mgd.monitor_work);
+                /* and do all the other regular work too */
                 queue_work(sdata->local->hw.workqueue,
                            &sdata->u.mgd.work);
         }
@@ -2378,6 +2253,11 @@ void ieee80211_sta_quiesce(struct ieee80211_sub_if_data *sdata)
         cancel_work_sync(&ifmgd->chswitch_work);
         if (del_timer_sync(&ifmgd->chswitch_timer))
                 set_bit(TMR_RUNNING_CHANSW, &ifmgd->timers_running);
+
+        cancel_work_sync(&ifmgd->monitor_work);
+        /* these will just be re-established on connection */
+        del_timer_sync(&ifmgd->conn_mon_timer);
+        del_timer_sync(&ifmgd->bcn_mon_timer);
 }
 
 void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata)
@@ -2395,210 +2275,265 @@ void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata)
 void ieee80211_sta_setup_sdata(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_if_managed *ifmgd;
-        u32 hw_flags;
 
         ifmgd = &sdata->u.mgd;
         INIT_WORK(&ifmgd->work, ieee80211_sta_work);
+        INIT_WORK(&ifmgd->monitor_work, ieee80211_sta_monitor_work);
         INIT_WORK(&ifmgd->chswitch_work, ieee80211_chswitch_work);
         INIT_WORK(&ifmgd->beacon_loss_work, ieee80211_beacon_loss_work);
         setup_timer(&ifmgd->timer, ieee80211_sta_timer,
                     (unsigned long) sdata);
+        setup_timer(&ifmgd->bcn_mon_timer, ieee80211_sta_bcn_mon_timer,
+                    (unsigned long) sdata);
+        setup_timer(&ifmgd->conn_mon_timer, ieee80211_sta_conn_mon_timer,
+                    (unsigned long) sdata);
         setup_timer(&ifmgd->chswitch_timer, ieee80211_chswitch_timer,
                     (unsigned long) sdata);
         skb_queue_head_init(&ifmgd->skb_queue);
 
+        INIT_LIST_HEAD(&ifmgd->work_list);
+
         ifmgd->capab = WLAN_CAPABILITY_ESS;
-        ifmgd->auth_algs = IEEE80211_AUTH_ALG_OPEN |
-                IEEE80211_AUTH_ALG_SHARED_KEY;
-        ifmgd->flags |= IEEE80211_STA_CREATE_IBSS |
-                IEEE80211_STA_AUTO_BSSID_SEL |
-                IEEE80211_STA_AUTO_CHANNEL_SEL;
+        ifmgd->flags = 0;
         if (sdata->local->hw.queues >= 4)
                 ifmgd->flags |= IEEE80211_STA_WMM_ENABLED;
 
-        hw_flags = sdata->local->hw.flags;
-
-        if (hw_flags & IEEE80211_HW_SUPPORTS_PS) {
-                ifmgd->powersave = CONFIG_MAC80211_DEFAULT_PS_VALUE;
-                sdata->local->hw.conf.dynamic_ps_timeout = 500;
-        }
+        mutex_init(&ifmgd->mtx);
 }
 
-/* configuration hooks */
-void ieee80211_sta_req_auth(struct ieee80211_sub_if_data *sdata)
+/* scan finished notification */
+void ieee80211_mlme_notify_scan_completed(struct ieee80211_local *local)
 {
-        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
-        struct ieee80211_local *local = sdata->local;
-
-        if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
-                return;
-
-        if ((ifmgd->flags & (IEEE80211_STA_BSSID_SET |
-                             IEEE80211_STA_AUTO_BSSID_SEL)) &&
-            (ifmgd->flags & (IEEE80211_STA_SSID_SET |
-                             IEEE80211_STA_AUTO_SSID_SEL))) {
-
-                if (ifmgd->state == IEEE80211_STA_MLME_ASSOCIATED)
-                        ieee80211_set_disassoc(sdata, true, true,
-                                               WLAN_REASON_DEAUTH_LEAVING);
-
-                if (ifmgd->ssid_len == 0) {
-                        /*
-                         * Only allow association to be started if a valid SSID
-                         * is configured.
-                         */
-                        return;
-                }
+        struct ieee80211_sub_if_data *sdata = local->scan_sdata;
 
-                if (!(ifmgd->flags & IEEE80211_STA_EXT_SME) ||
-                    ifmgd->state != IEEE80211_STA_MLME_ASSOCIATE)
-                        set_bit(IEEE80211_STA_REQ_AUTH, &ifmgd->request);
-                else if (ifmgd->flags & IEEE80211_STA_EXT_SME)
-                        set_bit(IEEE80211_STA_REQ_RUN, &ifmgd->request);
-                queue_work(local->hw.workqueue, &ifmgd->work);
-        }
+        /* Restart STA timers */
+        rcu_read_lock();
+        list_for_each_entry_rcu(sdata, &local->interfaces, list)
+                ieee80211_restart_sta_timer(sdata);
+        rcu_read_unlock();
 }
 
-int ieee80211_sta_commit(struct ieee80211_sub_if_data *sdata)
+int ieee80211_max_network_latency(struct notifier_block *nb,
+                                  unsigned long data, void *dummy)
 {
-        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+        s32 latency_usec = (s32) data;
+        struct ieee80211_local *local =
+                container_of(nb, struct ieee80211_local,
+                             network_latency_notifier);
 
-        if (ifmgd->ssid_len)
-                ifmgd->flags |= IEEE80211_STA_SSID_SET;
-        else
-                ifmgd->flags &= ~IEEE80211_STA_SSID_SET;
+        mutex_lock(&local->iflist_mtx);
+        ieee80211_recalc_ps(local, latency_usec);
+        mutex_unlock(&local->iflist_mtx);
 
         return 0;
 }
 
-int ieee80211_sta_set_ssid(struct ieee80211_sub_if_data *sdata, char *ssid, size_t len)
+/* config hooks */
+int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata,
+                       struct cfg80211_auth_request *req)
 {
-        struct ieee80211_if_managed *ifmgd;
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+        const u8 *ssid;
+        struct ieee80211_mgd_work *wk;
+        u16 auth_alg;
 
-        if (len > IEEE80211_MAX_SSID_LEN)
-                return -EINVAL;
+        switch (req->auth_type) {
+        case NL80211_AUTHTYPE_OPEN_SYSTEM:
+                auth_alg = WLAN_AUTH_OPEN;
+                break;
+        case NL80211_AUTHTYPE_SHARED_KEY:
+                auth_alg = WLAN_AUTH_SHARED_KEY;
+                break;
+        case NL80211_AUTHTYPE_FT:
+                auth_alg = WLAN_AUTH_FT;
+                break;
+        case NL80211_AUTHTYPE_NETWORK_EAP:
+                auth_alg = WLAN_AUTH_LEAP;
+                break;
+        default:
+                return -EOPNOTSUPP;
+        }
 
-        ifmgd = &sdata->u.mgd;
+        wk = kzalloc(sizeof(*wk) + req->ie_len, GFP_KERNEL);
+        if (!wk)
+                return -ENOMEM;
 
-        if (ifmgd->ssid_len != len || memcmp(ifmgd->ssid, ssid, len) != 0) {
-                if (ifmgd->state == IEEE80211_STA_MLME_ASSOCIATED)
-                        ieee80211_set_disassoc(sdata, true, true,
-                                               WLAN_REASON_DEAUTH_LEAVING);
+        wk->bss = (void *)req->bss;
 
-                /*
-                 * Do not use reassociation if SSID is changed (different ESS).
-                 */
-                ifmgd->flags &= ~IEEE80211_STA_PREV_BSSID_SET;
-                memset(ifmgd->ssid, 0, sizeof(ifmgd->ssid));
-                memcpy(ifmgd->ssid, ssid, len);
-                ifmgd->ssid_len = len;
+        if (req->ie && req->ie_len) {
+                memcpy(wk->ie, req->ie, req->ie_len);
+                wk->ie_len = req->ie_len;
         }
 
-        return ieee80211_sta_commit(sdata);
-}
+        if (req->key && req->key_len) {
+                wk->key_len = req->key_len;
+                wk->key_idx = req->key_idx;
+                memcpy(wk->key, req->key, req->key_len);
+        }
 
-int ieee80211_sta_get_ssid(struct ieee80211_sub_if_data *sdata, char *ssid, size_t *len)
-{
-        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
-        memcpy(ssid, ifmgd->ssid, ifmgd->ssid_len);
-        *len = ifmgd->ssid_len;
+        ssid = ieee80211_bss_get_ie(req->bss, WLAN_EID_SSID);
+        memcpy(wk->ssid, ssid + 2, ssid[1]);
+        wk->ssid_len = ssid[1];
+
+        wk->state = IEEE80211_MGD_STATE_PROBE;
+        wk->auth_alg = auth_alg;
+
+        /*
+         * XXX: if still associated need to tell AP that we're going
+         *      to sleep and then change channel etc.
+         */
+        sdata->local->oper_channel = req->bss->channel;
+        ieee80211_hw_config(sdata->local, 0);
+
+        mutex_lock(&ifmgd->mtx);
+        list_add(&wk->list, &sdata->u.mgd.work_list);
+        mutex_unlock(&ifmgd->mtx);
+
+        queue_work(sdata->local->hw.workqueue, &sdata->u.mgd.work);
         return 0;
 }
 
-int ieee80211_sta_set_bssid(struct ieee80211_sub_if_data *sdata, u8 *bssid)
+int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
+                        struct cfg80211_assoc_request *req)
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+        struct ieee80211_mgd_work *wk, *found = NULL;
+        int i, err;
 
-        if (compare_ether_addr(bssid, ifmgd->bssid) != 0 &&
-            ifmgd->state == IEEE80211_STA_MLME_ASSOCIATED)
-                ieee80211_set_disassoc(sdata, true, true,
-                                       WLAN_REASON_DEAUTH_LEAVING);
+        mutex_lock(&ifmgd->mtx);
 
-        if (is_valid_ether_addr(bssid)) {
-                memcpy(ifmgd->bssid, bssid, ETH_ALEN);
-                ifmgd->flags |= IEEE80211_STA_BSSID_SET;
-        } else {
-                memset(ifmgd->bssid, 0, ETH_ALEN);
-                ifmgd->flags &= ~IEEE80211_STA_BSSID_SET;
+        list_for_each_entry(wk, &ifmgd->work_list, list) {
+                if (&wk->bss->cbss == req->bss &&
+                    wk->state == IEEE80211_MGD_STATE_IDLE) {
+                        found = wk;
+                        break;
+                }
         }
 
-        return ieee80211_sta_commit(sdata);
-}
+        if (!found) {
+                err = -ENOLINK;
+                goto out;
+        }
 
-int ieee80211_sta_set_extra_ie(struct ieee80211_sub_if_data *sdata,
-                               const char *ie, size_t len)
-{
-        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+        list_del(&found->list);
+
+        wk = krealloc(found, sizeof(*wk) + req->ie_len, GFP_KERNEL);
+        if (!wk) {
+                list_add(&found->list, &ifmgd->work_list);
+                err = -ENOMEM;
+                goto out;
+        }
 
-        if (len == 0 && ifmgd->extra_ie_len == 0)
-                return -EALREADY;
+        list_add(&wk->list, &ifmgd->work_list);
 
-        if (len == ifmgd->extra_ie_len && ifmgd->extra_ie &&
-            memcmp(ifmgd->extra_ie, ie, len) == 0)
-                return -EALREADY;
+        ifmgd->flags &= ~IEEE80211_STA_DISABLE_11N;
 
-        kfree(ifmgd->extra_ie);
-        if (len == 0) {
-                ifmgd->extra_ie = NULL;
-                ifmgd->extra_ie_len = 0;
-                return 0;
-        }
-        ifmgd->extra_ie = kmalloc(len, GFP_KERNEL);
-        if (!ifmgd->extra_ie) {
-                ifmgd->extra_ie_len = 0;
-                return -ENOMEM;
+        for (i = 0; i < req->crypto.n_ciphers_pairwise; i++)
+                if (req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_WEP40 ||
+                    req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_TKIP ||
+                    req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_WEP104)
+                        ifmgd->flags |= IEEE80211_STA_DISABLE_11N;
+
+        sdata->local->oper_channel = req->bss->channel;
+        ieee80211_hw_config(sdata->local, 0);
+
+        if (req->ie && req->ie_len) {
+                memcpy(wk->ie, req->ie, req->ie_len);
+                wk->ie_len = req->ie_len;
+        } else
+                wk->ie_len = 0;
+
+        if (req->prev_bssid)
+                memcpy(wk->prev_bssid, req->prev_bssid, ETH_ALEN);
+
+        wk->state = IEEE80211_MGD_STATE_ASSOC;
+        wk->tries = 0;
+
+        if (req->use_mfp) {
+                ifmgd->mfp = IEEE80211_MFP_REQUIRED;
+                ifmgd->flags |= IEEE80211_STA_MFP_ENABLED;
+        } else {
+                ifmgd->mfp = IEEE80211_MFP_DISABLED;
+                ifmgd->flags &= ~IEEE80211_STA_MFP_ENABLED;
         }
-        memcpy(ifmgd->extra_ie, ie, len);
-        ifmgd->extra_ie_len = len;
-        return 0;
-}
 
-int ieee80211_sta_deauthenticate(struct ieee80211_sub_if_data *sdata, u16 reason)
-{
-        printk(KERN_DEBUG "%s: deauthenticating by local choice (reason=%d)\n",
-               sdata->dev->name, reason);
+        if (req->crypto.control_port)
+                ifmgd->flags |= IEEE80211_STA_CONTROL_PORT;
+        else
+                ifmgd->flags &= ~IEEE80211_STA_CONTROL_PORT;
 
-        ieee80211_set_disassoc(sdata, true, true, reason);
-        return 0;
+        queue_work(sdata->local->hw.workqueue, &sdata->u.mgd.work);
+
+        err = 0;
+
+ out:
+        mutex_unlock(&ifmgd->mtx);
+        return err;
 }
 
-int ieee80211_sta_disassociate(struct ieee80211_sub_if_data *sdata, u16 reason)
+int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
+                         struct cfg80211_deauth_request *req,
+                         void *cookie)
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+        struct ieee80211_mgd_work *wk;
+        const u8 *bssid = NULL;
 
-        printk(KERN_DEBUG "%s: disassociating by local choice (reason=%d)\n",
-               sdata->dev->name, reason);
+        printk(KERN_DEBUG "%s: deauthenticating by local choice (reason=%d)\n",
+               sdata->dev->name, req->reason_code);
+
+        mutex_lock(&ifmgd->mtx);
+
+        if (ifmgd->associated && &ifmgd->associated->cbss == req->bss) {
+                bssid = req->bss->bssid;
+                ieee80211_set_disassoc(sdata);
+        } else list_for_each_entry(wk, &ifmgd->work_list, list) {
+                if (&wk->bss->cbss == req->bss) {
+                        bssid = req->bss->bssid;
+                        list_del(&wk->list);
+                        kfree(wk);
+                        break;
+                }
+        }
 
-        if (!(ifmgd->flags & IEEE80211_STA_ASSOCIATED))
+        /* cfg80211 should catch this... */
+        if (WARN_ON(!bssid)) {
+                mutex_unlock(&ifmgd->mtx);
                 return -ENOLINK;
+        }
+
+        mutex_unlock(&ifmgd->mtx);
+
+        ieee80211_send_deauth_disassoc(sdata, bssid,
+                        IEEE80211_STYPE_DEAUTH, req->reason_code,
+                        cookie);
 
-        ieee80211_set_disassoc(sdata, false, true, reason);
         return 0;
 }
 
-/* scan finished notification */
-void ieee80211_mlme_notify_scan_completed(struct ieee80211_local *local)
+int ieee80211_mgd_disassoc(struct ieee80211_sub_if_data *sdata,
+                           struct cfg80211_disassoc_request *req,
+                           void *cookie)
 {
-        struct ieee80211_sub_if_data *sdata = local->scan_sdata;
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 
-        /* Restart STA timers */
-        rcu_read_lock();
-        list_for_each_entry_rcu(sdata, &local->interfaces, list)
-                ieee80211_restart_sta_timer(sdata);
-        rcu_read_unlock();
-}
+        printk(KERN_DEBUG "%s: disassociating by local choice (reason=%d)\n",
+               sdata->dev->name, req->reason_code);
 
-int ieee80211_max_network_latency(struct notifier_block *nb,
-                                  unsigned long data, void *dummy)
-{
-        s32 latency_usec = (s32) data;
-        struct ieee80211_local *local =
-                container_of(nb, struct ieee80211_local,
-                             network_latency_notifier);
+        mutex_lock(&ifmgd->mtx);
 
-        mutex_lock(&local->iflist_mtx);
-        ieee80211_recalc_ps(local, latency_usec);
-        mutex_unlock(&local->iflist_mtx);
+        /* cfg80211 should catch that */
+        if (WARN_ON(&ifmgd->associated->cbss != req->bss)) {
+                mutex_unlock(&ifmgd->mtx);
+                return -ENOLINK;
+        }
+
+        ieee80211_set_disassoc(sdata);
+
+        mutex_unlock(&ifmgd->mtx);
 
+        ieee80211_send_deauth_disassoc(sdata, req->bss->bssid,
+                        IEEE80211_STYPE_DISASSOC, req->reason_code,
+                        cookie);
         return 0;
 }
diff --git a/net/mac80211/rate.c b/net/mac80211/rate.c
index 4641f00a1e5c..b33efc4fc267 100644
--- a/net/mac80211/rate.c
+++ b/net/mac80211/rate.c
@@ -198,6 +198,35 @@ static void rate_control_release(struct kref *kref)
         kfree(ctrl_ref);
 }
 
+static bool rc_no_data_or_no_ack(struct ieee80211_tx_rate_control *txrc)
+{
+        struct sk_buff *skb = txrc->skb;
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+        __le16 fc;
+
+        fc = hdr->frame_control;
+
+        return ((info->flags & IEEE80211_TX_CTL_NO_ACK) || !ieee80211_is_data(fc));
+}
+
+bool rate_control_send_low(struct ieee80211_sta *sta,
+                           void *priv_sta,
+                           struct ieee80211_tx_rate_control *txrc)
+{
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(txrc->skb);
+
+        if (!sta || !priv_sta || rc_no_data_or_no_ack(txrc)) {
+                info->control.rates[0].idx = rate_lowest_index(txrc->sband, sta);
+                info->control.rates[0].count =
+                        (info->flags & IEEE80211_TX_CTL_NO_ACK) ?
+                        1 : txrc->hw->max_rate_tries;
+                return true;
+        }
+        return false;
+}
+EXPORT_SYMBOL(rate_control_send_low);
+
 void rate_control_get_rate(struct ieee80211_sub_if_data *sdata,
                            struct sta_info *sta,
                            struct ieee80211_tx_rate_control *txrc)
@@ -258,7 +287,7 @@ int ieee80211_init_rate_ctrl_alg(struct ieee80211_local *local,
         struct rate_control_ref *ref, *old;
 
         ASSERT_RTNL();
-        if (local->open_count || netif_running(local->mdev))
+        if (local->open_count)
                 return -EBUSY;
 
         ref = rate_control_alloc(name, local);
diff --git a/net/mac80211/rc80211_minstrel.c b/net/mac80211/rc80211_minstrel.c
index 37771abd8f5a..7c5142988bbb 100644
--- a/net/mac80211/rc80211_minstrel.c
+++ b/net/mac80211/rc80211_minstrel.c
@@ -70,20 +70,6 @@ rix_to_ndx(struct minstrel_sta_info *mi, int rix)
         return i;
 }
 
-static inline bool
-use_low_rate(struct sk_buff *skb)
-{
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
-        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-        u16 fc;
-
-        fc = le16_to_cpu(hdr->frame_control);
-
-        return ((info->flags & IEEE80211_TX_CTL_NO_ACK) ||
-                (fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA);
-}
-
-
 static void
 minstrel_update_stats(struct minstrel_priv *mp, struct minstrel_sta_info *mi)
 {
@@ -232,7 +218,6 @@ minstrel_get_rate(void *priv, struct ieee80211_sta *sta,
                   void *priv_sta, struct ieee80211_tx_rate_control *txrc)
 {
         struct sk_buff *skb = txrc->skb;
-        struct ieee80211_supported_band *sband = txrc->sband;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         struct minstrel_sta_info *mi = priv_sta;
         struct minstrel_priv *mp = priv;
@@ -245,14 +230,8 @@ minstrel_get_rate(void *priv, struct ieee80211_sta *sta,
         int mrr_ndx[3];
         int sample_rate;
 
-        if (!sta || !mi || use_low_rate(skb)) {
-                ar[0].idx = rate_lowest_index(sband, sta);
-                if (info->flags & IEEE80211_TX_CTL_NO_ACK)
-                        ar[0].count = 1;
-                else
-                        ar[0].count = mp->max_retry;
+        if (rate_control_send_low(sta, priv_sta, txrc))
                 return;
-        }
 
         mrr = mp->has_mrr && !txrc->rts && !txrc->bss_conf->use_cts_prot;
 
diff --git a/net/mac80211/rc80211_pid_algo.c b/net/mac80211/rc80211_pid_algo.c
index a0bef767ceb5..8c053be9dc24 100644
--- a/net/mac80211/rc80211_pid_algo.c
+++ b/net/mac80211/rc80211_pid_algo.c
@@ -276,11 +276,9 @@ rate_control_pid_get_rate(void *priv, struct ieee80211_sta *sta,
 {
         struct sk_buff *skb = txrc->skb;
         struct ieee80211_supported_band *sband = txrc->sband;
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         struct rc_pid_sta_info *spinfo = priv_sta;
         int rateidx;
-        u16 fc;
 
         if (txrc->rts)
                 info->control.rates[0].count =
@@ -290,16 +288,8 @@ rate_control_pid_get_rate(void *priv, struct ieee80211_sta *sta,
                         txrc->hw->conf.short_frame_max_tx_count;
 
         /* Send management frames and NO_ACK data using lowest rate. */
-        fc = le16_to_cpu(hdr->frame_control);
-        if (!sta || !spinfo ||
-            (fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA ||
-            info->flags & IEEE80211_TX_CTL_NO_ACK) {
-                info->control.rates[0].idx = rate_lowest_index(sband, sta);
-                if (info->flags & IEEE80211_TX_CTL_NO_ACK)
-                        info->control.rates[0].count = 1;
-
+        if (rate_control_send_low(sta, priv_sta, txrc))
                 return;
-        }
 
         rateidx = spinfo->txrate_idx;
 
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 0936fc24942d..b6ddde3848fb 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -30,7 +30,6 @@
 static u8 ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
                                            struct tid_ampdu_rx *tid_agg_rx,
                                            struct sk_buff *skb,
-                                           struct ieee80211_rx_status *status,
                                            u16 mpdu_seq_num,
                                            int bar_req);
 /*
@@ -59,11 +58,11 @@ static struct sk_buff *remove_monitor_info(struct ieee80211_local *local,
         return skb;
 }
 
-static inline int should_drop_frame(struct ieee80211_rx_status *status,
-                                    struct sk_buff *skb,
+static inline int should_drop_frame(struct sk_buff *skb,
                                     int present_fcs_len,
                                     int radiotap_len)
 {
+        struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
 
         if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
@@ -111,10 +110,10 @@ ieee80211_rx_radiotap_len(struct ieee80211_local *local,
 static void
 ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
                                  struct sk_buff *skb,
-                                 struct ieee80211_rx_status *status,
                                  struct ieee80211_rate *rate,
                                  int rtap_len)
 {
+        struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
         struct ieee80211_radiotap_header *rthdr;
         unsigned char *pos;
 
@@ -220,9 +219,9 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
  */
 static struct sk_buff *
 ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
-                     struct ieee80211_rx_status *status,
                      struct ieee80211_rate *rate)
 {
+        struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(origskb);
         struct ieee80211_sub_if_data *sdata;
         int needed_headroom = 0;
         struct sk_buff *skb, *skb2;
@@ -248,8 +247,7 @@ ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
                 present_fcs_len = FCS_LEN;
 
         if (!local->monitors) {
-                if (should_drop_frame(status, origskb, present_fcs_len,
-                                      rtap_len)) {
+                if (should_drop_frame(origskb, present_fcs_len, rtap_len)) {
                         dev_kfree_skb(origskb);
                         return NULL;
                 }
@@ -257,7 +255,7 @@ ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
                 return remove_monitor_info(local, origskb, rtap_len);
         }
 
-        if (should_drop_frame(status, origskb, present_fcs_len, rtap_len)) {
+        if (should_drop_frame(origskb, present_fcs_len, rtap_len)) {
                 /* only need to expand headroom if necessary */
                 skb = origskb;
                 origskb = NULL;
@@ -289,7 +287,7 @@ ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
 
         /* if necessary, prepend radiotap information */
         if (!(status->flag & RX_FLAG_RADIOTAP))
-                ieee80211_add_rx_radiotap_header(local, skb, status, rate,
+                ieee80211_add_rx_radiotap_header(local, skb, rate,
                                                  needed_headroom);
 
         skb_reset_mac_header(skb);
@@ -421,12 +419,11 @@ ieee80211_rx_h_passive_scan(struct ieee80211_rx_data *rx)
         struct sk_buff *skb = rx->skb;
 
         if (unlikely(local->hw_scanning))
-                return ieee80211_scan_rx(rx->sdata, skb, rx->status);
+                return ieee80211_scan_rx(rx->sdata, skb);
 
         if (unlikely(local->sw_scanning)) {
                 /* drop all the other packets during a software scan anyway */
-                if (ieee80211_scan_rx(rx->sdata, skb, rx->status)
-                    != RX_QUEUED)
+                if (ieee80211_scan_rx(rx->sdata, skb) != RX_QUEUED)
                         dev_kfree_skb(skb);
                 return RX_QUEUED;
         }
@@ -836,28 +833,22 @@ ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
         if (!sta)
                 return RX_CONTINUE;
 
-        /* Update last_rx only for IBSS packets which are for the current
-         * BSSID to avoid keeping the current IBSS network alive in cases where
-         * other STAs are using different BSSID. */
+        /*
+         * Update last_rx only for IBSS packets which are for the current
+         * BSSID to avoid keeping the current IBSS network alive in cases
+         * where other STAs start using different BSSID.
+         */
         if (rx->sdata->vif.type == NL80211_IFTYPE_ADHOC) {
                 u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len,
                                                 NL80211_IFTYPE_ADHOC);
                 if (compare_ether_addr(bssid, rx->sdata->u.ibss.bssid) == 0)
                         sta->last_rx = jiffies;
-        } else
-        if (!is_multicast_ether_addr(hdr->addr1) ||
-            rx->sdata->vif.type == NL80211_IFTYPE_STATION) {
-                /* Update last_rx only for unicast frames in order to prevent
-                 * the Probe Request frames (the only broadcast frames from a
-                 * STA in infrastructure mode) from keeping a connection alive.
+        } else if (!is_multicast_ether_addr(hdr->addr1)) {
+                /*
                  * Mesh beacons will update last_rx when if they are found to
                  * match the current local configuration when processed.
                  */
-                if (rx->sdata->vif.type == NL80211_IFTYPE_STATION &&
-                    ieee80211_is_beacon(hdr->frame_control)) {
-                        rx->sdata->u.mgd.last_beacon = jiffies;
-                } else
-                        sta->last_rx = jiffies;
+                sta->last_rx = jiffies;
         }
 
         if (!(rx->flags & IEEE80211_RX_RA_MATCH))
@@ -1487,10 +1478,13 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
         struct ieee80211s_hdr *mesh_hdr;
         unsigned int hdrlen;
         struct sk_buff *skb = rx->skb, *fwd_skb;
+        struct ieee80211_local *local = rx->local;
+        struct ieee80211_sub_if_data *sdata;
 
         hdr = (struct ieee80211_hdr *) skb->data;
         hdrlen = ieee80211_hdrlen(hdr->frame_control);
         mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
+        sdata = IEEE80211_DEV_TO_SUB_IF(rx->dev);
 
         if (!ieee80211_is_data(hdr->frame_control))
                 return RX_CONTINUE;
@@ -1500,10 +1494,8 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
                 return RX_DROP_MONITOR;
 
         if (mesh_hdr->flags & MESH_FLAGS_AE_A5_A6){
-                struct ieee80211_sub_if_data *sdata;
                 struct mesh_path *mppath;
 
-                sdata = IEEE80211_DEV_TO_SUB_IF(rx->dev);
                 rcu_read_lock();
                 mppath = mpp_path_lookup(mesh_hdr->eaddr2, sdata);
                 if (!mppath) {
@@ -1529,6 +1521,8 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
                                                      dropped_frames_ttl);
                 else {
                         struct ieee80211_hdr *fwd_hdr;
+                        struct ieee80211_tx_info *info;
+
                         fwd_skb = skb_copy(skb, GFP_ATOMIC);
 
                         if (!fwd_skb && net_ratelimit())
@@ -1542,9 +1536,25 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
                          */
                         memcpy(fwd_hdr->addr1, fwd_hdr->addr2, ETH_ALEN);
                         memcpy(fwd_hdr->addr2, rx->dev->dev_addr, ETH_ALEN);
-                        fwd_skb->dev = rx->local->mdev;
+                        info = IEEE80211_SKB_CB(fwd_skb);
+                        memset(info, 0, sizeof(*info));
+                        info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
                         fwd_skb->iif = rx->dev->ifindex;
-                        dev_queue_xmit(fwd_skb);
+                        ieee80211_select_queue(local, fwd_skb);
+                        if (is_multicast_ether_addr(fwd_hdr->addr3))
+                                memcpy(fwd_hdr->addr1, fwd_hdr->addr3,
+                                                ETH_ALEN);
+                        else {
+                                int err = mesh_nexthop_lookup(fwd_skb, sdata);
+                                /* Failed to immediately resolve next hop:
+                                 * fwded frame was dropped or will be added
+                                 * later to the pending skb queue.  */
+                                if (err)
+                                        return RX_DROP_MONITOR;
+                        }
+                        IEEE80211_IFSTA_MESH_CTR_INC(&sdata->u.mesh,
+                                                     fwded_frames);
+                        ieee80211_add_pending_skb(local, fwd_skb);
                 }
         }
 
@@ -1620,7 +1630,7 @@ ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx)
                 /* manage reordering buffer according to requested */
                 /* sequence number */
                 rcu_read_lock();
-                ieee80211_sta_manage_reorder_buf(hw, tid_agg_rx, NULL, NULL,
+                ieee80211_sta_manage_reorder_buf(hw, tid_agg_rx, NULL,
                                                  start_seq_num, 1);
                 rcu_read_unlock();
                 return RX_DROP_UNUSABLE;
@@ -1644,12 +1654,7 @@ static void ieee80211_process_sa_query_req(struct ieee80211_sub_if_data *sdata,
 
         if (compare_ether_addr(mgmt->sa, sdata->u.mgd.bssid) != 0 ||
             compare_ether_addr(mgmt->bssid, sdata->u.mgd.bssid) != 0) {
-                /* Not from the current AP. */
-                return;
-        }
-
-        if (sdata->u.mgd.state == IEEE80211_STA_MLME_ASSOCIATE) {
-                /* Association in progress; ignore SA Query */
+                /* Not from the current AP or not associated yet. */
                 return;
         }
 
@@ -1686,7 +1691,6 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
         struct ieee80211_local *local = rx->local;
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(rx->dev);
         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
-        struct ieee80211_bss *bss;
         int len = rx->skb->len;
 
         if (!ieee80211_is_action(mgmt->frame_control))
@@ -1764,17 +1768,7 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
                         if (memcmp(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN))
                                 return RX_DROP_MONITOR;
 
-                        bss = ieee80211_rx_bss_get(local, sdata->u.mgd.bssid,
-                                           local->hw.conf.channel->center_freq,
-                                           sdata->u.mgd.ssid,
-                                           sdata->u.mgd.ssid_len);
-                        if (!bss)
-                                return RX_DROP_MONITOR;
-
-                        ieee80211_sta_process_chanswitch(sdata,
-                                     &mgmt->u.action.u.chan_switch.sw_elem, bss);
-                        ieee80211_rx_bss_put(local, bss);
-                        break;
+                        return ieee80211_sta_rx_mgmt(sdata, rx->skb);
                 }
                 break;
         case WLAN_CATEGORY_SA_QUERY:
@@ -1817,19 +1811,18 @@ ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
                 return RX_DROP_MONITOR;
 
         if (ieee80211_vif_is_mesh(&sdata->vif))
-                return ieee80211_mesh_rx_mgmt(sdata, rx->skb, rx->status);
+                return ieee80211_mesh_rx_mgmt(sdata, rx->skb);
 
         if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
-                return ieee80211_ibss_rx_mgmt(sdata, rx->skb, rx->status);
+                return ieee80211_ibss_rx_mgmt(sdata, rx->skb);
 
         if (sdata->vif.type == NL80211_IFTYPE_STATION)
-                return ieee80211_sta_rx_mgmt(sdata, rx->skb, rx->status);
+                return ieee80211_sta_rx_mgmt(sdata, rx->skb);
 
         return RX_DROP_MONITOR;
 }
 
-static void ieee80211_rx_michael_mic_report(struct net_device *dev,
-                                            struct ieee80211_hdr *hdr,
+static void ieee80211_rx_michael_mic_report(struct ieee80211_hdr *hdr,
                                             struct ieee80211_rx_data *rx)
 {
         int keyidx;
@@ -1866,7 +1859,8 @@ static void ieee80211_rx_michael_mic_report(struct net_device *dev,
             !ieee80211_is_auth(hdr->frame_control))
                 goto ignore;
 
-        mac80211_ev_michael_mic_failure(rx->sdata, keyidx, hdr, NULL);
+        mac80211_ev_michael_mic_failure(rx->sdata, keyidx, hdr, NULL,
+                                        GFP_ATOMIC);
  ignore:
         dev_kfree_skb(rx->skb);
         rx->skb = NULL;
@@ -2028,13 +2022,8 @@ static int prepare_for_handlers(struct ieee80211_sub_if_data *sdata,
         case NL80211_IFTYPE_STATION:
                 if (!bssid)
                         return 0;
-                if (!ieee80211_bssid_match(bssid, sdata->u.mgd.bssid)) {
-                        if (!(rx->flags & IEEE80211_RX_IN_SCAN))
-                                return 0;
-                        rx->flags &= ~IEEE80211_RX_RA_MATCH;
-                } else if (!multicast &&
-                           compare_ether_addr(sdata->dev->dev_addr,
-                                              hdr->addr1) != 0) {
+                if (!multicast &&
+                    compare_ether_addr(sdata->dev->dev_addr, hdr->addr1) != 0) {
                         if (!(sdata->dev->flags & IFF_PROMISC))
                                 return 0;
                         rx->flags &= ~IEEE80211_RX_RA_MATCH;
@@ -2114,9 +2103,9 @@ static int prepare_for_handlers(struct ieee80211_sub_if_data *sdata,
  */
 static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
                                          struct sk_buff *skb,
-                                         struct ieee80211_rx_status *status,
                                          struct ieee80211_rate *rate)
 {
+        struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
         struct ieee80211_local *local = hw_to_local(hw);
         struct ieee80211_sub_if_data *sdata;
         struct ieee80211_hdr *hdr;
@@ -2143,7 +2132,7 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
         }
 
         if ((status->flag & RX_FLAG_MMIC_ERROR)) {
-                ieee80211_rx_michael_mic_report(local->mdev, hdr, &rx);
+                ieee80211_rx_michael_mic_report(hdr, &rx);
                 return;
         }
 
@@ -2227,20 +2216,21 @@ static void ieee80211_release_reorder_frame(struct ieee80211_hw *hw,
 {
         struct ieee80211_supported_band *sband;
         struct ieee80211_rate *rate;
-        struct ieee80211_rx_status status;
+        struct sk_buff *skb = tid_agg_rx->reorder_buf[index];
+        struct ieee80211_rx_status *status;
 
-        if (!tid_agg_rx->reorder_buf[index])
+        if (!skb)
                 goto no_frame;
 
+        status = IEEE80211_SKB_RXCB(skb);
+
         /* release the reordered frames to stack */
-        memcpy(&status, tid_agg_rx->reorder_buf[index]->cb, sizeof(status));
-        sband = hw->wiphy->bands[status.band];
-        if (status.flag & RX_FLAG_HT)
+        sband = hw->wiphy->bands[status->band];
+        if (status->flag & RX_FLAG_HT)
                 rate = sband->bitrates; /* TODO: HT rates */
         else
-                rate = &sband->bitrates[status.rate_idx];
-        __ieee80211_rx_handle_packet(hw, tid_agg_rx->reorder_buf[index],
-                                     &status, rate);
+                rate = &sband->bitrates[status->rate_idx];
+        __ieee80211_rx_handle_packet(hw, skb, rate);
         tid_agg_rx->stored_mpdu_num--;
         tid_agg_rx->reorder_buf[index] = NULL;
 
@@ -2265,7 +2255,6 @@ no_frame:
 static u8 ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
                                            struct tid_ampdu_rx *tid_agg_rx,
                                            struct sk_buff *skb,
-                                           struct ieee80211_rx_status *rxstatus,
                                            u16 mpdu_seq_num,
                                            int bar_req)
 {
@@ -2324,8 +2313,6 @@ static u8 ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
         /* put the frame in the reordering buffer */
         tid_agg_rx->reorder_buf[index] = skb;
         tid_agg_rx->reorder_time[index] = jiffies;
-        memcpy(tid_agg_rx->reorder_buf[index]->cb, rxstatus,
-               sizeof(*rxstatus));
         tid_agg_rx->stored_mpdu_num++;
         /* release the buffer until next missing frame */
         index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn)
@@ -2374,8 +2361,7 @@ static u8 ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
 }
 
 static u8 ieee80211_rx_reorder_ampdu(struct ieee80211_local *local,
-                                     struct sk_buff *skb,
-                                     struct ieee80211_rx_status *status)
+                                     struct sk_buff *skb)
 {
         struct ieee80211_hw *hw = &local->hw;
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
@@ -2424,7 +2410,7 @@ static u8 ieee80211_rx_reorder_ampdu(struct ieee80211_local *local,
 
         /* according to mpdu sequence number deal with reordering buffer */
         mpdu_seq_num = (sc & IEEE80211_SCTL_SEQ) >> 4;
-        ret = ieee80211_sta_manage_reorder_buf(hw, tid_agg_rx, skb, status,
+        ret = ieee80211_sta_manage_reorder_buf(hw, tid_agg_rx, skb,
                                                 mpdu_seq_num, 0);
  end_reorder:
         return ret;
@@ -2434,12 +2420,12 @@ static u8 ieee80211_rx_reorder_ampdu(struct ieee80211_local *local,
  * This is the receive path handler. It is called by a low level driver when an
  * 802.11 MPDU is received from the hardware.
  */
-void __ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb,
-                    struct ieee80211_rx_status *status)
+void __ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb)
 {
         struct ieee80211_local *local = hw_to_local(hw);
         struct ieee80211_rate *rate = NULL;
         struct ieee80211_supported_band *sband;
+        struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
 
         if (status->band < 0 ||
             status->band >= IEEE80211_NUM_BANDS) {
@@ -2494,7 +2480,7 @@ void __ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb,
          * if it was previously present.
          * Also, frames with less than 16 bytes are dropped.
          */
-        skb = ieee80211_rx_monitor(local, skb, status, rate);
+        skb = ieee80211_rx_monitor(local, skb, rate);
         if (!skb) {
                 rcu_read_unlock();
                 return;
@@ -2512,8 +2498,8 @@ void __ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb,
          * frames from other than operational channel), but that should not
          * happen in normal networks.
          */
-        if (!ieee80211_rx_reorder_ampdu(local, skb, status))
-                __ieee80211_rx_handle_packet(hw, skb, status, rate);
+        if (!ieee80211_rx_reorder_ampdu(local, skb))
+                __ieee80211_rx_handle_packet(hw, skb, rate);
 
         rcu_read_unlock();
 }
@@ -2521,16 +2507,12 @@ EXPORT_SYMBOL(__ieee80211_rx);
 
 /* This is a version of the rx handler that can be called from hard irq
  * context. Post the skb on the queue and schedule the tasklet */
-void ieee80211_rx_irqsafe(struct ieee80211_hw *hw, struct sk_buff *skb,
-                          struct ieee80211_rx_status *status)
+void ieee80211_rx_irqsafe(struct ieee80211_hw *hw, struct sk_buff *skb)
 {
         struct ieee80211_local *local = hw_to_local(hw);
 
         BUILD_BUG_ON(sizeof(struct ieee80211_rx_status) > sizeof(skb->cb));
 
-        skb->dev = local->mdev;
-        /* copy status into skb->cb for use by tasklet */
-        memcpy(skb->cb, status, sizeof(*status));
         skb->pkt_type = IEEE80211_RX_MSG;
         skb_queue_tail(&local->skb_queue, skb);
         tasklet_schedule(&local->tasklet);
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index 2a8d09ad17ff..74820656dc89 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -26,7 +26,7 @@
 
 #define IEEE80211_PROBE_DELAY (HZ / 33)
 #define IEEE80211_CHANNEL_TIME (HZ / 33)
-#define IEEE80211_PASSIVE_CHANNEL_TIME (HZ / 5)
+#define IEEE80211_PASSIVE_CHANNEL_TIME (HZ / 8)
 
 struct ieee80211_bss *
 ieee80211_rx_bss_get(struct ieee80211_local *local, u8 *bssid, int freq,
@@ -121,23 +121,10 @@ ieee80211_bss_info_update(struct ieee80211_local *local,
         return bss;
 }
 
-void ieee80211_rx_bss_remove(struct ieee80211_sub_if_data *sdata, u8 *bssid,
-                             int freq, u8 *ssid, u8 ssid_len)
-{
-        struct ieee80211_bss *bss;
-        struct ieee80211_local *local = sdata->local;
-
-        bss = ieee80211_rx_bss_get(local, bssid, freq, ssid, ssid_len);
-        if (bss) {
-                cfg80211_unlink_bss(local->hw.wiphy, (void *)bss);
-                ieee80211_rx_bss_put(local, bss);
-        }
-}
-
 ieee80211_rx_result
-ieee80211_scan_rx(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb,
-                  struct ieee80211_rx_status *rx_status)
+ieee80211_scan_rx(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb)
 {
+        struct ieee80211_rx_status *rx_status = IEEE80211_SKB_RXCB(skb);
         struct ieee80211_mgmt *mgmt;
         struct ieee80211_bss *bss;
         u8 *elements;
@@ -307,16 +294,13 @@ void ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted)
         if (was_hw_scan)
                 goto done;
 
-        netif_tx_lock_bh(local->mdev);
-        netif_addr_lock(local->mdev);
+        spin_lock_bh(&local->filter_lock);
         local->filter_flags &= ~FIF_BCN_PRBRESP_PROMISC;
         drv_configure_filter(local, FIF_BCN_PRBRESP_PROMISC,
                              &local->filter_flags,
-                             local->mdev->mc_count,
-                             local->mdev->mc_list);
-
-        netif_addr_unlock(local->mdev);
-        netif_tx_unlock_bh(local->mdev);
+                             local->mc_count,
+                             local->mc_list);
+        spin_unlock_bh(&local->filter_lock);
 
         drv_sw_scan_complete(local);
 
@@ -327,7 +311,7 @@ void ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted)
 
                 /* Tell AP we're back */
                 if (sdata->vif.type == NL80211_IFTYPE_STATION) {
-                        if (sdata->u.mgd.flags & IEEE80211_STA_ASSOCIATED) {
+                        if (sdata->u.mgd.associated) {
                                 ieee80211_scan_ps_disable(sdata);
                                 netif_tx_wake_all_queues(sdata->dev);
                         }
@@ -383,7 +367,7 @@ static int ieee80211_start_sw_scan(struct ieee80211_local *local)
                                 sdata, BSS_CHANGED_BEACON_ENABLED);
 
                 if (sdata->vif.type == NL80211_IFTYPE_STATION) {
-                        if (sdata->u.mgd.flags & IEEE80211_STA_ASSOCIATED) {
+                        if (sdata->u.mgd.associated) {
                                 netif_tx_stop_all_queues(sdata->dev);
                                 ieee80211_scan_ps_enable(sdata);
                         }
@@ -395,13 +379,13 @@ static int ieee80211_start_sw_scan(struct ieee80211_local *local)
         local->scan_state = SCAN_SET_CHANNEL;
         local->scan_channel_idx = 0;
 
-        netif_addr_lock_bh(local->mdev);
+        spin_lock_bh(&local->filter_lock);
         local->filter_flags |= FIF_BCN_PRBRESP_PROMISC;
         drv_configure_filter(local, FIF_BCN_PRBRESP_PROMISC,
                              &local->filter_flags,
-                             local->mdev->mc_count,
-                             local->mdev->mc_list);
-        netif_addr_unlock_bh(local->mdev);
+                             local->mc_count,
+                             local->mc_list);
+        spin_unlock_bh(&local->filter_lock);
 
         /* TODO: start scan as soon as all nullfunc frames are ACKed */
         queue_delayed_work(local->hw.workqueue, &local->scan_work,
@@ -443,10 +427,8 @@ static int __ieee80211_start_scan(struct ieee80211_sub_if_data *sdata,
 
         if (req != &local->int_scan_req &&
             sdata->vif.type == NL80211_IFTYPE_STATION &&
-            (ifmgd->state == IEEE80211_STA_MLME_DIRECT_PROBE ||
-             ifmgd->state == IEEE80211_STA_MLME_AUTHENTICATE ||
-             ifmgd->state == IEEE80211_STA_MLME_ASSOCIATE)) {
-                /* actually wait for the assoc to finish/time out */
+            !list_empty(&ifmgd->work_list)) {
+                /* actually wait for the work it's doing to finish/time out */
                 set_bit(IEEE80211_STA_REQ_SCAN, &ifmgd->request);
                 return 0;
         }
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index 49a1a1f76511..4ecf10a9bd00 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -308,6 +308,23 @@ struct sta_info {
                 struct dentry *inactive_ms;
                 struct dentry *last_seq_ctrl;
                 struct dentry *agg_status;
+                struct dentry *aid;
+                struct dentry *dev;
+                struct dentry *rx_packets;
+                struct dentry *tx_packets;
+                struct dentry *rx_bytes;
+                struct dentry *tx_bytes;
+                struct dentry *rx_duplicates;
+                struct dentry *rx_fragments;
+                struct dentry *rx_dropped;
+                struct dentry *tx_fragments;
+                struct dentry *tx_filtered;
+                struct dentry *tx_retry_failed;
+                struct dentry *tx_retry_count;
+                struct dentry *last_signal;
+                struct dentry *last_qual;
+                struct dentry *last_noise;
+                struct dentry *wep_weak_iv_count;
                 bool add_has_run;
         } debugfs;
 #endif
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 3a8922cd1038..2572509d5568 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -451,7 +451,7 @@ ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx)
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
 
-        if (unlikely(tx->skb->do_not_encrypt))
+        if (unlikely(info->flags & IEEE80211_TX_INTFL_DONT_ENCRYPT))
                 tx->key = NULL;
         else if (tx->sta && (key = rcu_dereference(tx->sta->key)))
                 tx->key = key;
@@ -497,7 +497,7 @@ ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx)
         }
 
         if (!tx->key || !(tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE))
-                tx->skb->do_not_encrypt = 1;
+                info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
 
         return TX_CONTINUE;
 }
@@ -512,6 +512,7 @@ ieee80211_tx_h_rate_ctrl(struct ieee80211_tx_data *tx)
         int i, len;
         bool inval = false, rts = false, short_preamble = false;
         struct ieee80211_tx_rate_control txrc;
+        u32 sta_flags;
 
         memset(&txrc, 0, sizeof(txrc));
 
@@ -544,7 +545,26 @@ ieee80211_tx_h_rate_ctrl(struct ieee80211_tx_data *tx)
              (tx->sta && test_sta_flags(tx->sta, WLAN_STA_SHORT_PREAMBLE))))
                 txrc.short_preamble = short_preamble = true;
 
+        sta_flags = tx->sta ? get_sta_flags(tx->sta) : 0;
+
+        /*
+         * Lets not bother rate control if we're associated and cannot
+         * talk to the sta. This should not happen.
+         */
+        if (WARN((tx->local->sw_scanning) &&
+                 (sta_flags & WLAN_STA_ASSOC) &&
+                 !rate_usable_index_exists(sband, &tx->sta->sta),
+                 "%s: Dropped data frame as no usable bitrate found while "
+                 "scanning and associated. Target station: "
+                 "%pM on %d GHz band\n",
+                 tx->dev->name, hdr->addr1,
+                 tx->channel->band ? 5 : 2))
+                return TX_DROP;
 
+        /*
+         * If we're associated with the sta at this point we know we can at
+         * least send the frame at the lowest bit rate.
+         */
         rate_control_get_rate(tx->sdata, tx->sta, &txrc);
 
         if (unlikely(info->control.rates[0].idx < 0))
@@ -754,9 +774,7 @@ static int ieee80211_fragment(struct ieee80211_local *local,
                 memcpy(tmp->cb, skb->cb, sizeof(tmp->cb));
                 skb_copy_queue_mapping(tmp, skb);
                 tmp->priority = skb->priority;
-                tmp->do_not_encrypt = skb->do_not_encrypt;
                 tmp->dev = skb->dev;
-                tmp->iif = skb->iif;
 
                 /* copy header and data */
                 memcpy(skb_put(tmp, hdrlen), skb->data, hdrlen);
@@ -784,7 +802,7 @@ ieee80211_tx_h_fragment(struct ieee80211_tx_data *tx)
 
         /*
          * Warn when submitting a fragmented A-MPDU frame and drop it.
-         * This scenario is handled in __ieee80211_tx_prepare but extra
+         * This scenario is handled in ieee80211_tx_prepare but extra
          * caution taken here as fragmented ampdu may cause Tx stop.
          */
         if (WARN_ON(info->flags & IEEE80211_TX_CTL_AMPDU))
@@ -923,11 +941,12 @@ static bool __ieee80211_parse_tx_radiotap(struct ieee80211_tx_data *tx,
         struct ieee80211_radiotap_header *rthdr =
                 (struct ieee80211_radiotap_header *) skb->data;
         struct ieee80211_supported_band *sband;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         int ret = ieee80211_radiotap_iterator_init(&iterator, rthdr, skb->len);
 
         sband = tx->local->hw.wiphy->bands[tx->channel->band];
 
-        skb->do_not_encrypt = 1;
+        info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
         tx->flags &= ~IEEE80211_TX_FRAGMENTED;
 
         /*
@@ -965,7 +984,7 @@ static bool __ieee80211_parse_tx_radiotap(struct ieee80211_tx_data *tx,
                                 skb_trim(skb, skb->len - FCS_LEN);
                         }
                         if (*iterator.this_arg & IEEE80211_RADIOTAP_F_WEP)
-                                tx->skb->do_not_encrypt = 0;
+                                info->flags &= ~IEEE80211_TX_INTFL_DONT_ENCRYPT;
                         if (*iterator.this_arg & IEEE80211_RADIOTAP_F_FRAG)
                                 tx->flags |= IEEE80211_TX_FRAGMENTED;
                         break;
@@ -998,13 +1017,12 @@ static bool __ieee80211_parse_tx_radiotap(struct ieee80211_tx_data *tx,
  * initialises @tx
  */
 static ieee80211_tx_result
-__ieee80211_tx_prepare(struct ieee80211_tx_data *tx,
-                       struct sk_buff *skb,
-                       struct net_device *dev)
+ieee80211_tx_prepare(struct ieee80211_sub_if_data *sdata,
+                     struct ieee80211_tx_data *tx,
+                     struct sk_buff *skb)
 {
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+        struct ieee80211_local *local = sdata->local;
         struct ieee80211_hdr *hdr;
-        struct ieee80211_sub_if_data *sdata;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         int hdrlen, tid;
         u8 *qc, *state;
@@ -1012,9 +1030,9 @@ __ieee80211_tx_prepare(struct ieee80211_tx_data *tx,
 
         memset(tx, 0, sizeof(*tx));
         tx->skb = skb;
-        tx->dev = dev; /* use original interface */
+        tx->dev = sdata->dev; /* use original interface */
         tx->local = local;
-        tx->sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        tx->sdata = sdata;
         tx->channel = local->hw.conf.channel;
         /*
          * Set this flag (used below to indicate "automatic fragmentation"),
@@ -1023,7 +1041,6 @@ __ieee80211_tx_prepare(struct ieee80211_tx_data *tx,
         tx->flags |= IEEE80211_TX_FRAGMENTED;
 
         /* process and remove the injection radiotap header */
-        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         if (unlikely(info->flags & IEEE80211_TX_CTL_INJECTED)) {
                 if (!__ieee80211_parse_tx_radiotap(tx, skb))
                         return TX_DROP;
@@ -1119,50 +1136,28 @@ __ieee80211_tx_prepare(struct ieee80211_tx_data *tx,
         return TX_CONTINUE;
 }
 
-/*
- * NB: @tx is uninitialised when passed in here
- */
-static int ieee80211_tx_prepare(struct ieee80211_local *local,
-                                struct ieee80211_tx_data *tx,
-                                struct sk_buff *skb)
-{
-        struct net_device *dev;
-
-        dev = dev_get_by_index(&init_net, skb->iif);
-        if (unlikely(dev && !is_ieee80211_device(local, dev))) {
-                dev_put(dev);
-                dev = NULL;
-        }
-        if (unlikely(!dev))
-                return -ENODEV;
-        /*
-         * initialises tx with control
-         *
-         * return value is safe to ignore here because this function
-         * can only be invoked for multicast frames
-         *
-         * XXX: clean up
-         */
-        __ieee80211_tx_prepare(tx, skb, dev);
-        dev_put(dev);
-        return 0;
-}
-
 static int __ieee80211_tx(struct ieee80211_local *local,
                           struct sk_buff **skbp,
-                          struct sta_info *sta)
+                          struct sta_info *sta,
+                          bool txpending)
 {
         struct sk_buff *skb = *skbp, *next;
         struct ieee80211_tx_info *info;
+        unsigned long flags;
         int ret, len;
         bool fragm = false;
 
-        local->mdev->trans_start = jiffies;
-
         while (skb) {
-                if (ieee80211_queue_stopped(&local->hw,
-                                            skb_get_queue_mapping(skb)))
-                        return IEEE80211_TX_PENDING;
+                int q = skb_get_queue_mapping(skb);
+
+                spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
+                ret = IEEE80211_TX_OK;
+                if (local->queue_stop_reasons[q] ||
+                    (!txpending && !skb_queue_empty(&local->pending[q])))
+                        ret = IEEE80211_TX_PENDING;
+                spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
+                if (ret != IEEE80211_TX_OK)
+                        return ret;
 
                 info = IEEE80211_SKB_CB(skb);
 
@@ -1234,10 +1229,10 @@ static int invoke_tx_handlers(struct ieee80211_tx_data *tx)
         return 0;
 }
 
-static void ieee80211_tx(struct net_device *dev, struct sk_buff *skb,
-                         bool txpending)
+static void ieee80211_tx(struct ieee80211_sub_if_data *sdata,
+                         struct sk_buff *skb, bool txpending)
 {
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+        struct ieee80211_local *local = sdata->local;
         struct ieee80211_tx_data tx;
         ieee80211_tx_result res_prepare;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
@@ -1248,8 +1243,6 @@ static void ieee80211_tx(struct net_device *dev, struct sk_buff *skb,
 
         queue = skb_get_queue_mapping(skb);
 
-        WARN_ON(!txpending && !skb_queue_empty(&local->pending[queue]));
-
         if (unlikely(skb->len < 10)) {
                 dev_kfree_skb(skb);
                 return;
@@ -1258,7 +1251,7 @@ static void ieee80211_tx(struct net_device *dev, struct sk_buff *skb,
         rcu_read_lock();
 
         /* initialises tx */
-        res_prepare = __ieee80211_tx_prepare(&tx, skb, dev);
+        res_prepare = ieee80211_tx_prepare(sdata, &tx, skb);
 
         if (unlikely(res_prepare == TX_DROP)) {
                 dev_kfree_skb(skb);
@@ -1277,7 +1270,7 @@ static void ieee80211_tx(struct net_device *dev, struct sk_buff *skb,
 
         retries = 0;
  retry:
-        ret = __ieee80211_tx(local, &tx.skb, tx.sta);
+        ret = __ieee80211_tx(local, &tx.skb, tx.sta, txpending);
         switch (ret) {
         case IEEE80211_TX_OK:
                 break;
@@ -1295,34 +1288,35 @@ static void ieee80211_tx(struct net_device *dev, struct sk_buff *skb,
 
                 spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
 
-                if (__netif_subqueue_stopped(local->mdev, queue)) {
+                if (local->queue_stop_reasons[queue] ||
+                    !skb_queue_empty(&local->pending[queue])) {
+                        /*
+                         * if queue is stopped, queue up frames for later
+                         * transmission from the tasklet
+                         */
                         do {
                                 next = skb->next;
                                 skb->next = NULL;
                                 if (unlikely(txpending))
-                                        skb_queue_head(&local->pending[queue],
-                                                       skb);
+                                        __skb_queue_head(&local->pending[queue],
+                                                         skb);
                                 else
-                                        skb_queue_tail(&local->pending[queue],
-                                                       skb);
+                                        __skb_queue_tail(&local->pending[queue],
+                                                         skb);
                         } while ((skb = next));
 
-                        /*
-                         * Make sure nobody will enable the queue on us
-                         * (without going through the tasklet) nor disable the
-                         * netdev queue underneath the pending handling code.
-                         */
-                        __set_bit(IEEE80211_QUEUE_STOP_REASON_PENDING,
-                                  &local->queue_stop_reasons[queue]);
-
                         spin_unlock_irqrestore(&local->queue_stop_reason_lock,
                                                flags);
                 } else {
+                        /*
+                         * otherwise retry, but this is a race condition or
+                         * a driver bug (which we warn about if it persists)
+                         */
                         spin_unlock_irqrestore(&local->queue_stop_reason_lock,
                                                flags);
 
                         retries++;
-                        if (WARN(retries > 10, "tx refused but queue active"))
+                        if (WARN(retries > 10, "tx refused but queue active\n"))
                                 goto drop;
                         goto retry;
                 }
@@ -1383,14 +1377,13 @@ static int ieee80211_skb_resize(struct ieee80211_local *local,
         return 0;
 }
 
-int ieee80211_master_start_xmit(struct sk_buff *skb, struct net_device *dev)
+static void ieee80211_xmit(struct ieee80211_sub_if_data *sdata,
+                           struct sk_buff *skb)
 {
-        struct ieee80211_master_priv *mpriv = netdev_priv(dev);
-        struct ieee80211_local *local = mpriv->local;
+        struct ieee80211_local *local = sdata->local;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
-        struct net_device *odev = NULL;
-        struct ieee80211_sub_if_data *osdata;
+        struct ieee80211_sub_if_data *tmp_sdata;
         int headroom;
         bool may_encrypt;
         enum {
@@ -1399,20 +1392,7 @@ int ieee80211_master_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 UNKNOWN_ADDRESS,
         } monitor_iface = NOT_MONITOR;
 
-        if (skb->iif)
-                odev = dev_get_by_index(&init_net, skb->iif);
-        if (unlikely(odev && !is_ieee80211_device(local, odev))) {
-                dev_put(odev);
-                odev = NULL;
-        }
-        if (unlikely(!odev)) {
-#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
-                printk(KERN_DEBUG "%s: Discarded packet with nonexistent "
-                       "originating device\n", dev->name);
-#endif
-                dev_kfree_skb(skb);
-                return NETDEV_TX_OK;
-        }
+        dev_hold(sdata->dev);
 
         if ((local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK) &&
             local->hw.conf.dynamic_ps_timeout > 0 &&
@@ -1428,26 +1408,18 @@ int ieee80211_master_start_xmit(struct sk_buff *skb, struct net_device *dev)
                         msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout));
         }
 
-        memset(info, 0, sizeof(*info));
-
         info->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
 
-        osdata = IEEE80211_DEV_TO_SUB_IF(odev);
-
-        if (ieee80211_vif_is_mesh(&osdata->vif) &&
+        if (ieee80211_vif_is_mesh(&sdata->vif) &&
             ieee80211_is_data(hdr->frame_control)) {
                 if (is_multicast_ether_addr(hdr->addr3))
                         memcpy(hdr->addr1, hdr->addr3, ETH_ALEN);
                 else
-                        if (mesh_nexthop_lookup(skb, osdata)) {
-                                dev_put(odev);
-                                return NETDEV_TX_OK;
+                        if (mesh_nexthop_lookup(skb, sdata)) {
+                                dev_put(sdata->dev);
+                                return;
                         }
-                if (memcmp(odev->dev_addr, hdr->addr4, ETH_ALEN) != 0)
-                        IEEE80211_IFSTA_MESH_CTR_INC(&osdata->u.mesh,
-                                                            fwded_frames);
-        } else if (unlikely(osdata->vif.type == NL80211_IFTYPE_MONITOR)) {
-                struct ieee80211_sub_if_data *sdata;
+        } else if (unlikely(sdata->vif.type == NL80211_IFTYPE_MONITOR)) {
                 int hdrlen;
                 u16 len_rthdr;
 
@@ -1471,19 +1443,17 @@ int ieee80211_master_start_xmit(struct sk_buff *skb, struct net_device *dev)
                          */
 
                         rcu_read_lock();
-                        list_for_each_entry_rcu(sdata, &local->interfaces,
+                        list_for_each_entry_rcu(tmp_sdata, &local->interfaces,
                                                 list) {
-                                if (!netif_running(sdata->dev))
+                                if (!netif_running(tmp_sdata->dev))
                                         continue;
-                                if (sdata->vif.type != NL80211_IFTYPE_AP)
+                                if (tmp_sdata->vif.type != NL80211_IFTYPE_AP)
                                         continue;
-                                if (compare_ether_addr(sdata->dev->dev_addr,
+                                if (compare_ether_addr(tmp_sdata->dev->dev_addr,
                                                        hdr->addr2)) {
-                                        dev_hold(sdata->dev);
-                                        dev_put(odev);
-                                        osdata = sdata;
-                                        odev = osdata->dev;
-                                        skb->iif = sdata->dev->ifindex;
+                                        dev_hold(tmp_sdata->dev);
+                                        dev_put(sdata->dev);
+                                        sdata = tmp_sdata;
                                         monitor_iface = FOUND_SDATA;
                                         break;
                                 }
@@ -1492,31 +1462,31 @@ int ieee80211_master_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 }
         }
 
-        may_encrypt = !skb->do_not_encrypt;
+        may_encrypt = !(info->flags & IEEE80211_TX_INTFL_DONT_ENCRYPT);
 
-        headroom = osdata->local->tx_headroom;
+        headroom = local->tx_headroom;
         if (may_encrypt)
                 headroom += IEEE80211_ENCRYPT_HEADROOM;
         headroom -= skb_headroom(skb);
         headroom = max_t(int, 0, headroom);
 
-        if (ieee80211_skb_resize(osdata->local, skb, headroom, may_encrypt)) {
+        if (ieee80211_skb_resize(local, skb, headroom, may_encrypt)) {
                 dev_kfree_skb(skb);
-                dev_put(odev);
-                return NETDEV_TX_OK;
+                dev_put(sdata->dev);
+                return;
         }
 
-        if (osdata->vif.type == NL80211_IFTYPE_AP_VLAN)
-                osdata = container_of(osdata->bss,
-                                      struct ieee80211_sub_if_data,
-                                      u.ap);
+        tmp_sdata = sdata;
+        if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
+                tmp_sdata = container_of(sdata->bss,
+                                         struct ieee80211_sub_if_data,
+                                         u.ap);
         if (likely(monitor_iface != UNKNOWN_ADDRESS))
-                info->control.vif = &osdata->vif;
-
-        ieee80211_tx(odev, skb, false);
-        dev_put(odev);
+                info->control.vif = &tmp_sdata->vif;
 
-        return NETDEV_TX_OK;
+        ieee80211_select_queue(local, skb);
+        ieee80211_tx(sdata, skb, false);
+        dev_put(sdata->dev);
 }
 
 int ieee80211_monitor_start_xmit(struct sk_buff *skb,
@@ -1526,6 +1496,7 @@ int ieee80211_monitor_start_xmit(struct sk_buff *skb,
         struct ieee80211_channel *chan = local->hw.conf.channel;
         struct ieee80211_radiotap_header *prthdr =
                 (struct ieee80211_radiotap_header *)skb->data;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         u16 len_rthdr;
 
         /*
@@ -1563,15 +1534,9 @@ int ieee80211_monitor_start_xmit(struct sk_buff *skb,
         if (unlikely(skb->len < len_rthdr))
                 goto fail; /* skb too short for claimed rt header extent */
 
-        skb->dev = local->mdev;
-
         /* needed because we set skb device to master */
         skb->iif = dev->ifindex;
 
-        /* sometimes we do encrypt injected frames, will be fixed
-         * up in radiotap parser if not wanted */
-        skb->do_not_encrypt = 0;
-
         /*
          * fix up the pointers accounting for the radiotap
          * header still being in there.  We are being given
@@ -1586,8 +1551,10 @@ int ieee80211_monitor_start_xmit(struct sk_buff *skb,
         skb_set_network_header(skb, len_rthdr);
         skb_set_transport_header(skb, len_rthdr);
 
-        /* pass the radiotap header up to the next stage intact */
-        dev_queue_xmit(skb);
+        memset(info, 0, sizeof(*info));
+
+        /* pass the radiotap header up to xmit */
+        ieee80211_xmit(IEEE80211_DEV_TO_SUB_IF(dev), skb);
         return NETDEV_TX_OK;
 
 fail:
@@ -1615,6 +1582,7 @@ int ieee80211_subif_start_xmit(struct sk_buff *skb,
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         struct ieee80211_local *local = sdata->local;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         int ret = NETDEV_TX_BUSY, head_need;
         u16 ethertype, hdrlen,  meshhdrlen = 0;
         __le16 fc;
@@ -1627,7 +1595,7 @@ int ieee80211_subif_start_xmit(struct sk_buff *skb,
         u32 sta_flags = 0;
 
         if (unlikely(skb->len < ETH_HLEN)) {
-                ret = 0;
+                ret = NETDEV_TX_OK;
                 goto fail;
         }
 
@@ -1664,7 +1632,7 @@ int ieee80211_subif_start_xmit(struct sk_buff *skb,
                 if (!sdata->u.mesh.mshcfg.dot11MeshTTL) {
                         /* Do not send frames with mesh_ttl == 0 */
                         sdata->u.mesh.mshstats.dropped_frames_ttl++;
-                        ret = 0;
+                        ret = NETDEV_TX_OK;
                         goto fail;
                 }
                 memset(&mesh_hdr, 0, sizeof(mesh_hdr));
@@ -1724,7 +1692,7 @@ int ieee80211_subif_start_xmit(struct sk_buff *skb,
                 hdrlen = 24;
                 break;
         default:
-                ret = 0;
+                ret = NETDEV_TX_OK;
                 goto fail;
         }
 
@@ -1766,7 +1734,7 @@ int ieee80211_subif_start_xmit(struct sk_buff *skb,
 
                 I802_DEBUG_INC(local->tx_handlers_drop_unauth_port);
 
-                ret = 0;
+                ret = NETDEV_TX_OK;
                 goto fail;
         }
 
@@ -1844,7 +1812,6 @@ int ieee80211_subif_start_xmit(struct sk_buff *skb,
 
         skb->iif = dev->ifindex;
 
-        skb->dev = local->mdev;
         dev->stats.tx_packets++;
         dev->stats.tx_bytes += skb->len;
 
@@ -1855,13 +1822,15 @@ int ieee80211_subif_start_xmit(struct sk_buff *skb,
         skb_set_network_header(skb, nh_pos);
         skb_set_transport_header(skb, h_pos);
 
+        memset(info, 0, sizeof(*info));
+
         dev->trans_start = jiffies;
-        dev_queue_xmit(skb);
+        ieee80211_xmit(sdata, skb);
 
-        return 0;
+        return NETDEV_TX_OK;
 
  fail:
-        if (!ret)
+        if (ret == NETDEV_TX_OK)
                 dev_kfree_skb(skb);
 
         return ret;
@@ -1898,7 +1867,6 @@ static bool ieee80211_tx_pending_skb(struct ieee80211_local *local,
                 return true;
         }
 
-        /* validate info->control.vif against skb->iif */
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
                 sdata = container_of(sdata->bss,
@@ -1912,12 +1880,13 @@ static bool ieee80211_tx_pending_skb(struct ieee80211_local *local,
         }
 
         if (info->flags & IEEE80211_TX_INTFL_NEED_TXPROCESSING) {
-                ieee80211_tx(dev, skb, true);
+                /* do not use sdata, it may have been changed above */
+                ieee80211_tx(IEEE80211_DEV_TO_SUB_IF(dev), skb, true);
         } else {
                 hdr = (struct ieee80211_hdr *)skb->data;
                 sta = sta_info_get(local, hdr->addr1);
 
-                ret = __ieee80211_tx(local, &skb, sta);
+                ret = __ieee80211_tx(local, &skb, sta, true);
                 if (ret != IEEE80211_TX_OK)
                         result = false;
         }
@@ -1929,59 +1898,43 @@ static bool ieee80211_tx_pending_skb(struct ieee80211_local *local,
 }
 
 /*
- * Transmit all pending packets. Called from tasklet, locks master device
- * TX lock so that no new packets can come in.
+ * Transmit all pending packets. Called from tasklet.
  */
 void ieee80211_tx_pending(unsigned long data)
 {
         struct ieee80211_local *local = (struct ieee80211_local *)data;
-        struct net_device *dev = local->mdev;
         unsigned long flags;
         int i;
-        bool next;
+        bool txok;
 
         rcu_read_lock();
-        netif_tx_lock_bh(dev);
 
+        spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
         for (i = 0; i < local->hw.queues; i++) {
                 /*
                  * If queue is stopped by something other than due to pending
                  * frames, or we have no pending frames, proceed to next queue.
                  */
-                spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
-                next = false;
-                if (local->queue_stop_reasons[i] !=
-                        BIT(IEEE80211_QUEUE_STOP_REASON_PENDING) ||
+                if (local->queue_stop_reasons[i] ||
                     skb_queue_empty(&local->pending[i]))
-                        next = true;
-                spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
-
-                if (next)
                         continue;
 
-                /*
-                 * start the queue now to allow processing our packets,
-                 * we're under the tx lock here anyway so nothing will
-                 * happen as a result of this
-                 */
-                netif_start_subqueue(local->mdev, i);
-
                 while (!skb_queue_empty(&local->pending[i])) {
-                        struct sk_buff *skb = skb_dequeue(&local->pending[i]);
-
-                        if (!ieee80211_tx_pending_skb(local, skb)) {
-                                skb_queue_head(&local->pending[i], skb);
+                        struct sk_buff *skb = __skb_dequeue(&local->pending[i]);
+                        spin_unlock_irqrestore(&local->queue_stop_reason_lock,
+                                                flags);
+
+                        txok = ieee80211_tx_pending_skb(local, skb);
+                        if (!txok)
+                                __skb_queue_head(&local->pending[i], skb);
+                        spin_lock_irqsave(&local->queue_stop_reason_lock,
+                                          flags);
+                        if (!txok)
                                 break;
-                        }
                 }
-
-                /* Start regular packet processing again. */
-                if (skb_queue_empty(&local->pending[i]))
-                        ieee80211_wake_queue_by_reason(&local->hw, i,
-                                        IEEE80211_QUEUE_STOP_REASON_PENDING);
         }
+        spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
 
-        netif_tx_unlock_bh(dev);
         rcu_read_unlock();
 }
 
@@ -2156,8 +2109,7 @@ struct sk_buff *ieee80211_beacon_get(struct ieee80211_hw *hw,
 
         info = IEEE80211_SKB_CB(skb);
 
-        skb->do_not_encrypt = 1;
-
+        info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
         info->band = band;
         /*
          * XXX: For now, always use the lowest rate
@@ -2228,9 +2180,6 @@ ieee80211_get_buffered_bc(struct ieee80211_hw *hw,
         sdata = vif_to_sdata(vif);
         bss = &sdata->u.ap;
 
-        if (!bss)
-                return NULL;
-
         rcu_read_lock();
         beacon = rcu_dereference(bss->beacon);
 
@@ -2256,7 +2205,7 @@ ieee80211_get_buffered_bc(struct ieee80211_hw *hw,
                                 cpu_to_le16(IEEE80211_FCTL_MOREDATA);
                 }
 
-                if (!ieee80211_tx_prepare(local, &tx, skb))
+                if (!ieee80211_tx_prepare(sdata, &tx, skb))
                         break;
                 dev_kfree_skb_any(skb);
         }
@@ -2276,3 +2225,25 @@ ieee80211_get_buffered_bc(struct ieee80211_hw *hw,
         return skb;
 }
 EXPORT_SYMBOL(ieee80211_get_buffered_bc);
+
+void ieee80211_tx_skb(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb,
+                      int encrypt)
+{
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+        skb_set_mac_header(skb, 0);
+        skb_set_network_header(skb, 0);
+        skb_set_transport_header(skb, 0);
+
+        skb->iif = sdata->dev->ifindex;
+        if (!encrypt)
+                info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
+
+        /*
+         * The other path calling ieee80211_xmit is from the tasklet,
+         * and while we can handle concurrent transmissions locking
+         * requirements are that we do not come into tx with bhs on.
+         */
+        local_bh_disable();
+        ieee80211_xmit(sdata, skb);
+        local_bh_enable();
+}
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 915e77769312..7fc55846d601 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -31,6 +31,7 @@
 #include "mesh.h"
 #include "wme.h"
 #include "led.h"
+#include "wep.h"
 
 /* privid for wiphys to determine whether they belong to us or not */
 void *mac80211_wiphy_privid = &mac80211_wiphy_privid;
@@ -274,16 +275,12 @@ static void __ieee80211_wake_queue(struct ieee80211_hw *hw, int queue,
 
         __clear_bit(reason, &local->queue_stop_reasons[queue]);
 
-        if (!skb_queue_empty(&local->pending[queue]) &&
-            local->queue_stop_reasons[queue] ==
-                                BIT(IEEE80211_QUEUE_STOP_REASON_PENDING))
-                tasklet_schedule(&local->tx_pending_tasklet);
-
         if (local->queue_stop_reasons[queue] != 0)
                 /* someone still has this queue stopped */
                 return;
 
-        netif_wake_subqueue(local->mdev, queue);
+        if (!skb_queue_empty(&local->pending[queue]))
+                tasklet_schedule(&local->tx_pending_tasklet);
 }
 
 void ieee80211_wake_queue_by_reason(struct ieee80211_hw *hw, int queue,
@@ -312,14 +309,6 @@ static void __ieee80211_stop_queue(struct ieee80211_hw *hw, int queue,
         if (WARN_ON(queue >= hw->queues))
                 return;
 
-        /*
-         * Only stop if it was previously running, this is necessary
-         * for correct pending packets handling because there we may
-         * start (but not wake) the queue and rely on that.
-         */
-        if (!local->queue_stop_reasons[queue])
-                netif_stop_subqueue(local->mdev, queue);
-
         __set_bit(reason, &local->queue_stop_reasons[queue]);
 }
 
@@ -350,8 +339,7 @@ void ieee80211_add_pending_skb(struct ieee80211_local *local,
 
         spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
         __ieee80211_stop_queue(hw, queue, IEEE80211_QUEUE_STOP_REASON_SKB_ADD);
-        __ieee80211_stop_queue(hw, queue, IEEE80211_QUEUE_STOP_REASON_PENDING);
-        skb_queue_tail(&local->pending[queue], skb);
+        __skb_queue_tail(&local->pending[queue], skb);
         __ieee80211_wake_queue(hw, queue, IEEE80211_QUEUE_STOP_REASON_SKB_ADD);
         spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
 }
@@ -372,16 +360,12 @@ int ieee80211_add_pending_skbs(struct ieee80211_local *local,
         while ((skb = skb_dequeue(skbs))) {
                 ret++;
                 queue = skb_get_queue_mapping(skb);
-                skb_queue_tail(&local->pending[queue], skb);
+                __skb_queue_tail(&local->pending[queue], skb);
         }
 
-        for (i = 0; i < hw->queues; i++) {
-                if (ret)
-                        __ieee80211_stop_queue(hw, i,
-                                IEEE80211_QUEUE_STOP_REASON_PENDING);
+        for (i = 0; i < hw->queues; i++)
                 __ieee80211_wake_queue(hw, i,
                         IEEE80211_QUEUE_STOP_REASON_SKB_ADD);
-        }
         spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
 
         return ret;
@@ -412,11 +396,16 @@ EXPORT_SYMBOL(ieee80211_stop_queues);
 int ieee80211_queue_stopped(struct ieee80211_hw *hw, int queue)
 {
         struct ieee80211_local *local = hw_to_local(hw);
+        unsigned long flags;
+        int ret;
 
         if (WARN_ON(queue >= hw->queues))
                 return true;
 
-        return __netif_subqueue_stopped(local->mdev, queue);
+        spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
+        ret = !!local->queue_stop_reasons[queue];
+        spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
+        return ret;
 }
 EXPORT_SYMBOL(ieee80211_queue_stopped);
 
@@ -760,20 +749,6 @@ void ieee80211_sta_def_wmm_params(struct ieee80211_sub_if_data *sdata,
         ieee80211_set_wmm_default(sdata);
 }
 
-void ieee80211_tx_skb(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb,
-                      int encrypt)
-{
-        skb->dev = sdata->local->mdev;
-        skb_set_mac_header(skb, 0);
-        skb_set_network_header(skb, 0);
-        skb_set_transport_header(skb, 0);
-
-        skb->iif = sdata->dev->ifindex;
-        skb->do_not_encrypt = !encrypt;
-
-        dev_queue_xmit(skb);
-}
-
 u32 ieee80211_mandatory_rates(struct ieee80211_local *local,
                               enum ieee80211_band band)
 {
@@ -804,12 +779,13 @@ u32 ieee80211_mandatory_rates(struct ieee80211_local *local,
 
 void ieee80211_send_auth(struct ieee80211_sub_if_data *sdata,
                          u16 transaction, u16 auth_alg,
-                         u8 *extra, size_t extra_len,
-                         const u8 *bssid, int encrypt)
+                         u8 *extra, size_t extra_len, const u8 *bssid,
+                         const u8 *key, u8 key_len, u8 key_idx)
 {
         struct ieee80211_local *local = sdata->local;
         struct sk_buff *skb;
         struct ieee80211_mgmt *mgmt;
+        int err;
 
         skb = dev_alloc_skb(local->hw.extra_tx_headroom +
                             sizeof(*mgmt) + 6 + extra_len);
@@ -824,8 +800,6 @@ void ieee80211_send_auth(struct ieee80211_sub_if_data *sdata,
         memset(mgmt, 0, 24 + 6);
         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
                                           IEEE80211_STYPE_AUTH);
-        if (encrypt)
-                mgmt->frame_control |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
         memcpy(mgmt->da, bssid, ETH_ALEN);
         memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
         memcpy(mgmt->bssid, bssid, ETH_ALEN);
@@ -835,7 +809,13 @@ void ieee80211_send_auth(struct ieee80211_sub_if_data *sdata,
         if (extra)
                 memcpy(skb_put(skb, extra_len), extra, extra_len);
 
-        ieee80211_tx_skb(sdata, skb, encrypt);
+        if (auth_alg == WLAN_AUTH_SHARED_KEY && transaction == 3) {
+                mgmt->frame_control |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
+                err = ieee80211_wep_encrypt(local, skb, key, key_len, key_idx);
+                WARN_ON(err);
+        }
+
+        ieee80211_tx_skb(sdata, skb, 0);
 }
 
 int ieee80211_build_preq_ies(struct ieee80211_local *local, u8 *buffer,
@@ -1043,9 +1023,9 @@ int ieee80211_reconfig(struct ieee80211_local *local)
         /* reconfigure hardware */
         ieee80211_hw_config(local, ~0);
 
-        netif_addr_lock_bh(local->mdev);
+        spin_lock_bh(&local->filter_lock);
         ieee80211_configure_filter(local);
-        netif_addr_unlock_bh(local->mdev);
+        spin_unlock_bh(&local->filter_lock);
 
         /* Finally also reconfigure all the BSS information */
         list_for_each_entry(sdata, &local->interfaces, list) {
diff --git a/net/mac80211/wep.c b/net/mac80211/wep.c
index ef73105b3061..8a980f136941 100644
--- a/net/mac80211/wep.c
+++ b/net/mac80211/wep.c
@@ -67,10 +67,10 @@ static inline bool ieee80211_wep_weak_iv(u32 iv, int keylen)
 
 
 static void ieee80211_wep_get_iv(struct ieee80211_local *local,
-                                 struct ieee80211_key *key, u8 *iv)
+                                 int keylen, int keyidx, u8 *iv)
 {
         local->wep_iv++;
-        if (ieee80211_wep_weak_iv(local->wep_iv, key->conf.keylen))
+        if (ieee80211_wep_weak_iv(local->wep_iv, keylen))
                 local->wep_iv += 0x0100;
 
         if (!iv)
@@ -79,13 +79,13 @@ static void ieee80211_wep_get_iv(struct ieee80211_local *local,
         *iv++ = (local->wep_iv >> 16) & 0xff;
         *iv++ = (local->wep_iv >> 8) & 0xff;
         *iv++ = local->wep_iv & 0xff;
-        *iv++ = key->conf.keyidx << 6;
+        *iv++ = keyidx << 6;
 }
 
 
 static u8 *ieee80211_wep_add_iv(struct ieee80211_local *local,
                                 struct sk_buff *skb,
-                                struct ieee80211_key *key)
+                                int keylen, int keyidx)
 {
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
         unsigned int hdrlen;
@@ -100,7 +100,7 @@ static u8 *ieee80211_wep_add_iv(struct ieee80211_local *local,
         hdrlen = ieee80211_hdrlen(hdr->frame_control);
         newhdr = skb_push(skb, WEP_IV_LEN);
         memmove(newhdr, newhdr + WEP_IV_LEN, hdrlen);
-        ieee80211_wep_get_iv(local, key, newhdr + hdrlen);
+        ieee80211_wep_get_iv(local, keylen, keyidx, newhdr + hdrlen);
         return newhdr + hdrlen;
 }
 
@@ -144,26 +144,17 @@ void ieee80211_wep_encrypt_data(struct crypto_blkcipher *tfm, u8 *rc4key,
  *
  * WEP frame payload: IV + TX key idx, RC4(data), ICV = RC4(CRC32(data))
  */
-int ieee80211_wep_encrypt(struct ieee80211_local *local, struct sk_buff *skb,
-                          struct ieee80211_key *key)
+int ieee80211_wep_encrypt(struct ieee80211_local *local,
+                          struct sk_buff *skb,
+                          const u8 *key, int keylen, int keyidx)
 {
-        u32 klen;
-        u8 *rc4key, *iv;
+        u8 *iv;
         size_t len;
+        u8 rc4key[3 + WLAN_KEY_LEN_WEP104];
 
-        if (!key || key->conf.alg != ALG_WEP)
-                return -1;
-
-        klen = 3 + key->conf.keylen;
-        rc4key = kmalloc(klen, GFP_ATOMIC);
-        if (!rc4key)
-                return -1;
-
-        iv = ieee80211_wep_add_iv(local, skb, key);
-        if (!iv) {
-                kfree(rc4key);
+        iv = ieee80211_wep_add_iv(local, skb, keylen, keyidx);
+        if (!iv)
                 return -1;
-        }
 
         len = skb->len - (iv + WEP_IV_LEN - skb->data);
 
@@ -171,16 +162,14 @@ int ieee80211_wep_encrypt(struct ieee80211_local *local, struct sk_buff *skb,
         memcpy(rc4key, iv, 3);
 
         /* Copy rest of the WEP key (the secret part) */
-        memcpy(rc4key + 3, key->conf.key, key->conf.keylen);
+        memcpy(rc4key + 3, key, keylen);
 
         /* Add room for ICV */
         skb_put(skb, WEP_ICV_LEN);
 
-        ieee80211_wep_encrypt_data(local->wep_tx_tfm, rc4key, klen,
+        ieee80211_wep_encrypt_data(local->wep_tx_tfm, rc4key, keylen + 3,
                                    iv + WEP_IV_LEN, len);
 
-        kfree(rc4key);
-
         return 0;
 }
 
@@ -216,8 +205,9 @@ int ieee80211_wep_decrypt_data(struct crypto_blkcipher *tfm, u8 *rc4key,
  * failure. If frame is OK, IV and ICV will be removed, i.e., decrypted payload
  * is moved to the beginning of the skb and skb length will be reduced.
  */
-int ieee80211_wep_decrypt(struct ieee80211_local *local, struct sk_buff *skb,
-                          struct ieee80211_key *key)
+static int ieee80211_wep_decrypt(struct ieee80211_local *local,
+                                 struct sk_buff *skb,
+                                 struct ieee80211_key *key)
 {
         u32 klen;
         u8 *rc4key;
@@ -314,12 +304,16 @@ static int wep_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 
         if (!(tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE)) {
-                if (ieee80211_wep_encrypt(tx->local, skb, tx->key))
+                if (ieee80211_wep_encrypt(tx->local, skb, tx->key->conf.key,
+                                          tx->key->conf.keylen,
+                                          tx->key->conf.keyidx))
                         return -1;
         } else {
                 info->control.hw_key = &tx->key->conf;
                 if (tx->key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV) {
-                        if (!ieee80211_wep_add_iv(tx->local, skb, tx->key))
+                        if (!ieee80211_wep_add_iv(tx->local, skb,
+                                                  tx->key->conf.keylen,
+                                                  tx->key->conf.keyidx))
                                 return -1;
                 }
         }
diff --git a/net/mac80211/wep.h b/net/mac80211/wep.h
index d3f0db48314e..fe29d7e5759f 100644
--- a/net/mac80211/wep.h
+++ b/net/mac80211/wep.h
@@ -20,12 +20,11 @@ int ieee80211_wep_init(struct ieee80211_local *local);
 void ieee80211_wep_free(struct ieee80211_local *local);
 void ieee80211_wep_encrypt_data(struct crypto_blkcipher *tfm, u8 *rc4key,
                                 size_t klen, u8 *data, size_t data_len);
+int ieee80211_wep_encrypt(struct ieee80211_local *local,
+                          struct sk_buff *skb,
+                          const u8 *key, int keylen, int keyidx);
 int ieee80211_wep_decrypt_data(struct crypto_blkcipher *tfm, u8 *rc4key,
                                size_t klen, u8 *data, size_t data_len);
-int ieee80211_wep_encrypt(struct ieee80211_local *local, struct sk_buff *skb,
-                          struct ieee80211_key *key);
-int ieee80211_wep_decrypt(struct ieee80211_local *local, struct sk_buff *skb,
-                          struct ieee80211_key *key);
 bool ieee80211_wep_is_weak_iv(struct sk_buff *skb, struct ieee80211_key *key);
 
 ieee80211_rx_result
diff --git a/net/mac80211/wext.c b/net/mac80211/wext.c
index 1da81f456744..5acb8140ee58 100644
--- a/net/mac80211/wext.c
+++ b/net/mac80211/wext.c
@@ -27,29 +27,6 @@
 #include "aes_ccm.h"
 
 
-static int ieee80211_ioctl_siwgenie(struct net_device *dev,
-                                    struct iw_request_info *info,
-                                    struct iw_point *data, char *extra)
-{
-        struct ieee80211_sub_if_data *sdata;
-
-        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-
-        if (sdata->vif.type == NL80211_IFTYPE_STATION) {
-                int ret = ieee80211_sta_set_extra_ie(sdata, extra, data->length);
-                if (ret && ret != -EALREADY)
-                        return ret;
-                sdata->u.mgd.flags &= ~IEEE80211_STA_AUTO_BSSID_SEL;
-                sdata->u.mgd.flags &= ~IEEE80211_STA_EXT_SME;
-                sdata->u.mgd.flags &= ~IEEE80211_STA_CONTROL_PORT;
-                if (ret != -EALREADY)
-                        ieee80211_sta_req_auth(sdata);
-                return 0;
-        }
-
-        return -EOPNOTSUPP;
-}
-
 static int ieee80211_ioctl_siwfreq(struct net_device *dev,
                                    struct iw_request_info *info,
                                    struct iw_freq *freq, char *extra)
@@ -61,16 +38,13 @@ static int ieee80211_ioctl_siwfreq(struct net_device *dev,
         if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
                 return cfg80211_ibss_wext_siwfreq(dev, info, freq, extra);
         else if (sdata->vif.type == NL80211_IFTYPE_STATION)
-                sdata->u.mgd.flags &= ~IEEE80211_STA_AUTO_CHANNEL_SEL;
+                return cfg80211_mgd_wext_siwfreq(dev, info, freq, extra);
 
         /* freq->e == 0: freq->m = channel; otherwise freq = m * 10^e */
         if (freq->e == 0) {
-                if (freq->m < 0) {
-                        if (sdata->vif.type == NL80211_IFTYPE_STATION)
-                                sdata->u.mgd.flags |=
-                                        IEEE80211_STA_AUTO_CHANNEL_SEL;
-                        return 0;
-                } else
+                if (freq->m < 0)
+                        return -EINVAL;
+                else
                         chan = ieee80211_get_channel(local->hw.wiphy,
                                 ieee80211_channel_to_frequency(freq->m));
         } else {
@@ -95,9 +69,6 @@ static int ieee80211_ioctl_siwfreq(struct net_device *dev,
         if (local->oper_channel == chan)
                 return 0;
 
-        if (sdata->vif.type == NL80211_IFTYPE_STATION)
-                ieee80211_sta_req_auth(sdata);
-
         local->oper_channel = chan;
         local->oper_channel_type = NL80211_CHAN_NO_HT;
         ieee80211_hw_config(local, 0);
@@ -115,6 +86,8 @@ static int ieee80211_ioctl_giwfreq(struct net_device *dev,
 
         if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
                 return cfg80211_ibss_wext_giwfreq(dev, info, freq, extra);
+        else if (sdata->vif.type == NL80211_IFTYPE_STATION)
+                return cfg80211_mgd_wext_giwfreq(dev, info, freq, extra);
 
         freq->m = local->oper_channel->center_freq;
         freq->e = 6;
@@ -128,31 +101,11 @@ static int ieee80211_ioctl_siwessid(struct net_device *dev,
                                     struct iw_point *data, char *ssid)
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        size_t len = data->length;
-        int ret;
 
         if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
                 return cfg80211_ibss_wext_siwessid(dev, info, data, ssid);
-
-        /* iwconfig uses nul termination in SSID.. */
-        if (len > 0 && ssid[len - 1] == '\0')
-                len--;
-
-        if (sdata->vif.type == NL80211_IFTYPE_STATION) {
-                if (data->flags)
-                        sdata->u.mgd.flags &= ~IEEE80211_STA_AUTO_SSID_SEL;
-                else
-                        sdata->u.mgd.flags |= IEEE80211_STA_AUTO_SSID_SEL;
-
-                ret = ieee80211_sta_set_ssid(sdata, ssid, len);
-                if (ret)
-                        return ret;
-
-                sdata->u.mgd.flags &= ~IEEE80211_STA_EXT_SME;
-                sdata->u.mgd.flags &= ~IEEE80211_STA_CONTROL_PORT;
-                ieee80211_sta_req_auth(sdata);
-                return 0;
-        }
+        else if (sdata->vif.type == NL80211_IFTYPE_STATION)
+                return cfg80211_mgd_wext_siwessid(dev, info, data, ssid);
 
         return -EOPNOTSUPP;
 }
@@ -162,23 +115,14 @@ static int ieee80211_ioctl_giwessid(struct net_device *dev,
                                     struct iw_request_info *info,
                                     struct iw_point *data, char *ssid)
 {
-        size_t len;
         struct ieee80211_sub_if_data *sdata;
 
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
         if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
                 return cfg80211_ibss_wext_giwessid(dev, info, data, ssid);
-
-        if (sdata->vif.type == NL80211_IFTYPE_STATION) {
-                int res = ieee80211_sta_get_ssid(sdata, ssid, &len);
-                if (res == 0) {
-                        data->length = len;
-                        data->flags = 1;
-                } else
-                        data->flags = 0;
-                return res;
-        }
+        else if (sdata->vif.type == NL80211_IFTYPE_STATION)
+                return cfg80211_mgd_wext_giwessid(dev, info, data, ssid);
 
         return -EOPNOTSUPP;
 }
@@ -193,40 +137,11 @@ static int ieee80211_ioctl_siwap(struct net_device *dev,
         if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
                 return cfg80211_ibss_wext_siwap(dev, info, ap_addr, extra);
 
-        if (sdata->vif.type == NL80211_IFTYPE_STATION) {
-                int ret;
-
-                if (is_zero_ether_addr((u8 *) &ap_addr->sa_data))
-                        sdata->u.mgd.flags |= IEEE80211_STA_AUTO_BSSID_SEL |
-                                IEEE80211_STA_AUTO_CHANNEL_SEL;
-                else if (is_broadcast_ether_addr((u8 *) &ap_addr->sa_data))
-                        sdata->u.mgd.flags |= IEEE80211_STA_AUTO_BSSID_SEL;
-                else
-                        sdata->u.mgd.flags &= ~IEEE80211_STA_AUTO_BSSID_SEL;
-                ret = ieee80211_sta_set_bssid(sdata, (u8 *) &ap_addr->sa_data);
-                if (ret)
-                        return ret;
-                sdata->u.mgd.flags &= ~IEEE80211_STA_EXT_SME;
-                sdata->u.mgd.flags &= ~IEEE80211_STA_CONTROL_PORT;
-                ieee80211_sta_req_auth(sdata);
-                return 0;
-        } else if (sdata->vif.type == NL80211_IFTYPE_WDS) {
-                /*
-                 * If it is necessary to update the WDS peer address
-                 * while the interface is running, then we need to do
-                 * more work here, namely if it is running we need to
-                 * add a new and remove the old STA entry, this is
-                 * normally handled by _open() and _stop().
-                 */
-                if (netif_running(dev))
-                        return -EBUSY;
-
-                memcpy(&sdata->u.wds.remote_addr, (u8 *) &ap_addr->sa_data,
-                       ETH_ALEN);
-
-                return 0;
-        }
+        if (sdata->vif.type == NL80211_IFTYPE_STATION)
+                return cfg80211_mgd_wext_siwap(dev, info, ap_addr, extra);
 
+        if (sdata->vif.type == NL80211_IFTYPE_WDS)
+                return cfg80211_wds_wext_siwap(dev, info, ap_addr, extra);
         return -EOPNOTSUPP;
 }
 
@@ -240,326 +155,13 @@ static int ieee80211_ioctl_giwap(struct net_device *dev,
         if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
                 return cfg80211_ibss_wext_giwap(dev, info, ap_addr, extra);
 
-        if (sdata->vif.type == NL80211_IFTYPE_STATION) {
-                if (sdata->u.mgd.state == IEEE80211_STA_MLME_ASSOCIATED) {
-                        ap_addr->sa_family = ARPHRD_ETHER;
-                        memcpy(&ap_addr->sa_data, sdata->u.mgd.bssid, ETH_ALEN);
-                } else
-                        memset(&ap_addr->sa_data, 0, ETH_ALEN);
-                return 0;
-        } else if (sdata->vif.type == NL80211_IFTYPE_WDS) {
-                ap_addr->sa_family = ARPHRD_ETHER;
-                memcpy(&ap_addr->sa_data, sdata->u.wds.remote_addr, ETH_ALEN);
-                return 0;
-        }
-
-        return -EOPNOTSUPP;
-}
-
-
-static int ieee80211_ioctl_siwrate(struct net_device *dev,
-                                  struct iw_request_info *info,
-                                  struct iw_param *rate, char *extra)
-{
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        int i, err = -EINVAL;
-        u32 target_rate = rate->value / 100000;
-        struct ieee80211_sub_if_data *sdata;
-        struct ieee80211_supported_band *sband;
-
-        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-
-        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
-
-        /* target_rate = -1, rate->fixed = 0 means auto only, so use all rates
-         * target_rate = X, rate->fixed = 1 means only rate X
-         * target_rate = X, rate->fixed = 0 means all rates <= X */
-        sdata->max_ratectrl_rateidx = -1;
-        sdata->force_unicast_rateidx = -1;
-        if (rate->value < 0)
-                return 0;
-
-        for (i=0; i< sband->n_bitrates; i++) {
-                struct ieee80211_rate *brate = &sband->bitrates[i];
-                int this_rate = brate->bitrate;
-
-                if (target_rate == this_rate) {
-                        sdata->max_ratectrl_rateidx = i;
-                        if (rate->fixed)
-                                sdata->force_unicast_rateidx = i;
-                        err = 0;
-                        break;
-                }
-        }
-        return err;
-}
-
-static int ieee80211_ioctl_giwrate(struct net_device *dev,
-                                  struct iw_request_info *info,
-                                  struct iw_param *rate, char *extra)
-{
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        struct sta_info *sta;
-        struct ieee80211_sub_if_data *sdata;
-        struct ieee80211_supported_band *sband;
-
-        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-
-        if (sdata->vif.type != NL80211_IFTYPE_STATION)
-                return -EOPNOTSUPP;
-
-        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
-
-        rcu_read_lock();
-
-        sta = sta_info_get(local, sdata->u.mgd.bssid);
-
-        if (sta && !(sta->last_tx_rate.flags & IEEE80211_TX_RC_MCS))
-                rate->value = sband->bitrates[sta->last_tx_rate.idx].bitrate;
-        else
-                rate->value = 0;
-
-        rcu_read_unlock();
-
-        if (!sta)
-                return -ENODEV;
-
-        rate->value *= 100000;
-
-        return 0;
-}
-
-static int ieee80211_ioctl_siwpower(struct net_device *dev,
-                                    struct iw_request_info *info,
-                                    struct iw_param *wrq,
-                                    char *extra)
-{
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        struct ieee80211_conf *conf = &local->hw.conf;
-        int timeout = 0;
-        bool ps;
-
-        if (!(local->hw.flags & IEEE80211_HW_SUPPORTS_PS))
-                return -EOPNOTSUPP;
-
-        if (sdata->vif.type != NL80211_IFTYPE_STATION)
-                return -EINVAL;
-
-        if (wrq->disabled) {
-                ps = false;
-                timeout = 0;
-                goto set;
-        }
-
-        switch (wrq->flags & IW_POWER_MODE) {
-        case IW_POWER_ON:       /* If not specified */
-        case IW_POWER_MODE:     /* If set all mask */
-        case IW_POWER_ALL_R:    /* If explicitely state all */
-                ps = true;
-                break;
-        default:                /* Otherwise we ignore */
-                return -EINVAL;
-        }
-
-        if (wrq->flags & ~(IW_POWER_MODE | IW_POWER_TIMEOUT))
-                return -EINVAL;
-
-        if (wrq->flags & IW_POWER_TIMEOUT)
-                timeout = wrq->value / 1000;
-
- set:
-        if (ps == sdata->u.mgd.powersave && timeout == conf->dynamic_ps_timeout)
-                return 0;
-
-        sdata->u.mgd.powersave = ps;
-        conf->dynamic_ps_timeout = timeout;
-
-        if (local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_PS)
-                ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
-
-        ieee80211_recalc_ps(local, -1);
-
-        return 0;
-}
-
-static int ieee80211_ioctl_giwpower(struct net_device *dev,
-                                    struct iw_request_info *info,
-                                    union iwreq_data *wrqu,
-                                    char *extra)
-{
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-
-        wrqu->power.disabled = !sdata->u.mgd.powersave;
-
-        return 0;
-}
-
-static int ieee80211_ioctl_siwauth(struct net_device *dev,
-                                   struct iw_request_info *info,
-                                   struct iw_param *data, char *extra)
-{
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        int ret = 0;
-
-        switch (data->flags & IW_AUTH_INDEX) {
-        case IW_AUTH_WPA_VERSION:
-        case IW_AUTH_CIPHER_GROUP:
-        case IW_AUTH_WPA_ENABLED:
-        case IW_AUTH_RX_UNENCRYPTED_EAPOL:
-        case IW_AUTH_KEY_MGMT:
-        case IW_AUTH_CIPHER_GROUP_MGMT:
-                break;
-        case IW_AUTH_CIPHER_PAIRWISE:
-                if (sdata->vif.type == NL80211_IFTYPE_STATION) {
-                        if (data->value & (IW_AUTH_CIPHER_WEP40 |
-                            IW_AUTH_CIPHER_WEP104 | IW_AUTH_CIPHER_TKIP))
-                                sdata->u.mgd.flags |=
-                                        IEEE80211_STA_TKIP_WEP_USED;
-                        else
-                                sdata->u.mgd.flags &=
-                                        ~IEEE80211_STA_TKIP_WEP_USED;
-                }
-                break;
-        case IW_AUTH_DROP_UNENCRYPTED:
-                sdata->drop_unencrypted = !!data->value;
-                break;
-        case IW_AUTH_PRIVACY_INVOKED:
-                if (sdata->vif.type != NL80211_IFTYPE_STATION)
-                        ret = -EINVAL;
-                else {
-                        sdata->u.mgd.flags &= ~IEEE80211_STA_PRIVACY_INVOKED;
-                        /*
-                         * Privacy invoked by wpa_supplicant, store the
-                         * value and allow associating to a protected
-                         * network without having a key up front.
-                         */
-                        if (data->value)
-                                sdata->u.mgd.flags |=
-                                        IEEE80211_STA_PRIVACY_INVOKED;
-                }
-                break;
-        case IW_AUTH_80211_AUTH_ALG:
-                if (sdata->vif.type == NL80211_IFTYPE_STATION)
-                        sdata->u.mgd.auth_algs = data->value;
-                else
-                        ret = -EOPNOTSUPP;
-                break;
-        case IW_AUTH_MFP:
-                if (!(sdata->local->hw.flags & IEEE80211_HW_MFP_CAPABLE)) {
-                        ret = -EOPNOTSUPP;
-                        break;
-                }
-                if (sdata->vif.type == NL80211_IFTYPE_STATION) {
-                        switch (data->value) {
-                        case IW_AUTH_MFP_DISABLED:
-                                sdata->u.mgd.mfp = IEEE80211_MFP_DISABLED;
-                                break;
-                        case IW_AUTH_MFP_OPTIONAL:
-                                sdata->u.mgd.mfp = IEEE80211_MFP_OPTIONAL;
-                                break;
-                        case IW_AUTH_MFP_REQUIRED:
-                                sdata->u.mgd.mfp = IEEE80211_MFP_REQUIRED;
-                                break;
-                        default:
-                                ret = -EINVAL;
-                        }
-                } else
-                        ret = -EOPNOTSUPP;
-                break;
-        default:
-                ret = -EOPNOTSUPP;
-                break;
-        }
-        return ret;
-}
-
-/* Get wireless statistics.  Called by /proc/net/wireless and by SIOCGIWSTATS */
-static struct iw_statistics *ieee80211_get_wireless_stats(struct net_device *dev)
-{
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        struct iw_statistics *wstats = &local->wstats;
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        struct sta_info *sta = NULL;
-
-        rcu_read_lock();
-
         if (sdata->vif.type == NL80211_IFTYPE_STATION)
-                sta = sta_info_get(local, sdata->u.mgd.bssid);
-
-        if (!sta) {
-                wstats->discard.fragment = 0;
-                wstats->discard.misc = 0;
-                wstats->qual.qual = 0;
-                wstats->qual.level = 0;
-                wstats->qual.noise = 0;
-                wstats->qual.updated = IW_QUAL_ALL_INVALID;
-        } else {
-                wstats->qual.updated = 0;
-                /*
-                 * mirror what cfg80211 does for iwrange/scan results,
-                 * otherwise userspace gets confused.
-                 */
-                if (local->hw.flags & (IEEE80211_HW_SIGNAL_UNSPEC |
-                                       IEEE80211_HW_SIGNAL_DBM)) {
-                        wstats->qual.updated |= IW_QUAL_LEVEL_UPDATED;
-                        wstats->qual.updated |= IW_QUAL_QUAL_UPDATED;
-                } else {
-                        wstats->qual.updated |= IW_QUAL_LEVEL_INVALID;
-                        wstats->qual.updated |= IW_QUAL_QUAL_INVALID;
-                }
-
-                if (local->hw.flags & IEEE80211_HW_SIGNAL_UNSPEC) {
-                        wstats->qual.level = sta->last_signal;
-                        wstats->qual.qual = sta->last_signal;
-                } else if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM) {
-                        int sig = sta->last_signal;
-
-                        wstats->qual.updated |= IW_QUAL_DBM;
-                        wstats->qual.level = sig;
-                        if (sig < -110)
-                                sig = -110;
-                        else if (sig > -40)
-                                sig = -40;
-                        wstats->qual.qual = sig + 110;
-                }
-
-                if (local->hw.flags & IEEE80211_HW_NOISE_DBM) {
-                        /*
-                         * This assumes that if driver reports noise, it also
-                         * reports signal in dBm.
-                         */
-                        wstats->qual.noise = sta->last_noise;
-                        wstats->qual.updated |= IW_QUAL_NOISE_UPDATED;
-                } else {
-                        wstats->qual.updated |= IW_QUAL_NOISE_INVALID;
-                }
-        }
+                return cfg80211_mgd_wext_giwap(dev, info, ap_addr, extra);
 
-        rcu_read_unlock();
-
-        return wstats;
-}
+        if (sdata->vif.type == NL80211_IFTYPE_WDS)
+                return cfg80211_wds_wext_giwap(dev, info, ap_addr, extra);
 
-static int ieee80211_ioctl_giwauth(struct net_device *dev,
-                                   struct iw_request_info *info,
-                                   struct iw_param *data, char *extra)
-{
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        int ret = 0;
-
-        switch (data->flags & IW_AUTH_INDEX) {
-        case IW_AUTH_80211_AUTH_ALG:
-                if (sdata->vif.type == NL80211_IFTYPE_STATION)
-                        data->value = sdata->u.mgd.auth_algs;
-                else
-                        ret = -EOPNOTSUPP;
-                break;
-        default:
-                ret = -EOPNOTSUPP;
-                break;
-        }
-        return ret;
+        return -EOPNOTSUPP;
 }
 
 
@@ -599,8 +201,8 @@ static const iw_handler ieee80211_handler[] =
         (iw_handler) NULL,                              /* SIOCGIWNICKN */
         (iw_handler) NULL,                              /* -- hole -- */
         (iw_handler) NULL,                              /* -- hole -- */
-        (iw_handler) ieee80211_ioctl_siwrate,           /* SIOCSIWRATE */
-        (iw_handler) ieee80211_ioctl_giwrate,           /* SIOCGIWRATE */
+        (iw_handler) cfg80211_wext_siwrate,             /* SIOCSIWRATE */
+        (iw_handler) cfg80211_wext_giwrate,             /* SIOCGIWRATE */
         (iw_handler) cfg80211_wext_siwrts,              /* SIOCSIWRTS */
         (iw_handler) cfg80211_wext_giwrts,              /* SIOCGIWRTS */
         (iw_handler) cfg80211_wext_siwfrag,             /* SIOCSIWFRAG */
@@ -611,14 +213,14 @@ static const iw_handler ieee80211_handler[] =
         (iw_handler) cfg80211_wext_giwretry,            /* SIOCGIWRETRY */
         (iw_handler) cfg80211_wext_siwencode,           /* SIOCSIWENCODE */
         (iw_handler) cfg80211_wext_giwencode,           /* SIOCGIWENCODE */
-        (iw_handler) ieee80211_ioctl_siwpower,          /* SIOCSIWPOWER */
-        (iw_handler) ieee80211_ioctl_giwpower,          /* SIOCGIWPOWER */
+        (iw_handler) cfg80211_wext_siwpower,            /* SIOCSIWPOWER */
+        (iw_handler) cfg80211_wext_giwpower,            /* SIOCGIWPOWER */
         (iw_handler) NULL,                              /* -- hole -- */
         (iw_handler) NULL,                              /* -- hole -- */
-        (iw_handler) ieee80211_ioctl_siwgenie,          /* SIOCSIWGENIE */
+        (iw_handler) cfg80211_wext_siwgenie,            /* SIOCSIWGENIE */
         (iw_handler) NULL,                              /* SIOCGIWGENIE */
-        (iw_handler) ieee80211_ioctl_siwauth,           /* SIOCSIWAUTH */
-        (iw_handler) ieee80211_ioctl_giwauth,           /* SIOCGIWAUTH */
+        (iw_handler) cfg80211_wext_siwauth,             /* SIOCSIWAUTH */
+        (iw_handler) cfg80211_wext_giwauth,             /* SIOCGIWAUTH */
         (iw_handler) cfg80211_wext_siwencodeext,        /* SIOCSIWENCODEEXT */
         (iw_handler) NULL,                              /* SIOCGIWENCODEEXT */
         (iw_handler) NULL,                              /* SIOCSIWPMKSA */
@@ -629,5 +231,5 @@ const struct iw_handler_def ieee80211_iw_handler_def =
 {
         .num_standard   = ARRAY_SIZE(ieee80211_handler),
         .standard       = (iw_handler *) ieee80211_handler,
-        .get_wireless_stats = ieee80211_get_wireless_stats,
+        .get_wireless_stats = cfg80211_wireless_stats,
 };
diff --git a/net/mac80211/wme.c b/net/mac80211/wme.c
index 116a923b14d6..b19b7696f3a2 100644
--- a/net/mac80211/wme.c
+++ b/net/mac80211/wme.c
@@ -85,10 +85,8 @@ static u16 classify80211(struct ieee80211_local *local, struct sk_buff *skb)
         return ieee802_1d_to_ac[skb->priority];
 }
 
-u16 ieee80211_select_queue(struct net_device *dev, struct sk_buff *skb)
+void ieee80211_select_queue(struct ieee80211_local *local, struct sk_buff *skb)
 {
-        struct ieee80211_master_priv *mpriv = netdev_priv(dev);
-        struct ieee80211_local *local = mpriv->local;
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
         u16 queue;
         u8 tid;
@@ -113,5 +111,5 @@ u16 ieee80211_select_queue(struct net_device *dev, struct sk_buff *skb)
                 *p = 0;
         }
 
-        return queue;
+        skb_set_queue_mapping(skb, queue);
 }
diff --git a/net/mac80211/wme.h b/net/mac80211/wme.h
index 7520d2e014dc..d4fd87ca5118 100644
--- a/net/mac80211/wme.h
+++ b/net/mac80211/wme.h
@@ -20,6 +20,7 @@
 
 extern const int ieee802_1d_to_ac[8];
 
-u16 ieee80211_select_queue(struct net_device *dev, struct sk_buff *skb);
+void ieee80211_select_queue(struct ieee80211_local *local,
+                            struct sk_buff *skb);
 
 #endif /* _WME_H */
diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c
index dcfae8884b86..70778694877b 100644
--- a/net/mac80211/wpa.c
+++ b/net/mac80211/wpa.c
@@ -122,7 +122,8 @@ ieee80211_rx_h_michael_mic_verify(struct ieee80211_rx_data *rx)
                         return RX_DROP_UNUSABLE;
 
                 mac80211_ev_michael_mic_failure(rx->sdata, rx->key->conf.keyidx,
-                                                (void *) skb->data, NULL);
+                                                (void *) skb->data, NULL,
+                                                GFP_ATOMIC);
                 return RX_DROP_UNUSABLE;
         }
 
diff --git a/net/netfilter/ipvs/ip_vs_app.c b/net/netfilter/ipvs/ip_vs_app.c
index 201b8ea3020d..c1781f80daf2 100644
--- a/net/netfilter/ipvs/ip_vs_app.c
+++ b/net/netfilter/ipvs/ip_vs_app.c
@@ -18,6 +18,9 @@
  *
  */
 
+#define KMSG_COMPONENT "IPVS"
+#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
+
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/skbuff.h>
diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c
index 77bfdfeb966e..4173d7b1d4cc 100644
--- a/net/netfilter/ipvs/ip_vs_conn.c
+++ b/net/netfilter/ipvs/ip_vs_conn.c
@@ -22,6 +22,9 @@
  *
  */
 
+#define KMSG_COMPONENT "IPVS"
+#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
+
 #include <linux/interrupt.h>
 #include <linux/in.h>
 #include <linux/net.h>
diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
index 8dddb17a947a..6811dcaca0f6 100644
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -24,6 +24,9 @@
  *
  */
 
+#define KMSG_COMPONENT "IPVS"
+#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
+
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/ip.h>
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index 7c1333c67ff3..e6133ea1ea4c 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -18,6 +18,9 @@
  *
  */
 
+#define KMSG_COMPONENT "IPVS"
+#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
+
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/types.h>
@@ -3231,7 +3234,7 @@ static int ip_vs_genl_get_cmd(struct sk_buff *skb, struct genl_info *info)
         }
 
         genlmsg_end(msg, reply);
-        ret = genlmsg_unicast(msg, info->snd_pid);
+        ret = genlmsg_reply(msg, info);
         goto out;
 
 nla_put_failure:
diff --git a/net/netfilter/ipvs/ip_vs_dh.c b/net/netfilter/ipvs/ip_vs_dh.c
index a9dac74bb13f..d0c0594d1e2e 100644
--- a/net/netfilter/ipvs/ip_vs_dh.c
+++ b/net/netfilter/ipvs/ip_vs_dh.c
@@ -35,6 +35,9 @@
  *
  */
 
+#define KMSG_COMPONENT "IPVS"
+#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
+
 #include <linux/ip.h>
 #include <linux/module.h>
 #include <linux/kernel.h>
diff --git a/net/netfilter/ipvs/ip_vs_est.c b/net/netfilter/ipvs/ip_vs_est.c
index 2eb2860dabb5..702b53ca937c 100644
--- a/net/netfilter/ipvs/ip_vs_est.c
+++ b/net/netfilter/ipvs/ip_vs_est.c
@@ -11,6 +11,10 @@
  * Changes:
  *
  */
+
+#define KMSG_COMPONENT "IPVS"
+#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
+
 #include <linux/kernel.h>
 #include <linux/jiffies.h>
 #include <linux/slab.h>
diff --git a/net/netfilter/ipvs/ip_vs_ftp.c b/net/netfilter/ipvs/ip_vs_ftp.c
index 428edbf481cc..9c16a3f64c1b 100644
--- a/net/netfilter/ipvs/ip_vs_ftp.c
+++ b/net/netfilter/ipvs/ip_vs_ftp.c
@@ -22,6 +22,9 @@
  *
  */
 
+#define KMSG_COMPONENT "IPVS"
+#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
+
 #include <linux/module.h>
 #include <linux/moduleparam.h>
 #include <linux/kernel.h>
diff --git a/net/netfilter/ipvs/ip_vs_lblc.c b/net/netfilter/ipvs/ip_vs_lblc.c
index 3eb5e2660c49..98fb185d890b 100644
--- a/net/netfilter/ipvs/ip_vs_lblc.c
+++ b/net/netfilter/ipvs/ip_vs_lblc.c
@@ -39,6 +39,9 @@
  * me to write this module.
  */
 
+#define KMSG_COMPONENT "IPVS"
+#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
+
 #include <linux/ip.h>
 #include <linux/module.h>
 #include <linux/kernel.h>
diff --git a/net/netfilter/ipvs/ip_vs_lblcr.c b/net/netfilter/ipvs/ip_vs_lblcr.c
index c04ce56c7f0f..5f5e5f4bad5e 100644
--- a/net/netfilter/ipvs/ip_vs_lblcr.c
+++ b/net/netfilter/ipvs/ip_vs_lblcr.c
@@ -37,6 +37,9 @@
  *
  */
 
+#define KMSG_COMPONENT "IPVS"
+#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
+
 #include <linux/ip.h>
 #include <linux/module.h>
 #include <linux/kernel.h>
diff --git a/net/netfilter/ipvs/ip_vs_lc.c b/net/netfilter/ipvs/ip_vs_lc.c
index d0dadc8a65fd..4ecd5e19c39a 100644
--- a/net/netfilter/ipvs/ip_vs_lc.c
+++ b/net/netfilter/ipvs/ip_vs_lc.c
@@ -14,6 +14,9 @@
  *
  */
 
+#define KMSG_COMPONENT "IPVS"
+#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
+
 #include <linux/module.h>
 #include <linux/kernel.h>
 
diff --git a/net/netfilter/ipvs/ip_vs_nq.c b/net/netfilter/ipvs/ip_vs_nq.c
index 694952db5026..2224478bdea8 100644
--- a/net/netfilter/ipvs/ip_vs_nq.c
+++ b/net/netfilter/ipvs/ip_vs_nq.c
@@ -31,6 +31,9 @@
  *
  */
 
+#define KMSG_COMPONENT "IPVS"
+#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
+
 #include <linux/module.h>
 #include <linux/kernel.h>
 
diff --git a/net/netfilter/ipvs/ip_vs_proto.c b/net/netfilter/ipvs/ip_vs_proto.c
index a01520e3d6b8..a95bc4021c90 100644
--- a/net/netfilter/ipvs/ip_vs_proto.c
+++ b/net/netfilter/ipvs/ip_vs_proto.c
@@ -13,6 +13,9 @@
  *
  */
 
+#define KMSG_COMPONENT "IPVS"
+#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
+
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/skbuff.h>
@@ -181,7 +184,7 @@ ip_vs_tcpudp_debug_packet_v4(struct ip_vs_protocol *pp,
                                 &ih->daddr, ntohs(pptr[1]));
         }
 
-        printk(KERN_DEBUG "IPVS: %s: %s\n", msg, buf);
+        pr_debug("%s: %s\n", msg, buf);
 }
 
 #ifdef CONFIG_IP_VS_IPV6
@@ -215,7 +218,7 @@ ip_vs_tcpudp_debug_packet_v6(struct ip_vs_protocol *pp,
                                 &ih->daddr, ntohs(pptr[1]));
         }
 
-        printk(KERN_DEBUG "IPVS: %s: %s\n", msg, buf);
+        pr_debug("%s: %s\n", msg, buf);
 }
 #endif
 
diff --git a/net/netfilter/ipvs/ip_vs_proto_ah_esp.c b/net/netfilter/ipvs/ip_vs_proto_ah_esp.c
index 79f56c1e7c19..c30b43c36cd7 100644
--- a/net/netfilter/ipvs/ip_vs_proto_ah_esp.c
+++ b/net/netfilter/ipvs/ip_vs_proto_ah_esp.c
@@ -10,6 +10,9 @@
  *
  */
 
+#define KMSG_COMPONENT "IPVS"
+#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
+
 #include <linux/in.h>
 #include <linux/ip.h>
 #include <linux/module.h>
@@ -138,7 +141,7 @@ ah_esp_debug_packet_v4(struct ip_vs_protocol *pp, const struct sk_buff *skb,
                 sprintf(buf, "%s %pI4->%pI4",
                         pp->name, &ih->saddr, &ih->daddr);
 
-        printk(KERN_DEBUG "IPVS: %s: %s\n", msg, buf);
+        pr_debug("%s: %s\n", msg, buf);
 }
 
 #ifdef CONFIG_IP_VS_IPV6
@@ -156,7 +159,7 @@ ah_esp_debug_packet_v6(struct ip_vs_protocol *pp, const struct sk_buff *skb,
                 sprintf(buf, "%s %pI6->%pI6",
                         pp->name, &ih->saddr, &ih->daddr);
 
-        printk(KERN_DEBUG "IPVS: %s: %s\n", msg, buf);
+        pr_debug("%s: %s\n", msg, buf);
 }
 #endif
 
diff --git a/net/netfilter/ipvs/ip_vs_proto_tcp.c b/net/netfilter/ipvs/ip_vs_proto_tcp.c
index 8cba41802850..c36c80d3a2b4 100644
--- a/net/netfilter/ipvs/ip_vs_proto_tcp.c
+++ b/net/netfilter/ipvs/ip_vs_proto_tcp.c
@@ -13,6 +13,9 @@
  *
  */
 
+#define KMSG_COMPONENT "IPVS"
+#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
+
 #include <linux/kernel.h>
 #include <linux/ip.h>
 #include <linux/tcp.h>                  /* for tcphdr */
diff --git a/net/netfilter/ipvs/ip_vs_proto_udp.c b/net/netfilter/ipvs/ip_vs_proto_udp.c
index d2930a71084b..96ebe40bc537 100644
--- a/net/netfilter/ipvs/ip_vs_proto_udp.c
+++ b/net/netfilter/ipvs/ip_vs_proto_udp.c
@@ -13,6 +13,9 @@
  *
  */
 
+#define KMSG_COMPONENT "IPVS"
+#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
+
 #include <linux/in.h>
 #include <linux/ip.h>
 #include <linux/kernel.h>
diff --git a/net/netfilter/ipvs/ip_vs_rr.c b/net/netfilter/ipvs/ip_vs_rr.c
index 2d16ab7f8c1e..b01007e1c11e 100644
--- a/net/netfilter/ipvs/ip_vs_rr.c
+++ b/net/netfilter/ipvs/ip_vs_rr.c
@@ -19,6 +19,9 @@
  *
  */
 
+#define KMSG_COMPONENT "IPVS"
+#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
+
 #include <linux/module.h>
 #include <linux/kernel.h>
 
diff --git a/net/netfilter/ipvs/ip_vs_sched.c b/net/netfilter/ipvs/ip_vs_sched.c
index a46ad9e35016..87bc5ea0ef29 100644
--- a/net/netfilter/ipvs/ip_vs_sched.c
+++ b/net/netfilter/ipvs/ip_vs_sched.c
@@ -17,6 +17,9 @@
  *
  */
 
+#define KMSG_COMPONENT "IPVS"
+#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
+
 #include <linux/module.h>
 #include <linux/spinlock.h>
 #include <linux/interrupt.h>
diff --git a/net/netfilter/ipvs/ip_vs_sed.c b/net/netfilter/ipvs/ip_vs_sed.c
index 20e4657d2f3b..4f745dd86dd8 100644
--- a/net/netfilter/ipvs/ip_vs_sed.c
+++ b/net/netfilter/ipvs/ip_vs_sed.c
@@ -35,6 +35,9 @@
  *
  */
 
+#define KMSG_COMPONENT "IPVS"
+#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
+
 #include <linux/module.h>
 #include <linux/kernel.h>
 
diff --git a/net/netfilter/ipvs/ip_vs_sh.c b/net/netfilter/ipvs/ip_vs_sh.c
index 75709ebeb630..fb4d2d23f2fe 100644
--- a/net/netfilter/ipvs/ip_vs_sh.c
+++ b/net/netfilter/ipvs/ip_vs_sh.c
@@ -32,6 +32,9 @@
  *
  */
 
+#define KMSG_COMPONENT "IPVS"
+#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
+
 #include <linux/ip.h>
 #include <linux/module.h>
 #include <linux/kernel.h>
diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c
index 5c48378a852f..cc04c99815fd 100644
--- a/net/netfilter/ipvs/ip_vs_sync.c
+++ b/net/netfilter/ipvs/ip_vs_sync.c
@@ -17,6 +17,9 @@
  *      Justin Ossevoort        :       Fix endian problem on sync message size.
  */
 
+#define KMSG_COMPONENT "IPVS"
+#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
+
 #include <linux/module.h>
 #include <linux/slab.h>
 #include <linux/inetdevice.h>
diff --git a/net/netfilter/ipvs/ip_vs_wlc.c b/net/netfilter/ipvs/ip_vs_wlc.c
index 8e942565b47d..bbddfdb10db2 100644
--- a/net/netfilter/ipvs/ip_vs_wlc.c
+++ b/net/netfilter/ipvs/ip_vs_wlc.c
@@ -19,6 +19,9 @@
  *
  */
 
+#define KMSG_COMPONENT "IPVS"
+#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
+
 #include <linux/module.h>
 #include <linux/kernel.h>
 
diff --git a/net/netfilter/ipvs/ip_vs_wrr.c b/net/netfilter/ipvs/ip_vs_wrr.c
index f7d74ef1ecf9..c39ebb6c5a54 100644
--- a/net/netfilter/ipvs/ip_vs_wrr.c
+++ b/net/netfilter/ipvs/ip_vs_wrr.c
@@ -18,6 +18,9 @@
  *
  */
 
+#define KMSG_COMPONENT "IPVS"
+#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
+
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/net.h>
diff --git a/net/netfilter/ipvs/ip_vs_xmit.c b/net/netfilter/ipvs/ip_vs_xmit.c
index 5874657af7f2..061e76dfdad9 100644
--- a/net/netfilter/ipvs/ip_vs_xmit.c
+++ b/net/netfilter/ipvs/ip_vs_xmit.c
@@ -13,6 +13,9 @@
  *
  */
 
+#define KMSG_COMPONENT "IPVS"
+#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
+
 #include <linux/kernel.h>
 #include <linux/tcp.h>                  /* for tcphdr */
 #include <net/ip.h>
diff --git a/net/netlabel/netlabel_kapi.c b/net/netlabel/netlabel_kapi.c
index 16e6c4378ff1..6ce00205f342 100644
--- a/net/netlabel/netlabel_kapi.c
+++ b/net/netlabel/netlabel_kapi.c
@@ -185,8 +185,7 @@ int netlbl_cfg_unlbl_map_add(const char *domain,
         return 0;
 
 cfg_unlbl_map_add_failure:
-        if (entry != NULL)
-                kfree(entry->domain);
+        kfree(entry->domain);
         kfree(entry);
         kfree(addrmap);
         kfree(map4);
@@ -385,8 +384,7 @@ int netlbl_cfg_cipsov4_map_add(u32 doi,
 
 cfg_cipsov4_map_add_failure:
         cipso_v4_doi_putdef(doi_def);
-        if (entry != NULL)
-                kfree(entry->domain);
+        kfree(entry->domain);
         kfree(entry);
         kfree(addrmap);
         kfree(addrinfo);
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 2936fa3b6dc8..da3163d15ef0 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -83,6 +83,11 @@ struct netlink_sock {
         struct module           *module;
 };
 
+struct listeners_rcu_head {
+        struct rcu_head rcu_head;
+        void *ptr;
+};
+
 #define NETLINK_KERNEL_SOCKET   0x1
 #define NETLINK_RECV_PKTINFO    0x2
 #define NETLINK_BROADCAST_SEND_ERROR    0x4
@@ -1356,7 +1361,7 @@ static int netlink_recvmsg(struct kiocb *kiocb, struct socket *sock,
         struct netlink_sock *nlk = nlk_sk(sk);
         int noblock = flags&MSG_DONTWAIT;
         size_t copied;
-        struct sk_buff *skb;
+        struct sk_buff *skb, *frag __maybe_unused = NULL;
         int err;
 
         if (flags&MSG_OOB)
@@ -1368,6 +1373,35 @@ static int netlink_recvmsg(struct kiocb *kiocb, struct socket *sock,
         if (skb == NULL)
                 goto out;
 
+#ifdef CONFIG_COMPAT_NETLINK_MESSAGES
+        if (unlikely(skb_shinfo(skb)->frag_list)) {
+                bool need_compat = !!(flags & MSG_CMSG_COMPAT);
+
+                /*
+                 * If this skb has a frag_list, then here that means that
+                 * we will have to use the frag_list skb for compat tasks
+                 * and the regular skb for non-compat tasks.
+                 *
+                 * The skb might (and likely will) be cloned, so we can't
+                 * just reset frag_list and go on with things -- we need to
+                 * keep that. For the compat case that's easy -- simply get
+                 * a reference to the compat skb and free the regular one
+                 * including the frag. For the non-compat case, we need to
+                 * avoid sending the frag to the user -- so assign NULL but
+                 * restore it below before freeing the skb.
+                 */
+                if (need_compat) {
+                        struct sk_buff *compskb = skb_shinfo(skb)->frag_list;
+                        skb_get(compskb);
+                        kfree_skb(skb);
+                        skb = compskb;
+                } else {
+                        frag = skb_shinfo(skb)->frag_list;
+                        skb_shinfo(skb)->frag_list = NULL;
+                }
+        }
+#endif
+
         msg->msg_namelen = 0;
 
         copied = skb->len;
@@ -1398,6 +1432,11 @@ static int netlink_recvmsg(struct kiocb *kiocb, struct socket *sock,
         siocb->scm->creds = *NETLINK_CREDS(skb);
         if (flags & MSG_TRUNC)
                 copied = skb->len;
+
+#ifdef CONFIG_COMPAT_NETLINK_MESSAGES
+        skb_shinfo(skb)->frag_list = frag;
+#endif
+
         skb_free_datagram(sk, skb);
 
         if (nlk->cb && atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf / 2)
@@ -1453,7 +1492,8 @@ netlink_kernel_create(struct net *net, int unit, unsigned int groups,
         if (groups < 32)
                 groups = 32;
 
-        listeners = kzalloc(NLGRPSZ(groups), GFP_KERNEL);
+        listeners = kzalloc(NLGRPSZ(groups) + sizeof(struct listeners_rcu_head),
+                            GFP_KERNEL);
         if (!listeners)
                 goto out_sock_release;
 
@@ -1501,6 +1541,14 @@ netlink_kernel_release(struct sock *sk)
 EXPORT_SYMBOL(netlink_kernel_release);
 
 
+static void netlink_free_old_listeners(struct rcu_head *rcu_head)
+{
+        struct listeners_rcu_head *lrh;
+
+        lrh = container_of(rcu_head, struct listeners_rcu_head, rcu_head);
+        kfree(lrh->ptr);
+}
+
 /**
  * netlink_change_ngroups - change number of multicast groups
  *
@@ -1516,6 +1564,7 @@ EXPORT_SYMBOL(netlink_kernel_release);
 int netlink_change_ngroups(struct sock *sk, unsigned int groups)
 {
         unsigned long *listeners, *old = NULL;
+        struct listeners_rcu_head *old_rcu_head;
         struct netlink_table *tbl = &nl_table[sk->sk_protocol];
         int err = 0;
 
@@ -1524,7 +1573,9 @@ int netlink_change_ngroups(struct sock *sk, unsigned int groups)
 
         netlink_table_grab();
         if (NLGRPSZ(tbl->groups) < NLGRPSZ(groups)) {
-                listeners = kzalloc(NLGRPSZ(groups), GFP_ATOMIC);
+                listeners = kzalloc(NLGRPSZ(groups) +
+                                    sizeof(struct listeners_rcu_head),
+                                    GFP_ATOMIC);
                 if (!listeners) {
                         err = -ENOMEM;
                         goto out_ungrab;
@@ -1532,16 +1583,24 @@ int netlink_change_ngroups(struct sock *sk, unsigned int groups)
                 old = tbl->listeners;
                 memcpy(listeners, old, NLGRPSZ(tbl->groups));
                 rcu_assign_pointer(tbl->listeners, listeners);
+                /*
+                 * Free the old memory after an RCU grace period so we
+                 * don't leak it. We use call_rcu() here in order to be
+                 * able to call this function from atomic contexts. The
+                 * allocation of this memory will have reserved enough
+                 * space for struct listeners_rcu_head at the end.
+                 */
+                old_rcu_head = (void *)(tbl->listeners +
+                                        NLGRPLONGS(tbl->groups));
+                old_rcu_head->ptr = old;
+                call_rcu(&old_rcu_head->rcu_head, netlink_free_old_listeners);
         }
         tbl->groups = groups;
 
  out_ungrab:
         netlink_table_ungrab();
-        synchronize_rcu();
-        kfree(old);
         return err;
 }
-EXPORT_SYMBOL(netlink_change_ngroups);
 
 /**
  * netlink_clear_multicast_users - kick off multicast listeners
@@ -1564,7 +1623,6 @@ void netlink_clear_multicast_users(struct sock *ksk, unsigned int group)
 
         netlink_table_ungrab();
 }
-EXPORT_SYMBOL(netlink_clear_multicast_users);
 
 void netlink_set_nonroot(int protocol, unsigned int flags)
 {
diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
index eed4c6a8afc0..575c64341508 100644
--- a/net/netlink/genetlink.c
+++ b/net/netlink/genetlink.c
@@ -18,8 +18,6 @@
 #include <net/sock.h>
 #include <net/genetlink.h>
 
-struct sock *genl_sock = NULL;
-
 static DEFINE_MUTEX(genl_mutex); /* serialization of message processing */
 
 static inline void genl_lock(void)
@@ -175,10 +173,31 @@ int genl_register_mc_group(struct genl_family *family,
                 mc_groups_longs++;
         }
 
-        err = netlink_change_ngroups(genl_sock,
-                                     mc_groups_longs * BITS_PER_LONG);
-        if (err)
-                goto out;
+        if (family->netnsok) {
+                struct net *net;
+
+                rcu_read_lock();
+                for_each_net_rcu(net) {
+                        err = netlink_change_ngroups(net->genl_sock,
+                                        mc_groups_longs * BITS_PER_LONG);
+                        if (err) {
+                                /*
+                                 * No need to roll back, can only fail if
+                                 * memory allocation fails and then the
+                                 * number of _possible_ groups has been
+                                 * increased on some sockets which is ok.
+                                 */
+                                rcu_read_unlock();
+                                goto out;
+                        }
+                }
+                rcu_read_unlock();
+        } else {
+                err = netlink_change_ngroups(init_net.genl_sock,
+                                             mc_groups_longs * BITS_PER_LONG);
+                if (err)
+                        goto out;
+        }
 
         grp->id = id;
         set_bit(id, mc_groups);
@@ -195,8 +214,14 @@ EXPORT_SYMBOL(genl_register_mc_group);
 static void __genl_unregister_mc_group(struct genl_family *family,
                                        struct genl_multicast_group *grp)
 {
+        struct net *net;
         BUG_ON(grp->family != family);
-        netlink_clear_multicast_users(genl_sock, grp->id);
+
+        rcu_read_lock();
+        for_each_net_rcu(net)
+                netlink_clear_multicast_users(net->genl_sock, grp->id);
+        rcu_read_unlock();
+
         clear_bit(grp->id, mc_groups);
         list_del(&grp->list);
         genl_ctrl_event(CTRL_CMD_DELMCAST_GRP, grp);
@@ -467,6 +492,7 @@ static int genl_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
 {
         struct genl_ops *ops;
         struct genl_family *family;
+        struct net *net = sock_net(skb->sk);
         struct genl_info info;
         struct genlmsghdr *hdr = nlmsg_data(nlh);
         int hdrlen, err;
@@ -475,6 +501,10 @@ static int genl_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
         if (family == NULL)
                 return -ENOENT;
 
+        /* this family doesn't exist in this netns */
+        if (!family->netnsok && !net_eq(net, &init_net))
+                return -ENOENT;
+
         hdrlen = GENL_HDRLEN + family->hdrsize;
         if (nlh->nlmsg_len < nlmsg_msg_size(hdrlen))
                 return -EINVAL;
@@ -492,7 +522,7 @@ static int genl_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                         return -EOPNOTSUPP;
 
                 genl_unlock();
-                err = netlink_dump_start(genl_sock, skb, nlh,
+                err = netlink_dump_start(net->genl_sock, skb, nlh,
                                          ops->dumpit, ops->done);
                 genl_lock();
                 return err;
@@ -514,6 +544,7 @@ static int genl_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
         info.genlhdr = nlmsg_data(nlh);
         info.userhdr = nlmsg_data(nlh) + GENL_HDRLEN;
         info.attrs = family->attrbuf;
+        genl_info_net_set(&info, net);
 
         return ops->doit(skb, &info);
 }
@@ -534,6 +565,7 @@ static struct genl_family genl_ctrl = {
         .name = "nlctrl",
         .version = 0x2,
         .maxattr = CTRL_ATTR_MAX,
+        .netnsok = true,
 };
 
 static int ctrl_fill_info(struct genl_family *family, u32 pid, u32 seq,
@@ -650,6 +682,7 @@ static int ctrl_dumpfamily(struct sk_buff *skb, struct netlink_callback *cb)
 
         int i, n = 0;
         struct genl_family *rt;
+        struct net *net = sock_net(skb->sk);
         int chains_to_skip = cb->args[0];
         int fams_to_skip = cb->args[1];
 
@@ -658,6 +691,8 @@ static int ctrl_dumpfamily(struct sk_buff *skb, struct netlink_callback *cb)
                         continue;
                 n = 0;
                 list_for_each_entry(rt, genl_family_chain(i), family_list) {
+                        if (!rt->netnsok && !net_eq(net, &init_net))
+                                continue;
                         if (++n < fams_to_skip)
                                 continue;
                         if (ctrl_fill_info(rt, NETLINK_CB(cb->skb).pid,
@@ -729,6 +764,7 @@ static int ctrl_getfamily(struct sk_buff *skb, struct genl_info *info)
         if (info->attrs[CTRL_ATTR_FAMILY_ID]) {
                 u16 id = nla_get_u16(info->attrs[CTRL_ATTR_FAMILY_ID]);
                 res = genl_family_find_byid(id);
+                err = -ENOENT;
         }
 
         if (info->attrs[CTRL_ATTR_FAMILY_NAME]) {
@@ -736,49 +772,61 @@ static int ctrl_getfamily(struct sk_buff *skb, struct genl_info *info)
 
                 name = nla_data(info->attrs[CTRL_ATTR_FAMILY_NAME]);
                 res = genl_family_find_byname(name);
+                err = -ENOENT;
         }
 
-        if (res == NULL) {
-                err = -ENOENT;
-                goto errout;
+        if (res == NULL)
+                return err;
+
+        if (!res->netnsok && !net_eq(genl_info_net(info), &init_net)) {
+                /* family doesn't exist here */
+                return -ENOENT;
         }
 
         msg = ctrl_build_family_msg(res, info->snd_pid, info->snd_seq,
                                     CTRL_CMD_NEWFAMILY);
-        if (IS_ERR(msg)) {
-                err = PTR_ERR(msg);
-                goto errout;
-        }
+        if (IS_ERR(msg))
+                return PTR_ERR(msg);
 
-        err = genlmsg_reply(msg, info);
-errout:
-        return err;
+        return genlmsg_reply(msg, info);
 }
 
 static int genl_ctrl_event(int event, void *data)
 {
         struct sk_buff *msg;
+        struct genl_family *family;
+        struct genl_multicast_group *grp;
 
-        if (genl_sock == NULL)
+        /* genl is still initialising */
+        if (!init_net.genl_sock)
                 return 0;
 
         switch (event) {
         case CTRL_CMD_NEWFAMILY:
         case CTRL_CMD_DELFAMILY:
-                msg = ctrl_build_family_msg(data, 0, 0, event);
-                if (IS_ERR(msg))
-                        return PTR_ERR(msg);
-
-                genlmsg_multicast(msg, 0, GENL_ID_CTRL, GFP_KERNEL);
+                family = data;
+                msg = ctrl_build_family_msg(family, 0, 0, event);
                 break;
         case CTRL_CMD_NEWMCAST_GRP:
         case CTRL_CMD_DELMCAST_GRP:
+                grp = data;
+                family = grp->family;
                 msg = ctrl_build_mcgrp_msg(data, 0, 0, event);
-                if (IS_ERR(msg))
-                        return PTR_ERR(msg);
-
-                genlmsg_multicast(msg, 0, GENL_ID_CTRL, GFP_KERNEL);
                 break;
+        default:
+                return -EINVAL;
+        }
+
+        if (IS_ERR(msg))
+                return PTR_ERR(msg);
+
+        if (!family->netnsok) {
+                genlmsg_multicast_netns(&init_net, msg, 0,
+                                        GENL_ID_CTRL, GFP_KERNEL);
+        } else {
+                rcu_read_lock();
+                genlmsg_multicast_allns(msg, 0, GENL_ID_CTRL, GFP_ATOMIC);
+                rcu_read_unlock();
         }
 
         return 0;
@@ -795,6 +843,33 @@ static struct genl_multicast_group notify_grp = {
         .name           = "notify",
 };
 
+static int __net_init genl_pernet_init(struct net *net)
+{
+        /* we'll bump the group number right afterwards */
+        net->genl_sock = netlink_kernel_create(net, NETLINK_GENERIC, 0,
+                                               genl_rcv, &genl_mutex,
+                                               THIS_MODULE);
+
+        if (!net->genl_sock && net_eq(net, &init_net))
+                panic("GENL: Cannot initialize generic netlink\n");
+
+        if (!net->genl_sock)
+                return -ENOMEM;
+
+        return 0;
+}
+
+static void __net_exit genl_pernet_exit(struct net *net)
+{
+        netlink_kernel_release(net->genl_sock);
+        net->genl_sock = NULL;
+}
+
+static struct pernet_operations genl_pernet_ops = {
+        .init = genl_pernet_init,
+        .exit = genl_pernet_exit,
+};
+
 static int __init genl_init(void)
 {
         int i, err;
@@ -804,36 +879,67 @@ static int __init genl_init(void)
 
         err = genl_register_family(&genl_ctrl);
         if (err < 0)
-                goto errout;
+                goto problem;
 
         err = genl_register_ops(&genl_ctrl, &genl_ctrl_ops);
         if (err < 0)
-                goto errout_register;
+                goto problem;
 
         netlink_set_nonroot(NETLINK_GENERIC, NL_NONROOT_RECV);
 
-        /* we'll bump the group number right afterwards */
-        genl_sock = netlink_kernel_create(&init_net, NETLINK_GENERIC, 0,
-                                          genl_rcv, &genl_mutex, THIS_MODULE);
-        if (genl_sock == NULL)
-                panic("GENL: Cannot initialize generic netlink\n");
+        err = register_pernet_subsys(&genl_pernet_ops);
+        if (err)
+                goto problem;
 
         err = genl_register_mc_group(&genl_ctrl, &notify_grp);
         if (err < 0)
-                goto errout_register;
+                goto problem;
 
         return 0;
 
-errout_register:
-        genl_unregister_family(&genl_ctrl);
-errout:
+problem:
         panic("GENL: Cannot register controller: %d\n", err);
 }
 
 subsys_initcall(genl_init);
 
-EXPORT_SYMBOL(genl_sock);
 EXPORT_SYMBOL(genl_register_ops);
 EXPORT_SYMBOL(genl_unregister_ops);
 EXPORT_SYMBOL(genl_register_family);
 EXPORT_SYMBOL(genl_unregister_family);
+
+static int genlmsg_mcast(struct sk_buff *skb, u32 pid, unsigned long group,
+                         gfp_t flags)
+{
+        struct sk_buff *tmp;
+        struct net *net, *prev = NULL;
+        int err;
+
+        for_each_net_rcu(net) {
+                if (prev) {
+                        tmp = skb_clone(skb, flags);
+                        if (!tmp) {
+                                err = -ENOMEM;
+                                goto error;
+                        }
+                        err = nlmsg_multicast(prev->genl_sock, tmp,
+                                              pid, group, flags);
+                        if (err)
+                                goto error;
+                }
+
+                prev = net;
+        }
+
+        return nlmsg_multicast(prev->genl_sock, skb, pid, group, flags);
+ error:
+        kfree_skb(skb);
+        return err;
+}
+
+int genlmsg_multicast_allns(struct sk_buff *skb, u32 pid, unsigned int group,
+                            gfp_t flags)
+{
+        return genlmsg_mcast(skb, pid, group, flags);
+}
+EXPORT_SYMBOL(genlmsg_multicast_allns);
diff --git a/net/netrom/nr_dev.c b/net/netrom/nr_dev.c
index 351372463fed..c7b7838a0519 100644
--- a/net/netrom/nr_dev.c
+++ b/net/netrom/nr_dev.c
@@ -177,13 +177,13 @@ static int nr_xmit(struct sk_buff *skb, struct net_device *dev)
         if (!nr_route_frame(skb, NULL)) {
                 kfree_skb(skb);
                 stats->tx_errors++;
-                return 0;
+                return NETDEV_TX_OK;
         }
 
         stats->tx_packets++;
         stats->tx_bytes += len;
 
-        return 0;
+        return NETDEV_TX_OK;
 }
 
 static const struct header_ops nr_header_ops = {
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index ebe5718baa31..d3d52c66cdc2 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -137,8 +137,7 @@ dev->hard_header == NULL (ll header is added by device, we cannot control it)
 
 /* Private packet socket structures. */
 
-struct packet_mclist
-{
+struct packet_mclist {
         struct packet_mclist    *next;
         int                     ifindex;
         int                     count;
@@ -149,8 +148,7 @@ struct packet_mclist
 /* identical to struct packet_mreq except it has
  * a longer address field.
  */
-struct packet_mreq_max
-{
+struct packet_mreq_max {
         int             mr_ifindex;
         unsigned short  mr_type;
         unsigned short  mr_alen;
@@ -162,7 +160,7 @@ static int packet_set_ring(struct sock *sk, struct tpacket_req *req,
                 int closing, int tx_ring);
 
 struct packet_ring_buffer {
-        char *                  *pg_vec;
+        char                    **pg_vec;
         unsigned int            head;
         unsigned int            frames_per_block;
         unsigned int            frame_size;
@@ -239,7 +237,7 @@ static void __packet_set_status(struct packet_sock *po, void *frame, int status)
                 flush_dcache_page(virt_to_page(&h.h2->tp_status));
                 break;
         default:
-                printk(KERN_ERR "TPACKET version not supported\n");
+                pr_err("TPACKET version not supported\n");
                 BUG();
         }
 
@@ -265,7 +263,7 @@ static int __packet_get_status(struct packet_sock *po, void *frame)
                 flush_dcache_page(virt_to_page(&h.h2->tp_status));
                 return h.h2->tp_status;
         default:
-                printk(KERN_ERR "TPACKET version not supported\n");
+                pr_err("TPACKET version not supported\n");
                 BUG();
                 return 0;
         }
@@ -327,7 +325,7 @@ static void packet_sock_destruct(struct sock *sk)
         WARN_ON(atomic_read(&sk->sk_wmem_alloc));
 
         if (!sock_flag(sk, SOCK_DEAD)) {
-                printk("Attempt to release alive packet socket: %p\n", sk);
+                pr_err("Attempt to release alive packet socket: %p\n", sk);
                 return;
         }
 
@@ -339,7 +337,8 @@ static const struct proto_ops packet_ops;
 
 static const struct proto_ops packet_ops_spkt;
 
-static int packet_rcv_spkt(struct sk_buff *skb, struct net_device *dev,  struct packet_type *pt, struct net_device *orig_dev)
+static int packet_rcv_spkt(struct sk_buff *skb, struct net_device *dev,
+                           struct packet_type *pt, struct net_device *orig_dev)
 {
         struct sock *sk;
         struct sockaddr_pkt *spkt;
@@ -368,7 +367,8 @@ static int packet_rcv_spkt(struct sk_buff *skb, struct net_device *dev,  struct
         if (dev_net(dev) != sock_net(sk))
                 goto out;
 
-        if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL)
+        skb = skb_share_check(skb, GFP_ATOMIC);
+        if (skb == NULL)
                 goto oom;
 
         /* drop any routing info */
@@ -394,7 +394,7 @@ static int packet_rcv_spkt(struct sk_buff *skb, struct net_device *dev,  struct
          *      to prevent sockets using all the memory up.
          */
 
-        if (sock_queue_rcv_skb(sk,skb) == 0)
+        if (sock_queue_rcv_skb(sk, skb) == 0)
                 return 0;
 
 out:
@@ -413,25 +413,23 @@ static int packet_sendmsg_spkt(struct kiocb *iocb, struct socket *sock,
                                struct msghdr *msg, size_t len)
 {
         struct sock *sk = sock->sk;
-        struct sockaddr_pkt *saddr=(struct sockaddr_pkt *)msg->msg_name;
+        struct sockaddr_pkt *saddr = (struct sockaddr_pkt *)msg->msg_name;
         struct sk_buff *skb;
         struct net_device *dev;
-        __be16 proto=0;
+        __be16 proto = 0;
         int err;
 
         /*
          *      Get and verify the address.
          */
 
-        if (saddr)
-        {
+        if (saddr) {
                 if (msg->msg_namelen < sizeof(struct sockaddr))
-                        return(-EINVAL);
-                if (msg->msg_namelen==sizeof(struct sockaddr_pkt))
-                        proto=saddr->spkt_protocol;
-        }
-        else
-                return(-ENOTCONN);      /* SOCK_PACKET must be sent giving an address */
+                        return -EINVAL;
+                if (msg->msg_namelen == sizeof(struct sockaddr_pkt))
+                        proto = saddr->spkt_protocol;
+        } else
+                return -ENOTCONN;       /* SOCK_PACKET must be sent giving an address */
 
         /*
          *      Find the device first to size check it
@@ -448,8 +446,8 @@ static int packet_sendmsg_spkt(struct kiocb *iocb, struct socket *sock,
                 goto out_unlock;
 
         /*
-         *      You may not queue a frame bigger than the mtu. This is the lowest level
-         *      raw protocol and you must do your own fragmentation at this level.
+         * You may not queue a frame bigger than the mtu. This is the lowest level
+         * raw protocol and you must do your own fragmentation at this level.
          */
 
         err = -EMSGSIZE;
@@ -460,9 +458,9 @@ static int packet_sendmsg_spkt(struct kiocb *iocb, struct socket *sock,
         skb = sock_wmalloc(sk, len + LL_RESERVED_SPACE(dev), 0, GFP_KERNEL);
 
         /*
-         *      If the write buffer is full, then tough. At this level the user gets to
-         *      deal with the problem - do your own algorithmic backoffs. That's far
-         *      more flexible.
+         * If the write buffer is full, then tough. At this level the user
+         * gets to deal with the problem - do your own algorithmic backoffs.
+         * That's far more flexible.
          */
 
         if (skb == NULL)
@@ -488,7 +486,7 @@ static int packet_sendmsg_spkt(struct kiocb *iocb, struct socket *sock,
         }
 
         /* Returns -EFAULT on error */
-        err = memcpy_fromiovec(skb_put(skb,len), msg->msg_iov, len);
+        err = memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len);
         skb->protocol = proto;
         skb->dev = dev;
         skb->priority = sk->sk_priority;
@@ -501,7 +499,7 @@ static int packet_sendmsg_spkt(struct kiocb *iocb, struct socket *sock,
 
         dev_queue_xmit(skb);
         dev_put(dev);
-        return(len);
+        return len;
 
 out_free:
         kfree_skb(skb);
@@ -537,12 +535,13 @@ static inline unsigned int run_filter(struct sk_buff *skb, struct sock *sk,
    we will not harm anyone.
  */
 
-static int packet_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt, struct net_device *orig_dev)
+static int packet_rcv(struct sk_buff *skb, struct net_device *dev,
+                      struct packet_type *pt, struct net_device *orig_dev)
 {
         struct sock *sk;
         struct sockaddr_ll *sll;
         struct packet_sock *po;
-        u8 * skb_head = skb->data;
+        u8 *skb_head = skb->data;
         int skb_len = skb->len;
         unsigned int snaplen, res;
 
@@ -648,7 +647,8 @@ drop:
 }
 
 #ifdef CONFIG_PACKET_MMAP
-static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt, struct net_device *orig_dev)
+static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev,
+                       struct packet_type *pt, struct net_device *orig_dev)
 {
         struct sock *sk;
         struct packet_sock *po;
@@ -658,7 +658,7 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, struct packe
                 struct tpacket2_hdr *h2;
                 void *raw;
         } h;
-        u8 * skb_head = skb->data;
+        u8 *skb_head = skb->data;
         int skb_len = skb->len;
         unsigned int snaplen, res;
         unsigned long status = TP_STATUS_LOSING|TP_STATUS_USER;
@@ -821,7 +821,7 @@ ring_is_full:
 static void tpacket_destruct_skb(struct sk_buff *skb)
 {
         struct packet_sock *po = pkt_sk(skb->sk);
-        void * ph;
+        void *ph;
 
         BUG_ON(skb == NULL);
 
@@ -836,9 +836,9 @@ static void tpacket_destruct_skb(struct sk_buff *skb)
         sock_wfree(skb);
 }
 
-static int tpacket_fill_skb(struct packet_sock *po, struct sk_buff * skb,
-                void * frame, struct net_device *dev, int size_max,
-                __be16 proto, unsigned char * addr)
+static int tpacket_fill_skb(struct packet_sock *po, struct sk_buff *skb,
+                void *frame, struct net_device *dev, int size_max,
+                __be16 proto, unsigned char *addr)
 {
         union {
                 struct tpacket_hdr *h1;
@@ -867,8 +867,7 @@ static int tpacket_fill_skb(struct packet_sock *po, struct sk_buff * skb,
                 break;
         }
         if (unlikely(tp_len > size_max)) {
-                printk(KERN_ERR "packet size is too long (%d > %d)\n",
-                                tp_len, size_max);
+                pr_err("packet size is too long (%d > %d)\n", tp_len, size_max);
                 return -EMSGSIZE;
         }
 
@@ -883,12 +882,11 @@ static int tpacket_fill_skb(struct packet_sock *po, struct sk_buff * skb,
                                 NULL, tp_len);
                 if (unlikely(err < 0))
                         return -EINVAL;
-        } else if (dev->hard_header_len ) {
+        } else if (dev->hard_header_len) {
                 /* net device doesn't like empty head */
                 if (unlikely(tp_len <= dev->hard_header_len)) {
-                        printk(KERN_ERR "packet size is too short "
-                                        "(%d < %d)\n", tp_len,
-                                        dev->hard_header_len);
+                        pr_err("packet size is too short (%d < %d)\n",
+                               tp_len, dev->hard_header_len);
                         return -EINVAL;
                 }
 
@@ -917,9 +915,8 @@ static int tpacket_fill_skb(struct packet_sock *po, struct sk_buff * skb,
                 nr_frags = skb_shinfo(skb)->nr_frags;
 
                 if (unlikely(nr_frags >= MAX_SKB_FRAGS)) {
-                        printk(KERN_ERR "Packet exceed the number "
-                                        "of skb frags(%lu)\n",
-                                        MAX_SKB_FRAGS);
+                        pr_err("Packet exceed the number of skb frags(%lu)\n",
+                               MAX_SKB_FRAGS);
                         return -EFAULT;
                 }
 
@@ -944,8 +941,8 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
         struct net_device *dev;
         __be16 proto;
         int ifindex, err, reserve = 0;
-        void * ph;
-        struct sockaddr_ll *saddr=(struct sockaddr_ll *)msg->msg_name;
+        void *ph;
+        struct sockaddr_ll *saddr = (struct sockaddr_ll *)msg->msg_name;
         int tp_len, size_max;
         unsigned char *addr;
         int len_sum = 0;
@@ -1038,8 +1035,7 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
                         goto out_xmit;
                 packet_increment_head(&po->tx_ring);
                 len_sum += tp_len;
-        }
-        while (likely((ph != NULL) || ((!(msg->msg_flags & MSG_DONTWAIT))
+        } while (likely((ph != NULL) || ((!(msg->msg_flags & MSG_DONTWAIT))
                                         && (atomic_read(&po->tx_ring.pending))))
               );
 
@@ -1064,7 +1060,7 @@ static int packet_snd(struct socket *sock,
                           struct msghdr *msg, size_t len)
 {
         struct sock *sk = sock->sk;
-        struct sockaddr_ll *saddr=(struct sockaddr_ll *)msg->msg_name;
+        struct sockaddr_ll *saddr = (struct sockaddr_ll *)msg->msg_name;
         struct sk_buff *skb;
         struct net_device *dev;
         __be16 proto;
@@ -1110,7 +1106,7 @@ static int packet_snd(struct socket *sock,
 
         skb = sock_alloc_send_skb(sk, len + LL_ALLOCATED_SPACE(dev),
                                 msg->msg_flags & MSG_DONTWAIT, &err);
-        if (skb==NULL)
+        if (skb == NULL)
                 goto out_unlock;
 
         skb_reserve(skb, LL_RESERVED_SPACE(dev));
@@ -1122,7 +1118,7 @@ static int packet_snd(struct socket *sock,
                 goto out_free;
 
         /* Returns -EFAULT on error */
-        err = memcpy_fromiovec(skb_put(skb,len), msg->msg_iov, len);
+        err = memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len);
         if (err)
                 goto out_free;
 
@@ -1140,7 +1136,7 @@ static int packet_snd(struct socket *sock,
 
         dev_put(dev);
 
-        return(len);
+        return len;
 
 out_free:
         kfree_skb(skb);
@@ -1283,9 +1279,10 @@ out_unlock:
  *      Bind a packet socket to a device
  */
 
-static int packet_bind_spkt(struct socket *sock, struct sockaddr *uaddr, int addr_len)
+static int packet_bind_spkt(struct socket *sock, struct sockaddr *uaddr,
+                            int addr_len)
 {
-        struct sock *sk=sock->sk;
+        struct sock *sk = sock->sk;
         char name[15];
         struct net_device *dev;
         int err = -ENODEV;
@@ -1296,7 +1293,7 @@ static int packet_bind_spkt(struct socket *sock, struct sockaddr *uaddr, int add
 
         if (addr_len != sizeof(struct sockaddr))
                 return -EINVAL;
-        strlcpy(name,uaddr->sa_data,sizeof(name));
+        strlcpy(name, uaddr->sa_data, sizeof(name));
 
         dev = dev_get_by_name(sock_net(sk), name);
         if (dev) {
@@ -1308,8 +1305,8 @@ static int packet_bind_spkt(struct socket *sock, struct sockaddr *uaddr, int add
 
 static int packet_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
 {
-        struct sockaddr_ll *sll = (struct sockaddr_ll*)uaddr;
-        struct sock *sk=sock->sk;
+        struct sockaddr_ll *sll = (struct sockaddr_ll *)uaddr;
+        struct sock *sk = sock->sk;
         struct net_device *dev = NULL;
         int err;
 
@@ -1404,7 +1401,7 @@ static int packet_create(struct net *net, struct socket *sock, int protocol)
         sk_add_node(sk, &net->packet.sklist);
         sock_prot_inuse_add(net, &packet_proto, 1);
         write_unlock_bh(&net->packet.sklist_lock);
-        return(0);
+        return 0;
 out:
         return err;
 }
@@ -1441,7 +1438,7 @@ static int packet_recvmsg(struct kiocb *iocb, struct socket *sock,
          *      but then it will block.
          */
 
-        skb=skb_recv_datagram(sk,flags,flags&MSG_DONTWAIT,&err);
+        skb = skb_recv_datagram(sk, flags, flags & MSG_DONTWAIT, &err);
 
         /*
          *      An error occurred so return it. Because skb_recv_datagram()
@@ -1469,10 +1466,9 @@ static int packet_recvmsg(struct kiocb *iocb, struct socket *sock,
          */
 
         copied = skb->len;
-        if (copied > len)
-        {
-                copied=len;
-                msg->msg_flags|=MSG_TRUNC;
+        if (copied > len) {
+                copied = len;
+                msg->msg_flags |= MSG_TRUNC;
         }
 
         err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
@@ -1539,7 +1535,7 @@ static int packet_getname(struct socket *sock, struct sockaddr *uaddr,
         struct net_device *dev;
         struct sock *sk = sock->sk;
         struct packet_sock *po = pkt_sk(sk);
-        struct sockaddr_ll *sll = (struct sockaddr_ll*)uaddr;
+        struct sockaddr_ll *sll = (struct sockaddr_ll *)uaddr;
 
         if (peer)
                 return -EOPNOTSUPP;
@@ -1584,14 +1580,15 @@ static int packet_dev_mc(struct net_device *dev, struct packet_mclist *i,
                 else
                         return dev_unicast_delete(dev, i->addr);
                 break;
-        default:;
+        default:
+                break;
         }
         return 0;
 }
 
 static void packet_dev_mclist(struct net_device *dev, struct packet_mclist *i, int what)
 {
-        for ( ; i; i=i->next) {
+        for ( ; i; i = i->next) {
                 if (i->ifindex == dev->ifindex)
                         packet_dev_mc(dev, i, what);
         }
@@ -1693,7 +1690,8 @@ static void packet_flush_mclist(struct sock *sk)
                 struct net_device *dev;
 
                 po->mclist = ml->next;
-                if ((dev = dev_get_by_index(sock_net(sk), ml->ifindex)) != NULL) {
+                dev = dev_get_by_index(sock_net(sk), ml->ifindex);
+                if (dev != NULL) {
                         packet_dev_mc(dev, ml, -1);
                         dev_put(dev);
                 }
@@ -1723,7 +1721,7 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv
                         return -EINVAL;
                 if (len > sizeof(mreq))
                         len = sizeof(mreq);
-                if (copy_from_user(&mreq,optval,len))
+                if (copy_from_user(&mreq, optval, len))
                         return -EFAULT;
                 if (len < (mreq.mr_alen + offsetof(struct packet_mreq, mr_address)))
                         return -EINVAL;
@@ -1740,9 +1738,9 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv
         {
                 struct tpacket_req req;
 
-                if (optlen<sizeof(req))
+                if (optlen < sizeof(req))
                         return -EINVAL;
-                if (copy_from_user(&req,optval,sizeof(req)))
+                if (copy_from_user(&req, optval, sizeof(req)))
                         return -EFAULT;
                 return packet_set_ring(sk, &req, 0, optname == PACKET_TX_RING);
         }
@@ -1750,9 +1748,9 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv
         {
                 int val;
 
-                if (optlen!=sizeof(val))
+                if (optlen != sizeof(val))
                         return -EINVAL;
-                if (copy_from_user(&val,optval,sizeof(val)))
+                if (copy_from_user(&val, optval, sizeof(val)))
                         return -EFAULT;
 
                 pkt_sk(sk)->copy_thresh = val;
@@ -1985,51 +1983,51 @@ static int packet_ioctl(struct socket *sock, unsigned int cmd,
         struct sock *sk = sock->sk;
 
         switch (cmd) {
-                case SIOCOUTQ:
-                {
-                        int amount = sk_wmem_alloc_get(sk);
+        case SIOCOUTQ:
+        {
+                int amount = sk_wmem_alloc_get(sk);
 
-                        return put_user(amount, (int __user *)arg);
-                }
-                case SIOCINQ:
-                {
-                        struct sk_buff *skb;
-                        int amount = 0;
-
-                        spin_lock_bh(&sk->sk_receive_queue.lock);
-                        skb = skb_peek(&sk->sk_receive_queue);
-                        if (skb)
-                                amount = skb->len;
-                        spin_unlock_bh(&sk->sk_receive_queue.lock);
-                        return put_user(amount, (int __user *)arg);
-                }
-                case SIOCGSTAMP:
-                        return sock_get_timestamp(sk, (struct timeval __user *)arg);
-                case SIOCGSTAMPNS:
-                        return sock_get_timestampns(sk, (struct timespec __user *)arg);
+                return put_user(amount, (int __user *)arg);
+        }
+        case SIOCINQ:
+        {
+                struct sk_buff *skb;
+                int amount = 0;
+
+                spin_lock_bh(&sk->sk_receive_queue.lock);
+                skb = skb_peek(&sk->sk_receive_queue);
+                if (skb)
+                        amount = skb->len;
+                spin_unlock_bh(&sk->sk_receive_queue.lock);
+                return put_user(amount, (int __user *)arg);
+        }
+        case SIOCGSTAMP:
+                return sock_get_timestamp(sk, (struct timeval __user *)arg);
+        case SIOCGSTAMPNS:
+                return sock_get_timestampns(sk, (struct timespec __user *)arg);
 
 #ifdef CONFIG_INET
-                case SIOCADDRT:
-                case SIOCDELRT:
-                case SIOCDARP:
-                case SIOCGARP:
-                case SIOCSARP:
-                case SIOCGIFADDR:
-                case SIOCSIFADDR:
-                case SIOCGIFBRDADDR:
-                case SIOCSIFBRDADDR:
-                case SIOCGIFNETMASK:
-                case SIOCSIFNETMASK:
-                case SIOCGIFDSTADDR:
-                case SIOCSIFDSTADDR:
-                case SIOCSIFFLAGS:
-                        if (!net_eq(sock_net(sk), &init_net))
-                                return -ENOIOCTLCMD;
-                        return inet_dgram_ops.ioctl(sock, cmd, arg);
+        case SIOCADDRT:
+        case SIOCDELRT:
+        case SIOCDARP:
+        case SIOCGARP:
+        case SIOCSARP:
+        case SIOCGIFADDR:
+        case SIOCSIFADDR:
+        case SIOCGIFBRDADDR:
+        case SIOCSIFBRDADDR:
+        case SIOCGIFNETMASK:
+        case SIOCSIFNETMASK:
+        case SIOCGIFDSTADDR:
+        case SIOCSIFDSTADDR:
+        case SIOCSIFFLAGS:
+                if (!net_eq(sock_net(sk), &init_net))
+                        return -ENOIOCTLCMD;
+                return inet_dgram_ops.ioctl(sock, cmd, arg);
 #endif
 
-                default:
-                        return -ENOIOCTLCMD;
+        default:
+                return -ENOIOCTLCMD;
         }
         return 0;
 }
@@ -2039,7 +2037,7 @@ static int packet_ioctl(struct socket *sock, unsigned int cmd,
 #define packet_poll datagram_poll
 #else
 
-static unsigned int packet_poll(struct file * file, struct socket *sock,
+static unsigned int packet_poll(struct file *file, struct socket *sock,
                                 poll_table *wait)
 {
         struct sock *sk = sock->sk;
@@ -2069,7 +2067,7 @@ static unsigned int packet_poll(struct file * file, struct socket *sock,
 static void packet_mm_open(struct vm_area_struct *vma)
 {
         struct file *file = vma->vm_file;
-        struct socket * sock = file->private_data;
+        struct socket *sock = file->private_data;
         struct sock *sk = sock->sk;
 
         if (sk)
@@ -2079,7 +2077,7 @@ static void packet_mm_open(struct vm_area_struct *vma)
 static void packet_mm_close(struct vm_area_struct *vma)
 {
         struct file *file = vma->vm_file;
-        struct socket * sock = file->private_data;
+        struct socket *sock = file->private_data;
         struct sock *sk = sock->sk;
 
         if (sk)
@@ -2087,8 +2085,8 @@ static void packet_mm_close(struct vm_area_struct *vma)
 }
 
 static struct vm_operations_struct packet_mmap_ops = {
-        .open = packet_mm_open,
-        .close =packet_mm_close,
+        .open   =       packet_mm_open,
+        .close  =       packet_mm_close,
 };
 
 static void free_pg_vec(char **pg_vec, unsigned int order, unsigned int len)
@@ -2239,8 +2237,8 @@ static int packet_set_ring(struct sock *sk, struct tpacket_req *req,
                 skb_queue_purge(rb_queue);
 #undef XC
                 if (atomic_read(&po->mapped))
-                        printk(KERN_DEBUG "packet_mmap: vma is busy: %d\n",
-                                                atomic_read(&po->mapped));
+                        pr_err("packet_mmap: vma is busy: %d\n",
+                               atomic_read(&po->mapped));
         }
         mutex_unlock(&po->pg_vec_lock);
 
@@ -2303,7 +2301,7 @@ static int packet_mmap(struct file *file, struct socket *sock,
                         int pg_num;
 
                         for (pg_num = 0; pg_num < rb->pg_vec_pages;
-                                        pg_num++,page++) {
+                                        pg_num++, page++) {
                                 err = vm_insert_page(vma, start, page);
                                 if (unlikely(err))
                                         goto out;
@@ -2372,7 +2370,7 @@ static struct net_proto_family packet_family_ops = {
 };
 
 static struct notifier_block packet_netdev_notifier = {
-        .notifier_call =packet_notifier,
+        .notifier_call =        packet_notifier,
 };
 
 #ifdef CONFIG_PROC_FS
@@ -2402,7 +2400,7 @@ static void *packet_seq_next(struct seq_file *seq, void *v, loff_t *pos)
         ++*pos;
         return  (v == SEQ_START_TOKEN)
                 ? sk_head(&net->packet.sklist)
-                : sk_next((struct sock*)v) ;
+                : sk_next((struct sock *)v) ;
 }
 
 static void packet_seq_stop(struct seq_file *seq, void *v)
@@ -2430,7 +2428,7 @@ static int packet_seq_show(struct seq_file *seq, void *v)
                            po->running,
                            atomic_read(&s->sk_rmem_alloc),
                            sock_i_uid(s),
-                           sock_i_ino(s) );
+                           sock_i_ino(s));
         }
 
         return 0;
diff --git a/net/phonet/datagram.c b/net/phonet/datagram.c
index e087862ed7e4..ef5c75c372e4 100644
--- a/net/phonet/datagram.c
+++ b/net/phonet/datagram.c
@@ -159,8 +159,11 @@ out_nofree:
 static int pn_backlog_rcv(struct sock *sk, struct sk_buff *skb)
 {
         int err = sock_queue_rcv_skb(sk, skb);
-        if (err < 0)
+        if (err < 0) {
                 kfree_skb(skb);
+                if (err == -ENOMEM)
+                        atomic_inc(&sk->sk_drops);
+        }
         return err ? NET_RX_DROP : NET_RX_SUCCESS;
 }
 
diff --git a/net/phonet/pep-gprs.c b/net/phonet/pep-gprs.c
index 480839dfc560..4667af51ed71 100644
--- a/net/phonet/pep-gprs.c
+++ b/net/phonet/pep-gprs.c
@@ -195,7 +195,7 @@ static int gprs_xmit(struct sk_buff *skb, struct net_device *dev)
                 break;
         default:
                 dev_kfree_skb(skb);
-                return 0;
+                return NETDEV_TX_OK;
         }
 
         skb_orphan(skb);
@@ -215,7 +215,7 @@ static int gprs_xmit(struct sk_buff *skb, struct net_device *dev)
         netif_stop_queue(dev);
         if (pep_writeable(sk))
                 netif_wake_queue(dev);
-        return 0;
+        return NETDEV_TX_OK;
 }
 
 static int gprs_set_mtu(struct net_device *dev, int new_mtu)
diff --git a/net/phonet/pep.c b/net/phonet/pep.c
index eef833ea6d7b..b8252d289cd7 100644
--- a/net/phonet/pep.c
+++ b/net/phonet/pep.c
@@ -346,8 +346,10 @@ static int pipe_do_rcv(struct sock *sk, struct sk_buff *skb)
                 break;
 
         case PNS_PEP_CTRL_REQ:
-                if (skb_queue_len(&pn->ctrlreq_queue) >= PNPIPE_CTRLREQ_MAX)
+                if (skb_queue_len(&pn->ctrlreq_queue) >= PNPIPE_CTRLREQ_MAX) {
+                        atomic_inc(&sk->sk_drops);
                         break;
+                }
                 __skb_pull(skb, 4);
                 queue = &pn->ctrlreq_queue;
                 goto queue;
@@ -358,10 +360,13 @@ static int pipe_do_rcv(struct sock *sk, struct sk_buff *skb)
                         err = sock_queue_rcv_skb(sk, skb);
                         if (!err)
                                 return 0;
+                        if (err == -ENOMEM)
+                                atomic_inc(&sk->sk_drops);
                         break;
                 }
 
                 if (pn->rx_credits == 0) {
+                        atomic_inc(&sk->sk_drops);
                         err = -ENOBUFS;
                         break;
                 }
diff --git a/net/phonet/pn_dev.c b/net/phonet/pn_dev.c
index b0d6ddd82a9d..5ae4c01e8388 100644
--- a/net/phonet/pn_dev.c
+++ b/net/phonet/pn_dev.c
@@ -27,6 +27,7 @@
 #include <linux/net.h>
 #include <linux/netdevice.h>
 #include <linux/phonet.h>
+#include <linux/proc_fs.h>
 #include <net/sock.h>
 #include <net/netns/generic.h>
 #include <net/phonet/pn_dev.h>
@@ -96,7 +97,7 @@ struct net_device *phonet_device_get(struct net *net)
 {
         struct phonet_device_list *pndevs = phonet_device_list(net);
         struct phonet_device *pnd;
-        struct net_device *dev;
+        struct net_device *dev = NULL;
 
         spin_lock_bh(&pndevs->lock);
         list_for_each_entry(pnd, &pndevs->list, list) {
@@ -218,6 +219,11 @@ static int phonet_init_net(struct net *net)
         if (!pnn)
                 return -ENOMEM;
 
+        if (!proc_net_fops_create(net, "phonet", 0, &pn_sock_seq_fops)) {
+                kfree(pnn);
+                return -ENOMEM;
+        }
+
         INIT_LIST_HEAD(&pnn->pndevs.list);
         spin_lock_init(&pnn->pndevs.lock);
         net_assign_generic(net, phonet_net_id, pnn);
@@ -233,6 +239,8 @@ static void phonet_exit_net(struct net *net)
         for_each_netdev(net, dev)
                 phonet_device_destroy(dev);
         rtnl_unlock();
+
+        proc_net_remove(net, "phonet");
         kfree(pnn);
 }
 
diff --git a/net/phonet/socket.c b/net/phonet/socket.c
index ada2a35bf7a2..aa1617a7f265 100644
--- a/net/phonet/socket.c
+++ b/net/phonet/socket.c
@@ -412,3 +412,99 @@ found:
         return 0;
 }
 EXPORT_SYMBOL(pn_sock_get_port);
+
+static struct sock *pn_sock_get_idx(struct seq_file *seq, loff_t pos)
+{
+        struct net *net = seq_file_net(seq);
+        struct hlist_node *node;
+        struct sock *sknode;
+
+        sk_for_each(sknode, node, &pnsocks.hlist) {
+                if (!net_eq(net, sock_net(sknode)))
+                        continue;
+                if (!pos)
+                        return sknode;
+                pos--;
+        }
+        return NULL;
+}
+
+static struct sock *pn_sock_get_next(struct seq_file *seq, struct sock *sk)
+{
+        struct net *net = seq_file_net(seq);
+
+        do
+                sk = sk_next(sk);
+        while (sk && !net_eq(net, sock_net(sk)));
+
+        return sk;
+}
+
+static void *pn_sock_seq_start(struct seq_file *seq, loff_t *pos)
+        __acquires(pnsocks.lock)
+{
+        spin_lock_bh(&pnsocks.lock);
+        return *pos ? pn_sock_get_idx(seq, *pos - 1) : SEQ_START_TOKEN;
+}
+
+static void *pn_sock_seq_next(struct seq_file *seq, void *v, loff_t *pos)
+{
+        struct sock *sk;
+
+        if (v == SEQ_START_TOKEN)
+                sk = pn_sock_get_idx(seq, 0);
+        else
+                sk = pn_sock_get_next(seq, v);
+        (*pos)++;
+        return sk;
+}
+
+static void pn_sock_seq_stop(struct seq_file *seq, void *v)
+        __releases(pnsocks.lock)
+{
+        spin_unlock_bh(&pnsocks.lock);
+}
+
+static int pn_sock_seq_show(struct seq_file *seq, void *v)
+{
+        int len;
+
+        if (v == SEQ_START_TOKEN)
+                seq_printf(seq, "%s%n", "pt  loc  rem rs st tx_queue rx_queue "
+                        "  uid inode ref pointer drops", &len);
+        else {
+                struct sock *sk = v;
+                struct pn_sock *pn = pn_sk(sk);
+
+                seq_printf(seq, "%2d %04X:%04X:%02X %02X %08X:%08X %5d %lu "
+                        "%d %p %d%n",
+                        sk->sk_protocol, pn->sobject, 0, pn->resource,
+                        sk->sk_state,
+                        sk_wmem_alloc_get(sk), sk_rmem_alloc_get(sk),
+                        sock_i_uid(sk), sock_i_ino(sk),
+                        atomic_read(&sk->sk_refcnt), sk,
+                        atomic_read(&sk->sk_drops), &len);
+        }
+        seq_printf(seq, "%*s\n", 127 - len, "");
+        return 0;
+}
+
+static const struct seq_operations pn_sock_seq_ops = {
+        .start = pn_sock_seq_start,
+        .next = pn_sock_seq_next,
+        .stop = pn_sock_seq_stop,
+        .show = pn_sock_seq_show,
+};
+
+static int pn_sock_open(struct inode *inode, struct file *file)
+{
+        return seq_open(file, &pn_sock_seq_ops);
+}
+
+const struct file_operations pn_sock_seq_fops = {
+        .owner = THIS_MODULE,
+        .open = pn_sock_open,
+        .read = seq_read,
+        .llseek = seq_lseek,
+        .release = seq_release,
+};
diff --git a/net/rds/connection.c b/net/rds/connection.c
index d14445c48304..b420a20d84fd 100644
--- a/net/rds/connection.c
+++ b/net/rds/connection.c
@@ -126,7 +126,7 @@ static struct rds_connection *__rds_conn_create(__be32 laddr, __be32 faddr,
                                        struct rds_transport *trans, gfp_t gfp,
                                        int is_outgoing)
 {
-        struct rds_connection *conn, *tmp, *parent = NULL;
+        struct rds_connection *conn, *parent = NULL;
         struct hlist_head *head = rds_conn_bucket(laddr, faddr);
         unsigned long flags;
         int ret;
@@ -155,7 +155,6 @@ static struct rds_connection *__rds_conn_create(__be32 laddr, __be32 faddr,
         }
 
         INIT_HLIST_NODE(&conn->c_hash_node);
-        conn->c_version = RDS_PROTOCOL_3_0;
         conn->c_laddr = laddr;
         conn->c_faddr = faddr;
         spin_lock_init(&conn->c_lock);
@@ -211,26 +210,40 @@ static struct rds_connection *__rds_conn_create(__be32 laddr, __be32 faddr,
           trans->t_name ? trans->t_name : "[unknown]",
           is_outgoing ? "(outgoing)" : "");
 
+        /*
+         * Since we ran without holding the conn lock, someone could
+         * have created the same conn (either normal or passive) in the
+         * interim. We check while holding the lock. If we won, we complete
+         * init and return our conn. If we lost, we rollback and return the
+         * other one.
+         */
         spin_lock_irqsave(&rds_conn_lock, flags);
-        if (parent == NULL) {
-                tmp = rds_conn_lookup(head, laddr, faddr, trans);
-                if (tmp == NULL)
-                        hlist_add_head(&conn->c_hash_node, head);
-        } else {
-                tmp = parent->c_passive;
-                if (!tmp)
+        if (parent) {
+                /* Creating passive conn */
+                if (parent->c_passive) {
+                        trans->conn_free(conn->c_transport_data);
+                        kmem_cache_free(rds_conn_slab, conn);
+                        conn = parent->c_passive;
+                } else {
                         parent->c_passive = conn;
-        }
-
-        if (tmp) {
-                trans->conn_free(conn->c_transport_data);
-                kmem_cache_free(rds_conn_slab, conn);
-                conn = tmp;
+                        rds_cong_add_conn(conn);
+                        rds_conn_count++;
+                }
         } else {
-                rds_cong_add_conn(conn);
-                rds_conn_count++;
+                /* Creating normal conn */
+                struct rds_connection *found;
+
+                found = rds_conn_lookup(head, laddr, faddr, trans);
+                if (found) {
+                        trans->conn_free(conn->c_transport_data);
+                        kmem_cache_free(rds_conn_slab, conn);
+                        conn = found;
+                } else {
+                        hlist_add_head(&conn->c_hash_node, head);
+                        rds_cong_add_conn(conn);
+                        rds_conn_count++;
+                }
         }
-
         spin_unlock_irqrestore(&rds_conn_lock, flags);
 
 out:
diff --git a/net/rds/ib.c b/net/rds/ib.c
index b9bcd32431e1..868559ac42d7 100644
--- a/net/rds/ib.c
+++ b/net/rds/ib.c
@@ -43,11 +43,14 @@
 
 unsigned int fmr_pool_size = RDS_FMR_POOL_SIZE;
 unsigned int fmr_message_size = RDS_FMR_SIZE + 1; /* +1 allows for unaligned MRs */
+unsigned int rds_ib_retry_count = RDS_IB_DEFAULT_RETRY_COUNT;
 
 module_param(fmr_pool_size, int, 0444);
 MODULE_PARM_DESC(fmr_pool_size, " Max number of fmr per HCA");
 module_param(fmr_message_size, int, 0444);
 MODULE_PARM_DESC(fmr_message_size, " Max size of a RDMA transfer");
+module_param(rds_ib_retry_count, int, 0444);
+MODULE_PARM_DESC(rds_ib_retry_count, " Number of hw retries before reporting an error");
 
 struct list_head rds_ib_devices;
 
@@ -82,9 +85,6 @@ void rds_ib_add_one(struct ib_device *device)
         rds_ibdev->max_wrs = dev_attr->max_qp_wr;
         rds_ibdev->max_sge = min(dev_attr->max_sge, RDS_IB_MAX_SGE);
 
-        rds_ibdev->fmr_page_shift = max(9, ffs(dev_attr->page_size_cap) - 1);
-        rds_ibdev->fmr_page_size  = 1 << rds_ibdev->fmr_page_shift;
-        rds_ibdev->fmr_page_mask  = ~((u64) rds_ibdev->fmr_page_size - 1);
         rds_ibdev->fmr_max_remaps = dev_attr->max_map_per_fmr?: 32;
         rds_ibdev->max_fmrs = dev_attr->max_fmr ?
                         min_t(unsigned int, dev_attr->max_fmr, fmr_pool_size) :
diff --git a/net/rds/ib.h b/net/rds/ib.h
index 455ae73047fe..1378b854cac0 100644
--- a/net/rds/ib.h
+++ b/net/rds/ib.h
@@ -15,6 +15,8 @@
 #define RDS_IB_DEFAULT_RECV_WR          1024
 #define RDS_IB_DEFAULT_SEND_WR          256
 
+#define RDS_IB_DEFAULT_RETRY_COUNT      2
+
 #define RDS_IB_SUPPORTED_PROTOCOLS      0x00000003      /* minor versions supported */
 
 extern struct list_head rds_ib_devices;
@@ -157,9 +159,6 @@ struct rds_ib_device {
         struct ib_pd            *pd;
         struct ib_mr            *mr;
         struct rds_ib_mr_pool   *mr_pool;
-        int                     fmr_page_shift;
-        int                     fmr_page_size;
-        u64                     fmr_page_mask;
         unsigned int            fmr_max_remaps;
         unsigned int            max_fmrs;
         int                     max_sge;
@@ -247,6 +246,7 @@ extern struct ib_client rds_ib_client;
 
 extern unsigned int fmr_pool_size;
 extern unsigned int fmr_message_size;
+extern unsigned int rds_ib_retry_count;
 
 extern spinlock_t ib_nodev_conns_lock;
 extern struct list_head ib_nodev_conns;
@@ -355,17 +355,25 @@ extern ctl_table rds_ib_sysctl_table[];
 /*
  * Helper functions for getting/setting the header and data SGEs in
  * RDS packets (not RDMA)
+ *
+ * From version 3.1 onwards, header is in front of data in the sge.
  */
 static inline struct ib_sge *
 rds_ib_header_sge(struct rds_ib_connection *ic, struct ib_sge *sge)
 {
-        return &sge[0];
+        if (ic->conn->c_version > RDS_PROTOCOL_3_0)
+                return &sge[0];
+        else
+                return &sge[1];
 }
 
 static inline struct ib_sge *
 rds_ib_data_sge(struct rds_ib_connection *ic, struct ib_sge *sge)
 {
-        return &sge[1];
+        if (ic->conn->c_version > RDS_PROTOCOL_3_0)
+                return &sge[1];
+        else
+                return &sge[0];
 }
 
 #endif
diff --git a/net/rds/ib_cm.c b/net/rds/ib_cm.c
index f8e40e1a6038..c2d372f13dbb 100644
--- a/net/rds/ib_cm.c
+++ b/net/rds/ib_cm.c
@@ -98,21 +98,34 @@ void rds_ib_cm_connect_complete(struct rds_connection *conn, struct rdma_cm_even
         struct ib_qp_attr qp_attr;
         int err;
 
-        if (event->param.conn.private_data_len) {
+        if (event->param.conn.private_data_len >= sizeof(*dp)) {
                 dp = event->param.conn.private_data;
 
-                rds_ib_set_protocol(conn,
+                /* make sure it isn't empty data */
+                if (dp->dp_protocol_major) {
+                        rds_ib_set_protocol(conn,
                                 RDS_PROTOCOL(dp->dp_protocol_major,
-                                        dp->dp_protocol_minor));
-                rds_ib_set_flow_control(conn, be32_to_cpu(dp->dp_credit));
+                                dp->dp_protocol_minor));
+                        rds_ib_set_flow_control(conn, be32_to_cpu(dp->dp_credit));
+                }
         }
 
         printk(KERN_NOTICE "RDS/IB: connected to %pI4 version %u.%u%s\n",
-                        &conn->c_laddr,
+                        &conn->c_faddr,
                         RDS_PROTOCOL_MAJOR(conn->c_version),
                         RDS_PROTOCOL_MINOR(conn->c_version),
                         ic->i_flowctl ? ", flow control" : "");
 
+        /*
+         * Init rings and fill recv. this needs to wait until protocol negotiation
+         * is complete, since ring layout is different from 3.0 to 3.1.
+         */
+        rds_ib_send_init_ring(ic);
+        rds_ib_recv_init_ring(ic);
+        /* Post receive buffers - as a side effect, this will update
+         * the posted credit count. */
+        rds_ib_recv_refill(conn, GFP_KERNEL, GFP_HIGHUSER, 1);
+
         /* Tune RNR behavior */
         rds_ib_tune_rnr(ic, &qp_attr);
 
@@ -145,7 +158,7 @@ static void rds_ib_cm_fill_conn_param(struct rds_connection *conn,
         /* XXX tune these? */
         conn_param->responder_resources = 1;
         conn_param->initiator_depth = 1;
-        conn_param->retry_count = 7;
+        conn_param->retry_count = min_t(unsigned int, rds_ib_retry_count, 7);
         conn_param->rnr_retry_count = 7;
 
         if (dp) {
@@ -190,9 +203,9 @@ static void rds_ib_qp_event_handler(struct ib_event *event, void *data)
                 rdma_notify(ic->i_cm_id, IB_EVENT_COMM_EST);
                 break;
         default:
-                printk(KERN_WARNING "RDS/ib: unhandled QP event %u "
-                       "on connection to %pI4\n", event->event,
-                       &conn->c_faddr);
+                rds_ib_conn_error(conn, "RDS/IB: Fatal QP Event %u "
+                        "- connection %pI4->%pI4, reconnecting\n",
+                        event->event, &conn->c_laddr, &conn->c_faddr);
                 break;
         }
 }
@@ -321,7 +334,7 @@ static int rds_ib_setup_qp(struct rds_connection *conn)
                 rdsdebug("send allocation failed\n");
                 goto out;
         }
-        rds_ib_send_init_ring(ic);
+        memset(ic->i_sends, 0, ic->i_send_ring.w_nr * sizeof(struct rds_ib_send_work));
 
         ic->i_recvs = vmalloc(ic->i_recv_ring.w_nr * sizeof(struct rds_ib_recv_work));
         if (ic->i_recvs == NULL) {
@@ -329,14 +342,10 @@ static int rds_ib_setup_qp(struct rds_connection *conn)
                 rdsdebug("recv allocation failed\n");
                 goto out;
         }
+        memset(ic->i_recvs, 0, ic->i_recv_ring.w_nr * sizeof(struct rds_ib_recv_work));
 
-        rds_ib_recv_init_ring(ic);
         rds_ib_recv_init_ack(ic);
 
-        /* Post receive buffers - as a side effect, this will update
-         * the posted credit count. */
-        rds_ib_recv_refill(conn, GFP_KERNEL, GFP_HIGHUSER, 1);
-
         rdsdebug("conn %p pd %p mr %p cq %p %p\n", conn, ic->i_pd, ic->i_mr,
                  ic->i_send_cq, ic->i_recv_cq);
 
@@ -344,19 +353,32 @@ out:
         return ret;
 }
 
-static u32 rds_ib_protocol_compatible(const struct rds_ib_connect_private *dp)
+static u32 rds_ib_protocol_compatible(struct rdma_cm_event *event)
 {
+        const struct rds_ib_connect_private *dp = event->param.conn.private_data;
         u16 common;
         u32 version = 0;
 
-        /* rdma_cm private data is odd - when there is any private data in the
+        /*
+         * rdma_cm private data is odd - when there is any private data in the
          * request, we will be given a pretty large buffer without telling us the
          * original size. The only way to tell the difference is by looking at
          * the contents, which are initialized to zero.
          * If the protocol version fields aren't set, this is a connection attempt
          * from an older version. This could could be 3.0 or 2.0 - we can't tell.
-         * We really should have changed this for OFED 1.3 :-( */
-        if (dp->dp_protocol_major == 0)
+         * We really should have changed this for OFED 1.3 :-(
+         */
+
+        /* Be paranoid. RDS always has privdata */
+        if (!event->param.conn.private_data_len) {
+                printk(KERN_NOTICE "RDS incoming connection has no private data, "
+                        "rejecting\n");
+                return 0;
+        }
+
+        /* Even if len is crap *now* I still want to check it. -ASG */
+        if (event->param.conn.private_data_len < sizeof (*dp)
+            || dp->dp_protocol_major == 0)
                 return RDS_PROTOCOL_3_0;
 
         common = be16_to_cpu(dp->dp_protocol_minor_mask) & RDS_IB_SUPPORTED_PROTOCOLS;
@@ -388,7 +410,7 @@ int rds_ib_cm_handle_connect(struct rdma_cm_id *cm_id,
         int err, destroy = 1;
 
         /* Check whether the remote protocol version matches ours. */
-        version = rds_ib_protocol_compatible(dp);
+        version = rds_ib_protocol_compatible(event);
         if (!version)
                 goto out;
 
diff --git a/net/rds/ib_rdma.c b/net/rds/ib_rdma.c
index 81033af93020..ef3ab5b7283e 100644
--- a/net/rds/ib_rdma.c
+++ b/net/rds/ib_rdma.c
@@ -211,7 +211,7 @@ struct rds_ib_mr_pool *rds_ib_create_mr_pool(struct rds_ib_device *rds_ibdev)
 
         pool->fmr_attr.max_pages = fmr_message_size;
         pool->fmr_attr.max_maps = rds_ibdev->fmr_max_remaps;
-        pool->fmr_attr.page_shift = rds_ibdev->fmr_page_shift;
+        pool->fmr_attr.page_shift = PAGE_SHIFT;
         pool->max_free_pinned = rds_ibdev->max_fmrs * fmr_message_size / 4;
 
         /* We never allow more than max_items MRs to be allocated.
@@ -349,13 +349,13 @@ static int rds_ib_map_fmr(struct rds_ib_device *rds_ibdev, struct rds_ib_mr *ibm
                 unsigned int dma_len = ib_sg_dma_len(dev, &scat[i]);
                 u64 dma_addr = ib_sg_dma_address(dev, &scat[i]);
 
-                if (dma_addr & ~rds_ibdev->fmr_page_mask) {
+                if (dma_addr & ~PAGE_MASK) {
                         if (i > 0)
                                 return -EINVAL;
                         else
                                 ++page_cnt;
                 }
-                if ((dma_addr + dma_len) & ~rds_ibdev->fmr_page_mask) {
+                if ((dma_addr + dma_len) & ~PAGE_MASK) {
                         if (i < sg_dma_len - 1)
                                 return -EINVAL;
                         else
@@ -365,7 +365,7 @@ static int rds_ib_map_fmr(struct rds_ib_device *rds_ibdev, struct rds_ib_mr *ibm
                 len += dma_len;
         }
 
-        page_cnt += len >> rds_ibdev->fmr_page_shift;
+        page_cnt += len >> PAGE_SHIFT;
         if (page_cnt > fmr_message_size)
                 return -EINVAL;
 
@@ -378,9 +378,9 @@ static int rds_ib_map_fmr(struct rds_ib_device *rds_ibdev, struct rds_ib_mr *ibm
                 unsigned int dma_len = ib_sg_dma_len(dev, &scat[i]);
                 u64 dma_addr = ib_sg_dma_address(dev, &scat[i]);
 
-                for (j = 0; j < dma_len; j += rds_ibdev->fmr_page_size)
+                for (j = 0; j < dma_len; j += PAGE_SIZE)
                         dma_pages[page_cnt++] =
-                                (dma_addr & rds_ibdev->fmr_page_mask) + j;
+                                (dma_addr & PAGE_MASK) + j;
         }
 
         ret = ib_map_phys_fmr(ibmr->fmr,
diff --git a/net/rds/ib_recv.c b/net/rds/ib_recv.c
index 5709bad28329..cd7a6cfcab03 100644
--- a/net/rds/ib_recv.c
+++ b/net/rds/ib_recv.c
@@ -555,6 +555,47 @@ u64 rds_ib_piggyb_ack(struct rds_ib_connection *ic)
         return rds_ib_get_ack(ic);
 }
 
+static struct rds_header *rds_ib_get_header(struct rds_connection *conn,
+                                            struct rds_ib_recv_work *recv,
+                                            u32 data_len)
+{
+        struct rds_ib_connection *ic = conn->c_transport_data;
+        void *hdr_buff = &ic->i_recv_hdrs[recv - ic->i_recvs];
+        void *addr;
+        u32 misplaced_hdr_bytes;
+
+        /*
+         * Support header at the front (RDS 3.1+) as well as header-at-end.
+         *
+         * Cases:
+         * 1) header all in header buff (great!)
+         * 2) header all in data page (copy all to header buff)
+         * 3) header split across hdr buf + data page
+         *    (move bit in hdr buff to end before copying other bit from data page)
+         */
+        if (conn->c_version > RDS_PROTOCOL_3_0 || data_len == RDS_FRAG_SIZE)
+                return hdr_buff;
+
+        if (data_len <= (RDS_FRAG_SIZE - sizeof(struct rds_header))) {
+                addr = kmap_atomic(recv->r_frag->f_page, KM_SOFTIRQ0);
+                memcpy(hdr_buff,
+                       addr + recv->r_frag->f_offset + data_len,
+                       sizeof(struct rds_header));
+                kunmap_atomic(addr, KM_SOFTIRQ0);
+                return hdr_buff;
+        }
+
+        misplaced_hdr_bytes = (sizeof(struct rds_header) - (RDS_FRAG_SIZE - data_len));
+
+        memmove(hdr_buff + misplaced_hdr_bytes, hdr_buff, misplaced_hdr_bytes);
+
+        addr = kmap_atomic(recv->r_frag->f_page, KM_SOFTIRQ0);
+        memcpy(hdr_buff, addr + recv->r_frag->f_offset + data_len,
+               sizeof(struct rds_header) - misplaced_hdr_bytes);
+        kunmap_atomic(addr, KM_SOFTIRQ0);
+        return hdr_buff;
+}
+
 /*
  * It's kind of lame that we're copying from the posted receive pages into
  * long-lived bitmaps.  We could have posted the bitmaps and rdma written into
@@ -645,7 +686,7 @@ struct rds_ib_ack_state {
 };
 
 static void rds_ib_process_recv(struct rds_connection *conn,
-                                struct rds_ib_recv_work *recv, u32 byte_len,
+                                struct rds_ib_recv_work *recv, u32 data_len,
                                 struct rds_ib_ack_state *state)
 {
         struct rds_ib_connection *ic = conn->c_transport_data;
@@ -655,9 +696,9 @@ static void rds_ib_process_recv(struct rds_connection *conn,
         /* XXX shut down the connection if port 0,0 are seen? */
 
         rdsdebug("ic %p ibinc %p recv %p byte len %u\n", ic, ibinc, recv,
-                 byte_len);
+                 data_len);
 
-        if (byte_len < sizeof(struct rds_header)) {
+        if (data_len < sizeof(struct rds_header)) {
                 rds_ib_conn_error(conn, "incoming message "
                        "from %pI4 didn't inclue a "
                        "header, disconnecting and "
@@ -665,9 +706,9 @@ static void rds_ib_process_recv(struct rds_connection *conn,
                        &conn->c_faddr);
                 return;
         }
-        byte_len -= sizeof(struct rds_header);
+        data_len -= sizeof(struct rds_header);
 
-        ihdr = &ic->i_recv_hdrs[recv - ic->i_recvs];
+        ihdr = rds_ib_get_header(conn, recv, data_len);
 
         /* Validate the checksum. */
         if (!rds_message_verify_checksum(ihdr)) {
@@ -687,7 +728,7 @@ static void rds_ib_process_recv(struct rds_connection *conn,
         if (ihdr->h_credit)
                 rds_ib_send_add_credits(conn, ihdr->h_credit);
 
-        if (ihdr->h_sport == 0 && ihdr->h_dport == 0 && byte_len == 0) {
+        if (ihdr->h_sport == 0 && ihdr->h_dport == 0 && data_len == 0) {
                 /* This is an ACK-only packet. The fact that it gets
                  * special treatment here is that historically, ACKs
                  * were rather special beasts.
diff --git a/net/rds/ib_sysctl.c b/net/rds/ib_sysctl.c
index d87830db93a0..84b5ffcb280f 100644
--- a/net/rds/ib_sysctl.c
+++ b/net/rds/ib_sysctl.c
@@ -53,7 +53,17 @@ unsigned long rds_ib_sysctl_max_unsig_bytes = (16 << 20);
 static unsigned long rds_ib_sysctl_max_unsig_bytes_min = 1;
 static unsigned long rds_ib_sysctl_max_unsig_bytes_max = ~0UL;
 
-unsigned int rds_ib_sysctl_flow_control = 1;
+/*
+ * This sysctl does nothing.
+ *
+ * Backwards compatibility with RDS 3.0 wire protocol
+ * disables initial FC credit exchange.
+ * If it's ever possible to drop 3.0 support,
+ * setting this to 1 and moving init/refill of send/recv
+ * rings from ib_cm_connect_complete() back into ib_setup_qp()
+ * will cause credits to be added before protocol negotiation.
+ */
+unsigned int rds_ib_sysctl_flow_control = 0;
 
 ctl_table rds_ib_sysctl_table[] = {
         {
diff --git a/net/rds/iw.c b/net/rds/iw.c
index d16e1cbc8e83..f5e9a29a80a7 100644
--- a/net/rds/iw.c
+++ b/net/rds/iw.c
@@ -83,23 +83,16 @@ void rds_iw_add_one(struct ib_device *device)
         rds_iwdev->max_wrs = dev_attr->max_qp_wr;
         rds_iwdev->max_sge = min(dev_attr->max_sge, RDS_IW_MAX_SGE);
 
-        rds_iwdev->page_shift = max(PAGE_SHIFT, ffs(dev_attr->page_size_cap) - 1);
-
         rds_iwdev->dev = device;
         rds_iwdev->pd = ib_alloc_pd(device);
         if (IS_ERR(rds_iwdev->pd))
                 goto free_dev;
 
         if (!rds_iwdev->dma_local_lkey) {
-                if (device->node_type != RDMA_NODE_RNIC) {
-                        rds_iwdev->mr = ib_get_dma_mr(rds_iwdev->pd,
-                                                IB_ACCESS_LOCAL_WRITE);
-                } else {
-                        rds_iwdev->mr = ib_get_dma_mr(rds_iwdev->pd,
-                                                IB_ACCESS_REMOTE_READ |
-                                                IB_ACCESS_REMOTE_WRITE |
-                                                IB_ACCESS_LOCAL_WRITE);
-                }
+                rds_iwdev->mr = ib_get_dma_mr(rds_iwdev->pd,
+                                        IB_ACCESS_REMOTE_READ |
+                                        IB_ACCESS_REMOTE_WRITE |
+                                        IB_ACCESS_LOCAL_WRITE);
                 if (IS_ERR(rds_iwdev->mr))
                         goto err_pd;
         } else
diff --git a/net/rds/iw.h b/net/rds/iw.h
index 0715dde323e7..dd72b62bd506 100644
--- a/net/rds/iw.h
+++ b/net/rds/iw.h
@@ -181,7 +181,6 @@ struct rds_iw_device {
         struct ib_pd            *pd;
         struct ib_mr            *mr;
         struct rds_iw_mr_pool   *mr_pool;
-        int                     page_shift;
         int                     max_sge;
         unsigned int            max_wrs;
         unsigned int            dma_local_lkey:1;
diff --git a/net/rds/iw_rdma.c b/net/rds/iw_rdma.c
index dcdb37da80f2..de4a1b16bf7b 100644
--- a/net/rds/iw_rdma.c
+++ b/net/rds/iw_rdma.c
@@ -263,18 +263,12 @@ static void rds_iw_set_scatterlist(struct rds_iw_scatterlist *sg,
 }
 
 static u64 *rds_iw_map_scatterlist(struct rds_iw_device *rds_iwdev,
-                        struct rds_iw_scatterlist *sg,
-                        unsigned int dma_page_shift)
+                        struct rds_iw_scatterlist *sg)
 {
         struct ib_device *dev = rds_iwdev->dev;
         u64 *dma_pages = NULL;
-        u64 dma_mask;
-        unsigned int dma_page_size;
         int i, j, ret;
 
-        dma_page_size = 1 << dma_page_shift;
-        dma_mask = dma_page_size - 1;
-
         WARN_ON(sg->dma_len);
 
         sg->dma_len = ib_dma_map_sg(dev, sg->list, sg->len, DMA_BIDIRECTIONAL);
@@ -295,18 +289,18 @@ static u64 *rds_iw_map_scatterlist(struct rds_iw_device *rds_iwdev,
                 sg->bytes += dma_len;
 
                 end_addr = dma_addr + dma_len;
-                if (dma_addr & dma_mask) {
+                if (dma_addr & PAGE_MASK) {
                         if (i > 0)
                                 goto out_unmap;
-                        dma_addr &= ~dma_mask;
+                        dma_addr &= ~PAGE_MASK;
                 }
-                if (end_addr & dma_mask) {
+                if (end_addr & PAGE_MASK) {
                         if (i < sg->dma_len - 1)
                                 goto out_unmap;
-                        end_addr = (end_addr + dma_mask) & ~dma_mask;
+                        end_addr = (end_addr + PAGE_MASK) & ~PAGE_MASK;
                 }
 
-                sg->dma_npages += (end_addr - dma_addr) >> dma_page_shift;
+                sg->dma_npages += (end_addr - dma_addr) >> PAGE_SHIFT;
         }
 
         /* Now gather the dma addrs into one list */
@@ -325,8 +319,8 @@ static u64 *rds_iw_map_scatterlist(struct rds_iw_device *rds_iwdev,
                 u64 end_addr;
 
                 end_addr = dma_addr + dma_len;
-                dma_addr &= ~dma_mask;
-                for (; dma_addr < end_addr; dma_addr += dma_page_size)
+                dma_addr &= ~PAGE_MASK;
+                for (; dma_addr < end_addr; dma_addr += PAGE_SIZE)
                         dma_pages[j++] = dma_addr;
                 BUG_ON(j > sg->dma_npages);
         }
@@ -727,7 +721,7 @@ static int rds_iw_rdma_build_fastreg(struct rds_iw_mapping *mapping)
         f_wr.wr.fast_reg.rkey = mapping->m_rkey;
         f_wr.wr.fast_reg.page_list = ibmr->page_list;
         f_wr.wr.fast_reg.page_list_len = mapping->m_sg.dma_len;
-        f_wr.wr.fast_reg.page_shift = ibmr->device->page_shift;
+        f_wr.wr.fast_reg.page_shift = PAGE_SHIFT;
         f_wr.wr.fast_reg.access_flags = IB_ACCESS_LOCAL_WRITE |
                                 IB_ACCESS_REMOTE_READ |
                                 IB_ACCESS_REMOTE_WRITE;
@@ -780,9 +774,7 @@ static int rds_iw_map_fastreg(struct rds_iw_mr_pool *pool,
 
         rds_iw_set_scatterlist(&mapping->m_sg, sg, sg_len);
 
-        dma_pages = rds_iw_map_scatterlist(rds_iwdev,
-                                &mapping->m_sg,
-                                rds_iwdev->page_shift);
+        dma_pages = rds_iw_map_scatterlist(rds_iwdev, &mapping->m_sg);
         if (IS_ERR(dma_pages)) {
                 ret = PTR_ERR(dma_pages);
                 dma_pages = NULL;
diff --git a/net/rds/iw_send.c b/net/rds/iw_send.c
index 44a6a0551f28..1f5abe3cf2b4 100644
--- a/net/rds/iw_send.c
+++ b/net/rds/iw_send.c
@@ -779,7 +779,7 @@ static void rds_iw_build_send_fastreg(struct rds_iw_device *rds_iwdev, struct rd
         send->s_wr.wr.fast_reg.rkey = send->s_mr->rkey;
         send->s_wr.wr.fast_reg.page_list = send->s_page_list;
         send->s_wr.wr.fast_reg.page_list_len = nent;
-        send->s_wr.wr.fast_reg.page_shift = rds_iwdev->page_shift;
+        send->s_wr.wr.fast_reg.page_shift = PAGE_SHIFT;
         send->s_wr.wr.fast_reg.access_flags = IB_ACCESS_REMOTE_WRITE;
         send->s_wr.wr.fast_reg.iova_start = sg_addr;
 
diff --git a/net/rds/rdma_transport.c b/net/rds/rdma_transport.c
index 7d0f901c93d5..981a5e6ea5bc 100644
--- a/net/rds/rdma_transport.c
+++ b/net/rds/rdma_transport.c
@@ -101,7 +101,7 @@ int rds_rdma_cm_event_handler(struct rdma_cm_id *cm_id,
                 break;
 
         case RDMA_CM_EVENT_DISCONNECTED:
-                printk(KERN_WARNING "RDS/IW: DISCONNECT event - dropping connection "
+                printk(KERN_WARNING "RDS/RDMA: DISCONNECT event - dropping connection "
                         "%pI4->%pI4\n", &conn->c_laddr,
                          &conn->c_faddr);
                 rds_conn_drop(conn);
@@ -132,7 +132,7 @@ static int __init rds_rdma_listen_init(void)
         cm_id = rdma_create_id(rds_rdma_cm_event_handler, NULL, RDMA_PS_TCP);
         if (IS_ERR(cm_id)) {
                 ret = PTR_ERR(cm_id);
-                printk(KERN_ERR "RDS/IW: failed to setup listener, "
+                printk(KERN_ERR "RDS/RDMA: failed to setup listener, "
                        "rdma_create_id() returned %d\n", ret);
                 goto out;
         }
@@ -147,14 +147,14 @@ static int __init rds_rdma_listen_init(void)
          */
         ret = rdma_bind_addr(cm_id, (struct sockaddr *)&sin);
         if (ret) {
-                printk(KERN_ERR "RDS/IW: failed to setup listener, "
+                printk(KERN_ERR "RDS/RDMA: failed to setup listener, "
                        "rdma_bind_addr() returned %d\n", ret);
                 goto out;
         }
 
         ret = rdma_listen(cm_id, 128);
         if (ret) {
-                printk(KERN_ERR "RDS/IW: failed to setup listener, "
+                printk(KERN_ERR "RDS/RDMA: failed to setup listener, "
                        "rdma_listen() returned %d\n", ret);
                 goto out;
         }
diff --git a/net/rds/recv.c b/net/rds/recv.c
index f2118c51cfa3..86bc1a06ebbd 100644
--- a/net/rds/recv.c
+++ b/net/rds/recv.c
@@ -409,18 +409,18 @@ int rds_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
         if (msg_flags & MSG_OOB)
                 goto out;
 
-        /* If there are pending notifications, do those - and nothing else */
-        if (!list_empty(&rs->rs_notify_queue)) {
-                ret = rds_notify_queue_get(rs, msg);
-                goto out;
-        }
+        while (1) {
+                /* If there are pending notifications, do those - and nothing else */
+                if (!list_empty(&rs->rs_notify_queue)) {
+                        ret = rds_notify_queue_get(rs, msg);
+                        break;
+                }
 
-        if (rs->rs_cong_notify) {
-                ret = rds_notify_cong(rs, msg);
-                goto out;
-        }
+                if (rs->rs_cong_notify) {
+                        ret = rds_notify_cong(rs, msg);
+                        break;
+                }
 
-        while (1) {
                 if (!rds_next_incoming(rs, &inc)) {
                         if (nonblock) {
                                 ret = -EAGAIN;
@@ -428,7 +428,9 @@ int rds_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
                         }
 
                         timeo = wait_event_interruptible_timeout(*sk->sk_sleep,
-                                                rds_next_incoming(rs, &inc),
+                                                (!list_empty(&rs->rs_notify_queue)
+                                                || rs->rs_cong_notify
+                                                || rds_next_incoming(rs, &inc)),
                                                 timeo);
                         rdsdebug("recvmsg woke inc %p timeo %ld\n", inc,
                                  timeo);
diff --git a/net/rfkill/core.c b/net/rfkill/core.c
index 2fc4a1724eb8..044de1c6af3d 100644
--- a/net/rfkill/core.c
+++ b/net/rfkill/core.c
@@ -1091,10 +1091,16 @@ static ssize_t rfkill_fop_write(struct file *file, const char __user *buf,
         struct rfkill_event ev;
 
         /* we don't need the 'hard' variable but accept it */
-        if (count < sizeof(ev) - 1)
+        if (count < RFKILL_EVENT_SIZE_V1 - 1)
                 return -EINVAL;
 
-        if (copy_from_user(&ev, buf, sizeof(ev) - 1))
+        /*
+         * Copy as much data as we can accept into our 'ev' buffer,
+         * but tell userspace how much we've copied so it can determine
+         * our API version even in a write() call, if it cares.
+         */
+        count = min(count, sizeof(ev));
+        if (copy_from_user(&ev, buf, count))
                 return -EFAULT;
 
         if (ev.op != RFKILL_OP_CHANGE && ev.op != RFKILL_OP_CHANGE_ALL)
diff --git a/net/rose/rose_dev.c b/net/rose/rose_dev.c
index 389d6e0d7740..c711e2edf5ce 100644
--- a/net/rose/rose_dev.c
+++ b/net/rose/rose_dev.c
@@ -141,7 +141,7 @@ static int rose_xmit(struct sk_buff *skb, struct net_device *dev)
         }
         dev_kfree_skb(skb);
         stats->tx_errors++;
-        return 0;
+        return NETDEV_TX_OK;
 }
 
 static const struct header_ops rose_header_ops = {
diff --git a/net/sched/sch_teql.c b/net/sched/sch_teql.c
index 9c002b6e0533..12434b6c2042 100644
--- a/net/sched/sch_teql.c
+++ b/net/sched/sch_teql.c
@@ -314,7 +314,7 @@ restart:
                                         netif_wake_queue(dev);
                                         txq->tx_packets++;
                                         txq->tx_bytes += length;
-                                        return 0;
+                                        return NETDEV_TX_OK;
                                 }
                                 __netif_tx_unlock(slave_txq);
                         }
@@ -323,7 +323,7 @@ restart:
                         break;
                 case 1:
                         master->slaves = NEXT_SLAVE(q);
-                        return 0;
+                        return NETDEV_TX_OK;
                 default:
                         nores = 1;
                         break;
@@ -345,7 +345,7 @@ restart:
 drop:
         txq->tx_dropped++;
         dev_kfree_skb(skb);
-        return 0;
+        return NETDEV_TX_OK;
 }
 
 static int teql_master_open(struct net_device *dev)
diff --git a/net/tipc/netlink.c b/net/tipc/netlink.c
index 3c57005e44d1..7bda8e3d1398 100644
--- a/net/tipc/netlink.c
+++ b/net/tipc/netlink.c
@@ -62,7 +62,7 @@ static int handle_cmd(struct sk_buff *skb, struct genl_info *info)
                 rep_nlh = nlmsg_hdr(rep_buf);
                 memcpy(rep_nlh, req_nlh, hdr_space);
                 rep_nlh->nlmsg_len = rep_buf->len;
-                genlmsg_unicast(rep_buf, NETLINK_CB(skb).pid);
+                genlmsg_unicast(&init_net, rep_buf, NETLINK_CB(skb).pid);
         }
 
         return 0;
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index 1848693ebb82..e8254e809b79 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -1748,6 +1748,12 @@ static int getsockopt(struct socket *sock,
                 value = jiffies_to_msecs(sk->sk_rcvtimeo);
                 /* no need to set "res", since already 0 at this point */
                 break;
+         case TIPC_NODE_RECVQ_DEPTH:
+                value = (u32)atomic_read(&tipc_queue_size);
+                break;
+         case TIPC_SOCK_RECVQ_DEPTH:
+                value = skb_queue_len(&sk->sk_receive_queue);
+                break;
         default:
                 res = -EINVAL;
         }
diff --git a/net/wireless/Kconfig b/net/wireless/Kconfig
index 4428dd5e911d..c6031d5b135f 100644
--- a/net/wireless/Kconfig
+++ b/net/wireless/Kconfig
@@ -2,6 +2,21 @@ config CFG80211
         tristate "Improved wireless configuration API"
         depends on RFKILL || !RFKILL
 
+config NL80211_TESTMODE
+        bool "nl80211 testmode command"
+        depends on CFG80211
+        help
+          The nl80211 testmode command helps implementing things like
+          factory calibration or validation tools for wireless chips.
+
+          Select this option ONLY for kernels that are specifically
+          built for such purposes.
+
+          Debugging tools that are supposed to end up in the hands of
+          users should better be implemented with debugfs.
+
+          Say N.
+
 config CFG80211_REG_DEBUG
         bool "cfg80211 regulatory debugging"
         depends on CFG80211
@@ -11,6 +26,22 @@ config CFG80211_REG_DEBUG
 
           If unsure, say N.
 
+config CFG80211_DEFAULT_PS
+        bool "enable powersave by default"
+        depends on CFG80211
+        default y
+        help
+          This option enables powersave mode by default.
+
+          If this causes your applications to misbehave you should fix your
+          applications instead -- they need to register their network
+          latency requirement, see Documentation/power/pm_qos_interface.txt.
+
+config CFG80211_DEFAULT_PS_VALUE
+        int
+        default 1 if CFG80211_DEFAULT_PS
+        default 0
+
 config CFG80211_DEBUGFS
         bool "cfg80211 DebugFS entries"
         depends on CFG80211 && DEBUG_FS
@@ -35,19 +66,13 @@ config WIRELESS_OLD_REGULATORY
 
 config WIRELESS_EXT
         bool "Wireless extensions"
-        default n
+        default y
         ---help---
           This option enables the legacy wireless extensions
           (wireless network interface configuration via ioctls.)
 
-          Wireless extensions will be replaced by cfg80211 and
-          will be required only by legacy drivers that implement
-          wireless extension handlers. This option does not
-          affect the wireless-extension backward compatibility
-          code in cfg80211.
-
-          Say N (if you can) unless you know you need wireless
-          extensions for external modules.
+          Say Y unless you've upgraded all your userspace to use
+          nl80211 instead of wireless extensions.
 
 config WIRELESS_EXT_SYSFS
         bool "Wireless extensions sysfs files"
diff --git a/net/wireless/Makefile b/net/wireless/Makefile
index f78c4832a9ca..d74cc77fa57a 100644
--- a/net/wireless/Makefile
+++ b/net/wireless/Makefile
@@ -5,8 +5,8 @@ obj-$(CONFIG_LIB80211_CRYPT_WEP) += lib80211_crypt_wep.o
 obj-$(CONFIG_LIB80211_CRYPT_CCMP) += lib80211_crypt_ccmp.o
 obj-$(CONFIG_LIB80211_CRYPT_TKIP) += lib80211_crypt_tkip.o
 
-cfg80211-y += core.o sysfs.o radiotap.o util.o reg.o scan.o nl80211.o mlme.o ibss.o
+cfg80211-y += core.o sysfs.o radiotap.o util.o reg.o scan.o nl80211.o mlme.o ibss.o sme.o
 cfg80211-$(CONFIG_CFG80211_DEBUGFS) += debugfs.o
-cfg80211-$(CONFIG_WIRELESS_EXT) += wext-compat.o
+cfg80211-$(CONFIG_WIRELESS_EXT) += wext-compat.o wext-sme.o
 
 ccflags-y += -D__CHECK_ENDIAN__
diff --git a/net/wireless/core.c b/net/wireless/core.c
index d5850292b3df..6891cd0e38d5 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -30,10 +30,10 @@ MODULE_DESCRIPTION("wireless configuration support");
 /* RCU might be appropriate here since we usually
  * only read the list, and that can happen quite
  * often because we need to do it for each command */
-LIST_HEAD(cfg80211_drv_list);
+LIST_HEAD(cfg80211_rdev_list);
 
 /*
- * This is used to protect the cfg80211_drv_list, cfg80211_regdomain,
+ * This is used to protect the cfg80211_rdev_list, cfg80211_regdomain,
  * country_ie_regdomain, the reg_beacon_list and the the last regulatory
  * request receipt (last_request).
  */
@@ -43,18 +43,18 @@ DEFINE_MUTEX(cfg80211_mutex);
 static struct dentry *ieee80211_debugfs_dir;
 
 /* requires cfg80211_mutex to be held! */
-struct cfg80211_registered_device *cfg80211_drv_by_wiphy_idx(int wiphy_idx)
+struct cfg80211_registered_device *cfg80211_rdev_by_wiphy_idx(int wiphy_idx)
 {
-        struct cfg80211_registered_device *result = NULL, *drv;
+        struct cfg80211_registered_device *result = NULL, *rdev;
 
         if (!wiphy_idx_valid(wiphy_idx))
                 return NULL;
 
         assert_cfg80211_lock();
 
-        list_for_each_entry(drv, &cfg80211_drv_list, list) {
-                if (drv->wiphy_idx == wiphy_idx) {
-                        result = drv;
+        list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
+                if (rdev->wiphy_idx == wiphy_idx) {
+                        result = rdev;
                         break;
                 }
         }
@@ -64,32 +64,32 @@ struct cfg80211_registered_device *cfg80211_drv_by_wiphy_idx(int wiphy_idx)
 
 int get_wiphy_idx(struct wiphy *wiphy)
 {
-        struct cfg80211_registered_device *drv;
+        struct cfg80211_registered_device *rdev;
         if (!wiphy)
                 return WIPHY_IDX_STALE;
-        drv = wiphy_to_dev(wiphy);
-        return drv->wiphy_idx;
+        rdev = wiphy_to_dev(wiphy);
+        return rdev->wiphy_idx;
 }
 
-/* requires cfg80211_drv_mutex to be held! */
+/* requires cfg80211_rdev_mutex to be held! */
 struct wiphy *wiphy_idx_to_wiphy(int wiphy_idx)
 {
-        struct cfg80211_registered_device *drv;
+        struct cfg80211_registered_device *rdev;
 
         if (!wiphy_idx_valid(wiphy_idx))
                 return NULL;
 
         assert_cfg80211_lock();
 
-        drv = cfg80211_drv_by_wiphy_idx(wiphy_idx);
-        if (!drv)
+        rdev = cfg80211_rdev_by_wiphy_idx(wiphy_idx);
+        if (!rdev)
                 return NULL;
-        return &drv->wiphy;
+        return &rdev->wiphy;
 }
 
 /* requires cfg80211_mutex to be held! */
 struct cfg80211_registered_device *
-__cfg80211_drv_from_info(struct genl_info *info)
+__cfg80211_rdev_from_info(struct genl_info *info)
 {
         int ifindex;
         struct cfg80211_registered_device *bywiphyidx = NULL, *byifidx = NULL;
@@ -99,7 +99,7 @@ __cfg80211_drv_from_info(struct genl_info *info)
         assert_cfg80211_lock();
 
         if (info->attrs[NL80211_ATTR_WIPHY]) {
-                bywiphyidx = cfg80211_drv_by_wiphy_idx(
+                bywiphyidx = cfg80211_rdev_by_wiphy_idx(
                                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY]));
                 err = -ENODEV;
         }
@@ -134,26 +134,26 @@ __cfg80211_drv_from_info(struct genl_info *info)
 struct cfg80211_registered_device *
 cfg80211_get_dev_from_info(struct genl_info *info)
 {
-        struct cfg80211_registered_device *drv;
+        struct cfg80211_registered_device *rdev;
 
         mutex_lock(&cfg80211_mutex);
-        drv = __cfg80211_drv_from_info(info);
+        rdev = __cfg80211_rdev_from_info(info);
 
         /* if it is not an error we grab the lock on
          * it to assure it won't be going away while
          * we operate on it */
-        if (!IS_ERR(drv))
-                mutex_lock(&drv->mtx);
+        if (!IS_ERR(rdev))
+                mutex_lock(&rdev->mtx);
 
         mutex_unlock(&cfg80211_mutex);
 
-        return drv;
+        return rdev;
 }
 
 struct cfg80211_registered_device *
 cfg80211_get_dev_from_ifindex(int ifindex)
 {
-        struct cfg80211_registered_device *drv = ERR_PTR(-ENODEV);
+        struct cfg80211_registered_device *rdev = ERR_PTR(-ENODEV);
         struct net_device *dev;
 
         mutex_lock(&cfg80211_mutex);
@@ -161,27 +161,21 @@ cfg80211_get_dev_from_ifindex(int ifindex)
         if (!dev)
                 goto out;
         if (dev->ieee80211_ptr) {
-                drv = wiphy_to_dev(dev->ieee80211_ptr->wiphy);
-                mutex_lock(&drv->mtx);
+                rdev = wiphy_to_dev(dev->ieee80211_ptr->wiphy);
+                mutex_lock(&rdev->mtx);
         } else
-                drv = ERR_PTR(-ENODEV);
+                rdev = ERR_PTR(-ENODEV);
         dev_put(dev);
  out:
         mutex_unlock(&cfg80211_mutex);
-        return drv;
-}
-
-void cfg80211_put_dev(struct cfg80211_registered_device *drv)
-{
-        BUG_ON(IS_ERR(drv));
-        mutex_unlock(&drv->mtx);
+        return rdev;
 }
 
 /* requires cfg80211_mutex to be held */
 int cfg80211_dev_rename(struct cfg80211_registered_device *rdev,
                         char *newname)
 {
-        struct cfg80211_registered_device *drv;
+        struct cfg80211_registered_device *rdev2;
         int wiphy_idx, taken = -1, result, digits;
 
         assert_cfg80211_lock();
@@ -207,8 +201,8 @@ int cfg80211_dev_rename(struct cfg80211_registered_device *rdev,
                 return 0;
 
         /* Ensure another device does not already have this name. */
-        list_for_each_entry(drv, &cfg80211_drv_list, list)
-                if (strcmp(newname, dev_name(&drv->wiphy.dev)) == 0)
+        list_for_each_entry(rdev2, &cfg80211_rdev_list, list)
+                if (strcmp(newname, dev_name(&rdev2->wiphy.dev)) == 0)
                         return -EINVAL;
 
         result = device_rename(&rdev->wiphy.dev, newname);
@@ -230,26 +224,26 @@ int cfg80211_dev_rename(struct cfg80211_registered_device *rdev,
 
 static void cfg80211_rfkill_poll(struct rfkill *rfkill, void *data)
 {
-        struct cfg80211_registered_device *drv = data;
+        struct cfg80211_registered_device *rdev = data;
 
-        drv->ops->rfkill_poll(&drv->wiphy);
+        rdev->ops->rfkill_poll(&rdev->wiphy);
 }
 
 static int cfg80211_rfkill_set_block(void *data, bool blocked)
 {
-        struct cfg80211_registered_device *drv = data;
+        struct cfg80211_registered_device *rdev = data;
         struct wireless_dev *wdev;
 
         if (!blocked)
                 return 0;
 
         rtnl_lock();
-        mutex_lock(&drv->devlist_mtx);
+        mutex_lock(&rdev->devlist_mtx);
 
-        list_for_each_entry(wdev, &drv->netdev_list, list)
+        list_for_each_entry(wdev, &rdev->netdev_list, list)
                 dev_close(wdev->netdev);
 
-        mutex_unlock(&drv->devlist_mtx);
+        mutex_unlock(&rdev->devlist_mtx);
         rtnl_unlock();
 
         return 0;
@@ -257,10 +251,75 @@ static int cfg80211_rfkill_set_block(void *data, bool blocked)
 
 static void cfg80211_rfkill_sync_work(struct work_struct *work)
 {
-        struct cfg80211_registered_device *drv;
+        struct cfg80211_registered_device *rdev;
 
-        drv = container_of(work, struct cfg80211_registered_device, rfkill_sync);
-        cfg80211_rfkill_set_block(drv, rfkill_blocked(drv->rfkill));
+        rdev = container_of(work, struct cfg80211_registered_device, rfkill_sync);
+        cfg80211_rfkill_set_block(rdev, rfkill_blocked(rdev->rfkill));
+}
+
+static void cfg80211_process_events(struct wireless_dev *wdev)
+{
+        struct cfg80211_event *ev;
+        unsigned long flags;
+
+        spin_lock_irqsave(&wdev->event_lock, flags);
+        while (!list_empty(&wdev->event_list)) {
+                ev = list_first_entry(&wdev->event_list,
+                                      struct cfg80211_event, list);
+                list_del(&ev->list);
+                spin_unlock_irqrestore(&wdev->event_lock, flags);
+
+                wdev_lock(wdev);
+                switch (ev->type) {
+                case EVENT_CONNECT_RESULT:
+                        __cfg80211_connect_result(
+                                wdev->netdev, ev->cr.bssid,
+                                ev->cr.req_ie, ev->cr.req_ie_len,
+                                ev->cr.resp_ie, ev->cr.resp_ie_len,
+                                ev->cr.status,
+                                ev->cr.status == WLAN_STATUS_SUCCESS);
+                        break;
+                case EVENT_ROAMED:
+                        __cfg80211_roamed(wdev, ev->rm.bssid,
+                                          ev->rm.req_ie, ev->rm.req_ie_len,
+                                          ev->rm.resp_ie, ev->rm.resp_ie_len);
+                        break;
+                case EVENT_DISCONNECTED:
+                        __cfg80211_disconnected(wdev->netdev,
+                                                ev->dc.ie, ev->dc.ie_len,
+                                                ev->dc.reason, true);
+                        break;
+                case EVENT_IBSS_JOINED:
+                        __cfg80211_ibss_joined(wdev->netdev, ev->ij.bssid);
+                        break;
+                }
+                wdev_unlock(wdev);
+
+                kfree(ev);
+
+                spin_lock_irqsave(&wdev->event_lock, flags);
+        }
+        spin_unlock_irqrestore(&wdev->event_lock, flags);
+}
+
+static void cfg80211_event_work(struct work_struct *work)
+{
+        struct cfg80211_registered_device *rdev;
+        struct wireless_dev *wdev;
+
+        rdev = container_of(work, struct cfg80211_registered_device,
+                            event_work);
+
+        rtnl_lock();
+        cfg80211_lock_rdev(rdev);
+        mutex_lock(&rdev->devlist_mtx);
+
+        list_for_each_entry(wdev, &rdev->netdev_list, list)
+                cfg80211_process_events(wdev);
+
+        mutex_unlock(&rdev->devlist_mtx);
+        cfg80211_unlock_rdev(rdev);
+        rtnl_unlock();
 }
 
 /* exported functions */
@@ -269,76 +328,84 @@ struct wiphy *wiphy_new(const struct cfg80211_ops *ops, int sizeof_priv)
 {
         static int wiphy_counter;
 
-        struct cfg80211_registered_device *drv;
+        struct cfg80211_registered_device *rdev;
         int alloc_size;
 
-        WARN_ON(!ops->add_key && ops->del_key);
-        WARN_ON(ops->add_key && !ops->del_key);
+        WARN_ON(ops->add_key && (!ops->del_key || !ops->set_default_key));
+        WARN_ON(ops->auth && (!ops->assoc || !ops->deauth || !ops->disassoc));
+        WARN_ON(ops->connect && !ops->disconnect);
+        WARN_ON(ops->join_ibss && !ops->leave_ibss);
+        WARN_ON(ops->add_virtual_intf && !ops->del_virtual_intf);
+        WARN_ON(ops->add_station && !ops->del_station);
+        WARN_ON(ops->add_mpath && !ops->del_mpath);
 
-        alloc_size = sizeof(*drv) + sizeof_priv;
+        alloc_size = sizeof(*rdev) + sizeof_priv;
 
-        drv = kzalloc(alloc_size, GFP_KERNEL);
-        if (!drv)
+        rdev = kzalloc(alloc_size, GFP_KERNEL);
+        if (!rdev)
                 return NULL;
 
-        drv->ops = ops;
+        rdev->ops = ops;
 
         mutex_lock(&cfg80211_mutex);
 
-        drv->wiphy_idx = wiphy_counter++;
+        rdev->wiphy_idx = wiphy_counter++;
 
-        if (unlikely(!wiphy_idx_valid(drv->wiphy_idx))) {
+        if (unlikely(!wiphy_idx_valid(rdev->wiphy_idx))) {
                 wiphy_counter--;
                 mutex_unlock(&cfg80211_mutex);
                 /* ugh, wrapped! */
-                kfree(drv);
+                kfree(rdev);
                 return NULL;
         }
 
         mutex_unlock(&cfg80211_mutex);
 
         /* give it a proper name */
-        dev_set_name(&drv->wiphy.dev, PHY_NAME "%d", drv->wiphy_idx);
-
-        mutex_init(&drv->mtx);
-        mutex_init(&drv->devlist_mtx);
-        INIT_LIST_HEAD(&drv->netdev_list);
-        spin_lock_init(&drv->bss_lock);
-        INIT_LIST_HEAD(&drv->bss_list);
-
-        device_initialize(&drv->wiphy.dev);
-        drv->wiphy.dev.class = &ieee80211_class;
-        drv->wiphy.dev.platform_data = drv;
-
-        drv->rfkill_ops.set_block = cfg80211_rfkill_set_block;
-        drv->rfkill = rfkill_alloc(dev_name(&drv->wiphy.dev),
-                                   &drv->wiphy.dev, RFKILL_TYPE_WLAN,
-                                   &drv->rfkill_ops, drv);
-
-        if (!drv->rfkill) {
-                kfree(drv);
+        dev_set_name(&rdev->wiphy.dev, PHY_NAME "%d", rdev->wiphy_idx);
+
+        mutex_init(&rdev->mtx);
+        mutex_init(&rdev->devlist_mtx);
+        INIT_LIST_HEAD(&rdev->netdev_list);
+        spin_lock_init(&rdev->bss_lock);
+        INIT_LIST_HEAD(&rdev->bss_list);
+        INIT_WORK(&rdev->scan_done_wk, __cfg80211_scan_done);
+
+        device_initialize(&rdev->wiphy.dev);
+        rdev->wiphy.dev.class = &ieee80211_class;
+        rdev->wiphy.dev.platform_data = rdev;
+
+        rdev->rfkill_ops.set_block = cfg80211_rfkill_set_block;
+        rdev->rfkill = rfkill_alloc(dev_name(&rdev->wiphy.dev),
+                                   &rdev->wiphy.dev, RFKILL_TYPE_WLAN,
+                                   &rdev->rfkill_ops, rdev);
+
+        if (!rdev->rfkill) {
+                kfree(rdev);
                 return NULL;
         }
 
-        INIT_WORK(&drv->rfkill_sync, cfg80211_rfkill_sync_work);
+        INIT_WORK(&rdev->rfkill_sync, cfg80211_rfkill_sync_work);
+        INIT_WORK(&rdev->conn_work, cfg80211_conn_work);
+        INIT_WORK(&rdev->event_work, cfg80211_event_work);
 
         /*
          * Initialize wiphy parameters to IEEE 802.11 MIB default values.
          * Fragmentation and RTS threshold are disabled by default with the
          * special -1 value.
          */
-        drv->wiphy.retry_short = 7;
-        drv->wiphy.retry_long = 4;
-        drv->wiphy.frag_threshold = (u32) -1;
-        drv->wiphy.rts_threshold = (u32) -1;
+        rdev->wiphy.retry_short = 7;
+        rdev->wiphy.retry_long = 4;
+        rdev->wiphy.frag_threshold = (u32) -1;
+        rdev->wiphy.rts_threshold = (u32) -1;
 
-        return &drv->wiphy;
+        return &rdev->wiphy;
 }
 EXPORT_SYMBOL(wiphy_new);
 
 int wiphy_register(struct wiphy *wiphy)
 {
-        struct cfg80211_registered_device *drv = wiphy_to_dev(wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
         int res;
         enum ieee80211_band band;
         struct ieee80211_supported_band *sband;
@@ -346,9 +413,6 @@ int wiphy_register(struct wiphy *wiphy)
         int i;
         u16 ifmodes = wiphy->interface_modes;
 
-        if (WARN_ON(wiphy->max_scan_ssids < 1))
-                return -EINVAL;
-
         /* sanity check ifmodes */
         WARN_ON(!ifmodes);
         ifmodes &= ((1 << __NL80211_IFTYPE_AFTER_LAST) - 1) & ~1;
@@ -395,11 +459,11 @@ int wiphy_register(struct wiphy *wiphy)
         /* check and set up bitrates */
         ieee80211_set_bitrate_flags(wiphy);
 
-        res = device_add(&drv->wiphy.dev);
+        res = device_add(&rdev->wiphy.dev);
         if (res)
                 return res;
 
-        res = rfkill_register(drv->rfkill);
+        res = rfkill_register(rdev->rfkill);
         if (res)
                 goto out_rm_dev;
 
@@ -408,16 +472,16 @@ int wiphy_register(struct wiphy *wiphy)
         /* set up regulatory info */
         wiphy_update_regulatory(wiphy, NL80211_REGDOM_SET_BY_CORE);
 
-        list_add(&drv->list, &cfg80211_drv_list);
+        list_add(&rdev->list, &cfg80211_rdev_list);
 
         mutex_unlock(&cfg80211_mutex);
 
         /* add to debugfs */
-        drv->wiphy.debugfsdir =
-                debugfs_create_dir(wiphy_name(&drv->wiphy),
+        rdev->wiphy.debugfsdir =
+                debugfs_create_dir(wiphy_name(&rdev->wiphy),
                                    ieee80211_debugfs_dir);
-        if (IS_ERR(drv->wiphy.debugfsdir))
-                drv->wiphy.debugfsdir = NULL;
+        if (IS_ERR(rdev->wiphy.debugfsdir))
+                rdev->wiphy.debugfsdir = NULL;
 
         if (wiphy->custom_regulatory) {
                 struct regulatory_request request;
@@ -430,48 +494,48 @@ int wiphy_register(struct wiphy *wiphy)
                 nl80211_send_reg_change_event(&request);
         }
 
-        cfg80211_debugfs_drv_add(drv);
+        cfg80211_debugfs_rdev_add(rdev);
 
         return 0;
 
  out_rm_dev:
-        device_del(&drv->wiphy.dev);
+        device_del(&rdev->wiphy.dev);
         return res;
 }
 EXPORT_SYMBOL(wiphy_register);
 
 void wiphy_rfkill_start_polling(struct wiphy *wiphy)
 {
-        struct cfg80211_registered_device *drv = wiphy_to_dev(wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 
-        if (!drv->ops->rfkill_poll)
+        if (!rdev->ops->rfkill_poll)
                 return;
-        drv->rfkill_ops.poll = cfg80211_rfkill_poll;
-        rfkill_resume_polling(drv->rfkill);
+        rdev->rfkill_ops.poll = cfg80211_rfkill_poll;
+        rfkill_resume_polling(rdev->rfkill);
 }
 EXPORT_SYMBOL(wiphy_rfkill_start_polling);
 
 void wiphy_rfkill_stop_polling(struct wiphy *wiphy)
 {
-        struct cfg80211_registered_device *drv = wiphy_to_dev(wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 
-        rfkill_pause_polling(drv->rfkill);
+        rfkill_pause_polling(rdev->rfkill);
 }
 EXPORT_SYMBOL(wiphy_rfkill_stop_polling);
 
 void wiphy_unregister(struct wiphy *wiphy)
 {
-        struct cfg80211_registered_device *drv = wiphy_to_dev(wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 
-        rfkill_unregister(drv->rfkill);
+        rfkill_unregister(rdev->rfkill);
 
         /* protect the device list */
         mutex_lock(&cfg80211_mutex);
 
-        BUG_ON(!list_empty(&drv->netdev_list));
+        BUG_ON(!list_empty(&rdev->netdev_list));
 
         /*
-         * Try to grab drv->mtx. If a command is still in progress,
+         * Try to grab rdev->mtx. If a command is still in progress,
          * hopefully the driver will refuse it since it's tearing
          * down the device already. We wait for this command to complete
          * before unlinking the item from the list.
@@ -480,33 +544,38 @@ void wiphy_unregister(struct wiphy *wiphy)
          * get to lock contention here if userspace issues a command
          * that identified the hardware by wiphy index.
          */
-        mutex_lock(&drv->mtx);
+        mutex_lock(&rdev->mtx);
         /* unlock again before freeing */
-        mutex_unlock(&drv->mtx);
+        mutex_unlock(&rdev->mtx);
 
-        cfg80211_debugfs_drv_del(drv);
+        cfg80211_debugfs_rdev_del(rdev);
 
         /* If this device got a regulatory hint tell core its
          * free to listen now to a new shiny device regulatory hint */
         reg_device_remove(wiphy);
 
-        list_del(&drv->list);
-        device_del(&drv->wiphy.dev);
-        debugfs_remove(drv->wiphy.debugfsdir);
+        list_del(&rdev->list);
+        device_del(&rdev->wiphy.dev);
+        debugfs_remove(rdev->wiphy.debugfsdir);
 
         mutex_unlock(&cfg80211_mutex);
+
+        cancel_work_sync(&rdev->conn_work);
+        cancel_work_sync(&rdev->scan_done_wk);
+        kfree(rdev->scan_req);
+        flush_work(&rdev->event_work);
 }
 EXPORT_SYMBOL(wiphy_unregister);
 
-void cfg80211_dev_free(struct cfg80211_registered_device *drv)
+void cfg80211_dev_free(struct cfg80211_registered_device *rdev)
 {
         struct cfg80211_internal_bss *scan, *tmp;
-        rfkill_destroy(drv->rfkill);
-        mutex_destroy(&drv->mtx);
-        mutex_destroy(&drv->devlist_mtx);
-        list_for_each_entry_safe(scan, tmp, &drv->bss_list, list)
+        rfkill_destroy(rdev->rfkill);
+        mutex_destroy(&rdev->mtx);
+        mutex_destroy(&rdev->devlist_mtx);
+        list_for_each_entry_safe(scan, tmp, &rdev->bss_list, list)
                 cfg80211_put_bss(&scan->pub);
-        kfree(drv);
+        kfree(rdev);
 }
 
 void wiphy_free(struct wiphy *wiphy)
@@ -517,10 +586,10 @@ EXPORT_SYMBOL(wiphy_free);
 
 void wiphy_rfkill_set_hw_state(struct wiphy *wiphy, bool blocked)
 {
-        struct cfg80211_registered_device *drv = wiphy_to_dev(wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 
-        if (rfkill_set_hw_state(drv->rfkill, blocked))
-                schedule_work(&drv->rfkill_sync);
+        if (rfkill_set_hw_state(rdev->rfkill, blocked))
+                schedule_work(&rdev->rfkill_sync);
 }
 EXPORT_SYMBOL(wiphy_rfkill_set_hw_state);
 
@@ -529,56 +598,101 @@ static int cfg80211_netdev_notifier_call(struct notifier_block * nb,
                                          void *ndev)
 {
         struct net_device *dev = ndev;
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
         struct cfg80211_registered_device *rdev;
 
-        if (!dev->ieee80211_ptr)
+        if (!wdev)
                 return NOTIFY_DONE;
 
-        rdev = wiphy_to_dev(dev->ieee80211_ptr->wiphy);
+        rdev = wiphy_to_dev(wdev->wiphy);
 
-        WARN_ON(dev->ieee80211_ptr->iftype == NL80211_IFTYPE_UNSPECIFIED);
+        WARN_ON(wdev->iftype == NL80211_IFTYPE_UNSPECIFIED);
 
         switch (state) {
         case NETDEV_REGISTER:
+                mutex_init(&wdev->mtx);
+                INIT_LIST_HEAD(&wdev->event_list);
+                spin_lock_init(&wdev->event_lock);
                 mutex_lock(&rdev->devlist_mtx);
-                list_add(&dev->ieee80211_ptr->list, &rdev->netdev_list);
+                list_add(&wdev->list, &rdev->netdev_list);
                 if (sysfs_create_link(&dev->dev.kobj, &rdev->wiphy.dev.kobj,
                                       "phy80211")) {
                         printk(KERN_ERR "wireless: failed to add phy80211 "
                                 "symlink to netdev!\n");
                 }
-                dev->ieee80211_ptr->netdev = dev;
+                wdev->netdev = dev;
+                wdev->sme_state = CFG80211_SME_IDLE;
+                mutex_unlock(&rdev->devlist_mtx);
 #ifdef CONFIG_WIRELESS_EXT
-                dev->ieee80211_ptr->wext.default_key = -1;
-                dev->ieee80211_ptr->wext.default_mgmt_key = -1;
+                wdev->wext.default_key = -1;
+                wdev->wext.default_mgmt_key = -1;
+                wdev->wext.connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
+                wdev->wext.ps = CONFIG_CFG80211_DEFAULT_PS_VALUE;
+                wdev->wext.ps_timeout = 500;
+                if (rdev->ops->set_power_mgmt)
+                        if (rdev->ops->set_power_mgmt(wdev->wiphy, dev,
+                                                      wdev->wext.ps,
+                                                      wdev->wext.ps_timeout)) {
+                                /* assume this means it's off */
+                                wdev->wext.ps = false;
+                        }
 #endif
-                mutex_unlock(&rdev->devlist_mtx);
                 break;
         case NETDEV_GOING_DOWN:
-                if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
+                switch (wdev->iftype) {
+                case NL80211_IFTYPE_ADHOC:
+                        cfg80211_leave_ibss(rdev, dev, true);
+                        break;
+                case NL80211_IFTYPE_STATION:
+                        wdev_lock(wdev);
+#ifdef CONFIG_WIRELESS_EXT
+                        kfree(wdev->wext.ie);
+                        wdev->wext.ie = NULL;
+                        wdev->wext.ie_len = 0;
+                        wdev->wext.connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
+#endif
+                        __cfg80211_disconnect(rdev, dev,
+                                              WLAN_REASON_DEAUTH_LEAVING, true);
+                        cfg80211_mlme_down(rdev, dev);
+                        wdev_unlock(wdev);
                         break;
-                if (!dev->ieee80211_ptr->ssid_len)
+                default:
                         break;
-                cfg80211_leave_ibss(rdev, dev, true);
+                }
                 break;
         case NETDEV_UP:
 #ifdef CONFIG_WIRELESS_EXT
-                if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
+                cfg80211_lock_rdev(rdev);
+                wdev_lock(wdev);
+                switch (wdev->iftype) {
+                case NL80211_IFTYPE_ADHOC:
+                        cfg80211_ibss_wext_join(rdev, wdev);
                         break;
-                if (!dev->ieee80211_ptr->wext.ibss.ssid_len)
+                case NL80211_IFTYPE_STATION:
+                        cfg80211_mgd_wext_connect(rdev, wdev);
                         break;
-                cfg80211_join_ibss(rdev, dev, &dev->ieee80211_ptr->wext.ibss);
-                break;
+                default:
+                        break;
+                }
+                wdev_unlock(wdev);
+                cfg80211_unlock_rdev(rdev);
 #endif
+                break;
         case NETDEV_UNREGISTER:
                 mutex_lock(&rdev->devlist_mtx);
-                if (!list_empty(&dev->ieee80211_ptr->list)) {
+                if (!list_empty(&wdev->list)) {
                         sysfs_remove_link(&dev->dev.kobj, "phy80211");
-                        list_del_init(&dev->ieee80211_ptr->list);
+                        list_del_init(&wdev->list);
                 }
                 mutex_unlock(&rdev->devlist_mtx);
+                mutex_destroy(&wdev->mtx);
+#ifdef CONFIG_WIRELESS_EXT
+                kfree(wdev->wext.keys);
+#endif
                 break;
         case NETDEV_PRE_UP:
+                if (!(wdev->wiphy->interface_modes & BIT(wdev->iftype)))
+                        return notifier_from_errno(-EOPNOTSUPP);
                 if (rfkill_blocked(rdev->rfkill))
                         return notifier_from_errno(-ERFKILL);
                 break;
diff --git a/net/wireless/core.h b/net/wireless/core.h
index bfa340c7abb5..2ec8ddbe57de 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -57,6 +57,14 @@ struct cfg80211_registered_device {
         u32 bss_generation;
         struct cfg80211_scan_request *scan_req; /* protected by RTNL */
         unsigned long suspend_at;
+        struct work_struct scan_done_wk;
+
+#ifdef CONFIG_NL80211_TESTMODE
+        struct genl_info *testmode_info;
+#endif
+
+        struct work_struct conn_work;
+        struct work_struct event_work;
 
 #ifdef CONFIG_CFG80211_DEBUGFS
         /* Debugfs entries */
@@ -89,13 +97,13 @@ bool wiphy_idx_valid(int wiphy_idx)
 }
 
 extern struct mutex cfg80211_mutex;
-extern struct list_head cfg80211_drv_list;
+extern struct list_head cfg80211_rdev_list;
 
 #define assert_cfg80211_lock() WARN_ON(!mutex_is_locked(&cfg80211_mutex))
 
 /*
  * You can use this to mark a wiphy_idx as not having an associated wiphy.
- * It guarantees cfg80211_drv_by_wiphy_idx(wiphy_idx) will return NULL
+ * It guarantees cfg80211_rdev_by_wiphy_idx(wiphy_idx) will return NULL
  */
 #define WIPHY_IDX_STALE -1
 
@@ -104,17 +112,35 @@ struct cfg80211_internal_bss {
         struct rb_node rbn;
         unsigned long ts;
         struct kref ref;
-        bool hold, ies_allocated;
+        atomic_t hold;
+        bool ies_allocated;
 
         /* must be last because of priv member */
         struct cfg80211_bss pub;
 };
 
-struct cfg80211_registered_device *cfg80211_drv_by_wiphy_idx(int wiphy_idx);
+static inline struct cfg80211_internal_bss *bss_from_pub(struct cfg80211_bss *pub)
+{
+        return container_of(pub, struct cfg80211_internal_bss, pub);
+}
+
+static inline void cfg80211_hold_bss(struct cfg80211_internal_bss *bss)
+{
+        atomic_inc(&bss->hold);
+}
+
+static inline void cfg80211_unhold_bss(struct cfg80211_internal_bss *bss)
+{
+        int r = atomic_dec_return(&bss->hold);
+        WARN_ON(r < 0);
+}
+
+
+struct cfg80211_registered_device *cfg80211_rdev_by_wiphy_idx(int wiphy_idx);
 int get_wiphy_idx(struct wiphy *wiphy);
 
 struct cfg80211_registered_device *
-__cfg80211_drv_from_info(struct genl_info *info);
+__cfg80211_rdev_from_info(struct genl_info *info);
 
 /*
  * This function returns a pointer to the driver
@@ -122,12 +148,12 @@ __cfg80211_drv_from_info(struct genl_info *info);
  * If successful, it returns non-NULL and also locks
  * the driver's mutex!
  *
- * This means that you need to call cfg80211_put_dev()
+ * This means that you need to call cfg80211_unlock_rdev()
  * before being allowed to acquire &cfg80211_mutex!
  *
  * This is necessary because we need to lock the global
  * mutex to get an item off the list safely, and then
- * we lock the drv mutex so it doesn't go away under us.
+ * we lock the rdev mutex so it doesn't go away under us.
  *
  * We don't want to keep cfg80211_mutex locked
  * for all the time in order to allow requests on
@@ -139,19 +165,90 @@ __cfg80211_drv_from_info(struct genl_info *info);
 extern struct cfg80211_registered_device *
 cfg80211_get_dev_from_info(struct genl_info *info);
 
-/* requires cfg80211_drv_mutex to be held! */
+/* requires cfg80211_rdev_mutex to be held! */
 struct wiphy *wiphy_idx_to_wiphy(int wiphy_idx);
 
 /* identical to cfg80211_get_dev_from_info but only operate on ifindex */
 extern struct cfg80211_registered_device *
 cfg80211_get_dev_from_ifindex(int ifindex);
 
-extern void cfg80211_put_dev(struct cfg80211_registered_device *drv);
+static inline void cfg80211_lock_rdev(struct cfg80211_registered_device *rdev)
+{
+        mutex_lock(&rdev->mtx);
+}
+
+static inline void cfg80211_unlock_rdev(struct cfg80211_registered_device *rdev)
+{
+        BUG_ON(IS_ERR(rdev) || !rdev);
+        mutex_unlock(&rdev->mtx);
+}
+
+static inline void wdev_lock(struct wireless_dev *wdev)
+        __acquires(wdev)
+{
+        mutex_lock(&wdev->mtx);
+        __acquire(wdev->mtx);
+}
+
+static inline void wdev_unlock(struct wireless_dev *wdev)
+        __releases(wdev)
+{
+        __release(wdev->mtx);
+        mutex_unlock(&wdev->mtx);
+}
+
+#define ASSERT_RDEV_LOCK(rdev) WARN_ON(!mutex_is_locked(&(rdev)->mtx));
+#define ASSERT_WDEV_LOCK(wdev) WARN_ON(!mutex_is_locked(&(wdev)->mtx));
+
+enum cfg80211_event_type {
+        EVENT_CONNECT_RESULT,
+        EVENT_ROAMED,
+        EVENT_DISCONNECTED,
+        EVENT_IBSS_JOINED,
+};
+
+struct cfg80211_event {
+        struct list_head list;
+        enum cfg80211_event_type type;
+
+        union {
+                struct {
+                        u8 bssid[ETH_ALEN];
+                        const u8 *req_ie;
+                        const u8 *resp_ie;
+                        size_t req_ie_len;
+                        size_t resp_ie_len;
+                        u16 status;
+                } cr;
+                struct {
+                        u8 bssid[ETH_ALEN];
+                        const u8 *req_ie;
+                        const u8 *resp_ie;
+                        size_t req_ie_len;
+                        size_t resp_ie_len;
+                } rm;
+                struct {
+                        const u8 *ie;
+                        size_t ie_len;
+                        u16 reason;
+                } dc;
+                struct {
+                        u8 bssid[ETH_ALEN];
+                } ij;
+        };
+};
+
+struct cfg80211_cached_keys {
+        struct key_params params[6];
+        u8 data[6][WLAN_MAX_KEY_LEN];
+        int def, defmgmt;
+};
+
 
 /* free object */
-extern void cfg80211_dev_free(struct cfg80211_registered_device *drv);
+extern void cfg80211_dev_free(struct cfg80211_registered_device *rdev);
 
-extern int cfg80211_dev_rename(struct cfg80211_registered_device *drv,
+extern int cfg80211_dev_rename(struct cfg80211_registered_device *rdev,
                                char *newname);
 
 void ieee80211_set_bitrate_flags(struct wiphy *wiphy);
@@ -163,15 +260,98 @@ void cfg80211_bss_age(struct cfg80211_registered_device *dev,
                       unsigned long age_secs);
 
 /* IBSS */
+int __cfg80211_join_ibss(struct cfg80211_registered_device *rdev,
+                         struct net_device *dev,
+                         struct cfg80211_ibss_params *params,
+                         struct cfg80211_cached_keys *connkeys);
 int cfg80211_join_ibss(struct cfg80211_registered_device *rdev,
                        struct net_device *dev,
-                       struct cfg80211_ibss_params *params);
+                       struct cfg80211_ibss_params *params,
+                       struct cfg80211_cached_keys *connkeys);
 void cfg80211_clear_ibss(struct net_device *dev, bool nowext);
 int cfg80211_leave_ibss(struct cfg80211_registered_device *rdev,
                         struct net_device *dev, bool nowext);
+void __cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid);
+int cfg80211_ibss_wext_join(struct cfg80211_registered_device *rdev,
+                            struct wireless_dev *wdev);
+
+/* MLME */
+int __cfg80211_mlme_auth(struct cfg80211_registered_device *rdev,
+                         struct net_device *dev,
+                         struct ieee80211_channel *chan,
+                         enum nl80211_auth_type auth_type,
+                         const u8 *bssid,
+                         const u8 *ssid, int ssid_len,
+                         const u8 *ie, int ie_len,
+                         const u8 *key, int key_len, int key_idx);
+int cfg80211_mlme_auth(struct cfg80211_registered_device *rdev,
+                       struct net_device *dev, struct ieee80211_channel *chan,
+                       enum nl80211_auth_type auth_type, const u8 *bssid,
+                       const u8 *ssid, int ssid_len,
+                       const u8 *ie, int ie_len,
+                       const u8 *key, int key_len, int key_idx);
+int __cfg80211_mlme_assoc(struct cfg80211_registered_device *rdev,
+                          struct net_device *dev,
+                          struct ieee80211_channel *chan,
+                          const u8 *bssid, const u8 *prev_bssid,
+                          const u8 *ssid, int ssid_len,
+                          const u8 *ie, int ie_len, bool use_mfp,
+                          struct cfg80211_crypto_settings *crypt);
+int cfg80211_mlme_assoc(struct cfg80211_registered_device *rdev,
+                        struct net_device *dev, struct ieee80211_channel *chan,
+                        const u8 *bssid, const u8 *prev_bssid,
+                        const u8 *ssid, int ssid_len,
+                        const u8 *ie, int ie_len, bool use_mfp,
+                        struct cfg80211_crypto_settings *crypt);
+int __cfg80211_mlme_deauth(struct cfg80211_registered_device *rdev,
+                           struct net_device *dev, const u8 *bssid,
+                           const u8 *ie, int ie_len, u16 reason);
+int cfg80211_mlme_deauth(struct cfg80211_registered_device *rdev,
+                         struct net_device *dev, const u8 *bssid,
+                         const u8 *ie, int ie_len, u16 reason);
+int cfg80211_mlme_disassoc(struct cfg80211_registered_device *rdev,
+                           struct net_device *dev, const u8 *bssid,
+                           const u8 *ie, int ie_len, u16 reason);
+void cfg80211_mlme_down(struct cfg80211_registered_device *rdev,
+                        struct net_device *dev);
+void __cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
+                               const u8 *req_ie, size_t req_ie_len,
+                               const u8 *resp_ie, size_t resp_ie_len,
+                               u16 status, bool wextev);
+
+/* SME */
+int __cfg80211_connect(struct cfg80211_registered_device *rdev,
+                       struct net_device *dev,
+                       struct cfg80211_connect_params *connect,
+                       struct cfg80211_cached_keys *connkeys);
+int cfg80211_connect(struct cfg80211_registered_device *rdev,
+                     struct net_device *dev,
+                     struct cfg80211_connect_params *connect,
+                     struct cfg80211_cached_keys *connkeys);
+int __cfg80211_disconnect(struct cfg80211_registered_device *rdev,
+                          struct net_device *dev, u16 reason,
+                          bool wextev);
+int cfg80211_disconnect(struct cfg80211_registered_device *rdev,
+                        struct net_device *dev, u16 reason,
+                        bool wextev);
+void __cfg80211_roamed(struct wireless_dev *wdev, const u8 *bssid,
+                       const u8 *req_ie, size_t req_ie_len,
+                       const u8 *resp_ie, size_t resp_ie_len);
+int cfg80211_mgd_wext_connect(struct cfg80211_registered_device *rdev,
+                              struct wireless_dev *wdev);
+
+void cfg80211_conn_work(struct work_struct *work);
 
 /* internal helpers */
-int cfg80211_validate_key_settings(struct key_params *params, int key_idx,
+int cfg80211_validate_key_settings(struct cfg80211_registered_device *rdev,
+                                   struct key_params *params, int key_idx,
                                    const u8 *mac_addr);
+void __cfg80211_disconnected(struct net_device *dev, const u8 *ie,
+                             size_t ie_len, u16 reason, bool from_ap);
+void cfg80211_sme_scan_done(struct net_device *dev);
+void cfg80211_sme_rx_auth(struct net_device *dev, const u8 *buf, size_t len);
+void cfg80211_sme_disassoc(struct net_device *dev, int idx);
+void __cfg80211_scan_done(struct work_struct *wk);
+void cfg80211_upload_connect_keys(struct wireless_dev *wdev);
 
 #endif /* __NET_WIRELESS_CORE_H */
diff --git a/net/wireless/debugfs.c b/net/wireless/debugfs.c
index 679ddfcec1ee..13d93d84f902 100644
--- a/net/wireless/debugfs.c
+++ b/net/wireless/debugfs.c
@@ -104,15 +104,15 @@ static const struct file_operations ht40allow_map_ops = {
 };
 
 #define DEBUGFS_ADD(name)                                               \
-        drv->debugfs.name = debugfs_create_file(#name, S_IRUGO, phyd,   \
-                                                  &drv->wiphy, &name## _ops);
+        rdev->debugfs.name = debugfs_create_file(#name, S_IRUGO, phyd,  \
+                                                  &rdev->wiphy, &name## _ops);
 #define DEBUGFS_DEL(name)                                               \
-        debugfs_remove(drv->debugfs.name);                              \
-        drv->debugfs.name = NULL;
+        debugfs_remove(rdev->debugfs.name);                             \
+        rdev->debugfs.name = NULL;
 
-void cfg80211_debugfs_drv_add(struct cfg80211_registered_device *drv)
+void cfg80211_debugfs_rdev_add(struct cfg80211_registered_device *rdev)
 {
-        struct dentry *phyd = drv->wiphy.debugfsdir;
+        struct dentry *phyd = rdev->wiphy.debugfsdir;
 
         DEBUGFS_ADD(rts_threshold);
         DEBUGFS_ADD(fragmentation_threshold);
@@ -121,7 +121,7 @@ void cfg80211_debugfs_drv_add(struct cfg80211_registered_device *drv)
         DEBUGFS_ADD(ht40allow_map);
 }
 
-void cfg80211_debugfs_drv_del(struct cfg80211_registered_device *drv)
+void cfg80211_debugfs_rdev_del(struct cfg80211_registered_device *rdev)
 {
         DEBUGFS_DEL(rts_threshold);
         DEBUGFS_DEL(fragmentation_threshold);
diff --git a/net/wireless/debugfs.h b/net/wireless/debugfs.h
index c226983ae66b..6419b6d6ce3e 100644
--- a/net/wireless/debugfs.h
+++ b/net/wireless/debugfs.h
@@ -2,13 +2,13 @@
 #define __CFG80211_DEBUGFS_H
 
 #ifdef CONFIG_CFG80211_DEBUGFS
-void cfg80211_debugfs_drv_add(struct cfg80211_registered_device *drv);
-void cfg80211_debugfs_drv_del(struct cfg80211_registered_device *drv);
+void cfg80211_debugfs_rdev_add(struct cfg80211_registered_device *rdev);
+void cfg80211_debugfs_rdev_del(struct cfg80211_registered_device *rdev);
 #else
 static inline
-void cfg80211_debugfs_drv_add(struct cfg80211_registered_device *drv) {}
+void cfg80211_debugfs_rdev_add(struct cfg80211_registered_device *rdev) {}
 static inline
-void cfg80211_debugfs_drv_del(struct cfg80211_registered_device *drv) {}
+void cfg80211_debugfs_rdev_del(struct cfg80211_registered_device *rdev) {}
 #endif
 
 #endif /* __CFG80211_DEBUGFS_H */
diff --git a/net/wireless/ibss.c b/net/wireless/ibss.c
index a4a1c3498ff2..8b65e212ae49 100644
--- a/net/wireless/ibss.c
+++ b/net/wireless/ibss.c
@@ -10,7 +10,7 @@
 #include "nl80211.h"
 
 
-void cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid, gfp_t gfp)
+void __cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         struct cfg80211_bss *bss;
@@ -24,9 +24,6 @@ void cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid, gfp_t gfp)
         if (WARN_ON(!wdev->ssid_len))
                 return;
 
-        if (memcmp(bssid, wdev->bssid, ETH_ALEN) == 0)
-                return;
-
         bss = cfg80211_get_bss(wdev->wiphy, NULL, bssid,
                                wdev->ssid, wdev->ssid_len,
                                WLAN_CAPABILITY_IBSS, WLAN_CAPABILITY_IBSS);
@@ -36,39 +33,69 @@ void cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid, gfp_t gfp)
 
         if (wdev->current_bss) {
                 cfg80211_unhold_bss(wdev->current_bss);
-                cfg80211_put_bss(wdev->current_bss);
+                cfg80211_put_bss(&wdev->current_bss->pub);
         }
 
-        cfg80211_hold_bss(bss);
-        wdev->current_bss = bss;
-        memcpy(wdev->bssid, bssid, ETH_ALEN);
+        cfg80211_hold_bss(bss_from_pub(bss));
+        wdev->current_bss = bss_from_pub(bss);
 
-        nl80211_send_ibss_bssid(wiphy_to_dev(wdev->wiphy), dev, bssid, gfp);
+        cfg80211_upload_connect_keys(wdev);
+
+        nl80211_send_ibss_bssid(wiphy_to_dev(wdev->wiphy), dev, bssid,
+                                GFP_KERNEL);
 #ifdef CONFIG_WIRELESS_EXT
         memset(&wrqu, 0, sizeof(wrqu));
         memcpy(wrqu.ap_addr.sa_data, bssid, ETH_ALEN);
         wireless_send_event(dev, SIOCGIWAP, &wrqu, NULL);
 #endif
 }
+
+void cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid, gfp_t gfp)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct cfg80211_event *ev;
+        unsigned long flags;
+
+        ev = kzalloc(sizeof(*ev), gfp);
+        if (!ev)
+                return;
+
+        ev->type = EVENT_IBSS_JOINED;
+        memcpy(ev->cr.bssid, bssid, ETH_ALEN);
+
+        spin_lock_irqsave(&wdev->event_lock, flags);
+        list_add_tail(&ev->list, &wdev->event_list);
+        spin_unlock_irqrestore(&wdev->event_lock, flags);
+        schedule_work(&rdev->event_work);
+}
 EXPORT_SYMBOL(cfg80211_ibss_joined);
 
-int cfg80211_join_ibss(struct cfg80211_registered_device *rdev,
-                       struct net_device *dev,
-                       struct cfg80211_ibss_params *params)
+int __cfg80211_join_ibss(struct cfg80211_registered_device *rdev,
+                         struct net_device *dev,
+                         struct cfg80211_ibss_params *params,
+                         struct cfg80211_cached_keys *connkeys)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         int err;
 
+        ASSERT_WDEV_LOCK(wdev);
+
         if (wdev->ssid_len)
                 return -EALREADY;
 
+        if (WARN_ON(wdev->connect_keys))
+                kfree(wdev->connect_keys);
+        wdev->connect_keys = connkeys;
+
 #ifdef CONFIG_WIRELESS_EXT
         wdev->wext.ibss.channel = params->channel;
 #endif
         err = rdev->ops->join_ibss(&rdev->wiphy, dev, params);
-
-        if (err)
+        if (err) {
+                wdev->connect_keys = NULL;
                 return err;
+        }
 
         memcpy(wdev->ssid, params->ssid, params->ssid_len);
         wdev->ssid_len = params->ssid_len;
@@ -76,45 +103,105 @@ int cfg80211_join_ibss(struct cfg80211_registered_device *rdev,
         return 0;
 }
 
-void cfg80211_clear_ibss(struct net_device *dev, bool nowext)
+int cfg80211_join_ibss(struct cfg80211_registered_device *rdev,
+                       struct net_device *dev,
+                       struct cfg80211_ibss_params *params,
+                       struct cfg80211_cached_keys *connkeys)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
+        int err;
+
+        wdev_lock(wdev);
+        err = __cfg80211_join_ibss(rdev, dev, params, connkeys);
+        wdev_unlock(wdev);
+
+        return err;
+}
+
+static void __cfg80211_clear_ibss(struct net_device *dev, bool nowext)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        int i;
+
+        ASSERT_WDEV_LOCK(wdev);
+
+        kfree(wdev->connect_keys);
+        wdev->connect_keys = NULL;
+
+        /*
+         * Delete all the keys ... pairwise keys can't really
+         * exist any more anyway, but default keys might.
+         */
+        if (rdev->ops->del_key)
+                for (i = 0; i < 6; i++)
+                        rdev->ops->del_key(wdev->wiphy, dev, i, NULL);
 
         if (wdev->current_bss) {
                 cfg80211_unhold_bss(wdev->current_bss);
-                cfg80211_put_bss(wdev->current_bss);
+                cfg80211_put_bss(&wdev->current_bss->pub);
         }
 
         wdev->current_bss = NULL;
         wdev->ssid_len = 0;
-        memset(wdev->bssid, 0, ETH_ALEN);
 #ifdef CONFIG_WIRELESS_EXT
         if (!nowext)
                 wdev->wext.ibss.ssid_len = 0;
 #endif
 }
 
-int cfg80211_leave_ibss(struct cfg80211_registered_device *rdev,
-                        struct net_device *dev, bool nowext)
+void cfg80211_clear_ibss(struct net_device *dev, bool nowext)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+
+        wdev_lock(wdev);
+        __cfg80211_clear_ibss(dev, nowext);
+        wdev_unlock(wdev);
+}
+
+static int __cfg80211_leave_ibss(struct cfg80211_registered_device *rdev,
+                                 struct net_device *dev, bool nowext)
 {
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
         int err;
 
+        ASSERT_WDEV_LOCK(wdev);
+
+        if (!wdev->ssid_len)
+                return -ENOLINK;
+
         err = rdev->ops->leave_ibss(&rdev->wiphy, dev);
 
         if (err)
                 return err;
 
-        cfg80211_clear_ibss(dev, nowext);
+        __cfg80211_clear_ibss(dev, nowext);
 
         return 0;
 }
 
+int cfg80211_leave_ibss(struct cfg80211_registered_device *rdev,
+                        struct net_device *dev, bool nowext)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        int err;
+
+        wdev_lock(wdev);
+        err = __cfg80211_leave_ibss(rdev, dev, nowext);
+        wdev_unlock(wdev);
+
+        return err;
+}
+
 #ifdef CONFIG_WIRELESS_EXT
-static int cfg80211_ibss_wext_join(struct cfg80211_registered_device *rdev,
-                                   struct wireless_dev *wdev)
+int cfg80211_ibss_wext_join(struct cfg80211_registered_device *rdev,
+                            struct wireless_dev *wdev)
 {
+        struct cfg80211_cached_keys *ck = NULL;
         enum ieee80211_band band;
-        int i;
+        int i, err;
+
+        ASSERT_WDEV_LOCK(wdev);
 
         if (!wdev->wext.ibss.beacon_interval)
                 wdev->wext.ibss.beacon_interval = 100;
@@ -154,8 +241,24 @@ static int cfg80211_ibss_wext_join(struct cfg80211_registered_device *rdev,
         if (!netif_running(wdev->netdev))
                 return 0;
 
-        return cfg80211_join_ibss(wiphy_to_dev(wdev->wiphy),
-                                  wdev->netdev, &wdev->wext.ibss);
+        if (wdev->wext.keys)
+                wdev->wext.keys->def = wdev->wext.default_key;
+
+        wdev->wext.ibss.privacy = wdev->wext.default_key != -1;
+
+        if (wdev->wext.keys) {
+                ck = kmemdup(wdev->wext.keys, sizeof(*ck), GFP_KERNEL);
+                if (!ck)
+                        return -ENOMEM;
+                for (i = 0; i < 6; i++)
+                        ck->params[i].key = ck->data[i];
+        }
+        err = __cfg80211_join_ibss(rdev, wdev->netdev,
+                                   &wdev->wext.ibss, ck);
+        if (err)
+                kfree(ck);
+
+        return err;
 }
 
 int cfg80211_ibss_wext_siwfreq(struct net_device *dev,
@@ -185,12 +288,15 @@ int cfg80211_ibss_wext_siwfreq(struct net_device *dev,
         if (wdev->wext.ibss.channel == chan)
                 return 0;
 
-        if (wdev->ssid_len) {
-                err = cfg80211_leave_ibss(wiphy_to_dev(wdev->wiphy),
-                                          dev, true);
-                if (err)
-                        return err;
-        }
+        wdev_lock(wdev);
+        err = 0;
+        if (wdev->ssid_len)
+                err = __cfg80211_leave_ibss(wiphy_to_dev(wdev->wiphy),
+                                            dev, true);
+        wdev_unlock(wdev);
+
+        if (err)
+                return err;
 
         if (chan) {
                 wdev->wext.ibss.channel = chan;
@@ -200,7 +306,11 @@ int cfg80211_ibss_wext_siwfreq(struct net_device *dev,
                 wdev->wext.ibss.channel_fixed = false;
         }
 
-        return cfg80211_ibss_wext_join(wiphy_to_dev(wdev->wiphy), wdev);
+        wdev_lock(wdev);
+        err = cfg80211_ibss_wext_join(wiphy_to_dev(wdev->wiphy), wdev);
+        wdev_unlock(wdev);
+
+        return err;
 }
 /* temporary symbol - mark GPL - in the future the handler won't be */
 EXPORT_SYMBOL_GPL(cfg80211_ibss_wext_siwfreq);
@@ -216,10 +326,12 @@ int cfg80211_ibss_wext_giwfreq(struct net_device *dev,
         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_ADHOC))
                 return -EINVAL;
 
+        wdev_lock(wdev);
         if (wdev->current_bss)
-                chan = wdev->current_bss->channel;
+                chan = wdev->current_bss->pub.channel;
         else if (wdev->wext.ibss.channel)
                 chan = wdev->wext.ibss.channel;
+        wdev_unlock(wdev);
 
         if (chan) {
                 freq->m = chan->center_freq;
@@ -248,12 +360,15 @@ int cfg80211_ibss_wext_siwessid(struct net_device *dev,
         if (!wiphy_to_dev(wdev->wiphy)->ops->join_ibss)
                 return -EOPNOTSUPP;
 
-        if (wdev->ssid_len) {
-                err = cfg80211_leave_ibss(wiphy_to_dev(wdev->wiphy),
-                                          dev, true);
-                if (err)
-                        return err;
-        }
+        wdev_lock(wdev);
+        err = 0;
+        if (wdev->ssid_len)
+                err = __cfg80211_leave_ibss(wiphy_to_dev(wdev->wiphy),
+                                            dev, true);
+        wdev_unlock(wdev);
+
+        if (err)
+                return err;
 
         /* iwconfig uses nul termination in SSID.. */
         if (len > 0 && ssid[len - 1] == '\0')
@@ -263,7 +378,11 @@ int cfg80211_ibss_wext_siwessid(struct net_device *dev,
         memcpy(wdev->wext.ibss.ssid, ssid, len);
         wdev->wext.ibss.ssid_len = len;
 
-        return cfg80211_ibss_wext_join(wiphy_to_dev(wdev->wiphy), wdev);
+        wdev_lock(wdev);
+        err = cfg80211_ibss_wext_join(wiphy_to_dev(wdev->wiphy), wdev);
+        wdev_unlock(wdev);
+
+        return err;
 }
 /* temporary symbol - mark GPL - in the future the handler won't be */
 EXPORT_SYMBOL_GPL(cfg80211_ibss_wext_siwessid);
@@ -280,6 +399,7 @@ int cfg80211_ibss_wext_giwessid(struct net_device *dev,
 
         data->flags = 0;
 
+        wdev_lock(wdev);
         if (wdev->ssid_len) {
                 data->flags = 1;
                 data->length = wdev->ssid_len;
@@ -289,6 +409,7 @@ int cfg80211_ibss_wext_giwessid(struct net_device *dev,
                 data->length = wdev->wext.ibss.ssid_len;
                 memcpy(ssid, wdev->wext.ibss.ssid, data->length);
         }
+        wdev_unlock(wdev);
 
         return 0;
 }
@@ -326,12 +447,15 @@ int cfg80211_ibss_wext_siwap(struct net_device *dev,
             compare_ether_addr(bssid, wdev->wext.ibss.bssid) == 0)
                 return 0;
 
-        if (wdev->ssid_len) {
-                err = cfg80211_leave_ibss(wiphy_to_dev(wdev->wiphy),
-                                          dev, true);
-                if (err)
-                        return err;
-        }
+        wdev_lock(wdev);
+        err = 0;
+        if (wdev->ssid_len)
+                err = __cfg80211_leave_ibss(wiphy_to_dev(wdev->wiphy),
+                                            dev, true);
+        wdev_unlock(wdev);
+
+        if (err)
+                return err;
 
         if (bssid) {
                 memcpy(wdev->wext.bssid, bssid, ETH_ALEN);
@@ -339,7 +463,11 @@ int cfg80211_ibss_wext_siwap(struct net_device *dev,
         } else
                 wdev->wext.ibss.bssid = NULL;
 
-        return cfg80211_ibss_wext_join(wiphy_to_dev(wdev->wiphy), wdev);
+        wdev_lock(wdev);
+        err = cfg80211_ibss_wext_join(wiphy_to_dev(wdev->wiphy), wdev);
+        wdev_unlock(wdev);
+
+        return err;
 }
 /* temporary symbol - mark GPL - in the future the handler won't be */
 EXPORT_SYMBOL_GPL(cfg80211_ibss_wext_siwap);
@@ -356,12 +484,16 @@ int cfg80211_ibss_wext_giwap(struct net_device *dev,
 
         ap_addr->sa_family = ARPHRD_ETHER;
 
-        if (wdev->wext.ibss.bssid) {
+        wdev_lock(wdev);
+        if (wdev->current_bss)
+                memcpy(ap_addr->sa_data, wdev->current_bss->pub.bssid, ETH_ALEN);
+        else if (wdev->wext.ibss.bssid)
                 memcpy(ap_addr->sa_data, wdev->wext.ibss.bssid, ETH_ALEN);
-                return 0;
-        }
+        else
+                memset(ap_addr->sa_data, 0, ETH_ALEN);
+
+        wdev_unlock(wdev);
 
-        memcpy(ap_addr->sa_data, wdev->bssid, ETH_ALEN);
         return 0;
 }
 /* temporary symbol - mark GPL - in the future the handler won't be */
diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c
index 42184361a109..5b9b22120824 100644
--- a/net/wireless/mlme.c
+++ b/net/wireless/mlme.c
@@ -14,69 +14,608 @@
 
 void cfg80211_send_rx_auth(struct net_device *dev, const u8 *buf, size_t len)
 {
-        struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct wiphy *wiphy = wdev->wiphy;
         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
-        nl80211_send_rx_auth(rdev, dev, buf, len);
+        struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
+        u8 *bssid = mgmt->bssid;
+        int i;
+        u16 status = le16_to_cpu(mgmt->u.auth.status_code);
+        bool done = false;
+
+        wdev_lock(wdev);
+
+        for (i = 0; i < MAX_AUTH_BSSES; i++) {
+                if (wdev->authtry_bsses[i] &&
+                    memcmp(wdev->authtry_bsses[i]->pub.bssid, bssid,
+                                                        ETH_ALEN) == 0) {
+                        if (status == WLAN_STATUS_SUCCESS) {
+                                wdev->auth_bsses[i] = wdev->authtry_bsses[i];
+                        } else {
+                                cfg80211_unhold_bss(wdev->authtry_bsses[i]);
+                                cfg80211_put_bss(&wdev->authtry_bsses[i]->pub);
+                        }
+                        wdev->authtry_bsses[i] = NULL;
+                        done = true;
+                        break;
+                }
+        }
+
+        WARN_ON(!done);
+
+        nl80211_send_rx_auth(rdev, dev, buf, len, GFP_KERNEL);
+        cfg80211_sme_rx_auth(dev, buf, len);
+
+        wdev_unlock(wdev);
 }
 EXPORT_SYMBOL(cfg80211_send_rx_auth);
 
 void cfg80211_send_rx_assoc(struct net_device *dev, const u8 *buf, size_t len)
 {
-        struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
+        u16 status_code;
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct wiphy *wiphy = wdev->wiphy;
         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
-        nl80211_send_rx_assoc(rdev, dev, buf, len);
+        struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
+        u8 *ie = mgmt->u.assoc_resp.variable;
+        int i, ieoffs = offsetof(struct ieee80211_mgmt, u.assoc_resp.variable);
+        bool done;
+
+        wdev_lock(wdev);
+
+        status_code = le16_to_cpu(mgmt->u.assoc_resp.status_code);
+
+        nl80211_send_rx_assoc(rdev, dev, buf, len, GFP_KERNEL);
+
+        __cfg80211_connect_result(dev, mgmt->bssid, NULL, 0, ie, len - ieoffs,
+                                  status_code,
+                                  status_code == WLAN_STATUS_SUCCESS);
+
+        if (status_code == WLAN_STATUS_SUCCESS) {
+                for (i = 0; wdev->current_bss && i < MAX_AUTH_BSSES; i++) {
+                        if (wdev->auth_bsses[i] == wdev->current_bss) {
+                                cfg80211_unhold_bss(wdev->auth_bsses[i]);
+                                cfg80211_put_bss(&wdev->auth_bsses[i]->pub);
+                                wdev->auth_bsses[i] = NULL;
+                                done = true;
+                                break;
+                        }
+                }
+
+                WARN_ON(!done);
+        }
+
+        wdev_unlock(wdev);
 }
 EXPORT_SYMBOL(cfg80211_send_rx_assoc);
 
-void cfg80211_send_deauth(struct net_device *dev, const u8 *buf, size_t len)
+static void __cfg80211_send_deauth(struct net_device *dev,
+                                   const u8 *buf, size_t len)
 {
-        struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct wiphy *wiphy = wdev->wiphy;
         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
-        nl80211_send_deauth(rdev, dev, buf, len);
+        struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
+        const u8 *bssid = mgmt->bssid;
+        int i;
+        bool done = false;
+
+        ASSERT_WDEV_LOCK(wdev);
+
+        nl80211_send_deauth(rdev, dev, buf, len, GFP_KERNEL);
+
+        if (wdev->current_bss &&
+            memcmp(wdev->current_bss->pub.bssid, bssid, ETH_ALEN) == 0) {
+                done = true;
+                cfg80211_unhold_bss(wdev->current_bss);
+                cfg80211_put_bss(&wdev->current_bss->pub);
+                wdev->current_bss = NULL;
+        } else for (i = 0; i < MAX_AUTH_BSSES; i++) {
+                if (wdev->auth_bsses[i] &&
+                    memcmp(wdev->auth_bsses[i]->pub.bssid, bssid, ETH_ALEN) == 0) {
+                        cfg80211_unhold_bss(wdev->auth_bsses[i]);
+                        cfg80211_put_bss(&wdev->auth_bsses[i]->pub);
+                        wdev->auth_bsses[i] = NULL;
+                        done = true;
+                        break;
+                }
+                if (wdev->authtry_bsses[i] &&
+                    memcmp(wdev->authtry_bsses[i]->pub.bssid, bssid, ETH_ALEN) == 0) {
+                        cfg80211_unhold_bss(wdev->authtry_bsses[i]);
+                        cfg80211_put_bss(&wdev->authtry_bsses[i]->pub);
+                        wdev->authtry_bsses[i] = NULL;
+                        done = true;
+                        break;
+                }
+        }
+
+        WARN_ON(!done);
+
+        if (wdev->sme_state == CFG80211_SME_CONNECTED) {
+                u16 reason_code;
+                bool from_ap;
+
+                reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
+
+                from_ap = memcmp(mgmt->da, dev->dev_addr, ETH_ALEN) == 0;
+                __cfg80211_disconnected(dev, NULL, 0, reason_code, from_ap);
+        } else if (wdev->sme_state == CFG80211_SME_CONNECTING) {
+                __cfg80211_connect_result(dev, mgmt->bssid, NULL, 0, NULL, 0,
+                                          WLAN_STATUS_UNSPECIFIED_FAILURE,
+                                          false);
+        }
+}
+
+
+void cfg80211_send_deauth(struct net_device *dev, const u8 *buf, size_t len,
+                          void *cookie)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+
+        BUG_ON(cookie && wdev != cookie);
+
+        if (cookie) {
+                /* called within callback */
+                __cfg80211_send_deauth(dev, buf, len);
+        } else {
+                wdev_lock(wdev);
+                __cfg80211_send_deauth(dev, buf, len);
+                wdev_unlock(wdev);
+        }
 }
 EXPORT_SYMBOL(cfg80211_send_deauth);
 
-void cfg80211_send_disassoc(struct net_device *dev, const u8 *buf, size_t len)
+static void __cfg80211_send_disassoc(struct net_device *dev,
+                                     const u8 *buf, size_t len)
 {
-        struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct wiphy *wiphy = wdev->wiphy;
         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
-        nl80211_send_disassoc(rdev, dev, buf, len);
+        struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
+        const u8 *bssid = mgmt->bssid;
+        int i;
+        u16 reason_code;
+        bool from_ap;
+        bool done = false;
+
+        ASSERT_WDEV_LOCK(wdev);
+
+        nl80211_send_disassoc(rdev, dev, buf, len, GFP_KERNEL);
+
+        if (wdev->sme_state != CFG80211_SME_CONNECTED)
+                return;
+
+        if (wdev->current_bss &&
+            memcmp(wdev->current_bss, bssid, ETH_ALEN) == 0) {
+                for (i = 0; i < MAX_AUTH_BSSES; i++) {
+                        if (wdev->authtry_bsses[i] || wdev->auth_bsses[i])
+                                continue;
+                        wdev->auth_bsses[i] = wdev->current_bss;
+                        wdev->current_bss = NULL;
+                        done = true;
+                        cfg80211_sme_disassoc(dev, i);
+                        break;
+                }
+                WARN_ON(!done);
+        } else
+                WARN_ON(1);
+
+
+        reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);
+
+        from_ap = memcmp(mgmt->da, dev->dev_addr, ETH_ALEN) == 0;
+        __cfg80211_disconnected(dev, NULL, 0, reason_code, from_ap);
 }
-EXPORT_SYMBOL(cfg80211_send_disassoc);
 
-static void cfg80211_wext_disconnected(struct net_device *dev)
+void cfg80211_send_disassoc(struct net_device *dev, const u8 *buf, size_t len,
+                            void *cookie)
 {
-#ifdef CONFIG_WIRELESS_EXT
-        union iwreq_data wrqu;
-        memset(&wrqu, 0, sizeof(wrqu));
-        wireless_send_event(dev, SIOCGIWAP, &wrqu, NULL);
-#endif
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+
+        BUG_ON(cookie && wdev != cookie);
+
+        if (cookie) {
+                /* called within callback */
+                __cfg80211_send_disassoc(dev, buf, len);
+        } else {
+                wdev_lock(wdev);
+                __cfg80211_send_disassoc(dev, buf, len);
+                wdev_unlock(wdev);
+        }
 }
+EXPORT_SYMBOL(cfg80211_send_disassoc);
 
 void cfg80211_send_auth_timeout(struct net_device *dev, const u8 *addr)
 {
-        struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct wiphy *wiphy = wdev->wiphy;
         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
-        nl80211_send_auth_timeout(rdev, dev, addr);
-        cfg80211_wext_disconnected(dev);
+        int i;
+        bool done = false;
+
+        wdev_lock(wdev);
+
+        nl80211_send_auth_timeout(rdev, dev, addr, GFP_KERNEL);
+        if (wdev->sme_state == CFG80211_SME_CONNECTING)
+                __cfg80211_connect_result(dev, addr, NULL, 0, NULL, 0,
+                                          WLAN_STATUS_UNSPECIFIED_FAILURE,
+                                          false);
+
+        for (i = 0; addr && i < MAX_AUTH_BSSES; i++) {
+                if (wdev->authtry_bsses[i] &&
+                    memcmp(wdev->authtry_bsses[i]->pub.bssid,
+                           addr, ETH_ALEN) == 0) {
+                        cfg80211_unhold_bss(wdev->authtry_bsses[i]);
+                        cfg80211_put_bss(&wdev->authtry_bsses[i]->pub);
+                        wdev->authtry_bsses[i] = NULL;
+                        done = true;
+                        break;
+                }
+        }
+
+        WARN_ON(!done);
+
+        wdev_unlock(wdev);
 }
 EXPORT_SYMBOL(cfg80211_send_auth_timeout);
 
 void cfg80211_send_assoc_timeout(struct net_device *dev, const u8 *addr)
 {
-        struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct wiphy *wiphy = wdev->wiphy;
         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
-        nl80211_send_assoc_timeout(rdev, dev, addr);
-        cfg80211_wext_disconnected(dev);
+        int i;
+        bool done = false;
+
+        wdev_lock(wdev);
+
+        nl80211_send_assoc_timeout(rdev, dev, addr, GFP_KERNEL);
+        if (wdev->sme_state == CFG80211_SME_CONNECTING)
+                __cfg80211_connect_result(dev, addr, NULL, 0, NULL, 0,
+                                          WLAN_STATUS_UNSPECIFIED_FAILURE,
+                                          false);
+
+        for (i = 0; addr && i < MAX_AUTH_BSSES; i++) {
+                if (wdev->auth_bsses[i] &&
+                    memcmp(wdev->auth_bsses[i]->pub.bssid,
+                           addr, ETH_ALEN) == 0) {
+                        cfg80211_unhold_bss(wdev->auth_bsses[i]);
+                        cfg80211_put_bss(&wdev->auth_bsses[i]->pub);
+                        wdev->auth_bsses[i] = NULL;
+                        done = true;
+                        break;
+                }
+        }
+
+        WARN_ON(!done);
+
+        wdev_unlock(wdev);
 }
 EXPORT_SYMBOL(cfg80211_send_assoc_timeout);
 
 void cfg80211_michael_mic_failure(struct net_device *dev, const u8 *addr,
                                   enum nl80211_key_type key_type, int key_id,
-                                  const u8 *tsc)
+                                  const u8 *tsc, gfp_t gfp)
 {
         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
-        nl80211_michael_mic_failure(rdev, dev, addr, key_type, key_id, tsc);
+#ifdef CONFIG_WIRELESS_EXT
+        union iwreq_data wrqu;
+        char *buf = kmalloc(128, gfp);
+
+        if (buf) {
+                sprintf(buf, "MLME-MICHAELMICFAILURE.indication("
+                        "keyid=%d %scast addr=%pM)", key_id,
+                        key_type == NL80211_KEYTYPE_GROUP ? "broad" : "uni",
+                        addr);
+                memset(&wrqu, 0, sizeof(wrqu));
+                wrqu.data.length = strlen(buf);
+                wireless_send_event(dev, IWEVCUSTOM, &wrqu, buf);
+                kfree(buf);
+        }
+#endif
+
+        nl80211_michael_mic_failure(rdev, dev, addr, key_type, key_id, tsc, gfp);
 }
 EXPORT_SYMBOL(cfg80211_michael_mic_failure);
+
+/* some MLME handling for userspace SME */
+int __cfg80211_mlme_auth(struct cfg80211_registered_device *rdev,
+                         struct net_device *dev,
+                         struct ieee80211_channel *chan,
+                         enum nl80211_auth_type auth_type,
+                         const u8 *bssid,
+                         const u8 *ssid, int ssid_len,
+                         const u8 *ie, int ie_len,
+                         const u8 *key, int key_len, int key_idx)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_auth_request req;
+        struct cfg80211_internal_bss *bss;
+        int i, err, slot = -1, nfree = 0;
+
+        ASSERT_WDEV_LOCK(wdev);
+
+        if (auth_type == NL80211_AUTHTYPE_SHARED_KEY)
+                if (!key || !key_len || key_idx < 0 || key_idx > 4)
+                        return -EINVAL;
+
+        if (wdev->current_bss &&
+            memcmp(bssid, wdev->current_bss->pub.bssid, ETH_ALEN) == 0)
+                return -EALREADY;
+
+        for (i = 0; i < MAX_AUTH_BSSES; i++) {
+                if (wdev->authtry_bsses[i] &&
+                    memcmp(bssid, wdev->authtry_bsses[i]->pub.bssid,
+                                                ETH_ALEN) == 0)
+                        return -EALREADY;
+                if (wdev->auth_bsses[i] &&
+                    memcmp(bssid, wdev->auth_bsses[i]->pub.bssid,
+                                                ETH_ALEN) == 0)
+                        return -EALREADY;
+        }
+
+        memset(&req, 0, sizeof(req));
+
+        req.ie = ie;
+        req.ie_len = ie_len;
+        req.auth_type = auth_type;
+        req.bss = cfg80211_get_bss(&rdev->wiphy, chan, bssid, ssid, ssid_len,
+                                   WLAN_CAPABILITY_ESS, WLAN_CAPABILITY_ESS);
+        req.key = key;
+        req.key_len = key_len;
+        req.key_idx = key_idx;
+        if (!req.bss)
+                return -ENOENT;
+
+        bss = bss_from_pub(req.bss);
+
+        for (i = 0; i < MAX_AUTH_BSSES; i++) {
+                if (!wdev->auth_bsses[i] && !wdev->authtry_bsses[i]) {
+                        slot = i;
+                        nfree++;
+                }
+        }
+
+        /* we need one free slot for disassoc and one for this auth */
+        if (nfree < 2) {
+                err = -ENOSPC;
+                goto out;
+        }
+
+        wdev->authtry_bsses[slot] = bss;
+        cfg80211_hold_bss(bss);
+
+        err = rdev->ops->auth(&rdev->wiphy, dev, &req);
+        if (err) {
+                wdev->authtry_bsses[slot] = NULL;
+                cfg80211_unhold_bss(bss);
+        }
+
+ out:
+        if (err)
+                cfg80211_put_bss(req.bss);
+        return err;
+}
+
+int cfg80211_mlme_auth(struct cfg80211_registered_device *rdev,
+                       struct net_device *dev, struct ieee80211_channel *chan,
+                       enum nl80211_auth_type auth_type, const u8 *bssid,
+                       const u8 *ssid, int ssid_len,
+                       const u8 *ie, int ie_len,
+                       const u8 *key, int key_len, int key_idx)
+{
+        int err;
+
+        wdev_lock(dev->ieee80211_ptr);
+        err = __cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
+                                   ssid, ssid_len, ie, ie_len,
+                                   key, key_len, key_idx);
+        wdev_unlock(dev->ieee80211_ptr);
+
+        return err;
+}
+
+int __cfg80211_mlme_assoc(struct cfg80211_registered_device *rdev,
+                          struct net_device *dev,
+                          struct ieee80211_channel *chan,
+                          const u8 *bssid, const u8 *prev_bssid,
+                          const u8 *ssid, int ssid_len,
+                          const u8 *ie, int ie_len, bool use_mfp,
+                          struct cfg80211_crypto_settings *crypt)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_assoc_request req;
+        struct cfg80211_internal_bss *bss;
+        int i, err, slot = -1;
+
+        ASSERT_WDEV_LOCK(wdev);
+
+        memset(&req, 0, sizeof(req));
+
+        if (wdev->current_bss)
+                return -EALREADY;
+
+        req.ie = ie;
+        req.ie_len = ie_len;
+        memcpy(&req.crypto, crypt, sizeof(req.crypto));
+        req.use_mfp = use_mfp;
+        req.prev_bssid = prev_bssid;
+        req.bss = cfg80211_get_bss(&rdev->wiphy, chan, bssid, ssid, ssid_len,
+                                   WLAN_CAPABILITY_ESS, WLAN_CAPABILITY_ESS);
+        if (!req.bss)
+                return -ENOENT;
+
+        bss = bss_from_pub(req.bss);
+
+        for (i = 0; i < MAX_AUTH_BSSES; i++) {
+                if (bss == wdev->auth_bsses[i]) {
+                        slot = i;
+                        break;
+                }
+        }
+
+        if (slot < 0) {
+                err = -ENOTCONN;
+                goto out;
+        }
+
+        err = rdev->ops->assoc(&rdev->wiphy, dev, &req);
+ out:
+        /* still a reference in wdev->auth_bsses[slot] */
+        cfg80211_put_bss(req.bss);
+        return err;
+}
+
+int cfg80211_mlme_assoc(struct cfg80211_registered_device *rdev,
+                        struct net_device *dev,
+                        struct ieee80211_channel *chan,
+                        const u8 *bssid, const u8 *prev_bssid,
+                        const u8 *ssid, int ssid_len,
+                        const u8 *ie, int ie_len, bool use_mfp,
+                        struct cfg80211_crypto_settings *crypt)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        int err;
+
+        wdev_lock(wdev);
+        err = __cfg80211_mlme_assoc(rdev, dev, chan, bssid, prev_bssid,
+                                    ssid, ssid_len, ie, ie_len, use_mfp, crypt);
+        wdev_unlock(wdev);
+
+        return err;
+}
+
+int __cfg80211_mlme_deauth(struct cfg80211_registered_device *rdev,
+                           struct net_device *dev, const u8 *bssid,
+                           const u8 *ie, int ie_len, u16 reason)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_deauth_request req;
+        int i;
+
+        ASSERT_WDEV_LOCK(wdev);
+
+        memset(&req, 0, sizeof(req));
+        req.reason_code = reason;
+        req.ie = ie;
+        req.ie_len = ie_len;
+        if (wdev->current_bss &&
+            memcmp(wdev->current_bss->pub.bssid, bssid, ETH_ALEN) == 0) {
+                req.bss = &wdev->current_bss->pub;
+        } else for (i = 0; i < MAX_AUTH_BSSES; i++) {
+                if (wdev->auth_bsses[i] &&
+                    memcmp(bssid, wdev->auth_bsses[i]->pub.bssid, ETH_ALEN) == 0) {
+                        req.bss = &wdev->auth_bsses[i]->pub;
+                        break;
+                }
+                if (wdev->authtry_bsses[i] &&
+                    memcmp(bssid, wdev->authtry_bsses[i]->pub.bssid, ETH_ALEN) == 0) {
+                        req.bss = &wdev->authtry_bsses[i]->pub;
+                        break;
+                }
+        }
+
+        if (!req.bss)
+                return -ENOTCONN;
+
+        return rdev->ops->deauth(&rdev->wiphy, dev, &req, wdev);
+}
+
+int cfg80211_mlme_deauth(struct cfg80211_registered_device *rdev,
+                         struct net_device *dev, const u8 *bssid,
+                         const u8 *ie, int ie_len, u16 reason)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        int err;
+
+        wdev_lock(wdev);
+        err = __cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason);
+        wdev_unlock(wdev);
+
+        return err;
+}
+
+static int __cfg80211_mlme_disassoc(struct cfg80211_registered_device *rdev,
+                                    struct net_device *dev, const u8 *bssid,
+                                    const u8 *ie, int ie_len, u16 reason)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_disassoc_request req;
+
+        ASSERT_WDEV_LOCK(wdev);
+
+        memset(&req, 0, sizeof(req));
+        req.reason_code = reason;
+        req.ie = ie;
+        req.ie_len = ie_len;
+        if (memcmp(wdev->current_bss->pub.bssid, bssid, ETH_ALEN) == 0)
+                req.bss = &wdev->current_bss->pub;
+        else
+                return -ENOTCONN;
+
+        return rdev->ops->disassoc(&rdev->wiphy, dev, &req, wdev);
+}
+
+int cfg80211_mlme_disassoc(struct cfg80211_registered_device *rdev,
+                           struct net_device *dev, const u8 *bssid,
+                           const u8 *ie, int ie_len, u16 reason)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        int err;
+
+        wdev_lock(wdev);
+        err = __cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason);
+        wdev_unlock(wdev);
+
+        return err;
+}
+
+void cfg80211_mlme_down(struct cfg80211_registered_device *rdev,
+                        struct net_device *dev)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_deauth_request req;
+        int i;
+
+        ASSERT_WDEV_LOCK(wdev);
+
+        if (!rdev->ops->deauth)
+                return;
+
+        memset(&req, 0, sizeof(req));
+        req.reason_code = WLAN_REASON_DEAUTH_LEAVING;
+        req.ie = NULL;
+        req.ie_len = 0;
+
+        if (wdev->current_bss) {
+                req.bss = &wdev->current_bss->pub;
+                rdev->ops->deauth(&rdev->wiphy, dev, &req, wdev);
+                if (wdev->current_bss) {
+                        cfg80211_unhold_bss(wdev->current_bss);
+                        cfg80211_put_bss(&wdev->current_bss->pub);
+                        wdev->current_bss = NULL;
+                }
+        }
+
+        for (i = 0; i < MAX_AUTH_BSSES; i++) {
+                if (wdev->auth_bsses[i]) {
+                        req.bss = &wdev->auth_bsses[i]->pub;
+                        rdev->ops->deauth(&rdev->wiphy, dev, &req, wdev);
+                        if (wdev->auth_bsses[i]) {
+                                cfg80211_unhold_bss(wdev->auth_bsses[i]);
+                                cfg80211_put_bss(&wdev->auth_bsses[i]->pub);
+                                wdev->auth_bsses[i] = NULL;
+                        }
+                }
+                if (wdev->authtry_bsses[i]) {
+                        req.bss = &wdev->authtry_bsses[i]->pub;
+                        rdev->ops->deauth(&rdev->wiphy, dev, &req, wdev);
+                        if (wdev->authtry_bsses[i]) {
+                                cfg80211_unhold_bss(wdev->authtry_bsses[i]);
+                                cfg80211_put_bss(&wdev->authtry_bsses[i]->pub);
+                                wdev->authtry_bsses[i] = NULL;
+                        }
+                }
+        }
+}
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 634496b3ed77..da450ef1fc7e 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -29,9 +29,9 @@ static struct genl_family nl80211_fam = {
         .maxattr = NL80211_ATTR_MAX,
 };
 
-/* internal helper: get drv and dev */
-static int get_drv_dev_by_info_ifindex(struct nlattr **attrs,
-                                       struct cfg80211_registered_device **drv,
+/* internal helper: get rdev and dev */
+static int get_rdev_dev_by_info_ifindex(struct nlattr **attrs,
+                                       struct cfg80211_registered_device **rdev,
                                        struct net_device **dev)
 {
         int ifindex;
@@ -44,10 +44,10 @@ static int get_drv_dev_by_info_ifindex(struct nlattr **attrs,
         if (!*dev)
                 return -ENODEV;
 
-        *drv = cfg80211_get_dev_from_ifindex(ifindex);
-        if (IS_ERR(*drv)) {
+        *rdev = cfg80211_get_dev_from_ifindex(ifindex);
+        if (IS_ERR(*rdev)) {
                 dev_put(*dev);
-                return PTR_ERR(*drv);
+                return PTR_ERR(*rdev);
         }
 
         return 0;
@@ -71,7 +71,9 @@ static struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] __read_mostly = {
         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
 
         [NL80211_ATTR_MAC] = { .type = NLA_BINARY, .len = ETH_ALEN },
+        [NL80211_ATTR_PREV_BSSID] = { .type = NLA_BINARY, .len = ETH_ALEN },
 
+        [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
                                     .len = WLAN_MAX_KEY_LEN },
         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
@@ -128,6 +130,20 @@ static struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] __read_mostly = {
                 .len = sizeof(struct nl80211_sta_flag_update),
         },
         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
+        [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
+        [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
+        [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
+};
+
+/* policy for the attributes */
+static struct nla_policy
+nl80211_key_policy[NL80211_KEY_MAX + 1] __read_mostly = {
+        [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
+        [NL80211_KEY_IDX] = { .type = NLA_U8 },
+        [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
+        [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 8 },
+        [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
+        [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 };
 
 /* IE validation */
@@ -194,6 +210,177 @@ static int nl80211_msg_put_channel(struct sk_buff *msg,
 
 /* netlink command implementations */
 
+struct key_parse {
+        struct key_params p;
+        int idx;
+        bool def, defmgmt;
+};
+
+static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
+{
+        struct nlattr *tb[NL80211_KEY_MAX + 1];
+        int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
+                                   nl80211_key_policy);
+        if (err)
+                return err;
+
+        k->def = !!tb[NL80211_KEY_DEFAULT];
+        k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
+
+        if (tb[NL80211_KEY_IDX])
+                k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
+
+        if (tb[NL80211_KEY_DATA]) {
+                k->p.key = nla_data(tb[NL80211_KEY_DATA]);
+                k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
+        }
+
+        if (tb[NL80211_KEY_SEQ]) {
+                k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
+                k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
+        }
+
+        if (tb[NL80211_KEY_CIPHER])
+                k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
+
+        return 0;
+}
+
+static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
+{
+        if (info->attrs[NL80211_ATTR_KEY_DATA]) {
+                k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
+                k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
+        }
+
+        if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
+                k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
+                k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
+        }
+
+        if (info->attrs[NL80211_ATTR_KEY_IDX])
+                k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
+
+        if (info->attrs[NL80211_ATTR_KEY_CIPHER])
+                k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
+
+        k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
+        k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
+
+        return 0;
+}
+
+static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
+{
+        int err;
+
+        memset(k, 0, sizeof(*k));
+        k->idx = -1;
+
+        if (info->attrs[NL80211_ATTR_KEY])
+                err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
+        else
+                err = nl80211_parse_key_old(info, k);
+
+        if (err)
+                return err;
+
+        if (k->def && k->defmgmt)
+                return -EINVAL;
+
+        if (k->idx != -1) {
+                if (k->defmgmt) {
+                        if (k->idx < 4 || k->idx > 5)
+                                return -EINVAL;
+                } else if (k->def) {
+                        if (k->idx < 0 || k->idx > 3)
+                                return -EINVAL;
+                } else {
+                        if (k->idx < 0 || k->idx > 5)
+                                return -EINVAL;
+                }
+        }
+
+        return 0;
+}
+
+static struct cfg80211_cached_keys *
+nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
+                       struct nlattr *keys)
+{
+        struct key_parse parse;
+        struct nlattr *key;
+        struct cfg80211_cached_keys *result;
+        int rem, err, def = 0;
+
+        result = kzalloc(sizeof(*result), GFP_KERNEL);
+        if (!result)
+                return ERR_PTR(-ENOMEM);
+
+        result->def = -1;
+        result->defmgmt = -1;
+
+        nla_for_each_nested(key, keys, rem) {
+                memset(&parse, 0, sizeof(parse));
+                parse.idx = -1;
+
+                err = nl80211_parse_key_new(key, &parse);
+                if (err)
+                        goto error;
+                err = -EINVAL;
+                if (!parse.p.key)
+                        goto error;
+                if (parse.idx < 0 || parse.idx > 4)
+                        goto error;
+                if (parse.def) {
+                        if (def)
+                                goto error;
+                        def = 1;
+                        result->def = parse.idx;
+                } else if (parse.defmgmt)
+                        goto error;
+                err = cfg80211_validate_key_settings(rdev, &parse.p,
+                                                     parse.idx, NULL);
+                if (err)
+                        goto error;
+                result->params[parse.idx].cipher = parse.p.cipher;
+                result->params[parse.idx].key_len = parse.p.key_len;
+                result->params[parse.idx].key = result->data[parse.idx];
+                memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
+        }
+
+        return result;
+ error:
+        kfree(result);
+        return ERR_PTR(err);
+}
+
+static int nl80211_key_allowed(struct wireless_dev *wdev)
+{
+        ASSERT_WDEV_LOCK(wdev);
+
+        if (!netif_running(wdev->netdev))
+                return -ENETDOWN;
+
+        switch (wdev->iftype) {
+        case NL80211_IFTYPE_AP:
+        case NL80211_IFTYPE_AP_VLAN:
+                break;
+        case NL80211_IFTYPE_ADHOC:
+                if (!wdev->current_bss)
+                        return -ENOLINK;
+                break;
+        case NL80211_IFTYPE_STATION:
+                if (wdev->sme_state != CFG80211_SME_CONNECTED)
+                        return -ENOLINK;
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
 static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
                               struct cfg80211_registered_device *dev)
 {
@@ -347,6 +534,17 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
         CMD(join_ibss, JOIN_IBSS);
 
 #undef CMD
+
+        if (dev->ops->connect || dev->ops->auth) {
+                i++;
+                NLA_PUT_U32(msg, i, NL80211_CMD_CONNECT);
+        }
+
+        if (dev->ops->disconnect || dev->ops->deauth) {
+                i++;
+                NLA_PUT_U32(msg, i, NL80211_CMD_DISCONNECT);
+        }
+
         nla_nest_end(msg, nl_cmds);
 
         return genlmsg_end(msg, hdr);
@@ -363,7 +561,7 @@ static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
         struct cfg80211_registered_device *dev;
 
         mutex_lock(&cfg80211_mutex);
-        list_for_each_entry(dev, &cfg80211_drv_list, list) {
+        list_for_each_entry(dev, &cfg80211_rdev_list, list) {
                 if (++idx <= start)
                         continue;
                 if (nl80211_send_wiphy(skb, NETLINK_CB(cb->skb).pid,
@@ -396,14 +594,14 @@ static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
         if (nl80211_send_wiphy(msg, info->snd_pid, info->snd_seq, 0, dev) < 0)
                 goto out_free;
 
-        cfg80211_put_dev(dev);
+        cfg80211_unlock_rdev(dev);
 
-        return genlmsg_unicast(msg, info->snd_pid);
+        return genlmsg_reply(msg, info);
 
  out_free:
         nlmsg_free(msg);
  out_err:
-        cfg80211_put_dev(dev);
+        cfg80211_unlock_rdev(dev);
         return -ENOBUFS;
 }
 
@@ -445,7 +643,7 @@ static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
 
         mutex_lock(&cfg80211_mutex);
 
-        rdev = __cfg80211_drv_from_info(info);
+        rdev = __cfg80211_rdev_from_info(info);
         if (IS_ERR(rdev)) {
                 mutex_unlock(&cfg80211_mutex);
                 result = PTR_ERR(rdev);
@@ -668,7 +866,7 @@ static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *
         struct wireless_dev *wdev;
 
         mutex_lock(&cfg80211_mutex);
-        list_for_each_entry(dev, &cfg80211_drv_list, list) {
+        list_for_each_entry(dev, &cfg80211_rdev_list, list) {
                 if (wp_idx < wp_start) {
                         wp_idx++;
                         continue;
@@ -709,7 +907,7 @@ static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
         struct net_device *netdev;
         int err;
 
-        err = get_drv_dev_by_info_ifindex(info->attrs, &dev, &netdev);
+        err = get_rdev_dev_by_info_ifindex(info->attrs, &dev, &netdev);
         if (err)
                 return err;
 
@@ -722,15 +920,15 @@ static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
                 goto out_free;
 
         dev_put(netdev);
-        cfg80211_put_dev(dev);
+        cfg80211_unlock_rdev(dev);
 
-        return genlmsg_unicast(msg, info->snd_pid);
+        return genlmsg_reply(msg, info);
 
  out_free:
         nlmsg_free(msg);
  out_err:
         dev_put(netdev);
-        cfg80211_put_dev(dev);
+        cfg80211_unlock_rdev(dev);
         return -ENOBUFS;
 }
 
@@ -765,9 +963,9 @@ static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
 
 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
 {
-        struct cfg80211_registered_device *drv;
+        struct cfg80211_registered_device *rdev;
         struct vif_params params;
-        int err, ifindex;
+        int err;
         enum nl80211_iftype otype, ntype;
         struct net_device *dev;
         u32 _flags, *flags = NULL;
@@ -777,13 +975,11 @@ static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
 
         rtnl_lock();
 
-        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
+        err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
         if (err)
                 goto unlock_rtnl;
 
-        ifindex = dev->ifindex;
         otype = ntype = dev->ieee80211_ptr->iftype;
-        dev_put(dev);
 
         if (info->attrs[NL80211_ATTR_IFTYPE]) {
                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
@@ -795,8 +991,8 @@ static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
                 }
         }
 
-        if (!drv->ops->change_virtual_intf ||
-            !(drv->wiphy.interface_modes & (1 << ntype))) {
+        if (!rdev->ops->change_virtual_intf ||
+            !(rdev->wiphy.interface_modes & (1 << ntype))) {
                 err = -EOPNOTSUPP;
                 goto unlock;
         }
@@ -826,21 +1022,21 @@ static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
         }
 
         if (change)
-                err = drv->ops->change_virtual_intf(&drv->wiphy, ifindex,
+                err = rdev->ops->change_virtual_intf(&rdev->wiphy, dev,
                                                     ntype, flags, &params);
         else
                 err = 0;
 
-        dev = __dev_get_by_index(&init_net, ifindex);
-        WARN_ON(!dev || (!err && dev->ieee80211_ptr->iftype != ntype));
+        WARN_ON(!err && dev->ieee80211_ptr->iftype != ntype);
 
-        if (dev && !err && (ntype != otype)) {
+        if (!err && (ntype != otype)) {
                 if (otype == NL80211_IFTYPE_ADHOC)
                         cfg80211_clear_ibss(dev, false);
         }
 
  unlock:
-        cfg80211_put_dev(drv);
+        dev_put(dev);
+        cfg80211_unlock_rdev(rdev);
  unlock_rtnl:
         rtnl_unlock();
         return err;
@@ -848,7 +1044,7 @@ static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
 
 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
 {
-        struct cfg80211_registered_device *drv;
+        struct cfg80211_registered_device *rdev;
         struct vif_params params;
         int err;
         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
@@ -867,14 +1063,14 @@ static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
 
         rtnl_lock();
 
-        drv = cfg80211_get_dev_from_info(info);
-        if (IS_ERR(drv)) {
-                err = PTR_ERR(drv);
+        rdev = cfg80211_get_dev_from_info(info);
+        if (IS_ERR(rdev)) {
+                err = PTR_ERR(rdev);
                 goto unlock_rtnl;
         }
 
-        if (!drv->ops->add_virtual_intf ||
-            !(drv->wiphy.interface_modes & (1 << type))) {
+        if (!rdev->ops->add_virtual_intf ||
+            !(rdev->wiphy.interface_modes & (1 << type))) {
                 err = -EOPNOTSUPP;
                 goto unlock;
         }
@@ -888,12 +1084,12 @@ static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
                                   &flags);
-        err = drv->ops->add_virtual_intf(&drv->wiphy,
+        err = rdev->ops->add_virtual_intf(&rdev->wiphy,
                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
                 type, err ? NULL : &flags, &params);
 
  unlock:
-        cfg80211_put_dev(drv);
+        cfg80211_unlock_rdev(rdev);
  unlock_rtnl:
         rtnl_unlock();
         return err;
@@ -901,27 +1097,27 @@ static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
 
 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
 {
-        struct cfg80211_registered_device *drv;
+        struct cfg80211_registered_device *rdev;
         int ifindex, err;
         struct net_device *dev;
 
         rtnl_lock();
 
-        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
+        err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
         if (err)
                 goto unlock_rtnl;
         ifindex = dev->ifindex;
         dev_put(dev);
 
-        if (!drv->ops->del_virtual_intf) {
+        if (!rdev->ops->del_virtual_intf) {
                 err = -EOPNOTSUPP;
                 goto out;
         }
 
-        err = drv->ops->del_virtual_intf(&drv->wiphy, ifindex);
+        err = rdev->ops->del_virtual_intf(&rdev->wiphy, ifindex);
 
  out:
-        cfg80211_put_dev(drv);
+        cfg80211_unlock_rdev(rdev);
  unlock_rtnl:
         rtnl_unlock();
         return err;
@@ -930,10 +1126,12 @@ static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
 struct get_key_cookie {
         struct sk_buff *msg;
         int error;
+        int idx;
 };
 
 static void get_key_callback(void *c, struct key_params *params)
 {
+        struct nlattr *key;
         struct get_key_cookie *cookie = c;
 
         if (params->key)
@@ -948,6 +1146,26 @@ static void get_key_callback(void *c, struct key_params *params)
                 NLA_PUT_U32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
                             params->cipher);
 
+        key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
+        if (!key)
+                goto nla_put_failure;
+
+        if (params->key)
+                NLA_PUT(cookie->msg, NL80211_KEY_DATA,
+                        params->key_len, params->key);
+
+        if (params->seq)
+                NLA_PUT(cookie->msg, NL80211_KEY_SEQ,
+                        params->seq_len, params->seq);
+
+        if (params->cipher)
+                NLA_PUT_U32(cookie->msg, NL80211_KEY_CIPHER,
+                            params->cipher);
+
+        NLA_PUT_U8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx);
+
+        nla_nest_end(cookie->msg, key);
+
         return;
  nla_put_failure:
         cookie->error = 1;
@@ -955,7 +1173,7 @@ static void get_key_callback(void *c, struct key_params *params)
 
 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
 {
-        struct cfg80211_registered_device *drv;
+        struct cfg80211_registered_device *rdev;
         int err;
         struct net_device *dev;
         u8 key_idx = 0;
@@ -977,11 +1195,11 @@ static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
 
         rtnl_lock();
 
-        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
+        err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
         if (err)
                 goto unlock_rtnl;
 
-        if (!drv->ops->get_key) {
+        if (!rdev->ops->get_key) {
                 err = -EOPNOTSUPP;
                 goto out;
         }
@@ -1001,13 +1219,14 @@ static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
         }
 
         cookie.msg = msg;
+        cookie.idx = key_idx;
 
         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
         if (mac_addr)
                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
 
-        err = drv->ops->get_key(&drv->wiphy, dev, key_idx, mac_addr,
+        err = rdev->ops->get_key(&rdev->wiphy, dev, key_idx, mac_addr,
                                 &cookie, get_key_callback);
 
         if (err)
@@ -1017,7 +1236,7 @@ static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
                 goto nla_put_failure;
 
         genlmsg_end(msg, hdr);
-        err = genlmsg_unicast(msg, info->snd_pid);
+        err = genlmsg_reply(msg, info);
         goto out;
 
  nla_put_failure:
@@ -1025,7 +1244,7 @@ static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
  free_msg:
         nlmsg_free(msg);
  out:
-        cfg80211_put_dev(drv);
+        cfg80211_unlock_rdev(rdev);
         dev_put(dev);
  unlock_rtnl:
         rtnl_unlock();
@@ -1035,57 +1254,57 @@ static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
 
 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
 {
-        struct cfg80211_registered_device *drv;
+        struct cfg80211_registered_device *rdev;
+        struct key_parse key;
         int err;
         struct net_device *dev;
-        u8 key_idx;
         int (*func)(struct wiphy *wiphy, struct net_device *netdev,
                     u8 key_index);
 
-        if (!info->attrs[NL80211_ATTR_KEY_IDX])
-                return -EINVAL;
-
-        key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
+        err = nl80211_parse_key(info, &key);
+        if (err)
+                return err;
 
-        if (info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT]) {
-                if (key_idx < 4 || key_idx > 5)
-                        return -EINVAL;
-        } else if (key_idx > 3)
+        if (key.idx < 0)
                 return -EINVAL;
 
-        /* currently only support setting default key */
-        if (!info->attrs[NL80211_ATTR_KEY_DEFAULT] &&
-            !info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT])
+        /* only support setting default key */
+        if (!key.def && !key.defmgmt)
                 return -EINVAL;
 
         rtnl_lock();
 
-        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
+        err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
         if (err)
                 goto unlock_rtnl;
 
-        if (info->attrs[NL80211_ATTR_KEY_DEFAULT])
-                func = drv->ops->set_default_key;
+        if (key.def)
+                func = rdev->ops->set_default_key;
         else
-                func = drv->ops->set_default_mgmt_key;
+                func = rdev->ops->set_default_mgmt_key;
 
         if (!func) {
                 err = -EOPNOTSUPP;
                 goto out;
         }
 
-        err = func(&drv->wiphy, dev, key_idx);
+        wdev_lock(dev->ieee80211_ptr);
+        err = nl80211_key_allowed(dev->ieee80211_ptr);
+        if (!err)
+                err = func(&rdev->wiphy, dev, key.idx);
+
 #ifdef CONFIG_WIRELESS_EXT
         if (!err) {
-                if (func == drv->ops->set_default_key)
-                        dev->ieee80211_ptr->wext.default_key = key_idx;
+                if (func == rdev->ops->set_default_key)
+                        dev->ieee80211_ptr->wext.default_key = key.idx;
                 else
-                        dev->ieee80211_ptr->wext.default_mgmt_key = key_idx;
+                        dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
         }
 #endif
+        wdev_unlock(dev->ieee80211_ptr);
 
  out:
-        cfg80211_put_dev(drv);
+        cfg80211_unlock_rdev(rdev);
         dev_put(dev);
 
  unlock_rtnl:
@@ -1096,62 +1315,47 @@ static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
 
 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
 {
-        struct cfg80211_registered_device *drv;
-        int err, i;
+        struct cfg80211_registered_device *rdev;
+        int err;
         struct net_device *dev;
-        struct key_params params;
-        u8 key_idx = 0;
+        struct key_parse key;
         u8 *mac_addr = NULL;
 
-        memset(&params, 0, sizeof(params));
+        err = nl80211_parse_key(info, &key);
+        if (err)
+                return err;
 
-        if (!info->attrs[NL80211_ATTR_KEY_CIPHER])
+        if (!key.p.key)
                 return -EINVAL;
 
-        if (info->attrs[NL80211_ATTR_KEY_DATA]) {
-                params.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
-                params.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
-        }
-
-        if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
-                params.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
-                params.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
-        }
-
-        if (info->attrs[NL80211_ATTR_KEY_IDX])
-                key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
-
-        params.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
-
         if (info->attrs[NL80211_ATTR_MAC])
                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
 
-        if (cfg80211_validate_key_settings(&params, key_idx, mac_addr))
-                return -EINVAL;
-
         rtnl_lock();
 
-        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
+        err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
         if (err)
                 goto unlock_rtnl;
 
-        for (i = 0; i < drv->wiphy.n_cipher_suites; i++)
-                if (params.cipher == drv->wiphy.cipher_suites[i])
-                        break;
-        if (i == drv->wiphy.n_cipher_suites) {
-                err = -EINVAL;
+        if (!rdev->ops->add_key) {
+                err = -EOPNOTSUPP;
                 goto out;
         }
 
-        if (!drv->ops->add_key) {
-                err = -EOPNOTSUPP;
+        if (cfg80211_validate_key_settings(rdev, &key.p, key.idx, mac_addr)) {
+                err = -EINVAL;
                 goto out;
         }
 
-        err = drv->ops->add_key(&drv->wiphy, dev, key_idx, mac_addr, &params);
+        wdev_lock(dev->ieee80211_ptr);
+        err = nl80211_key_allowed(dev->ieee80211_ptr);
+        if (!err)
+                err = rdev->ops->add_key(&rdev->wiphy, dev, key.idx,
+                                         mac_addr, &key.p);
+        wdev_unlock(dev->ieee80211_ptr);
 
  out:
-        cfg80211_put_dev(drv);
+        cfg80211_unlock_rdev(rdev);
         dev_put(dev);
  unlock_rtnl:
         rtnl_unlock();
@@ -1161,45 +1365,47 @@ static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
 
 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
 {
-        struct cfg80211_registered_device *drv;
+        struct cfg80211_registered_device *rdev;
         int err;
         struct net_device *dev;
-        u8 key_idx = 0;
         u8 *mac_addr = NULL;
+        struct key_parse key;
 
-        if (info->attrs[NL80211_ATTR_KEY_IDX])
-                key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
-
-        if (key_idx > 5)
-                return -EINVAL;
+        err = nl80211_parse_key(info, &key);
+        if (err)
+                return err;
 
         if (info->attrs[NL80211_ATTR_MAC])
                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
 
         rtnl_lock();
 
-        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
+        err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
         if (err)
                 goto unlock_rtnl;
 
-        if (!drv->ops->del_key) {
+        if (!rdev->ops->del_key) {
                 err = -EOPNOTSUPP;
                 goto out;
         }
 
-        err = drv->ops->del_key(&drv->wiphy, dev, key_idx, mac_addr);
+        wdev_lock(dev->ieee80211_ptr);
+        err = nl80211_key_allowed(dev->ieee80211_ptr);
+        if (!err)
+                err = rdev->ops->del_key(&rdev->wiphy, dev, key.idx, mac_addr);
 
 #ifdef CONFIG_WIRELESS_EXT
         if (!err) {
-                if (key_idx == dev->ieee80211_ptr->wext.default_key)
+                if (key.idx == dev->ieee80211_ptr->wext.default_key)
                         dev->ieee80211_ptr->wext.default_key = -1;
-                else if (key_idx == dev->ieee80211_ptr->wext.default_mgmt_key)
+                else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
         }
 #endif
+        wdev_unlock(dev->ieee80211_ptr);
 
  out:
-        cfg80211_put_dev(drv);
+        cfg80211_unlock_rdev(rdev);
         dev_put(dev);
 
  unlock_rtnl:
@@ -1212,7 +1418,7 @@ static int nl80211_addset_beacon(struct sk_buff *skb, struct genl_info *info)
 {
         int (*call)(struct wiphy *wiphy, struct net_device *dev,
                     struct beacon_parameters *info);
-        struct cfg80211_registered_device *drv;
+        struct cfg80211_registered_device *rdev;
         int err;
         struct net_device *dev;
         struct beacon_parameters params;
@@ -1223,7 +1429,7 @@ static int nl80211_addset_beacon(struct sk_buff *skb, struct genl_info *info)
 
         rtnl_lock();
 
-        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
+        err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
         if (err)
                 goto unlock_rtnl;
 
@@ -1242,10 +1448,10 @@ static int nl80211_addset_beacon(struct sk_buff *skb, struct genl_info *info)
                         goto out;
                 }
 
-                call = drv->ops->add_beacon;
+                call = rdev->ops->add_beacon;
                 break;
         case NL80211_CMD_SET_BEACON:
-                call = drv->ops->set_beacon;
+                call = rdev->ops->set_beacon;
                 break;
         default:
                 WARN_ON(1);
@@ -1291,10 +1497,10 @@ static int nl80211_addset_beacon(struct sk_buff *skb, struct genl_info *info)
                 goto out;
         }
 
-        err = call(&drv->wiphy, dev, &params);
+        err = call(&rdev->wiphy, dev, &params);
 
  out:
-        cfg80211_put_dev(drv);
+        cfg80211_unlock_rdev(rdev);
         dev_put(dev);
  unlock_rtnl:
         rtnl_unlock();
@@ -1304,17 +1510,17 @@ static int nl80211_addset_beacon(struct sk_buff *skb, struct genl_info *info)
 
 static int nl80211_del_beacon(struct sk_buff *skb, struct genl_info *info)
 {
-        struct cfg80211_registered_device *drv;
+        struct cfg80211_registered_device *rdev;
         int err;
         struct net_device *dev;
 
         rtnl_lock();
 
-        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
+        err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
         if (err)
                 goto unlock_rtnl;
 
-        if (!drv->ops->del_beacon) {
+        if (!rdev->ops->del_beacon) {
                 err = -EOPNOTSUPP;
                 goto out;
         }
@@ -1323,10 +1529,10 @@ static int nl80211_del_beacon(struct sk_buff *skb, struct genl_info *info)
                 err = -EOPNOTSUPP;
                 goto out;
         }
-        err = drv->ops->del_beacon(&drv->wiphy, dev);
+        err = rdev->ops->del_beacon(&rdev->wiphy, dev);
 
  out:
-        cfg80211_put_dev(drv);
+        cfg80211_unlock_rdev(rdev);
         dev_put(dev);
  unlock_rtnl:
         rtnl_unlock();
@@ -1560,7 +1766,7 @@ static int nl80211_dump_station(struct sk_buff *skb,
         cb->args[1] = sta_idx;
         err = skb->len;
  out_err:
-        cfg80211_put_dev(dev);
+        cfg80211_unlock_rdev(dev);
  out_rtnl:
         rtnl_unlock();
 
@@ -1569,7 +1775,7 @@ static int nl80211_dump_station(struct sk_buff *skb,
 
 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
 {
-        struct cfg80211_registered_device *drv;
+        struct cfg80211_registered_device *rdev;
         int err;
         struct net_device *dev;
         struct station_info sinfo;
@@ -1585,16 +1791,16 @@ static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
 
         rtnl_lock();
 
-        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
+        err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
         if (err)
                 goto out_rtnl;
 
-        if (!drv->ops->get_station) {
+        if (!rdev->ops->get_station) {
                 err = -EOPNOTSUPP;
                 goto out;
         }
 
-        err = drv->ops->get_station(&drv->wiphy, dev, mac_addr, &sinfo);
+        err = rdev->ops->get_station(&rdev->wiphy, dev, mac_addr, &sinfo);
         if (err)
                 goto out;
 
@@ -1606,13 +1812,13 @@ static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
                                  dev, mac_addr, &sinfo) < 0)
                 goto out_free;
 
-        err = genlmsg_unicast(msg, info->snd_pid);
+        err = genlmsg_reply(msg, info);
         goto out;
 
  out_free:
         nlmsg_free(msg);
  out:
-        cfg80211_put_dev(drv);
+        cfg80211_unlock_rdev(rdev);
         dev_put(dev);
  out_rtnl:
         rtnl_unlock();
@@ -1643,7 +1849,7 @@ static int get_vlan(struct nlattr *vlanattr,
 
 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
 {
-        struct cfg80211_registered_device *drv;
+        struct cfg80211_registered_device *rdev;
         int err;
         struct net_device *dev;
         struct station_parameters params;
@@ -1685,11 +1891,11 @@ static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
 
         rtnl_lock();
 
-        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
+        err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
         if (err)
                 goto out_rtnl;
 
-        err = get_vlan(info->attrs[NL80211_ATTR_STA_VLAN], drv, &params.vlan);
+        err = get_vlan(info->attrs[NL80211_ATTR_STA_VLAN], rdev, &params.vlan);
         if (err)
                 goto out;
 
@@ -1738,17 +1944,17 @@ static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
         if (err)
                 goto out;
 
-        if (!drv->ops->change_station) {
+        if (!rdev->ops->change_station) {
                 err = -EOPNOTSUPP;
                 goto out;
         }
 
-        err = drv->ops->change_station(&drv->wiphy, dev, mac_addr, &params);
+        err = rdev->ops->change_station(&rdev->wiphy, dev, mac_addr, &params);
 
  out:
         if (params.vlan)
                 dev_put(params.vlan);
-        cfg80211_put_dev(drv);
+        cfg80211_unlock_rdev(rdev);
         dev_put(dev);
  out_rtnl:
         rtnl_unlock();
@@ -1758,7 +1964,7 @@ static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
 
 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
 {
-        struct cfg80211_registered_device *drv;
+        struct cfg80211_registered_device *rdev;
         int err;
         struct net_device *dev;
         struct station_parameters params;
@@ -1798,11 +2004,11 @@ static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
 
         rtnl_lock();
 
-        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
+        err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
         if (err)
                 goto out_rtnl;
 
-        err = get_vlan(info->attrs[NL80211_ATTR_STA_VLAN], drv, &params.vlan);
+        err = get_vlan(info->attrs[NL80211_ATTR_STA_VLAN], rdev, &params.vlan);
         if (err)
                 goto out;
 
@@ -1838,7 +2044,7 @@ static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
         if (err)
                 goto out;
 
-        if (!drv->ops->add_station) {
+        if (!rdev->ops->add_station) {
                 err = -EOPNOTSUPP;
                 goto out;
         }
@@ -1848,12 +2054,12 @@ static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
                 goto out;
         }
 
-        err = drv->ops->add_station(&drv->wiphy, dev, mac_addr, &params);
+        err = rdev->ops->add_station(&rdev->wiphy, dev, mac_addr, &params);
 
  out:
         if (params.vlan)
                 dev_put(params.vlan);
-        cfg80211_put_dev(drv);
+        cfg80211_unlock_rdev(rdev);
         dev_put(dev);
  out_rtnl:
         rtnl_unlock();
@@ -1863,7 +2069,7 @@ static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
 
 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
 {
-        struct cfg80211_registered_device *drv;
+        struct cfg80211_registered_device *rdev;
         int err;
         struct net_device *dev;
         u8 *mac_addr = NULL;
@@ -1873,7 +2079,7 @@ static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
 
         rtnl_lock();
 
-        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
+        err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
         if (err)
                 goto out_rtnl;
 
@@ -1884,15 +2090,15 @@ static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
                 goto out;
         }
 
-        if (!drv->ops->del_station) {
+        if (!rdev->ops->del_station) {
                 err = -EOPNOTSUPP;
                 goto out;
         }
 
-        err = drv->ops->del_station(&drv->wiphy, dev, mac_addr);
+        err = rdev->ops->del_station(&rdev->wiphy, dev, mac_addr);
 
  out:
-        cfg80211_put_dev(drv);
+        cfg80211_unlock_rdev(rdev);
         dev_put(dev);
  out_rtnl:
         rtnl_unlock();
@@ -2023,7 +2229,7 @@ static int nl80211_dump_mpath(struct sk_buff *skb,
         cb->args[1] = path_idx;
         err = skb->len;
  out_err:
-        cfg80211_put_dev(dev);
+        cfg80211_unlock_rdev(dev);
  out_rtnl:
         rtnl_unlock();
 
@@ -2032,7 +2238,7 @@ static int nl80211_dump_mpath(struct sk_buff *skb,
 
 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
 {
-        struct cfg80211_registered_device *drv;
+        struct cfg80211_registered_device *rdev;
         int err;
         struct net_device *dev;
         struct mpath_info pinfo;
@@ -2049,11 +2255,11 @@ static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
 
         rtnl_lock();
 
-        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
+        err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
         if (err)
                 goto out_rtnl;
 
-        if (!drv->ops->get_mpath) {
+        if (!rdev->ops->get_mpath) {
                 err = -EOPNOTSUPP;
                 goto out;
         }
@@ -2063,7 +2269,7 @@ static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
                 goto out;
         }
 
-        err = drv->ops->get_mpath(&drv->wiphy, dev, dst, next_hop, &pinfo);
+        err = rdev->ops->get_mpath(&rdev->wiphy, dev, dst, next_hop, &pinfo);
         if (err)
                 goto out;
 
@@ -2075,13 +2281,13 @@ static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
                                  dev, dst, next_hop, &pinfo) < 0)
                 goto out_free;
 
-        err = genlmsg_unicast(msg, info->snd_pid);
+        err = genlmsg_reply(msg, info);
         goto out;
 
  out_free:
         nlmsg_free(msg);
  out:
-        cfg80211_put_dev(drv);
+        cfg80211_unlock_rdev(rdev);
         dev_put(dev);
  out_rtnl:
         rtnl_unlock();
@@ -2091,7 +2297,7 @@ static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
 
 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
 {
-        struct cfg80211_registered_device *drv;
+        struct cfg80211_registered_device *rdev;
         int err;
         struct net_device *dev;
         u8 *dst = NULL;
@@ -2108,11 +2314,11 @@ static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
 
         rtnl_lock();
 
-        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
+        err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
         if (err)
                 goto out_rtnl;
 
-        if (!drv->ops->change_mpath) {
+        if (!rdev->ops->change_mpath) {
                 err = -EOPNOTSUPP;
                 goto out;
         }
@@ -2127,10 +2333,10 @@ static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
                 goto out;
         }
 
-        err = drv->ops->change_mpath(&drv->wiphy, dev, dst, next_hop);
+        err = rdev->ops->change_mpath(&rdev->wiphy, dev, dst, next_hop);
 
  out:
-        cfg80211_put_dev(drv);
+        cfg80211_unlock_rdev(rdev);
         dev_put(dev);
  out_rtnl:
         rtnl_unlock();
@@ -2139,7 +2345,7 @@ static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
 }
 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
 {
-        struct cfg80211_registered_device *drv;
+        struct cfg80211_registered_device *rdev;
         int err;
         struct net_device *dev;
         u8 *dst = NULL;
@@ -2156,11 +2362,11 @@ static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
 
         rtnl_lock();
 
-        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
+        err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
         if (err)
                 goto out_rtnl;
 
-        if (!drv->ops->add_mpath) {
+        if (!rdev->ops->add_mpath) {
                 err = -EOPNOTSUPP;
                 goto out;
         }
@@ -2175,10 +2381,10 @@ static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
                 goto out;
         }
 
-        err = drv->ops->add_mpath(&drv->wiphy, dev, dst, next_hop);
+        err = rdev->ops->add_mpath(&rdev->wiphy, dev, dst, next_hop);
 
  out:
-        cfg80211_put_dev(drv);
+        cfg80211_unlock_rdev(rdev);
         dev_put(dev);
  out_rtnl:
         rtnl_unlock();
@@ -2188,7 +2394,7 @@ static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
 
 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
 {
-        struct cfg80211_registered_device *drv;
+        struct cfg80211_registered_device *rdev;
         int err;
         struct net_device *dev;
         u8 *dst = NULL;
@@ -2198,19 +2404,19 @@ static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
 
         rtnl_lock();
 
-        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
+        err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
         if (err)
                 goto out_rtnl;
 
-        if (!drv->ops->del_mpath) {
+        if (!rdev->ops->del_mpath) {
                 err = -EOPNOTSUPP;
                 goto out;
         }
 
-        err = drv->ops->del_mpath(&drv->wiphy, dev, dst);
+        err = rdev->ops->del_mpath(&rdev->wiphy, dev, dst);
 
  out:
-        cfg80211_put_dev(drv);
+        cfg80211_unlock_rdev(rdev);
         dev_put(dev);
  out_rtnl:
         rtnl_unlock();
@@ -2220,7 +2426,7 @@ static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
 
 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
 {
-        struct cfg80211_registered_device *drv;
+        struct cfg80211_registered_device *rdev;
         int err;
         struct net_device *dev;
         struct bss_parameters params;
@@ -2249,11 +2455,11 @@ static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
 
         rtnl_lock();
 
-        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
+        err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
         if (err)
                 goto out_rtnl;
 
-        if (!drv->ops->change_bss) {
+        if (!rdev->ops->change_bss) {
                 err = -EOPNOTSUPP;
                 goto out;
         }
@@ -2263,10 +2469,10 @@ static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
                 goto out;
         }
 
-        err = drv->ops->change_bss(&drv->wiphy, dev, &params);
+        err = rdev->ops->change_bss(&rdev->wiphy, dev, &params);
 
  out:
-        cfg80211_put_dev(drv);
+        cfg80211_unlock_rdev(rdev);
         dev_put(dev);
  out_rtnl:
         rtnl_unlock();
@@ -2357,7 +2563,7 @@ static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
 static int nl80211_get_mesh_params(struct sk_buff *skb,
         struct genl_info *info)
 {
-        struct cfg80211_registered_device *drv;
+        struct cfg80211_registered_device *rdev;
         struct mesh_config cur_params;
         int err;
         struct net_device *dev;
@@ -2368,17 +2574,17 @@ static int nl80211_get_mesh_params(struct sk_buff *skb,
         rtnl_lock();
 
         /* Look up our device */
-        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
+        err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
         if (err)
                 goto out_rtnl;
 
-        if (!drv->ops->get_mesh_params) {
+        if (!rdev->ops->get_mesh_params) {
                 err = -EOPNOTSUPP;
                 goto out;
         }
 
         /* Get the mesh params */
-        err = drv->ops->get_mesh_params(&drv->wiphy, dev, &cur_params);
+        err = rdev->ops->get_mesh_params(&rdev->wiphy, dev, &cur_params);
         if (err)
                 goto out;
 
@@ -2424,7 +2630,7 @@ static int nl80211_get_mesh_params(struct sk_buff *skb,
                         cur_params.dot11MeshHWMPnetDiameterTraversalTime);
         nla_nest_end(msg, pinfoattr);
         genlmsg_end(msg, hdr);
-        err = genlmsg_unicast(msg, info->snd_pid);
+        err = genlmsg_reply(msg, info);
         goto out;
 
  nla_put_failure:
@@ -2432,7 +2638,7 @@ static int nl80211_get_mesh_params(struct sk_buff *skb,
         err = -EMSGSIZE;
  out:
         /* Cleanup */
-        cfg80211_put_dev(drv);
+        cfg80211_unlock_rdev(rdev);
         dev_put(dev);
  out_rtnl:
         rtnl_unlock();
@@ -2470,7 +2676,7 @@ static int nl80211_set_mesh_params(struct sk_buff *skb, struct genl_info *info)
 {
         int err;
         u32 mask;
-        struct cfg80211_registered_device *drv;
+        struct cfg80211_registered_device *rdev;
         struct net_device *dev;
         struct mesh_config cfg;
         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
@@ -2485,11 +2691,11 @@ static int nl80211_set_mesh_params(struct sk_buff *skb, struct genl_info *info)
 
         rtnl_lock();
 
-        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
+        err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
         if (err)
                 goto out_rtnl;
 
-        if (!drv->ops->set_mesh_params) {
+        if (!rdev->ops->set_mesh_params) {
                 err = -EOPNOTSUPP;
                 goto out;
         }
@@ -2534,11 +2740,11 @@ static int nl80211_set_mesh_params(struct sk_buff *skb, struct genl_info *info)
                         nla_get_u16);
 
         /* Apply changes */
-        err = drv->ops->set_mesh_params(&drv->wiphy, dev, &cfg, mask);
+        err = rdev->ops->set_mesh_params(&rdev->wiphy, dev, &cfg, mask);
 
  out:
         /* cleanup */
-        cfg80211_put_dev(drv);
+        cfg80211_unlock_rdev(rdev);
         dev_put(dev);
  out_rtnl:
         rtnl_unlock();
@@ -2612,7 +2818,7 @@ static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
         nla_nest_end(msg, nl_reg_rules);
 
         genlmsg_end(msg, hdr);
-        err = genlmsg_unicast(msg, info->snd_pid);
+        err = genlmsg_reply(msg, info);
         goto out;
 
 nla_put_failure:
@@ -2698,16 +2904,41 @@ static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
         return r;
 }
 
+static int validate_scan_freqs(struct nlattr *freqs)
+{
+        struct nlattr *attr1, *attr2;
+        int n_channels = 0, tmp1, tmp2;
+
+        nla_for_each_nested(attr1, freqs, tmp1) {
+                n_channels++;
+                /*
+                 * Some hardware has a limited channel list for
+                 * scanning, and it is pretty much nonsensical
+                 * to scan for a channel twice, so disallow that
+                 * and don't require drivers to check that the
+                 * channel list they get isn't longer than what
+                 * they can scan, as long as they can scan all
+                 * the channels they registered at once.
+                 */
+                nla_for_each_nested(attr2, freqs, tmp2)
+                        if (attr1 != attr2 &&
+                            nla_get_u32(attr1) == nla_get_u32(attr2))
+                                return 0;
+        }
+
+        return n_channels;
+}
+
 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
 {
-        struct cfg80211_registered_device *drv;
+        struct cfg80211_registered_device *rdev;
         struct net_device *dev;
         struct cfg80211_scan_request *request;
         struct cfg80211_ssid *ssid;
         struct ieee80211_channel *channel;
         struct nlattr *attr;
         struct wiphy *wiphy;
-        int err, tmp, n_ssids = 0, n_channels = 0, i;
+        int err, tmp, n_ssids = 0, n_channels, i;
         enum ieee80211_band band;
         size_t ie_len;
 
@@ -2716,13 +2947,13 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
 
         rtnl_lock();
 
-        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
+        err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
         if (err)
                 goto out_rtnl;
 
-        wiphy = &drv->wiphy;
+        wiphy = &rdev->wiphy;
 
-        if (!drv->ops->scan) {
+        if (!rdev->ops->scan) {
                 err = -EOPNOTSUPP;
                 goto out;
         }
@@ -2732,19 +2963,21 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
                 goto out;
         }
 
-        if (drv->scan_req) {
+        if (rdev->scan_req) {
                 err = -EBUSY;
                 goto out;
         }
 
         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
-                nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp)
-                        n_channels++;
+                n_channels = validate_scan_freqs(
+                                info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
                 if (!n_channels) {
                         err = -EINVAL;
                         goto out;
                 }
         } else {
+                n_channels = 0;
+
                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
                         if (wiphy->bands[band])
                                 n_channels += wiphy->bands[band]->n_channels;
@@ -2837,18 +3070,21 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
         }
 
         request->ifidx = dev->ifindex;
-        request->wiphy = &drv->wiphy;
+        request->wiphy = &rdev->wiphy;
+
+        rdev->scan_req = request;
+        err = rdev->ops->scan(&rdev->wiphy, dev, request);
 
-        drv->scan_req = request;
-        err = drv->ops->scan(&drv->wiphy, dev, request);
+        if (!err)
+                nl80211_send_scan_start(rdev, dev);
 
  out_free:
         if (err) {
-                drv->scan_req = NULL;
+                rdev->scan_req = NULL;
                 kfree(request);
         }
  out:
-        cfg80211_put_dev(drv);
+        cfg80211_unlock_rdev(rdev);
         dev_put(dev);
  out_rtnl:
         rtnl_unlock();
@@ -2858,11 +3094,15 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
 
 static int nl80211_send_bss(struct sk_buff *msg, u32 pid, u32 seq, int flags,
                             struct cfg80211_registered_device *rdev,
-                            struct net_device *dev,
-                            struct cfg80211_bss *res)
+                            struct wireless_dev *wdev,
+                            struct cfg80211_internal_bss *intbss)
 {
+        struct cfg80211_bss *res = &intbss->pub;
         void *hdr;
         struct nlattr *bss;
+        int i;
+
+        ASSERT_WDEV_LOCK(wdev);
 
         hdr = nl80211hdr_put(msg, pid, seq, flags,
                              NL80211_CMD_NEW_SCAN_RESULTS);
@@ -2871,7 +3111,7 @@ static int nl80211_send_bss(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 
         NLA_PUT_U32(msg, NL80211_ATTR_SCAN_GENERATION,
                     rdev->bss_generation);
-        NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
+        NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex);
 
         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
         if (!bss)
@@ -2900,6 +3140,28 @@ static int nl80211_send_bss(struct sk_buff *msg, u32 pid, u32 seq, int flags,
                 break;
         }
 
+        switch (wdev->iftype) {
+        case NL80211_IFTYPE_STATION:
+                if (intbss == wdev->current_bss)
+                        NLA_PUT_U32(msg, NL80211_BSS_STATUS,
+                                    NL80211_BSS_STATUS_ASSOCIATED);
+                else for (i = 0; i < MAX_AUTH_BSSES; i++) {
+                        if (intbss != wdev->auth_bsses[i])
+                                continue;
+                        NLA_PUT_U32(msg, NL80211_BSS_STATUS,
+                                    NL80211_BSS_STATUS_AUTHENTICATED);
+                        break;
+                }
+                break;
+        case NL80211_IFTYPE_ADHOC:
+                if (intbss == wdev->current_bss)
+                        NLA_PUT_U32(msg, NL80211_BSS_STATUS,
+                                    NL80211_BSS_STATUS_IBSS_JOINED);
+                break;
+        default:
+                break;
+        }
+
         nla_nest_end(msg, bss);
 
         return genlmsg_end(msg, hdr);
@@ -2912,9 +3174,10 @@ static int nl80211_send_bss(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 static int nl80211_dump_scan(struct sk_buff *skb,
                              struct netlink_callback *cb)
 {
-        struct cfg80211_registered_device *dev;
-        struct net_device *netdev;
+        struct cfg80211_registered_device *rdev;
+        struct net_device *dev;
         struct cfg80211_internal_bss *scan;
+        struct wireless_dev *wdev;
         int ifidx = cb->args[0];
         int start = cb->args[1], idx = 0;
         int err;
@@ -2935,58 +3198,83 @@ static int nl80211_dump_scan(struct sk_buff *skb,
                 cb->args[0] = ifidx;
         }
 
-        netdev = dev_get_by_index(&init_net, ifidx);
-        if (!netdev)
+        dev = dev_get_by_index(&init_net, ifidx);
+        if (!dev)
                 return -ENODEV;
 
-        dev = cfg80211_get_dev_from_ifindex(ifidx);
-        if (IS_ERR(dev)) {
-                err = PTR_ERR(dev);
+        rdev = cfg80211_get_dev_from_ifindex(ifidx);
+        if (IS_ERR(rdev)) {
+                err = PTR_ERR(rdev);
                 goto out_put_netdev;
         }
 
-        spin_lock_bh(&dev->bss_lock);
-        cfg80211_bss_expire(dev);
+        wdev = dev->ieee80211_ptr;
 
-        list_for_each_entry(scan, &dev->bss_list, list) {
+        wdev_lock(wdev);
+        spin_lock_bh(&rdev->bss_lock);
+        cfg80211_bss_expire(rdev);
+
+        list_for_each_entry(scan, &rdev->bss_list, list) {
                 if (++idx <= start)
                         continue;
                 if (nl80211_send_bss(skb,
                                 NETLINK_CB(cb->skb).pid,
                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
-                                dev, netdev, &scan->pub) < 0) {
+                                rdev, wdev, scan) < 0) {
                         idx--;
                         goto out;
                 }
         }
 
  out:
-        spin_unlock_bh(&dev->bss_lock);
+        spin_unlock_bh(&rdev->bss_lock);
+        wdev_unlock(wdev);
 
         cb->args[1] = idx;
         err = skb->len;
-        cfg80211_put_dev(dev);
+        cfg80211_unlock_rdev(rdev);
  out_put_netdev:
-        dev_put(netdev);
+        dev_put(dev);
 
         return err;
 }
 
 static bool nl80211_valid_auth_type(enum nl80211_auth_type auth_type)
 {
-        return auth_type == NL80211_AUTHTYPE_OPEN_SYSTEM ||
-                auth_type == NL80211_AUTHTYPE_SHARED_KEY ||
-                auth_type == NL80211_AUTHTYPE_FT ||
-                auth_type == NL80211_AUTHTYPE_NETWORK_EAP;
+        return auth_type <= NL80211_AUTHTYPE_MAX;
 }
 
+static bool nl80211_valid_wpa_versions(u32 wpa_versions)
+{
+        return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
+                                  NL80211_WPA_VERSION_2));
+}
+
+static bool nl80211_valid_akm_suite(u32 akm)
+{
+        return akm == WLAN_AKM_SUITE_8021X ||
+                akm == WLAN_AKM_SUITE_PSK;
+}
+
+static bool nl80211_valid_cipher_suite(u32 cipher)
+{
+        return cipher == WLAN_CIPHER_SUITE_WEP40 ||
+                cipher == WLAN_CIPHER_SUITE_WEP104 ||
+                cipher == WLAN_CIPHER_SUITE_TKIP ||
+                cipher == WLAN_CIPHER_SUITE_CCMP ||
+                cipher == WLAN_CIPHER_SUITE_AES_CMAC;
+}
+
+
 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
 {
-        struct cfg80211_registered_device *drv;
+        struct cfg80211_registered_device *rdev;
         struct net_device *dev;
-        struct cfg80211_auth_request req;
-        struct wiphy *wiphy;
-        int err;
+        struct ieee80211_channel *chan;
+        const u8 *bssid, *ssid, *ie = NULL;
+        int err, ssid_len, ie_len = 0;
+        enum nl80211_auth_type auth_type;
+        struct key_parse key;
 
         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
                 return -EINVAL;
@@ -2997,13 +3285,38 @@ static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
                 return -EINVAL;
 
+        if (!info->attrs[NL80211_ATTR_SSID])
+                return -EINVAL;
+
+        if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
+                return -EINVAL;
+
+        err = nl80211_parse_key(info, &key);
+        if (err)
+                return err;
+
+        if (key.idx >= 0) {
+                if (!key.p.key || !key.p.key_len)
+                        return -EINVAL;
+                if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
+                     key.p.key_len != WLAN_KEY_LEN_WEP40) &&
+                    (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
+                     key.p.key_len != WLAN_KEY_LEN_WEP104))
+                        return -EINVAL;
+                if (key.idx > 4)
+                        return -EINVAL;
+        } else {
+                key.p.key_len = 0;
+                key.p.key = NULL;
+        }
+
         rtnl_lock();
 
-        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
+        err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
         if (err)
                 goto unlock_rtnl;
 
-        if (!drv->ops->auth) {
+        if (!rdev->ops->auth) {
                 err = -EOPNOTSUPP;
                 goto out;
         }
@@ -3018,69 +3331,128 @@ static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
                 goto out;
         }
 
-        wiphy = &drv->wiphy;
-        memset(&req, 0, sizeof(req));
-
-        req.peer_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
-
-        if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
-                req.chan = ieee80211_get_channel(
-                        wiphy,
-                        nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
-                if (!req.chan) {
-                        err = -EINVAL;
-                        goto out;
-                }
+        bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
+        chan = ieee80211_get_channel(&rdev->wiphy,
+                nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
+        if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED)) {
+                err = -EINVAL;
+                goto out;
         }
 
-        if (info->attrs[NL80211_ATTR_SSID]) {
-                req.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
-                req.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
-        }
+        ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
+        ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
 
         if (info->attrs[NL80211_ATTR_IE]) {
-                req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
-                req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
+                ie = nla_data(info->attrs[NL80211_ATTR_IE]);
+                ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
         }
 
-        req.auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
-        if (!nl80211_valid_auth_type(req.auth_type)) {
+        auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
+        if (!nl80211_valid_auth_type(auth_type)) {
                 err = -EINVAL;
                 goto out;
         }
 
-        err = drv->ops->auth(&drv->wiphy, dev, &req);
+        err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
+                                 ssid, ssid_len, ie, ie_len,
+                                 key.p.key, key.p.key_len, key.idx);
 
 out:
-        cfg80211_put_dev(drv);
+        cfg80211_unlock_rdev(rdev);
         dev_put(dev);
 unlock_rtnl:
         rtnl_unlock();
         return err;
 }
 
+static int nl80211_crypto_settings(struct genl_info *info,
+                                   struct cfg80211_crypto_settings *settings,
+                                   int cipher_limit)
+{
+        settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
+
+        if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
+                void *data;
+                int len, i;
+
+                data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
+                len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
+                settings->n_ciphers_pairwise = len / sizeof(u32);
+
+                if (len % sizeof(u32))
+                        return -EINVAL;
+
+                if (settings->n_ciphers_pairwise > cipher_limit)
+                        return -EINVAL;
+
+                memcpy(settings->ciphers_pairwise, data, len);
+
+                for (i = 0; i < settings->n_ciphers_pairwise; i++)
+                        if (!nl80211_valid_cipher_suite(
+                                        settings->ciphers_pairwise[i]))
+                                return -EINVAL;
+        }
+
+        if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
+                settings->cipher_group =
+                        nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
+                if (!nl80211_valid_cipher_suite(settings->cipher_group))
+                        return -EINVAL;
+        }
+
+        if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
+                settings->wpa_versions =
+                        nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
+                if (!nl80211_valid_wpa_versions(settings->wpa_versions))
+                        return -EINVAL;
+        }
+
+        if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
+                void *data;
+                int len, i;
+
+                data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
+                len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
+                settings->n_akm_suites = len / sizeof(u32);
+
+                if (len % sizeof(u32))
+                        return -EINVAL;
+
+                memcpy(settings->akm_suites, data, len);
+
+                for (i = 0; i < settings->n_ciphers_pairwise; i++)
+                        if (!nl80211_valid_akm_suite(settings->akm_suites[i]))
+                                return -EINVAL;
+        }
+
+        return 0;
+}
+
 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
 {
-        struct cfg80211_registered_device *drv;
+        struct cfg80211_registered_device *rdev;
         struct net_device *dev;
-        struct cfg80211_assoc_request req;
-        struct wiphy *wiphy;
-        int err;
+        struct cfg80211_crypto_settings crypto;
+        struct ieee80211_channel *chan;
+        const u8 *bssid, *ssid, *ie = NULL, *prev_bssid = NULL;
+        int err, ssid_len, ie_len = 0;
+        bool use_mfp = false;
 
         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
                 return -EINVAL;
 
         if (!info->attrs[NL80211_ATTR_MAC] ||
-            !info->attrs[NL80211_ATTR_SSID])
+            !info->attrs[NL80211_ATTR_SSID] ||
+            !info->attrs[NL80211_ATTR_WIPHY_FREQ])
                 return -EINVAL;
 
         rtnl_lock();
 
-        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
+        err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
         if (err)
                 goto unlock_rtnl;
 
-        if (!drv->ops->assoc) {
+        if (!rdev->ops->assoc) {
                 err = -EOPNOTSUPP;
                 goto out;
         }
@@ -3095,46 +3467,45 @@ static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
                 goto out;
         }
 
-        wiphy = &drv->wiphy;
-        memset(&req, 0, sizeof(req));
+        bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
 
-        req.peer_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
-
-        if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
-                req.chan = ieee80211_get_channel(
-                        wiphy,
-                        nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
-                if (!req.chan) {
-                        err = -EINVAL;
-                        goto out;
-                }
+        chan = ieee80211_get_channel(&rdev->wiphy,
+                nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
+        if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED)) {
+                err = -EINVAL;
+                goto out;
         }
 
-        req.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
-        req.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
+        ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
+        ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
 
         if (info->attrs[NL80211_ATTR_IE]) {
-                req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
-                req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
+                ie = nla_data(info->attrs[NL80211_ATTR_IE]);
+                ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
         }
 
         if (info->attrs[NL80211_ATTR_USE_MFP]) {
-                enum nl80211_mfp use_mfp =
+                enum nl80211_mfp mfp =
                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
-                if (use_mfp == NL80211_MFP_REQUIRED)
-                        req.use_mfp = true;
-                else if (use_mfp != NL80211_MFP_NO) {
+                if (mfp == NL80211_MFP_REQUIRED)
+                        use_mfp = true;
+                else if (mfp != NL80211_MFP_NO) {
                         err = -EINVAL;
                         goto out;
                 }
         }
 
-        req.control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
+        if (info->attrs[NL80211_ATTR_PREV_BSSID])
+                prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
 
-        err = drv->ops->assoc(&drv->wiphy, dev, &req);
+        err = nl80211_crypto_settings(info, &crypto, 1);
+        if (!err)
+                err = cfg80211_mlme_assoc(rdev, dev, chan, bssid, prev_bssid,
+                                          ssid, ssid_len, ie, ie_len, use_mfp,
+                                          &crypto);
 
 out:
-        cfg80211_put_dev(drv);
+        cfg80211_unlock_rdev(rdev);
         dev_put(dev);
 unlock_rtnl:
         rtnl_unlock();
@@ -3143,11 +3514,11 @@ unlock_rtnl:
 
 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
 {
-        struct cfg80211_registered_device *drv;
+        struct cfg80211_registered_device *rdev;
         struct net_device *dev;
-        struct cfg80211_deauth_request req;
-        struct wiphy *wiphy;
-        int err;
+        const u8 *ie = NULL, *bssid;
+        int err, ie_len = 0;
+        u16 reason_code;
 
         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
                 return -EINVAL;
@@ -3160,11 +3531,11 @@ static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
 
         rtnl_lock();
 
-        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
+        err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
         if (err)
                 goto unlock_rtnl;
 
-        if (!drv->ops->deauth) {
+        if (!rdev->ops->deauth) {
                 err = -EOPNOTSUPP;
                 goto out;
         }
@@ -3179,27 +3550,24 @@ static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
                 goto out;
         }
 
-        wiphy = &drv->wiphy;
-        memset(&req, 0, sizeof(req));
-
-        req.peer_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
+        bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
 
-        req.reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
-        if (req.reason_code == 0) {
+        reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
+        if (reason_code == 0) {
                 /* Reason Code 0 is reserved */
                 err = -EINVAL;
                 goto out;
         }
 
         if (info->attrs[NL80211_ATTR_IE]) {
-                req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
-                req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
+                ie = nla_data(info->attrs[NL80211_ATTR_IE]);
+                ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
         }
 
-        err = drv->ops->deauth(&drv->wiphy, dev, &req);
+        err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code);
 
 out:
-        cfg80211_put_dev(drv);
+        cfg80211_unlock_rdev(rdev);
         dev_put(dev);
 unlock_rtnl:
         rtnl_unlock();
@@ -3208,11 +3576,11 @@ unlock_rtnl:
 
 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
 {
-        struct cfg80211_registered_device *drv;
+        struct cfg80211_registered_device *rdev;
         struct net_device *dev;
-        struct cfg80211_disassoc_request req;
-        struct wiphy *wiphy;
-        int err;
+        const u8 *ie = NULL, *bssid;
+        int err, ie_len = 0;
+        u16 reason_code;
 
         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
                 return -EINVAL;
@@ -3225,11 +3593,11 @@ static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
 
         rtnl_lock();
 
-        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
+        err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
         if (err)
                 goto unlock_rtnl;
 
-        if (!drv->ops->disassoc) {
+        if (!rdev->ops->disassoc) {
                 err = -EOPNOTSUPP;
                 goto out;
         }
@@ -3244,27 +3612,24 @@ static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
                 goto out;
         }
 
-        wiphy = &drv->wiphy;
-        memset(&req, 0, sizeof(req));
+        bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
 
-        req.peer_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
-
-        req.reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
-        if (req.reason_code == 0) {
+        reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
+        if (reason_code == 0) {
                 /* Reason Code 0 is reserved */
                 err = -EINVAL;
                 goto out;
         }
 
         if (info->attrs[NL80211_ATTR_IE]) {
-                req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
-                req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
+                ie = nla_data(info->attrs[NL80211_ATTR_IE]);
+                ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
         }
 
-        err = drv->ops->disassoc(&drv->wiphy, dev, &req);
+        err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code);
 
 out:
-        cfg80211_put_dev(drv);
+        cfg80211_unlock_rdev(rdev);
         dev_put(dev);
 unlock_rtnl:
         rtnl_unlock();
@@ -3273,10 +3638,11 @@ unlock_rtnl:
 
 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
 {
-        struct cfg80211_registered_device *drv;
+        struct cfg80211_registered_device *rdev;
         struct net_device *dev;
         struct cfg80211_ibss_params ibss;
         struct wiphy *wiphy;
+        struct cfg80211_cached_keys *connkeys = NULL;
         int err;
 
         memset(&ibss, 0, sizeof(ibss));
@@ -3300,11 +3666,11 @@ static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
 
         rtnl_lock();
 
-        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
+        err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
         if (err)
                 goto unlock_rtnl;
 
-        if (!drv->ops->join_ibss) {
+        if (!rdev->ops->join_ibss) {
                 err = -EOPNOTSUPP;
                 goto out;
         }
@@ -3319,7 +3685,7 @@ static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
                 goto out;
         }
 
-        wiphy = &drv->wiphy;
+        wiphy = &rdev->wiphy;
 
         if (info->attrs[NL80211_ATTR_MAC])
                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
@@ -3341,30 +3707,43 @@ static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
         }
 
         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
+        ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
+
+        if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
+                connkeys = nl80211_parse_connkeys(rdev,
+                                        info->attrs[NL80211_ATTR_KEYS]);
+                if (IS_ERR(connkeys)) {
+                        err = PTR_ERR(connkeys);
+                        connkeys = NULL;
+                        goto out;
+                }
+        }
 
-        err = cfg80211_join_ibss(drv, dev, &ibss);
+        err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
 
 out:
-        cfg80211_put_dev(drv);
+        cfg80211_unlock_rdev(rdev);
         dev_put(dev);
 unlock_rtnl:
+        if (err)
+                kfree(connkeys);
         rtnl_unlock();
         return err;
 }
 
 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
 {
-        struct cfg80211_registered_device *drv;
+        struct cfg80211_registered_device *rdev;
         struct net_device *dev;
         int err;
 
         rtnl_lock();
 
-        err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
+        err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
         if (err)
                 goto unlock_rtnl;
 
-        if (!drv->ops->leave_ibss) {
+        if (!rdev->ops->leave_ibss) {
                 err = -EOPNOTSUPP;
                 goto out;
         }
@@ -3379,10 +3758,266 @@ static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
                 goto out;
         }
 
-        err = cfg80211_leave_ibss(drv, dev, false);
+        err = cfg80211_leave_ibss(rdev, dev, false);
+
+out:
+        cfg80211_unlock_rdev(rdev);
+        dev_put(dev);
+unlock_rtnl:
+        rtnl_unlock();
+        return err;
+}
+
+#ifdef CONFIG_NL80211_TESTMODE
+static struct genl_multicast_group nl80211_testmode_mcgrp = {
+        .name = "testmode",
+};
+
+static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
+{
+        struct cfg80211_registered_device *rdev;
+        int err;
+
+        if (!info->attrs[NL80211_ATTR_TESTDATA])
+                return -EINVAL;
+
+        rtnl_lock();
+
+        rdev = cfg80211_get_dev_from_info(info);
+        if (IS_ERR(rdev)) {
+                err = PTR_ERR(rdev);
+                goto unlock_rtnl;
+        }
+
+        err = -EOPNOTSUPP;
+        if (rdev->ops->testmode_cmd) {
+                rdev->testmode_info = info;
+                err = rdev->ops->testmode_cmd(&rdev->wiphy,
+                                nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
+                                nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
+                rdev->testmode_info = NULL;
+        }
+
+        cfg80211_unlock_rdev(rdev);
+
+ unlock_rtnl:
+        rtnl_unlock();
+        return err;
+}
+
+static struct sk_buff *
+__cfg80211_testmode_alloc_skb(struct cfg80211_registered_device *rdev,
+                              int approxlen, u32 pid, u32 seq, gfp_t gfp)
+{
+        struct sk_buff *skb;
+        void *hdr;
+        struct nlattr *data;
+
+        skb = nlmsg_new(approxlen + 100, gfp);
+        if (!skb)
+                return NULL;
+
+        hdr = nl80211hdr_put(skb, pid, seq, 0, NL80211_CMD_TESTMODE);
+        if (!hdr) {
+                kfree_skb(skb);
+                return NULL;
+        }
+
+        NLA_PUT_U32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
+        data = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
+
+        ((void **)skb->cb)[0] = rdev;
+        ((void **)skb->cb)[1] = hdr;
+        ((void **)skb->cb)[2] = data;
+
+        return skb;
+
+ nla_put_failure:
+        kfree_skb(skb);
+        return NULL;
+}
+
+struct sk_buff *cfg80211_testmode_alloc_reply_skb(struct wiphy *wiphy,
+                                                  int approxlen)
+{
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+
+        if (WARN_ON(!rdev->testmode_info))
+                return NULL;
+
+        return __cfg80211_testmode_alloc_skb(rdev, approxlen,
+                                rdev->testmode_info->snd_pid,
+                                rdev->testmode_info->snd_seq,
+                                GFP_KERNEL);
+}
+EXPORT_SYMBOL(cfg80211_testmode_alloc_reply_skb);
+
+int cfg80211_testmode_reply(struct sk_buff *skb)
+{
+        struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
+        void *hdr = ((void **)skb->cb)[1];
+        struct nlattr *data = ((void **)skb->cb)[2];
+
+        if (WARN_ON(!rdev->testmode_info)) {
+                kfree_skb(skb);
+                return -EINVAL;
+        }
+
+        nla_nest_end(skb, data);
+        genlmsg_end(skb, hdr);
+        return genlmsg_reply(skb, rdev->testmode_info);
+}
+EXPORT_SYMBOL(cfg80211_testmode_reply);
+
+struct sk_buff *cfg80211_testmode_alloc_event_skb(struct wiphy *wiphy,
+                                                  int approxlen, gfp_t gfp)
+{
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+
+        return __cfg80211_testmode_alloc_skb(rdev, approxlen, 0, 0, gfp);
+}
+EXPORT_SYMBOL(cfg80211_testmode_alloc_event_skb);
+
+void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
+{
+        void *hdr = ((void **)skb->cb)[1];
+        struct nlattr *data = ((void **)skb->cb)[2];
+
+        nla_nest_end(skb, data);
+        genlmsg_end(skb, hdr);
+        genlmsg_multicast(skb, 0, nl80211_testmode_mcgrp.id, gfp);
+}
+EXPORT_SYMBOL(cfg80211_testmode_event);
+#endif
+
+static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
+{
+        struct cfg80211_registered_device *rdev;
+        struct net_device *dev;
+        struct cfg80211_connect_params connect;
+        struct wiphy *wiphy;
+        struct cfg80211_cached_keys *connkeys = NULL;
+        int err;
+
+        memset(&connect, 0, sizeof(connect));
+
+        if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
+                return -EINVAL;
+
+        if (!info->attrs[NL80211_ATTR_SSID] ||
+            !nla_len(info->attrs[NL80211_ATTR_SSID]))
+                return -EINVAL;
+
+        if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
+                connect.auth_type =
+                        nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
+                if (!nl80211_valid_auth_type(connect.auth_type))
+                        return -EINVAL;
+        } else
+                connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
+
+        connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
+
+        err = nl80211_crypto_settings(info, &connect.crypto,
+                                      NL80211_MAX_NR_CIPHER_SUITES);
+        if (err)
+                return err;
+        rtnl_lock();
+
+        err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
+        if (err)
+                goto unlock_rtnl;
+
+        if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
+                err = -EOPNOTSUPP;
+                goto out;
+        }
+
+        if (!netif_running(dev)) {
+                err = -ENETDOWN;
+                goto out;
+        }
+
+        wiphy = &rdev->wiphy;
+
+        if (info->attrs[NL80211_ATTR_MAC])
+                connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
+        connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
+        connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
+
+        if (info->attrs[NL80211_ATTR_IE]) {
+                connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
+                connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
+        }
+
+        if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
+                connect.channel =
+                        ieee80211_get_channel(wiphy,
+                            nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
+                if (!connect.channel ||
+                    connect.channel->flags & IEEE80211_CHAN_DISABLED) {
+                        err = -EINVAL;
+                        goto out;
+                }
+        }
+
+        if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
+                connkeys = nl80211_parse_connkeys(rdev,
+                                        info->attrs[NL80211_ATTR_KEYS]);
+                if (IS_ERR(connkeys)) {
+                        err = PTR_ERR(connkeys);
+                        connkeys = NULL;
+                        goto out;
+                }
+        }
+
+        err = cfg80211_connect(rdev, dev, &connect, connkeys);
 
 out:
-        cfg80211_put_dev(drv);
+        cfg80211_unlock_rdev(rdev);
+        dev_put(dev);
+unlock_rtnl:
+        if (err)
+                kfree(connkeys);
+        rtnl_unlock();
+        return err;
+}
+
+static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
+{
+        struct cfg80211_registered_device *rdev;
+        struct net_device *dev;
+        int err;
+        u16 reason;
+
+        if (!info->attrs[NL80211_ATTR_REASON_CODE])
+                reason = WLAN_REASON_DEAUTH_LEAVING;
+        else
+                reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
+
+        if (reason == 0)
+                return -EINVAL;
+
+        rtnl_lock();
+
+        err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
+        if (err)
+                goto unlock_rtnl;
+
+        if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
+                err = -EOPNOTSUPP;
+                goto out;
+        }
+
+        if (!netif_running(dev)) {
+                err = -ENETDOWN;
+                goto out;
+        }
+
+        err = cfg80211_disconnect(rdev, dev, reason, true);
+
+out:
+        cfg80211_unlock_rdev(rdev);
         dev_put(dev);
 unlock_rtnl:
         rtnl_unlock();
@@ -3602,6 +4237,26 @@ static struct genl_ops nl80211_ops[] = {
                 .policy = nl80211_policy,
                 .flags = GENL_ADMIN_PERM,
         },
+#ifdef CONFIG_NL80211_TESTMODE
+        {
+                .cmd = NL80211_CMD_TESTMODE,
+                .doit = nl80211_testmode_do,
+                .policy = nl80211_policy,
+                .flags = GENL_ADMIN_PERM,
+        },
+#endif
+        {
+                .cmd = NL80211_CMD_CONNECT,
+                .doit = nl80211_connect,
+                .policy = nl80211_policy,
+                .flags = GENL_ADMIN_PERM,
+        },
+        {
+                .cmd = NL80211_CMD_DISCONNECT,
+                .doit = nl80211_disconnect,
+                .policy = nl80211_policy,
+                .flags = GENL_ADMIN_PERM,
+        },
 };
 static struct genl_multicast_group nl80211_mlme_mcgrp = {
         .name = "mlme",
@@ -3643,6 +4298,8 @@ static int nl80211_add_scan_req(struct sk_buff *msg,
         struct nlattr *nest;
         int i;
 
+        ASSERT_RDEV_LOCK(rdev);
+
         if (WARN_ON(!req))
                 return 0;
 
@@ -3668,11 +4325,11 @@ static int nl80211_add_scan_req(struct sk_buff *msg,
         return -ENOBUFS;
 }
 
-static int nl80211_send_scan_donemsg(struct sk_buff *msg,
-                                     struct cfg80211_registered_device *rdev,
-                                     struct net_device *netdev,
-                                     u32 pid, u32 seq, int flags,
-                                     u32 cmd)
+static int nl80211_send_scan_msg(struct sk_buff *msg,
+                                 struct cfg80211_registered_device *rdev,
+                                 struct net_device *netdev,
+                                 u32 pid, u32 seq, int flags,
+                                 u32 cmd)
 {
         void *hdr;
 
@@ -3693,6 +4350,24 @@ static int nl80211_send_scan_donemsg(struct sk_buff *msg,
         return -EMSGSIZE;
 }
 
+void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
+                             struct net_device *netdev)
+{
+        struct sk_buff *msg;
+
+        msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
+        if (!msg)
+                return;
+
+        if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
+                                  NL80211_CMD_TRIGGER_SCAN) < 0) {
+                nlmsg_free(msg);
+                return;
+        }
+
+        genlmsg_multicast(msg, 0, nl80211_scan_mcgrp.id, GFP_KERNEL);
+}
+
 void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
                             struct net_device *netdev)
 {
@@ -3702,8 +4377,8 @@ void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
         if (!msg)
                 return;
 
-        if (nl80211_send_scan_donemsg(msg, rdev, netdev, 0, 0, 0,
-                                      NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
+        if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
+                                  NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
                 nlmsg_free(msg);
                 return;
         }
@@ -3720,8 +4395,8 @@ void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
         if (!msg)
                 return;
 
-        if (nl80211_send_scan_donemsg(msg, rdev, netdev, 0, 0, 0,
-                                      NL80211_CMD_SCAN_ABORTED) < 0) {
+        if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
+                                  NL80211_CMD_SCAN_ABORTED) < 0) {
                 nlmsg_free(msg);
                 return;
         }
@@ -3787,12 +4462,12 @@ nla_put_failure:
 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
                                     struct net_device *netdev,
                                     const u8 *buf, size_t len,
-                                    enum nl80211_commands cmd)
+                                    enum nl80211_commands cmd, gfp_t gfp)
 {
         struct sk_buff *msg;
         void *hdr;
 
-        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
+        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
         if (!msg)
                 return;
 
@@ -3811,7 +4486,7 @@ static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
                 return;
         }
 
-        genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, GFP_ATOMIC);
+        genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
         return;
 
  nla_put_failure:
@@ -3820,42 +4495,45 @@ static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
 }
 
 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
-                          struct net_device *netdev, const u8 *buf, size_t len)
+                          struct net_device *netdev, const u8 *buf,
+                          size_t len, gfp_t gfp)
 {
         nl80211_send_mlme_event(rdev, netdev, buf, len,
-                                NL80211_CMD_AUTHENTICATE);
+                                NL80211_CMD_AUTHENTICATE, gfp);
 }
 
 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
                            struct net_device *netdev, const u8 *buf,
-                           size_t len)
+                           size_t len, gfp_t gfp)
 {
-        nl80211_send_mlme_event(rdev, netdev, buf, len, NL80211_CMD_ASSOCIATE);
+        nl80211_send_mlme_event(rdev, netdev, buf, len,
+                                NL80211_CMD_ASSOCIATE, gfp);
 }
 
 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
-                         struct net_device *netdev, const u8 *buf, size_t len)
+                         struct net_device *netdev, const u8 *buf,
+                         size_t len, gfp_t gfp)
 {
         nl80211_send_mlme_event(rdev, netdev, buf, len,
-                                NL80211_CMD_DEAUTHENTICATE);
+                                NL80211_CMD_DEAUTHENTICATE, gfp);
 }
 
 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
                            struct net_device *netdev, const u8 *buf,
-                           size_t len)
+                           size_t len, gfp_t gfp)
 {
         nl80211_send_mlme_event(rdev, netdev, buf, len,
-                                NL80211_CMD_DISASSOCIATE);
+                                NL80211_CMD_DISASSOCIATE, gfp);
 }
 
 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
                                       struct net_device *netdev, int cmd,
-                                      const u8 *addr)
+                                      const u8 *addr, gfp_t gfp)
 {
         struct sk_buff *msg;
         void *hdr;
 
-        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
+        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
         if (!msg)
                 return;
 
@@ -3875,7 +4553,7 @@ static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
                 return;
         }
 
-        genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, GFP_ATOMIC);
+        genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
         return;
 
  nla_put_failure:
@@ -3884,16 +4562,142 @@ static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
 }
 
 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
-                               struct net_device *netdev, const u8 *addr)
+                               struct net_device *netdev, const u8 *addr,
+                               gfp_t gfp)
 {
         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
-                                  addr);
+                                  addr, gfp);
 }
 
 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
-                                struct net_device *netdev, const u8 *addr)
+                                struct net_device *netdev, const u8 *addr,
+                                gfp_t gfp)
 {
-        nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE, addr);
+        nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
+                                  addr, gfp);
+}
+
+void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
+                                 struct net_device *netdev, const u8 *bssid,
+                                 const u8 *req_ie, size_t req_ie_len,
+                                 const u8 *resp_ie, size_t resp_ie_len,
+                                 u16 status, gfp_t gfp)
+{
+        struct sk_buff *msg;
+        void *hdr;
+
+        msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
+        if (!msg)
+                return;
+
+        hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
+        if (!hdr) {
+                nlmsg_free(msg);
+                return;
+        }
+
+        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
+        NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
+        if (bssid)
+                NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
+        NLA_PUT_U16(msg, NL80211_ATTR_STATUS_CODE, status);
+        if (req_ie)
+                NLA_PUT(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie);
+        if (resp_ie)
+                NLA_PUT(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie);
+
+        if (genlmsg_end(msg, hdr) < 0) {
+                nlmsg_free(msg);
+                return;
+        }
+
+        genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
+        return;
+
+ nla_put_failure:
+        genlmsg_cancel(msg, hdr);
+        nlmsg_free(msg);
+
+}
+
+void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
+                         struct net_device *netdev, const u8 *bssid,
+                         const u8 *req_ie, size_t req_ie_len,
+                         const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
+{
+        struct sk_buff *msg;
+        void *hdr;
+
+        msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
+        if (!msg)
+                return;
+
+        hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
+        if (!hdr) {
+                nlmsg_free(msg);
+                return;
+        }
+
+        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
+        NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
+        NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
+        if (req_ie)
+                NLA_PUT(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie);
+        if (resp_ie)
+                NLA_PUT(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie);
+
+        if (genlmsg_end(msg, hdr) < 0) {
+                nlmsg_free(msg);
+                return;
+        }
+
+        genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
+        return;
+
+ nla_put_failure:
+        genlmsg_cancel(msg, hdr);
+        nlmsg_free(msg);
+
+}
+
+void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
+                               struct net_device *netdev, u16 reason,
+                               const u8 *ie, size_t ie_len, bool from_ap)
+{
+        struct sk_buff *msg;
+        void *hdr;
+
+        msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
+        if (!msg)
+                return;
+
+        hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
+        if (!hdr) {
+                nlmsg_free(msg);
+                return;
+        }
+
+        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
+        NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
+        if (from_ap && reason)
+                NLA_PUT_U16(msg, NL80211_ATTR_REASON_CODE, reason);
+        if (from_ap)
+                NLA_PUT_FLAG(msg, NL80211_ATTR_DISCONNECTED_BY_AP);
+        if (ie)
+                NLA_PUT(msg, NL80211_ATTR_IE, ie_len, ie);
+
+        if (genlmsg_end(msg, hdr) < 0) {
+                nlmsg_free(msg);
+                return;
+        }
+
+        genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, GFP_KERNEL);
+        return;
+
+ nla_put_failure:
+        genlmsg_cancel(msg, hdr);
+        nlmsg_free(msg);
+
 }
 
 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
@@ -3933,12 +4737,12 @@ void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
                                  struct net_device *netdev, const u8 *addr,
                                  enum nl80211_key_type key_type, int key_id,
-                                 const u8 *tsc)
+                                 const u8 *tsc, gfp_t gfp)
 {
         struct sk_buff *msg;
         void *hdr;
 
-        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
+        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
         if (!msg)
                 return;
 
@@ -3962,7 +4766,7 @@ void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
                 return;
         }
 
-        genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, GFP_ATOMIC);
+        genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
         return;
 
  nla_put_failure:
@@ -4051,6 +4855,12 @@ int nl80211_init(void)
         if (err)
                 goto err_out;
 
+#ifdef CONFIG_NL80211_TESTMODE
+        err = genl_register_mc_group(&nl80211_fam, &nl80211_testmode_mcgrp);
+        if (err)
+                goto err_out;
+#endif
+
         return 0;
  err_out:
         genl_unregister_family(&nl80211_fam);
diff --git a/net/wireless/nl80211.h b/net/wireless/nl80211.h
index 5c12ad13499b..44cc2a76a1b0 100644
--- a/net/wireless/nl80211.h
+++ b/net/wireless/nl80211.h
@@ -3,39 +3,54 @@
 
 #include "core.h"
 
-extern int nl80211_init(void);
-extern void nl80211_exit(void);
-extern void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev);
-extern void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
-                                   struct net_device *netdev);
-extern void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
-                                      struct net_device *netdev);
-extern void nl80211_send_reg_change_event(struct regulatory_request *request);
-extern void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
-                                 struct net_device *netdev,
-                                 const u8 *buf, size_t len);
-extern void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
-                                  struct net_device *netdev,
-                                  const u8 *buf, size_t len);
-extern void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
+int nl80211_init(void);
+void nl80211_exit(void);
+void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev);
+void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
+                             struct net_device *netdev);
+void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
+                            struct net_device *netdev);
+void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
+                               struct net_device *netdev);
+void nl80211_send_reg_change_event(struct regulatory_request *request);
+void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
+                          struct net_device *netdev,
+                          const u8 *buf, size_t len, gfp_t gfp);
+void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
+                           struct net_device *netdev,
+                           const u8 *buf, size_t len, gfp_t gfp);
+void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
+                         struct net_device *netdev,
+                         const u8 *buf, size_t len, gfp_t gfp);
+void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
+                           struct net_device *netdev,
+                           const u8 *buf, size_t len, gfp_t gfp);
+void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
+                               struct net_device *netdev,
+                               const u8 *addr, gfp_t gfp);
+void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
                                 struct net_device *netdev,
-                                const u8 *buf, size_t len);
-extern void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
-                                  struct net_device *netdev,
-                                  const u8 *buf, size_t len);
-extern void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
-                                      struct net_device *netdev,
-                                      const u8 *addr);
-extern void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
-                                       struct net_device *netdev,
-                                       const u8 *addr);
-extern void
+                                const u8 *addr, gfp_t gfp);
+void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
+                                 struct net_device *netdev, const u8 *bssid,
+                                 const u8 *req_ie, size_t req_ie_len,
+                                 const u8 *resp_ie, size_t resp_ie_len,
+                                 u16 status, gfp_t gfp);
+void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
+                         struct net_device *netdev, const u8 *bssid,
+                         const u8 *req_ie, size_t req_ie_len,
+                         const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp);
+void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
+                               struct net_device *netdev, u16 reason,
+                               const u8 *ie, size_t ie_len, bool from_ap);
+
+void
 nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
                             struct net_device *netdev, const u8 *addr,
                             enum nl80211_key_type key_type,
-                            int key_id, const u8 *tsc);
+                            int key_id, const u8 *tsc, gfp_t gfp);
 
-extern void
+void
 nl80211_send_beacon_hint_event(struct wiphy *wiphy,
                                struct ieee80211_channel *channel_before,
                                struct ieee80211_channel *channel_after);
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 5e14371cda70..fb40428a5946 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -113,11 +113,7 @@ static const struct ieee80211_regdomain world_regdom = {
 static const struct ieee80211_regdomain *cfg80211_world_regdom =
         &world_regdom;
 
-#ifdef CONFIG_WIRELESS_OLD_REGULATORY
-static char *ieee80211_regdom = "US";
-#else
 static char *ieee80211_regdom = "00";
-#endif
 
 module_param(ieee80211_regdom, charp, 0444);
 MODULE_PARM_DESC(ieee80211_regdom, "IEEE 802.11 regulatory domain code");
@@ -1061,10 +1057,10 @@ static bool ignore_reg_update(struct wiphy *wiphy,
 
 static void update_all_wiphy_regulatory(enum nl80211_reg_initiator initiator)
 {
-        struct cfg80211_registered_device *drv;
+        struct cfg80211_registered_device *rdev;
 
-        list_for_each_entry(drv, &cfg80211_drv_list, list)
-                wiphy_update_regulatory(&drv->wiphy, initiator);
+        list_for_each_entry(rdev, &cfg80211_rdev_list, list)
+                wiphy_update_regulatory(&rdev->wiphy, initiator);
 }
 
 static void handle_reg_beacon(struct wiphy *wiphy,
@@ -1614,7 +1610,7 @@ static void reg_process_pending_hints(void)
 /* Processes beacon hints -- this has nothing to do with country IEs */
 static void reg_process_pending_beacon_hints(void)
 {
-        struct cfg80211_registered_device *drv;
+        struct cfg80211_registered_device *rdev;
         struct reg_beacon *pending_beacon, *tmp;
 
         mutex_lock(&cfg80211_mutex);
@@ -1633,8 +1629,8 @@ static void reg_process_pending_beacon_hints(void)
                 list_del_init(&pending_beacon->list);
 
                 /* Applies the beacon hint to current wiphys */
-                list_for_each_entry(drv, &cfg80211_drv_list, list)
-                        wiphy_update_new_beacon(&drv->wiphy, pending_beacon);
+                list_for_each_entry(rdev, &cfg80211_rdev_list, list)
+                        wiphy_update_new_beacon(&rdev->wiphy, pending_beacon);
 
                 /* Remembers the beacon hint for new wiphys or reg changes */
                 list_add_tail(&pending_beacon->list, &reg_beacon_list);
@@ -1814,23 +1810,23 @@ void regulatory_hint_11d(struct wiphy *wiphy,
         if (likely(last_request->initiator ==
             NL80211_REGDOM_SET_BY_COUNTRY_IE &&
             wiphy_idx_valid(last_request->wiphy_idx))) {
-                struct cfg80211_registered_device *drv_last_ie;
+                struct cfg80211_registered_device *rdev_last_ie;
 
-                drv_last_ie =
-                        cfg80211_drv_by_wiphy_idx(last_request->wiphy_idx);
+                rdev_last_ie =
+                        cfg80211_rdev_by_wiphy_idx(last_request->wiphy_idx);
 
                 /*
                  * Lets keep this simple -- we trust the first AP
                  * after we intersect with CRDA
                  */
-                if (likely(&drv_last_ie->wiphy == wiphy)) {
+                if (likely(&rdev_last_ie->wiphy == wiphy)) {
                         /*
                          * Ignore IEs coming in on this wiphy with
                          * the same alpha2 and environment cap
                          */
-                        if (likely(alpha2_equal(drv_last_ie->country_ie_alpha2,
+                        if (likely(alpha2_equal(rdev_last_ie->country_ie_alpha2,
                                   alpha2) &&
-                                  env == drv_last_ie->env)) {
+                                  env == rdev_last_ie->env)) {
                                 goto out;
                         }
                         /*
@@ -1846,9 +1842,9 @@ void regulatory_hint_11d(struct wiphy *wiphy,
                          * Ignore IEs coming in on two separate wiphys with
                          * the same alpha2 and environment cap
                          */
-                        if (likely(alpha2_equal(drv_last_ie->country_ie_alpha2,
+                        if (likely(alpha2_equal(rdev_last_ie->country_ie_alpha2,
                                   alpha2) &&
-                                  env == drv_last_ie->env)) {
+                                  env == rdev_last_ie->env)) {
                                 goto out;
                         }
                         /* We could potentially intersect though */
@@ -1995,14 +1991,14 @@ static void print_regdomain(const struct ieee80211_regdomain *rd)
 
                 if (last_request->initiator ==
                     NL80211_REGDOM_SET_BY_COUNTRY_IE) {
-                        struct cfg80211_registered_device *drv;
-                        drv = cfg80211_drv_by_wiphy_idx(
+                        struct cfg80211_registered_device *rdev;
+                        rdev = cfg80211_rdev_by_wiphy_idx(
                                 last_request->wiphy_idx);
-                        if (drv) {
+                        if (rdev) {
                                 printk(KERN_INFO "cfg80211: Current regulatory "
                                         "domain updated by AP to: %c%c\n",
-                                        drv->country_ie_alpha2[0],
-                                        drv->country_ie_alpha2[1]);
+                                        rdev->country_ie_alpha2[0],
+                                        rdev->country_ie_alpha2[1]);
                         } else
                                 printk(KERN_INFO "cfg80211: Current regulatory "
                                         "domain intersected: \n");
@@ -2063,7 +2059,7 @@ static inline void reg_country_ie_process_debug(
 static int __set_regdom(const struct ieee80211_regdomain *rd)
 {
         const struct ieee80211_regdomain *intersected_rd = NULL;
-        struct cfg80211_registered_device *drv = NULL;
+        struct cfg80211_registered_device *rdev = NULL;
         struct wiphy *request_wiphy;
         /* Some basic sanity checks first */
 
@@ -2202,11 +2198,11 @@ static int __set_regdom(const struct ieee80211_regdomain *rd)
         if (!intersected_rd)
                 return -EINVAL;
 
-        drv = wiphy_to_dev(request_wiphy);
+        rdev = wiphy_to_dev(request_wiphy);
 
-        drv->country_ie_alpha2[0] = rd->alpha2[0];
-        drv->country_ie_alpha2[1] = rd->alpha2[1];
-        drv->env = last_request->country_ie_env;
+        rdev->country_ie_alpha2[0] = rd->alpha2[0];
+        rdev->country_ie_alpha2[1] = rd->alpha2[1];
+        rdev->env = last_request->country_ie_env;
 
         BUG_ON(intersected_rd == rd);
 
@@ -2287,22 +2283,12 @@ int regulatory_init(void)
 
         printk(KERN_INFO "cfg80211: Using static regulatory domain info\n");
         print_regdomain_info(cfg80211_regdomain);
-        /*
-         * The old code still requests for a new regdomain and if
-         * you have CRDA you get it updated, otherwise you get
-         * stuck with the static values. Since "EU" is not a valid
-         * ISO / IEC 3166 alpha2 code we can't expect userpace to
-         * give us a regulatory domain for it. We need last_request
-         * iniitalized though so lets just send a request which we
-         * know will be ignored... this crap will be removed once
-         * OLD_REG dies.
-         */
-        err = regulatory_hint_core(ieee80211_regdom);
 #else
         cfg80211_regdomain = cfg80211_world_regdom;
 
-        err = regulatory_hint_core(ieee80211_regdom);
 #endif
+        /* We always try to get an update for the static regdomain */
+        err = regulatory_hint_core(cfg80211_regdomain->alpha2);
         if (err) {
                 if (err == -ENOMEM)
                         return err;
@@ -2321,6 +2307,13 @@ int regulatory_init(void)
 #endif
         }
 
+        /*
+         * Finally, if the user set the module parameter treat it
+         * as a user hint.
+         */
+        if (!is_world_regdom(ieee80211_regdom))
+                regulatory_hint_user(ieee80211_regdom);
+
         return 0;
 }
 
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index 9271118e1fc4..decc59fe0ee8 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -17,26 +17,39 @@
 
 #define IEEE80211_SCAN_RESULT_EXPIRE    (10 * HZ)
 
-void cfg80211_scan_done(struct cfg80211_scan_request *request, bool aborted)
+void __cfg80211_scan_done(struct work_struct *wk)
 {
+        struct cfg80211_registered_device *rdev;
+        struct cfg80211_scan_request *request;
         struct net_device *dev;
 #ifdef CONFIG_WIRELESS_EXT
         union iwreq_data wrqu;
 #endif
 
+        rdev = container_of(wk, struct cfg80211_registered_device,
+                            scan_done_wk);
+
+        mutex_lock(&rdev->mtx);
+        request = rdev->scan_req;
+
         dev = dev_get_by_index(&init_net, request->ifidx);
         if (!dev)
                 goto out;
 
-        WARN_ON(request != wiphy_to_dev(request->wiphy)->scan_req);
+        /*
+         * This must be before sending the other events!
+         * Otherwise, wpa_supplicant gets completely confused with
+         * wext events.
+         */
+        cfg80211_sme_scan_done(dev);
 
-        if (aborted)
+        if (request->aborted)
                 nl80211_send_scan_aborted(wiphy_to_dev(request->wiphy), dev);
         else
                 nl80211_send_scan_done(wiphy_to_dev(request->wiphy), dev);
 
 #ifdef CONFIG_WIRELESS_EXT
-        if (!aborted) {
+        if (!request->aborted) {
                 memset(&wrqu, 0, sizeof(wrqu));
 
                 wireless_send_event(dev, SIOCGIWSCAN, &wrqu, NULL);
@@ -46,9 +59,25 @@ void cfg80211_scan_done(struct cfg80211_scan_request *request, bool aborted)
         dev_put(dev);
 
  out:
+        cfg80211_unlock_rdev(rdev);
         wiphy_to_dev(request->wiphy)->scan_req = NULL;
         kfree(request);
 }
+
+void cfg80211_scan_done(struct cfg80211_scan_request *request, bool aborted)
+{
+        struct net_device *dev = dev_get_by_index(&init_net, request->ifidx);
+        if (WARN_ON(!dev)) {
+                kfree(request);
+                return;
+        }
+
+        WARN_ON(request != wiphy_to_dev(request->wiphy)->scan_req);
+
+        request->aborted = aborted;
+        schedule_work(&wiphy_to_dev(request->wiphy)->scan_done_wk);
+        dev_put(dev);
+}
 EXPORT_SYMBOL(cfg80211_scan_done);
 
 static void bss_release(struct kref *ref)
@@ -62,6 +91,8 @@ static void bss_release(struct kref *ref)
         if (bss->ies_allocated)
                 kfree(bss->pub.information_elements);
 
+        BUG_ON(atomic_read(&bss->hold));
+
         kfree(bss);
 }
 
@@ -84,8 +115,9 @@ void cfg80211_bss_expire(struct cfg80211_registered_device *dev)
         bool expired = false;
 
         list_for_each_entry_safe(bss, tmp, &dev->bss_list, list) {
-                if (bss->hold ||
-                    !time_after(jiffies, bss->ts + IEEE80211_SCAN_RESULT_EXPIRE))
+                if (atomic_read(&bss->hold))
+                        continue;
+                if (!time_after(jiffies, bss->ts + IEEE80211_SCAN_RESULT_EXPIRE))
                         continue;
                 list_del(&bss->list);
                 rb_erase(&bss->rbn, &dev->bss_tree);
@@ -545,30 +577,6 @@ void cfg80211_unlink_bss(struct wiphy *wiphy, struct cfg80211_bss *pub)
 }
 EXPORT_SYMBOL(cfg80211_unlink_bss);
 
-void cfg80211_hold_bss(struct cfg80211_bss *pub)
-{
-        struct cfg80211_internal_bss *bss;
-
-        if (!pub)
-                return;
-
-        bss = container_of(pub, struct cfg80211_internal_bss, pub);
-        bss->hold = true;
-}
-EXPORT_SYMBOL(cfg80211_hold_bss);
-
-void cfg80211_unhold_bss(struct cfg80211_bss *pub)
-{
-        struct cfg80211_internal_bss *bss;
-
-        if (!pub)
-                return;
-
-        bss = container_of(pub, struct cfg80211_internal_bss, pub);
-        bss->hold = false;
-}
-EXPORT_SYMBOL(cfg80211_unhold_bss);
-
 #ifdef CONFIG_WIRELESS_EXT
 int cfg80211_wext_siwscan(struct net_device *dev,
                           struct iw_request_info *info,
@@ -646,9 +654,10 @@ int cfg80211_wext_siwscan(struct net_device *dev,
         if (err) {
                 rdev->scan_req = NULL;
                 kfree(creq);
-        }
+        } else
+                nl80211_send_scan_start(rdev, dev);
  out:
-        cfg80211_put_dev(rdev);
+        cfg80211_unlock_rdev(rdev);
         return err;
 }
 EXPORT_SYMBOL_GPL(cfg80211_wext_siwscan);
@@ -957,7 +966,7 @@ int cfg80211_wext_giwscan(struct net_device *dev,
         }
 
  out:
-        cfg80211_put_dev(rdev);
+        cfg80211_unlock_rdev(rdev);
         return res;
 }
 EXPORT_SYMBOL_GPL(cfg80211_wext_giwscan);
diff --git a/net/wireless/sme.c b/net/wireless/sme.c
new file mode 100644
index 000000000000..82de2d9795f4
--- /dev/null
+++ b/net/wireless/sme.c
@@ -0,0 +1,836 @@
+/*
+ * SME code for cfg80211's connect emulation.
+ *
+ * Copyright 2009       Johannes Berg <johannes@sipsolutions.net>
+ * Copyright (C) 2009   Intel Corporation. All rights reserved.
+ */
+
+#include <linux/etherdevice.h>
+#include <linux/if_arp.h>
+#include <linux/workqueue.h>
+#include <net/cfg80211.h>
+#include <net/rtnetlink.h>
+#include "nl80211.h"
+
+struct cfg80211_conn {
+        struct cfg80211_connect_params params;
+        /* these are sub-states of the _CONNECTING sme_state */
+        enum {
+                CFG80211_CONN_IDLE,
+                CFG80211_CONN_SCANNING,
+                CFG80211_CONN_SCAN_AGAIN,
+                CFG80211_CONN_AUTHENTICATE_NEXT,
+                CFG80211_CONN_AUTHENTICATING,
+                CFG80211_CONN_ASSOCIATE_NEXT,
+                CFG80211_CONN_ASSOCIATING,
+        } state;
+        u8 bssid[ETH_ALEN];
+        u8 *ie;
+        size_t ie_len;
+        bool auto_auth;
+};
+
+
+static int cfg80211_conn_scan(struct wireless_dev *wdev)
+{
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct cfg80211_scan_request *request;
+        int n_channels, err;
+
+        ASSERT_RTNL();
+        ASSERT_RDEV_LOCK(rdev);
+        ASSERT_WDEV_LOCK(wdev);
+
+        if (rdev->scan_req)
+                return -EBUSY;
+
+        if (wdev->conn->params.channel) {
+                n_channels = 1;
+        } else {
+                enum ieee80211_band band;
+                n_channels = 0;
+
+                for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
+                        if (!wdev->wiphy->bands[band])
+                                continue;
+                        n_channels += wdev->wiphy->bands[band]->n_channels;
+                }
+        }
+        request = kzalloc(sizeof(*request) + sizeof(request->ssids[0]) +
+                          sizeof(request->channels[0]) * n_channels,
+                          GFP_KERNEL);
+        if (!request)
+                return -ENOMEM;
+
+        request->channels = (void *)((char *)request + sizeof(*request));
+        if (wdev->conn->params.channel)
+                request->channels[0] = wdev->conn->params.channel;
+        else {
+                int i = 0, j;
+                enum ieee80211_band band;
+
+                for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
+                        if (!wdev->wiphy->bands[band])
+                                continue;
+                        for (j = 0; j < wdev->wiphy->bands[band]->n_channels;
+                             i++, j++)
+                                request->channels[i] =
+                                        &wdev->wiphy->bands[band]->channels[j];
+                }
+        }
+        request->n_channels = n_channels;
+        request->ssids = (void *)(request->channels + n_channels);
+        request->n_ssids = 1;
+
+        memcpy(request->ssids[0].ssid, wdev->conn->params.ssid,
+                wdev->conn->params.ssid_len);
+        request->ssids[0].ssid_len = wdev->conn->params.ssid_len;
+
+        request->ifidx = wdev->netdev->ifindex;
+        request->wiphy = &rdev->wiphy;
+
+        rdev->scan_req = request;
+
+        err = rdev->ops->scan(wdev->wiphy, wdev->netdev, request);
+        if (!err) {
+                wdev->conn->state = CFG80211_CONN_SCANNING;
+                nl80211_send_scan_start(rdev, wdev->netdev);
+        } else {
+                rdev->scan_req = NULL;
+                kfree(request);
+        }
+        return err;
+}
+
+static int cfg80211_conn_do_work(struct wireless_dev *wdev)
+{
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct cfg80211_connect_params *params;
+        int err;
+
+        ASSERT_WDEV_LOCK(wdev);
+
+        if (!wdev->conn)
+                return 0;
+
+        params = &wdev->conn->params;
+
+        switch (wdev->conn->state) {
+        case CFG80211_CONN_SCAN_AGAIN:
+                return cfg80211_conn_scan(wdev);
+        case CFG80211_CONN_AUTHENTICATE_NEXT:
+                BUG_ON(!rdev->ops->auth);
+                wdev->conn->state = CFG80211_CONN_AUTHENTICATING;
+                return __cfg80211_mlme_auth(rdev, wdev->netdev,
+                                            params->channel, params->auth_type,
+                                            params->bssid,
+                                            params->ssid, params->ssid_len,
+                                            NULL, 0,
+                                            params->key, params->key_len,
+                                            params->key_idx);
+        case CFG80211_CONN_ASSOCIATE_NEXT:
+                BUG_ON(!rdev->ops->assoc);
+                wdev->conn->state = CFG80211_CONN_ASSOCIATING;
+                /*
+                 * We could, later, implement roaming here and then actually
+                 * set prev_bssid to non-NULL. But then we need to be aware
+                 * that some APs don't like that -- so we'd need to retry
+                 * the association.
+                 */
+                err = __cfg80211_mlme_assoc(rdev, wdev->netdev,
+                                            params->channel, params->bssid,
+                                            NULL,
+                                            params->ssid, params->ssid_len,
+                                            params->ie, params->ie_len,
+                                            false, &params->crypto);
+                if (err)
+                        __cfg80211_mlme_deauth(rdev, wdev->netdev, params->bssid,
+                                               NULL, 0,
+                                               WLAN_REASON_DEAUTH_LEAVING);
+                return err;
+        default:
+                return 0;
+        }
+}
+
+void cfg80211_conn_work(struct work_struct *work)
+{
+        struct cfg80211_registered_device *rdev =
+                container_of(work, struct cfg80211_registered_device, conn_work);
+        struct wireless_dev *wdev;
+
+        rtnl_lock();
+        cfg80211_lock_rdev(rdev);
+        mutex_lock(&rdev->devlist_mtx);
+
+        list_for_each_entry(wdev, &rdev->netdev_list, list) {
+                wdev_lock(wdev);
+                if (!netif_running(wdev->netdev)) {
+                        wdev_unlock(wdev);
+                        continue;
+                }
+                if (wdev->sme_state != CFG80211_SME_CONNECTING) {
+                        wdev_unlock(wdev);
+                        continue;
+                }
+                if (cfg80211_conn_do_work(wdev))
+                        __cfg80211_connect_result(
+                                        wdev->netdev,
+                                        wdev->conn->params.bssid,
+                                        NULL, 0, NULL, 0,
+                                        WLAN_STATUS_UNSPECIFIED_FAILURE,
+                                        false);
+                wdev_unlock(wdev);
+        }
+
+        mutex_unlock(&rdev->devlist_mtx);
+        cfg80211_unlock_rdev(rdev);
+        rtnl_unlock();
+}
+
+static bool cfg80211_get_conn_bss(struct wireless_dev *wdev)
+{
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct cfg80211_bss *bss;
+        u16 capa = WLAN_CAPABILITY_ESS;
+
+        ASSERT_WDEV_LOCK(wdev);
+
+        if (wdev->conn->params.privacy)
+                capa |= WLAN_CAPABILITY_PRIVACY;
+
+        bss = cfg80211_get_bss(wdev->wiphy, NULL, wdev->conn->params.bssid,
+                               wdev->conn->params.ssid,
+                               wdev->conn->params.ssid_len,
+                               WLAN_CAPABILITY_ESS | WLAN_CAPABILITY_PRIVACY,
+                               capa);
+        if (!bss)
+                return false;
+
+        memcpy(wdev->conn->bssid, bss->bssid, ETH_ALEN);
+        wdev->conn->params.bssid = wdev->conn->bssid;
+        wdev->conn->params.channel = bss->channel;
+        wdev->conn->state = CFG80211_CONN_AUTHENTICATE_NEXT;
+        schedule_work(&rdev->conn_work);
+
+        cfg80211_put_bss(bss);
+        return true;
+}
+
+static void __cfg80211_sme_scan_done(struct net_device *dev)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+
+        ASSERT_WDEV_LOCK(wdev);
+
+        if (wdev->sme_state != CFG80211_SME_CONNECTING)
+                return;
+
+        if (!wdev->conn)
+                return;
+
+        if (wdev->conn->state != CFG80211_CONN_SCANNING &&
+            wdev->conn->state != CFG80211_CONN_SCAN_AGAIN)
+                return;
+
+        if (!cfg80211_get_conn_bss(wdev)) {
+                /* not found */
+                if (wdev->conn->state == CFG80211_CONN_SCAN_AGAIN)
+                        schedule_work(&rdev->conn_work);
+                else
+                        __cfg80211_connect_result(
+                                        wdev->netdev,
+                                        wdev->conn->params.bssid,
+                                        NULL, 0, NULL, 0,
+                                        WLAN_STATUS_UNSPECIFIED_FAILURE,
+                                        false);
+        }
+}
+
+void cfg80211_sme_scan_done(struct net_device *dev)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+
+        wdev_lock(wdev);
+        __cfg80211_sme_scan_done(dev);
+        wdev_unlock(wdev);
+}
+
+void cfg80211_sme_rx_auth(struct net_device *dev,
+                          const u8 *buf, size_t len)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct wiphy *wiphy = wdev->wiphy;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+        struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
+        u16 status_code = le16_to_cpu(mgmt->u.auth.status_code);
+
+        ASSERT_WDEV_LOCK(wdev);
+
+        /* should only RX auth frames when connecting */
+        if (wdev->sme_state != CFG80211_SME_CONNECTING)
+                return;
+
+        if (WARN_ON(!wdev->conn))
+                return;
+
+        if (status_code == WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG &&
+            wdev->conn->auto_auth &&
+            wdev->conn->params.auth_type != NL80211_AUTHTYPE_NETWORK_EAP) {
+                /* select automatically between only open, shared, leap */
+                switch (wdev->conn->params.auth_type) {
+                case NL80211_AUTHTYPE_OPEN_SYSTEM:
+                        if (wdev->connect_keys)
+                                wdev->conn->params.auth_type =
+                                        NL80211_AUTHTYPE_SHARED_KEY;
+                        else
+                                wdev->conn->params.auth_type =
+                                        NL80211_AUTHTYPE_NETWORK_EAP;
+                        break;
+                case NL80211_AUTHTYPE_SHARED_KEY:
+                        wdev->conn->params.auth_type =
+                                NL80211_AUTHTYPE_NETWORK_EAP;
+                        break;
+                default:
+                        /* huh? */
+                        wdev->conn->params.auth_type =
+                                NL80211_AUTHTYPE_OPEN_SYSTEM;
+                        break;
+                }
+                wdev->conn->state = CFG80211_CONN_AUTHENTICATE_NEXT;
+                schedule_work(&rdev->conn_work);
+        } else if (status_code != WLAN_STATUS_SUCCESS) {
+                __cfg80211_connect_result(dev, mgmt->bssid, NULL, 0, NULL, 0,
+                                          status_code, false);
+        } else if (wdev->sme_state == CFG80211_SME_CONNECTING &&
+                 wdev->conn->state == CFG80211_CONN_AUTHENTICATING) {
+                wdev->conn->state = CFG80211_CONN_ASSOCIATE_NEXT;
+                schedule_work(&rdev->conn_work);
+        }
+}
+
+void __cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
+                               const u8 *req_ie, size_t req_ie_len,
+                               const u8 *resp_ie, size_t resp_ie_len,
+                               u16 status, bool wextev)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_bss *bss;
+#ifdef CONFIG_WIRELESS_EXT
+        union iwreq_data wrqu;
+#endif
+
+        ASSERT_WDEV_LOCK(wdev);
+
+        if (WARN_ON(wdev->iftype != NL80211_IFTYPE_STATION))
+                return;
+
+        if (wdev->sme_state == CFG80211_SME_CONNECTED)
+                nl80211_send_roamed(wiphy_to_dev(wdev->wiphy), dev,
+                                    bssid, req_ie, req_ie_len,
+                                    resp_ie, resp_ie_len, GFP_KERNEL);
+        else
+                nl80211_send_connect_result(wiphy_to_dev(wdev->wiphy), dev,
+                                            bssid, req_ie, req_ie_len,
+                                            resp_ie, resp_ie_len,
+                                            status, GFP_KERNEL);
+
+#ifdef CONFIG_WIRELESS_EXT
+        if (wextev) {
+                if (req_ie && status == WLAN_STATUS_SUCCESS) {
+                        memset(&wrqu, 0, sizeof(wrqu));
+                        wrqu.data.length = req_ie_len;
+                        wireless_send_event(dev, IWEVASSOCREQIE, &wrqu, req_ie);
+                }
+
+                if (resp_ie && status == WLAN_STATUS_SUCCESS) {
+                        memset(&wrqu, 0, sizeof(wrqu));
+                        wrqu.data.length = resp_ie_len;
+                        wireless_send_event(dev, IWEVASSOCRESPIE, &wrqu, resp_ie);
+                }
+
+                memset(&wrqu, 0, sizeof(wrqu));
+                wrqu.ap_addr.sa_family = ARPHRD_ETHER;
+                if (bssid && status == WLAN_STATUS_SUCCESS)
+                        memcpy(wrqu.ap_addr.sa_data, bssid, ETH_ALEN);
+                wireless_send_event(dev, SIOCGIWAP, &wrqu, NULL);
+        }
+#endif
+
+        if (status == WLAN_STATUS_SUCCESS &&
+            wdev->sme_state == CFG80211_SME_IDLE)
+                goto success;
+
+        if (wdev->sme_state != CFG80211_SME_CONNECTING)
+                return;
+
+        if (wdev->current_bss) {
+                cfg80211_unhold_bss(wdev->current_bss);
+                cfg80211_put_bss(&wdev->current_bss->pub);
+                wdev->current_bss = NULL;
+        }
+
+        if (wdev->conn)
+                wdev->conn->state = CFG80211_CONN_IDLE;
+
+        if (status != WLAN_STATUS_SUCCESS) {
+                wdev->sme_state = CFG80211_SME_IDLE;
+                kfree(wdev->conn);
+                wdev->conn = NULL;
+                kfree(wdev->connect_keys);
+                wdev->connect_keys = NULL;
+                return;
+        }
+
+        bss = cfg80211_get_bss(wdev->wiphy, NULL, bssid,
+                               wdev->ssid, wdev->ssid_len,
+                               WLAN_CAPABILITY_ESS,
+                               WLAN_CAPABILITY_ESS);
+
+        if (WARN_ON(!bss))
+                return;
+
+        cfg80211_hold_bss(bss_from_pub(bss));
+        wdev->current_bss = bss_from_pub(bss);
+
+ success:
+        wdev->sme_state = CFG80211_SME_CONNECTED;
+        cfg80211_upload_connect_keys(wdev);
+}
+
+void cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
+                             const u8 *req_ie, size_t req_ie_len,
+                             const u8 *resp_ie, size_t resp_ie_len,
+                             u16 status, gfp_t gfp)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct cfg80211_event *ev;
+        unsigned long flags;
+
+        ev = kzalloc(sizeof(*ev) + req_ie_len + resp_ie_len, gfp);
+        if (!ev)
+                return;
+
+        ev->type = EVENT_CONNECT_RESULT;
+        memcpy(ev->cr.bssid, bssid, ETH_ALEN);
+        ev->cr.req_ie = ((u8 *)ev) + sizeof(*ev);
+        ev->cr.req_ie_len = req_ie_len;
+        memcpy((void *)ev->cr.req_ie, req_ie, req_ie_len);
+        ev->cr.resp_ie = ((u8 *)ev) + sizeof(*ev) + req_ie_len;
+        ev->cr.resp_ie_len = resp_ie_len;
+        memcpy((void *)ev->cr.resp_ie, resp_ie, resp_ie_len);
+        ev->cr.status = status;
+
+        spin_lock_irqsave(&wdev->event_lock, flags);
+        list_add_tail(&ev->list, &wdev->event_list);
+        spin_unlock_irqrestore(&wdev->event_lock, flags);
+        schedule_work(&rdev->event_work);
+}
+EXPORT_SYMBOL(cfg80211_connect_result);
+
+void __cfg80211_roamed(struct wireless_dev *wdev, const u8 *bssid,
+                       const u8 *req_ie, size_t req_ie_len,
+                       const u8 *resp_ie, size_t resp_ie_len)
+{
+        struct cfg80211_bss *bss;
+#ifdef CONFIG_WIRELESS_EXT
+        union iwreq_data wrqu;
+#endif
+
+        ASSERT_WDEV_LOCK(wdev);
+
+        if (WARN_ON(wdev->iftype != NL80211_IFTYPE_STATION))
+                return;
+
+        if (WARN_ON(wdev->sme_state != CFG80211_SME_CONNECTED))
+                return;
+
+        /* internal error -- how did we get to CONNECTED w/o BSS? */
+        if (WARN_ON(!wdev->current_bss)) {
+                return;
+        }
+
+        cfg80211_unhold_bss(wdev->current_bss);
+        cfg80211_put_bss(&wdev->current_bss->pub);
+        wdev->current_bss = NULL;
+
+        bss = cfg80211_get_bss(wdev->wiphy, NULL, bssid,
+                               wdev->ssid, wdev->ssid_len,
+                               WLAN_CAPABILITY_ESS, WLAN_CAPABILITY_ESS);
+
+        if (WARN_ON(!bss))
+                return;
+
+        cfg80211_hold_bss(bss_from_pub(bss));
+        wdev->current_bss = bss_from_pub(bss);
+
+        nl80211_send_roamed(wiphy_to_dev(wdev->wiphy), wdev->netdev, bssid,
+                            req_ie, req_ie_len, resp_ie, resp_ie_len,
+                            GFP_KERNEL);
+
+#ifdef CONFIG_WIRELESS_EXT
+        if (req_ie) {
+                memset(&wrqu, 0, sizeof(wrqu));
+                wrqu.data.length = req_ie_len;
+                wireless_send_event(wdev->netdev, IWEVASSOCREQIE,
+                                    &wrqu, req_ie);
+        }
+
+        if (resp_ie) {
+                memset(&wrqu, 0, sizeof(wrqu));
+                wrqu.data.length = resp_ie_len;
+                wireless_send_event(wdev->netdev, IWEVASSOCRESPIE,
+                                    &wrqu, resp_ie);
+        }
+
+        memset(&wrqu, 0, sizeof(wrqu));
+        wrqu.ap_addr.sa_family = ARPHRD_ETHER;
+        memcpy(wrqu.ap_addr.sa_data, bssid, ETH_ALEN);
+        wireless_send_event(wdev->netdev, SIOCGIWAP, &wrqu, NULL);
+#endif
+}
+
+void cfg80211_roamed(struct net_device *dev, const u8 *bssid,
+                     const u8 *req_ie, size_t req_ie_len,
+                     const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct cfg80211_event *ev;
+        unsigned long flags;
+
+        ev = kzalloc(sizeof(*ev) + req_ie_len + resp_ie_len, gfp);
+        if (!ev)
+                return;
+
+        ev->type = EVENT_ROAMED;
+        memcpy(ev->rm.bssid, bssid, ETH_ALEN);
+        ev->rm.req_ie = ((u8 *)ev) + sizeof(*ev);
+        ev->rm.req_ie_len = req_ie_len;
+        memcpy((void *)ev->rm.req_ie, req_ie, req_ie_len);
+        ev->rm.resp_ie = ((u8 *)ev) + sizeof(*ev) + req_ie_len;
+        ev->rm.resp_ie_len = resp_ie_len;
+        memcpy((void *)ev->rm.resp_ie, resp_ie, resp_ie_len);
+
+        spin_lock_irqsave(&wdev->event_lock, flags);
+        list_add_tail(&ev->list, &wdev->event_list);
+        spin_unlock_irqrestore(&wdev->event_lock, flags);
+        schedule_work(&rdev->event_work);
+}
+EXPORT_SYMBOL(cfg80211_roamed);
+
+void __cfg80211_disconnected(struct net_device *dev, const u8 *ie,
+                             size_t ie_len, u16 reason, bool from_ap)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        int i;
+#ifdef CONFIG_WIRELESS_EXT
+        union iwreq_data wrqu;
+#endif
+
+        ASSERT_WDEV_LOCK(wdev);
+
+        if (WARN_ON(wdev->iftype != NL80211_IFTYPE_STATION))
+                return;
+
+        if (WARN_ON(wdev->sme_state != CFG80211_SME_CONNECTED))
+                return;
+
+        if (wdev->current_bss) {
+                cfg80211_unhold_bss(wdev->current_bss);
+                cfg80211_put_bss(&wdev->current_bss->pub);
+        }
+
+        wdev->current_bss = NULL;
+        wdev->sme_state = CFG80211_SME_IDLE;
+
+        if (wdev->conn) {
+                kfree(wdev->conn->ie);
+                wdev->conn->ie = NULL;
+                kfree(wdev->conn);
+                wdev->conn = NULL;
+        }
+
+        nl80211_send_disconnected(rdev, dev, reason, ie, ie_len, from_ap);
+
+        /*
+         * Delete all the keys ... pairwise keys can't really
+         * exist any more anyway, but default keys might.
+         */
+        if (rdev->ops->del_key)
+                for (i = 0; i < 6; i++)
+                        rdev->ops->del_key(wdev->wiphy, dev, i, NULL);
+
+#ifdef CONFIG_WIRELESS_EXT
+        memset(&wrqu, 0, sizeof(wrqu));
+        wrqu.ap_addr.sa_family = ARPHRD_ETHER;
+        wireless_send_event(dev, SIOCGIWAP, &wrqu, NULL);
+#endif
+}
+
+void cfg80211_disconnected(struct net_device *dev, u16 reason,
+                           u8 *ie, size_t ie_len, gfp_t gfp)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct cfg80211_event *ev;
+        unsigned long flags;
+
+        ev = kzalloc(sizeof(*ev) + ie_len, gfp);
+        if (!ev)
+                return;
+
+        ev->type = EVENT_DISCONNECTED;
+        ev->dc.ie = ((u8 *)ev) + sizeof(*ev);
+        ev->dc.ie_len = ie_len;
+        memcpy((void *)ev->dc.ie, ie, ie_len);
+        ev->dc.reason = reason;
+
+        spin_lock_irqsave(&wdev->event_lock, flags);
+        list_add_tail(&ev->list, &wdev->event_list);
+        spin_unlock_irqrestore(&wdev->event_lock, flags);
+        schedule_work(&rdev->event_work);
+}
+EXPORT_SYMBOL(cfg80211_disconnected);
+
+int __cfg80211_connect(struct cfg80211_registered_device *rdev,
+                       struct net_device *dev,
+                       struct cfg80211_connect_params *connect,
+                       struct cfg80211_cached_keys *connkeys)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        int err;
+
+        ASSERT_WDEV_LOCK(wdev);
+
+        if (wdev->sme_state != CFG80211_SME_IDLE)
+                return -EALREADY;
+
+        if (WARN_ON(wdev->connect_keys)) {
+                kfree(wdev->connect_keys);
+                wdev->connect_keys = NULL;
+        }
+
+        if (connkeys && connkeys->def >= 0) {
+                int idx;
+
+                idx = connkeys->def;
+                /* If given a WEP key we may need it for shared key auth */
+                if (connkeys->params[idx].cipher == WLAN_CIPHER_SUITE_WEP40 ||
+                    connkeys->params[idx].cipher == WLAN_CIPHER_SUITE_WEP104) {
+                        connect->key_idx = idx;
+                        connect->key = connkeys->params[idx].key;
+                        connect->key_len = connkeys->params[idx].key_len;
+                }
+        }
+
+        if (!rdev->ops->connect) {
+                if (!rdev->ops->auth || !rdev->ops->assoc)
+                        return -EOPNOTSUPP;
+
+                if (WARN_ON(wdev->conn))
+                        return -EINPROGRESS;
+
+                wdev->conn = kzalloc(sizeof(*wdev->conn), GFP_KERNEL);
+                if (!wdev->conn)
+                        return -ENOMEM;
+
+                /*
+                 * Copy all parameters, and treat explicitly IEs, BSSID, SSID.
+                 */
+                memcpy(&wdev->conn->params, connect, sizeof(*connect));
+                if (connect->bssid) {
+                        wdev->conn->params.bssid = wdev->conn->bssid;
+                        memcpy(wdev->conn->bssid, connect->bssid, ETH_ALEN);
+                }
+
+                if (connect->ie) {
+                        wdev->conn->ie = kmemdup(connect->ie, connect->ie_len,
+                                                GFP_KERNEL);
+                        wdev->conn->params.ie = wdev->conn->ie;
+                        if (!wdev->conn->ie) {
+                                kfree(wdev->conn);
+                                wdev->conn = NULL;
+                                return -ENOMEM;
+                        }
+                }
+
+                if (connect->auth_type == NL80211_AUTHTYPE_AUTOMATIC) {
+                        wdev->conn->auto_auth = true;
+                        /* start with open system ... should mostly work */
+                        wdev->conn->params.auth_type =
+                                NL80211_AUTHTYPE_OPEN_SYSTEM;
+                } else {
+                        wdev->conn->auto_auth = false;
+                }
+
+                memcpy(wdev->ssid, connect->ssid, connect->ssid_len);
+                wdev->ssid_len = connect->ssid_len;
+                wdev->conn->params.ssid = wdev->ssid;
+                wdev->conn->params.ssid_len = connect->ssid_len;
+
+                /* don't care about result -- but fill bssid & channel */
+                if (!wdev->conn->params.bssid || !wdev->conn->params.channel)
+                        cfg80211_get_conn_bss(wdev);
+
+                wdev->sme_state = CFG80211_SME_CONNECTING;
+                wdev->connect_keys = connkeys;
+
+                /* we're good if we have both BSSID and channel */
+                if (wdev->conn->params.bssid && wdev->conn->params.channel) {
+                        wdev->conn->state = CFG80211_CONN_AUTHENTICATE_NEXT;
+                        err = cfg80211_conn_do_work(wdev);
+                } else {
+                        /* otherwise we'll need to scan for the AP first */
+                        err = cfg80211_conn_scan(wdev);
+                        /*
+                         * If we can't scan right now, then we need to scan again
+                         * after the current scan finished, since the parameters
+                         * changed (unless we find a good AP anyway).
+                         */
+                        if (err == -EBUSY) {
+                                err = 0;
+                                wdev->conn->state = CFG80211_CONN_SCAN_AGAIN;
+                        }
+                }
+                if (err) {
+                        kfree(wdev->conn);
+                        wdev->conn = NULL;
+                        wdev->sme_state = CFG80211_SME_IDLE;
+                        wdev->connect_keys = NULL;
+                }
+
+                return err;
+        } else {
+                wdev->sme_state = CFG80211_SME_CONNECTING;
+                wdev->connect_keys = connkeys;
+                err = rdev->ops->connect(&rdev->wiphy, dev, connect);
+                if (err) {
+                        wdev->connect_keys = NULL;
+                        wdev->sme_state = CFG80211_SME_IDLE;
+                        return err;
+                }
+
+                memcpy(wdev->ssid, connect->ssid, connect->ssid_len);
+                wdev->ssid_len = connect->ssid_len;
+
+                return 0;
+        }
+}
+
+int cfg80211_connect(struct cfg80211_registered_device *rdev,
+                     struct net_device *dev,
+                     struct cfg80211_connect_params *connect,
+                     struct cfg80211_cached_keys *connkeys)
+{
+        int err;
+
+        wdev_lock(dev->ieee80211_ptr);
+        err = __cfg80211_connect(rdev, dev, connect, connkeys);
+        wdev_unlock(dev->ieee80211_ptr);
+
+        return err;
+}
+
+int __cfg80211_disconnect(struct cfg80211_registered_device *rdev,
+                          struct net_device *dev, u16 reason, bool wextev)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        int err;
+
+        ASSERT_WDEV_LOCK(wdev);
+
+        if (wdev->sme_state == CFG80211_SME_IDLE)
+                return -EINVAL;
+
+        kfree(wdev->connect_keys);
+        wdev->connect_keys = NULL;
+
+        if (!rdev->ops->disconnect) {
+                if (!rdev->ops->deauth)
+                        return -EOPNOTSUPP;
+
+                /* was it connected by userspace SME? */
+                if (!wdev->conn) {
+                        cfg80211_mlme_down(rdev, dev);
+                        return 0;
+                }
+
+                if (wdev->sme_state == CFG80211_SME_CONNECTING &&
+                    (wdev->conn->state == CFG80211_CONN_SCANNING ||
+                     wdev->conn->state == CFG80211_CONN_SCAN_AGAIN)) {
+                        wdev->sme_state = CFG80211_SME_IDLE;
+                        kfree(wdev->conn);
+                        wdev->conn = NULL;
+                        return 0;
+                }
+
+                /* wdev->conn->params.bssid must be set if > SCANNING */
+                err = __cfg80211_mlme_deauth(rdev, dev,
+                                             wdev->conn->params.bssid,
+                                             NULL, 0, reason);
+                if (err)
+                        return err;
+        } else {
+                err = rdev->ops->disconnect(&rdev->wiphy, dev, reason);
+                if (err)
+                        return err;
+        }
+
+        if (wdev->sme_state == CFG80211_SME_CONNECTED)
+                __cfg80211_disconnected(dev, NULL, 0, 0, false);
+        else if (wdev->sme_state == CFG80211_SME_CONNECTING)
+                __cfg80211_connect_result(dev, NULL, NULL, 0, NULL, 0,
+                                          WLAN_STATUS_UNSPECIFIED_FAILURE,
+                                          wextev);
+
+        return 0;
+}
+
+int cfg80211_disconnect(struct cfg80211_registered_device *rdev,
+                        struct net_device *dev,
+                        u16 reason, bool wextev)
+{
+        int err;
+
+        wdev_lock(dev->ieee80211_ptr);
+        err = __cfg80211_disconnect(rdev, dev, reason, wextev);
+        wdev_unlock(dev->ieee80211_ptr);
+
+        return err;
+}
+
+void cfg80211_sme_disassoc(struct net_device *dev, int idx)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        u8 bssid[ETH_ALEN];
+
+        ASSERT_WDEV_LOCK(wdev);
+
+        if (!wdev->conn)
+                return;
+
+        if (wdev->conn->state == CFG80211_CONN_IDLE)
+                return;
+
+        /*
+         * Ok, so the association was made by this SME -- we don't
+         * want it any more so deauthenticate too.
+         */
+
+        if (!wdev->auth_bsses[idx])
+                return;
+
+        memcpy(bssid, wdev->auth_bsses[idx]->pub.bssid, ETH_ALEN);
+        if (__cfg80211_mlme_deauth(rdev, dev, bssid,
+                                   NULL, 0, WLAN_REASON_DEAUTH_LEAVING)) {
+                /* whatever -- assume gone anyway */
+                cfg80211_unhold_bss(wdev->auth_bsses[idx]);
+                cfg80211_put_bss(&wdev->auth_bsses[idx]->pub);
+                wdev->auth_bsses[idx] = NULL;
+        }
+}
diff --git a/net/wireless/util.c b/net/wireless/util.c
index 25550692dda6..ba387d85dcfd 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -141,9 +141,12 @@ void ieee80211_set_bitrate_flags(struct wiphy *wiphy)
                         set_mandatory_flags_band(wiphy->bands[band], band);
 }
 
-int cfg80211_validate_key_settings(struct key_params *params, int key_idx,
+int cfg80211_validate_key_settings(struct cfg80211_registered_device *rdev,
+                                   struct key_params *params, int key_idx,
                                    const u8 *mac_addr)
 {
+        int i;
+
         if (key_idx > 5)
                 return -EINVAL;
 
@@ -197,6 +200,12 @@ int cfg80211_validate_key_settings(struct key_params *params, int key_idx,
                 }
         }
 
+        for (i = 0; i < rdev->wiphy.n_cipher_suites; i++)
+                if (params->cipher == rdev->wiphy.cipher_suites[i])
+                        break;
+        if (i == rdev->wiphy.n_cipher_suites)
+                return -EINVAL;
+
         return 0;
 }
 
@@ -502,3 +511,58 @@ unsigned int cfg80211_classify8021d(struct sk_buff *skb)
         return dscp >> 5;
 }
 EXPORT_SYMBOL(cfg80211_classify8021d);
+
+const u8 *ieee80211_bss_get_ie(struct cfg80211_bss *bss, u8 ie)
+{
+        u8 *end, *pos;
+
+        pos = bss->information_elements;
+        if (pos == NULL)
+                return NULL;
+        end = pos + bss->len_information_elements;
+
+        while (pos + 1 < end) {
+                if (pos + 2 + pos[1] > end)
+                        break;
+                if (pos[0] == ie)
+                        return pos;
+                pos += 2 + pos[1];
+        }
+
+        return NULL;
+}
+EXPORT_SYMBOL(ieee80211_bss_get_ie);
+
+void cfg80211_upload_connect_keys(struct wireless_dev *wdev)
+{
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct net_device *dev = wdev->netdev;
+        int i;
+
+        if (!wdev->connect_keys)
+                return;
+
+        for (i = 0; i < 6; i++) {
+                if (!wdev->connect_keys->params[i].cipher)
+                        continue;
+                if (rdev->ops->add_key(wdev->wiphy, dev, i, NULL,
+                                        &wdev->connect_keys->params[i])) {
+                        printk(KERN_ERR "%s: failed to set key %d\n",
+                                dev->name, i);
+                        continue;
+                }
+                if (wdev->connect_keys->def == i)
+                        if (rdev->ops->set_default_key(wdev->wiphy, dev, i)) {
+                                printk(KERN_ERR "%s: failed to set defkey %d\n",
+                                        dev->name, i);
+                                continue;
+                        }
+                if (wdev->connect_keys->defmgmt == i)
+                        if (rdev->ops->set_default_mgmt_key(wdev->wiphy, dev, i))
+                                printk(KERN_ERR "%s: failed to set mgtdef %d\n",
+                                        dev->name, i);
+        }
+
+        kfree(wdev->connect_keys);
+        wdev->connect_keys = NULL;
+}
diff --git a/net/wireless/wext-compat.c b/net/wireless/wext-compat.c
index d030c5315672..c7351a98e660 100644
--- a/net/wireless/wext-compat.c
+++ b/net/wireless/wext-compat.c
@@ -103,7 +103,7 @@ int cfg80211_wext_siwmode(struct net_device *dev, struct iw_request_info *info,
 
         memset(&vifparams, 0, sizeof(vifparams));
 
-        ret = rdev->ops->change_virtual_intf(wdev->wiphy, dev->ifindex, type,
+        ret = rdev->ops->change_virtual_intf(wdev->wiphy, dev, type,
                                              NULL, &vifparams);
         WARN_ON(!ret && wdev->iftype != type);
 
@@ -154,7 +154,7 @@ int cfg80211_wext_giwrange(struct net_device *dev,
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         struct iw_range *range = (struct iw_range *) extra;
         enum ieee80211_band band;
-        int c = 0;
+        int i, c = 0;
 
         if (!wdev)
                 return -EOPNOTSUPP;
@@ -173,9 +173,6 @@ int cfg80211_wext_giwrange(struct net_device *dev,
         range->min_frag = 256;
         range->max_frag = 2346;
 
-        range->encoding_size[0] = 5;
-        range->encoding_size[1] = 13;
-        range->num_encoding_sizes = 2;
         range->max_encoding_tokens = 4;
 
         range->max_qual.updated = IW_QUAL_NOISE_INVALID;
@@ -204,11 +201,31 @@ int cfg80211_wext_giwrange(struct net_device *dev,
         range->avg_qual.noise = range->max_qual.noise / 2;
         range->avg_qual.updated = range->max_qual.updated;
 
-        range->enc_capa = IW_ENC_CAPA_WPA | IW_ENC_CAPA_WPA2 |
-                          IW_ENC_CAPA_CIPHER_TKIP | IW_ENC_CAPA_CIPHER_CCMP;
+        for (i = 0; i < wdev->wiphy->n_cipher_suites; i++) {
+                switch (wdev->wiphy->cipher_suites[i]) {
+                case WLAN_CIPHER_SUITE_TKIP:
+                        range->enc_capa |= (IW_ENC_CAPA_CIPHER_TKIP |
+                                            IW_ENC_CAPA_WPA);
+                        break;
+
+                case WLAN_CIPHER_SUITE_CCMP:
+                        range->enc_capa |= (IW_ENC_CAPA_CIPHER_CCMP |
+                                            IW_ENC_CAPA_WPA2);
+                        break;
+
+                case WLAN_CIPHER_SUITE_WEP40:
+                        range->encoding_size[range->num_encoding_sizes++] =
+                                WLAN_KEY_LEN_WEP40;
+                        break;
+
+                case WLAN_CIPHER_SUITE_WEP104:
+                        range->encoding_size[range->num_encoding_sizes++] =
+                                WLAN_KEY_LEN_WEP104;
+                        break;
+                }
+        }
 
         for (band = 0; band < IEEE80211_NUM_BANDS; band ++) {
-                int i;
                 struct ieee80211_supported_band *sband;
 
                 sband = wdev->wiphy->bands[band];
@@ -236,56 +253,13 @@ int cfg80211_wext_giwrange(struct net_device *dev,
         IW_EVENT_CAPA_SET(range->event_capa, SIOCGIWAP);
         IW_EVENT_CAPA_SET(range->event_capa, SIOCGIWSCAN);
 
-        range->scan_capa |= IW_SCAN_CAPA_ESSID;
+        if (wdev->wiphy->max_scan_ssids > 0)
+                range->scan_capa |= IW_SCAN_CAPA_ESSID;
 
         return 0;
 }
 EXPORT_SYMBOL_GPL(cfg80211_wext_giwrange);
 
-int cfg80211_wext_siwmlme(struct net_device *dev,
-                          struct iw_request_info *info,
-                          struct iw_point *data, char *extra)
-{
-        struct wireless_dev *wdev = dev->ieee80211_ptr;
-        struct iw_mlme *mlme = (struct iw_mlme *)extra;
-        struct cfg80211_registered_device *rdev;
-        union {
-                struct cfg80211_disassoc_request disassoc;
-                struct cfg80211_deauth_request deauth;
-        } cmd;
-
-        if (!wdev)
-                return -EOPNOTSUPP;
-
-        rdev = wiphy_to_dev(wdev->wiphy);
-
-        if (wdev->iftype != NL80211_IFTYPE_STATION)
-                return -EINVAL;
-
-        if (mlme->addr.sa_family != ARPHRD_ETHER)
-                return -EINVAL;
-
-        memset(&cmd, 0, sizeof(cmd));
-
-        switch (mlme->cmd) {
-        case IW_MLME_DEAUTH:
-                if (!rdev->ops->deauth)
-                        return -EOPNOTSUPP;
-                cmd.deauth.peer_addr = mlme->addr.sa_data;
-                cmd.deauth.reason_code = mlme->reason_code;
-                return rdev->ops->deauth(wdev->wiphy, dev, &cmd.deauth);
-        case IW_MLME_DISASSOC:
-                if (!rdev->ops->disassoc)
-                        return -EOPNOTSUPP;
-                cmd.disassoc.peer_addr = mlme->addr.sa_data;
-                cmd.disassoc.reason_code = mlme->reason_code;
-                return rdev->ops->disassoc(wdev->wiphy, dev, &cmd.disassoc);
-        default:
-                return -EOPNOTSUPP;
-        }
-}
-EXPORT_SYMBOL_GPL(cfg80211_wext_siwmlme);
-
 
 /**
  * cfg80211_wext_freq - get wext frequency for non-"auto"
@@ -479,15 +453,32 @@ int cfg80211_wext_giwretry(struct net_device *dev,
 }
 EXPORT_SYMBOL_GPL(cfg80211_wext_giwretry);
 
-static int cfg80211_set_encryption(struct cfg80211_registered_device *rdev,
-                                   struct net_device *dev, const u8 *addr,
-                                   bool remove, bool tx_key, int idx,
-                                   struct key_params *params)
+static int __cfg80211_set_encryption(struct cfg80211_registered_device *rdev,
+                                     struct net_device *dev, const u8 *addr,
+                                     bool remove, bool tx_key, int idx,
+                                     struct key_params *params)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
-        int err;
+        int err, i;
+
+        if (!wdev->wext.keys) {
+                wdev->wext.keys = kzalloc(sizeof(*wdev->wext.keys),
+                                              GFP_KERNEL);
+                if (!wdev->wext.keys)
+                        return -ENOMEM;
+                for (i = 0; i < 6; i++)
+                        wdev->wext.keys->params[i].key =
+                                wdev->wext.keys->data[i];
+        }
+
+        if (wdev->iftype != NL80211_IFTYPE_ADHOC &&
+            wdev->iftype != NL80211_IFTYPE_STATION)
+                return -EOPNOTSUPP;
 
         if (params->cipher == WLAN_CIPHER_SUITE_AES_CMAC) {
+                if (!wdev->current_bss)
+                        return -ENOLINK;
+
                 if (!rdev->ops->set_default_mgmt_key)
                         return -EOPNOTSUPP;
 
@@ -497,8 +488,14 @@ static int cfg80211_set_encryption(struct cfg80211_registered_device *rdev,
                 return -EINVAL;
 
         if (remove) {
-                err = rdev->ops->del_key(&rdev->wiphy, dev, idx, addr);
+                err = 0;
+                if (wdev->current_bss)
+                        err = rdev->ops->del_key(&rdev->wiphy, dev, idx, addr);
                 if (!err) {
+                        if (!addr) {
+                                wdev->wext.keys->params[idx].key_len = 0;
+                                wdev->wext.keys->params[idx].cipher = 0;
+                        }
                         if (idx == wdev->wext.default_key)
                                 wdev->wext.default_key = -1;
                         else if (idx == wdev->wext.default_mgmt_key)
@@ -512,36 +509,65 @@ static int cfg80211_set_encryption(struct cfg80211_registered_device *rdev,
                         return 0;
 
                 return err;
-        } else {
-                if (addr)
-                        tx_key = false;
+        }
 
-                if (cfg80211_validate_key_settings(params, idx, addr))
-                        return -EINVAL;
+        if (addr)
+                tx_key = false;
 
+        if (cfg80211_validate_key_settings(rdev, params, idx, addr))
+                return -EINVAL;
+
+        err = 0;
+        if (wdev->current_bss)
                 err = rdev->ops->add_key(&rdev->wiphy, dev, idx, addr, params);
-                if (err)
-                        return err;
+        if (err)
+                return err;
+
+        if (!addr) {
+                wdev->wext.keys->params[idx] = *params;
+                memcpy(wdev->wext.keys->data[idx],
+                        params->key, params->key_len);
+                wdev->wext.keys->params[idx].key =
+                        wdev->wext.keys->data[idx];
+        }
 
-                if (tx_key || (!addr && wdev->wext.default_key == -1)) {
+        if ((params->cipher == WLAN_CIPHER_SUITE_WEP40 ||
+             params->cipher == WLAN_CIPHER_SUITE_WEP104) &&
+            (tx_key || (!addr && wdev->wext.default_key == -1))) {
+                if (wdev->current_bss)
                         err = rdev->ops->set_default_key(&rdev->wiphy,
                                                          dev, idx);
-                        if (!err)
-                                wdev->wext.default_key = idx;
-                        return err;
-                }
+                if (!err)
+                        wdev->wext.default_key = idx;
+                return err;
+        }
 
-                if (params->cipher == WLAN_CIPHER_SUITE_AES_CMAC &&
-                    (tx_key || (!addr && wdev->wext.default_mgmt_key == -1))) {
+        if (params->cipher == WLAN_CIPHER_SUITE_AES_CMAC &&
+            (tx_key || (!addr && wdev->wext.default_mgmt_key == -1))) {
+                if (wdev->current_bss)
                         err = rdev->ops->set_default_mgmt_key(&rdev->wiphy,
                                                               dev, idx);
-                        if (!err)
-                                wdev->wext.default_mgmt_key = idx;
-                        return err;
-                }
-
-                return 0;
+                if (!err)
+                        wdev->wext.default_mgmt_key = idx;
+                return err;
         }
+
+        return 0;
+}
+
+static int cfg80211_set_encryption(struct cfg80211_registered_device *rdev,
+                                   struct net_device *dev, const u8 *addr,
+                                   bool remove, bool tx_key, int idx,
+                                   struct key_params *params)
+{
+        int err;
+
+        wdev_lock(dev->ieee80211_ptr);
+        err = __cfg80211_set_encryption(rdev, dev, addr, remove,
+                                        tx_key, idx, params);
+        wdev_unlock(dev->ieee80211_ptr);
+
+        return err;
 }
 
 int cfg80211_wext_siwencode(struct net_device *dev,
@@ -554,6 +580,10 @@ int cfg80211_wext_siwencode(struct net_device *dev,
         bool remove = false;
         struct key_params params;
 
+        if (wdev->iftype != NL80211_IFTYPE_STATION &&
+            wdev->iftype != NL80211_IFTYPE_ADHOC)
+                return -EOPNOTSUPP;
+
         /* no use -- only MFP (set_default_mgmt_key) is optional */
         if (!rdev->ops->del_key ||
             !rdev->ops->add_key ||
@@ -574,9 +604,14 @@ int cfg80211_wext_siwencode(struct net_device *dev,
                 remove = true;
         else if (erq->length == 0) {
                 /* No key data - just set the default TX key index */
-                err = rdev->ops->set_default_key(&rdev->wiphy, dev, idx);
+                err = 0;
+                wdev_lock(wdev);
+                if (wdev->current_bss)
+                        err = rdev->ops->set_default_key(&rdev->wiphy,
+                                                         dev, idx);
                 if (!err)
                         wdev->wext.default_key = idx;
+                wdev_unlock(wdev);
                 return err;
         }
 
@@ -609,6 +644,10 @@ int cfg80211_wext_siwencodeext(struct net_device *dev,
         struct key_params params;
         u32 cipher;
 
+        if (wdev->iftype != NL80211_IFTYPE_STATION &&
+            wdev->iftype != NL80211_IFTYPE_ADHOC)
+                return -EOPNOTSUPP;
+
         /* no use -- only MFP (set_default_mgmt_key) is optional */
         if (!rdev->ops->del_key ||
             !rdev->ops->add_key ||
@@ -682,37 +721,15 @@ int cfg80211_wext_siwencodeext(struct net_device *dev,
 }
 EXPORT_SYMBOL_GPL(cfg80211_wext_siwencodeext);
 
-struct giwencode_cookie {
-        size_t buflen;
-        char *keybuf;
-};
-
-static void giwencode_get_key_cb(void *cookie, struct key_params *params)
-{
-        struct giwencode_cookie *data = cookie;
-
-        if (!params->key) {
-                data->buflen = 0;
-                return;
-        }
-
-        data->buflen = min_t(size_t, data->buflen, params->key_len);
-        memcpy(data->keybuf, params->key, data->buflen);
-}
-
 int cfg80211_wext_giwencode(struct net_device *dev,
                             struct iw_request_info *info,
                             struct iw_point *erq, char *keybuf)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
-        int idx, err;
-        struct giwencode_cookie data = {
-                .keybuf = keybuf,
-                .buflen = erq->length,
-        };
+        int idx;
 
-        if (!rdev->ops->get_key)
+        if (wdev->iftype != NL80211_IFTYPE_STATION &&
+            wdev->iftype != NL80211_IFTYPE_ADHOC)
                 return -EOPNOTSUPP;
 
         idx = erq->flags & IW_ENCODE_INDEX;
@@ -727,21 +744,18 @@ int cfg80211_wext_giwencode(struct net_device *dev,
 
         erq->flags = idx + 1;
 
-        err = rdev->ops->get_key(&rdev->wiphy, dev, idx, NULL, &data,
-                                 giwencode_get_key_cb);
-        if (!err) {
-                erq->length = data.buflen;
-                erq->flags |= IW_ENCODE_ENABLED;
-                return 0;
-        }
-
-        if (err == -ENOENT) {
+        if (!wdev->wext.keys || !wdev->wext.keys->params[idx].cipher) {
                 erq->flags |= IW_ENCODE_DISABLED;
                 erq->length = 0;
                 return 0;
         }
 
-        return err;
+        erq->length = min_t(size_t, erq->length,
+                            wdev->wext.keys->params[idx].key_len);
+        memcpy(keybuf, wdev->wext.keys->params[idx].key, erq->length);
+        erq->flags |= IW_ENCODE_ENABLED;
+
+        return 0;
 }
 EXPORT_SYMBOL_GPL(cfg80211_wext_giwencode);
 
@@ -827,3 +841,437 @@ int cfg80211_wext_giwtxpower(struct net_device *dev,
         return 0;
 }
 EXPORT_SYMBOL_GPL(cfg80211_wext_giwtxpower);
+
+static int cfg80211_set_auth_alg(struct wireless_dev *wdev,
+                                 s32 auth_alg)
+{
+        int nr_alg = 0;
+
+        if (!auth_alg)
+                return -EINVAL;
+
+        if (auth_alg & ~(IW_AUTH_ALG_OPEN_SYSTEM |
+                         IW_AUTH_ALG_SHARED_KEY |
+                         IW_AUTH_ALG_LEAP))
+                return -EINVAL;
+
+        if (auth_alg & IW_AUTH_ALG_OPEN_SYSTEM) {
+                nr_alg++;
+                wdev->wext.connect.auth_type = NL80211_AUTHTYPE_OPEN_SYSTEM;
+        }
+
+        if (auth_alg & IW_AUTH_ALG_SHARED_KEY) {
+                nr_alg++;
+                wdev->wext.connect.auth_type = NL80211_AUTHTYPE_SHARED_KEY;
+        }
+
+        if (auth_alg & IW_AUTH_ALG_LEAP) {
+                nr_alg++;
+                wdev->wext.connect.auth_type = NL80211_AUTHTYPE_NETWORK_EAP;
+        }
+
+        if (nr_alg > 1)
+                wdev->wext.connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
+
+        return 0;
+}
+
+static int cfg80211_set_wpa_version(struct wireless_dev *wdev, u32 wpa_versions)
+{
+        wdev->wext.connect.crypto.wpa_versions = 0;
+
+        if (wpa_versions & ~(IW_AUTH_WPA_VERSION_WPA |
+                             IW_AUTH_WPA_VERSION_WPA2|
+                             IW_AUTH_WPA_VERSION_DISABLED))
+                return -EINVAL;
+
+        if ((wpa_versions & IW_AUTH_WPA_VERSION_DISABLED) &&
+            (wpa_versions & (IW_AUTH_WPA_VERSION_WPA|
+                             IW_AUTH_WPA_VERSION_WPA2)))
+                return -EINVAL;
+
+        if (wpa_versions & IW_AUTH_WPA_VERSION_DISABLED)
+                wdev->wext.connect.crypto.wpa_versions &=
+                        ~(NL80211_WPA_VERSION_1|NL80211_WPA_VERSION_2);
+
+        if (wpa_versions & IW_AUTH_WPA_VERSION_WPA)
+                wdev->wext.connect.crypto.wpa_versions |=
+                        NL80211_WPA_VERSION_1;
+
+        if (wpa_versions & IW_AUTH_WPA_VERSION_WPA2)
+                wdev->wext.connect.crypto.wpa_versions |=
+                        NL80211_WPA_VERSION_2;
+
+        return 0;
+}
+
+static int cfg80211_set_cipher_group(struct wireless_dev *wdev, u32 cipher)
+{
+        wdev->wext.connect.crypto.cipher_group = 0;
+
+        if (cipher & IW_AUTH_CIPHER_WEP40)
+                wdev->wext.connect.crypto.cipher_group =
+                        WLAN_CIPHER_SUITE_WEP40;
+        else if (cipher & IW_AUTH_CIPHER_WEP104)
+                wdev->wext.connect.crypto.cipher_group =
+                        WLAN_CIPHER_SUITE_WEP104;
+        else if (cipher & IW_AUTH_CIPHER_TKIP)
+                wdev->wext.connect.crypto.cipher_group =
+                        WLAN_CIPHER_SUITE_TKIP;
+        else if (cipher & IW_AUTH_CIPHER_CCMP)
+                wdev->wext.connect.crypto.cipher_group =
+                        WLAN_CIPHER_SUITE_CCMP;
+        else if (cipher & IW_AUTH_CIPHER_AES_CMAC)
+                wdev->wext.connect.crypto.cipher_group =
+                        WLAN_CIPHER_SUITE_AES_CMAC;
+        else
+                return -EINVAL;
+
+        return 0;
+}
+
+static int cfg80211_set_cipher_pairwise(struct wireless_dev *wdev, u32 cipher)
+{
+        int nr_ciphers = 0;
+        u32 *ciphers_pairwise = wdev->wext.connect.crypto.ciphers_pairwise;
+
+        if (cipher & IW_AUTH_CIPHER_WEP40) {
+                ciphers_pairwise[nr_ciphers] = WLAN_CIPHER_SUITE_WEP40;
+                nr_ciphers++;
+        }
+
+        if (cipher & IW_AUTH_CIPHER_WEP104) {
+                ciphers_pairwise[nr_ciphers] = WLAN_CIPHER_SUITE_WEP104;
+                nr_ciphers++;
+        }
+
+        if (cipher & IW_AUTH_CIPHER_TKIP) {
+                ciphers_pairwise[nr_ciphers] = WLAN_CIPHER_SUITE_TKIP;
+                nr_ciphers++;
+        }
+
+        if (cipher & IW_AUTH_CIPHER_CCMP) {
+                ciphers_pairwise[nr_ciphers] = WLAN_CIPHER_SUITE_CCMP;
+                nr_ciphers++;
+        }
+
+        if (cipher & IW_AUTH_CIPHER_AES_CMAC) {
+                ciphers_pairwise[nr_ciphers] = WLAN_CIPHER_SUITE_AES_CMAC;
+                nr_ciphers++;
+        }
+
+        BUILD_BUG_ON(NL80211_MAX_NR_CIPHER_SUITES < 5);
+
+        wdev->wext.connect.crypto.n_ciphers_pairwise = nr_ciphers;
+
+        return 0;
+}
+
+
+static int cfg80211_set_key_mgt(struct wireless_dev *wdev, u32 key_mgt)
+{
+        int nr_akm_suites = 0;
+
+        if (key_mgt & ~(IW_AUTH_KEY_MGMT_802_1X |
+                        IW_AUTH_KEY_MGMT_PSK))
+                return -EINVAL;
+
+        if (key_mgt & IW_AUTH_KEY_MGMT_802_1X) {
+                wdev->wext.connect.crypto.akm_suites[nr_akm_suites] =
+                        WLAN_AKM_SUITE_8021X;
+                nr_akm_suites++;
+        }
+
+        if (key_mgt & IW_AUTH_KEY_MGMT_PSK) {
+                wdev->wext.connect.crypto.akm_suites[nr_akm_suites] =
+                        WLAN_AKM_SUITE_PSK;
+                nr_akm_suites++;
+        }
+
+        wdev->wext.connect.crypto.n_akm_suites = nr_akm_suites;
+
+        return 0;
+}
+
+int cfg80211_wext_siwauth(struct net_device *dev,
+                          struct iw_request_info *info,
+                          struct iw_param *data, char *extra)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+
+        if (wdev->iftype != NL80211_IFTYPE_STATION)
+                return -EOPNOTSUPP;
+
+        switch (data->flags & IW_AUTH_INDEX) {
+        case IW_AUTH_PRIVACY_INVOKED:
+                wdev->wext.connect.privacy = data->value;
+                return 0;
+        case IW_AUTH_WPA_VERSION:
+                return cfg80211_set_wpa_version(wdev, data->value);
+        case IW_AUTH_CIPHER_GROUP:
+                return cfg80211_set_cipher_group(wdev, data->value);
+        case IW_AUTH_KEY_MGMT:
+                return cfg80211_set_key_mgt(wdev, data->value);
+        case IW_AUTH_CIPHER_PAIRWISE:
+                return cfg80211_set_cipher_pairwise(wdev, data->value);
+        case IW_AUTH_80211_AUTH_ALG:
+                return cfg80211_set_auth_alg(wdev, data->value);
+        case IW_AUTH_WPA_ENABLED:
+        case IW_AUTH_RX_UNENCRYPTED_EAPOL:
+        case IW_AUTH_DROP_UNENCRYPTED:
+        case IW_AUTH_MFP:
+                return 0;
+        default:
+                return -EOPNOTSUPP;
+        }
+}
+EXPORT_SYMBOL_GPL(cfg80211_wext_siwauth);
+
+int cfg80211_wext_giwauth(struct net_device *dev,
+                          struct iw_request_info *info,
+                          struct iw_param *data, char *extra)
+{
+        /* XXX: what do we need? */
+
+        return -EOPNOTSUPP;
+}
+EXPORT_SYMBOL_GPL(cfg80211_wext_giwauth);
+
+int cfg80211_wext_siwpower(struct net_device *dev,
+                           struct iw_request_info *info,
+                           struct iw_param *wrq, char *extra)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        bool ps = wdev->wext.ps;
+        int timeout = wdev->wext.ps_timeout;
+        int err;
+
+        if (wdev->iftype != NL80211_IFTYPE_STATION)
+                return -EINVAL;
+
+        if (!rdev->ops->set_power_mgmt)
+                return -EOPNOTSUPP;
+
+        if (wrq->disabled) {
+                ps = false;
+        } else {
+                switch (wrq->flags & IW_POWER_MODE) {
+                case IW_POWER_ON:       /* If not specified */
+                case IW_POWER_MODE:     /* If set all mask */
+                case IW_POWER_ALL_R:    /* If explicitely state all */
+                        ps = true;
+                        break;
+                default:                /* Otherwise we ignore */
+                        return -EINVAL;
+                }
+
+                if (wrq->flags & ~(IW_POWER_MODE | IW_POWER_TIMEOUT))
+                        return -EINVAL;
+
+                if (wrq->flags & IW_POWER_TIMEOUT)
+                        timeout = wrq->value / 1000;
+        }
+
+        err = rdev->ops->set_power_mgmt(wdev->wiphy, dev, ps, timeout);
+        if (err)
+                return err;
+
+        wdev->wext.ps = ps;
+        wdev->wext.ps_timeout = timeout;
+
+        return 0;
+
+}
+EXPORT_SYMBOL_GPL(cfg80211_wext_siwpower);
+
+int cfg80211_wext_giwpower(struct net_device *dev,
+                           struct iw_request_info *info,
+                           struct iw_param *wrq, char *extra)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+
+        wrq->disabled = !wdev->wext.ps;
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(cfg80211_wext_giwpower);
+
+int cfg80211_wds_wext_siwap(struct net_device *dev,
+                            struct iw_request_info *info,
+                            struct sockaddr *addr, char *extra)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        int err;
+
+        if (WARN_ON(wdev->iftype != NL80211_IFTYPE_WDS))
+                return -EINVAL;
+
+        if (addr->sa_family != ARPHRD_ETHER)
+                return -EINVAL;
+
+        if (netif_running(dev))
+                return -EBUSY;
+
+        if (!rdev->ops->set_wds_peer)
+                return -EOPNOTSUPP;
+
+        err = rdev->ops->set_wds_peer(wdev->wiphy, dev, (u8 *) &addr->sa_data);
+        if (err)
+                return err;
+
+        memcpy(&wdev->wext.bssid, (u8 *) &addr->sa_data, ETH_ALEN);
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(cfg80211_wds_wext_siwap);
+
+int cfg80211_wds_wext_giwap(struct net_device *dev,
+                            struct iw_request_info *info,
+                            struct sockaddr *addr, char *extra)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+
+        if (WARN_ON(wdev->iftype != NL80211_IFTYPE_WDS))
+                return -EINVAL;
+
+        addr->sa_family = ARPHRD_ETHER;
+        memcpy(&addr->sa_data, wdev->wext.bssid, ETH_ALEN);
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(cfg80211_wds_wext_giwap);
+
+int cfg80211_wext_siwrate(struct net_device *dev,
+                          struct iw_request_info *info,
+                          struct iw_param *rate, char *extra)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct cfg80211_bitrate_mask mask;
+
+        if (!rdev->ops->set_bitrate_mask)
+                return -EOPNOTSUPP;
+
+        mask.fixed = 0;
+        mask.maxrate = 0;
+
+        if (rate->value < 0) {
+                /* nothing */
+        } else if (rate->fixed) {
+                mask.fixed = rate->value / 1000; /* kbps */
+        } else {
+                mask.maxrate = rate->value / 1000; /* kbps */
+        }
+
+        return rdev->ops->set_bitrate_mask(wdev->wiphy, dev, NULL, &mask);
+}
+EXPORT_SYMBOL_GPL(cfg80211_wext_siwrate);
+
+int cfg80211_wext_giwrate(struct net_device *dev,
+                          struct iw_request_info *info,
+                          struct iw_param *rate, char *extra)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        /* we are under RTNL - globally locked - so can use a static struct */
+        static struct station_info sinfo;
+        u8 addr[ETH_ALEN];
+        int err;
+
+        if (wdev->iftype != NL80211_IFTYPE_STATION)
+                return -EOPNOTSUPP;
+
+        if (!rdev->ops->get_station)
+                return -EOPNOTSUPP;
+
+        err = 0;
+        wdev_lock(wdev);
+        if (wdev->current_bss)
+                memcpy(addr, wdev->current_bss->pub.bssid, ETH_ALEN);
+        else
+                err = -EOPNOTSUPP;
+        wdev_unlock(wdev);
+        if (err)
+                return err;
+
+        err = rdev->ops->get_station(&rdev->wiphy, dev, addr, &sinfo);
+        if (err)
+                return err;
+
+        if (!(sinfo.filled & STATION_INFO_TX_BITRATE))
+                return -EOPNOTSUPP;
+
+        rate->value = 0;
+
+        if (!(sinfo.txrate.flags & RATE_INFO_FLAGS_MCS))
+                rate->value = 100000 * sinfo.txrate.legacy;
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(cfg80211_wext_giwrate);
+
+/* Get wireless statistics.  Called by /proc/net/wireless and by SIOCGIWSTATS */
+struct iw_statistics *cfg80211_wireless_stats(struct net_device *dev)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        /* we are under RTNL - globally locked - so can use static structs */
+        static struct iw_statistics wstats;
+        static struct station_info sinfo;
+        u8 bssid[ETH_ALEN];
+
+        if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION)
+                return NULL;
+
+        if (!rdev->ops->get_station)
+                return NULL;
+
+        /* Grab BSSID of current BSS, if any */
+        wdev_lock(wdev);
+        if (!wdev->current_bss) {
+                wdev_unlock(wdev);
+                return NULL;
+        }
+        memcpy(bssid, wdev->current_bss->pub.bssid, ETH_ALEN);
+        wdev_unlock(wdev);
+
+        if (rdev->ops->get_station(&rdev->wiphy, dev, bssid, &sinfo))
+                return NULL;
+
+        memset(&wstats, 0, sizeof(wstats));
+
+        switch (rdev->wiphy.signal_type) {
+        case CFG80211_SIGNAL_TYPE_MBM:
+                if (sinfo.filled & STATION_INFO_SIGNAL) {
+                        int sig = sinfo.signal;
+                        wstats.qual.updated |= IW_QUAL_LEVEL_UPDATED;
+                        wstats.qual.updated |= IW_QUAL_QUAL_UPDATED;
+                        wstats.qual.updated |= IW_QUAL_DBM;
+                        wstats.qual.level = sig;
+                        if (sig < -110)
+                                sig = -110;
+                        else if (sig > -40)
+                                sig = -40;
+                        wstats.qual.qual = sig + 110;
+                        break;
+                }
+        case CFG80211_SIGNAL_TYPE_UNSPEC:
+                if (sinfo.filled & STATION_INFO_SIGNAL) {
+                        wstats.qual.updated |= IW_QUAL_LEVEL_UPDATED;
+                        wstats.qual.updated |= IW_QUAL_QUAL_UPDATED;
+                        wstats.qual.level = sinfo.signal;
+                        wstats.qual.qual = sinfo.signal;
+                        break;
+                }
+        default:
+                wstats.qual.updated |= IW_QUAL_LEVEL_INVALID;
+                wstats.qual.updated |= IW_QUAL_QUAL_INVALID;
+        }
+
+        wstats.qual.updated |= IW_QUAL_NOISE_INVALID;
+
+        return &wstats;
+}
+EXPORT_SYMBOL_GPL(cfg80211_wireless_stats);
diff --git a/net/wireless/wext-sme.c b/net/wireless/wext-sme.c
new file mode 100644
index 000000000000..4c689fd865b0
--- /dev/null
+++ b/net/wireless/wext-sme.c
@@ -0,0 +1,394 @@
+/*
+ * cfg80211 wext compat for managed mode.
+ *
+ * Copyright 2009       Johannes Berg <johannes@sipsolutions.net>
+ * Copyright (C) 2009   Intel Corporation. All rights reserved.
+ */
+
+#include <linux/etherdevice.h>
+#include <linux/if_arp.h>
+#include <net/cfg80211.h>
+#include "nl80211.h"
+
+int cfg80211_mgd_wext_connect(struct cfg80211_registered_device *rdev,
+                              struct wireless_dev *wdev)
+{
+        struct cfg80211_cached_keys *ck = NULL;
+        int err, i;
+
+        ASSERT_RDEV_LOCK(rdev);
+        ASSERT_WDEV_LOCK(wdev);
+
+        if (!netif_running(wdev->netdev))
+                return 0;
+
+        wdev->wext.connect.ie = wdev->wext.ie;
+        wdev->wext.connect.ie_len = wdev->wext.ie_len;
+        wdev->wext.connect.privacy = wdev->wext.default_key != -1;
+
+        if (wdev->wext.keys) {
+                wdev->wext.keys->def = wdev->wext.default_key;
+                wdev->wext.keys->defmgmt = wdev->wext.default_mgmt_key;
+        }
+
+        if (!wdev->wext.connect.ssid_len)
+                return 0;
+
+        if (wdev->wext.keys) {
+                ck = kmemdup(wdev->wext.keys, sizeof(*ck), GFP_KERNEL);
+                if (!ck)
+                        return -ENOMEM;
+                for (i = 0; i < 6; i++)
+                        ck->params[i].key = ck->data[i];
+        }
+        err = __cfg80211_connect(rdev, wdev->netdev,
+                                 &wdev->wext.connect, ck);
+        if (err)
+                kfree(ck);
+
+        return err;
+}
+
+int cfg80211_mgd_wext_siwfreq(struct net_device *dev,
+                              struct iw_request_info *info,
+                              struct iw_freq *freq, char *extra)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct ieee80211_channel *chan;
+        int err;
+
+        /* call only for station! */
+        if (WARN_ON(wdev->iftype != NL80211_IFTYPE_STATION))
+                return -EINVAL;
+
+        chan = cfg80211_wext_freq(wdev->wiphy, freq);
+        if (chan && IS_ERR(chan))
+                return PTR_ERR(chan);
+
+        if (chan && (chan->flags & IEEE80211_CHAN_DISABLED))
+                return -EINVAL;
+
+        cfg80211_lock_rdev(rdev);
+        wdev_lock(wdev);
+
+        if (wdev->sme_state != CFG80211_SME_IDLE) {
+                bool event = true;
+
+                if (wdev->wext.connect.channel == chan) {
+                        err = 0;
+                        goto out;
+                }
+
+                /* if SSID set, we'll try right again, avoid event */
+                if (wdev->wext.connect.ssid_len)
+                        event = false;
+                err = __cfg80211_disconnect(wiphy_to_dev(wdev->wiphy),
+                                            dev, WLAN_REASON_DEAUTH_LEAVING,
+                                            event);
+                if (err)
+                        goto out;
+        }
+
+
+        wdev->wext.connect.channel = chan;
+
+        /* SSID is not set, we just want to switch channel */
+        if (wdev->wext.connect.ssid_len && chan) {
+                err = -EOPNOTSUPP;
+                if (rdev->ops->set_channel)
+                        err = rdev->ops->set_channel(wdev->wiphy, chan,
+                                                     NL80211_CHAN_NO_HT);
+                goto out;
+        }
+
+        err = cfg80211_mgd_wext_connect(wiphy_to_dev(wdev->wiphy), wdev);
+ out:
+        wdev_unlock(wdev);
+        cfg80211_unlock_rdev(rdev);
+        return err;
+}
+/* temporary symbol - mark GPL - in the future the handler won't be */
+EXPORT_SYMBOL_GPL(cfg80211_mgd_wext_siwfreq);
+
+int cfg80211_mgd_wext_giwfreq(struct net_device *dev,
+                              struct iw_request_info *info,
+                              struct iw_freq *freq, char *extra)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct ieee80211_channel *chan = NULL;
+
+        /* call only for station! */
+        if (WARN_ON(wdev->iftype != NL80211_IFTYPE_STATION))
+                return -EINVAL;
+
+        wdev_lock(wdev);
+        if (wdev->current_bss)
+                chan = wdev->current_bss->pub.channel;
+        else if (wdev->wext.connect.channel)
+                chan = wdev->wext.connect.channel;
+        wdev_unlock(wdev);
+
+        if (chan) {
+                freq->m = chan->center_freq;
+                freq->e = 6;
+                return 0;
+        }
+
+        /* no channel if not joining */
+        return -EINVAL;
+}
+/* temporary symbol - mark GPL - in the future the handler won't be */
+EXPORT_SYMBOL_GPL(cfg80211_mgd_wext_giwfreq);
+
+int cfg80211_mgd_wext_siwessid(struct net_device *dev,
+                               struct iw_request_info *info,
+                               struct iw_point *data, char *ssid)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        size_t len = data->length;
+        int err;
+
+        /* call only for station! */
+        if (WARN_ON(wdev->iftype != NL80211_IFTYPE_STATION))
+                return -EINVAL;
+
+        if (!data->flags)
+                len = 0;
+
+        /* iwconfig uses nul termination in SSID.. */
+        if (len > 0 && ssid[len - 1] == '\0')
+                len--;
+
+        cfg80211_lock_rdev(wiphy_to_dev(wdev->wiphy));
+        wdev_lock(wdev);
+
+        err = 0;
+
+        if (wdev->sme_state != CFG80211_SME_IDLE) {
+                bool event = true;
+
+                if (wdev->wext.connect.ssid && len &&
+                    len == wdev->wext.connect.ssid_len &&
+                    memcmp(wdev->wext.connect.ssid, ssid, len) == 0)
+                        goto out;
+
+                /* if SSID set now, we'll try to connect, avoid event */
+                if (len)
+                        event = false;
+                err = __cfg80211_disconnect(wiphy_to_dev(wdev->wiphy),
+                                            dev, WLAN_REASON_DEAUTH_LEAVING,
+                                            event);
+                if (err)
+                        goto out;
+        }
+
+        wdev->wext.connect.ssid = wdev->wext.ssid;
+        memcpy(wdev->wext.ssid, ssid, len);
+        wdev->wext.connect.ssid_len = len;
+
+        wdev->wext.connect.crypto.control_port = false;
+
+        err = cfg80211_mgd_wext_connect(wiphy_to_dev(wdev->wiphy), wdev);
+ out:
+        wdev_unlock(wdev);
+        cfg80211_unlock_rdev(wiphy_to_dev(wdev->wiphy));
+        return err;
+}
+/* temporary symbol - mark GPL - in the future the handler won't be */
+EXPORT_SYMBOL_GPL(cfg80211_mgd_wext_siwessid);
+
+int cfg80211_mgd_wext_giwessid(struct net_device *dev,
+                               struct iw_request_info *info,
+                               struct iw_point *data, char *ssid)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+
+        /* call only for station! */
+        if (WARN_ON(wdev->iftype != NL80211_IFTYPE_STATION))
+                return -EINVAL;
+
+        data->flags = 0;
+
+        wdev_lock(wdev);
+        if (wdev->wext.connect.ssid && wdev->wext.connect.ssid_len) {
+                data->flags = 1;
+                data->length = wdev->wext.connect.ssid_len;
+                memcpy(ssid, wdev->wext.connect.ssid, data->length);
+        } else
+                data->flags = 0;
+        wdev_unlock(wdev);
+
+        return 0;
+}
+/* temporary symbol - mark GPL - in the future the handler won't be */
+EXPORT_SYMBOL_GPL(cfg80211_mgd_wext_giwessid);
+
+int cfg80211_mgd_wext_siwap(struct net_device *dev,
+                            struct iw_request_info *info,
+                            struct sockaddr *ap_addr, char *extra)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        u8 *bssid = ap_addr->sa_data;
+        int err;
+
+        /* call only for station! */
+        if (WARN_ON(wdev->iftype != NL80211_IFTYPE_STATION))
+                return -EINVAL;
+
+        if (ap_addr->sa_family != ARPHRD_ETHER)
+                return -EINVAL;
+
+        /* automatic mode */
+        if (is_zero_ether_addr(bssid) || is_broadcast_ether_addr(bssid))
+                bssid = NULL;
+
+        cfg80211_lock_rdev(wiphy_to_dev(wdev->wiphy));
+        wdev_lock(wdev);
+
+        if (wdev->sme_state != CFG80211_SME_IDLE) {
+                err = 0;
+                /* both automatic */
+                if (!bssid && !wdev->wext.connect.bssid)
+                        goto out;
+
+                /* fixed already - and no change */
+                if (wdev->wext.connect.bssid && bssid &&
+                    compare_ether_addr(bssid, wdev->wext.connect.bssid) == 0)
+                        goto out;
+
+                err = __cfg80211_disconnect(wiphy_to_dev(wdev->wiphy),
+                                            dev, WLAN_REASON_DEAUTH_LEAVING,
+                                            false);
+                if (err)
+                        goto out;
+        }
+
+        if (bssid) {
+                memcpy(wdev->wext.bssid, bssid, ETH_ALEN);
+                wdev->wext.connect.bssid = wdev->wext.bssid;
+        } else
+                wdev->wext.connect.bssid = NULL;
+
+        err = cfg80211_mgd_wext_connect(wiphy_to_dev(wdev->wiphy), wdev);
+ out:
+        wdev_unlock(wdev);
+        cfg80211_unlock_rdev(wiphy_to_dev(wdev->wiphy));
+        return err;
+}
+/* temporary symbol - mark GPL - in the future the handler won't be */
+EXPORT_SYMBOL_GPL(cfg80211_mgd_wext_siwap);
+
+int cfg80211_mgd_wext_giwap(struct net_device *dev,
+                            struct iw_request_info *info,
+                            struct sockaddr *ap_addr, char *extra)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+
+        /* call only for station! */
+        if (WARN_ON(wdev->iftype != NL80211_IFTYPE_STATION))
+                return -EINVAL;
+
+        ap_addr->sa_family = ARPHRD_ETHER;
+
+        wdev_lock(wdev);
+        if (wdev->current_bss)
+                memcpy(ap_addr->sa_data, wdev->current_bss->pub.bssid, ETH_ALEN);
+        else if (wdev->wext.connect.bssid)
+                memcpy(ap_addr->sa_data, wdev->wext.connect.bssid, ETH_ALEN);
+        else
+                memset(ap_addr->sa_data, 0, ETH_ALEN);
+        wdev_unlock(wdev);
+
+        return 0;
+}
+/* temporary symbol - mark GPL - in the future the handler won't be */
+EXPORT_SYMBOL_GPL(cfg80211_mgd_wext_giwap);
+
+int cfg80211_wext_siwgenie(struct net_device *dev,
+                           struct iw_request_info *info,
+                           struct iw_point *data, char *extra)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        u8 *ie = extra;
+        int ie_len = data->length, err;
+
+        if (wdev->iftype != NL80211_IFTYPE_STATION)
+                return -EOPNOTSUPP;
+
+        if (!ie_len)
+                ie = NULL;
+
+        wdev_lock(wdev);
+
+        /* no change */
+        err = 0;
+        if (wdev->wext.ie_len == ie_len &&
+            memcmp(wdev->wext.ie, ie, ie_len) == 0)
+                goto out;
+
+        if (ie_len) {
+                ie = kmemdup(extra, ie_len, GFP_KERNEL);
+                if (!ie) {
+                        err = -ENOMEM;
+                        goto out;
+                }
+        } else
+                ie = NULL;
+
+        kfree(wdev->wext.ie);
+        wdev->wext.ie = ie;
+        wdev->wext.ie_len = ie_len;
+
+        if (wdev->sme_state != CFG80211_SME_IDLE) {
+                err = __cfg80211_disconnect(rdev, dev,
+                                            WLAN_REASON_DEAUTH_LEAVING, false);
+                if (err)
+                        goto out;
+        }
+
+        /* userspace better not think we'll reconnect */
+        err = 0;
+ out:
+        wdev_unlock(wdev);
+        return err;
+}
+EXPORT_SYMBOL_GPL(cfg80211_wext_siwgenie);
+
+int cfg80211_wext_siwmlme(struct net_device *dev,
+                          struct iw_request_info *info,
+                          struct iw_point *data, char *extra)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct iw_mlme *mlme = (struct iw_mlme *)extra;
+        struct cfg80211_registered_device *rdev;
+        int err;
+
+        if (!wdev)
+                return -EOPNOTSUPP;
+
+        rdev = wiphy_to_dev(wdev->wiphy);
+
+        if (wdev->iftype != NL80211_IFTYPE_STATION)
+                return -EINVAL;
+
+        if (mlme->addr.sa_family != ARPHRD_ETHER)
+                return -EINVAL;
+
+        wdev_lock(wdev);
+        switch (mlme->cmd) {
+        case IW_MLME_DEAUTH:
+        case IW_MLME_DISASSOC:
+                err = __cfg80211_disconnect(rdev, dev, mlme->reason_code,
+                                            true);
+                break;
+        default:
+                err = -EOPNOTSUPP;
+                break;
+        }
+        wdev_unlock(wdev);
+
+        return err;
+}
+EXPORT_SYMBOL_GPL(cfg80211_wext_siwmlme);
diff --git a/net/wireless/wext.c b/net/wireless/wext.c
index 252c2010c2e2..3fe3c2c0ce11 100644
--- a/net/wireless/wext.c
+++ b/net/wireless/wext.c
@@ -417,6 +417,21 @@ static const int event_type_size[] = {
         IW_EV_QUAL_LEN,                 /* IW_HEADER_TYPE_QUAL */
 };
 
+#ifdef CONFIG_COMPAT
+static const int compat_event_type_size[] = {
+        IW_EV_COMPAT_LCP_LEN,           /* IW_HEADER_TYPE_NULL */
+        0,
+        IW_EV_COMPAT_CHAR_LEN,          /* IW_HEADER_TYPE_CHAR */
+        0,
+        IW_EV_COMPAT_UINT_LEN,          /* IW_HEADER_TYPE_UINT */
+        IW_EV_COMPAT_FREQ_LEN,          /* IW_HEADER_TYPE_FREQ */
+        IW_EV_COMPAT_ADDR_LEN,          /* IW_HEADER_TYPE_ADDR */
+        0,
+        IW_EV_COMPAT_POINT_LEN,         /* Without variable payload */
+        IW_EV_COMPAT_PARAM_LEN,         /* IW_HEADER_TYPE_PARAM */
+        IW_EV_COMPAT_QUAL_LEN,          /* IW_HEADER_TYPE_QUAL */
+};
+#endif
 
 /************************ COMMON SUBROUTINES ************************/
 /*
@@ -610,6 +625,11 @@ static void wireless_seq_printf_stats(struct seq_file *seq,
 {
         /* Get stats from the driver */
         struct iw_statistics *stats = get_wireless_stats(dev);
+        static struct iw_statistics nullstats = {};
+
+        /* show device if it's wireless regardless of current stats */
+        if (!stats && dev->wireless_handlers)
+                stats = &nullstats;
 
         if (stats) {
                 seq_printf(seq, "%6s: %04x  %3d%c  %3d%c  %3d%c  %6d %6d %6d "
@@ -628,7 +648,9 @@ static void wireless_seq_printf_stats(struct seq_file *seq,
                            stats->discard.nwid, stats->discard.code,
                            stats->discard.fragment, stats->discard.retries,
                            stats->discard.misc, stats->miss.beacon);
-                stats->qual.updated &= ~IW_QUAL_ALL_UPDATED;
+
+                if (stats != &nullstats)
+                        stats->qual.updated &= ~IW_QUAL_ALL_UPDATED;
         }
 }
 
@@ -1250,65 +1272,58 @@ int compat_wext_handle_ioctl(struct net *net, unsigned int cmd,
 }
 #endif
 
-/************************* EVENT PROCESSING *************************/
-/*
- * Process events generated by the wireless layer or the driver.
- * Most often, the event will be propagated through rtnetlink
- */
+static int __net_init wext_pernet_init(struct net *net)
+{
+        skb_queue_head_init(&net->wext_nlevents);
+        return 0;
+}
 
-/* ---------------------------------------------------------------- */
-/*
- * Locking...
- * ----------
- *
- * Thanks to Herbert Xu <herbert@gondor.apana.org.au> for fixing
- * the locking issue in here and implementing this code !
- *
- * The issue : wireless_send_event() is often called in interrupt context,
- * while the Netlink layer can never be called in interrupt context.
- * The fully formed RtNetlink events are queued, and then a tasklet is run
- * to feed those to Netlink.
- * The skb_queue is interrupt safe, and its lock is not held while calling
- * Netlink, so there is no possibility of dealock.
- * Jean II
- */
+static void __net_exit wext_pernet_exit(struct net *net)
+{
+        skb_queue_purge(&net->wext_nlevents);
+}
 
-static struct sk_buff_head wireless_nlevent_queue;
+static struct pernet_operations wext_pernet_ops = {
+        .init = wext_pernet_init,
+        .exit = wext_pernet_exit,
+};
 
 static int __init wireless_nlevent_init(void)
 {
-        skb_queue_head_init(&wireless_nlevent_queue);
+        return register_pernet_subsys(&wext_pernet_ops);
         return 0;
 }
 
 subsys_initcall(wireless_nlevent_init);
 
-static void wireless_nlevent_process(unsigned long data)
+/* Process events generated by the wireless layer or the driver. */
+static void wireless_nlevent_process(struct work_struct *work)
 {
         struct sk_buff *skb;
+        struct net *net;
+
+        rtnl_lock();
+
+        for_each_net(net) {
+                while ((skb = skb_dequeue(&net->wext_nlevents)))
+                        rtnl_notify(skb, net, 0, RTNLGRP_LINK, NULL,
+                                    GFP_KERNEL);
+        }
 
-        while ((skb = skb_dequeue(&wireless_nlevent_queue)))
-                rtnl_notify(skb, &init_net, 0, RTNLGRP_LINK, NULL, GFP_ATOMIC);
+        rtnl_unlock();
 }
 
-static DECLARE_TASKLET(wireless_nlevent_tasklet, wireless_nlevent_process, 0);
+static DECLARE_WORK(wireless_nlevent_work, wireless_nlevent_process);
 
-/* ---------------------------------------------------------------- */
-/*
- * Fill a rtnetlink message with our event data.
- * Note that we propage only the specified event and don't dump the
- * current wireless config. Dumping the wireless config is far too
- * expensive (for each parameter, the driver need to query the hardware).
- */
-static int rtnetlink_fill_iwinfo(struct sk_buff *skb, struct net_device *dev,
-                                 int type, char *event, int event_len)
+static struct nlmsghdr *rtnetlink_ifinfo_prep(struct net_device *dev,
+                                              struct sk_buff *skb)
 {
         struct ifinfomsg *r;
         struct nlmsghdr  *nlh;
 
-        nlh = nlmsg_put(skb, 0, 0, type, sizeof(*r), 0);
-        if (nlh == NULL)
-                return -EMSGSIZE;
+        nlh = nlmsg_put(skb, 0, 0, RTM_NEWLINK, sizeof(*r), 0);
+        if (!nlh)
+                return NULL;
 
         r = nlmsg_data(nlh);
         r->ifi_family = AF_UNSPEC;
@@ -1319,48 +1334,14 @@ static int rtnetlink_fill_iwinfo(struct sk_buff *skb, struct net_device *dev,
         r->ifi_change = 0;      /* Wireless changes don't affect those flags */
 
         NLA_PUT_STRING(skb, IFLA_IFNAME, dev->name);
-        /* Add the wireless events in the netlink packet */
-        NLA_PUT(skb, IFLA_WIRELESS, event_len, event);
 
-        return nlmsg_end(skb, nlh);
-
-nla_put_failure:
+        return nlh;
+ nla_put_failure:
         nlmsg_cancel(skb, nlh);
-        return -EMSGSIZE;
+        return NULL;
 }
 
-/* ---------------------------------------------------------------- */
-/*
- * Create and broadcast and send it on the standard rtnetlink socket
- * This is a pure clone rtmsg_ifinfo() in net/core/rtnetlink.c
- * Andrzej Krzysztofowicz mandated that I used a IFLA_XXX field
- * within a RTM_NEWLINK event.
- */
-static void rtmsg_iwinfo(struct net_device *dev, char *event, int event_len)
-{
-        struct sk_buff *skb;
-        int err;
-
-        if (!net_eq(dev_net(dev), &init_net))
-                return;
-
-        skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
-        if (!skb)
-                return;
-
-        err = rtnetlink_fill_iwinfo(skb, dev, RTM_NEWLINK, event, event_len);
-        if (err < 0) {
-                WARN_ON(err == -EMSGSIZE);
-                kfree_skb(skb);
-                return;
-        }
-
-        NETLINK_CB(skb).dst_group = RTNLGRP_LINK;
-        skb_queue_tail(&wireless_nlevent_queue, skb);
-        tasklet_schedule(&wireless_nlevent_tasklet);
-}
 
-/* ---------------------------------------------------------------- */
 /*
  * Main event dispatcher. Called from other parts and drivers.
  * Send the event on the appropriate channels.
@@ -1369,7 +1350,7 @@ static void rtmsg_iwinfo(struct net_device *dev, char *event, int event_len)
 void wireless_send_event(struct net_device *    dev,
                          unsigned int           cmd,
                          union iwreq_data *     wrqu,
-                         char *                 extra)
+                         const char *           extra)
 {
         const struct iw_ioctl_description *     descr = NULL;
         int extra_len = 0;
@@ -1379,6 +1360,25 @@ void wireless_send_event(struct net_device *	dev,
         int wrqu_off = 0;                       /* Offset in wrqu */
         /* Don't "optimise" the following variable, it will crash */
         unsigned        cmd_index;              /* *MUST* be unsigned */
+        struct sk_buff *skb;
+        struct nlmsghdr *nlh;
+        struct nlattr *nla;
+#ifdef CONFIG_COMPAT
+        struct __compat_iw_event *compat_event;
+        struct compat_iw_point compat_wrqu;
+        struct sk_buff *compskb;
+#endif
+
+        /*
+         * Nothing in the kernel sends scan events with data, be safe.
+         * This is necessary because we cannot fix up scan event data
+         * for compat, due to being contained in 'extra', but normally
+         * applications are required to retrieve the scan data anyway
+         * and no data is included in the event, this codifies that
+         * practice.
+         */
+        if (WARN_ON(cmd == SIOCGIWSCAN && extra))
+                extra = NULL;
 
         /* Get the description of the Event */
         if (cmd <= SIOCIWLAST) {
@@ -1426,25 +1426,107 @@ void wireless_send_event(struct net_device *	dev,
         hdr_len = event_type_size[descr->header_type];
         event_len = hdr_len + extra_len;
 
-        /* Create temporary buffer to hold the event */
-        event = kmalloc(event_len, GFP_ATOMIC);
-        if (event == NULL)
+        /*
+         * The problem for 64/32 bit.
+         *
+         * On 64-bit, a regular event is laid out as follows:
+         *      |  0  |  1  |  2  |  3  |  4  |  5  |  6  |  7  |
+         *      | event.len | event.cmd |     p a d d i n g     |
+         *      | wrqu data ... (with the correct size)         |
+         *
+         * This padding exists because we manipulate event->u,
+         * and 'event' is not packed.
+         *
+         * An iw_point event is laid out like this instead:
+         *      |  0  |  1  |  2  |  3  |  4  |  5  |  6  |  7  |
+         *      | event.len | event.cmd |     p a d d i n g     |
+         *      | iwpnt.len | iwpnt.flg |     p a d d i n g     |
+         *      | extra data  ...
+         *
+         * The second padding exists because struct iw_point is extended,
+         * but this depends on the platform...
+         *
+         * On 32-bit, all the padding shouldn't be there.
+         */
+
+        skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
+        if (!skb)
+                return;
+
+        /* Send via the RtNetlink event channel */
+        nlh = rtnetlink_ifinfo_prep(dev, skb);
+        if (WARN_ON(!nlh)) {
+                kfree_skb(skb);
+                return;
+        }
+
+        /* Add the wireless events in the netlink packet */
+        nla = nla_reserve(skb, IFLA_WIRELESS, event_len);
+        if (!nla) {
+                kfree_skb(skb);
                 return;
+        }
+        event = nla_data(nla);
 
-        /* Fill event */
+        /* Fill event - first clear to avoid data leaking */
+        memset(event, 0, hdr_len);
         event->len = event_len;
         event->cmd = cmd;
         memcpy(&event->u, ((char *) wrqu) + wrqu_off, hdr_len - IW_EV_LCP_LEN);
-        if (extra)
+        if (extra_len)
                 memcpy(((char *) event) + hdr_len, extra, extra_len);
 
+        nlmsg_end(skb, nlh);
+#ifdef CONFIG_COMPAT
+        hdr_len = compat_event_type_size[descr->header_type];
+        event_len = hdr_len + extra_len;
+
+        compskb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
+        if (!compskb) {
+                kfree_skb(skb);
+                return;
+        }
+
         /* Send via the RtNetlink event channel */
-        rtmsg_iwinfo(dev, (char *) event, event_len);
+        nlh = rtnetlink_ifinfo_prep(dev, compskb);
+        if (WARN_ON(!nlh)) {
+                kfree_skb(skb);
+                kfree_skb(compskb);
+                return;
+        }
 
-        /* Cleanup */
-        kfree(event);
+        /* Add the wireless events in the netlink packet */
+        nla = nla_reserve(compskb, IFLA_WIRELESS, event_len);
+        if (!nla) {
+                kfree_skb(skb);
+                kfree_skb(compskb);
+                return;
+        }
+        compat_event = nla_data(nla);
 
-        return;         /* Always success, I guess ;-) */
+        compat_event->len = event_len;
+        compat_event->cmd = cmd;
+        if (descr->header_type == IW_HEADER_TYPE_POINT) {
+                compat_wrqu.length = wrqu->data.length;
+                compat_wrqu.flags = wrqu->data.flags;
+                memcpy(&compat_event->pointer,
+                        ((char *) &compat_wrqu) + IW_EV_COMPAT_POINT_OFF,
+                        hdr_len - IW_EV_COMPAT_LCP_LEN);
+                if (extra_len)
+                        memcpy(((char *) compat_event) + hdr_len,
+                                extra, extra_len);
+        } else {
+                /* extra_len must be zero, so no if (extra) needed */
+                memcpy(&compat_event->pointer, wrqu,
+                        hdr_len - IW_EV_COMPAT_LCP_LEN);
+        }
+
+        nlmsg_end(compskb, nlh);
+
+        skb_shinfo(skb)->frag_list = compskb;
+#endif
+        skb_queue_tail(&dev_net(dev)->wext_nlevents, skb);
+        schedule_work(&wireless_nlevent_work);
 }
 EXPORT_SYMBOL(wireless_send_event);